@paxnax/berliner 0.5.2 → 0.6.0

package/dist/commands/upgrade.js

@@ -6,6 +6,7 @@ import { gunzipSync } from "node:zlib";
 import { CliError } from "../client.js";
 import { hookPath, updatedHooks } from "../setup/hooks.js";
 import { detectTools, skillTargets } from "../setup/targets.js";
+import { askNudge } from "./nudge.js";
 import { confirm, installCommand, showPlan, tilde } from "./setup.js";
 const registryOf = (env) => (env.npm_config_registry || "https://registry.npmjs.org").replace(/\/+$/, "");
 async function latestVersion(env) {
@@ -23,11 +24,13 @@ async function latestVersion(env) {
         throw new CliError(`Could not look up the latest berliner on ${registry} (${err.message}). Nothing was changed.`, "network");
     }
 }
-// The skill text comes from the release being installed, so the plan's "already up to date" and what is written match it.
-// It is read out of the release tarball as data: running the release (npx) would load the cwd's .npmrc and node_modules.
-async function skillOf(version, bundled, env) {
+// The skill and the OpenCode plugin come from the release being installed, so the plan's "already up to date" and what is
+// written match it. They are read out of the release tarball as data: running the release (npx) would load the cwd's .npmrc
+// and node_modules.
+async function releaseFiles(version, bundled, env) {
+    const local = (file) => readFileSync(new URL(`../../${file}`, import.meta.url), "utf8");
     if (bundled)
-        return readFileSync(new URL("../../skill/SKILL.md", import.meta.url), "utf8");
+        return { skill: local("skill/SKILL.md"), plugin: local("opencode/berliner.js") };
     try {
         const meta = await fetch(`${registryOf(env)}/@paxnax/berliner/${version}`);
         if (!meta.ok)
@@ -41,17 +44,23 @@ async function skillOf(version, bundled, env) {
         const tar = gunzipSync(Buffer.from(await res.arrayBuffer()));
         // shortcut: plain ustar names only (no pax or GNU long names), enough for npm's short paths; parse pax if a path passes 100 bytes.
         const field = (at, end) => tar.toString("utf8", at, end).split("\0")[0];
+        const files = new Map();
         for (let at = 0; at + 512 <= tar.length && tar[at];) {
             const prefix = field(at + 345, at + 500);
             const size = Number.parseInt(field(at + 124, at + 136).trim() || "0", 8);
-            if (`${prefix && `${prefix}/`}${field(at, at + 100)}` === "package/skill/SKILL.md")
-                return tar.toString("utf8", at + 512, at + 512 + size);
+            files.set(`${prefix && `${prefix}/`}${field(at, at + 100)}`, tar.toString("utf8", at + 512, at + 512 + size));
             at += 512 + Math.ceil(size / 512) * 512;
         }
-        throw new Error("no skill/SKILL.md in the package");
+        const read = (file) => {
+            const text = files.get(`package/${file}`);
+            if (text === undefined)
+                throw new Error(`no ${file} in the package`);
+            return text;
+        };
+        return { skill: read("skill/SKILL.md"), plugin: read("opencode/berliner.js") };
     }
     catch (err) {
-        throw new CliError(`Could not read the skill of berliner ${version} (${err.message}). Nothing was changed.`, "network");
+        throw new CliError(`Could not read the skill and OpenCode plugin of berliner ${version} (${err.message}). Nothing was changed.`, "network");
     }
 }
 // Release versions only (x.y.z): the registry's latest tag never points at a prerelease.
@@ -70,7 +79,7 @@ const sameAs = (path, text) => {
 };
 // What a hook gains from this release, for the plan.
 const HOOK_CHANGE = {
-    "claude-code": "the reminder also runs on startup and resume",
+    "claude-code": "Stop hook no longer async, so Berliner can ask the agent to run the tests",
     codex: "the reminder also runs on startup and resume",
     opencode: "the new reminder, and totals saved in order",
 };
@@ -84,12 +93,14 @@ export async function upgrade(env, values) {
     const install = installCommand(latest);
     const tools = detectTools(env);
     const targets = values["no-skill"] ? [] : skillTargets(tools, env);
-    const skill = targets.length ? await skillOf(target, !installing, env) : "";
+    // The plugin too, so --no-skill still brings it up to date.
+    const release = targets.length || tools.some((t) => t.id === "opencode" && t.found) ? await releaseFiles(target, !installing, env) : null;
+    const skill = release?.skill ?? "";
     let stale = targets.filter((t) => !sameAs(t.path, skill));
     // Computed now, for the plan.
     const hooks = tools.flatMap((tool) => {
         const path = hookPath(tool.id, env);
-        const text = updatedHooks(tool.id, path);
+        const text = updatedHooks(tool.id, path, release?.plugin);
         return text === null ? [] : [{ ...tool, path, text }];
     });
     if (!installing && !stale.length && !hooks.length) {
@@ -127,6 +138,7 @@ export async function upgrade(env, values) {
         // Without an install, the skill is all Continue covered.
         if (installing && stale.length && !(await confirm(process.stdin, process.stdout, "Upgrade the skill too? [Y/n] ")))
             stale = [];
+        await askNudge(env);
         console.log();
     }
     if (installing) {
@@ -153,8 +165,8 @@ export async function upgrade(env, values) {
         }
     }
     for (const h of hooks) {
-        // Merged again into the file as it is now, so an edit made during the prompt or the install is kept. The plugin is the one
-        // the plan showed: the install may have replaced this package's copy.
+        // Merged again into the file as it is now, so an edit made during the prompt or the install is kept. The plugin is the
+        // release's, as the plan showed.
         // shortcut: an edit between this read and write is still lost; lock if that shows up.
         const text = h.id === "opencode" ? h.text : updatedHooks(h.id, h.path);
         if (text === null)

package/dist/config.js

@@ -7,14 +7,29 @@ export function configPath(env) {
 }
 export const stateDir = (env) => join(env.XDG_STATE_HOME || join(homedir(), ".local", "state"), "berliner");
 export const cacheDir = (env) => join(env.XDG_CACHE_HOME || join(homedir(), ".cache"), "berliner");
+function readNudge(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return undefined;
+    const { off_all, off, asked } = raw;
+    return {
+        ...(asked === true && { asked: true }),
+        ...(off_all === true && { off_all: true }),
+        ...(Array.isArray(off) && { off: off.filter((r) => typeof r === "string") }),
+    };
+}
 // A missing or unreadable file is the same as no file: the environment may still hold the token.
 export function readConfigFile(env) {
     try {
         const parsed = JSON.parse(readFileSync(configPath(env), "utf8"));
         if (typeof parsed !== "object" || parsed === null)
             return null;
-        const { token, url } = parsed;
-        return { token: typeof token === "string" ? token : undefined, url: typeof url === "string" ? url : undefined };
+        const { token, url, team, nudge } = parsed;
+        return {
+            token: typeof token === "string" ? token : undefined,
+            url: typeof url === "string" ? url : undefined,
+            team: typeof team === "string" ? team : undefined,
+            nudge: readNudge(nudge),
+        };
     }
     catch {
         return null;

package/dist/gh.js

@@ -5,8 +5,8 @@ const MERGE = { OPEN: "open", MERGED: "merged", CLOSED: "closed" };
 // CheckRun conclusions and StatusContext states.
 const FAILED = ["FAILURE", "ERROR", "CANCELLED", "TIMED_OUT", "ACTION_REQUIRED", "STARTUP_FAILURE"];
 const PENDING = ["PENDING", "EXPECTED"];
-// `gh pr view --json state,statusCheckRollup` as Berliner's merge and CI states. statusCheckRollup mixes CheckRuns (status,
-// conclusion; conclusion is "" until completed) and commit StatusContexts (state).
+// `gh pr view --json state,statusCheckRollup,headRefOid` as Berliner's merge and CI states and the head commit they belong to.
+// statusCheckRollup mixes CheckRuns (status, conclusion; conclusion is "" until completed) and commit StatusContexts (state).
 export function prState(view) {
     const merge_state = MERGE[String(view.state)];
     if (!merge_state)
@@ -19,10 +19,12 @@ export function prState(view) {
             : checks.length
                 ? "passed"
                 : "none";
-    return { merge_state, ci_state };
+    // Anything else the server would refuse, losing the states with it.
+    const head_sha = typeof view.headRefOid === "string" && /^[0-9a-f]{40}$/.test(view.headRefOid) ? view.headRefOid : null;
+    return { merge_state, ci_state, head_sha };
 }
 // The machine's gh, found on PATH; it rejects when gh is missing (code ENOENT), fails or takes over 5 seconds.
 export async function viewPr(url) {
-    const { stdout } = await run("gh", ["pr", "view", url, "--json", "state,statusCheckRollup"], { timeout: 5000 });
+    const { stdout } = await run("gh", ["pr", "view", url, "--json", "state,statusCheckRollup,headRefOid"], { timeout: 5000 });
     return prState(JSON.parse(stdout));
 }

package/dist/index.js

@@ -1,16 +1,19 @@
 #!/bin/sh
-//usr/bin/true; exec "$(command -v node || command -v bun)" "$0" "$@"
+//usr/bin/true; command -v node >/dev/null && exec node "$0" "$@"; exec bun --config=/dev/null --env-file=/dev/null "$0" "$@"
+// Bun reads the cwd's .env and bunfig.toml (whose preload runs code), so a checkout could redirect the token or run its code.
 import { parse } from "./args.js";
 import { CliError } from "./client.js";
 import { del } from "./commands/delete.js";
 import { evidence } from "./commands/evidence.js";
 import { hook } from "./commands/hook.js";
+import { nudge } from "./commands/nudge.js";
 import { project, projects } from "./commands/projects.js";
 import { report } from "./commands/report.js";
 import { session } from "./commands/session.js";
 import { sessions } from "./commands/sessions.js";
 import { setup } from "./commands/setup.js";
 import { skill } from "./commands/skill.js";
+import { team } from "./commands/team.js";
 import { summary } from "./commands/summary.js";
 import { update } from "./commands/update.js";
 import { upgrade } from "./commands/upgrade.js";
@@ -32,6 +35,11 @@ Commands:
   projects              the project names in use, then each repository's default [--json]
   project [<name>]      show or save this repository's default project; --none saves "no project"
                         [--none --repo <owner/name> --json]
+  team [<uuid>]         show or save the team new sessions are reported to; --none clears it
+                        a team can also come from --team <uuid> / --no-team, .berliner.json {"team": "<uuid>"}, BERLINER_TEAM
+                        [--none --json]
+  nudge [on|off]        show or set whether Berliner asks agents to run the tests before they hand work back, for this repository
+                        [--all for every repository]
   delete <session-id>   [--evidence <id>] [--yes]
   evidence public <id>  let anyone with the link view one file; prints its URL and Markdown [--json]
   evidence private <id> make it viewable only by you again [--json]
@@ -39,7 +47,7 @@ Commands:
   skill                 print the bundled SKILL.md
   hook <tool>           run by the hooks of claude-code, codex or opencode; reads the payload on stdin
 
-Environment: BERLINER_TOKEN, BERLINER_URL, BERLINER_PLAN (replaces --plan)`;
+Environment: BERLINER_TOKEN, BERLINER_URL, BERLINER_PLAN (replaces --plan), BERLINER_TEAM`;
 const args = parse(process.argv.slice(2));
 // Reporting must never fail the agent's own pipeline unless it asks to (anti-goal 1).
 const softFail = (args.command === "report" || args.command === "update") && !args.values.strict;
@@ -52,6 +60,8 @@ const handled = new Set([
     "summary",
     "projects",
     "project",
+    "team",
+    "nudge",
     "delete",
     "evidence",
     "skill",
@@ -83,6 +93,10 @@ try {
         await projects(cfg(), args.values);
     else if (args.command === "project")
         await project(cfg(), args.values, args.positionals);
+    else if (args.command === "team")
+        await team(process.env, args.values, args.positionals);
+    else if (args.command === "nudge")
+        await nudge(process.env, args.values, args.positionals);
     else if (args.command === "delete")
         await del(cfg(), args.values, args.positionals);
     else if (args.command === "evidence")

package/dist/setup/hooks.js

@@ -1,11 +1,11 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { claudeDir, codexDir, opencodeDir } from "./targets.js";
-const entries = (tool, asyncStop) => {
+const entries = (tool) => {
     const hooks = (extra = {}) => [{ type: "command", command: `berliner hook ${tool}`, ...extra }];
     return {
-        // Claude Code runs Stop after every reply; async keeps the agent from waiting on it.
-        Stop: { hooks: hooks(asyncStop ? { async: true } : {}) },
+        // Not async: Claude Code only reads what a foreground Stop hook prints to the agent. The hook still returns at once.
+        Stop: { hooks: hooks() },
         PreCompact: { hooks: hooks() },
         SessionEnd: { hooks: hooks() },
         // Not async: what it prints is the reminder, which the tool adds to the agent's context.
@@ -16,7 +16,7 @@ const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v)
 const ours = (entry) => isObject(entry) &&
     Array.isArray(entry.hooks) &&
     entry.hooks.some((h) => isObject(h) && typeof h.command === "string" && h.command.startsWith("berliner hook "));
-// The file with our entries added to the events that lack one (unless addMissing is false) and an older matcher of ours
+// The file with our entries added to the events that lack one (unless addMissing is false) and an older matcher or async flag of ours
 // brought up to date in place, or null when nothing changes. "unreadable" when it isn't a JSON object whose hooks we can add
 // to: then it is the user's to fix, and is never rewritten.
 function merged(file, add, addMissing = true) {
@@ -46,9 +46,25 @@ function merged(file, add, addMissing = true) {
             hooks[event] = [...list, entry];
             added = true;
         }
-        else if (i >= 0 && entry.matcher !== undefined && list[i].matcher !== entry.matcher) {
-            hooks[event] = list.map((e, j) => (j === i ? { ...e, matcher: entry.matcher } : e));
-            updated = true;
+        else if (i >= 0) {
+            const matcher = entry.matcher !== undefined && list[i].matcher !== entry.matcher;
+            const wantAsync = entry.hooks[0].async;
+            const stale = (h) => isObject(h) && ours({ hooks: [h] }) && h.async !== wantAsync;
+            const flag = list[i].hooks.some(stale);
+            if (matcher || flag) {
+                hooks[event] = list.map((e, j) => {
+                    if (j !== i)
+                        return e;
+                    const hs = e.hooks.map((h) => {
+                        if (!stale(h))
+                            return h;
+                        const { async: _, ...rest } = h;
+                        return wantAsync === undefined ? rest : { ...rest, async: wantAsync };
+                    });
+                    return { ...e, ...(matcher ? { matcher: entry.matcher } : {}), hooks: hs };
+                });
+                updated = true;
+            }
         }
     }
     if (!added && !updated)
@@ -68,28 +84,30 @@ function install(file, add) {
     return result.added ? "added" : "updated";
 }
 const describe = (result) => result === "unreadable" ? "can't be read, left unchanged" : result === null ? "already installed" : result.added ? "adds a hook" : "updates the hook";
-export const installClaudeHooks = (settingsPath) => install(settingsPath, entries("claude-code", true));
-export const describeClaudeHooks = (settingsPath) => describe(merged(settingsPath, entries("claude-code", true)));
-export const installCodexHooks = (hooksPath) => install(hooksPath, entries("codex", false));
-export const describeCodexHooks = (hooksPath) => describe(merged(hooksPath, entries("codex", false)));
+export const installClaudeHooks = (settingsPath) => install(settingsPath, entries("claude-code"));
+export const describeClaudeHooks = (settingsPath) => describe(merged(settingsPath, entries("claude-code")));
+export const installCodexHooks = (hooksPath) => install(hooksPath, entries("codex"));
+export const describeCodexHooks = (hooksPath) => describe(merged(hooksPath, entries("codex")));
 export const hookPath = (tool, env) => tool === "claude-code"
     ? join(claudeDir(env), "settings.json")
     : tool === "codex"
         ? join(codexDir(env), "hooks.json")
         : join(opencodeDir(env), "plugins", "berliner.js");
 // For upgrade: the hook file's new text when a Berliner hook is installed but older than this release, else null. Hooks that
-// are missing stay missing: adding them is setup's.
-export function updatedHooks(tool, path) {
-    if (tool === "opencode")
-        return existsSync(path) && !current(path) ? plugin() : null;
-    const result = merged(path, entries(tool, tool === "claude-code"), false);
+// are missing stay missing: adding them is setup's. `next` is the plugin of the release being installed, else this one's.
+export function updatedHooks(tool, path, next) {
+    if (tool === "opencode") {
+        const text = next ?? plugin();
+        return existsSync(path) && !current(path, text) ? text : null;
+    }
+    const result = merged(path, entries(tool), false);
     return result === "unreadable" ? null : (result?.text ?? null);
 }
 // dist/setup/hooks.js -> ../../opencode/berliner.js (the package's opencode/ directory).
 const plugin = () => readFileSync(new URL("../../opencode/berliner.js", import.meta.url), "utf8");
-const current = (pluginPath) => {
+const current = (pluginPath, text = plugin()) => {
     try {
-        return readFileSync(pluginPath, "utf8") === plugin();
+        return readFileSync(pluginPath, "utf8") === text;
     }
     catch {
         return false;

package/dist/team.js

@@ -0,0 +1,99 @@
+import { execFile } from "node:child_process";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { CliError } from "./client.js";
+import { readConfigFile, stateDir } from "./config.js";
+import { gitFacts } from "./git.js";
+import { warn } from "./output.js";
+const run = promisify(execFile);
+export const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+// The `team` of .berliner.json at the repository root, or undefined outside a repository or without the file.
+async function repoTeam(cwd) {
+    const root = await run("git", ["rev-parse", "--show-toplevel"], { cwd, timeout: 2000 }).then((r) => r.stdout.trim(), () => null);
+    if (!root)
+        return undefined;
+    const file = join(root, ".berliner.json");
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return undefined;
+        throw new CliError(`${file} is not readable JSON: ${err.message}`, "usage");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+        throw new CliError(`${file} must hold a JSON object like {"team": "<uuid>"}`, "usage");
+    const { team } = parsed;
+    if (team !== undefined && typeof team !== "string")
+        throw new CliError(`"team" in ${file} must be a string (the team's id)`, "usage");
+    return team || undefined;
+}
+// The founder's order: --no-team, --team, .berliner.json, BERLINER_TEAM, the global config, else the developer's own plan.
+export async function resolveTeamSource(values, cwd, env) {
+    if (values["no-team"] && values.team !== undefined)
+        throw new CliError("--team and --no-team can't be used together", "usage");
+    if (values["no-team"])
+        return { team: null, source: "flag" };
+    if (values.team)
+        return { team: values.team, source: "flag" };
+    const repo = await repoTeam(cwd);
+    if (repo)
+        return { team: repo, source: "repo" };
+    if (env.BERLINER_TEAM)
+        return { team: env.BERLINER_TEAM, source: "env" };
+    const saved = readConfigFile(env)?.team;
+    return saved ? { team: saved, source: "config" } : { team: null, source: "none" };
+}
+export const resolveTeam = async (values, cwd, env) => (await resolveTeamSource(values, cwd, env)).team;
+// A session keeps the team it was created with, so a different setting now only deserves a word.
+export function teamWarning(saved, resolved) {
+    return (saved?.id ?? null) === resolved ? null : `this session is already on ${saved?.name ?? "your own plan"}; the team setting applies to new sessions`;
+}
+const refusals = (env) => join(stateDir(env), "refusals.json");
+function readNotes(env) {
+    try {
+        return JSON.parse(readFileSync(refusals(env), "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+// Renamed into place, so a concurrent reader never sees half a file.
+// shortcut: two writers at once can lose one note (read, then write); the next refused report leaves it again.
+function writeNotes(env, notes) {
+    const file = refusals(env);
+    mkdirSync(stateDir(env), { recursive: true, mode: 0o700 });
+    if (!Object.keys(notes).length)
+        rmSync(file, { force: true });
+    else {
+        writeFileSync(`${file}.${process.pid}`, JSON.stringify(notes));
+        renameSync(`${file}.${process.pid}`, file);
+    }
+}
+// The hook can't print: it leaves the server's refusal here for the next command in that repository.
+export function noteRefusal(env, repository, message) {
+    writeNotes(env, { ...readNotes(env), [repository]: { message, at: new Date().toISOString() } });
+}
+export function takeRefusal(env, repository) {
+    const notes = readNotes(env);
+    const note = notes[repository];
+    if (!note)
+        return null;
+    delete notes[repository];
+    writeNotes(env, notes);
+    return note.message;
+}
+// Foreground commands print a refusal the hook left for this directory's repository, once. Outside a repository: nothing.
+export async function announceRefusal(env) {
+    try {
+        const repository = (await gitFacts(process.cwd(), null)).repository;
+        const message = repository && takeRefusal(env, repository);
+        if (message)
+            warn(message);
+    }
+    catch {
+        // A note that can't be read or removed must not stop the command.
+    }
+}

package/dist/tests/check.js

@@ -0,0 +1,108 @@
+import { execFile } from "node:child_process";
+import { lstatSync } from "node:fs";
+import path from "node:path";
+import { promisify } from "node:util";
+import { testCommand } from "./command.js";
+import { claudeRuns, codexRuns } from "./runs.js";
+const run = promisify(execFile);
+const DOCS = /^docs\/|\.(?:md|mdx|txt)$/i;
+// Best effort like git.ts, within what is left of the budget: a git error or no time left gives null.
+async function git(cwd, args, deadline) {
+    const timeout = deadline - Date.now();
+    if (timeout <= 0)
+        return null;
+    try {
+        return (await run("git", ["-c", "core.quotePath=false", ...args], { cwd, timeout })).stdout;
+    }
+    catch {
+        return null;
+    }
+}
+const mtime = (file) => lstatSync(file, { throwIfNoEntry: false })?.mtimeMs;
+// A deleted file is dated by the change to its nearest remaining folder: that removal is the folder's last change unless a
+// later one came after it, which only makes the date later.
+function removedAt(root, file) {
+    for (let dir = path.dirname(file);; dir = path.dirname(dir)) {
+        const at = mtime(path.join(root, dir));
+        if (at !== undefined || dir === ".")
+            return at ?? Date.now();
+    }
+}
+// The code files the session changed, uncommitted or committed since it started, newest first, and whether any code file is
+// uncommitted whatever its date; null when git fails.
+async function changedFiles(root, startedAt, start, deadline) {
+    const status = await git(root, ["status", "--porcelain", "-z", "--untracked-files=all"], deadline);
+    if (status === null)
+        return null;
+    // A repository with no commit has no log.
+    const log = (await git(root, ["log", `--since=${startedAt}`, "--name-only", "--format=%x01%ct"], deadline)) ?? "";
+    const uncommitted = new Set();
+    const entries = status.split("\0");
+    for (let i = 0; i < entries.length; i++) {
+        if (!entries[i])
+            continue;
+        uncommitted.add(entries[i].slice(3));
+        // A rename or copy is followed by its source path.
+        if (/^[RC]/.test(entries[i]))
+            uncommitted.add(entries[++i]);
+    }
+    const committed = new Map();
+    let commitAt = 0;
+    for (const line of log.split("\n")) {
+        if (line.startsWith("\x01"))
+            commitAt = Number(line.slice(1)) * 1000;
+        else if (line && !committed.has(line))
+            committed.set(line, commitAt); // newest commit first
+    }
+    const files = [];
+    for (const file of new Set([...uncommitted, ...committed.keys()])) {
+        if (DOCS.test(file))
+            continue;
+        const at = mtime(path.join(root, file)) ?? (uncommitted.has(file) ? removedAt(root, file) : committed.get(file));
+        if (at !== undefined && at >= start)
+            files.push({ path: file, at });
+    }
+    return { files: files.sort((a, b) => b.at - a.at), dirty: [...uncommitted].some((f) => !DOCS.test(f)) };
+}
+// The session's test runs against its changes, or null when there is nothing to say. Quick mode reads only the runs since
+// the newest change, so a pass before it gives unchecked, not stale.
+export async function checkTests(o) {
+    // OpenCode records no commands.
+    if ((o.tool !== "claude-code" && o.tool !== "codex") || !o.startedAt)
+        return null;
+    const start = Date.parse(o.startedAt);
+    if (Number.isNaN(start))
+        return null;
+    const root = o.root ?? (await git(o.cwd, ["rev-parse", "--show-toplevel"], o.deadline))?.trim();
+    if (!root)
+        return null;
+    const main = testCommand(root);
+    if (!main)
+        return null;
+    const { command } = main;
+    const found = await changedFiles(root, o.startedAt, start, o.deadline);
+    if (!found?.files.length)
+        return null;
+    const { files, dirty } = found;
+    const [headSha, headAt] = (await git(root, ["log", "-1", "--format=%H %ct"], o.deadline))?.trim().split(" ") ?? [];
+    const read = o.tool === "codex" ? codexRuns : claudeRuns;
+    const runs = await read(o.transcriptPath, command, root, o.deadline, o.quick ? files[0].at : start);
+    if (!runs || Date.now() > o.deadline)
+        return null;
+    const counted = runs.filter((r) => r.outcome !== "unknown");
+    const last = counted.at(-1);
+    const pass = counted.findLast((r) => r.outcome === "passed");
+    const changed = pass ? files.filter((f) => f.at > pass.at) : files;
+    // The latest counted run decides: a failure after a pass is not verified.
+    const verdict = last?.outcome === "zero" ? "zero_tests" : last?.outcome !== "passed" ? "unchecked" : changed.length ? "stale" : "verified";
+    return {
+        verdict,
+        command,
+        changed: changed.map((f) => f.path),
+        changedAt: files[0].at,
+        // CI vouches for a commit only when CI runs the tests, and the server takes SHA-1 ids only, as gh.ts reads them.
+        headSha: main.source === "workflow" && /^[0-9a-f]{40}$/.test(headSha ?? "") ? headSha : null,
+        // Any uncommitted code change, however old, means HEAD is not the tree that was tested.
+        treeClean: headAt !== undefined && !dirty,
+    };
+}

package/dist/tests/command.js

@@ -0,0 +1,72 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+// In the order they are tried.
+const KNOWN = [
+    "npm test",
+    "npm run test",
+    "pnpm test",
+    "yarn test",
+    "bun test",
+    "pytest",
+    "go test ./...",
+    "cargo test",
+    "vendor/bin/phpunit",
+    "composer test",
+    "bundle exec rspec",
+    "mix test",
+];
+const LOCKS = [
+    ["pnpm-lock.yaml", "pnpm test"],
+    ["yarn.lock", "yarn test"],
+    ["bun.lock", "bun test"],
+    ["bun.lockb", "bun test"],
+];
+const cache = new Map();
+// The repo's main test command: the first known one a CI workflow runs, else package.json's test script. Synchronous reads only.
+export function testCommand(root) {
+    const dir = path.join(root, ".github", "workflows");
+    const workflows = existsSync(dir)
+        ? readdirSync(dir)
+            .filter((f) => /\.ya?ml$/.test(f))
+            .sort()
+            .map((f) => path.join(dir, f))
+        : [];
+    const files = [...workflows, path.join(root, "package.json"), ...LOCKS.map(([f]) => path.join(root, f))];
+    const key = files.map((f) => `${f}:${existsSync(f) ? statSync(f).mtimeMs : ""}`).join("|");
+    const hit = cache.get(root);
+    if (hit?.key === key)
+        return hit.found;
+    const ci = fromWorkflows(workflows);
+    const found = ci ? { command: ci, source: "workflow" } : fromPackage(root);
+    cache.set(root, { key, found });
+    return found;
+}
+// shortcut: line matching, not YAML; upgrade if workflows with anchors or matrices that build the command go wrong.
+function fromWorkflows(files) {
+    for (const file of files) {
+        // A `run: cmd` line, a `- run: cmd` step or a line of a `run: |` block.
+        const lines = readFileSync(file, "utf8")
+            .split("\n")
+            .map((l) => l
+            .trim()
+            .replace(/^-\s+/, "")
+            .replace(/^run:\s*/, ""));
+        const found = KNOWN.find((c) => lines.some((l) => l === c || l.startsWith(`${c} `) || l.startsWith(`${c}\t`)));
+        if (found)
+            return found;
+    }
+    return null;
+}
+function fromPackage(root) {
+    let scripts;
+    try {
+        scripts = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).scripts;
+    }
+    catch {
+        return null;
+    }
+    // npm init's placeholder always fails: it is no tests.
+    if (typeof scripts?.test !== "string" || /no test specified/.test(scripts.test))
+        return null;
+    return { command: LOCKS.find(([f]) => existsSync(path.join(root, f)))?.[1] ?? "npm test", source: "package" };
+}