@bli-cockpit/cli 0.2.48 → 0.2.50

package/dist/commands/settings-render.js

@@ -139,4 +139,32 @@ export function renderEnvBlobs(body) {
         return [`${INDENT}no env files stored`];
     return blobs.map((blob) => `${INDENT}${padEndDisplay(text(blob.project), 12)} ${padEndDisplay(text(blob.file_name), 16)} ` +
         `updated ${text(blob.updated_at)}  id ${text(blob.id)}`);
+}
+/**
+ * The fleet forced-update floor (BLI-3557).
+ *
+ * Four different answers stay four different lines. "No floor" and "a floor
+ * nobody will honour" look identical to a collector and must never look
+ * identical here — the second one is the failure that hid for weeks, because a
+ * malformed value reads as configured while every machine ignores it.
+ */
+export function renderCliFloor(body) {
+    const floor = record(body.floor);
+    const version = typeof floor.version === "string" ? floor.version : null;
+    const lines = [
+        `${INDENT}${padEndDisplay("min CLI version", 24)} ${padEndDisplay(version ?? "none", 12)} (${text(floor.source, "no floor")})`,
+    ];
+    if (typeof floor.ignoredReason === "string" && floor.ignoredReason) {
+        lines.push(`${INDENT}stored value ${text(floor.storedValue)} is ignored by every collector (${floor.ignoredReason})`);
+    }
+    if (typeof floor.takesEffect === "string")
+        lines.push(`${INDENT}${floor.takesEffect}`);
+    if (typeof floor.pointer === "string")
+        lines.push(`${INDENT}Read at run time in: ${floor.pointer}`);
+    if (typeof floor.honouredIn === "string")
+        lines.push(`${INDENT}Acted on in: ${floor.honouredIn}`);
+    if (typeof floor.readFailureReason === "string" && floor.readFailureReason) {
+        lines.push(`${INDENT}floor could not be read: ${floor.readFailureReason}`);
+    }
+    return lines;
 }

package/dist/commands/settings.js

@@ -21,7 +21,7 @@
  */
 import { isInteractiveStdin, readLine, writeLine, yesByDefault } from "./cli-io.js";
 import { asList, asRecord, callTower, isForbidden, openTower, parseModelKey, readAllStdin, writeCommandFailure, } from "./tower-command.js";
-import { renderEnvBlobs, renderModelRouting, renderPersonal, renderSwitches, renderTeamSummary, } from "./settings-render.js";
+import { renderCliFloor, renderEnvBlobs, renderModelRouting, renderPersonal, renderSwitches, renderTeamSummary, } from "./settings-render.js";
 export async function runSettings(command, io) {
     const tower = await openTower("settings", command, io);
     switch (command.section) {
@@ -39,6 +39,10 @@ export async function runSettings(command, io) {
             return command.action === "set"
                 ? setModels(command, tower, io)
                 : showModels(command, tower, io);
+        case "cli-floor":
+            return command.action === "set"
+                ? raiseCliFloor(command, tower, io)
+                : showCliFloor(command, tower, io);
         case "env":
             if (command.action === "set")
                 return setEnvBlob(command, tower, io);
@@ -55,12 +59,16 @@ export async function runSettings(command, io) {
  * five sequential round trips would reasonably conclude the command had hung.
  */
 async function showOverview(command, tower, io) {
-    const [personal, switches, models, env, team] = await Promise.all([
+    const [personal, switches, models, env, team, cliFloor] = await Promise.all([
         callTower(tower, { path: "/api/settings/personal", label: "settings personal" }),
         callTower(tower, { path: "/api/settings/switches", label: "settings switches" }),
         callTower(tower, { path: "/api/settings/model-routing", label: "settings models" }),
         callTower(tower, { path: "/api/settings/env-blobs", label: "settings env" }),
         callTower(tower, { path: "/api/team/members", label: "settings team" }),
+        // BLI-3557: the floor rides the overview because "which version is the
+        // fleet being pulled to?" is a question people ask about their own laptop,
+        // and it went unanswered for weeks precisely because nothing showed it.
+        callTower(tower, { path: "/api/settings/cli-floor", label: "settings cli-floor" }),
     ]);
     // The one read every signed-in person is entitled to. If THAT is refused,
     // nothing else is going to work either, so say so once and stop.
@@ -75,6 +83,7 @@ async function showOverview(command, tower, io) {
             models: sectionPayload(models),
             env: sectionPayload(env),
             team: sectionPayload(team),
+            cliFloor: sectionPayload(cliFloor),
         }));
         return 0;
     }
@@ -84,12 +93,14 @@ async function showOverview(command, tower, io) {
     writeSection(io, "SWITCHES", switches, (body) => renderSwitches(body));
     writeSection(io, "MODELS", models, (body) => renderModelRouting(body));
     writeSection(io, "ENV FILES", env, (body) => renderEnvBlobs(body));
+    writeSection(io, "FLEET CLI FLOOR", cliFloor, (body) => renderCliFloor(body));
     writeLine(io.stderr, `[settings cli] overview ${JSON.stringify({
         personal: outcome(personal),
         team: outcome(team),
         switches: outcome(switches),
         models: outcome(models),
         env: outcome(env),
+        cli_floor: outcome(cliFloor),
     })}`);
     return 0;
 }
@@ -180,6 +191,59 @@ async function setSwitch(command, tower, io) {
     writeLine(io.stdout, `Switch ${String(body.key)} is now ${String(body.value)}.`);
     return 0;
 }
+// ── the fleet CLI floor ───────────────────────────────────────────────
+/**
+ * BLI-3557. The floor every collector is pulled up to on its next sync tick.
+ *
+ * Reading it is open to anybody signed in — the person whose laptop is about to
+ * update is entitled to know what it is updating to — and raising it is
+ * super_admin, decided on the server. `scripts/publish-public-packages.mjs`
+ * spends the SET verb after a `--tag latest` publish, which is the whole reason
+ * this exists: a fix on npm that no machine installs is not shipped.
+ */
+async function showCliFloor(command, tower, io) {
+    const result = await callTower(tower, {
+        path: "/api/settings/cli-floor",
+        label: "settings cli-floor",
+    });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    return writeBody(io, command.json, result.body, () => renderCliFloor(asRecord(result.body)));
+}
+async function raiseCliFloor(command, tower, io) {
+    const result = await callTower(tower, {
+        path: "/api/settings/cli-floor",
+        method: "PUT",
+        label: "settings cli-floor set",
+        body: { version: command.floorVersion },
+    });
+    if (!result.ok) {
+        // The refusal a release most needs to read is "that would LOWER the floor",
+        // and it arrives as a 409 whose body already names both versions. Relaying
+        // the server's sentence keeps one wording in one place.
+        writeLine(io.stderr, `[settings cli] cli-floor ${JSON.stringify({
+            requested: command.floorVersion,
+            outcome: result.reason,
+            ...(result.httpStatus === undefined ? {} : { http_status: result.httpStatus }),
+        })}`);
+        return writeCommandFailure(io, command.json, result);
+    }
+    const body = asRecord(result.body);
+    const changed = body.changed === true;
+    writeLine(io.stderr, `[settings cli] cli-floor ${JSON.stringify({
+        from: body.previous ?? null,
+        to: body.version ?? command.floorVersion,
+        outcome: changed ? "raised" : "already_at_floor",
+    })}`);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    writeLine(io.stdout, changed
+        ? `Fleet CLI floor raised ${String(body.previous ?? "none")}→${String(body.version)}.`
+        : `Fleet CLI floor is already ${String(body.version)}; nothing changed.`);
+    return 0;
+}
 // ── models (org-wide) ─────────────────────────────────────────────────
 async function showModels(command, tower, io) {
     const result = await callTower(tower, {

package/dist/commands/start.js

@@ -0,0 +1,47 @@
+import { writeLine } from "./cli-io.js";
+import { displayTicketId } from "./collection-report.js";
+import { discoverCommandWorktrees } from "./local-discovery.js";
+import { startLocalWorkContext } from "../local-state.js";
+export async function runStart(command, io) {
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
+    if (worktrees.length > 1) {
+        const contexts = await Promise.all(worktrees.map((worktree) => startLocalWorkContext({
+            homeDir: command.homeDir,
+            repoRoot: worktree.repo_root,
+            branch: command.branch,
+            activeTicketId: command.activeTicketId,
+            clearTicket: command.clearTicket,
+            topicLabel: command.topicLabel,
+            topicSummaryRedacted: command.topicSummaryRedacted,
+            workIntent: command.workIntent,
+            workPhase: command.workPhase,
+            intentSource: command.intentSource,
+            intentConfidence: command.intentConfidence,
+            operatorId: command.operatorId,
+            sessionId: command.sessionId,
+        })));
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({ mode: "multi_repo", contexts }, null, 2));
+            return 0;
+        }
+        writeLine(io.stdout, `Tower parent work context active for ${contexts.length} worktree(s).`);
+        for (const context of contexts) {
+            writeLine(io.stdout, `- ${context.repo_label ?? context.repo}/${context.worktree_label ?? "worktree"} · ${context.branch} · ${context.work_context_id}`);
+        }
+        return 0;
+    }
+    const context = await startLocalWorkContext(command);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(context, null, 2));
+        return 0;
+    }
+    writeLine(io.stdout, "Tower work context active.");
+    writeLine(io.stdout, `Repo: ${context.repo}`);
+    writeLine(io.stdout, `Branch: ${context.branch}`);
+    writeLine(io.stdout, `Ticket: ${displayTicketId(context.active_ticket_id)}`);
+    if (context.topic_label || context.work_intent || context.work_phase) {
+        writeLine(io.stdout, `Topic: ${context.topic_label ?? "unlabeled"} · ${context.work_intent ?? "unknown"} · ${context.work_phase ?? "unknown"}`);
+    }
+    writeLine(io.stdout, `Context: ${context.work_context_id}`);
+    return 0;
+}

package/dist/commands/sync-followups.js

@@ -0,0 +1,308 @@
+/**
+ * What the sync tick does AFTER collection's own outcome is decided and
+ * reported: keep this machine's CLI current on npm `latest` (BLI-2601), put a
+ * broken scheduler registration back (BLI-2721), and keep BLI Memory
+ * registered with both agent hosts (BLI-3580).
+ *
+ * Split out of commands/sync.ts (BLI-3578), moved verbatim. They belong
+ * together because they share one rule, and it is the reason both are called
+ * last: a follow-up may never block, delay or fail collection. Every error path
+ * here is swallowed on purpose and reported as its own named receipt — an
+ * `update` step, or an autostart repair step — never as a `sync` failure.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { resolveAutostartRoots } from "./autostart-command.js";
+import { installMemoryIntegration, } from "./memory-install.js";
+import { redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
+import { runSelfUpdate, SelfUpdateError } from "./install-update.js";
+import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, } from "../local-state.js";
+import { runAutostartSelfHeal, } from "../autostart-self-heal.js";
+import { envWithNodeRuntimeOnPath, runScheduledSelfUpdate, } from "../scheduled-self-update.js";
+/**
+ * BLI-2721: after the tick's collection and self-update are done and
+ * reported, repair a broken/legacy autostart registration in place (Windows
+ * only — see autostart-self-heal.ts for why macOS is excluded). Every error
+ * path is swallowed like the self-update's: heal outcomes are their own
+ * receipts, never a sync failure.
+ */
+export async function runAutostartSelfHealAfterSync(command, io, dashboardUrl) {
+    let result;
+    try {
+        const rawExec = io.exec;
+        if (!rawExec) {
+            // BLI-3483: this was a bare `return`. On Windows the self-heal is the
+            // only thing that puts a broken scheduler back, so abandoning it here
+            // meant a machine could stop collecting forever and leave no receipt
+            // anywhere — the exact shape the fleet contract forbids. The packed CLI
+            // always supplies a runner (`commands/cli-io.ts`), so this fires only for
+            // an embedder that built its own `io`; it costs one line either way.
+            console.error("[autostart-self-heal] no process runner on this io; the repair could not be attempted", JSON.stringify({
+                reason: "runner_unavailable",
+                platform: process.platform,
+                next_action: "reinstall the CLI (npm i -g @bli-cockpit/cli) and run `cockpit autostart install`",
+            }));
+            result = {
+                status: "skipped",
+                reason: "runner_unavailable",
+                detail: "No process runner available to this CLI invocation; run `cockpit autostart install` by hand.",
+            };
+            await reportAutostartSelfHealOutcome(command, io, dashboardUrl, result);
+            return;
+        }
+        const spawnEnv = envWithNodeRuntimeOnPath(io.env ?? process.env);
+        const exec = (cmd, args, options) => rawExec(cmd, args, { ...options, env: options?.env ?? spawnEnv });
+        result = await runAutostartSelfHeal(getCollectorRuntimePaths(command.homeDir), {
+            homeDir: command.homeDir,
+            repoRoots: await resolveAutostartRoots(command.homeDir, undefined),
+            dashboardUrl: command.dashboardUrl,
+            exec,
+        });
+    }
+    catch (error) {
+        result = {
+            status: "fail",
+            reason: "autostart_self_heal_threw",
+            detail: redactedSyncErrorDetail(error),
+        };
+    }
+    // Steady state (healthy, absent, non-Windows, no roots) and the daily
+    // throttle are silent; an actual repair attempt reports either way.
+    if (!result || result.reason === "repair_throttled_recent_attempt")
+        return;
+    await reportAutostartSelfHealOutcome(command, io, dashboardUrl, result);
+}
+/** One receipt for the repair, whichever branch above produced the outcome. */
+async function reportAutostartSelfHealOutcome(command, io, dashboardUrl, result) {
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        command: "sync",
+        events: [
+            {
+                // Windows repairs in place and keeps the name already in the receipts
+                // and the runbook; the macOS path only SCHEDULES a detached repair, so
+                // it reports under its own step (BLI-3553).
+                step: result.step ?? "autostart_repair",
+                status: result.status,
+                ...(result.status === "ok" ? {} : { error_code: result.reason }),
+                ...(result.detail ? { error_detail: result.detail } : {}),
+            },
+        ],
+        json: command.json,
+        io,
+    });
+}
+export const MEMORY_INSTALL_THROTTLE_MARKER = ".last-memory-install";
+const MEMORY_INSTALL_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
+/**
+ * BLI-3580: BLI Memory's registration converges on its own.
+ *
+ * Nobody is going to be asked to install a hook. `do-everything` registers it
+ * on the way through, and this puts it back if a host config is edited,
+ * replaced, or restored from a machine that never had it — at most once a day,
+ * because the steady state is "already current" and re-proving that every
+ * fifteen minutes is four file reads a tick for no new information.
+ *
+ * Same rule as the two follow-ups above: it runs only once collection's own
+ * outcome has been decided and reported, it never throws, and its outcome is
+ * its own named receipt rather than a sync failure.
+ */
+export async function runMemoryInstallAfterSync(command, io, dashboardUrl, options = {}) {
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    const now = options.now ?? new Date();
+    const marker = path.join(paths.state_dir, MEMORY_INSTALL_THROTTLE_MARKER);
+    const lastAttempt = await fs.stat(marker).catch(() => null);
+    if (lastAttempt &&
+        now.getTime() - lastAttempt.mtimeMs < MEMORY_INSTALL_MIN_INTERVAL_MS) {
+        return;
+    }
+    // Written for the ATTEMPT, not the outcome — the same idiom the self-update
+    // and autostart repair use, so a machine that cannot write a host config does
+    // not retry it every fifteen minutes.
+    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
+    await fs.writeFile(marker, now.toISOString()).catch(() => undefined);
+    let event;
+    try {
+        const outcome = await installMemoryIntegration({
+            kind: "memory",
+            action: "install",
+            homeDir: command.homeDir,
+            dashboardUrl,
+            dryRun: false,
+            json: command.json,
+        }, io);
+        event = memoryInstallEvent(outcome);
+    }
+    catch (error) {
+        event = {
+            step: "memory_install",
+            status: "fail",
+            error_code: "memory_install_threw",
+            error_detail: redactedSyncErrorDetail(error),
+        };
+    }
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        command: "sync",
+        events: [event],
+        json: command.json,
+        io,
+    });
+}
+/**
+ * Target names and reason labels only. A target's `path` names a person's home
+ * directory and a `write_failed` detail can carry one, so neither travels: the
+ * receipt says `claude_hooks:read_back_mismatch`, which is the part an operator
+ * can act on.
+ */
+function memoryInstallEvent(outcome) {
+    const detail = [
+        `source=${outcome.config_source}`,
+        ...outcome.targets.map((target) => `${target.target}:${target.status}/${target.reason}`),
+    ].join("; ");
+    if (outcome.status === "failed") {
+        return {
+            step: "memory_install",
+            status: "fail",
+            error_code: outcome.reason,
+            error_detail: detail,
+        };
+    }
+    if (outcome.status === "skipped") {
+        // Nothing was written, on purpose (`no_bin_no_write`). A fleet-wide
+        // `bin_missing` is the receipt that says the server package has not
+        // reached the machines yet — a fact, not a fault.
+        return {
+            step: "memory_install",
+            status: "skipped",
+            error_code: outcome.reason,
+            error_detail: detail,
+        };
+    }
+    return { step: "memory_install", status: "ok", error_detail: detail };
+}
+/**
+ * BLI-2601: the fleet keeps itself current on npm `latest` without anyone
+ * re-running `npm i -g @bli-cockpit/cli` by hand after day 0. This always
+ * runs AFTER `runSync` has already decided and reported collection's own
+ * outcome above — a stuck or failing self-update can never block or delay
+ * collection, and a collection failure never blocks the chance to
+ * self-update. Every error path here is swallowed on purpose: a failure is
+ * reported as its own named `update` receipt, never surfaced as a `sync`
+ * failure or thrown from this function.
+ */
+export async function runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersion) {
+    let event;
+    try {
+        event = await runScheduledSelfUpdateForSync(command, io, minCliVersion);
+    }
+    catch (error) {
+        // The throttle/probe/install machinery below is defensive already; this
+        // is the last-resort net so an update crash truly cannot touch the sync
+        // result above.
+        event = {
+            step: "update",
+            status: "fail",
+            error_code: "self_update_threw",
+            error_detail: redactedSyncErrorDetail(error),
+        };
+    }
+    if (!event)
+        return;
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        command: "update",
+        events: [event],
+        json: command.json,
+        io,
+    });
+}
+async function runScheduledSelfUpdateForSync(command, io, minCliVersion) {
+    const rawExec = io.exec;
+    if (!rawExec) {
+        // Only the real production `defaultIo()` supplies a process runner. A
+        // caller that omitted one gets a silent no-op rather than this reaching
+        // for a real npm binary it was never given — never observed in
+        // production, where `defaultIo()` always sets `exec`.
+        return null;
+    }
+    // Every spawn in the scheduled path carries the running node's bin dir on
+    // PATH — see envWithNodeRuntimeOnPath. Interactive doctor never needed
+    // this; the scheduler's stripped environment does.
+    const spawnEnv = envWithNodeRuntimeOnPath(io.env ?? process.env);
+    const exec = (cmd, args, options) => rawExec(cmd, args, { ...options, env: options?.env ?? spawnEnv });
+    const scheduledIo = { ...io, exec };
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    const result = await runScheduledSelfUpdate(paths, {
+        exec,
+        currentVersion: LOCAL_COLLECTOR_VERSION,
+        install: (tag) => attemptScheduledSelfUpdateInstall(scheduledIo, tag),
+    }, { env: io.env, minVersion: minCliVersion });
+    return scheduledSelfUpdateInstallEvent(result);
+}
+async function attemptScheduledSelfUpdateInstall(io, tag) {
+    try {
+        // Reuses the exact npm-install machinery `cockpit doctor`'s
+        // `fixCliLatest` uses (see doctor.ts:243-280) so there is one place that
+        // knows how to invoke `npm i -g` and classify EACCES. Unlike doctor,
+        // this call never re-execs — see runScheduledSelfUpdate's doc comment.
+        await runSelfUpdate(io, { json: true, tag });
+        return { ok: true };
+    }
+    catch (error) {
+        if (!(error instanceof SelfUpdateError))
+            throw error;
+        return { ok: false, eacces: error.eacces };
+    }
+}
+function scheduledSelfUpdateInstallEvent(result) {
+    // The steady-state "already checked today" case is a pure no-op; reporting
+    // it would post a receipt on ~95 of every 96 sync ticks for no new
+    // information. Only a real attempt (ok, fail, or an explicit disable)
+    // produces a receipt.
+    if (result.reason === "throttled_recent_attempt")
+        return null;
+    // A forced attempt names its trigger in the receipt either way, so the
+    // ledger can tell "converged on the daily cadence" from "the floor pulled
+    // this machine forward" (BLI-2678).
+    const forcedDetail = result.forced && result.min_version
+        ? `forced_min_version ${result.min_version}`
+        : null;
+    if (result.status === "ok") {
+        // BLI-3551: this used to be `update ok` with an empty detail unless the
+        // floor forced it. One machine posted that receipt daily for nine releases
+        // while sitting on 0.2.37, and nobody could tell "already current" from
+        // "installed something" from "npm answered nothing" — three different
+        // situations wearing one word. The success branch names itself now.
+        const okDetail = [
+            forcedDetail,
+            result.reason === "updated" && result.previous_version && result.installed_version
+                ? `installed ${result.previous_version}→${result.installed_version}`
+                : result.reason,
+            result.target_version ? `target ${result.target_version}` : null,
+        ]
+            .filter((part) => Boolean(part))
+            .join("; ");
+        return {
+            step: "update",
+            status: "ok",
+            ...(okDetail ? { error_detail: okDetail } : {}),
+        };
+    }
+    const detail = [
+        forcedDetail,
+        result.target_version ? `target ${result.target_version}` : null,
+        result.installed_version ? `installed ${result.installed_version}` : null,
+    ]
+        .filter((part) => Boolean(part))
+        .join("; ");
+    return {
+        step: "update",
+        status: result.status,
+        error_code: result.reason,
+        ...(detail ? { error_detail: detail } : {}),
+    };
+}