@bli-cockpit/cli 0.2.158 → 0.2.160

package/dist/adapters/common.js

@@ -1,4 +1,4 @@
-import { SourceScanResultSchema, parseTicketIdFromText, } from "@bli-cockpit/telemetry-core";
+import { SourceScanResultSchema, parseTicketIdFromBranch, parseTicketIdFromText, } from "@bli-cockpit/telemetry-core";
 import { LOCAL_COLLECTOR_VERSION } from "../local-state.js";
 export function makeSourceAdapterIdentity(captureSource, adapterName) {
     return {
@@ -34,4 +34,4 @@ export function makeSourceScan(context, captureSource, adapterName, status, reas
         diagnostic_labels: [reasonLabel],
     });
 }
-export { parseTicketIdFromText };
+export { parseTicketIdFromBranch, parseTicketIdFromText };

package/dist/adapters/git-state.js

@@ -1,7 +1,7 @@
 import { SourceScanResultSchema, } from "@bli-cockpit/telemetry-core";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { makeSourceAdapterIdentity, parseTicketIdFromText, } from "./common.js";
+import { makeSourceAdapterIdentity, parseTicketIdFromBranch, } from "./common.js";
 const execFileAsync = promisify(execFile);
 export async function collectGitState(context, runner = defaultGitCommandRunner()) {
     const startedAt = context.now.toISOString();
@@ -22,7 +22,7 @@ export async function collectGitState(context, runner = defaultGitCommandRunner(
                 ...fileStats.map((file) => file.path),
             ]),
         ].sort();
-        const ticketIdFromBranch = parseTicketIdFromText(branch);
+        const ticketIdFromBranch = parseTicketIdFromBranch(branch);
         const ticketBindingCandidates = ticketIdFromBranch
             ? [
                 {

package/dist/adapters/risk-flags.js

@@ -5,7 +5,7 @@ export function generateDumbRiskFlags(input) {
     const flags = [];
     const git = input.git ?? null;
     const changedLines = (git?.added_lines ?? 0) + (git?.deleted_lines ?? 0);
-    if (git && changedLines >= 800 && !input.hasPlanSignal) {
+    if (git && changedLines >= 800 && input.hasPlanSignal === false) {
         flags.push(makeRiskFlag(input, "no_plan_signal_before_large_edit", [
             "missing_plan_signal",
             "large_edit",
@@ -17,27 +17,13 @@ export function generateDumbRiskFlags(input) {
         git.deleted_lines >= 200) {
         flags.push(makeRiskFlag(input, "many_add_revert_loops", ["add_revert_loop"]));
     }
-    if (input.reviewFindingPriorities?.some((priority) => ["p1", "p2", "P1", "P2"].includes(priority))) {
-        flags.push(makeRiskFlag(input, "p1_or_p2_review_finding", [
-            input.reviewFindingPriorities.some((priority) => priority.toLowerCase() === "p1")
-                ? "p1_review_finding"
-                : "p2_review_finding",
-        ]));
-    }
-    if ((input.repeatedFailureCount ?? 0) >= 3) {
-        flags.push(makeRiskFlag(input, "repeated_same_failing_command", [
-            "same_failing_command",
-        ]));
-    }
-    if ((input.permissionDeniedCount ?? 0) >= 2) {
-        flags.push(makeRiskFlag(input, "permission_denied_spike", ["permission_denied"]));
-    }
-    if ((input.tokenCount ?? 0) >= 1_000_000 && !input.hasPullRequest) {
-        flags.push(makeRiskFlag(input, "high_token_or_time_burn_no_pr", [
-            "token_pressure",
-            "no_pr_after_work",
-        ]));
-    }
+    // BLI-12189: p1_or_p2_review_finding, repeated_same_failing_command,
+    // permission_denied_spike and high_token_or_time_burn_no_pr were removed.
+    // Their inputs (review priorities, failure and denial counts, token count,
+    // PR presence) were never passed by the one caller (local-sources.ts), so the
+    // flags could not fire. The risk_type values stay in the telemetry schema
+    // for a producer that really measures them; wire the input first, then add
+    // the branch back with a test that drives it from a real fixture.
     const branchTicket = git?.ticket_id_from_branch;
     if (branchTicket &&
         input.binding.selected_ticket_id &&
@@ -56,9 +42,7 @@ function makeRiskFlag(input, riskType, evidenceLabels) {
             .digest("hex")
             .slice(0, 16)}`,
         risk_type: riskType,
-        severity: riskType === "p1_or_p2_review_finding" || riskType === "branch_ticket_mismatch"
-            ? "high"
-            : "warning",
+        severity: riskType === "branch_ticket_mismatch" ? "high" : "warning",
         observed_at: input.context.now.toISOString(),
         evidence_labels: evidenceLabels,
         evidence_pointer_ids: [],

package/dist/commands/careers.js

@@ -52,6 +52,9 @@ async function planCareersRequest(command) {
         // The grader itself runs on Railway, because it needs a clone and yt-dlp.
         // This door re-queues the row; `--now` is passed through and the answer
         // names where the run actually happens rather than implying it ran here.
+        // BLI-12183: `{}` sends the second-chance email now; `--record-sent-at`
+        // records one sent outside Tower and sends nothing.
+        case 'followup': return { path: `${application}/followup`, method: 'POST', body: command.recordSentAt ? { record_sent_at: command.recordSentAt } : {} };
         case 'grade': return { path: `${application}/grade`, method: 'POST', body: { now: command.now === true } };
         case 'decide': return { path: `${application}/decide`, method: 'POST', body: { decision: command.decision } };
         // `resume` never arrives here: `runCareers` hands it to `careers-resume.ts`
@@ -101,8 +104,14 @@ function settingsBody(command) {
         body.booking_link = command.bookingLink;
     if (command.graderModel !== undefined)
         body.grader_model = command.graderModel;
+    if (command.followupEnabled !== undefined)
+        body.followup_enabled = command.followupEnabled;
+    if (command.followupAfterDays !== undefined)
+        body.followup_after_days = command.followupAfterDays;
+    if (command.takehomeWindowHours !== undefined)
+        body.takehome_window_hours = command.takehomeWindowHours;
     if (Object.keys(body).length === 0) {
-        throw new Error('careers settings set needs at least one of --enabled, --auto-invite-min-score, --attention-min-score, --account, --booking-link or --grader-model.');
+        throw new Error('careers settings set needs at least one of --enabled, --auto-invite-min-score, --attention-min-score, --account, --booking-link, --grader-model, --followup-enabled, --followup-after-days or --takehome-window-hours.');
     }
     return body;
 }

package/dist/commands/cli-io.js

@@ -1,3 +1,4 @@
+import { parseYesNo } from "../yes-no.js";
 import { createCapturedExecRunner, createInteractiveExecRunner, } from "../process-runner.js";
 export function writeLine(stream, text) {
     stream.write(`${text}\n`);
@@ -96,6 +97,10 @@ export async function readPipedText(stream, options) {
     }
     return stripLeadingBom(text);
 }
+// Lines that arrived in the same chunk as an earlier answer (a paste, type-ahead,
+// or a slow event loop that let the stream coalesce its buffer). Per stream, so
+// the next prompt reads them instead of waiting for input that already came.
+const queuedLines = new WeakMap();
 /**
  * Reads one line from stdin after writing a prompt. Shared by the onboard email
  * prompt and the autostart prompt; callers gate on `isInteractiveStdin` first so
@@ -103,21 +108,51 @@ export async function readPipedText(stream, options) {
  */
 export async function readLine(io, prompt) {
     io.stdout.write(prompt);
+    const queue = queuedLines.get(io.stdin) ?? [];
+    queuedLines.set(io.stdin, queue);
+    const queued = queue.shift();
+    if (queued !== undefined)
+        return queued;
     io.stdin.setEncoding("utf8");
     return new Promise((resolve) => {
         const onData = (chunk) => {
             io.stdin.removeListener("data", onData);
             io.stdin.pause();
-            resolve(chunk);
+            const lines = chunk.match(/[^\n]*\n|[^\n]+$/gu) ?? [chunk];
+            const [first = chunk, ...rest] = lines;
+            queue.push(...rest);
+            if (rest.length > 0) {
+                console.error(`[cli-io] stdin chunk held ${lines.length} lines {"queued_lines":${rest.length}}`);
+            }
+            resolve(first);
         };
         io.stdin.resume();
         io.stdin.on("data", onData);
     });
 }
-/** Enter means yes: only an explicit `n`/`no` declines. */
-export function yesByDefault(raw) {
-    const answer = raw.trim().split(/\s+/u)[0]?.toLowerCase() ?? "";
-    return answer !== "n" && answer !== "no";
+/**
+ * Settles a typed answer to a yes/no prompt (BLI-12189). `unclear` asks once
+ * more when `reask` is set, then declines; a destructive prompt passes
+ * `emptyIsYes: false` and no `reask`, so anything unclear is a No.
+ */
+export async function settleYesNo(io, firstAnswer, prompt, options) {
+    let answer = firstAnswer;
+    const attempts = options.reask ? 2 : 1;
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        const verdict = parseYesNo(answer, options);
+        if (verdict !== "unclear") {
+            console.error(`[cli-io] yes/no settled ${JSON.stringify({ verdict, attempt })}`);
+            return verdict === "yes";
+        }
+        console.error(`[cli-io] yes/no unclear ${JSON.stringify({ attempt, will_reask: attempt < attempts })}`);
+        if (attempt < attempts)
+            answer = await readLine(io, `Please answer y or n. ${prompt}`);
+    }
+    return false;
+}
+/** Reads one answer and settles it. Non-destructive: Enter is yes, unclear asks once more. */
+export async function askYesNo(io, prompt, options = { emptyIsYes: true, reask: true }) {
+    return settleYesNo(io, await readLine(io, prompt), prompt, options);
 }
 /** Collects what a nested command writes instead of letting it reach the user. */
 export function bufferedWritable(chunks) {

package/dist/commands/collection-roots.js

@@ -11,14 +11,14 @@ import os from "node:os";
 import { scanWorkDirectories } from "./local-discovery.js";
 import path from "node:path";
 import { stat } from "node:fs/promises";
-import { isInteractiveStdin, readLine, writeLine, yesByDefault } from "./cli-io.js";
+import { isInteractiveStdin, readLine, writeLine, askYesNo } from "./cli-io.js";
 import { CollectionRootRequiredError, resolveOnboardingRoots, } from "../onboarding-roots.js";
 import { getCollectorRuntimePaths, installLocalCollector, readLocalCollectorConfig, } from "../local-state.js";
 import { collectionRootPathAliases } from "../repo-identity.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
 export function onboardingRootPrompt(io) {
     return {
-        confirm: async (message) => yesByDefault(await readLine(io, message)),
+        confirm: async (message) => askYesNo(io, message),
         input: (message) => readLine(io, message),
         message: (message) => writeLine(io.stdout, message),
     };

package/dist/commands/install-update.js

@@ -14,7 +14,7 @@ import { defaultExec, defaultInteractiveExec, writeExecOutput, writeLine } from
 import { assertCollectionRootPersisted } from "./collection-roots.js";
 import { addInstallEvent, reportInstallEventsBestEffort } from "./install-receipts.js";
 import { installLocalCollector, LOCAL_COLLECTOR_VERSION, } from "../local-state.js";
-import { COLLECTION_ROOT_REQUIRED, CollectionRootRequiredError, missingCollectionRootMessage, normalizeRootsDetailed, rootRejectionExplanation, } from "../onboarding-roots.js";
+import { CollectionRootRequiredError, missingCollectionRootMessage, normalizeRootsDetailed, rootRejectionExplanation, } from "../onboarding-roots.js";
 export class SelfUpdateError extends Error {
     result;
     eacces;
@@ -192,16 +192,35 @@ function updateOnboardArgs(command) {
 function isNpmEaccesFailure(stderr) {
     return /EACCES|permission denied/i.test(stderr);
 }
-function updateOnboardFailureCode(result) {
-    const output = `${result.stdout}\n${result.stderr}`;
-    if (output.includes(COLLECTION_ROOT_REQUIRED))
-        return COLLECTION_ROOT_REQUIRED;
-    if (/pairing|approval|device_pairing/i.test(output))
-        return "pairing_timeout";
-    if (/sync_blocked|spooled|upload failed|network_or_ingest/i.test(output)) {
-        return "sync_blocked";
+/**
+ * The reason a failed onboard rerun carries (BLI-12189). Never scraped from
+ * prose: every rerun prints "pairing skipped", so matching words labelled any
+ * failed update `pairing_timeout`. A `--json` rerun hands back the typed
+ * `blocker` the onboard step itself computed; otherwise the exit code is the
+ * only honest fact, and it is the label.
+ */
+export function updateOnboardFailureCode(result) {
+    const blocker = typedOnboardBlocker(result.stdout);
+    const label = blocker ?? `onboard_exit_${result.code}`;
+    console.error(`[install-update] onboard rerun failed ${JSON.stringify({
+        exit_code: result.code,
+        reason: label,
+        source: blocker ? "typed_blocker" : "exit_code",
+    })}`);
+    return label;
+}
+function typedOnboardBlocker(stdout) {
+    const text = stdout.trim();
+    if (!text.startsWith("{"))
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        const blocker = parsed?.blocker;
+        return typeof blocker === "string" && blocker.length > 0 ? blocker : null;
+    }
+    catch {
+        return null;
     }
-    return "onboard_rerun_failed";
 }
 function updateCollectionRoots(command) {
     const roots = command.collectionRoots?.length

package/dist/commands/local-args-collector-sources.js

@@ -0,0 +1,27 @@
+/**
+ * `cockpit sources check [--older-than <days>] [--json]` (BLI-11122).
+ *
+ * One verb, read-only. There is deliberately no `sources clean` and no
+ * `--apply`: Tower never deletes a person's raw transcripts; deleting one is
+ * the person's own act, outside Tower. A path is never accepted: the roots are
+ * the ones the collector reads (`sources-discovery.ts`).
+ */
+import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, } from "./local-arg-values.js";
+export function parseSourcesArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: ["--older-than", "--home", "--dashboard-url", "--json"],
+        valueFlags: ["--older-than", "--home", "--dashboard-url"],
+    });
+    const action = values.positionals[0] ?? "check";
+    if (action !== "check" || values.positionals.length > 1) {
+        throw new Error("sources has one verb: `cockpit sources check [--older-than <days>] [--json]`.");
+    }
+    return {
+        kind: "sources",
+        action: "check",
+        olderThanDays: optionalPositiveInteger(values.flags.get("--older-than"), "--older-than") ?? null,
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        json: values.booleans.has("--json"),
+    };
+}

package/dist/commands/local-args-collector.js

@@ -26,4 +26,5 @@
  */
 export { parseOnboardArgs, parseUpdateArgs, parseDoctorArgs, parseInstallArgs, parseReleaseArgs, parseLoginArgs, parseLogoutArgs, } from "./local-args-collector-setup.js";
 export { parseStartArgs, parseSyncArgs, parseAnalyzeArgs, parseBackfillArgs, } from "./local-args-collector-work.js";
-export { parseStatusArgs, parseSessionsArgs, parseServeArgs, parseAutostartArgs, parseAgentRulesArgs, parseMemoryArgs, parseCleanArgs, } from "./local-args-collector-status.js";
+export { parseStatusArgs, parseSessionsArgs, parseServeArgs, parseAutostartArgs, parseAgentRulesArgs, parseMemoryArgs, parseCleanArgs, } from "./local-args-collector-status.js";
+export { parseSourcesArgs } from "./local-args-collector-sources.js";

package/dist/commands/local-args-tower-careers.js

@@ -1,13 +1,13 @@
 import { optionalNonEmpty, optionalUrl, parseNamedArgs } from './local-arg-values.js';
-const ACTIONS = ['list', 'show', 'rescreen', 'invite', 'decide', 'grade', 'resume', 'takehome-show', 'takehome-set', 'settings-show', 'settings-set'];
+const ACTIONS = ['list', 'show', 'rescreen', 'invite', 'decide', 'followup', 'grade', 'resume', 'takehome-show', 'takehome-set', 'settings-show', 'settings-set'];
 /** Typed word → the one action it means. The left side is what a person reads on the button. */
 const ALSO_SPELLED = { 'send-takehome': 'invite' };
 const DECISIONS = ['passed_on', 'archived', 'reopen'];
 /** Verbs that name an application id, a role slug, or nothing at all. */
-const NEEDS_ID = ['show', 'rescreen', 'invite', 'decide', 'grade', 'resume'];
+const NEEDS_ID = ['show', 'rescreen', 'invite', 'decide', 'followup', 'grade', 'resume'];
 const NEEDS_ROLE = ['takehome-show', 'takehome-set'];
 export function parseCareersArgs(args) {
-    const valueFlags = ['--role', '--min-score', '--since', '--home', '--dashboard-url', '--decision', '--stage', '--subject', '--body-file', '--link', '--pass-score', '--account', '--auto-invite-min-score', '--attention-min-score', '--enabled', '--booking-link', '--grader-model', '--out'];
+    const valueFlags = ['--role', '--min-score', '--since', '--home', '--dashboard-url', '--decision', '--stage', '--subject', '--body-file', '--link', '--pass-score', '--account', '--auto-invite-min-score', '--attention-min-score', '--enabled', '--booking-link', '--grader-model', '--out', '--record-sent-at', '--followup-enabled', '--followup-after-days', '--takehome-window-hours'];
     const values = parseNamedArgs(args, { allowedFlags: [...valueFlags, '--json', '--now', '--force'], valueFlags });
     const positionals = [...values.positionals];
     // `takehome show` and `settings set` are two words a person types and one
@@ -48,6 +48,19 @@ export function parseCareersArgs(args) {
     const enabledRaw = optionalNonEmpty(values.flags.get('--enabled'));
     if (enabledRaw !== undefined && enabledRaw !== 'true' && enabledRaw !== 'false')
         throw new Error('--enabled must be true or false.');
+    // BLI-12183: the second-chance follow-up. `--record-sent-at` records one sent
+    // outside Tower and sends nothing; the three settings flags are whole numbers
+    // and a boolean, refused here as well as on the door.
+    const recordSentAt = optionalNonEmpty(values.flags.get('--record-sent-at'));
+    if (recordSentAt !== undefined && verb !== 'followup')
+        throw new Error('--record-sent-at belongs to `cockpit careers followup <id>`.');
+    if (recordSentAt !== undefined && !Number.isFinite(Date.parse(recordSentAt)))
+        throw new Error('--record-sent-at must be an ISO date-time, e.g. 2026-10-03T08:00:00Z.');
+    const followupEnabledRaw = optionalNonEmpty(values.flags.get('--followup-enabled'));
+    if (followupEnabledRaw !== undefined && followupEnabledRaw !== 'true' && followupEnabledRaw !== 'false')
+        throw new Error('--followup-enabled must be true or false.');
+    const followupAfterDays = wholeFlag(values.flags.get('--followup-after-days'), '--followup-after-days', 1, 60);
+    const takehomeWindowHours = wholeFlag(values.flags.get('--takehome-window-hours'), '--takehome-window-hours', 1, 720);
     // The resume is the only thing this noun writes to disk, so both file flags
     // belong to it alone and say so rather than being accepted and ignored.
     const outPath = optionalNonEmpty(values.flags.get('--out'));
@@ -71,6 +84,9 @@ export function parseCareersArgs(args) {
         graderModel: optionalNonEmpty(values.flags.get('--grader-model')),
         now: values.booleans.has('--now'),
         outPath, force,
+        recordSentAt: recordSentAt ? new Date(recordSentAt).toISOString() : undefined,
+        followupEnabled: followupEnabledRaw === undefined ? undefined : followupEnabledRaw === 'true',
+        followupAfterDays, takehomeWindowHours,
         autoInviteMinScore, attentionMinScore,
         autoInviteEnabled: enabledRaw === undefined ? undefined : enabledRaw === 'true',
         homeDir: optionalNonEmpty(values.flags.get('--home')), dashboardUrl: optionalUrl(values.flags.get('--dashboard-url')), json: values.booleans.has('--json'),
@@ -96,6 +112,14 @@ function httpsFlag(raw) {
         throw new Error('--booking-link must be an https URL.');
     return value;
 }
+function wholeFlag(raw, flag, min, max) {
+    if (raw === undefined)
+        return undefined;
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value < min || value > max)
+        throw new Error(`${flag} must be a whole number, ${min} to ${max}.`);
+    return value;
+}
 function numberFlag(raw, flag, min, max) {
     if (raw === undefined)
         return undefined;

package/dist/commands/local-args.js

@@ -17,7 +17,7 @@
  */
 import { parseRootsArgs } from "./roots.js";
 import { SURFACE_ALIASES } from "./local-help.js";
-import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
+import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
 import { parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseCareersArgs, } from "./local-args-tower.js";
 // `normalizeUrl` has always been part of this module's surface — `local.ts` and
 // `local-auth.ts` import it from here — so it stays exported from this address
@@ -107,6 +107,8 @@ export function parseLocalArgs(argv) {
             return parseMemoryArgs(argv.slice(1));
         case "clean":
             return parseCleanArgs(argv.slice(1));
+        case "sources":
+            return parseSourcesArgs(argv.slice(1));
         case "docs":
             return parseDocsArgs(argv.slice(1));
         case "msg":

package/dist/commands/local-auth.js

@@ -8,7 +8,7 @@
  * onboard. Split out of commands/local.ts (BLI-3104); moved verbatim.
  */
 import { execFile } from "node:child_process";
-import { errorMessage, isInteractiveStdin, readLine, writeLine, yesByDefault, } from "./cli-io.js";
+import { errorMessage, isInteractiveStdin, readLine, writeLine, settleYesNo, } from "./cli-io.js";
 import { normalizeUrl } from "./local-args.js";
 import { getCollectorRuntimePaths, pairLocalCollector, readLocalCollectorSessionFile, readLocalSessionReference, } from "../local-state.js";
 const OTP_CODE_PROMPT = [
@@ -63,7 +63,8 @@ export async function resolveOnboardEmail(command, roots, config, io) {
     const typedEmail = answer.split(/\s+/u).find((part) => part.includes("@"));
     if (typedEmail)
         return typedEmail;
-    if (yesByDefault(answer)) {
+    const pairPrompt = `Use ${inferred.email} for Tower pairing? [Y/n] `;
+    if (await settleYesNo(io, answer, pairPrompt, { emptyIsYes: true, reask: true })) {
         return inferred.email;
     }
     return promptOnboardEmail(io);

package/dist/commands/local-help-commands-tower.js

@@ -25,12 +25,14 @@ export const TOWER_COMMAND_HELP = [
     [
         "careers",
         [
-            "Usage: cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <d>|grade <id>|resume <id>|takehome show <role>|takehome set <role>|settings show|settings set] [flags]",
+            "Usage: cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <d>|followup <id>|grade <id>|resume <id>|takehome show <role>|takehome set <role>|settings show|settings set] [flags]",
             "",
             "Super-admin application review and pipeline. Lists at most 100 matches with total and has_more; use filters to narrow.",
             "list [--role <slug>] [--min-score <n>] [--since <date>] [--stage <screened|invited|submitted|graded|booking_sent|passed_on|archived>] — the board, newest first, with the two thresholds in force.",
             "send-takehome <id> (also `invite <id>`): sends that role's take-home from the configured mailbox, whatever the screening scored. The same act as Tower's Send take-home button, and only a row still at `screened`.",
             "decide <id> --decision <passed_on|archived|reopen> — your own call on a row; `reopen` puts it back to `screened`.",
+            "followup <id> [--record-sent-at <iso>]: sends the one second-chance email now, in the take-home thread (the Send follow-up button), or with --record-sent-at records one you sent by hand and sends nothing (Already followed up). A second follow-up is refused. list and show carry each row's deadline label: overdue, second_chance, no_submission or incomplete.",
+            "settings set also takes --followup-enabled <true|false> (default false), --followup-after-days <1-60> (default 7) and --takehome-window-hours <1-720> (default 72).",
             "grade <id> [--now]: puts one submission back in the take-home grader's queue. The grader runs on Railway every 5 minutes; --now says so rather than pretending the run happened here.",
             "resume <id> [--out <path>] [--force]: the candidate's resume, the same file the drawer's Open resume button shows. Bare, it prints a signed link that dies in 60 seconds; --out downloads the file to that path and refuses to overwrite one already there unless you pass --force.",
             "takehome show <role> — the subject, body, link and the reviewer's rubric for that role.",

package/dist/commands/local-help-commands.js

@@ -366,6 +366,20 @@ export function localSubcommandHelp(command) {
                 "laptop that has been off.",
             ],
         ],
+        [
+            "sources",
+            [
+                "Usage: cockpit sources check [--older-than <days>] [--dashboard-url <url>] [--json]",
+                "",
+                "Answers, for every Codex and Claude transcript on this machine, whether Tower",
+                "holds it: stored in full, stored in part, or not stored, with the reason.",
+                "--older-than <days> checks only files not modified in that many days.",
+                "--json lists every file with its path, verdict and reason.",
+                "Read-only. Tower never deletes these files; deleting one is your own act.",
+                "Before deleting any transcript by hand, run this and delete only files it",
+                "answers \"stored in full\". See docs/runbooks/freeing-disk-on-a-collector-machine.md.",
+            ],
+        ],
         [
             "release",
             [

package/dist/commands/local-help.js

@@ -65,6 +65,7 @@ export const rootCommandNames = new Set([
     "agent-rules",
     "memory",
     "clean",
+    "sources",
     "docs",
     "msg",
     "issue",
@@ -117,6 +118,7 @@ export function localCommandHelp(command) {
         "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",
         "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|install|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
         "  cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
+        "  cockpit sources check [--older-than <days>] [--dashboard-url <url>] [--json]",
         "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>|delete <id|slug>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",
         "  cockpit msg [channels|create <name>|dm <email>|read <channel>|send <channel>|thread <id> --channel <channel>] [--private] [--members a@x,b@y] [--description <text>] [--thread <id>] [--limit <n>] [--dashboard-url <url>] [--json]",
         "  cockpit issue [list|show <BLI-id>|create --title <t>|update <BLI-id>|move <BLI-id> <state>|comment <BLI-id>|history <BLI-id>] [--state <s>] [--assignee me|unassigned|<uuid>] [--project <name|id>] [--limit <n>] [--priority 0-4] [--size S|M|L] [--parent <BLI-id>] [--file <path>|--body-stdin] [--dashboard-url <url>] [--json]",
@@ -125,7 +127,7 @@ export function localCommandHelp(command) {
         "  cockpit project [list] [--archived] [--dashboard-url <url>] [--json]",
         `  cockpit search "<words>" [--kind ${SEARCH_KINDS.join(",")}] [--limit <n>] [--dashboard-url <url>] [--json]`,
         "  cockpit release [--dry-run] [--skip-checks] [--no-floor] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
-        "  cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <passed_on|archived|reopen>|grade <id> [--now]|resume <id> [--out <path>]|takehome show <role>|takehome set <role> --body-file <path>|settings show|settings set --enabled <true|false>] [--role <slug>] [--min-score <n>] [--since <date>] [--stage <s>] [--force] [--json]",
+        "  cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <passed_on|archived|reopen>|followup <id> [--record-sent-at <iso>]|grade <id> [--now]|resume <id> [--out <path>]|takehome show <role>|takehome set <role> --body-file <path>|settings show|settings set --enabled <true|false> --followup-enabled <true|false> --followup-after-days <n> --takehome-window-hours <n>] [--role <slug>] [--min-score <n>] [--since <date>] [--stage <s>] [--force] [--json]",
         "  cockpit usage sessions [--task <BLI-NNNN> | --subject <name>] [--repo <label>] [--since <window>] [--json]",
         "  cockpit usage sessions --session <id> [--from-window <n>] [--json]",
         "  --by-topic groups work types; --by-subject groups open subjects from session summaries.",

package/dist/commands/local.js

@@ -37,6 +37,7 @@ import { runMemoryLog } from "./memory-log.js";
 import { runMemoryInstall } from "./memory-install.js";
 import { runMemoryStore, runMemoryVerbList } from "./memory-store.js";
 import { runClean } from "./clean.js";
+import { runSourcesCheck } from "./sources-check.js";
 import { runDocs } from "./docs.js";
 import { runMsg } from "./msg.js";
 import { runIssue } from "./issue.js";
@@ -213,6 +214,8 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
                 return await runMemoryStore(command, io);
             case "clean":
                 return await runClean(command, io);
+            case "sources":
+                return await runSourcesCheck(command, io);
             case "docs":
                 return await runDocs(command, io);
             case "msg":

package/dist/commands/notes-writes.js

@@ -3,7 +3,7 @@
  * sharing it and taking it back, and moving it to another shelf. Sibling of
  * `notes.ts`, named in its header.
  */
-import { isInteractiveStdin, readLine, readPipedText, writeLine, yesByDefault } from "./cli-io.js";
+import { isInteractiveStdin, readPipedText, writeLine, askYesNo } from "./cli-io.js";
 import { NOTE_SLOW_UPLOAD_BYTES, noteAudioMime, decodeTextBytes, noteFileRefusalSentence, readNoteFile, } from "./notes-file.js";
 import { ask, emit, fail, sayUpload, errorText, TAG, READ_DEADLINE_MS } from "./notes-door.js";
 /**
@@ -165,8 +165,8 @@ export async function shareNote(command, door) {
         if (!isInteractiveStdin(door.io)) {
             return fail(door, "confirmation_required", "Sharing a note lets everyone signed in read it. Pass --yes to do it without being asked.");
         }
-        const answer = await readLine(door.io, "Share this note with everyone signed in? [Y/n] ");
-        if (!yesByDefault(answer)) {
+        const shareYes = await askYesNo(door.io, "Share this note with everyone signed in? [Y/n] ");
+        if (!shareYes) {
             writeLine(door.io.stderr, `${TAG} share declined ${JSON.stringify({ reason: "operator_said_no" })}`);
             writeLine(door.io.stdout, "Left alone. Nothing changed.");
             return 0;

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.158");
+    writeLine(io?.stdout ?? process.stdout, "0.2.160");
     return 0;
   }
 

package/dist/commands/settings.js

@@ -19,7 +19,7 @@
  * that takes one. New content arrives on stdin and is forwarded without ever
  * being written to stdout, stderr, or an argument vector.
  */
-import { isInteractiveStdin, readLine, writeLine, yesByDefault } from "./cli-io.js";
+import { isInteractiveStdin, readLine, settleYesNo, writeLine } from "./cli-io.js";
 import { cacheAgeLabel, readThroughCache } from "./read-cache.js";
 import { asList, asRecord, callTower, isForbidden, openTower, parseModelKey, readAllStdin, writeCommandFailure, } from "./tower-command.js";
 import { showOverview } from "./settings-overview.js";
@@ -374,8 +374,9 @@ export async function confirmDestructive(command, io, prompt, label) {
         };
     }
     const answer = await readLine(io, prompt);
-    if (yesByDefault(answer))
+    if (await settleYesNo(io, answer, prompt, { emptyIsYes: false, reask: false })) {
         return { ok: true };
+    }
     return {
         ok: false,
         reason: "declined",

package/dist/commands/sources-check.js

@@ -0,0 +1,135 @@
+import { writeLine } from "./cli-io.js";
+import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { fetchTranscriptObjects } from "../evidence-transcripts-client.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
+import { discoverLocalTranscripts } from "./sources-discovery.js";
+import { fileFacts, judgeSource } from "./sources-verdict.js";
+const VERDICTS = ["stored_full", "stored_partial", "not_stored"];
+const DAY_MS = 24 * 60 * 60 * 1000;
+export async function runSourcesCheck(command, io, now = new Date()) {
+    const startedAt = Date.now();
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    const config = await readLocalCollectorConfig(paths).catch(() => null);
+    const dashboardUrl = command.dashboardUrl ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL;
+    const session = await readLocalCollectorSessionFile(paths).catch(() => null);
+    if (!session || session.session_state !== "valid" || typeof session.device_token !== "string" || !session.device_token) {
+        console.error("[collector sources] check not run", JSON.stringify({ reason: "collector_not_paired" }));
+        return fail(io, command, "collector_not_paired", "This machine is not signed in to Tower, so Tower cannot be asked. Run `cockpit doctor`.");
+    }
+    const remote = await fetchTranscriptObjects({ dashboardUrl, deviceToken: session.device_token, fetchImpl: io.fetch });
+    if (remote.status === "unavailable") {
+        console.error("[collector sources] check not answered", JSON.stringify({ reason: `transcript_door_unavailable:${remote.reason}` }));
+        return fail(io, command, `transcript_door_unavailable:${remote.reason}`, `Tower could not be asked which transcripts it holds (${remote.reason}). No file is answered; nothing here means "not stored".`);
+    }
+    const homeDir = command.homeDir ?? paths.home_dir;
+    const olderThanMs = command.olderThanDays === null ? null : now.getTime() - command.olderThanDays * DAY_MS;
+    const local = await discoverLocalTranscripts({ homeDir, olderThanMs });
+    const cursors = {
+        codex: await readRawEvidenceCursor(paths),
+        claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),
+    };
+    const report = emptyReport(command, remote, local.newer_count, local.file_read_failed + local.directory_read_failed);
+    for (const file of local.files) {
+        const judged = await judgeSource({
+            file,
+            remotes: remote.files.get(file.key) ?? [],
+            cursorEntry: file.kind === "claude_subagent" ? null : (cursors[file.source].sessions[file.session_id] ?? null),
+            facts: fileFacts(file),
+        }).catch((error) => {
+            report.local.unreadable += 1;
+            console.error("[collector sources] a transcript could not be judged; left out of the answer", JSON.stringify({ reason: "file_unreadable", kind: file.kind, byte_size: file.byte_size, error_name: error?.name ?? "Error" }));
+            return null;
+        });
+        if (!judged)
+            continue;
+        report.local.examined += 1;
+        report.counts[judged.verdict].files += 1;
+        report.counts[judged.verdict].bytes += file.byte_size;
+        report.reasons[judged.reason] = (report.reasons[judged.reason] ?? 0) + 1;
+        report.files.push({
+            path: file.file_path,
+            source: file.source,
+            kind: file.kind,
+            session_id: file.session_id,
+            byte_size: file.byte_size,
+            modified_at: new Date(file.mtime_ms).toISOString(),
+            verdict: judged.verdict,
+            reason: judged.reason,
+            remote_byte_size: judged.remote_byte_size,
+        });
+    }
+    report.files.sort((a, b) => VERDICTS.indexOf(a.verdict) - VERDICTS.indexOf(b.verdict) || a.path.localeCompare(b.path));
+    // Counts and bytes only: never a path, a session id or a byte of content.
+    console.error("[collector sources] check", JSON.stringify({
+        reason: `sources_check_${report.status}`,
+        older_than_days: report.older_than_days,
+        remote_status: remote.status,
+        remote_unique: remote.unique,
+        examined: report.local.examined,
+        newer_skipped: report.local.newer_skipped,
+        unreadable: report.local.unreadable,
+        stored_full: report.counts.stored_full,
+        stored_partial: report.counts.stored_partial,
+        not_stored: report.counts.not_stored,
+        reasons: report.reasons,
+        elapsed_ms: Date.now() - startedAt,
+    }));
+    if (command.json)
+        writeLine(io.stdout, JSON.stringify(report, null, 2));
+    else
+        for (const line of sourcesCheckLines(report))
+            writeLine(io.stdout, line);
+    return 0;
+}
+function emptyReport(command, remote, newerSkipped, unreadable) {
+    const { files, ...remoteCounts } = remote;
+    return {
+        status: remote.status === "exhausted" ? "complete" : "incomplete",
+        reason: remote.status === "exhausted" ? "ok" : `transcript_list_${remote.status}${remote.reason === "ok" ? "" : `:${remote.reason}`}`,
+        older_than_days: command.olderThanDays,
+        remote: { ...remoteCounts, file_count: files.size },
+        local: { examined: 0, newer_skipped: newerSkipped, unreadable },
+        counts: {
+            stored_full: { files: 0, bytes: 0 },
+            stored_partial: { files: 0, bytes: 0 },
+            not_stored: { files: 0, bytes: 0 },
+        },
+        reasons: {},
+        files: [],
+    };
+}
+function fail(io, command, reason, sentence) {
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ status: "unavailable", reason, older_than_days: command.olderThanDays }, null, 2));
+    }
+    else {
+        writeLine(io.stderr, sentence);
+    }
+    return 1;
+}
+/** What a person reads: counts and bytes per verdict, then why. Paths only with --json. */
+export function sourcesCheckLines(report) {
+    const scope = report.older_than_days === null ? "every transcript" : `transcripts not modified in ${report.older_than_days} days`;
+    const lines = [
+        `Tower sources check: ${scope} on this machine`,
+        `  stored in full   ${report.counts.stored_full.files} file(s), ${mb(report.counts.stored_full.bytes)} MB`,
+        `  stored in part   ${report.counts.stored_partial.files} file(s), ${mb(report.counts.stored_partial.bytes)} MB`,
+        `  not stored       ${report.counts.not_stored.files} file(s), ${mb(report.counts.not_stored.bytes)} MB`,
+    ];
+    const reasons = Object.entries(report.reasons).sort((a, b) => b[1] - a[1]);
+    if (reasons.length > 0)
+        lines.push(`  why              ${reasons.map(([reason, count]) => `${reason} ${count}`).join(", ")}`);
+    if (report.local.newer_skipped > 0)
+        lines.push(`  newer            ${report.local.newer_skipped} file(s) modified inside the window, not checked`);
+    if (report.local.unreadable > 0)
+        lines.push(`  unreadable       ${report.local.unreadable} file(s) could not be read and are not answered`);
+    lines.push(`  Tower's list     ${report.remote.status}: ${report.remote.unique} current transcript object(s) over ${report.remote.pages} page(s)`);
+    if (report.status === "incomplete") {
+        lines.push(`  INCOMPLETE       Tower's list was cut short (${report.reason}); "not stored" and "stored in part" may be understated. Run it again.`);
+    }
+    lines.push("Tower never deletes these files. `--json` lists every file with its path and verdict. Only a \"stored in full\" file is safe to delete by your own hand; see docs/runbooks/freeing-disk-on-a-collector-machine.md.");
+    return lines;
+}
+function mb(bytes) {
+    return (bytes / (1024 * 1024)).toFixed(1);
+}

package/dist/commands/sources-discovery.js

@@ -0,0 +1,232 @@
+/**
+ * Every agent transcript on this machine, named the way the collector names
+ * its upload (BLI-11122).
+ *
+ * `cockpit sources check` has to pair each local file with the object Tower
+ * holds for it, and an object key carries the session id the collector read
+ * from the transcript's CONTENT, not its file name (a resumed or forked Codex
+ * rollout is filed under one id and names another; see
+ * `backfill-stub-locate.ts`). So each file is named by the same rules the
+ * readers use, kept here as pure functions so both path layouts (macOS and
+ * Windows) are testable without either file system:
+ *
+ * - Codex (`~/.codex/sessions/**`, `~/.codex/archived_sessions/**`): the first
+ *   `session_meta` record's `payload.id`, else the uuid in the file name, else
+ *   a hash of the path (`codex-attribution.ts`).
+ * - Claude main (`~/.claude/projects/<project>/<uuid>.jsonl`): the first
+ *   record's `sessionId`, else the file name's uuid (`claude-attribution-score.ts`).
+ * - Claude subagent (`<project>/<uuid>/subagents/agent-*.jsonl`): the main's
+ *   session id plus the file stem (`raw-evidence-claude-reader.ts`).
+ *
+ * This module reads files and never writes, moves or deletes one.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createReadStream } from "node:fs";
+import readline from "node:readline";
+import { transcriptFileKey } from "@bli-cockpit/telemetry-core";
+import { SESSION_FILE_UUID_PATTERN, sanitizeSessionId, sessionIdFromFileName, shortHash, } from "../adapters/attribution-core.js";
+import { isSecretLikePath, safeKeySegment } from "../adapters/raw-evidence-keys.js";
+import { describeError } from "../health-detail.js";
+export function sourcesRoots(homeDir, pathApi = path) {
+    return {
+        codex: [
+            pathApi.join(homeDir, ".codex", "sessions"),
+            pathApi.join(homeDir, ".codex", "archived_sessions"),
+        ],
+        claudeProjects: pathApi.join(homeDir, ".claude", "projects"),
+    };
+}
+/** Which kind of transcript a path is, or null for anything the collector does not upload as one. */
+export function classifyTranscriptPath(filePath, roots, pathApi = path) {
+    if (!filePath.toLowerCase().endsWith(".jsonl"))
+        return null;
+    for (const root of roots.codex) {
+        const rel = pathApi.relative(root, filePath);
+        if (rel && !rel.startsWith("..") && !pathApi.isAbsolute(rel))
+            return { kind: "codex_rollout" };
+    }
+    const rel = pathApi.relative(roots.claudeProjects, filePath);
+    if (!rel || rel.startsWith("..") || pathApi.isAbsolute(rel))
+        return null;
+    const parts = rel.split(pathApi.sep);
+    if (parts.length === 2 && SESSION_FILE_UUID_PATTERN.test(parts[1]))
+        return { kind: "claude_main" };
+    if (parts.length === 4 && parts[2] === "subagents" && parts[3].startsWith("agent-")) {
+        return {
+            kind: "claude_subagent",
+            main_session_dir: parts[1],
+            sidecar_stem: parts[3].replace(/\.jsonl$/i, ""),
+        };
+    }
+    return null;
+}
+/** The session id a reader would key this file's session by, from its content id when it has one. */
+export function sessionIdFor(filePath, contentId, pathApi = path) {
+    const fromContent = sanitizeSessionId(contentId ?? undefined);
+    if (fromContent)
+        return { session_id: fromContent, session_id_source: "content" };
+    const fromName = sessionIdFromFileName(pathApi.basename(filePath));
+    if (fromName)
+        return { session_id: fromName, session_id_source: "file_name" };
+    return { session_id: shortHash(filePath), session_id_source: "path_hash" };
+}
+/** The key of the object a file would be uploaded as; see `raw-evidence-*-reader.ts`. */
+export function transcriptKeyFor(source, sessionId, sidecarStem) {
+    const identity = {
+        source,
+        session_id: safeKeySegment(sessionId),
+        sidecar: sidecarStem === null ? null : isSecretLikePath(sidecarStem) ? "redacted-file-name" : safeKeySegment(sidecarStem),
+    };
+    return transcriptFileKey(identity);
+}
+/**
+ * The first content id in a transcript: Codex's first `session_meta`
+ * `payload.id`, Claude's first `sessionId`. Streams line by line and stops at
+ * the first hit; a line that does not parse is skipped, as the readers do.
+ */
+export async function readContentSessionId(filePath, source) {
+    const stream = createReadStream(filePath, { encoding: "utf8" });
+    const lines = readline.createInterface({ input: stream, crlfDelay: Infinity });
+    try {
+        for await (const line of lines) {
+            const id = contentIdFromLine(line, source);
+            if (id)
+                return id;
+        }
+        return null;
+    }
+    finally {
+        lines.close();
+        stream.destroy();
+    }
+}
+export function contentIdFromLine(line, source) {
+    if (!line.trim())
+        return null;
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    if (!record || typeof record !== "object" || Array.isArray(record))
+        return null;
+    const entry = record;
+    if (source === "claude_code")
+        return trimmed(entry["sessionId"]);
+    if (entry["type"] !== "session_meta")
+        return null;
+    const payload = entry["payload"];
+    if (!payload || typeof payload !== "object")
+        return null;
+    return trimmed(payload["id"]);
+}
+function trimmed(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+/**
+ * Walk every root, name every transcript. `olderThanMs` keeps only files whose
+ * mtime is before it; the rest are counted, never read.
+ */
+export async function discoverLocalTranscripts(options) {
+    const roots = sourcesRoots(options.homeDir);
+    const result = { files: [], newer_count: 0, directory_read_failed: 0, file_read_failed: 0 };
+    const found = [];
+    let firstFailure = null;
+    const stack = [...roots.codex, roots.claudeProjects];
+    const seen = new Set();
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = await fs.readdir(dir, { withFileTypes: true });
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT") {
+                result.directory_read_failed += 1;
+                firstFailure ??= describeError(error);
+            }
+            continue;
+        }
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(full);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const shape = classifyTranscriptPath(full, roots);
+            if (!shape || seen.has(full))
+                continue;
+            seen.add(full);
+            const stat = await fs.stat(full).catch((error) => {
+                result.file_read_failed += 1;
+                firstFailure ??= describeError(error);
+                return null;
+            });
+            if (!stat)
+                continue;
+            if (options.olderThanMs !== null && stat.mtimeMs >= options.olderThanMs) {
+                result.newer_count += 1;
+                continue;
+            }
+            found.push({ file: full, size: stat.size, mtimeMs: stat.mtimeMs, shape });
+        }
+    }
+    // Claude mains first, so a subagent file can take its main's content id.
+    const claudeMainIds = new Map();
+    found.sort((a, b) => shapeOrder(a.shape) - shapeOrder(b.shape) || a.file.localeCompare(b.file));
+    for (const item of found) {
+        const source = item.shape.kind === "codex_rollout" ? "codex" : "claude_code";
+        let contentId = null;
+        if (item.shape.kind !== "claude_subagent") {
+            const read = await readContentSessionId(item.file, source).then((id) => ({ ok: true, id }), (error) => {
+                result.file_read_failed += 1;
+                firstFailure ??= describeError(error);
+                return { ok: false, id: null };
+            });
+            if (!read.ok)
+                continue;
+            contentId = read.id;
+        }
+        let named;
+        if (item.shape.kind === "claude_subagent") {
+            // The reader keys a subagent file under its MAIN session's id.
+            const mainPath = path.join(path.dirname(path.dirname(path.dirname(item.file))), `${item.shape.main_session_dir}.jsonl`);
+            const known = claudeMainIds.get(mainPath);
+            named = known
+                ? { session_id: known, session_id_source: "content" }
+                : sessionIdFor(mainPath, await readContentSessionId(mainPath, "claude_code").catch(() => null));
+        }
+        else {
+            named = sessionIdFor(item.file, contentId);
+            if (item.shape.kind === "claude_main")
+                claudeMainIds.set(item.file, named.session_id);
+        }
+        result.files.push({
+            source,
+            kind: item.shape.kind,
+            file_path: item.file,
+            byte_size: item.size,
+            mtime_ms: item.mtimeMs,
+            ...named,
+            key: transcriptKeyFor(source, named.session_id, item.shape.kind === "claude_subagent" ? item.shape.sidecar_stem : null),
+        });
+    }
+    if (result.directory_read_failed > 0 || result.file_read_failed > 0) {
+        console.error("[collector sources] some transcripts could not be read; they are left out of the answer", JSON.stringify({
+            reason: "sources_discovery_incomplete",
+            directory_read_failed: result.directory_read_failed,
+            file_read_failed: result.file_read_failed,
+            found_count: result.files.length,
+            ...(firstFailure ? { first_failure: firstFailure } : {}),
+        }));
+    }
+    return result;
+}
+function shapeOrder(shape) {
+    return shape.kind === "claude_main" ? 0 : shape.kind === "codex_rollout" ? 1 : 2;
+}

package/dist/commands/sources-verdict.js

@@ -0,0 +1,128 @@
+/**
+ * Does Tower hold this transcript, in full, in part, or not at all?
+ * (BLI-11122)
+ *
+ * One file, the current objects Tower lists for it, and this machine's cursor
+ * entry for its session. The rules, cheapest first; every answer names why:
+ *
+ *   not_stored      no current object for the file (`no_object`), or only the
+ *                   redaction-crash stub (`stub_only`): a stub holds no byte.
+ *   stored_full     the cursor's uploaded object is still current, the file
+ *                   is the size it was when uploaded and its hash is the one the
+ *                   cursor last recorded (`unchanged_since_upload`); or the
+ *                   file, redacted exactly as the upload redacts it, has the
+ *                   hash of a current object (`content_hash_match`) or is no
+ *                   larger than one (`remote_at_least_sanitized_size`).
+ *   stored_partial  a current object exists but is smaller than the redacted
+ *                   file (`changed_since_upload` when the cursor saw the file
+ *                   grow after its upload, else `remote_smaller`), or its size
+ *                   is not recorded (`remote_size_unknown`).
+ *
+ * A file too large to redact in memory is compared by its raw size
+ * (`remote_at_least_file_size`). A file whose redaction would crash to the stub
+ * is compared the same way, never by the stub's 42 bytes.
+ *
+ * Read-only: this module reads the file and never writes, moves or deletes it.
+ */
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, REDACTION_STUB_SHA256, } from "@bli-cockpit/telemetry-core";
+import { sanitizeTextEvidenceForUpload } from "../adapters/raw-evidence-sanitize.js";
+import { isSecretLikePath } from "../adapters/raw-evidence-keys.js";
+export async function judgeSource(input) {
+    const { file, remotes, cursorEntry } = input;
+    if (remotes.length === 0)
+        return { verdict: "not_stored", reason: "no_object", remote_byte_size: null };
+    const held = remotes.filter((remote) => !remote.stub);
+    if (held.length === 0)
+        return { verdict: "not_stored", reason: "stub_only", remote_byte_size: null };
+    const sizes = held.map((remote) => remote.byte_size).filter((size) => size !== null);
+    const best = sizes.length > 0 ? Math.max(...sizes) : null;
+    const full = (reason) => ({ verdict: "stored_full", reason, remote_byte_size: best });
+    const partial = (reason) => ({
+        verdict: "stored_partial",
+        reason,
+        remote_byte_size: best,
+    });
+    if (cursorEntry &&
+        !cursorEntry.stubbed &&
+        cursorEntry.uploaded_object_key &&
+        held.some((remote) => remote.object_key === cursorEntry.uploaded_object_key) &&
+        cursorEntry.uploaded_byte_size === file.byte_size &&
+        cursorEntry.file_hash_sha256 &&
+        cursorEntry.file_hash_sha256 === (await input.facts.rawSha256())) {
+        return full("unchanged_since_upload");
+    }
+    const sanitized = await input.facts.sanitized();
+    if (sanitized) {
+        if (held.some((remote) => remote.content_hash_sha256 === sanitized.sha256))
+            return full("content_hash_match");
+        if (best === null)
+            return partial("remote_size_unknown");
+        if (best >= sanitized.byte_size)
+            return full("remote_at_least_sanitized_size");
+    }
+    else {
+        if (best === null)
+            return partial("remote_size_unknown");
+        if (best >= file.byte_size)
+            return full("remote_at_least_file_size");
+    }
+    const grewAfterUpload = cursorEntry?.uploaded_object_key != null &&
+        cursorEntry.uploaded_byte_size != null &&
+        cursorEntry.uploaded_byte_size < file.byte_size;
+    return partial(grewAfterUpload ? "changed_since_upload" : "remote_smaller");
+}
+/**
+ * Reads the file at most once, on first ask, and redacts it exactly as the
+ * upload does (`raw-evidence-transcript-file.ts`): same sanitizer, same
+ * secret-like-name rule, same byte cap.
+ */
+export function fileFacts(file, maxBytes = RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES) {
+    let bytes = null;
+    const read = () => {
+        bytes ??= file.byte_size > maxBytes ? Promise.resolve(null) : fs.readFile(file.file_path);
+        return bytes;
+    };
+    let rawHash = null;
+    let sanitized = null;
+    return {
+        rawSha256() {
+            rawHash ??= read().then(async (buffer) => (buffer ? sha256(buffer) : await streamSha256(file.file_path)));
+            return rawHash;
+        },
+        sanitized() {
+            sanitized ??= read().then((buffer) => {
+                if (!buffer)
+                    return null;
+                const result = sanitizeTextEvidenceForUpload({
+                    text: buffer.toString("utf8"),
+                    originalBytes: buffer,
+                    redactedFields: [`${file.kind === "codex_rollout" ? "codex_jsonl" : file.kind === "claude_main" ? "claude_jsonl" : "claude_jsonl_sidecar"}.body`],
+                    secretLikeFileName: isSecretLikePath(path.basename(file.file_path)),
+                });
+                const hash = sha256(result.bytes);
+                if (hash === REDACTION_STUB_SHA256)
+                    return null;
+                return { sha256: hash, byte_size: result.bytes.byteLength };
+            });
+            return sanitized;
+        },
+    };
+}
+function sha256(buffer) {
+    return crypto.createHash("sha256").update(buffer).digest("hex");
+}
+async function streamSha256(filePath) {
+    const hash = crypto.createHash("sha256");
+    const handle = await fs.open(filePath, "r");
+    try {
+        for await (const chunk of handle.createReadStream())
+            hash.update(chunk);
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+    return hash.digest("hex");
+}

package/dist/evidence-transcripts-client.js

@@ -0,0 +1,118 @@
+/**
+ * Asks `POST /api/ambient/evidence/transcripts` for every current transcript
+ * object this operator owns, and groups the answer by local transcript file
+ * (BLI-11122). `cockpit sources check` compares each group to the file on disk.
+ *
+ * Never throws. A door that cannot be asked (an older dashboard answers 404, a
+ * network error, a malformed page) returns `unavailable` with the reason and
+ * the check says so instead of guessing.
+ *
+ * Bounded pages of up to 500, walked by the server's keyset cursor, at most
+ * `maxPages` of them. The result says whether the list was exhausted, capped by
+ * `maxPages`, or cut short by a failed page after some landed, and carries the
+ * requested, returned and unique counts so completeness is a number, not a claim.
+ */
+import { EVIDENCE_TRANSCRIPTS_MAX_PAGE, EVIDENCE_TRANSCRIPTS_SCHEMA_VERSION, EvidenceTranscriptsResponseSchema, transcriptFileFromObjectKey, transcriptFileKey, } from "@bli-cockpit/telemetry-core";
+import { describeError } from "./health-detail.js";
+const TRANSCRIPTS_PAGE_TIMEOUT_MS = 30_000;
+/** 400 pages of 500 is 200,000 current transcript objects: far past any operator today. */
+export const TRANSCRIPTS_DEFAULT_MAX_PAGES = 400;
+export async function fetchTranscriptObjects(options) {
+    const maxPages = options.maxPages ?? TRANSCRIPTS_DEFAULT_MAX_PAGES;
+    const pageSize = Math.min(options.pageSize ?? EVIDENCE_TRANSCRIPTS_MAX_PAGE, EVIDENCE_TRANSCRIPTS_MAX_PAGE);
+    const files = new Map();
+    const seen = new Set();
+    let returned = 0;
+    let unkeyed = 0;
+    let pages = 0;
+    let after = null;
+    for (;;) {
+        if (pages >= maxPages)
+            return finish("capped", "ok");
+        const page = await requestPage({ ...options, after, limit: pageSize });
+        if (!page.ok)
+            return finish(pages === 0 ? "unavailable" : "failed_partial", page.reason);
+        pages += 1;
+        for (const object of page.objects) {
+            returned += 1;
+            if (seen.has(object.ref_id))
+                continue;
+            seen.add(object.ref_id);
+            addObject(object);
+        }
+        // Advance by what the server returned; a page that names no cursor is the last.
+        if (!page.nextAfter)
+            return finish("exhausted", "ok");
+        after = page.nextAfter;
+    }
+    function addObject(object) {
+        const identity = transcriptFileFromObjectKey(object.object_key);
+        if (!identity) {
+            unkeyed += 1;
+            return;
+        }
+        const key = transcriptFileKey(identity);
+        const list = files.get(key) ?? [];
+        list.push({
+            object_key: object.object_key,
+            byte_size: object.byte_size,
+            content_hash_sha256: object.content_hash_sha256,
+            stub: object.stub,
+        });
+        files.set(key, list);
+    }
+    function finish(status, reason) {
+        const result = {
+            status,
+            reason,
+            pages,
+            requested: pages * pageSize,
+            returned,
+            unique: seen.size,
+            unkeyed,
+            files,
+        };
+        console.error("[collector sources] transcript objects listed", JSON.stringify({
+            reason: status === "unavailable" ? `transcript_door_unavailable:${reason}` : `transcripts_${status}`,
+            pages,
+            requested: result.requested,
+            returned,
+            unique: seen.size,
+            unkeyed,
+            file_count: files.size,
+            ...(status === "failed_partial" ? { failure: reason } : {}),
+        }));
+        return result;
+    }
+}
+async function requestPage(options) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), TRANSCRIPTS_PAGE_TIMEOUT_MS);
+    try {
+        const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/evidence/transcripts`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${options.deviceToken}`,
+            },
+            body: JSON.stringify({
+                schema_version: EVIDENCE_TRANSCRIPTS_SCHEMA_VERSION,
+                after: options.after,
+                limit: options.limit,
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return { ok: false, reason: `http_${response.status}` };
+        const parsed = EvidenceTranscriptsResponseSchema.safeParse(await response.json().catch(() => null));
+        if (!parsed.success)
+            return { ok: false, reason: "invalid_response" };
+        return { ok: true, objects: parsed.data.objects, nextAfter: parsed.data.next_after };
+    }
+    catch (error) {
+        return { ok: false, reason: describeError(error).error_name };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}

package/dist/onboarding-roots.js

@@ -1,4 +1,5 @@
 import fs from "node:fs/promises";
+import { parseYesNo } from "./yes-no.js";
 import { realpathSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -235,12 +236,11 @@ async function promptForHomeRootOptIn(options, rejections) {
 // Anything that isn't recognisably yes still routes to the decline prompt,
 // where a typed path is recoverable rather than lost.
 function isHomeRootYes(raw) {
-    const answer = raw.trim().split(/\s+/u)[0]?.toLowerCase() ?? "";
-    if (answer === "")
-        return true;
-    if (answer.startsWith("n"))
-        return false;
-    return answer.startsWith("y");
+    // BLI-12189: "you know what, no" used to pass on its leading "y". Unclear
+    // routes to the decline prompt, where a typed path is recoverable.
+    const verdict = parseYesNo(raw, { emptyIsYes: true });
+    console.error(`[onboarding-roots] home root consent ${JSON.stringify({ verdict })}`);
+    return verdict === "yes";
 }
 async function promptForDeclinedHomeRoot(options, homeDir) {
     const prompt = requirePrompt(options);

package/dist/yes-no.js

@@ -0,0 +1,28 @@
+/**
+ * The ONE reading of a typed yes/no answer (BLI-12189).
+ *
+ * The old `yesByDefault` returned true unless the first word was exactly
+ * `n`/`no`, so "nope", "nah", "cancel", "don't" and "No thanks" confirmed a
+ * device revoke. Now only a recognised yes confirms; a no word or a leading
+ * "n" declines; everything else is `unclear` and the caller decides (a
+ * destructive prompt declines, a harmless one asks once more).
+ *
+ * Pure: no I/O, no logging. Callers log the outcome label.
+ */
+const YES_WORDS = new Set(["y", "yes", "yeah", "yep", "sure", "ok", "okay"]);
+const NO_WORDS = new Set(["cancel", "stop", "don't", "dont", "never", "abort", "quit"]);
+/**
+ * `emptyIsYes`: bare Enter means yes where the prompt shows `[Y/n]`; on a
+ * `[y/N]` (destructive) prompt it means no.
+ */
+export function parseYesNo(raw, options) {
+    const first = raw.trim().split(/\s+/u)[0]?.toLowerCase() ?? "";
+    if (first === "")
+        return options.emptyIsYes ? "yes" : "no";
+    const word = first.replace(/[^\p{L}\p{N}']+$/gu, "");
+    if (YES_WORDS.has(word))
+        return "yes";
+    if (NO_WORDS.has(word) || word.startsWith("n"))
+        return "no";
+    return "unclear";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.158",
+  "version": "0.2.160",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,8 +27,8 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.42",
-    "@bli-cockpit/mcp": "0.1.76",
-    "@bli-cockpit/telemetry-core": "0.1.54"
+    "@bli-cockpit/memory-mcp": "0.1.44",
+    "@bli-cockpit/mcp": "0.1.78",
+    "@bli-cockpit/telemetry-core": "0.1.56"
   }
 }