@bli-cockpit/cli 0.2.173 → 0.2.174

package/dist/commands/local-args-tower-logs.js

@@ -3,28 +3,44 @@
  *
  *   cockpit logs <source> [--since 15m|1h|2d|<iso>] [--raw <template-id>] [--limit <n>]
  *                [--all-levels] [--table <file>] [--json]
+ *   cockpit logs <project> [--since 24h] [--json]          (BLI-12855: stored digests)
+ *   cockpit logs dashboard|railway --stored [--since 1h]   (Tower's stored digests)
+ *   cockpit logs --list                                     (the projects Tower digests)
  *
  * <source> is `collector`, `dashboard`, `railway`, `railway:<service>` or `-`
- * (lines on stdin). Read-only: the digest is computed on this machine from the
- * source's own CLI or files; nothing is sent to Tower and no dashboard is
- * called, so there is no `--dashboard-url`.
+ * (lines on stdin): read-only, computed on this machine from the source's own CLI
+ * or files, nothing sent to Tower. Or <source> is a registry project id (`kolm`,
+ * `tower`...): then the digest is the one Tower's own cron stored, read through
+ * the dashboard's `/api/logs` door with this machine's device token, so it works
+ * with no `vercel` or `railway` login at all.
  */
-import { optionalNonEmpty, optionalPositiveInteger, parseNamedArgs } from "./local-arg-values.js";
+import { LOG_PROJECT_PATTERN } from "@bli-cockpit/telemetry-core/log-digest";
+import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
 /** The source spellings, for the usage line and the refusal. `railway:<service>` takes any service name. */
-export const LOGS_SOURCES = ["collector", "dashboard", "railway", "railway:<service>", "-"];
-const SOURCE_PATTERN = /^(collector|dashboard|railway|railway:[A-Za-z0-9][A-Za-z0-9._-]{0,63}|-)$/;
+export const LOGS_SOURCES = ["collector", "dashboard", "railway", "railway:<service>", "-", "<project>"];
+/** The spellings that read a local log; every other name is a registry project (stored digests). */
+const LOCAL_SOURCE_PATTERN = /^(collector|dashboard|railway|railway:[A-Za-z0-9][A-Za-z0-9._-]{0,63}|-)$/;
 const SINCE_PATTERN = /^(\d{1,4}[smhd]|\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?(Z|[+-]\d{2}:\d{2})?)?)$/;
 export function parseLogsArgs(args) {
     const values = parseNamedArgs(args, {
-        allowedFlags: ["--home", "--since", "--raw", "--limit", "--table", "--all-levels", "--json"],
-        valueFlags: ["--home", "--since", "--raw", "--limit", "--table"],
+        allowedFlags: ["--home", "--since", "--raw", "--limit", "--table", "--all-levels", "--stored", "--list", "--dashboard-url", "--json"],
+        valueFlags: ["--home", "--since", "--raw", "--limit", "--table", "--dashboard-url"],
     });
-    const source = values.positionals[0];
-    if (!source || !SOURCE_PATTERN.test(source)) {
-        throw new Error(`logs needs a source: ${LOGS_SOURCES.join(", ")}. Example: \`cockpit logs dashboard --since 1h\`.`);
+    const list = values.booleans.has("--list");
+    const source = values.positionals[0] ?? (list ? "tower" : undefined);
+    if (!source || (!LOCAL_SOURCE_PATTERN.test(source) && !LOG_PROJECT_PATTERN.test(source))) {
+        throw new Error(`logs needs a source: ${LOGS_SOURCES.join(", ")}. Example: \`cockpit logs dashboard --since 1h\` or \`cockpit logs kolm --since 24h\`.`);
     }
     if (values.positionals.length > 1)
         throw new Error("logs takes one source; put the window in --since.");
+    const isProject = !LOCAL_SOURCE_PATTERN.test(source);
+    const stored = isProject || values.booleans.has("--stored");
+    if (values.booleans.has("--stored") && !["dashboard", "railway"].includes(source) && !isProject) {
+        throw new Error("--stored reads Tower's stored digests: use it with dashboard or railway, or name a project (`cockpit logs kolm`).");
+    }
+    if (stored && (values.flags.get("--raw") || values.flags.get("--table") || values.booleans.has("--all-levels"))) {
+        throw new Error("a stored digest keeps no raw line, and its classes were set when it was stored: --raw, --table and --all-levels read a local log.");
+    }
     const since = optionalNonEmpty(values.flags.get("--since"));
     if (since && !SINCE_PATTERN.test(since)) {
         throw new Error(`--since wants 15m, 1h, 2d or an ISO time like 2026-10-07T03:00Z; got ${JSON.stringify(since.slice(0, 40))}.`);
@@ -47,6 +63,9 @@ export function parseLogsArgs(args) {
         ...(rawLimit === undefined ? {} : { rawLimit }),
         ...(values.flags.get("--table") ? { tableFile: values.flags.get("--table") } : {}),
         allLevels: values.booleans.has("--all-levels"),
+        stored,
+        list,
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         json: values.booleans.has("--json"),
     };

package/dist/commands/local-help-commands-tower-ops.js

@@ -13,9 +13,9 @@ export const TOWER_OPS_COMMAND_HELP = [
     [
         "logs",
         [
-            "Usage: cockpit logs <collector|dashboard|railway|railway:<service>|-> [--since 15m|1h|2d|<iso>] [--raw <template-id> [--limit <n>]] [--all-levels] [--table <file>] [--json]",
+            "Usage: cockpit logs <collector|dashboard|railway|railway:<service>|-|project> [--since 15m|1h|2d|<iso>] [--raw <template-id> [--limit <n>]] [--all-levels] [--table <file>] [--stored] [--list] [--json]",
             "",
-            "A token-cheap digest of Tower's own logs, read on THIS machine (nothing is uploaded). Variable parts of",
+            "A token-cheap digest of Tower's own logs, read on THIS machine (nothing is uploaded) unless a project is named. Variable parts of",
             "each line are masked into a template, equal templates are counted, routine runs become counts, and every",
             "template is classified: our_bug and unknown first, then capacity, config_drift, rate_pushback, hiccup,",
             "and one COUNTED line for dead_source and benign (counted, never alerted). About 2 KB.",
@@ -27,10 +27,18 @@ export const TOWER_OPS_COMMAND_HELP = [
             "  railway:<service>   one service (ladder, runner, linear-sync, ...). Project and environment are always passed",
             "                      explicitly: this repo's `railway link` points at the runner service.",
             "  -                   lines on stdin: plain text, `journalctl -o json`, `railway logs --json` or `vercel logs --json`.",
+            "  <project>           a BLI project (tower, kolm, portpal, pearl-portal, triage-crm, ...; `--list` names them): the digest Tower's",
+            "                      own 15-minute cron STORED from that project's Vercel, Railway and Supabase logs, merged over --since",
+            "                      (default 24h, at most 30d), real bugs first. Needs only this machine's Tower login: no vercel or railway",
+            "                      login. It keeps no raw line, so --raw, --table and --all-levels do not apply.",
+            "--stored              dashboard or railway read Tower's stored digest of project `tower` (this also happens by itself, and says so,",
+            "                      when the local vercel or railway CLI is missing or logged out).",
+            "--list                every project, every source, and which are wired or not_wired (with the reason).",
             "--raw <template-id>   the original lines behind one template id from a digest (redacted, newest last; --limit n, default 20).",
             "--table <file>        a class table JSON (same shape as the packaged one) to try a new pattern before committing it.",
             "A source that cannot be read is a named refusal, never a stack trace: vercel_cli_missing, vercel_not_logged_in,",
-            "railway_cli_missing, railway_not_logged_in, railway_service_unknown, collector_logs_missing, stdin_is_terminal, ...",
+            "railway_cli_missing, railway_not_logged_in, railway_service_unknown, collector_logs_missing, stdin_is_terminal, and for a",
+            "project unknown_project, since_exceeds_retention, stored_read_failed, not_paired, ...",
             "--json writes one object to stdout: { ok, kind, source, window, lines, templates[], routine, notes, text, measure };",
             "a refusal is { ok: false, error, detail } and exits 1. Run list and teaching: docs/runbooks/tower-logs.md.",
             "The bli-tower MCP server has the twin: logs_digest.",

package/dist/commands/logs-stored.js

@@ -0,0 +1,56 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[logs cli]";
+const READ_DEADLINE_MS = 55_000;
+/** The project a stored read is for: the named project, or `tower` for `dashboard` and `railway`. */
+export function storedProject(command) {
+    if (!command.stored)
+        return null;
+    return command.source === "dashboard" || command.source === "railway" ? "tower" : command.source;
+}
+export async function runStoredLogs(command, io, options) {
+    let door;
+    try {
+        door = await openAgentDoor("logs", command, io);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : "this machine is not paired with Tower";
+        if (options.onNotPaired)
+            return options.onNotPaired(detail);
+        writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason: "not_paired" })}`);
+        if (command.json)
+            writeLine(io.stdout, JSON.stringify({ ok: false, error: "not_paired", detail }));
+        else
+            writeLine(io.stderr, detail);
+        return 1;
+    }
+    if (command.list) {
+        const answer = await askAgentDoor(door, { path: "/api/logs?list=1", method: "GET", label: "logs list", timeoutMs: READ_DEADLINE_MS });
+        if (!answer.ok)
+            return failAgentDoor(door, TAG, answer.reason, answer.detail);
+        const body = answer.body;
+        if (command.json)
+            return emitAgentDoor(door, body);
+        for (const project of body.projects) {
+            writeLine(io.stdout, `${project.id}  ${project.name}`);
+            for (const source of project.sources) {
+                writeLine(io.stdout, `  ${source.status === "wired" ? "wired    " : "not_wired"} ${source.source}${source.reason ? `: ${source.reason}` : ""}`);
+            }
+        }
+        return 0;
+    }
+    const query = new URLSearchParams({ project: options.project });
+    if (command.since)
+        query.set("since", command.since);
+    const answer = await askAgentDoor(door, { path: `/api/logs?${query.toString()}`, method: "GET", label: "logs", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(io.stderr, `${TAG} stored digest read ${JSON.stringify({ project: body.project, windows: body.windows, windows_ok: body.windows_ok, refusals: body.refusals.length, fallback: Boolean(options.fallbackReason) })}`);
+    if (command.json)
+        return emitAgentDoor(door, options.fallbackReason ? { ...body, fallback_from: options.fallbackReason } : body);
+    if (options.fallbackReason)
+        writeLine(io.stdout, `(no local ${command.source} access: ${options.fallbackReason}; this is the digest Tower stored)`);
+    writeLine(io.stdout, body.text);
+    return 0;
+}

package/dist/commands/logs.js

@@ -4,7 +4,8 @@
  * Read-only and local: the source's own CLI or files are read on THIS machine,
  * masked into templates, counted and classified by `@bli-cockpit/telemetry-core/log-digest`,
  * and printed in about 2 KB with real bugs (`our_bug`, `unknown`) first. Nothing
- * is uploaded and no Tower door is called. The MCP server's `logs_digest` tool
+ * is uploaded and no Tower door is called (the stored half, `logs-stored.ts`,
+ * is the one exception: a project name reads what Tower's cron stored). The MCP server's `logs_digest` tool
  * calls the same `digestSource`, so the two print the same thing.
  *
  * A source that cannot be read is a NAMED refusal (`vercel_cli_missing`,
@@ -12,9 +13,10 @@
  * detail }` on stdout under `--json`, exit 1. Never a stack trace.
  */
 import { readFile } from "node:fs/promises";
-import { ClassTable, digestSource } from "@bli-cockpit/telemetry-core/log-digest";
+import { ClassTable, LOCAL_ACCESS_REFUSALS, digestSource } from "@bli-cockpit/telemetry-core/log-digest";
 import { getCollectorRuntimePaths } from "../local-state-paths.js";
 import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
+import { runStoredLogs, storedProject } from "./logs-stored.js";
 const TAG = "[logs cli]";
 const MAX_STDIN_CHARS = 64 * 1024 * 1024;
 function refuse(io, json, reason, detail) {
@@ -26,6 +28,10 @@ function refuse(io, json, reason, detail) {
     return 1;
 }
 export async function runLogs(command, io, deps = {}) {
+    // BLI-12855: a project name (or --stored, or --list) reads the digests Tower's cron stored, not a local log.
+    const stored = storedProject(command);
+    if (command.list || stored)
+        return runStoredLogs(command, io, { project: stored ?? "tower" });
     const paths = getCollectorRuntimePaths(command.homeDir);
     let table;
     if (command.tableFile) {
@@ -61,6 +67,16 @@ export async function runLogs(command, io, deps = {}) {
         nowMs: deps.nowMs,
         log: (message, fields) => writeLine(io.stderr, `${message} ${JSON.stringify(fields)}`),
     });
+    if (!outcome.ok && LOCAL_ACCESS_REFUSALS.has(outcome.reason) && (command.source === "dashboard" || command.source === "railway") && !command.raw) {
+        // No local access to the platform: say so, then answer from what the cron stored (a refusal of its own if this machine is not paired).
+        writeLine(io.stderr, `${TAG} local source unreadable, reading the stored digest ${JSON.stringify({ reason: outcome.reason })}`);
+        return runStoredLogs(command, io, {
+            project: "tower",
+            fallbackReason: outcome.reason,
+            // The person asked for a local read: if the stored digest is out of reach too, the local refusal is the answer.
+            onNotPaired: () => refuse(io, command.json, outcome.reason, `${outcome.detail} This machine is not paired with Tower (cockpit login), so the stored digest could not be read either.`),
+        });
+    }
     if (!outcome.ok)
         return refuse(io, command.json, outcome.reason, outcome.detail);
     writeLine(io.stdout, command.json ? JSON.stringify(outcome) : outcome.text);

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.173");
+    writeLine(io?.stdout ?? process.stdout, "0.2.174");
     return 0;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.173",
+  "version": "0.2.174",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.47",
-    "@bli-cockpit/mcp": "0.1.89",
-    "@bli-cockpit/telemetry-core": "0.1.59"
+    "@bli-cockpit/memory-mcp": "0.1.48",
+    "@bli-cockpit/mcp": "0.1.90",
+    "@bli-cockpit/telemetry-core": "0.1.60"
   },
   "repository": {
     "type": "git",