@bli-cockpit/cli 0.2.51 → 0.2.53

package/dist/evidence-reconcile-client.js

@@ -0,0 +1,224 @@
+/**
+ * Asks `POST /api/ambient/evidence/reconcile` about every hash this laptop
+ * can no longer classify on its own, then writes the answer into
+ * `cursors/raw-evidence-reconcile.json` so `disk-usage.ts` reads it back on
+ * every run after this one.
+ *
+ * BLI-3619. Three properties, same as the prune it feeds:
+ *
+ * - **Never deletes.** This module only asks and records; `disk-prune.ts`
+ *   decides what goes, unchanged.
+ * - **A server failure never blocks the prune.** A batch that cannot be asked
+ *   leaves its hashes exactly as unresolved as they were — still `unknown`
+ *   locally — and the run says `reconcile_unavailable: <reason>` rather than
+ *   throwing. The ordinary retention prune runs whether this succeeded,
+ *   partly succeeded, or could not run at all.
+ * - **Bounded.** `maxBatches` lets a caller (the daily sync fold) ask only one
+ *   batch of up to 500 hashes per tick rather than draining years of
+ *   accumulated `unknown` state in one request storm; `cockpit clean
+ *   --reconcile` itself asks every batch there is.
+ */
+import { EVIDENCE_RECONCILE_MAX_BATCH, EVIDENCE_RECONCILE_SCHEMA_VERSION, EvidenceReconcileResponseSchema, } from "@bli-cockpit/telemetry-core";
+import { describeError } from "./health-detail.js";
+import { getCollectorRuntimePaths, readLocalCollectorSessionFile } from "./local-state.js";
+import { readReconcileCursor, recordReconcileResult, writeReconcileCursor, } from "./cursors/raw-evidence-reconcile-cursor.js";
+import { readStagingInventory } from "./disk-usage.js";
+const RECONCILE_BATCH_TIMEOUT_MS = 15_000;
+/** The prune the sync tick and `cockpit clean --reconcile` both call. Never throws. */
+export async function runEvidenceReconcile(options) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    const now = options.now ?? new Date();
+    const doFetch = options.fetch ?? fetch;
+    try {
+        const inventory = options.inventory ?? (await readStagingInventory(paths, now));
+        const hashes = uniqueUnknownHashes(inventory);
+        if (hashes.length === 0) {
+            // No stderr line here on purpose: the sync tick calls this every 15
+            // minutes and the steady state is "nothing unknown" — logging that
+            // every tick forever is exactly the receipt-on-95-of-96-ticks spam the
+            // daily prune throttle exists to avoid. `cockpit clean --reconcile`
+            // still tells a person this on stdout (`reconcileLines` in clean.ts).
+            return emptyResult("nothing_unknown");
+        }
+        const session = await readLocalCollectorSessionFile(paths).catch(() => null);
+        if (!session ||
+            session.session_state !== "valid" ||
+            typeof session.device_token !== "string" ||
+            !session.device_token) {
+            const result = {
+                ...emptyResult("no_device_session"),
+                total_batches: chunk(hashes, EVIDENCE_RECONCILE_MAX_BATCH).length,
+            };
+            reportReconcile(result);
+            return result;
+        }
+        const batches = chunk(hashes, EVIDENCE_RECONCILE_MAX_BATCH);
+        const bounded = options.maxBatches != null ? batches.slice(0, options.maxBatches) : batches;
+        const cursor = await readReconcileCursor(paths);
+        let committed = 0;
+        let notCommitted = 0;
+        let unknownToServer = 0;
+        let failedBatches = 0;
+        let firstFailureReason = null;
+        let askedThisRun = 0;
+        for (const batch of bounded) {
+            const outcome = await sendReconcileBatch({
+                dashboardUrl: options.dashboardUrl,
+                deviceToken: session.device_token,
+                hashes: batch,
+                fetchImpl: doFetch,
+            });
+            if (!outcome.ok) {
+                failedBatches += 1;
+                firstFailureReason ??= outcome.reason;
+                continue;
+            }
+            askedThisRun += batch.length;
+            for (const item of outcome.results) {
+                recordReconcileResult(cursor, item.content_hash_sha256, {
+                    verdict: item.verdict,
+                    checked_at: now.toISOString(),
+                    server_committed_at: item.verdict === "committed" ? item.committed_at : null,
+                });
+                if (item.verdict === "committed")
+                    committed += 1;
+                else if (item.verdict === "not_committed")
+                    notCommitted += 1;
+                else
+                    unknownToServer += 1;
+            }
+        }
+        if (askedThisRun > 0) {
+            cursor.updated_at = now.toISOString();
+            await writeReconcileCursor(paths, cursor).catch((error) => {
+                // The prune's own forgetStagedObjects follows the same rule: the
+                // answer is not lost (the server has it), but a reader of THIS
+                // machine will ask again next run rather than silently drift.
+                console.error("[collector reconcile] reconcile cursor not written after answers landed", JSON.stringify({
+                    reason: "reconcile_cursor_write_failed",
+                    answered_count: askedThisRun,
+                    ...describeError(error),
+                }));
+            });
+        }
+        const result = {
+            status: askedThisRun > 0 ? "ok" : "fail",
+            reason: reconcileReason({
+                askedThisRun,
+                failedBatches,
+                firstFailureReason,
+                boundedShortOfAvailable: bounded.length < batches.length,
+            }),
+            asked: askedThisRun,
+            committed,
+            not_committed: notCommitted,
+            unknown_to_server: unknownToServer,
+            batches: bounded.length,
+            failed_batches: failedBatches,
+            total_batches: batches.length,
+        };
+        reportReconcile(result);
+        return result;
+    }
+    catch (error) {
+        const result = {
+            ...emptyResult(`reconcile_unavailable: ${describeError(error).error_name}`),
+            status: "fail",
+        };
+        console.error("[collector reconcile] the reconcile pass threw; nothing was answered or deleted", JSON.stringify({ reason: "reconcile_threw", ...describeError(error) }));
+        return result;
+    }
+}
+function reconcileReason(input) {
+    if (input.askedThisRun === 0) {
+        return `reconcile_unavailable: ${input.firstFailureReason ?? "unknown"}`;
+    }
+    if (input.failedBatches > 0)
+        return "reconciled_partial";
+    if (input.boundedShortOfAvailable)
+        return "reconciled_bounded";
+    return "reconciled";
+}
+/** Every `unknown`-state object's hash, deduplicated — the question is per hash. */
+function uniqueUnknownHashes(inventory) {
+    const hashes = new Set();
+    for (const pack of inventory.packs) {
+        for (const object of pack.objects) {
+            if (object.state === "unknown" && object.content_hash) {
+                hashes.add(object.content_hash);
+            }
+        }
+    }
+    return [...hashes];
+}
+function chunk(items, size) {
+    const batches = [];
+    for (let index = 0; index < items.length; index += size) {
+        batches.push(items.slice(index, index + size));
+    }
+    return batches;
+}
+async function sendReconcileBatch(options) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), RECONCILE_BATCH_TIMEOUT_MS);
+    try {
+        const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/evidence/reconcile`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${options.deviceToken}`,
+            },
+            body: JSON.stringify({
+                schema_version: EVIDENCE_RECONCILE_SCHEMA_VERSION,
+                items: options.hashes.map((hash) => ({ content_hash_sha256: hash })),
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            return { ok: false, reason: `http_${response.status}`, results: [] };
+        }
+        const body = await response.json().catch(() => null);
+        const parsed = EvidenceReconcileResponseSchema.safeParse(body);
+        if (!parsed.success) {
+            return { ok: false, reason: "invalid_response", results: [] };
+        }
+        return { ok: true, reason: "ok", results: parsed.data.results };
+    }
+    catch (error) {
+        return { ok: false, reason: describeError(error).error_name, results: [] };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function emptyResult(reason) {
+    return {
+        status: "skipped",
+        reason,
+        asked: 0,
+        committed: 0,
+        not_committed: 0,
+        unknown_to_server: 0,
+        batches: 0,
+        failed_batches: 0,
+        total_batches: 0,
+    };
+}
+/**
+ * The receipt, on stderr, exactly the shape the ticket names:
+ * `{asked, committed, not_committed, unknown_to_server, batches, failed_batches}`,
+ * plus `total_batches` so a bounded (daily-fold) run says the bound it hit.
+ * Metadata only — hashes and pack ids never travel in this line.
+ */
+function reportReconcile(result) {
+    console.error("[collector reconcile]", JSON.stringify({
+        reason: result.reason,
+        asked: result.asked,
+        committed: result.committed,
+        not_committed: result.not_committed,
+        unknown_to_server: result.unknown_to_server,
+        batches: result.batches,
+        total_batches: result.total_batches,
+        failed_batches: result.failed_batches,
+    }));
+}

package/dist/log-rotation.js

@@ -50,7 +50,8 @@ export async function rotateCollectorLogs(paths, options = {}) {
     const maxBytes = options.maxBytes ?? DEFAULT_LOG_ROTATION_MAX_BYTES;
     const keep = options.keep ?? DEFAULT_LOG_ROTATION_KEEP;
     const names = options.names ?? ROTATED_LOG_NAMES;
-    const result = { rotated: [], failures: [] };
+    const result = { rotated: [], failures: [], swept: [] };
+    result.swept = await sweepOrphanedLogArchives(paths, { keep, names });
     for (const name of names) {
         const filePath = path.join(paths.state_dir, name);
         const size = await fs
@@ -107,18 +108,114 @@ async function rotateOne(filePath, maxBytes, keep) {
         await handle.close();
     }
 }
+/**
+ * Archives of the tick's own logs that the keep window does not cover.
+ *
+ * BLI-3553 promised `maxBytes x (keep + 1)` per stream as the worst case on
+ * disk. Two shapes escape it, and both were sitting on the reference Mac on
+ * 2026-09-05 (BLI-3619):
+ *
+ * - `sync.log.4` and beyond — `rotateOne` unlinks exactly `.{keep}` and renames
+ *   downward, so an archive that already exists above the window is never
+ *   touched again. Lowering `keep`, or a machine that once ran a build with a
+ *   larger one, strands them forever.
+ * - `sync.log.tail-20260825` / `sync.err.log.tail-20260825`, 7 MB — a hand
+ *   rotation from before this module existed. They are tails of the same two
+ *   streams, superseded by `.1`…`.3`, and nothing in the codebase writes or
+ *   reads them.
+ *
+ * Each removal is named with its own byte count, because "the cap works" and
+ * "the cap works and also quietly deleted a file you made" are different
+ * sentences and an operator is owed the second one.
+ */
+export async function sweepOrphanedLogArchives(paths, options) {
+    const entries = await fs
+        .readdir(paths.state_dir, { withFileTypes: true })
+        .catch(() => []);
+    const swept = [];
+    for (const entry of entries) {
+        if (!entry.isFile())
+            continue;
+        const reason = orphanArchiveReason(entry.name, options);
+        if (!reason)
+            continue;
+        const file = path.join(paths.state_dir, entry.name);
+        const size = await fs
+            .stat(file)
+            .then((info) => info.size)
+            .catch(() => 0);
+        const removed = await fs.rm(file, { force: true }).then(() => true, () => false);
+        if (!removed)
+            continue;
+        swept.push({ name: entry.name, byte_size: size, reason });
+    }
+    return swept;
+}
+/**
+ * Which stream this file belongs to and why it is outside the keep window, or
+ * null when the rotation already accounts for it. Exact suffix matching only —
+ * `sync.log` never matches `sync.err.log`, and neither ever matches a file the
+ * collector did not write.
+ */
+function orphanArchiveReason(name, options) {
+    for (const stream of options.names) {
+        if (!name.startsWith(`${stream}.`))
+            continue;
+        const suffix = name.slice(stream.length + 1);
+        if (suffix.startsWith("tail-"))
+            return "manual_tail_archive";
+        if (!/^\d+$/u.test(suffix))
+            continue;
+        return Number(suffix) > options.keep ? "archive_beyond_keep" : null;
+    }
+    return null;
+}
+/** Live logs plus every archive beside them, for the disk row and `clean`. */
+export async function rotatedLogFootprint(paths, names = ROTATED_LOG_NAMES) {
+    const entries = await fs
+        .readdir(paths.state_dir, { withFileTypes: true })
+        .catch(() => []);
+    const footprint = {
+        live_bytes: 0,
+        archive_bytes: 0,
+        archive_count: 0,
+        total_bytes: 0,
+    };
+    for (const entry of entries) {
+        if (!entry.isFile())
+            continue;
+        const live = names.includes(entry.name);
+        const archive = names.some((stream) => entry.name.startsWith(`${stream}.`));
+        if (!live && !archive)
+            continue;
+        const size = await fs
+            .stat(path.join(paths.state_dir, entry.name))
+            .then((info) => info.size)
+            .catch(() => 0);
+        if (live) {
+            footprint.live_bytes += size;
+        }
+        else {
+            footprint.archive_bytes += size;
+            footprint.archive_count += 1;
+        }
+    }
+    footprint.total_bytes = footprint.live_bytes + footprint.archive_bytes;
+    return footprint;
+}
 /**
  * Rotates and says what happened, on both branches. Safe to call every tick:
  * the size check is one stat per file and a rotation is rare.
  */
 export async function rotateCollectorLogsBestEffort(paths, options = {}) {
-    let result = { rotated: [], failures: [] };
+    let result = { rotated: [], failures: [], swept: [] };
     try {
         result = await rotateCollectorLogs(paths, options);
     }
     catch (error) {
         result = {
             rotated: [],
+            swept: [],
             failures: [
                 {
                     name: "*",
@@ -137,6 +234,13 @@ export async function rotateCollectorLogsBestEffort(paths, options = {}) {
             archives_kept: rotated.archives,
         }));
     }
+    for (const swept of result.swept) {
+        console.error("[log-rotation] removed a log archive outside the keep window", JSON.stringify({
+            file: swept.name,
+            reason: swept.reason,
+            byte_size: swept.byte_size,
+        }));
+    }
     for (const failure of result.failures) {
         console.error("[log-rotation] could not cap a scheduled-tick log", JSON.stringify({ file: failure.name, reason: failure.reason }));
     }

package/dist/tower-stream.js

@@ -124,6 +124,10 @@ export async function readTowerTurn(response, options = {}) {
             options.onToken?.(item.event);
             continue;
         }
+        if (item.event.type === "revision") {
+            options.onRevision?.(item.event);
+            continue;
+        }
         activity.push(item.event);
         options.onActivity?.(item.event);
     }
@@ -277,7 +281,7 @@ function parseLine(line) {
         return { kind: "note", reason: "unexpected_event_type" };
     }
     const type = parsed.type;
-    if (type !== "activity" && type !== "token" && type !== "final") {
+    if (type !== "activity" && type !== "token" && type !== "revision" && type !== "final") {
         return { kind: "note", reason: "unexpected_event_type" };
     }
     return { kind: "event", event: parsed };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.51",
+  "version": "0.2.53",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.1",
-    "@bli-cockpit/telemetry-core": "0.1.26"
+    "@bli-cockpit/memory-mcp": "0.1.2",
+    "@bli-cockpit/telemetry-core": "0.1.27"
   }
 }