@bli-cockpit/cli 0.2.94 → 0.2.96

package/dist/commands/sync-followups-staging.js

@@ -0,0 +1,202 @@
+import { redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { runStagingPrune } from "../disk-prune.js";
+import { runEvidenceReconcile, } from "../evidence-reconcile-client.js";
+import { runEvidenceRedelivery, } from "../evidence-redelivery.js";
+/** How many reconcile batches (of up to 500 hashes each) one sync tick may spend. */
+const RECONCILE_BATCHES_PER_TICK = 1;
+/**
+ * BLI-3619: staged raw evidence Tower has already accepted stops living on the
+ * laptop forever.
+ *
+ * Same shape as the memory install beside it and for the same reasons: it runs
+ * only once collection's own outcome is decided and reported, at most once a
+ * day, it cannot throw, and its outcome is its own named receipt rather than a
+ * sync failure. A machine that cannot prune is a machine short of disk, and
+ * that must never also be a machine that stops collecting.
+ *
+ * The rule itself is `disk-retention.ts`: only objects the upload ledger
+ * vouches for are ever deleted, and anything undelivered is counted, aged and
+ * named instead.
+ *
+ * BLI-3619's second half runs FIRST, every tick, bounded to
+ * `RECONCILE_BATCHES_PER_TICK` (one batch of up to 500 hashes): the local
+ * ledger's own memory is capped, so a laptop that keeps accumulating
+ * `unknown` state needs SOMETHING asking the server on a schedule, not only
+ * when a person happens to type `cockpit clean --reconcile`. One batch a tick
+ * is not throttled to once a day like the prune below — an `unknown` backlog
+ * drains at up to 500 hashes/15 min, and the ordinary case (nothing unknown)
+ * costs one cheap local read and no network call at all, so it never competes
+ * with collection for the tick's time. A reconcile failure never blocks the
+ * prune that follows it.
+ *
+ * BLI-3797 sits between them: the reconcile has just established which staged
+ * objects the SERVER says it never received, so the redelivery drain re-offers
+ * exactly those, bounded, before the prune runs and can delete whatever landed.
+ * Neither of the two can block the prune, and none of the three can fail a tick.
+ */
+export async function runStagingPruneAfterSync(command, io, dashboardUrl, options = {}) {
+    const events = [];
+    const reconciled = await runReconcileFollowUp(command, io, dashboardUrl, options);
+    if (reconciled)
+        events.push(reconcileEvent(reconciled));
+    const redelivered = await runRedeliveryFollowUp(command, io, dashboardUrl, options);
+    if (redelivered)
+        events.push(redeliveryEvent(redelivered));
+    let result;
+    try {
+        result = await runStagingPrune(getCollectorRuntimePaths(command.homeDir), {
+            env: io.env,
+            ...(options.now ? { now: options.now } : {}),
+        });
+    }
+    catch (error) {
+        // runStagingPrune already catches everything it can reach; this is the
+        // last-resort net so a prune crash truly cannot touch the sync result.
+        result = { ...prunedNothing(), reason: "prune_threw", status: "fail" };
+        console.error("[collector prune] the prune follow-up threw", JSON.stringify({
+            reason: "prune_followup_threw",
+            detail: redactedSyncErrorDetail(error),
+        }));
+    }
+    // The daily throttle is the steady state — reporting it would post a receipt
+    // on 95 of every 96 ticks for no new information.
+    if (result.reason !== "throttled_recent_run") {
+        events.push(stagingPruneEvent(result));
+    }
+    if (events.length === 0)
+        return;
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        command: "sync",
+        events,
+        json: command.json,
+        io,
+    });
+}
+/**
+ * Never throws (`runEvidenceReconcile` already never does); returns `null`
+ * for the boring, common case — nothing this tick was `unknown` — so that
+ * case costs no receipt either, the same rule the prune's own daily throttle
+ * follows above.
+ */
+async function runReconcileFollowUp(command, io, dashboardUrl, options) {
+    const result = await runEvidenceReconcile({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        maxBatches: RECONCILE_BATCHES_PER_TICK,
+        fetch: io.fetch,
+        ...(options.now ? { now: options.now } : {}),
+    });
+    return result.reason === "nothing_unknown" ? null : result;
+}
+/**
+ * BLI-3797, between the reconcile above and the prune below, and in that order
+ * for a reason: reconcile turns `unknown` into a server-backed answer, this
+ * re-offers what that answer says never landed, and the prune then deletes
+ * whatever this just made durable. Running the drain first would ask the server
+ * about hashes it is about to be told the truth about; running it after the
+ * prune would leave a tick's worth of freed cap unused.
+ *
+ * Never throws (`runEvidenceRedelivery` already never does); returns `null` for
+ * the boring, common case — nothing on this disk is undelivered — so the steady
+ * state costs no receipt, the same rule the reconcile follow-up above and the
+ * prune's daily throttle below both follow.
+ */
+async function runRedeliveryFollowUp(command, io, dashboardUrl, options) {
+    const result = await runEvidenceRedelivery({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        env: io.env,
+        fetch: io.fetch,
+        ...(options.now ? { now: options.now } : {}),
+    });
+    return result.reason === "nothing_uncommitted" ? null : result;
+}
+/** Counts and byte totals only; no pack id and no hash travels in a receipt. */
+function redeliveryEvent(result) {
+    const detail = [
+        `offered ${result.offered} object(s), ${result.offered_bytes}B, across ${result.packs} pack(s)`,
+        `uploaded ${result.uploaded} (${result.uploaded_bytes}B), reused ${result.reused}, failed ${result.failed}`,
+        `held ${result.held}, deferred ${result.deferred} (${result.deferred_bytes}B)`,
+        result.failure_reasons.length > 0
+            ? `failure_reasons ${result.failure_reasons.join(",")}`
+            : null,
+    ]
+        .filter((part) => Boolean(part))
+        .join("; ");
+    if (result.status === "fail") {
+        return {
+            step: "evidence_redelivery",
+            status: "fail",
+            error_code: result.reason,
+            error_detail: detail,
+        };
+    }
+    if (result.status === "skipped") {
+        return {
+            step: "evidence_redelivery",
+            status: "skipped",
+            error_code: result.reason,
+            error_detail: detail,
+        };
+    }
+    return { step: "evidence_redelivery", status: "ok", error_detail: detail };
+}
+function prunedNothing() {
+    return {
+        status: "skipped",
+        reason: "prune_threw",
+        deleted_files: 0,
+        deleted_bytes: 0,
+        removed_packs: 0,
+        kept_uncommitted: 0,
+        kept_uncommitted_bytes: 0,
+        oldest_uncommitted_age_ms: 0,
+        kept_unknown: 0,
+        kept_unknown_bytes: 0,
+        kept_in_window: 0,
+        cap_bytes: 0,
+        bytes_before: 0,
+        bytes_after: 0,
+        cap_blocked_by_uncommitted: false,
+        cap_blocked_count: 0,
+        failed_deletions: 0,
+    };
+}
+/** Counts and byte totals only; no pack id and no path travels in a receipt. */
+function stagingPruneEvent(result) {
+    const detail = [
+        `freed ${result.deleted_bytes}B in ${result.deleted_files} file(s)`,
+        `held ${result.kept_uncommitted_bytes}B uncommitted`,
+        result.cap_blocked_by_uncommitted
+            ? `staging_cap_blocked_by_uncommitted ${result.cap_blocked_count}`
+            : null,
+        result.failed_deletions > 0
+            ? `failed_deletions ${result.failed_deletions}`
+            : null,
+    ]
+        .filter((part) => Boolean(part))
+        .join("; ");
+    if (result.status === "fail") {
+        return {
+            step: "staging_prune",
+            status: "fail",
+            error_code: result.reason,
+            error_detail: detail,
+        };
+    }
+    if (result.status === "skipped") {
+        return { step: "staging_prune", status: "skipped", error_code: result.reason };
+    }
+    return { step: "staging_prune", status: "ok", error_detail: detail };
+}
+/** Counts only; no hash and no pack id travels in a receipt. */
+function reconcileEvent(result) {
+    const detail = `asked ${result.asked} hash(es) across ${result.batches}/${result.total_batches} batch(es); committed ${result.committed}, not_committed ${result.not_committed}, unknown_to_server ${result.unknown_to_server}, failed_batches ${result.failed_batches}`;
+    if (result.status === "fail") {
+        return { step: "evidence_reconcile", status: "fail", error_code: result.reason, error_detail: detail };
+    }
+    return { step: "evidence_reconcile", status: "ok", error_detail: detail };
+}