@bli-cockpit/cli 0.2.237 → 0.2.238

package/dist/commands/local.js

@@ -1,10 +1,10 @@
 import { runOpsCommand } from "./local-run-ops.js";
 import { runGlossary } from "./glossary.js";
 import { runSpend } from "./spend.js";
-import { defaultIo, errorMessage, writeLine } from "./cli-io.js";
-import { isLocalHelpRequest, localCommandHelp, rootCommandNames } from "./local-help.js";
+import { defaultIo, writeLine } from "./cli-io.js";
+import { isLocalHelpRequest, localCommandHelp } from "./local-help.js";
 import { beginStage, endStage } from "../crash-guard.js";
-import { describeError } from "../health-detail.js";
+import { reportCommandFailure, refuseArguments, stripGlobalToggles, watchWrites } from "./local-run-guards.js";
 import { reportInstallEventsBestEffort } from "./install-receipts.js";
 import { persistOnboardingRootConfig, resolveOnboardingRootsForCommand, } from "./collection-roots.js";
 import { rememberDiscoveryLimits } from "./local-discovery.js";
@@ -70,29 +70,36 @@ export { classifySyncFailureRecords, classifySyncHealthError, redactedSyncErrorD
 export { assertCollectionRootPersisted } from "./collection-roots.js";
 export { runSelfUpdate, SelfUpdateError, } from "./install-update.js";
 import { runRoots } from "./roots.js";
+/** Commands that act on THIS machine; the rest talk to Tower. */
+const MACHINE_COMMAND_KINDS = [
+    "roots",
+    "install",
+    "onboard",
+    "update",
+    "doctor",
+    "login",
+    "logout",
+    "start",
+    "sync",
+    "analyze",
+    "backfill",
+    "status",
+    "sessions",
+    "serve",
+    "autostart",
+    "agent-rules",
+    "memory-log",
+    "memory",
+    "memory-store",
+    "clean",
+    "sources",
+    "release",
+];
+function isMachineCommand(command) {
+    return MACHINE_COMMAND_KINDS.includes(command.kind);
+}
 export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorAfterSync }) {
-    // BLI-10450: `--quiet` is a global toggle, stripped here so no per-command
-    // parser's `allowedFlags` needs to learn it, and mirrored onto
-    // `COCKPIT_QUIET` so `tower-client.ts` can react without every call site
-    // threading a flag through. `--json` already implies it (tower-client.ts).
-    if (argv.includes("--quiet")) {
-        argv = argv.filter((token) => token !== "--quiet");
-        process.env.COCKPIT_QUIET = "1";
-    }
-    // BLI-10746: `--fresh`/`--allow-stale` are global toggles for the
-    // stale-while-revalidate read cache, same reason and same shape as
-    // `--quiet` above — stripped here so none of the seven cached read
-    // commands' own `allowedFlags` needs to learn them, and mirrored onto
-    // env vars `read-cache.ts` reads. One `cockpit` process makes at most one
-    // cacheable request, so a process-wide toggle is exactly a per-request one.
-    if (argv.includes("--fresh")) {
-        argv = argv.filter((token) => token !== "--fresh");
-        process.env.COCKPIT_READ_FRESH = "1";
-    }
-    if (argv.includes("--allow-stale")) {
-        argv = argv.filter((token) => token !== "--allow-stale");
-        process.env.COCKPIT_READ_ALLOW_STALE = "1";
-    }
+    argv = stripGlobalToggles(argv);
     if (isLocalHelpRequest(argv)) {
         writeLine(io.stdout, localCommandHelp(argv[0]));
         return 0;
@@ -102,29 +109,7 @@ export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorA
         command = parseLocalArgs(argv);
     }
     catch (error) {
-        // BLI-10431: under --json a refused parse still owes stdout one object.
-        // It used to write nothing there, so `cockpit usage sessions --json`
-        // without a filter read to an agent as an empty answer, not a refusal.
-        if (argv.includes("--json")) {
-            writeLine(io.stdout, JSON.stringify({
-                ok: false,
-                error: "invalid_arguments",
-                command: argv[0] ?? "",
-                detail: errorMessage(error),
-            }));
-        }
-        console.error("[cockpit-cli] arguments refused", JSON.stringify({ reason: "invalid_arguments", command: argv[0] ?? "", json: argv.includes("--json") }));
-        writeLine(io.stderr, errorMessage(error));
-        writeLine(io.stderr, "");
-        // A refused `cockpit cal create --meet` used to print its one correct
-        // reason line and then the WHOLE collector wall — onboard, update, forty
-        // more — so the reason drowned and Edward read it as "it just shows usage"
-        // (2026-09-06). A parse error on a KNOWN command gets that command's own
-        // manual, which names the flags the reason line just asked for; only an
-        // unknown command earns the wall.
-        const command = argv[0];
-        writeLine(io.stderr, command && rootCommandNames.has(command) ? localCommandHelp(command) : localCommandHelp());
-        return 1;
+        return refuseArguments(argv, error, io);
     }
     // A limit typed on the command line is remembered for every later run,
     // including the scheduled one nobody types into (BLI-2362). Done here so it
@@ -141,150 +126,117 @@ export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorA
     if (stdoutWatch)
         io = { ...io, stdout: stdoutWatch.stream };
     try {
-        switch (command.kind) {
-            case "roots": return await runRoots(command, io);
-            case "install":
-                return await runInstall(command, io);
-            case "onboard":
-                return await runOnboard(command, io);
-            case "update":
-                return await runUpdate(command, io);
-            case "doctor":
-                return await runDoctor(command, io, {
-                    reportInstallEvents: reportInstallEventsBestEffort,
-                    selfUpdate: runSelfUpdate,
-                    runLogin: runDoctorLogin,
-                    resolveAndSaveRoots: resolveAndSaveDoctorRoots,
-                });
-            case "login":
-                return await runLogin(command, io);
-            case "logout":
-                return await runLogout(command, io);
-            case "start":
-                return await runStart(command, io);
-            case "sync":
-                return await runSync(command, io);
-            case "analyze":
-                return await runAnalyze(command, io);
-            case "jarvis":
-                return await runJarvis(command, io);
-            case "model":
-                return await runModel(command, io);
-            case "models":
-                return await runModels(command, io);
-            case "scout":
-            case "ci":
-            case "ops":
-                return await runOpsCommand(command, io);
-            case "slack":
-                return await runSlack(command, io);
-            case "settings":
-                return await runSettings(command, io);
-            case "team":
-                return await runTeam(command, io);
-            case "workbook":
-                return await runWorkbook(command, io);
-            case "brief":
-                // BLI-3458 S2.7/S2.8: `edit` and `rewrite` are the two PANEL actions
-                // reaching the terminal. Dispatched here rather than inside `brief.ts`
-                // so each one stays its own module — `brief.ts` owns reading and
-                // nothing else.
-                if (command.action === "edit")
-                    return await runBriefEdit(command, io);
-                if (command.action === "rewrite")
-                    return await runBriefRewrite(command, io);
-                // BLI-3605: the board's done checkbox, at a terminal.
-                if (command.action === "done" || command.action === "undone") {
-                    return await runBriefDone(command, io);
-                }
-                return await runBrief(command, io);
-            case "correct":
-                return await runCorrect(command, io);
-            case "notes":
-                return await runNotes(command, io);
-            case "backfill":
-                return await runBackfillCommand(command, io);
-            case "status":
-                return await runStatus(command, io);
-            case "sessions":
-                return await runSessions(command, io);
-            case "serve":
-                return await runServe(command, io);
-            case "autostart":
-                return await runAutostart(command, io);
-            case "agent-rules":
-                return await runAgentRules(command, io);
-            case "memory-log":
-                return await runMemoryLog(command, io);
-            case "memory":
-                // BLI-4047: a bare `cockpit memory` says what the noun does. It used
-                // to install; `install` is still one word away and every unattended
-                // caller asks for it by name in code.
-                if (command.action === "help")
-                    return runMemoryVerbList(io, command.json);
-                return await runMemoryInstall(command, io);
-            case "memory-store":
-                return await runMemoryStore(command, io);
-            case "clean":
-                return await runClean(command, io);
-            case "sources":
-                return await runSourcesCheck(command, io);
-            case "glossary":
-                return await runGlossary(command, io);
-            case "spend": return await runSpend(command, io);
-            case "docs": return await runDocs(command, io);
-            case "msg": return await runMsg(command, io);
-            case "issue": return await runIssue(command, io);
-            case "cal": return runCal(command, io);
-            case "mail": return await runMail(command, io);
-            case "project": return await runProject(command, io);
-            case "search": return await runSearch(command, io);
-            case "github": return await runGithub(command, io);
-            case "release": return await runRelease(command, io);
-            case "careers": return await runCareers(command, io);
-            case "rename": return await runRename(command, io);
-            case "setup": return await runSetup(command, io);
-            case "usage": return await runUsage(command, io);
-            case "speed": return await runSpeed(command, io);
-            case "logs": return await runLogs(command, io);
-            case "brain": return await runBrain(command, io);
-            case "hits": return await runHits(command, io);
-            case "intentions": return await runIntentions(command, io);
-            case "who": return await runWho(command, io);
-            case "people": return await runPeople(command, io);
-            case "approvals": return await runApprovals(command, io);
-            case "drills": return await runDrills(command, io);
-            case "manager": return await runManager(command, io);
-            case "image": return await runImage(command, io);
-        }
+        // Not awaited, as it never was: a `cal` rejection bypasses the net below.
+        if (command.kind === "cal")
+            return runCal(command, io);
+        if (isMachineCommand(command))
+            return await runMachineCommand(command, io);
+        return await runTowerCommand(command, io);
     }
     catch (error) {
-        // The outermost net under every subcommand. It printed `error.message` and
-        // dropped the name, the code, the syscall and the cause — and never said
-        // WHICH subcommand died, so a scheduled `cockpit sync` and a hand-typed
-        // `cockpit doctor` failing the same way were indistinguishable in
-        // sync.err.log (BLI-3483). The human line is unchanged; the structured one
-        // beside it carries names and codes only, scrubbed by `describeError`.
-        console.error("[cockpit-cli] command failed", JSON.stringify({
-            reason: "command_failed",
-            command: command.kind,
-            ...describeError(error),
-        }));
-        if (stdoutWatch && !stdoutWatch.written()) {
-            writeLine(io.stdout, JSON.stringify({
-                ok: false,
-                error: "command_failed",
-                command: command.kind,
-                detail: errorMessage(error),
-            }));
-        }
-        writeLine(io.stderr, errorMessage(error));
-        return 1;
+        return reportCommandFailure(command, error, io, stdoutWatch);
     }
     finally {
         endStage(`command:${command.kind}`);
     }
 }
+async function runMachineCommand(command, io) {
+    switch (command.kind) {
+        case "roots": return await runRoots(command, io);
+        case "install": return await runInstall(command, io);
+        case "onboard": return await runOnboard(command, io);
+        case "update": return await runUpdate(command, io);
+        case "doctor":
+            return await runDoctor(command, io, {
+                reportInstallEvents: reportInstallEventsBestEffort,
+                selfUpdate: runSelfUpdate,
+                runLogin: runDoctorLogin,
+                resolveAndSaveRoots: resolveAndSaveDoctorRoots,
+            });
+        case "login": return await runLogin(command, io);
+        case "logout": return await runLogout(command, io);
+        case "start": return await runStart(command, io);
+        case "sync": return await runSync(command, io);
+        case "analyze": return await runAnalyze(command, io);
+        case "backfill": return await runBackfillCommand(command, io);
+        case "status": return await runStatus(command, io);
+        case "sessions": return await runSessions(command, io);
+        case "serve": return await runServe(command, io);
+        case "autostart": return await runAutostart(command, io);
+        case "agent-rules": return await runAgentRules(command, io);
+        case "memory-log": return await runMemoryLog(command, io);
+        case "memory":
+            // BLI-4047: a bare `cockpit memory` says what the noun does. It used
+            // to install; `install` is still one word away and every unattended
+            // caller asks for it by name in code.
+            if (command.action === "help")
+                return runMemoryVerbList(io, command.json);
+            return await runMemoryInstall(command, io);
+        case "memory-store": return await runMemoryStore(command, io);
+        case "clean": return await runClean(command, io);
+        case "sources": return await runSourcesCheck(command, io);
+        case "release": return await runRelease(command, io);
+    }
+}
+async function runTowerCommand(command, io) {
+    switch (command.kind) {
+        case "jarvis": return await runJarvis(command, io);
+        case "model": return await runModel(command, io);
+        case "models": return await runModels(command, io);
+        case "scout":
+        case "ci":
+        case "ops":
+            return await runOpsCommand(command, io);
+        case "slack": return await runSlack(command, io);
+        case "settings": return await runSettings(command, io);
+        case "team": return await runTeam(command, io);
+        case "workbook": return await runWorkbook(command, io);
+        case "brief": return await runBriefVerb(command, io);
+        case "correct": return await runCorrect(command, io);
+        case "notes": return await runNotes(command, io);
+        case "glossary": return await runGlossary(command, io);
+        case "spend": return await runSpend(command, io);
+        case "docs": return await runDocs(command, io);
+        case "msg": return await runMsg(command, io);
+        case "issue": return await runIssue(command, io);
+        case "mail": return await runMail(command, io);
+        case "project": return await runProject(command, io);
+        case "search": return await runSearch(command, io);
+        case "github": return await runGithub(command, io);
+        case "careers": return await runCareers(command, io);
+        case "rename": return await runRename(command, io);
+        case "setup": return await runSetup(command, io);
+        case "usage": return await runUsage(command, io);
+        case "speed": return await runSpeed(command, io);
+        case "logs": return await runLogs(command, io);
+        case "brain": return await runBrain(command, io);
+        case "hits": return await runHits(command, io);
+        case "intentions": return await runIntentions(command, io);
+        case "who": return await runWho(command, io);
+        case "people": return await runPeople(command, io);
+        case "approvals": return await runApprovals(command, io);
+        case "drills": return await runDrills(command, io);
+        case "manager": return await runManager(command, io);
+        case "image": return await runImage(command, io);
+    }
+}
+/**
+ * BLI-3458 S2.7/S2.8: `edit` and `rewrite` are the two PANEL actions
+ * reaching the terminal. Dispatched here rather than inside `brief.ts`
+ * so each one stays its own module — `brief.ts` owns reading and
+ * nothing else.
+ */
+async function runBriefVerb(command, io) {
+    if (command.action === "edit")
+        return await runBriefEdit(command, io);
+    if (command.action === "rewrite")
+        return await runBriefRewrite(command, io);
+    // BLI-3605: the board's done checkbox, at a terminal.
+    if (command.action === "done" || command.action === "undone") {
+        return await runBriefDone(command, io);
+    }
+    return await runBrief(command, io);
+}
 async function runDoctorLogin(command, io) {
     return runLogin({
         kind: "login",
@@ -311,25 +263,4 @@ async function resolveAndSaveDoctorRoots(command, io) {
     if (!command.json) {
         writeLine(io.stdout, `Saved collection roots: ${resolution.collectionRoots.join(", ")}`);
     }
-}
-/**
- * The same stream, with a flag that flips on the first write. A Proxy rather
- * than a copied object so `isTTY`, `columns` and every listener method still
- * reach the real stream.
- */
-function watchWrites(stream) {
-    let wrote = false;
-    const watched = new Proxy(stream, {
-        get(target, property) {
-            if (property === "write") {
-                return (...args) => {
-                    wrote = true;
-                    return target.write.apply(target, args);
-                };
-            }
-            const value = Reflect.get(target, property, target);
-            return typeof value === "function" ? value.bind(target) : value;
-        },
-    });
-    return { stream: watched, written: () => wrote };
 }

package/dist/commands/login.js

@@ -33,6 +33,18 @@ export async function runLogin(command, io) {
         if (command.pairCode)
             return 1;
     }
+    const result = await pairByDashboardApproval(command, dashboardUrl, io);
+    reportPaired(command, io, {
+        email: result.session.email ?? result.session.auth_subject_id,
+        deviceName: result.session.device_name ?? result.session.device_id ?? "unknown",
+        sessionFile: result.session_file,
+        json: result,
+    });
+    writeNextStep(command, io, config.default_repo_paths.length > 0);
+    return 0;
+}
+/** The legacy arm: sign in by email, then wait for the person to approve the device in the dashboard. */
+async function pairByDashboardApproval(command, dashboardUrl, io) {
     const claimedOwnerEmail = await resolveInteractiveLoginEmail(command, io);
     const pairingAccessToken = await requestPairingAccessToken({
         dashboardUrl,
@@ -40,7 +52,7 @@ export async function runLogin(command, io) {
         noAuth: command.noAuth,
         json: command.json,
     }, io);
-    const result = await pairLocalCollectorWithAuthFallback({
+    return await pairLocalCollectorWithAuthFallback({
         homeDir: command.homeDir,
         dashboardUrl,
         claimedOwnerEmail,
@@ -58,14 +70,6 @@ export async function runLogin(command, io) {
                 writeLine(io.stdout, "Waiting for dashboard approval...");
             },
     }, io);
-    reportPaired(command, io, {
-        email: result.session.email ?? result.session.auth_subject_id,
-        deviceName: result.session.device_name ?? result.session.device_id ?? "unknown",
-        sessionFile: result.session_file,
-        json: result,
-    });
-    writeNextStep(command, io, config.default_repo_paths.length > 0);
-    return 0;
 }
 /**
  * The one-link ceremony. Returns null when it could not finish, having already

package/dist/commands/logs.js

@@ -30,15 +30,8 @@ function refuse(io, json, reason, detail) {
     return 1;
 }
 export async function runLogs(command, io, deps = {}) {
-    if (command.keyAction) {
-        const tower = await openTower("logs keys", command, io);
-        const result = await callTower(tower, { path: "/api/settings/log-ingest-keys", method: "POST", body: { source: command.source, action: command.keyAction }, label: "logs keys" });
-        if (!result.ok)
-            return writeCommandFailure(io, command.json, result);
-        // Deliberate one-time credential output; never stderr, cache or log.
-        writeLine(io.stdout, command.json ? JSON.stringify(result.body) : String(asRecord(result.body).key));
-        return 0;
-    }
+    if (command.keyAction)
+        return mintLogKey(command, io, command.keyAction);
     if (command.search)
         return runLogsSearch(command, io);
     // BLI-12855: a project name (or --stored, or --list) reads the digests Tower's cron stored, not a local log.
@@ -46,52 +39,76 @@ export async function runLogs(command, io, deps = {}) {
     if (command.list || stored)
         return runStoredLogs(command, io, { project: stored ?? "tower" });
     const paths = getCollectorRuntimePaths(command.homeDir);
-    let table;
-    if (command.tableFile) {
-        try {
-            table = ClassTable.fromJson(await readFile(command.tableFile, "utf8"));
-        }
-        catch (error) {
-            return refuse(io, command.json, "table_unreadable", `--table ${command.tableFile} is not a readable class table: ${error instanceof Error ? error.message.slice(0, 160) : "unknown error"}`);
-        }
-    }
-    let stdinText;
+    const tableRead = await readClassTable(command, io);
+    if ("exitCode" in tableRead)
+        return tableRead.exitCode;
     const stdinIsTerminal = command.source === "-" && isInteractiveStdin(io);
-    if (command.source === "-" && !stdinIsTerminal) {
-        try {
-            stdinText = await readPipedText(io.stdin, { maxChars: MAX_STDIN_CHARS, overflowMessage: "logs - reads at most 64 MB of piped lines." });
-        }
-        catch (error) {
-            return refuse(io, command.json, "stdin_too_large", error instanceof Error ? error.message : "stdin could not be read");
-        }
-    }
+    const stdinRead = await readPipedLogs(command, io, stdinIsTerminal);
+    if ("exitCode" in stdinRead)
+        return stdinRead.exitCode;
     const outcome = await digestSource({
         source: command.source,
         since: command.since,
         raw: command.raw,
         rawLimit: command.rawLimit,
-        table,
+        table: tableRead.value,
         allLevels: command.allLevels,
     }, {
         stateDir: paths.state_dir,
-        stdinText,
+        stdinText: stdinRead.value,
         stdinIsTerminal,
         run: deps.run,
         nowMs: deps.nowMs,
         log: (message, fields) => writeLine(io.stderr, `${message} ${JSON.stringify(fields)}`),
     });
-    if (!outcome.ok && LOCAL_ACCESS_REFUSALS.has(outcome.reason) && (command.source === "dashboard" || command.source === "railway") && !command.raw) {
-        // No local access to the platform: say so, then answer from what the cron stored (a refusal of its own if this machine is not paired).
-        writeLine(io.stderr, `${TAG} local source unreadable, reading the stored digest ${JSON.stringify({ reason: outcome.reason })}`);
-        return runStoredLogs(command, io, {
-            project: "tower",
-            fallbackReason: outcome.reason,
-            // The person asked for a local read: if the stored digest is out of reach too, the local refusal is the answer.
-            onNotPaired: () => refuse(io, command.json, outcome.reason, `${outcome.detail} This machine is not paired with Tower (cockpit login), so the stored digest could not be read either.`),
-        });
+    if (!outcome.ok && canFallBackToStoredDigest(command, outcome)) {
+        return answerFromStoredDigest(command, io, outcome);
     }
     if (!outcome.ok)
         return refuse(io, command.json, outcome.reason, outcome.detail);
     writeLine(io.stdout, command.json ? JSON.stringify(outcome) : outcome.text);
     return 0;
+}
+async function mintLogKey(command, io, keyAction) {
+    const tower = await openTower("logs keys", command, io);
+    const result = await callTower(tower, { path: "/api/settings/log-ingest-keys", method: "POST", body: { source: command.source, action: keyAction }, label: "logs keys" });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    // Deliberate one-time credential output; never stderr, cache or log.
+    writeLine(io.stdout, command.json ? JSON.stringify(result.body) : String(asRecord(result.body).key));
+    return 0;
+}
+async function readClassTable(command, io) {
+    if (!command.tableFile)
+        return { value: undefined };
+    try {
+        return { value: ClassTable.fromJson(await readFile(command.tableFile, "utf8")) };
+    }
+    catch (error) {
+        return { exitCode: refuse(io, command.json, "table_unreadable", `--table ${command.tableFile} is not a readable class table: ${error instanceof Error ? error.message.slice(0, 160) : "unknown error"}`) };
+    }
+}
+/** The piped lines for `logs -`; nothing to read when the source is not stdin or stdin is a terminal. */
+async function readPipedLogs(command, io, stdinIsTerminal) {
+    if (command.source !== "-" || stdinIsTerminal)
+        return { value: undefined };
+    try {
+        return { value: await readPipedText(io.stdin, { maxChars: MAX_STDIN_CHARS, overflowMessage: "logs - reads at most 64 MB of piped lines." }) };
+    }
+    catch (error) {
+        return { exitCode: refuse(io, command.json, "stdin_too_large", error instanceof Error ? error.message : "stdin could not be read") };
+    }
+}
+function canFallBackToStoredDigest(command, refusal) {
+    return LOCAL_ACCESS_REFUSALS.has(refusal.reason) && (command.source === "dashboard" || command.source === "railway") && !command.raw;
+}
+function answerFromStoredDigest(command, io, refusal) {
+    // No local access to the platform: say so, then answer from what the cron stored (a refusal of its own if this machine is not paired).
+    writeLine(io.stderr, `${TAG} local source unreadable, reading the stored digest ${JSON.stringify({ reason: refusal.reason })}`);
+    return runStoredLogs(command, io, {
+        project: "tower",
+        fallbackReason: refusal.reason,
+        // The person asked for a local read: if the stored digest is out of reach too, the local refusal is the answer.
+        onNotPaired: () => refuse(io, command.json, refusal.reason, `${refusal.detail} This machine is not paired with Tower (cockpit login), so the stored digest could not be read either.`),
+    });
 }

package/dist/commands/mail-attachments.js

@@ -116,14 +116,48 @@ function totalTooLarge(total) {
 export async function readMailAttachments(paths) {
     if (paths.length === 0)
         return { ok: true, attachments: [], summary: { count: 0, bytes: 0, sizes: [], content_types: [] } };
+    const refusedByName = refuseByCountOrName(paths);
+    if (refusedByName)
+        return refusedByName;
+    const statted = await statEveryAttachment(paths);
+    if (!statted.ok)
+        return statted;
+    const tooLarge = totalTooLarge(statted.sizes.reduce((sum, size) => sum + size, 0));
+    if (tooLarge)
+        return tooLarge;
+    const read = await readEveryAttachment(paths);
+    if (!read.ok)
+        return read;
+    // A file that grew between the stat and the read is the file as it is now.
+    const total = read.sizes.reduce((sum, size) => sum + size, 0);
+    const grew = totalTooLarge(total);
+    if (grew)
+        return grew;
+    if (read.sizes.includes(0)) {
+        return refuse("attachment_unreadable", `Attachment ${read.sizes.indexOf(0) + 1} is empty, and an empty file is not worth sending. ${NOTHING_SENT}`);
+    }
+    return {
+        ok: true,
+        attachments: read.attachments,
+        summary: {
+            count: read.attachments.length,
+            bytes: total,
+            sizes: read.sizes,
+            content_types: read.attachments.map((attachment) => attachment.content_type),
+        },
+    };
+}
+function refuseByCountOrName(paths) {
     if (paths.length > MAIL_ATTACHMENT_MAX_COUNT) {
         return refuse("too_many_attachments", `${paths.length} files were named with --attach and one message carries at most ${MAIL_ATTACHMENT_MAX_COUNT}. ${NOTHING_SENT}`);
     }
     // Names first, before a single stat or read: a secret-looking file is never opened.
     const secret = paths.findIndex((filePath) => attachmentLooksSecret(path.basename(filePath)));
-    if (secret !== -1) {
-        return refuse("attachment_secret_like", `Attachment ${secret + 1} has a name that looks like a key or credential file, so it was not opened. ${NOTHING_SENT}`);
-    }
+    if (secret === -1)
+        return null;
+    return refuse("attachment_secret_like", `Attachment ${secret + 1} has a name that looks like a key or credential file, so it was not opened. ${NOTHING_SENT}`);
+}
+async function statEveryAttachment(paths) {
     const sizes = [];
     for (const [index, filePath] of paths.entries()) {
         const label = `Attachment ${index + 1}`;
@@ -144,11 +178,12 @@ export async function readMailAttachments(paths) {
             return refuse("attachment_unreadable", `${label} is empty, and an empty file is not worth sending. ${NOTHING_SENT}`);
         sizes.push(size);
     }
-    const tooLarge = totalTooLarge(sizes.reduce((sum, size) => sum + size, 0));
-    if (tooLarge)
-        return tooLarge;
+    return { ok: true, sizes };
+}
+/** The files as they are now: their wire form, and the byte count each one really had. */
+async function readEveryAttachment(paths) {
     const attachments = [];
-    const actual = [];
+    const sizes = [];
     for (const [index, filePath] of paths.entries()) {
         let bytes;
         try {
@@ -158,7 +193,7 @@ export async function readMailAttachments(paths) {
             const code = error.code;
             return refuse("attachment_unreadable", `Attachment ${index + 1} could not be read (${code ?? "unknown error"}). ${NOTHING_SENT}`);
         }
-        actual.push(bytes.length);
+        sizes.push(bytes.length);
         const filename = path.basename(filePath);
         attachments.push({
             filename,
@@ -166,24 +201,7 @@ export async function readMailAttachments(paths) {
             content_base64: bytes.toString("base64"),
         });
     }
-    // A file that grew between the stat and the read is the file as it is now.
-    const total = actual.reduce((sum, size) => sum + size, 0);
-    const grew = totalTooLarge(total);
-    if (grew)
-        return grew;
-    if (actual.includes(0)) {
-        return refuse("attachment_unreadable", `Attachment ${actual.indexOf(0) + 1} is empty, and an empty file is not worth sending. ${NOTHING_SENT}`);
-    }
-    return {
-        ok: true,
-        attachments,
-        summary: {
-            count: attachments.length,
-            bytes: total,
-            sizes: actual,
-            content_types: attachments.map((attachment) => attachment.content_type),
-        },
-    };
+    return { ok: true, attachments, sizes };
 }
 /**
  * The second check: the whole request, not just the files. Called with the JSON