bareloop 0.40.0 → 0.41.0

package/src/authorjob.js

@@ -113,7 +113,7 @@ import {
   QUESTION_SETS, questionsFor, requiredAnswersFor, authorClose, makeCostBook,
   runConfirmTurn, LANGUAGE_PICK_FIELD,
 } from './authorflow.js';
-import { draftCallOptions, assertDraftThinking } from './providers.js';
+import { thinkingCallOptions, assertThinkingMode } from './thinking.js';
 import { runAuthorScout, buildSeedListing, SCOUT_ATTEMPTS } from './authorscout.js';
 import {
   DECLARED_GAP_PREFIX, DECLARED_GENRES, guardNames, isDeclaredClose, validateCloseDecl,
@@ -423,7 +423,7 @@ function composerRefusal(reds) {
  *   seedRef?: string|null, scout?: any, listing?: any, ceilingUsd?: number|null, judgeModel?: string|null,
  *   rates?: {in: number, out: number}|null, draftThinking?: 'on'|'off',
  *   onPhase?: (phase: string, data?: any) => void,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingApplied?: boolean|null}) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void,
  *   seedFn?: Function, scoutFn?: Function, listingFn?: Function,
  *   authorFn?: Function, authorOpts?: object, writeScope?: string[]|null,
  *   signerFix?: Function|any, proposeFn?: Function, compileOpts?: object,
@@ -496,7 +496,7 @@ export async function authorCloseForJob({
   answerQuestions = null,
 }) {
   // an operator-param guard: a typo never silently means "default" (throws before any work, even when the survey is supplied)
-  assertDraftThinking(draftThinking);
+  assertThinkingMode(draftThinking);
   /** @type {any} */
   const base = {
     ok: false, refusal: null, verdictType: null, closeDecl: null, seedRef: null,
@@ -597,7 +597,7 @@ export async function authorCloseForJob({
     // real tree. `attempts` is the ceiling the scout enforces on itself, so the
     // reader knows how many the line could repeat for.
     onPhase('scout', { attempts: SCOUT_ATTEMPTS });
-    const scoutCallOptions = draftCallOptions(provider, draftThinking);
+    const scoutCallOptions = thinkingCallOptions(provider, draftThinking);
     survey = await scoutFn({ workdir, provider, ceilingUsd, onCall, ...(rates ? { rates } : {}), ...(Object.keys(scoutCallOptions).length ? { callOptions: scoutCallOptions } : {}) });
     // …and the survey's own VERDICT, said the moment it lands. `state` is what
     // every downstream refusal keys on (F59: absent is never "no facts needed"),

package/src/authorrun.js

@@ -101,7 +101,7 @@
 //                  in; a draft missing one, or naming one the provider factory
 //                  does not know, dies here loud, listing the known table.
 import { keysForDoor } from './keysfile.js';
-import { applyConfiguredKey, judgeRatesFor, keyNameFor, ratesFor, rowsForHome } from './providerrows.js';
+import { judgeRatesFor, judgeRowFor, keyNameFor, keyValueOf, ratesFor, ratesOfLine, resolveWorker, rowsForHome } from './providerrows.js';
 import { ConfigError } from './config.js';
 import {
   readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, statSync,
@@ -466,13 +466,15 @@ export async function main(argv, deps = {}) {
     try { return resolveProvider(draft?.provider); } catch (e) { return die(/** @type {Error} */ (e).message); }
   })();
   const PROVIDER_NAME = /** @type {string} */ (draft.provider);
-  // The same tier run-u drafts and works on. The declaration is authored by a
-  // model, so the floor is the drafter floor (PRD v1.36: sonnet MINIMUM).
-  const MODEL = /** @type {NonNullable<typeof providerEntry>} */ (providerEntry).tiers.sonnet;
-  // spec.baseUrl (PRD item 28, ruling (d)) — the same forwarding rule run-u
-  // applies: forwarded only when the draft names one, every provider
-  // constructor defaults it on its own when absent.
-  const baseUrl = typeof draft?.baseUrl === 'string' ? draft.baseUrl : undefined;
+  // The Settings LINE this authoring run works on (P8): the draft's own `model` on a ticked, priced line of a key row on the
+  // draft's API shape (and Base URL, when it names one). The row is the key, the Base URL and the old-max_tokens tick. Nothing is
+  // built in: a draft naming no model, or a model no row ticks, stops here at $0.
+  const keyCfg = rowsForHome(keys.home, env);
+  const W = resolveWorker(keyCfg, draft);
+  if (!W.ok) { err(W.say.includes('Nothing was spent') ? W.say : `${W.say} Nothing was spent.`); throw new ExitSignal(2); }
+  const MODEL = W.model;
+  const baseUrl = W.baseUrl;
+  const AUTHOR_ROW = W.row;
 
   // THE JUDGE THIS RUN'S OWN WORKER RESOLVES TO (PRD item 32.1) — resolved ONCE,
   // here, from the DRAFT, and reused for BOTH the compose-time stamp (the
@@ -508,12 +510,9 @@ export async function main(argv, deps = {}) {
 
   // Secrets load from the environment; they never enter argv (a command line is
   // world-readable on /proc) and they are never printed.
-  // P4a item 4 — the key variable the person picked in Settings (config.json) stands in for
-  // the provider's built-in one; none picked = the built-in. Names only.
-  const keyCfg = rowsForHome(keys.home);
-  const authorEnv = applyConfiguredKey(env, PROVIDER_NAME, baseUrl, keyCfg);
-  const AUTHOR_ENV_KEY = keyNameFor(PROVIDER_NAME, baseUrl, keyCfg).name;
-  const apiKey = authorEnv[/** @type {NonNullable<typeof providerEntry>} */ (providerEntry).envKey];
+  // The key is the chosen row's own variable (P8: no built-in name). Names only.
+  const AUTHOR_ENV_KEY = AUTHOR_ROW.envName;
+  const apiKey = keyValueOf(env, AUTHOR_ENV_KEY);
   if (!apiKey) { err(`${AUTHOR_ENV_KEY} not set (secrets load from the environment — never the tree, never argv)`); throw new ExitSignal(2); }
   // F181 — a key that carries a line break/control char/stray whitespace (a
   // two-line secret-store entry, e.g.) reads as "set" by the presence check
@@ -527,17 +526,17 @@ export async function main(argv, deps = {}) {
   // loop, confirm turn, calibration judge). A bad price refuses here; it never falls back to the guess.
   /** @type {ReturnType<typeof ratesFor>} */
   let authorPrice = null;
-  try { authorPrice = ratesFor(PROVIDER_NAME, baseUrl, keyCfg); } catch (e) {
-    if (!(e instanceof ConfigError)) throw e;
-    err(`${e.message} — refusing to start rather than guess a price. Nothing spent.`);
-    throw new ExitSignal(2);
+  {
+    const al = ratesOfLine(W.line);
+    authorPrice = al ? { ...al, envName: AUTHOR_ROW.envName } : null;
   }
   /** The judge's key follows the RESOLVED judge provider's own env var, with
    * `JUDGE_API_KEY` as the role-named override in front (PRD item 32.3) — the same
    * contract `scripts/run-u.mjs` keeps, so one story covers both surfaces. When the
    * judge IS the authoring provider this is the key already read above. */
+  const judgeRowOf = (/** @type {{provider: string, model?: string|null}} */ j) => judgeRowFor(keyCfg, j, PROVIDER_NAME, AUTHOR_ROW);
   const judgeKeyFor = (/** @type {string} */ providerName) => (
-    env.JUDGE_API_KEY ?? (providerName === PROVIDER_NAME ? authorEnv : applyConfiguredKey(env, providerName, undefined, keyCfg))[resolveProvider(providerName).envKey]
+    env.JUDGE_API_KEY ?? (providerName === PROVIDER_NAME ? apiKey : keyValueOf(env, judgeRowFor(keyCfg, { provider: providerName }, PROVIDER_NAME, AUTHOR_ROW)?.envName))
   );
 
   /** F6 — an unpriced call makes the TOTAL unknown, and unknown is reported as
@@ -579,7 +578,7 @@ export async function main(argv, deps = {}) {
   // one) — the real judge identity is not resolved until after `validateJob`,
   // further down, where a second call takes only its `.judgeProvider`.
   const { provider } = buildRunnerProviders({
-    providerName: PROVIDER_NAME, apiKey, model: MODEL, tierModels: providerEntry.tiers, baseUrl,
+    providerName: PROVIDER_NAME, apiKey, model: MODEL, baseUrl, legacyMaxTokens: AUTHOR_ROW.legacyMaxTokens,
     judgeApiKey: apiKey, judgeModel: MODEL, judgeProviderName: PROVIDER_NAME, judgeBaseUrl: baseUrl,
   });
   emit('author-start', { runid, source: SOURCE, lang: LANG, verdictType: VERDICT, provider: PROVIDER_NAME, model: MODEL, baseUrl: baseUrl ?? null, job: draft?.job ?? null, timeoutMs: TIMEOUT_MS, ceilingUsd: CEILING_USD });
@@ -1115,7 +1114,7 @@ export async function main(argv, deps = {}) {
           const judgeKeyValue = judgeKeyFor(judge.provider);
           const judgeKeyProblem = judgeKeyValue ? apiKeyProblem(judgeKeyValue) : null;
           if (judgeKeyProblem) {
-            const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : resolveProvider(judge.provider).envKey;
+            const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : (judgeRowOf(judge)?.envName ?? judge.provider);
             err(`${judgeEnvName} ${judgeKeyProblem} — refusing rather than crashing mid-call (never trimmed or repaired; fix the value at its source)`);
             // F186 — the scout above already ran and may have left its own gate
             // audit in the tree. Under `process.exit()` this path used to skip
@@ -1149,9 +1148,10 @@ export async function main(argv, deps = {}) {
         let judgeProvider = null;
         if (judge) {
           judgeProvider = buildRunnerProviders({
-            providerName: PROVIDER_NAME, apiKey, model: MODEL, tierModels: providerEntry.tiers, baseUrl,
+            providerName: PROVIDER_NAME, apiKey, model: MODEL, baseUrl, legacyMaxTokens: AUTHOR_ROW.legacyMaxTokens,
             judgeApiKey: judgeKeyFor(judge.provider), judgeModel: judge.model, judgeProviderName: judge.provider,
-            judgeBaseUrl: judge.provider === PROVIDER_NAME ? baseUrl : undefined,
+            judgeBaseUrl: judge.provider === PROVIDER_NAME ? baseUrl : (judgeRowOf(judge)?.baseUrl.trim() || undefined),
+            judgeLegacyMaxTokens: judge.provider === PROVIDER_NAME ? AUTHOR_ROW.legacyMaxTokens : (judgeRowOf(judge)?.legacyMaxTokens ?? false),
           }).judgeProvider;
         }
         if (judge) {
@@ -1170,7 +1170,7 @@ export async function main(argv, deps = {}) {
           // number would silently widen it.
           ceilingUsd: CEILING_USD,
           priorCalls: [...metered],
-          judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgePrice?.rates ?? null }) : null,
+          judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgePrice?.rates ?? null, thinking: spec.thinking === true }) : null,
           // the seam's other half (PRD item 32.1): the graded set is STAMPED with
           // this, and the close later refuses to grade under any other identity.
           judgeModel: judge?.model ?? null,
@@ -1297,7 +1297,7 @@ export async function main(argv, deps = {}) {
               + 'and run-u will enforce the remainder (Cap $ minus this) as ITS ceiling — pass --draft-spent-usd exactly as shown below, never a rounded or re-typed figure.');
           }
           out('\nTo run it (the same signature and gates as any other job — nothing here bypasses them):');
-          out(`  ${keyNameFor(PROVIDER_NAME, baseUrl, keyCfg, spec.model).name}=... ${commandFor('run-u', deps.invokedAs)} --spec ${specFile} --approve ${hash}${draftSpentUsd > 0 ? ` --draft-spent-usd ${draftSpentUsd}${draftIncomplete ? ' --draft-spend-incomplete' : ''}` : ''}`);
+          out(`  ${AUTHOR_ENV_KEY}=... ${commandFor('run-u', deps.invokedAs)} --spec ${specFile} --approve ${hash}${draftSpentUsd > 0 ? ` --draft-spent-usd ${draftSpentUsd}${draftIncomplete ? ' --draft-spend-incomplete' : ''}` : ''}`);
           emit('author-end', { outcome: 'prepared', specHash: hash });
         }
       }

package/src/authorscout.js

@@ -375,7 +375,7 @@ const defaultLoop = (/** @type {any} */ { system, policy, onLlmResult, provider,
  * @param {{workdir: string, provider?: any,
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
  *   attempts?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingApplied?: boolean|null}) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void,
  *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any, rates?: {in: number, out: number}}) => any,
  *   rates?: {in: number, out: number}|null, callOptions?: Record<string, any>,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
@@ -400,7 +400,7 @@ export async function runAuthorScout({
   onCall = () => {},
   createLoop = defaultLoop,
   rates = null,
-  // the drafter's per-call model options (`draftCallOptions`, src/providers.js; e.g. thinking off) — {} = nothing extra, byte-identical
+  // the drafter's per-call model options (`thinkingCallOptions`, src/thinking.js; e.g. thinking off) — {} = nothing extra, byte-identical
   callOptions = {},
   createSurveyor = defaultSurveyor,
 }) {
@@ -436,8 +436,8 @@ export async function runAuthorScout({
     // metered without the report going out: exactly the pairing invariant the
     // raw already rides. It REPORTS and decides nothing; the ceiling still binds
     // through `capStop` between calls, untouched.
-    // bare-agent's per-run `thinkingApplied` rides the reporting seam only, never the stored entry (see makeCostBook.add)
-    onCall({ ...call, ...(r?.thinkingApplied === undefined ? {} : { thinkingApplied: r.thinkingApplied }) });
+    // bare-agent's per-run `thinkingStatus` rides the reporting seam only, never the stored entry (see makeCostBook.add)
+    onCall({ ...call, ...(r?.thinkingStatus === undefined ? {} : { thinkingStatus: r.thinkingStatus }) });
     return raws.push(scrubRaw({ label, attempt, text: r?.text })) - 1;
   };
   // TIGHTEN-ONLY: an operator may lower the ceiling, never raise it. A garbage

package/src/bundle.js

@@ -459,13 +459,16 @@ export function exportBundle({ spec, closeScripts, registryDir, outDir, bareloop
     '',
     '## Running this bundle',
     '',
-    '  ./node_modules/.bin/bareloop run . --repo <path> [--budget N] [--wall MIN] [--approve <bundleHash>]',
+    '  ./node_modules/.bin/bareloop run . --repo <path> [--model <id>] [--budget N] [--wall MIN] [--approve <bundleHash>]',
     '',
     'Answer these, in the order `bareloop run` asks them:',
     '',
-    '1. Provider key — set ANTHROPIC_API_KEY in your environment (never on the',
-    '   command line, never in a file). Absent, `bareloop run` prints these',
-    '   questions and the bundleHash again, and spends nothing.',
+    "1. Provider key — put your provider's API key in your keys file (the NAME your",
+    '   Settings row uses), never on the command line. A bundle signed without a',
+    '   model needs `--model <id>` of a line ticked in Settings > Providers (with',
+    '   both prices), plus `--provider <KEY>` when two keys tick it. With neither,',
+    '   `bareloop run` prints these questions and the bundleHash again, and spends',
+    '   nothing.',
     `2. Approve — the FIRST run on this machine requires --approve ${hash}`,
     "   (this bundle's own signed hash, shown above) to prove a human read and",
     '   accepted it before anything runs. Once that first run GREENS, the',

package/src/bundlerun.js

@@ -204,13 +204,16 @@ export async function bundleMain(args, {
       workdir: worktree,
       seed,
       approve: approveHash,
+      // an exported bundle follows the run-u rule: a spec that names no model takes `--model <id>` (+ `--provider <KEY>` when two keys tick it)
+      ...(typeof flags.model === 'string' ? { model: flags.model } : {}),
+      ...(typeof flags.provider === 'string' ? { providerKey: flags.provider } : {}),
       deps: { ...deps, env, out, err, ...(keysHome === undefined ? {} : { keysHome }) },
       bundle: {
         runid,
         runDir,
         // the bare re-invocation prefix; the leg's OWN tightened ceilings (only those the person passed) ride as
         // DATA so the engine, which knows the halt kind and the spend, spells the printed line. Text only.
-        invoke: `bareloop run ${bundleDirArg} --repo ${repo}`,
+        invoke: `bareloop run ${bundleDirArg} --repo ${repo}${typeof flags.model === 'string' ? ` --model ${flags.model}` : ''}${typeof flags.provider === 'string' ? ` --provider ${flags.provider}` : ''}`,
         tightened: {
           ...(envelope.budgetUsd === undefined ? {} : { budgetUsd: envelope.budgetUsd }),
           ...(flags.wall === undefined ? {} : { wallMin: Number(flags.wall) }),

package/src/cli.js

@@ -7,7 +7,7 @@
 // run-u` drives (`src/userrun.js`): providers, keys (the keys file / env, any provider the
 // bundle's spec names), judge, monthly limit and readout are that engine's. The test seam is
 // the engine's too: `deps.provider` (and `providerFor`/`judgeProvider`) supplies a scripted
-// provider and skips the real-key check (same as `tests/planrun.test.js`'s pattern).
+// provider and skips the real-key check (same as `tests/planrun-*.test.js`'s pattern).
 //
 // Money/arbiter rules the bundle door keeps: `--budget`/`--wall` only TIGHTEN a bundle's
 // signed ceilings (`checkEnvelope`, M1); a bundle's `bundleHash` (the human-facing

package/src/config.js

@@ -1,17 +1,22 @@
-// PANEL-BUILD.md P4a item 2 — the ONE reader/writer of `~/.config/bareloop/config.json`.
+// rewritten-from: fwdloop src/config.js@f9449e8 (validators `modelsProblem`, `providerFieldProblem`, `cleanBaseUrl`)
+// PANEL-BUILD.md P4a item 2 / P8 — the ONE reader/writer of `~/.config/bareloop/config.json`.
 //
-// Every panel/CLI setting lives in this one file (R5): the monthly $ limit, the
-// Anthropic balance note, and the Providers rows' Name / API shape / Base URL, per key variable.
+// Every panel/CLI setting lives in this one file (R5): the monthly $ limit and the Providers
+// rows' API shape / Base URL / old-max_tokens tick (`keys`) and each row's model lines (`models`).
 // Key VALUES never live here — they live in the keys file (`src/keysfile.js`) and the
 // shell env. The write path refuses a document that carries a secret-shaped string
 // (the ONE inventory: `sweepSecretLiterals`, src/validate.js).
 //
 // Shape (unknown fields are kept, never dropped):
-//   { "monthlyLimitUsd": <number>,          // absent = no limit, no check
-//     "anthropicBalanceNote": <number>,     // a typed note; no check ever reads it
-//     "keys": { "<ENV NAME>": { "name": "<model id>", "shape": "<api shape>", "baseUrl": "<url or blank>" } } }
+//   { "monthlyLimitUsd": <number > 0>,          // absent = no limit, no check
+//     "keys":   { "<ENV NAME>": { "shape": "<shape id>", "baseUrl": "http(s)://…", "legacyMaxTokens": true|false } },
+//     "models": { "<ENV NAME>": [ { "model": "<id>", "use": true|false, "inPerM": n, "outPerM": n } ] } }
+// An older file's `keys.<ENV>.{name,priceInPerM,priceOutPerM}` is tolerated and read as ONE model
+// line (`effectiveModels`, src/providerrows.js); the first write of that row's `models` list removes them.
+// `modelsProblem` is the ONE rule for a row's model lines: a price is a PAIR or neither, a ticked
+// line needs both. Nothing here sniffs a host or a model id.
 //
-// A missing file = defaults. An UNREADABLE file is reported (`problem`), never
+// A missing file = defaults. An UNREADABLE or INVALID file is reported (`problem`), never
 // papered over — the monthly check REFUSES on it rather than silently running with
 // no limit. Written atomically (tmp + rename), mode 600.
 import {
@@ -20,6 +25,7 @@ import {
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { sweepSecretLiterals } from './validate.js';
+import { SHAPE_IDS } from './providershapes.js';
 
 /** A plain-words config failure (bad value, secret-shaped string, unreadable file). */
 export class ConfigError extends Error {}
@@ -55,22 +61,106 @@ export function readConfig(opts = {}) {
   if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
     return { config: {}, exists: true, problem: `${file} must hold a JSON object — fix or remove it` };
   }
+  const bad = docProblem(parsed);
+  if (bad) return { config: {}, exists: true, problem: `${file}: ${bad} — fix or remove it` };
   return { config: parsed, exists: true, problem: null };
 }
 
 const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
-/** the API shapes a keys row may name (the `src/providers.js` table names) */
-const SHAPE_IDS = ['anthropic-api', 'openai-api', 'gemini-api'];
+
+/** The fields of a key row this module validates (others are kept untouched). */
+const KEY_FIELDS = Object.freeze(['shape', 'baseUrl', 'legacyMaxTokens']);
+
+/**
+ * One key-row field's value problem in plain words, or null when fine.
+ * @param {string} field `model` | `shape` | `baseUrl` | `legacyMaxTokens`
+ * @param {unknown} v
+ * @returns {string|null}
+ */
+export function providerFieldProblem(field, v) {
+  if (field === 'model') {
+    if (typeof v !== 'string' || v.length === 0 || v.length > 200 || /\s/.test(v)) return 'must be a model id: 1 to 200 characters, no spaces';
+  } else if (field === 'shape') {
+    if (typeof v !== 'string' || !SHAPE_IDS.includes(v)) return `must be one of ${SHAPE_IDS.join(', ')}`;
+  } else if (field === 'legacyMaxTokens') {
+    if (typeof v !== 'boolean') return 'must be true or false';
+  } else if (field === 'baseUrl') {
+    if (typeof v !== 'string' || !(v === '' || /^https?:\/\/\S+$/.test(v))) return 'must be empty or an http(s) address';
+  } else return 'is not a provider field';
+  return null;
+}
+
+/** A Base URL as stored: trailing slashes dropped. @param {string} v @returns {string} */
+export const cleanBaseUrl = (v) => v.replace(/\/+$/, '');
+
+/**
+ * THE one rule for a row's model lines, used by config validation and the Settings routes. A price
+ * is a PAIR (`inPerM` and `outPerM`, each a finite number >= 0 — 0 / 0 typed is a chosen price) or
+ * neither (null / absent). A ticked line (`use`) needs both. Plain words, or null.
+ * @param {unknown} list
+ * @returns {string|null}
+ */
+export function modelsProblem(list) {
+  if (!Array.isArray(list)) return 'The model list must be a list of lines.';
+  const seen = new Set();
+  for (const line of list) {
+    if (line === null || typeof line !== 'object' || Array.isArray(line)) return 'Each model line must be an object.';
+    const l = /** @type {Record<string, any>} */ (line);
+    const bad = providerFieldProblem('model', l.model);
+    if (bad) return `The model name ${bad}.`;
+    if (seen.has(l.model)) return `The model "${l.model}" is listed twice.`;
+    seen.add(l.model);
+    if (typeof l.use !== 'boolean') return 'Use must be on or off.';
+    const has = (/** @type {string} */ f) => l[f] !== undefined && l[f] !== null;
+    const isNum = (/** @type {unknown} */ v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
+    if (has('inPerM') !== has('outPerM')) return 'Fill both price boxes or clear both.';
+    if (has('inPerM') && !(isNum(l.inPerM) && isNum(l.outPerM))) return 'A price must be a number, 0 or more.';
+    if (l.use && !has('inPerM')) return 'Fill both prices to tick this model.';
+    for (const k of Object.keys(l)) if (!['model', 'use', 'inPerM', 'outPerM'].includes(k)) return `A model line has no "${k}" field.`;
+  }
+  return null;
+}
+
+/**
+ * The first problem in a document's known fields, in plain words, or null.
+ * @param {Record<string, any>} doc
+ * @returns {string|null}
+ */
+function docProblem(doc) {
+  // monthlyLimitUsd is NOT judged here: `monthlyLimitOf` (src/monthly.js) owns its read-time sentence
+  if (doc.keys !== undefined) {
+    if (doc.keys === null || typeof doc.keys !== 'object' || Array.isArray(doc.keys)) return 'keys must be an object of key variable names';
+    for (const [env, row] of Object.entries(doc.keys)) {
+      if (!ENV_NAME_RE.test(env)) return `"${env}" is not a key variable name`;
+      if (row === null || typeof row !== 'object' || Array.isArray(row)) return `keys.${env} must be an object`;
+      for (const f of KEY_FIELDS) {
+        if (!Object.hasOwn(row, f)) continue;
+        const bad = providerFieldProblem(f, /** @type {Record<string, any>} */ (row)[f]);
+        if (bad) return `keys.${env}.${f} ${bad}`;
+      }
+    }
+  }
+  if (doc.models !== undefined) {
+    if (doc.models === null || typeof doc.models !== 'object' || Array.isArray(doc.models)) return 'models must be an object of key variable names';
+    for (const [env, list] of Object.entries(doc.models)) {
+      if (!ENV_NAME_RE.test(env)) return `models: "${env}" is not a key variable name`;
+      const bad = modelsProblem(list);
+      if (bad) return `models.${env}: ${bad}`;
+    }
+  }
+  return null;
+}
 
 /**
  * Apply a patch and write. `null` deletes a field. Top-level fields shallow-merge;
- * `keys` merges per key variable name, then per field. Validated before anything is
- * written; nothing is written on a refusal.
+ * `keys` merges per key variable name, then per field; `models.<ENV>` is REPLACED WHOLE (`null`
+ * clears it). Validated before anything is written; nothing is written on a refusal.
  *
- * Patch fields understood: `monthlyLimitUsd` (finite > 0), `anthropicBalanceNote`
- * (finite >= 0), `keys.<ENV NAME>.{name,shape,baseUrl}` (Name = a model id, shape = a provider table name, baseUrl = blank or http(s)). Any other
- * field is passed through untouched (kept), but the whole document is swept for
- * secret-shaped strings first.
+ * Patch fields understood: `monthlyLimitUsd` (finite > 0), `keys.<ENV>.{shape,baseUrl,legacyMaxTokens}`,
+ * `models.<ENV>` (a list judged by {@link modelsProblem}). The first write of a row's `models` list
+ * removes that row's older `name` / `priceInPerM` / `priceOutPerM` in the SAME write (never two
+ * sources); a retired top-level `anthropicBalanceNote` is dropped on any write. Any other field is
+ * kept, but the whole document is swept for secret-shaped strings first.
  * @param {Record<string, any>} patch
  * @param {{ home?: string }} [opts]
  * @returns {Record<string, any>} the document as written
@@ -81,16 +171,14 @@ export function updateConfig(patch, opts = {}) {
   /** @type {Record<string, any>} */
   const next = { ...cur.config };
   for (const [k, v] of Object.entries(patch)) {
-    if (k === 'keys') continue;
+    if (k === 'keys' || k === 'models') continue;
     if (v === null) { delete next[k]; continue; }
     if (k === 'monthlyLimitUsd' && !(typeof v === 'number' && Number.isFinite(v) && v > 0)) {
       throw new ConfigError('monthlyLimitUsd must be a number above 0 (remove the limit to have none)');
     }
-    if (k === 'anthropicBalanceNote' && !(typeof v === 'number' && Number.isFinite(v) && v >= 0)) {
-      throw new ConfigError('anthropicBalanceNote must be a number, 0 or more');
-    }
     next[k] = v;
   }
+  delete next.anthropicBalanceNote;
   if (patch.keys !== undefined) {
     if (patch.keys === null || typeof patch.keys !== 'object' || Array.isArray(patch.keys)) {
       throw new ConfigError('keys must be an object of key variable names');
@@ -104,21 +192,33 @@ export function updateConfig(patch, opts = {}) {
       const merged = { ...(keys[envName] && typeof keys[envName] === 'object' ? keys[envName] : {}) };
       for (const [fk, fv] of Object.entries(/** @type {Record<string, any>} */ (fields))) {
         if (fv === null) { delete merged[fk]; continue; }
-        if (fk === 'name' && !(typeof fv === 'string' && fv.length <= 100 && !/\s/.test(fv))) {
-          throw new ConfigError(`keys.${envName}.name must be a model id (no spaces, up to 100 characters)`);
-        }
-        if (fk === 'shape' && !SHAPE_IDS.includes(fv)) {
-          throw new ConfigError(`keys.${envName}.shape must be one of ${SHAPE_IDS.join(', ')}`);
-        }
-        if (fk === 'baseUrl' && !(typeof fv === 'string' && (fv === '' || /^https?:\/\/\S+$/.test(fv)))) {
-          throw new ConfigError(`keys.${envName}.baseUrl must be blank or an http(s) URL`);
-        }
-        merged[fk] = fv;
+        merged[fk] = fk === 'baseUrl' && typeof fv === 'string' ? cleanBaseUrl(fv) : fv;
       }
       keys[envName] = merged;
     }
     next.keys = keys;
   }
+  if (patch.models !== undefined) {
+    if (patch.models === null || typeof patch.models !== 'object' || Array.isArray(patch.models)) {
+      throw new ConfigError('models must be an object of key variable names');
+    }
+    /** @type {Record<string, any>} */
+    const models = { ...(next.models && typeof next.models === 'object' ? next.models : {}) };
+    for (const [envName, list] of Object.entries(patch.models)) {
+      if (!ENV_NAME_RE.test(envName)) throw new ConfigError(`"${envName}" is not a key variable name`);
+      if (list === null) { delete models[envName]; continue; }
+      models[envName] = list;
+      const row = next.keys?.[envName];
+      if (row && typeof row === 'object') {
+        // one source: the older single-model fields leave with the first saved list
+        const { name: _n, priceInPerM: _i, priceOutPerM: _o, ...rest } = row;
+        next.keys = { ...next.keys, [envName]: rest };
+      }
+    }
+    next.models = models;
+  }
+  const problem = docProblem(next);
+  if (problem) throw new ConfigError(problem);
   /** @type {string[]} */
   const secretPaths = [];
   sweepSecretLiterals(next, (_code, path) => { secretPaths.push(path); });

package/src/draftspend.js

@@ -24,10 +24,10 @@ export const DRAFT_LOG_FILE = 'draft-log.jsonl';
  * One line of the drafting log. `no` = the step's position in the session's progress list (a step id can repeat).
  *  - `step-start`  {no, id, label, at}
  *  - `step-end`    {no, status: 'done'|'failed', label, at}   (a re-opened step writes `step-reopen` {no, at} first)
- *  - `step-label`  {no, label, at}   (the step reads `label` from now on, status and times untouched: the thinking row's "the model thought anyway")
- *  - `call`        {no, step, label, model, thinking, thinkingApplied?, costUsd (null stays null), unpricedRounds, at}: one METERED model call
- *    (`thinking` = what was asked and sent: off | on | not-switchable | unverified; `thinkingApplied` = bare-agent's own verdict for the
- *    call's run (true | false | null), present only when thinkingMode was sent)
+ *  - `step-label`  {no, label, at}   (the step reads `label` from now on, status and times untouched: the thinking row's "the model thought anyway" / "can't change it" / "not confirmed")
+ *  - `call`        {no, step, label, model, thinking, thinkingSupport, thinkingStatus?, costUsd (null stays null), unpricedRounds, at}: one METERED model call
+ *    (`thinking` = the tick's mode: off | on; `thinkingSupport` = bare-agent's lookup for the model: true | false | 'unverified';
+ *    `thinkingStatus` = bare-agent's own verdict for the call's run: applied | unsupported | ignored | unknown, present only when thinkingMode was sent)
  *    (no token counts: the call path does not carry them without reworking the library, so none are recorded)
  * @typedef {{kind: string, no: number, at: string, [k: string]: any}} DraftEvent
  */

package/src/index.js

@@ -148,16 +148,14 @@ export { answerReviewDoor } from './reviewdoor.js';
 // SOFTGREEN module 1 — the judged floor's core. The pieces an adopter (and an
 // integrating UI) genuinely needs: `resolveJudge` (PRD item 32.1 — WHICH model
 // grades a job: the spec's signed `judge` override, else the job's own worker
-// model, and no library fall-back), `JUDGE_MODEL` (the pre-item-32 pin, kept
-// exported for adopters and still the right default for an anthropic-api job,
-// but no longer read by any grading path), the rulebook a card SELECTS from,
+// model, and no library fall-back; the old pinned-model constant is gone), the rulebook a card SELECTS from,
 // the card gate, and the two halves themselves so a calibration harness can
 // grade the whole pipe without running a close.
 // `defaultJudgeLoop` (src/judged.js) is the one spelling of how this repo drives a
 // judge; the runner reaches it through `runPlan`'s `judgeProvider`. It is internal:
 // the package root does not export it.
 export {
-  JUDGE_MODEL, resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS,
+  resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS,
   runLocate, decide,
   // SOFTGREEN module 4 — what a legal SIGNED calibration set is. The SIZE is
   // hamr's own ruling and a size change is a spec-level threshold change;

package/src/interviewrun.js

@@ -87,7 +87,7 @@
 // non-repo source gets the form up to here and then an honest named stop:
 // bareloop has no checks for that kind of job yet (ruling 7 → M4).
 import { keysForDoor } from './keysfile.js';
-import { applyConfiguredKey, rowsForHome } from './providerrows.js';
+import { keyValueOf, namedRowsForHome, resolveWorker } from './providerrows.js';
 import {
   writeFileSync, mkdirSync, readFileSync, statSync,
 } from 'node:fs';
@@ -192,6 +192,9 @@ export async function main(argv, deps = {}) {
   // way an empty `--verdict`/`--provider` value already does elsewhere in this
   // file.
   const baseUrlArg = arg('base-url');
+  // `--model <id>`: the model id of a line ticked in Settings > Providers (with both prices). Written into the draft as `model`, so the
+  // job carries its own model; absent when never given (run-author then stops at $0 asking for one).
+  const modelArg = arg('model');
   // `--lang` IS GONE (PRD item 33 M3, ruling 3): language is a FACT of the
   // repository, read off its own manifest, never a flag a person sets. A
   // `--lang` on the command line now is an operator error, stopped loud rather
@@ -686,6 +689,7 @@ export async function main(argv, deps = {}) {
     // written as `null`/`''`; every provider constructor defaults its own
     // endpoint on its own in that case (PRD item 28 ruling (d)).
     ...(baseUrlArg === null ? {} : { baseUrl: baseUrlArg }),
+    ...(modelArg === null ? {} : { model: modelArg }),
     cadence: { unit: 'day', every: 1 },
     budgetUsd,
     ...(wallMin === null ? {} : { maxWallMs: Math.round(wallMin * 60_000) }),
@@ -782,29 +786,17 @@ export async function main(argv, deps = {}) {
   // anything this script itself let through; the try/catch is only for the
   // off-menu case `validateJob` reds but does not stop the write for (an
   // admitted-but-uncrafted table entry would otherwise crash this print).
-  let providerEntry = null;
-  try { providerEntry = resolveProvider(PROVIDER); } catch { providerEntry = null; }
-  const providerEnvKey = providerEntry?.envKey ?? null;
-  say(`  ${providerEnvKey ?? 'YOUR_PROVIDER_API_KEY'}=... ${commandFor('author', deps.invokedAs)} ${childArgs.join(' ')}`);
-  // An `openai-api` + `baseUrl` draft (DeepSeek, today's one secondary, reached
-  // this way) still reads its key from `OPENAI_API_KEY` — there is no separate
-  // "DeepSeek key" env var, and a person pointed only at the command above could
-  // reasonably miss that. Said once, plainly, never a key VALUE.
-  if (draft.baseUrl !== undefined && providerEnvKey) {
-    say(`  (the endpoint above is reached through the "${PROVIDER}" table entry, so its key still goes in ${providerEnvKey} — there is no separate endpoint-specific key variable)`);
-  }
-  // NO KEY, NO OFFER. `run-author.mjs` refuses without one and exits 2 at its own
-  // door, before a spine exists — so with the shell unkeyed this question has
-  // exactly one possible outcome for the person, and putting it anyway spends
-  // their attention on a choice they do not have. What is actionable instead is
-  // the command above and the one line that says how to make it work.
-  // F181 — a key that IS set can still carry a shape run-author will refuse
-  // (a line break/control char/stray whitespace, e.g. a two-line secret-store
-  // entry). A malformed key must not count as KEYED: this offer must read the
-  // same "will it actually run" question run-author itself asks at its door.
-  // P4a item 4 — the key variable the person picked in Settings stands in for the built-in one
-  const keyEnv = keys.home !== undefined ? applyConfiguredKey(env, PROVIDER, draft.baseUrl, rowsForHome(keys.home)) : env;
-  const rawKeyValue = providerEnvKey ? keyEnv[providerEnvKey] : undefined;
+  // The key is the Settings row's own variable (P8: no built-in name). The worker is the draft's API shape + Base URL + model line.
+  const keyRowsNow = keys.home !== undefined ? namedRowsForHome(keys.home) : [];
+  const worker = resolveWorker(keyRowsNow, { provider: PROVIDER, baseUrl: draft.baseUrl, model: modelArg });
+  const providerEnvKey = worker.ok ? worker.row.envName : null;
+  say(`  ${providerEnvKey ?? 'YOUR_KEY_NAME'}=... ${commandFor('author', deps.invokedAs)} ${childArgs.join(' ')}`);
+  if (!worker.ok) say(`  (${worker.say.replace(' Nothing was spent.', '')} — bareloop author stops at $0 until it is)`);
+  // NO KEY, NO OFFER. `run-author.mjs` refuses without one and exits 2 at its own door, before a spine exists — so with the shell
+  // unkeyed this question has exactly one possible outcome for the person, and putting it anyway spends their attention on a choice
+  // they do not have. F181 — a key that IS set can still carry a shape run-author will refuse (a line break/control char/stray
+  // whitespace). A malformed key must not count as KEYED: this offer reads the same "will it actually run" question run-author asks.
+  const rawKeyValue = providerEnvKey ? keyValueOf(env, providerEnvKey) : undefined;
   const keyProblem = rawKeyValue ? apiKeyProblem(rawKeyValue) : null;
   const KEYED = providerEnvKey !== null && Boolean(rawKeyValue) && !keyProblem;
   if (!KEYED) {
@@ -814,7 +806,7 @@ export async function main(argv, deps = {}) {
     } else {
       say(providerEnvKey
         ? `  (${providerEnvKey} is not set in this shell — bareloop author refuses without it; secrets load from the environment, never the tree)`
-        : `  (provider "${PROVIDER}" is not in the runnable table — bareloop author will refuse it loud; this is not a key problem)`);
+        : '  (no key row serves this model yet — bareloop author refuses it at $0; this is not a key problem)');
     }
     // The repair, in plain words and WITHOUT a command: which secret store a person
     // keeps their key in is theirs, and printing one specific incantation would be