@bli-cockpit/cli 0.2.39 → 0.2.41

package/dist/adapters/local-sources.js

@@ -2,6 +2,7 @@ import { collectCarState } from "./car-state.js";
 import fs from "node:fs/promises";
 import { makeSourceScan, makeUnavailableScan, } from "./common.js";
 import { collectGitState } from "./git-state.js";
+import { describeError } from "../health-detail.js";
 import { collectRawEvidencePack, } from "./raw-evidence.js";
 import { generateDumbRiskFlags } from "./risk-flags.js";
 import { resolveTicketBinding, } from "./ticket-binding.js";
@@ -50,9 +51,11 @@ export async function runLocalSourceCollectors(options) {
         makeUnavailableScan(context, "claude_hooks", "claude-hooks", "claude_hooks_not_present"),
     ];
     // claude_jsonl availability (B.4): "ok" when ~/.claude/projects exists, else
-    // skipped with claude_projects_dir_not_found so an operator on a non-Claude
-    // machine sees why the claude funnel is empty. Collection itself is gated
-    // separately by collect_claude_jsonl in the sync orchestrator.
+    // skipped with the reason it could not be read — absent, permission-denied,
+    // not a directory, or unreadable (BLI-3483) — so an operator sees whether
+    // the empty claude funnel is normal or a wall they can take down. Collection
+    // itself is gated separately by collect_claude_jsonl in the sync
+    // orchestrator.
     const claudeJsonlScan = await makeClaudeJsonlScan(context, options.claudeProjectsDir);
     const candidates = collectBindingCandidates([
         git.scan,
@@ -93,9 +96,52 @@ async function makeClaudeJsonlScan(context, projectsDir) {
     if (!projectsDir) {
         return makeUnavailableScan(context, "claude_jsonl", "claude-jsonl", "claude_projects_dir_not_configured");
     }
-    const present = await fs.stat(projectsDir).then((stat) => stat.isDirectory(), () => false);
-    return makeSourceScan(context, "claude_jsonl", "claude-jsonl", present ? "ok" : "skipped", present ? "claude_projects_dir_present" : "claude_projects_dir_not_found");
+    // Until BLI-3483 every failure of this stat became `claude_projects_dir_
+    // not_found`, so a machine that HAS the folder and cannot open it — macOS
+    // TCC withholding Full Disk Access, a Windows ACL, a corporate MDM profile —
+    // reported the same word as a machine that has never run Claude Code. One
+    // repair is "nothing to do"; the other is "grant this app access, then every
+    // Claude session on this laptop starts collecting". Opposite meanings, one
+    // label, and the empty funnel looked normal either way.
+    const inspected = await fs.stat(projectsDir).then((stat) => ({ ok: true, isDirectory: stat.isDirectory() }), (error) => ({ ok: false, error }));
+    if (inspected.ok && inspected.isDirectory) {
+        return makeSourceScan(context, "claude_jsonl", "claude-jsonl", "ok", "claude_projects_dir_present");
+    }
+    const reason = inspected.ok
+        ? "claude_projects_dir_not_a_directory"
+        : claudeProjectsDirFailureReason(inspected.error);
+    // Never the path: it is under the operator's home directory.
+    console.error("[local-sources] claude projects directory unavailable", JSON.stringify({
+        reason,
+        fix_hint: CLAUDE_PROJECTS_FIX_HINTS[reason],
+        ...(inspected.ok ? {} : describeError(inspected.error)),
+    }));
+    return makeSourceScan(context, "claude_jsonl", "claude-jsonl", "skipped", reason);
+}
+/**
+ * `ENOENT`/`ENOTDIR` is the ordinary "this machine does not run Claude Code".
+ * `EACCES`/`EPERM` is a permission wall a person can take down. Anything else
+ * (`ELOOP`, `ENAMETOOLONG`, an I/O error) is named as unreadable rather than
+ * folded into either, because guessing between them is what created this bug.
+ */
+function claudeProjectsDirFailureReason(error) {
+    const code = error && typeof error === "object"
+        ? error.code
+        : undefined;
+    if (code === "ENOENT" || code === "ENOTDIR") {
+        return "claude_projects_dir_not_found";
+    }
+    if (code === "EACCES" || code === "EPERM") {
+        return "claude_projects_dir_permission_denied";
+    }
+    return "claude_projects_dir_unreadable";
 }
+const CLAUDE_PROJECTS_FIX_HINTS = {
+    claude_projects_dir_not_found: "nothing to repair unless this machine runs Claude Code",
+    claude_projects_dir_permission_denied: "macOS: grant the terminal/CLI Full Disk Access in System Settings > Privacy & Security; Windows: check the folder ACL on the user profile",
+    claude_projects_dir_not_a_directory: "a file sits where the projects directory should be; move or remove it",
+    claude_projects_dir_unreadable: "read the error_code beside this line; the folder exists but the stat failed",
+};
 function isGitStateFacts(value) {
     return Boolean(value && typeof value === "object" && "repo_root" in value);
 }

package/dist/autostart.js

@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "./local-state.js";
 import { savedDiscoveryLimitArgs } from "./discovery-limits.js";
+import { redactedHealthDetail } from "./health-detail.js";
 /** launchd LaunchAgent label; matches docs/runbooks/cockpit-launchd-sync.md. */
 export const AUTOSTART_LABEL = "com.bli.cockpit.sync";
 export const WINDOWS_AUTOSTART_TASK_NAME = "BLI Cockpit Sync";
@@ -100,6 +101,28 @@ export async function installAutostartAgent(options) {
     await options.exec("launchctl", ["unload", plistPath]).catch(() => undefined);
     const load = await options.exec("launchctl", ["load", plistPath]);
     const loaded = load.code === 0;
+    // Both branches log, for the same reason the Windows path does: a line that
+    // only fires on failure cannot answer "did background collection get
+    // installed at all today?". Until BLI-3483 the macOS failure existed only in
+    // the returned `message`, which nothing on the sync path reads — a Mac could
+    // finish `cockpit onboard` with no scheduler and nothing in sync.err.log.
+    // Metadata only: launchctl's stderr can carry the state directory, so the
+    // exit code and the redacted first line travel, never the raw text.
+    if (loaded) {
+        console.error("[autostart] launchd agent loaded", JSON.stringify({
+            label: AUTOSTART_LABEL,
+            interval_seconds: intervalSeconds,
+            watch_path_count: watchPaths.length,
+        }));
+    }
+    else {
+        console.error("[autostart] launchctl load failed; this Mac has no background collection", JSON.stringify({
+            reason: "autostart_load_failed",
+            label: AUTOSTART_LABEL,
+            exit_code: load.code,
+            detail: launchctlDetail(load),
+        }));
+    }
     return {
         status: "installed",
         label: AUTOSTART_LABEL,
@@ -112,10 +135,27 @@ export async function installAutostartAgent(options) {
         ...(loaded
             ? {}
             : {
-                message: `launchctl load exited ${load.code}: ${load.stderr.trim() || "unknown error"}`,
+                message: `launchctl load exited ${load.code}: ${launchctlDetail(load)}`,
             }),
     };
 }
+/**
+ * What `launchctl` actually said, or an honest account of it saying nothing.
+ *
+ * "unknown error" was the old fallback, and it is the least useful string in
+ * the file: `launchctl load` exits nonzero with EMPTY stderr for the ordinary
+ * cases — the agent is already loaded, or the plist was rejected — so the
+ * message an operator saw named neither the exit code's meaning nor the
+ * silence itself (BLI-3483). Exit 1 with no output is a fact; say so, and say
+ * what to do next. stdout is consulted too because launchctl is inconsistent
+ * about which stream it uses across macOS versions.
+ */
+function launchctlDetail(result) {
+    const spoken = result.stderr.trim() || result.stdout.trim();
+    if (spoken)
+        return redactedHealthDetail(spoken);
+    return `no output on either stream (exit ${result.code}); the agent may already be loaded, or launchd rejected the plist — check \`launchctl print gui/$(id -u)/${AUTOSTART_LABEL}\``;
+}
 /**
  * Removes the LaunchAgent. Reports `absent` when there was nothing to remove so
  * the command is safe to run repeatedly.
@@ -379,8 +419,9 @@ async function windowsTaskStatus(options) {
             syncLogPath: windowsSyncLogPath(options.homeDir),
         })}`;
         const currentScript = await readFile(scriptPath, "utf8").catch(() => null);
-        if (currentScript !== expectedScript) {
-            registrationProblems.push("sync script does not match the current roots or Tower runtime");
+        const scriptDifference = renderedFileDifference(currentScript, expectedScript);
+        if (scriptDifference) {
+            registrationProblems.push(`sync script does not match the current roots or Tower runtime (${describeDifference(scriptDifference)})`);
         }
     }
     // Same shape as the sync-script checks: existence always, content only when
@@ -398,8 +439,9 @@ async function windowsTaskStatus(options) {
             scriptPath,
         });
         const currentLauncher = await readFile(launcherPath, "utf8").catch(() => null);
-        if (currentLauncher !== expectedLauncher) {
-            registrationProblems.push("sync launcher does not match the current Tower runtime");
+        const launcherDifference = renderedFileDifference(currentLauncher, expectedLauncher);
+        if (launcherDifference) {
+            registrationProblems.push(`sync launcher does not match the current Tower runtime (${describeDifference(launcherDifference)})`);
         }
     }
     // Both branches log. A line that only fires on failure cannot answer "did
@@ -431,6 +473,64 @@ async function windowsTaskStatus(options) {
             : {}),
     };
 }
+function renderedFileDifference(current, expected) {
+    const expectedLines = normalizedScriptLines(expected);
+    if (current === null) {
+        return {
+            reason: "file_unreadable",
+            first_differing_line: null,
+            current_line_count: null,
+            expected_line_count: expectedLines.length,
+        };
+    }
+    if (hasByteOrderMark(current) !== hasByteOrderMark(expected)) {
+        return {
+            reason: "byte_order_mark",
+            first_differing_line: 0,
+            current_line_count: normalizedScriptLines(current).length,
+            expected_line_count: expectedLines.length,
+        };
+    }
+    const currentLines = normalizedScriptLines(current);
+    const shared = Math.min(currentLines.length, expectedLines.length);
+    for (let index = 0; index < shared; index += 1) {
+        if (currentLines[index] !== expectedLines[index]) {
+            return {
+                reason: "line_content",
+                first_differing_line: index,
+                current_line_count: currentLines.length,
+                expected_line_count: expectedLines.length,
+            };
+        }
+    }
+    if (currentLines.length !== expectedLines.length) {
+        return {
+            reason: "line_count",
+            first_differing_line: shared,
+            current_line_count: currentLines.length,
+            expected_line_count: expectedLines.length,
+        };
+    }
+    return null;
+}
+/** Safe to print: a reason label, a line index, two counts. No content. */
+function describeDifference(difference) {
+    if (difference.reason === "file_unreadable")
+        return "file could not be read";
+    if (difference.reason === "byte_order_mark")
+        return "byte-order mark differs";
+    return `${difference.reason} at line ${difference.first_differing_line}, ${difference.current_line_count} lines on disk vs ${difference.expected_line_count} expected`;
+}
+function normalizedScriptLines(value) {
+    const withoutBom = hasByteOrderMark(value) ? value.slice(UTF8_BOM.length) : value;
+    return withoutBom
+        .replace(/\r\n/gu, "\n")
+        .replace(/\s+$/u, "")
+        .split("\n");
+}
+function hasByteOrderMark(value) {
+    return value.startsWith(UTF8_BOM);
+}
 function windowsAutostartScriptPath(homeDir) {
     return path.join(getCollectorRuntimePaths(homeDir ?? os.homedir()).state_dir, WINDOWS_AUTOSTART_SCRIPT_NAME);
 }

package/dist/commands/brief.js

@@ -12,10 +12,8 @@
  * Identity is the existing paired device session. `--for` changes WHOSE page is
  * asked for, never who is asking — the same rule `cockpit jarvis --as` follows.
  */
-import { writeLine } from "./cli-io.js";
+import { colorEnabled, dim, writeLine } from "./cli-io.js";
 import { loadPairedSession, towerJsonRequest } from "../tower-client.js";
-const DIM = "\x1b[2m";
-const RESET = "\x1b[0m";
 const REQUEST_DEADLINE_MS = 30_000;
 export async function runBrief(command, io) {
     const session = await loadPairedSession("brief", command.homeDir);
@@ -81,19 +79,22 @@ function queryFor(command) {
     return query ? `?${query}` : "";
 }
 function writeHuman(io, command, body) {
+    // Decided once per page: colour only for a real terminal that has not said
+    // NO_COLOR, so `cockpit brief > page.txt` is text and nothing else (BLI-3482).
+    const styled = colorEnabled(io);
     const page = body.page ?? {};
     // Whose page, and — when it is not the newest — that it is a record of a
     // moment rather than something that failed to update.
     const whose = page.displayName ? `${page.displayName}'s page` : "This page";
     const pinned = page.olderVersionLabel ? ` · version from ${page.olderVersionLabel}` : "";
-    writeLine(io.stdout, `${DIM}${whose}${pinned}${RESET}`);
+    writeLine(io.stdout, dim(`${whose}${pinned}`, styled));
     writeLine(io.stdout, "");
     writeLine(io.stdout, body.text ?? "");
     if (body.claims && body.claims.length > 0) {
         writeLine(io.stdout, "");
-        writeLine(io.stdout, `${DIM}Claim ids — pass one to \`cockpit correct --claim\`:${RESET}`);
+        writeLine(io.stdout, dim("Claim ids — pass one to `cockpit correct --claim`:", styled));
         for (const claim of body.claims) {
-            writeLine(io.stdout, `${DIM}  [${claim.claimId}]${RESET} ${claim.text ?? ""}`);
+            writeLine(io.stdout, `${dim(`  [${claim.claimId}]`, styled)} ${claim.text ?? ""}`);
         }
     }
     if (body.versions) {
@@ -101,13 +102,13 @@ function writeHuman(io, command, body) {
         if (body.versions.length === 0) {
             // Never "there is one version". An empty list with a reason is an
             // answer; an empty list without one is a wrong answer.
-            writeLine(io.stdout, `${DIM}Earlier versions could not be listed (${body.versionsReason ?? "no reason given"}).${RESET}`);
+            writeLine(io.stdout, dim(`Earlier versions could not be listed (${body.versionsReason ?? "no reason given"}).`, styled));
         }
         else {
-            writeLine(io.stdout, `${DIM}Versions — pass one to \`cockpit brief --version\`:${RESET}`);
+            writeLine(io.stdout, dim("Versions — pass one to `cockpit brief --version`:", styled));
             for (const version of body.versions) {
                 const headline = version.headline ? ` — ${version.headline}` : "";
-                writeLine(io.stdout, `${DIM}  ${version.version}/${version.of}  ${version.pageId}  ${version.asOf}${headline}${RESET}`);
+                writeLine(io.stdout, dim(`  ${version.version}/${version.of}  ${version.pageId}  ${version.asOf}${headline}`, styled));
             }
         }
     }
@@ -118,7 +119,7 @@ function writeHuman(io, command, body) {
             .filter(Boolean);
         if (others.length > 0) {
             writeLine(io.stdout, "");
-            writeLine(io.stdout, `${DIM}You can also open: ${others.join(", ")} (\`--for <name>\`)${RESET}`);
+            writeLine(io.stdout, dim(`You can also open: ${others.join(", ")} (\`--for <name>\`)`, styled));
         }
     }
 }

package/dist/commands/cli-io.js

@@ -13,6 +13,35 @@ export function writeRaw(stream, text) {
 export function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+// ------------------------------------------------------------------- styling
+const SGR_DIM = "\x1b[2m";
+const SGR_RESET = "\x1b[0m";
+/**
+ * Whether this run may put colour escapes on stdout (BLI-3482). Five commands
+ * had their own copy of the same two escape constants and none of them asked
+ * this question, so `cockpit brief > page.txt` wrote `ESC[2m` into the file and
+ * `cockpit scout | grep` matched against bytes nobody typed.
+ *
+ * Two conditions, both from `io` rather than the process so a test can state
+ * them: stdout is a real terminal, and NO_COLOR is absent or empty
+ * (no-color.org — any non-empty value, whatever it says, means no colour).
+ * `defaultIo()` passes `process.env`, so in production this IS `process.env`.
+ */
+export function colorEnabled(io) {
+    if ((io.env["NO_COLOR"] ?? "") !== "")
+        return false;
+    return Boolean(io.stdout.isTTY);
+}
+/**
+ * The one dim-text helper. `enabled` is an explicit argument, never read from
+ * the process here, so the pure render modules stay deterministic and a caller
+ * cannot forget the gate without the compiler saying so.
+ */
+export function dim(text, enabled) {
+    if (!enabled || text === "")
+        return text;
+    return `${SGR_DIM}${text}${SGR_RESET}`;
+}
 export function writeExecOutput(io, result, options) {
     if (options.stdout)
         writeRaw(io.stdout, result.stdout);
@@ -20,7 +49,39 @@ export function writeExecOutput(io, result, options) {
         writeRaw(io.stderr, result.stderr);
 }
 export function isInteractiveStdin(io) {
-    return Boolean(io.stdin.isTTY);
+    const isTTY = io.stdin.isTTY;
+    // Git Bash (mintty/MSYS) gives Node a pipe for an interactive terminal, so
+    // `isTTY` is undefined and the piped branch would wait forever on an EOF
+    // that never comes (BLI-3480). MSYSTEM is set only inside MSYS shells, so
+    // launchd / Task Scheduler / spawned runs keep the non-interactive branch.
+    if (isTTY === undefined && process.env["MSYSTEM"])
+        return true;
+    return Boolean(isTTY);
+}
+/**
+ * Drops one leading U+FEFF. PowerShell 5.1 redirection and Notepad both write
+ * byte-order marks; stored verbatim, a BOM makes the first line of an env blob
+ * unreachable and pollutes pasted notes (BLI-3480). One strip, never more —
+ * a BOM anywhere else is content.
+ */
+export function stripLeadingBom(text) {
+    return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}
+/**
+ * Reads piped stdin whole as UTF-8, BOM-stripped. The one implementation
+ * behind every stdin-fed command (jarvis, correct, notes paste, settings env
+ * set) — each caller keeps its own size cap via `maxChars`.
+ */
+export async function readPipedText(stream, options) {
+    stream.setEncoding("utf8");
+    let text = "";
+    for await (const chunk of stream) {
+        text += chunk;
+        if (options?.maxChars !== undefined && text.length > options.maxChars) {
+            throw new Error(options.overflowMessage ?? `Piped input is limited to ${options.maxChars} characters.`);
+        }
+    }
+    return stripLeadingBom(text);
 }
 /**
  * Reads one line from stdin after writing a prompt. Shared by the onboard email

package/dist/commands/correct.js

@@ -23,10 +23,8 @@
  * is printed on stdout with an exit code of 0 — the correction WAS filed, with
  * its outcome recorded. Only a failure to file at all is a non-zero exit.
  */
-import { isInteractiveStdin, writeLine } from "./cli-io.js";
+import { colorEnabled, dim, isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
 import { loadPairedSession, towerJsonRequest } from "../tower-client.js";
-const DIM = "\x1b[2m";
-const RESET = "\x1b[0m";
 const REQUEST_DEADLINE_MS = 60_000;
 const MAX_CORRECTION_LENGTH = 4000;
 export async function runCorrect(command, io) {
@@ -101,11 +99,12 @@ export async function runCorrect(command, io) {
         writeLine(io.stdout, JSON.stringify({ ok: true, ...filed }));
     }
     else {
+        const styled = colorEnabled(io);
         writeLine(io.stdout, filed.reply ?? "Filed.");
         if (filed.finding)
-            writeLine(io.stdout, `${DIM}The record says: ${filed.finding}${RESET}`);
+            writeLine(io.stdout, dim(`The record says: ${filed.finding}`, styled));
         if (filed.link)
-            writeLine(io.stdout, `${DIM}${filed.link}${RESET}`);
+            writeLine(io.stdout, dim(filed.link, styled));
     }
     writeLine(io.stderr, `[correct cli] filed ${JSON.stringify({
         tier: filed.tier ?? null,
@@ -134,21 +133,10 @@ async function resolveText(command, io) {
         return command.text;
     if (isInteractiveStdin(io))
         return null;
-    const piped = await readAll(io.stdin);
+    const piped = await readPipedText(io.stdin, { maxChars: MAX_CORRECTION_LENGTH, overflowMessage: `A correction is limited to ${MAX_CORRECTION_LENGTH} characters.` });
     const trimmed = piped.trim();
     return trimmed.length > 0 ? trimmed : null;
 }
-async function readAll(stream) {
-    stream.setEncoding("utf8");
-    let text = "";
-    for await (const chunk of stream) {
-        text += chunk;
-        if (text.length > MAX_CORRECTION_LENGTH) {
-            throw new Error(`A correction is limited to ${MAX_CORRECTION_LENGTH} characters.`);
-        }
-    }
-    return text;
-}
 function writeFailure(command, io, reason, detail) {
     if (command.json) {
         writeLine(io.stdout, JSON.stringify({ ok: false, error: reason, detail }));

package/dist/commands/jarvis.js

@@ -5,12 +5,10 @@
  * existing paired device session, and every turn is executed by the dashboard
  * through the same JARVIS runtime used by web chat and Slack.
  */
-import { isInteractiveStdin, readLine, writeLine } from "./cli-io.js";
+import { colorEnabled, dim, isInteractiveStdin, readLine, readPipedText, writeLine, } from "./cli-io.js";
 import { attachedFileRefusalSentence, readAttachedImage, } from "./jarvis-attachment.js";
 import { loadPairedSession, towerFailureDetail, towerJsonRequest, towerRequest, } from "../tower-client.js";
 import { readTowerTurn, streamFailureDetail, } from "../tower-stream.js";
-const TRACE_DIM = "\x1b[2m";
-const TRACE_RESET = "\x1b[0m";
 /**
  * The dashboard route caps a turn at 120s (`maxDuration = 120`). The client
  * waits slightly longer so the server's own named failure wins the race
@@ -108,14 +106,15 @@ function writeThreadList(io, threads) {
         writeLine(io.stdout, "No terminal conversations yet. Ask something with `cockpit jarvis`.");
         return;
     }
+    const styled = colorEnabled(io);
     for (const thread of threads) {
         const turns = thread.turnCount === 1 ? "1 turn" : `${thread.turnCount ?? 0} turns`;
-        writeLine(io.stdout, `${thread.name}  ${TRACE_DIM}${turns} · ${thread.lastAt ?? "unknown"}${TRACE_RESET}`);
+        writeLine(io.stdout, `${thread.name}  ${dim(`${turns} · ${thread.lastAt ?? "unknown"}`, styled)}`);
         if (thread.preview)
-            writeLine(io.stdout, `${TRACE_DIM}  ${thread.preview}${TRACE_RESET}`);
+            writeLine(io.stdout, dim(`  ${thread.preview}`, styled));
     }
     writeLine(io.stdout, "");
-    writeLine(io.stdout, `${TRACE_DIM}Replay one with \`cockpit jarvis --thread <name> --history\`.${TRACE_RESET}`);
+    writeLine(io.stdout, dim("Replay one with `cockpit jarvis --thread <name> --history`.", styled));
 }
 function writeThreadHistory(io, body) {
     const messages = body.messages ?? [];
@@ -124,7 +123,7 @@ function writeThreadHistory(io, body) {
         return;
     }
     if (body.truncated) {
-        writeLine(io.stdout, `${TRACE_DIM}Showing the most recent ${messages.length}; there is more before this (\`--limit\`).${TRACE_RESET}`);
+        writeLine(io.stdout, dim(`Showing the most recent ${messages.length}; there is more before this (\`--limit\`).`, colorEnabled(io)));
     }
     for (const message of messages) {
         const speaker = message.role === "you" ? "you" : "jarvis";
@@ -136,7 +135,7 @@ async function resolveOneShotPrompt(command, io) {
         return validatePrompt(command.prompt);
     if (isInteractiveStdin(io))
         return null;
-    const piped = await readAll(io.stdin);
+    const piped = await readPipedText(io.stdin, { maxChars: 4000, overflowMessage: "JARVIS questions are limited to 4000 characters." });
     return validatePrompt(piped);
 }
 async function sendOneTurn(context, prompt, io) {
@@ -294,7 +293,7 @@ function writeTraceBlock(io, trace) {
 function writeTraceLine(io, step) {
     const elapsed = typeof step.elapsedMs === "number" ? ` (${step.elapsedMs}ms)` : "";
     const failure = step.status === "failed" ? ` — failed: ${step.detail ?? "no reason given"}` : "";
-    writeLine(io.stdout, `${TRACE_DIM}  ⏺ ${step.label}${elapsed}${failure}${TRACE_RESET}`);
+    writeLine(io.stdout, dim(`  ⏺ ${step.label}${elapsed}${failure}`, colorEnabled(io)));
 }
 /**
  * Draws one streamed tool call, and says whether it drew anything.
@@ -368,15 +367,4 @@ function validatePrompt(raw) {
         throw new Error("JARVIS questions are limited to 4000 characters.");
     }
     return prompt;
-}
-async function readAll(stream) {
-    stream.setEncoding("utf8");
-    let text = "";
-    for await (const chunk of stream) {
-        text += chunk;
-        if (text.length > 4000) {
-            throw new Error("JARVIS questions are limited to 4000 characters.");
-        }
-    }
-    return text;
 }

package/dist/commands/local-discovery.js

@@ -38,6 +38,26 @@ export async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
         throw new Error(message);
     }
     if (worktrees.length === 0 && !discovery.allowEmpty) {
+        // "No git repos found" is only true when the scan could actually SEE
+        // everywhere it looked. With unreadable folders in hand, the sentence sent
+        // the operator to the wrong repair — "run from a git repo", when the repos
+        // may be sitting right there behind a permission wall (BLI-3483). The
+        // warning above prints the folders; this refusal has to carry the fact,
+        // because it is the line that ends the command.
+        if (result.unreadable_dirs.length > 0) {
+            console.error("[local-discovery] scan found no repos while folders were unopenable", JSON.stringify({
+                reason: "empty_scan_with_unreadable_dirs",
+                unreadable_dir_count: result.unreadable_dirs.length,
+                codes: [...new Set(result.unreadable_dirs.map((dir) => dir.code))],
+            }));
+            throw new Error([
+                `No git repos found, and ${result.unreadable_dirs.length} folder(s) could not be opened — so this is not proof there are none.`,
+                ...(io
+                    ? ["The folders are listed in the warning above."]
+                    : ["Run `cockpit doctor` to see which folders."]),
+                "Fix the permissions on those folders and run the command again, or point --workspace at the project folders you can read.",
+            ].join("\n"));
+        }
         throw new Error("No git repos found. Run from a git repo, or from a parent folder containing git repos.");
     }
     return worktrees;

package/dist/commands/local-help.js

@@ -348,7 +348,7 @@ function localSubcommandHelp(command) {
                 "shelf [--limit <n>] — the notes YOU have put in, and what became of each.",
                 "shelves — the shelves in use, with how many notes are on each.",
                 "upload <paths...> [--exclude \"<sentence>\"] — put one or more local files in. Explicit paths only; your shell does any globbing, and a file that does not exist is named rather than skipped.",
-                "paste [--file <path>] [--name <n>] [--exclude \"<sentence>\"] — put text in with no file. Defaults to stdin: `pbpaste | cockpit notes paste` on macOS, `Get-Clipboard | cockpit notes paste` on Windows.",
+                "paste [--file <path>] [--name <n>] [--exclude \"<sentence>\"] — put text in. --file <path> is safest (any editor encoding is decoded). Stdin works too: `pbpaste | cockpit notes paste` on macOS; on Windows use PowerShell 7 (`Get-Clipboard | cockpit notes paste`) — PowerShell 5.1 turns non-ASCII into `?` on pipes.",
                 "--exclude carries your own sentence about what to leave out, exactly as the browser's box does.",
                 "share <id> [--yes] — let everyone signed in read the statements that are safe to share. Asks first in a terminal; --yes is required without one, and --json implies --yes.",
                 "unshare <id> — take it back. Never asks: it only ever narrows who can read.",

package/dist/commands/local.js

@@ -155,6 +155,17 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
         }
     }
     catch (error) {
+        // The outermost net under every subcommand. It printed `error.message` and
+        // dropped the name, the code, the syscall and the cause — and never said
+        // WHICH subcommand died, so a scheduled `cockpit sync` and a hand-typed
+        // `cockpit doctor` failing the same way were indistinguishable in
+        // sync.err.log (BLI-3483). The human line is unchanged; the structured one
+        // beside it carries names and codes only, scrubbed by `describeError`.
+        console.error("[cockpit-cli] command failed", JSON.stringify({
+            reason: "command_failed",
+            command: command.kind,
+            ...describeError(error),
+        }));
         writeLine(io.stderr, errorMessage(error));
         return 1;
     }
@@ -1115,8 +1126,26 @@ async function runAutostartSelfHealAfterSync(command, io, dashboardUrl) {
     let result;
     try {
         const rawExec = io.exec;
-        if (!rawExec)
+        if (!rawExec) {
+            // BLI-3483: this was a bare `return`. On Windows the self-heal is the
+            // only thing that puts a broken scheduler back, so abandoning it here
+            // meant a machine could stop collecting forever and leave no receipt
+            // anywhere — the exact shape the fleet contract forbids. The packed CLI
+            // always supplies a runner (`commands/cli-io.ts`), so this fires only for
+            // an embedder that built its own `io`; it costs one line either way.
+            console.error("[autostart-self-heal] no process runner on this io; the repair could not be attempted", JSON.stringify({
+                reason: "runner_unavailable",
+                platform: process.platform,
+                next_action: "reinstall the CLI (npm i -g @bli-cockpit/cli) and run `cockpit autostart install`",
+            }));
+            result = {
+                status: "skipped",
+                reason: "runner_unavailable",
+                detail: "No process runner available to this CLI invocation; run `cockpit autostart install` by hand.",
+            };
+            await reportAutostartSelfHealOutcome(command, io, dashboardUrl, result);
             return;
+        }
         const spawnEnv = envWithNodeRuntimeOnPath(io.env ?? process.env);
         const exec = (cmd, args, options) => rawExec(cmd, args, { ...options, env: options?.env ?? spawnEnv });
         result = await runAutostartSelfHeal(getCollectorRuntimePaths(command.homeDir), {
@@ -1137,6 +1166,10 @@ async function runAutostartSelfHealAfterSync(command, io, dashboardUrl) {
     // throttle are silent; an actual repair attempt reports either way.
     if (!result || result.reason === "repair_throttled_recent_attempt")
         return;
+    await reportAutostartSelfHealOutcome(command, io, dashboardUrl, result);
+}
+/** One receipt for the repair, whichever branch above produced the outcome. */
+async function reportAutostartSelfHealOutcome(command, io, dashboardUrl, result) {
     await reportInstallEventsBestEffort({
         homeDir: command.homeDir,
         dashboardUrl,

package/dist/commands/notes-file.js

@@ -99,4 +99,31 @@ export async function readNoteFile(filePath) {
         return { ok: false, refusal: "file_unreadable", detail: errorMessage(error) };
     }
     return { ok: true, bytes, fileName, extension: extension || "none" };
+}
+/**
+ * Decodes note/env bytes to text the way an editor would, not the way UTF-8
+ * hopes (BLI-3480). PowerShell 5.1 redirection writes UTF-16LE with a BOM and
+ * Notepad's "Unicode" save does the same; decoded blindly as UTF-8 that text
+ * becomes NUL-interleaved mojibake that passes an emptiness check and stores
+ * silently. The BOM decides the codec; a BOM-less file that still decodes to
+ * NULs is refused by name rather than stored as garbage.
+ */
+export function decodeTextBytes(bytes) {
+    let text;
+    if (bytes.length >= 2 && bytes[0] === 0xff && bytes[1] === 0xfe) {
+        text = bytes.subarray(2).toString("utf16le");
+    }
+    else if (bytes.length >= 2 && bytes[0] === 0xfe && bytes[1] === 0xff) {
+        text = new TextDecoder("utf-16be").decode(bytes.subarray(2));
+    }
+    else if (bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf) {
+        text = bytes.subarray(3).toString("utf8");
+    }
+    else {
+        text = bytes.toString("utf8");
+    }
+    if (text.includes("\u0000")) {
+        return { ok: false, reason: "undecodable_text_encoding" };
+    }
+    return { ok: true, text };
 }