@bli-cockpit/cli 0.2.262 → 0.2.264

package/dist/http1-fetch.js

@@ -0,0 +1,243 @@
+import http from "node:http";
+import https from "node:https";
+import { Readable } from "node:stream";
+import zlib from "node:zlib";
+/**
+ * A fetch that can only speak HTTP/1.1 (BLI-23313).
+ *
+ * Node 26's built-in fetch (undici 8) negotiates HTTP/2 by default. One sync
+ * tick was caught at 55-69 GB (166 GB on a 16 GB Mac) of NATIVE memory, 100% of
+ * its main-thread sample inside `Http2Session::SendPendingData` growing a
+ * `std::vector<NgHttp2StreamWrite>`, while stuck in repeated evidence-upload
+ * deadline failures. That memory is off the JS heap, so no JS limit sees it.
+ * The memory daemon's external undici 6 defaults to HTTP/1.1 and stayed flat.
+ *
+ * `node:https` never offers `h2` in ALPN, so this transport removes the trigger
+ * instead of capping its symptom. It is fetch-shaped (`Request`/`URL`/string
+ * input, `Headers`, string/bytes/Blob/stream bodies, `AbortSignal`, redirects)
+ * and returns a standard `Response` whose body streams. It adds no dependency.
+ *
+ * Differences from the built-in, on purpose: no env-proxy support (the built-in
+ * had none either unless NODE_USE_ENV_PROXY was set), no request cache, and a
+ * `Accept-Encoding` header is only sent when the caller sets one.
+ *
+ * `COCKPIT_FETCH_TRANSPORT=native` leaves `globalThis.fetch` alone, an escape
+ * hatch if this transport ever misbehaves on a machine.
+ */
+const MAX_REDIRECTS = 20;
+const NULL_BODY_STATUSES = new Set([101, 204, 205, 304]);
+const httpsAgent = new https.Agent({ keepAlive: true, maxSockets: 16 });
+const httpAgent = new http.Agent({ keepAlive: true, maxSockets: 16 });
+function abortError(signal) {
+    const reason = signal?.reason;
+    if (reason instanceof Error)
+        return reason;
+    const error = new Error("This operation was aborted");
+    error.name = "AbortError";
+    return error;
+}
+function toHeaderRecord(headers) {
+    const record = {};
+    headers.forEach((value, key) => {
+        record[key] = value;
+    });
+    return record;
+}
+async function resolveBody(body, headers) {
+    if (body === null || body === undefined)
+        return { payload: null, length: null };
+    if (typeof body === "string") {
+        const bytes = Buffer.from(body, "utf8");
+        return { payload: bytes, length: bytes.byteLength };
+    }
+    if (body instanceof URLSearchParams) {
+        if (!headers.has("content-type")) {
+            headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+        }
+        const bytes = Buffer.from(body.toString(), "utf8");
+        return { payload: bytes, length: bytes.byteLength };
+    }
+    if (body instanceof ArrayBuffer)
+        return { payload: new Uint8Array(body), length: body.byteLength };
+    if (ArrayBuffer.isView(body)) {
+        const view = new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+        return { payload: view, length: view.byteLength };
+    }
+    if (typeof Blob !== "undefined" && body instanceof Blob) {
+        if (body.type && !headers.has("content-type"))
+            headers.set("content-type", body.type);
+        return { payload: Readable.fromWeb(body.stream()), length: body.size };
+    }
+    if (typeof FormData !== "undefined" && body instanceof FormData) {
+        // Let the platform serialize the multipart boundary exactly as fetch would.
+        const wrapped = new Response(body);
+        const type = wrapped.headers.get("content-type");
+        if (type)
+            headers.set("content-type", type);
+        const bytes = Buffer.from(await wrapped.arrayBuffer());
+        return { payload: bytes, length: bytes.byteLength };
+    }
+    if (typeof body.getReader === "function") {
+        return { payload: Readable.fromWeb(body), length: null };
+    }
+    throw new TypeError("http1-fetch: unsupported request body type");
+}
+function decodeBody(res, headers) {
+    const encoding = (res.headers["content-encoding"] ?? "").toString().toLowerCase().trim();
+    let stream = res;
+    if (encoding === "gzip" || encoding === "x-gzip")
+        stream = res.pipe(zlib.createGunzip());
+    else if (encoding === "deflate")
+        stream = res.pipe(zlib.createInflate());
+    else if (encoding === "br")
+        stream = res.pipe(zlib.createBrotliDecompress());
+    else
+        return stream;
+    headers.delete("content-encoding");
+    headers.delete("content-length");
+    res.on("error", (error) => stream.destroy(error));
+    return stream;
+}
+function sendOnce(hop) {
+    return new Promise((resolve, reject) => {
+        const { url, signal } = hop;
+        if (signal?.aborted) {
+            reject(abortError(signal));
+            return;
+        }
+        const secure = url.protocol === "https:";
+        if (!secure && url.protocol !== "http:") {
+            reject(new TypeError(`http1-fetch: unsupported protocol ${url.protocol}`));
+            return;
+        }
+        const headers = toHeaderRecord(hop.headers);
+        if (hop.length !== null && hop.payload !== null && !("content-length" in headers)) {
+            headers["content-length"] = String(hop.length);
+        }
+        const request = (secure ? https : http).request({
+            protocol: url.protocol,
+            hostname: url.hostname.replace(/^\[|\]$/g, ""),
+            port: url.port || undefined,
+            path: `${url.pathname}${url.search}`,
+            method: hop.method,
+            headers,
+            agent: secure ? httpsAgent : httpAgent,
+            // Never negotiate h2: node:https only offers http/1.1 in ALPN.
+            ...(secure ? { ALPNProtocols: ["http/1.1"] } : {}),
+        }, (response) => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve(response);
+        });
+        const onAbort = () => {
+            const error = abortError(signal);
+            request.destroy(error);
+            reject(error);
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+        request.on("error", (error) => {
+            signal?.removeEventListener("abort", onAbort);
+            reject(error);
+        });
+        const { payload } = hop;
+        if (payload === null)
+            request.end();
+        else if (payload instanceof Readable) {
+            payload.on("error", (error) => request.destroy(error));
+            payload.pipe(request);
+        }
+        else
+            request.end(payload);
+    });
+}
+function buildResponse(res, url, signal) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(res.headers)) {
+        if (Array.isArray(value))
+            for (const item of value)
+                headers.append(name, item);
+        else if (value !== undefined)
+            headers.set(name, value);
+    }
+    const status = res.statusCode ?? 0;
+    const body = decodeBody(res, headers);
+    const onAbort = () => {
+        body.destroy(abortError(signal));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    body.on("close", () => signal?.removeEventListener("abort", onAbort));
+    const response = new Response(NULL_BODY_STATUSES.has(status) ? null : Readable.toWeb(body), { status, statusText: res.statusMessage ?? "", headers });
+    Object.defineProperty(response, "url", { value: url });
+    // Test and diagnostic seam: which protocol actually carried this response.
+    Object.defineProperty(response, "httpVersion", { value: res.httpVersion });
+    if (NULL_BODY_STATUSES.has(status))
+        res.resume();
+    return response;
+}
+export async function http1Fetch(input, init = {}) {
+    const source = input instanceof Request ? input : null;
+    let url = new URL(source ? source.url : String(input));
+    const headers = new Headers(source?.headers);
+    new Headers(init.headers).forEach((value, key) => headers.set(key, value));
+    let method = (init.method ?? source?.method ?? "GET").toUpperCase();
+    const signal = init.signal ?? source?.signal ?? null;
+    const redirect = init.redirect ?? source?.redirect ?? "follow";
+    const rawBody = init.body ?? (source && source.body ? Buffer.from(await source.arrayBuffer()) : null);
+    let resolved = await resolveBody(rawBody, headers);
+    if (!headers.has("user-agent"))
+        headers.set("user-agent", "cockpit-collector");
+    for (let hops = 0;; hops += 1) {
+        const response = await sendOnce({ url, method, headers, ...resolved, signal });
+        const status = response.statusCode ?? 0;
+        const location = response.headers.location;
+        const redirects = [301, 302, 303, 307, 308].includes(status) && location;
+        if (!redirects || redirect === "manual")
+            return buildResponse(response, url.href, signal);
+        response.resume();
+        if (redirect === "error")
+            throw new TypeError("http1-fetch: redirect mode is error");
+        if (hops >= MAX_REDIRECTS)
+            throw new TypeError("http1-fetch: too many redirects");
+        const next = new URL(location, url);
+        if (next.origin !== url.origin) {
+            headers.delete("authorization");
+            headers.delete("cookie");
+        }
+        const dropBody = status === 303 || ((status === 301 || status === 302) && method === "POST");
+        if (dropBody) {
+            method = method === "HEAD" ? "HEAD" : "GET";
+            resolved = { payload: null, length: null };
+            headers.delete("content-type");
+            headers.delete("content-length");
+        }
+        else if (resolved.payload instanceof Readable) {
+            throw new TypeError("http1-fetch: cannot follow a redirect with a streamed body");
+        }
+        url = next;
+    }
+}
+let installed = false;
+/**
+ * Replace `globalThis.fetch` with the HTTP/1.1 transport. Idempotent; a no-op
+ * under `COCKPIT_FETCH_TRANSPORT=native`. Logs the decision either way.
+ */
+export function installHttp1GlobalFetch(env = process.env) {
+    if (installed)
+        return true;
+    if (env["COCKPIT_FETCH_TRANSPORT"] === "native") {
+        console.error("[http1-fetch] native fetch kept", JSON.stringify({ reason: "COCKPIT_FETCH_TRANSPORT=native" }));
+        return false;
+    }
+    if (globalThis.fetch.cockpitFetchGuard) {
+        // scripts/public-cli-fetch-guard.mjs: a smoke run that must fail on any network call.
+        console.error("[http1-fetch] fetch guard present; left in place", JSON.stringify({ reason: "cockpitFetchGuard" }));
+        return false;
+    }
+    globalThis.fetch = http1Fetch;
+    installed = true;
+    console.error("[http1-fetch] http/1.1 transport installed", JSON.stringify({ reason: "BLI-23313_h2_native_memory" }));
+    return true;
+}
+/** Test seam: forget the install (the caller restores `globalThis.fetch`). */
+export function resetHttp1InstallForTest() {
+    installed = false;
+}

package/dist/image-description-session.js

@@ -5,10 +5,10 @@
  * Failures never fail the transcript. Logs contain metadata, never image bytes
  * or descriptions.
  */
-import { IMAGE_DESCRIBE_MAX_BYTES, IMAGE_HANDLING_MODE, base64Of, findEmbeddedImages, replaceImagesWithMarkers, } from "@bli-cockpit/telemetry-core";
+import { IMAGE_DESCRIBE_MAX_BYTES, IMAGE_HANDLING_MODE, base64Of, findEmbeddedImages, formatImageMarker, replaceImagesWithMarkers, } from "@bli-cockpit/telemetry-core";
 import { postImageToDescribeDoor } from "./image-describe-client.js";
 import { resolveImageHandlingMode } from "./image-mode-state.js";
-import { slimOrKeep, slimTranscript } from "./slim/slim-transcript.js";
+import { slimOrKeep, slimPassOrNull, slimTranscript } from "./slim/slim-transcript.js";
 import { imageStateKey, imageRetryDelayMs, readDescribedImageKeys, readFailedImages, writeImageDescriptionState, } from "./image-description-state.js";
 /** New images sent to the door in one sync (all worktrees together); the count never refills within a tick. */
 export const IMAGE_DESCRIBE_MAX_PER_RUN = 100;
@@ -39,10 +39,16 @@ export async function openImageDescriptions(options) {
         isDescribed: (sha256) => described.has(imageStateKey(sha256)),
         hasDescribeRoom: (sha256s) => describeRoomLeft(run, sha256s),
         async prepareTranscript(input) {
-            const afterImages = await describeAndReplace(run, input);
+            const { swap, ...afterImages } = await describeAndReplace(run, input);
             if (mode !== "describe_and_drop")
                 return { ...afterImages, text: input.text, changed: false, slim: null };
-            const slim = slimOrKeep(afterImages.text, input.source, { sessionId: input.sessionId });
+            // BLI-23317: the image swap and the slim rules are ONE pass over the lines (one joined string, no
+            // intermediate copy). A pass that cannot run falls back to the two-step order, which is the same bytes.
+            const pass = slimPassOrNull(input.text, input.source, { sessionId: input.sessionId }, swap);
+            if (pass)
+                return { ...afterImages, text: pass.text, changed: pass.changed, slim: pass.stats };
+            const replaced = replaceImagesWithMarkers(input.text, swap.images, swap.replace);
+            const slim = slimOrKeep(replaced.text, input.source, { sessionId: input.sessionId });
             return { ...afterImages, text: slim.text, changed: slim.text !== input.text, slim: slim.stats };
         },
     };
@@ -110,8 +116,9 @@ function rememberFailure(run, key, outcome) {
 async function describeAndReplace(run, input) {
     const { mode, described, options, orderedKeys, failedImages } = run;
     const images = findEmbeddedImages(input.text);
+    const swap = { images, replace: (image) => described.has(imageStateKey(image.sha256)) };
     if (images.length === 0)
-        return { text: input.text, pendingImages: [], imageCount: 0, uniqueCount: 0, replacedCount: 0, charsSaved: 0, deferredOnly: false };
+        return { swap, pendingImages: [], imageCount: 0, uniqueCount: 0, replacedCount: 0, charsSaved: 0, deferredOnly: false };
     const unique = new Map();
     for (const image of images)
         if (!unique.has(image.sha256))
@@ -126,9 +133,7 @@ async function describeAndReplace(run, input) {
     }
     const deferredOnly = counts.over_budget + counts.backing_off > 0
         && counts.described_now + counts.known + counts.failed + counts.too_large + counts.settled_earlier === 0;
-    const replaced = mode === "describe_and_drop"
-        ? replaceImagesWithMarkers(input.text, images, (image) => described.has(imageStateKey(image.sha256)))
-        : { text: input.text, replacedCount: 0, charsSaved: 0 };
+    const replaced = mode === "describe_and_drop" ? countImageSwaps(swap) : { replacedCount: 0, charsSaved: 0 };
     const pendingImages = [...unique.keys()].filter((sha256) => !described.has(imageStateKey(sha256)));
     console.error(TAG + " transcript prepared", JSON.stringify({
         mode,
@@ -143,7 +148,7 @@ async function describeAndReplace(run, input) {
         kept_without_description: mode === "describe_and_drop" ? images.length - replaced.replacedCount : 0,
     }));
     return {
-        text: replaced.text,
+        swap,
         pendingImages,
         imageCount: images.length,
         uniqueCount: unique.size,
@@ -152,6 +157,19 @@ async function describeAndReplace(run, input) {
         deferredOnly,
     };
 }
+/** What `replaceImagesWithMarkers` would report for this swap, without building the text it would make. */
+function countImageSwaps(swap) {
+    let replacedCount = 0;
+    let charsSaved = 0;
+    for (const image of swap.images) {
+        if (!swap.replace(image))
+            continue;
+        const marker = formatImageMarker({ sha256: image.sha256, mediaType: image.mediaType, byteSize: image.byteSize });
+        replacedCount += 1;
+        charsSaved += image.replaceEnd - image.replaceStart - marker.length;
+    }
+    return { replacedCount, charsSaved };
+}
 function selectImagesToDescribe(run, unique, counts) {
     const { described, settledThisRun, failedImages, now } = run;
     const toSend = [];

package/dist/local-state-files.js

@@ -52,11 +52,13 @@ export async function writeJsonFile(filePath, value) {
  * a reader (or a crash) never sees a half-written file (BLI-17273: a torn image-mode file made a slim
  * machine forget it had ever run slim). The temp file is removed when the write or the rename fails.
  */
-export async function writeJsonFileAtomic(filePath, value) {
+export async function writeJsonFileAtomic(filePath, value, options = {}) {
     await fs.mkdir(path.dirname(filePath), { recursive: true });
     const temp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 10)}.tmp`;
+    // Compact for the big memo files (BLI-23317): indentation was pure transient heap; readers take either.
+    const body = options.compact ? JSON.stringify(value) : JSON.stringify(value, null, 2);
     try {
-        await fs.writeFile(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        await fs.writeFile(temp, `${body}\n`, { mode: 0o600 });
         if (process.platform !== "win32") {
             await fs.chmod(temp, 0o600).catch(() => undefined);
         }

package/dist/raw-evidence-gc.js

@@ -3,6 +3,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { readRawEvidenceCursor } from "./cursors/raw-evidence-cursor.js";
 import { readRawEvidenceStagingState } from "./raw-evidence-staging.js";
+import { hashFileStreaming } from "./evidence-upload-staged.js";
 const RAW_EVIDENCE_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 /**
  * A staging directory belongs to one in-flight collection pass. Anything this
@@ -284,14 +285,13 @@ async function inspectRawEvidenceDirForGc(dir, uploadedHashes) {
         return { deletable: true, byteSize: 0 };
     let byteSize = 0;
     for (const file of files) {
-        const bytes = await fs.readFile(file).catch(() => null);
-        if (!bytes)
+        const hashed = await hashFileStreaming(file);
+        if (!hashed)
             return { deletable: false, byteSize: 0 };
-        const digest = crypto.createHash("sha256").update(bytes).digest("hex");
-        if (!uploadedHashes.has(digest)) {
+        if (!uploadedHashes.has(hashed.digest)) {
             return { deletable: false, byteSize: 0 };
         }
-        byteSize += bytes.byteLength;
+        byteSize += hashed.byteSize;
     }
     return { deletable: true, byteSize };
 }

package/dist/slim/slim-transcript.js

@@ -22,6 +22,7 @@
  * What each rule keeps and drops: claude-rules.ts and codex-rules.ts. The table for people:
  * docs/architecture/image-descriptions.md.
  */
+import { replaceImagesWithMarkers } from "@bli-cockpit/telemetry-core";
 import { newClaudeSlimState, slimClaudeRecord } from "./claude-rules.js";
 import { newCodexSlimState, slimCodexRecord } from "./codex-rules.js";
 import { LineEdits, SeenBlocks, isJsonObject } from "./slim-support.js";
@@ -103,17 +104,89 @@ function slimOneLine(line, applyRules, stats) {
     stats.linesModified += 1;
     return JSON.stringify(record) + (line.endsWith("\r") ? "\r" : "");
 }
-/** The slim form of a whole transcript's text, line for line. */
-export function slimTranscript(text, kind) {
+/**
+ * The slim form of a whole transcript's text, line for line, with the image swap folded into the
+ * same pass (BLI-23317). Output is byte-identical to `replaceImagesWithMarkers` followed by the old
+ * split/map/join: lines are found by `indexOf`, never `split`; a line no rule touched stays part of
+ * a slice of the input and is not copied on its own, so the only new allocation is the one joined
+ * result (and only when some line changed). An image sits inside one line (its characters exclude
+ * "\n"), so it is swapped inside that line before the rules read it, as the two-step order did.
+ */
+export function slimPass(text, kind, swap) {
     const slimmer = createSlimmer(kind);
-    const lines = text.split("\n");
-    const out = new Array(lines.length);
-    for (let index = 0; index < lines.length; index += 1)
-        out[index] = slimmer.slimLine(lines[index]);
+    const pieces = [];
+    let emitted = 0;
+    let nextImage = 0;
+    let replacedCount = 0;
+    let charsSaved = 0;
+    for (let position = 0;;) {
+        const newline = text.indexOf("\n", position);
+        const end = newline === -1 ? text.length : newline;
+        let line = text.slice(position, end);
+        let swapped = false;
+        if (swap) {
+            const local = [];
+            while (nextImage < swap.images.length && swap.images[nextImage].replaceStart < end) {
+                const image = swap.images[nextImage];
+                nextImage += 1;
+                if (image.replaceStart < position || image.replaceEnd > end)
+                    throw new Error("image_spans_lines");
+                local.push({
+                    ...image,
+                    replaceStart: image.replaceStart - position,
+                    replaceEnd: image.replaceEnd - position,
+                    base64Start: image.base64Start - position,
+                    base64End: image.base64End - position,
+                });
+            }
+            if (local.length > 0) {
+                const replaced = replaceImagesWithMarkers(line, local, swap.replace);
+                if (replaced.replacedCount > 0) {
+                    line = replaced.text;
+                    swapped = true;
+                    replacedCount += replaced.replacedCount;
+                    charsSaved += replaced.charsSaved;
+                }
+            }
+        }
+        const out = slimmer.slimLine(line);
+        if (swapped || out !== line) {
+            pieces.push(text.slice(emitted, position), out);
+            emitted = end;
+        }
+        if (newline === -1)
+            break;
+        position = newline + 1;
+    }
     const stats = slimmer.stats();
-    return { text: stats.linesModified === 0 ? text : out.join("\n"), stats };
+    if (pieces.length === 0)
+        return { text, stats, replacedCount, charsSaved, changed: false };
+    pieces.push(text.slice(emitted));
+    return { text: pieces.join(""), stats, replacedCount, charsSaved, changed: true };
+}
+/** The slim form of a whole transcript's text, line for line. */
+export function slimTranscript(text, kind) {
+    const slim = slimPass(text, kind);
+    return { text: slim.text, stats: slim.stats };
 }
 const TAG = "[slim-transcript]";
+function logSlimmed(kind, sessionId, stats, startedAt) {
+    console.error(TAG + (stats.linesModified === 0 ? " nothing to strip" : " transcript slimmed"), JSON.stringify({
+        source: kind,
+        session_id: sessionId.slice(0, 80),
+        lines: stats.lines,
+        lines_modified: stats.linesModified,
+        lines_failed: stats.linesFailed,
+        bytes_before: stats.bytesBefore,
+        bytes_after: stats.bytesAfter,
+        chars_by_rule: stats.charsByRule,
+        lines_by_rule: stats.linesByRule,
+        elapsed_ms: Date.now() - startedAt,
+    }));
+}
+function logSlimFailed(kind, error, bytes) {
+    console.error(TAG + " failed, uploading the transcript as it was", JSON.stringify({ reason: "slim_failed", source: kind, error_name: error instanceof Error ? error.name : typeof error, bytes }));
+}
 /**
  * `slimTranscript` that can never fail a transcript: any exception returns the text it was given and
  * logs the reason. Metadata only: counts, sizes, rule names. Never a line, never a field value.
@@ -122,23 +195,27 @@ export function slimOrKeep(text, kind, label) {
     const startedAt = Date.now();
     try {
         const slim = slimTranscript(text, kind);
-        const stats = slim.stats;
-        console.error(TAG + (stats.linesModified === 0 ? " nothing to strip" : " transcript slimmed"), JSON.stringify({
-            source: kind,
-            session_id: label.sessionId.slice(0, 80),
-            lines: stats.lines,
-            lines_modified: stats.linesModified,
-            lines_failed: stats.linesFailed,
-            bytes_before: stats.bytesBefore,
-            bytes_after: stats.bytesAfter,
-            chars_by_rule: stats.charsByRule,
-            lines_by_rule: stats.linesByRule,
-            elapsed_ms: Date.now() - startedAt,
-        }));
-        return { text: slim.text, stats };
+        logSlimmed(kind, label.sessionId, slim.stats, startedAt);
+        return { text: slim.text, stats: slim.stats };
     }
     catch (error) {
-        console.error(TAG + " failed, uploading the transcript as it was", JSON.stringify({ reason: "slim_failed", source: kind, error_name: error instanceof Error ? error.name : typeof error, bytes: typeof text === "string" ? text.length : 0 }));
+        logSlimFailed(kind, error, typeof text === "string" ? text.length : 0);
         return { text, stats: null };
     }
+}
+/**
+ * `slimPass` that can never fail a transcript: a pass that throws (an image that would span lines,
+ * an exhausted string) logs the reason and returns null, and the caller takes the two-step path.
+ */
+export function slimPassOrNull(text, kind, label, swap) {
+    const startedAt = Date.now();
+    try {
+        const slim = slimPass(text, kind, swap);
+        logSlimmed(kind, label.sessionId, slim.stats, startedAt);
+        return slim;
+    }
+    catch (error) {
+        logSlimFailed(kind, error, text.length);
+        return null;
+    }
 }

package/dist/spool/install-event-outbox.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { describeError } from "../health-detail.js";
@@ -36,6 +37,35 @@ export async function enqueueInstallEventEntry(paths, options) {
     await pruneInstallEventOutbox(paths);
     return entry;
 }
+/**
+ * Synchronous enqueue for a process that is about to exit (BLI-23313): the
+ * memory and wall-clock ceilings cannot await a write. Same entry shape the
+ * async path writes, so the next tick replays it like any other receipt.
+ */
+export function enqueueInstallEventEntrySyncForExit(paths, options) {
+    const createdAt = new Date().toISOString();
+    const outboxId = `install-event-${crypto.randomUUID()}`;
+    const entry = {
+        schema_version: "cockpit-install-event-outbox.v1",
+        outbox_id: outboxId,
+        created_at: createdAt,
+        last_attempt_at: null,
+        retry_count: 0,
+        last_failure_reason: null,
+        dashboard_url: options.dashboardUrl,
+        cli_version: options.cliVersion,
+        command: options.command,
+        os_platform: options.osPlatform,
+        events: options.events.map((event) => ({ ...event, at: event.at ?? createdAt })),
+    };
+    const directory = installEventOutboxDirectory(paths);
+    fsSync.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const filePath = entryPath(paths, outboxId);
+    const tempPath = `${filePath}.tmp-${process.pid}`;
+    fsSync.writeFileSync(tempPath, `${JSON.stringify(entry, null, 2)}\n`, { mode: 0o600 });
+    fsSync.renameSync(tempPath, filePath);
+    return outboxId;
+}
 export async function readPendingInstallEventEntries(paths) {
     const directory = installEventOutboxDirectory(paths);
     const names = await fs.readdir(directory).catch(() => []);

package/dist/staging-gate.js

@@ -73,7 +73,10 @@ export function stagingGateLimitsFromEnv(env) {
  * parent: a fresh machine has no state dir yet). `null` when the platform
  * cannot say, which is logged and never closes the gate on its own.
  */
-export async function readVolumeSpace(dir, statfs = fs.statfs) {
+export async function readVolumeSpace(dir, statfs = fs.statfs, 
+// The host's own path rules; injectable so a Linux test can walk a
+// `C:\Users\...` state dir up to its drive root exactly as Windows does.
+pathApi = path) {
     let target = dir;
     for (let hops = 0; hops < 64; hops += 1) {
         try {
@@ -85,7 +88,7 @@ export async function readVolumeSpace(dir, statfs = fs.statfs) {
             };
         }
         catch (error) {
-            const parent = path.dirname(target);
+            const parent = pathApi.dirname(target);
             if (parent === target) {
                 console.error("[staging-gate] free space unreadable, low-disk check skipped", JSON.stringify({ reason: "statfs_unavailable", ...describeError(error) }));
                 return null;
@@ -136,7 +139,7 @@ export async function readStagingGate(stateDir, env, deps = {}) {
     const [stagingBytes, collectorBytes, volume] = await Promise.all([
         directoryBytes(path.join(stateDir, "raw-evidence")).catch(() => 0),
         measureCollectorBytes(stateDir).catch(() => 0),
-        readVolumeSpace(stateDir, deps.statfs),
+        readVolumeSpace(stateDir, deps.statfs, deps.pathApi),
     ]);
     const facts = {
         staging_bytes: stagingBytes,

package/dist/sync-tick-timing.js

@@ -1,12 +1,15 @@
 export function startTickTimer(now = () => Date.now()) {
     const started = now();
     const stages = {};
+    let running = null;
     const wrap = (name) => async (run) => {
         const stageStarted = now();
+        running = name;
         try {
             return await run();
         }
         finally {
+            running = null;
             stages[name] = (stages[name] ?? 0) + (now() - stageStarted);
         }
     };
@@ -28,6 +31,7 @@ export function startTickTimer(now = () => Date.now()) {
         outcomeReport: wrap("outcome_report"),
         converge: wrap("converge"),
         prune: wrap("prune"),
+        current: () => running,
         finish: (exitCode) => report(exitCode === 0 ? "ok" : "failed", exitCode, null),
         threw: (error) => report("threw", null, error instanceof Error ? error.name : "unknown"),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.262",
+  "version": "0.2.264",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.77",
-    "@bli-cockpit/mcp": "0.1.161",
-    "@bli-cockpit/telemetry-core": "0.1.84"
+    "@bli-cockpit/memory-mcp": "0.1.78",
+    "@bli-cockpit/mcp": "0.1.162",
+    "@bli-cockpit/telemetry-core": "0.1.85"
   },
   "repository": {
     "type": "git",