@cotal-ai/cli 0.153.1 → 0.155.0

package/dist/commands/status.js

@@ -2,7 +2,7 @@ import { accessSync, constants, existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { CotalEndpoint, agentFilePath, dialerFor, EpEnvelopeError, formatAge, isReachable, mintCreds, mintLifecycleUid, resolveService, realDirNoSymlink, invokeRepairingSplit, standaloneConnectOpts, newIdentity, idFromCreds, principalKey, DEV_OWNER, unansweredRequest, resolveAuthProvider, personaDir, presenceText, } from "@cotal-ai/core";
-import { stoppedLoopbackListener, accountInventory, assessMaintenanceClaim, authDir, isCommandFailure, readMaintenanceJournal, recordsElsewhereError, recordsElsewhereText, restoreRolledBackRuns, targetErrorSpace, brokerAddressForDisplay, canonicalRoot, CLI_USER_ACTOR, codeSpan, CommandFailure, deliveryCredsKey, DELIVERY_PIDFILE, extensionsDir, findCotalRoot, folderSpaceOverSelection, meshesForRoot, resolveReadsLiveness, stoppedStack, unsettledStackOperation, withdrawOperationNote, hasUserAuthState, homeCotalDir, cachedPreferences, loadLaunchPersonaFile, resolvePreference, isMeshRegistryError, isWorkspaceTargetError, jsonFlag, loadManagerInstanceIdentity, loadSoleSpaceAuth, localProcessPath, localProcessVisible, MANAGER_PIDFILE, oneLine, PREFERENCE_KEYS, parsePid, plainFlag, preflightTarget, presentationOf, principalFromBearer, probeLiveness, probeWebReadiness, readCurrent, readMeshRegistry, readPidfile, preparedRecordSkipped, readPreparedSpaces, readRenewalRecord, renderWorkspaceError, resolveMeshTarget, serverFlag, spaceFlag, userAuthStateDir, WEB_PIDFILE, WEB_READINESS_HEADER, workspaceSecretStore, writeResult, workspaceErrorParts, preferencesPath, preferencesFolderWarning, cotalDirLink, movedProject, spaceStreamsAbsent, spaceStreamsExpected, resolveControlTarget, } from "@cotal-ai/workspace";
+import { stoppedLoopbackListener, accountInventory, assessMaintenanceClaim, authDir, isCommandFailure, readMaintenanceJournal, recordsElsewhereError, recordsElsewhereText, restoreRolledBackRuns, targetErrorSpace, brokerAddressForDisplay, brokerCheck, canonicalRoot, CLI_USER_ACTOR, codeSpan, CommandFailure, deliveryCredsKey, DELIVERY_PIDFILE, extensionsDir, findCotalRoot, folderSpaceOverSelection, meshesForRoot, resolveReadsLiveness, stoppedStack, unsettledStackOperation, withdrawOperationNote, hasUserAuthState, homeCotalDir, cachedPreferences, loadLaunchPersonaFile, resolvePreference, isMeshRegistryError, isWorkspaceTargetError, jsonFlag, loadManagerInstanceIdentity, loadSoleSpaceAuth, localProcessPath, localProcessVisible, MANAGER_PIDFILE, oneLine, PREFERENCE_KEYS, parsePid, plainFlag, preflightTarget, presentationOf, principalFromBearer, probeLiveness, probeWebReadiness, readCurrent, readMeshRegistry, readPidfile, preparedRecordSkipped, readPreparedSpaces, readRenewalRecord, renderWorkspaceError, resolveMeshTarget, serverFlag, spaceFlag, userAuthStateDir, WEB_PIDFILE, WEB_READINESS_HEADER, workspaceSecretStore, writeResult, workspaceErrorParts, preferencesPath, preferencesFolderWarning, cotalDirLink, movedProject, spaceStreamsAbsent, spaceStreamsExpected, resolveControlTarget, } from "@cotal-ai/workspace";
 import { localProcessSurface } from "../ext-loader.js";
 import { cliVersion, cliProvenance, readExtensionVersions } from "../lib/version.js";
 import { agentSkillsSkew } from "../lib/agent-skills.js";
@@ -30,9 +30,10 @@ import { freshTeamAttemptSettled, listFreshTeamAttempts, listFreshTeamSummaries
 import { additiveTeamRecordedState, listAdditiveTeamAttempts } from "../lib/team-additive-attempt.js";
 import { maintenanceNextStep, preservedSourceState, restoreNextStep, rolledBackNotes } from "../lib/restore.js";
 import { attemptProcessesGone } from "../lib/isolated-broker.js";
-import { journalRecordedElsewhere, readStackJournal, serviceHeldRecords, STACK_DEFINITION, stackStartedWithoutManager, stackOperationBlock, goneStackRoot, unfinishedStackOperation, } from "../lib/stack-journal.js";
+import { journalRecordedElsewhere, readStackJournal, serviceHeldRecords, STACK_DEFINITION, stackStartedWithoutManager, stackOperationBlock, stackRootGone, unfinishedStackOperation, } from "../lib/stack-journal.js";
 import { cotalLinkHere, homeHoldsStack, linkedCotalRemedy } from "../lib/paths.js";
 import { storeWriteProblem } from "../lib/store-dir.js";
+import { stackStoreWarnings } from "../lib/store-identity.js";
 import { natsServerLabel } from "../lib/nats-bin.js";
 import { askManager } from "@cotal-ai/workspace/control";
 /** `--components` is the fail-loud health pass with a machine-readable EXIT DISPOSITION. Bare
@@ -59,21 +60,20 @@ export const statusFlags = [
     jsonFlag,
     plainFlag,
 ];
-/** A project root with no registration or prepared space here, such as one whose space was
- *  forgotten. The resolver gives it the default broker address, which any broker may hold, so
- *  status selects no space for it and dials nothing. */
+/** A project root with an empty `.cotal/` and no registration or prepared space. The resolver
+ *  gives it the default broker address, which any broker may hold, so status selects no space for
+ *  it and dials nothing. A root whose records name no space is refused by the resolver instead, and
+ *  status uses that refusal. */
 class UnregisteredRoot {
     root;
-    namesNoSpace;
-    constructor(root, namesNoSpace) {
+    constructor(root) {
         this.root = root;
-        this.namesNoSpace = namesNoSpace;
     }
 }
 function resolveSelected(cwd, values, offline) {
     try {
         const target = resolveMeshTarget(cwd, { server: values.server, space: values.space, offline });
-        return target.source === "local-space" ? { ok: false, error: new UnregisteredRoot(target.root, target.namesNoSpace === true) } : { ok: true, target };
+        return target.source === "local-space" ? { ok: false, error: new UnregisteredRoot(target.root) } : { ok: true, target };
     }
     catch (e) {
         return { ok: false, error: e };
@@ -162,10 +162,24 @@ export async function status(args) {
     // THE RESPONDER AXIS (#1576), read ONCE and threaded into the rows that would otherwise claim
     // health they never checked. It is read before the folder section because that section renders
     // the delivery process row, and a live pid means nothing without it.
-    const responder = await readResponderAxis(selected);
+    const preflight = selected.ok && selected.target.mode !== "user" ? await preflightTarget(selected.target) : undefined;
+    const responder = await readResponderAxis(selected, preflight);
     const folder = blocked ? unreadFolder(root, blocked) : await readFolder(root, selected, values, responder.state, gaps, hints);
-    const meshes = await readMeshes(cwd, selected, Boolean(values.all), gaps, offline);
-    const target = await readSelected(selected, responder, folder, gaps, hints);
+    const meshes = await readMeshes(cwd, selected, Boolean(values.all), gaps, offline, preflight);
+    const maintenance = blocked ? { root, space: null, state: "unreadable", attemptId: null, next: null } : readMaintenance(root, gaps);
+    const recovery = backupRecovery(maintenance);
+    const selectedHints = [];
+    const target = await readSelected(selected, responder, folder, gaps, selectedHints, preflight);
+    // A held backup must be released before this root can start. Keep the selection's diagnostics,
+    // but replace its ordinary restart advice with the journal's recovery step.
+    if (recovery)
+        hints.unshift(recovery);
+    else
+        hints.push(...selectedHints);
+    if (!blocked)
+        readStackStoreWarnings(root, gaps, hints);
+    if (selected.ok && selected.target.origin === "up" && !sameDir(root, selected.target.root))
+        readStackStoreWarnings(selected.target.root, gaps, hints, selected.target.space);
     // The note under the heading sends here for this folder's own stack cut off with no recorded
     // outcome under another selection. A blocked one is named with its block under `This folder's
     // space` and its step first in Next, so that note is left out here, with its --json warning. One
@@ -173,11 +187,10 @@ export async function status(args) {
     const held = folderStack(folder, target);
     if (held && folder.stackBlock)
         withdrawOperationNote("FOLDER_SPACE_NOT_RUNNING", held.space);
-    if (held && !folder.stackBlock && !folder.stackUnfinished && unsettledStackOperation(held.root, held.space))
+    if (!recovery && held && !folder.stackBlock && !folder.stackUnfinished && unsettledStackOperation(held.root, held.space))
         hints.push(`start it with \`cotal up\` in ${held.root}`);
     const services = readOwnedServices(selected, gaps);
     const bootAttempts = blocked ? { root, state: "partial", observedAt: new Date().toISOString(), unsettled: [], additive: [], unreadable: [], elsewhere: [] } : readBootAttempts(root, gaps);
-    const maintenance = blocked ? { root, space: null, state: "unreadable", attemptId: null, next: null } : readMaintenance(root, gaps);
     const logged = selected.ok ? brokerStoreWrite(selected.target.root, selected.target.space) : undefined;
     // A store write failure holds until the broker restarts, so it is named before a full store.
     const full = selected.ok && target.resolved && target.storedBytes !== null && logged?.state !== "write-failed" ? storeFull(selected.target.root, selected.target.space, target.storedBytes) : undefined;
@@ -476,7 +489,7 @@ async function expectedDeliveryHolder(target) {
  *
  *  `leased` says whether the read found a delivery lease record. An open mesh runs no delivery
  *  daemon, so there a missing lease is the normal state rather than an unbound responder. */
-async function readResponderAxis(selected) {
+async function readResponderAxis(selected, preflight) {
     let leased = false;
     if (!selected.ok)
         return { state: "unknown", leased };
@@ -484,8 +497,7 @@ async function readResponderAxis(selected) {
     if (target.mode === "user")
         return { state: "unknown", leased };
     try {
-        const preflight = await preflightTarget(target);
-        if (!preflight.ok)
+        if (!preflight?.ok)
             return { state: "unknown", leased };
         const id = newIdentity();
         const creds = target.auth ? await mintCreds(target.auth, id, "observer") : undefined;
@@ -646,9 +658,9 @@ async function readFolder(root, selected, values, responder, gaps, hints) {
         controllerStack = false;
         // A journal no command can use is named with its way out, in the warnings and under Next; the
         // rest of the report still stands.
-        if (isCommandFailure(error) && error.code === "SCHEMA_INVALID") {
+        if (isCommandFailure(error) && (error.code === "SCHEMA_INVALID" || error.code === "PERMISSION_DENIED")) {
             unusable = true;
-            gaps.add("STACK_JOURNAL_INVALID", error.remedy ? `${error.message}; ${error.remedy}` : error.message, { root });
+            gaps.add(error.code === "PERMISSION_DENIED" ? "STACK_JOURNAL_UNREADABLE" : "STACK_JOURNAL_INVALID", error.remedy ? `${error.message}; ${error.remedy}` : error.message, { root });
             if (error.remedy)
                 hints.push(error.remedy);
         }
@@ -929,7 +941,7 @@ function deliveryDetail(live, responder) {
  *  with its own recorded TLS requirement. A bare TCP/INFO probe would green-light a plaintext broker
  *  that has substituted for a TLS-required mesh — the FAIL1 attack — so a list that only asks "is
  *  anything listening" cannot report on the one property the record claims. */
-async function readMeshes(cwd, selected, all, gaps, offline) {
+async function readMeshes(cwd, selected, all, gaps, offline, preflight) {
     // A registry file that cannot be read is named, and the readable records are still listed and
     // checked. Only an absent directory or pointer is an empty registry or no current mesh.
     const unreadable = [];
@@ -971,6 +983,18 @@ async function readMeshes(cwd, selected, all, gaps, offline) {
     const chosen = selected.ok ? selected.target : undefined;
     // A `--server` that names another address is the only broker dialed for the selected space.
     const checked = (m) => all || (m.space === chosen?.space && m.server === chosen.server);
+    const check = async (m) => {
+        if (!checked(m))
+            return "not-checked";
+        if (preflight && m.space === chosen?.space && m.server === chosen.server) {
+            if (preflight.ok)
+                return "reachable";
+            if (preflight.kind === "slow-link" || preflight.kind === "broker-stopped" || preflight.kind === "unreachable")
+                return preflight.kind;
+            return preflight.kind === "tls-trust" || preflight.kind === "tls-unsupported" ? "unreachable" : "reachable";
+        }
+        return brokerCheck(m.server, m.tlsRequired);
+    };
     const items = await Promise.all(entries.map(async (m) => ({
         space: m.space,
         server: displayStatusBroker(m.server, m.space, gaps),
@@ -981,7 +1005,7 @@ async function readMeshes(cwd, selected, all, gaps, offline) {
         eventsRequired: m.policy?.events === "required",
         modeChecked: m.unchecked !== true,
         current: m.space === current,
-        check: checked(m) ? ((await isReachable(m.server, m.tlsRequired ? { tls: true } : {})) ? "reachable" : "unreachable") : "not-checked",
+        check: await check(m),
         catalog: m.origin === "catalog" ? { name: m.catalogName && m.catalogName !== m.space ? m.catalogName : null, fetchedAt: m.catalogFetchedAt ?? null, error: m.catalogError ?? null } : null,
     })));
     // The prepared spaces folder, or a record in it, that cannot be read is named the same way.
@@ -1014,6 +1038,25 @@ async function readMeshes(cwd, selected, all, gaps, offline) {
         catalogs: preparedCatalogDiagnostics().map((r) => ({ idp: r.account.idpUrl, account: r.account.sub, state: r.state, error: r.state === "failed" ? (r.error ?? "refresh failed") : null })),
     };
 }
+/** Diagnose the current folder's store and a selected local stack independently of folder trust. */
+function readStackStoreWarnings(root, gaps, hints, space) {
+    try {
+        const journal = readStackJournal(root)?.journal;
+        if (journal && (space === undefined || journal.space === space))
+            for (const warning of stackStoreWarnings(journal))
+                gaps.add(warning.code, warning.message, warning.target);
+    }
+    catch (error) {
+        if (isCommandFailure(error) && (error.code === "SCHEMA_INVALID" || error.code === "PERMISSION_DENIED")) {
+            gaps.add(error.code === "PERMISSION_DENIED" ? "STACK_JOURNAL_UNREADABLE" : "STACK_JOURNAL_INVALID", error.remedy ? `${error.message}; ${error.remedy}` : error.message, { root });
+            if (error.remedy)
+                hints.push(error.remedy);
+        }
+        else if (!isCommandFailure(error) || error.code !== "CONFLICT")
+            throw error;
+        // A copied or moved journal is diagnosed by the folder and selection readers.
+    }
+}
 /** The refusal of the stack journal at `root` when it is one no command can use, as `up` and `down`
  *  refuse it. Undefined when it reads or is absent. */
 function unusableStackJournal(root) {
@@ -1022,7 +1065,7 @@ function unusableStackJournal(root) {
         return undefined;
     }
     catch (error) {
-        return isCommandFailure(error) && error.code === "SCHEMA_INVALID" ? error : undefined;
+        return isCommandFailure(error) && (error.code === "SCHEMA_INVALID" || error.code === "PERMISSION_DENIED") ? error : undefined;
     }
 }
 /** The refusal of `space`'s service instance records when one is a record no command can use, as
@@ -1053,7 +1096,7 @@ function rootStoreProblem(root) {
         return undefined;
     }
 }
-async function readSelected(selected, responder, folder, gaps, hints) {
+async function readSelected(selected, responder, folder, gaps, hints, preflight) {
     const cmd = displayCmd();
     if (!selected.ok) {
         const e = selected.error;
@@ -1074,11 +1117,7 @@ async function readSelected(selected, responder, folder, gaps, hints) {
         }
         if (e instanceof UnregisteredRoot) {
             const message = `no space is registered or prepared here for ${e.root}`;
-            // A bare `up` in a folder whose records name no space starts a space named after the folder,
-            // which then holds it, so the step that brings a forgotten space back is to prepare it again.
-            hints.push(e.namesNoSpace
-                ? `prepare a space with \`${cmd} space create <name> --root ${shellWord(e.root)}\`, or select one with \`${cmd} use <name>\``
-                : `run \`${cmd} up\` in ${e.root} to start one, or select a space with \`${cmd} use <name>\``);
+            hints.push(`run \`${cmd} up\` in ${e.root} to start one, or select a space with \`${cmd} use <name>\``);
             return { resolved: false, code: "unregistered-root", message };
         }
         if (!isWorkspaceTargetError(e))
@@ -1145,6 +1184,16 @@ async function readSelected(selected, responder, folder, gaps, hints) {
         spaceStreams: { state: "not-checked", root: null, stack: null },
         storedBytes: null,
     };
+    // A moved project keeps its trust under its new path. Prefer that specific diagnosis when
+    // this folder holds the records, otherwise report the missing stack root before any auth probe.
+    const moved = target.mode === "auth" && !target.auth ? movedProject(target.space, target.root) : undefined;
+    if (moved) {
+        hints.push(moved.remedy);
+        return { resolved: false, code: "moved-folder", message: moved.message };
+    }
+    const overridden = (target.source === "flag-server" || target.source === "flag-space-override") && target.recordedServer !== target.server;
+    if (base.rootGone && !overridden)
+        return { ...base, connection: "root-gone", snapshot: { state: "skipped", reason: "the stack's project folder was moved or deleted" } };
     if (target.mode === "user") {
         // Status never static-mints on a user-auth mesh (the flip). Everything here is offline
         // introspection — the login cache + the locally-readable ledger — plus, only when this
@@ -1177,14 +1226,8 @@ async function readSelected(selected, responder, folder, gaps, hints) {
             return { ...result, snapshot: { state: "skipped", reason: "needs a signed-in, granted login" } };
         return { ...result, ...(await readSnapshot(() => userSnapshotEndpoint(target, stateDir), target.space, true, gaps)) };
     }
-    // A project folder moved after its stack started there keeps the seed under its new path, where a
-    // probe without it reads as authentication required. Name the move and the way back, as send does.
-    const moved = target.mode === "auth" && !target.auth ? movedProject(target.space, target.root) : undefined;
-    if (moved) {
-        hints.push(moved.remedy);
-        return { resolved: false, code: "moved-folder", message: moved.message };
-    }
-    const preflight = await preflightTarget(target);
+    if (preflight === undefined)
+        throw new Error("status: selected non-user target has no preflight observation");
     if (!preflight.ok) {
         // A `--server` address that is not the one recorded for the space says nothing about whether its
         // stack runs, so Next names that address as the refusal of other commands does. A stopped stack
@@ -1409,7 +1452,7 @@ function folderSection(f, selected) {
     return { title: "This Folder", blocks: [{ kind: "fields", rows }] };
 }
 function meshesSections(m) {
-    const check = { reachable: cell("reachable", "ok"), unreachable: cell("down", "failed"), "not-checked": cell("not checked", "hint") };
+    const check = { reachable: cell("reachable", "ok"), unreachable: cell("down", "failed"), "slow-link": cell("not answering", "failed"), "broker-stopped": cell("broker process is stopped", "failed"), "not-checked": cell("not checked", "hint") };
     const blocks = [];
     if (!m.items.length && !m.unreadable.length)
         blocks.push({ kind: "lines", lines: [cell("none", "hint")] });
@@ -1608,17 +1651,13 @@ function machineOverview(r, wide) {
         ],
     };
 }
-/** Whether `root` is the gone folder of the stack this machine still records for `space`. */
-function stackRootGone(space, root) {
-    const gone = goneStackRoot(space);
-    return gone !== undefined && canonicalRoot(gone) === canonicalRoot(root);
-}
 function connectionCell(s) {
     if (s.connection === "ok" || s.connection === "reachable")
         return stateCell("reachable", "ok");
     const states = {
+        "root-gone": "project folder was moved or deleted",
         unreachable: "unreachable",
-        "slow-link": "connection timed out",
+        "slow-link": "not answering",
         "broker-stopped": `broker process ${s.brokerPid} is stopped`,
         "tls-trust": "TLS could not be verified",
         "tls-unsupported": "listener does not offer required TLS",
@@ -1655,7 +1694,7 @@ function spaceStateCell(r, entry) {
         return connectionCell(r.selected);
     if (entry.check === "not-checked")
         return "";
-    return stateCell(entry.check === "reachable" ? "reachable" : "unreachable", entry.check === "reachable" ? "ok" : "failed");
+    return stateCell(entry.check === "slow-link" ? "not answering" : entry.check === "broker-stopped" ? "broker process is stopped" : entry.check, entry.check === "reachable" ? "ok" : "failed");
 }
 /**
  * The spaces this machine knows: the selected one first with its connection state, then one line
@@ -1818,7 +1857,14 @@ function stackLines(folder) {
 function roleList(roles) {
     return roles.length > 1 ? `${roles.slice(0, -1).join(", ")} and ${roles.at(-1)}` : roles[0] ?? "";
 }
+/** Pre-commit backup claims block ordinary startup; ready cuts and committed restores do not. */
+function backupRecovery(maintenance) {
+    return maintenance?.state === "claimed" || maintenance?.state === "restore-ready" ? maintenance.next : null;
+}
 function nextActions(r) {
+    const recovery = backupRecovery(r.maintenance);
+    if (recovery)
+        return { title: "Next", blocks: [...new Set([recovery, ...r.hints])].map((hint) => ({ kind: "lines", lines: [cell(hint, "hint")] })) };
     const cmd = displayCmd();
     const items = [];
     const extra = [];