@bli-cockpit/cli 0.2.46 → 0.2.47

package/dist/raw-evidence-gc.js

@@ -4,7 +4,6 @@ import path from "node:path";
 import { readRawEvidenceCursor } from "./cursors/raw-evidence-cursor.js";
 import { readRawEvidenceStagingState } from "./raw-evidence-staging.js";
 const RAW_EVIDENCE_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
-const SYNC_LOG_MAX_BYTES = 50 * 1024 * 1024;
 /**
  * A staging directory belongs to one in-flight collection pass. Anything this
  * old is the remains of a crash or a kill, never live work — the longest sync
@@ -17,22 +16,12 @@ const STAGING_ORPHAN_MS = 6 * 60 * 60 * 1000;
 const GC_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
 export async function runRawEvidenceLocalGc(paths, env = process.env, now = new Date()) {
     if (env["COCKPIT_DISABLE_GC"] === "1") {
-        return {
-            skipped: true,
-            removed_dirs: 0,
-            freed_bytes: 0,
-            rotated_sync_log: false,
-        };
+        return { skipped: true, removed_dirs: 0, freed_bytes: 0 };
     }
     const throttleMarker = path.join(paths.state_dir, ".last-raw-evidence-gc");
     const lastRun = await fs.stat(throttleMarker).catch(() => null);
     if (lastRun && now.getTime() - lastRun.mtimeMs < GC_MIN_INTERVAL_MS) {
-        return {
-            skipped: true,
-            removed_dirs: 0,
-            freed_bytes: 0,
-            rotated_sync_log: false,
-        };
+        return { skipped: true, removed_dirs: 0, freed_bytes: 0 };
     }
     await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
     await fs.writeFile(throttleMarker, now.toISOString()).catch(() => undefined);
@@ -60,11 +49,17 @@ export async function runRawEvidenceLocalGc(paths, env = process.env, now = new
         removedDirs += 1;
         freedBytes += inspection.byteSize;
     }
+    // Log capping used to live here, and that is why it did not work: this GC
+    // is throttled to once a day and skipped entirely by COCKPIT_DISABLE_GC,
+    // while sync.log grows ~8 MB an hour on an active machine (measured on the
+    // reference Mac, 2026-09-04: 219,866,695 bytes with the last GC 19 hours
+    // earlier). A daily truncate-to-zero of a file that reaches ~190 MB a day is
+    // not a cap, and sync.err.log had no cap at all. One owner now, running in
+    // the tick preamble: log-rotation.ts (BLI-3553).
     return {
         skipped: false,
         removed_dirs: removedDirs,
         freed_bytes: freedBytes,
-        rotated_sync_log: await rotateSyncLog(paths),
     };
 }
 export function rawEvidenceGcSummary(result) {
@@ -288,15 +283,6 @@ async function listFiles(root) {
     }
     return files;
 }
-async function rotateSyncLog(paths) {
-    const syncLog = path.join(paths.state_dir, "sync.log");
-    const info = await fs.stat(syncLog).catch(() => null);
-    if (!info?.isFile() || info.size <= SYNC_LOG_MAX_BYTES)
-        return false;
-    await fs.truncate(syncLog, 0).catch(() => undefined);
-    const after = await fs.stat(syncLog).catch(() => null);
-    return after?.isFile() === true && after.size === 0;
-}
 async function exists(target) {
     return fs.stat(target).then(() => true, () => false);
 }

package/dist/scheduled-self-update.js

@@ -127,6 +127,7 @@ export async function runScheduledSelfUpdate(paths, deps, options = {}) {
         reason: "updated",
         target_version: targetVersion ?? installedVersion,
         installed_version: installedVersion,
+        previous_version: deps.currentVersion,
         ...forcedFields,
     };
 }

package/dist/second-install.js

@@ -0,0 +1,160 @@
+import path from "node:path";
+import { lstat, realpath } from "node:fs/promises";
+import { DARWIN_LOGIN_SHELL } from "./autostart-node-path.js";
+const NOT_CHECKED = {
+    detected: false,
+    reason: "probe_unavailable",
+    other_bin: null,
+    install_count: 0,
+    paths: [],
+};
+export async function detectSecondCockpitInstall(options) {
+    const platform = options.platform ?? process.platform;
+    const lookup = platform === "win32"
+        ? { cmd: "where.exe", args: ["cockpit"] }
+        : platform === "darwin"
+            ? { cmd: DARWIN_LOGIN_SHELL, args: ["-lc", "which -a cockpit"] }
+            : null;
+    if (!lookup)
+        return NOT_CHECKED;
+    const result = await options
+        .exec(lookup.cmd, lookup.args)
+        .catch(() => null);
+    if (!result) {
+        return { ...NOT_CHECKED, reason: "probe_failed" };
+    }
+    const candidates = parseCandidatePaths(result.stdout, platform);
+    if (candidates.length === 0) {
+        // `which`/`where` found nothing: this process was started by an absolute
+        // path (the scheduler always does) and the operator's PATH has no cockpit
+        // at all. Nothing to compare against, and nothing to complain about.
+        return {
+            detected: false,
+            reason: result.code === 0 ? "probe_failed" : "single_install",
+            other_bin: null,
+            install_count: 0,
+            paths: [],
+        };
+    }
+    const byDirectory = new Map();
+    for (const candidate of candidates) {
+        const key = directoryKey(candidate, platform);
+        if (!byDirectory.has(key))
+            byDirectory.set(key, candidate);
+    }
+    const installs = [...byDirectory.values()];
+    if (installs.length > 1) {
+        const other = await pickOther(installs, options, platform);
+        return {
+            detected: true,
+            reason: "second_install_detected",
+            other_bin: platformBasename(other ?? installs[installs.length - 1] ?? "", platform),
+            install_count: installs.length,
+            paths: installs,
+        };
+    }
+    // Exactly one on PATH. It can still be a DIFFERENT install from the one
+    // running now — the scheduler holds an absolute path to whichever prefix it
+    // was registered with. Only decidable where the bin is a symlink into the
+    // package (npm's POSIX layout); a Windows `.cmd` shim is a generated script,
+    // not a link, so there is nothing to resolve and the check stays quiet
+    // rather than guessing.
+    const only = installs[0];
+    if (!only || platform === "win32") {
+        return single(installs);
+    }
+    const ownEntryPoint = options.cliEntryPoint ?? process.argv[1] ?? "";
+    if (!ownEntryPoint)
+        return single(installs);
+    const isLink = await (options.isSymbolicLink ?? defaultIsSymbolicLink)(only);
+    if (!isLink)
+        return single(installs);
+    const resolve = options.realpath ?? ((candidate) => realpath(candidate));
+    const [linked, own] = await Promise.all([
+        resolve(only).catch(() => null),
+        resolve(ownEntryPoint).catch(() => ownEntryPoint),
+    ]);
+    if (!linked || linked === own)
+        return single(installs);
+    return {
+        detected: true,
+        reason: "second_install_detected",
+        other_bin: platformBasename(only, platform),
+        install_count: 2,
+        paths: [only, ownEntryPoint],
+    };
+}
+function single(installs) {
+    return {
+        detected: false,
+        reason: "single_install",
+        other_bin: null,
+        install_count: installs.length,
+        paths: installs,
+    };
+}
+/**
+ * Which of several installs is NOT the one this process came from.
+ *
+ * npm lays a global install out as `<prefix>/bin/cockpit` beside
+ * `<prefix>/lib/node_modules/...`, and on Windows as `<prefix>\cockpit.cmd`
+ * beside `<prefix>\node_modules\...`. Either way the bin's GRANDPARENT is the
+ * prefix and our own entry point lives under it, so anything under a different
+ * prefix is the other install. If nothing matches — an unusual layout — name
+ * the last candidate rather than nothing: an operator can act on a named bin
+ * and cannot act on silence.
+ */
+async function pickOther(installs, options, platform) {
+    const entryPoint = options.cliEntryPoint ?? process.argv[1] ?? "";
+    const other = installs.find((candidate) => !isUnderPrefixOf(candidate, entryPoint, platform));
+    return other ?? installs[installs.length - 1] ?? null;
+}
+function isUnderPrefixOf(candidateBin, entryPoint, platform) {
+    if (!entryPoint)
+        return false;
+    const platformPath = platform === "win32" ? path.win32 : path.posix;
+    const prefix = platformPath.dirname(platformPath.dirname(candidateBin));
+    if (!prefix || prefix === "." || prefix === platformPath.sep)
+        return false;
+    const normalize = (value) => platform === "win32" ? value.toLowerCase() : value;
+    const bounded = prefix.endsWith(platformPath.sep)
+        ? prefix
+        : prefix + platformPath.sep;
+    return normalize(entryPoint).startsWith(normalize(bounded));
+}
+function platformBasename(candidate, platform) {
+    return platform === "win32"
+        ? path.win32.basename(candidate)
+        : path.posix.basename(candidate);
+}
+function parseCandidatePaths(stdout, platform) {
+    return stdout
+        .split(/\r?\n/u)
+        .map((line) => line.trim())
+        .filter((line) => {
+        if (!line)
+            return false;
+        // zsh's `which -a` also prints shell-function bodies and
+        // "cockpit not found"; only absolute paths are installs.
+        return platform === "win32"
+            ? /^[A-Za-z]:\\/u.test(line)
+            : line.startsWith("/");
+    });
+}
+function directoryKey(candidate, platform) {
+    if (!candidate)
+        return "";
+    const directory = platform === "win32"
+        ? path.win32.dirname(candidate).toLowerCase()
+        : path.posix.dirname(candidate);
+    return directory;
+}
+async function defaultIsSymbolicLink(candidate) {
+    return lstat(candidate).then((info) => info.isSymbolicLink(), () => false);
+}
+/** One line for a receipt or a log: named, path-free. */
+export function secondInstallReason(finding) {
+    return finding.detected
+        ? `second_install_detected ${finding.other_bin ?? "cockpit"}`
+        : finding.reason;
+}

package/dist/sync-health-class.js

@@ -0,0 +1,242 @@
+/**
+ * What bucket a sync failure goes in, decided from structure — never from the
+ * words in a message.
+ *
+ * BLI-3551. The old classifier ran one regex,
+ * `/auth|token|session|unauthorized|forbidden|401|403/iu`, over the failure
+ * text. The sync's own reason label `session_report_unposted:no_successful_sync`
+ * contains the word "session", so a machine whose only problem was that it had
+ * nothing inside its approved roots reported `auth_failed` on every tick —
+ * 377 ticks in 38 hours on one device whose token was valid for another eleven
+ * weeks, 111 on another. The receipt did not merely lack detail; it named the
+ * wrong subsystem, and the operator's first move was to re-pair a device that
+ * was fine.
+ *
+ * So the bucket is now read off one of two structured things:
+ *
+ * - a **failure record** — the label the deciding branch wrote down, plus the
+ *   HTTP status it observed, carried beside the rendered string rather than
+ *   parsed back out of it;
+ * - a **typed error** — `SyncDeliveryError` (`reason` + `httpStatus`),
+ *   `CollectionRootRequiredError`, or a Node error with a `code`/`name` the
+ *   runtime set.
+ *
+ * `auth_failed` is reachable ONLY from an observed 401/403 or a named token
+ * failure. Anything unclassified is `sync_failed`, which is honest: an
+ * unrecognised failure is a failure whose subsystem nobody has named yet.
+ *
+ * Adding a reason label to the sync is adding an entry here — the class-lock
+ * test in `sync-health-class.test.ts` reads the reason literals out of
+ * `commands/session-sync.ts` and fails if one of them has no class.
+ */
+import { CollectionRootRequiredError } from "./onboarding-roots.js";
+import { SyncDeliveryError } from "./upload-failure-reason.js";
+/** The coarse bucket a `sync_complete` receipt carries as its `error_code`. */
+export const SYNC_HEALTH_ERROR_CODES = [
+    "auth_failed",
+    "network_failed",
+    "collection_root_failed",
+    "sync_failed",
+];
+/**
+ * Every reason label a sync run is allowed to fail with.
+ *
+ * The rendered string a person reads may carry a scope or a nested cause
+ * (`bli-cockpit:ingest_rejected: http_500`, `raw_evidence:upload_failed`); the
+ * LABEL is what classification reads, and it is drawn from this list only.
+ */
+export const SYNC_FAILURE_LABELS = [
+    // Delivery buckets, mirrored from SYNC_FAILURE_REASONS in
+    // upload-failure-reason.ts — a spooled worktree carries one of these.
+    "ingest_transport_error",
+    "ingest_rejected",
+    "ingest_receipt_not_202",
+    "ingest_receipt_incomplete",
+    "sync_failed_local",
+    /** A worktree finished in a state that is neither uploaded nor spooled. */
+    "upload_not_completed",
+    /** One or more raw-evidence objects failed to upload. */
+    "raw_evidence_upload_failed",
+    /** Raw evidence landed only partly and the gap is retryable. */
+    "raw_evidence_retry_required",
+    "deferred_byte_budget",
+    "deferred_object_budget",
+    "codex_session_limit_applied",
+    "claude_session_limit_applied",
+    "codex_session_read_failed",
+    "claude_session_read_failed",
+    /** The session store itself could not be read during the scan. */
+    "codex_scan_read_failed",
+    "claude_scan_read_failed",
+    /** Sessions were observed and their metadata report did not reach the door. */
+    "session_report_unposted",
+    /** The gate is real and this file forgot to say why — a bug, made visible. */
+    "sync_failed_reason_not_recorded",
+];
+/**
+ * The class each label belongs to.
+ *
+ * `ingest_rejected` is deliberately NOT auth by default: a 500 from the ingest
+ * route and a 401 from it are the same label, and only the observed status
+ * tells them apart (see {@link classifySyncFailureRecords}).
+ */
+export const SYNC_FAILURE_LABEL_CLASSES = {
+    // The request never reached an answer, or something in the path answered
+    // instead of the route. Both are the network, not this machine's state.
+    ingest_transport_error: "network_failed",
+    ingest_receipt_not_202: "network_failed",
+    // The route answered and refused, or answered and disagreed about what
+    // landed. Server-side; the status decides whether it was about credentials.
+    ingest_rejected: "sync_failed",
+    ingest_receipt_incomplete: "sync_failed",
+    // Everything below is this machine's own doing: budgets, caps, local reads,
+    // an unposted report. None of them is an authentication problem and none of
+    // them is a network problem.
+    sync_failed_local: "sync_failed",
+    upload_not_completed: "sync_failed",
+    raw_evidence_upload_failed: "sync_failed",
+    raw_evidence_retry_required: "sync_failed",
+    deferred_byte_budget: "sync_failed",
+    deferred_object_budget: "sync_failed",
+    codex_session_limit_applied: "sync_failed",
+    claude_session_limit_applied: "sync_failed",
+    codex_session_read_failed: "sync_failed",
+    claude_session_read_failed: "sync_failed",
+    codex_scan_read_failed: "sync_failed",
+    claude_scan_read_failed: "sync_failed",
+    session_report_unposted: "sync_failed",
+    sync_failed_reason_not_recorded: "sync_failed",
+};
+/** HTTP statuses that mean the credential, and nothing else. */
+const AUTH_HTTP_STATUSES = new Set([401, 403]);
+/**
+ * Reason labels that name a credential failure outright.
+ *
+ * Kept as an exact-match set, not a pattern: the word "token" appearing inside
+ * some other reason is what produced the lie this module exists to end.
+ */
+const AUTH_FAILURE_LABELS = new Set([
+    "device_token_invalid",
+    "device_token_revoked",
+    "device_token_expired",
+    "device_not_paired",
+    "unauthorized",
+    "forbidden",
+]);
+/** Node error codes that mean the request never got out or never got back. */
+const NETWORK_ERROR_CODES = new Set([
+    "ENOTFOUND",
+    "ECONNREFUSED",
+    "ECONNRESET",
+    "EAI_AGAIN",
+    "EHOSTUNREACH",
+    "ENETUNREACH",
+    "ETIMEDOUT",
+    "EPIPE",
+    "UND_ERR_CONNECT_TIMEOUT",
+    "UND_ERR_HEADERS_TIMEOUT",
+    "UND_ERR_SOCKET",
+]);
+/**
+ * The class one record belongs to.
+ *
+ * The status wins over the label where the two disagree, because a 401 is an
+ * observation and a label is a categorisation.
+ */
+export function classifySyncFailureRecord(record) {
+    if (typeof record.http_status === "number" &&
+        AUTH_HTTP_STATUSES.has(record.http_status)) {
+        return "auth_failed";
+    }
+    return SYNC_FAILURE_LABEL_CLASSES[record.label] ?? "sync_failed";
+}
+/**
+ * The class a whole run belongs to.
+ *
+ * A run fails for several reasons at once more often than not, so the most
+ * actionable one wins: a credential problem is worth waking up for, a network
+ * one is worth waiting out, and a missing collection root is a setup step. The
+ * generic bucket is the floor, never a tie-breaker.
+ */
+export function classifySyncFailureRecords(records) {
+    const classes = new Set(records.map(classifySyncFailureRecord));
+    for (const candidate of [
+        "auth_failed",
+        "collection_root_failed",
+        "network_failed",
+    ]) {
+        if (classes.has(candidate))
+            return candidate;
+    }
+    return "sync_failed";
+}
+/**
+ * The class a thrown error belongs to.
+ *
+ * Reads only structure the code itself set: the delivery error's own `reason`
+ * and `httpStatus`, the collection-root error's type, the runtime's `code` and
+ * `name`. A message is never inspected — that is the whole point of BLI-3551.
+ */
+export function classifySyncHealthError(error) {
+    if (error instanceof CollectionRootRequiredError) {
+        return "collection_root_failed";
+    }
+    if (error instanceof SyncDeliveryError) {
+        return classifySyncFailureRecord({
+            label: error.reason,
+            rendered: error.message,
+            http_status: error.httpStatus,
+        });
+    }
+    const structured = structuredErrorFields(error);
+    if (typeof structured.httpStatus === "number" &&
+        AUTH_HTTP_STATUSES.has(structured.httpStatus)) {
+        return "auth_failed";
+    }
+    if (structured.reason && AUTH_FAILURE_LABELS.has(structured.reason)) {
+        return "auth_failed";
+    }
+    if (structured.reason &&
+        isSyncFailureLabel(structured.reason)) {
+        return SYNC_FAILURE_LABEL_CLASSES[structured.reason];
+    }
+    if (structured.name === "AbortError" || structured.name === "TimeoutError") {
+        return "network_failed";
+    }
+    if (structured.code && NETWORK_ERROR_CODES.has(structured.code)) {
+        return "network_failed";
+    }
+    // Nothing structured said anything. That is not evidence of an auth problem,
+    // a network problem or a setup problem — it is an unclassified failure, and
+    // the receipt says so instead of guessing from vocabulary.
+    return "sync_failed";
+}
+export function isSyncFailureLabel(value) {
+    return Object.hasOwn(SYNC_FAILURE_LABEL_CLASSES, value);
+}
+/**
+ * Fields an error carries as data rather than as prose.
+ *
+ * Duck-typed on purpose: an error crossing a package boundary (or rebuilt from
+ * a worker) loses its prototype but keeps its own enumerable fields, and a
+ * `reason` written by our code is still structure.
+ */
+function structuredErrorFields(error) {
+    if (!error || typeof error !== "object") {
+        return { name: null, code: null, reason: null, httpStatus: null };
+    }
+    const record = error;
+    const status = typeof record["httpStatus"] === "number"
+        ? record["httpStatus"]
+        : typeof record["http_status"] === "number"
+            ? record["http_status"]
+            : typeof record["status"] === "number"
+                ? record["status"]
+                : null;
+    return {
+        name: typeof record["name"] === "string" ? record["name"] : null,
+        code: typeof record["code"] === "string" ? record["code"] : null,
+        reason: typeof record["reason"] === "string" ? record["reason"] : null,
+        httpStatus: status,
+    };
+}

package/dist/upload.js

@@ -170,6 +170,8 @@ export async function syncLocalAmbientEnvelope(options = {}) {
             source_scan_count: built.source_scan_count,
             risk_flag_count: built.risk_flag_count,
             failure_reason: spooledFailureReason,
+            failure_class: classified.reason,
+            failure_http_status: classified.http_status,
             spool_entry_id: entry.spool_id,
             retry_command: entry.retry_command,
             ...summarizeRawEvidenceDelivery(built, uploadOutcomes, uploadedChunkCount, cursor, staging, attemptedDate),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.46",
+  "version": "0.2.47",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,6 +27,6 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/telemetry-core": "0.1.25"
+    "@bli-cockpit/telemetry-core": "0.1.26"
   }
 }