@bli-cockpit/cli 0.2.256 → 0.2.258

package/dist/commands/agent-session-root-scope.js

@@ -16,4 +16,23 @@ import { OUTSIDE_APPROVED_ROOT_REASONS } from "./session-sync-health.js";
  */
 export function rootScopeForReason(reason) {
     return OUTSIDE_APPROVED_ROOT_REASONS.has(reason) ? "outside" : "inside";
+}
+/**
+ * The terminal attribution states: attribution finished and named no repo. They
+ * are labels, never a reason to withhold (session-first collection).
+ */
+const TERMINAL_ATTRIBUTION_STATES = new Set(["ambiguous", "unattributed", "skipped"]);
+/**
+ * Reasons a session carries no workspace of its own that are NOT an outside-root
+ * fact, so `rootScopeForReason` keeps calling them "inside". Today: a transcript
+ * with no cwd, workspace or origin signal at all (`no_repo_signals`).
+ */
+export const NO_WORKSPACE_REASONS = new Set(["no_repo_signals"]);
+/**
+ * Does this session still lack a workspace the upload can stand in? Every
+ * terminal state without a worktree rides the collector's synthetic workspace,
+ * whatever its reason; attribution stays exactly as scored.
+ */
+export function needsTransportWorkspace(result) {
+    return !result.worktree && TERMINAL_ATTRIBUTION_STATES.has(result.state);
 }

package/dist/commands/backfill-outside-roots.js

@@ -24,7 +24,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { repoFingerprintFromLocalRoot, stableWorktreeFingerprint, } from "../repo-identity.js";
-import { rootScopeForReason } from "./agent-session-root-scope.js";
+import { NO_WORKSPACE_REASONS, needsTransportWorkspace, rootScopeForReason } from "./agent-session-root-scope.js";
 /**
  * The label the sync path writes for a report with no real worktree
  * (`session-sync-record.ts`). Reused verbatim: one label, not a second one.
@@ -64,18 +64,22 @@ export function isOutsideRootCandidate(candidate) {
 export function labelOutsideRootCandidates(candidates, workspace) {
     let codex = 0;
     let claude = 0;
+    let noRepoSignals = 0;
     const labelled = candidates.map((candidate) => {
-        if (candidate.worktree || !isOutsideRootCandidate(candidate))
+        if (!needsTransportWorkspace(candidate))
             return candidate;
         if (candidate.source === "codex")
             codex += 1;
         else
             claude += 1;
+        if (NO_WORKSPACE_REASONS.has(candidate.reason))
+            noRepoSignals += 1;
         return { ...candidate, worktree: workspace };
     });
     console.error("[backfill] outside-root sessions labelled for upload", JSON.stringify({
-        root_scope: "outside",
+        reason: "unattributed_sessions_labelled_for_upload",
         count: codex + claude,
+        no_repo_signals_count: noRepoSignals,
         codex_count: codex,
         claude_count: claude,
         candidate_count: candidates.length,

package/dist/commands/local-args-tower-admin.js

@@ -375,6 +375,18 @@ function parseTeamDeviceArgs(rest, flags, common) {
         }
         return { kind: "team", action: "device-scope", deviceRef, deviceScope, ...common };
     }
+    if (deviceVerb === "mark-service" || deviceVerb === "unmark-service") {
+        const reasonLabel = optionalNonEmpty(flags.get("--reason"));
+        if (!deviceRef || extra.length > 0)
+            throw new Error(`team device ${deviceVerb} takes one <id|name>${deviceVerb === "mark-service" ? " and --reason <label>" : ""}.`);
+        if (deviceVerb === "mark-service") {
+            if (!reasonLabel || !/^[a-z0-9][a-z0-9_-]{1,39}$/.test(reasonLabel)) {
+                throw new Error("team device mark-service needs --reason <label> (2-40 chars: a-z, 0-9, _ or -), e.g. --reason boat-agent.");
+            }
+            return { kind: "team", action: "device-mark-service", deviceRef, reasonLabel, ...common };
+        }
+        return { kind: "team", action: "device-unmark-service", deviceRef, ...common };
+    }
     if (extra.length > 0)
         throw new Error("team device does not accept that many arguments.");
     if (!deviceVerb || deviceVerb === "list") {
@@ -406,7 +418,7 @@ function parseTeamDeviceArgs(rest, flags, common) {
             ...common,
         };
     }
-    throw new Error("team device takes one verb: list, doctor <id|name>, scope <id|name> notetaker_bot|none, or revoke <id|name>.");
+    throw new Error("team device takes one verb: list, doctor <id|name>, scope <id|name> notetaker_bot|none, mark-service <id|name> --reason <label>, unmark-service <id|name>, or revoke <id|name>.");
 }
 /** `cockpit model [show|set <key>]` — the alias surface for the personal chat model. */
 export function parseModelArgs(args) {

package/dist/commands/local-help-commands.js

@@ -211,6 +211,11 @@ const COMMAND_HELP = new Map([
             "  cockpit team device scope <id|name> notetaker_bot|none [--json]",
             "      Super admin only. Gives the meeting bot's device the scope Tower's claim door requires,",
             "      or takes it away. Without it the bot is refused every meeting (bot_scope_required).",
+            "  cockpit team device mark-service <id|name> --reason <label> [--json]",
+            "  cockpit team device unmark-service <id|name> [--json]",
+            "      Super admin only. Marks a device as automation (cloud agents, alert senders) so the fleet board",
+            "      lists it under service identities, judged only on when it last called Tower, instead of a red laptop.",
+            "      --reason is a short label such as boat-agent. Only this door can set it; a device cannot.",
             "  cockpit team device revoke <id|name> --reason <label> [--note \"<text>\"] [--yes]",
             "      Admin only. Names the device, asks first unless --yes, then revokes it —",
             "      this cannot be undone. --reason must be one of: stale_test_pairing,",

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.256");
+    writeLine(io?.stdout ?? process.stdout, "0.2.258");
     return 0;
   }
 

package/dist/commands/session-sync-outside-roots.js

@@ -47,7 +47,7 @@ import { isRedactionStubObjectKey } from "../cursors/raw-evidence-stub-entry.js"
 import { describeError } from "../health-detail.js";
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { isMissingFileError, writeJsonFileAtomic, writeJsonFile } from "../local-state-files.js";
-import { rootScopeForReason } from "./agent-session-root-scope.js";
+import { NO_WORKSPACE_REASONS, needsTransportWorkspace, rootScopeForReason } from "./agent-session-root-scope.js";
 import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
 /** Most outside-root sessions that upload bytes in one tick. 4 ticks an hour, so up to 3,840 a day. */
 export const OUTSIDE_ROOT_SESSIONS_PER_TICK = 40;
@@ -112,7 +112,7 @@ export function widenForCatchUp(sinceMinutes, catchUpPending, normalMinutes) {
  * than the horizon (that is backfill's).
  */
 export function outsideRootEntryOwesUpload(entry, now = new Date()) {
-    if (rootScopeForReason(entry.reason) !== "outside")
+    if (rootScopeForReason(entry.reason) !== "outside" && !NO_WORKSPACE_REASONS.has(entry.reason))
         return false;
     if (entry.uploaded_object_key && !isRedactionStubObjectKey(entry.uploaded_object_key))
         return false;
@@ -120,9 +120,13 @@ export function outsideRootEntryOwesUpload(entry, now = new Date()) {
         return false;
     return now.getTime() - entry.file_mtime_ms <= OUTSIDE_ROOT_HORIZON_MINUTES * 60_000;
 }
-/** Is this scan result a session outside every approved root with no worktree of its own? */
+/**
+ * Is this scan result a session with no worktree of its own that attribution
+ * left unattributed (outside every approved root, no repo signals, or any other
+ * terminal state)? All of them ride the synthetic workspace: a label is never a gate.
+ */
 function isUnclaimedOutsideRootResult(result) {
-    return !result.worktree && rootScopeForReason(result.reason) === "outside";
+    return needsTransportWorkspace(result);
 }
 /** Already durable remotely with the bytes the scan just read: it needs no upload. */
 function isDurableAndUnchanged(result, entry) {
@@ -224,7 +228,8 @@ export async function admitOutsideRootSessions(options) {
         },
         outsideRoots: { workspace, holds, counts },
     };
-    console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "outside_root_sessions_admitted", ...counts, ...budget }));
+    const noRepoSignals = admitted.filter((sighting) => NO_WORKSPACE_REASONS.has(sighting.result.reason)).length;
+    console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "outside_root_sessions_admitted", no_repo_signals_riding: noRepoSignals, ...counts, ...budget }));
     return labelled;
 }
 /** Session ids and queue turns only; no source paths or transcript content. */

package/dist/commands/team.js

@@ -41,6 +41,8 @@ export async function runTeam(command, io) {
         return deviceDoctor(command, tower, io);
     if (command.action === "device-scope")
         return deviceScope(command, tower, io);
+    if (command.action === "device-mark-service" || command.action === "device-unmark-service")
+        return deviceMarkService(command, tower, io);
     return deviceRevoke(command, tower, io);
 }
 async function showMembers(command, tower, io) {
@@ -246,6 +248,37 @@ async function deviceScope(command, tower, io) {
         : command.deviceScope === "none" ? `Took the service scope away from ${name}.` : `${name} now holds the notetaker_bot scope. The bot's next claim will go through.`);
     return 0;
 }
+/**
+ * `cockpit team device mark-service <id|name> --reason <label>` and `unmark-service <id|name>` (ticket 23031): the ONE
+ * door that tells the fleet board a device is automation, not a laptop. Super admin on the server.
+ */
+async function deviceMarkService(command, tower, io) {
+    const mark = command.action === "device-mark-service";
+    const listed = await callTower(tower, { path: "/api/team/devices", label: "team device mark-service lookup" });
+    if (!listed.ok)
+        return writeCommandFailure(io, command.json, listed);
+    const device = findDevice(devicesOf(asRecord(listed.body)), command.deviceRef ?? "");
+    if (!device)
+        return writeCommandFailure(io, command.json, { reason: "device_not_found", detail: "No unique device matches. Run cockpit team device list to see ids and names." });
+    const result = await callTower(tower, {
+        path: `/api/ambient/devices/${encodeURIComponent(device.device_id)}/service-mark`,
+        method: "POST", label: "team device mark-service", body: mark ? { mark: true, reason: command.reasonLabel } : { mark: false },
+    });
+    writeLine(io.stderr, `[team cli] device mark-service ${JSON.stringify({ device_id: device.device_id, mark, reason: mark ? command.reasonLabel : null, outcome: result.ok ? "answered" : result.reason })}`);
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    const name = String(device.device_name ?? device.device_id);
+    writeLine(io.stdout, body.changed === false
+        ? `${name} was already ${mark ? "marked as automation" : "not marked"}. Nothing changed.`
+        : mark ? `${name} is now marked as automation (${command.reasonLabel}). The fleet board lists it under service identities.`
+            : `Took the automation mark off ${name}. The fleet board grades it as a laptop again.`);
+    return 0;
+}
 /** Exact directory labels locate a roster id; attribution remains the server resolver's job. */
 async function githubLogin(command, tower, io) {
     let personId = command.personRef ?? "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.256",
+  "version": "0.2.258",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.76",
-    "@bli-cockpit/mcp": "0.1.157",
+    "@bli-cockpit/mcp": "0.1.158",
     "@bli-cockpit/telemetry-core": "0.1.83"
   },
   "repository": {