@bli-cockpit/cli 0.2.286 → 0.2.288

package/dist/source-opt-out.js

@@ -1,8 +1,53 @@
+/**
+ * The one reader of a machine's explicit source opt-outs (ticket 22557).
+ *
+ * Collection defaults ON and self-heals. The only things that withhold a
+ * session are an operator's own words, written into the collector config:
+ *
+ *   - `collect_claude_jsonl: false`   Claude transcripts stay on the machine
+ *   - `collect_codex_jsonl: false`    Codex transcripts stay on the machine
+ *   - `raw_evidence_upload: "disabled"` neither source uploads
+ *
+ * Each survives every config rewrite (`local-state-config.ts`) until the
+ * operator turns it back on. Every caller that withholds something logs the
+ * reason label this module returns, so a withheld source is never silent.
+ *
+ * FOUNDERS ONLY (BLI-22640, Jeetesh's review of 2026-10-25). Work on BLI
+ * accounts and BLI hardware is BLI's and goes to Tower; only a founder's
+ * opt-out is obeyed. For anybody else (Tower's LIVE answer,
+ * `founder-standing.ts`) every source stays on, the config value is left
+ * exactly as written, and `ignored` names what was found so the caller, the
+ * heartbeat and doctor can say so. When Tower cannot answer, the opt-out is
+ * HELD (`owner_check_unavailable`): the sources it names send nothing until
+ * Tower answers. The saved `founder-standing.json` is never read here
+ * (`founder-standing-contract.ts`).
+ *
+ * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
+ */
+import { optOutVerdict, } from "@bli-cockpit/telemetry-core";
+import { liveStandingForDecision } from "./live-founder-memo.js";
 export const CODEX_OPT_OUT_REASON = "collect_codex_jsonl_false";
 export const CLAUDE_OPT_OUT_REASON = "collect_claude_jsonl_false";
 export const ALL_SOURCES_OPT_OUT_REASON = "raw_evidence_upload_disabled";
-/** A missing or unreadable config is "no opt-out": collection stays on. */
-export function resolveSourceSwitches(config) {
+/** Every opt-out label the config holds, obeyed or not. */
+export function configOptOutLabels(config) {
+    return [
+        ...(config?.collect_claude_jsonl === false ? ["collect_claude_jsonl_false"] : []),
+        ...(config?.collect_codex_jsonl === false ? ["collect_codex_jsonl_false"] : []),
+        ...(config?.raw_evidence_upload === "disabled" ? ["raw_evidence_upload_disabled"] : []),
+    ];
+}
+/**
+ * A missing or unreadable config is "no opt-out": collection stays on.
+ * `standing` is Tower's answer for this machine's person; only a founder's
+ * opt-out turns a source off.
+ */
+export function resolveSourceSwitches(config, standing) {
+    const labels = configOptOutLabels(config);
+    const verdict = labels.length > 0 ? optOutVerdict(standing) : null;
+    if (verdict && !verdict.obeyed) {
+        return { codex: true, claude: true, codexReason: null, claudeReason: null, ignored: labels, verdict: verdict.reason, held: false };
+    }
     const all = config?.raw_evidence_upload === "disabled";
     const codexReason = config?.collect_codex_jsonl === false
         ? CODEX_OPT_OUT_REASON
@@ -15,11 +60,38 @@ export function resolveSourceSwitches(config) {
         claude: claudeReason === null,
         codexReason,
         claudeReason,
+        ignored: [],
+        verdict: verdict?.reason ?? null,
+        held: verdict?.held ?? false,
     };
 }
+/**
+ * `resolveSourceSwitches` on Tower's LIVE answer for this machine's person,
+ * asked now (or the answer this process got in the last minute; the sync tick
+ * asks first, `refreshFounderStandingForOptOuts`). A config with no opt-out
+ * asks nothing. Logs once when an opt-out is ignored and once when it is held.
+ */
+export async function readSourceSwitches(config, paths, caller, ask = {}) {
+    if (configOptOutLabels(config).length === 0)
+        return resolveSourceSwitches(config, "unknown");
+    const answer = await liveStandingForDecision(paths, ask);
+    const switches = resolveSourceSwitches(config, answer.standing);
+    if (switches.ignored.length > 0) {
+        console.error("[source-opt-out] opt-out ignored; only a founder's opt-out is obeyed, so these sessions upload", JSON.stringify({ reason: switches.verdict, ignored: switches.ignored, caller }));
+    }
+    if (switches.held) {
+        console.error("[source-opt-out] opt-out held; Tower could not say whether this person is a founder, so the sources it names send nothing this run", JSON.stringify({
+            reason: switches.verdict,
+            detail: answer.standing === "unknown" ? answer.reason : null,
+            held: configOptOutLabels(config),
+            caller,
+        }));
+    }
+    return switches;
+}
 /** The reason label for one source, or null when that source is on. */
-export function sourceOptOutReason(config, source) {
-    const switches = resolveSourceSwitches(config);
+export function sourceOptOutReason(config, source, standing) {
+    const switches = resolveSourceSwitches(config, standing);
     return source === "codex" ? switches.codexReason : switches.claudeReason;
 }
 /**
@@ -28,6 +100,11 @@ export function sourceOptOutReason(config, source) {
  * keeps a config file every CLI version can read. Every config writer uses this.
  */
 export function configForDisk(config) {
-    const { collect_codex_jsonl: codexSwitch, ...rest } = config;
-    return codexSwitch === false ? { ...rest, collect_codex_jsonl: false } : rest;
+    const { collect_codex_jsonl: codexSwitch, collection_scope: scope, ...rest } = config;
+    // `collection_scope` (BLI-23590) follows the same rule: only `roots_only` reaches disk.
+    return {
+        ...rest,
+        ...(codexSwitch === false ? { collect_codex_jsonl: false } : {}),
+        ...(scope === "roots_only" ? { collection_scope: "roots_only" } : {}),
+    };
 }

package/dist/state-dir-audit.js

@@ -57,6 +57,8 @@ export const STATE_DIR_RULES = [
     { name: "session-needs-login.json", match: "exact", class: "state", bound: "one small note, overwritten at most daily and removed when the sign-in is valid again (sync-heal.ts)" },
     { name: "agent-plugins.json", match: "exact", class: "state", bound: "one small file, overwritten: per host the last install attempt, its failure label and the last daily refresh (agent-plugins-converge.ts, BLI-18200)" },
     { name: "autostart-uninstalled", match: "exact", class: "state", bound: "a zero-byte marker written by `cockpit autostart uninstall` and removed by install or doctor" },
+    { name: "memory-capture.json", match: "exact", class: "state", bound: "one small file, this machine's BLI Memory on/off choice; rewritten only by `cockpit memory on|off` or the one-time doctor question (BLI-22640)" },
+    { name: "founder-standing.json", match: "exact", class: "state", bound: "one small file, overwritten: Tower's last answer to \"is this machine's person a founder?\", written only from a Tower reply (heartbeat or the founder-standing door), for display only: no decision reads it (BLI-22640)" },
     { name: "last-turn-trace.json", match: "exact", class: "state", bound: "one file, overwritten" },
     { name: "sync.lock", match: "exact", class: "state", bound: "lock file, removed when the tick ends" },
     { name: "backfill.lock", match: "exact", class: "state", bound: "lock file, removed when the backfill ends" },

package/dist/tower-client.js

@@ -4,10 +4,11 @@
  * carry named reasons. Warm reads reuse the daemon and writes invalidate cache.
  */
 import { invalidateReadCacheSurface, readCacheSurfaceForPath, } from "@bli-cockpit/telemetry-core/node-read-cache";
-import { errorMessage } from "./commands/cli-io.js";
+import { errorMessage } from "./error-message.js";
 import { getCollectorRuntimePaths, readLocalCollectorSessionFile, } from "./local-state.js";
 import { normalizeDashboardUrl, readResponseJson, responseErrorMessage, } from "./upload-http.js";
 import { isWarmRoutableRead, tryWarmTowerFetch } from "./warm-tower-fetch.js";
+import { collectorShelfHeaders } from "./shelf-headers.js";
 const defaultLog = (line) => {
     console.error(line);
 };
@@ -63,6 +64,8 @@ export async function towerRequest(options) {
     const headers = {
         ...(options.headers ?? {}),
         authorization: `Bearer ${options.deviceToken}`,
+        // BLI-23478: `x-tower-shelf: team`, caller `collector`, the CLI release (Tower's founder lock reads them).
+        ...collectorShelfHeaders(),
     };
     // fetch derives the multipart boundary from a FormData body; declaring the
     // content-type by hand would strip it and the server would parse nothing.

package/dist/upload-agent-artifacts.js

@@ -5,6 +5,7 @@
 import { AgentImageArtifactReportRequestSchema, } from "@bli-cockpit/telemetry-core";
 import { describeError } from "./health-detail.js";
 import { readResponseJson, serverFailureDetail } from "./upload-http.js";
+import { collectorShelfHeaders } from "./shelf-headers.js";
 export async function reportAgentImageArtifacts(options) {
     const artifacts = agentArtifactsFromEvidence(options);
     if (artifacts.length === 0) {
@@ -26,6 +27,7 @@ export async function reportAgentImageArtifacts(options) {
             headers: {
                 "Authorization": `Bearer ${options.deviceToken}`,
                 "Content-Type": "application/json",
+                ...collectorShelfHeaders(),
             },
             body: JSON.stringify(payload),
         });

package/dist/upload-envelope-build.js

@@ -3,7 +3,7 @@
  * Read the workspace context, describe transcript images, collect sources,
  * then sanitize and assemble the event. Blockers retain their retry commands.
  */
-import { resolveSourceSwitches } from "./source-opt-out.js";
+import { readSourceSwitches } from "./source-opt-out.js";
 import { priorSnapshotsFromCursor, } from "./adapters/raw-evidence-snapshot-supersede.js";
 import { TelemetryIngestEnvelopeSchema, } from "@bli-cockpit/telemetry-core";
 import path from "node:path";
@@ -145,7 +145,7 @@ function assembleLocalEnvelope(options, collector, uploadContext, repoLabel, sou
 async function collectEnvelopeSources(options, config, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now) {
     // The last gate before any transcript byte is read for upload: a source the
     // operator opted out of is never collected, whoever the caller is (ticket 22557).
-    const switches = resolveSourceSwitches(config);
+    const switches = await readSourceSwitches(config, paths, "upload_envelope");
     if (!switches.codex || !switches.claude) {
         console.error("[upload-envelope] source withheld by operator opt-out", JSON.stringify({ codex_reason: switches.codexReason, claude_reason: switches.claudeReason }));
     }

package/dist/upload-ingest-receipt.js

@@ -1,6 +1,7 @@
 import { describeError } from "./health-detail.js";
 import { isNonEmptyString, readResponseJson, serverFailureDetail, } from "./upload-http.js";
 import { SyncDeliveryError } from "./upload-failure-reason.js";
+import { collectorShelfHeaders } from "./shelf-headers.js";
 export async function postEnvelopeToIngest(options) {
     let response;
     try {
@@ -9,6 +10,7 @@ export async function postEnvelopeToIngest(options) {
             headers: {
                 "Authorization": `Bearer ${options.built.device_token}`,
                 "Content-Type": "application/json",
+                ...collectorShelfHeaders(),
             },
             body: JSON.stringify(options.envelope),
         });

package/dist/upload-session-reports-wire.js

@@ -8,6 +8,7 @@ import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorS
 import { makeCollectorProvenance, makeUploadWorkContext, safeRepoLabel, } from "./upload-envelope.js";
 import { normalizeDashboardUrl, readResponseJson } from "./upload-http.js";
 import { describeError } from "./health-detail.js";
+import { collectorShelfHeaders } from "./shelf-headers.js";
 /** Attempts per chunk, and the linear 250ms-per-attempt backoff between them. */
 const DEFAULT_REPORT_ATTEMPTS = 3;
 const REPORT_RETRY_BACKOFF_STEP_MS = 250;
@@ -202,6 +203,7 @@ function postSessionAttributionRequest(options) {
         headers: {
             "Authorization": `Bearer ${options.deviceToken}`,
             "Content-Type": "application/json",
+            ...collectorShelfHeaders(),
         },
         body: JSON.stringify({
             schema_version: "ambient-codex-session-attributions.v1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.286",
+  "version": "0.2.288",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.88",
-    "@bli-cockpit/mcp": "0.1.173",
-    "@bli-cockpit/telemetry-core": "0.1.94",
+    "@bli-cockpit/memory-mcp": "0.1.89",
+    "@bli-cockpit/mcp": "0.1.175",
+    "@bli-cockpit/telemetry-core": "0.1.95",
     "unpdf": "1.8.1"
   },
   "repository": {