@bli-cockpit/cli 0.2.242 → 0.2.244

package/dist/adapters/git-state.js

@@ -131,6 +131,7 @@ function defaultGitCommandRunner() {
             const { stdout } = await execFileAsync("git", args, {
                 cwd,
                 timeout: timeoutMs,
+                windowsHide: true,
                 maxBuffer: 1024 * 1024,
             });
             return stdout;

package/dist/adapters/raw-evidence-budget-admission.js

@@ -0,0 +1,63 @@
+import { terminalDeliveryReason } from "../raw-evidence-staging.js";
+import { admitToStaging } from "../staging-gate.js";
+/**
+ * The one door a file passes before its bytes may be copied: the per-sync
+ * budget below, then the disk (BLI-12832). A refusal from the disk hands the
+ * budget back, because nothing was staged and the next tick re-reads the source.
+ * A copy already staged costs the disk nothing and is never refused by it.
+ */
+export function admitEvidence(collection, byteLength, file) {
+    // Ticket 21952: a copy staged on an earlier tick is queued, not new bytes; re-charging it let a backlog use up the
+    // byte budget every tick. It still costs one object, and its upload resumes from the chunks the server holds.
+    const alreadyStaged = collection.staging.staged[file.contentHash] !== undefined;
+    const charged = alreadyStaged ? 0 : byteLength;
+    const budgetReason = admitToBudget(collection.budget, charged);
+    if (budgetReason)
+        return budgetReason;
+    const allowance = collection.budget.staging;
+    if (!allowance)
+        return null;
+    // BLI-12832: bytes the server refused for good are reclaimed by the prune
+    // (the refusal stays as a receipt), so copying them again would be churn.
+    if (!alreadyStaged &&
+        terminalDeliveryReason(collection.staging.delivery_attempts[file.contentHash]?.last_reason)) {
+        refundBudget(collection.budget, charged);
+        console.error("[staging-gate] not copying bytes the server refused for good", JSON.stringify({ reason: "delivery_terminal_refused", kind: file.kind, file_bytes: byteLength }));
+        return "delivery_terminal_refused";
+    }
+    const diskReason = admitToStaging(allowance, byteLength, {
+        alreadyStaged,
+        kind: file.kind,
+    });
+    if (!diskReason)
+        return null;
+    refundBudget(collection.budget, charged);
+    return `staging_deferred:${diskReason}`;
+}
+/** Hands back one admission that a later gate refused, so nothing was staged and nothing counts as sent. */
+function refundBudget(budget, byteLength) {
+    budget.remainingObjects += 1;
+    budget.remainingBytes += byteLength;
+    budget.admittedBytes = Math.max(0, (budget.admittedBytes ?? 0) - byteLength);
+    budget.admittedObjects = Math.max(0, (budget.admittedObjects ?? 0) - 1);
+}
+/**
+ * Decrements the per-sync budget when a file fits, or returns a deferred-skip
+ * reason when it does not. The object budget bounds request count; the byte
+ * budget bounds buffered bytes.
+ */
+export function admitToBudget(budget, byteLength) {
+    const single = budget.singleFileByteAllowance;
+    const firstLargeFile = single && budget.remainingBytes === single.normalBytes &&
+        byteLength <= single.maxFileBytes;
+    const reason = budget.remainingObjects <= 0 ? "deferred_object_budget" :
+        byteLength > 0 && byteLength > budget.remainingBytes && !firstLargeFile ? "deferred_byte_budget" : null;
+    if (reason) {
+        [budget.deferredObjects, budget.deferredBytes] = [(budget.deferredObjects ?? 0) + 1, (budget.deferredBytes ?? 0) + byteLength];
+        return reason;
+    }
+    budget.remainingObjects -= 1;
+    budget.remainingBytes -= byteLength;
+    [budget.admittedBytes, budget.admittedObjects] = [(budget.admittedBytes ?? 0) + byteLength, (budget.admittedObjects ?? 0) + 1];
+    return null;
+}

package/dist/adapters/raw-evidence-collection-state.js

@@ -7,13 +7,14 @@
  * contract, so `raw-evidence-completeness.ts` can read and write them without
  * knowing about packs, budgets or disks.
  *
- * Two mechanics live here rather than in any one reader, because the Codex
+ * Two mechanics are exposed here rather than in any one reader, because the Codex
  * reader, the Claude reader, the image reader and the git-diff reader all spend
  * them:
  *
  * - **`admitToBudget`** — the per-sync byte and object budget (D7b),
  *   decremented in place so one `cockpit sync` across many worktrees honours
- *   one cap.
+ *   one cap. Admission and disk-refusal refunds live together in
+ *   `raw-evidence-budget-admission.ts`; the exports here keep reader APIs stable.
  * - **`stageEvidenceBytes`** — bytes go on disk exactly once; content an
  *   earlier sync already staged is adopted rather than copied again.
  *
@@ -26,8 +27,8 @@ import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core"
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { DELIVERY_BACKOFF_BYPASS_REASON, deliveryBackoffApplies, heldSourceKeys, readRawEvidenceStagingState, resolveStagedObject, terminalDeliveryReason, } from "../raw-evidence-staging.js";
-import { admitToStaging, openStagingAllowance, } from "../staging-gate.js";
+import { DELIVERY_BACKOFF_BYPASS_REASON, deliveryBackoffApplies, heldSourceKeys, readRawEvidenceStagingState, resolveStagedObject, } from "../raw-evidence-staging.js";
+import { openStagingAllowance, } from "../staging-gate.js";
 import { chmodPrivate } from "./raw-evidence-pack-store.js";
 import { GIT_DIFF_TIMEOUT_MS, MAX_GIT_DIFF_BYTES, } from "./raw-evidence-git-diff.js";
 export const DEFAULT_SINCE_MINUTES = 24 * 60;
@@ -201,49 +202,4 @@ export async function stageEvidenceBytes(collection, options) {
     collection.stagedNewCount += 1;
     return { local_path: destination, staged_in_pack: true };
 }
-/**
- * The one door a file passes before its bytes may be copied: the per-sync
- * budget below, then the disk (BLI-12832). A refusal from the disk hands the
- * budget back, because nothing was staged and the next tick re-reads the source.
- * A copy already staged costs the disk nothing and is never refused by it.
- */
-export function admitEvidence(collection, byteLength, file) {
-    const budgetReason = admitToBudget(collection.budget, byteLength);
-    if (budgetReason)
-        return budgetReason;
-    const allowance = collection.budget.staging;
-    if (!allowance)
-        return null;
-    // BLI-12832: bytes the server refused for good are reclaimed by the prune
-    // (the refusal stays as a receipt), so copying them again would be churn.
-    if (collection.staging.staged[file.contentHash] === undefined &&
-        terminalDeliveryReason(collection.staging.delivery_attempts[file.contentHash]?.last_reason)) {
-        collection.budget.remainingObjects += 1;
-        collection.budget.remainingBytes += byteLength;
-        console.error("[staging-gate] not copying bytes the server refused for good", JSON.stringify({ reason: "delivery_terminal_refused", kind: file.kind, file_bytes: byteLength }));
-        return "delivery_terminal_refused";
-    }
-    const diskReason = admitToStaging(allowance, byteLength, {
-        alreadyStaged: collection.staging.staged[file.contentHash] !== undefined,
-        kind: file.kind,
-    });
-    if (!diskReason)
-        return null;
-    collection.budget.remainingObjects += 1;
-    collection.budget.remainingBytes += byteLength;
-    return `staging_deferred:${diskReason}`;
-}
-/**
- * Decrements the per-sync budget when a file fits, or returns a deferred-skip
- * reason when it does not. The object budget bounds request count; the byte
- * budget bounds buffered bytes.
- */
-export function admitToBudget(budget, byteLength) {
-    if (budget.remainingObjects <= 0)
-        return "deferred_object_budget";
-    if (byteLength > budget.remainingBytes)
-        return "deferred_byte_budget";
-    budget.remainingObjects -= 1;
-    budget.remainingBytes -= byteLength;
-    return null;
-}
+export { admitEvidence, admitToBudget } from "./raw-evidence-budget-admission.js";

package/dist/adapters/raw-evidence-git-diff.js

@@ -86,6 +86,7 @@ function captureGitDiff(args, repoRoot) {
         const child = spawn("git", [...args, ...SECRET_EXCLUDING_PATHSPEC], {
             cwd: repoRoot,
             stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
         });
         const stdoutChunks = [];
         const stderrChunks = [];

package/dist/agent-rules.js

@@ -180,6 +180,14 @@ export function cockpitAgentRulesBlock(options = {}) {
         "- Computer use first, always. The human can take over the browser at any point; when that happens, stop driving, observe, and record what the human verified.",
         "- A reviewer or QA agent spawned by the builder does not count as independent verification by itself — the receipt is what counts, not the reviewer's opinion.",
         "- QA catches the cheap majority of bugs, not all of them. Do the pass, attach the receipts, ship; remaining bugs get fixed as normal bugs.",
+        "",
+        "## Ground rules",
+        "",
+        "- Database: raw SQL through the repo's one door. Never add Supabase JS `.from()` or `.rpc()` on the server. Every query under 500 ms through indexes. No caching to hide a slow read. Store totals, do not recount. Never OFFSET on serving paths. Never reset a database password.",
+        "- Migrations: additive ones merge on green. Stop for Edward if one can lose data or widens private reads.",
+        "- Plans: a large plan, database change or architecture change runs `plan-review` first and follows its verdict.",
+        "- Secrets: use them exec-only, never print them, and ask nobody to paste a token.",
+        "- Setups are zero-click for Edward.",
         MANAGED_BLOCK_END,
     ].join("\n");
 }

package/dist/autostart-contract.js

@@ -8,7 +8,19 @@ export const AUTOSTART_LABEL = "com.bli.cockpit.sync";
 /** The name Task Scheduler files the same job under on Windows. */
 export const WINDOWS_AUTOSTART_TASK_NAME = "BLI Cockpit Sync";
 export const DEFAULT_AUTOSTART_INTERVAL_SECONDS = 15 * 60;
+/**
+ * BLI-21564: the second job of the one autostart contract. It runs `cockpit cal remind`
+ * every minute (the laptop meeting-reminder tick), is installed, repaired and removed
+ * with the sync agent, and is never a long-lived process.
+ */
+export const REMIND_AUTOSTART_LABEL = "com.bli.cockpit.remind";
+export const WINDOWS_REMIND_TASK_NAME = "BLI Cockpit Remind";
+export const REMIND_INTERVAL_SECONDS = 60;
 export const UNSUPPORTED_MESSAGE = "autostart is supported on macOS and Windows only";
+/** Where the reminder LaunchAgent lives for a given home. */
+export function remindPlistPathFor(homeDir) {
+    return path.join(homeDir, "Library", "LaunchAgents", `${REMIND_AUTOSTART_LABEL}.plist`);
+}
 /** Where the LaunchAgent lives for a given home; also the `plist_path` every
  * result carries, including the unsupported-platform one. */
 export function plistPathFor(homeDir) {

package/dist/autostart-darwin-plist.js

@@ -245,7 +245,7 @@ function renderDarwinSyncCommand(options) {
  * .zshrc) still fails — but now it fails with a reason in the log instead of a
  * bare 127.
  */
-function darwinNodeResolutionPreamble(nodeExecutable) {
+export function darwinNodeResolutionPreamble(nodeExecutable) {
     return [
         `node_bin=${shellQuote(nodeExecutable)}`,
         `[ -x "$node_bin" ] || node_bin="$(${DARWIN_LOGIN_SHELL} -lc 'command -v node' 2>/dev/null)"`,
@@ -274,6 +274,6 @@ function darwinAgentRegistrationProblems(plist, expected) {
     }
     return problems;
 }
-function shellQuote(value) {
+export function shellQuote(value) {
     return `'${value.replace(/'/g, "'\\''")}'`;
 }

package/dist/autostart-darwin.js

@@ -151,7 +151,7 @@ export function launchdUserDomain(uid = process.getuid?.() ?? 0) {
 export async function reregisterDarwinAgent(options) {
     const domain = launchdUserDomain(options.uid);
     const bootout = await options
-        .exec("launchctl", ["bootout", `${domain}/${AUTOSTART_LABEL}`])
+        .exec("launchctl", ["bootout", `${domain}/${options.label ?? AUTOSTART_LABEL}`])
         .catch(() => ({ code: 1, stdout: "", stderr: "" }));
     const bootstrap = await options
         .exec("launchctl", ["bootstrap", domain, options.plistPath])

package/dist/autostart-remind.js

@@ -0,0 +1,245 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileExists, REMIND_AUTOSTART_LABEL, REMIND_INTERVAL_SECONDS, remindPlistPathFor, resolveAutostartSettings, schedulerNodeExecutable, WINDOWS_REMIND_TASK_NAME, } from "./autostart-contract.js";
+import { darwinNodeResolutionPreamble, shellQuote } from "./autostart-darwin-plist.js";
+import { describeDifference, powershellLiteral, renderedFileDifference, renderWindowsLauncherScript, renderWindowsRegistrationScript, UTF8_BOM, WINDOWS_SYNC_LOG_LIMIT_BYTES, windowsPowerShellPath, windowsWScriptPath, } from "./autostart-windows-scripts.js";
+import { windowsTaskRegistrationProblems } from "./autostart-windows-task-xml.js";
+import { xmlEscape } from "./autostart-xml.js";
+import { isDefaultDashboardUrl, getCollectorRuntimePaths } from "./local-state.js";
+/**
+ * The reminder job: the SECOND scheduled job of the one autostart contract (BLI-21564).
+ *
+ * `com.bli.cockpit.remind` (launchd) and `BLI Cockpit Remind` (Task Scheduler) run
+ * `cockpit cal remind --quiet` every minute. They are installed, repaired and removed together with
+ * the sync agent (`autostart.ts` calls these three functions from the same front doors), honour the
+ * same opt-out marker through the same callers, and never watch a path: after a sleep the next tick
+ * runs, and the 5-minute grace decides shown versus missed. There is no always-on process.
+ *
+ * Nothing here throws for a host problem: every function answers with a named status and a message,
+ * and every deciding branch logs its reason (metadata only, never a path).
+ */
+const TAG = "[autostart-remind]";
+const REMIND_LOG = "remind.log";
+const REMIND_ERR_LOG = "remind.err.log";
+const REMIND_SCRIPT = "autostart-remind.ps1";
+const REMIND_LAUNCHER = "autostart-remind.vbs";
+const REMIND_REGISTRATION = "autostart-remind-register.ps1";
+const REMIND_COMMAND = ["cal", "remind", "--quiet"];
+function stateFile(homeDir, name) {
+    return path.join(getCollectorRuntimePaths(homeDir ?? os.homedir()).state_dir, name);
+}
+function result(base) {
+    return { label: REMIND_AUTOSTART_LABEL, interval_seconds: REMIND_INTERVAL_SECONDS, ...base };
+}
+/** launchd's reminder plist: StartInterval 60, RunAtLoad, and deliberately no WatchPaths. */
+export function renderRemindPlist(options) {
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        "<dict>",
+        "  <key>Label</key>",
+        `  <string>${xmlEscape(REMIND_AUTOSTART_LABEL)}</string>`,
+        ...remindProgramArguments(options),
+        "  <key>StartInterval</key>",
+        `  <integer>${REMIND_INTERVAL_SECONDS}</integer>`,
+        "  <key>RunAtLoad</key>",
+        "  <true/>",
+        "  <key>StandardOutPath</key>",
+        `  <string>${xmlEscape(options.stdoutPath)}</string>`,
+        "  <key>StandardErrorPath</key>",
+        `  <string>${xmlEscape(options.stderrPath)}</string>`,
+        "</dict>",
+        "</plist>",
+        "",
+    ].join("\n");
+}
+function remindProgramArguments(options) {
+    const dashboardArg = isDefaultDashboardUrl(options.dashboardUrl) ? "" : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
+    const command = [
+        ...darwinNodeResolutionPreamble(options.nodeExecutable),
+        `"$node_bin" ${shellQuote(options.cliEntryPoint)} ${REMIND_COMMAND.join(" ")}${dashboardArg}`,
+    ].join("; ");
+    return ["  <key>ProgramArguments</key>", "  <array>", "    <string>/bin/zsh</string>", "    <string>-c</string>", `    <string>${xmlEscape(command)}</string>`, "  </array>"];
+}
+async function renderedDarwinPlist(options) {
+    const homeDir = options.homeDir ?? os.homedir();
+    const settings = resolveAutostartSettings(options, "darwin");
+    const node = await schedulerNodeExecutable(options, "darwin");
+    const paths = getCollectorRuntimePaths(homeDir);
+    return {
+        plistPath: remindPlistPathFor(homeDir),
+        plist: renderRemindPlist({
+            nodeExecutable: node.path,
+            cliEntryPoint: settings.cli_entry_point,
+            dashboardUrl: settings.dashboard_url,
+            stdoutPath: path.join(paths.state_dir, REMIND_LOG),
+            stderrPath: path.join(paths.state_dir, REMIND_ERR_LOG),
+        }),
+    };
+}
+/** Writes the reminder plist without touching launchd (the detached healer registers it with bootout/bootstrap). */
+export async function writeDarwinRemindPlist(options) {
+    const { plist, plistPath } = await renderedDarwinPlist(options);
+    await mkdir(path.dirname(plistPath), { recursive: true });
+    await mkdir(getCollectorRuntimePaths(options.homeDir ?? os.homedir()).state_dir, { recursive: true });
+    await writeFile(plistPath, plist, "utf8");
+    return { plist_path: plistPath };
+}
+function windowsPaths(homeDir) {
+    return {
+        script: stateFile(homeDir, REMIND_SCRIPT),
+        launcher: stateFile(homeDir, REMIND_LAUNCHER),
+        registration: stateFile(homeDir, REMIND_REGISTRATION),
+        log: stateFile(homeDir, REMIND_LOG),
+    };
+}
+function renderWindowsRemindScript(options) {
+    const dashboardArgs = isDefaultDashboardUrl(options.dashboardUrl) ? "" : ` --dashboard-url ${powershellLiteral(options.dashboardUrl)}`;
+    return [
+        // Same reasons as the sync script: stderr is a log channel here, so 'Continue', and failure is the exit code.
+        "$ErrorActionPreference = 'Continue'",
+        "$exitCode = 0",
+        `$nodeExecutable = ${powershellLiteral(options.nodeExecutable)}`,
+        `$cliEntryPoint = ${powershellLiteral(options.cliEntryPoint)}`,
+        `$remindLogPath = ${powershellLiteral(options.logPath)}`,
+        "$remindLogFile = Get-Item -LiteralPath $remindLogPath -ErrorAction SilentlyContinue",
+        `if ($remindLogFile -and $remindLogFile.Length -gt ${WINDOWS_SYNC_LOG_LIMIT_BYTES}) { Set-Content -LiteralPath $remindLogPath -Value '' -Encoding UTF8 }`,
+        "try {",
+        `  & $nodeExecutable $cliEntryPoint ${REMIND_COMMAND.join(" ")}${dashboardArgs} 2>&1 | ForEach-Object { "$_" } | Add-Content -LiteralPath $remindLogPath -Encoding UTF8`,
+        "  if ($LASTEXITCODE -ne 0) { $exitCode = $LASTEXITCODE }",
+        "} catch {",
+        "  Add-Content -LiteralPath $remindLogPath -Encoding UTF8 -Value $_.Exception.Message",
+        "  $exitCode = 1",
+        "}",
+        "exit $exitCode",
+        "",
+    ].join("\r\n");
+}
+async function expectedWindowsFiles(options) {
+    const settings = resolveAutostartSettings(options, "win32");
+    const node = await schedulerNodeExecutable(options, "win32");
+    const paths = windowsPaths(options.homeDir);
+    return {
+        paths,
+        script: `${UTF8_BOM}${renderWindowsRemindScript({ nodeExecutable: node.path, cliEntryPoint: settings.cli_entry_point, dashboardUrl: settings.dashboard_url, logPath: paths.log })}`,
+        launcher: renderWindowsLauncherScript({ powershellPath: windowsPowerShellPath(), scriptPath: paths.script }),
+        registration: `${UTF8_BOM}${renderWindowsRegistrationScript({ taskName: WINDOWS_REMIND_TASK_NAME, launcherPath: paths.launcher, intervalMinutes: REMIND_INTERVAL_SECONDS / 60 })}`,
+    };
+}
+/** Installs or repairs the reminder job for this host. Never throws. */
+export async function installRemindAgent(options) {
+    const platform = options.platform ?? process.platform;
+    try {
+        if (platform === "darwin") {
+            const written = await writeDarwinRemindPlist(options);
+            await options.exec("launchctl", ["unload", written.plist_path]).catch(() => undefined);
+            const load = await options.exec("launchctl", ["load", written.plist_path]);
+            console.error(`${TAG} ${load.code === 0 ? "launchd job loaded" : "launchd job not loaded"}`, JSON.stringify({ label: REMIND_AUTOSTART_LABEL, exit_code: load.code, interval_seconds: REMIND_INTERVAL_SECONDS }));
+            return result({ status: "installed", path: written.plist_path, loaded: load.code === 0, ...(load.code === 0 ? {} : { message: `launchctl load exited ${load.code} for the reminder job` }) });
+        }
+        if (platform === "win32")
+            return await installWindowsRemind(options);
+    }
+    catch (error) {
+        console.error(`${TAG} install failed`, JSON.stringify({ reason: "install_threw", platform, error_name: error instanceof Error ? error.name : typeof error }));
+        return result({ status: "not_loaded", path: remindPlistPathFor(options.homeDir ?? os.homedir()), loaded: false, message: "the reminder job could not be written" });
+    }
+    return result({ status: "unsupported", path: remindPlistPathFor(options.homeDir ?? os.homedir()) });
+}
+async function installWindowsRemind(options) {
+    const expected = await expectedWindowsFiles(options);
+    await mkdir(path.dirname(expected.paths.script), { recursive: true });
+    await writeFile(expected.paths.script, expected.script, "utf8");
+    await writeFile(expected.paths.launcher, expected.launcher, "utf8");
+    await writeFile(expected.paths.registration, expected.registration, "utf8");
+    const created = await options.exec("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", expected.paths.registration]);
+    console.error(`${TAG} ${created.code === 0 ? "scheduled task registered" : "scheduled task registration failed"}`, JSON.stringify({ task_name: WINDOWS_REMIND_TASK_NAME, exit_code: created.code, interval_minutes: REMIND_INTERVAL_SECONDS / 60 }));
+    return result({
+        status: "installed", path: expected.paths.script, task_name: WINDOWS_REMIND_TASK_NAME, loaded: created.code === 0,
+        ...(created.code === 0 ? {} : { message: `PowerShell registration of the reminder task exited ${created.code}` }),
+    });
+}
+/** Removes the reminder job and its files. `absent` when there was nothing, so it is safe to repeat. */
+export async function uninstallRemindAgent(options) {
+    const platform = options.platform ?? process.platform;
+    if (platform === "darwin") {
+        const plistPath = remindPlistPathFor(options.homeDir ?? os.homedir());
+        if (!(await fileExists(plistPath)))
+            return result({ status: "absent", path: plistPath });
+        await options.exec("launchctl", ["unload", plistPath]).catch(() => undefined);
+        await rm(plistPath, { force: true });
+        console.error(`${TAG} launchd job removed`, JSON.stringify({ label: REMIND_AUTOSTART_LABEL }));
+        return result({ status: "uninstalled", path: plistPath });
+    }
+    if (platform === "win32") {
+        const paths = windowsPaths(options.homeDir);
+        const query = await options.exec("schtasks.exe", ["/Query", "/TN", WINDOWS_REMIND_TASK_NAME]);
+        const known = query.code === 0;
+        const removed = known ? await options.exec("schtasks.exe", ["/Delete", "/TN", WINDOWS_REMIND_TASK_NAME, "/F"]) : null;
+        if (removed && removed.code !== 0) {
+            console.error(`${TAG} scheduled task not removed`, JSON.stringify({ task_name: WINDOWS_REMIND_TASK_NAME, exit_code: removed.code }));
+            return result({ status: "not_loaded", path: paths.script, task_name: WINDOWS_REMIND_TASK_NAME, message: `schtasks /Delete exited ${removed.code} for the reminder task` });
+        }
+        for (const file of [paths.script, paths.launcher, paths.registration])
+            await rm(file, { force: true });
+        console.error(`${TAG} scheduled task ${known ? "removed" : "was not registered"}`, JSON.stringify({ task_name: WINDOWS_REMIND_TASK_NAME }));
+        return result({ status: known ? "uninstalled" : "absent", path: paths.script, task_name: WINDOWS_REMIND_TASK_NAME });
+    }
+    return result({ status: "unsupported", path: remindPlistPathFor(options.homeDir ?? os.homedir()) });
+}
+/**
+ * Whether the reminder job is registered and still says what this build would write. Content is only compared
+ * when the caller supplied roots, exactly like the sync agent (a bare `autostart status` stays permissive).
+ */
+export async function remindAgentStatus(options) {
+    const platform = options.platform ?? process.platform;
+    const compare = Boolean(options.repoRoots && options.repoRoots.length > 0);
+    if (platform === "darwin")
+        return darwinRemindStatus(options, compare);
+    if (platform === "win32")
+        return windowsRemindStatus(options, compare);
+    return result({ status: "unsupported", path: remindPlistPathFor(options.homeDir ?? os.homedir()) });
+}
+async function darwinRemindStatus(options, compare) {
+    const plistPath = remindPlistPathFor(options.homeDir ?? os.homedir());
+    const onDisk = await readFile(plistPath, "utf8").catch(() => null);
+    if (onDisk === null)
+        return result({ status: "absent", path: plistPath });
+    const problems = [];
+    if (compare && onDisk !== (await renderedDarwinPlist(options)).plist)
+        problems.push("reminder plist does not match the current Tower runtime");
+    const list = await options.exec("launchctl", ["list", REMIND_AUTOSTART_LABEL]);
+    if (list.code !== 0)
+        problems.unshift("reminder job is not loaded");
+    console.error(`${TAG} status`, JSON.stringify({ label: REMIND_AUTOSTART_LABEL, problems: problems.length }));
+    return result({ status: problems.length === 0 ? "loaded" : "not_loaded", path: plistPath, loaded: problems.length === 0, ...(problems.length ? { message: problems.join("; ") } : {}) });
+}
+async function windowsRemindStatus(options, compare) {
+    const paths = windowsPaths(options.homeDir);
+    const query = await options.exec("schtasks.exe", ["/Query", "/TN", WINDOWS_REMIND_TASK_NAME, "/XML"]);
+    if (query.code !== 0) {
+        const absent = query.code === 1 && /cannot find|not found|does not exist/iu.test(`${query.stderr}\n${query.stdout}`);
+        console.error(`${TAG} task query failed`, JSON.stringify({ task_name: WINDOWS_REMIND_TASK_NAME, exit_code: query.code, status: absent ? "absent" : "not_loaded" }));
+        return result({ status: absent ? "absent" : "not_loaded", path: paths.script, task_name: WINDOWS_REMIND_TASK_NAME });
+    }
+    const problems = [
+        ...(/<Enabled>\s*false\s*<\/Enabled>/iu.test(query.stdout) ? ["reminder task is disabled"] : []),
+        ...windowsTaskRegistrationProblems(query.stdout, { launcherPath: paths.launcher, intervalMinutes: REMIND_INTERVAL_SECONDS / 60, wscriptPath: windowsWScriptPath() }),
+    ];
+    if (!(await fileExists(paths.script)))
+        problems.push("reminder script is missing");
+    else if (!(await fileExists(paths.launcher)))
+        problems.push("reminder launcher is missing");
+    else if (compare) {
+        const expected = await expectedWindowsFiles(options);
+        for (const [label, file, text] of [["script", paths.script, expected.script], ["launcher", paths.launcher, expected.launcher]]) {
+            const difference = renderedFileDifference(await readFile(file, "utf8").catch(() => null), text);
+            if (difference)
+                problems.push(`reminder ${label} does not match the current Tower runtime (${describeDifference(difference)})`);
+        }
+    }
+    console.error(`${TAG} status`, JSON.stringify({ task_name: WINDOWS_REMIND_TASK_NAME, problems: problems.length }));
+    return result({ status: problems.length === 0 ? "loaded" : "not_loaded", path: paths.script, task_name: WINDOWS_REMIND_TASK_NAME, loaded: problems.length === 0, ...(problems.length ? { message: problems.join("; ") } : {}) });
+}

package/dist/autostart-self-heal.js

@@ -53,7 +53,13 @@ async function readAutostartProblem(paths, options, platform) {
         })
         : [];
     const marker = path.join(paths.state_dir, AUTOSTART_REPAIR_THROTTLE_MARKER);
-    if (!absent && status.status !== "not_loaded" && runtimeProblems.length === 0) {
+    // BLI-21564: the reminder job is repaired with the sync agent. A missing or broken reminder job is a
+    // problem of its own (an existing install that predates it gets it created here), and the opt-out
+    // marker is honoured above because an operator uninstall removed both.
+    const remindProblem = status.status === "loaded" && status.remind && status.remind.status !== "loaded" && status.remind.status !== "unsupported"
+        ? [`reminder job ${status.remind.status === "absent" ? "absent" : status.remind.message ?? "not loaded"}`]
+        : [];
+    if (!absent && status.status !== "not_loaded" && runtimeProblems.length === 0 && remindProblem.length === 0) {
         // Healthy is the steady state and stays silent. A marker left by an
         // earlier attempt is spent: that repair worked, so the next break starts
         // fresh instead of waiting out a retry window.
@@ -64,6 +70,7 @@ async function readAutostartProblem(paths, options, platform) {
         ...(absent ? ["registration absent"] : []),
         ...(status.message ? [status.message] : []),
         ...runtimeProblems,
+        ...remindProblem,
     ]
         .join("; ")
         .slice(0, DETAIL_MAX_CHARS) || "registration not loaded";
@@ -111,6 +118,14 @@ async function repairWindowsAutostart(options, platform, absent, problem) {
         exec: options.exec,
         platform,
     });
+    if (repaired.loaded && repaired.remind?.loaded === false) {
+        return {
+            status: "fail",
+            reason: "remind_repair_failed",
+            detail: (repaired.remind.message ?? problem).slice(0, DETAIL_MAX_CHARS),
+            step: "autostart_repair",
+        };
+    }
     if (repaired.loaded) {
         return {
             status: "ok",
@@ -182,6 +197,7 @@ function defaultSpawnDetached(command, args) {
     const child = spawn(command, args, {
         detached: true,
         stdio: "ignore",
+        windowsHide: true,
     });
     child.unref();
     return { pid: child.pid ?? null };

package/dist/autostart-windows-scripts.js

@@ -29,8 +29,8 @@ const WINDOWS_AUTOSTART_LAUNCHER_NAME = "autostart-sync.vbs";
 const WINDOWS_SYNC_LOG_NAME = "sync.log";
 /** With the window hidden, the log is the only place output goes; cap it so an
  * always-on machine syncing every 15 minutes cannot grow it without bound. */
-const WINDOWS_SYNC_LOG_LIMIT_BYTES = 10 * 1024 * 1024;
-const UTF8_BOM = "\uFEFF";
+export const WINDOWS_SYNC_LOG_LIMIT_BYTES = 10 * 1024 * 1024;
+export const UTF8_BOM = "\uFEFF";
 /** Where each written file lives, so the flow can name them in one breath. */
 export function windowsAutostartScriptPath(homeDir) {
     return windowsStateFile(homeDir, WINDOWS_AUTOSTART_SCRIPT_NAME);
@@ -160,7 +160,7 @@ export async function syncLauncherProblem(options) {
         ? `sync launcher does not match the current Tower runtime (${describeDifference(difference)})`
         : null;
 }
-function renderedFileDifference(current, expected) {
+export function renderedFileDifference(current, expected) {
     const expectedLines = normalizedScriptLines(expected);
     if (current === null) {
         return {
@@ -201,7 +201,7 @@ function renderedFileDifference(current, expected) {
     return null;
 }
 /** Safe to print: a reason label, a line index, two counts. No content. */
-function describeDifference(difference) {
+export function describeDifference(difference) {
     if (difference.reason === "file_unreadable")
         return "file could not be read";
     if (difference.reason === "byte_order_mark")
@@ -218,7 +218,7 @@ function normalizedScriptLines(value) {
 function hasByteOrderMark(value) {
     return value.startsWith(UTF8_BOM);
 }
-function renderWindowsRegistrationScript(options) {
+export function renderWindowsRegistrationScript(options) {
     return [
         "$ErrorActionPreference = 'Stop'",
         `$taskName = ${powershellLiteral(options.taskName)}`,
@@ -254,7 +254,7 @@ function renderWindowsRegistrationScript(options) {
  * doubling it; Windows paths cannot contain quotes, so the doubled quotes here
  * are only the fixed delimiters around the two paths.
  */
-function renderWindowsLauncherScript(options) {
+export function renderWindowsLauncherScript(options) {
     const quotedPowershell = `""${options.powershellPath}""`;
     const quotedScript = `""${options.scriptPath}""`;
     return [
@@ -305,6 +305,6 @@ function renderWindowsSyncScript(options) {
         "",
     ].join("\r\n");
 }
-function powershellLiteral(value) {
+export function powershellLiteral(value) {
     return `'${value.replace(/'/gu, "''")}'`;
 }

package/dist/autostart.js

@@ -4,6 +4,7 @@ import { darwinAgentStatus, installDarwinAgent, uninstallDarwinAgent, } from "./
 import { readRegisteredDarwinRuntimePaths } from "./autostart-darwin-plist.js";
 import { installWindowsTask, uninstallWindowsTask, windowsTaskStatus, } from "./autostart-windows.js";
 import { readRegisteredWindowsRuntimePaths } from "./autostart-windows-scripts.js";
+import { installRemindAgent, remindAgentStatus, uninstallRemindAgent } from "./autostart-remind.js";
 /**
  * Background collection's front door: install, uninstall, and status for the
  * OS scheduler, whichever OS this is.
@@ -20,7 +21,7 @@ import { readRegisteredWindowsRuntimePaths } from "./autostart-windows-scripts.j
  * autostart-contract.ts and is re-exported here because this module is the
  * import site the rest of the collector already knows (BLI-3571).
  */
-export { AUTOSTART_LABEL, DEFAULT_AUTOSTART_INTERVAL_SECONDS, WINDOWS_AUTOSTART_TASK_NAME, } from "./autostart-contract.js";
+export { AUTOSTART_LABEL, DEFAULT_AUTOSTART_INTERVAL_SECONDS, WINDOWS_AUTOSTART_TASK_NAME, REMIND_AUTOSTART_LABEL, WINDOWS_REMIND_TASK_NAME, } from "./autostart-contract.js";
 export { DARWIN_NETWORK_CHANGE_SIGNAL, DARWIN_NODE_MISSING_MESSAGE, writeDarwinAutostartPlist, } from "./autostart-darwin-plist.js";
 export { launchdUserDomain, reregisterDarwinAgent, } from "./autostart-darwin.js";
 /**
@@ -30,35 +31,35 @@ export { launchdUserDomain, reregisterDarwinAgent, } from "./autostart-darwin.js
  */
 export async function installAutostartAgent(options) {
     const platform = options.platform ?? process.platform;
-    if (platform === "win32")
-        return installWindowsTask(options);
-    if (platform !== "darwin")
+    if (platform !== "win32" && platform !== "darwin")
         return unsupportedResult(options.homeDir);
-    return installDarwinAgent(options);
+    const sync = platform === "win32" ? await installWindowsTask(options) : await installDarwinAgent(options);
+    // BLI-21564: the reminder job is the second job of the same contract, installed and repaired with the sync agent.
+    return { ...sync, remind: await installRemindAgent(options) };
 }
 /**
- * Removes the scheduled sync. Reports `absent` when there was nothing to
- * remove, so the command is safe to run repeatedly.
+ * Removes the scheduled sync and the reminder job. Reports `absent` when there
+ * was nothing to remove, so the command is safe to run repeatedly.
  */
 export async function uninstallAutostartAgent(options) {
     const platform = options.platform ?? process.platform;
-    if (platform === "win32")
-        return uninstallWindowsTask(options);
-    if (platform !== "darwin")
+    if (platform !== "win32" && platform !== "darwin")
         return unsupportedResult(options.homeDir);
-    return uninstallDarwinAgent(options);
+    const sync = platform === "win32" ? await uninstallWindowsTask(options) : await uninstallDarwinAgent(options);
+    return { ...sync, remind: await uninstallRemindAgent(options) };
 }
 /**
  * Reports whether the scheduled sync is installed, registered, and still
  * matches the configured roots, cadence, dashboard URL, and Cockpit runtime.
+ * The reminder job's own reading rides beside it as `remind`; it never changes
+ * the sync agent's `status`, and the self-heal tick is what acts on it.
  */
 export async function autostartStatus(options) {
     const platform = options.platform ?? process.platform;
-    if (platform === "win32")
-        return windowsTaskStatus(options);
-    if (platform !== "darwin")
+    if (platform !== "win32" && platform !== "darwin")
         return unsupportedResult(options.homeDir);
-    return darwinAgentStatus(options);
+    const sync = platform === "win32" ? await windowsTaskStatus(options) : await darwinAgentStatus(options);
+    return { ...sync, remind: await remindAgentStatus(options) };
 }
 /**
  * What the platform says it will run, parsed out of the registration itself