@bli-cockpit/cli 0.2.119 → 0.2.122

package/dist/commands/memory-install-contract.js

@@ -49,6 +49,12 @@
  * machine resolved before anything is written. Skipping that step registered
  * three hooks that answered `command not found` on every turn.
  *
+ * **And the path it is re-pointed at is written for a SHELL, not for the
+ * filesystem** — `shellSafeBinPath`. A hook command is a shell string, Windows
+ * runs it through bash, and a native path's backslashes are eaten as escapes:
+ * the same three hooks, the same `command not found`, arrived at from the other
+ * direction (BLI-4136).
+ *
  * Nothing here touches the filesystem. The halves that do are
  * `memory-install-claude.ts` and `memory-install-codex.ts`.
  */
@@ -96,16 +102,56 @@ export const MEMORY_AUTO_APPROVE_TOOLS = [
 ];
 /** Characters that would let a resolved path change the meaning of a hook command string. */
 const UNSAFE_PATH_CHARACTERS = /["'`$;&|<>\r\n]/u;
+/**
+ * Windows device paths — `\\?\C:\…` (extended length) and `\\.\…` (device
+ * namespace). Both prefixes are DEFINED in terms of backslashes and stop being
+ * that prefix the moment `shellSafeBinPath` turns them into forward slashes, so
+ * a hook command cannot carry one without silently naming a different file.
+ * Refused with a name rather than rewritten into something plausible.
+ */
+const WINDOWS_DEVICE_PATH = /^\\\\[?.]\\/u;
 export function isUnsafeBinPath(binPath) {
-    return UNSAFE_PATH_CHARACTERS.test(binPath);
+    return UNSAFE_PATH_CHARACTERS.test(binPath) || WINDOWS_DEVICE_PATH.test(binPath);
 }
 /**
- * A Claude Code hook `command` is a shell string by the platform's design, so
- * the only defence is quoting — and a path that could not be quoted safely is
- * refused upstream (see `resolveMemoryMcpBin`) rather than escaped cleverly.
+ * A path that no shell gives a meaning to, so it needs no quoting. Deliberately
+ * a tight allow-list rather than a list of known-bad characters: `(` and `)` in
+ * `C:/Program Files (x86)/…` are a bash syntax error, and the earlier
+ * whitespace-only trigger caught them only by the accident of the space.
+ */
+const PLAINLY_SAFE_PATH = /^[A-Za-z0-9_@:./+,-]+$/u;
+/**
+ * The resolved bin path, as it must appear INSIDE a hook command string.
+ *
+ * A Claude Code hook `command` is a shell string by the platform's design, and
+ * on Windows the host runs it through **bash** — which eats every backslash as
+ * an escape. So the native path this installer resolved,
+ * `C:\Users\…\.bin\bli-memory-mcp.cmd`, reaches the shell as
+ * `C:Users….binbli-memory-mcp.cmd` and answers `command not found` on every
+ * SessionStart, every prompt and every Stop. Non-blocking and therefore silent:
+ * memory recall simply degrades, and nothing says so (BLI-4136, fixed by hand
+ * twice on the same machine before the installer was the thing that changed).
+ *
+ * Two independent defences, because either one alone is a thin edge:
+ *
+ *  1. **Separators are normalised to `/` on Windows.** Win32 accepts forward
+ *     slashes in every path it resolves, and after this there is no escape
+ *     character left in the string for a shell to consume. This is also what
+ *     survives a `\\`: double-quoting ALONE would collapse the UNC prefix of
+ *     `\\server\share\…` back to one backslash and name the wrong path.
+ *  2. **Anything not plainly safe is double-quoted**, which covers spaces and
+ *     the bracket characters in `Program Files (x86)`.
+ *
+ * A path that still could not be expressed safely is refused upstream
+ * (`isUnsafeBinPath`, checked in `resolveMemoryConfig`) rather than escaped
+ * cleverly.
+ *
+ * POSIX keeps its separators untouched — a backslash there is a legal
+ * character in a filename, and rewriting it would name a different file.
  */
-export function shellQuoteBinPath(binPath) {
-    return /\s/u.test(binPath) ? `"${binPath}"` : binPath;
+export function shellSafeBinPath(binPath, platform) {
+    const forShell = platform === "win32" ? binPath.replace(/\\/gu, "/") : binPath;
+    return PLAINLY_SAFE_PATH.test(forShell) ? forShell : `"${forShell}"`;
 }
 /**
  * Windows cannot spawn an npm `.cmd` shim directly — Node refuses it without a
@@ -125,13 +171,13 @@ export function memoryMcpServerEntry(options) {
     return { command: options.binPath, args: [], env };
 }
 export function builtinMemoryInstallConfig(options) {
-    const quoted = shellQuoteBinPath(options.binPath);
+    const binPath = shellSafeBinPath(options.binPath, options.platform);
     return {
         server_id: MEMORY_MCP_SERVER_ID,
         mcp_server: memoryMcpServerEntry(options),
         hooks: MEMORY_HOOK_EVENTS.map((event) => ({
             event,
-            command: `${quoted} ${MEMORY_HOOK_SUBCOMMAND[event]}`,
+            command: `${binPath} ${MEMORY_HOOK_SUBCOMMAND[event]}`,
             timeout_seconds: MEMORY_HOOK_TIMEOUT_SECONDS[event],
         })),
         permissions_allow: [...MEMORY_AUTO_APPROVE_TOOLS],
@@ -237,13 +283,13 @@ export function parsePrintedMemoryInstallConfig(stdout) {
  * hook that runs something else.
  */
 export function withResolvedBinPath(config, options) {
-    const quoted = shellQuoteBinPath(options.binPath);
+    const binPath = shellSafeBinPath(options.binPath, options.platform);
     const hooks = [];
     for (const hook of config.hooks) {
         const tail = hookSubcommandTail(hook.command);
         if (!tail)
             return null;
-        hooks.push({ ...hook, command: `${quoted} ${tail}` });
+        hooks.push({ ...hook, command: `${binPath} ${tail}` });
     }
     const entry = memoryMcpServerEntry(options);
     return {

package/dist/commands/memory-install-report.js

@@ -83,17 +83,7 @@ export function logMemoryOutcome(outcome, platform) {
         : "[memory-install] BLI Memory registration converged", JSON.stringify(fields));
 }
 export function memoryOutcomeLines(outcome) {
-    const headline = outcome.status === "installed"
-        ? "BLI Memory registered on this machine."
-        : outcome.status === "already"
-            ? "BLI Memory is already registered on this machine."
-            : outcome.status === "would_install"
-                ? "BLI Memory would be registered (dry run; nothing was written)."
-                : outcome.status === "missing"
-                    ? "BLI Memory is not registered on this machine."
-                    : outcome.status === "skipped"
-                        ? "BLI Memory was not registered and nothing was written: the bli-memory-mcp server is not on this machine yet."
-                        : `BLI Memory is not fully registered: ${outcome.reason}.`;
+    const headline = memoryOutcomeHeadline(outcome);
     const lines = [headline, `  ${memoryReceiptLine(outcome.receipt)}`];
     // BLI-3884. Only `status` asks; an absent reading is not printed as "no
     // daemon", because nothing looked.
@@ -115,4 +105,19 @@ export function memoryOutcomeLines(outcome) {
         lines.push(`  ${target.target}: ${target.status} (${target.reason})${where}${detail}`);
     }
     return lines;
+}
+function memoryOutcomeHeadline(outcome) {
+    if (outcome.status === "installed")
+        return "BLI Memory registered on this machine.";
+    if (outcome.status === "already")
+        return "BLI Memory is already registered on this machine.";
+    if (outcome.status === "would_install") {
+        return "BLI Memory would be registered (dry run; nothing was written).";
+    }
+    if (outcome.status === "missing")
+        return "BLI Memory is not registered on this machine.";
+    if (outcome.status === "skipped") {
+        return "BLI Memory was not registered and nothing was written: the bli-memory-mcp server is not on this machine yet.";
+    }
+    return `BLI Memory is not fully registered: ${outcome.reason}.`;
 }

package/dist/commands/memory-install-skills.js

@@ -13,16 +13,6 @@
  * install is idempotent to the byte and a drifted copy is replaced rather than
  * merged — the same deal `cockpit agent-rules` offers for its managed block.
  */
-/** Relative path → exact file contents. The map IS the install. */
-export function memoryCodexSkillFiles() {
-    return {
-        "SKILL.md": SKILL_MD,
-        "references/search.md": SEARCH_MD,
-        "references/save.md": SAVE_MD,
-        "references/update.md": UPDATE_MD,
-        "references/forget.md": FORGET_MD,
-    };
-}
 const SKILL_MD = `---
 name: bli-memory
 description: BLI Memory — durable memory for this machine. Use when you need to recall what was decided before, or when a session produced a durable decision, preference or correction worth keeping.
@@ -118,4 +108,14 @@ again. Matching by content is exact after whitespace normalisation — never
 fuzzy, and never widened to every container.
 
 It returns what it removed. A bare "done" is not an answer.
-`;
+`;
+/** Relative path → exact file contents. The map IS the install. */
+export function memoryCodexSkillFiles() {
+    return {
+        "SKILL.md": SKILL_MD,
+        "references/search.md": SEARCH_MD,
+        "references/save.md": SAVE_MD,
+        "references/update.md": UPDATE_MD,
+        "references/forget.md": FORGET_MD,
+    };
+}

package/dist/commands/memory-log.js

@@ -5,20 +5,37 @@ import { callTower, openTower } from "./tower-command.js";
 function sender(command, io) {
     return async (entry) => {
         const tower = await openTower("memory log", command, io);
-        const result = await callTower(tower, { path: "/api/memory/experience", method: "POST", body: entry, label: "memory experience", timeoutMs: 5000 });
-        return result.ok ? { ok: result.body?.ok === true, reason: "experience_not_acknowledged" } : result;
+        const result = await callTower(tower, {
+            path: "/api/memory/experience",
+            method: "POST",
+            body: entry,
+            label: "memory experience",
+            timeoutMs: 5000,
+        });
+        return result.ok
+            ? {
+                ok: result.body?.ok === true,
+                reason: "experience_not_acknowledged",
+            }
+            : result;
     };
 }
 export async function runMemoryLog(command, io) {
-    const reason = command.reasonStdin ? (await readPipedText(io.stdin, { maxChars: 1002 })).trim() : command.reason;
+    const reason = command.reasonStdin
+        ? (await readPipedText(io.stdin, { maxChars: 1002 })).trim()
+        : command.reason;
     validateExperience(command.store, command.verdict, reason);
     const entry = await appendExperience({ store: command.store, verdict: command.verdict, reason }, {
-        homeDir: command.homeDir, agent: "cockpit", project: path.basename(process.cwd()),
+        homeDir: command.homeDir,
+        agent: "cockpit",
+        project: path.basename(process.cwd()),
     });
     const delivery = await shipExperience(entry, sender(command, io), command.homeDir);
     const receipt = { ok: true, id: entry.id, local: true, ...delivery };
     writeLine(io.stderr, `[memory experience] recorded ${JSON.stringify(receipt)}`);
-    writeLine(io.stdout, command.json ? JSON.stringify(receipt) : `Experience appended; shipped: ${delivery.shipped} (${delivery.reason}).`);
+    writeLine(io.stdout, command.json
+        ? JSON.stringify(receipt)
+        : `Experience appended; shipped: ${delivery.shipped} (${delivery.reason}).`);
     return 0;
 }
 export async function runMemoryExperienceAfterSync(command, io) {

package/dist/commands/msg.js

@@ -220,16 +220,23 @@ async function createChannel(command, door) {
     const membersAdded = body.members_added ?? [];
     const membersFailed = body.members_failed ?? [];
     const requestedMembers = command.memberEmails?.length ?? 0;
+    logChannelCreation(door, channel, command.isPrivate, requestedMembers, membersAdded, membersFailed);
+    if (door.json) {
+        return emitAgentDoor(door, { ok: true, channel, membersAdded, membersFailed });
+    }
+    reportChannelCreationToHuman(door, channel, name, requestedMembers, membersAdded, membersFailed);
+    return 0;
+}
+function logChannelCreation(door, channel, isPrivate, requestedMembers, membersAdded, membersFailed) {
     writeLine(door.io.stderr, `${TAG} created ${JSON.stringify({
         channel_id: channel?.id ?? null,
-        is_private: command.isPrivate,
+        is_private: isPrivate,
         members_requested: requestedMembers,
         members_added: membersAdded.length,
         members_failed: membersFailed.length,
     })}`);
-    if (door.json) {
-        return emitAgentDoor(door, { ok: true, channel, membersAdded, membersFailed });
-    }
+}
+function reportChannelCreationToHuman(door, channel, name, requestedMembers, membersAdded, membersFailed) {
     writeLine(door.io.stdout, `Created #${channel?.name ?? name} (${channel?.id ?? "?"}).`);
     if (membersAdded.length > 0) {
         writeLine(door.io.stdout, `${membersAdded.length} member(s) added.`);
@@ -246,7 +253,6 @@ async function createChannel(command, door) {
     for (const failure of membersFailed) {
         writeLine(door.io.stdout, `Not added (${failure.reason}): ${failure.userId}`);
     }
-    return 0;
 }
 async function openDm(command, door) {
     const email = command.dmEmail ?? "";

package/dist/commands/onboard-setup.js

@@ -57,6 +57,13 @@ export async function pairForOnboarding(command, input, installEvents, io) {
         repoRoot: input.primaryRoot,
         branch: command.branch,
     });
+    if (await reuseInstalledOnboardSession(command, input, installedStatus, installEvents, io)) {
+        return null;
+    }
+    await logOutMismatchedOnboardSession(command, installedStatus, io);
+    return await pairOnboardDevice(command, input, installEvents, io);
+}
+async function reuseInstalledOnboardSession(command, input, installedStatus, installEvents, io) {
     const installedSession = await readOnboardSessionReuseCandidate(command.homeDir);
     const canReuseInstalledSession = canReuseOnboardSession(installedSession, input.claimedOwnerEmail, command.dashboardUrl);
     if (installedStatus.session_state === "valid" && canReuseInstalledSession) {
@@ -65,14 +72,19 @@ export async function pairForOnboarding(command, input, installEvents, io) {
         if (!command.json) {
             writeLine(io.stdout, "2/5 Existing valid device session found; pairing skipped.");
         }
-        return null;
+        return true;
     }
+    return false;
+}
+async function logOutMismatchedOnboardSession(command, installedStatus, io) {
     if (installedStatus.session_state === "valid") {
         await logoutLocalCollector({ homeDir: command.homeDir });
         if (!command.json) {
             writeLine(io.stdout, "2/5 Existing valid device session does not match requested owner or dashboard; pairing again.");
         }
     }
+}
+async function pairOnboardDevice(command, input, installEvents, io) {
     // BLI-3731: one sign-in first. The link both signs the browser in and
     // finishes the pairing, so nobody reads a second email. Every other arm
     // below is the fallback, and it runs unchanged when this one cannot finish.
@@ -89,6 +101,9 @@ export async function pairForOnboarding(command, input, installEvents, io) {
             return linked;
         }
     }
+    return await pairOnboardDeviceWithAuthFallback(command, input, installEvents, io);
+}
+async function pairOnboardDeviceWithAuthFallback(command, input, installEvents, io) {
     const authResult = await requestPairingAccessTokenDetailed({
         dashboardUrl: command.dashboardUrl,
         email: input.claimedOwnerEmail,

package/dist/commands/ops-sections.js

@@ -0,0 +1,89 @@
+import { asRecord, callTower } from "./tower-command.js";
+import { writeLine } from "./cli-io.js";
+export function turnAggregateSection(payload) {
+    const section = payload.turns ?? null;
+    return { section, reason: section ? "ok" : "turns_section_absent" };
+}
+export async function readToolRouterBoard(io, tower) {
+    const result = await callTower(tower, { path: "/api/ops/tool-router", label: "ops-tool-router" });
+    if (!result.ok) {
+        writeLine(io.stderr, `[ops cli] tool router not read ${JSON.stringify({ reason: result.reason, http_status: result.httpStatus ?? null })}`);
+        return { board: null, reason: result.reason };
+    }
+    const board = asRecord(result.body).board ?? null;
+    return { board, reason: board ? "ok" : "tool_router_section_absent" };
+}
+export function turnAggregateLine(section) {
+    return `TURNS  ${section.turns ?? 0} turns / ${section.windowDays ?? 30}d · wall p50 ${section.wallTimeMs?.p50 ?? "n/a"}ms · p95 ${section.wallTimeMs?.p95 ?? "n/a"}ms · ${section.completion ?? "unknown"}`;
+}
+export function toolRouterLine(board) {
+    const rate = board.agreementRate === null || board.agreementRate === undefined
+        ? "n/a"
+        : `${(board.agreementRate * 100).toFixed(1)}%`;
+    return `TOOL ROUTER  ${board.turnsRouted ?? 0} routed · agreement ${rate} · p50 ${board.p50LatencyMs ?? "n/a"}ms${board.capped ? " · capped" : ""}${board.readError ? ` · ${board.readError}` : ""}`;
+}
+/**
+ * The adoption gauge, read through its own door.
+ *
+ * Never fails the board: a `cockpit ops --memory` whose memory half is
+ * unreadable still prints the pipelines, the fleet and the coverage, and says
+ * in one line which half is missing and why. The status board's exit code is
+ * about collection health, and adoption is not that.
+ */
+export async function readMemoryUsage(command, io, tower) {
+    const params = new URLSearchParams();
+    if (command.memoryDays !== undefined)
+        params.set("days", String(command.memoryDays));
+    const query = params.toString();
+    const result = await callTower(tower, {
+        path: `/api/ops/memory-usage${query ? `?${query}` : ""}`,
+        label: "ops-memory-usage",
+    });
+    if (!result.ok) {
+        writeLine(io.stderr, `[ops cli] memory usage not read ${JSON.stringify({
+            reason: result.reason,
+            http_status: result.httpStatus ?? null,
+        })}`);
+        return { section: null, hooks: null, experience: null, reason: result.reason };
+    }
+    const body = asRecord(result.body);
+    // BLI-3788: the hook counts ride the same answer, and their absence is a
+    // fact about the SERVER's version rather than about this fleet — an older
+    // dashboard sends no `hooks` key, and printing nothing is right there.
+    if (!body.memory)
+        return {
+            section: null,
+            hooks: body.hooks ?? null,
+            experience: body.experience ?? null,
+            reason: "memory_section_absent",
+        };
+    return {
+        section: body.memory,
+        hooks: body.hooks ?? null,
+        experience: body.experience ?? null,
+        reason: "ok",
+    };
+}
+/**
+ * The per-model board, read through its own door (BLI-3912).
+ *
+ * Same posture as the adoption gauge next door: it never fails the status
+ * board, and when it cannot be read the reason is printed where the section
+ * would have been. The LINES come from the server, so a terminal and the
+ * dashboard cannot disagree about what a model cost today.
+ */
+export async function readModelBoardLines(io, tower) {
+    const result = await callTower(tower, { path: "/api/ops/models", label: "ops-models" });
+    if (!result.ok) {
+        writeLine(io.stderr, `[ops cli] model board not read ${JSON.stringify({
+            reason: result.reason,
+            http_status: result.httpStatus ?? null,
+        })}`);
+        return { lines: [], board: null, reason: result.reason };
+    }
+    const body = asRecord(result.body);
+    if (!body.lines || body.lines.length === 0) {
+        return { lines: [], board: body.board ?? null, reason: "models_section_absent" };
+    }
+    return { lines: body.lines, board: body.board ?? null, reason: "ok" };
+}