@bli-cockpit/cli 0.2.117 → 0.2.121

package/dist/commands/local-args-tower-chat.js

@@ -10,7 +10,39 @@
  */
 import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, } from "./local-arg-values.js";
 export function parseJarvisArgs(args) {
-    const values = parseNamedArgs(args, {
+    const values = parseJarvisNamedArgs(args);
+    const prompt = parseJarvisPrompt(values);
+    const thread = parseJarvisThread(values);
+    const imagePath = parseJarvisAttachment(values);
+    const { threads, history } = parseJarvisReadback(values, prompt, imagePath);
+    const date = parseJarvisDate(values, threads, history);
+    const trace = parseJarvisTrace(values, threads, history, prompt, imagePath);
+    return {
+        kind: "jarvis",
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        prompt,
+        subject: optionalNonEmpty(values.flags.get("--as")),
+        thread,
+        threads,
+        history,
+        ...(trace ? { trace } : {}),
+        limit: optionalPositiveInteger(values.flags.get("--limit"), "--limit"),
+        // BLI-3381: no client-side allowlist — the dashboard forwards this key
+        // to the inference server's own allowlist and relays its refusal.
+        model: optionalNonEmpty(values.flags.get("--model")),
+        ...(date ? { date } : {}),
+        imagePath,
+        // BLI-3457: streaming is on unless a caller opts out. A dashboard that
+        // does not stream yet still answers plain JSON, so this flag is for
+        // callers that want the single-body shape on purpose, not a compat knob.
+        stream: !values.booleans.has("--no-stream"),
+        json: values.booleans.has("--json"),
+        showApprovalCode: values.booleans.has("--show-approval-code"),
+    };
+}
+function parseJarvisNamedArgs(args) {
+    return parseNamedArgs(args, {
         allowedFlags: [
             "--home",
             "--dashboard-url",
@@ -50,15 +82,23 @@ export function parseJarvisArgs(args) {
             "--limit",
         ],
     });
+}
+function parseJarvisPrompt(values) {
     const flaggedPrompt = optionalNonEmpty(values.flags.get("--prompt"));
     const positionalPrompt = optionalNonEmpty(values.positionals.join(" "));
     if (flaggedPrompt && positionalPrompt) {
         throw new Error("jarvis accepts either --prompt or positional text, not both.");
     }
+    return flaggedPrompt ?? positionalPrompt;
+}
+function parseJarvisThread(values) {
     const thread = optionalNonEmpty(values.flags.get("--thread")) ?? "main";
     if (!/^[A-Za-z0-9_-]{1,40}$/.test(thread)) {
         throw new Error("jarvis --thread must use 1 to 40 letters, numbers, underscores, or hyphens.");
     }
+    return thread;
+}
+function parseJarvisAttachment(values) {
     // BLI-3414: `--file` is a plain alias for `--image` — same flag, whichever
     // word a person reaches for first.
     const image = optionalNonEmpty(values.flags.get("--image"));
@@ -66,6 +106,9 @@ export function parseJarvisArgs(args) {
     if (image && file) {
         throw new Error("jarvis accepts either --image or --file, not both — they are the same flag.");
     }
+    return image ?? file;
+}
+function parseJarvisReadback(values, prompt, imagePath) {
     // BLI-3458. Reading history and asking a question are different acts, and a
     // command that quietly did one while you asked for the other would be worse
     // than a refusal — `--threads` with a question would silently drop the
@@ -75,12 +118,15 @@ export function parseJarvisArgs(args) {
     if (threads && history) {
         throw new Error("jarvis --threads lists every thread; --history replays one. Pass one, not both.");
     }
-    if ((threads || history) && (flaggedPrompt || positionalPrompt)) {
+    if ((threads || history) && prompt) {
         throw new Error("jarvis --threads and --history read back what was already said; they do not take a question.");
     }
-    if ((threads || history) && image) {
+    if ((threads || history) && imagePath) {
         throw new Error("jarvis --threads and --history do not take an attachment.");
     }
+    return { threads, history };
+}
+function parseJarvisDate(values, threads, history) {
     // BLI-3484. `--date` binds the page that was live on one of the subject's
     // days, so a turn can be about Sunday's page. Refused on the two reading
     // commands for the same reason an attachment is: they replay what was said
@@ -89,6 +135,9 @@ export function parseJarvisArgs(args) {
     if ((threads || history) && date) {
         throw new Error("jarvis --threads and --history replay what was said; they bind no page.");
     }
+    return date;
+}
+function parseJarvisTrace(values, threads, history, prompt, imagePath) {
     // BLI-3560. `--trace` reads back what a turn DID, the same class of act as
     // `--threads` and `--history`, and refused alongside them for the same
     // reason: a command that quietly asked a question while you asked to see one
@@ -97,38 +146,16 @@ export function parseJarvisArgs(args) {
     if (trace && (threads || history)) {
         throw new Error("jarvis --trace shows one turn's steps; --threads and --history replay what was said. Pass one.");
     }
-    if (trace && (flaggedPrompt || positionalPrompt)) {
+    if (trace && prompt) {
         throw new Error("jarvis --trace shows a turn that already ran; it does not take a question.");
     }
-    if (trace && image) {
+    if (trace && imagePath) {
         throw new Error("jarvis --trace does not take an attachment.");
     }
     if (trace !== undefined && !/^(last|[A-Za-z0-9_-]{1,64})$/.test(trace)) {
         throw new Error("jarvis --trace takes `last` or a trace id (up to 64 letters, numbers, underscores or hyphens).");
     }
-    return {
-        kind: "jarvis",
-        homeDir: optionalNonEmpty(values.flags.get("--home")),
-        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
-        prompt: flaggedPrompt ?? positionalPrompt,
-        subject: optionalNonEmpty(values.flags.get("--as")),
-        thread,
-        threads,
-        history,
-        ...(trace ? { trace } : {}),
-        limit: optionalPositiveInteger(values.flags.get("--limit"), "--limit"),
-        // BLI-3381: no client-side allowlist — the dashboard forwards this key
-        // to the inference server's own allowlist and relays its refusal.
-        model: optionalNonEmpty(values.flags.get("--model")),
-        ...(date ? { date } : {}),
-        imagePath: image ?? file,
-        // BLI-3457: streaming is on unless a caller opts out. A dashboard that
-        // does not stream yet still answers plain JSON, so this flag is for
-        // callers that want the single-body shape on purpose, not a compat knob.
-        stream: !values.booleans.has("--no-stream"),
-        json: values.booleans.has("--json"),
-        showApprovalCode: values.booleans.has("--show-approval-code"),
-    };
+    return trace;
 }
 /**
  * `cockpit correct` (BLI-3458) — say that one line on the page is wrong.

package/dist/commands/local-args-tower-docs-msg.js

@@ -27,23 +27,33 @@ export function parseDocsArgs(args) {
         ],
         valueFlags: ["--home", "--dashboard-url", "--title", "--parent", "--visibility", "--file", "--query", "--limit"],
     });
-    const first = values.positionals[0];
+    const { action, rest } = parseDocsAction(values.positionals);
+    const docRef = parseDocsDocumentReference(action, rest);
+    const { visibility, clearParent, parentId, allowEmpty, title, query, limit } = parseDocsFlags(action, values);
+    return buildDocsCommand(values, action, docRef, visibility, clearParent, parentId, allowEmpty, title, query, limit);
+}
+function parseDocsAction(positionals) {
+    const first = positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!DOCS_ACTIONS.has(action)) {
         throw new Error(`Unknown docs command: ${first}. Try list, tree, read, create, or update.`);
     }
-    const rest = values.positionals.slice(first === undefined ? 0 : 1);
-    let docRef;
+    return { action, rest: positionals.slice(first === undefined ? 0 : 1) };
+}
+function parseDocsDocumentReference(action, rest) {
     if (DOCS_ACTIONS_NEEDING_A_DOC.has(action)) {
-        docRef = optionalNonEmpty(rest[0]);
+        const docRef = optionalNonEmpty(rest[0]);
         if (!docRef)
             throw new Error(`docs ${action} needs a document id or slug.`);
         if (rest.length > 1)
             throw new Error(`docs ${action} takes one document reference, not ${rest.length}.`);
+        return docRef;
     }
-    else if (rest.length > 0) {
+    if (rest.length > 0)
         throw new Error(`docs ${action} does not take "${rest[0]}".`);
-    }
+    return undefined;
+}
+function parseDocsFlags(action, values) {
     const visibility = optionalNonEmpty(values.flags.get("--visibility"));
     if (visibility && visibility !== "org" && visibility !== "private") {
         throw new Error('docs --visibility must be "org" or "private".');
@@ -80,6 +90,9 @@ export function parseDocsArgs(args) {
     if (limit !== undefined && action !== "list") {
         throw new Error("--limit belongs to `cockpit docs list`.");
     }
+    return { visibility, clearParent, parentId, allowEmpty, title, query, limit };
+}
+function buildDocsCommand(values, action, docRef, visibility, clearParent, parentId, allowEmpty, title, query, limit) {
     return {
         kind: "docs",
         action,
@@ -137,12 +150,21 @@ export function parseMsgArgs(args) {
         ],
         valueFlags: ["--home", "--dashboard-url", "--channel", "--thread", "--limit", "--members", "--description"],
     });
-    const first = values.positionals[0];
+    const { action, rest } = parseMsgAction(values.positionals);
+    const { channelName, dmEmail } = parseMsgCreateTarget(action, rest);
+    const { isPrivate, memberEmails, description } = parseMsgCreateFlags(action, values);
+    const { channelRef, threadId, limit } = parseMsgReadTarget(action, rest, values);
+    return buildMsgCommand(values, action, channelRef, channelName, dmEmail, memberEmails, description, isPrivate, threadId, limit);
+}
+function parseMsgAction(positionals) {
+    const first = positionals[0];
     const action = (first === undefined ? "channels" : first);
     if (!MSG_ACTIONS.has(action)) {
         throw new Error(`Unknown msg command: ${first}. Try channels, read, send, thread, create, or dm.`);
     }
-    const rest = values.positionals.slice(first === undefined ? 0 : 1);
+    return { action, rest: positionals.slice(first === undefined ? 0 : 1) };
+}
+function parseMsgCreateTarget(action, rest) {
     let channelName;
     let dmEmail;
     if (action === "create") {
@@ -167,6 +189,9 @@ export function parseMsgArgs(args) {
         if (!dmEmail.includes("@"))
             throw new Error(`msg dm takes an email address; "${dmEmail}" is not one.`);
     }
+    return { channelName, dmEmail };
+}
+function parseMsgCreateFlags(action, values) {
     const isPrivate = values.booleans.has("--private");
     if (isPrivate && action !== "create") {
         throw new Error("--private belongs to `cockpit msg create`.");
@@ -179,6 +204,9 @@ export function parseMsgArgs(args) {
     if (description && action !== "create") {
         throw new Error("--description belongs to `cockpit msg create`.");
     }
+    return { isPrivate, memberEmails, description };
+}
+function parseMsgReadTarget(action, rest, values) {
     let channelRef;
     if (MSG_ACTIONS_NEEDING_A_CHANNEL.has(action)) {
         channelRef = optionalNonEmpty(rest[0]);
@@ -207,6 +235,9 @@ export function parseMsgArgs(args) {
     if (limit !== undefined && action !== "read" && action !== "thread") {
         throw new Error("--limit belongs to `cockpit msg read` or `cockpit msg thread`.");
     }
+    return { channelRef, threadId, limit };
+}
+function buildMsgCommand(values, action, channelRef, channelName, dmEmail, memberEmails, description, isPrivate, threadId, limit) {
     return {
         kind: "msg",
         action,

package/dist/commands/local-args-tower-mail.js

@@ -70,12 +70,23 @@ export function parseMailArgs(args) {
             "--out",
         ],
     });
+    const { action, rest } = readMailAction(values);
+    const { subject, query } = readMailSubjectOrQuery(action, rest);
+    const address = readImapAddress(action, values);
+    const { to, cc } = readMailRecipients(action, values);
+    const outPath = readAttachmentPath(action, values);
+    const limit = readMailLimit(action, values);
+    return buildMailCommand(values, action, subject, query, address, to, cc, outPath, limit);
+}
+function readMailAction(values) {
     const first = values.positionals[0];
     const action = (first === undefined ? "inbox" : first);
     if (!MAIL_ACTIONS.has(action)) {
         throw new Error(`Unknown mail command: ${first}. Try accounts, add-imap, detach, inbox, read, search, send, attachment, or sync.`);
     }
-    const rest = values.positionals.slice(first === undefined ? 0 : 1);
+    return { action, rest: values.positionals.slice(first === undefined ? 0 : 1) };
+}
+function readMailSubjectOrQuery(action, rest) {
     let subject;
     let query;
     if (MAIL_ACTIONS_NEEDING_A_SUBJECT.has(action)) {
@@ -96,10 +107,16 @@ export function parseMailArgs(args) {
     else if (rest.length > 0) {
         throw new Error(`mail ${action} does not take "${rest[0]}".`);
     }
+    return { subject, query };
+}
+function readImapAddress(action, values) {
     const address = optionalNonEmpty(values.flags.get("--address"));
     if (action === "add-imap" && !address) {
         throw new Error("mail add-imap needs --address, and reads the app password from stdin.");
     }
+    return address;
+}
+function readMailRecipients(action, values) {
     const to = splitAddresses(values.flags.get("--to"));
     const cc = splitAddresses(values.flags.get("--cc"));
     if (action === "send" && to.length === 0) {
@@ -108,14 +125,23 @@ export function parseMailArgs(args) {
     if (action === "send" && !optionalNonEmpty(values.flags.get("--account"))) {
         throw new Error("mail send needs --account <id>: with several mailboxes attached, which address this goes out from is yours to say. `cockpit mail accounts` lists them.");
     }
+    return { to, cc };
+}
+function readAttachmentPath(action, values) {
     const outPath = optionalNonEmpty(values.flags.get("--out"));
     if (action === "attachment" && !outPath) {
         throw new Error("mail attachment needs --out <path>: the file is written to disk, never to stdout.");
     }
+    return outPath;
+}
+function readMailLimit(action, values) {
     const limit = optionalPositiveInteger(values.flags.get("--limit"), "--limit");
     if (limit !== undefined && action !== "inbox" && action !== "search") {
         throw new Error("--limit belongs to `cockpit mail inbox` or `cockpit mail search`.");
     }
+    return limit;
+}
+function buildMailCommand(values, action, subject, query, address, to, cc, outPath, limit) {
     return {
         kind: "mail",
         action,

package/dist/commands/local-args-tower-models.js

@@ -28,23 +28,7 @@ export function parseModelsArgs(args) {
     // `compare` is the one verb that takes several ids, so it is parsed before
     // the at-most-two rule the other two live under (BLI-3919).
     if (values.positionals[0] === "compare") {
-        const modelIds = values.positionals.slice(1).map((id) => id.trim()).filter((id) => id.length > 0);
-        const unique = [...new Set(modelIds)];
-        if (unique.length < COMPARE_MIN) {
-            throw new Error(`models compare needs at least ${COMPARE_MIN} model ids, e.g. ` +
-                "`models compare openai:gpt-5.6-luna openai:gpt-5.6-terra`.");
-        }
-        if (unique.length > COMPARE_MAX) {
-            throw new Error(`models compare holds at most ${COMPARE_MAX} models; ${unique.length} named. ` +
-                "A fifth column stops being readable.");
-        }
-        return {
-            kind: "models",
-            action: "compare",
-            modelIds: unique,
-            highlight: values.booleans.has("--highlight"),
-            ...base,
-        };
+        return parseModelComparison(values.positionals, values.booleans.has("--highlight"), base);
     }
     if (values.booleans.has("--highlight")) {
         throw new Error("--highlight only means something for `models compare`.");
@@ -69,4 +53,17 @@ export function parseModelsArgs(args) {
         throw new Error("models show needs a model id, e.g. `models show openai:gpt-5.6-terra`.");
     }
     return { kind: "models", action: "show", modelId, ...base };
+}
+function parseModelComparison(positionals, highlight, base) {
+    const modelIds = positionals.slice(1).map((id) => id.trim()).filter((id) => id.length > 0);
+    const unique = [...new Set(modelIds)];
+    if (unique.length < COMPARE_MIN) {
+        throw new Error(`models compare needs at least ${COMPARE_MIN} model ids, e.g. ` +
+            "`models compare openai:gpt-5.6-luna openai:gpt-5.6-terra`.");
+    }
+    if (unique.length > COMPARE_MAX) {
+        throw new Error(`models compare holds at most ${COMPARE_MAX} models; ${unique.length} named. ` +
+            "A fifth column stops being readable.");
+    }
+    return { kind: "models", action: "compare", modelIds: unique, highlight, ...base };
 }

package/dist/commands/local-args-tower-pages.js

@@ -152,6 +152,18 @@ export function parseBriefArgs(args) {
         json: values.booleans.has("--json"),
     };
 }
+/**
+ * The notetakers `cockpit notes connect` will actually seal a key for
+ * (BLI-4391). It mirrors `CONNECTABLE_NOTES_PROVIDERS` in the dashboard, and
+ * the door is still the authority — this list only saves a round trip and a
+ * sealed key for a provider with no reader.
+ *
+ * `otter` and `granola` are deliberately absent: Otter's public API is
+ * Enterprise-only and Granola still runs on its own server-side cron.
+ */
+const CONNECTABLE_PROVIDERS = ["fellow", "circleback"];
+/** The provider whose API is per workspace, so its account needs a subdomain. */
+const PROVIDERS_NEEDING_A_WORKSPACE = ["fellow"];
 const NOTES_ACTIONS = new Set([
     "folders", "mkdir", "rmdir", "rename",
     "list",
@@ -169,6 +181,8 @@ const NOTES_ACTIONS = new Set([
     "connect",
     "detach",
     "sync",
+    // BLI-4394: arm that notetaker's webhook with the vendor's signing secret.
+    "webhook",
 ]);
 /** Actions whose first positional is the note it acts on. */
 const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
@@ -183,7 +197,7 @@ const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
  * note id. `sync` takes one too, and is handled beside these rather than in
  * this set because its id is checked at the door instead of here.
  */
-const NOTES_ACTIONS_NEEDING_AN_ACCOUNT = new Set(["detach"]);
+const NOTES_ACTIONS_NEEDING_AN_ACCOUNT = new Set(["detach", "webhook"]);
 export function parseNotesArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -209,6 +223,13 @@ export function parseNotesArgs(args) {
             // read from stdin and never from argv.
             "--provider",
             "--key-stdin",
+            // BLI-4391. Fellow's API is per WORKSPACE, and a subdomain is a label,
+            // not a secret, so this one carries a value while the key never does.
+            "--workspace",
+            // BLI-4394. `--secret-stdin` is a FLAG and not a value, for the same
+            // reason `--key-stdin` is: the signing secret never touches argv.
+            "--secret-stdin",
+            "--show-webhook",
         ],
         valueFlags: [
             "--home",
@@ -224,6 +245,8 @@ export function parseNotesArgs(args) {
             "--until",
             "--limit",
             "--provider",
+            "--workspace",
+            "--show-webhook",
         ],
     });
     // Bare `cockpit notes` is the list, which is the thing a person typing it
@@ -231,7 +254,7 @@ export function parseNotesArgs(args) {
     const first = values.positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, or sync.`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, sync, or webhook.`);
     }
     const rest = values.positionals.slice(first === undefined ? 0 : 1);
     const json = values.booleans.has("--json");
@@ -258,14 +281,46 @@ export function parseNotesArgs(args) {
             throw new Error(`notes ${action} takes one account id, not ${rest.length}.`);
         }
     }
+    // BLI-4394. `--show-webhook <id>` is a flag on `accounts` rather than a verb
+    // of its own, because "what is this one's webhook URL?" is the question a
+    // person asks WHILE looking at the list.
+    const showWebhook = optionalNonEmpty(values.flags.get("--show-webhook"));
+    if (showWebhook !== undefined) {
+        if (action !== "accounts") {
+            throw new Error("--show-webhook belongs to `cockpit notes accounts --show-webhook <account-id>`.");
+        }
+        accountId = showWebhook;
+    }
+    if (action === "webhook") {
+        if (!values.booleans.has("--secret-stdin")) {
+            // Naming the flag is the point: it says out loud that the signing secret
+            // is not an argument, so nobody goes looking for a `--secret` that will
+            // never exist.
+            throw new Error('notes webhook reads the signing secret from stdin. Say so: printf "%s" "<secret>" | cockpit notes webhook <account-id> --secret-stdin');
+        }
+    }
+    else if (values.booleans.has("--secret-stdin")) {
+        throw new Error("--secret-stdin belongs to `cockpit notes webhook <account-id> --secret-stdin`.");
+    }
     const provider = optionalNonEmpty(values.flags.get("--provider"));
+    const workspace = optionalNonEmpty(values.flags.get("--workspace"));
     if (action === "connect") {
-        if (!provider)
-            throw new Error("notes connect needs --provider fathom.");
+        if (!provider) {
+            throw new Error(`notes connect needs --provider ${CONNECTABLE_PROVIDERS.join("|")}.`);
+        }
+        if (!CONNECTABLE_PROVIDERS.includes(provider)) {
+            throw new Error(`notes connect does not know the provider "${provider}". Tower reads ${CONNECTABLE_PROVIDERS.join(" and ")}.`);
+        }
+        if (PROVIDERS_NEEDING_A_WORKSPACE.includes(provider) && !workspace) {
+            throw new Error(`notes connect --provider ${provider} needs --workspace <subdomain>: its API lives at https://<subdomain>.fellow.app, so a key alone cannot address anything.`);
+        }
+        if (workspace !== undefined && !/^[a-z0-9-]{1,63}$/.test(workspace)) {
+            throw new Error("--workspace is a workspace subdomain: lowercase letters, digits and hyphens, 1 to 63 characters.");
+        }
         if (!values.booleans.has("--key-stdin")) {
             // Naming the flag is the point: it says out loud that the key is not an
             // argument, so nobody goes looking for a `--key` that will never exist.
-            throw new Error('notes connect reads the key from stdin. Say so: printf "%s" "<key>" | cockpit notes connect --provider fathom --key-stdin');
+            throw new Error('notes connect reads the key from stdin. Say so: printf "%s" "<key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
         }
         if (rest.length > 0)
             throw new Error(`notes connect does not take "${rest[0]}".`);
@@ -316,6 +371,8 @@ export function parseNotesArgs(args) {
         ...(noteId ? { noteId } : {}),
         ...(accountId ? { accountId } : {}),
         ...(provider ? { provider } : {}),
+        ...(workspace ? { workspace } : {}),
+        ...(showWebhook ? { showWebhook: true } : {}),
         ...(paths ? { paths } : {}),
         filePath: optionalNonEmpty(values.flags.get("--file")),
         name: optionalNonEmpty(values.flags.get("--name")),

package/dist/commands/local-args-tower-work.js

@@ -72,12 +72,25 @@ export function parseIssueArgs(args) {
             "--file",
         ],
     });
+    const { action, rest } = readIssueAction(values);
+    const { issueRef, moveState } = readIssueReference(action, rest);
+    validateIssueState(moveState, "issue move state must be one of: ");
+    const stateFilter = readIssueStateFilter(action, values);
+    const title = readIssueTitle(action, values);
+    const priority = readIssuePriority(values);
+    const assignee = readIssueAssignee(action, values);
+    const limit = readIssueLimit(action, values);
+    return buildIssueCommand(values, action, issueRef, moveState, stateFilter, title, priority, assignee, limit);
+}
+function readIssueAction(values) {
     const first = values.positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!ISSUE_ACTIONS.has(action)) {
         throw new Error(`Unknown issue command: ${first}. Try list, show, create, update, move, comment, or history.`);
     }
-    const rest = values.positionals.slice(first === undefined ? 0 : 1);
+    return { action, rest: values.positionals.slice(first === undefined ? 0 : 1) };
+}
+function readIssueReference(action, rest) {
     let issueRef;
     let moveState;
     if (ISSUE_ACTIONS_NEEDING_AN_ISSUE.has(action)) {
@@ -99,19 +112,28 @@ export function parseIssueArgs(args) {
     else if (rest.length > 0) {
         throw new Error(`issue ${action} does not take "${rest[0]}".`);
     }
-    if (moveState && !ISSUE_STATES.includes(moveState)) {
-        throw new Error(`issue move state must be one of: ${ISSUE_STATES.join(", ")}.`);
+    return { issueRef, moveState };
+}
+function validateIssueState(state, errorPrefix) {
+    if (state && !ISSUE_STATES.includes(state)) {
+        throw new Error(`${errorPrefix}${ISSUE_STATES.join(", ")}.`);
     }
+}
+function readIssueStateFilter(action, values) {
     const stateFilter = optionalNonEmpty(values.flags.get("--state"));
-    if (stateFilter !== undefined && !ISSUE_STATES.includes(stateFilter)) {
-        throw new Error(`--state must be one of: ${ISSUE_STATES.join(", ")}.`);
-    }
+    validateIssueState(stateFilter, "--state must be one of: ");
     if (stateFilter !== undefined && action !== "list") {
         throw new Error("--state filters `cockpit issue list`; to move an issue use `cockpit issue move <id> <state>`.");
     }
+    return stateFilter;
+}
+function readIssueTitle(action, values) {
     const title = optionalNonEmpty(values.flags.get("--title"));
     if (action === "create" && !title)
         throw new Error("issue create needs --title.");
+    return title;
+}
+function readIssuePriority(values) {
     // Not `optionalPositiveInteger`: 0 is a legitimate priority ("none", the
     // column default), and that helper refuses it as non-positive.
     const priorityRaw = optionalNonEmpty(values.flags.get("--priority"));
@@ -122,6 +144,9 @@ export function parseIssueArgs(args) {
             throw new Error("--priority must be 0-4 (0 none, 1 urgent, 2 high, 3 medium, 4 low).");
         }
     }
+    return priority;
+}
+function readIssueAssignee(action, values) {
     // An assignee is `me`, `unassigned`, or a person's uuid. A name or an
     // email is refused HERE rather than travelling to Postgres as a malformed
     // uuid, which would come back as a 500 that names nothing useful.
@@ -132,10 +157,16 @@ export function parseIssueArgs(args) {
     if (assignee === "unassigned" && action !== "list") {
         throw new Error('--assignee unassigned filters `cockpit issue list`; to clear an assignee pass --assignee "" is not supported yet.');
     }
+    return assignee;
+}
+function readIssueLimit(action, values) {
     const limit = optionalPositiveInteger(values.flags.get("--limit"), "--limit");
     if (limit !== undefined && action !== "list" && action !== "history") {
         throw new Error("--limit belongs to `cockpit issue list` or `cockpit issue history`.");
     }
+    return limit;
+}
+function buildIssueCommand(values, action, issueRef, moveState, stateFilter, title, priority, assignee, limit) {
     return {
         kind: "issue",
         action,

package/dist/commands/local-help-commands.js

@@ -327,12 +327,13 @@ export function localSubcommandHelp(command) {
         [
             "ops",
             [
-                "Usage: cockpit ops [status [--job <id>] [--coverage] [--skips] [--memory [--memory-days N]] [--models] | recompile --person <email|name|id> [--dry-run]] [--json]",
+                "Usage: cockpit ops [status [--job <id>] [--coverage] [--skips] [--memory [--memory-days N]] [--models] [--turns] [--tool-router] | recompile --person <email|name|id> [--dry-run]] [--json]",
                 "",
                 "  cockpit ops status",
                 "      One line per scheduled job: when it last produced something, and whether that",
                 "      is late FOR THAT JOB. A once-daily job quiet for 18 hours reads ok; a",
                 "      quarter-hourly one does not. Every line names the schedule it is judged against.",
+                "      --turns adds 30-day JARVIS turn aggregates; --tool-router adds the shadow-router agreement board.",
                 "      A job that is not ok also prints what its artifact does and does not prove —",
                 "      several only write a row when there is something new, so quiet can mean a quiet",
                 "      week rather than a broken cron.",
@@ -472,9 +473,11 @@ export function localSubcommandHelp(command) {
                 "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
                 "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
                 "",
-                "Your own notetaker (BLI-4383). Fathom today; Granola uses the same account model.",
+                "Your own notetaker (BLI-4383). Fellow and Circleback today; Otter needs an Enterprise plan and Granola still runs on its own cron.",
                 "accounts [--json] — the notetakers you have connected, with health and when each was last read.",
-                "connect --provider fathom --key-stdin [--name <n>] — connect one. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fathom --key-stdin",
+                "accounts --show-webhook <account-id> — that account's webhook URL, where to paste it at the vendor, and whether a signing secret is stored (BLI-4394). Until one is, every request to that URL is refused, which is the right way to be off.",
+                "webhook <account-id> --secret-stdin — store the VENDOR's webhook signing secret. THE SECRET IS READ FROM STDIN, never a flag: printf \"%s\" \"<signing secret>\" | cockpit notes webhook <account-id> --secret-stdin",
+                "connect --provider fellow|circleback [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
                 "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
                 "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
                 "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",

package/dist/commands/local-help.js

@@ -87,7 +87,7 @@ export function localCommandHelp(command) {
         "  cockpit brief status [--who <person>] [--render] [--dashboard-url <url>] [--json]",
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
         "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
-        "  cockpit notes [accounts|connect --provider fathom --key-stdin [--name <n>]|detach <account-id>|sync <account-id>] [--json]   (the key is read from stdin, never a flag)",
+        "  cockpit notes [accounts [--show-webhook <account-id>]|connect --provider fellow --workspace <sub> --key-stdin [--name <n>]|webhook <account-id> --secret-stdin|detach <account-id>|sync <account-id>] [--json]   (the key and the signing secret are read from stdin, never a flag)",
         "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",