bareloop 0.35.0 → 0.36.0

package/src/panel/server.js

@@ -31,6 +31,7 @@ import {
 } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { readRunList, DIED_MTIME_MS, runIsAlive } from '../runlist.js';
+import { draftingPartFor } from '../draftspend.js';
 import {
   replayOne, parseJsonl, resolveSiblings, isSidecarByName,
 } from '../replayio.js';
@@ -321,6 +322,9 @@ export function resumePlanFor(row, records) {
   if (!age.ok) return { ok: false, why: String(age.detail ?? 'its checkpoint has expired') };
   const near = sourceNearSpine(row.spine);
   if (!near.specPath) return { ok: false, why: 'the signed job file is not beside this run' };
+  // P6 item 1: a worktree run resumes IN its worktree — a folder that is gone is a resume the engine would refuse
+  const wt = worktreeOfRun(row, records);
+  if (wt && !wt.exists) return { ok: false, why: `its worktree folder ${wt.folder} is gone` };
   const dir = dirname(near.specPath);
   /** @type {string[]} */
   let names = [];
@@ -407,10 +411,29 @@ const GOAL_NOT_MET = new Set(['plan-red', 'check-red', 'step-red', 'escalated'])
  * (replaces P5 item 3, 2026-10-03) is offered on green rows only, and starts a NEW run.
  * @param {{outcome: string|null, stopReason: string|null, spentUsd: number|null, budgetUsd: number|null, lastEscalation?: any}} summary
  * @param {{died: boolean, lastThing: string|null}} death
- * @param {{resume?: {ok: boolean, why?: string}|null, destinationRefused?: string|null, moneyHalt?: boolean}} [o]
+ * @param {{resume?: {ok: boolean, why?: string}|null, destinationRefused?: string|null, moneyHalt?: boolean,
+ *   worktree?: {folder: string, repo: string, branch: string|null, exists: boolean}|null}} [o]
+ *   `worktree` (P6 item 1): the run's worktree in the person's repo, from {@link worktreeOfRun}; absent for every other run
  * @returns {{reason: string, next: string, line: string, actions: {id: string, label: string}[]}|null}
  */
 export function endedFor(summary, death, o = {}) {
+  const base = endedBase(summary, death, o);
+  const wt = o.worktree;
+  if (!base || !wt) return base;
+  // P6 item 1 — the run worked on a worktree in the person's own repo. GREEN: the branch carries the work (the folder is
+  // removed by the engine) and the merge stays the person's — the two commands are shown as TEXT, never run by a button.
+  // Any other ending: the worktree folder stays (Resume needs it), so the block names it.
+  const green = !death.died && (summary.outcome === 'green' || summary.outcome === 'already-green' || summary.outcome === 'satisfied');
+  if (green) {
+    if (!wt.branch) return base;
+    const kept = wt.exists ? ` The worktree folder ${wt.folder} is still there.` : '';
+    return { ...base, next: `In ${wt.repo}: git merge ${wt.branch} — or throw the work away: git branch -D ${wt.branch}.${kept}` };
+  }
+  return wt.exists ? { ...base, next: `${base.next} Your work is in ${wt.folder}.` } : base;
+}
+
+/** @param {any} summary @param {any} death @param {any} o */
+function endedBase(summary, death, o) {
   const resumeOk = !!(o.resume && o.resume.ok);
   /** @type {{id: string, label: string}[]} */
   const RESUME = [{ id: 'resume', label: 'Resume' }];
@@ -572,7 +595,7 @@ function lastJobEndTs(/** @type {any[]} */ records) {
   return null;
 }
 
-function endedForRow(row, records, summary, death) {
+function endedForRow(row, records, summary, death, withWorktree = false) {
   const out = summary.outcome;
   const maybeResumable = death.died || out === 'escalated' || (typeof out === 'string' && CHECKPOINT_OUTCOMES.includes(out));
   const resume = maybeResumable ? resumePlanFor(row, records) : null;
@@ -581,6 +604,7 @@ function endedForRow(row, records, summary, death) {
     resume,
     moneyHalt: records.some((r) => r && r.type === 'money-halt'),
     destinationRefused: refused ? String(refused.detail ?? refused.code ?? 'the destination refused it') : null,
+    worktree: withWorktree ? worktreeOfRun(row, records) : null,
   });
   const esc = summary.lastEscalation;
   const status = statusFor({
@@ -731,6 +755,40 @@ export function getStopContext(runid, opts = {}) {
   return { row, live: runIsAlive(row), spineExists: existsSync(row.spine) };
 }
 
+/**
+ * @param {any} r
+ * @returns {number}
+ */
+function atMs(r) {
+  const t = typeof r?.at === 'string' ? Date.parse(r.at) : NaN;
+  return Number.isFinite(t) ? t : 0;
+}
+
+/**
+ * The ONE owner of run names (P6 item 7): runs of the same job (`row.job`) are numbered oldest `at` first, 1-based
+ * (ties keep file order). A resume is one row, so it counts once; died and stopped runs are rows too. Every view
+ * reads this number — the page never counts on its own.
+ * @param {any[]} rows
+ * @returns {Map<string, number>} runid → N
+ */
+function runNumbers(rows) {
+  /** @type {Map<string, any[]>} */
+  const byJob = new Map();
+  rows.forEach((row, index) => {
+    if (!row || typeof row.runid !== 'string') return;
+    const g = byJob.get(row.job) || [];
+    g.push({ row, index });
+    byJob.set(row.job, g);
+  });
+  /** @type {Map<string, number>} */
+  const out = new Map();
+  for (const g of byJob.values()) {
+    g.sort((a, b) => (atMs(a.row) - atMs(b.row)) || (a.index - b.index));
+    g.forEach(({ row }, i) => out.set(row.runid, i + 1));
+  }
+  return out;
+}
+
 /**
  * `GET /api/runs` — every listed run, NEWEST FIRST BY `at` (never by file/
  * append order — a backfill scan appends rows in sorted-PATH order, which
@@ -749,14 +807,29 @@ export function getStopContext(runid, opts = {}) {
  */
 export function listRuns(opts = {}) {
   const { rows } = readRunList(opts);
-  const atMs = (r) => {
-    const t = typeof r?.at === 'string' ? Date.parse(r.at) : NaN;
-    return Number.isFinite(t) ? t : 0;
-  };
+  const nos = runNumbers(rows);
   return rows
     .map((row, index) => ({ row, index })) // index: stable tie-break, see doc above
     .sort((a, b) => (atMs(b.row) - atMs(a.row)) || (a.index - b.index))
-    .map(({ row }) => summarizeRow(row));
+    .map(({ row }) => ({ ...summarizeRow(row), runNo: nos.get(row.runid) }));
+}
+
+/**
+ * The run's DRAFTING PART (hamr 2026-10-06, option A), or null: it exists only when the run came out of a panel
+ * session whose drafting log carries a metered call (src/draftspend.js, `draftingPartFor`) and the spine carries the
+ * drafting figure. It is the FIRST element of `detail.parts`, so EVERY index a reader is handed — `detail.parts`,
+ * `legDividers.beforePart`, the flat Audit rows' `partIndex`, the rounds endpoint's `part` — lives in ONE index space
+ * (the shown list), shifted by {@link draftingShift} in exactly those four places and nowhere else.
+ * @param {any} row @param {any} summary a `replayOne` summary of the row's spine @param {{ home?: string }} opts
+ * @returns {any|null}
+ */
+function draftingFor(row, summary, opts) {
+  return draftingPartFor(row, { draftSpentUsd: summary.draftSpentUsd, draftSpendComplete: summary.draftSpendComplete }, opts);
+}
+
+/** @param {any} row @param {any} summary @param {{ home?: string }} opts @returns {0|1} how far the drafting part pushes every other part's index */
+function draftingShift(row, summary, opts) {
+  return draftingFor(row, summary, opts) ? 1 : 0;
 }
 
 /**
@@ -789,6 +862,18 @@ function findRunRow(runid, opts) {
  * @returns {any|null}
  */
 export function getRunDetail(runid, opts = {}) {
+  const d = getRunDetailBody(runid, opts);
+  if (!d) return d;
+  const runNo = runNumbers(readRunList(opts).rows).get(runid);
+  return runNo === undefined ? d : { ...d, runNo };
+}
+
+/**
+ * @param {string} runid
+ * @param {{ home?: string }} opts
+ * @returns {any|null}
+ */
+function getRunDetailBody(runid, opts) {
   const row = findRunRow(runid, opts);
   if (!row) return null;
   if (!existsSync(row.spine)) {
@@ -810,8 +895,12 @@ export function getRunDetail(runid, opts = {}) {
   const auditPaths = resolveAuditPathsForRow(row, rawSpineRecords);
   const summary = replayOne(row.spine, { auditPathOverride: auditPaths.length > 0 ? auditPaths : null });
   const timelineKind = summary.timelineKind;
+  // the drafting part (see draftingFor) heads the parts list; the enrichment below touches the spine's own parts only
+  const draftingPartHere = draftingFor(row, summary, opts);
+  const draftingShiftHere = draftingPartHere ? 1 : 0;
+  const enrichedParts = enrichPartsWithStageKind(summary.parts, stageKindMetaFromSpec(resolveSpecForRow(row)));
   const death = deriveDeath(row, rawSpineRecords, summary.outcome);
-  const { ended, resume, status } = endedForRow(row, rawSpineRecords, summary, death);
+  const { ended, resume, status } = endedForRow(row, rawSpineRecords, summary, death, true);
   // judgeModel (Summary box "judge:" line): the FIRST `judge-round`'s own
   // `model` field (src/planrun.js:1704's `onJudgeCost` emit) — a soft-green
   // close's own paid judge seam, distinct from the worker `model` above.
@@ -980,7 +1069,8 @@ export function getRunDetail(runid, opts = {}) {
     // P5-R: the run's legs in order (`after` = how the leg before ended) and the resume count — the Audit tab's
     // dividers and the map's connectors read these; never a second derivation of where a leg starts
     legs: summary.legs,
-    legDividers: legDividersFor(rawSpineRecords, summary.parts),
+    // drafting belongs to leg 1: a divider's `beforePart` moves with the parts list it indexes
+    legDividers: legDividersFor(rawSpineRecords, summary.parts).map((d) => ({ ...d, beforePart: d.beforePart + draftingShiftHere })),
     resumedCount: Math.max(0, summary.legs.length - 1),
     resume: resume && resume.ok ? {
       budgetUsd: resume.budgetUsd, maxWallMin: resume.maxWallMin, spentUsd: resume.spentUsd, spendComplete: resume.spendComplete,
@@ -1027,7 +1117,7 @@ export function getRunDetail(runid, opts = {}) {
     // {@link enrichPartsWithStageKind}. `kindMeta` is `null` (every stage
     // passes through unchanged) whenever no spec resolves at all, so the two
     // tabs still never disagree about order/counts/blocked-call figures.
-    parts: enrichPartsWithStageKind(summary.parts, stageKindMetaFromSpec(resolveSpecForRow(row))),
+    parts: draftingPartHere && Array.isArray(enrichedParts) ? [draftingPartHere, ...enrichedParts] : enrichedParts,
     replans: summary.replans,
     close: summary.close,
     branch: summary.branch,
@@ -1379,6 +1469,7 @@ export function getRunAudit(runid, opts = {}) {
     skipAudit: true,
   });
   const partOf = makePartLookup(summary);
+  const shift = draftingShift(row, summary, opts); // the drafting part heads the shown list: every index moves with it
 
   const { records } = { records: auditPaths.flatMap((ap) => parseJsonl(ap).records) };
   const windowed = records.filter((r) => r && typeof r === 'object' && typeof r.ts === 'string' && inAnyWindow(r.ts, windows));
@@ -1419,7 +1510,7 @@ export function getRunAudit(runid, opts = {}) {
       path,
       pathShort: shortenPath(path, treeRoot),
       decision: typeof r.decision === 'string' ? r.decision : null,
-      partIndex,
+      partIndex: partIndex === null ? null : partIndex + shift,
       partLabel,
       attemptN,
       reason,
@@ -1488,7 +1579,11 @@ export function getRunRounds(runid, query = {}, opts = {}) {
     ? Math.min(query.limit, ROUNDS_PAGE_MAX) : ROUNDS_PAGE_DEFAULT;
 
   const summary = replayOne(row.spine);
-  const part = Array.isArray(summary.parts) ? summary.parts[partIndex] : null;
+  // `part` is an index into the SHOWN list (`detail.parts`): when the drafting part heads it, index 0 is the drafting
+  // part (it has no rounds table) and the spine's own part k is shown at k + 1
+  const shift = draftingShift(row, summary, opts);
+  if (shift && partIndex === 0) return null;
+  const part = Array.isArray(summary.parts) ? summary.parts[partIndex - shift] : null;
   if (!part) return null;
   const a = Array.isArray(part.attempts) ? part.attempts[attempt - 1] : null;
   if (!a) return null;
@@ -1616,6 +1711,25 @@ function sourceNearSpine(spinePath) {
   };
 }
 
+/**
+ * P6 item 1 — the worktree a run worked on in the person's own repo, read off the run's own `source.json` (the manifest
+ * the source door wrote: `worktree` + `repo`) and its spine's `work-branch` record. `null` for every run that has none
+ * (a copied-tree run, a bundle run, an import). `exists` is whether the folder is still on disk: a green run's folder is
+ * removed by the engine, any other ending leaves it.
+ * @param {{ spine: string }} row
+ * @param {any[]} records the run's raw spine records
+ * @returns {{folder: string, repo: string, branch: string|null, exists: boolean}|null}
+ */
+function worktreeOfRun(row, records) {
+  const near = sourceNearSpine(row.spine);
+  if (!near.sourceJsonPath) return null;
+  let m;
+  try { m = JSON.parse(readFileSync(near.sourceJsonPath, 'utf8')); } catch { return null; }
+  if (typeof m?.worktree !== 'string' || m.worktree === '' || typeof m?.repo !== 'string') return null;
+  const wb = records.findLast((r) => r && r.type === 'work-branch' && typeof r.branch === 'string') ?? null;
+  return { folder: m.worktree, repo: m.repo, branch: wb ? wb.branch : null, exists: existsSync(m.worktree) };
+}
+
 /**
  * The resolved SPEC OBJECT for a run — routes (a) bundle `spec.json`, (b)
  * `jobs/<job>.json`, (c) the run's own `resolved-spec.json` beside the spine
@@ -2526,7 +2640,7 @@ export function handleRequest(req, res, opts) {
       });
       return;
     }
-    sendText(res, 405, 'method not allowed — this panel is read-only outside /api/author and /api/settings (GET/HEAD only)');
+    sendText(res, 405, 'method not allowed — this route does not accept this method (GET/HEAD only)');
     return;
   }
   const getRoutes = routesFor(opts, pathname);
@@ -2635,7 +2749,8 @@ export function handleRequest(req, res, opts) {
  * this package's own `bin/bareloop.mjs`).
  * @param {{ port?: number, home?: string, env?: Record<string,string|undefined>,
  *   sessionsRoot?: string, spawnFn?: (...a: any[]) => any, bareloopBin?: string,
- *   fetchImpl?: typeof fetch, settleMs?: number, userHome?: string }} [opts]
+ *   fetchImpl?: typeof fetch, settleMs?: number, userHome?: string,
+ *   openFolderSpawn?: (cmd: string, args: string[], o: object) => any, platform?: string }} [opts]
  * @returns {Promise<{ server: import('node:http').Server, port: number, token: string, close: () => Promise<void> }>}
  */
 export function createPanelServer(opts = {}) {
@@ -2690,6 +2805,7 @@ export function createPanelServer(opts = {}) {
       });
       settingsRoutes = createSettingsRoutes({
         port: boundPort, token, home, env: opts.env, fetchImpl: opts.fetchImpl,
+        openFolderSpawn: opts.openFolderSpawn, platform: opts.platform,
       });
       runRoutes = createRunRoutes({
         port: boundPort,

package/src/panel/settingsroutes.js

@@ -14,7 +14,8 @@
 import { checkHumanGuard } from './authorroutes.js';
 import { readConfig, updateConfig, ConfigError } from '../config.js';
 import { spendSummary, monthlyLimitOf } from '../monthly.js';
-import { loadKeysEnv, keysFilePath, filledKeyNames, ensureKeysFile } from '../keysfile.js';
+import { spawn as realSpawn } from 'node:child_process';
+import { loadKeysEnv, keysFilePath, keysHome, filledKeyNames, ensureKeysFile } from '../keysfile.js';
 import { SHAPES, PRESET_KEY_NAMES, keyRows, endpointOf, defaultUrlOf, usableKey } from '../providerrows.js';
 import { apiKeyProblem, checkProviderReachable } from '../providers.js';
 
@@ -22,8 +23,11 @@ import { apiKeyProblem, checkProviderReachable } from '../providers.js';
 const DEEPSEEK_BALANCE_URL = 'https://api.deepseek.com/user/balance';
 
 /**
+ * `openFolderSpawn` / `platform` are test seams for the Open keys folder button (a real caller passes
+ * neither: `child_process.spawn` and `process.platform`).
  * @param {{ port: number, token: string, home?: string, env?: Record<string,string|undefined>,
- *   fetchImpl?: typeof fetch, now?: () => number }} opts
+ *   fetchImpl?: typeof fetch, now?: () => number, openFolderSpawn?: (cmd: string, args: string[], o: object) => any,
+ *   platform?: string }} opts
  */
 export function createSettingsRoutes(opts) {
   const fetchImpl = opts.fetchImpl ?? fetch;
@@ -134,6 +138,8 @@ export function createSettingsRoutes(opts) {
             placeholder: defaultUrlOf(r.provider),
             keyStatus: !raw ? 'not set' : (raw === 'null' ? 'no key needed' : (problem ? `bad shape (${problem})` : 'found')),
             canTest: r.provider !== 'gemini-api',
+            priceInPerM: typeof r.priceInPerM === 'number' ? r.priceInPerM : null,
+            priceOutPerM: typeof r.priceOutPerM === 'number' ? r.priceOutPerM : null,
             tokens: s.tokensByRow[r.envName] ?? 0,
             balance: r.provider === 'anthropic-api'
               ? { kind: 'note', usd: typeof note === 'number' && Number.isFinite(note) ? note : null }
@@ -148,11 +154,32 @@ export function createSettingsRoutes(opts) {
       const row = currentRows(readConfig({ home: opts.home }).config).find((r) => r.envName === body?.envName);
       if (!row) { send(400, { ok: false, error: 'unknown key — add NAME=key to your keys file and reload keys' }); return true; }
       // only the three settings a row has; each is optional in the body, the whole triple is stored
+      /** @type {Record<string, string|number|null>} */
       const patch = {
         name: typeof body?.name === 'string' ? body.name.trim() : row.name,
         shape: typeof body?.shape === 'string' ? body.shape : row.provider,
         baseUrl: typeof body?.baseUrl === 'string' ? body.baseUrl.trim().replace(/\/+$/, '') : row.baseUrl,
       };
+      // the two prices (USD per 1M tokens): absent = unchanged; blank / null = not set (the field is removed,
+      // never written as 0); otherwise a finite number >= 0 — anything else is refused and nothing is saved
+      for (const f of /** @type {const} */ (['priceInPerM', 'priceOutPerM'])) {
+        if (!Object.hasOwn(body ?? {}, f)) continue;
+        const v = body[f];
+        const label = f === 'priceInPerM' ? 'In' : 'Out';
+        if (v === null || (typeof v === 'string' && v.trim() === '')) { patch[f] = null; continue; }
+        const n = typeof v === 'number' ? v : (typeof v === 'string' && /^\d+(\.\d+)?$/.test(v.trim()) ? Number(v.trim()) : NaN);
+        if (!(Number.isFinite(n) && n >= 0)) {
+          send(400, { ok: false, error: `the ${label} price must be a number, 0 or more (USD per 1M tokens), or blank for not set` });
+          return true;
+        }
+        patch[f] = n;
+      }
+      // a price is both fields or neither — ratesFor refuses a half-set one at run time, so never save half
+      const after = (/** @type {'priceInPerM'|'priceOutPerM'} */ f) => (Object.hasOwn(patch, f) ? patch[f] !== null : row[f] !== undefined);
+      if (after('priceInPerM') !== after('priceOutPerM')) {
+        send(400, { ok: false, error: 'set both prices (In and Out, USD per 1M tokens) or neither — a half-set price is refused' });
+        return true;
+      }
       try {
         updateConfig({ keys: { [row.envName]: patch } }, { home: opts.home });
       } catch (e) {
@@ -164,6 +191,29 @@ export function createSettingsRoutes(opts) {
       return true;
     }
 
+    if (pathname === '/api/settings/open-keys-folder' && req.method === 'POST') {
+      // opens the FOLDER (never the file, never an editor) in the file manager; argv array, no shell, detached.
+      // Another OS, or a failed spawn: say so and hand back the path, which the page then shows as text.
+      const dir = keysHome(opts.home);
+      const platform = opts.platform ?? process.platform;
+      const cmd = platform === 'linux' ? 'xdg-open' : (platform === 'darwin' ? 'open' : null);
+      const cannot = () => send(200, { ok: true, opened: false, path: dir });
+      if (!cmd) { cannot(); return true; }
+      let child;
+      try {
+        child = (opts.openFolderSpawn ?? realSpawn)(cmd, [dir], { detached: true, stdio: 'ignore' });
+      } catch { cannot(); return true; }
+      let settled = false;
+      child.once('error', () => { if (!settled) { settled = true; cannot(); } });
+      child.once('spawn', () => {
+        if (settled) return;
+        settled = true;
+        if (typeof child.unref === 'function') child.unref();
+        send(200, { ok: true, opened: true, path: dir });
+      });
+      return true;
+    }
+
     if (pathname === '/api/settings/providers/balance-note' && req.method === 'POST') {
       // the Anthropic balance is a NOTE the person types; no check ever reads it
       const raw = body?.usd;

package/src/ralph.js

@@ -49,7 +49,7 @@ const CLOSE_KILL_GRACE_MS = 2000;
  * @param {{env: NodeJS.ProcessEnv, cwd?: string, timeoutMs?: number}} o
  * @returns {Promise<{error: (Error & {code?: string})|null, status: number|null, signal: string|null, stdout: string, stderr: string}>}
  */
-function spawnClose(cmd, args, { env, cwd, timeoutMs }) {
+export function spawnClose(cmd, args, { env, cwd, timeoutMs }) {
   return new Promise((resolve) => {
     const child = spawn(cmd, args, { env, cwd });
     /** @type {Buffer[]} */ const outChunks = [];

package/src/source.js

@@ -27,6 +27,7 @@ import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { mkdir, readdir, readFile, writeFile, lstat, stat, chmod, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
 import { dirname, join, relative, resolve, sep, basename } from 'node:path';
 import { git } from './kinds.js';
+import { addWorktree, hideBareloopDir } from './worktree.js';
 import { MAX_BUFFER } from './kinds.js';
 import { PROVIDER_TIMEOUT_MS } from './clock.js';
 import { scanSecrets, SECRET_PATTERNS, SECRET_PATTERN_NAMES } from './validate.js';
@@ -440,16 +441,21 @@ async function fetchOnce(url, timeoutMs) {
  * as declared, unvalidated by `proveDestination`, and `frontDoorFromManifest`
  * never hands a repo source's destination to `copyOut` — wiring it into
  * `writeScope` is M3/M4's job, not this one.
- * @param {{source: string, into: string, destination?: string,
+ * `worktree` (P6 item 1, repo sources ONLY — ignored for every other kind): instead of COPYING the repo, make the
+ * run's tree a detached git worktree of the person's own repo at that directory (the shared
+ * `src/worktree.js`, the bundle door's own spelling), hide `.bareloop/` from their `git status`, and record the
+ * worktree and the repo root in the manifest. `into` then holds only `source.json`; the tree is `worktree`, at the
+ * repo's current commit (uncommitted edits are NOT in it). No seed commit is made — the seed IS the repo's HEAD.
+ * @param {{source: string, into: string, destination?: string, worktree?: string,
  *   fetchTimeoutMs?: number, afterScan?: () => (void|Promise<void>)}} args
  *   `fetchTimeoutMs` is test-only — production callers omit it and get
  *   `PROVIDER_TIMEOUT_MS`. `afterScan` is a test seam too: called exactly once,
  *   after the secret scan finished and before the freeze loop re-reads any
  *   file's bytes, so a test can swap a file inside that window
  *   deterministically. Production never sets it; absent, behaviour is unchanged.
- * @returns {Promise<{stop: null, into: string, tree: string, manifestPath: string, manifest: object}|SourceRefusal>}
+ * @returns {Promise<{stop: null, into: string, tree: string, manifestPath: string, manifest: Record<string, any>}|SourceRefusal>}
  */
-export async function prepareSource({ source, into, destination, fetchTimeoutMs = PROVIDER_TIMEOUT_MS, afterScan }) {
+export async function prepareSource({ source, into, destination, worktree, fetchTimeoutMs = PROVIDER_TIMEOUT_MS, afterScan }) {
   const intoAbs = resolve(into);
   if (existsSync(intoAbs)) {
     return refuse('into-exists', `${intoAbs} already exists — a source door writes a FRESH tree, never reuses one (the export worktree rule)`);
@@ -634,6 +640,9 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     const buf = f.buf ?? (f.symlinkTarget !== undefined ? Buffer.from(f.symlinkTarget, 'utf8') : await readFile(/** @type {string} */ (f.abs)));
     fileMeta.push({ path: f.rel, bytes: buf.length, sha256: sha256Hex(buf) });
     const isBinary = f.symlinkTarget === undefined && hasNulByte(buf.subarray(0, 8192));
+    // P6 item 2 (hamr 2026-10-05 Q2=A): a repo going onto a WORKTREE is the person's OWN repo, left in place — a secret
+    // already in it is MASKED wherever bareloop records it (`redactSecrets`), not a refusal. Every other kind keeps the scan.
+    if (worktree !== undefined && frozen.kind === 'repo') continue;
     const names = secretPatternNames(buf.toString(isBinary ? 'latin1' : 'utf8'));
     if (names.length) secretHits.push({ rel: f.rel, names });
   }
@@ -642,6 +651,34 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     return refuse('source-carries-secret', `${secretHits.length} file(s) carry a known secret shape — refused before anything was written (hard line #3, secrets never enter the tree): ${detail}`);
   }
 
+  if (worktree !== undefined && frozen.kind === 'repo') {
+    const repoRoot = /** @type {string} */ (frozen.root);
+    const wt = resolve(worktree);
+    try {
+      hideBareloopDir(repoRoot);
+      addWorktree(repoRoot, wt);
+    } catch (e) {
+      return refuse('source-worktree-failed', `could not make the job's worktree in ${repoRoot}: ${/** @type {Error} */ (e).message} (the repo needs at least one commit)`);
+    }
+    const headAt = await git(wt, ['rev-parse', 'HEAD']);
+    if (!headAt.ok) return refuse('source-git-failed', `git rev-parse HEAD failed in ${wt}: ${headAt.err}`);
+    const wtManifest = {
+      kind: 'repo',
+      source,
+      ...(frozen.sourceSubdir === undefined ? {} : { sourceSubdir: frozen.sourceSubdir }),
+      fetchedAt: new Date().toISOString(),
+      files: fileMeta,
+      seed: headAt.out.trim(),
+      destination: destination ?? null,
+      worktree: wt,
+      repo: repoRoot,
+    };
+    await mkdir(intoAbs, { recursive: true });
+    const wtManifestPath = join(intoAbs, 'source.json');
+    await writeFile(wtManifestPath, `${JSON.stringify(wtManifest, null, 2)}\n`);
+    return { stop: null, into: intoAbs, tree: wt, manifestPath: wtManifestPath, manifest: wtManifest };
+  }
+
   const treeDir = join(intoAbs, 'tree');
   const outputDir = join(treeDir, 'output');
   await mkdir(treeDir, { recursive: true });
@@ -809,7 +846,7 @@ const LOCKFILE_COMMANDS = Object.freeze([
  *   manifest)
  * @param {string} [sourceSubdir] the manifest's own `sourceSubdir` ('' or
  *   undefined when Source IS the repo root)
- * @returns {{manager: string, command: string, reason: string}|null} `null`
+ * @returns {{dir: string, lockFile: string|null, manager: string, command: string, reason: string}|null} `null`
  *   when there is nothing to report: no JS/TS manifest found walking up from
  *   `sourceSubdir` to `treeDir`, the nearest one found has no dependencies,
  *   `node_modules` is already there, or the manifest cannot even be read as
@@ -846,6 +883,8 @@ export function missingDependencies(treeDir, sourceSubdir = '') {
     const installCmd = lock ? lock.command : 'npm install';
     const rel = relative(root, d).split(sep).join('/');
     return {
+      dir: d,
+      lockFile: lock ? lock.file : null,
       manager: installCmd.split(' ')[0],
       command: rel === '' ? installCmd : `cd ${rel} && ${installCmd}`,
       reason: `${rel === '' ? 'package.json' : `${rel}/package.json`} lists dependencies but the copy has no node_modules`,

package/src/u-patient.js

@@ -16,9 +16,10 @@
 // mechanical preparation of a tree, and both callers print what it did.
 import { execFileSync } from 'node:child_process';
 import {
-  rmSync, existsSync, renameSync,
+  rmSync, existsSync,
 } from 'node:fs';
 import { join } from 'node:path';
+import { moveFile } from './movefile.js';
 
 /**
  * Reset a patient to its frozen seed and drop its `.litectx` store.
@@ -68,6 +69,6 @@ export function moveStaleGateAudit(wd, spineDir, runid) {
   const staleAudit = join(wd, 'gate-audit.jsonl');
   if (!existsSync(staleAudit)) return null;
   const preFile = join(spineDir, `pre-${runid}-gate-audit.jsonl`);
-  renameSync(staleAudit, preFile);
+  moveFile(staleAudit, preFile);
   return preFile;
 }