@bli-cockpit/cli 0.2.52 → 0.2.53

package/dist/commands/clean.js

@@ -16,6 +16,16 @@
  * object inside it is committed. Nothing here can delete evidence the upload
  * ledger did not vouch for; that line is in `disk-retention.ts` and this
  * command has no way to cross it.
+ *
+ * `--reconcile` (also under `--dry-run`) runs FIRST, before the footprint is
+ * even read: it asks the dashboard's own upload ledger about every `unknown`
+ * hash and writes the answer into `cursors/raw-evidence-reconcile.json`, so
+ * the footprint and plan below already see a server-confirmed `committed`
+ * object as committed and a server-confirmed absence as an ordinary,
+ * never-deleted `uncommitted` object rather than `unknown`. A reconcile
+ * failure is its own printed line and never blocks the rest of the command —
+ * the usual buckets print and the usual prune runs on whatever the local
+ * ledger already knew.
  */
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
@@ -24,12 +34,20 @@ import { writeLine } from "./cli-io.js";
 import { planFromDisk, runStagingPrune } from "../disk-prune.js";
 import { MANUAL_VAULT_PREFIX, readDiskFootprint, } from "../disk-usage.js";
 import { readRawEvidenceCursor } from "../cursors/raw-evidence-cursor.js";
-import { getCollectorRuntimePaths, } from "../local-state.js";
+import { runEvidenceReconcile, } from "../evidence-reconcile-client.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
 import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
 export async function runClean(command, io) {
     const paths = getCollectorRuntimePaths(command.homeDir);
     const now = new Date();
     const env = io.env ?? process.env;
+    const reconciled = command.reconcile
+        ? await reconcileUnknownPacks(command, paths, io, now)
+        : null;
+    if (reconciled && !command.json) {
+        for (const line of reconcileLines(reconciled))
+            writeLine(io.stdout, line);
+    }
     const footprint = await readDiskFootprint(paths, now);
     const plan = await planFromDisk(paths, env, { allCommitted: command.allCommitted }, now);
     const vaults = command.allCommitted
@@ -41,8 +59,9 @@ export async function runClean(command, io) {
         }
     }
     if (command.dryRun) {
-        if (command.json)
-            writeLine(io.stdout, cleanJson(footprint, plan, vaults, null));
+        if (command.json) {
+            writeLine(io.stdout, cleanJson(footprint, plan, vaults, null, reconciled));
+        }
         return 0;
     }
     const pruned = await runStagingPrune(paths, {
@@ -56,7 +75,7 @@ export async function runClean(command, io) {
     await rotateCollectorLogsBestEffort(paths);
     const removedVaults = await removeVaults(paths.state_dir, vaults, io);
     if (command.json) {
-        writeLine(io.stdout, cleanJson(footprint, plan, vaults, pruned));
+        writeLine(io.stdout, cleanJson(footprint, plan, vaults, pruned, reconciled));
         return pruned.status === "fail" ? 1 : 0;
     }
     writeLine(io.stdout, `Freed ${mb(pruned.deleted_bytes)} MB across ${pruned.deleted_files} file(s) and ${pruned.removed_packs} pack(s)${removedVaults > 0 ? `, plus ${removedVaults} evidence vault(s)` : ""}.`);
@@ -91,8 +110,42 @@ export function cleanLines(footprint, plan, vaults, command) {
     }
     return lines;
 }
-function cleanJson(footprint, plan, vaults, pruned) {
+/**
+ * `--reconcile`: ask the dashboard about every hash this laptop can no longer
+ * classify, before the footprint below is even read. Never throws — a server
+ * failure is `reconciled.status === "fail"` and the rest of `clean` runs
+ * exactly as if `--reconcile` had not been passed.
+ */
+async function reconcileUnknownPacks(command, paths, io, now) {
+    const config = await readLocalCollectorConfig(paths).catch(() => null);
+    const dashboardUrl = command.dashboardUrl ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL;
+    return runEvidenceReconcile({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        now,
+        fetch: io.fetch,
+    });
+}
+function reconcileLines(reconciled) {
+    if (reconciled.reason === "nothing_unknown") {
+        return ["Reconcile: nothing unknown to ask the server about."];
+    }
+    if (reconciled.status === "fail") {
+        return [
+            `Reconcile unavailable (${reconciled.reason}). Nothing was deleted based on this run's local memory alone; the usual buckets below are unaffected.`,
+        ];
+    }
+    const lines = [
+        `Reconcile: asked ${reconciled.asked} hash(es) across ${reconciled.batches}/${reconciled.total_batches} batch(es) — ${reconciled.committed} committed, ${reconciled.not_committed} not committed, ${reconciled.unknown_to_server} unknown to the server.`,
+    ];
+    if (reconciled.failed_batches > 0) {
+        lines.push(`  ${reconciled.failed_batches} batch(es) could not be asked this run; those hashes stay unknown until the next --reconcile.`);
+    }
+    return lines;
+}
+function cleanJson(footprint, plan, vaults, pruned, reconciled = null) {
     return JSON.stringify({
+        reconciled,
         staging: {
             pack_count: footprint.staging.pack_count,
             object_count: footprint.staging.object_count,

package/dist/commands/doctor.js

@@ -506,9 +506,14 @@ function diskRowMessage(footprint, capBytes) {
     const staging = footprint.staging;
     const parts = [
         `staging ${mib(staging.total_bytes)} MB (${mib(staging.committed_bytes)} committed / ${mib(staging.uncommitted_bytes)} uncommitted / ${mib(staging.unknown_bytes)} unknown) against a ${mib(capBytes)} MB cap`,
-        `logs ${mib(footprint.logs.total_bytes)} MB`,
-        `spool ${mib(footprint.spool_bytes)} MB`,
     ];
+    // BLI-3619's second half: "unknown" means the local ledger's own capped
+    // memory cannot say, never that delivery failed — and the one command that
+    // actually answers it is named right here, not left for a person to find.
+    if (staging.unknown_count > 0) {
+        parts.push(`${staging.unknown_count} object(s) unknown to this laptop's own ledger — run \`cockpit clean --reconcile\` to ask the server`);
+    }
+    parts.push(`logs ${mib(footprint.logs.total_bytes)} MB`, `spool ${mib(footprint.spool_bytes)} MB`);
     for (const vault of footprint.vaults) {
         parts.push(`${vault.name} ${mib(vault.byte_size)} MB (a one-off; \`cockpit clean --all-committed\` removes it only if every file in it is accepted)`);
     }

package/dist/commands/local-args-collector.js

@@ -603,17 +603,26 @@ export function parseMemoryArgs(args) {
  */
 export function parseCleanArgs(args) {
     const values = parseNamedArgs(args, {
-        allowedFlags: ["--home", "--dry-run", "--all-committed", "--json"],
-        valueFlags: ["--home"],
+        allowedFlags: [
+            "--home",
+            "--dashboard-url",
+            "--dry-run",
+            "--all-committed",
+            "--reconcile",
+            "--json",
+        ],
+        valueFlags: ["--home", "--dashboard-url"],
     });
     if (values.positionals.length > 0) {
-        throw new Error("clean takes no arguments; use --dry-run or --all-committed.");
+        throw new Error("clean takes no arguments; use --dry-run, --all-committed, or --reconcile.");
     }
     return {
         kind: "clean",
         homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
         dryRun: values.booleans.has("--dry-run"),
         allCommitted: values.booleans.has("--all-committed"),
+        reconcile: values.booleans.has("--reconcile"),
         json: values.booleans.has("--json"),
     };
 }

package/dist/commands/local-help.js

@@ -77,7 +77,7 @@ export function localCommandHelp(command) {
         "  cockpit autostart [install|uninstall|status] [--workspace <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
         "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",
         "  cockpit memory [install|status] [--dashboard-url <url>] [--dry-run] [--json]",
-        "  cockpit clean [--dry-run] [--all-committed] [--json]",
+        "  cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
         "  cockpit release [--dry-run] [--skip-checks] [--no-floor] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
         "",
         `Default dashboard: ${DEFAULT_DASHBOARD_URL}. Omit --dashboard-url for normal production use; pass it only for staging/custom dashboards or to force a different pairing.`,
@@ -551,7 +551,7 @@ function localSubcommandHelp(command) {
         [
             "clean",
             [
-                "Usage: cockpit clean [--dry-run] [--all-committed] [--json]",
+                "Usage: cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
                 "",
                 "Reclaims this machine's disk. Prints what it would delete and why, per bucket,",
                 "then deletes: staged evidence Tower has already accepted goes after a 48-hour",
@@ -560,8 +560,16 @@ function localSubcommandHelp(command) {
                 "--dry-run stops after the printing. --all-committed drops the retry window,",
                 "so every already-accepted copy goes now, and is the only thing that removes a",
                 "manual-study-evidence-vault folder (and only when every file in it is accepted).",
-                "The scheduled sync does the same prune once a day; this is the door for a",
-                "laptop that is full right now.",
+                "--reconcile asks Tower's own upload ledger about every object this machine's",
+                "local memory can no longer classify (\"unknown\") before the buckets print — a",
+                "confirmed-committed pack prunes under the ordinary rule this same run; a pack",
+                "the server has never seen becomes an ordinary, never-deleted \"uncommitted\"",
+                "object instead of \"unknown\". A server failure never blocks the rest of clean",
+                "and is printed on its own line. Combine with --dry-run to ask and print",
+                "without deleting.",
+                "The scheduled sync does the same prune once a day (reconciling one batch first",
+                "when there is anything unknown); this is the door for a laptop that is full",
+                "right now.",
             ],
         ],
         [

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.52");
+    writeLine(io?.stdout ?? process.stdout, "0.2.53");
     return 0;
   }
 

package/dist/commands/session-sync-attribution.js

@@ -0,0 +1,55 @@
+/**
+ * Which sessions live sync may collect, and which worktrees it collects them
+ * through.
+ *
+ * One place answers all four questions the rest of the pass asks about an
+ * attribution result: is this state collectable at all, does this result belong
+ * to the worktree currently syncing, which worktrees are targets this tick, and
+ * does a cursor entry still owe a retry. Live sync is reason-ALLOWLISTED where
+ * historical backfill is not, so these answers are deliberately narrower than
+ * the shared policy in `raw-evidence-attribution-policy.ts` and must not be
+ * re-derived anywhere else.
+ */
+import { isLiveRawEvidenceSyncAttribution } from "../raw-evidence-attribution-policy.js";
+/**
+ * Live sync remains reason-allowlisted even though historical backfill accepts
+ * every deterministic fallback state.
+ */
+export function isLiveSyncCollectableAttributionState(state, reason, hasApprovedWorkspace = false) {
+    return isLiveRawEvidenceSyncAttribution(state, reason, hasApprovedWorkspace);
+}
+export function liveSyncCursorEntryRequiresRetry(entry) {
+    return (!entry.uploaded_object_key &&
+        (isLiveSyncCollectableAttributionState(entry.state, entry.reason, Boolean(entry.worktree_fingerprint)) || entry.reason === "repo_not_on_disk"));
+}
+export function matchesLiveSyncWorktree(result, target) {
+    return (isLiveRawEvidenceSyncAttribution(result.state, result.reason, result.worktree !== null) &&
+        result.worktree !== null &&
+        liveSyncTargetKey(result.worktree) === liveSyncTargetKey(target));
+}
+export function liveSyncTargetKey(worktree) {
+    return `${worktree.repo_fingerprint}:${worktree.worktree_fingerprint}`;
+}
+/**
+ * Folder and deleted-repo fallbacks can intentionally synthesize a worktree
+ * identity that is not present in git discovery. Include those identities as
+ * sync targets so a wrapper-root session is not observed and then stranded.
+ */
+export function liveSyncTargetWorktrees(discovered, results) {
+    const targets = [...discovered];
+    const seen = new Set(discovered.map(liveSyncTargetKey));
+    for (const result of results) {
+        const targetKey = result.worktree
+            ? liveSyncTargetKey(result.worktree)
+            : null;
+        if (!isLiveSyncCollectableAttributionState(result.state, result.reason, result.worktree !== null) ||
+            !result.worktree ||
+            !targetKey ||
+            seen.has(targetKey)) {
+            continue;
+        }
+        seen.add(targetKey);
+        targets.push(result.worktree);
+    }
+    return targets;
+}

package/dist/commands/session-sync-failures.js

@@ -0,0 +1,140 @@
+/**
+ * The ONE place a sync writes down that something failed, and what it is called.
+ *
+ * Every reason label this pass can produce is written here and nowhere else, so
+ * the closed registry in `sync-health-class.ts` can be checked against a single
+ * file: `sync-health-class.test.ts` reads this source and refuses a label with
+ * no declared class (BLI-3551). Two consequences bind anyone editing this file:
+ * the ledger's methods keep the names `add` and `fail`, because that test reads
+ * those exact call shapes, and a new label goes in the registry first.
+ *
+ * The recorders below are the decision table itself — worktree delivery, source
+ * scan, the unposted session report, and the sentinel for a gate that fired
+ * without saying why.
+ */
+import { claudeAttributionReadFailureCount, codexAttributionReadFailureCount, } from "./agent-session-report.js";
+import { sourceScanFailureReason } from "./session-sync-scan.js";
+/**
+ * The label used when a sync fails and nothing on the way there said why.
+ *
+ * A deliberate sentinel rather than a fallback to `sync_failed`: it means the
+ * gate is real but its reason is unrecorded, which is a bug in this file, and
+ * it should be visible as one instead of blending into the generic bucket.
+ */
+export const SYNC_FAILED_WITHOUT_REASON = "sync_failed_reason_not_recorded";
+export function createSyncFailureLedger() {
+    const recordsByRenderedReason = new Map();
+    const add = (record) => {
+        if (!recordsByRenderedReason.has(record.rendered)) {
+            recordsByRenderedReason.set(record.rendered, record);
+        }
+    };
+    return {
+        add,
+        fail(condition, label, rendered = label) {
+            if (condition)
+                add({ label, rendered });
+        },
+        isEmpty: () => recordsByRenderedReason.size === 0,
+        sortedRecords: () => [...recordsByRenderedReason.values()].sort((a, b) => a.rendered.localeCompare(b.rendered)),
+    };
+}
+/**
+ * Every worktree that did not finish, and every raw-evidence gap it reported.
+ *
+ * The spooled reason is the most specific thing anyone has, so it leads, and it
+ * names the worktree it belongs to — a fleet failure is usually one repo, and
+ * "which one" is the first question asked.
+ */
+export function recordWorktreeDeliveryFailures(ledger, outcomes) {
+    for (const { worktree, sync } of outcomes) {
+        if (sync.status !== "uploaded") {
+            ledger.add(sync.status === "spooled" && sync.failure_reason
+                ? {
+                    label: sync.failure_class,
+                    rendered: `${worktree.worktree_label}:${sync.failure_reason}`,
+                    http_status: sync.failure_http_status,
+                }
+                : {
+                    label: "upload_not_completed",
+                    rendered: `${worktree.worktree_label}:upload_${sync.status}`,
+                });
+        }
+        for (const reason of sync.raw_evidence_failure_reasons ?? []) {
+            ledger.add({
+                label: "raw_evidence_upload_failed",
+                rendered: `raw_evidence:${reason}`,
+            });
+        }
+        for (const reason of sync.raw_evidence_retry_reasons ?? []) {
+            ledger.add({
+                label: "raw_evidence_retry_required",
+                rendered: `raw_evidence_retry:${reason}`,
+            });
+        }
+        ledger.fail(sync.raw_evidence_deferred_byte_budget > 0, "deferred_byte_budget");
+        ledger.fail(sync.raw_evidence_deferred_object_budget > 0, "deferred_object_budget");
+    }
+}
+/**
+ * What the scan itself got wrong: a window that hit its cap, sessions that
+ * could not be read, or a session store that could not be read at all.
+ *
+ * BLI-3551: the scan's RETRY reason and the scan's FAILURE reason are two
+ * different questions, and answering both with one function is what put
+ * `claude_scan:repo_not_on_disk` on every tick of three machines. A repo that
+ * is not on disk is a label on the session (the attribution umbrella finding:
+ * nothing was deleted, the transcript simply names a path git no longer
+ * knows). It still widens the next scan window; it is not a failed sync.
+ */
+export function recordSourceScanFailures(ledger, scan) {
+    const { codexAttribution, claudeAttribution } = scan;
+    ledger.fail(codexAttribution.session_limit_applied, "codex_session_limit_applied");
+    ledger.fail(claudeAttribution.session_limit_applied, "claude_session_limit_applied");
+    ledger.fail(codexAttributionReadFailureCount(codexAttribution) > 0, "codex_session_read_failed");
+    ledger.fail(claudeAttributionReadFailureCount(claudeAttribution) > 0, "claude_session_read_failed");
+    const codexScanFailure = sourceScanFailureReason("codex", codexAttribution);
+    if (codexScanFailure) {
+        ledger.add({
+            label: "codex_scan_read_failed",
+            rendered: `codex_scan:${codexScanFailure}`,
+        });
+    }
+    const claudeScanFailure = sourceScanFailureReason("claude_code", claudeAttribution);
+    if (claudeScanFailure) {
+        ledger.add({
+            label: "claude_scan_read_failed",
+            rendered: `claude_scan:${claudeScanFailure}`,
+        });
+    }
+}
+/**
+ * A report that was owed and did not go out — unless the reason it did not go
+ * out is that there was nothing inside the approved roots to report.
+ *
+ * BLI-3551: a tick that observed only sessions from outside the operator's
+ * approved roots has nothing to post, and that is the consent boundary
+ * working — not a failure. It used to fail as
+ * `session_report_unposted:no_successful_sync`, whose word "session" then
+ * classified as `auth_failed`; one machine reported a broken credential 377
+ * times in 38 hours while its token had eleven weeks left. The withhold
+ * decision itself is untouched (adapters/attribution-core.ts) — only what it
+ * is CALLED.
+ */
+export function recordUnpostedSessionReportFailure(ledger, options) {
+    const report = options.delivery.report;
+    ledger.fail(options.delivery.reportRequired &&
+        !report.posted &&
+        !options.explainedByNothingInRoot, "session_report_unposted", `session_report_unposted:${report.reason ?? "unknown"}`);
+}
+/**
+ * A gate that fired without recording a reason still has to say so. Reached
+ * only when `ok` is false and the ledger is empty, which is a bug in this
+ * family rather than a condition of the machine.
+ */
+export function recordUnexplainedFailure(ledger) {
+    ledger.add({
+        label: SYNC_FAILED_WITHOUT_REASON,
+        rendered: SYNC_FAILED_WITHOUT_REASON,
+    });
+}

package/dist/commands/session-sync-health.js

@@ -0,0 +1,102 @@
+/**
+ * The verdict on one tick — and the one true thing said about a tick that did
+ * not fail.
+ *
+ * This used to be a single boolean chain: correct, and completely mute. A
+ * failed sync exited 1 saying only `sync_failed`, which named no cause and
+ * supported no repair (BLI-2526). The conditions are unchanged; they are now
+ * asked in order, each answered by a recorder in `session-sync-failures.ts`
+ * that writes the closed-registry LABEL the health receipt is classified by.
+ * Nothing here parses a rendered sentence back apart.
+ */
+import { createSyncFailureLedger, recordSourceScanFailures, recordUnexplainedFailure, recordUnpostedSessionReportFailure, recordWorktreeDeliveryFailures, } from "./session-sync-failures.js";
+/**
+ * Decide whether this tick failed, and record every condition that decided it.
+ *
+ * The order below is the decision table: what delivery got wrong, what the scan
+ * got wrong, whether the report was owed, and only then whether the run is ok.
+ */
+export function decideSyncHealth(options) {
+    const { outcomes } = options.worktreePass;
+    const ledger = createSyncFailureLedger();
+    recordWorktreeDeliveryFailures(ledger, outcomes);
+    recordSourceScanFailures(ledger, options.scan);
+    const sessionsOutsideRoot = options.sessions.filter((session) => OUTSIDE_APPROVED_ROOT_REASONS.has(session.attribution_reason)).length;
+    const nothingInRoot = nothingInRootCount({
+        sessionCount: options.sessions.length,
+        outsideRootCount: sessionsOutsideRoot,
+        outcomes,
+        reportPosted: options.delivery.report.posted,
+        reportReason: options.delivery.report.reason,
+    });
+    recordUnpostedSessionReportFailure(ledger, {
+        delivery: options.delivery,
+        explainedByNothingInRoot: nothingInRoot !== null,
+    });
+    // `everyWorktreeUploaded` may already be false; the delivery recorder above
+    // re-derives that from the same outcomes, so the two agree by construction.
+    const ok = options.worktreePass.everyWorktreeUploaded && ledger.isEmpty();
+    if (!ok && ledger.isEmpty()) {
+        recordUnexplainedFailure(ledger);
+    }
+    const notice = ok && nothingInRoot !== null ? `nothing_in_root:${nothingInRoot}` : null;
+    if (nothingInRoot !== null && notice) {
+        announceNothingInRoot(nothingInRoot, options.collectionRootCount);
+    }
+    const records = ledger.sortedRecords();
+    return {
+        ok,
+        failure_reasons: records.map((record) => record.rendered),
+        failure_records: records,
+        notice,
+        sessions_outside_root: sessionsOutsideRoot,
+    };
+}
+/**
+ * Reasons attribution gives when a session's working directory is not inside
+ * any approved collection root.
+ *
+ * Exact labels, not a pattern — the same discipline the classifier now follows.
+ * `attribution-core.ts` writes both of these and nothing else means
+ * "outside the boundary".
+ */
+const OUTSIDE_APPROVED_ROOT_REASONS = new Set([
+    "cwd_outside_scanned_worktrees",
+    "no_matching_worktree_signals",
+]);
+/**
+ * How many observed sessions were outside the approved roots, when that
+ * accounts for ALL of them and nothing else went wrong — otherwise `null`.
+ *
+ * Deliberately narrow. It requires that no worktree was synced at all (so no
+ * upload could have succeeded or failed), that every session observed this tick
+ * names an outside-the-root reason, and that the unposted report is the
+ * `no_successful_sync` shape rather than a spooled report that failed to flush.
+ * Anything else keeps its failure.
+ */
+export function nothingInRootCount(options) {
+    if (options.reportPosted)
+        return null;
+    if (options.reportReason !== "no_successful_sync")
+        return null;
+    if (options.outcomes.length > 0)
+        return null;
+    if (options.sessionCount === 0)
+        return null;
+    return options.outsideRootCount === options.sessionCount
+        ? options.outsideRootCount
+        : null;
+}
+/**
+ * The success branch says something too: this is the receipt that proves a
+ * quiet machine is a working machine, and the count is what tells a coach that
+ * someone is working entirely outside the approved boundary.
+ */
+function announceNothingInRoot(sessionsOutsideRoot, collectionRootCount) {
+    console.error("[session-sync] nothing to collect inside the approved roots", JSON.stringify({
+        reason: "nothing_in_root",
+        sessions_outside_root: sessionsOutsideRoot,
+        collection_root_count: collectionRootCount,
+        next_action: "widen the approved roots (an operator decision) if this machine should be collecting here",
+    }));
+}

package/dist/commands/session-sync-plan.js

@@ -0,0 +1,81 @@
+/**
+ * What this tick is bound by before it reads a single session file.
+ *
+ * Every read here degrades on purpose: a missing or corrupt local file becomes
+ * an empty cursor or a null spool, because a collector that cannot read its own
+ * bookkeeping must still collect. The one decision this step makes that changes
+ * what gets collected is the retry width — whether a source reopens all local
+ * history instead of its normal live window.
+ */
+import { readLocalCollectorConfig, } from "../local-state.js";
+import { CLAUDE_CURSOR_FILENAME, emptyRawEvidenceCursorState, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { normalizeCollectionRoots } from "../root-normalization.js";
+import { readLocalUploadSpoolState, } from "../spool/local-spool.js";
+import { liveSyncCursorEntryRequiresRetry } from "./session-sync-attribution.js";
+/**
+ * Read the local state this sync is bound by — config, both cursors, the upload
+ * spool — and turn it into the decisions the rest of the pass reads.
+ *
+ * Every read here degrades on purpose: a missing or corrupt local file becomes
+ * an empty cursor or a null spool, because a collector that cannot read its own
+ * bookkeeping must still collect.
+ */
+export async function planSyncFromLocalState(options) {
+    const config = await readLocalCollectorConfig(options.paths).catch(() => null);
+    const claudeEnabled = config?.collect_claude_jsonl !== false;
+    const collectionRoots = normalizeCollectionRoots(options.approvedCollectionRoots ?? config?.default_repo_paths ?? []);
+    const [codexCursorBefore, claudeCursorBefore, uploadSpool] = await Promise.all([
+        readRawEvidenceCursor(options.paths).catch(() => emptyRawEvidenceCursorState()),
+        claudeEnabled
+            ? readRawEvidenceCursor(options.paths, {
+                filename: CLAUDE_CURSOR_FILENAME,
+            }).catch(() => emptyRawEvidenceCursorState())
+            : Promise.resolve(emptyRawEvidenceCursorState()),
+        readLocalUploadSpoolState(options.paths).catch(() => null),
+    ]);
+    // A spooled upload from a CLI old enough not to have recorded its source
+    // could have come from either one, so both sources own it until it clears.
+    const legacyRetryPending = Boolean(uploadSpool?.pending_uploads.some((entry) => entry.raw_evidence_file_count > 0 && entry.retry_sources.length === 0));
+    const codexSourceRetryPending = sourceScanRetryIsPending(uploadSpool, "codex");
+    const claudeSourceRetryPending = sourceScanRetryIsPending(uploadSpool, "claude_code");
+    return {
+        claudeEnabled,
+        collectionRoots,
+        codexCursorBefore,
+        claudeCursorBefore,
+        uploadSpool,
+        codexSourceRetryPending,
+        claudeSourceRetryPending,
+        codexRetryPending: sourceHasPendingRetries("codex", uploadSpool, legacyRetryPending, codexSourceRetryPending, codexCursorBefore),
+        claudeRetryPending: claudeEnabled &&
+            sourceHasPendingRetries("claude_code", uploadSpool, legacyRetryPending, claudeSourceRetryPending, claudeCursorBefore),
+        allHistorySinceMinutes: allLocalHistorySinceMinutes(options.now),
+    };
+}
+function allLocalHistorySinceMinutes(now) {
+    // A cutoff just before the Unix epoch is effectively unbounded for Codex and
+    // Claude session files while keeping date arithmetic finite and portable.
+    return Math.ceil(now.getTime() / 60_000) + 24 * 60;
+}
+/** Whether the spool already recorded a source-scan retry for this source. */
+function sourceScanRetryIsPending(uploadSpool, source) {
+    return Boolean(uploadSpool?.pending_source_retries.some((entry) => entry.source === source));
+}
+/**
+ * Does this source have a reason to widen its scan window to all local
+ * history instead of the normal live-sync window? Used to be two separately
+ * written boolean chains, one per source, that happened to agree on shape by
+ * hand — asymmetric to read even though the rule is identical for both
+ * (BLI-3394): a legacy spooled upload with no recorded source, a scan-retry
+ * the spool already remembers, a spooled upload that names this source, or an
+ * undurable session this source's own cursor is still carrying.
+ */
+function sourceHasPendingRetries(source, uploadSpool, legacyRetryPending, sourceScanRetryPending, cursor) {
+    return (legacyRetryPending ||
+        sourceScanRetryPending ||
+        Boolean(uploadSpool?.pending_uploads.some((entry) => entry.retry_sources.includes(source))) ||
+        cursorHasUndurableCollectableSession(cursor));
+}
+function cursorHasUndurableCollectableSession(cursor) {
+    return Object.values(cursor.sessions).some((entry) => liveSyncCursorEntryRequiresRetry(entry));
+}