@bli-cockpit/cli 0.2.246 → 0.2.248

package/dist/commands/backfill-scope.js

@@ -4,6 +4,7 @@
  * which stores and how far back was it asked for, and can it reach the
  * dashboard at all. Nothing here opens a transcript.
  */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import path from "node:path";
 import { readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, } from "../local-state.js";
 import { DEFAULT_DISCOVERY_MAX_DEPTH, DEFAULT_DISCOVERY_MAX_REPOS, collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
@@ -44,22 +45,30 @@ export async function resolveBackfillScope(command, io, now, paths) {
         collectionRoots,
         worktreeDiscovery,
         retryCommand: backfillDiscoveryRetryCommand(command, worktreeDiscovery),
-        sources: honourClaudeOptOut(selectedSources(command.source), config.collect_claude_jsonl),
+        sources: honourSourceOptOuts(selectedSources(command.source), config),
         window,
     };
 }
 /**
  * Session-first (BLI-11091): now that outside-root sessions upload, an
  * explicit operator opt-out is the only thing that withholds one. The
- * per-machine Claude opt-out (`collect_claude_jsonl: false`) the scheduled
- * sync already honours (`session-sync-plan.ts`) therefore holds here too:
- * backfill never reads the Claude store on a machine that said no.
+ * per-machine opt-outs the scheduled sync already honours
+ * (`session-sync-plan.ts`) hold here too: `collect_claude_jsonl: false`,
+ * `collect_codex_jsonl: false` and `raw_evidence_upload: "disabled"` (both).
+ * Backfill never reads the store of a source the machine said no to, and logs
+ * the reason label (ticket 22557).
  */
-function honourClaudeOptOut(sources, collectClaudeJsonl) {
-    if (collectClaudeJsonl !== false || !sources.includes("claude_code"))
+function honourSourceOptOuts(sources, config) {
+    const switches = resolveSourceSwitches(config);
+    const kept = sources.filter((source) => (source === "codex" ? switches.codex : switches.claude));
+    if (kept.length === sources.length)
         return sources;
-    console.error("[backfill] claude source withheld by operator opt-out", JSON.stringify({ reason: "collect_claude_jsonl_false", sources_before: sources.length }));
-    return sources.filter((source) => source !== "claude_code");
+    for (const source of sources) {
+        if (kept.includes(source))
+            continue;
+        console.error(`[backfill] ${source === "codex" ? "codex" : "claude"} source withheld by operator opt-out`, JSON.stringify({ reason: source === "codex" ? switches.codexReason : switches.claudeReason, sources_before: sources.length }));
+    }
+    return kept;
 }
 function backfillCollectionRoots(command, savedRoots) {
     if (command.repoRoot)

package/dist/commands/docs-notion.js

@@ -16,7 +16,7 @@
 import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
 import { writeLine } from "./cli-io.js";
 import { resolveDocId } from "./docs.js";
-import { printSyncDetail } from "./docs-sync.js";
+import { printSyncDetail, syncTriage } from "./docs-sync.js";
 const TAG = "[docs cli]";
 const READ_DEADLINE_MS = 30_000;
 const WRITE_DEADLINE_MS = 60_000;
@@ -32,6 +32,9 @@ function runLine(direction, run) {
  * never claims anything about Notion it has not read.
  */
 export async function syncStatusDocs(command, door) {
+    // ticket 22178: `--owner|--decision|--ticket` turns the read into a label write on the same verb.
+    if (command.docsSync?.triage)
+        return syncTriage(command, door);
     let path = "/api/docs/notion-sync";
     if (command.docRef) {
         const resolved = await resolveDocId(door, command.docRef);
@@ -61,6 +64,11 @@ export async function syncStatusDocs(command, door) {
     const documents = body.documents ?? [];
     for (const doc of documents) {
         writeLine(door.io.stdout, `${doc.id}  ${doc.state.padEnd(13)}  ${(doc.notion_synced_at ?? "never").padEnd(25)}  ${doc.slug ?? "(no slug)"}  ${doc.title}`);
+        // ticket 22178: a document that is not synced says why, who owns it and what was decided.
+        if (doc.state !== "synced") {
+            const owner = doc.owner ? doc.owner.name ?? doc.owner.id : "unowned";
+            writeLine(door.io.stdout, `    why: ${doc.stuck_reason ?? "not_recorded_yet"} · owner: ${owner} · decision: ${doc.decision ?? "none"} · ticket: ${doc.ticket ?? "none"}`);
+        }
     }
     if (body.coverage)
         writeLine(door.io.stdout, body.coverage);

package/dist/commands/docs-sync-args.js

@@ -8,10 +8,15 @@
  * The door checks authority and the revision; this file only checks shape. It never picks a choice for the person.
  */
 import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
-const VALUE_FLAGS = ["--home", "--dashboard-url", "--version", "--expected-revision", "--request-id", "--under", "--cursor", "--out"];
+const VALUE_FLAGS = ["--home", "--dashboard-url", "--version", "--expected-revision", "--request-id", "--under", "--cursor", "--out", "--owner", "--decision", "--ticket"];
 const BOOLEAN_FLAGS = ["--json", "--keep-current", "--use-kept", "--all"];
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** ticket 22178: `sync-status <page> --owner|--decision|--ticket` writes the triage labels; without them it reads. */
+const TRIAGE_FLAGS = ["--owner", "--decision", "--ticket"];
+const DECISIONS = ["unlink", "take_notion", "keep_tower", "reshare", "investigate"];
 export function isDocsSyncInvocation(args) {
+    if (args[0] === "sync-status")
+        return args.some((arg) => TRIAGE_FLAGS.includes(arg) || TRIAGE_FLAGS.some((flag) => arg.startsWith(`${flag}=`)));
     return args[0] === "sync-resolve" || args[0] === "manifest";
 }
 export function parseDocsSyncArgs(args) {
@@ -33,6 +38,30 @@ export function parseDocsSyncArgs(args) {
                 throw new Error(`${flag} does not belong to \`cockpit docs ${verb}\`.`);
         }
     };
+    if (verb === "sync-status") {
+        only(TRIAGE_FLAGS);
+        if (rest.length !== 1)
+            throw new Error("docs sync-status with --owner, --decision or --ticket needs exactly one page id or slug, e.g. `cockpit docs sync-status runbook --owner me --decision reshare --ticket 22178`.");
+        const owner = optionalNonEmpty(values.flags.get("--owner"));
+        const decision = optionalNonEmpty(values.flags.get("--decision"));
+        const ticket = optionalNonEmpty(values.flags.get("--ticket"));
+        const triage = {};
+        if (owner !== undefined) {
+            const lowered = owner.toLowerCase();
+            if (lowered !== "me" && lowered !== "none" && !UUID.test(owner))
+                throw new Error("--owner is `me`, a team member's id (a UUID from `cockpit team members`), or `none` to clear it.");
+            triage.owner = lowered === "none" ? null : lowered === "me" ? "me" : owner;
+        }
+        if (decision !== undefined) {
+            const lowered = decision.toLowerCase();
+            if (lowered !== "none" && !DECISIONS.includes(lowered))
+                throw new Error(`--decision is one of ${DECISIONS.join(", ")}, or \`none\` to clear it.`);
+            triage.decision = lowered === "none" ? null : lowered;
+        }
+        if (ticket !== undefined)
+            triage.ticket = ticket.toLowerCase() === "none" ? null : ticket;
+        return { ...base, action: "sync-status", docRef: rest[0], docsSync: { triage } };
+    }
     if (verb === "manifest") {
         only(["--under", "--cursor", "--all", "--out"]);
         if (rest.length !== 0)

package/dist/commands/docs-sync.js

@@ -6,6 +6,8 @@
  *   sync-resolve <page>  POST /api/docs/documents/[id]/notion-sync/resolve
  *   manifest             GET  /api/docs/manifest[?cursor=&under=]
  *
+ *   sync-status <page> --owner --decision --ticket   PATCH /api/docs/documents/[id]/notion-sync   (ticket 22178)
+ *
  * Every line about a receipt, a loss or a conflict is the door's own `sentence`, printed verbatim, so this terminal says
  * what the web panel, the MCP tool and JARVIS say. Tower never asks Notion from a request: the answer is what the last
  * passes recorded, with its age. `manifest` reports readiness; it gives no cutover verdict.
@@ -37,6 +39,10 @@ export function printSyncDetail(door, ref, body) {
     const row = list(body["documents"])[0] ?? {};
     writeLine(door.io.stdout, `${str(row["id"])}  ${str(row["state"])}  ${str(row["slug"]) || "(no slug)"}  ${str(row["title"])}`);
     writeLine(door.io.stdout, str(detail["state_sentence"]));
+    if (str(row["state"]) !== "synced") {
+        const owner = object(row["owner"]);
+        writeLine(door.io.stdout, `Why: ${str(row["stuck_reason"]) || "not_recorded_yet"} · owner: ${str(owner["name"]) || str(owner["id"]) || "unowned"} · decision: ${str(row["decision"]) || "none"} · ticket: ${str(row["ticket"]) || "none"}`);
+    }
     const receipts = object(detail["last_receipt"]);
     for (const direction of ["push", "pull"]) {
         const receipt = object(receipts[direction]);
@@ -63,6 +69,28 @@ export function printSyncDetail(door, ref, body) {
     }
     return 0;
 }
+/** ticket 22178: who owns a stuck page, what was decided, which ticket carries it. Labels only; nothing is unlinked or resolved. */
+export async function syncTriage(command, door) {
+    const ref = command.docRef ?? "";
+    const answer = await askAgentDoor(door, {
+        path: `/api/docs/documents/${encodeURIComponent(ref)}/notion-sync`,
+        method: "PATCH",
+        label: "docs sync-status",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: command.docsSync?.triage ?? {},
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(door.io.stderr, `${TAG} triage ${JSON.stringify({ outcome: body["outcome"] ?? null, changed: body["changed"] ?? [] })}`);
+    if (door.json)
+        return emitAgentDoor(door, { ...body, ok: true });
+    const changed = Array.isArray(body["changed"]) ? body["changed"].map(str) : [];
+    writeLine(door.io.stdout, str(body["outcome"]) === "unchanged"
+        ? "Nothing changed: those labels were already set."
+        : `Saved ${changed.join(", ")}. Owner ${str(body["owner"]) || "unowned"}, decision ${str(body["decision"]) || "none"}, ticket ${str(body["ticket"]) || "none"}. Nothing was unlinked or resolved.`);
+    return 0;
+}
 async function syncResolve(command, door) {
     const ref = command.docRef ?? "";
     const answer = await askAgentDoor(door, {

package/dist/commands/local-discovery.js

@@ -1,3 +1,22 @@
+/**
+ * Finding the git worktrees a command should act on, inside the operator's
+ * approved collection roots.
+ *
+ * Two rules live here and both come from BLI-2362: a folder that could not be
+ * opened is reported rather than treated as empty, and a capped scan reports
+ * partial coverage while collection continues within approved roots. Split out of
+ * commands/local.ts (BLI-3104); moved verbatim.
+ *
+ * A third rule comes from BLI-4467: when no caller passed `--workspace` and the
+ * current folder holds no repos at all, a command that ASKS for it
+ * (`fallbackToSavedRoots`) scans this machine's saved collection roots instead
+ * of refusing. `cockpit status` and `cockpit sessions` ask, because they answer
+ * "what does this machine believe about itself" and that cannot depend on which
+ * folder the operator was standing in. `cockpit start` deliberately does not:
+ * binding a ticket from a scratch folder to every approved root on the machine
+ * is far wider than the operator asked for, so it keeps the old refusal.
+ */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import { writeLine } from "./cli-io.js";
 import { resolveDiscoveryLimits, saveDiscoveryLimits, } from "../discovery-limits.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
@@ -177,11 +196,14 @@ export async function scanWorkDirectories(homeDir, persist = true) {
         return null; throw error; });
     const now = new Date();
     const options = { worktrees: [], collectionRoots: config?.default_repo_paths ?? [], now, sinceMinutes: ROOT_WORK_SCAN_WINDOW_DAYS * 24 * 60, limit: Number.MAX_SAFE_INTEGER };
-    const codex = await scanAndAttributeCodexSessions({ ...options, sessionsDirs: defaultCodexSessionDirs(homeDir) });
-    const claude = config?.collect_claude_jsonl === false ? null : await scanAndAttributeClaudeSessions({ ...options, projectsDir: (await import("node:path")).default.join(homeDir, ".claude", "projects") });
-    if (codex.directory_read_failed_count || codex.stat_failed_count || claude?.project_dir_read_failed_count || claude?.session_stat_failed_count) {
+    const switches = resolveSourceSwitches(config);
+    if (!switches.codex)
+        console.error("[discovery] codex scan withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason }));
+    const codex = switches.codex ? await scanAndAttributeCodexSessions({ ...options, sessionsDirs: defaultCodexSessionDirs(homeDir) }) : null;
+    const claude = !switches.claude ? null : await scanAndAttributeClaudeSessions({ ...options, projectsDir: (await import("node:path")).default.join(homeDir, ".claude", "projects") });
+    if (codex?.directory_read_failed_count || codex?.stat_failed_count || claude?.project_dir_read_failed_count || claude?.session_stat_failed_count) {
         throw new Error("work_directory_scan_incomplete");
     }
-    const results = [...codex.results, ...(claude?.results ?? [])];
+    const results = [...(codex?.results ?? []), ...(claude?.results ?? [])];
     return persist ? saveRootWorkScan(paths, results, now) : { generated_at: now.toISOString(), observed: results.length, directories: workDirectories(results) };
 }

package/dist/commands/local-help-commands-tower.js

@@ -60,7 +60,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "docs",
         [
-            "Usage: cockpit docs [list|search [words]|tree|read <id|slug> [<id|slug>...]|read --parent <id> --bodies|create|update <id>|delete <id|slug> [<id|slug>...]|link <id|slug> <notion-page>|sync-status [<id|slug>]|sync-resolve <id|slug> --version <id> --keep-current|--use-kept|manifest [--under <id|slug>] [--all] [--out <file>]|export <id|slug> [--format md|pdf|docx|txt] [--out <path>]|mutation-status <request-uuid>|share <id|slug> --add|--remove <email>|access <id|slug>|comments <id|slug>|comment <id|slug>|trash|versions <id|slug>|restore <id>|favorite <id|slug>|unfavorite <id|slug>|marks] [flags]",
+            "Usage: cockpit docs [list|search [words]|tree|read <id|slug> [<id|slug>...]|read --parent <id> --bodies|create|update <id>|delete <id|slug> [<id|slug>...]|link <id|slug> <notion-page>|sync-status [<id|slug>] [--owner me|<uuid>|none --decision unlink|take_notion|keep_tower|reshare|investigate|none --ticket <id>|none]|sync-resolve <id|slug> --version <id> --keep-current|--use-kept|manifest [--under <id|slug>] [--all] [--out <file>]|export <id|slug> [--format md|pdf|docx|txt] [--out <path>]|mutation-status <request-uuid>|share <id|slug> --add|--remove <email>|access <id|slug>|comments <id|slug>|comment <id|slug>|trash|versions <id|slug>|restore <id>|favorite <id|slug>|unfavorite <id|slug>|marks] [flags]",
             "",
             "The Tower document library, typed. Bare `cockpit docs` lists every document you may read.",
             "list [--parent <id>|root] [--query <text> [--word]] [--limit <n>] — every document you may see: id, visibility, body size, slug, title. Metadata only — a list never carries a body, so it stays cheap enough for an agent to call (--json was 604 KB for 155 documents before BLI-3737, and is now a few tens of KB). --json shape: { documents: [{ id, slug, title, visibility, parent_id, source, updated_at, body_chars }] }.",

package/dist/commands/local-help-docs-sync.js

@@ -3,7 +3,7 @@
  * from `local-help-commands-tower.ts` to keep that file under the readability ratchet.
  */
 export const DOCS_SYNC_HELP = [
-    "sync-status <id|slug> — one linked page's Notion sync, from what the last push and pull passes RECORDED (Tower never asks Notion from a request): the state sentence, the newest push and pull receipt each with its reason label and age, what could not be carried (\"1 file kept only as a link\", blocks missing, content Tower cannot write back), the conflicts (versions a sync kept, open or resolved, newest 50 with a total) and the decisions made. A page Notion no longer shares reads \"Notion no longer shares this page\", not synced. --json adds { detail: { can_edit, state_sentence, last_receipt: { push, pull }, losses, conflicts: { total, open, shown, items: [{ version_id, version_number, origin, status, sentence, resolution }] }, resolutions, resolve_note, incomplete, as_of } }.",
+    "sync-status <id|slug> — one linked page's Notion sync, from what the last push and pull passes RECORDED (Tower never asks Notion from a request): the state sentence, the newest push and pull receipt each with its reason label and age, what could not be carried (\"1 file kept only as a link\", blocks missing, content Tower cannot write back), the conflicts (versions a sync kept, open or resolved, newest 50 with a total) and the decisions made. A page Notion no longer shares reads \"Notion no longer shares this page\", not synced. A document that is not synced also says WHY (stuck_reason: the reason Notion gave, archived, in_trash, object_not_found, restricted or http_<code>, or the reason the last push refused it, e.g. notion_has_blocks_tower_cannot_write), its owner (or \"unowned\"), the decision and the ticket. Set them with `sync-status <id|slug> --owner me|<team member uuid>|none --decision unlink|take_notion|keep_tower|reshare|investigate|none --ticket <id>|none` (any one or more; labels only, nothing is unlinked or resolved; page editors only). --json adds { detail: { can_edit, state_sentence, last_receipt: { push, pull }, losses, conflicts: { total, open, shown, items: [{ version_id, version_number, origin, status, sentence, resolution }] }, resolutions, resolve_note, incomplete, as_of } }.",
     "sync-resolve <id|slug> --version <id> --keep-current|--use-kept [--expected-revision <n>] [--request-id <uuid>] — decide one conflict; you choose, Tower never picks. --keep-current records the decision and writes no text. --use-kept makes the kept version the page's current text through a version restore (a new history row, revision +1) over your --expected-revision (the page revision you read; stale = revision_conflict, nothing is written or recorded), then records the decision. One decision per kept version: a repeat answers already_resolved with the stored one and writes nothing. Refusals: resolution_write_refused (not a page editor), not_a_sync_conflict (an ordinary version), version_not_found, invalid_resolution. The next push sends the restored text to Notion through the same checks as any push; a page Notion holds content on that Tower cannot write stays protected. --json shape: { ok, outcome: resolved|already_resolved, document_id, resolution: { version_id, choice, resolved_by, resolved_at, resulting_revision }, revision, body_written, note }.",
     "manifest [--under <id|slug>] [--cursor <c>] [--all] [--out <file>] — the library export manifest for a Notion cutover review: readiness facts only, no cutover verdict and no Notion turn-off. Per page you can read (another person's private page never appears): id, slug, title, parent, visibility, author, revision, body_sha256, body_chars, Notion link, editor ids (\"not_visible\" when you may not see them), files (id, name, type, byte size, state; no URLs, no bytes) and no body. 2,000 pages per call with next_cursor; --all walks every call (at most 100) and reports requested, returned, unique and coverage exhausted|capped|failed_partial (a failed call keeps the pages already read and prints the cursor to resume). --out writes the full JSON to a new file (never overwrites). --json shape: { ok, entries, requested, returned, unique, coverage: { status, calls, reason? }, coverage_text, failures: [{ stage, reason, count, document_ids }], next_cursor, under, generated_at }.",
 ];

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.246");
+    writeLine(io?.stdout ?? process.stdout, "0.2.248");
     return 0;
   }
 

package/dist/commands/roots.js

@@ -5,6 +5,7 @@ import { normalizeRootsDetailed } from "../onboarding-roots.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
 import { recordRootApprovals } from "../root-work.js";
 import { writeJsonFile } from "../local-state-files.js";
+import { configForDisk } from "../source-opt-out.js";
 import { writeLine } from "./cli-io.js";
 export function parseRootsArgs(args) {
     const [action, directory, ...flags] = args;
@@ -34,7 +35,7 @@ export async function runRoots(command, io) {
     const config = (await ensureLocalCollectorConfig({ homeDir })).config;
     const updated = { ...config, default_repo_paths: normalizeCollectionRoots([...config.default_repo_paths, ...roots]) };
     await recordRootApprovals(paths, [...config.default_repo_paths, ...roots]);
-    await writeJsonFile(paths.config_file, updated);
+    await writeJsonFile(paths.config_file, configForDisk(updated));
     console.error("[roots] added", JSON.stringify({ added: roots.length, roots: updated.default_repo_paths.length }));
     writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, roots: updated.default_repo_paths }) : `Approved roots: ${updated.default_repo_paths.join(", ")}. Run cockpit doctor to collect the work there.`);
     return 0;

package/dist/commands/session-sync-outside-roots.js

@@ -135,9 +135,12 @@ function isDurableAndUnchanged(result, entry) {
 }
 function sightingsOf(scan, plan) {
     const sightings = [];
-    for (const result of scan.codexAttribution.results) {
-        if (isUnclaimedOutsideRootResult(result)) {
-            sightings.push({ source: "codex", sessionId: result.codex_session_id, result });
+    // Same for Codex: an opted-out machine has no Codex results (`session-sync-scan.ts`).
+    if (plan.codexEnabled) {
+        for (const result of scan.codexAttribution.results) {
+            if (isUnclaimedOutsideRootResult(result)) {
+                sightings.push({ source: "codex", sessionId: result.codex_session_id, result });
+            }
         }
     }
     // A machine that opted out of Claude has no Claude results to begin with

package/dist/commands/session-sync-plan.js

@@ -18,6 +18,7 @@
  * no per-file record), {@link RETRY_WINDOW_FALLBACK_MINUTES} is the bound
  * instead — generous, but still a bound, never "since epoch".
  */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import { readLocalCollectorConfig, } from "../local-state.js";
 import { CLAUDE_CURSOR_FILENAME, emptyRawEvidenceCursorState, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
@@ -45,7 +46,15 @@ export const RETRY_WINDOW_BUFFER_MINUTES = 24 * 60;
  */
 export async function planSyncFromLocalState(options) {
     const config = await readLocalCollectorConfig(options.paths).catch(() => null);
-    const claudeEnabled = config?.collect_claude_jsonl !== false;
+    const switches = resolveSourceSwitches(config);
+    const claudeEnabled = switches.claude;
+    const codexEnabled = switches.codex;
+    if (!codexEnabled) {
+        console.error("[session-sync] codex source withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason }));
+    }
+    if (!claudeEnabled) {
+        console.error("[session-sync] claude source withheld by operator opt-out", JSON.stringify({ reason: switches.claudeReason }));
+    }
     const collectionRoots = normalizeCollectionRoots(options.approvedCollectionRoots ?? config?.default_repo_paths ?? []);
     const [codexCursorBefore, claudeCursorBefore, uploadSpool, outsideRootCatchUpPending] = await readSyncRetryState(options.paths, claudeEnabled);
     // A spooled upload from a CLI old enough not to have recorded its source
@@ -55,13 +64,15 @@ export async function planSyncFromLocalState(options) {
     const claudeSourceRetryPending = sourceScanRetryIsPending(uploadSpool, "claude_code");
     return {
         claudeEnabled,
+        codexEnabled,
         collectionRoots,
         codexCursorBefore,
         claudeCursorBefore,
         uploadSpool,
         codexSourceRetryPending,
         claudeSourceRetryPending,
-        codexRetryPending: sourceHasPendingRetries("codex", uploadSpool, legacyRetryPending, codexSourceRetryPending, codexCursorBefore),
+        codexRetryPending: codexEnabled &&
+            sourceHasPendingRetries("codex", uploadSpool, legacyRetryPending, codexSourceRetryPending, codexCursorBefore),
         claudeRetryPending: claudeEnabled &&
             sourceHasPendingRetries("claude_code", uploadSpool, legacyRetryPending, claudeSourceRetryPending, claudeCursorBefore),
         codexRetrySinceMinutes: boundedRetrySinceMinutes(codexCursorBefore, options.now),

package/dist/commands/session-sync-record.js

@@ -145,6 +145,7 @@ async function resolveFallbackDashboardUrl(homeDir, explicit) {
  */
 async function recordBothSourceCursorObservations(options) {
     const codexStaleCount = await recordCodexSessionObservationsForSync({
+        codexEnabled: options.plan.codexEnabled,
         paths: options.paths,
         codexAttribution: options.scan.codexAttribution,
         sessions: options.sessions,
@@ -196,6 +197,8 @@ async function deliverOrExplainSessionReport(options) {
  * kept as-is rather than forced to match.
  */
 async function recordCodexSessionObservationsForSync(options) {
+    if (!options.codexEnabled)
+        return 0;
     let staleCount = 0;
     try {
         const codexCursor = await readRawEvidenceCursor(options.paths);

package/dist/commands/session-sync-scan.js

@@ -28,6 +28,7 @@ const CLAUDE_DEFAULT_WINDOW_MINUTES = 24 * 60;
 export async function scanAndAttributeBothSources(options) {
     const { plan } = options;
     const codexAttribution = await scanCodexSessionsForSync({
+        codexEnabled: plan.codexEnabled,
         homeDir: options.homeDir,
         worktrees: options.worktrees,
         now: options.now,
@@ -51,13 +52,15 @@ export async function scanAndAttributeBothSources(options) {
         firstRunBackfill,
         outsideRootCatchUpPending: plan.outsideRootCatchUpPending,
     });
-    await reconcileSourceScanRetry({
-        paths: options.paths,
-        source: "codex",
-        attemptedAt: options.now.toISOString(),
-        pendingBefore: plan.codexSourceRetryPending,
-        reason: sourceScanRetryReason("codex", codexAttribution),
-    });
+    if (plan.codexEnabled) {
+        await reconcileSourceScanRetry({
+            paths: options.paths,
+            source: "codex",
+            attemptedAt: options.now.toISOString(),
+            pendingBefore: plan.codexSourceRetryPending,
+            reason: sourceScanRetryReason("codex", codexAttribution),
+        });
+    }
     if (plan.claudeEnabled) {
         await reconcileSourceScanRetry({
             paths: options.paths,
@@ -74,9 +77,13 @@ export async function scanAndAttributeBothSources(options) {
  * Scan and attribute Codex sessions for this sync, widening the window to all
  * local history when a retry is pending. Codex has no first-run backfill
  * concept (that is a Claude-only window, see `scanClaudeSessionsForSync`) and
- * is always scanned, unlike Claude which can be disabled entirely.
+ * is scanned unless the operator opted Codex out (`collect_codex_jsonl: false`
+ * or `raw_evidence_upload: "disabled"`), in which case the scan is empty and the
+ * plan already logged the reason.
  */
 async function scanCodexSessionsForSync(options) {
+    if (!options.codexEnabled)
+        return emptyCodexScan();
     const sinceMinutes = widenForCatchUp(options.retryPending
         ? options.retrySinceMinutes
         : CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES, options.outsideRootCatchUpPending, CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES);
@@ -180,6 +187,21 @@ async function reconcileSourceScanRetry(options) {
         await clearSourceRetryFailure(options.paths, options.source, options.attemptedAt);
     }
 }
+function emptyCodexScan() {
+    return {
+        results: [],
+        discovered_file_count: 0,
+        scanned_file_count: 0,
+        since_minutes: 0,
+        session_limit: 0,
+        session_limit_applied: false,
+        max_file_bytes: 0,
+        directory_read_failed_count: 0,
+        stat_failed_count: 0,
+        secret_path_skipped_count: 0,
+        counts: { attributed: 0, attributed_fallback: 0, ambiguous: 0, unattributed: 0, skipped: 0 },
+    };
+}
 function emptyClaudeScan() {
     return {
         results: [],

package/dist/commands/sources-check.js

@@ -19,6 +19,7 @@
  * "not stored". A list cut short (`capped`, `failed_partial`) still answers,
  * marked incomplete: a missing page can only understate what Tower holds.
  */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import { fetchSourceInventory, reconcileSource } from "./sources-reconciliation.js";
 import { writeLine } from "./cli-io.js";
 import { readDescribedImageKeys } from "../image-description-state.js";
@@ -51,9 +52,14 @@ export async function runSourcesCheck(command, io, now = new Date()) {
     }
     const homeDir = command.homeDir ?? paths.home_dir;
     const olderThanMs = command.olderThanDays === null ? null : now.getTime() - command.olderThanDays * DAY_MS;
-    const optOutAll = command.reconcile === true && config?.raw_evidence_upload === "disabled";
-    const optOutClaude = command.reconcile === true && config?.collect_claude_jsonl === false;
-    const local = await discoverLocalTranscripts({ homeDir, olderThanMs, skipAll: optOutAll, skipClaude: optOutClaude });
+    const switches = resolveSourceSwitches(config);
+    const optOutClaude = command.reconcile === true && !switches.claude;
+    const optOutCodex = command.reconcile === true && !switches.codex;
+    const optOutAll = optOutClaude && optOutCodex;
+    if (optOutClaude || optOutCodex) {
+        console.error("[collector sources] reconcile skips opted-out sources", JSON.stringify({ codex_reason: optOutCodex ? switches.codexReason : null, claude_reason: optOutClaude ? switches.claudeReason : null }));
+    }
+    const local = await discoverLocalTranscripts({ homeDir, olderThanMs, skipAll: optOutAll, skipClaude: optOutClaude, skipCodex: optOutCodex });
     const cursors = {
         codex: await readRawEvidenceCursor(paths),
         claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),

package/dist/commands/sources-discovery.js

@@ -153,7 +153,7 @@ function shapeOrder(shape) {
 }
 async function findTranscriptFiles(options, roots, result, recordFailure) {
     const found = [];
-    const stack = options.skipAll ? [] : [...roots.codex, ...(options.skipClaude ? [] : [roots.claudeProjects])];
+    const stack = options.skipAll ? [] : [...(options.skipCodex ? [] : roots.codex), ...(options.skipClaude ? [] : [roots.claudeProjects])];
     const seen = new Set();
     while (stack.length > 0) {
         const dir = stack.pop();

package/dist/commands/sync-stub-heal.js

@@ -1,3 +1,20 @@
+/**
+ * BLI-11112: the scheduled sync heals this machine's own redaction-crash stubs.
+ *
+ * `cockpit backfill` learned to re-offer a stubbed session (BLI‑11102), but
+ * nobody runs backfill on an intern machine, so their stubs stayed stubs. Once
+ * per tick, after the tick's own uploads and still under the collection lock,
+ * the sync asks the stubs door for this caller's stubs and re-offers up to
+ * `SYNC_STUB_SESSIONS_PER_TICK` sessions of them through the SAME backfill
+ * code: `runBackfill` with `stubPass` set. Same cursor mark, same redaction,
+ * same `stub_replaced` claim, and a claim only for a stub the door named.
+ *
+ * Cheap in the steady state: one door request, and nothing more unless a named
+ * stub belongs to a session this machine's cursor tracks. A stub from another
+ * of the operator's machines is not this machine's to heal; it is counted as
+ * remaining and skipped without a scan. Never throws and never fails the tick.
+ */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import { runBackfill } from "./backfill.js";
 import { loadStubReofferPlan } from "./backfill-stub-reoffer.js";
 import { backfillWaitingCheck } from "./sync-yield.js";
@@ -45,7 +62,18 @@ async function runStubPass(command, io, deps, now, summary) {
     const sessionFile = await readLocalCollectorSessionFile(paths).catch(() => null);
     if (!sessionFile)
         return "no_device_session";
-    const sources = config?.collect_claude_jsonl === false ? ["codex"] : ["codex", "claude_code"];
+    const switches = resolveSourceSwitches(config);
+    const sources = [
+        ...(switches.codex ? ["codex"] : []),
+        ...(switches.claude ? ["claude_code"] : []),
+    ];
+    if (sources.length === 0) {
+        console.error("[collector stubs] no source enabled", JSON.stringify({ reason: switches.codexReason }));
+        return "sources_opted_out";
+    }
+    if (!switches.codex || !switches.claude) {
+        console.error("[collector stubs] source withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason ?? switches.claudeReason, sources: sources.length }));
+    }
     const dashboardUrl = (sessionFile.dashboard_url ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL)
         .trim()
         .replace(/\/+$/, "");

package/dist/local-state-config.js

@@ -5,6 +5,7 @@ import { readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { normalizeCollectionRoots } from "./root-normalization.js";
+import { configForDisk, resolveSourceSwitches } from "./source-opt-out.js";
 import { ensureRuntimeDirectories, getCollectorRuntimePaths, } from "./local-state-paths.js";
 import { isMissingFileError, readJsonFile, writeJsonFile, } from "./local-state-files.js";
 const localCollectorPackage = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
@@ -62,11 +63,23 @@ export async function installLocalCollector(options = {}) {
         operator_id: existingConfig?.operator_id,
         default_repo_paths: defaultRepoPaths,
         raw_evidence_upload: rawEvidenceUpload,
+        // The operator's Claude opt-out survives every rewrite (doctor, onboard,
+        // update, roots add); only the operator turns it back on (BLI-22341).
+        collect_claude_jsonl: existingConfig?.collect_claude_jsonl,
+        // Same for Codex, and for `raw_evidence_upload: "disabled"` below (ticket 22557).
+        collect_codex_jsonl: existingConfig?.collect_codex_jsonl,
         session_file_path: paths.session_file,
         state_dir_path: paths.state_dir,
     });
     await recordRootApprovals(paths, defaultRepoPaths, options.replaceRepoRoots);
-    await writeJsonFile(paths.config_file, config);
+    await writeJsonFile(paths.config_file, configForDisk(config));
+    const switches = resolveSourceSwitches(config);
+    if (!switches.claude) {
+        console.error("[install] claude session upload stays off", JSON.stringify({ reason: switches.claudeReason }));
+    }
+    if (!switches.codex) {
+        console.error("[install] codex session upload stays off", JSON.stringify({ reason: switches.codexReason }));
+    }
     return {
         config,
         paths,
@@ -75,13 +88,14 @@ export async function installLocalCollector(options = {}) {
     };
 }
 /**
- * The one on-disk migration this file performs: both retired raw-evidence
- * choices become the durable one, so a machine installed before durable
- * evidence existed stops holding the old answer forever.
+ * The one on-disk migration this file performs: the retired short-retention
+ * raw-evidence choice becomes the durable one, so a machine installed before
+ * durable evidence existed stops holding the old answer forever. `"disabled"`
+ * is an operator's explicit opt-out of both sources and is kept until they
+ * turn it back on (ticket 22557); it is never healed to on.
  */
 function migrateRawEvidenceUploadChoice(existingConfig) {
-    return existingConfig?.raw_evidence_upload === "disabled" ||
-        existingConfig?.raw_evidence_upload === "remote_short_retention_opt_in"
+    return existingConfig?.raw_evidence_upload === "remote_short_retention_opt_in"
         ? "remote_durable_opt_in"
         : (existingConfig?.raw_evidence_upload ?? "remote_durable_opt_in");
 }
@@ -132,7 +146,7 @@ export async function ensureLocalCollectorConfig(options = {}) {
         session_file_path: paths.session_file,
         state_dir_path: paths.state_dir,
     });
-    await writeJsonFile(paths.config_file, config);
+    await writeJsonFile(paths.config_file, configForDisk(config));
     return { config, paths, created: true };
 }
 /**

package/dist/local-state-pairing.js

@@ -6,6 +6,7 @@ import { describeError, isMissingFileFailure } from "./health-detail.js";
 import { serverFailureDetail } from "./upload-http.js";
 import { ensureRuntimeDirectories, getCollectorRuntimePaths, } from "./local-state-paths.js";
 import { isMissingFileError, writeJsonFile } from "./local-state-files.js";
+import { configForDisk } from "./source-opt-out.js";
 import { defaultDeviceName, LOCAL_COLLECTOR_VERSION, normalizeDashboardUrl, normalizeDeviceName, normalizeOptionalEmail, readLocalCollectorConfig, } from "./local-state-config.js";
 import { readLocalCollectorSessionFile, toSessionReference, } from "./local-state-session.js";
 /**
@@ -80,12 +81,12 @@ async function recordDeviceIdentityWhenChanged(paths, config, device) {
         config.device_name !== device.deviceName ||
         (device.claimedOwnerEmail &&
             config.claimed_owner_email !== device.claimedOwnerEmail)) {
-        await writeJsonFile(paths.config_file, {
+        await writeJsonFile(paths.config_file, configForDisk({
             ...config,
             device_id: device.deviceId,
             device_name: device.deviceName,
             claimed_owner_email: device.claimedOwnerEmail,
-        });
+        }));
     }
 }
 /**

package/dist/source-opt-out.js

@@ -0,0 +1,33 @@
+export const CODEX_OPT_OUT_REASON = "collect_codex_jsonl_false";
+export const CLAUDE_OPT_OUT_REASON = "collect_claude_jsonl_false";
+export const ALL_SOURCES_OPT_OUT_REASON = "raw_evidence_upload_disabled";
+/** A missing or unreadable config is "no opt-out": collection stays on. */
+export function resolveSourceSwitches(config) {
+    const all = config?.raw_evidence_upload === "disabled";
+    const codexReason = config?.collect_codex_jsonl === false
+        ? CODEX_OPT_OUT_REASON
+        : all ? ALL_SOURCES_OPT_OUT_REASON : null;
+    const claudeReason = config?.collect_claude_jsonl === false
+        ? CLAUDE_OPT_OUT_REASON
+        : all ? ALL_SOURCES_OPT_OUT_REASON : null;
+    return {
+        codex: codexReason === null,
+        claude: claudeReason === null,
+        codexReason,
+        claudeReason,
+    };
+}
+/** The reason label for one source, or null when that source is on. */
+export function sourceOptOutReason(config, source) {
+    const switches = resolveSourceSwitches(config);
+    return source === "codex" ? switches.codexReason : switches.claudeReason;
+}
+/**
+ * The key `collect_codex_jsonl` reaches disk only when it is `false`. An older
+ * CLI's strict schema rejects an unknown key, so a machine that never opted out
+ * keeps a config file every CLI version can read. Every config writer uses this.
+ */
+export function configForDisk(config) {
+    const { collect_codex_jsonl: codexSwitch, ...rest } = config;
+    return codexSwitch === false ? { ...rest, collect_codex_jsonl: false } : rest;
+}

package/dist/upload-envelope-build.js

@@ -3,6 +3,7 @@
  * Read the workspace context, describe transcript images, collect sources,
  * then sanitize and assemble the event. Blockers retain their retry commands.
  */
+import { resolveSourceSwitches } from "./source-opt-out.js";
 import { priorSnapshotsFromCursor, } from "./adapters/raw-evidence-snapshot-supersede.js";
 import { TelemetryIngestEnvelopeSchema, } from "@bli-cockpit/telemetry-core";
 import path from "node:path";
@@ -88,7 +89,7 @@ export async function buildLocalAmbientEnvelope(options = {}) {
         deviceToken: sessionFile.device_token,
         fetchImpl: options.fetch,
     });
-    const sourceCollection = await collectEnvelopeSources(options, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now);
+    const sourceCollection = await collectEnvelopeSources(options, collector.config, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now);
     return assembleLocalEnvelope(options, collector, uploadContext, repoLabel, sourceCollection, now);
 }
 function assembleLocalEnvelope(options, collector, uploadContext, repoLabel, sourceCollection, now) {
@@ -141,7 +142,13 @@ function assembleLocalEnvelope(options, collector, uploadContext, repoLabel, sou
         raw_evidence_facts: sourceCollection.facts.raw_evidence,
     };
 }
-async function collectEnvelopeSources(options, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now) {
+async function collectEnvelopeSources(options, config, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now) {
+    // The last gate before any transcript byte is read for upload: a source the
+    // operator opted out of is never collected, whoever the caller is (ticket 22557).
+    const switches = resolveSourceSwitches(config);
+    if (!switches.codex || !switches.claude) {
+        console.error("[upload-envelope] source withheld by operator opt-out", JSON.stringify({ codex_reason: switches.codexReason, claude_reason: switches.claudeReason }));
+    }
     const sourceCollection = await runLocalSourceCollectors({
         repoRoot,
         branch: uploadContext.branch,
@@ -153,8 +160,8 @@ async function collectEnvelopeSources(options, paths, repoRoot, uploadContext, s
         rawEvidenceStateDir: paths.state_dir,
         rawEvidenceSessionsDirs: defaultCodexSessionDirs(paths.home_dir),
         claudeProjectsDir: path.join(paths.home_dir, ".claude", "projects"),
-        rawEvidenceIncludeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
-        rawEvidenceIncludeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,
+        rawEvidenceIncludeCodexJsonl: switches.codex ? options.rawEvidenceIncludeCodexJsonl : false,
+        rawEvidenceIncludeClaudeJsonl: switches.claude ? options.rawEvidenceIncludeClaudeJsonl : false,
         rawEvidenceCodexSessionFiles: options.codexSessionFiles,
         rawEvidenceCodexAttributionScan: options.codexAttributionScan,
         rawEvidenceClaudeSessionFiles: options.claudeSessionFiles,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.246",
+  "version": "0.2.248",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.72",
-    "@bli-cockpit/mcp": "0.1.151",
-    "@bli-cockpit/telemetry-core": "0.1.79"
+    "@bli-cockpit/memory-mcp": "0.1.73",
+    "@bli-cockpit/mcp": "0.1.152",
+    "@bli-cockpit/telemetry-core": "0.1.80"
   },
   "repository": {
     "type": "git",