@bli-cockpit/cli 0.2.19 → 0.2.21

package/dist/autostart.js

@@ -10,6 +10,16 @@ const WINDOWS_AUTOSTART_SCRIPT_NAME = "autostart-sync.ps1";
 const WINDOWS_AUTOSTART_REGISTRATION_SCRIPT_NAME = "autostart-register.ps1";
 const UTF8_BOM = "\uFEFF";
 export const DEFAULT_AUTOSTART_INTERVAL_SECONDS = 15 * 60;
+/**
+ * macOS rewrites this file on every network transition (join, leave, DNS
+ * change), so watching it retries spooled uploads the moment connectivity
+ * returns instead of waiting out the StartInterval \u2014 the lid-closed-mid-upload
+ * machine hopping caf\u00E9s is where most historical upload failures came from
+ * (BLI-2604). The real file, not the /etc/resolv.conf symlink: launchd watches
+ * the path it is given, and the symlink itself never changes. Burst fires are
+ * cheap \u2014 the collection lock turns overlap into a named no-op.
+ */
+export const DARWIN_NETWORK_CHANGE_SIGNAL = "/private/var/run/resolv.conf";
 const UNSUPPORTED_MESSAGE = "autostart is supported on macOS and Windows only";
 function plistPathFor(homeDir) {
     return path.join(homeDir, "Library", "LaunchAgents", `${AUTOSTART_LABEL}.plist`);
@@ -49,8 +59,13 @@ export async function installAutostartAgent(options) {
     const stderrPath = path.join(paths.state_dir, "sync.err.log");
     // launchd will not reliably watch a path that does not exist at load time, so
     // only feed it the transcript dirs that are present right now. A missing dir
-    // is fine — the StartInterval floor still covers it.
-    const watchPaths = await existingWatchPaths(homeDir);
+    // is fine — the StartInterval floor still covers it. The network signal is
+    // appended unconditionally: it always exists on the Macs this plist targets,
+    // and an existence filter would drop it when rendering on another host.
+    const watchPaths = [
+        ...(await existingWatchPaths(homeDir)),
+        DARWIN_NETWORK_CHANGE_SIGNAL,
+    ];
     await mkdir(path.dirname(plistPath), { recursive: true });
     await mkdir(paths.state_dir, { recursive: true });
     await writeFile(plistPath, renderPlist({

package/dist/commands/local.js

@@ -21,6 +21,7 @@ import { resolveDiscoveryLimits, saveDiscoveryLimits, } from "../discovery-limit
 import { runAttributedWorktreeSync, matchesLiveSyncWorktree, } from "./session-sync.js";
 import { COLLECTION_ROOT_REQUIRED, missingCollectionRootMessage, normalizeRootsDetailed, resolveOnboardingRoots, rootRejectionExplanation, } from "../onboarding-roots.js";
 import { rawEvidenceGcSummary, runRawEvidenceLocalGc, } from "../raw-evidence-gc.js";
+import { envWithNodeRuntimeOnPath, runScheduledSelfUpdate, } from "../scheduled-self-update.js";
 import { enqueueInstallEventEntry, readPendingInstallEventEntries, recordInstallEventAttemptFailure, removeInstallEventEntry, } from "../spool/install-event-outbox.js";
 import { createCapturedExecRunner, createInteractiveExecRunner, } from "../process-runner.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
@@ -250,6 +251,9 @@ function localSubcommandHelp(command) {
                 "Newly discovered repos get a general ambient work context automatically.",
                 "Discovery scans 3 folder levels and up to 50 repos by default; tune with",
                 "--max-depth and --max-repos.",
+                "Also self-updates the CLI from npm latest once per day, strictly after",
+                "collection finishes; set COCKPIT_DISABLE_AUTO_UPDATE=1 to freeze the",
+                "installed version during incident triage.",
             ],
         ],
         [
@@ -2149,6 +2153,9 @@ async function runSync(command, io) {
             json: command.json,
             io,
         });
+        // BLI-2601: self-update runs only after collection's own outcome above is
+        // already decided and reported, win or lose. See the function doc.
+        await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl);
         return result.exitCode;
     }
     catch (error) {
@@ -2167,9 +2174,107 @@ async function runSync(command, io) {
             json: command.json,
             io,
         });
+        await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl);
         throw error;
     }
 }
+/**
+ * BLI-2601: the fleet keeps itself current on npm `latest` without anyone
+ * re-running `npm i -g @bli-cockpit/cli` by hand after day 0. This always
+ * runs AFTER `runSync` has already decided and reported collection's own
+ * outcome above — a stuck or failing self-update can never block or delay
+ * collection, and a collection failure never blocks the chance to
+ * self-update. Every error path here is swallowed on purpose: a failure is
+ * reported as its own named `update` receipt, never surfaced as a `sync`
+ * failure or thrown from this function.
+ */
+async function runScheduledSelfUpdateAfterSync(command, io, dashboardUrl) {
+    let event;
+    try {
+        event = await runScheduledSelfUpdateForSync(command, io);
+    }
+    catch (error) {
+        // The throttle/probe/install machinery below is defensive already; this
+        // is the last-resort net so an update crash truly cannot touch the sync
+        // result above.
+        event = {
+            step: "update",
+            status: "fail",
+            error_code: "self_update_threw",
+            error_detail: redactedSyncErrorDetail(error),
+        };
+    }
+    if (!event)
+        return;
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        command: "update",
+        events: [event],
+        json: command.json,
+        io,
+    });
+}
+async function runScheduledSelfUpdateForSync(command, io) {
+    const rawExec = io.exec;
+    if (!rawExec) {
+        // Only the real production `defaultIo()` supplies a process runner. A
+        // caller that omitted one gets a silent no-op rather than this reaching
+        // for a real npm binary it was never given — never observed in
+        // production, where `defaultIo()` always sets `exec`.
+        return null;
+    }
+    // Every spawn in the scheduled path carries the running node's bin dir on
+    // PATH — see envWithNodeRuntimeOnPath. Interactive doctor never needed
+    // this; the scheduler's stripped environment does.
+    const spawnEnv = envWithNodeRuntimeOnPath(io.env ?? process.env);
+    const exec = (cmd, args, options) => rawExec(cmd, args, { ...options, env: options?.env ?? spawnEnv });
+    const scheduledIo = { ...io, exec };
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    const result = await runScheduledSelfUpdate(paths, {
+        exec,
+        currentVersion: LOCAL_COLLECTOR_VERSION,
+        install: (tag) => attemptScheduledSelfUpdateInstall(scheduledIo, tag),
+    }, { env: io.env });
+    return scheduledSelfUpdateInstallEvent(result);
+}
+async function attemptScheduledSelfUpdateInstall(io, tag) {
+    try {
+        // Reuses the exact npm-install machinery `cockpit doctor`'s
+        // `fixCliLatest` uses (see doctor.ts:243-280) so there is one place that
+        // knows how to invoke `npm i -g` and classify EACCES. Unlike doctor,
+        // this call never re-execs — see runScheduledSelfUpdate's doc comment.
+        await runSelfUpdate(io, { json: true, tag });
+        return { ok: true };
+    }
+    catch (error) {
+        if (!(error instanceof SelfUpdateError))
+            throw error;
+        return { ok: false, eacces: error.eacces };
+    }
+}
+function scheduledSelfUpdateInstallEvent(result) {
+    // The steady-state "already checked today" case is a pure no-op; reporting
+    // it would post a receipt on ~95 of every 96 sync ticks for no new
+    // information. Only a real attempt (ok, fail, or an explicit disable)
+    // produces a receipt.
+    if (result.reason === "throttled_recent_attempt")
+        return null;
+    if (result.status === "ok")
+        return { step: "update", status: "ok" };
+    const detail = [
+        result.target_version ? `target ${result.target_version}` : null,
+        result.installed_version ? `installed ${result.installed_version}` : null,
+    ]
+        .filter((part) => Boolean(part))
+        .join("; ");
+    return {
+        step: "update",
+        status: result.status,
+        error_code: result.reason,
+        ...(detail ? { error_detail: detail } : {}),
+    };
+}
 async function runSyncWithHealthReceipt(command, io) {
     const backfillLock = await inspectBackfillLock(getCollectorRuntimePaths(command.homeDir));
     if (backfillLock.held) {

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.19");
+    writeLine(io?.stdout ?? process.stdout, "0.2.21");
     return 0;
   }
 

package/dist/scheduled-self-update.js

@@ -0,0 +1,136 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+const SELF_UPDATE_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
+export const SELF_UPDATE_THROTTLE_MARKER = ".last-self-update-check";
+/**
+ * launchd starts the scheduled tick with a bare PATH (`/usr/bin:/bin:...`) —
+ * the plist hardcodes absolute node/CLI paths for exactly that reason — so a
+ * bare `npm` spawn that works in every interactive shell resolves to nothing
+ * inside the tick, and every scheduled update would fail `npm_install_failed`
+ * on the whole Mac fleet while interactive `cockpit doctor` kept working. The
+ * npm shim ships beside the node binary in the standard layouts on both host
+ * families, so the running node's own directory is the one PATH entry that is
+ * always right.
+ */
+export function envWithNodeRuntimeOnPath(env, nodeExecutable = process.execPath) {
+    const nodeBinDir = path.dirname(nodeExecutable);
+    const currentPath = env["PATH"] ?? "";
+    if (currentPath.split(path.delimiter).includes(nodeBinDir))
+        return env;
+    return {
+        ...env,
+        PATH: [nodeBinDir, currentPath].filter(Boolean).join(path.delimiter),
+    };
+}
+/**
+ * BLI-2601. Runs at most once per day from inside `cockpit sync`'s
+ * post-collection tail, so the fleet converges on npm `latest` without
+ * anyone re-running `npm i -g @bli-cockpit/cli` by hand after day 0.
+ *
+ * Deliberately does not re-exec: this process already has the OLD code
+ * loaded in memory, so nothing in-process could prove a re-exec actually
+ * picked up the new build. The next scheduled tick launches a fresh
+ * `cockpit` process from disk and picks up whatever npm actually installed —
+ * that is the verification, not a re-exec here.
+ */
+export async function runScheduledSelfUpdate(paths, deps, options = {}) {
+    const env = options.env ?? process.env;
+    const now = options.now ?? new Date();
+    const tag = options.tag ?? "latest";
+    const marker = path.join(paths.state_dir, SELF_UPDATE_THROTTLE_MARKER);
+    const lastCheck = await fs.stat(marker).catch(() => null);
+    if (lastCheck && now.getTime() - lastCheck.mtimeMs < SELF_UPDATE_MIN_INTERVAL_MS) {
+        // The steady-state case: already checked today, nothing to do. Not
+        // reported as an "attempt" by the caller — this fires on ~95 of every 96
+        // ticks and would otherwise be pure noise.
+        return { status: "skipped", reason: "throttled_recent_attempt" };
+    }
+    // The marker is written for the attempt, not the outcome — same idiom as
+    // raw-evidence GC (raw-evidence-gc.ts). A machine stuck on a permissions
+    // error must not spend every 15-min tick re-hitting the npm registry.
+    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
+    await fs.writeFile(marker, now.toISOString()).catch(() => undefined);
+    // Incident triage freeze: an operator can pin a machine's installed
+    // version while debugging without touching the scheduler itself. Mirrors
+    // COCKPIT_DISABLE_GC. Checked after the throttle write on purpose, so a
+    // disabled machine reports itself at most once per day too, instead of on
+    // every tick.
+    if (env["COCKPIT_DISABLE_AUTO_UPDATE"] === "1") {
+        return { status: "skipped", reason: "disabled_by_env" };
+    }
+    const targetVersion = await latestCliVersionFromNpm(deps.exec, tag);
+    if (targetVersion && targetVersion === deps.currentVersion) {
+        return { status: "ok", reason: "already_latest", target_version: targetVersion };
+    }
+    const installed = await deps.install(tag);
+    if (!installed.ok) {
+        return {
+            status: "fail",
+            reason: installed.eacces ? "eacces_needs_chown" : "npm_install_failed",
+            ...(targetVersion ? { target_version: targetVersion } : {}),
+        };
+    }
+    // Verify against what the platform returns, not the exit code npm handed
+    // back (BLI-2541 lesson: a green exit code is not proof). Read the
+    // globally installed package's version back off disk via `npm ls -g
+    // --json` rather than trusting that install succeeding means the version
+    // this process expected is what is actually there.
+    const installedVersion = await probeInstalledCliVersion(deps.exec);
+    if (!installedVersion || (targetVersion && installedVersion !== targetVersion)) {
+        return {
+            status: "fail",
+            reason: "stale_after_self_update",
+            ...(targetVersion ? { target_version: targetVersion } : {}),
+            ...(installedVersion ? { installed_version: installedVersion } : {}),
+        };
+    }
+    return {
+        status: "ok",
+        reason: "updated",
+        target_version: targetVersion ?? installedVersion,
+        installed_version: installedVersion,
+    };
+}
+async function latestCliVersionFromNpm(exec, tag) {
+    const result = await exec("npm", [
+        "view",
+        `@bli-cockpit/cli@${tag}`,
+        "version",
+        "--json",
+    ]);
+    if (result.code !== 0)
+        return null;
+    return parseNpmVersionField(result.stdout);
+}
+async function probeInstalledCliVersion(exec) {
+    // `npm ls` can exit non-zero on unrelated extraneous/peer-dependency
+    // warnings even when the requested package resolved cleanly, so the JSON
+    // body is parsed regardless of exit code — the printed tree is the ground
+    // truth here, not the exit code.
+    const result = await exec("npm", ["ls", "-g", "@bli-cockpit/cli", "--json"]);
+    try {
+        const parsed = JSON.parse(result.stdout);
+        const version = parsed.dependencies?.["@bli-cockpit/cli"]?.version;
+        return typeof version === "string" && version.trim() ? version.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Small, intentional duplication of doctor.ts's `parseNpmVersion`: importing
+// it here would create a cycle (doctor.ts already imports types from
+// commands/local.ts, which would need to import this file to wire the sync
+// integration). The parsing itself is a few lines and has no behavior this
+// module doesn't already own.
+function parseNpmVersionField(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed)
+        return null;
+    try {
+        const parsed = JSON.parse(trimmed);
+        return typeof parsed === "string" && parsed.trim() ? parsed.trim() : null;
+    }
+    catch {
+        return trimmed.replace(/^"|"$/gu, "") || null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "private": false,
   "type": "module",
   "bin": {