@bli-cockpit/cli 0.2.179 → 0.2.183

package/dist/commands/agent-setup.js

@@ -0,0 +1,152 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { AgentSetupSchema, SetupNameSchema } from "@bli-cockpit/telemetry-core";
+import { LOCAL_COLLECTOR_VERSION } from "../local-state.js";
+const exec = promisify(execFile);
+const files = {
+    read: file => fs.readFile(file, "utf8"), list: directory => fs.readdir(directory),
+    version: async (tool, platform) => {
+        try {
+            const { stdout } = await exec(platform === "win32" ? `${tool}.exe` : tool, ["--version"], { timeout: 750, maxBuffer: 4096, windowsHide: true });
+            return /(?:^|\s)(\d+\.\d+\.\d+(?:[-+][a-z0-9.-]+)?)(?:\s|$)/i.exec(stdout)?.[1] ?? null;
+        }
+        catch {
+            return null;
+        }
+    },
+};
+const safeName = (value) => SetupNameSchema.safeParse(value).success ? value : null;
+const names = (values) => [...new Set(values.flatMap(value => safeName(value) ? [value] : []))].sort().slice(0, 500);
+const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+/** Bounded, explicit locations only. Never recurse through a home or read env files. */
+export async function collectAgentSetup(home, platform = process.platform, io = files, now = new Date()) {
+    const paths = platform === "win32" ? path.win32 : path.posix;
+    const join = (...parts) => paths.join(home, ...parts);
+    const read = async (file) => {
+        try {
+            const text = await io.read(file);
+            return text.length <= 1_000_000 ? text : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const list = async (...parts) => {
+        try {
+            return names(await io.list(join(...parts)));
+        }
+        catch (error) {
+            return error.code === "ENOENT" ? [] : null;
+        }
+    };
+    const json = async (...parts) => {
+        const text = await read(join(...parts));
+        if (text === null)
+            return null;
+        try {
+            return object(JSON.parse(text));
+        }
+        catch {
+            return null;
+        }
+    };
+    const installedVersion = async (tool) => {
+        const version = await io.version?.(tool, platform).catch(() => null);
+        if (safeName(version))
+            return version;
+        // npm shims on native Windows cannot be execFile'd without a shell. Read
+        // their installed package metadata instead, never the update-available cache.
+        const packageName = tool === "claude" ? "@anthropic-ai/claude-code" : "@openai/codex";
+        const packageFile = platform === "win32" ? join("AppData", "Roaming", "npm", "node_modules", ...packageName.split("/"), "package.json") :
+            paths.join(paths.dirname(process.execPath), "..", "lib", "node_modules", ...packageName.split("/"), "package.json");
+        const text = await read(packageFile);
+        try {
+            return safeName(object(JSON.parse(text ?? "null")).version);
+        }
+        catch {
+            return null;
+        }
+    };
+    const claudeVersion = await installedVersion("claude");
+    const codexVersion = await installedVersion("codex");
+    const codexHooks = await json(".codex", "hooks.json");
+    const claudePlugins = await json(".claude", "plugins", "installed_plugins.json");
+    const pluginSkills = [], pluginAgents = [];
+    let pluginInventoryUnknown = false;
+    for (const [pluginName, installations] of Object.entries(object(claudePlugins?.plugins))) {
+        if (!safeName(pluginName) || !Array.isArray(installations))
+            continue;
+        for (const installation of installations.slice(0, 20)) {
+            const directory = object(installation).installPath;
+            if (typeof directory !== "string" || !paths.isAbsolute(directory)) {
+                pluginInventoryUnknown = true;
+                continue;
+            }
+            for (const category of ["skills", "agents"]) {
+                try {
+                    const entries = names(await io.list(paths.join(directory, category)));
+                    (category === "skills" ? pluginSkills : pluginAgents).push(...entries.map(name => `${pluginName}.${name}`));
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        pluginInventoryUnknown = true;
+                }
+            }
+        }
+    }
+    const claudeSkills = await list(".claude", "skills");
+    const claudeAgents = await list(".claude", "agents");
+    const sharedSkills = await list(".agents", "skills");
+    const codexSkills = await list(".codex", "skills");
+    const systemSkills = await list(".codex", "skills", ".system");
+    const claudeSettings = await json(".claude", "settings.json");
+    const claudeConfig = await json(".claude.json");
+    const toml = await read(join(".codex", "config.toml"));
+    // Read only simple quoted scalar values. Complex TOML is unknown, not guessed.
+    const rootToml = toml?.split(/^\s*\[/m)[0] ?? "";
+    const scalar = (key) => safeName(new RegExp(`^${key}\\s*=\\s*"([^"\\n]+)"\\s*(?:#.*)?$`, "m").exec(rootToml)?.[1]);
+    const codexMcp = toml === null ? null : [...toml.matchAll(/^\s*\[mcp_servers\.(?:"([a-z0-9_.@+-]+)"|([a-z0-9_-]+))\]\s*$/gim)].flatMap(match => {
+        const name = safeName(match[1] ?? match[2]);
+        if (!name)
+            return [];
+        const block = toml.slice(match.index + match[0].length).split(/^\s*\[/m)[0];
+        return [{ name, transport: /^\s*command\s*=/m.test(block) ? "stdio" : /^\s*url\s*=/m.test(block) ? "http" : "unknown" }];
+    }).slice(0, 500);
+    const claudeServers = [object(claudeConfig?.mcpServers), ...Object.values(object(claudeConfig?.projects)).map(project => object(object(project).mcpServers))];
+    const claudeMcp = claudeConfig === null ? null : claudeServers.flatMap(servers => Object.entries(servers)).flatMap(([key, value]) => {
+        const name = safeName(key);
+        if (!name)
+            return [];
+        const config = object(value);
+        const transport = config.type === "sse" ? "sse" : config.type === "http" || config.url ? "http" : config.command ? "stdio" : "unknown";
+        return [{ name, transport }];
+    }).slice(0, 500);
+    const instructions = await Promise.all(["CLAUDE.md", "AGENTS.md"].map(async (name) => {
+        const file = join(name === "CLAUDE.md" ? ".claude" : ".codex", name);
+        try {
+            const content = await io.read(file);
+            return { name, exists: true, sha256: crypto.createHash("sha256").update(content).digest("hex"), bytes: Buffer.byteLength(content) };
+        }
+        catch (error) {
+            return { name, exists: error.code === "ENOENT" ? false : null, sha256: null, bytes: null };
+        }
+    }));
+    const result = AgentSetupSchema.parse({
+        checked_at: now.toISOString(), os: platform === "darwin" || platform === "win32" ? platform : "other", cli_version: LOCAL_COLLECTOR_VERSION,
+        claude: { version: claudeVersion, model: safeName(claudeSettings?.model), effort: safeName(claudeSettings?.effortLevel),
+            skills: claudeSkills === null || pluginInventoryUnknown ? null : names([...claudeSkills, ...pluginSkills]), agents: claudeAgents === null || pluginInventoryUnknown ? null : names([...claudeAgents, ...pluginAgents]),
+            plugins: claudePlugins === null ? null : names(Object.keys(object(claudePlugins.plugins))),
+            hooks: claudeSettings === null ? null : names(Object.keys(object(claudeSettings.hooks))), mcp: claudeMcp },
+        codex: { version: codexVersion, model: scalar("model"), effort: scalar("model_reasoning_effort"),
+            skills: codexSkills === null || sharedSkills === null || systemSkills === null ? null : names([...(codexSkills ?? []), ...(sharedSkills ?? []), ...(systemSkills ?? [])]),
+            agents: toml === null ? null : names([...toml.matchAll(/^\s*\[agents\.([a-z0-9_-]+)\]\s*$/gim)].map(match => match[1])),
+            plugins: toml === null ? null : names([...toml.matchAll(/^\s*\[plugins\."([a-z0-9_@.+-]+)"\]\s*$/gim)].map(match => match[1])),
+            hooks: codexHooks === null && !/^notify\s*=/m.test(rootToml) ? null : names([...(codexHooks === null ? [] : Object.keys(object(codexHooks.hooks))), ...(/^notify\s*=/m.test(rootToml) ? ["notify"] : [])]), mcp: codexMcp }, instructions,
+    });
+    const unknownFields = [result.claude, result.codex].reduce((count, tool) => count + Object.values(tool).filter(value => value === null).length, 0);
+    console.error("[setup] inventory read", JSON.stringify({ reason: unknownFields ? "inventory_partial" : "inventory_observed", unknown_fields: unknownFields, os: result.os, mcp_count: (result.claude.mcp?.length ?? 0) + (result.codex.mcp?.length ?? 0) }));
+    return result;
+}

package/dist/commands/brain.js

@@ -0,0 +1,35 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[brain cli]";
+const READ_DEADLINE_MS = 55_000;
+export async function runBrain(command, io) {
+    let door;
+    try {
+        door = await openAgentDoor("brain", command, io);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : "this machine is not paired with Tower";
+        writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason: "not_paired" })}`);
+        if (command.json)
+            writeLine(io.stdout, JSON.stringify({ ok: false, error: "not_paired", detail }));
+        else
+            writeLine(io.stderr, detail);
+        return 1;
+    }
+    const query = new URLSearchParams();
+    if (command.project)
+        query.set("project", command.project);
+    if (command.show)
+        query.set("status", command.show);
+    const asked = query.toString();
+    const path = asked ? `/api/brain/incidents?${asked}` : "/api/brain/incidents";
+    const answer = await askAgentDoor(door, { path, method: "GET", label: "brain status", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(io.stderr, `${TAG} status read ${JSON.stringify({ projects: body.projects.length, rows: body.coverage.rows, pages: body.coverage.pages, end: body.coverage.end })}`);
+    if (command.json)
+        return emitAgentDoor(door, body);
+    writeLine(io.stdout, body.text);
+    return 0;
+}

package/dist/commands/doctor-update.js

@@ -27,6 +27,10 @@ export async function fixCliLatest(context, state) {
     catch (error) {
         return fail("cli-latest", selfUpdateFailureCode(error), selfUpdateFailureMessage(error));
     }
+    if (context.command.automaticTick) {
+        console.error("[doctor] update installed for the next tick", JSON.stringify({ reason: "restart_next_tick" }));
+        return { id: "cli-latest", status: "skipped", code: "restart_next_tick", message: "CLI updated; the next tick uses the new version." };
+    }
     if (context.io.env["COCKPIT_DOCTOR_REEXEC"] === "1") {
         if (state.code === "stale_cli") {
             return fail("cli-latest", "stale_after_self_update", "self-update ran but this process still reports the old CLI version; rerun `cockpit doctor`.");

package/dist/commands/doctor.js

@@ -47,7 +47,7 @@ export async function runDoctorWithDeps(command, io, deps) {
         try {
             row = diagnosed.get(invariant.id);
             const needsCollection = ["backfill-complete", "sync-fresh"].includes(invariant.id);
-            const prerequisitesReady = !needsCollection || rows.filter((prior) => prior.id === "authed" || prior.id === "roots-ok").every((prior) => prior.status === "ok");
+            const prerequisitesReady = !needsCollection || rows.filter((prior) => prior.id === "authed" || (!command.automaticTick && prior.id === "roots-ok")).every((prior) => prior.status === "ok");
             const canFix = !diagnoseOnly && prerequisitesReady && invariant.fix &&
                 (!invariant.requiresInteractiveFix || isInteractiveDoctorFix(context) || Boolean(command.collectionRoots?.length));
             let spent = row.status !== "ok" && row.status !== "skipped" && canFix ? budgetSpentRow(context, row) : null;
@@ -117,7 +117,6 @@ export async function runDoctorWithDeps(command, io, deps) {
         }
     }
     // BLI-12828: every repair's receipt says what it found and what it left.
-    finalizeDoctorRepairs(repairs, diagnosed, rows, attempted);
     const floor = await maybeReportDoctorEvents(context, rows);
     if (floor && isSemverBelow(LOCAL_COLLECTOR_VERSION, floor)) {
         const index = rows.findIndex((row) => row.id === "cli-latest");
@@ -134,8 +133,10 @@ export async function runDoctorWithDeps(command, io, deps) {
             rows.push({ id: "memory-registered", status: "needs_fix", code: "receipt_read_threw", message: "Run `cockpit doctor` to read the final setup receipt." });
         }
     }
+    finalizeDoctorRepairs(repairs, diagnosed, rows, attempted);
     const needsPerson = doctorNeedsPerson(rows, receipt).length;
     console.error("[doctor] run done", JSON.stringify({ elapsed_ms: Date.now() - runStarted, rows: rows.length, needs_person: needsPerson, check_only: Boolean(diagnoseOnly) }));
+    deps.onReceipt?.(rows, repairs, receipt);
     writeDoctorOutput(command, io, rows, receipt, repairs);
     return needsPerson === 0 ? 0 : 1;
 }
@@ -232,6 +233,7 @@ function doctorInvariants() {
 }
 function defaultDoctorDeps(hooks) {
     return {
+        onReceipt: hooks.onReceipt,
         checkAgentRules: checkDoctorAgentRules,
         fixAgentRules: fixDoctorAgentRules,
         latestCliVersion: latestCliVersionFromNpm,

package/dist/commands/glossary.js

@@ -0,0 +1,17 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { parseNamedArgs, optionalNonEmpty, optionalUrl } from "./local-arg-values.js";
+export function parseGlossaryArgs(args) {
+    const values = parseNamedArgs(args, { allowedFlags: ["--to", "--json", "--home", "--dashboard-url"], valueFlags: ["--to", "--home", "--dashboard-url"] });
+    const [action = "list", wrong, ...rest] = values.positionals;
+    const to = optionalNonEmpty(values.flags.get("--to"));
+    if (!["list", "add", "remove"].includes(action) || rest.length || (action === "list" && (wrong || to)) || (action !== "list" && !wrong) || (action === "add" && !to) || (action === "remove" && to))
+        throw new Error("Usage: cockpit glossary list | add <wrong> --to <name> | remove <wrong>");
+    return { kind: "glossary", action: action, wrong, to, json: values.booleans.has("--json"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")) };
+}
+export async function runGlossary(command, io) {
+    const door = await openAgentDoor("glossary", command, io);
+    const answer = await askAgentDoor(door, { path: "/api/glossary", method: command.action === "list" ? "GET" : "POST", label: "glossary", timeoutMs: 30_000, ...(command.action === "list" ? {} : { body: { action: command.action, wrong: command.wrong, to: command.to } }) });
+    if (!answer.ok)
+        return failAgentDoor(door, "[glossary cli]", answer.reason, answer.detail);
+    return emitAgentDoor(door, answer.body);
+}

package/dist/commands/heartbeat.js

@@ -19,7 +19,9 @@
  *   The path itself never leaves the machine, exactly as with `cwd_hash` on the
  *   session rows.
  */
+import { noteDoctorRequest } from "./sync-doctor-request.js";
 import crypto from "node:crypto";
+import { collectAgentSetup } from "./agent-setup.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -268,7 +270,7 @@ export async function sendCollectorHeartbeatBestEffort(options) {
     const heartbeat = buildCollectorHeartbeat({
         roots: options.roots,
         facts: options.facts,
-        setupReceipt,
+        setupReceipt: { ...(setupReceipt ?? { schema_version: "setup-receipt.v1", checked_at: new Date().toISOString(), browser: { status: "unknown" }, device: { status: "unknown" }, collector: { autostart: { status: "unknown" } } }), agent_setup: await collectAgentSetup(options.homeDir ?? os.homedir()) },
         ...(options.now ? { now: options.now } : {}),
         memoryInstall: memory.receipt,
     });
@@ -307,6 +309,8 @@ export async function sendCollectorHeartbeatBestEffort(options) {
         // BLI-4019. The server slides `token_expires_at` out on every call it
         // authenticates and answers with the result; the sibling records it, so
         // this machine's own copy follows the server rather than drifting.
+        const reply = await response.clone().json().catch(() => null);
+        noteDoctorRequest(reply?.device_action);
         await recordHeartbeatTokenExpiry(options.homeDir, response);
         console.error("[heartbeat] checked in", JSON.stringify({
             reason: "heartbeat_recorded",

package/dist/commands/local-args-tower-admin.js

@@ -332,6 +332,11 @@ function parseTeamDeviceArgs(rest, flags, common) {
             throw new Error("team device list does not accept positional arguments.");
         return { kind: "team", action: "device-list", ...common };
     }
+    if (deviceVerb === "doctor") {
+        if (!deviceRef)
+            throw new Error("team device doctor needs a device id or name.");
+        return { kind: "team", action: "device-doctor", deviceRef, ...common };
+    }
     if (deviceVerb === "revoke") {
         if (!deviceRef)
             throw new Error("team device revoke needs a device id or name.");
@@ -351,7 +356,7 @@ function parseTeamDeviceArgs(rest, flags, common) {
             ...common,
         };
     }
-    throw new Error("team device takes one verb: list or revoke <id|name>.");
+    throw new Error("team device takes one verb: list, doctor <id|name>, or revoke <id|name>.");
 }
 /** `cockpit model [show|set <key>]` — the alias surface for the personal chat model. */
 export function parseModelArgs(args) {

package/dist/commands/local-args-tower-brain.js

@@ -0,0 +1,38 @@
+/**
+ * `cockpit brain` argument parsing (BLI-12859).
+ *
+ *   cockpit brain status [--project <id>] [--show open|running|needs_human|fixed|not_actionable|cleared] [--json]
+ *
+ * Tower's incident queue: per project, how many incidents are open, being worked, waiting on a
+ * person, fixed, not actionable or cleared, the newest ones with their Tower issue, and the last
+ * 7 days of verdicts. It reads `GET /api/brain/incidents` with this machine's device token.
+ */
+import { LOG_PROJECT_PATTERN } from "@bli-cockpit/telemetry-core/log-digest";
+import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+/** The statuses the queue's door accepts for `--show`; the migration's CHECK constraint is the other copy. */
+export const BRAIN_SHOW_STATUSES = ["open", "running", "needs_human", "fixed", "not_actionable", "cleared"];
+export function parseBrainArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: ["--project", "--show", "--home", "--dashboard-url", "--json"],
+        valueFlags: ["--project", "--show", "--home", "--dashboard-url"],
+    });
+    const action = values.positionals[0];
+    if (action !== "status" || values.positionals.length > 1) {
+        throw new Error("brain takes one verb: `status`. Example: `cockpit brain status` or `cockpit brain status --project pearl-portal`.");
+    }
+    const project = optionalNonEmpty(values.flags.get("--project"));
+    if (project && !LOG_PROJECT_PATTERN.test(project))
+        throw new Error("--project wants a registry project id like pearl-portal (`cockpit logs --list` names them).");
+    const show = optionalNonEmpty(values.flags.get("--show"));
+    if (show && !BRAIN_SHOW_STATUSES.includes(show))
+        throw new Error(`--show wants one of ${BRAIN_SHOW_STATUSES.join(", ")}.`);
+    return {
+        kind: "brain",
+        action: "status",
+        ...(project ? { project } : {}),
+        ...(show ? { show } : {}),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        json: values.booleans.has("--json"),
+    };
+}

package/dist/commands/local-args-tower-memory.js

@@ -37,6 +37,11 @@ export const MEMORY_STORE_ACTIONS = new Set([
     "save",
     "update",
     "forget",
+    // BLI-12927: BLI Memory is public to the team until its owner narrows it.
+    // `private <id>` / `public <id>` flip one memory; same door as the
+    // `set_memory_visibility` tool.
+    "private",
+    "public",
     "profile",
     // BLI-4534: a READ of the nightly consolidation receipts, not a fifth way to
     // write a memory. It runs no pass and changes nothing — the pass is a
@@ -176,6 +181,16 @@ export function parseMemoryStoreArgs(action, args) {
     if (action === "consolidation") {
         return { ...command, action };
     }
+    if (action === "private" || action === "public") {
+        // BLI-12927: one memory, named by the id `cockpit memory search` printed.
+        const memoryId = optionalNonEmpty(rest[0]);
+        if (!memoryId) {
+            throw new Error(`memory ${action} needs the memory id \`cockpit memory search\` printed.`);
+        }
+        if (rest.length > 1)
+            throw new Error(`memory ${action} takes one id.`);
+        return { ...command, action, memoryId };
+    }
     if (action === "save") {
         if (rest.length > 0) {
             throw new Error("memory save reads the memory from stdin or --file, never from the command line: `echo \"...\" | cockpit memory save`.");

package/dist/commands/local-args-tower-pages.js

@@ -181,7 +181,13 @@ export function parseBriefArgs(args) {
  * `otter` and `granola` are deliberately absent: Otter's public API is
  * Enterprise-only and Granola still runs on its own server-side cron.
  */
-const CONNECTABLE_PROVIDERS = ["fellow", "circleback"];
+const CONNECTABLE_PROVIDERS = ["fellow", "circleback", "wisprflow"];
+/**
+ * BLI-12926. Providers with no API key at all: the person signs in through
+ * their browser and `connect` runs that sign-in itself. `--key-stdin` is
+ * optional for these, and carries a pre-built sign-in bundle when given.
+ */
+const PROVIDERS_SIGNED_IN_BY_BROWSER = ["wisprflow"];
 /** The provider whose API is per workspace, so its account needs a subdomain. */
 const PROVIDERS_NEEDING_A_WORKSPACE = ["fellow"];
 const NOTES_ACTIONS = new Set([
@@ -202,6 +208,9 @@ const NOTES_ACTIONS = new Set([
     "detach",
     "sync",
     "sync-status",
+    // BLI-12926: the alternates of a meeting several notetakers recorded.
+    "recordings",
+    "recording",
     // BLI-4394: arm that notetaker's webhook with the vendor's signing secret.
     "webhook",
     // Ticket 10718: the Granola cron's own last-several-runs health.
@@ -214,6 +223,9 @@ const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
     "unshare",
     "move",
     "place",
+    // BLI-12926: `recordings` names the note, `recording` names the recording.
+    "recordings",
+    "recording",
 ]);
 /**
  * BLI-4383. Actions whose first positional is a NOTETAKER ACCOUNT id, not a
@@ -277,7 +289,7 @@ export function parseNotesArgs(args) {
     const first = values.positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, sync, sync-status, webhook, or granola-status.`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, or granola-status.`);
     }
     const rest = values.positionals.slice(first === undefined ? 0 : 1);
     const json = values.booleans.has("--json");
@@ -340,7 +352,7 @@ export function parseNotesArgs(args) {
         if (workspace !== undefined && !/^[a-z0-9-]{1,63}$/.test(workspace)) {
             throw new Error("--workspace is a workspace subdomain: lowercase letters, digits and hyphens, 1 to 63 characters.");
         }
-        if (!values.booleans.has("--key-stdin")) {
+        if (!values.booleans.has("--key-stdin") && !PROVIDERS_SIGNED_IN_BY_BROWSER.includes(provider)) {
             // Naming the flag is the point: it says out loud that the key is not an
             // argument, so nobody goes looking for a `--key` that will never exist.
             throw new Error('notes connect reads the key from stdin. Say so: printf "%s" "<key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
@@ -397,6 +409,7 @@ export function parseNotesArgs(args) {
         ...(provider ? { provider } : {}),
         ...(workspace ? { workspace } : {}),
         ...(showWebhook ? { showWebhook: true } : {}),
+        ...(action === "connect" && values.booleans.has("--key-stdin") ? { keyStdin: true } : {}),
         ...(paths ? { paths } : {}),
         filePath: optionalNonEmpty(values.flags.get("--file")),
         name: optionalNonEmpty(values.flags.get("--name")),

package/dist/commands/local-args-tower-setup.js

@@ -0,0 +1,10 @@
+import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+export function parseSetupArgs(args) {
+    const values = parseNamedArgs(args, { allowedFlags: ["--person", "--compare", "--json", "--home", "--dashboard-url"], valueFlags: ["--person", "--compare", "--home", "--dashboard-url"] });
+    if (values.positionals.length)
+        throw new Error("setup takes --person or --compare, not a subcommand.");
+    const compare = optionalNonEmpty(values.flags.get("--compare"));
+    if (compare && (compare.split(",").length !== 2 || compare.split(",").some(value => !value.trim())))
+        throw new Error("--compare takes two emails separated by a comma.");
+    return { kind: "setup", person: optionalNonEmpty(values.flags.get("--person")), compare, json: values.booleans.has("--json"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")) };
+}

package/dist/commands/local-args-tower.js

@@ -37,7 +37,10 @@ export { SEARCH_KINDS, parseSearchArgs } from "./local-args-tower-search.js";
 export { parseModelsArgs } from "./local-args-tower-models.js";
 export { parseMailArgs } from "./local-args-tower-mail.js";
 export { parseCalArgs } from "./local-args-tower-cal.js";
+export { parseSetupArgs } from "./local-args-tower-setup.js";
 export { parseUsageArgs } from "./local-args-tower-usage.js";
 export { parseLogsArgs } from "./local-args-tower-logs.js";
+export { parseBrainArgs } from "./local-args-tower-brain.js";
 export { parseCareersArgs } from './local-args-tower-careers.js';
-export { parseRenameArgs } from './local-args-tower-rename.js';
+export { parseRenameArgs } from './local-args-tower-rename.js';
+export { parseGlossaryArgs } from "./glossary.js";

package/dist/commands/local-args.js

@@ -15,10 +15,11 @@
  * its own rate. Behavior-preserving extraction throughout: functions moved
  * verbatim, no logic change.
  */
+import { parseGlossaryArgs } from "./glossary.js";
 import { parseRootsArgs } from "./roots.js";
 import { SURFACE_ALIASES } from "./local-help.js";
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
-import { parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseLogsArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
+import { parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseSetupArgs, parseLogsArgs, parseBrainArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
 // `normalizeUrl` has always been part of this module's surface — `local.ts` and
 // `local-auth.ts` import it from here — so it stays exported from this address
 // even though it now lives next door. The same goes for the four names the
@@ -109,6 +110,8 @@ export function parseLocalArgs(argv) {
             return parseCleanArgs(argv.slice(1));
         case "sources":
             return parseSourcesArgs(argv.slice(1));
+        case "glossary":
+            return parseGlossaryArgs(argv.slice(1));
         case "docs":
             return parseDocsArgs(argv.slice(1));
         case "msg":
@@ -131,10 +134,14 @@ export function parseLocalArgs(argv) {
             return parseCareersArgs(argv.slice(1));
         case "rename":
             return parseRenameArgs(argv.slice(1));
+        case "setup":
+            return parseSetupArgs(argv.slice(1));
         case "usage":
             return parseUsageArgs(argv.slice(1));
         case "logs":
             return parseLogsArgs(argv.slice(1));
+        case "brain":
+            return parseBrainArgs(argv.slice(1));
         default:
             throw new Error(`Unknown local command: ${command ?? ""}`);
     }

package/dist/commands/local-command-shapes-brain.js

@@ -0,0 +1,5 @@
+/**
+ * `cockpit brain` command shape (BLI-12859), beside `local-command-shapes-logs.ts` for the same
+ * reason: `local-command-shapes.ts` sits at the readability ceiling.
+ */
+export {};

package/dist/commands/local-help-commands-tower-ops.js

@@ -44,6 +44,23 @@ export const TOWER_OPS_COMMAND_HELP = [
             "The bli-tower MCP server has the twin: logs_digest.",
         ],
     ],
+    [
+        "brain",
+        [
+            "Usage: cockpit brain status [--project <id>] [--show open|running|needs_human|fixed|not_actionable|cleared] [--dashboard-url <url>] [--json]",
+            "",
+            "Tower's incident queue. Every 15 minutes the log-digest cron turns each recurring problem in a project's logs (classes",
+            "our_bug, config_drift, capacity, unknown) into ONE incident with ONE Tower issue; a repeat adds to its count, never a twin.",
+            "A template quiet for 24 hours is marked cleared. This prints, per project, how many incidents are open, being worked,",
+            "waiting on a person, fixed, not actionable or cleared, the newest ones in the --show status (default open) with their Tower",
+            "issue, how often each was seen and what it said, and the last 7 days of verdicts. Needs only this machine's Tower login.",
+            "--project <id>   one project (`cockpit logs --list` names them).",
+            "--show <status>  list the newest incidents in that status instead of open.",
+            "--json writes one object to stdout: { ok, generated_at, projects[{ project, counts, incidents[], verdicts_7d }], totals, coverage, text };",
+            "a refusal is { ok: false, error, detail } and exits 1 (unknown_project, invalid_status, stored_read_failed, not_paired, ...).",
+            "Teaching: docs/architecture/tower-brain.md. The bli-tower MCP server has the twin: brain_status.",
+        ],
+    ],
     [
         "github",
         [

package/dist/commands/local-help-commands-tower.js

@@ -341,7 +341,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "notes",
         [
-            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]] [flags]",
+            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>] [flags]",
             "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 4 MB. --wait polls transcription for at most 330 seconds.",
             "",
             "folders [--tree] [--json]: list folders and visible note counts.",
@@ -362,10 +362,13 @@ export const TOWER_COMMAND_HELP = [
             "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
             "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
             "",
-            "Your own notetaker (BLI-4383). Fellow and Circleback today; Otter needs an Enterprise plan and Granola still runs on its own cron.",
-            "accounts [--json] — the notetakers you have connected, with health and when each was last read.",
+            "Your own notetaker (BLI-4383). Fellow, Circleback and Wispr Flow today; Otter needs an Enterprise plan and Granola still runs on its own cron.",
+            "accounts [--json] — the notetakers you have connected, with health and when each was last read, and under it who on the team feeds Tower with which notetaker (a member with none is named: that is the gap).",
+            "recordings <note-id> [--json] — every recording of the meeting this note is. When several notetakers or people recorded one meeting, the library shows ONE note, the recording with the longest transcript; the others are alternates kept by id (BLI-12926).",
+            "recording <recording-id> [--json] — one recording, text and all, shown or alternate.",
             "accounts --show-webhook <account-id> — that account's webhook URL, where to paste it at the vendor, and whether a signing secret is stored (BLI-4394). Until one is, every request to that URL is refused, which is the right way to be off.",
             "webhook <account-id> --secret-stdin — store the VENDOR's webhook signing secret. THE SECRET IS READ FROM STDIN, never a flag: printf \"%s\" \"<signing secret>\" | cockpit notes webhook <account-id> --secret-stdin",
+            "connect --provider wisprflow [--name <n>] — Wispr Flow has no API key: this prints an address and a code, you approve in your browser (Google, Apple, Microsoft or company single sign-on), and Tower reads your Notetaker meetings from then on. Needs Notetaker and MCP access on your Wispr account (BLI-12926).",
             "connect --provider fellow|circleback [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
             "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
             "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
@@ -380,7 +383,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "memory",
         [
-            "Usage: cockpit memory [search|save|update|forget|profile|consolidation|requeue|install|status|log] [flags]",
+            "Usage: cockpit memory [search|save|update|forget|private|public|profile|consolidation|requeue|install|status|log] [flags]",
             "",
             "The STORE, over the same /api/memory/* doors the bli-memory MCP server calls:",
             "  search \"<question>\" [--container <tag>] [--limit 1..20] [--no-recent]",
@@ -395,6 +398,11 @@ export const TOWER_COMMAND_HELP = [
             "  update <id> [--file <path>]   replacement text on stdin; the old row is kept as history.",
             "  forget <id> [--reason <label>]",
             "  forget --content-stdin --container <tag> [--reason <label>]   forget by exact text.",
+            "      Memory is public to every member and super admin, but only a memory's owner",
+            "      (or a super admin) can update or forget it.",
+            "  private <id>   only you and super admins can read this memory.",
+            "  public <id>    every member can read it again; this is how every memory starts.",
+            "      A teammate's memory in a search says who filed it and on what day.",
             "  profile [--container <tag>]   the compiled one-page briefing; a read, never a compile.",
             "  consolidation [--container <tag>]   what the nightly tidy-up pass did.",
             "      Clusters looked at, edits by verb, refusals by reason, model and cost.",

package/dist/commands/local-help-commands.js

@@ -22,10 +22,12 @@ import { TOWER_COMMAND_HELP } from "./local-help-commands-tower.js";
 import { TOWER_OPS_COMMAND_HELP } from "./local-help-commands-tower-ops.js";
 export function localSubcommandHelp(command) {
     const helpByCommand = new Map([
+        ["glossary", ["Usage: cockpit glossary list|add <wrong> --to <name>|remove <wrong> [--json]", "Quote phrases. Removing a form prevents future corrections of it."]],
         ["roots", ["Usage: cockpit roots add <dir> [--allow-home-root] [--json]", "Approves a work directory, saves an approval receipt, and adds it to collection. Run cockpit doctor afterward."]],
         // BLI-3709: the Tower nouns live next door, split along the same seam the
         // argument parsers already use — see `local-help-commands-tower.ts`.
         ...TOWER_COMMAND_HELP,
+        ["setup", ["Usage: cockpit setup [--person <email>] [--compare <email,email>] [--json]", "Read agent setups beside 30-day outcomes, or compare two exact emails."]],
         [
             "onboard",
             [
@@ -191,6 +193,7 @@ export function localSubcommandHelp(command) {
                 "  cockpit team role <userId> --role <role> [--yes]",
                 "      Admin only. Asks first unless --yes. You cannot change your own role.",
                 "  cockpit team device [list] [--json]",
+                "  cockpit team device doctor <id|name> [--json]",
                 "      Every paired collector device: name, id, trust state, owner, and why",
                 "      (revoked reason, or when it was approved, or that it's still waiting).",
                 "      Admin only.",