tare-cli 0.3.0__tar.gz → 0.3.1__tar.gz

{tare_cli-0.3.0 → tare_cli-0.3.1}/CONCEPT.md

@@ -6,10 +6,11 @@ that it could not see your setup (`tare: not proven (blind)`). It refuses to sta
 until the reading is `tare: 0.00`, unless you pass `--allow-dirty`. It supports Claude Code, Codex, Pi
 and the Antigravity CLI (`agy`) on Linux and WSL, and Claude Code, Codex and Pi on macOS.
 
-This document describes the design and the measurements behind it. The [README](README.md)
-explains the words this document uses: room, probe, reading, leak, declared, dirty twin, check, tail and
-handoff. Every claim marked **measured** was observed on WSL2. The section
-[Measurements](#measurements) lists the agent versions and links each result.
+This document describes the design and the measurements behind it. The documentation explains the
+words this document uses: room, probe, reading, leak, declared and dirty twin in
+[docs/words.md](docs/words.md), check, tail and handoff in [docs/measuring.md](docs/measuring.md).
+Every claim marked **measured** was observed on WSL2. The section [Measurements](#measurements)
+lists the agent versions and links each result.
 
 ## Why
 
@@ -122,6 +123,14 @@ session. This has not been tested, so tare refuses to start when the copy would
 within the next hour. **Measured:** the Antigravity CLI's Google login keeps its refresh token
 when it renews, so a room may renew its own copy.
 
+**Measured** on Ubuntu on WSL2 with Claude Code 2.1.310: Claude Code renews its token only in
+the last minutes before it expires. A session started outside tare with 57 minutes left, and
+another with 7 minutes left, kept the old token; one started with under 6 minutes left renewed
+it, and the new token held for 8 hours. So for most of the refused hour no session outside tare
+can renew the login, and the refusal names the expiry time instead of asking for one. A run
+known to be shorter may ask for less with `TARE_MIN_LOGIN_MINUTES`, never below 10 minutes, so
+the copy does not start inside the renewal window (#126).
+
 ### Probe and reading
 
 The probe has the three parts of layer 3: the agent in the room against the fake model server,

tare_cli-0.3.1/PKG-INFO

@@ -0,0 +1,172 @@
+Metadata-Version: 2.5
+Name: tare-cli
+Version: 0.3.1
+Summary: Prove your coding agent starts without your personal setup before you measure it.
+Project-URL: Homepage, https://github.com/a-ratz/tare
+Project-URL: Repository, https://github.com/a-ratz/tare
+Project-URL: Issues, https://github.com/a-ratz/tare/issues
+Project-URL: Concept, https://github.com/a-ratz/tare/blob/main/CONCEPT.md
+Author: Andre Ratzenberger
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agent-evaluation,ai-agents,claude-code,codex,coding-agents,evals,llm-evaluation,sandbox
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-light.svg">
+    <img alt="tare" src="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-light.svg" width="260">
+  </picture>
+
+  <p><b>Zero the scale before you weigh.</b><br>
+  Prove your coding agent starts without your personal setup, then measure it.</p>
+</div>
+
+<div align="center">
+
+[![License: MIT][license-shield]][license-url]
+[![PyPI][version-shield]][version-url]
+[![Python 3.11+][python-shield]][python-url]
+[![Linux | WSL | macOS][platform-shield]][platform-url]
+[![Claude Code | Codex | Pi | Antigravity][agent-shield]][agent-url]
+
+</div>
+
+<div align="center">
+  <a href="#quick-start">Quick start</a> &middot;
+  <a href="#features">Features</a> &middot;
+  <a href="https://github.com/a-ratz/tare/blob/main/docs/README.md">Documentation</a> &middot;
+  <a href="https://github.com/a-ratz/tare/blob/main/CONCEPT.md">Concept</a> &middot;
+  <a href="https://github.com/a-ratz/tare/issues/new?template=bug_report.md">Report Bug</a>
+</div>
+
+<br>
+
+---
+
+Your coding agent knows you. Every run loads your global instructions, memories, skills, MCP
+servers and connected accounts. At work that is the point. In an evaluation it is noise. Compare
+runs with and without a skill on your own machine, and both runs carry your setup. You measure
+your machine, not the skill.
+
+**tare** starts the agent in a room that holds nothing of yours and proves the room is clean
+before every run. It works with Claude Code, Codex, Pi and Google's Antigravity CLI on Linux and
+WSL, and with the first three on macOS.
+
+```text
+$ tare probe claude
+tare probe · claude 2.1.289 · /home/me/tare
+  control   dirty twin shows: instructions, home path, mcp, skills, plugins, email, reach
+  leaks     none
+  declared
+    email        account email                                subscription login
+    credentials  /home/tare/.claude-config/.credentials.json  copy of the login, needed by the CLI
+tare: 0.00
+```
+
+`tare: 0.00` is the zeroed scale. Nothing of your setup reached the model except what the reading
+declares. A reading with leaks names each one and the file it came from, and the agent does not
+start.
+
+## Quick start
+
+```bash
+uv tool install tare-cli            # or: pipx install tare-cli
+tare probe claude                   # prove the room is clean
+tare claude -- -p "fix the tests"   # run Claude Code in it
+```
+
+On Linux and WSL, tare also needs bubblewrap (`sudo apt install bubblewrap`). The
+[install guide](https://github.com/a-ratz/tare/blob/main/docs/install.md) has the details per
+platform, and [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md) explains
+every line of the output above.
+
+## Features
+
+- **Measures what the model receives.** The probe records the request the agent sends to a fake
+  model server on your machine. It makes no paid calls and never asks the agent about itself,
+  because an agent asked about its own context can refuse or be wrong.
+  [How it works](https://github.com/a-ratz/tare/blob/main/docs/how-it-works.md)
+- **Knows when it cannot see.** A dirty twin runs the agent in your real setup. If the probe could
+  not see your setup there, the reading is `tare: not proven (blind)` instead of a `0.00` that
+  proves nothing. [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md)
+- **Keeps your files out and your login working.** The room has no home directory of yours, no
+  credentials of your other tools and no secret environment variables. It gets a fresh copy of
+  your login, which tare deletes after the run.
+  [Running agents in rooms](https://github.com/a-ratz/tare/blob/main/docs/running-agents.md)
+- **Compares skills, plugins and models.** `tare calibrate` starts each side several times from
+  scratch and reports pass rates with their intervals.
+  [Calibrate](https://github.com/a-ratz/tare/blob/main/docs/calibrate.md)
+- **Scores what no test can decide.** `tare judge` lets a second agent score a page by your
+  rubric, without agent or model names, and `tare judge-noise` shows how far its scores vary.
+  [Judge](https://github.com/a-ratz/tare/blob/main/docs/judge.md)
+- **Tells the workspace from the agent.** `tare swap` lets two agents continue each other's
+  unfinished work and reports whether the workspace or the agent decided the outcome.
+  [Swap](https://github.com/a-ratz/tare/blob/main/docs/swap.md)
+- **Finds the step where a failed run was lost** (experimental). `tare cliff` restarts the run
+  from its saved steps and names the step after which it no longer passes.
+  [Cliff](https://github.com/a-ratz/tare/blob/main/docs/cliff.md)
+- **Live dashboard, cost and reruns.** A dashboard follows every run, each report ends with tokens
+  and cost, and `tare rerun` repeats a run from its recipe.
+  [Dashboard and rerun](https://github.com/a-ratz/tare/blob/main/docs/dashboard.md) ·
+  [Tokens and cost](https://github.com/a-ratz/tare/blob/main/docs/tokens-and-cost.md)
+
+## When to use
+
+| Use tare when | Look elsewhere when |
+|---|---|
+| you compare agent runs with and without a skill, plugin or prompt | you need protection from a hostile agent, because the room has network access and a working login |
+| you benchmark agents on your own machine | you use the Antigravity CLI on macOS (not supported there yet) |
+| you want a fresh-machine run without a fresh machine | you log in with an API key only (untested) |
+| an agent failed a task and you want to know which step lost it | you want a single run explained without running the agent again, because Cliff runs it many times |
+
+## Documentation
+
+| | |
+|---|---|
+| **Getting started** | [Install](https://github.com/a-ratz/tare/blob/main/docs/install.md) · [The words tare uses](https://github.com/a-ratz/tare/blob/main/docs/words.md) · [Running agents in rooms](https://github.com/a-ratz/tare/blob/main/docs/running-agents.md) · [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md) |
+| **Measuring** | [Overview](https://github.com/a-ratz/tare/blob/main/docs/measuring.md) · [Calibrate](https://github.com/a-ratz/tare/blob/main/docs/calibrate.md) · [Judge](https://github.com/a-ratz/tare/blob/main/docs/judge.md) · [Swap](https://github.com/a-ratz/tare/blob/main/docs/swap.md) · [Cliff](https://github.com/a-ratz/tare/blob/main/docs/cliff.md) · [Tokens and cost](https://github.com/a-ratz/tare/blob/main/docs/tokens-and-cost.md) · [Dashboard and rerun](https://github.com/a-ratz/tare/blob/main/docs/dashboard.md) |
+| **Background** | [How it works](https://github.com/a-ratz/tare/blob/main/docs/how-it-works.md) · [Concept: the design and every measurement](https://github.com/a-ratz/tare/blob/main/CONCEPT.md) · [Experiments](https://github.com/a-ratz/tare/tree/main/experiments) |
+
+## Status
+
+tare is on PyPI as `tare-cli`. Claude Code, Codex and Pi run on Linux, WSL and macOS; the
+Antigravity CLI runs on Linux and WSL, and stops with a message on macOS for now. What comes next
+is in the [open epics](https://github.com/a-ratz/tare/issues?q=is%3Aissue+is%3Aopen+label%3Atype%3Aepic).
+
+## Contributing
+
+Every change starts as an issue. Larger work is an epic, split into features, and one epic
+becomes one branch and one pull request. [AGENTS.md](https://github.com/a-ratz/tare/blob/main/AGENTS.md)
+describes the process, the checks and the conventions. Run the tests with `uv run pytest`.
+
+## License
+
+MIT. See [LICENSE](https://github.com/a-ratz/tare/blob/main/LICENSE).
+
+---
+
+Crafted with [Readme Craft](https://github.com/motiful/readme-craft)
+
+[license-shield]: https://img.shields.io/badge/license-MIT-blue.svg
+[license-url]: https://github.com/a-ratz/tare/blob/main/LICENSE
+[version-shield]: https://img.shields.io/pypi/v/tare-cli.svg
+[version-url]: https://pypi.org/project/tare-cli/
+[python-shield]: https://img.shields.io/badge/python-3.11%2B-3776AB.svg
+[python-url]: https://www.python.org/
+[platform-shield]: https://img.shields.io/badge/platform-Linux%20%7C%20WSL%20%7C%20macOS-555555.svg
+[platform-url]: https://github.com/a-ratz/tare/blob/main/docs/install.md
+[agent-shield]: https://img.shields.io/badge/agents-Claude%20Code%20%7C%20Codex%20%7C%20Pi%20%7C%20Antigravity-D97757.svg
+[agent-url]: https://github.com/a-ratz/tare/blob/main/docs/install.md

tare_cli-0.3.1/README.md

@@ -0,0 +1,147 @@
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-light.svg">
+    <img alt="tare" src="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-light.svg" width="260">
+  </picture>
+
+  <p><b>Zero the scale before you weigh.</b><br>
+  Prove your coding agent starts without your personal setup, then measure it.</p>
+</div>
+
+<div align="center">
+
+[![License: MIT][license-shield]][license-url]
+[![PyPI][version-shield]][version-url]
+[![Python 3.11+][python-shield]][python-url]
+[![Linux | WSL | macOS][platform-shield]][platform-url]
+[![Claude Code | Codex | Pi | Antigravity][agent-shield]][agent-url]
+
+</div>
+
+<div align="center">
+  <a href="#quick-start">Quick start</a> &middot;
+  <a href="#features">Features</a> &middot;
+  <a href="https://github.com/a-ratz/tare/blob/main/docs/README.md">Documentation</a> &middot;
+  <a href="https://github.com/a-ratz/tare/blob/main/CONCEPT.md">Concept</a> &middot;
+  <a href="https://github.com/a-ratz/tare/issues/new?template=bug_report.md">Report Bug</a>
+</div>
+
+<br>
+
+---
+
+Your coding agent knows you. Every run loads your global instructions, memories, skills, MCP
+servers and connected accounts. At work that is the point. In an evaluation it is noise. Compare
+runs with and without a skill on your own machine, and both runs carry your setup. You measure
+your machine, not the skill.
+
+**tare** starts the agent in a room that holds nothing of yours and proves the room is clean
+before every run. It works with Claude Code, Codex, Pi and Google's Antigravity CLI on Linux and
+WSL, and with the first three on macOS.
+
+```text
+$ tare probe claude
+tare probe · claude 2.1.289 · /home/me/tare
+  control   dirty twin shows: instructions, home path, mcp, skills, plugins, email, reach
+  leaks     none
+  declared
+    email        account email                                subscription login
+    credentials  /home/tare/.claude-config/.credentials.json  copy of the login, needed by the CLI
+tare: 0.00
+```
+
+`tare: 0.00` is the zeroed scale. Nothing of your setup reached the model except what the reading
+declares. A reading with leaks names each one and the file it came from, and the agent does not
+start.
+
+## Quick start
+
+```bash
+uv tool install tare-cli            # or: pipx install tare-cli
+tare probe claude                   # prove the room is clean
+tare claude -- -p "fix the tests"   # run Claude Code in it
+```
+
+On Linux and WSL, tare also needs bubblewrap (`sudo apt install bubblewrap`). The
+[install guide](https://github.com/a-ratz/tare/blob/main/docs/install.md) has the details per
+platform, and [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md) explains
+every line of the output above.
+
+## Features
+
+- **Measures what the model receives.** The probe records the request the agent sends to a fake
+  model server on your machine. It makes no paid calls and never asks the agent about itself,
+  because an agent asked about its own context can refuse or be wrong.
+  [How it works](https://github.com/a-ratz/tare/blob/main/docs/how-it-works.md)
+- **Knows when it cannot see.** A dirty twin runs the agent in your real setup. If the probe could
+  not see your setup there, the reading is `tare: not proven (blind)` instead of a `0.00` that
+  proves nothing. [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md)
+- **Keeps your files out and your login working.** The room has no home directory of yours, no
+  credentials of your other tools and no secret environment variables. It gets a fresh copy of
+  your login, which tare deletes after the run.
+  [Running agents in rooms](https://github.com/a-ratz/tare/blob/main/docs/running-agents.md)
+- **Compares skills, plugins and models.** `tare calibrate` starts each side several times from
+  scratch and reports pass rates with their intervals.
+  [Calibrate](https://github.com/a-ratz/tare/blob/main/docs/calibrate.md)
+- **Scores what no test can decide.** `tare judge` lets a second agent score a page by your
+  rubric, without agent or model names, and `tare judge-noise` shows how far its scores vary.
+  [Judge](https://github.com/a-ratz/tare/blob/main/docs/judge.md)
+- **Tells the workspace from the agent.** `tare swap` lets two agents continue each other's
+  unfinished work and reports whether the workspace or the agent decided the outcome.
+  [Swap](https://github.com/a-ratz/tare/blob/main/docs/swap.md)
+- **Finds the step where a failed run was lost** (experimental). `tare cliff` restarts the run
+  from its saved steps and names the step after which it no longer passes.
+  [Cliff](https://github.com/a-ratz/tare/blob/main/docs/cliff.md)
+- **Live dashboard, cost and reruns.** A dashboard follows every run, each report ends with tokens
+  and cost, and `tare rerun` repeats a run from its recipe.
+  [Dashboard and rerun](https://github.com/a-ratz/tare/blob/main/docs/dashboard.md) ·
+  [Tokens and cost](https://github.com/a-ratz/tare/blob/main/docs/tokens-and-cost.md)
+
+## When to use
+
+| Use tare when | Look elsewhere when |
+|---|---|
+| you compare agent runs with and without a skill, plugin or prompt | you need protection from a hostile agent, because the room has network access and a working login |
+| you benchmark agents on your own machine | you use the Antigravity CLI on macOS (not supported there yet) |
+| you want a fresh-machine run without a fresh machine | you log in with an API key only (untested) |
+| an agent failed a task and you want to know which step lost it | you want a single run explained without running the agent again, because Cliff runs it many times |
+
+## Documentation
+
+| | |
+|---|---|
+| **Getting started** | [Install](https://github.com/a-ratz/tare/blob/main/docs/install.md) · [The words tare uses](https://github.com/a-ratz/tare/blob/main/docs/words.md) · [Running agents in rooms](https://github.com/a-ratz/tare/blob/main/docs/running-agents.md) · [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md) |
+| **Measuring** | [Overview](https://github.com/a-ratz/tare/blob/main/docs/measuring.md) · [Calibrate](https://github.com/a-ratz/tare/blob/main/docs/calibrate.md) · [Judge](https://github.com/a-ratz/tare/blob/main/docs/judge.md) · [Swap](https://github.com/a-ratz/tare/blob/main/docs/swap.md) · [Cliff](https://github.com/a-ratz/tare/blob/main/docs/cliff.md) · [Tokens and cost](https://github.com/a-ratz/tare/blob/main/docs/tokens-and-cost.md) · [Dashboard and rerun](https://github.com/a-ratz/tare/blob/main/docs/dashboard.md) |
+| **Background** | [How it works](https://github.com/a-ratz/tare/blob/main/docs/how-it-works.md) · [Concept: the design and every measurement](https://github.com/a-ratz/tare/blob/main/CONCEPT.md) · [Experiments](https://github.com/a-ratz/tare/tree/main/experiments) |
+
+## Status
+
+tare is on PyPI as `tare-cli`. Claude Code, Codex and Pi run on Linux, WSL and macOS; the
+Antigravity CLI runs on Linux and WSL, and stops with a message on macOS for now. What comes next
+is in the [open epics](https://github.com/a-ratz/tare/issues?q=is%3Aissue+is%3Aopen+label%3Atype%3Aepic).
+
+## Contributing
+
+Every change starts as an issue. Larger work is an epic, split into features, and one epic
+becomes one branch and one pull request. [AGENTS.md](https://github.com/a-ratz/tare/blob/main/AGENTS.md)
+describes the process, the checks and the conventions. Run the tests with `uv run pytest`.
+
+## License
+
+MIT. See [LICENSE](https://github.com/a-ratz/tare/blob/main/LICENSE).
+
+---
+
+Crafted with [Readme Craft](https://github.com/motiful/readme-craft)
+
+[license-shield]: https://img.shields.io/badge/license-MIT-blue.svg
+[license-url]: https://github.com/a-ratz/tare/blob/main/LICENSE
+[version-shield]: https://img.shields.io/pypi/v/tare-cli.svg
+[version-url]: https://pypi.org/project/tare-cli/
+[python-shield]: https://img.shields.io/badge/python-3.11%2B-3776AB.svg
+[python-url]: https://www.python.org/
+[platform-shield]: https://img.shields.io/badge/platform-Linux%20%7C%20WSL%20%7C%20macOS-555555.svg
+[platform-url]: https://github.com/a-ratz/tare/blob/main/docs/install.md
+[agent-shield]: https://img.shields.io/badge/agents-Claude%20Code%20%7C%20Codex%20%7C%20Pi%20%7C%20Antigravity-D97757.svg
+[agent-url]: https://github.com/a-ratz/tare/blob/main/docs/install.md

{tare_cli-0.3.0 → tare_cli-0.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tare-cli"
-version = "0.3.0"
+version = "0.3.1"
 description = "Prove your coding agent starts without your personal setup before you measure it."
 readme = "README.md"
 requires-python = ">=3.11"

{tare_cli-0.3.0 → tare_cli-0.3.1}/src/tare/room.py

@@ -15,6 +15,7 @@ import stat
 import subprocess
 import sys
 import tempfile
+import time
 from contextlib import contextmanager
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -28,8 +29,11 @@ SEATBELT_ROOMS = "/private/tmp"
 # Copied from the caller when set; everything else stays outside.
 PASS_ENV = ("TERM", "COLORTERM", "LANG", "LC_ALL")
 # The room must not refresh the login: a refresh may rotate the token family the real
-# session depends on (CONCEPT.md, layer 2). An hour covers ordinary runs.
+# session depends on (CONCEPT.md, layer 2). An hour covers ordinary runs; a shorter run may
+# ask for less, but never so little that the copy starts close to its renewal.
 MIN_TOKEN_LIFETIME = 3600
+MIN_LOGIN_ENV = "TARE_MIN_LOGIN_MINUTES"
+MIN_LOGIN_FLOOR = 10  # minutes
 
 
 class TareError(Exception):
@@ -61,11 +65,26 @@ class Room:
         return f"{self.inside_home}/{agent.config_dir}"
 
 
+def _min_lifetime() -> int:
+    """Seconds the login copy must still hold: an hour, or what TARE_MIN_LOGIN_MINUTES asks for."""
+    minutes = os.environ.get(MIN_LOGIN_ENV)
+    if minutes is None:
+        return MIN_TOKEN_LIFETIME
+    if not minutes.isdigit() or int(minutes) < MIN_LOGIN_FLOOR:
+        raise TareError(f"{MIN_LOGIN_ENV} must be a whole number of minutes, at least {MIN_LOGIN_FLOOR}")
+    return int(minutes) * 60
+
+
 def _check_login(agent, real):
     left = agent.token_lifetime(real)
-    if left < MIN_TOKEN_LIFETIME:
-        raise TareError(f"the {agent.name} login token expires in {max(0, int(left // 60))} min: "
-                        f"start any {agent.name} session to refresh it, then retry")
+    if left < _min_lifetime():
+        # the agent renews only close to expiry, so a session started earlier changes nothing
+        # with the zone: on the night the clocks go back, a bare 02:04 reads as already past
+        minutes, at = max(0, int(left // 60)), time.strftime("%H:%M %Z", time.localtime(time.time() + left)).strip()
+        shorter = (f"; a run that ends well before then can start now with {MIN_LOGIN_ENV}={minutes} or less"
+                   if minutes >= MIN_LOGIN_FLOOR else "")
+        raise TareError(f"the {agent.name} login token expires in {minutes} min, at {at}: to renew it, start "
+                        f"{agent.name} outside tare after {at}, then retry{shorter}")
 
 
 def room_env(agent, room: Room | None = None, extra: dict[str, str] | None = None) -> dict[str, str]:

{tare_cli-0.3.0 → tare_cli-0.3.1}/tests/test_room.py

@@ -60,6 +60,35 @@ def test_room_refuses_a_login_that_would_need_a_refresh(tmp_path, make, agent):
             pass
 
 
+def test_refusal_names_the_expiry_and_how_a_shorter_run_starts(tmp_path):
+    real = claude_real(tmp_path, expires_in=1800)
+    with pytest.raises(TareError, match=r"expires in 29 min, at \d\d:\d\d.*: to renew it, start claude outside "
+                                        r"tare after \d\d:\d\d.*, then retry; .* TARE_MIN_LOGIN_MINUTES=29 or less"):
+        with room_home(Claude(), real):
+            pass
+
+
+def test_no_shorter_run_is_offered_below_the_floor(tmp_path):
+    with pytest.raises(TareError) as refused:
+        with room_home(Claude(), claude_real(tmp_path, expires_in=300)):
+            pass
+    assert "TARE_MIN_LOGIN_MINUTES" not in str(refused.value)
+
+
+def test_a_shorter_run_starts_with_less_than_an_hour_left(tmp_path, monkeypatch):
+    monkeypatch.setenv("TARE_MIN_LOGIN_MINUTES", "15")
+    with room_home(Claude(), claude_real(tmp_path, expires_in=1200)) as home:
+        assert (home / ".claude-config" / ".credentials.json").exists()
+
+
+@pytest.mark.parametrize("minutes", ["9", "0", "-5", "ten", ""])
+def test_the_minimum_never_drops_below_the_floor(tmp_path, monkeypatch, minutes):
+    monkeypatch.setenv("TARE_MIN_LOGIN_MINUTES", minutes)
+    with pytest.raises(TareError, match="TARE_MIN_LOGIN_MINUTES must be a whole number of minutes, at least 10"):
+        with room_home(Claude(), claude_real(tmp_path)):
+            pass
+
+
 def test_codex_api_key_login_never_expires(tmp_path):
     real = codex_real(tmp_path)
     (real.config / "auth.json").write_text(json.dumps({"OPENAI_API_KEY": "sk-test"}))