@bli-cockpit/cli 0.2.14 → 0.2.15

package/dist/commands/doctor.js

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { autostartStatus, installAutostartAgent } from "../autostart.js";
 import { savedDiscoveryLimitArgs } from "../discovery-limits.js";
+import { redactedHealthDetail } from "../health-detail.js";
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { backfillCompletionCovers, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
@@ -383,10 +384,21 @@ function doctorEvent(row) {
         : row.status === "skipped"
             ? "skipped"
             : "ok";
+    if (status === "ok")
+        return { step: row.id, status };
+    // BLI-2542. The step already computed why it failed and already printed it to
+    // the operator; before this, only the bucket travelled. `autostart-alive`
+    // reports two distinct problems at once on Windows, so the detail carries the
+    // whole message rather than a first line.
+    const detail = redactedHealthDetail(row.message);
     return {
         step: row.id,
         status,
-        ...(status === "ok" ? {} : { error_code: sanitizeEventCode(row.code) }),
+        error_code: sanitizeEventCode(row.code),
+        // A detail that only repeats the bucket is noise, not a reason.
+        ...(detail && detail !== sanitizeEventCode(row.code)
+            ? { error_detail: detail }
+            : {}),
     };
 }
 function doctorMark(row) {

package/dist/commands/local.js

@@ -7,6 +7,7 @@ import { inspectAgentRules, installAgentRules, uninstallAgentRules, } from "../a
 import { backfillRetryCommand, runBackfill, runBackfillCommand, } from "./backfill.js";
 import { runDoctor } from "./doctor.js";
 import { inspectBackfillLock } from "../backfill-lock.js";
+import { maskLocalIdentifiers, redactedHealthDetail, } from "../health-detail.js";
 import { parseLocalArgs, normalizeUrl } from "./local-args.js";
 import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from "../autostart.js";
 import { DEFAULT_DASHBOARD_URL, ensureLocalCollectorConfig, getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext, } from "../local-state.js";
@@ -640,11 +641,17 @@ function updateCollectionRoots(command) {
     }
     return deduped;
 }
-function addInstallEvent(events, step, status, errorCode) {
+function addInstallEvent(events, step, status, errorCode, 
+// BLI-2542: the bucket alone cannot be acted on. Callers that hold the reason
+// pass it; it is redacted at this boundary, not at the call site.
+errorMessage) {
+    const detail = errorMessage ? redactedHealthDetail(errorMessage) : "";
+    const code = errorCode ? sanitizeInstallErrorCode(errorCode) : undefined;
     events.push({
         step,
         status,
-        ...(errorCode ? { error_code: sanitizeInstallErrorCode(errorCode) } : {}),
+        ...(code ? { error_code: code } : {}),
+        ...(detail && detail !== code ? { error_detail: detail } : {}),
     });
 }
 function addOnboardFailureEvent(events, blocker) {
@@ -660,10 +667,10 @@ function addAutostartInstallEvent(events, result) {
         return;
     }
     if (result.status === "unsupported") {
-        addInstallEvent(events, "autostart", "skipped", "unsupported");
+        addInstallEvent(events, "autostart", "skipped", "unsupported", result.message);
         return;
     }
-    addInstallEvent(events, "autostart", result.loaded === false ? "fail" : "ok", result.loaded === false ? "autostart_load_failed" : undefined);
+    addInstallEvent(events, "autostart", result.loaded === false ? "fail" : "ok", result.loaded === false ? "autostart_load_failed" : undefined, result.loaded === false ? result.message : undefined);
 }
 function onboardAutostartFailed(result) {
     return (result !== null &&
@@ -2272,9 +2279,14 @@ export function redactedSyncErrorDetail(error) {
     const { text } = redactSecretLikeContent(message, {
         appliedBy: "local_collector",
     });
-    return text.length > SYNC_ERROR_DETAIL_MAX_CHARS
-        ? `${text.slice(0, SYNC_ERROR_DETAIL_MAX_CHARS - 1)}…`
-        : text;
+    // BLI-2542: the comment above always said this text can carry absolute paths,
+    // and until now nothing removed them — secret redaction matches token shapes,
+    // not filesystem paths. Same masking the doctor receipts use, so one boundary
+    // rule covers every health receipt.
+    const masked = maskLocalIdentifiers(text);
+    return masked.length > SYNC_ERROR_DETAIL_MAX_CHARS
+        ? `${masked.slice(0, SYNC_ERROR_DETAIL_MAX_CHARS - 1)}…`
+        : masked;
 }
 /**
  * Turn a finished run into an exit code and the reasons behind it.

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.14");
+    writeLine(io?.stdout ?? process.stdout, "0.2.15");
     return 0;
   }
 

package/dist/health-detail.js

@@ -0,0 +1,80 @@
+import os from "node:os";
+import { redactSecretLikeContent } from "@bli-cockpit/telemetry-core";
+/**
+ * The reason a health receipt carries, redacted on the machine that produced it.
+ *
+ * `error_code` is the aggregation bucket. This is the cause — the text a step
+ * already computed and already showed the operator. BLI-2542: without it a
+ * receipt can say `autostart_load_failed` and nothing else, which names no cause
+ * and supports no repair. Measured on 2026-08-13, every receipt step except
+ * `sync_complete` uploaded a null detail: `npm_install` 6 failures, `gc-checked`
+ * 3, `backfill-complete` 3, `sync-fresh` 3, `autostart-alive` 1, all with the
+ * reason computed locally and discarded at the boundary.
+ *
+ * Two things are stripped before it leaves, in this order:
+ *
+ * 1. Secret-like fragments, via the same deterministic redaction the collector
+ *    applies to evidence.
+ * 2. Local identifiers — absolute paths, UNC shares, the machine name, the
+ *    account name. Step messages are static strings today, but several of them
+ *    embed the output of `schtasks` or `launchctl`, and that output does carry
+ *    the state directory and the host. Masking at the boundary means a future
+ *    step cannot leak one by writing a more helpful message.
+ *
+ * Redaction is deliberately here rather than at each call site: the boundary is
+ * what leaves the machine, so the boundary is what has to be safe.
+ */
+export const HEALTH_DETAIL_MAX_CHARS = 600;
+const WINDOWS_ABSOLUTE_PATH = /[A-Za-z]:\\[^\s"';]+/gu;
+const UNC_PATH = /\\\\[^\s"';]+/gu;
+// An absolute POSIX path of at least two segments. One segment ("/tmp") carries
+// nothing identifying and masking it would make messages harder to read.
+const POSIX_ABSOLUTE_PATH = /\/[\w.@-]+(?:\/[\w.@ -]+)+/gu;
+export function redactedHealthDetail(message) {
+    const collapsed = message.replace(/\s+/gu, " ").trim();
+    if (!collapsed)
+        return "";
+    const { text } = redactSecretLikeContent(collapsed, {
+        appliedBy: "local_collector",
+    });
+    const masked = maskLocalIdentifiers(text);
+    return masked.length > HEALTH_DETAIL_MAX_CHARS
+        ? `${masked.slice(0, HEALTH_DETAIL_MAX_CHARS - 1)}…`
+        : masked;
+}
+/**
+ * Paths first, because a path usually contains the account name; whatever
+ * mentions of the host or account survive on their own are masked after.
+ */
+export function maskLocalIdentifiers(value) {
+    let text = value
+        .replace(UNC_PATH, "[path]")
+        .replace(WINDOWS_ABSOLUTE_PATH, "[path]")
+        .replace(POSIX_ABSOLUTE_PATH, "[path]");
+    for (const [identifier, placeholder] of localIdentifiers()) {
+        if (!identifier)
+            continue;
+        text = text.replace(literalPattern(identifier), placeholder);
+    }
+    return text;
+}
+function localIdentifiers() {
+    const identifiers = [];
+    try {
+        identifiers.push([os.hostname(), "[host]"]);
+    }
+    catch {
+        // A host with no resolvable name has nothing to leak.
+    }
+    try {
+        identifiers.push([os.userInfo().username, "[user]"]);
+    }
+    catch {
+        // Same: no account name available means none can travel.
+    }
+    // A one- or two-character name would match far too much ordinary text.
+    return identifiers.filter(([value]) => value && value.length > 2);
+}
+function literalPattern(value) {
+    return new RegExp(value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), "giu");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.14",
+  "version": "0.2.15",
   "private": false,
   "type": "module",
   "bin": {