@bli-cockpit/cli 0.2.154 → 0.2.156

package/dist/evidence-stubs-client.js

@@ -0,0 +1,115 @@
+/**
+ * Asks `POST /api/ambient/evidence/stubs` which of this operator's stored
+ * transcripts are only the redaction-crash stub, and groups the answer by agent
+ * session (BLI-11102).
+ *
+ * A stub is a promise to come back, not a delivery: the local cursor recorded
+ * an upload, so nothing local would ever offer that session again. The server
+ * holds the label, so the server is asked. `cockpit backfill` re-offers every
+ * session this returns.
+ *
+ * Never throws. A door that cannot be asked (an older dashboard answers 404, a
+ * network error, a malformed page) returns `unavailable` with the reason, and
+ * the backfill runs exactly as it did before. That is also the release gate:
+ * the collector only ever sends a `stub_replaced` claim for a stub this door
+ * named, so it cannot send one to a server that does not know the rule.
+ *
+ * Bounded: pages of up to 500, at most `maxPages` of them, walked by the
+ * server's keyset cursor. The result says whether the list was exhausted,
+ * capped by `maxPages`, or cut short by a failed page after some landed.
+ */
+import { EVIDENCE_STUBS_MAX_PAGE, EVIDENCE_STUBS_SCHEMA_VERSION, EvidenceStubsResponseSchema, transcriptSessionFromObjectKey, } from "@bli-cockpit/telemetry-core";
+import { describeError } from "./health-detail.js";
+const STUBS_PAGE_TIMEOUT_MS = 15_000;
+export const STUBS_DEFAULT_MAX_PAGES = 20;
+export function stubSessionKey(source, sessionId) {
+    return `${source}:${sessionId}`;
+}
+export async function fetchStubbedSessions(options) {
+    const maxPages = options.maxPages ?? STUBS_DEFAULT_MAX_PAGES;
+    const sessions = new Map();
+    const seen = new Set();
+    let stubCount = 0;
+    let unkeyed = 0;
+    let pages = 0;
+    let after = null;
+    for (;;) {
+        if (pages >= maxPages) {
+            return finish("capped", "ok");
+        }
+        const page = await requestPage({ ...options, after });
+        if (!page.ok) {
+            return finish(pages === 0 ? "unavailable" : "failed_partial", page.reason);
+        }
+        pages += 1;
+        for (const stub of page.stubs) {
+            stubCount += 1;
+            if (seen.has(stub.ref_id))
+                continue;
+            seen.add(stub.ref_id);
+            const session = transcriptSessionFromObjectKey(stub.object_key);
+            if (!session) {
+                unkeyed += 1;
+                continue;
+            }
+            const key = stubSessionKey(session.source, session.session_id);
+            sessions.set(key, [...(sessions.get(key) ?? []), stub.raw_evidence_pointer_id]);
+        }
+        // Advance by what the server returned; a page that names no cursor is the last.
+        if (!page.nextAfter)
+            return finish("exhausted", "ok");
+        after = page.nextAfter;
+    }
+    function finish(status, reason) {
+        const result = {
+            status,
+            reason,
+            pages,
+            stub_count: stubCount,
+            unique_stub_count: seen.size,
+            unkeyed_stub_count: unkeyed,
+            sessions,
+        };
+        console.error("[collector stubs] redaction-crash stubs asked", JSON.stringify({
+            reason: status === "unavailable" ? `stub_door_unavailable:${reason}` : `stubs_${status}`,
+            pages,
+            stub_count: stubCount,
+            unique_stub_count: seen.size,
+            unkeyed_stub_count: unkeyed,
+            session_count: sessions.size,
+            ...(status === "failed_partial" ? { failure: reason } : {}),
+        }));
+        return result;
+    }
+}
+async function requestPage(options) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), STUBS_PAGE_TIMEOUT_MS);
+    try {
+        const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/evidence/stubs`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${options.deviceToken}`,
+            },
+            body: JSON.stringify({
+                schema_version: EVIDENCE_STUBS_SCHEMA_VERSION,
+                after: options.after,
+                limit: EVIDENCE_STUBS_MAX_PAGE,
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return { ok: false, reason: `http_${response.status}` };
+        const parsed = EvidenceStubsResponseSchema.safeParse(await response.json().catch(() => null));
+        if (!parsed.success)
+            return { ok: false, reason: "invalid_response" };
+        return { ok: true, stubs: parsed.data.stubs, nextAfter: parsed.data.next_after };
+    }
+    catch (error) {
+        return { ok: false, reason: describeError(error).error_name };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}

package/dist/log-rotation.js

@@ -37,9 +37,16 @@ import path from "node:path";
  * of a file operators can read. The tail is capped rather than copied whole, so
  * the archives cannot themselves become the disk problem — worst case on disk
  * is (keep + 1) x maxBytes per stream.
+ *
+ * BLI-11106 tightened the numbers: at most 2 archives and 20 MB of archive per
+ * stream (2 x 10 MiB), so both streams together never pass 60 MiB, live logs
+ * included. It was 3 x 20 MiB per stream (160 MiB worst case) and the
+ * reference Mac held 147 MB of it on 2026-09-30. An archive above the new keep
+ * window (`sync.log.3` on every machine that ran the old numbers) is swept on
+ * the first tick by `sweepOrphanedLogArchives` below.
  */
-export const DEFAULT_LOG_ROTATION_MAX_BYTES = 20 * 1024 * 1024;
-export const DEFAULT_LOG_ROTATION_KEEP = 3;
+export const DEFAULT_LOG_ROTATION_MAX_BYTES = 10 * 1024 * 1024;
+export const DEFAULT_LOG_ROTATION_KEEP = 2;
 /** The two files launchd writes for the scheduled tick. */
 export const ROTATED_LOG_NAMES = ["sync.log", "sync.err.log"];
 /**
@@ -129,27 +136,41 @@ async function rotateOne(filePath, maxBytes, keep) {
  * sentences and an operator is owed the second one.
  */
 export async function sweepOrphanedLogArchives(paths, options) {
+    const swept = [];
+    for (const archive of await orphanedLogArchives(paths, options)) {
+        const removed = await fs
+            .rm(path.join(paths.state_dir, archive.name), { force: true })
+            .then(() => true, () => false);
+        if (removed)
+            swept.push(archive);
+    }
+    return swept;
+}
+/**
+ * The archives the sweep above WOULD remove, without removing them — what
+ * `cockpit clean --dry-run` prints (BLI-11106). Same rule, one reader.
+ */
+export async function orphanedLogArchives(paths, options = {
+    keep: DEFAULT_LOG_ROTATION_KEEP,
+    names: ROTATED_LOG_NAMES,
+}) {
     const entries = await fs
         .readdir(paths.state_dir, { withFileTypes: true })
         .catch(() => []);
-    const swept = [];
+    const found = [];
     for (const entry of entries) {
         if (!entry.isFile())
             continue;
         const reason = orphanArchiveReason(entry.name, options);
         if (!reason)
             continue;
-        const file = path.join(paths.state_dir, entry.name);
         const size = await fs
-            .stat(file)
+            .stat(path.join(paths.state_dir, entry.name))
             .then((info) => info.size)
             .catch(() => 0);
-        const removed = await fs.rm(file, { force: true }).then(() => true, () => false);
-        if (!removed)
-            continue;
-        swept.push({ name: entry.name, byte_size: size, reason });
+        found.push({ name: entry.name, byte_size: size, reason });
     }
-    return swept;
+    return found;
 }
 /**
  * Which stream this file belongs to and why it is outside the keep window, or

package/dist/prune-receipt.js

@@ -0,0 +1,87 @@
+/**
+ * `last-prune.json`: when the staging prune last ran and what it freed
+ * (BLI-11106).
+ *
+ * The prune runs on every sync tick, so "did it run?" is answered by a file it
+ * overwrites, never by a file that grows. One small JSON object, bounded by
+ * construction. `cockpit doctor` and `cockpit status` read it for the
+ * footprint line ("last prune: <when>, freed <n> MB") without re-running the
+ * prune themselves.
+ *
+ * It also carries the last time a prune actually freed something, because on
+ * a healthy machine the newest run is usually `nothing_to_prune` and "freed
+ * 0 MB" on its own cannot tell a working drain from a stuck one.
+ *
+ * The old once-a-day throttle marker is removed on the first write: it gates
+ * nothing any more, and a file that gates nothing is exactly the kind of
+ * leftover this ticket exists to stop.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { describeError } from "./health-detail.js";
+export const LAST_PRUNE_FILE = "last-prune.json";
+/** The retired daily throttle marker; deleted on sight. */
+export const LEGACY_STAGING_PRUNE_MARKER = ".last-staging-prune";
+export async function readLastPruneReceipt(paths) {
+    const raw = await fs
+        .readFile(path.join(paths.state_dir, LAST_PRUNE_FILE), "utf8")
+        .catch(() => null);
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.at !== "string" || typeof parsed.reason !== "string") {
+            return null;
+        }
+        return {
+            at: parsed.at,
+            reason: parsed.reason,
+            freed_bytes: numberOr0(parsed.freed_bytes),
+            deleted_files: numberOr0(parsed.deleted_files),
+            bytes_scanned: numberOr0(parsed.bytes_scanned),
+            bytes_after: numberOr0(parsed.bytes_after),
+            last_freed_at: typeof parsed.last_freed_at === "string" ? parsed.last_freed_at : null,
+            last_freed_bytes: numberOr0(parsed.last_freed_bytes),
+        };
+    }
+    catch {
+        // A torn or hand-edited receipt reads as "never ran"; the next tick
+        // overwrites it. Doctor prints "last prune: never" rather than guessing.
+        return null;
+    }
+}
+/** Never throws: a receipt that cannot be written is a log line, not a failed tick. */
+export async function writeLastPruneReceipt(paths, result, now) {
+    try {
+        const previous = await readLastPruneReceipt(paths);
+        const freed = result.deleted_bytes > 0;
+        const receipt = {
+            at: now.toISOString(),
+            reason: result.reason,
+            freed_bytes: result.deleted_bytes,
+            deleted_files: result.deleted_files,
+            bytes_scanned: result.bytes_before,
+            bytes_after: result.bytes_after,
+            last_freed_at: freed ? now.toISOString() : (previous?.last_freed_at ?? null),
+            last_freed_bytes: freed
+                ? result.deleted_bytes
+                : (previous?.last_freed_bytes ?? 0),
+        };
+        await fs.mkdir(paths.state_dir, { recursive: true });
+        const file = path.join(paths.state_dir, LAST_PRUNE_FILE);
+        const temp = `${file}.${process.pid}.tmp`;
+        await fs.writeFile(temp, `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+        await fs.rename(temp, file);
+        await fs
+            .rm(path.join(paths.state_dir, LEGACY_STAGING_PRUNE_MARKER), { force: true })
+            .catch(() => undefined);
+    }
+    catch (error) {
+        console.error("[collector prune] could not record the last-prune receipt", JSON.stringify({ reason: "last_prune_write_failed", ...describeError(error) }));
+    }
+}
+function numberOr0(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0
+        ? value
+        : 0;
+}

package/dist/raw-evidence-gc.js

@@ -10,27 +10,33 @@ const RAW_EVIDENCE_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
  * observed on the fleet is minutes, not hours.
  */
 const STAGING_ORPHAN_MS = 6 * 60 * 60 * 1000;
-// GC hashes every file in every old-but-kept dir to confirm uploads. Running
-// that on each 15-min sync would re-read the same gigabytes ~96x/day on
-// machines with unconfirmed evidence, so GC is throttled to once per day.
-const GC_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
+/**
+ * The retired once-a-day throttle marker (BLI-11106). The GC runs every tick
+ * now, and deletes this file on sight so it stops being state nobody reads.
+ *
+ * Why every tick is affordable: the GC used to hash every file of every old
+ * pack to confirm it was uploaded, which re-read gigabytes on a machine with
+ * unconfirmed evidence. It now asks the pack's own `manifest.json` first, and a
+ * pack whose manifest names ANY hash the ledger has not committed is skipped
+ * without reading a payload byte. Only a pack the manifest says is fully
+ * committed is hashed, once, on the way to being deleted.
+ */
+export const LEGACY_GC_THROTTLE_MARKER = ".last-raw-evidence-gc";
 export async function runRawEvidenceLocalGc(paths, env = process.env, now = new Date()) {
     if (env["COCKPIT_DISABLE_GC"] === "1") {
         return { skipped: true, removed_dirs: 0, freed_bytes: 0 };
     }
-    const throttleMarker = path.join(paths.state_dir, ".last-raw-evidence-gc");
-    const lastRun = await fs.stat(throttleMarker).catch(() => null);
-    if (lastRun && now.getTime() - lastRun.mtimeMs < GC_MIN_INTERVAL_MS) {
-        return { skipped: true, removed_dirs: 0, freed_bytes: 0 };
-    }
-    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
-    await fs.writeFile(throttleMarker, now.toISOString()).catch(() => undefined);
+    await fs
+        .rm(path.join(paths.state_dir, LEGACY_GC_THROTTLE_MARKER), { force: true })
+        .catch(() => undefined);
     const cursor = await readRawEvidenceCursor(paths);
     const uploadedHashes = new Set(Object.keys(cursor.objects));
     const rawEvidenceRoot = path.join(paths.state_dir, "raw-evidence");
     const entries = await fs.readdir(rawEvidenceRoot, { withFileTypes: true }).catch(() => []);
     let removedDirs = 0;
     let freedBytes = 0;
+    let scannedDirs = 0;
+    let skippedByManifest = 0;
     for (const entry of entries) {
         if (!entry.isDirectory() || !entry.name.startsWith("work-"))
             continue;
@@ -40,6 +46,11 @@ export async function runRawEvidenceLocalGc(paths, env = process.env, now = new
             continue;
         if (now.getTime() - dirStats.mtimeMs < RAW_EVIDENCE_RETENTION_MS)
             continue;
+        scannedDirs += 1;
+        if (await manifestNamesUncommitted(dir, uploadedHashes)) {
+            skippedByManifest += 1;
+            continue;
+        }
         const inspection = await inspectRawEvidenceDirForGc(dir, uploadedHashes);
         if (!inspection.deletable)
             continue;
@@ -50,12 +61,18 @@ export async function runRawEvidenceLocalGc(paths, env = process.env, now = new
         freedBytes += inspection.byteSize;
     }
     // Log capping used to live here, and that is why it did not work: this GC
-    // is throttled to once a day and skipped entirely by COCKPIT_DISABLE_GC,
+    // was throttled to once a day and is skipped entirely by COCKPIT_DISABLE_GC,
     // while sync.log grows ~8 MB an hour on an active machine (measured on the
     // reference Mac, 2026-09-04: 219,866,695 bytes with the last GC 19 hours
-    // earlier). A daily truncate-to-zero of a file that reaches ~190 MB a day is
-    // not a cap, and sync.err.log had no cap at all. One owner now, running in
-    // the tick preamble: log-rotation.ts (BLI-3553).
+    // earlier). One owner now, running in the tick preamble: log-rotation.ts
+    // (BLI-3553).
+    console.error("[raw-evidence] gc sweep", JSON.stringify({
+        reason: removedDirs > 0 ? "gc_removed" : "nothing_to_prune",
+        scanned_dirs: scannedDirs,
+        skipped_by_manifest: skippedByManifest,
+        removed_dirs: removedDirs,
+        freed_bytes: freedBytes,
+    }));
     return {
         skipped: false,
         removed_dirs: removedDirs,
@@ -241,6 +258,29 @@ async function dirByteSize(dir) {
     }
     return total;
 }
+/**
+ * True when the pack's own manifest names a content hash the ledger has not
+ * committed, so the pack cannot be deleted and no payload needs reading. A
+ * missing or unreadable manifest answers false and falls through to the full
+ * hash check, which is the old, conservative path.
+ */
+async function manifestNamesUncommitted(dir, uploadedHashes) {
+    const manifest = await fs
+        .readFile(path.join(dir, "manifest.json"), "utf8")
+        .catch(() => null);
+    if (!manifest)
+        return false;
+    try {
+        const parsed = JSON.parse(manifest);
+        return (parsed.files ?? []).some((file) => typeof file.content_hash_sha256 === "string" &&
+            !uploadedHashes.has(file.content_hash_sha256));
+    }
+    catch {
+        // Not silent in effect: an unparseable manifest falls through to the full
+        // per-file hash check below, which decides on the bytes themselves.
+        return false;
+    }
+}
 async function inspectRawEvidenceDirForGc(dir, uploadedHashes) {
     const files = await listFiles(dir).catch(() => null);
     if (!files)

package/dist/state-dir-audit.js

@@ -0,0 +1,138 @@
+/**
+ * Everything the collector's state directory holds, sorted into who owns it
+ * and what bounds it (BLI-11106).
+ *
+ * `~/.local/state/bli-cockpit` (Windows: `%USERPROFILE%\.local\state\bli-cockpit`,
+ * the same layout with backslashes) is where the collector keeps its state.
+ * By 2026-09-30 it also held a gigabyte of study artifacts written by agents
+ * running benches and experiments (`memory-bench`, `memory-extract-*`,
+ * `chat-model-bench`, …). Those are not the collector's, the collector never
+ * reads them, and counting them as its footprint made `cockpit doctor`
+ * alarm about bytes no prune could ever explain.
+ *
+ * The rule: study artifacts belong in the SIBLING root
+ * `~/.local/state/bli-cockpit-studies` (same parent, same layout on Windows),
+ * see `studiesStateDir`. Existing study folders already under the state dir are
+ * recognised by name, left exactly where they are, and not counted. Anything
+ * the table below does not recognise is counted as `other`, so a new
+ * collector file that nobody registered still shows up in the footprint
+ * rather than hiding.
+ *
+ * Every collector entry carries the one-line reason it is bounded; the
+ * runbook (`docs/runbooks/cockpit-launchd-sync.md`, "What the state
+ * directory holds") prints the same table. Metadata only: entry names are
+ * fixed strings, never a person's path.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { directoryBytes } from "./disk-usage-files.js";
+/** The sibling root where agent-written studies live, never under the collector. */
+export const STUDIES_DIR_SUFFIX = "-studies";
+/**
+ * The collector's own entries first (checked before the study prefixes), then
+ * the studies. Order matters only where a study prefix could shadow a
+ * collector name; none does today, and the test pins that.
+ */
+export const STATE_DIR_RULES = [
+    { name: "raw-evidence", match: "exact", class: "staging", bound: "staged copies go the tick the server commits them; 256 MiB cap; uncommitted evidence is never deleted, only counted" },
+    { name: "sync.log", match: "prefix", class: "logs", bound: "rotated every tick at 10 MiB, at most 2 archives (20 MB) per stream" },
+    { name: "sync.err.log", match: "prefix", class: "logs", bound: "rotated every tick at 10 MiB, at most 2 archives (20 MB) per stream" },
+    { name: "spool", match: "exact", class: "spool", bound: "upload queue; each entry is deleted once the ingest door accepts it" },
+    { name: "cursors", match: "exact", class: "state", bound: "raw-evidence ledger and reconcile answers capped at 5,000 rows each; backfill cursors one small file each" },
+    { name: "raw-evidence-staging.json", match: "exact", class: "state", bound: "staged-object index and delivery attempts capped at 5,000 rows each" },
+    { name: "work-contexts", match: "exact", class: "state", bound: "one small file per worktree ever bound with `cockpit start`; overwritten, not pruned (a few KB each)" },
+    { name: "active-work-context.json", match: "exact", class: "state", bound: "one file, overwritten" },
+    { name: "root-work-scan.json", match: "exact", class: "state", bound: "one file, overwritten by each root scan" },
+    { name: "setup-receipt.json", match: "exact", class: "state", bound: "one file, overwritten" },
+    { name: "memory-install-receipt.json", match: "exact", class: "state", bound: "one file, overwritten" },
+    { name: "last-prune.json", match: "exact", class: "state", bound: "one file, overwritten every tick" },
+    { name: "last-turn-trace.json", match: "exact", class: "state", bound: "one file, overwritten" },
+    { name: "sync.lock", match: "exact", class: "state", bound: "lock file, removed when the tick ends" },
+    { name: "backfill.lock", match: "exact", class: "state", bound: "lock file, removed when the backfill ends" },
+    { name: ".last-", match: "prefix", class: "state", bound: "24-byte throttle markers for self-update, autostart repair and the memory install" },
+    { name: "read-cache", match: "exact", class: "state", bound: "one response file per distinct Tower read, overwritten on refresh" },
+    { name: "memory-hook-stats.json", match: "exact", class: "state", bound: "fixed-size histograms, overwritten (BLI Memory hooks)" },
+    { name: "memory-hook-samples", match: "exact", class: "state", bound: "hourly content-free timing samples (BLI Memory hooks); not yet pruned, a few MB a week" },
+    { name: "memory-recall-seen", match: "exact", class: "state", bound: "one file per agent session, deleted after 7 days (BLI Memory hooks)" },
+    { name: "memory-stop-anchors.json", match: "exact", class: "state", bound: "one offset per transcript, overwritten (BLI Memory hooks)" },
+    { name: "memory-daemon-spawn.json", match: "exact", class: "state", bound: "one spawn stamp, overwritten (BLI Memory daemon)" },
+    { name: "memory-daemon.sock", match: "exact", class: "state", bound: "the daemon's socket, zero bytes" },
+    // Studies written by agents and scripts, not by the collector. Counted by
+    // name only, never sized, never deleted.
+    { name: "memory-bench", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-extract-", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-questions", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-hook-context-sweep", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-anchor-probe", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-dup-threshold", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-judge-effort", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-recurrence-backfill", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-supersede-from-record", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-reconcile-precision", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-harvest-dedup", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "chat-model-bench", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "gpt6-bench-", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "manual-study-evidence-vault", match: "prefix", class: "study", bound: "hand-made evidence vault; `cockpit clean --all-committed` removes it once every file is committed" },
+    { name: "issue-import", match: "exact", class: "study", bound: "one-off import receipts; belongs in bli-cockpit-studies" },
+    { name: "analysis", match: "exact", class: "study", bound: "local harvest-analysis output; belongs in bli-cockpit-studies" },
+    { name: "task-type-backlog", match: "prefix", class: "study", bound: "local harvest-analysis output; belongs in bli-cockpit-studies" },
+];
+/** Which rule an entry name falls under, or null for `other`. */
+export function classifyStateEntry(name) {
+    for (const rule of STATE_DIR_RULES) {
+        if (rule.match === "exact" ? name === rule.name : name.startsWith(rule.name)) {
+            return rule;
+        }
+    }
+    return null;
+}
+/**
+ * The sibling studies root, on either host family: the state dir's own path
+ * with `-studies` appended, so `/Users/x/.local/state/bli-cockpit` becomes
+ * `/Users/x/.local/state/bli-cockpit-studies` and
+ * `C:\Users\x\.local\state\bli-cockpit` becomes
+ * `C:\Users\x\.local\state\bli-cockpit-studies`. No separator is joined, so
+ * neither layout can be spelled wrong.
+ */
+export function studiesStateDir(paths) {
+    return `${paths.state_dir.replace(/[\\/]+$/u, "")}${STUDIES_DIR_SUFFIX}`;
+}
+/**
+ * Sizes the `state` and `other` entries of the state directory. Staging,
+ * logs and spool are measured by their own readers and skipped here; studies
+ * are counted but never walked, because a gigabyte of somebody's bench run is
+ * not worth a stat per file on every doctor call.
+ */
+export async function readStateDirFootprint(paths) {
+    const footprint = {
+        state_bytes: 0,
+        other_bytes: 0,
+        other_entries: 0,
+        study_entries: 0,
+    };
+    const entries = await fs
+        .readdir(paths.state_dir, { withFileTypes: true })
+        .catch(() => []);
+    for (const entry of entries) {
+        const rule = classifyStateEntry(entry.name);
+        const cls = rule?.class ?? "other";
+        if (cls === "staging" || cls === "logs" || cls === "spool")
+            continue;
+        if (cls === "study") {
+            footprint.study_entries += 1;
+            continue;
+        }
+        const full = path.join(paths.state_dir, entry.name);
+        const bytes = entry.isDirectory()
+            ? await directoryBytes(full)
+            : await fs.stat(full).then((info) => info.size, () => 0);
+        if (cls === "state") {
+            footprint.state_bytes += bytes;
+        }
+        else {
+            footprint.other_bytes += bytes;
+            footprint.other_entries += 1;
+        }
+    }
+    return footprint;
+}

package/dist/upload-envelope-build.js

@@ -125,6 +125,7 @@ export async function buildLocalAmbientEnvelope(options = {}) {
             operatorId: session.operator_id,
             workContextId: uploadContext.work_context_id,
         })),
+        rawEvidenceStubReoffers: options.rawEvidenceStubReoffers,
         rawEvidenceByteBudget: options.rawEvidenceByteBudget,
         rawEvidenceObjectBudget: options.rawEvidenceObjectBudget,
         rawEvidenceBudget: options.rawEvidenceBudget,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.154",
+  "version": "0.2.156",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,8 +27,8 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.41",
-    "@bli-cockpit/mcp": "0.1.75",
-    "@bli-cockpit/telemetry-core": "0.1.53"
+    "@bli-cockpit/memory-mcp": "0.1.42",
+    "@bli-cockpit/mcp": "0.1.76",
+    "@bli-cockpit/telemetry-core": "0.1.54"
   }
 }