bareloop 0.9.0 → 0.11.0

package/src/validate.js

@@ -177,6 +177,69 @@ function unboundedQuantLen(src, i) {
   return len;
 }
 
+/** How many characters of `(`-prologue sit at `src[i]` before the group's BODY:
+ * 1 for a plain or capturing group, 3 for `(?:` `(?=` `(?!`, 4 for `(?<=` `(?<!`,
+ * and past the `>` of a named group `(?<name>`. The body is read back when the
+ * group closes, and a prologue counted as body text would make `(?:a|aa)` split
+ * as `?:a` / `aa` — no prefix relation, and the hazard read as safe.
+ * @param {string} src @param {number} i index of the `(` */
+function groupPrologueLen(src, i) {
+  if (src[i + 1] !== '?') return 1;
+  const c = src[i + 2];
+  if (c === ':' || c === '=' || c === '!') return 3;
+  if (c === '<') {
+    if (src[i + 3] === '=' || src[i + 3] === '!') return 4;   // lookbehind
+    const close = src.indexOf('>', i + 3);                    // named group
+    return close === -1 ? 3 : close - i + 1;
+  }
+  return 1;                                                    // modifier groups etc — read the lot as body (fail-safe)
+}
+
+/**
+ * Do a group body's TOP-LEVEL alternation branches overlap — is one a prefix of
+ * another, equality included? That is the practical detectable core of the
+ * overlapping-alternation blowup (`(a|aa)`, `(a|a)`, `(\d|\d\d)`, `(a|a?)`):
+ * two branches that can consume the same text give the engine two ways to reach
+ * the same position, and an unbounded repeat multiplies them.
+ *
+ * The comparison is over the branches' SOURCE TEXT, which is what makes it
+ * conservative rather than exact — `(ab|abc)+` carries the prefix relation and
+ * did not blow up on the body measured. Exactness needs the real regex engine
+ * F49 declined to take as a dependency, and guessing it wrong would ADMIT an
+ * exponential pattern, so the over-rejection stands as a named limit.
+ *
+ * Splitting respects escapes, character classes and nested groups: a `|` inside
+ * `[a|b]` or inside `(x|y)` is not this group's alternation, and treating it as
+ * one would invent branches nobody wrote.
+ * @param {string} body the text between a group's prologue and its `)`
+ * @returns {boolean}
+ */
+function altBranchesOverlap(body) {
+  /** @type {string[]} */
+  const branches = [];
+  let start = 0;
+  let depth = 0;
+  for (let i = 0; i < body.length; i++) {
+    const c = body[i];
+    if (c === '\\') { i++; continue; }
+    if (c === '[') { i++; if (body[i] === '^') i++; while (i < body.length && body[i] !== ']') { if (body[i] === '\\') i++; i++; } continue; }
+    if (c === '(') { depth++; continue; }
+    if (c === ')') { depth--; continue; }
+    if (c === '|' && depth === 0) { branches.push(body.slice(start, i)); start = i + 1; }
+  }
+  if (branches.length === 0) return false;                    // no top-level alternation at all
+  branches.push(body.slice(start));
+  for (let i = 0; i < branches.length; i++) {
+    for (let j = 0; j < branches.length; j++) {
+      // `startsWith` covers EQUALITY, which is the 2ⁿ case: `(a|a)+$` took 52.3s
+      // on a 27-character body. Skipping i===j is what keeps that from being
+      // every pattern's own reflexive match.
+      if (i !== j && branches[j].startsWith(branches[i])) return true;
+    }
+  }
+  return false;
+}
+
 /**
  * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
  * unbounded quantifier applied to a group whose body itself repeats unboundedly
@@ -201,16 +264,40 @@ function unboundedQuantLen(src, i) {
  * So the reject targets the dominant exponential class and fails it as a
  * mechanical gap at the validation gate, before any tokens burn. A full ReDoS
  * analyzer needs a real regex engine (an external native dep we do not take for
- * a LOW issue); exotic overlapping-alternation blowup is out of scope by
- * decision (PARKED to the close-authoring rung — PRD v1.55).
+ * a LOW issue).
+ *
+ * SECOND CLASS, added 2026-08-12 — OVERLAPPING ALTERNATION under an unbounded
+ * repeat (`(a|aa)+`, `(a|a)+`, `(\d|\d\d)*`). F49 recorded this as a genuine
+ * false NEGATIVE of the shape approach and PARKED the widening, because changing
+ * the detector changes which SIGNED specs are admissible. It is closed here on
+ * measurement, one fresh process per point (a hot RegExp tiers up out of the V8
+ * interpreter, and a single-process sweep read a LONGER body as faster —
+ * backwards for an exponential, and the harness rather than the regex).
+ * `(a|aa)+$` against a run of `a` with one non-matching tail character:
+ *
+ *     27ch 218ms · 31ch 1,879ms · 35ch 12,082ms · 39ch 52,563ms · 41ch 189,420ms
+ *
+ * ~6.8× per 4 characters — the Fibonacci decomposition count, φ⁴. `(a|a)+$` (the
+ * 2ⁿ equal-branch case) took 52,256ms on 27ch, and `((a|aa))+$` — the redundant
+ * wrapper the `((a+))+` entry above exists for — 15,426ms on 35ch, which is why
+ * the overlap propagates up through a wrapper exactly as the inner repeat does.
+ * Input-bounding is theater here for F49's own reason: tens of characters suffice.
+ *
+ * The detected core is the PREFIX RELATION between top-level branches (one branch
+ * a prefix of another, equality included — `(a|a)+` is the 2ⁿ case). Whether a
+ * given prefix overlap can actually be DRIVEN exponentially depends on what
+ * follows the group, and deciding that needs the real engine this file declined
+ * to take as a dependency — so the reject is conservative by construction, which
+ * is the fail-safe direction.
+ *
+ * MONOTONIC, and that is the rule this change lives under: it only ever ADDS
+ * rejections. Nothing above is narrowed, and no previously-rejected shape became
+ * admissible (asserted over the whole corpus in tests/plan.test.js). F49's
+ * "never sharpen the detector" bars chasing false POSITIVES; closing a false
+ * NEGATIVE by adding rejections is the opposite, allowed direction — distinct
+ * rules, not in tension (the `((a+))+` widening set the precedent).
  *
  * SCOPE IS ASYMMETRIC, both directions named on purpose:
- *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
- *     detected — there is no inner QUANTIFIER to find, so the shape scan cannot
- *     see it; the blowup comes from overlapping alternation BRANCHES under a
- *     repeat. A genuine limit of the approach, not a bug in it. Widening the
- *     detector changes which SIGNED specs are admissible, which is
- *     arbiter-adjacent — parked, not chased (PRD v1.55).
  *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
  *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
  *     though a real engine runs it linearly — the scan sees the nested-quantifier
@@ -221,13 +308,28 @@ function unboundedQuantLen(src, i) {
  *     and guessing it wrong would ADMIT an exponential pattern — so the shape
  *     reject stands, and the over-rejection is a named, accepted limitation.
  *
+ *     The alternation class has its OWN instance of the same limit, measured and
+ *     locked in `REDOS_OVERREJECTED_ALT`: `(ab|abc)+$`, `(x|xy|xyz)+$` and
+ *     `(x(a|aa))+$` carry the prefix relation and did NOT blow up on the bodies
+ *     measured (0.3–0.4ms at 41–91 characters). "Did not blow up on the body
+ *     measured" is the honest claim — no adversarial search was run for a worse
+ *     input — and rejecting them is again the direction that never admits an
+ *     exponential pattern.
+ *
  * The input is guaranteed to compile as a RegExp (checked first by the caller),
  * so this scan assumes valid, balanced JS regex syntax.
  * @param {string} src a compiled regex source string
- * @returns {boolean} true iff a nested unbounded quantifier is present
+ * @returns {boolean} true iff a nested unbounded quantifier, or an unboundedly
+ *   repeated group with overlapping alternation branches, is present
  */
 export function hasNestedQuantifier(src) {
-  /** @type {{ quant: boolean }[]} */
+  /** `quant`: the body repeats unboundedly. `alt`: the body (or a group beneath
+   * it) carries overlapping alternation branches. `at`: where the body starts,
+   * so the branches can be read back when the group closes. The two hazard flags
+   * are tracked separately and propagate separately — merging them would let a
+   * plain nested repeat be reported as an alternation overlap and vice versa,
+   * and the two are different rewrites for the author. */
+  /** @type {{ quant: boolean, alt: boolean, at: number }[]} */
   const stack = [];
   for (let i = 0; i < src.length; i++) {
     const c = src[i];
@@ -254,11 +356,19 @@ export function hasNestedQuantifier(src) {
       while (i < src.length && src[i] !== ']') { if (src[i] === '\\') i++; i++; }
       continue;
     }
-    if (c === '(') { stack.push({ quant: false }); continue; }
+    if (c === '(') { stack.push({ quant: false, alt: false, at: i + groupPrologueLen(src, i) }); continue; }
     if (c === ')') {
       const g = stack.pop();
       const qlen = unboundedQuantLen(src, i + 1);
       if (g && g.quant && qlen) return true;    // group repeats unboundedly AND its body did too
+      // …and the SECOND class: the body's own top-level branches overlap, so the
+      // engine has more than one way to consume the same text and an unbounded
+      // repeat multiplies those ways (MEASURED: `(a|aa)+$` 12.1s on a 35-char
+      // body). `g.alt` carries an overlap found in a group BENEATH this one, for
+      // the redundant-wrapper reason one comment down.
+      const overlap = !!g && (g.alt || altBranchesOverlap(src.slice(g.at, i)));
+      if (overlap && qlen) return true;
+      if (overlap && stack.length) stack[stack.length - 1].alt = true;
       // The group is an unbounded-repeated atom of its parent when it is directly
       // re-quantified (qlen) OR its own body already repeats unboundedly (g.quant):
       // a redundant wrapper — ((a+))+ , (?:(a+))* , (((\d*)))+ — is the SAME
@@ -276,3 +386,50 @@ export function hasNestedQuantifier(src) {
   }
   return false;
 }
+
+/**
+ * The catastrophic-backtracking reject, applied to a WHOLE signed document by
+ * tree walk — `sweepSecretLiterals`'s twin, and for its reason: some signed
+ * documents carry their regexes at a depth no per-field check enumerates.
+ *
+ * WHY IT EXISTS (PRD v1.60 §1, an OPEN GAP now closed). v1.55 took F49's reject
+ * to the operator's own regex fields, and the admissibility sweep that backed it
+ * walked `jobs/*.json`. That is not the population of signed specs: a REGISTRY
+ * BRIDGE is signed the same way, ships its plans VERBATIM (reuse stores the
+ * whole plan, never a template), and lives outside `jobs/`, so a pathological
+ * pattern arriving through a bridge was never swept. Nothing had decided
+ * bridge-borne patterns were safe — the sweep was written against the directory
+ * that held every spec at the time and was never re-aimed.
+ *
+ * WHAT is rejected is UNCHANGED: `hasNestedQuantifier`, one inventory, shared
+ * with job.js and plan.js. Only WHERE it looks is wider. Widening the DETECTOR
+ * is arbiter-adjacent and stays parked (F49); widening the POPULATION is this.
+ *
+ * KEY-SCOPED, deliberately. `pattern` and `gapKeep` are the exactly-three regex
+ * fields F49 names (`artifact-written.pattern`, `judged.pattern`, `gapKeep`);
+ * every other string in a signed document is prose, a path or a command, and
+ * running a regex-shape scan over prose would red goals for containing `(a+)+`
+ * in a sentence. A field carrying a regex under a NEW key is not swept until
+ * this list names it — stated so the limit is read rather than rediscovered.
+ *
+ * COMPILE-FIRST, like both per-field callers: the scan's contract is that its
+ * input is valid regex syntax, and a string that does not compile is the OTHER
+ * validator's red. Two reds on one string bury the real one.
+ * @param {any} root
+ * @param {(code: string, path: string, detail?: string) => void} red
+ */
+export function sweepNestedQuantifiers(root, red) {
+  (/** @type {(node: any, at: string, key: string) => void} */
+  function sweep(node, at, key) {
+    if (typeof node === 'string') {
+      if (key !== 'pattern' && key !== 'gapKeep') return;
+      try { new RegExp(node, 'm'); } catch { return; }
+      if (hasNestedQuantifier(node)) {
+        red('invalid-value', at, `catastrophic-backtracking risk: a nested unbounded quantifier (${node}) can hang the untimed evaluator on the MAIN event loop, where the in-process stall fuse cannot fire (F49). Rewrite the pattern — drop the outer repeat, or match once.`);
+      }
+      return;
+    }
+    if (Array.isArray(node)) node.forEach((v, i) => sweep(v, `${at}.${i}`, key));
+    else if (isObj(node)) for (const [k, v] of Object.entries(node)) sweep(v, at ? `${at}.${k}` : k, k);
+  })(root, '', '');
+}

package/types/authorflow.d.ts

@@ -149,6 +149,31 @@ export function declarationTool(box: {
  * @param {Record<string, any>} [catalogue]
  */
 export function catalogueBlock(catalogue?: Record<string, any>): string;
+/**
+ * HOW THE GENRE'S OWN TOOLS PRINT — rendered FROM `genreInstruments`, so the
+ * pattern the author is handed and the pattern the tree already grades with are
+ * one string.
+ *
+ * This block is the fix for run msmbpjk6: a parser for a tool WE OWN THE FACTS
+ * ABOUT was left to the model to compose, and it composed tsc's terminal-only
+ * shape against piped output — 0 matches on 67 real error lines. The delivery is
+ * deliberately the MANDATORY-GUARD delivery, not advice: the pattern arrives
+ * spelled out, marked genre property, with the real captured line beside it, in
+ * the same register as the guard battery that arrives already parameterised.
+ *
+ * It states the MECHANISM (pipe, not a terminal) rather than only the answer,
+ * because the same trap is waiting behind every tool that pretty-prints for a
+ * human, and only some of them are in the table yet. That prediction has since
+ * been paid off by measurement: `node --test` prints TAP down a pipe and the
+ * spec reporter on a terminal, the identical flip, on a second tool.
+ *
+ * Each row also carries its `capture`, because a count term and a tally term are
+ * read by DIFFERENT aggregates and the wrong pairing is a silent misreading, not
+ * an error — `first` over a line the tool omits on a good run reports a broken
+ * instrument. The block states that mapping once rather than per row.
+ * @param {string} lang
+ */
+export function instrumentsBlock(lang: string): string;
 /** The three laws. Stated to the author; enforced, where checkable, by M2. */
 export function lawsBlock(): string;
 /**
@@ -321,7 +346,26 @@ export function resolveSourcePrefixes({ workdir, sourcePaths, seedFiles }: {
  * run could not be read afterwards. A cost entry with no raw beside it is that
  * run again.
  */
-export function makeCostBook(): {
+/**
+ * @param {{ceilingUsd?: number|null,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void}} [o]
+ *   `ceilingUsd` is the OPERATOR's ceiling; `null`/absent is UNBOUNDED.
+ *   `onCall` is a REPORTING seam fired as each metered call lands — the shell's
+ *   only chance to know what has been spent while the run is still alive. It is
+ *   never consulted and never governs: `capStop` below is still the one
+ *   predicate, still asked between calls, and still reads the same `entries`.
+ *   `absorb` deliberately does NOT fire it: those calls were metered (and
+ *   reported) by whoever made them, and reporting them twice would double the
+ *   scout's spend in every reader downstream.
+ */
+export function makeCostBook({ ceilingUsd, onCall }?: {
+    ceilingUsd?: number | null;
+    onCall?: (call: {
+        label: string;
+        costUsd: number | null;
+        unpricedRounds: number;
+    }) => void;
+}): {
     /** @param {string} label @param {any} r a bare-agent run result @param {number} [attempt] */
     add(label: string, r: any, attempt?: number): {
         label: string;
@@ -347,17 +391,28 @@ export function makeCostBook(): {
         reason: string | null;
     }[];
     report(): {
-        costUsd: number | null;
-        knownUsd: number;
-        spendComplete: boolean;
-        nullCostCalls: number;
-        unpricedRounds: number;
         calls: {
             label: string;
             costUsd: number | null;
             unpricedRounds: number;
         }[];
+        costUsd: number | null;
+        knownUsd: number;
+        spendComplete: boolean;
+        nullCostCalls: number;
+        unpricedRounds: number;
     };
+    /**
+     * THE CEILING'S OWN READING, asked between metered calls. The book is the one
+     * place this pipeline's spend accumulates, so it is the one place that can
+     * answer honestly — and it answers through the shared predicate rather than a
+     * second hand-spelled comparison (`src/text.js`, beside `priceOf`).
+     * @returns {'cap-halt'|'pricing-red'|null}
+     */
+    capStop(): "cap-halt" | "pricing-red" | null;
+    /** what was set, stated — `null` is "nobody set one", which is UNBOUNDED and
+     * a visible operator choice, never a defaulted number */
+    ceilingUsd: number | null;
 };
 /**
  * The default model boundary: one bare-agent Loop per call, with the declaration
@@ -406,13 +461,17 @@ export function makeLoopGenerate(provider: any, { system, maxTokens }?: {
  *
  * @param {{workdir: string, seedRef: string, lang: string, verdictType: string,
  *   answers: Record<string|number, string>, questions?: Record<string|number, string>,
- *   scout: {state: string, facts: any, reason?: string|null, calls?: any[], raws?: any[]},
+ *   scout: {state: string, facts: any, reason?: string|null, cause?: string|null, calls?: any[], raws?: any[],
+ *     budgetStop?: 'cap-halt'|'pricing-red'|null},
  *   listing?: {stop: string|null, files: string[]|null, block: string|null, meta: any}|null,
  *   generate: Function, seedReadFn?: Function, closeCtx?: any,
+ *   ceilingUsd?: number|null,
+ *   onPhase?: (phase: string, data?: any) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
  *   maxRevisions?: number, structureRetries?: number,
  *   structuredMode?: 'tool'|'text', catalogue?: Record<string, any>}} o
  */
-export function authorClose({ workdir, seedRef, lang, verdictType, answers, questions, scout, listing, generate, seedReadFn, closeCtx, maxRevisions, structureRetries, structuredMode, catalogue, }: {
+export function authorClose({ workdir, seedRef, lang, verdictType, answers, questions, scout, listing, generate, seedReadFn, closeCtx, ceilingUsd, onPhase, onCall, maxRevisions, structureRetries, structuredMode, catalogue, }: {
     workdir: string;
     seedRef: string;
     lang: string;
@@ -423,8 +482,10 @@ export function authorClose({ workdir, seedRef, lang, verdictType, answers, ques
         state: string;
         facts: any;
         reason?: string | null;
+        cause?: string | null;
         calls?: any[];
         raws?: any[];
+        budgetStop?: "cap-halt" | "pricing-red" | null;
     };
     listing?: {
         stop: string | null;
@@ -435,6 +496,13 @@ export function authorClose({ workdir, seedRef, lang, verdictType, answers, ques
     generate: Function;
     seedReadFn?: Function;
     closeCtx?: any;
+    ceilingUsd?: number | null;
+    onPhase?: (phase: string, data?: any) => void;
+    onCall?: (call: {
+        label: string;
+        costUsd: number | null;
+        unpricedRounds: number;
+    }) => void;
     maxRevisions?: number;
     structureRetries?: number;
     structuredMode?: "tool" | "text";
@@ -485,21 +553,66 @@ export const STRUCTURE_INSTRUCTION_TEXT: string;
  * cannot emit anything else (D2/D3), so a genre it has never seen is a
  * composition problem, not a catalogue problem.
  *
- * The GREEN set is questions 1–6 of the frozen TYPES set (prereg §5) BYTE FOR
- * BYTE. What is gone is the seventh slot — D13's genre CONFIRM ("this looks like
- * a type-fixing job, correct?") — superseded in full: the interview never asks
- * about a genre again. The refusal it carried did not disappear; it MOVED to the
- * composer, on the same counted `request-red` path (see `authorCloseForJob`).
- * The remaining six are already genre-neutral, which is why generalising them
- * required deleting a slot rather than rewording one.
+ * The GREEN set descends from questions 1–6 of the frozen TYPES set (prereg §5).
+ * TWO slots have been deleted since, both because the interview was ASKING FOR
+ * SOMETHING IT ALREADY HAD or already knew:
+ *
+ *   - D13's genre CONFIRM ("this looks like a type-fixing job, correct?") —
+ *     superseded in full: the interview never asks about a genre again, and the
+ *     refusal it carried MOVED to the composer, on the same counted
+ *     `request-red` path (see `authorCloseForJob`);
+ *   - "Is there a code repo I can look at? Where?" — DROPPED on hamr's ruling
+ *     after he drove the terminal interview himself (2026-08-15, verbatim: *"drop
+ *     Q6"*). The repository is a MANDATORY, STRUCTURED input already —
+ *     `runInterview`'s own `repoPath`, which the runner takes from `--patient` and
+ *     refuses to start without. Asking a person to re-type in prose a path the
+ *     machine is holding in a variable is the SWE tax this product refuses, and
+ *     it invites a second, drifting answer for the same fact (hamr's own answer
+ *     on the live run was *"Yes — the patient itself."*). Nothing downstream lost
+ *     anything: the scout reads `repoPath`, never the answer.
+ *
+ * Question 2 was WIDENED in the same ruling: it now asks for the read-or-draw-from
+ * files as well as the ones that change. The two halves belong in one answer
+ * because they are one decision for the person answering — what the work touches,
+ * and what it touches only to look at.
+ *
+ * The five that remain are genre-neutral, which is why every generalisation so far
+ * has deleted a slot rather than reworded one. They are NUMBERED CONTIGUOUSLY from
+ * 1: the number a person sees is the key their answer is filed under, and a gap
+ * would be a hole in a form nobody can explain.
  */
 export const GREEN_QUESTIONS: Readonly<{
     1: "What do you want done?";
-    2: "Which files or folders should change?";
+    2: "Which files or folders should change? And which files should the work read or draw from (they stay untouched)?";
+    3: "Is there anything that must not change?";
+    4: "How do you check today whether it's working?";
+    5: "What would make you say this came back worse than before?";
+}>;
+/**
+ * THE HITL SET (N4 slice 1) — the green questions BYTE FOR BYTE, plus one.
+ *
+ * The five are unchanged deliberately rather than economically: the
+ * mechanical-first composition law (2026-08-07) says every hitl close is
+ * *deterministic stages first, judge minimal, human last*, so a hitl job needs
+ * exactly the same mechanical facts a green one does — what changes, what must
+ * not, how it is checked today, what "worse" looks like. Rewording them would
+ * fork one interview into two that drift.
+ *
+ * The last one is the only thing the green set cannot supply, and it is not a
+ * flourish: `human-confirms` requires an `ask` — the question the signer answers
+ * at the end of the run — and nothing else in the interview names it. Without it
+ * the composer would have to invent what a person is deciding, which is the one
+ * thing a human stage must never have done for it. It is the SPREAD's next number
+ * rather than a fixed one, so a green-side deletion renumbers it instead of
+ * leaving a gap (it was 7 while the green set held six, and is 6 now it holds five).
+ */
+export const HITL_QUESTIONS: Readonly<{
+    6: "When you look at the finished result yourself, what are you deciding?";
+    1: "What do you want done?";
+    2: "Which files or folders should change? And which files should the work read or draw from (they stay untouched)?";
     3: "Is there anything that must not change?";
     4: "How do you check today whether it's working?";
     5: "What would make you say this came back worse than before?";
-    6: "Is there a code repo I can look at? Where?";
 }>;
 /**
  * The three sets. `questions: null` on a locked class is ABSENT, never `{}`:
@@ -710,6 +823,11 @@ export const PARAM_SCHEMAS: Readonly<{
     requireNonEmpty: {
         const: boolean;
     };
+    ask: {
+        type: string;
+        minLength: number;
+        description: string;
+    };
 }>;
 export type Red = {
     code: string;