@bli-cockpit/cli 0.1.26 → 0.1.28

package/README.md

@@ -45,11 +45,11 @@ cockpit onboard --email <APPROVED_EMAIL> --workspace ~/BLI --workspace ~/side-pr
 The CLI defaults to the production dashboard. Normal intern/operator setup,
 updates, and syncs omit `--dashboard-url`. Pass `--dashboard-url` only for
 staging, a custom dashboard, or deliberately forcing a different dashboard
-pairing. Already-onboarded users update with
-`npm install -g @bli-cockpit/cli@latest`, then run
-`cockpit onboard` from anywhere to refresh pairing, agent rules, autostart, and
-an initial sync against saved roots. `--repo <path>` remains supported for older
-prompts and the agent ticket-binding guardrail.
+pairing. Already-onboarded users update with `cockpit update` from anywhere. It
+installs the latest public CLI from npm, then reruns onboarding checks to
+refresh pairing, agent rules, autostart, and an initial sync against saved
+roots. `cockpit upgrade` is a compatibility alias. `--repo <path>` remains
+supported for older prompts and the agent ticket-binding guardrail.
 
 On machines where Codex or Claude agents will do ticketed work, `cockpit
 onboard` refreshes `~/.codex/AGENTS.md` and `~/.claude/CLAUDE.md` after harvest
@@ -191,6 +191,10 @@ Remote dashboard:
   for screenshots/images explicitly attached into Codex or Claude sessions;
 - Codex session attribution records (session id, file hash, attribution state
   and reason labels, scores) accepted by `/api/ambient/codex-sessions`.
+  The local collector scans both active `~/.codex/sessions` files and archived
+  `~/.codex/archived_sessions` files, using only `session_meta` and
+  `turn_context` metadata for attribution. Transcript bytes are sanitized or
+  blocked later by raw evidence collection before upload.
 
 New raw evidence object keys are readable from the Storage browser:
 
@@ -212,6 +216,9 @@ Local attribution preview:
 cockpit sessions --workspace "$PWD" --json
 ```
 
+This preview includes both active and archived Codex sessions in the bounded
+backfill window, plus Claude Code sessions when Claude collection is enabled.
+
 Remote metadata path:
 
 1. Query `ambient_evidence_refs` by `operator_user_id`, `received_at`, and

package/dist/adapters/codex-attribution.js

@@ -1,8 +1,11 @@
-import { SECRET_FILE_SEGMENT_PATTERN, containsSecretLikeContent, } from "@bli-cockpit/telemetry-core";
+import { SECRET_FILE_SEGMENT_PATTERN, } from "@bli-cockpit/telemetry-core";
+import { createReadStream } from "node:fs";
+import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { normalizeGitOrigin } from "../repo-identity.js";
-import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, sha256, shortHash, } from "./attribution-core.js";
+import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
 /**
  * Deterministic Codex session JSONL -> repo/worktree attribution.
  *
@@ -18,12 +21,24 @@ import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName,
 export { sanitizeSessionId, sessionIdFromFileName };
 export const CODEX_ATTRIBUTION_DEFAULT_SINCE_MINUTES = 24 * 60;
 export const CODEX_ATTRIBUTION_DEFAULT_SESSION_LIMIT = 50;
+export const CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES = 14 * 24 * 60;
+export const CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT = 500;
+// Compatibility export only. Codex attribution streams full files for metadata
+// and no longer rejects sessions by file size; raw evidence collection enforces
+// upload budgets and content guards later.
 export const CODEX_SESSION_MAX_FILE_BYTES = 10 * 1024 * 1024;
+const CODEX_ATTRIBUTION_MAX_LINE_BYTES = 2 * 1024 * 1024;
+export function defaultCodexSessionDirs(homeDir) {
+    return [
+        path.join(homeDir, ".codex", "sessions"),
+        path.join(homeDir, ".codex", "archived_sessions"),
+    ];
+}
 export async function scanAndAttributeCodexSessions(options) {
     const sinceMinutes = options.sinceMinutes ?? CODEX_ATTRIBUTION_DEFAULT_SINCE_MINUTES;
     const limit = options.limit ?? CODEX_ATTRIBUTION_DEFAULT_SESSION_LIMIT;
     const cutoffMs = options.now.getTime() - sinceMinutes * 60 * 1000;
-    const discovery = await discoverCodexJsonlFiles(options.sessionsDir, cutoffMs);
+    const discovery = await discoverCodexJsonlFiles(codexSessionDirsFromOptions(options), cutoffMs);
     const files = discovery.files.slice(0, limit);
     const results = [];
     for (const file of files) {
@@ -36,7 +51,7 @@ export async function scanAndAttributeCodexSessions(options) {
         since_minutes: sinceMinutes,
         session_limit: limit,
         session_limit_applied: discovery.files.length > limit,
-        max_file_bytes: CODEX_SESSION_MAX_FILE_BYTES,
+        max_file_bytes: 0,
         directory_read_failed_count: discovery.directoryReadFailedCount,
         stat_failed_count: discovery.statFailedCount,
         secret_path_skipped_count: discovery.secretPathSkippedCount,
@@ -57,7 +72,8 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
     let directoryReadFailedCount = 0;
     let statFailedCount = 0;
     let secretPathSkippedCount = 0;
-    const stack = [dir];
+    const stack = Array.isArray(dir) ? [...dir] : [dir];
+    const seenFiles = new Set();
     while (stack.length > 0) {
         const current = stack.pop();
         if (!current)
@@ -100,7 +116,11 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
                 continue;
             }
             if (stat.mtimeMs >= cutoffMs) {
-                out.push({ file: full, mtimeMs: stat.mtimeMs, byteSize: stat.size });
+                const dedupeKey = await fs.realpath(full).catch(() => path.resolve(full));
+                if (!seenFiles.has(dedupeKey)) {
+                    seenFiles.add(dedupeKey);
+                    out.push({ file: full, mtimeMs: stat.mtimeMs, byteSize: stat.size });
+                }
             }
         }
     }
@@ -112,6 +132,22 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
         secretPathSkippedCount,
     };
 }
+function codexSessionDirsFromOptions(options) {
+    const dirs = options.sessionsDirs ?? (options.sessionsDir ? [options.sessionsDir] : []);
+    return dedupePaths(dirs);
+}
+function dedupePaths(values) {
+    const seen = new Set();
+    const out = [];
+    for (const value of values) {
+        const resolved = path.resolve(value);
+        if (seen.has(resolved))
+            continue;
+        seen.add(resolved);
+        out.push(resolved);
+    }
+    return out;
+}
 async function attributeOneSession(file, worktrees) {
     const fileName = path.basename(file.file);
     const base = {
@@ -128,23 +164,16 @@ async function attributeOneSession(file, worktrees) {
     if (isSecretLikePath(fileName)) {
         return skippedResult(base, "secret_like_file_name");
     }
-    if (file.byteSize > CODEX_SESSION_MAX_FILE_BYTES) {
-        return skippedResult(base, "file_too_large");
-    }
-    let raw;
+    let read;
     try {
-        raw = await fs.readFile(file.file);
+        read = await readCodexMetadataSignals(file.file);
     }
     catch {
         return skippedResult(base, "file_read_failed");
     }
-    const content = raw.toString("utf8");
-    base.content_hash_sha256 = sha256(raw);
-    base.byte_size = raw.byteLength;
-    if (containsSecretLikeContent(content)) {
-        return skippedResult(base, "secret_like_content_guard");
-    }
-    const signals = extractCodexSessionSignals(content);
+    base.content_hash_sha256 = read.contentHashSha256;
+    base.byte_size = read.byteSize;
+    const signals = read.signals;
     const metaSessionId = sanitizeSessionId(signals.session_ids[0]);
     if (metaSessionId) {
         base.codex_session_id = metaSessionId;
@@ -174,72 +203,132 @@ async function attributeOneSession(file, worktrees) {
     }, worktrees);
     return { ...base, ...outcome };
 }
+async function readCodexMetadataSignals(filePath) {
+    const hash = crypto.createHash("sha256");
+    const decoder = new StringDecoder("utf8");
+    const state = makeSignalExtractionState();
+    const stream = createReadStream(filePath);
+    let byteSize = 0;
+    let lineBuffer = "";
+    let discardingOversizedLine = false;
+    for await (const chunk of stream) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        byteSize += buffer.byteLength;
+        hash.update(buffer);
+        const text = decoder.write(buffer);
+        const segments = text.split("\n");
+        for (let index = 0; index < segments.length; index += 1) {
+            const segment = segments[index] ?? "";
+            const lineEnded = index < segments.length - 1;
+            if (discardingOversizedLine) {
+                if (lineEnded)
+                    discardingOversizedLine = false;
+                continue;
+            }
+            lineBuffer += segment;
+            if (Buffer.byteLength(lineBuffer, "utf8") > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
+                state.lineCount += 1;
+                state.parseErrorCount += 1;
+                lineBuffer = "";
+                discardingOversizedLine = !lineEnded;
+                continue;
+            }
+            if (lineEnded) {
+                absorbCodexSessionLine(state, lineBuffer);
+                lineBuffer = "";
+            }
+        }
+    }
+    const rest = decoder.end();
+    if (rest)
+        lineBuffer += rest;
+    if (lineBuffer.trim())
+        absorbCodexSessionLine(state, lineBuffer);
+    return {
+        signals: codexSignalsFromState(state),
+        contentHashSha256: hash.digest("hex"),
+        byteSize,
+    };
+}
 export function extractCodexSessionSignals(content) {
-    const sessionIds = new Set();
-    const cwds = new Set();
-    const workspaceRoots = new Set();
-    const branches = new Set();
-    const commitHashes = new Set();
-    const repositoryUrls = new Set();
-    let lineCount = 0;
-    let parseErrorCount = 0;
+    const state = makeSignalExtractionState();
     for (const line of content.split("\n")) {
-        if (!line.trim())
-            continue;
-        lineCount += 1;
-        let record;
-        try {
-            record = JSON.parse(line);
-        }
-        catch {
-            parseErrorCount += 1;
-            continue;
-        }
-        if (!record || typeof record !== "object")
-            continue;
-        const type = record.type;
-        const payload = record.payload;
-        if (!payload || typeof payload !== "object")
-            continue;
-        const payloadRecord = payload;
-        if (type === "session_meta") {
-            addString(sessionIds, payloadRecord["id"]);
-            addString(cwds, payloadRecord["cwd"]);
-            const git = payloadRecord["git"];
-            if (git && typeof git === "object") {
-                const gitRecord = git;
-                addString(branches, gitRecord["branch"] ?? gitRecord["current_branch"]);
-                addString(commitHashes, gitRecord["commit_hash"]);
-                const repositoryUrl = gitRecord["repository_url"];
-                if (typeof repositoryUrl === "string" && repositoryUrl.trim()) {
-                    repositoryUrls.add(normalizeGitOrigin(repositoryUrl));
-                }
+        absorbCodexSessionLine(state, line);
+    }
+    return codexSignalsFromState(state);
+}
+function makeSignalExtractionState() {
+    return {
+        sessionIds: new Set(),
+        cwds: new Set(),
+        workspaceRoots: new Set(),
+        branches: new Set(),
+        commitHashes: new Set(),
+        repositoryUrls: new Set(),
+        lineCount: 0,
+        parseErrorCount: 0,
+    };
+}
+function absorbCodexSessionLine(state, line) {
+    if (!line.trim())
+        return;
+    state.lineCount += 1;
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        state.parseErrorCount += 1;
+        return;
+    }
+    if (!record || typeof record !== "object")
+        return;
+    const type = record.type;
+    if (type !== "session_meta" && type !== "turn_context")
+        return;
+    const payload = record.payload;
+    if (!payload || typeof payload !== "object")
+        return;
+    const payloadRecord = payload;
+    if (type === "session_meta") {
+        addString(state.sessionIds, payloadRecord["id"]);
+        addString(state.cwds, payloadRecord["cwd"]);
+        const git = payloadRecord["git"];
+        if (git && typeof git === "object") {
+            const gitRecord = git;
+            addString(state.branches, gitRecord["branch"] ?? gitRecord["current_branch"]);
+            addString(state.commitHashes, gitRecord["commit_hash"]);
+            const repositoryUrl = gitRecord["repository_url"];
+            if (typeof repositoryUrl === "string" && repositoryUrl.trim()) {
+                state.repositoryUrls.add(normalizeGitOrigin(repositoryUrl));
             }
         }
-        else if (type === "turn_context") {
-            addString(cwds, payloadRecord["cwd"]);
-            const roots = payloadRecord["workspace_roots"];
-            if (Array.isArray(roots)) {
-                for (const root of roots) {
-                    if (typeof root === "string") {
-                        addString(workspaceRoots, root);
-                    }
-                    else if (root && typeof root === "object") {
-                        addString(workspaceRoots, root["path"]);
-                    }
+    }
+    else if (type === "turn_context") {
+        addString(state.cwds, payloadRecord["cwd"]);
+        const roots = payloadRecord["workspace_roots"];
+        if (Array.isArray(roots)) {
+            for (const root of roots) {
+                if (typeof root === "string") {
+                    addString(state.workspaceRoots, root);
+                }
+                else if (root && typeof root === "object") {
+                    addString(state.workspaceRoots, root["path"]);
                 }
             }
         }
     }
+}
+function codexSignalsFromState(state) {
     return {
-        session_ids: [...sessionIds],
-        cwds: [...cwds],
-        workspace_roots: [...workspaceRoots],
-        branches: [...branches],
-        commit_hashes: [...commitHashes],
-        repository_urls: [...repositoryUrls],
-        line_count: lineCount,
-        parse_error_count: parseErrorCount,
+        session_ids: [...state.sessionIds],
+        cwds: [...state.cwds],
+        workspace_roots: [...state.workspaceRoots],
+        branches: [...state.branches],
+        commit_hashes: [...state.commitHashes],
+        repository_urls: [...state.repositoryUrls],
+        line_count: state.lineCount,
+        parse_error_count: state.parseErrorCount,
     };
 }
 function skippedResult(base, reason) {

package/dist/adapters/local-sources.js

@@ -25,6 +25,7 @@ export async function runLocalSourceCollectors(options) {
             stateDir: options.rawEvidenceStateDir,
             repoRoot: options.repoRoot,
             sessionsDir: options.rawEvidenceSessionsDir,
+            sessionsDirs: options.rawEvidenceSessionsDirs,
             includeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
             includeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,
             codexSessionFiles: options.rawEvidenceCodexSessionFiles,

package/dist/adapters/raw-evidence.js

@@ -6,6 +6,7 @@ import os from "node:os";
 import path from "node:path";
 import { makeSourceAdapterIdentity, } from "./common.js";
 import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
+import { defaultCodexSessionDirs, } from "./codex-attribution.js";
 const DEFAULT_SINCE_MINUTES = 24 * 60;
 const DEFAULT_SESSION_LIMIT = 50;
 const MAX_GIT_DIFF_BYTES = 2 * 1024 * 1024;
@@ -104,6 +105,7 @@ export async function collectRawEvidencePack(context, options) {
             await collectCodexJsonlFiles(collection, {
                 codexSessionFiles: options.codexSessionFiles,
                 sessionsDir: options.sessionsDir,
+                sessionsDirs: options.sessionsDirs,
                 sinceMinutes,
                 limit: sessionLimit,
             });
@@ -311,11 +313,6 @@ function recordCodexAttributionCompleteness(collection, scan) {
         limit: scan.session_limit,
         observed: scan.discovered_file_count,
         applied: scan.session_limit_applied,
-    }, {
-        source: "codex_attribution",
-        cap_type: "max_file_bytes",
-        limit: scan.max_file_bytes,
-        applied: scan.results.some((result) => result.reason === "file_too_large"),
     });
     recordSkipCount(collection, "codex_attribution", "session_limit_overflow", Math.max(0, scan.discovered_file_count - scan.scanned_file_count));
     recordSkipCount(collection, "codex_attribution", "directory_read_failed", scan.directory_read_failed_count);
@@ -391,7 +388,10 @@ async function collectCodexJsonlFiles(collection, options) {
             filePath: file.local_path,
             codexSessionId: file.codex_session_id,
         }))
-        : (await walkJsonlFiles(options.sessionsDir ?? path.join(os.homedir(), ".codex", "sessions"), collection.context.now.getTime() - options.sinceMinutes * 60 * 1000))
+        : (await walkJsonlFiles(options.sessionsDirs ??
+            (options.sessionsDir
+                ? [options.sessionsDir]
+                : defaultCodexSessionDirs(os.homedir())), collection.context.now.getTime() - options.sinceMinutes * 60 * 1000))
             .map((filePath) => ({ filePath, codexSessionId: null }));
     collection.caps.push({
         source: "codex_jsonl",
@@ -573,10 +573,9 @@ async function collectOneAgentImageFile(collection, options) {
 }
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
- * attributed transcript into the pack. The secret guard runs again here even
- * though attribution already guarded — three reads per file (attribution,
- * collection, server commit) is the accepted defense-in-depth cost; do not
- * "optimize" a layer away.
+ * attributed transcript into the pack. Attribution only reads metadata records;
+ * this collection layer and the server commit layer are the two content guards
+ * that decide whether transcript bytes can become durable evidence.
  */
 async function collectOneEvidenceFile(collection, options) {
     const fileName = path.basename(options.filePath);
@@ -1075,7 +1074,8 @@ function makeEvidenceCompleteness(collection, options) {
 }
 async function walkJsonlFiles(dir, cutoffMs) {
     const out = [];
-    const stack = [dir];
+    const stack = Array.isArray(dir) ? [...dir] : [dir];
+    const seen = new Set();
     while (stack.length > 0) {
         const current = stack.pop();
         if (!current || isSecretLikePath(current))
@@ -1098,8 +1098,13 @@ async function walkJsonlFiles(dir, cutoffMs) {
             if (!entry.isFile() || !entry.name.endsWith(".jsonl"))
                 continue;
             const stat = await fs.stat(full);
-            if (stat.mtimeMs >= cutoffMs)
-                out.push({ file: full, mtimeMs: stat.mtimeMs });
+            if (stat.mtimeMs >= cutoffMs) {
+                const dedupeKey = await fs.realpath(full).catch(() => path.resolve(full));
+                if (!seen.has(dedupeKey)) {
+                    seen.add(dedupeKey);
+                    out.push({ file: full, mtimeMs: stat.mtimeMs });
+                }
+            }
         }
     }
     out.sort((a, b) => b.mtimeMs - a.mtimeMs);

package/dist/commands/local-args.js

@@ -12,6 +12,9 @@ export function parseLocalArgs(argv) {
     switch (command) {
         case "onboard":
             return parseOnboardArgs(argv.slice(1));
+        case "update":
+        case "upgrade":
+            return parseUpdateArgs(command, argv.slice(1));
         case "install":
             return parseInstallArgs(argv.slice(1));
         case "login":
@@ -33,11 +36,13 @@ export function parseLocalArgs(argv) {
             return parseAutostartArgs(argv.slice(1));
         case "agent-rules":
             return parseAgentRulesArgs(argv.slice(1));
+        case "release":
+            return parseReleaseArgs(argv.slice(1));
         default:
             throw new Error(`Unknown local command: ${command ?? ""}`);
     }
 }
-function parseOnboardArgs(args) {
+function parseOnboardLikeArgs(args, command) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
             "--home",
@@ -69,13 +74,13 @@ function parseOnboardArgs(args) {
             "--max-repos",
         ],
     });
-    assertNoPositionals(values.positionals, "onboard");
+    assertNoPositionals(values.positionals, command);
     return {
-        kind: "onboard",
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         repoRoot: optionalNonEmpty(workRootFlagValue(values)),
         collectionRoots: optionalNonEmptyList(workRootFlagValues(values)),
         dashboardUrl: normalizeUrl(values.flags.get("--dashboard-url") ?? DEFAULT_DASHBOARD_URL),
+        dashboardUrlExplicit: values.flags.has("--dashboard-url"),
         claimedOwnerEmail: optionalEmail(values.flags.get("--email")),
         deviceName: optionalNonEmpty(values.flags.get("--device-name")),
         activeTicketId: optionalNonEmpty(values.flags.get("--ticket")),
@@ -87,6 +92,16 @@ function parseOnboardArgs(args) {
         maxRepos: optionalPositiveInteger(values.flags.get("--max-repos"), "--max-repos"),
     };
 }
+function parseOnboardArgs(args) {
+    return { kind: "onboard", ...parseOnboardLikeArgs(args, "onboard") };
+}
+function parseUpdateArgs(alias, args) {
+    return {
+        kind: "update",
+        alias,
+        ...parseOnboardLikeArgs(args, alias),
+    };
+}
 function parseInstallArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -115,6 +130,30 @@ function parseInstallArgs(args) {
         json: values.booleans.has("--json"),
     };
 }
+function parseReleaseArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: [
+            "--dry-run",
+            "--tag",
+            "--access",
+            "--otp",
+            "--skip-checks",
+        ],
+        valueFlags: ["--tag", "--access", "--otp"],
+    });
+    assertNoPositionals(values.positionals, "release");
+    const releaseArgs = [];
+    if (values.booleans.has("--dry-run"))
+        releaseArgs.push("--dry-run");
+    if (values.booleans.has("--skip-checks"))
+        releaseArgs.push("--skip-checks");
+    for (const flag of ["--tag", "--access", "--otp"]) {
+        const value = values.flags.get(flag);
+        if (value !== undefined)
+            releaseArgs.push(flag, value);
+    }
+    return { kind: "release", args: releaseArgs };
+}
 function parseLoginArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [

package/dist/commands/local.js

@@ -1,4 +1,5 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { createCollectorServer } from "../server.js";
@@ -6,7 +7,7 @@ import { inspectAgentRules, installAgentRules, uninstallAgentRules, } from "../a
 import { parseLocalArgs, normalizeUrl } from "./local-args.js";
 import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from "../autostart.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext, } from "../local-state.js";
-import { scanAndAttributeCodexSessions } from "../adapters/codex-attribution.js";
+import { CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT, CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES, defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
 import { acquireSyncLock } from "../sync-lock.js";
 import { discoverGitWorktrees } from "../repo-identity.js";
@@ -14,6 +15,8 @@ import { runAttributedWorktreeSync, } from "./session-sync.js";
 import { COLLECTION_ROOT_REQUIRED, resolveOnboardingRoots, } from "../onboarding-roots.js";
 export const rootCommandNames = new Set([
     "onboard",
+    "update",
+    "upgrade",
     "install",
     "login",
     "pair",
@@ -25,6 +28,7 @@ export const rootCommandNames = new Set([
     "serve",
     "autostart",
     "agent-rules",
+    "release",
 ]);
 export async function runLocalCockpitCli(argv, io = defaultIo()) {
     if (isLocalHelpRequest(argv)) {
@@ -47,6 +51,8 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
                 return await runInstall(command, io);
             case "onboard":
                 return await runOnboard(command, io);
+            case "update":
+                return await runUpdate(command, io);
             case "login":
                 return await runLogin(command, io);
             case "logout":
@@ -65,6 +71,8 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
                 return await runAutostart(command, io);
             case "agent-rules":
                 return await runAgentRules(command, io);
+            case "release":
+                return await runRelease(command, io);
         }
     }
     catch (error) {
@@ -77,6 +85,8 @@ export function localCommandHelp(command) {
         return localSubcommandHelp(command);
     return [
         "  cockpit onboard [--ticket <id>] [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--branch <name>] [--max-depth <n>] [--max-repos <n>] [--json]",
+        "  cockpit update [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--json]",
+        "  cockpit upgrade [same flags as update]",
         "  cockpit install [--dashboard-url <url>] [--workspace <path>] [--json]",
         "  cockpit login [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--json]",
         "  cockpit pair [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--json]",
@@ -88,6 +98,7 @@ export function localCommandHelp(command) {
         "  cockpit serve [--port <port>] [--workspace <path>]",
         "  cockpit autostart [install|uninstall|status] [--workspace <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
         "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",
+        "  cockpit release [--dry-run] [--skip-checks] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
         "",
         `Default dashboard: ${DEFAULT_DASHBOARD_URL}. Omit --dashboard-url for normal production use; pass it only for staging/custom dashboards or to force a different pairing.`,
     ].join("\n");
@@ -118,6 +129,25 @@ function localSubcommandHelp(command) {
                 "Omit --dashboard-url for the production dashboard; pass it only for staging/custom dashboards.",
             ],
         ],
+        [
+            "update",
+            [
+                "Usage: cockpit update [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--json]",
+                "",
+                "Updates the global public CLI from npm, then reruns `cockpit onboard`",
+                "with the same setup flags so pairing, saved roots, agent rules,",
+                "autostart, and the initial sync are refreshed in one command.",
+                "`cockpit upgrade` is an alias.",
+            ],
+        ],
+        [
+            "upgrade",
+            [
+                "Usage: cockpit upgrade [same flags as cockpit update]",
+                "",
+                "Alias for `cockpit update`.",
+            ],
+        ],
         [
             "login",
             [
@@ -222,6 +252,17 @@ function localSubcommandHelp(command) {
                 "Action defaults to `install`.",
             ],
         ],
+        [
+            "release",
+            [
+                "Usage: cockpit release [--dry-run] [--skip-checks] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
+                "",
+                "Maintainer-only helper. Run from inside the bli-cockpit repo checkout.",
+                "Requires a clean `main` branch and runs `git pull --ff-only` before publishing.",
+                "Delegates to `npm run publish:public -- ...` so public packages are",
+                "built, checked, and published in the safe telemetry-core then CLI order.",
+            ],
+        ],
     ]);
     return (helpByCommand.get(command) ?? [localCommandHelp()]).join("\n");
 }
@@ -244,6 +285,186 @@ async function runInstall(command, io) {
     writeLine(io.stdout, "Next: run `cockpit login`, then `cockpit start` inside the repo; add `--ticket <id>` only when ticket work begins.");
     return 0;
 }
+async function runUpdate(command, io) {
+    const exec = io.exec ?? defaultExec();
+    const installArgs = [
+        "install",
+        "-g",
+        "@bli-cockpit/cli@latest",
+        "--prefer-online",
+    ];
+    if (!command.json) {
+        writeLine(io.stdout, "Updating Cockpit CLI from npm...");
+    }
+    const install = await exec("npm", installArgs);
+    writeExecOutput(io, install, { stdout: !command.json, stderr: true });
+    if (install.code !== 0) {
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({
+                status: "blocked",
+                step: "npm_install",
+                command: `npm ${installArgs.join(" ")}`,
+                exit_code: install.code,
+            }, null, 2));
+        }
+        else {
+            writeLine(io.stderr, "BLOCKED: npm install failed; Cockpit CLI was not refreshed.");
+        }
+        return install.code || 1;
+    }
+    if (!command.json) {
+        writeLine(io.stdout, "Cockpit CLI updated. Rechecking onboarding...");
+    }
+    const onboard = await exec("cockpit", [
+        "onboard",
+        ...updateOnboardArgs(command),
+    ]);
+    writeExecOutput(io, onboard, { stdout: true, stderr: true });
+    return onboard.code;
+}
+async function runRelease(command, io) {
+    const releaseRoot = await findPublicReleaseRoot(process.cwd());
+    if (!releaseRoot) {
+        writeLine(io.stderr, "cockpit release must be run inside the bli-cockpit repo checkout (missing publish:public script).");
+        return 1;
+    }
+    const exec = io.exec ?? defaultExec();
+    const gitReady = await prepareReleaseMainBranch(releaseRoot, exec, io);
+    if (!gitReady)
+        return 1;
+    writeLine(io.stdout, "Running Cockpit public package release...");
+    const npmArgs = ["--prefix", releaseRoot, "run", "publish:public"];
+    if (command.args.length > 0)
+        npmArgs.push("--", ...command.args);
+    const releaseExec = io.interactiveExec ?? defaultInteractiveExec();
+    const result = await releaseExec("npm", npmArgs);
+    writeExecOutput(io, result, { stdout: true, stderr: true });
+    return result.code;
+}
+async function prepareReleaseMainBranch(releaseRoot, exec, io) {
+    const branch = await exec("git", [
+        "-C",
+        releaseRoot,
+        "rev-parse",
+        "--abbrev-ref",
+        "HEAD",
+    ]);
+    writeExecOutput(io, branch, { stdout: false, stderr: true });
+    if (branch.code !== 0) {
+        writeLine(io.stderr, "BLOCKED: cockpit release could not read the current git branch.");
+        return false;
+    }
+    const currentBranch = branch.stdout.trim();
+    if (currentBranch !== "main") {
+        writeLine(io.stderr, `BLOCKED: cockpit release only publishes from main. Current branch is ${currentBranch || "unknown"}.`);
+        writeLine(io.stderr, "Merge the release changes, switch to main, then rerun `cockpit release`.");
+        return false;
+    }
+    const status = await exec("git", [
+        "-C",
+        releaseRoot,
+        "status",
+        "--porcelain",
+    ]);
+    writeExecOutput(io, status, { stdout: false, stderr: true });
+    if (status.code !== 0) {
+        writeLine(io.stderr, "BLOCKED: cockpit release could not inspect git status.");
+        return false;
+    }
+    if (status.stdout.trim()) {
+        writeLine(io.stderr, "BLOCKED: cockpit release requires a clean main checkout.");
+        writeLine(io.stderr, "Commit or discard local changes, then rerun `cockpit release`.");
+        return false;
+    }
+    writeLine(io.stdout, "Syncing main with git pull --ff-only...");
+    const pull = await exec("git", ["-C", releaseRoot, "pull", "--ff-only"]);
+    writeExecOutput(io, pull, { stdout: true, stderr: true });
+    if (pull.code !== 0) {
+        writeLine(io.stderr, "BLOCKED: git pull --ff-only failed; main is not safely current.");
+        return false;
+    }
+    return true;
+}
+async function findPublicReleaseRoot(startDir) {
+    let current = path.resolve(startDir);
+    while (true) {
+        const packageJsonPath = path.join(current, "package.json");
+        try {
+            const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
+            if (packageJson.scripts?.["publish:public"] !== undefined)
+                return current;
+        }
+        catch {
+            // Keep walking: nested packages may be missing package.json or have one
+            // without the release script.
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+function updateOnboardArgs(command) {
+    const args = [];
+    if (command.homeDir)
+        args.push("--home", command.homeDir);
+    for (const root of updateCollectionRoots(command)) {
+        args.push("--workspace", root);
+    }
+    if (command.dashboardUrlExplicit) {
+        args.push("--dashboard-url", command.dashboardUrl);
+    }
+    if (command.claimedOwnerEmail)
+        args.push("--email", command.claimedOwnerEmail);
+    if (command.deviceName)
+        args.push("--device-name", command.deviceName);
+    if (command.activeTicketId)
+        args.push("--ticket", command.activeTicketId);
+    if (command.branch)
+        args.push("--branch", command.branch);
+    if (command.pollIntervalMs !== undefined) {
+        args.push("--poll-interval-ms", String(command.pollIntervalMs));
+    }
+    if (command.timeoutMs !== undefined) {
+        args.push("--timeout-ms", String(command.timeoutMs));
+    }
+    if (command.maxDepth !== undefined)
+        args.push("--max-depth", String(command.maxDepth));
+    if (command.maxRepos !== undefined)
+        args.push("--max-repos", String(command.maxRepos));
+    if (command.json)
+        args.push("--json");
+    return args;
+}
+function updateCollectionRoots(command) {
+    const roots = command.collectionRoots?.length
+        ? command.collectionRoots
+        : command.repoRoot
+            ? [command.repoRoot]
+            : [];
+    const seen = new Set();
+    const deduped = [];
+    for (const root of roots) {
+        if (seen.has(root))
+            continue;
+        seen.add(root);
+        deduped.push(root);
+    }
+    return deduped;
+}
+function writeExecOutput(io, result, options) {
+    if (options.stdout)
+        writeRaw(io.stdout, result.stdout);
+    if (options.stderr)
+        writeRaw(io.stderr, result.stderr);
+}
+function writeRaw(stream, text) {
+    if (!text)
+        return;
+    stream.write(text);
+    if (!text.endsWith("\n"))
+        stream.write("\n");
+}
 function isInteractiveStdin(io) {
     return Boolean(io.stdin.isTTY);
 }
@@ -1143,9 +1364,11 @@ async function runSessions(command, io) {
     const wantClaude = command.source !== "codex";
     const codex = wantCodex
         ? await scanAndAttributeCodexSessions({
-            sessionsDir: path.join(homeDir, ".codex", "sessions"),
+            sessionsDirs: defaultCodexSessionDirs(homeDir),
             worktrees,
             now,
+            sinceMinutes: CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES,
+            limit: CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT,
         })
         : null;
     const claude = wantClaude
@@ -1341,6 +1564,17 @@ function defaultExec() {
         });
     });
 }
+function defaultInteractiveExec() {
+    return (cmd, args) => new Promise((resolve) => {
+        const child = spawn(cmd, args, { stdio: "inherit" });
+        child.on("error", (error) => {
+            resolve({ code: 1, stdout: "", stderr: errorMessage(error) });
+        });
+        child.on("close", (code) => {
+            resolve({ code: code ?? 1, stdout: "", stderr: "" });
+        });
+    });
+}
 function defaultIo() {
     if (!globalThis.fetch) {
         throw new Error("global fetch is unavailable; use Node.js 20 or newer.");
@@ -1352,6 +1586,7 @@ function defaultIo() {
         env: process.env,
         fetch: globalThis.fetch.bind(globalThis),
         exec: defaultExec(),
+        interactiveExec: defaultInteractiveExec(),
     };
 }
 function writeLine(stream, text) {

package/dist/commands/public-root.js

@@ -22,13 +22,15 @@ function cockpitHelp() {
     "Usage:",
     localCommandHelp(),
     "",
-    "Install/update: `npm install -g @bli-cockpit/cli@latest`.",
+    "Install: `npm install -g @bli-cockpit/cli@latest`.",
+    "Update: run `cockpit update` to refresh the global CLI and rerun onboarding checks.",
     "Intern path: run `cockpit onboard`; it confirms a `/BLI` collection root before syncing.",
     "Headless/reused laptop path: `cockpit onboard --email <email> --workspace ~/BLI`.",
-    "Already onboarded: rerun `cockpit onboard` from anywhere to refresh pairing, roots, agent rules, autostart, and sync.",
+    "Already onboarded: run `cockpit update` from anywhere to refresh pairing, roots, agent rules, autostart, and sync.",
     "Agent setup: `cockpit onboard` refreshes AGENTS.md/CLAUDE.md rules; use `cockpit agent-rules install --workspace ~/BLI` for repair.",
     "Dashboard URL is optional for normal production use; pass `--dashboard-url` only for staging/custom dashboards or forced re-pairing.",
     "Manual collector path: `install`, `login`, `start [--ticket <id>] [--topic <label>] [--intent <intent>] [--phase <phase>]`, `sync`, `status`, `agent-rules`.",
+    "Maintainer release path: merge to main first, then run `cockpit release --dry-run` and `cockpit release` from a clean main checkout.",
   ].join("\n");
 }
 

package/dist/commands/session-sync.js

@@ -7,7 +7,7 @@ import os from "node:os";
 import path from "node:path";
 import { getCollectorRuntimePaths, startLocalWorkContext, readLocalCollectorConfig } from "../local-state.js";
 import { LocalUploadBlockedError, postCodexSessionReport, syncLocalAmbientEnvelope } from "../upload.js";
-import { scanAndAttributeCodexSessions } from "../adapters/codex-attribution.js";
+import { CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT, CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES, defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
 import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET } from "../adapters/raw-evidence.js";
 import { CLAUDE_CURSOR_FILENAME, countStaleSessions, emptyRawEvidenceCursorState, readRawEvidenceCursor, recordSessionObservation, writeRawEvidenceCursor } from "../cursors/raw-evidence-cursor.js";
@@ -30,9 +30,11 @@ export async function runAttributedWorktreeSync(options) {
     const paths = getCollectorRuntimePaths(options.homeDir);
     const claudeEnabled = await isClaudeCollectionEnabled(paths);
     const codexAttribution = await scanAndAttributeCodexSessions({
-        sessionsDir: path.join(homeDir, ".codex", "sessions"),
+        sessionsDirs: defaultCodexSessionDirs(homeDir),
         worktrees: options.worktrees,
         now,
+        sinceMinutes: CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES,
+        limit: CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT,
     });
     // First run (D B.4 §8): without a Claude cursor yet, widen the window to 14
     // days so the first sync captures retroactive history instead of only 24h.

package/dist/upload.js

@@ -2,6 +2,7 @@ import { AgentImageArtifactReportRequestSchema, EvidenceCompletenessPayloadSchem
 import path from "node:path";
 import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, readLocalWorkContextForRepo, } from "./local-state.js";
 import { runLocalSourceCollectors } from "./adapters/local-sources.js";
+import { defaultCodexSessionDirs, } from "./adapters/codex-attribution.js";
 import { uploadRawEvidenceFilesChunked, } from "./evidence-upload-client.js";
 import { markObjectCommitted, readRawEvidenceCursor, writeRawEvidenceCursor, } from "./cursors/raw-evidence-cursor.js";
 import { recordUploadBlocked, recordUploadFailure, recordUploadSuccess, } from "./spool/local-spool.js";
@@ -57,7 +58,7 @@ export async function buildLocalAmbientEnvelope(options = {}) {
         workContextId: uploadContext.work_context_id,
         activeWorkContext: activeContext,
         rawEvidenceStateDir: paths.state_dir,
-        rawEvidenceSessionsDir: path.join(paths.home_dir, ".codex", "sessions"),
+        rawEvidenceSessionsDirs: defaultCodexSessionDirs(paths.home_dir),
         claudeProjectsDir: path.join(paths.home_dir, ".claude", "projects"),
         rawEvidenceIncludeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
         rawEvidenceIncludeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "private": false,
   "type": "module",
   "bin": {