@bli-cockpit/cli 0.2.140 → 0.2.142

package/dist/commands/docs.js

@@ -49,6 +49,8 @@ export async function runDocs(command, io) {
             return createDoc(command, door);
         case "update":
             return updateDoc(command, door);
+        case "delete":
+            return deleteDocs(command, door);
         case "link":
             return linkDoc(command, door);
         case "sync-status":
@@ -234,6 +236,75 @@ async function updateDoc(command, door) {
     writeLine(door.io.stdout, `Updated ${String(document["title"] ?? "")} (${String(document["id"] ?? resolved.id)}).`);
     return 0;
 }
+/**
+ * BLI‑10555: soft-deletes one or more documents — `DELETE
+ * /api/docs/documents/[id]`, the same door the browser's own delete calls.
+ * Recoverable (only a super_admin clearing `deleted_at` brings it back, no
+ * self-service undo) and never cascades: a deleted document's children keep
+ * their own `parent_id` and stay exactly where they were.
+ *
+ * Mirrors `readDoc`'s multi-ref shape (BLI-10450): one shared `docs list`
+ * resolves every ref, then one `DELETE` per document — one bad ref never
+ * loses the rest of the batch.
+ */
+async function deleteDocs(command, door) {
+    const refs = command.docRefs && command.docRefs.length > 0 ? command.docRefs : [command.docRef ?? ""];
+    const resolved = await resolveDocIds(door, refs);
+    if (resolved.status === "list_failed")
+        return failAgentDoor(door, TAG, resolved.reason, resolved.detail);
+    const results = await Promise.all(refs.map((ref) => deleteOneDocument(door, ref, resolved.ids.get(ref))));
+    const failed = results.filter((result) => !result.ok);
+    writeLine(door.io.stderr, `${TAG} delete ${JSON.stringify({ requested: refs.length, deleted: results.length - failed.length, refused: failed.length })}`);
+    if (refs.length === 1) {
+        const [result] = results;
+        if (!result || !result.ok) {
+            return failAgentDoor(door, TAG, result?.reason ?? "document_not_found_or_unreadable", result?.detail ?? "Not found.");
+        }
+        if (door.json)
+            return emitAgentDoor(door, { ok: true, document_id: result.id });
+        writeLine(door.io.stdout, `Deleted ${result.id}. Recoverable by a super_admin; its children stay in place.`);
+        return 0;
+    }
+    if (door.json) {
+        return emitAgentDoor(door, {
+            ok: failed.length === 0,
+            documents: results.map((result) => result.ok
+                ? { ref: result.ref, ok: true, document_id: result.id }
+                : { ref: result.ref, ok: false, error: result.reason, detail: result.detail }),
+        }, failed.length === 0 ? 0 : 1);
+    }
+    results.forEach((result) => {
+        if (result.ok) {
+            writeLine(door.io.stdout, `Deleted ${result.ref} (${result.id}).`);
+        }
+        else {
+            writeLine(door.io.stderr, `${TAG} refused ${JSON.stringify({ ref: result.ref, reason: result.reason })}`);
+            writeLine(door.io.stdout, `${result.ref}: ${result.detail}`);
+        }
+    });
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, `${results.length - failed.length}/${results.length} document(s) deleted. Recoverable by a super_admin; children stay in place.`);
+    return failed.length === 0 ? 0 : 1;
+}
+async function deleteOneDocument(door, ref, id) {
+    if (!id) {
+        return {
+            ref,
+            ok: false,
+            reason: "document_not_found_or_unreadable",
+            detail: `That document does not exist, or you cannot delete it: ${ref}`,
+        };
+    }
+    const answer = await askAgentDoor(door, {
+        path: `/api/docs/documents/${encodeURIComponent(id)}`,
+        method: "DELETE",
+        label: "docs delete",
+        timeoutMs: WRITE_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return { ref, ok: false, reason: answer.reason, detail: answer.detail };
+    return { ref, ok: true, id };
+}
 async function updateDocument(command, door, documentId, bodyMarkdown) {
     return askAgentDoor(door, {
         path: `/api/docs/documents/${encodeURIComponent(documentId)}`,

package/dist/commands/local-args-tower-docs-msg.js

@@ -7,10 +7,12 @@
  * added both without stretching either existing family's own doc comment.
  */
 import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, } from "./local-arg-values.js";
-const DOCS_ACTIONS = new Set(["list", "tree", "read", "create", "update", "link", "sync-status"]);
+const DOCS_ACTIONS = new Set(["list", "tree", "read", "create", "update", "delete", "link", "sync-status"]);
 // BLI-10450: `read` moved to its own branch in `parseDocsDocumentReference` —
 // it takes SEVERAL references now, so it no longer shares the "exactly one"
-// rule `update`/`link` still enforce.
+// rule `update`/`link` still enforce. BLI‑10555: `delete` takes several too
+// (the same door, called once per ref), so it joined `read`'s branch rather
+// than this set.
 const DOCS_ACTIONS_NEEDING_A_DOC = new Set(["update", "link"]);
 export function parseDocsArgs(args) {
     const values = parseNamedArgs(args, {
@@ -52,6 +54,11 @@ export function parseDocsArgs(args) {
     const { visibility, clearParent, parentId, allowEmpty, title, query, wholeWord, limit, bodies, section, offset } = parseDocsFlags(action, values);
     if (action === "read")
         validateDocsReadTargets(docRefs, parentId, bodies);
+    // BLI‑10555: `delete` needs no `--parent`/`--bodies` shape, only at least
+    // one reference — `read`'s emptier validation does not apply.
+    if (action === "delete" && (!docRefs || docRefs.length === 0)) {
+        throw new Error("docs delete needs one or more document ids/slugs.");
+    }
     return buildDocsCommand(values, action, docRef, docRefs, visibility, clearParent, parentId, allowEmpty, title, query, wholeWord, limit, bodies, section, offset, link);
 }
 /**
@@ -104,7 +111,7 @@ function parseDocsAction(positionals) {
     const first = positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!DOCS_ACTIONS.has(action)) {
-        throw new Error(`Unknown docs command: ${first}. Try list, tree, read, create, update, link, or sync-status.`);
+        throw new Error(`Unknown docs command: ${first}. Try list, tree, read, create, update, delete, link, or sync-status.`);
     }
     return { action, rest: positionals.slice(first === undefined ? 0 : 1) };
 }
@@ -112,8 +119,10 @@ function parseDocsDocumentReference(action, rest) {
     // BLI-10450: `read` alone takes several references in one call — an agent
     // reading a folder's worth of documents used to pay a resolve-then-read
     // pair PER document. Emptiness is validated later, once `--parent`/
-    // `--bodies` are known (`validateDocsReadTargets`).
-    if (action === "read") {
+    // `--bodies` are known (`validateDocsReadTargets`). BLI‑10555: `delete`
+    // shares this shape — several refs, one shared resolve, one DELETE each —
+    // its own emptiness check runs right after this function returns.
+    if (action === "read" || action === "delete") {
         const refs = rest.map((token) => optionalNonEmpty(token)).filter((token) => Boolean(token));
         return { docRef: refs[0], docRefs: refs.length > 0 ? refs : undefined };
     }

package/dist/commands/local-help-commands-tower-ops.js

@@ -0,0 +1,134 @@
+/**
+ * The long-form `cockpit <command> --help` text for JARVIS, the model cards,
+ * Scout and the ops doors.
+ *
+ * Split out of `local-help-commands.ts` (BLI-10445) when that file crossed the
+ * 500-line readability ratchet, along the same seam BLI-3709 drew: these are
+ * Tower surfaces, not the collector's own commands.
+ *
+ * Every string moved verbatim. Help output is what an intern pastes back when
+ * something breaks, so it is a user-visible contract like any other.
+ */
+export const TOWER_OPS_COMMAND_HELP = [
+    [
+        "jarvis",
+        [
+            "Usage: cockpit jarvis [question] [--prompt <question>] [--as <person>] [--date <YYYY-MM-DD>] [--thread <name>] [--model <key>] [--image <path>|--file <path>] [--no-stream] [--threads|--history [--limit <n>]] [--trace <id|last>] [--dashboard-url <url>] [--json [--show-approval-code]]",
+            "",
+            "Chats with the same JARVIS used by Tower web chat and the BLI Slack DM.",
+            "--as selects the existing website person space; it changes who the chat is about, never who is authenticated.",
+            "--date <YYYY-MM-DD> binds the page that was live on one of that person's days (`today` and `yesterday` work too), so the turn is about that day's page instead of the newest one. A day with nothing compiled binds no page and JARVIS says so rather than answering from a different day.",
+            "--model <key> requests one provider:model pair (e.g. openai:gpt-5.6-terra); an unrecognised key is refused by the dashboard, not this command.",
+            "--image <path> (alias --file) attaches one local PNG, JPEG, or WEBP under 10 MB with the question, the same one-image gate the JARVIS panel uses. A bad path, an unsupported type, or an oversized file is refused with its own plain sentence — never a stack trace.",
+            "Run with no question for an interactive terminal conversation.",
+            "Agents can pass --prompt, positional text, or pipe one question on stdin.",
+            "Each answer prints a per-tool trace line and, only on a fallback or model mismatch, one model receipt line.",
+            "Trace lines arrive live while JARVIS works; pass --no-stream to wait for the whole answer in one piece instead.",
+            "--json writes one machine-readable response (including trace and model) to stdout; operational metadata stays on stderr. A --json run never streams fragments, whichever mode it is in.",
+            "A --json turn is treated as an AGENT surface: if it proposes a coding task, JARVIS answers with proposal_id and NOT the eight-character approval code, because a code a program can read is a code it could approve with. The person fetches the code themself — a Tower browser tab, their Slack DM, or an interactive `cockpit jarvis` — and hands it back. Pass --show-approval-code when a script really is driving a dispatch for a person; the run says on stderr that it did.",
+            "That object carries answer, sources (the Source: lines inside it), turn_id (pass it to --trace), thread_id (pass it to --thread), proposal_id, next_action, degraded and degraded_reasons — the SAME shape the bli-tower MCP server's jarvis_ask tool returns, so a script and an agent read one contract. reply/thread/traceId/model/trace/latency are still there beside it and still mean what they always meant.",
+            "proposal_id carries the coding-arm proposal a turn made, and is null when it made none — including when the arm refused. next_action is the sentence that says which of those it was and what a PERSON has to do about it: fetch the approval code for that proposal (a Tower tab, their Slack DM, or their own interactive `cockpit jarvis`), or approve a refused one where a person reads. A null proposal_id is never on its own. Do not send a proposal_id back on a --json turn: this is the surface the code was withheld from, and reading it back is refused here.",
+            "A turn that outlives the dashboard's own ceiling is reported as turn_timed_out — an incomplete answer is never printed as a finished one.",
+            "The command uses the existing paired device identity. It cannot override the caller, team, role, or person scope.",
+            "A thread is SINGLE-WRITER: two turns in the same conversation at the same time can read each other, and one can answer the other's question. Your own terminal is one conversation, named main, and stays that way. A --json turn is a program's, so it gets a FRESH conversation per call unless --thread names one, and the answer's thread_id is the name it used — pass that back with --thread to continue it deliberately. On a --json turn, --thread main asks for the shared default nobody chose, so it is treated as naming nothing and a fresh conversation is minted anyway.",
+            "--threads lists the terminal conversations on this account; --thread <name> --history replays one (the newest --limit <n> messages). The per-call conversations a --json turn minted are counted rather than listed, and any one of them still replays by name. Neither takes a question, and neither can reach anybody else's conversations.",
+            "--trace <id|last> prints the step tree of one turn — every model step, tool call and server-side memory step, with how long each took, which model ran it, the tokens it spent and what failed. `last` opens the turn this machine asked most recently. Like --threads it takes no question and reaches no model.",
+            "Run `cockpit login` first if this machine is not paired.",
+        ],
+    ],
+    [
+        "models",
+        [
+            "Usage: cockpit models [list|show <provider:model>|compare <id> <id> [...]] [--highlight] [--dashboard-url <url>] [--json]",
+            "",
+            "The model-card shelf: one card per model, with what the PROVIDER documents (context",
+            "window, max output, price per million, reasoning modes, tool calling, structured output,",
+            "quirks) beside what OUR machine measured (latency p50/p95, observed tokens/s, the last",
+            "belt and conformance probe verdicts).",
+            "Every value carries the page it was read from; a field the provider does not state reads",
+            "unknown with the reason, never a guess.",
+            "STALE:<field> means a measurement contradicted the documentation — reasoning-off refused",
+            "where the card says it can be turned off, the belt refused where the card says tool",
+            "calling. The line under it is the command that re-reads the provider.",
+            "compare puts two to four cards side by side: the same rows the page at /settings/models/",
+            "compare renders, including `$ per 100 JARVIS turns` (our own measured tokens a turn times",
+            "the provider's price, with the window it was measured over beside it — `not measured`",
+            "where no profile exists, never a per-million price relabelled) and the bench row, which",
+            "appears only when every model was judged in the SAME run against the SAME baseline;",
+            "otherwise it says `benched separately — not a head-to-head` rather than subtracting two",
+            "win rates. --highlight marks the winner in each scored row (lowest wins on price and",
+            "latency, highest on tokens/s, most wins on the bench); a row where any column is `—` or",
+            "`not measured` is not scored at all, and says why.",
+            "`cockpit models` is the SHELF; `cockpit model` is the org setting saying which model a",
+            "slot runs on. Different nouns, one letter apart, on purpose.",
+            "--json writes one object to stdout; operational lines stay on stderr.",
+            "Run `cockpit login` first if this machine is not paired.",
+        ],
+    ],
+    [
+        "scout",
+        [
+            "Usage: cockpit scout [board|start|dismiss|undo <experiment-id>] [--days <n>] [--dashboard-url <url>] [--json]",
+            "",
+            "Prints the same Scout board the Tower page shows, in the same words: the standing",
+            "watch line, the cards waiting on a decision, and the raw signal watch underneath.",
+            "This is the board itself. To ask a QUESTION about it — what it means, whether it is",
+            "worth doing here — use `cockpit jarvis`, whose readScout tool reads the same rows.",
+            "`cockpit scout board` and a bare `cockpit scout` are the same command; the MCP twin",
+            "is `scout_board` on the bli-tower server, over the same GET /api/cockpit/scout door.",
+            "--days <n> widens or narrows the window (1 to 90; the board defaults to 14).",
+            "Reading follows the Scout page audience setting, so whoever can open /scout can run this.",
+            "start, dismiss, and undo move one card and are super_admin actions on every surface;",
+            "a refusal is printed as Tower worded it and the board stays readable underneath.",
+            "The id can be the first 6 or more characters printed beside each card; an ambiguous",
+            "prefix is refused with the candidates rather than acting on the first match.",
+            "--json writes one object to stdout; operational lines stay on stderr.",
+            "Run `cockpit login` first if this machine is not paired.",
+        ],
+    ],
+    [
+        "ops",
+        [
+            "Usage: cockpit ops [status [--job <id>] [--coverage] [--skips] [--memory [--memory-days N]] [--models] [--turns] [--tool-router] | recompile --person <email|name|id> [--dry-run]] [--json]",
+            "",
+            "  cockpit ops status",
+            "      One line per scheduled job: when it last produced something, and whether that",
+            "      is late FOR THAT JOB. A once-daily job quiet for 18 hours reads ok; a",
+            "      quarter-hourly one does not. Every line names the schedule it is judged against.",
+            "      --turns adds 30-day JARVIS turn aggregates; --tool-router adds the shadow-router agreement board.",
+            "      A job that is not ok also prints what its artifact does and does not prove —",
+            "      several only write a row when there is something new, so quiet can mean a quiet",
+            "      week rather than a broken cron.",
+            "      --job <id> asks about one; --skips adds the open Slack and external-sync skips,",
+            "      grouped by reason. Exits 1 if anything is stale, empty or unreadable.",
+            "      --coverage is the collection-coverage row on its own, with the BUCKET table:",
+            "      which bucket the missing sessions are in (staged-not-committed with the upload",
+            "      ledger's own reason, still pending upload, deliberately withheld, or no row at",
+            "      all), whose machines they are on, which of their own days, and what to run for",
+            "      each. That table also prints on the ordinary board whenever anything is missing.",
+            "      Every machine's line also carries its BLI Memory column — whether the MCP",
+            "      servers and the recall/save hooks are registered for Claude Code and Codex,",
+            "      and whether Codex has been told to TRUST its hooks. That column never colours",
+            "      a machine: a laptop with no memory hooks is still collecting sessions.",
+            "      --memory adds the adoption gauge: memories saved per person per day for the",
+            "      last 7 days, split by source (an agent calling save_memory, the Stop hook, or",
+            "      the vendor import, which is a backfill and never counted as use).",
+            "      --memory-days N changes the window (1-30) and implies --memory. Searches are",
+            "      NOT counted — nothing in Tower records one, and the gauge says so rather than",
+            "      printing a zero you would read as nobody searching.",
+            "      It also shows ordinary prompt-hook observations: outcome counts, 100 ms",
+            "      duration bounds, actual vector-cache reuse and named coverage gaps. These",
+            "      are hook-body timings, not full host wait or retrieval-quality scores.",
+            "  cockpit ops recompile --person <email|name|id> [--dry-run]",
+            "      Writes that person's page again, now. Your own page is always yours to",
+            "      recompile; somebody else's is for the people who read across the team.",
+            "      --dry-run resolves the person and says which page is being served, compiling",
+            "      nothing. A compile only ever ADDS a version — nothing is overwritten.",
+            "      It can take minutes, and if Tower's 800-second budget runs out first you are",
+            "      told exactly that: the compile may still have finished. Check with",
+            "      `cockpit brief --for <person>`.",
+            "      There is no --cadence: the compile path behind this writes a daily, and a flag",
+            "      that was accepted and dropped would be worse than no flag.",
+        ],
+    ],
+];

package/dist/commands/local-help-commands-tower.js

@@ -42,7 +42,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "docs",
         [
-            "Usage: cockpit docs [list|tree|read <id|slug> [<id|slug>...]|read --parent <id> --bodies|create|update <id>|link <id|slug> <notion-page>|sync-status [<id|slug>]] [flags]",
+            "Usage: cockpit docs [list|tree|read <id|slug> [<id|slug>...]|read --parent <id> --bodies|create|update <id>|delete <id|slug> [<id|slug>...]|link <id|slug> <notion-page>|sync-status [<id|slug>]] [flags]",
             "",
             "The Tower document library, typed. Bare `cockpit docs` lists every document you may read.",
             "list [--parent <id>|root] [--query <text> [--word]] [--limit <n>] — every document you may see: id, visibility, body size, slug, title. Metadata only — a list never carries a body, so it stays cheap enough for an agent to call (--json was 604 KB for 155 documents before BLI-3737, and is now a few tens of KB). --json shape: { documents: [{ id, slug, title, visibility, parent_id, source, updated_at, body_chars }] }.",
@@ -59,6 +59,7 @@ export const TOWER_COMMAND_HELP = [
             "create --title \"<title>\" [--parent <id>] [--visibility org|private] [--file <path>|--body-stdin] — the body comes from --file, or stdin (`cat body.md | cockpit docs create --title \"...\"`); neither means an empty body, matching the browser's own default. --json shape: { document }.",
             "update <id|slug> [--title \"<t>\"] [--visibility org|private] [--parent <id>|--clear-parent] [--file <path>|--body-stdin] [--allow-empty] — only the fields you pass change; a `--parent` change IS a move, there is no separate move verb. --json shape: { document }.",
             "  --allow-empty clears the page on purpose. A body that would empty a document that holds text is refused (refused_empty_body) unless you say so, because far more often it is a surface that lost the content than a person who meant it.",
+            "delete <id|slug> [<id|slug>...] — soft-deletes one or more documents (BLI-10555): the browser's own delete, sets deleted_at, never a real SQL DELETE. Recoverable — only a super_admin clearing deleted_at brings it back, there is no self-service undo. Deleting a parent does NOT delete its children; they keep their own parent_id and stay exactly where they were. Several refs resolve against ONE shared list call, then one DELETE each — one bad ref never loses the rest. --json shape: one ref answers { ok, document_id }; several answer { documents: [{ ref, ok, document_id } | { ref, ok: false, error, detail }] }.",
             "link <id|slug> <notion-url|page-id> — ties the document to a Notion page so the two-way sync moves it both ways. The page is the truth from then on: the next sync pulls it over this copy and keeps the copy as a version. `link <id|slug> --clear` unties it. Refusals: invalid_notion_page, notion_page_already_linked, document_not_writable.",
             "sync-status [<id|slug>] — every linked document's Notion sync state, or one's: synced (the body is what both sides last agreed on), tower_changed (edited here since; the next write-back pushes it), never_synced (linked, no baseline yet). Tower's half only: a Notion edit shows up at the next pull, not here. Metadata only, never a body.",
             "A document body is never accepted on the command line — --file (safest on Windows) or a pipe only, same discipline as `cockpit notes paste`.",
@@ -216,4 +217,185 @@ export const TOWER_COMMAND_HELP = [
             "The command uses the existing paired device identity. Run `cockpit login` first if this machine is not paired.",
         ],
     ],
+    [
+        "slack",
+        [
+            "Usage: cockpit slack [coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [filters] [--format compact|full]] [--json]",
+            "",
+            "  cockpit slack coverage",
+            "      What Cockpit's Slack bot can see: how many channels it is in, what each",
+            "      visibility state means, which cursors have not moved, and which ingest skips",
+            "      are open. No message text at all, so anybody signed in can run it.",
+            "      This is the command that tells an empty search apart from a coverage gap.",
+            "      --stale-only drops the per-state breakdown and shows just what is behind.",
+            "      --list names every channel and its readable state — counts alone could not",
+            "      answer \"is there a Kaiben channel?\". --json's shape: { coverage: { workspaces: [",
+            "      { workspace, channelsKnown, covered, byVisibility, staleChannels, openSkips,",
+            "      channels? } ] } } — channels is present only with --list.",
+            "  cockpit slack read --person <p> | --channel <c> | --query <text> [--word]",
+            "      The messages themselves, through the same reader JARVIS uses. At least one",
+            "      filter is required. --since/--until are YYYY-MM-DD; --limit caps the rows.",
+            "      --query matches a substring; add --word to match whole words, so `excel`",
+            "      stops matching \"Excellent\".",
+            "      Reading Slack reads across the team, so this is for the people who do that",
+            "      job; being refused it never costs you `cockpit slack coverage`.",
+            "      An empty or partial answer prints Tower's own sentence about WHY, word for",
+            "      word — none of those reasons means nothing was said.",
+            "      --format full (default): each message as its own block (channel/author/time,",
+            "      text, permalink). --format compact: one line per message. Always one rendering,",
+            "      never both — a result used to print as a summary AND as blocks (BLI-10450).",
+            "      --json's shape: { result: { status, reason, messages: [...], coverage, note } }.",
+        ],
+    ],
+    [
+        "workbook",
+        [
+            "Usage: cockpit workbook [<project> [<doc>]] [--section <id>] [--markdown] [--width <n>] [--dashboard-url <url>] [--json]",
+            "",
+            "Reads the Tower workbook library: written project documents — workbooks, runbooks —",
+            "each with an author and a date. With no arguments it lists every compartment and the",
+            "command that opens each document.",
+            "`cockpit workbook tower` lists one project's shelf; `cockpit workbook tower workbook`",
+            "prints that document as wrapped plain text.",
+            "--section <id> prints one section, named by the anchors listed with the document.",
+            "--markdown prints the server's Markdown unchanged, for piping into anything else.",
+            "--width <n> sets the wrap column; otherwise the terminal's width is used, held between 60 and 100.",
+            "There is no pager: pipe it into one if you want paging.",
+            "Sign-in is the only gate, exactly as on the website page.",
+            "Run `cockpit login` first if this machine is not paired.",
+        ],
+    ],
+    [
+        "brief",
+        [
+            "Usage: cockpit brief [done <item>|undone <item>|edit|rewrite|history] [--for <person>] [--date <YYYY-MM-DD>] [--delta [--against <YYYY-MM-DD>]] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--days <n>] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
+            "",
+            "Prints the TODAY page — the same page the Tower website shows, rendered for a terminal.",
+            "--for opens somebody else's page; the website's own rule decides whether you may, and it refuses in plain words when you may not.",
+            "--tldr prints the ten-second version; the whole page is the default.",
+            "--version <pageId> steps back to one exact earlier version; --versions lists them with their ids.",
+            "--claims prints the [claimId] beside every line, which is what `cockpit correct --claim` takes.",
+            "Reading it here counts as opening it, exactly as opening it in a browser does.",
+            "",
+            "--date <YYYY-MM-DD> reads the page that was live on one day — `today` and `yesterday` work too. Days are that person's own days, in their own timezone, so a page always sits on the date its own masthead says.",
+            "  A day with nothing compiled says so by name, and says which day is nearest. It never quietly hands you a different day's page.",
+            "--delta says what changed between that day and the day before it, in the same words the website's version history uses. --against <day> compares against a day you name instead.",
+            "  Comparisons that skip versions are worked out fresh each time and say `(not kept)` — a day with several compiles is one of those.",
+            "",
+            "history — the days there are, newest first, each with its masthead line and how many times it compiled that day. --days <n> asks for more than the last 14.",
+            "  Pass any date it prints back to `--date`.",
+            "",
+            "  cockpit brief status [--who <person>] [--render]",
+            "      Why your brief did or did not arrive this morning — one reason, from the same",
+            "      chain the Slack DM cron itself follows: not_due, not_monday, not_the_1st,",
+            "      no_page, page_stale, no_slack_identity, engagement_write_failed, delivered.",
+            "      It shows your delivery window, which cadence owns this morning, whether a",
+            "      Slack identity is on record, and the delivered/opened/clicked receipts.",
+            "      --render adds the TLDR the DM would have carried.",
+            "      --who <person> asks about somebody else and is for the people who read across",
+            "      the team. Exits 0 only on `delivered`.",
+            "edit — opens the page in $VISUAL/$EDITOR as a document: one [claimId] line per sentence you may rewrite, everything else a # comment. Change the words after an id, save, close. Only the lines that really changed are sent, so an accidental save writes nothing.",
+            "  An id you delete or invent is refused by name BEFORE anything is sent: a missing line reads as no opinion at all, not as a sentence to remove, and Tower cannot tell those apart.",
+            "  --reason \"<why>\" rides on every row, exactly like a commit message. Optional; the before-and-after already teaches on its own.",
+            "  With no editor, or with something piped in, the edited document is read from stdin instead — `cockpit brief edit < page.md`.",
+            "  The edit IS the correction: each changed line is filed in the ledger before the page is republished, so a publish that falls over never costs you the edit.",
+            "",
+            "done <item> / undone <item>, tick one DO THIS FIRST row off, or put it back. The same checkbox the website's board has, on the same record.",
+            "  <item> is the ticket exactly as the board writes it (BLI-3511), or a claim id from `cockpit brief --claims` for a row with no ticket behind it.",
+            "  A ticked row prints as [x] and says `done`; everything still open prints as [ ]. A ticket keeps its tick across every recompile, so what you finished stays finished.",
+            "  An item that is not on your page is named before anything is sent, and nothing is recorded.",
+            "  Your own board only: a tick is your working state, so there is no --for here.",
+            "",
+            "rewrite — asks Tower to compile the page again and waits for the new version. Writing a page takes minutes, so this queues the work and watches your page rather than holding one long request open.",
+            "  --no-wait returns as soon as the ask is on the record. Waiting is the default.",
+            "  Running out of patience is not a failure and says so: the work is still going, and `cockpit brief` will show it when it lands.",
+            "  Whose page you may ask about is the website's own rule — your own always, anybody's if you are an admin.",
+            "The command uses the existing paired device identity. Run `cockpit login` first if this machine is not paired.",
+        ],
+    ],
+    [
+        "notes",
+        [
+            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>] [flags]",
+            "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 4 MB. --wait polls transcription for at most 330 seconds.",
+            "",
+            "folders [--tree] [--json]: list folders and visible note counts.",
+            "mkdir <path> [--json]: create a folder and any missing ancestors.",
+            "rename <path> --name <name> [--json]: rename a folder and its descendant paths.",
+            "rmdir <path> [--json]: delete an empty folder; refuses notes or subfolders.",
+            "upload, paste and move accept --folder <path>; use / for Root. Shelf placement stays independent.",
+            "The /meeting-notes surface, typed. Bare `cockpit notes` lists the library.",
+            "list [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] — every note you may open, grouped by shelf, newest meeting first. Never a word of a note.",
+            "show <id> — one note with its text, its shelf, and why you are allowed to see it.",
+            "shelf [--limit <n>] — the notes YOU have put in, and what became of each.",
+            "shelves — the shelves in use, with how many notes are on each.",
+            "upload <paths...> [--exclude \"<sentence>\"] — put one or more local files in. Explicit paths only; your shell does any globbing, and a file that does not exist is named rather than skipped.",
+            "paste [--file <path>] [--name <n>] [--exclude \"<sentence>\"] — put text in. --file <path> is safest (any editor encoding is decoded). Stdin works too: `pbpaste | cockpit notes paste` on macOS; on Windows use PowerShell 7 (`Get-Clipboard | cockpit notes paste`) — PowerShell 5.1 turns non-ASCII into `?` on pipes.",
+            "--exclude carries your own sentence about what to leave out, exactly as the browser's box does.",
+            "share <id> [--yes] — let everyone signed in read the statements that are safe to share. Asks first in a terminal; --yes is required without one, and --json implies --yes.",
+            "unshare <id> — take it back. Never asks: it only ever narrows who can read.",
+            "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
+            "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
+            "",
+            "Your own notetaker (BLI-4383). Fellow and Circleback today; Otter needs an Enterprise plan and Granola still runs on its own cron.",
+            "accounts [--json] — the notetakers you have connected, with health and when each was last read.",
+            "accounts --show-webhook <account-id> — that account's webhook URL, where to paste it at the vendor, and whether a signing secret is stored (BLI-4394). Until one is, every request to that URL is refused, which is the right way to be off.",
+            "webhook <account-id> --secret-stdin — store the VENDOR's webhook signing secret. THE SECRET IS READ FROM STDIN, never a flag: printf \"%s\" \"<signing secret>\" | cockpit notes webhook <account-id> --secret-stdin",
+            "connect --provider fellow|circleback [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
+            "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
+            "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
+            "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
+            "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
+            "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",
+            "The command uses the existing paired device identity. Run `cockpit login` first if this machine is not paired.",
+        ],
+    ],
+    [
+        "memory",
+        [
+            "Usage: cockpit memory [search|save|update|forget|profile|consolidation|requeue|install|status|log] [flags]",
+            "",
+            "The STORE, over the same /api/memory/* doors the bli-memory MCP server calls:",
+            "  search \"<question>\" [--container <tag>] [--limit 1..20] [--no-recent]",
+            "      repeat --container to search more than one space; omit it for this repository's own.",
+            "      --limit caps the memories (default 5); up to 3 Tower pages and tickets ride beside",
+            "      them whatever it says. For more Tower rows, use `cockpit search`.",
+            "  save [--container <tag>] [--custom-id <id>] [--extract] [--file <path>]",
+            "      the memory comes from stdin or --file, never from the command line:",
+            "      `echo \"Edward decided X on 2026-09-10\" | cockpit memory save`.",
+            "      --custom-id makes a repeat save update instead of duplicating;",
+            "      --extract distils atomic facts first (one model call) instead of storing as given.",
+            "  update <id> [--file <path>]   replacement text on stdin; the old row is kept as history.",
+            "  forget <id> [--reason <label>]",
+            "  forget --content-stdin --container <tag> [--reason <label>]   forget by exact text.",
+            "  profile [--container <tag>]   the compiled one-page briefing; a read, never a compile.",
+            "  consolidation [--container <tag>]   what the nightly tidy-up pass did.",
+            "      Clusters looked at, edits by verb, refusals by reason, model and cost.",
+            "      Read-only: the pass is a nightly cron, it never deletes a memory, and",
+            "      report mode changes nothing on the shelf at all.",
+            "  requeue --since <iso> [--until <iso>] [--source hook|harvest] [--reason <label>] [--apply]",
+            "      puts finished extractions back in the queue after the store refused their",
+            "      writes. Super admins only. A DRY RUN unless you pass --apply, because an",
+            "      apply re-runs one model call per receipt. Nothing is ever deleted: each",
+            "      row keeps its previous outcome under result.requeued_from.",
+            "Refusals keep the door's own label — needs_rls_client, unknown_memory,",
+            "already_superseded, no_match — and --json prints the door's answer unchanged.",
+            "",
+            "BARE `cockpit memory` PRINTS THIS LIST AND DOES NOTHING ELSE (BLI-4047).",
+            "It used to run the installer; installing is now `cockpit memory install`.",
+            "",
+            "install/status register BLI Memory on this machine: the `bli-memory` MCP server plus the",
+            "recall/save hooks, for Claude Code (~/.claude.json, ~/.claude/settings.json)",
+            "and for Codex (~/.codex/config.toml, ~/.codex/skills/bli-memory/).",
+            "Idempotent: it merges with what is already there, never duplicates its own",
+            "entries, and reads the stored config back before reporting success.",
+            "`cockpit doctor` runs it, and the sync tick re-runs it at most once a day.",
+            "See docs/runbooks/bli-memory-install.md.",
+            "log appends an opinion to ~/.codex/AGENT-EXPERIENCE.md and posts it to Tower.",
+            "Use --reason-stdin instead of a quoted reason; --json reports shipped status.",
+            "Reasons: one line, max 500 characters; no prompts, memory bodies or secrets.",
+            "Markers: [bli] = BLI Memory, ◪ = Supermemory, [bli]+◪ = both.",
+            "Offline entries stay queued; the next collector sync retries with the same ID.",
+        ],
+    ],
 ];

package/dist/commands/local-help-commands.js

@@ -19,6 +19,7 @@
 import { DEFAULT_DASHBOARD_URL } from "../local-state.js";
 import { localCommandHelp, SURFACE_ALIASES } from "./local-help.js";
 import { TOWER_COMMAND_HELP } from "./local-help-commands-tower.js";
+import { TOWER_OPS_COMMAND_HELP } from "./local-help-commands-tower-ops.js";
 export function localSubcommandHelp(command) {
     const helpByCommand = new Map([
         ["roots", ["Usage: cockpit roots add <dir> [--allow-home-root] [--json]", "Approves a work directory, saves an approval receipt, and adds it to collection. Run cockpit doctor afterward."]],
@@ -248,260 +249,9 @@ export function localSubcommandHelp(command) {
                 "`--repo <path>` remains supported as a backward-compatible alias.",
             ],
         ],
-        [
-            "jarvis",
-            [
-                "Usage: cockpit jarvis [question] [--prompt <question>] [--as <person>] [--date <YYYY-MM-DD>] [--thread <name>] [--model <key>] [--image <path>|--file <path>] [--no-stream] [--threads|--history [--limit <n>]] [--trace <id|last>] [--dashboard-url <url>] [--json [--show-approval-code]]",
-                "",
-                "Chats with the same JARVIS used by Tower web chat and the BLI Slack DM.",
-                "--as selects the existing website person space; it changes who the chat is about, never who is authenticated.",
-                "--date <YYYY-MM-DD> binds the page that was live on one of that person's days (`today` and `yesterday` work too), so the turn is about that day's page instead of the newest one. A day with nothing compiled binds no page and JARVIS says so rather than answering from a different day.",
-                "--model <key> requests one provider:model pair (e.g. openai:gpt-5.6-terra); an unrecognised key is refused by the dashboard, not this command.",
-                "--image <path> (alias --file) attaches one local PNG, JPEG, or WEBP under 10 MB with the question, the same one-image gate the JARVIS panel uses. A bad path, an unsupported type, or an oversized file is refused with its own plain sentence — never a stack trace.",
-                "Run with no question for an interactive terminal conversation.",
-                "Agents can pass --prompt, positional text, or pipe one question on stdin.",
-                "Each answer prints a per-tool trace line and, only on a fallback or model mismatch, one model receipt line.",
-                "Trace lines arrive live while JARVIS works; pass --no-stream to wait for the whole answer in one piece instead.",
-                "--json writes one machine-readable response (including trace and model) to stdout; operational metadata stays on stderr. A --json run never streams fragments, whichever mode it is in.",
-                "A --json turn is treated as an AGENT surface: if it proposes a coding task, JARVIS answers with proposal_id and NOT the eight-character approval code, because a code a program can read is a code it could approve with. The person fetches the code themself — a Tower browser tab, their Slack DM, or an interactive `cockpit jarvis` — and hands it back. Pass --show-approval-code when a script really is driving a dispatch for a person; the run says on stderr that it did.",
-                "That object carries answer, sources (the Source: lines inside it), turn_id (pass it to --trace), thread_id (pass it to --thread), proposal_id, next_action, degraded and degraded_reasons — the SAME shape the bli-tower MCP server's jarvis_ask tool returns, so a script and an agent read one contract. reply/thread/traceId/model/trace/latency are still there beside it and still mean what they always meant.",
-                "proposal_id carries the coding-arm proposal a turn made, and is null when it made none — including when the arm refused. next_action is the sentence that says which of those it was and what a PERSON has to do about it: fetch the approval code for that proposal (a Tower tab, their Slack DM, or their own interactive `cockpit jarvis`), or approve a refused one where a person reads. A null proposal_id is never on its own. Do not send a proposal_id back on a --json turn: this is the surface the code was withheld from, and reading it back is refused here.",
-                "A turn that outlives the dashboard's own ceiling is reported as turn_timed_out — an incomplete answer is never printed as a finished one.",
-                "The command uses the existing paired device identity. It cannot override the caller, team, role, or person scope.",
-                "A thread is SINGLE-WRITER: two turns in the same conversation at the same time can read each other, and one can answer the other's question. Your own terminal is one conversation, named main, and stays that way. A --json turn is a program's, so it gets a FRESH conversation per call unless --thread names one, and the answer's thread_id is the name it used — pass that back with --thread to continue it deliberately. On a --json turn, --thread main asks for the shared default nobody chose, so it is treated as naming nothing and a fresh conversation is minted anyway.",
-                "--threads lists the terminal conversations on this account; --thread <name> --history replays one (the newest --limit <n> messages). The per-call conversations a --json turn minted are counted rather than listed, and any one of them still replays by name. Neither takes a question, and neither can reach anybody else's conversations.",
-                "--trace <id|last> prints the step tree of one turn — every model step, tool call and server-side memory step, with how long each took, which model ran it, the tokens it spent and what failed. `last` opens the turn this machine asked most recently. Like --threads it takes no question and reaches no model.",
-                "Run `cockpit login` first if this machine is not paired.",
-            ],
-        ],
-        [
-            "models",
-            [
-                "Usage: cockpit models [list|show <provider:model>|compare <id> <id> [...]] [--highlight] [--dashboard-url <url>] [--json]",
-                "",
-                "The model-card shelf: one card per model, with what the PROVIDER documents (context",
-                "window, max output, price per million, reasoning modes, tool calling, structured output,",
-                "quirks) beside what OUR machine measured (latency p50/p95, observed tokens/s, the last",
-                "belt and conformance probe verdicts).",
-                "Every value carries the page it was read from; a field the provider does not state reads",
-                "unknown with the reason, never a guess.",
-                "STALE:<field> means a measurement contradicted the documentation — reasoning-off refused",
-                "where the card says it can be turned off, the belt refused where the card says tool",
-                "calling. The line under it is the command that re-reads the provider.",
-                "compare puts two to four cards side by side: the same rows the page at /settings/models/",
-                "compare renders, including `$ per 100 JARVIS turns` (our own measured tokens a turn times",
-                "the provider's price, with the window it was measured over beside it — `not measured`",
-                "where no profile exists, never a per-million price relabelled) and the bench row, which",
-                "appears only when every model was judged in the SAME run against the SAME baseline;",
-                "otherwise it says `benched separately — not a head-to-head` rather than subtracting two",
-                "win rates. --highlight marks the winner in each scored row (lowest wins on price and",
-                "latency, highest on tokens/s, most wins on the bench); a row where any column is `—` or",
-                "`not measured` is not scored at all, and says why.",
-                "`cockpit models` is the SHELF; `cockpit model` is the org setting saying which model a",
-                "slot runs on. Different nouns, one letter apart, on purpose.",
-                "--json writes one object to stdout; operational lines stay on stderr.",
-                "Run `cockpit login` first if this machine is not paired.",
-            ],
-        ],
-        [
-            "scout",
-            [
-                "Usage: cockpit scout [board|start|dismiss|undo <experiment-id>] [--days <n>] [--dashboard-url <url>] [--json]",
-                "",
-                "Prints the same Scout board the Tower page shows, in the same words: the standing",
-                "watch line, the cards waiting on a decision, and the raw signal watch underneath.",
-                "This is the board itself. To ask a QUESTION about it — what it means, whether it is",
-                "worth doing here — use `cockpit jarvis`, whose readScout tool reads the same rows.",
-                "`cockpit scout board` and a bare `cockpit scout` are the same command; the MCP twin",
-                "is `scout_board` on the bli-tower server, over the same GET /api/cockpit/scout door.",
-                "--days <n> widens or narrows the window (1 to 90; the board defaults to 14).",
-                "Reading follows the Scout page audience setting, so whoever can open /scout can run this.",
-                "start, dismiss, and undo move one card and are super_admin actions on every surface;",
-                "a refusal is printed as Tower worded it and the board stays readable underneath.",
-                "The id can be the first 6 or more characters printed beside each card; an ambiguous",
-                "prefix is refused with the candidates rather than acting on the first match.",
-                "--json writes one object to stdout; operational lines stay on stderr.",
-                "Run `cockpit login` first if this machine is not paired.",
-            ],
-        ],
-        [
-            "ops",
-            [
-                "Usage: cockpit ops [status [--job <id>] [--coverage] [--skips] [--memory [--memory-days N]] [--models] [--turns] [--tool-router] | recompile --person <email|name|id> [--dry-run]] [--json]",
-                "",
-                "  cockpit ops status",
-                "      One line per scheduled job: when it last produced something, and whether that",
-                "      is late FOR THAT JOB. A once-daily job quiet for 18 hours reads ok; a",
-                "      quarter-hourly one does not. Every line names the schedule it is judged against.",
-                "      --turns adds 30-day JARVIS turn aggregates; --tool-router adds the shadow-router agreement board.",
-                "      A job that is not ok also prints what its artifact does and does not prove —",
-                "      several only write a row when there is something new, so quiet can mean a quiet",
-                "      week rather than a broken cron.",
-                "      --job <id> asks about one; --skips adds the open Slack and external-sync skips,",
-                "      grouped by reason. Exits 1 if anything is stale, empty or unreadable.",
-                "      --coverage is the collection-coverage row on its own, with the BUCKET table:",
-                "      which bucket the missing sessions are in (staged-not-committed with the upload",
-                "      ledger's own reason, still pending upload, deliberately withheld, or no row at",
-                "      all), whose machines they are on, which of their own days, and what to run for",
-                "      each. That table also prints on the ordinary board whenever anything is missing.",
-                "      Every machine's line also carries its BLI Memory column — whether the MCP",
-                "      servers and the recall/save hooks are registered for Claude Code and Codex,",
-                "      and whether Codex has been told to TRUST its hooks. That column never colours",
-                "      a machine: a laptop with no memory hooks is still collecting sessions.",
-                "      --memory adds the adoption gauge: memories saved per person per day for the",
-                "      last 7 days, split by source (an agent calling save_memory, the Stop hook, or",
-                "      the vendor import, which is a backfill and never counted as use).",
-                "      --memory-days N changes the window (1-30) and implies --memory. Searches are",
-                "      NOT counted — nothing in Tower records one, and the gauge says so rather than",
-                "      printing a zero you would read as nobody searching.",
-                "      It also shows ordinary prompt-hook observations: outcome counts, 100 ms",
-                "      duration bounds, actual vector-cache reuse and named coverage gaps. These",
-                "      are hook-body timings, not full host wait or retrieval-quality scores.",
-                "  cockpit ops recompile --person <email|name|id> [--dry-run]",
-                "      Writes that person's page again, now. Your own page is always yours to",
-                "      recompile; somebody else's is for the people who read across the team.",
-                "      --dry-run resolves the person and says which page is being served, compiling",
-                "      nothing. A compile only ever ADDS a version — nothing is overwritten.",
-                "      It can take minutes, and if Tower's 800-second budget runs out first you are",
-                "      told exactly that: the compile may still have finished. Check with",
-                "      `cockpit brief --for <person>`.",
-                "      There is no --cadence: the compile path behind this writes a daily, and a flag",
-                "      that was accepted and dropped would be worse than no flag.",
-            ],
-        ],
-        [
-            "slack",
-            [
-                "Usage: cockpit slack [coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [filters] [--format compact|full]] [--json]",
-                "",
-                "  cockpit slack coverage",
-                "      What Cockpit's Slack bot can see: how many channels it is in, what each",
-                "      visibility state means, which cursors have not moved, and which ingest skips",
-                "      are open. No message text at all, so anybody signed in can run it.",
-                "      This is the command that tells an empty search apart from a coverage gap.",
-                "      --stale-only drops the per-state breakdown and shows just what is behind.",
-                "      --list names every channel and its readable state — counts alone could not",
-                "      answer \"is there a Kaiben channel?\". --json's shape: { coverage: { workspaces: [",
-                "      { workspace, channelsKnown, covered, byVisibility, staleChannels, openSkips,",
-                "      channels? } ] } } — channels is present only with --list.",
-                "  cockpit slack read --person <p> | --channel <c> | --query <text> [--word]",
-                "      The messages themselves, through the same reader JARVIS uses. At least one",
-                "      filter is required. --since/--until are YYYY-MM-DD; --limit caps the rows.",
-                "      --query matches a substring; add --word to match whole words, so `excel`",
-                "      stops matching \"Excellent\".",
-                "      Reading Slack reads across the team, so this is for the people who do that",
-                "      job; being refused it never costs you `cockpit slack coverage`.",
-                "      An empty or partial answer prints Tower's own sentence about WHY, word for",
-                "      word — none of those reasons means nothing was said.",
-                "      --format full (default): each message as its own block (channel/author/time,",
-                "      text, permalink). --format compact: one line per message. Always one rendering,",
-                "      never both — a result used to print as a summary AND as blocks (BLI-10450).",
-                "      --json's shape: { result: { status, reason, messages: [...], coverage, note } }.",
-            ],
-        ],
-        [
-            "workbook",
-            [
-                "Usage: cockpit workbook [<project> [<doc>]] [--section <id>] [--markdown] [--width <n>] [--dashboard-url <url>] [--json]",
-                "",
-                "Reads the Tower workbook library: written project documents — workbooks, runbooks —",
-                "each with an author and a date. With no arguments it lists every compartment and the",
-                "command that opens each document.",
-                "`cockpit workbook tower` lists one project's shelf; `cockpit workbook tower workbook`",
-                "prints that document as wrapped plain text.",
-                "--section <id> prints one section, named by the anchors listed with the document.",
-                "--markdown prints the server's Markdown unchanged, for piping into anything else.",
-                "--width <n> sets the wrap column; otherwise the terminal's width is used, held between 60 and 100.",
-                "There is no pager: pipe it into one if you want paging.",
-                "Sign-in is the only gate, exactly as on the website page.",
-                "Run `cockpit login` first if this machine is not paired.",
-            ],
-        ],
-        [
-            "brief",
-            [
-                "Usage: cockpit brief [done <item>|undone <item>|edit|rewrite|history] [--for <person>] [--date <YYYY-MM-DD>] [--delta [--against <YYYY-MM-DD>]] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--days <n>] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
-                "",
-                "Prints the TODAY page — the same page the Tower website shows, rendered for a terminal.",
-                "--for opens somebody else's page; the website's own rule decides whether you may, and it refuses in plain words when you may not.",
-                "--tldr prints the ten-second version; the whole page is the default.",
-                "--version <pageId> steps back to one exact earlier version; --versions lists them with their ids.",
-                "--claims prints the [claimId] beside every line, which is what `cockpit correct --claim` takes.",
-                "Reading it here counts as opening it, exactly as opening it in a browser does.",
-                "",
-                "--date <YYYY-MM-DD> reads the page that was live on one day — `today` and `yesterday` work too. Days are that person's own days, in their own timezone, so a page always sits on the date its own masthead says.",
-                "  A day with nothing compiled says so by name, and says which day is nearest. It never quietly hands you a different day's page.",
-                "--delta says what changed between that day and the day before it, in the same words the website's version history uses. --against <day> compares against a day you name instead.",
-                "  Comparisons that skip versions are worked out fresh each time and say `(not kept)` — a day with several compiles is one of those.",
-                "",
-                "history — the days there are, newest first, each with its masthead line and how many times it compiled that day. --days <n> asks for more than the last 14.",
-                "  Pass any date it prints back to `--date`.",
-                "",
-                "  cockpit brief status [--who <person>] [--render]",
-                "      Why your brief did or did not arrive this morning — one reason, from the same",
-                "      chain the Slack DM cron itself follows: not_due, not_monday, not_the_1st,",
-                "      no_page, page_stale, no_slack_identity, engagement_write_failed, delivered.",
-                "      It shows your delivery window, which cadence owns this morning, whether a",
-                "      Slack identity is on record, and the delivered/opened/clicked receipts.",
-                "      --render adds the TLDR the DM would have carried.",
-                "      --who <person> asks about somebody else and is for the people who read across",
-                "      the team. Exits 0 only on `delivered`.",
-                "edit — opens the page in $VISUAL/$EDITOR as a document: one [claimId] line per sentence you may rewrite, everything else a # comment. Change the words after an id, save, close. Only the lines that really changed are sent, so an accidental save writes nothing.",
-                "  An id you delete or invent is refused by name BEFORE anything is sent: a missing line reads as no opinion at all, not as a sentence to remove, and Tower cannot tell those apart.",
-                "  --reason \"<why>\" rides on every row, exactly like a commit message. Optional; the before-and-after already teaches on its own.",
-                "  With no editor, or with something piped in, the edited document is read from stdin instead — `cockpit brief edit < page.md`.",
-                "  The edit IS the correction: each changed line is filed in the ledger before the page is republished, so a publish that falls over never costs you the edit.",
-                "",
-                "done <item> / undone <item>, tick one DO THIS FIRST row off, or put it back. The same checkbox the website's board has, on the same record.",
-                "  <item> is the ticket exactly as the board writes it (BLI-3511), or a claim id from `cockpit brief --claims` for a row with no ticket behind it.",
-                "  A ticked row prints as [x] and says `done`; everything still open prints as [ ]. A ticket keeps its tick across every recompile, so what you finished stays finished.",
-                "  An item that is not on your page is named before anything is sent, and nothing is recorded.",
-                "  Your own board only: a tick is your working state, so there is no --for here.",
-                "",
-                "rewrite — asks Tower to compile the page again and waits for the new version. Writing a page takes minutes, so this queues the work and watches your page rather than holding one long request open.",
-                "  --no-wait returns as soon as the ask is on the record. Waiting is the default.",
-                "  Running out of patience is not a failure and says so: the work is still going, and `cockpit brief` will show it when it lands.",
-                "  Whose page you may ask about is the website's own rule — your own always, anybody's if you are an admin.",
-                "The command uses the existing paired device identity. Run `cockpit login` first if this machine is not paired.",
-            ],
-        ],
-        [
-            "notes",
-            [
-                "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>] [flags]",
-                "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 4 MB. --wait polls transcription for at most 330 seconds.",
-                "",
-                "folders [--tree] [--json]: list folders and visible note counts.",
-                "mkdir <path> [--json]: create a folder and any missing ancestors.",
-                "rename <path> --name <name> [--json]: rename a folder and its descendant paths.",
-                "rmdir <path> [--json]: delete an empty folder; refuses notes or subfolders.",
-                "upload, paste and move accept --folder <path>; use / for Root. Shelf placement stays independent.",
-                "The /meeting-notes surface, typed. Bare `cockpit notes` lists the library.",
-                "list [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] — every note you may open, grouped by shelf, newest meeting first. Never a word of a note.",
-                "show <id> — one note with its text, its shelf, and why you are allowed to see it.",
-                "shelf [--limit <n>] — the notes YOU have put in, and what became of each.",
-                "shelves — the shelves in use, with how many notes are on each.",
-                "upload <paths...> [--exclude \"<sentence>\"] — put one or more local files in. Explicit paths only; your shell does any globbing, and a file that does not exist is named rather than skipped.",
-                "paste [--file <path>] [--name <n>] [--exclude \"<sentence>\"] — put text in. --file <path> is safest (any editor encoding is decoded). Stdin works too: `pbpaste | cockpit notes paste` on macOS; on Windows use PowerShell 7 (`Get-Clipboard | cockpit notes paste`) — PowerShell 5.1 turns non-ASCII into `?` on pipes.",
-                "--exclude carries your own sentence about what to leave out, exactly as the browser's box does.",
-                "share <id> [--yes] — let everyone signed in read the statements that are safe to share. Asks first in a terminal; --yes is required without one, and --json implies --yes.",
-                "unshare <id> — take it back. Never asks: it only ever narrows who can read.",
-                "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
-                "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
-                "",
-                "Your own notetaker (BLI-4383). Fellow and Circleback today; Otter needs an Enterprise plan and Granola still runs on its own cron.",
-                "accounts [--json] — the notetakers you have connected, with health and when each was last read.",
-                "accounts --show-webhook <account-id> — that account's webhook URL, where to paste it at the vendor, and whether a signing secret is stored (BLI-4394). Until one is, every request to that URL is refused, which is the right way to be off.",
-                "webhook <account-id> --secret-stdin — store the VENDOR's webhook signing secret. THE SECRET IS READ FROM STDIN, never a flag: printf \"%s\" \"<signing secret>\" | cockpit notes webhook <account-id> --secret-stdin",
-                "connect --provider fellow|circleback [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
-                "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
-                "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
-                "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
-                "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
-                "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",
-                "The command uses the existing paired device identity. Run `cockpit login` first if this machine is not paired.",
-            ],
-        ],
+        // BLI-10445: JARVIS, models, Scout and ops live in `local-help-commands-tower-ops.ts`;
+        // slack, workbook, brief, notes and memory joined `local-help-commands-tower.ts`.
+        ...TOWER_OPS_COMMAND_HELP,
         [
             "correct",
             [
@@ -587,54 +337,6 @@ export function localSubcommandHelp(command) {
                 "Action defaults to `install`.",
             ],
         ],
-        [
-            "memory",
-            [
-                "Usage: cockpit memory [search|save|update|forget|profile|consolidation|requeue|install|status|log] [flags]",
-                "",
-                "The STORE, over the same /api/memory/* doors the bli-memory MCP server calls:",
-                "  search \"<question>\" [--container <tag>] [--limit 1..20] [--no-recent]",
-                "      repeat --container to search more than one space; omit it for this repository's own.",
-                "      --limit caps the memories (default 5); up to 3 Tower pages and tickets ride beside",
-                "      them whatever it says. For more Tower rows, use `cockpit search`.",
-                "  save [--container <tag>] [--custom-id <id>] [--extract] [--file <path>]",
-                "      the memory comes from stdin or --file, never from the command line:",
-                "      `echo \"Edward decided X on 2026-09-10\" | cockpit memory save`.",
-                "      --custom-id makes a repeat save update instead of duplicating;",
-                "      --extract distils atomic facts first (one model call) instead of storing as given.",
-                "  update <id> [--file <path>]   replacement text on stdin; the old row is kept as history.",
-                "  forget <id> [--reason <label>]",
-                "  forget --content-stdin --container <tag> [--reason <label>]   forget by exact text.",
-                "  profile [--container <tag>]   the compiled one-page briefing; a read, never a compile.",
-                "  consolidation [--container <tag>]   what the nightly tidy-up pass did.",
-                "      Clusters looked at, edits by verb, refusals by reason, model and cost.",
-                "      Read-only: the pass is a nightly cron, it never deletes a memory, and",
-                "      report mode changes nothing on the shelf at all.",
-                "  requeue --since <iso> [--until <iso>] [--source hook|harvest] [--reason <label>] [--apply]",
-                "      puts finished extractions back in the queue after the store refused their",
-                "      writes. Super admins only. A DRY RUN unless you pass --apply, because an",
-                "      apply re-runs one model call per receipt. Nothing is ever deleted: each",
-                "      row keeps its previous outcome under result.requeued_from.",
-                "Refusals keep the door's own label — needs_rls_client, unknown_memory,",
-                "already_superseded, no_match — and --json prints the door's answer unchanged.",
-                "",
-                "BARE `cockpit memory` PRINTS THIS LIST AND DOES NOTHING ELSE (BLI-4047).",
-                "It used to run the installer; installing is now `cockpit memory install`.",
-                "",
-                "install/status register BLI Memory on this machine: the `bli-memory` MCP server plus the",
-                "recall/save hooks, for Claude Code (~/.claude.json, ~/.claude/settings.json)",
-                "and for Codex (~/.codex/config.toml, ~/.codex/skills/bli-memory/).",
-                "Idempotent: it merges with what is already there, never duplicates its own",
-                "entries, and reads the stored config back before reporting success.",
-                "`cockpit doctor` runs it, and the sync tick re-runs it at most once a day.",
-                "See docs/runbooks/bli-memory-install.md.",
-                "log appends an opinion to ~/.codex/AGENT-EXPERIENCE.md and posts it to Tower.",
-                "Use --reason-stdin instead of a quoted reason; --json reports shipped status.",
-                "Reasons: one line, max 500 characters; no prompts, memory bodies or secrets.",
-                "Markers: [bli] = BLI Memory, ◪ = Supermemory, [bli]+◪ = both.",
-                "Offline entries stay queued; the next collector sync retries with the same ID.",
-            ],
-        ],
         [
             "clean",
             [

package/dist/commands/local-help.js

@@ -117,7 +117,7 @@ export function localCommandHelp(command) {
         "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",
         "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|install|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
         "  cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
-        "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",
+        "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>|delete <id|slug>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",
         "  cockpit msg [channels|create <name>|dm <email>|read <channel>|send <channel>|thread <id> --channel <channel>] [--private] [--members a@x,b@y] [--description <text>] [--thread <id>] [--limit <n>] [--dashboard-url <url>] [--json]",
         "  cockpit issue [list|show <BLI-id>|create --title <t>|update <BLI-id>|move <BLI-id> <state>|comment <BLI-id>|history <BLI-id>] [--state <s>] [--assignee me|unassigned|<uuid>] [--project <name|id>] [--limit <n>] [--priority 0-4] [--parent <BLI-id>] [--file <path>|--body-stdin] [--dashboard-url <url>] [--json]",
         "  cockpit mail [accounts|add-imap --address <a>|inbox|read <thread>|search \"<words>\"|send --account <id> --to <a> --subject <s>|attachment <id> --out <path>|sync <account>|detach <account>] [--account <id>] [--limit <n>] [--unread] [--label <l>] [--file <path>] [--dashboard-url <url>] [--json]",

package/dist/commands/memory-store.js

@@ -48,6 +48,7 @@ import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
 import { runMemoryConsolidation } from "./memory-consolidation.js";
 import { runMemoryRequeue } from "./memory-requeue.js";
 import { readNoteFile } from "./notes-file.js";
+export { runMemoryVerbList } from "./memory-verb-list.js";
 const TAG = "[memory cli]";
 const SEARCH_DEADLINE_MS = 60_000;
 /** `--extract` is one model call, sometimes two; the door waits for it when asked to. */
@@ -130,61 +131,6 @@ async function profileMemory(command, door) {
     writeLine(door.io.stdout, `Compiled ${String(profile.compiledAt ?? "—")} from ${String(profile.sourceRows ?? 0)} memories by ${String(profile.model ?? "—")}.`);
     return 0;
 }
-/**
- * The verb list a bare `cockpit memory` prints (BLI-4047).
- *
- * It used to run the installer. Typing a noun to find out what it does is the
- * single most common thing a person does with a new CLI, and this was the one
- * command in the collector that answered that by writing five files in a home
- * directory. Installing is still one word away, and every unattended caller
- * asks for `install` by name in code.
- */
-export function runMemoryVerbList(io, json) {
-    if (json) {
-        writeLine(io.stdout, JSON.stringify({
-            ok: true,
-            noun: "memory",
-            machine_verbs: ["install", "status"],
-            store_verbs: ["search", "save", "update", "forget", "profile", "consolidation", "requeue"],
-            log_verbs: ["log"],
-        }));
-        return 0;
-    }
-    for (const line of [
-        "cockpit memory — BLI Memory: the store, and this machine's registration.",
-        "",
-        "The store (Tower, over /api/memory/*):",
-        "  cockpit memory search \"<question>\" [--container <tag>] [--limit 1..20] [--no-recent] [--json]",
-        "  cockpit memory save [--container <tag>] [--custom-id <id>] [--extract] [--file <path>] [--json]",
-        "      the memory comes from stdin, or --file; never from the command line",
-        "  cockpit memory update <id> [--file <path>] [--json]        replacement text on stdin",
-        "  cockpit memory forget <id> [--reason <label>] [--json]",
-        "  cockpit memory forget --content-stdin --container <tag> [--reason <label>] [--json]",
-        "  cockpit memory profile [--container <tag>] [--json]",
-        "      the compiled one-page briefing every session opens with; a read, never a compile",
-        "  cockpit memory consolidation [--container <tag>] [--json]",
-        "      what the nightly tidy-up pass did: clusters, edits by verb, refusals, cost",
-        "  cockpit memory requeue --since <iso> [--until <iso>] [--source hook|harvest] [--reason <label>] [--apply] [--json]",
-        "      put a window of finished extractions back in the queue after the store refused",
-        "      their writes; super admins only, and a DRY RUN unless you pass --apply",
-        "",
-        "This machine:",
-        "  cockpit memory install [--dry-run] [--json]   register the MCP server and the three hooks",
-        "  cockpit memory status [--json]                read the stored config back",
-        "",
-        "The experience log:",
-        "  cockpit memory log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"",
-        "",
-        "Search: --limit caps the MEMORIES (default 5, at most 20). Up to 3 Tower pages and",
-        "tickets ride beside them whatever --limit says; for more, use `cockpit search`.",
-        "Save accepts repeated --alias names (up to 16 names of 64 characters).",
-        "Omit --container and this repository's own memory space is used — the same",
-        "space the bli-memory MCP server and its hooks read and write.",
-    ]) {
-        writeLine(io.stdout, line);
-    }
-    return 0;
-}
 /**
  * This repository's memory space, resolved by the MCP server's own resolver.
  * `--container` wins; `--workspace` says which directory to derive it from.

package/dist/commands/memory-verb-list.js

@@ -0,0 +1,68 @@
+/**
+ * The verb list a bare `cockpit memory` prints: what the noun does, never a
+ * side effect.
+ *
+ * Split out of `memory-store.ts` (BLI-10445) when that file crossed the
+ * 500-line readability ratchet. The seam: `memory-store.ts` talks to the
+ * `/api/memory/*` doors; this module talks to nobody and only describes them,
+ * so it changes when a verb is added, not when a door's contract moves.
+ * `memory-store.ts` re-exports it so the router and tests import one name.
+ *
+ * Every string moved verbatim.
+ */
+import { writeLine } from "./cli-io.js";
+/**
+ * The verb list a bare `cockpit memory` prints (BLI-4047).
+ *
+ * It used to run the installer. Typing a noun to find out what it does is the
+ * single most common thing a person does with a new CLI, and this was the one
+ * command in the collector that answered that by writing five files in a home
+ * directory. Installing is still one word away, and every unattended caller
+ * asks for `install` by name in code.
+ */
+export function runMemoryVerbList(io, json) {
+    if (json) {
+        writeLine(io.stdout, JSON.stringify({
+            ok: true,
+            noun: "memory",
+            machine_verbs: ["install", "status"],
+            store_verbs: ["search", "save", "update", "forget", "profile", "consolidation", "requeue"],
+            log_verbs: ["log"],
+        }));
+        return 0;
+    }
+    for (const line of [
+        "cockpit memory — BLI Memory: the store, and this machine's registration.",
+        "",
+        "The store (Tower, over /api/memory/*):",
+        "  cockpit memory search \"<question>\" [--container <tag>] [--limit 1..20] [--no-recent] [--json]",
+        "  cockpit memory save [--container <tag>] [--custom-id <id>] [--extract] [--file <path>] [--json]",
+        "      the memory comes from stdin, or --file; never from the command line",
+        "  cockpit memory update <id> [--file <path>] [--json]        replacement text on stdin",
+        "  cockpit memory forget <id> [--reason <label>] [--json]",
+        "  cockpit memory forget --content-stdin --container <tag> [--reason <label>] [--json]",
+        "  cockpit memory profile [--container <tag>] [--json]",
+        "      the compiled one-page briefing every session opens with; a read, never a compile",
+        "  cockpit memory consolidation [--container <tag>] [--json]",
+        "      what the nightly tidy-up pass did: clusters, edits by verb, refusals, cost",
+        "  cockpit memory requeue --since <iso> [--until <iso>] [--source hook|harvest] [--reason <label>] [--apply] [--json]",
+        "      put a window of finished extractions back in the queue after the store refused",
+        "      their writes; super admins only, and a DRY RUN unless you pass --apply",
+        "",
+        "This machine:",
+        "  cockpit memory install [--dry-run] [--json]   register the MCP server and the three hooks",
+        "  cockpit memory status [--json]                read the stored config back",
+        "",
+        "The experience log:",
+        "  cockpit memory log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"",
+        "",
+        "Search: --limit caps the MEMORIES (default 5, at most 20). Up to 3 Tower pages and",
+        "tickets ride beside them whatever --limit says; for more, use `cockpit search`.",
+        "Save accepts repeated --alias names (up to 16 names of 64 characters).",
+        "Omit --container and this repository's own memory space is used — the same",
+        "space the bli-memory MCP server and its hooks read and write.",
+    ]) {
+        writeLine(io.stdout, line);
+    }
+    return 0;
+}

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.140");
+    writeLine(io?.stdout ?? process.stdout, "0.2.142");
     return 0;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.140",
+  "version": "0.2.142",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.36",
-    "@bli-cockpit/mcp": "0.1.65",
+    "@bli-cockpit/mcp": "0.1.67",
     "@bli-cockpit/telemetry-core": "0.1.48"
   }
 }