@bli-cockpit/cli 0.2.208 → 0.2.211

package/dist/image-mode-state.js

@@ -0,0 +1,154 @@
+/**
+ * This machine's image-handling mode, as Tower last told it (BLI-17273).
+ *
+ * The fleet default is `IMAGE_HANDLING_MODE` (keep). Tower can set a different mode for ONE machine
+ * (`collector_image_mode:<device_id>` in `system_settings`); the answer rides the reply to the
+ * sync-start receipt (`image_handling_mode`). The tick records what it heard here, in one small file in
+ * the collector state directory, and every later reader (the uploader, `cockpit sources check`)
+ * reads the file. The mode for a tick is therefore:
+ *
+ *   the reply's value, when this tick got one   (it is written to the file first, so the file IS it)
+ *   else the last value on file                  (an offline tick must not flip a slim machine back
+ *                                                 to keep: each flip re-uploads every live-window
+ *                                                 transcript as a new object)
+ *   else `IMAGE_HANDLING_MODE`
+ *
+ * The file also remembers, sticky, that this machine EVER ran slim (`drop_seen_at`). A machine put
+ * back on keep still holds slim server copies of the files it uploaded while slim, and
+ * `cockpit sources check` must go on treating those as "keep your local file".
+ *
+ * Holds the mode and two timestamps. Never an id, a path or a byte.
+ */
+import path from "node:path";
+import { IMAGE_HANDLING_MODE } from "@bli-cockpit/telemetry-core";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
+import { readJsonFile, writeJsonFileAtomic } from "./local-state-files.js";
+export const IMAGE_MODE_STATE_FILENAME = "image-handling-mode.json";
+const TAG = "[image-mode]";
+export function isImageHandlingMode(value) {
+    return value === "describe_and_keep" || value === "describe_and_drop";
+}
+export function imageModeStatePath(stateDir) {
+    return path.join(stateDir, IMAGE_MODE_STATE_FILENAME);
+}
+/**
+ * Stands in for `drop_seen_at` when the file was there but could not be read, so whether this machine
+ * ever ran slim is unknown. It counts as "ran slim": the wrong guess costs a kept local file, the
+ * other wrong guess lets `cockpit sources check` call a slim server copy safe to delete.
+ */
+export const DROP_SEEN_UNKNOWN = "unknown_state_unreadable";
+async function readImageModeFile(stateDir) {
+    let raw;
+    try {
+        raw = await readJsonFile(imageModeStatePath(stateDir));
+    }
+    catch (error) {
+        if (isMissingFileFailure(error))
+            return { state: null, damaged: false, recoveredDropSeenAt: null };
+        console.error(TAG + " cache unreadable, using the fleet default and treating this machine as ever-slim", JSON.stringify({ reason: "image_mode_cache_unreadable", ...describeError(error) }));
+        return { state: null, damaged: true, recoveredDropSeenAt: null };
+    }
+    const record = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+    if (!record) {
+        console.error(TAG + " cache is not an object, using the fleet default and treating this machine as ever-slim", JSON.stringify({ reason: "image_mode_cache_shape_invalid" }));
+        return { state: null, damaged: true, recoveredDropSeenAt: null };
+    }
+    const dropSeenAt = typeof record.drop_seen_at === "string" ? record.drop_seen_at : null;
+    if (!isImageHandlingMode(record.mode)) {
+        console.error(TAG + " cached mode not recognised, using the fleet default and treating this machine as ever-slim", JSON.stringify({ reason: "image_mode_cache_value_invalid" }));
+        return { state: null, damaged: true, recoveredDropSeenAt: dropSeenAt };
+    }
+    return {
+        state: {
+            mode: record.mode,
+            observed_at: typeof record.observed_at === "string" ? record.observed_at : "",
+            drop_seen_at: dropSeenAt,
+        },
+        damaged: false,
+        recoveredDropSeenAt: null,
+    };
+}
+/** The file's content, or null when there is none or it cannot be trusted (said out loud when unreadable). */
+export async function readImageModeState(stateDir) {
+    return (await readImageModeFile(stateDir)).state;
+}
+/**
+ * What a reader of the file should use right now: the cached mode, else (damaged file) slim when a
+ * `drop_seen_at` could be recovered from it, else the fleet default. `slimAware` is true when this
+ * machine runs slim OR has ever run slim. `read` is a read the caller already did this tick, so a
+ * damaged file is read and logged once.
+ */
+export async function resolveImageHandlingMode(stateDir, read) {
+    const { state, damaged, recoveredDropSeenAt } = read ?? (await readImageModeFile(stateDir));
+    // A damaged file that still named when this machine first ran slim: it ran slim, keep it slim
+    // (flipping to keep would re-upload every live-window transcript as a new whole object).
+    const mode = state?.mode ?? (damaged && recoveredDropSeenAt !== null ? "describe_and_drop" : IMAGE_HANDLING_MODE);
+    return {
+        mode,
+        source: state ? "cache" : damaged ? "damaged_cache" : "default",
+        // A file that is there but unreadable is "ever slim, unknown": fail closed (BLI-17273).
+        slimAware: mode === "describe_and_drop" || state?.drop_seen_at != null || damaged,
+        state,
+    };
+}
+/**
+ * Put what the reply said on file. An unknown value is ignored with a log (the old value stays);
+ * a write failure is logged and the previous file stays in force. Returns true only when the file
+ * now holds the observed mode.
+ */
+export async function recordObservedImageMode(stateDir, observed, now = () => new Date(), read) {
+    if (observed === undefined || observed === null)
+        return false;
+    if (!isImageHandlingMode(observed)) {
+        console.error(TAG + " reply carried a mode this collector does not know, ignored", JSON.stringify({ reason: "image_mode_reply_value_unknown", value_type: typeof observed }));
+        return false;
+    }
+    const { state: previous, damaged, recoveredDropSeenAt } = read ?? (await readImageModeFile(stateDir));
+    const stamp = now().toISOString();
+    const next = {
+        mode: observed,
+        observed_at: stamp,
+        // Never rebuild "never ran slim" over a file we could not read: keep what parsed, else the unknown marker.
+        drop_seen_at: previous?.drop_seen_at ?? (damaged ? (recoveredDropSeenAt ?? DROP_SEEN_UNKNOWN) : observed === "describe_and_drop" ? stamp : null),
+    };
+    if (damaged) {
+        console.error(TAG + " rewriting a damaged mode file; ever-slim history kept", JSON.stringify({ reason: "image_mode_cache_damaged_rewritten", drop_seen_recovered: recoveredDropSeenAt !== null }));
+    }
+    try {
+        await writeJsonFileAtomic(imageModeStatePath(stateDir), { schema_version: "cockpit-image-handling-mode.v1", ...next });
+    }
+    catch (error) {
+        console.error(TAG + " could not cache the mode Tower sent; the previous value stays in force", JSON.stringify({ reason: "image_mode_cache_write_failed", mode: observed, ...describeError(error) }));
+        return false;
+    }
+    if (previous?.mode !== observed) {
+        console.error(TAG + " mode for this machine changed", JSON.stringify({ reason: "image_mode_changed", from: previous?.mode ?? (damaged ? "damaged" : "none"), to: observed }));
+    }
+    return true;
+}
+/**
+ * The tick's decision, logged once: where the mode came from and what it is. Called right after the
+ * sync-start receipt. `observed` is the reply's value (undefined when no reply arrived).
+ */
+export async function settleTickImageMode(stateDir, observed, now) {
+    // One read per tick: a damaged file is logged once, and the 'changed' line can say from:'damaged'.
+    const read = await readImageModeFile(stateDir);
+    const wrote = await recordObservedImageMode(stateDir, observed, now, read);
+    // After a write the file is whole again, so read it fresh; otherwise the tick's own read stands.
+    const resolved = wrote ? await resolveImageHandlingMode(stateDir) : await resolveImageHandlingMode(stateDir, read);
+    const source = wrote ? "reply" : resolved.source;
+    console.error(TAG + " mode for this tick", JSON.stringify({ reason: `image_mode_from_${source}`, source, mode: resolved.mode }));
+    return { mode: resolved.mode, source };
+}
+/**
+ * `settleTickImageMode` for the sync tick, which it must never fail: a throw is logged and the
+ * uploader falls back to the file or the fleet default.
+ */
+export async function settleTickImageModeBestEffort(stateDir, observed) {
+    try {
+        await settleTickImageMode(stateDir, observed);
+    }
+    catch (error) {
+        console.error(TAG + " could not settle the mode for this tick; the uploader reads the file or the fleet default", JSON.stringify({ reason: "image_mode_settle_failed", error_name: error instanceof Error ? error.name : typeof error }));
+    }
+}

package/dist/local-state-files.js

@@ -47,6 +47,26 @@ export async function writeJsonFile(filePath, value) {
         await fs.chmod(filePath, 0o600).catch(() => undefined);
     }
 }
+/**
+ * Same file, same owner-only mode, but written to a sibling temp file and renamed over the target, so
+ * a reader (or a crash) never sees a half-written file (BLI-17273: a torn image-mode file made a slim
+ * machine forget it had ever run slim). The temp file is removed when the write or the rename fails.
+ */
+export async function writeJsonFileAtomic(filePath, value) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    const temp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 10)}.tmp`;
+    try {
+        await fs.writeFile(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        if (process.platform !== "win32") {
+            await fs.chmod(temp, 0o600).catch(() => undefined);
+        }
+        await fs.rename(temp, filePath);
+    }
+    catch (error) {
+        await fs.rm(temp, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
 /**
  * Separate from `isMissingFileFailure`: the two callers here hold a raw `fs`
  * rejection rather than a wrapped failure, and "the file was never there" is

package/dist/local-state-work-context.js

@@ -64,7 +64,9 @@ async function writeLocalWorkContext(options, attributedIdentity) {
         existingContext,
     });
     await writeJsonFile(workContextFile(paths, identity.worktree_fingerprint), context);
-    await writeJsonFile(paths.active_work_context_file, context);
+    if (!options.leaveActiveContext) {
+        await writeJsonFile(paths.active_work_context_file, context);
+    }
     return context;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.208",
+  "version": "0.2.211",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.63",
-    "@bli-cockpit/mcp": "0.1.118",
-    "@bli-cockpit/telemetry-core": "0.1.72"
+    "@bli-cockpit/memory-mcp": "0.1.65",
+    "@bli-cockpit/mcp": "0.1.120",
+    "@bli-cockpit/telemetry-core": "0.1.74"
   },
   "repository": {
     "type": "git",