@bli-cockpit/cli 0.2.261 → 0.2.263

package/dist/adapters/transcript-read-memo.js

@@ -66,7 +66,7 @@ export async function openTranscriptReadMemo(stateDir, name) {
                 const before = entries.size;
                 const kept = trimEntries(entries, now, PREPARE_MEMO_MAX_ENTRIES);
                 try {
-                    await writeJsonFileAtomic(transcriptReadMemoPath(stateDir, name), { schema_version: MEMO_FORMAT, entries: Object.fromEntries(kept) });
+                    await writeJsonFileAtomic(transcriptReadMemoPath(stateDir, name), { schema_version: MEMO_FORMAT, entries: Object.fromEntries(kept) }, { compact: true });
                     dirty = false;
                     written = true;
                 }

package/dist/command-guard.js

@@ -0,0 +1,202 @@
+import os from "node:os";
+import { Worker } from "node:worker_threads";
+import { enqueueInstallEventEntrySyncForExit, installEventOutboxDirectory } from "./spool/install-event-outbox.js";
+import { LOCAL_COLLECTOR_VERSION } from "./local-state-config.js";
+import { releaseHeldSyncLocksOnExit } from "./sync-lock.js";
+/**
+ * Two ceilings a long-lived collector command stops itself at (BLI-23313).
+ *
+ * Why: a 15-minute `cockpit sync` tick was caught at 55-69 GB of NATIVE memory
+ * (166 GB on a 16 GB Mac), growing ~1 GB/s, while `ps` RSS read ~1 GB because
+ * the pages were already swapped and compressed. The growth is off the JS heap,
+ * so `--max-old-space-size` cannot cap it. Other ticks simply held the
+ * collection lock for 16 minutes to 5.4 hours. A command that cannot finish
+ * must end itself, say why, and give the lock back.
+ *
+ * - Memory ceiling: a 2 s `unref`ed timer reads `rss`, `external`,
+ *   `arrayBuffers` and the sticky peak `maxRSS` (which survives pages being
+ *   swapped out). Default 3 GB for sync/doctor (a normal tick peaks ~400 MB).
+ *   `COCKPIT_MEMORY_CEILING_MB` overrides it.
+ * - Wall-clock deadline: sync only, 30 min by default. 12 min killed a healthy
+ *   catch-up tick in its prune step after it had uploaded 42 envelopes; the
+ *   memory ceiling is what stops a runaway, this only ends multi-hour hangs.
+ *   The collection lock keeps ticks from overlapping meanwhile.
+ *   `COCKPIT_TICK_DEADLINE_MS` overrides it.
+ * - A worker-thread backstop checks every second at 1.25x the ceiling (or 30 s
+ *   past the deadline). The observed runaway sat 100% inside one native call on
+ *   the main thread, where no main-thread timer can fire; the worker writes the
+ *   receipt and hard-kills the process. The dead pid lets the next tick take
+ *   the lock over at once.
+ *
+ * On a trip: log `[cockpit <command>] <reason>` with sizes only, queue a
+ * `sync_complete` failure receipt in the install-event outbox (the next tick
+ * delivers it), release the collection lock, `process.exit` non-zero. Both
+ * exits are portable: no POSIX signal is needed on the main-thread path.
+ */
+export const EXIT_MEMORY_CEILING = 71;
+export const EXIT_TICK_DEADLINE = 72;
+export const MEMORY_CEILING_REASON = "memory_ceiling_exceeded";
+export const TICK_DEADLINE_REASON = "tick_deadline_exceeded";
+export const DEFAULT_MEMORY_CEILING_MB = { sync: 3072, doctor: 3072, backfill: 6144 };
+export const DEFAULT_TICK_DEADLINE_MS = 30 * 60_000;
+const DEFAULT_INTERVAL_MS = 2_000;
+const BACKSTOP_FACTOR = 1.25;
+const BACKSTOP_DEADLINE_GRACE_MS = 30_000;
+const MB = 1024 * 1024;
+function positive(raw) {
+    if (!raw)
+        return null;
+    const value = Number(raw);
+    return Number.isFinite(value) && value > 0 ? value : null;
+}
+export function resolveCeilingMb(command, env) {
+    return positive(env["COCKPIT_MEMORY_CEILING_MB"]) ?? DEFAULT_MEMORY_CEILING_MB[command];
+}
+export function resolveDeadlineMs(command, env) {
+    if (command !== "sync")
+        return null;
+    return positive(env["COCKPIT_TICK_DEADLINE_MS"]) ?? DEFAULT_TICK_DEADLINE_MS;
+}
+export function readMemory() {
+    const usage = process.memoryUsage();
+    let maxRssKb = 0;
+    try {
+        maxRssKb = process.resourceUsage().maxRSS; // kilobytes on every platform
+    }
+    catch {
+        maxRssKb = 0;
+    }
+    return {
+        rss_mb: Math.round(usage.rss / MB),
+        max_rss_mb: Math.round(maxRssKb / 1024),
+        external_mb: Math.round(usage.external / MB),
+        array_buffers_mb: Math.round(usage.arrayBuffers / MB),
+    };
+}
+export function exceedsCeiling(reading, ceilingMb) {
+    return Math.max(reading.rss_mb, reading.max_rss_mb, reading.external_mb, reading.array_buffers_mb) > ceilingMb;
+}
+/** Starts the guard; the returned function stops it (call it in a `finally`). */
+export function startCommandGuard(options) {
+    const env = options.env ?? process.env;
+    const exit = options.exit ?? ((code) => process.exit(code));
+    const ceilingMb = resolveCeilingMb(options.command, env);
+    const deadlineMs = options.deadlineMs === undefined ? resolveDeadlineMs(options.command, env) : options.deadlineMs;
+    const intervalMs = positive(env["COCKPIT_GUARD_INTERVAL_MS"]) ?? DEFAULT_INTERVAL_MS;
+    let tripped = false;
+    const trip = (reason, code, label, extra) => {
+        if (tripped)
+            return;
+        tripped = true;
+        const fields = { reason, command: options.command, phase: options.phase?.() ?? null, ...extra };
+        console.error(`[cockpit ${options.command}] ${label}`, JSON.stringify(fields));
+        try {
+            const outboxId = enqueueInstallEventEntrySyncForExit(options.paths, {
+                dashboardUrl: options.dashboardUrl,
+                cliVersion: LOCAL_COLLECTOR_VERSION,
+                command: options.command,
+                osPlatform: os.platform(),
+                events: [{ step: `${options.command}_complete`, status: "fail", error_code: reason, error_detail: JSON.stringify(fields) }],
+            });
+            console.error(`[cockpit ${options.command}] failure receipt queued`, JSON.stringify({ reason, outbox_id: outboxId }));
+        }
+        catch (error) {
+            console.error(`[cockpit ${options.command}] failure receipt not queued`, JSON.stringify({ reason: "receipt_write_failed", trip_reason: reason, error_name: error instanceof Error ? error.name : typeof error }));
+        }
+        try {
+            const released = releaseHeldSyncLocksOnExit();
+            console.error(`[cockpit ${options.command}] collection lock released before exit`, JSON.stringify({ reason, released }));
+        }
+        catch (error) {
+            console.error(`[cockpit ${options.command}] lock release threw`, JSON.stringify({ reason: "lock_release_threw", trip_reason: reason, error_name: error instanceof Error ? error.name : typeof error }));
+        }
+        exit(code);
+    };
+    const memoryTimer = setInterval(() => {
+        const reading = readMemory();
+        if (exceedsCeiling(reading, ceilingMb)) {
+            trip(MEMORY_CEILING_REASON, EXIT_MEMORY_CEILING, "memory ceiling exceeded", { ...reading, ceiling_mb: ceilingMb });
+        }
+    }, intervalMs);
+    memoryTimer.unref();
+    const startedAt = Date.now();
+    const deadlineTimer = deadlineMs
+        ? setTimeout(() => {
+            trip(TICK_DEADLINE_REASON, EXIT_TICK_DEADLINE, "tick deadline exceeded", { deadline_ms: deadlineMs, elapsed_ms: Date.now() - startedAt, ...readMemory() });
+        }, deadlineMs)
+        : null;
+    deadlineTimer?.unref();
+    const worker = options.backstop === false ? null : startBackstop(options, ceilingMb, deadlineMs, startedAt);
+    console.error(`[cockpit ${options.command}] guard armed`, JSON.stringify({ ceiling_mb: ceilingMb, deadline_ms: deadlineMs, interval_ms: intervalMs, backstop: worker !== null }));
+    return () => {
+        clearInterval(memoryTimer);
+        if (deadlineTimer)
+            clearTimeout(deadlineTimer);
+        void worker?.terminate();
+    };
+}
+const BACKSTOP_SOURCE = `
+const { workerData: d } = require("node:worker_threads");
+const fs = require("node:fs");
+const path = require("node:path");
+const crypto = require("node:crypto");
+setInterval(() => {
+  let reason = null;
+  const rssMb = process.memoryUsage.rss() / 1048576;
+  let maxMb = 0;
+  try { maxMb = process.resourceUsage().maxRSS / 1024; } catch (error) { maxMb = 0; /* resourceUsage unavailable: rss alone decides */ }
+  if (Math.max(rssMb, maxMb) > d.hardCeilingMb) reason = "memory_ceiling_exceeded";
+  else if (d.hardDeadlineAt && Date.now() > d.hardDeadlineAt) reason = "tick_deadline_exceeded";
+  if (!reason) return;
+  const fields = { reason, command: d.command, backstop: "worker", rss_mb: Math.round(rssMb), max_rss_mb: Math.round(maxMb), ceiling_mb: d.ceilingMb, phase: "main_thread_unresponsive" };
+  // Direct fd write: worker console output goes through the (stuck) main thread.
+  const say = (line) => { try { fs.writeSync(2, line + "\\n"); } catch (error) { /* stderr is closed; the receipt file below still records the trip */ } };
+  say("[cockpit " + d.command + "] " + (reason === "memory_ceiling_exceeded" ? "memory ceiling exceeded" : "tick deadline exceeded") + " " + JSON.stringify(fields));
+  try {
+    const now = new Date().toISOString();
+    const id = "install-event-" + crypto.randomUUID();
+    fs.mkdirSync(d.outboxDir, { recursive: true, mode: 0o700 });
+    const entry = { schema_version: "cockpit-install-event-outbox.v1", outbox_id: id, created_at: now, last_attempt_at: null, retry_count: 0, last_failure_reason: null, dashboard_url: d.dashboardUrl, cli_version: d.cliVersion, command: d.command, os_platform: d.osPlatform, events: [{ step: d.command + "_complete", status: "fail", error_code: reason, error_detail: JSON.stringify(fields), at: now }] };
+    fs.writeFileSync(path.join(d.outboxDir, id.replace(/[^a-z0-9_-]/gi, "") + ".json"), JSON.stringify(entry, null, 2) + "\\n", { mode: 0o600 });
+  } catch (error) {
+    say("[cockpit " + d.command + "] failure receipt not queued " + JSON.stringify({ reason: "receipt_write_failed", trip_reason: reason, error_name: error && error.name }));
+  }
+  process.kill(process.pid, "SIGKILL");
+}, 1000);
+`;
+function startBackstop(options, ceilingMb, deadlineMs, startedAt) {
+    try {
+        const worker = new Worker(BACKSTOP_SOURCE, {
+            eval: true,
+            workerData: {
+                command: options.command,
+                ceilingMb,
+                hardCeilingMb: Math.ceil(ceilingMb * BACKSTOP_FACTOR),
+                hardDeadlineAt: deadlineMs ? startedAt + deadlineMs + BACKSTOP_DEADLINE_GRACE_MS : null,
+                outboxDir: installEventOutboxDirectory(options.paths),
+                dashboardUrl: options.dashboardUrl,
+                cliVersion: LOCAL_COLLECTOR_VERSION,
+                osPlatform: os.platform(),
+            },
+        });
+        worker.unref();
+        worker.on("error", (error) => {
+            console.error(`[cockpit ${options.command}] guard backstop crashed`, JSON.stringify({ reason: "backstop_worker_error", error_name: error.name }));
+        });
+        return worker;
+    }
+    catch (error) {
+        console.error(`[cockpit ${options.command}] guard backstop not started`, JSON.stringify({ reason: "backstop_worker_unavailable", error_name: error instanceof Error ? error.name : typeof error }));
+        return null;
+    }
+}
+/** Runs `body` with the guard armed, always disarming it afterwards. */
+export async function withCommandGuard(options, body) {
+    const stop = startCommandGuard(options);
+    try {
+        return await body();
+    }
+    finally {
+        stop();
+    }
+}

package/dist/commands/backfill.js

@@ -53,6 +53,9 @@ import { uploadBackfillBatches } from "./backfill-upload.js";
 // which sibling implements one is this module's business, not theirs.
 export { DEFAULT_BACKFILL_SINCE_DAYS, backfillRetryCommand } from "./backfill-command-line.js";
 export { buildBackfillSessionReport } from "./backfill-session-report.js";
+import { withCommandGuard } from "../command-guard.js";
+import { installHttp1GlobalFetch } from "../http1-fetch.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "../local-state.js";
 export async function runBackfillCommand(command, io) {
     // A bare `cockpit backfill` used to refuse and print three lines telling the
     // operator to pick a window. That put a mandatory flag on the command that
@@ -78,7 +81,9 @@ export async function runBackfillCommand(command, io) {
         }
         return 1;
     }
-    const result = await runBackfill(effective, io);
+    // BLI-23313: same HTTP/1.1 transport and memory ceiling as the sync tick.
+    installHttp1GlobalFetch();
+    const result = await withCommandGuard({ command: "backfill", paths: getCollectorRuntimePaths(effective.homeDir), dashboardUrl: DEFAULT_DASHBOARD_URL }, () => runBackfill(effective, io));
     if (effective.json) {
         writeLine(io.stdout, JSON.stringify(result, null, 2));
         return result.status === "complete" ? 0 : 1;

package/dist/commands/cli-io.js

@@ -197,7 +197,9 @@ export function defaultIo() {
         stdout: process.stdout,
         stderr: process.stderr,
         env: process.env,
-        fetch: globalThis.fetch.bind(globalThis),
+        // Late-bound (BLI-23313): `installHttp1GlobalFetch()` swaps globalThis.fetch for the
+        // HTTP/1.1 transport when a long-lived command starts; a bound copy would miss it.
+        fetch: ((input, init) => globalThis.fetch(input, init)),
         exec: defaultExec(),
         interactiveExec: defaultInteractiveExec(),
     };

package/dist/commands/doctor-disk-words.js

@@ -92,7 +92,11 @@ export function footprintBuckets(footprint) {
  */
 export function stagingPausedWords(gate, holder) {
     if (gate.reason === "low_disk") {
-        return `Tower paused copying new evidence: the disk has ${gib(gate.free_bytes ?? 0)} GB free. Nothing is lost; it resumes when space returns.`;
+        // BLI-23181: the size of the disk, the floor it is under, and Tower's own
+        // share, so "is it us?" is answered on the row that raises it.
+        const of = typeof gate.total_bytes === "number" ? ` of ${gib(gate.total_bytes)} GB` : "";
+        const floor = typeof gate.floor_bytes === "number" ? `, under the ${gib(gate.floor_bytes)} GB Tower leaves free` : "";
+        return `Tower paused copying new evidence: the disk has ${gib(gate.free_bytes ?? 0)} GB free${of}${floor}; Tower itself keeps ${mib(gate.collector_bytes)} MB here. Nothing is lost; it resumes when space returns.`;
     }
     if (gate.reason === "state_over_ceiling") {
         return `Tower paused copying new evidence: everything it keeps here is ${mib(gate.collector_bytes)} MB, over its ${mib(gate.ceiling_bytes)} MB ceiling${holder ? `, mostly ${holder.label} (${mib(holder.bytes)} MB)` : ""}. Nothing is lost; it resumes when that shrinks.`;

package/dist/commands/doctor.js

@@ -1,6 +1,8 @@
 import { checkSlackConnected } from "./doctor-slack.js";
 import { checkUsageTelemetry, fixUsageTelemetry } from "./doctor-usage-telemetry.js";
-import { LOCAL_COLLECTOR_VERSION } from "../local-state.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION } from "../local-state.js";
+import { withCommandGuard } from "../command-guard.js";
+import { installHttp1GlobalFetch } from "../http1-fetch.js";
 import { isSemverBelow } from "../scheduled-self-update.js";
 import { describeError } from "../health-detail.js";
 import { withStage } from "../crash-guard.js";
@@ -17,7 +19,12 @@ import { buildSetupReceipt, refreshSetupReceipt } from "./setup-receipt.js";
 import { checkCliLatest, fixCliLatest, latestCliVersionFromNpm, reexecDoctor, } from "./doctor-update.js";
 export async function runDoctor(command, io, hooks, overrides = {}) {
     const deps = { ...defaultDoctorDeps(hooks), ...overrides };
-    return runDoctorWithDeps(command, io, deps);
+    // BLI-23313: memory ceiling only (doctor has its own run deadline); a test
+    // that injects deps is not guarded.
+    if (Object.keys(overrides).length > 0)
+        return runDoctorWithDeps(command, io, deps);
+    installHttp1GlobalFetch(io.env);
+    return withCommandGuard({ command: "doctor", paths: getCollectorRuntimePaths(command.homeDir), dashboardUrl: command.dashboardUrl ?? DEFAULT_DASHBOARD_URL, env: io.env }, () => runDoctorWithDeps(command, io, deps));
 }
 export async function runDoctorWithDeps(command, io, deps) {
     const runStarted = Date.now();

package/dist/commands/heartbeat.js

@@ -27,6 +27,7 @@ import path from "node:path";
 import { COLLECTOR_HEARTBEAT_SCHEMA_VERSION, MemoryInstallReceiptSchema, setupReceiptGaps, } from "@bli-cockpit/telemetry-core";
 import { readCachedSetupReceipt } from "./setup-receipt.js";
 import { readStagingInventory } from "../disk-usage.js";
+import { readStagingGate } from "../staging-gate.js";
 import { describeError } from "../health-detail.js";
 import { shouldSuppressFleetReceipts, } from "../dev-build.js";
 import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, } from "../local-state.js";
@@ -123,6 +124,7 @@ export function buildCollectorHeartbeat(options) {
         ...(options.facts.stagingUncommittedReason
             ? { staging_uncommitted_reason: options.facts.stagingUncommittedReason }
             : {}),
+        ...(options.facts.disk ? { disk: options.facts.disk } : {}),
         ...(options.memoryInstall ? { memory_install: options.memoryInstall } : {}),
         ...(options.setupReceipt ? { setup_receipt: options.setupReceipt } : {}),
     };
@@ -155,6 +157,44 @@ export async function readHeartbeatStagingFacts(options) {
         return { bytes: null, reason: null };
     }
 }
+/**
+ * BLI-23181. "Is it us filling their disk?" in six numbers the server keeps.
+ *
+ * One live read of the same gate the tick already runs (`staging-gate.ts`):
+ * the volume holding the state dir, its floor, Tower's own bytes on it and
+ * whether copying is paused. The board used to learn only the label
+ * `staging_paused_low_disk`, which cannot tell a 99%-full laptop from a floor
+ * that is wrong for that disk. Best-effort: a failure returns null and says
+ * so, and the heartbeat omits the field rather than reporting a zero.
+ */
+export async function readHeartbeatDiskFacts(options) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    try {
+        const gate = await readStagingGate(paths.state_dir, options.env, options.deps);
+        const reading = {
+            free_bytes: wholeBytes(gate.free_bytes),
+            total_bytes: wholeBytes(gate.total_bytes),
+            floor_bytes: wholeBytes(gate.floor_bytes),
+            collector_bytes: wholeBytes(gate.collector_bytes) ?? 0,
+            staging_bytes: wholeBytes(gate.staging_bytes) ?? 0,
+            gate: gate.reason ?? "open",
+        };
+        console.error("[heartbeat] carrying the disk reading", JSON.stringify({
+            reason: reading.free_bytes === null ? "disk_free_unreadable" : `disk_gate_${reading.gate}`,
+            ...reading,
+        }));
+        return reading;
+    }
+    catch (error) {
+        console.error("[heartbeat] the disk could not be measured; this tick reports no disk reading", JSON.stringify({ reason: "disk_reading_failed", ...describeError(error) }));
+        return null;
+    }
+}
+function wholeBytes(value) {
+    if (value === null || !Number.isFinite(value) || value < 0)
+        return null;
+    return Math.min(Math.floor(value), Number.MAX_SAFE_INTEGER);
+}
 /**
  * The cached memory receipt for this tick, or null with a named reason
  * (BLI-3729).

package/dist/commands/local-args-collector-status.js

@@ -12,6 +12,7 @@ import { DEFAULT_AUTOSTART_INTERVAL_SECONDS } from "../autostart.js";
 import { assertNoPositionals, normalizeUrl, optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, workRootFlagValue, } from "./local-arg-values.js";
 import { DEFAULT_DASHBOARD_URL } from "../local-state.js";
 import { MEMORY_STORE_ACTIONS, parseMemoryStoreArgs, } from "./local-args-tower-memory.js";
+import { parseSessionsForgetArgs } from "./sessions-forget.js";
 export function parseStatusArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -41,6 +42,9 @@ export function parseStatusArgs(args) {
     };
 }
 export function parseSessionsArgs(args) {
+    // BLI-23245: `cockpit sessions forget <id>` talks to Tower; plain `cockpit sessions` stays the local scan.
+    if (args[0] === "forget")
+        return parseSessionsForgetArgs(args.slice(1));
     const values = parseNamedArgs(args, {
         allowedFlags: [
             "--home",

package/dist/commands/local-args.js

@@ -19,6 +19,7 @@ import { parseGlossaryArgs } from "./glossary.js";
 import { parseSpendArgs } from "./spend.js";
 import { parsePushArgs } from "./push.js";
 import { parseRootsArgs } from "./roots.js";
+import { parseSlackPrivacyArgs } from "./slack-privacy-args.js";
 import { parseMilestoneArgs } from "./local-args-tower-milestone.js";
 import { SURFACE_ALIASES } from "./local-help.js";
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
@@ -67,7 +68,8 @@ const COMMAND_PARSERS = new Map([
     ["ci", (_command, rest) => parseCiArgs(rest)],
     ["delivery", (_command, rest) => parseDeliveryArgs(rest)],
     ["ops", (_command, rest) => parseOpsArgs(rest)],
-    ["slack", (_command, rest) => parseSlackArgs(rest)],
+    // BLI-23244: `slack privacy` has its own flags and its own file.
+    ["slack", (_command, rest) => (rest.includes("privacy") ? parseSlackPrivacyArgs(rest.filter((arg) => arg !== "privacy")) : parseSlackArgs(rest))],
     ["settings", (_command, rest) => parseSettingsArgs(rest)],
     ["team", (_command, rest) => parseTeamArgs(rest)],
     ["workbook", (_command, rest) => parseWorkbookArgs(rest)],

package/dist/commands/local-help-commands-tower.js

@@ -304,7 +304,13 @@ export const TOWER_COMMAND_HELP = [
     [
         "slack",
         [
-            "Usage: cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [filters] [--format compact|full]] [--json]",
+            "Usage: cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [filters] [--format compact|full] | privacy] [--json]",
+            "",
+            "  cockpit slack privacy   (founders only)",
+            "      Lists which Slack conversations Tower keeps out and lets in, and the founders' Slack ids.",
+            "      A DM or group DM that includes a founder, and any channel a founder excludes, never enters",
+            "      Tower unless a founder lets it in. Ids only (C…, D…, G…), never names. Changing a list needs",
+            "      a signed-in browser session (ticket 23265), never this machine's token. Anyone else: owner_only.",
             "",
             "  cockpit slack coverage",
             "      What Cockpit's Slack bot can see: how many channels it is in, what each",

package/dist/commands/local-help-commands.js

@@ -323,6 +323,14 @@ const COMMAND_HELP = new Map([
             "missing?\" locally — counts and labels only, never paths or content.",
             "--since-days uses the same paired_at cap as `cockpit backfill`; --all scans the full local history.",
             "`--repo <path>` remains supported as a backward-compatible alias.",
+            "",
+            "Usage: cockpit sessions forget <session-id> [--apply] [--json]",
+            "",
+            "Founders only: removes one of YOUR OWN sessions from Tower everywhere it was copied",
+            "(transcript files, digests, summaries, search rows, usage counts, memories learned from it)",
+            "and stops Tower ever taking it again. Without --apply it is a dry run: counts per place,",
+            "nothing changed. --apply deletes, then counts again to prove zero. It cannot be undone.",
+            "The MCP tool sessions_forget is the dry run only; only this command, typed by you, removes.",
         ],
     ],
     [

package/dist/commands/local.js

@@ -1,6 +1,7 @@
 import { runOpsCommand } from "./local-run-ops.js";
 import { runGlossary } from "./glossary.js";
 import { runSpend } from "./spend.js";
+import { runSessionsForget } from "./sessions-forget.js";
 import { runPush } from "./push.js";
 import { defaultIo, writeLine } from "./cli-io.js";
 import { isLocalHelpRequest, localCommandHelp } from "./local-help.js";
@@ -198,6 +199,7 @@ async function runTowerCommand(command, io) {
         case "correct": return await runCorrect(command, io);
         case "notes": return await runNotes(command, io);
         case "glossary": return await runGlossary(command, io);
+        case "sessions-forget": return await runSessionsForget(command, io);
         case "spend": return await runSpend(command, io);
         case "push": return await runPush(command, io);
         case "docs": return await runDocs(command, io);

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.261");
+    writeLine(io?.stdout ?? process.stdout, "0.2.263");
     return 0;
   }
 

package/dist/commands/sessions-forget.js

@@ -0,0 +1,62 @@
+import { writeLine } from "./cli-io.js";
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+export const SESSIONS_FORGET_USAGE = "Usage: cockpit sessions forget <session-id> [--apply] [--json]";
+/** Session ids are the Claude/Codex transcript ids: letters, digits and dashes. Anything else is a typo, not an id. */
+const SESSION_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+export function parseSessionsForgetArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: ["--apply", "--json", "--home", "--dashboard-url"],
+        valueFlags: ["--home", "--dashboard-url"],
+    });
+    const [sessionId, ...rest] = values.positionals;
+    if (!sessionId || rest.length > 0)
+        throw new Error(SESSIONS_FORGET_USAGE);
+    if (!SESSION_ID.test(sessionId))
+        throw new Error(`"${sessionId}" is not a session id. ${SESSIONS_FORGET_USAGE}`);
+    return {
+        kind: "sessions-forget",
+        sessionId,
+        apply: values.booleans.has("--apply"),
+        json: values.booleans.has("--json"),
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+    };
+}
+function isForgetAnswer(body) {
+    const value = body;
+    return Boolean(value && value.ok === true && Array.isArray(value.places) && typeof value.message === "string");
+}
+/** The words a founder reads. Only places with something in them, then the one-line verdict from Tower. */
+function printAnswer(io, answer) {
+    const found = answer.places.filter((place) => place.before > 0 || (place.after ?? 0) > 0);
+    writeLine(io.stdout, answer.mode === "apply" ? `Forgot session ${answer.session_id}.` : `Dry run for session ${answer.session_id}. Nothing was changed.`);
+    if (found.length === 0)
+        writeLine(io.stdout, "  Tower holds nothing for this session.");
+    for (const place of found) {
+        const after = answer.mode === "apply" ? `  ->  ${place.after ?? "?"} left` : "";
+        writeLine(io.stdout, `  ${place.label}: ${place.before}${after}`);
+    }
+    writeLine(io.stdout, answer.message);
+    if (answer.mode === "dry_run" && answer.total_before > 0) {
+        writeLine(io.stdout, `To remove it for good: cockpit sessions forget ${answer.session_id} --apply`);
+    }
+}
+export async function runSessionsForget(command, io) {
+    const door = await openAgentDoor("sessions forget", command, io);
+    const answer = await askAgentDoor(door, {
+        path: "/api/sessions/forget",
+        method: "POST",
+        label: "sessions forget",
+        // An apply removes stored files one batch at a time after the database transaction; give it room.
+        timeoutMs: 120_000,
+        body: { session_id: command.sessionId, apply: command.apply },
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, "[sessions forget cli]", answer.reason, answer.detail);
+    if (command.json || !isForgetAnswer(answer.body))
+        return emitAgentDoor(door, answer.body);
+    printAnswer(io, answer.body);
+    // An apply that could not prove zero is not a success, and the exit code says so.
+    return answer.body.mode === "apply" && (answer.body.total_after !== 0 || answer.body.files_left !== 0) ? 1 : 0;
+}

package/dist/commands/slack-privacy-args.js

@@ -0,0 +1,28 @@
+/**
+ * `cockpit slack privacy` arguments (BLI-23244): a founder LISTS their Slack privacy lists (which conversations Tower
+ * keeps out or lets in, and the founders' Slack identities). Ids only, never names.
+ *
+ * Read-only on purpose. Changing a list needs a signed-in browser session, so that an agent holding a founder's device
+ * token can never opt a founder's conversation in; the server refuses device-token writes. The browser card is
+ * ticket 23265. Split from `local-args-tower-admin.ts`, which is at this repo's readability band.
+ */
+import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+const VALUE_FLAGS = ["--home", "--dashboard-url"];
+const WRITE_FLAGS = ["--exclude", "--optin", "--remove", "--identity", "--no-account"];
+const ALLOWED_FLAGS = [...VALUE_FLAGS, "--json"];
+export const SLACK_PRIVACY_WRITE_REFUSAL = "slack privacy only lists. Changing a founder privacy list needs a signed-in browser session, so an agent holding this machine's token can never opt a founder's conversation in (the Settings card is ticket 23265).";
+export function parseSlackPrivacyArgs(args) {
+    if (args.some((arg) => WRITE_FLAGS.includes(arg)))
+        throw new Error(SLACK_PRIVACY_WRITE_REFUSAL);
+    const values = parseNamedArgs(args, { allowedFlags: ALLOWED_FLAGS, valueFlags: VALUE_FLAGS });
+    if (values.positionals.length > 0)
+        throw new Error("slack privacy takes no arguments; it lists the founder privacy lists.");
+    return {
+        kind: "slack",
+        action: "privacy",
+        privacy: { op: "list" },
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        json: values.booleans.has("--json"),
+    };
+}

package/dist/commands/slack-privacy.js

@@ -0,0 +1,31 @@
+import { writeLine } from "./cli-io.js";
+import { asRecord, callTower, openTower, writeCommandFailure } from "./tower-command.js";
+export async function runSlackPrivacy(command, io) {
+    const tower = await openTower("slack", command, io);
+    const result = await callTower(tower, { path: "/api/slack/founder-privacy", label: "slack-privacy" });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    writeLine(io.stderr, `[slack cli] privacy answered ${JSON.stringify({ op: "list", reason: "ok" })}`);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(body));
+        return 0;
+    }
+    for (const line of describe(body))
+        writeLine(io.stdout, line);
+    return 0;
+}
+/** Plain lines for a person. Exported for its test. */
+export function describe(body) {
+    const rows = (key) => (Array.isArray(body[key]) ? body[key] : []);
+    const mark = (row) => `  ${String(row["conversationId"])} (${String(row["workspace"])}) since ${String(row["addedAt"]).slice(0, 10)}${row["addedByYou"] ? " — you" : " — the other founder"}`;
+    const identities = rows("identities");
+    return [
+        `Kept out (${rows("exclusions").length}):`, ...rows("exclusions").map(mark),
+        `Let in (${rows("optins").length}):`, ...rows("optins").map(mark),
+        `Founder Slack ids stated (${identities.length}):`,
+        ...identities.map((row) => `  ${String(row["workspace"])}: ${row["slackUserId"] ? String(row["slackUserId"]) : "no account"}${row["yours"] ? " — you" : ""}`),
+        "Any DM or group DM that includes a founder is kept out unless it is on the let-in list.",
+        "To change a list, use Tower in the browser (ticket 23265); this command only lists.",
+    ];
+}

package/dist/commands/slack.js

@@ -22,7 +22,10 @@
  */
 import { colorEnabled, dim, writeLine } from "./cli-io.js";
 import { asRecord, callTower, openTower, writeCommandFailure } from "./tower-command.js";
+import { runSlackPrivacy } from "./slack-privacy.js";
 export async function runSlack(command, io) {
+    if (command.action === "privacy")
+        return runSlackPrivacy(command, io);
     const tower = await openTower("slack", command, io);
     if (command.action === "connect" || command.action === "disconnect") {
         const result = await callTower(tower, { path: `/api/slack/connections${command.action === "disconnect" ? `?workspace=${command.workspace}` : ""}`,

package/dist/commands/sync-heartbeat.js

@@ -1,4 +1,4 @@
-import { sendCollectorHeartbeatBestEffort, readHeartbeatStagingFacts, } from "./heartbeat.js";
+import { sendCollectorHeartbeatBestEffort, readHeartbeatDiskFacts, readHeartbeatStagingFacts, } from "./heartbeat.js";
 import { resolveSyncCollectionRoots } from "./sync-roots.js";
 import { describeError } from "../health-detail.js";
 /**
@@ -17,6 +17,9 @@ export async function sendSyncHeartbeat(command, io, dashboardUrl, facts) {
     const staging = await readHeartbeatStagingFacts({
         homeDir: command.homeDir,
     }).catch(() => ({ bytes: null, reason: null }));
+    // BLI-23181: free, total and floor bytes beside Tower's own footprint, so the
+    // board can say whether a low-disk pause is a full disk or Tower.
+    const disk = await readHeartbeatDiskFacts({ homeDir: command.homeDir, env: io.env }).catch(() => null);
     await sendCollectorHeartbeatBestEffort({
         homeDir: command.homeDir,
         dashboardUrl,
@@ -25,6 +28,7 @@ export async function sendSyncHeartbeat(command, io, dashboardUrl, facts) {
             ...facts,
             stagingUncommittedBytes: staging.bytes,
             stagingUncommittedReason: staging.reason,
+            disk,
         },
         io,
     }).catch((error) => {

package/dist/commands/sync.js

@@ -47,6 +47,8 @@ import { runAutostartSelfHealAfterSync, runMemoryInstallAfterSync, runScheduledS
 import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
 import { settleTickImageModeBestEffort } from "../image-mode-state.js";
 import { stampSyncTick } from "../sync-tick-stamp.js";
+import { withCommandGuard } from "../command-guard.js";
+import { installHttp1GlobalFetch } from "../http1-fetch.js";
 import { startTickTimer } from "../sync-tick-timing.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
 /**
@@ -55,7 +57,14 @@ import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConf
  * steps themselves are `runSyncTick`, below.
  */
 export async function runSync(command, io) {
+    // BLI-23313: HTTP/1.1 only (Node's h2 session grew native memory without
+    // bound), then a memory ceiling and a whole-tick deadline.
+    installHttp1GlobalFetch(io.env);
     const tick = startTickTimer();
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    return withCommandGuard({ command: "sync", paths, dashboardUrl: await tickDashboardUrl(command, paths), env: io.env, phase: () => tick.current() }, () => runTimedSync(command, io, tick));
+}
+async function runTimedSync(command, io, tick) {
     try {
         const exitCode = await runSyncTick(command, io, tick);
         tick.finish(exitCode);

package/dist/cursors/raw-evidence-cursor.js

@@ -66,7 +66,7 @@ export async function writeRawEvidenceCursor(paths, state, options = {}) {
         // Invariant enforcement (D4): the Claude cursor never owns objects.
         pruned.objects = {};
     }
-    const serialized = `${JSON.stringify(pruned, null, 2)}\n`;
+    const serialized = `${JSON.stringify(pruned)}\n`; // compact (BLI-23317); readers accept either
     // Atomic write: a launchd sync and a manual sync can race the same cursor, so
     // write a sibling temp file, fsync it, and rename over the target. A crash
     // mid-write leaves either the old or the new state, never a truncated file.