bareloop 0.35.0 → 0.37.0

package/src/panel/server.js

@@ -31,6 +31,7 @@ import {
 } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { readRunList, DIED_MTIME_MS, runIsAlive } from '../runlist.js';
+import { draftingPartFor } from '../draftspend.js';
 import {
   replayOne, parseJsonl, resolveSiblings, isSidecarByName,
 } from '../replayio.js';
@@ -52,7 +53,7 @@ import { rowsForHome, findRow, modelChoiceFor } from '../providerrows.js';
 import { resolveProvider } from '../providers.js';
 import { REUSE_LOCKED_FIELDS, REUSE_OPEN_FIELDS } from './authorsession.js';
 import { readResume, checkpointAgeGate, CHECKPOINT_OUTCOMES } from '../reuse.js';
-import { statusFor, GOAL_MET_LINE } from './status.js';
+import { statusFor, partStatusFor, GOAL_MET_LINE } from './status.js';
 import { createSettingsRoutes } from './settingsroutes.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -321,6 +322,9 @@ export function resumePlanFor(row, records) {
   if (!age.ok) return { ok: false, why: String(age.detail ?? 'its checkpoint has expired') };
   const near = sourceNearSpine(row.spine);
   if (!near.specPath) return { ok: false, why: 'the signed job file is not beside this run' };
+  // P6 item 1: a worktree run resumes IN its worktree — a folder that is gone is a resume the engine would refuse
+  const wt = worktreeOfRun(row, records);
+  if (wt && !wt.exists) return { ok: false, why: `its worktree folder ${wt.folder} is gone` };
   const dir = dirname(near.specPath);
   /** @type {string[]} */
   let names = [];
@@ -407,10 +411,29 @@ const GOAL_NOT_MET = new Set(['plan-red', 'check-red', 'step-red', 'escalated'])
  * (replaces P5 item 3, 2026-10-03) is offered on green rows only, and starts a NEW run.
  * @param {{outcome: string|null, stopReason: string|null, spentUsd: number|null, budgetUsd: number|null, lastEscalation?: any}} summary
  * @param {{died: boolean, lastThing: string|null}} death
- * @param {{resume?: {ok: boolean, why?: string}|null, destinationRefused?: string|null, moneyHalt?: boolean}} [o]
+ * @param {{resume?: {ok: boolean, why?: string}|null, destinationRefused?: string|null, moneyHalt?: boolean,
+ *   worktree?: {folder: string, repo: string, branch: string|null, exists: boolean}|null}} [o]
+ *   `worktree` (P6 item 1): the run's worktree in the person's repo, from {@link worktreeOfRun}; absent for every other run
  * @returns {{reason: string, next: string, line: string, actions: {id: string, label: string}[]}|null}
  */
 export function endedFor(summary, death, o = {}) {
+  const base = endedBase(summary, death, o);
+  const wt = o.worktree;
+  if (!base || !wt) return base;
+  // P6 item 1 — the run worked on a worktree in the person's own repo. GREEN: the branch carries the work (the folder is
+  // removed by the engine) and the merge stays the person's — the two commands are shown as TEXT, never run by a button.
+  // Any other ending: the worktree folder stays (Resume needs it), so the block names it.
+  const green = !death.died && (summary.outcome === 'green' || summary.outcome === 'already-green' || summary.outcome === 'satisfied');
+  if (green) {
+    if (!wt.branch) return base;
+    const kept = wt.exists ? ` The worktree folder ${wt.folder} is still there.` : '';
+    return { ...base, next: `In ${wt.repo}: git merge ${wt.branch} — or throw the work away: git branch -D ${wt.branch}.${kept}` };
+  }
+  return wt.exists ? { ...base, next: `${base.next} Your work is in ${wt.folder}.` } : base;
+}
+
+/** @param {any} summary @param {any} death @param {any} o */
+function endedBase(summary, death, o) {
   const resumeOk = !!(o.resume && o.resume.ok);
   /** @type {{id: string, label: string}[]} */
   const RESUME = [{ id: 'resume', label: 'Resume' }];
@@ -572,7 +595,7 @@ function lastJobEndTs(/** @type {any[]} */ records) {
   return null;
 }
 
-function endedForRow(row, records, summary, death) {
+function endedForRow(row, records, summary, death, withWorktree = false) {
   const out = summary.outcome;
   const maybeResumable = death.died || out === 'escalated' || (typeof out === 'string' && CHECKPOINT_OUTCOMES.includes(out));
   const resume = maybeResumable ? resumePlanFor(row, records) : null;
@@ -581,6 +604,7 @@ function endedForRow(row, records, summary, death) {
     resume,
     moneyHalt: records.some((r) => r && r.type === 'money-halt'),
     destinationRefused: refused ? String(refused.detail ?? refused.code ?? 'the destination refused it') : null,
+    worktree: withWorktree ? worktreeOfRun(row, records) : null,
   });
   const esc = summary.lastEscalation;
   const status = statusFor({
@@ -731,6 +755,40 @@ export function getStopContext(runid, opts = {}) {
   return { row, live: runIsAlive(row), spineExists: existsSync(row.spine) };
 }
 
+/**
+ * @param {any} r
+ * @returns {number}
+ */
+function atMs(r) {
+  const t = typeof r?.at === 'string' ? Date.parse(r.at) : NaN;
+  return Number.isFinite(t) ? t : 0;
+}
+
+/**
+ * The ONE owner of run names (P6 item 7): runs of the same job (`row.job`) are numbered oldest `at` first, 1-based
+ * (ties keep file order). A resume is one row, so it counts once; died and stopped runs are rows too. Every view
+ * reads this number — the page never counts on its own.
+ * @param {any[]} rows
+ * @returns {Map<string, number>} runid → N
+ */
+function runNumbers(rows) {
+  /** @type {Map<string, any[]>} */
+  const byJob = new Map();
+  rows.forEach((row, index) => {
+    if (!row || typeof row.runid !== 'string') return;
+    const g = byJob.get(row.job) || [];
+    g.push({ row, index });
+    byJob.set(row.job, g);
+  });
+  /** @type {Map<string, number>} */
+  const out = new Map();
+  for (const g of byJob.values()) {
+    g.sort((a, b) => (atMs(a.row) - atMs(b.row)) || (a.index - b.index));
+    g.forEach(({ row }, i) => out.set(row.runid, i + 1));
+  }
+  return out;
+}
+
 /**
  * `GET /api/runs` — every listed run, NEWEST FIRST BY `at` (never by file/
  * append order — a backfill scan appends rows in sorted-PATH order, which
@@ -749,14 +807,29 @@ export function getStopContext(runid, opts = {}) {
  */
 export function listRuns(opts = {}) {
   const { rows } = readRunList(opts);
-  const atMs = (r) => {
-    const t = typeof r?.at === 'string' ? Date.parse(r.at) : NaN;
-    return Number.isFinite(t) ? t : 0;
-  };
+  const nos = runNumbers(rows);
   return rows
     .map((row, index) => ({ row, index })) // index: stable tie-break, see doc above
     .sort((a, b) => (atMs(b.row) - atMs(a.row)) || (a.index - b.index))
-    .map(({ row }) => summarizeRow(row));
+    .map(({ row }) => ({ ...summarizeRow(row), runNo: nos.get(row.runid) }));
+}
+
+/**
+ * The run's DRAFTING PART (hamr 2026-10-06, option A), or null: it exists only when the run came out of a panel
+ * session whose drafting log carries a metered call (src/draftspend.js, `draftingPartFor`) and the spine carries the
+ * drafting figure. It is the FIRST element of `detail.parts`, so EVERY index a reader is handed — `detail.parts`,
+ * `legDividers.beforePart`, the flat Audit rows' `partIndex`, the rounds endpoint's `part` — lives in ONE index space
+ * (the shown list), shifted by {@link draftingShift} in exactly those four places and nowhere else.
+ * @param {any} row @param {any} summary a `replayOne` summary of the row's spine @param {{ home?: string }} opts
+ * @returns {any|null}
+ */
+function draftingFor(row, summary, opts) {
+  return draftingPartFor(row, { draftSpentUsd: summary.draftSpentUsd, draftSpendComplete: summary.draftSpendComplete }, opts);
+}
+
+/** @param {any} row @param {any} summary @param {{ home?: string }} opts @returns {0|1} how far the drafting part pushes every other part's index */
+function draftingShift(row, summary, opts) {
+  return draftingFor(row, summary, opts) ? 1 : 0;
 }
 
 /**
@@ -789,6 +862,18 @@ function findRunRow(runid, opts) {
  * @returns {any|null}
  */
 export function getRunDetail(runid, opts = {}) {
+  const d = getRunDetailBody(runid, opts);
+  if (!d) return d;
+  const runNo = runNumbers(readRunList(opts).rows).get(runid);
+  return runNo === undefined ? d : { ...d, runNo };
+}
+
+/**
+ * @param {string} runid
+ * @param {{ home?: string }} opts
+ * @returns {any|null}
+ */
+function getRunDetailBody(runid, opts) {
   const row = findRunRow(runid, opts);
   if (!row) return null;
   if (!existsSync(row.spine)) {
@@ -810,8 +895,12 @@ export function getRunDetail(runid, opts = {}) {
   const auditPaths = resolveAuditPathsForRow(row, rawSpineRecords);
   const summary = replayOne(row.spine, { auditPathOverride: auditPaths.length > 0 ? auditPaths : null });
   const timelineKind = summary.timelineKind;
+  // the drafting part (see draftingFor) heads the parts list; the enrichment below touches the spine's own parts only
+  const draftingPartHere = draftingFor(row, summary, opts);
+  const draftingShiftHere = draftingShift(row, summary, opts);
+  const enrichedParts = enrichPartsWithStageKind(summary.parts, stageKindMetaFromSpec(resolveSpecForRow(row)));
   const death = deriveDeath(row, rawSpineRecords, summary.outcome);
-  const { ended, resume, status } = endedForRow(row, rawSpineRecords, summary, death);
+  const { ended, resume, status } = endedForRow(row, rawSpineRecords, summary, death, true);
   // judgeModel (Summary box "judge:" line): the FIRST `judge-round`'s own
   // `model` field (src/planrun.js:1704's `onJudgeCost` emit) — a soft-green
   // close's own paid judge seam, distinct from the worker `model` above.
@@ -980,7 +1069,8 @@ export function getRunDetail(runid, opts = {}) {
     // P5-R: the run's legs in order (`after` = how the leg before ended) and the resume count — the Audit tab's
     // dividers and the map's connectors read these; never a second derivation of where a leg starts
     legs: summary.legs,
-    legDividers: legDividersFor(rawSpineRecords, summary.parts),
+    // drafting belongs to leg 1: a divider's `beforePart` moves with the parts list it indexes
+    legDividers: legDividersFor(rawSpineRecords, summary.parts).map((d) => ({ ...d, beforePart: d.beforePart + draftingShiftHere })),
     resumedCount: Math.max(0, summary.legs.length - 1),
     resume: resume && resume.ok ? {
       budgetUsd: resume.budgetUsd, maxWallMin: resume.maxWallMin, spentUsd: resume.spentUsd, spendComplete: resume.spendComplete,
@@ -1027,7 +1117,9 @@ export function getRunDetail(runid, opts = {}) {
     // {@link enrichPartsWithStageKind}. `kindMeta` is `null` (every stage
     // passes through unchanged) whenever no spec resolves at all, so the two
     // tabs still never disagree about order/counts/blocked-call figures.
-    parts: enrichPartsWithStageKind(summary.parts, stageKindMetaFromSpec(resolveSpecForRow(row))),
+    // a run that DIED (no job-end, runner gone — `death`, decided once above) leaves its last part in flight: that part reads
+    // `died`, never the "happened, so passed" default. Replay alone cannot tell died from still running, so the verdict lives here.
+    parts: (draftingPartHere && Array.isArray(enrichedParts) ? [draftingPartHere, ...enrichedParts] : enrichedParts)?.map((p, i, all) => ({ ...p, status: partStatusFor(death.died && i === all.length - 1 && p.kind !== 'drafting' && p.outcome == null && !p.stopReason ? { ...p, stopReason: 'died' } : p) })),
     replans: summary.replans,
     close: summary.close,
     branch: summary.branch,
@@ -1379,6 +1471,7 @@ export function getRunAudit(runid, opts = {}) {
     skipAudit: true,
   });
   const partOf = makePartLookup(summary);
+  const shift = draftingShift(row, summary, opts); // the drafting part heads the shown list: every index moves with it
 
   const { records } = { records: auditPaths.flatMap((ap) => parseJsonl(ap).records) };
   const windowed = records.filter((r) => r && typeof r === 'object' && typeof r.ts === 'string' && inAnyWindow(r.ts, windows));
@@ -1419,7 +1512,7 @@ export function getRunAudit(runid, opts = {}) {
       path,
       pathShort: shortenPath(path, treeRoot),
       decision: typeof r.decision === 'string' ? r.decision : null,
-      partIndex,
+      partIndex: partIndex === null ? null : partIndex + shift,
       partLabel,
       attemptN,
       reason,
@@ -1488,7 +1581,11 @@ export function getRunRounds(runid, query = {}, opts = {}) {
     ? Math.min(query.limit, ROUNDS_PAGE_MAX) : ROUNDS_PAGE_DEFAULT;
 
   const summary = replayOne(row.spine);
-  const part = Array.isArray(summary.parts) ? summary.parts[partIndex] : null;
+  // `part` is an index into the SHOWN list (`detail.parts`): when the drafting part heads it, index 0 is the drafting
+  // part (it has no rounds table) and the spine's own part k is shown at k + 1
+  const shift = draftingShift(row, summary, opts);
+  if (shift && partIndex === 0) return null;
+  const part = Array.isArray(summary.parts) ? summary.parts[partIndex - shift] : null;
   if (!part) return null;
   const a = Array.isArray(part.attempts) ? part.attempts[attempt - 1] : null;
   if (!a) return null;
@@ -1616,6 +1713,25 @@ function sourceNearSpine(spinePath) {
   };
 }
 
+/**
+ * P6 item 1 — the worktree a run worked on in the person's own repo, read off the run's own `source.json` (the manifest
+ * the source door wrote: `worktree` + `repo`) and its spine's `work-branch` record. `null` for every run that has none
+ * (a copied-tree run, a bundle run, an import). `exists` is whether the folder is still on disk: a green run's folder is
+ * removed by the engine, any other ending leaves it.
+ * @param {{ spine: string }} row
+ * @param {any[]} records the run's raw spine records
+ * @returns {{folder: string, repo: string, branch: string|null, exists: boolean}|null}
+ */
+function worktreeOfRun(row, records) {
+  const near = sourceNearSpine(row.spine);
+  if (!near.sourceJsonPath) return null;
+  let m;
+  try { m = JSON.parse(readFileSync(near.sourceJsonPath, 'utf8')); } catch { return null; }
+  if (typeof m?.worktree !== 'string' || m.worktree === '' || typeof m?.repo !== 'string') return null;
+  const wb = records.findLast((r) => r && r.type === 'work-branch' && typeof r.branch === 'string') ?? null;
+  return { folder: m.worktree, repo: m.repo, branch: wb ? wb.branch : null, exists: existsSync(m.worktree) };
+}
+
 /**
  * The resolved SPEC OBJECT for a run — routes (a) bundle `spec.json`, (b)
  * `jobs/<job>.json`, (c) the run's own `resolved-spec.json` beside the spine
@@ -2345,6 +2461,39 @@ export function getStartFrom(runid, opts = {}) {
   };
 }
 
+/**
+ * The Reuse workflow picker's list: one entry per JOB (same-job identity = `workflowKey`, the one `getStartFrom` uses)
+ * that has at least one GREEN local run, newest green first. `runid` = that job's newest green run, so the page hands
+ * it to the existing start-from flow unchanged; `line` is `getStartFrom`'s own estimate line (never a second
+ * spelling). Local runs only — an imported job keeps its Reuse button in the Import view. $0, read-only.
+ * @param {{ home?: string, model?: string }} [opts] `model` passes through to the estimate line, as start-from's does
+ * @returns {{job: string, runid: string, checkType: 'deterministic'|'rubric', line: string}[]}
+ */
+export function listReuseJobs(opts = {}) {
+  const { rows } = readRunList(opts);
+  const seen = new Set();
+  /** @type {{job: string, runid: string, checkType: 'deterministic'|'rubric', line: string}[]} */
+  const jobs = [];
+  for (let i = rows.length - 1; i >= 0; i -= 1) {
+    const row = rows[i];
+    if (!row || !existsSync(row.spine)) continue;
+    let records;
+    try { records = parseJsonl(row.spine).records; } catch { continue; }
+    const outcome = legsOf(records).at(-1)?.outcome ?? null;
+    // the same endings the Run tab's own Reuse button is offered on (`endedBase`)
+    if (outcome !== 'green' && outcome !== 'already-green' && outcome !== 'satisfied') continue;
+    const signed = signedSpecForRun(row, records);
+    if (!signed) continue;
+    const key = workflowKey(signed.spec);
+    if (seen.has(key)) continue;
+    const pre = getStartFrom(row.runid, opts);
+    if (!pre || !pre.ok) continue;
+    seen.add(key);
+    jobs.push({ job: pre.card.jobName, runid: row.runid, checkType: pre.card.checkType === 'rubric' ? 'rubric' : 'deterministic', line: pre.line });
+  }
+  return jobs;
+}
+
 /**
  * The reuse card for a signed spec: locked boxes from the spec through the Job tab's own readers, open boxes from
  * the spec's own fence and caps (Source and the saved text from the caller — a spec carries neither).
@@ -2522,11 +2671,19 @@ export function handleRequest(req, res, opts) {
         /** @type {any} */
         let body = null;
         if (raw.length > 0) { try { body = JSON.parse(raw); } catch { body = null; } }
-        routes.handle(req, res, pathname, body);
+        // this callback runs OUTSIDE createServer's try/catch (which covers only the synchronous GET path), so a
+        // synchronous throw in a route handler (a full disk, a permission fault) would be an uncaught exception that
+        // takes the whole panel down: answer 500 JSON instead and keep serving
+        try {
+          routes.handle(req, res, pathname, body);
+        } catch (e) {
+          if (res.headersSent) { res.end(); return; }
+          sendJson(res, 500, { ok: false, error: `internal error: ${/** @type {Error} */ (e)?.message ?? String(e)}` });
+        }
       });
       return;
     }
-    sendText(res, 405, 'method not allowed — this panel is read-only outside /api/author and /api/settings (GET/HEAD only)');
+    sendText(res, 405, 'method not allowed — this route does not accept this method (GET/HEAD only)');
     return;
   }
   const getRoutes = routesFor(opts, pathname);
@@ -2635,7 +2792,8 @@ export function handleRequest(req, res, opts) {
  * this package's own `bin/bareloop.mjs`).
  * @param {{ port?: number, home?: string, env?: Record<string,string|undefined>,
  *   sessionsRoot?: string, spawnFn?: (...a: any[]) => any, bareloopBin?: string,
- *   fetchImpl?: typeof fetch, settleMs?: number, userHome?: string }} [opts]
+ *   fetchImpl?: typeof fetch, settleMs?: number, userHome?: string,
+ *   openFolderSpawn?: (cmd: string, args: string[], o: object) => any, platform?: string }} [opts]
  * @returns {Promise<{ server: import('node:http').Server, port: number, token: string, close: () => Promise<void> }>}
  */
 export function createPanelServer(opts = {}) {
@@ -2686,10 +2844,12 @@ export function createPanelServer(opts = {}) {
         startFrom: {
           get: (runid, o = {}) => getStartFrom(runid, { home, ...o }),
           getImport: (id, o = {}) => getStartFromImport(id, { home, ...o }),
+          listJobs: (o = {}) => listReuseJobs({ home, ...o }),
         },
       });
       settingsRoutes = createSettingsRoutes({
         port: boundPort, token, home, env: opts.env, fetchImpl: opts.fetchImpl,
+        openFolderSpawn: opts.openFolderSpawn, platform: opts.platform,
       });
       runRoutes = createRunRoutes({
         port: boundPort,

package/src/panel/settingsroutes.js

@@ -14,7 +14,8 @@
 import { checkHumanGuard } from './authorroutes.js';
 import { readConfig, updateConfig, ConfigError } from '../config.js';
 import { spendSummary, monthlyLimitOf } from '../monthly.js';
-import { loadKeysEnv, keysFilePath, filledKeyNames, ensureKeysFile } from '../keysfile.js';
+import { spawn as realSpawn } from 'node:child_process';
+import { loadKeysEnv, keysFilePath, keysHome, filledKeyNames, ensureKeysFile } from '../keysfile.js';
 import { SHAPES, PRESET_KEY_NAMES, keyRows, endpointOf, defaultUrlOf, usableKey } from '../providerrows.js';
 import { apiKeyProblem, checkProviderReachable } from '../providers.js';
 
@@ -22,8 +23,11 @@ import { apiKeyProblem, checkProviderReachable } from '../providers.js';
 const DEEPSEEK_BALANCE_URL = 'https://api.deepseek.com/user/balance';
 
 /**
+ * `openFolderSpawn` / `platform` are test seams for the Open keys folder button (a real caller passes
+ * neither: `child_process.spawn` and `process.platform`).
  * @param {{ port: number, token: string, home?: string, env?: Record<string,string|undefined>,
- *   fetchImpl?: typeof fetch, now?: () => number }} opts
+ *   fetchImpl?: typeof fetch, now?: () => number, openFolderSpawn?: (cmd: string, args: string[], o: object) => any,
+ *   platform?: string }} opts
  */
 export function createSettingsRoutes(opts) {
   const fetchImpl = opts.fetchImpl ?? fetch;
@@ -134,6 +138,8 @@ export function createSettingsRoutes(opts) {
             placeholder: defaultUrlOf(r.provider),
             keyStatus: !raw ? 'not set' : (raw === 'null' ? 'no key needed' : (problem ? `bad shape (${problem})` : 'found')),
             canTest: r.provider !== 'gemini-api',
+            priceInPerM: typeof r.priceInPerM === 'number' ? r.priceInPerM : null,
+            priceOutPerM: typeof r.priceOutPerM === 'number' ? r.priceOutPerM : null,
             tokens: s.tokensByRow[r.envName] ?? 0,
             balance: r.provider === 'anthropic-api'
               ? { kind: 'note', usd: typeof note === 'number' && Number.isFinite(note) ? note : null }
@@ -148,11 +154,32 @@ export function createSettingsRoutes(opts) {
       const row = currentRows(readConfig({ home: opts.home }).config).find((r) => r.envName === body?.envName);
       if (!row) { send(400, { ok: false, error: 'unknown key — add NAME=key to your keys file and reload keys' }); return true; }
       // only the three settings a row has; each is optional in the body, the whole triple is stored
+      /** @type {Record<string, string|number|null>} */
       const patch = {
         name: typeof body?.name === 'string' ? body.name.trim() : row.name,
         shape: typeof body?.shape === 'string' ? body.shape : row.provider,
         baseUrl: typeof body?.baseUrl === 'string' ? body.baseUrl.trim().replace(/\/+$/, '') : row.baseUrl,
       };
+      // the two prices (USD per 1M tokens): absent = unchanged; blank / null = not set (the field is removed,
+      // never written as 0); otherwise a finite number >= 0 — anything else is refused and nothing is saved
+      for (const f of /** @type {const} */ (['priceInPerM', 'priceOutPerM'])) {
+        if (!Object.hasOwn(body ?? {}, f)) continue;
+        const v = body[f];
+        const label = f === 'priceInPerM' ? 'In' : 'Out';
+        if (v === null || (typeof v === 'string' && v.trim() === '')) { patch[f] = null; continue; }
+        const n = typeof v === 'number' ? v : (typeof v === 'string' && /^\d+(\.\d+)?$/.test(v.trim()) ? Number(v.trim()) : NaN);
+        if (!(Number.isFinite(n) && n >= 0)) {
+          send(400, { ok: false, error: `the ${label} price must be a number, 0 or more (USD per 1M tokens), or blank for not set` });
+          return true;
+        }
+        patch[f] = n;
+      }
+      // a price is both fields or neither — ratesFor refuses a half-set one at run time, so never save half
+      const after = (/** @type {'priceInPerM'|'priceOutPerM'} */ f) => (Object.hasOwn(patch, f) ? patch[f] !== null : row[f] !== undefined);
+      if (after('priceInPerM') !== after('priceOutPerM')) {
+        send(400, { ok: false, error: 'set both prices (In and Out, USD per 1M tokens) or neither — a half-set price is refused' });
+        return true;
+      }
       try {
         updateConfig({ keys: { [row.envName]: patch } }, { home: opts.home });
       } catch (e) {
@@ -164,6 +191,29 @@ export function createSettingsRoutes(opts) {
       return true;
     }
 
+    if (pathname === '/api/settings/open-keys-folder' && req.method === 'POST') {
+      // opens the FOLDER (never the file, never an editor) in the file manager; argv array, no shell, detached.
+      // Another OS, or a failed spawn: say so and hand back the path, which the page then shows as text.
+      const dir = keysHome(opts.home);
+      const platform = opts.platform ?? process.platform;
+      const cmd = platform === 'linux' ? 'xdg-open' : (platform === 'darwin' ? 'open' : null);
+      const cannot = () => send(200, { ok: true, opened: false, path: dir });
+      if (!cmd) { cannot(); return true; }
+      let child;
+      try {
+        child = (opts.openFolderSpawn ?? realSpawn)(cmd, [dir], { detached: true, stdio: 'ignore' });
+      } catch { cannot(); return true; }
+      let settled = false;
+      child.once('error', () => { if (!settled) { settled = true; cannot(); } });
+      child.once('spawn', () => {
+        if (settled) return;
+        settled = true;
+        if (typeof child.unref === 'function') child.unref();
+        send(200, { ok: true, opened: true, path: dir });
+      });
+      return true;
+    }
+
     if (pathname === '/api/settings/providers/balance-note' && req.method === 'POST') {
       // the Anthropic balance is a NOTE the person types; no check ever reads it
       const raw = body?.usd;

package/src/panel/status.js

@@ -49,3 +49,25 @@ export function statusFor(o) {
   else if (out === 'escalated' && ((o.category === 'cap-halt' && o.moneyHalt) || o.category === 'wall-halt')) key = 'capped';
   return { key, ...STATUS[key] };
 }
+
+/**
+ * The word one PART of a run wears on the step map, the step cards and the Audit rows (hamr 2026-10-07: `[✓] passed` /
+ * `[✗] failed`, never "done"). Reads the same table; `running` is the page's call (it knows which part is live), so a
+ * part with no verdict and no cut-off is `passed` here.
+ *   drafting, green/satisfied/already-green outcome, or a part that simply happened (scout/plan/replan/judge) -> passed
+ *   a red outcome -> its run-outcome word (failed; a cap/stop outcome keeps capped/stopped)
+ *   a part its leg's halt cut off (`stopReason`): 'money cap' / 'time cap' -> capped, 'you stopped it' -> stopped,
+ *     'died' -> died, anything else (provider failed, step stalled, a raw outcome) -> failed
+ * @param {{kind?: string, outcome?: string|null, stopReason?: string|null}} part
+ * @returns {{key: StatusKey, sign: string, word: string}}
+ */
+export function partStatusFor(part) {
+  if (part.kind === 'drafting') return statusFor({ outcome: 'green' });
+  if (typeof part.outcome === 'string') return statusFor({ outcome: part.outcome });
+  const why = part.stopReason;
+  if (why) {
+    const key = why === 'money cap' || why === 'time cap' ? 'capped' : why === 'you stopped it' ? 'stopped' : why === 'died' ? 'died' : 'failed';
+    return { key, ...STATUS[key] };
+  }
+  return statusFor({ outcome: 'green' });
+}

package/src/planrun.js

@@ -970,10 +970,10 @@ ${scoutBlob || '(no scout notes)'}`;
  *   the resume-plan-red option, the fix-loop terminal) say "resume is `run-u`-only
  *   in v1" instead of naming a flag that would fail if typed.
  * @param {string|null} [opts.stopFile=null] P5 item 5 — the run's STOP REQUEST file
- *   (`stopFilePath(spine)`, src/legs.js). Read at ONE seam, the round boundary of a step worker
- *   (the `metered` callback, where the money cap binds): present = emit `stop-requested`, consume
+ *   (`stopFilePath(spine)`, src/legs.js). Read at ONE seam, the round boundary of EVERY worker
+ *   (scout, plan/replan drafter, step, close-fix: the `metered` callback, where the money cap binds): present = emit `stop-requested`, consume
  *   the file, end the Loop after that round, and end the leg `stopped` (a checkpoint outcome, filed
- *   the way a mid-step cap-halt is; resume re-enters that step). Nothing is in flight at that
+ *   the way a mid-step cap-halt is; resume re-enters that step, or continues the phase). Nothing is in flight at that
  *   point, so the spend is exact. `null` = no stop surface (the default).
  * @returns {Promise<string>} 'green' | 'already-green' | 'escalated' | 'plan-red' |
  *   'check-red' | 'close-red' | 'close-unsupported' | 'recipe-stale' | 'pricing-red' |
@@ -2745,11 +2745,12 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
           // (nothing in flight, the round just metered). It is the ONE owner of the stop request. The file is
           // consumed here; `self.stop()` ends the Loop after this round exactly as a bound does; `ask`/`askFrom`
           // then throw category `stopped`, which the step loop files as the checkpoint outcome `stopped` the way a
-          // mid-step cap-halt is filed. Step workers only (scout/plan/fix never read it).
-          if (stopFile !== null && !stopHit && phase.startsWith('step:') && existsSync(stopFile)) {
+          // mid-step cap-halt is filed. EVERY phase that runs rounds reads it here (scout, plan/replan drafter, step,
+          // close-fix) — the one seam the money cap binds at; `relay` files the non-ralph phases' throw as `stopped`.
+          if (stopFile !== null && !stopHit && existsSync(stopFile)) {
             try { unlinkSync(stopFile); } catch { /* already consumed */ }
             stopHit = true;
-            emit('stop-requested', { phase, step: phase.slice('step:'.length), iteration: roundIteration, round: roundsThisAttempt, meaning: 'the person asked to stop; the leg ends after this round and a resume re-enters this step' });
+            emit('stop-requested', { phase, ...(phase.startsWith('step:') ? { step: phase.slice('step:'.length) } : {}), iteration: roundIteration, round: roundsThisAttempt, meaning: 'the person asked to stop; the leg ends after this round and a resume continues the run' });
             self.stop();
           } else if (clock.expired()) {
             attemptBounded = { iteration: roundIteration, cause: 'wall', reason: null };
@@ -2903,6 +2904,8 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       // instead and every such fault came back `provider-red` — a broken runner
       // reported as the provider's fault, and an upstream ask aimed at a library
       // for our own missing wiring (the step-stalled lesson).
+      // P5 item 5 — the PERSON's stop, honoured at a round boundary outside a step (scout, plan drafting, replan): nothing failed
+      'stopped': [`You stopped the run during ${phase}. Nothing is discarded: the work on disk stands, and a resume continues the run.`, ['resume (the same run continues)', 'abandon the task']],
       'interpreter-red': [`The ${phase} phase could not be set up — the runner or a primitive it was handed is not correctly bound.`, ['fix the wiring the detail names', 'retry the run', 'abandon the run']],
     };
     const [decision, options] = (Object.hasOwn(DECIDE, category) ? DECIDE[category] : undefined)
@@ -2914,7 +2917,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     // `step-stalled` rides out as ITSELF, not as provider-red. Naming the
     // escalation while returning a casualty label would launder a governance stop
     // into transport noise at exactly the layer the readout reads.
-    return category === 'cap-halt' || category === 'wall-halt' || category === 'step-stalled' || category === 'interpreter-red'
+    return category === 'cap-halt' || category === 'wall-halt' || category === 'step-stalled' || category === 'interpreter-red' || category === 'stopped'
       ? category : 'provider-red';
   };
 

package/src/ralph.js

@@ -49,7 +49,7 @@ const CLOSE_KILL_GRACE_MS = 2000;
  * @param {{env: NodeJS.ProcessEnv, cwd?: string, timeoutMs?: number}} o
  * @returns {Promise<{error: (Error & {code?: string})|null, status: number|null, signal: string|null, stdout: string, stderr: string}>}
  */
-function spawnClose(cmd, args, { env, cwd, timeoutMs }) {
+export function spawnClose(cmd, args, { env, cwd, timeoutMs }) {
   return new Promise((resolve) => {
     const child = spawn(cmd, args, { env, cwd });
     /** @type {Buffer[]} */ const outChunks = [];

package/src/source.js

@@ -27,6 +27,7 @@ import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { mkdir, readdir, readFile, writeFile, lstat, stat, chmod, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
 import { dirname, join, relative, resolve, sep, basename } from 'node:path';
 import { git } from './kinds.js';
+import { addWorktree, hideBareloopDir } from './worktree.js';
 import { MAX_BUFFER } from './kinds.js';
 import { PROVIDER_TIMEOUT_MS } from './clock.js';
 import { scanSecrets, SECRET_PATTERNS, SECRET_PATTERN_NAMES } from './validate.js';
@@ -440,16 +441,21 @@ async function fetchOnce(url, timeoutMs) {
  * as declared, unvalidated by `proveDestination`, and `frontDoorFromManifest`
  * never hands a repo source's destination to `copyOut` — wiring it into
  * `writeScope` is M3/M4's job, not this one.
- * @param {{source: string, into: string, destination?: string,
+ * `worktree` (P6 item 1, repo sources ONLY — ignored for every other kind): instead of COPYING the repo, make the
+ * run's tree a detached git worktree of the person's own repo at that directory (the shared
+ * `src/worktree.js`, the bundle door's own spelling), hide `.bareloop/` from their `git status`, and record the
+ * worktree and the repo root in the manifest. `into` then holds only `source.json`; the tree is `worktree`, at the
+ * repo's current commit (uncommitted edits are NOT in it). No seed commit is made — the seed IS the repo's HEAD.
+ * @param {{source: string, into: string, destination?: string, worktree?: string,
  *   fetchTimeoutMs?: number, afterScan?: () => (void|Promise<void>)}} args
  *   `fetchTimeoutMs` is test-only — production callers omit it and get
  *   `PROVIDER_TIMEOUT_MS`. `afterScan` is a test seam too: called exactly once,
  *   after the secret scan finished and before the freeze loop re-reads any
  *   file's bytes, so a test can swap a file inside that window
  *   deterministically. Production never sets it; absent, behaviour is unchanged.
- * @returns {Promise<{stop: null, into: string, tree: string, manifestPath: string, manifest: object}|SourceRefusal>}
+ * @returns {Promise<{stop: null, into: string, tree: string, manifestPath: string, manifest: Record<string, any>}|SourceRefusal>}
  */
-export async function prepareSource({ source, into, destination, fetchTimeoutMs = PROVIDER_TIMEOUT_MS, afterScan }) {
+export async function prepareSource({ source, into, destination, worktree, fetchTimeoutMs = PROVIDER_TIMEOUT_MS, afterScan }) {
   const intoAbs = resolve(into);
   if (existsSync(intoAbs)) {
     return refuse('into-exists', `${intoAbs} already exists — a source door writes a FRESH tree, never reuses one (the export worktree rule)`);
@@ -634,6 +640,9 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     const buf = f.buf ?? (f.symlinkTarget !== undefined ? Buffer.from(f.symlinkTarget, 'utf8') : await readFile(/** @type {string} */ (f.abs)));
     fileMeta.push({ path: f.rel, bytes: buf.length, sha256: sha256Hex(buf) });
     const isBinary = f.symlinkTarget === undefined && hasNulByte(buf.subarray(0, 8192));
+    // P6 item 2 (hamr 2026-10-05 Q2=A): a repo going onto a WORKTREE is the person's OWN repo, left in place — a secret
+    // already in it is MASKED wherever bareloop records it (`redactSecrets`), not a refusal. Every other kind keeps the scan.
+    if (worktree !== undefined && frozen.kind === 'repo') continue;
     const names = secretPatternNames(buf.toString(isBinary ? 'latin1' : 'utf8'));
     if (names.length) secretHits.push({ rel: f.rel, names });
   }
@@ -642,6 +651,34 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     return refuse('source-carries-secret', `${secretHits.length} file(s) carry a known secret shape — refused before anything was written (hard line #3, secrets never enter the tree): ${detail}`);
   }
 
+  if (worktree !== undefined && frozen.kind === 'repo') {
+    const repoRoot = /** @type {string} */ (frozen.root);
+    const wt = resolve(worktree);
+    try {
+      hideBareloopDir(repoRoot);
+      addWorktree(repoRoot, wt);
+    } catch (e) {
+      return refuse('source-worktree-failed', `could not make the job's worktree in ${repoRoot}: ${/** @type {Error} */ (e).message} (the repo needs at least one commit)`);
+    }
+    const headAt = await git(wt, ['rev-parse', 'HEAD']);
+    if (!headAt.ok) return refuse('source-git-failed', `git rev-parse HEAD failed in ${wt}: ${headAt.err}`);
+    const wtManifest = {
+      kind: 'repo',
+      source,
+      ...(frozen.sourceSubdir === undefined ? {} : { sourceSubdir: frozen.sourceSubdir }),
+      fetchedAt: new Date().toISOString(),
+      files: fileMeta,
+      seed: headAt.out.trim(),
+      destination: destination ?? null,
+      worktree: wt,
+      repo: repoRoot,
+    };
+    await mkdir(intoAbs, { recursive: true });
+    const wtManifestPath = join(intoAbs, 'source.json');
+    await writeFile(wtManifestPath, `${JSON.stringify(wtManifest, null, 2)}\n`);
+    return { stop: null, into: intoAbs, tree: wt, manifestPath: wtManifestPath, manifest: wtManifest };
+  }
+
   const treeDir = join(intoAbs, 'tree');
   const outputDir = join(treeDir, 'output');
   await mkdir(treeDir, { recursive: true });
@@ -809,7 +846,7 @@ const LOCKFILE_COMMANDS = Object.freeze([
  *   manifest)
  * @param {string} [sourceSubdir] the manifest's own `sourceSubdir` ('' or
  *   undefined when Source IS the repo root)
- * @returns {{manager: string, command: string, reason: string}|null} `null`
+ * @returns {{dir: string, lockFile: string|null, manager: string, command: string, reason: string}|null} `null`
  *   when there is nothing to report: no JS/TS manifest found walking up from
  *   `sourceSubdir` to `treeDir`, the nearest one found has no dependencies,
  *   `node_modules` is already there, or the manifest cannot even be read as
@@ -846,6 +883,8 @@ export function missingDependencies(treeDir, sourceSubdir = '') {
     const installCmd = lock ? lock.command : 'npm install';
     const rel = relative(root, d).split(sep).join('/');
     return {
+      dir: d,
+      lockFile: lock ? lock.file : null,
       manager: installCmd.split(' ')[0],
       command: rel === '' ? installCmd : `cd ${rel} && ${installCmd}`,
       reason: `${rel === '' ? 'package.json' : `${rel}/package.json`} lists dependencies but the copy has no node_modules`,
@@ -1109,3 +1148,15 @@ export function frontDoorFromManifest(read) {
   if (typeof destination !== 'string' || !destination) return null;
   return { destination };
 }
+
+/**
+ * The $0 refusal for a non-repo source, worded by the kind the source door recorded (`prep.manifest.kind`) — a single
+ * file is not a "folder", and Source must be the repo folder with the file named in Destination (hamr 2026-10-05).
+ * @param {string} kind `prep.manifest.kind`: 'file' | 'folder' | 'url' (a 'repo' never reaches this)
+ * @returns {string}
+ */
+export function nonRepoSourceMessage(kind) {
+  if (kind === 'file') return 'Source is a single file. Source must be the repo folder — put the file in Destination, like src/digest.js. Nothing spent.';
+  if (kind === 'folder') return "Source is a plain folder, not a code project (no git repo found). bareloop can't check this kind of job yet. Nothing spent.";
+  return "Source is not a code project (no git repo found). bareloop can't check this kind of job yet. Nothing spent.";
+}