@bli-cockpit/cli 0.2.262 → 0.2.263

package/dist/http1-fetch.js

@@ -0,0 +1,243 @@
+import http from "node:http";
+import https from "node:https";
+import { Readable } from "node:stream";
+import zlib from "node:zlib";
+/**
+ * A fetch that can only speak HTTP/1.1 (BLI-23313).
+ *
+ * Node 26's built-in fetch (undici 8) negotiates HTTP/2 by default. One sync
+ * tick was caught at 55-69 GB (166 GB on a 16 GB Mac) of NATIVE memory, 100% of
+ * its main-thread sample inside `Http2Session::SendPendingData` growing a
+ * `std::vector<NgHttp2StreamWrite>`, while stuck in repeated evidence-upload
+ * deadline failures. That memory is off the JS heap, so no JS limit sees it.
+ * The memory daemon's external undici 6 defaults to HTTP/1.1 and stayed flat.
+ *
+ * `node:https` never offers `h2` in ALPN, so this transport removes the trigger
+ * instead of capping its symptom. It is fetch-shaped (`Request`/`URL`/string
+ * input, `Headers`, string/bytes/Blob/stream bodies, `AbortSignal`, redirects)
+ * and returns a standard `Response` whose body streams. It adds no dependency.
+ *
+ * Differences from the built-in, on purpose: no env-proxy support (the built-in
+ * had none either unless NODE_USE_ENV_PROXY was set), no request cache, and a
+ * `Accept-Encoding` header is only sent when the caller sets one.
+ *
+ * `COCKPIT_FETCH_TRANSPORT=native` leaves `globalThis.fetch` alone, an escape
+ * hatch if this transport ever misbehaves on a machine.
+ */
+const MAX_REDIRECTS = 20;
+const NULL_BODY_STATUSES = new Set([101, 204, 205, 304]);
+const httpsAgent = new https.Agent({ keepAlive: true, maxSockets: 16 });
+const httpAgent = new http.Agent({ keepAlive: true, maxSockets: 16 });
+function abortError(signal) {
+    const reason = signal?.reason;
+    if (reason instanceof Error)
+        return reason;
+    const error = new Error("This operation was aborted");
+    error.name = "AbortError";
+    return error;
+}
+function toHeaderRecord(headers) {
+    const record = {};
+    headers.forEach((value, key) => {
+        record[key] = value;
+    });
+    return record;
+}
+async function resolveBody(body, headers) {
+    if (body === null || body === undefined)
+        return { payload: null, length: null };
+    if (typeof body === "string") {
+        const bytes = Buffer.from(body, "utf8");
+        return { payload: bytes, length: bytes.byteLength };
+    }
+    if (body instanceof URLSearchParams) {
+        if (!headers.has("content-type")) {
+            headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+        }
+        const bytes = Buffer.from(body.toString(), "utf8");
+        return { payload: bytes, length: bytes.byteLength };
+    }
+    if (body instanceof ArrayBuffer)
+        return { payload: new Uint8Array(body), length: body.byteLength };
+    if (ArrayBuffer.isView(body)) {
+        const view = new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+        return { payload: view, length: view.byteLength };
+    }
+    if (typeof Blob !== "undefined" && body instanceof Blob) {
+        if (body.type && !headers.has("content-type"))
+            headers.set("content-type", body.type);
+        return { payload: Readable.fromWeb(body.stream()), length: body.size };
+    }
+    if (typeof FormData !== "undefined" && body instanceof FormData) {
+        // Let the platform serialize the multipart boundary exactly as fetch would.
+        const wrapped = new Response(body);
+        const type = wrapped.headers.get("content-type");
+        if (type)
+            headers.set("content-type", type);
+        const bytes = Buffer.from(await wrapped.arrayBuffer());
+        return { payload: bytes, length: bytes.byteLength };
+    }
+    if (typeof body.getReader === "function") {
+        return { payload: Readable.fromWeb(body), length: null };
+    }
+    throw new TypeError("http1-fetch: unsupported request body type");
+}
+function decodeBody(res, headers) {
+    const encoding = (res.headers["content-encoding"] ?? "").toString().toLowerCase().trim();
+    let stream = res;
+    if (encoding === "gzip" || encoding === "x-gzip")
+        stream = res.pipe(zlib.createGunzip());
+    else if (encoding === "deflate")
+        stream = res.pipe(zlib.createInflate());
+    else if (encoding === "br")
+        stream = res.pipe(zlib.createBrotliDecompress());
+    else
+        return stream;
+    headers.delete("content-encoding");
+    headers.delete("content-length");
+    res.on("error", (error) => stream.destroy(error));
+    return stream;
+}
+function sendOnce(hop) {
+    return new Promise((resolve, reject) => {
+        const { url, signal } = hop;
+        if (signal?.aborted) {
+            reject(abortError(signal));
+            return;
+        }
+        const secure = url.protocol === "https:";
+        if (!secure && url.protocol !== "http:") {
+            reject(new TypeError(`http1-fetch: unsupported protocol ${url.protocol}`));
+            return;
+        }
+        const headers = toHeaderRecord(hop.headers);
+        if (hop.length !== null && hop.payload !== null && !("content-length" in headers)) {
+            headers["content-length"] = String(hop.length);
+        }
+        const request = (secure ? https : http).request({
+            protocol: url.protocol,
+            hostname: url.hostname.replace(/^\[|\]$/g, ""),
+            port: url.port || undefined,
+            path: `${url.pathname}${url.search}`,
+            method: hop.method,
+            headers,
+            agent: secure ? httpsAgent : httpAgent,
+            // Never negotiate h2: node:https only offers http/1.1 in ALPN.
+            ...(secure ? { ALPNProtocols: ["http/1.1"] } : {}),
+        }, (response) => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve(response);
+        });
+        const onAbort = () => {
+            const error = abortError(signal);
+            request.destroy(error);
+            reject(error);
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+        request.on("error", (error) => {
+            signal?.removeEventListener("abort", onAbort);
+            reject(error);
+        });
+        const { payload } = hop;
+        if (payload === null)
+            request.end();
+        else if (payload instanceof Readable) {
+            payload.on("error", (error) => request.destroy(error));
+            payload.pipe(request);
+        }
+        else
+            request.end(payload);
+    });
+}
+function buildResponse(res, url, signal) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(res.headers)) {
+        if (Array.isArray(value))
+            for (const item of value)
+                headers.append(name, item);
+        else if (value !== undefined)
+            headers.set(name, value);
+    }
+    const status = res.statusCode ?? 0;
+    const body = decodeBody(res, headers);
+    const onAbort = () => {
+        body.destroy(abortError(signal));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    body.on("close", () => signal?.removeEventListener("abort", onAbort));
+    const response = new Response(NULL_BODY_STATUSES.has(status) ? null : Readable.toWeb(body), { status, statusText: res.statusMessage ?? "", headers });
+    Object.defineProperty(response, "url", { value: url });
+    // Test and diagnostic seam: which protocol actually carried this response.
+    Object.defineProperty(response, "httpVersion", { value: res.httpVersion });
+    if (NULL_BODY_STATUSES.has(status))
+        res.resume();
+    return response;
+}
+export async function http1Fetch(input, init = {}) {
+    const source = input instanceof Request ? input : null;
+    let url = new URL(source ? source.url : String(input));
+    const headers = new Headers(source?.headers);
+    new Headers(init.headers).forEach((value, key) => headers.set(key, value));
+    let method = (init.method ?? source?.method ?? "GET").toUpperCase();
+    const signal = init.signal ?? source?.signal ?? null;
+    const redirect = init.redirect ?? source?.redirect ?? "follow";
+    const rawBody = init.body ?? (source && source.body ? Buffer.from(await source.arrayBuffer()) : null);
+    let resolved = await resolveBody(rawBody, headers);
+    if (!headers.has("user-agent"))
+        headers.set("user-agent", "cockpit-collector");
+    for (let hops = 0;; hops += 1) {
+        const response = await sendOnce({ url, method, headers, ...resolved, signal });
+        const status = response.statusCode ?? 0;
+        const location = response.headers.location;
+        const redirects = [301, 302, 303, 307, 308].includes(status) && location;
+        if (!redirects || redirect === "manual")
+            return buildResponse(response, url.href, signal);
+        response.resume();
+        if (redirect === "error")
+            throw new TypeError("http1-fetch: redirect mode is error");
+        if (hops >= MAX_REDIRECTS)
+            throw new TypeError("http1-fetch: too many redirects");
+        const next = new URL(location, url);
+        if (next.origin !== url.origin) {
+            headers.delete("authorization");
+            headers.delete("cookie");
+        }
+        const dropBody = status === 303 || ((status === 301 || status === 302) && method === "POST");
+        if (dropBody) {
+            method = method === "HEAD" ? "HEAD" : "GET";
+            resolved = { payload: null, length: null };
+            headers.delete("content-type");
+            headers.delete("content-length");
+        }
+        else if (resolved.payload instanceof Readable) {
+            throw new TypeError("http1-fetch: cannot follow a redirect with a streamed body");
+        }
+        url = next;
+    }
+}
+let installed = false;
+/**
+ * Replace `globalThis.fetch` with the HTTP/1.1 transport. Idempotent; a no-op
+ * under `COCKPIT_FETCH_TRANSPORT=native`. Logs the decision either way.
+ */
+export function installHttp1GlobalFetch(env = process.env) {
+    if (installed)
+        return true;
+    if (env["COCKPIT_FETCH_TRANSPORT"] === "native") {
+        console.error("[http1-fetch] native fetch kept", JSON.stringify({ reason: "COCKPIT_FETCH_TRANSPORT=native" }));
+        return false;
+    }
+    if (globalThis.fetch.cockpitFetchGuard) {
+        // scripts/public-cli-fetch-guard.mjs: a smoke run that must fail on any network call.
+        console.error("[http1-fetch] fetch guard present; left in place", JSON.stringify({ reason: "cockpitFetchGuard" }));
+        return false;
+    }
+    globalThis.fetch = http1Fetch;
+    installed = true;
+    console.error("[http1-fetch] http/1.1 transport installed", JSON.stringify({ reason: "BLI-23313_h2_native_memory" }));
+    return true;
+}
+/** Test seam: forget the install (the caller restores `globalThis.fetch`). */
+export function resetHttp1InstallForTest() {
+    installed = false;
+}

package/dist/local-state-files.js

@@ -52,11 +52,13 @@ export async function writeJsonFile(filePath, value) {
  * a reader (or a crash) never sees a half-written file (BLI-17273: a torn image-mode file made a slim
  * machine forget it had ever run slim). The temp file is removed when the write or the rename fails.
  */
-export async function writeJsonFileAtomic(filePath, value) {
+export async function writeJsonFileAtomic(filePath, value, options = {}) {
     await fs.mkdir(path.dirname(filePath), { recursive: true });
     const temp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 10)}.tmp`;
+    // Compact for the big memo files (BLI-23317): indentation was pure transient heap; readers take either.
+    const body = options.compact ? JSON.stringify(value) : JSON.stringify(value, null, 2);
     try {
-        await fs.writeFile(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        await fs.writeFile(temp, `${body}\n`, { mode: 0o600 });
         if (process.platform !== "win32") {
             await fs.chmod(temp, 0o600).catch(() => undefined);
         }

package/dist/raw-evidence-gc.js

@@ -3,6 +3,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { readRawEvidenceCursor } from "./cursors/raw-evidence-cursor.js";
 import { readRawEvidenceStagingState } from "./raw-evidence-staging.js";
+import { hashFileStreaming } from "./evidence-upload-staged.js";
 const RAW_EVIDENCE_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 /**
  * A staging directory belongs to one in-flight collection pass. Anything this
@@ -284,14 +285,13 @@ async function inspectRawEvidenceDirForGc(dir, uploadedHashes) {
         return { deletable: true, byteSize: 0 };
     let byteSize = 0;
     for (const file of files) {
-        const bytes = await fs.readFile(file).catch(() => null);
-        if (!bytes)
+        const hashed = await hashFileStreaming(file);
+        if (!hashed)
             return { deletable: false, byteSize: 0 };
-        const digest = crypto.createHash("sha256").update(bytes).digest("hex");
-        if (!uploadedHashes.has(digest)) {
+        if (!uploadedHashes.has(hashed.digest)) {
             return { deletable: false, byteSize: 0 };
         }
-        byteSize += bytes.byteLength;
+        byteSize += hashed.byteSize;
     }
     return { deletable: true, byteSize };
 }

package/dist/spool/install-event-outbox.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { describeError } from "../health-detail.js";
@@ -36,6 +37,35 @@ export async function enqueueInstallEventEntry(paths, options) {
     await pruneInstallEventOutbox(paths);
     return entry;
 }
+/**
+ * Synchronous enqueue for a process that is about to exit (BLI-23313): the
+ * memory and wall-clock ceilings cannot await a write. Same entry shape the
+ * async path writes, so the next tick replays it like any other receipt.
+ */
+export function enqueueInstallEventEntrySyncForExit(paths, options) {
+    const createdAt = new Date().toISOString();
+    const outboxId = `install-event-${crypto.randomUUID()}`;
+    const entry = {
+        schema_version: "cockpit-install-event-outbox.v1",
+        outbox_id: outboxId,
+        created_at: createdAt,
+        last_attempt_at: null,
+        retry_count: 0,
+        last_failure_reason: null,
+        dashboard_url: options.dashboardUrl,
+        cli_version: options.cliVersion,
+        command: options.command,
+        os_platform: options.osPlatform,
+        events: options.events.map((event) => ({ ...event, at: event.at ?? createdAt })),
+    };
+    const directory = installEventOutboxDirectory(paths);
+    fsSync.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const filePath = entryPath(paths, outboxId);
+    const tempPath = `${filePath}.tmp-${process.pid}`;
+    fsSync.writeFileSync(tempPath, `${JSON.stringify(entry, null, 2)}\n`, { mode: 0o600 });
+    fsSync.renameSync(tempPath, filePath);
+    return outboxId;
+}
 export async function readPendingInstallEventEntries(paths) {
     const directory = installEventOutboxDirectory(paths);
     const names = await fs.readdir(directory).catch(() => []);

package/dist/staging-gate.js

@@ -73,7 +73,10 @@ export function stagingGateLimitsFromEnv(env) {
  * parent: a fresh machine has no state dir yet). `null` when the platform
  * cannot say, which is logged and never closes the gate on its own.
  */
-export async function readVolumeSpace(dir, statfs = fs.statfs) {
+export async function readVolumeSpace(dir, statfs = fs.statfs, 
+// The host's own path rules; injectable so a Linux test can walk a
+// `C:\Users\...` state dir up to its drive root exactly as Windows does.
+pathApi = path) {
     let target = dir;
     for (let hops = 0; hops < 64; hops += 1) {
         try {
@@ -85,7 +88,7 @@ export async function readVolumeSpace(dir, statfs = fs.statfs) {
             };
         }
         catch (error) {
-            const parent = path.dirname(target);
+            const parent = pathApi.dirname(target);
             if (parent === target) {
                 console.error("[staging-gate] free space unreadable, low-disk check skipped", JSON.stringify({ reason: "statfs_unavailable", ...describeError(error) }));
                 return null;
@@ -136,7 +139,7 @@ export async function readStagingGate(stateDir, env, deps = {}) {
     const [stagingBytes, collectorBytes, volume] = await Promise.all([
         directoryBytes(path.join(stateDir, "raw-evidence")).catch(() => 0),
         measureCollectorBytes(stateDir).catch(() => 0),
-        readVolumeSpace(stateDir, deps.statfs),
+        readVolumeSpace(stateDir, deps.statfs, deps.pathApi),
     ]);
     const facts = {
         staging_bytes: stagingBytes,

package/dist/sync-tick-timing.js

@@ -1,12 +1,15 @@
 export function startTickTimer(now = () => Date.now()) {
     const started = now();
     const stages = {};
+    let running = null;
     const wrap = (name) => async (run) => {
         const stageStarted = now();
+        running = name;
         try {
             return await run();
         }
         finally {
+            running = null;
             stages[name] = (stages[name] ?? 0) + (now() - stageStarted);
         }
     };
@@ -28,6 +31,7 @@ export function startTickTimer(now = () => Date.now()) {
         outcomeReport: wrap("outcome_report"),
         converge: wrap("converge"),
         prune: wrap("prune"),
+        current: () => running,
         finish: (exitCode) => report(exitCode === 0 ? "ok" : "failed", exitCode, null),
         threw: (error) => report("threw", null, error instanceof Error ? error.name : "unknown"),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.262",
+  "version": "0.2.263",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.77",
-    "@bli-cockpit/mcp": "0.1.161",
-    "@bli-cockpit/telemetry-core": "0.1.84"
+    "@bli-cockpit/memory-mcp": "0.1.78",
+    "@bli-cockpit/mcp": "0.1.162",
+    "@bli-cockpit/telemetry-core": "0.1.85"
   },
   "repository": {
     "type": "git",