bareloop 0.38.0 → 0.40.0

package/types/panel/authorsession.d.ts

@@ -1,3 +1,11 @@
+/**
+ * The first drafting row's words (hamr 2026-10-11) — code-owned, one owner, ALWAYS starting "thinking on" or "thinking off".
+ * `sent` is what the drafting calls carry (`draftThinkingFor`); `thoughtAnyway` = a call reported `thinkingApplied === false`
+ * after 'off' was sent (bare-agent saw reasoning in the reply).
+ * @param {'on'|'off'|'not-switchable'|'unverified'} sent @param {boolean} [thoughtAnyway]
+ * @returns {string}
+ */
+export function thinkingRowText(sent: "on" | "off" | "not-switchable" | "unverified", thoughtAnyway?: boolean): string;
 /** @typedef {{id: string, label: string, status: 'running'|'done'|'failed', detail: string}} StepLine */
 /** @param {StepLine[]} steps @param {string} id the LATEST line carrying this id (the list is a time-ordered log; an id can repeat) */
 export function latestStep(steps: StepLine[], id: string): StepLine | undefined;
@@ -9,6 +17,37 @@ export function latestStep(steps: StepLine[], id: string): StepLine | undefined;
  * @param {StepLine[]} steps @param {string} id @param {string} [detail] (absent = keep what the line has)
  */
 export function advanceSteps(steps: StepLine[], id: string, detail?: string): void;
+/**
+ * The confirm turn's plan as a chat message (P7): a STRUCTURED `{role:'bot', kind:'plan', plan}` the page draws with the
+ * same renderer the Job tab uses — each numbered job line, its `~` rule, its drafted checks folded; the AI's own "not
+ * checked"; the always-on guards. `questions` (what the plan still asks) ride inside the plan. One owner of the shape.
+ * @param {{goal?: string, checks?: string[], checkItems?: {text: string, fromLine: number[]|null}[], notChecked?: string[], questions?: string[], protections?: string[]}} p the confirm turn's plan
+ * @param {{n: number, text: string, rule: string}[]|null} jobLines
+ * @returns {{role: 'bot', kind: 'plan', text: string, plan: ReturnType<typeof planFromConfirm> & {goal: string, questions: string[]}}}
+ */
+export function planMessage(p: {
+    goal?: string;
+    checks?: string[];
+    checkItems?: {
+        text: string;
+        fromLine: number[] | null;
+    }[];
+    notChecked?: string[];
+    questions?: string[];
+    protections?: string[];
+}, jobLines: {
+    n: number;
+    text: string;
+    rule: string;
+}[] | null): {
+    role: "bot";
+    kind: "plan";
+    text: string;
+    plan: ReturnType<typeof planFromConfirm> & {
+        goal: string;
+        questions: string[];
+    };
+};
 /**
  * `true` when `jobs/<name>.json` already exists in the repo's own jobs/ dir
  * (resolved from THIS module's own on-disk location, never `process.cwd()`,
@@ -22,6 +61,13 @@ export function advanceSteps(steps: StepLine[], id: string, detail?: string): vo
 export function jobNameTaken(name: string, opts?: {
     jobsDir?: string;
 }): boolean;
+/**
+ * The repo a card names: Inputs line 1 (P7 — the Source box is gone; the first input IS the repo). `''` when the Inputs
+ * box does not parse (the card validator refuses that before anything uses this).
+ * @param {any} card
+ * @returns {string}
+ */
+export function cardSource(card: any): string;
 /**
  * Only the form's own fields, nothing else a request body might carry (`startFrom`, stray keys).
  * @param {any} card
@@ -38,12 +84,12 @@ export function cardFields(card: any): Record<string, any>;
 export function lockedFieldChanged(card: Record<string, any>, origin: Record<string, any>): string | null;
 /**
  * The spec a reuse signs: a COPY of the origin's signed spec with ONLY the open fields set from the card —
- * `writeScope` from Destination, `budgetUsd` from the $ cap, `maxWallMs` from the Time cap (absent when blank), and the
+ * `writeScope` from Destination, `inputs` from the Inputs box (P7), `budgetUsd` from the $ cap, `maxWallMs` from the Time cap (absent when blank), and the
  * worker (`provider`/`baseUrl`/`model`) from the Model Name chosen in Settings > Providers, spelled exactly as normal
  * authoring spells it (`baseUrl` only when the row has one; `model` only when the Name is not the provider's default
  * tier). A RUBRIC (soft-green) origin with no explicit `judge` first has its judge pinned to the ORIGIN's resolved judge
  * identity — the judge must not change because the worker did (`resolveJobJudge`, the one spelling); an explicit
- * `judge` is kept; a deterministic job has no judge to move. Source is not in a spec (it lives beside the run). The copy
+ * `judge` is kept; a deterministic job has no judge to move. The repo (Inputs line 1) is in a spec only as `inputs`. The copy
  * hashes to a NEW `jobSpecHash` and the SAME `workflowKey` — the caller checks the second after building.
  * @param {any} originSpec
  * @param {Record<string, any>} card
@@ -53,7 +99,7 @@ export function lockedFieldChanged(card: Record<string, any>, origin: Record<str
 export function buildReuseSpec(originSpec: any, card: Record<string, any>, rows?: readonly import("../providerrows.js").KeyRow[]): any;
 /**
  * `$0` validation for a REUSE start: the signed job carries the goal, checks and guardrails, so those boxes are not
- * required here — only what the new session itself needs: a Source, a Destination, a Model that is a Settings Name,
+ * required here — only what the new session itself needs: Inputs, a Destination, a Model that is a Settings Name,
  * and the cap. (The spec built from the open boxes is validated by the route with `validateJob`.)
  * @param {any} card
  * @param {{rows?: readonly import('../providerrows.js').KeyRow[]}} [opts]
@@ -72,7 +118,7 @@ export function validateReuseCard(card: any, opts?: {
  * relative to the repo, so an absolute path is refused — at $0, before any copy or model call. A FOLDER source (or a
  * source that does not peek as a repo) keeps today's behaviour: its Destination is an absolute output directory.
  * @param {string} destination
- * @param {boolean} isRepoLike `looksLikeRepoSource(card.source)`
+ * @param {boolean} isRepoLike `looksLikeRepoSource(cardSource(card))`
  * @returns {string|null} the plain refusal, or null when the Destination is fine
  */
 export function repoDestinationProblem(destination: string, isRepoLike: boolean): string | null;
@@ -96,12 +142,12 @@ export function validateJobCard(card: any, opts?: {
 /**
  * ONE session's engine — created already RUNNING (the caller awaits nothing;
  * the pipeline drives itself, reporting through `state`). `state.pendingAsk`
- * is the ONE thing a person answers next; `answer()`/`send()`/`revise()`/
+ * is the ONE thing a person answers next; `answer()`/`send()`/
  * `signPrepare()` are the only ways in.
  * @param {any} card the validated job card (see {@link validateJobCard})
  * @param {{env?: Record<string,string|undefined>, sessionsRoot?: string, home?: string, timeoutMs?: number,
  *   scout?: any, generate?: Function, confirmGenerate?: Function, authorFn?: Function,
- *   prepareSigningFn?: Function, npmCiFn?: Function, reuse?: {spec: any, workflowKey: string}}} [deps] `scout`..`prepareSigningFn` are
+ *   prepareSigningFn?: Function, npmCiFn?: Function, draftThinking?: "on"|"off", reuse?: {spec: any, workflowKey: string}}} [deps] `scout`..`prepareSigningFn` are
  *   TEST SEAMS ONLY — see the note just above where each is read, below. `reuse` (Reuse workflow) is NOT a seam: the
  *   caller (`/api/author/start`) sets it only when the server's own same-job rule held.
  * @returns {any} the session object
@@ -117,6 +163,7 @@ export function createSession(card: any, deps?: {
     authorFn?: Function;
     prepareSigningFn?: Function;
     npmCiFn?: Function;
+    draftThinking?: "on" | "off";
     reuse?: {
         spec: any;
         workflowKey: string;
@@ -135,11 +182,13 @@ export const STEP_LABELS: Readonly<Record<string, string>>;
  * @type {Readonly<Record<string, keyof typeof STEP_LABELS>>}
  */
 export const PHASE_STEP: Readonly<Record<string, keyof typeof STEP_LABELS>>;
+/** the line under the plan bubble, in plain words (the bubble itself is drawn by the page's one `renderJobPlan`) */
+export const PLAN_FOOTER: "Sign & run to confirm this plan, or Revise to edit the boxes and draft again.";
 /** the form's fields, in card order — what `card.json` stores, verbatim (P5 item 3) */
 export const CARD_FIELDS: readonly string[];
 /**
  * REUSE WORKFLOW (hamr 2026-10-03, replaces P5 item 3's same-job rule; Model opened 2026-10-04): a reuse card has exactly
- * FIVE open boxes — Source, Destination, Model, $ cap, Time cap — and every other box is the signed workflow, shown greyed and never
+ * FIVE open boxes — Inputs, Destination, Model, $ cap, Time cap — and every other box is the signed workflow, shown greyed and never
  * editable. The page greys them; THIS is what refuses (the server never trusts the page). Changing any locked box
  * is a different job: Clear the card, which drafts.
  */
@@ -153,4 +202,5 @@ export type StepLine = {
     status: "running" | "done" | "failed";
     detail: string;
 };
+import { planFromConfirm } from './jobplan.js';
 import { nonRepoSourceMessage } from '../source.js';

package/types/panel/jobplan.d.ts

@@ -0,0 +1,58 @@
+/** @typedef {{name: string, cls: 'machine check'|'judge'|null}} PlanCheck */
+/** @typedef {{n: number, text: string, rule: string, checks: PlanCheck[], refused: string[]}} PlanLine */
+/** @typedef {{lines: PlanLine[], loose: PlanCheck[], notChecked: string[], alwaysOn: string[], older: boolean, goal?: string}} JobPlan */
+/**
+ * `machine check` for a kind a command decides, `judge` for one that needs judgement; `null` for a stage whose kind is
+ * unknown (a hand-written command close has no kind: it is a command, so a machine check).
+ * @param {unknown} kind
+ * @returns {'machine check'|'judge'|null}
+ */
+export function checkClassOfKind(kind: unknown): "machine check" | "judge" | null;
+/**
+ * The plan of a SIGNED spec. With `jobLines`, each stage lands under EACH line its `fromLine` array names (a stage with none is
+ * a mandatory guard: "Always on"), `closeDecl.refused` reasons land under their line, and `closeDecl.notes` are the
+ * drafter's own "not checked" words. Without `jobLines` (a spec that predates the job block) the signed goal sentence is
+ * line 1 and every stage name is a check under it — `older: true`.
+ * @param {any} spec
+ * @returns {JobPlan}
+ */
+export function planFromSpec(spec: any): JobPlan;
+/**
+ * The plan of the confirm turn, before anything is drafted: the person's own job lines, the model's checks under the
+ * line each names, its own "not checked" words, and the real protections (code-owned) as "Always on".
+ * @param {{n: number, text: string, rule: string}[]|null|undefined} jobLines
+ * @param {{checkItems?: {text: string, fromLine: number[]|null}[], checks?: string[], notChecked?: string[], protections?: string[]}} plan
+ * @returns {JobPlan}
+ */
+export function planFromConfirm(jobLines: {
+    n: number;
+    text: string;
+    rule: string;
+}[] | null | undefined, plan: {
+    checkItems?: {
+        text: string;
+        fromLine: number[] | null;
+    }[];
+    checks?: string[];
+    notChecked?: string[];
+    protections?: string[];
+}): JobPlan;
+export type PlanCheck = {
+    name: string;
+    cls: "machine check" | "judge" | null;
+};
+export type PlanLine = {
+    n: number;
+    text: string;
+    rule: string;
+    checks: PlanCheck[];
+    refused: string[];
+};
+export type JobPlan = {
+    lines: PlanLine[];
+    loose: PlanCheck[];
+    notChecked: string[];
+    alwaysOn: string[];
+    older: boolean;
+    goal?: string;
+};

package/types/panel/server.d.ts

@@ -298,6 +298,26 @@ export function getRunRounds(runid: string, query?: {
 }, opts?: {
     home?: string;
 }): any | null;
+/**
+ * The Signed row of the Job tab: `YYYY-MM-DD HH:MM · <first 6 of specHash>`, the time being the run's FIRST `job-start`
+ * in local time (hamr, P7). `null` when either part is not on record — never a made-up stamp.
+ * @param {string|null|undefined} ts an ISO stamp @param {string|null|undefined} hash
+ * @returns {string|null}
+ */
+export function signedLine(ts: string | null | undefined, hash: string | null | undefined): string | null;
+/**
+ * The Job box's text for a signed spec: the person's own numbered lines (a `~` line per entry of `rules`, or — for a spec
+ * signed before `rules` existed — per '; '-split piece of `rule`), or — for
+ * an older job that saved no job lines — the signed goal sentence as the one line.
+ * @param {any} spec @returns {string}
+ */
+export function jobTextFromSpec(spec: any): string;
+/**
+ * The Inputs box's text for a signed spec: its numbered inputs, or — for an older job — `repo: <source>` from the
+ * caller's best knowledge of the source (or empty).
+ * @param {any} spec @param {string} source @returns {string}
+ */
+export function inputsTextFromSpec(spec: any, source: string): string;
 /**
  * `GET /api/runs/:runid/job` — the Job tab, filled from the first source
  * that actually resolves (item 2, 2026-09-25), in order:

package/types/planrun.d.ts

@@ -221,7 +221,7 @@ export function planPrompt(job: any, scoutBlob: string, reds: any[] | null, maxS
  *   item 27/M3 Part B), forwarded to every close invocation as
  *   `BARELOOP_CLOSE_DIR`
  * @param {number} [opts.maxStepRounds] the shell's per-step rounds ceiling (validatePlan's bound)
- * @param {boolean} [opts.scout=true] operator-only switch (docs/product/SCOUT-CONTRAST.md):
+ * @param {boolean} [opts.scout=true] operator-only switch (docs/logs/SCOUT-CONTRAST.md):
  *        `false` on a FRESH run (no `resumeSeed`) skips the survey entirely — `scoutBlob`
  *        stays `''`, no `scout-start`/`scout-result`/`scout-empty` is emitted, and a single
  *        `scout-skipped {reason:'operator-off'}` records it (a RECORD, never silence — the

package/types/providers.d.ts

@@ -1,3 +1,47 @@
+/**
+ * The per-call options the rubric JUDGE's model calls carry for this provider instance: `{ thinkingMode: 'off' }` when
+ * bare-agent measures the model switchable, else `{}` (F192: judge runs thinking off; a judge on a model that cannot turn it
+ * off must not throw).
+ * @param {any} provider a constructed bare-agent provider
+ * @returns {Record<string, any>}
+ */
+export function judgeCallOptions(provider: any): Record<string, any>;
+/**
+ * Throw unless `mode` is one of {@link DRAFT_THINKING_MODES} — an operator-param guard, so a typo never silently means a mode.
+ * @param {unknown} mode
+ * @returns {'on'|'off'}
+ */
+export function assertDraftThinking(mode: unknown): "on" | "off";
+/**
+ * What the drafting calls on this provider ACTUALLY carry for thinking, for the draft log and the panel row: `'on'` (mode on,
+ * nothing sent), `'off'` (mode off and the switch is sent), `'not-switchable'` (mode off, model measured not switchable —
+ * nothing sent), `'unverified'` (mode off, model not measured by bare-agent — nothing sent). Never re-derives a model list.
+ * @param {any} provider a constructed bare-agent provider
+ * @param {unknown} [mode] 'on' | 'off' (default 'off')
+ * @returns {'on'|'off'|'not-switchable'|'unverified'}
+ */
+export function draftThinkingSent(provider: any, mode?: unknown): "on" | "off" | "not-switchable" | "unverified";
+/**
+ * {@link draftThinkingSent} for a model the caller has only NAMED (provider shape, model id, baseUrl) — no key, no network. For
+ * the panel's first drafting row, which is shown before the key is read. Constructing the provider only makes the class and
+ * the model id available to `thinkingSupport`; it sends nothing.
+ * @param {{providerName: string, model: string, baseUrl?: string|null}} o
+ * @param {unknown} [mode] 'on' | 'off' (default 'off')
+ * @returns {'on'|'off'|'not-switchable'|'unverified'}
+ */
+export function draftThinkingFor({ providerName, model, baseUrl }: {
+    providerName: string;
+    model: string;
+    baseUrl?: string | null;
+}, mode?: unknown): "on" | "off" | "not-switchable" | "unverified";
+/**
+ * The ONE owner of the per-call options every DRAFTING model call carries (scout, confirm, author, revise, structure retries).
+ * `{ thinkingMode: 'off' }` exactly when {@link draftThinkingSent} says `'off'`, else `{}`.
+ * @param {any} provider a constructed bare-agent provider
+ * @param {unknown} [mode] 'on' | 'off' (default 'off')
+ * @returns {Record<string, any>}
+ */
+export function draftCallOptions(provider: any, mode?: unknown): Record<string, any>;
 /**
  * Look up a provider's table entry. Throws a NAMED error on an unrecognized
  * provider — never a silent default (the `resolveRates`-style-substring-
@@ -11,7 +55,7 @@ export function resolveProvider(providerName: string): ProviderTableEntry;
 /**
  * Report whether a resolved API key VALUE (not its presence — every call
  * site already presence-checks separately) carries a shape an HTTP header
- * value cannot: F181 (`docs/logs/FINDINGS.md`) — a two-line secret-store
+ * value cannot: F181 (`docs/wiki/FINDINGS.md`) — a two-line secret-store
  * entry put the key plus a trailing metadata line into `OPENAI_API_KEY`
  * (`"<key>\nmeta"`), the presence-only check at every door passed, and Node
  * crashed `TypeError [ERR_INVALID_CHAR]` inside its own header-encode at the
@@ -210,6 +254,13 @@ export const PROBE_STATUS: Readonly<Record<string, {
     probed: boolean;
     evidence: string;
 }>>;
+/**
+ * The drafter's THINKING knob — an enumerated OPERATOR param, never model output and never read from env inside the library.
+ * `'on'` sends nothing (the model's own thinking, byte-identical to a no-knob call); `'off'` sends `thinkingMode: 'off'` where
+ * bare-agent measures the model switchable. The DEFAULT is `'off'` (hamr 2026-10-11, decided by the frozen ON/OFF contrast,
+ * docs/logs/2026-10-10-drafter-thinking-contrast-prereg.md); `'on'` stays selectable for a later Settings checkbox.
+ */
+export const DRAFT_THINKING_MODES: readonly string[];
 export type ProviderTableEntry = {
     /**
      * the bare-agent provider class

package/types/run.d.ts

@@ -158,7 +158,7 @@
  *        frozen A0 baseline arm has to be exactly today, so a guard firing under a disabled
  *        shim would make the baseline a treatment arm. The default-flip belongs to a
  *        paid contrast nobody has approved yet (the `layerRoot` precedent, F41).
- * @param {boolean} [opts.scout=true] operator-only switch (docs/product/SCOUT-CONTRAST.md),
+ * @param {boolean} [opts.scout=true] operator-only switch (docs/logs/SCOUT-CONTRAST.md),
  *   forwarded verbatim to the plan flow: `false` on a fresh run (no `resumeSeed`) skips the
  *   read-only survey and records `scout-skipped {reason:'operator-off'}` instead — the
  *   planner drafts from `(no scout notes)`. Runner territory exactly like `readShim`: the

package/types/source.d.ts

@@ -304,6 +304,32 @@ export function frontDoorFromManifest(read: {
  * @returns {string}
  */
 export function nonRepoSourceMessage(kind: string): string;
+/**
+ * P7 (docs/product/PANEL-BUILD.md, "Inputs"): prove the NUMBERED INPUTS at $0, before any token. Line 1 is the repo
+ * (an absolute path to an existing folder); lines 2+ are files or folders INSIDE that repo, repo-relative. A line
+ * that is not one of those is a named red naming its line number — never a throw, never a silent skip:
+ *   - a `search:` line or a URL, and a path that leaves the repo: "only files inside the repo for now" (search and
+ *     outside-the-repo inputs arrive with the plain-folder piece);
+ *   - a path that does not exist, or that git does not track (a repo job would not see it);
+ *   - the front door's own refusals for a file: an environment file by NAME, a symlink, a non-text file, an oversize
+ *     file. A known secret shape in its content is NOT a refusal (masked where recorded, as the P6 worktree door does).
+ * A folder value is checked for existence and tracking only (its files are the repo's own, which the worktree door
+ * already masks). Reads the tree; writes nothing.
+ * @param {{n: number, label: string, value: string}[]} inputs the parsed Inputs (`parseInputs`)
+ * @returns {Promise<{ok: true, repo: string, root: string|null}|{ok: false, error: string}>} `repo` = line 1's absolute path; `root` = the git root it sits in (null when line 1 alone was given and it is not in a git repo)
+ */
+export function proveInputFiles(inputs: {
+    n: number;
+    label: string;
+    value: string;
+}[]): Promise<{
+    ok: true;
+    repo: string;
+    root: string | null;
+} | {
+    ok: false;
+    error: string;
+}>;
 /**
  * a named, non-throwing stop
  */

package/types/trend.d.ts

@@ -54,6 +54,7 @@ export function createTrend({ stageOrder, limit, blindCap, seed, directions }?:
      * @param {{gap?: string, stage?: string|null, value?: number|null}} o either a
      *   raw gap (parsed here) or an already-read `{stage, value}` — never both
      *   spellings of the same reading in one call.
+     *   (A judged stage's value is its distinct red COUNT, supplied by the caller.)
      * @returns {{iteration: number, stage: string, value: number|null, improved: boolean,
      *   comparable: boolean, noProgress: number, limit: number, stageIndex: number}}
      */