@bli-cockpit/cli 0.2.237 → 0.2.238

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.237");
+    writeLine(io?.stdout ?? process.stdout, "0.2.238");
     return 0;
   }
 

package/dist/commands/session-sync-outside-roots.js

@@ -165,6 +165,45 @@ export async function admitOutsideRootSessions(options) {
     if (sightings.length === 0) {
         return { ...scan, outsideRoots: null };
     }
+    const { admitted, holds, counts, budget } = selectOutsideRootSessions(sightings, plan);
+    if (admitted.length === 0) {
+        console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "nothing_to_upload_outside_roots", ...counts, ...budget }));
+        return { ...scan, outsideRoots: { workspace: null, holds, counts } };
+    }
+    const workspace = outsideRootsWorkspace(options.homeDir);
+    try {
+        await ensureOutsideRootsWorkspace(workspace);
+    }
+    catch (error) {
+        // Not silent, and not a crash: every outside-root session keeps waiting and
+        // says why, and the in-root sessions of this tick are unaffected.
+        for (const sighting of admitted) {
+            holds.set(outsideRootKey(sighting.source, sighting.sessionId), "outside_root_workspace_unavailable");
+        }
+        console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "workspace_unavailable", ...counts, ...budget, ...describeError(error) }));
+        return { ...scan, outsideRoots: { workspace: null, holds, counts } };
+    }
+    const admittedKeys = new Set(admitted.map((sighting) => outsideRootKey(sighting.source, sighting.sessionId)));
+    const labelled = {
+        ...scan,
+        codexAttribution: {
+            ...scan.codexAttribution,
+            results: scan.codexAttribution.results.map((result) => admittedKeys.has(outsideRootKey("codex", result.codex_session_id)) && isUnclaimedOutsideRootResult(result)
+                ? { ...result, worktree: workspace }
+                : result),
+        },
+        claudeAttribution: {
+            ...scan.claudeAttribution,
+            results: scan.claudeAttribution.results.map((result) => admittedKeys.has(outsideRootKey("claude_code", result.claude_session_id)) && isUnclaimedOutsideRootResult(result)
+                ? { ...result, worktree: workspace }
+                : result),
+        },
+        outsideRoots: { workspace, holds, counts },
+    };
+    console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "outside_root_sessions_admitted", ...counts, ...budget }));
+    return labelled;
+}
+function selectOutsideRootSessions(sightings, plan) {
     const cursorFor = (source) => source === "codex" ? plan.codexCursorBefore : plan.claudeCursorBefore;
     const free = [];
     const owed = [];
@@ -207,42 +246,7 @@ export async function admitOutsideRootSessions(options) {
         bytes_per_tick: OUTSIDE_ROOT_BYTES_PER_TICK,
         objects_per_tick: OUTSIDE_ROOT_OBJECTS_PER_TICK,
     };
-    if (admitted.length === 0) {
-        console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "nothing_to_upload_outside_roots", ...counts, ...budget }));
-        return { ...scan, outsideRoots: { workspace: null, holds, counts } };
-    }
-    const workspace = outsideRootsWorkspace(options.homeDir);
-    try {
-        await ensureOutsideRootsWorkspace(workspace);
-    }
-    catch (error) {
-        // Not silent, and not a crash: every outside-root session keeps waiting and
-        // says why, and the in-root sessions of this tick are unaffected.
-        for (const sighting of admitted) {
-            holds.set(outsideRootKey(sighting.source, sighting.sessionId), "outside_root_workspace_unavailable");
-        }
-        console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "workspace_unavailable", ...counts, ...budget, ...describeError(error) }));
-        return { ...scan, outsideRoots: { workspace: null, holds, counts } };
-    }
-    const admittedKeys = new Set(admitted.map((sighting) => outsideRootKey(sighting.source, sighting.sessionId)));
-    const labelled = {
-        ...scan,
-        codexAttribution: {
-            ...scan.codexAttribution,
-            results: scan.codexAttribution.results.map((result) => admittedKeys.has(outsideRootKey("codex", result.codex_session_id)) && isUnclaimedOutsideRootResult(result)
-                ? { ...result, worktree: workspace }
-                : result),
-        },
-        claudeAttribution: {
-            ...scan.claudeAttribution,
-            results: scan.claudeAttribution.results.map((result) => admittedKeys.has(outsideRootKey("claude_code", result.claude_session_id)) && isUnclaimedOutsideRootResult(result)
-                ? { ...result, worktree: workspace }
-                : result),
-        },
-        outsideRoots: { workspace, holds, counts },
-    };
-    console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "outside_root_sessions_admitted", ...counts, ...budget }));
-    return labelled;
+    return { admitted, holds, counts, budget };
 }
 /**
  * Says why an outside-root session did not ride this tick, on its report row.

package/dist/commands/session-sync-plan.js

@@ -47,16 +47,7 @@ export async function planSyncFromLocalState(options) {
     const config = await readLocalCollectorConfig(options.paths).catch(() => null);
     const claudeEnabled = config?.collect_claude_jsonl !== false;
     const collectionRoots = normalizeCollectionRoots(options.approvedCollectionRoots ?? config?.default_repo_paths ?? []);
-    const [codexCursorBefore, claudeCursorBefore, uploadSpool, outsideRootCatchUpPending] = await Promise.all([
-        readRawEvidenceCursor(options.paths).catch(() => emptyRawEvidenceCursorState()),
-        claudeEnabled
-            ? readRawEvidenceCursor(options.paths, {
-                filename: CLAUDE_CURSOR_FILENAME,
-            }).catch(() => emptyRawEvidenceCursorState())
-            : Promise.resolve(emptyRawEvidenceCursorState()),
-        readLocalUploadSpoolState(options.paths).catch(() => null),
-        outsideRootCatchUpIsPending(options.paths),
-    ]);
+    const [codexCursorBefore, claudeCursorBefore, uploadSpool, outsideRootCatchUpPending] = await readSyncRetryState(options.paths, claudeEnabled);
     // A spooled upload from a CLI old enough not to have recorded its source
     // could have come from either one, so both sources own it until it clears.
     const legacyRetryPending = Boolean(uploadSpool?.pending_uploads.some((entry) => entry.raw_evidence_file_count > 0 && entry.retry_sources.length === 0));
@@ -78,6 +69,19 @@ export async function planSyncFromLocalState(options) {
         outsideRootCatchUpPending,
     };
 }
+async function readSyncRetryState(paths, claudeEnabled) {
+    const [codexCursorBefore, claudeCursorBefore, uploadSpool, outsideRootCatchUpPending] = await Promise.all([
+        readRawEvidenceCursor(paths).catch(() => emptyRawEvidenceCursorState()),
+        claudeEnabled
+            ? readRawEvidenceCursor(paths, {
+                filename: CLAUDE_CURSOR_FILENAME,
+            }).catch(() => emptyRawEvidenceCursorState())
+            : Promise.resolve(emptyRawEvidenceCursorState()),
+        readLocalUploadSpoolState(paths).catch(() => null),
+        outsideRootCatchUpIsPending(paths),
+    ]);
+    return [codexCursorBefore, claudeCursorBefore, uploadSpool, outsideRootCatchUpPending];
+}
 /**
  * How far back a retry-widened scan should reopen: the age of the oldest
  * undurable file this cursor is still carrying, plus a day of buffer — or

package/dist/commands/session-sync-upload.js

@@ -44,28 +44,7 @@ export async function syncEveryTargetWorktree(options) {
         items: syncWorktrees,
         shouldYield: run.yieldCheck,
         describe: (outcome) => ({ status: outcome.sync.status }),
-        runOne: (worktree) => {
-            // The outside-root pass has its own per-tick allowance (bytes and files),
-            // so a busy in-root tick cannot starve it and it cannot take in-root room.
-            if (isOutsideRootsWorkspace(worktree)) {
-                giveOutsideRootsTheirOwnAllowance(rawEvidenceBudget);
-            }
-            return syncOneWorktree({
-                run,
-                now: options.now,
-                plan: options.plan,
-                scan,
-                worktree,
-                syncWorktrees,
-                rawEvidenceBudget,
-                // A target git discovery never produced is one the fallback attribution
-                // synthesized, and it syncs through its own attributed work context.
-                isDiscoveredWorktree: discoveredWorktreeKeys.has(liveSyncTargetKey(worktree)),
-                recordDampedClaudeSession: (sessionId, priorPointer) => {
-                    dampedClaudePointers.set(sessionId, priorPointer);
-                },
-            });
-        },
+        runOne: (worktree) => syncTargetWithAllowance(options, worktree, syncWorktrees, rawEvidenceBudget, discoveredWorktreeKeys, dampedClaudePointers),
     });
     const outcomes = loop.results;
     const everyWorktreeUploaded = outcomes.every((outcome) => outcome.sync.status === "uploaded");
@@ -77,6 +56,29 @@ export async function syncEveryTargetWorktree(options) {
         yieldedWorktreesLeft: loop.left,
     };
 }
+function syncTargetWithAllowance(options, worktree, syncWorktrees, rawEvidenceBudget, discoveredWorktreeKeys, dampedClaudePointers) {
+    const { run, scan } = options;
+    // The outside-root pass has its own per-tick allowance (bytes and files),
+    // so a busy in-root tick cannot starve it and it cannot take in-root room.
+    if (isOutsideRootsWorkspace(worktree)) {
+        giveOutsideRootsTheirOwnAllowance(rawEvidenceBudget);
+    }
+    return syncOneWorktree({
+        run,
+        now: options.now,
+        plan: options.plan,
+        scan,
+        worktree,
+        syncWorktrees,
+        rawEvidenceBudget,
+        // A target git discovery never produced is one the fallback attribution
+        // synthesized, and it syncs through its own attributed work context.
+        isDiscoveredWorktree: discoveredWorktreeKeys.has(liveSyncTargetKey(worktree)),
+        recordDampedClaudeSession: (sessionId, priorPointer) => {
+            dampedClaudePointers.set(sessionId, priorPointer);
+        },
+    });
+}
 /** Every Claude session the cursor already holds a durable pointer for. */
 function claudeDurablePointersFromCursor(claudeCursorBefore) {
     const pointersBySessionId = new Map();

package/dist/commands/session-sync.js

@@ -108,14 +108,7 @@ export async function runAttributedWorktreeSync(options) {
         plan,
         scan,
     });
-    const ticketByWorktree = new Map();
-    for (const worktree of options.worktrees) {
-        const context = await readLocalWorkContextForRepo(paths, worktree.repo_root).catch(() => null);
-        const ticket = context?.linear_ticket_id ?? context?.active_ticket_id;
-        if (ticket)
-            ticketByWorktree.set(worktree.worktree_fingerprint, ticket);
-    }
-    console.error("[session-sync] bindings read", JSON.stringify({ bound_worktrees: ticketByWorktree.size, reason: "active_work_context" }));
+    const ticketByWorktree = await readWorktreeTickets(paths, options.worktrees);
     // BLI-13028: which commits each session's working tree created while it ran.
     // Read from the scan as it was BEFORE the outside-root step: the synthetic
     // workspace is not a git tree, and no commit belongs to it.
@@ -131,6 +124,21 @@ export async function runAttributedWorktreeSync(options) {
         now,
         claudePriorDurablePointers: worktreePass.claudePriorDurablePointers,
     }), commitsBySession), scan.outsideRoots?.holds);
+    reportCountedSessionFacts(sessions);
+    return finishAttributedSync(options, { paths, now, plan, scan, sessions, worktreePass });
+}
+async function readWorktreeTickets(paths, worktrees) {
+    const ticketByWorktree = new Map();
+    for (const worktree of worktrees) {
+        const context = await readLocalWorkContextForRepo(paths, worktree.repo_root).catch(() => null);
+        const ticket = context?.linear_ticket_id ?? context?.active_ticket_id;
+        if (ticket)
+            ticketByWorktree.set(worktree.worktree_fingerprint, ticket);
+    }
+    console.error("[session-sync] bindings read", JSON.stringify({ bound_worktrees: ticketByWorktree.size, reason: "active_work_context" }));
+    return ticketByWorktree;
+}
+function reportCountedSessionFacts(sessions) {
     // BLI-4341: every session should arrive counted. Say how many did, and say
     // it on the success path too: a silent drop from "all" to "some" is exactly
     // the kind of decay nobody notices.
@@ -141,6 +149,9 @@ export async function runAttributedWorktreeSync(options) {
         counted: sessionsCounted,
         tokens_total: sessions.reduce((total, session) => total + (session.session_facts?.total_tokens ?? 0), 0),
     }));
+}
+async function finishAttributedSync(options, context) {
+    const { paths, now, plan, scan, sessions, worktreePass } = context;
     const delivery = await reportSessionsAndAdvanceCursors({
         run: options,
         paths,

package/dist/commands/slack.js

@@ -31,21 +31,27 @@ export async function runSlack(command, io) {
             return writeCommandFailure(io, command.json, result);
         writeLine(io.stderr, `[slack cli] connection answered ${JSON.stringify({ action: command.action, workspace: command.workspace ?? "all", reason: "ok" })}`);
         const body = asRecord(result.body);
-        if (command.json)
-            writeLine(io.stdout, JSON.stringify(body));
-        else if (command.action === "disconnect")
-            writeLine(io.stdout, `Disconnected Slack for ${command.workspace}.`);
-        else
-            for (const connection of (body["connections"] ?? [])) {
-                if (!command.workspace || command.workspace === connection["workspace"])
-                    writeLine(io.stdout, `${connection["workspace"]}: ${connection["connected"] ? "connected" : "Connect Slack"} ${new URL(String(connection["connectPath"]), tower.dashboardUrl).toString()}`);
-            }
+        writeConnectionReply(command, io, body, tower.dashboardUrl);
         return 0;
     }
     return command.action === "coverage"
         ? runCoverageAction(command, io, tower)
         : runReadAction(command, io, tower);
 }
+function writeConnectionReply(command, io, body, dashboardUrl) {
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(body));
+        return;
+    }
+    if (command.action === "disconnect") {
+        writeLine(io.stdout, `Disconnected Slack for ${command.workspace}.`);
+        return;
+    }
+    for (const connection of (body["connections"] ?? [])) {
+        if (!command.workspace || command.workspace === connection["workspace"])
+            writeLine(io.stdout, `${connection["workspace"]}: ${connection["connected"] ? "connected" : "Connect Slack"} ${new URL(String(connection["connectPath"]), dashboardUrl).toString()}`);
+    }
+}
 async function runCoverageAction(command, io, tower) {
     const params = new URLSearchParams();
     if (command.workspace)
@@ -266,13 +272,7 @@ function writeReadReply(command, io, payload, read, messages) {
     else {
         if (messages.length > 0)
             writeLine(io.stdout, "");
-        for (const message of messages) {
-            writeLine(io.stdout, `#${String(message["channel"] ?? "?")}  ${String(message["author"] ?? "?")}  ${String(message["messageTs"] ?? "?")}`);
-            writeLine(io.stdout, `  ${String(message["text"] ?? "")}`);
-            if (typeof message["permalink"] === "string") {
-                writeLine(io.stdout, dim(`  ${message["permalink"]}`, styled));
-            }
-        }
+        writeExpandedMessages(io, messages, styled);
     }
     // A refusal's summary IS its note (tools-slack.ts `boundary`); print it once.
     if (typeof read["note"] === "string" && read["note"] && read["note"] !== header) {
@@ -280,6 +280,15 @@ function writeReadReply(command, io, payload, read, messages) {
         writeLine(io.stdout, dim(read["note"], styled));
     }
 }
+function writeExpandedMessages(io, messages, styled) {
+    for (const message of messages) {
+        writeLine(io.stdout, `#${String(message["channel"] ?? "?")}  ${String(message["author"] ?? "?")}  ${String(message["messageTs"] ?? "?")}`);
+        writeLine(io.stdout, `  ${String(message["text"] ?? "")}`);
+        if (typeof message["permalink"] === "string") {
+            writeLine(io.stdout, dim(`  ${message["permalink"]}`, styled));
+        }
+    }
+}
 function compactMessageLine(message) {
     return `- #${String(message["channel"] ?? "?")} — ${String(message["author"] ?? "?")} — `
         + `${String(message["messageTs"] ?? "?")} — "${String(message["text"] ?? "")}" — ${String(message["permalink"] ?? "")}`;

package/dist/commands/sources-check.js

@@ -37,7 +37,17 @@ export async function runSourcesCheck(command, io, now = new Date()) {
     const imageMode = await resolveImageHandlingMode(paths.state_dir);
     console.error("[collector sources] judging against this machine's image mode", JSON.stringify({ reason: `image_mode_from_${imageMode.source}`, mode: imageMode.mode, slim_aware: imageMode.slimAware }));
     const report = emptyReport(command, remote, local.newer_count, local.file_read_failed + local.directory_read_failed);
-    for (const file of local.files) {
+    await judgeLocalTranscripts(local.files, remote, cursors, imageMode, describedKeys, report);
+    reportSourcesCheck(report, remote, startedAt);
+    if (command.json)
+        writeLine(io.stdout, JSON.stringify(report, null, 2));
+    else
+        for (const line of sourcesCheckLines(report))
+            writeLine(io.stdout, line);
+    return 0;
+}
+async function judgeLocalTranscripts(files, remote, cursors, imageMode, describedKeys, report) {
+    for (const file of files) {
         const judged = await judgeSource({
             file,
             remotes: remote.files.get(file.key) ?? [],
@@ -67,6 +77,8 @@ export async function runSourcesCheck(command, io, now = new Date()) {
         });
     }
     report.files.sort((a, b) => VERDICTS.indexOf(a.verdict) - VERDICTS.indexOf(b.verdict) || a.path.localeCompare(b.path));
+}
+function reportSourcesCheck(report, remote, startedAt) {
     // Counts and bytes only: never a path, a session id or a byte of content.
     console.error("[collector sources] check", JSON.stringify({
         reason: `sources_check_${report.status}`,
@@ -83,12 +95,6 @@ export async function runSourcesCheck(command, io, now = new Date()) {
         reasons: report.reasons,
         elapsed_ms: Date.now() - startedAt,
     }));
-    if (command.json)
-        writeLine(io.stdout, JSON.stringify(report, null, 2));
-    else
-        for (const line of sourcesCheckLines(report))
-            writeLine(io.stdout, line);
-    return 0;
 }
 function emptyReport(command, remote, newerSkipped, unreadable) {
     const { files, ...remoteCounts } = remote;

package/dist/commands/sources-discovery.js

@@ -133,8 +133,26 @@ function trimmed(value) {
 export async function discoverLocalTranscripts(options) {
     const roots = sourcesRoots(options.homeDir);
     const result = { files: [], newer_count: 0, directory_read_failed: 0, file_read_failed: 0 };
-    const found = [];
     let firstFailure = null;
+    const recordFailure = (error) => { firstFailure ??= describeError(error); };
+    const found = await findTranscriptFiles(options, roots, result, recordFailure);
+    await nameTranscriptFiles(found, result, recordFailure);
+    if (result.directory_read_failed > 0 || result.file_read_failed > 0) {
+        console.error("[collector sources] some transcripts could not be read; they are left out of the answer", JSON.stringify({
+            reason: "sources_discovery_incomplete",
+            directory_read_failed: result.directory_read_failed,
+            file_read_failed: result.file_read_failed,
+            found_count: result.files.length,
+            ...(firstFailure ? { first_failure: firstFailure } : {}),
+        }));
+    }
+    return result;
+}
+function shapeOrder(shape) {
+    return shape.kind === "claude_main" ? 0 : shape.kind === "codex_rollout" ? 1 : 2;
+}
+async function findTranscriptFiles(options, roots, result, recordFailure) {
+    const found = [];
     const stack = [...roots.codex, roots.claudeProjects];
     const seen = new Set();
     while (stack.length > 0) {
@@ -146,7 +164,7 @@ export async function discoverLocalTranscripts(options) {
         catch (error) {
             if (error?.code !== "ENOENT") {
                 result.directory_read_failed += 1;
-                firstFailure ??= describeError(error);
+                recordFailure(error);
             }
             continue;
         }
@@ -164,7 +182,7 @@ export async function discoverLocalTranscripts(options) {
             seen.add(full);
             const stat = await fs.stat(full).catch((error) => {
                 result.file_read_failed += 1;
-                firstFailure ??= describeError(error);
+                recordFailure(error);
                 return null;
             });
             if (!stat)
@@ -176,6 +194,9 @@ export async function discoverLocalTranscripts(options) {
             found.push({ file: full, size: stat.size, mtimeMs: stat.mtimeMs, shape });
         }
     }
+    return found;
+}
+async function nameTranscriptFiles(found, result, recordFailure) {
     // Claude mains first, so a subagent file can take its main's content id.
     const claudeMainIds = new Map();
     found.sort((a, b) => shapeOrder(a.shape) - shapeOrder(b.shape) || a.file.localeCompare(b.file));
@@ -185,7 +206,7 @@ export async function discoverLocalTranscripts(options) {
         if (item.shape.kind !== "claude_subagent") {
             const read = await readContentSessionId(item.file, source).then((id) => ({ ok: true, id }), (error) => {
                 result.file_read_failed += 1;
-                firstFailure ??= describeError(error);
+                recordFailure(error);
                 return { ok: false, id: null };
             });
             if (!read.ok)
@@ -216,17 +237,4 @@ export async function discoverLocalTranscripts(options) {
             key: transcriptKeyFor(source, named.session_id, item.shape.kind === "claude_subagent" ? item.shape.sidecar_stem : null),
         });
     }
-    if (result.directory_read_failed > 0 || result.file_read_failed > 0) {
-        console.error("[collector sources] some transcripts could not be read; they are left out of the answer", JSON.stringify({
-            reason: "sources_discovery_incomplete",
-            directory_read_failed: result.directory_read_failed,
-            file_read_failed: result.file_read_failed,
-            found_count: result.files.length,
-            ...(firstFailure ? { first_failure: firstFailure } : {}),
-        }));
-    }
-    return result;
-}
-function shapeOrder(shape) {
-    return shape.kind === "claude_main" ? 0 : shape.kind === "codex_rollout" ? 1 : 2;
 }

package/dist/commands/sources-verdict.js

@@ -162,24 +162,7 @@ upload = {}) {
     const mode = upload.mode ?? IMAGE_HANDLING_MODE;
     const describedKeys = upload.describedKeys ?? new Set();
     const slimAware = upload.slimAware ?? mode === "describe_and_drop";
-    const redactForUpload = (text, original) => {
-        const result = sanitizeTextEvidenceForUpload({
-            text,
-            originalBytes: text === original.toString("utf8") ? original : Buffer.from(text, "utf8"),
-            redactedFields: [`${file.kind === "codex_rollout" ? "codex_jsonl" : file.kind === "claude_main" ? "claude_jsonl" : "claude_jsonl_sidecar"}.body`],
-            secretLikeFileName: isSecretLikePath(path.basename(file.file_path)),
-        });
-        const hash = sha256(result.bytes);
-        if (hash === REDACTION_STUB_SHA256)
-            return null;
-        // A whole-file mask is one 40-byte line, not the content: every copy Tower holds would look
-        // "at least as large" and read stored_full. No redacted form, so the raw size answers instead.
-        if (isWholeFileMask(result.bytes)) {
-            console.error("[sources-verdict] redacted form is the whole-file mask: judged by raw size", JSON.stringify({ reason: "whole_file_mask", source: file.source, file_bytes: file.byte_size }));
-            return null;
-        }
-        return { sha256: hash, byte_size: result.bytes.byteLength };
-    };
+    const redactForUpload = (text, original) => redactTranscriptForm(file, text, original);
     let split = null;
     let whole = null;
     let bytes = null;
@@ -230,6 +213,24 @@ upload = {}) {
         },
     };
 }
+function redactTranscriptForm(file, text, original) {
+    const result = sanitizeTextEvidenceForUpload({
+        text,
+        originalBytes: text === original.toString("utf8") ? original : Buffer.from(text, "utf8"),
+        redactedFields: [`${file.kind === "codex_rollout" ? "codex_jsonl" : file.kind === "claude_main" ? "claude_jsonl" : "claude_jsonl_sidecar"}.body`],
+        secretLikeFileName: isSecretLikePath(path.basename(file.file_path)),
+    });
+    const hash = sha256(result.bytes);
+    if (hash === REDACTION_STUB_SHA256)
+        return null;
+    // A whole-file mask is one 40-byte line, not the content: every copy Tower holds would look
+    // "at least as large" and read stored_full. No redacted form, so the raw size answers instead.
+    if (isWholeFileMask(result.bytes)) {
+        console.error("[sources-verdict] redacted form is the whole-file mask: judged by raw size", JSON.stringify({ reason: "whole_file_mask", source: file.source, file_bytes: file.byte_size }));
+        return null;
+    }
+    return { sha256: hash, byte_size: result.bytes.byteLength };
+}
 function sha256(buffer) {
     return crypto.createHash("sha256").update(buffer).digest("hex");
 }

package/dist/commands/speed.js

@@ -41,25 +41,7 @@ export async function runSpeed(command, io, deps = {}) {
         : everyPage;
     const results = [];
     for (const page of chosen) {
-        const samples = [];
-        for (let run = 0; run < runs; run += 1) {
-            const sample = await timeOneRead(page, { dashboardUrl, deviceToken: session.device_token, io, now, log });
-            samples.push(sample);
-            // A page this account may not open answers the same way every time.
-            if (classifyStatus(sample.status) === "not_permitted")
-                break;
-        }
-        const summary = summarizeSamples(page, samples);
-        results.push(summary);
-        log(`[speed cli] page measured ${JSON.stringify({
-            page: summary.page,
-            outcome: summary.outcome,
-            http_status: summary.http_status,
-            runs: samples.length,
-            failed_runs: summary.failed_runs,
-            p50_ms: summary.p50_ms,
-            ...(summary.reason ? { reason: summary.reason } : {}),
-        })}`);
+        results.push(await measurePage(page, runs, { dashboardUrl, deviceToken: session.device_token, io, now, log }));
     }
     const ranked = rankPages(results);
     const failed = ranked.filter((page) => page.outcome === "failed").length;
@@ -86,6 +68,28 @@ export async function runSpeed(command, io, deps = {}) {
     }
     return failed === 0 ? 0 : 1;
 }
+async function measurePage(page, runs, context) {
+    const { dashboardUrl, deviceToken, io, now, log } = context;
+    const samples = [];
+    for (let run = 0; run < runs; run += 1) {
+        const sample = await timeOneRead(page, { dashboardUrl, deviceToken, io, now, log });
+        samples.push(sample);
+        // A page this account may not open answers the same way every time.
+        if (classifyStatus(sample.status) === "not_permitted")
+            break;
+    }
+    const summary = summarizeSamples(page, samples);
+    log(`[speed cli] page measured ${JSON.stringify({
+        page: summary.page,
+        outcome: summary.outcome,
+        http_status: summary.http_status,
+        runs: samples.length,
+        failed_runs: summary.failed_runs,
+        p50_ms: summary.p50_ms,
+        ...(summary.reason ? { reason: summary.reason } : {}),
+    })}`);
+    return summary;
+}
 async function timeOneRead(page, context) {
     const startedAt = context.now();
     const answer = await towerRequest({

package/dist/commands/start.js

@@ -13,22 +13,7 @@ export async function runStart(command, io) {
     };
     const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
     if (worktrees.length > 1) {
-        const contexts = await Promise.all(worktrees.map((worktree) => startLocalWorkContext({
-            homeDir: command.homeDir,
-            repoRoot: worktree.repo_root,
-            branch: command.branch,
-            activeTicketId: command.activeTicketId,
-            ...ticketIds,
-            clearTicket: command.clearTicket,
-            topicLabel: command.topicLabel,
-            topicSummaryRedacted: command.topicSummaryRedacted,
-            workIntent: command.workIntent,
-            workPhase: command.workPhase,
-            intentSource: command.intentSource,
-            intentConfidence: command.intentConfidence,
-            operatorId: command.operatorId,
-            sessionId: command.sessionId,
-        })));
+        const contexts = await startDiscoveredWorktrees(command, ticketIds, worktrees);
         if (command.json) {
             writeLine(io.stdout, JSON.stringify({ mode: "multi_repo", contexts, ...(binding ? { ticket_binding: binding } : {}) }, null, 2));
             return 0;
@@ -56,6 +41,25 @@ export async function runStart(command, io) {
     writeLine(io.stdout, `Context: ${context.work_context_id}`);
     return 0;
 }
+async function startDiscoveredWorktrees(command, ticketIds, worktrees) {
+    const contexts = await Promise.all(worktrees.map((worktree) => startLocalWorkContext({
+        homeDir: command.homeDir,
+        repoRoot: worktree.repo_root,
+        branch: command.branch,
+        activeTicketId: command.activeTicketId,
+        ...ticketIds,
+        clearTicket: command.clearTicket,
+        topicLabel: command.topicLabel,
+        topicSummaryRedacted: command.topicSummaryRedacted,
+        workIntent: command.workIntent,
+        workPhase: command.workPhase,
+        intentSource: command.intentSource,
+        intentConfidence: command.intentConfidence,
+        operatorId: command.operatorId,
+        sessionId: command.sessionId,
+    })));
+    return contexts;
+}
 /**
  * Both trackers' ids when they are known, and the reason when one is not. A
  * lookup that resolved nothing still prints its sentence: a person who typed