@nurix/nustack 0.23.7 → 0.23.9

package/dist/commands/telemetry.js

@@ -6,7 +6,11 @@ import { getBindingByRepositoryRoot, listActiveBindings, setBindingTelemetry, }
 import { upsertFilebeatState } from "../lib/local_store/filebeat_state.js";
 import { ensureFilebeatBinary } from "../lib/filebeat_installer.js";
 import { collectTelemetryStatus } from "../lib/telemetry/health_report.js";
-import { ensureBindingTelemetry, setLocalOutput, switchMachineOff } from "../lib/session_telemetry.js";
+import { ensureBindingTelemetry, reconcileAllBindings, setLocalOutput, switchMachineOff } from "../lib/session_telemetry.js";
+import { readPartState, telemetryReconcileLockPath } from "../lib/telemetry/part_state.js";
+import { TELEMETRY_CHILD_VARIABLE } from "../lib/telemetry/environment.js";
+import { isFlagSet } from "../lib/records/environment.js";
+import { acquireDrainLock, releaseDrainLock } from "../lib/records/drain.js";
 import { resolveRepository } from "../lib/git-sync/core/repository.js";
 function resolveTargetBinding(store, options) {
     if (options.device)
@@ -28,13 +32,37 @@ export async function runTelemetry(action, options) {
     const store = await openLocalStore();
     try {
         const verbose = { localVerbose: options.localVerbose === true };
+        if (action === "reconcile") {
+            const isChild = isFlagSet(TELEMETRY_CHILD_VARIABLE);
+            const lockPath = telemetryReconcileLockPath();
+            if (isChild && !acquireDrainLock(lockPath))
+                return;
+            try {
+                const result = await reconcileAllBindings({ baseUrl: resolveNuStackUrl(options), store });
+                if (options.quiet)
+                    return;
+                if (json) {
+                    printJsonSuccess("telemetry reconcile", { scope: "device", ...result });
+                    return;
+                }
+                p.intro("nustack telemetry reconcile");
+                p.log.success(`Reconciled ${result.reconciled} folder${result.reconciled === 1 ? "" : "s"}; parts on ${result.parts.on}, off ${result.parts.off}, unknown ${result.parts.unknown}${result.conflict ? "; two telemetry destinations conflict, so nothing ships" : ""}.`);
+                p.outro("Telemetry reconciled.");
+            }
+            finally {
+                if (isChild)
+                    releaseDrainLock(lockPath);
+            }
+            return;
+        }
         if (action === "status") {
             const status = await collectTelemetryStatus(store, undefined, verbose);
             if (json) {
                 printJsonSuccess("telemetry status", status);
                 return;
             }
-            const shipping = status.folders.filter((f) => f.enabled).length;
+            const shipping = status.folders.filter((f) => f.enabled && f.shipping).length;
+            const partsOff = status.folders.filter((f) => f.partState === "off").length;
             p.intro("nustack telemetry status");
             p.note([
                 `telemetry_enabled: ${status.telemetryEnabled}`,
@@ -45,6 +73,7 @@ export async function runTelemetry(action, options) {
                 `install state:     ${status.filebeatState}${status.lastErrorCode ? ` (${status.lastErrorCode})` : ""}`,
                 `config version:    ${status.desiredConfigVersion}`,
                 `folders:           ${shipping} of ${status.folders.length} shipping`,
+                `telemetry part:    ${partsOff === 0 ? "on for every folder's project" : `off for ${partsOff} folder${partsOff === 1 ? "" : "s"}`}`,
                 `last cloud report: ${status.lastHealthAtMs ? new Date(status.lastHealthAtMs).toISOString() : "never"}`,
             ].join("\n"), "Telemetry");
             p.outro("Telemetry status.");
@@ -99,9 +128,12 @@ export async function runTelemetry(action, options) {
                 return;
             }
             p.intro(`nustack telemetry ${action}`);
-            p.log.success(enabled
-                ? `${folderLabel(target)} is shipping. Other folders are unchanged.`
-                : `${folderLabel(target)} has stopped shipping; nothing it records while off will ever ship. Other folders are unchanged.`);
+            const isPartOff = readPartState().projects[target.projectId]?.state === "off";
+            p.log.success(enabled && isPartOff
+                ? `${folderLabel(target)} is switched on, but the tenant's telemetry part is off for this project; this folder ships when it is switched back on.`
+                : enabled
+                    ? `${folderLabel(target)} is shipping. Other folders are unchanged.`
+                    : `${folderLabel(target)} has stopped shipping; nothing it records while off will ever ship. Other folders are unchanged.`);
             p.outro(`Run \`nustack telemetry ${enabled ? "disable" : "enable"}\` here to reverse it.`);
             return;
         }

package/dist/index.js

@@ -34,6 +34,7 @@ import { runHarnessMount, runHarnessStatus } from "./commands/harness.js";
 import { runSessionsList, runSessionsPrune, runSessionsRecord, runSessionsServe, } from "./commands/sessions.js";
 import { registerReviewCommands } from "./commands/review.js";
 import { registerRecordsCommands, startDrainIfDue } from "./commands/records.js";
+import { isPartCheckStale, startTelemetryReconcile } from "./lib/telemetry/part_state.js";
 import { RECORD_ALIAS_GROUPS, registerRecordAliases } from "./commands/recordAliases.js";
 import { runAgentContext, runAgentHookInstall, runAgentHookRemove } from "./commands/agent.js";
 import { printJsonError } from "./lib/json_output.js";
@@ -180,14 +181,15 @@ device
     .action(async (deviceId, options) => runDeviceRevoke(deviceId, options, program.opts()));
 program
     .command("telemetry [action]")
-    .description("Inspect or control telemetry (status | enable | disable | reinstall | output). Inside a bound folder, enable/disable move that folder alone; output points the shipper at your own Elastic, its key read from NUSTACK_ELASTIC_API_KEY")
+    .description("Inspect or control telemetry (status | enable | disable | reinstall | output | reconcile). Inside a bound folder, enable/disable move that folder alone; output points the shipper at your own Elastic, its key read from NUSTACK_ELASTIC_API_KEY; reconcile asks the server for each project's telemetry part")
     .option("--json", "emit the versioned machine envelope")
     .option("--device", "move this machine's switch instead of the current folder's")
     .option("--local-verbose", "include each folder's absolute path (local consumers only — never pipe into a log)")
     .option("--elastic-url <url>", "output: the Elastic endpoint (default NUSTACK_ELASTIC_URL)")
     .option("--index <name>", "output: the index events are written to (default claude-sessions)")
+    .option("--quiet", "reconcile: print nothing")
     .action(async (action, options) => {
-    const allowed = ["status", "enable", "disable", "reinstall", "output"];
+    const allowed = ["status", "enable", "disable", "reinstall", "output", "reconcile"];
     const chosen = (allowed.includes(action ?? "") ? action : "status");
     return runTelemetry(chosen, {
         ...program.opts(),
@@ -196,6 +198,7 @@ program
         localVerbose: options.localVerbose,
         elasticUrl: options.elasticUrl,
         index: options.index,
+        quiet: options.quiet,
     });
 });
 const toLimit = (value) => Number.parseInt(value, 10);
@@ -245,6 +248,8 @@ program.hook("preAction", async (_program, action) => {
     const group = action.parent?.name() ?? "";
     if (group !== "records" && !RECORD_ALIAS_GROUPS.includes(group))
         await startDrainIfDue(program.opts());
+    if (action.name() !== "telemetry" && isPartCheckStale())
+        startTelemetryReconcile({ nustackUrl: program.opts().nustackUrl });
 });
 const docs = program.command("docs").description("Work with a Project's Documents");
 docs

package/dist/lib/filebeat_installer.js

@@ -6,6 +6,7 @@ import { existsSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { nustackDir } from "./nustack_store.js";
+import { FILEBEAT_SERVICE_LABEL_VARIABLE } from "./telemetry/environment.js";
 const FILEBEAT_VERSION = process.env.NUSTACK_FILEBEAT_VERSION || "8.15.3";
 export function desiredFilebeatVersion() {
     return FILEBEAT_VERSION;
@@ -106,7 +107,10 @@ export function observedFilebeatVersion() {
         return null;
     }
 }
-const SERVICE_LABEL = "co.nurix.nustack.filebeat";
+export const SERVICE_LABEL = (() => {
+    const override = process.env[FILEBEAT_SERVICE_LABEL_VARIABLE]?.trim() ?? "";
+    return /^[a-z0-9][a-z0-9.-]{2,127}$/.test(override) ? override : "co.nurix.nustack.filebeat";
+})();
 function run(cmd, args) {
     try {
         execFileSync(cmd, args, { stdio: "ignore" });

package/dist/lib/nustack_client.js

@@ -21,8 +21,10 @@ const KEYS_PLANE = "the credential plane (/api/v1/keys)";
 export function apiError(payload, status, label, plane) {
     if (status === 401 && !envToken())
         return Object.assign(new Error(deadCredentialCopy("revoked")), { code: "SIGNED_OUT" });
-    const code = typeof payload?.error === "object" && typeof payload.error?.code === "string" ? payload.error.code : "UNEXPECTED";
-    return Object.assign(new Error(errorMessage(payload, status, label, plane)), { code });
+    const envelope = typeof payload?.error === "object" ? payload.error : undefined;
+    const code = typeof envelope?.code === "string" ? envelope.code : "UNEXPECTED";
+    const details = envelope?.details && typeof envelope.details === "object" && !Array.isArray(envelope.details) ? envelope.details : undefined;
+    return Object.assign(new Error(errorMessage(payload, status, label, plane)), details ? { code, details } : { code });
 }
 export function errorMessage(payload, status, label, plane) {
     if (plane && status === 404 && typeof payload?.error === "string") {

package/dist/lib/session_telemetry.js

@@ -14,8 +14,9 @@ import { INPUTS_FILE, LOCAL_OUTPUT_HEADER, renderCentralConfig, renderInputsFile
 import { applyConfigChange, removeInputFile } from "./telemetry/reload.js";
 import { discoverProviderBindings } from "./telemetry/provider_paths.js";
 import { reportTelemetryHealth } from "./telemetry/health_report.js";
+import { DEFAULT_SESSION_INDEX, isSameOutput, machineVerdict, partAnswerOf, readPartState, recordPartState, } from "./telemetry/part_state.js";
 const TELEMETRY_SERVICE = "elastic-observability";
-const DEFAULT_INDEX = "claude-sessions";
+const DEFAULT_INDEX = DEFAULT_SESSION_INDEX;
 const NO_OP_LOG = () => { };
 function defaultSeams() {
     return {
@@ -123,53 +124,68 @@ export async function ensureBindingTelemetry(opts) {
             await reportBestEffort(baseUrl, store, seams, accessToken);
             return;
         }
-        let brokerFailure = null;
+        let brokerError = null;
         const credential = accessToken
             ? await fetchBrokeredCredential(baseUrl, accessToken, {
                 projectId: binding.projectId,
                 service: TELEMETRY_SERVICE,
             }).catch((error) => {
-                brokerFailure = error instanceof Error ? error.message : String(error);
+                brokerError = error;
                 return null;
             })
             : null;
-        if (!credential?.url && !localOutput) {
+        const brokerFailure = brokerError === null ? null : message(brokerError);
+        const answer = accessToken ? partAnswerOf(binding.organizationId, { credential, error: brokerError }) : null;
+        const parts = answer ? recordPartState({ projects: { [binding.projectId]: answer } }) : readPartState();
+        const candidate = credential?.url && answer ? { destination: answer.destination ?? "nurix", url: credential.url, index: answer.index ?? DEFAULT_INDEX } : null;
+        const verdict = machineVerdict(bindingsOf(store, binding.id, true), parts, candidate);
+        const output = verdict.selection.output;
+        if (verdict.selection.conflict) {
+            recordPartState({ conflict: true });
+            await applyInputs(store, binding.id, verdict, deviceRef, userId, seams);
+            disableActivity(store, binding.id);
+            recordDegraded(store, "destination_conflict");
+            await reportBestEffort(baseUrl, store, seams, accessToken);
+            return;
+        }
+        if (!output) {
+            recordPartState({ conflict: false });
+            if (answer?.state === "off") {
+                await applyInputs(store, binding.id, verdict, deviceRef, userId, seams);
+                disableActivity(store, binding.id);
+            }
             const unserved = brokerFailure !== null && brokerFailure.includes("does not serve");
             recordDegraded(store, unserved ? "credential_plane_unserved" : "no_output_credential");
             await reportBestEffort(baseUrl, store, seams, accessToken);
             return;
         }
-        if (credential?.url) {
-            const index = credential.meta?.index || DEFAULT_INDEX;
+        if (credential && candidate && isSameOutput(output, candidate)) {
             const central = {
                 relativePath: "filebeat.yml",
-                contents: renderCentralConfig({ elkUrl: credential.url, apiKey: credential.key, index }),
+                contents: renderCentralConfig({ elkUrl: candidate.url, apiKey: credential.key, index: candidate.index }),
             };
-            const centralApply = await applyConfigChange({
-                files: [central],
-                scope: "central",
-                context: centralReloadContext(seams, filebeatDir()),
-            });
-            if (!centralApply.ok) {
-                recordDegraded(store, centralApply.errorCode);
-                await reportBestEffort(baseUrl, store, seams, accessToken);
-                return;
+            const live = await readFile(mainConfigPath(), "utf8").catch(() => null);
+            if (live !== central.contents) {
+                const centralApply = await applyConfigChange({
+                    files: [central],
+                    scope: "central",
+                    context: centralReloadContext(seams, filebeatDir()),
+                });
+                if (!centralApply.ok) {
+                    recordDegraded(store, centralApply.errorCode);
+                    await reportBestEffort(baseUrl, store, seams, accessToken);
+                    return;
+                }
             }
         }
+        recordPartState({ output, conflict: false });
         if (!seams.serviceRegistered())
             await seams.registerService();
-        const inputs = renderInputs(store, { id: binding.id, binding, enabled: true }, deviceRef, userId) ?? "";
-        await removeOrphanInputs();
-        const inputsApply = await applyConfigChange({
-            files: [{ relativePath: INPUTS_FILE, contents: inputs }],
-            scope: "inputs",
-            context: seams.reloadContext(filebeatDir()),
-        });
-        if (!inputsApply.ok) {
-            recordDegraded(store, inputsApply.errorCode);
+        if (!(await applyInputs(store, binding.id, verdict, deviceRef, userId, seams, binding))) {
             await reportBestEffort(baseUrl, store, seams, accessToken);
             return;
         }
+        const isShipping = verdict.shipping.has(binding.id);
         for (const discovered of discoverProviderBindings(binding.repositoryRoot)) {
             upsertActivityBinding(store, {
                 id: activityRowId(binding.id, discovered.provider, discovered.pathFingerprint),
@@ -177,7 +193,7 @@ export async function ensureBindingTelemetry(opts) {
                 provider: discovered.provider,
                 providerProjectPath: discovered.absolutePath,
                 pathFingerprint: discovered.pathFingerprint,
-                state: discovered.state,
+                state: isShipping ? discovered.state : "disabled",
             });
         }
         upsertFilebeatState(store, {
@@ -226,6 +242,7 @@ export async function setLocalOutput(opts) {
         recordDegraded(store, centralApply.errorCode);
         return { ok: false, errorCode: centralApply.errorCode };
     }
+    recordPartState({ output: { destination: "local", url: opts.elkUrl, index: opts.index || DEFAULT_INDEX }, conflict: false });
     if (!seams.serviceRegistered())
         await seams.registerService();
     upsertFilebeatState(store, {
@@ -251,7 +268,8 @@ export async function removeBindingTelemetry(opts) {
     try {
         const device = readDeviceState(store);
         await removeOrphanInputs();
-        const inputs = renderInputs(store, { id: bindingId, enabled: false }, device?.deviceRef ?? "", device?.activeUserId ?? "");
+        const verdict = machineVerdict(bindingsOf(store, bindingId, false), readPartState());
+        const inputs = renderInputs(store, { id: bindingId, enabled: false }, device?.deviceRef ?? "", device?.activeUserId ?? "", verdict);
         if (inputs === null) {
             await removeInputFile(filebeatDir(), INPUTS_FILE);
         }
@@ -266,20 +284,70 @@ export async function removeBindingTelemetry(opts) {
                 recordDegraded(store, applied.errorCode);
             }
         }
-        for (const row of listActivityBindings(store, bindingId)) {
-            upsertActivityBinding(store, {
-                id: row.id,
-                bindingId: row.bindingId,
-                provider: row.provider,
-                providerProjectPath: row.providerProjectPath,
-                pathFingerprint: row.pathFingerprint,
-                state: "disabled",
-            });
+        disableActivity(store, bindingId);
+    }
+    catch {
+    }
+}
+function disableActivity(store, bindingId) {
+    for (const row of listActivityBindings(store, bindingId)) {
+        upsertActivityBinding(store, {
+            id: row.id,
+            bindingId: row.bindingId,
+            provider: row.provider,
+            providerProjectPath: row.providerProjectPath,
+            pathFingerprint: row.pathFingerprint,
+            state: "disabled",
+        });
+    }
+}
+function bindingsOf(store, bindingId, folderEnabled) {
+    return listActiveBindings(store).map((b) => ({ bindingId: b.id, projectId: b.projectId, folderEnabled: b.id === bindingId ? folderEnabled : b.telemetryEnabled }));
+}
+async function applyInputs(store, bindingId, verdict, deviceRef, userId, seams, binding) {
+    const inputs = renderInputs(store, { id: bindingId, binding, enabled: true }, deviceRef, userId, verdict) ?? "";
+    await removeOrphanInputs();
+    const inputsApply = await applyConfigChange({
+        files: [{ relativePath: INPUTS_FILE, contents: inputs }],
+        scope: "inputs",
+        context: seams.reloadContext(filebeatDir()),
+    });
+    if (!inputsApply.ok)
+        recordDegraded(store, inputsApply.errorCode);
+    return inputsApply.ok;
+}
+export async function reconcileAllBindings(opts) {
+    const { store, baseUrl } = opts;
+    const bindings = listActiveBindings(store);
+    let reconciled = 0;
+    try {
+        const machine = readFilebeatState(store);
+        if (!optedOutByEnv() && (!machine || machine.telemetryEnabled)) {
+            for (const binding of bindings) {
+                await ensureBindingTelemetry({ baseUrl, store, binding, seams: opts.seams });
+                reconciled += 1;
+            }
         }
     }
+    finally {
+        recordPartStateBestEffort();
+    }
+    const parts = readPartState();
+    return { reconciled, parts: countParts(bindings, parts), conflict: parts.conflict };
+}
+function recordPartStateBestEffort() {
+    try {
+        recordPartState();
+    }
     catch {
     }
 }
+function countParts(bindings, parts) {
+    const counts = { on: 0, off: 0, unknown: 0 };
+    for (const projectId of new Set(bindings.map((b) => b.projectId)))
+        counts[parts.projects[projectId]?.state ?? "unknown"] += 1;
+    return counts;
+}
 export async function switchMachineOff(opts) {
     const seams = { ...defaultSeams(), ...opts.seams };
     const { store } = opts;
@@ -310,15 +378,15 @@ export async function switchMachineOff(opts) {
     upsertFilebeatState(store, { processState: "stopped" });
     return "stopped";
 }
-function renderInputs(store, reconciled, deviceRef, userId) {
+function renderInputs(store, reconciled, deviceRef, userId, verdict) {
     const byId = new Map();
     for (const b of listActiveBindings(store)) {
-        byId.set(b.id, { binding: toTelemetryBinding(b, deviceRef, userId), enabled: b.telemetryEnabled });
+        byId.set(b.id, { binding: toTelemetryBinding(b, deviceRef, userId), enabled: b.telemetryEnabled && verdict.shipping.has(b.id) });
     }
     const known = reconciled.binding ? toTelemetryBinding(reconciled.binding, deviceRef, userId) : byId.get(reconciled.id)?.binding;
     if (known)
-        byId.set(reconciled.id, { binding: known, enabled: reconciled.enabled });
-    return byId.size === 0 ? null : renderInputsFile([...byId.values()], { deviceRef, userId });
+        byId.set(reconciled.id, { binding: known, enabled: reconciled.enabled && verdict.shipping.has(reconciled.id) });
+    return byId.size === 0 ? null : renderInputsFile([...byId.values()], { deviceRef, userId }, { dropAll: verdict.dropCodex });
 }
 async function removeOrphanInputs() {
     const inputsDirPath = path.join(filebeatDir(), "inputs.d");

package/dist/lib/telemetry/config_renderer.js

@@ -139,10 +139,10 @@ export function renderBindingInput(binding, enabled = true) {
     });
     return enabled ? block : block.replace("\n  processors:\n", `\n  processors:\n${SWITCHED_OFF}`);
 }
-export function renderCodexSharedInput(entries, device) {
+export function renderCodexSharedInput(entries, device, options = {}) {
     const ordered = [...entries].sort((a, b) => a.binding.bindingId < b.binding.bindingId ? -1 : a.binding.bindingId > b.binding.bindingId ? 1 : 0);
     const sorted = ordered.filter((entry) => entry.enabled).map((entry) => entry.binding);
-    const drops = sorted.length === 0 ? SWITCHED_OFF : "";
+    const drops = sorted.length === 0 || options.dropAll === true ? SWITCHED_OFF : "";
     const conditionals = sorted
         .map((binding) => `
     - if:
@@ -183,10 +183,10 @@ ${drops}    - add_fields:
         ignore_missing: true
 `;
 }
-export function renderInputsFile(entries, device) {
+export function renderInputsFile(entries, device, options = {}) {
     const sorted = [...entries].sort((a, b) => a.binding.bindingId < b.binding.bindingId ? -1 : a.binding.bindingId > b.binding.bindingId ? 1 : 0);
     const blocks = sorted.map((entry) => renderBindingInput(entry.binding, entry.enabled));
-    return INPUTS_HEADER + blocks.join("") + renderCodexSharedInput(sorted, device);
+    return INPUTS_HEADER + blocks.join("") + renderCodexSharedInput(sorted, device, options);
 }
 export function splitInputBlocks(contents) {
     const starts = [...contents.matchAll(BLOCK_MARKER)].map((match) => ({

package/dist/lib/telemetry/environment.js

@@ -0,0 +1,2 @@
+export const TELEMETRY_CHILD_VARIABLE = "NUSTACK_TELEMETRY_CHILD";
+export const FILEBEAT_SERVICE_LABEL_VARIABLE = "NUSTACK_FILEBEAT_SERVICE_LABEL";

package/dist/lib/telemetry/health_report.js

@@ -9,6 +9,7 @@ import { REDACTION_POLICY_VERSION, } from "./redaction_policy.js";
 import { INPUTS_FILE, TELEMETRY_CONFIG_VERSION, desiredConfigHash, renderBindingInput, splitInputBlocks, } from "./config_renderer.js";
 import { discoverProviderBindings } from "./provider_paths.js";
 import { readObservedConfigBytes } from "./reload.js";
+import { machineVerdict, readPartState } from "./part_state.js";
 export function defaultProbes() {
     return {
         binaryPresent: () => existsSync(filebeatBinPath()),
@@ -36,7 +37,11 @@ export async function collectTelemetryStatus(store, probes = defaultProbes(), op
     const userId = device?.activeUserId ?? "";
     const folders = [];
     const activity = [];
-    for (const binding of listActiveBindings(store)) {
+    const bindings = listActiveBindings(store);
+    const parts = readPartState();
+    const verdict = machineVerdict(bindings.map((b) => ({ bindingId: b.id, projectId: b.projectId, folderEnabled: b.telemetryEnabled })), parts);
+    for (const binding of bindings) {
+        const isRendered = verdict.shipping.has(binding.id);
         const rendered = renderBindingInput({
             bindingId: binding.id,
             repoRoot: binding.repositoryRoot,
@@ -57,9 +62,11 @@ export async function collectTelemetryStatus(store, probes = defaultProbes(), op
             desiredConfigHash: desired,
             observedConfigHash: observed,
             redactionPolicyVersion: REDACTION_POLICY_VERSION,
+            partState: parts.projects[binding.projectId]?.state ?? "unknown",
+            shipping: isRendered && verdict.selection.output !== null,
             state: folderState({
                 telemetryEnabled,
-                folderEnabled: binding.telemetryEnabled,
+                folderEnabled: binding.telemetryEnabled && isRendered,
                 binaryPresent,
                 desired,
                 observed,
@@ -75,7 +82,7 @@ export async function collectTelemetryStatus(store, probes = defaultProbes(), op
                 providerProjectKey: discovered.providerProjectKey,
                 pathFingerprint: discovered.pathFingerprint,
                 discoveryMethod: discovered.discoveryMethod,
-                state: !telemetryEnabled || !binding.telemetryEnabled ? "disabled" : baseState,
+                state: !telemetryEnabled || !binding.telemetryEnabled || !isRendered ? "disabled" : baseState,
                 lastObservedAtMs: row?.lastObservedAtMs ?? null,
             });
         }

package/dist/lib/telemetry/part_state.js

@@ -0,0 +1,168 @@
+import { spawn } from "node:child_process";
+import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { filebeatDir, mainConfigPath } from "../filebeat_installer.js";
+import { locksDir } from "../local_store/paths.js";
+import { DRAIN_CHILD_VARIABLE, isFlagSet } from "../records/environment.js";
+import { BROKERED_OUTPUT_HEADER, LOCAL_OUTPUT_HEADER } from "./config_renderer.js";
+import { TELEMETRY_CHILD_VARIABLE } from "./environment.js";
+export const TELEMETRY_PART_OFF_REASON = "telemetry_part_off";
+export const TELEMETRY_PART_DETAIL = "telemetryPart";
+export const TELEMETRY_DESTINATION_DETAIL = "telemetryDestination";
+export const DEFAULT_SESSION_INDEX = "claude-sessions";
+export const PART_CHECK_INTERVAL_MS = 60 * 60 * 1000;
+const PART_STATE_SCHEMA_VERSION = 1;
+export function partStatePath() {
+    return path.join(filebeatDir(), "part-state.json");
+}
+export function telemetryReconcileLockPath() {
+    return path.join(locksDir(), "telemetry-reconcile.lock");
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const stringOrNull = (value) => (typeof value === "string" && value.length > 0 ? value : null);
+function readOutput(value) {
+    if (!isRecord(value))
+        return null;
+    const destination = value.destination;
+    if (destination !== "nurix" && destination !== "tenant" && destination !== "local")
+        return null;
+    return { destination, url: stringOrNull(value.url), index: stringOrNull(value.index) };
+}
+function readProject(value) {
+    if (!isRecord(value) || (value.state !== "on" && value.state !== "off") || typeof value.organizationId !== "string")
+        return null;
+    const destination = value.destination === "nurix" || value.destination === "tenant" ? value.destination : null;
+    return { organizationId: value.organizationId, state: value.state, destination, url: stringOrNull(value.url), index: stringOrNull(value.index), checkedAt: String(value.checkedAt ?? "") };
+}
+function seedOutput() {
+    try {
+        const header = readFileSync(mainConfigPath(), "utf8").split("\n", 1)[0];
+        if (header === LOCAL_OUTPUT_HEADER)
+            return { destination: "local", url: null, index: null };
+        if (header === BROKERED_OUTPUT_HEADER)
+            return { destination: "nurix", url: null, index: null };
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function readPartState() {
+    const empty = { schemaVersion: PART_STATE_SCHEMA_VERSION, checkedAt: null, output: null, conflict: false, projects: {} };
+    let state = empty;
+    try {
+        const parsed = JSON.parse(readFileSync(partStatePath(), "utf8"));
+        if (isRecord(parsed) && parsed.schemaVersion === PART_STATE_SCHEMA_VERSION) {
+            const projects = {};
+            for (const [projectId, entry] of Object.entries(isRecord(parsed.projects) ? parsed.projects : {})) {
+                const project = readProject(entry);
+                if (project)
+                    projects[projectId] = project;
+            }
+            state = { ...empty, checkedAt: stringOrNull(parsed.checkedAt), output: readOutput(parsed.output), conflict: parsed.conflict === true, projects };
+        }
+    }
+    catch {
+    }
+    return state.output ? state : { ...state, output: seedOutput() };
+}
+export function recordPartState(change = {}) {
+    const current = readPartState();
+    const projects = { ...current.projects };
+    for (const [projectId, entry] of Object.entries(change.projects ?? {})) {
+        if (entry)
+            projects[projectId] = entry;
+        else
+            delete projects[projectId];
+    }
+    const next = {
+        schemaVersion: PART_STATE_SCHEMA_VERSION,
+        checkedAt: new Date().toISOString(),
+        output: change.output === undefined ? current.output : change.output,
+        conflict: change.conflict ?? current.conflict,
+        projects,
+    };
+    const target = partStatePath();
+    mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    const staged = `${target}.${process.pid}.tmp`;
+    writeFileSync(staged, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    renameSync(staged, target);
+    return next;
+}
+export function partAnswerOf(organizationId, answer) {
+    const checkedAt = new Date().toISOString();
+    if (answer.credential) {
+        const index = typeof answer.credential.meta?.index === "string" && answer.credential.meta.index ? answer.credential.meta.index : DEFAULT_SESSION_INDEX;
+        const destination = answer.credential.meta?.destination === "tenant" ? "tenant" : "nurix";
+        return { organizationId, state: "on", destination, url: answer.credential.url, index, checkedAt };
+    }
+    const details = isRecord(answer.error) && isRecord(answer.error.details) ? answer.error.details : null;
+    if (!details)
+        return null;
+    if (details.reason === TELEMETRY_PART_OFF_REASON)
+        return { organizationId, state: "off", destination: null, url: null, index: null, checkedAt };
+    if (details[TELEMETRY_PART_DETAIL] !== "on")
+        return null;
+    const named = details[TELEMETRY_DESTINATION_DETAIL];
+    return { organizationId, state: "on", destination: named === "nurix" || named === "tenant" ? named : null, url: null, index: null, checkedAt };
+}
+export const isSameOutput = (a, b) => a !== null && b !== null && a.destination === b.destination && a.url === b.url && a.index === b.index;
+export function matchesOutput(entry, output) {
+    if (!output || entry?.state === "off")
+        return false;
+    if (output.destination !== "tenant")
+        return entry?.destination !== "tenant";
+    return entry?.state === "on" && entry.destination === "tenant" && entry.url === output.url && entry.index === output.index;
+}
+export function selectMachineOutput(input) {
+    const live = input.bindings.filter((binding) => binding.folderEnabled && input.projects[binding.projectId]?.state !== "off");
+    const tenantOutputs = new Map();
+    for (const binding of live) {
+        const entry = input.projects[binding.projectId];
+        if (entry?.destination === "tenant" && entry.url !== null)
+            tenantOutputs.set(`${entry.url}\n${entry.index}`, { destination: "tenant", url: entry.url, index: entry.index });
+    }
+    if (tenantOutputs.size > 1)
+        return { output: input.current, shippingBindingIds: [], conflict: true };
+    const tenant = [...tenantOutputs.values()][0] ?? null;
+    let output = input.current;
+    if (tenant && (isSameOutput(tenant, input.candidate) || isSameOutput(tenant, input.current)))
+        output = tenant;
+    else if (!tenant && input.candidate?.destination === "nurix")
+        output = input.candidate;
+    const shippingBindingIds = live.filter((binding) => matchesOutput(input.projects[binding.projectId], output)).map((binding) => binding.bindingId);
+    return { output, shippingBindingIds, conflict: false };
+}
+export function machineVerdict(bindings, parts, candidate = null) {
+    const selection = selectMachineOutput({ bindings, projects: parts.projects, current: parts.output, candidate });
+    const isOff = (projectId) => parts.projects[projectId]?.state === "off";
+    const live = bindings.filter((binding) => binding.folderEnabled && !isOff(binding.projectId)).map((binding) => binding.bindingId);
+    const shipping = new Set(selection.conflict ? [] : selection.output === null ? live : selection.shippingBindingIds);
+    const dropCodex = selection.conflict || selection.output?.destination === "tenant" || bindings.some((binding) => isOff(binding.projectId));
+    return { selection, shipping, dropCodex };
+}
+export function isPartCheckStale(env = process.env, now = Date.now()) {
+    try {
+        if (isFlagSet(DRAIN_CHILD_VARIABLE, env) || isFlagSet(TELEMETRY_CHILD_VARIABLE, env) || env.NUSTACK_TELEMETRY === "off")
+            return false;
+        if (!statSync(mainConfigPath(), { throwIfNoEntry: false }))
+            return false;
+        const file = statSync(partStatePath(), { throwIfNoEntry: false });
+        return !file || now - file.mtimeMs > PART_CHECK_INTERVAL_MS;
+    }
+    catch {
+        return false;
+    }
+}
+export function startTelemetryReconcile(options = {}) {
+    try {
+        const entry = fileURLToPath(new URL("../../index.js", import.meta.url));
+        const args = [entry, ...(options.nustackUrl ? ["--nustack-url", options.nustackUrl] : []), "telemetry", "reconcile", "--quiet"];
+        const child = spawn(process.execPath, args, { detached: true, stdio: "ignore", env: { ...process.env, [TELEMETRY_CHILD_VARIABLE]: "1" } });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/nustack",
-  "version": "0.23.7",
+  "version": "0.23.9",
   "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
   "type": "module",
   "private": false,
@@ -35,8 +35,8 @@
     "@types/node": "^22.19.20",
     "typescript": "^5.7.2",
     "vitest": "^4.1.11",
-    "@nurix/contracts": "2.0.1",
     "@nurix/nustack.studio": "0.0.0",
+    "@nurix/contracts": "2.0.1",
     "@nurix/nustack.ui": "0.0.0"
   },
   "publishConfig": {