@bli-cockpit/cli 0.2.56 → 0.2.58

package/dist/commands/tower-mcp-codex.js

@@ -0,0 +1,100 @@
+/**
+ * The Codex half of `bli-tower`'s registration (BLI-3706) — one table,
+ * `[mcp_servers.bli-tower]`, in `~/.codex/config.toml`.
+ *
+ * Deliberately narrower than `memory-install-codex.ts`: `bli-tower` has no
+ * Codex skill to teach (its tools are self-describing over MCP, same as any
+ * other server Codex discovers), so there is no `codex_skills` target here —
+ * only the one table, written the same byte-preserving way BLI Memory's own
+ * table is (`memory-install-toml.ts`'s line-span swap, never a
+ * parse-and-reserialise, so a person's model/approval/sandbox settings and
+ * every other MCP server come out untouched).
+ */
+import path from "node:path";
+import { TOWER_MCP_SERVER_ID } from "./tower-mcp-contract.js";
+import { findTomlTableSpan, readTomlTable, renderTomlTable, upsertTomlTable, } from "./memory-install-toml.js";
+const TOWER_TOML_PATH = ["mcp_servers", TOWER_MCP_SERVER_ID];
+export function codexConfigFile(homeDir) {
+    return path.join(homeDir, ".codex", "config.toml");
+}
+export async function installCodexTowerIntegration(options) {
+    const file = codexConfigFile(options.homeDir);
+    const raw = (await options.io.readText(file)) ?? "";
+    if (tableMatches(raw, options.config)) {
+        return { target: "tower_codex_mcp", status: "already", reason: "already_current", path: file };
+    }
+    const next = upsertTomlTable(raw, TOWER_TOML_PATH, renderTowerTable(options.config));
+    if (options.dryRun) {
+        return { target: "tower_codex_mcp", status: "would_install", reason: "dry_run", path: file };
+    }
+    try {
+        await options.io.writeText(file, next);
+    }
+    catch (error) {
+        return {
+            target: "tower_codex_mcp",
+            status: "failed",
+            reason: "write_failed",
+            path: file,
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    // BLI-2541: parse the table back out of the stored bytes, same discipline
+    // as every other target this installer writes.
+    const stored = await options.io.readText(file);
+    if (stored === null || !tableMatches(stored, options.config)) {
+        return {
+            target: "tower_codex_mcp",
+            status: "failed",
+            reason: "read_back_mismatch",
+            path: file,
+            detail: "the table on disk does not parse back to the entry that was written",
+        };
+    }
+    return { target: "tower_codex_mcp", status: "installed", reason: "wrote_entry", path: file };
+}
+export async function inspectCodexTowerIntegration(options) {
+    const file = codexConfigFile(options.homeDir);
+    const raw = await options.io.readText(file);
+    if (raw === null) {
+        return { target: "tower_codex_mcp", status: "missing", reason: "file_absent", path: file };
+    }
+    if (tableMatches(raw, options.config)) {
+        return { target: "tower_codex_mcp", status: "installed", reason: "already_current", path: file };
+    }
+    return findTomlTableSpan(raw, TOWER_TOML_PATH)
+        ? { target: "tower_codex_mcp", status: "mismatch", reason: "entry_differs", path: file }
+        : { target: "tower_codex_mcp", status: "missing", reason: "entry_absent", path: file };
+}
+function renderTowerTable(config) {
+    const entries = [
+        ["command", config.mcp_server.command],
+        ["args", config.mcp_server.args],
+    ];
+    if (Object.keys(config.mcp_server.env).length > 0) {
+        entries.push(["env", config.mcp_server.env]);
+    }
+    return renderTomlTable(TOWER_TOML_PATH, entries);
+}
+function tableMatches(raw, config) {
+    const table = readTomlTable(raw, TOWER_TOML_PATH);
+    if (!table)
+        return false;
+    if (table["command"] !== config.mcp_server.command)
+        return false;
+    const args = table["args"];
+    if (!Array.isArray(args))
+        return config.mcp_server.args.length === 0;
+    if (args.length !== config.mcp_server.args.length)
+        return false;
+    if (!args.every((entry, index) => entry === config.mcp_server.args[index]))
+        return false;
+    const env = table["env"];
+    for (const [key, value] of Object.entries(config.mcp_server.env)) {
+        if (!env || Array.isArray(env) || typeof env === "string")
+            return false;
+        if (env[key] !== value)
+            return false;
+    }
+    return true;
+}

package/dist/commands/tower-mcp-contract.js

@@ -0,0 +1,39 @@
+/**
+ * The `bli-tower` MCP server's registration shape (BLI-3706).
+ *
+ * `bli-tower` is the server id `@bli-cockpit/mcp` (bin `bli-cockpit-mcp`)
+ * registers under — the `docs_*`/`msg_*` tools over the collector device
+ * token, beside `bli-memory` (BLI-3580). Unlike BLI Memory, this server has
+ * NO Claude Code hooks: it is tools only, so `hooks: []` and
+ * `permissions_allow: []` on every config this module builds — the shared
+ * `memory-install-claude.ts`/`memory-install-codex.ts` writers already treat
+ * an empty hooks array as "nothing to do" for that half (see their own
+ * `config.hooks` loops), so no server-specific hook-writing code exists here.
+ *
+ * `@bli-cockpit/mcp` does not (yet) print its own `--print-config`, unlike
+ * `bli-memory-mcp` — so `builtinTowerInstallConfig` is the ONLY source of the
+ * config today; there is no `parsePrintedTowerInstallConfig` counterpart to
+ * `memory-install-contract.ts`'s equivalent. Adding one there is a natural
+ * follow-up once the server ships its own printer, matching BLI Memory's own
+ * shape (see that file's header for why the bin's own answer should win when
+ * it can be asked).
+ */
+import { memoryMcpServerEntry } from "./memory-install-contract.js";
+/** The published bin name. Both hosts spawn this — `@bli-cockpit/mcp`'s package.json `bin`. */
+export const TOWER_MCP_BIN = "bli-cockpit-mcp";
+/** The MCP server id, as it appears in `mcp__<server>__<tool>`. */
+export const TOWER_MCP_SERVER_ID = "bli-tower";
+/** The one env var the server is handed. A URL, never a token — same contract as BLI Memory's. */
+export const TOWER_DASHBOARD_URL_ENV = "COCKPIT_DASHBOARD_URL";
+export function builtinTowerInstallConfig(options) {
+    return {
+        server_id: TOWER_MCP_SERVER_ID,
+        mcp_server: memoryMcpServerEntry(options),
+        // No hooks: bli-tower is tools-only. Left as an empty array rather than
+        // omitted so this is still a complete MemoryInstallConfig — the shared
+        // Claude/Codex writers are already generic over "a server with zero
+        // hooks" (see this file's own header).
+        hooks: [],
+        permissions_allow: [],
+    };
+}

package/dist/commands/tower-mcp-install.js

@@ -0,0 +1,75 @@
+/**
+ * `bli-tower`'s registration — the docs_* and msg_* MCP server, beside
+ * `bli-memory` (BLI-3706, "Agent-friendly is the definition of done").
+ *
+ * Rides `cockpit memory install`/`cockpit memory status` rather than a new
+ * verb: that command already runs unasked from `do-everything` and the daily
+ * sync tick (`memory-install.ts`'s own header), which is the ONLY way a
+ * registration reaches every intern machine without anyone typing anything.
+ * A second, un-invoked `cockpit mcp install` command would ship the feature
+ * and still leave every existing machine unregistered until someone learned
+ * to type the new verb.
+ *
+ * `no_bin_no_write` applies here too, for the identical reason
+ * `memory-install.ts` states it for `bli-memory-mcp`: a Claude Code entry
+ * pointing at a server that is not on this machine is a dead MCP connection
+ * on every startup, not a graceful absence.
+ */
+import os from "node:os";
+import { resolveMcpBin } from "./mcp-bin-resolve.js";
+import { installClaudeTowerIntegration, inspectClaudeTowerIntegration } from "./tower-mcp-claude.js";
+import { installCodexTowerIntegration, inspectCodexTowerIntegration } from "./tower-mcp-codex.js";
+import { builtinTowerInstallConfig, TOWER_MCP_BIN } from "./tower-mcp-contract.js";
+import { envWithNodeRuntimeOnPath } from "../scheduled-self-update.js";
+async function resolveTowerConfig(deps) {
+    const found = await resolveMcpBin({
+        binName: TOWER_MCP_BIN,
+        env: envWithNodeRuntimeOnPath(deps.env),
+        platform: deps.platform,
+        fileExists: deps.fileExists,
+        cliEntryPoint: deps.cliEntryPoint,
+        realpath: deps.realpath,
+    });
+    if (!found) {
+        return {
+            config: null,
+            binTarget: {
+                target: "tower_bin",
+                status: "skipped",
+                reason: "bin_missing",
+                detail: `${TOWER_MCP_BIN} is not installed beside this CLI or on PATH; nothing was written, and the next daily run will try again`,
+            },
+        };
+    }
+    return {
+        config: builtinTowerInstallConfig({ binPath: found.path, platform: deps.platform, dashboardUrl: deps.dashboardUrl }),
+        binTarget: { target: "tower_bin", status: "already", reason: "bin_present_template_used" },
+    };
+}
+export async function installTowerIntegration(deps, dryRun) {
+    const resolved = await resolveTowerConfig(deps);
+    const targets = [resolved.binTarget];
+    if (!resolved.config)
+        return targets;
+    targets.push(await installClaudeTowerIntegration({ homeDir: deps.homeDir, config: resolved.config, dryRun, io: deps.io }));
+    targets.push(await installCodexTowerIntegration({ homeDir: deps.homeDir, config: resolved.config, dryRun, io: deps.io }));
+    return targets;
+}
+export async function inspectTowerIntegration(deps) {
+    const resolved = await resolveTowerConfig(deps);
+    const targets = [resolved.binTarget];
+    if (!resolved.config)
+        return targets;
+    targets.push(await inspectClaudeTowerIntegration({ homeDir: deps.homeDir, config: resolved.config, io: deps.io }));
+    targets.push(await inspectCodexTowerIntegration({ homeDir: deps.homeDir, config: resolved.config, io: deps.io }));
+    return targets;
+}
+export function defaultTowerDeps(overrides) {
+    return {
+        platform: process.platform,
+        homeDir: os.homedir(),
+        dashboardUrl: overrides.dashboardUrl ?? "",
+        env: process.env,
+        ...overrides,
+    };
+}

package/dist/repo-identity-fingerprint.js

@@ -0,0 +1,88 @@
+/**
+ * Turning a filesystem path or a git origin URL into the stable ids this
+ * package hands out (`repo_fingerprint`, `worktree_fingerprint`, the label),
+ * plus the collection-root canonicalization built on the same realpath call.
+ * Sibling of `repo-identity.ts`, named in its header.
+ */
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+export async function stableWorktreeRoot(repoRoot) {
+    const resolvedRoot = path.resolve(repoRoot);
+    return fs.realpath(resolvedRoot).catch(() => resolvedRoot);
+}
+/**
+ * Canonicalizes existing collection roots through the filesystem so transcript
+ * paths and consent roots use the same spelling (for example `/private/var`
+ * versus the `/var` symlink on macOS). Missing roots remain resolved as typed.
+ */
+export async function canonicalizeCollectionRootPaths(roots) {
+    const canonical = await Promise.all(roots.map(stableWorktreeRoot));
+    return [...new Set(canonical)];
+}
+/**
+ * Returns the operator-entered resolved paths plus filesystem-canonical aliases.
+ * Both are needed for absent child repos because the child itself cannot be
+ * realpathed after deletion, while its transcript may retain either spelling.
+ */
+export async function collectionRootPathAliases(roots) {
+    const resolved = roots.map((root) => path.resolve(root));
+    const canonical = await canonicalizeCollectionRootPaths(resolved);
+    return [...new Set([...resolved, ...canonical])];
+}
+function normalizeFingerprintPath(repoRoot, pathApi = path) {
+    const resolved = pathApi.resolve(repoRoot);
+    return pathApi.sep === "\\" ? resolved.toLowerCase() : resolved;
+}
+export function stableWorktreeFingerprint(repoRoot, pathApi = path) {
+    return `wt-${sha256(`worktree:${normalizeFingerprintPath(repoRoot, pathApi)}`).slice(0, 24)}`;
+}
+export function repoFingerprintFromLocalRoot(root, pathApi = path) {
+    return `repo-${sha256(`local:${normalizeFingerprintPath(root, pathApi)}`).slice(0, 24)}`;
+}
+export function repoFingerprintFromOrigin(origin) {
+    const normalizedOrigin = normalizeGitOrigin(origin);
+    return `repo-${sha256(`origin:${normalizedOrigin}`).slice(0, 24)}`;
+}
+export function normalizeGitOrigin(rawOrigin) {
+    const trimmed = rawOrigin.trim();
+    if (!trimmed)
+        return "";
+    const scpLike = trimmed.match(/^(?:[^@]+@)?([^:]+):(.+)$/);
+    if (scpLike && !trimmed.includes("://")) {
+        return normalizeOriginParts(scpLike[1] ?? "", scpLike[2] ?? "");
+    }
+    try {
+        const url = new URL(trimmed);
+        return normalizeOriginParts(url.hostname, url.pathname);
+    }
+    catch {
+        // Deliberately silent (BLI-3238). `new URL` is being used as the test for
+        // "is this origin URL-shaped?", and a plain path or an unusual remote form
+        // failing to parse IS the answer — the fallback below is the intended
+        // normalization for exactly that case, not a degradation.
+        return trimmed
+            .replace(/\.git$/i, "")
+            .replace(/^\/+|\/+$/g, "")
+            .toLowerCase();
+    }
+}
+export function repoLabelFromOrigin(origin) {
+    const segments = origin.split("/").filter(Boolean);
+    return segments.at(-1) ?? origin;
+}
+function normalizeOriginParts(host, repoPath) {
+    return [
+        host.trim().toLowerCase(),
+        repoPath
+            .trim()
+            .replace(/\.git$/i, "")
+            .replace(/^\/+|\/+$/g, "")
+            .toLowerCase(),
+    ]
+        .filter(Boolean)
+        .join("/");
+}
+export function sha256(value) {
+    return crypto.createHash("sha256").update(value, "utf8").digest("hex");
+}

package/dist/repo-identity-git.js

@@ -0,0 +1,76 @@
+/**
+ * Every place this package shells out to `git`, plus the two ways a branch
+ * is read when git itself cannot be asked (a `.git` file's HEAD, for a
+ * linked worktree whose git process is unavailable). Sibling of
+ * `repo-identity.ts`, named in its header.
+ */
+import { execFile } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
+const execFileAsync = promisify(execFile);
+export async function runGit(args, cwd) {
+    const { stdout } = await execFileAsync("git", args, {
+        cwd,
+        timeout: 2_000,
+        maxBuffer: 1024 * 1024,
+    });
+    return stdout;
+}
+export async function hasGitMarker(dir) {
+    return fs.stat(path.join(dir, ".git")).then((stat) => stat.isDirectory() || stat.isFile(), () => false);
+}
+export async function resolveGitBranchWithGit(repoRoot) {
+    const branch = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], repoRoot).then((value) => value.trim(), () => "");
+    if (branch && branch !== "HEAD")
+        return branch;
+    const head = await runGit(["rev-parse", "--short=12", "HEAD"], repoRoot).then((value) => value.trim(), () => "");
+    return head ? `detached:${head}` : "unknown";
+}
+export async function resolveBranchFromHead(repoRoot) {
+    try {
+        const gitPath = path.join(repoRoot, ".git");
+        const stat = await fs.stat(gitPath);
+        const headPath = stat.isFile()
+            ? path.join(await resolveLinkedGitDir(gitPath), "HEAD")
+            : path.join(gitPath, "HEAD");
+        const head = (await fs.readFile(headPath, "utf8")).trim();
+        if (head.startsWith("ref: refs/heads/")) {
+            return head.slice("ref: refs/heads/".length);
+        }
+        return head ? `detached:${head.slice(0, 12)}` : "unknown";
+    }
+    catch (error) {
+        // Not a repo → quiet, that is an ordinary approved folder. A `.git` that
+        // exists and will not read → every session from this worktree is labelled
+        // branch `unknown` and, until BLI-3238, nothing said why.
+        if (!isMissingFileFailure(error)) {
+            console.error("[repo-identity] could not read HEAD, branch recorded as unknown", JSON.stringify({
+                reason: "git_head_unreadable",
+                ...describeError(error),
+            }));
+        }
+        return "unknown";
+    }
+}
+async function resolveLinkedGitDir(gitFile) {
+    const raw = await fs.readFile(gitFile, "utf8");
+    const match = raw.match(/^gitdir:\s*(.+)$/m);
+    if (!match)
+        return path.dirname(gitFile);
+    const gitDir = match[1].trim();
+    return path.isAbsolute(gitDir) ? gitDir : path.resolve(path.dirname(gitFile), gitDir);
+}
+export async function listLinkedWorktreePaths(repoRoot) {
+    const porcelain = await runGit(["worktree", "list", "--porcelain"], repoRoot).catch(() => "");
+    const paths = [];
+    for (const line of porcelain.split("\n")) {
+        if (line.startsWith("worktree ")) {
+            const value = line.slice("worktree ".length).trim();
+            if (value)
+                paths.push(value);
+        }
+    }
+    return paths;
+}

package/dist/repo-identity-linked-worktrees.js

@@ -0,0 +1,81 @@
+/**
+ * Adding a discovered repo's linked worktrees (Claude Code isolation
+ * worktrees, `git worktree add` checkouts) as first-class candidates.
+ * Sibling of `repo-identity.ts`, named in its header.
+ */
+import path from "node:path";
+import { containsPath, isCodexWorktreePath } from "./root-normalization.js";
+import { listLinkedWorktreePaths } from "./repo-identity-git.js";
+import { compareIdentity, resolveRepoWorktreeIdentity } from "./repo-identity.js";
+/**
+ * Directory discovery skips dot-dirs, so Claude Code's isolation worktrees
+ * (`<repo>/.claude/worktrees/<name>`) and any other linked worktree are never
+ * found by walking the filesystem. A session whose cwd sits inside one would
+ * otherwise satisfy `isPathWithin(cwd, parentRoot)` and attribute confidently
+ * to the PARENT with the wrong branch and worktree fingerprint. Enumerating
+ * `git worktree list --porcelain` for each discovered repo adds the linked
+ * worktrees as first-class candidates with their own branch/fingerprint; the
+ * deepest-root tie-break (attribution-core D6) then attributes nested-worktree
+ * sessions to the correct linked worktree. Benefits Codex sessions identically.
+ */
+export async function expandLinkedWorktrees(identities, maxWorktrees, allowedRoots) {
+    const byFingerprint = new Map(identities.map((identity) => [identity.worktree_fingerprint, identity]));
+    const seenRoots = new Set(identities.map((identity) => localPathKey(identity.repo_root)));
+    let maxWorktreesReached = identities.length > maxWorktrees;
+    for (const identity of identities.slice(0, maxWorktrees)) {
+        // One `git worktree list` from any worktree returns every worktree of that
+        // repo, so a single call per already-discovered repo covers its linked set.
+        for (const worktreePath of await listLinkedWorktreePaths(identity.repo_root)) {
+            const resolved = path.resolve(worktreePath);
+            const rootKey = localPathKey(resolved);
+            if (seenRoots.has(rootKey))
+                continue;
+            seenRoots.add(rootKey);
+            const linked = await resolveRepoWorktreeIdentity(resolved).catch(() => null);
+            if (!linked ||
+                byFingerprint.has(linked.worktree_fingerprint) ||
+                !isLinkedWorktreeWithinCollectionScope(linked, identities, allowedRoots)) {
+                continue;
+            }
+            if (byFingerprint.size >= maxWorktrees) {
+                maxWorktreesReached = true;
+                break;
+            }
+            byFingerprint.set(linked.worktree_fingerprint, linked);
+        }
+    }
+    const worktrees = [...byFingerprint.values()]
+        .sort(compareIdentity)
+        .slice(0, maxWorktrees);
+    const incompleteReasons = maxWorktreesReached
+        ? ["max_worktrees_reached"]
+        : [];
+    return {
+        worktrees,
+        complete: incompleteReasons.length === 0,
+        incomplete_reasons: incompleteReasons,
+        // Expansion asks git for its own worktree list; it never walks folders, so
+        // it has no unreadable directories of its own to report.
+        unreadable_dirs: [],
+        // Linked-worktree expansion is not scoped to one root; callers merge this
+        // into a result that already knows which roots were involved.
+        incomplete_roots: [],
+    };
+}
+function isLinkedWorktreeWithinCollectionScope(linked, discoveredFromApprovedRoots, allowedRoots) {
+    if (allowedRoots.some((root) => containsPath(root, linked.repo_root))) {
+        return true;
+    }
+    // Codex isolation worktrees live under ~/.codex/worktrees, outside the
+    // approved workspace parent. They remain in scope only when Git proves they
+    // belong to a clone discovered inside an approved root. Arbitrary sibling or
+    // personal linked worktrees do not inherit that consent.
+    if (!isCodexWorktreePath(linked.repo_root))
+        return false;
+    return discoveredFromApprovedRoots.some((identity) => identity.repo_fingerprint === linked.repo_fingerprint &&
+        allowedRoots.some((root) => containsPath(root, identity.repo_root)));
+}
+function localPathKey(value) {
+    const resolved = path.resolve(value);
+    return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}