@bli-cockpit/cli 0.2.277 → 0.2.279

package/dist/adapters/codex-session-signals.js

@@ -34,7 +34,11 @@ export async function readCodexMetadataSignals(filePath) {
     const state = makeSignalExtractionState();
     const stream = createReadStream(filePath);
     let byteSize = 0;
-    let lineBuffer = "";
+    // The line being assembled, in the pieces the chunks gave and its byte count kept as a running sum. The
+    // old `lineBuffer += segment` plus `Buffer.byteLength(lineBuffer)` flattened the whole growing string on
+    // every 64 KiB chunk, so a 1 MiB record made about 8 MiB of short-lived copies (BLI-23521).
+    let lineParts = [];
+    let lineBytes = 0;
     let discardingOversizedLine = false;
     for await (const chunk of stream) {
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
@@ -50,25 +54,29 @@ export async function readCodexMetadataSignals(filePath) {
                     discardingOversizedLine = false;
                 continue;
             }
-            lineBuffer += segment;
-            if (Buffer.byteLength(lineBuffer, "utf8") > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
+            lineParts.push(segment);
+            lineBytes += Buffer.byteLength(segment, "utf8");
+            if (lineBytes > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
                 state.lineCount += 1;
                 state.parseErrorCount += 1;
-                lineBuffer = "";
+                lineParts = [];
+                lineBytes = 0;
                 discardingOversizedLine = !lineEnded;
                 continue;
             }
             if (lineEnded) {
-                absorbCodexSessionLine(state, lineBuffer);
-                lineBuffer = "";
+                absorbCodexSessionLine(state, lineParts.length === 1 ? lineParts[0] : lineParts.join(""));
+                lineParts = [];
+                lineBytes = 0;
             }
         }
     }
     const rest = decoder.end();
     if (rest)
-        lineBuffer += rest;
-    if (lineBuffer.trim())
-        absorbCodexSessionLine(state, lineBuffer);
+        lineParts.push(rest);
+    const lastLine = lineParts.join("");
+    if (lastLine.trim())
+        absorbCodexSessionLine(state, lastLine);
     observeSessionFactsFile(state.facts, { bytes: byteSize, lines: state.lineCount });
     return {
         signals: codexSignalsFromState(state),

package/dist/adapters/raw-evidence-facts.js

@@ -269,6 +269,9 @@ function uploadFileFromEntry(entry) {
             ? { artifact_metadata: entry.artifact_metadata }
             : {}),
         ...(entry.snapshot ? { source_key: entry.source_key, snapshot: entry.snapshot } : {}),
+        ...(entry.supersedes?.rule === "prefix" && entry.supersedes.base
+            ? { extend_base: { object_key: entry.supersedes.pointer_id, ...entry.supersedes.base } }
+            : {}),
     };
 }
 function stageReasonLabel(state, priorPackCount) {

package/dist/adapters/raw-evidence-snapshot-supersede.js

@@ -20,7 +20,7 @@
  * says so: `snapshot_rewritten`, both sizes, and the byte range the first
  * difference falls in. Never content.
  */
-import { createReadStream } from "node:fs";
+import { chunksOfFileReusingOneBuffer } from "../evidence-upload-staged.js";
 import { REDACTION_STUB_LABEL } from "@bli-cockpit/telemetry-core";
 import { firstDifferenceRange, isPrefixSuccessor, prefixCheckpoints, prefixDigestsFromStream, } from "@bli-cockpit/telemetry-core/snapshot-supersede";
 /**
@@ -73,7 +73,11 @@ function decideClaim(options, isPrefix, differenceRange) {
             previous_byte_size: prior.byte_size,
             byte_size: options.byteSize,
         }));
-        return { pointer_id: prior.raw_evidence_pointer_id, rule: "prefix" };
+        return {
+            pointer_id: prior.raw_evidence_pointer_id,
+            rule: "prefix",
+            base: { content_hash_sha256: prior.content_hash_sha256, byte_size: prior.byte_size },
+        };
     }
     const range = differenceRange(prior);
     console.error("[evidence-upload] snapshot rewritten, keeping both", JSON.stringify({
@@ -101,7 +105,7 @@ export async function describeStagedSnapshot(options) {
     const priorOffsets = wantClaim
         ? [prior.byte_size, ...Object.keys(prior.checkpoints ?? {}).map(Number)].filter((at) => at > 0 && at <= Math.min(prior.byte_size, byteLength))
         : [];
-    const result = await prefixDigestsFromStream(createReadStream(options.filePath, { highWaterMark: 1024 * 1024 }), [...checkpointOffsets, ...priorOffsets]);
+    const result = await prefixDigestsFromStream(chunksOfFileReusingOneBuffer(options.filePath, 1024 * 1024), [...checkpointOffsets, ...priorOffsets]);
     if (result.total_bytes !== byteLength) {
         // The staged file is not the bytes that were hashed: a claim made on it would be a lie.
         console.error("[evidence-upload] staged file size differs from what was written; no claim", JSON.stringify({

package/dist/adapters/raw-evidence-transcript-body.js

@@ -10,8 +10,9 @@
  * The order stays image replacement, slim, redact.
  */
 import { isUtf8 } from "node:buffer";
-import { mightHoldEmbeddedImages } from "@bli-cockpit/telemetry-core";
+import { mightHoldEmbeddedImages, modeDropsImages, modeStoresImages } from "@bli-cockpit/telemetry-core";
 import { describeError } from "../health-detail.js";
+import { makeCaptureProvenance } from "./common.js";
 import { roomToStreamToStaging } from "./raw-evidence-budget-admission.js";
 import { readTranscriptWhole, streamTranscriptBody, volatilityOf } from "./raw-evidence-transcript-stream.js";
 /** Which agent's transcript rules apply to this evidence kind; null for anything the image step does not know. */
@@ -27,8 +28,22 @@ export function holdDecodedText(source) {
     if (!lossless) {
         console.error("[raw-evidence] transcript is not valid UTF-8; keeping its bytes beside the text so an unchanged file uploads as it is", JSON.stringify({ reason: "invalid_utf8_bytes_kept", byte_size: bytes.byteLength }));
     }
+    if (lossless)
+        releaseBackingStore(bytes);
     return { text, exactBytes: lossless ? null : bytes };
 }
+/**
+ * Free a file-sized buffer now instead of at the next collection (BLI-23521). Dropping the reference only
+ * makes it collectable; an ArrayBuffer is not collected until a GC runs, so on a 10 MB transcript the bytes,
+ * the decoded text and the encoded output were all resident at once (arrayBuffers 21 MB, RSS +30 MB over a
+ * 2.6 MB file). Only a buffer that owns its whole ArrayBuffer is detached: a slice of the shared pool is not ours.
+ */
+function releaseBackingStore(bytes) {
+    const store = bytes.buffer;
+    if (bytes.byteOffset !== 0 || store.byteLength !== bytes.byteLength)
+        return;
+    store.transfer?.(0);
+}
 /**
  * BLI-16977: describe each distinct embedded image once and, when the one switch says so, swap the
  * base64 for a short marker BEFORE masking, so the masker and the content hash see the final bytes.
@@ -41,6 +56,10 @@ export function holdDecodedText(source) {
 export async function prepareTranscriptBody(collection, file) {
     const session = collection.budget.images;
     const agent = agentOfKind(file.kind);
+    // BLI-23329: `store_and_drop` talks to the upload doors for the images of this transcript, as this sync.
+    const provenance = session && modeStoresImages(session.mode) && collection.context
+        ? makeCaptureProvenance(collection.context, "collector_runtime")
+        : undefined;
     if (file.source.stream) {
         // BLI-23317 stage D: the slimmed bytes are written to this pack's `files` directory as they are made,
         // but only when the budget and the disk gate would admit a file of the source's size: never a byte ahead of the gate.
@@ -48,7 +67,7 @@ export async function prepareTranscriptBody(collection, file) {
         if (refusal) {
             console.error("[raw-evidence] streamed output is not written ahead of the staging gate", JSON.stringify({ reason: "stream_to_staging_declined", gate: refusal, kind: file.kind, input_bytes: file.source.stream.inputBytes ?? null }));
         }
-        const streamed = await streamTranscriptBody(session, agent, { ...file.source.stream, sessionId: file.sessionId, kind: file.kind, stageDir: refusal ? undefined : collection.filesDir });
+        const streamed = await streamTranscriptBody(session, agent, { ...file.source.stream, sessionId: file.sessionId, kind: file.kind, stageDir: refusal ? undefined : collection.filesDir, ...(provenance ? { provenance } : {}) });
         if (streamed) {
             file.source.readBytes = streamed.readBytes;
             return { held: streamed.held, volatile: streamed.volatile, pendingImages: streamed.pendingImages };
@@ -60,12 +79,12 @@ export async function prepareTranscriptBody(collection, file) {
     if (!session || !agent)
         return untouched(false, null);
     // Drop mode slims every transcript, image-bearing or not; keep mode only describes the ones that can hold an image.
-    if (session.mode !== "describe_and_drop" && !mightHoldEmbeddedImages(file.source.bytes))
+    if (!modeDropsImages(session.mode) && !mightHoldEmbeddedImages(file.source.bytes))
         return untouched(false, null);
     let held;
     try {
         held = holdDecodedText(file.source);
-        const prepared = await session.prepareTranscript({ text: held.text, source: agent, sessionId: file.sessionId });
+        const prepared = await session.prepareTranscript({ text: held.text, source: agent, sessionId: file.sessionId, ...(provenance ? { provenance } : {}) });
         // BLI-3936: "volatile" = the next tick could build different bytes, or do image work, from
         // this very file: an image still without a stored description (keep mode never replaces, so
         // any image counts) or a slim step that failed and should be retried.

package/dist/adapters/raw-evidence-transcript-stream.js

@@ -1,6 +1,6 @@
 /**
- * The transcript that is never read whole (BLI-23317): its path goes to the image session's two
- * streaming passes, and what comes back is the one slimmed string the sanitizer takes.
+ * The transcript that is never read whole (BLI-23317; keep mode too since BLI-23524, where the second pass
+ * copies the lines): its path goes to the image session's two streaming passes, and what comes back is the one slimmed string the sanitizer takes.
  *
  * Three endings, each named:
  *  - a body: the text is the slim form of the file (valid UTF-8 was checked across every chunk, so
@@ -12,6 +12,7 @@
  *    read gives (`file_read_failed`, `file_too_large`), never a shorter file.
  */
 import fs from "node:fs/promises";
+import { modeDropsImages } from "@bli-cockpit/telemetry-core";
 import { describeError } from "../health-detail.js";
 import { TranscriptNotStreamable, TranscriptReadError, TranscriptTooLargeError, } from "./transcript-text-stream.js";
 const TAG = "[raw-evidence]";
@@ -22,10 +23,10 @@ const TAG = "[raw-evidence]";
  * stored description means the bytes change only when one of them gains one, so the memo may keep the entry.
  */
 export function volatilityOf(mode, prepared) {
-    const imagesPending = mode === "describe_and_drop"
+    const imagesPending = modeDropsImages(mode)
         ? prepared.imageCount > prepared.replacedCount
         : prepared.imageCount > 0;
-    const slimFailed = mode === "describe_and_drop" && prepared.slim === null;
+    const slimFailed = modeDropsImages(mode) && prepared.slim === null;
     const volatile = imagesPending || slimFailed;
     return { volatile, pendingImages: volatile && !slimFailed ? prepared.pendingImages : null };
 }
@@ -35,9 +36,9 @@ export async function streamTranscriptBody(session, agent, file) {
         return null;
     }
     try {
-        const prepared = await session.prepareTranscriptFile({ filePath: file.filePath, source: agent, sessionId: file.sessionId, maxFileBytes: file.maxFileBytes, stageDir: file.stageDir, omitText: file.stageDir !== undefined });
+        const prepared = await session.prepareTranscriptFile({ filePath: file.filePath, source: agent, sessionId: file.sessionId, maxFileBytes: file.maxFileBytes, stageDir: file.stageDir, omitText: file.stageDir !== undefined, ...(file.provenance ? { provenance: file.provenance } : {}) });
         const { volatile, pendingImages } = volatilityOf(session.mode, prepared);
-        console.error(TAG + " transcript streamed through image swap and slim", JSON.stringify({ kind: file.kind, byte_size: prepared.readBytes, changed: prepared.changed, images: prepared.imageCount, volatile, staged_bytes: prepared.staged?.byteLength ?? null }));
+        console.error(TAG + " transcript streamed through image swap and slim", JSON.stringify({ kind: file.kind, mode: session.mode, byte_size: prepared.readBytes, changed: prepared.changed, images: prepared.imageCount, volatile, staged_bytes: prepared.staged?.byteLength ?? null }));
         // BLI-23344: with a spool the text is not read back; the sanitizer reads the spool line by line.
         return { held: { text: prepared.staged ? null : prepared.text, exactBytes: null, ...(prepared.staged ? { staged: prepared.staged } : {}) }, volatile, pendingImages, readBytes: prepared.readBytes };
     }

package/dist/adapters/raw-evidence-volatile-reuse.js

@@ -10,6 +10,16 @@ export function trustVolatileEntry(collection, memo, known, kind, sourceKey, byt
     const pending = known.pending_images ?? [];
     if (!session)
         return false;
+    // BLI-23329: in store mode the bytes change only when Tower confirms an image, never when a description arrives, so
+    // the gate asks about STORAGE progress: rebuild while the store could still take one of them (a closed session whose
+    // store failed is stored on the next tick with room), reuse once the budget is spent or every one is backing off.
+    if (session.mode === "store_and_drop") {
+        if (session.hasStoreRoom(pending)) {
+            logVolatileReuse(kind, sourceKey, known.content_hash, "rebuilt_store_has_room");
+            return false;
+        }
+        return true;
+    }
     if (pending.some((sha256) => session.isDescribed(sha256))) {
         memo.count("rebuilt_image_now_described", bytes);
         logVolatileReuse(kind, sourceKey, known.content_hash, "rebuilt_image_now_described");

package/dist/commands/ai-spend.js

@@ -0,0 +1,32 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { parseNamedArgs, optionalNonEmpty, optionalUrl } from "./local-arg-values.js";
+const USAGE = "Usage: cockpit ai-spend flow|people|output [--days <1-365>] [--json]";
+export function parseAiSpendArgs(args) {
+    const values = parseNamedArgs(args, { allowedFlags: ["--days", "--json", "--home", "--dashboard-url"], valueFlags: ["--days", "--home", "--dashboard-url"] });
+    const [action, ...rest] = values.positionals;
+    if ((action !== "flow" && action !== "people" && action !== "output") || rest.length)
+        throw new Error(USAGE);
+    const raw = values.flags.get("--days");
+    let days;
+    if (raw !== undefined) {
+        days = Number(raw);
+        if (!Number.isInteger(days) || days < 1 || days > 365)
+            throw new Error(USAGE);
+    }
+    return { kind: "ai-spend", action, days, json: values.booleans.has("--json"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")) };
+}
+export async function runAiSpend(command, io) {
+    const door = await openAgentDoor("ai-spend", command, io);
+    const query = new URLSearchParams({ view: command.action });
+    if (command.days !== undefined)
+        query.set("days", String(command.days));
+    const answer = await askAgentDoor(door, { path: `/api/ai-spend?${query}`, method: "GET", label: `ai-spend ${command.action}`, timeoutMs: 30_000 });
+    if (!answer.ok)
+        return failAgentDoor(door, "[ai-spend cli]", answer.reason, answer.detail);
+    if (command.json)
+        return emitAgentDoor(door, answer.body);
+    for (const line of answer.body.lines)
+        writeLine(io.stdout, line);
+    return 0;
+}

package/dist/commands/image.js

@@ -12,10 +12,10 @@
  * large or not an image is refused here, before anything is sent.
  */
 import { createHash } from "node:crypto";
-import { readFile, stat } from "node:fs/promises";
+import { readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { IMAGE_DESCRIBE_MAX_BYTES, formatImageMarker, imageSizeLabel, sniffImageMediaType, } from "@bli-cockpit/telemetry-core";
-import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { askAgentDoor, emitAgentDoor, failAgentDoor, fetchAgentDoorFile, openAgentDoor } from "./agent-door.js";
 import { writeLine } from "./cli-io.js";
 const TAG = "[image cli]";
 const READ_DEADLINE_MS = 30_000;
@@ -94,7 +94,41 @@ async function describeImage(command, door, request) {
     writeLine(out, `Transcript marker: ${formatImageMarker({ sha256: request.sha256, mediaType: request.media_type, byteSize: request.byte_size })}`);
     return 0;
 }
+/**
+ * `show --bytes <file>` (BLI-23329): the stored image itself, written to a NEW file. The door decodes the evidence
+ * envelope and hashes the result; this side hashes again before a byte reaches the disk, so a body that is not the
+ * picture its name promises is never written. An existing file is never overwritten.
+ */
+async function saveImageBytes(command, door, file) {
+    const sha256 = command.sha256 ?? "";
+    const query = new URLSearchParams({ sha256, bytes: "1" });
+    const answer = await fetchAgentDoorFile(door, { path: `${DOOR_PATH}?${query.toString()}`, label: "image show bytes", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const actual = createHash("sha256").update(answer.bytes).digest("hex");
+    if (actual !== sha256) {
+        return failAgentDoor(door, TAG, "bytes_do_not_match_sha256", "Tower sent bytes whose sha256 is not the one you asked for, so nothing was written.");
+    }
+    const mediaType = sniffImageMediaType(answer.bytes);
+    const target = path.resolve(file);
+    try {
+        await writeFile(target, answer.bytes, { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        const code = error?.code;
+        const reason = code === "EEXIST" ? "output_exists" : "output_unwritable";
+        return failAgentDoor(door, TAG, reason, code === "EEXIST" ? `${file} already exists; choose a new file name. Nothing was written.` : `Could not write ${file}. Nothing was written.`);
+    }
+    writeLine(door.io.stderr, `${TAG} bytes saved ${JSON.stringify({ sha256: sha256.slice(0, 16), byte_size: answer.bytes.length, media_type: mediaType ?? "unknown", verified: true })}`);
+    const result = { ok: true, sha256, media_type: mediaType, byte_size: answer.bytes.length, path: target, verified: true };
+    if (door.json)
+        return emitAgentDoor(door, result);
+    writeLine(door.io.stdout, `Wrote ${imageSizeLabel(answer.bytes.length)} ${mediaType?.replace("image/", "") ?? "image"} to ${target}; its sha256 matches ${sha256.slice(0, 16)}….`);
+    return 0;
+}
 async function showImage(command, door) {
+    if (command.bytesFile)
+        return saveImageBytes(command, door, command.bytesFile);
     const query = new URLSearchParams({ sha256: command.sha256 ?? "" });
     const answer = await askAgentDoor(door, { path: `${DOOR_PATH}?${query.toString()}`, method: "GET", label: "image show", timeoutMs: READ_DEADLINE_MS });
     if (!answer.ok)

package/dist/commands/local-args-tower-image.js

@@ -3,6 +3,7 @@
  *
  *   cockpit image describe <file> [--session <id>] [--json]
  *   cockpit image show <sha256-or-prefix> [--json]
+ *   cockpit image show <sha256> --bytes <file> [--json]
  *
  * Tower swaps the base64 pictures inside collected transcripts for a short written description.
  * `describe` sends one image file through that same door by hand; `show` looks a description up by
@@ -14,8 +15,8 @@ const ONE_VERB = "image takes one verb: describe or show. Example: `cockpit imag
 const SESSION_ID_MAX_CHARS = 200;
 export function parseImageArgs(args) {
     const values = parseNamedArgs(args, {
-        allowedFlags: ["--session", "--home", "--dashboard-url", "--json"],
-        valueFlags: ["--session", "--home", "--dashboard-url"],
+        allowedFlags: ["--session", "--bytes", "--home", "--dashboard-url", "--json"],
+        valueFlags: ["--session", "--bytes", "--home", "--dashboard-url"],
     });
     const [verb, ...rest] = values.positionals;
     if (verb !== "describe" && verb !== "show")
@@ -28,6 +29,9 @@ export function parseImageArgs(args) {
         throw new Error("--session does not belong to `cockpit image show`.");
     if (session !== undefined && session.length > SESSION_ID_MAX_CHARS)
         throw new Error(`--session is at most ${SESSION_ID_MAX_CHARS} characters.`);
+    const bytesFile = optionalNonEmpty(values.flags.get("--bytes"));
+    if (bytesFile !== undefined && verb !== "show")
+        throw new Error("--bytes belongs to `cockpit image show`.");
     const common = {
         kind: "image",
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
@@ -36,7 +40,11 @@ export function parseImageArgs(args) {
     };
     if (verb === "describe")
         return { ...common, action: "describe", file: rest[0], ...(session ? { session } : {}) };
-    return { ...common, action: "show", sha256: readHashQuery(rest[0]) };
+    const sha256 = readHashQuery(rest[0]);
+    if (bytesFile !== undefined && sha256.length !== 64) {
+        throw new Error("--bytes needs the whole sha256 (64 hex characters): a 16-character marker prefix names a description, not one stored image. `cockpit image show <prefix>` first, then the full hash it prints.");
+    }
+    return { ...common, action: "show", sha256, ...(bytesFile ? { bytesFile } : {}) };
 }
 /** A marker is pasted whole as often as not (`sha256:ab12…`), so accept that spelling and trim it. */
 function readHashQuery(typed) {

package/dist/commands/local-args-tower.js

@@ -57,4 +57,6 @@ export { parseGlossaryArgs } from "./glossary.js";
 export { parseSpendArgs } from "./spend.js";
 export { parsePushArgs } from "./push.js";
 export { parseCiArgs } from "./ci.js";
-export { parseDeliveryArgs } from "./delivery.js";
+export { parseDeliveryArgs } from "./delivery.js";
+export { parsePrOutputArgs } from "./pr-output.js";
+export { parseAiSpendArgs } from "./ai-spend.js";

package/dist/commands/local-args.js

@@ -23,7 +23,7 @@ import { parseSlackPrivacyArgs } from "./slack-privacy-args.js";
 import { parseMilestoneArgs } from "./local-args-tower-milestone.js";
 import { SURFACE_ALIASES } from "./local-help.js";
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
-import { parseCiArgs, parseDeliveryArgs, parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseSetupArgs, parseSpeedArgs, parseLogsArgs, parseBrainArgs, parseHitsArgs, parseIntentionsArgs, parseWhoArgs, parsePeopleArgs, parseApprovalsArgs, parseDrillsArgs, parseManagerArgs, parseImageArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
+import { parseCiArgs, parseDeliveryArgs, parsePrOutputArgs, parseAiSpendArgs, parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseSetupArgs, parseSpeedArgs, parseLogsArgs, parseBrainArgs, parseHitsArgs, parseIntentionsArgs, parseWhoArgs, parsePeopleArgs, parseApprovalsArgs, parseDrillsArgs, parseManagerArgs, parseImageArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
 // `normalizeUrl` has always been part of this module's surface — `local.ts` and
 // `local-auth.ts` import it from here — so it stays exported from this address
 // even though it now lives next door. The same goes for the four names the
@@ -67,6 +67,8 @@ const COMMAND_PARSERS = new Map([
     ["scout", (_command, rest) => parseScoutArgs(rest)],
     ["ci", (_command, rest) => parseCiArgs(rest)],
     ["delivery", (_command, rest) => parseDeliveryArgs(rest)],
+    ["pr-output", (_command, rest) => parsePrOutputArgs(rest)],
+    ["ai-spend", (_command, rest) => parseAiSpendArgs(rest)],
     ["ops", (_command, rest) => parseOpsArgs(rest)],
     // BLI-23244: `slack privacy` has its own flags and its own file.
     ["slack", (_command, rest) => (rest.includes("privacy") ? parseSlackPrivacyArgs(rest.filter((arg) => arg !== "privacy")) : parseSlackArgs(rest))],

package/dist/commands/local-help-commands-tower-ops.js

@@ -298,10 +298,12 @@ export const TOWER_OPS_COMMAND_HELP = [
         [
             "Usage: cockpit image describe <file> [--session <id>] [--dashboard-url <url>] [--json]",
             "       cockpit image show <sha256-or-prefix> [--dashboard-url <url>] [--json]",
+            "       cockpit image show <sha256> --bytes <file> [--dashboard-url <url>] [--json]",
             "",
             "Tower swaps the base64 pictures inside collected transcripts for a short written description kept against the image's sha256.",
             "  describe   send one PNG, JPEG, GIF or WebP file (up to 3 MB) to the describe door; prints the description and the marker a transcript would carry",
             "  show       look a stored description up by its sha256, or the first 12 to 64 characters of it (a marker carries 16)",
+            "  show --bytes <file>   write the stored IMAGE to a new file (needs the whole 64-character sha256). Tower keeps the image itself only for machines on the store_and_drop switch; the bytes are decoded, checked against the sha256 and refused if they differ. An existing file is never overwritten.",
             "A file that is too large or not an image is refused here by name, before anything is sent. An image Tower already described answers from storage.",
             "--json writes the door's body to stdout and nothing else; a refusal is { ok: false, error, detail } and exits 1.",
             "The bli-tower MCP server has the twins: image_describe, image_show.",
@@ -409,6 +411,17 @@ export const TOWER_OPS_COMMAND_HELP = [
             "Run `cockpit login` first if this machine is not paired.",
         ],
     ],
+    [
+        "ai-spend",
+        [
+            "Usage: cockpit ai-spend flow [--days <1-365>] [--json]",
+            "       cockpit ai-spend people [--days <1-365>] [--json]",
+            "       cockpit ai-spend output [--days <1-365>] [--json]",
+            "flow: where AI spend went, by what each session's work became: Shipped (a linked PR merged), In review (open), Closed (closed unmerged), No PR (the link check ran and found none), Active (still running) and Unlinked (no branch or commit to check), with dollars, tokens, share and the coverage of the PR link check.",
+            "people: per account and tool, what Tower estimated at list price from session token counts and what the tool itself reported, each labelled by source (estimated, client_reported); actual (vendor-billed) and flat-rate plan cost are named as not connected. output: list-price dollars per expert hour of the merged PRs sessions link to (an AI estimate of hours, not measured time); says no output scores yet when none exist.",
+            "Dollars are API list-price equivalents, not invoices. MCP twins: ai_spend_flow, ai_spend_people, ai_spend_output. Web: TEAM > AI spend.",
+        ],
+    ],
     [
         "ci",
         ["Usage: cockpit ci report [--repo <owner/name>] [--json]", "Reads the daily stored CI report, as-of age and coverage. MCP twin: ci_report."],
@@ -421,6 +434,17 @@ export const TOWER_OPS_COMMAND_HELP = [
             "--review-minutes is an assumption for the review-hours line, not a measurement. Counts show their denominators; no verdict is given. MCP twin: delivery_read. Web: TEAM > Delivery.",
         ],
     ],
+    [
+        "pr-output",
+        [
+            "Usage: cockpit pr-output list [--days <1-365>] [--limit <1-200>] [--cursor <value>] [--json]",
+            "       cockpit pr-output correct <owner/name#number> --hours <0-2000> [--reason <text>] [--json]",
+            "       cockpit pr-output estimate [--limit <1-25>] [--days <1-365>] [--json]",
+            "list: merged PRs with an AI estimate of the hours an expert engineer would have needed before AI (1 unit = 1 expert hour), a one-line reason, type, component, whether a person corrected it, and the coverage line (N of M merged PRs estimated). It is an estimate, not a measured or validated pre-AI time.",
+            "correct: sets your corrected hours on a PR's current estimate; the AI estimate and every earlier correction are kept. estimate: super admin only; estimates merged PRs that have no estimate for their current revision (spends model credit; a re-run on the same revision writes nothing).",
+            "MCP twins: pr_output_list, pr_output_correct, pr_output_estimate. Web: TEAM > Output.",
+        ],
+    ],
     [
         "ops",
         [

package/dist/commands/local-help.js

@@ -32,6 +32,7 @@ export const SURFACE_ALIASES = new Map([
     ["calendar", "cal"],
     ["messages", "msg"],
     ["meeting-notes", "notes"],
+    ["pr", "pr-output"], // BLI-23364: the MCP tools are the `pr_output_*` family
 ]);
 export const rootCommandNames = new Set([
     "roots",
@@ -54,6 +55,8 @@ export const rootCommandNames = new Set([
     "scout",
     "ci",
     "delivery",
+    "pr-output",
+    "ai-spend",
     "ops",
     "slack",
     "settings",
@@ -123,6 +126,8 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit scout [board|start|dismiss|undo <experiment-id>] [--days <n>] [--dashboard-url <url>] [--json]",
     "  cockpit ci report [--repo <owner/name>] [--json]",
     "  cockpit delivery report [--days <1-30>] [--end <YYYY-MM-DD>] [--review-minutes <1-240>] [--json]",
+    "  cockpit pr-output [list [--days <1-365>] [--limit <1-200>] [--cursor <value>] | correct <owner/name#number> --hours <0-2000> [--reason <text>] | estimate [--limit <1-25>] [--days <1-365>]] [--json]",
+    "  cockpit ai-spend (flow | people | output) [--days <1-365>] [--json]",
     "  cockpit ops [status [--job <id>] [--skips] [--memory] [--models] | recompile --person <email|name|id> [--dry-run]] [--dashboard-url <url>] [--json]",
     "  cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [--person <p>] [--channel <c>] [--query <text> [--word]] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--format compact|full]] [--json]",
     "  cockpit settings [personal [--chat-model <key>] [--brief-model <key>] | switches [set <key> <value> | set <key> --clear] | models [set --chat <key>] [--memory <id>] | cli-floor [<version>] | env list|set --project <p> --file <f> --content-stdin|delete --id <uuid> [--yes]] [--json]",
@@ -183,6 +188,7 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit ticket [same verbs and flags as cockpit issue]   (the Tickets page; projects: `cockpit project list`)",
     "  cockpit tickets ...   same as cockpit ticket",
     "  cockpit work ...      same as cockpit ticket (the older name)",
+    "  cockpit pr ...        same as cockpit pr-output (the MCP tools are pr_output_*)",
     "  cockpit calendar [same verbs and flags as cockpit cal]",
     "  cockpit messages [same verbs and flags as cockpit msg]",
     "  cockpit meeting-notes [same verbs and flags as cockpit notes]",

package/dist/commands/local-run-ops.js

@@ -1,6 +1,8 @@
 import { runScout } from "./scout.js";
 import { runCi } from "./ci.js";
 import { runDelivery } from "./delivery.js";
+import { runPrOutput } from "./pr-output.js";
+import { runAiSpend } from "./ai-spend.js";
 import { runOps } from "./ops.js";
 /** Dispatch the operational report commands. */
 export function runOpsCommand(command, io) {
@@ -8,6 +10,8 @@ export function runOpsCommand(command, io) {
         case "scout": return runScout(command, io);
         case "ci": return runCi(command, io);
         case "delivery": return runDelivery(command, io);
+        case "pr-output": return runPrOutput(command, io);
+        case "ai-spend": return runAiSpend(command, io);
         case "ops": return runOps(command, io);
     }
 }

package/dist/commands/local.js

@@ -124,6 +124,8 @@ async function runTowerCommand(command, io) {
         case "scout":
         case "ci":
         case "delivery":
+        case "pr-output":
+        case "ai-spend":
         case "ops":
             return await (await import("./local-run-ops.js")).runOpsCommand(command, io);
         case "slack": return await (await import("./slack.js")).runSlack(command, io);

package/dist/commands/pr-output.js

@@ -0,0 +1,79 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { parseNamedArgs, optionalNonEmpty, optionalUrl } from "./local-arg-values.js";
+const USAGE = [
+    "Usage: cockpit pr-output list [--days <1-365>] [--limit <1-200>] [--cursor <value>] [--json]",
+    "       cockpit pr-output correct <owner/name#number> --hours <0-2000> [--reason <text>] [--json]",
+    "       cockpit pr-output estimate [--limit <1-25>] [--days <1-365>] [--json]",
+].join("\n");
+function bounded(raw, min, max) {
+    if (raw === undefined)
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < min || n > max)
+        throw new Error(USAGE);
+    return n;
+}
+export function parseTarget(raw) {
+    const match = /^([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)#(\d+)$/.exec(raw ?? "");
+    if (!match || Number(match[2]) < 1)
+        throw new Error(USAGE);
+    return { repo: match[1], number: Number(match[2]) };
+}
+export function parsePrOutputArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: ["--days", "--limit", "--cursor", "--hours", "--reason", "--json", "--home", "--dashboard-url"],
+        valueFlags: ["--days", "--limit", "--cursor", "--hours", "--reason", "--home", "--dashboard-url"],
+    });
+    const [action, target, ...rest] = values.positionals;
+    if ((action !== "list" && action !== "correct" && action !== "estimate") || rest.length)
+        throw new Error(USAGE);
+    const common = { kind: "pr-output", action: action, json: values.booleans.has("--json"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")) };
+    const flags = values.flags;
+    if (action === "correct") {
+        const hoursRaw = flags.get("--hours");
+        const hours = hoursRaw === undefined ? NaN : Number(hoursRaw);
+        if (!Number.isFinite(hours) || hours < 0 || hours > 2000 || flags.has("--days") || flags.has("--limit") || flags.has("--cursor"))
+            throw new Error(USAGE);
+        const reason = optionalNonEmpty(flags.get("--reason"));
+        if (reason !== undefined && reason.length > 600)
+            throw new Error(USAGE);
+        return { ...common, ...parseTarget(target), hours, ...(reason !== undefined ? { reason } : {}) };
+    }
+    if (target !== undefined || flags.has("--hours") || flags.has("--reason"))
+        throw new Error(USAGE);
+    if (action === "estimate") {
+        if (flags.has("--cursor"))
+            throw new Error(USAGE);
+        return { ...common, limit: bounded(flags.get("--limit"), 1, 25), days: bounded(flags.get("--days"), 1, 365) };
+    }
+    return { ...common, days: bounded(flags.get("--days"), 1, 365), limit: bounded(flags.get("--limit"), 1, 200), cursor: optionalNonEmpty(flags.get("--cursor")) };
+}
+export async function runPrOutput(command, io) {
+    const door = await openAgentDoor("pr-output", command, io);
+    let request;
+    if (command.action === "list") {
+        const query = new URLSearchParams();
+        if (command.days !== undefined)
+            query.set("days", String(command.days));
+        if (command.limit !== undefined)
+            query.set("limit", String(command.limit));
+        if (command.cursor !== undefined)
+            query.set("cursor", command.cursor);
+        request = { path: `/api/pr-output${query.size ? `?${query}` : ""}`, method: "GET" };
+    }
+    else if (command.action === "correct") {
+        request = { path: "/api/pr-output/correct", method: "POST", body: { repo: command.repo, number: command.number, hours: command.hours, ...(command.reason !== undefined ? { reason: command.reason } : {}) } };
+    }
+    else {
+        request = { path: "/api/pr-output/estimate", method: "POST", body: { ...(command.limit !== undefined ? { limit: command.limit } : {}), ...(command.days !== undefined ? { days: command.days } : {}) } };
+    }
+    const answer = await askAgentDoor(door, { ...request, label: `pr-output ${command.action}`, timeoutMs: command.action === "estimate" ? 300_000 : 30_000 });
+    if (!answer.ok)
+        return failAgentDoor(door, "[pr-output cli]", answer.reason, answer.detail);
+    if (command.json || command.action !== "list")
+        return emitAgentDoor(door, answer.body);
+    for (const line of answer.body.lines)
+        writeLine(io.stdout, line);
+    return 0;
+}

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.277");
+    writeLine(io?.stdout ?? process.stdout, "0.2.279");
     return 0;
   }
 

package/dist/commands/sources-verdict.js

@@ -38,7 +38,7 @@ import path from "node:path";
 import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, REDACTION_STUB_SHA256, } from "@bli-cockpit/telemetry-core";
 import { isWholeFileMask, sanitizeTextEvidenceForUpload } from "../adapters/raw-evidence-sanitize.js";
 import { isSecretLikePath } from "../adapters/raw-evidence-keys.js";
-import { IMAGE_HANDLING_MODE } from "@bli-cockpit/telemetry-core";
+import { IMAGE_HANDLING_MODE, modeDropsImages } from "@bli-cockpit/telemetry-core";
 import { uploadFormOfTranscript } from "../image-description-session.js";
 export async function judgeSource(input) {
     const { file, remotes, cursorEntry } = input;
@@ -161,7 +161,7 @@ export function fileFacts(file, maxBytes = RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
 upload = {}) {
     const mode = upload.mode ?? IMAGE_HANDLING_MODE;
     const describedKeys = upload.describedKeys ?? new Set();
-    const slimAware = upload.slimAware ?? mode === "describe_and_drop";
+    const slimAware = upload.slimAware ?? modeDropsImages(mode);
     const redactForUpload = (text, original) => redactTranscriptForm(file, text, original);
     let split = null;
     let whole = null;

package/dist/evidence-upload-direct.js

@@ -1,7 +1,7 @@
 import { encodeChunkForStorage } from "./evidence-upload-encoding.js";
 import { fetchWithDeadline, isUploadDeadlineError, uploadDeadlineMs } from "./evidence-upload-deadline.js";
 import { noteSyncProgress } from "./sync-lock.js";
-export async function putSignedChunk(options, signedUrl, bytes, uploadId, index, codec = "gzip") {
+export async function putSignedChunk(options, signedUrl, bytes, uploadId, index, codec = "gzip", meter) {
     // Identical manifest + codec framing to the server chunk route staging write (gzip unless the server listed more).
     const encoded = encodeChunkForStorage(bytes, codec);
     console.error("[evidence-upload] chunk encoded for storage", JSON.stringify({
@@ -23,6 +23,8 @@ export async function putSignedChunk(options, signedUrl, bytes, uploadId, index,
             await response.body?.cancel();
             if (response.ok) {
                 noteSyncProgress();
+                if (meter)
+                    meter.wireBytes += encoded.length;
                 const elapsedMs = Date.now() - startedAt;
                 log("signed_chunk_uploaded", uploadId, index, attempt, status, {
                     bytes: encoded.length, elapsed_ms: elapsedMs,