@bli-cockpit/cli 0.1.23 → 0.1.24

package/README.md

@@ -11,27 +11,35 @@ device pairing.
 
 ## One-paste install
 
-Run this from the repo where work will happen:
+Run this in a terminal. If you are inside `~/BLI`, Cockpit suggests that
+workspace root; otherwise it looks for likely roots such as `~/BLI` and asks
+before collecting. Later reruns remember the approved roots:
 
 ```bash
 npm install -g @bli-cockpit/cli@latest
-cockpit onboard --workspace "$PWD"
+cockpit onboard
 ```
 
 Interactive onboarding prompts for the dashboard email. Enter the approved
 intern/operator email. For reused laptops, VMs, or headless/agent-run setup,
-pass the email explicitly:
+pass the email and root explicitly:
 
 ```bash
-cockpit onboard --email <APPROVED_EMAIL> --workspace "$PWD"
+cockpit onboard --email <APPROVED_EMAIL> --workspace ~/BLI
 ```
 
-If a work folder contains multiple repos, run the same command from the parent:
+If a work folder contains multiple repos, confirm the parent folder as the
+collection root. In a headless setup, pass it explicitly:
 
 ```bash
-cd ~/Downloads/bluepearl-workspace
 npm install -g @bli-cockpit/cli@latest
-cockpit onboard --workspace "$PWD"
+cockpit onboard --email <APPROVED_EMAIL> --workspace ~/BLI
+```
+
+For multiple unrelated collection roots, repeat `--workspace`:
+
+```bash
+cockpit onboard --email <APPROVED_EMAIL> --workspace ~/BLI --workspace ~/side-projects
 ```
 
 The CLI defaults to the production dashboard. Normal intern/operator setup,
@@ -39,25 +47,23 @@ updates, and syncs omit `--dashboard-url`. Pass `--dashboard-url` only for
 staging, a custom dashboard, or deliberately forcing a different dashboard
 pairing. Already-onboarded users update with
 `npm install -g @bli-cockpit/cli@latest`, then run
-`cockpit sync --workspace "$PWD" --json`. `--repo <path>` remains supported
-for older prompts and the agent ticket-binding guardrail.
-
-On machines where Codex or Claude agents will do ticketed work, interactive
-`cockpit onboard` checks `~/.codex/AGENTS.md` and `~/.claude/CLAUDE.md` after
-harvest proof. If equivalent Cockpit ticket-binding guidance already exists, it
-leaves the files alone. If guidance is missing or clearly stale, it asks whether
-to install or replace it. The managed guidance is scoped to the workspace path
-used for onboarding, so agents should ignore it in private chats or unrelated
-repos.
-
-For intern machines, accept the onboarding prompt to keep Cockpit syncing in the
-background. It installs the launchd autostart agent so Cockpit syncs at login
-and every 15 minutes. If skipped, run
-`cockpit autostart install --workspace "$PWD"` later.
+`cockpit onboard` from anywhere to refresh pairing, agent rules, autostart, and
+an initial sync against saved roots. `--repo <path>` remains supported for older
+prompts and the agent ticket-binding guardrail.
+
+On machines where Codex or Claude agents will do ticketed work, `cockpit
+onboard` refreshes `~/.codex/AGENTS.md` and `~/.claude/CLAUDE.md` after harvest
+proof. The managed Cockpit ticket-binding block is replaced in place rather
+than duplicated and is scoped to the confirmed root set, so agents should ignore
+it in private chats or unrelated repos.
+
+For intern machines, `cockpit onboard` refreshes the launchd autostart agent so
+Cockpit syncs confirmed roots at login and every 15 minutes. For a manual
+repair path, run `cockpit autostart install --workspace <root>` later.
 
 ```bash
-# Repair/manual path, or headless/json onboarding where Cockpit cannot prompt.
-cockpit agent-rules install --workspace "$PWD"
+# Repair/manual path.
+cockpit agent-rules install --workspace <root>
 ```
 
 The direct command updates `~/.codex/AGENTS.md` and `~/.claude/CLAUDE.md` with
@@ -87,18 +93,21 @@ What happens:
 4. Admin approves the persistent email access request from Ambient -> Collector
    approvals. Pair codes still expire, but the access request remains. If the
    terminal is still polling, approval pairs it immediately; if not, the intern
-   reruns `cockpit onboard --email <APPROVED_EMAIL> --workspace "$PWD"` and the
-   stored approval auto-pairs without another Admin action. Admin can still
-   paste the printed code there as a rescue path. The signed-in intern can still
-   use the printed URL. If the claimed email is not an app user yet, a super
-   admin approval creates the user, adds team membership, and sends the
-   Supabase invite flow automatically.
+   reruns `cockpit onboard --email <APPROVED_EMAIL> --workspace ~/BLI` or
+   simply `cockpit onboard` after roots are saved, and the stored approval
+   auto-pairs without another Admin action. Admin can still paste the printed
+   code there as a rescue path. The signed-in intern can still use the printed
+   URL. If the claimed email is not an app user yet, a super admin approval
+   creates the user, adds team membership, and sends the Supabase invite flow
+   automatically.
 5. The CLI starts general ambient capture, uploads private raw evidence objects
    when present (chunked and resumable, with identical content acknowledged
    instead of re-uploaded), then uploads one safe metadata/ref envelope. Text
    evidence with secret-shaped values is sanitized before storage and marked as
    partial evidence with redaction metadata; env files are still never read.
-6. The CLI prints `PASS: Cockpit collector is ready for harvest.`
+6. The CLI prints `PASS: Cockpit collector is ready for harvest.` and a final
+   `You're live.` block with collection roots, pairing state, background sync
+   state, dashboard link, and `cockpit status` as the next command.
 
 `--device-name` is optional and only a readable label in Cockpit. Pass it only
 when you want a specific label such as `"Savina MacBook"` or `"Box VM 42"`.

package/dist/agent-rules.js

@@ -15,7 +15,11 @@ export async function installAgentRules(options = {}) {
 }
 async function installAgentRulesForHost(host, options = {}) {
     const rulesFile = agentRulesFile(host, options.homeDir);
-    const block = cockpitAgentRulesBlock({ scopePath: options.scopePath });
+    const block = cockpitAgentRulesBlock({
+        scopePath: options.scopePath,
+        scopePaths: options.scopePaths,
+    });
+    const scopePaths = normalizeScopePaths(options);
     let existing = "";
     let existed = true;
     try {
@@ -24,7 +28,7 @@ async function installAgentRulesForHost(host, options = {}) {
     catch {
         existed = false;
     }
-    const prepared = prepareManagedBlockInstall(existing, block, options.scopePath);
+    const prepared = prepareManagedBlockInstall(existing, block, scopePaths);
     if (!prepared.next) {
         return agentRulesResult(host, rulesFile, "unchanged", block, prepared.state);
     }
@@ -78,7 +82,11 @@ export async function inspectAgentRules(options = {}) {
 }
 async function inspectAgentRulesForHost(host, options = {}) {
     const rulesFile = agentRulesFile(host, options.homeDir);
-    const block = cockpitAgentRulesBlock({ scopePath: options.scopePath });
+    const block = cockpitAgentRulesBlock({
+        scopePath: options.scopePath,
+        scopePaths: options.scopePaths,
+    });
+    const scopePaths = normalizeScopePaths(options);
     let existing = "";
     try {
         existing = await readFile(rulesFile, "utf8");
@@ -89,7 +97,7 @@ async function inspectAgentRulesForHost(host, options = {}) {
             installed: false,
         };
     }
-    const state = inspectAgentRulesContents(existing, block, options.scopePath);
+    const state = inspectAgentRulesContents(existing, block, scopePaths);
     const installed = state === "managed" || state === "equivalent";
     return {
         ...agentRulesResult(host, rulesFile, installed ? "unchanged" : "missing", block, state),
@@ -97,10 +105,12 @@ async function inspectAgentRulesForHost(host, options = {}) {
     };
 }
 export function cockpitAgentRulesBlock(options = {}) {
-    const scopePath = options.scopePath ? path.resolve(options.scopePath) : null;
-    const scopeLine = scopePath
-        ? `- This guidance only applies when the current working directory is inside the Cockpit-onboarded workspace/repo: \`${scopePath}\`. Outside that folder, do not run Cockpit ticket binding or sync commands for private chats or unrelated repos.`
-        : "- This guidance only applies when the current working directory is inside the workspace/repo that ran `cockpit onboard` or `cockpit agent-rules install`. Outside that folder, do not run Cockpit ticket binding or sync commands for private chats or unrelated repos.";
+    const scopePaths = normalizeScopePaths(options);
+    const scopeLine = scopePaths.length === 1
+        ? `- This guidance only applies when the current working directory is inside the Cockpit-onboarded workspace/repo: \`${scopePaths[0]}\`. Outside that folder, do not run Cockpit ticket binding or sync commands for private chats or unrelated repos.`
+        : scopePaths.length > 1
+            ? `- This guidance only applies when the current working directory is inside one of these Cockpit-onboarded workspace roots: ${scopePaths.map((scopePath) => `\`${scopePath}\``).join(", ")}. Outside those folders, do not run Cockpit ticket binding or sync commands for private chats or unrelated repos.`
+            : "- This guidance only applies when the current working directory is inside the workspace/repo that ran `cockpit onboard` or `cockpit agent-rules install`. Outside that folder, do not run Cockpit ticket binding or sync commands for private chats or unrelated repos.";
     return [
         MANAGED_BLOCK_START,
         "## Cockpit Ticket Binding",
@@ -114,6 +124,19 @@ export function cockpitAgentRulesBlock(options = {}) {
         MANAGED_BLOCK_END,
     ].join("\n");
 }
+function normalizeScopePaths(options) {
+    const raw = options.scopePaths ?? (options.scopePath ? [options.scopePath] : []);
+    const seen = new Set();
+    const normalized = [];
+    for (const scopePath of raw) {
+        const resolved = path.resolve(scopePath);
+        if (seen.has(resolved))
+            continue;
+        seen.add(resolved);
+        normalized.push(resolved);
+    }
+    return normalized;
+}
 export function hasManagedBlock(contents) {
     return contents.includes(MANAGED_BLOCK_START) && contents.includes(MANAGED_BLOCK_END);
 }
@@ -131,7 +154,7 @@ export function removeManagedBlock(contents) {
         return contents;
     return contents.replace(managedBlockPattern(), "").replace(/\n{3,}/gu, "\n\n").trimEnd() + "\n";
 }
-function prepareManagedBlockInstall(contents, block, scopePath) {
+function prepareManagedBlockInstall(contents, block, scopePaths = []) {
     if (!contents.trim())
         return { next: `${block}\n`, state: "missing" };
     if (hasManagedBlock(contents)) {
@@ -140,10 +163,10 @@ function prepareManagedBlockInstall(contents, block, scopePath) {
             state: extractManagedBlock(contents) === block ? "managed" : "stale",
         };
     }
-    if (hasEquivalentUnmanagedTicketBinding(contents, scopePath)) {
+    if (hasEquivalentUnmanagedTicketBinding(contents, scopePaths)) {
         return { next: null, state: "equivalent" };
     }
-    const staleBlock = findStaleUnmanagedTicketBindingBlock(contents, scopePath);
+    const staleBlock = findStaleUnmanagedTicketBindingBlock(contents, scopePaths);
     if (staleBlock) {
         return {
             next: replaceLineSpan(contents, staleBlock.startLine, staleBlock.endLine, block),
@@ -152,13 +175,13 @@ function prepareManagedBlockInstall(contents, block, scopePath) {
     }
     return { next: `${contents.replace(/\s+$/u, "")}\n\n${block}\n`, state: "missing" };
 }
-function inspectAgentRulesContents(contents, block, scopePath) {
+function inspectAgentRulesContents(contents, block, scopePaths = []) {
     if (hasManagedBlock(contents)) {
         return extractManagedBlock(contents) === block ? "managed" : "stale";
     }
-    if (hasEquivalentUnmanagedTicketBinding(contents, scopePath))
+    if (hasEquivalentUnmanagedTicketBinding(contents, scopePaths))
         return "equivalent";
-    if (findStaleUnmanagedTicketBindingBlock(contents, scopePath))
+    if (findStaleUnmanagedTicketBindingBlock(contents, scopePaths))
         return "stale";
     return "missing";
 }
@@ -200,13 +223,13 @@ function managedBlockPattern() {
 function extractManagedBlock(contents) {
     return contents.match(managedBlockPattern())?.[0] ?? null;
 }
-function hasEquivalentUnmanagedTicketBinding(contents, scopePath) {
+function hasEquivalentUnmanagedTicketBinding(contents, scopePaths = []) {
     const text = normalizeRuleText(contents);
     if (!hasTicketBindingCues(text))
         return false;
     if (!hasRepoScopeGuard(text))
         return false;
-    if (scopePath && !hasScopePath(text, scopePath))
+    if (scopePaths.some((scopePath) => !hasScopePath(text, scopePath)))
         return false;
     if (!hasTicketLookupOrCreationCue(text))
         return false;
@@ -231,7 +254,7 @@ function hasRepoScopeGuard(text) {
         /outside\s+that\s+(?:folder|workspace|repo).*(?:do\s+not|dont)\s+run\s+cockpit/u.test(text) ||
         /private\s+chats\s+or\s+unrelated\s+repos/u.test(text));
 }
-function findStaleUnmanagedTicketBindingBlock(contents, scopePath) {
+function findStaleUnmanagedTicketBindingBlock(contents, scopePaths = []) {
     const lines = contents.split("\n");
     for (let index = 0; index < lines.length; index += 1) {
         if (!/^#{1,6}\s+.*(?:cockpit\s+)?ticket\s+binding\b/iu.test(lines[index] ?? "")) {
@@ -247,7 +270,7 @@ function findStaleUnmanagedTicketBindingBlock(contents, scopePath) {
         const candidate = lines.slice(index, endLine).join("\n");
         const normalized = normalizeRuleText(candidate);
         if (hasTicketBindingCues(normalized) &&
-            !hasEquivalentUnmanagedTicketBinding(candidate, scopePath)) {
+            !hasEquivalentUnmanagedTicketBinding(candidate, scopePaths)) {
             return { startLine: index, endLine };
         }
     }

package/dist/autostart.js

@@ -29,7 +29,9 @@ export async function installAutostartAgent(options) {
     if (platform !== "darwin")
         return unsupportedResult(options.homeDir);
     const homeDir = options.homeDir ?? os.homedir();
-    const workDir = path.resolve(options.repoRoot ?? process.cwd());
+    const workDirs = normalizeWorkDirs(options.repoRoots);
+    const workDir = path.resolve(options.repoRoot ?? workDirs[0] ?? process.cwd());
+    const resolvedWorkDirs = workDirs.length > 0 ? workDirs : [workDir];
     const dashboardUrl = options.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
     const intervalSeconds = options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS;
     const paths = getCollectorRuntimePaths(homeDir);
@@ -44,6 +46,7 @@ export async function installAutostartAgent(options) {
     await mkdir(paths.state_dir, { recursive: true });
     await writeFile(plistPath, renderPlist({
         workDir,
+        workDirs: resolvedWorkDirs,
         dashboardUrl,
         intervalSeconds,
         stdoutPath,
@@ -62,6 +65,7 @@ export async function installAutostartAgent(options) {
         loaded,
         interval_seconds: intervalSeconds,
         work_dir: workDir,
+        work_dirs: resolvedWorkDirs,
         dashboard_url: dashboardUrl,
         ...(loaded
             ? {}
@@ -131,7 +135,10 @@ function renderPlist(options) {
     const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
         ? ""
         : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
-    const command = `cockpit sync --workspace ${shellQuote(options.workDir)}${dashboardArg} --json`;
+    const roots = options.workDirs.length > 0 ? options.workDirs : [options.workDir];
+    const command = roots
+        .map((root) => `cockpit sync --workspace ${shellQuote(root)}${dashboardArg} --json`)
+        .join("; ");
     return [
         '<?xml version="1.0" encoding="UTF-8"?>',
         '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
@@ -169,6 +176,20 @@ function renderPlist(options) {
         "",
     ].join("\n");
 }
+function normalizeWorkDirs(repoRoots) {
+    if (!repoRoots)
+        return [];
+    const seen = new Set();
+    const normalized = [];
+    for (const root of repoRoots) {
+        const resolved = path.resolve(root);
+        if (seen.has(resolved))
+            continue;
+        seen.add(resolved);
+        normalized.push(resolved);
+    }
+    return normalized;
+}
 /**
  * Renders the `<key>WatchPaths</key><array>…</array>` lines, or nothing when no
  * transcript dir exists yet (an empty array would tell launchd to watch

package/dist/commands/local-args.js

@@ -74,6 +74,7 @@ function parseOnboardArgs(args) {
         kind: "onboard",
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         repoRoot: optionalNonEmpty(workRootFlagValue(values)),
+        collectionRoots: optionalNonEmptyList(workRootFlagValues(values)),
         dashboardUrl: normalizeUrl(values.flags.get("--dashboard-url") ?? DEFAULT_DASHBOARD_URL),
         claimedOwnerEmail: optionalEmail(values.flags.get("--email")),
         deviceName: optionalNonEmpty(values.flags.get("--device-name")),
@@ -403,6 +404,7 @@ function parseNamedArgs(args, options) {
     const allowed = new Set(options.allowedFlags);
     const valueFlags = new Set(options.valueFlags);
     const flags = new Map();
+    const flagValues = new Map();
     const booleans = new Set();
     const positionals = [];
     for (let index = 0; index < args.length; index += 1) {
@@ -422,6 +424,9 @@ function parseNamedArgs(args, options) {
             }
             rejectServiceRoleLikeArgument(value);
             flags.set(flag, value);
+            const existing = flagValues.get(flag) ?? [];
+            existing.push(value);
+            flagValues.set(flag, existing);
             if (inlineValue === undefined)
                 index += 1;
         }
@@ -431,7 +436,7 @@ function parseNamedArgs(args, options) {
             booleans.add(flag);
         }
     }
-    return { flags, booleans, positionals };
+    return { flags, flagValues, booleans, positionals };
 }
 function workRootFlagValue(values) {
     const provided = WORK_ROOT_FLAGS.filter((flag) => values.flags.has(flag));
@@ -443,6 +448,19 @@ function workRootFlagValue(values) {
     }
     return values.flags.get("--workspace") ?? values.flags.get("--repo");
 }
+function workRootFlagValues(values) {
+    const roots = [];
+    for (const flag of WORK_ROOT_FLAGS) {
+        roots.push(...(values.flagValues.get(flag) ?? []));
+    }
+    return roots;
+}
+function optionalNonEmptyList(values) {
+    const filtered = values
+        .map((value) => optionalNonEmpty(value))
+        .filter((value) => Boolean(value));
+    return filtered.length > 0 ? filtered : undefined;
+}
 function assertNoPositionals(positionals, command) {
     if (positionals.length > 0) {
         throw new Error(`${command} does not accept positional arguments.`);

package/dist/commands/local.js

@@ -4,13 +4,14 @@ import path from "node:path";
 import { createCollectorServer } from "../server.js";
 import { inspectAgentRules, installAgentRules, uninstallAgentRules, } from "../agent-rules.js";
 import { parseLocalArgs, normalizeUrl } from "./local-args.js";
-import { autostartStatus, installAutostartAgent, uninstallAutostartAgent } from "../autostart.js";
-import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext } from "../local-state.js";
+import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from "../autostart.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext, } from "../local-state.js";
 import { scanAndAttributeCodexSessions } from "../adapters/codex-attribution.js";
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
 import { acquireSyncLock } from "../sync-lock.js";
 import { discoverGitWorktrees } from "../repo-identity.js";
-import { runAttributedWorktreeSync } from "./session-sync.js";
+import { runAttributedWorktreeSync, } from "./session-sync.js";
+import { COLLECTION_ROOT_REQUIRED, resolveOnboardingRoots, } from "../onboarding-roots.js";
 export const rootCommandNames = new Set([
     "onboard",
     "install",
@@ -281,68 +282,112 @@ async function promptOnboardEmail(io) {
     }
     return answer;
 }
+function onboardingRootPrompt(io) {
+    return {
+        confirm: async (message) => yesByDefault(await readLine(io, message)),
+        input: (message) => readLine(io, message),
+    };
+}
+function yesByDefault(raw) {
+    const answer = raw.trim().split(/\s+/u)[0]?.toLowerCase() ?? "";
+    return answer !== "n" && answer !== "no";
+}
+async function resolveOnboardEmail(command, roots, config, io) {
+    if (command.claimedOwnerEmail)
+        return command.claimedOwnerEmail;
+    const inferred = await inferOnboardEmail(command.homeDir, roots, config);
+    const interactive = !command.json && isInteractiveStdin(io);
+    if (!inferred) {
+        return interactive ? promptOnboardEmail(io) : undefined;
+    }
+    if (inferred.source === "session") {
+        if (!command.json)
+            writeLine(io.stdout, `Dashboard email: ${inferred.email}`);
+        return inferred.email;
+    }
+    if (!interactive)
+        return inferred.email;
+    const answer = (await readLine(io, `Use ${inferred.email} for Cockpit pairing? [Y/n] `)).trim().toLowerCase();
+    const typedEmail = answer.split(/\s+/u).find((part) => part.includes("@"));
+    if (typedEmail)
+        return typedEmail;
+    if (yesByDefault(answer)) {
+        return inferred.email;
+    }
+    return promptOnboardEmail(io);
+}
+async function inferOnboardEmail(homeDir, roots, config) {
+    const session = await readOnboardSessionReuseCandidate(homeDir).catch(() => null);
+    const sessionEmail = normalizeEmailForComparison(session?.email);
+    if (session?.session_state === "valid" && sessionEmail) {
+        return { email: sessionEmail, source: "session" };
+    }
+    const configEmail = normalizeEmailForComparison(config?.claimed_owner_email);
+    if (configEmail)
+        return { email: configEmail, source: "config" };
+    const gitEmail = await inferUniqueGitEmail(roots);
+    return gitEmail ? { email: gitEmail, source: "git" } : null;
+}
+async function inferUniqueGitEmail(roots) {
+    const emails = new Set();
+    for (const root of roots) {
+        const email = await readGitConfigEmail(root);
+        if (email)
+            emails.add(email);
+    }
+    return emails.size === 1 ? [...emails][0] ?? null : null;
+}
+async function readGitConfigEmail(root) {
+    return new Promise((resolve) => {
+        execFile("git", ["config", "user.email"], { cwd: root, encoding: "utf8" }, (error, stdout) => {
+            if (error) {
+                resolve(null);
+                return;
+            }
+            const email = normalizeEmailForComparison(stdout);
+            resolve(email?.includes("@") ? email : null);
+        });
+    });
+}
 /**
- * After a successful onboard, offers to install the launchd autostart agent so a
- * Mac mini keeps syncing without anyone re-running cockpit — this is the fix for
- * interns drifting to Stale. Only in an interactive, non-JSON run with a real
- * exec runner (`io.exec`): headless / piped / spawned onboards and tests that
- * pass no exec skip it entirely. Declining leaves onboarding's success untouched.
+ * After a successful onboard, refreshes the launchd autostart agent so intern
+ * machines keep syncing without anyone re-running Cockpit. Runtimes without an
+ * exec runner skip this because launchd installation cannot be attempted there.
  */
-async function maybeOfferAutostart(command, io) {
-    if (command.json || !isInteractiveStdin(io) || !io.exec)
-        return;
-    const answer = (await readLine(io, "Keep Cockpit syncing in the background, even after restart? [Y/n] "))
-        .trim()
-        .toLowerCase();
-    if (answer === "n" || answer === "no") {
-        writeLine(io.stdout, "Skipped background autostart. Run `cockpit autostart install` anytime.");
-        return;
-    }
+async function refreshOnboardAutostart(command, roots, io) {
+    if (!io.exec)
+        return null;
     const result = await installAutostartAgent({
         homeDir: command.homeDir,
-        repoRoot: command.repoRoot,
+        repoRoot: roots[0],
+        repoRoots: roots,
         dashboardUrl: command.dashboardUrl,
         exec: io.exec,
     });
+    if (command.json)
+        return result;
     if (result.status === "unsupported") {
         writeLine(io.stdout, `Background autostart unsupported: ${result.message}`);
-        return;
+        return result;
     }
     writeLine(io.stdout, result.loaded
-        ? "Background autostart installed; Cockpit syncs at login and every 15 min."
-        : "Background autostart installed, but launchctl load reported a problem; check `cockpit autostart status`.");
+        ? "Background autostart refreshed; Cockpit syncs at login and every 15 min."
+        : "Background autostart refreshed, but launchctl load reported a problem; check `cockpit autostart status`.");
     writeLine(io.stdout, `Plist: ${result.plist_path}`);
+    return result;
 }
-async function maybeOfferAgentRules(command, io) {
-    if (command.json || !isInteractiveStdin(io))
-        return;
-    const scopePath = path.resolve(command.repoRoot ?? process.cwd());
-    const current = await inspectAgentRules({
+async function refreshOnboardAgentRules(command, roots, io) {
+    const result = await installAgentRules({
         homeDir: command.homeDir,
-        scopePath,
+        scopePaths: roots,
     });
-    if (current.installed) {
-        writeLine(io.stdout, onboardAgentRulesAlreadyInstalledLine(current));
-        return;
-    }
-    const answer = (await readLine(io, `Add Cockpit ticket-binding rules scoped to ${scopePath} to AGENTS.md and CLAUDE.md? [Y/n] `))
-        .trim()
-        .toLowerCase();
-    if (answer === "n" || answer === "no") {
-        writeLine(io.stdout, "Skipped agent rules. Run `cockpit agent-rules install --workspace \"$PWD\"` anytime.");
-        return;
-    }
-    const result = await installAgentRules({ homeDir: command.homeDir, scopePath });
+    if (command.json)
+        return result;
     writeLine(io.stdout, `Agent rules: ${onboardAgentRulesInstallLine(result)}`);
     for (const target of result.targets) {
         writeLine(io.stdout, `${agentRuleHostLabel(target.host)}: ${target.rules_file}`);
     }
-}
-function onboardAgentRulesAlreadyInstalledLine(result) {
-    const hasEquivalent = result.targets.some((target) => target.state === "equivalent");
-    return hasEquivalent
-        ? "Agent rules: matching Cockpit ticket-binding guidance already exists."
-        : "Agent rules: already current in AGENTS.md and CLAUDE.md.";
+    return result;
 }
 function onboardAgentRulesInstallLine(result) {
     if (result.targets.some((target) => target.stale_block_replaced)) {
@@ -359,24 +404,78 @@ function onboardAgentRulesInstallLine(result) {
             return "not installed.";
     }
 }
+function writeOnboardLiveStatus(io, command, roots, options) {
+    writeLine(io.stdout, "You're live.");
+    writeLine(io.stdout, "Collecting from:");
+    for (const root of roots)
+        writeLine(io.stdout, `- ${root}`);
+    writeLine(io.stdout, `Paired user: ${options.pair?.session.email ??
+        options.pair?.session.auth_subject_id ??
+        (options.status?.session_state === "valid" ? "existing valid session" : "pending")}`);
+    writeLine(io.stdout, `Background sync: ${backgroundSyncLine(options.autostart)}`);
+    writeLine(io.stdout, `Initial sync: ${options.initialSyncOk ? options.sync?.status ?? "uploaded" : "blocked"}`);
+    writeLine(io.stdout, `Agent rules: ${options.agentRules ? onboardAgentRulesInstallLine(options.agentRules) : "not refreshed"}`);
+    writeLine(io.stdout, `Dashboard: ${command.dashboardUrl}/my-work`);
+    writeLine(io.stdout, "Next: cockpit status");
+}
+function backgroundSyncLine(result) {
+    if (!result)
+        return "not refreshed (launchd runner unavailable)";
+    if (result.status === "unsupported")
+        return `unsupported (${result.message})`;
+    if (result.status === "installed" && result.loaded)
+        return "installed";
+    if (result.status === "installed") {
+        return `installed with warning (${result.message ?? "launchctl load failed"})`;
+    }
+    return result.status;
+}
 async function runOnboard(command, io) {
     let install = null;
     let pair = null;
     let sync = null;
     let status = null;
+    let rootsResult = null;
+    let agentRules = null;
+    let autostart = null;
     try {
         if (!command.json) {
             writeLine(io.stdout, "Cockpit harvest onboarding");
             writeLine(io.stdout, `Dashboard: ${command.dashboardUrl}`);
             writeLine(io.stdout, `Ticket: ${command.activeTicketId ?? "general ambient"}`);
         }
-        let claimedOwnerEmail = command.claimedOwnerEmail;
-        if (!claimedOwnerEmail && !command.json && isInteractiveStdin(io)) {
-            claimedOwnerEmail = await promptOnboardEmail(io);
+        const paths = getCollectorRuntimePaths(command.homeDir);
+        const existingConfig = await readLocalCollectorConfig(paths).catch(() => null);
+        const interactive = !command.json && isInteractiveStdin(io);
+        rootsResult = await resolveOnboardingRoots({
+            homeDir: command.homeDir,
+            explicitRoots: command.collectionRoots ?? (command.repoRoot ? [command.repoRoot] : []),
+            config: existingConfig,
+            interactive,
+            prompt: interactive ? onboardingRootPrompt(io) : undefined,
+        });
+        const collectionRoots = rootsResult.roots;
+        const primaryRoot = collectionRoots[0];
+        if (!primaryRoot) {
+            throw new Error(`${COLLECTION_ROOT_REQUIRED}: no collection root confirmed.`);
+        }
+        const resolvedCommand = {
+            ...command,
+            repoRoot: primaryRoot,
+            collectionRoots,
+        };
+        const replaceRepoRoots = rootsResult.source === "prompt" &&
+            !command.collectionRoots?.length &&
+            (existingConfig?.default_repo_paths.length ?? 0) > 0;
+        if (!command.json) {
+            writeLine(io.stdout, `Collecting from: ${collectionRoots.join(", ")}`);
         }
+        const claimedOwnerEmail = await resolveOnboardEmail(resolvedCommand, collectionRoots, existingConfig, io);
         install = await installLocalCollector({
             homeDir: command.homeDir,
-            repoRoot: command.repoRoot,
+            repoRoot: primaryRoot,
+            repoRoots: collectionRoots,
+            replaceRepoRoots,
             dashboardUrl: command.dashboardUrl,
             deviceName: command.deviceName,
         });
@@ -386,7 +485,7 @@ async function runOnboard(command, io) {
         }
         const installedStatus = await inspectLocalCollectorStatus({
             homeDir: command.homeDir,
-            repoRoot: command.repoRoot,
+            repoRoot: primaryRoot,
             branch: command.branch,
         });
         const installedSession = await readOnboardSessionReuseCandidate(command.homeDir);
@@ -421,26 +520,41 @@ async function runOnboard(command, io) {
                 writeLine(io.stdout, `Device: ${pair.session.device_name ?? pair.session.device_id ?? "unknown"}`);
             }
         }
-        const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
+        const worktrees = await discoverCommandWorktrees(collectionRoots, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
         if (worktrees.length > 1) {
-            const multi = await runMultiRepoOnboard(command, io, worktrees);
+            const multi = await runMultiRepoOnboard(resolvedCommand, io, worktrees);
+            if (multi.ok) {
+                agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
+                autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
+            }
             if (command.json) {
                 writeLine(io.stdout, JSON.stringify({
-                    ...onboardResult(multi.ok ? "pass" : "blocked", command, install, pair, null, null),
+                    ...onboardResult(multi.ok ? "pass" : "blocked", resolvedCommand, install, pair, null, null),
+                    collection_roots: collectionRoots,
+                    root_resolution: rootsResult,
+                    agent_rules: agentRules,
+                    autostart,
                     mode: "multi_repo",
                     repos: multi.results,
                     codex_sessions: multi.codex_sessions,
                 }, null, 2));
             }
-            if (multi.ok) {
-                await maybeOfferAgentRules(command, io);
-                await maybeOfferAutostart(command, io);
+            if (multi.ok && !command.json) {
+                writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
+                    pair,
+                    status,
+                    sync: null,
+                    agentRules,
+                    autostart,
+                    initialSyncOk: true,
+                });
             }
             return multi.ok ? 0 : 1;
         }
+        const worktreeRoot = worktrees[0]?.repo_root ?? primaryRoot;
         const context = await startLocalWorkContext({
             homeDir: command.homeDir,
-            repoRoot: command.repoRoot,
+            repoRoot: worktreeRoot,
             branch: command.branch,
             activeTicketId: command.activeTicketId,
         });
@@ -464,13 +578,15 @@ async function runOnboard(command, io) {
         }
         status = await inspectLocalCollectorStatus({
             homeDir: command.homeDir,
-            repoRoot: command.repoRoot,
+            repoRoot: worktreeRoot,
             branch: command.branch,
         });
         if (sync.status !== "uploaded") {
             if (command.json) {
                 writeLine(io.stdout, JSON.stringify({
-                    ...onboardResult("blocked", command, install, pair, sync, status),
+                    ...onboardResult("blocked", resolvedCommand, install, pair, sync, status),
+                    collection_roots: collectionRoots,
+                    root_resolution: rootsResult,
                     codex_sessions: run.summary,
                 }, null, 2));
             }
@@ -482,8 +598,14 @@ async function runOnboard(command, io) {
             return 1;
         }
         if (command.json) {
+            agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
+            autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
             writeLine(io.stdout, JSON.stringify({
-                ...onboardResult("pass", command, install, pair, sync, status),
+                ...onboardResult("pass", resolvedCommand, install, pair, sync, status),
+                collection_roots: collectionRoots,
+                root_resolution: rootsResult,
+                agent_rules: agentRules,
+                autostart,
                 codex_sessions: run.summary,
             }, null, 2));
             return 0;
@@ -500,22 +622,35 @@ async function runOnboard(command, io) {
         writeLine(io.stdout, `Upload state: ${status.upload_state}`);
         writeLine(io.stdout, "PASS: Cockpit collector is ready for harvest.");
         writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
-        await maybeOfferAgentRules(command, io);
-        await maybeOfferAutostart(command, io);
+        agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
+        autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
+        writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
+            pair,
+            status,
+            sync,
+            agentRules,
+            autostart,
+            initialSyncOk: true,
+        });
         return 0;
     }
     catch (error) {
         const message = errorMessage(error);
-        status = await inspectLocalCollectorStatus({
-            homeDir: command.homeDir,
-            repoRoot: command.repoRoot,
-            branch: command.branch,
-        }).catch(() => null);
+        const statusRoot = rootsResult?.roots[0] ?? command.repoRoot;
+        status = statusRoot
+            ? await inspectLocalCollectorStatus({
+                homeDir: command.homeDir,
+                repoRoot: statusRoot,
+                branch: command.branch,
+            }).catch(() => null)
+            : null;
         const blocker = classifyOnboardBlocker(message);
         const nextStep = nextStepForOnboardBlocker(blocker);
         if (command.json) {
             writeLine(io.stdout, JSON.stringify({
                 ...onboardResult("blocked", command, install, pair, sync, status),
+                collection_roots: rootsResult?.roots ?? [],
+                root_resolution: rootsResult,
                 blocker,
                 message,
                 next_step: nextStep,
@@ -625,6 +760,13 @@ function cursorStatusLine(sync) {
 const DEFAULT_DISCOVERY_MAX_DEPTH = 3;
 const DEFAULT_DISCOVERY_MAX_REPOS = 50;
 async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
+    if (Array.isArray(repoRoot)) {
+        const discovered = [];
+        for (const root of repoRoot) {
+            discovered.push(...(await discoverCommandWorktrees(root, discovery, io)));
+        }
+        return dedupeWorktrees(discovered);
+    }
     const maxWorktrees = discovery.maxRepos ?? DEFAULT_DISCOVERY_MAX_REPOS;
     const worktrees = await discoverGitWorktrees(repoRoot ?? process.cwd(), {
         maxDepth: discovery.maxDepth ?? DEFAULT_DISCOVERY_MAX_DEPTH,
@@ -638,6 +780,18 @@ async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
     }
     return worktrees;
 }
+function dedupeWorktrees(worktrees) {
+    const seen = new Set();
+    const deduped = [];
+    for (const worktree of worktrees) {
+        const key = worktree.worktree_fingerprint || path.resolve(worktree.repo_root);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        deduped.push(worktree);
+    }
+    return deduped;
+}
 async function runMultiRepoOnboard(command, io, worktrees) {
     if (!command.json) {
         writeLine(io.stdout, `3/5 Parent folder mode: discovered ${worktrees.length} git worktree(s).`);
@@ -743,6 +897,7 @@ function onboardResult(resultStatus, command, install, pair, sync, status) {
         work_context_id: sync?.work_context_id ?? status?.work_context_id ?? null,
         config_file: install?.paths.config_file ?? status?.config_file ?? null,
         session_file: install?.paths.session_file ?? status?.session_file ?? null,
+        collection_roots: command.collectionRoots ?? (command.repoRoot ? [command.repoRoot] : []),
         paired_user: pair?.session.email ?? pair?.session.auth_subject_id ?? null,
         paired_device: pair?.session.device_name ?? pair?.session.device_id ?? null,
         upload_status: sync?.status ?? null,
@@ -756,6 +911,8 @@ function onboardResult(resultStatus, command, install, pair, sync, status) {
     };
 }
 function classifyOnboardBlocker(message) {
+    if (message.includes(COLLECTION_ROOT_REQUIRED))
+        return COLLECTION_ROOT_REQUIRED;
     if (/ticket/i.test(message))
         return "ticket";
     if (/pair|paired|approval|expired|revoked/i.test(message))
@@ -772,6 +929,8 @@ function classifyOnboardBlocker(message) {
 }
 function nextStepForOnboardBlocker(blocker) {
     switch (blocker) {
+        case COLLECTION_ROOT_REQUIRED:
+            return "Run `cockpit onboard --workspace <path>` or rerun in a terminal and confirm the collection root.";
         case "ticket":
         case "ticket_binding":
             return "Run `cockpit start --ticket <id>` when actual ticket work begins, then run `cockpit sync`.";

package/dist/commands/public-root.js

@@ -23,9 +23,10 @@ function cockpitHelp() {
     localCommandHelp(),
     "",
     "Install/update: `npm install -g @bli-cockpit/cli@latest`.",
-    "Intern path: run `cockpit onboard` from the repo root; add `--ticket <id>` only when work already has a ticket.",
-    "Already onboarded: run `cockpit sync --workspace \"$PWD\" --json`.",
-    "Agent setup: interactive `cockpit onboard` offers AGENTS.md/CLAUDE.md rules; use `cockpit agent-rules install --workspace \"$PWD\"` for repair/headless setup.",
+    "Intern path: run `cockpit onboard`; it confirms a `/BLI` collection root before syncing.",
+    "Headless/reused laptop path: `cockpit onboard --email <email> --workspace ~/BLI`.",
+    "Already onboarded: rerun `cockpit onboard` from anywhere to refresh pairing, roots, agent rules, autostart, and sync.",
+    "Agent setup: `cockpit onboard` refreshes AGENTS.md/CLAUDE.md rules; use `cockpit agent-rules install --workspace ~/BLI` for repair.",
     "Dashboard URL is optional for normal production use; pass `--dashboard-url` only for staging/custom dashboards or forced re-pairing.",
     "Manual collector path: `install`, `login`, `start [--ticket <id>] [--topic <label>] [--intent <intent>] [--phase <phase>]`, `sync`, `status`, `agent-rules`.",
   ].join("\n");

package/dist/local-state.js

@@ -21,12 +21,15 @@ export function getCollectorRuntimePaths(homeDir = os.homedir()) {
 }
 export async function installLocalCollector(options = {}) {
     const homeDir = options.homeDir ?? os.homedir();
-    const repoRoot = path.resolve(options.repoRoot ?? process.cwd());
+    const repoRoots = normalizeRepoRoots(options.repoRoots);
+    const repoRoot = path.resolve(options.repoRoot ?? repoRoots[0] ?? process.cwd());
     const paths = getCollectorRuntimePaths(homeDir);
     await ensureRuntimeDirectories(paths);
     const existingConfig = await readLocalCollectorConfig(paths).catch(() => null);
-    const defaultRepoPaths = new Set(existingConfig?.default_repo_paths ?? []);
-    defaultRepoPaths.add(repoRoot);
+    const defaultRepoPaths = new Set(options.replaceRepoRoots ? [] : (existingConfig?.default_repo_paths ?? []));
+    for (const root of repoRoots.length > 0 ? repoRoots : [repoRoot]) {
+        defaultRepoPaths.add(root);
+    }
     const rawEvidenceUpload = existingConfig?.raw_evidence_upload === "disabled" ||
         existingConfig?.raw_evidence_upload === "remote_short_retention_opt_in"
         ? "remote_durable_opt_in"
@@ -55,6 +58,20 @@ export async function installLocalCollector(options = {}) {
         message: "Local collector installed. Pair/login is still required before remote upload.",
     };
 }
+function normalizeRepoRoots(repoRoots) {
+    if (!repoRoots)
+        return [];
+    const seen = new Set();
+    const normalized = [];
+    for (const root of repoRoots) {
+        const resolved = path.resolve(root);
+        if (seen.has(resolved))
+            continue;
+        seen.add(resolved);
+        normalized.push(resolved);
+    }
+    return normalized;
+}
 export async function pairLocalCollector(options = {}) {
     const homeDir = options.homeDir ?? os.homedir();
     const paths = getCollectorRuntimePaths(homeDir);

package/dist/onboarding-roots.js

@@ -0,0 +1,104 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+export const COLLECTION_ROOT_REQUIRED = "collection_root_required";
+export async function resolveOnboardingRoots(options) {
+    const explicitRoots = normalizeRoots(options.explicitRoots ?? []);
+    if (explicitRoots.length > 0) {
+        return { roots: explicitRoots, source: "explicit", confirmed: true };
+    }
+    const savedRoots = normalizeRoots([
+        ...(options.savedRoots ?? []),
+        ...(options.config?.default_repo_paths ?? []),
+    ]);
+    if (savedRoots.length > 0) {
+        if (!options.interactive) {
+            return { roots: savedRoots, source: "saved", confirmed: false };
+        }
+        const confirmed = await requirePrompt(options).confirm(savedRootsPrompt(savedRoots));
+        if (confirmed) {
+            return { roots: savedRoots, source: "saved", confirmed: true };
+        }
+        return promptForRoots(options, "Collection root(s), comma-separated: ");
+    }
+    if (!options.interactive) {
+        throw new Error(`${COLLECTION_ROOT_REQUIRED}: pass --workspace <path> or run cockpit onboard in a terminal to confirm a collection root.`);
+    }
+    const cwd = path.resolve(options.cwd ?? process.cwd());
+    const cwdRoot = likelyBliRootFromCwd(cwd);
+    if (cwdRoot) {
+        const confirmed = await requirePrompt(options).confirm(`Collect from ${cwdRoot}? [Y/n] `);
+        if (confirmed) {
+            return { roots: [cwdRoot], source: "cwd_likely_root", confirmed: true };
+        }
+    }
+    const homeRoot = path.join(options.homeDir ?? os.homedir(), "BLI");
+    if (await directoryExists(homeRoot)) {
+        const confirmed = await requirePrompt(options).confirm(`I found ${homeRoot}. Collect from there? [Y/n] `);
+        if (confirmed) {
+            return { roots: [path.resolve(homeRoot)], source: "home_likely_root", confirmed: true };
+        }
+    }
+    return promptForRoots(options, "Collection root(s), comma-separated: ");
+}
+export function normalizeRoots(roots) {
+    const seen = new Set();
+    const normalized = [];
+    for (const root of roots) {
+        const trimmed = root.trim();
+        if (!trimmed)
+            continue;
+        for (const candidate of splitRootInput(trimmed)) {
+            const resolved = path.resolve(candidate);
+            if (resolved === path.parse(resolved).root)
+                continue;
+            if (resolved === os.homedir())
+                continue;
+            if (seen.has(resolved))
+                continue;
+            seen.add(resolved);
+            normalized.push(resolved);
+        }
+    }
+    return normalized;
+}
+function splitRootInput(value) {
+    return value
+        .split(/[,\n]/u)
+        .map((part) => part.trim())
+        .filter(Boolean);
+}
+async function promptForRoots(options, message) {
+    const prompt = requirePrompt(options);
+    const roots = normalizeRoots([await prompt.input(message)]);
+    if (roots.length === 0) {
+        throw new Error(`${COLLECTION_ROOT_REQUIRED}: no collection root confirmed; pass --workspace <path>.`);
+    }
+    return { roots, source: "prompt", confirmed: true };
+}
+function savedRootsPrompt(roots) {
+    if (roots.length === 1) {
+        return `I'm collecting from ${roots[0]}. Still true? [Y/n] `;
+    }
+    return [
+        "I'm collecting from:",
+        ...roots.map((root) => `- ${root}`),
+        "Still true? [Y/n] ",
+    ].join("\n");
+}
+function requirePrompt(options) {
+    if (!options.prompt) {
+        throw new Error(`${COLLECTION_ROOT_REQUIRED}: interactive prompt unavailable.`);
+    }
+    return options.prompt;
+}
+function likelyBliRootFromCwd(cwd) {
+    const parts = cwd.split(path.sep).filter(Boolean);
+    const index = parts.lastIndexOf("BLI");
+    if (index < 0)
+        return null;
+    return `${path.sep}${parts.slice(0, index + 1).join(path.sep)}`;
+}
+async function directoryExists(dir) {
+    return fs.stat(dir).then((stats) => stats.isDirectory(), () => false);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "private": false,
   "type": "module",
   "bin": {