bareloop 0.31.0 → 0.33.0

package/src/panel/server.js

@@ -5,8 +5,10 @@
 // `src/cli.js` calls — `src/replayio.js`'s read side and `src/runlist.js`'s
 // run list — never a re-implementation of either.
 //
-// READ-ONLY, BY CONSTRUCTION: GET/HEAD only (anything else -> 405); no
-// endpoint runs a job, spends money, signs, or reads a key/.env. Nothing
+// READ-ONLY, BY CONSTRUCTION: GET/HEAD only (anything else -> 405) EXCEPT the two
+// human-click-guarded route families in their own modules (`/api/author/*`,
+// `/api/settings/*` — P3/P4a); no endpoint here runs a job, spends money, signs, or
+// returns a key/.env value. Nothing
 // here imports `src/providers.js` or touches `process.env` for a secret —
 // grepped before writing this file, and the same discipline is kept here.
 //
@@ -28,19 +30,23 @@ import {
   dirname, join, basename, relative, isAbsolute, sep,
 } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readRunList } from '../runlist.js';
+import { readRunList, DIED_MTIME_MS } from '../runlist.js';
 import {
   replayOne, parseJsonl, resolveSiblings, isSidecarByName,
 } from '../replayio.js';
 import { summarizeForAllLine, auditWindow } from '../replay.js';
 import { runBehaviour } from '../behaviour.js';
-import { SPEND_RECORD_TYPES } from '../ledger.js';
+import { SPEND_RECORD_TYPES, floorsFromRecords } from '../ledger.js';
 import { jobSpecHash } from '../job.js';
 import { confirmProtections } from '../authorflow.js';
 import { createAuthorRoutes, mintToken } from './authorroutes.js';
+import { createSettingsRoutes } from './settingsroutes.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
+/** Largest POST body the panel buffers (job cards are short prose); a bigger one is refused with 413. */
+const MAX_BODY_BYTES = 1024 * 1024;
+
 /**
  * A runid, as it appears in a URL path segment — never a raw filesystem
  * path. `~` is included so a backfill-disambiguated runid (F197:
@@ -131,17 +137,10 @@ export function checkTypeTitle(verdictType, atIso) {
   return null;
 }
 
-// DIED (hamr's ruling B, 2026-09-25): a run with no `job-end` never shares
-// the failed glyph — [✗] stays reserved for a run whose close/arbiter
-// actually rendered a "no" (a real result). A spine that just stops, with
-// no ending ever recorded, is a DIFFERENT fact (killed, crashed, or the
-// machine slept) and gets its own [?] glyph. The distinguishing signal is
-// the spine FILE's own mtime, never wall-clock "now minus job-start" (a
-// resumed/paused run can legitimately sit quiet for a long time without
-// having died): still fresh (written to within this window) reads as the
-// existing `running` [▶] state; older than this reads as died. Tighten-only,
-// named so a future change is a deliberate, visible edit.
-export const DIED_MTIME_MS = 10 * 60 * 1000;
+// DIED (hamr's ruling B, 2026-09-25): a run with no `job-end` is `died` [?], never [✗], once its
+// spine file's mtime is older than DIED_MTIME_MS — the constant and its full comment live in
+// src/runlist.js (the monthly limit reads the same rule); re-exported here for the panel's callers.
+export { DIED_MTIME_MS };
 
 /**
  * Plain-words description of ONE spine record, for the died "why" sentence's
@@ -237,32 +236,6 @@ export function formatTimestamp(ts) {
  * @param {string|null} outcome `replayRun`'s own `summary.outcome`
  * @returns {{died: boolean, why: string|null, spendFloorUsd: number|null, wallFloorMs: number|null}}
  */
-/**
- * The priced-rounds spend floor + first-record→last-record wall floor,
- * derived straight off the spine's raw records — the same derivation a
- * died run's "at least …" figures use, factored out so build item 6
- * (2026-09-28) can hand a genuinely-still-running spine the identical
- * floor instead of "unknown" on the Run tab, without a second copy of this
- * math.
- * @param {any[]} records raw parsed spine records
- * @returns {{spendFloorUsd: number|null, wallFloorMs: number|null}}
- */
-function floorsFromRecords(records) {
-  let spendSum = 0;
-  let pricedCount = 0;
-  for (const r of records) {
-    if (!r || typeof r !== 'object' || !SPEND_RECORD_TYPES.includes(r.type)) continue; // worker-result echoes excluded by construction — not a spend type
-    if (typeof r.costUsd === 'number' && Number.isFinite(r.costUsd)) { spendSum += r.costUsd; pricedCount += 1; }
-  }
-  const spendFloorUsd = pricedCount > 0 ? spendSum : null;
-
-  const withTs = records.filter((r) => r && typeof r === 'object' && typeof r.ts === 'string');
-  const firstMs = withTs.length ? Date.parse(withTs[0].ts) : NaN;
-  const lastMs = withTs.length ? Date.parse(withTs[withTs.length - 1].ts) : NaN;
-  const wallFloorMs = Number.isFinite(firstMs) && Number.isFinite(lastMs) && lastMs >= firstMs ? lastMs - firstMs : null;
-  return { spendFloorUsd, wallFloorMs };
-}
-
 function deriveDeath(spinePath, records, outcome) {
   const notDied = {
     died: false, why: null, spendFloorUsd: null, wallFloorMs: null,
@@ -1751,9 +1724,17 @@ function sendText(res, code, text) {
  * only `createPanelServer` below always supplies one.
  * @param {import('node:http').IncomingMessage} req
  * @param {import('node:http').ServerResponse} res
- * @param {{ home?: string, port: number, token?: string, authorRoutes?: ReturnType<typeof createAuthorRoutes> }} opts
+ * @param {{ home?: string, port: number, token?: string, authorRoutes?: ReturnType<typeof createAuthorRoutes>, settingsRoutes?: ReturnType<typeof createSettingsRoutes> }} opts
  */
 export function handleRequest(req, res, opts) {
+  /** the ONE writable route family for a path, or null — `/api/author/*` (authoring) or
+   * `/api/settings/*` (Settings, P4a): separate modules, each behind the human-click guard.
+   * @param {any} o @param {string} p */
+  function routesFor(o, p) {
+    if (o.authorRoutes && p.startsWith('/api/author')) return o.authorRoutes;
+    if (o.settingsRoutes && p.startsWith('/api/settings')) return o.settingsRoutes;
+    return null;
+  }
   const method = req.method ?? 'GET';
 
   let url;
@@ -1766,22 +1747,39 @@ export function handleRequest(req, res, opts) {
   const { pathname } = url;
 
   if (method !== 'GET' && method !== 'HEAD') {
-    if (opts.authorRoutes && pathname.startsWith('/api/author')) {
+    const routes = routesFor(opts, pathname);
+    if (routes) {
       let raw = '';
-      req.on('data', (c) => { raw += c; });
+      let size = 0;
+      let refused = false;
+      req.on('data', (c) => {
+        if (refused) return;
+        size += c.length;
+        if (size > MAX_BODY_BYTES) {
+          refused = true;
+          raw = '';
+          res.once('finish', () => { req.destroy(); });
+          res.setHeader('connection', 'close');
+          sendText(res, 413, `request body over ${MAX_BODY_BYTES} bytes`);
+          return;
+        }
+        raw += c;
+      });
       req.on('end', () => {
+        if (refused) return;
         /** @type {any} */
         let body = null;
         if (raw.length > 0) { try { body = JSON.parse(raw); } catch { body = null; } }
-        opts.authorRoutes?.handle(req, res, pathname, body);
+        routes.handle(req, res, pathname, body);
       });
       return;
     }
-    sendText(res, 405, 'method not allowed — this panel is read-only outside /api/author (GET/HEAD only)');
+    sendText(res, 405, 'method not allowed — this panel is read-only outside /api/author and /api/settings (GET/HEAD only)');
     return;
   }
-  if (opts.authorRoutes && pathname.startsWith('/api/author')) {
-    opts.authorRoutes.handle(req, res, pathname, null);
+  const getRoutes = routesFor(opts, pathname);
+  if (getRoutes) {
+    getRoutes.handle(req, res, pathname, null);
     return;
   }
 
@@ -1901,10 +1899,12 @@ export function createPanelServer(opts = {}) {
     let boundPort = requestedPort;
     /** @type {ReturnType<typeof createAuthorRoutes>|undefined} */
     let authorRoutes;
+    /** @type {ReturnType<typeof createSettingsRoutes>|undefined} */
+    let settingsRoutes;
     const server = createServer((req, res) => {
       try {
         handleRequest(req, res, {
-          home, port: boundPort, token, authorRoutes,
+          home, port: boundPort, token, authorRoutes, settingsRoutes,
         });
       } catch (e) {
         sendText(res, 500, `internal error: ${/** @type {Error} */ (e).message}`);
@@ -1926,6 +1926,10 @@ export function createPanelServer(opts = {}) {
         spawnFn: opts.spawnFn,
         bareloopBin: opts.bareloopBin,
         fetchImpl: opts.fetchImpl,
+        home,
+      });
+      settingsRoutes = createSettingsRoutes({
+        port: boundPort, token, home, env: opts.env, fetchImpl: opts.fetchImpl,
       });
       resolve({
         server,
@@ -1942,7 +1946,10 @@ export function createPanelServer(opts = {}) {
  * Never picks a different port on collision (see file header): prints a
  * loud, named error to stderr and returns 1.
  * @param {string[]} argv
- * @param {{ out: (s: string) => void, err: (s: string) => void, runlistHome?: string }} ctx
+ * @param {{ out: (s: string) => void, err: (s: string) => void, runlistHome?: string, env?: Record<string,string|undefined> }} ctx
+ *   `env` is the RAW shell env (never the start-time merge with the keys file) — the routes
+ *   re-merge `~/.config/bareloop/.env` onto it per request so Reload keys is real;
+ *   undefined = the process env.
  * @returns {Promise<number>}
  */
 export async function panelMain(argv, ctx) {
@@ -1956,7 +1963,7 @@ export async function panelMain(argv, ctx) {
     }
   }
   try {
-    const { port: boundPort } = await createPanelServer({ port, home: ctx.runlistHome });
+    const { port: boundPort } = await createPanelServer({ port, home: ctx.runlistHome, env: ctx.env });
     ctx.out(`bareloop panel — read-only, http://127.0.0.1:${boundPort} (Ctrl-C to stop)`);
     // never resolves on its own — the process stays up until killed, same
     // shape any other long-running dev server takes.

package/src/panel/settingsroutes.js

@@ -0,0 +1,230 @@
+// PANEL-BUILD.md P4a — Settings routes (`/api/settings/*`). A separate module from the
+// authoring routes on purpose: the chat/authoring session can reach NO route here (it has
+// no path to this file's handlers), and every route here is behind the same human-click
+// guard (per-server-start token + Origin/Host, `checkHumanGuard`) — GET too, because the
+// pages these serve name key variables and spend.
+//
+// Providers (P4b): the rows are the keys file's filled lines; Name / API shape / Base URL save to
+// config.json `keys.<ENV NAME>` (src/providerrows.js is the one owner of the rows).
+//
+// Every write goes to `~/.config/bareloop/config.json` through `src/config.js` (the one
+// writer); the monthly limit is a person's own number, set by hand — nothing here (and
+// nothing the agent can reach) raises it on their behalf. Key VALUES never appear in any
+// response: names and found / not set only.
+import { checkHumanGuard } from './authorroutes.js';
+import { readConfig, updateConfig, ConfigError } from '../config.js';
+import { spendSummary, monthlyLimitOf } from '../monthly.js';
+import { loadKeysEnv, keysFilePath, filledKeyNames, ensureKeysFile } from '../keysfile.js';
+import { SHAPES, PRESET_KEY_NAMES, keyRows, endpointOf, defaultUrlOf, usableKey } from '../providerrows.js';
+import { apiKeyProblem, checkProviderReachable } from '../providers.js';
+
+/** DeepSeek's own balance endpoint (same host as its models list). */
+const DEEPSEEK_BALANCE_URL = 'https://api.deepseek.com/user/balance';
+
+/**
+ * @param {{ port: number, token: string, home?: string, env?: Record<string,string|undefined>,
+ *   fetchImpl?: typeof fetch, now?: () => number }} opts
+ */
+export function createSettingsRoutes(opts) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  /** the env keys are looked up in: the door's env (shell + keys file), re-read against the
+   * keys file on every call so "Reload keys" is just another request. NAMES leave this
+   * module; values never do.
+   * @returns {ReturnType<typeof loadKeysEnv>} */
+  const keys = () => loadKeysEnv({ env: opts.env, home: opts.home });
+  /** the Providers rows: keys with a value in the file, over the saved settings
+   * @param {Record<string, any>} config */
+  const currentRows = (config) => keyRows({ filled: filledKeyNames(opts.home), config });
+  /** @param {string} u @returns {string} */
+  const hostOf = (u) => { try { return new URL(u).hostname; } catch { return ''; } };
+  /**
+   * @param {import('node:http').IncomingMessage} req
+   * @param {import('node:http').ServerResponse} res
+   * @param {string} pathname
+   * @param {any} body already-parsed JSON body (or `null`)
+   * @returns {boolean} true if this module handled the request
+   */
+  function handle(req, res, pathname, body) {
+    if (!pathname.startsWith('/api/settings')) return false;
+    const send = (/** @type {number} */ code, /** @type {any} */ obj) => {
+      const text = JSON.stringify(obj);
+      res.writeHead(code, { 'content-type': 'application/json; charset=utf-8', 'content-length': Buffer.byteLength(text) });
+      res.end(text);
+    };
+    const guard = checkHumanGuard(req, { token: opts.token, port: opts.port });
+    if (!guard.ok) { send(403, { ok: false, error: `refused — ${guard.reason}` }); return true; }
+
+    if (pathname === '/api/settings/money') {
+      if (req.method === 'GET') {
+        const cfg = readConfig({ home: opts.home });
+        const s = spendSummary({ home: opts.home, now: opts.now });
+        /** @type {number|null} */
+        let limit = null;
+        let configProblem = cfg.problem;
+        // a limit the file names but that is not a number above 0 is a problem, never "no limit"
+        try { limit = monthlyLimitOf(cfg.config, opts.home); } catch (e) {
+          if (!(e instanceof ConfigError)) throw e;
+          configProblem = e.message;
+        }
+        send(200, {
+          ok: true,
+          configProblem,
+          totalUsd: s.total.usd, totalAtLeast: s.total.atLeast,
+          monthUsd: s.month.usd, monthAtLeast: s.month.atLeast,
+          totalTokens: s.total.tokens, monthTokens: s.month.tokens,
+          monthlyLimitUsd: limit,
+          byProvider: Object.values(s.byProvider).sort((a, b) => b.totalUsd - a.totalUsd),
+        });
+        return true;
+      }
+      if (req.method === 'POST') {
+        // an empty / unparseable body, or a JSON body without the key, is NOT "clear the limit" — only
+        // an explicit null / blank clears it (that is how the auto-saving field clears it)
+        if (body === null || typeof body !== 'object' || Array.isArray(body) || !Object.hasOwn(body, 'monthlyLimitUsd')) {
+          send(400, { ok: false, error: 'send {"monthlyLimitUsd": <number above 0>} to set the limit, or null to clear it' });
+          return true;
+        }
+        // a blank / null limit removes it (no limit); anything else must be a number > 0
+        const raw = body.monthlyLimitUsd;
+        const limit = raw === null || raw === '' ? null : Number(raw);
+        if (limit !== null && !(Number.isFinite(limit) && limit > 0)) {
+          send(400, { ok: false, error: 'the monthly limit must be a number above 0 (leave it blank for no limit)' });
+          return true;
+        }
+        try {
+          updateConfig({ monthlyLimitUsd: limit }, { home: opts.home });
+        } catch (e) {
+          if (!(e instanceof ConfigError)) throw e;
+          send(400, { ok: false, error: e.message });
+          return true;
+        }
+        send(200, { ok: true, monthlyLimitUsd: limit });
+        return true;
+      }
+      send(405, { ok: false, error: 'GET or POST only' });
+      return true;
+    }
+
+    // ── Providers (P4b): one row per key in the keys file that has a value. ──
+    if (pathname === '/api/settings/providers' && req.method === 'GET') {
+      // a missing keys file is created with the five empty preset lines (never edited if present)
+      ensureKeysFile(PRESET_KEY_NAMES, opts.home);
+      const cfg = readConfig({ home: opts.home });
+      const k = keys();
+      const rows = currentRows(cfg.config);
+      const s = spendSummary({ home: opts.home, now: opts.now, rows });
+      const note = cfg.config.anthropicBalanceNote;
+      // a preset key exported only in the shell gets no row (the rows are the keys file): NAMES the
+      // person can act on, read off the RAW shell env — never a value, never a length
+      const shellEnv = opts.env ?? process.env;
+      const filled = new Set(filledKeyNames(opts.home));
+      const shellOnly = PRESET_KEY_NAMES.filter((n) => typeof shellEnv[n] === 'string' && shellEnv[n] !== '' && !filled.has(n));
+      send(200, {
+        ok: true,
+        shellOnly,
+        keysFile: { path: keysFilePath(opts.home), exists: k.exists, names: k.names, warning: k.warning },
+        configProblem: cfg.problem,
+        shapes: SHAPES.map((x) => ({ id: x.id, label: x.label })),
+        rows: rows.map((r) => {
+          const raw = k.env[r.envName];
+          const problem = raw ? apiKeyProblem(raw) : null;
+          const isDeepseek = r.provider === 'openai-api' && hostOf(endpointOf(r.provider, r.baseUrl)) === 'api.deepseek.com';
+          return {
+            envName: r.envName, name: r.name, shape: r.provider, baseUrl: r.baseUrl,
+            placeholder: defaultUrlOf(r.provider),
+            keyStatus: !raw ? 'not set' : (raw === 'null' ? 'no key needed' : (problem ? `bad shape (${problem})` : 'found')),
+            canTest: r.provider !== 'gemini-api',
+            tokens: s.tokensByRow[r.envName] ?? 0,
+            balance: r.provider === 'anthropic-api'
+              ? { kind: 'note', usd: typeof note === 'number' && Number.isFinite(note) ? note : null }
+              : (isDeepseek ? { kind: 'fetch' } : { kind: 'none' }),
+          };
+        }),
+      });
+      return true;
+    }
+
+    if (pathname === '/api/settings/providers/row' && req.method === 'POST') {
+      const row = currentRows(readConfig({ home: opts.home }).config).find((r) => r.envName === body?.envName);
+      if (!row) { send(400, { ok: false, error: 'unknown key — add NAME=key to your keys file and reload keys' }); return true; }
+      // only the three settings a row has; each is optional in the body, the whole triple is stored
+      const patch = {
+        name: typeof body?.name === 'string' ? body.name.trim() : row.name,
+        shape: typeof body?.shape === 'string' ? body.shape : row.provider,
+        baseUrl: typeof body?.baseUrl === 'string' ? body.baseUrl.trim().replace(/\/+$/, '') : row.baseUrl,
+      };
+      try {
+        updateConfig({ keys: { [row.envName]: patch } }, { home: opts.home });
+      } catch (e) {
+        if (!(e instanceof ConfigError)) throw e;
+        send(400, { ok: false, error: e.message });
+        return true;
+      }
+      send(200, { ok: true, envName: row.envName, ...patch });
+      return true;
+    }
+
+    if (pathname === '/api/settings/providers/balance-note' && req.method === 'POST') {
+      // the Anthropic balance is a NOTE the person types; no check ever reads it
+      const raw = body?.usd;
+      const usd = raw === null || raw === '' || raw === undefined ? null : Number(raw);
+      if (usd !== null && !(Number.isFinite(usd) && usd >= 0)) { send(400, { ok: false, error: 'the balance must be a number, 0 or more' }); return true; }
+      try {
+        updateConfig({ anthropicBalanceNote: usd }, { home: opts.home });
+      } catch (e) {
+        if (!(e instanceof ConfigError)) throw e;
+        send(400, { ok: false, error: e.message });
+        return true;
+      }
+      send(200, { ok: true, usd });
+      return true;
+    }
+
+    if (pathname === '/api/settings/providers/test' && req.method === 'POST') {
+      const row = currentRows(readConfig({ home: opts.home }).config).find((r) => r.envName === body?.envName);
+      if (!row) { send(400, { ok: false, error: 'unknown key' }); return true; }
+      const raw = keys().env[row.envName];
+      if (!raw) { send(200, { ok: true, reachable: false, status: 'no key', note: `${row.envName} not set`, ms: null }); return true; }
+      const problem = apiKeyProblem(raw);
+      if (problem) { send(200, { ok: true, reachable: false, status: 'bad key', note: `${row.envName} ${problem}`, ms: null }); return true; }
+      const started = Date.now();
+      // $0: one GET of the models list with THIS row's shape + URL (never a completion), key only in a header
+      checkProviderReachable({
+        providerName: row.provider, apiKey: usableKey(raw), baseUrl: row.baseUrl.trim() !== '' ? row.baseUrl : undefined, fetchImpl, timeoutMs: 4000,
+      }).then((r) => {
+        send(200, { ok: true, reachable: r.reachable, status: r.status, note: r.note, ms: Date.now() - started });
+      });
+      return true;
+    }
+
+    if (pathname === '/api/settings/providers/balance' && req.method === 'GET') {
+      // DeepSeek only: fetched server-side from the provider (key in a header, never returned)
+      const q = new URL(/** @type {string} */ (req.url), 'http://127.0.0.1').searchParams;
+      const row = currentRows(readConfig({ home: opts.home }).config).find((r) => r.envName === q.get('env'));
+      if (!row || row.provider !== 'openai-api' || hostOf(endpointOf(row.provider, row.baseUrl)) !== 'api.deepseek.com') { send(404, { ok: false, error: 'not found' }); return true; }
+      const raw = keys().env[row.envName];
+      if (!raw || apiKeyProblem(raw)) { send(200, { ok: true, text: null, note: 'no usable key' }); return true; }
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 4000);
+      fetchImpl(DEEPSEEK_BALANCE_URL, { method: 'GET', headers: { Authorization: `Bearer ${raw}` }, signal: controller.signal })
+        .then(async (res) => {
+          if (!res.ok) { send(200, { ok: true, text: null, note: `HTTP ${res.status}` }); return; }
+          /** @type {any} */
+          let j = null;
+          try { j = await res.json(); } catch { j = null; }
+          const infos = Array.isArray(j?.balance_infos) ? j.balance_infos : [];
+          const parts = infos
+            .filter((/** @type {any} */ b) => b && typeof b.currency === 'string' && b.total_balance !== undefined)
+            .map((/** @type {any} */ b) => `${String(b.total_balance)} ${b.currency}`);
+          send(200, { ok: true, text: parts.length ? parts.join(' + ') : null, note: parts.length ? null : 'balance not reported' });
+        })
+        .catch((/** @type {any} */ e) => { send(200, { ok: true, text: null, note: `request failed: ${e?.name === 'AbortError' ? 'timeout' : (e?.code || e?.name || 'error')}` }); })
+        .finally(() => clearTimeout(timer));
+      return true;
+    }
+
+    send(404, { ok: false, error: 'not found' });
+    return true;
+  }
+  return { handle };
+}

package/src/planrun.js

@@ -762,6 +762,10 @@ ${scoutBlob || '(no scout notes)'}`;
  *   `false` → the drafter has no tools, so a native session would report NO cost — return a
  *   metered claude-json TEXT provider (`--output-format json`, `parse:'claude-json'`) instead,
  *   so its spend is never invisible. The Loop path (`anthropic-api`) never touches this.
+ * @param {{in: number, out: number}|null} [opts.rates] the customer's own price for the worker's key row (USD per
+ *   1K tokens, `ratesFor`) — handed to the one Loop that drives worker, scout and planner rounds, so they read
+ *   `rateSource:'caller'`; null = bare-agent's built-in guess. Not applied to a native (CLI) session, which reports its own cost.
+ * @param {{in: number, out: number}|null} [opts.judgeRates] the same, for the judge's Loop
  * @param {string|null} [opts.judgeModel] softgreen — WHICH model that judge provider drives
  *   (PRD item 32.1). Resolved by the CALLER (`resolveJudge`, src/judged.js: the spec's signed
  *   `judge` override, else the job's own worker model), never pinned in this library. It
@@ -983,7 +987,7 @@ ${scoutBlob || '(no scout notes)'}`;
  *   'branch-red' | 'cap-halt' | 'wall-halt' | 'provider-red' | 'interpreter-red' |
  *   'step-stalled' | 'hitl-pause' | 'hitl-decision-red' | `step-red:<id>`
  */
-export async function runPlan(job, { workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, emit, remainingUsd, isUnpriced = () => false, spendComplete = () => true, capRuns = 3, strikeLimit = STRIKE_LIMIT, closeTimeoutMs, closeDir = null, maxStepRounds = 40, layerRoot = false, readShim = false, scout = true, scoutRounds = SCOUT_ROUNDS, bridge = null, now, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, priorSpentUsd = 0, reviewDoor = null, doorRerun = null, resumable = true }) {
+export async function runPlan(job, { workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, rates = null, judgeRates = null, emit, remainingUsd, isUnpriced = () => false, spendComplete = () => true, capRuns = 3, strikeLimit = STRIKE_LIMIT, closeTimeoutMs, closeDir = null, maxStepRounds = 40, layerRoot = false, readShim = false, scout = true, scoutRounds = SCOUT_ROUNDS, bridge = null, now, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, priorSpentUsd = 0, reviewDoor = null, doorRerun = null, resumable = true }) {
   // MEMORY-CACHE: what the read shim (src/readshim.js) saved THIS run, summed across
   // every mkWorker's own shim instance (scout, drafter, each step's worker, the fix
   // worker) — one accumulator closed over by all of them, because the shim's ledger
@@ -1687,7 +1691,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       // ride, so `runJob`'s ONE ledger accounts a close's spend exactly as it accounts
       // an attempt's (a budget funds the attempt PLUS its close), and a null cost trips
       // the same F6 pricing halt rather than being laundered into $0.
-      judgeLoop: judgeProvider ? (/** @type {{system: string}} */ o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system }) : null,
+      judgeLoop: judgeProvider ? (/** @type {{system: string}} */ o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgeRates }) : null,
       // the seam's other half (PRD item 32.1) — WHICH model that loop drives. Passed
       // through untouched: this module resolves no judge, exactly as it constructs no
       // provider. `runJudgedFloor` stops as a wiring gap when it is absent rather than
@@ -2750,7 +2754,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         }
         return onLlmResult(arg);
       };
-      self = new Loop({ provider: loopProvider, system, policy, onLlmResult: metered, onToolResult: onToolOutcome });
+      self = new Loop({ provider: loopProvider, system, policy, onLlmResult: metered, onToolResult: onToolOutcome, ...(rates ? { rates } : {}) });
       return self;
     };
     /** @param {string} prompt @param {typeof toolDefs} [defs] */