bareloop 0.39.0 → 0.41.0

package/CHANGELOG.md

@@ -5,6 +5,66 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.41.0] - 2026-10-12
+
+### Added
+
+- **Settings > Providers, rewritten from fwdloop's layout (P8).** One shared grid: a key row (API shape, Base URL, the "old max_tokens" tick, Tokens, `[ Test ] [ ⟳ Refresh ]`) with its model lines under it (Use tick, In / Out $/1M, tokens), a folded summary, `label : value` lines below 1280px, and the KEYS strip stacking below 900px. **Test** and **Refresh** are one free `GET <Base URL>/models` (`src/modellist.js`); `gemini-api` is now testable. `Open keys folder` stays in the KEYS strip.
+- **Model lines.** Config gains `models.<ENV>` — a list of `{ model, use, inPerM, outPerM }` — and `keys.<ENV>` becomes `{ shape, baseUrl, legacyMaxTokens }`. A price is a pair or nothing, a ticked line needs both, 0 / 0 is a chosen price. An older `keys.<ENV>.{name,priceInPerM,priceOutPerM}` still reads as one line until the row's first save.
+- **"Thinking on" tick (per job).** A tick under Model in the New job card, unticked by default, saved in the signed job as the optional `thinking` boolean (absent = off; an old spec and any unticked job keep their hash). It covers drafting and the rubric judge, never the worker. `src/thinking.js` is the one owner; bare-agent (^0.52.0) says what each model can switch and reports `thinkingStatus`, which the draft log and the drafting `thinking` row show.
+- **`--model <id>` and `--provider <KEY>`** on `run-u`, `run <bundle>` and the resume route name the Settings line a run works on (for a spec that names no model); `interview` takes `--model` and writes it into the draft.
+- `tests/no-hardcode.test.js`: a search of `src/` and `bin/` finds no provider name, model name, web address or price in code, except an allow-list with a reason per entry.
+
+### Changed
+
+- **Resume of a pre-P8 run whose signed spec names no model** opens the Resume card's Model box (it was locked, so the person could not act on `--model`). The menu offers only lines of the spec's API shape (and endpoint, when the spec names one) and shows `Tick a <shape> model in Settings > Providers.` when none match; Sign & resume stays blocked until a usable line is picked, and the pick is sent as model + provider. The spec and its hash are untouched. Changing the Model line now blocks Start/Sign until its key check returns, and a late answer for a line no longer selected is ignored (the New job card shares this path).
+- **Chat's Model menu** lists only ticked, priced lines as `<KEY> · <model>`; a card carries `provider` (the key's env name) beside `model`, and a stale pick is refused at $0 with one of three plain sentences.
+- **A job's key is its row's own variable name.** There is no built-in key name, tier table, default model, default address or per-model gating: the "old max_tokens" tick on the row decides the output-cap spelling.
+- **Existing DeepSeek rows need one tick.** An existing DeepSeek row (or any OpenAI-compatible server that wants the old `max_tokens` field) must have "old max_tokens" ticked once in Settings > Providers: the built-in per-model rule that did this is gone (no-hardcode ruling), and until the tick is set the output cap may not bind (F149).
+- The Money tab groups spend by the Providers row that served it (a run no row serves lands under its own shape and address) and carries tokens per model.
+- A fresh keys file holds two comment lines and no preset key.
+- Dependencies: `bare-agent` ^0.51.0 to ^0.52.0.
+- The exported bundle README tells the user to put their provider's API key in their keys file (the name their Settings row uses), with no vendor.
+
+### Removed
+
+- **Balance** (the Settings column, both routes and the `anthropicBalanceNote` config field).
+- Built-in tiers and keys: `*_TIER_MODELS`, `envKey`, `OPENAI_MODEL_OPTIONS`/`paramsFor`, `PRESET_KEY_NAMES`, the vendor default addresses, the `--model sonnet|haiku` aliases, the vendor map in the Money tab.
+- **`JUDGE_MODEL`** is no longer exported from the package root or `src/judged.js` (a public-API removal: pass your own model id). `resolveWorkerModel` takes `suppliedModel` instead of `defaultModel` and throws when no model is named.
+- The bench row `bareguard-types-deepseek` is renamed `bareguard-types-gateway` (spec file renamed; contents and hash untouched; the patient directory it names is now `bareloop-patients/bareguard-u-gateway`).
+
+### Breaking
+
+- **The config shape changed.** Every row that relied on a built-in default (shape, address, model, price) must have its API shape, Base URL and model lines entered or ticked ONCE in Settings. A row on a server that ignores `max_completion_tokens` (F149) needs "old max_tokens" ticked by hand, once, before a paid run: an output cap that does not bind is a money hazard.
+- **Specs signed before this release that name no `model` (or no `baseUrl`)** have nothing to run on until a line is named at run start: `--model <id>` (the hash is untouched). A signed model no ticked line carries is refused at $0.
+
+## [0.40.0] - 2026-10-11
+
+### Added
+
+- **The job block (P7).** A job is now written as two numbered boxes, **The job** and **Inputs**, replacing Goal / Source / Success / Guardrails / Judge examples. A `~` line is a rule for the line above it; `~ PASS:` / `~ FAIL:` lines are a rubric's judge examples and keep their line number. Inputs are numbered `label: value`: line 1 is the repo, later lines are files inside it, proven at $0 before any session. One parser (`src/jobblock.js`) serves the panel and the CLI interview, which now asks The job and Inputs as multi-line answers.
+- **Every job line is covered.** The signed spec carries `jobLines` and `inputs`. Each stage the drafter writes names the job line(s) it serves (`fromLine`, an array, so one check may serve several lines), or the line is listed in `closeDecl.refused` with a reason; an uncovered line is a $0 red fed back through the revise loop. Signed `jobLines` carry `rules[]` beside `rule`, so Reuse never cuts an example at its own `; `. Only new jobs' hashes move; Inputs is open on a Reuse.
+- **Try-3 questions.** On the last drafting try, after two failed ones (validation red, seed-read failure or vacuous close, or an output cut-off), the drafter may ask up to 2 questions, each naming a job line. The panel asks each through the ordinary ask path (answer required, no Skip), adds the answer word for word as a `~` rule on that line, and drafts once more with no asking. Off unless the caller wires an asker (the CLI never does).
+- **Thinking switch for drafting and the judge.** `thinkingMode` ('on' | 'off', anything else throws) is asked of bare-agent; `off` is sent only for models bare-agent's `thinkingSupport` says are switchable, and nothing is sent for a not-switchable or unverified model. The draft log records `thinking` (off / on / not-switchable / unverified) and bare-agent's `thinkingApplied` verdict per call.
+- **Panel.**
+  - One shared plan renderer draws the chat bubble and the Job tab: numbered lines, rules, checks under the line they serve, with *Not checked* and *Always on* folds; an "AI's summary" row, and an "AI's open questions" row (each question its own item, then "Revise if you need to.") shown only when there are questions.
+  - The Job tab runs The job, Inputs, Destination, Tools, Cap, Signed, with the job at full height; older jobs show an older-job note and keep their goal as line 1.
+  - The job boxes grow to 8 lines then scroll, with the number gutter scrolling alongside; the left pane widens to 630px from 1200px wide.
+  - The drafting list opens with a code-owned *thinking* row; if the model reports it thought anyway after `off` was sent, it reads "thinking on (the model thought anyway)".
+  - Every drafting stop now says why in plain words (what happened, what it cost, what to do).
+
+### Changed
+
+- **Thinking is OFF by default for drafting and the judge, for every switchable model, worker untouched.** The default was decided by a frozen, pre-registered 8-draft ON/OFF contrast measured on **deepseek-flash only** (rule said OFF; underpowered by declaration); extending it to every other switchable model is hamr's ruling of 2026-10-11, not a measurement. `on` sends nothing and is byte-identical to a call with no knob. The deepseek-flash request body is unchanged (thinking disabled, now produced by bare-agent); the per-model allow-lists in `src/providers.js` are deleted.
+- A secret-shaped input file is masked, not refused (matching the worktree repo door); `.env` by name and symlinks are still refused.
+- Dependencies: `bare-agent` ^0.49.0 to ^0.51.0.
+
+### Fixed
+
+- **Output cut-off is a failed try, not provider-red.** A drafter answer stopped at the output cap (`truncated:max_tokens`) now goes through the same retry ladder as a malformed artifact, with the reason "the AI's answer was cut off at the output limit"; the cut-off reply is not replayed, `AUTHOR_MAX_TOKENS` is not raised, real transport failures stay provider-red, and spend stays booked. An all-cut-off try also counts for the try-3 question gate. Test-proven only, not exercised live.
+- A dropped connection (ECONNRESET "socket hang up") is a call casualty like ETIMEDOUT, and the scout stop says in words that the first look did not complete (F217).
+- `proveInputFiles` compares like-for-like, so a repo behind a symlinked parent proves its Inputs.
+
 ## [0.39.0] - 2026-10-10
 
 ### Added