@bli-cockpit/cli 0.2.242 → 0.2.243

package/dist/commands/work-notify.js

@@ -0,0 +1,63 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { READ_DEADLINE_MS, WRITE_DEADLINE_MS } from "./issue-contracts.js";
+const TAG = "[ticket notifications cli]";
+function writeSettings(door, settings) {
+    const out = door.io.stdout;
+    writeLine(out, `Slack delivery: ${settings.slack_enabled ? "on" : "off"}${settings.slack_enabled_at && settings.slack_enabled ? ` (since ${settings.slack_enabled_at})` : ""}`);
+    if (settings.slack_linked === null)
+        writeLine(out, `Slack account: could not check (${settings.slack_linked_reason ?? "unknown"}).`);
+    else
+        writeLine(out, settings.slack_linked ? "Slack account: linked." : "Slack account: none linked, so delivery would fail with slack_identity_missing.");
+}
+export async function runWorkNotify(command, io, door) {
+    void io;
+    const notify = command.notify;
+    if (notify.sub === "receipts") {
+        const query = new URLSearchParams();
+        if (notify.notification)
+            query.set("notification_id", notify.notification);
+        if (notify.before)
+            query.set("before", notify.before);
+        if (notify.limit !== undefined)
+            query.set("limit", String(notify.limit));
+        const suffix = query.toString();
+        const answer = await askAgentDoor(door, {
+            path: `/api/work/notifications/receipts${suffix ? `?${suffix}` : ""}`,
+            method: "GET",
+            label: "ticket notifications receipts",
+            timeoutMs: READ_DEADLINE_MS,
+        });
+        if (!answer.ok)
+            return failAgentDoor(door, TAG, answer.reason, answer.detail);
+        const body = answer.body;
+        if (door.json)
+            return emitAgentDoor(door, { ok: true, ...body });
+        const receipts = body.receipts ?? [];
+        if (receipts.length === 0)
+            writeLine(door.io.stdout, "No delivery receipts yet.");
+        for (const receipt of receipts) {
+            writeLine(door.io.stdout, `${receipt.id}  ${receipt.outcome.padEnd(10)}  ${(receipt.reason ?? "-").padEnd(22)}  ${(receipt.identifier ?? "(ticket not readable)").padEnd(9)}  ${receipt.created_at}`);
+        }
+        if (body.has_more && body.next_cursor)
+            writeLine(door.io.stdout, `More receipts available. Continue with --before ${body.next_cursor}`);
+        return 0;
+    }
+    const setting = notify.sub === "set";
+    const answer = await askAgentDoor(door, {
+        path: "/api/work/notifications/settings",
+        method: setting ? "PUT" : "GET",
+        label: setting ? "ticket notifications set" : "ticket notifications",
+        timeoutMs: setting ? WRITE_DEADLINE_MS : READ_DEADLINE_MS,
+        ...(setting ? { body: { slack_enabled: notify.slackEnabled } } : {}),
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    console.error(`${TAG} ${setting ? "set" : "read"} done`, JSON.stringify({ slack_enabled: body.settings?.slack_enabled }));
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...body });
+    if (body.settings)
+        writeSettings(door, body.settings);
+    return 0;
+}

package/dist/delivery-hold-notice.js

@@ -163,4 +163,38 @@ function reasonWord(reason, budget) {
     if (safe.length === 0)
         return ABSENT;
     return safe.slice(0, budget);
+}
+/**
+ * Ticket 21952: the per-tick SIZE BUDGET's hold, the second token this file owns.
+ *
+ * A tick that sent some evidence and held the rest for the next tick reports
+ * `ok` with this token instead of failing, because overflow defers and converges
+ * by design. The collector writes it and the fleet board reads it
+ * (`apps/dashboard/src/lib/ops/fleet-budget-hold.ts`), which turns a hold that
+ * never drains into a RED row, so a growing backlog cannot stay green.
+ *
+ *     held_budget:<held objects>:<held MiB>:<sent MiB>
+ *     held_budget:3:901:2043
+ */
+export const BUDGET_HOLD_NOTICE_PREFIX = "held_budget";
+const MIB = 1024 * 1024;
+/** Render the size-budget hold, or null for a hold of nothing. Held MiB rounds up so a held byte never reads as 0. */
+export function formatBudgetHoldNotice(use) {
+    if (use.deferredObjects <= 0)
+        return null;
+    const heldMib = Math.ceil(Math.max(0, use.deferredBytes) / MIB);
+    const sentMib = Math.round(Math.max(0, use.admittedBytes) / MIB);
+    return `${BUDGET_HOLD_NOTICE_PREFIX}:${Math.trunc(use.deferredObjects)}:${heldMib}:${sentMib}`;
+}
+/** Find a size-budget hold token anywhere in a receipt's detail. A search, for the same reason as `parseDeliveryHoldNotice`. */
+export function parseBudgetHoldNotice(text) {
+    if (!text)
+        return null;
+    const match = new RegExp(String.raw `${BUDGET_HOLD_NOTICE_PREFIX}:(\d+):(\d+):(\d+)`, "u").exec(text);
+    if (!match)
+        return null;
+    const heldObjects = Number.parseInt(match[1], 10);
+    if (!Number.isFinite(heldObjects) || heldObjects <= 0)
+        return null;
+    return { heldObjects, heldMib: Number.parseInt(match[2], 10), sentMib: Number.parseInt(match[3], 10) };
 }

package/dist/log-rotation.js

@@ -47,8 +47,8 @@ import path from "node:path";
  */
 export const DEFAULT_LOG_ROTATION_MAX_BYTES = 10 * 1024 * 1024;
 export const DEFAULT_LOG_ROTATION_KEEP = 2;
-/** The two files launchd writes for the scheduled tick. */
-export const ROTATED_LOG_NAMES = ["sync.log", "sync.err.log"];
+/** The files launchd writes for the scheduled ticks (sync, and BLI-21564 the reminder job). */
+export const ROTATED_LOG_NAMES = ["sync.log", "sync.err.log", "remind.log", "remind.err.log"];
 /**
  * Caps the scheduled tick's own logs. Never throws: a rotation failure is data
  * for the caller to log, never a reason a sync does not run.

package/dist/notifier.js

@@ -0,0 +1,83 @@
+/**
+ * The one place the collector paints an OS banner (BLI-21564, calendar slice 11).
+ *
+ * macOS goes through `osascript -e 'display notification ...'`, Windows through
+ * a PowerShell toast on PowerShell's own app id. Both are spawned through
+ * `process-runner.ts` with an ARRAY of arguments (never a shell line), and every
+ * string a person or a calendar can influence is escaped (AppleScript) or passed
+ * by environment variable (PowerShell), so a meeting title cannot become code.
+ *
+ * The result is always one of three named outcomes. A banner the OS refused is
+ * `permission_denied`; a helper that failed any other way is `notifier_failed`
+ * with its exit code; nothing here is silent. `osascript` exits 0 when the user
+ * switched notifications off for it, so a silent denial is not detectable: a
+ * desktop receipt, not this module, is the proof a banner appeared.
+ */
+import { createCapturedExecRunner } from "./process-runner.js";
+const NOTIFIER_TIMEOUT_MS = 15_000;
+const MAX_TEXT = 200;
+const DENIAL = /not allowed|not authorized|not permitted|access.*denied|notifications? (?:are |is )?(?:disabled|blocked|turned off)|\(-1743\)|\(-1744\)|blocked by/i;
+/** Controls become spaces and the length is bounded; the text is a banner, not a document. */
+function plain(value) {
+    // eslint-disable-next-line no-control-regex
+    return value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, MAX_TEXT);
+}
+/** An AppleScript string literal body: backslash and double quote are the only escapes it needs. */
+export function appleScriptEscape(value) {
+    return plain(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+export function macNotifyArgs(request) {
+    const sound = request.sound ? ' sound name "Glass"' : "";
+    return ["-e", `display notification "${appleScriptEscape(request.message)}" with title "${appleScriptEscape(request.title)}"${sound}`];
+}
+/** The toast script reads its text from the environment, so no title can reach the script body. */
+export const WINDOWS_TOAST_SCRIPT = [
+    "$ErrorActionPreference = 'Stop'",
+    "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null",
+    "[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null",
+    "$title = [System.Security.SecurityElement]::Escape($env:TOWER_TOAST_TITLE)",
+    "$message = [System.Security.SecurityElement]::Escape($env:TOWER_TOAST_MESSAGE)",
+    "$audio = if ($env:TOWER_TOAST_SOUND -eq '1') { '' } else { '<audio silent=\"true\"/>' }",
+    "$xml = New-Object Windows.Data.Xml.Dom.XmlDocument",
+    "$xml.LoadXml('<toast><visual><binding template=\"ToastText02\"><text id=\"1\">' + $title + '</text><text id=\"2\">' + $message + '</text></binding></visual>' + $audio + '</toast>')",
+    "$toast = New-Object Windows.UI.Notifications.ToastNotification $xml",
+    "$appId = '{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe'",
+    "[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($appId).Show($toast)",
+].join("\n");
+export function windowsNotifyArgs() {
+    const encoded = Buffer.from(WINDOWS_TOAST_SCRIPT, "utf16le").toString("base64");
+    return ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded];
+}
+export async function showNotification(request, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const exec = options.exec ?? createCapturedExecRunner({ platform });
+    let command;
+    let args;
+    let env;
+    if (platform === "darwin") {
+        command = "osascript";
+        args = macNotifyArgs(request);
+    }
+    else if (platform === "win32") {
+        command = "powershell.exe";
+        args = windowsNotifyArgs();
+        env = { ...(options.env ?? process.env), TOWER_TOAST_TITLE: plain(request.title), TOWER_TOAST_MESSAGE: plain(request.message), TOWER_TOAST_SOUND: request.sound ? "1" : "0" };
+    }
+    else {
+        const reason = `no_notifier_for_${platform}`;
+        console.error("[notifier] not shown", JSON.stringify({ outcome: "notifier_failed", reason }));
+        return { outcome: "notifier_failed", reason };
+    }
+    const result = await exec(command, args, { timeoutMs: NOTIFIER_TIMEOUT_MS, ...(env ? { env } : {}) });
+    if (result.code === 0) {
+        console.error("[notifier] shown", JSON.stringify({ outcome: "shown", platform }));
+        return { outcome: "shown", reason: null };
+    }
+    if (DENIAL.test(`${result.stderr}\n${result.stdout}`)) {
+        console.error("[notifier] not shown", JSON.stringify({ outcome: "permission_denied", platform, exit: result.code }));
+        return { outcome: "permission_denied", reason: `os_refused_exit_${result.code}` };
+    }
+    const reason = result.code === 124 ? "timed_out" : `exit_${result.code}`;
+    console.error("[notifier] not shown", JSON.stringify({ outcome: "notifier_failed", platform, exit: result.code }));
+    return { outcome: "notifier_failed", reason };
+}

package/dist/process-runner.js

@@ -35,6 +35,7 @@ export function createCapturedExecRunner(options = {}) {
             encoding: "utf8",
             env,
             windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+            windowsHide: true,
             ...(runOptions?.timeoutMs ? { timeout: runOptions.timeoutMs } : {}),
         }, (error, stdout, stderr) => {
             const code = capturedExitCode(error, runOptions?.timeoutMs);
@@ -86,6 +87,9 @@ export function createInteractiveExecRunner(options = {}) {
             stdio,
             env,
             windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+            // Ticket 21952: a scheduled sync has no console, so a child without this opens a visible window on Windows.
+            // With a console (a person typing `cockpit doctor`) the child shares it and the flag changes nothing.
+            windowsHide: true,
         });
         let settled = false;
         child.on("error", (error) => {

package/dist/repo-identity-git.js

@@ -14,6 +14,7 @@ export async function runGit(args, cwd) {
     const { stdout } = await execFileAsync("git", args, {
         cwd,
         timeout: 2_000,
+        windowsHide: true,
         maxBuffer: 1024 * 1024,
     });
     return stdout;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.242",
+  "version": "0.2.243",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.70",
-    "@bli-cockpit/mcp": "0.1.147",
-    "@bli-cockpit/telemetry-core": "0.1.77"
+    "@bli-cockpit/memory-mcp": "0.1.71",
+    "@bli-cockpit/mcp": "0.1.148",
+    "@bli-cockpit/telemetry-core": "0.1.78"
   },
   "repository": {
     "type": "git",