bareloop 0.40.0 → 0.42.0

package/src/authorrun.js

@@ -101,7 +101,7 @@
 //                  in; a draft missing one, or naming one the provider factory
 //                  does not know, dies here loud, listing the known table.
 import { keysForDoor } from './keysfile.js';
-import { applyConfiguredKey, judgeRatesFor, keyNameFor, ratesFor, rowsForHome } from './providerrows.js';
+import { judgeRatesFor, judgeRowFor, keyNameFor, keyValueOf, ratesFor, ratesOfLine, resolveWorker, rowsForHome } from './providerrows.js';
 import { ConfigError } from './config.js';
 import {
   readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, statSync,
@@ -120,11 +120,13 @@ import { defaultJudgeLoop, resolveJobJudge } from './judged.js';
 import { validateJob, jobSpecHash, resolveWorkerModel } from './job.js';
 import { scanSecrets, redactSecrets } from './validate.js';
 import { detectLanguage } from './detectlang.js';
+import { RUBRIC_LANG } from './authoring.js';
+import { rubricGoal } from './rubricstep.js';
 import { moveFile } from './movefile.js';
 import { closeJudges, GATE_AUDIT_FILE } from './kinds.js';
 import { resolveProvider, buildRunnerProviders, apiKeyProblem } from './providers.js';
 import { commandFor } from './invoke.js';
-import { readSourceManifest, missingDependencies, nonRepoSourceMessage } from './source.js';
+import { readSourceManifest, missingDependencies, nonRepoSourceMessage, isRubricFilesManifest } from './source.js';
 import { tallyCalls } from './text.js';
 import {
   declarationLines, rubricLines, calibrationLines, parseCeiling, ceilingLine, crashRecord, phaseLine,
@@ -327,6 +329,9 @@ export async function main(argv, deps = {}) {
   // folder has no genre to detect) and the branch further down that decides
   // which of the two paths this run actually takes.
   const IS_REPO_SOURCE = manifestRead.manifest.kind === 'repo';
+  // PART 1a: a soft-green job whose source froze the person's own local FILES (`proveRubricInputs` left `inputs` in the
+  // manifest) is NOT the plain-folder stop below: it is authored against the hidden tree with the text genre, no scout.
+  const RUBRIC_FILES = !IS_REPO_SOURCE && VERDICT === 'soft-green' && isRubricFilesManifest(manifestRead.manifest);
 
   // ── LANGUAGE, DETECTED — never asked (PRD item 33 M3, ruling 3) ──────────────
   // $0, no provider, run BEFORE the API key is even read — this script must
@@ -361,7 +366,7 @@ export async function main(argv, deps = {}) {
   // the language pick (the old repo-only "worse than before" ask is retired
   // entirely as of 2026-09-28 — see src/authorflow.js's own retirement note).
   let langResult = /** @type {ReturnType<typeof detectLanguage>|null} */ (null);
-  let LANG = 'none-detected';
+  let LANG = RUBRIC_FILES ? RUBRIC_LANG : 'none-detected';
   if (IS_REPO_SOURCE) {
     langResult = detectLanguage(SOURCE);
     // AMBIGUOUS NO LONGER DIES (PRD item 33 M3 piece 4, step S4): the confirm
@@ -466,13 +471,15 @@ export async function main(argv, deps = {}) {
     try { return resolveProvider(draft?.provider); } catch (e) { return die(/** @type {Error} */ (e).message); }
   })();
   const PROVIDER_NAME = /** @type {string} */ (draft.provider);
-  // The same tier run-u drafts and works on. The declaration is authored by a
-  // model, so the floor is the drafter floor (PRD v1.36: sonnet MINIMUM).
-  const MODEL = /** @type {NonNullable<typeof providerEntry>} */ (providerEntry).tiers.sonnet;
-  // spec.baseUrl (PRD item 28, ruling (d)) — the same forwarding rule run-u
-  // applies: forwarded only when the draft names one, every provider
-  // constructor defaults it on its own when absent.
-  const baseUrl = typeof draft?.baseUrl === 'string' ? draft.baseUrl : undefined;
+  // The Settings LINE this authoring run works on (P8): the draft's own `model` on a ticked, priced line of a key row on the
+  // draft's API shape (and Base URL, when it names one). The row is the key, the Base URL and the old-max_tokens tick. Nothing is
+  // built in: a draft naming no model, or a model no row ticks, stops here at $0.
+  const keyCfg = rowsForHome(keys.home, env);
+  const W = resolveWorker(keyCfg, draft);
+  if (!W.ok) { err(W.say.includes('Nothing was spent') ? W.say : `${W.say} Nothing was spent.`); throw new ExitSignal(2); }
+  const MODEL = W.model;
+  const baseUrl = W.baseUrl;
+  const AUTHOR_ROW = W.row;
 
   // THE JUDGE THIS RUN'S OWN WORKER RESOLVES TO (PRD item 32.1) — resolved ONCE,
   // here, from the DRAFT, and reused for BOTH the compose-time stamp (the
@@ -508,12 +515,9 @@ export async function main(argv, deps = {}) {
 
   // Secrets load from the environment; they never enter argv (a command line is
   // world-readable on /proc) and they are never printed.
-  // P4a item 4 — the key variable the person picked in Settings (config.json) stands in for
-  // the provider's built-in one; none picked = the built-in. Names only.
-  const keyCfg = rowsForHome(keys.home);
-  const authorEnv = applyConfiguredKey(env, PROVIDER_NAME, baseUrl, keyCfg);
-  const AUTHOR_ENV_KEY = keyNameFor(PROVIDER_NAME, baseUrl, keyCfg).name;
-  const apiKey = authorEnv[/** @type {NonNullable<typeof providerEntry>} */ (providerEntry).envKey];
+  // The key is the chosen row's own variable (P8: no built-in name). Names only.
+  const AUTHOR_ENV_KEY = AUTHOR_ROW.envName;
+  const apiKey = keyValueOf(env, AUTHOR_ENV_KEY);
   if (!apiKey) { err(`${AUTHOR_ENV_KEY} not set (secrets load from the environment — never the tree, never argv)`); throw new ExitSignal(2); }
   // F181 — a key that carries a line break/control char/stray whitespace (a
   // two-line secret-store entry, e.g.) reads as "set" by the presence check
@@ -527,17 +531,17 @@ export async function main(argv, deps = {}) {
   // loop, confirm turn, calibration judge). A bad price refuses here; it never falls back to the guess.
   /** @type {ReturnType<typeof ratesFor>} */
   let authorPrice = null;
-  try { authorPrice = ratesFor(PROVIDER_NAME, baseUrl, keyCfg); } catch (e) {
-    if (!(e instanceof ConfigError)) throw e;
-    err(`${e.message} — refusing to start rather than guess a price. Nothing spent.`);
-    throw new ExitSignal(2);
+  {
+    const al = ratesOfLine(W.line);
+    authorPrice = al ? { ...al, envName: AUTHOR_ROW.envName } : null;
   }
   /** The judge's key follows the RESOLVED judge provider's own env var, with
    * `JUDGE_API_KEY` as the role-named override in front (PRD item 32.3) — the same
    * contract `scripts/run-u.mjs` keeps, so one story covers both surfaces. When the
    * judge IS the authoring provider this is the key already read above. */
+  const judgeRowOf = (/** @type {{provider: string, model?: string|null}} */ j) => judgeRowFor(keyCfg, j, PROVIDER_NAME, AUTHOR_ROW);
   const judgeKeyFor = (/** @type {string} */ providerName) => (
-    env.JUDGE_API_KEY ?? (providerName === PROVIDER_NAME ? authorEnv : applyConfiguredKey(env, providerName, undefined, keyCfg))[resolveProvider(providerName).envKey]
+    env.JUDGE_API_KEY ?? (providerName === PROVIDER_NAME ? apiKey : keyValueOf(env, judgeRowFor(keyCfg, { provider: providerName }, PROVIDER_NAME, AUTHOR_ROW)?.envName))
   );
 
   /** F6 — an unpriced call makes the TOTAL unknown, and unknown is reported as
@@ -579,7 +583,7 @@ export async function main(argv, deps = {}) {
   // one) — the real judge identity is not resolved until after `validateJob`,
   // further down, where a second call takes only its `.judgeProvider`.
   const { provider } = buildRunnerProviders({
-    providerName: PROVIDER_NAME, apiKey, model: MODEL, tierModels: providerEntry.tiers, baseUrl,
+    providerName: PROVIDER_NAME, apiKey, model: MODEL, baseUrl, legacyMaxTokens: AUTHOR_ROW.legacyMaxTokens,
     judgeApiKey: apiKey, judgeModel: MODEL, judgeProviderName: PROVIDER_NAME, judgeBaseUrl: baseUrl,
   });
   emit('author-start', { runid, source: SOURCE, lang: LANG, verdictType: VERDICT, provider: PROVIDER_NAME, model: MODEL, baseUrl: baseUrl ?? null, job: draft?.job ?? null, timeoutMs: TIMEOUT_MS, ceilingUsd: CEILING_USD });
@@ -835,7 +839,7 @@ export async function main(argv, deps = {}) {
   // build can close. The stop fires HERE, immediately, at $0, no scout, no
   // confirm turn, no model call — a plain folder's spine is exactly
   // `author-start` → `author-end{outcome:'not-authored', stop:'non-code-source'}`.
-  if (!IS_REPO_SOURCE) {
+  if (!IS_REPO_SOURCE && !RUBRIC_FILES) {
     const message = nonRepoSourceMessage(manifestRead.manifest.kind);
     out(`\n${message}`);
     const red = {
@@ -897,7 +901,7 @@ export async function main(argv, deps = {}) {
       // so every path that reaches this call is a repo job. `langResult`
       // travels through unchanged — its `ambiguous` shape is what the confirm
       // turn's own $0 half (D7) asks about, before the scout.
-      ask, confirmGenerate, isRepo: true, langResult,
+      ask, confirmGenerate, isRepo: !RUBRIC_FILES, langResult,
     });
     const authoredFile = writeOut('authored.json', authored);
     emit('authored', { ok: authored.ok, stop: authored.stop, seedRef: authored.seedRef, cost: authored.cost, reds: authored.reds });
@@ -1009,7 +1013,11 @@ export async function main(argv, deps = {}) {
       // predates the confirm turn's own `ask` wiring (`authored.confirmed` is
       // `null` for every caller that runs no confirm turn) — the draft's own
       // goal (if any) then stands untouched.
-      if (authored.confirmed?.goal) {
+      if (RUBRIC_FILES && Array.isArray(draft.jobLines) && draft.jobLines.length > 0) {
+        // PART 1a: the worker's goal for a rubric job on files is written by code from the person's own numbered lines and the
+        // frozen input files the manifest recorded (src/rubricstep.js); the confirmed goal sentence rides as the plan line
+        draft.goal = redactSecrets(rubricGoal({ jobLines: draft.jobLines, files: manifestRead.manifest?.inputs ?? [], confirmedGoal: authored.confirmed?.goal ?? null, closeDecl: authored.closeDecl }));
+      } else if (authored.confirmed?.goal) {
         draft.goal = redactSecrets(String(authored.confirmed.goal));
       }
       // ── 2. the operator's half + the authored half → one spec ──────────────────
@@ -1115,7 +1123,7 @@ export async function main(argv, deps = {}) {
           const judgeKeyValue = judgeKeyFor(judge.provider);
           const judgeKeyProblem = judgeKeyValue ? apiKeyProblem(judgeKeyValue) : null;
           if (judgeKeyProblem) {
-            const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : resolveProvider(judge.provider).envKey;
+            const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : (judgeRowOf(judge)?.envName ?? judge.provider);
             err(`${judgeEnvName} ${judgeKeyProblem} — refusing rather than crashing mid-call (never trimmed or repaired; fix the value at its source)`);
             // F186 — the scout above already ran and may have left its own gate
             // audit in the tree. Under `process.exit()` this path used to skip
@@ -1149,9 +1157,10 @@ export async function main(argv, deps = {}) {
         let judgeProvider = null;
         if (judge) {
           judgeProvider = buildRunnerProviders({
-            providerName: PROVIDER_NAME, apiKey, model: MODEL, tierModels: providerEntry.tiers, baseUrl,
+            providerName: PROVIDER_NAME, apiKey, model: MODEL, baseUrl, legacyMaxTokens: AUTHOR_ROW.legacyMaxTokens,
             judgeApiKey: judgeKeyFor(judge.provider), judgeModel: judge.model, judgeProviderName: judge.provider,
-            judgeBaseUrl: judge.provider === PROVIDER_NAME ? baseUrl : undefined,
+            judgeBaseUrl: judge.provider === PROVIDER_NAME ? baseUrl : (judgeRowOf(judge)?.baseUrl.trim() || undefined),
+            judgeLegacyMaxTokens: judge.provider === PROVIDER_NAME ? AUTHOR_ROW.legacyMaxTokens : (judgeRowOf(judge)?.legacyMaxTokens ?? false),
           }).judgeProvider;
         }
         if (judge) {
@@ -1170,7 +1179,7 @@ export async function main(argv, deps = {}) {
           // number would silently widen it.
           ceilingUsd: CEILING_USD,
           priorCalls: [...metered],
-          judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgePrice?.rates ?? null }) : null,
+          judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgePrice?.rates ?? null, thinking: spec.thinking === true }) : null,
           // the seam's other half (PRD item 32.1): the graded set is STAMPED with
           // this, and the close later refuses to grade under any other identity.
           judgeModel: judge?.model ?? null,
@@ -1297,7 +1306,7 @@ export async function main(argv, deps = {}) {
               + 'and run-u will enforce the remainder (Cap $ minus this) as ITS ceiling — pass --draft-spent-usd exactly as shown below, never a rounded or re-typed figure.');
           }
           out('\nTo run it (the same signature and gates as any other job — nothing here bypasses them):');
-          out(`  ${keyNameFor(PROVIDER_NAME, baseUrl, keyCfg, spec.model).name}=... ${commandFor('run-u', deps.invokedAs)} --spec ${specFile} --approve ${hash}${draftSpentUsd > 0 ? ` --draft-spent-usd ${draftSpentUsd}${draftIncomplete ? ' --draft-spend-incomplete' : ''}` : ''}`);
+          out(`  ${AUTHOR_ENV_KEY}=... ${commandFor('run-u', deps.invokedAs)} --spec ${specFile} --approve ${hash}${draftSpentUsd > 0 ? ` --draft-spent-usd ${draftSpentUsd}${draftIncomplete ? ' --draft-spend-incomplete' : ''}` : ''}`);
           emit('author-end', { outcome: 'prepared', specHash: hash });
         }
       }

package/src/authorscout.js

@@ -56,6 +56,7 @@ import { TOOL_BY_VERB, CTX_TOOLS, createCtxTools, toolAction, strategyFor } from
 import { redactSecrets, SECRET_PATTERNS } from './validate.js';
 import { extractArtifact, priceOf, scrubRaw, stampRaw, tallyCalls, capStop, callCasualty } from './text.js';
 import { PROVIDER_TIMEOUT_MS } from './clock.js';
+import { lookReadTools, lookReportSchema, lookPrompt, verifyLookReport, labelListsOf, LOOK_REPORT_TOOL } from './inputlook.js';
 
 const require = createRequire(import.meta.url);
 const { Loop, wireGate } = require('bare-agent');
@@ -375,7 +376,7 @@ const defaultLoop = (/** @type {any} */ { system, policy, onLlmResult, provider,
  * @param {{workdir: string, provider?: any,
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
  *   attempts?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingApplied?: boolean|null}) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void,
  *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any, rates?: {in: number, out: number}}) => any,
  *   rates?: {in: number, out: number}|null, callOptions?: Record<string, any>,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
@@ -400,7 +401,7 @@ export async function runAuthorScout({
   onCall = () => {},
   createLoop = defaultLoop,
   rates = null,
-  // the drafter's per-call model options (`draftCallOptions`, src/providers.js; e.g. thinking off) — {} = nothing extra, byte-identical
+  // the drafter's per-call model options (`thinkingCallOptions`, src/thinking.js; e.g. thinking off) — {} = nothing extra, byte-identical
   callOptions = {},
   createSurveyor = defaultSurveyor,
 }) {
@@ -436,8 +437,8 @@ export async function runAuthorScout({
     // metered without the report going out: exactly the pairing invariant the
     // raw already rides. It REPORTS and decides nothing; the ceiling still binds
     // through `capStop` between calls, untouched.
-    // bare-agent's per-run `thinkingApplied` rides the reporting seam only, never the stored entry (see makeCostBook.add)
-    onCall({ ...call, ...(r?.thinkingApplied === undefined ? {} : { thinkingApplied: r.thinkingApplied }) });
+    // bare-agent's per-run `thinkingStatus` rides the reporting seam only, never the stored entry (see makeCostBook.add)
+    onCall({ ...call, ...(r?.thinkingStatus === undefined ? {} : { thinkingStatus: r.thinkingStatus }) });
     return raws.push(scrubRaw({ label, attempt, text: r?.text })) - 1;
   };
   // TIGHTEN-ONLY: an operator may lower the ceiling, never raise it. A garbage
@@ -656,6 +657,113 @@ export async function runAuthorScout({
   }
 }
 
+// ── THE LOOK AT A RUBRIC JOB'S INPUTS (PART 1c, docs/product/ITEM33-BUILD.md "3. The look") ─────────────────────────────────────
+//
+// The same pattern as the repo survey above, aimed at the person's own input text instead of a repository: a FIXED read-only grant
+// (search the input, read a slice around a hit - closures over in-memory text, so there is nothing to fence), a hard round bound, a
+// reserved final round whose ONLY tool is the answer form (no more looking), the spend metered per call into the same `calls` the
+// drafting book absorbs, and the answer through a strict tool call (never free prose with JSON inside). The result is shaped like a
+// survey (`state`, `facts`, `calls`, `raws`, `budgetStop`) so the drafting pipeline absorbs it exactly as it absorbs the repo scout.
+
+/** the look's hard round bound */
+export const LOOK_ROUNDS = AUTHOR_SCOUT_ROUNDS;
+
+export const LOOK_SYSTEM = 'You are a careful analyst setting up a checkable job. You are given the person\'s job and the text of their inputs. '
+  + 'You can only search and read that text - you cannot write, run anything or change anything. You have a hard, small number of turns. '
+  + 'Your single deliverable is a report of which facts the job asks for can be CHECKED in the input, with the label that sits right before each value (picked from the list you are shown), and what you could not find. '
+  + 'You do not judge whether a result is good and you do not decide what is done with the job.';
+
+export const LOOK_RECOVERY_PROMPT = 'You are out of looking turns. Report NOW, from what you have already read: call the report tool once with everything you can check and everything you could not find.';
+
+/**
+ * Run the look. `createLoop` is the same seam the repo scout has; nothing else here needs a live process.
+ * @param {{texts: Record<string, string>, inputs: {n: number, label: string}[], jobLines: {n: number, text: string, rule?: string, rules?: string[]}[],
+ *   provider?: any, rounds?: number, maxTokens?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void,
+ *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any, rates?: {in: number, out: number}}) => any,
+ *   rates?: {in: number, out: number}|null, callOptions?: Record<string, any>,
+ *   prove?: (source: string, phrase: string) => number}} o
+ * @returns {Promise<{state: 'PRESENT'|'ABSENT', facts: any, reason: string|null, cause: string|null, meta: any, raw: string,
+ *   raws: ReturnType<typeof scrubRaw>[], calls: {label: string, costUsd: number|null, unpricedRounds: number}[],
+ *   budgetStop: 'cap-halt'|'pricing-red'|null}>}
+ */
+export async function runInputLook({
+  texts, inputs, jobLines, provider = null, rounds = LOOK_ROUNDS, maxTokens = AUTHOR_SCOUT_MAX_TOKENS, ceilingUsd = null,
+  callTimeoutMs = AUTHOR_CALL_TIMEOUT_MS, onCall = () => {}, createLoop = defaultLoop, rates = null, callOptions = {}, prove,
+}) {
+  const callTimeout = Number.isFinite(Number(callTimeoutMs)) && Number(callTimeoutMs) > 0
+    ? Math.min(Math.trunc(Number(callTimeoutMs)), AUTHOR_CALL_TIMEOUT_MS) : AUTHOR_CALL_TIMEOUT_MS;
+  const priced = rates ? { rates } : {};
+  /** @type {{label: string, costUsd: number|null, unpricedRounds: number}[]} */
+  const calls = [];
+  /** @type {ReturnType<typeof scrubRaw>[]} */
+  const raws = [];
+  const record = (/** @type {string} */ label, /** @type {any} */ r) => {
+    const call = { label, ...priceOf(r) };
+    calls.push(call);
+    onCall({ ...call, ...(r?.thinkingStatus === undefined ? {} : { thinkingStatus: r.thinkingStatus }) });
+    raws.push(scrubRaw({ label, attempt: 1, text: r?.text }));
+  };
+  const settled = async (/** @type {Promise<any>} */ p) => {
+    try { return await p; } catch (e) {
+      const reason = callCasualty(e);
+      if (reason === null) throw e;
+      return { error: reason };
+    }
+  };
+  const { scans, lists } = labelListsOf(texts);
+  /** @type {{calls: any[]}} */
+  const box = { calls: [] };
+  /** @type {any} */
+  let loop = null;
+  const reportTool = {
+    name: LOOK_REPORT_TOOL,
+    description: 'Deliver the report. Call this exactly once, with the whole report as its arguments.',
+    parameters: lookReportSchema(),
+    execute: async (/** @type {any} */ args) => { box.calls.push(args); if (loop) loop.stop(); return 'received'; },
+  };
+  const tools = [...lookReadTools(texts), reportTool];
+  const absent = (/** @type {string} */ reason, /** @type {string} */ cause, /** @type {'cap-halt'|'pricing-red'|null} */ budgetStop = null) => ({
+    state: /** @type {'ABSENT'} */ ('ABSENT'), facts: null, reason, cause, meta: { rounds: seen, bounded }, raw: '', raws, calls, budgetStop,
+  });
+  let seen = 0;
+  let bounded = false;
+  const halt0 = capStop({ ceilingUsd, ...tallyCalls(calls) });
+  if (halt0) return absent(`the look was never asked for: the $${ceilingUsd} ceiling was already spent`, SURVEY_CAUSES.NOT_FUNDED, halt0);
+
+  const metered = async (/** @type {any} */ arg) => {
+    if ((arg?.kind ?? 'turn') === 'turn') {
+      seen += 1;
+      if (seen >= rounds) { bounded = true; loop.stop(); }
+    }
+  };
+  loop = createLoop({ system: LOOK_SYSTEM, policy: undefined, onLlmResult: metered, provider, ...priced });
+  const r = await settled(loop.run([{ role: 'user', content: lookPrompt({ jobLines, labels: Object.keys(texts), lists }) }], tools,
+    { cacheMessages: true, maxTokens, timeoutMs: callTimeout, ...callOptions }));
+  record('input-look', r);
+  /** @type {any} */
+  let last = r;
+  if (box.calls.length === 0 && !r?.error) {
+    // THE RESERVED FINAL ROUND: no more looking - the only tool is the answer form
+    const halt = capStop({ ceilingUsd, ...tallyCalls(calls) });
+    if (halt) return absent(`the look stopped on the cost ceiling before it reported: ${halt}`, SURVEY_CAUSES.NOT_FUNDED, halt);
+    const recovery = createLoop({ system: LOOK_SYSTEM, policy: undefined, onLlmResult: undefined, provider, ...priced });
+    const rMsgs = Array.isArray(r?.msgs) && r.msgs.length ? (r.msgs[0]?.role === 'system' ? r.msgs.slice(1) : r.msgs) : [];
+    const only = { ...reportTool, execute: async (/** @type {any} */ args) => { box.calls.push(args); recovery.stop(); return 'received'; } };
+    last = await settled(recovery.run([...rMsgs, { role: 'user', content: LOOK_RECOVERY_PROMPT }], [only],
+      { cacheMessages: true, maxTokens, timeoutMs: callTimeout, ...callOptions }));
+    record('input-look-recovery', last);
+  }
+  if (box.calls.length === 0) {
+    return absent(last?.error ? `the look call failed: ${redactSecrets(String(last.error))}` : 'the look ended without a report', last?.error ? SURVEY_CAUSES.CALL_FAILED : SURVEY_CAUSES.EMPTY);
+  }
+  const report = verifyLookReport(box.calls[0], { scans, jobLines, ...(prove ? { prove } : {}) });
+  return {
+    state: 'PRESENT', reason: null, cause: null, meta: { rounds: seen, bounded }, raw: '', raws, calls, budgetStop: null,
+    facts: { rubricFiles: true, inputs: inputs.map((i) => ({ n: i.n, label: i.label })), look: report },
+  };
+}
+
 // ── L1: THE MECHANICAL SEED LISTING ──────────────────────────────────────────
 
 /** per-path full-listing cap; over it, names give way to counted directories */

package/src/bundle.js

@@ -459,13 +459,16 @@ export function exportBundle({ spec, closeScripts, registryDir, outDir, bareloop
     '',
     '## Running this bundle',
     '',
-    '  ./node_modules/.bin/bareloop run . --repo <path> [--budget N] [--wall MIN] [--approve <bundleHash>]',
+    '  ./node_modules/.bin/bareloop run . --repo <path> [--model <id>] [--budget N] [--wall MIN] [--approve <bundleHash>]',
     '',
     'Answer these, in the order `bareloop run` asks them:',
     '',
-    '1. Provider key — set ANTHROPIC_API_KEY in your environment (never on the',
-    '   command line, never in a file). Absent, `bareloop run` prints these',
-    '   questions and the bundleHash again, and spends nothing.',
+    "1. Provider key — put your provider's API key in your keys file (the NAME your",
+    '   Settings row uses), never on the command line. A bundle signed without a',
+    '   model needs `--model <id>` of a line ticked in Settings > Providers (with',
+    '   both prices), plus `--provider <KEY>` when two keys tick it. With neither,',
+    '   `bareloop run` prints these questions and the bundleHash again, and spends',
+    '   nothing.',
     `2. Approve — the FIRST run on this machine requires --approve ${hash}`,
     "   (this bundle's own signed hash, shown above) to prove a human read and",
     '   accepted it before anything runs. Once that first run GREENS, the',

package/src/bundlerun.js

@@ -204,13 +204,16 @@ export async function bundleMain(args, {
       workdir: worktree,
       seed,
       approve: approveHash,
+      // an exported bundle follows the run-u rule: a spec that names no model takes `--model <id>` (+ `--provider <KEY>` when two keys tick it)
+      ...(typeof flags.model === 'string' ? { model: flags.model } : {}),
+      ...(typeof flags.provider === 'string' ? { providerKey: flags.provider } : {}),
       deps: { ...deps, env, out, err, ...(keysHome === undefined ? {} : { keysHome }) },
       bundle: {
         runid,
         runDir,
         // the bare re-invocation prefix; the leg's OWN tightened ceilings (only those the person passed) ride as
         // DATA so the engine, which knows the halt kind and the spend, spells the printed line. Text only.
-        invoke: `bareloop run ${bundleDirArg} --repo ${repo}`,
+        invoke: `bareloop run ${bundleDirArg} --repo ${repo}${typeof flags.model === 'string' ? ` --model ${flags.model}` : ''}${typeof flags.provider === 'string' ? ` --provider ${flags.provider}` : ''}`,
         tightened: {
           ...(envelope.budgetUsd === undefined ? {} : { budgetUsd: envelope.budgetUsd }),
           ...(flags.wall === undefined ? {} : { wallMin: Number(flags.wall) }),

package/src/cli.js

@@ -7,7 +7,7 @@
 // run-u` drives (`src/userrun.js`): providers, keys (the keys file / env, any provider the
 // bundle's spec names), judge, monthly limit and readout are that engine's. The test seam is
 // the engine's too: `deps.provider` (and `providerFor`/`judgeProvider`) supplies a scripted
-// provider and skips the real-key check (same as `tests/planrun.test.js`'s pattern).
+// provider and skips the real-key check (same as `tests/planrun-*.test.js`'s pattern).
 //
 // Money/arbiter rules the bundle door keeps: `--budget`/`--wall` only TIGHTEN a bundle's
 // signed ceilings (`checkEnvelope`, M1); a bundle's `bundleHash` (the human-facing

package/src/config.js

@@ -1,17 +1,22 @@
-// PANEL-BUILD.md P4a item 2 — the ONE reader/writer of `~/.config/bareloop/config.json`.
+// rewritten-from: fwdloop src/config.js@f9449e8 (validators `modelsProblem`, `providerFieldProblem`, `cleanBaseUrl`)
+// PANEL-BUILD.md P4a item 2 / P8 — the ONE reader/writer of `~/.config/bareloop/config.json`.
 //
-// Every panel/CLI setting lives in this one file (R5): the monthly $ limit, the
-// Anthropic balance note, and the Providers rows' Name / API shape / Base URL, per key variable.
+// Every panel/CLI setting lives in this one file (R5): the monthly $ limit and the Providers
+// rows' API shape / Base URL / old-max_tokens tick (`keys`) and each row's model lines (`models`).
 // Key VALUES never live here — they live in the keys file (`src/keysfile.js`) and the
 // shell env. The write path refuses a document that carries a secret-shaped string
 // (the ONE inventory: `sweepSecretLiterals`, src/validate.js).
 //
 // Shape (unknown fields are kept, never dropped):
-//   { "monthlyLimitUsd": <number>,          // absent = no limit, no check
-//     "anthropicBalanceNote": <number>,     // a typed note; no check ever reads it
-//     "keys": { "<ENV NAME>": { "name": "<model id>", "shape": "<api shape>", "baseUrl": "<url or blank>" } } }
+//   { "monthlyLimitUsd": <number > 0>,          // absent = no limit, no check
+//     "keys":   { "<ENV NAME>": { "shape": "<shape id>", "baseUrl": "http(s)://…", "legacyMaxTokens": true|false } },
+//     "models": { "<ENV NAME>": [ { "model": "<id>", "use": true|false, "inPerM": n, "outPerM": n } ] } }
+// An older file's `keys.<ENV>.{name,priceInPerM,priceOutPerM}` is tolerated and read as ONE model
+// line (`effectiveModels`, src/providerrows.js); the first write of that row's `models` list removes them.
+// `modelsProblem` is the ONE rule for a row's model lines: a price is a PAIR or neither, a ticked
+// line needs both. Nothing here sniffs a host or a model id.
 //
-// A missing file = defaults. An UNREADABLE file is reported (`problem`), never
+// A missing file = defaults. An UNREADABLE or INVALID file is reported (`problem`), never
 // papered over — the monthly check REFUSES on it rather than silently running with
 // no limit. Written atomically (tmp + rename), mode 600.
 import {
@@ -20,6 +25,7 @@ import {
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { sweepSecretLiterals } from './validate.js';
+import { SHAPE_IDS } from './providershapes.js';
 
 /** A plain-words config failure (bad value, secret-shaped string, unreadable file). */
 export class ConfigError extends Error {}
@@ -55,22 +61,106 @@ export function readConfig(opts = {}) {
   if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
     return { config: {}, exists: true, problem: `${file} must hold a JSON object — fix or remove it` };
   }
+  const bad = docProblem(parsed);
+  if (bad) return { config: {}, exists: true, problem: `${file}: ${bad} — fix or remove it` };
   return { config: parsed, exists: true, problem: null };
 }
 
 const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
-/** the API shapes a keys row may name (the `src/providers.js` table names) */
-const SHAPE_IDS = ['anthropic-api', 'openai-api', 'gemini-api'];
+
+/** The fields of a key row this module validates (others are kept untouched). */
+const KEY_FIELDS = Object.freeze(['shape', 'baseUrl', 'legacyMaxTokens']);
+
+/**
+ * One key-row field's value problem in plain words, or null when fine.
+ * @param {string} field `model` | `shape` | `baseUrl` | `legacyMaxTokens`
+ * @param {unknown} v
+ * @returns {string|null}
+ */
+export function providerFieldProblem(field, v) {
+  if (field === 'model') {
+    if (typeof v !== 'string' || v.length === 0 || v.length > 200 || /\s/.test(v)) return 'must be a model id: 1 to 200 characters, no spaces';
+  } else if (field === 'shape') {
+    if (typeof v !== 'string' || !SHAPE_IDS.includes(v)) return `must be one of ${SHAPE_IDS.join(', ')}`;
+  } else if (field === 'legacyMaxTokens') {
+    if (typeof v !== 'boolean') return 'must be true or false';
+  } else if (field === 'baseUrl') {
+    if (typeof v !== 'string' || !(v === '' || /^https?:\/\/\S+$/.test(v))) return 'must be empty or an http(s) address';
+  } else return 'is not a provider field';
+  return null;
+}
+
+/** A Base URL as stored: trailing slashes dropped. @param {string} v @returns {string} */
+export const cleanBaseUrl = (v) => v.replace(/\/+$/, '');
+
+/**
+ * THE one rule for a row's model lines, used by config validation and the Settings routes. A price
+ * is a PAIR (`inPerM` and `outPerM`, each a finite number >= 0 — 0 / 0 typed is a chosen price) or
+ * neither (null / absent). A ticked line (`use`) needs both. Plain words, or null.
+ * @param {unknown} list
+ * @returns {string|null}
+ */
+export function modelsProblem(list) {
+  if (!Array.isArray(list)) return 'The model list must be a list of lines.';
+  const seen = new Set();
+  for (const line of list) {
+    if (line === null || typeof line !== 'object' || Array.isArray(line)) return 'Each model line must be an object.';
+    const l = /** @type {Record<string, any>} */ (line);
+    const bad = providerFieldProblem('model', l.model);
+    if (bad) return `The model name ${bad}.`;
+    if (seen.has(l.model)) return `The model "${l.model}" is listed twice.`;
+    seen.add(l.model);
+    if (typeof l.use !== 'boolean') return 'Use must be on or off.';
+    const has = (/** @type {string} */ f) => l[f] !== undefined && l[f] !== null;
+    const isNum = (/** @type {unknown} */ v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
+    if (has('inPerM') !== has('outPerM')) return 'Fill both price boxes or clear both.';
+    if (has('inPerM') && !(isNum(l.inPerM) && isNum(l.outPerM))) return 'A price must be a number, 0 or more.';
+    if (l.use && !has('inPerM')) return 'Fill both prices to tick this model.';
+    for (const k of Object.keys(l)) if (!['model', 'use', 'inPerM', 'outPerM'].includes(k)) return `A model line has no "${k}" field.`;
+  }
+  return null;
+}
+
+/**
+ * The first problem in a document's known fields, in plain words, or null.
+ * @param {Record<string, any>} doc
+ * @returns {string|null}
+ */
+function docProblem(doc) {
+  // monthlyLimitUsd is NOT judged here: `monthlyLimitOf` (src/monthly.js) owns its read-time sentence
+  if (doc.keys !== undefined) {
+    if (doc.keys === null || typeof doc.keys !== 'object' || Array.isArray(doc.keys)) return 'keys must be an object of key variable names';
+    for (const [env, row] of Object.entries(doc.keys)) {
+      if (!ENV_NAME_RE.test(env)) return `"${env}" is not a key variable name`;
+      if (row === null || typeof row !== 'object' || Array.isArray(row)) return `keys.${env} must be an object`;
+      for (const f of KEY_FIELDS) {
+        if (!Object.hasOwn(row, f)) continue;
+        const bad = providerFieldProblem(f, /** @type {Record<string, any>} */ (row)[f]);
+        if (bad) return `keys.${env}.${f} ${bad}`;
+      }
+    }
+  }
+  if (doc.models !== undefined) {
+    if (doc.models === null || typeof doc.models !== 'object' || Array.isArray(doc.models)) return 'models must be an object of key variable names';
+    for (const [env, list] of Object.entries(doc.models)) {
+      if (!ENV_NAME_RE.test(env)) return `models: "${env}" is not a key variable name`;
+      const bad = modelsProblem(list);
+      if (bad) return `models.${env}: ${bad}`;
+    }
+  }
+  return null;
+}
 
 /**
  * Apply a patch and write. `null` deletes a field. Top-level fields shallow-merge;
- * `keys` merges per key variable name, then per field. Validated before anything is
- * written; nothing is written on a refusal.
+ * `keys` merges per key variable name, then per field; `models.<ENV>` is REPLACED WHOLE (`null`
+ * clears it). Validated before anything is written; nothing is written on a refusal.
  *
- * Patch fields understood: `monthlyLimitUsd` (finite > 0), `anthropicBalanceNote`
- * (finite >= 0), `keys.<ENV NAME>.{name,shape,baseUrl}` (Name = a model id, shape = a provider table name, baseUrl = blank or http(s)). Any other
- * field is passed through untouched (kept), but the whole document is swept for
- * secret-shaped strings first.
+ * Patch fields understood: `monthlyLimitUsd` (finite > 0), `keys.<ENV>.{shape,baseUrl,legacyMaxTokens}`,
+ * `models.<ENV>` (a list judged by {@link modelsProblem}). The first write of a row's `models` list
+ * removes that row's older `name` / `priceInPerM` / `priceOutPerM` in the SAME write (never two
+ * sources); a retired top-level `anthropicBalanceNote` is dropped on any write. Any other field is
+ * kept, but the whole document is swept for secret-shaped strings first.
  * @param {Record<string, any>} patch
  * @param {{ home?: string }} [opts]
  * @returns {Record<string, any>} the document as written
@@ -81,16 +171,14 @@ export function updateConfig(patch, opts = {}) {
   /** @type {Record<string, any>} */
   const next = { ...cur.config };
   for (const [k, v] of Object.entries(patch)) {
-    if (k === 'keys') continue;
+    if (k === 'keys' || k === 'models') continue;
     if (v === null) { delete next[k]; continue; }
     if (k === 'monthlyLimitUsd' && !(typeof v === 'number' && Number.isFinite(v) && v > 0)) {
       throw new ConfigError('monthlyLimitUsd must be a number above 0 (remove the limit to have none)');
     }
-    if (k === 'anthropicBalanceNote' && !(typeof v === 'number' && Number.isFinite(v) && v >= 0)) {
-      throw new ConfigError('anthropicBalanceNote must be a number, 0 or more');
-    }
     next[k] = v;
   }
+  delete next.anthropicBalanceNote;
   if (patch.keys !== undefined) {
     if (patch.keys === null || typeof patch.keys !== 'object' || Array.isArray(patch.keys)) {
       throw new ConfigError('keys must be an object of key variable names');
@@ -104,21 +192,33 @@ export function updateConfig(patch, opts = {}) {
       const merged = { ...(keys[envName] && typeof keys[envName] === 'object' ? keys[envName] : {}) };
       for (const [fk, fv] of Object.entries(/** @type {Record<string, any>} */ (fields))) {
         if (fv === null) { delete merged[fk]; continue; }
-        if (fk === 'name' && !(typeof fv === 'string' && fv.length <= 100 && !/\s/.test(fv))) {
-          throw new ConfigError(`keys.${envName}.name must be a model id (no spaces, up to 100 characters)`);
-        }
-        if (fk === 'shape' && !SHAPE_IDS.includes(fv)) {
-          throw new ConfigError(`keys.${envName}.shape must be one of ${SHAPE_IDS.join(', ')}`);
-        }
-        if (fk === 'baseUrl' && !(typeof fv === 'string' && (fv === '' || /^https?:\/\/\S+$/.test(fv)))) {
-          throw new ConfigError(`keys.${envName}.baseUrl must be blank or an http(s) URL`);
-        }
-        merged[fk] = fv;
+        merged[fk] = fk === 'baseUrl' && typeof fv === 'string' ? cleanBaseUrl(fv) : fv;
       }
       keys[envName] = merged;
     }
     next.keys = keys;
   }
+  if (patch.models !== undefined) {
+    if (patch.models === null || typeof patch.models !== 'object' || Array.isArray(patch.models)) {
+      throw new ConfigError('models must be an object of key variable names');
+    }
+    /** @type {Record<string, any>} */
+    const models = { ...(next.models && typeof next.models === 'object' ? next.models : {}) };
+    for (const [envName, list] of Object.entries(patch.models)) {
+      if (!ENV_NAME_RE.test(envName)) throw new ConfigError(`"${envName}" is not a key variable name`);
+      if (list === null) { delete models[envName]; continue; }
+      models[envName] = list;
+      const row = next.keys?.[envName];
+      if (row && typeof row === 'object') {
+        // one source: the older single-model fields leave with the first saved list
+        const { name: _n, priceInPerM: _i, priceOutPerM: _o, ...rest } = row;
+        next.keys = { ...next.keys, [envName]: rest };
+      }
+    }
+    next.models = models;
+  }
+  const problem = docProblem(next);
+  if (problem) throw new ConfigError(problem);
   /** @type {string[]} */
   const secretPaths = [];
   sweepSecretLiterals(next, (_code, path) => { secretPaths.push(path); });