@bli-cockpit/cli 0.2.125 → 0.2.127

package/dist/commands/careers-resume.js

@@ -0,0 +1,111 @@
+import { stat, writeFile } from 'node:fs/promises';
+import { writeLine } from './cli-io.js';
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from './agent-door.js';
+/**
+ * `cockpit careers resume <id>` — the drawer's "Open resume" button, typed
+ * (BLI-4462).
+ *
+ * It lives beside `careers.ts` rather than inside it because it is the only
+ * careers verb that does not end at `emitAgentDoor`: the Tower door answers
+ * with a SIGNED URL that lives 60 seconds, and `--out <path>` spends it here,
+ * fetching the private object straight from storage and writing the bytes to
+ * disk. Two requests, one act.
+ *
+ * The URL is a bearer credential for that object, so it goes to stdout only
+ * when a person asked for it and NEVER into a log line: every `[careers
+ * resume]` line carries the application id, a byte count, the seconds left and
+ * a reason label. The overwrite refusal is checked twice, once before the
+ * link is fetched so the sentence is the useful one, and again by opening the
+ * file with `wx`, which is what actually closes the race.
+ */
+const TAG = '[careers resume]';
+const RESUME_TIMEOUT_MS = 60_000;
+/** What the door promises the link is good for. Read from the answer when it says. */
+const DEFAULT_EXPIRES_IN_SECONDS = 60;
+export async function runCareersResume(command, door) {
+    const id = command.id ?? '';
+    const outPath = command.outPath;
+    if (outPath !== undefined && command.force !== true && await fileExists(outPath)) {
+        return failAgentDoor(door, TAG, 'file_exists', `${outPath} is already there, so nothing was downloaded. Pass --force to overwrite it, or name another path.`);
+    }
+    const answer = await askAgentDoor(door, {
+        path: `/api/careers/applications/${encodeURIComponent(id)}/resume-url`,
+        method: 'GET',
+        label: 'careers resume',
+        timeoutMs: RESUME_TIMEOUT_MS,
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const url = readUrl(answer.body);
+    if (!url) {
+        return failAgentDoor(door, TAG, 'no_signed_url', 'Tower answered that door without a link, so there is nothing to open or download. That application may have no resume on file.');
+    }
+    const expiresInSeconds = readExpiry(answer.body);
+    if (outPath === undefined)
+        return emitLink(door, id, url, expiresInSeconds);
+    return downloadResume(door, { id, url, outPath, force: command.force === true, expiresInSeconds });
+}
+/** No `--out`: the link itself, on stdout, and never in the receipt line. */
+function emitLink(door, id, url, expiresInSeconds) {
+    writeLine(door.io.stderr, `${TAG} link ${JSON.stringify({ application_id: id, expires_in_seconds: expiresInSeconds, reason: 'signed_url_issued' })}`);
+    if (door.json)
+        return emitAgentDoor(door, { url, expires_in_seconds: expiresInSeconds });
+    writeLine(door.io.stdout, url);
+    return 0;
+}
+async function downloadResume(door, file) {
+    // Straight to storage, not through Tower: this URL IS the authorisation, and
+    // the device token has no business on a request to another host.
+    let response;
+    try {
+        response = await door.io.fetch(file.url, { method: 'GET' });
+    }
+    catch (error) {
+        return failAgentDoor(door, TAG, 'download_failed', `Could not reach the storage that holds that resume: ${error instanceof Error ? error.message : String(error)}. Nothing was written to ${file.outPath}.`);
+    }
+    if (!response.ok) {
+        return failAgentDoor(door, TAG, `http_${response.status}`, `Storage answered ${response.status} for that resume; the link is only good for ${file.expiresInSeconds} seconds. Nothing was written to ${file.outPath}.`);
+    }
+    const bytes = Buffer.from(await response.arrayBuffer());
+    try {
+        // `wx` fails rather than clobbering: the check above is the good sentence,
+        // this is the one that holds when the file appears in between.
+        await writeFile(file.outPath, bytes, file.force ? {} : { flag: 'wx' });
+    }
+    catch (error) {
+        const reason = error?.code === 'EEXIST' ? 'file_exists' : 'write_failed';
+        writeLine(door.io.stderr, `${TAG} download ${JSON.stringify({ application_id: file.id, bytes: bytes.length, reason })}`);
+        return failAgentDoor(door, TAG, reason, `Downloaded ${bytes.length} bytes and could not write them to ${file.outPath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    writeLine(door.io.stderr, `${TAG} download ${JSON.stringify({ application_id: file.id, bytes: bytes.length, reason: 'written' })}`);
+    if (door.json)
+        return emitAgentDoor(door, { path: file.outPath, bytes: bytes.length });
+    writeLine(door.io.stdout, `Wrote ${bytes.length} bytes to ${file.outPath}.`);
+    return 0;
+}
+function readUrl(body) {
+    if (!body || typeof body !== 'object')
+        return null;
+    const value = body['url'];
+    return typeof value === 'string' && value.trim() !== '' ? value : null;
+}
+/**
+ * The door answers `expires_in`; every surface a person reads says
+ * `expires_in_seconds`, because "60" with no unit is the kind of number that
+ * gets read as minutes.
+ */
+function readExpiry(body) {
+    if (!body || typeof body !== 'object')
+        return DEFAULT_EXPIRES_IN_SECONDS;
+    const value = body['expires_in'];
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : DEFAULT_EXPIRES_IN_SECONDS;
+}
+async function fileExists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/commands/careers.js

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from './agent-door.js';
+import { runCareersResume } from './careers-resume.js';
 /**
  * `cockpit careers` — application review (BLI-3706) and, since BLI-4460, the
  * pipeline: invite, decide, the role's take-home and the settings. BLI-4461
@@ -9,9 +10,15 @@ import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from './age
  * decides policy. The take-home body arrives from a FILE rather than a flag,
  * because an email body does not belong in an argument vector, a shell history
  * or a process list.
+ *
+ * `resume` (BLI-4462) is the one verb that does not end at `emitAgentDoor`,
+ * because its answer is a 60-second signed URL and `--out` spends it on a
+ * download. That work lives in `careers-resume.ts`.
  */
 export async function runCareers(command, io) {
     const door = await openAgentDoor('careers', command, io);
+    if (command.action === 'resume')
+        return runCareersResume(command, door);
     let plan;
     try {
         plan = await planCareersRequest(command);
@@ -47,6 +54,10 @@ async function planCareersRequest(command) {
         // names where the run actually happens rather than implying it ran here.
         case 'grade': return { path: `${application}/grade`, method: 'POST', body: { now: command.now === true } };
         case 'decide': return { path: `${application}/decide`, method: 'POST', body: { decision: command.decision } };
+        // `resume` never arrives here: `runCareers` hands it to `careers-resume.ts`
+        // above, which owns both of its requests. The case keeps the switch
+        // exhaustive, so a verb added later cannot fall through this table unseen.
+        case 'resume': throw new Error('careers resume is answered by runCareersResume, not by this table.');
         case 'takehome-show': return { path: takehomePath(command), method: 'GET' };
         case 'takehome-set': return { path: takehomePath(command), method: 'PUT', body: await takehomeBody(command) };
         case 'settings-show': return { path: '/api/careers/settings', method: 'GET' };

package/dist/commands/local-args-tower-careers.js

@@ -1,14 +1,14 @@
 import { optionalNonEmpty, optionalUrl, parseNamedArgs } from './local-arg-values.js';
-const ACTIONS = ['list', 'show', 'rescreen', 'invite', 'decide', 'grade', 'takehome-show', 'takehome-set', 'settings-show', 'settings-set'];
+const ACTIONS = ['list', 'show', 'rescreen', 'invite', 'decide', 'grade', 'resume', 'takehome-show', 'takehome-set', 'settings-show', 'settings-set'];
 /** Typed word → the one action it means. The left side is what a person reads on the button. */
 const ALSO_SPELLED = { 'send-takehome': 'invite' };
 const DECISIONS = ['passed_on', 'archived', 'reopen'];
 /** Verbs that name an application id, a role slug, or nothing at all. */
-const NEEDS_ID = ['show', 'rescreen', 'invite', 'decide', 'grade'];
+const NEEDS_ID = ['show', 'rescreen', 'invite', 'decide', 'grade', 'resume'];
 const NEEDS_ROLE = ['takehome-show', 'takehome-set'];
 export function parseCareersArgs(args) {
-    const valueFlags = ['--role', '--min-score', '--since', '--home', '--dashboard-url', '--decision', '--stage', '--subject', '--body-file', '--link', '--pass-score', '--account', '--auto-invite-min-score', '--attention-min-score', '--enabled', '--booking-link', '--grader-model'];
-    const values = parseNamedArgs(args, { allowedFlags: [...valueFlags, '--json', '--now'], valueFlags });
+    const valueFlags = ['--role', '--min-score', '--since', '--home', '--dashboard-url', '--decision', '--stage', '--subject', '--body-file', '--link', '--pass-score', '--account', '--auto-invite-min-score', '--attention-min-score', '--enabled', '--booking-link', '--grader-model', '--out'];
+    const values = parseNamedArgs(args, { allowedFlags: [...valueFlags, '--json', '--now', '--force'], valueFlags });
     const positionals = [...values.positionals];
     // `takehome show` and `settings set` are two words a person types and one
     // action everything downstream reads.
@@ -48,6 +48,16 @@ export function parseCareersArgs(args) {
     const enabledRaw = optionalNonEmpty(values.flags.get('--enabled'));
     if (enabledRaw !== undefined && enabledRaw !== 'true' && enabledRaw !== 'false')
         throw new Error('--enabled must be true or false.');
+    // The resume is the only thing this noun writes to disk, so both file flags
+    // belong to it alone and say so rather than being accepted and ignored.
+    const outPath = optionalNonEmpty(values.flags.get('--out'));
+    const force = values.booleans.has('--force');
+    if (outPath !== undefined && verb !== 'resume')
+        throw new Error('--out belongs to `cockpit careers resume <id>`.');
+    if (force && verb !== 'resume')
+        throw new Error('--force belongs to `cockpit careers resume <id> --out <path>`.');
+    if (force && outPath === undefined)
+        throw new Error('--force only means something beside --out <path>: with no file to write there is nothing to overwrite.');
     return {
         kind: 'careers', action: verb,
         id: NEEDS_ID.includes(verb) ? target : undefined,
@@ -60,6 +70,7 @@ export function parseCareersArgs(args) {
         bookingLink: httpsFlag(values.flags.get('--booking-link')),
         graderModel: optionalNonEmpty(values.flags.get('--grader-model')),
         now: values.booleans.has('--now'),
+        outPath, force,
         autoInviteMinScore, attentionMinScore,
         autoInviteEnabled: enabledRaw === undefined ? undefined : enabledRaw === 'true',
         homeDir: optionalNonEmpty(values.flags.get('--home')), dashboardUrl: optionalUrl(values.flags.get('--dashboard-url')), json: values.booleans.has('--json'),

package/dist/commands/local-discovery.js

@@ -1,37 +1,15 @@
 import { writeLine } from "./cli-io.js";
 import { resolveDiscoveryLimits, saveDiscoveryLimits, } from "../discovery-limits.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
 import { discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
 export async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
     // What the operator typed this run, else what they typed some previous run,
     // else the built-in defaults (BLI-2362).
     const limits = await resolveDiscoveryLimits(discovery, discovery.homeDir);
-    const maxWorktrees = limits.maxRepos;
-    const roots = Array.isArray(repoRoot)
-        ? repoRoot
-        : [repoRoot ?? process.cwd()];
-    const result = await discoverGitWorktreesInRootsWithStatus(roots, {
-        maxDepth: limits.maxDepth,
-        maxWorktrees,
-    });
-    if (io && result.unreadable_dirs.length > 0) {
-        // Never silently dropped: anything under these folders is missing from the
-        // scan, so say so even when the run otherwise succeeds.
-        writeLine(io.stderr, unreadableDirectoriesMessage(result.unreadable_dirs));
-    }
+    const askedForRoots = repoRoot === undefined ? undefined : Array.isArray(repoRoot) ? repoRoot : [repoRoot];
+    const roots = askedForRoots ?? [process.cwd()];
+    const result = await scanRootsReportingWhatItMissed(roots, limits, discovery, io);
     const worktrees = result.worktrees;
-    if (!result.complete) {
-        const message = incompleteDiscoveryMessage({
-            result,
-            roots,
-            maxDepth: limits.maxDepth,
-            maxRepos: maxWorktrees,
-            found: worktrees.length,
-        });
-        if (io)
-            writeLine(io.stderr, message);
-        discovery.onPartial?.(message);
-        console.error("[local-discovery] partial collection", JSON.stringify({ reason: result.incomplete_reasons.join(","), roots: roots.length, incomplete_roots: result.incomplete_roots.length, max_depth: limits.maxDepth, found: worktrees.length }));
-    }
     if (worktrees.length === 0 && result.complete && !discovery.allowEmpty) {
         // "No git repos found" is only true when the scan could actually SEE
         // everywhere it looked. With unreadable folders in hand, the sentence sent
@@ -53,10 +31,86 @@ export async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
                 "Fix the permissions on those folders and run the command again, or point --workspace at the project folders you can read.",
             ].join("\n"));
         }
+        // An explicit --workspace is an instruction about WHERE to look, so an
+        // empty answer there is the answer. Without one, the folder the operator
+        // stood in was a guess, and this machine already knows a better one — for
+        // the commands that asked for it (BLI-4467).
+        if (askedForRoots === undefined && discovery.fallbackToSavedRoots) {
+            return await discoverInSavedCollectionRoots(limits, discovery, io);
+        }
         throw new Error("No git repos found. Run from a git repo, or from a parent folder containing git repos.");
     }
     return worktrees;
 }
+/**
+ * The second look: this machine's approved collection roots, scanned with the
+ * same limits and the same partial/unreadable reporting as the first. Refuses
+ * only when there are no approved roots to read, because then the machine
+ * genuinely has nothing to point the operator at (BLI-4467).
+ */
+async function discoverInSavedCollectionRoots(limits, discovery, io) {
+    const savedRoots = await readSavedCollectionRoots(discovery.homeDir);
+    if (savedRoots.length === 0) {
+        console.error("[local-discovery] cwd holds no repos and this machine has no saved collection roots", JSON.stringify({ reason: "no_saved_roots" }));
+        throw new Error([
+            "No git repos found here and this machine has no approved collection roots.",
+            "Run `cockpit doctor` to set them up, or `cockpit roots add <dir>`.",
+        ].join("\n"));
+    }
+    console.error("[local-discovery] cwd holds no repos, using the saved collection roots", JSON.stringify({ reason: "roots_fallback", roots: savedRoots.length }));
+    if (io)
+        writeLine(io.stderr, "No git repo here; reading the machine's approved roots.");
+    const result = await scanRootsReportingWhatItMissed(savedRoots, limits, discovery, io);
+    console.error("[local-discovery] saved collection roots scanned", JSON.stringify({
+        reason: "roots_fallback_result",
+        roots: savedRoots.length,
+        found: result.worktrees.length,
+        complete: result.complete,
+    }));
+    return result.worktrees;
+}
+/** The approved roots this machine already agreed to collect, or none if the config cannot be read. */
+async function readSavedCollectionRoots(homeDir) {
+    const paths = getCollectorRuntimePaths(homeDir);
+    const config = await readLocalCollectorConfig(paths).catch((error) => {
+        console.error("[local-discovery] could not read the saved collection roots", JSON.stringify({
+            reason: error.code ?? "config_unreadable",
+        }));
+        return null;
+    });
+    return config?.default_repo_paths ?? [];
+}
+/**
+ * One scan plus the two things a scan owes the operator: the folders it could
+ * not open, and the coverage it could not finish. Shared so the fallback scan
+ * reports exactly what the first one does.
+ */
+async function scanRootsReportingWhatItMissed(roots, limits, discovery, io) {
+    const maxWorktrees = limits.maxRepos;
+    const result = await discoverGitWorktreesInRootsWithStatus(roots, {
+        maxDepth: limits.maxDepth,
+        maxWorktrees,
+    });
+    if (io && result.unreadable_dirs.length > 0) {
+        // Never silently dropped: anything under these folders is missing from the
+        // scan, so say so even when the run otherwise succeeds.
+        writeLine(io.stderr, unreadableDirectoriesMessage(result.unreadable_dirs));
+    }
+    if (!result.complete) {
+        const message = incompleteDiscoveryMessage({
+            result,
+            roots,
+            maxDepth: limits.maxDepth,
+            maxRepos: maxWorktrees,
+            found: result.worktrees.length,
+        });
+        if (io)
+            writeLine(io.stderr, message);
+        discovery.onPartial?.(message);
+        console.error("[local-discovery] partial collection", JSON.stringify({ reason: result.incomplete_reasons.join(","), roots: roots.length, incomplete_roots: result.incomplete_roots.length, max_depth: limits.maxDepth, found: result.worktrees.length }));
+    }
+    return result;
+}
 /**
  * Persists `--max-depth` / `--max-repos` when a command carried them, so the
  * number survives into the background sync and the doctor's own sync — neither

package/dist/commands/local-help-commands-tower.js

@@ -25,13 +25,14 @@ export const TOWER_COMMAND_HELP = [
     [
         "careers",
         [
-            "Usage: cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <d>|grade <id>|takehome show <role>|takehome set <role>|settings show|settings set] [flags]",
+            "Usage: cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <d>|grade <id>|resume <id>|takehome show <role>|takehome set <role>|settings show|settings set] [flags]",
             "",
             "Super-admin application review and pipeline. Lists at most 100 matches with total and has_more; use filters to narrow.",
             "list [--role <slug>] [--min-score <n>] [--since <date>] [--stage <screened|invited|submitted|graded|booking_sent|passed_on|archived>] — the board, newest first, with the two thresholds in force.",
             "send-takehome <id> (also `invite <id>`): sends that role's take-home from the configured mailbox, whatever the screening scored. The same act as Tower's Send take-home button, and only a row still at `screened`.",
             "decide <id> --decision <passed_on|archived|reopen> — your own call on a row; `reopen` puts it back to `screened`.",
             "grade <id> [--now]: puts one submission back in the take-home grader's queue. The grader runs on Railway every 15 minutes; --now says so rather than pretending the run happened here.",
+            "resume <id> [--out <path>] [--force]: the candidate's resume, the same file the drawer's Open resume button shows. Bare, it prints a signed link that dies in 60 seconds; --out downloads the file to that path and refuses to overwrite one already there unless you pass --force.",
             "takehome show <role> — the subject, body, link and the reviewer's rubric for that role.",
             "takehome set <role> [--subject <s>] [--body-file <path>] [--link <url>] [--pass-score <0-10>] — the body comes from a FILE and must keep {first_name} and {link}.",
             "settings show — the bar, the attention threshold, whether automatic sending is on, and which mailbox it goes out from.",

package/dist/commands/local-help.js

@@ -104,7 +104,7 @@ export function localCommandHelp(command) {
         "  cockpit project [list] [--archived] [--dashboard-url <url>] [--json]",
         `  cockpit search "<words>" [--kind ${SEARCH_KINDS.join(",")}] [--limit <n>] [--dashboard-url <url>] [--json]`,
         "  cockpit release [--dry-run] [--skip-checks] [--no-floor] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
-        "  cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <passed_on|archived|reopen>|grade <id> [--now]|takehome show <role>|takehome set <role> --body-file <path>|settings show|settings set --enabled <true|false>] [--role <slug>] [--min-score <n>] [--since <date>] [--stage <s>] [--json]",
+        "  cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <passed_on|archived|reopen>|grade <id> [--now]|resume <id> [--out <path>]|takehome show <role>|takehome set <role> --body-file <path>|settings show|settings set --enabled <true|false>] [--role <slug>] [--min-score <n>] [--since <date>] [--stage <s>] [--force] [--json]",
         "  cockpit usage sessions [--task <BLI-NNNN> | --subject <name>] [--repo <label>] [--since <window>] [--json]",
         "  cockpit usage sessions --session <id> [--from-window <n>] [--json]",
         "  --by-topic groups work types; --by-subject groups open subjects from session summaries.",

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.125");
+    writeLine(io?.stdout ?? process.stdout, "0.2.127");
     return 0;
   }
 

package/dist/commands/sessions.js

@@ -19,7 +19,14 @@ const SESSION_SCAN_OVERRIDE_LIMIT = 10_000;
 export async function runSessions(command, io) {
     const now = new Date();
     const homeDir = command.homeDir ?? os.homedir();
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, {
+        maxDepth: command.maxDepth,
+        maxRepos: command.maxRepos,
+        homeDir: command.homeDir,
+        // BLI-4467: a read-only question about what this machine has observed,
+        // so the approved roots answer it from any folder.
+        fallbackToSavedRoots: true,
+    }, io);
     const window = await sessionsScanWindow(command, now);
     const { codex, claude } = await scanSessionSources(command, homeDir, worktrees, now, window);
     const { codexRows, claudeRows } = sessionRows(codex, claude);

package/dist/commands/status.js

@@ -30,11 +30,26 @@ import { normalizeCollectionRoots } from "../root-normalization.js";
 export async function runStatus(command, io) {
     const backfillCursor = await inspectBackfillCursor(command.homeDir);
     const setupReceipt = await readMachineSetupReceipt(command.homeDir, io);
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, {
+        maxDepth: command.maxDepth,
+        maxRepos: command.maxRepos,
+        homeDir: command.homeDir,
+        // BLI-4467: this command answers "what does this machine believe about
+        // itself", so standing in a folder with no repo is not a reason to
+        // refuse — the approved roots are the better answer.
+        fallbackToSavedRoots: true,
+    }, io);
     if (worktrees.length > 1) {
         return writeMultiRepoStatus(command, io, backfillCursor, setupReceipt, worktrees);
     }
-    return writeSingleRepoStatus(command, io, backfillCursor, setupReceipt);
+    // BLI-4467: with no --workspace, the folder was a guess and discovery is the
+    // one that knows which worktree this is about — the fallback above may have
+    // found it under an approved root, nowhere near the cwd. Describing the guess
+    // printed `repo: <the empty folder>` and `branch: unknown` while exiting 0.
+    const single = command.repoRoot === undefined && worktrees.length === 1
+        ? { ...command, repoRoot: worktrees[0].repo_root }
+        : command;
+    return writeSingleRepoStatus(single, io, backfillCursor, setupReceipt);
 }
 async function readMachineSetupReceipt(homeDir, io) {
     // BLI-3731: "is this machine actually connected?" belongs beside "is it

package/dist/upload-agent-artifacts.js

@@ -40,20 +40,26 @@ export async function reportAgentImageArtifacts(options) {
         // Both non-2xx branches returned a label and said nothing (BLI-3483). An
         // image that never gets reported is never redacted and never OCR'd, and
         // the only place that fact existed was a return value the sync discards.
-        if (response.status === 404) {
-            console.error("[agent-artifacts] the dashboard has no agent-artifact route; these images stay unreported", JSON.stringify({
-                reason: "agent_artifact_api_unavailable",
-                http_status: 404,
-                artifact_count: artifacts.length,
-            }));
-            return {
-                posted: false,
-                reason: "agent_artifact_api_unavailable",
-                recorded_count: 0,
-            };
-        }
         if (!response.ok) {
-            const serverReason = serverFailureDetail(await readResponseJson(response));
+            const errorBody = await readResponseJson(response);
+            // A 404 is two different facts. "No such route" is the platform
+            // answering with an empty or HTML body; a JSON error envelope means the
+            // route answered and refused, and calling that "the dashboard has no
+            // agent-artifact route" hid a real refusal behind a shrug for as long as
+            // the door rejected ambient tickets.
+            if (response.status === 404 && !routeAnswered(errorBody)) {
+                console.error("[agent-artifacts] nothing answered at the agent-artifact path; these images stay unreported", JSON.stringify({
+                    reason: "agent_artifact_api_unavailable",
+                    http_status: 404,
+                    artifact_count: artifacts.length,
+                }));
+                return {
+                    posted: false,
+                    reason: "agent_artifact_api_unavailable",
+                    recorded_count: 0,
+                };
+            }
+            const serverReason = serverFailureDetail(errorBody);
             console.error("[agent-artifacts] report refused", JSON.stringify({
                 reason: "report_failed",
                 http_status: response.status,
@@ -99,6 +105,20 @@ export async function reportAgentImageArtifacts(options) {
         return { posted: false, reason: "report_network_error", recorded_count: 0 };
     }
 }
+/**
+ * Did the route answer, or did something in front of it?
+ *
+ * The dashboard's refusals are always a JSON envelope carrying a `code` (and
+ * sometimes a `reason`); a missing route answers with an empty body or a
+ * platform HTML page, which `readResponseJson` hands back as `{ message }`.
+ * That difference is the whole reason a 404 can mean two things.
+ */
+function routeAnswered(body) {
+    if (!body || typeof body !== "object")
+        return false;
+    const record = body;
+    return (typeof record["code"] === "string" || typeof record["reason"] === "string");
+}
 /**
  * The images this sync made durable, from both directions.
  *

package/dist/upload-http.js

@@ -39,11 +39,19 @@ export async function readResponseJson(response) {
  * The server's own reason for refusing, as something safe to log.
  *
  * The dashboard's error envelopes answer `{ code, message, reason? }`. A
- * `reason`/`code` that already looks like a label travels verbatim — that is
- * the bucket the server chose, and reproducing it is how "storage rejected 116
- * MB" reaches an operator instead of "upload failed" (BLI-2528). Anything else
- * falls back to the message, redacted and capped, because a proxy's error page
- * is unbounded and a route's message can carry a path.
+ * `reason`/`code` that already looks like a label is the bucket the server
+ * chose and travels verbatim at the head — that is how "storage rejected 116
+ * MB" reaches an operator instead of "upload failed" (BLI-2528).
+ *
+ * The label alone is not the whole fact. Every dashboard envelope carries a
+ * `code`, so a label-first helper that stopped at the first match never read
+ * `message` on any refusal: four fleet machines showed `ingest_rejected: http
+ * 500; server reason BLI-E001` while the server had sent "Collector device
+ * lookup failed: <cause>" in the same body. The failure knew its reason and
+ * the collector discarded it. So the sentence rides behind the label as
+ * `label: message`, redacted and capped — a proxy's error page is unbounded
+ * and a route's message can carry a path. A message that merely restates the
+ * `reason` is dropped rather than repeated.
  *
  * `null` means the body said nothing usable — which is itself worth logging as
  * `"none"`, since "the server gave no reason" and "we never looked" are
@@ -53,14 +61,26 @@ export function serverFailureDetail(value) {
     if (!value || typeof value !== "object")
         return null;
     const record = value;
+    let head = null;
+    let headIsReason = false;
     for (const key of ["reason", "code"]) {
         const candidate = record[key];
         if (typeof candidate === "string" && /^[a-z0-9_:.-]{1,80}$/iu.test(candidate)) {
-            return candidate;
+            head = candidate;
+            headIsReason = key === "reason";
+            break;
         }
     }
     const message = record["message"] ?? record["error"];
-    return typeof message === "string" ? boundedFailureDetail(message) : null;
+    const sentence = typeof message === "string" ? boundedFailureDetail(message) : null;
+    if (!head)
+        return sentence;
+    if (!sentence)
+        return head;
+    if (headIsReason && sentence.trim().toLowerCase() === head.trim().toLowerCase()) {
+        return head;
+    }
+    return `${head}: ${sentence}`;
 }
 /** The server's own words when it supplied any, otherwise our fallback. */
 export function responseErrorMessage(value, fallback) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.125",
+  "version": "0.2.127",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.32",
-    "@bli-cockpit/mcp": "0.1.52",
+    "@bli-cockpit/mcp": "0.1.54",
     "@bli-cockpit/telemetry-core": "0.1.48"
   }
 }