@bli-cockpit/cli 0.2.48 → 0.2.50

package/dist/commands/agent-rules-command.js

@@ -0,0 +1,55 @@
+/**
+ * `cockpit agent-rules install|uninstall|status` — the ticket-binding guidance
+ * Tower writes into a machine's `AGENTS.md` and `CLAUDE.md`.
+ *
+ * Split out of commands/local.ts (BLI-3578); the files themselves are written
+ * by `../agent-rules.ts`. This module is the command: which hosts a verb
+ * touches, and the lines it prints. Moved verbatim. `agentRuleHostLabel` is
+ * shared with onboarding, which installs the same rules on its way through.
+ */
+import path from "node:path";
+import { writeLine } from "./cli-io.js";
+import { inspectAgentRules, installAgentRules, uninstallAgentRules, } from "../agent-rules.js";
+export async function runAgentRules(command, io) {
+    const hosts = agentRuleHosts(command.host);
+    const scopePath = path.resolve(command.repoRoot ?? process.cwd());
+    const result = command.action === "install"
+        ? await installAgentRules({ homeDir: command.homeDir, hosts, scopePath })
+        : command.action === "uninstall"
+            ? await uninstallAgentRules({ homeDir: command.homeDir, hosts })
+            : await inspectAgentRules({ homeDir: command.homeDir, hosts, scopePath });
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(result, null, 2));
+        return 0;
+    }
+    if ("installed" in result) {
+        writeLine(io.stdout, result.installed
+            ? "Tower agent rules are installed."
+            : "Tower agent rules are not installed.");
+    }
+    else {
+        writeLine(io.stdout, agentRulesStatusLine(result));
+    }
+    for (const target of result.targets) {
+        writeLine(io.stdout, `${agentRuleHostLabel(target.host)}: ${target.rules_file}`);
+    }
+    return 0;
+}
+function agentRuleHosts(host) {
+    return host === "all" ? ["codex", "claude"] : [host];
+}
+function agentRulesStatusLine(result) {
+    switch (result.status) {
+        case "created":
+            return "Tower agent rules installed.";
+        case "updated":
+            return "Tower agent rules updated.";
+        case "unchanged":
+            return "Tower agent rules already current.";
+        case "missing":
+            return "Tower agent rules were not installed.";
+    }
+}
+export function agentRuleHostLabel(host) {
+    return host === "claude" ? "CLAUDE.md" : "AGENTS.md";
+}

package/dist/commands/agent-session-report.js

@@ -0,0 +1,290 @@
+/**
+ * What one sync run REPORTS: the per-session attribution rows posted to the
+ * door, and the funnel counts the CLI prints.
+ *
+ * Split out of commands/session-sync.ts (BLI-3572) because these are pure
+ * projections — attribution results plus upload outcomes in, rows and counts
+ * out, no I/O and no ordering — while the engine next door is nothing but I/O
+ * and ordering. Behavior-preserving move: no logic changed, and every name is
+ * still re-exported from `./session-sync.js` for callers that had it there.
+ */
+import { CODEX_SESSION_ATTRIBUTION_STATE_RANK, NO_UPLOAD_ATTEMPT_RECORDED, notUploadableAttributionStateReason, } from "@bli-cockpit/telemetry-core";
+import { isLiveRawEvidenceSyncAttribution, isRawEvidenceUploadableAttributionState, } from "../raw-evidence-attribution-policy.js";
+/** How many Codex sessions the scan could not read at all. */
+export function codexAttributionReadFailureCount(scan) {
+    return scan.directory_read_failed_count + scan.stat_failed_count;
+}
+/** How many Claude sessions or sidecars the scan could not read at all. */
+export function claudeAttributionReadFailureCount(scan) {
+    return (scan.project_dir_read_failed_count +
+        scan.session_stat_failed_count +
+        scan.sidecar_dir_read_failed_count +
+        scan.sidecar_stat_failed_count);
+}
+/**
+ * How good each attribution state is, for picking one row per session when the
+ * same session was attributed more than once. Re-exported under the collector's
+ * own name so callers do not have to reach into telemetry-core for it.
+ */
+export const ATTRIBUTION_STATE_RANK = CODEX_SESSION_ATTRIBUTION_STATE_RANK;
+function normalizeCodexResult(result) {
+    return {
+        source: "codex",
+        session_id: result.codex_session_id,
+        state: result.state,
+        reason: result.reason,
+        signals: result.signals,
+        attribution_score: result.attribution_score,
+        path_score: result.path_score,
+        content_hash_sha256: result.content_hash_sha256,
+        byte_size: result.byte_size,
+        session_file_mtime: result.session_file_mtime,
+        session_file_mtime_ms: result.session_file_mtime_ms,
+        worktree: result.worktree,
+        cwd_basename: result.cwd_basename,
+        cwd_hash: result.cwd_hash,
+    };
+}
+function normalizeClaudeResult(result) {
+    return {
+        source: "claude_code",
+        session_id: result.claude_session_id,
+        state: result.state,
+        reason: result.reason,
+        signals: result.signals,
+        attribution_score: result.attribution_score,
+        path_score: result.path_score,
+        content_hash_sha256: result.content_hash_sha256,
+        byte_size: result.byte_size,
+        session_file_mtime: result.session_file_mtime,
+        session_file_mtime_ms: result.session_file_mtime_ms,
+        worktree: result.worktree,
+        cwd_basename: result.cwd_basename,
+        cwd_hash: result.cwd_hash,
+    };
+}
+/**
+ * Dedupe every source's attributed results down to the single best result per
+ * `(source, session_id)`. Best means highest attribution-state rank, ties
+ * broken by the newer file mtime. Codex and Claude sessions that happen to
+ * share an id are never collapsed into each other because the key carries the
+ * source.
+ */
+function bestAttributedSessionsByKey(codexResults, claudeResults) {
+    const normalized = [
+        ...codexResults.map(normalizeCodexResult),
+        ...claudeResults.map(normalizeClaudeResult),
+    ];
+    const bestByKey = new Map();
+    for (const result of normalized) {
+        const key = `${result.source}:${result.session_id}`;
+        const existing = bestByKey.get(key);
+        if (!existing ||
+            (ATTRIBUTION_STATE_RANK[result.state] ?? 0) >
+                (ATTRIBUTION_STATE_RANK[existing.state] ?? 0) ||
+            ((ATTRIBUTION_STATE_RANK[result.state] ?? 0) ===
+                (ATTRIBUTION_STATE_RANK[existing.state] ?? 0) &&
+                result.session_file_mtime_ms > existing.session_file_mtime_ms)) {
+            bestByKey.set(key, result);
+        }
+    }
+    return bestByKey;
+}
+/**
+ * Which sessions this sync actually uploaded, and why the rest did not — read
+ * ONLY from main-file outcomes (kind `codex_jsonl` / `claude_jsonl`); a
+ * sidecar making it must never mark a session uploaded when the main did not
+ * (D3).
+ */
+function sessionUploadOutcomesByKey(outcomes) {
+    const uploadByKey = new Map();
+    const noUploadReasonByKey = new Map();
+    let anySyncIncomplete = false;
+    for (const outcome of outcomes) {
+        if (outcome.sync.status !== "uploaded") {
+            anySyncIncomplete = true;
+            continue;
+        }
+        for (const upload of outcome.sync.raw_evidence_outcomes) {
+            if (!upload.codex_session_id)
+                continue;
+            const source = upload.kind === "claude_jsonl"
+                ? "claude_code"
+                : upload.kind === "codex_jsonl"
+                    ? "codex"
+                    : null;
+            if (!source)
+                continue; // sidecars and other kinds do not set session state
+            const key = `${source}:${upload.codex_session_id}`;
+            if (!upload.raw_evidence_pointer_id) {
+                // An outcome with no pointer is a failure that named itself. Keep the
+                // reason even though there is nothing to point at.
+                if (upload.reason)
+                    noUploadReasonByKey.set(key, upload.reason);
+                continue;
+            }
+            uploadByKey.set(key, upload);
+        }
+    }
+    return { uploadByKey, noUploadReasonByKey, anySyncIncomplete };
+}
+/** Turn one deduped, best-ranked session result into its report row. */
+function sessionReportEntry(result, context) {
+    const key = `${result.source}:${result.session_id}`;
+    const upload = context.uploadByKey.get(key);
+    // A previously-durable Claude session with no fresh main upload this sync
+    // (damped / spooled / budget-deferred) reports reused_existing + its prior
+    // pointer rather than not_uploaded, so the store row never flips.
+    const priorDurablePointer = result.source === "claude_code"
+        ? (context.claudePriorDurablePointers.get(result.session_id) ?? null)
+        : null;
+    return {
+        codex_session_id: result.session_id,
+        source: result.source,
+        observed_at: context.now.toISOString(),
+        attribution_state: result.state,
+        attribution_reason: result.reason,
+        attribution_score: result.attribution_score,
+        path_score: result.path_score,
+        signals: result.signals,
+        ...(result.content_hash_sha256
+            ? { session_file_hash_sha256: result.content_hash_sha256 }
+            : {}),
+        session_file_byte_size: result.byte_size,
+        session_file_mtime: result.session_file_mtime,
+        ...(result.worktree
+            ? {
+                repo_fingerprint: result.worktree.repo_fingerprint,
+                worktree_fingerprint: result.worktree.worktree_fingerprint,
+                repo_label: result.worktree.repo_label,
+                branch: result.worktree.branch,
+            }
+            : {}),
+        ...(result.cwd_basename ? { cwd_basename: result.cwd_basename } : {}),
+        ...(result.cwd_hash ? { cwd_hash: result.cwd_hash } : {}),
+        ...(upload
+            ? {
+                raw_evidence_pointer_id: upload.raw_evidence_pointer_id,
+                upload_state: upload.upload_state,
+                // A failed upload names itself; a successful one has nothing to
+                // explain.
+                ...(upload.upload_state === "upload_failed"
+                    ? {
+                        upload_reason: upload.reason ?? NO_UPLOAD_ATTEMPT_RECORDED,
+                    }
+                    : {}),
+            }
+            : priorDurablePointer
+                ? {
+                    raw_evidence_pointer_id: priorDurablePointer,
+                    upload_state: "reused_existing",
+                }
+                : isRawEvidenceUploadableAttributionState(result.state, result.worktree !== null)
+                    ? {
+                        upload_state: "not_uploaded",
+                        // BLI-2107: `not_uploaded` used to be the branch of last
+                        // resort, recording that nothing happened and never why. It
+                        // now always carries a cause, even when the cause is that we
+                        // have none — a session labelled NO_UPLOAD_ATTEMPT_RECORDED
+                        // is a path that still needs instrumenting, and saying so is
+                        // the point.
+                        upload_reason: context.noUploadReasonByKey.get(key) ??
+                            (context.anySyncIncomplete
+                                ? "sync_incomplete_this_pass"
+                                : NO_UPLOAD_ATTEMPT_RECORDED),
+                    }
+                    : {
+                        // BLI-3272: the upload policy refused this session's
+                        // attribution state. That refusal used to spread `{}` here, so
+                        // the row landed with upload_state NULL and upload_reason NULL
+                        // — a withhold that named nothing, on 1,256 production
+                        // sessions. It is a decision like any other and it says so.
+                        // Any reason the pipeline did record still wins: it is the more
+                        // specific answer.
+                        upload_state: "not_uploaded",
+                        upload_reason: context.noUploadReasonByKey.get(key) ??
+                            notUploadableAttributionStateReason(result.reason),
+                    }),
+    };
+}
+/**
+ * Generalizes the per-session report across sources. Dedupe is per
+ * `(source, session_id)` so a Codex session and a Claude session that happen to
+ * share an id are never collapsed. Upload state maps ONLY from the main-file
+ * outcome (kind `codex_jsonl` / `claude_jsonl`); sidecar outcomes never set a
+ * session's upload state (D3). Damped Claude sessions report `reused_existing`
+ * carrying their prior durable pointer.
+ *
+ * The pass, named: pick the best-ranked result per session
+ * (`bestAttributedSessionsByKey`), read back what this sync actually uploaded
+ * (`sessionUploadOutcomesByKey`), then render one report row per session
+ * (`sessionReportEntry`).
+ */
+export function buildAgentSessionReport(options) {
+    const bestByKey = bestAttributedSessionsByKey(options.codexResults, options.claudeResults);
+    const uploadOutcomes = sessionUploadOutcomesByKey(options.outcomes);
+    return [...bestByKey.values()].map((result) => sessionReportEntry(result, {
+        ...uploadOutcomes,
+        claudePriorDurablePointers: options.claudePriorDurablePointers,
+        now: options.now,
+    }));
+}
+/**
+ * The funnel one sync run prints: per-source scan counts, sidecar and
+ * damping counts, and the two budget totals.
+ */
+export function buildAgentSessionSummary(options) {
+    const sidecarOutcomes = options.outcomes.flatMap((outcome) => outcome.sync.raw_evidence_outcomes.filter((upload) => upload.kind === "claude_jsonl_sidecar"));
+    const attributedClaude = options.claudeAttribution.results.filter((result) => isLiveRawEvidenceSyncAttribution(result.state, result.reason));
+    const sidecarsCollected = attributedClaude.reduce((total, result) => total +
+        result.sidecar_files.filter((sidecar) => !sidecar.skipped_reason).length, 0);
+    const sidecarsSkipped = options.claudeAttribution.results.reduce((total, result) => total +
+        result.sidecar_files.filter((sidecar) => sidecar.skipped_reason).length, 0);
+    const codex = {
+        scanned: options.codexAttribution.scanned_file_count,
+        attributed: options.codexAttribution.counts.attributed,
+        attributed_fallback: options.codexAttribution.counts.attributed_fallback,
+        ambiguous: options.codexAttribution.counts.ambiguous,
+        unattributed: options.codexAttribution.counts.unattributed,
+        skipped: options.codexAttribution.counts.skipped,
+        stale: options.codexStaleCount,
+        read_failures: codexAttributionReadFailureCount(options.codexAttribution),
+    };
+    const claude = {
+        scanned: options.claudeAttribution.scanned_session_count,
+        attributed: options.claudeAttribution.counts.attributed,
+        attributed_fallback: options.claudeAttribution.counts.attributed_fallback,
+        ambiguous: options.claudeAttribution.counts.ambiguous,
+        unattributed: options.claudeAttribution.counts.unattributed,
+        skipped: options.claudeAttribution.counts.skipped,
+        stale: options.claudeStaleCount,
+        read_failures: claudeAttributionReadFailureCount(options.claudeAttribution),
+        sidecars_collected: sidecarsCollected,
+        sidecars_uploaded: sidecarOutcomes.filter((upload) => upload.upload_state === "uploaded" ||
+            upload.upload_state === "reused_existing").length,
+        sidecars_skipped: sidecarsSkipped,
+        sidecars_capped: options.claudeAttribution.counts.sidecars_capped,
+        sidecars_failed: sidecarOutcomes.filter((upload) => upload.upload_state === "upload_failed").length,
+        mains_oversized: options.claudeAttribution.counts.mains_oversized,
+        oversized_lines_skipped: options.claudeAttribution.counts.oversized_lines_skipped,
+        project_dirs_skipped: options.claudeAttribution.project_dirs_skipped,
+        sessions_schema_drift: options.claudeAttribution.counts.sessions_schema_drift,
+        growth_damped: options.growthDamped,
+        first_run_backfill: options.firstRunBackfill,
+    };
+    return {
+        scanned: codex.scanned,
+        attributed: codex.attributed,
+        attributed_fallback: codex.attributed_fallback,
+        ambiguous: codex.ambiguous,
+        unattributed: codex.unattributed,
+        skipped: codex.skipped,
+        stale: codex.stale,
+        report_posted: options.report.posted,
+        report_reason: options.report.reason,
+        codex,
+        claude,
+        files_deferred_byte_budget: options.outcomes.reduce((total, outcome) => total + outcome.sync.raw_evidence_deferred_byte_budget, 0),
+        files_deferred_object_budget: options.outcomes.reduce((total, outcome) => total + outcome.sync.raw_evidence_deferred_object_budget, 0),
+    };
+}

package/dist/commands/analyze.js

@@ -0,0 +1,131 @@
+import { bufferedWritable, parseCapturedJson, replayCaptured, writeLine, } from "./cli-io.js";
+import { normalizeUrl } from "./local-args.js";
+import { runSync } from "./sync.js";
+import { describeError, isMissingFileFailure } from "../health-detail.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorSessionFile, } from "../local-state.js";
+export async function runAnalyze(command, io) {
+    const syncStdout = [];
+    const syncStderr = [];
+    const syncIo = {
+        ...io,
+        stdout: bufferedWritable(syncStdout),
+        stderr: bufferedWritable(syncStderr),
+    };
+    const syncCommand = {
+        ...command,
+        kind: "sync",
+        json: true,
+    };
+    const syncExitCode = await runSync(syncCommand, syncIo);
+    const syncOutput = parseCapturedJson(syncStdout);
+    if (syncExitCode !== 0 || !isUploadedSyncResult(syncOutput)) {
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({
+                status: syncExitCode === 0 ? "sync_not_completed" : "sync_failed",
+                sync: syncOutput,
+                error: syncStderr.join("").trim()
+                    || (syncExitCode === 0
+                        ? "Tower sync did not upload fresh evidence."
+                        : "Tower sync failed."),
+            }, null, 2));
+        }
+        else {
+            replayCaptured(io.stderr, syncStderr);
+            writeLine(io.stderr, syncExitCode === 0
+                ? "Analysis was not queued because a fresh upload did not complete."
+                : "Analysis was not queued because the latest upload failed.");
+        }
+        return syncExitCode === 0 ? 1 : syncExitCode;
+    }
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    const session = await readLocalCollectorSessionFile(paths).catch((error) => {
+        // "Not signed in" is the right sentence for an absent session file and the
+        // wrong one for a corrupt one, which `cockpit login` will not repair
+        // (BLI-3238).
+        if (!isMissingFileFailure(error)) {
+            console.error("[cockpit-analyze] session file present but unreadable, reporting as not signed in", JSON.stringify({
+                reason: "session_file_unusable",
+                ...describeError(error),
+            }));
+        }
+        throw new Error("Tower is not signed in. Run `cockpit onboard` or `cockpit login` first.");
+    });
+    const dashboardUrl = normalizeUrl(command.dashboardUrl ?? session.dashboard_url ?? DEFAULT_DASHBOARD_URL);
+    const response = await io.fetch(`${dashboardUrl}/api/ambient/analyze`, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${session.device_token}`,
+            "content-type": "application/json",
+        },
+        body: "{}",
+    });
+    const body = await readAnalyzeApiResponse(response);
+    if (!response.ok) {
+        const message = typeof body.message === "string"
+            ? body.message
+            : `Analysis request failed with HTTP ${response.status}.`;
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({
+                status: "analyze_failed",
+                sync: syncOutput,
+                http_status: response.status,
+                code: typeof body.code === "string" ? body.code : null,
+                message,
+                retry_after_seconds: typeof body.retry_after_seconds === "number"
+                    ? body.retry_after_seconds
+                    : null,
+            }, null, 2));
+        }
+        else {
+            replayCaptured(io.stderr, syncStderr);
+            writeLine(io.stderr, `Analysis was not queued: ${message}`);
+        }
+        return 1;
+    }
+    const jobId = typeof body.job?.id === "string" ? body.job.id : null;
+    const jobStatus = typeof body.job?.status === "string" ? body.job.status : "pending";
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({
+            status: "queued",
+            sync: syncOutput,
+            job: body.job ?? null,
+            dashboard_url: `${dashboardUrl}/my-work`,
+        }, null, 2));
+        return 0;
+    }
+    replayCaptured(io.stderr, syncStderr);
+    writeLine(io.stdout, "Tower uploaded your latest work.");
+    writeLine(io.stdout, "Tower analysis queued.");
+    if (jobId)
+        writeLine(io.stdout, `Job: ${jobId}`);
+    writeLine(io.stdout, `Status: ${jobStatus === "pending" ? "queued" : jobStatus}`);
+    writeLine(io.stdout, `Results: ${dashboardUrl}/my-work`);
+    return 0;
+}
+async function readAnalyzeApiResponse(response) {
+    const text = await response.text();
+    if (!text)
+        return {};
+    try {
+        const value = JSON.parse(text);
+        return value && typeof value === "object" ? value : {};
+    }
+    catch {
+        // `{}` erases whatever the analyze endpoint said, including its error, and
+        // the operator is left with a job id of `undefined` and no reason. The
+        // body is never logged; its shape is what identifies a proxy reply.
+        console.error("[cockpit-analyze] reply was not JSON", JSON.stringify({
+            reason: "response_body_not_json",
+            http_status: response.status,
+            byte_size: text.length,
+            content_type: response.headers.get("content-type") ?? "none",
+        }));
+        return {};
+    }
+}
+function isUploadedSyncResult(value) {
+    return Boolean(value
+        && typeof value === "object"
+        && !Array.isArray(value)
+        && value["status"] === "uploaded");
+}

package/dist/commands/autostart-command.js

@@ -0,0 +1,105 @@
+import { defaultExec, writeLine } from "./cli-io.js";
+import { runAutostartHealDetached } from "./autostart-heal.js";
+import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from "../autostart.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
+export async function runAutostart(command, io) {
+    if (command.action === "heal-detached") {
+        // BLI-3553: the internal one-shot the scheduled macOS tick spawns. It has
+        // its own receipt and its own exit code; nothing else in this function
+        // applies to it.
+        return runAutostartHealDetached({
+            homeDir: command.homeDir,
+            dashboardUrl: command.dashboardUrl,
+            parentPid: command.parentPid ?? null,
+            json: command.json,
+        }, io);
+    }
+    const exec = io.exec ?? defaultExec();
+    const repoRoots = command.action === "install" || command.action === "status"
+        ? await resolveAutostartRoots(command.homeDir, command.repoRoot)
+        : [];
+    const result = command.action === "install"
+        ? await installAutostartAgent({
+            homeDir: command.homeDir,
+            repoRoot: repoRoots[0],
+            repoRoots,
+            dashboardUrl: command.dashboardUrl,
+            intervalSeconds: command.intervalSeconds,
+            exec,
+        })
+        : command.action === "uninstall"
+            ? await uninstallAutostartAgent({ homeDir: command.homeDir, exec })
+            : await autostartStatus({
+                homeDir: command.homeDir,
+                repoRoot: repoRoots[0],
+                repoRoots,
+                dashboardUrl: command.dashboardUrl,
+                intervalSeconds: command.intervalSeconds,
+                exec,
+            });
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(result, null, 2));
+        return autostartExitCode(command.action, result);
+    }
+    writeAutostartResult(io, result);
+    return autostartExitCode(command.action, result);
+}
+function autostartExitCode(action, result) {
+    if (result.status === "unsupported")
+        return 1;
+    if (action === "status")
+        return result.status === "loaded" ? 0 : 1;
+    if (action === "install" && result.loaded === false)
+        return 1;
+    if (action === "uninstall" && result.status === "not_loaded")
+        return 1;
+    return 0;
+}
+export async function resolveAutostartRoots(homeDir, explicitRoot) {
+    if (explicitRoot)
+        return [explicitRoot];
+    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(homeDir)).catch(() => null);
+    return config?.default_repo_paths ?? [];
+}
+function writeAutostartResult(io, result) {
+    switch (result.status) {
+        case "installed":
+            writeLine(io.stdout, result.loaded
+                ? "Tower autostart installed and loaded."
+                : "Tower autostart installed (the operating-system scheduler reported a problem).");
+            writeLine(io.stdout, `Label: ${result.label}`);
+            writeLine(io.stdout, autostartLocationLine(result));
+            writeLine(io.stdout, `Interval: every ${result.interval_seconds}s`);
+            writeLine(io.stdout, `Repo: ${result.work_dir}`);
+            writeLine(io.stdout, `Dashboard: ${result.dashboard_url}`);
+            if (!result.loaded && result.message)
+                writeLine(io.stderr, result.message);
+            return;
+        case "uninstalled":
+            writeLine(io.stdout, "Tower autostart removed.");
+            writeLine(io.stdout, autostartLocationLine(result));
+            return;
+        case "absent":
+            writeLine(io.stdout, "Tower autostart is not installed.");
+            writeLine(io.stdout, autostartLocationLine(result));
+            return;
+        case "loaded":
+            writeLine(io.stdout, "Tower autostart is installed and loaded.");
+            writeLine(io.stdout, autostartLocationLine(result));
+            return;
+        case "not_loaded":
+            writeLine(io.stdout, "Tower autostart exists but is disabled or not loaded; run `cockpit autostart install` to repair it.");
+            writeLine(io.stdout, autostartLocationLine(result));
+            if (result.message)
+                writeLine(io.stderr, result.message);
+            return;
+        case "unsupported":
+            writeLine(io.stderr, `Autostart unsupported: ${result.message}`);
+            return;
+    }
+}
+export function autostartLocationLine(result) {
+    return result.task_name
+        ? `Task: ${result.task_name}`
+        : `Plist: ${result.plist_path}`;
+}

package/dist/commands/backfill-batches.js

@@ -0,0 +1,34 @@
+/**
+ * Which scanned sessions are actually uploadable, and how they are cut into
+ * the units one upload call handles. Batches are per worktree because the sync
+ * path uploads one repo's envelope at a time, and capped in size so a single
+ * failure costs one batch rather than the whole history.
+ */
+import { isRawEvidenceUploadableAttributionState } from "../raw-evidence-attribution-policy.js";
+export const BACKFILL_UPLOAD_BATCH_SESSIONS = 25;
+export function uploadableCandidates(candidates) {
+    return candidates.filter((candidate) => isRawEvidenceUploadableAttributionState(candidate.state, candidate.worktree !== null) &&
+        candidate.worktree);
+}
+export function buildBackfillBatches(candidates) {
+    const byWorktree = new Map();
+    for (const candidate of candidates) {
+        if (!candidate.worktree)
+            continue;
+        const key = candidate.worktree.worktree_fingerprint;
+        byWorktree.set(key, [...(byWorktree.get(key) ?? []), candidate]);
+    }
+    const batches = [];
+    for (const group of byWorktree.values()) {
+        const worktree = group[0]?.worktree;
+        if (!worktree)
+            continue;
+        for (let offset = 0; offset < group.length; offset += BACKFILL_UPLOAD_BATCH_SESSIONS) {
+            batches.push({
+                worktree,
+                candidates: group.slice(offset, offset + BACKFILL_UPLOAD_BATCH_SESSIONS),
+            });
+        }
+    }
+    return batches;
+}

package/dist/commands/backfill-candidates.js

@@ -0,0 +1,54 @@
+/**
+ * How backfill identifies and orders one archived session. The cursor key is
+ * the durable identity every later stage keys on — batches, durability, the
+ * resume cursor — so it is computed in exactly one place, from the source, the
+ * session id and a path normalized the same way on every host.
+ */
+import crypto from "node:crypto";
+import path from "node:path";
+export function isAfterCursor(candidate, cursor) {
+    const source = cursor.sources[candidate.source];
+    const oldest = source?.oldest_mtime_ms_processed;
+    if (oldest === null || oldest === undefined)
+        return true;
+    if (candidate.session_file_mtime_ms < oldest)
+        return true;
+    const key = candidateCursorKey(candidate);
+    if (candidate.session_file_mtime_ms === oldest) {
+        return !source.processed_keys_at_oldest_mtime.includes(key);
+    }
+    const newest = source.newest_mtime_ms_covered;
+    // A cursor written before upper-edge coverage existed gets one safe
+    // migration pass across the previously processed interval. Once that pass is
+    // acknowledged, subsequent --all runs only inspect genuinely newer files.
+    if (newest === null)
+        return true;
+    if (candidate.session_file_mtime_ms > newest)
+        return true;
+    if (candidate.session_file_mtime_ms < newest)
+        return false;
+    // A legacy cursor has no boundary identities. Rechecking the equal-time
+    // boundary is safe because durable evidence is content-addressed.
+    return !source.processed_keys_at_newest_mtime.includes(key);
+}
+export function compareBackfillCandidates(a, b) {
+    return (b.session_file_mtime_ms - a.session_file_mtime_ms ||
+        candidateCursorKey(a).localeCompare(candidateCursorKey(b)));
+}
+export function candidateCursorKey(candidate) {
+    return crypto
+        .createHash("sha256")
+        .update(JSON.stringify([
+        candidate.source,
+        candidate.session_id,
+        normalizedCursorPath(candidate.file_path),
+    ]))
+        .digest("hex");
+}
+function normalizedCursorPath(filePath) {
+    const windowsStyle = path.win32.isAbsolute(filePath) && !path.posix.isAbsolute(filePath);
+    if (windowsStyle)
+        return path.win32.normalize(filePath).toLowerCase();
+    const normalized = path.resolve(filePath);
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}