bareloop 0.31.0 → 0.33.0

package/src/interviewrun.js

@@ -86,6 +86,8 @@
 // question this used to ask separately is GONE, folded into Destination. A
 // non-repo source gets the form up to here and then an honest named stop:
 // bareloop has no checks for that kind of job yet (ruling 7 → M4).
+import { keysForDoor } from './keysfile.js';
+import { applyConfiguredKey, rowsForHome } from './providerrows.js';
 import {
   writeFileSync, mkdirSync, existsSync, readFileSync, statSync,
 } from 'node:fs';
@@ -107,6 +109,7 @@ import { scanSecrets, redactSecrets } from './validate.js';
 import { detectLanguage } from './detectlang.js';
 import { prepareSource, proveDestination, looksLikeRepoSource, missingDependencies } from './source.js';
 import { parseCeiling, ceilingLine } from './authorreadout.js';
+import { commandFor } from './invoke.js';
 
 /** Thrown to unwind `main` to an exit code without ever calling
  * `process.exit()` (constraint: a library function returns a code / throws,
@@ -123,6 +126,7 @@ class ExitSignal extends Error {
 /**
  * @typedef {object} Deps
  * @property {Record<string,string|undefined>} [env]
+ * @property {string} [keysHome] P4a — test seam: load this home's `.env` keys file even when `env` is injected.
  * @property {NodeJS.ReadStream} [stdin]
  * @property {NodeJS.WritableStream} [stdout]
  * @property {NodeJS.WritableStream} [stderr]
@@ -146,12 +150,15 @@ class ExitSignal extends Error {
  * @returns {Promise<number>} an exit code — never calls process.exit
  */
 export async function main(argv, deps = {}) {
-  const env = deps.env ?? process.env;
+  // P4a item 1 — the keys file fills what the shell leaves unset (shell wins).
+  const keys = keysForDoor(deps);
+  const env = keys.env;
   const stdin = deps.stdin ?? process.stdin;
   const stdout = deps.stdout ?? process.stdout;
   const stderr = deps.stderr ?? process.stderr;
+  if (keys.warning && deps.env === undefined) stderr.write(`WARNING: ${keys.warning}\n`);
   const spawnSyncFn = deps.spawnSync ?? realSpawnSync;
-  const invokedAs = deps.invokedAs ?? 'node scripts/run-interview.mjs';
+  const invokedAs = deps.invokedAs ?? commandFor('interview', undefined);
   const out = (/** @type {string} */ s = '') => { stdout.write(`${s}\n`); };
   const err = (/** @type {string} */ s) => { stderr.write(`${s}\n`); };
   const arg = (/** @type {string} */ n) => { const i = argv.indexOf(`--${n}`); return i === -1 ? null : (argv[i + 1] ?? ''); };
@@ -748,7 +755,7 @@ export async function main(argv, deps = {}) {
   let providerEntry = null;
   try { providerEntry = resolveProvider(PROVIDER); } catch { providerEntry = null; }
   const providerEnvKey = providerEntry?.envKey ?? null;
-  say(`  ${providerEnvKey ?? 'YOUR_PROVIDER_API_KEY'}=... node scripts/run-author.mjs ${childArgs.join(' ')}`);
+  say(`  ${providerEnvKey ?? 'YOUR_PROVIDER_API_KEY'}=... ${commandFor('author', deps.invokedAs)} ${childArgs.join(' ')}`);
   // An `openai-api` + `baseUrl` draft (DeepSeek, today's one secondary, reached
   // this way) still reads its key from `OPENAI_API_KEY` — there is no separate
   // "DeepSeek key" env var, and a person pointed only at the command above could
@@ -765,7 +772,9 @@ export async function main(argv, deps = {}) {
   // (a line break/control char/stray whitespace, e.g. a two-line secret-store
   // entry). A malformed key must not count as KEYED: this offer must read the
   // same "will it actually run" question run-author itself asks at its door.
-  const rawKeyValue = providerEnvKey ? env[providerEnvKey] : undefined;
+  // P4a item 4 — the key variable the person picked in Settings stands in for the built-in one
+  const keyEnv = keys.home !== undefined ? applyConfiguredKey(env, PROVIDER, draft.baseUrl, rowsForHome(keys.home)) : env;
+  const rawKeyValue = providerEnvKey ? keyEnv[providerEnvKey] : undefined;
   const keyProblem = rawKeyValue ? apiKeyProblem(rawKeyValue) : null;
   const KEYED = providerEnvKey !== null && Boolean(rawKeyValue) && !keyProblem;
   if (!KEYED) {

package/src/invoke.js

@@ -0,0 +1,22 @@
+// The one owner of how a printed re-invocation is spelled. The package ships `src/` and `bin/`
+// only, so a person who reached a flow through the `bareloop` CLI must be told
+// `bareloop run-u ...`, never `node scripts/run-u.mjs ...` (a path their install does not have).
+// Each flow's `main(argv, deps)` takes `deps.invokedAs` — the command it was actually reached
+// through (`src/cli.js` passes `'bareloop <name>'`; the `scripts/*.mjs` adapters pass none).
+
+/** @typedef {'run-u' | 'interview' | 'author'} Flow */
+
+/** the script adapter each flow keeps for a source-tree run */
+const SCRIPT = /** @type {const} */ ({ 'run-u': 'run-u', interview: 'run-interview', author: 'run-author' });
+
+/**
+ * The command that runs `flow`, spelled the way the caller reached this flow: `bareloop <flow>`
+ * when `invokedAs` names the CLI, else the source-tree script.
+ * @param {Flow} flow @param {string|undefined} invokedAs
+ * @returns {string}
+ */
+export function commandFor(flow, invokedAs) {
+  return invokedAs !== undefined && /^bareloop(\s|$)/.test(invokedAs)
+    ? `bareloop ${flow}`
+    : `node scripts/${SCRIPT[flow]}.mjs`;
+}

package/src/judged.js

@@ -791,10 +791,12 @@ function topLevelFunctionNames(artifactText) {
  * A `Loop`, NOT `provider.generate()`: the POC measured that a bare provider
  * result carries no `costUsd` at all, and under F6 an unpriced call is a red,
  * so the priced seam is the only legal one.
- * @param {{provider: any, system: string}} o */
-export const defaultJudgeLoop = ({ provider, system }) => {
+ * `rates` is the customer's own price for the judge's row (USD per 1K, `ratesFor`'s
+ * `rates`); null/absent = bare-agent's built-in guess, exactly as before.
+ * @param {{provider: any, system: string, rates?: {in: number, out: number}|null}} o */
+export const defaultJudgeLoop = ({ provider, system, rates = null }) => {
   const { Loop } = require('bare-agent');
-  return new Loop({ provider, system });
+  return new Loop({ provider, system, ...(rates ? { rates } : {}) });
 };
 
 // ── LOCATE: one attempt ─────────────────────────────────────────────────────

package/src/keysfile.js

@@ -0,0 +1,156 @@
+// PANEL-BUILD.md P4a item 1 — the keys file loader (`~/.config/bareloop/.env`).
+//
+// Key VALUES live only in this file (chmod 600, outside any repo) and in the shell
+// environment — never in config.json, the spine, runs.jsonl, a log, or a page.
+// This is the ONE reader of that file. Plain `NAME=value` lines (an optional
+// `export ` prefix, `#` full-line comments, one pair of matching quotes around the
+// value); no dependency.
+//
+// Precedence: the SHELL wins. An explicit `export FOO=…` beats the file; the file
+// only fills names the shell leaves unset (or empty). The merged env is a NEW
+// object — `process.env` is never mutated.
+//
+// Values leave this module in exactly one place: the `env` of `loadKeysEnv`, which
+// goes to provider construction. Everything else it returns (`names`, `warning`) is
+// value-free by construction, and a parse problem never quotes the offending line.
+import { existsSync, readFileSync, statSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+/**
+ * `~/.config/bareloop` (or the injected override) — same home every other
+ * per-person file (runs.jsonl, config.json) lives in.
+ * @param {string} [home] test seam; production never passes it
+ * @returns {string}
+ */
+export function keysHome(home) {
+  return home ?? join(homedir(), '.config', 'bareloop');
+}
+
+/**
+ * @param {string} [home]
+ * @returns {string} `<home>/.env`
+ */
+export function keysFilePath(home) {
+  return join(keysHome(home), '.env');
+}
+
+const NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+/**
+ * Parse the file's text. Lines that are not `NAME=value` are skipped silently
+ * (never echoed — a malformed line may hold a secret).
+ * @param {string} text
+ * @returns {Record<string,string>}
+ */
+export function parseKeysText(text) {
+  /** @type {Record<string,string>} */
+  const out = {};
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === '' || line.startsWith('#')) continue;
+    const body = line.startsWith('export ') ? line.slice(7).trimStart() : line;
+    const eq = body.indexOf('=');
+    if (eq <= 0) continue;
+    const name = body.slice(0, eq).trim();
+    if (!NAME_RE.test(name)) continue;
+    let value = body.slice(eq + 1).trim();
+    if (value.length >= 2 && (value[0] === '"' || value[0] === "'") && value.endsWith(value[0])) {
+      value = value.slice(1, -1);
+    }
+    out[name] = value;
+  }
+  return out;
+}
+
+/**
+ * The NAMES in the file that carry a non-empty value, in file order — the Providers rows
+ * (an empty preset line is not a row). Names only; a missing/unreadable file = none.
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+export function filledKeyNames(home) {
+  try {
+    return Object.entries(parseKeysText(readFileSync(keysFilePath(home), 'utf8'))).filter(([, v]) => v !== '').map(([n]) => n);
+  } catch { return []; }
+}
+
+/**
+ * Create the keys file with the five empty preset lines when — and only when — it does not
+ * exist (mode 600). An existing file is never touched.
+ * @param {readonly string[]} presetNames the names to seed, in order
+ * @param {string} [home]
+ * @returns {boolean} true if it was created
+ */
+export function ensureKeysFile(presetNames, home) {
+  const file = keysFilePath(home);
+  if (existsSync(file)) return false;
+  mkdirSync(keysHome(home), { recursive: true });
+  try {
+    writeFileSync(file, presetNames.map((n) => `${n}=\n`).join(''), { mode: 0o600, flag: 'wx' });
+  } catch (/** @type {any} */ e) {
+    if (e?.code === 'EEXIST') return false; // lost a race: the file is there, untouched
+    throw e;
+  }
+  return true;
+}
+
+/**
+ * @typedef {object} KeysLoad
+ * @property {boolean} exists the file is there
+ * @property {string[]} names the NAMES the file defines (sorted; never values)
+ * @property {string|null} warning a plain-words warning (file readable by others, or
+ *   unreadable), else null — a warning, never a refusal
+ * @property {Record<string,string|undefined>} env shell env with the file filling the
+ *   names the shell does not set. THE ONLY place values leave this module.
+ */
+
+/**
+ * Load the keys file over an env. Missing file is fine (no names, env unchanged).
+ * @param {{ env?: Record<string,string|undefined>, home?: string }} [opts]
+ * @returns {KeysLoad}
+ */
+export function loadKeysEnv(opts = {}) {
+  const base = opts.env ?? process.env;
+  const file = keysFilePath(opts.home);
+  if (!existsSync(file)) return { exists: false, names: [], warning: null, env: { ...base } };
+  /** @type {string|null} */
+  let warning = null;
+  try {
+    const mode = statSync(file).mode & 0o777;
+    if ((mode & 0o077) !== 0) {
+      warning = `${file} is readable by other users (mode ${mode.toString(8)}) — run: chmod 600 ${file}`;
+    }
+  } catch { /* the read below reports it */ }
+  /** @type {Record<string,string>} */
+  let parsed = {};
+  try {
+    parsed = parseKeysText(readFileSync(file, 'utf8'));
+  } catch (/** @type {any} */ e) {
+    return { exists: true, names: [], warning: `${file} could not be read (${e?.code ?? 'error'})`, env: { ...base } };
+  }
+  /** @type {Record<string,string|undefined>} */
+  const env = { ...base };
+  for (const [name, value] of Object.entries(parsed)) {
+    if (!env[name]) env[name] = value;
+  }
+  return { exists: true, names: Object.keys(parsed).sort(), warning, env };
+}
+
+/**
+ * The door helper the CLI and the panel call: load the file only when the caller is
+ * on the REAL environment (no injected env) or names a keys home explicitly — so a
+ * test that injects `env` alone never reads the real `~/.config/bareloop/.env`.
+ * @param {{ env?: Record<string,string|undefined>, keysHome?: string }} deps
+ * @returns {KeysLoad & { env: Record<string,string|undefined>, home: string|undefined }}
+ *   `home` = the home the file was loaded from (the real `~/.config/bareloop` when none was
+ *   injected) — or `undefined` when loading was skipped (injected env, no keysHome). The
+ *   door passes it on so config.json (src/config.js) is read from the SAME place, and never
+ *   from the real home in a test.
+ */
+export function keysForDoor(deps) {
+  if (deps.env !== undefined && deps.keysHome === undefined) {
+    return { exists: false, names: [], warning: null, env: deps.env, home: undefined };
+  }
+  return { ...loadKeysEnv({ env: deps.env, home: deps.keysHome }), home: keysHome(deps.keysHome) };
+}

package/src/ledger.js

@@ -506,3 +506,29 @@ export function spendProvenance(events) {
   }
   return out;
 }
+
+/**
+ * The priced-rounds spend floor + first-record→last-record wall floor,
+ * derived straight off the spine's raw records — the same derivation a
+ * died run's "at least …" figures use, factored out so build item 6
+ * (2026-09-28) can hand a genuinely-still-running spine the identical
+ * floor instead of "unknown" on the Run tab, without a second copy of this
+ * math.
+ * @param {any[]} records raw parsed spine records
+ * @returns {{spendFloorUsd: number|null, wallFloorMs: number|null}}
+ */
+export function floorsFromRecords(records) {
+  let spendSum = 0;
+  let pricedCount = 0;
+  for (const r of records) {
+    if (!r || typeof r !== 'object' || !SPEND_RECORD_TYPES.includes(r.type)) continue; // worker-result echoes excluded by construction — not a spend type
+    if (typeof r.costUsd === 'number' && Number.isFinite(r.costUsd)) { spendSum += r.costUsd; pricedCount += 1; }
+  }
+  const spendFloorUsd = pricedCount > 0 ? spendSum : null;
+
+  const withTs = records.filter((r) => r && typeof r === 'object' && typeof r.ts === 'string');
+  const firstMs = withTs.length ? Date.parse(withTs[0].ts) : NaN;
+  const lastMs = withTs.length ? Date.parse(withTs[withTs.length - 1].ts) : NaN;
+  const wallFloorMs = Number.isFinite(firstMs) && Number.isFinite(lastMs) && lastMs >= firstMs ? lastMs - firstMs : null;
+  return { spendFloorUsd, wallFloorMs };
+}