v0.1.6: period budget and reserve-then-settle

Money-safety release. Before this, a paid run was limited by the cap per run, an in-memory rate limit and the token balance. Runs started together each had their own cap, and a browser could lower the cap through the confirmed quote.

• Period budget: a daily and a monthly amount (UTC), $10 and $50 by default, saved in budget.json. Only the signed-in owner changes it, on the new Costs page (session and CSRF token). A run request cannot raise it.
• Reserve then settle, per call: each of the up to 16 calls in flight reserves its list price under a lock file before it is made, and is refused if used plus reserved plus the price would pass either budget. The reservation becomes the real cost when the call ends. A call looot answered with an error releases it. A pending call keeps its reservation and is never counted as $0. The next run looks it up with GET /v1/runs/{id} and settles it. Unreachable reservations are released after 24 hours.
• Stored results: a finished call is stored under its stable key (account, signal, normalised input, freshness window). The same request inside the window makes no call and no charge. The key has no date or time salt.
• The per-run cap comes from LOOOT_INTENT_MAX_RUN_USD only. The confirmed quote now only checks the price.
• Sidebar spend panel and Costs page show used, reserved and remaining. A skipped call names the limit. The CLI refuses a run above what is left unless --partial is passed.
• Tests: 117 before, 153 after. Checked against a fake local looot server: with a $0.05 daily budget, 5 calls went out, 28 were skipped, and a repeat made no call.

No migration. The budget is a new file, budget.json, in LOOOT_INTENT_DIR. Run one instance on a persistent disk. The looot token balance is still the final limit. See Spending and Securing a deployment in the README.

v0.1.5: third-party buying intent

Adds an eleventh signal, third-party buying intent, from TheirStack.

• looot job companies.buying-intents, endpoint theirstack-companies-buying-intents.
• Price $0.0981 per result. The app asks for 1 result per account, so one account costs at most $0.0981. The quote and the spend cap reserve that price first. The caller cannot change the limit.
• Own weight (14) in config/intent.config.json.
• Typical cost at list price goes from $0.1720 to $0.2701 per account. 25 accounts is $6.75, 100 is $27.01. The default $5 web cap covers 18 accounts. Switch the signal off to get the old price back.
• The response parser is tolerant and unverified, the catalog lists no response fields. No paid run was made.
• Still dropped: Bombora-style topic surge and G2, Capterra, Trustpilot review signals. The catalog has no source keyed by domain.

v0.1.4: admin sign-in and server-side run cap

Security fix: the admin routes are now closed

Versions 0.1.3 and older had no admin authentication. Anyone who could reach a running copy could read the saved run and start paid looot runs on your token, with a spend cap they chose. If you run v0.1.3 or older on a host other than your own machine, upgrade to v0.1.4 and set LOOOT_INTENT_ADMIN_PASSWORD (12 characters or more).

What changed

• Every page and API route except /login, /api/auth/login, /api/auth/logout and /api/health needs a signed session. Without a password set, the web UI shows a setup page and serves nothing else.
• Sessions are signed httpOnly SameSite=Lax cookies (Secure in production) that last 8 hours. 5 wrong passwords lock an address for 15 minutes.
• State-changing requests need a same-origin check and a CSRF token.
• POST /api/run takes its ceiling from the server (LOOOT_INTENT_MAX_RUN_USD, default 5), not from the browser. It prices the list again before spending, refuses if the price is above the cap or the quote you confirmed, and allows 6 runs per session per 10 minutes.
• npm run demo stays open with a "Demo, no sign-in" badge and refuses to start next to a LOOOT_TOKEN or a saved run.
• Security headers on every response. Admin responses are never cached.

Upgrade steps

1. Set LOOOT_INTENT_ADMIN_PASSWORD (or LOOOT_INTENT_ADMIN_PASSWORD_HASH from npm run hash-password).
2. Optional: set LOOOT_INTENT_MAX_RUN_USD.
3. Restart. The web UI now asks for the password. The CLI is unchanged.

The README section "Securing a deployment" has the route map and the stronger option of a VPN or identity-aware proxy.

v0.1.3

LinkedIn ads signal now uses scrapecreators-linkedin-ads-search, since the earlier endpoint left the looot catalog. A signal whose endpoint is missing shows as source unavailable instead of being skipped silently.

v0.1.2

Sidebar layout: left sidebar that collapses to an icon rail, drawer on phones, spend panel, docs and GitHub links.

v0.1.1

Dependency security bump. next and eslint-config-next 16.3.7 to 16.3.8, which fixes six Next.js advisories (GHSA-3w37-wq28-93x7, GHSA-4jqv-mc3x-m676, GHSA-39w2-rjm5-chcv, GHSA-f87g-xv8r-7p7x, GHSA-mcj8-r9mp-w47p, GHSA-cjq9-62q9-8jv4). No code changes. v0.1.0 is unchanged.

v0.1.0

First release. Account intent scoring on looot: ten signals from nine categories, explainable score and buying stage, quote before run, spend cap, demo mode, CLI and web UI. No paid looot run has been made; response parsers are built from provider docs and fixtures. See the README section on what is not tested.