@bli-cockpit/cli 0.2.40 → 0.2.42

package/dist/adapters/local-sources.js

@@ -2,6 +2,7 @@ import { collectCarState } from "./car-state.js";
 import fs from "node:fs/promises";
 import { makeSourceScan, makeUnavailableScan, } from "./common.js";
 import { collectGitState } from "./git-state.js";
+import { describeError } from "../health-detail.js";
 import { collectRawEvidencePack, } from "./raw-evidence.js";
 import { generateDumbRiskFlags } from "./risk-flags.js";
 import { resolveTicketBinding, } from "./ticket-binding.js";
@@ -50,9 +51,11 @@ export async function runLocalSourceCollectors(options) {
         makeUnavailableScan(context, "claude_hooks", "claude-hooks", "claude_hooks_not_present"),
     ];
     // claude_jsonl availability (B.4): "ok" when ~/.claude/projects exists, else
-    // skipped with claude_projects_dir_not_found so an operator on a non-Claude
-    // machine sees why the claude funnel is empty. Collection itself is gated
-    // separately by collect_claude_jsonl in the sync orchestrator.
+    // skipped with the reason it could not be read — absent, permission-denied,
+    // not a directory, or unreadable (BLI-3483) — so an operator sees whether
+    // the empty claude funnel is normal or a wall they can take down. Collection
+    // itself is gated separately by collect_claude_jsonl in the sync
+    // orchestrator.
     const claudeJsonlScan = await makeClaudeJsonlScan(context, options.claudeProjectsDir);
     const candidates = collectBindingCandidates([
         git.scan,
@@ -93,9 +96,52 @@ async function makeClaudeJsonlScan(context, projectsDir) {
     if (!projectsDir) {
         return makeUnavailableScan(context, "claude_jsonl", "claude-jsonl", "claude_projects_dir_not_configured");
     }
-    const present = await fs.stat(projectsDir).then((stat) => stat.isDirectory(), () => false);
-    return makeSourceScan(context, "claude_jsonl", "claude-jsonl", present ? "ok" : "skipped", present ? "claude_projects_dir_present" : "claude_projects_dir_not_found");
+    // Until BLI-3483 every failure of this stat became `claude_projects_dir_
+    // not_found`, so a machine that HAS the folder and cannot open it — macOS
+    // TCC withholding Full Disk Access, a Windows ACL, a corporate MDM profile —
+    // reported the same word as a machine that has never run Claude Code. One
+    // repair is "nothing to do"; the other is "grant this app access, then every
+    // Claude session on this laptop starts collecting". Opposite meanings, one
+    // label, and the empty funnel looked normal either way.
+    const inspected = await fs.stat(projectsDir).then((stat) => ({ ok: true, isDirectory: stat.isDirectory() }), (error) => ({ ok: false, error }));
+    if (inspected.ok && inspected.isDirectory) {
+        return makeSourceScan(context, "claude_jsonl", "claude-jsonl", "ok", "claude_projects_dir_present");
+    }
+    const reason = inspected.ok
+        ? "claude_projects_dir_not_a_directory"
+        : claudeProjectsDirFailureReason(inspected.error);
+    // Never the path: it is under the operator's home directory.
+    console.error("[local-sources] claude projects directory unavailable", JSON.stringify({
+        reason,
+        fix_hint: CLAUDE_PROJECTS_FIX_HINTS[reason],
+        ...(inspected.ok ? {} : describeError(inspected.error)),
+    }));
+    return makeSourceScan(context, "claude_jsonl", "claude-jsonl", "skipped", reason);
+}
+/**
+ * `ENOENT`/`ENOTDIR` is the ordinary "this machine does not run Claude Code".
+ * `EACCES`/`EPERM` is a permission wall a person can take down. Anything else
+ * (`ELOOP`, `ENAMETOOLONG`, an I/O error) is named as unreadable rather than
+ * folded into either, because guessing between them is what created this bug.
+ */
+function claudeProjectsDirFailureReason(error) {
+    const code = error && typeof error === "object"
+        ? error.code
+        : undefined;
+    if (code === "ENOENT" || code === "ENOTDIR") {
+        return "claude_projects_dir_not_found";
+    }
+    if (code === "EACCES" || code === "EPERM") {
+        return "claude_projects_dir_permission_denied";
+    }
+    return "claude_projects_dir_unreadable";
 }
+const CLAUDE_PROJECTS_FIX_HINTS = {
+    claude_projects_dir_not_found: "nothing to repair unless this machine runs Claude Code",
+    claude_projects_dir_permission_denied: "macOS: grant the terminal/CLI Full Disk Access in System Settings > Privacy & Security; Windows: check the folder ACL on the user profile",
+    claude_projects_dir_not_a_directory: "a file sits where the projects directory should be; move or remove it",
+    claude_projects_dir_unreadable: "read the error_code beside this line; the folder exists but the stat failed",
+};
 function isGitStateFacts(value) {
     return Boolean(value && typeof value === "object" && "repo_root" in value);
 }

package/dist/autostart.js

@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "./local-state.js";
 import { savedDiscoveryLimitArgs } from "./discovery-limits.js";
+import { redactedHealthDetail } from "./health-detail.js";
 /** launchd LaunchAgent label; matches docs/runbooks/cockpit-launchd-sync.md. */
 export const AUTOSTART_LABEL = "com.bli.cockpit.sync";
 export const WINDOWS_AUTOSTART_TASK_NAME = "BLI Cockpit Sync";
@@ -100,6 +101,28 @@ export async function installAutostartAgent(options) {
     await options.exec("launchctl", ["unload", plistPath]).catch(() => undefined);
     const load = await options.exec("launchctl", ["load", plistPath]);
     const loaded = load.code === 0;
+    // Both branches log, for the same reason the Windows path does: a line that
+    // only fires on failure cannot answer "did background collection get
+    // installed at all today?". Until BLI-3483 the macOS failure existed only in
+    // the returned `message`, which nothing on the sync path reads — a Mac could
+    // finish `cockpit onboard` with no scheduler and nothing in sync.err.log.
+    // Metadata only: launchctl's stderr can carry the state directory, so the
+    // exit code and the redacted first line travel, never the raw text.
+    if (loaded) {
+        console.error("[autostart] launchd agent loaded", JSON.stringify({
+            label: AUTOSTART_LABEL,
+            interval_seconds: intervalSeconds,
+            watch_path_count: watchPaths.length,
+        }));
+    }
+    else {
+        console.error("[autostart] launchctl load failed; this Mac has no background collection", JSON.stringify({
+            reason: "autostart_load_failed",
+            label: AUTOSTART_LABEL,
+            exit_code: load.code,
+            detail: launchctlDetail(load),
+        }));
+    }
     return {
         status: "installed",
         label: AUTOSTART_LABEL,
@@ -112,10 +135,27 @@ export async function installAutostartAgent(options) {
         ...(loaded
             ? {}
             : {
-                message: `launchctl load exited ${load.code}: ${load.stderr.trim() || "unknown error"}`,
+                message: `launchctl load exited ${load.code}: ${launchctlDetail(load)}`,
             }),
     };
 }
+/**
+ * What `launchctl` actually said, or an honest account of it saying nothing.
+ *
+ * "unknown error" was the old fallback, and it is the least useful string in
+ * the file: `launchctl load` exits nonzero with EMPTY stderr for the ordinary
+ * cases — the agent is already loaded, or the plist was rejected — so the
+ * message an operator saw named neither the exit code's meaning nor the
+ * silence itself (BLI-3483). Exit 1 with no output is a fact; say so, and say
+ * what to do next. stdout is consulted too because launchctl is inconsistent
+ * about which stream it uses across macOS versions.
+ */
+function launchctlDetail(result) {
+    const spoken = result.stderr.trim() || result.stdout.trim();
+    if (spoken)
+        return redactedHealthDetail(spoken);
+    return `no output on either stream (exit ${result.code}); the agent may already be loaded, or launchd rejected the plist — check \`launchctl print gui/$(id -u)/${AUTOSTART_LABEL}\``;
+}
 /**
  * Removes the LaunchAgent. Reports `absent` when there was nothing to remove so
  * the command is safe to run repeatedly.
@@ -379,8 +419,9 @@ async function windowsTaskStatus(options) {
             syncLogPath: windowsSyncLogPath(options.homeDir),
         })}`;
         const currentScript = await readFile(scriptPath, "utf8").catch(() => null);
-        if (currentScript !== expectedScript) {
-            registrationProblems.push("sync script does not match the current roots or Tower runtime");
+        const scriptDifference = renderedFileDifference(currentScript, expectedScript);
+        if (scriptDifference) {
+            registrationProblems.push(`sync script does not match the current roots or Tower runtime (${describeDifference(scriptDifference)})`);
         }
     }
     // Same shape as the sync-script checks: existence always, content only when
@@ -398,8 +439,9 @@ async function windowsTaskStatus(options) {
             scriptPath,
         });
         const currentLauncher = await readFile(launcherPath, "utf8").catch(() => null);
-        if (currentLauncher !== expectedLauncher) {
-            registrationProblems.push("sync launcher does not match the current Tower runtime");
+        const launcherDifference = renderedFileDifference(currentLauncher, expectedLauncher);
+        if (launcherDifference) {
+            registrationProblems.push(`sync launcher does not match the current Tower runtime (${describeDifference(launcherDifference)})`);
         }
     }
     // Both branches log. A line that only fires on failure cannot answer "did
@@ -431,6 +473,64 @@ async function windowsTaskStatus(options) {
             : {}),
     };
 }
+function renderedFileDifference(current, expected) {
+    const expectedLines = normalizedScriptLines(expected);
+    if (current === null) {
+        return {
+            reason: "file_unreadable",
+            first_differing_line: null,
+            current_line_count: null,
+            expected_line_count: expectedLines.length,
+        };
+    }
+    if (hasByteOrderMark(current) !== hasByteOrderMark(expected)) {
+        return {
+            reason: "byte_order_mark",
+            first_differing_line: 0,
+            current_line_count: normalizedScriptLines(current).length,
+            expected_line_count: expectedLines.length,
+        };
+    }
+    const currentLines = normalizedScriptLines(current);
+    const shared = Math.min(currentLines.length, expectedLines.length);
+    for (let index = 0; index < shared; index += 1) {
+        if (currentLines[index] !== expectedLines[index]) {
+            return {
+                reason: "line_content",
+                first_differing_line: index,
+                current_line_count: currentLines.length,
+                expected_line_count: expectedLines.length,
+            };
+        }
+    }
+    if (currentLines.length !== expectedLines.length) {
+        return {
+            reason: "line_count",
+            first_differing_line: shared,
+            current_line_count: currentLines.length,
+            expected_line_count: expectedLines.length,
+        };
+    }
+    return null;
+}
+/** Safe to print: a reason label, a line index, two counts. No content. */
+function describeDifference(difference) {
+    if (difference.reason === "file_unreadable")
+        return "file could not be read";
+    if (difference.reason === "byte_order_mark")
+        return "byte-order mark differs";
+    return `${difference.reason} at line ${difference.first_differing_line}, ${difference.current_line_count} lines on disk vs ${difference.expected_line_count} expected`;
+}
+function normalizedScriptLines(value) {
+    const withoutBom = hasByteOrderMark(value) ? value.slice(UTF8_BOM.length) : value;
+    return withoutBom
+        .replace(/\r\n/gu, "\n")
+        .replace(/\s+$/u, "")
+        .split("\n");
+}
+function hasByteOrderMark(value) {
+    return value.startsWith(UTF8_BOM);
+}
 function windowsAutostartScriptPath(homeDir) {
     return path.join(getCollectorRuntimePaths(homeDir ?? os.homedir()).state_dir, WINDOWS_AUTOSTART_SCRIPT_NAME);
 }

package/dist/commands/brief-edit.js

@@ -0,0 +1,289 @@
+/**
+ * `cockpit brief edit` — rewrite the page like a document (BLI-3458, S2.7).
+ *
+ * The browser has had this since BLI-3120: click into a line, fix the words,
+ * press save, and the edit IS the correction — the exact wrong words, the exact
+ * right words, and optionally why, which is strictly more than any complaint
+ * could carry. This is the same door from a terminal.
+ *
+ * Four steps, and the order matters:
+ *
+ *   1. `GET /api/jarvis/brief?editable=1` — the page as a file, one
+ *      `[claimId] the prose` line per rewritable claim. The server builds it
+ *      from the SAME `indexClaims` the edit door diffs against, so an untouched
+ *      line comes back byte-identical instead of being filed as an edit.
+ *   2. Open `$VISUAL`/`$EDITOR` on a temp copy (`editor.ts` owns that, and it is
+ *      the one place in this package that spawns a program a PERSON chose). No
+ *      editor, or nothing to open one on — piped input, a script, CI — and the
+ *      edited document is read from stdin instead.
+ *   3. Diff HERE, not on the server. Only lines that really changed are sent, so
+ *      an accidental save writes nothing and publishes no version.
+ *   4. `POST /api/jarvis/edit` — the same door the browser's save posts to.
+ *
+ * Two refusals happen before anything is sent, both by name:
+ *
+ * - **A claim id that vanished.** The document is a set of lines, not a text
+ *   file: deleting one is not "delete that sentence", it is "I have no opinion
+ *   about it", and the two are indistinguishable to a diff. Sending it as an
+ *   emptied line would publish a page with a hole in it.
+ * - **A claim id that was invented.** Filing a correction against a clause
+ *   nobody can find is how a ledger fills with rows that mean nothing.
+ */
+import { colorEnabled, dim, isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
+import { editInEditor, resolveEditorCommand } from "./editor.js";
+import { loadPairedSession, towerJsonRequest } from "../tower-client.js";
+const REQUEST_DEADLINE_MS = 120_000;
+/** A page is long; a document that arrives bigger than this is not one of ours. */
+const MAX_DOCUMENT_CHARS = 400_000;
+export async function runBriefEdit(command, io) {
+    const session = await loadPairedSession("brief edit", command.homeDir);
+    const dashboardUrl = command.dashboardUrl ?? session.dashboard_url;
+    const log = (line) => writeLine(io.stderr, line);
+    const startedAt = Date.now();
+    // ── 1. The page, as a document ────────────────────────────────────────────
+    const read = await towerJsonRequest({
+        dashboardUrl,
+        path: `/api/jarvis/brief${briefQuery(command)}`,
+        deviceToken: session.device_token,
+        fetch: io.fetch,
+        method: "GET",
+        label: "brief:edit",
+        timeoutMs: REQUEST_DEADLINE_MS,
+        log,
+    });
+    if (!read.ok)
+        return fail(command, io, read.reason, read.detail);
+    const brief = read.body;
+    const personId = brief.page?.personId;
+    const original = brief.editable?.document;
+    const lines = (brief.editable?.lines ?? []).filter((line) => typeof line.claimId === "string" && typeof line.text === "string");
+    if (!brief.ok || !personId || typeof original !== "string" || lines.length === 0) {
+        return fail(command, io, brief.error ?? "no_page", brief.reply ?? "There is no page to edit.");
+    }
+    // ── 2. Their editor, or their stdin ───────────────────────────────────────
+    const edited = await collectEditedDocument(io, original, log);
+    if (!edited.ok)
+        return fail(command, io, edited.reason, edited.detail);
+    // ── 3. The diff, here ─────────────────────────────────────────────────────
+    const diff = diffDocument(lines, edited.text);
+    if (diff.invented.length > 0) {
+        return fail(command, io, "invented_claim", `The page has no line called “${diff.invented[0]}”. Change the words after an id, never the id ` +
+            "itself — nothing has been sent to Tower.");
+    }
+    if (diff.deleted.length > 0) {
+        return fail(command, io, "deleted_claim", `The line [${diff.deleted[0]}] is missing from what you saved. Put it back — a line you delete ` +
+            "reads as no opinion at all, not as a sentence to remove, and Tower cannot tell those apart. " +
+            "Nothing has been sent.");
+    }
+    if (diff.edits.length === 0) {
+        const styled = colorEnabled(io);
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({ ok: true, saved: 0, reason: "nothing_changed" }));
+        }
+        else {
+            writeLine(io.stdout, dim("Nothing changed, so nothing was written.", styled));
+        }
+        writeLine(io.stderr, `[brief edit] nothing changed ${JSON.stringify({
+            lines: lines.length,
+            elapsed_ms: Date.now() - startedAt,
+        })}`);
+        return 0;
+    }
+    // ── 4. The same door the browser's save posts to ──────────────────────────
+    const saved = await towerJsonRequest({
+        dashboardUrl,
+        path: "/api/jarvis/edit",
+        deviceToken: session.device_token,
+        fetch: io.fetch,
+        label: "brief:edit:save",
+        timeoutMs: REQUEST_DEADLINE_MS,
+        log,
+        body: {
+            personId,
+            pageId: brief.page?.pageId ?? null,
+            edits: diff.edits,
+            ...(command.reason ? { reason: command.reason } : {}),
+        },
+    });
+    if (!saved.ok)
+        return fail(command, io, saved.reason, saved.detail);
+    const answer = saved.body;
+    writeOutcome(command, io, answer, diff.edits.length);
+    writeLine(io.stderr, `[brief edit] saved ${JSON.stringify({
+        sent: diff.edits.length,
+        saved: answer.saved ?? null,
+        versions: answer.versions ?? null,
+        skipped: answer.skipped?.length ?? 0,
+        overruled: answer.overruled?.length ?? 0,
+        reason: answer.reason ?? null,
+        had_reason: command.reason != null,
+        subject: command.subject ? "selected" : "caller",
+        elapsed_ms: Date.now() - startedAt,
+    })}`);
+    return 0;
+}
+function briefQuery(command) {
+    const params = new URLSearchParams({ editable: "1" });
+    if (command.subject)
+        params.set("p", command.subject);
+    if (command.version)
+        params.set("v", command.version);
+    return `?${params.toString()}`;
+}
+/**
+ * The edited document.
+ *
+ * Piped stdin wins, and deliberately: somebody who prepared a file has already
+ * done the editing, and opening an editor on top of it would be the command
+ * ignoring what it was handed. Otherwise the editor opens — and when there is
+ * neither, the refusal names both ways out rather than guessing `vi` at
+ * somebody who has never used it.
+ */
+async function collectEditedDocument(io, original, log) {
+    if (!isInteractiveStdin(io)) {
+        let piped;
+        try {
+            piped = await readPipedText(io.stdin, {
+                maxChars: MAX_DOCUMENT_CHARS,
+                overflowMessage: `An edited page is limited to ${MAX_DOCUMENT_CHARS} characters.`,
+            });
+        }
+        catch (error) {
+            return {
+                ok: false,
+                reason: "stdin_unreadable",
+                detail: error instanceof Error ? error.message : String(error),
+            };
+        }
+        if (piped.trim() === "") {
+            return {
+                ok: false,
+                reason: "nothing_on_stdin",
+                detail: "Nothing arrived on stdin. Run `cockpit brief edit` in a terminal to open your editor, " +
+                    "or pipe the edited document in: `cockpit brief --editable > page.md; … ; " +
+                    "cockpit brief edit < page.md`.",
+            };
+        }
+        log(`[brief edit] read from stdin ${JSON.stringify({ chars: piped.length })}`);
+        return { ok: true, text: piped, via: "stdin" };
+    }
+    if (!resolveEditorCommand(io.env)) {
+        return {
+            ok: false,
+            reason: "no_editor_configured",
+            detail: "No editor is configured. Set EDITOR (or VISUAL) — `export EDITOR=nano` — or pipe the " +
+                "edited document in on stdin instead.",
+        };
+    }
+    const session = await editInEditor({
+        contents: original,
+        suffix: ".md",
+        env: io.env,
+        log,
+    });
+    if (!session.ok)
+        return { ok: false, reason: session.reason, detail: session.detail };
+    return { ok: true, text: session.text, via: "editor" };
+}
+/**
+ * What actually changed, decided here rather than on the server.
+ *
+ * The parse mirrors `apps/dashboard/src/lib/jarvis/serialize/editable-document.ts`,
+ * which produced the document: `#` is a comment, a `[id]` starts a line, a
+ * following un-prefixed line is that line wrapped rather than a new one. It only
+ * ever has to read what the server wrote, and the `unchanged` case proves it
+ * did — a parser that got this wrong would report every line as an edit, which
+ * is exactly the failure `editable-document.test.ts` holds the server side to.
+ */
+export function diffDocument(original, edited) {
+    const before = new Map(original.filter((line) => line.rewritable).map((line) => [line.claimId, normalize(line.text)]));
+    const seen = new Set();
+    const diff = { edits: [], invented: [], deleted: [] };
+    for (const parsed of parseDocument(edited)) {
+        if (seen.has(parsed.claimId))
+            continue;
+        seen.add(parsed.claimId);
+        const stored = before.get(parsed.claimId);
+        if (stored === undefined) {
+            diff.invented.push(parsed.claimId);
+            continue;
+        }
+        const after = normalize(parsed.text);
+        if (after !== stored)
+            diff.edits.push({ claimId: parsed.claimId, after });
+    }
+    for (const claimId of before.keys()) {
+        if (!seen.has(claimId))
+            diff.deleted.push(claimId);
+    }
+    return diff;
+}
+/** The same collapse `normalizeEditedText` does server-side, so the two agree. */
+function normalize(text) {
+    return text.replace(/ /g, " ").replace(/\s+/g, " ").trim();
+}
+const CLAIM_LINE = /^\[([^\]\s]+)\]\s?(.*)$/;
+export function parseDocument(text) {
+    const out = [];
+    let current = null;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (line.startsWith("#")) {
+            current = null;
+            continue;
+        }
+        const match = CLAIM_LINE.exec(line);
+        if (match) {
+            current = { claimId: match[1], text: (match[2] ?? "").trim() };
+            out.push(current);
+            continue;
+        }
+        if (line === "") {
+            current = null;
+            continue;
+        }
+        if (current)
+            current.text = `${current.text} ${line}`.trim();
+    }
+    return out;
+}
+function writeOutcome(command, io, answer, sent) {
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, sent, ...answer }));
+        return;
+    }
+    const styled = colorEnabled(io);
+    const saved = answer.saved ?? 0;
+    const versions = answer.versions;
+    writeLine(io.stdout, saved === 1
+        ? "One line rewritten, and Tower has it."
+        : `${saved} lines rewritten, and Tower has them.`);
+    if (typeof versions === "number") {
+        writeLine(io.stdout, dim(`Your page now has ${versions} versions.`, styled));
+    }
+    else if (answer.reason) {
+        // The edit is on the record and the page did not move. Never silent: the
+        // server named which of the four reasons it was and it goes straight out.
+        writeLine(io.stdout, dim(`The page itself was not republished (${answer.reason}); your words are on the record.`, styled));
+    }
+    for (const skip of answer.skipped ?? []) {
+        writeLine(io.stdout, dim(`Not applied: [${skip.claimId ?? "?"}] — ${skip.reason ?? "no reason given"}.`, styled));
+    }
+    // The push-back is the point, not an error path: the record disagreed with
+    // what they typed, their words were kept anyway, and the disagreement is said
+    // out loud rather than quietly stored.
+    for (const overruled of answer.overruled ?? []) {
+        if (overruled.pushBack)
+            writeLine(io.stdout, overruled.pushBack);
+    }
+}
+function fail(command, io, reason, detail) {
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: false, error: reason, detail }));
+    }
+    else {
+        writeLine(io.stderr, detail);
+    }
+    writeLine(io.stderr, `[brief edit] not saved ${JSON.stringify({ reason })}`);
+    return 1;
+}