@bli-cockpit/cli 0.2.180 → 0.2.183

package/dist/commands/memory-store.js

@@ -48,6 +48,7 @@ import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
 import { runMemoryConsolidation } from "./memory-consolidation.js";
 import { cacheAgeLabel, readThroughCache } from "./read-cache.js";
 import { runMemoryRequeue } from "./memory-requeue.js";
+import { runMemoryVisibility } from "./memory-visibility.js";
 import { readNoteFile } from "./notes-file.js";
 export { runMemoryVerbList } from "./memory-verb-list.js";
 const TAG = "[memory cli]";
@@ -80,6 +81,11 @@ export async function runMemoryStore(command, io) {
             // Its own module too: a window-shaped, super-admin, dry-run-by-default
             // verb that refuses nothing the others refuse (BLI-4539).
             return runMemoryRequeue(command, io);
+        case "private":
+        case "public":
+            // BLI-12927: the narrowing switch. Its own module, so this file stays
+            // under the readability ceiling.
+            return runMemoryVisibility(command, door);
     }
 }
 /**
@@ -203,14 +209,16 @@ async function searchMemory(command, door) {
     else {
         for (const row of results) {
             writeLine(door.io.stdout, `${similarityLabel(row)}${oneLine(row["memory"])}`);
-            writeLine(door.io.stdout, `    ${String(row["id"] ?? "")}  ${String(row["containerTag"] ?? "")}`);
+            writeLine(door.io.stdout, `    ${String(row["id"] ?? "")}  ${String(row["containerTag"] ?? "")}${filedByLabel(row)}`);
         }
     }
     if (recent.length > 0) {
         writeLine(door.io.stdout, "");
         writeLine(door.io.stdout, "Recent context:");
-        for (const row of recent)
-            writeLine(door.io.stdout, `  - ${oneLine(row["preview"] ?? row["memory"])}`);
+        for (const row of recent) {
+            const author = typeof row["savedBy"] === "string" && row["savedBy"] ? `(from ${row["savedBy"]}) ` : "";
+            writeLine(door.io.stdout, `  - ${author}${oneLine(row["preview"] ?? row["memory"])}`);
+        }
     }
     if (body.degraded) {
         writeLine(door.io.stdout, "");
@@ -375,6 +383,18 @@ function similarityLabel(row) {
         ? `[${Math.round(similarity * 100)}%] `
         : "";
 }
+/**
+ * BLI-12927: memory is public across the team, so a hit can be a teammate's.
+ * `  filed by Edward on 2026-09-14` ahead of nothing when it is the caller's own.
+ */
+function filedByLabel(row) {
+    const name = typeof row["savedBy"] === "string" ? row["savedBy"].trim() : "";
+    if (!name)
+        return "";
+    const filed = typeof row["createdAt"] === "string" ? new Date(row["createdAt"]) : null;
+    const day = filed && !Number.isNaN(filed.getTime()) ? filed.toISOString().slice(0, 10) : null;
+    return day ? `  filed by ${name} on ${day}` : `  filed by ${name}`;
+}
 /** One terminal line: newlines folded, so a long memory cannot break the listing. */
 function oneLine(value) {
     return String(value ?? "").replace(/\s+/g, " ").trim();

package/dist/commands/memory-verb-list.js

@@ -26,7 +26,7 @@ export function runMemoryVerbList(io, json) {
             ok: true,
             noun: "memory",
             machine_verbs: ["install", "status"],
-            store_verbs: ["search", "save", "update", "forget", "profile", "consolidation", "requeue"],
+            store_verbs: ["search", "save", "update", "forget", "private", "public", "profile", "consolidation", "requeue"],
             log_verbs: ["log"],
         }));
         return 0;
@@ -41,6 +41,9 @@ export function runMemoryVerbList(io, json) {
         "  cockpit memory update <id> [--file <path>] [--json]        replacement text on stdin",
         "  cockpit memory forget <id> [--reason <label>] [--json]",
         "  cockpit memory forget --content-stdin --container <tag> [--reason <label>] [--json]",
+        "      you can forget or update only your own memories (a super admin, any)",
+        "  cockpit memory private <id> [--json]       only you and super admins can read this memory",
+        "  cockpit memory public <id> [--json]        every member can read it again (how every memory starts)",
         "  cockpit memory profile [--container <tag>] [--json]",
         "      the compiled one-page briefing every session opens with; a read, never a compile",
         "  cockpit memory consolidation [--container <tag>] [--json]",

package/dist/commands/memory-visibility.js

@@ -0,0 +1,48 @@
+/**
+ * `cockpit memory private <id>` and `cockpit memory public <id>` (BLI-12927).
+ *
+ * BLI Memory is public to every member of the team until its owner narrows it:
+ * "if it's worth saving, it's worth sharing; when we have a privacy problem, we
+ * narrow down." These two verbs are the narrowing switch, one memory at a time.
+ * `private` means only you and super admins can read that memory; `public`
+ * means every member can again, which is how every memory starts.
+ *
+ * Both verbs call the SAME door, `POST /api/memory/visibility`, as the
+ * `set_memory_visibility` tool on the `bli-memory` MCP server. Who may flip a
+ * memory is decided by the database on the caller's own session (the owner of
+ * the memory, or a super admin); this file asks and prints the door's own
+ * answer, reason label included, and never rephrases a refusal.
+ */
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[memory cli]";
+const DEADLINE_MS = 60_000;
+export async function runMemoryVisibility(command, door) {
+    const visibility = command.action === "private" ? "private" : "public";
+    if (!command.memoryId) {
+        return failAgentDoor(door, TAG, "id_required", `memory ${visibility} needs the memory id \`cockpit memory search\` printed.`);
+    }
+    const answer = await askAgentDoor(door, {
+        path: "/api/memory/visibility",
+        method: "POST",
+        label: `memory ${visibility}`,
+        timeoutMs: DEADLINE_MS,
+        body: { id: command.memoryId, visibility },
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const result = answer.body;
+    // Counts and labels only: a memory's text never enters a log line.
+    writeLine(door.io.stderr, `${TAG} visibility ${JSON.stringify({
+        visibility,
+        changed: result["changed"] ?? null,
+        profile_invalidated: result["profileInvalidated"] ?? null,
+    })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    const already = result["changed"] === false ? " It already was." : "";
+    writeLine(door.io.stdout, visibility === "private"
+        ? `Memory ${command.memoryId} is now private: only you and super admins can read it.${already}`
+        : `Memory ${command.memoryId} is now public: every member can read it.${already}`);
+    return 0;
+}

package/dist/commands/notes-accounts.js

@@ -17,11 +17,67 @@
  * `cockpit notes` keeps.
  */
 import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
-import { ask, emit, fail, READ_DEADLINE_MS } from "./notes-door.js";
+import { ask, emit, fail, READ_DEADLINE_MS, TAG } from "./notes-door.js";
+import { printCoverage, readCoverage } from "./notes-recordings.js";
+import { signInToWisprflow } from "./notes-wisprflow-login.js";
 /** A pass can take a while; a read never should. */
 const WRITE_DEADLINE_MS = 120_000;
 /** An API key is long; anything past this is not one, and is refused by size. */
 const KEY_MAX_CHARS = 500;
+/** BLI-12926: a Wispr Flow sign-in bundle holds an OAuth refresh token, which can run longer. */
+const SIGN_IN_MAX_CHARS = 4000;
+/**
+ * Granola, read through the one door that answers for it
+ * (`GET /api/notes/granola-status`). A ledger that cannot be read is said so on
+ * the feed, never turned into "nothing feeds your notes".
+ */
+async function readSharedFeeds(door) {
+    const feed = {
+        provider: "granola",
+        name: "Granola",
+        how: "read by the organization's own Granola key, swept once a day by Tower's server; no key of yours is involved",
+        last_run: null,
+        unreadable: null,
+    };
+    const answer = await ask(door, {
+        path: "/api/notes/granola-status?limit=1",
+        method: "GET",
+        label: "notes granola-status",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok) {
+        feed.unreadable = answer.reason;
+        writeLine(door.io.stderr, `${TAG} shared feed ledger unreadable ${JSON.stringify({ provider: "granola", reason: answer.reason })}`);
+        return [feed];
+    }
+    const runs = answer.body.runs ?? [];
+    const newest = runs[0];
+    if (newest) {
+        feed.last_run = {
+            started_at: newest.started_at,
+            reason: newest.reason,
+            notes_seen: newest.notes_seen,
+            notes_stored: newest.notes_stored,
+            notes_failed: newest.notes_failed,
+        };
+    }
+    return [feed];
+}
+function writeSharedFeeds(door, feeds) {
+    if (feeds.length === 0)
+        return;
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, "Also feeding your notes, for the whole organization:");
+    for (const feed of feeds) {
+        const last = feed.unreadable
+            ? `last run unknown (the run ledger could not be read: ${feed.unreadable})`
+            : feed.last_run
+                ? `last run ${feed.last_run.started_at}: ${feed.last_run.reason}, saw ${feed.last_run.notes_seen}, stored ${feed.last_run.notes_stored}, failed ${feed.last_run.notes_failed}`
+                : "no run has landed a row yet";
+        writeLine(door.io.stdout, `  ${feed.name}  ${feed.how}; ${last}`);
+    }
+    writeLine(door.io.stdout, "  Its runs in full: `cockpit notes granola-status`.");
+}
 export async function listNotesAccounts(command, door) {
     const answer = await ask(door, {
         path: "/api/notes/accounts",
@@ -32,13 +88,23 @@ export async function listNotesAccounts(command, door) {
     if (!answer.ok)
         return fail(door, answer.reason, answer.detail);
     const accounts = answer.body.accounts ?? [];
+    // BLI-12925: what feeds this person's notes is more than the accounts they
+    // connected. Granola arrives through the organization's own key and cron, so
+    // an empty account list never meant "no notetaker".
+    const sharedFeeds = await readSharedFeeds(door);
+    // BLI-12926: who feeds whom, added after the list so the list stays as it was.
+    const coverage = await readCoverage(door);
     if (door.json)
-        return emit(door, { ok: true, accounts });
+        return emit(door, { ok: true, accounts, shared_feeds: sharedFeeds, coverage });
     if (accounts.length === 0) {
-        writeLine(door.io.stdout, "No notetaker is connected yet.");
+        writeLine(door.io.stdout, "You have not connected a notetaker of your own.");
+        writeSharedFeeds(door, sharedFeeds);
         writeLine(door.io.stdout, "");
         writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fellow api key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
         writeLine(door.io.stdout, '          or:  printf "%s" "<your circleback api key>" | cockpit notes connect --provider circleback --key-stdin');
+        writeLine(door.io.stdout, "          or:  cockpit notes connect --provider wisprflow   (signs in through your browser; no key)");
+        if (coverage)
+            printCoverage(door, coverage);
         return 0;
     }
     for (const account of accounts) {
@@ -52,30 +118,45 @@ export async function listNotesAccounts(command, door) {
     }
     writeLine(door.io.stdout, "");
     writeLine(door.io.stdout, `${accounts.length} notetaker(s). ids: ${accounts.map((account) => account.id).join(", ")}`);
+    writeSharedFeeds(door, sharedFeeds);
+    if (coverage)
+        printCoverage(door, coverage);
     // `command` is unused beyond the door it already carries; naming it keeps
     // every verb in this file one shape.
     void command;
     return 0;
 }
 export async function connectNotetaker(command, door) {
-    // The key comes from stdin and nowhere else. An interactive terminal with
-    // nothing piped in is told how, rather than left waiting on a prompt that
-    // would echo the secret into the scrollback.
-    if (isInteractiveStdin(door.io)) {
-        return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
-    }
     let apiKey;
-    try {
-        apiKey = (await readPipedText(door.io.stdin, {
-            maxChars: KEY_MAX_CHARS,
-            overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
-        })).trim();
-    }
-    catch (error) {
-        return fail(door, "key_unreadable", error instanceof Error ? error.message : String(error));
+    if (command.provider === "wisprflow" && !command.keyStdin) {
+        // BLI-12926. Wispr Flow has no API key: the person signs in through their
+        // browser and what gets sealed is the sign-in. Nothing is read from stdin.
+        const signedIn = await signInToWisprflow({ io: door.io });
+        if (!signedIn.ok)
+            return fail(door, signedIn.reason, signedIn.detail);
+        apiKey = signedIn.bundle;
     }
-    if (apiKey === "") {
-        return fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.");
+    else {
+        // The key comes from stdin and nowhere else. An interactive terminal with
+        // nothing piped in is told how, rather than left waiting on a prompt that
+        // would echo the secret into the scrollback.
+        if (isInteractiveStdin(door.io)) {
+            return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
+        }
+        try {
+            apiKey = (await readPipedText(door.io.stdin, {
+                // A Wispr Flow sign-in bundle carries an OAuth refresh token, which
+                // can be far longer than any API key.
+                maxChars: command.provider === "wisprflow" ? SIGN_IN_MAX_CHARS : KEY_MAX_CHARS,
+                overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
+            })).trim();
+        }
+        catch (error) {
+            return fail(door, "key_unreadable", error instanceof Error ? error.message : String(error));
+        }
+        if (apiKey === "") {
+            return fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.");
+        }
     }
     const answer = await ask(door, {
         path: "/api/notes/accounts",
@@ -243,7 +324,8 @@ export async function syncStatusNotetakers(command, door) {
     if (door.json)
         return emit(door, { ok: true, accounts });
     if (accounts.length === 0) {
-        writeLine(door.io.stdout, "No notetaker is connected yet.");
+        writeLine(door.io.stdout, "You have not connected a notetaker of your own.");
+        writeLine(door.io.stdout, "Granola is read by the organization's key, not by an account of yours: `cockpit notes granola-status` is its health.");
         return 0;
     }
     for (const account of accounts) {

package/dist/commands/notes-reads.js

@@ -69,7 +69,7 @@ export async function listNotes(command, door) {
         writeLine(door.io.stdout, `${one.heading} (${one.notes.length})`);
         for (const note of one.notes) {
             const who = note.participants.length > 0 ? ` — ${note.participants.join(", ")}` : "";
-            writeLine(door.io.stdout, `  ${note.meetingDate}  ${note.id}  ${note.fileName}${who}`);
+            writeLine(door.io.stdout, `  ${note.meetingDate}  ${note.id}  ${note.title?.trim() || note.fileName}${who}`);
         }
     }
     writeLine(door.io.stdout, "");

package/dist/commands/notes-recordings.js

@@ -0,0 +1,113 @@
+/**
+ * `cockpit notes recordings <note-id>`, `cockpit notes recording <id>` and the
+ * "who feeds whom" section of `cockpit notes accounts` (BLI-12926).
+ *
+ * One meeting that several notetakers (or several people) recorded is ONE note
+ * in the library: the recording with the longest transcript. The others are
+ * alternates, kept by id and never ingested. `recordings` lists every recording
+ * of the meeting a note is; `recording` opens one, body and all.
+ *
+ * `coverage` is the other half: which notetakers feed each member's notes, so a
+ * member with none is a visible gap and not a silence. It rides on
+ * `cockpit notes accounts` as an added section; a failed read of it never fails
+ * the account list, and says so on stderr.
+ *
+ * Thin client over `/api/notes/recordings` and `/api/notes/coverage`; every
+ * access rule lives behind those doors.
+ */
+import { writeLine } from "./cli-io.js";
+import { ask, emit, fail, READ_DEADLINE_MS, TAG } from "./notes-door.js";
+function lengthOf(row) {
+    return row.transcript_chars === null ? "length unknown" : `${row.transcript_chars} characters`;
+}
+export async function listRecordings(command, door) {
+    const noteId = command.noteId ?? "";
+    const answer = await ask(door, {
+        path: `/api/notes/recordings?note_id=${encodeURIComponent(noteId)}`,
+        method: "GET",
+        label: "notes recordings",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const recordings = answer.body.recordings ?? [];
+    if (door.json)
+        return emit(door, { ok: true, note_id: noteId, recordings });
+    if (recordings.length === 0) {
+        writeLine(door.io.stdout, "No recording is indexed for this note. It was filed before recordings were tracked, or by hand.");
+        return 0;
+    }
+    for (const row of recordings) {
+        const shown = row.role === "primary" ? "SHOWN    " : "alternate";
+        writeLine(door.io.stdout, `${shown}  ${row.source_namespace.padEnd(10)}  ${lengthOf(row).padEnd(20)}  ${(row.started_at ?? "no start time").padEnd(24)}  ${row.id}`);
+        if (row.chosen_reason)
+            writeLine(door.io.stdout, `           ${row.chosen_reason}`);
+    }
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, recordings.length === 1
+        ? "One recording: the note is the recording."
+        : `${recordings.length} recordings of one meeting. Open one with \`cockpit notes recording <id>\`.`);
+    return 0;
+}
+export async function showRecording(command, door) {
+    const recordingId = command.noteId ?? "";
+    const answer = await ask(door, {
+        path: `/api/notes/recordings?recording_id=${encodeURIComponent(recordingId)}`,
+        method: "GET",
+        label: "notes recording",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const recording = answer.body.recording;
+    if (!recording)
+        return fail(door, "empty_answer", "Tower answered without a recording.");
+    if (door.json)
+        return emit(door, { ok: true, recording });
+    writeLine(door.io.stderr, `${recording.role === "primary" ? "The recording shown as the note" : "An alternate"} from ${recording.source_namespace}, ${lengthOf(recording)}.`);
+    if (recording.chosen_reason)
+        writeLine(door.io.stderr, recording.chosen_reason);
+    writeLine(door.io.stdout, recording.body ?? "(Tower did not keep this recording's text.)");
+    return 0;
+}
+/**
+ * The "who is connected" section. Returns the rows it printed, or null when the
+ * read failed; a failure is reported on stderr and never fails the caller.
+ */
+export async function readCoverage(door) {
+    const answer = await ask(door, {
+        path: "/api/notes/coverage",
+        method: "GET",
+        label: "notes coverage",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok) {
+        writeLine(door.io.stderr, `${TAG} could not read who has a notetaker connected: ${answer.detail}`);
+        return null;
+    }
+    // An answer that is not a roster is not "nobody has a notetaker"; say so.
+    const body = answer.body;
+    if (!body || !Array.isArray(body.members)) {
+        writeLine(door.io.stderr, `${TAG} could not read who has a notetaker connected: Tower's answer was not a roster.`);
+        return null;
+    }
+    return { members: body.members, members_with_none: body.members_with_none ?? 0 };
+}
+export function printCoverage(door, coverage) {
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, "Who feeds Tower's notes:");
+    for (const member of coverage.members) {
+        const who = `${member.display_name ?? member.email}${member.is_you ? " (you)" : ""}`;
+        if (member.notetakers.length === 0) {
+            writeLine(door.io.stdout, `  ${who.padEnd(32)}  NO NOTETAKER CONNECTED`);
+            continue;
+        }
+        const feeds = member.notetakers
+            .map((taker) => (taker.status === "active" ? taker.provider : `${taker.provider} (${taker.status})`))
+            .join(", ");
+        writeLine(door.io.stdout, `  ${who.padEnd(32)}  ${feeds}`);
+    }
+    if (coverage.members_with_none > 0) {
+        writeLine(door.io.stdout, `${coverage.members_with_none} member(s) have no notetaker connected, so their meetings reach Tower only if someone else recorded them.`);
+    }
+}

package/dist/commands/notes-wisprflow-login.js

@@ -0,0 +1,219 @@
+/**
+ * `cockpit notes connect --provider wisprflow` — signing a person into Wispr
+ * Flow's MCP server from a terminal (BLI-12926).
+ *
+ * Wispr Flow has no API key for meetings. Its Notetaker is read through a
+ * remote MCP server behind OAuth (docs.wisprflow.ai, "Connect Claude, ChatGPT
+ * or another MCP client to Wispr Flow": "no API key or token is needed"). Its
+ * authorization server publishes, at
+ * `https://mcp-auth.wisprflow.com/.well-known/oauth-authorization-server`
+ * (read 2026-10-08), dynamic client registration, PKCE `S256`, a refresh-token
+ * grant and the RFC 8628 DEVICE grant. The device grant is the one a terminal
+ * can use: it prints an address and a short code, the person approves in their
+ * own browser (Google, Apple, Microsoft or company single sign-on; an
+ * email-and-password Wispr account cannot complete MCP authorization), and this
+ * file polls until Wispr hands back a refresh token.
+ *
+ * What leaves this machine: a client registration, then the device and token
+ * calls, all to Wispr's own authorization server. The refresh token goes into a
+ * bundle (`{ v, client_id, refresh_token }`) that `connect` posts to Tower's
+ * accounts door, which seals it. It is never printed, never written to a file
+ * and never put in a flag; `--json` shows the account, not the bundle.
+ *
+ * **No live call has been made from this code.** Every shape is the RFC's, and
+ * the first real sign-in is the proof. In particular it is NOT known whether
+ * Wispr's server accepts a dynamically registered client on the device grant
+ * (the document lists both, not that they combine); if it does not, the refusal
+ * below says what Wispr answered and `--key-stdin` accepts a bundle made by any
+ * other means.
+ *
+ * stdout carries nothing from here; every line is stderr commentary.
+ */
+import { writeLine } from "./cli-io.js";
+export const WISPRFLOW_AUTH_ISSUER = "https://mcp-auth.wisprflow.com";
+export const WISPRFLOW_MCP_RESOURCE = "https://api.wisprflow.ai/connect/mcp";
+const SCOPE = "openid offline_access";
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+const REQUEST_DEADLINE_MS = 30_000;
+/** RFC 8628: a client polls no faster than the server's interval, default 5 s. */
+const DEFAULT_INTERVAL_SECONDS = 5;
+/** Never wait on a person longer than this, whatever the server says. */
+const MAX_WAIT_SECONDS = 15 * 60;
+const TAG = "[notes wisprflow signin]";
+export async function signInToWisprflow(options) {
+    const { io } = options;
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const now = options.now ?? Date.now;
+    const metadata = await readMetadata(io);
+    if (!metadata.ok)
+        return metadata;
+    // 1. Register a client. A public client: no secret, only an id.
+    const registered = await postJson(io, metadata.value.registration_endpoint, {
+        client_name: "Tower (BLI) notes sync",
+        grant_types: [DEVICE_GRANT, "refresh_token"],
+        response_types: [],
+        token_endpoint_auth_method: "none",
+        scope: SCOPE,
+    });
+    if (!registered.ok)
+        return explain(io, "registration", registered);
+    const clientId = stringField(registered.body, "client_id");
+    if (!clientId) {
+        return { ok: false, reason: "wisprflow_registration_unusable", detail: "Wispr Flow accepted the registration but sent no client id." };
+    }
+    // 2. Ask for a code.
+    const device = await postForm(io, metadata.value.device_authorization_endpoint, {
+        client_id: clientId,
+        scope: SCOPE,
+        resource: WISPRFLOW_MCP_RESOURCE,
+    });
+    if (!device.ok)
+        return explain(io, "device code", device);
+    const deviceCode = stringField(device.body, "device_code");
+    const userCode = stringField(device.body, "user_code");
+    const address = stringField(device.body, "verification_uri_complete") ?? stringField(device.body, "verification_uri");
+    if (!deviceCode || !userCode || !address) {
+        return { ok: false, reason: "wisprflow_device_unusable", detail: "Wispr Flow's device answer was missing its code or its address." };
+    }
+    const waitSeconds = Math.min(numberField(device.body, "expires_in") ?? MAX_WAIT_SECONDS, MAX_WAIT_SECONDS);
+    let intervalMs = (numberField(device.body, "interval") ?? DEFAULT_INTERVAL_SECONDS) * 1000;
+    writeLine(io.stderr, "Sign in to Wispr Flow to let Tower read your meeting notes:");
+    writeLine(io.stderr, `  1. Open  ${address}`);
+    writeLine(io.stderr, `  2. If it asks, enter the code  ${userCode}`);
+    writeLine(io.stderr, "  Use the Wispr account that holds your notes, signed in with Google, Apple, Microsoft or company single sign-on.");
+    writeLine(io.stderr, `Waiting up to ${Math.round(waitSeconds / 60)} minutes for you to approve...`);
+    log(io, "waiting", { interval_s: intervalMs / 1000, wait_s: waitSeconds });
+    // 3. Poll.
+    const deadline = now() + waitSeconds * 1000;
+    while (now() < deadline) {
+        await sleep(intervalMs);
+        const polled = await postForm(io, metadata.value.token_endpoint, {
+            grant_type: DEVICE_GRANT,
+            device_code: deviceCode,
+            client_id: clientId,
+            resource: WISPRFLOW_MCP_RESOURCE,
+        });
+        if (polled.ok) {
+            const refreshToken = stringField(polled.body, "refresh_token");
+            if (!refreshToken) {
+                return {
+                    ok: false,
+                    reason: "wisprflow_no_offline_access",
+                    detail: "Wispr Flow signed you in but did not hand back a refresh token, so Tower could not read your meetings"
+                        + " every half hour without you. Nothing was connected.",
+                };
+            }
+            log(io, "signed in", { client_registered: true, refresh_token_received: true });
+            return {
+                ok: true,
+                bundle: JSON.stringify({ v: 1, client_id: clientId, refresh_token: refreshToken }),
+            };
+        }
+        const code = stringField(polled.body, "error");
+        if (code === "authorization_pending")
+            continue;
+        if (code === "slow_down") {
+            intervalMs += 5000;
+            continue;
+        }
+        if (code === "expired_token") {
+            return { ok: false, reason: "wisprflow_code_expired", detail: "The code expired before it was approved. Run the command again." };
+        }
+        if (code === "access_denied") {
+            return { ok: false, reason: "wisprflow_denied", detail: "Wispr Flow says the request was declined. Nothing was connected." };
+        }
+        return explain(io, "sign-in", polled);
+    }
+    return { ok: false, reason: "wisprflow_timed_out", detail: "Nobody approved the code in time. Run the command again." };
+}
+/** Metadata only: a step, a status and an OAuth error label. Never a code or a token. */
+function log(io, message, fields) {
+    writeLine(io.stderr, `${TAG} ${message} ${JSON.stringify(fields)}`);
+}
+async function readMetadata(io) {
+    const got = await send(io, `${WISPRFLOW_AUTH_ISSUER}/.well-known/oauth-authorization-server`, { method: "GET" });
+    if (!got.ok)
+        return explain(io, "discovery", got);
+    const registration = stringField(got.body, "registration_endpoint");
+    const device = stringField(got.body, "device_authorization_endpoint");
+    const token = stringField(got.body, "token_endpoint");
+    if (!registration || !device || !token) {
+        return {
+            ok: false,
+            reason: "wisprflow_discovery_changed",
+            detail: "Wispr Flow's sign-in no longer advertises client registration and the device flow. Tower cannot sign you in from a terminal until it does.",
+        };
+    }
+    // Every endpoint must stay on Wispr's own host: a discovery document that
+    // points the token call somewhere else is not one to send a code to.
+    for (const endpoint of [registration, device, token]) {
+        if (!endpoint.startsWith(`${WISPRFLOW_AUTH_ISSUER}/`)) {
+            return { ok: false, reason: "wisprflow_discovery_changed", detail: "Wispr Flow's sign-in points at a host Tower does not recognise, so nothing was sent." };
+        }
+    }
+    return { ok: true, value: { registration_endpoint: registration, device_authorization_endpoint: device, token_endpoint: token } };
+}
+async function postJson(io, url, body) {
+    return send(io, url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify(body),
+    });
+}
+async function postForm(io, url, body) {
+    return send(io, url, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+        body: new URLSearchParams(body).toString(),
+    });
+}
+async function send(io, url, init) {
+    const call = io.fetch;
+    const controller = new AbortController();
+    const deadline = setTimeout(() => controller.abort(), REQUEST_DEADLINE_MS);
+    try {
+        const response = await call(url, { ...init, signal: controller.signal });
+        let body = null;
+        try {
+            body = await response.json();
+        }
+        catch {
+            body = null;
+        }
+        return response.ok ? { ok: true, body } : { ok: false, status: response.status, body, network: false };
+    }
+    catch {
+        return { ok: false, status: 0, body: null, network: true };
+    }
+    finally {
+        clearTimeout(deadline);
+    }
+}
+/** A refusal in the vendor's own words: its OAuth error label, never a body dump. */
+function explain(io, step, failure) {
+    if (failure.network) {
+        return { ok: false, reason: "wisprflow_unreachable", detail: `Could not reach Wispr Flow's sign-in during ${step}. Check the connection and try again.` };
+    }
+    const label = stringField(failure.body, "error");
+    const words = stringField(failure.body, "error_description");
+    log(io, "refused", { step, http_status: failure.status, oauth_error: label ?? "none" });
+    return {
+        ok: false,
+        reason: `wisprflow_${step.replace(/\s+/g, "_")}_refused`,
+        detail: `Wispr Flow refused the ${step} step (HTTP ${failure.status}${label ? `, ${label}` : ""}).`
+            + `${words ? ` It said: ${words.slice(0, 200)}` : ""}`
+            + " Nothing was connected.",
+    };
+}
+function stringField(body, name) {
+    if (typeof body !== "object" || body === null)
+        return null;
+    const value = body[name];
+    return typeof value === "string" && value.trim() !== "" ? value : null;
+}
+function numberField(body, name) {
+    if (typeof body !== "object" || body === null)
+        return null;
+    const value = body[name];
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+}

package/dist/commands/notes.js

@@ -45,10 +45,12 @@ import { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-
 import { runFolderCommand } from "./notes-folders.js";
 import { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, syncStatusNotetakers, } from "./notes-accounts.js";
 import { showGranolaStatus } from "./notes-granola-status.js";
+import { listRecordings, showRecording } from "./notes-recordings.js";
 export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 export { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
 export { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, syncStatusNotetakers, } from "./notes-accounts.js";
 export { showGranolaStatus } from "./notes-granola-status.js";
+export { listRecordings, showRecording } from "./notes-recordings.js";
 export { ask, emit, fail, sayUpload, sayScope, errorText, TAG, } from "./notes-door.js";
 export async function runNotes(command, io) {
     const session = await loadPairedSession("notes", command.homeDir);
@@ -98,6 +100,10 @@ export async function runNotes(command, io) {
             return syncNotetaker(command, door);
         case "sync-status":
             return syncStatusNotetakers(command, door);
+        case "recordings":
+            return listRecordings(command, door);
+        case "recording":
+            return showRecording(command, door);
         case "webhook":
             return armNotesWebhook(command, door);
         case "granola-status":