@bli-cockpit/cli 0.2.247 → 0.2.249

package/dist/commands/backfill-scope.js

@@ -4,6 +4,7 @@
  * which stores and how far back was it asked for, and can it reach the
  * dashboard at all. Nothing here opens a transcript.
  */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import path from "node:path";
 import { readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, } from "../local-state.js";
 import { DEFAULT_DISCOVERY_MAX_DEPTH, DEFAULT_DISCOVERY_MAX_REPOS, collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
@@ -44,22 +45,30 @@ export async function resolveBackfillScope(command, io, now, paths) {
         collectionRoots,
         worktreeDiscovery,
         retryCommand: backfillDiscoveryRetryCommand(command, worktreeDiscovery),
-        sources: honourClaudeOptOut(selectedSources(command.source), config.collect_claude_jsonl),
+        sources: honourSourceOptOuts(selectedSources(command.source), config),
         window,
     };
 }
 /**
  * Session-first (BLI-11091): now that outside-root sessions upload, an
  * explicit operator opt-out is the only thing that withholds one. The
- * per-machine Claude opt-out (`collect_claude_jsonl: false`) the scheduled
- * sync already honours (`session-sync-plan.ts`) therefore holds here too:
- * backfill never reads the Claude store on a machine that said no.
+ * per-machine opt-outs the scheduled sync already honours
+ * (`session-sync-plan.ts`) hold here too: `collect_claude_jsonl: false`,
+ * `collect_codex_jsonl: false` and `raw_evidence_upload: "disabled"` (both).
+ * Backfill never reads the store of a source the machine said no to, and logs
+ * the reason label (ticket 22557).
  */
-function honourClaudeOptOut(sources, collectClaudeJsonl) {
-    if (collectClaudeJsonl !== false || !sources.includes("claude_code"))
+function honourSourceOptOuts(sources, config) {
+    const switches = resolveSourceSwitches(config);
+    const kept = sources.filter((source) => (source === "codex" ? switches.codex : switches.claude));
+    if (kept.length === sources.length)
         return sources;
-    console.error("[backfill] claude source withheld by operator opt-out", JSON.stringify({ reason: "collect_claude_jsonl_false", sources_before: sources.length }));
-    return sources.filter((source) => source !== "claude_code");
+    for (const source of sources) {
+        if (kept.includes(source))
+            continue;
+        console.error(`[backfill] ${source === "codex" ? "codex" : "claude"} source withheld by operator opt-out`, JSON.stringify({ reason: source === "codex" ? switches.codexReason : switches.claudeReason, sources_before: sources.length }));
+    }
+    return kept;
 }
 function backfillCollectionRoots(command, savedRoots) {
     if (command.repoRoot)

package/dist/commands/docs-notion.js

@@ -16,7 +16,7 @@
 import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
 import { writeLine } from "./cli-io.js";
 import { resolveDocId } from "./docs.js";
-import { printSyncDetail } from "./docs-sync.js";
+import { printSyncDetail, syncTriage } from "./docs-sync.js";
 const TAG = "[docs cli]";
 const READ_DEADLINE_MS = 30_000;
 const WRITE_DEADLINE_MS = 60_000;
@@ -32,6 +32,9 @@ function runLine(direction, run) {
  * never claims anything about Notion it has not read.
  */
 export async function syncStatusDocs(command, door) {
+    // ticket 22178: `--owner|--decision|--ticket` turns the read into a label write on the same verb.
+    if (command.docsSync?.triage)
+        return syncTriage(command, door);
     let path = "/api/docs/notion-sync";
     if (command.docRef) {
         const resolved = await resolveDocId(door, command.docRef);
@@ -61,6 +64,11 @@ export async function syncStatusDocs(command, door) {
     const documents = body.documents ?? [];
     for (const doc of documents) {
         writeLine(door.io.stdout, `${doc.id}  ${doc.state.padEnd(13)}  ${(doc.notion_synced_at ?? "never").padEnd(25)}  ${doc.slug ?? "(no slug)"}  ${doc.title}`);
+        // ticket 22178: a document that is not synced says why, who owns it and what was decided.
+        if (doc.state !== "synced") {
+            const owner = doc.owner ? doc.owner.name ?? doc.owner.id : "unowned";
+            writeLine(door.io.stdout, `    why: ${doc.stuck_reason ?? "not_recorded_yet"} · owner: ${owner} · decision: ${doc.decision ?? "none"} · ticket: ${doc.ticket ?? "none"}`);
+        }
     }
     if (body.coverage)
         writeLine(door.io.stdout, body.coverage);

package/dist/commands/docs-sync-args.js

@@ -8,10 +8,15 @@
  * The door checks authority and the revision; this file only checks shape. It never picks a choice for the person.
  */
 import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
-const VALUE_FLAGS = ["--home", "--dashboard-url", "--version", "--expected-revision", "--request-id", "--under", "--cursor", "--out"];
+const VALUE_FLAGS = ["--home", "--dashboard-url", "--version", "--expected-revision", "--request-id", "--under", "--cursor", "--out", "--owner", "--decision", "--ticket"];
 const BOOLEAN_FLAGS = ["--json", "--keep-current", "--use-kept", "--all"];
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** ticket 22178: `sync-status <page> --owner|--decision|--ticket` writes the triage labels; without them it reads. */
+const TRIAGE_FLAGS = ["--owner", "--decision", "--ticket"];
+const DECISIONS = ["unlink", "take_notion", "keep_tower", "reshare", "investigate"];
 export function isDocsSyncInvocation(args) {
+    if (args[0] === "sync-status")
+        return args.some((arg) => TRIAGE_FLAGS.includes(arg) || TRIAGE_FLAGS.some((flag) => arg.startsWith(`${flag}=`)));
     return args[0] === "sync-resolve" || args[0] === "manifest";
 }
 export function parseDocsSyncArgs(args) {
@@ -33,6 +38,30 @@ export function parseDocsSyncArgs(args) {
                 throw new Error(`${flag} does not belong to \`cockpit docs ${verb}\`.`);
         }
     };
+    if (verb === "sync-status") {
+        only(TRIAGE_FLAGS);
+        if (rest.length !== 1)
+            throw new Error("docs sync-status with --owner, --decision or --ticket needs exactly one page id or slug, e.g. `cockpit docs sync-status runbook --owner me --decision reshare --ticket 22178`.");
+        const owner = optionalNonEmpty(values.flags.get("--owner"));
+        const decision = optionalNonEmpty(values.flags.get("--decision"));
+        const ticket = optionalNonEmpty(values.flags.get("--ticket"));
+        const triage = {};
+        if (owner !== undefined) {
+            const lowered = owner.toLowerCase();
+            if (lowered !== "me" && lowered !== "none" && !UUID.test(owner))
+                throw new Error("--owner is `me`, a team member's id (a UUID from `cockpit team members`), or `none` to clear it.");
+            triage.owner = lowered === "none" ? null : lowered === "me" ? "me" : owner;
+        }
+        if (decision !== undefined) {
+            const lowered = decision.toLowerCase();
+            if (lowered !== "none" && !DECISIONS.includes(lowered))
+                throw new Error(`--decision is one of ${DECISIONS.join(", ")}, or \`none\` to clear it.`);
+            triage.decision = lowered === "none" ? null : lowered;
+        }
+        if (ticket !== undefined)
+            triage.ticket = ticket.toLowerCase() === "none" ? null : ticket;
+        return { ...base, action: "sync-status", docRef: rest[0], docsSync: { triage } };
+    }
     if (verb === "manifest") {
         only(["--under", "--cursor", "--all", "--out"]);
         if (rest.length !== 0)

package/dist/commands/docs-sync.js

@@ -6,6 +6,8 @@
  *   sync-resolve <page>  POST /api/docs/documents/[id]/notion-sync/resolve
  *   manifest             GET  /api/docs/manifest[?cursor=&under=]
  *
+ *   sync-status <page> --owner --decision --ticket   PATCH /api/docs/documents/[id]/notion-sync   (ticket 22178)
+ *
  * Every line about a receipt, a loss or a conflict is the door's own `sentence`, printed verbatim, so this terminal says
  * what the web panel, the MCP tool and JARVIS say. Tower never asks Notion from a request: the answer is what the last
  * passes recorded, with its age. `manifest` reports readiness; it gives no cutover verdict.
@@ -37,6 +39,10 @@ export function printSyncDetail(door, ref, body) {
     const row = list(body["documents"])[0] ?? {};
     writeLine(door.io.stdout, `${str(row["id"])}  ${str(row["state"])}  ${str(row["slug"]) || "(no slug)"}  ${str(row["title"])}`);
     writeLine(door.io.stdout, str(detail["state_sentence"]));
+    if (str(row["state"]) !== "synced") {
+        const owner = object(row["owner"]);
+        writeLine(door.io.stdout, `Why: ${str(row["stuck_reason"]) || "not_recorded_yet"} · owner: ${str(owner["name"]) || str(owner["id"]) || "unowned"} · decision: ${str(row["decision"]) || "none"} · ticket: ${str(row["ticket"]) || "none"}`);
+    }
     const receipts = object(detail["last_receipt"]);
     for (const direction of ["push", "pull"]) {
         const receipt = object(receipts[direction]);
@@ -63,6 +69,28 @@ export function printSyncDetail(door, ref, body) {
     }
     return 0;
 }
+/** ticket 22178: who owns a stuck page, what was decided, which ticket carries it. `unlink` unlinks in the call; `keep_tower`/`take_notion` apply on the next pass (the door's `note` says so). */
+export async function syncTriage(command, door) {
+    const ref = command.docRef ?? "";
+    const answer = await askAgentDoor(door, {
+        path: `/api/docs/documents/${encodeURIComponent(ref)}/notion-sync`,
+        method: "PATCH",
+        label: "docs sync-status",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: command.docsSync?.triage ?? {},
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(door.io.stderr, `${TAG} triage ${JSON.stringify({ outcome: body["outcome"] ?? null, changed: body["changed"] ?? [] })}`);
+    if (door.json)
+        return emitAgentDoor(door, { ...body, ok: true });
+    const changed = Array.isArray(body["changed"]) ? body["changed"].map(str) : [];
+    writeLine(door.io.stdout, str(body["outcome"]) === "unchanged"
+        ? "Nothing changed: those labels were already set."
+        : `Saved ${changed.join(", ")}. Owner ${str(body["owner"]) || "unowned"}, decision ${str(body["decision"]) || "none"}, ticket ${str(body["ticket"]) || "none"}. ${str(body["note"]) || "Nothing else changed."}`);
+    return 0;
+}
 async function syncResolve(command, door) {
     const ref = command.docRef ?? "";
     const answer = await askAgentDoor(door, {

package/dist/commands/local-discovery.js

@@ -1,3 +1,22 @@
+/**
+ * Finding the git worktrees a command should act on, inside the operator's
+ * approved collection roots.
+ *
+ * Two rules live here and both come from BLI-2362: a folder that could not be
+ * opened is reported rather than treated as empty, and a capped scan reports
+ * partial coverage while collection continues within approved roots. Split out of
+ * commands/local.ts (BLI-3104); moved verbatim.
+ *
+ * A third rule comes from BLI-4467: when no caller passed `--workspace` and the
+ * current folder holds no repos at all, a command that ASKS for it
+ * (`fallbackToSavedRoots`) scans this machine's saved collection roots instead
+ * of refusing. `cockpit status` and `cockpit sessions` ask, because they answer
+ * "what does this machine believe about itself" and that cannot depend on which
+ * folder the operator was standing in. `cockpit start` deliberately does not:
+ * binding a ticket from a scratch folder to every approved root on the machine
+ * is far wider than the operator asked for, so it keeps the old refusal.
+ */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import { writeLine } from "./cli-io.js";
 import { resolveDiscoveryLimits, saveDiscoveryLimits, } from "../discovery-limits.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
@@ -177,11 +196,14 @@ export async function scanWorkDirectories(homeDir, persist = true) {
         return null; throw error; });
     const now = new Date();
     const options = { worktrees: [], collectionRoots: config?.default_repo_paths ?? [], now, sinceMinutes: ROOT_WORK_SCAN_WINDOW_DAYS * 24 * 60, limit: Number.MAX_SAFE_INTEGER };
-    const codex = await scanAndAttributeCodexSessions({ ...options, sessionsDirs: defaultCodexSessionDirs(homeDir) });
-    const claude = config?.collect_claude_jsonl === false ? null : await scanAndAttributeClaudeSessions({ ...options, projectsDir: (await import("node:path")).default.join(homeDir, ".claude", "projects") });
-    if (codex.directory_read_failed_count || codex.stat_failed_count || claude?.project_dir_read_failed_count || claude?.session_stat_failed_count) {
+    const switches = resolveSourceSwitches(config);
+    if (!switches.codex)
+        console.error("[discovery] codex scan withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason }));
+    const codex = switches.codex ? await scanAndAttributeCodexSessions({ ...options, sessionsDirs: defaultCodexSessionDirs(homeDir) }) : null;
+    const claude = !switches.claude ? null : await scanAndAttributeClaudeSessions({ ...options, projectsDir: (await import("node:path")).default.join(homeDir, ".claude", "projects") });
+    if (codex?.directory_read_failed_count || codex?.stat_failed_count || claude?.project_dir_read_failed_count || claude?.session_stat_failed_count) {
         throw new Error("work_directory_scan_incomplete");
     }
-    const results = [...codex.results, ...(claude?.results ?? [])];
+    const results = [...(codex?.results ?? []), ...(claude?.results ?? [])];
     return persist ? saveRootWorkScan(paths, results, now) : { generated_at: now.toISOString(), observed: results.length, directories: workDirectories(results) };
 }

package/dist/commands/local-help-commands-tower.js

@@ -60,7 +60,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "docs",
         [
-            "Usage: cockpit docs [list|search [words]|tree|read <id|slug> [<id|slug>...]|read --parent <id> --bodies|create|update <id>|delete <id|slug> [<id|slug>...]|link <id|slug> <notion-page>|sync-status [<id|slug>]|sync-resolve <id|slug> --version <id> --keep-current|--use-kept|manifest [--under <id|slug>] [--all] [--out <file>]|export <id|slug> [--format md|pdf|docx|txt] [--out <path>]|mutation-status <request-uuid>|share <id|slug> --add|--remove <email>|access <id|slug>|comments <id|slug>|comment <id|slug>|trash|versions <id|slug>|restore <id>|favorite <id|slug>|unfavorite <id|slug>|marks] [flags]",
+            "Usage: cockpit docs [list|search [words]|tree|read <id|slug> [<id|slug>...]|read --parent <id> --bodies|create|update <id>|delete <id|slug> [<id|slug>...]|link <id|slug> <notion-page>|sync-status [<id|slug>] [--owner me|<uuid>|none --decision unlink|take_notion|keep_tower|reshare|investigate|none --ticket <id>|none]|sync-resolve <id|slug> --version <id> --keep-current|--use-kept|manifest [--under <id|slug>] [--all] [--out <file>]|export <id|slug> [--format md|pdf|docx|txt] [--out <path>]|mutation-status <request-uuid>|share <id|slug> --add|--remove <email>|access <id|slug>|comments <id|slug>|comment <id|slug>|trash|versions <id|slug>|restore <id>|favorite <id|slug>|unfavorite <id|slug>|marks] [flags]",
             "",
             "The Tower document library, typed. Bare `cockpit docs` lists every document you may read.",
             "list [--parent <id>|root] [--query <text> [--word]] [--limit <n>] — every document you may see: id, visibility, body size, slug, title. Metadata only — a list never carries a body, so it stays cheap enough for an agent to call (--json was 604 KB for 155 documents before BLI-3737, and is now a few tens of KB). --json shape: { documents: [{ id, slug, title, visibility, parent_id, source, updated_at, body_chars }] }.",

package/dist/commands/local-help-docs-sync.js

@@ -3,7 +3,7 @@
  * from `local-help-commands-tower.ts` to keep that file under the readability ratchet.
  */
 export const DOCS_SYNC_HELP = [
-    "sync-status <id|slug> — one linked page's Notion sync, from what the last push and pull passes RECORDED (Tower never asks Notion from a request): the state sentence, the newest push and pull receipt each with its reason label and age, what could not be carried (\"1 file kept only as a link\", blocks missing, content Tower cannot write back), the conflicts (versions a sync kept, open or resolved, newest 50 with a total) and the decisions made. A page Notion no longer shares reads \"Notion no longer shares this page\", not synced. --json adds { detail: { can_edit, state_sentence, last_receipt: { push, pull }, losses, conflicts: { total, open, shown, items: [{ version_id, version_number, origin, status, sentence, resolution }] }, resolutions, resolve_note, incomplete, as_of } }.",
+    "sync-status <id|slug> — one linked page's Notion sync, from what the last push and pull passes RECORDED (Tower never asks Notion from a request): the state sentence, the newest push and pull receipt each with its reason label and age, what could not be carried (\"1 file kept only as a link\", blocks missing, content Tower cannot write back), the conflicts (versions a sync kept, open or resolved, newest 50 with a total) and the decisions made. A page Notion no longer shares reads \"Notion no longer shares this page\", not synced. A document that is not synced also says WHY (stuck_reason: the reason Notion gave, archived, in_trash, object_not_found, restricted or http_<code>, or the reason the last push refused it, e.g. notion_has_blocks_tower_cannot_write), its owner (or \"unowned\"), the decision and the ticket. Set them with `sync-status <id|slug> --owner me|<team member uuid>|none --decision unlink|take_notion|keep_tower|reshare|investigate|none --ticket <id>|none` (any one or more; page editors only). A decision takes effect: unlink unlinks in that call; keep_tower is applied by the next push pass (Tower's edits go to Notion, the Notion content Tower cannot write stays in place, or the push refuses by name and the page stays stuck); take_notion is applied by the next pull pass (Notion's text becomes the page's text, Tower's kept as a version); reshare and investigate are notes. A Notion database folder (todo-list, daily-stand-ups) refuses a decision (database_folder_not_decidable). --json adds { detail: { can_edit, state_sentence, last_receipt: { push, pull }, losses, conflicts: { total, open, shown, items: [{ version_id, version_number, origin, status, sentence, resolution }] }, resolutions, resolve_note, incomplete, as_of } }.",
     "sync-resolve <id|slug> --version <id> --keep-current|--use-kept [--expected-revision <n>] [--request-id <uuid>] — decide one conflict; you choose, Tower never picks. --keep-current records the decision and writes no text. --use-kept makes the kept version the page's current text through a version restore (a new history row, revision +1) over your --expected-revision (the page revision you read; stale = revision_conflict, nothing is written or recorded), then records the decision. One decision per kept version: a repeat answers already_resolved with the stored one and writes nothing. Refusals: resolution_write_refused (not a page editor), not_a_sync_conflict (an ordinary version), version_not_found, invalid_resolution. The next push sends the restored text to Notion through the same checks as any push; a page Notion holds content on that Tower cannot write stays protected. --json shape: { ok, outcome: resolved|already_resolved, document_id, resolution: { version_id, choice, resolved_by, resolved_at, resulting_revision }, revision, body_written, note }.",
     "manifest [--under <id|slug>] [--cursor <c>] [--all] [--out <file>] — the library export manifest for a Notion cutover review: readiness facts only, no cutover verdict and no Notion turn-off. Per page you can read (another person's private page never appears): id, slug, title, parent, visibility, author, revision, body_sha256, body_chars, Notion link, editor ids (\"not_visible\" when you may not see them), files (id, name, type, byte size, state; no URLs, no bytes) and no body. 2,000 pages per call with next_cursor; --all walks every call (at most 100) and reports requested, returned, unique and coverage exhausted|capped|failed_partial (a failed call keeps the pages already read and prints the cursor to resume). --out writes the full JSON to a new file (never overwrites). --json shape: { ok, entries, requested, returned, unique, coverage: { status, calls, reason? }, coverage_text, failures: [{ stage, reason, count, document_ids }], next_cursor, under, generated_at }.",
 ];

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.247");
+    writeLine(io?.stdout ?? process.stdout, "0.2.249");
     return 0;
   }
 

package/dist/commands/roots.js

@@ -5,6 +5,7 @@ import { normalizeRootsDetailed } from "../onboarding-roots.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
 import { recordRootApprovals } from "../root-work.js";
 import { writeJsonFile } from "../local-state-files.js";
+import { configForDisk } from "../source-opt-out.js";
 import { writeLine } from "./cli-io.js";
 export function parseRootsArgs(args) {
     const [action, directory, ...flags] = args;
@@ -34,7 +35,7 @@ export async function runRoots(command, io) {
     const config = (await ensureLocalCollectorConfig({ homeDir })).config;
     const updated = { ...config, default_repo_paths: normalizeCollectionRoots([...config.default_repo_paths, ...roots]) };
     await recordRootApprovals(paths, [...config.default_repo_paths, ...roots]);
-    await writeJsonFile(paths.config_file, updated);
+    await writeJsonFile(paths.config_file, configForDisk(updated));
     console.error("[roots] added", JSON.stringify({ added: roots.length, roots: updated.default_repo_paths.length }));
     writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, roots: updated.default_repo_paths }) : `Approved roots: ${updated.default_repo_paths.join(", ")}. Run cockpit doctor to collect the work there.`);
     return 0;

package/dist/commands/session-sync-outside-roots.js

@@ -135,9 +135,12 @@ function isDurableAndUnchanged(result, entry) {
 }
 function sightingsOf(scan, plan) {
     const sightings = [];
-    for (const result of scan.codexAttribution.results) {
-        if (isUnclaimedOutsideRootResult(result)) {
-            sightings.push({ source: "codex", sessionId: result.codex_session_id, result });
+    // Same for Codex: an opted-out machine has no Codex results (`session-sync-scan.ts`).
+    if (plan.codexEnabled) {
+        for (const result of scan.codexAttribution.results) {
+            if (isUnclaimedOutsideRootResult(result)) {
+                sightings.push({ source: "codex", sessionId: result.codex_session_id, result });
+            }
         }
     }
     // A machine that opted out of Claude has no Claude results to begin with

package/dist/commands/session-sync-plan.js

@@ -18,6 +18,7 @@
  * no per-file record), {@link RETRY_WINDOW_FALLBACK_MINUTES} is the bound
  * instead — generous, but still a bound, never "since epoch".
  */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import { readLocalCollectorConfig, } from "../local-state.js";
 import { CLAUDE_CURSOR_FILENAME, emptyRawEvidenceCursorState, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
@@ -45,7 +46,15 @@ export const RETRY_WINDOW_BUFFER_MINUTES = 24 * 60;
  */
 export async function planSyncFromLocalState(options) {
     const config = await readLocalCollectorConfig(options.paths).catch(() => null);
-    const claudeEnabled = config?.collect_claude_jsonl !== false;
+    const switches = resolveSourceSwitches(config);
+    const claudeEnabled = switches.claude;
+    const codexEnabled = switches.codex;
+    if (!codexEnabled) {
+        console.error("[session-sync] codex source withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason }));
+    }
+    if (!claudeEnabled) {
+        console.error("[session-sync] claude source withheld by operator opt-out", JSON.stringify({ reason: switches.claudeReason }));
+    }
     const collectionRoots = normalizeCollectionRoots(options.approvedCollectionRoots ?? config?.default_repo_paths ?? []);
     const [codexCursorBefore, claudeCursorBefore, uploadSpool, outsideRootCatchUpPending] = await readSyncRetryState(options.paths, claudeEnabled);
     // A spooled upload from a CLI old enough not to have recorded its source
@@ -55,13 +64,15 @@ export async function planSyncFromLocalState(options) {
     const claudeSourceRetryPending = sourceScanRetryIsPending(uploadSpool, "claude_code");
     return {
         claudeEnabled,
+        codexEnabled,
         collectionRoots,
         codexCursorBefore,
         claudeCursorBefore,
         uploadSpool,
         codexSourceRetryPending,
         claudeSourceRetryPending,
-        codexRetryPending: sourceHasPendingRetries("codex", uploadSpool, legacyRetryPending, codexSourceRetryPending, codexCursorBefore),
+        codexRetryPending: codexEnabled &&
+            sourceHasPendingRetries("codex", uploadSpool, legacyRetryPending, codexSourceRetryPending, codexCursorBefore),
         claudeRetryPending: claudeEnabled &&
             sourceHasPendingRetries("claude_code", uploadSpool, legacyRetryPending, claudeSourceRetryPending, claudeCursorBefore),
         codexRetrySinceMinutes: boundedRetrySinceMinutes(codexCursorBefore, options.now),

package/dist/commands/session-sync-record.js

@@ -145,6 +145,7 @@ async function resolveFallbackDashboardUrl(homeDir, explicit) {
  */
 async function recordBothSourceCursorObservations(options) {
     const codexStaleCount = await recordCodexSessionObservationsForSync({
+        codexEnabled: options.plan.codexEnabled,
         paths: options.paths,
         codexAttribution: options.scan.codexAttribution,
         sessions: options.sessions,
@@ -196,6 +197,8 @@ async function deliverOrExplainSessionReport(options) {
  * kept as-is rather than forced to match.
  */
 async function recordCodexSessionObservationsForSync(options) {
+    if (!options.codexEnabled)
+        return 0;
     let staleCount = 0;
     try {
         const codexCursor = await readRawEvidenceCursor(options.paths);

package/dist/commands/session-sync-scan.js

@@ -28,6 +28,7 @@ const CLAUDE_DEFAULT_WINDOW_MINUTES = 24 * 60;
 export async function scanAndAttributeBothSources(options) {
     const { plan } = options;
     const codexAttribution = await scanCodexSessionsForSync({
+        codexEnabled: plan.codexEnabled,
         homeDir: options.homeDir,
         worktrees: options.worktrees,
         now: options.now,
@@ -51,13 +52,15 @@ export async function scanAndAttributeBothSources(options) {
         firstRunBackfill,
         outsideRootCatchUpPending: plan.outsideRootCatchUpPending,
     });
-    await reconcileSourceScanRetry({
-        paths: options.paths,
-        source: "codex",
-        attemptedAt: options.now.toISOString(),
-        pendingBefore: plan.codexSourceRetryPending,
-        reason: sourceScanRetryReason("codex", codexAttribution),
-    });
+    if (plan.codexEnabled) {
+        await reconcileSourceScanRetry({
+            paths: options.paths,
+            source: "codex",
+            attemptedAt: options.now.toISOString(),
+            pendingBefore: plan.codexSourceRetryPending,
+            reason: sourceScanRetryReason("codex", codexAttribution),
+        });
+    }
     if (plan.claudeEnabled) {
         await reconcileSourceScanRetry({
             paths: options.paths,
@@ -74,9 +77,13 @@ export async function scanAndAttributeBothSources(options) {
  * Scan and attribute Codex sessions for this sync, widening the window to all
  * local history when a retry is pending. Codex has no first-run backfill
  * concept (that is a Claude-only window, see `scanClaudeSessionsForSync`) and
- * is always scanned, unlike Claude which can be disabled entirely.
+ * is scanned unless the operator opted Codex out (`collect_codex_jsonl: false`
+ * or `raw_evidence_upload: "disabled"`), in which case the scan is empty and the
+ * plan already logged the reason.
  */
 async function scanCodexSessionsForSync(options) {
+    if (!options.codexEnabled)
+        return emptyCodexScan();
     const sinceMinutes = widenForCatchUp(options.retryPending
         ? options.retrySinceMinutes
         : CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES, options.outsideRootCatchUpPending, CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES);
@@ -180,6 +187,21 @@ async function reconcileSourceScanRetry(options) {
         await clearSourceRetryFailure(options.paths, options.source, options.attemptedAt);
     }
 }
+function emptyCodexScan() {
+    return {
+        results: [],
+        discovered_file_count: 0,
+        scanned_file_count: 0,
+        since_minutes: 0,
+        session_limit: 0,
+        session_limit_applied: false,
+        max_file_bytes: 0,
+        directory_read_failed_count: 0,
+        stat_failed_count: 0,
+        secret_path_skipped_count: 0,
+        counts: { attributed: 0, attributed_fallback: 0, ambiguous: 0, unattributed: 0, skipped: 0 },
+    };
+}
 function emptyClaudeScan() {
     return {
         results: [],

package/dist/commands/sources-check.js

@@ -19,6 +19,7 @@
  * "not stored". A list cut short (`capped`, `failed_partial`) still answers,
  * marked incomplete: a missing page can only understate what Tower holds.
  */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import { fetchSourceInventory, reconcileSource } from "./sources-reconciliation.js";
 import { writeLine } from "./cli-io.js";
 import { readDescribedImageKeys } from "../image-description-state.js";
@@ -51,9 +52,14 @@ export async function runSourcesCheck(command, io, now = new Date()) {
     }
     const homeDir = command.homeDir ?? paths.home_dir;
     const olderThanMs = command.olderThanDays === null ? null : now.getTime() - command.olderThanDays * DAY_MS;
-    const optOutAll = command.reconcile === true && config?.raw_evidence_upload === "disabled";
-    const optOutClaude = command.reconcile === true && config?.collect_claude_jsonl === false;
-    const local = await discoverLocalTranscripts({ homeDir, olderThanMs, skipAll: optOutAll, skipClaude: optOutClaude });
+    const switches = resolveSourceSwitches(config);
+    const optOutClaude = command.reconcile === true && !switches.claude;
+    const optOutCodex = command.reconcile === true && !switches.codex;
+    const optOutAll = optOutClaude && optOutCodex;
+    if (optOutClaude || optOutCodex) {
+        console.error("[collector sources] reconcile skips opted-out sources", JSON.stringify({ codex_reason: optOutCodex ? switches.codexReason : null, claude_reason: optOutClaude ? switches.claudeReason : null }));
+    }
+    const local = await discoverLocalTranscripts({ homeDir, olderThanMs, skipAll: optOutAll, skipClaude: optOutClaude, skipCodex: optOutCodex });
     const cursors = {
         codex: await readRawEvidenceCursor(paths),
         claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),

package/dist/commands/sources-discovery.js

@@ -153,7 +153,7 @@ function shapeOrder(shape) {
 }
 async function findTranscriptFiles(options, roots, result, recordFailure) {
     const found = [];
-    const stack = options.skipAll ? [] : [...roots.codex, ...(options.skipClaude ? [] : [roots.claudeProjects])];
+    const stack = options.skipAll ? [] : [...(options.skipCodex ? [] : roots.codex), ...(options.skipClaude ? [] : [roots.claudeProjects])];
     const seen = new Set();
     while (stack.length > 0) {
         const dir = stack.pop();

package/dist/commands/sync-stub-heal.js

@@ -1,3 +1,20 @@
+/**
+ * BLI-11112: the scheduled sync heals this machine's own redaction-crash stubs.
+ *
+ * `cockpit backfill` learned to re-offer a stubbed session (BLI‑11102), but
+ * nobody runs backfill on an intern machine, so their stubs stayed stubs. Once
+ * per tick, after the tick's own uploads and still under the collection lock,
+ * the sync asks the stubs door for this caller's stubs and re-offers up to
+ * `SYNC_STUB_SESSIONS_PER_TICK` sessions of them through the SAME backfill
+ * code: `runBackfill` with `stubPass` set. Same cursor mark, same redaction,
+ * same `stub_replaced` claim, and a claim only for a stub the door named.
+ *
+ * Cheap in the steady state: one door request, and nothing more unless a named
+ * stub belongs to a session this machine's cursor tracks. A stub from another
+ * of the operator's machines is not this machine's to heal; it is counted as
+ * remaining and skipped without a scan. Never throws and never fails the tick.
+ */
+import { resolveSourceSwitches } from "../source-opt-out.js";
 import { runBackfill } from "./backfill.js";
 import { loadStubReofferPlan } from "./backfill-stub-reoffer.js";
 import { backfillWaitingCheck } from "./sync-yield.js";
@@ -45,7 +62,18 @@ async function runStubPass(command, io, deps, now, summary) {
     const sessionFile = await readLocalCollectorSessionFile(paths).catch(() => null);
     if (!sessionFile)
         return "no_device_session";
-    const sources = config?.collect_claude_jsonl === false ? ["codex"] : ["codex", "claude_code"];
+    const switches = resolveSourceSwitches(config);
+    const sources = [
+        ...(switches.codex ? ["codex"] : []),
+        ...(switches.claude ? ["claude_code"] : []),
+    ];
+    if (sources.length === 0) {
+        console.error("[collector stubs] no source enabled", JSON.stringify({ reason: switches.codexReason }));
+        return "sources_opted_out";
+    }
+    if (!switches.codex || !switches.claude) {
+        console.error("[collector stubs] source withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason ?? switches.claudeReason, sources: sources.length }));
+    }
     const dashboardUrl = (sessionFile.dashboard_url ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL)
         .trim()
         .replace(/\/+$/, "");

package/dist/local-state-config.js

@@ -5,6 +5,7 @@ import { readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { normalizeCollectionRoots } from "./root-normalization.js";
+import { configForDisk, resolveSourceSwitches } from "./source-opt-out.js";
 import { ensureRuntimeDirectories, getCollectorRuntimePaths, } from "./local-state-paths.js";
 import { isMissingFileError, readJsonFile, writeJsonFile, } from "./local-state-files.js";
 const localCollectorPackage = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
@@ -65,13 +66,19 @@ export async function installLocalCollector(options = {}) {
         // The operator's Claude opt-out survives every rewrite (doctor, onboard,
         // update, roots add); only the operator turns it back on (BLI-22341).
         collect_claude_jsonl: existingConfig?.collect_claude_jsonl,
+        // Same for Codex, and for `raw_evidence_upload: "disabled"` below (ticket 22557).
+        collect_codex_jsonl: existingConfig?.collect_codex_jsonl,
         session_file_path: paths.session_file,
         state_dir_path: paths.state_dir,
     });
     await recordRootApprovals(paths, defaultRepoPaths, options.replaceRepoRoots);
-    await writeJsonFile(paths.config_file, config);
-    if (config.collect_claude_jsonl === false) {
-        console.error("[install] claude session upload stays off", JSON.stringify({ reason: "collect_claude_jsonl_false" }));
+    await writeJsonFile(paths.config_file, configForDisk(config));
+    const switches = resolveSourceSwitches(config);
+    if (!switches.claude) {
+        console.error("[install] claude session upload stays off", JSON.stringify({ reason: switches.claudeReason }));
+    }
+    if (!switches.codex) {
+        console.error("[install] codex session upload stays off", JSON.stringify({ reason: switches.codexReason }));
     }
     return {
         config,
@@ -81,13 +88,14 @@ export async function installLocalCollector(options = {}) {
     };
 }
 /**
- * The one on-disk migration this file performs: both retired raw-evidence
- * choices become the durable one, so a machine installed before durable
- * evidence existed stops holding the old answer forever.
+ * The one on-disk migration this file performs: the retired short-retention
+ * raw-evidence choice becomes the durable one, so a machine installed before
+ * durable evidence existed stops holding the old answer forever. `"disabled"`
+ * is an operator's explicit opt-out of both sources and is kept until they
+ * turn it back on (ticket 22557); it is never healed to on.
  */
 function migrateRawEvidenceUploadChoice(existingConfig) {
-    return existingConfig?.raw_evidence_upload === "disabled" ||
-        existingConfig?.raw_evidence_upload === "remote_short_retention_opt_in"
+    return existingConfig?.raw_evidence_upload === "remote_short_retention_opt_in"
         ? "remote_durable_opt_in"
         : (existingConfig?.raw_evidence_upload ?? "remote_durable_opt_in");
 }
@@ -138,7 +146,7 @@ export async function ensureLocalCollectorConfig(options = {}) {
         session_file_path: paths.session_file,
         state_dir_path: paths.state_dir,
     });
-    await writeJsonFile(paths.config_file, config);
+    await writeJsonFile(paths.config_file, configForDisk(config));
     return { config, paths, created: true };
 }
 /**

package/dist/local-state-pairing.js

@@ -6,6 +6,7 @@ import { describeError, isMissingFileFailure } from "./health-detail.js";
 import { serverFailureDetail } from "./upload-http.js";
 import { ensureRuntimeDirectories, getCollectorRuntimePaths, } from "./local-state-paths.js";
 import { isMissingFileError, writeJsonFile } from "./local-state-files.js";
+import { configForDisk } from "./source-opt-out.js";
 import { defaultDeviceName, LOCAL_COLLECTOR_VERSION, normalizeDashboardUrl, normalizeDeviceName, normalizeOptionalEmail, readLocalCollectorConfig, } from "./local-state-config.js";
 import { readLocalCollectorSessionFile, toSessionReference, } from "./local-state-session.js";
 /**
@@ -80,12 +81,12 @@ async function recordDeviceIdentityWhenChanged(paths, config, device) {
         config.device_name !== device.deviceName ||
         (device.claimedOwnerEmail &&
             config.claimed_owner_email !== device.claimedOwnerEmail)) {
-        await writeJsonFile(paths.config_file, {
+        await writeJsonFile(paths.config_file, configForDisk({
             ...config,
             device_id: device.deviceId,
             device_name: device.deviceName,
             claimed_owner_email: device.claimedOwnerEmail,
-        });
+        }));
     }
 }
 /**

package/dist/source-opt-out.js

@@ -0,0 +1,33 @@
+export const CODEX_OPT_OUT_REASON = "collect_codex_jsonl_false";
+export const CLAUDE_OPT_OUT_REASON = "collect_claude_jsonl_false";
+export const ALL_SOURCES_OPT_OUT_REASON = "raw_evidence_upload_disabled";
+/** A missing or unreadable config is "no opt-out": collection stays on. */
+export function resolveSourceSwitches(config) {
+    const all = config?.raw_evidence_upload === "disabled";
+    const codexReason = config?.collect_codex_jsonl === false
+        ? CODEX_OPT_OUT_REASON
+        : all ? ALL_SOURCES_OPT_OUT_REASON : null;
+    const claudeReason = config?.collect_claude_jsonl === false
+        ? CLAUDE_OPT_OUT_REASON
+        : all ? ALL_SOURCES_OPT_OUT_REASON : null;
+    return {
+        codex: codexReason === null,
+        claude: claudeReason === null,
+        codexReason,
+        claudeReason,
+    };
+}
+/** The reason label for one source, or null when that source is on. */
+export function sourceOptOutReason(config, source) {
+    const switches = resolveSourceSwitches(config);
+    return source === "codex" ? switches.codexReason : switches.claudeReason;
+}
+/**
+ * The key `collect_codex_jsonl` reaches disk only when it is `false`. An older
+ * CLI's strict schema rejects an unknown key, so a machine that never opted out
+ * keeps a config file every CLI version can read. Every config writer uses this.
+ */
+export function configForDisk(config) {
+    const { collect_codex_jsonl: codexSwitch, ...rest } = config;
+    return codexSwitch === false ? { ...rest, collect_codex_jsonl: false } : rest;
+}

package/dist/upload-envelope-build.js

@@ -3,6 +3,7 @@
  * Read the workspace context, describe transcript images, collect sources,
  * then sanitize and assemble the event. Blockers retain their retry commands.
  */
+import { resolveSourceSwitches } from "./source-opt-out.js";
 import { priorSnapshotsFromCursor, } from "./adapters/raw-evidence-snapshot-supersede.js";
 import { TelemetryIngestEnvelopeSchema, } from "@bli-cockpit/telemetry-core";
 import path from "node:path";
@@ -88,7 +89,7 @@ export async function buildLocalAmbientEnvelope(options = {}) {
         deviceToken: sessionFile.device_token,
         fetchImpl: options.fetch,
     });
-    const sourceCollection = await collectEnvelopeSources(options, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now);
+    const sourceCollection = await collectEnvelopeSources(options, collector.config, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now);
     return assembleLocalEnvelope(options, collector, uploadContext, repoLabel, sourceCollection, now);
 }
 function assembleLocalEnvelope(options, collector, uploadContext, repoLabel, sourceCollection, now) {
@@ -141,7 +142,13 @@ function assembleLocalEnvelope(options, collector, uploadContext, repoLabel, sou
         raw_evidence_facts: sourceCollection.facts.raw_evidence,
     };
 }
-async function collectEnvelopeSources(options, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now) {
+async function collectEnvelopeSources(options, config, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now) {
+    // The last gate before any transcript byte is read for upload: a source the
+    // operator opted out of is never collected, whoever the caller is (ticket 22557).
+    const switches = resolveSourceSwitches(config);
+    if (!switches.codex || !switches.claude) {
+        console.error("[upload-envelope] source withheld by operator opt-out", JSON.stringify({ codex_reason: switches.codexReason, claude_reason: switches.claudeReason }));
+    }
     const sourceCollection = await runLocalSourceCollectors({
         repoRoot,
         branch: uploadContext.branch,
@@ -153,8 +160,8 @@ async function collectEnvelopeSources(options, paths, repoRoot, uploadContext, s
         rawEvidenceStateDir: paths.state_dir,
         rawEvidenceSessionsDirs: defaultCodexSessionDirs(paths.home_dir),
         claudeProjectsDir: path.join(paths.home_dir, ".claude", "projects"),
-        rawEvidenceIncludeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
-        rawEvidenceIncludeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,
+        rawEvidenceIncludeCodexJsonl: switches.codex ? options.rawEvidenceIncludeCodexJsonl : false,
+        rawEvidenceIncludeClaudeJsonl: switches.claude ? options.rawEvidenceIncludeClaudeJsonl : false,
         rawEvidenceCodexSessionFiles: options.codexSessionFiles,
         rawEvidenceCodexAttributionScan: options.codexAttributionScan,
         rawEvidenceClaudeSessionFiles: options.claudeSessionFiles,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.247",
+  "version": "0.2.249",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.72",
-    "@bli-cockpit/mcp": "0.1.151",
-    "@bli-cockpit/telemetry-core": "0.1.79"
+    "@bli-cockpit/memory-mcp": "0.1.73",
+    "@bli-cockpit/mcp": "0.1.153",
+    "@bli-cockpit/telemetry-core": "0.1.80"
   },
   "repository": {
     "type": "git",