@bli-cockpit/cli 0.2.278 → 0.2.279

package/dist/adapters/codex-session-signals.js

@@ -34,7 +34,11 @@ export async function readCodexMetadataSignals(filePath) {
     const state = makeSignalExtractionState();
     const stream = createReadStream(filePath);
     let byteSize = 0;
-    let lineBuffer = "";
+    // The line being assembled, in the pieces the chunks gave and its byte count kept as a running sum. The
+    // old `lineBuffer += segment` plus `Buffer.byteLength(lineBuffer)` flattened the whole growing string on
+    // every 64 KiB chunk, so a 1 MiB record made about 8 MiB of short-lived copies (BLI-23521).
+    let lineParts = [];
+    let lineBytes = 0;
     let discardingOversizedLine = false;
     for await (const chunk of stream) {
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
@@ -50,25 +54,29 @@ export async function readCodexMetadataSignals(filePath) {
                     discardingOversizedLine = false;
                 continue;
             }
-            lineBuffer += segment;
-            if (Buffer.byteLength(lineBuffer, "utf8") > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
+            lineParts.push(segment);
+            lineBytes += Buffer.byteLength(segment, "utf8");
+            if (lineBytes > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
                 state.lineCount += 1;
                 state.parseErrorCount += 1;
-                lineBuffer = "";
+                lineParts = [];
+                lineBytes = 0;
                 discardingOversizedLine = !lineEnded;
                 continue;
             }
             if (lineEnded) {
-                absorbCodexSessionLine(state, lineBuffer);
-                lineBuffer = "";
+                absorbCodexSessionLine(state, lineParts.length === 1 ? lineParts[0] : lineParts.join(""));
+                lineParts = [];
+                lineBytes = 0;
             }
         }
     }
     const rest = decoder.end();
     if (rest)
-        lineBuffer += rest;
-    if (lineBuffer.trim())
-        absorbCodexSessionLine(state, lineBuffer);
+        lineParts.push(rest);
+    const lastLine = lineParts.join("");
+    if (lastLine.trim())
+        absorbCodexSessionLine(state, lastLine);
     observeSessionFactsFile(state.facts, { bytes: byteSize, lines: state.lineCount });
     return {
         signals: codexSignalsFromState(state),

package/dist/adapters/raw-evidence-facts.js

@@ -269,6 +269,9 @@ function uploadFileFromEntry(entry) {
             ? { artifact_metadata: entry.artifact_metadata }
             : {}),
         ...(entry.snapshot ? { source_key: entry.source_key, snapshot: entry.snapshot } : {}),
+        ...(entry.supersedes?.rule === "prefix" && entry.supersedes.base
+            ? { extend_base: { object_key: entry.supersedes.pointer_id, ...entry.supersedes.base } }
+            : {}),
     };
 }
 function stageReasonLabel(state, priorPackCount) {

package/dist/adapters/raw-evidence-snapshot-supersede.js

@@ -20,7 +20,7 @@
  * says so: `snapshot_rewritten`, both sizes, and the byte range the first
  * difference falls in. Never content.
  */
-import { createReadStream } from "node:fs";
+import { chunksOfFileReusingOneBuffer } from "../evidence-upload-staged.js";
 import { REDACTION_STUB_LABEL } from "@bli-cockpit/telemetry-core";
 import { firstDifferenceRange, isPrefixSuccessor, prefixCheckpoints, prefixDigestsFromStream, } from "@bli-cockpit/telemetry-core/snapshot-supersede";
 /**
@@ -73,7 +73,11 @@ function decideClaim(options, isPrefix, differenceRange) {
             previous_byte_size: prior.byte_size,
             byte_size: options.byteSize,
         }));
-        return { pointer_id: prior.raw_evidence_pointer_id, rule: "prefix" };
+        return {
+            pointer_id: prior.raw_evidence_pointer_id,
+            rule: "prefix",
+            base: { content_hash_sha256: prior.content_hash_sha256, byte_size: prior.byte_size },
+        };
     }
     const range = differenceRange(prior);
     console.error("[evidence-upload] snapshot rewritten, keeping both", JSON.stringify({
@@ -101,7 +105,7 @@ export async function describeStagedSnapshot(options) {
     const priorOffsets = wantClaim
         ? [prior.byte_size, ...Object.keys(prior.checkpoints ?? {}).map(Number)].filter((at) => at > 0 && at <= Math.min(prior.byte_size, byteLength))
         : [];
-    const result = await prefixDigestsFromStream(createReadStream(options.filePath, { highWaterMark: 1024 * 1024 }), [...checkpointOffsets, ...priorOffsets]);
+    const result = await prefixDigestsFromStream(chunksOfFileReusingOneBuffer(options.filePath, 1024 * 1024), [...checkpointOffsets, ...priorOffsets]);
     if (result.total_bytes !== byteLength) {
         // The staged file is not the bytes that were hashed: a claim made on it would be a lie.
         console.error("[evidence-upload] staged file size differs from what was written; no claim", JSON.stringify({

package/dist/adapters/raw-evidence-transcript-body.js

@@ -28,8 +28,22 @@ export function holdDecodedText(source) {
     if (!lossless) {
         console.error("[raw-evidence] transcript is not valid UTF-8; keeping its bytes beside the text so an unchanged file uploads as it is", JSON.stringify({ reason: "invalid_utf8_bytes_kept", byte_size: bytes.byteLength }));
     }
+    if (lossless)
+        releaseBackingStore(bytes);
     return { text, exactBytes: lossless ? null : bytes };
 }
+/**
+ * Free a file-sized buffer now instead of at the next collection (BLI-23521). Dropping the reference only
+ * makes it collectable; an ArrayBuffer is not collected until a GC runs, so on a 10 MB transcript the bytes,
+ * the decoded text and the encoded output were all resident at once (arrayBuffers 21 MB, RSS +30 MB over a
+ * 2.6 MB file). Only a buffer that owns its whole ArrayBuffer is detached: a slice of the shared pool is not ours.
+ */
+function releaseBackingStore(bytes) {
+    const store = bytes.buffer;
+    if (bytes.byteOffset !== 0 || store.byteLength !== bytes.byteLength)
+        return;
+    store.transfer?.(0);
+}
 /**
  * BLI-16977: describe each distinct embedded image once and, when the one switch says so, swap the
  * base64 for a short marker BEFORE masking, so the masker and the content hash see the final bytes.

package/dist/adapters/raw-evidence-transcript-stream.js

@@ -1,6 +1,6 @@
 /**
- * The transcript that is never read whole (BLI-23317): its path goes to the image session's two
- * streaming passes, and what comes back is the one slimmed string the sanitizer takes.
+ * The transcript that is never read whole (BLI-23317; keep mode too since BLI-23524, where the second pass
+ * copies the lines): its path goes to the image session's two streaming passes, and what comes back is the one slimmed string the sanitizer takes.
  *
  * Three endings, each named:
  *  - a body: the text is the slim form of the file (valid UTF-8 was checked across every chunk, so
@@ -38,7 +38,7 @@ export async function streamTranscriptBody(session, agent, file) {
     try {
         const prepared = await session.prepareTranscriptFile({ filePath: file.filePath, source: agent, sessionId: file.sessionId, maxFileBytes: file.maxFileBytes, stageDir: file.stageDir, omitText: file.stageDir !== undefined, ...(file.provenance ? { provenance: file.provenance } : {}) });
         const { volatile, pendingImages } = volatilityOf(session.mode, prepared);
-        console.error(TAG + " transcript streamed through image swap and slim", JSON.stringify({ kind: file.kind, byte_size: prepared.readBytes, changed: prepared.changed, images: prepared.imageCount, volatile, staged_bytes: prepared.staged?.byteLength ?? null }));
+        console.error(TAG + " transcript streamed through image swap and slim", JSON.stringify({ kind: file.kind, mode: session.mode, byte_size: prepared.readBytes, changed: prepared.changed, images: prepared.imageCount, volatile, staged_bytes: prepared.staged?.byteLength ?? null }));
         // BLI-23344: with a spool the text is not read back; the sanitizer reads the spool line by line.
         return { held: { text: prepared.staged ? null : prepared.text, exactBytes: null, ...(prepared.staged ? { staged: prepared.staged } : {}) }, volatile, pendingImages, readBytes: prepared.readBytes };
     }

package/dist/commands/ai-spend.js

@@ -0,0 +1,32 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { parseNamedArgs, optionalNonEmpty, optionalUrl } from "./local-arg-values.js";
+const USAGE = "Usage: cockpit ai-spend flow|people|output [--days <1-365>] [--json]";
+export function parseAiSpendArgs(args) {
+    const values = parseNamedArgs(args, { allowedFlags: ["--days", "--json", "--home", "--dashboard-url"], valueFlags: ["--days", "--home", "--dashboard-url"] });
+    const [action, ...rest] = values.positionals;
+    if ((action !== "flow" && action !== "people" && action !== "output") || rest.length)
+        throw new Error(USAGE);
+    const raw = values.flags.get("--days");
+    let days;
+    if (raw !== undefined) {
+        days = Number(raw);
+        if (!Number.isInteger(days) || days < 1 || days > 365)
+            throw new Error(USAGE);
+    }
+    return { kind: "ai-spend", action, days, json: values.booleans.has("--json"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")) };
+}
+export async function runAiSpend(command, io) {
+    const door = await openAgentDoor("ai-spend", command, io);
+    const query = new URLSearchParams({ view: command.action });
+    if (command.days !== undefined)
+        query.set("days", String(command.days));
+    const answer = await askAgentDoor(door, { path: `/api/ai-spend?${query}`, method: "GET", label: `ai-spend ${command.action}`, timeoutMs: 30_000 });
+    if (!answer.ok)
+        return failAgentDoor(door, "[ai-spend cli]", answer.reason, answer.detail);
+    if (command.json)
+        return emitAgentDoor(door, answer.body);
+    for (const line of answer.body.lines)
+        writeLine(io.stdout, line);
+    return 0;
+}

package/dist/commands/local-args-tower.js

@@ -57,4 +57,6 @@ export { parseGlossaryArgs } from "./glossary.js";
 export { parseSpendArgs } from "./spend.js";
 export { parsePushArgs } from "./push.js";
 export { parseCiArgs } from "./ci.js";
-export { parseDeliveryArgs } from "./delivery.js";
+export { parseDeliveryArgs } from "./delivery.js";
+export { parsePrOutputArgs } from "./pr-output.js";
+export { parseAiSpendArgs } from "./ai-spend.js";

package/dist/commands/local-args.js

@@ -23,7 +23,7 @@ import { parseSlackPrivacyArgs } from "./slack-privacy-args.js";
 import { parseMilestoneArgs } from "./local-args-tower-milestone.js";
 import { SURFACE_ALIASES } from "./local-help.js";
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
-import { parseCiArgs, parseDeliveryArgs, parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseSetupArgs, parseSpeedArgs, parseLogsArgs, parseBrainArgs, parseHitsArgs, parseIntentionsArgs, parseWhoArgs, parsePeopleArgs, parseApprovalsArgs, parseDrillsArgs, parseManagerArgs, parseImageArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
+import { parseCiArgs, parseDeliveryArgs, parsePrOutputArgs, parseAiSpendArgs, parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseSetupArgs, parseSpeedArgs, parseLogsArgs, parseBrainArgs, parseHitsArgs, parseIntentionsArgs, parseWhoArgs, parsePeopleArgs, parseApprovalsArgs, parseDrillsArgs, parseManagerArgs, parseImageArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
 // `normalizeUrl` has always been part of this module's surface — `local.ts` and
 // `local-auth.ts` import it from here — so it stays exported from this address
 // even though it now lives next door. The same goes for the four names the
@@ -67,6 +67,8 @@ const COMMAND_PARSERS = new Map([
     ["scout", (_command, rest) => parseScoutArgs(rest)],
     ["ci", (_command, rest) => parseCiArgs(rest)],
     ["delivery", (_command, rest) => parseDeliveryArgs(rest)],
+    ["pr-output", (_command, rest) => parsePrOutputArgs(rest)],
+    ["ai-spend", (_command, rest) => parseAiSpendArgs(rest)],
     ["ops", (_command, rest) => parseOpsArgs(rest)],
     // BLI-23244: `slack privacy` has its own flags and its own file.
     ["slack", (_command, rest) => (rest.includes("privacy") ? parseSlackPrivacyArgs(rest.filter((arg) => arg !== "privacy")) : parseSlackArgs(rest))],

package/dist/commands/local-help-commands-tower-ops.js

@@ -411,6 +411,17 @@ export const TOWER_OPS_COMMAND_HELP = [
             "Run `cockpit login` first if this machine is not paired.",
         ],
     ],
+    [
+        "ai-spend",
+        [
+            "Usage: cockpit ai-spend flow [--days <1-365>] [--json]",
+            "       cockpit ai-spend people [--days <1-365>] [--json]",
+            "       cockpit ai-spend output [--days <1-365>] [--json]",
+            "flow: where AI spend went, by what each session's work became: Shipped (a linked PR merged), In review (open), Closed (closed unmerged), No PR (the link check ran and found none), Active (still running) and Unlinked (no branch or commit to check), with dollars, tokens, share and the coverage of the PR link check.",
+            "people: per account and tool, what Tower estimated at list price from session token counts and what the tool itself reported, each labelled by source (estimated, client_reported); actual (vendor-billed) and flat-rate plan cost are named as not connected. output: list-price dollars per expert hour of the merged PRs sessions link to (an AI estimate of hours, not measured time); says no output scores yet when none exist.",
+            "Dollars are API list-price equivalents, not invoices. MCP twins: ai_spend_flow, ai_spend_people, ai_spend_output. Web: TEAM > AI spend.",
+        ],
+    ],
     [
         "ci",
         ["Usage: cockpit ci report [--repo <owner/name>] [--json]", "Reads the daily stored CI report, as-of age and coverage. MCP twin: ci_report."],
@@ -423,6 +434,17 @@ export const TOWER_OPS_COMMAND_HELP = [
             "--review-minutes is an assumption for the review-hours line, not a measurement. Counts show their denominators; no verdict is given. MCP twin: delivery_read. Web: TEAM > Delivery.",
         ],
     ],
+    [
+        "pr-output",
+        [
+            "Usage: cockpit pr-output list [--days <1-365>] [--limit <1-200>] [--cursor <value>] [--json]",
+            "       cockpit pr-output correct <owner/name#number> --hours <0-2000> [--reason <text>] [--json]",
+            "       cockpit pr-output estimate [--limit <1-25>] [--days <1-365>] [--json]",
+            "list: merged PRs with an AI estimate of the hours an expert engineer would have needed before AI (1 unit = 1 expert hour), a one-line reason, type, component, whether a person corrected it, and the coverage line (N of M merged PRs estimated). It is an estimate, not a measured or validated pre-AI time.",
+            "correct: sets your corrected hours on a PR's current estimate; the AI estimate and every earlier correction are kept. estimate: super admin only; estimates merged PRs that have no estimate for their current revision (spends model credit; a re-run on the same revision writes nothing).",
+            "MCP twins: pr_output_list, pr_output_correct, pr_output_estimate. Web: TEAM > Output.",
+        ],
+    ],
     [
         "ops",
         [

package/dist/commands/local-help.js

@@ -32,6 +32,7 @@ export const SURFACE_ALIASES = new Map([
     ["calendar", "cal"],
     ["messages", "msg"],
     ["meeting-notes", "notes"],
+    ["pr", "pr-output"], // BLI-23364: the MCP tools are the `pr_output_*` family
 ]);
 export const rootCommandNames = new Set([
     "roots",
@@ -54,6 +55,8 @@ export const rootCommandNames = new Set([
     "scout",
     "ci",
     "delivery",
+    "pr-output",
+    "ai-spend",
     "ops",
     "slack",
     "settings",
@@ -123,6 +126,8 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit scout [board|start|dismiss|undo <experiment-id>] [--days <n>] [--dashboard-url <url>] [--json]",
     "  cockpit ci report [--repo <owner/name>] [--json]",
     "  cockpit delivery report [--days <1-30>] [--end <YYYY-MM-DD>] [--review-minutes <1-240>] [--json]",
+    "  cockpit pr-output [list [--days <1-365>] [--limit <1-200>] [--cursor <value>] | correct <owner/name#number> --hours <0-2000> [--reason <text>] | estimate [--limit <1-25>] [--days <1-365>]] [--json]",
+    "  cockpit ai-spend (flow | people | output) [--days <1-365>] [--json]",
     "  cockpit ops [status [--job <id>] [--skips] [--memory] [--models] | recompile --person <email|name|id> [--dry-run]] [--dashboard-url <url>] [--json]",
     "  cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [--person <p>] [--channel <c>] [--query <text> [--word]] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--format compact|full]] [--json]",
     "  cockpit settings [personal [--chat-model <key>] [--brief-model <key>] | switches [set <key> <value> | set <key> --clear] | models [set --chat <key>] [--memory <id>] | cli-floor [<version>] | env list|set --project <p> --file <f> --content-stdin|delete --id <uuid> [--yes]] [--json]",
@@ -183,6 +188,7 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit ticket [same verbs and flags as cockpit issue]   (the Tickets page; projects: `cockpit project list`)",
     "  cockpit tickets ...   same as cockpit ticket",
     "  cockpit work ...      same as cockpit ticket (the older name)",
+    "  cockpit pr ...        same as cockpit pr-output (the MCP tools are pr_output_*)",
     "  cockpit calendar [same verbs and flags as cockpit cal]",
     "  cockpit messages [same verbs and flags as cockpit msg]",
     "  cockpit meeting-notes [same verbs and flags as cockpit notes]",

package/dist/commands/local-run-ops.js

@@ -1,6 +1,8 @@
 import { runScout } from "./scout.js";
 import { runCi } from "./ci.js";
 import { runDelivery } from "./delivery.js";
+import { runPrOutput } from "./pr-output.js";
+import { runAiSpend } from "./ai-spend.js";
 import { runOps } from "./ops.js";
 /** Dispatch the operational report commands. */
 export function runOpsCommand(command, io) {
@@ -8,6 +10,8 @@ export function runOpsCommand(command, io) {
         case "scout": return runScout(command, io);
         case "ci": return runCi(command, io);
         case "delivery": return runDelivery(command, io);
+        case "pr-output": return runPrOutput(command, io);
+        case "ai-spend": return runAiSpend(command, io);
         case "ops": return runOps(command, io);
     }
 }

package/dist/commands/local.js

@@ -124,6 +124,8 @@ async function runTowerCommand(command, io) {
         case "scout":
         case "ci":
         case "delivery":
+        case "pr-output":
+        case "ai-spend":
         case "ops":
             return await (await import("./local-run-ops.js")).runOpsCommand(command, io);
         case "slack": return await (await import("./slack.js")).runSlack(command, io);

package/dist/commands/pr-output.js

@@ -0,0 +1,79 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { parseNamedArgs, optionalNonEmpty, optionalUrl } from "./local-arg-values.js";
+const USAGE = [
+    "Usage: cockpit pr-output list [--days <1-365>] [--limit <1-200>] [--cursor <value>] [--json]",
+    "       cockpit pr-output correct <owner/name#number> --hours <0-2000> [--reason <text>] [--json]",
+    "       cockpit pr-output estimate [--limit <1-25>] [--days <1-365>] [--json]",
+].join("\n");
+function bounded(raw, min, max) {
+    if (raw === undefined)
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < min || n > max)
+        throw new Error(USAGE);
+    return n;
+}
+export function parseTarget(raw) {
+    const match = /^([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)#(\d+)$/.exec(raw ?? "");
+    if (!match || Number(match[2]) < 1)
+        throw new Error(USAGE);
+    return { repo: match[1], number: Number(match[2]) };
+}
+export function parsePrOutputArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: ["--days", "--limit", "--cursor", "--hours", "--reason", "--json", "--home", "--dashboard-url"],
+        valueFlags: ["--days", "--limit", "--cursor", "--hours", "--reason", "--home", "--dashboard-url"],
+    });
+    const [action, target, ...rest] = values.positionals;
+    if ((action !== "list" && action !== "correct" && action !== "estimate") || rest.length)
+        throw new Error(USAGE);
+    const common = { kind: "pr-output", action: action, json: values.booleans.has("--json"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")) };
+    const flags = values.flags;
+    if (action === "correct") {
+        const hoursRaw = flags.get("--hours");
+        const hours = hoursRaw === undefined ? NaN : Number(hoursRaw);
+        if (!Number.isFinite(hours) || hours < 0 || hours > 2000 || flags.has("--days") || flags.has("--limit") || flags.has("--cursor"))
+            throw new Error(USAGE);
+        const reason = optionalNonEmpty(flags.get("--reason"));
+        if (reason !== undefined && reason.length > 600)
+            throw new Error(USAGE);
+        return { ...common, ...parseTarget(target), hours, ...(reason !== undefined ? { reason } : {}) };
+    }
+    if (target !== undefined || flags.has("--hours") || flags.has("--reason"))
+        throw new Error(USAGE);
+    if (action === "estimate") {
+        if (flags.has("--cursor"))
+            throw new Error(USAGE);
+        return { ...common, limit: bounded(flags.get("--limit"), 1, 25), days: bounded(flags.get("--days"), 1, 365) };
+    }
+    return { ...common, days: bounded(flags.get("--days"), 1, 365), limit: bounded(flags.get("--limit"), 1, 200), cursor: optionalNonEmpty(flags.get("--cursor")) };
+}
+export async function runPrOutput(command, io) {
+    const door = await openAgentDoor("pr-output", command, io);
+    let request;
+    if (command.action === "list") {
+        const query = new URLSearchParams();
+        if (command.days !== undefined)
+            query.set("days", String(command.days));
+        if (command.limit !== undefined)
+            query.set("limit", String(command.limit));
+        if (command.cursor !== undefined)
+            query.set("cursor", command.cursor);
+        request = { path: `/api/pr-output${query.size ? `?${query}` : ""}`, method: "GET" };
+    }
+    else if (command.action === "correct") {
+        request = { path: "/api/pr-output/correct", method: "POST", body: { repo: command.repo, number: command.number, hours: command.hours, ...(command.reason !== undefined ? { reason: command.reason } : {}) } };
+    }
+    else {
+        request = { path: "/api/pr-output/estimate", method: "POST", body: { ...(command.limit !== undefined ? { limit: command.limit } : {}), ...(command.days !== undefined ? { days: command.days } : {}) } };
+    }
+    const answer = await askAgentDoor(door, { ...request, label: `pr-output ${command.action}`, timeoutMs: command.action === "estimate" ? 300_000 : 30_000 });
+    if (!answer.ok)
+        return failAgentDoor(door, "[pr-output cli]", answer.reason, answer.detail);
+    if (command.json || command.action !== "list")
+        return emitAgentDoor(door, answer.body);
+    for (const line of answer.body.lines)
+        writeLine(io.stdout, line);
+    return 0;
+}

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.278");
+    writeLine(io?.stdout ?? process.stdout, "0.2.279");
     return 0;
   }
 

package/dist/evidence-upload-direct.js

@@ -1,7 +1,7 @@
 import { encodeChunkForStorage } from "./evidence-upload-encoding.js";
 import { fetchWithDeadline, isUploadDeadlineError, uploadDeadlineMs } from "./evidence-upload-deadline.js";
 import { noteSyncProgress } from "./sync-lock.js";
-export async function putSignedChunk(options, signedUrl, bytes, uploadId, index, codec = "gzip") {
+export async function putSignedChunk(options, signedUrl, bytes, uploadId, index, codec = "gzip", meter) {
     // Identical manifest + codec framing to the server chunk route staging write (gzip unless the server listed more).
     const encoded = encodeChunkForStorage(bytes, codec);
     console.error("[evidence-upload] chunk encoded for storage", JSON.stringify({
@@ -23,6 +23,8 @@ export async function putSignedChunk(options, signedUrl, bytes, uploadId, index,
             await response.body?.cancel();
             if (response.ok) {
                 noteSyncProgress();
+                if (meter)
+                    meter.wireBytes += encoded.length;
                 const elapsedMs = Date.now() - startedAt;
                 log("signed_chunk_uploaded", uploadId, index, attempt, status, {
                     bytes: encoded.length, elapsed_ms: elapsedMs,

package/dist/evidence-upload-object.js

@@ -1,10 +1,46 @@
 import { putSignedChunk } from "./evidence-upload-direct.js";
 import { compressEvidenceBytes } from "@bli-cockpit/telemetry-core/evidence-storage-encoding";
 import { chooseUploadEncoding } from "./evidence-upload-encoding.js";
-import { COMMIT_CRASHED_PLATFORM, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
+import { COMMIT_CRASHED_PLATFORM, EXTEND_BASE_UNAVAILABLE, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
 import { StagedFileError, readVerifiedChunk } from "./evidence-upload-staged.js";
 import { beginOneObject } from "./evidence-upload-terminal.js";
 import { isNonJsonResponseBody, requestJson, safeFailureDetail, } from "./evidence-upload-transport.js";
+/**
+ * The chunk plan this `begin` answer commits us to (BLI-23345): the tail plan when the server accepted
+ * exactly the one we offered, the whole file otherwise. A tail plan the server states differently from
+ * ours is not guessed at; the caller re-offers the whole object, which resets the row.
+ */
+function planForDisposition(entry, disposition) {
+    const accepted = disposition.extend;
+    const tail = entry.tail;
+    if (!accepted) {
+        if (tail) {
+            console.error("[evidence-upload] tail upload not used; sending the whole object", JSON.stringify({
+                reason: disposition.extend_refused ? `extend_refused:${disposition.extend_refused}` : "extend_not_answered",
+                upload_id: disposition.upload_id, byte_size: entry.byteSize,
+            }));
+        }
+        return { plan: "whole", view: entry };
+    }
+    if (!tail || accepted.base_object_key !== tail.base.object_key || accepted.base_content_hash_sha256 !== tail.base.content_hash_sha256
+        || accepted.base_byte_size !== tail.base.byte_size || accepted.tail_offset !== tail.offset
+        || accepted.tail_size !== tail.byteSize || accepted.chunk_count !== tail.chunkCount) {
+        return { plan: "mismatch" };
+    }
+    return { plan: "tail", view: { ...entry, byteSize: tail.byteSize, chunkHashes: tail.chunkHashes, chunkCount: tail.chunkCount, readOffset: tail.offset } };
+}
+/**
+ * Re-offer the whole object from the same staged file: begin without the tail plan resets the server's
+ * row to a whole plan, so nothing is lost and nothing is double-counted.
+ */
+async function reofferWhole(options, entry, chunkSizeBytes, restageAttempted, reason, uploadId) {
+    console.error("[evidence-upload] re-offering the whole object", JSON.stringify({ reason, upload_id: uploadId, byte_size: entry.byteSize }));
+    const wholeEntry = { ...entry, tail: undefined, readOffset: undefined, duplicates: [] };
+    const restarted = await beginOneObject(options, wholeEntry, chunkSizeBytes);
+    if (!restarted)
+        return failedOutcome(entry.file, `${reason}:begin_failed`);
+    return uploadOneObject(options, wholeEntry, restarted, chunkSizeBytes, restageAttempted);
+}
 export async function uploadOneObject(options, entry, disposition, chunkSizeBytes, restageAttempted = false) {
     const objectKey = entry.file.pointer.object_key ?? "";
     if (disposition.disposition === "already_committed") {
@@ -15,11 +51,19 @@ export async function uploadOneObject(options, entry, disposition, chunkSizeByte
     if (disposition.disposition === "conflict" || !disposition.upload_id) {
         return failedOutcome(entry.file, disposition.reason ?? "upload_conflict");
     }
+    const picked = planForDisposition(entry, disposition);
+    if (picked.plan === "mismatch")
+        return reofferWhole(options, entry, chunkSizeBytes, restageAttempted, "extend_plan_mismatch", disposition.upload_id);
+    const view = picked.view;
     const directChunks = [];
-    const chunked = await uploadObjectChunks(options, entry, disposition, chunkSizeBytes, objectKey, directChunks);
+    const chunked = await uploadObjectChunks(options, view, disposition, chunkSizeBytes, objectKey, directChunks, picked.plan, entry.byteSize);
     if (!chunked.ok)
         return chunked.outcome;
-    const committed = await commitUploadedObject(options, entry, disposition, objectKey, chunked.uploadedChunks, directChunks);
+    const committed = await commitUploadedObject(options, view, disposition, objectKey, chunked.uploadedChunks, directChunks);
+    if (picked.plan === "tail" && committed.reason === `commit_failed_http_409_${EXTEND_BASE_UNAVAILABLE}`) {
+        // The base was deleted (supersede) between begin and commit. The staged whole file is intact.
+        return reofferWhole(options, entry, chunkSizeBytes, restageAttempted, EXTEND_BASE_UNAVAILABLE, disposition.upload_id);
+    }
     if (committed.reason !== "commit_failed_http_409_staging_missing_between_passes")
         return committed;
     if (restageAttempted)
@@ -36,9 +80,10 @@ export async function uploadOneObject(options, entry, disposition, chunkSizeByte
     }
     return retried;
 }
-async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, objectKey, directChunks) {
+async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, objectKey, directChunks, plan, wholeByteSize) {
     const received = new Set(disposition.received_chunk_indexes);
     let uploadedChunks = 0;
+    const meter = { wireBytes: 0 };
     if (disposition.disposition === "already_committed" || disposition.commit_ready) {
         return { ok: true, uploadedChunks };
     }
@@ -55,7 +100,7 @@ async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, o
         try {
             // Re-read from disk by offset and check against the plan-time hash; the
             // buffer lives only for this iteration (BLI-23317).
-            chunk = await readVerifiedChunk(entry.file.local_path, index * chunkSizeBytes, Math.min(chunkSizeBytes, entry.byteSize - index * chunkSizeBytes), entry.chunkHashes[index]);
+            chunk = await readVerifiedChunk(entry.file.local_path, (entry.readOffset ?? 0) + index * chunkSizeBytes, Math.min(chunkSizeBytes, entry.byteSize - index * chunkSizeBytes), entry.chunkHashes[index]);
         }
         catch (error) {
             const reason = error instanceof StagedFileError ? error.reason : "file_read_failed";
@@ -67,7 +112,7 @@ async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, o
         }
         const offer = disposition.signed_uploads?.find(upload => upload.chunk_index === index);
         const direct = offer
-            ? await putSignedChunk(options, offer.signed_url, chunk, disposition.upload_id, index, encoding.codec)
+            ? await putSignedChunk(options, offer.signed_url, chunk, disposition.upload_id, index, encoding.codec, meter)
             : "refused";
         if (direct === "deadline") {
             // BLI-22801: the chunk route would push the same bytes over the same slow link.
@@ -82,19 +127,27 @@ async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, o
             uploadedChunks += 1;
             continue;
         }
-        const failure = await uploadChunkThroughEndpoint(options, entry, disposition, objectKey, index, chunk, uploadedChunks, Boolean(offer), encoding.codec);
+        const failure = await uploadChunkThroughEndpoint(options, entry, disposition, objectKey, index, chunk, uploadedChunks, Boolean(offer), encoding.codec, meter);
         if (failure)
             return failure;
         uploadedChunks += 1;
     }
+    // The number the ticket is measured by: compressed bytes that actually crossed the wire for this object,
+    // against the whole object it replaced (sizes and labels only).
+    console.error("[evidence-upload] object bytes sent", JSON.stringify({
+        reason: "object_bytes_sent", upload_id: disposition.upload_id, plan,
+        whole_byte_size: wholeByteSize, planned_byte_size: entry.byteSize, chunks_sent: uploadedChunks,
+        wire_bytes_sent: meter.wireBytes, chunk_encoding: encoding.codec,
+    }));
     return { ok: true, uploadedChunks };
 }
-async function uploadChunkThroughEndpoint(options, entry, disposition, objectKey, index, chunk, uploadedChunks, hadSignedOffer, codec) {
+async function uploadChunkThroughEndpoint(options, entry, disposition, objectKey, index, chunk, uploadedChunks, hadSignedOffer, codec, meter) {
     console.error("[evidence-upload] using chunk route", JSON.stringify({
         reason: hadSignedOffer ? "signed_upload_refused_fallback" : "signed_upload_not_offered",
         upload_id: disposition.upload_id, chunk_index: index,
     }));
     const encodedChunk = compressEvidenceBytes(chunk, codec);
+    meter.wireBytes += encodedChunk.length;
     console.error("[evidence-upload] chunk encoded", JSON.stringify({
         upload_id: disposition.upload_id, chunk_index: index, chunk_encoding: codec,
         bytes_before: chunk.length, bytes_after: encodedChunk.length,

package/dist/evidence-upload-plan.js

@@ -4,12 +4,13 @@ import { requestJson, safeFailureDetail } from "./evidence-upload-transport.js";
 import { failedOutcome, uploadOneObject } from "./evidence-upload-object.js";
 import { duplicateOutcome, rekeyConflictedEntry, reportAbandonedUpload, } from "./evidence-upload-terminal.js";
 import { describeError } from "./health-detail.js";
-import { StagedFileError, fingerprintStagedFile } from "./evidence-upload-staged.js";
+import { StagedFileError, fingerprintStagedFile, fingerprintStagedTail, } from "./evidence-upload-staged.js";
 export async function loadPlannedEntries(options, chunkSizeBytes, outcomes) {
     const loaded = [];
     const loadedByObjectKey = new Map();
     for (const file of options.files) {
-        const measured = await measureStagedUpload(file, chunkSizeBytes, outcomes);
+        const base = tailBaseFor(file, chunkSizeBytes);
+        const measured = await measureStagedUpload(file, chunkSizeBytes, outcomes, base?.byte_size);
         if (!measured)
             continue;
         // Content-addressed keys collide for byte-identical files (e.g. a resumed
@@ -28,6 +29,7 @@ export async function loadPlannedEntries(options, chunkSizeBytes, outcomes) {
             objectSha256: measured.objectSha256,
             chunkHashes: measured.chunkHashes,
             chunkCount: measured.chunkHashes.length,
+            ...(base ? await planTail(file, base, measured, chunkSizeBytes) : {}),
             duplicates: [],
         };
         loaded.push(entry);
@@ -37,7 +39,62 @@ export async function loadPlannedEntries(options, chunkSizeBytes, outcomes) {
     }
     return loaded;
 }
-async function measureStagedUpload(file, chunkSizeBytes, outcomes) {
+/** A transcript that extends a committed snapshot by at least one chunk's worth is worth a tail plan. */
+function tailBaseFor(file, chunkSizeBytes) {
+    const base = file.extend_base;
+    if (!base || (file.pointer.byte_size ?? 0) <= base.byte_size)
+        return null;
+    if (base.byte_size < chunkSizeBytes)
+        return null;
+    return base;
+}
+/** The tail plan, or nothing: the base must still be exactly the staged file's first bytes. */
+async function planTail(file, base, measured, chunkSizeBytes) {
+    if (measured.prefixSha256 !== base.content_hash_sha256) {
+        // The prepare step proved this prefix a moment ago; the file moved since. Whole upload, said out loud.
+        console.error("[evidence-upload] tail upload not planned; the staged file no longer starts with its base", JSON.stringify({
+            reason: "extend_prefix_changed", kind: file.kind ?? "unknown", byte_size: measured.byteSize, base_byte_size: base.byte_size,
+        }));
+        return {};
+    }
+    try {
+        const chunkHashes = await fingerprintStagedTail(file.local_path, measured.byteSize, base.byte_size, chunkSizeBytes);
+        console.error("[evidence-upload] tail planned", JSON.stringify({
+            reason: "extend_planned", kind: file.kind ?? "unknown", byte_size: measured.byteSize,
+            base_byte_size: base.byte_size, tail_byte_size: measured.byteSize - base.byte_size, tail_chunk_count: chunkHashes.length,
+        }));
+        return { tail: { base, offset: base.byte_size, byteSize: measured.byteSize - base.byte_size, chunkHashes, chunkCount: chunkHashes.length } };
+    }
+    catch (error) {
+        console.error("[evidence-upload] tail upload not planned; the staged file could not be read", JSON.stringify({
+            reason: "extend_tail_unreadable", byte_size: measured.byteSize,
+            detail: error instanceof StagedFileError ? error.reason : "read_error",
+        }));
+        return {};
+    }
+}
+/** One `begin` object. The tail plan rides only where `tailAllowed` (an old server answers 400 to the extra field). */
+export function beginObjectFor(entry, chunkSizeBytes, tailAllowed) {
+    const tail = tailAllowed ? entry.tail : undefined;
+    return {
+        pointer: entry.file.pointer,
+        chunk_size_bytes: chunkSizeBytes,
+        chunk_count: tail ? tail.chunkCount : entry.chunkCount,
+        ...(tail ? { extend: {
+                base_object_key: tail.base.object_key,
+                base_content_hash_sha256: tail.base.content_hash_sha256,
+                base_byte_size: tail.base.byte_size,
+            } } : {}),
+        // BLI-23329: an image-store object names the session it is staged for.
+        ...(entry.file.image_use ? { image_use: entry.file.image_use } : {}),
+    };
+}
+/** Runs that learned the server does not know tail plans; the answer holds for the rest of the run. */
+const serverWithoutTailPlans = new WeakSet();
+export function tailPlansAllowed(options) {
+    return !serverWithoutTailPlans.has(options);
+}
+async function measureStagedUpload(file, chunkSizeBytes, outcomes, prefixAt) {
     let stat;
     try {
         stat = await fs.stat(file.local_path);
@@ -64,7 +121,7 @@ async function measureStagedUpload(file, chunkSizeBytes, outcomes) {
         return null;
     }
     try {
-        const fingerprint = await fingerprintStagedFile(file.local_path, stat.size, chunkSizeBytes);
+        const fingerprint = await fingerprintStagedFile(file.local_path, stat.size, chunkSizeBytes, undefined, prefixAt);
         console.error("[evidence-upload] staged object measured", JSON.stringify({
             byte_size: fingerprint.byteSize,
             chunk_count: fingerprint.chunkHashes.length,
@@ -108,18 +165,23 @@ export function batches(items, size) {
  * so each branch stays a guard clause rather than nested conditionals.
  */
 export async function resolveBeginBatch(options, totalLoadedCount, batch, chunkSizeBytes, outcomes, resolvedEntries) {
+    const offersTails = tailPlansAllowed(options) && batch.some((entry) => entry.tail);
     const begin = await requestJson(options, "/api/ambient/evidence/upload/begin", {
         schema_version: "ambient-raw-evidence-upload-begin.v1",
         generated_at: options.generatedAt,
         provenance: options.provenance,
-        objects: batch.map((entry) => ({
-            pointer: entry.file.pointer,
-            chunk_size_bytes: chunkSizeBytes,
-            chunk_count: entry.chunkCount,
-            // BLI-23329: an image-store object names the session it is staged for.
-            ...(entry.file.image_use ? { image_use: entry.file.image_use } : {}),
-        })),
+        objects: batch.map((entry) => beginObjectFor(entry, chunkSizeBytes, tailPlansAllowed(options))),
     });
+    if (offersTails && begin.status === 400) {
+        // A server from before BLI-23345 rejects the extra field. Ask again as every collector always has,
+        // and remember for the run; server deploys first, so this is the rollout window only.
+        serverWithoutTailPlans.add(options);
+        console.error("[evidence-upload] server does not know tail plans; offering whole objects", JSON.stringify({
+            reason: "extend_not_supported", http_status: begin.status, server_reason: safeFailureDetail(begin.body) ?? "none",
+            objects_in_batch: batch.length,
+        }));
+        return resolveBeginBatch(options, totalLoadedCount, batch, chunkSizeBytes, outcomes, resolvedEntries);
+    }
     // 404 means an old dashboard without the chunk routes; a persistent 5xx
     // (after retries) covers a new dashboard whose ledger migration has not
     // been applied yet. Both still serve the legacy v1 route.
@@ -243,6 +305,8 @@ export function readBeginDispositions(body) {
             received_chunk_indexes: entry.received_chunk_indexes,
             commit_ready: entry.commit_ready === true,
             signed_uploads: entry.signed_uploads,
+            ...(entry.extend ? { extend: entry.extend } : {}),
+            ...(entry.extend_refused ? { extend_refused: entry.extend_refused } : {}),
             reason: entry.reason ?? null,
             raw_evidence_pointer_id: entry.raw_evidence_pointer_id,
             ...(entry.accepted_encodings ? { accepted_encodings: entry.accepted_encodings } : {}),

package/dist/evidence-upload-staged.js

@@ -11,9 +11,14 @@ export class StagedFileError extends Error {
         this.detail = detail;
     }
 }
-/** Read exactly `length` bytes at `position`, looping over short reads. */
-export async function readExactly(handle, length, position) {
-    const buffer = Buffer.allocUnsafe(length);
+/**
+ * Read exactly `length` bytes at `position`, looping over short reads. With `into` (at least `length` bytes) the
+ * read lands in that buffer and the answer is a view of it, so a loop over a big file allocates once instead of
+ * once per chunk (BLI-23524: per-chunk buffers are garbage the collector reclaims lazily, and a 100 MB file
+ * left tens of MB of it resident).
+ */
+export async function readExactly(handle, length, position, into) {
+    const buffer = into ? into.subarray(0, length) : Buffer.allocUnsafe(length);
     let filled = 0;
     while (filled < length) {
         const { bytesRead } = await handle.read(buffer, filled, length - filled, position + filled);
@@ -28,25 +33,87 @@ export async function readExactly(handle, length, position) {
  * one chunk. Throws StagedFileError when the file vanishes or its length
  * moves while it is being read.
  */
-export async function fingerprintStagedFile(localPath, expectedSize, chunkSizeBytes, openFile = fs.open) {
+export async function fingerprintStagedFile(localPath, expectedSize, chunkSizeBytes, openFile = fs.open, prefixAt) {
     const handle = await openStaged(localPath, openFile);
     try {
         const whole = crypto.createHash("sha256");
         const chunkHashes = [];
+        // One buffer for every chunk: each is hashed before the next read, and none is kept.
+        const reused = Buffer.allocUnsafeSlow(Math.min(chunkSizeBytes, Math.max(expectedSize, 1)));
+        let prefixSha256;
         for (let offset = 0; offset < expectedSize; offset += chunkSizeBytes) {
             const want = Math.min(chunkSizeBytes, expectedSize - offset);
-            const chunk = await readExactly(handle, want, offset);
+            const chunk = await readExactly(handle, want, offset, reused);
             if (chunk.length !== want) {
                 throw new StagedFileError("staged_file_changed", "file shrank while planning");
             }
-            whole.update(chunk);
+            if (prefixAt !== undefined && prefixAt > offset && prefixAt <= offset + want) {
+                const cut = prefixAt - offset;
+                whole.update(chunk.subarray(0, cut));
+                prefixSha256 = whole.copy().digest("hex");
+                whole.update(chunk.subarray(cut));
+            }
+            else {
+                whole.update(chunk);
+            }
             chunkHashes.push(crypto.createHash("sha256").update(chunk).digest("hex"));
         }
         const probe = await readExactly(handle, 1, expectedSize);
         if (probe.length !== 0) {
             throw new StagedFileError("staged_file_changed", "file grew while planning");
         }
-        return { byteSize: expectedSize, objectSha256: whole.digest("hex"), chunkHashes };
+        return {
+            byteSize: expectedSize,
+            objectSha256: whole.digest("hex"),
+            chunkHashes,
+            ...(prefixSha256 !== undefined ? { prefixSha256 } : {}),
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * The chunk hashes of the TAIL of a staged file, `[start, expectedSize)` cut into chunks that begin at
+ * `start` (BLI-23345). One pass over the tail only; memory is one chunk.
+ */
+export async function fingerprintStagedTail(localPath, expectedSize, start, chunkSizeBytes, openFile = fs.open) {
+    const handle = await openStaged(localPath, openFile);
+    try {
+        const chunkHashes = [];
+        const reused = Buffer.allocUnsafeSlow(Math.min(chunkSizeBytes, Math.max(expectedSize - start, 1)));
+        for (let offset = start; offset < expectedSize; offset += chunkSizeBytes) {
+            const want = Math.min(chunkSizeBytes, expectedSize - offset);
+            const chunk = await readExactly(handle, want, offset, reused);
+            if (chunk.length !== want) {
+                throw new StagedFileError("staged_file_changed", "file shrank while planning the tail");
+            }
+            chunkHashes.push(crypto.createHash("sha256").update(chunk).digest("hex"));
+        }
+        return chunkHashes;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * The file's bytes in order, `chunkBytes` at a time, every piece a view of the SAME buffer: valid until the next
+ * piece is asked for, so a consumer must use it (hash it, count it) before looping on. Memory is one chunk
+ * whatever the file's size; the descriptor closes when the consumer stops, however it stops. A failed read throws,
+ * never ends the stream early (BLI-23524).
+ */
+export async function* chunksOfFileReusingOneBuffer(localPath, chunkBytes) {
+    const handle = await openStaged(localPath, fs.open);
+    try {
+        const buffer = Buffer.allocUnsafeSlow(chunkBytes);
+        for (let position = 0;; position += chunkBytes) {
+            const { bytesRead } = await handle.read(buffer, 0, chunkBytes, position);
+            if (bytesRead === 0)
+                return;
+            yield buffer.subarray(0, bytesRead);
+            if (bytesRead < chunkBytes)
+                return;
+        }
     }
     finally {
         await handle.close();

package/dist/evidence-upload-terminal.js

@@ -1,5 +1,5 @@
 import { RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, isImageObjectKey, isRekeyableUploadConflict, } from "@bli-cockpit/telemetry-core";
-import { readBeginDispositions } from "./evidence-upload-plan.js";
+import { beginObjectFor, readBeginDispositions, tailPlansAllowed } from "./evidence-upload-plan.js";
 import { rekeyedEvidencePointer } from "./evidence-upload-rekey.js";
 import { requestJson, safeFailureDetail } from "./evidence-upload-transport.js";
 /**
@@ -71,14 +71,7 @@ export async function beginOneObject(options, entry, chunkSizeBytes) {
         schema_version: "ambient-raw-evidence-upload-begin.v1",
         generated_at: options.generatedAt,
         provenance: options.provenance,
-        objects: [
-            {
-                pointer: entry.file.pointer,
-                chunk_size_bytes: chunkSizeBytes,
-                chunk_count: entry.chunkCount,
-                ...(entry.file.image_use ? { image_use: entry.file.image_use } : {}),
-            },
-        ],
+        objects: [beginObjectFor(entry, chunkSizeBytes, tailPlansAllowed(options))],
     });
     if (!response.ok) {
         console.error("[evidence-rekey] begin refused the re-keyed object; keeping the original conflict", JSON.stringify({

package/dist/image-description-session.js

@@ -17,6 +17,7 @@ import { addPdfsToFinds, mergeOccurrences, pdfsOfText } from "./pdf-transcript-s
 import { openPinnedTranscript } from "./adapters/pinned-transcript.js";
 import { openStagedOutput, readStagedText } from "./adapters/staged-output.js";
 import { TranscriptNotStreamable } from "./adapters/transcript-text-stream.js";
+import { copyLinesStream } from "./slim/keep-line-copy.js";
 import { LineBytesSink, slimLineStream } from "./slim/slim-stream.js";
 import { logSlimmed, slimOrKeep, slimPassOrNull, slimTranscript } from "./slim/slim-transcript.js";
 import { imageStateKey, readDescribedImageKeys, readFailedImages, writeImageDescriptionState, } from "./image-description-state.js";
@@ -72,7 +73,7 @@ export async function openImageDescriptions(options) {
             const slim = slimOrKeep(replaced.text, input.source, { sessionId: input.sessionId });
             return { ...afterImages, text: slim.text, changed: slim.text !== input.text, slim: slim.stats };
         },
-        prepareTranscriptFile: modeDropsImages(mode) ? (input) => prepareFileInTwoPasses(run, input) : undefined,
+        prepareTranscriptFile: (input) => prepareFileInTwoPasses(run, input),
     };
 }
 /** Files smaller than this are cheaper to read whole; the streamed path pays a second read. */
@@ -139,7 +140,9 @@ async function prepareFileInTwoPasses(run, input) {
         const census = await censusOfLines(source.lines());
         // Describe attempts finish and the swap decisions are settled before a single line is swapped, as with the whole text.
         // BLI-23347: the census also found the PDFs; they are converted here and swapped in the same pass as the images.
-        const pdfFinds = await addPdfsToFinds(findsOfCensus(census, source), census.pdfs, pdfContext(run, {
+        const keeps = !modeDropsImages(run.mode); // BLI-23524: nothing is swapped, so no PDFs and pass two is a copy
+        const imageFinds = findsOfCensus(census, source);
+        const pdfFinds = keeps ? imageFinds : await addPdfsToFinds(imageFinds, census.pdfs, pdfContext(run, {
             stateDir: run.options.stateDir,
             read: (pdf) => source.read(pdf.base64Start, pdf.base64End - pdf.base64Start),
             changed: () => new TranscriptNotStreamable("file_changed_during_pass"),
@@ -148,14 +151,15 @@ async function prepareFileInTwoPasses(run, input) {
         // Pass two: swap and slim over exactly the bytes pass one saw, writing the result to staging as it goes.
         writer = input.stageDir ? await openStagedOutput(input.stageDir) : undefined;
         const memory = writer ? undefined : new LineBytesSink(source.length);
-        const slim = await slimLineStream(source.lines(), input.source, mergeOccurrences(census.occurrences, finds.extraOccurrences), replace, writer ?? memory);
+        const slim = keeps ? await copyLinesStream(source.lines(), writer ?? memory) : await slimLineStream(source.lines(), input.source, mergeOccurrences(census.occurrences, finds.extraOccurrences), replace, writer ?? memory);
         if (slim.replacedCount !== afterImages.replacedCount)
             throw new TranscriptNotStreamable("images_changed_between_passes");
         await source.verifyUnchanged();
         const staged = await writer?.finish();
         // The sanitizer reads the whole text: from the staged file when one was written, else from the sink's buffer.
         const text = staged ? (input.omitText ? "" : await readStagedText(staged)) : memory.text();
-        logSlimmed(input.source, input.sessionId, slim.stats, startedAt);
+        if (slim.stats)
+            logSlimmed(input.source, input.sessionId, slim.stats, startedAt);
         return { ...afterImages, text, changed: slim.changed, slim: slim.stats, readBytes: source.length, ...(staged ? { staged } : {}) };
     }
     catch (error) {

package/dist/slim/keep-line-copy.js

@@ -0,0 +1,34 @@
+/**
+ * Pass two of the streamed transcript when the machine keeps its images (`describe_and_keep`, BLI-23524).
+ *
+ * Keep mode never swaps an image and never slims, so the upload is the file itself. The drop modes' pass two
+ * (`slim-stream.ts`) rebuilds each line; this one copies each line, in order, to the same `LineSink`, so the file
+ * never sits in memory beside its decoded text and its re-encoded output (a 500 MB cap meant 2 to 3 copies).
+ *
+ * Byte identity with the whole-file read is by construction: the lines are cut at 0x0a (the same cut as splitting
+ * the decoded text at "\n" for valid UTF-8), joined again with "\n", and decoded with the same rules as
+ * `Buffer.toString("utf8")` (a BOM stays a character). A file that is not valid UTF-8 is not copied at all: the
+ * whole-file path uploads such a file's original bytes, and only a whole read can keep them, so the caller is told
+ * `invalid_utf8` and reads it whole. (The census pass has already refused such a file before any image was sent;
+ * this check is the same one at the copy, so a file rewritten between the passes cannot slip through.)
+ */
+import { TextDecoder } from "node:util";
+import { TranscriptNotStreamable } from "../adapters/transcript-text-stream.js";
+export async function copyLinesStream(lines, sink) {
+    const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+    let count = 0;
+    for await (const { bytes } of lines) {
+        let line;
+        try {
+            line = decoder.decode(bytes);
+        }
+        catch {
+            throw new TranscriptNotStreamable("invalid_utf8");
+        }
+        if (count > 0)
+            await sink.write("\n");
+        count += 1;
+        await sink.write(line);
+    }
+    return { stats: null, replacedCount: 0, charsSaved: 0, changed: false, lines: count };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.278",
+  "version": "0.2.279",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.85",
-    "@bli-cockpit/mcp": "0.1.169",
-    "@bli-cockpit/telemetry-core": "0.1.92",
+    "@bli-cockpit/memory-mcp": "0.1.86",
+    "@bli-cockpit/mcp": "0.1.170",
+    "@bli-cockpit/telemetry-core": "0.1.93",
     "unpdf": "1.8.1"
   },
   "repository": {