@paxnax/berliner 0.5.1 → 0.5.3

package/dist/agents/codex.js

@@ -1,5 +1,12 @@
 import { addTokens, jsonl, num, Span, ticketUrl } from "./read.js";
 const zero = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cacheWrite1h: 0 };
+const tokensOf = (u) => ({
+    input: Math.max(0, num(u.input_tokens) - num(u.cached_input_tokens) - num(u.cache_write_input_tokens)),
+    output: num(u.output_tokens),
+    cacheRead: num(u.cached_input_tokens),
+    cacheWrite: num(u.cache_write_input_tokens),
+    cacheWrite1h: 0,
+});
 // Line shapes as Codex 0.162.1 writes them (codex-rs/protocol). input_tokens includes both cached reads and cache writes,
 // as in Codex's own parsing test (100 input = 40 cached + 60 written); reasoning_output_tokens is part of output_tokens.
 export async function readCodex(rolloutPath) {
@@ -9,12 +16,25 @@ export async function readCodex(rolloutPath) {
     let taskUrl = null;
     let latest = zero;
     let latestTotal = 0;
+    let latestLast = 0;
     const byModel = {};
+    // Codex 0.148+ writes a token_usage_record per model response, before its token_count; where present they are the usage.
+    let beforeRecords = null;
+    const records = {};
+    const responses = new Set();
     for await (const e of jsonl(rolloutPath)) {
         span.add(e.timestamp);
         const p = e.payload;
         if (e.type === "turn_context" && typeof p?.model === "string")
             model = p.model;
+        if (e.type === "token_usage_record" && p?.usage) {
+            // A rollout begun on an older Codex and resumed on a newer one counts its earlier part from token_count.
+            beforeRecords ??= { ...byModel };
+            if (model && !(typeof p.response_id === "string" && responses.has(p.response_id))) {
+                responses.add(p.response_id);
+                records[model] = addTokens(records[model] ?? zero, tokensOf(p.usage));
+            }
+        }
         if (e.type !== "event_msg")
             continue;
         if (p?.type === "item_completed" && p.item?.type === "UserMessage" && Array.isArray(p.item.content)) {
@@ -28,21 +48,23 @@ export async function readCodex(rolloutPath) {
         if (!u)
             continue;
         const total = num(u.total_tokens);
+        const last = num(p?.info?.last_token_usage?.total_tokens);
         // A resumed session restarts the running total in the same rollout: it drops, or its first count is just its own last request.
-        const restart = total < latestTotal || (total > latestTotal && latestTotal > 0 && total === num(p?.info?.last_token_usage?.total_tokens));
-        const cur = {
-            input: Math.max(0, num(u.input_tokens) - num(u.cached_input_tokens) - num(u.cache_write_input_tokens)),
-            output: num(u.output_tokens),
-            cacheRead: num(u.cached_input_tokens),
-            cacheWrite: num(u.cache_write_input_tokens),
-            cacheWrite1h: 0,
-        };
+        // A repeat of the previous event, last request included, is a duplicate notification.
+        // shortcut: without usage records, a restart after a one-request run of the same size reads as a duplicate; drop this path once pre-0.148 rollouts no longer matter.
+        const dup = total === latestTotal && last === latestLast;
+        const restart = total < latestTotal || (latestTotal > 0 && total === last && !dup);
+        const cur = tokensOf(u);
         // Each event's growth goes to the model it was made with, so a switch mid-session splits the usage.
         const delta = Object.fromEntries(Object.entries(cur).map(([k, v]) => [k, restart ? v : Math.max(0, v - latest[k])]));
         if (model)
             byModel[model] = addTokens(byModel[model] ?? zero, delta);
         latestTotal = total;
+        latestLast = last;
         latest = cur;
     }
-    return { model, tokensByModel: byModel, costUsd: null, startedAt: span.first, endedAt: span.last, firstPrompt, taskUrl };
+    if (beforeRecords)
+        for (const [m, t] of Object.entries(records))
+            beforeRecords[m] = addTokens(beforeRecords[m] ?? zero, t);
+    return { model, tokensByModel: beforeRecords ?? byModel, costUsd: null, startedAt: span.first, endedAt: span.last, firstPrompt, taskUrl };
 }

package/dist/client.js

@@ -11,7 +11,7 @@ export class CliError extends Error {
 }
 export const absolute = (cfg, path) => cfg.url.replace(/\/+$/, "") + path;
 export async function request(cfg, method, path, body, opts = {}) {
-    const { timeoutMs = 10_000, retries = 3, deadlineMs = 15_000, auth = true } = opts;
+    const { timeoutMs = 10_000, retries = 3, deadlineMs = 15_000, auth = true, headers = {} } = opts;
     if (auth && !cfg.token)
         throw new CliError("No API token: run `npx @paxnax/berliner@latest setup`, or set BERLINER_TOKEN.", "usage");
     // One budget for all attempts, so a hung server can't hold the agent's pipeline for long (anti-goal 1).
@@ -28,6 +28,7 @@ export async function request(cfg, method, path, body, opts = {}) {
                 headers: {
                     ...(auth ? { Authorization: `Bearer ${cfg.token}` } : {}),
                     ...(body === undefined ? {} : { "Content-Type": raw ? "application/octet-stream" : "application/json" }),
+                    ...headers,
                 },
                 // A Uint8Array is sent as-is (evidence bytes); fetch sets its Content-Length.
                 body: body === undefined ? undefined : raw ? body : JSON.stringify(body),

package/dist/commands/body.js

@@ -50,15 +50,24 @@ export async function fromTool(tool, values, env, command) {
 }
 // Inside a tool: the same fields, minus a derived title, for a session that exists; on a 404 (the first turn, before the hook
 // has reported), the PUT that creates it, at cost 0 while the cost is unknown and on BERLINER_PLAN when no plan is given.
+// Create-only: when another report created the session since the 404 (412), the PATCH after all, so its title and cost stay.
 export async function patchFirst(cfg, path, body, titled, guess) {
-    try {
+    const patch = async () => {
         const res = await saveSession(cfg, "PATCH", path, titled ? body : { ...body, title: undefined }, guess);
         return { ...res, json: { created: false, ...res.json } };
+    };
+    try {
+        return await patch();
     }
     catch (err) {
         if (!(err instanceof CliError && err.status === 404))
             throw err;
-        return saveSession(cfg, "PUT", path, { ...body, cost_usd: body.cost_usd ?? 0, plan: body.plan ?? cfg.plan ?? undefined }, guess);
+        const create = { ...body, cost_usd: body.cost_usd ?? 0, plan: body.plan ?? cfg.plan ?? undefined };
+        return saveSession(cfg, "PUT", path, create, guess, { "If-None-Match": "*" }).catch((err) => {
+            if (err instanceof CliError && err.status === 412)
+                return patch();
+            throw err;
+        });
     }
 }
 function number(values, flag) {
@@ -127,7 +136,7 @@ function prefilterPrs(body) {
 // `guess`, the agent's --plan, in that same retry; without --plan it is left out, so a new session gets the server's pick.
 // Anything else is thrown as before. Warnings are printed only once the save succeeded, so a failed save never claims
 // fields were dropped.
-export async function saveSession(cfg, method, path, input, guess) {
+export async function saveSession(cfg, method, path, input, guess, headers) {
     const first = prefilterPrs(input);
     const dropped = first.dropped;
     const fromEnv = cfg.plan !== null && input.plan === cfg.plan && guess !== cfg.plan;
@@ -142,7 +151,7 @@ export async function saveSession(cfg, method, path, input, guess) {
         return { ...res, dropped };
     };
     try {
-        return finish(await request(cfg, method, path, first.body));
+        return finish(await request(cfg, method, path, first.body, { headers }));
     }
     catch (err) {
         const fieldErrors = err instanceof CliError && err.status === 422 ? err.details?.fieldErrors : undefined;
@@ -155,6 +164,6 @@ export async function saveSession(cfg, method, path, input, guess) {
             delete retry[field];
             dropped.push({ field, reason: field === "prs" ? `all PRs dropped: ${[fieldErrors[field]].flat().join(", ")}` : [fieldErrors[field]].flat().join(", ") });
         }
-        return finish(await request(cfg, method, path, retry));
+        return finish(await request(cfg, method, path, retry, { headers }));
     }
 }

package/dist/commands/hook.js

@@ -28,15 +28,16 @@ export function inTool(env) {
     return null;
 }
 // The session's facts from the tool's own record, with a cost estimated wherever the tool stores none; the cost stays null when
-// no prices load. Claude Code and Codex name the record in the hook payload, and OpenCode's plugin sends the session itself;
-// otherwise it is looked up. Null without a record.
+// no prices load. Claude Code and Codex name the record in the hook payload; otherwise it is looked up. OpenCode's plugin sends
+// the session itself too, used only without a saved record. Null without a record.
 export async function sessionFacts(tool, sessionId, env, payload = {}) {
     let facts;
-    if (tool === "opencode" && payload.session)
+    const named = typeof payload.transcript_path === "string" && payload.transcript_path ? payload.transcript_path : null;
+    const file = named ?? (await findRecord(tool, sessionId, env));
+    // The plugin saves the record, in order, before it spawns each reporter, so a reporter that runs late still finds the newest.
+    if (tool === "opencode" && !file && payload.session)
         facts = readOpenCode(payload.session);
     else {
-        const named = typeof payload.transcript_path === "string" && payload.transcript_path ? payload.transcript_path : null;
-        const file = named ?? (await findRecord(tool, sessionId, env));
         if (!file)
             return null;
         if (tool === "claude-code")
@@ -104,8 +105,10 @@ async function start(tool, env) {
     // shortcut: payload files are kept, one small file per session, as a child can't tell whether a newer one is on its way.
     writeFileSync(`${file}.${process.pid}`, text);
     renameSync(`${file}.${process.pid}`, file);
-    // No stdio and its own process group: the tool waits on this process only, and the child outlives it.
-    spawn(process.execPath, [process.argv[1], "hook", tool, "--run", file], { detached: true, stdio: "ignore" })
+    // No stdio and its own process group: the tool waits on this process only, and the child outlives it. Bun gets the
+    // launcher's flags, so the cwd's .env and bunfig.toml stay out of it (see index.ts).
+    const bun = process.versions.bun ? ["--config=/dev/null", "--env-file=/dev/null"] : [];
+    spawn(process.execPath, [...bun, process.argv[1], "hook", tool, "--run", file], { detached: true, stdio: "ignore" })
         .on("error", (err) => log(env, `${tool} ${id}: ${err.message}`))
         .unref();
 }
@@ -230,10 +233,14 @@ async function send(tool, file, env) {
     catch (err) {
         if (!(err instanceof CliError && err.status === 404))
             throw err;
-        // shortcut: an agent report landing between the 404 and this PUT gets the derived title; a create-only call would close that.
         // The plan is BERLINER_PLAN from the tool's environment, else the server's pick from the user's subscriptions. A new
-        // session needs a cost: 0 until prices load.
-        const create = (plan) => request(cfg, "PUT", path, { ...body, cost_usd: body.cost_usd ?? 0, title: derivedTitle(facts.firstPrompt, git), plan });
+        // session needs a cost: 0 until prices load. Create-only: when an agent report created the session since the 404 (412),
+        // only the machine's fields are sent. A server that ignores the header overwrites the title, as before.
+        const create = (plan) => request(cfg, "PUT", path, { ...body, cost_usd: body.cost_usd ?? 0, title: derivedTitle(facts.firstPrompt, git), plan }, { headers: { "If-None-Match": "*" } }).catch((err) => {
+            if (err instanceof CliError && err.status === 412)
+                return request(cfg, "PATCH", path, body);
+            throw err;
+        });
         try {
             saved = await create(cfg.plan ?? undefined);
         }

package/dist/commands/report.js

@@ -43,9 +43,8 @@ export async function report(cfg, values, positionals, env) {
     if (json_)
         print({ data: { ...json, evidence: result }, text }, true);
     else {
-        console.log(`Evidence: ${result.uploaded} uploaded, ${result.existing} already uploaded, ${result.skipped.length} skipped.`);
-        for (const p of result.published ?? [])
-            console.log(p.markdown);
+        const summary = `Evidence: ${result.uploaded} uploaded, ${result.existing} already uploaded, ${result.skipped.length} skipped.`;
+        print({ data: result, text: [summary, ...(result.published ?? []).map((p) => p.markdown)].join("\n") }, false);
     }
     for (const s of result.skipped)
         warn(`${s.path}: ${s.reason}`);

package/dist/commands/upgrade.js

@@ -23,11 +23,13 @@ async function latestVersion(env) {
         throw new CliError(`Could not look up the latest berliner on ${registry} (${err.message}). Nothing was changed.`, "network");
     }
 }
-// The skill text comes from the release being installed, so the plan's "already up to date" and what is written match it.
-// It is read out of the release tarball as data: running the release (npx) would load the cwd's .npmrc and node_modules.
-async function skillOf(version, bundled, env) {
+// The skill and the OpenCode plugin come from the release being installed, so the plan's "already up to date" and what is
+// written match it. They are read out of the release tarball as data: running the release (npx) would load the cwd's .npmrc
+// and node_modules.
+async function releaseFiles(version, bundled, env) {
+    const local = (file) => readFileSync(new URL(`../../${file}`, import.meta.url), "utf8");
     if (bundled)
-        return readFileSync(new URL("../../skill/SKILL.md", import.meta.url), "utf8");
+        return { skill: local("skill/SKILL.md"), plugin: local("opencode/berliner.js") };
     try {
         const meta = await fetch(`${registryOf(env)}/@paxnax/berliner/${version}`);
         if (!meta.ok)
@@ -41,17 +43,23 @@ async function skillOf(version, bundled, env) {
         const tar = gunzipSync(Buffer.from(await res.arrayBuffer()));
         // shortcut: plain ustar names only (no pax or GNU long names), enough for npm's short paths; parse pax if a path passes 100 bytes.
         const field = (at, end) => tar.toString("utf8", at, end).split("\0")[0];
+        const files = new Map();
         for (let at = 0; at + 512 <= tar.length && tar[at];) {
             const prefix = field(at + 345, at + 500);
             const size = Number.parseInt(field(at + 124, at + 136).trim() || "0", 8);
-            if (`${prefix && `${prefix}/`}${field(at, at + 100)}` === "package/skill/SKILL.md")
-                return tar.toString("utf8", at + 512, at + 512 + size);
+            files.set(`${prefix && `${prefix}/`}${field(at, at + 100)}`, tar.toString("utf8", at + 512, at + 512 + size));
             at += 512 + Math.ceil(size / 512) * 512;
         }
-        throw new Error("no skill/SKILL.md in the package");
+        const read = (file) => {
+            const text = files.get(`package/${file}`);
+            if (text === undefined)
+                throw new Error(`no ${file} in the package`);
+            return text;
+        };
+        return { skill: read("skill/SKILL.md"), plugin: read("opencode/berliner.js") };
     }
     catch (err) {
-        throw new CliError(`Could not read the skill of berliner ${version} (${err.message}). Nothing was changed.`, "network");
+        throw new CliError(`Could not read the skill and OpenCode plugin of berliner ${version} (${err.message}). Nothing was changed.`, "network");
     }
 }
 // Release versions only (x.y.z): the registry's latest tag never points at a prerelease.
@@ -84,12 +92,14 @@ export async function upgrade(env, values) {
     const install = installCommand(latest);
     const tools = detectTools(env);
     const targets = values["no-skill"] ? [] : skillTargets(tools, env);
-    const skill = targets.length ? await skillOf(target, !installing, env) : "";
+    // The plugin too, so --no-skill still brings it up to date.
+    const release = targets.length || tools.some((t) => t.id === "opencode" && t.found) ? await releaseFiles(target, !installing, env) : null;
+    const skill = release?.skill ?? "";
     let stale = targets.filter((t) => !sameAs(t.path, skill));
-    // Computed now, so what is written is what the plan showed.
+    // Computed now, for the plan.
     const hooks = tools.flatMap((tool) => {
         const path = hookPath(tool.id, env);
-        const text = updatedHooks(tool.id, path);
+        const text = updatedHooks(tool.id, path, release?.plugin);
         return text === null ? [] : [{ ...tool, path, text }];
     });
     if (!installing && !stale.length && !hooks.length) {
@@ -153,9 +163,15 @@ export async function upgrade(env, values) {
         }
     }
     for (const h of hooks) {
+        // Merged again into the file as it is now, so an edit made during the prompt or the install is kept. The plugin is the
+        // release's, as the plan showed.
+        // shortcut: an edit between this read and write is still lost; lock if that shows up.
+        const text = h.id === "opencode" ? h.text : updatedHooks(h.id, h.path);
+        if (text === null)
+            continue;
         try {
             // In place, so a settings file that is a symlink stays one.
-            writeFileSync(h.path, h.text);
+            writeFileSync(h.path, text);
             console.log(`✓ ${h.name} hook: ${tilde(h.path)}`);
         }
         catch (err) {

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/bin/sh
-//usr/bin/true; exec "$(command -v node || command -v bun)" "$0" "$@"
+//usr/bin/true; command -v node >/dev/null && exec node "$0" "$@"; exec bun --config=/dev/null --env-file=/dev/null "$0" "$@"
+// Bun reads the cwd's .env and bunfig.toml (whose preload runs code), so a checkout could redirect the token or run its code.
 import { parse } from "./args.js";
 import { CliError } from "./client.js";
 import { del } from "./commands/delete.js";

package/dist/output.js

@@ -1,12 +1,14 @@
+// Stored text must not drive the terminal (OSC 52, cursor moves); one char for one keeps table widths.
+const safe = (s) => s.replace(/(?![\t\n])\p{Cc}/gu, "\ufffd");
 export function print(result, json) {
-    console.log(json ? JSON.stringify(result.data, null, 2) : result.text);
+    console.log(json ? JSON.stringify(result.data, null, 2) : safe(result.text));
 }
 // Always a single line, so agents and CI logs see exactly one warning.
 export function warn(msg) {
-    console.error(`berliner: ${msg.replace(/\s*\n\s*/g, " ")}`);
+    console.error(`berliner: ${safe(msg.replace(/\s*\n\s*/g, " "))}`);
 }
 // GitHub renders an image from Markdown but not a video from another host, so a video is its bare URL.
-export const embed = (e, url) => e.kind === "video" ? url : `![${(e.caption || e.filename).replace(/[[\]]/g, "\\$&")}](${url})`;
+export const embed = (e, url) => e.kind === "video" ? url : `![${(e.caption || e.filename).replace(/\s*\n\s*/g, " ").replace(/[\\[\]]/g, "\\$&")}](${url})`;
 // Same wording as the web's mergeLabel (app/src/web/format.ts).
 const MERGE = { open: "Open", merged: "Merged", closed: "Closed", none: "No PRs" };
 export const mergeLabel = (s) => s.pr_count > 1 ? `${s.merged_count} of ${s.pr_count} merged` : (MERGE[s.merge] ?? s.merge);

package/dist/setup/hooks.js

@@ -78,18 +78,20 @@ export const hookPath = (tool, env) => tool === "claude-code"
         ? join(codexDir(env), "hooks.json")
         : join(opencodeDir(env), "plugins", "berliner.js");
 // For upgrade: the hook file's new text when a Berliner hook is installed but older than this release, else null. Hooks that
-// are missing stay missing: adding them is setup's.
-export function updatedHooks(tool, path) {
-    if (tool === "opencode")
-        return existsSync(path) && !current(path) ? plugin() : null;
+// are missing stay missing: adding them is setup's. `next` is the plugin of the release being installed, else this one's.
+export function updatedHooks(tool, path, next) {
+    if (tool === "opencode") {
+        const text = next ?? plugin();
+        return existsSync(path) && !current(path, text) ? text : null;
+    }
     const result = merged(path, entries(tool, tool === "claude-code"), false);
     return result === "unreadable" ? null : (result?.text ?? null);
 }
 // dist/setup/hooks.js -> ../../opencode/berliner.js (the package's opencode/ directory).
 const plugin = () => readFileSync(new URL("../../opencode/berliner.js", import.meta.url), "utf8");
-const current = (pluginPath) => {
+const current = (pluginPath, text = plugin()) => {
     try {
-        return readFileSync(pluginPath, "utf8") === plugin();
+        return readFileSync(pluginPath, "utf8") === text;
     }
     catch {
         return false;

package/opencode/berliner.js

@@ -26,6 +26,9 @@ const MAX_DEPTH = 10;
 
 const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : 0);
 const get = async (client, id) => (await client.session.get({ path: { id } }))?.data;
+// Resolves with p, or with undefined after ms: an SDK call that never answers must not hold up OpenCode. Unreferenced, so a
+// pending deadline never keeps a process alive.
+const within = (p, ms) => Promise.race([p, new Promise((r) => setTimeout(r, ms).unref?.())]);
 
 // One agent session is one Berliner session: a subagent's child session belongs to the top-level session above it.
 async function topLevelId(client, id) {
@@ -60,14 +63,23 @@ async function withChildren(client, session, depth = 0) {
   return { ...session, cost, tokens };
 }
 
+// Each save's place in the order saves started, and per session the latest one written: a save that finishes after a later
+// one (past its 10-second deadline in serial) never writes, nor reports, its older totals.
+let seq = 0;
+const committed = new Map();
+
 // Saves a top-level session with its subagents' totals where `berliner report` run by the agent finds them: its shell can't
-// reach this client. Returns what it saved, or null for a child session, which the top-level session's totals count.
+// reach this client. Returns what it saved, or null for a child session, which the top-level session's totals count, and for
+// a save a later one overtook.
 async function save(client, sessionID) {
+  const mine = ++seq;
   if (typeof sessionID !== "string" || !SAFE_ID.test(sessionID)) return null;
   const found = await get(client, sessionID);
   if (found?.id !== sessionID || found.parentID) return null;
   // OpenCode moves time.updated only when a prompt arrives, so the session's last activity is now.
   const session = { ...(await withChildren(client, found)), time: { ...found.time, updated: Date.now() } };
+  if ((committed.get(sessionID) ?? 0) > mine) return null;
+  committed.set(sessionID, mine);
   const dir = join(process.env.XDG_STATE_HOME || join(homedir(), ".local", "state"), "berliner", "opencode");
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   const file = join(dir, `${sessionID}.json`);
@@ -77,14 +89,15 @@ async function save(client, sessionID) {
   return session;
 }
 
-// One session's saves run one at a time, in the order they came, so an older total never overwrites a newer one.
+// One session's saves run one at a time, in the order they came, so an older total never overwrites a newer one. A save that
+// hangs holds the next one up for 10 seconds at most.
 // shortcut: only within this OpenCode process; two `berliner hook` processes can still write out of order, lock there if that shows up.
 const queues = new Map();
 const serial = (id, fn) => {
   const p = (queues.get(id) ?? Promise.resolve()).then(fn, fn);
   queues.set(
     id,
-    p.catch(() => {}),
+    within(p, 10_000).catch(() => {}),
   );
   return p;
 };
@@ -111,11 +124,15 @@ export const BerlinerPlugin = async ({ client }) => ({
       if (!input?.sessionID) return;
       output.env.OPENCODE_SESSION_ID = input.sessionID;
       // A subagent's shell gets the top-level session, so a `berliner report` the agent runs there doesn't split it off.
-      const top = await topLevelId(client, input.sessionID);
+      // A second each at most: past it the shell keeps the id it was given, or runs before the save is done.
+      const top = await within(topLevelId(client, input.sessionID), 1000);
       if (!top) return;
       output.env.OPENCODE_SESSION_ID = top;
       // So that report finds the totals before the session's first idle. Not reported from here: that waits for idle.
-      await serial(top, () => save(client, top));
+      await within(
+        serial(top, () => save(client, top)),
+        1000,
+      );
     } catch {
       // Never fail the agent's shell.
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paxnax/berliner",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Report coding-agent sessions to Berliner",
   "type": "module",
   "engines": {