@cotal-ai/cli 0.154.0 → 0.155.1

package/dist/commands/status.js

@@ -1,8 +1,8 @@
-import { accessSync, constants, existsSync } from "node:fs";
+import { accessSync, constants, existsSync, lstatSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { CotalEndpoint, agentFilePath, dialerFor, EpEnvelopeError, formatAge, isReachable, mintCreds, mintLifecycleUid, resolveService, realDirNoSymlink, invokeRepairingSplit, standaloneConnectOpts, newIdentity, idFromCreds, principalKey, DEV_OWNER, unansweredRequest, resolveAuthProvider, personaDir, presenceText, } from "@cotal-ai/core";
-import { stoppedLoopbackListener, accountInventory, assessMaintenanceClaim, authDir, isCommandFailure, readMaintenanceJournal, recordsElsewhereError, recordsElsewhereText, restoreRolledBackRuns, targetErrorSpace, brokerAddressForDisplay, brokerCheck, canonicalRoot, CLI_USER_ACTOR, codeSpan, CommandFailure, deliveryCredsKey, DELIVERY_PIDFILE, extensionsDir, findCotalRoot, folderSpaceOverSelection, meshesForRoot, resolveReadsLiveness, stoppedStack, unsettledStackOperation, withdrawOperationNote, hasUserAuthState, homeCotalDir, cachedPreferences, loadLaunchPersonaFile, resolvePreference, isMeshRegistryError, isWorkspaceTargetError, jsonFlag, loadManagerInstanceIdentity, loadSoleSpaceAuth, localProcessPath, localProcessVisible, MANAGER_PIDFILE, oneLine, PREFERENCE_KEYS, parsePid, plainFlag, preflightTarget, presentationOf, principalFromBearer, probeLiveness, probeWebReadiness, readCurrent, readMeshRegistry, readPidfile, preparedRecordSkipped, readPreparedSpaces, readRenewalRecord, renderWorkspaceError, resolveMeshTarget, serverFlag, spaceFlag, userAuthStateDir, WEB_PIDFILE, WEB_READINESS_HEADER, workspaceSecretStore, writeResult, workspaceErrorParts, preferencesPath, preferencesFolderWarning, cotalDirLink, movedProject, spaceStreamsAbsent, spaceStreamsExpected, resolveControlTarget, } from "@cotal-ai/workspace";
+import { stoppedLoopbackListener, accountInventory, assessMaintenanceClaim, authDir, isCommandFailure, readMaintenanceJournal, recordsElsewhereError, recordsElsewhereText, restoreRolledBackRuns, targetErrorSpace, brokerAddressForDisplay, brokerCheck, canonicalRoot, CLI_USER_ACTOR, codeSpan, CommandFailure, deliveryCredsKey, DELIVERY_PIDFILE, extensionsDir, findCotalRoot, folderSpaceOverSelection, meshesForRoot, resolveReadsLiveness, stoppedStack, unsettledStackOperation, withdrawOperationNote, hasUserAuthState, homeCotalDir, cachedPreferences, loadLaunchPersonaFile, resolvePreference, isMeshRegistryError, isWorkspaceTargetError, jsonFlag, loadManagerInstanceIdentity, loadSoleSpaceAuth, localProcessPath, localProcessVisible, MANAGER_PIDFILE, oneLine, PREFERENCE_KEYS, parsePid, plainFlag, preflightTarget, presentationOf, principalFromBearer, probeLiveness, probeWebReadiness, readCurrent, readMeshRegistry, readPidfile, preparedRecordSkipped, readPreparedSpaces, stackJournalPath, readRenewalRecord, renderWorkspaceError, resolveMeshTarget, serverFlag, spaceFlag, userAuthStateDir, WEB_PIDFILE, WEB_READINESS_HEADER, workspaceSecretStore, writeResult, workspaceErrorParts, preferencesPath, preferencesFolderWarning, cotalDirLink, movedProject, spaceStreamsAbsent, spaceStreamsExpected, resolveControlTarget, } from "@cotal-ai/workspace";
 import { localProcessSurface } from "../ext-loader.js";
 import { cliVersion, cliProvenance, readExtensionVersions } from "../lib/version.js";
 import { agentSkillsSkew } from "../lib/agent-skills.js";
@@ -30,9 +30,10 @@ import { freshTeamAttemptSettled, listFreshTeamAttempts, listFreshTeamSummaries
 import { additiveTeamRecordedState, listAdditiveTeamAttempts } from "../lib/team-additive-attempt.js";
 import { maintenanceNextStep, preservedSourceState, restoreNextStep, rolledBackNotes } from "../lib/restore.js";
 import { attemptProcessesGone } from "../lib/isolated-broker.js";
-import { journalRecordedElsewhere, readStackJournal, serviceHeldRecords, STACK_DEFINITION, stackStartedWithoutManager, stackOperationBlock, goneStackRoot, unfinishedStackOperation, } from "../lib/stack-journal.js";
+import { journalRecordedElsewhere, readStackJournal, serviceHeldRecords, STACK_DEFINITION, stackStartedWithoutManager, stackOperationBlock, stackRootGone, unfinishedStackOperation, } from "../lib/stack-journal.js";
 import { cotalLinkHere, homeHoldsStack, linkedCotalRemedy } from "../lib/paths.js";
 import { storeWriteProblem } from "../lib/store-dir.js";
+import { stackStoreWarnings } from "../lib/store-identity.js";
 import { natsServerLabel } from "../lib/nats-bin.js";
 import { askManager } from "@cotal-ai/workspace/control";
 /** `--components` is the fail-loud health pass with a machine-readable EXIT DISPOSITION. Bare
@@ -59,21 +60,20 @@ export const statusFlags = [
     jsonFlag,
     plainFlag,
 ];
-/** A project root with no registration or prepared space here, such as one whose space was
- *  forgotten. The resolver gives it the default broker address, which any broker may hold, so
- *  status selects no space for it and dials nothing. */
+/** A project root with an empty `.cotal/` and no registration or prepared space. The resolver
+ *  gives it the default broker address, which any broker may hold, so status selects no space for
+ *  it and dials nothing. A root whose records name no space is refused by the resolver instead, and
+ *  status uses that refusal. */
 class UnregisteredRoot {
     root;
-    namesNoSpace;
-    constructor(root, namesNoSpace) {
+    constructor(root) {
         this.root = root;
-        this.namesNoSpace = namesNoSpace;
     }
 }
 function resolveSelected(cwd, values, offline) {
     try {
         const target = resolveMeshTarget(cwd, { server: values.server, space: values.space, offline });
-        return target.source === "local-space" ? { ok: false, error: new UnregisteredRoot(target.root, target.namesNoSpace === true) } : { ok: true, target };
+        return target.source === "local-space" ? { ok: false, error: new UnregisteredRoot(target.root) } : { ok: true, target };
     }
     catch (e) {
         return { ok: false, error: e };
@@ -166,7 +166,20 @@ export async function status(args) {
     const responder = await readResponderAxis(selected, preflight);
     const folder = blocked ? unreadFolder(root, blocked) : await readFolder(root, selected, values, responder.state, gaps, hints);
     const meshes = await readMeshes(cwd, selected, Boolean(values.all), gaps, offline, preflight);
-    const target = await readSelected(selected, responder, folder, gaps, hints, preflight);
+    const maintenance = blocked ? { root, space: null, state: "unreadable", attemptId: null, next: null } : readMaintenance(root, gaps);
+    const recovery = backupRecovery(maintenance);
+    const selectedHints = [];
+    const target = await readSelected(selected, responder, folder, gaps, selectedHints, preflight);
+    // A held backup must be released before this root can start. Keep the selection's diagnostics,
+    // but replace its ordinary restart advice with the journal's recovery step.
+    if (recovery)
+        hints.unshift(recovery);
+    else
+        hints.push(...selectedHints);
+    if (!blocked)
+        readStackStoreWarnings(root, gaps, hints);
+    if (selected.ok && selected.target.origin === "up" && !sameDir(root, selected.target.root))
+        readStackStoreWarnings(selected.target.root, gaps, hints, selected.target.space);
     // The note under the heading sends here for this folder's own stack cut off with no recorded
     // outcome under another selection. A blocked one is named with its block under `This folder's
     // space` and its step first in Next, so that note is left out here, with its --json warning. One
@@ -174,11 +187,10 @@ export async function status(args) {
     const held = folderStack(folder, target);
     if (held && folder.stackBlock)
         withdrawOperationNote("FOLDER_SPACE_NOT_RUNNING", held.space);
-    if (held && !folder.stackBlock && !folder.stackUnfinished && unsettledStackOperation(held.root, held.space))
+    if (!recovery && held && !folder.stackBlock && !folder.stackUnfinished && unsettledStackOperation(held.root, held.space))
         hints.push(`start it with \`cotal up\` in ${held.root}`);
     const services = readOwnedServices(selected, gaps);
     const bootAttempts = blocked ? { root, state: "partial", observedAt: new Date().toISOString(), unsettled: [], additive: [], unreadable: [], elsewhere: [] } : readBootAttempts(root, gaps);
-    const maintenance = blocked ? { root, space: null, state: "unreadable", attemptId: null, next: null } : readMaintenance(root, gaps);
     const logged = selected.ok ? brokerStoreWrite(selected.target.root, selected.target.space) : undefined;
     // A store write failure holds until the broker restarts, so it is named before a full store.
     const full = selected.ok && target.resolved && target.storedBytes !== null && logged?.state !== "write-failed" ? storeFull(selected.target.root, selected.target.space, target.storedBytes) : undefined;
@@ -227,7 +239,7 @@ function folderReadProblem(root) {
 /** The folder section for a folder this account cannot read: every part of it is unread. */
 function unreadFolder(root, code) {
     const error = `${root} cannot be read by this account (${code})`;
-    return { root, auth: { state: "unreadable", spaces: [], userAuth: false, error }, personas: { root: personaDir(root), default: "unreadable", demo: null, error }, launches: null, processes: null, processSpace: null, storedState: false, controllerStack: false, noManager: false, stackBlock: null };
+    return { root, auth: { state: "unreadable", spaces: [], userAuth: false, error }, personas: { root: personaDir(root), default: "unreadable", demo: null, error }, launches: null, processes: null, processSpace: null, storedState: false, controllerStack: false, stackJournal: "unreadable", noManager: false, stackBlock: null };
 }
 /** The folder's maintenance journal, read only. An unreadable one is reported, never taken for none. */
 function readMaintenance(root, gaps) {
@@ -537,6 +549,13 @@ async function readResponderAxis(selected, preflight) {
 }
 async function readFolder(root, selected, values, responder, gaps, hints) {
     const cmd = displayCmd();
+    let stackJournal;
+    try {
+        stackJournal = lstatSync(stackJournalPath(root), { throwIfNoEntry: false }) === undefined ? "absent" : "present";
+    }
+    catch {
+        stackJournal = "unreadable";
+    }
     const folder = (auth, processes = null, storedState = false, processSpace = null, controllerStack = false, noManager = false, stackBlock = null, stackUnfinished = null) => ({
         root,
         auth,
@@ -545,6 +564,7 @@ async function readFolder(root, selected, values, responder, gaps, hints) {
         processSpace,
         storedState,
         controllerStack,
+        stackJournal,
         noManager,
         stackBlock,
         stackUnfinished,
@@ -646,9 +666,9 @@ async function readFolder(root, selected, values, responder, gaps, hints) {
         controllerStack = false;
         // A journal no command can use is named with its way out, in the warnings and under Next; the
         // rest of the report still stands.
-        if (isCommandFailure(error) && error.code === "SCHEMA_INVALID") {
+        if (isCommandFailure(error) && (error.code === "SCHEMA_INVALID" || error.code === "PERMISSION_DENIED")) {
             unusable = true;
-            gaps.add("STACK_JOURNAL_INVALID", error.remedy ? `${error.message}; ${error.remedy}` : error.message, { root });
+            gaps.add(error.code === "PERMISSION_DENIED" ? "STACK_JOURNAL_UNREADABLE" : "STACK_JOURNAL_INVALID", error.remedy ? `${error.message}; ${error.remedy}` : error.message, { root });
             if (error.remedy)
                 hints.push(error.remedy);
         }
@@ -997,9 +1017,10 @@ async function readMeshes(cwd, selected, all, gaps, offline, preflight) {
         catalog: m.origin === "catalog" ? { name: m.catalogName && m.catalogName !== m.space ? m.catalogName : null, fetchedAt: m.catalogFetchedAt ?? null, error: m.catalogError ?? null } : null,
     })));
     // The prepared spaces folder, or a record in it, that cannot be read is named the same way.
-    let currentPrepared = false, currentStopped = false;
+    let currentPrepared = false, currentStopped = false, hasPrepared = false;
     try {
         const prepared = readPreparedSpaces();
+        hasPrepared = prepared.spaces.length > 0;
         // Named with the warning a command that skips it gives, so a run that also skipped it says it once.
         for (const e of prepared.unusable) {
             const skipped = preparedRecordSkipped(e);
@@ -1019,6 +1040,7 @@ async function readMeshes(cwd, selected, all, gaps, offline, preflight) {
         current,
         currentRecorded: current === null || entries.some((m) => m.space === current),
         currentPrepared,
+        hasPrepared,
         currentStopped,
         folder,
         unreadable,
@@ -1026,6 +1048,25 @@ async function readMeshes(cwd, selected, all, gaps, offline, preflight) {
         catalogs: preparedCatalogDiagnostics().map((r) => ({ idp: r.account.idpUrl, account: r.account.sub, state: r.state, error: r.state === "failed" ? (r.error ?? "refresh failed") : null })),
     };
 }
+/** Diagnose the current folder's store and a selected local stack independently of folder trust. */
+function readStackStoreWarnings(root, gaps, hints, space) {
+    try {
+        const journal = readStackJournal(root)?.journal;
+        if (journal && (space === undefined || journal.space === space))
+            for (const warning of stackStoreWarnings(journal))
+                gaps.add(warning.code, warning.message, warning.target);
+    }
+    catch (error) {
+        if (isCommandFailure(error) && (error.code === "SCHEMA_INVALID" || error.code === "PERMISSION_DENIED")) {
+            gaps.add(error.code === "PERMISSION_DENIED" ? "STACK_JOURNAL_UNREADABLE" : "STACK_JOURNAL_INVALID", error.remedy ? `${error.message}; ${error.remedy}` : error.message, { root });
+            if (error.remedy)
+                hints.push(error.remedy);
+        }
+        else if (!isCommandFailure(error) || error.code !== "CONFLICT")
+            throw error;
+        // A copied or moved journal is diagnosed by the folder and selection readers.
+    }
+}
 /** The refusal of the stack journal at `root` when it is one no command can use, as `up` and `down`
  *  refuse it. Undefined when it reads or is absent. */
 function unusableStackJournal(root) {
@@ -1034,7 +1075,7 @@ function unusableStackJournal(root) {
         return undefined;
     }
     catch (error) {
-        return isCommandFailure(error) && error.code === "SCHEMA_INVALID" ? error : undefined;
+        return isCommandFailure(error) && (error.code === "SCHEMA_INVALID" || error.code === "PERMISSION_DENIED") ? error : undefined;
     }
 }
 /** The refusal of `space`'s service instance records when one is a record no command can use, as
@@ -1086,11 +1127,7 @@ async function readSelected(selected, responder, folder, gaps, hints, preflight)
         }
         if (e instanceof UnregisteredRoot) {
             const message = `no space is registered or prepared here for ${e.root}`;
-            // A bare `up` in a folder whose records name no space starts a space named after the folder,
-            // which then holds it, so the step that brings a forgotten space back is to prepare it again.
-            hints.push(e.namesNoSpace
-                ? `prepare a space with \`${cmd} space create <name> --root ${shellWord(e.root)}\`, or select one with \`${cmd} use <name>\``
-                : `run \`${cmd} up\` in ${e.root} to start one, or select a space with \`${cmd} use <name>\``);
+            hints.push(`run \`${cmd} up\` in ${e.root} to start one, or select a space with \`${cmd} use <name>\``);
             return { resolved: false, code: "unregistered-root", message };
         }
         if (!isWorkspaceTargetError(e))
@@ -1157,6 +1194,16 @@ async function readSelected(selected, responder, folder, gaps, hints, preflight)
         spaceStreams: { state: "not-checked", root: null, stack: null },
         storedBytes: null,
     };
+    // A moved project keeps its trust under its new path. Prefer that specific diagnosis when
+    // this folder holds the records, otherwise report the missing stack root before any auth probe.
+    const moved = target.mode === "auth" && !target.auth ? movedProject(target.space, target.root) : undefined;
+    if (moved) {
+        hints.push(moved.remedy);
+        return { resolved: false, code: "moved-folder", message: moved.message };
+    }
+    const overridden = (target.source === "flag-server" || target.source === "flag-space-override") && target.recordedServer !== target.server;
+    if (base.rootGone && !overridden)
+        return { ...base, connection: "root-gone", snapshot: { state: "skipped", reason: "the stack's project folder was moved or deleted" } };
     if (target.mode === "user") {
         // Status never static-mints on a user-auth mesh (the flip). Everything here is offline
         // introspection — the login cache + the locally-readable ledger — plus, only when this
@@ -1189,13 +1236,6 @@ async function readSelected(selected, responder, folder, gaps, hints, preflight)
             return { ...result, snapshot: { state: "skipped", reason: "needs a signed-in, granted login" } };
         return { ...result, ...(await readSnapshot(() => userSnapshotEndpoint(target, stateDir), target.space, true, gaps)) };
     }
-    // A project folder moved after its stack started there keeps the seed under its new path, where a
-    // probe without it reads as authentication required. Name the move and the way back, as send does.
-    const moved = target.mode === "auth" && !target.auth ? movedProject(target.space, target.root) : undefined;
-    if (moved) {
-        hints.push(moved.remedy);
-        return { resolved: false, code: "moved-folder", message: moved.message };
-    }
     if (preflight === undefined)
         throw new Error("status: selected non-user target has no preflight observation");
     if (!preflight.ok) {
@@ -1579,7 +1619,8 @@ function extensionsCell(e) {
  * does not have is what `cotal setup` adds, which the applications line already counts. So an
  * application's own rows (the Claude plugin, Desktop and skills) appear only for an application that
  * IS set up, and only when they are not current; the broker executable appears when it is missing or
- * refused; the dashboard, which is optional, appears when its record cannot be read. `--all` and
+ * refused and local broker records make it relevant; the dashboard, which is optional, appears
+ * when its record cannot be read. `--all` and
  * `--wide` print every row, and `--verbose` adds the installation paths ({@link machineSection}).
  *
  * It used to print one row per known connector whether or not it was set up, every extension label
@@ -1602,7 +1643,15 @@ function machineOverview(r, wide) {
                 continue;
             rows.push([connector.name, stateCell(connector.missing.length ? `${connector.missing.join(", ")} not on PATH` : connector.requires.length ? "available on PATH" : "in-process", connector.missing.length ? "waiting" : "ok")]);
         }
-    if (wide || m.nats === "missing" || m.natsProblem)
+    // A remote registration uses the broker elsewhere. Keep executable readiness in the full
+    // diagnostics, without making a hosted client repair a binary it does not need to run.
+    const localBroker = r.meshes.hasPrepared || r.meshes.currentPrepared || r.meshes.unreadable.length > 0 ||
+        r.meshes.items.some((entry) => entry.origin !== "manual" && entry.origin !== "catalog") ||
+        r.folder.controllerStack || r.folder.storedState || r.folder.auth.state !== "none" ||
+        (r.folder.stackJournal !== undefined && r.folder.stackJournal !== "absent") ||
+        r.folder.processes?.some((row) => row.name === "nats" && (row.pid !== null || row.state === "unreadable")) ||
+        (!r.selected.resolved && (r.selected.code === "not-started" || r.selected.code === "unregistered-root" || r.selected.code === "unreadable-auth"));
+    if (wide || (localBroker && (m.nats === "missing" || m.natsProblem)))
         rows.push(["Broker executable", stateCell(m.nats === "missing" ? "not installed" : brokerExecutable(m), m.nats === "missing" ? "waiting" : m.natsProblem ? "failed" : "ok")]);
     if (wide || (m.skills.state !== "current" && setUp.length))
         rows.push(["Agent skills", skillsCell(m.skills)]);
@@ -1621,15 +1670,11 @@ function machineOverview(r, wide) {
         ],
     };
 }
-/** Whether `root` is the gone folder of the stack this machine still records for `space`. */
-function stackRootGone(space, root) {
-    const gone = goneStackRoot(space);
-    return gone !== undefined && canonicalRoot(gone) === canonicalRoot(root);
-}
 function connectionCell(s) {
     if (s.connection === "ok" || s.connection === "reachable")
         return stateCell("reachable", "ok");
     const states = {
+        "root-gone": "project folder was moved or deleted",
         unreachable: "unreachable",
         "slow-link": "not answering",
         "broker-stopped": `broker process ${s.brokerPid} is stopped`,
@@ -1831,7 +1876,14 @@ function stackLines(folder) {
 function roleList(roles) {
     return roles.length > 1 ? `${roles.slice(0, -1).join(", ")} and ${roles.at(-1)}` : roles[0] ?? "";
 }
+/** Pre-commit backup claims block ordinary startup; ready cuts and committed restores do not. */
+function backupRecovery(maintenance) {
+    return maintenance?.state === "claimed" || maintenance?.state === "restore-ready" ? maintenance.next : null;
+}
 function nextActions(r) {
+    const recovery = backupRecovery(r.maintenance);
+    if (recovery)
+        return { title: "Next", blocks: [...new Set([recovery, ...r.hints])].map((hint) => ({ kind: "lines", lines: [cell(hint, "hint")] })) };
     const cmd = displayCmd();
     const items = [];
     const extra = [];