@bli-cockpit/cli 0.2.201 → 0.2.203

package/dist/commands/issue.js

@@ -29,12 +29,15 @@ import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor, } from "./ag
 import { writeLine } from "./cli-io.js";
 import { assigneeLabel, beginAssigneeDirectoryFetch, finishAssigneeDirectory, withAssigneeIdentity } from "./issue-directory.js";
 import { cacheAgeLabel, cacheCoverage, readThroughCache } from "./read-cache.js";
+import { readTicketBoard } from "./tickets-board.js";
 import { showIssue } from "./issue-show.js";
 import { READ_DEADLINE_MS, TAG, resolveProjectId, sizeForEstimate, withSizeLabel, } from "./issue-contracts.js";
 import { commentIssue, createIssue, moveIssue, updateIssue } from "./issue-write.js";
 export async function runIssue(command, io) {
     const door = await openAgentDoor("issue", command, io);
     switch (command.action) {
+        case "board":
+            return readTicketBoard(command, door);
         case "list":
             return listIssues(command, door);
         case "show":

package/dist/commands/local-args-tower-admin.js

@@ -293,9 +293,23 @@ export function parseTeamArgs(args) {
         json: values.booleans.has("--json"),
     };
     const [verb, ...rest] = values.positionals;
+    if (verb === "github-login") {
+        const [operation, personRef, githubLogin, ...extra] = rest;
+        if (!["add", "remove", "list"].includes(operation ?? "") || !personRef || extra.length ||
+            (operation === "list" ? githubLogin !== undefined : !githubLogin)) {
+            throw new Error("team github-login takes add|remove <person> <login>, or list <person>.");
+        }
+        return { kind: "team", action: `github-login-${operation}`, personRef, githubLogin, ...common };
+    }
     if (verb === "device") {
         return parseTeamDeviceArgs(rest, values.flags, common);
     }
+    if (verb === "grant" || verb === "revoke") {
+        const [person, section, level = "see", ...extra] = rest;
+        if (!person || section !== "careers" || !["see", "act"].includes(level) || extra.length)
+            throw new Error("team grant|revoke <person uuid> careers [see|act]");
+        return { kind: "team", action: verb, targetUserId: person, section: "careers", level: level, ...common };
+    }
     const [subject, ...extra] = rest;
     if (extra.length > 0)
         throw new Error("team does not accept that many arguments.");
@@ -321,7 +335,7 @@ export function parseTeamArgs(args) {
             throw new Error("team role needs --role <role>.");
         return { kind: "team", action: "role", targetUserId: subject, role, ...common };
     }
-    throw new Error("team takes one verb: members, invite, role, or device.");
+    throw new Error("team takes one verb: members, invite, role, grant, revoke, or device.");
 }
 /**
  * `cockpit team device [list] [--json]` or

package/dist/commands/local-args-tower-logs.js

@@ -22,6 +22,17 @@ export const LOGS_SOURCES = ["collector", "dashboard", "railway", "railway:<serv
 const LOCAL_SOURCE_PATTERN = /^(collector|dashboard|railway|railway:[A-Za-z0-9][A-Za-z0-9._-]{0,63}|-)$/;
 const SINCE_PATTERN = /^(\d{1,4}[smhd]|\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?(Z|[+-]\d{2}:\d{2})?)?)$/;
 export function parseLogsArgs(args) {
+    if (args[0] === "keys") {
+        const action = args[1];
+        const source = args[2];
+        if ((action !== "mint" && action !== "rotate") || !source)
+            throw new Error("Use cockpit logs keys mint|rotate <source>.");
+        const values = parseNamedArgs(args.slice(3), { allowedFlags: ["--json", "--home", "--dashboard-url"], valueFlags: ["--home", "--dashboard-url"] });
+        if (values.positionals.length)
+            throw new Error("Unexpected logs keys argument.");
+        return { kind: "logs", source, keyAction: action, stored: false, list: false, allLevels: false,
+            json: values.booleans.has("--json"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")) };
+    }
     const values = parseNamedArgs(args, {
         allowedFlags: ["--home", "--since", "--raw", "--limit", "--table", "--all-levels", "--stored", "--list", "--dashboard-url", "--json"],
         valueFlags: ["--home", "--since", "--raw", "--limit", "--table", "--dashboard-url"],

package/dist/commands/local-args-tower-memory.js

@@ -31,9 +31,11 @@
  * MCP server and three hooks) and these act on Tower. `memory-store.ts` runs
  * them; `parseMemoryArgs` in `local-args-collector-status.ts` routes to here.
  */
+import { parseMemoryMapArgs } from "./memory-map.js";
 import { parseMemoryRulesArgs } from "./memory-rules.js";
 import { optionalNonEmpty, optionalUrl, parseNamedArgs, workRootFlagValue, } from "./local-arg-values.js";
 export const MEMORY_STORE_ACTIONS = new Set([
+    "map",
     "rules",
     "knowledge",
     "search",
@@ -50,6 +52,8 @@ export const MEMORY_STORE_ACTIONS = new Set([
     // write a memory. It runs no pass and changes nothing — the pass is a
     // Railway cron; this is how a person or an agent asks what it did.
     "consolidation",
+    // BLI-13376: the originals behind a consolidated memory, one id.
+    "chain",
     "requeue",
 ]);
 const ALLOWED_FLAGS = [
@@ -89,6 +93,8 @@ const VALUE_FLAGS = [
     "--source",
 ];
 export function parseMemoryStoreArgs(action, args) {
+    if (action === "map")
+        return parseMemoryMapArgs(args);
     if (action === "rules" || action === "knowledge")
         return parseMemoryRulesArgs(args, action);
     const values = parseNamedArgs(args, { allowedFlags: ALLOWED_FLAGS, valueFlags: VALUE_FLAGS });
@@ -186,7 +192,7 @@ export function parseMemoryStoreArgs(action, args) {
     if (action === "consolidation") {
         return { ...command, action };
     }
-    if (action === "private" || action === "public") {
+    if (action === "private" || action === "public" || action === "chain") {
         // BLI-12927: one memory, named by the id `cockpit memory search` printed.
         const memoryId = optionalNonEmpty(rest[0]);
         if (!memoryId) {

package/dist/commands/local-args-tower-usage.js

@@ -1,15 +1,15 @@
 import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
 export function parseUsageArgs(args) {
-    const values = parseNamedArgs(args, { allowedFlags: ["--by-task", "--task", "--by-subject", "--subject", "--repo", "--session", "--from-window", "--min-confidence", "--by-topic", "--by-repo", "--person", "--all", "--since", "--until", "--include-automated", "--detail", "--home", "--dashboard-url", "--json"], valueFlags: ["--task", "--subject", "--repo", "--session", "--from-window", "--min-confidence", "--person", "--since", "--until", "--home", "--dashboard-url"] });
+    const values = parseNamedArgs(args, { allowedFlags: ["--by-task", "--task", "--by-subject", "--subject", "--tool", "--cursor", "--limit", "--repo", "--session", "--from-window", "--min-confidence", "--by-topic", "--by-repo", "--person", "--all", "--since", "--until", "--include-automated", "--detail", "--home", "--dashboard-url", "--json"], valueFlags: ["--task", "--subject", "--tool", "--cursor", "--limit", "--repo", "--session", "--from-window", "--min-confidence", "--person", "--since", "--until", "--home", "--dashboard-url"] });
     if (["--by-task", "--by-repo", "--by-topic", "--by-subject"].filter(flag => values.booleans.has(flag)).length > 1)
         throw new Error("--by-repo and --by-topic cannot be used together or with --by-subject or --by-task.");
     const minConfidence = values.flags.get("--min-confidence");
     if (minConfidence !== undefined && !["high", "medium", "low"].includes(minConfidence))
         throw new Error("--min-confidence accepts high, medium or low.");
     const action = values.positionals[0] ?? "people";
-    if (!["people", "sessions"].includes(action) || values.positionals.length > 1)
-        throw new Error("usage takes people or sessions.");
-    if (action === "sessions" && !values.flags.get("--subject") && !values.flags.get("--session") && !values.flags.get("--task"))
-        throw new Error("usage sessions requires --task, --subject or --session.");
-    return { byTask: values.booleans.has("--by-task"), task: optionalNonEmpty(values.flags.get("--task")), bySubject: values.booleans.has("--by-subject"), subject: optionalNonEmpty(values.flags.get("--subject")), repo: optionalNonEmpty(values.flags.get("--repo")), session: optionalNonEmpty(values.flags.get("--session")), fromWindow: optionalNonEmpty(values.flags.get("--from-window")), kind: "usage", ...(minConfidence ? { minConfidence: minConfidence } : {}), byTopic: values.booleans.has("--by-topic"), byRepo: values.booleans.has("--by-repo"), person: optionalNonEmpty(values.flags.get("--person")), all: values.booleans.has("--all"), action: action, since: optionalNonEmpty(values.flags.get("--since")) ?? "30d", until: optionalNonEmpty(values.flags.get("--until")), detail: values.booleans.has("--detail"), includeAutomated: values.booleans.has("--include-automated"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")), json: values.booleans.has("--json") };
+    if (!["people", "sessions", "session"].includes(action) || values.positionals.length > (action === "session" ? 2 : 1))
+        throw new Error("usage takes people, sessions or session <id>.");
+    if (action === "session" && !values.positionals[1])
+        throw new Error("usage session requires an id.");
+    return { byTask: values.booleans.has("--by-task"), task: optionalNonEmpty(values.flags.get("--task")), bySubject: values.booleans.has("--by-subject"), subject: optionalNonEmpty(values.flags.get("--subject")), repo: optionalNonEmpty(values.flags.get("--repo")), tool: optionalNonEmpty(values.flags.get("--tool")), cursor: optionalNonEmpty(values.flags.get("--cursor")), limit: optionalNonEmpty(values.flags.get("--limit")), session: action === "session" ? values.positionals[1] : optionalNonEmpty(values.flags.get("--session")), fromWindow: optionalNonEmpty(values.flags.get("--from-window")), kind: "usage", ...(minConfidence ? { minConfidence: minConfidence } : {}), byTopic: values.booleans.has("--by-topic"), byRepo: values.booleans.has("--by-repo"), person: optionalNonEmpty(values.flags.get("--person")), all: values.booleans.has("--all"), action: (action === "session" ? "sessions" : action), since: optionalNonEmpty(values.flags.get("--since")) ?? "30d", until: optionalNonEmpty(values.flags.get("--until")), detail: values.booleans.has("--detail"), includeAutomated: values.booleans.has("--include-automated"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")), json: values.booleans.has("--json") };
 }

package/dist/commands/local-args-tower-work.js

@@ -18,6 +18,7 @@
 import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, } from "./local-arg-values.js";
 import { estimateForSize } from "./issue-contracts.js";
 const ISSUE_ACTIONS = new Set([
+    "board",
     "list",
     "show",
     "create",
@@ -52,6 +53,8 @@ export function parseIssueArgs(args) {
             "--state",
             "--assignee",
             "--project",
+            "--label",
+            "--rows",
             "--limit",
             "--title",
             "--priority",
@@ -67,6 +70,8 @@ export function parseIssueArgs(args) {
             "--state",
             "--assignee",
             "--project",
+            "--label",
+            "--rows",
             "--limit",
             "--title",
             "--priority",
@@ -80,6 +85,12 @@ export function parseIssueArgs(args) {
     validateIssueState(moveState, "issue move state must be one of: ");
     const stateFilter = readIssueStateFilter(action, values);
     const title = readIssueTitle(action, values);
+    if (action !== "board" && (values.flags.has("--label") || values.flags.has("--rows"))) {
+        throw new Error("--label and --rows filter cockpit tickets board only.");
+    }
+    const boardProject = optionalNonEmpty(values.flags.get("--project"));
+    if (action === "board" && boardProject && !UUID_PATTERN.test(boardProject))
+        throw new Error("board --project requires a uuid.");
     const priority = readIssuePriority(values);
     const estimate = readIssueSize(values);
     const assignee = readIssueAssignee(action, values);
@@ -90,7 +101,7 @@ function readIssueAction(values) {
     const first = values.positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!ISSUE_ACTIONS.has(action)) {
-        throw new Error(`Unknown issue command: ${first}. Try list, show, create, update, move, comment, or history.`);
+        throw new Error(`Unknown issue command: ${first}. Try board, list, show, create, update, move, comment, or history.`);
     }
     return { action, rest: values.positionals.slice(first === undefined ? 0 : 1) };
 }
@@ -137,7 +148,7 @@ function validateIssueState(state, errorPrefix) {
 function readIssueStateFilter(action, values) {
     const stateFilter = optionalNonEmpty(values.flags.get("--state"));
     validateIssueState(stateFilter, "--state must be one of: ");
-    if (stateFilter !== undefined && action !== "list") {
+    if (stateFilter !== undefined && action !== "list" && action !== "board") {
         throw new Error("--state filters `cockpit issue list`; to move an issue use `cockpit issue move <id> <state>`.");
     }
     return stateFilter;
@@ -173,7 +184,7 @@ function readIssueAssignee(action, values) {
     if (assignee !== undefined && assignee !== "me" && assignee !== "unassigned" && !UUID_PATTERN.test(assignee)) {
         throw new Error('--assignee must be "me", "unassigned", or a person\'s uuid (see `cockpit team`).');
     }
-    if (assignee === "unassigned" && action !== "list") {
+    if (assignee === "unassigned" && action !== "list" && action !== "board") {
         throw new Error('--assignee unassigned filters `cockpit issue list`; to clear an assignee pass --assignee "" is not supported yet.');
     }
     return assignee;
@@ -196,6 +207,8 @@ function buildIssueCommand(values, action, issueRef, issueRefs, moveState, state
         ...(moveState ? { moveState } : {}),
         ...(stateFilter ? { stateFilter } : {}),
         ...(assignee ? { assignee } : {}),
+        label: optionalNonEmpty(values.flags.get("--label")),
+        rows: optionalNonEmpty(values.flags.get("--rows")),
         project: optionalNonEmpty(values.flags.get("--project")),
         ...(limit === undefined ? {} : { limit }),
         title,

package/dist/commands/local-help-commands-tower-ops.js

@@ -41,7 +41,8 @@ export const TOWER_OPS_COMMAND_HELP = [
             "project unknown_project, since_exceeds_retention, stored_read_failed, not_paired, ...",
             "--json writes one object to stdout: { ok, kind, source, window, lines, templates[], routine, notes, text, measure };",
             "a refusal is { ok: false, error, detail } and exits 1. Run list and teaching: docs/runbooks/tower-logs.md.",
-            "The bli-tower MCP server has the twin: logs_digest.",
+            "cockpit logs keys mint|rotate <source> [--json]: super admin only; prints the source ingest key once. Rotation invalidates the old key.",
+            "The bli-tower MCP server has the twins: logs_digest and logs_key_mint.",
         ],
     ],
     [

package/dist/commands/local-help-commands-tower.js

@@ -93,10 +93,11 @@ export const TOWER_COMMAND_HELP = [
     [
         "issue",
         [
-            "Usage: cockpit issue [list|show <id> [<id>...]|create|update <id>|move <id> <state>|comment <id>|history <id>] [flags]",
+            "Usage: cockpit issue [board|list|show <id> [<id>...]|create|update <id>|move <id> <state>|comment <id>|history <id>] [flags]",
             "",
             "Tower's issue tracker. <id> is a BLI-#### identifier (BLI-3654) or an issue's uuid — both work everywhere an issue is named.",
             "list [--state <s>] [--assignee me|unassigned|<uuid>] [--project <name|id>] [--limit <n>] — the issues you may see, most recently updated first. Each row carries assignee_name/assignee_email alongside the bare assignee_id (BLI-10450, one extra `cockpit team members` call for the whole page, never per row), and a `size` label (S/M/L) alongside the raw `estimate` when it matches Tower's own scale (BLI-10575). --json shape: { issues: [{ id, identifier, title, state, priority, estimate, size, assignee_id, assignee_name, assignee_email, project_id, parent_id, updated_at }] }.",
+            "board [--json] [--state <s>] [--assignee me|unassigned|<uuid>] [--project <uuid>] [--label <name>] [--rows <state:n,...>] — the Tickets board, counts, coverage and top five cards per column, through GET /api/work/board. Also cockpit tickets board.",
             "show <id> [<id>...] — one or more issues: title, state, priority, size, assignee (name and email, not just its id), description, and every comment on each. Several ids read in one call — one bad id never loses the rest.",
             "  --json shape: one id answers { issue, comments }, unchanged from before BLI-10450 (plus `estimate`/`size`, BLI-10575). Several ids answer { issues: [{ ref, ok, issue, comments } | { ref, ok: false, error, detail }] }.",
             "create --title \"<title>\" [--project <name|id>] [--priority 0-4] [--size S|M|L] [--assignee me|<uuid>] [--parent <id>] [--file <path>] — the DESCRIPTION comes from --file or stdin (`cat plan.md | cockpit issue create --title \"...\"`); neither means no description. --size maps onto the existing `estimate` column, Tower's own scale: S=1, M=3, L=5 (BLI-10575) — an estimate outside that scale (an imported Linear point value, say) just has no size label on a read. --json shape: { issue }.",
@@ -189,7 +190,7 @@ export const TOWER_COMMAND_HELP = [
             "(nearest rank). Also the HTTP status, the response size and the door's own Server-Timing total.",
             "Slowest first. A page your account may not open (Careers for a member) reads \"not permitted\", not as a failure.",
             "--page <name> limits the run to one page; repeat it for several. Names: today, meeting-notes, careers, scout,",
-            "messages, mail, docs, memory, tickets, setup, usage, calendar, workbook, settings.",
+            "messages, mail, docs, memory-knowledge, memory-rules, tickets, tickets-list, setup, usage, calendar, workbook, settings.",
             "--runs <n> sets the requests per page (default 5, at most 50).",
             "--json writes one object to stdout ({ ok, runs, pages: [...] }); every log line stays on stderr.",
             "It times the DATA DOOR the page opens on, not the page's HTML or paint, and it never uses the local read cache.",
@@ -207,8 +208,8 @@ export const TOWER_COMMAND_HELP = [
         "usage",
         [
             "Usage: cockpit usage people [--by-repo | --by-topic | --by-subject | --by-task] [--min-confidence high|medium|low] [--person <email|me>] [--all] [--since <n>d|<n>h|<iso>] [--detail] [--until <iso>] [--include-automated] [--json]",
-            "  cockpit usage sessions [--task <BLI-NNNN> | --subject <name>] [--repo <label>] [--since <window>] [--json]",
-            "  cockpit usage sessions --session <id> [--from-window <n>] [--json]",
+            "  cockpit usage sessions [--person <exact-name>] [--task <BLI-NNNN> | --subject <name>] [--repo <label>] [--tool claude|codex] [--since <window>] [--until <iso>] [--cursor <cursor>] [--limit <n>] [--json]",
+            "  cockpit usage session <id> [--from-window <n>] [--json]",
             "  --by-topic groups work types; --by-subject groups open subjects from session summaries.",
             "",
             "--by-topic adds topic rows, including (unlabelled). Choose only one grouping. --by-repo adds project rows under each person (top 10; --all shows every repo). --person me uses your signed-in email.",
@@ -406,8 +407,10 @@ export const TOWER_COMMAND_HELP = [
     [
         "memory",
         [
-            "Usage: cockpit memory [rules|search|save|update|forget|private|public|profile|consolidation|requeue|install|status|log] [flags]",
+            "Usage: cockpit memory [map|knowledge|rules|search|save|update|forget|private|public|profile|consolidation|chain|requeue|install|status|log] [flags]",
             "",
+            "  map [--json] — projects, topics, memory counts and importance from the shared map.",
+            "  knowledge [--person <name>] [--project <name>] [--by-project] [--limit <n>] [--json] — ranked project ideas.",
             "  rules [--person <name>] [--project <name>] [--limit <n>] [--json] — standing rules grouped by person.",
             "The STORE, over the same /api/memory/* doors the bli-memory MCP server calls:",
             "  search \"<question>\" [--container <tag>] [--limit 1..20] [--no-recent]",
@@ -432,6 +435,8 @@ export const TOWER_COMMAND_HELP = [
             "      Clusters looked at, edits by verb, refusals by reason, model and cost.",
             "      Read-only: the pass is a nightly cron, it never deletes a memory, and",
             "      report mode changes nothing on the shelf at all.",
+            "  chain <id>   the originals behind a consolidated memory (\"from 4 memories by Edward, Vee\").",
+            "      Private originals show only to their owner or a super admin; the rest are counted.",
             "  requeue --since <iso> [--until <iso>] [--source hook|harvest] [--reason <label>] [--apply]",
             "      puts finished extractions back in the queue after the store refused their",
             "      writes. Super admins only. A DRY RUN unless you pass --apply, because an",

package/dist/commands/local-help-commands.js

@@ -184,15 +184,21 @@ export function localSubcommandHelp(command) {
         [
             "team",
             [
-                "Usage: cockpit team [members | invite <email> --role <role> | role <userId> --role <role> | device [list] | device revoke <id|name> --reason <label>] [--json]",
+                "Usage: cockpit team [members | invite <email> --role <role> | role <userId> --role <role> | grant|revoke <person> careers [see|act] | device [list] | device revoke <id|name> --reason <label>] [--json]",
                 "",
                 "  cockpit team [members]",
                 "      Everyone on your team — roster and accounts together, with each person's id.",
                 "      Open to every role; it says so when the view is read-only for you.",
+                "  cockpit team github-login add|remove <person> <login> [--json] — exact roster UUID, name or email; super admin or a member managing their own extra logins. History stays.",
+                "  cockpit team github-login list <person> [--json] — primary and extra GitHub logins.",
                 "  cockpit team invite <email> --role <role> [--team-id <uuid>]",
                 "      Admin only. Defaults to your own team; Tower emails them a sign-in link.",
                 "  cockpit team role <userId> --role <role> [--yes]",
                 "      Admin only. Asks first unless --yes. You cannot change your own role.",
+                "  cockpit team grant <person-uuid> careers [see|act] [--json]",
+                "  cockpit team revoke <person-uuid> careers [see|act] [--json]",
+                "      Super admins manage separate See and Act grants. Default level: see.",
+                "      Find the account uuid with cockpit team members --json. Revocation retains history.",
                 "  cockpit team device [list] [--json]",
                 "  cockpit team device doctor <id|name> [--json]",
                 "      Every paired collector device: name, id, trust state, owner, and why",

package/dist/commands/local-help.js

@@ -113,6 +113,7 @@ export function localCommandHelp(command) {
         "  cockpit ops [status [--job <id>] [--skips] [--memory] [--models] | recompile --person <email|name|id> [--dry-run]] [--dashboard-url <url>] [--json]",
         "  cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [--person <p>] [--channel <c>] [--query <text> [--word]] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--format compact|full]] [--json]",
         "  cockpit settings [personal [--chat-model <key>] [--brief-model <key>] | switches [set <key> <value>] | models [set --chat <key>] [--memory <id>] | cli-floor [<version>] | env list|set --project <p> --file <f> --content-stdin|delete --id <uuid> [--yes]] [--json]",
+        "  cockpit team github-login add|remove <person> <login> | list <person> [--json]",
         "  cockpit team [members | invite <email> --role <role> [--team-id <uuid>] | role <userId> --role <role> [--yes] | device [list] | device revoke <id|name> --reason <label> [--note \"<text>\"] [--yes]] [--json]",
         "  cockpit workbook [<project> [<doc>]] [--section <id>] [--markdown] [--width <n>] [--dashboard-url <url>] [--json]",
         "  cockpit brief [edit|rewrite|history] [--for <person>] [--date <YYYY-MM-DD>] [--delta [--against <YYYY-MM-DD>]] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--days <n>] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
@@ -145,8 +146,8 @@ export function localCommandHelp(command) {
         "  cockpit logs <collector|dashboard|railway|railway:<service>|-> [--since 15m|1h|2d|<iso>] [--raw <template-id> [--limit <n>]] [--all-levels] [--table <file>] [--json]",
         "  cockpit brain status [--project <id>] [--show open|running|needs_human|fixed|not_actionable|cleared] [--dashboard-url <url>] [--json]",
         "  cockpit setup [--since <7d|30d|date>] [--details] [--person <name|email>] [--compare <name,name>] [--json]",
-        "  cockpit usage sessions [--task <BLI-NNNN> | --subject <name>] [--repo <label>] [--since <window>] [--json]",
-        "  cockpit usage sessions --session <id> [--from-window <n>] [--json]",
+        "  cockpit usage sessions [--person <exact-name>] [--task <BLI-NNNN> | --subject <name>] [--repo <label>] [--tool claude|codex] [--since <window>] [--until <iso>] [--cursor <cursor>] [--limit <n>] [--json]",
+        "  cockpit usage session <id> [--from-window <n>] [--json]",
         "  --by-topic groups work types; --by-subject groups open subjects from session summaries.",
         "  cockpit ticket [same verbs and flags as cockpit issue]   (the Tickets page; projects: `cockpit project list`)",
         "  cockpit tickets ...   same as cockpit ticket",

package/dist/commands/logs.js

@@ -14,6 +14,7 @@
  */
 import { readFile } from "node:fs/promises";
 import { ClassTable, LOCAL_ACCESS_REFUSALS, digestSource } from "@bli-cockpit/telemetry-core/log-digest";
+import { asRecord, callTower, openTower, writeCommandFailure } from "./tower-command.js";
 import { getCollectorRuntimePaths } from "../local-state-paths.js";
 import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
 import { runStoredLogs, storedProject } from "./logs-stored.js";
@@ -28,6 +29,15 @@ function refuse(io, json, reason, detail) {
     return 1;
 }
 export async function runLogs(command, io, deps = {}) {
+    if (command.keyAction) {
+        const tower = await openTower("logs keys", command, io);
+        const result = await callTower(tower, { path: "/api/settings/log-ingest-keys", method: "POST", body: { source: command.source, action: command.keyAction }, label: "logs keys" });
+        if (!result.ok)
+            return writeCommandFailure(io, command.json, result);
+        // Deliberate one-time credential output; never stderr, cache or log.
+        writeLine(io.stdout, command.json ? JSON.stringify(result.body) : String(asRecord(result.body).key));
+        return 0;
+    }
     // BLI-12855: a project name (or --stored, or --list) reads the digests Tower's cron stored, not a local log.
     const stored = storedProject(command);
     if (command.list || stored)

package/dist/commands/memory-chain.js

@@ -0,0 +1,55 @@
+/**
+ * `cockpit memory chain <id>` (BLI-13376): the memories the nightly
+ * consolidation folded into this one.
+ *
+ * A READ over `GET /api/memory/chain?id=<id>`, the same door the
+ * `memory_chain` MCP tool calls, with this machine's device token. The door
+ * decides what you may see: a private original shows only to its owner or a
+ * super admin, and the rest are counted ("1 private original not shown"),
+ * never printed. This verb prints the door's answer and its reason labels and
+ * writes nothing.
+ */
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[memory cli]";
+const READ_DEADLINE_MS = 30_000;
+export async function runMemoryChain(command, door) {
+    if (!command.memoryId) {
+        return failAgentDoor(door, TAG, "id_required", "memory chain needs the memory id `cockpit memory search` printed.");
+    }
+    const answer = await askAgentDoor(door, {
+        path: `/api/memory/chain?id=${encodeURIComponent(command.memoryId)}`,
+        method: "GET",
+        label: "memory chain",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    const originals = body.originals ?? [];
+    // Counts only: a memory's text never enters a log line.
+    writeLine(door.io.stderr, `${TAG} chain ${JSON.stringify({
+        consolidated: body.consolidated ?? false, count: body.count ?? 0, shown: originals.length,
+        hidden_private: body.hiddenPrivate ?? 0, hidden_forgotten: body.hiddenForgotten ?? 0, missing: body.missing ?? 0,
+    })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    if (!body.consolidated) {
+        writeLine(door.io.stdout, `Memory ${command.memoryId} was not written by the nightly consolidation, so it has no originals.`);
+        return 0;
+    }
+    const by = (body.people ?? []).length > 0 ? ` by ${(body.people ?? []).join(", ")}` : "";
+    writeLine(door.io.stdout, `Memory ${command.memoryId} is from ${body.count ?? originals.length} ${body.count === 1 ? "memory" : "memories"}${by}.`);
+    for (const original of originals) {
+        writeLine(door.io.stdout, `  [${(original.createdAt ?? "").slice(0, 10)}]${original.project ? ` [${original.project}]` : ""}${original.savedBy ? ` ${original.savedBy}:` : ""} ${original.text ?? ""}`);
+    }
+    const hiddenPrivate = body.hiddenPrivate ?? 0;
+    if (hiddenPrivate > 0)
+        writeLine(door.io.stdout, `${hiddenPrivate} private ${hiddenPrivate === 1 ? "original" : "originals"} not shown.`);
+    const gone = (body.hiddenForgotten ?? 0) + (body.missing ?? 0);
+    if (gone > 0)
+        writeLine(door.io.stdout, `${gone} ${gone === 1 ? "original is" : "originals are"} no longer available.`);
+    if (body.truncated)
+        writeLine(door.io.stdout, "Only the first originals are listed.");
+    return 0;
+}

package/dist/commands/memory-consolidation.js

@@ -54,6 +54,14 @@ export async function runMemoryConsolidation(command, door) {
             : "No consolidation runs are visible to this account. The receipts are readable by a super_admin; this is the access rule answering, not an outage.");
         return 0;
     }
+    if (body.night && body.nightLine) {
+        // Last night first (BLI-13376): one line for the whole night, then a row per scope.
+        writeLine(door.io.stdout, body.nightLine);
+        writeLine(door.io.stdout, nightTable(body.nightScopes ?? []));
+        writeLine(door.io.stdout, "");
+        writeLine(door.io.stdout, "merged/rewritten/corrected are what an apply run wrote, or what a report run only proposed (mode column). kept is always a proposal. Nothing is ever deleted. `--json` has every run.");
+        return 0;
+    }
     for (const run of runs) {
         writeLine(door.io.stdout, `${run.containerTag ?? "(no tag)"}  ${run.mode ?? "?"}`);
         writeLine(door.io.stdout, `    ${run.startedAt ?? "?"} -> ${run.finishedAt ?? "unfinished"}  ${run.reason ?? "no reason recorded"}`);
@@ -80,4 +88,31 @@ function countsOf(value) {
 }
 function moneyOf(value) {
     return value === null || value === undefined ? "$0.000000" : `$${Number(value).toFixed(6)}`;
+}
+const NIGHT_HEADERS = ["scope", "mode", "clusters", "merged", "rewritten", "corrected", "kept", "refused", "cross-person", "cost"];
+/** Aligned columns: the scope key first (left), every count after it (right). */
+function nightTable(scopes) {
+    const rows = scopes.map((scope) => [
+        scope.label ?? scope.containerTag ?? "(no tag)",
+        scope.mode ?? "?",
+        String(scope.clusters ?? 0),
+        String(scope.merged ?? 0),
+        String(scope.rewritten ?? 0),
+        String(scope.corrected ?? 0),
+        String(scope.kept ?? 0),
+        refusedCell(scope),
+        String(scope.crossPersonClusters ?? 0),
+        moneyOf(scope.costUsd),
+    ]);
+    const widths = NIGHT_HEADERS.map((header, column) => Math.max(header.length, ...rows.map((row) => row[column].length)));
+    const render = (cells) => cells.map((cell, column) => (column <= 1 ? cell.padEnd(widths[column]) : cell.padStart(widths[column]))).join("  ").trimEnd();
+    return [render(NIGHT_HEADERS), ...rows.map(render)].join("\n");
+}
+/** `7 (stale 4, empty 3)`: the total, then the biggest labels. */
+function refusedCell(scope) {
+    const total = scope.refused ?? 0;
+    if (total === 0)
+        return "0";
+    const labels = (scope.topRefused ?? []).map((item) => `${item.label} ${item.count}`).join(", ");
+    return labels ? `${total} (${labels})` : String(total);
 }

package/dist/commands/memory-map.js

@@ -0,0 +1,29 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+/** The map takes no filters: the backend answers with the caller's visible projects and topics. */
+export function parseMemoryMapArgs(args) {
+    const values = parseNamedArgs(args, { allowedFlags: ["--json", "--home", "--dashboard-url"], valueFlags: ["--home", "--dashboard-url"] });
+    if (values.positionals.slice(1).length)
+        throw new Error("memory map takes no positionals.");
+    return { kind: "memory-store", action: "map", containerTags: [], json: values.booleans.has("--json"),
+        homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")) };
+}
+export async function runMemoryMap(door) {
+    const answer = await askAgentDoor(door, { method: "GET", path: "/api/memory/map", label: "memory map", timeoutMs: 60_000 });
+    if (!answer.ok)
+        return failAgentDoor(door, "[memory map cli]", answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(door.io.stderr, `[memory map cli] answered ${JSON.stringify({ reason: body.capped ? "capped" : "exhausted", examined: body.examined, total: body.total })}`);
+    if (door.json)
+        return emitAgentDoor(door, body);
+    for (const project of body.projects) {
+        writeLine(door.io.stdout, `${project.project} (${project.count} memories)`);
+        for (const topic of project.topics)
+            writeLine(door.io.stdout, `  ${topic.label}: ${topic.count}${topic.averageImportance === null ? " (unscored)" : ` (importance ${Math.round(topic.averageImportance)}/100)`}`);
+    }
+    writeLine(door.io.stdout, `${body.examined} of ${body.total} visible memories counted; as of ${body.computedAt}.${body.capped ? " Scan capped at 10,000." : ""}`);
+    if (!body.projects.length)
+        writeLine(door.io.stdout, "No project knowledge yet.");
+    return 0;
+}

package/dist/commands/memory-rules.js

@@ -1,19 +1,66 @@
 import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
 import { writeLine } from "./cli-io.js";
 import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+/** A whole number inside a range, or a refusal that names the flag. */
+function boundedNumber(flag, raw, max) {
+    if (raw === undefined)
+        return undefined;
+    if (!/^\d+$/.test(raw) || Number(raw) < 1 || Number(raw) > max)
+        throw new Error(`${flag} must be between 1 and ${max}.`);
+    return Number(raw);
+}
 export function parseMemoryRulesArgs(args, action = "rules") {
-    const values = parseNamedArgs(args, { allowedFlags: ["--person", "--project", "--limit", "--json", "--by-project", "--home", "--dashboard-url"],
-        valueFlags: ["--person", "--project", "--limit", "--home", "--dashboard-url"] });
+    const values = parseNamedArgs(args, { allowedFlags: ["--person", "--project", "--limit", "--per-project", "--json", "--by-project", "--machine", "--home", "--dashboard-url"],
+        valueFlags: ["--person", "--project", "--limit", "--per-project", "--home", "--dashboard-url"] });
     if (values.positionals.slice(1).length)
         throw new Error(`memory ${action} takes no positionals; use --person and --project.`);
-    const raw = values.flags.get("--limit");
-    if (raw !== undefined && (!/^\d+$/.test(raw) || Number(raw) < 1 || Number(raw) > 1000))
-        throw new Error("--limit must be between 1 and 1000.");
-    return { kind: "memory-store", action, byProject: values.booleans.has("--by-project"), containerTags: [],
+    return { kind: "memory-store", action, byProject: values.booleans.has("--by-project"), machine: values.booleans.has("--machine"), containerTags: [],
         person: optionalNonEmpty(values.flags.get("--person")), project: optionalNonEmpty(values.flags.get("--project")),
-        limit: raw === undefined ? undefined : Number(raw), json: values.booleans.has("--json"),
+        limit: boundedNumber("--limit", values.flags.get("--limit"), 1000), perProject: boundedNumber("--per-project", values.flags.get("--per-project"), 100),
+        json: values.booleans.has("--json"),
         homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")) };
 }
+/** " (from 4 memories by Edward, Vee)" for a memory the nightly pass wrote (BLI-13376); empty otherwise. */
+function originOf(idea) {
+    const c = idea.consolidated;
+    return c ? ` (from ${c.count} ${c.count === 1 ? "memory" : "memories"}${c.people.length ? ` by ${c.people.join(", ")}` : ""})` : "";
+}
+/** The sentence a person reads: the plain one, or the machine wording marked as the original when no plain one was written yet. */
+function personWording(idea) {
+    return (idea.human_text ? idea.human_text : `${idea.text} (original wording)`) + originOf(idea);
+}
+/** What an agent reads: the machine wording, how many times it was said, its score and its space. */
+function agentWording(idea) {
+    const said = (idea.repetition ?? 1) > 1 ? ` (said ${idea.repetition} times)` : "";
+    const score = idea.importance === null || idea.importance === undefined ? "" : ` [importance ${idea.importance}/100]`;
+    return `${idea.text}${originOf(idea)}${said}${score}${idea.container ? ` (space: ${idea.container})` : ""}`;
+}
+function printHeader(body, write) {
+    for (const line of [body.words?.summary, body.words?.ranking, body.freshness?.words])
+        if (line)
+            write(line);
+    for (const note of body.notes ?? [])
+        write(note);
+}
+function printProjects(groups, machine, write) {
+    for (const group of groups) {
+        write("");
+        write(`${group.project}, ${group.count.toLocaleString("en-US")} memories`);
+        const topics = group.topics ?? [];
+        // Topic headings help only when topics rank the ideas; a lone "Other" heading is noise.
+        const headed = Boolean(group.ranked) && topics.length > 1;
+        if (topics.length)
+            for (const topic of topics) {
+                if (headed)
+                    write(`  ${topic.title}`);
+                for (const idea of topic.memories)
+                    write(`${headed ? "    " : "  "}${machine ? agentWording(idea) : personWording(idea)}`);
+            }
+        else
+            for (const idea of group.memories ?? [])
+                write(`  ${machine ? agentWording(idea) : personWording(idea)}`);
+    }
+}
 export async function runMemoryRules(command, door) {
     const params = new URLSearchParams();
     if (command.person)
@@ -22,33 +69,32 @@ export async function runMemoryRules(command, door) {
         params.set("project", command.project);
     if (command.limit !== undefined)
         params.set("limit", String(command.limit));
+    if (command.perProject !== undefined)
+        params.set("per_project", String(command.perProject));
     const answer = await askAgentDoor(door, { path: `/api/memory/${command.action}${params.size ? `?${params}` : ""}`,
         method: "GET", label: `memory ${command.action}`, timeoutMs: 60_000 });
     if (!answer.ok)
         return failAgentDoor(door, "[memory cli]", answer.reason, answer.detail);
     const body = answer.body;
-    writeLine(door.io.stderr, `[memory cli] ${command.action} ${JSON.stringify({ reason: body.capped ? "capped" : "exhausted", returned: body.returned, groups: body.projectGroups?.length ?? body.groups?.length ?? 0 })}`);
+    const projects = body.projectGroups?.length ?? 0;
+    writeLine(door.io.stderr, `[memory cli] ${command.action} ${JSON.stringify({ reason: body.capped ? "capped" : "exhausted", returned: body.returned, projects,
+        groups: projects || (body.groups?.length ?? 0), per_project: command.perProject ?? body.perProject ?? null, machine: Boolean(command.machine) })}`);
+    // JSON is the whole answer, untouched: both wordings, every field. --machine only changes the human text.
     if (door.json)
         return emitAgentDoor(door, answer.body);
-    if (command.byProject || command.action === "knowledge") {
-        for (const group of body.projectGroups ?? []) {
-            writeLine(door.io.stdout, `${group.project} (${group.count}) : ${group.headline.split("\n")[0]}`);
-            for (const topic of group.topics) {
-                writeLine(door.io.stdout, `  ${topic.title}`);
-                for (const memory of topic.memories)
-                    writeLine(door.io.stdout, `    ${memory.text}${memory.repetition > 1 ? ` (said ${memory.repetition} times)` : ""}${memory.importance !== null ? ` [importance ${memory.importance}/100]` : ""}`);
-            }
-        }
-    }
+    const write = (line) => writeLine(door.io.stdout, line);
+    printHeader(body, write);
+    if (projects)
+        printProjects(body.projectGroups ?? [], Boolean(command.machine), write);
     else
-        for (const group of body.groups) {
-            writeLine(door.io.stdout, group.owner);
+        for (const group of body.groups ?? []) {
+            write(group.owner);
             for (const rule of group.rules)
-                writeLine(door.io.stdout, `  [${rule.created_at.slice(0, 10)}] ${rule.project ? `[${rule.project}] ` : ""}${rule.text}${group.owner === "unattributed" ? ` (space: ${rule.container})` : ""}`);
+                write(`  [${rule.created_at.slice(0, 10)}] ${rule.project ? `[${rule.project}] ` : ""}${command.machine ? rule.text : personWording(rule)}`);
         }
     if (!body.returned)
-        writeLine(door.io.stdout, `No ${command.action === "knowledge" ? "project knowledge" : "ground rules"} matched.`);
+        write(`No ${command.action === "knowledge" ? "project knowledge" : "ground rules"} matched.`);
     if (body.capped)
-        writeLine(door.io.stdout, "Result capped. Narrow by person or project, or increase --limit (max 1000).");
+        write("Result capped. Narrow by person or project, or raise --limit (max 1000) or --per-project (max 100).");
     return 0;
 }

package/dist/commands/memory-store.js

@@ -1,5 +1,5 @@
 /**
- * `cockpit memory search|save|update|forget|profile|consolidation|requeue` —
+ * `cockpit memory search|save|update|forget|profile|consolidation|chain|requeue` —
  * BLI Memory at a terminal (BLI-4047; `profile` added by BLI-4533,
  * `consolidation` by BLI-4534 and `requeue` by BLI-4539, the last two running
  * in `memory-consolidation.ts` and `memory-requeue.ts` next door).
@@ -42,12 +42,14 @@
  * `ps` shows an argument list, shell history keeps it, and a memory with a
  * newline in it cannot be quoted correctly anyway.
  */
+import { runMemoryMap } from "./memory-map.js";
 import { runMemoryRules } from "./memory-rules.js";
 import { memoryProjectPrefix } from "./memory-project-label.js";
 import { memorySaveOutsideRoots } from "@bli-cockpit/memory-mcp/dist/recorded-outside-roots.js";
 import { resolveContainerTag } from "@bli-cockpit/memory-mcp/dist/container-tag.js";
 import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor, } from "./agent-door.js";
 import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
+import { runMemoryChain } from "./memory-chain.js";
 import { runMemoryConsolidation } from "./memory-consolidation.js";
 import { cacheAgeLabel, cacheCoverage, readThroughCache } from "./read-cache.js";
 import { runMemoryRequeue } from "./memory-requeue.js";
@@ -65,6 +67,8 @@ const FORGET_MAX_CHARS = 10_000;
 export async function runMemoryStore(command, io) {
     const door = await openAgentDoor("memory", command, io);
     switch (command.action) {
+        case "map":
+            return runMemoryMap(door);
         case "knowledge":
         case "rules":
             return runMemoryRules(command, door);
@@ -79,14 +83,13 @@ export async function runMemoryStore(command, io) {
         case "profile":
             return profileMemory(command, door);
         case "consolidation":
-            // BLI-4534. Its own module: it reads a different door, prints a
-            // different shape, and is the only memory verb that is about the JOB
-            // rather than about a memory.
+            // BLI-4534. Its own module: a different door and shape, about the JOB.
             return runMemoryConsolidation(command, door);
         case "requeue":
-            // Its own module too: a window-shaped, super-admin, dry-run-by-default
-            // verb that refuses nothing the others refuse (BLI-4539).
+            // Its own module: window-shaped, super-admin, dry-run by default (BLI-4539).
             return runMemoryRequeue(command, io);
+        case "chain":
+            return runMemoryChain(command, door);
         case "private":
         case "public":
             // BLI-12927: the narrowing switch. Its own module, so this file stays

package/dist/commands/memory-verb-list.js

@@ -26,7 +26,7 @@ export function runMemoryVerbList(io, json) {
             ok: true,
             noun: "memory",
             machine_verbs: ["install", "status"],
-            store_verbs: ["rules", "knowledge", "search", "save", "update", "forget", "private", "public", "profile", "consolidation", "requeue"],
+            store_verbs: ["rules", "knowledge", "search", "save", "update", "forget", "private", "public", "profile", "consolidation", "chain", "requeue"],
             log_verbs: ["log"],
         }));
         return 0;
@@ -44,12 +44,18 @@ export function runMemoryVerbList(io, json) {
         "      you can forget or update only your own memories (a super admin, any)",
         "  cockpit memory private <id> [--json]       only you and super admins can read this memory",
         "  cockpit memory public <id> [--json]        every member can read it again (how every memory starts)",
-        "  cockpit memory rules [--person <name>] [--project <name-or-slug>] [--by-project] [--limit <n>] [--json]",
-        "  cockpit memory knowledge [--person <name>] [--project <name-or-slug>] [--by-project] [--limit <n>] [--json]",
+        "  cockpit memory map [--json]",
+        "  cockpit memory rules [--person <name>] [--project <name-or-slug>] [--limit <n>] [--per-project <n>] [--machine] [--json]",
+        "  cockpit memory knowledge [--person <name>] [--project <name-or-slug>] [--limit <n>] [--per-project <n>] [--machine] [--json]",
+        "      plain sentences per project; --per-project 1..100 (default 15) is each project's own",
+        "      quota, --limit 1..1000 caps the ideas in all; --machine prints the agent wording with",
+        "      scores and spaces; --json is the whole answer, both wordings (--by-project is accepted)",
         "  cockpit memory profile [--container <tag>] [--json]",
         "      the compiled one-page briefing every session opens with; a read, never a compile",
         "  cockpit memory consolidation [--container <tag>] [--json]",
         "      what the nightly tidy-up pass did: clusters, edits by verb, refusals, cost",
+        "  cockpit memory chain <id> [--json]",
+        "      the memories the nightly pass folded into this one: who, when, what they said",
         "  cockpit memory requeue --since <iso> [--until <iso>] [--source hook|harvest] [--reason <label>] [--apply] [--json]",
         "      put a window of finished extractions back in the queue after the store refused",
         "      their writes; super admins only, and a DRY RUN unless you pass --apply",

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.201");
+    writeLine(io?.stdout ?? process.stdout, "0.2.203");
     return 0;
   }
 

package/dist/commands/speed-pages.js

@@ -11,8 +11,8 @@
  * (`packages/bli-cockpit-mcp/src/speed-tools.ts`) carries its own copy, and a
  * test in that package fails when the two lists drift.
  */
-/** The pages in rail order. `memoryContainer` is the tag `cockpit memory profile` would use here. */
-export function speedPages(memoryContainer) {
+/** The pages in rail order; Memory has one data door per tab. */
+export function speedPages(_memoryContainer) {
     return [
         { name: "today", label: "Today (JARVIS home)", path: "/api/jarvis/brief" },
         { name: "meeting-notes", label: "Meeting notes", path: "/api/notes/library" },
@@ -21,13 +21,10 @@ export function speedPages(memoryContainer) {
         { name: "messages", label: "Messages", path: "/api/msg/channels" },
         { name: "mail", label: "Mail", path: "/api/mail/inbox" },
         { name: "docs", label: "Docs", path: "/api/docs/tree" },
-        {
-            name: "memory",
-            label: "Memory",
-            path: `/api/memory/profile?container=${encodeURIComponent(memoryContainer)}`,
-            note: "the page reads agent_memories on the server; the profile door is the nearest read",
-        },
-        { name: "tickets", label: "Tickets", path: "/api/work/issues" },
+        { name: "memory-knowledge", label: "Memory knowledge", path: "/api/memory/knowledge" },
+        { name: "memory-rules", label: "Memory rules", path: "/api/memory/rules" },
+        { name: "tickets", label: "Tickets", path: "/api/work/board" },
+        { name: "tickets-list", label: "Tickets list", path: "/api/work/issues" },
         { name: "setup", label: "Setup", path: "/api/setup" },
         { name: "usage", label: "Usage", path: "/api/usage/people?since=30d" },
         { name: "calendar", label: "Calendar", path: "/api/cal/week" },

package/dist/commands/team.js

@@ -23,10 +23,14 @@ import { confirmDestructive } from "./settings.js";
 import { asRecord, callTower, openTower, writeCommandFailure, } from "./tower-command.js";
 export async function runTeam(command, io) {
     const tower = await openTower("team", command, io);
+    if (command.action.startsWith("github-login-"))
+        return githubLogin(command, tower, io);
     if (command.action === "members")
         return showMembers(command, tower, io);
     if (command.action === "invite")
         return invite(command, tower, io);
+    if (command.action === "grant" || command.action === "revoke")
+        return changeGrant(command, tower, io);
     if (command.action === "role")
         return changeRole(command, tower, io);
     if (command.action === "device-list")
@@ -207,4 +211,41 @@ async function deviceDoctor(command, tower, io) {
         return writeCommandFailure(io, command.json, result);
     writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, ...asRecord(result.body) }) : `Doctor requested for ${device.device_name ?? device.device_id}. Waiting for its next check-in.`);
     return 0;
+}
+/** Exact directory labels locate a roster id; attribution remains the server resolver's job. */
+async function githubLogin(command, tower, io) {
+    let personId = command.personRef ?? "";
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(personId)) {
+        const directory = await callTower(tower, { path: "/api/team/members", label: "team github-login lookup" });
+        if (!directory.ok)
+            return writeCommandFailure(io, command.json, directory);
+        const body = asRecord(directory.body);
+        if (body.rosterError)
+            return writeCommandFailure(io, command.json, { reason: "roster_read_failed", detail: "The roster could not be read. Use a person UUID or retry." });
+        const needle = personId.toLowerCase();
+        const matches = (Array.isArray(body.people) ? body.people : []).map(asRecord).filter(person => [person.rosterId, person.name, person.email].some(label => typeof label === "string" && label.toLowerCase() === needle));
+        const ids = [...new Set(matches.map(person => person.rosterId).filter((id) => typeof id === "string"))];
+        if (ids.length !== 1)
+            return writeCommandFailure(io, command.json, { reason: ids.length ? "ambiguous_person" : "person_not_found", detail: "Use an exact roster UUID, name or email from cockpit team members." });
+        personId = ids[0];
+    }
+    const method = command.action === "github-login-list" ? "GET" : command.action === "github-login-add" ? "POST" : "DELETE";
+    const result = await callTower(tower, { path: `/api/team/members/${encodeURIComponent(personId)}/github-logins`, method,
+        label: "team github-login", ...(method === "GET" ? {} : { body: { login: command.githubLogin } }) });
+    writeLine(io.stderr, `[team cli] github login ${JSON.stringify({ person_id: personId, method, reason: result.ok ? "answered" : result.reason })}`);
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    writeLine(io.stdout, command.json ? JSON.stringify(body) :
+        `GitHub logins: ${[body.primary_login, ...(Array.isArray(body.extra_logins) ? body.extra_logins : [])].filter(Boolean).join(", ") || "none"}. History is preserved.`);
+    return 0;
+}
+async function changeGrant(command, tower, io) {
+    const result = await callTower(tower, { path: "/api/team/grants", method: "POST", label: "team section grant",
+        body: { person_id: command.targetUserId, section: command.section, level: command.level ?? "see", action: command.action } });
+    writeLine(io.stderr, `[team cli] section grant ${JSON.stringify({ action: command.action, level: command.level ?? "see", reason: result.ok ? "ok" : result.reason })}`);
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, ...asRecord(result.body) }) : `Careers ${command.level ?? "see"} ${command.action === "grant" ? "granted to" : "revoked for"} ${command.targetUserId}.`);
+    return 0;
 }

package/dist/commands/tickets-board.js

@@ -0,0 +1,43 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { ISSUE_STATES } from "./local-args-tower-work.js";
+import { READ_DEADLINE_MS } from "./issue-contracts.js";
+export function ticketBoardLines(board, command) {
+    const lines = [];
+    for (const state of ISSUE_STATES) {
+        if (command.stateFilter && command.stateFilter !== state)
+            continue;
+        const cards = board.cards.filter(card => card.state === state).sort((a, b) => (a.priority || 5) - (b.priority || 5) || b.updatedAt.localeCompare(a.updatedAt));
+        const total = board.countsByState?.[state];
+        const countLine = command.label ? `${cards.length} loaded` :
+            total == null ? `${cards.length} loaded · total unavailable` : `${cards.length} loaded of ${total}`;
+        const failure = board.failedStates.includes(state) ? " · read failed" : "";
+        const preview = cards.length > 5 ? " · top 5 below" : "";
+        lines.push(`${state.toUpperCase().replaceAll("_", " ")}: ${countLine}${failure}${preview}`);
+        lines.push(...cards.slice(0, 5).map(card => `  ${card.identifier}  ${card.title}`));
+    }
+    if (board.countsCoverage)
+        lines.push(`Counts: ${board.countsCoverage}`);
+    if (board.countsUnavailableReason)
+        lines.push(`Counts unavailable: ${board.countsUnavailableReason}`);
+    if (board.gaps.length)
+        lines.push(`Unavailable: ${board.gaps.join(", ")}`);
+    return lines;
+}
+export async function readTicketBoard(command, door) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries({ state: command.stateFilter, assignee: command.assignee,
+        project: command.project, label: command.label, rows: command.rows }))
+        if (value)
+            query.set(key, value);
+    const suffix = query.toString();
+    const answer = await askAgentDoor(door, { path: `/api/work/board${suffix ? `?${suffix}` : ""}`, method: "GET", label: "tickets board", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, "[tickets board]", answer.reason, answer.detail);
+    writeLine(door.io.stderr, `[tickets board] read ${JSON.stringify({ reason: "board_read", cards: answer.body.cards.length })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    for (const line of ticketBoardLines(answer.body, command))
+        writeLine(door.io.stdout, line);
+    return 0;
+}

package/dist/commands/usage.js

@@ -20,7 +20,7 @@ export async function runUsage(command, io) {
     if (command.includeAutomated)
         query.set("include_automated", "1");
     if (command.action === "sessions") {
-        for (const [key, value] of [["task", command.task], ["subject", command.subject], ["repo", command.repo], ["session", command.session], ["fromWindow", command.fromWindow]])
+        for (const [key, value] of [["person", command.person], ["tool", command.tool], ["cursor", command.cursor], ["limit", command.limit], ["task", command.task], ["subject", command.subject], ["repo", command.repo], ["session", command.session], ["fromWindow", command.fromWindow]])
             if (value)
                 query.set(key, value);
         const response = await askAgentDoor(door, { path: `/api/usage/sessions?${query}`, method: "GET", label: "usage sessions", timeoutMs: 30_000 });
@@ -30,8 +30,13 @@ export async function runUsage(command, io) {
             return emitAgentDoor(door, response.body);
         const sessions = response.body.sessions ?? [];
         for (const session of sessions)
-            writeLine(io.stdout, `${session.session_id}  ${formatCount(session.tokens)}  ${session.task_type}  ${session.title}`);
+            writeLine(io.stdout, `${session.session_id}  ${formatCount(session.tokens)}  ${session.start_time ?? "start unknown"}  ${session.tool ?? session.task_type}  ${session.model ?? "model unknown"}  ${session.title ?? "no title yet"}`);
         writeLine(io.stdout, `${sessions.length} sessions`);
+        const page = response.body;
+        for (const line of page.read_coverage ?? [])
+            writeLine(io.stdout, line);
+        if (page.next_cursor)
+            writeLine(io.stdout, `Next page: ${page.window ? `--since ${page.window.since} --until ${page.window.until} ` : ""}--cursor ${page.next_cursor}`);
         return 0;
     }
     const answer = await askAgentDoor(door, { path: `/api/usage/people?${query}`, method: "GET", label: "usage people", timeoutMs: 30_000 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.201",
+  "version": "0.2.203",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.60",
-    "@bli-cockpit/mcp": "0.1.113",
-    "@bli-cockpit/telemetry-core": "0.1.69"
+    "@bli-cockpit/memory-mcp": "0.1.61",
+    "@bli-cockpit/mcp": "0.1.115",
+    "@bli-cockpit/telemetry-core": "0.1.70"
   },
   "repository": {
     "type": "git",