@bli-cockpit/cli 0.2.54 → 0.2.55

package/dist/commands/local-help.js

@@ -64,7 +64,7 @@ export function localCommandHelp(command) {
         "  cockpit ops [status [--job <id>] [--skips] | recompile --person <email|name|id> [--dry-run]] [--dashboard-url <url>] [--json]",
         "  cockpit slack [coverage [--workspace bli|blue_pearl] [--stale-only] | read [--person <p>] [--channel <c>] [--query <text>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>]] [--json]",
         "  cockpit settings [personal [--chat-model <key>] [--brief-model <key>] | switches [set <key> <value>] | models [set --chat <key>] [--memory <id>] | cli-floor [<version>] | env list|set --project <p> --file <f> --content-stdin|delete --id <uuid> [--yes]] [--json]",
-        "  cockpit team [members | invite <email> --role <role> [--team-id <uuid>] | role <userId> --role <role> [--yes]] [--json]",
+        "  cockpit team [members | invite <email> --role <role> [--team-id <uuid>] | role <userId> --role <role> [--yes] | device [list] | device revoke <id|name> --reason <label> [--note \"<text>\"] [--yes]] [--json]",
         "  cockpit workbook [<project> [<doc>]] [--section <id>] [--markdown] [--width <n>] [--dashboard-url <url>] [--json]",
         "  cockpit brief [edit|rewrite|history] [--for <person>] [--date <YYYY-MM-DD>] [--delta [--against <YYYY-MM-DD>]] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--days <n>] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
         "  cockpit brief status [--who <person>] [--render] [--dashboard-url <url>] [--json]",
@@ -223,7 +223,7 @@ function localSubcommandHelp(command) {
         [
             "team",
             [
-                "Usage: cockpit team [members | invite <email> --role <role> | role <userId> --role <role>] [--json]",
+                "Usage: cockpit team [members | invite <email> --role <role> | role <userId> --role <role> | device [list] | device revoke <id|name> --reason <label>] [--json]",
                 "",
                 "  cockpit team [members]",
                 "      Everyone on your team — roster and accounts together, with each person's id.",
@@ -232,6 +232,14 @@ function localSubcommandHelp(command) {
                 "      Admin only. Defaults to your own team; Tower emails them a sign-in link.",
                 "  cockpit team role <userId> --role <role> [--yes]",
                 "      Admin only. Asks first unless --yes. You cannot change your own role.",
+                "  cockpit team device [list] [--json]",
+                "      Every paired collector device: name, id, trust state, owner, and why",
+                "      (revoked reason, or when it was approved, or that it's still waiting).",
+                "      Admin only.",
+                "  cockpit team device revoke <id|name> --reason <label> [--note \"<text>\"] [--yes]",
+                "      Admin only. Names the device, asks first unless --yes, then revokes it —",
+                "      this cannot be undone. --reason must be one of: stale_test_pairing,",
+                "      machine_retired, person_left, re_pairing, other.",
             ],
         ],
         [

package/dist/commands/onboard-completion.js

@@ -0,0 +1,136 @@
+import { errorMessage, writeLine } from "./cli-io.js";
+import { agentRuleHostLabel } from "./agent-rules-command.js";
+import { autostartLocationLine } from "./autostart-command.js";
+import { backfillRetryCommand, runBackfill, } from "./backfill.js";
+import { addInstallEvent, reportInstallEventsBestEffort } from "./install-receipts.js";
+import { addAutostartInstallEvent, addOnboardFailureEvent, classifyOnboardBlocker, onboardAutostartFailed, } from "./onboard-receipts.js";
+import { nextStepForOnboardBlocker, onboardAgentRulesInstallLine, onboardJsonPayload, writeOnboardJson, } from "./onboard-report.js";
+import { installAgentRules } from "../agent-rules.js";
+import { installAutostartAgent } from "../autostart.js";
+import { inspectLocalCollectorStatus, } from "../local-state.js";
+function requiredOnboardBackfillCommand(command) {
+    return {
+        homeDir: command.homeDir,
+        all: true,
+        dryRun: false,
+        maxDepth: command.maxDepth,
+        maxRepos: command.maxRepos,
+        yes: true,
+        json: true,
+    };
+}
+export async function runRequiredOnboardBackfill(command, io) {
+    const backfillCommand = requiredOnboardBackfillCommand(command);
+    const retryCommand = backfillRetryCommand(backfillCommand);
+    try {
+        const result = await runBackfill(backfillCommand, io);
+        return {
+            status: result.status,
+            failureReason: result.status === "complete"
+                ? null
+                : result.failure_reason ?? `backfill_${result.status}`,
+            retryCommand: result.retry_command,
+            result,
+        };
+    }
+    catch (error) {
+        return {
+            status: "failed",
+            failureReason: errorMessage(error),
+            retryCommand,
+            result: null,
+        };
+    }
+}
+/** The last two setup steps of a successful onboard, in the order both arms run them. */
+export async function completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io) {
+    const agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
+    addInstallEvent(installEvents, "agent_rules", "ok");
+    const autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
+    addAutostartInstallEvent(installEvents, autostart);
+    return { agentRules, autostart, ok: !onboardAutostartFailed(autostart) };
+}
+async function refreshOnboardAgentRules(command, roots, io) {
+    const result = await installAgentRules({
+        homeDir: command.homeDir,
+        scopePaths: roots,
+    });
+    if (command.json)
+        return result;
+    writeLine(io.stdout, `Agent rules: ${onboardAgentRulesInstallLine(result)}`);
+    for (const target of result.targets) {
+        writeLine(io.stdout, `${agentRuleHostLabel(target.host)}: ${target.rules_file}`);
+    }
+    return result;
+}
+/** Refreshes the host autostart backend after successful onboarding. */
+async function refreshOnboardAutostart(command, roots, io) {
+    if (!io.exec)
+        return null;
+    const result = await installAutostartAgent({
+        homeDir: command.homeDir,
+        repoRoot: roots[0],
+        repoRoots: roots,
+        dashboardUrl: command.dashboardUrl,
+        exec: io.exec,
+    });
+    if (command.json)
+        return result;
+    if (result.status === "unsupported") {
+        writeLine(io.stdout, `Background autostart unsupported: ${result.message}`);
+        return result;
+    }
+    writeLine(io.stdout, result.loaded
+        ? "Background autostart refreshed; Tower syncs at login and every 15 min."
+        : "Background autostart refreshed, but the operating-system scheduler reported a problem; check `cockpit autostart status`.");
+    writeLine(io.stdout, autostartLocationLine(result));
+    return result;
+}
+/**
+ * Every onboard exit funnels through here so the best-effort install-event
+ * report always fires, pass or blocked — replaces a `finish` closure that used
+ * to live inside `runOnboard` so the flow functions below can call it too.
+ */
+export async function finishOnboardRun(command, installEvents, io, code) {
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        command: "onboard",
+        events: installEvents,
+        json: command.json,
+        io,
+    });
+    return code;
+}
+/**
+ * Every uncaught error from either onboarding arm lands here. `status` is
+ * always recomputed fresh against whichever root got furthest, never trusted
+ * from before the throw — the arms already recompute it themselves on their
+ * own success paths, so nothing upstream is lost by not threading it through.
+ */
+export async function handleOnboardFailure(error, command, rootsResult, install, pair, sync, installEvents, io) {
+    const message = errorMessage(error);
+    const statusRoot = rootsResult?.roots[0] ?? command.repoRoot;
+    const status = statusRoot
+        ? await inspectLocalCollectorStatus({
+            homeDir: command.homeDir,
+            repoRoot: statusRoot,
+            branch: command.branch,
+        }).catch(() => null)
+        : null;
+    const blocker = classifyOnboardBlocker(message);
+    addOnboardFailureEvent(installEvents, blocker);
+    const nextStep = nextStepForOnboardBlocker(blocker, command);
+    if (command.json) {
+        writeOnboardJson(io, onboardJsonPayload("blocked", command, install, pair, sync, status, rootsResult, {
+            blocker,
+            message,
+            next_step: nextStep,
+        }));
+    }
+    else {
+        writeLine(io.stderr, `BLOCKED: ${message}`);
+        writeLine(io.stderr, `Next: ${nextStep}`);
+    }
+    return finishOnboardRun(command, installEvents, io, 1);
+}

package/dist/commands/onboard-flows.js

@@ -0,0 +1,165 @@
+import { writeLine } from "./cli-io.js";
+import { attributedSyncRunStatus, shortSha, worktreeSyncRow, writeAgentSessionSummary, } from "./collection-report.js";
+import { collectionRootConsentAliases } from "./collection-roots.js";
+import { addInstallEvent } from "./install-receipts.js";
+import { completeOnboardingSetup, finishOnboardRun, runRequiredOnboardBackfill, } from "./onboard-completion.js";
+import { onboardJsonPayload, reportOnboardMultiRepoResult, reportOnboardSyncBlocked, writeOnboardAutostartBlocker, writeOnboardBackfillBlockedResult, writeOnboardLiveStatus, writeOnboardMultiRepoSyncBlocked, writeOnboardSingleRepoResultJson, writeOnboardUploadNarrative, writeOnboardWorkContextStarted, } from "./onboard-report.js";
+import { runAttributedWorktreeSync, } from "./session-sync.js";
+import { inspectLocalCollectorStatus, startLocalWorkContext, } from "../local-state.js";
+/** The parent-folder arm: sync every discovered worktree, then backfill and finish setup once. */
+export async function runOnboardMultiRepoFlow(ctx) {
+    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
+    const multi = await runMultiRepoOnboard(resolvedCommand, io, worktrees);
+    addInstallEvent(installEvents, "work_context", "ok");
+    addInstallEvent(installEvents, "sync", multi.ok ? "ok" : "fail", multi.ok ? undefined : "sync_blocked");
+    if (!multi.ok) {
+        if (command.json)
+            writeOnboardMultiRepoSyncBlocked(ctx, multi);
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
+    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
+    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
+        ? undefined
+        : backfill.failureReason ?? "backfill_incomplete");
+    if (!completedBackfill) {
+        writeOnboardBackfillBlockedResult(io, {
+            json: command.json,
+            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, null, null, rootsResult),
+            extra: {
+                mode: "multi_repo",
+                repos: multi.results,
+                codex_sessions: multi.codex_sessions,
+            },
+            backfill,
+        });
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    const multiSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
+    reportOnboardMultiRepoResult(ctx, {
+        multi,
+        backfill: completedBackfill,
+        setup: multiSetup,
+    });
+    return finishOnboardRun(command, installEvents, io, multiSetup.ok ? 0 : 1);
+}
+/** The single-repo arm: start the work context, sync it, backfill, then finish setup once. */
+export async function runOnboardSingleRepoFlow(ctx, single) {
+    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
+    const worktreeRoot = worktrees[0]?.repo_root ?? single.primaryRoot;
+    const context = await startLocalWorkContext({
+        homeDir: command.homeDir,
+        repoRoot: worktreeRoot,
+        branch: command.branch,
+        activeTicketId: command.activeTicketId,
+    });
+    if (!command.json)
+        writeOnboardWorkContextStarted(io, context);
+    addInstallEvent(installEvents, "work_context", "ok");
+    const run = await runAttributedWorktreeSync({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        collectionRoots: single.attributionCollectionRoots,
+        startContexts: false,
+        worktrees,
+        fetchImpl: io.fetch,
+    });
+    const sync = run.outcomes[0]?.sync ?? null;
+    single.syncHolder.current = sync;
+    if (!sync) {
+        throw new Error("Onboard sync produced no result for the repo worktree.");
+    }
+    const status = await inspectLocalCollectorStatus({
+        homeDir: command.homeDir,
+        repoRoot: worktreeRoot,
+        branch: command.branch,
+    });
+    if (!run.ok || sync.status !== "uploaded") {
+        addInstallEvent(installEvents, "sync", "fail", "sync_blocked");
+        reportOnboardSyncBlocked(ctx, { run, sync, status, worktreeRoot });
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    addInstallEvent(installEvents, "sync", "ok");
+    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
+    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
+    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
+        ? undefined
+        : backfill.failureReason ?? "backfill_incomplete");
+    if (!completedBackfill) {
+        writeOnboardBackfillBlockedResult(io, {
+            json: command.json,
+            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, sync, status, rootsResult),
+            extra: { codex_sessions: run.summary },
+            backfill,
+        });
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    if (command.json) {
+        const jsonSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
+        writeOnboardSingleRepoResultJson(ctx, {
+            run,
+            sync,
+            status,
+            backfill: completedBackfill,
+            setup: jsonSetup,
+        });
+        return finishOnboardRun(command, installEvents, io, jsonSetup.ok ? 0 : 1);
+    }
+    writeOnboardUploadNarrative(io, { command, run, sync, status });
+    const setup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
+    const { agentRules, autostart } = setup;
+    if (!setup.ok) {
+        writeOnboardAutostartBlocker(io, autostart);
+        return finishOnboardRun(command, installEvents, io, 1);
+    }
+    writeLine(io.stdout, "PASS: Tower is set up and collecting.");
+    writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
+        pair,
+        status,
+        sync,
+        agentRules,
+        autostart,
+        initialSyncOk: true,
+        backfill: completedBackfill,
+    });
+    return finishOnboardRun(command, installEvents, io, 0);
+}
+async function runMultiRepoOnboard(command, io, worktrees) {
+    if (!command.json) {
+        writeLine(io.stdout, `3/5 Parent folder mode: discovered ${worktrees.length} git worktree(s).`);
+    }
+    const collectionRoots = await collectionRootConsentAliases(command.collectionRoots ??
+        (command.repoRoot ? [command.repoRoot] : []));
+    const run = await runAttributedWorktreeSync({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        branch: command.branch,
+        activeTicketId: command.activeTicketId,
+        collectionRoots,
+        startContexts: true,
+        worktrees,
+        fetchImpl: io.fetch,
+    });
+    const results = run.outcomes.map((outcome) => worktreeSyncRow(outcome, run));
+    const collectionRunStatus = attributedSyncRunStatus(run);
+    if (!command.json) {
+        for (const [index, outcome] of run.outcomes.entries()) {
+            const row = results[index];
+            if (!row)
+                continue;
+            const uploaded = outcome.sync.status === "uploaded";
+            writeLine(uploaded ? io.stdout : io.stderr, `${uploaded ? "SYNCED" : "BLOCKED"} ${row["repo_label"]}/${row["worktree_label"]} (${row["branch"]}) head:${shortSha(outcome.sync.head_sha ?? outcome.worktree.head_sha)} ${outcome.sync.status} objects:${outcome.sync.raw_evidence_uploaded_object_count} chunks:${outcome.sync.raw_evidence_uploaded_chunk_count} reused:${outcome.sync.raw_evidence_reused_count} failed:${outcome.sync.raw_evidence_failed_count} sessions:${row["attributed_session_count"]}${row["failure_reason"] ? ` reason:${row["failure_reason"]}` : ""}`);
+        }
+        writeLine(io.stdout, "4/5 Parent worktree sync complete.");
+        writeLine(io.stdout, `Uploaded: ${results.filter((row) => row["upload_status"] === "uploaded").length}/${results.length}`);
+        writeAgentSessionSummary(io, run.summary);
+        if (run.ok) {
+            writeLine(io.stdout, "Live sync receipts complete; verifying all-history Codex and Claude backfill.");
+        }
+        else {
+            writeLine(io.stderr, `BLOCKED: Tower collection is ${collectionRunStatus}; retry until every eligible session has a durable receipt or explicit terminal reason.`);
+        }
+        writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
+    }
+    return { ok: run.ok, results, codex_sessions: run.summary };
+}

package/dist/commands/onboard-setup.js

@@ -0,0 +1,102 @@
+import { writeLine } from "./cli-io.js";
+import { collectionRootConsentAliases, persistOnboardingRootConfig, resolveOnboardingRootsForCommand, } from "./collection-roots.js";
+import { addInstallEvent } from "./install-receipts.js";
+import { canReuseOnboardSession, pairLocalCollectorWithAuthFallback, readOnboardSessionReuseCandidate, requestPairingAccessTokenDetailed, } from "./local-auth.js";
+import { writePairingInstructions } from "./onboard-report.js";
+import { inspectLocalCollectorStatus, logoutLocalCollector, } from "../local-state.js";
+/** Step 0: which folders are approved, and who claims to own this machine's uploads. */
+export async function prepareOnboardRoots(command, installEvents, io) {
+    const resolvedRoots = await resolveOnboardingRootsForCommand(command, io);
+    const rootsResult = resolvedRoots.rootsResult;
+    const collectionRoots = rootsResult.roots;
+    const attributionCollectionRoots = await collectionRootConsentAliases(collectionRoots);
+    const primaryRoot = resolvedRoots.primaryRoot;
+    const resolvedCommand = {
+        ...command,
+        repoRoot: primaryRoot,
+        collectionRoots,
+    };
+    if (!command.json) {
+        writeLine(io.stdout, `Collecting from: ${collectionRoots.join(", ")}`);
+    }
+    if (rootsResult.homeRootOptIn) {
+        addInstallEvent(installEvents, "home_root_optin", "ok");
+    }
+    return {
+        resolvedRoots,
+        rootsResult,
+        collectionRoots,
+        attributionCollectionRoots,
+        primaryRoot,
+        existingConfig: resolvedRoots.existingConfig,
+        resolvedCommand,
+    };
+}
+/** Step 1: write the local config that makes this machine a known collector. */
+export async function installOnboardConfig(command, resolvedRoots, installEvents, io) {
+    const install = await persistOnboardingRootConfig(command, resolvedRoots);
+    addInstallEvent(installEvents, "install", "ok");
+    if (!command.json) {
+        writeLine(io.stdout, "1/5 Installed local collector.");
+        writeLine(io.stdout, `Config: ${install.paths.config_file}`);
+    }
+    return install;
+}
+/**
+ * Step 2 of onboarding: reuse the device session when it already belongs to
+ * this owner on this dashboard, otherwise sign in and pair — logging the old
+ * session out first when it belongs to someone else.
+ *
+ * Returns null when an existing session was reused, which is why the caller's
+ * `pair` stays null and the readiness proof falls back to the status file.
+ */
+export async function pairForOnboarding(command, input, installEvents, io) {
+    const installedStatus = await inspectLocalCollectorStatus({
+        homeDir: command.homeDir,
+        repoRoot: input.primaryRoot,
+        branch: command.branch,
+    });
+    const installedSession = await readOnboardSessionReuseCandidate(command.homeDir);
+    const canReuseInstalledSession = canReuseOnboardSession(installedSession, input.claimedOwnerEmail, command.dashboardUrl);
+    if (installedStatus.session_state === "valid" && canReuseInstalledSession) {
+        addInstallEvent(installEvents, "auth", "skipped", "existing_session");
+        addInstallEvent(installEvents, "pair", "skipped", "existing_session");
+        if (!command.json) {
+            writeLine(io.stdout, "2/5 Existing valid device session found; pairing skipped.");
+        }
+        return null;
+    }
+    if (installedStatus.session_state === "valid") {
+        await logoutLocalCollector({ homeDir: command.homeDir });
+        if (!command.json) {
+            writeLine(io.stdout, "2/5 Existing valid device session does not match requested owner or dashboard; pairing again.");
+        }
+    }
+    const authResult = await requestPairingAccessTokenDetailed({
+        dashboardUrl: command.dashboardUrl,
+        email: input.claimedOwnerEmail,
+        noAuth: command.noAuth,
+        json: command.json,
+    }, io);
+    addInstallEvent(installEvents, "auth", authResult.status, authResult.errorCode);
+    const pair = await pairLocalCollectorWithAuthFallback({
+        homeDir: command.homeDir,
+        dashboardUrl: command.dashboardUrl,
+        claimedOwnerEmail: input.claimedOwnerEmail,
+        deviceName: command.deviceName,
+        pollIntervalMs: command.pollIntervalMs,
+        timeoutMs: command.timeoutMs,
+        pairingAccessToken: authResult.accessToken,
+        fetch: io.fetch,
+        onPairStarted: command.json
+            ? undefined
+            : (request) => writePairingInstructions(io, request),
+    }, io);
+    addInstallEvent(installEvents, "pair", "ok");
+    if (!command.json) {
+        writeLine(io.stdout, "2/5 Device paired.");
+        writeLine(io.stdout, `User: ${pair.session.email ?? pair.session.auth_subject_id}`);
+        writeLine(io.stdout, `Device: ${pair.session.device_name ?? pair.session.device_id ?? "unknown"}`);
+    }
+    return pair;
+}