@bli-cockpit/cli 0.2.222 → 0.2.236

package/dist/commands/sync-heal.js

@@ -8,6 +8,10 @@
  *                                                  failed install retried hourly
  *   sign-in lapsed          record the ONE human   written when the heartbeat
  *                           action, stop nagging   could not renew, reported daily
+ *   company plugin missing  install it for Claude  inspected every tick, a failed
+ *   (BLI-18200)             Code and Codex         host retried every six hours,
+ *                           (sync-heal-agent-      an installed one refreshed daily
+ *                           plugins.ts)
  *
  * The rest of the table is already on the tick elsewhere: the CLI floor
  * (`sync-followups-self-update.ts`), the scheduler incl. an ABSENT one
@@ -23,6 +27,7 @@ import path from "node:path";
 import { redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
 import { heartbeatRefusalStatus } from "./heartbeat-token.js";
 import { SIGN_IN_ACTION } from "../sign-in-action.js";
+import { healAgentPlugins } from "./sync-heal-agent-plugins.js";
 import { inspectAgentRules, installAgentRules } from "../agent-rules.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, toSessionReference, } from "../local-state.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
@@ -37,6 +42,7 @@ export async function runMachineHealAfterSync(command, io, dashboardUrl, options
     const events = [];
     for (const heal of [
         () => healAgentRules(command, paths, now),
+        () => healAgentPlugins(command, io, paths, now),
         () => noteSessionState(paths, heartbeatRefusalStatus(), now),
     ]) {
         try {

package/dist/commands/team.js

@@ -25,6 +25,8 @@ export async function runTeam(command, io) {
     const tower = await openTower("team", command, io);
     if (command.action.startsWith("github-login-"))
         return githubLogin(command, tower, io);
+    if (command.action.startsWith("timezone-"))
+        return timezone(command, tower, io);
     if (command.action === "members")
         return showMembers(command, tower, io);
     if (command.action === "invite")
@@ -272,6 +274,39 @@ async function githubLogin(command, tower, io) {
         `GitHub logins: ${[body.primary_login, ...(Array.isArray(body.extra_logins) ? body.extra_logins : [])].filter(Boolean).join(", ") || "none"}. History is preserved.`);
     return 0;
 }
+/**
+ * `cockpit team timezone list|set` (BLI-19277). The server owns every rule: who
+ * may ask (super admin), how a person is found (the one identity resolver, exact
+ * after case folding) and what counts as an IANA zone. This only relays and words
+ * the answer, so a stale CLI can be wrong about wording and never about a zone.
+ */
+async function timezone(command, tower, io) {
+    const setting = command.action === "timezone-set";
+    const result = await callTower(tower, { path: "/api/team/timezones", method: setting ? "PUT" : "GET", label: "team timezone",
+        ...(setting ? { body: { person: command.personRef, timezone: command.zone } } : {}) });
+    writeLine(io.stderr, `[team cli] timezone ${JSON.stringify({ action: setting ? "set" : "list", reason: result.ok ? "answered" : result.reason })}`);
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(body));
+        return 0;
+    }
+    if (setting) {
+        const name = String(body.display_name ?? command.personRef);
+        const before = String(body.before ?? "unknown");
+        const after = String(body.after ?? "unknown");
+        writeLine(io.stdout, body.changed === false ? `${name} already has ${after}. Nothing changed.` : `${name}: ${before} -> ${after}.`);
+        return 0;
+    }
+    const people = (Array.isArray(body.people) ? body.people : []).map(asRecord);
+    const width = Math.max(6, ...people.map(person => String(person.display_name ?? "").length));
+    for (const person of people) {
+        writeLine(io.stdout, `${String(person.display_name ?? "").padEnd(width)}  ${String(person.timezone_label ?? "unknown").padEnd(24)}${person.active === false ? " (inactive)" : ""}`);
+    }
+    writeLine(io.stdout, `${people.length} people, ${String(body.unknown_count ?? 0)} with an unknown timezone.`);
+    return 0;
+}
 async function changeGrant(command, tower, io) {
     const result = await callTower(tower, { path: "/api/team/grants", method: "POST", label: "team section grant",
         body: { person_id: command.targetUserId, section: command.section, level: command.level ?? "see", action: command.action } });

package/dist/commands/usage.js

@@ -15,6 +15,8 @@ export async function runUsage(command, io) {
         query.set("groupBy", "task_type");
     if (command.byRepo)
         query.set("groupBy", "repo");
+    if (command.byClient)
+        query.set("groupBy", "client");
     if (command.until)
         query.set("until", command.until);
     if (command.includeAutomated)
@@ -43,6 +45,13 @@ export async function runUsage(command, io) {
     if (!answer.ok)
         return failAgentDoor(door, "[usage]", answer.reason, answer.detail);
     const body = answer.body;
+    // Ticket 19258: the client app split reads everyone and prints the door's own words (medians always with their N).
+    if (command.byClient) {
+        if (door.json)
+            return emitAgentDoor(door, answer.body);
+        writeLine(io.stdout, String(answer.body.text ?? ""));
+        return 0;
+    }
     if (command.person) {
         const email = command.person === "me" ? (await loadPairedSession("usage", command.homeDir)).email : command.person;
         if (!email)

package/dist/commands/who.js

@@ -0,0 +1,36 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[who cli]";
+const READ_DEADLINE_MS = 30_000;
+export async function runWho(command, io) {
+    let door;
+    try {
+        door = await openAgentDoor("who", command, io);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : "this machine is not paired with Tower";
+        writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason: "not_paired" })}`);
+        if (command.json)
+            writeLine(io.stdout, JSON.stringify({ ok: false, error: "not_paired", detail }));
+        else
+            writeLine(io.stderr, detail);
+        return 1;
+    }
+    const query = new URLSearchParams();
+    if (command.topic)
+        query.set("topic", command.topic);
+    if (command.layer)
+        query.set("layer", command.layer);
+    if (command.limit)
+        query.set("limit", String(command.limit));
+    const asked = query.toString();
+    const answer = await askAgentDoor(door, { path: asked ? `/api/who?${asked}` : "/api/who", method: "GET", label: "who", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(io.stderr, `${TAG} answered ${JSON.stringify({ resolved_as: body.resolved_as, areas: body.areas.length, as_of: body.as_of })}`);
+    if (command.json)
+        return emitAgentDoor(door, body);
+    writeLine(io.stdout, body.text);
+    return 0;
+}

package/dist/evidence-upload-direct.js

@@ -0,0 +1,44 @@
+import { encodeEvidenceBytes } from "@bli-cockpit/telemetry-core/evidence-storage-encoding";
+import { noteSyncProgress } from "./sync-lock.js";
+/** The signed capability is the only credential sent to Storage. Never log it,
+ * its query string, provider bodies, or thrown errors that might contain it. */
+export async function putSignedChunk(options, signedUrl, bytes, uploadId, index) {
+    // Identical manifest + gzip framing to the server chunk route staging write.
+    const encoded = encodeEvidenceBytes(bytes);
+    console.error("[evidence-upload] chunk encoded for storage", JSON.stringify({
+        upload_id: uploadId, chunk_index: index, chunk_encoding: "gzip",
+        bytes_before: bytes.length, bytes_after: encoded.length,
+    }));
+    const attempts = options.maxAttemptsPerRequest ?? 3;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        let status = 0;
+        try {
+            const response = await options.fetchImpl(signedUrl, {
+                method: "PUT", headers: { "Content-Type": "application/octet-stream", "x-upsert": "false" },
+                body: new Uint8Array(encoded), signal: AbortSignal.timeout(60_000), redirect: "error",
+            });
+            status = response.status;
+            await response.body?.cancel();
+            if (response.ok) {
+                noteSyncProgress();
+                log("signed_chunk_uploaded", uploadId, index, attempt, status);
+                return true;
+            }
+            log("signed_upload_refused", uploadId, index, attempt, status);
+            if (status < 500 && status !== 429)
+                return false;
+        }
+        catch {
+            log("signed_upload_network_failure", uploadId, index, attempt, status);
+        }
+        if (attempt < attempts)
+            await (options.sleep ?? sleep)(250 * attempt);
+    }
+    return false;
+}
+function log(reason, uploadId, index, attempt, status) {
+    console.error("[evidence-upload] direct chunk", JSON.stringify({
+        reason, upload_id: uploadId, chunk_index: index, attempt, http_status: status,
+    }));
+}
+function sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); }

package/dist/evidence-upload-object.js

@@ -1,3 +1,4 @@
+import { putSignedChunk } from "./evidence-upload-direct.js";
 import { gzipSync } from "node:zlib";
 import { COMMIT_CRASHED_PLATFORM, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
 import { beginOneObject } from "./evidence-upload-terminal.js";
@@ -17,10 +18,11 @@ export async function uploadOneObject(options, entry, disposition, chunkSizeByte
     if (disposition.disposition === "conflict" || !disposition.upload_id) {
         return failedOutcome(entry.file, disposition.reason ?? "upload_conflict");
     }
-    const chunked = await uploadObjectChunks(options, entry, disposition, chunkSizeBytes, objectKey);
+    const directChunks = [];
+    const chunked = await uploadObjectChunks(options, entry, disposition, chunkSizeBytes, objectKey, directChunks);
     if (!chunked.ok)
         return chunked.outcome;
-    const committed = await commitUploadedObject(options, entry, disposition, objectKey, chunked.uploadedChunks);
+    const committed = await commitUploadedObject(options, entry, disposition, objectKey, chunked.uploadedChunks, directChunks);
     if (committed.reason !== "commit_failed_http_409_staging_missing_between_passes")
         return committed;
     if (restageAttempted)
@@ -37,7 +39,7 @@ export async function uploadOneObject(options, entry, disposition, chunkSizeByte
     }
     return retried;
 }
-async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, objectKey) {
+async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, objectKey, directChunks) {
     const received = new Set(disposition.received_chunk_indexes);
     let uploadedChunks = 0;
     if (disposition.disposition === "already_committed" || disposition.commit_ready) {
@@ -47,6 +49,17 @@ async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, o
         if (received.has(index))
             continue;
         const chunk = entry.bytes.subarray(index * chunkSizeBytes, Math.min((index + 1) * chunkSizeBytes, entry.bytes.byteLength));
+        const offer = disposition.signed_uploads?.find(upload => upload.chunk_index === index);
+        if (offer && await putSignedChunk(options, offer.signed_url, chunk, disposition.upload_id, index)) {
+            directChunks.push({ chunk_index: index, byte_size: chunk.length,
+                chunk_hash_sha256: sha256(chunk) });
+            uploadedChunks += 1;
+            continue;
+        }
+        console.error("[evidence-upload] using chunk route", JSON.stringify({
+            reason: offer ? "signed_upload_refused_fallback" : "signed_upload_not_offered",
+            upload_id: disposition.upload_id, chunk_index: index,
+        }));
         const encodedChunk = gzipSync(chunk);
         console.error("[evidence-upload] chunk encoded", JSON.stringify({
             upload_id: disposition.upload_id, chunk_index: index, chunk_encoding: "gzip",
@@ -97,13 +110,14 @@ async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, o
     }
     return { ok: true, uploadedChunks };
 }
-async function commitUploadedObject(options, entry, disposition, objectKey, uploadedChunks) {
+async function commitUploadedObject(options, entry, disposition, objectKey, uploadedChunks, directChunks) {
     const commit = await requestJson(options, "/api/ambient/evidence/upload/commit", {
         schema_version: "ambient-raw-evidence-upload-commit.v1",
         generated_at: options.generatedAt,
         provenance: options.provenance,
         upload_id: disposition.upload_id,
         object_key: objectKey,
+        ...(disposition.signed_uploads ? { direct_chunks: directChunks } : {}),
     });
     if (!commit.ok) {
         // The server can tell us this object will be refused again. Take its reason

package/dist/evidence-upload-plan.js

@@ -225,6 +225,7 @@ export function readBeginDispositions(body) {
             upload_id: entry.upload_id ?? null,
             received_chunk_indexes: entry.received_chunk_indexes,
             commit_ready: entry.commit_ready === true,
+            signed_uploads: entry.signed_uploads,
             reason: entry.reason ?? null,
             raw_evidence_pointer_id: entry.raw_evidence_pointer_id,
         });

package/dist/evidence-upload-transport.js

@@ -22,6 +22,8 @@ export async function requestJson(options, routePath, body) {
                 headers: {
                     "Authorization": `Bearer ${options.deviceToken}`,
                     "Content-Type": "application/json",
+                    ...(routePath.endsWith("/evidence/upload/begin")
+                        ? { "x-tower-evidence-direct": "staged-gzip-v1" } : {}),
                 },
                 body: JSON.stringify(body),
             });

package/dist/local-state-config.js

@@ -11,7 +11,27 @@ const localCollectorPackage = JSON.parse(readFileSync(new URL("../package.json",
 export const LOCAL_COLLECTOR_VERSION = typeof localCollectorPackage.version === "string"
     ? localCollectorPackage.version
     : "0.0.0";
-export const DEFAULT_DASHBOARD_URL = "https://bli-cockpit-dashboard.vercel.app";
+export const DEFAULT_DASHBOARD_URL = "https://tower.buildlaunchiterate.ca";
+/**
+ * The address every machine paired before 2026-10-14 saved. It stays live as an
+ * alias of the same deployment forever, so a saved config naming it keeps
+ * working untouched and counts as the default wherever the default is decided.
+ */
+export const LEGACY_DASHBOARD_URL = "https://bli-cockpit-dashboard.vercel.app";
+function dashboardUrlKey(value) {
+    return value.trim().replace(/\/+$/, "").toLowerCase();
+}
+/** True for either address of the production Tower; a staging or local URL is false. */
+export function isDefaultDashboardUrl(value) {
+    const key = dashboardUrlKey(value);
+    return key === dashboardUrlKey(DEFAULT_DASHBOARD_URL) || key === dashboardUrlKey(LEGACY_DASHBOARD_URL);
+}
+/** Same dashboard, the two production addresses counted as one. */
+export function sameDashboardUrl(a, b) {
+    if (isDefaultDashboardUrl(a) && isDefaultDashboardUrl(b))
+        return true;
+    return dashboardUrlKey(a) === dashboardUrlKey(b);
+}
 /**
  * `cockpit install` — the one write that registers collection roots, because
  * widening an operator's boundary is a consent decision and nothing else may

package/dist/local-state.js

@@ -36,7 +36,7 @@
  * `runtimeFiles`, or the repo tests stay green while the packed CLI breaks.
  */
 export { getCollectorRuntimePaths } from "./local-state-paths.js";
-export { DEFAULT_DASHBOARD_URL, ensureLocalCollectorConfig, installLocalCollector, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, } from "./local-state-config.js";
+export { DEFAULT_DASHBOARD_URL, ensureLocalCollectorConfig, installLocalCollector, isDefaultDashboardUrl, LEGACY_DASHBOARD_URL, LOCAL_COLLECTOR_VERSION, sameDashboardUrl, readLocalCollectorConfig, } from "./local-state-config.js";
 export { readLocalCollectorSessionFile, readLocalSessionReference, toSessionReference, } from "./local-state-session.js";
 export { logoutLocalCollector, pairLocalCollector, recordDeviceTokenExpiry, } from "./local-state-pairing.js";
 export { PairingCodeError, pairLocalCollectorViaLink, } from "./local-state-pairing-code.js";

package/dist/process-runner.js

@@ -35,12 +35,16 @@ export function createCapturedExecRunner(options = {}) {
             encoding: "utf8",
             env,
             windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+            ...(runOptions?.timeoutMs ? { timeout: runOptions.timeoutMs } : {}),
         }, (error, stdout, stderr) => {
+            // A child ended by `timeoutMs` reports code 124, never a bare 1.
             const code = error == null
                 ? 0
-                : typeof error.code === "number"
-                    ? error.code
-                    : 1;
+                : error.killed === true && runOptions?.timeoutMs
+                    ? 124
+                    : typeof error.code === "number"
+                        ? error.code
+                        : 1;
             resolve({
                 code,
                 stdout: stdout ?? "",

package/dist/state-dir-audit.js

@@ -55,6 +55,7 @@ export const STATE_DIR_RULES = [
     // tiny by construction; naming them keeps the unrecognised bucket meaning
     // "something nobody registered", not "something small we forgot".
     { name: "session-needs-login.json", match: "exact", class: "state", bound: "one small note, overwritten at most daily and removed when the sign-in is valid again (sync-heal.ts)" },
+    { name: "agent-plugins.json", match: "exact", class: "state", bound: "one small file, overwritten: per host the last install attempt, its failure label and the last daily refresh (agent-plugins-converge.ts, BLI-18200)" },
     { name: "autostart-uninstalled", match: "exact", class: "state", bound: "a zero-byte marker written by `cockpit autostart uninstall` and removed by install or doctor" },
     { name: "last-turn-trace.json", match: "exact", class: "state", bound: "one file, overwritten" },
     { name: "sync.lock", match: "exact", class: "state", bound: "lock file, removed when the tick ends" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.222",
+  "version": "0.2.236",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.66",
-    "@bli-cockpit/mcp": "0.1.129",
-    "@bli-cockpit/telemetry-core": "0.1.75"
+    "@bli-cockpit/memory-mcp": "0.1.69",
+    "@bli-cockpit/mcp": "0.1.141",
+    "@bli-cockpit/telemetry-core": "0.1.76"
   },
   "repository": {
     "type": "git",