@bli-cockpit/cli 0.1.8 → 0.1.11

package/dist/commands/local.js

@@ -1,15 +1,15 @@
+import { execFile } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
 import { createCollectorServer } from "../server.js";
-import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext, } from "../local-state.js";
-import { LocalUploadBlockedError, postCodexSessionReport, syncLocalAmbientEnvelope, } from "../upload.js";
-import { scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
-import { scanAndAttributeClaudeSessions, } from "../adapters/claude-attribution.js";
-import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET, } from "../adapters/raw-evidence.js";
-import { CLAUDE_CURSOR_FILENAME, countStaleSessions, emptyRawEvidenceCursorState, readRawEvidenceCursor, recordSessionObservation, writeRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
-import { readLocalCollectorConfig } from "../local-state.js";
+import { parseLocalArgs, normalizeUrl } from "./local-args.js";
+import { autostartStatus, installAutostartAgent, uninstallAutostartAgent } from "../autostart.js";
+import { getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext } from "../local-state.js";
+import { scanAndAttributeCodexSessions } from "../adapters/codex-attribution.js";
+import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
 import { acquireSyncLock } from "../sync-lock.js";
-import { discoverGitWorktrees, } from "../repo-identity.js";
+import { discoverGitWorktrees } from "../repo-identity.js";
+import { runAttributedWorktreeSync } from "./session-sync.js";
 export const rootCommandNames = new Set([
     "onboard",
     "install",
@@ -21,6 +21,7 @@ export const rootCommandNames = new Set([
     "status",
     "sessions",
     "serve",
+    "autostart",
 ]);
 export async function runLocalCockpitCli(argv, io = defaultIo()) {
     if (isLocalHelpRequest(argv)) {
@@ -57,6 +58,8 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
                 return await runSessions(command, io);
             case "serve":
                 return await runServe(command, io);
+            case "autostart":
+                return await runAutostart(command, io);
         }
     }
     catch (error) {
@@ -78,6 +81,7 @@ export function localCommandHelp(command) {
         "  cockpit status [--repo <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--repo <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit serve [--port <port>] [--repo <path>]",
+        "  cockpit autostart [install|uninstall|status] [--repo <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
     ].join("\n");
 }
 function localSubcommandHelp(command) {
@@ -169,6 +173,17 @@ function localSubcommandHelp(command) {
                 "Starts the local collector HTTP status server.",
             ],
         ],
+        [
+            "autostart",
+            [
+                "Usage: cockpit autostart [install|uninstall|status] [--repo <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
+                "",
+                "Installs a macOS launchd LaunchAgent that runs `cockpit sync` at login and",
+                "every 30 min (default), surviving reboots — so machines never drift to Stale.",
+                "Action defaults to `install`. `--repo` is the parent work folder to sync.",
+                "macOS-only for now; see docs/runbooks/cockpit-launchd-sync.md.",
+            ],
+        ],
     ]);
     return (helpByCommand.get(command) ?? [localCommandHelp()]).join("\n");
 }
@@ -178,284 +193,6 @@ function isLocalHelpRequest(argv) {
         return false;
     return argv.length === 2 && (argv[1] === "--help" || argv[1] === "-h");
 }
-function parseLocalArgs(argv) {
-    const command = argv[0];
-    switch (command) {
-        case "onboard":
-            return parseOnboardArgs(argv.slice(1));
-        case "install":
-            return parseInstallArgs(argv.slice(1));
-        case "login":
-        case "pair":
-            return parseLoginArgs(argv.slice(1));
-        case "logout":
-            return parseLogoutArgs(argv.slice(1));
-        case "start":
-            return parseStartArgs(argv.slice(1));
-        case "sync":
-            return parseSyncArgs(argv.slice(1));
-        case "status":
-            return parseStatusArgs(argv.slice(1));
-        case "sessions":
-            return parseSessionsArgs(argv.slice(1));
-        case "serve":
-            return parseServeArgs(argv.slice(1));
-        default:
-            throw new Error(`Unknown local command: ${command ?? ""}`);
-    }
-}
-function parseOnboardArgs(args) {
-    const values = parseNamedArgs(args, {
-        allowedFlags: [
-            "--home",
-            "--repo",
-            "--dashboard-url",
-            "--email",
-            "--device-name",
-            "--ticket",
-            "--branch",
-            "--json",
-            "--poll-interval-ms",
-            "--timeout-ms",
-            "--max-depth",
-            "--max-repos",
-        ],
-        valueFlags: [
-            "--home",
-            "--repo",
-            "--dashboard-url",
-            "--email",
-            "--device-name",
-            "--ticket",
-            "--branch",
-            "--poll-interval-ms",
-            "--timeout-ms",
-            "--max-depth",
-            "--max-repos",
-        ],
-    });
-    assertNoPositionals(values.positionals, "onboard");
-    return {
-        kind: "onboard",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        repoRoot: optionalNonEmpty(values.flags.get("--repo")),
-        dashboardUrl: normalizeUrl(values.flags.get("--dashboard-url") ?? DEFAULT_DASHBOARD_URL),
-        claimedOwnerEmail: optionalEmail(values.flags.get("--email")),
-        deviceName: optionalNonEmpty(values.flags.get("--device-name")),
-        activeTicketId: optionalNonEmpty(values.flags.get("--ticket")),
-        branch: optionalNonEmpty(values.flags.get("--branch")),
-        json: values.booleans.has("--json"),
-        pollIntervalMs: optionalPositiveInteger(values.flags.get("--poll-interval-ms"), "--poll-interval-ms"),
-        timeoutMs: optionalPositiveInteger(values.flags.get("--timeout-ms"), "--timeout-ms"),
-        maxDepth: optionalPositiveInteger(values.flags.get("--max-depth"), "--max-depth"),
-        maxRepos: optionalPositiveInteger(values.flags.get("--max-repos"), "--max-repos"),
-    };
-}
-function parseInstallArgs(args) {
-    const values = parseNamedArgs(args, {
-        allowedFlags: [
-            "--home",
-            "--repo",
-            "--dashboard-url",
-            "--supabase-url",
-            "--json",
-        ],
-        valueFlags: ["--home", "--repo", "--dashboard-url", "--supabase-url"],
-    });
-    assertNoPositionals(values.positionals, "install");
-    return {
-        kind: "install",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        repoRoot: optionalNonEmpty(values.flags.get("--repo")),
-        dashboardUrl: normalizeUrl(values.flags.get("--dashboard-url") ?? DEFAULT_DASHBOARD_URL),
-        supabaseUrl: optionalNonEmpty(values.flags.get("--supabase-url")),
-        json: values.booleans.has("--json"),
-    };
-}
-function parseLoginArgs(args) {
-    const values = parseNamedArgs(args, {
-        allowedFlags: [
-            "--home",
-            "--dashboard-url",
-            "--email",
-            "--device-name",
-            "--json",
-            "--poll-interval-ms",
-            "--timeout-ms",
-        ],
-        valueFlags: [
-            "--home",
-            "--dashboard-url",
-            "--email",
-            "--device-name",
-            "--poll-interval-ms",
-            "--timeout-ms",
-        ],
-    });
-    assertNoPositionals(values.positionals, "login");
-    return {
-        kind: "login",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
-        claimedOwnerEmail: optionalEmail(values.flags.get("--email")),
-        deviceName: optionalNonEmpty(values.flags.get("--device-name")),
-        json: values.booleans.has("--json"),
-        pollIntervalMs: optionalPositiveInteger(values.flags.get("--poll-interval-ms"), "--poll-interval-ms"),
-        timeoutMs: optionalPositiveInteger(values.flags.get("--timeout-ms"), "--timeout-ms"),
-    };
-}
-function parseLogoutArgs(args) {
-    const values = parseNamedArgs(args, {
-        allowedFlags: ["--home", "--json"],
-        valueFlags: ["--home"],
-    });
-    assertNoPositionals(values.positionals, "logout");
-    return {
-        kind: "logout",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        json: values.booleans.has("--json"),
-    };
-}
-function parseStartArgs(args) {
-    const values = parseNamedArgs(args, {
-        allowedFlags: [
-            "--home",
-            "--repo",
-            "--branch",
-            "--ticket",
-            "--operator-id",
-            "--session-id",
-            "--json",
-            "--max-depth",
-            "--max-repos",
-        ],
-        valueFlags: [
-            "--home",
-            "--repo",
-            "--branch",
-            "--ticket",
-            "--operator-id",
-            "--session-id",
-            "--max-depth",
-            "--max-repos",
-        ],
-    });
-    assertNoPositionals(values.positionals, "start");
-    return {
-        kind: "start",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        repoRoot: optionalNonEmpty(values.flags.get("--repo")),
-        branch: optionalNonEmpty(values.flags.get("--branch")),
-        activeTicketId: optionalNonEmpty(values.flags.get("--ticket")),
-        operatorId: optionalNonEmpty(values.flags.get("--operator-id")),
-        sessionId: optionalNonEmpty(values.flags.get("--session-id")),
-        json: values.booleans.has("--json"),
-        maxDepth: optionalPositiveInteger(values.flags.get("--max-depth"), "--max-depth"),
-        maxRepos: optionalPositiveInteger(values.flags.get("--max-repos"), "--max-repos"),
-    };
-}
-function parseSyncArgs(args) {
-    const values = parseNamedArgs(args, {
-        allowedFlags: ["--home", "--repo", "--dashboard-url", "--json", "--max-depth", "--max-repos"],
-        valueFlags: ["--home", "--repo", "--dashboard-url", "--max-depth", "--max-repos"],
-    });
-    assertNoPositionals(values.positionals, "sync");
-    return {
-        kind: "sync",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        repoRoot: optionalNonEmpty(values.flags.get("--repo")),
-        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
-        json: values.booleans.has("--json"),
-        maxDepth: optionalPositiveInteger(values.flags.get("--max-depth"), "--max-depth"),
-        maxRepos: optionalPositiveInteger(values.flags.get("--max-repos"), "--max-repos"),
-    };
-}
-function parseStatusArgs(args) {
-    const values = parseNamedArgs(args, {
-        allowedFlags: ["--home", "--repo", "--json", "--max-depth", "--max-repos"],
-        valueFlags: ["--home", "--repo", "--max-depth", "--max-repos"],
-    });
-    assertNoPositionals(values.positionals, "status");
-    return {
-        kind: "status",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        repoRoot: optionalNonEmpty(values.flags.get("--repo")),
-        json: values.booleans.has("--json"),
-        maxDepth: optionalPositiveInteger(values.flags.get("--max-depth"), "--max-depth"),
-        maxRepos: optionalPositiveInteger(values.flags.get("--max-repos"), "--max-repos"),
-    };
-}
-function parseSessionsArgs(args) {
-    const values = parseNamedArgs(args, {
-        allowedFlags: ["--home", "--repo", "--source", "--json", "--max-depth", "--max-repos"],
-        valueFlags: ["--home", "--repo", "--source", "--max-depth", "--max-repos"],
-    });
-    assertNoPositionals(values.positionals, "sessions");
-    const source = values.flags.get("--source");
-    if (source !== undefined && source !== "codex" && source !== "claude") {
-        throw new Error("--source must be 'codex' or 'claude'.");
-    }
-    return {
-        kind: "sessions",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        repoRoot: optionalNonEmpty(values.flags.get("--repo")),
-        source,
-        json: values.booleans.has("--json"),
-        maxDepth: optionalPositiveInteger(values.flags.get("--max-depth"), "--max-depth"),
-        maxRepos: optionalPositiveInteger(values.flags.get("--max-repos"), "--max-repos"),
-    };
-}
-function parseServeArgs(args) {
-    const values = parseNamedArgs(args, {
-        allowedFlags: ["--home", "--repo", "--port"],
-        valueFlags: ["--home", "--repo", "--port"],
-    });
-    assertNoPositionals(values.positionals, "serve");
-    const port = Number(values.flags.get("--port") ?? "4174");
-    if (!Number.isInteger(port) || port < 1 || port > 65535) {
-        throw new Error("--port must be a TCP port between 1 and 65535.");
-    }
-    return {
-        kind: "serve",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        repoRoot: optionalNonEmpty(values.flags.get("--repo")),
-        port,
-    };
-}
-function parseNamedArgs(args, options) {
-    const allowed = new Set(options.allowedFlags);
-    const valueFlags = new Set(options.valueFlags);
-    const flags = new Map();
-    const booleans = new Set();
-    const positionals = [];
-    for (let index = 0; index < args.length; index += 1) {
-        const arg = args[index] ?? "";
-        rejectServiceRoleLikeArgument(arg);
-        if (!arg.startsWith("--")) {
-            positionals.push(arg);
-            continue;
-        }
-        const [flag, inlineValue] = arg.split("=", 2);
-        if (!allowed.has(flag))
-            throw new Error(`Unknown flag: ${flag}`);
-        if (valueFlags.has(flag)) {
-            const value = inlineValue ?? args[index + 1];
-            if (!value || value.startsWith("--")) {
-                throw new Error(`${flag} requires a value.`);
-            }
-            rejectServiceRoleLikeArgument(value);
-            flags.set(flag, value);
-            if (inlineValue === undefined)
-                index += 1;
-        }
-        else {
-            if (inlineValue !== undefined)
-                throw new Error(`${flag} does not accept a value.`);
-            booleans.add(flag);
-        }
-    }
-    return { flags, booleans, positionals };
-}
 async function runInstall(command, io) {
     const result = await installLocalCollector(command);
     if (command.json) {
@@ -473,17 +210,14 @@ function isInteractiveStdin(io) {
     return Boolean(io.stdin.isTTY);
 }
 /**
- * Reads one line from stdin so `cockpit onboard` (no flags) can ask for the
- * dashboard email instead of forcing a `--email` flag. Only called when stdin
- * is a TTY and we're not in --json mode, so headless / piped / spawned runs
- * never block on input — they keep the existing behaviour (email optional; the
- * approving admin's account owns the device). An empty answer or a non-email
- * skips rather than failing, matching `optionalEmail`'s leniency.
+ * Reads one line from stdin after writing a prompt. Shared by the onboard email
+ * prompt and the autostart prompt; callers gate on `isInteractiveStdin` first so
+ * headless / piped / spawned runs never block on input.
  */
-async function promptOnboardEmail(io) {
-    io.stdout.write("Dashboard email (press enter to skip): ");
+async function readLine(io, prompt) {
+    io.stdout.write(prompt);
     io.stdin.setEncoding("utf8");
-    const raw = await new Promise((resolve) => {
+    return new Promise((resolve) => {
         const onData = (chunk) => {
             io.stdin.removeListener("data", onData);
             io.stdin.pause();
@@ -492,6 +226,15 @@ async function promptOnboardEmail(io) {
         io.stdin.resume();
         io.stdin.on("data", onData);
     });
+}
+/**
+ * Asks for the dashboard email so `cockpit onboard` (no flags) need not force a
+ * `--email`. Only called when stdin is a TTY and not in --json mode. An empty
+ * answer or a non-email skips rather than failing, matching `optionalEmail`'s
+ * leniency (the approving admin's account then owns the device).
+ */
+async function promptOnboardEmail(io) {
+    const raw = await readLine(io, "Dashboard email (press enter to skip): ");
     const answer = raw.trim().toLowerCase();
     if (!answer)
         return undefined;
@@ -501,6 +244,38 @@ async function promptOnboardEmail(io) {
     }
     return answer;
 }
+/**
+ * After a successful onboard, offers to install the launchd autostart agent so a
+ * Mac mini keeps syncing without anyone re-running cockpit — this is the fix for
+ * interns drifting to Stale. Only in an interactive, non-JSON run with a real
+ * exec runner (`io.exec`): headless / piped / spawned onboards and tests that
+ * pass no exec skip it entirely. Declining leaves onboarding's success untouched.
+ */
+async function maybeOfferAutostart(command, io) {
+    if (command.json || !isInteractiveStdin(io) || !io.exec)
+        return;
+    const answer = (await readLine(io, "Keep Cockpit syncing in the background, even after restart? [Y/n] "))
+        .trim()
+        .toLowerCase();
+    if (answer === "n" || answer === "no") {
+        writeLine(io.stdout, "Skipped background autostart. Run `cockpit autostart install` anytime.");
+        return;
+    }
+    const result = await installAutostartAgent({
+        homeDir: command.homeDir,
+        repoRoot: command.repoRoot,
+        dashboardUrl: command.dashboardUrl,
+        exec: io.exec,
+    });
+    if (result.status === "unsupported") {
+        writeLine(io.stdout, `Background autostart unsupported: ${result.message}`);
+        return;
+    }
+    writeLine(io.stdout, result.loaded
+        ? "Background autostart installed; Cockpit syncs at login and every 30 min."
+        : "Background autostart installed, but launchctl load reported a problem; check `cockpit autostart status`.");
+    writeLine(io.stdout, `Plist: ${result.plist_path}`);
+}
 async function runOnboard(command, io) {
     let install = null;
     let pair = null;
@@ -574,6 +349,8 @@ async function runOnboard(command, io) {
                     codex_sessions: multi.codex_sessions,
                 }, null, 2));
             }
+            if (multi.ok)
+                await maybeOfferAutostart(command, io);
             return multi.ok ? 0 : 1;
         }
         const context = await startLocalWorkContext({
@@ -638,6 +415,7 @@ async function runOnboard(command, io) {
         writeLine(io.stdout, `Upload state: ${status.upload_state}`);
         writeLine(io.stdout, "PASS: Cockpit collector is ready for harvest.");
         writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
+        await maybeOfferAutostart(command, io);
         return 0;
     }
     catch (error) {
@@ -694,497 +472,6 @@ async function readOnboardSessionReuseCandidate(homeDir) {
 function normalizeUrlForComparison(value) {
     return value ? normalizeUrl(value) : null;
 }
-const CLAUDE_FIRST_RUN_BACKFILL_MINUTES = 14 * 24 * 60;
-const CLAUDE_DAMP_GROWTH_BYTES = 256 * 1024;
-const CLAUDE_DAMP_MAX_AGE_MS = 6 * 60 * 60 * 1000;
-/**
- * Shared dual-source sync orchestration for single-repo and parent-folder
- * modes. Codex AND Claude Code sessions are scanned and attributed once across
- * every discovered worktree; each worktree syncs with only its own attributed
- * transcripts (codex + claude main + sidecars), and the
- * ambiguous/unattributed/skipped remainder is reported with reason labels and a
- * `source` discriminator instead of being duplicated into every repo or
- * silently dropped. The session row's upload state maps ONLY from the main-file
- * outcome (D3); sidecar outcomes aggregate into CLI counts.
- */
-async function runAttributedWorktreeSync(options) {
-    const now = new Date();
-    const homeDir = options.homeDir ?? os.homedir();
-    const paths = getCollectorRuntimePaths(options.homeDir);
-    const claudeEnabled = await isClaudeCollectionEnabled(paths);
-    const codexAttribution = await scanAndAttributeCodexSessions({
-        sessionsDir: path.join(homeDir, ".codex", "sessions"),
-        worktrees: options.worktrees,
-        now,
-    });
-    // First run (D B.4 §8): without a Claude cursor yet, widen the window to 14
-    // days so the first sync captures retroactive history instead of only 24h.
-    const claudeCursorExists = await fileExists(path.join(paths.cursors_dir, CLAUDE_CURSOR_FILENAME));
-    const firstRunBackfill = claudeEnabled && !claudeCursorExists;
-    const claudeAttribution = claudeEnabled
-        ? await scanAndAttributeClaudeSessions({
-            projectsDir: path.join(homeDir, ".claude", "projects"),
-            worktrees: options.worktrees,
-            now,
-            sinceMinutes: firstRunBackfill
-                ? CLAUDE_FIRST_RUN_BACKFILL_MINUTES
-                : undefined,
-        })
-        : emptyClaudeScan();
-    // Read the Claude cursor up front: damping decisions need prior upload state.
-    const claudeCursorBefore = claudeEnabled
-        ? await readRawEvidenceCursor(paths, {
-            filename: CLAUDE_CURSOR_FILENAME,
-        }).catch(() => emptyRawEvidenceCursorState())
-        : emptyRawEvidenceCursorState();
-    // sessionId -> prior durable pointer for damped sessions (drives the
-    // growth_damped count + the skip_main decision).
-    const dampedClaudePointers = new Map();
-    // sessionId -> prior durable pointer for EVERY already-durable Claude session
-    // (superset of damped). A session that was durable before but had no fresh
-    // upload this sync (damped, spooled, budget-deferred) reports reused_existing
-    // with this pointer instead of not_uploaded, so the store row never flips.
-    const claudePriorDurablePointers = new Map();
-    for (const [sessionId, entry] of Object.entries(claudeCursorBefore.sessions)) {
-        if (entry.uploaded_object_key) {
-            claudePriorDurablePointers.set(sessionId, entry.uploaded_object_key);
-        }
-    }
-    // One shared budget for the whole sync (D7b is per-sync): a parent-folder
-    // sync over many worktrees honors a single byte/object cap rather than N×.
-    const rawEvidenceBudget = {
-        remainingBytes: RAW_EVIDENCE_DEFAULT_BYTE_BUDGET,
-        remainingObjects: RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET,
-    };
-    const outcomes = [];
-    let ok = true;
-    for (const worktree of options.worktrees) {
-        let context = null;
-        if (options.startContexts) {
-            context = await startLocalWorkContext({
-                homeDir: options.homeDir,
-                repoRoot: worktree.repo_root,
-                branch: options.branch,
-                activeTicketId: options.activeTicketId,
-                operatorId: options.operatorId,
-                sessionId: options.sessionId,
-            });
-        }
-        const claudeSessionFiles = claudeAttribution.results
-            .filter((result) => result.state === "attributed" &&
-            result.worktree?.worktree_fingerprint ===
-                worktree.worktree_fingerprint)
-            .map((result) => {
-            const damped = !result.main_file_oversized &&
-                shouldDampClaudeMain(result, claudeCursorBefore, now);
-            if (damped) {
-                dampedClaudePointers.set(result.claude_session_id, claudeCursorBefore.sessions[result.claude_session_id]
-                    ?.uploaded_object_key ?? null);
-            }
-            return {
-                local_path: result.file_path,
-                claude_session_id: result.claude_session_id,
-                main_file_oversized: result.main_file_oversized,
-                skip_main: damped,
-                sidecar_files: result.sidecar_files
-                    .filter((sidecar) => !sidecar.skipped_reason)
-                    .map((sidecar) => ({ local_path: sidecar.local_path })),
-            };
-        });
-        const syncOptions = {
-            homeDir: options.homeDir,
-            repoRoot: worktree.repo_root,
-            dashboardUrl: options.dashboardUrl,
-            codexSessionFiles: codexAttribution.results
-                .filter((result) => result.state === "attributed" &&
-                result.worktree?.worktree_fingerprint ===
-                    worktree.worktree_fingerprint)
-                .map((result) => ({
-                local_path: result.file_path,
-                codex_session_id: result.codex_session_id,
-            })),
-            claudeSessionFiles,
-            rawEvidenceBudget,
-            fetch: options.fetchImpl,
-        };
-        let sync;
-        try {
-            sync = await syncLocalAmbientEnvelope(syncOptions);
-        }
-        catch (error) {
-            // A newly cloned repo has no work context yet. Capture is permissive
-            // and ticket binding comes later, so start general ambient capture for
-            // it instead of blocking every other repo's sync until someone runs
-            // `cockpit start` by hand.
-            if (error instanceof LocalUploadBlockedError &&
-                error.blocker === "missing_context") {
-                context = await startLocalWorkContext({
-                    homeDir: options.homeDir,
-                    repoRoot: worktree.repo_root,
-                    branch: options.branch,
-                });
-                sync = await syncLocalAmbientEnvelope(syncOptions);
-            }
-            else {
-                throw error;
-            }
-        }
-        ok = ok && sync.status === "uploaded";
-        outcomes.push({ worktree, context, sync });
-    }
-    const sessions = buildAgentSessionReport({
-        codexResults: codexAttribution.results,
-        claudeResults: claudeAttribution.results,
-        outcomes,
-        now,
-        claudePriorDurablePointers,
-    });
-    // The sessions cursor is an optimization; a broken local state dir must not
-    // turn already-completed syncs into a CLI crash.
-    let codexStaleCount = 0;
-    let claudeStaleCount = 0;
-    try {
-        const codexCursor = await readRawEvidenceCursor(paths);
-        codexStaleCount = recordSourceObservations({
-            cursor: codexCursor,
-            results: codexAttribution.results,
-            sessions,
-            source: "codex",
-            sessionIdOf: (result) => result.codex_session_id,
-            now,
-        });
-        codexCursor.updated_at = now.toISOString();
-        await writeRawEvidenceCursor(paths, codexCursor);
-    }
-    catch {
-        // Best-effort: stale counts read 0 and observations re-record next sync.
-    }
-    if (claudeEnabled) {
-        try {
-            claudeStaleCount = recordSourceObservations({
-                cursor: claudeCursorBefore,
-                results: claudeAttribution.results,
-                sessions,
-                source: "claude_code",
-                sessionIdOf: (result) => result.claude_session_id,
-                now,
-                priorCursor: claudeCursorBefore,
-            });
-            claudeCursorBefore.updated_at = now.toISOString();
-            await writeRawEvidenceCursor(paths, claudeCursorBefore, {
-                filename: CLAUDE_CURSOR_FILENAME,
-                sessionsOnly: true,
-            });
-        }
-        catch {
-            // Best-effort: a broken Claude cursor must not fail the sync.
-        }
-    }
-    const firstUploaded = outcomes.find((outcome) => outcome.sync.status === "uploaded");
-    const report = firstUploaded
-        ? await postCodexSessionReport({
-            homeDir: options.homeDir,
-            repoRoot: firstUploaded.worktree.repo_root,
-            dashboardUrl: options.dashboardUrl,
-            sessions,
-            fetch: options.fetchImpl,
-            now,
-        })
-        : {
-            posted: false,
-            reason: sessions.length === 0 ? "no_sessions_observed" : "no_successful_sync",
-        };
-    const summary = buildAgentSessionSummary({
-        codexAttribution,
-        claudeAttribution,
-        outcomes,
-        codexStaleCount,
-        claudeStaleCount,
-        firstRunBackfill,
-        growthDamped: dampedClaudePointers.size,
-        report,
-    });
-    return { ok, outcomes, codexAttribution, claudeAttribution, summary };
-}
-const ATTRIBUTION_STATE_RANK = {
-    attributed: 3,
-    ambiguous: 2,
-    unattributed: 1,
-    skipped: 0,
-};
-function normalizeCodexResult(result) {
-    return {
-        source: "codex",
-        session_id: result.codex_session_id,
-        state: result.state,
-        reason: result.reason,
-        signals: result.signals,
-        attribution_score: result.attribution_score,
-        path_score: result.path_score,
-        content_hash_sha256: result.content_hash_sha256,
-        byte_size: result.byte_size,
-        session_file_mtime: result.session_file_mtime,
-        session_file_mtime_ms: result.session_file_mtime_ms,
-        worktree: result.worktree,
-        cwd_basename: result.cwd_basename,
-        cwd_hash: result.cwd_hash,
-    };
-}
-function normalizeClaudeResult(result) {
-    return {
-        source: "claude_code",
-        session_id: result.claude_session_id,
-        state: result.state,
-        reason: result.reason,
-        signals: result.signals,
-        attribution_score: result.attribution_score,
-        path_score: result.path_score,
-        content_hash_sha256: result.content_hash_sha256,
-        byte_size: result.byte_size,
-        session_file_mtime: result.session_file_mtime,
-        session_file_mtime_ms: result.session_file_mtime_ms,
-        worktree: result.worktree,
-        cwd_basename: result.cwd_basename,
-        cwd_hash: result.cwd_hash,
-    };
-}
-/**
- * Generalizes the per-session report across sources. Dedupe is per
- * `(source, session_id)` so a Codex session and a Claude session that happen to
- * share an id are never collapsed. Upload state maps ONLY from the main-file
- * outcome (kind `codex_jsonl` / `claude_jsonl`); sidecar outcomes never set a
- * session's upload state (D3). Damped Claude sessions report `reused_existing`
- * carrying their prior durable pointer.
- */
-function buildAgentSessionReport(options) {
-    const normalized = [
-        ...options.codexResults.map(normalizeCodexResult),
-        ...options.claudeResults.map(normalizeClaudeResult),
-    ];
-    const bestByKey = new Map();
-    for (const result of normalized) {
-        const key = `${result.source}:${result.session_id}`;
-        const existing = bestByKey.get(key);
-        if (!existing ||
-            (ATTRIBUTION_STATE_RANK[result.state] ?? 0) >
-                (ATTRIBUTION_STATE_RANK[existing.state] ?? 0) ||
-            ((ATTRIBUTION_STATE_RANK[result.state] ?? 0) ===
-                (ATTRIBUTION_STATE_RANK[existing.state] ?? 0) &&
-                result.session_file_mtime_ms > existing.session_file_mtime_ms)) {
-            bestByKey.set(key, result);
-        }
-    }
-    // Main-file outcomes only (D3): a sidecar making it must never mark a session
-    // uploaded when the main did not.
-    const uploadByKey = new Map();
-    for (const outcome of options.outcomes) {
-        if (outcome.sync.status !== "uploaded")
-            continue;
-        for (const upload of outcome.sync.raw_evidence_outcomes) {
-            if (!upload.codex_session_id || !upload.raw_evidence_pointer_id)
-                continue;
-            const source = upload.kind === "claude_jsonl"
-                ? "claude_code"
-                : upload.kind === "codex_jsonl"
-                    ? "codex"
-                    : null;
-            if (!source)
-                continue; // sidecars and other kinds do not set session state
-            uploadByKey.set(`${source}:${upload.codex_session_id}`, upload);
-        }
-    }
-    return [...bestByKey.values()].map((result) => {
-        const key = `${result.source}:${result.session_id}`;
-        const upload = uploadByKey.get(key);
-        // A previously-durable Claude session with no fresh main upload this sync
-        // (damped / spooled / budget-deferred) reports reused_existing + its prior
-        // pointer rather than not_uploaded, so the store row never flips.
-        const priorDurablePointer = result.source === "claude_code"
-            ? (options.claudePriorDurablePointers.get(result.session_id) ?? null)
-            : null;
-        return {
-            codex_session_id: result.session_id,
-            source: result.source,
-            observed_at: options.now.toISOString(),
-            attribution_state: result.state,
-            attribution_reason: result.reason,
-            attribution_score: result.attribution_score,
-            path_score: result.path_score,
-            signals: result.signals,
-            ...(result.content_hash_sha256
-                ? { session_file_hash_sha256: result.content_hash_sha256 }
-                : {}),
-            session_file_byte_size: result.byte_size,
-            session_file_mtime: result.session_file_mtime,
-            ...(result.worktree
-                ? {
-                    repo_fingerprint: result.worktree.repo_fingerprint,
-                    worktree_fingerprint: result.worktree.worktree_fingerprint,
-                    repo_label: result.worktree.repo_label,
-                    branch: result.worktree.branch,
-                }
-                : {}),
-            ...(result.cwd_basename ? { cwd_basename: result.cwd_basename } : {}),
-            ...(result.cwd_hash ? { cwd_hash: result.cwd_hash } : {}),
-            ...(upload
-                ? {
-                    raw_evidence_pointer_id: upload.raw_evidence_pointer_id,
-                    upload_state: upload.upload_state,
-                }
-                : priorDurablePointer
-                    ? {
-                        raw_evidence_pointer_id: priorDurablePointer,
-                        upload_state: "reused_existing",
-                    }
-                    : result.state === "attributed"
-                        ? { upload_state: "not_uploaded" }
-                        : {}),
-        };
-    });
-}
-/**
- * Records per-source session observations into its cursor and returns the stale
- * count. Damped/reused Claude sessions carry forward their prior upload
- * timestamp + byte size so the 6h damping window keeps counting from the real
- * last upload (otherwise a slowly-growing file would never re-upload — D21).
- */
-function recordSourceObservations(options) {
-    const seen = new Set(options.results.map((result) => options.sessionIdOf(result)));
-    const stale = countStaleSessions(options.cursor, seen);
-    for (const result of options.results) {
-        const sessionId = options.sessionIdOf(result);
-        const reported = options.sessions.find((session) => session.source === options.source &&
-            session.codex_session_id === sessionId);
-        const uploadedThisSync = reported?.upload_state === "uploaded";
-        const durableThisSync = reported?.upload_state === "uploaded" ||
-            reported?.upload_state === "reused_existing";
-        const prior = options.priorCursor?.sessions[sessionId];
-        // D21 / no-flip-flop: a sync that is spooled (offline), budget-deferred, or
-        // upload-failed for a session that was ALREADY durable must NOT wipe the
-        // prior durable state — otherwise damping is forfeited forever and the
-        // store row oscillates uploaded -> not_uploaded hourly. Carry the prior
-        // durable pointer/timestamp/size forward unless we durably uploaded anew.
-        const uploadedObjectKey = durableThisSync
-            ? (reported?.raw_evidence_pointer_id ?? prior?.uploaded_object_key ?? null)
-            : (prior?.uploaded_object_key ?? null);
-        const uploadedAt = uploadedThisSync
-            ? options.now.toISOString()
-            : (prior?.uploaded_at ?? (durableThisSync ? options.now.toISOString() : null));
-        const uploadedByteSize = uploadedThisSync
-            ? result.byte_size
-            : (prior?.uploaded_byte_size ??
-                (durableThisSync ? result.byte_size : null));
-        const entry = {
-            file_hash_sha256: result.content_hash_sha256,
-            file_mtime_ms: result.session_file_mtime_ms,
-            byte_size: result.byte_size,
-            // Durable byte offset reflects how many bytes are durable remotely (the
-            // last uploaded size), not the current file size.
-            byte_offset: uploadedByteSize ?? 0,
-            state: result.state,
-            reason: result.reason,
-            worktree_fingerprint: result.worktree?.worktree_fingerprint ?? null,
-            uploaded_object_key: uploadedObjectKey,
-            uploaded_at: uploadedAt,
-            uploaded_byte_size: uploadedByteSize,
-            last_seen_at: options.now.toISOString(),
-        };
-        recordSessionObservation(options.cursor, sessionId, entry);
-    }
-    return stale;
-}
-function shouldDampClaudeMain(result, cursor, now) {
-    const entry = cursor.sessions[result.claude_session_id];
-    if (!entry ||
-        !entry.uploaded_object_key ||
-        !entry.uploaded_at ||
-        entry.uploaded_byte_size == null) {
-        return false;
-    }
-    const grew = result.byte_size > entry.uploaded_byte_size;
-    if (!grew)
-        return false; // unchanged content reuses via the object cursor
-    const growth = result.byte_size - entry.uploaded_byte_size;
-    const ageMs = now.getTime() - Date.parse(entry.uploaded_at);
-    return (growth <= CLAUDE_DAMP_GROWTH_BYTES &&
-        Number.isFinite(ageMs) &&
-        ageMs <= CLAUDE_DAMP_MAX_AGE_MS);
-}
-function buildAgentSessionSummary(options) {
-    const sidecarOutcomes = options.outcomes.flatMap((outcome) => outcome.sync.raw_evidence_outcomes.filter((upload) => upload.kind === "claude_jsonl_sidecar"));
-    const attributedClaude = options.claudeAttribution.results.filter((result) => result.state === "attributed");
-    const sidecarsCollected = attributedClaude.reduce((total, result) => total +
-        result.sidecar_files.filter((sidecar) => !sidecar.skipped_reason).length, 0);
-    const sidecarsSkipped = options.claudeAttribution.results.reduce((total, result) => total +
-        result.sidecar_files.filter((sidecar) => sidecar.skipped_reason).length, 0);
-    const codex = {
-        scanned: options.codexAttribution.scanned_file_count,
-        attributed: options.codexAttribution.counts.attributed,
-        ambiguous: options.codexAttribution.counts.ambiguous,
-        unattributed: options.codexAttribution.counts.unattributed,
-        skipped: options.codexAttribution.counts.skipped,
-        stale: options.codexStaleCount,
-    };
-    const claude = {
-        scanned: options.claudeAttribution.scanned_session_count,
-        attributed: options.claudeAttribution.counts.attributed,
-        ambiguous: options.claudeAttribution.counts.ambiguous,
-        unattributed: options.claudeAttribution.counts.unattributed,
-        skipped: options.claudeAttribution.counts.skipped,
-        stale: options.claudeStaleCount,
-        sidecars_collected: sidecarsCollected,
-        sidecars_uploaded: sidecarOutcomes.filter((upload) => upload.upload_state === "uploaded" ||
-            upload.upload_state === "reused_existing").length,
-        sidecars_skipped: sidecarsSkipped,
-        sidecars_capped: options.claudeAttribution.counts.sidecars_capped,
-        sidecars_failed: sidecarOutcomes.filter((upload) => upload.upload_state === "upload_failed").length,
-        mains_oversized: options.claudeAttribution.counts.mains_oversized,
-        oversized_lines_skipped: options.claudeAttribution.counts.oversized_lines_skipped,
-        project_dirs_skipped: options.claudeAttribution.project_dirs_skipped,
-        sessions_schema_drift: options.claudeAttribution.counts.sessions_schema_drift,
-        growth_damped: options.growthDamped,
-        first_run_backfill: options.firstRunBackfill,
-    };
-    return {
-        scanned: codex.scanned,
-        attributed: codex.attributed,
-        ambiguous: codex.ambiguous,
-        unattributed: codex.unattributed,
-        skipped: codex.skipped,
-        stale: codex.stale,
-        report_posted: options.report.posted,
-        report_reason: options.report.reason,
-        codex,
-        claude,
-        files_deferred_byte_budget: options.outcomes.reduce((total, outcome) => total + outcome.sync.raw_evidence_deferred_byte_budget, 0),
-        files_deferred_object_budget: options.outcomes.reduce((total, outcome) => total + outcome.sync.raw_evidence_deferred_object_budget, 0),
-    };
-}
-function emptyClaudeScan() {
-    return {
-        results: [],
-        scanned_session_count: 0,
-        project_dirs_skipped: 0,
-        counts: {
-            attributed: 0,
-            ambiguous: 0,
-            unattributed: 0,
-            skipped: 0,
-            mains_oversized: 0,
-            oversized_lines_skipped: 0,
-            sessions_schema_drift: 0,
-            sidecars_capped: 0,
-        },
-    };
-}
-async function isClaudeCollectionEnabled(paths) {
-    const config = await readLocalCollectorConfig(paths).catch(() => null);
-    return config?.collect_claude_jsonl !== false;
-}
-async function fileExists(filePath) {
-    const { stat } = await import("node:fs/promises");
-    return stat(filePath).then(() => true, () => false);
-}
 function shortSha(value) {
     return value ? value.slice(0, 12) : "unknown";
 }
@@ -1685,74 +972,70 @@ async function runServe(command, io) {
     });
     return 0;
 }
-function assertNoPositionals(positionals, command) {
-    if (positionals.length > 0) {
-        throw new Error(`${command} does not accept positional arguments.`);
-    }
-}
-function optionalNonEmpty(value) {
-    const trimmed = value?.trim();
-    return trimmed ? trimmed : undefined;
-}
-function optionalUrl(value) {
-    return value === undefined ? undefined : normalizeUrl(value);
-}
-function optionalEmail(value) {
-    const trimmed = value?.trim().toLowerCase();
-    if (!trimmed)
-        return undefined;
-    if (!trimmed.includes("@")) {
-        throw new Error("--email must be a valid email address.");
-    }
-    return trimmed;
-}
-function optionalPositiveInteger(value, flag) {
-    if (value === undefined)
-        return undefined;
-    const parsed = Number(value);
-    if (!Number.isInteger(parsed) || parsed < 1) {
-        throw new Error(`${flag} must be a positive integer.`);
-    }
-    return parsed;
-}
-function normalizeUrl(value) {
-    const trimmed = value.trim().replace(/\/+$/, "");
-    if (!trimmed)
-        throw new Error("URL value cannot be empty.");
-    return trimmed;
-}
-function rejectServiceRoleLikeArgument(value) {
-    if (!looksLikeServiceRoleSecret(value))
-        return;
-    throw new Error("Service-role credentials are not accepted by local collector commands.");
-}
-function looksLikeServiceRoleSecret(value) {
-    if (serviceCredentialNamePattern().test(value))
-        return true;
-    const parts = value.split(".");
-    if (parts.length !== 3)
-        return false;
-    try {
-        const payload = Buffer.from(base64UrlToBase64(parts[1] ?? ""), "base64").toString("utf8");
-        return serviceCredentialPayloadPattern().test(payload);
+async function runAutostart(command, io) {
+    const exec = io.exec ?? defaultExec();
+    const result = command.action === "install"
+        ? await installAutostartAgent({
+            homeDir: command.homeDir,
+            repoRoot: command.repoRoot,
+            dashboardUrl: command.dashboardUrl,
+            intervalSeconds: command.intervalSeconds,
+            exec,
+        })
+        : command.action === "uninstall"
+            ? await uninstallAutostartAgent({ homeDir: command.homeDir, exec })
+            : await autostartStatus({ homeDir: command.homeDir, exec });
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(result, null, 2));
+        return result.status === "unsupported" ? 1 : 0;
     }
-    catch {
-        return false;
+    writeAutostartResult(io, result);
+    return result.status === "unsupported" ? 1 : 0;
+}
+function writeAutostartResult(io, result) {
+    switch (result.status) {
+        case "installed":
+            writeLine(io.stdout, result.loaded
+                ? "Cockpit autostart installed and loaded."
+                : "Cockpit autostart installed (launchctl load reported a problem).");
+            writeLine(io.stdout, `Label: ${result.label}`);
+            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            writeLine(io.stdout, `Interval: every ${result.interval_seconds}s`);
+            writeLine(io.stdout, `Repo: ${result.work_dir}`);
+            writeLine(io.stdout, `Dashboard: ${result.dashboard_url}`);
+            if (!result.loaded && result.message)
+                writeLine(io.stderr, result.message);
+            return;
+        case "uninstalled":
+            writeLine(io.stdout, "Cockpit autostart removed.");
+            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            return;
+        case "absent":
+            writeLine(io.stdout, "Cockpit autostart is not installed.");
+            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            return;
+        case "loaded":
+            writeLine(io.stdout, "Cockpit autostart is installed and loaded.");
+            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            return;
+        case "not_loaded":
+            writeLine(io.stdout, "Cockpit autostart plist exists but is not loaded; run `cockpit autostart install` to reload.");
+            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            return;
+        case "unsupported":
+            writeLine(io.stderr, `Autostart unsupported: ${result.message}`);
+            return;
     }
 }
-function serviceCredentialNamePattern() {
-    return new RegExp([
-        ["SUPABASE", "SERVICE", "ROLE", "KEY"].join("[_-]?"),
-        ["service", "role"].join("[_-]?"),
-    ].join("|"), "i");
-}
-function serviceCredentialPayloadPattern() {
-    const privilegedRole = ["service", "role"].join("_");
-    return new RegExp(`"role"\\s*:\\s*"${privilegedRole}"`);
-}
-function base64UrlToBase64(value) {
-    const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
-    return `${normalized}${"=".repeat((4 - (normalized.length % 4)) % 4)}`;
+function defaultExec() {
+    return (cmd, args) => new Promise((resolve) => {
+        execFile(cmd, args, { encoding: "utf8" }, (err, stdout, stderr) => {
+            // execFile's error `.code` is the exit code when numeric, but a string
+            // (e.g. "ENOENT") for spawn failures — treat those as a generic 1.
+            const code = err == null ? 0 : typeof err.code === "number" ? err.code : 1;
+            resolve({ code, stdout: stdout ?? "", stderr: stderr ?? "" });
+        });
+    });
 }
 function defaultIo() {
     if (!globalThis.fetch) {
@@ -1764,6 +1047,7 @@ function defaultIo() {
         stderr: process.stderr,
         env: process.env,
         fetch: globalThis.fetch.bind(globalThis),
+        exec: defaultExec(),
     };
 }
 function writeLine(stream, text) {