@bli-cockpit/cli 0.1.0

package/README.md

@@ -0,0 +1,26 @@
+# Cockpit CLI
+
+Public BLI Cockpit command-line interface for approved operators and interns.
+
+The CLI pairs a local laptop with the private Cockpit dashboard, records safe
+metadata-only work context, and uploads that metadata after dashboard-approved
+device pairing.
+
+```bash
+npm exec --yes --package=@bli-cockpit/cli -- cockpit onboard \
+  --dashboard-url <dashboard-url> \
+  --email <approved-email> \
+  --device-name "<device-name>" \
+  --repo "$PWD"
+```
+
+When ticket work starts later:
+
+```bash
+npm exec --yes --package=@bli-cockpit/cli -- cockpit start \
+  --ticket <ticket-id> \
+  --repo "$PWD"
+```
+
+This public package intentionally excludes Cockpit admin bootstrap commands,
+service-role credential handling, source maps, tests, and internal runbooks.

package/dist/adapters/car-state.js

@@ -0,0 +1,103 @@
+import { SourceScanResultSchema, } from "@bli-cockpit/telemetry-core";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { makeSourceAdapterIdentity, parseTicketIdFromText, } from "./common.js";
+export async function collectCarState(context) {
+    const ticketsDir = path.join(context.repoRoot, ".codex-autorunner", "tickets");
+    try {
+        const filenames = (await fs.readdir(ticketsDir))
+            .filter(isCarTicketFilename)
+            .sort();
+        const tickets = await Promise.all(filenames.map(async (filename) => parseCarTicketFile(path.join(ticketsDir, filename))));
+        const openTickets = tickets.filter((ticket) => !ticket.done);
+        const currentTicket = openTickets[0] ?? null;
+        const ticketId = currentTicket && parseTicketIdFromText(`${currentTicket.ticket_id} ${currentTicket.title}`);
+        const ticketBindingCandidates = ticketId
+            ? [
+                {
+                    ticket_id: ticketId,
+                    binding_source: "car_ticket",
+                    confidence: 0.7,
+                    evidence_labels: [`car_ticket:${currentTicket.file}`],
+                },
+            ]
+            : [];
+        const facts = {
+            present: true,
+            current_ticket: currentTicket,
+            open_ticket_count: openTickets.length,
+        };
+        return {
+            scan: makeCarScan({
+                context,
+                status: "ok",
+                facts,
+                ticketBindingCandidates,
+                diagnosticLabels: [
+                    `car_open_tickets:${facts.open_ticket_count}`,
+                    currentTicket ? `car_current_ticket:${currentTicket.file}` : "car_no_open_ticket",
+                ],
+            }),
+            facts,
+        };
+    }
+    catch {
+        const facts = {
+            present: false,
+            current_ticket: null,
+            open_ticket_count: 0,
+        };
+        return {
+            scan: makeCarScan({
+                context,
+                status: "skipped",
+                facts,
+                ticketBindingCandidates: [],
+                diagnosticLabels: ["car_not_present"],
+            }),
+            facts,
+        };
+    }
+}
+export async function parseCarTicketFile(filePath) {
+    const raw = await fs.readFile(filePath, "utf8");
+    return {
+        file: path.basename(filePath),
+        ticket_id: matchFrontmatter(raw, "ticket_id") ?? path.basename(filePath, ".md"),
+        title: matchFrontmatter(raw, "title") ?? path.basename(filePath, ".md"),
+        done: (matchFrontmatter(raw, "done") ?? "false") === "true",
+    };
+}
+function makeCarScan(options) {
+    return SourceScanResultSchema.parse({
+        adapter: makeSourceAdapterIdentity("car_state", "car-state"),
+        work_context_id: options.context.workContextId,
+        status: options.status,
+        started_at: options.context.now.toISOString(),
+        finished_at: options.context.now.toISOString(),
+        events: options.facts.current_ticket
+            ? [
+                {
+                    source_event_id: `car-ticket:${options.facts.current_ticket.file}`,
+                    event_type: "car_ticket_snapshot",
+                    occurred_at: options.context.now.toISOString(),
+                    redaction: {
+                        privacy_classification: "metadata",
+                        redaction_status: "metadata_only",
+                        redacted_fields: [],
+                        raw_evidence_pointer_ids: [],
+                    },
+                },
+            ]
+            : [],
+        ticket_binding_candidates: options.ticketBindingCandidates,
+        diagnostic_labels: options.diagnosticLabels,
+    });
+}
+function isCarTicketFilename(filename) {
+    return /^TICKET-\d+-.+\.md$/.test(filename);
+}
+function matchFrontmatter(raw, key) {
+    const match = raw.match(new RegExp(`^${key}:\\s*"?([^"\\n]+)"?`, "m"));
+    return match?.[1]?.trim() ?? null;
+}

package/dist/adapters/common.js

@@ -0,0 +1,35 @@
+import { SourceScanResultSchema, } from "@bli-cockpit/telemetry-core";
+import { LOCAL_COLLECTOR_VERSION } from "../local-state.js";
+export function makeSourceAdapterIdentity(captureSource, adapterName) {
+    return {
+        capture_source: captureSource,
+        adapter_name: adapterName,
+        capture_adapter_version: LOCAL_COLLECTOR_VERSION,
+    };
+}
+export function makeCaptureProvenance(context, captureSource) {
+    return {
+        capture_source: captureSource,
+        capture_adapter_version: LOCAL_COLLECTOR_VERSION,
+        collector_version: LOCAL_COLLECTOR_VERSION,
+        repo: context.repoRoot,
+        branch: context.branch,
+        operator_id: context.operatorId,
+        session_id: context.sessionId,
+        work_context_id: context.workContextId,
+    };
+}
+export function makeUnavailableScan(context, captureSource, adapterName, reasonLabel) {
+    return SourceScanResultSchema.parse({
+        adapter: makeSourceAdapterIdentity(captureSource, adapterName),
+        work_context_id: context.workContextId,
+        status: "skipped",
+        started_at: context.now.toISOString(),
+        finished_at: context.now.toISOString(),
+        diagnostic_labels: [reasonLabel],
+    });
+}
+export function parseTicketIdFromText(value) {
+    const match = value.match(/\b[A-Z][A-Z0-9]{1,12}-\d+\b/);
+    return match?.[0] ?? null;
+}

package/dist/adapters/git-state.js

@@ -0,0 +1,133 @@
+import { SourceScanResultSchema, } from "@bli-cockpit/telemetry-core";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { makeSourceAdapterIdentity, parseTicketIdFromText, } from "./common.js";
+const execFileAsync = promisify(execFile);
+export async function collectGitState(context, runner = defaultGitCommandRunner()) {
+    const startedAt = context.now.toISOString();
+    try {
+        const repoRoot = (await runner.runGit(["rev-parse", "--show-toplevel"], context.repoRoot, 2_000)).trim() ||
+            context.repoRoot;
+        const branch = (await runner.runGit(["rev-parse", "--abbrev-ref", "HEAD"], repoRoot, 2_000)).trim() ||
+            context.branch;
+        const porcelain = await runner.runGit(["status", "--porcelain=v1"], repoRoot, 2_000);
+        const unstagedNumstat = await runner.runGit(["diff", "--numstat"], repoRoot, 2_000);
+        const stagedNumstat = await runner.runGit(["diff", "--cached", "--numstat"], repoRoot, 2_000);
+        const fileStats = [...parseNumstat(unstagedNumstat), ...parseNumstat(stagedNumstat)];
+        const addedLines = fileStats.reduce((sum, file) => sum + file.added_lines, 0);
+        const deletedLines = fileStats.reduce((sum, file) => sum + file.deleted_lines, 0);
+        const changedPaths = [
+            ...new Set([
+                ...parsePorcelainPaths(porcelain),
+                ...fileStats.map((file) => file.path),
+            ]),
+        ].sort();
+        const ticketIdFromBranch = parseTicketIdFromText(branch);
+        const ticketBindingCandidates = ticketIdFromBranch
+            ? [
+                {
+                    ticket_id: ticketIdFromBranch,
+                    binding_source: "branch_name",
+                    confidence: 0.85,
+                    evidence_labels: [`branch:${branch}`],
+                },
+            ]
+            : [];
+        const facts = {
+            repo_root: repoRoot,
+            branch,
+            changed_file_count: changedPaths.length,
+            added_lines: addedLines,
+            deleted_lines: deletedLines,
+            changed_paths: changedPaths,
+            ticket_id_from_branch: ticketIdFromBranch,
+        };
+        const scan = makeGitScan({
+            context,
+            startedAt,
+            status: "ok",
+            branch,
+            facts,
+            ticketBindingCandidates,
+            diagnosticLabels: [
+                `changed_files:${facts.changed_file_count}`,
+                `added_lines:${facts.added_lines}`,
+                `deleted_lines:${facts.deleted_lines}`,
+            ],
+        });
+        return { scan, facts };
+    }
+    catch (error) {
+        const scan = makeGitScan({
+            context,
+            startedAt,
+            status: "failed",
+            branch: context.branch,
+            facts: null,
+            ticketBindingCandidates: [],
+            diagnosticLabels: [
+                `git_unavailable:${error instanceof Error ? error.message : String(error)}`,
+            ],
+        });
+        return { scan, facts: { git_unavailable: true } };
+    }
+}
+export function parseNumstat(raw) {
+    return raw
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .map((line) => {
+        const [addedRaw, deletedRaw, filePath] = line.split(/\s+/, 3);
+        return {
+            path: filePath ?? "unknown",
+            added_lines: Number.parseInt(addedRaw ?? "0", 10) || 0,
+            deleted_lines: Number.parseInt(deletedRaw ?? "0", 10) || 0,
+        };
+    });
+}
+export function parsePorcelainPaths(raw) {
+    return raw
+        .split("\n")
+        .filter((line) => line.trim())
+        .map((line) => line.slice(3).trim())
+        .filter(Boolean);
+}
+function makeGitScan(options) {
+    return SourceScanResultSchema.parse({
+        adapter: makeSourceAdapterIdentity("git_state", "git-state"),
+        work_context_id: options.context.workContextId,
+        status: options.status,
+        started_at: options.startedAt,
+        finished_at: options.context.now.toISOString(),
+        events: options.facts
+            ? [
+                {
+                    source_event_id: `git-state:${options.branch}`,
+                    event_type: "git_state_snapshot",
+                    occurred_at: options.context.now.toISOString(),
+                    redaction: {
+                        privacy_classification: "metadata",
+                        redaction_status: "metadata_only",
+                        redacted_fields: [],
+                        raw_evidence_pointer_ids: [],
+                    },
+                },
+            ]
+            : [],
+        ticket_binding_candidates: options.ticketBindingCandidates,
+        diagnostic_labels: options.diagnosticLabels,
+    });
+}
+function defaultGitCommandRunner() {
+    return {
+        async runGit(args, cwd, timeoutMs) {
+            const { stdout } = await execFileAsync("git", args, {
+                cwd,
+                timeout: timeoutMs,
+                maxBuffer: 1024 * 1024,
+            });
+            return stdout;
+        },
+    };
+}

package/dist/adapters/local-sources.js

@@ -0,0 +1,59 @@
+import { collectCarState } from "./car-state.js";
+import { makeUnavailableScan, } from "./common.js";
+import { collectGitState } from "./git-state.js";
+import { generateDumbRiskFlags } from "./risk-flags.js";
+import { resolveTicketBinding, } from "./ticket-binding.js";
+export async function runLocalSourceCollectors(options) {
+    const context = {
+        repoRoot: options.repoRoot,
+        branch: options.branch,
+        operatorId: options.operatorId,
+        sessionId: options.sessionId,
+        workContextId: options.workContextId,
+        now: options.now ?? new Date(),
+    };
+    const git = await collectGitState(context);
+    const car = await collectCarState(context);
+    const unavailableScans = [
+        makeUnavailableScan(context, "codex_jsonl", "codex-jsonl", "codex_session_file_not_configured"),
+        makeUnavailableScan(context, "codex_otel", "codex-otel", "codex_otel_export_not_configured"),
+        makeUnavailableScan(context, "github_state", "github-state", "github_auth_not_configured"),
+        makeUnavailableScan(context, "linear_state", "linear-state", "linear_auth_not_configured"),
+        makeUnavailableScan(context, "mcp_local", "mcp-local", "mcp_activity_not_configured"),
+        makeUnavailableScan(context, "claude_hooks", "claude-hooks", "claude_hooks_not_present"),
+    ];
+    const candidates = collectBindingCandidates([
+        git.scan,
+        car.scan,
+        ...unavailableScans,
+    ]);
+    const binding = resolveTicketBinding({
+        activeWorkContext: options.activeWorkContext,
+        candidates,
+    });
+    const gitFacts = isGitStateFacts(git.facts) ? git.facts : null;
+    const carFacts = isCarStateFacts(car.facts) ? car.facts : null;
+    const riskFlags = generateDumbRiskFlags({
+        context,
+        git: gitFacts,
+        binding,
+    });
+    return {
+        scans: [git.scan, car.scan, ...unavailableScans],
+        facts: {
+            git: gitFacts,
+            car: carFacts,
+        },
+        binding,
+        risk_flags: riskFlags,
+    };
+}
+function collectBindingCandidates(scans) {
+    return scans.flatMap((scan) => scan.ticket_binding_candidates);
+}
+function isGitStateFacts(value) {
+    return Boolean(value && typeof value === "object" && "repo_root" in value);
+}
+function isCarStateFacts(value) {
+    return Boolean(value && typeof value === "object" && "present" in value);
+}

package/dist/adapters/risk-flags.js

@@ -0,0 +1,67 @@
+import { RiskFlagSchema, } from "@bli-cockpit/telemetry-core";
+import crypto from "node:crypto";
+import { makeCaptureProvenance, } from "./common.js";
+export function generateDumbRiskFlags(input) {
+    const flags = [];
+    const git = input.git ?? null;
+    const changedLines = (git?.added_lines ?? 0) + (git?.deleted_lines ?? 0);
+    if (git && changedLines >= 800 && !input.hasPlanSignal) {
+        flags.push(makeRiskFlag(input, "no_plan_signal_before_large_edit", [
+            "missing_plan_signal",
+            "large_edit",
+        ]));
+    }
+    if (git &&
+        git.changed_file_count >= 1 &&
+        git.added_lines >= 200 &&
+        git.deleted_lines >= 200) {
+        flags.push(makeRiskFlag(input, "many_add_revert_loops", ["add_revert_loop"]));
+    }
+    if (input.reviewFindingPriorities?.some((priority) => ["p1", "p2", "P1", "P2"].includes(priority))) {
+        flags.push(makeRiskFlag(input, "p1_or_p2_review_finding", [
+            input.reviewFindingPriorities.some((priority) => priority.toLowerCase() === "p1")
+                ? "p1_review_finding"
+                : "p2_review_finding",
+        ]));
+    }
+    if ((input.repeatedFailureCount ?? 0) >= 3) {
+        flags.push(makeRiskFlag(input, "repeated_same_failing_command", [
+            "same_failing_command",
+        ]));
+    }
+    if ((input.permissionDeniedCount ?? 0) >= 2) {
+        flags.push(makeRiskFlag(input, "permission_denied_spike", ["permission_denied"]));
+    }
+    if ((input.tokenCount ?? 0) >= 1_000_000 && !input.hasPullRequest) {
+        flags.push(makeRiskFlag(input, "high_token_or_time_burn_no_pr", [
+            "token_pressure",
+            "no_pr_after_work",
+        ]));
+    }
+    const branchTicket = git?.ticket_id_from_branch;
+    if (branchTicket &&
+        input.binding.selected_ticket_id &&
+        branchTicket !== input.binding.selected_ticket_id) {
+        flags.push(makeRiskFlag(input, "branch_ticket_mismatch", [
+            "branch_ticket_disagreement",
+        ]));
+    }
+    return flags;
+}
+function makeRiskFlag(input, riskType, evidenceLabels) {
+    return RiskFlagSchema.parse({
+        risk_flag_id: `risk-${crypto
+            .createHash("sha256")
+            .update(`${riskType}:${input.context.workContextId}:${evidenceLabels.join(",")}`)
+            .digest("hex")
+            .slice(0, 16)}`,
+        risk_type: riskType,
+        severity: riskType === "p1_or_p2_review_finding" || riskType === "branch_ticket_mismatch"
+            ? "high"
+            : "warning",
+        observed_at: input.context.now.toISOString(),
+        evidence_labels: evidenceLabels,
+        evidence_pointer_ids: [],
+        provenance: makeCaptureProvenance(input.context, "collector_runtime"),
+    });
+}

package/dist/adapters/ticket-binding.js

@@ -0,0 +1,65 @@
+const BINDING_PRIORITY = [
+    "active_work_context",
+    "branch_name",
+    "linear_assignment",
+    "car_ticket",
+    "manual_picker",
+    "github_pr",
+    "mcp_context",
+];
+export function resolveTicketBinding(options) {
+    const activeCandidate = options.activeWorkContext?.active_ticket_id
+        ? {
+            ticket_id: options.activeWorkContext.active_ticket_id,
+            binding_source: "active_work_context",
+            confidence: 1,
+            evidence_labels: ["active_work_context"],
+        }
+        : null;
+    const candidates = dedupeCandidates([
+        ...(activeCandidate ? [activeCandidate] : []),
+        ...options.candidates,
+    ]);
+    for (const source of BINDING_PRIORITY) {
+        const sourceCandidates = candidates.filter((candidate) => candidate.binding_source === source);
+        const uniqueTicketIds = new Set(sourceCandidates.map((candidate) => candidate.ticket_id));
+        if (uniqueTicketIds.size === 1) {
+            const selected = sourceCandidates[0];
+            return {
+                state: "bound",
+                selected_ticket_id: selected.ticket_id,
+                selected_source: selected.binding_source,
+                candidates,
+                diagnostic_labels: [`bound_by:${source}`],
+            };
+        }
+        if (uniqueTicketIds.size > 1) {
+            return {
+                state: "ambiguous",
+                selected_ticket_id: null,
+                selected_source: source,
+                candidates,
+                diagnostic_labels: [`ambiguous:${source}`],
+            };
+        }
+    }
+    return {
+        state: "unbound",
+        selected_ticket_id: null,
+        selected_source: null,
+        candidates,
+        diagnostic_labels: ["no_ticket_binding_candidate"],
+    };
+}
+function dedupeCandidates(candidates) {
+    const seen = new Set();
+    const deduped = [];
+    for (const candidate of candidates) {
+        const key = `${candidate.binding_source}:${candidate.ticket_id}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        deduped.push(candidate);
+    }
+    return deduped;
+}

package/dist/cli.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { runCockpitCli } from "./commands/public-root.js";
+
+const exitCode = await runCockpitCli(process.argv.slice(2));
+process.exitCode = exitCode;