@bli-cockpit/cli 0.2.208 → 0.2.211

package/dist/commands/session-sync-upload.js

@@ -10,6 +10,8 @@ import { startLocalWorkContext, startLocalWorkContextForAttributedTarget, } from
 import { LocalUploadBlockedError, syncLocalAmbientEnvelope, } from "../upload.js";
 import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET, } from "../adapters/raw-evidence.js";
 import { liveSyncTargetKey, liveSyncTargetWorktrees, matchesLiveSyncWorktree, } from "./session-sync-attribution.js";
+import { isOutsideRootsWorkspace } from "./backfill-outside-roots.js";
+import { giveOutsideRootsTheirOwnAllowance, outsideRootsLast, } from "./session-sync-outside-roots.js";
 import { runYieldingAtBoundaries } from "./sync-yield.js";
 const CLAUDE_DAMP_GROWTH_BYTES = 256 * 1024;
 const CLAUDE_DAMP_MAX_AGE_MS = 6 * 60 * 60 * 1000;
@@ -22,10 +24,12 @@ const CLAUDE_DAMP_MAX_AGE_MS = 6 * 60 * 60 * 1000;
  */
 export async function syncEveryTargetWorktree(options) {
     const { run, scan } = options;
-    const syncWorktrees = liveSyncTargetWorktrees(run.worktrees, [
+    // BLI-17916: the outside-roots workspace goes last, so in-root evidence is
+    // never held up behind it.
+    const syncWorktrees = outsideRootsLast(liveSyncTargetWorktrees(run.worktrees, [
         ...scan.codexAttribution.results,
         ...scan.claudeAttribution.results,
-    ]);
+    ]));
     const discoveredWorktreeKeys = new Set(run.worktrees.map(liveSyncTargetKey));
     // sessionId -> prior durable pointer for damped sessions (drives the
     // growth_damped count + the skip_main decision).
@@ -40,21 +44,28 @@ export async function syncEveryTargetWorktree(options) {
         items: syncWorktrees,
         shouldYield: run.yieldCheck,
         describe: (outcome) => ({ status: outcome.sync.status }),
-        runOne: (worktree) => syncOneWorktree({
-            run,
-            now: options.now,
-            plan: options.plan,
-            scan,
-            worktree,
-            syncWorktrees,
-            rawEvidenceBudget,
-            // A target git discovery never produced is one the fallback attribution
-            // synthesized, and it syncs through its own attributed work context.
-            isDiscoveredWorktree: discoveredWorktreeKeys.has(liveSyncTargetKey(worktree)),
-            recordDampedClaudeSession: (sessionId, priorPointer) => {
-                dampedClaudePointers.set(sessionId, priorPointer);
-            },
-        }),
+        runOne: (worktree) => {
+            // The outside-root pass has its own per-tick allowance (bytes and files),
+            // so a busy in-root tick cannot starve it and it cannot take in-root room.
+            if (isOutsideRootsWorkspace(worktree)) {
+                giveOutsideRootsTheirOwnAllowance(rawEvidenceBudget);
+            }
+            return syncOneWorktree({
+                run,
+                now: options.now,
+                plan: options.plan,
+                scan,
+                worktree,
+                syncWorktrees,
+                rawEvidenceBudget,
+                // A target git discovery never produced is one the fallback attribution
+                // synthesized, and it syncs through its own attributed work context.
+                isDiscoveredWorktree: discoveredWorktreeKeys.has(liveSyncTargetKey(worktree)),
+                recordDampedClaudeSession: (sessionId, priorPointer) => {
+                    dampedClaudePointers.set(sessionId, priorPointer);
+                },
+            });
+        },
     });
     const outcomes = loop.results;
     const everyWorktreeUploaded = outcomes.every((outcome) => outcome.sync.status === "uploaded");
@@ -87,12 +98,14 @@ function claudeDurablePointersFromCursor(claudeCursorBefore) {
  */
 async function syncOneWorktree(options) {
     const { run, worktree } = options;
-    const attributedSyntheticTarget = options.isDiscoveredWorktree
-        ? null
-        : worktree;
-    const ensureContext = () => startWorktreeContext(options, attributedSyntheticTarget);
+    // The outside-roots workspace starts its work context the way `cockpit
+    // backfill` does (a plain folder, no attributed-target proof): it is a
+    // transport folder the collector owns, not a repo anyone attributed.
+    const outsideRoots = isOutsideRootsWorkspace(worktree);
+    const attributedSyntheticTarget = options.isDiscoveredWorktree || outsideRoots ? null : worktree;
+    const ensureContext = () => startWorktreeContext(options, attributedSyntheticTarget, outsideRoots);
     let context = null;
-    if (run.startContexts || attributedSyntheticTarget) {
+    if (run.startContexts || attributedSyntheticTarget || outsideRoots) {
         context = await ensureContext();
     }
     const syncOptions = ambientEnvelopeForWorktree(options);
@@ -112,15 +125,21 @@ async function syncOneWorktree(options) {
     }
     return { worktree, context, sync };
 }
-function startWorktreeContext(options, attributedSyntheticTarget) {
+function startWorktreeContext(options, attributedSyntheticTarget, outsideRoots) {
     const { run, worktree } = options;
     const contextOptions = {
         homeDir: run.homeDir,
         repoRoot: worktree.repo_root,
-        activeTicketId: run.activeTicketId,
+        // The caller's ticket and branch belong to the caller's repo, never to the
+        // outside-roots workspace.
+        ...(outsideRoots ? {} : { activeTicketId: run.activeTicketId }),
         operatorId: run.operatorId,
         sessionId: run.sessionId,
-        ...(attributedSyntheticTarget ? {} : { branch: run.branch }),
+        ...(outsideRoots
+            ? { branch: worktree.branch, leaveActiveContext: true }
+            : attributedSyntheticTarget
+                ? {}
+                : { branch: run.branch }),
     };
     return attributedSyntheticTarget
         ? startLocalWorkContextForAttributedTarget(contextOptions, attributedSyntheticTarget)

package/dist/commands/session-sync.js

@@ -43,7 +43,8 @@ import { getCollectorRuntimePaths } from "../local-state.js";
 import { buildAgentSessionReport, buildAgentSessionSummary, } from "./agent-session-report.js";
 import { collectSessionCommits, withSessionCommits } from "../session-commits.js";
 import { planSyncFromLocalState } from "./session-sync-plan.js";
-import { scanAndAttributeBothSources } from "./session-sync-scan.js";
+import { scanAndAttributeBothSources, sourceScanFailureReason, } from "./session-sync-scan.js";
+import { admitOutsideRootSessions, applyOutsideRootHolds, markOutsideRootCatchUpDone, } from "./session-sync-outside-roots.js";
 import { syncEveryTargetWorktree } from "./session-sync-upload.js";
 import { reportSessionsAndAdvanceCursors } from "./session-sync-record.js";
 import { decideSyncHealth } from "./session-sync-health.js";
@@ -55,6 +56,11 @@ export { sourceScanFailureReason, sourceScanRetryReason, } from "./session-sync-
 export { SYNC_FAILED_WITHOUT_REASON } from "./session-sync-failures.js";
 export { nothingInRootCount } from "./session-sync-health.js";
 export { isDeliveryHoldReason, summarizeDeliveryHold, } from "./session-sync-hold.js";
+/** Did either session store fail to read this tick? A failed read means the scan saw less than exists. */
+function scanHadReadFailure(scan) {
+    return (sourceScanFailureReason("codex", scan.codexAttribution) !== null ||
+        sourceScanFailureReason("claude_code", scan.claudeAttribution) !== null);
+}
 /**
  * Shared dual-source sync orchestration for single-repo and parent-folder
  * modes. Codex AND Claude Code sessions are scanned and attributed once across
@@ -62,7 +68,8 @@ export { isDeliveryHoldReason, summarizeDeliveryHold, } from "./session-sync-hol
  * fallback-attributed transcripts (Codex + Claude main + sidecars). The
  * ambiguous/unattributed/skipped sessions inside an approved root retain those
  * labels while syncing once through that root's synthetic folder workspace.
- * Outside-root sessions remain diagnostic-only. The session row's upload state
+ * Outside-root sessions keep their labels and upload through the collector's
+ * own outside-roots workspace, a few per tick (BLI-17916). The session row's upload state
  * maps ONLY from the main-file outcome (D3); sidecar outcomes aggregate into
  * CLI counts.
  *
@@ -80,13 +87,21 @@ export async function runAttributedWorktreeSync(options) {
         now,
         approvedCollectionRoots: options.collectionRoots,
     });
-    const scan = await scanAndAttributeBothSources({
+    const scanned = await scanAndAttributeBothSources({
         paths,
         homeDir,
         now,
         worktrees: options.worktrees,
         plan,
     });
+    // BLI-17916: roots are a label, never a gate. Outside-root sessions ride this
+    // tick's upload under the synthetic workspace, a few per tick, newest first.
+    const scan = await admitOutsideRootSessions({
+        homeDir: options.homeDir,
+        plan,
+        scan: scanned,
+        now,
+    });
     const worktreePass = await syncEveryTargetWorktree({
         run: options,
         now,
@@ -102,18 +117,20 @@ export async function runAttributedWorktreeSync(options) {
     }
     console.error("[session-sync] bindings read", JSON.stringify({ bound_worktrees: ticketByWorktree.size, reason: "active_work_context" }));
     // BLI-13028: which commits each session's working tree created while it ran.
+    // Read from the scan as it was BEFORE the outside-root step: the synthetic
+    // workspace is not a git tree, and no commit belongs to it.
     const commitsBySession = await collectSessionCommits([
-        ...scan.codexAttribution.results.map((result) => ({ key: `codex:${result.codex_session_id}`, result })),
-        ...scan.claudeAttribution.results.map((result) => ({ key: `claude_code:${result.claude_session_id}`, result })),
+        ...scanned.codexAttribution.results.map((result) => ({ key: `codex:${result.codex_session_id}`, result })),
+        ...scanned.claudeAttribution.results.map((result) => ({ key: `claude_code:${result.claude_session_id}`, result })),
     ]);
-    const sessions = withSessionCommits(buildAgentSessionReport({
+    const sessions = applyOutsideRootHolds(withSessionCommits(buildAgentSessionReport({
         ticketByWorktree,
         codexResults: scan.codexAttribution.results,
         claudeResults: scan.claudeAttribution.results,
         outcomes: worktreePass.outcomes,
         now,
         claudePriorDurablePointers: worktreePass.claudePriorDurablePointers,
-    }), commitsBySession);
+    }), commitsBySession), scan.outsideRoots?.holds);
     // BLI-4341: every session should arrive counted. Say how many did, and say
     // it on the success path too: a silent drop from "all" to "some" is exactly
     // the kind of decay nobody notices.
@@ -133,6 +150,11 @@ export async function runAttributedWorktreeSync(options) {
         sessions,
         outcomes: worktreePass.outcomes,
     });
+    // The one-time 30-day look-back is done once a tick read both stores without
+    // a failure and recorded what it saw in the cursors.
+    if (plan.outsideRootCatchUpPending && !scanHadReadFailure(scan)) {
+        await markOutsideRootCatchUpDone(paths, { now, sessions_seen: sessions.length });
+    }
     const summary = buildAgentSessionSummary({
         codexAttribution: scan.codexAttribution,
         claudeAttribution: scan.claudeAttribution,

package/dist/commands/settings-render.js

@@ -138,6 +138,10 @@ export function renderSwitches(body) {
     if (typeof body.readFailureReason === "string") {
         lines.push(`${INDENT}values could not be read: ${body.readFailureReason}`);
     }
+    // "No machine is on slim" must never hide "could not ask" (BLI-17273).
+    if (typeof body.collectorImageModeReadFailureReason === "string") {
+        lines.push(`${INDENT}machine image modes could not be listed: ${body.collectorImageModeReadFailureReason}`);
+    }
     return lines;
 }
 export function renderModelRouting(body) {

package/dist/commands/sources-check.js

@@ -1,11 +1,12 @@
 import { writeLine } from "./cli-io.js";
 import { readDescribedImageKeys } from "../image-description-state.js";
+import { resolveImageHandlingMode } from "../image-mode-state.js";
 import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
 import { fetchTranscriptObjects } from "../evidence-transcripts-client.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
 import { discoverLocalTranscripts } from "./sources-discovery.js";
 import { fileFacts, judgeSource } from "./sources-verdict.js";
-const VERDICTS = ["stored_full", "stored_partial", "not_stored"];
+const VERDICTS = ["stored_full", "stored_slim", "stored_partial", "not_stored"];
 const DAY_MS = 24 * 60 * 60 * 1000;
 export async function runSourcesCheck(command, io, now = new Date()) {
     const startedAt = Date.now();
@@ -30,13 +31,18 @@ export async function runSourcesCheck(command, io, now = new Date()) {
         claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),
     };
     const describedKeys = new Set(await readDescribedImageKeys(paths.state_dir));
+    // BLI-17273: judge against THIS machine's mode (the cache the sync-start receipt wrote, else the
+    // fleet default), never the bare constant. A machine that runs or ever ran slim holds slim server
+    // copies, which must never read as safe to delete.
+    const imageMode = await resolveImageHandlingMode(paths.state_dir);
+    console.error("[collector sources] judging against this machine's image mode", JSON.stringify({ reason: `image_mode_from_${imageMode.source}`, mode: imageMode.mode, slim_aware: imageMode.slimAware }));
     const report = emptyReport(command, remote, local.newer_count, local.file_read_failed + local.directory_read_failed);
     for (const file of local.files) {
         const judged = await judgeSource({
             file,
             remotes: remote.files.get(file.key) ?? [],
             cursorEntry: file.kind === "claude_subagent" ? null : (cursors[file.source].sessions[file.session_id] ?? null),
-            facts: fileFacts(file, undefined, { describedKeys }),
+            facts: fileFacts(file, undefined, { mode: imageMode.mode, describedKeys, slimAware: imageMode.slimAware }),
         }).catch((error) => {
             report.local.unreadable += 1;
             console.error("[collector sources] a transcript could not be judged; left out of the answer", JSON.stringify({ reason: "file_unreadable", kind: file.kind, byte_size: file.byte_size, error_name: error?.name ?? "Error" }));
@@ -71,6 +77,7 @@ export async function runSourcesCheck(command, io, now = new Date()) {
         newer_skipped: report.local.newer_skipped,
         unreadable: report.local.unreadable,
         stored_full: report.counts.stored_full,
+        stored_slim: report.counts.stored_slim,
         stored_partial: report.counts.stored_partial,
         not_stored: report.counts.not_stored,
         reasons: report.reasons,
@@ -93,6 +100,7 @@ function emptyReport(command, remote, newerSkipped, unreadable) {
         local: { examined: 0, newer_skipped: newerSkipped, unreadable },
         counts: {
             stored_full: { files: 0, bytes: 0 },
+            stored_slim: { files: 0, bytes: 0 },
             stored_partial: { files: 0, bytes: 0 },
             not_stored: { files: 0, bytes: 0 },
         },
@@ -115,7 +123,10 @@ export function sourcesCheckLines(report) {
     const lines = [
         `Tower sources check: ${scope} on this machine`,
         `  stored in full   ${report.counts.stored_full.files} file(s), ${mb(report.counts.stored_full.bytes)} MB`,
-        `  stored in part   ${report.counts.stored_partial.files} file(s), ${mb(report.counts.stored_partial.bytes)} MB`,
+        ...(report.counts.stored_slim.files > 0
+            ? [`  stored slim      ${report.counts.stored_slim.files} file(s), ${mb(report.counts.stored_slim.bytes)} MB (KEEP: Tower holds the slim form, the image bytes are only here)`]
+            : []),
+        `  stored in part  ${report.counts.stored_partial.files} file(s), ${mb(report.counts.stored_partial.bytes)} MB`,
         `  not stored       ${report.counts.not_stored.files} file(s), ${mb(report.counts.not_stored.bytes)} MB`,
     ];
     const reasons = Object.entries(report.reasons).sort((a, b) => b[1] - a[1]);
@@ -129,7 +140,7 @@ export function sourcesCheckLines(report) {
     if (report.status === "incomplete") {
         lines.push(`  INCOMPLETE       Tower's list was cut short (${report.reason}); "not stored" and "stored in part" may be understated. Run it again.`);
     }
-    lines.push("Tower never deletes these files. `--json` lists every file with its path and verdict. Only a \"stored in full\" file is safe to delete by your own hand; see docs/runbooks/freeing-disk-on-a-collector-machine.md.");
+    lines.push("Tower never deletes these files. `--json` lists every file with its path and verdict. Only a \"stored in full\" file is safe to delete by your own hand (never \"stored slim\"); see docs/runbooks/freeing-disk-on-a-collector-machine.md.");
     return lines;
 }
 function mb(bytes) {

package/dist/commands/sources-verdict.js

@@ -18,6 +18,14 @@
  *                   grow after its upload, else `remote_smaller`), or its size
  *                   is not recorded (`remote_size_unknown`).
  *
+ *   stored_slim     (BLI-17273) the copy Tower holds is the SLIM form of the file: images
+ *                   described and replaced by a marker, duplicate copies and bookkeeping
+ *                   stripped. Complete for every reader, but the local file holds the only
+ *                   copy of the image bytes, so a slim copy is NEVER `stored_full`: keep the
+ *                   file. Only judged for a machine that runs, or ever ran, slim
+ *                   (`image-mode-state.ts`); every other machine reads exactly as before.
+ *                   The rules are on `judgeWithSlimCopy` below.
+ *
  * A file too large to redact in memory is compared by its raw size
  * (`remote_at_least_file_size`). A file whose redaction would crash to the stub
  * is compared the same way, never by the stub's 42 bytes.
@@ -28,7 +36,7 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, REDACTION_STUB_SHA256, } from "@bli-cockpit/telemetry-core";
-import { sanitizeTextEvidenceForUpload } from "../adapters/raw-evidence-sanitize.js";
+import { isWholeFileMask, sanitizeTextEvidenceForUpload } from "../adapters/raw-evidence-sanitize.js";
 import { isSecretLikePath } from "../adapters/raw-evidence-keys.js";
 import { IMAGE_HANDLING_MODE } from "@bli-cockpit/telemetry-core";
 import { uploadFormOfTranscript } from "../image-description-session.js";
@@ -47,7 +55,15 @@ export async function judgeSource(input) {
         reason,
         remote_byte_size: best,
     });
-    if (cursorEntry &&
+    const split = input.facts.slimSplit ? await input.facts.slimSplit() : null;
+    if (split)
+        return judgeWithSlimCopy({ file, cursorEntry, facts: input.facts, held, best, split });
+    // A slim-aware machine with a null split may have lost its described-image list: the server copy
+    // can be slim while this side sees nothing to slim. The cursor cannot tell, so judge only against
+    // the whole form below (a slim copy then reads stored_partial/remote_smaller: keep the file).
+    const trustCursor = input.facts.slimAware !== true;
+    if (trustCursor &&
+        cursorEntry &&
         !cursorEntry.stubbed &&
         cursorEntry.uploaded_object_key &&
         held.some((remote) => remote.object_key === cursorEntry.uploaded_object_key) &&
@@ -56,7 +72,12 @@ export async function judgeSource(input) {
         cursorEntry.file_hash_sha256 === (await input.facts.rawSha256())) {
         return full("unchanged_since_upload");
     }
-    const sanitized = await input.facts.sanitized();
+    if (!trustCursor) {
+        console.error("[sources-verdict] slim-aware machine, no slim split: cursor shortcut skipped", JSON.stringify({ reason: "slim_aware_split_null", has_cursor: cursorEntry !== null }));
+    }
+    // Slim-aware with no split: only the WHOLE form is evidence of a whole server copy. When it
+    // stubs (null) the raw size below answers, so a slim-only copy is never stored_full.
+    const sanitized = !trustCursor && input.facts.wholeForm ? await input.facts.wholeForm() : await input.facts.sanitized();
     if (sanitized) {
         if (held.some((remote) => remote.content_hash_sha256 === sanitized.sha256))
             return full("content_hash_match");
@@ -76,16 +97,91 @@ export async function judgeSource(input) {
         cursorEntry.uploaded_byte_size < file.byte_size;
     return partial(grewAfterUpload ? "changed_since_upload" : "remote_smaller");
 }
+/**
+ * BLI-17273. The file has two redacted forms (whole and slim) and this machine has run slim, so a
+ * copy Tower holds may be either. The rule that keeps local image bytes safe: only evidence that the
+ * WHOLE form is on the server makes `stored_full`; a copy that is the slim form, or cannot be told
+ * apart from it, is `stored_slim` (keep the file).
+ *
+ *   hash equals the whole form                         stored_full    content_hash_match
+ *   hash equals the slim form                          stored_slim    content_hash_match
+ *   largest copy is at least the whole form's size     stored_full    remote_at_least_sanitized_size
+ *   cursor says its upload is current, file unchanged  stored_slim    unchanged_since_upload
+ *     (the upload may be either form and its hash matches neither, so it is not proven whole)
+ *   largest copy is at least the slim form's size      stored_slim    remote_at_least_slim_size
+ *   size never recorded                                stored_partial remote_size_unknown
+ *   otherwise                                          stored_partial changed_since_upload / remote_smaller
+ *
+ * A stale whole copy cannot outrank the slim size: a copy smaller than the whole form is never
+ * `stored_full` here, however it compares to the slim form.
+ */
+async function judgeWithSlimCopy(input) {
+    const { file, cursorEntry, held, best, split } = input;
+    const result = (verdict, reason) => ({
+        verdict,
+        reason,
+        remote_byte_size: best,
+    });
+    if (held.some((remote) => remote.content_hash_sha256 === split.full.sha256))
+        return result("stored_full", "content_hash_match");
+    if (held.some((remote) => remote.content_hash_sha256 === split.slim.sha256))
+        return result("stored_slim", "content_hash_match");
+    if (best !== null && best >= split.full.byte_size)
+        return result("stored_full", "remote_at_least_sanitized_size");
+    if (cursorEntry &&
+        !cursorEntry.stubbed &&
+        cursorEntry.uploaded_object_key &&
+        held.some((remote) => remote.object_key === cursorEntry.uploaded_object_key) &&
+        cursorEntry.uploaded_byte_size === file.byte_size &&
+        cursorEntry.file_hash_sha256 &&
+        cursorEntry.file_hash_sha256 === (await input.facts.rawSha256())) {
+        return result("stored_slim", "unchanged_since_upload");
+    }
+    if (best === null)
+        return result("stored_partial", "remote_size_unknown");
+    if (best >= split.slim.byte_size)
+        return result("stored_slim", "remote_at_least_slim_size");
+    const grewAfterUpload = cursorEntry?.uploaded_object_key != null &&
+        cursorEntry.uploaded_byte_size != null &&
+        cursorEntry.uploaded_byte_size < file.byte_size;
+    return result("stored_partial", grewAfterUpload ? "changed_since_upload" : "remote_smaller");
+}
 /**
  * Reads the file at most once, on first ask, and redacts it exactly as the
  * upload does (`raw-evidence-transcript-file.ts`): same sanitizer, same
  * secret-like-name rule, same byte cap.
  */
 export function fileFacts(file, maxBytes = RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, 
-/** Tests only set `mode`. Production reads the one switch. `describedKeys` is the collector's described-image state. */
+/**
+ * `mode` is this machine's mode (`image-mode-state.ts`; absent means the fleet default
+ * `IMAGE_HANDLING_MODE`). `describedKeys` is the collector's described-image state. `slimAware`
+ * (BLI-17273) is true for a machine that runs or ever ran slim: its server copies may be slim, so
+ * `slimSplit()` answers; absent it defaults to "the mode is drop".
+ */
 upload = {}) {
     const mode = upload.mode ?? IMAGE_HANDLING_MODE;
     const describedKeys = upload.describedKeys ?? new Set();
+    const slimAware = upload.slimAware ?? mode === "describe_and_drop";
+    const redactForUpload = (text, original) => {
+        const result = sanitizeTextEvidenceForUpload({
+            text,
+            originalBytes: text === original.toString("utf8") ? original : Buffer.from(text, "utf8"),
+            redactedFields: [`${file.kind === "codex_rollout" ? "codex_jsonl" : file.kind === "claude_main" ? "claude_jsonl" : "claude_jsonl_sidecar"}.body`],
+            secretLikeFileName: isSecretLikePath(path.basename(file.file_path)),
+        });
+        const hash = sha256(result.bytes);
+        if (hash === REDACTION_STUB_SHA256)
+            return null;
+        // A whole-file mask is one 40-byte line, not the content: every copy Tower holds would look
+        // "at least as large" and read stored_full. No redacted form, so the raw size answers instead.
+        if (isWholeFileMask(result.bytes)) {
+            console.error("[sources-verdict] redacted form is the whole-file mask: judged by raw size", JSON.stringify({ reason: "whole_file_mask", source: file.source, file_bytes: file.byte_size }));
+            return null;
+        }
+        return { sha256: hash, byte_size: result.bytes.byteLength };
+    };
+    let split = null;
+    let whole = null;
     let bytes = null;
     const read = () => {
         bytes ??= file.byte_size > maxBytes ? Promise.resolve(null) : fs.readFile(file.file_path);
@@ -94,6 +190,7 @@ upload = {}) {
     let rawHash = null;
     let sanitized = null;
     return {
+        slimAware,
         rawSha256() {
             rawHash ??= read().then(async (buffer) => (buffer ? sha256(buffer) : await streamSha256(file.file_path)));
             return rawHash;
@@ -104,19 +201,33 @@ upload = {}) {
                     return null;
                 // Compare against what the uploader sends: in drop mode that is the slim form, not the disk bytes.
                 const uploadText = uploadFormOfTranscript(buffer.toString("utf8"), file.source === "codex" ? "codex" : "claude_code", mode, describedKeys);
-                const result = sanitizeTextEvidenceForUpload({
-                    text: uploadText,
-                    originalBytes: uploadText === buffer.toString("utf8") ? buffer : Buffer.from(uploadText, "utf8"),
-                    redactedFields: [`${file.kind === "codex_rollout" ? "codex_jsonl" : file.kind === "claude_main" ? "claude_jsonl" : "claude_jsonl_sidecar"}.body`],
-                    secretLikeFileName: isSecretLikePath(path.basename(file.file_path)),
-                });
-                const hash = sha256(result.bytes);
-                if (hash === REDACTION_STUB_SHA256)
-                    return null;
-                return { sha256: hash, byte_size: result.bytes.byteLength };
+                return redactForUpload(uploadText, buffer);
             });
             return sanitized;
         },
+        wholeForm() {
+            whole ??= read().then((buffer) => (buffer ? redactForUpload(buffer.toString("utf8"), buffer) : null));
+            return whole;
+        },
+        async slimSplit() {
+            if (!slimAware)
+                return null;
+            split ??= read().then((buffer) => {
+                if (!buffer)
+                    return null;
+                const text = buffer.toString("utf8");
+                const slimText = uploadFormOfTranscript(text, file.source === "codex" ? "codex" : "claude_code", "describe_and_drop", describedKeys);
+                // Slimming changes nothing: one form, and `sanitized()` is the answer.
+                if (slimText === text)
+                    return null;
+                const whole = redactForUpload(text, buffer);
+                const slim = redactForUpload(slimText, buffer);
+                if (!whole || !slim || whole.sha256 === slim.sha256)
+                    return null;
+                return { full: whole, slim };
+            });
+            return split;
+        },
     };
 }
 function sha256(buffer) {

package/dist/commands/sync-report.js

@@ -63,7 +63,7 @@ export async function reportNoWorktreeSync(command, io, run, dedup) {
     if (run.notice?.startsWith("nothing_in_root")) {
         // Says out loud what the receipt now says to the dashboard: the sessions
         // this machine ran were all outside the folders it is allowed to look at.
-        writeLine(io.stdout, `Every session seen this run was outside your approved folders (${run.notice}). Nothing was collected, and nothing is broken.`);
+        writeLine(io.stdout, `Every session seen this run was outside your approved folders (${run.notice}). No transcript was uploaded for them this run (the log line "outside-root raw upload" says why), and nothing is broken.`);
     }
     writeAgentSessionSummary(io, run.summary);
     if (gc && !gc.skipped)

package/dist/commands/sync.js

@@ -45,6 +45,7 @@ import { sendSyncHeartbeat } from "./sync-heartbeat.js";
 import { runSyncWithHealthReceipt } from "./sync-receipt.js";
 import { runAutostartSelfHealAfterSync, runMemoryInstallAfterSync, runScheduledSelfUpdateAfterSync, runStagingPruneAfterSync, } from "./sync-followups.js";
 import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
+import { settleTickImageModeBestEffort } from "../image-mode-state.js";
 import { stampSyncTick } from "../sync-tick-stamp.js";
 import { startTickTimer } from "../sync-tick-timing.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
@@ -137,14 +138,20 @@ async function tickDashboardUrl(command, paths) {
  * one to fall back on (BLI-2678).
  */
 async function reportTickStarted(command, io, dashboardUrl) {
-    return reportInstallEventsBestEffort({
+    const observed = {};
+    const minCliVersion = await reportInstallEventsBestEffort({
         homeDir: command.homeDir,
         dashboardUrl,
         command: "sync",
         events: [{ step: "sync_started", status: "ok" }],
         json: command.json,
         io,
+        observed,
     });
+    // BLI-17273: the reply also names this machine's image-handling mode. Put it on file BEFORE
+    // collection starts (the uploader reads the file); an offline tick keeps the last value on file.
+    await settleTickImageModeBestEffort(getCollectorRuntimePaths(command.homeDir).state_dir, observed.imageHandlingMode);
+    return minCliVersion;
 }
 /** Post the receipt the run earned, whatever it says. */
 async function reportTickOutcome(command, io, dashboardUrl, completion) {

package/dist/image-description-session.js

@@ -9,7 +9,8 @@
  *     the describe door, a few at a time, inside a per-sync count and time budget. The state file
  *     remembers what was sent, so a screenshot that appears in 40 turns, or in 3 sessions, is sent
  *     once. A failure never fails the transcript.
- *  3. REPLACE, only when the one switch (`IMAGE_HANDLING_MODE` in telemetry-core) says
+ *  3. REPLACE, only when this machine's mode (set per machine from Tower, kept on file by
+ *     `image-mode-state.ts`; the fleet default is `IMAGE_HANDLING_MODE` in telemetry-core) says
  *     `describe_and_drop`: every image whose description is stored becomes its short marker. An
  *     image with no stored description is KEPT. In `describe_and_keep` (the default) the text
  *     comes back byte for byte as it went in.
@@ -22,6 +23,7 @@
  */
 import { IMAGE_DESCRIBE_MAX_BYTES, IMAGE_HANDLING_MODE, base64Of, findEmbeddedImages, replaceImagesWithMarkers, } from "@bli-cockpit/telemetry-core";
 import { postImageToDescribeDoor } from "./image-describe-client.js";
+import { resolveImageHandlingMode } from "./image-mode-state.js";
 import { slimOrKeep, slimTranscript } from "./slim/slim-transcript.js";
 import { imageStateKey, imageRetryDelayMs, readDescribedImageKeys, readFailedImages, writeImageDescriptionState, } from "./image-description-state.js";
 /** New images sent to the door in one sync (all worktrees together). */
@@ -204,11 +206,15 @@ export async function openImageStepForSync(options) {
     if (options.budget?.images)
         return options.budget.images;
     try {
+        // BLI-17273: the mode is PER MACHINE: the last value Tower sent (kept on file so an offline
+        // tick does not flip a slim machine back), else the fleet default `IMAGE_HANDLING_MODE`.
+        const mode = options.mode ?? (await resolveImageHandlingMode(options.stateDir)).mode;
         const session = await openImageDescriptions({
             stateDir: options.stateDir,
             dashboardUrl: options.dashboardUrl,
             deviceToken: options.deviceToken,
             fetchImpl: options.fetchImpl,
+            mode,
         });
         if (options.budget)
             options.budget.images = session;

package/dist/image-description-state.js

@@ -9,7 +9,7 @@
  */
 import path from "node:path";
 import { isMissingFileFailure } from "./health-detail.js";
-import { readJsonFile, writeJsonFile } from "./local-state-files.js";
+import { readJsonFile, writeJsonFileAtomic } from "./local-state-files.js";
 export const IMAGE_DESCRIPTION_STATE_FILENAME = "image-descriptions.json";
 /** Oldest keys leave first past this many (about 5 MB on disk). */
 export const IMAGE_DESCRIPTION_STATE_MAX_KEYS = 150_000;
@@ -76,7 +76,7 @@ export async function writeImageDescriptionState(stateDir, state) {
     const kept = keys.length > IMAGE_DESCRIPTION_STATE_MAX_KEYS ? keys.slice(keys.length - IMAGE_DESCRIPTION_STATE_MAX_KEYS) : keys;
     const failedEntries = Object.entries(state.failed).sort((a, b) => a[1].retry_after - b[1].retry_after);
     const failed = Object.fromEntries(failedEntries.slice(Math.max(0, failedEntries.length - IMAGE_FAILED_STATE_MAX_KEYS)));
-    await writeJsonFile(imageDescriptionStatePath(stateDir), {
+    await writeJsonFileAtomic(imageDescriptionStatePath(stateDir), {
         schema_version: "cockpit-image-descriptions.v1",
         described: kept,
         failed,