@bli-cockpit/cli 0.2.222 → 0.2.224

package/dist/agent-plugins-converge.js

@@ -0,0 +1,182 @@
+/**
+ * Runs the host commands that put the company plugin on a machine (BLI-18200),
+ * and remembers what happened so the 15-minute tick never hammers a failure.
+ *
+ *   Claude Code  claude plugin marketplace add BLI-INC/bli-agents-marketplace
+ *                claude plugin install engineering-standards@bli-agents
+ *                daily: claude plugin marketplace update bli-agents
+ *                       claude plugin update engineering-standards@bli-agents
+ *   Codex        codex plugin marketplace add BLI-INC/bli-agents-marketplace
+ *                codex plugin add engineering-standards@bli-agents
+ *                daily: codex plugin marketplace upgrade bli-agents
+ *
+ * The marketplace follows the repository default branch (no ref is passed).
+ * These are the host programs the machine already runs (agent-setup.ts spawns
+ * them for `--version` the same way), never a person's own program, so this does
+ * not belong in `commands/editor.ts`.
+ *
+ * Never throws and never blocks: a missing program, a private-repo sign-in gap,
+ * a dead network or a program too old for `plugin` is a named reason in the
+ * returned outcome, the log and `agent-plugins.json`. The tick retries a failed
+ * host only after six hours; a person running `cockpit doctor` always retries.
+ * Logs carry reason labels, exit codes and timings only, never command output.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { AGENT_PLUGIN_ID, AGENT_PLUGIN_MARKETPLACE, AGENT_PLUGIN_SOURCE, PLUGIN_HOSTS, classifyPluginFailure, inspectAgentPlugins, locateHostBinary, } from "./agent-plugins.js";
+import { envWithNodeRuntimeOnPath } from "./scheduled-self-update.js";
+export const AGENT_PLUGINS_STATE_FILE = "agent-plugins.json";
+export const PLUGIN_RETRY_AFTER_FAILURE_MS = 6 * 60 * 60 * 1000;
+export const PLUGIN_REFRESH_EVERY_MS = 24 * 60 * 60 * 1000;
+/** A first marketplace clone is small; anything slower is a stuck prompt or a dead link. */
+export const PLUGIN_COMMAND_TIMEOUT_MS = 120_000;
+export async function readPluginState(stateDir) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(path.join(stateDir, AGENT_PLUGINS_STATE_FILE), "utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+async function writePluginState(stateDir, state) {
+    try {
+        await fs.mkdir(stateDir, { recursive: true });
+        await fs.writeFile(path.join(stateDir, AGENT_PLUGINS_STATE_FILE), JSON.stringify(state), { mode: 0o600 });
+    }
+    catch (error) {
+        console.error("[agent-plugins] state not saved", JSON.stringify({ reason: "state_write_failed", error_code: error.code ?? null }));
+    }
+}
+const msSince = (iso, now) => {
+    const at = iso ? Date.parse(iso) : Number.NaN;
+    return Number.isFinite(at) ? now.getTime() - at : Number.POSITIVE_INFINITY;
+};
+function spawnEnv(options) {
+    const env = envWithNodeRuntimeOnPath({ ...(options.env ?? process.env) }, options.nodeExecutable);
+    return {
+        ...env,
+        // git must fail, not ask: a prompt on a scheduled tick hangs until the timeout.
+        GIT_TERMINAL_PROMPT: "0",
+        GCM_INTERACTIVE: "never",
+        ...(options.unattended && !env["GIT_SSH_COMMAND"] ? { GIT_SSH_COMMAND: "ssh -o BatchMode=yes" } : {}),
+    };
+}
+function stepsFor(host, reading, refresh) {
+    const steps = [];
+    if (!reading.marketplace)
+        steps.push({ name: "marketplace_add", args: ["plugin", "marketplace", "add", AGENT_PLUGIN_SOURCE] });
+    if (!reading.installed)
+        steps.push({ name: "plugin_install", args: host === "claude" ? ["plugin", "install", AGENT_PLUGIN_ID] : ["plugin", "add", AGENT_PLUGIN_ID] });
+    if (reading.installed && refresh) {
+        steps.push(host === "claude"
+            ? { name: "marketplace_update", args: ["plugin", "marketplace", "update", AGENT_PLUGIN_MARKETPLACE] }
+            : { name: "marketplace_update", args: ["plugin", "marketplace", "upgrade", AGENT_PLUGIN_MARKETPLACE] });
+        if (host === "claude")
+            steps.push({ name: "plugin_update", args: ["plugin", "update", AGENT_PLUGIN_ID] });
+    }
+    return steps;
+}
+export async function convergeAgentPlugins(options) {
+    const now = options.now ?? new Date();
+    const state = await readPluginState(options.stateDir);
+    const before = JSON.stringify(state);
+    const outcomes = [];
+    let readings;
+    try {
+        readings = await inspectAgentPlugins(options.homeDir, options);
+    }
+    catch (error) {
+        console.error("[agent-plugins] host state unreadable", JSON.stringify({ reason: "inspect_threw", error_name: error instanceof Error ? error.name : typeof error }));
+        return PLUGIN_HOSTS.map((host) => ({ host, status: "failed", reason: "command_failed", quiet: false }));
+    }
+    for (const host of PLUGIN_HOSTS) {
+        const reading = readings.find((entry) => entry.host === host);
+        const entry = { ...state[host] };
+        const outcome = await convergeHost(host, reading, entry, options, now).catch((error) => {
+            console.error("[agent-plugins] host step threw", JSON.stringify({ reason: "unexpected_error", host, error_name: error instanceof Error ? error.name : typeof error }));
+            return { host, status: "failed", reason: "command_failed", quiet: false };
+        });
+        if (Object.keys(entry).length > 0)
+            state[host] = entry;
+        else
+            delete state[host];
+        outcomes.push(outcome);
+    }
+    if (JSON.stringify(state) !== before)
+        await writePluginState(options.stateDir, state);
+    return outcomes;
+}
+async function convergeHost(host, reading, entry, options, now) {
+    if (!reading.present)
+        return { host, status: "skipped", reason: "host_not_present", quiet: true };
+    if (reading.installed) {
+        // Installed by us or by hand: a failure remembered from before is spent.
+        delete entry.last_reason;
+        const due = options.refresh && msSince(entry.last_refresh_at, now) >= PLUGIN_REFRESH_EVERY_MS;
+        if (!due)
+            return { host, status: "already_installed", reason: "installed", quiet: true };
+        return refreshHost(host, reading, entry, options, now);
+    }
+    if (options.unattended && entry.last_reason !== undefined && msSince(entry.last_attempt_at, now) < PLUGIN_RETRY_AFTER_FAILURE_MS) {
+        console.error("[agent-plugins] retry waits; the last attempt failed under six hours ago", JSON.stringify({ reason: "retry_throttled", host, last_reason: entry.last_reason }));
+        return { host, status: entry.last_reason === "binary_missing" ? "skipped" : "failed", reason: entry.last_reason, quiet: true };
+    }
+    return installHost(host, reading, entry, options, now);
+}
+async function runSteps(host, binary, steps, options) {
+    const env = spawnEnv(options);
+    for (const step of steps) {
+        const started = Date.now();
+        // The runner contract never rejects; a runner that does is still just a failed command.
+        const result = await options.exec(binary, step.args, { env, timeoutMs: options.timeoutMs ?? PLUGIN_COMMAND_TIMEOUT_MS })
+            .catch(() => ({ code: 1, stdout: "", stderr: "" }));
+        const elapsed_ms = Date.now() - started;
+        if (result.code !== 0) {
+            const reason = classifyPluginFailure(result);
+            console.error("[agent-plugins] host command failed", JSON.stringify({ reason, host, step: step.name, exit_code: result.code, elapsed_ms }));
+            return reason;
+        }
+        console.error("[agent-plugins] host command ran", JSON.stringify({ reason: "step_ok", host, step: step.name, exit_code: 0, elapsed_ms }));
+    }
+    return null;
+}
+async function installHost(host, reading, entry, options, now) {
+    entry.last_attempt_at = now.toISOString();
+    const binary = await locateHostBinary(host, options.homeDir, options);
+    if (!binary) {
+        entry.last_reason = "binary_missing";
+        console.error("[agent-plugins] host program not found", JSON.stringify({ reason: "binary_missing", host }));
+        return { host, status: "skipped", reason: "binary_missing", quiet: false };
+    }
+    const failure = await runSteps(host, binary, stepsFor(host, reading, false), options);
+    if (failure) {
+        entry.last_reason = failure;
+        return { host, status: "failed", reason: failure, quiet: false };
+    }
+    // Verify against what the host recorded, not against the exit code we got.
+    const after = (await inspectAgentPlugins(options.homeDir, options)).find((candidate) => candidate.host === host);
+    if (!after?.installed) {
+        entry.last_reason = "install_not_recorded";
+        console.error("[agent-plugins] install ran but the host did not record it", JSON.stringify({ reason: "install_not_recorded", host }));
+        return { host, status: "failed", reason: "install_not_recorded", quiet: false };
+    }
+    delete entry.last_reason;
+    entry.last_refresh_at = now.toISOString();
+    console.error("[agent-plugins] plugin installed", JSON.stringify({ reason: "installed", host }));
+    return { host, status: "installed", reason: "installed", quiet: false };
+}
+/** The daily refresh. A failure here never un-installs anything; the next try is tomorrow's. */
+async function refreshHost(host, reading, entry, options, now) {
+    entry.last_refresh_at = now.toISOString();
+    const binary = await locateHostBinary(host, options.homeDir, options);
+    if (!binary) {
+        console.error("[agent-plugins] host program not found for the daily refresh", JSON.stringify({ reason: "binary_missing", host }));
+        return { host, status: "already_installed", reason: "refresh_skipped_binary_missing", quiet: true };
+    }
+    const failure = await runSteps(host, binary, stepsFor(host, reading, true), options);
+    if (failure)
+        return { host, status: "already_installed", reason: `refresh_failed_${failure}`, quiet: false };
+    console.error("[agent-plugins] plugin refreshed", JSON.stringify({ reason: "refreshed", host }));
+    return { host, status: "refreshed", reason: "refreshed", quiet: false };
+}

package/dist/agent-plugins.js

@@ -0,0 +1,116 @@
+/**
+ * The company `engineering-standards` plugin on an agent machine (BLI-18200).
+ *
+ * Every intern machine should carry the plugin from the private marketplace
+ * `BLI-INC/bli-agents-marketplace` in BOTH Claude Code and Codex. This module is
+ * the reading half: what the two hosts' own state files say, where each host's
+ * program lives, and how a failed host command is named. It spawns nothing;
+ * `agent-plugins-converge.ts` runs the commands, `commands/doctor-agent-plugins.ts`
+ * is the doctor row, `commands/sync-heal-agent-plugins.ts` is the 15-minute tick.
+ *
+ * Reads only the hosts' own files, rooted at the person's home, so the same code
+ * answers on macOS and native Windows:
+ *   Claude Code  ~/.claude/plugins/known_marketplaces.json  (marketplace added)
+ *                ~/.claude/plugins/installed_plugins.json   (plugin installed)
+ *   Codex        ~/.codex/config.toml  [marketplaces.bli-agents] / [plugins."<id>"]
+ *
+ * A host counts as PRESENT when its config directory exists (`~/.claude`,
+ * `~/.codex`). That is a file read, so a doctor check never spawns a program, and
+ * a machine whose agent was never started has nothing to install into yet.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+export const AGENT_PLUGIN_SOURCE = "BLI-INC/bli-agents-marketplace";
+export const AGENT_PLUGIN_MARKETPLACE = "bli-agents";
+export const AGENT_PLUGIN_NAME = "engineering-standards";
+export const AGENT_PLUGIN_ID = `${AGENT_PLUGIN_NAME}@${AGENT_PLUGIN_MARKETPLACE}`;
+export const PLUGIN_HOSTS = ["claude", "codex"];
+export const realPluginFiles = {
+    read: (file) => fs.readFile(file, "utf8").catch(() => null),
+    exists: (file) => fs.access(file).then(() => true, () => false),
+};
+const pathApi = (platform) => (platform === "win32" ? path.win32 : path.posix);
+function parseObject(text) {
+    if (text === null)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function inspectAgentPlugins(homeDir, runtime = {}) {
+    const platform = runtime.platform ?? process.platform;
+    const files = runtime.files ?? realPluginFiles;
+    const join = (...parts) => pathApi(platform).join(homeDir, ...parts);
+    const claudePresent = await files.exists(join(".claude"));
+    const marketplaces = parseObject(await files.read(join(".claude", "plugins", "known_marketplaces.json")));
+    const installedFile = parseObject(await files.read(join(".claude", "plugins", "installed_plugins.json")));
+    const installations = installedFile?.["plugins"]?.[AGENT_PLUGIN_ID];
+    const codexPresent = await files.exists(join(".codex"));
+    const toml = (await files.read(join(".codex", "config.toml"))) ?? "";
+    const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+    const marketplace = escapeRegExp(AGENT_PLUGIN_MARKETPLACE);
+    return [
+        {
+            host: "claude",
+            present: claudePresent,
+            marketplace: Boolean(marketplaces && Object.keys(marketplaces).includes(AGENT_PLUGIN_MARKETPLACE)),
+            // A plugin the person turned off by hand is still installed; it is not ours to switch back on.
+            installed: Array.isArray(installations) && installations.length > 0,
+        },
+        {
+            host: "codex",
+            present: codexPresent,
+            marketplace: new RegExp(`^\\s*\\[marketplaces\\.(?:"${marketplace}"|${marketplace})\\]\\s*$`, "mu").test(toml),
+            installed: new RegExp(`^\\s*\\[plugins\\."${escapeRegExp(AGENT_PLUGIN_ID)}"\\]\\s*$`, "mu").test(toml),
+        },
+    ];
+}
+/**
+ * Where a host's program lives, as an absolute path or null. A scheduled tick
+ * runs with a stripped PATH, so the person's PATH is tried first and then the
+ * places the host's installers use on each family. No exec: a file check.
+ */
+export async function locateHostBinary(host, homeDir, runtime = {}) {
+    const platform = runtime.platform ?? process.platform;
+    const files = runtime.files ?? realPluginFiles;
+    const api = pathApi(platform);
+    const env = runtime.env ?? process.env;
+    const windows = platform === "win32";
+    const fromPath = (env["PATH"] ?? env["Path"] ?? "").split(windows ? ";" : ":").filter(Boolean);
+    const known = windows
+        ? [api.join(homeDir, ".local", "bin"), api.join(homeDir, "AppData", "Roaming", "npm"), ...(host === "claude" ? [api.join(homeDir, ".claude", "local")] : [])]
+        : [api.join(homeDir, ".local", "bin"), api.join(homeDir, ".npm-global", "bin"), api.join(homeDir, ".bun", "bin"), "/opt/homebrew/bin", "/usr/local/bin", ...(host === "claude" ? [api.join(homeDir, ".claude", "local")] : [])];
+    const nodeDir = api.dirname(runtime.nodeExecutable ?? process.execPath);
+    const names = windows ? [`${host}.exe`, `${host}.cmd`] : [host];
+    for (const directory of [...new Set([...fromPath, ...known, nodeDir])]) {
+        for (const name of names) {
+            const candidate = api.join(directory, name);
+            if (await files.exists(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
+/**
+ * Names a failed host command from its exit code and output. The output is read
+ * for the label and then dropped: only the label ever leaves this function, so a
+ * git error that echoed a URL with a credential in it cannot reach a log.
+ */
+export function classifyPluginFailure(result) {
+    if (result.code === 124)
+        return "timed_out";
+    const text = `${result.stderr}\n${result.stdout}`.toLowerCase();
+    if (/unknown (sub)?command|unrecognized (sub)?command|unexpected argument|no such (sub)?command|invalid subcommand|unknown option/u.test(text))
+        return "cli_too_old";
+    if (/authentication failed|could not read (username|password)|permission denied \(publickey|repository not found|terminal prompts disabled|invalid username or password|bad credentials|not logged in|returned error: (401|403|404)|access denied|saml|single sign-on/u.test(text))
+        return "private_repo_auth";
+    if (/could not resolve host|network is unreachable|failed to connect|connection (timed out|refused|reset)|econn(reset|refused)|enotfound|etimedout|eai_again|temporary failure in name resolution|ssl|tls|early eof|remote end hung up/u.test(text))
+        return "network_unreachable";
+    if (/plugin .*(not found|does not exist)|not found in (any )?marketplace|no plugin named|marketplace .*not found/u.test(text))
+        return "plugin_not_in_marketplace";
+    return "command_failed";
+}

package/dist/autostart-darwin-plist.js

@@ -1,7 +1,7 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "./local-state.js";
+import { isDefaultDashboardUrl, getCollectorRuntimePaths } from "./local-state.js";
 import { savedDiscoveryLimitArgs } from "./discovery-limits.js";
 import { DARWIN_LOGIN_SHELL } from "./autostart-node-path.js";
 import { AUTOSTART_LABEL, fileExists, plistPathFor, resolveAutostartSettings, schedulerNodeExecutable, } from "./autostart-contract.js";
@@ -211,7 +211,7 @@ function watchPathsBlock(watchPaths) {
     ];
 }
 function renderDarwinSyncCommand(options) {
-    const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
+    const dashboardArg = isDefaultDashboardUrl(options.dashboardUrl)
         ? ""
         : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
     const discoveryArg = options.discoveryArgs.length > 0 ? ` ${options.discoveryArgs.join(" ")}` : "";

package/dist/autostart-windows-scripts.js

@@ -1,7 +1,7 @@
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "./local-state.js";
+import { isDefaultDashboardUrl, getCollectorRuntimePaths } from "./local-state.js";
 import { savedDiscoveryLimitArgs } from "./discovery-limits.js";
 import { fileExists, resolveAutostartSettings, schedulerNodeExecutable, WINDOWS_AUTOSTART_TASK_NAME, } from "./autostart-contract.js";
 /**
@@ -271,7 +271,7 @@ function renderWindowsLauncherScript(options) {
     ].join("\r\n");
 }
 function renderWindowsSyncScript(options) {
-    const dashboardArgs = options.dashboardUrl === DEFAULT_DASHBOARD_URL
+    const dashboardArgs = isDefaultDashboardUrl(options.dashboardUrl)
         ? ""
         : ` --dashboard-url ${powershellLiteral(options.dashboardUrl)}`;
     const discoveryArgs = options.discoveryArgs.length > 0 ? ` ${options.discoveryArgs.join(" ")}` : "";

package/dist/commands/doctor-access.js

@@ -4,7 +4,7 @@ import { scanWorkDirectories } from "./local-discovery.js";
 import { sendCollectorHeartbeatBestEffort } from "./heartbeat.js";
 import { isInteractiveDoctorFix } from "./doctor-report.js";
 import { describeError } from "../health-detail.js";
-import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, toSessionReference, } from "../local-state.js";
+import { isDefaultDashboardUrl, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, toSessionReference, } from "../local-state.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
 import { detectSecondCockpitInstall } from "../second-install.js";
 import { hardStop, needsFix, ok, skipped } from "./doctor-report.js";
@@ -140,7 +140,7 @@ export async function savedRoots(homeDir) {
 }
 function onboardOneLiner(command) {
     const workspace = command.repoRoot ?? "$PWD";
-    const dashboard = command.dashboardUrl === DEFAULT_DASHBOARD_URL
+    const dashboard = isDefaultDashboardUrl(command.dashboardUrl)
         ? ""
         : ` --dashboard-url ${shellQuote(command.dashboardUrl)}`;
     return `cockpit doctor --workspace ${shellQuote(workspace)}${dashboard}`;

package/dist/commands/doctor-agent-plugins.js

@@ -0,0 +1,82 @@
+/**
+ * The `agent-plugins` doctor row (BLI-18200): does this machine carry the
+ * company `engineering-standards` plugin in Claude Code and in Codex?
+ *
+ * The CHECK reads the two hosts' own files and the last attempt's remembered
+ * reason; it never starts a program, so `cockpit doctor --check` is free. The
+ * FIX runs the host commands through `agent-plugins-converge.ts` and answers by
+ * re-reading what the hosts recorded. A tick runs the fix too (the doctor the
+ * sync runs after collection), throttled to one retry per six hours; a person
+ * running `cockpit doctor` always retries.
+ *
+ * Never blocks anything else: a missing program is `skipped`, every other
+ * failure is a named reason on this row alone.
+ */
+import os from "node:os";
+import { AGENT_PLUGIN_NAME, AGENT_PLUGIN_SOURCE, inspectAgentPlugins, locateHostBinary, } from "../agent-plugins.js";
+import { convergeAgentPlugins, readPluginState } from "../agent-plugins-converge.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { needsFix, ok, skipped } from "./doctor-report.js";
+const ID = "agent-plugins";
+/** Worst first: the row names the reason a person can act on before the one that heals itself. */
+const REASON_PRIORITY = ["private_repo_auth", "cli_too_old", "plugin_not_in_marketplace", "install_not_recorded", "command_failed", "timed_out", "network_unreachable", "missing"];
+const SENTENCES = {
+    missing: { say: (hosts) => `the company ${AGENT_PLUGIN_NAME} plugin is not installed for ${hosts}; \`cockpit doctor\` installs it`, next: "cockpit doctor" },
+    private_repo_auth: {
+        say: (hosts) => `Tower could not read the company plugin repository ${AGENT_PLUGIN_SOURCE} for ${hosts}: GitHub sign-in or BLI-INC access is missing. Run \`gh auth login\` with your company account, then \`cockpit doctor\``,
+        next: "gh auth login",
+    },
+    cli_too_old: { say: (hosts) => `the installed ${hosts} program is too old to manage plugins; update it, then run \`cockpit doctor\``, next: "cockpit doctor" },
+    plugin_not_in_marketplace: { say: (hosts) => `the company marketplace did not offer ${AGENT_PLUGIN_NAME} for ${hosts}; ask in the engineering channel, then run \`cockpit doctor\``, next: "cockpit doctor" },
+    install_not_recorded: { say: (hosts) => `the install for ${hosts} ran but the program did not record it; run \`cockpit doctor\` again`, next: "cockpit doctor" },
+    command_failed: { say: (hosts) => `the plugin install for ${hosts} failed; run \`cockpit doctor\` to retry`, next: "cockpit doctor" },
+    timed_out: { say: (hosts) => `the plugin install for ${hosts} timed out; Tower retries on its own, or run \`cockpit doctor\``, next: "cockpit doctor" },
+    network_unreachable: { say: (hosts) => `the plugin install for ${hosts} could not reach GitHub; Tower retries on its own, or run \`cockpit doctor\``, next: "cockpit doctor" },
+};
+function homeOf(context) {
+    return context.command.homeDir ?? os.homedir();
+}
+/** `runtime` is for tests: a Windows layout, a fake file system. */
+export async function checkAgentPluginsState(context, runtime = {}) {
+    const homeDir = homeOf(context);
+    const present = (await inspectAgentPlugins(homeDir, runtime)).filter((reading) => reading.present);
+    if (present.length === 0) {
+        return skipped(ID, "no_agent_hosts", "neither Claude Code nor Codex is set up on this machine yet; Tower installs the company plugin once one is");
+    }
+    const missing = present.filter((reading) => !reading.installed);
+    if (missing.length === 0) {
+        return ok(ID, "installed", `the company ${AGENT_PLUGIN_NAME} plugin is installed for ${present.map((reading) => reading.host).join(", ")}`);
+    }
+    const remembered = await readPluginState(getCollectorRuntimePaths(context.command.homeDir).state_dir);
+    const reasons = new Map();
+    for (const reading of missing) {
+        const binary = await locateHostBinary(reading.host, homeDir, runtime);
+        reasons.set(reading.host, binary ? remembered[reading.host]?.last_reason ?? "missing" : "binary_missing");
+    }
+    // A remembered label this table does not know reads as a plain command failure.
+    const actionable = [...reasons].filter(([, reason]) => reason !== "binary_missing").map(([host, reason]) => ({ host, reason: REASON_PRIORITY.includes(reason) ? reason : "command_failed" }));
+    if (actionable.length === 0) {
+        return skipped(ID, "binary_missing", `${[...reasons.keys()].join(", ")} is set up but its program was not found; the plugin installs once it is`);
+    }
+    const code = REASON_PRIORITY.find((reason) => actionable.some((entry) => entry.reason === reason));
+    const hosts = actionable.filter((entry) => entry.reason === code).map((entry) => entry.host).join(" and ");
+    const sentence = SENTENCES[code];
+    return { ...needsFix(ID, code, sentence.say(hosts)), nextAction: sentence.next };
+}
+export async function fixAgentPluginsState(context, runtime = {}) {
+    const exec = context.io.exec;
+    if (!exec) {
+        console.error("[agent-plugins] no process runner on this io; the install could not be attempted", JSON.stringify({ reason: "runner_unavailable" }));
+        return needsFix(ID, "runner_unavailable", "this CLI has no process runner; reinstall it with `npm i -g @bli-cockpit/cli`, then run `cockpit doctor`");
+    }
+    const outcomes = await convergeAgentPlugins({
+        ...runtime,
+        homeDir: homeOf(context),
+        stateDir: getCollectorRuntimePaths(context.command.homeDir).state_dir,
+        exec,
+        unattended: Boolean(context.command.automaticTick),
+        refresh: false,
+    });
+    console.error("[agent-plugins] doctor repair done", JSON.stringify({ reason: "repair_done", outcomes: outcomes.map((outcome) => `${outcome.host}:${outcome.reason}`) }));
+    return checkAgentPluginsState(context, runtime);
+}

package/dist/commands/doctor-pipeline.js

@@ -5,7 +5,7 @@ import { retentionOptionsFromEnv } from "../disk-retention.js";
 import { readStagingGate, stagingGateLimitsFromEnv } from "../staging-gate.js";
 import { readDiskFootprint } from "../disk-usage.js";
 import { runEvidenceRedelivery } from "../evidence-redelivery.js";
-import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "../local-state.js";
+import { isDefaultDashboardUrl, getCollectorRuntimePaths } from "../local-state.js";
 import { runRawEvidenceLocalGc, rawEvidenceGcSummary } from "../raw-evidence-gc.js";
 import { FOOTPRINT_NEEDS_FIX_BYTES, stagingPausedWords, diskRowMessage, footprintHolder, footprintTotalBytes, mib, redeliveryLine, } from "./doctor-disk-words.js";
 import { doctorRoots } from "./doctor-access.js";
@@ -185,7 +185,7 @@ async function runSyncRepair(context) {
         const args = ["sync", "--json", "--workspace", repoRoot, ...discoveryArgs];
         if (context.command.homeDir)
             args.push("--home", context.command.homeDir);
-        if (context.command.dashboardUrl !== DEFAULT_DASHBOARD_URL) {
+        if (!isDefaultDashboardUrl(context.command.dashboardUrl)) {
             args.push("--dashboard-url", context.command.dashboardUrl);
         }
         // One line every 30 s while doctor's own sync runs; the exec has nothing

package/dist/commands/doctor-report.js

@@ -174,6 +174,7 @@ export function doctorNeedsPerson(rows, receipt) {
         "usage-telemetry": "cockpit doctor",
         "memory-registered": "cockpit doctor",
         "agent-rules": "cockpit doctor",
+        "agent-plugins": "cockpit doctor",
         "mcp-answers": "cockpit doctor",
         "memory-daemon": "cockpit doctor",
         "backfill-complete": "cockpit doctor",

package/dist/commands/doctor-update.js

@@ -1,5 +1,5 @@
 import { isSemverBelow } from "../scheduled-self-update.js";
-import { DEFAULT_DASHBOARD_URL, LOCAL_COLLECTOR_VERSION } from "../local-state.js";
+import { isDefaultDashboardUrl, LOCAL_COLLECTOR_VERSION } from "../local-state.js";
 import { createInteractiveExecRunner } from "../process-runner.js";
 import { asRecord, fail, needsFix, ok } from "./doctor-report.js";
 /**
@@ -89,7 +89,7 @@ export function reexecDoctor(command, io) {
         args.push("--max-repos", String(command.maxRepos));
     for (const root of command.collectionRoots ?? (command.repoRoot ? [command.repoRoot] : []))
         args.push("--workspace", root);
-    if (command.dashboardUrl !== DEFAULT_DASHBOARD_URL) {
+    if (!isDefaultDashboardUrl(command.dashboardUrl)) {
         args.push("--dashboard-url", command.dashboardUrl);
     }
     if (command.updateTag)

package/dist/commands/doctor.js

@@ -10,6 +10,7 @@ import { gateRow, readCollectionGate } from "./doctor-collection-lock.js";
 import { checkMcpAnswersState, fixMcpAnswersState } from "./doctor-mcp.js";
 import { budgetSpentRow, doctorRunDeadline, DOCTOR_JSON_BUDGET_SECONDS } from "./doctor-budget.js";
 import { checkMemoryDaemonState } from "./doctor-memory-daemon.js";
+import { checkAgentPluginsState, fixAgentPluginsState } from "./doctor-agent-plugins.js";
 import { checkDoctorAgentRules, fixDoctorAgentRules, checkAutostartState, checkMemoryState, fixAutostartState, fixMemoryState, } from "./doctor-registration.js";
 import { dryRunPreview, isInteractiveDoctorFix, maybeReportDoctorEvents, writeDoctorOutput, doctorNeedsPerson, finalizeDoctorRepairs, } from "./doctor-report.js";
 import { buildSetupReceipt, refreshSetupReceipt } from "./setup-receipt.js";
@@ -189,6 +190,9 @@ function doctorInvariants() {
         },
         { id: "usage-telemetry", check: context => context.deps.checkUsageTelemetry(context), fix: context => context.deps.fixUsageTelemetry(context) },
         { id: "agent-rules", check: (context) => context.deps.checkAgentRules(context), fix: (context) => context.deps.fixAgentRules(context) },
+        // BLI-18200. Right after the rules row: same family, what the two agent
+        // hosts carry. The check reads the hosts' files; only the fix starts their CLIs.
+        { id: "agent-plugins", check: (context) => context.deps.checkAgentPlugins(context), fix: (context) => context.deps.fixAgentPlugins(context) },
         // BLI-3804. Right after the registration row, because it asks the second
         // half of the same question: `memory-registered` proves the entry exists
         // and names a bin, this one proves the server behind it starts, speaks the
@@ -240,6 +244,8 @@ function defaultDoctorDeps(hooks) {
         onReceipt: hooks.onReceipt,
         checkAgentRules: checkDoctorAgentRules,
         fixAgentRules: fixDoctorAgentRules,
+        checkAgentPlugins: (context) => checkAgentPluginsState(context),
+        fixAgentPlugins: (context) => fixAgentPluginsState(context),
         latestCliVersion: latestCliVersionFromNpm,
         selfUpdate: hooks.selfUpdate,
         reexecDoctor: reexecDoctor,

package/dist/commands/local-auth.js

@@ -10,7 +10,7 @@
 import { execFile } from "node:child_process";
 import { errorMessage, isInteractiveStdin, readLine, writeLine, settleYesNo, } from "./cli-io.js";
 import { normalizeUrl } from "./local-args.js";
-import { getCollectorRuntimePaths, pairLocalCollector, readLocalCollectorSessionFile, readLocalSessionReference, } from "../local-state.js";
+import { getCollectorRuntimePaths, pairLocalCollector, readLocalCollectorSessionFile, sameDashboardUrl, readLocalSessionReference, } from "../local-state.js";
 const OTP_CODE_PROMPT = [
     "Email code needed:",
     "  Check your latest Tower email for a 6- to 10-digit code.",
@@ -254,8 +254,11 @@ export function canReuseOnboardSession(session, claimedOwnerEmail, dashboardUrl)
         return false;
     }
     const expectedDashboardUrl = normalizeUrlForComparison(dashboardUrl);
+    // The two production addresses are one deployment: a session paired on the
+    // old vercel.app address stays reusable against the new default.
+    const sessionDashboardUrl = normalizeUrlForComparison(session.dashboard_url);
     if (expectedDashboardUrl &&
-        normalizeUrlForComparison(session.dashboard_url) !== expectedDashboardUrl) {
+        !(sessionDashboardUrl && sameDashboardUrl(sessionDashboardUrl, expectedDashboardUrl))) {
         return false;
     }
     return true;

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.222");
+    writeLine(io?.stdout ?? process.stdout, "0.2.224");
     return 0;
   }
 

package/dist/commands/sync-heal-agent-plugins.js

@@ -0,0 +1,46 @@
+/**
+ * The tick's half of the company plugin install (BLI-18200). Doctor's
+ * `agent-plugins` row converges a machine when a person runs `cockpit doctor`;
+ * this puts the same plugin on a machine nobody is looking at, every 15 minutes
+ * and cheaply: a steady machine costs four file reads, a failed host waits six
+ * hours, and an installed plugin is refreshed once a day.
+ *
+ * It reports through the same install-event channel as the agent-rules heal
+ * (`agent_plugins_install`), once per real attempt, with reason labels only.
+ */
+import os from "node:os";
+import { convergeAgentPlugins } from "../agent-plugins-converge.js";
+export async function healAgentPlugins(command, io, paths, now) {
+    const exec = io.exec;
+    if (!exec) {
+        console.error("[sync-heal] agent plugins not checked; this io has no process runner", JSON.stringify({ reason: "runner_unavailable" }));
+        return null;
+    }
+    const outcomes = await convergeAgentPlugins({
+        homeDir: command.homeDir ?? os.homedir(),
+        stateDir: paths.state_dir,
+        exec,
+        unattended: true,
+        refresh: true,
+        now,
+    });
+    return eventFor(outcomes);
+}
+/** One event per real attempt; steady state, throttled retries and absent hosts report nothing. */
+export function eventFor(outcomes) {
+    const acted = outcomes.filter((outcome) => !outcome.quiet);
+    if (acted.length === 0)
+        return null;
+    const detail = acted.map((outcome) => `${outcome.host}=${outcome.reason}`).join("; ");
+    const failed = acted.find((outcome) => outcome.status === "failed");
+    if (failed)
+        return { step: "agent_plugins_install", status: "fail", error_code: failed.reason, error_detail: detail };
+    if (acted.every((outcome) => outcome.status === "skipped"))
+        return { step: "agent_plugins_install", status: "skipped", error_code: acted[0].reason, error_detail: detail };
+    const refreshOnly = acted.every((outcome) => outcome.status === "refreshed");
+    // A failed daily refresh keeps the plugin; it is still worth one line, as a skipped step.
+    const refreshFailed = acted.find((outcome) => outcome.reason.startsWith("refresh_failed_"));
+    if (refreshFailed)
+        return { step: "agent_plugins_install", status: "skipped", error_code: refreshFailed.reason, error_detail: detail };
+    return { step: refreshOnly ? "agent_plugins_refresh" : "agent_plugins_install", status: "ok", error_detail: detail };
+}

package/dist/commands/sync-heal.js

@@ -8,6 +8,10 @@
  *                                                  failed install retried hourly
  *   sign-in lapsed          record the ONE human   written when the heartbeat
  *                           action, stop nagging   could not renew, reported daily
+ *   company plugin missing  install it for Claude  inspected every tick, a failed
+ *   (BLI-18200)             Code and Codex         host retried every six hours,
+ *                           (sync-heal-agent-      an installed one refreshed daily
+ *                           plugins.ts)
  *
  * The rest of the table is already on the tick elsewhere: the CLI floor
  * (`sync-followups-self-update.ts`), the scheduler incl. an ABSENT one
@@ -23,6 +27,7 @@ import path from "node:path";
 import { redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
 import { heartbeatRefusalStatus } from "./heartbeat-token.js";
 import { SIGN_IN_ACTION } from "../sign-in-action.js";
+import { healAgentPlugins } from "./sync-heal-agent-plugins.js";
 import { inspectAgentRules, installAgentRules } from "../agent-rules.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, toSessionReference, } from "../local-state.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
@@ -37,6 +42,7 @@ export async function runMachineHealAfterSync(command, io, dashboardUrl, options
     const events = [];
     for (const heal of [
         () => healAgentRules(command, paths, now),
+        () => healAgentPlugins(command, io, paths, now),
         () => noteSessionState(paths, heartbeatRefusalStatus(), now),
     ]) {
         try {

package/dist/local-state-config.js

@@ -11,7 +11,27 @@ const localCollectorPackage = JSON.parse(readFileSync(new URL("../package.json",
 export const LOCAL_COLLECTOR_VERSION = typeof localCollectorPackage.version === "string"
     ? localCollectorPackage.version
     : "0.0.0";
-export const DEFAULT_DASHBOARD_URL = "https://bli-cockpit-dashboard.vercel.app";
+export const DEFAULT_DASHBOARD_URL = "https://tower.buildlaunchiterate.ca";
+/**
+ * The address every machine paired before 2026-10-14 saved. It stays live as an
+ * alias of the same deployment forever, so a saved config naming it keeps
+ * working untouched and counts as the default wherever the default is decided.
+ */
+export const LEGACY_DASHBOARD_URL = "https://bli-cockpit-dashboard.vercel.app";
+function dashboardUrlKey(value) {
+    return value.trim().replace(/\/+$/, "").toLowerCase();
+}
+/** True for either address of the production Tower; a staging or local URL is false. */
+export function isDefaultDashboardUrl(value) {
+    const key = dashboardUrlKey(value);
+    return key === dashboardUrlKey(DEFAULT_DASHBOARD_URL) || key === dashboardUrlKey(LEGACY_DASHBOARD_URL);
+}
+/** Same dashboard, the two production addresses counted as one. */
+export function sameDashboardUrl(a, b) {
+    if (isDefaultDashboardUrl(a) && isDefaultDashboardUrl(b))
+        return true;
+    return dashboardUrlKey(a) === dashboardUrlKey(b);
+}
 /**
  * `cockpit install` — the one write that registers collection roots, because
  * widening an operator's boundary is a consent decision and nothing else may

package/dist/local-state.js

@@ -36,7 +36,7 @@
  * `runtimeFiles`, or the repo tests stay green while the packed CLI breaks.
  */
 export { getCollectorRuntimePaths } from "./local-state-paths.js";
-export { DEFAULT_DASHBOARD_URL, ensureLocalCollectorConfig, installLocalCollector, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, } from "./local-state-config.js";
+export { DEFAULT_DASHBOARD_URL, ensureLocalCollectorConfig, installLocalCollector, isDefaultDashboardUrl, LEGACY_DASHBOARD_URL, LOCAL_COLLECTOR_VERSION, sameDashboardUrl, readLocalCollectorConfig, } from "./local-state-config.js";
 export { readLocalCollectorSessionFile, readLocalSessionReference, toSessionReference, } from "./local-state-session.js";
 export { logoutLocalCollector, pairLocalCollector, recordDeviceTokenExpiry, } from "./local-state-pairing.js";
 export { PairingCodeError, pairLocalCollectorViaLink, } from "./local-state-pairing-code.js";

package/dist/process-runner.js

@@ -35,12 +35,16 @@ export function createCapturedExecRunner(options = {}) {
             encoding: "utf8",
             env,
             windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+            ...(runOptions?.timeoutMs ? { timeout: runOptions.timeoutMs } : {}),
         }, (error, stdout, stderr) => {
+            // A child ended by `timeoutMs` reports code 124, never a bare 1.
             const code = error == null
                 ? 0
-                : typeof error.code === "number"
-                    ? error.code
-                    : 1;
+                : error.killed === true && runOptions?.timeoutMs
+                    ? 124
+                    : typeof error.code === "number"
+                        ? error.code
+                        : 1;
             resolve({
                 code,
                 stdout: stdout ?? "",

package/dist/state-dir-audit.js

@@ -55,6 +55,7 @@ export const STATE_DIR_RULES = [
     // tiny by construction; naming them keeps the unrecognised bucket meaning
     // "something nobody registered", not "something small we forgot".
     { name: "session-needs-login.json", match: "exact", class: "state", bound: "one small note, overwritten at most daily and removed when the sign-in is valid again (sync-heal.ts)" },
+    { name: "agent-plugins.json", match: "exact", class: "state", bound: "one small file, overwritten: per host the last install attempt, its failure label and the last daily refresh (agent-plugins-converge.ts, BLI-18200)" },
     { name: "autostart-uninstalled", match: "exact", class: "state", bound: "a zero-byte marker written by `cockpit autostart uninstall` and removed by install or doctor" },
     { name: "last-turn-trace.json", match: "exact", class: "state", bound: "one file, overwritten" },
     { name: "sync.lock", match: "exact", class: "state", bound: "lock file, removed when the tick ends" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.222",
+  "version": "0.2.224",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,8 +27,8 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.66",
-    "@bli-cockpit/mcp": "0.1.129",
+    "@bli-cockpit/memory-mcp": "0.1.67",
+    "@bli-cockpit/mcp": "0.1.130",
     "@bli-cockpit/telemetry-core": "0.1.75"
   },
   "repository": {