@bli-cockpit/cli 0.2.286 → 0.2.287

package/dist/commands/shelf.js

@@ -0,0 +1,165 @@
+/**
+ * `cockpit shelf …` (BLI-23478, three-shelves design 9.1 item 7): a founder's shelf settings on THIS laptop.
+ *
+ *   cockpit shelf status                         the lock, the default, and what is in the drawer here
+ *   cockpit shelf default team|drawer            where work outside every labelled folder goes
+ *   cockpit shelf metrics --allow day,tool,model,spawn|none
+ *                                                the opt-in categories on a drawer session's bare record
+ *   cockpit shelf drawer purge --older-than <days>
+ *                                                the ONLY way drawer items are removed
+ *
+ * A machine command: it acts on this laptop and calls no Tower door. `safe` is refused everywhere until the safe is
+ * live (`safe_not_live`); `default drawer` is refused on a laptop Tower has not named an owner's.
+ *
+ * Logs carry labels and counts only.
+ */
+import os from "node:os";
+import { safeLog, SHELF_METRIC_CATEGORIES } from "@bli-cockpit/telemetry-core";
+import { listDrawerItems, purgeDrawerItems } from "@bli-cockpit/memory-mcp/dist/drawer-spool.js";
+import { ensureLocalCollectorConfig, getCollectorRuntimePaths, readLocalCollectorConfig } from "../local-state.js";
+import { writeJsonFile } from "../local-state-files.js";
+import { readRootLabels } from "../root-work.js";
+import { countShelvedSessions } from "../shelf-reports.js";
+import { readShelfState } from "../shelf-state.js";
+import { askFounderLive, OWNER_CHECK_UNAVAILABLE } from "../shelf-decision.js";
+import { configForDisk } from "../source-opt-out.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "shelf";
+export const SHELF_USAGE = "Usage: cockpit shelf status | default team|drawer | metrics --allow <day,tool,model,spawn|none> | drawer purge --older-than <days> [--json]";
+export function parseShelfArgs(args) {
+    const positional = [];
+    let homeDir;
+    let allow;
+    let olderThan;
+    let json = false;
+    for (let index = 0; index < args.length; index++) {
+        const token = args[index];
+        if (token === "--json") {
+            json = true;
+            continue;
+        }
+        if (token === "--home-dir" && args[index + 1]) {
+            homeDir = args[++index];
+            continue;
+        }
+        if (token === "--allow" && args[index + 1]) {
+            allow = args[++index];
+            continue;
+        }
+        if (token === "--older-than" && args[index + 1]) {
+            olderThan = args[++index];
+            continue;
+        }
+        if (token.startsWith("--"))
+            throw new Error(`Unknown shelf flag: ${token}`);
+        positional.push(token);
+    }
+    const [action, value, extra] = positional;
+    if (action === "status" && !value)
+        return { kind: "shelf", action, homeDir, json };
+    if (action === "default" && value && !extra)
+        return { kind: "shelf", action, shelf: value, homeDir, json };
+    if (action === "metrics" && !value && allow !== undefined) {
+        const words = allow.split(",").map((word) => word.trim()).filter(Boolean);
+        const chosen = words.length === 1 && words[0] === "none" ? [] : words;
+        const unknown = chosen.filter((word) => !SHELF_METRIC_CATEGORIES.includes(word));
+        if (unknown.length > 0 || chosen.length === 0 && words[0] !== "none")
+            throw new Error(SHELF_USAGE);
+        return { kind: "shelf", action, allow: [...new Set(chosen)], homeDir, json };
+    }
+    if (action === "drawer" && value === "purge" && !extra && olderThan !== undefined) {
+        const days = Number(olderThan.replace(/d$/u, ""));
+        if (!Number.isInteger(days) || days < 0)
+            throw new Error("--older-than takes a whole number of days, e.g. 30 or 30d.");
+        return { kind: "shelf", action: "purge", olderThanDays: days, homeDir, json };
+    }
+    throw new Error(SHELF_USAGE);
+}
+export async function runShelf(command, io) {
+    const homeDir = command.homeDir ?? os.homedir();
+    if (command.action === "status")
+        return shelfStatus(homeDir, command.json, io);
+    if (command.action === "purge") {
+        const result = purgeDrawerItems(command.olderThanDays, { homeDir });
+        writeLine(io.stdout, command.json
+            ? JSON.stringify({ ok: result.failed === 0, ...result })
+            : `Removed ${result.removed} drawer item(s) older than ${command.olderThanDays} days; ${result.kept} kept${result.failed ? `; ${result.failed} could not be removed` : ""}.`);
+        return result.failed === 0 ? 0 : 1;
+    }
+    const { config, paths } = await ensureLocalCollectorConfig({ homeDir });
+    if (command.action === "metrics") {
+        await writeJsonFile(paths.config_file, configForDisk({ ...config, shelf_metrics_allow: command.allow }));
+        safeLog(TAG, "shelf_metrics_allow_set", { categories: command.allow.join(",") || "none" });
+        writeLine(io.stdout, command.json
+            ? JSON.stringify({ ok: true, shelf_metrics_allow: command.allow })
+            : `Bare records from this laptop now carry: the always-sent numbers${command.allow.length ? ` plus ${command.allow.join(", ")}` : " only"}.`);
+        return 0;
+    }
+    const refuse = (reason, message) => {
+        safeLog(TAG, "shelf_default_refused", { refused: reason });
+        writeLine(command.json ? io.stdout : io.stderr, command.json ? JSON.stringify({ ok: false, reason, message }) : message);
+        return 1;
+    };
+    if (command.shelf === "safe")
+        return refuse("safe_not_live", "The safe is not live on this laptop yet. Use drawer: it stays on this laptop.");
+    if (command.shelf !== "team" && command.shelf !== "drawer")
+        return refuse("unknown_shelf", "The default is team or drawer.");
+    // Tower is asked live (never the saved heartbeat copy): only a founder may make the drawer the default.
+    const founder = command.shelf === "drawer" ? await askFounderLive({ homeDir, fetchImpl: io.fetch }) : null;
+    if (founder?.standing === "unknown")
+        return refuse(OWNER_CHECK_UNAVAILABLE, "Tower could not be asked whether this is a founder's laptop, so nothing changed. Try again shortly.");
+    if (founder && founder.standing !== "founder")
+        return refuse("shelf_owner_only", "The drawer is for founders' laptops, and Tower says this is not one.");
+    await writeJsonFile(paths.config_file, configForDisk({ ...config, shelf_default: command.shelf }));
+    safeLog(TAG, "shelf_default_set", { shelf: command.shelf });
+    writeLine(io.stdout, command.json
+        ? JSON.stringify({ ok: true, shelf_default: command.shelf })
+        : `Work outside every labelled folder now goes to: ${command.shelf}.`);
+    return 0;
+}
+async function shelfStatus(homeDir, json, io) {
+    const paths = getCollectorRuntimePaths(homeDir);
+    const state = readShelfState(homeDir);
+    const [labels, sessions, config] = await Promise.all([
+        readRootLabels(paths).catch(() => ({})),
+        countShelvedSessions(paths),
+        // Read only: status never creates a config on a laptop that has none.
+        readLocalCollectorConfig(paths).catch(() => null),
+    ]);
+    const drawer = listDrawerItems({ homeDir });
+    const oldest = [sessions.oldest, drawer.oldest].filter((value) => Boolean(value)).sort()[0] ?? null;
+    const status = {
+        is_owner: state?.is_owner ?? null,
+        founder_routing_enabled: state?.founder_routing_enabled ?? null,
+        shelf_enforced: state?.shelf_enforced ?? null,
+        cli_too_old: state?.cli_too_old ?? null,
+        lock_checked_at: state?.checked_at ?? null,
+        shelf_default: config?.shelf_default ?? "team",
+        shelf_metrics_allow: config?.shelf_metrics_allow ?? [],
+        labelled_folders: Object.keys(labels).length,
+        drawer_folders: Object.values(labels).filter((label) => label !== "team").length,
+        drawer_sessions: sessions.sessions,
+        drawer_memory_items: drawer.items.length,
+        drawer_corrupt_items: drawer.corrupt,
+        drawer_oldest: oldest,
+        drawer_backed_up: false,
+    };
+    safeLog(TAG, "shelf_status_read", {
+        drawer_sessions: status.drawer_sessions,
+        drawer_memory_items: status.drawer_memory_items,
+        drawer_corrupt_items: status.drawer_corrupt_items,
+        labelled_folders: status.labelled_folders,
+    });
+    if (json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...status }));
+        return 0;
+    }
+    const owner = status.is_owner === true ? "a founder's laptop" : status.is_owner === false ? "not a founder's laptop" : "not yet checked in with Tower";
+    writeLine(io.stdout, `Shelves on this laptop (${owner}).`);
+    writeLine(io.stdout, `  Tower's founder lock: ${status.founder_routing_enabled === true ? "on" : status.founder_routing_enabled === false ? "off" : "unknown"}${status.cli_too_old ? " (this CLI is too old; run cockpit update)" : ""}.`);
+    writeLine(io.stdout, `  Outside every labelled folder: ${status.shelf_default}. Labelled folders: ${status.labelled_folders} (${status.drawer_folders} drawer).`);
+    writeLine(io.stdout, `  ${status.drawer_sessions} sessions and ${status.drawer_memory_items} memory items in the drawer on this laptop; not backed up; oldest ${oldest ? oldest.slice(0, 10) : "none"}.`);
+    if (status.drawer_corrupt_items > 0)
+        writeLine(io.stdout, `  ${status.drawer_corrupt_items} drawer file(s) could not be read; they are kept and never sent.`);
+    return 0;
+}

package/dist/commands/sources-check.js

@@ -19,7 +19,7 @@
  * "not stored". A list cut short (`capped`, `failed_partial`) still answers,
  * marked incomplete: a missing page can only understate what Tower holds.
  */
-import { resolveSourceSwitches } from "../source-opt-out.js";
+import { readSourceSwitches } from "../source-opt-out.js";
 import { fetchSourceInventory, reconcileSource } from "./sources-reconciliation.js";
 import { writeLine } from "./cli-io.js";
 import { readDescribedImageKeys } from "../image-description-state.js";
@@ -52,7 +52,7 @@ export async function runSourcesCheck(command, io, now = new Date()) {
     }
     const homeDir = command.homeDir ?? paths.home_dir;
     const olderThanMs = command.olderThanDays === null ? null : now.getTime() - command.olderThanDays * DAY_MS;
-    const switches = resolveSourceSwitches(config);
+    const switches = await readSourceSwitches(config, paths, "sources_check", { fetch: io.fetch });
     const optOutClaude = command.reconcile === true && !switches.claude;
     const optOutCodex = command.reconcile === true && !switches.codex;
     const optOutAll = optOutClaude && optOutCodex;

package/dist/commands/sources-reconciliation.js

@@ -1,5 +1,6 @@
 /** Metadata reconciliation only. Never writes cursors, starts collection or fetches bodies. */
 import fs from "node:fs/promises";
+import { collectorShelfHeaders } from "../shelf-headers.js";
 const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 export async function fetchSourceInventory(options) {
     const rows = new Map();
@@ -9,7 +10,7 @@ export async function fetchSourceInventory(options) {
         for (let page = 0; page < (options.maxPages ?? 400); page++) {
             result.requested += 500;
             const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/evidence/transcripts?inventory=1`, {
-                method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${options.deviceToken}` },
+                method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${options.deviceToken}`, ...collectorShelfHeaders() },
                 body: JSON.stringify({ schema_version: "evidence-transcripts.v1", after, limit: 500 }),
                 signal: AbortSignal.timeout(30_000),
             });

package/dist/commands/sync-doctor.js

@@ -15,6 +15,7 @@ import { runSelfUpdate } from "./install-update.js";
 import { reportInstallEventsBestEffort } from "./install-receipts.js";
 import { clearDoctorRequest, requestedDoctorId } from "./sync-doctor-request.js";
 import { envWithNodeRuntimeOnPath } from "../scheduled-self-update.js";
+import { collectorShelfHeaders } from "../shelf-headers.js";
 export async function runDoctorAfterSync(command, io, dashboardUrl, overrides = {}, facts) {
     if (shouldSuppressFleetReceipts({ dashboardUrl }).suppressed) {
         console.error("[sync-doctor] checkout does not repair the fleet machine", JSON.stringify({ reason: "receipt_suppressed:dev_build" }));
@@ -149,7 +150,7 @@ async function postReceipt(receipt, command, io, dashboardUrl) {
     }
     try {
         const response = await io.fetch(`${dashboardUrl}/api/ambient/devices/${encodeURIComponent(session.device_id)}/doctor`, {
-            method: "PATCH", headers: { "Content-Type": "application/json", Authorization: `Bearer ${session.device_token}` },
+            method: "PATCH", headers: { "Content-Type": "application/json", Authorization: `Bearer ${session.device_token}`, ...collectorShelfHeaders() },
             body: JSON.stringify(receipt), signal: AbortSignal.timeout(5_000),
         });
         console.error("[sync-doctor] receipt delivery", JSON.stringify({ reason: response.ok ? "receipt_recorded" : "receipt_rejected", http_status: response.status, request_id: receipt.request_id }));

package/dist/commands/sync-receipt.js

@@ -150,5 +150,6 @@ function heartbeatCounts(run) {
         outsideRootDirectories: run.outsideRootDirectories,
         sessionsNewThisTick: run.sessionsNewThisTick,
         sessionsPendingUpload: run.sessionsPendingUpload,
+        ...(run.collectionScope ? { collectionScope: run.collectionScope } : {}),
     };
 }

package/dist/commands/sync-report.js

@@ -158,6 +158,7 @@ function syncResult(run) {
         outsideRootDirectories: run.outside_root_directories,
         sessionsNewThisTick: run.sessions_new_this_tick,
         sessionsPendingUpload: run.sessions_pending_upload,
+        ...(run.collection_scope ? { collectionScope: run.collection_scope } : {}),
     };
 }
 /** The local raw-evidence sweep a successful run earns before it reports. */

package/dist/commands/sync-stub-heal.js

@@ -14,7 +14,7 @@
  * of the operator's machines is not this machine's to heal; it is counted as
  * remaining and skipped without a scan. Never throws and never fails the tick.
  */
-import { resolveSourceSwitches } from "../source-opt-out.js";
+import { readSourceSwitches } from "../source-opt-out.js";
 import { runBackfill } from "./backfill.js";
 import { loadStubReofferPlan } from "./backfill-stub-reoffer.js";
 import { backfillWaitingCheck } from "./sync-yield.js";
@@ -62,7 +62,7 @@ async function runStubPass(command, io, deps, now, summary) {
     const sessionFile = await readLocalCollectorSessionFile(paths).catch(() => null);
     if (!sessionFile)
         return "no_device_session";
-    const switches = resolveSourceSwitches(config);
+    const switches = await readSourceSwitches(config, paths, "stub_heal");
     const sources = [
         ...(switches.codex ? ["codex"] : []),
         ...(switches.claude ? ["claude_code"] : []),

package/dist/commands/sync.js

@@ -47,11 +47,13 @@ import { runSyncWithHealthReceipt } from "./sync-receipt.js";
 import { runAutostartSelfHealAfterSync, runMemoryInstallAfterSync, runScheduledSelfUpdateAfterSync, runStagingPruneAfterSync, } from "./sync-followups.js";
 import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
 import { settleTickImageModeBestEffort } from "../image-mode-state.js";
+import { settleTickCollectionScopeBestEffort } from "../collection-scope.js";
 import { stampSyncTick } from "../sync-tick-stamp.js";
 import { withCommandGuard } from "../command-guard.js";
 import { installHttp1GlobalFetch } from "../http1-fetch.js";
 import { startTickTimer } from "../sync-tick-timing.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
+import { refreshFounderStandingForOptOuts } from "../capture-opt-outs.js";
 /**
  * The tick, timed (BLI-12872): ends with one `[sync] tick finished` line that
  * carries its duration and the time spent in each step, win or throw. The
@@ -113,6 +115,14 @@ async function reexecuteSync(command, io) {
     return result.code;
 }
 async function collectAndReportTick(command, io, tick, dashboardUrl) {
+    // BLI-22640: a machine that holds an opt-out asks Tower whether its person is
+    // a founder BEFORE anything is collected, so this tick obeys or ignores the
+    // opt-out on Tower's current answer. Never throws; asks nothing otherwise.
+    await refreshFounderStandingForOptOuts({
+        ...(command.homeDir ? { homeDir: command.homeDir } : {}),
+        dashboardUrl,
+        fetch: io.fetch,
+    });
     try {
         const result = await tick.collect(() => runSyncWithHealthReceipt(command, io));
         // BLI-3551: every tick checks in, including one that collected nothing.
@@ -167,6 +177,8 @@ async function reportTickStarted(command, io, dashboardUrl) {
     // BLI-17273: the reply also names this machine's image-handling mode. Put it on file BEFORE
     // collection starts (the uploader reads the file); an offline tick keeps the last value on file.
     await settleTickImageModeBestEffort(getCollectorRuntimePaths(command.homeDir).state_dir, observed.imageHandlingMode);
+    // BLI-23590: and this person's collection scope. On file BEFORE collection starts, because the scan reads it.
+    await settleTickCollectionScopeBestEffort(getCollectorRuntimePaths(command.homeDir).state_dir, observed.collectionScope);
     return minCliVersion;
 }
 /** Post the receipt the run earned, whatever it says. */

package/dist/error-message.js

@@ -0,0 +1,11 @@
+/**
+ * The one-line text of a thrown value. A leaf with no imports on purpose:
+ * `tower-client.ts` needs it, and pulling it from `commands/cli-io.ts` dragged
+ * the whole CLI import graph (autostart, admin, the argument parsers) into every
+ * reader that only wanted Tower's answer, including the dashboard's typecheck.
+ *
+ * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
+ */
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/evidence-reconcile-client.js

@@ -23,6 +23,7 @@ import { describeError } from "./health-detail.js";
 import { getCollectorRuntimePaths, readLocalCollectorSessionFile } from "./local-state.js";
 import { readReconcileCursor, recordReconcileResult, writeReconcileCursor, } from "./cursors/raw-evidence-reconcile-cursor.js";
 import { readStagingInventory } from "./disk-usage.js";
+import { collectorShelfHeaders } from "./shelf-headers.js";
 const RECONCILE_BATCH_TIMEOUT_MS = 15_000;
 /** The prune the sync tick and `cockpit clean --reconcile` both call. Never throws. */
 export async function runEvidenceReconcile(options) {
@@ -178,6 +179,7 @@ async function sendReconcileBatch(options) {
             headers: {
                 "Content-Type": "application/json",
                 Authorization: `Bearer ${options.deviceToken}`,
+                ...collectorShelfHeaders(),
             },
             body: JSON.stringify({
                 schema_version: EVIDENCE_RECONCILE_SCHEMA_VERSION,

package/dist/evidence-redelivery-plan.js

@@ -33,6 +33,7 @@
  */
 import fs from "node:fs/promises";
 import path from "node:path";
+import { COLLECTION_SCOPE_ROOTS_ONLY_REASON } from "@bli-cockpit/telemetry-core";
 import { RAW_EVIDENCE_BUCKET, RAW_EVIDENCE_RETENTION_MODE, } from "./adapters/raw-evidence-manifest.js";
 import { RAW_EVIDENCE_DIR } from "./disk-usage.js";
 import { describeError } from "./health-detail.js";
@@ -107,6 +108,11 @@ export async function planEvidenceRedelivery(options) {
             countUnplannable(plan, "manifest_unreadable");
             continue;
         }
+        if (options.withholdRepoLabels &&
+            [manifest.provenance.repo, manifest.provenance.repo_label].some((label) => label && options.withholdRepoLabels.has(label))) {
+            countUnplannable(plan, COLLECTION_SCOPE_ROOTS_ONLY_REASON);
+            continue;
+        }
         const row = manifest.files.get(object.relative_path);
         if (!row) {
             countUnplannable(plan, "no_manifest_row");

package/dist/evidence-redelivery.js

@@ -27,7 +27,9 @@ import { planEvidenceRedelivery, } from "./evidence-redelivery-plan.js";
 import { markObjectCommitted, readRawEvidenceCursor, writeRawEvidenceCursor, } from "./cursors/raw-evidence-cursor.js";
 import { readStagingInventory } from "./disk-usage.js";
 import { describeError } from "./health-detail.js";
-import { getCollectorRuntimePaths, readLocalCollectorSessionFile, } from "./local-state.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "./local-state.js";
+import { settleCollectionScope } from "./collection-scope.js";
+import { OUTSIDE_ROOTS_WORKSPACE_LABEL } from "./commands/backfill-outside-roots.js";
 import { clearDeliveryAttempt, readRawEvidenceStagingState, recordDeliveryFailure, terminalDeliveryReason, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
 /**
  * The drain the sync tick runs and `cockpit doctor`'s disk fix reuses.
@@ -49,11 +51,14 @@ export async function runEvidenceRedelivery(options) {
             return { ...emptyResult("nothing_uncommitted", "ok"), terminal: inventory.terminal_count ?? 0, terminal_bytes: inventory.terminal_bytes ?? 0 };
         }
         const staging = await readRawEvidenceStagingState(paths.state_dir);
+        // BLI-23590: a person on `roots_only` never re-offers what was staged for an outside-root session.
+        const scope = await settleCollectionScope(paths.state_dir, (await readLocalCollectorConfig(paths).catch(() => null))?.collection_scope);
         const plan = await planEvidenceRedelivery({
             stateDir: paths.state_dir,
             inventory,
             staging,
             now,
+            ...(scope.scope === "roots_only" ? { withholdRepoLabels: new Set([OUTSIDE_ROOTS_WORKSPACE_LABEL]) } : {}),
             ...(options.maxBytes != null ? { maxBytes: options.maxBytes } : {}),
             ...(options.maxObjects != null ? { maxObjects: options.maxObjects } : {}),
         });

package/dist/evidence-stubs-client.js

@@ -20,6 +20,7 @@
  */
 import { EVIDENCE_STUBS_MAX_PAGE, EVIDENCE_STUBS_SCHEMA_VERSION, EvidenceStubsResponseSchema, transcriptSessionFromObjectKey, } from "@bli-cockpit/telemetry-core";
 import { describeError } from "./health-detail.js";
+import { collectorShelfHeaders } from "./shelf-headers.js";
 const STUBS_PAGE_TIMEOUT_MS = 15_000;
 export const STUBS_DEFAULT_MAX_PAGES = 20;
 export function stubSessionKey(source, sessionId) {
@@ -91,6 +92,7 @@ async function requestPage(options) {
             headers: {
                 "Content-Type": "application/json",
                 Authorization: `Bearer ${options.deviceToken}`,
+                ...collectorShelfHeaders(),
             },
             body: JSON.stringify({
                 schema_version: EVIDENCE_STUBS_SCHEMA_VERSION,

package/dist/evidence-transcripts-client.js

@@ -14,6 +14,7 @@
  */
 import { EVIDENCE_TRANSCRIPTS_MAX_PAGE, EVIDENCE_TRANSCRIPTS_SCHEMA_VERSION, EvidenceTranscriptsResponseSchema, transcriptFileFromObjectKey, transcriptFileKey, } from "@bli-cockpit/telemetry-core";
 import { describeError } from "./health-detail.js";
+import { collectorShelfHeaders } from "./shelf-headers.js";
 const TRANSCRIPTS_PAGE_TIMEOUT_MS = 30_000;
 /** 400 pages of 500 is 200,000 current transcript objects: far past any operator today. */
 export const TRANSCRIPTS_DEFAULT_MAX_PAGES = 400;
@@ -95,6 +96,7 @@ async function requestPage(options) {
             headers: {
                 "Content-Type": "application/json",
                 Authorization: `Bearer ${options.deviceToken}`,
+                ...collectorShelfHeaders(),
             },
             body: JSON.stringify({
                 schema_version: EVIDENCE_TRANSCRIPTS_SCHEMA_VERSION,

package/dist/evidence-upload-transport.js

@@ -4,6 +4,7 @@ import { localEncodings } from "./evidence-upload-encoding.js";
 import { describeError } from "./health-detail.js";
 import { fetchWithDeadline, isUploadDeadlineError, uploadDeadlineMs } from "./evidence-upload-deadline.js";
 import { noteSyncProgress } from "./sync-lock.js";
+import { collectorShelfHeaders } from "./shelf-headers.js";
 /**
  * The `send` stage: one retrying POST to an evidence-upload route, plus the
  * response-body plumbing every later stage reads a reason off of.
@@ -27,6 +28,7 @@ export async function requestJson(options, routePath, body) {
                 headers: {
                     "Authorization": `Bearer ${options.deviceToken}`,
                     "Content-Type": "application/json",
+                    ...collectorShelfHeaders(),
                     ...(routePath.endsWith("/evidence/upload/begin")
                         ? { "x-tower-evidence-direct": "staged-gzip-v1", [EVIDENCE_CODECS_HEADER]: localEncodings().join(",") } : {}),
                 },

package/dist/founder-standing-file.js

@@ -0,0 +1,52 @@
+import { FOUNDER_STANDING_FILE_NAME, parseFounderStanding, renderFounderStanding, } from "@bli-cockpit/telemetry-core";
+import fs from "node:fs/promises";
+import path from "node:path";
+function standingPath(paths) {
+    return path.join(paths.state_dir, FOUNDER_STANDING_FILE_NAME);
+}
+/** The last answer Tower gave this machine. Never throws: no file, or an unreadable one, is `unknown`. */
+export async function readFounderStanding(paths) {
+    let raw;
+    try {
+        raw = await fs.readFile(standingPath(paths), "utf8");
+    }
+    catch (error) {
+        const code = error?.code;
+        if (code !== "ENOENT" && code !== "ENOTDIR") {
+            console.error("[founder-standing] standing file unreadable; treating it as unknown", JSON.stringify({ reason: "standing_unreadable", error_code: code ?? "unknown" }));
+            return { standing: "unknown", reason: "standing_unreadable", record: null };
+        }
+        raw = null;
+    }
+    return parseFounderStanding(raw);
+}
+/**
+ * Records one Tower answer. Never throws: a reader then sees the previous
+ * answer, and this line says why the new one did not land. Logs both branches,
+ * and says when the answer changed.
+ */
+export async function recordFounderStanding(paths, founder, source, now = new Date()) {
+    const before = await readFounderStanding(paths);
+    try {
+        await fs.mkdir(paths.state_dir, { recursive: true, mode: 0o700 });
+        // A file a person made read-only would keep a stale answer; take the mode
+        // back first (no-op when it is not there). Both macOS and Windows honour it.
+        await fs.chmod(standingPath(paths), 0o600).catch(() => undefined);
+        await fs.writeFile(standingPath(paths), renderFounderStanding({ founder, checked_at: now.toISOString(), source }), { encoding: "utf8", mode: 0o600 });
+    }
+    catch (error) {
+        console.error("[founder-standing] Tower's answer could not be recorded; the previous one stands", JSON.stringify({
+            reason: "standing_write_failed",
+            source,
+            error_code: error?.code ?? "unknown",
+        }));
+        return false;
+    }
+    const standing = founder ? "founder" : "not_founder";
+    const changed = before.standing !== standing;
+    // Every tick writes this; only a change is worth a line on an ordinary tick.
+    if (changed || source === "standing_door") {
+        console.error("[founder-standing] recorded Tower's answer", JSON.stringify({ reason: founder ? "tower_says_founder" : "tower_says_not_founder", source, changed, previous: before.standing }));
+    }
+    return true;
+}

package/dist/founder-standing.js

@@ -0,0 +1,117 @@
+import { FOUNDER_CHECK_UNAVAILABLE, FOUNDERS_ONLY_REFUSAL, FOUNDER_STANDING_PATH, founderAnswerFromReply, founderAnswerNotPaired, founderAnswerUnreachable, } from "@bli-cockpit/telemetry-core";
+import { recordFounderStanding } from "./founder-standing-file.js";
+import { getCollectorRuntimePaths } from "./local-state.js";
+import { recallLiveFounderAnswer, rememberLiveFounderAnswer } from "./live-founder-memo.js";
+import { loadPairedSession, towerJsonRequest } from "./tower-client.js";
+export { readFounderStanding, recordFounderStanding } from "./founder-standing-file.js";
+/**
+ * BLI-22640 (Jeetesh's review of 2026-10-25, tightened 2026-10-26): is the
+ * person this machine is paired to a founder? The collector's half of
+ * `founder-standing-contract.ts` (telemetry-core), which says why only
+ * founders may keep work out of Tower and why the answer is Tower's.
+ *
+ * Every decision about what leaves the machine asks Tower LIVE. The answer is
+ * `LiveFounderAnswer`: founder, not a founder, or `unknown` with the reason
+ * Tower could not say. Nothing here falls back to `<state_dir>/founder-standing.json`;
+ * that file is written from each reply for display (`cockpit doctor`, support)
+ * and no decision reads it. A caller handed `unknown` HOLDS
+ * (`owner_check_unavailable`, `optOutVerdict`).
+ *
+ *   - `askTowerFounderStanding` always asks `GET /api/ambient/founder-standing`.
+ *     The verbs that RECORD an off need this and refuse without a live answer.
+ *   - `liveFounderStanding` is the decider's door: it reuses what THIS process
+ *     heard from Tower in the last minute (`live-founder-memo.ts`, memory only)
+ *     so a tick asks once, and asks otherwise.
+ *   - the heartbeat reply's `is_owner` is recorded every tick for display
+ *     (`heartbeat-post.ts`); it is not a source for a decision either.
+ *
+ * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
+ */
+const STANDING_DEADLINE_MS = 10_000;
+/**
+ * Asks Tower now, remembers the answer for this process, and (on a real
+ * answer) records it for display. Never throws. Logs every branch.
+ */
+export async function askTowerFounderStanding(options = {}) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    const answer = await askDoor(options);
+    rememberLiveFounderAnswer(paths.state_dir, answer, options.now?.getTime());
+    if (answer.standing === "unknown") {
+        console.error("[founder-standing] Tower could not say whether this person is a founder; readers hold", JSON.stringify({ reason: answer.reason, ...(answer.httpStatus === undefined ? {} : { http_status: answer.httpStatus }) }));
+    }
+    else {
+        await recordFounderStanding(paths, answer.standing === "founder", "standing_door", options.now);
+    }
+    return answer;
+}
+/**
+ * What a decider asks. Tower's answer from the last minute in THIS process, or
+ * a fresh ask. Never the saved file.
+ */
+export async function liveFounderStanding(options = {}) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    const known = recallLiveFounderAnswer(paths.state_dir, options.now?.getTime());
+    if (known)
+        return known;
+    return askTowerFounderStanding(options);
+}
+async function askDoor(options) {
+    let session;
+    try {
+        session = await loadPairedSession("memory off", options.homeDir);
+    }
+    catch {
+        return founderAnswerNotPaired();
+    }
+    const result = await towerJsonRequest({
+        dashboardUrl: options.dashboardUrl ?? session.dashboard_url,
+        path: FOUNDER_STANDING_PATH,
+        deviceToken: session.device_token,
+        fetch: options.fetch ?? globalThis.fetch,
+        method: "GET",
+        timeoutMs: STANDING_DEADLINE_MS,
+        label: "founder-standing",
+        ...(options.homeDir === undefined ? {} : { homeDir: options.homeDir }),
+        log: (line) => console.error(line),
+    });
+    if (!result.ok) {
+        return result.reason === "http_error"
+            ? { standing: "unknown", reason: "founder_check_refused", ...(result.httpStatus === undefined ? {} : { httpStatus: result.httpStatus }) }
+            : founderAnswerUnreachable();
+    }
+    return founderAnswerFromReply({ status: result.httpStatus ?? 200, body: result.body });
+}
+/** The standing a decider acts on: Tower's live word, or `unknown` (hold). */
+export function standingOf(answer) {
+    return answer.standing;
+}
+/**
+ * May this machine record an "off"? Only for a founder, and only on Tower's
+ * LIVE answer, asked now and never from this process's memory: a file or a
+ * remembered answer is never enough to record one, so an edit cannot open
+ * this door. Every door that records an off asks this (`memory off|uninstall`,
+ * `doctor --no-memory`, the one-time question).
+ */
+export async function mayRecordOff(options) {
+    const answer = await askTowerFounderStanding(options);
+    if (answer.standing === "founder") {
+        console.error("[founder-standing] off allowed", JSON.stringify({ reason: "tower_says_founder", door: options.door }));
+        return { allowed: true };
+    }
+    if (answer.standing === "not_founder") {
+        console.error("[founder-standing] off refused", JSON.stringify({ reason: FOUNDERS_ONLY_REFUSAL, door: options.door }));
+        return {
+            allowed: false,
+            reason: FOUNDERS_ONLY_REFUSAL,
+            detail: null,
+            line: `BLI Memory stays on: only Tower's founders can turn it off on a machine, because work on BLI machines goes to Tower (${FOUNDERS_ONLY_REFUSAL}). Nothing was changed.`,
+        };
+    }
+    console.error("[founder-standing] off refused", JSON.stringify({ reason: FOUNDER_CHECK_UNAVAILABLE, detail: answer.reason, door: options.door }));
+    return {
+        allowed: false,
+        reason: FOUNDER_CHECK_UNAVAILABLE,
+        detail: answer.reason,
+        line: `BLI Memory was not turned off: Tower could not confirm that you are a founder (${answer.reason}), and only founders can turn it off (${FOUNDER_CHECK_UNAVAILABLE}). Nothing was changed.`,
+    };
+}

package/dist/image-describe-client.js

@@ -14,6 +14,7 @@ import { describeError } from "./health-detail.js";
 import { fetchWithDeadline, isUploadDeadlineError, uploadDeadlineMs } from "./evidence-upload-deadline.js";
 import { safeFailureDetail } from "./evidence-upload-transport.js";
 import { noteSyncProgress } from "./sync-lock.js";
+import { collectorShelfHeaders } from "./shelf-headers.js";
 const MAX_ATTEMPTS = 2;
 const RETRY_DELAY_MS = 500;
 export async function postImageToDescribeDoor(options, request) {
@@ -25,7 +26,7 @@ export async function postImageToDescribeDoor(options, request) {
         try {
             const response = await fetchWithDeadline(options.fetchImpl, `${options.dashboardUrl}/api/ambient/images`, {
                 method: "POST",
-                headers: { Authorization: `Bearer ${options.deviceToken}`, "Content-Type": "application/json" },
+                headers: { Authorization: `Bearer ${options.deviceToken}`, "Content-Type": "application/json", ...collectorShelfHeaders() },
                 body: payload,
             }, deadlineMs);
             const body = await readJson(response);