@bli-cockpit/cli 0.2.236 → 0.2.238

package/dist/adapters/local-sources.js

@@ -7,7 +7,52 @@ import { collectRawEvidencePack, } from "./raw-evidence.js";
 import { generateDumbRiskFlags } from "./risk-flags.js";
 import { resolveTicketBinding, } from "./ticket-binding.js";
 export async function runLocalSourceCollectors(options) {
-    const context = {
+    const context = makeCollectionContext(options);
+    const git = await collectGitState(context);
+    const car = await collectCarState(context);
+    const rawEvidence = await collectConfiguredRawEvidence(context, options);
+    const unavailableScans = makeUnconfiguredSourceScans(context);
+    // claude_jsonl availability (B.4): "ok" when ~/.claude/projects exists, else
+    // skipped with the reason it could not be read — absent, permission-denied,
+    // not a directory, or unreadable (BLI-3483) — so an operator sees whether
+    // the empty claude funnel is normal or a wall they can take down. Collection
+    // itself is gated separately by collect_claude_jsonl in the sync
+    // orchestrator.
+    const claudeJsonlScan = await makeClaudeJsonlScan(context, options.claudeProjectsDir);
+    const candidates = collectBindingCandidates([
+        git.scan,
+        car.scan,
+        rawEvidence.scan,
+        claudeJsonlScan,
+        ...unavailableScans,
+    ]);
+    const binding = resolveTicketBinding({
+        activeWorkContext: options.activeWorkContext,
+        candidates,
+    });
+    const gitFacts = isGitStateFacts(git.facts) ? git.facts : null;
+    const carFacts = isCarStateFacts(car.facts) ? car.facts : null;
+    const rawEvidenceFacts = isRawEvidenceFacts(rawEvidence.facts)
+        ? rawEvidence.facts
+        : null;
+    const riskFlags = generateDumbRiskFlags({
+        context,
+        git: gitFacts,
+        binding,
+    });
+    return {
+        scans: [git.scan, car.scan, rawEvidence.scan, claudeJsonlScan, ...unavailableScans],
+        facts: {
+            git: gitFacts,
+            car: carFacts,
+            raw_evidence: rawEvidenceFacts,
+        },
+        binding,
+        risk_flags: riskFlags,
+    };
+}
+function makeCollectionContext(options) {
+    return {
         repoRoot: options.repoRoot,
         repoLabel: options.activeWorkContext?.repo_label,
         worktreeLabel: options.activeWorkContext?.worktree_label,
@@ -19,9 +64,9 @@ export async function runLocalSourceCollectors(options) {
         activeTicketId: options.activeWorkContext?.active_ticket_id ?? null,
         now: options.now ?? new Date(),
     };
-    const git = await collectGitState(context);
-    const car = await collectCarState(context);
-    const rawEvidence = options.rawEvidenceStateDir
+}
+async function collectConfiguredRawEvidence(context, options) {
+    return options.rawEvidenceStateDir
         ? await collectRawEvidencePack(context, {
             stateDir: options.rawEvidenceStateDir,
             repoRoot: options.repoRoot,
@@ -46,51 +91,15 @@ export async function runLocalSourceCollectors(options) {
             scan: makeUnavailableScan(context, "codex_jsonl", "codex-jsonl", "raw_evidence_state_dir_not_configured"),
             facts: null,
         };
-    const unavailableScans = [
+}
+function makeUnconfiguredSourceScans(context) {
+    return [
         makeUnavailableScan(context, "codex_otel", "codex-otel", "codex_otel_export_not_configured"),
         makeUnavailableScan(context, "github_state", "github-state", "github_auth_not_configured"),
         makeUnavailableScan(context, "linear_state", "linear-state", "linear_auth_not_configured"),
         makeUnavailableScan(context, "mcp_local", "mcp-local", "mcp_activity_not_configured"),
         makeUnavailableScan(context, "claude_hooks", "claude-hooks", "claude_hooks_not_present"),
     ];
-    // claude_jsonl availability (B.4): "ok" when ~/.claude/projects exists, else
-    // skipped with the reason it could not be read — absent, permission-denied,
-    // not a directory, or unreadable (BLI-3483) — so an operator sees whether
-    // the empty claude funnel is normal or a wall they can take down. Collection
-    // itself is gated separately by collect_claude_jsonl in the sync
-    // orchestrator.
-    const claudeJsonlScan = await makeClaudeJsonlScan(context, options.claudeProjectsDir);
-    const candidates = collectBindingCandidates([
-        git.scan,
-        car.scan,
-        rawEvidence.scan,
-        claudeJsonlScan,
-        ...unavailableScans,
-    ]);
-    const binding = resolveTicketBinding({
-        activeWorkContext: options.activeWorkContext,
-        candidates,
-    });
-    const gitFacts = isGitStateFacts(git.facts) ? git.facts : null;
-    const carFacts = isCarStateFacts(car.facts) ? car.facts : null;
-    const rawEvidenceFacts = isRawEvidenceFacts(rawEvidence.facts)
-        ? rawEvidence.facts
-        : null;
-    const riskFlags = generateDumbRiskFlags({
-        context,
-        git: gitFacts,
-        binding,
-    });
-    return {
-        scans: [git.scan, car.scan, rawEvidence.scan, claudeJsonlScan, ...unavailableScans],
-        facts: {
-            git: gitFacts,
-            car: carFacts,
-            raw_evidence: rawEvidenceFacts,
-        },
-        binding,
-        risk_flags: riskFlags,
-    };
 }
 function collectBindingCandidates(scans) {
     return scans.flatMap((scan) => scan.ticket_binding_candidates);

package/dist/adapters/raw-evidence-git-diff.js

@@ -79,6 +79,9 @@ export async function runGitDiff(args, repoRoot) {
     if (!(await repoRootExists(repoRoot))) {
         throw new RepoRootMissingError();
     }
+    return captureGitDiff(args, repoRoot);
+}
+function captureGitDiff(args, repoRoot) {
     return new Promise((resolve, reject) => {
         const child = spawn("git", [...args, ...SECRET_EXCLUDING_PATHSPEC], {
             cwd: repoRoot,
@@ -119,8 +122,7 @@ export async function runGitDiff(args, repoRoot) {
         });
         child.on("close", (code, signal) => {
             clearTimeout(timeout);
-            // A cap that fired killed the child on purpose, so SIGTERM and a
-            // non-zero code are both success here, not failure.
+            // Caps deliberately kill the child; SIGTERM and non-zero codes then count as success.
             if (code === 0 || truncated || signal === "SIGTERM") {
                 resolve({
                     stdout: Buffer.concat(stdoutChunks).toString("utf8"),

package/dist/adapters/raw-evidence-sanitize.js

@@ -56,18 +56,7 @@ export function sanitizeTextEvidenceForUpload(options) {
         };
     }
     catch (error) {
-        // The redactor itself crashed. The stub below is the safe answer — a
-        // placeholder goes up instead of unredacted bytes — but it is also
-        // indistinguishable downstream from a file that was legitimately masked,
-        // so a systematic redactor bug would look like a machine that simply
-        // writes a lot of secrets. Never the text, never the field values: name,
-        // code and size only (BLI-3238).
-        console.error("[raw-evidence-sanitize] redaction crashed; uploading a stub instead of the content", JSON.stringify({
-            reason: "redaction_crashed",
-            byte_size: originalBytes.byteLength,
-            redacted_field_count: options.redactedFields.length,
-            ...describeError(error),
-        }));
+        logRedactionCrash(error, originalBytes.byteLength, options.redactedFields.length);
         return stubForCrashedRedaction({
             text: options.text,
             originalBytes,
@@ -75,6 +64,20 @@ export function sanitizeTextEvidenceForUpload(options) {
         });
     }
 }
+function logRedactionCrash(error, byteSize, redactedFieldCount) {
+    // The redactor itself crashed. The stub below is the safe answer — a
+    // placeholder goes up instead of unredacted bytes — but it is also
+    // indistinguishable downstream from a file that was legitimately masked,
+    // so a systematic redactor bug would look like a machine that simply
+    // writes a lot of secrets. Never the text, never the field values: name,
+    // code and size only (BLI-3238).
+    console.error("[raw-evidence-sanitize] redaction crashed; uploading a stub instead of the content", JSON.stringify({
+        reason: "redaction_crashed",
+        byte_size: byteSize,
+        redacted_field_count: redactedFieldCount,
+        ...describeError(error),
+    }));
+}
 /**
  * The name itself (`.env.production`, `id_rsa`) is the signal, so nothing in
  * this file is trusted: whatever the redactor left behind is re-checked, and a

package/dist/adapters/raw-evidence-transcript-file.js

@@ -33,14 +33,7 @@ import { admitEvidence, stageEvidenceBytes, } from "./raw-evidence-collection-st
  */
 export async function collectOneEvidenceFile(collection, options) {
     const names = nameEvidenceFile(options);
-    const skip = (reason) => {
-        collection.skipped.push({
-            kind: options.kind,
-            label: names.evidenceLabel,
-            reason,
-        });
-        return false;
-    };
+    const skip = (reason) => recordEvidenceSkip(collection, options.kind, names.evidenceLabel, reason);
     // Delivery backoff is checked BEFORE the file is read. An object whose commit
     // has failed repeatedly costs nothing at all this cycle — no read, no hash,
     // no copy, no request — and the hold is a named, retryable gap so a held
@@ -58,29 +51,7 @@ export async function collectOneEvidenceFile(collection, options) {
         markCapApplied(collection, options.kind, "max_file_bytes");
         return skip("file_too_large");
     }
-    // BLI-16977: describe each distinct embedded image once and, when the one switch says so, swap the
-    // base64 for a short marker BEFORE masking, so the masker and the content hash see the final bytes.
-    const imagesPrepared = await prepareEmbeddedImages(collection, {
-        bytes: read.bytes,
-        kind: options.kind,
-        sessionId: options.sessionId,
-    });
-    const sanitized = maskSecretsInTranscript(collection, {
-        raw: imagesPrepared,
-        kind: options.kind,
-        evidenceLabel: names.evidenceLabel,
-        secretLikeFileName: names.secretLikeFileName,
-    });
-    const contentHash = sha256(sanitized.bytes);
-    // BLI-11102: a session the server named a redaction stub is re-offered even
-    // when these bytes are already durable, because the stub is not a delivery.
-    const stubClaim = stubReplacementClaim({
-        kind: options.kind,
-        stubPointerId: collection.stubReoffers.get(options.sessionId),
-        completenessLabel: sanitized.completenessLabel,
-        byteSize: sanitized.bytes.byteLength,
-        alreadyDurable: collection.skipContentHashes.has(contentHash),
-    });
+    const { sanitized, contentHash, stubClaim } = await prepareTranscriptForUpload(collection, options, names, read.bytes);
     if (collection.skipContentHashes.has(contentHash) && !stubClaim) {
         collection.reused.push({
             kind: options.kind,
@@ -104,6 +75,36 @@ export async function collectOneEvidenceFile(collection, options) {
     });
     return true;
 }
+function recordEvidenceSkip(collection, kind, label, reason) {
+    collection.skipped.push({ kind, label, reason });
+    return false;
+}
+async function prepareTranscriptForUpload(collection, options, names, bytes) {
+    // BLI-16977: describe each distinct embedded image once and, when the one switch says so, swap the
+    // base64 for a short marker BEFORE masking, so the masker and the content hash see the final bytes.
+    const imagesPrepared = await prepareEmbeddedImages(collection, {
+        bytes,
+        kind: options.kind,
+        sessionId: options.sessionId,
+    });
+    const sanitized = maskSecretsInTranscript(collection, {
+        raw: imagesPrepared,
+        kind: options.kind,
+        evidenceLabel: names.evidenceLabel,
+        secretLikeFileName: names.secretLikeFileName,
+    });
+    const contentHash = sha256(sanitized.bytes);
+    // BLI-11102: a session the server named a redaction stub is re-offered even
+    // when these bytes are already durable, because the stub is not a delivery.
+    const stubClaim = stubReplacementClaim({
+        kind: options.kind,
+        stubPointerId: collection.stubReoffers.get(options.sessionId),
+        completenessLabel: sanitized.completenessLabel,
+        byteSize: sanitized.bytes.byteLength,
+        alreadyDurable: collection.skipContentHashes.has(contentHash),
+    });
+    return { sanitized, contentHash, stubClaim };
+}
 /**
  * The transcript bytes after the image step. Unchanged (the very same buffer) unless this sync has
  * an image session AND the switch is `describe_and_drop` (images become markers where a description

package/dist/autostart-self-heal.js

@@ -16,6 +16,17 @@ export async function runAutostartSelfHeal(paths, options) {
         return null;
     if (options.repoRoots.length === 0)
         return null;
+    const problem = await readAutostartProblem(paths, options, platform);
+    if (!problem)
+        return null;
+    const guarded = await prepareRepairAttempt(paths, options, platform, problem.detail);
+    if (guarded)
+        return guarded;
+    if (platform === "darwin")
+        return scheduleDarwinHeal(options, problem.detail);
+    return repairWindowsAutostart(options, platform, problem.absent, problem.detail);
+}
+async function readAutostartProblem(paths, options, platform) {
     const status = await autostartStatus({
         homeDir: options.homeDir,
         repoRoot: options.repoRoots[0],
@@ -56,6 +67,10 @@ export async function runAutostartSelfHeal(paths, options) {
     ]
         .join("; ")
         .slice(0, DETAIL_MAX_CHARS) || "registration not loaded";
+    return { absent, detail: problem };
+}
+async function prepareRepairAttempt(paths, options, platform, problem) {
+    const marker = path.join(paths.state_dir, AUTOSTART_REPAIR_THROTTLE_MARKER);
     // Two installs fighting over one registration re-register each other every
     // tick. Naming that is the repair; rewriting the plist would BE the flapping.
     const secondInstall = await detectSecondCockpitInstall({
@@ -85,8 +100,9 @@ export async function runAutostartSelfHeal(paths, options) {
     }
     await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
     await fs.writeFile(marker, now.toISOString()).catch(() => undefined);
-    if (platform === "darwin")
-        return scheduleDarwinHeal(options, problem);
+    return null;
+}
+async function repairWindowsAutostart(options, platform, absent, problem) {
     const repaired = await installAutostartAgent({
         homeDir: options.homeDir,
         repoRoot: options.repoRoots[0],

package/dist/commands/agent-session-report.js

@@ -172,49 +172,34 @@ function sessionReportEntry(result, context) {
             : {}),
         ...(result.cwd_basename ? { cwd_basename: result.cwd_basename } : {}),
         ...(result.cwd_hash ? { cwd_hash: result.cwd_hash } : {}),
-        ...(upload
-            ? {
-                raw_evidence_pointer_id: upload.raw_evidence_pointer_id,
-                upload_state: upload.upload_state,
-                // A failed upload names itself; a successful one has nothing to
-                // explain.
-                ...(upload.upload_state === "upload_failed"
-                    ? {
-                        upload_reason: upload.reason ?? NO_UPLOAD_ATTEMPT_RECORDED,
-                    }
-                    : {}),
-            }
-            : priorDurablePointer
-                ? {
-                    raw_evidence_pointer_id: priorDurablePointer,
-                    upload_state: "reused_existing",
-                }
-                : isRawEvidenceUploadableAttributionState(result.state, result.worktree !== null)
-                    ? {
-                        upload_state: "not_uploaded",
-                        // BLI-2107: `not_uploaded` used to be the branch of last
-                        // resort, recording that nothing happened and never why. It
-                        // now always carries a cause, even when the cause is that we
-                        // have none — a session labelled NO_UPLOAD_ATTEMPT_RECORDED
-                        // is a path that still needs instrumenting, and saying so is
-                        // the point.
-                        upload_reason: context.noUploadReasonByKey.get(key) ??
-                            (context.anySyncIncomplete
-                                ? "sync_incomplete_this_pass"
-                                : NO_UPLOAD_ATTEMPT_RECORDED),
-                    }
-                    : {
-                        // BLI-3272: the upload policy refused this session's
-                        // attribution state. That refusal used to spread `{}` here, so
-                        // the row landed with upload_state NULL and upload_reason NULL
-                        // — a withhold that named nothing, on 1,256 production
-                        // sessions. It is a decision like any other and it says so.
-                        // Any reason the pipeline did record still wins: it is the more
-                        // specific answer.
-                        upload_state: "not_uploaded",
-                        upload_reason: context.noUploadReasonByKey.get(key) ??
-                            notUploadableAttributionStateReason(result.reason),
-                    }),
+        ...describeSessionUpload(result, context, key, upload, priorDurablePointer),
+    };
+}
+function describeSessionUpload(result, context, key, upload, priorDurablePointer) {
+    if (upload) {
+        return {
+            raw_evidence_pointer_id: upload.raw_evidence_pointer_id,
+            upload_state: upload.upload_state,
+            ...(upload.upload_state === "upload_failed"
+                ? { upload_reason: upload.reason ?? NO_UPLOAD_ATTEMPT_RECORDED }
+                : {}),
+        };
+    }
+    if (priorDurablePointer) {
+        return { raw_evidence_pointer_id: priorDurablePointer, upload_state: "reused_existing" };
+    }
+    if (isRawEvidenceUploadableAttributionState(result.state, result.worktree !== null)) {
+        // No upload attempt still needs a reason, even when no more specific cause was recorded.
+        return {
+            upload_state: "not_uploaded",
+            upload_reason: context.noUploadReasonByKey.get(key) ??
+                (context.anySyncIncomplete ? "sync_incomplete_this_pass" : NO_UPLOAD_ATTEMPT_RECORDED),
+        };
+    }
+    // The attribution policy's refusal is an outcome; preserve any more specific recorded reason.
+    return {
+        upload_state: "not_uploaded",
+        upload_reason: context.noUploadReasonByKey.get(key) ?? notUploadableAttributionStateReason(result.reason),
     };
 }
 /**
@@ -245,22 +230,8 @@ export function buildAgentSessionReport(options) {
  * damping counts, and the two budget totals.
  */
 export function buildAgentSessionSummary(options) {
-    const sidecarOutcomes = options.outcomes.flatMap((outcome) => outcome.sync.raw_evidence_outcomes.filter((upload) => upload.kind === "claude_jsonl_sidecar"));
-    const attributedClaude = options.claudeAttribution.results.filter((result) => isLiveRawEvidenceSyncAttribution(result.state, result.reason, result.worktree !== null));
-    const sidecarsCollected = attributedClaude.reduce((total, result) => total +
-        result.sidecar_files.filter((sidecar) => !sidecar.skipped_reason).length, 0);
-    const sidecarsSkipped = options.claudeAttribution.results.reduce((total, result) => total +
-        result.sidecar_files.filter((sidecar) => sidecar.skipped_reason).length, 0);
-    const codex = {
-        scanned: options.codexAttribution.scanned_file_count,
-        attributed: options.codexAttribution.counts.attributed,
-        attributed_fallback: options.codexAttribution.counts.attributed_fallback,
-        ambiguous: options.codexAttribution.counts.ambiguous,
-        unattributed: options.codexAttribution.counts.unattributed,
-        skipped: options.codexAttribution.counts.skipped,
-        stale: options.codexStaleCount,
-        read_failures: codexAttributionReadFailureCount(options.codexAttribution),
-    };
+    const { sidecarOutcomes, sidecarsCollected, sidecarsSkipped } = countClaudeSidecars(options);
+    const codex = makeCodexFunnel(options);
     const claude = {
         scanned: options.claudeAttribution.scanned_session_count,
         attributed: options.claudeAttribution.counts.attributed,
@@ -298,4 +269,25 @@ export function buildAgentSessionSummary(options) {
         files_deferred_byte_budget: options.outcomes.reduce((total, outcome) => total + outcome.sync.raw_evidence_deferred_byte_budget, 0),
         files_deferred_object_budget: options.outcomes.reduce((total, outcome) => total + outcome.sync.raw_evidence_deferred_object_budget, 0),
     };
+}
+function countClaudeSidecars(options) {
+    const sidecarOutcomes = options.outcomes.flatMap((outcome) => outcome.sync.raw_evidence_outcomes.filter((upload) => upload.kind === "claude_jsonl_sidecar"));
+    const attributedClaude = options.claudeAttribution.results.filter((result) => isLiveRawEvidenceSyncAttribution(result.state, result.reason, result.worktree !== null));
+    const sidecarsCollected = attributedClaude.reduce((total, result) => total +
+        result.sidecar_files.filter((sidecar) => !sidecar.skipped_reason).length, 0);
+    const sidecarsSkipped = options.claudeAttribution.results.reduce((total, result) => total +
+        result.sidecar_files.filter((sidecar) => sidecar.skipped_reason).length, 0);
+    return { sidecarOutcomes, sidecarsCollected, sidecarsSkipped };
+}
+function makeCodexFunnel(options) {
+    return {
+        scanned: options.codexAttribution.scanned_file_count,
+        attributed: options.codexAttribution.counts.attributed,
+        attributed_fallback: options.codexAttribution.counts.attributed_fallback,
+        ambiguous: options.codexAttribution.counts.ambiguous,
+        unattributed: options.codexAttribution.counts.unattributed,
+        skipped: options.codexAttribution.counts.skipped,
+        stale: options.codexStaleCount,
+        read_failures: codexAttributionReadFailureCount(options.codexAttribution),
+    };
 }

package/dist/commands/agent-setup-observed.js

@@ -31,10 +31,6 @@ function top(counts) {
 export function observeTranscripts(tool, samples) {
     const models = new Map(), efforts = new Map();
     let version = null;
-    const bump = (map, value) => {
-        if (typeof value === "string" && value && !value.startsWith("<"))
-            map.set(value, (map.get(value) ?? 0) + 1);
-    };
     for (const sample of samples)
         for (const line of sample.split("\n")) {
             if (!line.startsWith("{"))
@@ -46,25 +42,33 @@ export function observeTranscripts(tool, samples) {
             catch {
                 continue;
             } // a chunk edge can cut a line
-            const payload = entry.payload && typeof entry.payload === "object" ? entry.payload : {};
-            if (tool === "claude") {
-                if (typeof entry.version === "string")
-                    version = newerVersion(version, entry.version);
-                const message = entry.message && typeof entry.message === "object" ? entry.message : {};
-                if (entry.type === "assistant")
-                    bump(models, message.model);
-            }
-            else if (entry.type === "session_meta") {
-                if (typeof payload.cli_version === "string")
-                    version = newerVersion(version, payload.cli_version);
-            }
-            else if (entry.type === "turn_context") {
-                bump(models, payload.model);
-                bump(efforts, payload.effort);
-            }
+            version = observeTranscriptEntry(tool, entry, version, models, efforts);
         }
     return { version, model: top(models), effort: top(efforts), files: samples.length };
 }
+function observeTranscriptEntry(tool, entry, version, models, efforts) {
+    const payload = entry.payload && typeof entry.payload === "object" ? entry.payload : {};
+    if (tool === "claude") {
+        if (typeof entry.version === "string")
+            version = newerVersion(version, entry.version);
+        const message = entry.message && typeof entry.message === "object" ? entry.message : {};
+        if (entry.type === "assistant")
+            countObservedValue(models, message.model);
+    }
+    else if (entry.type === "session_meta") {
+        if (typeof payload.cli_version === "string")
+            version = newerVersion(version, payload.cli_version);
+    }
+    else if (entry.type === "turn_context") {
+        countObservedValue(models, payload.model);
+        countObservedValue(efforts, payload.effort);
+    }
+    return version;
+}
+function countObservedValue(map, value) {
+    if (typeof value === "string" && value && !value.startsWith("<"))
+        map.set(value, (map.get(value) ?? 0) + 1);
+}
 async function sampleFile(file) {
     let handle;
     try {
@@ -110,14 +114,17 @@ async function newestCodexFiles(home) {
     for (const year of await newestFirst(root))
         for (const month of await newestFirst(path.join(root, year)))
             for (const day of await newestFirst(path.join(root, year, month))) {
-                for (const name of await newestFirst(path.join(root, year, month, day)))
-                    if (name.endsWith(".jsonl") && files.length < TRANSCRIPT_FILES)
-                        files.push(path.join(root, year, month, day, name));
+                await collectCodexDayFiles(path.join(root, year, month, day), files);
                 if (files.length >= TRANSCRIPT_FILES)
                     return files;
             }
     return files;
 }
+async function collectCodexDayFiles(directory, files) {
+    for (const name of await (await entries(directory)).sort().reverse())
+        if (name.endsWith(".jsonl") && files.length < TRANSCRIPT_FILES)
+            files.push(path.join(directory, name));
+}
 /** Text samples of the newest transcripts of one tool in the last 30 days. Never throws. */
 export async function readTranscriptSamples(tool, home, now = Date.now()) {
     try {