@bli-cockpit/cli 0.2.34 → 0.2.36

package/dist/commands/local.js

@@ -411,297 +411,355 @@ async function resolveAndSaveDoctorRoots(command, io) {
         writeLine(io.stdout, `Saved collection roots: ${resolution.collectionRoots.join(", ")}`);
     }
 }
+/**
+ * Every onboard exit funnels through here so the best-effort install-event
+ * report always fires, pass or blocked — replaces a `finish` closure that used
+ * to live inside `runOnboard` so the flow functions below can call it too.
+ */
+async function finishOnboardRun(command, installEvents, io, code) {
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        command: "onboard",
+        events: installEvents,
+        json: command.json,
+        io,
+    });
+    return code;
+}
+/**
+ * Every onboard `--json` payload is `onboardResult` plus the roots this pass
+ * resolved plus whatever extra keys that arm of onboarding adds. Assembling it
+ * here means the call sites below cannot drift on key order or forget a field
+ * a sibling call site remembers.
+ */
+function onboardJsonPayload(resultStatus, command, install, pair, sync, status, rootsResult, extra = {}) {
+    return {
+        ...onboardResult(resultStatus, command, install, pair, sync, status),
+        collection_roots: rootsResult?.roots ?? [],
+        root_resolution: rootsResult,
+        ...extra,
+    };
+}
+function writeOnboardJson(io, payload) {
+    writeLine(io.stdout, JSON.stringify(payload, null, 2));
+}
+/** Step 0: which folders are approved, and who claims to own this machine's uploads. */
+async function prepareOnboardRoots(command, installEvents, io) {
+    const resolvedRoots = await resolveOnboardingRootsForCommand(command, io);
+    const rootsResult = resolvedRoots.rootsResult;
+    const collectionRoots = rootsResult.roots;
+    const attributionCollectionRoots = await collectionRootConsentAliases(collectionRoots);
+    const primaryRoot = resolvedRoots.primaryRoot;
+    const resolvedCommand = {
+        ...command,
+        repoRoot: primaryRoot,
+        collectionRoots,
+    };
+    if (!command.json) {
+        writeLine(io.stdout, `Collecting from: ${collectionRoots.join(", ")}`);
+    }
+    if (rootsResult.homeRootOptIn) {
+        addInstallEvent(installEvents, "home_root_optin", "ok");
+    }
+    return {
+        resolvedRoots,
+        rootsResult,
+        collectionRoots,
+        attributionCollectionRoots,
+        primaryRoot,
+        existingConfig: resolvedRoots.existingConfig,
+        resolvedCommand,
+    };
+}
+/** Step 1: write the local config that makes this machine a known collector. */
+async function installOnboardConfig(command, resolvedRoots, installEvents, io) {
+    const install = await persistOnboardingRootConfig(command, resolvedRoots);
+    addInstallEvent(installEvents, "install", "ok");
+    if (!command.json) {
+        writeLine(io.stdout, "1/5 Installed local collector.");
+        writeLine(io.stdout, `Config: ${install.paths.config_file}`);
+    }
+    return install;
+}
+/**
+ * The onboarding runbook: resolve roots, install, pair, discover worktrees,
+ * then hand off to whichever arm matches what was found — one repo runs the
+ * single-repo sync-then-backfill sequence (`runOnboardSingleRepoFlow`),
+ * several run the parent-folder one (`runOnboardMultiRepoFlow`). Any failure
+ * anywhere in either arm unwinds to the single catch below.
+ */
 async function runOnboard(command, io) {
     const installEvents = [];
-    const finish = async (code) => {
-        await reportInstallEventsBestEffort({
-            homeDir: command.homeDir,
-            dashboardUrl: command.dashboardUrl,
-            command: "onboard",
-            events: installEvents,
-            json: command.json,
-            io,
-        });
-        return code;
-    };
     let install = null;
     let pair = null;
-    let sync = null;
-    let status = null;
     let rootsResult = null;
-    let agentRules = null;
-    let autostart = null;
+    // `sync` has to survive a throw from inside either flow function, so it is
+    // mutated through this holder rather than returned — a return only happens
+    // on the success path, and the failure path needs the value too.
+    const syncHolder = {
+        current: null,
+    };
     try {
         if (!command.json)
             writeOnboardBanner(command, io);
-        const resolvedRoots = await resolveOnboardingRootsForCommand(command, io);
-        const existingConfig = resolvedRoots.existingConfig;
-        rootsResult = resolvedRoots.rootsResult;
-        const collectionRoots = rootsResult.roots;
-        const attributionCollectionRoots = await collectionRootConsentAliases(collectionRoots);
-        const primaryRoot = resolvedRoots.primaryRoot;
-        const resolvedCommand = {
-            ...command,
-            repoRoot: primaryRoot,
-            collectionRoots,
-        };
-        if (!command.json) {
-            writeLine(io.stdout, `Collecting from: ${collectionRoots.join(", ")}`);
-        }
-        if (rootsResult.homeRootOptIn) {
-            addInstallEvent(installEvents, "home_root_optin", "ok");
-        }
-        const claimedOwnerEmail = await resolveOnboardEmail(resolvedCommand, collectionRoots, existingConfig, io);
-        install = await persistOnboardingRootConfig(command, resolvedRoots);
-        addInstallEvent(installEvents, "install", "ok");
-        if (!command.json) {
-            writeLine(io.stdout, "1/5 Installed local collector.");
-            writeLine(io.stdout, `Config: ${install.paths.config_file}`);
-        }
-        pair = await pairForOnboarding(command, { primaryRoot, claimedOwnerEmail }, installEvents, io);
-        const worktrees = await discoverCommandWorktrees(collectionRoots, {
+        const roots = await prepareOnboardRoots(command, installEvents, io);
+        rootsResult = roots.rootsResult;
+        const claimedOwnerEmail = await resolveOnboardEmail(roots.resolvedCommand, roots.collectionRoots, roots.existingConfig, io);
+        install = await installOnboardConfig(command, roots.resolvedRoots, installEvents, io);
+        pair = await pairForOnboarding(command, { primaryRoot: roots.primaryRoot, claimedOwnerEmail }, installEvents, io);
+        const worktrees = await discoverCommandWorktrees(roots.collectionRoots, {
             maxDepth: command.maxDepth,
             maxRepos: command.maxRepos,
             homeDir: command.homeDir,
             allowEmpty: true,
         }, io);
-        if (worktrees.length > 1) {
-            const multi = await runMultiRepoOnboard(resolvedCommand, io, worktrees);
-            addInstallEvent(installEvents, "work_context", "ok");
-            addInstallEvent(installEvents, "sync", multi.ok ? "ok" : "fail", multi.ok ? undefined : "sync_blocked");
-            if (!multi.ok) {
-                if (command.json) {
-                    writeLine(io.stdout, JSON.stringify({
-                        ...onboardResult("blocked", resolvedCommand, install, pair, null, null),
-                        collection_roots: collectionRoots,
-                        root_resolution: rootsResult,
-                        mode: "multi_repo",
-                        repos: multi.results,
-                        codex_sessions: multi.codex_sessions,
-                        blocker: "sync_blocked",
-                        next_step: "Run `cockpit sync --json` until every root returns an uploaded receipt.",
-                    }, null, 2));
-                }
-                return finish(1);
-            }
-            const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
-            const completedBackfill = backfill.status === "complete" ? backfill.result : null;
-            addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
-                ? undefined
-                : backfill.failureReason ?? "backfill_incomplete");
-            if (!completedBackfill) {
-                writeOnboardBackfillBlockedResult(io, {
-                    json: command.json,
-                    base: {
-                        ...onboardResult("blocked", resolvedCommand, install, pair, null, null),
-                        collection_roots: collectionRoots,
-                        root_resolution: rootsResult,
-                    },
-                    extra: {
-                        mode: "multi_repo",
-                        repos: multi.results,
-                        codex_sessions: multi.codex_sessions,
-                    },
-                    backfill,
-                });
-                return finish(1);
-            }
-            const multiSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
-            agentRules = multiSetup.agentRules;
-            autostart = multiSetup.autostart;
-            const onboardOk = multiSetup.ok;
-            if (command.json) {
-                writeLine(io.stdout, JSON.stringify({
-                    ...onboardResult(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, null, null),
-                    collection_roots: collectionRoots,
-                    root_resolution: rootsResult,
-                    agent_rules: agentRules,
-                    autostart,
-                    backfill: completedBackfill,
-                    mode: "multi_repo",
-                    repos: multi.results,
-                    codex_sessions: multi.codex_sessions,
-                    ...(!onboardOk && multi.ok
-                        ? {
-                            blocker: "autostart_load_failed",
-                            next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
-                        }
-                        : {}),
-                }, null, 2));
-            }
-            if (onboardOk && !command.json) {
-                writeLine(io.stdout, "PASS: Tower is set up and collecting.");
-                writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
-                    pair,
-                    status,
-                    sync: null,
-                    agentRules,
-                    autostart,
-                    initialSyncOk: true,
-                    backfill: completedBackfill,
-                });
-            }
-            else if (multi.ok && !command.json) {
-                writeOnboardAutostartBlocker(io, autostart);
-            }
-            return finish(onboardOk ? 0 : 1);
-        }
-        const worktreeRoot = worktrees[0]?.repo_root ?? primaryRoot;
-        const context = await startLocalWorkContext({
-            homeDir: command.homeDir,
-            repoRoot: worktreeRoot,
-            branch: command.branch,
-            activeTicketId: command.activeTicketId,
-        });
-        if (!command.json) {
-            writeLine(io.stdout, "3/5 Work context active.");
-            writeLine(io.stdout, `Repo: ${context.repo}`);
-            writeLine(io.stdout, `Branch: ${context.branch}`);
-            writeLine(io.stdout, `Ticket: ${displayTicketId(context.active_ticket_id)}`);
-            writeLine(io.stdout, `Context: ${context.work_context_id}`);
-        }
-        addInstallEvent(installEvents, "work_context", "ok");
-        const run = await runAttributedWorktreeSync({
-            homeDir: command.homeDir,
-            dashboardUrl: command.dashboardUrl,
-            collectionRoots: attributionCollectionRoots,
-            startContexts: false,
+        const ctx = {
+            command,
+            resolvedCommand: roots.resolvedCommand,
+            collectionRoots: roots.collectionRoots,
+            rootsResult: roots.rootsResult,
+            install,
+            pair,
+            installEvents,
+            io,
             worktrees,
-            fetchImpl: io.fetch,
-        });
-        sync = run.outcomes[0]?.sync ?? null;
-        if (!sync) {
-            throw new Error("Onboard sync produced no result for the repo worktree.");
+        };
+        if (worktrees.length > 1) {
+            return await runOnboardMultiRepoFlow(ctx);
         }
-        status = await inspectLocalCollectorStatus({
-            homeDir: command.homeDir,
-            repoRoot: worktreeRoot,
-            branch: command.branch,
+        return await runOnboardSingleRepoFlow(ctx, {
+            attributionCollectionRoots: roots.attributionCollectionRoots,
+            primaryRoot: roots.primaryRoot,
+            syncHolder,
         });
-        if (!run.ok || sync.status !== "uploaded") {
-            addInstallEvent(installEvents, "sync", "fail", "sync_blocked");
-            const collectionRunStatus = attributedSyncRunStatus(run);
-            if (command.json) {
-                writeLine(io.stdout, JSON.stringify({
-                    ...onboardResult("blocked", resolvedCommand, install, pair, sync, status),
-                    collection_roots: collectionRoots,
-                    root_resolution: rootsResult,
-                    codex_sessions: run.summary,
-                    collection_status: collectionRunStatus,
-                }, null, 2));
-            }
-            else {
-                const syncFailureReason = sync.status === "spooled" ? sync.failure_reason : null;
-                const retryCommand = sync.status === "spooled"
-                    ? sync.retry_command
-                    : `cockpit sync --workspace ${JSON.stringify(worktreeRoot)}`;
-                writeLine(io.stderr, "BLOCKED: initial collection is incomplete; retry until every eligible session has a durable receipt or explicit terminal reason.");
-                writeLine(io.stderr, `Failure: ${syncFailureReason ?? (run.summary.report_posted ? collectionRunStatus : run.summary.report_reason)}`);
-                writeAgentSessionSummary(io, run.summary);
-                writeLine(io.stderr, `Retry: ${retryCommand}`);
-            }
-            return finish(1);
-        }
-        addInstallEvent(installEvents, "sync", "ok");
-        const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
-        const completedBackfill = backfill.status === "complete" ? backfill.result : null;
-        addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
-            ? undefined
-            : backfill.failureReason ?? "backfill_incomplete");
-        if (!completedBackfill) {
-            writeOnboardBackfillBlockedResult(io, {
-                json: command.json,
-                base: {
-                    ...onboardResult("blocked", resolvedCommand, install, pair, sync, status),
-                    collection_roots: collectionRoots,
-                    root_resolution: rootsResult,
-                },
-                extra: { codex_sessions: run.summary },
-                backfill,
-            });
-            return finish(1);
-        }
+    }
+    catch (error) {
+        return await handleOnboardFailure(error, command, rootsResult, install, pair, syncHolder.current, installEvents, io);
+    }
+}
+/** The parent-folder arm: sync every discovered worktree, then backfill and finish setup once. */
+async function runOnboardMultiRepoFlow(ctx) {
+    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
+    const multi = await runMultiRepoOnboard(resolvedCommand, io, worktrees);
+    addInstallEvent(installEvents, "work_context", "ok");
+    addInstallEvent(installEvents, "sync", multi.ok ? "ok" : "fail", multi.ok ? undefined : "sync_blocked");
+    if (!multi.ok) {
         if (command.json) {
-            const jsonSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
-            agentRules = jsonSetup.agentRules;
-            autostart = jsonSetup.autostart;
-            const onboardOk = jsonSetup.ok;
-            writeLine(io.stdout, JSON.stringify({
-                ...onboardResult(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, sync, status),
-                collection_roots: collectionRoots,
-                root_resolution: rootsResult,
-                agent_rules: agentRules,
-                autostart,
-                backfill: completedBackfill,
-                codex_sessions: run.summary,
-                ...(!onboardOk
-                    ? {
-                        blocker: "autostart_load_failed",
-                        next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
-                    }
-                    : {}),
-            }, null, 2));
-            return finish(onboardOk ? 0 : 1);
-        }
-        writeLine(io.stdout, "4/5 Uploaded what you worked on.");
-        writeLine(io.stdout, `HTTP: ${sync.http_status}`);
-        writeLine(io.stdout, `Things recorded: ${sync.event_count}`);
-        writeLine(io.stdout, `Sources: ${sync.source_scan_count}`);
-        writeLine(io.stdout, `Risk flags: ${sync.risk_flag_count}`);
-        writeLine(io.stdout, `Raw evidence files: ${sync.raw_evidence_file_count}`);
-        writeLine(io.stdout, rawEvidenceSyncLine(sync));
-        writeAgentSessionSummary(io, run.summary);
-        writeLine(io.stdout, "5/5 Status ready.");
-        writeLine(io.stdout, `Upload state: ${status.upload_state}`);
-        writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
-        const setup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
-        agentRules = setup.agentRules;
-        autostart = setup.autostart;
-        if (!setup.ok) {
-            writeOnboardAutostartBlocker(io, autostart);
-            return finish(1);
+            writeOnboardJson(io, onboardJsonPayload("blocked", resolvedCommand, install, pair, null, null, rootsResult, {
+                mode: "multi_repo",
+                repos: multi.results,
+                codex_sessions: multi.codex_sessions,
+                blocker: "sync_blocked",
+                next_step: "Run `cockpit sync --json` until every root returns an uploaded receipt.",
+            }));
         }
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
+    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
+    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
+        ? undefined
+        : backfill.failureReason ?? "backfill_incomplete");
+    if (!completedBackfill) {
+        writeOnboardBackfillBlockedResult(io, {
+            json: command.json,
+            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, null, null, rootsResult),
+            extra: {
+                mode: "multi_repo",
+                repos: multi.results,
+                codex_sessions: multi.codex_sessions,
+            },
+            backfill,
+        });
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    const multiSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
+    const { agentRules, autostart } = multiSetup;
+    const onboardOk = multiSetup.ok;
+    if (command.json) {
+        writeOnboardJson(io, onboardJsonPayload(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, null, null, rootsResult, {
+            agent_rules: agentRules,
+            autostart,
+            backfill: completedBackfill,
+            mode: "multi_repo",
+            repos: multi.results,
+            codex_sessions: multi.codex_sessions,
+            ...(!onboardOk && multi.ok
+                ? {
+                    blocker: "autostart_load_failed",
+                    next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
+                }
+                : {}),
+        }));
+    }
+    if (onboardOk && !command.json) {
         writeLine(io.stdout, "PASS: Tower is set up and collecting.");
         writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
             pair,
-            status,
-            sync,
+            status: null,
+            sync: null,
             agentRules,
             autostart,
             initialSyncOk: true,
             backfill: completedBackfill,
         });
-        return finish(0);
     }
-    catch (error) {
-        const message = errorMessage(error);
-        const statusRoot = rootsResult?.roots[0] ?? command.repoRoot;
-        status = statusRoot
-            ? await inspectLocalCollectorStatus({
-                homeDir: command.homeDir,
-                repoRoot: statusRoot,
-                branch: command.branch,
-            }).catch(() => null)
-            : null;
-        const blocker = classifyOnboardBlocker(message);
-        addOnboardFailureEvent(installEvents, blocker);
-        const nextStep = nextStepForOnboardBlocker(blocker, command);
+    else if (multi.ok && !command.json) {
+        writeOnboardAutostartBlocker(io, autostart);
+    }
+    return finishOnboardRun(command, installEvents, io, onboardOk ? 0 : 1);
+}
+/** The single-repo arm: start the work context, sync it, backfill, then finish setup once. */
+async function runOnboardSingleRepoFlow(ctx, single) {
+    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
+    const worktreeRoot = worktrees[0]?.repo_root ?? single.primaryRoot;
+    const context = await startLocalWorkContext({
+        homeDir: command.homeDir,
+        repoRoot: worktreeRoot,
+        branch: command.branch,
+        activeTicketId: command.activeTicketId,
+    });
+    if (!command.json) {
+        writeLine(io.stdout, "3/5 Work context active.");
+        writeLine(io.stdout, `Repo: ${context.repo}`);
+        writeLine(io.stdout, `Branch: ${context.branch}`);
+        writeLine(io.stdout, `Ticket: ${displayTicketId(context.active_ticket_id)}`);
+        writeLine(io.stdout, `Context: ${context.work_context_id}`);
+    }
+    addInstallEvent(installEvents, "work_context", "ok");
+    const run = await runAttributedWorktreeSync({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        collectionRoots: single.attributionCollectionRoots,
+        startContexts: false,
+        worktrees,
+        fetchImpl: io.fetch,
+    });
+    const sync = run.outcomes[0]?.sync ?? null;
+    single.syncHolder.current = sync;
+    if (!sync) {
+        throw new Error("Onboard sync produced no result for the repo worktree.");
+    }
+    const status = await inspectLocalCollectorStatus({
+        homeDir: command.homeDir,
+        repoRoot: worktreeRoot,
+        branch: command.branch,
+    });
+    if (!run.ok || sync.status !== "uploaded") {
+        addInstallEvent(installEvents, "sync", "fail", "sync_blocked");
+        const collectionRunStatus = attributedSyncRunStatus(run);
         if (command.json) {
-            writeLine(io.stdout, JSON.stringify({
-                ...onboardResult("blocked", command, install, pair, sync, status),
-                collection_roots: rootsResult?.roots ?? [],
-                root_resolution: rootsResult,
-                blocker,
-                message,
-                next_step: nextStep,
-            }, null, 2));
+            writeOnboardJson(io, onboardJsonPayload("blocked", resolvedCommand, install, pair, sync, status, rootsResult, {
+                codex_sessions: run.summary,
+                collection_status: collectionRunStatus,
+            }));
         }
         else {
-            writeLine(io.stderr, `BLOCKED: ${message}`);
-            writeLine(io.stderr, `Next: ${nextStep}`);
+            const syncFailureReason = sync.status === "spooled" ? sync.failure_reason : null;
+            const retryCommand = sync.status === "spooled"
+                ? sync.retry_command
+                : `cockpit sync --workspace ${JSON.stringify(worktreeRoot)}`;
+            writeLine(io.stderr, "BLOCKED: initial collection is incomplete; retry until every eligible session has a durable receipt or explicit terminal reason.");
+            writeLine(io.stderr, `Failure: ${syncFailureReason ?? (run.summary.report_posted ? collectionRunStatus : run.summary.report_reason)}`);
+            writeAgentSessionSummary(io, run.summary);
+            writeLine(io.stderr, `Retry: ${retryCommand}`);
         }
-        return finish(1);
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    addInstallEvent(installEvents, "sync", "ok");
+    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
+    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
+    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
+        ? undefined
+        : backfill.failureReason ?? "backfill_incomplete");
+    if (!completedBackfill) {
+        writeOnboardBackfillBlockedResult(io, {
+            json: command.json,
+            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, sync, status, rootsResult),
+            extra: { codex_sessions: run.summary },
+            backfill,
+        });
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    if (command.json) {
+        const jsonSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
+        const { agentRules, autostart } = jsonSetup;
+        const onboardOk = jsonSetup.ok;
+        writeOnboardJson(io, onboardJsonPayload(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, sync, status, rootsResult, {
+            agent_rules: agentRules,
+            autostart,
+            backfill: completedBackfill,
+            codex_sessions: run.summary,
+            ...(!onboardOk
+                ? {
+                    blocker: "autostart_load_failed",
+                    next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
+                }
+                : {}),
+        }));
+        return finishOnboardRun(command, installEvents, io, onboardOk ? 0 : 1);
+    }
+    writeLine(io.stdout, "4/5 Uploaded what you worked on.");
+    writeLine(io.stdout, `HTTP: ${sync.http_status}`);
+    writeLine(io.stdout, `Things recorded: ${sync.event_count}`);
+    writeLine(io.stdout, `Sources: ${sync.source_scan_count}`);
+    writeLine(io.stdout, `Risk flags: ${sync.risk_flag_count}`);
+    writeLine(io.stdout, `Raw evidence files: ${sync.raw_evidence_file_count}`);
+    writeLine(io.stdout, rawEvidenceSyncLine(sync));
+    writeAgentSessionSummary(io, run.summary);
+    writeLine(io.stdout, "5/5 Status ready.");
+    writeLine(io.stdout, `Upload state: ${status.upload_state}`);
+    writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
+    const setup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
+    const { agentRules, autostart } = setup;
+    if (!setup.ok) {
+        writeOnboardAutostartBlocker(io, autostart);
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    writeLine(io.stdout, "PASS: Tower is set up and collecting.");
+    writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
+        pair,
+        status,
+        sync,
+        agentRules,
+        autostart,
+        initialSyncOk: true,
+        backfill: completedBackfill,
+    });
+    return finishOnboardRun(command, installEvents, io, 0);
+}
+/**
+ * Every uncaught error from either onboarding arm lands here. `status` is
+ * always recomputed fresh against whichever root got furthest, never trusted
+ * from before the throw — the arms already recompute it themselves on their
+ * own success paths, so nothing upstream is lost by not threading it through.
+ */
+async function handleOnboardFailure(error, command, rootsResult, install, pair, sync, installEvents, io) {
+    const message = errorMessage(error);
+    const statusRoot = rootsResult?.roots[0] ?? command.repoRoot;
+    const status = statusRoot
+        ? await inspectLocalCollectorStatus({
+            homeDir: command.homeDir,
+            repoRoot: statusRoot,
+            branch: command.branch,
+        }).catch(() => null)
+        : null;
+    const blocker = classifyOnboardBlocker(message);
+    addOnboardFailureEvent(installEvents, blocker);
+    const nextStep = nextStepForOnboardBlocker(blocker, command);
+    if (command.json) {
+        writeOnboardJson(io, onboardJsonPayload("blocked", command, install, pair, sync, status, rootsResult, {
+            blocker,
+            message,
+            next_step: nextStep,
+        }));
+    }
+    else {
+        writeLine(io.stderr, `BLOCKED: ${message}`);
+        writeLine(io.stderr, `Next: ${nextStep}`);
     }
+    return finishOnboardRun(command, installEvents, io, 1);
 }
 async function runMultiRepoOnboard(command, io, worktrees) {
     if (!command.json) {
@@ -1207,6 +1265,13 @@ function syncResult(run) {
         failureReasons: run.ok ? [] : run.failure_reasons,
     };
 }
+/**
+ * The sync runbook: resolve which roots to collect, dedup staged packs before
+ * touching anything else, discover worktrees, sync them, then report — one of
+ * three shapes depending on how many worktrees came back. The three shapes
+ * share nothing but `dedup`, so each gets its own step function below rather
+ * than one branchy body.
+ */
 async function runSyncLocked(command, io) {
     const collectionRoots = await resolveSyncCollectionRoots(command);
     // Before anything is collected: collapse byte-identical staged packs. It runs
@@ -1233,33 +1298,7 @@ async function runSyncLocked(command, io) {
         fetchImpl: io.fetch,
     });
     if (run.outcomes.length > 1) {
-        const rows = run.outcomes.map((outcome) => worktreeSyncRow(outcome, run));
-        const collectionRunStatus = attributedSyncRunStatus(run);
-        const gc = run.ok ? await runSyncRawEvidenceGc(command, io) : null;
-        if (command.json) {
-            writeLine(io.stdout, JSON.stringify({
-                mode: "multi_repo",
-                status: collectionRunStatus,
-                collection_complete: run.ok,
-                results: run.outcomes.map((outcome) => outcome.sync),
-                repos: rows,
-                codex_sessions: run.summary,
-                raw_evidence_gc: gc,
-                raw_evidence_dedup: dedup,
-            }, null, 2));
-            return syncResult(run);
-        }
-        writeLine(run.ok ? io.stdout : io.stderr, `Tower parent sync ${collectionRunStatus} ${run.outcomes.filter((outcome) => outcome.sync.status === "uploaded").length}/${run.outcomes.length} worktree(s).`);
-        for (const outcome of run.outcomes) {
-            const { worktree, sync } = outcome;
-            const uploaded = sync.status === "uploaded";
-            const failureSuffix = sync.status === "spooled" ? ` reason:${sync.failure_reason}` : "";
-            writeLine(uploaded ? io.stdout : io.stderr, `- ${worktree.repo_label}/${worktree.worktree_label} (${worktree.branch}) head:${shortSha(sync.head_sha ?? worktree.head_sha)} ${sync.status} objects:${sync.raw_evidence_uploaded_object_count} chunks:${sync.raw_evidence_uploaded_chunk_count} reused:${sync.raw_evidence_reused_count} failed:${sync.raw_evidence_failed_count} cursor:${sync.cursor_tracked_object_count}${failureSuffix}`);
-        }
-        writeAgentSessionSummary(io, run.summary);
-        if (gc && !gc.skipped)
-            writeLine(io.stdout, rawEvidenceGcSummary(gc));
-        return syncResult(run);
+        return reportMultiRepoSync(command, io, run, dedup);
     }
     // Zero worktrees is a legitimate steady state, not a failure: an approved
     // root can hold no git repos, and sessions upload independently of
@@ -1268,25 +1307,60 @@ async function runSyncLocked(command, io) {
     // fleet machine with a single empty root and taught people to ignore
     // sync_failed (BLI-2722). A genuinely broken run still fails via run.ok.
     if (run.outcomes.length === 0) {
-        const collectionRunStatus = attributedSyncRunStatus(run);
-        const gc = run.ok ? await runSyncRawEvidenceGc(command, io) : null;
-        if (command.json) {
-            writeLine(io.stdout, JSON.stringify({
-                mode: "no_worktrees",
-                status: collectionRunStatus,
-                collection_complete: run.ok,
-                codex_sessions: run.summary,
-                raw_evidence_gc: gc,
-                raw_evidence_dedup: dedup,
-            }, null, 2));
-            return syncResult(run);
-        }
-        writeLine(run.ok ? io.stdout : io.stderr, `Tower sync ${collectionRunStatus}: no git worktrees under this root; session scan ran.`);
-        writeAgentSessionSummary(io, run.summary);
-        if (gc && !gc.skipped)
-            writeLine(io.stdout, rawEvidenceGcSummary(gc));
+        return reportNoWorktreeSync(command, io, run, dedup);
+    }
+    return reportSingleRepoSync(command, io, run, dedup);
+}
+async function reportMultiRepoSync(command, io, run, dedup) {
+    const rows = run.outcomes.map((outcome) => worktreeSyncRow(outcome, run));
+    const collectionRunStatus = attributedSyncRunStatus(run);
+    const gc = run.ok ? await runSyncRawEvidenceGc(command, io) : null;
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({
+            mode: "multi_repo",
+            status: collectionRunStatus,
+            collection_complete: run.ok,
+            results: run.outcomes.map((outcome) => outcome.sync),
+            repos: rows,
+            codex_sessions: run.summary,
+            raw_evidence_gc: gc,
+            raw_evidence_dedup: dedup,
+        }, null, 2));
         return syncResult(run);
     }
+    writeLine(run.ok ? io.stdout : io.stderr, `Tower parent sync ${collectionRunStatus} ${run.outcomes.filter((outcome) => outcome.sync.status === "uploaded").length}/${run.outcomes.length} worktree(s).`);
+    for (const outcome of run.outcomes) {
+        const { worktree, sync } = outcome;
+        const uploaded = sync.status === "uploaded";
+        const failureSuffix = sync.status === "spooled" ? ` reason:${sync.failure_reason}` : "";
+        writeLine(uploaded ? io.stdout : io.stderr, `- ${worktree.repo_label}/${worktree.worktree_label} (${worktree.branch}) head:${shortSha(sync.head_sha ?? worktree.head_sha)} ${sync.status} objects:${sync.raw_evidence_uploaded_object_count} chunks:${sync.raw_evidence_uploaded_chunk_count} reused:${sync.raw_evidence_reused_count} failed:${sync.raw_evidence_failed_count} cursor:${sync.cursor_tracked_object_count}${failureSuffix}`);
+    }
+    writeAgentSessionSummary(io, run.summary);
+    if (gc && !gc.skipped)
+        writeLine(io.stdout, rawEvidenceGcSummary(gc));
+    return syncResult(run);
+}
+async function reportNoWorktreeSync(command, io, run, dedup) {
+    const collectionRunStatus = attributedSyncRunStatus(run);
+    const gc = run.ok ? await runSyncRawEvidenceGc(command, io) : null;
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({
+            mode: "no_worktrees",
+            status: collectionRunStatus,
+            collection_complete: run.ok,
+            codex_sessions: run.summary,
+            raw_evidence_gc: gc,
+            raw_evidence_dedup: dedup,
+        }, null, 2));
+        return syncResult(run);
+    }
+    writeLine(run.ok ? io.stdout : io.stderr, `Tower sync ${collectionRunStatus}: no git worktrees under this root; session scan ran.`);
+    writeAgentSessionSummary(io, run.summary);
+    if (gc && !gc.skipped)
+        writeLine(io.stdout, rawEvidenceGcSummary(gc));
+    return syncResult(run);
+}
+async function reportSingleRepoSync(command, io, run, dedup) {
     const result = run.outcomes[0]?.sync;
     if (!result) {
         throw new Error("Sync produced no result for the repo worktree.");