@paxnax/berliner 0.5.2 → 0.6.0

package/dist/tests/nudge.js

@@ -0,0 +1,68 @@
+import { execFile } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { jsonl } from "../agents/read.js";
+import { nudgeEnabled } from "../commands/nudge.js";
+import { stateDir } from "../config.js";
+import { checkTests } from "./check.js";
+const run = promisify(execFile);
+const BUDGET_MS = 500;
+// The session's start without reading the whole record: both tools date their first entries.
+async function firstTimestamp(file, deadline) {
+    for await (const e of jsonl(file)) {
+        if (Date.now() > deadline)
+            return null;
+        if (typeof e.timestamp === "string")
+            return e.timestamp;
+    }
+    return null;
+}
+async function repoRoot(cwd, deadline) {
+    try {
+        return (await run("git", ["rev-parse", "--show-toplevel"], { cwd, timeout: Math.max(1, deadline - Date.now()) })).stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+// The Stop hook's line asking the agent to run the tests, or null. Asked once per set of changes: the state is saved first.
+export async function nudge(tool, p, env) {
+    const deadline = Date.now() + BUDGET_MS;
+    if (tool === "opencode" || p.stop_hook_active === true)
+        return null;
+    if (typeof p.transcript_path !== "string" || !p.transcript_path || typeof p.cwd !== "string")
+        return null;
+    // A reply ending in a question waits on the user; it doesn't hand the work back. Markdown may close after the ?: `?**`, `?)`.
+    const last = typeof p.last_assistant_message === "string" ? p.last_assistant_message.trimEnd().split("\n").at(-1) : "";
+    if (/\?[*_)"`]*$/.test(last ?? ""))
+        return null;
+    const root = await repoRoot(p.cwd, deadline);
+    if (!root || !nudgeEnabled(env, root))
+        return null;
+    const startedAt = await firstTimestamp(p.transcript_path, deadline);
+    const check = await checkTests({ tool, transcriptPath: p.transcript_path, cwd: p.cwd, root, startedAt, deadline, quick: true });
+    if (!check || check.verdict === "verified")
+        return null;
+    const dir = join(stateDir(env), "nudge");
+    const file = join(dir, `${p.session_id}.json`);
+    const state = JSON.stringify({ changed: check.changed, changedAt: check.changedAt });
+    if (existsSync(file) && readFileSync(file, "utf8") === state)
+        return null;
+    // The changed paths name the user's files: only the user may read them.
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // shortcut: nudge state files are never removed, one small file per session, like the hook's payload files; prune old ones if they pile up.
+    writeFileSync(file, state, { mode: 0o600 });
+    const files = check.changed
+        .slice(0, 3)
+        .map((f) => `\`${f}\``)
+        .join(", ");
+    // No file changed since the last pass means the run after it failed.
+    const note = check.verdict === "zero_tests"
+        ? `\`${check.command}\` ran no tests. Please check the test filter and run the full suite before handing this back.`
+        : !files
+            ? `\`${check.command}\` failed on its last run. Please get it passing, or say why, before handing this back.`
+            : `This repo has tests and ${files} changed since they last passed. Please run \`${check.command}\` before handing this back.`;
+    // Codex expects JSON, not plain text, on Stop's stdout; block is how it continues the turn.
+    return JSON.stringify(tool === "codex" ? { decision: "block", reason: note } : { hookSpecificOutput: { hookEventName: "Stop", additionalContext: note } });
+}

package/dist/tests/runs.js

@@ -0,0 +1,195 @@
+import { realpathSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { subagentFiles } from "../agents/claude.js";
+import { jsonl, jsonlBackward } from "../agents/read.js";
+// Words that change how a run reports, not which tests it runs. Kept short on purpose: anything else makes the run partial.
+const FLAGS = new Set(["--", "--silent", "--color", "--no-color", "-v", "--verbose", "--coverage", "2>&1"]);
+const ZERO = [
+    /No test files found/,
+    /No tests found/,
+    /\b0 tests\b/,
+    /\b0 passing\b/,
+    /no tests ran/,
+    /collected 0 items/,
+    /no tests to run/,
+    /Tests:\s+0 total/,
+];
+// Non-zero counts only: cargo prints "0 failed" when it passes and "0 passed" when nothing ran.
+const FAIL_COUNT = /\b[1-9]\d* (?:failed|failing)\b/;
+const PASS_COUNT = /\b[1-9]\d* (?:passed|passing)\b/;
+// node:test prints `# pass N` and `# fail N` (TAP) or `ℹ pass N` (spec); TAP's per-test `ok N - name` is no summary, so Go's
+// marker takes its package and time.
+const FAILED = [FAIL_COUNT, /^FAIL\b/m, /test result: FAILED/, /^\s*not ok\b/m, /^[#ℹ] fail [1-9]/m];
+const PASSED = [PASS_COUNT, /^ok\s+\S+\s+(?:[\d.]+s|\(cached\))\s*$/m, /^[#ℹ] pass [1-9]/m];
+const real = (dir) => {
+    try {
+        return realpathSync(dir);
+    }
+    catch {
+        return null;
+    }
+};
+const sameDir = (a, b) => a === b || (real(a) ?? a) === real(b);
+// A full run's shape, or null. Only a run in the repo root is full: in a monorepo, a workspace's own test script is part of
+// the suite. The directory is the call's, moved by each `cd <dir>` before it; one it can't work out (none, `-`, `~`, a
+// variable, quotes, pushd) makes the run partial. Piped: something after the test command owns the exit status, so only
+// the output can tell.
+function parse(command, main, cwd, root) {
+    const segments = command.split("&&");
+    const mainWords = main.split(" ");
+    let dir = cwd;
+    for (const [i, segment] of segments.entries()) {
+        const end = segment.search(/[|;\n]/);
+        const head = end < 0 ? segment : segment.slice(0, end);
+        const words = head.trim().split(/\s+/);
+        while (/^\w+=\S*$/.test(words[0] ?? ""))
+            words.shift();
+        if (words[0] === "cd" || words[0] === "pushd") {
+            const plain = words[0] === "cd" && words.length === 2 && /^[^-~$"'`\\][^$"'`\\]*$/.test(words[1]);
+            dir = dir && plain ? path.resolve(dir, words[1]) : undefined;
+        }
+        if (mainWords.every((w, j) => words[j] === w) && onlyFlags(words.slice(mainWords.length)) && dir && sameDir(dir, root)) {
+            // Splitting removed the &&s, so an & left over backgrounds the chain or redirects.
+            const tail = [segment.slice(head.length), ...segments.slice(i + 1)].join(" ").replaceAll("2>&1", "");
+            return { piped: /[|;&\n]/.test(tail) };
+        }
+        // A cd later in the step, after ; & || or a newline, moves the steps after it somewhere this doesn't follow.
+        if (/[;|&\n{]\s*(cd|pushd|popd)\b/.test(segment))
+            dir = undefined;
+    }
+    return null;
+}
+function onlyFlags(words) {
+    for (let k = 0; k < words.length; k++) {
+        if (words[k] === "--reporter")
+            k++;
+        else if (!FLAGS.has(words[k]) && !words[k].startsWith("--reporter="))
+            return false;
+    }
+    return true;
+}
+export const isFullRun = (command, main, cwd, root) => parse(command, main, cwd, root) !== null;
+function outcome(output, isError, piped) {
+    // A "nothing ran" line only means zero when no part of the run counted a test: cargo's doc-tests print "running 0 tests" after the unit tests.
+    if (ZERO.some((r) => r.test(output)) && !PASS_COUNT.test(output) && !FAIL_COUNT.test(output))
+        return "zero";
+    if (!piped)
+        return isError === false ? "passed" : isError === true ? "failed" : "unknown";
+    if (FAILED.some((r) => r.test(output)))
+        return "failed";
+    return PASSED.some((r) => r.test(output)) ? "passed" : "unknown";
+}
+const text = (c) => typeof c === "string" ? c : Array.isArray(c) ? c.map((p) => (p?.type === "text" && typeof p.text === "string" ? p.text : "")).join("\n") : "";
+const parts = (e) => (Array.isArray(e.message?.content) ? e.message.content.filter((p) => p && typeof p === "object") : []);
+const time = (ts) => (typeof ts === "string" ? Date.parse(ts) : Number.NaN);
+function bashCall(e, p, main, root) {
+    if (e.type !== "assistant" || p.type !== "tool_use" || p.name !== "Bash" || typeof p.input?.command !== "string")
+        return null;
+    const shape = parse(p.input.command, main, typeof e.cwd === "string" ? e.cwd : undefined, root);
+    return shape && { command: p.input.command, ...shape, background: p.input.run_in_background === true };
+}
+function toolResult(e, p) {
+    const at = time(e.timestamp);
+    return e.type === "user" && p.type === "tool_result" && !Number.isNaN(at) ? { at, content: p.content, isError: p.is_error } : null;
+}
+// A background call's result only says it started.
+const run = (call, r) => ({
+    command: call.command,
+    at: r.at,
+    outcome: call.background ? "unknown" : outcome(text(r.content), r.isError, call.piped),
+});
+async function forward(file, main, root, deadline) {
+    const calls = new Map();
+    const runs = [];
+    for await (const e of jsonl(file)) {
+        if (Date.now() > deadline)
+            return null;
+        for (const p of parts(e)) {
+            const call = bashCall(e, p, main, root);
+            if (call)
+                calls.set(p.id, call);
+            const r = toolResult(e, p);
+            const made = r && calls.get(p.tool_use_id);
+            if (r && made)
+                runs.push(run(made, r));
+        }
+    }
+    return runs;
+}
+// Last entry first, so a result is seen before its call. Stops at the first entry older than since.
+async function backward(file, main, root, deadline, since) {
+    const results = new Map();
+    const runs = [];
+    for await (const e of jsonlBackward(file)) {
+        if (Date.now() > deadline)
+            return null;
+        if (time(e.timestamp) < since)
+            break;
+        for (const p of parts(e)) {
+            const r = toolResult(e, p);
+            if (r)
+                results.set(p.tool_use_id, r);
+            const call = bashCall(e, p, main, root);
+            const got = call && results.get(p.id);
+            if (call && got)
+                runs.push(run(call, got));
+        }
+    }
+    return runs;
+}
+// The full runs of main in the repo root in the session and its subagents, in time order; null once Date.now() passes the
+// deadline. With since (ms), only the runs from then on, read from the end of each file.
+export async function claudeRuns(transcriptPath, main, root, deadline, since) {
+    const runs = [];
+    for (const file of [transcriptPath, ...(await subagentFiles(transcriptPath))]) {
+        const found = since === undefined ? await forward(file, main, root, deadline) : await backward(file, main, root, deadline, since);
+        if (!found)
+            return null;
+        runs.push(...found);
+    }
+    if (Date.now() > deadline)
+        return null;
+    return runs.sort((a, b) => a.at - b.at);
+}
+// Codex records the directory as a file URL.
+function codexDir(cwd) {
+    if (typeof cwd !== "string")
+        return undefined;
+    try {
+        return cwd.startsWith("file:") ? fileURLToPath(cwd) : cwd;
+    }
+    catch {
+        return undefined;
+    }
+}
+// A finished command as a run of main, or null. Codex records the argv; the script is what the shell was given.
+function codexRun(e, main, root) {
+    const item = e.payload?.item;
+    const at = time(e.timestamp);
+    if (e.type !== "event_msg" || e.payload?.type !== "item_completed" || item?.type !== "CommandExecution" || Number.isNaN(at))
+        return null;
+    const argv = item.command;
+    const command = Array.isArray(argv) && /^-\w*c$/.test(String(argv[1])) ? argv[2] : null;
+    const shape = typeof command === "string" ? parse(command, main, codexDir(item.cwd), root) : null;
+    if (!shape || typeof command !== "string")
+        return null;
+    // No exit status recorded: nothing says it passed or failed.
+    const code = item.exit_code;
+    const output = typeof item.aggregated_output === "string" ? item.aggregated_output : "";
+    return { command, at, outcome: outcome(output, typeof code === "number" ? code !== 0 : undefined, shape.piped) };
+}
+// The same for a Codex rollout, which has no subagent files.
+export async function codexRuns(rolloutPath, main, root, deadline, since) {
+    const runs = [];
+    for await (const e of since === undefined ? jsonl(rolloutPath) : jsonlBackward(rolloutPath)) {
+        if (Date.now() > deadline)
+            return null;
+        if (since !== undefined && time(e.timestamp) < since)
+            break;
+        const r = codexRun(e, main, root);
+        if (r)
+            runs.push(r);
+    }
+    return runs.sort((a, b) => a.at - b.at);
+}

package/opencode/berliner.js

@@ -63,14 +63,23 @@ async function withChildren(client, session, depth = 0) {
   return { ...session, cost, tokens };
 }
 
+// Each save's place in the order saves started, and per session the latest one written: a save that finishes after a later
+// one (past its 10-second deadline in serial) never writes, nor reports, its older totals.
+let seq = 0;
+const committed = new Map();
+
 // Saves a top-level session with its subagents' totals where `berliner report` run by the agent finds them: its shell can't
-// reach this client. Returns what it saved, or null for a child session, which the top-level session's totals count.
+// reach this client. Returns what it saved, or null for a child session, which the top-level session's totals count, and for
+// a save a later one overtook.
 async function save(client, sessionID) {
+  const mine = ++seq;
   if (typeof sessionID !== "string" || !SAFE_ID.test(sessionID)) return null;
   const found = await get(client, sessionID);
   if (found?.id !== sessionID || found.parentID) return null;
   // OpenCode moves time.updated only when a prompt arrives, so the session's last activity is now.
   const session = { ...(await withChildren(client, found)), time: { ...found.time, updated: Date.now() } };
+  if ((committed.get(sessionID) ?? 0) > mine) return null;
+  committed.set(sessionID, mine);
   const dir = join(process.env.XDG_STATE_HOME || join(homedir(), ".local", "state"), "berliner", "opencode");
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   const file = join(dir, `${sessionID}.json`);
@@ -83,7 +92,6 @@ async function save(client, sessionID) {
 // One session's saves run one at a time, in the order they came, so an older total never overwrites a newer one. A save that
 // hangs holds the next one up for 10 seconds at most.
 // shortcut: only within this OpenCode process; two `berliner hook` processes can still write out of order, lock there if that shows up.
-// shortcut: a save that resumes after its deadline can write older totals; the next save rewrites them.
 const queues = new Map();
 const serial = (id, fn) => {
   const p = (queues.get(id) ?? Promise.resolve()).then(fn, fn);

package/package.json

@@ -1,7 +1,16 @@
 {
   "name": "@paxnax/berliner",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "Report coding-agent sessions to Berliner",
+  "keywords": [
+    "claude-code",
+    "codex",
+    "opencode",
+    "coding-agents",
+    "ai-cost-tracking",
+    "cli"
+  ],
+  "homepage": "https://berliner.app",
   "type": "module",
   "engines": {
     "node": ">=22"

package/skill/SKILL.md

@@ -28,6 +28,7 @@ Hooks installed by `berliner setup` already report the session's cost, model, re
 | `--pr` | Every pull request, one flag each. |
 | `--coverage` | Percent, from the test run's coverage summary. |
 | `--evidence` | Each screenshot or video. |
+| `--team`, `--no-team` | Only when the user asks for a one-off. See [Teams](#teams). |
 
 Do not pass `--session-id`, `--cost` or `--model`: the CLI fills them in from the tool's own records, and an explicit value is ignored with a warning. `--repo` and `--plan` are not needed either: the plan comes from the user's `BERLINER_PLAN`, or from their subscriptions in Settings. A report without `--title` keeps the session's existing title. `berliner update` ignores a session ID here.
 
@@ -86,6 +87,36 @@ In a non-interactive session (no user to answer), never ask and never save.
 
 The repository comes from `git remote get-url origin`; `--repo owner/name` names another one.
 
+## Teams
+
+A session reports to the user's own plan unless a team is set. The CLI picks the team from the first of these that exists:
+
+| Source | Use it for |
+|---|---|
+| `--team <uuid>` or `--no-team` | One report. `--no-team` beats every other source. |
+| `team` in `.berliner.json` at the repository root: `{ "team": "<uuid>" }` | The whole team. The file is meant to be committed. |
+| `BERLINER_TEAM` | One machine or shell. |
+| `berliner team <uuid>` | One machine, saved globally. `berliner team --none` clears it; `berliner team` prints the team in effect and where it came from. |
+
+With none of them, the session goes to the user's own plan. Do not set a team yourself: the user or the repository already did.
+
+Only the report that creates a session sends the team. A session's team is fixed after that, and the CLI warns when a later setting differs. Ignore the warning.
+
+The server can refuse the report that creates a team session with a 422. The message says how to fix it:
+
+| Code | Meaning | Fix |
+|---|---|---|
+| `team_not_found` | No team has that uuid. | Check the uuid in `.berliner.json`, `BERLINER_TEAM` or the global setting. |
+| `team_not_member` | The user is not a member of the team. | The user accepts the team's invite in the web app, or the owner invites them. |
+| `team_not_eligible` | The repository's owner is not an organization the team covers. | The team's owner adds the organization in the web app, or the user reports this repository without the team. |
+| `team_inactive` | The team has no active plan. | The team's owner sets up the plan in the web app. |
+
+When a report is refused, tell the user in your next message and quote the message the CLI printed. Inside Claude Code, Codex or OpenCode the hook cannot print it: it saves a note, and the next `berliner report`, `update`, `session` or `sessions` in that repository prints it once. The web app shows it as a banner too.
+
+Never add `--no-team` or a different `--team` just to get past a refusal unless the user agrees. That moves the session to another plan.
+
+The team's owner sees every session and file reported to the team. Members never see each other's team work.
+
 ## Keep PR states current
 
 A PR in a repository without the Berliner GitHub App keeps the state you last reported. So:
@@ -119,6 +150,7 @@ Report again with the same `--session-id` whenever something changes.
 - `--public`: with `--evidence`, also make those files viewable without sign-in. See below.
 - `--task <id>`, `--task-url <url>`: the ticket. See [Tickets](#tickets).
 - `--project <name>`: only the ticket's tracker project or a project the user named. See [Projects](#projects).
+- `--team <uuid>`, `--no-team`: which plan the session reports to. See [Teams](#teams).
 - `--started-at <ISO>`, `--ended-at <ISO>`.
 
 Quote any value that contains spaces.