bareloop 0.31.0 → 0.33.0

package/CHANGELOG.md

@@ -5,6 +5,157 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.33.0] — 2026-09-30
+
+### Added
+
+- **Your own price, per key row.** `config.json` `keys.<ENV NAME>.priceInPerM` / `priceOutPerM` (USD per
+  1M tokens, in and out; both or neither, each a finite number 0 or more) set what the model behind a key
+  costs. `ratesFor(provider, baseUrl, rows, model)` (`src/providerrows.js`) is the one lookup, on the same
+  row `keyNameFor` picks the key from. The run doors (`run-u` / `run <bundle>` / the panel via
+  `src/userrun.js`, `run-author`, the panel's authoring session) resolve it once at $0 and hand it to every
+  model call as bare-agent's `Loop({ rates })`: worker, scout and planner rounds, the drafter and confirm
+  turn, and the judge (priced at the judge model's own row; falls back to the worker's price when the model
+  names no row on that endpoint — `judgeRatesFor`). Priced rounds read `rateSource:'caller'`. A bad
+  price (one field, negative, non-number) refuses the run at $0 with "Nothing spent." and never falls back
+  to the guess. No price = no `rates` key = the built-in guess, unchanged. The run preview and run tail print
+  `price    yours: in $0.006 / out $1.20 per 1M tokens (DEEPSEEK_API_KEY row)` when a price is set. New:
+  `runJob` / `runPlan` options `rates` / `judgeRates`; `runAuthorScout`, `authorCloseForJob`,
+  `makeLoopGenerate` and `defaultJudgeLoop` take an optional `rates`. The Settings screen field is a later
+  UI part; until then edit `config.json`. Past runs are not re-priced. Not covered: native (CLI) sessions
+  (they report their own cost) and the reuse engine (`runReuse`), which resolves no key row.
+
+### Changed
+
+- **Monthly limit: a run claims its cap at start and holds it until it is done.** The run-start seam
+  writes the run's row FIRST (now carrying `pid` and `capUsd`; no lock file — records only), then reads
+  `runs.jsonl`: only the claims above its own row count, so whoever runs first holds. A run whose pid is
+  a live bareloop runner stays held at its full cap however quiet its spine (no more 10-minute silence
+  drop); a dead run's claim is closed by whoever finds it, with an attributed `settled` note
+  (`process gone`, first note wins); a run that does not fit appends a `released` entry and refuses
+  with the exact `Max $X (monthly limit)` text. A finished run appends its own `settled` entry. Old
+  rows without a `pid` keep the spine-mtime rule. The `resumingSpine` special case is gone (a resumed
+  leg's dead process already counts at its floor). `--resume`'s "is the old process alive" check now
+  recognises `bareloop run-u` / `bareloop run` and shares `isLiveRunner`.
+  `isLiveRunner` now needs a node executable (or a runner-named argv[0]) plus a runner-named argument, so a
+  recycled pid running e.g. `nvim` on a bareloop path no longer holds a dead run's cap; a claimed run (or, with no monthly limit, a listed one) that
+  exits at $0 before its spine exists is released (`reason: 'not started'`) instead of leaving a ghost row.
+- **One runner: `bareloop run <bundle>` is now a thin door to the `run-u` engine.** The exported
+  bundle CLI no longer carries its own `runJob` caller (`doRun`) and provider wiring
+  (`buildProviders`); `src/bundlerun.js` keeps only the bundle checks (integrity, deps, envelope,
+  blessing before any key read), the tightened spec, the fresh worktree, the history row, the
+  first-green blessing and the merge hints. Consequences: a bundle can name any provider whose key
+  is in your keys file or env (the ANTHROPIC-only refusal is gone); the **monthly $ limit now
+  applies to a bundle** run (exit 2, nothing spent, no worktree); a missing key is the engine's
+  refusal, **exit 2 naming the key** (it used to print the bundle README and exit 0 — the README now
+  prints on the unblessed first-run screen); the close-fix cap for a bundle is run-u's 4 (was 3 —
+  one number for every caller); the outside watchdog now guards a bundle run; a bundle green mints
+  no bridge file; the engine's job-end tail read tolerates a torn spine line (as the bundle door's
+  already did).
+- **`bareloop run <bundle> --resume <runid> [--repo <path>]`** — a halted bundle run resumes into
+  its own worktree through the engine's resume gates and spend fold. Each run leg writes
+  `runs/<runid>/run.json`; a resume's `history.jsonl` row carries `resumedFrom`. Proven with tests against a real git worktree and a scripted
+  provider; not run live.
+
+### Fixed
+
+- **The outside watchdog now ships in the package (F205).** `scripts/u-watchdog.mjs` moved to
+  `src/u-watchdog.mjs`: `package.json` `files` omits `scripts/`, so an installed run spawned a guard
+  whose script did not exist and it died silently at startup.
+- **The bare `bareloop` menu's "2 run" now honours the monthly limit.** It handed the bundle door no keys
+  home, so the limit, your price and the key-row choice were all off; it now gets the same home
+  `bareloop run <bundle>` does.
+- **A halted bundle run's printed resume command keeps your tightened `--budget` / `--wall`.** It used to drop
+  them, so the next leg silently reverted to the signed ceiling. The money-halt hint for a bundle no longer
+  says to edit `budgetUsd` (a bundle's spec is manifest-hashed and cannot be edited).
+  After a MONEY halt the line does not repeat the exhausted `--budget` (chain spend is folded, so pasting it
+  halted again at once); it prints `--budget <more than $<spent so far>, at most $<signed budgetUsd>>` for the
+  person to fill in, and the lever list says to choose a larger `--budget` up to the signed amount. Nothing is
+  filled in automatically. Other halts keep your tightened `--budget` / `--wall` as before. Printed text only.
+- **Printed commands no longer name scripts the package does not ship.** Entered through `bareloop run-u` /
+  `interview` / `author`, the approve, resume, pause and reopen lines (and the interview's run-author line and
+  the author's run-u line) now read `bareloop run-u …` etc.; `node scripts/*.mjs` is printed only from the
+  source-tree scripts. One owner for the spelling: `commandFor` in `src/invoke.js`.
+- **Printed copy-paste commands name the key variable the run reads and carry `--registry` / `--workflow`.**
+  The approve and resume lines from `run-u` and `run-author` used to leave these out, so a pasted line could
+  read a different key row or drop the run-list registration (F207 b). Printed text only.
+
+### Removed
+
+- `doRun`/`buildProviders` in `src/cli.js` and the `resumable: false` wiring for bundles (F130).
+
+## [0.32.0] — 2026-09-29
+
+### Added
+
+- **Panel Settings (P4a)** — `~/.config/bareloop/.env` keys-file loader (shell env wins; keys
+  never reach the page), `config.json` (monthly $ limit, chosen key variables, Anthropic balance
+  note), a monthly $ limit that refuses a run start with `Max $X (monthly limit)` at both
+  `run-u` and the panel Sign & run, and a Settings view with a Money & limits tab and a Providers
+  tab (read, $0 Test, key-name dropdown). Add/edit/remove providers is P4b. There is no monthly
+  time limit. **The monthly limit is checked by `run-u` and the panel only — `bareloop run
+  <bundle>` does not check it.** An unreadable `config.json` refuses a run start; a month whose
+  spend is incomplete reads "at least".
+- **Money & limits tab** — total and this-month spend and tokens as two header tiles ($ and
+  tokens, month first), a monthly $ limit that saves on change, and a per-provider breakdown
+  table ($, wall minutes, tokens; this month and to date). Wall time is job-start to job-end
+  when the run ended, otherwise an "at least" floor; unknown is shown as unknown, never 0. A
+  spine with no recorded provider is labelled "not recorded (model X)", never guessed from the
+  model name.
+- **`replay-live --live-audit`** (`scripts/replay-live.mjs`) — opt-in: a $0 replay keeps its
+  sidecar in a scratch patient dir while it paces, so the panel's live tool-log fallback can be
+  seen on screen. Default replay is unchanged.
+- **Panel Providers tab is the keys file (P4b)** — one Settings row per key in
+  `~/.config/bareloop/.env` that has a value (the file is created with five empty preset lines,
+  `ANTHROPIC_API_KEY` / `DEEPSEEK_API_KEY` / `OPENAI_API_KEY` / `GEMINI_API_KEY` / `LOCAL_API_KEY`,
+  when missing; an existing file is never edited). Each row has an editable Name (the model id Chat
+  uses), API shape (Anthropic / OpenAI-compatible / Gemini), Base URL, a $0 Test at that shape and
+  URL, and a total Tokens used; changes save to `config.json` `keys.<ENV NAME>`. A key value of
+  `null` counts as set and means "no real key" (local servers); the provider gets a placeholder,
+  and local rounds price as an `estimated` guess, never a real $0. Reload keys re-merges the
+  keys file onto the shell environment per request, so edits and removals take effect without a
+  restart. Chat's Model menu is the Settings
+  rows, and one owner (`src/providerrows.js`) resolves model to key + shape + URL for Chat, the
+  author doors and the run doors.
+- **Providers tab names a shell-only key** — a preset key variable exported only in the shell
+  (not in the keys file) gets no row and no Chat model; the tab now says so under the table, by
+  name only (`GET /api/settings/providers` returns `shellOnly: string[]`, never a value).
+
+### Changed
+
+- **Panel: no price is displayed** — the Providers table Price column and the Chat job card's
+  Token price field are removed. Display only: cost recording, the `estimated` provenance, spend
+  sums, caps and the monthly limit are unchanged.
+- The Chat cap row is two equal full-width columns (Cap $ | Time cap) at every width.
+- `config.json` `providers.<row>.key` (P4a key-name dropdown) is replaced by
+  `keys.<ENV NAME> = { name, shape, baseUrl }`; the hardcoded `PROVIDER_ROWS` and the panel's fixed
+  `MODEL_OPTIONS` are gone.
+- **Monthly limit counts running jobs at their full cap** — a run still in flight (no `job-end`,
+  spine written to within the panel's died window) is counted against the limit at its own leg
+  cap, not its spend so far, so two runs cannot both start against a limit only one fits. A died
+  run still counts its floor. The Money tab's "$ month" stays real spend.
+
+### Fixed
+
+- **Monthly limit no longer double-counts a resume** — `run-u --resume` on a leg killed within
+  `DIED_MTIME_MS` reserved the old leg at its full cap AND asked for the remainder, so a resume
+  that fit was refused; the resumed leg now counts its real spend only
+  (`checkMonthlyRoom({ resumingSpine })`).
+- **`POST /api/settings/money` no longer clears the limit on a bad body** — an empty or
+  unparseable body, or JSON without the `monthlyLimitUsd` key, is a 400 and leaves `config.json`
+  alone; only an explicit `null` or blank clears the limit.
+- **A bad `monthlyLimitUsd` no longer reads as "no limit"** — a `monthlyLimitUsd` present in
+  `config.json` but not a number above 0 (`"50"`, `-5`, `0`, `true`, `{}`) now refuses the run
+  start and shows as a config problem on the Money tab, like an unparseable file. Absent or
+  `null` still means no limit.
+- **Panel author routes: `jobsDir` and body size** — the name-collision check's `jobsDir` test
+  seam is now server-side only (it was readable off the client's job card, so any
+  `/api/author/start` body could repoint it), and POST bodies over 1 MiB get 413 and the request
+  is destroyed (the reader had no cap and ran before the click guard).
+- **Providers Test** — a connection failure now reads "nothing answering at <URL>"; the Test
+  cell keeps a fixed width and wraps its result. **Tokens used** counts older model-only spines
+  toward the row whose Name exactly equals the model.
+
 ## [0.31.0] — 2026-09-29
 
 ### Added

package/README.md

@@ -143,7 +143,10 @@ bareloop run ./my-maintainer.bareloop --repo /path/to/checkout --approve <bundle
 `export` only ships a job that has already earned a real green — it refuses to bundle an
 unproven draft. The first `run` on a new machine asks you to approve the bundle's printed
 hash; once that run goes green, later runs need no re-approval as long as the bundle stays
-unchanged. Every run works in its own fresh git worktree and leaves the merge to you. Full
+unchanged. Every run works in its own fresh git worktree and leaves the merge to you. `bareloop
+run` is a door to the same engine as `bareloop run-u`, so it uses any provider your keys file
+has, honours the monthly limit, and a halted run can be continued with
+`bareloop run <bundle> --resume <runid>`. Full
 contract — flags, approval/blessing rules, exit codes — in
 [`bareloop.context.md`](bareloop.context.md).