@bli-cockpit/cli 0.2.46 → 0.2.48

package/dist/log-rotation.js

@@ -0,0 +1,144 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+/**
+ * BLI-3553. Measured on the reference Mac, 2026-09-04, not estimated:
+ * `sync.log` 219,866,695 bytes and `sync.err.log` 59,635,270 after two months
+ * of a 15-minute tick. The repo's logging contract says log the success branch
+ * too, which is correct and is exactly why the files grow: the cost of that
+ * rule is bounded here, not by logging less.
+ *
+ * A cap DID exist for sync.log — buried in `raw-evidence-gc.ts`, 50 MB,
+ * truncate-to-zero with no archive. It could not work: the GC is throttled to
+ * once a day and skipped outright by `COCKPIT_DISABLE_GC`, while the log grows
+ * about 8 MB an hour on an active machine, so the file spent almost all of its
+ * life several times over the cap (last GC 19 hours before the measurement
+ * above). sync.err.log had no cap at all. That copy is gone; this is the one
+ * owner, it runs every tick, and it keeps an archive instead of destroying the
+ * only record of what happened.
+ *
+ * WHY TRUNCATE-AFTER-COPY, NOT RENAME-AND-REOPEN
+ *
+ * launchd opens StandardOutPath/StandardErrorPath once and holds that fd for
+ * the life of the job (the paths are right there in the `launchctl print`
+ * capture pinned in autostart.test.ts). Renaming the file does not move the fd:
+ * the job would keep writing into the renamed — eventually unlinked — inode, so
+ * the disk would never be reclaimed and `sync.err.log` would stop receiving new
+ * lines entirely until the agent was reloaded. Only the tick can reopen it, and
+ * the tick is not the writer; launchd is.
+ *
+ * A dated StandardErrorPath plus a pruner was the other candidate and is worse:
+ * it changes the plist on a schedule, every change has to be re-registered
+ * (which on macOS means the BLI-2583 bootout/bootstrap hazard), and it makes
+ * the rendered-plist comparison in autostartStatus a moving target — the exact
+ * shape that made every Windows machine read "needs repair" in BLI-2541.
+ *
+ * So: copy the last `maxBytes` of the file aside, then `truncate(path, 0)`.
+ * Same inode, so launchd's fd stays valid and its next write lands at offset 0
+ * of a file operators can read. The tail is capped rather than copied whole, so
+ * the archives cannot themselves become the disk problem — worst case on disk
+ * is (keep + 1) x maxBytes per stream.
+ */
+export const DEFAULT_LOG_ROTATION_MAX_BYTES = 20 * 1024 * 1024;
+export const DEFAULT_LOG_ROTATION_KEEP = 3;
+/** The two files launchd writes for the scheduled tick. */
+export const ROTATED_LOG_NAMES = ["sync.log", "sync.err.log"];
+/**
+ * Caps the scheduled tick's own logs. Never throws: a rotation failure is data
+ * for the caller to log, never a reason a sync does not run.
+ */
+export async function rotateCollectorLogs(paths, options = {}) {
+    const maxBytes = options.maxBytes ?? DEFAULT_LOG_ROTATION_MAX_BYTES;
+    const keep = options.keep ?? DEFAULT_LOG_ROTATION_KEEP;
+    const names = options.names ?? ROTATED_LOG_NAMES;
+    const result = { rotated: [], failures: [] };
+    for (const name of names) {
+        const filePath = path.join(paths.state_dir, name);
+        const size = await fs
+            .stat(filePath)
+            .then((info) => (info.isFile() ? info.size : null))
+            .catch(() => null);
+        if (size === null || size <= maxBytes)
+            continue;
+        try {
+            const kept = await rotateOne(filePath, maxBytes, keep);
+            result.rotated.push({
+                name,
+                bytes_before: size,
+                bytes_kept: kept,
+                archives: keep,
+            });
+        }
+        catch (error) {
+            result.failures.push({
+                name,
+                reason: error instanceof Error && error.message
+                    ? `rotation_failed:${error.code ?? "unknown"}`
+                    : "rotation_failed:unknown",
+            });
+        }
+    }
+    return result;
+}
+async function rotateOne(filePath, maxBytes, keep) {
+    // Shift the archives down first: .2 -> .3, .1 -> .2, and drop whatever fell
+    // off the end. Done before the copy so a crash mid-rotation loses an old
+    // archive, never the live log.
+    await fs.rm(`${filePath}.${keep}`, { force: true });
+    for (let index = keep - 1; index >= 1; index -= 1) {
+        await fs
+            .rename(`${filePath}.${index}`, `${filePath}.${index + 1}`)
+            .catch(() => undefined);
+    }
+    const handle = await fs.open(filePath, "r+");
+    try {
+        const info = await handle.stat();
+        const start = Math.max(0, info.size - maxBytes);
+        const buffer = Buffer.allocUnsafe(info.size - start);
+        await handle.read(buffer, 0, buffer.length, start);
+        // Drop the partial first line so the archive never opens mid-JSON.
+        const newline = start > 0 ? buffer.indexOf(0x0a) : -1;
+        const tail = newline >= 0 ? buffer.subarray(newline + 1) : buffer;
+        await fs.writeFile(`${filePath}.1`, tail);
+        // The load-bearing line: same inode, so launchd's held fd keeps working.
+        await handle.truncate(0);
+        return tail.length;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Rotates and says what happened, on both branches. Safe to call every tick:
+ * the size check is one stat per file and a rotation is rare.
+ */
+export async function rotateCollectorLogsBestEffort(paths, options = {}) {
+    let result = { rotated: [], failures: [] };
+    try {
+        result = await rotateCollectorLogs(paths, options);
+    }
+    catch (error) {
+        result = {
+            rotated: [],
+            failures: [
+                {
+                    name: "*",
+                    reason: `rotation_threw:${error?.code ?? "unknown"}`,
+                },
+            ],
+        };
+    }
+    // Metadata only: file names (fixed strings) and byte counts, never a path
+    // and never a line of content.
+    for (const rotated of result.rotated) {
+        console.error("[log-rotation] capped a scheduled-tick log", JSON.stringify({
+            file: rotated.name,
+            bytes_before: rotated.bytes_before,
+            bytes_kept: rotated.bytes_kept,
+            archives_kept: rotated.archives,
+        }));
+    }
+    for (const failure of result.failures) {
+        console.error("[log-rotation] could not cap a scheduled-tick log", JSON.stringify({ file: failure.name, reason: failure.reason }));
+    }
+    return result;
+}

package/dist/onboarding-roots.js

@@ -4,6 +4,23 @@ import os from "node:os";
 import path from "node:path";
 import { isSamePath, normalizeCollectionRoots, } from "./root-normalization.js";
 export const COLLECTION_ROOT_REQUIRED = "collection_root_required";
+/**
+ * No approved collection root, so there is nothing this machine may look at.
+ *
+ * A type rather than a message prefix (BLI-3551): the health-receipt classifier
+ * used to recognise this by searching the error text, which is the same habit
+ * that filed `session_report_unposted` as an auth failure. The message is
+ * unchanged — `collection_root_required: <what to do about it>` — so every
+ * operator-facing string and every test that reads one still matches; what
+ * changed is that the classifier reads the type.
+ */
+export class CollectionRootRequiredError extends Error {
+    reason = COLLECTION_ROOT_REQUIRED;
+    constructor(detail) {
+        super(`${COLLECTION_ROOT_REQUIRED}: ${detail}`);
+        this.name = "CollectionRootRequiredError";
+    }
+}
 export function homeRootConsentPrompt(homeDirInput) {
     const homeDir = path.resolve(homeDirInput ?? os.homedir());
     return `You're in your home folder (${homeDir}).\n  Sync ALL projects on this machine? Every git repo under here gets captured now and in the future.\n  This is a work machine — exclude personal projects yourself if needed.\n  Press Enter to sync everything, or answer n to name one folder instead.  [Y/n]: `;
@@ -22,7 +39,7 @@ export async function resolveOnboardingRoots(options) {
     }
     if (hasRootInput(explicitInput) && explicit.rejected.length > 0) {
         if (!options.interactive) {
-            throw new Error(`${COLLECTION_ROOT_REQUIRED}: ${rootRejectionExplanation(explicit.rejected[0], options)}`);
+            throw new CollectionRootRequiredError(rootRejectionExplanation(explicit.rejected[0], options));
         }
         explainRejectedRoots(options, withoutHomeRejections(explicit.rejected));
         const homeOptIn = await promptForHomeRootOptIn(options, explicit.rejected);
@@ -54,7 +71,7 @@ export async function resolveOnboardingRoots(options) {
             return resolvedRoots(options, [homeDir], "cwd_likely_root", true);
         }
         if (!options.interactive) {
-            throw new Error(`${COLLECTION_ROOT_REQUIRED}: ${homeRootTutorial(homeDir)}`);
+            throw new CollectionRootRequiredError(homeRootTutorial(homeDir));
         }
         const homeOptIn = await promptForHomeRootOptIn(options, [
             { input: homeDir, reason: "home_dir" },
@@ -63,7 +80,7 @@ export async function resolveOnboardingRoots(options) {
             return homeOptIn;
     }
     if (!options.interactive) {
-        throw new Error(`${COLLECTION_ROOT_REQUIRED}: ${missingCollectionRootMessage(options)}`);
+        throw new CollectionRootRequiredError(missingCollectionRootMessage(options));
     }
     const cwdRoot = likelyBliRootFromCwd(cwd);
     if (cwdRoot) {
@@ -160,7 +177,7 @@ async function promptForRoots(options, message) {
             prompt.message?.(missingCollectionRootMessage(options));
         }
     }
-    throw new Error(`${COLLECTION_ROOT_REQUIRED}: ${missingCollectionRootMessage(options)}`);
+    throw new CollectionRootRequiredError(missingCollectionRootMessage(options));
 }
 function savedRootsPrompt(roots) {
     if (roots.length === 1) {
@@ -174,7 +191,7 @@ function savedRootsPrompt(roots) {
 }
 function requirePrompt(options) {
     if (!options.prompt) {
-        throw new Error(`${COLLECTION_ROOT_REQUIRED}: interactive prompt unavailable.`);
+        throw new CollectionRootRequiredError(`interactive prompt unavailable.`);
     }
     return options.prompt;
 }
@@ -269,7 +286,7 @@ async function promptForDeclinedHomeRoot(options, homeDir) {
         break;
     }
     prompt.message?.(HOME_ROOT_NO_FOLDER_CHOSEN_MESSAGE);
-    throw new Error(`${COLLECTION_ROOT_REQUIRED}: ${HOME_ROOT_NO_FOLDER_CHOSEN_MESSAGE}`);
+    throw new CollectionRootRequiredError(HOME_ROOT_NO_FOLDER_CHOSEN_MESSAGE);
 }
 function resolveRootInputPath(input, homeDir, cwd) {
     const expanded = input === "~" || /^~[\\/]/u.test(input)

package/dist/raw-evidence-gc.js

@@ -4,7 +4,6 @@ import path from "node:path";
 import { readRawEvidenceCursor } from "./cursors/raw-evidence-cursor.js";
 import { readRawEvidenceStagingState } from "./raw-evidence-staging.js";
 const RAW_EVIDENCE_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
-const SYNC_LOG_MAX_BYTES = 50 * 1024 * 1024;
 /**
  * A staging directory belongs to one in-flight collection pass. Anything this
  * old is the remains of a crash or a kill, never live work — the longest sync
@@ -17,22 +16,12 @@ const STAGING_ORPHAN_MS = 6 * 60 * 60 * 1000;
 const GC_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
 export async function runRawEvidenceLocalGc(paths, env = process.env, now = new Date()) {
     if (env["COCKPIT_DISABLE_GC"] === "1") {
-        return {
-            skipped: true,
-            removed_dirs: 0,
-            freed_bytes: 0,
-            rotated_sync_log: false,
-        };
+        return { skipped: true, removed_dirs: 0, freed_bytes: 0 };
     }
     const throttleMarker = path.join(paths.state_dir, ".last-raw-evidence-gc");
     const lastRun = await fs.stat(throttleMarker).catch(() => null);
     if (lastRun && now.getTime() - lastRun.mtimeMs < GC_MIN_INTERVAL_MS) {
-        return {
-            skipped: true,
-            removed_dirs: 0,
-            freed_bytes: 0,
-            rotated_sync_log: false,
-        };
+        return { skipped: true, removed_dirs: 0, freed_bytes: 0 };
     }
     await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
     await fs.writeFile(throttleMarker, now.toISOString()).catch(() => undefined);
@@ -60,11 +49,17 @@ export async function runRawEvidenceLocalGc(paths, env = process.env, now = new
         removedDirs += 1;
         freedBytes += inspection.byteSize;
     }
+    // Log capping used to live here, and that is why it did not work: this GC
+    // is throttled to once a day and skipped entirely by COCKPIT_DISABLE_GC,
+    // while sync.log grows ~8 MB an hour on an active machine (measured on the
+    // reference Mac, 2026-09-04: 219,866,695 bytes with the last GC 19 hours
+    // earlier). A daily truncate-to-zero of a file that reaches ~190 MB a day is
+    // not a cap, and sync.err.log had no cap at all. One owner now, running in
+    // the tick preamble: log-rotation.ts (BLI-3553).
     return {
         skipped: false,
         removed_dirs: removedDirs,
         freed_bytes: freedBytes,
-        rotated_sync_log: await rotateSyncLog(paths),
     };
 }
 export function rawEvidenceGcSummary(result) {
@@ -288,15 +283,6 @@ async function listFiles(root) {
     }
     return files;
 }
-async function rotateSyncLog(paths) {
-    const syncLog = path.join(paths.state_dir, "sync.log");
-    const info = await fs.stat(syncLog).catch(() => null);
-    if (!info?.isFile() || info.size <= SYNC_LOG_MAX_BYTES)
-        return false;
-    await fs.truncate(syncLog, 0).catch(() => undefined);
-    const after = await fs.stat(syncLog).catch(() => null);
-    return after?.isFile() === true && after.size === 0;
-}
 async function exists(target) {
     return fs.stat(target).then(() => true, () => false);
 }

package/dist/scheduled-self-update.js

@@ -127,6 +127,7 @@ export async function runScheduledSelfUpdate(paths, deps, options = {}) {
         reason: "updated",
         target_version: targetVersion ?? installedVersion,
         installed_version: installedVersion,
+        previous_version: deps.currentVersion,
         ...forcedFields,
     };
 }

package/dist/second-install.js

@@ -0,0 +1,160 @@
+import path from "node:path";
+import { lstat, realpath } from "node:fs/promises";
+import { DARWIN_LOGIN_SHELL } from "./autostart-node-path.js";
+const NOT_CHECKED = {
+    detected: false,
+    reason: "probe_unavailable",
+    other_bin: null,
+    install_count: 0,
+    paths: [],
+};
+export async function detectSecondCockpitInstall(options) {
+    const platform = options.platform ?? process.platform;
+    const lookup = platform === "win32"
+        ? { cmd: "where.exe", args: ["cockpit"] }
+        : platform === "darwin"
+            ? { cmd: DARWIN_LOGIN_SHELL, args: ["-lc", "which -a cockpit"] }
+            : null;
+    if (!lookup)
+        return NOT_CHECKED;
+    const result = await options
+        .exec(lookup.cmd, lookup.args)
+        .catch(() => null);
+    if (!result) {
+        return { ...NOT_CHECKED, reason: "probe_failed" };
+    }
+    const candidates = parseCandidatePaths(result.stdout, platform);
+    if (candidates.length === 0) {
+        // `which`/`where` found nothing: this process was started by an absolute
+        // path (the scheduler always does) and the operator's PATH has no cockpit
+        // at all. Nothing to compare against, and nothing to complain about.
+        return {
+            detected: false,
+            reason: result.code === 0 ? "probe_failed" : "single_install",
+            other_bin: null,
+            install_count: 0,
+            paths: [],
+        };
+    }
+    const byDirectory = new Map();
+    for (const candidate of candidates) {
+        const key = directoryKey(candidate, platform);
+        if (!byDirectory.has(key))
+            byDirectory.set(key, candidate);
+    }
+    const installs = [...byDirectory.values()];
+    if (installs.length > 1) {
+        const other = await pickOther(installs, options, platform);
+        return {
+            detected: true,
+            reason: "second_install_detected",
+            other_bin: platformBasename(other ?? installs[installs.length - 1] ?? "", platform),
+            install_count: installs.length,
+            paths: installs,
+        };
+    }
+    // Exactly one on PATH. It can still be a DIFFERENT install from the one
+    // running now — the scheduler holds an absolute path to whichever prefix it
+    // was registered with. Only decidable where the bin is a symlink into the
+    // package (npm's POSIX layout); a Windows `.cmd` shim is a generated script,
+    // not a link, so there is nothing to resolve and the check stays quiet
+    // rather than guessing.
+    const only = installs[0];
+    if (!only || platform === "win32") {
+        return single(installs);
+    }
+    const ownEntryPoint = options.cliEntryPoint ?? process.argv[1] ?? "";
+    if (!ownEntryPoint)
+        return single(installs);
+    const isLink = await (options.isSymbolicLink ?? defaultIsSymbolicLink)(only);
+    if (!isLink)
+        return single(installs);
+    const resolve = options.realpath ?? ((candidate) => realpath(candidate));
+    const [linked, own] = await Promise.all([
+        resolve(only).catch(() => null),
+        resolve(ownEntryPoint).catch(() => ownEntryPoint),
+    ]);
+    if (!linked || linked === own)
+        return single(installs);
+    return {
+        detected: true,
+        reason: "second_install_detected",
+        other_bin: platformBasename(only, platform),
+        install_count: 2,
+        paths: [only, ownEntryPoint],
+    };
+}
+function single(installs) {
+    return {
+        detected: false,
+        reason: "single_install",
+        other_bin: null,
+        install_count: installs.length,
+        paths: installs,
+    };
+}
+/**
+ * Which of several installs is NOT the one this process came from.
+ *
+ * npm lays a global install out as `<prefix>/bin/cockpit` beside
+ * `<prefix>/lib/node_modules/...`, and on Windows as `<prefix>\cockpit.cmd`
+ * beside `<prefix>\node_modules\...`. Either way the bin's GRANDPARENT is the
+ * prefix and our own entry point lives under it, so anything under a different
+ * prefix is the other install. If nothing matches — an unusual layout — name
+ * the last candidate rather than nothing: an operator can act on a named bin
+ * and cannot act on silence.
+ */
+async function pickOther(installs, options, platform) {
+    const entryPoint = options.cliEntryPoint ?? process.argv[1] ?? "";
+    const other = installs.find((candidate) => !isUnderPrefixOf(candidate, entryPoint, platform));
+    return other ?? installs[installs.length - 1] ?? null;
+}
+function isUnderPrefixOf(candidateBin, entryPoint, platform) {
+    if (!entryPoint)
+        return false;
+    const platformPath = platform === "win32" ? path.win32 : path.posix;
+    const prefix = platformPath.dirname(platformPath.dirname(candidateBin));
+    if (!prefix || prefix === "." || prefix === platformPath.sep)
+        return false;
+    const normalize = (value) => platform === "win32" ? value.toLowerCase() : value;
+    const bounded = prefix.endsWith(platformPath.sep)
+        ? prefix
+        : prefix + platformPath.sep;
+    return normalize(entryPoint).startsWith(normalize(bounded));
+}
+function platformBasename(candidate, platform) {
+    return platform === "win32"
+        ? path.win32.basename(candidate)
+        : path.posix.basename(candidate);
+}
+function parseCandidatePaths(stdout, platform) {
+    return stdout
+        .split(/\r?\n/u)
+        .map((line) => line.trim())
+        .filter((line) => {
+        if (!line)
+            return false;
+        // zsh's `which -a` also prints shell-function bodies and
+        // "cockpit not found"; only absolute paths are installs.
+        return platform === "win32"
+            ? /^[A-Za-z]:\\/u.test(line)
+            : line.startsWith("/");
+    });
+}
+function directoryKey(candidate, platform) {
+    if (!candidate)
+        return "";
+    const directory = platform === "win32"
+        ? path.win32.dirname(candidate).toLowerCase()
+        : path.posix.dirname(candidate);
+    return directory;
+}
+async function defaultIsSymbolicLink(candidate) {
+    return lstat(candidate).then((info) => info.isSymbolicLink(), () => false);
+}
+/** One line for a receipt or a log: named, path-free. */
+export function secondInstallReason(finding) {
+    return finding.detected
+        ? `second_install_detected ${finding.other_bin ?? "cockpit"}`
+        : finding.reason;
+}