@bli-cockpit/cli 0.2.56 → 0.2.58

package/dist/repo-identity.js

@@ -1,11 +1,9 @@
-import { execFile } from "node:child_process";
-import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { promisify } from "node:util";
-import { containsPath, isCodexWorktreePath } from "./root-normalization.js";
-import { describeError, isMissingFileFailure } from "./health-detail.js";
-const execFileAsync = promisify(execFile);
+import { hasGitMarker, resolveGitBranchWithGit, resolveBranchFromHead, runGit } from "./repo-identity-git.js";
+import { repoFingerprintFromLocalRoot, repoFingerprintFromOrigin, repoLabelFromOrigin, normalizeGitOrigin, sha256, stableWorktreeFingerprint, stableWorktreeRoot, } from "./repo-identity-fingerprint.js";
+import { expandLinkedWorktrees } from "./repo-identity-linked-worktrees.js";
+export { canonicalizeCollectionRootPaths, collectionRootPathAliases, normalizeGitOrigin, repoFingerprintFromLocalRoot, repoFingerprintFromOrigin, repoLabelFromOrigin, stableWorktreeFingerprint, stableWorktreeRoot, } from "./repo-identity-fingerprint.js";
 const SKIPPED_DIR_NAMES = new Set([
     ".cache",
     ".git",
@@ -203,112 +201,6 @@ export async function discoverGitWorktreesInRootsWithStatus(roots, options = {})
         unreadable_dirs: unreadableDirs,
     };
 }
-/**
- * Canonicalizes existing collection roots through the filesystem so transcript
- * paths and consent roots use the same spelling (for example `/private/var`
- * versus the `/var` symlink on macOS). Missing roots remain resolved as typed.
- */
-export async function canonicalizeCollectionRootPaths(roots) {
-    const canonical = await Promise.all(roots.map(stableWorktreeRoot));
-    return [...new Set(canonical)];
-}
-/**
- * Returns the operator-entered resolved paths plus filesystem-canonical aliases.
- * Both are needed for absent child repos because the child itself cannot be
- * realpathed after deletion, while its transcript may retain either spelling.
- */
-export async function collectionRootPathAliases(roots) {
-    const resolved = roots.map((root) => path.resolve(root));
-    const canonical = await canonicalizeCollectionRootPaths(resolved);
-    return [...new Set([...resolved, ...canonical])];
-}
-/**
- * Directory discovery skips dot-dirs, so Claude Code's isolation worktrees
- * (`<repo>/.claude/worktrees/<name>`) and any other linked worktree are never
- * found by walking the filesystem. A session whose cwd sits inside one would
- * otherwise satisfy `isPathWithin(cwd, parentRoot)` and attribute confidently
- * to the PARENT with the wrong branch and worktree fingerprint. Enumerating
- * `git worktree list --porcelain` for each discovered repo adds the linked
- * worktrees as first-class candidates with their own branch/fingerprint; the
- * deepest-root tie-break (attribution-core D6) then attributes nested-worktree
- * sessions to the correct linked worktree. Benefits Codex sessions identically.
- */
-async function expandLinkedWorktrees(identities, maxWorktrees, allowedRoots) {
-    const byFingerprint = new Map(identities.map((identity) => [identity.worktree_fingerprint, identity]));
-    const seenRoots = new Set(identities.map((identity) => localPathKey(identity.repo_root)));
-    let maxWorktreesReached = identities.length > maxWorktrees;
-    for (const identity of identities.slice(0, maxWorktrees)) {
-        // One `git worktree list` from any worktree returns every worktree of that
-        // repo, so a single call per already-discovered repo covers its linked set.
-        for (const worktreePath of await listLinkedWorktreePaths(identity.repo_root)) {
-            const resolved = path.resolve(worktreePath);
-            const rootKey = localPathKey(resolved);
-            if (seenRoots.has(rootKey))
-                continue;
-            seenRoots.add(rootKey);
-            const linked = await resolveRepoWorktreeIdentity(resolved).catch(() => null);
-            if (!linked ||
-                byFingerprint.has(linked.worktree_fingerprint) ||
-                !isLinkedWorktreeWithinCollectionScope(linked, identities, allowedRoots)) {
-                continue;
-            }
-            if (byFingerprint.size >= maxWorktrees) {
-                maxWorktreesReached = true;
-                break;
-            }
-            byFingerprint.set(linked.worktree_fingerprint, linked);
-        }
-    }
-    const worktrees = [...byFingerprint.values()]
-        .sort(compareIdentity)
-        .slice(0, maxWorktrees);
-    const incompleteReasons = maxWorktreesReached
-        ? ["max_worktrees_reached"]
-        : [];
-    return {
-        worktrees,
-        complete: incompleteReasons.length === 0,
-        incomplete_reasons: incompleteReasons,
-        // Expansion asks git for its own worktree list; it never walks folders, so
-        // it has no unreadable directories of its own to report.
-        unreadable_dirs: [],
-        // Linked-worktree expansion is not scoped to one root; callers merge this
-        // into a result that already knows which roots were involved.
-        incomplete_roots: [],
-    };
-}
-function isLinkedWorktreeWithinCollectionScope(linked, discoveredFromApprovedRoots, allowedRoots) {
-    if (allowedRoots.some((root) => containsPath(root, linked.repo_root))) {
-        return true;
-    }
-    // Codex isolation worktrees live under ~/.codex/worktrees, outside the
-    // approved workspace parent. They remain in scope only when Git proves they
-    // belong to a clone discovered inside an approved root. Arbitrary sibling or
-    // personal linked worktrees do not inherit that consent.
-    if (!isCodexWorktreePath(linked.repo_root))
-        return false;
-    return discoveredFromApprovedRoots.some((identity) => identity.repo_fingerprint === linked.repo_fingerprint &&
-        allowedRoots.some((root) => containsPath(root, identity.repo_root)));
-}
-function localPathKey(value) {
-    const resolved = path.resolve(value);
-    return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-}
-async function listLinkedWorktreePaths(repoRoot) {
-    const porcelain = await runGit(["worktree", "list", "--porcelain"], repoRoot).catch(() => "");
-    const paths = [];
-    for (const line of porcelain.split("\n")) {
-        if (line.startsWith("worktree ")) {
-            const value = line.slice("worktree ".length).trim();
-            if (value)
-                paths.push(value);
-        }
-    }
-    return paths;
-}
-async function hasGitMarker(dir) {
-    return fs.stat(path.join(dir, ".git")).then((stat) => stat.isDirectory() || stat.isFile(), () => false);
-}
 async function fallbackFilesystemIdentity(repoRoot) {
     const resolvedRoot = await stableWorktreeRoot(repoRoot);
     const repoLabel = path.basename(resolvedRoot) || "repo";
@@ -326,120 +218,11 @@ async function fallbackFilesystemIdentity(repoRoot) {
         worktree_is_primary: true,
     };
 }
-export async function stableWorktreeRoot(repoRoot) {
-    const resolvedRoot = path.resolve(repoRoot);
-    return fs.realpath(resolvedRoot).catch(() => resolvedRoot);
-}
-export function stableWorktreeFingerprint(repoRoot, pathApi = path) {
-    return `wt-${sha256(`worktree:${normalizeFingerprintPath(repoRoot, pathApi)}`).slice(0, 24)}`;
-}
-export function repoFingerprintFromLocalRoot(root, pathApi = path) {
-    return `repo-${sha256(`local:${normalizeFingerprintPath(root, pathApi)}`).slice(0, 24)}`;
-}
-export function repoFingerprintFromOrigin(origin) {
-    const normalizedOrigin = normalizeGitOrigin(origin);
-    return `repo-${sha256(`origin:${normalizedOrigin}`).slice(0, 24)}`;
-}
-async function resolveBranchFromHead(repoRoot) {
-    try {
-        const gitPath = path.join(repoRoot, ".git");
-        const stat = await fs.stat(gitPath);
-        const headPath = stat.isFile()
-            ? path.join(await resolveLinkedGitDir(gitPath), "HEAD")
-            : path.join(gitPath, "HEAD");
-        const head = (await fs.readFile(headPath, "utf8")).trim();
-        if (head.startsWith("ref: refs/heads/")) {
-            return head.slice("ref: refs/heads/".length);
-        }
-        return head ? `detached:${head.slice(0, 12)}` : "unknown";
-    }
-    catch (error) {
-        // Not a repo → quiet, that is an ordinary approved folder. A `.git` that
-        // exists and will not read → every session from this worktree is labelled
-        // branch `unknown` and, until BLI-3238, nothing said why.
-        if (!isMissingFileFailure(error)) {
-            console.error("[repo-identity] could not read HEAD, branch recorded as unknown", JSON.stringify({
-                reason: "git_head_unreadable",
-                ...describeError(error),
-            }));
-        }
-        return "unknown";
-    }
-}
-async function resolveLinkedGitDir(gitFile) {
-    const raw = await fs.readFile(gitFile, "utf8");
-    const match = raw.match(/^gitdir:\s*(.+)$/m);
-    if (!match)
-        return path.dirname(gitFile);
-    const gitDir = match[1].trim();
-    return path.isAbsolute(gitDir) ? gitDir : path.resolve(path.dirname(gitFile), gitDir);
-}
-export function normalizeGitOrigin(rawOrigin) {
-    const trimmed = rawOrigin.trim();
-    if (!trimmed)
-        return "";
-    const scpLike = trimmed.match(/^(?:[^@]+@)?([^:]+):(.+)$/);
-    if (scpLike && !trimmed.includes("://")) {
-        return normalizeOriginParts(scpLike[1] ?? "", scpLike[2] ?? "");
-    }
-    try {
-        const url = new URL(trimmed);
-        return normalizeOriginParts(url.hostname, url.pathname);
-    }
-    catch {
-        // Deliberately silent (BLI-3238). `new URL` is being used as the test for
-        // "is this origin URL-shaped?", and a plain path or an unusual remote form
-        // failing to parse IS the answer — the fallback below is the intended
-        // normalization for exactly that case, not a degradation.
-        return trimmed
-            .replace(/\.git$/i, "")
-            .replace(/^\/+|\/+$/g, "")
-            .toLowerCase();
-    }
-}
-export function repoLabelFromOrigin(origin) {
-    const segments = origin.split("/").filter(Boolean);
-    return segments.at(-1) ?? origin;
-}
-function normalizeOriginParts(host, repoPath) {
-    return [
-        host.trim().toLowerCase(),
-        repoPath
-            .trim()
-            .replace(/\.git$/i, "")
-            .replace(/^\/+|\/+$/g, "")
-            .toLowerCase(),
-    ]
-        .filter(Boolean)
-        .join("/");
-}
 function shouldSkipDirectory(name) {
     return name.startsWith(".") || SKIPPED_DIR_NAMES.has(name);
 }
-function compareIdentity(a, b) {
+export function compareIdentity(a, b) {
     return (a.repo_label.localeCompare(b.repo_label) ||
         Number(b.worktree_is_primary) - Number(a.worktree_is_primary) ||
         a.worktree_label.localeCompare(b.worktree_label));
-}
-async function resolveGitBranchWithGit(repoRoot) {
-    const branch = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], repoRoot).then((value) => value.trim(), () => "");
-    if (branch && branch !== "HEAD")
-        return branch;
-    const head = await runGit(["rev-parse", "--short=12", "HEAD"], repoRoot).then((value) => value.trim(), () => "");
-    return head ? `detached:${head}` : "unknown";
-}
-async function runGit(args, cwd) {
-    const { stdout } = await execFileAsync("git", args, {
-        cwd,
-        timeout: 2_000,
-        maxBuffer: 1024 * 1024,
-    });
-    return stdout;
-}
-function normalizeFingerprintPath(repoRoot, pathApi = path) {
-    const resolved = pathApi.resolve(repoRoot);
-    return pathApi.sep === "\\" ? resolved.toLowerCase() : resolved;
-}
-function sha256(value) {
-    return crypto.createHash("sha256").update(value, "utf8").digest("hex");
 }

package/dist/upload-envelope-build.js

@@ -0,0 +1,240 @@
+/**
+ * Is this machine ready to upload, and — if so — `buildLocalAmbientEnvelope`:
+ * five steps from a bare repo root to a validated envelope.
+ *
+ * - `readPairedCollector` — prove the collector is installed and paired, with
+ *   its own reason and retry command for each of the three ways a machine can
+ *   fail to be ready. "sync failed" with no next step is what turns a
+ *   five-second fix into a support thread.
+ * - `buildLocalAmbientEnvelope` — find the work context for this repo, run the
+ *   source collectors, sanitize what came back and assemble the one event
+ *   (`upload-envelope-event.ts`), then parse the envelope against its schema.
+ * - The work-context and provenance helpers (`makeUploadWorkContext`,
+ *   `makeCollectorProvenance`, `safeRepoLabel`) are also called directly by
+ *   `upload-session-reports.ts`, which builds its own provenance without a
+ *   full envelope.
+ */
+import { TelemetryIngestEnvelopeSchema, } from "@bli-cockpit/telemetry-core";
+import path from "node:path";
+import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, readLocalWorkContextForRepo, } from "./local-state.js";
+import { runLocalSourceCollectors } from "./adapters/local-sources.js";
+import { defaultCodexSessionDirs, } from "./adapters/codex-attribution.js";
+import { normalizeDashboardUrl } from "./upload-http.js";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
+import { makeSourceScanCompletedEvent, sanitizeRiskFlag, sanitizeSessionReference, sanitizeSourceScanResults, selectedTicketBindingCandidate, } from "./upload-envelope-event.js";
+export class LocalUploadBlockedError extends Error {
+    blocker;
+    retry_hint;
+    constructor(blocker, message, retryHint) {
+        super(message);
+        this.name = "LocalUploadBlockedError";
+        this.blocker = blocker;
+        this.retry_hint = retryHint;
+    }
+}
+/**
+ * Is this machine installed, paired, and holding a session that has not lapsed?
+ */
+async function readPairedCollector(paths) {
+    const config = await readLocalCollectorConfig(paths).catch((error) => {
+        // `not_installed` tells the operator to reinstall the CLI. That is the
+        // wrong instruction for a config that exists and is corrupt, and there was
+        // no way to tell which one this machine hit.
+        if (!isMissingFileFailure(error)) {
+            console.error("[upload-envelope] collector config present but unreadable, reporting it as not installed", JSON.stringify({
+                reason: "not_installed",
+                ...describeError(error),
+            }));
+        }
+        throw new LocalUploadBlockedError("not_installed", "Local collector config missing. Install/update the CLI, then run `cockpit do-everything` before `cockpit sync`.", "npm install -g @bli-cockpit/cli@latest && cockpit do-everything");
+    });
+    const sessionFile = await readLocalCollectorSessionFile(paths).catch((error) => {
+        // Same trap on the pairing half: `unpaired` sends the operator to
+        // `cockpit login`, which does not fix an unreadable session file.
+        if (!isMissingFileFailure(error)) {
+            console.error("[upload-envelope] session file present but unreadable, reporting the machine as unpaired", JSON.stringify({
+                reason: "unpaired",
+                ...describeError(error),
+            }));
+        }
+        throw new LocalUploadBlockedError("unpaired", "No paired collector session found. Run `cockpit login` or `cockpit pair` before `cockpit sync`.", "cockpit login");
+    });
+    const session = await readLocalSessionReference(paths);
+    if (session.session_state !== "valid") {
+        throw new LocalUploadBlockedError("unpaired", session.session_state === "expired"
+            ? "Collector session expired. Run `cockpit login` or `cockpit pair` again before `cockpit sync`."
+            : "Collector is not paired. Run `cockpit login` or `cockpit pair` before `cockpit sync`.", "cockpit login");
+    }
+    return { config, sessionFile, session };
+}
+export async function buildLocalAmbientEnvelope(options = {}) {
+    const now = options.now ?? new Date();
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    const collector = await readPairedCollector(paths);
+    const { config, sessionFile, session } = collector;
+    const repoRoot = path.resolve(options.repoRoot ?? process.cwd());
+    const activeContext = await readLocalWorkContextForRepo(paths, repoRoot).catch((error) => {
+        // The operator is told "run `cockpit start`", which is right when the file
+        // is simply absent and wrong when it exists and will not parse — the same
+        // advice, forever, on a machine that has already run it (BLI-3238).
+        if (!isMissingFileFailure(error)) {
+            console.error("[upload-envelope] work context present but unreadable, reporting it as missing", JSON.stringify({
+                reason: "missing_context",
+                ...describeError(error),
+            }));
+        }
+        throw new LocalUploadBlockedError("missing_context", "Active work context missing. Run `cockpit start --workspace \"$PWD\"` before `cockpit sync`.", "cockpit start --workspace \"$PWD\"");
+    });
+    const repoLabel = safeRepoLabel(activeContext.repo_label ?? repoRoot);
+    const uploadContext = makeUploadWorkContext({
+        activeContext,
+        session,
+        repoLabel,
+        now,
+    });
+    const sourceCollection = await runLocalSourceCollectors({
+        repoRoot,
+        branch: uploadContext.branch,
+        operatorId: session.operator_id,
+        operatorLabel: session.email ?? session.auth_subject_id,
+        sessionId: session.session_id,
+        workContextId: uploadContext.work_context_id,
+        activeWorkContext: activeContext,
+        rawEvidenceStateDir: paths.state_dir,
+        rawEvidenceSessionsDirs: defaultCodexSessionDirs(paths.home_dir),
+        claudeProjectsDir: path.join(paths.home_dir, ".claude", "projects"),
+        rawEvidenceIncludeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
+        rawEvidenceIncludeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,
+        rawEvidenceCodexSessionFiles: options.codexSessionFiles,
+        rawEvidenceCodexAttributionScan: options.codexAttributionScan,
+        rawEvidenceClaudeSessionFiles: options.claudeSessionFiles,
+        rawEvidenceClaudeAttributionScan: options.claudeAttributionScan,
+        rawEvidenceSkipContentHashes: reusableContentHashes(options, {
+            operatorId: session.operator_id,
+            workContextId: uploadContext.work_context_id,
+        }),
+        rawEvidenceByteBudget: options.rawEvidenceByteBudget,
+        rawEvidenceObjectBudget: options.rawEvidenceObjectBudget,
+        rawEvidenceBudget: options.rawEvidenceBudget,
+        rawEvidenceDeliveryMode: options.evidenceDeliveryMode,
+        now,
+    });
+    const binding = sourceCollection.binding;
+    const ticketBinding = selectedTicketBindingCandidate(binding);
+    const uploadWorkContext = {
+        ...uploadContext,
+        active_ticket_id: binding.selected_ticket_id ?? undefined,
+        ticket_binding_candidates: ticketBinding ? [ticketBinding] : binding.candidates,
+    };
+    const safeRiskFlags = sourceCollection.risk_flags.map((flag) => sanitizeRiskFlag(flag, repoLabel));
+    const events = [
+        makeSourceScanCompletedEvent({
+            context: uploadWorkContext,
+            generatedAt: now.toISOString(),
+            binding,
+            ticketBinding,
+            scans: sourceCollection.scans,
+            gitChangedFileCount: sourceCollection.facts.git?.changed_file_count ?? 0,
+            gitAddedLines: sourceCollection.facts.git?.added_lines ?? 0,
+            gitDeletedLines: sourceCollection.facts.git?.deleted_lines ?? 0,
+            carOpenTicketCount: sourceCollection.facts.car?.open_ticket_count ?? 0,
+            rawEvidenceFacts: sourceCollection.facts.raw_evidence,
+            riskFlags: safeRiskFlags,
+        }),
+    ];
+    const envelope = TelemetryIngestEnvelopeSchema.parse({
+        envelope_version: "telemetry-ingest.v1",
+        generated_at: now.toISOString(),
+        collector_version: LOCAL_COLLECTOR_VERSION,
+        session_reference: sanitizeSessionReference(session),
+        work_context: uploadWorkContext,
+        worktree_inventory: options.worktreeInventory ?? [],
+        source_scan_results: sanitizeSourceScanResults(sourceCollection.scans, repoLabel),
+        events,
+    });
+    return {
+        envelope,
+        dashboard_url: normalizeDashboardUrl(options.dashboardUrl ?? sessionFile.dashboard_url ?? config.dashboard_url),
+        device_token: sessionFile.device_token,
+        ticket_id: binding.selected_ticket_id ?? null,
+        binding,
+        event_count: envelope.events.length,
+        source_scan_count: envelope.source_scan_results.length,
+        risk_flag_count: safeRiskFlags.length,
+        repo_label: repoLabel,
+        head_sha: uploadContext.head_sha ?? null,
+        raw_evidence_upload_files: sourceCollection.facts.raw_evidence?.upload_files ?? [],
+        raw_evidence_facts: sourceCollection.facts.raw_evidence,
+    };
+}
+/**
+ * Content hashes whose bytes are already durable and may be skipped this sync.
+ *
+ * Object keys embed the work context, so a cursor entry only counts as reuse
+ * when it was committed under THIS operator and context. The same bytes under a
+ * different context still need their own pointer and evidence ref.
+ */
+function reusableContentHashes(options, context) {
+    if (options.skipContentHashes)
+        return options.skipContentHashes;
+    return new Set(Object.entries(options.cursorObjects ?? {})
+        .filter(([, entry]) => rawEvidenceObjectKeyBelongsToWorkContext(entry.object_key, context))
+        .map(([hash]) => hash));
+}
+export function makeUploadWorkContext(options) {
+    const provenance = makeCollectorProvenance({
+        context: options.activeContext,
+        session: options.session,
+        repoLabel: options.repoLabel,
+    });
+    return {
+        ...options.activeContext,
+        repo: options.repoLabel,
+        repo_label: options.activeContext.repo_label ?? options.repoLabel,
+        repo_fingerprint: options.activeContext.repo_fingerprint,
+        repo_origin_url: options.activeContext.repo_origin_url,
+        head_sha: options.activeContext.head_sha,
+        worktree_label: options.activeContext.worktree_label,
+        worktree_fingerprint: options.activeContext.worktree_fingerprint,
+        worktree_is_primary: options.activeContext.worktree_is_primary,
+        operator_id: options.session.operator_id,
+        session_id: options.session.session_id,
+        updated_at: options.now.toISOString(),
+        provenance,
+    };
+}
+export function makeCollectorProvenance(options) {
+    return {
+        capture_source: "collector_runtime",
+        capture_adapter_version: LOCAL_COLLECTOR_VERSION,
+        collector_version: LOCAL_COLLECTOR_VERSION,
+        repo: options.repoLabel,
+        branch: options.context.branch,
+        repo_label: options.context.repo_label ?? options.repoLabel,
+        repo_fingerprint: options.context.repo_fingerprint,
+        repo_origin_url: options.context.repo_origin_url,
+        worktree_label: options.context.worktree_label,
+        worktree_fingerprint: options.context.worktree_fingerprint,
+        worktree_is_primary: options.context.worktree_is_primary,
+        operator_id: options.session.operator_id,
+        session_id: options.session.session_id,
+        work_context_id: options.context.work_context_id,
+    };
+}
+/** The basename of a repo root, never the path that led to it. */
+export function safeRepoLabel(repoRoot) {
+    const basename = path.basename(repoRoot.replace(/[\\/]+$/, ""));
+    return basename || "repo";
+}
+/**
+ * Does this durable object belong to the operator and work context now syncing?
+ *
+ * Two key shapes are live: the original `<operator>/<context>/...` prefix and
+ * the readable `operators/.../ids/<operator>/<context>/...` layout.
+ */
+function rawEvidenceObjectKeyBelongsToWorkContext(objectKey, context) {
+    const legacyPrefix = `${context.operatorId}/${context.workContextId}/`;
+    const readableIdGuard = `/ids/${context.operatorId}/${context.workContextId}/`;
+    return (objectKey.startsWith(legacyPrefix) ||
+        (objectKey.startsWith("operators/") && objectKey.includes(readableIdGuard)));
+}