@bli-cockpit/cli 0.2.117 → 0.2.121

package/dist/commands/memory-install-contract.js

@@ -49,6 +49,12 @@
  * machine resolved before anything is written. Skipping that step registered
  * three hooks that answered `command not found` on every turn.
  *
+ * **And the path it is re-pointed at is written for a SHELL, not for the
+ * filesystem** — `shellSafeBinPath`. A hook command is a shell string, Windows
+ * runs it through bash, and a native path's backslashes are eaten as escapes:
+ * the same three hooks, the same `command not found`, arrived at from the other
+ * direction (BLI-4136).
+ *
  * Nothing here touches the filesystem. The halves that do are
  * `memory-install-claude.ts` and `memory-install-codex.ts`.
  */
@@ -96,16 +102,56 @@ export const MEMORY_AUTO_APPROVE_TOOLS = [
 ];
 /** Characters that would let a resolved path change the meaning of a hook command string. */
 const UNSAFE_PATH_CHARACTERS = /["'`$;&|<>\r\n]/u;
+/**
+ * Windows device paths — `\\?\C:\…` (extended length) and `\\.\…` (device
+ * namespace). Both prefixes are DEFINED in terms of backslashes and stop being
+ * that prefix the moment `shellSafeBinPath` turns them into forward slashes, so
+ * a hook command cannot carry one without silently naming a different file.
+ * Refused with a name rather than rewritten into something plausible.
+ */
+const WINDOWS_DEVICE_PATH = /^\\\\[?.]\\/u;
 export function isUnsafeBinPath(binPath) {
-    return UNSAFE_PATH_CHARACTERS.test(binPath);
+    return UNSAFE_PATH_CHARACTERS.test(binPath) || WINDOWS_DEVICE_PATH.test(binPath);
 }
 /**
- * A Claude Code hook `command` is a shell string by the platform's design, so
- * the only defence is quoting — and a path that could not be quoted safely is
- * refused upstream (see `resolveMemoryMcpBin`) rather than escaped cleverly.
+ * A path that no shell gives a meaning to, so it needs no quoting. Deliberately
+ * a tight allow-list rather than a list of known-bad characters: `(` and `)` in
+ * `C:/Program Files (x86)/…` are a bash syntax error, and the earlier
+ * whitespace-only trigger caught them only by the accident of the space.
+ */
+const PLAINLY_SAFE_PATH = /^[A-Za-z0-9_@:./+,-]+$/u;
+/**
+ * The resolved bin path, as it must appear INSIDE a hook command string.
+ *
+ * A Claude Code hook `command` is a shell string by the platform's design, and
+ * on Windows the host runs it through **bash** — which eats every backslash as
+ * an escape. So the native path this installer resolved,
+ * `C:\Users\…\.bin\bli-memory-mcp.cmd`, reaches the shell as
+ * `C:Users….binbli-memory-mcp.cmd` and answers `command not found` on every
+ * SessionStart, every prompt and every Stop. Non-blocking and therefore silent:
+ * memory recall simply degrades, and nothing says so (BLI-4136, fixed by hand
+ * twice on the same machine before the installer was the thing that changed).
+ *
+ * Two independent defences, because either one alone is a thin edge:
+ *
+ *  1. **Separators are normalised to `/` on Windows.** Win32 accepts forward
+ *     slashes in every path it resolves, and after this there is no escape
+ *     character left in the string for a shell to consume. This is also what
+ *     survives a `\\`: double-quoting ALONE would collapse the UNC prefix of
+ *     `\\server\share\…` back to one backslash and name the wrong path.
+ *  2. **Anything not plainly safe is double-quoted**, which covers spaces and
+ *     the bracket characters in `Program Files (x86)`.
+ *
+ * A path that still could not be expressed safely is refused upstream
+ * (`isUnsafeBinPath`, checked in `resolveMemoryConfig`) rather than escaped
+ * cleverly.
+ *
+ * POSIX keeps its separators untouched — a backslash there is a legal
+ * character in a filename, and rewriting it would name a different file.
  */
-export function shellQuoteBinPath(binPath) {
-    return /\s/u.test(binPath) ? `"${binPath}"` : binPath;
+export function shellSafeBinPath(binPath, platform) {
+    const forShell = platform === "win32" ? binPath.replace(/\\/gu, "/") : binPath;
+    return PLAINLY_SAFE_PATH.test(forShell) ? forShell : `"${forShell}"`;
 }
 /**
  * Windows cannot spawn an npm `.cmd` shim directly — Node refuses it without a
@@ -125,13 +171,13 @@ export function memoryMcpServerEntry(options) {
     return { command: options.binPath, args: [], env };
 }
 export function builtinMemoryInstallConfig(options) {
-    const quoted = shellQuoteBinPath(options.binPath);
+    const binPath = shellSafeBinPath(options.binPath, options.platform);
     return {
         server_id: MEMORY_MCP_SERVER_ID,
         mcp_server: memoryMcpServerEntry(options),
         hooks: MEMORY_HOOK_EVENTS.map((event) => ({
             event,
-            command: `${quoted} ${MEMORY_HOOK_SUBCOMMAND[event]}`,
+            command: `${binPath} ${MEMORY_HOOK_SUBCOMMAND[event]}`,
             timeout_seconds: MEMORY_HOOK_TIMEOUT_SECONDS[event],
         })),
         permissions_allow: [...MEMORY_AUTO_APPROVE_TOOLS],
@@ -237,13 +283,13 @@ export function parsePrintedMemoryInstallConfig(stdout) {
  * hook that runs something else.
  */
 export function withResolvedBinPath(config, options) {
-    const quoted = shellQuoteBinPath(options.binPath);
+    const binPath = shellSafeBinPath(options.binPath, options.platform);
     const hooks = [];
     for (const hook of config.hooks) {
         const tail = hookSubcommandTail(hook.command);
         if (!tail)
             return null;
-        hooks.push({ ...hook, command: `${quoted} ${tail}` });
+        hooks.push({ ...hook, command: `${binPath} ${tail}` });
     }
     const entry = memoryMcpServerEntry(options);
     return {

package/dist/commands/memory-install-report.js

@@ -83,17 +83,7 @@ export function logMemoryOutcome(outcome, platform) {
         : "[memory-install] BLI Memory registration converged", JSON.stringify(fields));
 }
 export function memoryOutcomeLines(outcome) {
-    const headline = outcome.status === "installed"
-        ? "BLI Memory registered on this machine."
-        : outcome.status === "already"
-            ? "BLI Memory is already registered on this machine."
-            : outcome.status === "would_install"
-                ? "BLI Memory would be registered (dry run; nothing was written)."
-                : outcome.status === "missing"
-                    ? "BLI Memory is not registered on this machine."
-                    : outcome.status === "skipped"
-                        ? "BLI Memory was not registered and nothing was written: the bli-memory-mcp server is not on this machine yet."
-                        : `BLI Memory is not fully registered: ${outcome.reason}.`;
+    const headline = memoryOutcomeHeadline(outcome);
     const lines = [headline, `  ${memoryReceiptLine(outcome.receipt)}`];
     // BLI-3884. Only `status` asks; an absent reading is not printed as "no
     // daemon", because nothing looked.
@@ -115,4 +105,19 @@ export function memoryOutcomeLines(outcome) {
         lines.push(`  ${target.target}: ${target.status} (${target.reason})${where}${detail}`);
     }
     return lines;
+}
+function memoryOutcomeHeadline(outcome) {
+    if (outcome.status === "installed")
+        return "BLI Memory registered on this machine.";
+    if (outcome.status === "already")
+        return "BLI Memory is already registered on this machine.";
+    if (outcome.status === "would_install") {
+        return "BLI Memory would be registered (dry run; nothing was written).";
+    }
+    if (outcome.status === "missing")
+        return "BLI Memory is not registered on this machine.";
+    if (outcome.status === "skipped") {
+        return "BLI Memory was not registered and nothing was written: the bli-memory-mcp server is not on this machine yet.";
+    }
+    return `BLI Memory is not fully registered: ${outcome.reason}.`;
 }

package/dist/commands/memory-install-skills.js

@@ -13,16 +13,6 @@
  * install is idempotent to the byte and a drifted copy is replaced rather than
  * merged — the same deal `cockpit agent-rules` offers for its managed block.
  */
-/** Relative path → exact file contents. The map IS the install. */
-export function memoryCodexSkillFiles() {
-    return {
-        "SKILL.md": SKILL_MD,
-        "references/search.md": SEARCH_MD,
-        "references/save.md": SAVE_MD,
-        "references/update.md": UPDATE_MD,
-        "references/forget.md": FORGET_MD,
-    };
-}
 const SKILL_MD = `---
 name: bli-memory
 description: BLI Memory — durable memory for this machine. Use when you need to recall what was decided before, or when a session produced a durable decision, preference or correction worth keeping.
@@ -118,4 +108,14 @@ again. Matching by content is exact after whitespace normalisation — never
 fuzzy, and never widened to every container.
 
 It returns what it removed. A bare "done" is not an answer.
-`;
+`;
+/** Relative path → exact file contents. The map IS the install. */
+export function memoryCodexSkillFiles() {
+    return {
+        "SKILL.md": SKILL_MD,
+        "references/search.md": SEARCH_MD,
+        "references/save.md": SAVE_MD,
+        "references/update.md": UPDATE_MD,
+        "references/forget.md": FORGET_MD,
+    };
+}

package/dist/commands/memory-log.js

@@ -5,20 +5,37 @@ import { callTower, openTower } from "./tower-command.js";
 function sender(command, io) {
     return async (entry) => {
         const tower = await openTower("memory log", command, io);
-        const result = await callTower(tower, { path: "/api/memory/experience", method: "POST", body: entry, label: "memory experience", timeoutMs: 5000 });
-        return result.ok ? { ok: result.body?.ok === true, reason: "experience_not_acknowledged" } : result;
+        const result = await callTower(tower, {
+            path: "/api/memory/experience",
+            method: "POST",
+            body: entry,
+            label: "memory experience",
+            timeoutMs: 5000,
+        });
+        return result.ok
+            ? {
+                ok: result.body?.ok === true,
+                reason: "experience_not_acknowledged",
+            }
+            : result;
     };
 }
 export async function runMemoryLog(command, io) {
-    const reason = command.reasonStdin ? (await readPipedText(io.stdin, { maxChars: 1002 })).trim() : command.reason;
+    const reason = command.reasonStdin
+        ? (await readPipedText(io.stdin, { maxChars: 1002 })).trim()
+        : command.reason;
     validateExperience(command.store, command.verdict, reason);
     const entry = await appendExperience({ store: command.store, verdict: command.verdict, reason }, {
-        homeDir: command.homeDir, agent: "cockpit", project: path.basename(process.cwd()),
+        homeDir: command.homeDir,
+        agent: "cockpit",
+        project: path.basename(process.cwd()),
     });
     const delivery = await shipExperience(entry, sender(command, io), command.homeDir);
     const receipt = { ok: true, id: entry.id, local: true, ...delivery };
     writeLine(io.stderr, `[memory experience] recorded ${JSON.stringify(receipt)}`);
-    writeLine(io.stdout, command.json ? JSON.stringify(receipt) : `Experience appended; shipped: ${delivery.shipped} (${delivery.reason}).`);
+    writeLine(io.stdout, command.json
+        ? JSON.stringify(receipt)
+        : `Experience appended; shipped: ${delivery.shipped} (${delivery.reason}).`);
     return 0;
 }
 export async function runMemoryExperienceAfterSync(command, io) {

package/dist/commands/msg.js

@@ -220,16 +220,23 @@ async function createChannel(command, door) {
     const membersAdded = body.members_added ?? [];
     const membersFailed = body.members_failed ?? [];
     const requestedMembers = command.memberEmails?.length ?? 0;
+    logChannelCreation(door, channel, command.isPrivate, requestedMembers, membersAdded, membersFailed);
+    if (door.json) {
+        return emitAgentDoor(door, { ok: true, channel, membersAdded, membersFailed });
+    }
+    reportChannelCreationToHuman(door, channel, name, requestedMembers, membersAdded, membersFailed);
+    return 0;
+}
+function logChannelCreation(door, channel, isPrivate, requestedMembers, membersAdded, membersFailed) {
     writeLine(door.io.stderr, `${TAG} created ${JSON.stringify({
         channel_id: channel?.id ?? null,
-        is_private: command.isPrivate,
+        is_private: isPrivate,
         members_requested: requestedMembers,
         members_added: membersAdded.length,
         members_failed: membersFailed.length,
     })}`);
-    if (door.json) {
-        return emitAgentDoor(door, { ok: true, channel, membersAdded, membersFailed });
-    }
+}
+function reportChannelCreationToHuman(door, channel, name, requestedMembers, membersAdded, membersFailed) {
     writeLine(door.io.stdout, `Created #${channel?.name ?? name} (${channel?.id ?? "?"}).`);
     if (membersAdded.length > 0) {
         writeLine(door.io.stdout, `${membersAdded.length} member(s) added.`);
@@ -246,7 +253,6 @@ async function createChannel(command, door) {
     for (const failure of membersFailed) {
         writeLine(door.io.stdout, `Not added (${failure.reason}): ${failure.userId}`);
     }
-    return 0;
 }
 async function openDm(command, door) {
     const email = command.dmEmail ?? "";

package/dist/commands/notes-accounts.js

@@ -37,14 +37,18 @@ export async function listNotesAccounts(command, door) {
     if (accounts.length === 0) {
         writeLine(door.io.stdout, "No notetaker is connected yet.");
         writeLine(door.io.stdout, "");
-        writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fathom api key>" | cockpit notes connect --provider fathom --key-stdin');
+        writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fellow api key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
+        writeLine(door.io.stdout, '          or:  printf "%s" "<your circleback api key>" | cockpit notes connect --provider circleback --key-stdin');
         return 0;
     }
     for (const account of accounts) {
         const health = account.status === "active"
             ? "active"
             : `${account.status}: ${account.status_reason ?? "no reason recorded"}`;
-        writeLine(door.io.stdout, `${(account.label ?? account.provider).padEnd(20)}  ${account.provider.padEnd(10)}  ${health.padEnd(24)}  ${account.last_synced_at ?? "never read"}`);
+        // The workspace rides beside the provider because a Fellow account that
+        // points at the wrong subdomain fails with a 401 and nothing else says so.
+        const where = account.workspace ? `${account.provider}/${account.workspace}` : account.provider;
+        writeLine(door.io.stdout, `${(account.label ?? account.provider).padEnd(20)}  ${where.padEnd(20)}  ${health.padEnd(24)}  ${account.last_synced_at ?? "never read"}`);
     }
     writeLine(door.io.stdout, "");
     writeLine(door.io.stdout, `${accounts.length} notetaker(s). ids: ${accounts.map((account) => account.id).join(", ")}`);
@@ -58,7 +62,7 @@ export async function connectNotetaker(command, door) {
     // nothing piped in is told how, rather than left waiting on a prompt that
     // would echo the secret into the scrollback.
     if (isInteractiveStdin(door.io)) {
-        return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fathom --key-stdin');
+        return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
     }
     let apiKey;
     try {
@@ -79,8 +83,12 @@ export async function connectNotetaker(command, door) {
         label: "notes connect",
         timeoutMs: WRITE_DEADLINE_MS,
         body: {
-            provider: command.provider ?? "fathom",
+            provider: command.provider ?? "fellow",
             label: command.name ?? null,
+            // Absent, not null, when nobody named one: the door treats a missing
+            // workspace and an explicit null the same, and a `--workspace` a person
+            // did type is never silently dropped.
+            ...(command.workspace ? { workspace: command.workspace } : {}),
             api_key: apiKey,
         },
     });
@@ -89,10 +97,93 @@ export async function connectNotetaker(command, door) {
     const account = answer.body.account;
     if (door.json)
         return emit(door, { ok: true, account });
-    writeLine(door.io.stdout, `Connected ${account?.provider ?? command.provider ?? "fathom"} (${account?.id ?? "no id returned"}).`);
+    const named = account?.provider ?? command.provider ?? "fellow";
+    writeLine(door.io.stdout, `Connected ${account?.workspace ? `${named}/${account.workspace}` : named} (${account?.id ?? "no id returned"}).`);
     writeLine(door.io.stdout, "Nothing is read until a sync runs: `cockpit notes sync <id>`, or wait for the half-hourly cron.");
     return 0;
 }
+/**
+ * `cockpit notes accounts --show-webhook <id>` and
+ * `cockpit notes webhook <id> --secret-stdin` (BLI-4394).
+ *
+ * The URL is SHOWN, because a person cannot register a webhook they cannot
+ * read. The signing secret is READ FROM STDIN and never from a flag, for the
+ * same reason `connect` reads the API key that way: an argument list is in the
+ * process table, in the shell history and in every log that records a command
+ * line. There is deliberately no `--secret <value>`, and deliberately no MCP
+ * twin for this verb.
+ */
+export async function showNotesWebhook(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        return fail(door, "account_required", "Name the notetaker: `cockpit notes accounts --show-webhook <account-id>`. `cockpit notes accounts` lists the ids.");
+    }
+    const answer = await ask(door, {
+        path: `/api/notes/accounts/${encodeURIComponent(accountId)}/webhook`,
+        method: "GET",
+        label: "notes webhook",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const webhook = answer.body.webhook;
+    if (door.json)
+        return emit(door, { ok: true, webhook });
+    if (!webhook?.url) {
+        writeLine(door.io.stdout, "This notetaker has no webhook URL.");
+        writeLine(door.io.stdout, "Its key was sealed before webhooks shipped. Detach it and connect it again to mint one.");
+        return 0;
+    }
+    writeLine(door.io.stdout, webhook.url);
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, webhook.armed
+        ? "A signing secret is stored, so requests to that URL are verified."
+        : "NO SIGNING SECRET IS STORED YET, so every request to that URL is refused. That is the right way to be off.");
+    if (webhook.where) {
+        writeLine(door.io.stdout, "");
+        writeLine(door.io.stdout, webhook.where);
+    }
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, `Store the secret:  printf "%s" "<signing secret>" | cockpit notes webhook ${accountId} --secret-stdin`);
+    return 0;
+}
+export async function armNotesWebhook(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        return fail(door, "account_required", "Name the notetaker: `cockpit notes webhook <account-id> --secret-stdin`.");
+    }
+    // The secret comes from stdin and nowhere else, exactly as the API key does.
+    if (isInteractiveStdin(door.io)) {
+        return fail(door, "secret_required_on_stdin", `The signing secret is read from stdin, never from a flag. Try: printf "%s" "<signing secret>" | cockpit notes webhook ${accountId} --secret-stdin`);
+    }
+    let secret;
+    try {
+        secret = (await readPipedText(door.io.stdin, {
+            maxChars: KEY_MAX_CHARS,
+            overflowMessage: "That is longer than any webhook signing secret; nothing was sent.",
+        })).trim();
+    }
+    catch (error) {
+        return fail(door, "secret_unreadable", error instanceof Error ? error.message : String(error));
+    }
+    if (secret === "") {
+        return fail(door, "secret_required_on_stdin", "Nothing arrived on stdin, so nothing was stored.");
+    }
+    const answer = await ask(door, {
+        path: `/api/notes/accounts/${encodeURIComponent(accountId)}/webhook`,
+        method: "PUT",
+        label: "notes webhook arm",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: { signing_secret: secret },
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    if (door.json)
+        return emit(door, { ok: true, armed: true, account_id: accountId });
+    writeLine(door.io.stdout, `Stored. Requests to ${accountId}'s webhook URL are now verified.`);
+    writeLine(door.io.stdout, "Until a meeting is written up nothing changes; the half-hourly sweep still reads this account either way.");
+    return 0;
+}
 export async function detachNotetaker(command, door) {
     const accountId = command.accountId ?? "";
     const answer = await ask(door, {

package/dist/commands/notes.js

@@ -40,10 +40,10 @@ import { loadPairedSession } from "../tower-client.js";
 import { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 import { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
 import { runFolderCommand } from "./notes-folders.js";
-import { connectNotetaker, detachNotetaker, listNotesAccounts, syncNotetaker, } from "./notes-accounts.js";
+import { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, } from "./notes-accounts.js";
 export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 export { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
-export { connectNotetaker, detachNotetaker, listNotesAccounts, syncNotetaker, } from "./notes-accounts.js";
+export { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, } from "./notes-accounts.js";
 export { ask, emit, fail, sayUpload, sayScope, errorText, TAG, } from "./notes-door.js";
 export async function runNotes(command, io) {
     const session = await loadPairedSession("notes", command.homeDir);
@@ -79,12 +79,19 @@ export async function runNotes(command, io) {
         case "place":
             return placeNote(command, door);
         case "accounts":
-            return listNotesAccounts(command, door);
+            // BLI-4394. `--show-webhook <id>` turns the list into one account's
+            // webhook URL, because that is the question a person asks WHILE looking
+            // at the list rather than a verb of its own.
+            return command.showWebhook
+                ? showNotesWebhook(command, door)
+                : listNotesAccounts(command, door);
         case "connect":
             return connectNotetaker(command, door);
         case "detach":
             return detachNotetaker(command, door);
         case "sync":
             return syncNotetaker(command, door);
+        case "webhook":
+            return armNotesWebhook(command, door);
     }
 }

package/dist/commands/onboard-setup.js

@@ -57,6 +57,13 @@ export async function pairForOnboarding(command, input, installEvents, io) {
         repoRoot: input.primaryRoot,
         branch: command.branch,
     });
+    if (await reuseInstalledOnboardSession(command, input, installedStatus, installEvents, io)) {
+        return null;
+    }
+    await logOutMismatchedOnboardSession(command, installedStatus, io);
+    return await pairOnboardDevice(command, input, installEvents, io);
+}
+async function reuseInstalledOnboardSession(command, input, installedStatus, installEvents, io) {
     const installedSession = await readOnboardSessionReuseCandidate(command.homeDir);
     const canReuseInstalledSession = canReuseOnboardSession(installedSession, input.claimedOwnerEmail, command.dashboardUrl);
     if (installedStatus.session_state === "valid" && canReuseInstalledSession) {
@@ -65,14 +72,19 @@ export async function pairForOnboarding(command, input, installEvents, io) {
         if (!command.json) {
             writeLine(io.stdout, "2/5 Existing valid device session found; pairing skipped.");
         }
-        return null;
+        return true;
     }
+    return false;
+}
+async function logOutMismatchedOnboardSession(command, installedStatus, io) {
     if (installedStatus.session_state === "valid") {
         await logoutLocalCollector({ homeDir: command.homeDir });
         if (!command.json) {
             writeLine(io.stdout, "2/5 Existing valid device session does not match requested owner or dashboard; pairing again.");
         }
     }
+}
+async function pairOnboardDevice(command, input, installEvents, io) {
     // BLI-3731: one sign-in first. The link both signs the browser in and
     // finishes the pairing, so nobody reads a second email. Every other arm
     // below is the fallback, and it runs unchanged when this one cannot finish.
@@ -89,6 +101,9 @@ export async function pairForOnboarding(command, input, installEvents, io) {
             return linked;
         }
     }
+    return await pairOnboardDeviceWithAuthFallback(command, input, installEvents, io);
+}
+async function pairOnboardDeviceWithAuthFallback(command, input, installEvents, io) {
     const authResult = await requestPairingAccessTokenDetailed({
         dashboardUrl: command.dashboardUrl,
         email: input.claimedOwnerEmail,

package/dist/commands/ops-sections.js

@@ -0,0 +1,89 @@
+import { asRecord, callTower } from "./tower-command.js";
+import { writeLine } from "./cli-io.js";
+export function turnAggregateSection(payload) {
+    const section = payload.turns ?? null;
+    return { section, reason: section ? "ok" : "turns_section_absent" };
+}
+export async function readToolRouterBoard(io, tower) {
+    const result = await callTower(tower, { path: "/api/ops/tool-router", label: "ops-tool-router" });
+    if (!result.ok) {
+        writeLine(io.stderr, `[ops cli] tool router not read ${JSON.stringify({ reason: result.reason, http_status: result.httpStatus ?? null })}`);
+        return { board: null, reason: result.reason };
+    }
+    const board = asRecord(result.body).board ?? null;
+    return { board, reason: board ? "ok" : "tool_router_section_absent" };
+}
+export function turnAggregateLine(section) {
+    return `TURNS  ${section.turns ?? 0} turns / ${section.windowDays ?? 30}d · wall p50 ${section.wallTimeMs?.p50 ?? "n/a"}ms · p95 ${section.wallTimeMs?.p95 ?? "n/a"}ms · ${section.completion ?? "unknown"}`;
+}
+export function toolRouterLine(board) {
+    const rate = board.agreementRate === null || board.agreementRate === undefined
+        ? "n/a"
+        : `${(board.agreementRate * 100).toFixed(1)}%`;
+    return `TOOL ROUTER  ${board.turnsRouted ?? 0} routed · agreement ${rate} · p50 ${board.p50LatencyMs ?? "n/a"}ms${board.capped ? " · capped" : ""}${board.readError ? ` · ${board.readError}` : ""}`;
+}
+/**
+ * The adoption gauge, read through its own door.
+ *
+ * Never fails the board: a `cockpit ops --memory` whose memory half is
+ * unreadable still prints the pipelines, the fleet and the coverage, and says
+ * in one line which half is missing and why. The status board's exit code is
+ * about collection health, and adoption is not that.
+ */
+export async function readMemoryUsage(command, io, tower) {
+    const params = new URLSearchParams();
+    if (command.memoryDays !== undefined)
+        params.set("days", String(command.memoryDays));
+    const query = params.toString();
+    const result = await callTower(tower, {
+        path: `/api/ops/memory-usage${query ? `?${query}` : ""}`,
+        label: "ops-memory-usage",
+    });
+    if (!result.ok) {
+        writeLine(io.stderr, `[ops cli] memory usage not read ${JSON.stringify({
+            reason: result.reason,
+            http_status: result.httpStatus ?? null,
+        })}`);
+        return { section: null, hooks: null, experience: null, reason: result.reason };
+    }
+    const body = asRecord(result.body);
+    // BLI-3788: the hook counts ride the same answer, and their absence is a
+    // fact about the SERVER's version rather than about this fleet — an older
+    // dashboard sends no `hooks` key, and printing nothing is right there.
+    if (!body.memory)
+        return {
+            section: null,
+            hooks: body.hooks ?? null,
+            experience: body.experience ?? null,
+            reason: "memory_section_absent",
+        };
+    return {
+        section: body.memory,
+        hooks: body.hooks ?? null,
+        experience: body.experience ?? null,
+        reason: "ok",
+    };
+}
+/**
+ * The per-model board, read through its own door (BLI-3912).
+ *
+ * Same posture as the adoption gauge next door: it never fails the status
+ * board, and when it cannot be read the reason is printed where the section
+ * would have been. The LINES come from the server, so a terminal and the
+ * dashboard cannot disagree about what a model cost today.
+ */
+export async function readModelBoardLines(io, tower) {
+    const result = await callTower(tower, { path: "/api/ops/models", label: "ops-models" });
+    if (!result.ok) {
+        writeLine(io.stderr, `[ops cli] model board not read ${JSON.stringify({
+            reason: result.reason,
+            http_status: result.httpStatus ?? null,
+        })}`);
+        return { lines: [], board: null, reason: result.reason };
+    }
+    const body = asRecord(result.body);
+    if (!body.lines || body.lines.length === 0) {
+        return { lines: [], board: body.board ?? null, reason: "models_section_absent" };
+    }
+    return { lines: body.lines, board: body.board ?? null, reason: "ok" };
+}