@bli-cockpit/cli 0.2.72 → 0.2.75

package/dist/commands/doctor-mcp.js

@@ -0,0 +1,98 @@
+/**
+ * The `mcp-answers` check (BLI-3804): does the `bli-tower` server this machine
+ * REGISTERED actually answer?
+ *
+ * `memory-registered` (`doctor-registration.ts`) proves the registration —
+ * the entry is in `~/.claude.json` and `~/.codex/config.toml` and the bin it
+ * names is on this machine. That is a file-contents check, and it stayed green
+ * for the whole life of a server that exited 1 on startup on every machine
+ * outside the bli-cockpit repo. Nothing on a laptop ever ASKED the server a
+ * question, so nothing could tell the difference between registered and
+ * working; five QA ticks recorded "no `mcp__bli-tower__*` in this session" as
+ * a client-side mystery.
+ *
+ * This row asks. It spawns the registered server the way an agent host does
+ * and calls the cheapest read on it — `docs_list` with `limit: 1`, the same
+ * first call `packages/bli-cockpit-mcp/scripts/smoke.ts` makes — and reports
+ * what came back.
+ *
+ * The three outcomes, and why each is spelled the way it is:
+ *
+ *   ok        the door answered. The server starts, speaks the protocol, and
+ *             reaches Tower with this machine's device token.
+ *   needs_fix the server answered and the DOOR refused, in its own words. The
+ *             MCP half is alive; the refusal belongs to Tower and is named
+ *             verbatim. No fix runs from here — the row reports, and `authed`
+ *             above it already owns the pairing.
+ *   fail      nothing answered: no process, no protocol, no reply. This is the
+ *             state that hid for five ticks, so it is a `fail` rather than a
+ *             `needs_fix` — only a `fail` travels to the fleet's install-event
+ *             ledger with its reason label (`doctor-report.ts`'s `doctorEvent`
+ *             maps every other status to `ok`).
+ *
+ * `skipped` when the bin is not on this machine at all, for the same reason
+ * `memory-registered` skips: nothing to probe is not a broken machine.
+ */
+import { envWithNodeRuntimeOnPath } from "../scheduled-self-update.js";
+import { fail, needsFix, ok, skipped } from "./doctor-report.js";
+import { resolveMcpBin } from "./mcp-bin-resolve.js";
+import { probeMcpTool, resolveServerEntry } from "./mcp-stdio-probe.js";
+import { TOWER_DASHBOARD_URL_ENV, TOWER_MCP_BIN } from "./tower-mcp-contract.js";
+/** The cheapest read on the server, and the smoke's own first call. */
+export const MCP_ANSWERS_TOOL = "docs_list";
+const MCP_ANSWERS_ARGUMENTS = { limit: 1 };
+/** Where the server's JS lives behind a Windows `.cmd` shim, relative to `.bin`. */
+const WINDOWS_ENTRY_FROM_BIN = ["..", "@bli-cockpit", "mcp", "dist", "index.js"];
+export async function checkMcpAnswersState(context, deps = {}) {
+    const resolveBin = deps.resolveBin ?? resolveMcpBin;
+    const resolveEntry = deps.resolveEntry ?? resolveServerEntry;
+    const probe = deps.probe ?? probeMcpTool;
+    const bin = await resolveBin({
+        binName: TOWER_MCP_BIN,
+        env: envWithNodeRuntimeOnPath(process.env),
+        platform: process.platform,
+    });
+    if (!bin) {
+        return skipped("mcp-answers", "bin_missing", `${TOWER_MCP_BIN} is not installed beside this CLI or on PATH; nothing was asked, and the next daily run will try again`);
+    }
+    const entry = resolveEntry(bin.path, WINDOWS_ENTRY_FROM_BIN);
+    if (!entry) {
+        return skipped("mcp-answers", "server_entry_not_found", `${TOWER_MCP_BIN} is registered but its server file could not be found behind the shim; nothing was asked`);
+    }
+    const outcome = await probe({
+        entry,
+        toolName: MCP_ANSWERS_TOOL,
+        toolArguments: MCP_ANSWERS_ARGUMENTS,
+        env: probeEnv(context),
+        ...(deps.timeoutMs === undefined ? {} : { timeoutMs: deps.timeoutMs }),
+    });
+    return mcpAnswersRow(outcome);
+}
+export function mcpAnswersRow(outcome) {
+    if (outcome.status === "answered") {
+        return ok("mcp-answers", "answered", `bli-tower answered ${MCP_ANSWERS_TOOL} in ${outcome.ms} ms`);
+    }
+    if (outcome.status === "refused") {
+        return needsFix("mcp-answers", outcome.reason, `bli-tower is alive (it answered in ${outcome.ms} ms) and Tower refused ${MCP_ANSWERS_TOOL}`
+            + ` (${outcome.reason}): ${outcome.said}`);
+    }
+    return fail("mcp-answers", outcome.reason, `bli-tower is registered but did not answer ${MCP_ANSWERS_TOOL} (${outcome.reason}): ${outcome.said}.`
+        + " No agent session on this machine can reach Tower's tools until it does."
+        + " Take the newest CLI with `cockpit update` (the server ships with it), then"
+        + " re-register with `cockpit memory install`.");
+}
+/**
+ * The child gets a URL and a HOME, never a token: the server reads this
+ * machine's device token itself, from the same session file `cockpit login`
+ * wrote, which is what makes this a probe of the REAL auth path.
+ */
+function probeEnv(context) {
+    const base = { ...process.env };
+    if (context.command.homeDir) {
+        base.HOME = context.command.homeDir;
+        base.USERPROFILE = context.command.homeDir;
+    }
+    if (context.command.dashboardUrl)
+        base[TOWER_DASHBOARD_URL_ENV] = context.command.dashboardUrl;
+    return base;
+}

package/dist/commands/doctor.js

@@ -1,5 +1,6 @@
 import { checkSingleInstallState, fixAuthState, fixRootState, readAuthState, readRootState, } from "./doctor-access.js";
 import { backfillCompletionStepState, checkBackfillState, checkDiskState, checkGcState, checkSyncState, fixBackfillState, fixDiskState, fixGcState, fixSyncState, syncBacklogDrainingVerdict, } from "./doctor-pipeline.js";
+import { checkMcpAnswersState } from "./doctor-mcp.js";
 import { checkAutostartState, checkMemoryState, fixAutostartState, fixMemoryState, } from "./doctor-registration.js";
 import { dryRunPreview, isInteractiveDoctorFix, maybeReportDoctorEvents, writeDoctorOutput, } from "./doctor-report.js";
 import { refreshSetupReceipt } from "./setup-receipt.js";
@@ -23,14 +24,8 @@ export async function runDoctorWithDeps(command, io, deps) {
         }
         const canFix = Boolean(invariant.fix) &&
             (!invariant.requiresInteractiveFix || isInteractiveDoctorFix(context));
-        if (!canFix) {
-            rows.push(checked.hardStop ? checked : { ...checked, status: "needs_fix" });
-            if (checked.hardStop)
-                break;
-            continue;
-        }
-        if (!invariant.fix) {
-            rows.push(checked.hardStop ? checked : { ...checked, status: "needs_fix" });
+        if (!canFix || !invariant.fix) {
+            rows.push(withoutAFix(checked));
             if (checked.hardStop)
                 break;
             continue;
@@ -52,6 +47,21 @@ export async function runDoctorWithDeps(command, io, deps) {
     writeDoctorOutput(command, io, rows, await deps.readSetupReceipt(context));
     return rows.some((row) => row.status === "fail" || row.hardStop) ? 1 : 0;
 }
+/**
+ * What a broken row looks like when nothing can repair it from here.
+ *
+ * A check that says `needs_fix` and has no fix is still `needs_fix` — the
+ * person is being told what to do. A check that says `fail` KEEPS that word
+ * (BLI-3804): it used to be quietly rewritten to `needs_fix`, which turned the
+ * run green and, because `doctor-report.ts` maps every non-`fail` row to `ok`
+ * in the install-event ledger, threw the reason label away on the way to the
+ * fleet as well. `hardStop` is untouched and still ends the walk.
+ */
+function withoutAFix(checked) {
+    if (checked.hardStop || checked.status === "fail")
+        return checked;
+    return { ...checked, status: "needs_fix" };
+}
 function doctorInvariants() {
     return [
         { id: "cli-latest", check: checkCliLatest, fix: fixCliLatest },
@@ -84,6 +94,16 @@ function doctorInvariants() {
             check: (context) => context.deps.checkMemory(context),
             fix: (context, _state) => context.deps.fixMemory(context),
         },
+        // BLI-3804. Right after the registration row, because it asks the second
+        // half of the same question: `memory-registered` proves the entry exists
+        // and names a bin, this one proves the server behind it starts, speaks the
+        // protocol and reaches Tower. Deliberately has NO fix — re-registering a
+        // server that is already registered repairs nothing, and the row names the
+        // command a person should run instead (`doctor-mcp.ts`).
+        {
+            id: "mcp-answers",
+            check: (context) => context.deps.checkMcpAnswers(context),
+        },
         {
             id: "backfill-complete",
             check: (context) => context.deps.checkBackfill(context),
@@ -125,6 +145,7 @@ function defaultDoctorDeps(hooks) {
         fixAutostart: fixAutostartState,
         checkMemory: checkMemoryState,
         fixMemory: fixMemoryState,
+        checkMcpAnswers: (context) => checkMcpAnswersState(context),
         checkBackfill: checkBackfillState,
         fixBackfill: fixBackfillState,
         checkGc: checkGcState,

package/dist/commands/local-args-tower-admin.js

@@ -66,6 +66,8 @@ export function parseOpsArgs(args) {
             "--skips",
             "--memory",
             "--memory-days",
+            // BLI-3798: the coverage half on its own, with the bucket table.
+            "--coverage",
             "--person",
             "--dry-run",
             "--json",
@@ -91,10 +93,19 @@ export function parseOpsArgs(args) {
         if (memoryDays !== undefined && !/^[0-9]{1,2}$/u.test(memoryDays)) {
             throw new Error("ops --memory-days takes a whole number of days, 1 to 30.");
         }
+        const coverageOnly = values.booleans.has("--coverage");
+        const job = optionalNonEmpty(values.flags.get("--job"));
+        if (coverageOnly && job !== undefined && job !== "collection-coverage") {
+            // Refused rather than silently preferring one: `--coverage --job
+            // daily-brief` is somebody asking two different questions in one
+            // command, and answering the wrong one is how a board loses trust.
+            throw new Error("ops --coverage IS --job collection-coverage. Pass one or the other, not a --job naming a different pipeline.");
+        }
         return {
             kind: "ops",
             action: "status",
-            job: optionalNonEmpty(values.flags.get("--job")),
+            job: coverageOnly ? "collection-coverage" : job,
+            coverage: coverageOnly,
             skips: values.booleans.has("--skips"),
             memory: values.booleans.has("--memory") || memoryDays !== undefined,
             ...(memoryDays === undefined ? {} : { memoryDays: Number(memoryDays) }),

package/dist/commands/local-help-commands.js

@@ -295,7 +295,7 @@ export function localSubcommandHelp(command) {
         [
             "ops",
             [
-                "Usage: cockpit ops [status [--job <id>] [--skips] [--memory [--memory-days N]] | recompile --person <email|name|id> [--dry-run]] [--json]",
+                "Usage: cockpit ops [status [--job <id>] [--coverage] [--skips] [--memory [--memory-days N]] | recompile --person <email|name|id> [--dry-run]] [--json]",
                 "",
                 "  cockpit ops status",
                 "      One line per scheduled job: when it last produced something, and whether that",
@@ -306,6 +306,11 @@ export function localSubcommandHelp(command) {
                 "      week rather than a broken cron.",
                 "      --job <id> asks about one; --skips adds the open Slack and external-sync skips,",
                 "      grouped by reason. Exits 1 if anything is stale, empty or unreadable.",
+                "      --coverage is the collection-coverage row on its own, with the BUCKET table:",
+                "      which bucket the missing sessions are in (staged-not-committed with the upload",
+                "      ledger's own reason, still pending upload, deliberately withheld, or no row at",
+                "      all), whose machines they are on, which of their own days, and what to run for",
+                "      each. That table also prints on the ordinary board whenever anything is missing.",
                 "      Every machine's line also carries its BLI Memory column — whether the MCP",
                 "      servers and the recall/save hooks are registered for Claude Code and Codex,",
                 "      and whether Codex has been told to TRUST its hooks. That column never colours",

package/dist/commands/mcp-stdio-probe.js

@@ -0,0 +1,267 @@
+/**
+ * Ask an MCP server one question over stdio and see whether it answers
+ * (BLI-3804).
+ *
+ * `cockpit doctor`'s `memory-registered` row proves a server is REGISTERED —
+ * that the entry exists in `~/.claude.json` and `~/.codex/config.toml` and
+ * points at a bin that is on this machine. It cannot prove the server starts,
+ * speaks the protocol, or reaches Tower, and for five QA ticks
+ * (`docs/reports/jarvis-qa-loop/tick15.md` … `tick19.md`) nothing else did
+ * either: the `bli-tower` tools were shipped, published, and never executed
+ * end to end. This module is the missing half — it spawns the server the way
+ * an agent host does and calls one cheap read.
+ *
+ * ## Why a hand-written client
+ *
+ * MCP's stdio transport is newline-delimited JSON-RPC 2.0 and nothing more:
+ * `initialize`, `notifications/initialized`, `tools/call`. Writing those three
+ * messages costs ~60 lines here, against pulling
+ * `@modelcontextprotocol/sdk` into the collector — the package every intern
+ * machine installs — for one diagnostic. The collector already declines a
+ * dependency for exactly this reason in `agent-door-session.ts`'s sibling on
+ * the MCP side.
+ *
+ * ## Never a shell
+ *
+ * The registered bin is an npm shim: a symlink to the server's own JS on
+ * POSIX, a `.cmd` on Windows. This module spawns `process.execPath` with the
+ * server's JS ENTRY — resolved from the shim, never run through it — so no
+ * `cmd.exe`, no quoting hazard, and the same code path on both required host
+ * families (`commands/editor.ts` refuses a Windows shim for the same reason).
+ * When the entry cannot be found behind the shim the probe says so by name
+ * rather than guessing.
+ */
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+const DEFAULT_TIMEOUT_MS = 25_000;
+/**
+ * The server's JS entry behind an npm bin shim.
+ *
+ * POSIX: `node_modules/.bin/<name>` is a symlink to the file itself, so one
+ * realpath is the whole answer. Windows: the shim is a `.cmd` and the entry
+ * lives at `<.bin>/../<scope>/<pkg>/dist/index.js`, which the caller names.
+ */
+export function resolveServerEntry(binPath, windowsFallbackRelative, deps = {}) {
+    const realpath = deps.realpath ?? defaultRealpath;
+    const exists = deps.exists ?? defaultExists;
+    const resolved = realpath(binPath);
+    if (resolved.endsWith(".js") || resolved.endsWith(".mjs"))
+        return resolved;
+    const beside = path.resolve(path.dirname(binPath), ...windowsFallbackRelative);
+    return exists(beside) ? beside : null;
+}
+/** One `initialize` + one `tools/call`, then the child is killed. */
+export async function probeMcpTool(request) {
+    const now = request.now ?? Date.now;
+    const started = now();
+    const timeoutMs = request.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const spawnProcess = request.spawnProcess ?? defaultSpawn;
+    const elapsed = () => now() - started;
+    let child;
+    try {
+        child = spawnProcess(process.execPath, [request.entry], { env: request.env });
+    }
+    catch (error) {
+        return { status: "no_answer", ms: elapsed(), reason: "spawn_failed", said: firstLine(errorText(error)) };
+    }
+    const pending = new Map();
+    /**
+     * A reply that arrived before anyone asked for it. Nothing in the protocol
+     * forbids it and a stream can deliver one synchronously with the write that
+     * provoked it, so the answer is held rather than dropped — a dropped reply
+     * would read as a silent server, which is the exact verdict this module
+     * exists to make trustworthy.
+     */
+    const early = new Map();
+    let ended = null;
+    const endWaiters = [];
+    const end = (reason, said) => {
+        if (!ended)
+            ended = { reason, said };
+        for (const wake of endWaiters.splice(0))
+            wake();
+    };
+    child.on("error", ((error) => end("spawn_failed", firstLine(errorText(error)))));
+    child.on("exit", ((code) => end("server_exited", `the server exited with code ${code ?? "null"} before answering`)));
+    let buffer = "";
+    child.stdout?.on("data", (chunk) => {
+        buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        let newline = buffer.indexOf("\n");
+        while (newline !== -1) {
+            const line = buffer.slice(0, newline).trim();
+            buffer = buffer.slice(newline + 1);
+            newline = buffer.indexOf("\n");
+            if (line === "")
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                // Not our protocol. A server that writes prose to stdout has already
+                // broken the transport for every real client too, so it is named.
+                end("protocol_error", "the server wrote something to stdout that is not JSON-RPC");
+                return;
+            }
+            const message = parsed;
+            const id = typeof message["id"] === "number" ? message["id"] : null;
+            if (id === null)
+                continue;
+            const waiter = pending.get(id);
+            if (!waiter) {
+                early.set(id, message);
+                continue;
+            }
+            pending.delete(id);
+            waiter(message);
+        }
+    });
+    const send = (message) => {
+        child.stdin?.write(`${JSON.stringify(message)}\n`);
+    };
+    const awaitReply = (id) => new Promise((resolve) => {
+        const alreadyHere = early.get(id);
+        if (alreadyHere) {
+            early.delete(id);
+            resolve(alreadyHere);
+            return;
+        }
+        if (ended) {
+            resolve(null);
+            return;
+        }
+        const timer = setTimeout(() => {
+            pending.delete(id);
+            end("timed_out", `the server did not answer within ${timeoutMs} ms`);
+            resolve(null);
+        }, timeoutMs);
+        timer.unref?.();
+        endWaiters.push(() => {
+            clearTimeout(timer);
+            pending.delete(id);
+            resolve(null);
+        });
+        pending.set(id, (message) => {
+            clearTimeout(timer);
+            resolve(message);
+        });
+    });
+    try {
+        send({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "initialize",
+            params: {
+                protocolVersion: "2025-06-18",
+                capabilities: {},
+                clientInfo: { name: "cockpit-doctor", version: "1" },
+            },
+        });
+        const initialized = await awaitReply(1);
+        if (!initialized)
+            return { status: "no_answer", ms: elapsed(), ...endedDetail(ended) };
+        if (initialized["error"]) {
+            return {
+                status: "no_answer",
+                ms: elapsed(),
+                reason: "protocol_error",
+                said: firstLine(rpcErrorMessage(initialized)),
+            };
+        }
+        send({ jsonrpc: "2.0", method: "notifications/initialized" });
+        send({
+            jsonrpc: "2.0",
+            id: 2,
+            method: "tools/call",
+            params: { name: request.toolName, arguments: request.toolArguments },
+        });
+        const called = await awaitReply(2);
+        if (!called)
+            return { status: "no_answer", ms: elapsed(), ...endedDetail(ended) };
+        if (called["error"]) {
+            return {
+                status: "no_answer",
+                ms: elapsed(),
+                reason: "protocol_error",
+                said: firstLine(rpcErrorMessage(called)),
+            };
+        }
+        const result = (called["result"] ?? {});
+        const said = firstLine((result.content ?? []).find((part) => part.type === "text")?.text ?? "");
+        if (result.isError !== true)
+            return { status: "answered", ms: elapsed(), said };
+        return { status: "refused", ms: elapsed(), reason: refusalReason(said), said };
+    }
+    finally {
+        try {
+            child.stdin?.end();
+            child.kill();
+        }
+        catch (error) {
+            // The verdict is already decided; a child that will not close changes
+            // none of it. Not silent: the reason travels in the caller's log.
+            void error;
+        }
+    }
+}
+/**
+ * The DOOR's own reason label, lifted from the sentence the MCP server's
+ * `tool-result.ts` built. Deliberately not rephrased — that file's header is
+ * explicit that a second wording in a second place is a second thing to keep
+ * in step. `packages/bli-cockpit-mcp/scripts/smoke.ts` reads the same shapes
+ * for the same reason; the two live in packages that do not depend on each
+ * other, which is why the reading exists twice and nothing else does.
+ */
+export function refusalReason(said) {
+    if (/could not be reached for [^(]*\(/u.test(said))
+        return "door_unreachable";
+    const refused = /refused [^(]*\(([^)]+)\)/u.exec(said);
+    if (refused?.[1])
+        return refused[1];
+    const unpaired = /not paired with Tower \(([^)]+)\)/u.exec(said);
+    if (unpaired?.[1])
+        return unpaired[1];
+    return "unlabelled_refusal";
+}
+function endedDetail(ended) {
+    return ended ?? { reason: "protocol_error", said: "the server stopped answering for an unnamed reason" };
+}
+function rpcErrorMessage(message) {
+    const error = message["error"];
+    if (error && typeof error === "object") {
+        const detail = error;
+        if (typeof detail.message === "string")
+            return detail.message;
+        return `JSON-RPC error ${String(detail.code ?? "?")}`;
+    }
+    return "JSON-RPC error";
+}
+function defaultSpawn(command, args, options) {
+    return spawn(command, args, {
+        env: options.env,
+        stdio: ["pipe", "pipe", "ignore"],
+    });
+}
+function defaultRealpath(value) {
+    try {
+        return fs.realpathSync.native(value);
+    }
+    catch {
+        return value;
+    }
+}
+function defaultExists(file) {
+    try {
+        return fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function firstLine(value) {
+    return (value.split("\n")[0] ?? value).slice(0, 240);
+}

package/dist/commands/ops-render-coverage.js

@@ -0,0 +1,62 @@
+/**
+ * `cockpit ops --coverage` — WHICH sessions never arrived (BLI-3798).
+ *
+ * The board's COVERAGE block already prints a line per person. What it never
+ * printed was the BUCKET table: the reasons were computed on the server, sat
+ * on `people[].days[].reasons` in every response, and were never rendered
+ * anywhere — so `42 sessions seen and never arrived` was the whole of what a
+ * person saw, ten QA ticks running, and reading further meant writing a script
+ * against production.
+ *
+ * Same rule as the rest of this file's family: every sentence in here was
+ * written on the SERVER (`lib/ops/coverage-rollup.ts` and
+ * `lib/ops/coverage-buckets.ts`) and is printed VERBATIM. This module decides
+ * order, indentation and column widths and nothing else. A terminal that
+ * composed its own fix sentence would eventually tell somebody to run a
+ * command the board does not believe in, and the one that is wrong is always
+ * the one somebody is reading.
+ *
+ * A CLI too old to know this section simply does not print it: the buckets
+ * ride the ordinary `coverage` section of the same response, so nothing here
+ * is load-bearing for delivery. What is load-bearing is that the SERVER also
+ * puts the dominant bucket in the `collection-coverage` row's `detail`, which
+ * every version prints when the row is `failing`.
+ */
+/**
+ * The bucket table, largest first, each with its people and its fix.
+ *
+ * Printed after the person lines, because "who" comes before "which bucket"
+ * when somebody is scanning — but the HEADLINE goes first, since it is the one
+ * line that answers the question the row has been failing to answer.
+ */
+export function renderCoverageBuckets(table, dim) {
+    if (!table) {
+        // Never a silent gap where a section was asked for: an older Tower that
+        // does not send the table says so, rather than looking like a clean fleet.
+        return [
+            "",
+            "BUCKETS  not sent by this Tower — it predates the coverage bucket table; the per-person lines above are all it knows",
+        ];
+    }
+    const buckets = table.buckets ?? [];
+    const lines = ["", `BUCKETS  ${table.headline ?? "(no headline)"}`];
+    if (buckets.length === 0) {
+        lines.push(dim("  nothing is unaccounted for, so there are no buckets to show"));
+        return lines;
+    }
+    for (const bucket of buckets) {
+        lines.push(`  ${String(bucket.count ?? 0).padStart(5)}  ${bucket.reason ?? "unlabelled"}`);
+        for (const person of bucket.people ?? []) {
+            const days = (person.days ?? []).join(", ");
+            lines.push(dim(`         ${String(person.count ?? 0).padStart(4)}  ${person.displayName ?? "(person)"}` +
+                (days ? `  ${days}` : "")));
+        }
+        // The fix is NOT dimmed. It is the only line on this board that tells
+        // somebody to do something, and a board whose one action is grey is a
+        // board that gets scrolled past — which is what ten ticks of `failing`
+        // with no named bucket already proved.
+        if (bucket.owner)
+            lines.push(`         fix: ${bucket.owner}`);
+    }
+    return lines;
+}

package/dist/commands/ops-render.js

@@ -12,7 +12,9 @@
  * artifact does and does not prove — because that is exactly the moment
  * somebody is about to conclude something from it.
  */
+import { renderCoverageBuckets, } from "./ops-render-coverage.js";
 export { renderMemoryHooks, renderMemoryUsage } from "./ops-render-memory.js";
+export { renderCoverageBuckets };
 /** The word a person reads. Short, fixed width, and never a bare colour. */
 export function verdictWord(verdict) {
     switch (verdict) {
@@ -64,7 +66,15 @@ export function intervalWord(row) {
         return `every ${Math.round(hours / 24)}d`;
     return `every ${Math.round(hours)}h`;
 }
-export function renderOpsStatus(payload, dim) {
+export function renderOpsStatus(payload, dim, 
+/**
+ * BLI-3798. `alwaysShowBuckets` is what `cockpit ops --coverage` passes: the
+ * board hides the table on a clean fleet (it would be nineteen rows of
+ * nothing), but somebody who asked for the coverage view specifically is
+ * owed the answer "nothing is unaccounted for" out loud rather than an
+ * absent section they have to interpret.
+ */
+options = {}) {
     const rows = payload.pipelines ?? [];
     const lines = [];
     const counts = new Map();
@@ -104,8 +114,16 @@ export function renderOpsStatus(payload, dim) {
     }
     if (payload.fleet)
         lines.push(...renderFleet(payload.fleet, dim));
-    if (payload.coverage)
+    if (payload.coverage) {
         lines.push(...renderCoverage(payload.coverage, dim));
+        // BLI-3798. The bucket table rides EVERY board, not only `--coverage`:
+        // ten QA ticks of `42 sessions seen and never arrived` is what happens
+        // when the reasons are only reachable behind a flag nobody knew about.
+        // Skipped entirely on a clean fleet, so it costs a healthy board nothing.
+        if (options.alwaysShowBuckets || (payload.coverage.counts?.gapSessions ?? 0) > 0) {
+            lines.push(...renderCoverageBuckets(payload.coverage.buckets, dim));
+        }
+    }
     const slack = payload.skips?.slack;
     const external = payload.skips?.external;
     if (slack || external) {

package/dist/commands/ops.js

@@ -16,6 +16,15 @@
  * the command, and it does not pass silently either: it prints as `n/a` with
  * the reason there is nothing to read.
  *
+ * `ops status --coverage` (BLI-3798) is the same door narrowed to the
+ * collection-coverage row, with the BUCKET table under it: which bucket the
+ * missing sessions are in, whose machines they are on, which of their own days,
+ * and one fix sentence per bucket. It exists because the board said
+ * `42 sessions seen and never arrived` for ten consecutive QA ticks while the
+ * reasons sat one field deeper in the same response, and reading them meant
+ * writing a script against production. The table also rides the ordinary board
+ * whenever anything is missing, so nobody has to know this flag exists.
+ *
  * `ops recompile` spends a real provider call, so it says what it is about to
  * do and reports the ceiling by name. A run that outlives Tower's own 800-second
  * budget produces no response at all, which is indistinguishable from a network
@@ -83,7 +92,9 @@ async function runOpsStatus(command, io, tower) {
     }
     else {
         const styled = colorEnabled(io);
-        for (const line of renderOpsStatus(payload, (text) => dim(text, styled))) {
+        for (const line of renderOpsStatus(payload, (text) => dim(text, styled), {
+            alwaysShowBuckets: command.coverage === true,
+        })) {
             writeLine(io.stdout, line);
         }
         if (memory?.section) {

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.72");
+    writeLine(io?.stdout ?? process.stdout, "0.2.75");
     return 0;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.72",
+  "version": "0.2.75",
   "private": false,
   "type": "module",
   "bin": {
@@ -24,11 +24,11 @@
     "pretypecheck": "node ../../scripts/build-workspace-dep.mjs @bli-cockpit/cli",
     "typecheck": "node -e \"await import('./dist/commands/public-root.js')\"",
     "pretest": "node ../../scripts/build-workspace-dep.mjs @bli-cockpit/cli",
-    "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
+    "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.11",
-    "@bli-cockpit/mcp": "0.1.12",
+    "@bli-cockpit/mcp": "0.1.13",
     "@bli-cockpit/telemetry-core": "0.1.32"
   }
 }