@bli-cockpit/cli 0.2.22 → 0.2.24

package/dist/autostart-self-heal.js

@@ -0,0 +1,55 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { autostartStatus, installAutostartAgent, } from "./autostart.js";
+export const AUTOSTART_REPAIR_THROTTLE_MARKER = ".last-autostart-repair";
+const AUTOSTART_REPAIR_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const DETAIL_MAX_CHARS = 300;
+export async function runAutostartSelfHeal(paths, options) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "win32")
+        return null;
+    if (options.repoRoots.length === 0)
+        return null;
+    const status = await autostartStatus({
+        homeDir: options.homeDir,
+        repoRoot: options.repoRoots[0],
+        repoRoots: options.repoRoots,
+        dashboardUrl: options.dashboardUrl,
+        exec: options.exec,
+        platform,
+    });
+    // Healthy is the steady state and stays silent; absent means the operator
+    // (or onboarding) owns the decision, not this tick.
+    if (status.status !== "not_loaded")
+        return null;
+    // Attempts are throttled like the self-update's (marker mtime, written for
+    // the attempt not the outcome) so a persistently failing repair cannot spawn
+    // a registration every 15 minutes. The status probe above still runs every
+    // tick — it is one schtasks query.
+    const now = options.now ?? new Date();
+    const marker = path.join(paths.state_dir, AUTOSTART_REPAIR_THROTTLE_MARKER);
+    const lastAttempt = await fs.stat(marker).catch(() => null);
+    if (lastAttempt &&
+        now.getTime() - lastAttempt.mtimeMs < AUTOSTART_REPAIR_MIN_INTERVAL_MS) {
+        return { status: "skipped", reason: "repair_throttled_recent_attempt" };
+    }
+    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
+    await fs.writeFile(marker, now.toISOString()).catch(() => undefined);
+    const problem = (status.message ?? "task not loaded").slice(0, DETAIL_MAX_CHARS);
+    const repaired = await installAutostartAgent({
+        homeDir: options.homeDir,
+        repoRoot: options.repoRoots[0],
+        repoRoots: options.repoRoots,
+        dashboardUrl: options.dashboardUrl,
+        exec: options.exec,
+        platform,
+    });
+    if (repaired.loaded) {
+        return { status: "ok", reason: "autostart_repaired", detail: problem };
+    }
+    return {
+        status: "fail",
+        reason: "autostart_repair_failed",
+        detail: (repaired.message ?? problem).slice(0, DETAIL_MAX_CHARS),
+    };
+}

package/dist/commands/local.js

@@ -22,6 +22,7 @@ import { runAttributedWorktreeSync, matchesLiveSyncWorktree, } from "./session-s
 import { COLLECTION_ROOT_REQUIRED, missingCollectionRootMessage, normalizeRootsDetailed, resolveOnboardingRoots, rootRejectionExplanation, } from "../onboarding-roots.js";
 import { rawEvidenceGcSummary, runRawEvidenceLocalGc, } from "../raw-evidence-gc.js";
 import { envWithNodeRuntimeOnPath, runScheduledSelfUpdate, } from "../scheduled-self-update.js";
+import { runAutostartSelfHeal, } from "../autostart-self-heal.js";
 import { enqueueInstallEventEntry, readPendingInstallEventEntries, recordInstallEventAttemptFailure, removeInstallEventEntry, } from "../spool/install-event-outbox.js";
 import { createCapturedExecRunner, createInteractiveExecRunner, } from "../process-runner.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
@@ -711,9 +712,16 @@ function sanitizeInstallErrorCode(value) {
         .slice(0, 120);
     return normalized || "unknown";
 }
+/**
+ * Posts pending install events. Also the collector's only per-tick listening
+ * post: the response carries the server-published `min_cli_version` floor
+ * (BLI-2678), so the last one observed is returned for the scheduled
+ * self-update step to act on. Every early-out returns null — no receipt, no
+ * floor.
+ */
 export async function reportInstallEventsBestEffort(options) {
     if (options.events.length === 0)
-        return;
+        return null;
     const paths = getCollectorRuntimePaths(options.homeDir);
     try {
         await enqueueInstallEventEntry(paths, {
@@ -744,17 +752,18 @@ export async function reportInstallEventsBestEffort(options) {
         if (options.json) {
             writeLine(options.io.stderr, "Install event outbox unavailable: local_write_failed");
         }
-        return;
+        return null;
     }
     const session = await readLocalCollectorSessionFile(paths).catch(() => null);
     if (!session ||
         session.session_state !== "valid" ||
         typeof session.device_token !== "string" ||
         !session.device_token) {
-        return;
+        return null;
     }
     const pending = (await readPendingInstallEventEntries(paths)).slice(0, 20);
     const failures = [];
+    let observedMinCliVersion = null;
     for (let offset = 0; offset < pending.length; offset += 5) {
         await Promise.all(pending.slice(offset, offset + 5).map(async (entry) => {
             const controller = new AbortController();
@@ -777,6 +786,13 @@ export async function reportInstallEventsBestEffort(options) {
                 if (!response.ok) {
                     throw new Error(`http_${response.status}`);
                 }
+                const receipt = (await response
+                    .json()
+                    .catch(() => null));
+                if (typeof receipt?.min_cli_version === "string" &&
+                    receipt.min_cli_version.trim()) {
+                    observedMinCliVersion = receipt.min_cli_version.trim();
+                }
                 await removeInstallEventEntry(paths, entry.outbox_id);
             }
             catch (error) {
@@ -795,6 +811,7 @@ export async function reportInstallEventsBestEffort(options) {
     if (options.json && failures.length > 0) {
         writeLine(options.io.stderr, `Install event telemetry queued for retry: ${[...new Set(failures)].join(",")}`);
     }
+    return observedMinCliVersion;
 }
 function classifyInstallTelemetryError(error) {
     if (error instanceof Error && error.name === "AbortError") {
@@ -2135,7 +2152,7 @@ async function runSync(command, io) {
     const paths = getCollectorRuntimePaths(command.homeDir);
     const config = await readLocalCollectorConfig(paths).catch(() => null);
     const dashboardUrl = command.dashboardUrl ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL;
-    await reportInstallEventsBestEffort({
+    const minCliVersionAtStart = await reportInstallEventsBestEffort({
         homeDir: command.homeDir,
         dashboardUrl,
         command: "sync",
@@ -2145,7 +2162,7 @@ async function runSync(command, io) {
     });
     try {
         const result = await runSyncWithHealthReceipt(command, io);
-        await reportInstallEventsBestEffort({
+        const minCliVersion = await reportInstallEventsBestEffort({
             homeDir: command.homeDir,
             dashboardUrl,
             command: "sync",
@@ -2155,11 +2172,12 @@ async function runSync(command, io) {
         });
         // BLI-2601: self-update runs only after collection's own outcome above is
         // already decided and reported, win or lose. See the function doc.
-        await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl);
+        await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersion ?? minCliVersionAtStart);
+        await runAutostartSelfHealAfterSync(command, io, dashboardUrl);
         return result.exitCode;
     }
     catch (error) {
-        await reportInstallEventsBestEffort({
+        const minCliVersion = await reportInstallEventsBestEffort({
             homeDir: command.homeDir,
             dashboardUrl,
             command: "sync",
@@ -2174,10 +2192,60 @@ async function runSync(command, io) {
             json: command.json,
             io,
         });
-        await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl);
+        await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersion ?? minCliVersionAtStart);
+        await runAutostartSelfHealAfterSync(command, io, dashboardUrl);
         throw error;
     }
 }
+/**
+ * BLI-2721: after the tick's collection and self-update are done and
+ * reported, repair a broken/legacy autostart registration in place (Windows
+ * only — see autostart-self-heal.ts for why macOS is excluded). Every error
+ * path is swallowed like the self-update's: heal outcomes are their own
+ * receipts, never a sync failure.
+ */
+async function runAutostartSelfHealAfterSync(command, io, dashboardUrl) {
+    let result;
+    try {
+        const rawExec = io.exec;
+        if (!rawExec)
+            return;
+        const spawnEnv = envWithNodeRuntimeOnPath(io.env ?? process.env);
+        const exec = (cmd, args, options) => rawExec(cmd, args, { ...options, env: options?.env ?? spawnEnv });
+        result = await runAutostartSelfHeal(getCollectorRuntimePaths(command.homeDir), {
+            homeDir: command.homeDir,
+            repoRoots: await resolveAutostartRoots(command.homeDir, undefined),
+            dashboardUrl: command.dashboardUrl,
+            exec,
+        });
+    }
+    catch (error) {
+        result = {
+            status: "fail",
+            reason: "autostart_self_heal_threw",
+            detail: redactedSyncErrorDetail(error),
+        };
+    }
+    // Steady state (healthy, absent, non-Windows, no roots) and the daily
+    // throttle are silent; an actual repair attempt reports either way.
+    if (!result || result.reason === "repair_throttled_recent_attempt")
+        return;
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        command: "sync",
+        events: [
+            {
+                step: "autostart_repair",
+                status: result.status,
+                ...(result.status === "ok" ? {} : { error_code: result.reason }),
+                ...(result.detail ? { error_detail: result.detail } : {}),
+            },
+        ],
+        json: command.json,
+        io,
+    });
+}
 /**
  * BLI-2601: the fleet keeps itself current on npm `latest` without anyone
  * re-running `npm i -g @bli-cockpit/cli` by hand after day 0. This always
@@ -2188,10 +2256,10 @@ async function runSync(command, io) {
  * reported as its own named `update` receipt, never surfaced as a `sync`
  * failure or thrown from this function.
  */
-async function runScheduledSelfUpdateAfterSync(command, io, dashboardUrl) {
+async function runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersion) {
     let event;
     try {
-        event = await runScheduledSelfUpdateForSync(command, io);
+        event = await runScheduledSelfUpdateForSync(command, io, minCliVersion);
     }
     catch (error) {
         // The throttle/probe/install machinery below is defensive already; this
@@ -2215,7 +2283,7 @@ async function runScheduledSelfUpdateAfterSync(command, io, dashboardUrl) {
         io,
     });
 }
-async function runScheduledSelfUpdateForSync(command, io) {
+async function runScheduledSelfUpdateForSync(command, io, minCliVersion) {
     const rawExec = io.exec;
     if (!rawExec) {
         // Only the real production `defaultIo()` supplies a process runner. A
@@ -2235,7 +2303,7 @@ async function runScheduledSelfUpdateForSync(command, io) {
         exec,
         currentVersion: LOCAL_COLLECTOR_VERSION,
         install: (tag) => attemptScheduledSelfUpdateInstall(scheduledIo, tag),
-    }, { env: io.env });
+    }, { env: io.env, minVersion: minCliVersion });
     return scheduledSelfUpdateInstallEvent(result);
 }
 async function attemptScheduledSelfUpdateInstall(io, tag) {
@@ -2260,9 +2328,21 @@ function scheduledSelfUpdateInstallEvent(result) {
     // produces a receipt.
     if (result.reason === "throttled_recent_attempt")
         return null;
-    if (result.status === "ok")
-        return { step: "update", status: "ok" };
+    // A forced attempt names its trigger in the receipt either way, so the
+    // ledger can tell "converged on the daily cadence" from "the floor pulled
+    // this machine forward" (BLI-2678).
+    const forcedDetail = result.forced && result.min_version
+        ? `forced_min_version ${result.min_version}`
+        : null;
+    if (result.status === "ok") {
+        return {
+            step: "update",
+            status: "ok",
+            ...(forcedDetail ? { error_detail: forcedDetail } : {}),
+        };
+    }
     const detail = [
+        forcedDetail,
         result.target_version ? `target ${result.target_version}` : null,
         result.installed_version ? `installed ${result.installed_version}` : null,
     ]

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.22");
+    writeLine(io?.stdout ?? process.stdout, "0.2.24");
     return 0;
   }
 

package/dist/scheduled-self-update.js

@@ -37,9 +37,22 @@ export async function runScheduledSelfUpdate(paths, deps, options = {}) {
     const env = options.env ?? process.env;
     const now = options.now ?? new Date();
     const tag = options.tag ?? "latest";
+    // BLI-2678: the fleet forced-update floor. When the server says the minimum
+    // is above what this process is running, the daily throttle stops applying —
+    // the whole point of the floor is converging faster than once a day. This is
+    // NOT remote code execution: being below the floor only makes the exact
+    // same npm self-update that runs daily anyway run now. An unparseable floor
+    // is ignored rather than obeyed — a typo must fail toward the safe default.
+    const minVersion = parseSemverTriple(options.minVersion ?? null)
+        ? options.minVersion.trim()
+        : null;
+    const forced = minVersion !== null && isSemverBelow(deps.currentVersion, minVersion);
+    const forcedFields = forced ? { forced: true, min_version: minVersion } : {};
     const marker = path.join(paths.state_dir, SELF_UPDATE_THROTTLE_MARKER);
     const lastCheck = await fs.stat(marker).catch(() => null);
-    if (lastCheck && now.getTime() - lastCheck.mtimeMs < SELF_UPDATE_MIN_INTERVAL_MS) {
+    if (!forced &&
+        lastCheck &&
+        now.getTime() - lastCheck.mtimeMs < SELF_UPDATE_MIN_INTERVAL_MS) {
         // The steady-state case: already checked today, nothing to do. Not
         // reported as an "attempt" by the caller — this fires on ~95 of every 96
         // ticks and would otherwise be pure noise.
@@ -56,11 +69,33 @@ export async function runScheduledSelfUpdate(paths, deps, options = {}) {
     // disabled machine reports itself at most once per day too, instead of on
     // every tick.
     if (env["COCKPIT_DISABLE_AUTO_UPDATE"] === "1") {
-        return { status: "skipped", reason: "disabled_by_env" };
+        // The incident-triage freeze outranks the forced floor: a human pinned
+        // this machine on purpose, and the server must not be able to unpin it.
+        return { status: "skipped", reason: "disabled_by_env", ...forcedFields };
     }
     const targetVersion = await latestCliVersionFromNpm(deps.exec, tag);
+    if (forced &&
+        targetVersion &&
+        isSemverBelow(targetVersion, minVersion)) {
+        // The floor is above what npm actually serves — a typo'd floor, or one set
+        // before the release finished publishing. Installing would not clear the
+        // floor, so every forced tick would run `npm install` forever. Skip loudly
+        // instead: this reason posts a receipt on every tick until the floor is
+        // corrected, which is exactly the alarm a misconfig should raise.
+        return {
+            status: "skipped",
+            reason: "min_version_above_npm_latest",
+            target_version: targetVersion,
+            ...forcedFields,
+        };
+    }
     if (targetVersion && targetVersion === deps.currentVersion) {
-        return { status: "ok", reason: "already_latest", target_version: targetVersion };
+        return {
+            status: "ok",
+            reason: "already_latest",
+            target_version: targetVersion,
+            ...forcedFields,
+        };
     }
     const installed = await deps.install(tag);
     if (!installed.ok) {
@@ -68,6 +103,7 @@ export async function runScheduledSelfUpdate(paths, deps, options = {}) {
             status: "fail",
             reason: installed.eacces ? "eacces_needs_chown" : "npm_install_failed",
             ...(targetVersion ? { target_version: targetVersion } : {}),
+            ...forcedFields,
         };
     }
     // Verify against what the platform returns, not the exit code npm handed
@@ -82,6 +118,7 @@ export async function runScheduledSelfUpdate(paths, deps, options = {}) {
             reason: "stale_after_self_update",
             ...(targetVersion ? { target_version: targetVersion } : {}),
             ...(installedVersion ? { installed_version: installedVersion } : {}),
+            ...forcedFields,
         };
     }
     return {
@@ -89,8 +126,37 @@ export async function runScheduledSelfUpdate(paths, deps, options = {}) {
         reason: "updated",
         target_version: targetVersion ?? installedVersion,
         installed_version: installedVersion,
+        ...forcedFields,
     };
 }
+/**
+ * Ordering comparison for the forced-update floor. Mirrors the dashboard's
+ * parseSemver/compareParsedSemver (apps/dashboard/src/lib/ambient/rollups.ts)
+ * rather than adding a `semver` dependency for two ten-line functions. A
+ * version either side fails to parse → false: an unreadable floor or version
+ * must never force anything.
+ */
+function parseSemverTriple(value) {
+    if (typeof value !== "string")
+        return null;
+    const match = value.trim().match(/^(\d+)\.(\d+)\.(\d+)/u);
+    if (!match)
+        return null;
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function isSemverBelow(left, right) {
+    const parsedLeft = parseSemverTriple(left);
+    const parsedRight = parseSemverTriple(right);
+    if (!parsedLeft || !parsedRight)
+        return false;
+    for (let part = 0; part < 3; part += 1) {
+        if ((parsedLeft[part] ?? 0) < (parsedRight[part] ?? 0))
+            return true;
+        if ((parsedLeft[part] ?? 0) > (parsedRight[part] ?? 0))
+            return false;
+    }
+    return false;
+}
 async function latestCliVersionFromNpm(exec, tag) {
     const result = await exec("npm", [
         "view",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.22",
+  "version": "0.2.24",
   "private": false,
   "type": "module",
   "bin": {