@bli-cockpit/cli 0.2.47 → 0.2.49

package/dist/commands/local.js

@@ -1,59 +1,18 @@
-/**
- * The `cockpit` subcommands and the router that picks one.
- *
- * Read `runLocalCockpitCli` below as the table of contents: one case per
- * command, each delegating to a `run<Command>` function. The commands that
- * grew their own supporting cast now live beside this file and are re-exported
- * here so `./local.js` stays the single published entry point (BLI-3104):
- *
- *   local-help.ts        what --help prints, and the recognised command names
- *   cli-io.ts            stdout/stderr/stdin plumbing and the production CliIo
- *   install-receipts.ts  the named step results this machine reports back
- *   heartbeat.ts         the per-tick "I am alive, and these are my roots"
- *   local-auth.ts        which email, the OTP exchange, pairing with fallback
- *   collection-roots.ts  which folders may be collected, saved and read back
- *   local-discovery.ts   finding git worktrees inside those roots
- *   collection-report.ts how one collection run reads back to a person
- *   install-update.ts    install, update, self-update, release
- *   status.ts            `cockpit status`
- *   sessions.ts          `cockpit sessions`
- *   jarvis.ts            terminal adapter for the shared JARVIS gateway
- *   scout.ts             `cockpit scout` — the board, and the three card verbs
- *                        (+ scout-render.ts, the pure layout half)
- *   ops.ts               `cockpit ops` — the pipeline board and one recompile
- *                        (+ ops-render.ts, the pure layout half, shared with
- *                        `cockpit brief status`)
- *   slack.ts             `cockpit slack` — bot coverage, and the messages
- *   workbook.ts          `cockpit workbook` — the project document library
- *                        (+ workbook-render.ts, the pure layout half)
- *   brief.ts             `cockpit brief` — the TODAY page in the terminal
- *   brief-edit.ts        `cockpit brief edit` — rewrite it like a document
- *   brief-rewrite.ts     `cockpit brief rewrite` — have Tower compile it again
- *   editor.ts            the one place a person's own $EDITOR is spawned
- *   correct.ts           `cockpit correct` — one line on it is wrong
- *   notes.ts             `cockpit notes` — the meeting-notes surface, typed
- *   notes-file.ts        the local screen a note file passes before it is sent
- *   tower-command.ts     open a Tower session, call a route, name the refusal
- *   settings.ts          `cockpit settings` and `cockpit model`
- *   settings-render.ts   how a settings answer reads in a terminal
- *   team.ts              `cockpit team` — members, invite, role
- *   autostart-heal.ts    the internal detached one-shot the macOS tick spawns
- *                        to re-register launchd after the tick itself exits
- *
- * What stays here is orchestration: onboard, login/logout/start, the sync tick,
- * analyze, serve, autostart and agent-rules.
- */
-import path from "node:path";
-import { bufferedWritable, defaultExec, defaultIo, errorMessage, parseCapturedJson, replayCaptured, writeLine, } from "./cli-io.js";
+import { defaultIo, errorMessage, writeLine } from "./cli-io.js";
 import { isLocalHelpRequest, localCommandHelp } from "./local-help.js";
-import { describeError, isMissingFileFailure } from "../health-detail.js";
-import { sendCollectorHeartbeatBestEffort, } from "./heartbeat.js";
-import { addInstallEvent, classifySyncFailureRecords, classifySyncHealthError, redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
-import { canReuseOnboardSession, pairLocalCollectorWithAuthFallback, readOnboardSessionReuseCandidate, requestPairingAccessToken, requestPairingAccessTokenDetailed, resolveInteractiveLoginEmail, resolveOnboardEmail, } from "./local-auth.js";
-import { collectionRootConsentAliases, persistOnboardingRootConfig, resolveOnboardingRootsForCommand, } from "./collection-roots.js";
-import { discoverCommandWorktrees, rememberDiscoveryLimits } from "./local-discovery.js";
-import { attributedSyncRunStatus, cursorStatusLine, displayTicketId, rawEvidenceSyncLine, shortSha, worktreeSyncRow, writeAgentSessionSummary, } from "./collection-report.js";
-import { runInstall, runRelease, runSelfUpdate, runUpdate, SelfUpdateError, } from "./install-update.js";
+import { describeError } from "../health-detail.js";
+import { reportInstallEventsBestEffort } from "./install-receipts.js";
+import { persistOnboardingRootConfig, resolveOnboardingRootsForCommand, } from "./collection-roots.js";
+import { rememberDiscoveryLimits } from "./local-discovery.js";
+import { runInstall, runRelease, runSelfUpdate, runUpdate } from "./install-update.js";
+import { runOnboard } from "./onboard.js";
+import { runLogin } from "./login.js";
+import { runLogout } from "./logout.js";
+import { runStart } from "./start.js";
+import { runSync } from "./sync.js";
+import { runAnalyze } from "./analyze.js";
+import { runBackfillCommand } from "./backfill.js";
+import { runDoctor } from "./doctor.js";
 import { runStatus } from "./status.js";
 import { runSessions } from "./sessions.js";
 import { runJarvis } from "./jarvis.js";
@@ -62,30 +21,16 @@ import { runOps } from "./ops.js";
 import { runSlack } from "./slack.js";
 import { runModel, runSettings } from "./settings.js";
 import { runTeam } from "./team.js";
-import { asRecord, callTower, openTower } from "./tower-command.js";
 import { runWorkbook } from "./workbook.js";
 import { runBrief } from "./brief.js";
 import { runBriefEdit } from "./brief-edit.js";
 import { runBriefRewrite } from "./brief-rewrite.js";
 import { runCorrect } from "./correct.js";
 import { runNotes } from "./notes.js";
-import { createCollectorServer } from "../server.js";
-import { inspectAgentRules, installAgentRules, uninstallAgentRules, } from "../agent-rules.js";
-import { backfillRetryCommand, runBackfill, runBackfillCommand, } from "./backfill.js";
-import { runDoctor } from "./doctor.js";
-import { inspectBackfillLock } from "../backfill-lock.js";
-import { parseLocalArgs, normalizeUrl } from "./local-args.js";
-import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from "../autostart.js";
-import { DEFAULT_DASHBOARD_URL, ensureLocalCollectorConfig, getCollectorRuntimePaths, inspectLocalCollectorStatus, logoutLocalCollector, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, startLocalWorkContext, } from "../local-state.js";
-import { acquireSyncLock } from "../sync-lock.js";
-import { runAttributedWorktreeSync, } from "./session-sync.js";
-import { COLLECTION_ROOT_REQUIRED, CollectionRootRequiredError, missingCollectionRootMessage, } from "../onboarding-roots.js";
-import { rawEvidenceDedupSummary, rawEvidenceGcSummary, runRawEvidenceLocalGc, sweepDuplicateStagedRawEvidence, } from "../raw-evidence-gc.js";
-import { envWithNodeRuntimeOnPath, runScheduledSelfUpdate, } from "../scheduled-self-update.js";
-import { runAutostartSelfHeal, } from "../autostart-self-heal.js";
-import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
-import { runAutostartHealDetached } from "./autostart-heal.js";
-import { normalizeCollectionRoots } from "../root-normalization.js";
+import { runServe } from "./serve.js";
+import { runAutostart } from "./autostart-command.js";
+import { runAgentRules } from "./agent-rules-command.js";
+import { parseLocalArgs } from "./local-args.js";
 // `./local.js` is the published entry point for this command surface: the
 // public CLI's generated root, commands/root.ts, doctor.ts and the test suite
 // all import from here. Splitting the file must not move a name off it.
@@ -200,268 +145,6 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
         return 1;
     }
 }
-function addOnboardFailureEvent(events, blocker) {
-    const step = onboardFailureStep(blocker, events);
-    const existing = events.find((event) => event.step === step && event.status === "fail");
-    if (existing)
-        return;
-    addInstallEvent(events, step, "fail", blocker);
-}
-function addAutostartInstallEvent(events, result) {
-    if (!result) {
-        addInstallEvent(events, "autostart", "skipped", "runner_unavailable");
-        return;
-    }
-    if (result.status === "unsupported") {
-        addInstallEvent(events, "autostart", "skipped", "unsupported", result.message);
-        return;
-    }
-    addInstallEvent(events, "autostart", result.loaded === false ? "fail" : "ok", result.loaded === false ? "autostart_load_failed" : undefined, result.loaded === false ? result.message : undefined);
-}
-function onboardAutostartFailed(result) {
-    return (result !== null &&
-        result.status !== "unsupported" &&
-        result.loaded === false);
-}
-function writeOnboardAutostartBlocker(io, result) {
-    writeLine(io.stderr, "BLOCKED: initial collection succeeded, but recurring background collection is not running.");
-    if (result?.message)
-        writeLine(io.stderr, `Failure: ${result.message}`);
-    writeLine(io.stderr, "Next: run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.");
-}
-function onboardFailureStep(blocker, events) {
-    if (blocker === COLLECTION_ROOT_REQUIRED)
-        return "install";
-    if (blocker === "device_pairing")
-        return "pair";
-    if (blocker === "work_context" || blocker === "ticket_binding" || blocker === "ticket") {
-        return "work_context";
-    }
-    if (blocker === "network_or_ingest")
-        return "sync";
-    if (blocker === "install")
-        return "install";
-    const lastIncomplete = ["install", "auth", "pair", "work_context", "sync"].find((step) => !events.some((event) => event.step === step));
-    return lastIncomplete ?? "sync";
-}
-/** Refreshes the host autostart backend after successful onboarding. */
-async function refreshOnboardAutostart(command, roots, io) {
-    if (!io.exec)
-        return null;
-    const result = await installAutostartAgent({
-        homeDir: command.homeDir,
-        repoRoot: roots[0],
-        repoRoots: roots,
-        dashboardUrl: command.dashboardUrl,
-        exec: io.exec,
-    });
-    if (command.json)
-        return result;
-    if (result.status === "unsupported") {
-        writeLine(io.stdout, `Background autostart unsupported: ${result.message}`);
-        return result;
-    }
-    writeLine(io.stdout, result.loaded
-        ? "Background autostart refreshed; Tower syncs at login and every 15 min."
-        : "Background autostart refreshed, but the operating-system scheduler reported a problem; check `cockpit autostart status`.");
-    writeLine(io.stdout, autostartLocationLine(result));
-    return result;
-}
-async function refreshOnboardAgentRules(command, roots, io) {
-    const result = await installAgentRules({
-        homeDir: command.homeDir,
-        scopePaths: roots,
-    });
-    if (command.json)
-        return result;
-    writeLine(io.stdout, `Agent rules: ${onboardAgentRulesInstallLine(result)}`);
-    for (const target of result.targets) {
-        writeLine(io.stdout, `${agentRuleHostLabel(target.host)}: ${target.rules_file}`);
-    }
-    return result;
-}
-function onboardAgentRulesInstallLine(result) {
-    if (result.targets.some((target) => target.stale_block_replaced)) {
-        return "updated; replaced stale Tower ticket-binding guidance.";
-    }
-    switch (result.status) {
-        case "created":
-            return "installed.";
-        case "updated":
-            return "updated.";
-        case "unchanged":
-            return "already current.";
-        case "missing":
-            return "not installed.";
-    }
-}
-function writeOnboardLiveStatus(io, command, roots, options) {
-    writeLine(io.stdout, "You're live.");
-    writeLine(io.stdout, "Collecting from:");
-    for (const root of roots)
-        writeLine(io.stdout, `- ${root}`);
-    writeLine(io.stdout, `Paired user: ${options.pair?.session.email ??
-        options.pair?.session.auth_subject_id ??
-        (options.status?.session_state === "valid" ? "existing valid session" : "pending")}`);
-    writeLine(io.stdout, `Background sync: ${backgroundSyncLine(options.autostart)}`);
-    writeLine(io.stdout, `Initial sync: ${options.initialSyncOk ? options.sync?.status ?? "uploaded" : "blocked"}`);
-    writeLine(io.stdout, `Historical backfill: complete (${options.backfill.counts.backfilled} uploaded, ${options.backfill.counts.skipped} explicit skip(s))`);
-    writeLine(io.stdout, `Agent rules: ${options.agentRules ? onboardAgentRulesInstallLine(options.agentRules) : "not refreshed"}`);
-    writeLine(io.stdout, `Dashboard: ${command.dashboardUrl}/my-work`);
-    writeLine(io.stdout, "Next: cockpit status");
-}
-function requiredOnboardBackfillCommand(command) {
-    return {
-        homeDir: command.homeDir,
-        all: true,
-        dryRun: false,
-        maxDepth: command.maxDepth,
-        maxRepos: command.maxRepos,
-        yes: true,
-        json: true,
-    };
-}
-async function runRequiredOnboardBackfill(command, io) {
-    const backfillCommand = requiredOnboardBackfillCommand(command);
-    const retryCommand = backfillRetryCommand(backfillCommand);
-    try {
-        const result = await runBackfill(backfillCommand, io);
-        return {
-            status: result.status,
-            failureReason: result.status === "complete"
-                ? null
-                : result.failure_reason ?? `backfill_${result.status}`,
-            retryCommand: result.retry_command,
-            result,
-        };
-    }
-    catch (error) {
-        return {
-            status: "failed",
-            failureReason: errorMessage(error),
-            retryCommand,
-            result: null,
-        };
-    }
-}
-function onboardBackfillPayload(outcome) {
-    return (outcome.result ?? {
-        status: "blocked",
-        failure_reason: outcome.failureReason,
-        retry_command: outcome.retryCommand,
-    });
-}
-/**
- * The blocked-backfill result, identical in both onboarding arms. `extra`
- * carries the arm-specific keys and is spread where those keys appeared before,
- * so the `--json` key order is unchanged.
- */
-function writeOnboardBackfillBlockedResult(io, options) {
-    if (!options.json) {
-        writeOnboardBackfillBlocker(io, options.backfill);
-        return;
-    }
-    writeLine(io.stdout, JSON.stringify({
-        ...options.base,
-        ...options.extra,
-        backfill: onboardBackfillPayload(options.backfill),
-        blocker: "backfill_incomplete",
-        backfill_failure_reason: options.backfill.failureReason,
-        next_step: options.backfill.retryCommand,
-    }, null, 2));
-}
-function writeOnboardBackfillBlocker(io, outcome) {
-    writeLine(io.stderr, "BLOCKED: all-history Codex and Claude backfill is incomplete for the approved collection roots.");
-    writeLine(io.stderr, `Failure: ${outcome.failureReason ?? `backfill_${outcome.status}`}`);
-    writeLine(io.stderr, `Retry: ${outcome.retryCommand}`);
-}
-function backgroundSyncLine(result) {
-    if (!result)
-        return "not refreshed (autostart runner unavailable)";
-    if (result.status === "unsupported")
-        return `unsupported (${result.message})`;
-    if (result.status === "installed" && result.loaded)
-        return "installed";
-    if (result.status === "installed") {
-        return `installed with warning (${result.message ?? "operating-system scheduler load failed"})`;
-    }
-    return result.status;
-}
-function writeOnboardBanner(command, io) {
-    writeLine(io.stdout, "Setting up Tower");
-    writeLine(io.stdout, `Dashboard: ${command.dashboardUrl}`);
-    writeLine(io.stdout, `Ticket: ${displayTicketId(command.activeTicketId)}`);
-}
-/**
- * Step 2 of onboarding: reuse the device session when it already belongs to
- * this owner on this dashboard, otherwise sign in and pair — logging the old
- * session out first when it belongs to someone else.
- *
- * Returns null when an existing session was reused, which is why the caller's
- * `pair` stays null and the readiness proof falls back to the status file.
- */
-async function pairForOnboarding(command, input, installEvents, io) {
-    const installedStatus = await inspectLocalCollectorStatus({
-        homeDir: command.homeDir,
-        repoRoot: input.primaryRoot,
-        branch: command.branch,
-    });
-    const installedSession = await readOnboardSessionReuseCandidate(command.homeDir);
-    const canReuseInstalledSession = canReuseOnboardSession(installedSession, input.claimedOwnerEmail, command.dashboardUrl);
-    if (installedStatus.session_state === "valid" && canReuseInstalledSession) {
-        addInstallEvent(installEvents, "auth", "skipped", "existing_session");
-        addInstallEvent(installEvents, "pair", "skipped", "existing_session");
-        if (!command.json) {
-            writeLine(io.stdout, "2/5 Existing valid device session found; pairing skipped.");
-        }
-        return null;
-    }
-    if (installedStatus.session_state === "valid") {
-        await logoutLocalCollector({ homeDir: command.homeDir });
-        if (!command.json) {
-            writeLine(io.stdout, "2/5 Existing valid device session does not match requested owner or dashboard; pairing again.");
-        }
-    }
-    const authResult = await requestPairingAccessTokenDetailed({
-        dashboardUrl: command.dashboardUrl,
-        email: input.claimedOwnerEmail,
-        noAuth: command.noAuth,
-        json: command.json,
-    }, io);
-    addInstallEvent(installEvents, "auth", authResult.status, authResult.errorCode);
-    const pair = await pairLocalCollectorWithAuthFallback({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-        claimedOwnerEmail: input.claimedOwnerEmail,
-        deviceName: command.deviceName,
-        pollIntervalMs: command.pollIntervalMs,
-        timeoutMs: command.timeoutMs,
-        pairingAccessToken: authResult.accessToken,
-        fetch: io.fetch,
-        onPairStarted: command.json
-            ? undefined
-            : (request) => writePairingInstructions(io, request),
-    }, io);
-    addInstallEvent(installEvents, "pair", "ok");
-    if (!command.json) {
-        writeLine(io.stdout, "2/5 Device paired.");
-        writeLine(io.stdout, `User: ${pair.session.email ?? pair.session.auth_subject_id}`);
-        writeLine(io.stdout, `Device: ${pair.session.device_name ?? pair.session.device_id ?? "unknown"}`);
-    }
-    return pair;
-}
-/**
- * The last two setup steps of a successful onboard, in the order both arms run
- * them. `ok` is false only when a supported scheduler was asked to load
- * recurring collection and refused — an unsupported host is not a failure.
- */
-async function completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io) {
-    const agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
-    addInstallEvent(installEvents, "agent_rules", "ok");
-    const autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
-    addAutostartInstallEvent(installEvents, autostart);
-    return { agentRules, autostart, ok: !onboardAutostartFailed(autostart) };
-}
 async function runDoctorLogin(command, io) {
     return runLogin({
         kind: "login",
@@ -487,1455 +170,4 @@ async function resolveAndSaveDoctorRoots(command, io) {
     if (!command.json) {
         writeLine(io.stdout, `Saved collection roots: ${resolution.collectionRoots.join(", ")}`);
     }
-}
-/**
- * Every onboard exit funnels through here so the best-effort install-event
- * report always fires, pass or blocked — replaces a `finish` closure that used
- * to live inside `runOnboard` so the flow functions below can call it too.
- */
-async function finishOnboardRun(command, installEvents, io, code) {
-    await reportInstallEventsBestEffort({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-        command: "onboard",
-        events: installEvents,
-        json: command.json,
-        io,
-    });
-    return code;
-}
-/**
- * Every onboard `--json` payload is `onboardResult` plus the roots this pass
- * resolved plus whatever extra keys that arm of onboarding adds. Assembling it
- * here means the call sites below cannot drift on key order or forget a field
- * a sibling call site remembers.
- */
-function onboardJsonPayload(resultStatus, command, install, pair, sync, status, rootsResult, extra = {}) {
-    return {
-        ...onboardResult(resultStatus, command, install, pair, sync, status),
-        collection_roots: rootsResult?.roots ?? [],
-        root_resolution: rootsResult,
-        ...extra,
-    };
-}
-function writeOnboardJson(io, payload) {
-    writeLine(io.stdout, JSON.stringify(payload, null, 2));
-}
-/** Step 0: which folders are approved, and who claims to own this machine's uploads. */
-async function prepareOnboardRoots(command, installEvents, io) {
-    const resolvedRoots = await resolveOnboardingRootsForCommand(command, io);
-    const rootsResult = resolvedRoots.rootsResult;
-    const collectionRoots = rootsResult.roots;
-    const attributionCollectionRoots = await collectionRootConsentAliases(collectionRoots);
-    const primaryRoot = resolvedRoots.primaryRoot;
-    const resolvedCommand = {
-        ...command,
-        repoRoot: primaryRoot,
-        collectionRoots,
-    };
-    if (!command.json) {
-        writeLine(io.stdout, `Collecting from: ${collectionRoots.join(", ")}`);
-    }
-    if (rootsResult.homeRootOptIn) {
-        addInstallEvent(installEvents, "home_root_optin", "ok");
-    }
-    return {
-        resolvedRoots,
-        rootsResult,
-        collectionRoots,
-        attributionCollectionRoots,
-        primaryRoot,
-        existingConfig: resolvedRoots.existingConfig,
-        resolvedCommand,
-    };
-}
-/** Step 1: write the local config that makes this machine a known collector. */
-async function installOnboardConfig(command, resolvedRoots, installEvents, io) {
-    const install = await persistOnboardingRootConfig(command, resolvedRoots);
-    addInstallEvent(installEvents, "install", "ok");
-    if (!command.json) {
-        writeLine(io.stdout, "1/5 Installed local collector.");
-        writeLine(io.stdout, `Config: ${install.paths.config_file}`);
-    }
-    return install;
-}
-/**
- * The onboarding runbook: resolve roots, install, pair, discover worktrees,
- * then hand off to whichever arm matches what was found — one repo runs the
- * single-repo sync-then-backfill sequence (`runOnboardSingleRepoFlow`),
- * several run the parent-folder one (`runOnboardMultiRepoFlow`). Any failure
- * anywhere in either arm unwinds to the single catch below.
- */
-async function runOnboard(command, io) {
-    const installEvents = [];
-    let install = null;
-    let pair = null;
-    let rootsResult = null;
-    // `sync` has to survive a throw from inside either flow function, so it is
-    // mutated through this holder rather than returned — a return only happens
-    // on the success path, and the failure path needs the value too.
-    const syncHolder = {
-        current: null,
-    };
-    try {
-        if (!command.json)
-            writeOnboardBanner(command, io);
-        const roots = await prepareOnboardRoots(command, installEvents, io);
-        rootsResult = roots.rootsResult;
-        const claimedOwnerEmail = await resolveOnboardEmail(roots.resolvedCommand, roots.collectionRoots, roots.existingConfig, io);
-        install = await installOnboardConfig(command, roots.resolvedRoots, installEvents, io);
-        pair = await pairForOnboarding(command, { primaryRoot: roots.primaryRoot, claimedOwnerEmail }, installEvents, io);
-        const worktrees = await discoverCommandWorktrees(roots.collectionRoots, {
-            maxDepth: command.maxDepth,
-            maxRepos: command.maxRepos,
-            homeDir: command.homeDir,
-            allowEmpty: true,
-        }, io);
-        const ctx = {
-            command,
-            resolvedCommand: roots.resolvedCommand,
-            collectionRoots: roots.collectionRoots,
-            rootsResult: roots.rootsResult,
-            install,
-            pair,
-            installEvents,
-            io,
-            worktrees,
-        };
-        if (worktrees.length > 1) {
-            return await runOnboardMultiRepoFlow(ctx);
-        }
-        return await runOnboardSingleRepoFlow(ctx, {
-            attributionCollectionRoots: roots.attributionCollectionRoots,
-            primaryRoot: roots.primaryRoot,
-            syncHolder,
-        });
-    }
-    catch (error) {
-        return await handleOnboardFailure(error, command, rootsResult, install, pair, syncHolder.current, installEvents, io);
-    }
-}
-/** The parent-folder arm: sync every discovered worktree, then backfill and finish setup once. */
-async function runOnboardMultiRepoFlow(ctx) {
-    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
-    const multi = await runMultiRepoOnboard(resolvedCommand, io, worktrees);
-    addInstallEvent(installEvents, "work_context", "ok");
-    addInstallEvent(installEvents, "sync", multi.ok ? "ok" : "fail", multi.ok ? undefined : "sync_blocked");
-    if (!multi.ok) {
-        if (command.json) {
-            writeOnboardJson(io, onboardJsonPayload("blocked", resolvedCommand, install, pair, null, null, rootsResult, {
-                mode: "multi_repo",
-                repos: multi.results,
-                codex_sessions: multi.codex_sessions,
-                blocker: "sync_blocked",
-                next_step: "Run `cockpit sync --json` until every root returns an uploaded receipt.",
-            }));
-        }
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
-    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
-    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
-        ? undefined
-        : backfill.failureReason ?? "backfill_incomplete");
-    if (!completedBackfill) {
-        writeOnboardBackfillBlockedResult(io, {
-            json: command.json,
-            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, null, null, rootsResult),
-            extra: {
-                mode: "multi_repo",
-                repos: multi.results,
-                codex_sessions: multi.codex_sessions,
-            },
-            backfill,
-        });
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    const multiSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
-    const { agentRules, autostart } = multiSetup;
-    const onboardOk = multiSetup.ok;
-    if (command.json) {
-        writeOnboardJson(io, onboardJsonPayload(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, null, null, rootsResult, {
-            agent_rules: agentRules,
-            autostart,
-            backfill: completedBackfill,
-            mode: "multi_repo",
-            repos: multi.results,
-            codex_sessions: multi.codex_sessions,
-            ...(!onboardOk && multi.ok
-                ? {
-                    blocker: "autostart_load_failed",
-                    next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
-                }
-                : {}),
-        }));
-    }
-    if (onboardOk && !command.json) {
-        writeLine(io.stdout, "PASS: Tower is set up and collecting.");
-        writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
-            pair,
-            status: null,
-            sync: null,
-            agentRules,
-            autostart,
-            initialSyncOk: true,
-            backfill: completedBackfill,
-        });
-    }
-    else if (multi.ok && !command.json) {
-        writeOnboardAutostartBlocker(io, autostart);
-    }
-    return finishOnboardRun(command, installEvents, io, onboardOk ? 0 : 1);
-}
-/** The single-repo arm: start the work context, sync it, backfill, then finish setup once. */
-async function runOnboardSingleRepoFlow(ctx, single) {
-    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
-    const worktreeRoot = worktrees[0]?.repo_root ?? single.primaryRoot;
-    const context = await startLocalWorkContext({
-        homeDir: command.homeDir,
-        repoRoot: worktreeRoot,
-        branch: command.branch,
-        activeTicketId: command.activeTicketId,
-    });
-    if (!command.json) {
-        writeLine(io.stdout, "3/5 Work context active.");
-        writeLine(io.stdout, `Repo: ${context.repo}`);
-        writeLine(io.stdout, `Branch: ${context.branch}`);
-        writeLine(io.stdout, `Ticket: ${displayTicketId(context.active_ticket_id)}`);
-        writeLine(io.stdout, `Context: ${context.work_context_id}`);
-    }
-    addInstallEvent(installEvents, "work_context", "ok");
-    const run = await runAttributedWorktreeSync({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-        collectionRoots: single.attributionCollectionRoots,
-        startContexts: false,
-        worktrees,
-        fetchImpl: io.fetch,
-    });
-    const sync = run.outcomes[0]?.sync ?? null;
-    single.syncHolder.current = sync;
-    if (!sync) {
-        throw new Error("Onboard sync produced no result for the repo worktree.");
-    }
-    const status = await inspectLocalCollectorStatus({
-        homeDir: command.homeDir,
-        repoRoot: worktreeRoot,
-        branch: command.branch,
-    });
-    if (!run.ok || sync.status !== "uploaded") {
-        addInstallEvent(installEvents, "sync", "fail", "sync_blocked");
-        const collectionRunStatus = attributedSyncRunStatus(run);
-        if (command.json) {
-            writeOnboardJson(io, onboardJsonPayload("blocked", resolvedCommand, install, pair, sync, status, rootsResult, {
-                codex_sessions: run.summary,
-                collection_status: collectionRunStatus,
-            }));
-        }
-        else {
-            const syncFailureReason = sync.status === "spooled" ? sync.failure_reason : null;
-            const retryCommand = sync.status === "spooled"
-                ? sync.retry_command
-                : `cockpit sync --workspace ${JSON.stringify(worktreeRoot)}`;
-            writeLine(io.stderr, "BLOCKED: initial collection is incomplete; retry until every eligible session has a durable receipt or explicit terminal reason.");
-            writeLine(io.stderr, `Failure: ${syncFailureReason ?? (run.summary.report_posted ? collectionRunStatus : run.summary.report_reason)}`);
-            writeAgentSessionSummary(io, run.summary);
-            writeLine(io.stderr, `Retry: ${retryCommand}`);
-        }
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    addInstallEvent(installEvents, "sync", "ok");
-    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
-    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
-    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
-        ? undefined
-        : backfill.failureReason ?? "backfill_incomplete");
-    if (!completedBackfill) {
-        writeOnboardBackfillBlockedResult(io, {
-            json: command.json,
-            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, sync, status, rootsResult),
-            extra: { codex_sessions: run.summary },
-            backfill,
-        });
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    if (command.json) {
-        const jsonSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
-        const { agentRules, autostart } = jsonSetup;
-        const onboardOk = jsonSetup.ok;
-        writeOnboardJson(io, onboardJsonPayload(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, sync, status, rootsResult, {
-            agent_rules: agentRules,
-            autostart,
-            backfill: completedBackfill,
-            codex_sessions: run.summary,
-            ...(!onboardOk
-                ? {
-                    blocker: "autostart_load_failed",
-                    next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
-                }
-                : {}),
-        }));
-        return finishOnboardRun(command, installEvents, io, onboardOk ? 0 : 1);
-    }
-    writeLine(io.stdout, "4/5 Uploaded what you worked on.");
-    writeLine(io.stdout, `HTTP: ${sync.http_status}`);
-    writeLine(io.stdout, `Things recorded: ${sync.event_count}`);
-    writeLine(io.stdout, `Sources: ${sync.source_scan_count}`);
-    writeLine(io.stdout, `Risk flags: ${sync.risk_flag_count}`);
-    writeLine(io.stdout, `Raw evidence files: ${sync.raw_evidence_file_count}`);
-    writeLine(io.stdout, rawEvidenceSyncLine(sync));
-    writeAgentSessionSummary(io, run.summary);
-    writeLine(io.stdout, "5/5 Status ready.");
-    writeLine(io.stdout, `Upload state: ${status.upload_state}`);
-    writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
-    const setup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
-    const { agentRules, autostart } = setup;
-    if (!setup.ok) {
-        writeOnboardAutostartBlocker(io, autostart);
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    writeLine(io.stdout, "PASS: Tower is set up and collecting.");
-    writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
-        pair,
-        status,
-        sync,
-        agentRules,
-        autostart,
-        initialSyncOk: true,
-        backfill: completedBackfill,
-    });
-    return finishOnboardRun(command, installEvents, io, 0);
-}
-/**
- * Every uncaught error from either onboarding arm lands here. `status` is
- * always recomputed fresh against whichever root got furthest, never trusted
- * from before the throw — the arms already recompute it themselves on their
- * own success paths, so nothing upstream is lost by not threading it through.
- */
-async function handleOnboardFailure(error, command, rootsResult, install, pair, sync, installEvents, io) {
-    const message = errorMessage(error);
-    const statusRoot = rootsResult?.roots[0] ?? command.repoRoot;
-    const status = statusRoot
-        ? await inspectLocalCollectorStatus({
-            homeDir: command.homeDir,
-            repoRoot: statusRoot,
-            branch: command.branch,
-        }).catch(() => null)
-        : null;
-    const blocker = classifyOnboardBlocker(message);
-    addOnboardFailureEvent(installEvents, blocker);
-    const nextStep = nextStepForOnboardBlocker(blocker, command);
-    if (command.json) {
-        writeOnboardJson(io, onboardJsonPayload("blocked", command, install, pair, sync, status, rootsResult, {
-            blocker,
-            message,
-            next_step: nextStep,
-        }));
-    }
-    else {
-        writeLine(io.stderr, `BLOCKED: ${message}`);
-        writeLine(io.stderr, `Next: ${nextStep}`);
-    }
-    return finishOnboardRun(command, installEvents, io, 1);
-}
-async function runMultiRepoOnboard(command, io, worktrees) {
-    if (!command.json) {
-        writeLine(io.stdout, `3/5 Parent folder mode: discovered ${worktrees.length} git worktree(s).`);
-    }
-    const collectionRoots = await collectionRootConsentAliases(command.collectionRoots ??
-        (command.repoRoot ? [command.repoRoot] : []));
-    const run = await runAttributedWorktreeSync({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-        branch: command.branch,
-        activeTicketId: command.activeTicketId,
-        collectionRoots,
-        startContexts: true,
-        worktrees,
-        fetchImpl: io.fetch,
-    });
-    const results = run.outcomes.map((outcome) => worktreeSyncRow(outcome, run));
-    const collectionRunStatus = attributedSyncRunStatus(run);
-    if (!command.json) {
-        for (const [index, outcome] of run.outcomes.entries()) {
-            const row = results[index];
-            if (!row)
-                continue;
-            const uploaded = outcome.sync.status === "uploaded";
-            writeLine(uploaded ? io.stdout : io.stderr, `${uploaded ? "SYNCED" : "BLOCKED"} ${row["repo_label"]}/${row["worktree_label"]} (${row["branch"]}) head:${shortSha(outcome.sync.head_sha ?? outcome.worktree.head_sha)} ${outcome.sync.status} objects:${outcome.sync.raw_evidence_uploaded_object_count} chunks:${outcome.sync.raw_evidence_uploaded_chunk_count} reused:${outcome.sync.raw_evidence_reused_count} failed:${outcome.sync.raw_evidence_failed_count} sessions:${row["attributed_session_count"]}${row["failure_reason"] ? ` reason:${row["failure_reason"]}` : ""}`);
-        }
-        writeLine(io.stdout, "4/5 Parent worktree sync complete.");
-        writeLine(io.stdout, `Uploaded: ${results.filter((row) => row["upload_status"] === "uploaded").length}/${results.length}`);
-        writeAgentSessionSummary(io, run.summary);
-        if (run.ok) {
-            writeLine(io.stdout, "Live sync receipts complete; verifying all-history Codex and Claude backfill.");
-        }
-        else {
-            writeLine(io.stderr, `BLOCKED: Tower collection is ${collectionRunStatus}; retry until every eligible session has a durable receipt or explicit terminal reason.`);
-        }
-        writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
-    }
-    return { ok: run.ok, results, codex_sessions: run.summary };
-}
-async function runLogin(command, io) {
-    // Standalone `cockpit login` must work on a fresh machine: bootstrap a
-    // minimal rootless config when onboard/install has not run yet, instead of
-    // failing on the missing config file.
-    const { config, paths, created } = await ensureLocalCollectorConfig({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-    });
-    const dashboardUrl = command.dashboardUrl ?? config.dashboard_url;
-    if (created && !command.json) {
-        writeLine(io.stdout, `First login on this machine; wrote collector config: ${paths.config_file}`);
-    }
-    const claimedOwnerEmail = await resolveInteractiveLoginEmail(command, io);
-    const pairingAccessToken = await requestPairingAccessToken({
-        dashboardUrl,
-        email: claimedOwnerEmail,
-        noAuth: command.noAuth,
-        json: command.json,
-    }, io);
-    const result = await pairLocalCollectorWithAuthFallback({
-        homeDir: command.homeDir,
-        dashboardUrl,
-        claimedOwnerEmail,
-        deviceName: command.deviceName,
-        pollIntervalMs: command.pollIntervalMs,
-        timeoutMs: command.timeoutMs,
-        pairingAccessToken,
-        fetch: io.fetch,
-        onPairStarted: command.json
-            ? undefined
-            : (request) => {
-                writeLine(io.stdout, "Tower device pairing started.");
-                writeLine(io.stdout, `Open: ${request.approve_url}`);
-                writeLine(io.stdout, `Code: ${request.user_code}`);
-                writeLine(io.stdout, "Waiting for dashboard approval...");
-            },
-    }, io);
-    if (command.json) {
-        writeLine(io.stdout, JSON.stringify(result, null, 2));
-        return 0;
-    }
-    writeLine(io.stdout, "Tower collector paired.");
-    writeLine(io.stdout, `Session: ${result.session_file}`);
-    writeLine(io.stdout, `User: ${result.session.email ?? result.session.auth_subject_id}`);
-    writeLine(io.stdout, `Device: ${result.session.device_name ?? result.session.device_id ?? "unknown"}`);
-    writeLine(io.stdout, config.default_repo_paths.length > 0
-        ? "Next: run `cockpit start` inside the repo."
-        : "Next: run `cockpit onboard` from your repo root so Tower knows which repos to collect.");
-    return 0;
-}
-function writePairingInstructions(io, request) {
-    writeLine(io.stdout, "2/5 Device pairing started.");
-    writeLine(io.stdout, `Open: ${request.approve_url}`);
-    writeLine(io.stdout, `Code: ${request.user_code}`);
-    writeLine(io.stdout, "Waiting for dashboard approval...");
-}
-function onboardResult(resultStatus, command, install, pair, sync, status) {
-    return {
-        status: resultStatus,
-        dashboard_url: command.dashboardUrl,
-        ticket_id: sync?.ticket_id ?? command.activeTicketId ?? null,
-        work_context_id: sync?.work_context_id ?? status?.work_context_id ?? null,
-        config_file: install?.paths.config_file ?? status?.config_file ?? null,
-        session_file: install?.paths.session_file ?? status?.session_file ?? null,
-        collection_roots: command.collectionRoots ?? (command.repoRoot ? [command.repoRoot] : []),
-        paired_user: pair?.session.email ?? pair?.session.auth_subject_id ?? null,
-        paired_device: pair?.session.device_name ?? pair?.session.device_id ?? null,
-        upload_status: sync?.status ?? null,
-        upload_state: status?.upload_state ?? null,
-        event_count: sync?.event_count ?? null,
-        source_scan_count: sync?.source_scan_count ?? null,
-        risk_flag_count: sync?.risk_flag_count ?? null,
-        pending_upload_count: status?.pending_upload_count ?? null,
-        last_upload_success_at: status?.last_upload_success_at ?? null,
-        next_dashboard_path: `${command.dashboardUrl}/my-work`,
-    };
-}
-function classifyOnboardBlocker(message) {
-    if (message.includes(COLLECTION_ROOT_REQUIRED))
-        return COLLECTION_ROOT_REQUIRED;
-    if (/ticket/i.test(message))
-        return "ticket";
-    if (/pair|paired|approval|expired|revoked/i.test(message))
-        return "device_pairing";
-    if (/fetch|network|ENOTFOUND|ECONNREFUSED|HTTP/i.test(message))
-        return "network_or_ingest";
-    if (/config|install/i.test(message))
-        return "install";
-    if (/context|start/i.test(message))
-        return "work_context";
-    if (/bound|binding/i.test(message))
-        return "ticket_binding";
-    return "unknown";
-}
-function nextStepForOnboardBlocker(blocker, options = {}) {
-    switch (blocker) {
-        case COLLECTION_ROOT_REQUIRED:
-            return missingCollectionRootMessage(options);
-        case "ticket":
-        case "ticket_binding":
-            return "Run `cockpit start --ticket <id>` when actual ticket work begins, then run `cockpit sync`.";
-        case "device_pairing":
-            return "Ask Edward to approve this machine in the dashboard under Ambient -> Collector approvals, then run `cockpit onboard` again.";
-        case "network_or_ingest":
-            return "Check dashboard URL/network, then run `cockpit sync --json` or rerun `cockpit onboard`.";
-        case "install":
-            return "Rerun `cockpit onboard` from the repo root; it will reinstall local config.";
-        case "work_context":
-            return "Run `cockpit start --ticket <id> --workspace \"$PWD\"`, then retry `cockpit sync`.";
-        default:
-            return "Run `cockpit status --json` and report the blocker label plus last failure reason.";
-    }
-}
-/**
- * `cockpit logout` removes the local session file. `--revoke` also tells Tower
- * to end the device's token (BLI-3461).
- *
- * Those are two different facts, and the difference matters when a laptop is
- * being handed back: without the revoke the machine stops collecting but the
- * token it held is still one the server would honour. The revoke is attempted
- * FIRST, because it needs the token the local logout is about to delete, and a
- * revoke that fails does not stop the local logout — the person asked to be
- * signed out of this machine, and they get that either way. The outcome of each
- * half is reported separately rather than folded into one "ok".
- */
-async function runLogout(command, io) {
-    const revoke = command.revoke ? await revokeThisDevice(command, io) : null;
-    const result = await logoutLocalCollector({ homeDir: command.homeDir });
-    writeLine(io.stderr, `[logout] done ${JSON.stringify({
-        local_session: result.removed ? "removed" : "absent",
-        revoke: revoke ? revoke.outcome : "not_requested",
-    })}`);
-    if (command.json) {
-        writeLine(io.stdout, JSON.stringify({ ...result, revoke: revoke ?? { outcome: "not_requested" } }, null, 2));
-        return revoke && revoke.outcome !== "revoked" ? 1 : 0;
-    }
-    writeLine(io.stdout, result.removed
-        ? "Tower collector session removed."
-        : "No Tower collector session found.");
-    if (revoke) {
-        writeLine(io.stdout, revoke.outcome === "revoked"
-            ? "This device's Tower token is revoked."
-            : `This device's Tower token was NOT revoked: ${revoke.detail}`);
-    }
-    return revoke && revoke.outcome !== "revoked" ? 1 : 0;
-}
-/**
- * Ends this device's own session server-side.
- *
- * The route gates the device arm on `self_revoke_only`, so the device id is
- * read from the paired session rather than accepted as an argument — there is
- * no way to spell "revoke somebody else's laptop" here, and that is deliberate.
- */
-async function revokeThisDevice(command, io) {
-    let tower;
-    let deviceId;
-    try {
-        const session = await readLocalCollectorSessionFile(getCollectorRuntimePaths(command.homeDir));
-        deviceId = session.device_id;
-        tower = await openTower("logout", command, io);
-    }
-    catch (error) {
-        return { outcome: "no_paired_session", detail: errorMessage(error) };
-    }
-    const result = await callTower(tower, {
-        path: `/api/ambient/devices/${encodeURIComponent(deviceId)}/revoke`,
-        method: "POST",
-        label: "logout revoke",
-        body: { reason: "Signed out from the device" },
-    });
-    if (!result.ok) {
-        return { outcome: result.reason, detail: result.detail };
-    }
-    const body = asRecord(result.body);
-    return { outcome: "revoked", detail: String(asRecord(body.device).revoked_at ?? "") };
-}
-async function runStart(command, io) {
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
-    if (worktrees.length > 1) {
-        const contexts = await Promise.all(worktrees.map((worktree) => startLocalWorkContext({
-            homeDir: command.homeDir,
-            repoRoot: worktree.repo_root,
-            branch: command.branch,
-            activeTicketId: command.activeTicketId,
-            clearTicket: command.clearTicket,
-            topicLabel: command.topicLabel,
-            topicSummaryRedacted: command.topicSummaryRedacted,
-            workIntent: command.workIntent,
-            workPhase: command.workPhase,
-            intentSource: command.intentSource,
-            intentConfidence: command.intentConfidence,
-            operatorId: command.operatorId,
-            sessionId: command.sessionId,
-        })));
-        if (command.json) {
-            writeLine(io.stdout, JSON.stringify({ mode: "multi_repo", contexts }, null, 2));
-            return 0;
-        }
-        writeLine(io.stdout, `Tower parent work context active for ${contexts.length} worktree(s).`);
-        for (const context of contexts) {
-            writeLine(io.stdout, `- ${context.repo_label ?? context.repo}/${context.worktree_label ?? "worktree"} · ${context.branch} · ${context.work_context_id}`);
-        }
-        return 0;
-    }
-    const context = await startLocalWorkContext(command);
-    if (command.json) {
-        writeLine(io.stdout, JSON.stringify(context, null, 2));
-        return 0;
-    }
-    writeLine(io.stdout, "Tower work context active.");
-    writeLine(io.stdout, `Repo: ${context.repo}`);
-    writeLine(io.stdout, `Branch: ${context.branch}`);
-    writeLine(io.stdout, `Ticket: ${displayTicketId(context.active_ticket_id)}`);
-    if (context.topic_label || context.work_intent || context.work_phase) {
-        writeLine(io.stdout, `Topic: ${context.topic_label ?? "unlabeled"} · ${context.work_intent ?? "unknown"} · ${context.work_phase ?? "unknown"}`);
-    }
-    writeLine(io.stdout, `Context: ${context.work_context_id}`);
-    return 0;
-}
-async function runSync(command, io) {
-    const paths = getCollectorRuntimePaths(command.homeDir);
-    // BLI-3553, first thing in the tick: cap the scheduler's own logs. Nothing
-    // rotated them before, and two months of a 15-minute tick left 211 MB of
-    // sync.log on the reference Mac. Best-effort by construction — a rotation
-    // problem is its own log line, never a reason collection does not run.
-    await rotateCollectorLogsBestEffort(paths);
-    const config = await readLocalCollectorConfig(paths).catch(() => null);
-    const dashboardUrl = command.dashboardUrl ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL;
-    const minCliVersionAtStart = await reportInstallEventsBestEffort({
-        homeDir: command.homeDir,
-        dashboardUrl,
-        command: "sync",
-        events: [{ step: "sync_started", status: "ok" }],
-        json: command.json,
-        io,
-    });
-    try {
-        const result = await runSyncWithHealthReceipt(command, io);
-        // BLI-3551: every tick checks in, including one that collected nothing.
-        // This is the only writer of `last_seen_at` that does not need an envelope,
-        // so it is what separates a quiet machine from a dead one.
-        await sendSyncHeartbeat(command, io, dashboardUrl, result.heartbeat);
-        const minCliVersion = await reportInstallEventsBestEffort({
-            homeDir: command.homeDir,
-            dashboardUrl,
-            command: "sync",
-            events: [result.completion],
-            json: command.json,
-            io,
-        });
-        // BLI-2601: self-update runs only after collection's own outcome above is
-        // already decided and reported, win or lose. See the function doc.
-        await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersion ?? minCliVersionAtStart);
-        await runAutostartSelfHealAfterSync(command, io, dashboardUrl);
-        return result.exitCode;
-    }
-    catch (error) {
-        const errorCode = classifySyncHealthError(error);
-        // A machine whose sync THREW is still alive, and that is worth knowing —
-        // a device that stops checking in entirely is a different problem from one
-        // checking in with a failure every fifteen minutes.
-        await sendSyncHeartbeat(command, io, dashboardUrl, {
-            status: "fail",
-            reason: errorCode,
-        });
-        const minCliVersion = await reportInstallEventsBestEffort({
-            homeDir: command.homeDir,
-            dashboardUrl,
-            command: "sync",
-            events: [
-                {
-                    step: "sync_complete",
-                    status: "fail",
-                    error_code: errorCode,
-                    error_detail: redactedSyncErrorDetail(error),
-                },
-            ],
-            json: command.json,
-            io,
-        });
-        await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersion ?? minCliVersionAtStart);
-        await runAutostartSelfHealAfterSync(command, io, dashboardUrl);
-        throw error;
-    }
-}
-/**
- * The tick's check-in (BLI-3551).
- *
- * Resolving the roots is best-effort on purpose: a machine with NO approved
- * root is exactly the machine whose silence needs explaining, so it still
- * checks in — with an empty root list, which is itself the finding.
- */
-async function sendSyncHeartbeat(command, io, dashboardUrl, facts) {
-    const roots = await resolveSyncCollectionRoots(command).catch(() => []);
-    await sendCollectorHeartbeatBestEffort({
-        homeDir: command.homeDir,
-        dashboardUrl,
-        roots,
-        facts,
-        io,
-    }).catch((error) => {
-        // The sender already swallows everything it knows about; this is the net
-        // for anything it does not, because a heartbeat must never fail a sync.
-        console.error("[heartbeat] the check-in threw and was dropped", JSON.stringify({ reason: "heartbeat_threw", ...describeError(error) }));
-        return false;
-    });
-}
-/**
- * BLI-2721: after the tick's collection and self-update are done and
- * reported, repair a broken/legacy autostart registration in place (Windows
- * only — see autostart-self-heal.ts for why macOS is excluded). Every error
- * path is swallowed like the self-update's: heal outcomes are their own
- * receipts, never a sync failure.
- */
-async function runAutostartSelfHealAfterSync(command, io, dashboardUrl) {
-    let result;
-    try {
-        const rawExec = io.exec;
-        if (!rawExec) {
-            // BLI-3483: this was a bare `return`. On Windows the self-heal is the
-            // only thing that puts a broken scheduler back, so abandoning it here
-            // meant a machine could stop collecting forever and leave no receipt
-            // anywhere — the exact shape the fleet contract forbids. The packed CLI
-            // always supplies a runner (`commands/cli-io.ts`), so this fires only for
-            // an embedder that built its own `io`; it costs one line either way.
-            console.error("[autostart-self-heal] no process runner on this io; the repair could not be attempted", JSON.stringify({
-                reason: "runner_unavailable",
-                platform: process.platform,
-                next_action: "reinstall the CLI (npm i -g @bli-cockpit/cli) and run `cockpit autostart install`",
-            }));
-            result = {
-                status: "skipped",
-                reason: "runner_unavailable",
-                detail: "No process runner available to this CLI invocation; run `cockpit autostart install` by hand.",
-            };
-            await reportAutostartSelfHealOutcome(command, io, dashboardUrl, result);
-            return;
-        }
-        const spawnEnv = envWithNodeRuntimeOnPath(io.env ?? process.env);
-        const exec = (cmd, args, options) => rawExec(cmd, args, { ...options, env: options?.env ?? spawnEnv });
-        result = await runAutostartSelfHeal(getCollectorRuntimePaths(command.homeDir), {
-            homeDir: command.homeDir,
-            repoRoots: await resolveAutostartRoots(command.homeDir, undefined),
-            dashboardUrl: command.dashboardUrl,
-            exec,
-        });
-    }
-    catch (error) {
-        result = {
-            status: "fail",
-            reason: "autostart_self_heal_threw",
-            detail: redactedSyncErrorDetail(error),
-        };
-    }
-    // Steady state (healthy, absent, non-Windows, no roots) and the daily
-    // throttle are silent; an actual repair attempt reports either way.
-    if (!result || result.reason === "repair_throttled_recent_attempt")
-        return;
-    await reportAutostartSelfHealOutcome(command, io, dashboardUrl, result);
-}
-/** One receipt for the repair, whichever branch above produced the outcome. */
-async function reportAutostartSelfHealOutcome(command, io, dashboardUrl, result) {
-    await reportInstallEventsBestEffort({
-        homeDir: command.homeDir,
-        dashboardUrl,
-        command: "sync",
-        events: [
-            {
-                // Windows repairs in place and keeps the name already in the receipts
-                // and the runbook; the macOS path only SCHEDULES a detached repair, so
-                // it reports under its own step (BLI-3553).
-                step: result.step ?? "autostart_repair",
-                status: result.status,
-                ...(result.status === "ok" ? {} : { error_code: result.reason }),
-                ...(result.detail ? { error_detail: result.detail } : {}),
-            },
-        ],
-        json: command.json,
-        io,
-    });
-}
-/**
- * BLI-2601: the fleet keeps itself current on npm `latest` without anyone
- * re-running `npm i -g @bli-cockpit/cli` by hand after day 0. This always
- * runs AFTER `runSync` has already decided and reported collection's own
- * outcome above — a stuck or failing self-update can never block or delay
- * collection, and a collection failure never blocks the chance to
- * self-update. Every error path here is swallowed on purpose: a failure is
- * reported as its own named `update` receipt, never surfaced as a `sync`
- * failure or thrown from this function.
- */
-async function runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersion) {
-    let event;
-    try {
-        event = await runScheduledSelfUpdateForSync(command, io, minCliVersion);
-    }
-    catch (error) {
-        // The throttle/probe/install machinery below is defensive already; this
-        // is the last-resort net so an update crash truly cannot touch the sync
-        // result above.
-        event = {
-            step: "update",
-            status: "fail",
-            error_code: "self_update_threw",
-            error_detail: redactedSyncErrorDetail(error),
-        };
-    }
-    if (!event)
-        return;
-    await reportInstallEventsBestEffort({
-        homeDir: command.homeDir,
-        dashboardUrl,
-        command: "update",
-        events: [event],
-        json: command.json,
-        io,
-    });
-}
-async function runScheduledSelfUpdateForSync(command, io, minCliVersion) {
-    const rawExec = io.exec;
-    if (!rawExec) {
-        // Only the real production `defaultIo()` supplies a process runner. A
-        // caller that omitted one gets a silent no-op rather than this reaching
-        // for a real npm binary it was never given — never observed in
-        // production, where `defaultIo()` always sets `exec`.
-        return null;
-    }
-    // Every spawn in the scheduled path carries the running node's bin dir on
-    // PATH — see envWithNodeRuntimeOnPath. Interactive doctor never needed
-    // this; the scheduler's stripped environment does.
-    const spawnEnv = envWithNodeRuntimeOnPath(io.env ?? process.env);
-    const exec = (cmd, args, options) => rawExec(cmd, args, { ...options, env: options?.env ?? spawnEnv });
-    const scheduledIo = { ...io, exec };
-    const paths = getCollectorRuntimePaths(command.homeDir);
-    const result = await runScheduledSelfUpdate(paths, {
-        exec,
-        currentVersion: LOCAL_COLLECTOR_VERSION,
-        install: (tag) => attemptScheduledSelfUpdateInstall(scheduledIo, tag),
-    }, { env: io.env, minVersion: minCliVersion });
-    return scheduledSelfUpdateInstallEvent(result);
-}
-async function attemptScheduledSelfUpdateInstall(io, tag) {
-    try {
-        // Reuses the exact npm-install machinery `cockpit doctor`'s
-        // `fixCliLatest` uses (see doctor.ts:243-280) so there is one place that
-        // knows how to invoke `npm i -g` and classify EACCES. Unlike doctor,
-        // this call never re-execs — see runScheduledSelfUpdate's doc comment.
-        await runSelfUpdate(io, { json: true, tag });
-        return { ok: true };
-    }
-    catch (error) {
-        if (!(error instanceof SelfUpdateError))
-            throw error;
-        return { ok: false, eacces: error.eacces };
-    }
-}
-function scheduledSelfUpdateInstallEvent(result) {
-    // The steady-state "already checked today" case is a pure no-op; reporting
-    // it would post a receipt on ~95 of every 96 sync ticks for no new
-    // information. Only a real attempt (ok, fail, or an explicit disable)
-    // produces a receipt.
-    if (result.reason === "throttled_recent_attempt")
-        return null;
-    // A forced attempt names its trigger in the receipt either way, so the
-    // ledger can tell "converged on the daily cadence" from "the floor pulled
-    // this machine forward" (BLI-2678).
-    const forcedDetail = result.forced && result.min_version
-        ? `forced_min_version ${result.min_version}`
-        : null;
-    if (result.status === "ok") {
-        // BLI-3551: this used to be `update ok` with an empty detail unless the
-        // floor forced it. One machine posted that receipt daily for nine releases
-        // while sitting on 0.2.37, and nobody could tell "already current" from
-        // "installed something" from "npm answered nothing" — three different
-        // situations wearing one word. The success branch names itself now.
-        const okDetail = [
-            forcedDetail,
-            result.reason === "updated" && result.previous_version && result.installed_version
-                ? `installed ${result.previous_version}→${result.installed_version}`
-                : result.reason,
-            result.target_version ? `target ${result.target_version}` : null,
-        ]
-            .filter((part) => Boolean(part))
-            .join("; ");
-        return {
-            step: "update",
-            status: "ok",
-            ...(okDetail ? { error_detail: okDetail } : {}),
-        };
-    }
-    const detail = [
-        forcedDetail,
-        result.target_version ? `target ${result.target_version}` : null,
-        result.installed_version ? `installed ${result.installed_version}` : null,
-    ]
-        .filter((part) => Boolean(part))
-        .join("; ");
-    return {
-        step: "update",
-        status: result.status,
-        error_code: result.reason,
-        ...(detail ? { error_detail: detail } : {}),
-    };
-}
-async function runSyncWithHealthReceipt(command, io) {
-    const backfillLock = await inspectBackfillLock(getCollectorRuntimePaths(command.homeDir));
-    if (backfillLock.held) {
-        if (command.json) {
-            writeLine(io.stdout, JSON.stringify({
-                status: "live_sync_paused_during_backfill",
-                reason: "live sync paused during backfill",
-                held_since: backfillLock.held_since,
-                collection_complete: false,
-                upload_state: "not_uploaded",
-                retryable: true,
-            }, null, 2));
-        }
-        else {
-            writeLine(io.stdout, "Pausing normal sync while it catches up on old sessions.");
-        }
-        return {
-            exitCode: 0,
-            completion: {
-                step: "sync_complete",
-                status: "skipped",
-                error_code: "live_sync_paused_during_backfill",
-            },
-            heartbeat: {
-                status: "skipped",
-                reason: "live_sync_paused_during_backfill",
-            },
-        };
-    }
-    // Single-flight: a launchd timer and a manual sync must not interleave the
-    // cursor read-modify-write. A blocked invocation exits cleanly (B.4 §7).
-    const lock = await acquireSyncLock(getCollectorRuntimePaths(command.homeDir));
-    if (!lock.acquired) {
-        if (command.json) {
-            writeLine(io.stdout, JSON.stringify({
-                status: "sync_already_running",
-                reason: "another sync owns the collection lock",
-                held_since: lock.held_since,
-                collection_complete: false,
-                upload_state: "not_uploaded",
-                retryable: true,
-            }, null, 2));
-        }
-        else {
-            writeLine(io.stdout, "Tower sync already running; skipping this run.");
-        }
-        return {
-            exitCode: 0,
-            completion: {
-                step: "sync_complete",
-                status: "skipped",
-                error_code: "sync_already_running",
-            },
-            heartbeat: { status: "skipped", reason: "sync_already_running" },
-        };
-    }
-    try {
-        const { exitCode, failureReasons, failureRecords, notice, sessionsObserved, sessionsOutsideRoot, } = await runSyncLocked(command, io);
-        const counts = {
-            sessionsObserved,
-            sessionsOutsideRoot,
-        };
-        if (exitCode === 0) {
-            // BLI-3551: an `ok` tick can still have something to say. `nothing_in_root`
-            // is the receipt that separates "this machine is alive and its operator
-            // works outside the approved roots" from "this machine is dead", which
-            // until now looked identical from the dashboard.
-            return {
-                exitCode,
-                completion: {
-                    step: "sync_complete",
-                    status: "ok",
-                    ...(notice ? { error_detail: notice } : {}),
-                },
-                heartbeat: { status: "ok", reason: notice, ...counts },
-            };
-        }
-        // A sync that fails by exit code says exactly as much as one that throws.
-        // It used to say `sync_failed` and nothing else, so 100% of recorded
-        // failure rows carried a null detail and the real reason was reachable only
-        // by running `cockpit status` on the machine itself (BLI-2526).
-        const reasonText = failureReasons.join("; ");
-        // The bucket comes from the records the deciding branches wrote, not from
-        // this sentence (BLI-3551). The sentence is still the detail.
-        const errorCode = classifySyncFailureRecords(failureRecords);
-        return {
-            exitCode,
-            completion: {
-                step: "sync_complete",
-                status: "fail",
-                error_code: errorCode,
-                error_detail: redactedSyncErrorDetail(reasonText),
-            },
-            heartbeat: { status: "fail", reason: errorCode, ...counts },
-        };
-    }
-    finally {
-        await lock.handle.release();
-    }
-}
-/**
- * Turn a finished run into an exit code and the reasons behind it.
- *
- * One place, so a future return path cannot reintroduce a code with no reason.
- * The reasons come from the run itself — the code that decided `ok` is false is
- * the only code that knows why.
- */
-function syncResult(run) {
-    return {
-        exitCode: run.ok ? 0 : 1,
-        failureReasons: run.ok ? [] : run.failure_reasons,
-        failureRecords: run.ok ? [] : run.failure_records,
-        notice: run.notice,
-        sessionsObserved: run.sessions_observed,
-        sessionsOutsideRoot: run.sessions_outside_root,
-    };
-}
-/**
- * The sync runbook: resolve which roots to collect, dedup staged packs before
- * touching anything else, discover worktrees, sync them, then report — one of
- * three shapes depending on how many worktrees came back. The three shapes
- * share nothing but `dedup`, so each gets its own step function below rather
- * than one branchy body.
- */
-async function runSyncLocked(command, io) {
-    const collectionRoots = await resolveSyncCollectionRoots(command);
-    // Before anything is collected: collapse byte-identical staged packs. It runs
-    // first, unconditionally and unthrottled, because a machine that already
-    // holds 559 copies of one rollout needs the disk back before it stages
-    // anything else (BLI-3066). Safe by construction — a duplicate is identical
-    // by content hash to the survivor.
-    const dedup = await sweepDuplicateStagedRawEvidence(getCollectorRuntimePaths(command.homeDir), io.env);
-    if (!dedup.skipped && dedup.removed_dirs > 0) {
-        writeLine(io.stdout, rawEvidenceDedupSummary(dedup));
-    }
-    const worktrees = await discoverCommandWorktrees(collectionRoots, {
-        maxDepth: command.maxDepth,
-        maxRepos: command.maxRepos,
-        homeDir: command.homeDir,
-        allowEmpty: true,
-    }, io);
-    const run = await runAttributedWorktreeSync({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-        collectionRoots,
-        startContexts: false,
-        worktrees,
-        fetchImpl: io.fetch,
-    });
-    if (run.outcomes.length > 1) {
-        return reportMultiRepoSync(command, io, run, dedup);
-    }
-    // Zero worktrees is a legitimate steady state, not a failure: an approved
-    // root can hold no git repos, and sessions upload independently of
-    // worktrees (session-first, BLI-2581). This used to throw "Sync produced no
-    // result", which painted ~90 false-red sync_failed receipts per day on one
-    // fleet machine with a single empty root and taught people to ignore
-    // sync_failed (BLI-2722). A genuinely broken run still fails via run.ok.
-    if (run.outcomes.length === 0) {
-        return reportNoWorktreeSync(command, io, run, dedup);
-    }
-    return reportSingleRepoSync(command, io, run, dedup);
-}
-async function reportMultiRepoSync(command, io, run, dedup) {
-    const rows = run.outcomes.map((outcome) => worktreeSyncRow(outcome, run));
-    const collectionRunStatus = attributedSyncRunStatus(run);
-    const gc = run.ok ? await runSyncRawEvidenceGc(command, io) : null;
-    if (command.json) {
-        writeLine(io.stdout, JSON.stringify({
-            mode: "multi_repo",
-            status: collectionRunStatus,
-            collection_complete: run.ok,
-            results: run.outcomes.map((outcome) => outcome.sync),
-            repos: rows,
-            codex_sessions: run.summary,
-            raw_evidence_gc: gc,
-            raw_evidence_dedup: dedup,
-        }, null, 2));
-        return syncResult(run);
-    }
-    writeLine(run.ok ? io.stdout : io.stderr, `Tower parent sync ${collectionRunStatus} ${run.outcomes.filter((outcome) => outcome.sync.status === "uploaded").length}/${run.outcomes.length} worktree(s).`);
-    for (const outcome of run.outcomes) {
-        const { worktree, sync } = outcome;
-        const uploaded = sync.status === "uploaded";
-        const failureSuffix = sync.status === "spooled" ? ` reason:${sync.failure_reason}` : "";
-        writeLine(uploaded ? io.stdout : io.stderr, `- ${worktree.repo_label}/${worktree.worktree_label} (${worktree.branch}) head:${shortSha(sync.head_sha ?? worktree.head_sha)} ${sync.status} objects:${sync.raw_evidence_uploaded_object_count} chunks:${sync.raw_evidence_uploaded_chunk_count} reused:${sync.raw_evidence_reused_count} failed:${sync.raw_evidence_failed_count} cursor:${sync.cursor_tracked_object_count}${failureSuffix}`);
-    }
-    writeAgentSessionSummary(io, run.summary);
-    if (gc && !gc.skipped)
-        writeLine(io.stdout, rawEvidenceGcSummary(gc));
-    return syncResult(run);
-}
-async function reportNoWorktreeSync(command, io, run, dedup) {
-    const collectionRunStatus = attributedSyncRunStatus(run);
-    const gc = run.ok ? await runSyncRawEvidenceGc(command, io) : null;
-    if (command.json) {
-        writeLine(io.stdout, JSON.stringify({
-            mode: "no_worktrees",
-            status: collectionRunStatus,
-            collection_complete: run.ok,
-            ...(run.notice ? { notice: run.notice } : {}),
-            codex_sessions: run.summary,
-            raw_evidence_gc: gc,
-            raw_evidence_dedup: dedup,
-        }, null, 2));
-        return syncResult(run);
-    }
-    writeLine(run.ok ? io.stdout : io.stderr, `Tower sync ${collectionRunStatus}: no git worktrees under this root; session scan ran.`);
-    if (run.notice) {
-        // Says out loud what the receipt now says to the dashboard: the sessions
-        // this machine ran were all outside the folders it is allowed to look at.
-        writeLine(io.stdout, `Every session seen this run was outside your approved folders (${run.notice}). Nothing was collected, and nothing is broken.`);
-    }
-    writeAgentSessionSummary(io, run.summary);
-    if (gc && !gc.skipped)
-        writeLine(io.stdout, rawEvidenceGcSummary(gc));
-    return syncResult(run);
-}
-async function reportSingleRepoSync(command, io, run, dedup) {
-    const result = run.outcomes[0]?.sync;
-    if (!result) {
-        throw new Error("Sync produced no result for the repo worktree.");
-    }
-    const collectionRunStatus = attributedSyncRunStatus(run);
-    const gc = run.ok ? await runSyncRawEvidenceGc(command, io) : null;
-    if (command.json) {
-        writeLine(io.stdout, JSON.stringify({
-            ...result,
-            status: collectionRunStatus,
-            collection_complete: run.ok,
-            codex_sessions: run.summary,
-            raw_evidence_gc: gc,
-            raw_evidence_dedup: dedup,
-        }, null, 2));
-        return syncResult(run);
-    }
-    if (run.ok) {
-        writeLine(io.stdout, "Tower uploaded this session.");
-        writeLine(io.stdout, `Ticket: ${displayTicketId(result.ticket_id)}`);
-        writeLine(io.stdout, `Context: ${result.work_context_id}`);
-        writeLine(io.stdout, `Head: ${shortSha(result.head_sha)}`);
-        writeLine(io.stdout, `Things recorded: ${result.event_count}`);
-        writeLine(io.stdout, `Risk flags: ${result.risk_flag_count}`);
-        writeLine(io.stdout, `Raw evidence files: ${result.raw_evidence_file_count}`);
-        writeLine(io.stdout, rawEvidenceSyncLine(result));
-        writeAgentSessionSummary(io, run.summary);
-        writeLine(io.stdout, cursorStatusLine(result));
-        if (gc && !gc.skipped)
-            writeLine(io.stdout, rawEvidenceGcSummary(gc));
-        return syncResult(run);
-    }
-    if (result.status === "uploaded") {
-        writeLine(io.stderr, "Tower uploaded, but some sessions did not make it. Run `cockpit sync` again.");
-        writeAgentSessionSummary(io, run.summary);
-        return syncResult(run);
-    }
-    writeLine(io.stderr, "Tower could not upload. It saved a note to retry and will try again on the next sync.");
-    writeLine(io.stderr, `Ticket: ${displayTicketId(result.ticket_id)}`);
-    writeLine(io.stderr, `Failure: ${result.failure_reason}`);
-    writeLine(io.stderr, `Retry: ${result.retry_command}`);
-    return syncResult(run);
-}
-async function resolveSyncCollectionRoots(command) {
-    const explicitRoots = normalizeCollectionRoots(command.repoRoot ? [command.repoRoot] : []);
-    if (explicitRoots.length > 0) {
-        return collectionRootConsentAliases(explicitRoots);
-    }
-    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(command.homeDir)).catch(() => null);
-    const savedRoots = normalizeCollectionRoots(config?.default_repo_paths ?? []);
-    if (savedRoots.length > 0) {
-        return collectionRootConsentAliases(savedRoots);
-    }
-    throw new CollectionRootRequiredError(`no explicit or saved collection root is available.`);
-}
-async function runAnalyze(command, io) {
-    const syncStdout = [];
-    const syncStderr = [];
-    const syncIo = {
-        ...io,
-        stdout: bufferedWritable(syncStdout),
-        stderr: bufferedWritable(syncStderr),
-    };
-    const syncCommand = {
-        ...command,
-        kind: "sync",
-        json: true,
-    };
-    const syncExitCode = await runSync(syncCommand, syncIo);
-    const syncOutput = parseCapturedJson(syncStdout);
-    if (syncExitCode !== 0 || !isUploadedSyncResult(syncOutput)) {
-        if (command.json) {
-            writeLine(io.stdout, JSON.stringify({
-                status: syncExitCode === 0 ? "sync_not_completed" : "sync_failed",
-                sync: syncOutput,
-                error: syncStderr.join("").trim()
-                    || (syncExitCode === 0
-                        ? "Tower sync did not upload fresh evidence."
-                        : "Tower sync failed."),
-            }, null, 2));
-        }
-        else {
-            replayCaptured(io.stderr, syncStderr);
-            writeLine(io.stderr, syncExitCode === 0
-                ? "Analysis was not queued because a fresh upload did not complete."
-                : "Analysis was not queued because the latest upload failed.");
-        }
-        return syncExitCode === 0 ? 1 : syncExitCode;
-    }
-    const paths = getCollectorRuntimePaths(command.homeDir);
-    const session = await readLocalCollectorSessionFile(paths).catch((error) => {
-        // "Not signed in" is the right sentence for an absent session file and the
-        // wrong one for a corrupt one, which `cockpit login` will not repair
-        // (BLI-3238).
-        if (!isMissingFileFailure(error)) {
-            console.error("[cockpit-analyze] session file present but unreadable, reporting as not signed in", JSON.stringify({
-                reason: "session_file_unusable",
-                ...describeError(error),
-            }));
-        }
-        throw new Error("Tower is not signed in. Run `cockpit onboard` or `cockpit login` first.");
-    });
-    const dashboardUrl = normalizeUrl(command.dashboardUrl ?? session.dashboard_url ?? DEFAULT_DASHBOARD_URL);
-    const response = await io.fetch(`${dashboardUrl}/api/ambient/analyze`, {
-        method: "POST",
-        headers: {
-            authorization: `Bearer ${session.device_token}`,
-            "content-type": "application/json",
-        },
-        body: "{}",
-    });
-    const body = await readAnalyzeApiResponse(response);
-    if (!response.ok) {
-        const message = typeof body.message === "string"
-            ? body.message
-            : `Analysis request failed with HTTP ${response.status}.`;
-        if (command.json) {
-            writeLine(io.stdout, JSON.stringify({
-                status: "analyze_failed",
-                sync: syncOutput,
-                http_status: response.status,
-                code: typeof body.code === "string" ? body.code : null,
-                message,
-                retry_after_seconds: typeof body.retry_after_seconds === "number"
-                    ? body.retry_after_seconds
-                    : null,
-            }, null, 2));
-        }
-        else {
-            replayCaptured(io.stderr, syncStderr);
-            writeLine(io.stderr, `Analysis was not queued: ${message}`);
-        }
-        return 1;
-    }
-    const jobId = typeof body.job?.id === "string" ? body.job.id : null;
-    const jobStatus = typeof body.job?.status === "string" ? body.job.status : "pending";
-    if (command.json) {
-        writeLine(io.stdout, JSON.stringify({
-            status: "queued",
-            sync: syncOutput,
-            job: body.job ?? null,
-            dashboard_url: `${dashboardUrl}/my-work`,
-        }, null, 2));
-        return 0;
-    }
-    replayCaptured(io.stderr, syncStderr);
-    writeLine(io.stdout, "Tower uploaded your latest work.");
-    writeLine(io.stdout, "Tower analysis queued.");
-    if (jobId)
-        writeLine(io.stdout, `Job: ${jobId}`);
-    writeLine(io.stdout, `Status: ${jobStatus === "pending" ? "queued" : jobStatus}`);
-    writeLine(io.stdout, `Results: ${dashboardUrl}/my-work`);
-    return 0;
-}
-async function readAnalyzeApiResponse(response) {
-    const text = await response.text();
-    if (!text)
-        return {};
-    try {
-        const value = JSON.parse(text);
-        return value && typeof value === "object" ? value : {};
-    }
-    catch {
-        // `{}` erases whatever the analyze endpoint said, including its error, and
-        // the operator is left with a job id of `undefined` and no reason. The
-        // body is never logged; its shape is what identifies a proxy reply.
-        console.error("[cockpit-analyze] reply was not JSON", JSON.stringify({
-            reason: "response_body_not_json",
-            http_status: response.status,
-            byte_size: text.length,
-            content_type: response.headers.get("content-type") ?? "none",
-        }));
-        return {};
-    }
-}
-function isUploadedSyncResult(value) {
-    return Boolean(value
-        && typeof value === "object"
-        && !Array.isArray(value)
-        && value["status"] === "uploaded");
-}
-async function runSyncRawEvidenceGc(command, io) {
-    return runRawEvidenceLocalGc(getCollectorRuntimePaths(command.homeDir), io.env);
-}
-async function runServe(command, io) {
-    const server = createCollectorServer(command);
-    await new Promise((resolve) => {
-        server.listen(command.port, "127.0.0.1", resolve);
-    });
-    writeLine(io.stdout, `Tower collector serving on http://127.0.0.1:${command.port}`);
-    await new Promise((resolve) => {
-        server.on("close", resolve);
-    });
-    return 0;
-}
-async function runAutostart(command, io) {
-    if (command.action === "heal-detached") {
-        // BLI-3553: the internal one-shot the scheduled macOS tick spawns. It has
-        // its own receipt and its own exit code; nothing else in this function
-        // applies to it.
-        return runAutostartHealDetached({
-            homeDir: command.homeDir,
-            dashboardUrl: command.dashboardUrl,
-            parentPid: command.parentPid ?? null,
-            json: command.json,
-        }, io);
-    }
-    const exec = io.exec ?? defaultExec();
-    const repoRoots = command.action === "install" || command.action === "status"
-        ? await resolveAutostartRoots(command.homeDir, command.repoRoot)
-        : [];
-    const result = command.action === "install"
-        ? await installAutostartAgent({
-            homeDir: command.homeDir,
-            repoRoot: repoRoots[0],
-            repoRoots,
-            dashboardUrl: command.dashboardUrl,
-            intervalSeconds: command.intervalSeconds,
-            exec,
-        })
-        : command.action === "uninstall"
-            ? await uninstallAutostartAgent({ homeDir: command.homeDir, exec })
-            : await autostartStatus({
-                homeDir: command.homeDir,
-                repoRoot: repoRoots[0],
-                repoRoots,
-                dashboardUrl: command.dashboardUrl,
-                intervalSeconds: command.intervalSeconds,
-                exec,
-            });
-    if (command.json) {
-        writeLine(io.stdout, JSON.stringify(result, null, 2));
-        return autostartExitCode(command.action, result);
-    }
-    writeAutostartResult(io, result);
-    return autostartExitCode(command.action, result);
-}
-function autostartExitCode(action, result) {
-    if (result.status === "unsupported")
-        return 1;
-    if (action === "status")
-        return result.status === "loaded" ? 0 : 1;
-    if (action === "install" && result.loaded === false)
-        return 1;
-    if (action === "uninstall" && result.status === "not_loaded")
-        return 1;
-    return 0;
-}
-async function resolveAutostartRoots(homeDir, explicitRoot) {
-    if (explicitRoot)
-        return [explicitRoot];
-    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(homeDir)).catch(() => null);
-    return config?.default_repo_paths ?? [];
-}
-async function runAgentRules(command, io) {
-    const hosts = agentRuleHosts(command.host);
-    const scopePath = path.resolve(command.repoRoot ?? process.cwd());
-    const result = command.action === "install"
-        ? await installAgentRules({ homeDir: command.homeDir, hosts, scopePath })
-        : command.action === "uninstall"
-            ? await uninstallAgentRules({ homeDir: command.homeDir, hosts })
-            : await inspectAgentRules({ homeDir: command.homeDir, hosts, scopePath });
-    if (command.json) {
-        writeLine(io.stdout, JSON.stringify(result, null, 2));
-        return 0;
-    }
-    if ("installed" in result) {
-        writeLine(io.stdout, result.installed
-            ? "Tower agent rules are installed."
-            : "Tower agent rules are not installed.");
-    }
-    else {
-        writeLine(io.stdout, agentRulesStatusLine(result));
-    }
-    for (const target of result.targets) {
-        writeLine(io.stdout, `${agentRuleHostLabel(target.host)}: ${target.rules_file}`);
-    }
-    return 0;
-}
-function agentRuleHosts(host) {
-    return host === "all" ? ["codex", "claude"] : [host];
-}
-function agentRulesStatusLine(result) {
-    switch (result.status) {
-        case "created":
-            return "Tower agent rules installed.";
-        case "updated":
-            return "Tower agent rules updated.";
-        case "unchanged":
-            return "Tower agent rules already current.";
-        case "missing":
-            return "Tower agent rules were not installed.";
-    }
-}
-function agentRuleHostLabel(host) {
-    return host === "claude" ? "CLAUDE.md" : "AGENTS.md";
-}
-function writeAutostartResult(io, result) {
-    switch (result.status) {
-        case "installed":
-            writeLine(io.stdout, result.loaded
-                ? "Tower autostart installed and loaded."
-                : "Tower autostart installed (the operating-system scheduler reported a problem).");
-            writeLine(io.stdout, `Label: ${result.label}`);
-            writeLine(io.stdout, autostartLocationLine(result));
-            writeLine(io.stdout, `Interval: every ${result.interval_seconds}s`);
-            writeLine(io.stdout, `Repo: ${result.work_dir}`);
-            writeLine(io.stdout, `Dashboard: ${result.dashboard_url}`);
-            if (!result.loaded && result.message)
-                writeLine(io.stderr, result.message);
-            return;
-        case "uninstalled":
-            writeLine(io.stdout, "Tower autostart removed.");
-            writeLine(io.stdout, autostartLocationLine(result));
-            return;
-        case "absent":
-            writeLine(io.stdout, "Tower autostart is not installed.");
-            writeLine(io.stdout, autostartLocationLine(result));
-            return;
-        case "loaded":
-            writeLine(io.stdout, "Tower autostart is installed and loaded.");
-            writeLine(io.stdout, autostartLocationLine(result));
-            return;
-        case "not_loaded":
-            writeLine(io.stdout, "Tower autostart exists but is disabled or not loaded; run `cockpit autostart install` to repair it.");
-            writeLine(io.stdout, autostartLocationLine(result));
-            if (result.message)
-                writeLine(io.stderr, result.message);
-            return;
-        case "unsupported":
-            writeLine(io.stderr, `Autostart unsupported: ${result.message}`);
-            return;
-    }
-}
-function autostartLocationLine(result) {
-    return result.task_name
-        ? `Task: ${result.task_name}`
-        : `Plist: ${result.plist_path}`;
 }