bareloop 0.40.0 → 0.41.0

package/src/job.js

@@ -167,7 +167,7 @@ export const CONDITION_KEYS = Object.freeze(['providerPath', 'closeVerbosity', '
 // `steps` stays in the field list ONLY so a retired spec reds by name
 // (`shape-retired`) instead of falling through to a generic unknown-field —
 // the operator gets told what happened, not just that something is wrong.
-const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools', 'jobLines', 'inputs'];
+const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'thinking', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools', 'jobLines', 'inputs'];
 /** the exact fields of a signed `judge` override — nested objects red unknown
  * keys too, because no smuggling level exists in a signed spec */
 const JUDGE_FIELDS = ['provider', 'model'];
@@ -329,7 +329,12 @@ export function validateJob(input, { shellCapUsd = 2 } = {}) {
   // on THAT model, not merely on the goal/close it runs against. The judge
   // model stays library-pinned pending recalibration — out of scope here.
   if (spec.model !== undefined && !isNonEmptyString(spec.model)) {
-    red('invalid-value', 'model', 'non-empty string — exact provider model id (e.g. "claude-sonnet-5")');
+    red('invalid-value', 'model', 'non-empty string — the exact model id of a line ticked in Settings > Providers');
+  }
+  // THINKING (P8) — the job's "Thinking on" tick, OPTIONAL: absent means off (and an old spec keeps the hash it always had); present it is
+  // signed like `model`. It covers DRAFTING and the rubric JUDGE only — the worker is never handed a thinking option. A boolean, nothing else.
+  if (spec.thinking !== undefined && typeof spec.thinking !== 'boolean') {
+    red('invalid-value', 'thinking', 'true or false — the job\'s "Thinking on" tick (absent = off)');
   }
 
   // JUDGE — PRD item 32.1 (hamr, 2026-09-10: the judge "defaults to whatever
@@ -984,15 +989,15 @@ export function checkApproval(job, approvals) {
  * mismatched flag is a mistake worth stopping on, never a silent swap); the
  * same id from both is not a conflict. Extracted from scripts/run-u.mjs so
  * the decision is testable without running the script or touching a provider.
- * @param {{ specModel?: string, flagModel?: string, defaultModel: string }} args
+ * @param {{ specModel?: string, flagModel?: string, suppliedModel?: string }} args
  *   `specModel` — `job.model` if the signed spec carries one, else undefined.
  *   `flagModel` — the model id an explicit `--model <tier>` resolved to, else
  *   undefined (a flag that was never passed, not merely a default tier name).
- *   `defaultModel` — the runner's own default when neither spec nor flag says.
+ *   `suppliedModel` — a model the CALLER supplies when neither spec nor flag says (bareloop keeps none of its own).
  * @returns {{ model: string, source: 'spec'|'flag'|'default' }}
- * @throws {Error} when the spec names a model and the flag names a different one
+ * @throws {Error} when the spec names a model and the flag names a different one, or when no model is named at all
  */
-export function resolveWorkerModel({ specModel, flagModel, defaultModel }) {
+export function resolveWorkerModel({ specModel, flagModel, suppliedModel }) {
   if (specModel !== undefined) {
     if (flagModel !== undefined && flagModel !== specModel) {
       throw new Error(`spec names model "${specModel}" but --model resolved to "${flagModel}" — the signed spec wins; a mismatched --model flag is refused, never silently overridden. Drop --model or point it at the same model.`);
@@ -1000,5 +1005,6 @@ export function resolveWorkerModel({ specModel, flagModel, defaultModel }) {
     return { model: specModel, source: 'spec' };
   }
   if (flagModel !== undefined) return { model: flagModel, source: 'flag' };
-  return { model: defaultModel, source: 'default' };
+  if (suppliedModel === undefined) throw new Error('no model is named — a job carries its own model, or the run is given --model <id> (one ticked in Settings > Providers with both prices)');
+  return { model: suppliedModel, source: 'default' };
 }

package/src/judged.js

@@ -66,43 +66,11 @@
 import { quoteIn } from 'bareguard';
 import { createRequire } from 'node:module';
 import { extractArtifact, priceOf, scrubRaw, rateSourceFields } from './text.js';
-import { resolveProvider, judgeCallOptions } from './providers.js';
+import { resolveProvider } from './providers.js';
+import { thinkingCallOptions } from './thinking.js';
 
 const require = createRequire(import.meta.url);
 
-/**
- * THE JUDGE'S HISTORICAL PIN. Until PRD item 32 (2026-09-10) this constant WAS
- * the judge: every grading path imported it, so bareloop could run a worker on
- * any provider and still judge only on Claude.
- *
- * It is no longer read by any grading path. The judge identity is now RESOLVED
- * per job (`resolveJudge` below) and travels as data — `ctx.judgeModel` into
- * `runJudgedFloor`, an explicit argument into the calibration gate, and
- * `closeDecl.calibration.judgeModel` into the signed spec, exactly as before.
- * Keeping the export is deliberate: it is part of the public API
- * (`src/index.js`) and an adopter importing it should not break on a minor.
- * What it means now is "the judge bareloop pinned before item 32", which is
- * still the right DEFAULT for an anthropic-api job and still the only tier with
- * established injection resistance upstream (BA-20's `INJECTION_BATTERY` is
- * haiku-4.5 only).
- *
- * THE ENFORCEMENT IS UNCHANGED, and still lives in three wired places because a
- * rule with no detector is prose (F45) — only the value being compared moved
- * from this constant to the resolved identity:
- *   1. the identity is STORED with the set it graded — `foldJudgedArtifacts`
- *      writes it as `closeDecl.calibration.judgeModel`, inside the spec, so
- *      `jobSpecHash` covers it by construction. Change the judge and every
- *      signed judged spec hashes differently: the signature dies, and re-signing
- *      is what re-runs the calibration gate.
- *   2. `validateCloseDecl` REQUIRES it on any stored set — a set nobody can
- *      attribute to a judge is a floor nobody can tell apart from a moved one.
- *   3. `runJudgedFloor` refuses to grade when the stored identity is not the one
- *      about to grade, naming both. It does not degrade in either direction:
- *      grading on the new judge judges against a floor nobody calibrated, and
- *      the old judge is not on offer.
- */
-export const JUDGE_MODEL = 'claude-haiku-4-5';
-
 /**
  * RESOLVE WHICH MODEL GRADES THIS JOB (PRD item 32.1).
  *
@@ -122,7 +90,7 @@ export const JUDGE_MODEL = 'claude-haiku-4-5';
  *      item 31.4 a green job runs on its own key alone, and this is what lets a
  *      JUDGED one do the same.
  *
- * There is deliberately NO third fallback to `JUDGE_MODEL`. A caller that cannot
+ * There is deliberately NO third fallback to a library-pinned model. A caller that cannot
  * say which model will grade has not wired a judge, and the grading path stops
  * as a wiring gap rather than grading under an identity nobody chose — the same
  * answer an absent `judgeLoop` already gets. A silent default here would be the
@@ -198,15 +166,13 @@ export function resolveJudge({ specJudge, workerProvider, workerModel } = {}) {
  *
  * @param {{provider?: string, model?: string, judge?: any}} source draft or spec
  * @param {string} fallbackProviderName used only when `source.provider` is absent
- * @param {(o: {specModel?: string, flagModel?: string, defaultModel: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
+ * @param {(o: {specModel?: string, flagModel?: string, suppliedModel?: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
  * @returns {{provider: string, model: string}}
  */
 export function resolveJobJudge(source, fallbackProviderName, resolveWorkerModelFn) {
   const providerName = source?.provider ?? fallbackProviderName;
-  const providerEntry = resolveProvider(providerName);
-  const { model } = resolveWorkerModelFn({
-    specModel: source?.model, flagModel: undefined, defaultModel: providerEntry.tiers.sonnet,
-  });
+  resolveProvider(providerName); // an unknown shape is the named throw, never a silent default
+  const { model } = resolveWorkerModelFn({ specModel: source?.model, flagModel: undefined });
   return resolveJudge({ specJudge: source?.judge, workerProvider: providerName, workerModel: model });
 }
 
@@ -1089,9 +1055,11 @@ function topLevelFunctionNames(artifactText) {
  * so the priced seam is the only legal one.
  * `rates` is the customer's own price for the judge's row (USD per 1K, `ratesFor`'s
  * `rates`); null/absent = bare-agent's built-in guess, exactly as before.
- * @param {{provider: any, system: string, rates?: {in: number, out: number}|null}} o
+ * `thinking` is the job's SIGNED "Thinking on" tick (false/absent = off): the judge follows the signed value — so the calibration gate
+ * (10/10) and the later grading run with the SAME tick — and bare-agent decides what each model can switch (src/thinking.js).
+ * @param {{provider: any, system: string, rates?: {in: number, out: number}|null, thinking?: boolean}} o
  * @returns {{run: (msgs: any[], tools: any[], opts?: any) => Promise<any>}} */
-export const defaultJudgeLoop = ({ provider, system, rates = null }) => {
+export const defaultJudgeLoop = ({ provider, system, rates = null, thinking = false }) => {
   const { Loop } = require('bare-agent');
   // BA-21: the Loop's run RESULT carries no `rateSource` — only the per-call metering event
   // does (`onLlmResult`). Capture it there and ride it on the result, so `runLocate` can
@@ -1107,7 +1075,7 @@ export const defaultJudgeLoop = ({ provider, system, rates = null }) => {
   return {
     run: async (/** @type {any[]} */ msgs, /** @type {any[]} */ tools, /** @type {any} */ opts) => {
       seen = null;
-      const res = await loop.run(msgs, tools, { ...judgeCallOptions(provider), ...opts });
+      const res = await loop.run(msgs, tools, { ...thinkingCallOptions(provider, thinking === true ? 'on' : 'off'), ...opts });
       return res && typeof res === 'object' && seen ? { ...res, rateSource: /** @type {any} */ (seen).rateSource } : res;
     },
   };

package/src/keysfile.js

@@ -76,18 +76,24 @@ export function filledKeyNames(home) {
 }
 
 /**
- * Create the keys file with the five empty preset lines when — and only when — it does not
- * exist (mode 600). An existing file is never touched.
- * @param {readonly string[]} presetNames the names to seed, in order
+ * The two comment lines a fresh keys file is created with — no provider name, no preset key.
+ * Each key the person types becomes a row in Settings > Providers.
+ */
+export const KEYS_FILE_BODY = '# bareloop keys — type NAME=value by hand; this file is never shown or written by bareloop.\n'
+  + '# One line per provider key, e.g. MY_PROVIDER_API_KEY=... ; each key becomes a row in Settings > Providers.\n';
+
+/**
+ * Create the keys file with {@link KEYS_FILE_BODY} when — and only when — it does not
+ * exist (mode 600, dir 700). An existing file is never touched.
  * @param {string} [home]
  * @returns {boolean} true if it was created
  */
-export function ensureKeysFile(presetNames, home) {
+export function ensureKeysFile(home) {
   const file = keysFilePath(home);
   if (existsSync(file)) return false;
-  mkdirSync(keysHome(home), { recursive: true });
+  mkdirSync(keysHome(home), { recursive: true, mode: 0o700 });
   try {
-    writeFileSync(file, presetNames.map((n) => `${n}=\n`).join(''), { mode: 0o600, flag: 'wx' });
+    writeFileSync(file, KEYS_FILE_BODY, { mode: 0o600, flag: 'wx' });
   } catch (/** @type {any} */ e) {
     if (e?.code === 'EEXIST') return false; // lost a race: the file is there, untouched
     throw e;
@@ -101,6 +107,8 @@ export function ensureKeysFile(presetNames, home) {
  * @property {string[]} names the NAMES the file defines (sorted; never values)
  * @property {string|null} warning a plain-words warning (file readable by others, or
  *   unreadable), else null — a warning, never a refusal
+ * @property {boolean} [unreadable] true only when the file is there but could not be read (the Settings row then
+ *   reads "refused — see above"); absent otherwise
  * @property {Record<string,string|undefined>} env shell env with the file filling the
  *   names the shell does not set. THE ONLY place values leave this module.
  */
@@ -127,7 +135,7 @@ export function loadKeysEnv(opts = {}) {
   try {
     parsed = parseKeysText(readFileSync(file, 'utf8'));
   } catch (/** @type {any} */ e) {
-    return { exists: true, names: [], warning: `${file} could not be read (${e?.code ?? 'error'})`, env: { ...base } };
+    return { exists: true, names: [], warning: `${file} could not be read (${e?.code ?? 'error'})`, unreadable: true, env: { ...base } };
   }
   /** @type {Record<string,string|undefined>} */
   const env = { ...base };

package/src/kinds.js

@@ -1776,7 +1776,7 @@ async function runJudgedFloor(stage, ctx) {
       + `${MAX_JUDGED_PATHS} — a judged stage buys one call per artifact, and a runaway list is a bill`, {}, STOP_FAULTS.CRASHED);
   }
   // 1b. THE TIER THE SIGNED SET WAS GRADED BY, against the tier this run would buy.
-  //     `JUDGE_MODEL` has always SAID a bump forces a full recalibration; this is the
+  //     the judge model has always SAID a bump forces a full recalibration; this is the
   //     detector, because a rule with no wired detector is prose (F45). The stamp comes
   //     off the SIGNED calibration (`calibration.judgeModel`, carried across by
   //     `declaredStages`), so a mismatch means exactly one thing: the pin moved under a
@@ -1799,7 +1799,7 @@ async function runJudgedFloor(stage, ctx) {
   // model). The IDENTITY is checked before the seam and before the stamp, because
   // an unwired identity makes both of the messages below unwritable: neither
   // "would grade with X" nor "the judge is X" can be said by a stage that cannot
-  // name X. There is deliberately NO fall-back to `JUDGE_MODEL` here — a run that
+  // name X. There is deliberately NO library-pinned fall-back here — a run that
   // cannot say which model grades has not wired a judge, and grading under an
   // identity nobody chose is exactly the silent-ignore class this repo refuses
   // everywhere else.

package/src/modellist.js

@@ -0,0 +1,84 @@
+// rewritten-from: fwdloop src/panel/settings.js@f9449e8 (`authHeaders`, `getWithKey`, `idsOf`, `listModels`)
+// PANEL-BUILD.md P8 — the ONE `<baseUrl>/models` GET. Settings > Providers' Test and Refresh and the
+// New job card's model-readiness check (`checkProviderReachable`, src/providers.js) all call it; no
+// second copy of the probe exists. It is a GET of a models LIST, never a completion, so it spends
+// no token and writes no spend row. The key goes in a header only and is never returned or logged.
+// A redirect is NOT followed (`redirect:'manual'`), so the key is never sent on to another host.
+// There is no default host: a blank Base URL makes no call.
+
+/** The default deadline for the one GET. */
+export const LIST_TIMEOUT_MS = 4000;
+
+/**
+ * The key goes only in a header, in the form each shape expects.
+ * @param {string} shape an API shape id (src/providershapes.js)
+ * @param {string} key
+ * @returns {Record<string, string>}
+ */
+export function authHeaders(shape, key) {
+  if (shape === 'anthropic-api') return { 'x-api-key': key, 'anthropic-version': '2023-06-01' };
+  if (shape === 'gemini-api') return { 'x-goog-api-key': key };
+  return { Authorization: `Bearer ${key}` };
+}
+
+/**
+ * The model ids a provider's list answer holds, per API shape (`data[].id` for two shapes;
+ * `models[].name` minus its `models/` prefix for the third). Sorted, de-duplicated.
+ * @param {string} shape
+ * @param {any} body
+ * @returns {string[]}
+ */
+export function idsOf(shape, body) {
+  const list = shape === 'gemini-api' ? body?.models : body?.data;
+  const key = shape === 'gemini-api' ? 'name' : 'id';
+  const ids = (Array.isArray(list) ? list : [])
+    .map((/** @type {any} */ m) => (typeof m?.[key] === 'string' ? m[key].replace(/^models\//, '') : ''))
+    .filter((id) => id !== '');
+  return [...new Set(ids)].sort();
+}
+
+/**
+ * @typedef {{ ok: true, models: string[], ms: number }
+ *   | { ok: false, why: string, status: string, detail?: string }} ListResult
+ */
+
+/**
+ * One free GET of `<baseUrl>/models` with the key in the header only and a deadline.
+ * Failure is data, never a throw: `why` is a plain sentence, `status` a short machine word
+ * (`no-base-url`, `redirect`, `HTTP <n>`, `timeout`, `unreachable`) for callers that need it.
+ * @param {object} o
+ * @param {string} o.shape an API shape id
+ * @param {string} o.baseUrl the row's Base URL ('' = no call)
+ * @param {string} o.key the key value (header only)
+ * @param {typeof fetch} [o.fetchImpl] test seam; defaults to the global `fetch`
+ * @param {number} [o.timeoutMs]
+ * @returns {Promise<ListResult>}
+ */
+export async function listModels({ shape, baseUrl, key, fetchImpl = fetch, timeoutMs = LIST_TIMEOUT_MS }) {
+  const base = typeof baseUrl === 'string' ? baseUrl.trim().replace(/\/+$/, '') : '';
+  if (base === '') return { ok: false, why: 'Type a Base URL.', status: 'no-base-url' };
+  const url = `${base}/models`;
+  const started = Date.now();
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(url, { method: 'GET', headers: authHeaders(shape, key), signal: ctl.signal, redirect: 'manual' });
+    if (res.status >= 300 && res.status < 400) {
+      return { ok: false, why: 'The provider answered with a redirect; the key was not sent on. Check the Base URL.', status: 'redirect' };
+    }
+    if (res.status === 401 || res.status === 403) return { ok: false, why: 'The provider refused the key.', status: `HTTP ${res.status}` };
+    if (!res.ok) return { ok: false, why: 'The provider answered with an error.', status: `HTTP ${res.status}` };
+    /** @type {any} */
+    let body = null;
+    try { body = await res.json(); } catch { body = null; }
+    return { ok: true, models: idsOf(shape, body), ms: Date.now() - started };
+  } catch (/** @type {any} */ e) {
+    if (e?.name === 'AbortError') return { ok: false, why: 'The provider did not answer in 4 seconds.', status: 'timeout' };
+    const cls = e?.code || e?.name || 'network-error';
+    // connection refused surfaces as fetch's bare TypeError ("fetch failed")
+    const refused = e?.name === 'TypeError' || e?.code === 'ECONNREFUSED' || e?.cause?.code === 'ECONNREFUSED';
+    return { ok: false, why: 'Could not reach the provider.', status: String(cls), detail: refused ? `nothing answering at ${url}` : `request failed: ${cls}` };
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/monthly.js

@@ -33,37 +33,10 @@ import { readOrphanDraftSpends } from './draftspend.js';
 // the per-leg / per-run spend readers live with the ledger (one home, no import cycle through the replay reader)
 export { legSpend, runSpend, chainSpend };
 
-// The Money tab's per-provider breakdown groups a run by the endpoint it ran on and names
-// the groups it knows the vendor of. This is HISTORY labelling for spend already recorded
-// (an archived run keeps its provider whatever Settings holds today) — not the Providers
-// rows, which come from the keys file (src/providerrows.js).
-/** @type {readonly {id: string, name: string}[]} */
-const MONEY_LABELS = Object.freeze([
-  { id: 'anthropic', name: 'Anthropic' }, { id: 'openai', name: 'OpenAI' },
-  { id: 'gemini', name: 'Gemini' }, { id: 'deepseek', name: 'DeepSeek' },
-]);
-
-/**
- * Which known vendor a run's `(provider, baseUrl)` belongs to. `openai-api` with no override
- * is OpenAI; with DeepSeek's host it is DeepSeek; with any OTHER override it is none (null —
- * never silently pooled into OpenAI's figures).
- * @param {string|null|undefined} provider
- * @param {string|null|undefined} baseUrl
- * @returns {string|null} a MONEY_LABELS id, or null
- */
-function rowIdFor(provider, baseUrl) {
-  if (provider === 'anthropic-api') return 'anthropic';
-  if (provider === 'gemini-api') return 'gemini';
-  if (provider === 'openai-api') {
-    if (!baseUrl) return 'openai';
-    try {
-      const host = new URL(baseUrl).hostname;
-      if (host === 'api.deepseek.com') return 'deepseek';
-    } catch { /* an unparseable override is no known vendor */ }
-    return null;
-  }
-  return null;
-}
+// The Money tab's per-provider breakdown groups a run by the Providers ROW that served it (its
+// key variable name, `src/providerrows.js` `findRow`); a run no row claims lands under its own
+// `<shape> @ <baseUrl>`. This is HISTORY labelling for spend already recorded (an archived run
+// keeps its provider whatever Settings holds today). No vendor name or host is known here.
 
 /**
  * One run's wall time off its spine: job-start -> job-end when the run ended (exact), else the
@@ -289,11 +262,11 @@ export function monthSpend(opts = {}) {
 
 /**
  * The Money tab's figures: all-time and this-month spend, and per-provider breakdown
- * (rows from `rowIdFor`; a run on no known row lands under its own provider name, never
- * pooled into another row). Any leg with unknown spend makes the figure it belongs to
+ * (grouped by the matched Providers row's key variable name; a run on no row lands under its
+ * own provider name, never pooled into another row). Any leg with unknown spend makes the figure it belongs to
  * an "at least".
  * @param {{ home?: string, sessionsRoot?: string, now?: () => number, rows?: readonly import('./providerrows.js').KeyRow[] }} [opts] `rows` = the Providers rows: when given, `tokensByRow` sums each row's tokens
- * @returns {{ tokensByRow: Record<string, number>, total: {usd: number, atLeast: boolean, tokens: number}, month: {usd: number, atLeast: boolean, tokens: number},
+ * @returns {{ tokensByRow: Record<string, number>, tokensByModel: Record<string, Record<string, number>>, total: {usd: number, atLeast: boolean, tokens: number}, month: {usd: number, atLeast: boolean, tokens: number},
  *   byProvider: Record<string, {label: string, monthUsd: number, monthAtLeast: boolean, totalUsd: number, totalAtLeast: boolean, tokens: number, vouchedRounds: number, otherRounds: number, monthWallMs: number|null, monthWallAtLeast: boolean, totalWallMs: number|null, totalWallAtLeast: boolean}> }}
  */
 export function spendSummary(opts = {}) {
@@ -307,22 +280,29 @@ export function spendSummary(opts = {}) {
   const wallSeen = {};
   /** total tokens of the runs each Providers row served (matched by shape + endpoint + model) @type {Record<string, number>} */
   const tokensByRow = {};
+  /** tokens per model line of each row, from the spend rows that NAME the model; absent = no row names it (never 0) @type {Record<string, Record<string, number>>} */
+  const tokensByModel = {};
   for (const leg of readLegs({ home: opts.home, sessionsRoot: opts.sessionsRoot })) {
     let served = opts.rows ? findRow(opts.rows, { provider: leg.provider, baseUrl: leg.baseUrl, model: leg.model }) : null;
-    // an older spine records a model but no provider: it counts toward the row whose Name EXACTLY
-    // equals that model. Two rows sharing the Name make it ambiguous, so it counts toward neither.
+    // an older spine records a model but no provider: it counts toward the row with a model line EXACTLY
+    // named that model. Two rows naming it make it ambiguous, so it counts toward neither.
     if (opts.rows && leg.provider === null && leg.model !== null) {
-      const named = opts.rows.filter((r) => r.name === leg.model);
+      const named = opts.rows.filter((r) => r.models.some((l) => l.model === leg.model));
       served = named.length === 1 ? named[0] : null;
     }
-    if (served) tokensByRow[served.envName] = (tokensByRow[served.envName] ?? 0) + leg.tokens;
+    if (served) {
+      tokensByRow[served.envName] = (tokensByRow[served.envName] ?? 0) + leg.tokens;
+      if (typeof leg.model === 'string' && leg.model !== '') {
+        const own = (tokensByModel[served.envName] ??= {});
+        own[leg.model] = (own[leg.model] ?? 0) + leg.tokens;
+      }
+    }
     const inMonth = Number.isNaN(leg.at.getTime()) ? true : sameLocalMonth(leg.at, nowDate);
-    const id = rowIdFor(leg.provider, leg.baseUrl);
     // an older spine carries a model but no provider: say so honestly, one row per model —
     // never a provider guessed from the model's name
-    const notRecorded = id === null && leg.provider === null;
-    const key = id ?? (notRecorded ? `not-recorded:${leg.model ?? ''}` : `other:${leg.provider}${leg.baseUrl ? ` @ ${leg.baseUrl}` : ''}`);
-    const label = id ? (MONEY_LABELS.find((r) => r.id === id)?.name ?? id)
+    const notRecorded = !served && leg.provider === null;
+    const key = served ? served.envName : (notRecorded ? `not-recorded:${leg.model ?? ''}` : `other:${leg.provider}${leg.baseUrl ? ` @ ${leg.baseUrl}` : ''}`);
+    const label = served ? served.envName
       : (notRecorded ? (leg.model ? `not recorded (model ${leg.model})` : 'not recorded') : key.slice('other:'.length));
     const p = (byProvider[key] ??= { label, monthUsd: 0, monthAtLeast: false, totalUsd: 0, totalAtLeast: false, tokens: 0, vouchedRounds: 0, otherRounds: 0, monthWallMs: 0, monthWallAtLeast: false, totalWallMs: 0, totalWallAtLeast: false });
     const w = (wallSeen[key] ??= { monthRuns: 0, monthKnown: 0, totalKnown: 0 });
@@ -349,7 +329,7 @@ export function spendSummary(opts = {}) {
     if (w.totalKnown === 0) p.totalWallMs = null;
     if (w.monthRuns > 0 && w.monthKnown === 0) p.monthWallMs = null;
   }
-  return { tokensByRow, total, month, byProvider };
+  return { tokensByRow, tokensByModel, total, month, byProvider };
 }
 
 /**

package/src/panel/authorroutes.js

@@ -29,7 +29,8 @@ import { validateJob } from '../job.js';
 import { checkMonthlyRoom, monthlyRefusalText } from '../monthly.js';
 import { ConfigError } from '../config.js';
 import { keysForDoor, keysHome } from '../keysfile.js';
-import { keyNameFor, modelChoiceFor, rowsForHome, chatModels, usableKey } from '../providerrows.js';
+import { endpointOf, judgePick, keyValueOf, rowsForHome, tickedLines } from '../providerrows.js';
+import { thinkingForLine } from '../thinking.js';
 import { apiKeyProblem, checkProviderReachable } from '../providers.js';
 
 /** @returns {string} a fresh per-process token — never persisted, never logged */
@@ -137,13 +138,13 @@ export function createAuthorRoutes(opts) {
     if (pathname === '/api/author/model-check') {
       if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
       const q = new URL(/** @type {string} */ (req.url), 'http://127.0.0.1').searchParams;
-      const modelId = q.get('model') ?? '';
-      const rows = rowsForHome(keysHome(opts.home));
-      const choice = modelChoiceFor(rows, modelId);
-      if (!choice) { send(400, { ok: false, error: `unknown model "${modelId}"` }); return true; }
-      // the key of the Settings row this Name belongs to
-      const keyName = keyNameFor(choice.provider, choice.baseUrl, rows, choice.name).name;
-      const raw = envNow()[keyName];
+      const rows = rowsForHome(keysHome(opts.home), envNow());
+      const pick = judgePick(rows, { provider: q.get('provider'), model: q.get('model') });
+      if (!pick.ok) { send(400, { ok: false, error: pick.say }); return true; }
+      const choice = pick.choice;
+      // the key of the Settings row this line belongs to
+      const keyName = choice.envName;
+      const raw = keyValueOf(envNow(), keyName);
       const problem = raw ? apiKeyProblem(raw) : null;
       const keyStatus = !raw ? 'missing' : (problem ? 'bad-shape' : 'found');
       if (keyStatus !== 'found') {
@@ -157,7 +158,7 @@ export function createAuthorRoutes(opts) {
       // `checkProviderReachable`'s own doc) — a short timeout so a flaky
       // endpoint never hangs the card.
       checkProviderReachable({
-        providerName: choice.provider, apiKey: /** @type {string} */ (usableKey(raw)), model: choice.name,
+        providerName: choice.provider, apiKey: /** @type {string} */ (raw), model: choice.name,
         baseUrl: choice.baseUrl, fetchImpl, timeoutMs: 4000,
       }).then((r) => {
         send(200, {
@@ -180,7 +181,11 @@ export function createAuthorRoutes(opts) {
     // ── P4b: Chat's Model menu IS the Settings rows (a blank Name is not offered). ──
     if (pathname === '/api/author/models') {
       if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
-      send(200, { ok: true, models: chatModels(rowsForHome(keysHome(opts.home))) });
+      // every ticked-and-priced line of a row, labelled `<KEY> · <model>`; `thinking` is the server's answer for the "Thinking on" box
+      const lines = tickedLines(rowsForHome(keysHome(opts.home), envNow())).map(({ row, line }) => ({
+        slot: row.envName, model: line.model, label: `${row.envName} · ${line.model}`, shape: row.provider, endpoint: endpointOf(row.provider, row.baseUrl), thinking: thinkingForLine(row.provider, line.model, row.baseUrl),
+      }));
+      send(200, { ok: true, lines, say: lines.length === 0 ? 'Tick a model in Settings > Providers.' : '' });
       return true;
     }
 
@@ -207,14 +212,14 @@ export function createAuthorRoutes(opts) {
       const sp = new URL(/** @type {string} */ (req.url), 'http://127.0.0.1').searchParams;
       const runid = sp.get('runid') ?? '';
       // `model` = the card's Model box right now: the estimate line counts only runs on that worker
-      const asModel = sp.has('model') ? { model: sp.get('model') ?? '' } : {};
+      const asModel = sp.has('model') ? { model: sp.get('model') ?? '', provider: sp.get('provider') ?? '' } : {};
       const pre = sp.has('import') ? opts.startFrom.getImport(sp.get('import') ?? '', asModel) : opts.startFrom.get(runid, asModel);
       if (pre === null) { send(404, { ok: false, error: 'no such run' }); return true; }
       if (!pre.ok) { send(409, pre); return true; }
       send(200, {
         ok: true, origin: pre.origin, card: pre.card, from: pre.from, note: pre.note,
         locked: pre.locked, open: pre.open, specHash: pre.specHash, workflowKey: pre.workflowKey, trackRecord: pre.trackRecord,
-        line: pre.line,
+        line: pre.line, specNamesModel: pre.specNamesModel, specWorker: pre.specWorker,
       });
       return true;
     }
@@ -225,7 +230,7 @@ export function createAuthorRoutes(opts) {
       if (!opts.startFrom || !opts.startFrom.listJobs) { send(404, { ok: false, error: 'not found' }); return true; }
       if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
       const sp = new URL(/** @type {string} */ (req.url), 'http://127.0.0.1').searchParams;
-      const asModel = sp.has('model') ? { model: sp.get('model') ?? '' } : {};
+      const asModel = sp.has('model') ? { model: sp.get('model') ?? '', provider: sp.get('provider') ?? '' } : {};
       send(200, { ok: true, jobs: opts.startFrom.listJobs(asModel) });
       return true;
     }
@@ -243,7 +248,7 @@ export function createAuthorRoutes(opts) {
       if (req.method !== 'POST') { send(405, { ok: false, error: 'POST only' }); return true; }
       if (hasLiveSession()) { send(409, { ok: false, error: 'an authoring session is already live — one at a time' }); return true; }
       const card = body ?? {};
-      const rows = rowsForHome(keysHome(opts.home));
+      const rows = rowsForHome(keysHome(opts.home), envNow());
       // Reuse workflow — started from a green run or an imported job: only Source, Destination and the two caps may
       // differ from the signed workflow. The SERVER refuses any other change (the page greys those boxes, but is
       // never trusted); the spec it signs is a copy of the origin's with just those four set. Nothing is drafted.