@paxnax/berliner 0.5.0 → 0.5.2

package/dist/agents/codex.js

@@ -9,8 +9,8 @@ export async function readCodex(rolloutPath) {
     let taskUrl = null;
     let latest = zero;
     let latestTotal = 0;
-    // A resumed session restarts the running total in the same rollout, so the totals before each restart are carried over.
-    let carried = zero;
+    let latestLast = 0;
+    const byModel = {};
     for await (const e of jsonl(rolloutPath)) {
         span.add(e.timestamp);
         const p = e.payload;
@@ -29,18 +29,26 @@ export async function readCodex(rolloutPath) {
         if (!u)
             continue;
         const total = num(u.total_tokens);
-        // shortcut: an overflow reset whose first total exceeds the running total is missed; compare every count instead of total_tokens if that shows up.
-        if (total < latestTotal)
-            carried = addTokens(carried, latest);
-        latestTotal = total;
-        latest = {
+        const last = num(p?.info?.last_token_usage?.total_tokens);
+        // A resumed session restarts the running total in the same rollout: it drops, or its first count is just its own last request.
+        // A repeat of the previous event, last request included, is a duplicate notification.
+        // shortcut: a restart after a one-request run of the same size reads as a duplicate; use a run marker if Codex adds one.
+        const dup = total === latestTotal && last === latestLast;
+        const restart = total < latestTotal || (latestTotal > 0 && total === last && !dup);
+        const cur = {
             input: Math.max(0, num(u.input_tokens) - num(u.cached_input_tokens) - num(u.cache_write_input_tokens)),
             output: num(u.output_tokens),
             cacheRead: num(u.cached_input_tokens),
             cacheWrite: num(u.cache_write_input_tokens),
             cacheWrite1h: 0,
         };
+        // Each event's growth goes to the model it was made with, so a switch mid-session splits the usage.
+        const delta = Object.fromEntries(Object.entries(cur).map(([k, v]) => [k, restart ? v : Math.max(0, v - latest[k])]));
+        if (model)
+            byModel[model] = addTokens(byModel[model] ?? zero, delta);
+        latestTotal = total;
+        latestLast = last;
+        latest = cur;
     }
-    const tokens = addTokens(carried, latest);
-    return { model, tokensByModel: model ? { [model]: tokens } : {}, costUsd: null, startedAt: span.first, endedAt: span.last, firstPrompt, taskUrl };
+    return { model, tokensByModel: byModel, costUsd: null, startedAt: span.first, endedAt: span.last, firstPrompt, taskUrl };
 }

package/dist/client.js

@@ -11,7 +11,7 @@ export class CliError extends Error {
 }
 export const absolute = (cfg, path) => cfg.url.replace(/\/+$/, "") + path;
 export async function request(cfg, method, path, body, opts = {}) {
-    const { timeoutMs = 10_000, retries = 3, deadlineMs = 15_000, auth = true } = opts;
+    const { timeoutMs = 10_000, retries = 3, deadlineMs = 15_000, auth = true, headers = {} } = opts;
     if (auth && !cfg.token)
         throw new CliError("No API token: run `npx @paxnax/berliner@latest setup`, or set BERLINER_TOKEN.", "usage");
     // One budget for all attempts, so a hung server can't hold the agent's pipeline for long (anti-goal 1).
@@ -28,6 +28,7 @@ export async function request(cfg, method, path, body, opts = {}) {
                 headers: {
                     ...(auth ? { Authorization: `Bearer ${cfg.token}` } : {}),
                     ...(body === undefined ? {} : { "Content-Type": raw ? "application/octet-stream" : "application/json" }),
+                    ...headers,
                 },
                 // A Uint8Array is sent as-is (evidence bytes); fetch sets its Content-Length.
                 body: body === undefined ? undefined : raw ? body : JSON.stringify(body),

package/dist/commands/delete.js

@@ -1,18 +1,20 @@
 import { createInterface } from "node:readline/promises";
 import { CliError, request } from "../client.js";
 export async function del(cfg, values, positionals) {
-    if (positionals.length !== 1)
+    // A blank --evidence must not fall through to deleting the whole session.
+    const { evidence } = values;
+    if (positionals.length !== 1 || (evidence && (evidence.length !== 1 || !evidence[0].trim())))
         throw new CliError("usage: berliner delete <session-id> [--evidence <id>] [--yes]", "usage");
     const id = positionals[0];
-    const evidenceId = values.evidence?.[0];
-    if (evidenceId) {
+    const evidenceId = evidence?.[0];
+    if (evidenceId !== undefined) {
         // Evidence ids are global, so the session named on the command line must actually hold this one.
         const { json } = await request(cfg, "GET", `/v1/sessions/${encodeURIComponent(id)}`);
         if (!json.session.evidence.some((e) => e.id === evidenceId)) {
             throw new CliError(`evidence ${evidenceId} is not part of session ${id}`, "usage");
         }
     }
-    const question = evidenceId ? `Delete evidence ${evidenceId} of session ${id}? [y/N] ` : `Delete session ${id} and its evidence? [y/N] `;
+    const question = evidenceId !== undefined ? `Delete evidence ${evidenceId} of session ${id}? [y/N] ` : `Delete session ${id} and its evidence? [y/N] `;
     if (!values.yes) {
         if (!process.stdin.isTTY)
             throw new CliError("refusing to delete without confirmation; pass --yes to delete without a prompt", "usage");
@@ -24,7 +26,7 @@ export async function del(cfg, values, positionals) {
             return;
         }
     }
-    if (evidenceId) {
+    if (evidenceId !== undefined) {
         await request(cfg, "DELETE", `/v1/evidence/${encodeURIComponent(evidenceId)}`);
         console.log(`Deleted evidence ${evidenceId}.`);
     }

package/dist/commands/hook.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { appendFileSync, existsSync, mkdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, linkSync, mkdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { findRecord, readClaudeCode, readCodex, readOpenCode, SAFE_ID } from "../agents/index.js";
@@ -28,15 +28,16 @@ export function inTool(env) {
     return null;
 }
 // The session's facts from the tool's own record, with a cost estimated wherever the tool stores none; the cost stays null when
-// no prices load. Claude Code and Codex name the record in the hook payload, and OpenCode's plugin sends the session itself;
-// otherwise it is looked up. Null without a record.
+// no prices load. Claude Code and Codex name the record in the hook payload; otherwise it is looked up. OpenCode's plugin sends
+// the session itself too, used only without a saved record. Null without a record.
 export async function sessionFacts(tool, sessionId, env, payload = {}) {
     let facts;
-    if (tool === "opencode" && payload.session)
+    const named = typeof payload.transcript_path === "string" && payload.transcript_path ? payload.transcript_path : null;
+    const file = named ?? (await findRecord(tool, sessionId, env));
+    // The plugin saves the record, in order, before it spawns each reporter, so a reporter that runs late still finds the newest.
+    if (tool === "opencode" && !file && payload.session)
         facts = readOpenCode(payload.session);
     else {
-        const named = typeof payload.transcript_path === "string" && payload.transcript_path ? payload.transcript_path : null;
-        const file = named ?? (await findRecord(tool, sessionId, env));
         if (!file)
             return null;
         if (tool === "claude-code")
@@ -152,15 +153,36 @@ async function child(tool, file, env) {
         clearTimeout(timer);
     }
 }
-// A lock younger than a minute belongs to a running child. An older one was left by a child that died: it is removed and
-// created again with wx, so of two children that find it stale only one gets it, and the other exits as for a held lock.
-function takeLock(lock) {
+// A lock younger than a minute belongs to a running child. An older one was left by a child that died: it is moved aside and
+// removed only if it is the very lock that was checked, so of two children that find it stale only one gets it.
+export function takeLock(lock) {
     if (createLock(lock))
         return true;
-    if (Date.now() - (statSync(lock, { throwIfNoEntry: false })?.mtimeMs ?? 0) < LOCK_MS)
+    const seen = statSync(lock, { throwIfNoEntry: false });
+    // Gone since: its child just unlocked, so it is free, not stale.
+    if (!seen)
+        return createLock(lock);
+    if (Date.now() - seen.mtimeMs < LOCK_MS)
         return false;
-    // shortcut: a child that found the lock stale just before another one replaced it removes the new lock; this needs a child to have died.
-    rmSync(lock, { force: true });
+    const aside = `${lock}.${process.pid}`;
+    try {
+        renameSync(lock, aside);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+    if (statSync(aside).ino !== seen.ino) {
+        // shortcut: a third child can lock in the moment before this lock is put back; that needs a dead child and three at once.
+        try {
+            linkSync(aside, lock);
+        }
+        catch { }
+        rmSync(aside, { force: true });
+        return false;
+    }
+    rmSync(aside, { force: true });
     return createLock(lock);
 }
 function createLock(lock) {
@@ -209,10 +231,14 @@ async function send(tool, file, env) {
     catch (err) {
         if (!(err instanceof CliError && err.status === 404))
             throw err;
-        // shortcut: an agent report landing between the 404 and this PUT gets the derived title; a create-only call would close that.
         // The plan is BERLINER_PLAN from the tool's environment, else the server's pick from the user's subscriptions. A new
-        // session needs a cost: 0 until prices load.
-        const create = (plan) => request(cfg, "PUT", path, { ...body, cost_usd: body.cost_usd ?? 0, title: derivedTitle(facts.firstPrompt, git), plan });
+        // session needs a cost: 0 until prices load. Create-only: when an agent report created the session since the 404 (412),
+        // only the machine's fields are sent. A server that ignores the header overwrites the title, as before.
+        const create = (plan) => request(cfg, "PUT", path, { ...body, cost_usd: body.cost_usd ?? 0, title: derivedTitle(facts.firstPrompt, git), plan }, { headers: { "If-None-Match": "*" } }).catch((err) => {
+            if (err instanceof CliError && err.status === 412)
+                return request(cfg, "PATCH", path, body);
+            throw err;
+        });
         try {
             saved = await create(cfg.plan ?? undefined);
         }

package/dist/commands/report.js

@@ -43,9 +43,8 @@ export async function report(cfg, values, positionals, env) {
     if (json_)
         print({ data: { ...json, evidence: result }, text }, true);
     else {
-        console.log(`Evidence: ${result.uploaded} uploaded, ${result.existing} already uploaded, ${result.skipped.length} skipped.`);
-        for (const p of result.published ?? [])
-            console.log(p.markdown);
+        const summary = `Evidence: ${result.uploaded} uploaded, ${result.existing} already uploaded, ${result.skipped.length} skipped.`;
+        print({ data: result, text: [summary, ...(result.published ?? []).map((p) => p.markdown)].join("\n") }, false);
     }
     for (const s of result.skipped)
         warn(`${s.path}: ${s.reason}`);

package/dist/commands/setup.js

@@ -114,7 +114,8 @@ export async function setup(env, values) {
     }
     let installFailed = false;
     if (!values["no-install"]) {
-        const run = spawnSync(install[0], install.slice(1), { encoding: "utf8" });
+        // From home, so the install never picks up the cwd's .npmrc.
+        const run = spawnSync(install[0], install.slice(1), { encoding: "utf8", cwd: homedir() });
         installFailed = run.status !== 0;
         if (!installFailed)
             console.log(`✓ Installed berliner ${version}`);

package/dist/commands/upgrade.js

@@ -1,12 +1,15 @@
 import { spawnSync } from "node:child_process";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { dirname } from "node:path";
+import { gunzipSync } from "node:zlib";
 import { CliError } from "../client.js";
 import { hookPath, updatedHooks } from "../setup/hooks.js";
 import { detectTools, skillTargets } from "../setup/targets.js";
 import { confirm, installCommand, showPlan, tilde } from "./setup.js";
+const registryOf = (env) => (env.npm_config_registry || "https://registry.npmjs.org").replace(/\/+$/, "");
 async function latestVersion(env) {
-    const registry = (env.npm_config_registry || "https://registry.npmjs.org").replace(/\/+$/, "");
+    const registry = registryOf(env);
     try {
         const res = await fetch(`${registry}/@paxnax/berliner/latest`);
         if (!res.ok)
@@ -21,15 +24,35 @@ async function latestVersion(env) {
     }
 }
 // The skill text comes from the release being installed, so the plan's "already up to date" and what is written match it.
-function skillOf(version, bundled) {
+// It is read out of the release tarball as data: running the release (npx) would load the cwd's .npmrc and node_modules.
+async function skillOf(version, bundled, env) {
     if (bundled)
         return readFileSync(new URL("../../skill/SKILL.md", import.meta.url), "utf8");
-    // --bun keeps the CLI on Bun: its shebang prefers node when both exist.
-    const [cmd, ...pre] = process.versions.bun ? ["bunx", "--bun"] : ["npx", "--yes"];
-    const run = spawnSync(cmd, [...pre, `@paxnax/berliner@${version}`, "skill"], { encoding: "utf8" });
-    if (run.status !== 0 || !run.stdout)
-        throw new CliError(`Could not read the skill of berliner ${version} (${(run.error?.message ?? run.stderr).trim() || `exited with ${run.status}`}). Nothing was changed.`, "network");
-    return run.stdout;
+    try {
+        const meta = await fetch(`${registryOf(env)}/@paxnax/berliner/${version}`);
+        if (!meta.ok)
+            throw new Error(`HTTP ${meta.status}`);
+        const { dist } = (await meta.json());
+        if (typeof dist?.tarball !== "string")
+            throw new Error("no tarball in the reply");
+        const res = await fetch(dist.tarball);
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status}`);
+        const tar = gunzipSync(Buffer.from(await res.arrayBuffer()));
+        // shortcut: plain ustar names only (no pax or GNU long names), enough for npm's short paths; parse pax if a path passes 100 bytes.
+        const field = (at, end) => tar.toString("utf8", at, end).split("\0")[0];
+        for (let at = 0; at + 512 <= tar.length && tar[at];) {
+            const prefix = field(at + 345, at + 500);
+            const size = Number.parseInt(field(at + 124, at + 136).trim() || "0", 8);
+            if (`${prefix && `${prefix}/`}${field(at, at + 100)}` === "package/skill/SKILL.md")
+                return tar.toString("utf8", at + 512, at + 512 + size);
+            at += 512 + Math.ceil(size / 512) * 512;
+        }
+        throw new Error("no skill/SKILL.md in the package");
+    }
+    catch (err) {
+        throw new CliError(`Could not read the skill of berliner ${version} (${err.message}). Nothing was changed.`, "network");
+    }
 }
 // Release versions only (x.y.z): the registry's latest tag never points at a prerelease.
 const newer = (a, b) => {
@@ -49,7 +72,7 @@ const sameAs = (path, text) => {
 const HOOK_CHANGE = {
     "claude-code": "the reminder also runs on startup and resume",
     codex: "the reminder also runs on startup and resume",
-    opencode: "the new reminder",
+    opencode: "the new reminder, and totals saved in order",
 };
 // The command, the skill, and Berliner hooks already installed: the token and config are setup's, as is adding a hook.
 export async function upgrade(env, values) {
@@ -61,9 +84,9 @@ export async function upgrade(env, values) {
     const install = installCommand(latest);
     const tools = detectTools(env);
     const targets = values["no-skill"] ? [] : skillTargets(tools, env);
-    const skill = targets.length ? skillOf(target, !installing) : "";
+    const skill = targets.length ? await skillOf(target, !installing, env) : "";
     let stale = targets.filter((t) => !sameAs(t.path, skill));
-    // Computed now, so what is written is what the plan showed.
+    // Computed now, for the plan.
     const hooks = tools.flatMap((tool) => {
         const path = hookPath(tool.id, env);
         const text = updatedHooks(tool.id, path);
@@ -107,7 +130,8 @@ export async function upgrade(env, values) {
         console.log();
     }
     if (installing) {
-        const run = spawnSync(install[0], install.slice(1), { encoding: "utf8" });
+        // From home, so the install never picks up the cwd's .npmrc.
+        const run = spawnSync(install[0], install.slice(1), { encoding: "utf8", cwd: homedir() });
         if (run.status !== 0) {
             console.error(`✗ Could not install the berliner command:\n${(run.error?.message ?? run.stdout + run.stderr).trimEnd()}`);
             throw new CliError(`The skill was left as it is. Install the command yourself, then run upgrade again:  ${install.join(" ")}`, "usage");
@@ -129,9 +153,15 @@ export async function upgrade(env, values) {
         }
     }
     for (const h of hooks) {
+        // Merged again into the file as it is now, so an edit made during the prompt or the install is kept. The plugin is the one
+        // the plan showed: the install may have replaced this package's copy.
+        // shortcut: an edit between this read and write is still lost; lock if that shows up.
+        const text = h.id === "opencode" ? h.text : updatedHooks(h.id, h.path);
+        if (text === null)
+            continue;
         try {
             // In place, so a settings file that is a symlink stays one.
-            writeFileSync(h.path, h.text);
+            writeFileSync(h.path, text);
             console.log(`✓ ${h.name} hook: ${tilde(h.path)}`);
         }
         catch (err) {

package/dist/output.js

@@ -1,12 +1,14 @@
+// Stored text must not drive the terminal (OSC 52, cursor moves); one char for one keeps table widths.
+const safe = (s) => s.replace(/(?![\t\n])\p{Cc}/gu, "\ufffd");
 export function print(result, json) {
-    console.log(json ? JSON.stringify(result.data, null, 2) : result.text);
+    console.log(json ? JSON.stringify(result.data, null, 2) : safe(result.text));
 }
 // Always a single line, so agents and CI logs see exactly one warning.
 export function warn(msg) {
-    console.error(`berliner: ${msg.replace(/\s*\n\s*/g, " ")}`);
+    console.error(`berliner: ${safe(msg.replace(/\s*\n\s*/g, " "))}`);
 }
 // GitHub renders an image from Markdown but not a video from another host, so a video is its bare URL.
-export const embed = (e, url) => e.kind === "video" ? url : `![${(e.caption || e.filename).replace(/[[\]]/g, "\\$&")}](${url})`;
+export const embed = (e, url) => e.kind === "video" ? url : `![${(e.caption || e.filename).replace(/\s*\n\s*/g, " ").replace(/[\\[\]]/g, "\\$&")}](${url})`;
 // Same wording as the web's mergeLabel (app/src/web/format.ts).
 const MERGE = { open: "Open", merged: "Merged", closed: "Closed", none: "No PRs" };
 export const mergeLabel = (s) => s.pr_count > 1 ? `${s.merged_count} of ${s.pr_count} merged` : (MERGE[s.merge] ?? s.merge);

package/opencode/berliner.js

@@ -26,6 +26,9 @@ const MAX_DEPTH = 10;
 
 const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : 0);
 const get = async (client, id) => (await client.session.get({ path: { id } }))?.data;
+// Resolves with p, or with undefined after ms: an SDK call that never answers must not hold up OpenCode. Unreferenced, so a
+// pending deadline never keeps a process alive.
+const within = (p, ms) => Promise.race([p, new Promise((r) => setTimeout(r, ms).unref?.())]);
 
 // One agent session is one Berliner session: a subagent's child session belongs to the top-level session above it.
 async function topLevelId(client, id) {
@@ -77,20 +80,35 @@ async function save(client, sessionID) {
   return session;
 }
 
-async function report(client, event, sessionID) {
-  try {
-    const session = await save(client, sessionID);
-    if (!session) return;
-    // Detached and unreferenced: OpenCode never waits on it.
-    const child = spawn("berliner", ["hook", "opencode"], { detached: true, stdio: ["pipe", "ignore", "ignore"] });
-    child.on("error", () => {});
-    child.stdin.on("error", () => {});
-    child.stdin.end(JSON.stringify({ event, session }));
-    child.unref();
-  } catch {
-    // A report that can't be sent is skipped; the next idle sends the latest totals.
-  }
-}
+// One session's saves run one at a time, in the order they came, so an older total never overwrites a newer one. A save that
+// hangs holds the next one up for 10 seconds at most.
+// shortcut: only within this OpenCode process; two `berliner hook` processes can still write out of order, lock there if that shows up.
+// shortcut: a save that resumes after its deadline can write older totals; the next save rewrites them.
+const queues = new Map();
+const serial = (id, fn) => {
+  const p = (queues.get(id) ?? Promise.resolve()).then(fn, fn);
+  queues.set(
+    id,
+    within(p, 10_000).catch(() => {}),
+  );
+  return p;
+};
+
+const report = (client, event, sessionID) =>
+  serial(sessionID, async () => {
+    try {
+      const session = await save(client, sessionID);
+      if (!session) return;
+      // Detached and unreferenced: OpenCode never waits on it.
+      const child = spawn("berliner", ["hook", "opencode"], { detached: true, stdio: ["pipe", "ignore", "ignore"] });
+      child.on("error", () => {});
+      child.stdin.on("error", () => {});
+      child.stdin.end(JSON.stringify({ event, session }));
+      child.unref();
+    } catch {
+      // A report that can't be sent is skipped; the next idle sends the latest totals.
+    }
+  });
 
 export const BerlinerPlugin = async ({ client }) => ({
   "shell.env": async (input, output) => {
@@ -98,11 +116,15 @@ export const BerlinerPlugin = async ({ client }) => ({
       if (!input?.sessionID) return;
       output.env.OPENCODE_SESSION_ID = input.sessionID;
       // A subagent's shell gets the top-level session, so a `berliner report` the agent runs there doesn't split it off.
-      const top = await topLevelId(client, input.sessionID);
+      // A second each at most: past it the shell keeps the id it was given, or runs before the save is done.
+      const top = await within(topLevelId(client, input.sessionID), 1000);
       if (!top) return;
       output.env.OPENCODE_SESSION_ID = top;
       // So that report finds the totals before the session's first idle. Not reported from here: that waits for idle.
-      await save(client, top);
+      await within(
+        serial(top, () => save(client, top)),
+        1000,
+      );
     } catch {
       // Never fail the agent's shell.
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paxnax/berliner",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Report coding-agent sessions to Berliner",
   "type": "module",
   "engines": {