@bli-cockpit/cli 0.2.273 → 0.2.275

package/dist/commands/doctor-report.js

@@ -1,4 +1,4 @@
-import { setupReceiptPieces } from "@bli-cockpit/telemetry-core";
+import { CODEX_HOOKS_TRUST_GUIDE_URL, setupReceiptPieces } from "@bli-cockpit/telemetry-core";
 import { redactedHealthDetail } from "../health-detail.js";
 import { setupReceiptBlock } from "./setup-receipt-lines.js";
 export function ok(id, code, message) {
@@ -193,7 +193,7 @@ export function doctorNeedsPerson(rows, receipt) {
             const step = key === "device" || key === "browser" ? "authed" : key === "collector.autostart" ? "autostart-alive" : "memory-registered";
             if (piece.status !== "needs_trust" && items.some((item) => item.step === step))
                 continue;
-            items.push({ step: key, reason: piece.reason ?? piece.status, action: piece.status === "needs_trust" ? "Open Codex and run /hooks to trust the installed hooks." : defaults[step] });
+            items.push({ step: key, reason: piece.reason ?? piece.status, action: piece.status === "needs_trust" ? `Open Codex and run /hooks to trust the installed hooks. Step by step: ${CODEX_HOOKS_TRUST_GUIDE_URL}` : defaults[step] });
         }
     }
     return items;

package/dist/commands/local.js

@@ -1,78 +1,11 @@
-import { runOpsCommand } from "./local-run-ops.js";
-import { runGlossary } from "./glossary.js";
-import { runSpend } from "./spend.js";
-import { runSessionsForget } from "./sessions-forget.js";
-import { runPush } from "./push.js";
 import { defaultIo, writeLine } from "./cli-io.js";
 import { isLocalHelpRequest, localCommandHelp } from "./local-help.js";
 import { beginStage, endStage } from "../crash-guard.js";
 import { reportCommandFailure, refuseArguments, stripGlobalToggles, watchWrites } from "./local-run-guards.js";
-import { reportInstallEventsBestEffort } from "./install-receipts.js";
-import { persistOnboardingRootConfig, resolveOnboardingRootsForCommand, } from "./collection-roots.js";
 import { rememberDiscoveryLimits } from "./local-discovery.js";
-import { runInstall, runRelease, runSelfUpdate, runUpdate } from "./install-update.js";
-import { runOnboard } from "./onboard.js";
-import { runLogin } from "./login.js";
-import { runLogout } from "./logout.js";
-import { runStart } from "./start.js";
-import { runSync } from "./sync.js";
-import { runDoctorAfterSync } from "./sync-doctor.js";
-import { runAnalyze } from "./analyze.js";
-import { runBackfillCommand } from "./backfill.js";
-import { runDoctor } from "./doctor.js";
-import { runStatus } from "./status.js";
-import { runSessions } from "./sessions.js";
-import { runJarvis } from "./jarvis.js";
-import { runModels } from "./models.js";
-import { runSlack } from "./slack.js";
-import { runModel, runSettings } from "./settings.js";
-import { runTeam } from "./team.js";
-import { runWorkbook } from "./workbook.js";
-import { runBrief } from "./brief.js";
-import { runBriefEdit } from "./brief-edit.js";
-import { runBriefRewrite } from "./brief-rewrite.js";
-import { runBriefDone } from "./brief-done.js";
-import { runCorrect } from "./correct.js";
-import { runNotes } from "./notes.js";
-import { runServe } from "./serve.js";
-import { runAutostart } from "./autostart-command.js";
-import { runAgentRules } from "./agent-rules-command.js";
-import { runMemoryLog } from "./memory-log.js";
-import { runMemoryInstall } from "./memory-install.js";
-import { runMemoryStore, runMemoryVerbList } from "./memory-store.js";
-import { runClean } from "./clean.js";
-import { runSourcesCheck } from "./sources-check.js";
-import { runDocs } from "./docs.js";
-import { runMsg } from "./msg.js";
-import { runIssue } from "./issue.js";
-import { runCal } from "./cal.js";
-import { runMail } from "./mail.js";
-import { runProject } from "./project.js";
-import { runMilestone } from "./milestone.js";
-import { runGithub } from "./github.js";
-import { runSearch } from "./search.js";
-import { runCareers } from "./careers.js";
-import { runRename } from "./rename-scope.js";
-import { runSetup } from "./setup.js";
-import { runUsage } from "./usage.js";
-import { runSpeed } from "./speed.js";
-import { runLogs } from "./logs.js";
-import { runApprovals, runDrills } from "./approvals.js";
-import { runManager } from "./manager.js";
-import { runImage } from "./image.js";
-import { runBrain } from "./brain.js";
-import { runHits } from "./hits.js";
-import { runIntentions } from "./intentions.js";
-import { runWho } from "./who.js";
-import { runPeople } from "./people.js";
 import { parseLocalArgs } from "./local-args.js";
-// `./local.js` is the published entry point (the public CLI root, root.ts, doctor.ts, tests): a split must not move a name off it.
+// `./local.js` is the published entry point (the public CLI root, root.ts): it keeps the help registry names and loads each command module only when that command runs (BLI-23349).
 export { rootCommandNames, localCommandHelp, SURFACE_ALIASES, unknownCommandJson, unknownCommandLine, } from "./local-help.js";
-export { buildCollectorHeartbeat, collectionRootLabel, collectionRootLabels, sendCollectorHeartbeatBestEffort, } from "./heartbeat.js";
-export { classifySyncFailureRecords, classifySyncHealthError, redactedSyncErrorDetail, reportInstallEventsBestEffort, SYNC_ERROR_DETAIL_MAX_CHARS, } from "./install-receipts.js";
-export { assertCollectionRootPersisted } from "./collection-roots.js";
-export { runSelfUpdate, SelfUpdateError, } from "./install-update.js";
-import { runRoots } from "./roots.js";
 /** Commands that act on THIS machine; the rest talk to Tower. */
 const MACHINE_COMMAND_KINDS = [
     "roots",
@@ -101,7 +34,9 @@ const MACHINE_COMMAND_KINDS = [
 function isMachineCommand(command) {
     return MACHINE_COMMAND_KINDS.includes(command.kind);
 }
-export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorAfterSync }) {
+/** `sync` is the only caller of this hook; the module loads when it is first called, not at startup. */
+const lazyRunDoctorAfterSync = async (...args) => (await import("./sync-doctor.js")).runDoctorAfterSync(...args);
+export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorAfterSync: lazyRunDoctorAfterSync }) {
     argv = stripGlobalToggles(argv);
     if (isLocalHelpRequest(argv)) {
         writeLine(io.stdout, localCommandHelp(argv[0]));
@@ -131,7 +66,7 @@ export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorA
     try {
         // Not awaited, as it never was: a `cal` rejection bypasses the net below.
         if (command.kind === "cal")
-            return runCal(command, io);
+            return (await import("./cal.js")).runCal(command, io);
         if (isMachineCommand(command))
             return await runMachineCommand(command, io);
         return await runTowerCommand(command, io);
@@ -145,86 +80,86 @@ export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorA
 }
 async function runMachineCommand(command, io) {
     switch (command.kind) {
-        case "roots": return await runRoots(command, io);
-        case "install": return await runInstall(command, io);
-        case "onboard": return await runOnboard(command, io);
-        case "update": return await runUpdate(command, io);
+        case "roots": return await (await import("./roots.js")).runRoots(command, io);
+        case "install": return await (await import("./install-update.js")).runInstall(command, io);
+        case "onboard": return await (await import("./onboard.js")).runOnboard(command, io);
+        case "update": return await (await import("./install-update.js")).runUpdate(command, io);
         case "doctor":
-            return await runDoctor(command, io, {
-                reportInstallEvents: reportInstallEventsBestEffort,
-                selfUpdate: runSelfUpdate,
+            return await (await import("./doctor.js")).runDoctor(command, io, {
+                reportInstallEvents: (await import("./install-receipts.js")).reportInstallEventsBestEffort,
+                selfUpdate: (await import("./install-update.js")).runSelfUpdate,
                 runLogin: runDoctorLogin,
                 resolveAndSaveRoots: resolveAndSaveDoctorRoots,
             });
-        case "login": return await runLogin(command, io);
-        case "logout": return await runLogout(command, io);
-        case "start": return await runStart(command, io);
-        case "sync": return await runSync(command, io);
-        case "analyze": return await runAnalyze(command, io);
-        case "backfill": return await runBackfillCommand(command, io);
-        case "status": return await runStatus(command, io);
-        case "sessions": return await runSessions(command, io);
-        case "serve": return await runServe(command, io);
-        case "autostart": return await runAutostart(command, io);
-        case "agent-rules": return await runAgentRules(command, io);
-        case "memory-log": return await runMemoryLog(command, io);
+        case "login": return await (await import("./login.js")).runLogin(command, io);
+        case "logout": return await (await import("./logout.js")).runLogout(command, io);
+        case "start": return await (await import("./start.js")).runStart(command, io);
+        case "sync": return await (await import("./sync.js")).runSync(command, io);
+        case "analyze": return await (await import("./analyze.js")).runAnalyze(command, io);
+        case "backfill": return await (await import("./backfill.js")).runBackfillCommand(command, io);
+        case "status": return await (await import("./status.js")).runStatus(command, io);
+        case "sessions": return await (await import("./sessions.js")).runSessions(command, io);
+        case "serve": return await (await import("./serve.js")).runServe(command, io);
+        case "autostart": return await (await import("./autostart-command.js")).runAutostart(command, io);
+        case "agent-rules": return await (await import("./agent-rules-command.js")).runAgentRules(command, io);
+        case "memory-log": return await (await import("./memory-log.js")).runMemoryLog(command, io);
         case "memory":
             // BLI-4047: a bare `cockpit memory` says what the noun does. It used
             // to install; `install` is still one word away and every unattended
             // caller asks for it by name in code.
             if (command.action === "help")
-                return runMemoryVerbList(io, command.json);
-            return await runMemoryInstall(command, io);
-        case "memory-store": return await runMemoryStore(command, io);
-        case "clean": return await runClean(command, io);
-        case "sources": return await runSourcesCheck(command, io);
-        case "release": return await runRelease(command, io);
+                return (await import("./memory-store.js")).runMemoryVerbList(io, command.json);
+            return await (await import("./memory-install.js")).runMemoryInstall(command, io);
+        case "memory-store": return await (await import("./memory-store.js")).runMemoryStore(command, io);
+        case "clean": return await (await import("./clean.js")).runClean(command, io);
+        case "sources": return await (await import("./sources-check.js")).runSourcesCheck(command, io);
+        case "release": return await (await import("./install-update.js")).runRelease(command, io);
     }
 }
 async function runTowerCommand(command, io) {
     switch (command.kind) {
-        case "jarvis": return await runJarvis(command, io);
-        case "model": return await runModel(command, io);
-        case "models": return await runModels(command, io);
+        case "jarvis": return await (await import("./jarvis.js")).runJarvis(command, io);
+        case "model": return await (await import("./settings.js")).runModel(command, io);
+        case "models": return await (await import("./models.js")).runModels(command, io);
         case "scout":
         case "ci":
         case "delivery":
         case "ops":
-            return await runOpsCommand(command, io);
-        case "slack": return await runSlack(command, io);
-        case "settings": return await runSettings(command, io);
-        case "team": return await runTeam(command, io);
-        case "workbook": return await runWorkbook(command, io);
+            return await (await import("./local-run-ops.js")).runOpsCommand(command, io);
+        case "slack": return await (await import("./slack.js")).runSlack(command, io);
+        case "settings": return await (await import("./settings.js")).runSettings(command, io);
+        case "team": return await (await import("./team.js")).runTeam(command, io);
+        case "workbook": return await (await import("./workbook.js")).runWorkbook(command, io);
         case "brief": return await runBriefVerb(command, io);
-        case "correct": return await runCorrect(command, io);
-        case "notes": return await runNotes(command, io);
-        case "glossary": return await runGlossary(command, io);
-        case "sessions-forget": return await runSessionsForget(command, io);
-        case "spend": return await runSpend(command, io);
-        case "push": return await runPush(command, io);
-        case "docs": return await runDocs(command, io);
-        case "msg": return await runMsg(command, io);
-        case "issue": return await runIssue(command, io);
-        case "mail": return await runMail(command, io);
-        case "project": return await runProject(command, io);
-        case "milestone": return await runMilestone(command, io);
-        case "search": return await runSearch(command, io);
-        case "github": return await runGithub(command, io);
-        case "careers": return await runCareers(command, io);
-        case "rename": return await runRename(command, io);
-        case "setup": return await runSetup(command, io);
-        case "usage": return await runUsage(command, io);
-        case "speed": return await runSpeed(command, io);
-        case "logs": return await runLogs(command, io);
-        case "brain": return await runBrain(command, io);
-        case "hits": return await runHits(command, io);
-        case "intentions": return await runIntentions(command, io);
-        case "who": return await runWho(command, io);
-        case "people": return await runPeople(command, io);
-        case "approvals": return await runApprovals(command, io);
-        case "drills": return await runDrills(command, io);
-        case "manager": return await runManager(command, io);
-        case "image": return await runImage(command, io);
+        case "correct": return await (await import("./correct.js")).runCorrect(command, io);
+        case "notes": return await (await import("./notes.js")).runNotes(command, io);
+        case "glossary": return await (await import("./glossary.js")).runGlossary(command, io);
+        case "sessions-forget": return await (await import("./sessions-forget.js")).runSessionsForget(command, io);
+        case "spend": return await (await import("./spend.js")).runSpend(command, io);
+        case "push": return await (await import("./push.js")).runPush(command, io);
+        case "docs": return await (await import("./docs.js")).runDocs(command, io);
+        case "msg": return await (await import("./msg.js")).runMsg(command, io);
+        case "issue": return await (await import("./issue.js")).runIssue(command, io);
+        case "mail": return await (await import("./mail.js")).runMail(command, io);
+        case "project": return await (await import("./project.js")).runProject(command, io);
+        case "milestone": return await (await import("./milestone.js")).runMilestone(command, io);
+        case "search": return await (await import("./search.js")).runSearch(command, io);
+        case "github": return await (await import("./github.js")).runGithub(command, io);
+        case "careers": return await (await import("./careers.js")).runCareers(command, io);
+        case "rename": return await (await import("./rename-scope.js")).runRename(command, io);
+        case "setup": return await (await import("./setup.js")).runSetup(command, io);
+        case "usage": return await (await import("./usage.js")).runUsage(command, io);
+        case "speed": return await (await import("./speed.js")).runSpeed(command, io);
+        case "logs": return await (await import("./logs.js")).runLogs(command, io);
+        case "brain": return await (await import("./brain.js")).runBrain(command, io);
+        case "hits": return await (await import("./hits.js")).runHits(command, io);
+        case "intentions": return await (await import("./intentions.js")).runIntentions(command, io);
+        case "who": return await (await import("./who.js")).runWho(command, io);
+        case "people": return await (await import("./people.js")).runPeople(command, io);
+        case "approvals": return await (await import("./approvals.js")).runApprovals(command, io);
+        case "drills": return await (await import("./approvals.js")).runDrills(command, io);
+        case "manager": return await (await import("./manager.js")).runManager(command, io);
+        case "image": return await (await import("./image.js")).runImage(command, io);
     }
 }
 /**
@@ -235,17 +170,17 @@ async function runTowerCommand(command, io) {
  */
 async function runBriefVerb(command, io) {
     if (command.action === "edit")
-        return await runBriefEdit(command, io);
+        return await (await import("./brief-edit.js")).runBriefEdit(command, io);
     if (command.action === "rewrite")
-        return await runBriefRewrite(command, io);
+        return await (await import("./brief-rewrite.js")).runBriefRewrite(command, io);
     // BLI-3605: the board's done checkbox, at a terminal.
     if (command.action === "done" || command.action === "undone") {
-        return await runBriefDone(command, io);
+        return await (await import("./brief-done.js")).runBriefDone(command, io);
     }
-    return await runBrief(command, io);
+    return await (await import("./brief.js")).runBrief(command, io);
 }
 async function runDoctorLogin(command, io) {
-    return runLogin({
+    return (await import("./login.js")).runLogin({
         kind: "login",
         homeDir: command.homeDir,
         dashboardUrl: command.dashboardUrl,
@@ -265,8 +200,9 @@ async function resolveAndSaveDoctorRoots(command, io) {
         // headless equivalent for scripted and scheduled runs.
         allowHomeRoot: command.allowHomeRoot,
     };
-    const resolution = await resolveOnboardingRootsForCommand(rootCommand, io);
-    await persistOnboardingRootConfig(rootCommand, resolution);
+    const roots = await import("./collection-roots.js");
+    const resolution = await roots.resolveOnboardingRootsForCommand(rootCommand, io);
+    await roots.persistOnboardingRootConfig(rootCommand, resolution);
     if (!command.json) {
         writeLine(io.stdout, `Saved collection roots: ${resolution.collectionRoots.join(", ")}`);
     }

package/dist/commands/memory-install-report.js

@@ -3,7 +3,7 @@
  * one outcome, and rendering that outcome for a log line or a terminal.
  * Sibling of `memory-install.ts`, named in its header.
  */
-import { memoryInstallGaps } from "@bli-cockpit/telemetry-core";
+import { CODEX_HOOKS_TRUST_GUIDE_URL, memoryInstallGaps } from "@bli-cockpit/telemetry-core";
 import { memoryDaemonLine } from "./memory-daemon-probe.js";
 import { memoryReceiptLine } from "./memory-install-receipt.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
@@ -93,7 +93,8 @@ export function memoryOutcomeLines(outcome) {
     // here in words rather than left as a status word they have to look up.
     if (outcome.receipt.codex.hooks === "needs_trust") {
         lines.push("  Codex will NOT run these hooks until you trust them: open Codex in any folder, " +
-            "run /hooks, and trust the three bli-memory entries. One time, per machine.");
+            "run /hooks, and trust every bli-memory entry. One time, per machine. " +
+            `Step by step, with pictures: ${CODEX_HOOKS_TRUST_GUIDE_URL}`);
     }
     if (outcome.receipt.codex.hooks === "unsupported") {
         lines.push("  Codex hooks are turned off in your ~/.codex/config.toml ([features] hooks = false), " +

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.273");
+    writeLine(io?.stdout ?? process.stdout, "0.2.275");
     return 0;
   }
 

package/dist/commands/setup-receipt-lines.js

@@ -9,7 +9,7 @@
  * refusal that does not say what to do next is half a message. Every gap here
  * gets ONE command or ONE click, never a paragraph and never "see the docs".
  */
-import { setupPieceMark, setupReceiptLine, setupReceiptPieces, } from "@bli-cockpit/telemetry-core";
+import { CODEX_HOOKS_TRUST_GUIDE_URL, setupPieceMark, setupReceiptLine, setupReceiptPieces, } from "@bli-cockpit/telemetry-core";
 /** Cached host facts are old after the same seven-day window as their readers. */
 const OLD_READING_MS = 7 * 24 * 60 * 60 * 1000;
 /** The one fix for each piece, by key. Present for every key the block prints. */
@@ -45,7 +45,7 @@ const UNSUPPORTED_FIX = "Switched off in your own config; nothing to do.";
  * and waiting to be trusted are finished by a PERSON, in the Codex UI, and no
  * command we could print would do it.
  */
-const NEEDS_TRUST_FIX = "Open Codex and press `/hooks` to trust them (once, ~15s).";
+const NEEDS_TRUST_FIX = `Open Codex and press \`/hooks\` to trust them (once, ~15s). Step by step: ${CODEX_HOOKS_TRUST_GUIDE_URL}`;
 /**
  * The block a terminal prints: the one line, then one fix per gap, then
  * nothing. A fully connected machine gets one line and no advice — a receipt

package/dist/image-byte-scan.js

@@ -1,185 +1,2 @@
-/**
- * Find the embedded images of one transcript line without ever building the base64 as a JS string
- * (BLI-23317, stage D).
- *
- * `findEmbeddedImages` (telemetry-core/transcript-images.ts) is the RULE and stays the test oracle: it
- * feeds `evidenceRulesFingerprint`, so its regex and its results do not change. This module is the same
- * rule run on the line's BYTES, which is what the streamed prepare path calls:
- *
- *  - a whole-string payload: a base64 run that starts right after a `"`, starts with one of the four
- *    image starts (`iVBOR`, `/9j/`, `R0lGO`, `UklGR`), is at least 495 characters past that start
- *    (so 499 for a JPEG, 500 for the others, exactly as the regex counts) and is closed by `"` or `\"`;
- *  - a data URL: `data:image/<[a-z0-9.+-]+>;base64,` and then a run of at least 500 characters, no closing
- *    quote needed. The whole URL is the replaced range.
- *
- * A match is accepted only when the decoded bytes sniff as PNG, JPEG, GIF or WebP; either way the scan
- * resumes after the run, as `matchAll` does. All matched characters are ASCII, so a byte offset here is
- * the character offset there on ASCII text, and the replaced ranges are the same everywhere else.
- *
- * Decoding is incremental: the run is decoded in blocks of 48 Ki characters (a multiple of 4, so each
- * block decodes on its own) straight into a sha256, with the first block sniffed. At no point does a
- * string of the run, or a Buffer of the whole decoded image, exist. The one exception is a run whose
- * `=` characters are not plain trailing padding: Node's decoder rules for those are version specific,
- * so such a run takes the whole-run decode the oracle takes (never seen in real transcripts).
- *
- * `byteSize` is the length Node's `Buffer.from(run, "base64")` gives, because every block, including a
- * short last one, is decoded by that very function.
- */
-import { createHash } from "node:crypto";
-import { IMAGE_MIN_BASE64_CHARS, sniffImageMediaType, } from "@bli-cockpit/telemetry-core";
-const QUOTE = 0x22;
-const BACKSLASH = 0x5c;
-const EQUALS = 0x3d;
-/** Characters per decoded block. A multiple of 4: each block is a whole number of base64 quanta. */
-const BLOCK_CHARS = 48 * 1024;
-const BASE64 = new Uint8Array(256);
-for (const range of ["AZ", "az", "09"]) {
-    for (let code = range.charCodeAt(0); code <= range.charCodeAt(1); code += 1)
-        BASE64[code] = 1;
-}
-for (const char of "+/=")
-    BASE64[char.charCodeAt(0)] = 1;
-const DATA_URL_LOWER = new Uint8Array(256);
-for (const range of ["az", "09"]) {
-    for (let code = range.charCodeAt(0); code <= range.charCodeAt(1); code += 1)
-        DATA_URL_LOWER[code] = 1;
-}
-for (const char of ".+-")
-    DATA_URL_LOWER[char.charCodeAt(0)] = 1;
-/** The four image starts of a whole-string payload, and the data URL anchor. */
-const STARTS = ["iVBOR", "/9j/", "R0lGO", "UklGR"].map((text) => Buffer.from(text, "latin1"));
-const DATA_URL = Buffer.from("data:image/", "latin1");
-const BASE64_TAG = Buffer.from(";base64,", "latin1");
-/** Is there any chance this line holds an image? Same anchors as the string check, on bytes. */
-export function bytesMayHoldImage(line) {
-    return line.includes(DATA_URL) || STARTS.some((start) => line.includes(start));
-}
-/** The end (exclusive) of the base64-alphabet run that starts at `from`. */
-function runEnd(line, from) {
-    let at = from;
-    while (at < line.length && BASE64[line[at]] === 1)
-        at += 1;
-    return at;
-}
-/**
- * sha256, size and type of the image `line[from, to)` encodes, or null when it is not a PNG, JPEG, GIF
- * or WebP. Blocks of the run are decoded one at a time.
- */
-export function digestBase64Run(line, from, to) {
-    const length = to - from;
-    const inRun = line.subarray(from, to).indexOf(EQUALS);
-    const firstPad = inRun === -1 ? -1 : from + inRun;
-    const padCount = firstPad === -1 ? 0 : to - firstPad;
-    const plainPadding = padCount === 0
-        || (padCount <= 2 && length % 4 === 0 && onlyPaddingFrom(line, firstPad, to));
-    if (!plainPadding) {
-        const bytes = Buffer.from(line.toString("latin1", from, to), "base64");
-        const mediaType = sniffImageMediaType(bytes);
-        return mediaType ? { sha256: createHash("sha256").update(bytes).digest("hex"), mediaType, byteSize: bytes.byteLength } : null;
-    }
-    const hash = createHash("sha256");
-    let byteSize = 0;
-    let mediaType = null;
-    for (let at = from; at < to; at += BLOCK_CHARS) {
-        const block = Buffer.from(line.toString("latin1", at, Math.min(to, at + BLOCK_CHARS)), "base64");
-        if (at === from) {
-            mediaType = sniffImageMediaType(block);
-            if (!mediaType)
-                return null;
-        }
-        hash.update(block);
-        byteSize += block.byteLength;
-    }
-    return mediaType ? { sha256: hash.digest("hex"), mediaType, byteSize } : null;
-}
-/** True when everything from `firstPad` to `to` is `=` (padding at the very end of the run, nothing after it). */
-function onlyPaddingFrom(line, firstPad, to) {
-    for (let at = firstPad; at < to; at += 1)
-        if (line[at] !== EQUALS)
-            return false;
-    return true;
-}
-/** The sha256 of an image's decoded bytes, or null when `line[from, to)` does not decode to an image (used to re-check a payload before it is sent). */
-export function sha256OfBase64Run(line, from, to) {
-    return digestBase64Run(line, from, to)?.sha256 ?? null;
-}
-/**
- * The next index at or after `from` where `anchor` sits right after a `"`, or -1. `current` is the answer
- * of the last call: -2 not looked for yet, -1 none left, else still good while it is at or after `from`.
- */
-function nextQuotedStart(line, anchor, from, current) {
-    if (current === -1 || current >= from)
-        return current;
-    let at = line.indexOf(anchor, from);
-    while (at !== -1 && !(at > 0 && line[at - 1] === QUOTE))
-        at = line.indexOf(anchor, at + 1);
-    return at;
-}
-/**
- * Every embedded image in `line` (one physical line, no `\n` inside), in order, with byte offsets inside
- * the line. Equal to `findEmbeddedImages` on the decoded text in everything but the unit of the offsets.
- */
-export function scanImagesInLine(line) {
-    const found = [];
-    if (line.length < IMAGE_MIN_BASE64_CHARS - 1)
-        return found;
-    // For each whole-string start, the next quoted occurrence (-2: not looked for yet, -1: none left).
-    const nextStart = STARTS.map(() => -2);
-    let nextData = -2;
-    let position = 0;
-    while (position < line.length) {
-        let candidate = -1;
-        let kind = -1;
-        for (let index = 0; index < STARTS.length; index += 1) {
-            nextStart[index] = nextQuotedStart(line, STARTS[index], position, nextStart[index]);
-            const at = nextStart[index];
-            if (at !== -1 && (candidate === -1 || at < candidate)) {
-                candidate = at;
-                kind = index;
-            }
-        }
-        if (nextData !== -1) {
-            nextData = nextData >= position ? nextData : line.indexOf(DATA_URL, position);
-            if (nextData !== -1 && (candidate === -1 || nextData < candidate)) {
-                candidate = nextData;
-                kind = STARTS.length;
-            }
-        }
-        if (candidate === -1)
-            break;
-        if (kind < STARTS.length) {
-            const startLength = STARTS[kind].length;
-            const end = runEnd(line, candidate);
-            const closed = end < line.length && (line[end] === QUOTE || (line[end] === BACKSLASH && line[end + 1] === QUOTE));
-            if (!closed || end - candidate < startLength + (IMAGE_MIN_BASE64_CHARS - 5)) {
-                position = candidate + 1;
-                continue;
-            }
-            position = end;
-            const digest = digestBase64Run(line, candidate, end);
-            if (digest)
-                found.push({ replaceStart: candidate, replaceEnd: end, base64Start: candidate, base64End: end, ...digest });
-            continue;
-        }
-        // data:image/<type>;base64,<run of at least 500>
-        let cursor = candidate + DATA_URL.length;
-        const typeStart = cursor;
-        while (cursor < line.length && DATA_URL_LOWER[line[cursor]] === 1)
-            cursor += 1;
-        if (cursor === typeStart || line.compare(BASE64_TAG, 0, BASE64_TAG.length, cursor, cursor + BASE64_TAG.length) !== 0) {
-            position = candidate + 1;
-            continue;
-        }
-        const base64Start = cursor + BASE64_TAG.length;
-        const end = runEnd(line, base64Start);
-        if (end - base64Start < IMAGE_MIN_BASE64_CHARS) {
-            position = candidate + 1;
-            continue;
-        }
-        position = end;
-        const digest = digestBase64Run(line, base64Start, end);
-        if (digest)
-            found.push({ replaceStart: candidate, replaceEnd: end, base64Start, base64End: end, ...digest });
-    }
-    return found;
-}
+/** The byte scanner lives in telemetry-core (BLI-23349) so the memory hook shares it; this keeps the collector's import path. */
+export { bytesMayHoldImage, digestBase64Run, scanImagesInLine, sha256OfBase64Run, } from "@bli-cockpit/telemetry-core";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.273",
+  "version": "0.2.275",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.82",
-    "@bli-cockpit/mcp": "0.1.166",
-    "@bli-cockpit/telemetry-core": "0.1.89",
+    "@bli-cockpit/memory-mcp": "0.1.84",
+    "@bli-cockpit/mcp": "0.1.168",
+    "@bli-cockpit/telemetry-core": "0.1.91",
     "unpdf": "1.8.1"
   },
   "repository": {