@bli-cockpit/cli 0.2.291 → 0.2.293

package/dist/adapters/raw-evidence-transcript-file.js

@@ -56,11 +56,27 @@ export async function collectOneEvidenceFile(collection, options) {
     }
     // BLI-3936: stat BEFORE the read. The same stamp, taken again after the work, proves the file
     // did not move underneath it; only then is the result remembered.
-    const stamp = await statSourceForMemo(options.filePath);
+    const stamp = options.sourceProvider ? null : await statSourceForMemo(options.filePath);
     const recipe = prepareRecipe({ imageMode: collection.budget.images?.mode, kind: options.kind });
     if (await reuseUnchangedTranscript(collection, options, names, stamp, recipe))
         return true;
-    const read = await readEvidenceFileWithinCap(options.filePath, options.maxFileBytes, streamMinBytesFor(collection, options.kind));
+    let read;
+    try {
+        read = options.sourceProvider
+            ? { status: "ok", ...await options.sourceProvider() }
+            : await readEvidenceFileWithinCap(options.filePath, options.maxFileBytes, streamMinBytesFor(collection, options.kind));
+    }
+    catch (error) {
+        if (error instanceof TranscriptTooLargeError) {
+            markCapApplied(collection, options.kind, "max_file_bytes");
+            return skip("file_too_large");
+        }
+        const reason = error instanceof TranscriptReadError ? `file_read_failed:${error.stage}` : "file_read_failed";
+        console.error("[raw-evidence] revision source unavailable", JSON.stringify({ reason, ...describeError(error) }));
+        return skip(reason);
+    }
+    if (read.status === "ok" && options.maxFileBytes && read.byteLength > options.maxFileBytes)
+        read = { status: "too_large" };
     if (read.status === "read_failed")
         return skip("file_read_failed");
     if (read.status === "too_large") {
@@ -80,8 +96,15 @@ export async function collectOneEvidenceFile(collection, options) {
     }
     catch (error) {
         // BLI-23317: a streamed or fallback read that fails ends exactly as a whole-file read that failed.
-        if (error instanceof TranscriptReadError)
-            return skip("file_read_failed");
+        if (error instanceof TranscriptReadError) {
+            const deferred = error.stage === "composite_staging_declined" && error.underlying instanceof Error ? error.underlying.message : null;
+            if (deferred && /^(deferred_(byte|object)_budget|staging_deferred:[a-z_]+)$/.test(deferred)) {
+                markBudgetCapApplied(collection, deferred);
+                return skip(deferred);
+            }
+            const detail = options.sourceProvider ? `:${error.stage}` : "";
+            return skip(`file_read_failed${detail}`);
+        }
         if (error instanceof TranscriptTooLargeError) {
             markCapApplied(collection, options.kind, "max_file_bytes");
             return skip("file_too_large");

package/dist/adapters/raw-evidence-transcript-stream.js

@@ -12,6 +12,8 @@
  *    read gives (`file_read_failed`, `file_too_large`), never a shorter file.
  */
 import fs from "node:fs/promises";
+import { copyLinesStream } from "../slim/keep-line-copy.js";
+import { openStagedOutput } from "./staged-output.js";
 import { modeDropsImages } from "@bli-cockpit/telemetry-core";
 import { describeError } from "../health-detail.js";
 import { TranscriptNotStreamable, TranscriptReadError, TranscriptTooLargeError, } from "./transcript-text-stream.js";
@@ -32,11 +34,13 @@ export function volatilityOf(mode, prepared) {
 }
 export async function streamTranscriptBody(session, agent, file) {
     if (!session?.prepareTranscriptFile || !agent) {
+        if (file.openSource)
+            return streamCompositeWithoutImages(file);
         console.error(TAG + " streamed read not available, reading the transcript whole", JSON.stringify({ reason: "stream_unavailable", kind: file.kind }));
         return null;
     }
     try {
-        const prepared = await session.prepareTranscriptFile({ filePath: file.filePath, source: agent, sessionId: file.sessionId, maxFileBytes: file.maxFileBytes, stageDir: file.stageDir, omitText: file.stageDir !== undefined, ...(file.provenance ? { provenance: file.provenance } : {}) });
+        const prepared = await session.prepareTranscriptFile({ filePath: file.filePath, ...(file.openSource ? { openSource: file.openSource } : {}), source: agent, sessionId: file.sessionId, maxFileBytes: file.maxFileBytes, stageDir: file.stageDir, omitText: file.stageDir !== undefined, ...(file.provenance ? { provenance: file.provenance } : {}) });
         const { volatile, pendingImages } = volatilityOf(session.mode, prepared);
         console.error(TAG + " transcript streamed through image swap and slim", JSON.stringify({ kind: file.kind, mode: session.mode, byte_size: prepared.readBytes, changed: prepared.changed, images: prepared.imageCount, volatile, staged_bytes: prepared.staged?.byteLength ?? null }));
         // BLI-23344: with a spool the text is not read back; the sanitizer reads the spool line by line.
@@ -45,12 +49,18 @@ export async function streamTranscriptBody(session, agent, file) {
     catch (error) {
         if (error instanceof TranscriptReadError || error instanceof TranscriptTooLargeError)
             throw error;
+        if (file.openSource) {
+            console.error(TAG + " composite revision remains pending", JSON.stringify({ reason: "composite_prepare_failed", kind: file.kind, ...describeError(error) }));
+            throw new TranscriptReadError(error instanceof TranscriptNotStreamable ? error.reason : "composite_prepare_failed", error);
+        }
         console.error(TAG + " streamed read set aside, reading the transcript whole", JSON.stringify({ reason: error instanceof TranscriptNotStreamable ? error.reason : "stream_step_failed", kind: file.kind, ...(error instanceof TranscriptNotStreamable ? {} : describeError(error)) }));
         return null;
     }
 }
 /** The whole-file read the streamed path falls back to: same failures, same labels, as the reader that did not stream. */
 export async function readTranscriptWhole(file) {
+    if (file.openSource)
+        throw new TranscriptReadError("composite_buffering_refused", new Error("composite_buffering_refused"));
     let bytes;
     try {
         bytes = await fs.readFile(file.filePath);
@@ -62,4 +72,26 @@ export async function readTranscriptWhole(file) {
     if (file.maxFileBytes && bytes.byteLength > file.maxFileBytes)
         throw new TranscriptTooLargeError(file.maxFileBytes);
     return bytes;
+}
+/** Keep mode when image preparation is unavailable: same spool/mask/ack, no representative read or whole buffer. */
+async function streamCompositeWithoutImages(file) {
+    if (!file.stageDir)
+        throw new TranscriptReadError("composite_staging_unavailable", new Error("composite_staging_unavailable"));
+    const source = await file.openSource();
+    let writer;
+    try {
+        writer = await openStagedOutput(file.stageDir);
+        await copyLinesStream(source.lines(), writer);
+        await source.verifyUnchanged();
+        const staged = await writer.finish();
+        console.error(TAG + " composite revision kept without image preparation", JSON.stringify({ reason: "composite_images_unavailable_kept", kind: file.kind, byte_size: source.length }));
+        return { held: { text: null, exactBytes: null, staged }, volatile: true, pendingImages: null, readBytes: source.length };
+    }
+    catch (error) {
+        await writer?.abandon();
+        throw new TranscriptReadError(error instanceof TranscriptNotStreamable ? error.reason : "composite_prepare_failed", error);
+    }
+    finally {
+        await source.close();
+    }
 }

package/dist/agent-plugins-converge.js

@@ -113,7 +113,12 @@ async function convergeHost(host, reading, entry, options, now) {
     if (reading.installed) {
         // Installed by us or by hand: a failure remembered from before is spent.
         delete entry.last_reason;
-        const due = options.refresh && msSince(entry.last_refresh_at, now) >= PLUGIN_REFRESH_EVERY_MS;
+        // A failed refresh waits out the six-hour retry window, not a whole day: it
+        // never counts as the day's refresh, so a machine (or a Boat template
+        // snapshot) that failed once is not left on an old version (BLI-24352).
+        const due = options.refresh
+            && msSince(entry.last_refresh_at, now) >= PLUGIN_REFRESH_EVERY_MS
+            && msSince(entry.last_refresh_failed_at, now) >= PLUGIN_RETRY_AFTER_FAILURE_MS;
         if (!due)
             return { host, status: "already_installed", reason: "installed", quiet: true };
         return refreshHost(host, reading, entry, options, now);
@@ -166,17 +171,31 @@ async function installHost(host, reading, entry, options, now) {
     console.error("[agent-plugins] plugin installed", JSON.stringify({ reason: "installed", host }));
     return { host, status: "installed", reason: "installed", quiet: false };
 }
-/** The daily refresh. A failure here never un-installs anything; the next try is tomorrow's. */
+/**
+ * The daily refresh. A failure here never un-installs anything and never counts
+ * as the day's refresh: `last_refresh_at` stays on the last clean one and the
+ * next try is after the six-hour retry window (BLI-24352).
+ */
 async function refreshHost(host, reading, entry, options, now) {
-    entry.last_refresh_at = now.toISOString();
+    const failed = (reason) => {
+        entry.last_refresh_failed_at = now.toISOString();
+        entry.last_refresh_reason = reason;
+    };
     const binary = await locateHostBinary(host, options.homeDir, options);
     if (!binary) {
-        console.error("[agent-plugins] host program not found for the daily refresh", JSON.stringify({ reason: "binary_missing", host }));
+        failed("binary_missing");
+        console.error("[agent-plugins] host program not found for the daily refresh", JSON.stringify({ reason: "binary_missing", host, retry_after_hours: PLUGIN_RETRY_AFTER_FAILURE_MS / 3_600_000 }));
         return { host, status: "already_installed", reason: "refresh_skipped_binary_missing", quiet: true };
     }
     const failure = await runSteps(host, binary, stepsFor(host, reading, true), options);
-    if (failure)
+    if (failure) {
+        failed(failure);
+        console.error("[agent-plugins] daily refresh failed; the installed plugin stays and the refresh is retried after the failure window", JSON.stringify({ reason: `refresh_failed_${failure}`, host, retry_after_hours: PLUGIN_RETRY_AFTER_FAILURE_MS / 3_600_000 }));
         return { host, status: "already_installed", reason: `refresh_failed_${failure}`, quiet: false };
+    }
+    entry.last_refresh_at = now.toISOString();
+    delete entry.last_refresh_failed_at;
+    delete entry.last_refresh_reason;
     console.error("[agent-plugins] plugin refreshed", JSON.stringify({ reason: "refreshed", host }));
     return { host, status: "refreshed", reason: "refreshed", quiet: false };
 }

package/dist/collection-scope.js

@@ -146,6 +146,8 @@ export function cwdInsideRoots(cwd, roots) {
  * it cannot be proven inside, so it is withheld.
  */
 export function sessionInsideRoots(result, roots) {
+    if (result.local_cwds)
+        return result.local_cwds.length > 0 && result.local_cwds.every(cwd => cwdInsideRoots(cwd, roots) || Boolean(result.worktree && cwdInsideRoots(cwd, [result.worktree.repo_root])));
     if (cwdInsideRoots(result.local_cwd, roots))
         return true;
     return Boolean(result.worktree && cwdInsideRoots(result.local_cwd, [result.worktree.repo_root]));

package/dist/commands/backfill-checkpoint.js

@@ -37,7 +37,8 @@ export async function recordBackfillDurableSessionPointers(options) {
             // delivery, so a real pointer replaces it and the mark clears.
             // BLI-11119: an entry the cursor itself knows is `stubbed` counts too.
             const replacesStub = Boolean(prior?.stub_reoffer || prior?.stubbed) && prior?.uploaded_object_key !== objectKey;
-            if (!objectKey || !prior || (prior.uploaded_object_key && !replacesStub))
+            const replacesRevision = candidate.source === "codex" && prior?.uploaded_source_revision !== candidate.content_hash_sha256;
+            if (!objectKey || (prior?.uploaded_object_key && !replacesStub && !replacesRevision))
                 continue;
             if (replacesStub && !isRedactionStubObjectKey(objectKey))
                 stubsReplaced += 1;
@@ -61,6 +62,7 @@ function deliveredCursorEntry(prior, candidate, objectKey, now) {
     const entry = {
         ...prior,
         file_hash_sha256: candidate.content_hash_sha256,
+        uploaded_source_revision: isRedactionStubObjectKey(objectKey) ? prior?.uploaded_source_revision ?? null : candidate.content_hash_sha256,
         file_mtime_ms: candidate.session_file_mtime_ms,
         byte_size: candidate.byte_size,
         // The whole file was delivered, so the incremental reader starts at its end.

package/dist/commands/backfill-history-scan.js

@@ -0,0 +1,38 @@
+/** Keep complete-history rescans separate from candidate selection and cursor policy. */
+import { scanAndAttributeCodexSessions } from "../adapters/codex-attribution.js";
+import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
+/**
+ * The adapter's own limit is a memory guard, not permission to silently leave
+ * history undiscovered. When it fires, re-scan the exact discovered population
+ * so a user-facing `--max-files` cap can resume from a truthful ordering.
+ */
+export async function scanCodexHistory(request, sessionsDirs, scanLimit) {
+    const scan = (limit) => scanAndAttributeCodexSessions({
+        sessionsDirs,
+        worktrees: request.worktrees,
+        now: request.now,
+        sinceMinutes: request.window.since_minutes,
+        limit,
+        collectionRoots: request.collectionRoots,
+    });
+    const firstPass = await scan(scanLimit);
+    if (!firstPass.session_limit_applied)
+        return firstPass;
+    return scan(Math.max(scanLimit + 1, firstPass.discovered_file_count));
+}
+/** Same rule for the Claude store: a capped first pass is rescanned in full. */
+export async function scanClaudeHistory(request, projectsDirs, scanLimit) {
+    const scan = (limit) => scanAndAttributeClaudeSessions({
+        projectsDir: projectsDirs[0],
+        projectsDirs,
+        worktrees: request.worktrees,
+        now: request.now,
+        sinceMinutes: request.window.since_minutes,
+        limit,
+        collectionRoots: request.collectionRoots,
+    });
+    const firstPass = await scan(scanLimit);
+    if (!firstPass.session_limit_applied)
+        return firstPass;
+    return scan(Math.max(scanLimit + 1, firstPass.discovered_session_count));
+}

package/dist/commands/backfill-issues.js

@@ -29,36 +29,33 @@ import { candidateCursorKey } from "./backfill-candidates.js";
 export async function backfillScanIssues(options) {
     const issues = [];
     if (options.codexAttribution) {
-        await addCodexStoreScanIssues(issues, options.codexAttribution, options.codexSessionDirs);
+        await addCodexStoreScanIssues(issues, options.codexAttribution);
     }
     if (options.claudeAttribution) {
-        await addClaudeStoreScanIssues(issues, options.claudeAttribution, options.claudeProjectsDir, options.candidates);
+        await addClaudeStoreScanIssues(issues, options.claudeAttribution, options.candidates);
     }
     addCandidateScanIssues(issues, options.candidates, options.omittedCandidateCount);
     sortScanIssuesByPriority(issues);
     return issues;
 }
 /** What the archived Codex store could not tell us — every one of these hides history. */
-async function addCodexStoreScanIssues(issues, codexAttribution, codexSessionDirs) {
+async function addCodexStoreScanIssues(issues, codexAttribution) {
     countScanIssue(issues, "codex_session_limit_applied", codexAttribution.session_limit_applied
         ? Math.max(1, codexAttribution.discovered_file_count -
             codexAttribution.scanned_file_count)
         : 0, "global");
-    // A session directory that simply does not exist on this machine is not a
-    // read failure; subtract those before reporting one.
-    const missingTopLevelDirs = (await Promise.all(codexSessionDirs.map(isMissingPath))).filter(Boolean).length;
-    countScanIssue(issues, "codex_directory_read_failed", Math.max(0, codexAttribution.directory_read_failed_count - missingTopLevelDirs), "global");
+    // The reader already excludes ENOENT. Subtracting absent default roots
+    // here would erase a failure in another configured home or T3 discovery.
+    countScanIssue(issues, "codex_directory_read_failed", codexAttribution.directory_read_failed_count, "global");
     countScanIssue(issues, "codex_session_stat_failed", codexAttribution.stat_failed_count, "global");
 }
 /** The same census for the Claude store, which also has sidecars to account for. */
-async function addClaudeStoreScanIssues(issues, claudeAttribution, claudeProjectsDir, candidates) {
+async function addClaudeStoreScanIssues(issues, claudeAttribution, candidates) {
     countScanIssue(issues, "claude_session_limit_applied", claudeAttribution.session_limit_applied
         ? Math.max(1, claudeAttribution.discovered_session_count -
             claudeAttribution.scanned_session_count)
         : 0, "global");
-    const projectsDirMissing = await isMissingPath(claudeProjectsDir);
-    countScanIssue(issues, "claude_project_dir_read_failed", Math.max(0, claudeAttribution.project_dir_read_failed_count -
-        (projectsDirMissing ? 1 : 0)), "global");
+    countScanIssue(issues, "claude_project_dir_read_failed", claudeAttribution.project_dir_read_failed_count, "global");
     countScanIssue(issues, "claude_session_stat_failed", claudeAttribution.session_stat_failed_count, "global");
     countScanIssue(issues, "claude_sidecar_stat_failed", claudeAttribution.sidecar_stat_failed_count, "global");
     countScanIssue(issues, "claude_sidecar_dir_read_failed", await countUnreadableClaudeSidecarDirs(candidates), "global");
@@ -151,15 +148,6 @@ async function countUnreadableClaudeSidecarDirs(candidates) {
     }
     return unreadable;
 }
-async function isMissingPath(filePath) {
-    try {
-        await fs.stat(filePath);
-        return false;
-    }
-    catch (error) {
-        return isMissingFsError(error);
-    }
-}
 function isMissingFsError(error) {
     if (!error || typeof error !== "object")
         return false;

package/dist/commands/backfill-scan.js

@@ -1,3 +1,5 @@
+import { scanCodexHistory, scanClaudeHistory } from "./backfill-history-scan.js";
+import { nativeSessionRoots } from "../native-session-roots.js";
 /**
  * SCAN: read both archived session stores and turn them into the candidates
  * this run will consider, then census what could not be accounted for.
@@ -9,9 +11,6 @@
  * on what was missed before what merely arrived.
  */
 import os from "node:os";
-import path from "node:path";
-import { scanAndAttributeClaudeSessions, } from "../adapters/claude-attribution.js";
-import { defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
 import { emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
 import { liveWindowMsFor, scopeBackfillCandidates } from "./backfill-live-window.js";
@@ -136,10 +135,15 @@ async function auditScannedCandidates(scan, discoveryIncompleteReasons) {
  */
 async function scanBackfillSessions(options) {
     const scanLimit = options.command.maxFiles ?? 10_000;
-    const codexSessionDirs = defaultCodexSessionDirs(options.homeDir);
-    const claudeProjectsDir = path.join(options.homeDir, ".claude", "projects");
+    const { codex: codexSessionDirs, claudeProjects: claudeProjectsDir, claudeProjectDirs, discoveryFailed } = nativeSessionRoots(options.homeDir);
     const codexScanned = options.sources.includes("codex") ? await scanCodexHistory(options, codexSessionDirs, scanLimit) : null;
-    const claudeScanned = options.sources.includes("claude_code") ? await scanClaudeHistory(options, claudeProjectsDir, scanLimit) : null;
+    const claudeScanned = options.sources.includes("claude_code") ? await scanClaudeHistory(options, claudeProjectDirs, scanLimit) : null;
+    if (discoveryFailed) {
+        if (codexScanned)
+            codexScanned.directory_read_failed_count += 1;
+        if (claudeScanned)
+            claudeScanned.project_dir_read_failed_count += 1;
+    }
     // BLI-23590 withholds sessions outside the approved roots first; BLI-23478 then keeps drawer sessions home.
     const scoped = scopeHistoryScans(options, codexScanned, claudeScanned);
     const { codexAttribution, claudeAttribution } = shelveBackfillScan(scoped.codex, scoped.claude, options.shelfDecision);
@@ -155,6 +159,13 @@ async function scanBackfillSessions(options) {
         sinceMinutes: options.window.since_minutes,
     });
     const liveWindowMs = liveWindowMsFor(options.command);
+    const durableCodex = await readRawEvidenceCursor(getCollectorRuntimePaths(options.homeDir));
+    for (const c of scanned) {
+        const prior = durableCodex.sessions[c.session_id];
+        if (c.source === "codex" && (c.segment_paths || prior?.uploaded_source_revision) &&
+            prior?.uploaded_source_revision !== c.content_hash_sha256)
+            options.pointerlessTerminalSessions.codex.add(c.session_id);
+    }
     const selection = selectBackfillCandidates({
         scanned,
         cursor: options.cursor,
@@ -188,40 +199,6 @@ async function scanBackfillSessions(options) {
         live_window_ms: liveWindowMs,
     };
 }
-/**
- * The adapter's own limit is a memory guard, not permission to silently leave
- * history undiscovered. When it fires, re-scan the exact discovered population
- * so a user-facing `--max-files` cap can resume from a truthful ordering.
- */
-async function scanCodexHistory(request, sessionsDirs, scanLimit) {
-    const scan = (limit) => scanAndAttributeCodexSessions({
-        sessionsDirs,
-        worktrees: request.worktrees,
-        now: request.now,
-        sinceMinutes: request.window.since_minutes,
-        limit,
-        collectionRoots: request.collectionRoots,
-    });
-    const firstPass = await scan(scanLimit);
-    if (!firstPass.session_limit_applied)
-        return firstPass;
-    return scan(Math.max(scanLimit + 1, firstPass.discovered_file_count));
-}
-/** Same rule for the Claude store: a capped first pass is rescanned in full. */
-async function scanClaudeHistory(request, projectsDir, scanLimit) {
-    const scan = (limit) => scanAndAttributeClaudeSessions({
-        projectsDir,
-        worktrees: request.worktrees,
-        now: request.now,
-        sinceMinutes: request.window.since_minutes,
-        limit,
-        collectionRoots: request.collectionRoots,
-    });
-    const firstPass = await scan(scanLimit);
-    if (!firstPass.session_limit_applied)
-        return firstPass;
-    return scan(Math.max(scanLimit + 1, firstPass.discovered_session_count));
-}
 /**
  * Which scanned sessions this run will actually work on. A session is in play
  * if the cursor has not passed it, or if it is a terminal session that never
@@ -291,6 +268,7 @@ function normalizeCodexCandidate(result) {
     return {
         source: "codex",
         session_id: result.codex_session_id,
+        ...(result.segment_paths ? { segment_paths: result.segment_paths } : {}),
         session_id_source: result.session_id_source,
         file_path: result.file_path,
         state: result.state,

package/dist/commands/backfill-upload.js

@@ -231,6 +231,7 @@ function backfillBatchSyncOptions(options) {
             .map((candidate) => ({
             local_path: candidate.file_path,
             codex_session_id: candidate.session_id,
+            ...(candidate.segment_paths ? { segment_paths: candidate.segment_paths, revision_hash: candidate.content_hash_sha256 ?? undefined, revision_bytes: candidate.byte_size } : {}),
         })),
         codexAttributionScan: options.codexAttribution ?? undefined,
         claudeSessionFiles: options.batch.candidates

package/dist/commands/books-usage.js

@@ -1,6 +1,7 @@
 /** `cockpit books` usage text (BLI-23711), in its own module so the help table can print it without loading the command. */
 export const BOOKS_USAGE = [
-    "Usage: cockpit books list [--json]",
+    "Usage: cockpit books list [--json] (includes archived books, marked archived)",
+    "       cockpit books archive <book> [--restore] [--json] (founders; nothing deleted)",
     "       cockpit books create <book> --title \"<title>\" [--json]                      (founders)",
     "       cockpit books members list|add|remove <book> [<email or user id>] [--edit] [--json]   (founders)",
     "       cockpit books ls <book> <collection> [--after <doc_id>] [--limit <1-500>] [--deleted] [--json]",

package/dist/commands/books.js

@@ -4,7 +4,7 @@ import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
 import { BOOKS_USAGE } from "./books-usage.js";
 import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
 export { BOOKS_USAGE };
-const ACTIONS = ["list", "create", "members", "ls", "get", "put", "delete", "batch", "export", "import"];
+const ACTIONS = ["list", "archive", "create", "members", "ls", "get", "put", "delete", "batch", "export", "import"];
 const BODY_MAX_CHARS = 4_000_000;
 function usage() {
     throw new Error(BOOKS_USAGE);
@@ -21,7 +21,7 @@ function wholeNumber(raw, min, max) {
 }
 export function parseBooksArgs(args) {
     const values = parseNamedArgs(args, {
-        allowedFlags: ["--title", "--edit", "--after", "--limit", "--deleted", "--merge", "--version", "--data", "--json", "--home", "--dashboard-url"],
+        allowedFlags: ["--restore", "--title", "--edit", "--after", "--limit", "--deleted", "--merge", "--version", "--data", "--json", "--home", "--dashboard-url"],
         valueFlags: ["--title", "--after", "--limit", "--version", "--data", "--home", "--dashboard-url"],
     });
     const [action, ...rest] = values.positionals;
@@ -30,7 +30,7 @@ export function parseBooksArgs(args) {
     const flags = values.flags;
     const has = (flag) => flags.has(flag) || values.booleans.has(flag);
     const allowOnly = (...allowed) => {
-        for (const flag of ["--title", "--edit", "--after", "--limit", "--deleted", "--merge", "--version", "--data"])
+        for (const flag of ["--restore", "--title", "--edit", "--after", "--limit", "--deleted", "--merge", "--version", "--data"])
             if (has(flag) && !allowed.includes(flag))
                 usage();
     };
@@ -47,6 +47,11 @@ export function parseBooksArgs(args) {
                 usage();
             allowOnly();
             return command;
+        case "archive":
+            if (rest.length !== 1)
+                usage();
+            allowOnly("--restore");
+            return { ...command, book: rest[0], restore: values.booleans.has("--restore") };
         case "create": {
             const title = optionalNonEmpty(flags.get("--title"));
             if (rest.length !== 1 || !title)
@@ -137,10 +142,13 @@ export async function runBooks(command, io) {
                 if (books.length === 0)
                     writeLine(io.stdout, "No books you can open.");
                 for (const b of books)
-                    writeLine(io.stdout, `${b.id}\t${b.access}${b.founder ? " (founder)" : ""}\t${b.title}`);
+                    writeLine(io.stdout, `${b.id}\t${b.access}${b.founder ? " (founder)" : ""}\t${b.title}${b.archived_at ? " (archived)" : ""}`);
                 return 0;
             }
             break;
+        case "archive":
+            answer = await booksRequest(door, "POST", `/api/books/${book}/archive`, "archive", { archived: !command.restore });
+            break;
         case "create":
             answer = await booksRequest(door, "POST", "/api/books", "create", { id: command.book, title: command.title });
             break;

package/dist/commands/codex-hooks-trust-choice.js

@@ -0,0 +1,51 @@
+/**
+ * The person's answer to "Auto-trust the BLI Memory hooks in Codex?"
+ * (BLI-24349), kept so a "no" is never asked again.
+ *
+ * `<state_dir>/codex-hooks-trust.json`, one small object. Only a "no" changes
+ * behaviour (the question is not asked again); a "yes" is recorded for the
+ * operator reading the machine, since the system hooks file itself is what
+ * proves the yes. `cockpit doctor --trust-codex-hooks` is how a person who
+ * said no changes their mind.
+ *
+ * A file that will not read or parse counts as no answer: asking again is the
+ * harmless direction for a question whose default is yes.
+ */
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+export const CODEX_HOOKS_TRUST_CHOICE_FILE = "codex-hooks-trust.json";
+const SCHEMA = "codex-hooks-trust.v1";
+function choiceFile(paths) {
+    return path.join(paths.state_dir, CODEX_HOOKS_TRUST_CHOICE_FILE);
+}
+export async function readCodexHooksTrustChoice(paths) {
+    let raw;
+    try {
+        raw = await readFile(choiceFile(paths), "utf8");
+    }
+    catch (error) {
+        const code = error?.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return { choice: null, reason: "choice_absent" };
+        console.error("[codex-hooks-trust] choice file unreadable; treating as no answer", JSON.stringify({ reason: "choice_unreadable", error_code: code ?? "unknown" }));
+        return { choice: null, reason: "choice_unreadable" };
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed?.schema === SCHEMA && (parsed.choice === "declined" || parsed.choice === "trusted")) {
+            return { choice: parsed.choice, reason: "choice_read" };
+        }
+    }
+    catch {
+        // fall through to the named reason below
+    }
+    console.error("[codex-hooks-trust] choice file does not parse; treating as no answer", JSON.stringify({ reason: "choice_unreadable", byte_size: raw.length }));
+    return { choice: null, reason: "choice_unreadable" };
+}
+export async function writeCodexHooksTrustChoice(paths, choice, via, now = new Date()) {
+    const file = choiceFile(paths);
+    await mkdir(paths.state_dir, { recursive: true });
+    const staged = `${file}.${process.pid}.tmp`;
+    await writeFile(staged, `${JSON.stringify({ schema: SCHEMA, choice, via, at: now.toISOString() }, null, 2)}\n`, "utf8");
+    await rename(staged, file);
+}