@brokkai/slopcop 0.0.6 → 0.0.8

package/README.md

@@ -25,16 +25,17 @@ prompts, one request, and the analyzer's exit contract.
 
 ## Install
 
-npm, PyPI, the release archive, and the PowerShell installer all install the
-same release binary for macOS, Linux, and Windows on x64 and arm64, so
-`slopcop version` reports which release it came from. The Go toolchain can
-build that binary from source instead.
+npm, PyPI, the release archive, and the shell and PowerShell installers all
+install the same release binary for macOS, Linux, and Windows on x64 and
+arm64, so `slopcop version` reports which release it came from. The Go
+toolchain can build that binary from source instead.
 
 | Channel | Platforms | Needs |
 | --- | --- | --- |
 | [npm](#npm) | macOS, Linux, Windows | Node 22 or newer |
 | [PyPI](#pypi) | macOS, Linux, Windows | Python 3.9 or newer |
 | [Release archive](#release-archive) | macOS, Linux, Windows | nothing |
+| [Shell installer](#shell-installer) | macOS, Linux | curl |
 | [PowerShell installer](#powershell-installer) | Windows | PowerShell |
 | [Go](#go) | built from source | Go 1.25 or newer |
 
@@ -78,6 +79,17 @@ tar -xzf "slopcop_v${ver}_${os}_${arch}.tar.gz" slopcop
 sudo install -m 755 slopcop /usr/local/bin/slopcop
 ```
 
+### Shell installer
+
+```console
+curl -fsSL https://raw.githubusercontent.com/BrokkAi/slopcop/master/install.sh | sh
+```
+
+It takes the latest release, verifies the archive against `checksums.txt`,
+installs `slopcop` to `$HOME/.local/bin`, and adds that directory to the
+shell profile. `SLOPCOP_VERSION`, `SLOPCOP_INSTALL_DIR`, and
+`SLOPCOP_NO_MODIFY_PATH` override its defaults.
+
 ### PowerShell installer
 
 ```powershell
@@ -101,8 +113,9 @@ its version; in a clone, `make install` stamps the version from `git describe`.
 ## Enable it in an agent
 
 The binary carries the agent skill that teaches a coding agent how to run
-slopcop. `slopcop init` installs it into each well-known skills directory whose
-harness is present, and names what it did:
+slopcop, plus an automatic check hook for Claude Code and Codex. `slopcop init`
+installs the skill into each well-known skills directory whose harness is
+present, and names what it did:
 
 | Location | Harness |
 | --- | --- |
@@ -117,6 +130,47 @@ so an agent follows the instructions of the slopcop version it runs; local
 edits to an installed skill do not survive them. `slopcop init --no-skill`
 skips the install and any update of it.
 
+Init also adds a `Stop` hook for each harness installed here, and leaves
+everything else in the file as it was:
+
+| File | Harness |
+| --- | --- |
+| `settings.json` under `CLAUDE_CONFIG_DIR`, or `~/.claude` | Claude Code |
+| `hooks.json` under `CODEX_HOME`, or `~/.codex` | Codex |
+
+Codex runs a new or changed hook only once you trust it: open Codex and review
+it with `/hooks`. Init never writes that trust itself, and reminds you each
+time it runs, since Codex says nothing of a hook it skips. The hook stays the
+same from one release to the next, so an update does not ask for it again.
+
+When the agent stops, the hook checks the working tree through the same
+hosted API, but only when all of these hold:
+
+- the session wrote files in the repository with its edit tools (a Codex
+  session's subagents included);
+- slopcop is signed in, and the workspace a check would use
+  (`$SLOPCOP_WORKSPACE`, or the login's) has the repository active
+  (`slopcop repo list`), so nothing is sent from other repositories;
+- the tree differs from the last check in the session, including a check the
+  agent ran by hand.
+
+New findings in files the session wrote are handed to the agent to fix, once
+for a given tree and at most twice in a row; then the agent is let go and you
+are told what remains. A finding ignored with `slopcop ignore` is not handed
+back. New findings in other files on the branch are only mentioned. The hook
+never keeps the agent going on its own failures: a refusal the service calls
+final, such as an expired login, is reported once and the hook stays quiet for
+the rest of the session, until a check by hand completes; a brief outage is
+only reported. The hook runs as `slopcop hook claude || true` (and
+`slopcop hook codex || true`, or `|| exit /b 0` under Windows' `cmd`), so even
+a `slopcop` that cannot run it, such as an older one first on `PATH`, lets the
+agent stop; init warns when that is the case, because no check would run.
+
+Use `slopcop init --no-hooks` to install only the skill, or
+`slopcop init --remove-hooks` to remove SlopCop's hooks and nothing else.
+Ordinary checks do not reinstall a removed hook. The skill remains the way to
+check from other harnesses.
+
 ## Sign in
 
 ```console
@@ -137,6 +191,7 @@ Precedence:
 | --- | --- |
 | Service URL | `--service`, `$SLOPCOP_SERVICE`, stored by `slopcop login`, `https://slopcop.com` |
 | Token | `$SLOPCOP_TOKEN`, stored value |
+| Workspace (`check`, `ignore`, `repo`) | `-w`/`--workspace`, `$SLOPCOP_WORKSPACE`, the one the login is bound to |
 
 ## Workspace and repositories
 
@@ -147,6 +202,7 @@ active in the browser when the login was approved.
 slopcop whoami                     # account, this login's workspace, its plan, the service URL
 slopcop workspace list             # the account's workspaces; * marks this login's
 slopcop workspace use "Acme team"  # move this login (not the browser) to another, by name or id
+slopcop check -w "Acme team"       # check in, and bill, another workspace this once
 slopcop repo list                  # the workspace's repositories: active, disabled, or over the limit
 slopcop repo disable acme/widgets  # stop checking and charging for one (owner only)
 slopcop repo enable acme/widgets   # turn it back on, within the workspace's active limit
@@ -160,9 +216,22 @@ one is not checked or charged and keeps its reports, findings and settings.
 and refuse when stdin is not a terminal: an agent or CI job runs with your
 login, and the service cannot tell it from you, so changing what the workspace
 pays stays a step you take yourself.
+`workspace use` moves every agent and script using this login, not only the
+one that runs it, so it asks `[y/N]` and refuses when stdin is not a terminal.
+To check in another workspace without moving anyone, `check`, `ignore` and
+`repo` take `-w`/`--workspace <name|id>` (or `$SLOPCOP_WORKSPACE`) for that one
+command; the login stays where it was. Give agents that share a login their
+own `--workspace` instead of switching it.
+
 Names match without regard to case; when two workspaces share a name, or two
 providers a repository name, pass the id the listing prints. There is no `repo
-add`: a first check adds a repository. Deleting repositories, archiving
+add`: a first check adds a repository. When the workspace would then pay for
+it (it already has an active repository and is charged), the service refuses
+the check with `repository_add_unconfirmed` until a person confirms: at a
+terminal `check` prints what it costs, asks `Add owner/name to "Workspace"?
+[y/N]`, and on a yes sends the check again; with no terminal, as for an agent
+or CI, it exits `2` with the service's remedy. A workspace's first repository
+is added without asking. Deleting repositories, archiving
 workspaces, members, credits and repository settings stay in the web app. The
 commands exit `0` on success and `2` with the service's message and remedy
 otherwise, as `ignore` does.
@@ -195,6 +264,7 @@ Flags:
 | `--policy PATH` | repository-relative `.rqlp` file to evaluate (repeatable) |
 | `--no-policy-discovery` | skip `.slopcop/policies` rules |
 | `--timeout DURATION` | how long to wait for the result (default `10m`) |
+| `-w`, `--workspace NAME\|ID` | check in, and bill, this workspace of the account instead of the login's |
 | `--verbose` | print the resolved request to stderr |
 
 ### What is sent
@@ -269,7 +339,7 @@ check outside your workspace.
 The service answers structured data; the CLI renders it. `human` prints one
 block per new finding, with an `ID:` line when the service names one, then a
 summary line such as `1 new finding across 1 file(s); 72 already in the code |
-Analysis complete`, and any omitted or
+Analysis complete`, and any omitted new findings or
 incomplete checks. `json` prints `status`, `baseCommit`, `summary`
 (`newFindings` and `existingFindings` count the split), `findings` (each with
 `new` and its `id`), `incomplete`, and `failure` when the analysis did not
@@ -292,12 +362,12 @@ interrupted check prints no report. Interrupted before it was sent, nothing
 reached the service; after, a service that received it keeps running it, and
 running the same check again picks up its result.
 
-An inconclusive check fails the check only when it concerns a file the
-change writes. One about other files is listed on an `Inconclusive outside
-the change` line (`inconclusiveElsewhere` in `json`, a `note` notification in
-`sarif`) and never changes the exit code. A check that timed out counts
-wherever it is. The service can place an inconclusive check only once Bifrost
-reports which files it concerns; until then every one counts as in the change.
+An inconclusive check, one that ran but could not prove there is nothing
+more to find, never changes the exit code and is not named in any format.
+Complete proof is rare in static analysis, typically at a library boundary,
+so this is the norm rather than a gap. `summary.inconclusive` counts them in
+`json`, as does `slopcop.inconclusive` in `sarif`. A check that timed out or
+that Bifrost judged unreliable is incomplete and counts wherever it is.
 
 The service applies `--fail-on` and sets the status; the exit code follows it.
 The CLI always sends `--fail-on`, defaulting to `finding`: a check fails only
@@ -323,7 +393,8 @@ rewrite them. The remedies name no client, so the CLI adds its own command
 after some: `slopcop login` when the remedy is to sign in, the listing to
 choose from after `workspace_not_found` or `workspace_repository_not_found`,
 and `slopcop whoami` after `repository_disabled`, since the workspace that
-disabled it is the one this login is bound to. A failed request prints no
+disabled it is the one this login is bound to, and `--workspace` after
+`owner_required`. A failed request prints no
 report on stdout.
 
 ## API
@@ -336,11 +407,16 @@ The CLI calls `POST <service>/v1/check` with a bearer token:
   "baseCommit": "0123456789abcdef0123456789abcdef01234567",
   "change": "<base64 git patch>",
   "selection": {"files": [".slopcop/policies/rule.rqlp"]},
-  "failOn": "finding"
+  "failOn": "finding",
+  "addRepository": true
 }
 ```
 
-The service rejects any other field. The response carries `status`,
+`addRepository` is sent only after a person confirms adding the repository. The
+service rejects any other field. With `--workspace`, every request, the
+check's, the ignore's and the account routes', carries the workspace's id in
+the `SlopCop-Workspace` header; a name is first looked up with
+`GET <service>/v1/whoami`. The response carries `status`,
 `baseCommit`, `applied`, `summary`, `findings`, `incomplete`, and `failure`
 when the analysis did not complete. Against a service from before findings
 were marked `new`, the CLI treats every finding as new, as that service gated
@@ -414,6 +490,7 @@ Layout:
 | `internal/service` | `/v1/check` client and the wire contract |
 | `internal/report` | human, JSON, and SARIF rendering from the structured response |
 | `internal/config` | stored service URL and token |
+| `internal/hooks` | Claude Code and Codex hook installation and removal |
 | `npm` | launcher, packer, and tests of the `@brokkai/slopcop` package |
 | `packaging/pypi` | wheel packer and launcher of the `brokk-slopcop` package |
 | `skills/slopcop` | the agent skill the binary embeds and installs |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brokkai/slopcop",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Static analysis for coding agents and CI: check a change through the hosted SlopCop API",
   "keywords": [
     "agents",