@bli-cockpit/cli 0.2.47 → 0.2.49

package/dist/commands/login.js

@@ -0,0 +1,53 @@
+import { writeLine } from "./cli-io.js";
+import { pairLocalCollectorWithAuthFallback, requestPairingAccessToken, resolveInteractiveLoginEmail, } from "./local-auth.js";
+import { ensureLocalCollectorConfig } from "../local-state.js";
+export async function runLogin(command, io) {
+    // Standalone `cockpit login` must work on a fresh machine: bootstrap a
+    // minimal rootless config when onboard/install has not run yet, instead of
+    // failing on the missing config file.
+    const { config, paths, created } = await ensureLocalCollectorConfig({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+    });
+    const dashboardUrl = command.dashboardUrl ?? config.dashboard_url;
+    if (created && !command.json) {
+        writeLine(io.stdout, `First login on this machine; wrote collector config: ${paths.config_file}`);
+    }
+    const claimedOwnerEmail = await resolveInteractiveLoginEmail(command, io);
+    const pairingAccessToken = await requestPairingAccessToken({
+        dashboardUrl,
+        email: claimedOwnerEmail,
+        noAuth: command.noAuth,
+        json: command.json,
+    }, io);
+    const result = await pairLocalCollectorWithAuthFallback({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        claimedOwnerEmail,
+        deviceName: command.deviceName,
+        pollIntervalMs: command.pollIntervalMs,
+        timeoutMs: command.timeoutMs,
+        pairingAccessToken,
+        fetch: io.fetch,
+        onPairStarted: command.json
+            ? undefined
+            : (request) => {
+                writeLine(io.stdout, "Tower device pairing started.");
+                writeLine(io.stdout, `Open: ${request.approve_url}`);
+                writeLine(io.stdout, `Code: ${request.user_code}`);
+                writeLine(io.stdout, "Waiting for dashboard approval...");
+            },
+    }, io);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(result, null, 2));
+        return 0;
+    }
+    writeLine(io.stdout, "Tower collector paired.");
+    writeLine(io.stdout, `Session: ${result.session_file}`);
+    writeLine(io.stdout, `User: ${result.session.email ?? result.session.auth_subject_id}`);
+    writeLine(io.stdout, `Device: ${result.session.device_name ?? result.session.device_id ?? "unknown"}`);
+    writeLine(io.stdout, config.default_repo_paths.length > 0
+        ? "Next: run `cockpit start` inside the repo."
+        : "Next: run `cockpit onboard` from your repo root so Tower knows which repos to collect.");
+    return 0;
+}

package/dist/commands/logout.js

@@ -0,0 +1,66 @@
+import { errorMessage, writeLine } from "./cli-io.js";
+import { asRecord, callTower, openTower } from "./tower-command.js";
+import { getCollectorRuntimePaths, logoutLocalCollector, readLocalCollectorSessionFile, } from "../local-state.js";
+/**
+ * `cockpit logout` removes the local session file. `--revoke` also tells Tower
+ * to end the device's token (BLI-3461).
+ *
+ * Those are two different facts, and the difference matters when a laptop is
+ * being handed back: without the revoke the machine stops collecting but the
+ * token it held is still one the server would honour. The revoke is attempted
+ * FIRST, because it needs the token the local logout is about to delete, and a
+ * revoke that fails does not stop the local logout — the person asked to be
+ * signed out of this machine, and they get that either way. The outcome of each
+ * half is reported separately rather than folded into one "ok".
+ */
+export async function runLogout(command, io) {
+    const revoke = command.revoke ? await revokeThisDevice(command, io) : null;
+    const result = await logoutLocalCollector({ homeDir: command.homeDir });
+    writeLine(io.stderr, `[logout] done ${JSON.stringify({
+        local_session: result.removed ? "removed" : "absent",
+        revoke: revoke ? revoke.outcome : "not_requested",
+    })}`);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ...result, revoke: revoke ?? { outcome: "not_requested" } }, null, 2));
+        return revoke && revoke.outcome !== "revoked" ? 1 : 0;
+    }
+    writeLine(io.stdout, result.removed
+        ? "Tower collector session removed."
+        : "No Tower collector session found.");
+    if (revoke) {
+        writeLine(io.stdout, revoke.outcome === "revoked"
+            ? "This device's Tower token is revoked."
+            : `This device's Tower token was NOT revoked: ${revoke.detail}`);
+    }
+    return revoke && revoke.outcome !== "revoked" ? 1 : 0;
+}
+/**
+ * Ends this device's own session server-side.
+ *
+ * The route gates the device arm on `self_revoke_only`, so the device id is
+ * read from the paired session rather than accepted as an argument — there is
+ * no way to spell "revoke somebody else's laptop" here, and that is deliberate.
+ */
+async function revokeThisDevice(command, io) {
+    let tower;
+    let deviceId;
+    try {
+        const session = await readLocalCollectorSessionFile(getCollectorRuntimePaths(command.homeDir));
+        deviceId = session.device_id;
+        tower = await openTower("logout", command, io);
+    }
+    catch (error) {
+        return { outcome: "no_paired_session", detail: errorMessage(error) };
+    }
+    const result = await callTower(tower, {
+        path: `/api/ambient/devices/${encodeURIComponent(deviceId)}/revoke`,
+        method: "POST",
+        label: "logout revoke",
+        body: { reason: "Signed out from the device" },
+    });
+    if (!result.ok) {
+        return { outcome: result.reason, detail: result.detail };
+    }
+    const body = asRecord(result.body);
+    return { outcome: "revoked", detail: String(asRecord(body.device).revoked_at ?? "") };
+}

package/dist/commands/onboard-receipts.js

@@ -0,0 +1,66 @@
+/**
+ * What onboarding records about itself: one install-event step per thing it
+ * did, and the blocker label a failure earns.
+ *
+ * Split out of commands/onboard.ts (BLI-3578), moved verbatim. It is the same
+ * ledger `./install-receipts.ts` posts for every command — this module only
+ * decides which step a given onboarding outcome belongs to, so the runbook next
+ * door never has to.
+ */
+import { addInstallEvent } from "./install-receipts.js";
+import { COLLECTION_ROOT_REQUIRED } from "../onboarding-roots.js";
+export function addOnboardFailureEvent(events, blocker) {
+    const step = onboardFailureStep(blocker, events);
+    const existing = events.find((event) => event.step === step && event.status === "fail");
+    if (existing)
+        return;
+    addInstallEvent(events, step, "fail", blocker);
+}
+function onboardFailureStep(blocker, events) {
+    if (blocker === COLLECTION_ROOT_REQUIRED)
+        return "install";
+    if (blocker === "device_pairing")
+        return "pair";
+    if (blocker === "work_context" || blocker === "ticket_binding" || blocker === "ticket") {
+        return "work_context";
+    }
+    if (blocker === "network_or_ingest")
+        return "sync";
+    if (blocker === "install")
+        return "install";
+    const lastIncomplete = ["install", "auth", "pair", "work_context", "sync"].find((step) => !events.some((event) => event.step === step));
+    return lastIncomplete ?? "sync";
+}
+export function addAutostartInstallEvent(events, result) {
+    if (!result) {
+        addInstallEvent(events, "autostart", "skipped", "runner_unavailable");
+        return;
+    }
+    if (result.status === "unsupported") {
+        addInstallEvent(events, "autostart", "skipped", "unsupported", result.message);
+        return;
+    }
+    addInstallEvent(events, "autostart", result.loaded === false ? "fail" : "ok", result.loaded === false ? "autostart_load_failed" : undefined, result.loaded === false ? result.message : undefined);
+}
+export function onboardAutostartFailed(result) {
+    return (result !== null &&
+        result.status !== "unsupported" &&
+        result.loaded === false);
+}
+export function classifyOnboardBlocker(message) {
+    if (message.includes(COLLECTION_ROOT_REQUIRED))
+        return COLLECTION_ROOT_REQUIRED;
+    if (/ticket/i.test(message))
+        return "ticket";
+    if (/pair|paired|approval|expired|revoked/i.test(message))
+        return "device_pairing";
+    if (/fetch|network|ENOTFOUND|ECONNREFUSED|HTTP/i.test(message))
+        return "network_or_ingest";
+    if (/config|install/i.test(message))
+        return "install";
+    if (/context|start/i.test(message))
+        return "work_context";
+    if (/bound|binding/i.test(message))
+        return "ticket_binding";
+    return "unknown";
+}

package/dist/commands/onboard-report.js

@@ -0,0 +1,274 @@
+import { writeLine } from "./cli-io.js";
+import { attributedSyncRunStatus, displayTicketId, rawEvidenceSyncLine, writeAgentSessionSummary, } from "./collection-report.js";
+import { COLLECTION_ROOT_REQUIRED, missingCollectionRootMessage, } from "../onboarding-roots.js";
+export function writeOnboardBanner(command, io) {
+    writeLine(io.stdout, "Setting up Tower");
+    writeLine(io.stdout, `Dashboard: ${command.dashboardUrl}`);
+    writeLine(io.stdout, `Ticket: ${displayTicketId(command.activeTicketId)}`);
+}
+export function writePairingInstructions(io, request) {
+    writeLine(io.stdout, "2/5 Device pairing started.");
+    writeLine(io.stdout, `Open: ${request.approve_url}`);
+    writeLine(io.stdout, `Code: ${request.user_code}`);
+    writeLine(io.stdout, "Waiting for dashboard approval...");
+}
+export function writeOnboardLiveStatus(io, command, roots, options) {
+    writeLine(io.stdout, "You're live.");
+    writeLine(io.stdout, "Collecting from:");
+    for (const root of roots)
+        writeLine(io.stdout, `- ${root}`);
+    writeLine(io.stdout, `Paired user: ${options.pair?.session.email ??
+        options.pair?.session.auth_subject_id ??
+        (options.status?.session_state === "valid" ? "existing valid session" : "pending")}`);
+    writeLine(io.stdout, `Background sync: ${backgroundSyncLine(options.autostart)}`);
+    writeLine(io.stdout, `Initial sync: ${options.initialSyncOk ? options.sync?.status ?? "uploaded" : "blocked"}`);
+    writeLine(io.stdout, `Historical backfill: complete (${options.backfill.counts.backfilled} uploaded, ${options.backfill.counts.skipped} explicit skip(s))`);
+    writeLine(io.stdout, `Agent rules: ${options.agentRules ? onboardAgentRulesInstallLine(options.agentRules) : "not refreshed"}`);
+    writeLine(io.stdout, `Dashboard: ${command.dashboardUrl}/my-work`);
+    writeLine(io.stdout, "Next: cockpit status");
+}
+function backgroundSyncLine(result) {
+    if (!result)
+        return "not refreshed (autostart runner unavailable)";
+    if (result.status === "unsupported")
+        return `unsupported (${result.message})`;
+    if (result.status === "installed" && result.loaded)
+        return "installed";
+    if (result.status === "installed") {
+        return `installed with warning (${result.message ?? "operating-system scheduler load failed"})`;
+    }
+    return result.status;
+}
+export function onboardAgentRulesInstallLine(result) {
+    if (result.targets.some((target) => target.stale_block_replaced)) {
+        return "updated; replaced stale Tower ticket-binding guidance.";
+    }
+    switch (result.status) {
+        case "created":
+            return "installed.";
+        case "updated":
+            return "updated.";
+        case "unchanged":
+            return "already current.";
+        case "missing":
+            return "not installed.";
+    }
+}
+export function writeOnboardAutostartBlocker(io, result) {
+    writeLine(io.stderr, "BLOCKED: initial collection succeeded, but recurring background collection is not running.");
+    if (result?.message)
+        writeLine(io.stderr, `Failure: ${result.message}`);
+    writeLine(io.stderr, "Next: run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.");
+}
+/**
+ * The blocked-backfill result, identical in both onboarding arms. `extra`
+ * carries the arm-specific keys and is spread where those keys appeared before,
+ * so the `--json` key order is unchanged.
+ */
+export function writeOnboardBackfillBlockedResult(io, options) {
+    if (!options.json) {
+        writeOnboardBackfillBlocker(io, options.backfill);
+        return;
+    }
+    writeLine(io.stdout, JSON.stringify({
+        ...options.base,
+        ...options.extra,
+        backfill: onboardBackfillPayload(options.backfill),
+        blocker: "backfill_incomplete",
+        backfill_failure_reason: options.backfill.failureReason,
+        next_step: options.backfill.retryCommand,
+    }, null, 2));
+}
+function writeOnboardBackfillBlocker(io, outcome) {
+    writeLine(io.stderr, "BLOCKED: all-history Codex and Claude backfill is incomplete for the approved collection roots.");
+    writeLine(io.stderr, `Failure: ${outcome.failureReason ?? `backfill_${outcome.status}`}`);
+    writeLine(io.stderr, `Retry: ${outcome.retryCommand}`);
+}
+function onboardBackfillPayload(outcome) {
+    return (outcome.result ?? {
+        status: "blocked",
+        failure_reason: outcome.failureReason,
+        retry_command: outcome.retryCommand,
+    });
+}
+/**
+ * Every onboard `--json` payload is `onboardResult` plus the roots this pass
+ * resolved plus whatever extra keys that arm of onboarding adds. Assembling it
+ * here means the call sites below cannot drift on key order or forget a field
+ * a sibling call site remembers.
+ */
+export function onboardJsonPayload(resultStatus, command, install, pair, sync, status, rootsResult, extra = {}) {
+    return {
+        ...onboardResult(resultStatus, command, install, pair, sync, status),
+        collection_roots: rootsResult?.roots ?? [],
+        root_resolution: rootsResult,
+        ...extra,
+    };
+}
+export function writeOnboardJson(io, payload) {
+    writeLine(io.stdout, JSON.stringify(payload, null, 2));
+}
+function onboardResult(resultStatus, command, install, pair, sync, status) {
+    return {
+        status: resultStatus,
+        dashboard_url: command.dashboardUrl,
+        ticket_id: sync?.ticket_id ?? command.activeTicketId ?? null,
+        work_context_id: sync?.work_context_id ?? status?.work_context_id ?? null,
+        config_file: install?.paths.config_file ?? status?.config_file ?? null,
+        session_file: install?.paths.session_file ?? status?.session_file ?? null,
+        collection_roots: command.collectionRoots ?? (command.repoRoot ? [command.repoRoot] : []),
+        paired_user: pair?.session.email ?? pair?.session.auth_subject_id ?? null,
+        paired_device: pair?.session.device_name ?? pair?.session.device_id ?? null,
+        upload_status: sync?.status ?? null,
+        upload_state: status?.upload_state ?? null,
+        event_count: sync?.event_count ?? null,
+        source_scan_count: sync?.source_scan_count ?? null,
+        risk_flag_count: sync?.risk_flag_count ?? null,
+        pending_upload_count: status?.pending_upload_count ?? null,
+        last_upload_success_at: status?.last_upload_success_at ?? null,
+        next_dashboard_path: `${command.dashboardUrl}/my-work`,
+    };
+}
+export function nextStepForOnboardBlocker(blocker, options = {}) {
+    switch (blocker) {
+        case COLLECTION_ROOT_REQUIRED:
+            return missingCollectionRootMessage(options);
+        case "ticket":
+        case "ticket_binding":
+            return "Run `cockpit start --ticket <id>` when actual ticket work begins, then run `cockpit sync`.";
+        case "device_pairing":
+            return "Ask Edward to approve this machine in the dashboard under Ambient -> Collector approvals, then run `cockpit onboard` again.";
+        case "network_or_ingest":
+            return "Check dashboard URL/network, then run `cockpit sync --json` or rerun `cockpit onboard`.";
+        case "install":
+            return "Rerun `cockpit onboard` from the repo root; it will reinstall local config.";
+        case "work_context":
+            return "Run `cockpit start --ticket <id> --workspace \"$PWD\"`, then retry `cockpit sync`.";
+        default:
+            return "Run `cockpit status --json` and report the blocker label plus last failure reason.";
+    }
+}
+/** Step 3 of a single-repo onboard: the work context this machine just bound. */
+export function writeOnboardWorkContextStarted(io, context) {
+    writeLine(io.stdout, "3/5 Work context active.");
+    writeLine(io.stdout, `Repo: ${context.repo}`);
+    writeLine(io.stdout, `Branch: ${context.branch}`);
+    writeLine(io.stdout, `Ticket: ${displayTicketId(context.active_ticket_id)}`);
+    writeLine(io.stdout, `Context: ${context.work_context_id}`);
+}
+/**
+ * The single-repo arm's blocked-collection result. The retry command is the
+ * spooled run's own when there is one, because that one names the pack to send.
+ */
+export function reportOnboardSyncBlocked(ctx, outcome) {
+    const { command, resolvedCommand, install, pair, rootsResult, io } = ctx;
+    const { run, sync, status, worktreeRoot } = outcome;
+    const collectionRunStatus = attributedSyncRunStatus(run);
+    if (command.json) {
+        writeOnboardJson(io, onboardJsonPayload("blocked", resolvedCommand, install, pair, sync, status, rootsResult, {
+            codex_sessions: run.summary,
+            collection_status: collectionRunStatus,
+        }));
+    }
+    else {
+        const syncFailureReason = sync.status === "spooled" ? sync.failure_reason : null;
+        const retryCommand = sync.status === "spooled"
+            ? sync.retry_command
+            : `cockpit sync --workspace ${JSON.stringify(worktreeRoot)}`;
+        writeLine(io.stderr, "BLOCKED: initial collection is incomplete; retry until every eligible session has a durable receipt or explicit terminal reason.");
+        writeLine(io.stderr, `Failure: ${syncFailureReason ?? (run.summary.report_posted ? collectionRunStatus : run.summary.report_reason)}`);
+        writeAgentSessionSummary(io, run.summary);
+        writeLine(io.stderr, `Retry: ${retryCommand}`);
+    }
+}
+/** Steps 4 and 5 of a single-repo onboard: what was uploaded, and where to read it. */
+export function writeOnboardUploadNarrative(io, uploaded) {
+    const { command, run, sync, status } = uploaded;
+    writeLine(io.stdout, "4/5 Uploaded what you worked on.");
+    writeLine(io.stdout, `HTTP: ${sync.http_status}`);
+    writeLine(io.stdout, `Things recorded: ${sync.event_count}`);
+    writeLine(io.stdout, `Sources: ${sync.source_scan_count}`);
+    writeLine(io.stdout, `Risk flags: ${sync.risk_flag_count}`);
+    writeLine(io.stdout, `Raw evidence files: ${sync.raw_evidence_file_count}`);
+    writeLine(io.stdout, rawEvidenceSyncLine(sync));
+    writeAgentSessionSummary(io, run.summary);
+    writeLine(io.stdout, "5/5 Status ready.");
+    writeLine(io.stdout, `Upload state: ${status.upload_state}`);
+    writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
+}
+/**
+ * The single-repo arm's `--json` result. A scheduler that could not load
+ * recurring collection is the one thing that turns a finished setup into a
+ * blocked one, and it says so by name.
+ */
+export function writeOnboardSingleRepoResultJson(ctx, finished) {
+    const { resolvedCommand, install, pair, rootsResult, io } = ctx;
+    const { run, sync, status, backfill, setup } = finished;
+    const { agentRules, autostart } = setup;
+    const onboardOk = setup.ok;
+    writeOnboardJson(io, onboardJsonPayload(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, sync, status, rootsResult, {
+        agent_rules: agentRules,
+        autostart,
+        backfill,
+        codex_sessions: run.summary,
+        ...(!onboardOk
+            ? {
+                blocker: "autostart_load_failed",
+                next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
+            }
+            : {}),
+    }));
+}
+/** The parent-folder arm's blocked-collection result; `--json` only, as it always was. */
+export function writeOnboardMultiRepoSyncBlocked(ctx, multi) {
+    const { resolvedCommand, install, pair, rootsResult, io } = ctx;
+    writeOnboardJson(io, onboardJsonPayload("blocked", resolvedCommand, install, pair, null, null, rootsResult, {
+        mode: "multi_repo",
+        repos: multi.results,
+        codex_sessions: multi.codex_sessions,
+        blocker: "sync_blocked",
+        next_step: "Run `cockpit sync --json` until every root returns an uploaded receipt.",
+    }));
+}
+/**
+ * The parent-folder arm's finished result, in whichever of the three shapes
+ * applies: the `--json` payload, the live-status page, or the autostart blocker
+ * when a supported scheduler refused the registration.
+ */
+export function reportOnboardMultiRepoResult(ctx, finished) {
+    const { command, resolvedCommand, collectionRoots, install, pair, rootsResult, io } = ctx;
+    const { multi, backfill, setup } = finished;
+    const { agentRules, autostart } = setup;
+    const onboardOk = setup.ok;
+    if (command.json) {
+        writeOnboardJson(io, onboardJsonPayload(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, null, null, rootsResult, {
+            agent_rules: agentRules,
+            autostart,
+            backfill,
+            mode: "multi_repo",
+            repos: multi.results,
+            codex_sessions: multi.codex_sessions,
+            ...(!onboardOk && multi.ok
+                ? {
+                    blocker: "autostart_load_failed",
+                    next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
+                }
+                : {}),
+        }));
+    }
+    if (onboardOk && !command.json) {
+        writeLine(io.stdout, "PASS: Tower is set up and collecting.");
+        writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
+            pair,
+            status: null,
+            sync: null,
+            agentRules,
+            autostart,
+            initialSyncOk: true,
+            backfill,
+        });
+    }
+    else if (multi.ok && !command.json) {
+        writeOnboardAutostartBlocker(io, autostart);
+    }
+}