@bli-cockpit/cli 0.2.116 → 0.2.119

package/dist/commands/local-args-tower-pages.js

@@ -152,6 +152,18 @@ export function parseBriefArgs(args) {
         json: values.booleans.has("--json"),
     };
 }
+/**
+ * The notetakers `cockpit notes connect` will actually seal a key for
+ * (BLI-4391). It mirrors `CONNECTABLE_NOTES_PROVIDERS` in the dashboard, and
+ * the door is still the authority — this list only saves a round trip and a
+ * sealed key for a provider with no reader.
+ *
+ * `otter` and `granola` are deliberately absent: Otter's public API is
+ * Enterprise-only and Granola still runs on its own server-side cron.
+ */
+const CONNECTABLE_PROVIDERS = ["fellow", "circleback"];
+/** The provider whose API is per workspace, so its account needs a subdomain. */
+const PROVIDERS_NEEDING_A_WORKSPACE = ["fellow"];
 const NOTES_ACTIONS = new Set([
     "folders", "mkdir", "rmdir", "rename",
     "list",
@@ -164,6 +176,13 @@ const NOTES_ACTIONS = new Set([
     "unshare",
     "move",
     "place",
+    // BLI-4383: the notetaker a person connects, and the meetings it records.
+    "accounts",
+    "connect",
+    "detach",
+    "sync",
+    // BLI-4394: arm that notetaker's webhook with the vendor's signing secret.
+    "webhook",
 ]);
 /** Actions whose first positional is the note it acts on. */
 const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
@@ -173,6 +192,12 @@ const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
     "move",
     "place",
 ]);
+/**
+ * BLI-4383. Actions whose first positional is a NOTETAKER ACCOUNT id, not a
+ * note id. `sync` takes one too, and is handled beside these rather than in
+ * this set because its id is checked at the door instead of here.
+ */
+const NOTES_ACTIONS_NEEDING_AN_ACCOUNT = new Set(["detach", "webhook"]);
 export function parseNotesArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -194,6 +219,17 @@ export function parseNotesArgs(args) {
             "--yes",
             "--json",
             "--tree",
+            // BLI-4383. `--key-stdin` is a FLAG and not a value: the key itself is
+            // read from stdin and never from argv.
+            "--provider",
+            "--key-stdin",
+            // BLI-4391. Fellow's API is per WORKSPACE, and a subdomain is a label,
+            // not a secret, so this one carries a value while the key never does.
+            "--workspace",
+            // BLI-4394. `--secret-stdin` is a FLAG and not a value, for the same
+            // reason `--key-stdin` is: the signing secret never touches argv.
+            "--secret-stdin",
+            "--show-webhook",
         ],
         valueFlags: [
             "--home",
@@ -208,6 +244,9 @@ export function parseNotesArgs(args) {
             "--since",
             "--until",
             "--limit",
+            "--provider",
+            "--workspace",
+            "--show-webhook",
         ],
     });
     // Bare `cockpit notes` is the list, which is the thing a person typing it
@@ -215,7 +254,7 @@ export function parseNotesArgs(args) {
     const first = values.positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, or place.`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, sync, or webhook.`);
     }
     const rest = values.positionals.slice(first === undefined ? 0 : 1);
     const json = values.booleans.has("--json");
@@ -232,6 +271,60 @@ export function parseNotesArgs(args) {
             throw new Error(`notes ${action} takes one note id, not ${rest.length}.`);
         }
     }
+    let accountId;
+    if (NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action) || action === "sync") {
+        accountId = optionalNonEmpty(rest[0]);
+        if (!accountId && NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action)) {
+            throw new Error(`notes ${action} needs a notetaker account id.`);
+        }
+        if (rest.length > 1) {
+            throw new Error(`notes ${action} takes one account id, not ${rest.length}.`);
+        }
+    }
+    // BLI-4394. `--show-webhook <id>` is a flag on `accounts` rather than a verb
+    // of its own, because "what is this one's webhook URL?" is the question a
+    // person asks WHILE looking at the list.
+    const showWebhook = optionalNonEmpty(values.flags.get("--show-webhook"));
+    if (showWebhook !== undefined) {
+        if (action !== "accounts") {
+            throw new Error("--show-webhook belongs to `cockpit notes accounts --show-webhook <account-id>`.");
+        }
+        accountId = showWebhook;
+    }
+    if (action === "webhook") {
+        if (!values.booleans.has("--secret-stdin")) {
+            // Naming the flag is the point: it says out loud that the signing secret
+            // is not an argument, so nobody goes looking for a `--secret` that will
+            // never exist.
+            throw new Error('notes webhook reads the signing secret from stdin. Say so: printf "%s" "<secret>" | cockpit notes webhook <account-id> --secret-stdin');
+        }
+    }
+    else if (values.booleans.has("--secret-stdin")) {
+        throw new Error("--secret-stdin belongs to `cockpit notes webhook <account-id> --secret-stdin`.");
+    }
+    const provider = optionalNonEmpty(values.flags.get("--provider"));
+    const workspace = optionalNonEmpty(values.flags.get("--workspace"));
+    if (action === "connect") {
+        if (!provider) {
+            throw new Error(`notes connect needs --provider ${CONNECTABLE_PROVIDERS.join("|")}.`);
+        }
+        if (!CONNECTABLE_PROVIDERS.includes(provider)) {
+            throw new Error(`notes connect does not know the provider "${provider}". Tower reads ${CONNECTABLE_PROVIDERS.join(" and ")}.`);
+        }
+        if (PROVIDERS_NEEDING_A_WORKSPACE.includes(provider) && !workspace) {
+            throw new Error(`notes connect --provider ${provider} needs --workspace <subdomain>: its API lives at https://<subdomain>.fellow.app, so a key alone cannot address anything.`);
+        }
+        if (workspace !== undefined && !/^[a-z0-9-]{1,63}$/.test(workspace)) {
+            throw new Error("--workspace is a workspace subdomain: lowercase letters, digits and hyphens, 1 to 63 characters.");
+        }
+        if (!values.booleans.has("--key-stdin")) {
+            // Naming the flag is the point: it says out loud that the key is not an
+            // argument, so nobody goes looking for a `--key` that will never exist.
+            throw new Error('notes connect reads the key from stdin. Say so: printf "%s" "<key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
+        }
+        if (rest.length > 0)
+            throw new Error(`notes connect does not take "${rest[0]}".`);
+    }
     let paths;
     if (action === "upload") {
         // Explicit paths only. No globbing happens here — a shell that expands
@@ -245,7 +338,12 @@ export function parseNotesArgs(args) {
         if (rest.length !== 1 || !rest[0]?.trim())
             throw new Error(`notes ${action} needs one folder path.`);
     }
-    else if (action !== "paste" && !NOTES_ACTIONS_NEEDING_A_NOTE.has(action) && rest.length > 0) {
+    else if (action !== "paste"
+        && action !== "connect"
+        && action !== "sync"
+        && !NOTES_ACTIONS_NEEDING_A_NOTE.has(action)
+        && !NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action)
+        && rest.length > 0) {
         throw new Error(`notes ${action} does not take "${rest[0]}".`);
     }
     if (action === "rename" && !optionalNonEmpty(values.flags.get("--name")))
@@ -271,6 +369,10 @@ export function parseNotesArgs(args) {
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
         ...(noteId ? { noteId } : {}),
+        ...(accountId ? { accountId } : {}),
+        ...(provider ? { provider } : {}),
+        ...(workspace ? { workspace } : {}),
+        ...(showWebhook ? { showWebhook: true } : {}),
         ...(paths ? { paths } : {}),
         filePath: optionalNonEmpty(values.flags.get("--file")),
         name: optionalNonEmpty(values.flags.get("--name")),

package/dist/commands/local-help-commands.js

@@ -471,6 +471,14 @@ export function localSubcommandHelp(command) {
                 "unshare <id> — take it back. Never asks: it only ever narrows who can read.",
                 "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
                 "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
+                "",
+                "Your own notetaker (BLI-4383). Fellow and Circleback today; Otter needs an Enterprise plan and Granola still runs on its own cron.",
+                "accounts [--json] — the notetakers you have connected, with health and when each was last read.",
+                "accounts --show-webhook <account-id> — that account's webhook URL, where to paste it at the vendor, and whether a signing secret is stored (BLI-4394). Until one is, every request to that URL is refused, which is the right way to be off.",
+                "webhook <account-id> --secret-stdin — store the VENDOR's webhook signing secret. THE SECRET IS READ FROM STDIN, never a flag: printf \"%s\" \"<signing secret>\" | cockpit notes webhook <account-id> --secret-stdin",
+                "connect --provider fellow|circleback [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
+                "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
+                "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
                 "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
                 "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
                 "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",

package/dist/commands/local-help.js

@@ -87,6 +87,7 @@ export function localCommandHelp(command) {
         "  cockpit brief status [--who <person>] [--render] [--dashboard-url <url>] [--json]",
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
         "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
+        "  cockpit notes [accounts [--show-webhook <account-id>]|connect --provider fellow --workspace <sub> --key-stdin [--name <n>]|webhook <account-id> --secret-stdin|detach <account-id>|sync <account-id>] [--json]   (the key and the signing secret are read from stdin, never a flag)",
         "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",

package/dist/commands/notes-accounts.js

@@ -0,0 +1,230 @@
+/**
+ * `cockpit notes accounts | connect | detach | sync` — the notetaker a person
+ * connects, at a terminal (BLI-4383). Sibling of `notes.ts`, named in its
+ * header.
+ *
+ * Four verbs over the same `/api/notes/accounts` doors the Settings section
+ * calls, so nothing a browser can do here is unreachable from a terminal.
+ *
+ * **THE KEY NEVER TOUCHES ARGV.** `connect` reads it from stdin, exactly as
+ * `cockpit mail add-imap` reads a Google app password, and for the same
+ * reason: an argument list is in the process table, in the shell history and
+ * in every log that records a command line. There is deliberately no
+ * `--key <value>` flag, and there is deliberately no MCP twin for this one
+ * verb (`verb-census.ts`'s `TERMINAL_ONLY` says so in full).
+ *
+ * stdout is the answer, stderr is the commentary — the same split the rest of
+ * `cockpit notes` keeps.
+ */
+import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
+import { ask, emit, fail, READ_DEADLINE_MS } from "./notes-door.js";
+/** A pass can take a while; a read never should. */
+const WRITE_DEADLINE_MS = 120_000;
+/** An API key is long; anything past this is not one, and is refused by size. */
+const KEY_MAX_CHARS = 500;
+export async function listNotesAccounts(command, door) {
+    const answer = await ask(door, {
+        path: "/api/notes/accounts",
+        method: "GET",
+        label: "notes accounts",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const accounts = answer.body.accounts ?? [];
+    if (door.json)
+        return emit(door, { ok: true, accounts });
+    if (accounts.length === 0) {
+        writeLine(door.io.stdout, "No notetaker is connected yet.");
+        writeLine(door.io.stdout, "");
+        writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fellow api key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
+        writeLine(door.io.stdout, '          or:  printf "%s" "<your circleback api key>" | cockpit notes connect --provider circleback --key-stdin');
+        return 0;
+    }
+    for (const account of accounts) {
+        const health = account.status === "active"
+            ? "active"
+            : `${account.status}: ${account.status_reason ?? "no reason recorded"}`;
+        // The workspace rides beside the provider because a Fellow account that
+        // points at the wrong subdomain fails with a 401 and nothing else says so.
+        const where = account.workspace ? `${account.provider}/${account.workspace}` : account.provider;
+        writeLine(door.io.stdout, `${(account.label ?? account.provider).padEnd(20)}  ${where.padEnd(20)}  ${health.padEnd(24)}  ${account.last_synced_at ?? "never read"}`);
+    }
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, `${accounts.length} notetaker(s). ids: ${accounts.map((account) => account.id).join(", ")}`);
+    // `command` is unused beyond the door it already carries; naming it keeps
+    // every verb in this file one shape.
+    void command;
+    return 0;
+}
+export async function connectNotetaker(command, door) {
+    // The key comes from stdin and nowhere else. An interactive terminal with
+    // nothing piped in is told how, rather than left waiting on a prompt that
+    // would echo the secret into the scrollback.
+    if (isInteractiveStdin(door.io)) {
+        return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
+    }
+    let apiKey;
+    try {
+        apiKey = (await readPipedText(door.io.stdin, {
+            maxChars: KEY_MAX_CHARS,
+            overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
+        })).trim();
+    }
+    catch (error) {
+        return fail(door, "key_unreadable", error instanceof Error ? error.message : String(error));
+    }
+    if (apiKey === "") {
+        return fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.");
+    }
+    const answer = await ask(door, {
+        path: "/api/notes/accounts",
+        method: "POST",
+        label: "notes connect",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: {
+            provider: command.provider ?? "fellow",
+            label: command.name ?? null,
+            // Absent, not null, when nobody named one: the door treats a missing
+            // workspace and an explicit null the same, and a `--workspace` a person
+            // did type is never silently dropped.
+            ...(command.workspace ? { workspace: command.workspace } : {}),
+            api_key: apiKey,
+        },
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const account = answer.body.account;
+    if (door.json)
+        return emit(door, { ok: true, account });
+    const named = account?.provider ?? command.provider ?? "fellow";
+    writeLine(door.io.stdout, `Connected ${account?.workspace ? `${named}/${account.workspace}` : named} (${account?.id ?? "no id returned"}).`);
+    writeLine(door.io.stdout, "Nothing is read until a sync runs: `cockpit notes sync <id>`, or wait for the half-hourly cron.");
+    return 0;
+}
+/**
+ * `cockpit notes accounts --show-webhook <id>` and
+ * `cockpit notes webhook <id> --secret-stdin` (BLI-4394).
+ *
+ * The URL is SHOWN, because a person cannot register a webhook they cannot
+ * read. The signing secret is READ FROM STDIN and never from a flag, for the
+ * same reason `connect` reads the API key that way: an argument list is in the
+ * process table, in the shell history and in every log that records a command
+ * line. There is deliberately no `--secret <value>`, and deliberately no MCP
+ * twin for this verb.
+ */
+export async function showNotesWebhook(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        return fail(door, "account_required", "Name the notetaker: `cockpit notes accounts --show-webhook <account-id>`. `cockpit notes accounts` lists the ids.");
+    }
+    const answer = await ask(door, {
+        path: `/api/notes/accounts/${encodeURIComponent(accountId)}/webhook`,
+        method: "GET",
+        label: "notes webhook",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const webhook = answer.body.webhook;
+    if (door.json)
+        return emit(door, { ok: true, webhook });
+    if (!webhook?.url) {
+        writeLine(door.io.stdout, "This notetaker has no webhook URL.");
+        writeLine(door.io.stdout, "Its key was sealed before webhooks shipped. Detach it and connect it again to mint one.");
+        return 0;
+    }
+    writeLine(door.io.stdout, webhook.url);
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, webhook.armed
+        ? "A signing secret is stored, so requests to that URL are verified."
+        : "NO SIGNING SECRET IS STORED YET, so every request to that URL is refused. That is the right way to be off.");
+    if (webhook.where) {
+        writeLine(door.io.stdout, "");
+        writeLine(door.io.stdout, webhook.where);
+    }
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, `Store the secret:  printf "%s" "<signing secret>" | cockpit notes webhook ${accountId} --secret-stdin`);
+    return 0;
+}
+export async function armNotesWebhook(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        return fail(door, "account_required", "Name the notetaker: `cockpit notes webhook <account-id> --secret-stdin`.");
+    }
+    // The secret comes from stdin and nowhere else, exactly as the API key does.
+    if (isInteractiveStdin(door.io)) {
+        return fail(door, "secret_required_on_stdin", `The signing secret is read from stdin, never from a flag. Try: printf "%s" "<signing secret>" | cockpit notes webhook ${accountId} --secret-stdin`);
+    }
+    let secret;
+    try {
+        secret = (await readPipedText(door.io.stdin, {
+            maxChars: KEY_MAX_CHARS,
+            overflowMessage: "That is longer than any webhook signing secret; nothing was sent.",
+        })).trim();
+    }
+    catch (error) {
+        return fail(door, "secret_unreadable", error instanceof Error ? error.message : String(error));
+    }
+    if (secret === "") {
+        return fail(door, "secret_required_on_stdin", "Nothing arrived on stdin, so nothing was stored.");
+    }
+    const answer = await ask(door, {
+        path: `/api/notes/accounts/${encodeURIComponent(accountId)}/webhook`,
+        method: "PUT",
+        label: "notes webhook arm",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: { signing_secret: secret },
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    if (door.json)
+        return emit(door, { ok: true, armed: true, account_id: accountId });
+    writeLine(door.io.stdout, `Stored. Requests to ${accountId}'s webhook URL are now verified.`);
+    writeLine(door.io.stdout, "Until a meeting is written up nothing changes; the half-hourly sweep still reads this account either way.");
+    return 0;
+}
+export async function detachNotetaker(command, door) {
+    const accountId = command.accountId ?? "";
+    const answer = await ask(door, {
+        path: `/api/notes/accounts?account_id=${encodeURIComponent(accountId)}`,
+        method: "DELETE",
+        label: "notes detach",
+        timeoutMs: WRITE_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    if (door.json)
+        return emit(door, { ok: true, detached: accountId });
+    writeLine(door.io.stdout, `Detached ${accountId}. Its stored key went with it.`);
+    writeLine(door.io.stdout, "The meetings it already filed stay where they are.");
+    return 0;
+}
+export async function syncNotetaker(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        // One account per call on purpose: the sweep over ALL of them is the cron,
+        // and a terminal asking for "everything" would hide which one failed.
+        return fail(door, "account_required", "Name the notetaker to sync: `cockpit notes sync <account-id>`. `cockpit notes accounts` lists the ids.");
+    }
+    const answer = await ask(door, {
+        path: `/api/notes/accounts/${encodeURIComponent(accountId)}/sync`,
+        method: "POST",
+        label: "notes sync",
+        timeoutMs: WRITE_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const run = answer.body.run;
+    if (door.json)
+        return emit(door, { ok: true, run });
+    if (!run) {
+        writeLine(door.io.stdout, "Tower answered without a run.");
+        return 0;
+    }
+    // The ledger row's own words, relayed rather than rephrased.
+    writeLine(door.io.stdout, `${run.reason}: ${run.notesAdded} stored, ${run.notesUpdated} unchanged, ${run.notesSkipped} skipped.`);
+    if (run.detail)
+        writeLine(door.io.stdout, run.detail);
+    return run.ok ? 0 : 1;
+}

package/dist/commands/notes.js

@@ -30,6 +30,9 @@
  *  - `notes-writes.ts` — upload, paste, share/unshare, move, place.
  *  - `notes-door.ts` — the one HTTP request, and the shared answer / refusal /
  *    emit / say-* rendering both halves above call.
+ *  - `notes-accounts.ts` — BLI-4383: the notetaker a person connects, and the
+ *    meetings it records. `connect` reads the API key from STDIN and there is
+ *    no flag that would take one.
  *
  * Every public name is still importable from this file.
  */
@@ -37,8 +40,10 @@ import { loadPairedSession } from "../tower-client.js";
 import { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 import { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
 import { runFolderCommand } from "./notes-folders.js";
+import { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, } from "./notes-accounts.js";
 export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 export { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
+export { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, } from "./notes-accounts.js";
 export { ask, emit, fail, sayUpload, sayScope, errorText, TAG, } from "./notes-door.js";
 export async function runNotes(command, io) {
     const session = await loadPairedSession("notes", command.homeDir);
@@ -73,5 +78,20 @@ export async function runNotes(command, io) {
             return moveNote(command, door);
         case "place":
             return placeNote(command, door);
+        case "accounts":
+            // BLI-4394. `--show-webhook <id>` turns the list into one account's
+            // webhook URL, because that is the question a person asks WHILE looking
+            // at the list rather than a verb of its own.
+            return command.showWebhook
+                ? showNotesWebhook(command, door)
+                : listNotesAccounts(command, door);
+        case "connect":
+            return connectNotetaker(command, door);
+        case "detach":
+            return detachNotetaker(command, door);
+        case "sync":
+            return syncNotetaker(command, door);
+        case "webhook":
+            return armNotesWebhook(command, door);
     }
 }

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.116");
+    writeLine(io?.stdout ?? process.stdout, "0.2.119");
     return 0;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.116",
+  "version": "0.2.119",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.32",
-    "@bli-cockpit/mcp": "0.1.44",
+    "@bli-cockpit/mcp": "0.1.47",
     "@bli-cockpit/telemetry-core": "0.1.48"
   }
 }