@bli-cockpit/cli 0.2.115 → 0.2.117

package/dist/commands/local-args-tower-pages.js

@@ -164,6 +164,11 @@ const NOTES_ACTIONS = new Set([
     "unshare",
     "move",
     "place",
+    // BLI-4383: the notetaker a person connects, and the meetings it records.
+    "accounts",
+    "connect",
+    "detach",
+    "sync",
 ]);
 /** Actions whose first positional is the note it acts on. */
 const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
@@ -173,6 +178,12 @@ const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
     "move",
     "place",
 ]);
+/**
+ * BLI-4383. Actions whose first positional is a NOTETAKER ACCOUNT id, not a
+ * note id. `sync` takes one too, and is handled beside these rather than in
+ * this set because its id is checked at the door instead of here.
+ */
+const NOTES_ACTIONS_NEEDING_AN_ACCOUNT = new Set(["detach"]);
 export function parseNotesArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -194,6 +205,10 @@ export function parseNotesArgs(args) {
             "--yes",
             "--json",
             "--tree",
+            // BLI-4383. `--key-stdin` is a FLAG and not a value: the key itself is
+            // read from stdin and never from argv.
+            "--provider",
+            "--key-stdin",
         ],
         valueFlags: [
             "--home",
@@ -208,6 +223,7 @@ export function parseNotesArgs(args) {
             "--since",
             "--until",
             "--limit",
+            "--provider",
         ],
     });
     // Bare `cockpit notes` is the list, which is the thing a person typing it
@@ -215,7 +231,7 @@ export function parseNotesArgs(args) {
     const first = values.positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, or place.`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, or sync.`);
     }
     const rest = values.positionals.slice(first === undefined ? 0 : 1);
     const json = values.booleans.has("--json");
@@ -232,6 +248,28 @@ export function parseNotesArgs(args) {
             throw new Error(`notes ${action} takes one note id, not ${rest.length}.`);
         }
     }
+    let accountId;
+    if (NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action) || action === "sync") {
+        accountId = optionalNonEmpty(rest[0]);
+        if (!accountId && NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action)) {
+            throw new Error(`notes ${action} needs a notetaker account id.`);
+        }
+        if (rest.length > 1) {
+            throw new Error(`notes ${action} takes one account id, not ${rest.length}.`);
+        }
+    }
+    const provider = optionalNonEmpty(values.flags.get("--provider"));
+    if (action === "connect") {
+        if (!provider)
+            throw new Error("notes connect needs --provider fathom.");
+        if (!values.booleans.has("--key-stdin")) {
+            // Naming the flag is the point: it says out loud that the key is not an
+            // argument, so nobody goes looking for a `--key` that will never exist.
+            throw new Error('notes connect reads the key from stdin. Say so: printf "%s" "<key>" | cockpit notes connect --provider fathom --key-stdin');
+        }
+        if (rest.length > 0)
+            throw new Error(`notes connect does not take "${rest[0]}".`);
+    }
     let paths;
     if (action === "upload") {
         // Explicit paths only. No globbing happens here — a shell that expands
@@ -245,7 +283,12 @@ export function parseNotesArgs(args) {
         if (rest.length !== 1 || !rest[0]?.trim())
             throw new Error(`notes ${action} needs one folder path.`);
     }
-    else if (action !== "paste" && !NOTES_ACTIONS_NEEDING_A_NOTE.has(action) && rest.length > 0) {
+    else if (action !== "paste"
+        && action !== "connect"
+        && action !== "sync"
+        && !NOTES_ACTIONS_NEEDING_A_NOTE.has(action)
+        && !NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action)
+        && rest.length > 0) {
         throw new Error(`notes ${action} does not take "${rest[0]}".`);
     }
     if (action === "rename" && !optionalNonEmpty(values.flags.get("--name")))
@@ -271,6 +314,8 @@ export function parseNotesArgs(args) {
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
         ...(noteId ? { noteId } : {}),
+        ...(accountId ? { accountId } : {}),
+        ...(provider ? { provider } : {}),
         ...(paths ? { paths } : {}),
         filePath: optionalNonEmpty(values.flags.get("--file")),
         name: optionalNonEmpty(values.flags.get("--name")),

package/dist/commands/local-help-commands.js

@@ -471,6 +471,12 @@ export function localSubcommandHelp(command) {
                 "unshare <id> — take it back. Never asks: it only ever narrows who can read.",
                 "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
                 "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
+                "",
+                "Your own notetaker (BLI-4383). Fathom today; Granola uses the same account model.",
+                "accounts [--json] — the notetakers you have connected, with health and when each was last read.",
+                "connect --provider fathom --key-stdin [--name <n>] — connect one. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fathom --key-stdin",
+                "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
+                "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
                 "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
                 "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
                 "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",

package/dist/commands/local-help.js

@@ -87,6 +87,7 @@ export function localCommandHelp(command) {
         "  cockpit brief status [--who <person>] [--render] [--dashboard-url <url>] [--json]",
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
         "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
+        "  cockpit notes [accounts|connect --provider fathom --key-stdin [--name <n>]|detach <account-id>|sync <account-id>] [--json]   (the key is read from stdin, never a flag)",
         "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",

package/dist/commands/notes-accounts.js

@@ -0,0 +1,139 @@
+/**
+ * `cockpit notes accounts | connect | detach | sync` — the notetaker a person
+ * connects, at a terminal (BLI-4383). Sibling of `notes.ts`, named in its
+ * header.
+ *
+ * Four verbs over the same `/api/notes/accounts` doors the Settings section
+ * calls, so nothing a browser can do here is unreachable from a terminal.
+ *
+ * **THE KEY NEVER TOUCHES ARGV.** `connect` reads it from stdin, exactly as
+ * `cockpit mail add-imap` reads a Google app password, and for the same
+ * reason: an argument list is in the process table, in the shell history and
+ * in every log that records a command line. There is deliberately no
+ * `--key <value>` flag, and there is deliberately no MCP twin for this one
+ * verb (`verb-census.ts`'s `TERMINAL_ONLY` says so in full).
+ *
+ * stdout is the answer, stderr is the commentary — the same split the rest of
+ * `cockpit notes` keeps.
+ */
+import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
+import { ask, emit, fail, READ_DEADLINE_MS } from "./notes-door.js";
+/** A pass can take a while; a read never should. */
+const WRITE_DEADLINE_MS = 120_000;
+/** An API key is long; anything past this is not one, and is refused by size. */
+const KEY_MAX_CHARS = 500;
+export async function listNotesAccounts(command, door) {
+    const answer = await ask(door, {
+        path: "/api/notes/accounts",
+        method: "GET",
+        label: "notes accounts",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const accounts = answer.body.accounts ?? [];
+    if (door.json)
+        return emit(door, { ok: true, accounts });
+    if (accounts.length === 0) {
+        writeLine(door.io.stdout, "No notetaker is connected yet.");
+        writeLine(door.io.stdout, "");
+        writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fathom api key>" | cockpit notes connect --provider fathom --key-stdin');
+        return 0;
+    }
+    for (const account of accounts) {
+        const health = account.status === "active"
+            ? "active"
+            : `${account.status}: ${account.status_reason ?? "no reason recorded"}`;
+        writeLine(door.io.stdout, `${(account.label ?? account.provider).padEnd(20)}  ${account.provider.padEnd(10)}  ${health.padEnd(24)}  ${account.last_synced_at ?? "never read"}`);
+    }
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, `${accounts.length} notetaker(s). ids: ${accounts.map((account) => account.id).join(", ")}`);
+    // `command` is unused beyond the door it already carries; naming it keeps
+    // every verb in this file one shape.
+    void command;
+    return 0;
+}
+export async function connectNotetaker(command, door) {
+    // The key comes from stdin and nowhere else. An interactive terminal with
+    // nothing piped in is told how, rather than left waiting on a prompt that
+    // would echo the secret into the scrollback.
+    if (isInteractiveStdin(door.io)) {
+        return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fathom --key-stdin');
+    }
+    let apiKey;
+    try {
+        apiKey = (await readPipedText(door.io.stdin, {
+            maxChars: KEY_MAX_CHARS,
+            overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
+        })).trim();
+    }
+    catch (error) {
+        return fail(door, "key_unreadable", error instanceof Error ? error.message : String(error));
+    }
+    if (apiKey === "") {
+        return fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.");
+    }
+    const answer = await ask(door, {
+        path: "/api/notes/accounts",
+        method: "POST",
+        label: "notes connect",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: {
+            provider: command.provider ?? "fathom",
+            label: command.name ?? null,
+            api_key: apiKey,
+        },
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const account = answer.body.account;
+    if (door.json)
+        return emit(door, { ok: true, account });
+    writeLine(door.io.stdout, `Connected ${account?.provider ?? command.provider ?? "fathom"} (${account?.id ?? "no id returned"}).`);
+    writeLine(door.io.stdout, "Nothing is read until a sync runs: `cockpit notes sync <id>`, or wait for the half-hourly cron.");
+    return 0;
+}
+export async function detachNotetaker(command, door) {
+    const accountId = command.accountId ?? "";
+    const answer = await ask(door, {
+        path: `/api/notes/accounts?account_id=${encodeURIComponent(accountId)}`,
+        method: "DELETE",
+        label: "notes detach",
+        timeoutMs: WRITE_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    if (door.json)
+        return emit(door, { ok: true, detached: accountId });
+    writeLine(door.io.stdout, `Detached ${accountId}. Its stored key went with it.`);
+    writeLine(door.io.stdout, "The meetings it already filed stay where they are.");
+    return 0;
+}
+export async function syncNotetaker(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        // One account per call on purpose: the sweep over ALL of them is the cron,
+        // and a terminal asking for "everything" would hide which one failed.
+        return fail(door, "account_required", "Name the notetaker to sync: `cockpit notes sync <account-id>`. `cockpit notes accounts` lists the ids.");
+    }
+    const answer = await ask(door, {
+        path: `/api/notes/accounts/${encodeURIComponent(accountId)}/sync`,
+        method: "POST",
+        label: "notes sync",
+        timeoutMs: WRITE_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const run = answer.body.run;
+    if (door.json)
+        return emit(door, { ok: true, run });
+    if (!run) {
+        writeLine(door.io.stdout, "Tower answered without a run.");
+        return 0;
+    }
+    // The ledger row's own words, relayed rather than rephrased.
+    writeLine(door.io.stdout, `${run.reason}: ${run.notesAdded} stored, ${run.notesUpdated} unchanged, ${run.notesSkipped} skipped.`);
+    if (run.detail)
+        writeLine(door.io.stdout, run.detail);
+    return run.ok ? 0 : 1;
+}

package/dist/commands/notes.js

@@ -30,6 +30,9 @@
  *  - `notes-writes.ts` — upload, paste, share/unshare, move, place.
  *  - `notes-door.ts` — the one HTTP request, and the shared answer / refusal /
  *    emit / say-* rendering both halves above call.
+ *  - `notes-accounts.ts` — BLI-4383: the notetaker a person connects, and the
+ *    meetings it records. `connect` reads the API key from STDIN and there is
+ *    no flag that would take one.
  *
  * Every public name is still importable from this file.
  */
@@ -37,8 +40,10 @@ import { loadPairedSession } from "../tower-client.js";
 import { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 import { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
 import { runFolderCommand } from "./notes-folders.js";
+import { connectNotetaker, detachNotetaker, listNotesAccounts, syncNotetaker, } from "./notes-accounts.js";
 export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 export { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
+export { connectNotetaker, detachNotetaker, listNotesAccounts, syncNotetaker, } from "./notes-accounts.js";
 export { ask, emit, fail, sayUpload, sayScope, errorText, TAG, } from "./notes-door.js";
 export async function runNotes(command, io) {
     const session = await loadPairedSession("notes", command.homeDir);
@@ -73,5 +78,13 @@ export async function runNotes(command, io) {
             return moveNote(command, door);
         case "place":
             return placeNote(command, door);
+        case "accounts":
+            return listNotesAccounts(command, door);
+        case "connect":
+            return connectNotetaker(command, door);
+        case "detach":
+            return detachNotetaker(command, door);
+        case "sync":
+            return syncNotetaker(command, door);
     }
 }

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.115");
+    writeLine(io?.stdout ?? process.stdout, "0.2.117");
     return 0;
   }
 

package/dist/commands/usage.js

@@ -43,7 +43,7 @@ export async function runUsage(command, io) {
         if (!email)
             return failAgentDoor(door, "[usage]", "caller_email_unavailable", "The paired session has no email. Sign in again or pass --person <email>.");
         body.people = (body.people ?? []).filter((person) => person.email?.toLowerCase() === email.toLowerCase());
-        body.coverage = { sessions_labelled: body.people.reduce((total, person) => total + (person.sessions_labelled ?? 0), 0), sessions_extracted: body.people.reduce((total, person) => total + person.sessions_extracted, 0), sessions_observed: body.people.reduce((total, person) => total + person.sessions_observed, 0), sessions_counted_at_upload: body.people.reduce((total, person) => total + (person.sessions_counted_at_upload ?? 0), 0), sessions_counted_by_server: body.people.reduce((total, person) => total + (person.sessions_counted_by_server ?? 0), 0), sessions_counted_by_ladder: body.people.reduce((total, person) => total + (person.sessions_counted_by_ladder ?? 0), 0) };
+        body.coverage = { sessions_labelled: body.people.reduce((total, person) => total + (person.sessions_labelled ?? 0), 0), sessions_extracted: body.people.reduce((total, person) => total + person.sessions_extracted, 0), sessions_observed: body.people.reduce((total, person) => total + person.sessions_observed, 0), sessions_counted_at_upload: body.people.reduce((total, person) => total + (person.sessions_counted_at_upload ?? 0), 0), sessions_counted_by_server: body.people.reduce((total, person) => total + (person.sessions_counted_by_server ?? 0), 0), sessions_counted_by_ladder: body.people.reduce((total, person) => total + (person.sessions_counted_by_ladder ?? 0), 0), sessions_awaiting_count: body.people.reduce((total, person) => total + (person.sessions_awaiting_count ?? 0), 0), sessions_automated_excluded: body.people.reduce((total, person) => total + (person.sessions_automated_excluded ?? 0), 0) };
     }
     if (command.byRepo && body.people?.some((person) => !Array.isArray(person.repos))) {
         return failAgentDoor(door, "[usage]", "repo_grouping_unavailable", "The dashboard returned person totals without project rows. Deploy the dashboard project split before using --by-repo.");
@@ -104,6 +104,14 @@ export async function runUsage(command, io) {
     writeLine(io.stdout, "");
     writeLine(io.stdout, body.api_list_price_equivalent_label ?? "API list-price equivalent (not actual spend)");
     writeLine(io.stdout, `${body.coverage?.sessions_extracted ?? 0} of ${body.coverage?.sessions_observed ?? 0} sessions extracted`);
+    // BLI-4356: the gap says why. A session observed with no tokens is either
+    // waiting on a count that has not run yet, or an automated one this view
+    // leaves out on purpose; never an unexplained hole in a person's week.
+    const waiting = body.coverage?.sessions_awaiting_count ?? 0;
+    const automatedExcluded = body.coverage?.sessions_automated_excluded ?? 0;
+    if (waiting > 0 || automatedExcluded > 0) {
+        writeLine(io.stdout, `${waiting} waiting on a token count, ${automatedExcluded} automated and excluded`);
+    }
     // BLI-4341: a session should arrive counted. This line is how a person sees
     // whether that is happening, or whether something else is doing the work.
     // BLI-4351 added the third counter: the ladder, counting out of Storage the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.115",
+  "version": "0.2.117",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.32",
-    "@bli-cockpit/mcp": "0.1.43",
+    "@bli-cockpit/mcp": "0.1.45",
     "@bli-cockpit/telemetry-core": "0.1.48"
   }
 }