@bli-cockpit/cli 0.2.13 → 0.2.15

package/dist/autostart.js

@@ -270,6 +270,13 @@ async function windowsTaskStatus(options) {
         const queryMessage = `${query.stderr}\n${query.stdout}`;
         const taskIsKnownAbsent = query.code === 1 &&
             /cannot find|not found|does not exist/iu.test(queryMessage);
+        // Metadata only: schtasks stderr can carry the state directory, so the exit
+        // code and the classification travel, never the text.
+        console.error("[autostart] windows task query failed", JSON.stringify({
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            exit_code: query.code,
+            status: taskIsKnownAbsent ? "absent" : "not_loaded",
+        }));
         return {
             status: taskIsKnownAbsent ? "absent" : "not_loaded",
             label: AUTOSTART_LABEL,
@@ -305,6 +312,23 @@ async function windowsTaskStatus(options) {
             registrationProblems.push("sync script does not match the current roots or Cockpit runtime");
         }
     }
+    // Both branches log. A line that only fires on failure cannot answer "did
+    // background collection validate at all today?", which is the question that
+    // would have caught a validator rejecting every healthy Windows task.
+    // Problem labels carry no paths, so they are safe to emit verbatim.
+    if (registrationProblems.length > 0) {
+        console.error("[autostart] windows task needs repair", JSON.stringify({
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            problem_count: registrationProblems.length,
+            problems: registrationProblems,
+        }));
+    }
+    else {
+        console.error("[autostart] windows task validated", JSON.stringify({
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            interval_minutes: intervalMinutes,
+        }));
+    }
     return {
         status: registrationProblems.length > 0 ? "not_loaded" : "loaded",
         label: AUTOSTART_LABEL,
@@ -415,7 +439,7 @@ function windowsTaskRegistrationProblems(taskXml, expected) {
     const actionArguments = exactExecBlock
         .match(/<Arguments>\s*([^<]*?)\s*<\/Arguments>/iu)?.[1]
         ?.trim() ?? "";
-    const expectedActionArguments = `-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${expected.scriptPath}"`;
+    const expectedArgumentFlags = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File";
     const requirements = [
         [
             /<DisallowStartIfOnBatteries>\s*false\s*<\/DisallowStartIfOnBatteries>/iu,
@@ -444,8 +468,18 @@ function windowsTaskRegistrationProblems(taskXml, expected) {
         if (!/<LogonType>\s*InteractiveToken\s*<\/LogonType>/iu.test(exactPrincipalBlock)) {
             problems.push("logon type is not InteractiveToken");
         }
-        if (!/<RunLevel>\s*LeastPrivilege\s*<\/RunLevel>/iu.test(exactPrincipalBlock)) {
-            problems.push("task does not run with limited privileges");
+        // Windows omits <RunLevel> entirely when a task runs at the default
+        // LeastPrivilege, so `schtasks /Create ... /RL LIMITED` stores a principal
+        // block with no RunLevel element at all. Demanding the element asks Windows
+        // to state a default it never states, which is why this check failed on
+        // every Windows machine in the fleet and passed on none (0 of 4
+        // autostart-alive events ok, 2026-08-12). Absent means LeastPrivilege; only
+        // an explicit elevated value is a real problem.
+        const runLevel = exactPrincipalBlock
+            .match(/<RunLevel>\s*([^<]*?)\s*<\/RunLevel>/iu)?.[1]
+            ?.trim() || "LeastPrivilege";
+        if (!/^LeastPrivilege$/iu.test(runLevel)) {
+            problems.push(`task does not run with limited privileges (RunLevel=${runLevel})`);
         }
     }
     if (actionContext && actionContext !== principalId) {
@@ -477,8 +511,9 @@ function windowsTaskRegistrationProblems(taskXml, expected) {
     if (!sameWindowsPath(command, expected.powershellPath)) {
         problems.push("task action does not run the expected Windows PowerShell");
     }
-    if (actionArguments !== expectedActionArguments) {
-        problems.push("task action arguments do not exactly run the Cockpit sync script");
+    const actionArgumentProblem = windowsActionArgumentProblem(actionArguments, expectedArgumentFlags, expected.scriptPath);
+    if (actionArgumentProblem) {
+        problems.push(actionArgumentProblem);
     }
     if (/<Duration>/iu.test(repetition)) {
         problems.push("repetition has a finite duration");
@@ -489,6 +524,38 @@ function windowsPowerShellPath(env = process.env) {
     const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
     return path.win32.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
 }
+/**
+ * Task Scheduler stores a normalized form of the action it was given, not the
+ * string we passed: `schtasks /Create /TR "<powershell> <args>"` is split into
+ * <Command> plus <Arguments>, and the quotes around a space-free script path
+ * are dropped. Comparing <Arguments> against the exact string we built
+ * therefore fails on a task that is registered perfectly — observed on
+ * DESKTOP-G2UO1GK (CLI 0.2.13, 2026-08-12), where the stored value differed
+ * from the expected one only by those quotes.
+ *
+ * Compare the flags exactly, because those are ours, and compare the script as
+ * a path, because that is what Windows normalizes. Each failure returns its own
+ * reason so a repair message says which half is wrong rather than "arguments
+ * differ".
+ */
+function windowsActionArgumentProblem(actionArguments, expectedFlags, expectedScriptPath) {
+    if (!actionArguments.startsWith(expectedFlags)) {
+        return "task action does not run PowerShell with the expected Cockpit sync flags";
+    }
+    const scriptArgument = unquoteWindowsArgument(actionArguments.slice(expectedFlags.length));
+    if (!scriptArgument) {
+        return "task action names no sync script to run";
+    }
+    if (!sameWindowsPath(scriptArgument, expectedScriptPath)) {
+        return "task action runs a script other than the Cockpit sync script";
+    }
+    return null;
+}
+function unquoteWindowsArgument(value) {
+    const trimmed = value.trim();
+    const quoted = trimmed.match(/^"([\s\S]*)"$/u) ?? trimmed.match(/^'([\s\S]*)'$/u);
+    return (quoted?.[1] ?? trimmed).trim();
+}
 function sameWindowsPath(left, right) {
     if (!left || !right)
         return false;

package/dist/commands/doctor.js

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { autostartStatus, installAutostartAgent } from "../autostart.js";
 import { savedDiscoveryLimitArgs } from "../discovery-limits.js";
+import { redactedHealthDetail } from "../health-detail.js";
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { backfillCompletionCovers, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
@@ -383,10 +384,21 @@ function doctorEvent(row) {
         : row.status === "skipped"
             ? "skipped"
             : "ok";
+    if (status === "ok")
+        return { step: row.id, status };
+    // BLI-2542. The step already computed why it failed and already printed it to
+    // the operator; before this, only the bucket travelled. `autostart-alive`
+    // reports two distinct problems at once on Windows, so the detail carries the
+    // whole message rather than a first line.
+    const detail = redactedHealthDetail(row.message);
     return {
         step: row.id,
         status,
-        ...(status === "ok" ? {} : { error_code: sanitizeEventCode(row.code) }),
+        error_code: sanitizeEventCode(row.code),
+        // A detail that only repeats the bucket is noise, not a reason.
+        ...(detail && detail !== sanitizeEventCode(row.code)
+            ? { error_detail: detail }
+            : {}),
     };
 }
 function doctorMark(row) {

package/dist/commands/local.js

@@ -7,6 +7,7 @@ import { inspectAgentRules, installAgentRules, uninstallAgentRules, } from "../a
 import { backfillRetryCommand, runBackfill, runBackfillCommand, } from "./backfill.js";
 import { runDoctor } from "./doctor.js";
 import { inspectBackfillLock } from "../backfill-lock.js";
+import { maskLocalIdentifiers, redactedHealthDetail, } from "../health-detail.js";
 import { parseLocalArgs, normalizeUrl } from "./local-args.js";
 import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from "../autostart.js";
 import { DEFAULT_DASHBOARD_URL, ensureLocalCollectorConfig, getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext, } from "../local-state.js";
@@ -640,11 +641,17 @@ function updateCollectionRoots(command) {
     }
     return deduped;
 }
-function addInstallEvent(events, step, status, errorCode) {
+function addInstallEvent(events, step, status, errorCode, 
+// BLI-2542: the bucket alone cannot be acted on. Callers that hold the reason
+// pass it; it is redacted at this boundary, not at the call site.
+errorMessage) {
+    const detail = errorMessage ? redactedHealthDetail(errorMessage) : "";
+    const code = errorCode ? sanitizeInstallErrorCode(errorCode) : undefined;
     events.push({
         step,
         status,
-        ...(errorCode ? { error_code: sanitizeInstallErrorCode(errorCode) } : {}),
+        ...(code ? { error_code: code } : {}),
+        ...(detail && detail !== code ? { error_detail: detail } : {}),
     });
 }
 function addOnboardFailureEvent(events, blocker) {
@@ -660,10 +667,10 @@ function addAutostartInstallEvent(events, result) {
         return;
     }
     if (result.status === "unsupported") {
-        addInstallEvent(events, "autostart", "skipped", "unsupported");
+        addInstallEvent(events, "autostart", "skipped", "unsupported", result.message);
         return;
     }
-    addInstallEvent(events, "autostart", result.loaded === false ? "fail" : "ok", result.loaded === false ? "autostart_load_failed" : undefined);
+    addInstallEvent(events, "autostart", result.loaded === false ? "fail" : "ok", result.loaded === false ? "autostart_load_failed" : undefined, result.loaded === false ? result.message : undefined);
 }
 function onboardAutostartFailed(result) {
     return (result !== null &&
@@ -2272,9 +2279,14 @@ export function redactedSyncErrorDetail(error) {
     const { text } = redactSecretLikeContent(message, {
         appliedBy: "local_collector",
     });
-    return text.length > SYNC_ERROR_DETAIL_MAX_CHARS
-        ? `${text.slice(0, SYNC_ERROR_DETAIL_MAX_CHARS - 1)}…`
-        : text;
+    // BLI-2542: the comment above always said this text can carry absolute paths,
+    // and until now nothing removed them — secret redaction matches token shapes,
+    // not filesystem paths. Same masking the doctor receipts use, so one boundary
+    // rule covers every health receipt.
+    const masked = maskLocalIdentifiers(text);
+    return masked.length > SYNC_ERROR_DETAIL_MAX_CHARS
+        ? `${masked.slice(0, SYNC_ERROR_DETAIL_MAX_CHARS - 1)}…`
+        : masked;
 }
 /**
  * Turn a finished run into an exit code and the reasons behind it.

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.13");
+    writeLine(io?.stdout ?? process.stdout, "0.2.15");
     return 0;
   }
 

package/dist/health-detail.js

@@ -0,0 +1,80 @@
+import os from "node:os";
+import { redactSecretLikeContent } from "@bli-cockpit/telemetry-core";
+/**
+ * The reason a health receipt carries, redacted on the machine that produced it.
+ *
+ * `error_code` is the aggregation bucket. This is the cause — the text a step
+ * already computed and already showed the operator. BLI-2542: without it a
+ * receipt can say `autostart_load_failed` and nothing else, which names no cause
+ * and supports no repair. Measured on 2026-08-13, every receipt step except
+ * `sync_complete` uploaded a null detail: `npm_install` 6 failures, `gc-checked`
+ * 3, `backfill-complete` 3, `sync-fresh` 3, `autostart-alive` 1, all with the
+ * reason computed locally and discarded at the boundary.
+ *
+ * Two things are stripped before it leaves, in this order:
+ *
+ * 1. Secret-like fragments, via the same deterministic redaction the collector
+ *    applies to evidence.
+ * 2. Local identifiers — absolute paths, UNC shares, the machine name, the
+ *    account name. Step messages are static strings today, but several of them
+ *    embed the output of `schtasks` or `launchctl`, and that output does carry
+ *    the state directory and the host. Masking at the boundary means a future
+ *    step cannot leak one by writing a more helpful message.
+ *
+ * Redaction is deliberately here rather than at each call site: the boundary is
+ * what leaves the machine, so the boundary is what has to be safe.
+ */
+export const HEALTH_DETAIL_MAX_CHARS = 600;
+const WINDOWS_ABSOLUTE_PATH = /[A-Za-z]:\\[^\s"';]+/gu;
+const UNC_PATH = /\\\\[^\s"';]+/gu;
+// An absolute POSIX path of at least two segments. One segment ("/tmp") carries
+// nothing identifying and masking it would make messages harder to read.
+const POSIX_ABSOLUTE_PATH = /\/[\w.@-]+(?:\/[\w.@ -]+)+/gu;
+export function redactedHealthDetail(message) {
+    const collapsed = message.replace(/\s+/gu, " ").trim();
+    if (!collapsed)
+        return "";
+    const { text } = redactSecretLikeContent(collapsed, {
+        appliedBy: "local_collector",
+    });
+    const masked = maskLocalIdentifiers(text);
+    return masked.length > HEALTH_DETAIL_MAX_CHARS
+        ? `${masked.slice(0, HEALTH_DETAIL_MAX_CHARS - 1)}…`
+        : masked;
+}
+/**
+ * Paths first, because a path usually contains the account name; whatever
+ * mentions of the host or account survive on their own are masked after.
+ */
+export function maskLocalIdentifiers(value) {
+    let text = value
+        .replace(UNC_PATH, "[path]")
+        .replace(WINDOWS_ABSOLUTE_PATH, "[path]")
+        .replace(POSIX_ABSOLUTE_PATH, "[path]");
+    for (const [identifier, placeholder] of localIdentifiers()) {
+        if (!identifier)
+            continue;
+        text = text.replace(literalPattern(identifier), placeholder);
+    }
+    return text;
+}
+function localIdentifiers() {
+    const identifiers = [];
+    try {
+        identifiers.push([os.hostname(), "[host]"]);
+    }
+    catch {
+        // A host with no resolvable name has nothing to leak.
+    }
+    try {
+        identifiers.push([os.userInfo().username, "[user]"]);
+    }
+    catch {
+        // Same: no account name available means none can travel.
+    }
+    // A one- or two-character name would match far too much ordinary text.
+    return identifiers.filter(([value]) => value && value.length > 2);
+}
+function literalPattern(value) {
+    return new RegExp(value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), "giu");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "private": false,
   "type": "module",
   "bin": {