@bli-cockpit/cli 0.2.276 → 0.2.278

package/dist/adapters/raw-evidence-transcript-body.js

@@ -10,8 +10,9 @@
  * The order stays image replacement, slim, redact.
  */
 import { isUtf8 } from "node:buffer";
-import { mightHoldEmbeddedImages } from "@bli-cockpit/telemetry-core";
+import { mightHoldEmbeddedImages, modeDropsImages, modeStoresImages } from "@bli-cockpit/telemetry-core";
 import { describeError } from "../health-detail.js";
+import { makeCaptureProvenance } from "./common.js";
 import { roomToStreamToStaging } from "./raw-evidence-budget-admission.js";
 import { readTranscriptWhole, streamTranscriptBody, volatilityOf } from "./raw-evidence-transcript-stream.js";
 /** Which agent's transcript rules apply to this evidence kind; null for anything the image step does not know. */
@@ -41,6 +42,10 @@ export function holdDecodedText(source) {
 export async function prepareTranscriptBody(collection, file) {
     const session = collection.budget.images;
     const agent = agentOfKind(file.kind);
+    // BLI-23329: `store_and_drop` talks to the upload doors for the images of this transcript, as this sync.
+    const provenance = session && modeStoresImages(session.mode) && collection.context
+        ? makeCaptureProvenance(collection.context, "collector_runtime")
+        : undefined;
     if (file.source.stream) {
         // BLI-23317 stage D: the slimmed bytes are written to this pack's `files` directory as they are made,
         // but only when the budget and the disk gate would admit a file of the source's size: never a byte ahead of the gate.
@@ -48,7 +53,7 @@ export async function prepareTranscriptBody(collection, file) {
         if (refusal) {
             console.error("[raw-evidence] streamed output is not written ahead of the staging gate", JSON.stringify({ reason: "stream_to_staging_declined", gate: refusal, kind: file.kind, input_bytes: file.source.stream.inputBytes ?? null }));
         }
-        const streamed = await streamTranscriptBody(session, agent, { ...file.source.stream, sessionId: file.sessionId, kind: file.kind, stageDir: refusal ? undefined : collection.filesDir });
+        const streamed = await streamTranscriptBody(session, agent, { ...file.source.stream, sessionId: file.sessionId, kind: file.kind, stageDir: refusal ? undefined : collection.filesDir, ...(provenance ? { provenance } : {}) });
         if (streamed) {
             file.source.readBytes = streamed.readBytes;
             return { held: streamed.held, volatile: streamed.volatile, pendingImages: streamed.pendingImages };
@@ -60,12 +65,12 @@ export async function prepareTranscriptBody(collection, file) {
     if (!session || !agent)
         return untouched(false, null);
     // Drop mode slims every transcript, image-bearing or not; keep mode only describes the ones that can hold an image.
-    if (session.mode !== "describe_and_drop" && !mightHoldEmbeddedImages(file.source.bytes))
+    if (!modeDropsImages(session.mode) && !mightHoldEmbeddedImages(file.source.bytes))
         return untouched(false, null);
     let held;
     try {
         held = holdDecodedText(file.source);
-        const prepared = await session.prepareTranscript({ text: held.text, source: agent, sessionId: file.sessionId });
+        const prepared = await session.prepareTranscript({ text: held.text, source: agent, sessionId: file.sessionId, ...(provenance ? { provenance } : {}) });
         // BLI-3936: "volatile" = the next tick could build different bytes, or do image work, from
         // this very file: an image still without a stored description (keep mode never replaces, so
         // any image counts) or a slim step that failed and should be retried.

package/dist/adapters/raw-evidence-transcript-stream.js

@@ -12,6 +12,7 @@
  *    read gives (`file_read_failed`, `file_too_large`), never a shorter file.
  */
 import fs from "node:fs/promises";
+import { modeDropsImages } from "@bli-cockpit/telemetry-core";
 import { describeError } from "../health-detail.js";
 import { TranscriptNotStreamable, TranscriptReadError, TranscriptTooLargeError, } from "./transcript-text-stream.js";
 const TAG = "[raw-evidence]";
@@ -22,10 +23,10 @@ const TAG = "[raw-evidence]";
  * stored description means the bytes change only when one of them gains one, so the memo may keep the entry.
  */
 export function volatilityOf(mode, prepared) {
-    const imagesPending = mode === "describe_and_drop"
+    const imagesPending = modeDropsImages(mode)
         ? prepared.imageCount > prepared.replacedCount
         : prepared.imageCount > 0;
-    const slimFailed = mode === "describe_and_drop" && prepared.slim === null;
+    const slimFailed = modeDropsImages(mode) && prepared.slim === null;
     const volatile = imagesPending || slimFailed;
     return { volatile, pendingImages: volatile && !slimFailed ? prepared.pendingImages : null };
 }
@@ -35,7 +36,7 @@ export async function streamTranscriptBody(session, agent, file) {
         return null;
     }
     try {
-        const prepared = await session.prepareTranscriptFile({ filePath: file.filePath, source: agent, sessionId: file.sessionId, maxFileBytes: file.maxFileBytes, stageDir: file.stageDir, omitText: file.stageDir !== undefined });
+        const prepared = await session.prepareTranscriptFile({ filePath: file.filePath, source: agent, sessionId: file.sessionId, maxFileBytes: file.maxFileBytes, stageDir: file.stageDir, omitText: file.stageDir !== undefined, ...(file.provenance ? { provenance: file.provenance } : {}) });
         const { volatile, pendingImages } = volatilityOf(session.mode, prepared);
         console.error(TAG + " transcript streamed through image swap and slim", JSON.stringify({ kind: file.kind, byte_size: prepared.readBytes, changed: prepared.changed, images: prepared.imageCount, volatile, staged_bytes: prepared.staged?.byteLength ?? null }));
         // BLI-23344: with a spool the text is not read back; the sanitizer reads the spool line by line.

package/dist/adapters/raw-evidence-volatile-reuse.js

@@ -10,6 +10,16 @@ export function trustVolatileEntry(collection, memo, known, kind, sourceKey, byt
     const pending = known.pending_images ?? [];
     if (!session)
         return false;
+    // BLI-23329: in store mode the bytes change only when Tower confirms an image, never when a description arrives, so
+    // the gate asks about STORAGE progress: rebuild while the store could still take one of them (a closed session whose
+    // store failed is stored on the next tick with room), reuse once the budget is spent or every one is backing off.
+    if (session.mode === "store_and_drop") {
+        if (session.hasStoreRoom(pending)) {
+            logVolatileReuse(kind, sourceKey, known.content_hash, "rebuilt_store_has_room");
+            return false;
+        }
+        return true;
+    }
     if (pending.some((sha256) => session.isDescribed(sha256))) {
         memo.count("rebuilt_image_now_described", bytes);
         logVolatileReuse(kind, sourceKey, known.content_hash, "rebuilt_image_now_described");

package/dist/commands/image.js

@@ -12,10 +12,10 @@
  * large or not an image is refused here, before anything is sent.
  */
 import { createHash } from "node:crypto";
-import { readFile, stat } from "node:fs/promises";
+import { readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { IMAGE_DESCRIBE_MAX_BYTES, formatImageMarker, imageSizeLabel, sniffImageMediaType, } from "@bli-cockpit/telemetry-core";
-import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { askAgentDoor, emitAgentDoor, failAgentDoor, fetchAgentDoorFile, openAgentDoor } from "./agent-door.js";
 import { writeLine } from "./cli-io.js";
 const TAG = "[image cli]";
 const READ_DEADLINE_MS = 30_000;
@@ -94,7 +94,41 @@ async function describeImage(command, door, request) {
     writeLine(out, `Transcript marker: ${formatImageMarker({ sha256: request.sha256, mediaType: request.media_type, byteSize: request.byte_size })}`);
     return 0;
 }
+/**
+ * `show --bytes <file>` (BLI-23329): the stored image itself, written to a NEW file. The door decodes the evidence
+ * envelope and hashes the result; this side hashes again before a byte reaches the disk, so a body that is not the
+ * picture its name promises is never written. An existing file is never overwritten.
+ */
+async function saveImageBytes(command, door, file) {
+    const sha256 = command.sha256 ?? "";
+    const query = new URLSearchParams({ sha256, bytes: "1" });
+    const answer = await fetchAgentDoorFile(door, { path: `${DOOR_PATH}?${query.toString()}`, label: "image show bytes", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const actual = createHash("sha256").update(answer.bytes).digest("hex");
+    if (actual !== sha256) {
+        return failAgentDoor(door, TAG, "bytes_do_not_match_sha256", "Tower sent bytes whose sha256 is not the one you asked for, so nothing was written.");
+    }
+    const mediaType = sniffImageMediaType(answer.bytes);
+    const target = path.resolve(file);
+    try {
+        await writeFile(target, answer.bytes, { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        const code = error?.code;
+        const reason = code === "EEXIST" ? "output_exists" : "output_unwritable";
+        return failAgentDoor(door, TAG, reason, code === "EEXIST" ? `${file} already exists; choose a new file name. Nothing was written.` : `Could not write ${file}. Nothing was written.`);
+    }
+    writeLine(door.io.stderr, `${TAG} bytes saved ${JSON.stringify({ sha256: sha256.slice(0, 16), byte_size: answer.bytes.length, media_type: mediaType ?? "unknown", verified: true })}`);
+    const result = { ok: true, sha256, media_type: mediaType, byte_size: answer.bytes.length, path: target, verified: true };
+    if (door.json)
+        return emitAgentDoor(door, result);
+    writeLine(door.io.stdout, `Wrote ${imageSizeLabel(answer.bytes.length)} ${mediaType?.replace("image/", "") ?? "image"} to ${target}; its sha256 matches ${sha256.slice(0, 16)}….`);
+    return 0;
+}
 async function showImage(command, door) {
+    if (command.bytesFile)
+        return saveImageBytes(command, door, command.bytesFile);
     const query = new URLSearchParams({ sha256: command.sha256 ?? "" });
     const answer = await askAgentDoor(door, { path: `${DOOR_PATH}?${query.toString()}`, method: "GET", label: "image show", timeoutMs: READ_DEADLINE_MS });
     if (!answer.ok)

package/dist/commands/local-args-tower-image.js

@@ -3,6 +3,7 @@
  *
  *   cockpit image describe <file> [--session <id>] [--json]
  *   cockpit image show <sha256-or-prefix> [--json]
+ *   cockpit image show <sha256> --bytes <file> [--json]
  *
  * Tower swaps the base64 pictures inside collected transcripts for a short written description.
  * `describe` sends one image file through that same door by hand; `show` looks a description up by
@@ -14,8 +15,8 @@ const ONE_VERB = "image takes one verb: describe or show. Example: `cockpit imag
 const SESSION_ID_MAX_CHARS = 200;
 export function parseImageArgs(args) {
     const values = parseNamedArgs(args, {
-        allowedFlags: ["--session", "--home", "--dashboard-url", "--json"],
-        valueFlags: ["--session", "--home", "--dashboard-url"],
+        allowedFlags: ["--session", "--bytes", "--home", "--dashboard-url", "--json"],
+        valueFlags: ["--session", "--bytes", "--home", "--dashboard-url"],
     });
     const [verb, ...rest] = values.positionals;
     if (verb !== "describe" && verb !== "show")
@@ -28,6 +29,9 @@ export function parseImageArgs(args) {
         throw new Error("--session does not belong to `cockpit image show`.");
     if (session !== undefined && session.length > SESSION_ID_MAX_CHARS)
         throw new Error(`--session is at most ${SESSION_ID_MAX_CHARS} characters.`);
+    const bytesFile = optionalNonEmpty(values.flags.get("--bytes"));
+    if (bytesFile !== undefined && verb !== "show")
+        throw new Error("--bytes belongs to `cockpit image show`.");
     const common = {
         kind: "image",
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
@@ -36,7 +40,11 @@ export function parseImageArgs(args) {
     };
     if (verb === "describe")
         return { ...common, action: "describe", file: rest[0], ...(session ? { session } : {}) };
-    return { ...common, action: "show", sha256: readHashQuery(rest[0]) };
+    const sha256 = readHashQuery(rest[0]);
+    if (bytesFile !== undefined && sha256.length !== 64) {
+        throw new Error("--bytes needs the whole sha256 (64 hex characters): a 16-character marker prefix names a description, not one stored image. `cockpit image show <prefix>` first, then the full hash it prints.");
+    }
+    return { ...common, action: "show", sha256, ...(bytesFile ? { bytesFile } : {}) };
 }
 /** A marker is pasted whole as often as not (`sha256:ab12…`), so accept that spelling and trim it. */
 function readHashQuery(typed) {

package/dist/commands/local-help-commands-tower-ops.js

@@ -298,10 +298,12 @@ export const TOWER_OPS_COMMAND_HELP = [
         [
             "Usage: cockpit image describe <file> [--session <id>] [--dashboard-url <url>] [--json]",
             "       cockpit image show <sha256-or-prefix> [--dashboard-url <url>] [--json]",
+            "       cockpit image show <sha256> --bytes <file> [--dashboard-url <url>] [--json]",
             "",
             "Tower swaps the base64 pictures inside collected transcripts for a short written description kept against the image's sha256.",
             "  describe   send one PNG, JPEG, GIF or WebP file (up to 3 MB) to the describe door; prints the description and the marker a transcript would carry",
             "  show       look a stored description up by its sha256, or the first 12 to 64 characters of it (a marker carries 16)",
+            "  show --bytes <file>   write the stored IMAGE to a new file (needs the whole 64-character sha256). Tower keeps the image itself only for machines on the store_and_drop switch; the bytes are decoded, checked against the sha256 and refused if they differ. An existing file is never overwritten.",
             "A file that is too large or not an image is refused here by name, before anything is sent. An image Tower already described answers from storage.",
             "--json writes the door's body to stdout and nothing else; a refusal is { ok: false, error, detail } and exits 1.",
             "The bli-tower MCP server has the twins: image_describe, image_show.",

package/dist/commands/notes-audio-direct.js

@@ -12,10 +12,19 @@
  * Step 2 goes to the storage host with the signed URL ONLY: the device token is
  * sent to Tower's own routes in steps 1 and 3 and never to anyone else.
  *
+ * A laptop recording (`recording`, from `cockpit notes record stop`, BLI-23470)
+ * also names its session to step 3, so Tower answers a repeat with the note it
+ * already made, and keeps the object key Tower issued in the session's
+ * `upload.json` before the PUT. The next try after a failed step 3 (a timeout
+ * after the server saved, a 5xx) asks step 3 again with that key and sends no
+ * byte; only when Tower says the object is not there (`upload_not_found`) does
+ * it upload again.
+ *
  * Nothing here throws; every failure comes back as a closed reason label and
  * the sentence Tower (or this file) wrote for it.
  */
 import { createReadStream } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { writeLine } from "./cli-io.js";
 import { ask, TAG } from "./notes-door.js";
@@ -23,8 +32,61 @@ import { noteAudioMime } from "./notes-file.js";
 /** A signed upload URL lives two hours; the PUT must finish inside that. */
 const PUT_DEADLINE_MS = 2 * 60 * 60 * 1000;
 const SMALL_DEADLINE_MS = 60_000;
+/** The object key a previous try of this session was issued, or null (no file, unreadable, another session's). */
+async function keptObjectKey(recording) {
+    try {
+        const kept = JSON.parse(await readFile(recording.stateFile, "utf8"));
+        return kept.session === recording.session && typeof kept.objectKey === "string" && kept.objectKey ? kept.objectKey : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function keepObjectKey(door, recording, objectKey, size) {
+    try {
+        await writeFile(recording.stateFile, `${JSON.stringify({ session: recording.session, objectKey, bytes: size, issuedAt: new Date().toISOString() })}\n`, { mode: 0o600 });
+    }
+    catch (error) {
+        // Not fatal: without it a retry sends the file again, and Tower's session check still makes one note.
+        writeLine(door.io.stderr, `${TAG} upload key not kept ${JSON.stringify({ session: recording.session, reason: error.code ?? "write_failed" })}`);
+    }
+}
+async function confirmSaved(door, input, objectKey) {
+    const saved = await ask(door, {
+        path: "/api/notes/audio/saved", method: "POST", label: "notes audio saved", timeoutMs: SMALL_DEADLINE_MS,
+        body: {
+            object_key: objectKey, file_name: input.fileName,
+            ...(input.exclude ? { exclusions: input.exclude } : {}),
+            ...(input.folder ? { folder_path: input.folder } : {}),
+            ...(input.recording ? { recording_session: input.recording.session } : {}),
+        },
+    });
+    if (!saved.ok)
+        return { ok: false, reason: saved.reason, detail: saved.detail };
+    return { ok: true, body: saved.body };
+}
+/**
+ * A recording whose file already reached storage on an earlier try: ask `/saved` again with the kept key. Null means
+ * "upload it" (nothing kept, or Tower says the object is not there); any other answer is final for this try.
+ */
+async function resumeKept(door, input, recording) {
+    const kept = await keptObjectKey(recording);
+    if (!kept)
+        return null;
+    writeLine(door.io.stderr, `${TAG} upload resumed ${JSON.stringify({ session: recording.session, bytes: input.size, reason: "object_key_kept" })}`);
+    const saved = await confirmSaved(door, input, kept);
+    if (saved.ok || saved.reason !== "upload_not_found")
+        return saved;
+    writeLine(door.io.stderr, `${TAG} upload resumed ${JSON.stringify({ session: recording.session, reason: "kept_object_not_in_storage" })}`);
+    return null;
+}
 export async function uploadAudioDirect(door, input) {
     const started = Date.now();
+    if (input.recording) {
+        const resumed = await resumeKept(door, input, input.recording);
+        if (resumed)
+            return resumed;
+    }
     const mediaType = noteAudioMime(input.fileName) ?? "";
     const target = await ask(door, {
         path: "/api/notes/audio/target", method: "POST", label: "notes audio target", timeoutMs: SMALL_DEADLINE_MS,
@@ -37,6 +99,9 @@ export async function uploadAudioDirect(door, input) {
     if (!issued.objectKey || !url) {
         return { ok: false, reason: "target_unreadable", detail: "Tower answered without an upload link." };
     }
+    // Kept BEFORE the PUT: a crash after the bytes landed still lets the next try ask `/saved` instead of re-sending.
+    if (input.recording)
+        await keepObjectKey(door, input.recording, issued.objectKey, input.size);
     writeLine(door.io.stderr, `Uploading ${input.fileName} (${(input.size / 1_000_000).toFixed(1)} MB) straight to storage...`);
     let put;
     try {
@@ -63,15 +128,5 @@ export async function uploadAudioDirect(door, input) {
                 : `Storage refused the upload (HTTP ${put.status}). Nothing was saved; try again.` };
     }
     writeLine(door.io.stderr, `${TAG} storage put ok ${JSON.stringify({ bytes: input.size, elapsed_ms: Date.now() - started })}`);
-    const saved = await ask(door, {
-        path: "/api/notes/audio/saved", method: "POST", label: "notes audio saved", timeoutMs: SMALL_DEADLINE_MS,
-        body: {
-            object_key: issued.objectKey, file_name: input.fileName,
-            ...(input.exclude ? { exclusions: input.exclude } : {}),
-            ...(input.folder ? { folder_path: input.folder } : {}),
-        },
-    });
-    if (!saved.ok)
-        return { ok: false, reason: saved.reason, detail: saved.detail };
-    return { ok: true, body: saved.body };
+    return await confirmSaved(door, input, issued.objectKey);
 }

package/dist/commands/notes-record-capture.js

@@ -22,7 +22,9 @@
  * `MAX_RECORDING_SECONDS` of audio (8 hours, about 922 MB of 16 kHz mono
  * 16-bit, under the 1,000,000,000-byte storage limit), writing `ended.txt`
  * (`max_duration_reached`) and `done`. `status` then shows the session as
- * stopped and waiting for upload.
+ * stopped and waiting for upload. BLI-23470: the same stop fires after 8 hours
+ * on the wall clock, or once the file nears the storage limit
+ * (`max_size_reached`), whichever comes first (`RECORDER_STOP_RULE`).
  *
  * Everything in a session lives in one directory under the collector's state
  * dir. Nothing here touches the network.
@@ -40,8 +42,35 @@ export const MAX_RECORDING_SECONDS = 28_800;
 export const MAX_RECORDING_BYTES = MAX_RECORDING_SECONDS * RECORDING_SAMPLE_RATE * 2;
 /** The marker a recorder writes when it ended by itself, holding one closed reason label. */
 export const ENDED_MARKER = "ended.txt";
-/** The only reason a recorder ends by itself today. */
+/** Why a recorder ends by itself: the 8-hour cap (by audio or by the clock). */
 export const MAX_DURATION_REASON = "max_duration_reached";
+/** BLI-23470: or its file came near the storage limit first (only if the audio is not the format asked for). */
+export const MAX_SIZE_REASON = "max_size_reached";
+/** The storage bucket's per-object limit (`AUDIO_DIRECT_MAX_BYTES` on the server). */
+export const AUDIO_UPLOAD_LIMIT_BYTES = 1_000_000_000;
+/**
+ * BLI-23470: the macOS recorder stops once `audio.wav` reaches this, 1 MB under the limit: room for the WAV header
+ * and the chunks AVAudioRecorder adds, and for what it writes in one 0.2 s poll even at a far higher rate.
+ */
+export const RECORDER_STOP_BYTES = AUDIO_UPLOAD_LIMIT_BYTES - 1_000_000;
+/** BLI-23470: a recorder whose `audio.wav` has not changed for this long is not recording (both platforms write it continuously). */
+export const RECORDER_SILENT_AFTER_MS = 60_000;
+/** Asked again after this pause before calling it silent: a laptop just back from sleep writes again within a second. */
+export const RECORDER_SILENT_RECHECK_MS = 3_000;
+/** A session older than the 8-hour cap plus this has no recorder of ours behind it, whatever its pid says. */
+export const RECORDER_PAST_CAP_MARGIN_SECONDS = 15 * 60;
+/** BLI-23470: the session file keeping the object key Tower issued for its upload (see `notes-audio-direct.ts`). */
+export const UPLOAD_STATE_FILE = "upload.json";
+/**
+ * BLI-23470: when the macOS recorder stops by itself, as JavaScript it runs (and the tests run, with a fake clock).
+ * Whichever comes first: 8 hours of audio in the file, 8 hours on the wall clock since it started (the old tick
+ * count drifted), or the file nearing the storage limit. Returns the closed reason label, or null to keep recording.
+ */
+export const RECORDER_STOP_RULE = `function capReached(startedMs, nowMs, audioSeconds, fileBytes) {
+  if (audioSeconds >= ${MAX_RECORDING_SECONDS} || nowMs - startedMs >= ${MAX_RECORDING_SECONDS * 1000}) return '${MAX_DURATION_REASON}';
+  if (fileBytes >= ${RECORDER_STOP_BYTES}) return '${MAX_SIZE_REASON}';
+  return null;
+}`;
 /** The JXA recorder. `argv[0]` is the session directory. Reasons it writes to `failed.txt`: mic_denied, recorder_failed. */
 export const RECORDER_SCRIPT = `ObjC.import('AVFoundation');
 ObjC.import('Foundation');
@@ -51,8 +80,19 @@ function writeText(file, text) {
 }
 function exists(file) { return $.NSFileManager.defaultManager.fileExistsAtPath(file); }
 function tick(seconds) { $.NSRunLoop.currentRunLoop.runUntilDate($.NSDate.dateWithTimeIntervalSinceNow(seconds)); }
+function fileBytes(file) {
+  // Never throws: a size it cannot read is 0, and the audio and clock checks still stop the recorder.
+  try {
+    var attrs = $.NSFileManager.defaultManager.attributesOfItemAtPathError(file, null);
+    if (!attrs || attrs.isNil()) return 0;
+    var size = ObjC.unwrap(attrs.objectForKey('NSFileSize'));
+    return typeof size === 'number' ? size : 0;
+  } catch (e) { return 0; }
+}
+${RECORDER_STOP_RULE}
 function run(argv) {
   var dir = argv[0];
+  var startedMs = Date.now();
   var auth = $.AVCaptureDevice.authorizationStatusForMediaType('soun');
   if (auth === 1 || auth === 2) { writeText(dir + '/failed.txt', 'mic_denied'); $.exit(3); }
   var settings = $.NSDictionary.dictionaryWithObjectsForKeys(
@@ -69,10 +109,11 @@ function run(argv) {
     if (now === 1 || now === 2) { recorder.stop; writeText(dir + '/failed.txt', 'mic_denied'); $.exit(3); }
     if (!announced && now === 3) { announced = true; writeText(dir + '/ready', 'ok'); }
     if (!announced && waited > 120) { recorder.stop; writeText(dir + '/failed.txt', 'mic_permission_unanswered'); $.exit(5); }
-    // currentTime is the audio in the file, so it bounds the file size; the tick count is a backstop if it ever reads wrong.
-    if (recorder.currentTime >= ${MAX_RECORDING_SECONDS} || waited >= ${MAX_RECORDING_SECONDS + 600}) {
+    // currentTime is the audio in the file; the wall clock and the file size are the backstops (BLI-23470).
+    var capped = capReached(startedMs, Date.now(), recorder.currentTime, fileBytes(dir + '/audio.wav'));
+    if (capped) {
       recorder.stop;
-      writeText(dir + '/${ENDED_MARKER}', '${MAX_DURATION_REASON}');
+      writeText(dir + '/${ENDED_MARKER}', capped);
       writeText(dir + '/done', 'ok');
       $.exit(0);
     }
@@ -130,6 +171,15 @@ export async function fileSize(file) {
         return null;
     }
 }
+/** How long ago `file` last changed, by the real clock, or null when it does not exist (BLI-23470). */
+export async function fileQuietMs(file) {
+    try {
+        return Math.max(0, Date.now() - (await stat(file)).mtimeMs);
+    }
+    catch {
+        return null;
+    }
+}
 export async function fileExists(file) {
     return (await fileSize(file)) !== null;
 }

package/dist/commands/notes-record.js

@@ -22,6 +22,14 @@
  * refuses by name. Both platforms share one session directory, marker files,
  * JSON answers and WAV format, so the upload and recovery below are one code path.
  *
+ * BLI-23470: a session whose pid answers but whose recorder is plainly gone
+ * (silent file, past the cap, never opened the microphone) is crashed, so it
+ * uploads and `start` works again; an upload names its session and keeps the
+ * object key Tower issued (`upload.json`), so a retry makes no second note and
+ * sends no byte twice; failed uploads are counted on the session and `status`
+ * reports them (`upload_failures`, `last_attempt_age_seconds`) for the app's
+ * backoff.
+ *
  * Capture is `notes-record-capture.ts` (macOS) and
  * `notes-record-capture-win32.ts` (Windows); the header repair is `notes-record-wav.ts`.
  */
@@ -29,7 +37,7 @@ import { link, rm } from "node:fs/promises";
 import path from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { writeLine } from "./cli-io.js";
-import { audioPath, fileExists, fileSize, launchRecorder, listSessions, newSessionId, prepareSessionDir, processAlive, readEndedReason, readReason, recordingsRoot, requestStop, sessionDir, uploadPath, writeSession, MAX_RECORDING_SECONDS, RECORDING_SAMPLE_RATE, } from "./notes-record-capture.js";
+import { audioPath, fileExists, fileQuietMs, fileSize, launchRecorder, listSessions, newSessionId, prepareSessionDir, processAlive, readEndedReason, readReason, recordingsRoot, requestStop, sessionDir, uploadPath, writeSession, MAX_RECORDING_SECONDS, RECORDER_PAST_CAP_MARGIN_SECONDS, RECORDER_SILENT_AFTER_MS, RECORDER_SILENT_RECHECK_MS, RECORDING_SAMPLE_RATE, UPLOAD_STATE_FILE, } from "./notes-record-capture.js";
 import { repairWavHeader } from "./notes-record-wav.js";
 const TAG = "[notes record]";
 const READY_DEADLINE_MS = 150_000;
@@ -47,14 +55,19 @@ export function defaultRecordDeps(io, upload) {
         }
         catch { /* already gone */ } },
         upload,
+        audioQuietMs: fileQuietMs,
     };
 }
 /**
  * Where a session stands. Order matters: an end the CLI wrote, then an end the recorder wrote (`ended.txt`
  * at the 8-hour cap, or `done`), then a live process. A marker outranks the pid, so a pid the system reused
  * never pins a finished recorder as "recording". `endedReason` is the recorder's closed label, if it wrote one.
+ *
+ * BLI-23470: a live pid is not proof either. With no marker, a pid the system reused (or one owned by another
+ * user, EPERM) would pin a crashed session as "recording" forever: never uploaded, and `start` refused. So a
+ * process that looks alive still counts as crashed when its recorder is plainly not recording (`recorderGone`).
  */
-async function viewOf(root, session, deps) {
+async function viewOf(root, session, deps, io) {
     if (session.endedAt)
         return { state: session.endedBy === "cancel" ? "cancelled" : "stopped", endedReason: null };
     const ended = await readEndedReason(root, session.id);
@@ -62,11 +75,48 @@ async function viewOf(root, session, deps) {
         return { state: "stopped", endedReason: ended };
     if (await fileExists(path.join(sessionDir(root, session.id), "done")))
         return { state: "stopped", endedReason: null };
-    return { state: deps.alive(session.pid) ? "recording" : "crashed", endedReason: null };
+    if (!deps.alive(session.pid))
+        return { state: "crashed", endedReason: null };
+    const gone = await recorderGone(root, session, deps, io);
+    return gone ? { state: "crashed", endedReason: gone } : { state: "recording", endedReason: null };
+}
+/**
+ * Why a session whose pid answers is not really recording, or null when it is. Judged on the session's own files:
+ *   - `recorder_past_cap`: started longer ago than the 8-hour cap plus a margin; no recorder of ours runs that long.
+ *   - `recorder_never_ready`: the microphone never opened (no `ready`) and `start` gave up waiting long ago.
+ *   - `recorder_silent`: the microphone opened, but `audio.wav` has not changed for `RECORDER_SILENT_AFTER_MS`.
+ *     Asked twice, `RECORDER_SILENT_RECHECK_MS` apart: right after a laptop wakes from sleep the file is old
+ *     but the recorder writes again within a second, and that recording must not be cut off.
+ */
+async function recorderGone(root, session, deps, io) {
+    const ageMs = deps.now().getTime() - Date.parse(session.startedAt);
+    let reason = null;
+    if (ageMs > (MAX_RECORDING_SECONDS + RECORDER_PAST_CAP_MARGIN_SECONDS) * 1000)
+        reason = "recorder_past_cap";
+    else if (!(await fileExists(path.join(sessionDir(root, session.id), "ready")))) {
+        if (ageMs > READY_DEADLINE_MS + RECORDER_SILENT_AFTER_MS)
+            reason = "recorder_never_ready";
+    }
+    else {
+        const audio = audioPath(root, session.id);
+        const quiet = await deps.audioQuietMs(audio);
+        if (quiet !== null && quiet > RECORDER_SILENT_AFTER_MS) {
+            const before = await fileSize(audio);
+            await deps.sleep(RECORDER_SILENT_RECHECK_MS);
+            const again = await deps.audioQuietMs(audio);
+            // The size too: a file system that is slow to move the modified time still shows the bytes growing.
+            if (again !== null && again > RECORDER_SILENT_AFTER_MS && (await fileSize(audio)) === before)
+                reason = "recorder_silent";
+        }
+    }
+    if (reason) {
+        writeLine(io.stderr, `${TAG} recorder gone ${JSON.stringify({ session: session.id, pid: session.pid, reason, age_s: Math.round(ageMs / 1000) })}`);
+    }
+    return reason;
 }
-async function findRecording(root, sessions, deps) {
+async function findRecording(root, sessions, deps, io) {
     for (const session of sessions) {
-        if ((await viewOf(root, session, deps)).state === "recording")
+        if ((await viewOf(root, session, deps, io)).state === "recording")
             return session;
     }
     return undefined;
@@ -120,7 +170,7 @@ export async function runNotesRecord(command, io, deps) {
 }
 async function startRecording(command, io, deps, root) {
     const sessions = await listSessions(root);
-    const running = await findRecording(root, sessions, deps);
+    const running = await findRecording(root, sessions, deps, io);
     if (running) {
         return refuse(io, command, "already_recording", `A recording is already running (started ${running.startedAt}). Run \`cockpit notes record stop\` to finish it or \`cockpit notes record cancel\` to keep the file and stop.`);
     }
@@ -162,7 +212,7 @@ async function closeRecorder(root, session, deps) {
         deps.kill(session.pid);
 }
 async function cancelRecording(command, io, deps, root) {
-    const running = await findRecording(root, await listSessions(root), deps);
+    const running = await findRecording(root, await listSessions(root), deps, io);
     if (!running)
         return refuse(io, command, "not_recording", "No recording is running.");
     await closeRecorder(root, running, deps);
@@ -213,7 +263,7 @@ async function stopRecording(command, io, deps, root) {
     const sessions = await listSessions(root);
     const target = command.sessionId
         ? sessions.find((s) => s.id === command.sessionId)
-        : await findRecording(root, sessions, deps);
+        : await findRecording(root, sessions, deps, io);
     if (!target) {
         const waiting = sessions.filter((s) => !s.submittedAt && !s.nothingToUpload);
         const hint = waiting.length ? ` Waiting for upload: ${waiting.map((s) => s.id).join(", ")} (\`cockpit notes record stop <id>\`).` : "";
@@ -223,12 +273,21 @@ async function stopRecording(command, io, deps, root) {
         return refuse(io, command, "already_submitted", `Recording ${target.id} was already submitted at ${target.submittedAt}.`);
     }
     let session = target;
-    const view = await viewOf(root, target, deps);
+    const view = await viewOf(root, target, deps, io);
     if (view.state === "recording") {
         await closeRecorder(root, target, deps);
         session = { ...target, endedAt: deps.now().toISOString(), endedBy: "stop" };
         await writeSession(root, session);
     }
+    else if (view.endedReason?.startsWith("recorder_")) {
+        // BLI-23470: its pid answers but the recorder is gone (`recorderGone`). Ask a recorder that may still be there to
+        // close its file, but never kill: that pid may belong to somebody else's process now. Pinned as stopped.
+        await requestStop(root, target.id);
+        for (let waited = 0; waited < STOP_DEADLINE_MS && deps.alive(target.pid); waited += POLL_MS)
+            await deps.sleep(POLL_MS);
+        session = { ...target, endedAt: deps.now().toISOString(), endedBy: "stop" };
+        await writeSession(root, session);
+    }
     const audio = audioPath(root, session.id);
     const reason = await unsendable(root, session, deps);
     if (reason) {
@@ -240,9 +299,15 @@ async function stopRecording(command, io, deps, root) {
     writeLine(io.stderr, `${TAG} uploading original ${JSON.stringify({ session: session.id, bytes, seconds: Math.round(audioSeconds(bytes)), ended_reason: view.endedReason })}`);
     if (!command.json)
         writeLine(io.stderr, `Uploading the whole recording (${clock(audioSeconds(bytes))}, ${megabytes(bytes)})...`);
-    const code = await deps.upload({ ...command, action: "upload", paths: [sent] }, sent);
+    // BLI-23470: the upload names this session, and keeps the object key Tower issued beside the audio, so a retry after
+    // `/saved` failed asks Tower again instead of sending the whole file twice (and Tower answers with the same note).
+    const recordingUpload = { session: session.id, stateFile: path.join(sessionDir(root, session.id), UPLOAD_STATE_FILE) };
+    const code = await deps.upload({ ...command, action: "upload", paths: [sent], recordingUpload }, sent);
     if (code !== 0) {
-        writeLine(io.stderr, `${TAG} upload failed ${JSON.stringify({ session: session.id, exit: code })}`);
+        // Counted on the session, so the app's retries back off across restarts (5 min doubling to 1 h, `backoff.rs`).
+        const failures = (session.uploadFailures ?? 0) + 1;
+        await writeSession(root, { ...session, uploadFailures: failures, lastUploadAttemptAt: deps.now().toISOString() });
+        writeLine(io.stderr, `${TAG} upload failed ${JSON.stringify({ session: session.id, exit: code, upload_failures: failures })}`);
         writeLine(io.stderr, `The upload did not finish. The recording is kept; the BLI Notetaker app tries again by itself, or run \`cockpit notes record stop ${session.id}\`.`);
         return code;
     }
@@ -261,14 +326,19 @@ async function recordingStatus(command, io, deps, root) {
     const sessions = (await listSessions(root)).filter((s) => !s.submittedAt && !s.nothingToUpload);
     const rows = [];
     for (const session of sessions) {
-        const { state, endedReason } = await viewOf(root, session, deps);
+        const { state, endedReason } = await viewOf(root, session, deps, io);
         const bytes = await fileSize(audioPath(root, session.id));
         if (state !== "recording" && bytes === null)
             continue;
-        const elapsed = state === "recording" ? (deps.now().getTime() - Date.parse(session.startedAt)) / 1000 : audioSeconds(bytes);
+        const now = deps.now().getTime();
+        const elapsed = state === "recording" ? (now - Date.parse(session.startedAt)) / 1000 : audioSeconds(bytes);
+        const lastAttempt = session.lastUploadAttemptAt ? Date.parse(session.lastUploadAttemptAt) : Number.NaN;
         rows.push({
             session: session.id, state, needs_upload: state !== "recording", ended_reason: endedReason,
             started_at: session.startedAt, elapsed_seconds: Math.round(elapsed), bytes, file: audioPath(root, session.id),
+            // BLI-23470: what the app's backoff reads. Seconds since the last failed upload, so no clock is compared across processes.
+            upload_failures: session.uploadFailures ?? 0,
+            last_attempt_age_seconds: Number.isFinite(lastAttempt) ? Math.max(0, Math.round((now - lastAttempt) / 1000)) : null,
         });
     }
     writeLine(io.stderr, `${TAG} status ${JSON.stringify({ sessions: rows.length, needs_upload: rows.filter((row) => row.needs_upload).length })}`);

package/dist/commands/notes-writes.js

@@ -80,9 +80,12 @@ async function uploadOneNote(command, door, filePath) {
  * upload route.
  */
 async function sendNoteFile(command, door, filePath, read) {
-    if (read.direct) {
+    // BLI-23470: a laptop recording always goes direct, whatever its size, so it names its session to `/saved` and a
+    // retry never makes a second note (the small-file route has no session check).
+    if (read.direct || (command.recordingUpload && noteAudioMime(read.fileName))) {
         const direct = await uploadAudioDirect(door, {
             filePath, fileName: read.fileName, size: read.size, exclude: command.exclude, folder: command.folder,
+            ...(command.recordingUpload ? { recording: command.recordingUpload } : {}),
         });
         return direct.ok ? { ok: true, body: direct.body } : { ok: false, reason: direct.reason, detail: direct.detail };
     }

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.276");
+    writeLine(io?.stdout ?? process.stdout, "0.2.278");
     return 0;
   }