@bli-cockpit/cli 0.2.168 → 0.2.170

package/dist/autostart-opt-out.js

@@ -0,0 +1,43 @@
+import { AUTOSTART_OPT_OUT_MARKER_FILE_NAME } from "@bli-cockpit/telemetry-core";
+import fs from "node:fs/promises";
+import path from "node:path";
+/**
+ * BLI-12828. The tick now CREATES a missing scheduler registration (an absent
+ * LaunchAgent / Scheduled Task is how a Mac goes quiet after a reboot), so
+ * "absent" can no longer double as "the operator removed it on purpose". This
+ * marker is that deliberate act: `cockpit autostart uninstall` writes it,
+ * `cockpit autostart install` and `cockpit doctor` clear it, and the tick's
+ * create-when-absent repair refuses while it stands.
+ *
+ * One small file under the state dir; it holds a timestamp, never a path.
+ */
+export const AUTOSTART_OPT_OUT_MARKER = AUTOSTART_OPT_OUT_MARKER_FILE_NAME;
+function markerPath(paths) {
+    return path.join(paths.state_dir, AUTOSTART_OPT_OUT_MARKER);
+}
+export async function isAutostartOptedOut(paths) {
+    return fs
+        .stat(markerPath(paths))
+        .then(() => true)
+        .catch(() => false);
+}
+export async function markAutostartOptedOut(paths, now = new Date()) {
+    try {
+        await fs.mkdir(paths.state_dir, { recursive: true, mode: 0o700 });
+        await fs.writeFile(markerPath(paths), now.toISOString());
+        console.error("[autostart] opt-out recorded; the sync tick will not re-create the scheduler until `cockpit autostart install`", JSON.stringify({ reason: "operator_uninstalled" }));
+    }
+    catch (error) {
+        console.error("[autostart] opt-out could not be recorded; the tick may re-create the scheduler", JSON.stringify({
+            reason: "opt_out_write_failed",
+            error_name: error instanceof Error ? error.name : typeof error,
+        }));
+    }
+}
+export async function clearAutostartOptOut(paths) {
+    const had = await isAutostartOptedOut(paths);
+    await fs.rm(markerPath(paths), { force: true }).catch(() => undefined);
+    if (had) {
+        console.error("[autostart] opt-out cleared; background sync is wanted again", JSON.stringify({ reason: "operator_installed" }));
+    }
+}

package/dist/autostart-self-heal.js

@@ -3,8 +3,12 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 import { autostartStatus, installAutostartAgent, registeredRuntimePathProblems, } from "./autostart.js";
 import { detectSecondCockpitInstall, secondInstallReason, } from "./second-install.js";
+import { isAutostartOptedOut } from "./autostart-opt-out.js";
 export const AUTOSTART_REPAIR_THROTTLE_MARKER = ".last-autostart-repair";
-const AUTOSTART_REPAIR_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
+// BLI-12828: the FIRST repair of a break never waits. The marker only spaces
+// out RETRIES of a repair that keeps failing, and a healthy reading clears it,
+// so the next break is repaired on the next tick, not a day later.
+const AUTOSTART_REPAIR_RETRY_AFTER_FAILURE_MS = 60 * 60 * 1000;
 const DETAIL_MAX_CHARS = 300;
 export async function runAutostartSelfHeal(paths, options) {
     const platform = options.platform ?? process.platform;
@@ -20,9 +24,12 @@ export async function runAutostartSelfHeal(paths, options) {
         exec: options.exec,
         platform,
     });
-    // Absent means the operator (or onboarding) owns the decision, not this tick.
-    if (status.status === "absent")
+    const absent = status.status === "absent";
+    if (absent && (await isAutostartOptedOut(paths))) {
+        // Said on the tick's own log so "why is this Mac not ticking" is answerable.
+        console.error("[autostart-self-heal] scheduler absent; not re-creating it, the operator uninstalled it on purpose", JSON.stringify({ reason: "autostart_uninstalled_by_operator", platform }));
         return null;
+    }
     // A registration can read as "loaded" and still name a binary that no longer
     // exists — that is precisely what `brew upgrade node` leaves behind. Ask the
     // filesystem about the paths the SCHEDULER holds, not the ones this process
@@ -34,11 +41,16 @@ export async function runAutostartSelfHeal(paths, options) {
             platform,
         })
         : [];
-    if (status.status !== "not_loaded" && runtimeProblems.length === 0) {
-        // Healthy is the steady state and stays silent.
+    const marker = path.join(paths.state_dir, AUTOSTART_REPAIR_THROTTLE_MARKER);
+    if (!absent && status.status !== "not_loaded" && runtimeProblems.length === 0) {
+        // Healthy is the steady state and stays silent. A marker left by an
+        // earlier attempt is spent: that repair worked, so the next break starts
+        // fresh instead of waiting out a retry window.
+        await fs.rm(marker, { force: true }).catch(() => undefined);
         return null;
     }
     const problem = [
+        ...(absent ? ["registration absent"] : []),
         ...(status.message ? [status.message] : []),
         ...runtimeProblems,
     ]
@@ -59,15 +71,16 @@ export async function runAutostartSelfHeal(paths, options) {
             step: platform === "darwin" ? "autostart_heal" : "autostart_repair",
         };
     }
-    // Attempts are throttled (marker mtime, written for the attempt not the
-    // outcome) so a persistently failing repair cannot run every 15 minutes. The
+    // Only a RETRY waits (marker mtime, written for the attempt not the
+    // outcome, cleared by the next healthy reading): a repair that keeps failing
+    // is retried hourly instead of churning the scheduler every 15 minutes. The
     // status probe above still runs every tick — it is one launchctl/schtasks
     // query.
     const now = options.now ?? new Date();
-    const marker = path.join(paths.state_dir, AUTOSTART_REPAIR_THROTTLE_MARKER);
     const lastAttempt = await fs.stat(marker).catch(() => null);
     if (lastAttempt &&
-        now.getTime() - lastAttempt.mtimeMs < AUTOSTART_REPAIR_MIN_INTERVAL_MS) {
+        now.getTime() - lastAttempt.mtimeMs < AUTOSTART_REPAIR_RETRY_AFTER_FAILURE_MS) {
+        console.error("[autostart-self-heal] scheduler still broken; the last repair attempt was under an hour ago, retrying after that", JSON.stringify({ reason: "repair_retry_waiting", platform }));
         return { status: "skipped", reason: "repair_throttled_recent_attempt" };
     }
     await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
@@ -85,7 +98,7 @@ export async function runAutostartSelfHeal(paths, options) {
     if (repaired.loaded) {
         return {
             status: "ok",
-            reason: "autostart_repaired",
+            reason: absent ? "autostart_created" : "autostart_repaired",
             detail: problem,
             step: "autostart_repair",
         };

package/dist/commands/autostart-command.js

@@ -1,6 +1,7 @@
 import { defaultExec, writeLine } from "./cli-io.js";
 import { runAutostartHealDetached } from "./autostart-heal.js";
 import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from "../autostart.js";
+import { clearAutostartOptOut, markAutostartOptedOut, } from "../autostart-opt-out.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
 export async function runAutostart(command, io) {
     if (command.action === "heal-detached") {
@@ -37,6 +38,15 @@ export async function runAutostart(command, io) {
                 intervalSeconds: command.intervalSeconds,
                 exec,
             });
+    // BLI-12828: the tick re-creates an absent scheduler, so a deliberate
+    // uninstall has to leave a mark the tick can read.
+    const optOutPaths = getCollectorRuntimePaths(command.homeDir);
+    if (command.action === "uninstall" && result.status !== "unsupported") {
+        await markAutostartOptedOut(optOutPaths);
+    }
+    else if (command.action === "install" && result.loaded !== false) {
+        await clearAutostartOptOut(optOutPaths);
+    }
     if (command.json) {
         writeLine(io.stdout, JSON.stringify(result, null, 2));
         return autostartExitCode(command.action, result);

package/dist/commands/autostart-heal.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { appendFile } from "node:fs/promises";
 import { AUTOSTART_LABEL, autostartStatus, reregisterDarwinAgent, writeDarwinAutostartPlist, } from "../autostart.js";
+import { isAutostartOptedOut } from "../autostart-opt-out.js";
 import { redactedHealthDetail } from "../health-detail.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
@@ -72,9 +73,10 @@ async function healDetached(command, io, deps) {
         exec,
         platform,
     });
-    if (before.status === "absent") {
-        // Repair what exists, never create.
-        return { status: "skipped", reason: "autostart_absent" };
+    if (before.status === "absent" &&
+        (await isAutostartOptedOut(getCollectorRuntimePaths(command.homeDir)))) {
+        // BLI-12828: absent is created now; only a deliberate uninstall stops it.
+        return { status: "skipped", reason: "autostart_uninstalled_by_operator" };
     }
     let written;
     try {
@@ -125,7 +127,7 @@ async function healDetached(command, io, deps) {
     }
     return {
         status: "ok",
-        reason: "autostart_healed",
+        reason: before.status === "absent" ? "autostart_created" : "autostart_healed",
         detail: `node_path_reason=${written.node_path_reason}`,
     };
 }

package/dist/commands/doctor-access.js

@@ -8,6 +8,7 @@ import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConf
 import { normalizeCollectionRoots } from "../root-normalization.js";
 import { detectSecondCockpitInstall } from "../second-install.js";
 import { hardStop, needsFix, ok, skipped } from "./doctor-report.js";
+import { SIGN_IN_ACTION } from "../sign-in-action.js";
 /**
  * The `authed`, `roots-ok`, and `single-install` check family: who is this
  * machine and where does it collect. Auth and roots are hard stops with no
@@ -31,7 +32,7 @@ export async function fixAuthState(context, state) {
             return checked;
     }
     if (!isInteractiveDoctorFix(context))
-        return { ...state, nextAction: "cockpit login" };
+        return { ...state, nextAction: SIGN_IN_ACTION };
     const code = await context.deps.runLogin(context).catch((error) => {
         // Exit code 1 with no reason at all is what an operator saw when doctor
         // tried and failed to repair their auth — the same output as a login that
@@ -73,13 +74,10 @@ export async function readAuthState(context) {
         }
         return ok("authed", "device_token_present", "this machine is signed in");
     }
-    return hardStop("authed", "pairing_required", [
-        "device is not signed in.",
-        "What you can do:",
-        "  1) Run `cockpit login` and complete the email/device approval.",
-        `  2) If this is a reused machine, run \`${onboardOneLiner(context.command)}\` to refresh onboarding.`,
-        "  3) Send this output to Edward if approval is blocked.",
-    ].join("\n"));
+    return {
+        ...hardStop("authed", "pairing_required", `this machine is signed out. ${SIGN_IN_ACTION}`),
+        nextAction: SIGN_IN_ACTION,
+    };
 }
 export async function readRootState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
@@ -92,13 +90,11 @@ export async function readRootState(context) {
             roots,
         };
     }
-    return hardStop("roots-ok", "no_roots", [
-        "no saved collection roots were found.",
-        "What you can do:",
-        `  1) Run \`${onboardOneLiner(context.command)}\` to save the workspace roots again.`,
-        "  2) If this is the wrong folder, rerun from the BLI workspace or pass `--workspace <path>`.",
-        "  3) Run `cockpit doctor` interactively to choose approved roots.",
-    ].join("\n"));
+    const action = `Run \`${onboardOneLiner(context.command)}\` in a terminal from the folder where you work.`;
+    return {
+        ...hardStop("roots-ok", "no_roots", `no collection folders are saved yet. ${action}`),
+        nextAction: action,
+    };
 }
 /**
  * BLI-3218/BLI-3553. Two Tower installs on one machine make each one's tick
@@ -164,10 +160,10 @@ function shellQuote(value) {
  * a gate on it, so a session sitting outside one is not a defect doctor found
  * and cannot repair. This row is therefore always informational (`ok`): it
  * reports how many of this scan's sessions were inside vs. outside, never
- * asks for approval, and attempts no fix. Widening the boundary still buys
- * the redacted transcript BYTES for those outside directories (those stay
- * root-gated), so the message still names `cockpit roots add` as something an
- * operator can choose to do, never something doctor is stuck waiting on. The
+ * asks for approval, and attempts no fix. Widening a root only adds the redacted transcript BYTES for those
+ * directories, so the message names `cockpit roots add` as an OPTIONAL step an
+ * operator can choose, never something doctor, or any person, is waiting on to
+ * approve. The
  * row only turns red the ordinary way every other doctor check does: the scan
  * itself throwing (`work_directory_scan_incomplete` from unreadable session
  * folders), which `runDoctorWithDeps`'s existing `check_threw` handling
@@ -182,9 +178,9 @@ export async function readRootsCoverWork(context) {
     const outsideCount = outside.reduce((sum, entry) => sum + entry.count, 0);
     const insideCount = scan.observed - outsideCount;
     if (!outsideCount)
-        return ok("roots-cover-work", "work_covered", `${scan.observed} sessions seen; no known working directories outside approved roots. ${sessionCoverageLine(scan, outsideCount)}`);
+        return ok("roots-cover-work", "work_covered", `${scan.observed} sessions seen; no working folders outside your saved roots. ${sessionCoverageLine(scan, outsideCount)}`);
     return {
-        ...ok("roots-cover-work", "work_outside_roots_labelled", `${insideCount} of ${scan.observed} sessions inside approved roots, ${outsideCount} outside — every one already reached the server, the outside ones carrying an outside label. Their redacted transcript content stays unuploaded until a root widens (scan ${scan.generated_at}):\n${outside.map(entry => `${entry.count}: ${entry.directory}\n  ${rootsAddCommand(entry.directory, process.platform, homeDir)}`).join("\n")}\n\n${sessionCoverageLine(scan, outsideCount)}`),
+        ...ok("roots-cover-work", "work_outside_roots_labelled", `${insideCount} of ${scan.observed} sessions inside your saved roots, ${outsideCount} outside — every one already reached the server, the outside ones carrying an outside label. Nothing needs approving. Optional: add a folder as a root to also upload its redacted transcript text (scan ${scan.generated_at}):\n${outside.map(entry => `${entry.count}: ${entry.directory}\n  ${rootsAddCommand(entry.directory, process.platform, homeDir)}`).join("\n")}\n\n${sessionCoverageLine(scan, outsideCount)}`),
         nextAction: rootsAddCommand(outside[0].directory, process.platform, homeDir),
     };
 }

package/dist/commands/doctor-mcp.js

@@ -30,6 +30,12 @@
  *             ledger with its reason label (`doctor-report.ts`'s `doctorEvent`
  *             maps every other status to `ok`).
  *
+ * BLI-12828: a `fail` (nothing answered) now has a repair. The server ships
+ * inside the CLI and is wired in by `memory install`, so the fix re-registers,
+ * takes the newest CLI if that alone did not wake it, and asks again; the row's
+ * receipt shows the before and after. A `needs_fix` (Tower refused) has none:
+ * the refusal is the sign-in's, and the `authed` row owns that.
+ *
  * `skipped` when the bin is not on this machine at all, for the same reason
  * `memory-registered` skips: nothing to probe is not a broken machine.
  */
@@ -95,4 +101,25 @@ function probeEnv(context) {
     if (context.command.dashboardUrl)
         base[TOWER_DASHBOARD_URL_ENV] = context.command.dashboardUrl;
     return base;
+}
+/**
+ * The `mcp-answers` repair (BLI-12828): re-register, then take the newest CLI,
+ * asking the server again after each. Heavy (it spawns the server and may run
+ * the updater), so doctor runs it only on a `fail` and the tick leaves it to
+ * the daily memory install and the CLI floor, which do the same two things.
+ */
+export async function fixMcpAnswersState(context, state) {
+    if (state.status !== "fail") {
+        console.error("[doctor] mcp-answers not repaired; Tower refused the call and the sign-in row owns that", JSON.stringify({ reason: state.code }));
+        return state;
+    }
+    await context.deps.fixMemory(context);
+    let checked = await context.deps.checkMcpAnswers(context);
+    console.error("[doctor] mcp-answers re-registered and asked again", JSON.stringify({ reason: checked.code, status: checked.status }));
+    if (checked.status === "fail") {
+        await context.deps.selfUpdate(context.io, { json: true, tag: context.command.updateTag });
+        checked = await context.deps.checkMcpAnswers(context);
+        console.error("[doctor] mcp-answers updated the CLI and asked again", JSON.stringify({ reason: checked.code, status: checked.status }));
+    }
+    return checked;
 }

package/dist/commands/doctor-registration.js

@@ -1,6 +1,8 @@
 import { inspectAgentRules, installAgentRules } from "../agent-rules.js";
 import { doctorRoots } from "./doctor-access.js";
 import { installAutostartAgent } from "../autostart.js";
+import { clearAutostartOptOut } from "../autostart-opt-out.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
 import { fail, needsFix, ok, skipped } from "./doctor-report.js";
 import { autostartDoctorStatus, autostartRegistrationRoots, readAutostartRegistration, } from "./autostart-reading.js";
 import { installMemoryIntegration, inspectMemoryIntegration, } from "./memory-install.js";
@@ -41,7 +43,7 @@ export async function fixAutostartState(context) {
     // leave the row red forever (BLI-3793).
     const roots = await autostartRegistrationRoots(context.command.homeDir, context.command.repoRoot);
     if (roots.length === 0)
-        return needsFix("autostart-alive", "no_roots", "Run `cockpit doctor` to choose approved collection roots first.");
+        return needsFix("autostart-alive", "no_roots", "Run `cockpit doctor` in a terminal and pick the folders where you work.");
     const result = await installAutostartAgent({
         ...(roots[0] ? { repoRoot: roots[0] } : {}),
         repoRoots: roots,
@@ -52,6 +54,10 @@ export async function fixAutostartState(context) {
     if (result.status === "unsupported") {
         return skipped("autostart-alive", "unsupported", result.message ?? "unsupported");
     }
+    if (result.loaded !== false) {
+        // BLI-12828: a person asked for background sync again; the tick may keep it.
+        await clearAutostartOptOut(getCollectorRuntimePaths(context.command.homeDir));
+    }
     if (result.loaded === false) {
         return fail("autostart-alive", "autostart_load_failed", result.message ?? "operating-system scheduler load failed");
     }
@@ -111,12 +117,12 @@ function memoryStepState(outcome, phase) {
 }
 export async function checkDoctorAgentRules(context) {
     const result = await inspectAgentRules({ homeDir: context.command.homeDir, scopePaths: await doctorRoots(context) });
-    return result.installed ? ok("agent-rules", "installed", "agent rules are installed for both hosts") : needsFix("agent-rules", "missing", "run `cockpit agent-rules install`");
+    return result.installed ? ok("agent-rules", "installed", "agent rules are installed for both hosts") : needsFix("agent-rules", "missing", "agent rules are missing; `cockpit agent-rules install` writes them");
 }
 export async function fixDoctorAgentRules(context) {
     const roots = await doctorRoots(context);
     if (roots.length === 0)
-        return needsFix("agent-rules", "no_roots", "Run `cockpit doctor` to choose approved roots first.");
+        return needsFix("agent-rules", "no_roots", "Run `cockpit doctor` in a terminal and pick the folders where you work.");
     await installAgentRules({ homeDir: context.command.homeDir, scopePaths: roots });
     return checkDoctorAgentRules(context);
 }

package/dist/commands/doctor-report.js

@@ -70,6 +70,8 @@ setupReceipt, repairs = []) {
         writeLine(io.stderr, `${row.id}:`);
         writeLine(io.stderr, row.message.replaceAll("—", ";"));
     }
+    for (const line of repairReceiptLines(repairs))
+        writeLine(io.stdout, line);
     // BLI-3731. The invariant table says whether collection is healthy; this
     // says whether the machine is CONNECTED — the browser sign-in, the device
     // session, both agent hosts and the scheduler, every word read back off this
@@ -132,6 +134,32 @@ export function asRecord(value) {
 export function writeLine(stream, text) {
     stream.write(`${text}\n`);
 }
+/** Fills each repair's before -> after receipt from the diagnosis and the final rows. */
+export function finalizeDoctorRepairs(repairs, diagnosed, rows, attempted) {
+    for (const repair of repairs) {
+        const found = diagnosed.get(repair.step);
+        const final = rows.find((row) => row.id === repair.step);
+        if (found) {
+            repair.before = `${found.status}:${found.code}`;
+            repair.before_message = oneLine(found.message);
+        }
+        if (final) {
+            repair.after = `${final.status}:${final.code}`;
+            repair.after_message = oneLine(final.message);
+        }
+        repair.fix_attempted = attempted.has(repair.step);
+    }
+}
+/** The "Repairs:" block of the human table; empty when no fix ran. */
+export function repairReceiptLines(repairs) {
+    const ran = repairs.filter((repair) => repair.fix_attempted);
+    if (ran.length === 0)
+        return [];
+    return [
+        "Repairs (before -> after):",
+        ...ran.map((repair) => `  ${repair.after?.startsWith("ok:") ? "fixed" : "still needs you"} ${repair.step}: ${repair.before_message ?? ""} -> ${repair.after_message ?? ""}`.replaceAll("—", ";")),
+    ];
+}
 export function doctorNeedsPerson(rows, receipt) {
     const defaults = {
         "cli-latest": "npm i -g @bli-cockpit/cli && cockpit doctor",

package/dist/commands/doctor.js

@@ -4,11 +4,11 @@ import { describeError } from "../health-detail.js";
 import { withStage } from "../crash-guard.js";
 import { checkSingleInstallState, readRootsCoverWork, fixAuthState, fixRootState, readAuthState, readRootState, } from "./doctor-access.js";
 import { backfillCompletionStepState, backfillFixVerdict, checkBackfillState, checkDiskState, checkGcState, checkSyncState, fixBackfillState, fixDiskState, fixGcState, fixSyncState, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline.js";
-import { checkMcpAnswersState } from "./doctor-mcp.js";
+import { checkMcpAnswersState, fixMcpAnswersState } from "./doctor-mcp.js";
 import { budgetSpentRow, doctorRunDeadline, DOCTOR_JSON_BUDGET_SECONDS } from "./doctor-budget.js";
 import { checkMemoryDaemonState } from "./doctor-memory-daemon.js";
 import { checkDoctorAgentRules, fixDoctorAgentRules, checkAutostartState, checkMemoryState, fixAutostartState, fixMemoryState, } from "./doctor-registration.js";
-import { dryRunPreview, isInteractiveDoctorFix, maybeReportDoctorEvents, writeDoctorOutput, doctorNeedsPerson, } from "./doctor-report.js";
+import { dryRunPreview, isInteractiveDoctorFix, maybeReportDoctorEvents, writeDoctorOutput, doctorNeedsPerson, finalizeDoctorRepairs, } from "./doctor-report.js";
 import { buildSetupReceipt, refreshSetupReceipt } from "./setup-receipt.js";
 import { checkCliLatest, fixCliLatest, latestCliVersionFromNpm, reexecDoctor, } from "./doctor-update.js";
 export async function runDoctor(command, io, hooks, overrides = {}) {
@@ -24,6 +24,7 @@ export async function runDoctorWithDeps(command, io, deps) {
     const repairs = [];
     const diagnoseOnly = command.dryRun || command.checkOnly;
     const diagnosed = new Map();
+    const attempted = new Set();
     // BLI-11101: every row says how long it took, so the next slow run names
     // the row without a profiler. A killed run still leaves every finished row.
     const checkMs = new Map();
@@ -54,6 +55,7 @@ export async function runDoctorWithDeps(command, io, deps) {
                 repairs.push({ step: invariant.id, outcome: "needs_person", reason: row.code });
             }
             else if (row.status !== "ok" && row.status !== "skipped" && canFix && invariant.fix) {
+                attempted.add(invariant.id);
                 row = await withStage(`doctor:fix:${invariant.id}`, () => invariant.fix(context, row));
                 repairs.push({ step: invariant.id, outcome: row.status === "ok" ? "repaired" : "needs_person", reason: row.code });
                 // The replacement process owns the one final receipt, including JSON.
@@ -106,6 +108,8 @@ export async function runDoctorWithDeps(command, io, deps) {
             }
         }
     }
+    // BLI-12828: every repair's receipt says what it found and what it left.
+    finalizeDoctorRepairs(repairs, diagnosed, rows, attempted);
     const floor = await maybeReportDoctorEvents(context, rows);
     if (floor && isSemverBelow(LOCAL_COLLECTOR_VERSION, floor)) {
         const index = rows.findIndex((row) => row.id === "cli-latest");
@@ -127,6 +131,15 @@ export async function runDoctorWithDeps(command, io, deps) {
     writeDoctorOutput(command, io, rows, receipt, repairs);
     return needsPerson === 0 ? 0 : 1;
 }
+/**
+ * The table's row ids in order, and whether each one carries a repair.
+ * `doctor-repair-classes.test.ts` pins this against the runbook's audit table
+ * (`docs/runbooks/cockpit-doctor-repairs.md`) so a row cannot be added without
+ * either a repair or a named reason it has none.
+ */
+export function doctorInvariantTable() {
+    return doctorInvariants().map((invariant) => ({ id: invariant.id, hasFix: Boolean(invariant.fix) }));
+}
 function doctorInvariants() {
     return [
         { id: "cli-latest", check: checkCliLatest, fix: fixCliLatest },
@@ -166,12 +179,14 @@ function doctorInvariants() {
         // BLI-3804. Right after the registration row, because it asks the second
         // half of the same question: `memory-registered` proves the entry exists
         // and names a bin, this one proves the server behind it starts, speaks the
-        // protocol and reaches Tower. Deliberately has NO fix — re-registering a
-        // server that is already registered repairs nothing, and the row names the
-        // command a person should run instead (`doctor-mcp.ts`).
+        // protocol and reaches Tower. BLI-12828 gave it the repair the row always
+        // named in words: re-register, take the newest CLI, ask again. A Tower
+        // refusal is the sign-in row's, so that outcome is returned untouched
+        // (`doctor-mcp.ts`).
         {
             id: "mcp-answers",
             check: (context) => context.deps.checkMcpAnswers(context),
+            fix: fixMcpAnswersState,
         },
         // BLI-3884. Beside the two rows above because it is the same family — what
         // this machine's agents can reach — and, like `mcp-answers`, it has NO fix:

package/dist/commands/heartbeat-token.js

@@ -77,4 +77,18 @@ async function readTokenExpiry(response) {
     catch {
         return null;
     }
+}
+/**
+ * BLI-12828. The one fact the tick's sign-in heal needs from the check-in it
+ * just made: did the DOOR refuse this machine's token (401/403), as opposed to
+ * the network being down or the build being a checkout? A lapsed local date
+ * alone proves nothing offline. Process-scoped on purpose: one tick is one
+ * process, and `null` means "no refusal observed", never "accepted".
+ */
+let lastRefusalStatus = null;
+export function noteHeartbeatRefusal(status) {
+    lastRefusalStatus = status;
+}
+export function heartbeatRefusalStatus() {
+    return lastRefusalStatus;
 }

package/dist/commands/heartbeat.js

@@ -29,7 +29,7 @@ import { readStagingInventory } from "../disk-usage.js";
 import { describeError } from "../health-detail.js";
 import { shouldSuppressFleetReceipts, } from "../dev-build.js";
 import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, } from "../local-state.js";
-import { readHeartbeatSession, recordHeartbeatTokenExpiry, } from "./heartbeat-token.js";
+import { noteHeartbeatRefusal, readHeartbeatSession, recordHeartbeatTokenExpiry, } from "./heartbeat-token.js";
 import { classifySyncHealthError } from "../sync-health-class.js";
 import { readMemoryReceiptFile } from "./memory-install-receipt.js";
 import { readMemoryHookCounts } from "./memory-hook-counts.js";
@@ -284,6 +284,7 @@ export async function sendCollectorHeartbeatBestEffort(options) {
             body: JSON.stringify(heartbeat),
             signal: controller.signal,
         });
+        noteHeartbeatRefusal(response.ok ? null : response.status);
         if (!response.ok) {
             // A heartbeat is not retried, so the reason has to be said once, here.
             // BLI-4019: the CLASS comes from `sync-health-class.ts`, the one place

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.168");
+    writeLine(io?.stdout ?? process.stdout, "0.2.170");
     return 0;
   }
 

package/dist/commands/sync-heal.js

@@ -0,0 +1,144 @@
+/**
+ * The tick's machine-heal follow-ups that `cockpit doctor` also performs
+ * (BLI-12828). Doctor and the tick are meant to be the same repairs run by a
+ * person and run by the clock; `docs/runbooks/cockpit-doctor-repairs.md` is the
+ * table of which row each one answers.
+ *
+ *   agent rules missing     re-install them        inspected every tick, a
+ *                                                  failed install retried hourly
+ *   sign-in lapsed          record the ONE human   written when the heartbeat
+ *                           action, stop nagging   could not renew, reported daily
+ *
+ * The rest of the table is already on the tick elsewhere: the CLI floor
+ * (`sync-followups-self-update.ts`), the scheduler incl. an ABSENT one
+ * (`sync-followups-autostart.ts` over `../autostart-self-heal.ts`), BLI Memory
+ * (`sync-followups-memory.ts`) and staging (`sync-followups-staging.ts`).
+ *
+ * Same rule as every follow-up: it runs after collection's outcome is decided,
+ * never throws, and its outcome is its own named receipt, never a sync failure.
+ * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
+import { heartbeatRefusalStatus } from "./heartbeat-token.js";
+import { SIGN_IN_ACTION } from "../sign-in-action.js";
+import { inspectAgentRules, installAgentRules } from "../agent-rules.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, toSessionReference, } from "../local-state.js";
+import { normalizeCollectionRoots } from "../root-normalization.js";
+export const AGENT_RULES_REPAIR_MARKER = ".last-agent-rules-repair";
+export const SESSION_NEEDS_LOGIN_MARKER = "session-needs-login.json";
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** Only a RETRY of a failed install waits; the first install never does. */
+const AGENT_RULES_RETRY_AFTER_FAILURE_MS = 60 * 60 * 1000;
+export async function runMachineHealAfterSync(command, io, dashboardUrl, options = {}) {
+    const now = options.now ?? new Date();
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    const events = [];
+    for (const heal of [
+        () => healAgentRules(command, paths, now),
+        () => noteSessionState(paths, heartbeatRefusalStatus(), now),
+    ]) {
+        try {
+            const event = await heal();
+            if (event)
+                events.push(event);
+        }
+        catch (error) {
+            console.error("[sync-heal] a machine-heal step threw and was dropped", JSON.stringify({ reason: "heal_step_threw", detail: redactedSyncErrorDetail(error) }));
+        }
+    }
+    if (events.length === 0)
+        return;
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        command: "sync",
+        events,
+        json: command.json,
+        io,
+    });
+}
+/** Agent rules: cheap to read, so read every tick; write only when missing. */
+async function healAgentRules(command, paths, now) {
+    const config = await readLocalCollectorConfig(paths).catch(() => null);
+    const roots = normalizeCollectionRoots(config?.default_repo_paths ?? []);
+    if (roots.length === 0) {
+        console.error("[sync-heal] agent rules not checked; no saved roots to scope them to", JSON.stringify({ reason: "no_saved_roots" }));
+        return null;
+    }
+    const scope = { ...(command.homeDir ? { homeDir: command.homeDir } : {}), scopePaths: roots };
+    const marker = path.join(paths.state_dir, AGENT_RULES_REPAIR_MARKER);
+    const before = await inspectAgentRules(scope);
+    if (before.installed) {
+        // A marker from an earlier attempt is spent; the next removal is
+        // reinstalled on the next tick, not after a retry window.
+        await fs.rm(marker, { force: true }).catch(() => undefined);
+        return null;
+    }
+    const last = await fs.stat(marker).catch(() => null);
+    if (last && now.getTime() - last.mtimeMs < AGENT_RULES_RETRY_AFTER_FAILURE_MS) {
+        console.error("[sync-heal] agent rules still missing; the last install attempt was under an hour ago, retrying after that", JSON.stringify({ reason: "agent_rules_repair_throttled" }));
+        return null;
+    }
+    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
+    await fs.writeFile(marker, now.toISOString()).catch(() => undefined);
+    await installAgentRules(scope);
+    const after = await inspectAgentRules(scope);
+    console.error(after.installed
+        ? "[sync-heal] agent rules were missing and are installed"
+        : "[sync-heal] agent rules install ran but they still read missing", JSON.stringify({ reason: after.installed ? "agent_rules_installed" : "agent_rules_still_missing", before: "missing", after: after.installed ? "installed" : "missing" }));
+    return after.installed
+        ? { step: "agent_rules_install", status: "ok", error_detail: "before=missing; after=installed" }
+        : { step: "agent_rules_install", status: "fail", error_code: "agent_rules_still_missing", error_detail: "before=missing; after=missing" };
+}
+/**
+ * Sign-in: the heartbeat (which ran just before this) renews a lapsed token
+ * inside the server's grace window without a browser. If this machine is STILL
+ * signed out or the door refused the token (401/403), only a browser can fix
+ * it, so record the one action and say it once a day instead of every fifteen
+ * minutes. A lapsed local date with no refusal (offline, a checkout build)
+ * proves nothing, so it says nothing.
+ */
+async function noteSessionState(paths, refusedStatus, now) {
+    const marker = path.join(paths.state_dir, SESSION_NEEDS_LOGIN_MARKER);
+    const session = await readLocalCollectorSessionFile(paths).catch(() => null);
+    const state = session ? toSessionReference(session).session_state : "missing";
+    const noted = await readMarker(marker);
+    const refused = refusedStatus === 401 || refusedStatus === 403;
+    if (state === "valid" && !refused) {
+        if (!noted)
+            return null;
+        await fs.rm(marker, { force: true }).catch(() => undefined);
+        console.error("[sync-heal] sign-in is valid again; the needs-login note is cleared", JSON.stringify({ reason: "session_renewed", before: "needs_login", after: "valid" }));
+        return { step: "session_renewal", status: "ok", error_detail: "before=needs_login; after=valid" };
+    }
+    if (state !== "missing" && !refused)
+        return null;
+    const nowIso = now.toISOString();
+    if (noted && now.getTime() - Date.parse(noted.last_reported_at) < DAY_MS) {
+        return null;
+    }
+    const record = { since: noted?.since ?? nowIso, last_reported_at: nowIso, session_state: state, action: SIGN_IN_ACTION };
+    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
+    await fs.writeFile(marker, JSON.stringify(record)).catch(() => undefined);
+    console.error("[sync-heal] this machine is signed out and a browser sign-in is the only fix; saying so once a day", JSON.stringify({ reason: "browser_sign_in_required", session_state: state, next_action: SIGN_IN_ACTION }));
+    return {
+        step: "session_renewal",
+        status: "fail",
+        error_code: "browser_sign_in_required",
+        error_detail: `${state}; ${SIGN_IN_ACTION}`,
+    };
+}
+async function readMarker(file) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(file, "utf8"));
+        if (typeof parsed["since"] === "string" && typeof parsed["last_reported_at"] === "string") {
+            return { since: parsed["since"], last_reported_at: parsed["last_reported_at"] };
+        }
+    }
+    catch {
+        // No marker, or an unreadable one, reads as "never said".
+    }
+    return null;
+}

package/dist/commands/sync.js

@@ -11,7 +11,7 @@
  *   collect behind both locks         sync-receipt.ts
  *   check in with the heartbeat door  sync-heartbeat.ts
  *   say how the tick went             reportTickOutcome / reportTickThrew
- *   converge the rest of the machine  sync-followups.ts
+ *   converge the rest of the machine  sync-followups.ts, sync-heal.ts
  *
  * The supporting modules each own one thing those steps share:
  *
@@ -39,13 +39,18 @@ import { createInteractiveExecRunner } from "../process-runner.js";
 import { envWithNodeRuntimeOnPath } from "../scheduled-self-update.js";
 import { runMemoryExperienceAfterSync } from "./memory-log.js";
 import { classifySyncHealthError, redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
+import { runMachineHealAfterSync } from "./sync-heal.js";
 import { sendSyncHeartbeat } from "./sync-heartbeat.js";
 import { runSyncWithHealthReceipt } from "./sync-receipt.js";
 import { runAutostartSelfHealAfterSync, runMemoryInstallAfterSync, runScheduledSelfUpdateAfterSync, runStagingPruneAfterSync, } from "./sync-followups.js";
 import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
+import { stampSyncTick } from "../sync-tick-stamp.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
 export async function runSync(command, io) {
     const paths = getCollectorRuntimePaths(command.homeDir);
+    // Ticket 12831: the memory prompt hook reads this stamp to tell a scheduler
+    // that stopped firing from one that is merely quiet.
+    await stampSyncTick(paths);
     // BLI-3553, first thing in the tick: cap the scheduler's own logs. Nothing
     // rotated them before, and two months of a 15-minute tick left 211 MB of
     // sync.log on the reference Mac. Best-effort by construction — a rotation
@@ -165,5 +170,8 @@ async function reportTickThrew(command, io, dashboardUrl, error, errorCode) {
 async function convergeAfterTick(command, io, dashboardUrl) {
     await runAutostartSelfHealAfterSync(command, io, dashboardUrl);
     await runMemoryInstallAfterSync(command, io, dashboardUrl);
+    // BLI-12828: the repairs `cockpit doctor` also makes (agent rules, a lapsed
+    // sign-in), so nobody has to be told to run it.
+    await runMachineHealAfterSync(command, io, dashboardUrl);
     await runMemoryExperienceAfterSync({ ...command, dashboardUrl }, io);
 }

package/dist/sign-in-action.js

@@ -0,0 +1,7 @@
+/**
+ * The ONE sentence a person gets when only a browser can fix their sign-in
+ * (BLI-12828). Doctor's `authed` row, doctor's exit-code receipt and the sync
+ * tick's once-a-day note all say these exact words, so nobody is told two
+ * different things for the same problem.
+ */
+export const SIGN_IN_ACTION = "Run `cockpit login` and approve the sign-in in your browser.";

package/dist/sync-tick-stamp.js

@@ -0,0 +1,22 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { SYNC_TICK_STAMP_FILE_NAME } from "@bli-cockpit/telemetry-core";
+/**
+ * Ticket 12831. Touched first thing in every `cockpit sync`, so "when did this
+ * machine last tick" is one file stat. The memory prompt hook reads it
+ * (`@bli-cockpit/memory-mcp` `hooks/sync-revive.ts`) and revives a scheduler
+ * that stopped firing. Best-effort: a stamp that cannot be written says so and
+ * never fails the tick (the worst case is one extra hourly revive attempt).
+ */
+export async function stampSyncTick(paths, now = new Date()) {
+    try {
+        await fs.mkdir(paths.state_dir, { recursive: true, mode: 0o700 });
+        await fs.writeFile(path.join(paths.state_dir, SYNC_TICK_STAMP_FILE_NAME), now.toISOString());
+    }
+    catch (error) {
+        console.error("[sync-tick-stamp] tick stamp not written; the prompt hook may attempt a revive", JSON.stringify({
+            reason: "tick_stamp_write_failed",
+            error_name: error instanceof Error ? error.name : typeof error,
+        }));
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.168",
+  "version": "0.2.170",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.45",
-    "@bli-cockpit/mcp": "0.1.86",
-    "@bli-cockpit/telemetry-core": "0.1.57"
+    "@bli-cockpit/memory-mcp": "0.1.46",
+    "@bli-cockpit/mcp": "0.1.87",
+    "@bli-cockpit/telemetry-core": "0.1.58"
   },
   "repository": {
     "type": "git",