@bli-cockpit/cli 0.2.207 → 0.2.210

package/dist/adapters/raw-evidence-sanitize.js

@@ -1,6 +1,16 @@
 import { containsSecretLikeContent, redactSecretLikeContent, scannedCleanRedactionMetadata, } from "@bli-cockpit/telemetry-core";
 import { sha256 } from "./raw-evidence-keys.js";
 import { describeError } from "../health-detail.js";
+/**
+ * The one line a whole file becomes when masking its secret-bearing lines still leaves something
+ * secret-looking. It carries none of the file's content, so a reader that compares sizes or hashes
+ * against it (`cockpit sources check`) must treat it as "no redacted form", never as the file.
+ */
+export const WHOLE_FILE_MASK_LINE = "[REDACTED_LINE:secret_redaction_failed]\n";
+/** True when these upload bytes are the whole-file mask, not a redacted copy of the content. */
+export function isWholeFileMask(bytes) {
+    return Buffer.from(bytes).toString("utf8") === WHOLE_FILE_MASK_LINE;
+}
 /** BLI-3238: a crashed redactor has to say so; see the catch below. */
 export function sanitizeTextEvidenceForUpload(options) {
     const originalBytes = options.originalBytes ?? Buffer.from(options.text, "utf8");
@@ -75,7 +85,7 @@ function maskFileWithSecretLikeName(input) {
         ? input.redactionResult.text
         : input.text;
     const safeText = containsSecretLikeContent(sanitizedText)
-        ? "[REDACTED_LINE:secret_redaction_failed]\n"
+        ? WHOLE_FILE_MASK_LINE
         : sanitizedText;
     const sanitizedBytes = Buffer.from(safeText, "utf8");
     return {
@@ -101,7 +111,7 @@ function maskSecretBearingLinesOnly(input) {
         });
     let maskedText = maskSecretBearingLines(input.text, redaction);
     if (containsSecretLikeContent(maskedText)) {
-        maskedText = "[REDACTED_LINE:secret_redaction_failed]\n";
+        maskedText = WHOLE_FILE_MASK_LINE;
     }
     const sanitizedBytes = Buffer.from(maskedText, "utf8");
     return {

package/dist/commands/install-receipts.js

@@ -136,11 +136,15 @@ async function deliverPendingInstallEvents(options, paths, deviceToken) {
     let delivered = 0;
     let observedMinCliVersion = null;
     for (let offset = 0; offset < pending.length; offset += 5) {
-        await Promise.all(pending.slice(offset, offset + 5).map((entry) => deliverInstallEventEntry(options.io, paths, entry, deviceToken, failures).then((floor) => {
-            if (floor != null)
-                observedMinCliVersion = floor;
-            if (floor !== undefined)
-                delivered += 1;
+        await Promise.all(pending.slice(offset, offset + 5).map((entry) => deliverInstallEventEntry(options.io, paths, entry, deviceToken, failures).then((receipt) => {
+            if (receipt === undefined)
+                return;
+            if (receipt.floor != null)
+                observedMinCliVersion = receipt.floor;
+            if (receipt.imageHandlingMode !== undefined && options.observed) {
+                options.observed.imageHandlingMode = receipt.imageHandlingMode;
+            }
+            delivered += 1;
         })));
     }
     if (delivered > 0) {
@@ -165,9 +169,9 @@ async function deliverInstallEventEntry(io, paths, entry, deviceToken, failures)
     const timeout = setTimeout(() => controller.abort(), 5_000);
     try {
         const response = await postInstallEventEntry(io, entry, deviceToken, controller.signal);
-        const floor = await readObservedMinCliVersion(response);
+        const receipt = await readReceiptReply(response);
         await removeInstallEventEntry(paths, entry.outbox_id);
-        return floor;
+        return receipt;
     }
     catch (error) {
         await keepFailedInstallEventEntry(paths, entry, error, failures);
@@ -193,18 +197,25 @@ async function postInstallEventEntry(io, entry, deviceToken, signal) {
         throw new Error(`http_${response.status}`);
     return response;
 }
-async function readObservedMinCliVersion(response) {
+/**
+ * The reply carries two things the tick listens for: the server-published `min_cli_version` floor
+ * (BLI-2678) and this machine's `image_handling_mode` (BLI-17273; undefined when the reply names
+ * none, validated by the caller and never here).
+ */
+async function readReceiptReply(response) {
     const receipt = (await response.json().catch((error) => {
-        // This reply carries the server-published `min_cli_version` floor
-        // (BLI-2678). A body that will not parse means the floor is not
-        // observed on this tick and the forced-update path silently does
-        // nothing — while the 2xx above says the receipt landed fine.
-        console.error("[install-receipts] receipt body unreadable; no min_cli_version observed", JSON.stringify({ reason: "receipt_body_unreadable", http_status: response.status, ...describeError(error) }));
+        // A body that will not parse means the floor and the image mode are not observed on this tick
+        // (the forced-update path silently does nothing, the machine keeps its cached mode) while the
+        // 2xx above says the receipt landed fine.
+        console.error("[install-receipts] receipt body unreadable; no min_cli_version or image_handling_mode observed", JSON.stringify({ reason: "receipt_body_unreadable", http_status: response.status, ...describeError(error) }));
         return null;
     }));
-    return typeof receipt?.min_cli_version === "string" && receipt.min_cli_version.trim()
-        ? receipt.min_cli_version.trim()
-        : null;
+    return {
+        floor: typeof receipt?.min_cli_version === "string" && receipt.min_cli_version.trim()
+            ? receipt.min_cli_version.trim()
+            : null,
+        imageHandlingMode: receipt?.image_handling_mode,
+    };
 }
 async function keepFailedInstallEventEntry(paths, entry, error, failures) {
     const failureReason = classifyInstallTelemetryError(error);

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.207");
+    writeLine(io?.stdout ?? process.stdout, "0.2.210");
     return 0;
   }
 

package/dist/commands/settings-render.js

@@ -138,6 +138,10 @@ export function renderSwitches(body) {
     if (typeof body.readFailureReason === "string") {
         lines.push(`${INDENT}values could not be read: ${body.readFailureReason}`);
     }
+    // "No machine is on slim" must never hide "could not ask" (BLI-17273).
+    if (typeof body.collectorImageModeReadFailureReason === "string") {
+        lines.push(`${INDENT}machine image modes could not be listed: ${body.collectorImageModeReadFailureReason}`);
+    }
     return lines;
 }
 export function renderModelRouting(body) {

package/dist/commands/sources-check.js

@@ -1,11 +1,12 @@
 import { writeLine } from "./cli-io.js";
 import { readDescribedImageKeys } from "../image-description-state.js";
+import { resolveImageHandlingMode } from "../image-mode-state.js";
 import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
 import { fetchTranscriptObjects } from "../evidence-transcripts-client.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
 import { discoverLocalTranscripts } from "./sources-discovery.js";
 import { fileFacts, judgeSource } from "./sources-verdict.js";
-const VERDICTS = ["stored_full", "stored_partial", "not_stored"];
+const VERDICTS = ["stored_full", "stored_slim", "stored_partial", "not_stored"];
 const DAY_MS = 24 * 60 * 60 * 1000;
 export async function runSourcesCheck(command, io, now = new Date()) {
     const startedAt = Date.now();
@@ -30,13 +31,18 @@ export async function runSourcesCheck(command, io, now = new Date()) {
         claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),
     };
     const describedKeys = new Set(await readDescribedImageKeys(paths.state_dir));
+    // BLI-17273: judge against THIS machine's mode (the cache the sync-start receipt wrote, else the
+    // fleet default), never the bare constant. A machine that runs or ever ran slim holds slim server
+    // copies, which must never read as safe to delete.
+    const imageMode = await resolveImageHandlingMode(paths.state_dir);
+    console.error("[collector sources] judging against this machine's image mode", JSON.stringify({ reason: `image_mode_from_${imageMode.source}`, mode: imageMode.mode, slim_aware: imageMode.slimAware }));
     const report = emptyReport(command, remote, local.newer_count, local.file_read_failed + local.directory_read_failed);
     for (const file of local.files) {
         const judged = await judgeSource({
             file,
             remotes: remote.files.get(file.key) ?? [],
             cursorEntry: file.kind === "claude_subagent" ? null : (cursors[file.source].sessions[file.session_id] ?? null),
-            facts: fileFacts(file, undefined, { describedKeys }),
+            facts: fileFacts(file, undefined, { mode: imageMode.mode, describedKeys, slimAware: imageMode.slimAware }),
         }).catch((error) => {
             report.local.unreadable += 1;
             console.error("[collector sources] a transcript could not be judged; left out of the answer", JSON.stringify({ reason: "file_unreadable", kind: file.kind, byte_size: file.byte_size, error_name: error?.name ?? "Error" }));
@@ -71,6 +77,7 @@ export async function runSourcesCheck(command, io, now = new Date()) {
         newer_skipped: report.local.newer_skipped,
         unreadable: report.local.unreadable,
         stored_full: report.counts.stored_full,
+        stored_slim: report.counts.stored_slim,
         stored_partial: report.counts.stored_partial,
         not_stored: report.counts.not_stored,
         reasons: report.reasons,
@@ -93,6 +100,7 @@ function emptyReport(command, remote, newerSkipped, unreadable) {
         local: { examined: 0, newer_skipped: newerSkipped, unreadable },
         counts: {
             stored_full: { files: 0, bytes: 0 },
+            stored_slim: { files: 0, bytes: 0 },
             stored_partial: { files: 0, bytes: 0 },
             not_stored: { files: 0, bytes: 0 },
         },
@@ -115,7 +123,10 @@ export function sourcesCheckLines(report) {
     const lines = [
         `Tower sources check: ${scope} on this machine`,
         `  stored in full   ${report.counts.stored_full.files} file(s), ${mb(report.counts.stored_full.bytes)} MB`,
-        `  stored in part   ${report.counts.stored_partial.files} file(s), ${mb(report.counts.stored_partial.bytes)} MB`,
+        ...(report.counts.stored_slim.files > 0
+            ? [`  stored slim      ${report.counts.stored_slim.files} file(s), ${mb(report.counts.stored_slim.bytes)} MB (KEEP: Tower holds the slim form, the image bytes are only here)`]
+            : []),
+        `  stored in part  ${report.counts.stored_partial.files} file(s), ${mb(report.counts.stored_partial.bytes)} MB`,
         `  not stored       ${report.counts.not_stored.files} file(s), ${mb(report.counts.not_stored.bytes)} MB`,
     ];
     const reasons = Object.entries(report.reasons).sort((a, b) => b[1] - a[1]);
@@ -129,7 +140,7 @@ export function sourcesCheckLines(report) {
     if (report.status === "incomplete") {
         lines.push(`  INCOMPLETE       Tower's list was cut short (${report.reason}); "not stored" and "stored in part" may be understated. Run it again.`);
     }
-    lines.push("Tower never deletes these files. `--json` lists every file with its path and verdict. Only a \"stored in full\" file is safe to delete by your own hand; see docs/runbooks/freeing-disk-on-a-collector-machine.md.");
+    lines.push("Tower never deletes these files. `--json` lists every file with its path and verdict. Only a \"stored in full\" file is safe to delete by your own hand (never \"stored slim\"); see docs/runbooks/freeing-disk-on-a-collector-machine.md.");
     return lines;
 }
 function mb(bytes) {

package/dist/commands/sources-verdict.js

@@ -18,6 +18,14 @@
  *                   grow after its upload, else `remote_smaller`), or its size
  *                   is not recorded (`remote_size_unknown`).
  *
+ *   stored_slim     (BLI-17273) the copy Tower holds is the SLIM form of the file: images
+ *                   described and replaced by a marker, duplicate copies and bookkeeping
+ *                   stripped. Complete for every reader, but the local file holds the only
+ *                   copy of the image bytes, so a slim copy is NEVER `stored_full`: keep the
+ *                   file. Only judged for a machine that runs, or ever ran, slim
+ *                   (`image-mode-state.ts`); every other machine reads exactly as before.
+ *                   The rules are on `judgeWithSlimCopy` below.
+ *
  * A file too large to redact in memory is compared by its raw size
  * (`remote_at_least_file_size`). A file whose redaction would crash to the stub
  * is compared the same way, never by the stub's 42 bytes.
@@ -28,7 +36,7 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, REDACTION_STUB_SHA256, } from "@bli-cockpit/telemetry-core";
-import { sanitizeTextEvidenceForUpload } from "../adapters/raw-evidence-sanitize.js";
+import { isWholeFileMask, sanitizeTextEvidenceForUpload } from "../adapters/raw-evidence-sanitize.js";
 import { isSecretLikePath } from "../adapters/raw-evidence-keys.js";
 import { IMAGE_HANDLING_MODE } from "@bli-cockpit/telemetry-core";
 import { uploadFormOfTranscript } from "../image-description-session.js";
@@ -47,7 +55,15 @@ export async function judgeSource(input) {
         reason,
         remote_byte_size: best,
     });
-    if (cursorEntry &&
+    const split = input.facts.slimSplit ? await input.facts.slimSplit() : null;
+    if (split)
+        return judgeWithSlimCopy({ file, cursorEntry, facts: input.facts, held, best, split });
+    // A slim-aware machine with a null split may have lost its described-image list: the server copy
+    // can be slim while this side sees nothing to slim. The cursor cannot tell, so judge only against
+    // the whole form below (a slim copy then reads stored_partial/remote_smaller: keep the file).
+    const trustCursor = input.facts.slimAware !== true;
+    if (trustCursor &&
+        cursorEntry &&
         !cursorEntry.stubbed &&
         cursorEntry.uploaded_object_key &&
         held.some((remote) => remote.object_key === cursorEntry.uploaded_object_key) &&
@@ -56,7 +72,12 @@ export async function judgeSource(input) {
         cursorEntry.file_hash_sha256 === (await input.facts.rawSha256())) {
         return full("unchanged_since_upload");
     }
-    const sanitized = await input.facts.sanitized();
+    if (!trustCursor) {
+        console.error("[sources-verdict] slim-aware machine, no slim split: cursor shortcut skipped", JSON.stringify({ reason: "slim_aware_split_null", has_cursor: cursorEntry !== null }));
+    }
+    // Slim-aware with no split: only the WHOLE form is evidence of a whole server copy. When it
+    // stubs (null) the raw size below answers, so a slim-only copy is never stored_full.
+    const sanitized = !trustCursor && input.facts.wholeForm ? await input.facts.wholeForm() : await input.facts.sanitized();
     if (sanitized) {
         if (held.some((remote) => remote.content_hash_sha256 === sanitized.sha256))
             return full("content_hash_match");
@@ -76,16 +97,91 @@ export async function judgeSource(input) {
         cursorEntry.uploaded_byte_size < file.byte_size;
     return partial(grewAfterUpload ? "changed_since_upload" : "remote_smaller");
 }
+/**
+ * BLI-17273. The file has two redacted forms (whole and slim) and this machine has run slim, so a
+ * copy Tower holds may be either. The rule that keeps local image bytes safe: only evidence that the
+ * WHOLE form is on the server makes `stored_full`; a copy that is the slim form, or cannot be told
+ * apart from it, is `stored_slim` (keep the file).
+ *
+ *   hash equals the whole form                         stored_full    content_hash_match
+ *   hash equals the slim form                          stored_slim    content_hash_match
+ *   largest copy is at least the whole form's size     stored_full    remote_at_least_sanitized_size
+ *   cursor says its upload is current, file unchanged  stored_slim    unchanged_since_upload
+ *     (the upload may be either form and its hash matches neither, so it is not proven whole)
+ *   largest copy is at least the slim form's size      stored_slim    remote_at_least_slim_size
+ *   size never recorded                                stored_partial remote_size_unknown
+ *   otherwise                                          stored_partial changed_since_upload / remote_smaller
+ *
+ * A stale whole copy cannot outrank the slim size: a copy smaller than the whole form is never
+ * `stored_full` here, however it compares to the slim form.
+ */
+async function judgeWithSlimCopy(input) {
+    const { file, cursorEntry, held, best, split } = input;
+    const result = (verdict, reason) => ({
+        verdict,
+        reason,
+        remote_byte_size: best,
+    });
+    if (held.some((remote) => remote.content_hash_sha256 === split.full.sha256))
+        return result("stored_full", "content_hash_match");
+    if (held.some((remote) => remote.content_hash_sha256 === split.slim.sha256))
+        return result("stored_slim", "content_hash_match");
+    if (best !== null && best >= split.full.byte_size)
+        return result("stored_full", "remote_at_least_sanitized_size");
+    if (cursorEntry &&
+        !cursorEntry.stubbed &&
+        cursorEntry.uploaded_object_key &&
+        held.some((remote) => remote.object_key === cursorEntry.uploaded_object_key) &&
+        cursorEntry.uploaded_byte_size === file.byte_size &&
+        cursorEntry.file_hash_sha256 &&
+        cursorEntry.file_hash_sha256 === (await input.facts.rawSha256())) {
+        return result("stored_slim", "unchanged_since_upload");
+    }
+    if (best === null)
+        return result("stored_partial", "remote_size_unknown");
+    if (best >= split.slim.byte_size)
+        return result("stored_slim", "remote_at_least_slim_size");
+    const grewAfterUpload = cursorEntry?.uploaded_object_key != null &&
+        cursorEntry.uploaded_byte_size != null &&
+        cursorEntry.uploaded_byte_size < file.byte_size;
+    return result("stored_partial", grewAfterUpload ? "changed_since_upload" : "remote_smaller");
+}
 /**
  * Reads the file at most once, on first ask, and redacts it exactly as the
  * upload does (`raw-evidence-transcript-file.ts`): same sanitizer, same
  * secret-like-name rule, same byte cap.
  */
 export function fileFacts(file, maxBytes = RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, 
-/** Tests only set `mode`. Production reads the one switch. `describedKeys` is the collector's described-image state. */
+/**
+ * `mode` is this machine's mode (`image-mode-state.ts`; absent means the fleet default
+ * `IMAGE_HANDLING_MODE`). `describedKeys` is the collector's described-image state. `slimAware`
+ * (BLI-17273) is true for a machine that runs or ever ran slim: its server copies may be slim, so
+ * `slimSplit()` answers; absent it defaults to "the mode is drop".
+ */
 upload = {}) {
     const mode = upload.mode ?? IMAGE_HANDLING_MODE;
     const describedKeys = upload.describedKeys ?? new Set();
+    const slimAware = upload.slimAware ?? mode === "describe_and_drop";
+    const redactForUpload = (text, original) => {
+        const result = sanitizeTextEvidenceForUpload({
+            text,
+            originalBytes: text === original.toString("utf8") ? original : Buffer.from(text, "utf8"),
+            redactedFields: [`${file.kind === "codex_rollout" ? "codex_jsonl" : file.kind === "claude_main" ? "claude_jsonl" : "claude_jsonl_sidecar"}.body`],
+            secretLikeFileName: isSecretLikePath(path.basename(file.file_path)),
+        });
+        const hash = sha256(result.bytes);
+        if (hash === REDACTION_STUB_SHA256)
+            return null;
+        // A whole-file mask is one 40-byte line, not the content: every copy Tower holds would look
+        // "at least as large" and read stored_full. No redacted form, so the raw size answers instead.
+        if (isWholeFileMask(result.bytes)) {
+            console.error("[sources-verdict] redacted form is the whole-file mask: judged by raw size", JSON.stringify({ reason: "whole_file_mask", source: file.source, file_bytes: file.byte_size }));
+            return null;
+        }
+        return { sha256: hash, byte_size: result.bytes.byteLength };
+    };
+    let split = null;
+    let whole = null;
     let bytes = null;
     const read = () => {
         bytes ??= file.byte_size > maxBytes ? Promise.resolve(null) : fs.readFile(file.file_path);
@@ -94,6 +190,7 @@ upload = {}) {
     let rawHash = null;
     let sanitized = null;
     return {
+        slimAware,
         rawSha256() {
             rawHash ??= read().then(async (buffer) => (buffer ? sha256(buffer) : await streamSha256(file.file_path)));
             return rawHash;
@@ -104,19 +201,33 @@ upload = {}) {
                     return null;
                 // Compare against what the uploader sends: in drop mode that is the slim form, not the disk bytes.
                 const uploadText = uploadFormOfTranscript(buffer.toString("utf8"), file.source === "codex" ? "codex" : "claude_code", mode, describedKeys);
-                const result = sanitizeTextEvidenceForUpload({
-                    text: uploadText,
-                    originalBytes: uploadText === buffer.toString("utf8") ? buffer : Buffer.from(uploadText, "utf8"),
-                    redactedFields: [`${file.kind === "codex_rollout" ? "codex_jsonl" : file.kind === "claude_main" ? "claude_jsonl" : "claude_jsonl_sidecar"}.body`],
-                    secretLikeFileName: isSecretLikePath(path.basename(file.file_path)),
-                });
-                const hash = sha256(result.bytes);
-                if (hash === REDACTION_STUB_SHA256)
-                    return null;
-                return { sha256: hash, byte_size: result.bytes.byteLength };
+                return redactForUpload(uploadText, buffer);
             });
             return sanitized;
         },
+        wholeForm() {
+            whole ??= read().then((buffer) => (buffer ? redactForUpload(buffer.toString("utf8"), buffer) : null));
+            return whole;
+        },
+        async slimSplit() {
+            if (!slimAware)
+                return null;
+            split ??= read().then((buffer) => {
+                if (!buffer)
+                    return null;
+                const text = buffer.toString("utf8");
+                const slimText = uploadFormOfTranscript(text, file.source === "codex" ? "codex" : "claude_code", "describe_and_drop", describedKeys);
+                // Slimming changes nothing: one form, and `sanitized()` is the answer.
+                if (slimText === text)
+                    return null;
+                const whole = redactForUpload(text, buffer);
+                const slim = redactForUpload(slimText, buffer);
+                if (!whole || !slim || whole.sha256 === slim.sha256)
+                    return null;
+                return { full: whole, slim };
+            });
+            return split;
+        },
     };
 }
 function sha256(buffer) {

package/dist/commands/sync.js

@@ -45,6 +45,7 @@ import { sendSyncHeartbeat } from "./sync-heartbeat.js";
 import { runSyncWithHealthReceipt } from "./sync-receipt.js";
 import { runAutostartSelfHealAfterSync, runMemoryInstallAfterSync, runScheduledSelfUpdateAfterSync, runStagingPruneAfterSync, } from "./sync-followups.js";
 import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
+import { settleTickImageModeBestEffort } from "../image-mode-state.js";
 import { stampSyncTick } from "../sync-tick-stamp.js";
 import { startTickTimer } from "../sync-tick-timing.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
@@ -137,14 +138,20 @@ async function tickDashboardUrl(command, paths) {
  * one to fall back on (BLI-2678).
  */
 async function reportTickStarted(command, io, dashboardUrl) {
-    return reportInstallEventsBestEffort({
+    const observed = {};
+    const minCliVersion = await reportInstallEventsBestEffort({
         homeDir: command.homeDir,
         dashboardUrl,
         command: "sync",
         events: [{ step: "sync_started", status: "ok" }],
         json: command.json,
         io,
+        observed,
     });
+    // BLI-17273: the reply also names this machine's image-handling mode. Put it on file BEFORE
+    // collection starts (the uploader reads the file); an offline tick keeps the last value on file.
+    await settleTickImageModeBestEffort(getCollectorRuntimePaths(command.homeDir).state_dir, observed.imageHandlingMode);
+    return minCliVersion;
 }
 /** Post the receipt the run earned, whatever it says. */
 async function reportTickOutcome(command, io, dashboardUrl, completion) {

package/dist/image-description-session.js

@@ -9,7 +9,8 @@
  *     the describe door, a few at a time, inside a per-sync count and time budget. The state file
  *     remembers what was sent, so a screenshot that appears in 40 turns, or in 3 sessions, is sent
  *     once. A failure never fails the transcript.
- *  3. REPLACE, only when the one switch (`IMAGE_HANDLING_MODE` in telemetry-core) says
+ *  3. REPLACE, only when this machine's mode (set per machine from Tower, kept on file by
+ *     `image-mode-state.ts`; the fleet default is `IMAGE_HANDLING_MODE` in telemetry-core) says
  *     `describe_and_drop`: every image whose description is stored becomes its short marker. An
  *     image with no stored description is KEPT. In `describe_and_keep` (the default) the text
  *     comes back byte for byte as it went in.
@@ -22,8 +23,9 @@
  */
 import { IMAGE_DESCRIBE_MAX_BYTES, IMAGE_HANDLING_MODE, base64Of, findEmbeddedImages, replaceImagesWithMarkers, } from "@bli-cockpit/telemetry-core";
 import { postImageToDescribeDoor } from "./image-describe-client.js";
+import { resolveImageHandlingMode } from "./image-mode-state.js";
 import { slimOrKeep, slimTranscript } from "./slim/slim-transcript.js";
-import { imageStateKey, readDescribedImageKeys, writeDescribedImageKeys, } from "./image-description-state.js";
+import { imageStateKey, imageRetryDelayMs, readDescribedImageKeys, readFailedImages, writeImageDescriptionState, } from "./image-description-state.js";
 /** New images sent to the door in one sync (all worktrees together). */
 export const IMAGE_DESCRIBE_MAX_PER_RUN = 100;
 /** After this long in one sync, remaining images wait for the next tick. */
@@ -35,6 +37,8 @@ export async function openImageDescriptions(options) {
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
     const described = new Set(await readDescribedImageKeys(options.stateDir));
     const orderedKeys = [...described];
+    const failedImages = await readFailedImages(options.stateDir);
+    let stateDirty = false;
     const settledThisRun = new Map();
     const now = options.now ?? Date.now;
     const startedAt = now();
@@ -59,12 +63,33 @@ export async function openImageDescriptions(options) {
             source: input.source,
             session_id: input.sessionId.slice(0, 200),
         });
+        const key = imageStateKey(image.sha256);
         if (outcome.ok) {
             markDescribed(image.sha256);
             settledThisRun.set(image.sha256, outcome.status);
+            if (failedImages[key]) {
+                delete failedImages[key];
+                stateDirty = true;
+            }
             return;
         }
         settledThisRun.set(image.sha256, `failed:${outcome.reason}`);
+        rememberFailure(key, outcome);
+    }
+    /**
+     * BLI-16979: the door answered about THIS image and could not describe it (a 4xx such as
+     * `describer_rejected_image`, or a 5xx). Wait before sending the same bytes again, instead of
+     * re-sending them every sync. A transport error, a 401 and a 429 say nothing about the image, so
+     * they are not remembered.
+     */
+    function rememberFailure(key, outcome) {
+        if (outcome.httpStatus < 400 || outcome.httpStatus === 401 || outcome.httpStatus === 429)
+            return;
+        const attempts = (failedImages[key]?.attempts ?? 0) + 1;
+        const delay = imageRetryDelayMs(attempts, outcome.permanent);
+        failedImages[key] = { reason: outcome.reason, attempts, retry_after: now() + delay };
+        stateDirty = true;
+        console.error(TAG + " image not described, will not be re-sent until later", JSON.stringify({ reason: outcome.reason, http_status: outcome.httpStatus, attempts, retry_in_hours: Math.round(delay / 3_600_000), sha256_prefix: key.slice(0, 16) }));
     }
     async function describeAndReplace(input) {
         const images = findEmbeddedImages(input.text);
@@ -74,7 +99,7 @@ export async function openImageDescriptions(options) {
         for (const image of images)
             if (!unique.has(image.sha256))
                 unique.set(image.sha256, image);
-        const counts = { already: 0, described_now: 0, known: 0, too_large: 0, over_budget: 0, failed: 0 };
+        const counts = { already: 0, described_now: 0, known: 0, too_large: 0, over_budget: 0, failed: 0, backing_off: 0 };
         const failedReasons = {};
         const toSend = [];
         for (const image of unique.values()) {
@@ -90,6 +115,11 @@ export async function openImageDescriptions(options) {
                 counts.too_large += 1;
                 continue;
             }
+            const earlierFailure = failedImages[imageStateKey(image.sha256)];
+            if (earlierFailure && earlierFailure.retry_after > now()) {
+                counts.backing_off += 1;
+                continue;
+            }
             toSend.push(image);
         }
         let next = 0;
@@ -116,8 +146,10 @@ export async function openImageDescriptions(options) {
                 failedReasons[reason] = (failedReasons[reason] ?? 0) + 1;
             }
         }
-        if (counts.described_now + counts.known > 0)
-            await writeDescribedImageKeys(options.stateDir, orderedKeys);
+        if (counts.described_now + counts.known > 0 || stateDirty) {
+            await writeImageDescriptionState(options.stateDir, { described: orderedKeys, failed: failedImages });
+            stateDirty = false;
+        }
         const replaced = mode === "describe_and_drop"
             ? replaceImagesWithMarkers(input.text, images, (image) => described.has(imageStateKey(image.sha256)))
             : { text: input.text, replacedCount: 0, charsSaved: 0 };
@@ -174,11 +206,15 @@ export async function openImageStepForSync(options) {
     if (options.budget?.images)
         return options.budget.images;
     try {
+        // BLI-17273: the mode is PER MACHINE: the last value Tower sent (kept on file so an offline
+        // tick does not flip a slim machine back), else the fleet default `IMAGE_HANDLING_MODE`.
+        const mode = options.mode ?? (await resolveImageHandlingMode(options.stateDir)).mode;
         const session = await openImageDescriptions({
             stateDir: options.stateDir,
             dashboardUrl: options.dashboardUrl,
             deviceToken: options.deviceToken,
             fetchImpl: options.fetchImpl,
+            mode,
         });
         if (options.budget)
             options.budget.images = session;

package/dist/image-description-state.js

@@ -9,7 +9,7 @@
  */
 import path from "node:path";
 import { isMissingFileFailure } from "./health-detail.js";
-import { readJsonFile, writeJsonFile } from "./local-state-files.js";
+import { readJsonFile, writeJsonFileAtomic } from "./local-state-files.js";
 export const IMAGE_DESCRIPTION_STATE_FILENAME = "image-descriptions.json";
 /** Oldest keys leave first past this many (about 5 MB on disk). */
 export const IMAGE_DESCRIPTION_STATE_MAX_KEYS = 150_000;
@@ -35,10 +35,54 @@ export async function readDescribedImageKeys(stateDir) {
         return [];
     }
 }
-export async function writeDescribedImageKeys(stateDir, keys) {
+/** Oldest failures leave first past this many. */
+export const IMAGE_FAILED_STATE_MAX_KEYS = 5_000;
+const HOUR_MS = 3_600_000;
+/** A refusal that repeats for the same bytes (a 4xx): a week, then a month. */
+const PERMANENT_BACKOFF_MS = [7 * 24 * HOUR_MS, 30 * 24 * HOUR_MS];
+/** A failure that may pass (the door or the model was down): 1 h, 6 h, 24 h, then 72 h. */
+const TRANSIENT_BACKOFF_MS = [HOUR_MS, 6 * HOUR_MS, 24 * HOUR_MS, 72 * HOUR_MS];
+/** How long to leave an image alone after its Nth failed attempt. */
+export function imageRetryDelayMs(attempts, permanent) {
+    const steps = permanent ? PERMANENT_BACKOFF_MS : TRANSIENT_BACKOFF_MS;
+    return steps[Math.min(Math.max(attempts, 1), steps.length) - 1];
+}
+/** The failures on record, key to record. A missing or unreadable file is an empty map, said out loud when unreadable. */
+export async function readFailedImages(stateDir) {
+    try {
+        const raw = (await readJsonFile(imageDescriptionStatePath(stateDir)));
+        if (!raw?.failed || typeof raw.failed !== "object" || Array.isArray(raw.failed))
+            return {};
+        const kept = {};
+        for (const [key, value] of Object.entries(raw.failed)) {
+            const record = value;
+            if (key.length !== KEY_CHARS || !record)
+                continue;
+            if (typeof record.reason !== "string" || typeof record.attempts !== "number" || typeof record.retry_after !== "number")
+                continue;
+            kept[key] = { reason: record.reason, attempts: record.attempts, retry_after: record.retry_after };
+        }
+        return kept;
+    }
+    catch (error) {
+        if (!isMissingFileFailure(error)) {
+            console.error("[image-descriptions] failed-image list unreadable, starting from an empty list", JSON.stringify({ reason: "image_failed_state_unreadable" }));
+        }
+        return {};
+    }
+}
+export async function writeImageDescriptionState(stateDir, state) {
+    const keys = state.described;
     const kept = keys.length > IMAGE_DESCRIPTION_STATE_MAX_KEYS ? keys.slice(keys.length - IMAGE_DESCRIPTION_STATE_MAX_KEYS) : keys;
-    await writeJsonFile(imageDescriptionStatePath(stateDir), {
+    const failedEntries = Object.entries(state.failed).sort((a, b) => a[1].retry_after - b[1].retry_after);
+    const failed = Object.fromEntries(failedEntries.slice(Math.max(0, failedEntries.length - IMAGE_FAILED_STATE_MAX_KEYS)));
+    await writeJsonFileAtomic(imageDescriptionStatePath(stateDir), {
         schema_version: "cockpit-image-descriptions.v1",
         described: kept,
+        failed,
     });
+}
+/** Writes the described list and keeps whatever failures are on record. */
+export async function writeDescribedImageKeys(stateDir, keys) {
+    await writeImageDescriptionState(stateDir, { described: keys, failed: await readFailedImages(stateDir) });
 }

package/dist/image-mode-state.js

@@ -0,0 +1,154 @@
+/**
+ * This machine's image-handling mode, as Tower last told it (BLI-17273).
+ *
+ * The fleet default is `IMAGE_HANDLING_MODE` (keep). Tower can set a different mode for ONE machine
+ * (`collector_image_mode:<device_id>` in `system_settings`); the answer rides the reply to the
+ * sync-start receipt (`image_handling_mode`). The tick records what it heard here, in one small file in
+ * the collector state directory, and every later reader (the uploader, `cockpit sources check`)
+ * reads the file. The mode for a tick is therefore:
+ *
+ *   the reply's value, when this tick got one   (it is written to the file first, so the file IS it)
+ *   else the last value on file                  (an offline tick must not flip a slim machine back
+ *                                                 to keep: each flip re-uploads every live-window
+ *                                                 transcript as a new object)
+ *   else `IMAGE_HANDLING_MODE`
+ *
+ * The file also remembers, sticky, that this machine EVER ran slim (`drop_seen_at`). A machine put
+ * back on keep still holds slim server copies of the files it uploaded while slim, and
+ * `cockpit sources check` must go on treating those as "keep your local file".
+ *
+ * Holds the mode and two timestamps. Never an id, a path or a byte.
+ */
+import path from "node:path";
+import { IMAGE_HANDLING_MODE } from "@bli-cockpit/telemetry-core";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
+import { readJsonFile, writeJsonFileAtomic } from "./local-state-files.js";
+export const IMAGE_MODE_STATE_FILENAME = "image-handling-mode.json";
+const TAG = "[image-mode]";
+export function isImageHandlingMode(value) {
+    return value === "describe_and_keep" || value === "describe_and_drop";
+}
+export function imageModeStatePath(stateDir) {
+    return path.join(stateDir, IMAGE_MODE_STATE_FILENAME);
+}
+/**
+ * Stands in for `drop_seen_at` when the file was there but could not be read, so whether this machine
+ * ever ran slim is unknown. It counts as "ran slim": the wrong guess costs a kept local file, the
+ * other wrong guess lets `cockpit sources check` call a slim server copy safe to delete.
+ */
+export const DROP_SEEN_UNKNOWN = "unknown_state_unreadable";
+async function readImageModeFile(stateDir) {
+    let raw;
+    try {
+        raw = await readJsonFile(imageModeStatePath(stateDir));
+    }
+    catch (error) {
+        if (isMissingFileFailure(error))
+            return { state: null, damaged: false, recoveredDropSeenAt: null };
+        console.error(TAG + " cache unreadable, using the fleet default and treating this machine as ever-slim", JSON.stringify({ reason: "image_mode_cache_unreadable", ...describeError(error) }));
+        return { state: null, damaged: true, recoveredDropSeenAt: null };
+    }
+    const record = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+    if (!record) {
+        console.error(TAG + " cache is not an object, using the fleet default and treating this machine as ever-slim", JSON.stringify({ reason: "image_mode_cache_shape_invalid" }));
+        return { state: null, damaged: true, recoveredDropSeenAt: null };
+    }
+    const dropSeenAt = typeof record.drop_seen_at === "string" ? record.drop_seen_at : null;
+    if (!isImageHandlingMode(record.mode)) {
+        console.error(TAG + " cached mode not recognised, using the fleet default and treating this machine as ever-slim", JSON.stringify({ reason: "image_mode_cache_value_invalid" }));
+        return { state: null, damaged: true, recoveredDropSeenAt: dropSeenAt };
+    }
+    return {
+        state: {
+            mode: record.mode,
+            observed_at: typeof record.observed_at === "string" ? record.observed_at : "",
+            drop_seen_at: dropSeenAt,
+        },
+        damaged: false,
+        recoveredDropSeenAt: null,
+    };
+}
+/** The file's content, or null when there is none or it cannot be trusted (said out loud when unreadable). */
+export async function readImageModeState(stateDir) {
+    return (await readImageModeFile(stateDir)).state;
+}
+/**
+ * What a reader of the file should use right now: the cached mode, else (damaged file) slim when a
+ * `drop_seen_at` could be recovered from it, else the fleet default. `slimAware` is true when this
+ * machine runs slim OR has ever run slim. `read` is a read the caller already did this tick, so a
+ * damaged file is read and logged once.
+ */
+export async function resolveImageHandlingMode(stateDir, read) {
+    const { state, damaged, recoveredDropSeenAt } = read ?? (await readImageModeFile(stateDir));
+    // A damaged file that still named when this machine first ran slim: it ran slim, keep it slim
+    // (flipping to keep would re-upload every live-window transcript as a new whole object).
+    const mode = state?.mode ?? (damaged && recoveredDropSeenAt !== null ? "describe_and_drop" : IMAGE_HANDLING_MODE);
+    return {
+        mode,
+        source: state ? "cache" : damaged ? "damaged_cache" : "default",
+        // A file that is there but unreadable is "ever slim, unknown": fail closed (BLI-17273).
+        slimAware: mode === "describe_and_drop" || state?.drop_seen_at != null || damaged,
+        state,
+    };
+}
+/**
+ * Put what the reply said on file. An unknown value is ignored with a log (the old value stays);
+ * a write failure is logged and the previous file stays in force. Returns true only when the file
+ * now holds the observed mode.
+ */
+export async function recordObservedImageMode(stateDir, observed, now = () => new Date(), read) {
+    if (observed === undefined || observed === null)
+        return false;
+    if (!isImageHandlingMode(observed)) {
+        console.error(TAG + " reply carried a mode this collector does not know, ignored", JSON.stringify({ reason: "image_mode_reply_value_unknown", value_type: typeof observed }));
+        return false;
+    }
+    const { state: previous, damaged, recoveredDropSeenAt } = read ?? (await readImageModeFile(stateDir));
+    const stamp = now().toISOString();
+    const next = {
+        mode: observed,
+        observed_at: stamp,
+        // Never rebuild "never ran slim" over a file we could not read: keep what parsed, else the unknown marker.
+        drop_seen_at: previous?.drop_seen_at ?? (damaged ? (recoveredDropSeenAt ?? DROP_SEEN_UNKNOWN) : observed === "describe_and_drop" ? stamp : null),
+    };
+    if (damaged) {
+        console.error(TAG + " rewriting a damaged mode file; ever-slim history kept", JSON.stringify({ reason: "image_mode_cache_damaged_rewritten", drop_seen_recovered: recoveredDropSeenAt !== null }));
+    }
+    try {
+        await writeJsonFileAtomic(imageModeStatePath(stateDir), { schema_version: "cockpit-image-handling-mode.v1", ...next });
+    }
+    catch (error) {
+        console.error(TAG + " could not cache the mode Tower sent; the previous value stays in force", JSON.stringify({ reason: "image_mode_cache_write_failed", mode: observed, ...describeError(error) }));
+        return false;
+    }
+    if (previous?.mode !== observed) {
+        console.error(TAG + " mode for this machine changed", JSON.stringify({ reason: "image_mode_changed", from: previous?.mode ?? (damaged ? "damaged" : "none"), to: observed }));
+    }
+    return true;
+}
+/**
+ * The tick's decision, logged once: where the mode came from and what it is. Called right after the
+ * sync-start receipt. `observed` is the reply's value (undefined when no reply arrived).
+ */
+export async function settleTickImageMode(stateDir, observed, now) {
+    // One read per tick: a damaged file is logged once, and the 'changed' line can say from:'damaged'.
+    const read = await readImageModeFile(stateDir);
+    const wrote = await recordObservedImageMode(stateDir, observed, now, read);
+    // After a write the file is whole again, so read it fresh; otherwise the tick's own read stands.
+    const resolved = wrote ? await resolveImageHandlingMode(stateDir) : await resolveImageHandlingMode(stateDir, read);
+    const source = wrote ? "reply" : resolved.source;
+    console.error(TAG + " mode for this tick", JSON.stringify({ reason: `image_mode_from_${source}`, source, mode: resolved.mode }));
+    return { mode: resolved.mode, source };
+}
+/**
+ * `settleTickImageMode` for the sync tick, which it must never fail: a throw is logged and the
+ * uploader falls back to the file or the fleet default.
+ */
+export async function settleTickImageModeBestEffort(stateDir, observed) {
+    try {
+        await settleTickImageMode(stateDir, observed);
+    }
+    catch (error) {
+        console.error(TAG + " could not settle the mode for this tick; the uploader reads the file or the fleet default", JSON.stringify({ reason: "image_mode_settle_failed", error_name: error instanceof Error ? error.name : typeof error }));
+    }
+}

package/dist/local-state-files.js

@@ -47,6 +47,26 @@ export async function writeJsonFile(filePath, value) {
         await fs.chmod(filePath, 0o600).catch(() => undefined);
     }
 }
+/**
+ * Same file, same owner-only mode, but written to a sibling temp file and renamed over the target, so
+ * a reader (or a crash) never sees a half-written file (BLI-17273: a torn image-mode file made a slim
+ * machine forget it had ever run slim). The temp file is removed when the write or the rename fails.
+ */
+export async function writeJsonFileAtomic(filePath, value) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    const temp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 10)}.tmp`;
+    try {
+        await fs.writeFile(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        if (process.platform !== "win32") {
+            await fs.chmod(temp, 0o600).catch(() => undefined);
+        }
+        await fs.rename(temp, filePath);
+    }
+    catch (error) {
+        await fs.rm(temp, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
 /**
  * Separate from `isMissingFileFailure`: the two callers here hold a raw `fs`
  * rejection rather than a wrapped failure, and "the file was never there" is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.207",
+  "version": "0.2.210",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.63",
-    "@bli-cockpit/mcp": "0.1.118",
-    "@bli-cockpit/telemetry-core": "0.1.72"
+    "@bli-cockpit/memory-mcp": "0.1.65",
+    "@bli-cockpit/mcp": "0.1.120",
+    "@bli-cockpit/telemetry-core": "0.1.74"
   },
   "repository": {
     "type": "git",