@bli-cockpit/cli 0.2.170 → 0.2.174

package/dist/adapters/raw-evidence-collection-state.js

@@ -26,7 +26,8 @@ import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core"
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { DELIVERY_BACKOFF_BYPASS_REASON, deliveryBackoffApplies, heldSourceKeys, readRawEvidenceStagingState, resolveStagedObject, } from "../raw-evidence-staging.js";
+import { DELIVERY_BACKOFF_BYPASS_REASON, deliveryBackoffApplies, heldSourceKeys, readRawEvidenceStagingState, resolveStagedObject, terminalDeliveryReason, } from "../raw-evidence-staging.js";
+import { admitToStaging, openStagingAllowance, } from "../staging-gate.js";
 import { chmodPrivate } from "./raw-evidence-pack-store.js";
 import { GIT_DIFF_TIMEOUT_MS, MAX_GIT_DIFF_BYTES, } from "./raw-evidence-git-diff.js";
 export const DEFAULT_SINCE_MINUTES = 24 * 60;
@@ -54,6 +55,11 @@ export async function openCollection(context, options, places) {
     const byteBudget = options.byteBudget ?? RAW_EVIDENCE_DEFAULT_BYTE_BUDGET;
     const objectBudget = options.objectBudget ?? RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET;
     const staging = await readRawEvidenceStagingState(options.stateDir);
+    const budget = options.budget ?? {
+        remainingBytes: byteBudget,
+        remainingObjects: objectBudget,
+    };
+    const stagingAllowance = (budget.staging ??= await openStagingAllowance(options.stateDir, options.env ?? process.env, { statfs: options.statfs }));
     return {
         context,
         filesDir: path.join(places.stagingDir, "files"),
@@ -71,14 +77,16 @@ export async function openCollection(context, options, places) {
         redacted: [],
         reused: [],
         scanned: new Map(),
-        caps: startingCaps({ byteBudget, objectBudget, budget: options.budget }),
+        caps: startingCaps({
+            byteBudget,
+            objectBudget,
+            budget: options.budget,
+            stagingCapBytes: stagingAllowance.snapshot.cap_bytes,
+        }),
         skipContentHashes: options.skipContentHashes ?? new Set(),
         priorSnapshots: options.priorSnapshots ?? new Map(),
         stubReoffers: options.stubReoffers ?? new Map(),
-        budget: options.budget ?? {
-            remainingBytes: byteBudget,
-            remainingObjects: objectBudget,
-        },
+        budget,
         index: { value: 0 },
     };
 }
@@ -118,6 +126,12 @@ function startingCaps(options) {
             observed: options.budget?.remainingObjects ?? options.objectBudget,
             applied: false,
         },
+        {
+            source: "raw_evidence",
+            cap_type: "staging_gate",
+            limit: options.stagingCapBytes,
+            applied: false,
+        },
         {
             source: "git_diff",
             cap_type: "max_bytes_per_diff",
@@ -185,6 +199,38 @@ export async function stageEvidenceBytes(collection, options) {
     collection.stagedNewCount += 1;
     return { local_path: destination, staged_in_pack: true };
 }
+/**
+ * The one door a file passes before its bytes may be copied: the per-sync
+ * budget below, then the disk (BLI-12832). A refusal from the disk hands the
+ * budget back, because nothing was staged and the next tick re-reads the source.
+ * A copy already staged costs the disk nothing and is never refused by it.
+ */
+export function admitEvidence(collection, byteLength, file) {
+    const budgetReason = admitToBudget(collection.budget, byteLength);
+    if (budgetReason)
+        return budgetReason;
+    const allowance = collection.budget.staging;
+    if (!allowance)
+        return null;
+    // BLI-12832: bytes the server refused for good are reclaimed by the prune
+    // (the refusal stays as a receipt), so copying them again would be churn.
+    if (collection.staging.staged[file.contentHash] === undefined &&
+        terminalDeliveryReason(collection.staging.delivery_attempts[file.contentHash]?.last_reason)) {
+        collection.budget.remainingObjects += 1;
+        collection.budget.remainingBytes += byteLength;
+        console.error("[staging-gate] not copying bytes the server refused for good", JSON.stringify({ reason: "delivery_terminal_refused", kind: file.kind, file_bytes: byteLength }));
+        return "delivery_terminal_refused";
+    }
+    const diskReason = admitToStaging(allowance, byteLength, {
+        alreadyStaged: collection.staging.staged[file.contentHash] !== undefined,
+        kind: file.kind,
+    });
+    if (!diskReason)
+        return null;
+    collection.budget.remainingObjects += 1;
+    collection.budget.remainingBytes += byteLength;
+    return `staging_deferred:${diskReason}`;
+}
 /**
  * Decrements the per-sync budget when a file fits, or returns a deferred-skip
  * reason when it does not. The object budget bounds request count; the byte

package/dist/adapters/raw-evidence-completeness.js

@@ -21,6 +21,12 @@ export function markCapApplied(ledger, source, capType) {
         cap.applied = true;
 }
 export function markBudgetCapApplied(ledger, reason) {
+    if (reason === "delivery_terminal_refused")
+        return;
+    if (reason.startsWith("staging_deferred:")) {
+        markCapApplied(ledger, "raw_evidence", "staging_gate");
+        return;
+    }
     markCapApplied(ledger, "raw_evidence", reason === "deferred_object_budget" ? "object_budget" : "byte_budget");
 }
 // ---------------------------------------------------------------------------

package/dist/adapters/raw-evidence-git-diff-reader.js

@@ -19,7 +19,7 @@ import { sha256 } from "./raw-evidence-keys.js";
 import { maskSecretsInGitDiff, } from "./raw-evidence-sanitize.js";
 import { markBudgetCapApplied, markCapApplied, recordScanned, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
-import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
+import { admitEvidence, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 import { MAX_GIT_DIFF_BYTES, REPO_ROOT_MISSING_REASON, RepoRootMissingError, repoRootExists, runGitDiff, } from "./raw-evidence-git-diff.js";
 const GIT_DIFF_TARGETS = [
     { label: "unstaged", args: ["diff", "--no-ext-diff", "--"] },
@@ -130,7 +130,7 @@ async function stageOneGitDiff(collection, target) {
         });
         return;
     }
-    const deferReason = admitToBudget(collection.budget, sanitized.bytes.byteLength);
+    const deferReason = admitEvidence(collection, sanitized.bytes.byteLength, { contentHash, kind: "git_diff" });
     if (deferReason) {
         markBudgetCapApplied(collection, deferReason);
         collection.skipped.push({

package/dist/adapters/raw-evidence-image-reader.js

@@ -13,7 +13,7 @@ import { evidenceSourceKey } from "../raw-evidence-staging.js";
 import { sha256 } from "./raw-evidence-keys.js";
 import { markBudgetCapApplied, recordScanned, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
-import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
+import { admitEvidence, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 export async function collectAgentImagesFromTranscript(collection, options) {
     const result = await collectAgentImageEvidenceFromJsonlFile({
         filePath: options.filePath,
@@ -56,7 +56,10 @@ async function collectOneAgentImageFile(collection, options) {
         });
         return;
     }
-    const deferReason = admitToBudget(collection.budget, raw.byteLength);
+    const deferReason = admitEvidence(collection, raw.byteLength, {
+        contentHash,
+        kind: options.kind,
+    });
     if (deferReason) {
         markBudgetCapApplied(collection, deferReason);
         collection.skipped.push({

package/dist/adapters/raw-evidence-transcript-file.js

@@ -20,7 +20,7 @@ import { maskSecretsInTranscript, } from "./raw-evidence-sanitize.js";
 import { markBudgetCapApplied, markCapApplied, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
 import { describeSnapshot, stubReplacementClaim, supersedeClaimFor, } from "./raw-evidence-snapshot-supersede.js";
-import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
+import { admitEvidence, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
  * attributed transcript into the pack.
@@ -82,7 +82,7 @@ export async function collectOneEvidenceFile(collection, options) {
         });
         return true;
     }
-    const deferReason = admitToBudget(collection.budget, sanitized.bytes.byteLength);
+    const deferReason = admitEvidence(collection, sanitized.bytes.byteLength, { contentHash, kind: options.kind });
     if (deferReason) {
         markBudgetCapApplied(collection, deferReason);
         return skip(deferReason);

package/dist/commands/backfill-upload.js

@@ -7,6 +7,7 @@ import { countSessionUploadFailures, deferredEvidenceCount, durableBackfillCandi
 import { blockingScanIssues } from "./backfill-issues.js";
 import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { writeLine } from "./backfill-output.js";
+import { stagingDeferredFiles } from "../staging-gate.js";
 import { stubClaimsForCandidates } from "./backfill-stub-reoffer.js";
 const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
 /**
@@ -92,6 +93,17 @@ export async function uploadBackfillBatches(command, io, lock, ctx) {
             failureReason = "deferred_budget_exhausted";
             break;
         }
+        // BLI-12832: the disk gate refused a copy. Every later batch would be
+        // refused the same way, so stop here; the cursor only advanced through
+        // sessions that earned a durable pointer, and the next run starts from
+        // the same place once room returns.
+        const stagingDeferred = stagingDeferredFiles(rawEvidenceBudget.staging);
+        if (stagingDeferred > 0) {
+            blockedAt = stoppedAt("staging paused: not enough room to copy more evidence", index);
+            failureReason = "deferred_budget_exhausted";
+            console.error("[backfill] stopped, the staging gate is holding new copies", JSON.stringify({ reason: "staging_deferred", files_deferred: stagingDeferred, batch_index: index + 1 }));
+            break;
+        }
         if (consecutiveFailures >= BACKFILL_MAX_CONSECUTIVE_FAILURES) {
             blockedAt = stoppedAt("consecutive upload failures", index);
             failureReason = failedBatchReason(outcome.sync, outcome.missingDurableMain);

package/dist/commands/doctor-disk-words.js

@@ -57,6 +57,26 @@ export function footprintBuckets(footprint) {
     ];
     return buckets.filter((bucket) => bucket.bytes > 0).sort((a, b) => b.bytes - a.bytes);
 }
+/**
+ * BLI-12832: the sentence for a paused staging gate, in plain words. Every
+ * variant says the same two true things: nothing is lost (the source file is
+ * still on disk), and copying resumes by itself.
+ */
+export function stagingPausedWords(gate, holder) {
+    if (gate.reason === "low_disk") {
+        return `Tower paused copying new evidence: the disk has ${gib(gate.free_bytes ?? 0)} GB free. Nothing is lost; it resumes when space returns.`;
+    }
+    if (gate.reason === "state_over_ceiling") {
+        return `Tower paused copying new evidence: everything it keeps here is ${mib(gate.collector_bytes)} MB, over its ${mib(gate.ceiling_bytes)} MB ceiling${holder ? `, mostly ${holder.label} (${mib(holder.bytes)} MB)` : ""}. Nothing is lost; it resumes when that shrinks.`;
+    }
+    if (gate.reason === "staging_at_cap") {
+        return `Tower paused copying new evidence: its staging folder is full (${mib(gate.staging_bytes)} MB of a ${mib(gate.cap_bytes)} MB cap) with evidence the server has not accepted yet. Nothing is lost; the sources stay on disk and copying resumes once uploads succeed.`;
+    }
+    return null;
+}
+export function gib(bytes) {
+    return (bytes / (1024 * 1024 * 1024)).toFixed(1);
+}
 export function footprintTotalBytes(footprint) {
     return footprintBuckets(footprint).reduce((sum, bucket) => sum + bucket.bytes, 0);
 }

package/dist/commands/doctor-pipeline.js

@@ -5,12 +5,13 @@ import { readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/ba
 import { savedDiscoveryLimitArgs } from "../discovery-limits.js";
 import { runStagingPrune } from "../disk-prune.js";
 import { retentionOptionsFromEnv } from "../disk-retention.js";
+import { readStagingGate, stagingGateLimitsFromEnv } from "../staging-gate.js";
 import { readDiskFootprint } from "../disk-usage.js";
 import { runEvidenceRedelivery } from "../evidence-redelivery.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "../local-state.js";
 import { runRawEvidenceLocalGc, rawEvidenceGcSummary } from "../raw-evidence-gc.js";
 import { runBackfillCommand } from "./backfill.js";
-import { FOOTPRINT_NEEDS_FIX_BYTES, diskRowMessage, footprintHolder, footprintTotalBytes, mib, redeliveryLine, } from "./doctor-disk-words.js";
+import { FOOTPRINT_NEEDS_FIX_BYTES, stagingPausedWords, diskRowMessage, footprintHolder, footprintTotalBytes, mib, redeliveryLine, } from "./doctor-disk-words.js";
 import { doctorRoots } from "./doctor-access.js";
 import { backfillCompletionStepState, backfillFixVerdict, jsonField, parseDoctorBackfillJson, parseDoctorSyncJson, syncFailureMessage, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline-verdicts.js";
 import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
@@ -162,34 +163,55 @@ export async function checkDiskState(context) {
     const footprint = await readDiskFootprint(getCollectorRuntimePaths(context.command.homeDir));
     const { capBytes } = retentionOptionsFromEnv(context.io.env);
     const message = diskRowMessage(footprint, capBytes);
+    const paused = await stagingPausedRow(context, footprint, message);
+    if (paused)
+        return paused;
     if (footprint.staging.total_bytes - (footprint.staging.terminal_bytes ?? 0) > capBytes) {
         return needsFix("disk-bounded", "over_staging_cap", message);
     }
-    const over = footprintOverSentence(footprint);
+    const over = footprintOverSentence(footprint, stagingGateLimitsFromEnv(context.io.env).ceilingBytes);
     if (over)
         return needsFix("disk-bounded", "footprint_over_512mb", `${over}; ${message}`);
     return ok("disk-bounded", "within_staging_cap", message);
 }
+/**
+ * BLI-12832: the row for a paused staging gate, or null when copying is open.
+ * Plain words first, then the numbers; logged either way so a green row can
+ * still say the gate was checked.
+ */
+async function stagingPausedRow(context, footprint, message) {
+    const gate = await readStagingGate(getCollectorRuntimePaths(context.command.homeDir).state_dir, context.io.env);
+    const words = stagingPausedWords(gate, footprintHolder(footprint));
+    console.error("[cockpit-doctor] staging gate", JSON.stringify({
+        reason: gate.reason ?? "open",
+        staging_bytes: gate.staging_bytes,
+        collector_bytes: gate.collector_bytes,
+        free_bytes: gate.free_bytes,
+    }));
+    if (!words || !gate.reason)
+        return null;
+    return needsFix("disk-bounded", `staging_paused_${gate.reason}`, `${words} ${message}`);
+}
 /**
  * "812.0 MB held, over the 512 MB line; most of it is sync logs (600.0 MB)",
  * or null when the footprint is under the line. Logged either way, because a
  * row that only speaks when it is red cannot say the check ran.
  */
-export function footprintOverSentence(footprint) {
+export function footprintOverSentence(footprint, ceilingBytes = FOOTPRINT_NEEDS_FIX_BYTES) {
     const total = footprintTotalBytes(footprint);
     const holder = footprintHolder(footprint);
-    const over = total > FOOTPRINT_NEEDS_FIX_BYTES;
+    const over = total > ceilingBytes;
     console.error("[cockpit-doctor] collector footprint", JSON.stringify({
         reason: over ? "footprint_over_512mb" : "footprint_within_512mb",
         total_bytes: total,
-        limit_bytes: FOOTPRINT_NEEDS_FIX_BYTES,
+        limit_bytes: ceilingBytes,
         holder: holder?.label ?? null,
         holder_bytes: holder?.bytes ?? 0,
         study_entries_not_counted: footprint.state.study_entries,
     }));
     if (!over)
         return null;
-    return `${mib(total)} MB held, over the ${mib(FOOTPRINT_NEEDS_FIX_BYTES)} MB line; most of it is ${holder?.label ?? "unknown"} (${mib(holder?.bytes ?? 0)} MB)`;
+    return `${mib(total)} MB held, over the ${mib(ceilingBytes)} MB line; most of it is ${holder?.label ?? "unknown"} (${mib(holder?.bytes ?? 0)} MB)`;
 }
 export async function fixDiskState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
@@ -216,11 +238,16 @@ export async function fixDiskState(context) {
     }
     const footprint = await readDiskFootprint(paths);
     const message = diskRowMessage(footprint, pruned.cap_bytes);
-    const over = pruned.cap_blocked_by_uncommitted ? null : footprintOverSentence(footprint);
+    const over = pruned.cap_blocked_by_uncommitted
+        ? null
+        : footprintOverSentence(footprint, stagingGateLimitsFromEnv(context.io.env).ceilingBytes);
     if (over) {
         return needsFix("disk-bounded", "footprint_over_512mb", `freed ${mib(pruned.deleted_bytes)} MB; ${over}; ${message}`);
     }
     if (!pruned.cap_blocked_by_uncommitted) {
+        const stillPaused = await stagingPausedRow(context, footprint, `freed ${mib(pruned.deleted_bytes)} MB; ${message}`);
+        if (stillPaused)
+            return stillPaused;
         return ok("disk-bounded", `freed_${pruned.deleted_files}`, `freed ${mib(pruned.deleted_bytes)} MB; ${message}`);
     }
     // Unaccepted evidence still occupies the cap. Keep the disk row actionable.

package/dist/commands/local-args-tower-logs.js

@@ -0,0 +1,72 @@
+/**
+ * `cockpit logs` argument parsing (BLI-12833).
+ *
+ *   cockpit logs <source> [--since 15m|1h|2d|<iso>] [--raw <template-id>] [--limit <n>]
+ *                [--all-levels] [--table <file>] [--json]
+ *   cockpit logs <project> [--since 24h] [--json]          (BLI-12855: stored digests)
+ *   cockpit logs dashboard|railway --stored [--since 1h]   (Tower's stored digests)
+ *   cockpit logs --list                                     (the projects Tower digests)
+ *
+ * <source> is `collector`, `dashboard`, `railway`, `railway:<service>` or `-`
+ * (lines on stdin): read-only, computed on this machine from the source's own CLI
+ * or files, nothing sent to Tower. Or <source> is a registry project id (`kolm`,
+ * `tower`...): then the digest is the one Tower's own cron stored, read through
+ * the dashboard's `/api/logs` door with this machine's device token, so it works
+ * with no `vercel` or `railway` login at all.
+ */
+import { LOG_PROJECT_PATTERN } from "@bli-cockpit/telemetry-core/log-digest";
+import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+/** The source spellings, for the usage line and the refusal. `railway:<service>` takes any service name. */
+export const LOGS_SOURCES = ["collector", "dashboard", "railway", "railway:<service>", "-", "<project>"];
+/** The spellings that read a local log; every other name is a registry project (stored digests). */
+const LOCAL_SOURCE_PATTERN = /^(collector|dashboard|railway|railway:[A-Za-z0-9][A-Za-z0-9._-]{0,63}|-)$/;
+const SINCE_PATTERN = /^(\d{1,4}[smhd]|\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?(Z|[+-]\d{2}:\d{2})?)?)$/;
+export function parseLogsArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: ["--home", "--since", "--raw", "--limit", "--table", "--all-levels", "--stored", "--list", "--dashboard-url", "--json"],
+        valueFlags: ["--home", "--since", "--raw", "--limit", "--table", "--dashboard-url"],
+    });
+    const list = values.booleans.has("--list");
+    const source = values.positionals[0] ?? (list ? "tower" : undefined);
+    if (!source || (!LOCAL_SOURCE_PATTERN.test(source) && !LOG_PROJECT_PATTERN.test(source))) {
+        throw new Error(`logs needs a source: ${LOGS_SOURCES.join(", ")}. Example: \`cockpit logs dashboard --since 1h\` or \`cockpit logs kolm --since 24h\`.`);
+    }
+    if (values.positionals.length > 1)
+        throw new Error("logs takes one source; put the window in --since.");
+    const isProject = !LOCAL_SOURCE_PATTERN.test(source);
+    const stored = isProject || values.booleans.has("--stored");
+    if (values.booleans.has("--stored") && !["dashboard", "railway"].includes(source) && !isProject) {
+        throw new Error("--stored reads Tower's stored digests: use it with dashboard or railway, or name a project (`cockpit logs kolm`).");
+    }
+    if (stored && (values.flags.get("--raw") || values.flags.get("--table") || values.booleans.has("--all-levels"))) {
+        throw new Error("a stored digest keeps no raw line, and its classes were set when it was stored: --raw, --table and --all-levels read a local log.");
+    }
+    const since = optionalNonEmpty(values.flags.get("--since"));
+    if (since && !SINCE_PATTERN.test(since)) {
+        throw new Error(`--since wants 15m, 1h, 2d or an ISO time like 2026-10-07T03:00Z; got ${JSON.stringify(since.slice(0, 40))}.`);
+    }
+    const raw = optionalNonEmpty(values.flags.get("--raw"));
+    if (raw && !/^[0-9a-f]{8}$/.test(raw)) {
+        throw new Error("--raw wants the 8 hex characters a digest line starts with.");
+    }
+    const rawLimit = optionalPositiveInteger(values.flags.get("--limit"), "--limit");
+    if (rawLimit !== undefined && !raw)
+        throw new Error("--limit counts the original lines --raw prints.");
+    if (values.booleans.has("--all-levels") && source !== "dashboard") {
+        throw new Error("--all-levels belongs to `cockpit logs dashboard`.");
+    }
+    return {
+        kind: "logs",
+        source,
+        ...(since ? { since } : {}),
+        ...(raw ? { raw } : {}),
+        ...(rawLimit === undefined ? {} : { rawLimit }),
+        ...(values.flags.get("--table") ? { tableFile: values.flags.get("--table") } : {}),
+        allLevels: values.booleans.has("--all-levels"),
+        stored,
+        list,
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        json: values.booleans.has("--json"),
+    };
+}

package/dist/commands/local-args-tower.js

@@ -38,5 +38,6 @@ export { parseModelsArgs } from "./local-args-tower-models.js";
 export { parseMailArgs } from "./local-args-tower-mail.js";
 export { parseCalArgs } from "./local-args-tower-cal.js";
 export { parseUsageArgs } from "./local-args-tower-usage.js";
+export { parseLogsArgs } from "./local-args-tower-logs.js";
 export { parseCareersArgs } from './local-args-tower-careers.js';
 export { parseRenameArgs } from './local-args-tower-rename.js';

package/dist/commands/local-args.js

@@ -18,7 +18,7 @@
 import { parseRootsArgs } from "./roots.js";
 import { SURFACE_ALIASES } from "./local-help.js";
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
-import { parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
+import { parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseLogsArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
 // `normalizeUrl` has always been part of this module's surface — `local.ts` and
 // `local-auth.ts` import it from here — so it stays exported from this address
 // even though it now lives next door. The same goes for the four names the
@@ -133,6 +133,8 @@ export function parseLocalArgs(argv) {
             return parseRenameArgs(argv.slice(1));
         case "usage":
             return parseUsageArgs(argv.slice(1));
+        case "logs":
+            return parseLogsArgs(argv.slice(1));
         default:
             throw new Error(`Unknown local command: ${command ?? ""}`);
     }

package/dist/commands/local-command-shapes-logs.js

@@ -0,0 +1,6 @@
+/**
+ * `cockpit logs` command shape (BLI-12833), beside `local-command-shapes.ts` for
+ * the same reason `local-command-shapes-github.ts` is: that file sits at the
+ * readability ceiling.
+ */
+export {};

package/dist/commands/local-help-commands-tower-ops.js

@@ -10,6 +10,40 @@
  * something breaks, so it is a user-visible contract like any other.
  */
 export const TOWER_OPS_COMMAND_HELP = [
+    [
+        "logs",
+        [
+            "Usage: cockpit logs <collector|dashboard|railway|railway:<service>|-|project> [--since 15m|1h|2d|<iso>] [--raw <template-id> [--limit <n>]] [--all-levels] [--table <file>] [--stored] [--list] [--json]",
+            "",
+            "A token-cheap digest of Tower's own logs, read on THIS machine (nothing is uploaded) unless a project is named. Variable parts of",
+            "each line are masked into a template, equal templates are counted, routine runs become counts, and every",
+            "template is classified: our_bug and unknown first, then capacity, config_drift, rate_pushback, hiccup,",
+            "and one COUNTED line for dead_source and benign (counted, never alerted). About 2 KB.",
+            "  collector           this machine's sync.log, sync.err.log and their rotated archives (hook logs go to sync.err.log).",
+            "                      These logs have no per-line time, so the window is approximate (the digest says so).",
+            "  dashboard           Vercel runtime logs of bli-cockpit-dashboard (team bli-inc) through the `vercel` CLI.",
+            "                      Reads what Vercel marks error, warning or fatal plus every 5xx; --all-levels reads everything (slow).",
+            "  railway             every service of the bli-cockpit-inference project through the `railway` CLI;",
+            "  railway:<service>   one service (ladder, runner, linear-sync, ...). Project and environment are always passed",
+            "                      explicitly: this repo's `railway link` points at the runner service.",
+            "  -                   lines on stdin: plain text, `journalctl -o json`, `railway logs --json` or `vercel logs --json`.",
+            "  <project>           a BLI project (tower, kolm, portpal, pearl-portal, triage-crm, ...; `--list` names them): the digest Tower's",
+            "                      own 15-minute cron STORED from that project's Vercel, Railway and Supabase logs, merged over --since",
+            "                      (default 24h, at most 30d), real bugs first. Needs only this machine's Tower login: no vercel or railway",
+            "                      login. It keeps no raw line, so --raw, --table and --all-levels do not apply.",
+            "--stored              dashboard or railway read Tower's stored digest of project `tower` (this also happens by itself, and says so,",
+            "                      when the local vercel or railway CLI is missing or logged out).",
+            "--list                every project, every source, and which are wired or not_wired (with the reason).",
+            "--raw <template-id>   the original lines behind one template id from a digest (redacted, newest last; --limit n, default 20).",
+            "--table <file>        a class table JSON (same shape as the packaged one) to try a new pattern before committing it.",
+            "A source that cannot be read is a named refusal, never a stack trace: vercel_cli_missing, vercel_not_logged_in,",
+            "railway_cli_missing, railway_not_logged_in, railway_service_unknown, collector_logs_missing, stdin_is_terminal, and for a",
+            "project unknown_project, since_exceeds_retention, stored_read_failed, not_paired, ...",
+            "--json writes one object to stdout: { ok, kind, source, window, lines, templates[], routine, notes, text, measure };",
+            "a refusal is { ok: false, error, detail } and exits 1. Run list and teaching: docs/runbooks/tower-logs.md.",
+            "The bli-tower MCP server has the twin: logs_digest.",
+        ],
+    ],
     [
         "github",
         [

package/dist/commands/local-help.js

@@ -78,6 +78,7 @@ export const rootCommandNames = new Set([
     "careers",
     "rename",
     "usage",
+    "logs",
     ...SURFACE_ALIASES.keys(),
 ]);
 /** Public names omit compatibility spellings while the router keeps accepting them. */
@@ -132,6 +133,7 @@ export function localCommandHelp(command) {
         "  cockpit release [--dry-run] [--skip-checks] [--no-floor] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
         "  cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <passed_on|archived|reopen>|followup <id> [--record-sent-at <iso>]|interview <id> <--at <iso>|--clear>|grade <id> [--now]|resume <id> [--out <path>]|takehome show <role>|takehome set <role> --body-file <path>|settings show|settings set --enabled <true|false> --followup-enabled <true|false> --followup-after-days <n> --takehome-window-hours <n>] [--role <slug>] [--min-score <n>] [--since <date>] [--stage <s>] [--force] [--json]",
         "  cockpit rename [list|resolve <id> --scope <page|everywhere|undo>] [--dashboard-url <url>] [--json]",
+        "  cockpit logs <collector|dashboard|railway|railway:<service>|-> [--since 15m|1h|2d|<iso>] [--raw <template-id> [--limit <n>]] [--all-levels] [--table <file>] [--json]",
         "  cockpit usage sessions [--task <BLI-NNNN> | --subject <name>] [--repo <label>] [--since <window>] [--json]",
         "  cockpit usage sessions --session <id> [--from-window <n>] [--json]",
         "  --by-topic groups work types; --by-subject groups open subjects from session summaries.",

package/dist/commands/local.js

@@ -49,6 +49,7 @@ import { runSearch } from "./search.js";
 import { runCareers } from "./careers.js";
 import { runRename } from "./rename-scope.js";
 import { runUsage } from "./usage.js";
+import { runLogs } from "./logs.js";
 import { parseLocalArgs } from "./local-args.js";
 // `./local.js` is the published entry point for this command surface: the
 // public CLI's generated root, commands/root.ts, doctor.ts and the test suite
@@ -242,6 +243,8 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
                 return await runRename(command, io);
             case "usage":
                 return await runUsage(command, io);
+            case "logs":
+                return await runLogs(command, io);
         }
     }
     catch (error) {

package/dist/commands/logs-stored.js

@@ -0,0 +1,56 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[logs cli]";
+const READ_DEADLINE_MS = 55_000;
+/** The project a stored read is for: the named project, or `tower` for `dashboard` and `railway`. */
+export function storedProject(command) {
+    if (!command.stored)
+        return null;
+    return command.source === "dashboard" || command.source === "railway" ? "tower" : command.source;
+}
+export async function runStoredLogs(command, io, options) {
+    let door;
+    try {
+        door = await openAgentDoor("logs", command, io);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : "this machine is not paired with Tower";
+        if (options.onNotPaired)
+            return options.onNotPaired(detail);
+        writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason: "not_paired" })}`);
+        if (command.json)
+            writeLine(io.stdout, JSON.stringify({ ok: false, error: "not_paired", detail }));
+        else
+            writeLine(io.stderr, detail);
+        return 1;
+    }
+    if (command.list) {
+        const answer = await askAgentDoor(door, { path: "/api/logs?list=1", method: "GET", label: "logs list", timeoutMs: READ_DEADLINE_MS });
+        if (!answer.ok)
+            return failAgentDoor(door, TAG, answer.reason, answer.detail);
+        const body = answer.body;
+        if (command.json)
+            return emitAgentDoor(door, body);
+        for (const project of body.projects) {
+            writeLine(io.stdout, `${project.id}  ${project.name}`);
+            for (const source of project.sources) {
+                writeLine(io.stdout, `  ${source.status === "wired" ? "wired    " : "not_wired"} ${source.source}${source.reason ? `: ${source.reason}` : ""}`);
+            }
+        }
+        return 0;
+    }
+    const query = new URLSearchParams({ project: options.project });
+    if (command.since)
+        query.set("since", command.since);
+    const answer = await askAgentDoor(door, { path: `/api/logs?${query.toString()}`, method: "GET", label: "logs", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(io.stderr, `${TAG} stored digest read ${JSON.stringify({ project: body.project, windows: body.windows, windows_ok: body.windows_ok, refusals: body.refusals.length, fallback: Boolean(options.fallbackReason) })}`);
+    if (command.json)
+        return emitAgentDoor(door, options.fallbackReason ? { ...body, fallback_from: options.fallbackReason } : body);
+    if (options.fallbackReason)
+        writeLine(io.stdout, `(no local ${command.source} access: ${options.fallbackReason}; this is the digest Tower stored)`);
+    writeLine(io.stdout, body.text);
+    return 0;
+}