@bli-cockpit/cli 0.2.272 → 0.2.273

package/dist/adapters/claude-attribution-memoized-reads.js

@@ -36,7 +36,7 @@ function parseMainRead(data) {
 export async function readSidecar(memo, localPath) {
     const stamp = memo ? await statSourceForMemo(localPath) : null;
     if (memo && stamp) {
-        const hit = memo.recall(localPath, stamp, ATTRIBUTION_READ_RECIPE, stamp.size, parseSidecarRead);
+        const hit = await memo.recall(localPath, stamp, ATTRIBUTION_READ_RECIPE, stamp.size, parseSidecarRead);
         if (hit)
             return hit;
     }
@@ -60,7 +60,7 @@ export async function readSidecar(memo, localPath) {
 export async function readMain(memo, filePath) {
     const stamp = memo ? await statSourceForMemo(filePath) : null;
     if (memo && stamp) {
-        const hit = memo.recall(filePath, stamp, ATTRIBUTION_READ_RECIPE, stamp.size, parseMainRead);
+        const hit = await memo.recall(filePath, stamp, ATTRIBUTION_READ_RECIPE, stamp.size, parseMainRead);
         if (hit)
             return hit;
     }

package/dist/adapters/codex-attribution-memoized-reads.js

@@ -0,0 +1,52 @@
+import { SESSION_FACTS_VERSION, SKILL_USE_VERSION } from "@bli-cockpit/telemetry-core";
+import { readCodexMetadataSignals } from "./codex-session-signals.js";
+import { statSourceForMemo } from "./transcript-read-memo.js";
+/**
+ * The read attribution does of one Codex session file, remembered by the file's stamp (BLI-23346), the sibling
+ * of Claude's `claude-attribution-memoized-reads.ts`. Before this a tick re-streamed and re-hashed every Codex
+ * session in the window (177 files, 490 MB on the reference Mac) although no byte had changed. A Codex session
+ * is one file, so what is remembered is the finished answer of the streaming pass: the metadata signals, the
+ * sha256 and size of the bytes, and the finalized facts. The stamp (size, inode, mtime and ctime in
+ * nanoseconds) is the prepare memo's, so an append, rewrite or replace is read fresh. Scoring against the
+ * worktrees and the cwd-exists check run after the read, on every tick, so a repo that appears or vanishes is
+ * seen at once. Bump SIGNALS_VERSION when `codex-session-signals.ts` changes what it extracts.
+ */
+const SIGNALS_VERSION = "codex-signals.v1";
+export const CODEX_READ_RECIPE = ["codex-reads.v1", SIGNALS_VERSION, SESSION_FACTS_VERSION, SKILL_USE_VERSION].join("|");
+const isStrings = (v) => Array.isArray(v) && v.every((s) => typeof s === "string");
+const isNum = (v) => typeof v === "number" && Number.isFinite(v);
+const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function parseCodexRead(data) {
+    if (!isObj(data) || !isNum(data["byteSize"]) || typeof data["contentHashSha256"] !== "string")
+        return null;
+    const s = data["signals"];
+    const facts = data["facts"];
+    if (!isObj(s) || !isObj(facts))
+        return null;
+    for (const key of ["session_ids", "cwds", "workspace_roots", "branches", "commit_hashes", "repository_urls"]) {
+        if (!isStrings(s[key]))
+            return null;
+    }
+    if (!isNum(s["line_count"]) || !isNum(s["parse_error_count"]))
+        return null;
+    if (typeof facts["extractor_version"] !== "string" || facts["source"] !== "codex" || !isObj(facts["usage_by_model"]) || !isNum(facts["transcript_bytes"]))
+        return null;
+    return data;
+}
+/** The session's signals, hash, size and facts: recalled when its stamp is unchanged, else streamed (a read failure throws). */
+export async function readCodexMetadataMemoized(memo, filePath) {
+    const stamp = memo ? await statSourceForMemo(filePath) : null;
+    if (memo && stamp) {
+        const hit = await memo.recall(filePath, stamp, CODEX_READ_RECIPE, stamp.size, parseCodexRead);
+        if (hit)
+            return hit;
+    }
+    else
+        memo?.note("stamp_missing");
+    const read = await readCodexMetadataSignals(filePath);
+    if (memo && stamp) {
+        memo.note("fresh");
+        memo.remember(filePath, stamp, CODEX_READ_RECIPE, read);
+    }
+    return read;
+}

package/dist/adapters/codex-attribution.js

@@ -2,7 +2,8 @@ import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { describeError } from "../health-detail.js";
-import { extractCodexSessionSignals, readCodexMetadataSignals, } from "./codex-session-signals.js";
+import { extractCodexSessionSignals, } from "./codex-session-signals.js";
+import { readCodexMetadataMemoized } from "./codex-attribution-memoized-reads.js";
 import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
 /**
  * Deterministic Codex session JSONL -> repo/worktree attribution.
@@ -41,7 +42,7 @@ export async function scanAndAttributeCodexSessions(options) {
     const files = discovery.files.slice(0, limit);
     const results = [];
     for (const file of files) {
-        results.push(await attributeOneSession(file, options.worktrees, options.collectionRoots ?? []));
+        results.push(await attributeOneSession(file, options.worktrees, options.collectionRoots ?? [], options.readMemo));
     }
     return {
         results,
@@ -164,11 +165,11 @@ function dedupePaths(values) {
     }
     return out;
 }
-async function attributeOneSession(file, worktrees, collectionRoots) {
+async function attributeOneSession(file, worktrees, collectionRoots, readMemo) {
     const base = createSessionBase(file);
     let read;
     try {
-        read = await readCodexMetadataSignals(file.file);
+        read = await readCodexMetadataMemoized(readMemo, file.file);
     }
     catch (error) {
         // One skipped session, with `file_read_failed` on its row. Logged per

package/dist/adapters/raw-evidence-image-reader.js

@@ -27,7 +27,7 @@ export async function collectAgentImagesFromTranscript(collection, options) {
     const memo = collection.budget.readMemo;
     const stamp = memo ? await statSourceForMemo(options.filePath) : null;
     const remembered = memo && stamp
-        ? memo.recall(options.filePath, stamp, IMAGE_SCAN_RECIPE, stamp.size, (data) => (data === "no_image_candidates" ? true : null))
+        ? await memo.recall(options.filePath, stamp, IMAGE_SCAN_RECIPE, stamp.size, (data) => (data === "no_image_candidates" ? true : null))
         : null;
     if (!remembered && memo && !stamp)
         memo.note("stamp_missing");

package/dist/adapters/transcript-read-memo.js

@@ -5,49 +5,77 @@
  * transcript the image step scans: on the reference Mac 33 of the 37 seconds of main-thread JavaScript went to
  * reading, parsing and hashing files whose size and mtime had not moved since the tick before. This is the
  * sibling of the prepare memo (`raw-evidence-prepare-memo.ts`) and uses ITS stamp: size plus inode, mtime and
- * ctime in nanoseconds, so an append, rewrite or replace is never mistaken for "unchanged". The entry cap, the
- * `seen_ms` ageing and the atomic write are the prepare memo's own helpers.
+ * ctime in nanoseconds, so an append, rewrite or replace is never mistaken for "unchanged". The entry cap and
+ * the 14-day forgetting are the prepare memo's own numbers.
  *
  * An entry is trusted only when the stamp AND the recipe match. The recipe names the rules that produced the
  * remembered answer, so changing a rule rebuilds the memo once. What an entry holds is decided by its caller
  * (`data`); this file never sees a byte of transcript content, and neither does the file on disk: signals,
  * hashes, sizes and counts only. A memo that is lost, corrupt or stale in the safe direction costs one slow
  * tick, never a wrong answer. The file path is hashed, so no path reaches the memo either.
+ *
+ * BLI-23346: one small file per source key under `transcript-read-memo-<name>/`, read on demand. The first
+ * layout was one JSON file; on the reference Mac that reached 18.2 MB (2,931 entries, 1.1 M timestamps), was
+ * parsed whole at open, held through both scan passes and rewritten whole whenever one transcript was fresh.
+ * Now an unchanged transcript costs one small read that is parsed and dropped, a changed one costs one small
+ * atomic write, and nothing else is touched. A hit older than a day gets its `seen_ms` rewritten (one small
+ * file), and a prune pass (at most daily, by file mtime) forgets what was not written or refreshed for 14 days
+ * and the oldest beyond the cap. Exact facts are unchanged: an entry holds the same `data` the caller always
+ * stored (request-id-ordered usage, delta-encoded timestamps), it is only filed apart.
  */
 import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
 import path from "node:path";
-import { isMissingFileFailure } from "../health-detail.js";
-import { readJsonFile, writeJsonFileAtomic } from "../local-state-files.js";
-import { PREPARE_MEMO_MAX_ENTRIES, refreshSeen, trimEntries, } from "./raw-evidence-prepare-memo.js";
+import { describeError } from "../health-detail.js";
+import { isMissingFileError, writeJsonFileAtomic } from "../local-state-files.js";
+import { FORGET_AFTER_MS, PREPARE_MEMO_MAX_ENTRIES, SEEN_REFRESH_MS, } from "./raw-evidence-prepare-memo.js";
 export { sourceStampOf, statSourceForMemo } from "./raw-evidence-prepare-memo.js";
-const MEMO_FORMAT = "transcript-read-memo.v1";
+const MEMO_FORMAT = "transcript-read-memo.v2";
 const TAG = "[transcript-reads]";
+const PRUNE_EVERY_MS = 24 * 3_600_000;
+const PRUNE_MARKER = ".pruned";
+const WRITE_CONCURRENCY = 8;
 export function transcriptReadMemoPath(stateDir, name) {
-    return path.join(stateDir, `transcript-read-memo-${name}.json`);
+    return path.join(stateDir, `transcript-read-memo-${name}`);
 }
 const keyOf = (filePath) => createHash("sha256").update(filePath).digest("hex").slice(0, 32);
+const zeroCounts = () => ({ reused: 0, fresh: 0, stamp_missing: 0, bytes_not_read: 0, unreadable: 0, refreshed: 0 });
 export async function openTranscriptReadMemo(stateDir, name) {
-    const entries = await readEntries(stateDir, name);
-    let dirty = false;
-    let counts = { reused: 0, fresh: 0, stamp_missing: 0, bytes_not_read: 0 };
-    const recalled = new Set();
+    const dir = transcriptReadMemoPath(stateDir, name);
+    const entryPath = (key) => path.join(dir, `${key}.json`);
+    /** Entries remembered this pass, written at `settle`; also answers a second pass over the same file before then. */
+    const pending = new Map();
+    let counts = zeroCounts();
+    await removeLegacySingleFile(stateDir, name);
     return {
-        recall(filePath, stamp, recipe, bytes, parse) {
+        async recall(filePath, stamp, recipe, bytes, parse) {
             const key = keyOf(filePath);
-            const entry = entries.get(key);
+            const fromPending = pending.get(key);
+            let entry = fromPending;
+            if (!entry) {
+                const loaded = await readEntry(entryPath(key));
+                if (loaded === "unreadable")
+                    counts.unreadable += 1;
+                else if (loaded)
+                    entry = loaded;
+            }
             if (!entry || entry.recipe !== recipe || entry.size !== stamp.size || entry.identity !== stamp.identity)
                 return null;
             const data = parse(entry.data);
             if (data === null)
                 return null;
-            recalled.add(key);
             counts.reused += 1;
             counts.bytes_not_read += bytes;
+            const now = Date.now();
+            if (!fromPending && now - entry.seen_ms > SEEN_REFRESH_MS) {
+                entry.seen_ms = now;
+                counts.refreshed += 1;
+                await writeJsonFileAtomic(entryPath(key), entry, { compact: true }).catch(() => undefined);
+            }
             return data;
         },
         remember(filePath, stamp, recipe, data, now = Date.now()) {
-            entries.set(keyOf(filePath), { ...stamp, recipe, data, seen_ms: now });
-            dirty = true;
+            pending.set(keyOf(filePath), { schema_version: MEMO_FORMAT, ...stamp, recipe, data, seen_ms: now });
         },
         note(outcome) {
             if (outcome === "fresh")
@@ -57,53 +85,102 @@ export async function openTranscriptReadMemo(stateDir, name) {
         },
         async settle(now = Date.now()) {
             const done = counts;
-            counts = { reused: 0, fresh: 0, stamp_missing: 0, bytes_not_read: 0 };
-            dirty = refreshSeen(entries, recalled, now) || dirty;
-            recalled.clear();
-            let written = false;
-            let reason = done.reused > 0 ? "stamp_unchanged" : done.fresh > 0 ? "no_reusable_entry" : "stamp_missing";
-            if (dirty) {
-                const before = entries.size;
-                const kept = trimEntries(entries, now, PREPARE_MEMO_MAX_ENTRIES);
-                try {
-                    await writeJsonFileAtomic(transcriptReadMemoPath(stateDir, name), { schema_version: MEMO_FORMAT, entries: Object.fromEntries(kept) }, { compact: true });
-                    dirty = false;
-                    written = true;
-                }
-                catch (error) {
-                    reason = "memo_write_failed";
-                    console.error(TAG + " memo not written; the next tick reads these files again", JSON.stringify({ memo: name, reason, entries: before, error_name: error instanceof Error ? error.name : typeof error }));
+            counts = zeroCounts();
+            const toWrite = [...pending.entries()];
+            pending.clear();
+            let written = 0;
+            let failed = 0;
+            for (let i = 0; i < toWrite.length; i += WRITE_CONCURRENCY) {
+                const outcomes = await Promise.all(toWrite.slice(i, i + WRITE_CONCURRENCY).map(([key, entry]) => writeJsonFileAtomic(entryPath(key), entry, { compact: true }).then(() => true, (error) => {
+                    if (failed === 0)
+                        console.error(TAG + " memo entry not written; that file is read again next tick", JSON.stringify({ memo: name, reason: "memo_write_failed", ...describeError(error) }));
+                    return false;
+                })));
+                for (const ok of outcomes) {
+                    if (ok)
+                        written += 1;
+                    else
+                        failed += 1;
                 }
             }
-            if (done.reused + done.fresh + done.stamp_missing === 0)
+            const pruned = await pruneIfDue(dir, name, now);
+            if (done.reused + done.fresh + done.stamp_missing === 0 && pruned === null)
                 return;
-            console.error(TAG + " tick", JSON.stringify({ memo: name, reason, reused: done.reused, read_fresh: done.fresh, stamp_missing: done.stamp_missing, bytes_not_read: done.bytes_not_read, entries: entries.size, memo_written: written }));
+            const reason = failed > 0 ? "memo_write_failed" : done.reused > 0 ? "stamp_unchanged" : done.fresh > 0 ? "no_reusable_entry" : "stamp_missing";
+            console.error(TAG + " tick", JSON.stringify({
+                memo: name,
+                reason,
+                reused: done.reused,
+                read_fresh: done.fresh,
+                stamp_missing: done.stamp_missing,
+                bytes_not_read: done.bytes_not_read,
+                entries_written: written,
+                entries_write_failed: failed,
+                entries_unreadable: done.unreadable,
+                seen_refreshed: done.refreshed,
+                ...(pruned ? { pruned_expired: pruned.expired, pruned_over_cap: pruned.overCap, kept: pruned.kept } : {}),
+            }));
         },
     };
 }
-async function readEntries(stateDir, name) {
-    const entries = new Map();
-    let raw;
+/** One entry file; null when absent; "unreadable" when it exists but is not an entry (a miss, rewritten by the next fresh read). */
+async function readEntry(file) {
+    let text;
+    try {
+        text = await fs.readFile(file, "utf8");
+    }
+    catch (error) {
+        return isMissingFileError(error) ? null : "unreadable";
+    }
+    try {
+        const e = JSON.parse(text);
+        if (e && e.schema_version === MEMO_FORMAT && typeof e.size === "number" && typeof e.identity === "string" && typeof e.recipe === "string" && typeof e.seen_ms === "number" && e.data !== undefined)
+            return e;
+    }
+    catch {
+        // A torn or foreign file is a miss; the caller counts it as unreadable.
+    }
+    return "unreadable";
+}
+/** The pre-BLI-23346 single file is dead weight (18 MB on the reference Mac): remove it once and say so. */
+async function removeLegacySingleFile(stateDir, name) {
+    const legacy = path.join(stateDir, `transcript-read-memo-${name}.json`);
     try {
-        raw = await readJsonFile(transcriptReadMemoPath(stateDir, name));
+        const { size } = await fs.stat(legacy);
+        await fs.rm(legacy, { force: true });
+        console.error(TAG + " legacy single-file memo removed", JSON.stringify({ memo: name, reason: "legacy_memo_replaced_by_entry_files", bytes: size }));
     }
     catch (error) {
-        if (!isMissingFileFailure(error))
-            console.error(TAG + " memo unreadable; every file is read once", JSON.stringify({ memo: name, reason: "read_memo_unreadable" }));
-        return entries;
+        if (!isMissingFileError(error))
+            console.error(TAG + " legacy memo not removed", JSON.stringify({ memo: name, reason: "legacy_memo_remove_failed", ...describeError(error) }));
     }
-    const stored = raw;
-    if (stored?.schema_version !== MEMO_FORMAT || !stored.entries || typeof stored.entries !== "object")
-        return entries;
-    let dropped = 0;
-    for (const [key, value] of Object.entries(stored.entries)) {
-        const e = value;
-        if (e && typeof e.size === "number" && typeof e.identity === "string" && typeof e.recipe === "string" && typeof e.seen_ms === "number" && e.data !== undefined)
-            entries.set(key, e);
-        else
-            dropped += 1;
+}
+/** At most once a day: forget entries not written or refreshed for 14 days, then the oldest beyond the cap. Null when not due or nothing to prune. */
+async function pruneIfDue(dir, name, now) {
+    const marker = path.join(dir, PRUNE_MARKER);
+    try {
+        const last = await fs.stat(marker).then((s) => s.mtimeMs, () => 0);
+        if (now - last < PRUNE_EVERY_MS)
+            return null;
+        const names = (await fs.readdir(dir)).filter((n) => n.endsWith(".json"));
+        const aged = [];
+        for (const n of names) {
+            const file = path.join(dir, n);
+            const stat = await fs.stat(file).catch(() => null);
+            if (stat)
+                aged.push({ file, mtimeMs: stat.mtimeMs });
+        }
+        const expired = aged.filter((a) => now - a.mtimeMs > FORGET_AFTER_MS);
+        const live = aged.filter((a) => now - a.mtimeMs <= FORGET_AFTER_MS).sort((a, b) => b.mtimeMs - a.mtimeMs);
+        const over = live.slice(PREPARE_MEMO_MAX_ENTRIES);
+        await Promise.all([...expired, ...over].map((a) => fs.rm(a.file, { force: true })));
+        await fs.writeFile(marker, `${new Date(now).toISOString()}\n`);
+        await fs.utimes(marker, new Date(now), new Date(now));
+        return { expired: expired.length, overCap: over.length, kept: live.length - over.length };
+    }
+    catch (error) {
+        if (!isMissingFileError(error))
+            console.error(TAG + " memo prune failed", JSON.stringify({ memo: name, reason: "memo_prune_failed", ...describeError(error) }));
+        return null;
     }
-    if (dropped > 0)
-        console.error(TAG + " memo entries dropped as malformed", JSON.stringify({ memo: name, reason: "read_memo_entries_malformed", dropped, kept: entries.size }));
-    return entries;
 }

package/dist/bookkeeping-session.js

@@ -0,0 +1,82 @@
+/**
+ * Tick-scoped bookkeeping: load each big state file once, write it at checkpoints (BLI-23346).
+ *
+ * The worktree loop of one sync tick used to read the 7 MB raw-evidence cursor and the staging state from disk,
+ * mutate them and write them back (serialise, fsync, rename) once per worktree, about 45 times a tick on the
+ * reference Mac: ~650 MB of JSON churn and ~326 MB of fsync'd writes to say "nothing changed". Inside
+ * `withBookkeepingSession` the first read of a file loads it, later reads return the SAME in-memory object, and a
+ * write only marks it dirty. Dirty files are persisted by the SAME writer the caller named (so fsync, temp file,
+ * rename and pruning are unchanged) at three points: when `CHECKPOINT_MS` has passed since the last flush, and
+ * when the session ends (also on an exception or a yielded loop, before the sync lock is released). A process
+ * killed between checkpoints loses at most that window of bookkeeping, which only means objects are re-offered
+ * next tick (the server dedups by content hash); it never loses a delivery.
+ *
+ * Outside a session every call is the plain disk read / write it always was, so a lone `cockpit sync`, backfill
+ * or doctor behaves exactly as before. Only the worktree loop opens a session, and it holds the sync lock.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { describeError } from "./health-detail.js";
+const TAG = "[bookkeeping]";
+export const CHECKPOINT_MS = 30_000;
+const storage = new AsyncLocalStorage();
+/** The value for `key`: loaded by `load` on first use inside a session, then served from memory. Outside a session, `load()`. */
+export async function bookkeepingRead(key, load) {
+    const session = storage.getStore();
+    if (!session)
+        return load();
+    const held = session.entries.get(key);
+    if (held) {
+        session.memoryReads += 1;
+        return held.value;
+    }
+    const value = await load();
+    session.diskReads += 1;
+    // `persist` is filled in by the first write; a never-written entry is never dirty.
+    session.entries.set(key, { value, persist: async () => undefined, dirty: false });
+    return value;
+}
+/** Record `value` as the new state of `key`. Inside a session it is persisted at the next checkpoint; outside, now. */
+export async function bookkeepingWrite(key, value, persist) {
+    const session = storage.getStore();
+    if (!session)
+        return persist(value);
+    session.writesRequested += 1;
+    session.entries.set(key, { value, persist: persist, dirty: true });
+    if (Date.now() - session.lastFlushMs >= CHECKPOINT_MS)
+        await flush(session, "checkpoint");
+}
+async function flush(session, why) {
+    session.lastFlushMs = Date.now();
+    const dirty = [...session.entries.values()].filter((entry) => entry.dirty);
+    if (dirty.length === 0)
+        return;
+    session.flushes += 1;
+    for (const entry of dirty) {
+        entry.dirty = false;
+        try {
+            await entry.persist(entry.value);
+            session.filesFlushed += 1;
+        }
+        catch (error) {
+            entry.dirty = true;
+            console.error(TAG + " state not written", JSON.stringify({ reason: why === "end" ? "end_flush_failed" : "checkpoint_flush_failed", ...describeError(error) }));
+            if (why === "checkpoint")
+                throw error;
+        }
+    }
+}
+/** Run `fn` with bookkeeping held in memory; flush whatever is dirty when it settles, however it settles. */
+export async function withBookkeepingSession(fn) {
+    if (storage.getStore())
+        return fn();
+    const session = { entries: new Map(), lastFlushMs: Date.now(), diskReads: 0, memoryReads: 0, writesRequested: 0, flushes: 0, filesFlushed: 0 };
+    try {
+        return await storage.run(session, fn);
+    }
+    finally {
+        await flush(session, "end");
+        if (session.diskReads + session.memoryReads + session.writesRequested > 0) {
+            console.error(TAG + " session settled", JSON.stringify({ reason: "session_end", disk_reads: session.diskReads, memory_reads: session.memoryReads, writes_requested: session.writesRequested, flush_count: session.flushes, files_written: session.filesFlushed }));
+        }
+    }
+}

package/dist/commands/memory-install-config.js

@@ -31,7 +31,7 @@ export async function resolveMemoryMcpBin(options) {
 export async function resolveMemoryConfig(command, io, platform, deps) {
     const dashboardUrl = await resolveDashboardUrl(command, deps);
     const found = await resolveMemoryMcpBin({
-        env: envWithNodeRuntimeOnPath(io.env ?? process.env),
+        env: envWithNodeRuntimeOnPath(io.env ?? process.env, undefined, platform),
         platform,
         fileExists: deps.fileExists,
         cliEntryPoint: deps.cliEntryPoint,

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.272");
+    writeLine(io?.stdout ?? process.stdout, "0.2.273");
     return 0;
   }
 

package/dist/commands/session-sync-scan.js

@@ -12,6 +12,7 @@ import { saveRootWorkScan } from "../root-work.js";
 import { CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT, CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES, defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
 import { scanAndAttributeClaudeSessions, } from "../adapters/claude-attribution.js";
 import { CLAUDE_CURSOR_FILENAME } from "../cursors/raw-evidence-cursor.js";
+import { isRedactionStubObjectKey } from "../cursors/raw-evidence-stub-entry.js";
 import { clearSourceRetryFailure, recordSourceRetryFailure, } from "../spool/local-spool.js";
 import { claudeAttributionReadFailureCount, codexAttributionReadFailureCount, } from "./agent-session-report.js";
 import { widenForCatchUp } from "./session-sync-outside-roots.js";
@@ -37,6 +38,7 @@ export async function scanAndAttributeBothSources(options) {
         retryPending: plan.codexRetryPending,
         retrySinceMinutes: plan.codexRetrySinceMinutes,
         outsideRootCatchUpPending: plan.outsideRootCatchUpPending,
+        stateDir: options.paths.state_dir,
     });
     // First run (D B.4 §8): without a Claude cursor yet, widen the window to 14
     // days so the first sync captures retroactive history instead of only 24h.
@@ -60,7 +62,7 @@ export async function scanAndAttributeBothSources(options) {
             source: "codex",
             attemptedAt: options.now.toISOString(),
             pendingBefore: plan.codexSourceRetryPending,
-            reason: sourceScanRetryReason("codex", codexAttribution),
+            reason: sourceScanRetryReason("codex", codexAttribution, plan.codexCursorBefore),
         });
     }
     if (plan.claudeEnabled) {
@@ -69,7 +71,7 @@ export async function scanAndAttributeBothSources(options) {
             source: "claude_code",
             attemptedAt: options.now.toISOString(),
             pendingBefore: plan.claudeSourceRetryPending,
-            reason: sourceScanRetryReason("claude_code", claudeAttribution),
+            reason: sourceScanRetryReason("claude_code", claudeAttribution, plan.claudeCursorBefore),
         });
     }
     await saveRootWorkScan(options.paths, [...codexAttribution.results, ...claudeAttribution.results], options.now);
@@ -89,28 +91,37 @@ async function scanCodexSessionsForSync(options) {
     const sinceMinutes = widenForCatchUp(options.retryPending
         ? options.retrySinceMinutes
         : CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES, options.outsideRootCatchUpPending, CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES);
-    let scan = await scanAndAttributeCodexSessions({
-        sessionsDirs: defaultCodexSessionDirs(options.homeDir),
-        worktrees: options.worktrees,
-        now: options.now,
-        sinceMinutes,
-        limit: CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT,
-        collectionRoots: options.collectionRoots,
-    });
-    if (scan.session_limit_applied) {
-        // Re-run once, bounded by exactly what the first pass discovered, so a
-        // capped scan still returns every session it found instead of silently
-        // truncating at the window's default limit.
-        scan = await scanAndAttributeCodexSessions({
+    // BLI-23346: one memo for both passes, settled once, so an unchanged session file is never streamed again.
+    const readMemo = await openTranscriptReadMemo(options.stateDir, "codex_attribution").catch(() => undefined);
+    try {
+        let scan = await scanAndAttributeCodexSessions({
             sessionsDirs: defaultCodexSessionDirs(options.homeDir),
             worktrees: options.worktrees,
             now: options.now,
             sinceMinutes,
-            limit: scan.discovered_file_count,
+            limit: CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT,
             collectionRoots: options.collectionRoots,
+            readMemo,
         });
+        if (scan.session_limit_applied) {
+            // Re-run once, bounded by exactly what the first pass discovered, so a
+            // capped scan still returns every session it found instead of silently
+            // truncating at the window's default limit.
+            scan = await scanAndAttributeCodexSessions({
+                sessionsDirs: defaultCodexSessionDirs(options.homeDir),
+                worktrees: options.worktrees,
+                now: options.now,
+                sinceMinutes,
+                limit: scan.discovered_file_count,
+                collectionRoots: options.collectionRoots,
+                readMemo,
+            });
+        }
+        return scan;
+    }
+    finally {
+        await readMemo?.settle();
     }
-    return scan;
 }
 /**
  * Scan and attribute Claude sessions for this sync — the Claude counterpart to
@@ -155,7 +166,7 @@ async function scanClaudeSessionsForSync(options) {
         await readMemo?.settle();
     }
 }
-export function sourceScanRetryReason(source, scan) {
+export function sourceScanRetryReason(source, scan, cursorBefore) {
     const reasons = new Set();
     const failure = sourceScanFailureReason(source, scan);
     if (failure)
@@ -164,11 +175,30 @@ export function sourceScanRetryReason(source, scan) {
     // reason to widen the next scan window, because the transcript fallback can
     // still attribute it. It is not a reason to call this sync failed — see
     // `sourceScanFailureReason`.
-    if (scan.results.some((result) => result.reason === "repo_not_on_disk")) {
+    //
+    // BLI-23346: only while that session still owes its upload. A `repo_not_on_disk` session the cursor already
+    // holds a durable pointer for owes nothing, and widening for it re-scanned 30 days every tick on the reference
+    // Mac (the widened window found the same already-delivered sessions again, which re-armed the flag).
+    const owing = scan.results.filter((result) => result.reason === "repo_not_on_disk" && sessionStillOwesUpload(source, result, cursorBefore));
+    if (owing.length > 0) {
         reasons.add("repo_not_on_disk");
     }
+    else if (cursorBefore) {
+        const delivered = scan.results.filter((result) => result.reason === "repo_not_on_disk").length;
+        if (delivered > 0)
+            console.error("[session-sync] repo_not_on_disk sessions are already delivered, no scan retry kept", JSON.stringify({ reason: "repo_not_on_disk_already_durable", source, delivered_count: delivered }));
+    }
     return reasons.size > 0 ? [...reasons].sort().join(",") : null;
 }
+function sessionStillOwesUpload(source, result, cursorBefore) {
+    if (!cursorBefore)
+        return true;
+    const sessionId = source === "codex"
+        ? result.codex_session_id
+        : result.claude_session_id;
+    const key = cursorBefore.sessions[sessionId]?.uploaded_object_key;
+    return !key || isRedactionStubObjectKey(key);
+}
 /**
  * The part of the scan outcome that is a genuine FAILURE: the session store
  * itself could not be read, so sessions that exist were not seen.

package/dist/commands/session-sync-upload.js

@@ -6,6 +6,7 @@
  * and the Claude growth damper lives here because it is the only step that can
  * see both what the cursor already made durable and what is about to be sent.
  */
+import { withBookkeepingSession } from "../bookkeeping-session.js";
 import { startLocalWorkContext, startLocalWorkContextForAttributedTarget, } from "../local-state.js";
 import { LocalUploadBlockedError, syncLocalAmbientEnvelope, } from "../upload.js";
 import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET, } from "../adapters/raw-evidence.js";
@@ -41,12 +42,14 @@ export async function syncEveryTargetWorktree(options) {
     };
     // BLI-11112: a waiting backfill takes the lock at the next worktree
     // boundary; the worktrees not reached stay pending for it or the next tick.
-    const loop = await runYieldingAtBoundaries({
+    // BLI-23346: the cursor and the staging state are loaded once for the whole loop and written at checkpoints and
+    // when the loop ends (before the lock is released), not read and rewritten per worktree.
+    const loop = await withBookkeepingSession(() => runYieldingAtBoundaries({
         items: syncWorktrees,
         shouldYield: run.yieldCheck,
         describe: (outcome) => ({ status: outcome.sync.status }),
         runOne: (worktree) => syncTargetWithAllowance(options, worktree, syncWorktrees, rawEvidenceBudget, discoveredWorktreeKeys, dampedClaudePointers),
-    });
+    }));
     const outcomes = loop.results;
     const everyWorktreeUploaded = outcomes.every((outcome) => outcome.sync.status === "uploaded");
     return {

package/dist/commands/tower-mcp-install.js

@@ -26,7 +26,7 @@ import { envWithNodeRuntimeOnPath } from "../scheduled-self-update.js";
 async function resolveTowerConfig(deps) {
     const found = await resolveMcpBin({
         binName: TOWER_MCP_BIN,
-        env: envWithNodeRuntimeOnPath(deps.env),
+        env: envWithNodeRuntimeOnPath(deps.env, undefined, deps.platform),
         platform: deps.platform,
         fileExists: deps.fileExists,
         cliEntryPoint: deps.cliEntryPoint,

package/dist/cursors/raw-evidence-cursor.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { bookkeepingRead, bookkeepingWrite } from "../bookkeeping-session.js";
 import { describeError, isMissingFileFailure } from "../health-detail.js";
 /**
  * Durable local cursor for raw-evidence harvesting.
@@ -37,7 +38,22 @@ export function emptyRawEvidenceCursorState() {
         sessions: {},
     };
 }
+/**
+ * Inside a worktree-loop bookkeeping session the cursor is loaded once and handed out as one shared object
+ * (`bookkeeping-session.ts`, BLI-23346); anywhere else this is the plain disk read.
+ */
 export async function readRawEvidenceCursor(paths, options = {}) {
+    let key;
+    try {
+        key = rawEvidenceCursorPath(paths, options.filename);
+    }
+    catch {
+        // Paths without a cursors dir: the disk reader below reports it exactly as it always did.
+        return readRawEvidenceCursorFromDisk(paths, options);
+    }
+    return bookkeepingRead(key, () => readRawEvidenceCursorFromDisk(paths, options));
+}
+async function readRawEvidenceCursorFromDisk(paths, options) {
     try {
         const raw = JSON.parse(await fs.readFile(rawEvidenceCursorPath(paths, options.filename), "utf8"));
         return parseCursorState(raw);
@@ -59,6 +75,9 @@ export async function readRawEvidenceCursor(paths, options = {}) {
     }
 }
 export async function writeRawEvidenceCursor(paths, state, options = {}) {
+    await bookkeepingWrite(rawEvidenceCursorPath(paths, options.filename), state, (held) => writeRawEvidenceCursorToDisk(paths, held, options));
+}
+async function writeRawEvidenceCursorToDisk(paths, state, options) {
     const filePath = rawEvidenceCursorPath(paths, options.filename);
     await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
     const pruned = pruneCursorState(state);

package/dist/raw-evidence-staging.js

@@ -2,6 +2,7 @@ import { DELIVERY_BACKOFF_HOLDING } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { bookkeepingRead, bookkeepingWrite } from "./bookkeeping-session.js";
 import { describeError, isMissingFileFailure } from "./health-detail.js";
 /**
  * Durable local state for raw-evidence STAGING and DELIVERY ATTEMPTS.
@@ -67,7 +68,9 @@ export function emptyRawEvidenceStagingState() {
 export function rawEvidenceStagingStatePath(stateDir) {
     return path.join(stateDir, RAW_EVIDENCE_STAGING_FILENAME);
 }
-export async function readRawEvidenceStagingState(stateDir) {
+export const readRawEvidenceStagingState = (stateDir) => // BLI-23346: once per loop
+ bookkeepingRead(rawEvidenceStagingStatePath(stateDir), () => readStagingFromDisk(stateDir));
+async function readStagingFromDisk(stateDir) {
     try {
         const raw = JSON.parse(await fs.readFile(rawEvidenceStagingStatePath(stateDir), "utf8"));
         const state = parseStagingState(raw);
@@ -94,11 +97,12 @@ export async function readRawEvidenceStagingState(stateDir) {
  * lose every attempt count at once — which is exactly the thing that must not
  * be losable.
  */
-export async function writeRawEvidenceStagingState(stateDir, state) {
+export const writeRawEvidenceStagingState = (stateDir, state) => bookkeepingWrite(rawEvidenceStagingStatePath(stateDir), state, (held) => writeStagingToDisk(stateDir, held));
+async function writeStagingToDisk(stateDir, state) {
     const filePath = rawEvidenceStagingStatePath(stateDir);
     await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
     const pruned = pruneStagingState(state);
-    const serialized = `${JSON.stringify(pruned, null, 2)}\n`;
+    const serialized = `${JSON.stringify(pruned)}\n`; // compact (BLI-23346); readers accept either
     const tempPath = `${filePath}.tmp-${process.pid}-${crypto.randomUUID()}`;
     let handle = null;
     try {

package/dist/scheduled-self-update.js

@@ -7,14 +7,24 @@ export const SELF_UPDATE_THROTTLE_MARKER = ".last-self-update-check";
  * Put the running node binary's directory on PATH for scheduled npm commands.
  * Schedulers use a bare PATH; npm's shim ships beside node on both host families.
  */
-export function envWithNodeRuntimeOnPath(env, nodeExecutable = process.execPath) {
-    const nodeBinDir = path.dirname(nodeExecutable);
-    const currentPath = env["PATH"] ?? "";
-    if (currentPath.split(path.delimiter).includes(nodeBinDir))
+export function envWithNodeRuntimeOnPath(env, nodeExecutable = process.execPath, 
+/** Which platform's rules the PATH follows. Omitted: this host's own. */
+platform) {
+    const api = platform === undefined ? path : platform === "win32" ? path.win32 : path.posix;
+    // The running node's folder means nothing on a platform it is not from (an install
+    // simulated for another platform): leave that PATH exactly as the caller wrote it.
+    if (!api.isAbsolute(nodeExecutable))
+        return env;
+    const nodeBinDir = api.dirname(nodeExecutable);
+    // Windows spells the variable `Path`, and `{ ...process.env }` keeps that spelling: reading
+    // only `PATH` saw an empty PATH and left two spellings in the child's environment (BLI-23322).
+    const pathKey = api.sep === "\\" ? Object.keys(env).find((key) => key.toUpperCase() === "PATH") ?? "PATH" : "PATH";
+    const currentPath = env[pathKey] ?? "";
+    if (currentPath.split(api.delimiter).includes(nodeBinDir))
         return env;
     return {
         ...env,
-        PATH: [nodeBinDir, currentPath].filter(Boolean).join(path.delimiter),
+        [pathKey]: [nodeBinDir, currentPath].filter(Boolean).join(api.delimiter),
     };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.272",
+  "version": "0.2.273",
   "private": false,
   "type": "module",
   "bin": {