@bli-cockpit/cli 0.2.10 → 0.2.12

package/dist/autostart.js

@@ -2,6 +2,7 @@ import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "./local-state.js";
+import { savedDiscoveryLimitArgs } from "./discovery-limits.js";
 /** launchd LaunchAgent label; matches docs/runbooks/cockpit-launchd-sync.md. */
 export const AUTOSTART_LABEL = "com.bli.cockpit.sync";
 export const WINDOWS_AUTOSTART_TASK_NAME = "BLI Cockpit Sync";
@@ -53,6 +54,7 @@ export async function installAutostartAgent(options) {
     await mkdir(path.dirname(plistPath), { recursive: true });
     await mkdir(paths.state_dir, { recursive: true });
     await writeFile(plistPath, renderPlist({
+        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
         workDir,
         workDirs: resolvedWorkDirs,
         dashboardUrl,
@@ -127,6 +129,7 @@ export async function autostartStatus(options) {
     const cliEntryPoint = path.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
     const plist = await readFile(plistPath, "utf8").catch(() => "");
     const registrationProblems = darwinAgentRegistrationProblems(plist, {
+        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
         workDirs: resolvedWorkDirs,
         dashboardUrl,
         intervalSeconds,
@@ -165,6 +168,7 @@ async function installWindowsTask(options) {
     const cliEntryPoint = path.win32.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
     await mkdir(path.dirname(scriptPath), { recursive: true });
     await writeFile(scriptPath, `${UTF8_BOM}${renderWindowsSyncScript({
+        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
         workDirs: resolvedWorkDirs,
         dashboardUrl,
         nodeExecutable,
@@ -290,6 +294,7 @@ async function windowsTaskStatus(options) {
     }
     else if (options.repoRoots && options.repoRoots.length > 0) {
         const expectedScript = `${UTF8_BOM}${renderWindowsSyncScript({
+            discoveryArgs: await savedDiscoveryLimitArgs(options.homeDir),
             workDirs: normalizeWindowsWorkDirs(options.repoRoots),
             dashboardUrl: options.dashboardUrl ?? DEFAULT_DASHBOARD_URL,
             nodeExecutable: path.win32.resolve(options.nodeExecutable ?? process.execPath),
@@ -337,9 +342,10 @@ function renderWindowsSyncScript(options) {
     const dashboardArgs = options.dashboardUrl === DEFAULT_DASHBOARD_URL
         ? ""
         : ` --dashboard-url ${powershellLiteral(options.dashboardUrl)}`;
+    const discoveryArgs = options.discoveryArgs.length > 0 ? ` ${options.discoveryArgs.join(" ")}` : "";
     const commands = options.workDirs.flatMap((root) => [
         "try {",
-        `  & $nodeExecutable $cliEntryPoint sync --workspace ${powershellLiteral(root)}${dashboardArgs} --json`,
+        `  & $nodeExecutable $cliEntryPoint sync --workspace ${powershellLiteral(root)}${dashboardArgs}${discoveryArgs} --json`,
         "  if ($LASTEXITCODE -ne 0) { $exitCode = $LASTEXITCODE }",
         "} catch {",
         "  [Console]::Error.WriteLine($_.Exception.Message)",
@@ -532,6 +538,7 @@ function renderPlist(options) {
         dashboardUrl: options.dashboardUrl,
         nodeExecutable: options.nodeExecutable,
         cliEntryPoint: options.cliEntryPoint,
+        discoveryArgs: options.discoveryArgs,
     });
     return [
         '<?xml version="1.0" encoding="UTF-8"?>',
@@ -569,7 +576,8 @@ function renderDarwinSyncCommand(options) {
     const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
         ? ""
         : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
-    const commands = options.workDirs.map((root) => `${shellQuote(options.nodeExecutable)} ${shellQuote(options.cliEntryPoint)} sync --workspace ${shellQuote(root)}${dashboardArg} --json || exit_code=1`);
+    const discoveryArg = options.discoveryArgs.length > 0 ? ` ${options.discoveryArgs.join(" ")}` : "";
+    const commands = options.workDirs.map((root) => `${shellQuote(options.nodeExecutable)} ${shellQuote(options.cliEntryPoint)} sync --workspace ${shellQuote(root)}${dashboardArg}${discoveryArg} --json || exit_code=1`);
     return ["exit_code=0", ...commands, 'exit "$exit_code"'].join("; ");
 }
 function darwinAgentRegistrationProblems(plist, expected) {
@@ -583,6 +591,7 @@ function darwinAgentRegistrationProblems(plist, expected) {
         problems.push(`cadence is not ${expected.intervalSeconds} seconds`);
     }
     const expectedCommand = renderDarwinSyncCommand({
+        discoveryArgs: expected.discoveryArgs,
         workDirs: expected.workDirs,
         dashboardUrl: expected.dashboardUrl,
         nodeExecutable: expected.nodeExecutable,

package/dist/commands/backfill.js

@@ -9,7 +9,7 @@ import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET }
 import { acquireBackfillLock } from "../backfill-lock.js";
 import { BACKFILL_COMPLETION_RECHECK_MS, BACKFILL_COVERAGE_VERSION, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCursor, recordBackfillCursorObservations, recordBackfillScanCoverage, writeBackfillCompletionMarker, writeBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, readLocalWorkContextForRepo, startLocalWorkContext } from "../local-state.js";
-import { collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
+import { DEFAULT_DISCOVERY_MAX_DEPTH, DEFAULT_DISCOVERY_MAX_REPOS, collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
 import { isRawEvidenceUploadableAttributionState } from "../raw-evidence-attribution-policy.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
 import { acquireSyncLock } from "../sync-lock.js";
@@ -17,8 +17,6 @@ import { LocalUploadBlockedError, postCodexSessionReport, syncLocalAmbientEnvelo
 const BACKFILL_UPLOAD_BATCH_SESSIONS = 25;
 const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
 const ALL_BACKFILL_SINCE_MINUTES = 20 * 365 * 24 * 60;
-const DEFAULT_DISCOVERY_MAX_DEPTH = 3;
-const DEFAULT_DISCOVERY_MAX_REPOS = 50;
 // Window a bare `cockpit backfill` uses. Wide enough to cover a new machine's
 // recent history and an intern who went quiet for a few weeks, narrow enough
 // that it is not the whole-history scan `--all` deliberately gates.

package/dist/commands/doctor.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { autostartStatus, installAutostartAgent } from "../autostart.js";
+import { savedDiscoveryLimitArgs } from "../discovery-limits.js";
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { backfillCompletionCovers, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
@@ -314,8 +315,12 @@ async function fixSyncState(context) {
     if (roots.length === 0) {
         return fail("sync-fresh", "no_roots", "sync has no saved workspace roots");
     }
+    // The remembered limits have to ride along, or the doctor's own verification
+    // sync scans differently from every other run and can fail closed on a
+    // machine the operator already fixed by hand (BLI-2362).
+    const discoveryArgs = await savedDiscoveryLimitArgs(context.command.homeDir);
     for (const repoRoot of roots) {
-        const args = ["sync", "--json", "--workspace", repoRoot];
+        const args = ["sync", "--json", "--workspace", repoRoot, ...discoveryArgs];
         if (context.command.dashboardUrl !== DEFAULT_DASHBOARD_URL) {
             args.push("--dashboard-url", context.command.dashboardUrl);
         }

package/dist/commands/local.js

@@ -16,6 +16,7 @@ import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.j
 import { backfillCompletionCovers, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { acquireSyncLock } from "../sync-lock.js";
 import { collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
+import { resolveDiscoveryLimits, saveDiscoveryLimits, } from "../discovery-limits.js";
 import { runAttributedWorktreeSync, matchesLiveSyncWorktree, } from "./session-sync.js";
 import { COLLECTION_ROOT_REQUIRED, missingCollectionRootMessage, normalizeRootsDetailed, resolveOnboardingRoots, rootRejectionExplanation, } from "../onboarding-roots.js";
 import { rawEvidenceGcSummary, runRawEvidenceLocalGc, } from "../raw-evidence-gc.js";
@@ -58,6 +59,10 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
         writeLine(io.stderr, localCommandHelp());
         return 1;
     }
+    // A limit typed on the command line is remembered for every later run,
+    // including the scheduled one nobody types into (BLI-2362). Done here so it
+    // applies to whichever command carried the flag.
+    await rememberDiscoveryLimits(command);
     try {
         switch (command.kind) {
             case "install":
@@ -1430,6 +1435,7 @@ async function runOnboard(command, io) {
         const worktrees = await discoverCommandWorktrees(collectionRoots, {
             maxDepth: command.maxDepth,
             maxRepos: command.maxRepos,
+            homeDir: command.homeDir,
             allowEmpty: true,
         }, io);
         if (worktrees.length > 1) {
@@ -1779,32 +1785,105 @@ function rawEvidenceSyncLine(sync) {
 function cursorStatusLine(sync) {
     return `Cursor: ${sync.cursor_tracked_object_count} durable object(s) tracked`;
 }
-const DEFAULT_DISCOVERY_MAX_DEPTH = 3;
-const DEFAULT_DISCOVERY_MAX_REPOS = 50;
 const ALL_SESSION_SCAN_WINDOW_MINUTES = 20 * 365 * 24 * 60;
 const SESSION_SCAN_OVERRIDE_LIMIT = 10_000;
 async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
-    const maxWorktrees = discovery.maxRepos ?? DEFAULT_DISCOVERY_MAX_REPOS;
+    // What the operator typed this run, else what they typed some previous run,
+    // else the built-in defaults (BLI-2362).
+    const limits = await resolveDiscoveryLimits(discovery, discovery.homeDir);
+    const maxWorktrees = limits.maxRepos;
     const roots = Array.isArray(repoRoot)
         ? repoRoot
         : [repoRoot ?? process.cwd()];
     const result = await discoverGitWorktreesInRootsWithStatus(roots, {
-        maxDepth: discovery.maxDepth ?? DEFAULT_DISCOVERY_MAX_DEPTH,
+        maxDepth: limits.maxDepth,
         maxWorktrees,
     });
+    if (io && result.unreadable_dirs.length > 0) {
+        // Never silently dropped: anything under these folders is missing from the
+        // scan, so say so even when the run otherwise succeeds.
+        writeLine(io.stderr, unreadableDirectoriesMessage(result.unreadable_dirs));
+    }
     const worktrees = result.worktrees;
     if (!result.complete) {
-        const reasons = result.incomplete_reasons.join(",");
-        if (io) {
-            writeLine(io.stderr, `BLOCKED: repo discovery is incomplete (${reasons}); no collection cursor was advanced.`);
-        }
-        throw new Error(`repo discovery incomplete: ${reasons}. Raise --max-depth or --max-repos until every approved-root repo is included.`);
+        // Sync fails closed here ON PURPOSE, and that is not the bug. Advancing a
+        // cursor after a partial scan would mark the run as covering repos it
+        // never saw, permanently skipping their sessions — backfill can tolerate
+        // partial only because it keeps per-scope completion markers, and sync
+        // does not. The bug (BLI-2362) was that the refusal named no roots and
+        // gave no runnable command, so a big workspace just stayed red forever.
+        const message = incompleteDiscoveryMessage({
+            result,
+            roots,
+            maxDepth: limits.maxDepth,
+            maxRepos: maxWorktrees,
+            found: worktrees.length,
+        });
+        if (io)
+            writeLine(io.stderr, message);
+        throw new Error(message);
     }
     if (worktrees.length === 0 && !discovery.allowEmpty) {
         throw new Error("No git repos found. Run from a git repo, or from a parent folder containing git repos.");
     }
     return worktrees;
 }
+/**
+ * Persists `--max-depth` / `--max-repos` when a command carried them, so the
+ * number survives into the background sync and the doctor's own sync — neither
+ * of which has anywhere to type one (BLI-2362). Best-effort: failing to record
+ * a preference must never fail the command the operator actually asked for.
+ */
+async function rememberDiscoveryLimits(command) {
+    const limits = command;
+    if (limits.maxDepth === undefined && limits.maxRepos === undefined)
+        return;
+    await saveDiscoveryLimits({ maxDepth: limits.maxDepth, maxRepos: limits.maxRepos }, limits.homeDir).catch(() => undefined);
+}
+/**
+ * Says which folders could not be opened, and therefore what the scan could not
+ * see. Reported without failing the run — an unreadable folder cannot be fixed
+ * by retrying, so blocking on one would strand the machine (BLI-2362).
+ */
+function unreadableDirectoriesMessage(unreadable) {
+    return [
+        `WARNING: ${unreadable.length} folder(s) could not be opened, so anything inside them was not scanned:`,
+        ...unreadable.map((dir) => `  ${dir.path} (${dir.code})`),
+        "Collection continued for everything else. If a repo is missing from Cockpit,",
+        "check the permissions on the folders above.",
+    ].join("\n");
+}
+/**
+ * Names the roots that could not be covered and hands back a command that
+ * actually fixes it, with this machine's numbers already filled in.
+ */
+function incompleteDiscoveryMessage(input) {
+    const { result, roots, maxDepth, maxRepos, found } = input;
+    const blocked = result.incomplete_roots.length > 0 ? result.incomplete_roots : roots;
+    const hitRepoCap = result.incomplete_reasons.includes("max_worktrees_reached");
+    const nextDepth = maxDepth + 3;
+    const nextRepos = Math.max(maxRepos * 2, found + 50);
+    const retry = [
+        "cockpit do-everything",
+        ...roots.map((root) => `--workspace ${root}`),
+        `--max-depth ${hitRepoCap ? maxDepth : nextDepth}`,
+        `--max-repos ${nextRepos}`,
+    ].join(" ");
+    return [
+        `Cockpit could not finish scanning for repos, so it stopped instead of collecting a partial picture (${result.incomplete_reasons.join(", ")}).`,
+        "It stops rather than continuing because a partial scan would mark these repos as already checked and skip them from now on.",
+        "",
+        "Could not fully scan:",
+        ...blocked.map((root) => `  ${root}`),
+        "",
+        `Found ${found} repo(s) before stopping, with --max-depth ${maxDepth} and --max-repos ${maxRepos}.`,
+        "",
+        "Run this to raise the limits and try again:",
+        `  ${retry}`,
+        "",
+        "If that still stops, the folder is deeper or larger than expected — raise the numbers again, or point --workspace at the specific project folders instead of a parent.",
+    ].join("\n");
+}
 async function runMultiRepoOnboard(command, io, worktrees) {
     if (!command.json) {
         writeLine(io.stdout, `3/5 Parent folder mode: discovered ${worktrees.length} git worktree(s).`);
@@ -1999,7 +2078,7 @@ async function runLogout(command, io) {
     return 0;
 }
 async function runStart(command, io) {
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
     if (worktrees.length > 1) {
         const contexts = await Promise.all(worktrees.map((worktree) => startLocalWorkContext({
             homeDir: command.homeDir,
@@ -2190,6 +2269,7 @@ async function runSyncLocked(command, io) {
     const worktrees = await discoverCommandWorktrees(collectionRoots, {
         maxDepth: command.maxDepth,
         maxRepos: command.maxRepos,
+        homeDir: command.homeDir,
         allowEmpty: true,
     }, io);
     const run = await runAttributedWorktreeSync({
@@ -2432,7 +2512,7 @@ async function runSyncRawEvidenceGc(command, io) {
 }
 async function runStatus(command, io) {
     const backfillCursor = await inspectBackfillCursor(command.homeDir);
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
     if (worktrees.length > 1) {
         const statuses = await Promise.all(worktrees.map(async (worktree) => ({
             ...(await inspectLocalCollectorStatus({
@@ -2663,7 +2743,7 @@ function sessionsWindowLine(window) {
 async function runSessions(command, io) {
     const now = new Date();
     const homeDir = command.homeDir ?? os.homedir();
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
     const window = await sessionsScanWindow(command, now);
     const wantCodex = command.source !== "claude";
     const wantClaude = command.source !== "codex";

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.10");
+    writeLine(io?.stdout ?? process.stdout, "0.2.12");
     return 0;
   }
 

package/dist/discovery-limits.js

@@ -0,0 +1,89 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { DEFAULT_DISCOVERY_MAX_DEPTH, DEFAULT_DISCOVERY_MAX_REPOS, } from "./repo-identity.js";
+import { getCollectorRuntimePaths } from "./local-state.js";
+const SCHEMA_VERSION = "cockpit-discovery-limits.v1";
+// A depth beyond this is a typo rather than a workspace, and an unbounded walk
+// on a huge tree is its own outage. Same for the repo cap.
+const MAX_ALLOWED_DEPTH = 64;
+const MAX_ALLOWED_REPOS = 5000;
+function discoveryLimitsFile(homeDir) {
+    return path.join(getCollectorRuntimePaths(homeDir).state_dir, "discovery-limits.json");
+}
+function sanitizeLimit(value, ceiling) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value))
+        return undefined;
+    if (value < 1 || value > ceiling)
+        return undefined;
+    return value;
+}
+/**
+ * Reads the remembered limits. Never throws: a corrupt file falls back to the
+ * defaults rather than taking collection down, because failing to read a tuning
+ * knob is not a reason to stop collecting.
+ */
+export async function readSavedDiscoveryLimits(homeDir = os.homedir()) {
+    try {
+        const raw = await fs.readFile(discoveryLimitsFile(homeDir), "utf8");
+        const parsed = JSON.parse(raw);
+        return {
+            max_depth: sanitizeLimit(parsed.max_depth, MAX_ALLOWED_DEPTH),
+            max_repos: sanitizeLimit(parsed.max_repos, MAX_ALLOWED_REPOS),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Remembers limits an operator passed explicitly. Only writes the ones actually
+ * supplied, so raising the depth does not quietly reset a repo cap someone set
+ * earlier for their own reasons.
+ */
+export async function saveDiscoveryLimits(limits, homeDir = os.homedir()) {
+    const maxDepth = sanitizeLimit(limits.maxDepth, MAX_ALLOWED_DEPTH);
+    const maxRepos = sanitizeLimit(limits.maxRepos, MAX_ALLOWED_REPOS);
+    if (maxDepth === undefined && maxRepos === undefined)
+        return;
+    const existing = await readSavedDiscoveryLimits(homeDir);
+    const next = {
+        schema_version: SCHEMA_VERSION,
+        max_depth: maxDepth ?? existing.max_depth,
+        max_repos: maxRepos ?? existing.max_repos,
+        updated_at: new Date().toISOString(),
+    };
+    const file = discoveryLimitsFile(homeDir);
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, `${JSON.stringify(next, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+/**
+ * The limits a scan should actually use: what the operator typed this run,
+ * else what they typed some previous run, else the built-in defaults.
+ */
+export async function resolveDiscoveryLimits(command, homeDir = os.homedir()) {
+    const saved = await readSavedDiscoveryLimits(homeDir);
+    return {
+        maxDepth: command.maxDepth ?? saved.max_depth ?? DEFAULT_DISCOVERY_MAX_DEPTH,
+        maxRepos: command.maxRepos ?? saved.max_repos ?? DEFAULT_DISCOVERY_MAX_REPOS,
+    };
+}
+/**
+ * The flags a generated background command needs so a scheduled run scans the
+ * same way an operator's manual run did. Empty when the machine is on the
+ * defaults, which keeps the common plist/Task Scheduler command unchanged.
+ */
+export async function savedDiscoveryLimitArgs(homeDir = os.homedir()) {
+    const saved = await readSavedDiscoveryLimits(homeDir);
+    const args = [];
+    if (saved.max_depth !== undefined) {
+        args.push("--max-depth", String(saved.max_depth));
+    }
+    if (saved.max_repos !== undefined) {
+        args.push("--max-repos", String(saved.max_repos));
+    }
+    return args;
+}

package/dist/repo-identity.js

@@ -16,6 +16,27 @@ const SKIPPED_DIR_NAMES = new Set([
     "node_modules",
     "out",
 ]);
+/**
+ * How deep discovery walks, and how many repos it will hold, when the caller
+ * names no limit. Both are the ONLY defaults — commands import these rather
+ * than declaring their own, because a second copy silently drifts.
+ *
+ * These are generous on purpose. Discovery stops descending the moment it sees
+ * a git marker and skips dot-dirs, `node_modules`, `dist` and friends, so the
+ * walk is bounded by plain folders rather than by repo contents: on a real
+ * workspace of 38 repos, depth 20 visited the same 308 directories in the same
+ * ~110ms as depth 6, because the tree simply ran out first. A limit that is too
+ * low is not merely slow — discovery fails closed, so every extra level costs
+ * nothing while every missing level costs the whole machine's collection.
+ */
+export const DEFAULT_DISCOVERY_MAX_DEPTH = 20;
+export const DEFAULT_DISCOVERY_MAX_REPOS = 200;
+/** Caps the reported list so one pathological tree cannot dominate a receipt. */
+const MAX_REPORTED_UNREADABLE_DIRS = 25;
+function errorCode(error) {
+    const code = error?.code;
+    return typeof code === "string" ? code : "UNKNOWN";
+}
 export async function resolveRepoWorktreeIdentity(repoRoot) {
     const requestedPath = path.resolve(repoRoot);
     const gitRoot = await runGit(["rev-parse", "--show-toplevel"], requestedPath);
@@ -62,18 +83,19 @@ export async function discoverGitWorktrees(root, options = {}) {
 export async function discoverGitWorktreesWithStatus(root, options = {}) {
     const resolvedRoot = path.resolve(root);
     const allowedRoots = [await stableWorktreeRoot(resolvedRoot)];
-    const maxWorktrees = Math.max(1, options.maxWorktrees ?? 50);
+    const maxWorktrees = Math.max(1, options.maxWorktrees ?? DEFAULT_DISCOVERY_MAX_REPOS);
     const direct = await resolveRepoWorktreeIdentity(resolvedRoot).catch(() => null);
     if (direct)
         return expandLinkedWorktrees([direct], maxWorktrees, allowedRoots);
     if (await hasGitMarker(resolvedRoot)) {
         return expandLinkedWorktrees([await fallbackFilesystemIdentity(resolvedRoot)], maxWorktrees, allowedRoots);
     }
-    const maxDepth = options.maxDepth ?? 2;
+    const maxDepth = options.maxDepth ?? DEFAULT_DISCOVERY_MAX_DEPTH;
     const discovered = new Map();
     const stack = [{ dir: resolvedRoot, depth: 0 }];
     const visited = new Set();
     const incompleteReasons = new Set();
+    const unreadableDirs = [];
     while (stack.length > 0) {
         if (discovered.size >= maxWorktrees) {
             incompleteReasons.add("max_worktrees_reached");
@@ -92,7 +114,18 @@ export async function discoverGitWorktreesWithStatus(root, options = {}) {
             discovered.set(identity.worktree_fingerprint, identity);
             continue;
         }
-        const entries = await fs.readdir(current.dir, { withFileTypes: true }).catch(() => []);
+        // A failed read is recorded, never swallowed: anything beneath this folder
+        // is missing from the scan, and the operator has to be able to see that.
+        let entries;
+        try {
+            entries = await fs.readdir(current.dir, { withFileTypes: true });
+        }
+        catch (error) {
+            if (unreadableDirs.length < MAX_REPORTED_UNREADABLE_DIRS) {
+                unreadableDirs.push({ path: current.dir, code: errorCode(error) });
+            }
+            continue;
+        }
         if (current.depth >= maxDepth) {
             if (entries.some((entry) => entry.isDirectory() && !shouldSkipDirectory(entry.name))) {
                 incompleteReasons.add("max_depth_reached");
@@ -113,6 +146,9 @@ export async function discoverGitWorktreesWithStatus(root, options = {}) {
         worktrees: expanded.worktrees,
         complete: incompleteReasons.size === 0,
         incomplete_reasons: [...incompleteReasons].sort(),
+        // Single-root scanner: the only root in play is the one it was handed.
+        incomplete_roots: incompleteReasons.size === 0 ? [] : [path.resolve(root)],
+        unreadable_dirs: unreadableDirs,
     };
 }
 /**
@@ -126,9 +162,11 @@ export async function discoverGitWorktreesInRoots(roots, options = {}) {
     return (await discoverGitWorktreesInRootsWithStatus(roots, options)).worktrees;
 }
 export async function discoverGitWorktreesInRootsWithStatus(roots, options = {}) {
-    const maxWorktrees = Math.max(1, options.maxWorktrees ?? 50);
+    const maxWorktrees = Math.max(1, options.maxWorktrees ?? DEFAULT_DISCOVERY_MAX_REPOS);
     const discovered = new Map();
     const incompleteReasons = new Set();
+    const incompleteRoots = new Set();
+    const unreadableDirs = [];
     for (const root of roots) {
         const result = await discoverGitWorktreesWithStatus(root, {
             ...options,
@@ -136,11 +174,20 @@ export async function discoverGitWorktreesInRootsWithStatus(roots, options = {})
         });
         for (const reason of result.incomplete_reasons) {
             incompleteReasons.add(reason);
+            incompleteRoots.add(root);
+        }
+        for (const dir of result.unreadable_dirs) {
+            if (unreadableDirs.length >= MAX_REPORTED_UNREADABLE_DIRS)
+                break;
+            unreadableDirs.push(dir);
         }
         for (const worktree of result.worktrees) {
             if (discovered.size >= maxWorktrees) {
                 if (!discovered.has(worktree.worktree_fingerprint)) {
                     incompleteReasons.add("max_worktrees_reached");
+                    // The cap is global, so the root being read when it filled up is the
+                    // one whose repos got dropped.
+                    incompleteRoots.add(root);
                 }
                 continue;
             }
@@ -151,6 +198,8 @@ export async function discoverGitWorktreesInRootsWithStatus(roots, options = {})
         worktrees: [...discovered.values()].sort(compareIdentity),
         complete: incompleteReasons.size === 0,
         incomplete_reasons: [...incompleteReasons].sort(),
+        incomplete_roots: [...incompleteRoots].sort(),
+        unreadable_dirs: unreadableDirs,
     };
 }
 /**
@@ -219,6 +268,12 @@ async function expandLinkedWorktrees(identities, maxWorktrees, allowedRoots) {
         worktrees,
         complete: incompleteReasons.length === 0,
         incomplete_reasons: incompleteReasons,
+        // Expansion asks git for its own worktree list; it never walks folders, so
+        // it has no unreadable directories of its own to report.
+        unreadable_dirs: [],
+        // Linked-worktree expansion is not scoped to one root; callers merge this
+        // into a result that already knows which roots were involved.
+        incomplete_roots: [],
     };
 }
 function isLinkedWorktreeWithinCollectionScope(linked, discoveredFromApprovedRoots, allowedRoots) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "private": false,
   "type": "module",
   "bin": {
@@ -26,6 +26,6 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/telemetry-core": "0.1.15"
+    "@bli-cockpit/telemetry-core": "0.1.16"
   }
 }