@bli-cockpit/cli 0.2.117 → 0.2.119

package/dist/commands/local-args-tower-pages.js

@@ -152,6 +152,18 @@ export function parseBriefArgs(args) {
         json: values.booleans.has("--json"),
     };
 }
+/**
+ * The notetakers `cockpit notes connect` will actually seal a key for
+ * (BLI-4391). It mirrors `CONNECTABLE_NOTES_PROVIDERS` in the dashboard, and
+ * the door is still the authority — this list only saves a round trip and a
+ * sealed key for a provider with no reader.
+ *
+ * `otter` and `granola` are deliberately absent: Otter's public API is
+ * Enterprise-only and Granola still runs on its own server-side cron.
+ */
+const CONNECTABLE_PROVIDERS = ["fellow", "circleback"];
+/** The provider whose API is per workspace, so its account needs a subdomain. */
+const PROVIDERS_NEEDING_A_WORKSPACE = ["fellow"];
 const NOTES_ACTIONS = new Set([
     "folders", "mkdir", "rmdir", "rename",
     "list",
@@ -169,6 +181,8 @@ const NOTES_ACTIONS = new Set([
     "connect",
     "detach",
     "sync",
+    // BLI-4394: arm that notetaker's webhook with the vendor's signing secret.
+    "webhook",
 ]);
 /** Actions whose first positional is the note it acts on. */
 const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
@@ -183,7 +197,7 @@ const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
  * note id. `sync` takes one too, and is handled beside these rather than in
  * this set because its id is checked at the door instead of here.
  */
-const NOTES_ACTIONS_NEEDING_AN_ACCOUNT = new Set(["detach"]);
+const NOTES_ACTIONS_NEEDING_AN_ACCOUNT = new Set(["detach", "webhook"]);
 export function parseNotesArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -209,6 +223,13 @@ export function parseNotesArgs(args) {
             // read from stdin and never from argv.
             "--provider",
             "--key-stdin",
+            // BLI-4391. Fellow's API is per WORKSPACE, and a subdomain is a label,
+            // not a secret, so this one carries a value while the key never does.
+            "--workspace",
+            // BLI-4394. `--secret-stdin` is a FLAG and not a value, for the same
+            // reason `--key-stdin` is: the signing secret never touches argv.
+            "--secret-stdin",
+            "--show-webhook",
         ],
         valueFlags: [
             "--home",
@@ -224,6 +245,8 @@ export function parseNotesArgs(args) {
             "--until",
             "--limit",
             "--provider",
+            "--workspace",
+            "--show-webhook",
         ],
     });
     // Bare `cockpit notes` is the list, which is the thing a person typing it
@@ -231,7 +254,7 @@ export function parseNotesArgs(args) {
     const first = values.positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, or sync.`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, sync, or webhook.`);
     }
     const rest = values.positionals.slice(first === undefined ? 0 : 1);
     const json = values.booleans.has("--json");
@@ -258,14 +281,46 @@ export function parseNotesArgs(args) {
             throw new Error(`notes ${action} takes one account id, not ${rest.length}.`);
         }
     }
+    // BLI-4394. `--show-webhook <id>` is a flag on `accounts` rather than a verb
+    // of its own, because "what is this one's webhook URL?" is the question a
+    // person asks WHILE looking at the list.
+    const showWebhook = optionalNonEmpty(values.flags.get("--show-webhook"));
+    if (showWebhook !== undefined) {
+        if (action !== "accounts") {
+            throw new Error("--show-webhook belongs to `cockpit notes accounts --show-webhook <account-id>`.");
+        }
+        accountId = showWebhook;
+    }
+    if (action === "webhook") {
+        if (!values.booleans.has("--secret-stdin")) {
+            // Naming the flag is the point: it says out loud that the signing secret
+            // is not an argument, so nobody goes looking for a `--secret` that will
+            // never exist.
+            throw new Error('notes webhook reads the signing secret from stdin. Say so: printf "%s" "<secret>" | cockpit notes webhook <account-id> --secret-stdin');
+        }
+    }
+    else if (values.booleans.has("--secret-stdin")) {
+        throw new Error("--secret-stdin belongs to `cockpit notes webhook <account-id> --secret-stdin`.");
+    }
     const provider = optionalNonEmpty(values.flags.get("--provider"));
+    const workspace = optionalNonEmpty(values.flags.get("--workspace"));
     if (action === "connect") {
-        if (!provider)
-            throw new Error("notes connect needs --provider fathom.");
+        if (!provider) {
+            throw new Error(`notes connect needs --provider ${CONNECTABLE_PROVIDERS.join("|")}.`);
+        }
+        if (!CONNECTABLE_PROVIDERS.includes(provider)) {
+            throw new Error(`notes connect does not know the provider "${provider}". Tower reads ${CONNECTABLE_PROVIDERS.join(" and ")}.`);
+        }
+        if (PROVIDERS_NEEDING_A_WORKSPACE.includes(provider) && !workspace) {
+            throw new Error(`notes connect --provider ${provider} needs --workspace <subdomain>: its API lives at https://<subdomain>.fellow.app, so a key alone cannot address anything.`);
+        }
+        if (workspace !== undefined && !/^[a-z0-9-]{1,63}$/.test(workspace)) {
+            throw new Error("--workspace is a workspace subdomain: lowercase letters, digits and hyphens, 1 to 63 characters.");
+        }
         if (!values.booleans.has("--key-stdin")) {
             // Naming the flag is the point: it says out loud that the key is not an
             // argument, so nobody goes looking for a `--key` that will never exist.
-            throw new Error('notes connect reads the key from stdin. Say so: printf "%s" "<key>" | cockpit notes connect --provider fathom --key-stdin');
+            throw new Error('notes connect reads the key from stdin. Say so: printf "%s" "<key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
         }
         if (rest.length > 0)
             throw new Error(`notes connect does not take "${rest[0]}".`);
@@ -316,6 +371,8 @@ export function parseNotesArgs(args) {
         ...(noteId ? { noteId } : {}),
         ...(accountId ? { accountId } : {}),
         ...(provider ? { provider } : {}),
+        ...(workspace ? { workspace } : {}),
+        ...(showWebhook ? { showWebhook: true } : {}),
         ...(paths ? { paths } : {}),
         filePath: optionalNonEmpty(values.flags.get("--file")),
         name: optionalNonEmpty(values.flags.get("--name")),

package/dist/commands/local-help-commands.js

@@ -472,9 +472,11 @@ export function localSubcommandHelp(command) {
                 "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
                 "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
                 "",
-                "Your own notetaker (BLI-4383). Fathom today; Granola uses the same account model.",
+                "Your own notetaker (BLI-4383). Fellow and Circleback today; Otter needs an Enterprise plan and Granola still runs on its own cron.",
                 "accounts [--json] — the notetakers you have connected, with health and when each was last read.",
-                "connect --provider fathom --key-stdin [--name <n>] — connect one. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fathom --key-stdin",
+                "accounts --show-webhook <account-id> — that account's webhook URL, where to paste it at the vendor, and whether a signing secret is stored (BLI-4394). Until one is, every request to that URL is refused, which is the right way to be off.",
+                "webhook <account-id> --secret-stdin — store the VENDOR's webhook signing secret. THE SECRET IS READ FROM STDIN, never a flag: printf \"%s\" \"<signing secret>\" | cockpit notes webhook <account-id> --secret-stdin",
+                "connect --provider fellow|circleback [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
                 "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
                 "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
                 "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",

package/dist/commands/local-help.js

@@ -87,7 +87,7 @@ export function localCommandHelp(command) {
         "  cockpit brief status [--who <person>] [--render] [--dashboard-url <url>] [--json]",
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
         "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
-        "  cockpit notes [accounts|connect --provider fathom --key-stdin [--name <n>]|detach <account-id>|sync <account-id>] [--json]   (the key is read from stdin, never a flag)",
+        "  cockpit notes [accounts [--show-webhook <account-id>]|connect --provider fellow --workspace <sub> --key-stdin [--name <n>]|webhook <account-id> --secret-stdin|detach <account-id>|sync <account-id>] [--json]   (the key and the signing secret are read from stdin, never a flag)",
         "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",

package/dist/commands/notes-accounts.js

@@ -37,14 +37,18 @@ export async function listNotesAccounts(command, door) {
     if (accounts.length === 0) {
         writeLine(door.io.stdout, "No notetaker is connected yet.");
         writeLine(door.io.stdout, "");
-        writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fathom api key>" | cockpit notes connect --provider fathom --key-stdin');
+        writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fellow api key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
+        writeLine(door.io.stdout, '          or:  printf "%s" "<your circleback api key>" | cockpit notes connect --provider circleback --key-stdin');
         return 0;
     }
     for (const account of accounts) {
         const health = account.status === "active"
             ? "active"
             : `${account.status}: ${account.status_reason ?? "no reason recorded"}`;
-        writeLine(door.io.stdout, `${(account.label ?? account.provider).padEnd(20)}  ${account.provider.padEnd(10)}  ${health.padEnd(24)}  ${account.last_synced_at ?? "never read"}`);
+        // The workspace rides beside the provider because a Fellow account that
+        // points at the wrong subdomain fails with a 401 and nothing else says so.
+        const where = account.workspace ? `${account.provider}/${account.workspace}` : account.provider;
+        writeLine(door.io.stdout, `${(account.label ?? account.provider).padEnd(20)}  ${where.padEnd(20)}  ${health.padEnd(24)}  ${account.last_synced_at ?? "never read"}`);
     }
     writeLine(door.io.stdout, "");
     writeLine(door.io.stdout, `${accounts.length} notetaker(s). ids: ${accounts.map((account) => account.id).join(", ")}`);
@@ -58,7 +62,7 @@ export async function connectNotetaker(command, door) {
     // nothing piped in is told how, rather than left waiting on a prompt that
     // would echo the secret into the scrollback.
     if (isInteractiveStdin(door.io)) {
-        return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fathom --key-stdin');
+        return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
     }
     let apiKey;
     try {
@@ -79,8 +83,12 @@ export async function connectNotetaker(command, door) {
         label: "notes connect",
         timeoutMs: WRITE_DEADLINE_MS,
         body: {
-            provider: command.provider ?? "fathom",
+            provider: command.provider ?? "fellow",
             label: command.name ?? null,
+            // Absent, not null, when nobody named one: the door treats a missing
+            // workspace and an explicit null the same, and a `--workspace` a person
+            // did type is never silently dropped.
+            ...(command.workspace ? { workspace: command.workspace } : {}),
             api_key: apiKey,
         },
     });
@@ -89,10 +97,93 @@ export async function connectNotetaker(command, door) {
     const account = answer.body.account;
     if (door.json)
         return emit(door, { ok: true, account });
-    writeLine(door.io.stdout, `Connected ${account?.provider ?? command.provider ?? "fathom"} (${account?.id ?? "no id returned"}).`);
+    const named = account?.provider ?? command.provider ?? "fellow";
+    writeLine(door.io.stdout, `Connected ${account?.workspace ? `${named}/${account.workspace}` : named} (${account?.id ?? "no id returned"}).`);
     writeLine(door.io.stdout, "Nothing is read until a sync runs: `cockpit notes sync <id>`, or wait for the half-hourly cron.");
     return 0;
 }
+/**
+ * `cockpit notes accounts --show-webhook <id>` and
+ * `cockpit notes webhook <id> --secret-stdin` (BLI-4394).
+ *
+ * The URL is SHOWN, because a person cannot register a webhook they cannot
+ * read. The signing secret is READ FROM STDIN and never from a flag, for the
+ * same reason `connect` reads the API key that way: an argument list is in the
+ * process table, in the shell history and in every log that records a command
+ * line. There is deliberately no `--secret <value>`, and deliberately no MCP
+ * twin for this verb.
+ */
+export async function showNotesWebhook(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        return fail(door, "account_required", "Name the notetaker: `cockpit notes accounts --show-webhook <account-id>`. `cockpit notes accounts` lists the ids.");
+    }
+    const answer = await ask(door, {
+        path: `/api/notes/accounts/${encodeURIComponent(accountId)}/webhook`,
+        method: "GET",
+        label: "notes webhook",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const webhook = answer.body.webhook;
+    if (door.json)
+        return emit(door, { ok: true, webhook });
+    if (!webhook?.url) {
+        writeLine(door.io.stdout, "This notetaker has no webhook URL.");
+        writeLine(door.io.stdout, "Its key was sealed before webhooks shipped. Detach it and connect it again to mint one.");
+        return 0;
+    }
+    writeLine(door.io.stdout, webhook.url);
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, webhook.armed
+        ? "A signing secret is stored, so requests to that URL are verified."
+        : "NO SIGNING SECRET IS STORED YET, so every request to that URL is refused. That is the right way to be off.");
+    if (webhook.where) {
+        writeLine(door.io.stdout, "");
+        writeLine(door.io.stdout, webhook.where);
+    }
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, `Store the secret:  printf "%s" "<signing secret>" | cockpit notes webhook ${accountId} --secret-stdin`);
+    return 0;
+}
+export async function armNotesWebhook(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        return fail(door, "account_required", "Name the notetaker: `cockpit notes webhook <account-id> --secret-stdin`.");
+    }
+    // The secret comes from stdin and nowhere else, exactly as the API key does.
+    if (isInteractiveStdin(door.io)) {
+        return fail(door, "secret_required_on_stdin", `The signing secret is read from stdin, never from a flag. Try: printf "%s" "<signing secret>" | cockpit notes webhook ${accountId} --secret-stdin`);
+    }
+    let secret;
+    try {
+        secret = (await readPipedText(door.io.stdin, {
+            maxChars: KEY_MAX_CHARS,
+            overflowMessage: "That is longer than any webhook signing secret; nothing was sent.",
+        })).trim();
+    }
+    catch (error) {
+        return fail(door, "secret_unreadable", error instanceof Error ? error.message : String(error));
+    }
+    if (secret === "") {
+        return fail(door, "secret_required_on_stdin", "Nothing arrived on stdin, so nothing was stored.");
+    }
+    const answer = await ask(door, {
+        path: `/api/notes/accounts/${encodeURIComponent(accountId)}/webhook`,
+        method: "PUT",
+        label: "notes webhook arm",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: { signing_secret: secret },
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    if (door.json)
+        return emit(door, { ok: true, armed: true, account_id: accountId });
+    writeLine(door.io.stdout, `Stored. Requests to ${accountId}'s webhook URL are now verified.`);
+    writeLine(door.io.stdout, "Until a meeting is written up nothing changes; the half-hourly sweep still reads this account either way.");
+    return 0;
+}
 export async function detachNotetaker(command, door) {
     const accountId = command.accountId ?? "";
     const answer = await ask(door, {

package/dist/commands/notes.js

@@ -40,10 +40,10 @@ import { loadPairedSession } from "../tower-client.js";
 import { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 import { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
 import { runFolderCommand } from "./notes-folders.js";
-import { connectNotetaker, detachNotetaker, listNotesAccounts, syncNotetaker, } from "./notes-accounts.js";
+import { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, } from "./notes-accounts.js";
 export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 export { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
-export { connectNotetaker, detachNotetaker, listNotesAccounts, syncNotetaker, } from "./notes-accounts.js";
+export { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, } from "./notes-accounts.js";
 export { ask, emit, fail, sayUpload, sayScope, errorText, TAG, } from "./notes-door.js";
 export async function runNotes(command, io) {
     const session = await loadPairedSession("notes", command.homeDir);
@@ -79,12 +79,19 @@ export async function runNotes(command, io) {
         case "place":
             return placeNote(command, door);
         case "accounts":
-            return listNotesAccounts(command, door);
+            // BLI-4394. `--show-webhook <id>` turns the list into one account's
+            // webhook URL, because that is the question a person asks WHILE looking
+            // at the list rather than a verb of its own.
+            return command.showWebhook
+                ? showNotesWebhook(command, door)
+                : listNotesAccounts(command, door);
         case "connect":
             return connectNotetaker(command, door);
         case "detach":
             return detachNotetaker(command, door);
         case "sync":
             return syncNotetaker(command, door);
+        case "webhook":
+            return armNotesWebhook(command, door);
     }
 }

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.117");
+    writeLine(io?.stdout ?? process.stdout, "0.2.119");
     return 0;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.117",
+  "version": "0.2.119",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.32",
-    "@bli-cockpit/mcp": "0.1.45",
+    "@bli-cockpit/mcp": "0.1.47",
     "@bli-cockpit/telemetry-core": "0.1.48"
   }
 }