bareloop 0.31.0 → 0.32.0

package/src/panel/authorroutes.js

@@ -21,8 +21,13 @@ import { randomBytes } from 'node:crypto';
 import { spawn as realSpawn } from 'node:child_process';
 import { openSync } from 'node:fs';
 import { join } from 'node:path';
-import { createSession, validateJobCard, MODEL_OPTIONS } from './authorsession.js';
-import { resolveProvider, apiKeyProblem, checkProviderReachable } from '../providers.js';
+import { readFileSync } from 'node:fs';
+import { createSession, validateJobCard } from './authorsession.js';
+import { checkMonthlyRoom, monthlyRefusalText } from '../monthly.js';
+import { ConfigError } from '../config.js';
+import { keysForDoor, keysHome } from '../keysfile.js';
+import { keyNameFor, modelChoiceFor, rowsForHome, chatModels, usableKey } from '../providerrows.js';
+import { apiKeyProblem, checkProviderReachable } from '../providers.js';
 
 /** @returns {string} a fresh per-process token — never persisted, never logged */
 export function mintToken() {
@@ -68,10 +73,12 @@ const TERMINAL_PHASES = new Set(['refused', 'abandoned', 'error', 'signed', 'sig
  * deliberately has none of).
  * @param {{ port: number, token: string, env?: Record<string,string|undefined>,
  *   sessionsRoot?: string, spawnFn?: typeof realSpawn, bareloopBin?: string,
- *   jobsDir?: string, fetchImpl?: typeof fetch }} opts
+ *   jobsDir?: string, fetchImpl?: typeof fetch, home?: string }} opts
  */
 export function createAuthorRoutes(opts) {
-  const env = opts.env ?? process.env;
+  // the RAW env with the keys file re-merged on every use, so an edited file takes effect
+  // without a restart (never a start-time snapshot). An injected env with no `home` skips the file.
+  const envNow = () => keysForDoor({ env: opts.env, keysHome: opts.home }).env;
   const spawnFn = opts.spawnFn ?? realSpawn;
   const bareloopBin = opts.bareloopBin ?? new URL('../../bin/bareloop.mjs', import.meta.url).pathname;
   // TEST SEAM ONLY: a test injects a fake `fetch`-shaped function so the
@@ -111,17 +118,17 @@ export function createAuthorRoutes(opts) {
       if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
       const q = new URL(/** @type {string} */ (req.url), 'http://127.0.0.1').searchParams;
       const modelId = q.get('model') ?? '';
-      const choice = MODEL_OPTIONS[modelId];
+      const rows = rowsForHome(keysHome(opts.home));
+      const choice = modelChoiceFor(rows, modelId);
       if (!choice) { send(400, { ok: false, error: `unknown model "${modelId}"` }); return true; }
-      /** @type {any} */
-      let providerEntry;
-      try { providerEntry = resolveProvider(choice.provider); } catch (e) { send(400, { ok: false, error: /** @type {Error} */ (e).message }); return true; }
-      const raw = env[providerEntry.envKey];
+      // the key of the Settings row this Name belongs to
+      const keyName = keyNameFor(choice.provider, choice.baseUrl, rows, choice.name).name;
+      const raw = envNow()[keyName];
       const problem = raw ? apiKeyProblem(raw) : null;
       const keyStatus = !raw ? 'missing' : (problem ? 'bad-shape' : 'found');
       if (keyStatus !== 'found') {
         send(200, {
-          ok: true, envKey: providerEntry.envKey, keyStatus, keyProblem: problem,
+          ok: true, envKey: keyName, keyStatus, keyProblem: problem,
           reachability: { checked: false, reachable: null, modelListed: null, status: null, note: 'no usable key to check reachability with' },
         });
         return true;
@@ -130,12 +137,12 @@ export function createAuthorRoutes(opts) {
       // `checkProviderReachable`'s own doc) — a short timeout so a flaky
       // endpoint never hangs the card.
       checkProviderReachable({
-        providerName: choice.provider, apiKey: /** @type {string} */ (raw), model: providerEntry.tiers.sonnet,
+        providerName: choice.provider, apiKey: /** @type {string} */ (usableKey(raw)), model: choice.name,
         baseUrl: choice.baseUrl, fetchImpl, timeoutMs: 4000,
       }).then((r) => {
         send(200, {
           ok: true,
-          envKey: providerEntry.envKey,
+          envKey: keyName,
           keyStatus,
           keyProblem: null,
           reachability: {
@@ -146,13 +153,39 @@ export function createAuthorRoutes(opts) {
       return true;
     }
 
+    // ── P4a: the monthly-limit note under the cap field. READ-ONLY, $0 — the same
+    // library check (`checkMonthlyRoom`, src/monthly.js) the run-start seam and the
+    // Sign refusal use, so the note the person sees is never a second opinion. The
+    // page is never the arbiter: Sign & run re-checks server-side regardless.
+    // ── P4b: Chat's Model menu IS the Settings rows (a blank Name is not offered). ──
+    if (pathname === '/api/author/models') {
+      if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
+      send(200, { ok: true, models: chatModels(rowsForHome(keysHome(opts.home))) });
+      return true;
+    }
+
+    if (pathname === '/api/author/monthly-check') {
+      if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
+      const q = new URL(/** @type {string} */ (req.url), 'http://127.0.0.1').searchParams;
+      const cap = Number(q.get('cap'));
+      if (!Number.isFinite(cap) || cap <= 0) { send(200, { ok: true, refusal: null }); return true; }
+      try {
+        const room = checkMonthlyRoom({ capUsd: cap, home: opts.home });
+        send(200, { ok: true, refusal: monthlyRefusalText(room), leftUsd: room.leftUsd, atLeast: room.atLeast });
+      } catch (e) {
+        if (!(e instanceof ConfigError)) throw e;
+        send(200, { ok: true, refusal: null, configProblem: e.message });
+      }
+      return true;
+    }
+
     if (pathname === '/api/author/start') {
       if (req.method !== 'POST') { send(405, { ok: false, error: 'POST only' }); return true; }
       if (hasLiveSession()) { send(409, { ok: false, error: 'an authoring session is already live — one at a time' }); return true; }
       const card = body ?? {};
-      const v = validateJobCard(card);
+      const v = validateJobCard(card, { jobsDir: opts.jobsDir, rows: rowsForHome(keysHome(opts.home)) });
       if (!v.ok) { send(400, { ok: false, error: v.error }); return true; }
-      const session = createSession(card, { env, sessionsRoot: opts.sessionsRoot });
+      const session = createSession(card, { env: envNow(), sessionsRoot: opts.sessionsRoot, ...(opts.home !== undefined ? { home: opts.home } : {}) });
       sessions.set(session.id, session);
       send(200, { ok: true, sessionId: session.id, state: session.state });
       return true;
@@ -192,7 +225,7 @@ export function createAuthorRoutes(opts) {
     }
     if (sub === 'sign') {
       const claimedHash = String(body?.specHash ?? '');
-      const r = signRun(session, claimedHash, { env, spawnFn, bareloopBin, sessionsRoot: opts.sessionsRoot });
+      const r = signRun(session, claimedHash, { env: envNow(), spawnFn, bareloopBin, sessionsRoot: opts.sessionsRoot, home: opts.home });
       send(r.ok ? 200 : 400, r);
       return true;
     }
@@ -234,13 +267,25 @@ function panelMoney2(n) {
  * it to sign"), and this is where it is checked, not trusted.
  * @param {ReturnType<typeof createSession>} session
  * @param {string} claimedHash
- * @param {{env: any, spawnFn: typeof realSpawn, bareloopBin: string, sessionsRoot?: string}} o
+ * @param {{env: any, spawnFn: typeof realSpawn, bareloopBin: string, sessionsRoot?: string, home?: string}} o
  * @returns {{ok: boolean, error?: string, job?: string}}
  */
 export function signRun(session, claimedHash, o) {
   if (session.state.phase !== 'prepared') return { ok: false, error: `session is not prepared (phase=${session.state.phase}) — nothing to sign` };
   if (!session.state.specHash || claimedHash !== session.state.specHash) return { ok: false, error: 'spec hash mismatch — refusing to sign' };
   if (!session.state.resolvedSpecPath) return { ok: false, error: 'no resolved spec on disk — refusing to sign' };
+  // P4a — the monthly $ limit REFUSES here too, server-side, before anything is spawned
+  // (the page's note is a courtesy; this is the check). Same library call, same text as
+  // the run-start seam in src/userrun.js. The session stays `prepared`, so the person can
+  // lower nothing (the cap is signed in) but may raise the limit in Settings and sign again.
+  try {
+    const spec = JSON.parse(readFileSync(session.state.resolvedSpecPath, 'utf8'));
+    const refusal = monthlyRefusalText(checkMonthlyRoom({ capUsd: Number(spec.budgetUsd), home: o.home }));
+    if (refusal !== null) return { ok: false, error: refusal };
+  } catch (e) {
+    if (e instanceof ConfigError) return { ok: false, error: `${e.message} — refusing rather than guess the monthly limit` };
+    return { ok: false, error: 'could not read the signed spec to check the monthly limit — refusing to sign' };
+  }
   const logFile = join(session.state.outDir, 'run.log');
   // array argv, never a shell string — `--approve <hash>` is a literal
   // element, checkable byte-for-byte by a test stubbing `spawnFn`, and there

package/src/panel/authorsession.js

@@ -20,10 +20,11 @@
 // `src/panel/server.js`'s POST routes). Nothing here changes what a step
 // means or what an answer does — only where the answer comes from.
 
+import { applyConfiguredKey, keyNameFor, modelChoiceFor, rowsForHome } from '../providerrows.js';
 import {
   mkdirSync, existsSync, writeFileSync, readdirSync,
 } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { join, resolve, dirname } from 'node:path';
 import {
   prepareSource, proveDestination, missingDependencies, looksLikeRepoSource,
 } from '../source.js';
@@ -46,20 +47,6 @@ import { closeJudges } from '../kinds.js';
 import { redactSecrets } from '../validate.js';
 import { tallyCalls } from '../text.js';
 
-/**
- * The job card's "Model" select — a fixed, small, source-grounded mapping
- * from a display id to the `{provider, baseUrl?}` pair `src/interviewrun.js`
- * itself documents (that script's own `--provider openai-api --base-url
- * https://api.deepseek.com/v1` usage line for DeepSeek): the panel builds no
- * provider table of its own, this is a UI convenience over the SAME two
- * provider identities the CLI already resolves through `resolveProvider`.
- * @type {Readonly<Record<string, {provider: string, baseUrl?: string}>>}
- */
-export const MODEL_OPTIONS = Object.freeze({
-  'claude-sonnet-5': Object.freeze({ provider: 'anthropic-api' }),
-  'deepseek-flash': Object.freeze({ provider: 'openai-api', baseUrl: 'https://api.deepseek.com/v1' }),
-});
-
 /**
  * Plain-language labels for the library's own `onPhase(name, …)` calls
  * (`src/authorjob.js`/`src/authorflow.js`) — build item 3's progress
@@ -126,17 +113,18 @@ export function jobNameTaken(name, opts = {}) {
  * creates a session or spends anything — never inside the async pipeline,
  * so a bad card refuses synchronously, in the same HTTP response.
  * @param {any} card
+ * @param {{jobsDir?: string, rows?: readonly import('../providerrows.js').KeyRow[]}} [opts] `rows` = the Settings rows (the Model menu); jobsDir is a server-side test seam — NEVER read off the client card
  * @returns {{ok: true}|{ok: false, error: string}}
  */
-export function validateJobCard(card) {
+export function validateJobCard(card, opts = {}) {
   if (!card || typeof card !== 'object') return { ok: false, error: 'missing job card' };
   const { jobName, checkType, model, goal, source, destination, success, guardrails, capUsd } = card;
   if (!isSlug(jobName)) return { ok: false, error: 'Job name must be a kebab-case slug (letters, digits, dashes)' };
-  if (jobNameTaken(jobName, card.jobsDirOverride ? { jobsDir: card.jobsDirOverride } : {})) {
+  if (jobNameTaken(jobName, { jobsDir: opts.jobsDir })) {
     return { ok: false, error: `a job named "${jobName}" already exists — P3 is new jobs only (Q4=A)` };
   }
   if (checkType !== 'deterministic' && checkType !== 'rubric') return { ok: false, error: 'Check type must be deterministic or rubric' };
-  if (!MODEL_OPTIONS[model]) return { ok: false, error: `Model must be one of: ${Object.keys(MODEL_OPTIONS).join(', ')}` };
+  if (!modelChoiceFor(opts.rows ?? [], model)) return { ok: false, error: 'Model must be one of the Names in Settings > Providers' };
   for (const [field, label] of [[goal, 'Goal'], [source, 'Source'], [destination, 'Destination'], [success, 'Success'], [guardrails, 'Guardrails']]) {
     if (typeof field !== 'string' || field.trim() === '') return { ok: false, error: `${label} is required` };
   }
@@ -155,7 +143,7 @@ export function validateJobCard(card) {
  * is the ONE thing a person answers next; `answer()`/`send()`/`revise()`/
  * `signPrepare()` are the only ways in.
  * @param {any} card the validated job card (see {@link validateJobCard})
- * @param {{env?: Record<string,string|undefined>, sessionsRoot?: string, timeoutMs?: number,
+ * @param {{env?: Record<string,string|undefined>, sessionsRoot?: string, home?: string, timeoutMs?: number,
  *   scout?: any, generate?: Function, confirmGenerate?: Function, authorFn?: Function,
  *   prepareSigningFn?: Function}} [deps] the last five are TEST SEAMS ONLY — see the note
  *   just above where each is read, below.
@@ -164,6 +152,8 @@ export function validateJobCard(card) {
 export function createSession(card, deps = {}) {
   const env = deps.env ?? process.env;
   const sessionsRoot = deps.sessionsRoot ?? join(process.env.HOME ?? '/tmp', '.config', 'bareloop', 'panel-sessions');
+  // config.json lives beside the sessions dir (~/.config/bareloop) unless a home is injected
+  const configHome = deps.home ?? dirname(sessionsRoot);
   const timeoutMs = deps.timeoutMs ?? 300_000;
   // TEST SEAMS ONLY (never set by `src/panel/authorroutes.js`'s real caller):
   // override the declaration composer and/or `prepareSigning` itself so a
@@ -309,13 +299,19 @@ export function createSession(card, deps = {}) {
 
   async function run() {
     // ── keys, at $0, before anything is prepared ────────────────────────
-    const modelChoice = MODEL_OPTIONS[card.model];
+    const keyRows = rowsForHome(configHome);
+    const modelChoice = modelChoiceFor(keyRows, card.model);
+    if (!modelChoice) { refuse(`Model "${card.model}" is not a Name in Settings > Providers. Stopped — nothing spent.`); return; }
     let providerEntry;
     try { providerEntry = resolveProvider(modelChoice.provider); } catch (e) { refuse(/** @type {Error} */ (e).message); return; }
-    const apiKey = env[providerEntry.envKey];
-    if (!apiKey) { refuse(`${providerEntry.envKey} not set. Stopped — nothing spent.`); return; }
+    // P4a item 4 — the key variable the person picked in Settings stands in for the built-in one
+    const keyCfg = keyRows;
+    const draftEnv = applyConfiguredKey(env, modelChoice.provider, modelChoice.baseUrl, keyCfg, modelChoice.name);
+    const draftKeyName = keyNameFor(modelChoice.provider, modelChoice.baseUrl, keyCfg, modelChoice.name).name;
+    const apiKey = draftEnv[providerEntry.envKey];
+    if (!apiKey) { refuse(`${draftKeyName} not set. Stopped — nothing spent.`); return; }
     const keyProblem = apiKeyProblem(apiKey);
-    if (keyProblem) { refuse(`${providerEntry.envKey} ${keyProblem}. Stopped — nothing spent.`); return; }
+    if (keyProblem) { refuse(`${draftKeyName} ${keyProblem}. Stopped — nothing spent.`); return; }
 
     const verdictType = card.checkType === 'rubric' ? 'soft-green' : 'green';
     const into = join(outDir, 'source-seed');
@@ -389,6 +385,8 @@ export function createSession(card, deps = {}) {
       description: `${card.jobName} — authored through the bareloop panel (${verdictType}, ${LANG})`,
       provider: modelChoice.provider,
       ...(modelChoice.baseUrl ? { baseUrl: modelChoice.baseUrl } : {}),
+      // the Name is the model id: signed into the spec only when it is not the provider's own default
+      ...(modelChoice.name !== providerEntry.tiers.sonnet ? { model: modelChoice.name } : {}),
       cadence: { unit: 'day', every: 1 },
       budgetUsd: card.capUsd,
       ...(typeof card.maxWallMs === 'number' ? { maxWallMs: card.maxWallMs } : {}),
@@ -414,7 +412,7 @@ export function createSession(card, deps = {}) {
     const draftJudge = (() => {
       try { return resolveJobJudge(draft, modelChoice.provider, resolveWorkerModel); } catch { return { provider: modelChoice.provider, model: providerEntry.tiers.sonnet }; }
     })();
-    const MODEL = providerEntry.tiers.sonnet;
+    const MODEL = modelChoice.name;
     const { provider } = buildRunnerProviders({
       providerName: modelChoice.provider, apiKey, model: MODEL, tierModels: providerEntry.tiers, baseUrl: modelChoice.baseUrl,
       judgeApiKey: apiKey, judgeModel: MODEL, judgeProviderName: modelChoice.provider, judgeBaseUrl: modelChoice.baseUrl,
@@ -473,7 +471,7 @@ export function createSession(card, deps = {}) {
     const judge = judges ? resolveJobJudge(spec, modelChoice.provider, resolveWorkerModel) : null;
     let judgeProvider = null;
     if (judge) {
-      const judgeKeyValue = env.JUDGE_API_KEY ?? env[resolveProvider(judge.provider).envKey];
+      const judgeKeyValue = env.JUDGE_API_KEY ?? (judge.provider === modelChoice.provider ? draftEnv : applyConfiguredKey(env, judge.provider, undefined, keyCfg, judge.model))[resolveProvider(judge.provider).envKey];
       const judgeKeyProblem = judgeKeyValue ? apiKeyProblem(judgeKeyValue) : null;
       if (!judgeKeyValue || judgeKeyProblem) {
         refuse(`the judge key is not usable (${judgeKeyProblem ?? 'not set'}) — refusing before gate 4 spends anything`);