@bli-cockpit/cli 0.2.11 → 0.2.12

package/dist/autostart.js

@@ -2,6 +2,7 @@ import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "./local-state.js";
+import { savedDiscoveryLimitArgs } from "./discovery-limits.js";
 /** launchd LaunchAgent label; matches docs/runbooks/cockpit-launchd-sync.md. */
 export const AUTOSTART_LABEL = "com.bli.cockpit.sync";
 export const WINDOWS_AUTOSTART_TASK_NAME = "BLI Cockpit Sync";
@@ -53,6 +54,7 @@ export async function installAutostartAgent(options) {
     await mkdir(path.dirname(plistPath), { recursive: true });
     await mkdir(paths.state_dir, { recursive: true });
     await writeFile(plistPath, renderPlist({
+        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
         workDir,
         workDirs: resolvedWorkDirs,
         dashboardUrl,
@@ -127,6 +129,7 @@ export async function autostartStatus(options) {
     const cliEntryPoint = path.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
     const plist = await readFile(plistPath, "utf8").catch(() => "");
     const registrationProblems = darwinAgentRegistrationProblems(plist, {
+        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
         workDirs: resolvedWorkDirs,
         dashboardUrl,
         intervalSeconds,
@@ -165,6 +168,7 @@ async function installWindowsTask(options) {
     const cliEntryPoint = path.win32.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
     await mkdir(path.dirname(scriptPath), { recursive: true });
     await writeFile(scriptPath, `${UTF8_BOM}${renderWindowsSyncScript({
+        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
         workDirs: resolvedWorkDirs,
         dashboardUrl,
         nodeExecutable,
@@ -290,6 +294,7 @@ async function windowsTaskStatus(options) {
     }
     else if (options.repoRoots && options.repoRoots.length > 0) {
         const expectedScript = `${UTF8_BOM}${renderWindowsSyncScript({
+            discoveryArgs: await savedDiscoveryLimitArgs(options.homeDir),
             workDirs: normalizeWindowsWorkDirs(options.repoRoots),
             dashboardUrl: options.dashboardUrl ?? DEFAULT_DASHBOARD_URL,
             nodeExecutable: path.win32.resolve(options.nodeExecutable ?? process.execPath),
@@ -337,9 +342,10 @@ function renderWindowsSyncScript(options) {
     const dashboardArgs = options.dashboardUrl === DEFAULT_DASHBOARD_URL
         ? ""
         : ` --dashboard-url ${powershellLiteral(options.dashboardUrl)}`;
+    const discoveryArgs = options.discoveryArgs.length > 0 ? ` ${options.discoveryArgs.join(" ")}` : "";
     const commands = options.workDirs.flatMap((root) => [
         "try {",
-        `  & $nodeExecutable $cliEntryPoint sync --workspace ${powershellLiteral(root)}${dashboardArgs} --json`,
+        `  & $nodeExecutable $cliEntryPoint sync --workspace ${powershellLiteral(root)}${dashboardArgs}${discoveryArgs} --json`,
         "  if ($LASTEXITCODE -ne 0) { $exitCode = $LASTEXITCODE }",
         "} catch {",
         "  [Console]::Error.WriteLine($_.Exception.Message)",
@@ -532,6 +538,7 @@ function renderPlist(options) {
         dashboardUrl: options.dashboardUrl,
         nodeExecutable: options.nodeExecutable,
         cliEntryPoint: options.cliEntryPoint,
+        discoveryArgs: options.discoveryArgs,
     });
     return [
         '<?xml version="1.0" encoding="UTF-8"?>',
@@ -569,7 +576,8 @@ function renderDarwinSyncCommand(options) {
     const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
         ? ""
         : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
-    const commands = options.workDirs.map((root) => `${shellQuote(options.nodeExecutable)} ${shellQuote(options.cliEntryPoint)} sync --workspace ${shellQuote(root)}${dashboardArg} --json || exit_code=1`);
+    const discoveryArg = options.discoveryArgs.length > 0 ? ` ${options.discoveryArgs.join(" ")}` : "";
+    const commands = options.workDirs.map((root) => `${shellQuote(options.nodeExecutable)} ${shellQuote(options.cliEntryPoint)} sync --workspace ${shellQuote(root)}${dashboardArg}${discoveryArg} --json || exit_code=1`);
     return ["exit_code=0", ...commands, 'exit "$exit_code"'].join("; ");
 }
 function darwinAgentRegistrationProblems(plist, expected) {
@@ -583,6 +591,7 @@ function darwinAgentRegistrationProblems(plist, expected) {
         problems.push(`cadence is not ${expected.intervalSeconds} seconds`);
     }
     const expectedCommand = renderDarwinSyncCommand({
+        discoveryArgs: expected.discoveryArgs,
         workDirs: expected.workDirs,
         dashboardUrl: expected.dashboardUrl,
         nodeExecutable: expected.nodeExecutable,

package/dist/commands/doctor.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { autostartStatus, installAutostartAgent } from "../autostart.js";
+import { savedDiscoveryLimitArgs } from "../discovery-limits.js";
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { backfillCompletionCovers, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
@@ -314,8 +315,12 @@ async function fixSyncState(context) {
     if (roots.length === 0) {
         return fail("sync-fresh", "no_roots", "sync has no saved workspace roots");
     }
+    // The remembered limits have to ride along, or the doctor's own verification
+    // sync scans differently from every other run and can fail closed on a
+    // machine the operator already fixed by hand (BLI-2362).
+    const discoveryArgs = await savedDiscoveryLimitArgs(context.command.homeDir);
     for (const repoRoot of roots) {
-        const args = ["sync", "--json", "--workspace", repoRoot];
+        const args = ["sync", "--json", "--workspace", repoRoot, ...discoveryArgs];
         if (context.command.dashboardUrl !== DEFAULT_DASHBOARD_URL) {
             args.push("--dashboard-url", context.command.dashboardUrl);
         }

package/dist/commands/local.js

@@ -15,7 +15,8 @@ import { CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT, CODEX_ATTRIBUTION_SCAN_WIN
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
 import { backfillCompletionCovers, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { acquireSyncLock } from "../sync-lock.js";
-import { DEFAULT_DISCOVERY_MAX_DEPTH, DEFAULT_DISCOVERY_MAX_REPOS, collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
+import { collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
+import { resolveDiscoveryLimits, saveDiscoveryLimits, } from "../discovery-limits.js";
 import { runAttributedWorktreeSync, matchesLiveSyncWorktree, } from "./session-sync.js";
 import { COLLECTION_ROOT_REQUIRED, missingCollectionRootMessage, normalizeRootsDetailed, resolveOnboardingRoots, rootRejectionExplanation, } from "../onboarding-roots.js";
 import { rawEvidenceGcSummary, runRawEvidenceLocalGc, } from "../raw-evidence-gc.js";
@@ -58,6 +59,10 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
         writeLine(io.stderr, localCommandHelp());
         return 1;
     }
+    // A limit typed on the command line is remembered for every later run,
+    // including the scheduled one nobody types into (BLI-2362). Done here so it
+    // applies to whichever command carried the flag.
+    await rememberDiscoveryLimits(command);
     try {
         switch (command.kind) {
             case "install":
@@ -1430,6 +1435,7 @@ async function runOnboard(command, io) {
         const worktrees = await discoverCommandWorktrees(collectionRoots, {
             maxDepth: command.maxDepth,
             maxRepos: command.maxRepos,
+            homeDir: command.homeDir,
             allowEmpty: true,
         }, io);
         if (worktrees.length > 1) {
@@ -1782,14 +1788,22 @@ function cursorStatusLine(sync) {
 const ALL_SESSION_SCAN_WINDOW_MINUTES = 20 * 365 * 24 * 60;
 const SESSION_SCAN_OVERRIDE_LIMIT = 10_000;
 async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
-    const maxWorktrees = discovery.maxRepos ?? DEFAULT_DISCOVERY_MAX_REPOS;
+    // What the operator typed this run, else what they typed some previous run,
+    // else the built-in defaults (BLI-2362).
+    const limits = await resolveDiscoveryLimits(discovery, discovery.homeDir);
+    const maxWorktrees = limits.maxRepos;
     const roots = Array.isArray(repoRoot)
         ? repoRoot
         : [repoRoot ?? process.cwd()];
     const result = await discoverGitWorktreesInRootsWithStatus(roots, {
-        maxDepth: discovery.maxDepth ?? DEFAULT_DISCOVERY_MAX_DEPTH,
+        maxDepth: limits.maxDepth,
         maxWorktrees,
     });
+    if (io && result.unreadable_dirs.length > 0) {
+        // Never silently dropped: anything under these folders is missing from the
+        // scan, so say so even when the run otherwise succeeds.
+        writeLine(io.stderr, unreadableDirectoriesMessage(result.unreadable_dirs));
+    }
     const worktrees = result.worktrees;
     if (!result.complete) {
         // Sync fails closed here ON PURPOSE, and that is not the bug. Advancing a
@@ -1801,7 +1815,7 @@ async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
         const message = incompleteDiscoveryMessage({
             result,
             roots,
-            maxDepth: discovery.maxDepth ?? DEFAULT_DISCOVERY_MAX_DEPTH,
+            maxDepth: limits.maxDepth,
             maxRepos: maxWorktrees,
             found: worktrees.length,
         });
@@ -1814,6 +1828,31 @@ async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
     }
     return worktrees;
 }
+/**
+ * Persists `--max-depth` / `--max-repos` when a command carried them, so the
+ * number survives into the background sync and the doctor's own sync — neither
+ * of which has anywhere to type one (BLI-2362). Best-effort: failing to record
+ * a preference must never fail the command the operator actually asked for.
+ */
+async function rememberDiscoveryLimits(command) {
+    const limits = command;
+    if (limits.maxDepth === undefined && limits.maxRepos === undefined)
+        return;
+    await saveDiscoveryLimits({ maxDepth: limits.maxDepth, maxRepos: limits.maxRepos }, limits.homeDir).catch(() => undefined);
+}
+/**
+ * Says which folders could not be opened, and therefore what the scan could not
+ * see. Reported without failing the run — an unreadable folder cannot be fixed
+ * by retrying, so blocking on one would strand the machine (BLI-2362).
+ */
+function unreadableDirectoriesMessage(unreadable) {
+    return [
+        `WARNING: ${unreadable.length} folder(s) could not be opened, so anything inside them was not scanned:`,
+        ...unreadable.map((dir) => `  ${dir.path} (${dir.code})`),
+        "Collection continued for everything else. If a repo is missing from Cockpit,",
+        "check the permissions on the folders above.",
+    ].join("\n");
+}
 /**
  * Names the roots that could not be covered and hands back a command that
  * actually fixes it, with this machine's numbers already filled in.
@@ -2039,7 +2078,7 @@ async function runLogout(command, io) {
     return 0;
 }
 async function runStart(command, io) {
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
     if (worktrees.length > 1) {
         const contexts = await Promise.all(worktrees.map((worktree) => startLocalWorkContext({
             homeDir: command.homeDir,
@@ -2230,6 +2269,7 @@ async function runSyncLocked(command, io) {
     const worktrees = await discoverCommandWorktrees(collectionRoots, {
         maxDepth: command.maxDepth,
         maxRepos: command.maxRepos,
+        homeDir: command.homeDir,
         allowEmpty: true,
     }, io);
     const run = await runAttributedWorktreeSync({
@@ -2472,7 +2512,7 @@ async function runSyncRawEvidenceGc(command, io) {
 }
 async function runStatus(command, io) {
     const backfillCursor = await inspectBackfillCursor(command.homeDir);
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
     if (worktrees.length > 1) {
         const statuses = await Promise.all(worktrees.map(async (worktree) => ({
             ...(await inspectLocalCollectorStatus({
@@ -2703,7 +2743,7 @@ function sessionsWindowLine(window) {
 async function runSessions(command, io) {
     const now = new Date();
     const homeDir = command.homeDir ?? os.homedir();
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
     const window = await sessionsScanWindow(command, now);
     const wantCodex = command.source !== "claude";
     const wantClaude = command.source !== "codex";

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.11");
+    writeLine(io?.stdout ?? process.stdout, "0.2.12");
     return 0;
   }
 

package/dist/discovery-limits.js

@@ -0,0 +1,89 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { DEFAULT_DISCOVERY_MAX_DEPTH, DEFAULT_DISCOVERY_MAX_REPOS, } from "./repo-identity.js";
+import { getCollectorRuntimePaths } from "./local-state.js";
+const SCHEMA_VERSION = "cockpit-discovery-limits.v1";
+// A depth beyond this is a typo rather than a workspace, and an unbounded walk
+// on a huge tree is its own outage. Same for the repo cap.
+const MAX_ALLOWED_DEPTH = 64;
+const MAX_ALLOWED_REPOS = 5000;
+function discoveryLimitsFile(homeDir) {
+    return path.join(getCollectorRuntimePaths(homeDir).state_dir, "discovery-limits.json");
+}
+function sanitizeLimit(value, ceiling) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value))
+        return undefined;
+    if (value < 1 || value > ceiling)
+        return undefined;
+    return value;
+}
+/**
+ * Reads the remembered limits. Never throws: a corrupt file falls back to the
+ * defaults rather than taking collection down, because failing to read a tuning
+ * knob is not a reason to stop collecting.
+ */
+export async function readSavedDiscoveryLimits(homeDir = os.homedir()) {
+    try {
+        const raw = await fs.readFile(discoveryLimitsFile(homeDir), "utf8");
+        const parsed = JSON.parse(raw);
+        return {
+            max_depth: sanitizeLimit(parsed.max_depth, MAX_ALLOWED_DEPTH),
+            max_repos: sanitizeLimit(parsed.max_repos, MAX_ALLOWED_REPOS),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Remembers limits an operator passed explicitly. Only writes the ones actually
+ * supplied, so raising the depth does not quietly reset a repo cap someone set
+ * earlier for their own reasons.
+ */
+export async function saveDiscoveryLimits(limits, homeDir = os.homedir()) {
+    const maxDepth = sanitizeLimit(limits.maxDepth, MAX_ALLOWED_DEPTH);
+    const maxRepos = sanitizeLimit(limits.maxRepos, MAX_ALLOWED_REPOS);
+    if (maxDepth === undefined && maxRepos === undefined)
+        return;
+    const existing = await readSavedDiscoveryLimits(homeDir);
+    const next = {
+        schema_version: SCHEMA_VERSION,
+        max_depth: maxDepth ?? existing.max_depth,
+        max_repos: maxRepos ?? existing.max_repos,
+        updated_at: new Date().toISOString(),
+    };
+    const file = discoveryLimitsFile(homeDir);
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, `${JSON.stringify(next, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+/**
+ * The limits a scan should actually use: what the operator typed this run,
+ * else what they typed some previous run, else the built-in defaults.
+ */
+export async function resolveDiscoveryLimits(command, homeDir = os.homedir()) {
+    const saved = await readSavedDiscoveryLimits(homeDir);
+    return {
+        maxDepth: command.maxDepth ?? saved.max_depth ?? DEFAULT_DISCOVERY_MAX_DEPTH,
+        maxRepos: command.maxRepos ?? saved.max_repos ?? DEFAULT_DISCOVERY_MAX_REPOS,
+    };
+}
+/**
+ * The flags a generated background command needs so a scheduled run scans the
+ * same way an operator's manual run did. Empty when the machine is on the
+ * defaults, which keeps the common plist/Task Scheduler command unchanged.
+ */
+export async function savedDiscoveryLimitArgs(homeDir = os.homedir()) {
+    const saved = await readSavedDiscoveryLimits(homeDir);
+    const args = [];
+    if (saved.max_depth !== undefined) {
+        args.push("--max-depth", String(saved.max_depth));
+    }
+    if (saved.max_repos !== undefined) {
+        args.push("--max-repos", String(saved.max_repos));
+    }
+    return args;
+}

package/dist/repo-identity.js

@@ -31,6 +31,12 @@ const SKIPPED_DIR_NAMES = new Set([
  */
 export const DEFAULT_DISCOVERY_MAX_DEPTH = 20;
 export const DEFAULT_DISCOVERY_MAX_REPOS = 200;
+/** Caps the reported list so one pathological tree cannot dominate a receipt. */
+const MAX_REPORTED_UNREADABLE_DIRS = 25;
+function errorCode(error) {
+    const code = error?.code;
+    return typeof code === "string" ? code : "UNKNOWN";
+}
 export async function resolveRepoWorktreeIdentity(repoRoot) {
     const requestedPath = path.resolve(repoRoot);
     const gitRoot = await runGit(["rev-parse", "--show-toplevel"], requestedPath);
@@ -89,6 +95,7 @@ export async function discoverGitWorktreesWithStatus(root, options = {}) {
     const stack = [{ dir: resolvedRoot, depth: 0 }];
     const visited = new Set();
     const incompleteReasons = new Set();
+    const unreadableDirs = [];
     while (stack.length > 0) {
         if (discovered.size >= maxWorktrees) {
             incompleteReasons.add("max_worktrees_reached");
@@ -107,7 +114,18 @@ export async function discoverGitWorktreesWithStatus(root, options = {}) {
             discovered.set(identity.worktree_fingerprint, identity);
             continue;
         }
-        const entries = await fs.readdir(current.dir, { withFileTypes: true }).catch(() => []);
+        // A failed read is recorded, never swallowed: anything beneath this folder
+        // is missing from the scan, and the operator has to be able to see that.
+        let entries;
+        try {
+            entries = await fs.readdir(current.dir, { withFileTypes: true });
+        }
+        catch (error) {
+            if (unreadableDirs.length < MAX_REPORTED_UNREADABLE_DIRS) {
+                unreadableDirs.push({ path: current.dir, code: errorCode(error) });
+            }
+            continue;
+        }
         if (current.depth >= maxDepth) {
             if (entries.some((entry) => entry.isDirectory() && !shouldSkipDirectory(entry.name))) {
                 incompleteReasons.add("max_depth_reached");
@@ -130,6 +148,7 @@ export async function discoverGitWorktreesWithStatus(root, options = {}) {
         incomplete_reasons: [...incompleteReasons].sort(),
         // Single-root scanner: the only root in play is the one it was handed.
         incomplete_roots: incompleteReasons.size === 0 ? [] : [path.resolve(root)],
+        unreadable_dirs: unreadableDirs,
     };
 }
 /**
@@ -147,6 +166,7 @@ export async function discoverGitWorktreesInRootsWithStatus(roots, options = {})
     const discovered = new Map();
     const incompleteReasons = new Set();
     const incompleteRoots = new Set();
+    const unreadableDirs = [];
     for (const root of roots) {
         const result = await discoverGitWorktreesWithStatus(root, {
             ...options,
@@ -156,6 +176,11 @@ export async function discoverGitWorktreesInRootsWithStatus(roots, options = {})
             incompleteReasons.add(reason);
             incompleteRoots.add(root);
         }
+        for (const dir of result.unreadable_dirs) {
+            if (unreadableDirs.length >= MAX_REPORTED_UNREADABLE_DIRS)
+                break;
+            unreadableDirs.push(dir);
+        }
         for (const worktree of result.worktrees) {
             if (discovered.size >= maxWorktrees) {
                 if (!discovered.has(worktree.worktree_fingerprint)) {
@@ -174,6 +199,7 @@ export async function discoverGitWorktreesInRootsWithStatus(roots, options = {})
         complete: incompleteReasons.size === 0,
         incomplete_reasons: [...incompleteReasons].sort(),
         incomplete_roots: [...incompleteRoots].sort(),
+        unreadable_dirs: unreadableDirs,
     };
 }
 /**
@@ -242,6 +268,9 @@ async function expandLinkedWorktrees(identities, maxWorktrees, allowedRoots) {
         worktrees,
         complete: incompleteReasons.length === 0,
         incomplete_reasons: incompleteReasons,
+        // Expansion asks git for its own worktree list; it never walks folders, so
+        // it has no unreadable directories of its own to report.
+        unreadable_dirs: [],
         // Linked-worktree expansion is not scoped to one root; callers merge this
         // into a result that already knows which roots were involved.
         incomplete_roots: [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "private": false,
   "type": "module",
   "bin": {
@@ -26,6 +26,6 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/telemetry-core": "0.1.15"
+    "@bli-cockpit/telemetry-core": "0.1.16"
   }
 }