@bli-cockpit/cli 0.2.48 → 0.2.50

package/dist/commands/onboard.js

@@ -0,0 +1,449 @@
+import { errorMessage, writeLine } from "./cli-io.js";
+import { agentRuleHostLabel } from "./agent-rules-command.js";
+import { autostartLocationLine } from "./autostart-command.js";
+import { backfillRetryCommand, runBackfill, } from "./backfill.js";
+import { attributedSyncRunStatus, shortSha, worktreeSyncRow, writeAgentSessionSummary, } from "./collection-report.js";
+import { collectionRootConsentAliases, persistOnboardingRootConfig, resolveOnboardingRootsForCommand, } from "./collection-roots.js";
+import { addInstallEvent, reportInstallEventsBestEffort } from "./install-receipts.js";
+import { canReuseOnboardSession, pairLocalCollectorWithAuthFallback, readOnboardSessionReuseCandidate, requestPairingAccessTokenDetailed, resolveOnboardEmail, } from "./local-auth.js";
+import { discoverCommandWorktrees } from "./local-discovery.js";
+import { addAutostartInstallEvent, addOnboardFailureEvent, classifyOnboardBlocker, onboardAutostartFailed, } from "./onboard-receipts.js";
+import { nextStepForOnboardBlocker, onboardAgentRulesInstallLine, onboardJsonPayload, reportOnboardMultiRepoResult, reportOnboardSyncBlocked, writeOnboardAutostartBlocker, writeOnboardBackfillBlockedResult, writeOnboardBanner, writeOnboardJson, writeOnboardLiveStatus, writeOnboardMultiRepoSyncBlocked, writeOnboardSingleRepoResultJson, writeOnboardUploadNarrative, writeOnboardWorkContextStarted, writePairingInstructions, } from "./onboard-report.js";
+import { runAttributedWorktreeSync, } from "./session-sync.js";
+import { installAgentRules } from "../agent-rules.js";
+import { installAutostartAgent } from "../autostart.js";
+import { inspectLocalCollectorStatus, logoutLocalCollector, startLocalWorkContext, } from "../local-state.js";
+/**
+ * The onboarding runbook: resolve roots, install, pair, discover worktrees,
+ * then hand off to whichever arm matches what was found — one repo runs the
+ * single-repo sync-then-backfill sequence (`runOnboardSingleRepoFlow`),
+ * several run the parent-folder one (`runOnboardMultiRepoFlow`). Any failure
+ * anywhere in either arm unwinds to the single catch below.
+ */
+export async function runOnboard(command, io) {
+    const installEvents = [];
+    let install = null;
+    let pair = null;
+    let rootsResult = null;
+    // `sync` has to survive a throw from inside either flow function, so it is
+    // mutated through this holder rather than returned — a return only happens
+    // on the success path, and the failure path needs the value too.
+    const syncHolder = {
+        current: null,
+    };
+    try {
+        if (!command.json)
+            writeOnboardBanner(command, io);
+        const roots = await prepareOnboardRoots(command, installEvents, io);
+        rootsResult = roots.rootsResult;
+        const claimedOwnerEmail = await resolveOnboardEmail(roots.resolvedCommand, roots.collectionRoots, roots.existingConfig, io);
+        install = await installOnboardConfig(command, roots.resolvedRoots, installEvents, io);
+        pair = await pairForOnboarding(command, { primaryRoot: roots.primaryRoot, claimedOwnerEmail }, installEvents, io);
+        const worktrees = await discoverCommandWorktrees(roots.collectionRoots, {
+            maxDepth: command.maxDepth,
+            maxRepos: command.maxRepos,
+            homeDir: command.homeDir,
+            allowEmpty: true,
+        }, io);
+        const ctx = {
+            command,
+            resolvedCommand: roots.resolvedCommand,
+            collectionRoots: roots.collectionRoots,
+            rootsResult: roots.rootsResult,
+            install,
+            pair,
+            installEvents,
+            io,
+            worktrees,
+        };
+        if (worktrees.length > 1) {
+            return await runOnboardMultiRepoFlow(ctx);
+        }
+        return await runOnboardSingleRepoFlow(ctx, {
+            attributionCollectionRoots: roots.attributionCollectionRoots,
+            primaryRoot: roots.primaryRoot,
+            syncHolder,
+        });
+    }
+    catch (error) {
+        return await handleOnboardFailure(error, command, rootsResult, install, pair, syncHolder.current, installEvents, io);
+    }
+}
+/** The parent-folder arm: sync every discovered worktree, then backfill and finish setup once. */
+async function runOnboardMultiRepoFlow(ctx) {
+    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
+    const multi = await runMultiRepoOnboard(resolvedCommand, io, worktrees);
+    addInstallEvent(installEvents, "work_context", "ok");
+    addInstallEvent(installEvents, "sync", multi.ok ? "ok" : "fail", multi.ok ? undefined : "sync_blocked");
+    if (!multi.ok) {
+        if (command.json)
+            writeOnboardMultiRepoSyncBlocked(ctx, multi);
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
+    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
+    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
+        ? undefined
+        : backfill.failureReason ?? "backfill_incomplete");
+    if (!completedBackfill) {
+        writeOnboardBackfillBlockedResult(io, {
+            json: command.json,
+            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, null, null, rootsResult),
+            extra: {
+                mode: "multi_repo",
+                repos: multi.results,
+                codex_sessions: multi.codex_sessions,
+            },
+            backfill,
+        });
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    const multiSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
+    reportOnboardMultiRepoResult(ctx, {
+        multi,
+        backfill: completedBackfill,
+        setup: multiSetup,
+    });
+    return finishOnboardRun(command, installEvents, io, multiSetup.ok ? 0 : 1);
+}
+/** The single-repo arm: start the work context, sync it, backfill, then finish setup once. */
+async function runOnboardSingleRepoFlow(ctx, single) {
+    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
+    const worktreeRoot = worktrees[0]?.repo_root ?? single.primaryRoot;
+    const context = await startLocalWorkContext({
+        homeDir: command.homeDir,
+        repoRoot: worktreeRoot,
+        branch: command.branch,
+        activeTicketId: command.activeTicketId,
+    });
+    if (!command.json)
+        writeOnboardWorkContextStarted(io, context);
+    addInstallEvent(installEvents, "work_context", "ok");
+    const run = await runAttributedWorktreeSync({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        collectionRoots: single.attributionCollectionRoots,
+        startContexts: false,
+        worktrees,
+        fetchImpl: io.fetch,
+    });
+    const sync = run.outcomes[0]?.sync ?? null;
+    single.syncHolder.current = sync;
+    if (!sync) {
+        throw new Error("Onboard sync produced no result for the repo worktree.");
+    }
+    const status = await inspectLocalCollectorStatus({
+        homeDir: command.homeDir,
+        repoRoot: worktreeRoot,
+        branch: command.branch,
+    });
+    if (!run.ok || sync.status !== "uploaded") {
+        addInstallEvent(installEvents, "sync", "fail", "sync_blocked");
+        reportOnboardSyncBlocked(ctx, { run, sync, status, worktreeRoot });
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    addInstallEvent(installEvents, "sync", "ok");
+    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
+    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
+    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
+        ? undefined
+        : backfill.failureReason ?? "backfill_incomplete");
+    if (!completedBackfill) {
+        writeOnboardBackfillBlockedResult(io, {
+            json: command.json,
+            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, sync, status, rootsResult),
+            extra: { codex_sessions: run.summary },
+            backfill,
+        });
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    if (command.json) {
+        const jsonSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
+        writeOnboardSingleRepoResultJson(ctx, {
+            run,
+            sync,
+            status,
+            backfill: completedBackfill,
+            setup: jsonSetup,
+        });
+        return finishOnboardRun(command, installEvents, io, jsonSetup.ok ? 0 : 1);
+    }
+    writeOnboardUploadNarrative(io, { command, run, sync, status });
+    const setup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
+    const { agentRules, autostart } = setup;
+    if (!setup.ok) {
+        writeOnboardAutostartBlocker(io, autostart);
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    writeLine(io.stdout, "PASS: Tower is set up and collecting.");
+    writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
+        pair,
+        status,
+        sync,
+        agentRules,
+        autostart,
+        initialSyncOk: true,
+        backfill: completedBackfill,
+    });
+    return finishOnboardRun(command, installEvents, io, 0);
+}
+/**
+ * Every uncaught error from either onboarding arm lands here. `status` is
+ * always recomputed fresh against whichever root got furthest, never trusted
+ * from before the throw — the arms already recompute it themselves on their
+ * own success paths, so nothing upstream is lost by not threading it through.
+ */
+async function handleOnboardFailure(error, command, rootsResult, install, pair, sync, installEvents, io) {
+    const message = errorMessage(error);
+    const statusRoot = rootsResult?.roots[0] ?? command.repoRoot;
+    const status = statusRoot
+        ? await inspectLocalCollectorStatus({
+            homeDir: command.homeDir,
+            repoRoot: statusRoot,
+            branch: command.branch,
+        }).catch(() => null)
+        : null;
+    const blocker = classifyOnboardBlocker(message);
+    addOnboardFailureEvent(installEvents, blocker);
+    const nextStep = nextStepForOnboardBlocker(blocker, command);
+    if (command.json) {
+        writeOnboardJson(io, onboardJsonPayload("blocked", command, install, pair, sync, status, rootsResult, {
+            blocker,
+            message,
+            next_step: nextStep,
+        }));
+    }
+    else {
+        writeLine(io.stderr, `BLOCKED: ${message}`);
+        writeLine(io.stderr, `Next: ${nextStep}`);
+    }
+    return finishOnboardRun(command, installEvents, io, 1);
+}
+/** Step 0: which folders are approved, and who claims to own this machine's uploads. */
+async function prepareOnboardRoots(command, installEvents, io) {
+    const resolvedRoots = await resolveOnboardingRootsForCommand(command, io);
+    const rootsResult = resolvedRoots.rootsResult;
+    const collectionRoots = rootsResult.roots;
+    const attributionCollectionRoots = await collectionRootConsentAliases(collectionRoots);
+    const primaryRoot = resolvedRoots.primaryRoot;
+    const resolvedCommand = {
+        ...command,
+        repoRoot: primaryRoot,
+        collectionRoots,
+    };
+    if (!command.json) {
+        writeLine(io.stdout, `Collecting from: ${collectionRoots.join(", ")}`);
+    }
+    if (rootsResult.homeRootOptIn) {
+        addInstallEvent(installEvents, "home_root_optin", "ok");
+    }
+    return {
+        resolvedRoots,
+        rootsResult,
+        collectionRoots,
+        attributionCollectionRoots,
+        primaryRoot,
+        existingConfig: resolvedRoots.existingConfig,
+        resolvedCommand,
+    };
+}
+/** Step 1: write the local config that makes this machine a known collector. */
+async function installOnboardConfig(command, resolvedRoots, installEvents, io) {
+    const install = await persistOnboardingRootConfig(command, resolvedRoots);
+    addInstallEvent(installEvents, "install", "ok");
+    if (!command.json) {
+        writeLine(io.stdout, "1/5 Installed local collector.");
+        writeLine(io.stdout, `Config: ${install.paths.config_file}`);
+    }
+    return install;
+}
+/**
+ * Step 2 of onboarding: reuse the device session when it already belongs to
+ * this owner on this dashboard, otherwise sign in and pair — logging the old
+ * session out first when it belongs to someone else.
+ *
+ * Returns null when an existing session was reused, which is why the caller's
+ * `pair` stays null and the readiness proof falls back to the status file.
+ */
+async function pairForOnboarding(command, input, installEvents, io) {
+    const installedStatus = await inspectLocalCollectorStatus({
+        homeDir: command.homeDir,
+        repoRoot: input.primaryRoot,
+        branch: command.branch,
+    });
+    const installedSession = await readOnboardSessionReuseCandidate(command.homeDir);
+    const canReuseInstalledSession = canReuseOnboardSession(installedSession, input.claimedOwnerEmail, command.dashboardUrl);
+    if (installedStatus.session_state === "valid" && canReuseInstalledSession) {
+        addInstallEvent(installEvents, "auth", "skipped", "existing_session");
+        addInstallEvent(installEvents, "pair", "skipped", "existing_session");
+        if (!command.json) {
+            writeLine(io.stdout, "2/5 Existing valid device session found; pairing skipped.");
+        }
+        return null;
+    }
+    if (installedStatus.session_state === "valid") {
+        await logoutLocalCollector({ homeDir: command.homeDir });
+        if (!command.json) {
+            writeLine(io.stdout, "2/5 Existing valid device session does not match requested owner or dashboard; pairing again.");
+        }
+    }
+    const authResult = await requestPairingAccessTokenDetailed({
+        dashboardUrl: command.dashboardUrl,
+        email: input.claimedOwnerEmail,
+        noAuth: command.noAuth,
+        json: command.json,
+    }, io);
+    addInstallEvent(installEvents, "auth", authResult.status, authResult.errorCode);
+    const pair = await pairLocalCollectorWithAuthFallback({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        claimedOwnerEmail: input.claimedOwnerEmail,
+        deviceName: command.deviceName,
+        pollIntervalMs: command.pollIntervalMs,
+        timeoutMs: command.timeoutMs,
+        pairingAccessToken: authResult.accessToken,
+        fetch: io.fetch,
+        onPairStarted: command.json
+            ? undefined
+            : (request) => writePairingInstructions(io, request),
+    }, io);
+    addInstallEvent(installEvents, "pair", "ok");
+    if (!command.json) {
+        writeLine(io.stdout, "2/5 Device paired.");
+        writeLine(io.stdout, `User: ${pair.session.email ?? pair.session.auth_subject_id}`);
+        writeLine(io.stdout, `Device: ${pair.session.device_name ?? pair.session.device_id ?? "unknown"}`);
+    }
+    return pair;
+}
+async function runMultiRepoOnboard(command, io, worktrees) {
+    if (!command.json) {
+        writeLine(io.stdout, `3/5 Parent folder mode: discovered ${worktrees.length} git worktree(s).`);
+    }
+    const collectionRoots = await collectionRootConsentAliases(command.collectionRoots ??
+        (command.repoRoot ? [command.repoRoot] : []));
+    const run = await runAttributedWorktreeSync({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        branch: command.branch,
+        activeTicketId: command.activeTicketId,
+        collectionRoots,
+        startContexts: true,
+        worktrees,
+        fetchImpl: io.fetch,
+    });
+    const results = run.outcomes.map((outcome) => worktreeSyncRow(outcome, run));
+    const collectionRunStatus = attributedSyncRunStatus(run);
+    if (!command.json) {
+        for (const [index, outcome] of run.outcomes.entries()) {
+            const row = results[index];
+            if (!row)
+                continue;
+            const uploaded = outcome.sync.status === "uploaded";
+            writeLine(uploaded ? io.stdout : io.stderr, `${uploaded ? "SYNCED" : "BLOCKED"} ${row["repo_label"]}/${row["worktree_label"]} (${row["branch"]}) head:${shortSha(outcome.sync.head_sha ?? outcome.worktree.head_sha)} ${outcome.sync.status} objects:${outcome.sync.raw_evidence_uploaded_object_count} chunks:${outcome.sync.raw_evidence_uploaded_chunk_count} reused:${outcome.sync.raw_evidence_reused_count} failed:${outcome.sync.raw_evidence_failed_count} sessions:${row["attributed_session_count"]}${row["failure_reason"] ? ` reason:${row["failure_reason"]}` : ""}`);
+        }
+        writeLine(io.stdout, "4/5 Parent worktree sync complete.");
+        writeLine(io.stdout, `Uploaded: ${results.filter((row) => row["upload_status"] === "uploaded").length}/${results.length}`);
+        writeAgentSessionSummary(io, run.summary);
+        if (run.ok) {
+            writeLine(io.stdout, "Live sync receipts complete; verifying all-history Codex and Claude backfill.");
+        }
+        else {
+            writeLine(io.stderr, `BLOCKED: Tower collection is ${collectionRunStatus}; retry until every eligible session has a durable receipt or explicit terminal reason.`);
+        }
+        writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
+    }
+    return { ok: run.ok, results, codex_sessions: run.summary };
+}
+function requiredOnboardBackfillCommand(command) {
+    return {
+        homeDir: command.homeDir,
+        all: true,
+        dryRun: false,
+        maxDepth: command.maxDepth,
+        maxRepos: command.maxRepos,
+        yes: true,
+        json: true,
+    };
+}
+async function runRequiredOnboardBackfill(command, io) {
+    const backfillCommand = requiredOnboardBackfillCommand(command);
+    const retryCommand = backfillRetryCommand(backfillCommand);
+    try {
+        const result = await runBackfill(backfillCommand, io);
+        return {
+            status: result.status,
+            failureReason: result.status === "complete"
+                ? null
+                : result.failure_reason ?? `backfill_${result.status}`,
+            retryCommand: result.retry_command,
+            result,
+        };
+    }
+    catch (error) {
+        return {
+            status: "failed",
+            failureReason: errorMessage(error),
+            retryCommand,
+            result: null,
+        };
+    }
+}
+async function completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io) {
+    const agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
+    addInstallEvent(installEvents, "agent_rules", "ok");
+    const autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
+    addAutostartInstallEvent(installEvents, autostart);
+    return { agentRules, autostart, ok: !onboardAutostartFailed(autostart) };
+}
+async function refreshOnboardAgentRules(command, roots, io) {
+    const result = await installAgentRules({
+        homeDir: command.homeDir,
+        scopePaths: roots,
+    });
+    if (command.json)
+        return result;
+    writeLine(io.stdout, `Agent rules: ${onboardAgentRulesInstallLine(result)}`);
+    for (const target of result.targets) {
+        writeLine(io.stdout, `${agentRuleHostLabel(target.host)}: ${target.rules_file}`);
+    }
+    return result;
+}
+/** Refreshes the host autostart backend after successful onboarding. */
+async function refreshOnboardAutostart(command, roots, io) {
+    if (!io.exec)
+        return null;
+    const result = await installAutostartAgent({
+        homeDir: command.homeDir,
+        repoRoot: roots[0],
+        repoRoots: roots,
+        dashboardUrl: command.dashboardUrl,
+        exec: io.exec,
+    });
+    if (command.json)
+        return result;
+    if (result.status === "unsupported") {
+        writeLine(io.stdout, `Background autostart unsupported: ${result.message}`);
+        return result;
+    }
+    writeLine(io.stdout, result.loaded
+        ? "Background autostart refreshed; Tower syncs at login and every 15 min."
+        : "Background autostart refreshed, but the operating-system scheduler reported a problem; check `cockpit autostart status`.");
+    writeLine(io.stdout, autostartLocationLine(result));
+    return result;
+}
+/**
+ * Every onboard exit funnels through here so the best-effort install-event
+ * report always fires, pass or blocked — replaces a `finish` closure that used
+ * to live inside `runOnboard` so the flow functions below can call it too.
+ */
+async function finishOnboardRun(command, installEvents, io, code) {
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        command: "onboard",
+        events: installEvents,
+        json: command.json,
+        io,
+    });
+    return code;
+}

package/dist/commands/ops-render.js

@@ -82,6 +82,8 @@ export function renderOpsStatus(payload, dim) {
     }
     if (payload.fleet)
         lines.push(...renderFleet(payload.fleet, dim));
+    if (payload.coverage)
+        lines.push(...renderCoverage(payload.coverage, dim));
     const slack = payload.skips?.slack;
     const external = payload.skips?.external;
     if (slack || external) {
@@ -122,6 +124,40 @@ export function renderFleet(fleet, dim) {
         lines.push(dim(`  ${fleet.noDeviceLine}`));
     return lines;
 }
+/**
+ * Did the sessions arrive? RED first, then AMBER, then everybody else dimmed.
+ *
+ * The two days sit under a person only when something is wrong with them: on a
+ * clean fleet this is one summary line and a dimmed name per person, because
+ * eighteen day-lines nobody reads is how a section gets scrolled past.
+ */
+export function renderCoverage(coverage, dim) {
+    const lines = ["", `COVERAGE  ${coverage.summary ?? "(no summary)"}`];
+    if (coverage.readError) {
+        lines.push(`  coverage could not be read (${coverage.readError}); nothing is known about whether anybody's sessions arrived`);
+        return lines;
+    }
+    const people = coverage.people ?? [];
+    if (people.length === 0) {
+        lines.push(dim("  nobody on the roster has collection coverage to check"));
+        return lines;
+    }
+    const rank = (colour) => colour === "red" ? 0 : colour === "amber" ? 1 : colour === "unknown" ? 2 : 3;
+    for (const person of [...people].sort((left, right) => rank(left.colour) - rank(right.colour))) {
+        const text = `  ${person.line ?? person.displayName ?? "(person)"}`;
+        const loud = person.colour === "red" || person.colour === "amber";
+        // A healthy person is dimmed, never dropped: "whose collection IS complete"
+        // is the other half of the question.
+        lines.push(loud ? text : dim(text));
+        if (!loud)
+            continue;
+        for (const day of person.days ?? []) {
+            if (day.line)
+                lines.push(dim(`      ${day.line}`));
+        }
+    }
+    return lines;
+}
 function renderSkipLedger(ledger, dim) {
     const lines = [];
     const name = ledger.relation ?? "skips";

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.48");
+    writeLine(io?.stdout ?? process.stdout, "0.2.50");
     return 0;
   }
 

package/dist/commands/serve.js

@@ -0,0 +1,13 @@
+import { writeLine } from "./cli-io.js";
+import { createCollectorServer } from "../server.js";
+export async function runServe(command, io) {
+    const server = createCollectorServer(command);
+    await new Promise((resolve) => {
+        server.listen(command.port, "127.0.0.1", resolve);
+    });
+    writeLine(io.stdout, `Tower collector serving on http://127.0.0.1:${command.port}`);
+    await new Promise((resolve) => {
+        server.on("close", resolve);
+    });
+    return 0;
+}