@bli-cockpit/cli 0.2.179 → 0.2.183

package/dist/commands/local-help.js

@@ -66,6 +66,7 @@ export const rootCommandNames = new Set([
     "memory",
     "clean",
     "sources",
+    "glossary",
     "docs",
     "msg",
     "issue",
@@ -77,8 +78,10 @@ export const rootCommandNames = new Set([
     "release",
     "careers",
     "rename",
+    "setup",
     "usage",
     "logs",
+    "brain",
     ...SURFACE_ALIASES.keys(),
 ]);
 /** Public names omit compatibility spellings while the router keeps accepting them. */
@@ -112,7 +115,7 @@ export function localCommandHelp(command) {
         "  cockpit brief status [--who <person>] [--render] [--dashboard-url <url>] [--json]",
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
         "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
-        "  cockpit notes [accounts [--show-webhook <account-id>]|connect --provider fellow --workspace <sub> --key-stdin [--name <n>]|webhook <account-id> --secret-stdin|detach <account-id>|sync <account-id>] [--json]   (the key and the signing secret are read from stdin, never a flag)",
+        "  cockpit notes [accounts [--show-webhook <account-id>]|connect --provider fellow --workspace <sub> --key-stdin [--name <n>]|connect --provider wisprflow|recordings <note-id>|recording <id>|webhook <account-id> --secret-stdin|detach <account-id>|sync <account-id>] [--json]   (the key and the signing secret are read from stdin, never a flag)",
         "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--lock-wait <seconds>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
@@ -132,8 +135,11 @@ export function localCommandHelp(command) {
         `  cockpit search "<words>" [--kind ${SEARCH_KINDS.join(",")}] [--limit <n>] [--dashboard-url <url>] [--json]`,
         "  cockpit release [--dry-run] [--skip-checks] [--no-floor] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
         "  cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <passed_on|archived|reopen>|followup <id> [--record-sent-at <iso>]|interview <id> <--at <iso>|--clear>|grade <id> [--now]|resume <id> [--out <path>]|takehome show <role>|takehome set <role> --body-file <path>|settings show|settings set --enabled <true|false> --followup-enabled <true|false> --followup-after-days <n> --takehome-window-hours <n>] [--role <slug>] [--min-score <n>] [--since <date>] [--stage <s>] [--force] [--json]",
+        "  cockpit glossary list|add <wrong> --to <name>|remove <wrong> [--dashboard-url <url>] [--json]",
         "  cockpit rename [list|resolve <id> --scope <page|everywhere|undo>] [--dashboard-url <url>] [--json]",
         "  cockpit logs <collector|dashboard|railway|railway:<service>|-> [--since 15m|1h|2d|<iso>] [--raw <template-id> [--limit <n>]] [--all-levels] [--table <file>] [--json]",
+        "  cockpit brain status [--project <id>] [--show open|running|needs_human|fixed|not_actionable|cleared] [--dashboard-url <url>] [--json]",
+        "  cockpit setup [--person <email>] [--compare <email,email>] [--json]",
         "  cockpit usage sessions [--task <BLI-NNNN> | --subject <name>] [--repo <label>] [--since <window>] [--json]",
         "  cockpit usage sessions --session <id> [--from-window <n>] [--json]",
         "  --by-topic groups work types; --by-subject groups open subjects from session summaries.",

package/dist/commands/local.js

@@ -1,3 +1,4 @@
+import { runGlossary } from "./glossary.js";
 import { defaultIo, errorMessage, writeLine } from "./cli-io.js";
 import { isLocalHelpRequest, localCommandHelp, rootCommandNames } from "./local-help.js";
 import { beginStage, endStage } from "../crash-guard.js";
@@ -11,6 +12,7 @@ import { runLogin } from "./login.js";
 import { runLogout } from "./logout.js";
 import { runStart } from "./start.js";
 import { runSync } from "./sync.js";
+import { runDoctorAfterSync } from "./sync-doctor.js";
 import { runAnalyze } from "./analyze.js";
 import { runBackfillCommand } from "./backfill.js";
 import { runDoctor } from "./doctor.js";
@@ -48,8 +50,10 @@ import { runGithub } from "./github.js";
 import { runSearch } from "./search.js";
 import { runCareers } from "./careers.js";
 import { runRename } from "./rename-scope.js";
+import { runSetup } from "./setup.js";
 import { runUsage } from "./usage.js";
 import { runLogs } from "./logs.js";
+import { runBrain } from "./brain.js";
 import { parseLocalArgs } from "./local-args.js";
 // `./local.js` is the published entry point for this command surface: the
 // public CLI's generated root, commands/root.ts, doctor.ts and the test suite
@@ -60,7 +64,7 @@ export { classifySyncFailureRecords, classifySyncHealthError, redactedSyncErrorD
 export { assertCollectionRootPersisted } from "./collection-roots.js";
 export { runSelfUpdate, SelfUpdateError, } from "./install-update.js";
 import { runRoots } from "./roots.js";
-export async function runLocalCockpitCli(argv, io = defaultIo()) {
+export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorAfterSync }) {
     // BLI-10450: `--quiet` is a global toggle, stripped here so no per-command
     // parser's `allowedFlags` needs to learn it, and mirrored onto
     // `COCKPIT_QUIET` so `tower-client.ts` can react without every call site
@@ -219,6 +223,8 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
                 return await runClean(command, io);
             case "sources":
                 return await runSourcesCheck(command, io);
+            case "glossary":
+                return await runGlossary(command, io);
             case "docs":
                 return await runDocs(command, io);
             case "msg":
@@ -241,10 +247,10 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
                 return await runCareers(command, io);
             case "rename":
                 return await runRename(command, io);
-            case "usage":
-                return await runUsage(command, io);
-            case "logs":
-                return await runLogs(command, io);
+            case "setup": return await runSetup(command, io);
+            case "usage": return await runUsage(command, io);
+            case "logs": return await runLogs(command, io);
+            case "brain": return await runBrain(command, io);
         }
     }
     catch (error) {

package/dist/commands/memory-store.js

@@ -48,6 +48,7 @@ import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
 import { runMemoryConsolidation } from "./memory-consolidation.js";
 import { cacheAgeLabel, readThroughCache } from "./read-cache.js";
 import { runMemoryRequeue } from "./memory-requeue.js";
+import { runMemoryVisibility } from "./memory-visibility.js";
 import { readNoteFile } from "./notes-file.js";
 export { runMemoryVerbList } from "./memory-verb-list.js";
 const TAG = "[memory cli]";
@@ -80,6 +81,11 @@ export async function runMemoryStore(command, io) {
             // Its own module too: a window-shaped, super-admin, dry-run-by-default
             // verb that refuses nothing the others refuse (BLI-4539).
             return runMemoryRequeue(command, io);
+        case "private":
+        case "public":
+            // BLI-12927: the narrowing switch. Its own module, so this file stays
+            // under the readability ceiling.
+            return runMemoryVisibility(command, door);
     }
 }
 /**
@@ -203,14 +209,16 @@ async function searchMemory(command, door) {
     else {
         for (const row of results) {
             writeLine(door.io.stdout, `${similarityLabel(row)}${oneLine(row["memory"])}`);
-            writeLine(door.io.stdout, `    ${String(row["id"] ?? "")}  ${String(row["containerTag"] ?? "")}`);
+            writeLine(door.io.stdout, `    ${String(row["id"] ?? "")}  ${String(row["containerTag"] ?? "")}${filedByLabel(row)}`);
         }
     }
     if (recent.length > 0) {
         writeLine(door.io.stdout, "");
         writeLine(door.io.stdout, "Recent context:");
-        for (const row of recent)
-            writeLine(door.io.stdout, `  - ${oneLine(row["preview"] ?? row["memory"])}`);
+        for (const row of recent) {
+            const author = typeof row["savedBy"] === "string" && row["savedBy"] ? `(from ${row["savedBy"]}) ` : "";
+            writeLine(door.io.stdout, `  - ${author}${oneLine(row["preview"] ?? row["memory"])}`);
+        }
     }
     if (body.degraded) {
         writeLine(door.io.stdout, "");
@@ -375,6 +383,18 @@ function similarityLabel(row) {
         ? `[${Math.round(similarity * 100)}%] `
         : "";
 }
+/**
+ * BLI-12927: memory is public across the team, so a hit can be a teammate's.
+ * `  filed by Edward on 2026-09-14` ahead of nothing when it is the caller's own.
+ */
+function filedByLabel(row) {
+    const name = typeof row["savedBy"] === "string" ? row["savedBy"].trim() : "";
+    if (!name)
+        return "";
+    const filed = typeof row["createdAt"] === "string" ? new Date(row["createdAt"]) : null;
+    const day = filed && !Number.isNaN(filed.getTime()) ? filed.toISOString().slice(0, 10) : null;
+    return day ? `  filed by ${name} on ${day}` : `  filed by ${name}`;
+}
 /** One terminal line: newlines folded, so a long memory cannot break the listing. */
 function oneLine(value) {
     return String(value ?? "").replace(/\s+/g, " ").trim();

package/dist/commands/memory-verb-list.js

@@ -26,7 +26,7 @@ export function runMemoryVerbList(io, json) {
             ok: true,
             noun: "memory",
             machine_verbs: ["install", "status"],
-            store_verbs: ["search", "save", "update", "forget", "profile", "consolidation", "requeue"],
+            store_verbs: ["search", "save", "update", "forget", "private", "public", "profile", "consolidation", "requeue"],
             log_verbs: ["log"],
         }));
         return 0;
@@ -41,6 +41,9 @@ export function runMemoryVerbList(io, json) {
         "  cockpit memory update <id> [--file <path>] [--json]        replacement text on stdin",
         "  cockpit memory forget <id> [--reason <label>] [--json]",
         "  cockpit memory forget --content-stdin --container <tag> [--reason <label>] [--json]",
+        "      you can forget or update only your own memories (a super admin, any)",
+        "  cockpit memory private <id> [--json]       only you and super admins can read this memory",
+        "  cockpit memory public <id> [--json]        every member can read it again (how every memory starts)",
         "  cockpit memory profile [--container <tag>] [--json]",
         "      the compiled one-page briefing every session opens with; a read, never a compile",
         "  cockpit memory consolidation [--container <tag>] [--json]",

package/dist/commands/memory-visibility.js

@@ -0,0 +1,48 @@
+/**
+ * `cockpit memory private <id>` and `cockpit memory public <id>` (BLI-12927).
+ *
+ * BLI Memory is public to every member of the team until its owner narrows it:
+ * "if it's worth saving, it's worth sharing; when we have a privacy problem, we
+ * narrow down." These two verbs are the narrowing switch, one memory at a time.
+ * `private` means only you and super admins can read that memory; `public`
+ * means every member can again, which is how every memory starts.
+ *
+ * Both verbs call the SAME door, `POST /api/memory/visibility`, as the
+ * `set_memory_visibility` tool on the `bli-memory` MCP server. Who may flip a
+ * memory is decided by the database on the caller's own session (the owner of
+ * the memory, or a super admin); this file asks and prints the door's own
+ * answer, reason label included, and never rephrases a refusal.
+ */
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[memory cli]";
+const DEADLINE_MS = 60_000;
+export async function runMemoryVisibility(command, door) {
+    const visibility = command.action === "private" ? "private" : "public";
+    if (!command.memoryId) {
+        return failAgentDoor(door, TAG, "id_required", `memory ${visibility} needs the memory id \`cockpit memory search\` printed.`);
+    }
+    const answer = await askAgentDoor(door, {
+        path: "/api/memory/visibility",
+        method: "POST",
+        label: `memory ${visibility}`,
+        timeoutMs: DEADLINE_MS,
+        body: { id: command.memoryId, visibility },
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const result = answer.body;
+    // Counts and labels only: a memory's text never enters a log line.
+    writeLine(door.io.stderr, `${TAG} visibility ${JSON.stringify({
+        visibility,
+        changed: result["changed"] ?? null,
+        profile_invalidated: result["profileInvalidated"] ?? null,
+    })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    const already = result["changed"] === false ? " It already was." : "";
+    writeLine(door.io.stdout, visibility === "private"
+        ? `Memory ${command.memoryId} is now private: only you and super admins can read it.${already}`
+        : `Memory ${command.memoryId} is now public: every member can read it.${already}`);
+    return 0;
+}

package/dist/commands/notes-accounts.js

@@ -17,11 +17,67 @@
  * `cockpit notes` keeps.
  */
 import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
-import { ask, emit, fail, READ_DEADLINE_MS } from "./notes-door.js";
+import { ask, emit, fail, READ_DEADLINE_MS, TAG } from "./notes-door.js";
+import { printCoverage, readCoverage } from "./notes-recordings.js";
+import { signInToWisprflow } from "./notes-wisprflow-login.js";
 /** A pass can take a while; a read never should. */
 const WRITE_DEADLINE_MS = 120_000;
 /** An API key is long; anything past this is not one, and is refused by size. */
 const KEY_MAX_CHARS = 500;
+/** BLI-12926: a Wispr Flow sign-in bundle holds an OAuth refresh token, which can run longer. */
+const SIGN_IN_MAX_CHARS = 4000;
+/**
+ * Granola, read through the one door that answers for it
+ * (`GET /api/notes/granola-status`). A ledger that cannot be read is said so on
+ * the feed, never turned into "nothing feeds your notes".
+ */
+async function readSharedFeeds(door) {
+    const feed = {
+        provider: "granola",
+        name: "Granola",
+        how: "read by the organization's own Granola key, swept once a day by Tower's server; no key of yours is involved",
+        last_run: null,
+        unreadable: null,
+    };
+    const answer = await ask(door, {
+        path: "/api/notes/granola-status?limit=1",
+        method: "GET",
+        label: "notes granola-status",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok) {
+        feed.unreadable = answer.reason;
+        writeLine(door.io.stderr, `${TAG} shared feed ledger unreadable ${JSON.stringify({ provider: "granola", reason: answer.reason })}`);
+        return [feed];
+    }
+    const runs = answer.body.runs ?? [];
+    const newest = runs[0];
+    if (newest) {
+        feed.last_run = {
+            started_at: newest.started_at,
+            reason: newest.reason,
+            notes_seen: newest.notes_seen,
+            notes_stored: newest.notes_stored,
+            notes_failed: newest.notes_failed,
+        };
+    }
+    return [feed];
+}
+function writeSharedFeeds(door, feeds) {
+    if (feeds.length === 0)
+        return;
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, "Also feeding your notes, for the whole organization:");
+    for (const feed of feeds) {
+        const last = feed.unreadable
+            ? `last run unknown (the run ledger could not be read: ${feed.unreadable})`
+            : feed.last_run
+                ? `last run ${feed.last_run.started_at}: ${feed.last_run.reason}, saw ${feed.last_run.notes_seen}, stored ${feed.last_run.notes_stored}, failed ${feed.last_run.notes_failed}`
+                : "no run has landed a row yet";
+        writeLine(door.io.stdout, `  ${feed.name}  ${feed.how}; ${last}`);
+    }
+    writeLine(door.io.stdout, "  Its runs in full: `cockpit notes granola-status`.");
+}
 export async function listNotesAccounts(command, door) {
     const answer = await ask(door, {
         path: "/api/notes/accounts",
@@ -32,13 +88,23 @@ export async function listNotesAccounts(command, door) {
     if (!answer.ok)
         return fail(door, answer.reason, answer.detail);
     const accounts = answer.body.accounts ?? [];
+    // BLI-12925: what feeds this person's notes is more than the accounts they
+    // connected. Granola arrives through the organization's own key and cron, so
+    // an empty account list never meant "no notetaker".
+    const sharedFeeds = await readSharedFeeds(door);
+    // BLI-12926: who feeds whom, added after the list so the list stays as it was.
+    const coverage = await readCoverage(door);
     if (door.json)
-        return emit(door, { ok: true, accounts });
+        return emit(door, { ok: true, accounts, shared_feeds: sharedFeeds, coverage });
     if (accounts.length === 0) {
-        writeLine(door.io.stdout, "No notetaker is connected yet.");
+        writeLine(door.io.stdout, "You have not connected a notetaker of your own.");
+        writeSharedFeeds(door, sharedFeeds);
         writeLine(door.io.stdout, "");
         writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fellow api key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
         writeLine(door.io.stdout, '          or:  printf "%s" "<your circleback api key>" | cockpit notes connect --provider circleback --key-stdin');
+        writeLine(door.io.stdout, "          or:  cockpit notes connect --provider wisprflow   (signs in through your browser; no key)");
+        if (coverage)
+            printCoverage(door, coverage);
         return 0;
     }
     for (const account of accounts) {
@@ -52,30 +118,45 @@ export async function listNotesAccounts(command, door) {
     }
     writeLine(door.io.stdout, "");
     writeLine(door.io.stdout, `${accounts.length} notetaker(s). ids: ${accounts.map((account) => account.id).join(", ")}`);
+    writeSharedFeeds(door, sharedFeeds);
+    if (coverage)
+        printCoverage(door, coverage);
     // `command` is unused beyond the door it already carries; naming it keeps
     // every verb in this file one shape.
     void command;
     return 0;
 }
 export async function connectNotetaker(command, door) {
-    // The key comes from stdin and nowhere else. An interactive terminal with
-    // nothing piped in is told how, rather than left waiting on a prompt that
-    // would echo the secret into the scrollback.
-    if (isInteractiveStdin(door.io)) {
-        return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
-    }
     let apiKey;
-    try {
-        apiKey = (await readPipedText(door.io.stdin, {
-            maxChars: KEY_MAX_CHARS,
-            overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
-        })).trim();
-    }
-    catch (error) {
-        return fail(door, "key_unreadable", error instanceof Error ? error.message : String(error));
+    if (command.provider === "wisprflow" && !command.keyStdin) {
+        // BLI-12926. Wispr Flow has no API key: the person signs in through their
+        // browser and what gets sealed is the sign-in. Nothing is read from stdin.
+        const signedIn = await signInToWisprflow({ io: door.io });
+        if (!signedIn.ok)
+            return fail(door, signedIn.reason, signedIn.detail);
+        apiKey = signedIn.bundle;
     }
-    if (apiKey === "") {
-        return fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.");
+    else {
+        // The key comes from stdin and nowhere else. An interactive terminal with
+        // nothing piped in is told how, rather than left waiting on a prompt that
+        // would echo the secret into the scrollback.
+        if (isInteractiveStdin(door.io)) {
+            return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
+        }
+        try {
+            apiKey = (await readPipedText(door.io.stdin, {
+                // A Wispr Flow sign-in bundle carries an OAuth refresh token, which
+                // can be far longer than any API key.
+                maxChars: command.provider === "wisprflow" ? SIGN_IN_MAX_CHARS : KEY_MAX_CHARS,
+                overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
+            })).trim();
+        }
+        catch (error) {
+            return fail(door, "key_unreadable", error instanceof Error ? error.message : String(error));
+        }
+        if (apiKey === "") {
+            return fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.");
+        }
     }
     const answer = await ask(door, {
         path: "/api/notes/accounts",
@@ -243,7 +324,8 @@ export async function syncStatusNotetakers(command, door) {
     if (door.json)
         return emit(door, { ok: true, accounts });
     if (accounts.length === 0) {
-        writeLine(door.io.stdout, "No notetaker is connected yet.");
+        writeLine(door.io.stdout, "You have not connected a notetaker of your own.");
+        writeLine(door.io.stdout, "Granola is read by the organization's key, not by an account of yours: `cockpit notes granola-status` is its health.");
         return 0;
     }
     for (const account of accounts) {

package/dist/commands/notes-reads.js

@@ -69,7 +69,7 @@ export async function listNotes(command, door) {
         writeLine(door.io.stdout, `${one.heading} (${one.notes.length})`);
         for (const note of one.notes) {
             const who = note.participants.length > 0 ? ` — ${note.participants.join(", ")}` : "";
-            writeLine(door.io.stdout, `  ${note.meetingDate}  ${note.id}  ${note.fileName}${who}`);
+            writeLine(door.io.stdout, `  ${note.meetingDate}  ${note.id}  ${note.title?.trim() || note.fileName}${who}`);
         }
     }
     writeLine(door.io.stdout, "");

package/dist/commands/notes-recordings.js

@@ -0,0 +1,113 @@
+/**
+ * `cockpit notes recordings <note-id>`, `cockpit notes recording <id>` and the
+ * "who feeds whom" section of `cockpit notes accounts` (BLI-12926).
+ *
+ * One meeting that several notetakers (or several people) recorded is ONE note
+ * in the library: the recording with the longest transcript. The others are
+ * alternates, kept by id and never ingested. `recordings` lists every recording
+ * of the meeting a note is; `recording` opens one, body and all.
+ *
+ * `coverage` is the other half: which notetakers feed each member's notes, so a
+ * member with none is a visible gap and not a silence. It rides on
+ * `cockpit notes accounts` as an added section; a failed read of it never fails
+ * the account list, and says so on stderr.
+ *
+ * Thin client over `/api/notes/recordings` and `/api/notes/coverage`; every
+ * access rule lives behind those doors.
+ */
+import { writeLine } from "./cli-io.js";
+import { ask, emit, fail, READ_DEADLINE_MS, TAG } from "./notes-door.js";
+function lengthOf(row) {
+    return row.transcript_chars === null ? "length unknown" : `${row.transcript_chars} characters`;
+}
+export async function listRecordings(command, door) {
+    const noteId = command.noteId ?? "";
+    const answer = await ask(door, {
+        path: `/api/notes/recordings?note_id=${encodeURIComponent(noteId)}`,
+        method: "GET",
+        label: "notes recordings",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const recordings = answer.body.recordings ?? [];
+    if (door.json)
+        return emit(door, { ok: true, note_id: noteId, recordings });
+    if (recordings.length === 0) {
+        writeLine(door.io.stdout, "No recording is indexed for this note. It was filed before recordings were tracked, or by hand.");
+        return 0;
+    }
+    for (const row of recordings) {
+        const shown = row.role === "primary" ? "SHOWN    " : "alternate";
+        writeLine(door.io.stdout, `${shown}  ${row.source_namespace.padEnd(10)}  ${lengthOf(row).padEnd(20)}  ${(row.started_at ?? "no start time").padEnd(24)}  ${row.id}`);
+        if (row.chosen_reason)
+            writeLine(door.io.stdout, `           ${row.chosen_reason}`);
+    }
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, recordings.length === 1
+        ? "One recording: the note is the recording."
+        : `${recordings.length} recordings of one meeting. Open one with \`cockpit notes recording <id>\`.`);
+    return 0;
+}
+export async function showRecording(command, door) {
+    const recordingId = command.noteId ?? "";
+    const answer = await ask(door, {
+        path: `/api/notes/recordings?recording_id=${encodeURIComponent(recordingId)}`,
+        method: "GET",
+        label: "notes recording",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const recording = answer.body.recording;
+    if (!recording)
+        return fail(door, "empty_answer", "Tower answered without a recording.");
+    if (door.json)
+        return emit(door, { ok: true, recording });
+    writeLine(door.io.stderr, `${recording.role === "primary" ? "The recording shown as the note" : "An alternate"} from ${recording.source_namespace}, ${lengthOf(recording)}.`);
+    if (recording.chosen_reason)
+        writeLine(door.io.stderr, recording.chosen_reason);
+    writeLine(door.io.stdout, recording.body ?? "(Tower did not keep this recording's text.)");
+    return 0;
+}
+/**
+ * The "who is connected" section. Returns the rows it printed, or null when the
+ * read failed; a failure is reported on stderr and never fails the caller.
+ */
+export async function readCoverage(door) {
+    const answer = await ask(door, {
+        path: "/api/notes/coverage",
+        method: "GET",
+        label: "notes coverage",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok) {
+        writeLine(door.io.stderr, `${TAG} could not read who has a notetaker connected: ${answer.detail}`);
+        return null;
+    }
+    // An answer that is not a roster is not "nobody has a notetaker"; say so.
+    const body = answer.body;
+    if (!body || !Array.isArray(body.members)) {
+        writeLine(door.io.stderr, `${TAG} could not read who has a notetaker connected: Tower's answer was not a roster.`);
+        return null;
+    }
+    return { members: body.members, members_with_none: body.members_with_none ?? 0 };
+}
+export function printCoverage(door, coverage) {
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, "Who feeds Tower's notes:");
+    for (const member of coverage.members) {
+        const who = `${member.display_name ?? member.email}${member.is_you ? " (you)" : ""}`;
+        if (member.notetakers.length === 0) {
+            writeLine(door.io.stdout, `  ${who.padEnd(32)}  NO NOTETAKER CONNECTED`);
+            continue;
+        }
+        const feeds = member.notetakers
+            .map((taker) => (taker.status === "active" ? taker.provider : `${taker.provider} (${taker.status})`))
+            .join(", ");
+        writeLine(door.io.stdout, `  ${who.padEnd(32)}  ${feeds}`);
+    }
+    if (coverage.members_with_none > 0) {
+        writeLine(door.io.stdout, `${coverage.members_with_none} member(s) have no notetaker connected, so their meetings reach Tower only if someone else recorded them.`);
+    }
+}