@bli-cockpit/cli 0.2.155 → 0.2.157

package/dist/adapters/local-sources.js

@@ -35,6 +35,7 @@ export async function runLocalSourceCollectors(options) {
             claudeAttributionScan: options.rawEvidenceClaudeAttributionScan,
             skipContentHashes: options.rawEvidenceSkipContentHashes,
             priorSnapshots: options.rawEvidencePriorSnapshots,
+            stubReoffers: options.rawEvidenceStubReoffers,
             byteBudget: options.rawEvidenceByteBudget,
             objectBudget: options.rawEvidenceObjectBudget,
             budget: options.rawEvidenceBudget,

package/dist/adapters/raw-evidence-collection-state.js

@@ -74,6 +74,7 @@ export async function openCollection(context, options, places) {
         caps: startingCaps({ byteBudget, objectBudget, budget: options.budget }),
         skipContentHashes: options.skipContentHashes ?? new Set(),
         priorSnapshots: options.priorSnapshots ?? new Map(),
+        stubReoffers: options.stubReoffers ?? new Map(),
         budget: options.budget ?? {
             remainingBytes: byteBudget,
             remainingObjects: objectBudget,

package/dist/adapters/raw-evidence-snapshot-supersede.js

@@ -20,6 +20,7 @@
  * says so: `snapshot_rewritten`, both sizes, and the byte range the first
  * difference falls in. Never content.
  */
+import { REDACTION_STUB_LABEL } from "@bli-cockpit/telemetry-core";
 import { firstDifferenceRange, isPrefixSuccessor, prefixCheckpoints, } from "@bli-cockpit/telemetry-core/snapshot-supersede";
 /**
  * The newest committed snapshot per source key, from the cursor's objects map,
@@ -79,4 +80,32 @@ export function supersedeClaimFor(options) {
         first_differing_offset_below: range.below,
     }));
     return null;
+}
+/**
+ * BLI-11102: the claim a re-offered transcript makes when the server named its
+ * stored copy a redaction-crash stub. Only a main transcript that redacted
+ * cleanly this time claims; one that stubbed again claims nothing and keeps
+ * the ordinary path. Logs the decision either way.
+ */
+export function stubReplacementClaim(options) {
+    if (!options.stubPointerId || (options.kind !== "codex_jsonl" && options.kind !== "claude_jsonl"))
+        return null;
+    if (options.completenessLabel === REDACTION_STUB_LABEL) {
+        console.error("[evidence-upload] stubbed session re-offered but it stubbed again; no claim", JSON.stringify({
+            reason: "stub_reoffer_still_stubbed",
+            kind: options.kind,
+            byte_size: options.byteSize,
+        }));
+        return null;
+    }
+    console.error("[evidence-upload] stubbed session re-offered; claiming to replace the stub", JSON.stringify({
+        reason: "stub_reoffered",
+        rule: "stub_replaced",
+        kind: options.kind,
+        byte_size: options.byteSize,
+        // The same bytes may already be durable (a later sync healed it without
+        // knowing about the stub); they are staged anyway so the claim has a carrier.
+        already_durable: options.alreadyDurable,
+    }));
+    return { pointer_id: options.stubPointerId, rule: "stub_replaced" };
 }

package/dist/adapters/raw-evidence-transcript-file.js

@@ -19,7 +19,7 @@ import { isSecretLikePath, sha256, shortHash, } from "./raw-evidence-keys.js";
 import { maskSecretsInTranscript, } from "./raw-evidence-sanitize.js";
 import { markBudgetCapApplied, markCapApplied, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
-import { describeSnapshot, supersedeClaimFor } from "./raw-evidence-snapshot-supersede.js";
+import { describeSnapshot, stubReplacementClaim, supersedeClaimFor, } from "./raw-evidence-snapshot-supersede.js";
 import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
@@ -64,7 +64,16 @@ export async function collectOneEvidenceFile(collection, options) {
         secretLikeFileName: names.secretLikeFileName,
     });
     const contentHash = sha256(sanitized.bytes);
-    if (collection.skipContentHashes.has(contentHash)) {
+    // BLI-11102: a session the server named a redaction stub is re-offered even
+    // when these bytes are already durable, because the stub is not a delivery.
+    const stubClaim = stubReplacementClaim({
+        kind: options.kind,
+        stubPointerId: collection.stubReoffers.get(options.sessionId),
+        completenessLabel: sanitized.completenessLabel,
+        byteSize: sanitized.bytes.byteLength,
+        alreadyDurable: collection.skipContentHashes.has(contentHash),
+    });
+    if (collection.skipContentHashes.has(contentHash) && !stubClaim) {
         collection.reused.push({
             kind: options.kind,
             label: names.evidenceLabel,
@@ -83,6 +92,7 @@ export async function collectOneEvidenceFile(collection, options) {
         names,
         sanitized,
         contentHash,
+        stubClaim,
     });
     return true;
 }
@@ -139,7 +149,7 @@ async function stageOneTranscript(collection, file) {
         // BLI-11088: remember this snapshot's shape, and claim the last one when
         // these bytes rebuild it.
         snapshot: describeSnapshot(file.sanitized.bytes),
-        supersedes: supersedeClaimFor({
+        supersedes: file.stubClaim ?? supersedeClaimFor({
             bytes: file.sanitized.bytes,
             contentHash: file.contentHash,
             kind: file.kind,

package/dist/commands/backfill-checkpoint.js

@@ -21,6 +21,7 @@ import { indexDurableMainObjectKeys } from "./backfill-evidence-outcomes.js";
 export async function recordBackfillDurableSessionPointers(options) {
     const durableObjectBySession = indexDurableMainObjectKeys(options.syncResults);
     let recordedCount = 0;
+    let stubsReplaced = 0;
     for (const source of ["codex", "claude_code"]) {
         const filename = source === "claude_code" ? CLAUDE_CURSOR_FILENAME : undefined;
         const cursor = await readRawEvidenceCursor(options.paths, { filename });
@@ -31,8 +32,13 @@ export async function recordBackfillDurableSessionPointers(options) {
             const objectKey = durableObjectBySession.get(`${source}:${candidate.session_id}`);
             const prior = cursor.sessions[candidate.session_id];
             // No pointer, no prior entry, or already pointed: nothing this pass owes.
-            if (!objectKey || !prior || prior.uploaded_object_key)
+            // BLI-11102: a pointer the server named a redaction stub is not a
+            // delivery, so a real pointer replaces it and the mark clears.
+            const replacesStub = Boolean(prior?.stub_reoffer) && prior?.uploaded_object_key !== objectKey;
+            if (!objectKey || !prior || (prior.uploaded_object_key && !replacesStub))
                 continue;
+            if (replacesStub)
+                stubsReplaced += 1;
             cursor.sessions[candidate.session_id] = deliveredCursorEntry(prior, candidate, objectKey, options.now);
             changed = true;
             recordedCount += 1;
@@ -45,12 +51,12 @@ export async function recordBackfillDurableSessionPointers(options) {
         }
     }
     if (recordedCount > 0) {
-        console.error("[backfill] terminal session pointers recorded", JSON.stringify({ count: recordedCount }));
+        console.error("[backfill] terminal session pointers recorded", JSON.stringify({ count: recordedCount, stub_pointers_replaced: stubsReplaced }));
     }
 }
 /** The cursor entry for a session backfill has just delivered in full. */
 function deliveredCursorEntry(prior, candidate, objectKey, now) {
-    return {
+    const entry = {
         ...prior,
         file_hash_sha256: candidate.content_hash_sha256,
         file_mtime_ms: candidate.session_file_mtime_ms,
@@ -65,6 +71,9 @@ function deliveredCursorEntry(prior, candidate, objectKey, now) {
         uploaded_byte_size: candidate.byte_size,
         last_seen_at: now.toISOString(),
     };
+    // The mark says "this pointer is a stub"; the pointer written above is not.
+    delete entry.stub_reoffer;
+    return entry;
 }
 export function advanceBackfillCursorThroughResolvedPrefix(options) {
     if (!options.discoveryComplete)

package/dist/commands/backfill-report.js

@@ -7,6 +7,7 @@ import { advanceBackfillCursorThroughResolvedPrefix, recordBackfillDurableSessio
 import { blockingScanIssues, cappedSidecarCount } from "./backfill-issues.js";
 import { backfillResultBaseArgs, baseBackfillResult, emptyReport, } from "./backfill-result.js";
 import { buildBackfillSessionReport } from "./backfill-session-report.js";
+import { summarizeStubReoffer } from "./backfill-stub-reoffer.js";
 /**
  * REPORT: post the session report, record durable pointers, advance the
  * cursor through the resolved contiguous prefix, decide completion, write the
@@ -25,7 +26,11 @@ export async function reportBackfillOutcome(command, io, ctx, upload) {
         failureReason ??= sessionReportFailureReason(posted);
     }
     if (posted.acknowledged) {
-        await checkpointResolvedBackfillProgress(ctx, upload);
+        // BLI-11112: the sync's stub pass saw only stubbed sessions, so it records
+        // their pointers and never moves the history cursor past anything else.
+        await checkpointResolvedBackfillProgress(ctx, upload, {
+            advanceCursor: !command.stubPass,
+        });
     }
     const completion = summarizeBackfillCompletion({
         ctx,
@@ -34,17 +39,22 @@ export async function reportBackfillOutcome(command, io, ctx, upload) {
         stoppedEarly: Boolean(blockedAt),
         failureReason,
     });
-    if (completion.status === "complete" && command.all) {
+    if (completion.status === "complete" && command.all && !command.stubPass) {
         await writeAllHistoryCompletionMarker(ctx);
     }
-    return assembleBackfillResult({
-        command,
-        ctx,
-        upload,
-        posted,
-        completion,
-        blockedAt,
-    });
+    return {
+        ...assembleBackfillResult({
+            command,
+            ctx,
+            upload,
+            posted,
+            completion,
+            blockedAt,
+        }),
+        stub_reoffer: summarizeStubReoffer(ctx.stubReoffer, upload.uploadable, posted.acknowledged ? upload.durableCandidateKeys : new Set(), 
+        // One sync result per batch the loop reached; a stopped run reached fewer.
+        upload.batches.slice(0, upload.syncResults.length).flatMap((batch) => batch.candidates)),
+    };
 }
 /**
  * Tells the server what this run observed about every session, uploaded or
@@ -110,7 +120,7 @@ function sessionReportFailureReason(posted) {
  * both writes wait on the report acknowledgement, because a cursor advanced
  * past a session the server never recorded can never be walked back.
  */
-async function checkpointResolvedBackfillProgress(ctx, upload) {
+async function checkpointResolvedBackfillProgress(ctx, upload, options) {
     const { paths, scan, cursor, now, deterministicSkipCandidateKeys } = ctx;
     if (upload.durableCandidateKeys.size > 0) {
         await recordBackfillDurableSessionPointers({
@@ -120,6 +130,8 @@ async function checkpointResolvedBackfillProgress(ctx, upload) {
             now,
         });
     }
+    if (!options.advanceCursor)
+        return;
     const cursorAdvanced = advanceBackfillCursorThroughResolvedPrefix({
         cursor,
         candidates: scan.candidates,

package/dist/commands/backfill-scan.js

@@ -20,7 +20,9 @@ import { addReadOnlyGuardIssues, addRepoDiscoveryIssues, backfillScanIssues, cou
 import { labelOutsideRootCandidates, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { reasonCountsFor } from "./backfill-reasons.js";
 import { blockedBackfillResult } from "./backfill-result.js";
+import { emptyStubReofferPlan, loadStubReofferPlan, reopenStubbedSessions, } from "./backfill-stub-reoffer.js";
 import { resolveBackfillScope } from "./backfill-scope.js";
+import { stubSessionKey } from "../evidence-stubs-client.js";
 /**
  * SCAN: is this machine paired, what roots/sources/window apply, and what did
  * the archived Codex + Claude session stores actually contain. Returns either
@@ -47,6 +49,21 @@ export async function scanBackfillRun(command, io, now) {
     const scopedCursor = prepareBackfillCursorForScope(storedCursor, collectionRoots, sources);
     const cursor = scopedCursor.cursor;
     const pointerlessTerminalSessions = await loadPointerlessTerminalSessions(paths, sources);
+    // BLI-11102: a redaction-crash stub is not a delivery. The server names
+    // them; those sessions reopen exactly like pointer-less ones. A dry run
+    // keeps its one-request contract (the reachability probe) and does not ask.
+    // BLI-11112: the sync's stub pass brings the door's answer with it.
+    const stubReoffer = command.stubPass
+        ? command.stubPass.plan
+        : command.dryRun
+            ? emptyStubReofferPlan("dry_run")
+            : await loadStubReofferPlan({
+                paths,
+                dashboardUrl: scope.dashboardUrl,
+                sources,
+                fetchImpl: io.fetch,
+            });
+    reopenStubbedSessions(pointerlessTerminalSessions, stubReoffer);
     const scan = await scanBackfillSessions({
         command,
         homeDir: command.homeDir ?? os.homedir(),
@@ -73,6 +90,7 @@ export async function scanBackfillRun(command, io, now) {
         cursor,
         scan,
         reasonCounts,
+        stubReoffer,
         oversizedCandidateKeys: oversizedBackfillCandidateKeys(scan.candidates),
         deterministicSkipCandidateKeys: deterministicSkipCandidateKeys(scan.candidates),
     };
@@ -117,6 +135,9 @@ async function scanBackfillSessions(options) {
         cursor: options.cursor,
         pointerlessTerminalSessions: options.pointerlessTerminalSessions,
         maxFiles: options.command.maxFiles,
+        onlySessions: options.command.stubPass
+            ? new Set(options.command.stubPass.plan.sessions.keys())
+            : undefined,
     });
     // BLI-11091: a session outside every approved root is labelled, not
     // refused. It rides the synthetic outside-roots workspace from here on, so
@@ -184,6 +205,8 @@ function selectBackfillCandidates(options) {
         ...(options.codexAttribution?.results.map(normalizeCodexCandidate) ?? []),
         ...(options.claudeAttribution?.results.map(normalizeClaudeCandidate) ?? []),
     ]
+        .filter((candidate) => !options.onlySessions ||
+        options.onlySessions.has(stubSessionKey(candidate.source, candidate.session_id)))
         .filter((candidate) => isAfterCursor(candidate, options.cursor) ||
         isPointerlessTerminalRetry(candidate, options.pointerlessTerminalSessions))
         .sort((a, b) => compareBackfillCandidatesForRetry(a, b, options.pointerlessTerminalSessions));

package/dist/commands/backfill-stub-reoffer.js

@@ -0,0 +1,109 @@
+import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, writeRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { fetchStubbedSessions, stubSessionKey } from "../evidence-stubs-client.js";
+import { describeError } from "../health-detail.js";
+import { readLocalCollectorSessionFile } from "../local-state.js";
+import { candidateCursorKey } from "./backfill-candidates.js";
+export function emptyStubReofferPlan(reason) {
+    return { status: "skipped", reason, sessions: new Map(), stub_count: 0, marked_local_sessions: 0 };
+}
+/** Ask the server which of this operator's pointers are stubs. Never throws; writes nothing. */
+export async function loadStubReofferPlan(options) {
+    const session = await readLocalCollectorSessionFile(options.paths).catch(() => null);
+    if (!session || session.session_state !== "valid" || typeof session.device_token !== "string" || !session.device_token) {
+        console.error("[backfill] redaction stubs not asked", JSON.stringify({ reason: "no_device_session" }));
+        return emptyStubReofferPlan("no_device_session");
+    }
+    const answer = await fetchStubbedSessions({
+        dashboardUrl: options.dashboardUrl,
+        deviceToken: session.device_token,
+        fetchImpl: options.fetchImpl,
+    });
+    const sessions = new Map([...answer.sessions].filter(([key]) => options.sources.some((source) => key.startsWith(`${source}:`))));
+    return {
+        status: answer.status,
+        reason: answer.reason,
+        sessions,
+        stub_count: answer.unique_stub_count,
+        marked_local_sessions: 0,
+    };
+}
+/**
+ * Mark every stubbed session this machine tracks as not delivered. The caller
+ * holds the collection lock: sync writes the same cursor files.
+ */
+export async function markStubReoffers(paths, plan, now) {
+    if (plan.sessions.size === 0)
+        return;
+    plan.marked_local_sessions = await markStubbedSessions(paths, plan.sessions, now);
+}
+/** Reopen stubbed sessions exactly like pointer-less ones: selected past the cursor, sorted first. */
+export function reopenStubbedSessions(reopen, plan) {
+    for (const key of plan.sessions.keys()) {
+        const at = key.indexOf(":");
+        const source = key.slice(0, at);
+        reopen[source]?.add(key.slice(at + 1));
+    }
+}
+/** Session id -> the stub pointer the new upload claims to replace (the server retires the rest). */
+export function stubClaimsForCandidates(candidates, plan) {
+    const claims = new Map();
+    for (const candidate of candidates) {
+        const pointer = plan.sessions.get(stubSessionKey(candidate.source, candidate.session_id))?.[0];
+        if (pointer)
+            claims.set(candidate.session_id, pointer);
+    }
+    return claims;
+}
+export function summarizeStubReoffer(plan, candidates, durableCandidateKeys = new Set(), attempted = candidates) {
+    const offered = candidates.filter((candidate) => plan.sessions.has(stubSessionKey(candidate.source, candidate.session_id)));
+    const stubsOf = (list) => list.reduce((total, candidate) => total + (plan.sessions.get(stubSessionKey(candidate.source, candidate.session_id))?.length ?? 0), 0);
+    const reoffered = offered.length;
+    const summary = {
+        status: plan.status,
+        reason: plan.reason,
+        stubs: plan.stub_count,
+        sessions: plan.sessions.size,
+        marked_local_sessions: plan.marked_local_sessions,
+        reoffered_sessions: reoffered,
+        reoffered_stubs: stubsOf(offered.filter((candidate) => attempted.includes(candidate))),
+        replaced_stubs: stubsOf(offered.filter((candidate) => durableCandidateKeys.has(candidateCursorKey(candidate)))),
+    };
+    if (plan.sessions.size > 0) {
+        console.error("[backfill] redaction-stubbed sessions re-offered", JSON.stringify({
+            ...summary,
+            reason: "stub_reoffered",
+            stub_door: `${summary.status}:${summary.reason}`,
+            // Stubbed on the server, but no file for it in this run's scan window.
+            not_found_locally: plan.sessions.size - reoffered,
+        }));
+    }
+    return summary;
+}
+async function markStubbedSessions(paths, sessions, now) {
+    let marked = 0;
+    for (const source of ["codex", "claude_code"]) {
+        const filename = source === "claude_code" ? CLAUDE_CURSOR_FILENAME : undefined;
+        try {
+            const cursor = await readRawEvidenceCursor(paths, { filename });
+            let changed = false;
+            for (const [key, pointerIds] of sessions) {
+                if (!key.startsWith(`${source}:`))
+                    continue;
+                const entry = cursor.sessions[key.slice(source.length + 1)];
+                if (!entry)
+                    continue;
+                entry.stub_reoffer = { reason: "stub_reoffered", stub_pointer_ids: pointerIds, marked_at: now.toISOString() };
+                changed = true;
+                marked += 1;
+            }
+            if (changed) {
+                await writeRawEvidenceCursor(paths, cursor, { filename, sessionsOnly: source === "claude_code" });
+            }
+        }
+        catch (error) {
+            // The mark is bookkeeping; the server's answer still drives this run.
+            console.error("[backfill] stub mark not written to the cursor", JSON.stringify({ reason: "stub_mark_write_failed", source, ...describeError(error) }));
+        }
+    }
+    return marked;
+}

package/dist/commands/backfill-upload.js

@@ -7,6 +7,7 @@ import { countSessionUploadFailures, deferredEvidenceCount, durableBackfillCandi
 import { blockingScanIssues } from "./backfill-issues.js";
 import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { writeLine } from "./backfill-output.js";
+import { stubClaimsForCandidates } from "./backfill-stub-reoffer.js";
 const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
 /**
  * UPLOAD: sync every uploadable candidate in fixed-size batches, heartbeating
@@ -19,10 +20,11 @@ const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
  */
 export async function uploadBackfillBatches(command, io, lock, ctx) {
     const uploadable = uploadableCandidates(ctx.scan.candidates);
-    // Doctor needs a boundary after each session. Ordinary backfill retains
-    // its existing batching, and scheduled sync does not use this command.
+    // Doctor needs a boundary after each session, and so does the scheduled
+    // sync's stub pass (BLI-11112), which hands the lock to a waiting backfill
+    // at the next one. Ordinary backfill retains its existing batching.
     const plannedBatches = buildBackfillBatches(uploadable);
-    const batches = command.deadlineMs !== undefined || command.onProgress
+    const batches = command.deadlineMs !== undefined || command.onProgress || command.stubPass
         ? plannedBatches.flatMap((batch) => batch.candidates.map((candidate) => ({
             worktree: batch.worktree, candidates: [candidate],
         })))
@@ -71,6 +73,12 @@ export async function uploadBackfillBatches(command, io, lock, ctx) {
             failureReason = "deferred_budget_exhausted";
             break;
         }
+        if (command.stubPass?.shouldYield && (await command.stubPass.shouldYield())) {
+            blockedAt = stoppedAt("yielded to a waiting backfill", index);
+            failureReason = "yielded_to_backfill";
+            console.error("[collector stubs] stub pass yielded the collection lock to a waiting backfill", JSON.stringify({ reason: "backfill_waiting", sessions_done: index, sessions_left: batches.length - index }));
+            break;
+        }
         const outcome = await uploadOneBackfillBatch(command, io, ctx, batch, rawEvidenceBudget);
         foldBatchIntoTally(tally, batch, outcome);
         reportProgress();
@@ -101,6 +109,7 @@ async function uploadOneBackfillBatch(command, io, ctx, batch, rawEvidenceBudget
         codexAttribution: ctx.scan.codexAttribution,
         claudeAttribution: ctx.scan.claudeAttribution,
         rawEvidenceBudget,
+        stubClaims: stubClaimsForCandidates(batch.candidates, ctx.stubReoffer),
         fetchImpl: io.fetch,
     });
     const durableInBatch = durableBackfillCandidateKeys(batch, sync);
@@ -216,6 +225,8 @@ function backfillBatchSyncOptions(options) {
         })),
         claudeAttributionScan: options.claudeAttribution ?? undefined,
         rawEvidenceBudget: options.rawEvidenceBudget,
+        // BLI-11102: session id -> the redaction stub this upload replaces.
+        rawEvidenceStubReoffers: options.stubClaims,
         // `cockpit backfill` is only ever an operator asking — by hand, through
         // onboarding, through doctor, or by running the retry command Cockpit
         // printed. The delivery-backoff window is the scheduler's cadence, so it

package/dist/commands/backfill.js

@@ -25,6 +25,7 @@
  *   backfill-evidence-outcomes.ts  what one upload achieved per session
  *   backfill-session-report.ts     one attribution row per session seen
  *   backfill-checkpoint.ts         the durable cursor and pointer writes
+ *   backfill-stub-reoffer.ts       redaction-crash stubs: re-offered, not delivered
  *   backfill-result.ts             the `--json` payload
  *   backfill-output.ts             every line and prompt a person sees
  *
@@ -45,6 +46,7 @@ import { planBackfillRun } from "./backfill-plan.js";
 import { reportBackfillOutcome } from "./backfill-report.js";
 import { lockHeldResult } from "./backfill-result.js";
 import { scanBackfillRun } from "./backfill-scan.js";
+import { markStubReoffers } from "./backfill-stub-reoffer.js";
 import { uploadBackfillBatches } from "./backfill-upload.js";
 // The command's public surface. Callers (doctor, onboard, local, the CLI
 // router, the BLI-3272 regression test) import these from `./backfill.js`;
@@ -101,7 +103,14 @@ export async function runBackfill(command, io) {
     if (plan.kind === "result")
         return plan.result;
     const { paths } = scanned;
-    const lock = await acquireBackfillLock(paths, now);
+    // BLI-11112: the sync's stub pass does not take the backfill lock. It runs
+    // under the collection lock, which already serialises it against any
+    // backfill, and the backfill lock is the flag a WAITING backfill raises: a
+    // person's backfill that arrives mid-pass must wait its turn, not bounce off
+    // `backfill_already_running`.
+    const lock = command.stubPass
+        ? { acquired: true, handle: { release: async () => undefined, heartbeat: async () => undefined } }
+        : await acquireBackfillLock(paths, now);
     if (!lock.acquired) {
         return lockHeldResult(command, scanned, {
             failureReason: "backfill_already_running",
@@ -110,31 +119,41 @@ export async function runBackfill(command, io) {
     }
     // BLI-11091: the scheduled sync holds this lock most of the time an agent
     // is working, so wait for it (bounded) instead of exiting at batch 0. Giving
-    // up is `sync_lock_held`, a blocked result and so a non-zero exit.
-    let waited;
-    try {
-        waited = await acquireSyncLockWithWait(paths, command.syncLockWaitMs ?? BACKFILL_SYNC_LOCK_WAIT_MS);
-    }
-    catch (error) {
-        await lock.handle.release();
-        throw error;
+    // up is `sync_lock_held`, a blocked result and so a non-zero exit. The
+    // sync's own stub pass (BLI-11112) runs inside the sync's lock and skips it.
+    let collectionLock;
+    if (command.stubPass) {
+        collectionLock = { handle: { release: async () => undefined } };
     }
-    if (!waited.acquired) {
-        await lock.handle.release();
-        return lockHeldResult(command, scanned, {
-            failureReason: "sync_lock_held",
-            what: "sync collection lock held",
-        });
+    else {
+        let waited;
+        try {
+            waited = await acquireSyncLockWithWait(paths, command.syncLockWaitMs ?? BACKFILL_SYNC_LOCK_WAIT_MS);
+        }
+        catch (error) {
+            await lock.handle.release();
+            throw error;
+        }
+        if (!waited.acquired) {
+            await lock.handle.release();
+            return lockHeldResult(command, scanned, {
+                failureReason: "sync_lock_held",
+                what: "sync collection lock held",
+            });
+        }
+        collectionLock = waited.lock;
     }
-    const collectionLock = waited.lock;
     try {
         // Backfill and scheduled/manual sync share upload spool and raw-evidence
         // cursors. Holding the same collection lock makes their read-modify-write
         // updates serial, while the dedicated backfill lock still prevents two
         // historical scans from running together.
-        if (scanned.scopedCursor.reset) {
+        if (scanned.scopedCursor.reset && !command.stubPass) {
             await writeBackfillCursor(paths, scanned.cursor);
         }
+        // BLI-11102: mark server-named stubs as not delivered, under the lock
+        // because sync writes the same cursor files.
+        await markStubReoffers(paths, scanned.stubReoffer, now);
         const upload = await uploadBackfillBatches(command, io, lock, scanned);
         return await reportBackfillOutcome(command, io, scanned, upload);
     }

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.155");
+    writeLine(io?.stdout ?? process.stdout, "0.2.157");
     return 0;
   }
 

package/dist/commands/session-sync-upload.js

@@ -10,6 +10,7 @@ import { startLocalWorkContext, startLocalWorkContextForAttributedTarget, } from
 import { LocalUploadBlockedError, syncLocalAmbientEnvelope, } from "../upload.js";
 import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET, } from "../adapters/raw-evidence.js";
 import { liveSyncTargetKey, liveSyncTargetWorktrees, matchesLiveSyncWorktree, } from "./session-sync-attribution.js";
+import { runYieldingAtBoundaries } from "./sync-yield.js";
 const CLAUDE_DAMP_GROWTH_BYTES = 256 * 1024;
 const CLAUDE_DAMP_MAX_AGE_MS = 6 * 60 * 60 * 1000;
 /**
@@ -33,10 +34,13 @@ export async function syncEveryTargetWorktree(options) {
         remainingBytes: RAW_EVIDENCE_DEFAULT_BYTE_BUDGET,
         remainingObjects: RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET,
     };
-    const outcomes = [];
-    let everyWorktreeUploaded = true;
-    for (const worktree of syncWorktrees) {
-        const outcome = await syncOneWorktree({
+    // BLI-11112: a waiting backfill takes the lock at the next worktree
+    // boundary; the worktrees not reached stay pending for it or the next tick.
+    const loop = await runYieldingAtBoundaries({
+        items: syncWorktrees,
+        shouldYield: run.yieldCheck,
+        describe: (outcome) => ({ status: outcome.sync.status }),
+        runOne: (worktree) => syncOneWorktree({
             run,
             now: options.now,
             plan: options.plan,
@@ -50,16 +54,16 @@ export async function syncEveryTargetWorktree(options) {
             recordDampedClaudeSession: (sessionId, priorPointer) => {
                 dampedClaudePointers.set(sessionId, priorPointer);
             },
-        });
-        everyWorktreeUploaded =
-            everyWorktreeUploaded && outcome.sync.status === "uploaded";
-        outcomes.push(outcome);
-    }
+        }),
+    });
+    const outcomes = loop.results;
+    const everyWorktreeUploaded = outcomes.every((outcome) => outcome.sync.status === "uploaded");
     return {
         outcomes,
         everyWorktreeUploaded,
         claudePriorDurablePointers: claudeDurablePointersFromCursor(options.plan.claudeCursorBefore),
         growthDampedSessionCount: dampedClaudePointers.size,
+        yieldedWorktreesLeft: loop.left,
     };
 }
 /** Every Claude session the cursor already holds a durable pointer for. */

package/dist/commands/session-sync.js

@@ -151,6 +151,7 @@ export async function runAttributedWorktreeSync(options) {
         failure_records: health.failure_records,
         notice: health.notice,
         hold: health.hold,
+        yielded_worktrees_left: worktreePass.yieldedWorktreesLeft,
         sessions_observed: sessions.length,
         sessions_outside_root: health.sessions_outside_root,
         outside_root_directories: health.outside_root_directories,

package/dist/commands/sync-run.js

@@ -3,6 +3,8 @@ import { discoverCommandWorktrees } from "./local-discovery.js";
 import { runAttributedWorktreeSync } from "./session-sync.js";
 import { reportMultiRepoSync, reportNoWorktreeSync, reportSingleRepoSync, } from "./sync-report.js";
 import { resolveSyncCollectionRoots } from "./sync-roots.js";
+import { healStubsDuringTick } from "./sync-stub-heal.js";
+import { backfillWaitingCheck } from "./sync-yield.js";
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { rawEvidenceDedupSummary, sweepDuplicateStagedRawEvidence, } from "../raw-evidence-gc.js";
 /**
@@ -18,7 +20,8 @@ export async function runSyncLocked(command, io) {
     // holds 559 copies of one rollout needs the disk back before it stages
     // anything else (BLI-3066). Safe by construction — a duplicate is identical
     // by content hash to the survivor.
-    const dedup = await sweepDuplicateStagedRawEvidence(getCollectorRuntimePaths(command.homeDir), io.env);
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    const dedup = await sweepDuplicateStagedRawEvidence(paths, io.env);
     if (!dedup.skipped && dedup.removed_dirs > 0) {
         writeLine(io.stdout, rawEvidenceDedupSummary(dedup));
     }
@@ -37,7 +40,11 @@ export async function runSyncLocked(command, io) {
         startContexts: false,
         worktrees,
         fetchImpl: io.fetch,
+        yieldCheck: backfillWaitingCheck(paths),
     });
+    // After the tick's own uploads, still under the lock: re-offer up to 25 of
+    // this machine's stubbed sessions. Never fails the tick.
+    await healStubsDuringTick(command, io);
     if (discoveryNotice) {
         run.discovery_partial = true;
         run.notice = [discoveryNotice, run.notice].filter(Boolean).join("; ");

package/dist/commands/sync-stub-heal.js

@@ -0,0 +1,135 @@
+import { runBackfill } from "./backfill.js";
+import { loadStubReofferPlan } from "./backfill-stub-reoffer.js";
+import { backfillWaitingCheck } from "./sync-yield.js";
+import { inspectBackfillLock } from "../backfill-lock.js";
+import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { describeError } from "../health-detail.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
+/** At most this many stubbed sessions are re-offered per tick (one backfill batch). */
+export const SYNC_STUB_SESSIONS_PER_TICK = 25;
+const DAY_MS = 24 * 60 * 60_000;
+const DEFAULT_DEPS = { runBackfill, loadPlan: loadStubReofferPlan };
+export async function healStubsDuringTick(command, io, deps = DEFAULT_DEPS, now = new Date()) {
+    const summary = {
+        reason: "unknown",
+        stubs_asked: 0,
+        stubs_reoffered: 0,
+        stubs_remaining: 0,
+        sessions_local: 0,
+        sessions_selected: 0,
+    };
+    try {
+        summary.reason = await runStubPass(command, io, deps, now, summary);
+    }
+    catch (error) {
+        summary.reason = "stub_pass_threw";
+        console.error("[collector stubs] tick stub pass threw; the tick is unaffected", JSON.stringify({ reason: "stub_pass_threw", ...describeError(error) }));
+    }
+    console.error("[collector stubs] tick", JSON.stringify(summary));
+    return summary;
+}
+async function runStubPass(command, io, deps, now, summary) {
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    // A backfill waiting for the lock heals stubs itself, with the whole door.
+    if ((await inspectBackfillLock(paths)).held)
+        return "backfill_running";
+    const config = await readLocalCollectorConfig(paths).catch(() => null);
+    const sessionFile = await readLocalCollectorSessionFile(paths).catch(() => null);
+    if (!sessionFile)
+        return "no_device_session";
+    const sources = config?.collect_claude_jsonl === false ? ["codex"] : ["codex", "claude_code"];
+    const dashboardUrl = (sessionFile.dashboard_url ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL)
+        .trim()
+        .replace(/\/+$/, "");
+    const plan = await deps.loadPlan({ paths, dashboardUrl, sources, fetchImpl: io.fetch });
+    summary.stubs_asked = plan.stub_count;
+    summary.stubs_remaining = plan.stub_count;
+    if (plan.status === "skipped")
+        return plan.reason;
+    if (plan.status === "unavailable")
+        return `stub_door_unavailable:${plan.reason}`;
+    if (plan.sessions.size === 0)
+        return "no_stubs";
+    const local = await locallyTrackedStubSessions(paths, plan);
+    summary.sessions_local = local.length;
+    if (local.length === 0)
+        return "stubs_not_on_this_machine";
+    const selected = local.slice(0, SYNC_STUB_SESSIONS_PER_TICK);
+    summary.sessions_selected = selected.length;
+    const trimmed = {
+        ...plan,
+        sessions: new Map(selected.map((session) => [session.key, session.pointerIds])),
+        stub_count: selected.reduce((total, session) => total + session.pointerIds.length, 0),
+        marked_local_sessions: 0,
+    };
+    const window = stubWindow(selected, sessionFile.paired_at, now);
+    const result = await deps.runBackfill({
+        homeDir: command.homeDir,
+        repoRoot: command.repoRoot,
+        maxDepth: command.maxDepth,
+        maxRepos: command.maxRepos,
+        ...window,
+        dryRun: false,
+        yes: true,
+        json: true,
+        stubPass: { plan: trimmed, shouldYield: backfillWaitingCheck(paths) },
+    }, backfillIoFor(io));
+    const outcome = result.stub_reoffer;
+    summary.stubs_reoffered = outcome?.reoffered_stubs ?? 0;
+    summary.stubs_remaining = Math.max(0, plan.stub_count - (outcome?.replaced_stubs ?? 0));
+    return stubPassReason(result);
+}
+/** Door-order list of the stubbed sessions whose cursor entry lives on this machine. */
+async function locallyTrackedStubSessions(paths, plan) {
+    const cursors = {
+        codex: await readRawEvidenceCursor(paths).catch(() => null),
+        claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME }).catch(() => null),
+    };
+    const local = [];
+    for (const [key, pointerIds] of plan.sessions) {
+        const at = key.indexOf(":");
+        const source = key.slice(0, at);
+        const entry = cursors[source]?.sessions[key.slice(at + 1)];
+        if (entry)
+            local.push({ key, pointerIds, mtimeMs: entry.file_mtime_ms });
+    }
+    return local;
+}
+/**
+ * The narrowest backfill window that still reaches every selected session:
+ * back to the oldest one's file time plus a day. A backfill window never
+ * reaches before pairing, so an older session (or one with no recorded time)
+ * asks for all history instead.
+ */
+function stubWindow(selected, pairedAt, now) {
+    const times = selected.map((session) => session.mtimeMs);
+    const oldest = Math.min(...times);
+    const paired = pairedAt ? Date.parse(pairedAt) : Number.NaN;
+    if (times.some((time) => !Number.isFinite(time) || time <= 0))
+        return { all: true };
+    if (!Number.isFinite(paired) || oldest < paired)
+        return { all: true };
+    return { all: false, sinceDays: Math.max(1, Math.ceil((now.getTime() - oldest) / DAY_MS) + 1) };
+}
+function stubPassReason(result) {
+    const outcome = result.stub_reoffer;
+    if (result.failure_reason === "yielded_to_backfill")
+        return "yielded_to_backfill";
+    if (result.status === "blocked")
+        return `stub_backfill_blocked:${result.failure_reason ?? "unknown"}`;
+    if (!outcome || outcome.reoffered_sessions === 0)
+        return "stubs_not_found_locally";
+    if (outcome.replaced_stubs < outcome.reoffered_stubs) {
+        return `stubs_partly_replaced:${result.failure_reason ?? "unknown"}`;
+    }
+    return "stubs_reoffered";
+}
+/**
+ * The backfill writes its `--json` result and progress to stdout; the sync's
+ * stdout is its own `--json` receipt, so those lines go nowhere and the
+ * backfill's own `[backfill]` logs still reach stderr.
+ */
+function backfillIoFor(io) {
+    const discard = { write: () => true };
+    return { stdin: io.stdin, stdout: discard, stderr: io.stderr, fetch: io.fetch };
+}

package/dist/commands/sync-yield.js

@@ -0,0 +1,61 @@
+/**
+ * BLI-11112: the scheduled sync hands the collection lock to a waiting
+ * backfill at its next worktree boundary.
+ *
+ * A tick on a machine with a backlog now runs 10 to 15 minutes, longer than
+ * the backfill's old wait, so a person who typed `cockpit backfill` sat out the
+ * whole tick and got `sync_lock_held`. The rule is plain: a backfill that wants
+ * the lock takes the backfill lock FIRST and then waits for the collection
+ * lock (`backfill-lock-wait.ts`). The backfill lock being held is the waiter's
+ * flag. Before each worktree upload the sync asks whether that flag is up; if
+ * it is, it finishes nothing new, writes down what it already did, and
+ * releases the lock. The worktrees it did not reach stay pending in the cursor
+ * and are exactly what the backfill (or the next tick) picks up. A worktree
+ * already uploading is never interrupted, so the wait is bounded by one
+ * worktree's upload, which is why each one logs its own elapsed time.
+ */
+import { inspectBackfillLock } from "../backfill-lock.js";
+/** The waiter's flag: the backfill lock is held while its owner waits for ours. */
+export function backfillWaitingCheck(paths, inspect = inspectBackfillLock) {
+    return async () => {
+        try {
+            return (await inspect(paths)).held;
+        }
+        catch {
+            // A lock probe that cannot read the file means nobody is waiting; the
+            // sync carries on exactly as it did before this rule existed.
+            return false;
+        }
+    };
+}
+/**
+ * Run `runOne` over `items` in order, asking `shouldYield` before each one.
+ * The first `true` stops the loop; nothing already started is interrupted.
+ */
+export async function runYieldingAtBoundaries(options) {
+    const now = options.now ?? (() => Date.now());
+    const results = [];
+    const started = now();
+    for (const [index, item] of options.items.entries()) {
+        if (options.shouldYield && (await options.shouldYield())) {
+            const left = options.items.length - index;
+            console.error("[session-sync] yielded the collection lock to a waiting backfill", JSON.stringify({
+                reason: "backfill_waiting",
+                worktrees_done: index,
+                worktrees_left: left,
+                elapsed_ms: now() - started,
+            }));
+            return { results, yielded: true, left };
+        }
+        const itemStarted = now();
+        const result = await options.runOne(item);
+        results.push(result);
+        console.error("[session-sync] worktree synced", JSON.stringify({
+            index: index + 1,
+            total: options.items.length,
+            elapsed_ms: now() - itemStarted,
+            ...(options.describe ? options.describe(result) : {}),
+        }));
+    }
+    return { results, yielded: false, left: 0 };
+}

package/dist/cursors/raw-evidence-cursor.js

@@ -195,8 +195,21 @@ function parseSessionEntry(value) {
         uploaded_at: optionalString(record["uploaded_at"]),
         uploaded_byte_size: optionalNumberOrNull(record["uploaded_byte_size"]),
         last_seen_at: lastSeenAt,
+        ...parseStubReoffer(record["stub_reoffer"]),
     };
 }
+function parseStubReoffer(value) {
+    if (!value || typeof value !== "object")
+        return {};
+    const record = value;
+    const markedAt = optionalString(record["marked_at"]);
+    const ids = Array.isArray(record["stub_pointer_ids"])
+        ? record["stub_pointer_ids"].filter((id) => typeof id === "string" && id.length > 0)
+        : [];
+    if (record["reason"] !== "stub_reoffered" || !markedAt || ids.length === 0)
+        return {};
+    return { stub_reoffer: { reason: "stub_reoffered", stub_pointer_ids: ids, marked_at: markedAt } };
+}
 function parseCheckpoints(value) {
     if (!value || typeof value !== "object")
         return null;

package/dist/evidence-stubs-client.js

@@ -0,0 +1,115 @@
+/**
+ * Asks `POST /api/ambient/evidence/stubs` which of this operator's stored
+ * transcripts are only the redaction-crash stub, and groups the answer by agent
+ * session (BLI-11102).
+ *
+ * A stub is a promise to come back, not a delivery: the local cursor recorded
+ * an upload, so nothing local would ever offer that session again. The server
+ * holds the label, so the server is asked. `cockpit backfill` re-offers every
+ * session this returns.
+ *
+ * Never throws. A door that cannot be asked (an older dashboard answers 404, a
+ * network error, a malformed page) returns `unavailable` with the reason, and
+ * the backfill runs exactly as it did before. That is also the release gate:
+ * the collector only ever sends a `stub_replaced` claim for a stub this door
+ * named, so it cannot send one to a server that does not know the rule.
+ *
+ * Bounded: pages of up to 500, at most `maxPages` of them, walked by the
+ * server's keyset cursor. The result says whether the list was exhausted,
+ * capped by `maxPages`, or cut short by a failed page after some landed.
+ */
+import { EVIDENCE_STUBS_MAX_PAGE, EVIDENCE_STUBS_SCHEMA_VERSION, EvidenceStubsResponseSchema, transcriptSessionFromObjectKey, } from "@bli-cockpit/telemetry-core";
+import { describeError } from "./health-detail.js";
+const STUBS_PAGE_TIMEOUT_MS = 15_000;
+export const STUBS_DEFAULT_MAX_PAGES = 20;
+export function stubSessionKey(source, sessionId) {
+    return `${source}:${sessionId}`;
+}
+export async function fetchStubbedSessions(options) {
+    const maxPages = options.maxPages ?? STUBS_DEFAULT_MAX_PAGES;
+    const sessions = new Map();
+    const seen = new Set();
+    let stubCount = 0;
+    let unkeyed = 0;
+    let pages = 0;
+    let after = null;
+    for (;;) {
+        if (pages >= maxPages) {
+            return finish("capped", "ok");
+        }
+        const page = await requestPage({ ...options, after });
+        if (!page.ok) {
+            return finish(pages === 0 ? "unavailable" : "failed_partial", page.reason);
+        }
+        pages += 1;
+        for (const stub of page.stubs) {
+            stubCount += 1;
+            if (seen.has(stub.ref_id))
+                continue;
+            seen.add(stub.ref_id);
+            const session = transcriptSessionFromObjectKey(stub.object_key);
+            if (!session) {
+                unkeyed += 1;
+                continue;
+            }
+            const key = stubSessionKey(session.source, session.session_id);
+            sessions.set(key, [...(sessions.get(key) ?? []), stub.raw_evidence_pointer_id]);
+        }
+        // Advance by what the server returned; a page that names no cursor is the last.
+        if (!page.nextAfter)
+            return finish("exhausted", "ok");
+        after = page.nextAfter;
+    }
+    function finish(status, reason) {
+        const result = {
+            status,
+            reason,
+            pages,
+            stub_count: stubCount,
+            unique_stub_count: seen.size,
+            unkeyed_stub_count: unkeyed,
+            sessions,
+        };
+        console.error("[collector stubs] redaction-crash stubs asked", JSON.stringify({
+            reason: status === "unavailable" ? `stub_door_unavailable:${reason}` : `stubs_${status}`,
+            pages,
+            stub_count: stubCount,
+            unique_stub_count: seen.size,
+            unkeyed_stub_count: unkeyed,
+            session_count: sessions.size,
+            ...(status === "failed_partial" ? { failure: reason } : {}),
+        }));
+        return result;
+    }
+}
+async function requestPage(options) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), STUBS_PAGE_TIMEOUT_MS);
+    try {
+        const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/evidence/stubs`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${options.deviceToken}`,
+            },
+            body: JSON.stringify({
+                schema_version: EVIDENCE_STUBS_SCHEMA_VERSION,
+                after: options.after,
+                limit: EVIDENCE_STUBS_MAX_PAGE,
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return { ok: false, reason: `http_${response.status}` };
+        const parsed = EvidenceStubsResponseSchema.safeParse(await response.json().catch(() => null));
+        if (!parsed.success)
+            return { ok: false, reason: "invalid_response" };
+        return { ok: true, stubs: parsed.data.stubs, nextAfter: parsed.data.next_after };
+    }
+    catch (error) {
+        return { ok: false, reason: describeError(error).error_name };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}

package/dist/upload-envelope-build.js

@@ -125,6 +125,7 @@ export async function buildLocalAmbientEnvelope(options = {}) {
             operatorId: session.operator_id,
             workContextId: uploadContext.work_context_id,
         })),
+        rawEvidenceStubReoffers: options.rawEvidenceStubReoffers,
         rawEvidenceByteBudget: options.rawEvidenceByteBudget,
         rawEvidenceObjectBudget: options.rawEvidenceObjectBudget,
         rawEvidenceBudget: options.rawEvidenceBudget,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.155",
+  "version": "0.2.157",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,8 +27,8 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.41",
-    "@bli-cockpit/mcp": "0.1.75",
-    "@bli-cockpit/telemetry-core": "0.1.53"
+    "@bli-cockpit/memory-mcp": "0.1.42",
+    "@bli-cockpit/mcp": "0.1.76",
+    "@bli-cockpit/telemetry-core": "0.1.54"
   }
 }