@beryl-so/cli 0.24.1 → 0.27.0

package/README.md

@@ -60,7 +60,7 @@ claude mcp add beryl -- beryl mcp                    # or, with the CLI installe
 
 Most non-interactive commands below are exposed as an MCP tool with the same name
 (spaces and dashes become underscores) — see the MCP tool column. `—` marks commands
-kept CLI-only: account/billing/team admin, Slack alerts, feedback, and cloud exploration.
+kept CLI-only: account/billing/team admin, feedback, and cloud exploration.
 
 ## Commands
 
@@ -277,19 +277,6 @@ Manage the variables, secrets, and files the agent can use while exploring and r
 | `beryl config files download <file-id>` | Get a short-lived download URL for a file | `config_files_download` |
 | `beryl config files delete <file-id>` | Delete an uploaded file | `config_files_delete` |
 
-### slack
-
-Send run outcomes to a Slack channel via a per-project incoming webhook.
-
-`beryl slack` with no subcommand runs `slack show`.
-
-| Command | Summary | MCP tool |
-| --- | --- | --- |
-| `beryl slack show` | Show the project's Slack alert config (webhook is masked) | — |
-| `beryl slack set-webhook <url>` | Set the Slack incoming-webhook URL run alerts post to | — |
-| `beryl slack clear` | Remove the project's Slack webhook (stops all alerts) | — |
-| `beryl slack test` | Post a sample alert to the configured webhook | — |
-
 ### mailbox
 
 The project's standing email addresses — where its tests receive sign-in mail.
@@ -346,7 +333,7 @@ Review a workspace's plan usage, subscription, and invoices.
 
 | Command | Summary | MCP tool |
 | --- | --- | --- |
-| `beryl billing usage` | Show plan usage: services and weekly AI units | — |
+| `beryl billing usage` | Show plan usage: monthly cloud run minutes | — |
 | `beryl billing subscription` | Show the workspace's subscription | — |
 | `beryl billing invoices` | List recent invoices | — |
 | `beryl billing portal` | Get a Stripe billing-portal link for the workspace | — |

package/dist/commands/account.js

@@ -45,7 +45,7 @@ export const accountCommands = [
     },
     {
         name: "billing usage",
-        summary: "Show plan usage: services and weekly AI units",
+        summary: "Show plan usage: monthly cloud run minutes",
         scope: "workspace",
         groupSummary: "Review a workspace's plan usage, subscription, and invoices.",
         async run(ctx, input) {

package/dist/commands/mailboxes.js

@@ -1,4 +1,4 @@
-import { extractCode } from "../email-extract.js";
+import { ApiError } from "../http.js";
 import { dim, green, table } from "../output.js";
 import { arg, flagBool, flagNum, flagStr, projectPath } from "./util.js";
 const mailboxPath = (ws) => `/workspaces/${ws}/mailboxes`;
@@ -89,7 +89,8 @@ export const mailboxCommands = [
         summary: "Read the latest email in a mailbox (waits for one to arrive)",
         description: "Waits up to --timeout-s for a matching email and returns it (one blocking request; " +
             "the server caps the wait at 50s — re-run to keep waiting). With --extract-code, " +
-            "also pulls the one-time code (4-8 digits) out of the body/subject. Use " +
+            "also asks the server to pull the one-time code out of the email (AI-assisted when " +
+            "the email is ambiguous; `code` is null if none was found). Use " +
             "--recipient-contains to read only one `+tag` alias's mail when several identities " +
             "share the mailbox. Exits non-zero if nothing arrives before the timeout. Waits for " +
             "and returns ONE latest matching email — `mailbox emails` lists what has already " +
@@ -126,7 +127,8 @@ export const mailboxCommands = [
         ],
         async run(ctx, input) {
             const { workspaceId } = await ctx.requireProject(input);
-            const email = (await ctx.client.get(`${mailboxPath(workspaceId)}/${arg(input, "mailbox-id")}/emails/latest`, {
+            const mailboxId = arg(input, "mailbox-id");
+            const email = (await ctx.client.get(`${mailboxPath(workspaceId)}/${mailboxId}/emails/latest`, {
                 timeout_s: flagNum(input, "timeout-s"),
                 since: flagStr(input, "since"),
                 from_contains: flagStr(input, "from-contains"),
@@ -135,7 +137,18 @@ export const mailboxCommands = [
             }));
             if (!flagBool(input, "extract-code"))
                 return { data: email };
-            return { data: { ...email, code: extractCode(email) } };
+            // Extraction is the server's job (the same brain runs use, AI included); a 422
+            // means the email genuinely carries no code.
+            try {
+                const extracted = (await ctx.client.post(`${mailboxPath(workspaceId)}/${mailboxId}/emails/${email.id}/extract`, { extract: "code" }));
+                return { data: { ...email, code: extracted.value } };
+            }
+            catch (err) {
+                if (err instanceof ApiError && err.status === 422) {
+                    return { data: { ...email, code: null } };
+                }
+                throw err;
+            }
         },
     },
     {

package/dist/email-pump.js

@@ -1,10 +1,10 @@
 import fs from "node:fs";
-import { extractValue } from "./email-extract.js";
 import { ApiError } from "./http.js";
 const SIDECAR_POLL_MS = 500;
 // The server caps one blocking wait at 50s; stay under it and loop.
 const SERVER_WAIT_MAX_S = 45;
 const DEFAULT_WAIT_S = 30;
+const EXTRACT_RETRY_MS = 1000;
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export function startEmailPump(opts) {
     let stopped = false;
@@ -29,11 +29,36 @@ export function startEmailPump(opts) {
             throw err;
         }
     };
+    // A 422 is a real verdict — "this email carries no artifact" — and sends the wait on
+    // to the next email; anything else is transport trouble, retried until the step's own
+    // deadline does the failing.
+    const extractOnServer = async (emailId, req, deadline) => {
+        while (!stopped && Date.now() < deadline) {
+            try {
+                const res = (await opts.client.post(`/workspaces/${opts.workspaceId}/mailboxes/${opts.inboxId}/emails/${emailId}/extract`, { extract: req.extract ?? "code", extract_pattern: req.pattern }));
+                if (res.source === "ai")
+                    opts.onEvent?.("await_email: the AI extractor answered");
+                return { ok: true, value: res.value };
+            }
+            catch (err) {
+                if (err instanceof ApiError && err.status === 422) {
+                    const detail = typeof err.detail === "string" ? err.detail : err.message;
+                    return {
+                        ok: false,
+                        error: detail.replace(/^EMAIL_EXTRACTION_FAILED:\s*/, ""),
+                    };
+                }
+                await sleep(EXTRACT_RETRY_MS);
+            }
+        }
+        return { ok: false, error: "extraction did not complete before the wait deadline" };
+    };
     const resolveRequest = async (req) => {
         // Wait exactly wait_s, like the cloud resolver — the spec's own grace window
         // covers this side's poll tick + round trip.
         const waitS = Math.max(1, Number(req.wait_s) || DEFAULT_WAIT_S);
         const deadline = Date.now() + waitS * 1000;
+        let lastExtractError;
         while (!stopped && Date.now() < deadline) {
             const remainingS = Math.ceil((deadline - Date.now()) / 1000);
             const email = await fetchLatest(req, Math.min(SERVER_WAIT_MAX_S, remainingS));
@@ -48,9 +73,15 @@ export function startEmailPump(opts) {
             consumed.add(email.id);
             since = email.received_at;
             opts.onEvent?.(`await_email: matched "${email.subject ?? "(no subject)"}"`);
-            return extractValue(email, String(req.extract ?? "code"), req.pattern);
+            const extracted = await extractOnServer(email.id, req, deadline);
+            if (extracted.ok)
+                return extracted.value;
+            // Same move as the cloud resolver: an email without the artifact (a welcome mail
+            // racing the code mail) is consumed and the wait continues for the next one.
+            lastExtractError = extracted.error;
+            opts.onEvent?.(`await_email: ${extracted.error} — waiting for the next email`);
         }
-        throw new Error(`no matching email arrived in the run inbox within ${waitS}s`);
+        throw new Error(lastExtractError ?? `no matching email arrived in the run inbox within ${waitS}s`);
     };
     const writeResponse = (response) => {
         let box = {};

package/dist/registry/index.js

@@ -9,7 +9,6 @@ import { initCommands } from "../commands/init.js";
 import { mcpCommands } from "../commands/mcp.js";
 import { projectCommands } from "../commands/projects.js";
 import { runCommands } from "../commands/runs.js";
-import { slackCommands } from "../commands/slack.js";
 import { testCommands } from "../commands/tests.js";
 import { workspaceCommands } from "../commands/workspaces.js";
 export const WORKSPACE_FLAG = {
@@ -34,11 +33,10 @@ function withScopeFlags(spec) {
     return { ...spec, flags: [...(spec.flags ?? []), ...extra] };
 }
 // Command groups kept OUT of the `beryl mcp` tool surface while staying full CLI commands:
-// account/billing/team admin, Slack alerts, feedback, and the cloud-exploration mode
+// account/billing/team admin, feedback, and the cloud-exploration mode
 // (incl. `projects re-explore`) — none of it is part of authoring/editing/running tests,
 // which is all an agent drives over MCP.
 const MCP_HIDDEN_PREFIXES = [
-    "slack",
     "account",
     "billing",
     "feedback",
@@ -61,7 +59,6 @@ export const commands = [
     ...runCommands,
     ...explorationCommands,
     ...configCommands,
-    ...slackCommands,
     ...mailboxCommands,
     ...testAccountCommands,
     ...accountCommands,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beryl-so/cli",
-  "version": "0.24.1",
+  "version": "0.27.0",
   "description": "Beryl on the command line — projects, runs, the exploring agent, and an MCP server over the same commands.",
   "license": "MIT",
   "type": "module",

package/dist/commands/slack.js

@@ -1,82 +0,0 @@
-import { arg, flagBool, projectPath } from "./util.js";
-const slackPath = (ws, p) => `${projectPath(ws, p)}/slack`;
-export const slackCommands = [
-    {
-        name: "slack show",
-        summary: "Show the project's Slack alert config (webhook is masked)",
-        groupSummary: "Send run outcomes to a Slack channel via a per-project incoming webhook.",
-        scope: "project",
-        groupDefault: true,
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            return { data: await ctx.client.get(slackPath(workspaceId, projectId)) };
-        },
-    },
-    {
-        name: "slack set-webhook",
-        summary: "Set the Slack incoming-webhook URL run alerts post to",
-        scope: "project",
-        args: [
-            {
-                name: "url",
-                description: "Slack incoming-webhook URL (https://hooks.slack.com/…)",
-                required: true,
-            },
-        ],
-        flags: [
-            {
-                name: "all-runs",
-                type: "boolean",
-                description: "Post on every run, not only on a new regression",
-            },
-            {
-                name: "failures-only",
-                type: "boolean",
-                description: "Post only on a new regression (the default)",
-            },
-        ],
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            const path = slackPath(workspaceId, projectId);
-            // Preserve the stored notify preference unless the caller states one, so
-            // rotating the webhook doesn't silently reset an existing all-runs opt-in.
-            let notifyAllRuns;
-            if (flagBool(input, "all-runs")) {
-                notifyAllRuns = true;
-            }
-            else if (flagBool(input, "failures-only")) {
-                notifyAllRuns = false;
-            }
-            else {
-                const current = (await ctx.client.get(path));
-                notifyAllRuns = current?.notify_all_runs ?? false;
-            }
-            return {
-                data: await ctx.client.put(path, {
-                    webhook_url: arg(input, "url"),
-                    notify_all_runs: notifyAllRuns,
-                }),
-            };
-        },
-    },
-    {
-        name: "slack clear",
-        summary: "Remove the project's Slack webhook (stops all alerts)",
-        scope: "project",
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            await ctx.client.del(slackPath(workspaceId, projectId));
-            return { human: "Cleared." };
-        },
-    },
-    {
-        name: "slack test",
-        summary: "Post a sample alert to the configured webhook",
-        scope: "project",
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            await ctx.client.post(`${slackPath(workspaceId, projectId)}/test`);
-            return { human: "Sent a test message to Slack." };
-        },
-    },
-];

package/dist/email-extract.js

@@ -1,99 +0,0 @@
-import vm from "node:vm";
-// A labelled digit run ("your code is 654321") beats the bare fenced pattern, because a
-// real sign-in mail is full of innocent 4-8 digit runs — "© 2026", a support number —
-// and the bare fence would happily return the first of them.
-const CODE_PATTERN = /(?<!\d)(\d{4,8})(?!\d)/;
-const LABELLED_CODE_PATTERN = /(?:verification|security|one[\s-]?time|login|sign[\s-]?in|access|confirmation)?\s*(?:code|otp|passcode|pin)\b[^0-9]{0,20}(?<!\d)(\d{4,8})(?!\d)/i;
-const LINK_PATTERN = /https:\/\/[^\s"'<>)\]]+/;
-// An anchor's href is the click target in an HTML mail; a bare URL scan over raw markup
-// would return a CSS background or tracking pixel instead.
-const HREF_PATTERN = /<a\b[^>]*\bhref\s*=\s*["']?(https:\/\/[^\s"'>]+)/gi;
-// Footer furniture a sign-in mail carries but nobody means.
-const LINK_NOISE = [
-    "unsubscribe",
-    "/privacy",
-    "/terms",
-    "list-manage",
-    "mailchimp",
-    "sendgrid.net",
-    "/track/",
-    "/wf/open",
-    "twitter.com",
-    "facebook.com",
-    "linkedin.com",
-];
-// Matches the server's EMAIL_PATTERN_MAX_BODY_CHARS bound: backtracking cost scales with
-// haystack length, and no real sign-in code lives past the first few KB of an email.
-const PATTERN_MAX_BODY_CHARS = 20_000;
-const PATTERN_TIMEOUT_MS = 2_000;
-// An author-supplied regex against a sender-supplied body is the textbook ReDoS setup,
-// and native RegExp cannot be interrupted once it starts. Running the match inside a vm
-// context gives it a real wall-clock deadline — V8 services the timeout interrupt while
-// backtracking — matching the server's regex-engine timeout, whatever the pattern is.
-function matchWithDeadline(haystack, pattern) {
-    try {
-        return vm.runInNewContext("haystack.match(new RegExp(pattern))", { haystack, pattern }, { timeout: PATTERN_TIMEOUT_MS });
-    }
-    catch (err) {
-        const code = err?.code;
-        if (code === "ERR_SCRIPT_EXECUTION_TIMEOUT" || /timed out/i.test(String(err))) {
-            throw new Error("the extract_pattern took too long to match this email — it backtracks " +
-                "explosively (an ambiguous quantifier like (a+)+ or (a|a)+ does this). " +
-                "Rewrite it to match unambiguously.");
-        }
-        throw err;
-    }
-}
-export function visibleText(html) {
-    return html
-        .replace(/<(style|script|head)\b[\s\S]*?<\/\1>/gi, " ")
-        .replace(/<[^>]+>/g, " ");
-}
-function bodyOf(email) {
-    if (email.body_text)
-        return email.body_text;
-    if (email.body_html)
-        return visibleText(email.body_html);
-    return "";
-}
-export function extractCode(email) {
-    for (const pattern of [LABELLED_CODE_PATTERN, CODE_PATTERN]) {
-        for (const text of [bodyOf(email), email.subject ?? ""]) {
-            const match = text.match(pattern);
-            if (match)
-                return match[1];
-        }
-    }
-    return null;
-}
-export function extractLink(email) {
-    const html = email.body_html ?? "";
-    const hrefs = [...html.matchAll(HREF_PATTERN)].map((m) => m[1]);
-    const candidates = hrefs.length > 0 ? hrefs : (bodyOf(email).match(LINK_PATTERN) ?? []);
-    for (const url of candidates) {
-        if (!LINK_NOISE.some((noise) => url.toLowerCase().includes(noise)))
-            return url;
-    }
-    if (candidates.length > 0) {
-        throw new Error("the email's only links look like footer/unsubscribe links, not a sign-in link");
-    }
-    throw new Error("the email arrived but carried no https link to follow");
-}
-export function extractValue(email, extract, pattern) {
-    if (extract === "link")
-        return extractLink(email);
-    const body = bodyOf(email);
-    if (extract === "pattern") {
-        if (!pattern)
-            throw new Error("extract=pattern needs an extract_pattern");
-        const match = matchWithDeadline(body.slice(0, PATTERN_MAX_BODY_CHARS), pattern);
-        if (!match) {
-            throw new Error("the email arrived but nothing in it matched the extract_pattern");
-        }
-        return match[1] ?? match[0];
-    }
-    const code = extractCode(email);
-    if (!code)
-        throw new Error("the email arrived but carried no 4-8 digit sign-in code");
-    return code;
-}