bareloop 0.31.0 → 0.33.0

package/types/authorrun.d.ts

@@ -1,6 +1,7 @@
 /**
  * @typedef {object} Deps
  * @property {Record<string,string|undefined>} [env]
+ * @property {string} [keysHome] P4a — test seam: load this home's `.env` keys file even when `env` is injected.
  * @property {NodeJS.ReadStream} [stdin]
  * @property {NodeJS.WritableStream} [stdout]
  * @property {NodeJS.WritableStream} [stderr]
@@ -23,6 +24,10 @@
 export function main(argv: string[], deps?: Deps): Promise<number>;
 export type Deps = {
     env?: Record<string, string | undefined> | undefined;
+    /**
+     * P4a — test seam: load this home's `.env` keys file even when `env` is injected.
+     */
+    keysHome?: string | undefined;
     stdin?: NodeJS.ReadStream | undefined;
     stdout?: NodeJS.WritableStream | undefined;
     stderr?: NodeJS.WritableStream | undefined;

package/types/authorscout.d.ts

@@ -93,13 +93,14 @@ export function defaultSurveyor({ workdir, granted, auditPath, ctx }: {
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
  *   attempts?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
  *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
- *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any}) => any,
+ *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any, rates?: {in: number, out: number}}) => any,
+ *   rates?: {in: number, out: number}|null,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
  * @returns {Promise<Survey & {raw: string, raws: ReturnType<typeof scrubRaw>[],
  *   calls: {label: string, costUsd: number|null, unpricedRounds: number}[],
  *   budgetStop: 'cap-halt'|'pricing-red'|null}>}
  */
-export function runAuthorScout({ workdir, provider, rounds, minBytes, blobMax, maxTokens, ctx, attempts, ceilingUsd, callTimeoutMs, onCall, createLoop, createSurveyor, }: {
+export function runAuthorScout({ workdir, provider, rounds, minBytes, blobMax, maxTokens, ctx, attempts, ceilingUsd, callTimeoutMs, onCall, createLoop, rates, createSurveyor, }: {
     workdir: string;
     provider?: any;
     rounds?: number;
@@ -120,7 +121,15 @@ export function runAuthorScout({ workdir, provider, rounds, minBytes, blobMax, m
         policy: any;
         onLlmResult: any;
         provider: any;
+        rates?: {
+            in: number;
+            out: number;
+        };
     }) => any;
+    rates?: {
+        in: number;
+        out: number;
+    } | null;
     createSurveyor?: (o: {
         workdir: string;
         granted: readonly string[];

package/types/bundlerun.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `bareloop run <bundleDir> --repo <path> [--budget N] [--wall MIN] [--approve <bundleHash>]`
+ * `bareloop run <bundleDir> --resume <runid> [--repo <path>] [--budget N] [--wall MIN] [--approve <bundleHash>]`
+ * @param {string[]} args
+ * @param {{
+ *   out: (s: string) => void, err: (s: string) => void, cwd: string,
+ *   env: Record<string,string|undefined>, now: () => number, deps: any, keysHome?: string,
+ *   parseFlags: (a: string[]) => { positional: string[], flags: Record<string, string|true> },
+ *   printReds: (reds: import('./bundle.js').Red[], err: (s: string) => void) => void,
+ * }} ctx
+ * @returns {Promise<number>}
+ */
+export function bundleMain(args: string[], { out, err, cwd, env, now, deps, keysHome, parseFlags, printReds, }: {
+    out: (s: string) => void;
+    err: (s: string) => void;
+    cwd: string;
+    env: Record<string, string | undefined>;
+    now: () => number;
+    deps: any;
+    keysHome?: string;
+    parseFlags: (a: string[]) => {
+        positional: string[];
+        flags: Record<string, string | true>;
+    };
+    printReds: (reds: import("./bundle.js").Red[], err: (s: string) => void) => void;
+}): Promise<number>;

package/types/cli.d.ts

@@ -3,7 +3,7 @@
  * code, so `bin/bareloop.mjs` can set `process.exitCode` and let node flush
  * queued stdout on its own (F-something: `process.exit()` can discard it).
  * @param {string[]} argv
- * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, judgeModel?: string|null, now?: () => number, stdin?: any, runlistHome?: string }} deps
+ * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, judgeModel?: string|null, now?: () => number, stdin?: any, runlistHome?: string, keysHome?: string }} deps
  * @returns {Promise<number>}
  */
 export function main(argv: string[], deps?: {
@@ -18,4 +18,5 @@ export function main(argv: string[], deps?: {
     now?: () => number;
     stdin?: any;
     runlistHome?: string;
+    keysHome?: string;
 }): Promise<number>;

package/types/config.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @param {string} [home] test seam; production never passes it
+ * @returns {string} `<home>/config.json`
+ */
+export function configPath(home?: string): string;
+/**
+ * @typedef {object} ConfigRead
+ * @property {Record<string, any>} config the parsed document ({} when missing/unreadable)
+ * @property {boolean} exists
+ * @property {string|null} problem plain words when the file is there but unreadable
+ */
+/**
+ * @param {{ home?: string }} [opts]
+ * @returns {ConfigRead}
+ */
+export function readConfig(opts?: {
+    home?: string;
+}): ConfigRead;
+/**
+ * Apply a patch and write. `null` deletes a field. Top-level fields shallow-merge;
+ * `keys` merges per key variable name, then per field. Validated before anything is
+ * written; nothing is written on a refusal.
+ *
+ * Patch fields understood: `monthlyLimitUsd` (finite > 0), `anthropicBalanceNote`
+ * (finite >= 0), `keys.<ENV NAME>.{name,shape,baseUrl}` (Name = a model id, shape = a provider table name, baseUrl = blank or http(s)). Any other
+ * field is passed through untouched (kept), but the whole document is swept for
+ * secret-shaped strings first.
+ * @param {Record<string, any>} patch
+ * @param {{ home?: string }} [opts]
+ * @returns {Record<string, any>} the document as written
+ */
+export function updateConfig(patch: Record<string, any>, opts?: {
+    home?: string;
+}): Record<string, any>;
+/** A plain-words config failure (bad value, secret-shaped string, unreadable file). */
+export class ConfigError extends Error {
+}
+export type ConfigRead = {
+    /**
+     * the parsed document ({} when missing/unreadable)
+     */
+    config: Record<string, any>;
+    exists: boolean;
+    /**
+     * plain words when the file is there but unreadable
+     */
+    problem: string | null;
+};

package/types/interviewrun.d.ts

@@ -1,6 +1,7 @@
 /**
  * @typedef {object} Deps
  * @property {Record<string,string|undefined>} [env]
+ * @property {string} [keysHome] P4a — test seam: load this home's `.env` keys file even when `env` is injected.
  * @property {NodeJS.ReadStream} [stdin]
  * @property {NodeJS.WritableStream} [stdout]
  * @property {NodeJS.WritableStream} [stderr]
@@ -25,6 +26,10 @@
 export function main(argv: string[], deps?: Deps): Promise<number>;
 export type Deps = {
     env?: Record<string, string | undefined> | undefined;
+    /**
+     * P4a — test seam: load this home's `.env` keys file even when `env` is injected.
+     */
+    keysHome?: string | undefined;
     stdin?: NodeJS.ReadStream | undefined;
     stdout?: NodeJS.WritableStream | undefined;
     stderr?: NodeJS.WritableStream | undefined;

package/types/invoke.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The command that runs `flow`, spelled the way the caller reached this flow: `bareloop <flow>`
+ * when `invokedAs` names the CLI, else the source-tree script.
+ * @param {Flow} flow @param {string|undefined} invokedAs
+ * @returns {string}
+ */
+export function commandFor(flow: Flow, invokedAs: string | undefined): string;
+export type Flow = "run-u" | "interview" | "author";

package/types/judged.d.ts

@@ -382,9 +382,13 @@ export const JUDGE_RULE_IDS: readonly string[];
 export const CALIBRATION_SIZE: 10;
 /** the two verdicts a case may expect — `decide()`'s own closed set */
 export const CASE_VERDICTS: readonly string[];
-export function defaultJudgeLoop({ provider, system }: {
+export function defaultJudgeLoop({ provider, system, rates }: {
     provider: any;
     system: string;
+    rates?: {
+        in: number;
+        out: number;
+    } | null;
 }): import("bare-agent").Loop;
 export type RuleRed = {
     fn: string;

package/types/keysfile.d.ts

@@ -0,0 +1,90 @@
+/**
+ * `~/.config/bareloop` (or the injected override) — same home every other
+ * per-person file (runs.jsonl, config.json) lives in.
+ * @param {string} [home] test seam; production never passes it
+ * @returns {string}
+ */
+export function keysHome(home?: string): string;
+/**
+ * @param {string} [home]
+ * @returns {string} `<home>/.env`
+ */
+export function keysFilePath(home?: string): string;
+/**
+ * Parse the file's text. Lines that are not `NAME=value` are skipped silently
+ * (never echoed — a malformed line may hold a secret).
+ * @param {string} text
+ * @returns {Record<string,string>}
+ */
+export function parseKeysText(text: string): Record<string, string>;
+/**
+ * The NAMES in the file that carry a non-empty value, in file order — the Providers rows
+ * (an empty preset line is not a row). Names only; a missing/unreadable file = none.
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+export function filledKeyNames(home?: string): string[];
+/**
+ * Create the keys file with the five empty preset lines when — and only when — it does not
+ * exist (mode 600). An existing file is never touched.
+ * @param {readonly string[]} presetNames the names to seed, in order
+ * @param {string} [home]
+ * @returns {boolean} true if it was created
+ */
+export function ensureKeysFile(presetNames: readonly string[], home?: string): boolean;
+/**
+ * @typedef {object} KeysLoad
+ * @property {boolean} exists the file is there
+ * @property {string[]} names the NAMES the file defines (sorted; never values)
+ * @property {string|null} warning a plain-words warning (file readable by others, or
+ *   unreadable), else null — a warning, never a refusal
+ * @property {Record<string,string|undefined>} env shell env with the file filling the
+ *   names the shell does not set. THE ONLY place values leave this module.
+ */
+/**
+ * Load the keys file over an env. Missing file is fine (no names, env unchanged).
+ * @param {{ env?: Record<string,string|undefined>, home?: string }} [opts]
+ * @returns {KeysLoad}
+ */
+export function loadKeysEnv(opts?: {
+    env?: Record<string, string | undefined>;
+    home?: string;
+}): KeysLoad;
+/**
+ * The door helper the CLI and the panel call: load the file only when the caller is
+ * on the REAL environment (no injected env) or names a keys home explicitly — so a
+ * test that injects `env` alone never reads the real `~/.config/bareloop/.env`.
+ * @param {{ env?: Record<string,string|undefined>, keysHome?: string }} deps
+ * @returns {KeysLoad & { env: Record<string,string|undefined>, home: string|undefined }}
+ *   `home` = the home the file was loaded from (the real `~/.config/bareloop` when none was
+ *   injected) — or `undefined` when loading was skipped (injected env, no keysHome). The
+ *   door passes it on so config.json (src/config.js) is read from the SAME place, and never
+ *   from the real home in a test.
+ */
+export function keysForDoor(deps: {
+    env?: Record<string, string | undefined>;
+    keysHome?: string;
+}): KeysLoad & {
+    env: Record<string, string | undefined>;
+    home: string | undefined;
+};
+export type KeysLoad = {
+    /**
+     * the file is there
+     */
+    exists: boolean;
+    /**
+     * the NAMES the file defines (sorted; never values)
+     */
+    names: string[];
+    /**
+     * a plain-words warning (file readable by others, or
+     * unreadable), else null — a warning, never a refusal
+     */
+    warning: string | null;
+    /**
+     * shell env with the file filling the
+     * names the shell does not set. THE ONLY place values leave this module.
+     */
+    env: Record<string, string | undefined>;
+};

package/types/ledger.d.ts

@@ -81,6 +81,20 @@ export function spendProvenance(events: any[]): {
     unpriced: ProvenanceBucket;
     unknown: ProvenanceBucket;
 };
+/**
+ * The priced-rounds spend floor + first-record→last-record wall floor,
+ * derived straight off the spine's raw records — the same derivation a
+ * died run's "at least …" figures use, factored out so build item 6
+ * (2026-09-28) can hand a genuinely-still-running spine the identical
+ * floor instead of "unknown" on the Run tab, without a second copy of this
+ * math.
+ * @param {any[]} records raw parsed spine records
+ * @returns {{spendFloorUsd: number|null, wallFloorMs: number|null}}
+ */
+export function floorsFromRecords(records: any[]): {
+    spendFloorUsd: number | null;
+    wallFloorMs: number | null;
+};
 /** severity order, worst-first (the fold's display order; frequency ranks within) */
 export const LEDGER_CLASSES: readonly string[];
 /**

package/types/monthly.d.ts

@@ -0,0 +1,227 @@
+/**
+ * One run's own spend, off its spine records: this LEG's figure (never the chain fold),
+ * plus the drafting spend the run was signed with (counted once — on the first leg only).
+ * @param {any[]} records
+ * @returns {{ usd: number, complete: boolean }}
+ */
+export function legSpend(records: any[]): {
+    usd: number;
+    complete: boolean;
+};
+/**
+ * One run's wall time off its spine: job-start -> job-end when the run ended (exact), else the
+ * first -> last record floor (the SAME floor a died / still-running run's "at least" wall uses,
+ * `floorsFromRecords`). `ms` null = unknown — never 0.
+ * @param {any[]} records
+ * @returns {{ ms: number|null, complete: boolean }}
+ */
+export function legWall(records: any[]): {
+    ms: number | null;
+    complete: boolean;
+};
+/**
+ * Tokens a spine's rounds processed (input + output + cache read + cache write — all four,
+ * so a cache-heavy run is not under-reported), off the real `usage` field names.
+ * @param {any[]} records
+ * @returns {number}
+ */
+export function legTokens(records: any[]): number;
+/**
+ * Every listed run as one {@link Leg}. The ONE reader the month total, the all-time total
+ * and the per-provider figures share.
+ * @param {{ home?: string, now?: () => number, aboveRunid?: string }} [opts] `now` = the clock for the no-pid in-flight test; `aboveRunid` = read only the runs listed EARLIER in the file than that run (a claim yields to the claims above it, never below)
+ * @returns {Leg[]}
+ */
+export function readLegs(opts?: {
+    home?: string;
+    now?: () => number;
+    aboveRunid?: string;
+}): Leg[];
+/**
+ * @param {{ home?: string, now?: () => number, aboveRunid?: string }} [opts] `aboveRunid`: see {@link readLegs}
+ * @returns {{ usd: number, atLeast: boolean, runs: number, reservedUsd: number }} `usd` = real spend (the Money tab's figure); `reservedUsd` = the same with in-flight runs at their cap (the refusal check's)
+ */
+export function monthSpend(opts?: {
+    home?: string;
+    now?: () => number;
+    aboveRunid?: string;
+}): {
+    usd: number;
+    atLeast: boolean;
+    runs: number;
+    reservedUsd: number;
+};
+/**
+ * The Money tab's figures: all-time and this-month spend, and per-provider breakdown
+ * (rows from `rowIdFor`; a run on no known row lands under its own provider name, never
+ * pooled into another row). Any leg with unknown spend makes the figure it belongs to
+ * an "at least".
+ * @param {{ home?: string, now?: () => number, rows?: readonly import('./providerrows.js').KeyRow[] }} [opts] `rows` = the Providers rows: when given, `tokensByRow` sums each row's tokens
+ * @returns {{ tokensByRow: Record<string, number>, total: {usd: number, atLeast: boolean, tokens: number}, month: {usd: number, atLeast: boolean, tokens: number},
+ *   byProvider: Record<string, {label: string, monthUsd: number, monthAtLeast: boolean, totalUsd: number, totalAtLeast: boolean, tokens: number, vouchedRounds: number, otherRounds: number, monthWallMs: number|null, monthWallAtLeast: boolean, totalWallMs: number|null, totalWallAtLeast: boolean}> }}
+ */
+export function spendSummary(opts?: {
+    home?: string;
+    now?: () => number;
+    rows?: readonly import("./providerrows.js").KeyRow[];
+}): {
+    tokensByRow: Record<string, number>;
+    total: {
+        usd: number;
+        atLeast: boolean;
+        tokens: number;
+    };
+    month: {
+        usd: number;
+        atLeast: boolean;
+        tokens: number;
+    };
+    byProvider: Record<string, {
+        label: string;
+        monthUsd: number;
+        monthAtLeast: boolean;
+        totalUsd: number;
+        totalAtLeast: boolean;
+        tokens: number;
+        vouchedRounds: number;
+        otherRounds: number;
+        monthWallMs: number | null;
+        monthWallAtLeast: boolean;
+        totalWallMs: number | null;
+        totalWallAtLeast: boolean;
+    }>;
+};
+/**
+ * @typedef {object} MonthlyRoom
+ * @property {boolean} ok
+ * @property {number|null} leftUsd what is left this month (null = no limit set)
+ * @property {number|null} limitUsd the person's monthly limit (null = none)
+ * @property {boolean} atLeast the month's spend is a floor, so `leftUsd` is a ceiling
+ */
+/**
+ * The person's monthly limit off a parsed config.json: key absent (or null) = no limit (null);
+ * a number above 0 = the limit; ANY other value present is a broken setting and throws
+ * `ConfigError` — a limit the file names but this code cannot read never reads as "no limit".
+ * @param {Record<string, any>} config
+ * @param {string} [home]
+ * @returns {number|null}
+ */
+export function monthlyLimitOf(config: Record<string, any>, home?: string): number | null;
+/**
+ * Does a run with this $ cap fit in what is left this month (a run still held counts at its full cap)? No limit set (key absent or null) = ok, no check; a limit that is present but not a
+ * number above 0 throws `ConfigError`.
+ * Compared in whole cents. Also throws `ConfigError` when config.json is unreadable — a gate
+ * whose own instrument is broken refuses; it never silently runs with no limit.
+ * @param {{ capUsd: number, home?: string, now?: () => number, aboveRunid?: string }} args `aboveRunid`: count only the claims listed above that run (a claim in progress)
+ * @returns {MonthlyRoom}
+ */
+export function checkMonthlyRoom({ capUsd, home, now, aboveRunid }: {
+    capUsd: number;
+    home?: string;
+    now?: () => number;
+    aboveRunid?: string;
+}): MonthlyRoom;
+/**
+ * The ONE refusal text, everywhere (CLI, panel cap note, panel Sign refusal).
+ * @param {MonthlyRoom} room
+ * @returns {string|null} null when the run fits
+ */
+export function monthlyRefusalText(room: MonthlyRoom): string | null;
+/**
+ * Close every claim ABOVE `aboveRunid` (file order) whose process is gone: a pid-bearing run row with no
+ * `settled` entry whose pid is not a live bareloop runner gets `{ type: 'settled', by: <closer>, reason:
+ * 'process gone', spentUsd: <its spine's floor>, spendComplete: false }` appended — so every claim gets a
+ * write-back, attributed. Two runs may both close the same dead claim; readers take the FIRST note.
+ * @param {{ home?: string, by: string, aboveRunid?: string }} args `by` = the run doing the closing
+ * @returns {number} how many notes were appended
+ */
+export function settleDeadClaims({ home, by, aboveRunid }: {
+    home?: string;
+    by: string;
+    aboveRunid?: string;
+}): number;
+/**
+ * The CLAIM (hamr 2026-09-30: whoever runs first claims the limit and holds it; no lock file, records
+ * only): the run APPENDS its row first (`row` carries its `pid` and `capUsd`), then reads the run list.
+ * Only the claims ABOVE its own row count — a live one is held at its cap (a dead one is closed with an
+ * attributed note and counts its real spend); rows below yield to it. If `capUsd` fits, it runs; if not
+ * it appends `{type:'released', reason:'refused'}` and reports the refusal, nothing spent. No limit set =
+ * no claim (`claimed: false`; the caller lists the run as it always did). An unreadable config, or a row
+ * that cannot be written, throws `ConfigError` — the gate refuses, never reads "no limit".
+ * @param {{ row: import('./runlist.js').RunRow, capUsd: number, home?: string, now?: () => number }} args
+ * @returns {{ room: MonthlyRoom, claimed: boolean }}
+ */
+export function claimRun({ row, capUsd, home, now }: {
+    row: import("./runlist.js").RunRow;
+    capUsd: number;
+    home?: string;
+    now?: () => number;
+}): {
+    room: MonthlyRoom;
+    claimed: boolean;
+};
+export { isLiveRunner };
+export type Leg = {
+    /**
+     * when the run was listed
+     */
+    at: Date;
+    /**
+     * job-start's provider (null = an older spine that carried none)
+     */
+    provider: string | null;
+    baseUrl: string | null;
+    /**
+     * this leg's spend (a floor when `!complete`)
+     */
+    usd: number;
+    /**
+     * every figure behind `usd` is known
+     */
+    complete: boolean;
+    tokens: number;
+    /**
+     * job-start's model (older spines carry a model but no provider)
+     */
+    model: string | null;
+    /**
+     * this leg's wall time (null = unknown; a floor when `!wallComplete`)
+     */
+    wallMs: number | null;
+    /**
+     * the wall is the exact job-start -> job-end span
+     */
+    wallComplete: boolean;
+    /**
+     * rounds priced by a rate somebody vouched for (`provider`/`caller`)
+     */
+    vouchedRounds: number;
+    /**
+     * every other round: a built-in guess, unpriced, or no provenance on record
+     */
+    otherRounds: number;
+    /**
+     * what the refusal check counts: `usd`, or the leg's cap when the run is in flight
+     */
+    reservedUsd: number;
+    /**
+     * the spine was missing/unreadable or the listed date was bad (spend unknown)
+     */
+    unreadable: boolean;
+};
+export type MonthlyRoom = {
+    ok: boolean;
+    /**
+     * what is left this month (null = no limit set)
+     */
+    leftUsd: number | null;
+    /**
+     * the person's monthly limit (null = none)
+     */
+    limitUsd: number | null;
+    /**
+     * the month's spend is a floor, so `leftUsd` is a ceiling
+     */
+    atLeast: boolean;
+};
+import { isLiveRunner } from './runlist.js';

package/types/panel/authorroutes.d.ts

@@ -25,7 +25,7 @@ export function checkHumanGuard(req: import("node:http").IncomingMessage, { toke
  * deliberately has none of).
  * @param {{ port: number, token: string, env?: Record<string,string|undefined>,
  *   sessionsRoot?: string, spawnFn?: typeof realSpawn, bareloopBin?: string,
- *   jobsDir?: string, fetchImpl?: typeof fetch }} opts
+ *   jobsDir?: string, fetchImpl?: typeof fetch, home?: string }} opts
  */
 export function createAuthorRoutes(opts: {
     port: number;
@@ -36,6 +36,7 @@ export function createAuthorRoutes(opts: {
     bareloopBin?: string;
     jobsDir?: string;
     fetchImpl?: typeof fetch;
+    home?: string;
 }): {
     handle: (req: import("node:http").IncomingMessage, res: import("node:http").ServerResponse, pathname: string, body: any) => boolean;
     sessions: Map<string, any>;
@@ -48,7 +49,7 @@ export function createAuthorRoutes(opts: {
  * it to sign"), and this is where it is checked, not trusted.
  * @param {ReturnType<typeof createSession>} session
  * @param {string} claimedHash
- * @param {{env: any, spawnFn: typeof realSpawn, bareloopBin: string, sessionsRoot?: string}} o
+ * @param {{env: any, spawnFn: typeof realSpawn, bareloopBin: string, sessionsRoot?: string, home?: string}} o
  * @returns {{ok: boolean, error?: string, job?: string}}
  */
 export function signRun(session: ReturnType<typeof createSession>, claimedHash: string, o: {
@@ -56,6 +57,7 @@ export function signRun(session: ReturnType<typeof createSession>, claimedHash:
     spawnFn: typeof realSpawn;
     bareloopBin: string;
     sessionsRoot?: string;
+    home?: string;
 }): {
     ok: boolean;
     error?: string;

package/types/panel/authorsession.d.ts

@@ -16,9 +16,13 @@ export function jobNameTaken(name: string, opts?: {
  * creates a session or spends anything — never inside the async pipeline,
  * so a bad card refuses synchronously, in the same HTTP response.
  * @param {any} card
+ * @param {{jobsDir?: string, rows?: readonly import('../providerrows.js').KeyRow[]}} [opts] `rows` = the Settings rows (the Model menu); jobsDir is a server-side test seam — NEVER read off the client card
  * @returns {{ok: true}|{ok: false, error: string}}
  */
-export function validateJobCard(card: any): {
+export function validateJobCard(card: any, opts?: {
+    jobsDir?: string;
+    rows?: readonly import("../providerrows.js").KeyRow[];
+}): {
     ok: true;
 } | {
     ok: false;
@@ -30,7 +34,7 @@ export function validateJobCard(card: any): {
  * is the ONE thing a person answers next; `answer()`/`send()`/`revise()`/
  * `signPrepare()` are the only ways in.
  * @param {any} card the validated job card (see {@link validateJobCard})
- * @param {{env?: Record<string,string|undefined>, sessionsRoot?: string, timeoutMs?: number,
+ * @param {{env?: Record<string,string|undefined>, sessionsRoot?: string, home?: string, timeoutMs?: number,
  *   scout?: any, generate?: Function, confirmGenerate?: Function, authorFn?: Function,
  *   prepareSigningFn?: Function}} [deps] the last five are TEST SEAMS ONLY — see the note
  *   just above where each is read, below.
@@ -39,6 +43,7 @@ export function validateJobCard(card: any): {
 export function createSession(card: any, deps?: {
     env?: Record<string, string | undefined>;
     sessionsRoot?: string;
+    home?: string;
     timeoutMs?: number;
     scout?: any;
     generate?: Function;
@@ -46,16 +51,3 @@ export function createSession(card: any, deps?: {
     authorFn?: Function;
     prepareSigningFn?: Function;
 }): any;
-/**
- * The job card's "Model" select — a fixed, small, source-grounded mapping
- * from a display id to the `{provider, baseUrl?}` pair `src/interviewrun.js`
- * itself documents (that script's own `--provider openai-api --base-url
- * https://api.deepseek.com/v1` usage line for DeepSeek): the panel builds no
- * provider table of its own, this is a UI convenience over the SAME two
- * provider identities the CLI already resolves through `resolveProvider`.
- * @type {Readonly<Record<string, {provider: string, baseUrl?: string}>>}
- */
-export const MODEL_OPTIONS: Readonly<Record<string, {
-    provider: string;
-    baseUrl?: string;
-}>>;

package/types/panel/server.d.ts

@@ -211,13 +211,14 @@ export function getRunJob(runid: string, opts?: {
  * only `createPanelServer` below always supplies one.
  * @param {import('node:http').IncomingMessage} req
  * @param {import('node:http').ServerResponse} res
- * @param {{ home?: string, port: number, token?: string, authorRoutes?: ReturnType<typeof createAuthorRoutes> }} opts
+ * @param {{ home?: string, port: number, token?: string, authorRoutes?: ReturnType<typeof createAuthorRoutes>, settingsRoutes?: ReturnType<typeof createSettingsRoutes> }} opts
  */
 export function handleRequest(req: import("node:http").IncomingMessage, res: import("node:http").ServerResponse, opts: {
     home?: string;
     port: number;
     token?: string;
     authorRoutes?: ReturnType<typeof createAuthorRoutes>;
+    settingsRoutes?: ReturnType<typeof createSettingsRoutes>;
 }): void;
 /**
  * Start the panel server. Binds `127.0.0.1` ONLY. A taken port is a LOUD,
@@ -259,13 +260,17 @@ export function createPanelServer(opts?: {
  * Never picks a different port on collision (see file header): prints a
  * loud, named error to stderr and returns 1.
  * @param {string[]} argv
- * @param {{ out: (s: string) => void, err: (s: string) => void, runlistHome?: string }} ctx
+ * @param {{ out: (s: string) => void, err: (s: string) => void, runlistHome?: string, env?: Record<string,string|undefined> }} ctx
+ *   `env` is the RAW shell env (never the start-time merge with the keys file) — the routes
+ *   re-merge `~/.config/bareloop/.env` onto it per request so Reload keys is real;
+ *   undefined = the process env.
  * @returns {Promise<number>}
  */
 export function panelMain(argv: string[], ctx: {
     out: (s: string) => void;
     err: (s: string) => void;
     runlistHome?: string;
+    env?: Record<string, string | undefined>;
 }): Promise<number>;
 /**
  * A runid, as it appears in a URL path segment — never a raw filesystem
@@ -286,10 +291,12 @@ export const DEFAULT_PORT: 4700;
  * 2026-09-25).
  */
 export const SOFTGREEN_ADMITTED_ISO: "2026-08-18T00:00:00.000Z";
-export const DIED_MTIME_MS: number;
+export { DIED_MTIME_MS };
 /** The default/max page size for {@link getRunRounds} — tighten-only,
  * named so a future change is a deliberate, visible edit (item 5,
  * 2026-09-25). */
 export const ROUNDS_PAGE_DEFAULT: 50;
 export const ROUNDS_PAGE_MAX: 200;
 import { createAuthorRoutes } from './authorroutes.js';
+import { createSettingsRoutes } from './settingsroutes.js';
+import { DIED_MTIME_MS } from '../runlist.js';