@bli-cockpit/cli 0.2.255 → 0.2.257

package/dist/commands/session-sync-outside-roots.js

@@ -47,7 +47,7 @@ import { isRedactionStubObjectKey } from "../cursors/raw-evidence-stub-entry.js"
 import { describeError } from "../health-detail.js";
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { isMissingFileError, writeJsonFileAtomic, writeJsonFile } from "../local-state-files.js";
-import { rootScopeForReason } from "./agent-session-root-scope.js";
+import { NO_WORKSPACE_REASONS, needsTransportWorkspace, rootScopeForReason } from "./agent-session-root-scope.js";
 import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
 /** Most outside-root sessions that upload bytes in one tick. 4 ticks an hour, so up to 3,840 a day. */
 export const OUTSIDE_ROOT_SESSIONS_PER_TICK = 40;
@@ -112,7 +112,7 @@ export function widenForCatchUp(sinceMinutes, catchUpPending, normalMinutes) {
  * than the horizon (that is backfill's).
  */
 export function outsideRootEntryOwesUpload(entry, now = new Date()) {
-    if (rootScopeForReason(entry.reason) !== "outside")
+    if (rootScopeForReason(entry.reason) !== "outside" && !NO_WORKSPACE_REASONS.has(entry.reason))
         return false;
     if (entry.uploaded_object_key && !isRedactionStubObjectKey(entry.uploaded_object_key))
         return false;
@@ -120,9 +120,13 @@ export function outsideRootEntryOwesUpload(entry, now = new Date()) {
         return false;
     return now.getTime() - entry.file_mtime_ms <= OUTSIDE_ROOT_HORIZON_MINUTES * 60_000;
 }
-/** Is this scan result a session outside every approved root with no worktree of its own? */
+/**
+ * Is this scan result a session with no worktree of its own that attribution
+ * left unattributed (outside every approved root, no repo signals, or any other
+ * terminal state)? All of them ride the synthetic workspace: a label is never a gate.
+ */
 function isUnclaimedOutsideRootResult(result) {
-    return !result.worktree && rootScopeForReason(result.reason) === "outside";
+    return needsTransportWorkspace(result);
 }
 /** Already durable remotely with the bytes the scan just read: it needs no upload. */
 function isDurableAndUnchanged(result, entry) {
@@ -224,7 +228,8 @@ export async function admitOutsideRootSessions(options) {
         },
         outsideRoots: { workspace, holds, counts },
     };
-    console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "outside_root_sessions_admitted", ...counts, ...budget }));
+    const noRepoSignals = admitted.filter((sighting) => NO_WORKSPACE_REASONS.has(sighting.result.reason)).length;
+    console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "outside_root_sessions_admitted", no_repo_signals_riding: noRepoSignals, ...counts, ...budget }));
     return labelled;
 }
 /** Session ids and queue turns only; no source paths or transcript content. */

package/dist/commands/toml-duplicate-keys.js

@@ -0,0 +1,192 @@
+/**
+ * Finds the first key a TOML file defines twice (BLI-22766).
+ *
+ * Why this exists: `codex` refuses to start when `~/.codex/config.toml` defines
+ * one key twice — for example `[mcp_servers.bli-memory]` holding an inline
+ * `env = { … }` AND a separate `[mcp_servers.bli-memory.env]` table. It prints
+ * `config.toml:180:25: duplicate key` and does nothing else, so every Codex
+ * worker on that machine dies silently. `cockpit doctor` needs to say so, by
+ * file and line.
+ *
+ * This is NOT a TOML parser, for the same reason `memory-install-toml.ts` is
+ * not one: the public CLI ships no TOML dependency. It models only what makes a
+ * key "defined": table headers, array-of-table headers, `key = value` lines
+ * (dotted keys included) and inline tables. It skips over multi-line strings
+ * and multi-line arrays so their contents are never mistaken for keys. The
+ * tests check its answer against a real TOML parser on the same fixtures.
+ *
+ * What it does NOT catch: syntax errors that are not duplicate keys (a missing
+ * quote, a bad date). Those still break Codex; this check reports only the
+ * class of breakage our own writer could cause.
+ */
+export function findTomlDuplicateKey(text) {
+    const values = new Set();
+    const tables = new Set();
+    const dottedTables = new Set();
+    const arrayTables = new Map();
+    let current = [];
+    let pending = null;
+    const lines = text.split(/\r?\n/u);
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index] ?? "";
+        if (pending) {
+            pending = continuePending(line, pending);
+            continue;
+        }
+        const trimmed = stripComment(line).trim();
+        if (!trimmed)
+            continue;
+        if (trimmed.startsWith("[[")) {
+            const raw = trimmed.slice(2, trimmed.lastIndexOf("]]"));
+            const resolved = resolveArrayPrefixes(splitKeyPath(raw), arrayTables, false);
+            const id = encode(resolved);
+            const count = (arrayTables.get(id) ?? 0) + 1;
+            arrayTables.set(id, count);
+            current = [...resolved, `#${count}`];
+            continue;
+        }
+        if (trimmed.startsWith("[")) {
+            const resolved = resolveArrayPrefixes(splitKeyPath(trimmed.slice(1, trimmed.lastIndexOf("]"))), arrayTables, true);
+            const id = encode(resolved);
+            if (tables.has(id) || dottedTables.has(id) || hasValuePrefix(values, resolved)) {
+                return duplicate(index, resolved);
+            }
+            tables.add(id);
+            current = resolved;
+            continue;
+        }
+        const equals = indexOutsideQuotes(trimmed, "=");
+        if (equals <= 0)
+            continue;
+        const full = [...current, ...splitKeyPath(trimmed.slice(0, equals))];
+        const id = encode(full);
+        if (hasValuePrefix(values, full) || tables.has(id) || dottedTables.has(id)) {
+            return duplicate(index, full);
+        }
+        if (hasTableUnder(tables, full))
+            return duplicate(index, full);
+        values.add(id);
+        for (let length = current.length + 1; length < full.length; length += 1) {
+            dottedTables.add(encode(full.slice(0, length)));
+        }
+        pending = openPending(trimmed.slice(equals + 1).trim());
+    }
+    return null;
+}
+function duplicate(index, path) {
+    return { line: index + 1, key: path.filter((part) => !part.startsWith("#")).join(".") };
+}
+function encode(path) {
+    return JSON.stringify(path);
+}
+function hasValuePrefix(values, path) {
+    for (let length = 1; length <= path.length; length += 1) {
+        if (values.has(encode(path.slice(0, length))))
+            return true;
+    }
+    return false;
+}
+function hasTableUnder(tables, path) {
+    const prefix = encode(path).slice(0, -1);
+    for (const table of tables) {
+        if (table.startsWith(`${prefix},`))
+            return true;
+    }
+    return false;
+}
+/** `[a.b]` after `[[a]]` means "b inside the LAST a" — give it that element's path. */
+function resolveArrayPrefixes(path, arrayTables, includeLast) {
+    const resolved = [];
+    path.forEach((part, index) => {
+        resolved.push(part);
+        if (!includeLast && index === path.length - 1)
+            return;
+        const count = arrayTables.get(encode(resolved));
+        if (count !== undefined)
+            resolved.push(`#${count}`);
+    });
+    return resolved;
+}
+/** Decides whether a value continues onto later lines. */
+function openPending(value) {
+    for (const closer of ['"""', "'''"]) {
+        if (value.startsWith(closer)) {
+            return value.indexOf(closer, closer.length) >= 0 ? null : { kind: "string", closer };
+        }
+    }
+    if (value.startsWith("[") || value.startsWith("{")) {
+        const depth = bracketDepth(value, 0);
+        return depth > 0 ? { kind: "brackets", depth } : null;
+    }
+    return null;
+}
+function continuePending(line, pending) {
+    if (pending.kind === "string")
+        return line.includes(pending.closer) ? null : pending;
+    const depth = bracketDepth(line, pending.depth);
+    return depth > 0 ? { kind: "brackets", depth } : null;
+}
+function bracketDepth(raw, start) {
+    let depth = start;
+    let quote = null;
+    for (const character of raw) {
+        if (quote) {
+            if (character === quote)
+                quote = null;
+            continue;
+        }
+        if (character === '"' || character === "'")
+            quote = character;
+        else if (character === "#")
+            break;
+        else if (character === "[" || character === "{")
+            depth += 1;
+        else if (character === "]" || character === "}")
+            depth -= 1;
+    }
+    return depth;
+}
+function indexOutsideQuotes(raw, target) {
+    let quote = null;
+    for (let index = 0; index < raw.length; index += 1) {
+        const character = raw[index];
+        if (quote) {
+            if (character === quote)
+                quote = null;
+            continue;
+        }
+        if (character === '"' || character === "'")
+            quote = character;
+        else if (character === target)
+            return index;
+    }
+    return -1;
+}
+function stripComment(raw) {
+    const index = indexOutsideQuotes(raw, "#");
+    return index < 0 ? raw : raw.slice(0, index);
+}
+function splitKeyPath(raw) {
+    const parts = [];
+    let current = "";
+    let quote = null;
+    for (const character of raw) {
+        if (quote) {
+            if (character === quote)
+                quote = null;
+            else
+                current += character;
+            continue;
+        }
+        if (character === '"' || character === "'")
+            quote = character;
+        else if (character === ".") {
+            parts.push(current.trim());
+            current = "";
+        }
+        else
+            current += character;
+    }
+    parts.push(current.trim());
+    return parts;
+}

package/dist/commands/tower-mcp-codex.js

@@ -12,46 +12,25 @@
  */
 import path from "node:path";
 import { TOWER_MCP_SERVER_ID } from "./tower-mcp-contract.js";
-import { findTomlTableSpan, readTomlTable, renderTomlTable, upsertTomlTable, } from "./memory-install-toml.js";
+import { MEMORY_MCP_SERVER_ID, } from "./memory-install-contract.js";
+import { findTomlTableSpan } from "./memory-install-toml.js";
+import { applyCodexServerTable, codexConfigUnparseable, codexServerTableMatches, } from "./codex-mcp-table.js";
 const TOWER_TOML_PATH = ["mcp_servers", TOWER_MCP_SERVER_ID];
+/** BLI Memory's writer runs first on the same command and repairs its own table. */
+const SIBLING_TOML_PATH = ["mcp_servers", MEMORY_MCP_SERVER_ID];
 export function codexConfigFile(homeDir) {
     return path.join(homeDir, ".codex", "config.toml");
 }
 export async function installCodexTowerIntegration(options) {
-    const file = codexConfigFile(options.homeDir);
-    const raw = (await options.io.readText(file)) ?? "";
-    if (tableMatches(raw, options.config)) {
-        return { target: "tower_codex_mcp", status: "already", reason: "already_current", path: file };
-    }
-    const next = upsertTomlTable(raw, TOWER_TOML_PATH, renderTowerTable(options.config), "tower-mcp");
-    if (options.dryRun) {
-        return { target: "tower_codex_mcp", status: "would_install", reason: "dry_run", path: file };
-    }
-    try {
-        await options.io.writeText(file, next);
-    }
-    catch (error) {
-        return {
-            target: "tower_codex_mcp",
-            status: "failed",
-            reason: "write_failed",
-            path: file,
-            detail: error instanceof Error ? error.message : String(error),
-        };
-    }
-    // BLI-2541: parse the table back out of the stored bytes, same discipline
-    // as every other target this installer writes.
-    const stored = await options.io.readText(file);
-    if (stored === null || !tableMatches(stored, options.config)) {
-        return {
-            target: "tower_codex_mcp",
-            status: "failed",
-            reason: "read_back_mismatch",
-            path: file,
-            detail: "the table on disk does not parse back to the entry that was written",
-        };
-    }
-    return { target: "tower_codex_mcp", status: "installed", reason: "wrote_entry", path: file };
+    return applyCodexServerTable({
+        file: codexConfigFile(options.homeDir),
+        target: "tower_codex_mcp",
+        tablePath: TOWER_TOML_PATH,
+        siblingPath: SIBLING_TOML_PATH,
+        config: options.config,
+        dryRun: options.dryRun,
+        io: options.io,
+    });
 }
 export async function inspectCodexTowerIntegration(options) {
     const file = codexConfigFile(options.homeDir);
@@ -59,42 +38,14 @@ export async function inspectCodexTowerIntegration(options) {
     if (raw === null) {
         return { target: "tower_codex_mcp", status: "missing", reason: "file_absent", path: file };
     }
-    if (tableMatches(raw, options.config)) {
+    // BLI-22766: a file Codex cannot load is named first, whatever our table says.
+    const broken = codexConfigUnparseable(raw, file, "tower_codex_mcp");
+    if (broken)
+        return broken;
+    if (codexServerTableMatches(raw, TOWER_TOML_PATH, options.config)) {
         return { target: "tower_codex_mcp", status: "installed", reason: "already_current", path: file };
     }
     return findTomlTableSpan(raw, TOWER_TOML_PATH)
         ? { target: "tower_codex_mcp", status: "mismatch", reason: "entry_differs", path: file }
         : { target: "tower_codex_mcp", status: "missing", reason: "entry_absent", path: file };
-}
-function renderTowerTable(config) {
-    const entries = [
-        ["command", config.mcp_server.command],
-        ["args", config.mcp_server.args],
-    ];
-    if (Object.keys(config.mcp_server.env).length > 0) {
-        entries.push(["env", config.mcp_server.env]);
-    }
-    return renderTomlTable(TOWER_TOML_PATH, entries);
-}
-function tableMatches(raw, config) {
-    const table = readTomlTable(raw, TOWER_TOML_PATH);
-    if (!table)
-        return false;
-    if (table["command"] !== config.mcp_server.command)
-        return false;
-    const args = table["args"];
-    if (!Array.isArray(args))
-        return config.mcp_server.args.length === 0;
-    if (args.length !== config.mcp_server.args.length)
-        return false;
-    if (!args.every((entry, index) => entry === config.mcp_server.args[index]))
-        return false;
-    const env = table["env"];
-    for (const [key, value] of Object.entries(config.mcp_server.env)) {
-        if (!env || Array.isArray(env) || typeof env === "string")
-            return false;
-        if (env[key] !== value)
-            return false;
-    }
-    return true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.255",
+  "version": "0.2.257",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.75",
-    "@bli-cockpit/mcp": "0.1.156",
-    "@bli-cockpit/telemetry-core": "0.1.82"
+    "@bli-cockpit/memory-mcp": "0.1.76",
+    "@bli-cockpit/mcp": "0.1.157",
+    "@bli-cockpit/telemetry-core": "0.1.83"
   },
   "repository": {
     "type": "git",