@bli-cockpit/cli 0.2.212 → 0.2.217

package/dist/commands/notes-sync-loop.js

@@ -0,0 +1,129 @@
+/**
+ * `cockpit notes sync <account-id>` — read one notetaker now, until it is caught
+ * up (BLI-17974; split out of `notes-accounts.ts`).
+ *
+ * ONE door call is a bounded pass: it answers well inside Vercel's 60 s limit
+ * with `more: true` and a cursor it saved after every meeting. The terminal asks
+ * again until Tower says the account is caught up, printing each pass, and exits
+ * 1 with the reason when a pass fails. The loop calls the same door the web
+ * Sync button, the MCP `notes_sync` tool and JARVIS call; nothing here reads a
+ * notetaker itself.
+ *
+ * stdout is the answer, stderr is the commentary (in `--json` the progress lines
+ * move to stderr so stdout stays one object).
+ */
+import { writeLine } from "./cli-io.js";
+import { ask, emit, fail, TAG } from "./notes-door.js";
+/** One door call is a bounded pass (under a minute); the terminal allows twice that. */
+const WRITE_DEADLINE_MS = 120_000;
+/** BLI-17974: bounds on the sync loop, so a stuck account ends in a reason, not a hang. */
+const MAX_SYNC_PASSES = 200;
+const MAX_STALLED_PASSES = 3;
+const MAX_TRANSIENT_FAILURES = 3;
+const MAX_LIVE_WAITS = 40;
+/** How long to wait for a pass another caller has live before asking again. */
+const LIVE_PASS_WAIT_MS = 5_000;
+export async function syncNotetaker(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        // One account per call on purpose: the sweep over ALL of them is the cron,
+        // and a terminal asking for "everything" would hide which one failed.
+        return fail(door, "account_required", "Name the notetaker to sync: `cockpit notes sync <account-id>`. `cockpit notes accounts` lists the ids.");
+    }
+    // BLI-17974: ONE door call is a bounded pass (it answers well inside Vercel's
+    // 60 s limit with `more: true` and a saved cursor). The terminal asks again
+    // until Tower says the account is caught up, printing each pass, and exits 1
+    // with the reason when a pass fails. The loop is the same door the web button
+    // and the MCP tool call; nothing here reads a notetaker itself.
+    const env = door.io.env ?? {};
+    const pollMs = Number.parseInt(env["COCKPIT_NOTES_SYNC_POLL_MS"] ?? "", 10);
+    const liveWaitMs = Number.isFinite(pollMs) && pollMs >= 0 ? pollMs : LIVE_PASS_WAIT_MS;
+    const totals = { stored: 0, unchanged: 0, skipped: 0 };
+    let passes = 0;
+    let stalled = 0;
+    let liveWaits = 0;
+    let transientFailures = 0;
+    let last;
+    while (passes < MAX_SYNC_PASSES) {
+        const answer = await ask(door, {
+            path: `/api/notes/accounts/${encodeURIComponent(accountId)}/sync`,
+            method: "POST",
+            label: "notes sync",
+            timeoutMs: WRITE_DEADLINE_MS,
+        });
+        if (!answer.ok) {
+            // A timeout or a 5xx mid-history is the call's, not the account's: the
+            // cursor was saved after every meeting, so asking again resumes. Three in
+            // a row is a real outage and is reported with its reason.
+            const transient = /^(timeout|network|unreachable|http_5\d\d|BLI-E5\d\d|read_failed)/i.test(answer.reason);
+            if (transient && transientFailures < MAX_TRANSIENT_FAILURES) {
+                transientFailures += 1;
+                writeLine(door.io.stderr, `${TAG} sync call failed, retrying ${JSON.stringify({ reason: answer.reason, attempt: transientFailures })}`);
+                await sleepMs(liveWaitMs);
+                continue;
+            }
+            return failRun(door, answer.reason, answer.detail, last, passes, totals);
+        }
+        transientFailures = 0;
+        const run = answer.body.run;
+        if (!run) {
+            writeLine(door.io.stdout, "Tower answered without a run.");
+            return failRun(door, "no_run_in_answer", "Tower answered the sync without a run.", last, passes, totals);
+        }
+        last = run;
+        if (run.reason === "running") {
+            // Another pass (the cron, a second terminal) is live on this account. It
+            // writes the same cursor; wait for it rather than racing it.
+            liveWaits += 1;
+            writeLine(door.io.stderr, `${TAG} another pass is running ${JSON.stringify({ run_id: run.runId ?? null, waits: liveWaits })}`);
+            if (liveWaits > MAX_LIVE_WAITS) {
+                return failRun(door, "pass_still_running", "Another pass kept running on this notetaker. Check `cockpit notes sync-status`, then try again.", last, passes, totals);
+            }
+            await sleepMs(liveWaitMs);
+            continue;
+        }
+        passes += 1;
+        totals.stored += run.notesAdded;
+        totals.unchanged += run.notesUpdated;
+        totals.skipped += run.notesSkipped;
+        const waiting = typeof run.remaining === "number" ? `; ${run.remaining} waiting` : "";
+        const line = `pass ${passes}: ${run.reason}: ${run.notesAdded} stored, ${run.notesUpdated} unchanged, ${run.notesSkipped} skipped${run.more ? `${waiting}, continuing` : ""}.`;
+        // Progress is commentary in --json (stdout is the one answer), and the
+        // answer in a terminal.
+        writeLine(door.json ? door.io.stderr : door.io.stdout, line);
+        if (run.detail && !run.ok)
+            writeLine(door.json ? door.io.stderr : door.io.stdout, run.detail);
+        if (!run.ok) {
+            return failRun(door, run.reason, run.detail || `The pass ended ${run.reason}.`, run, passes, totals);
+        }
+        if (!run.more) {
+            if (door.json)
+                return emit(door, { ok: true, passes, totals, run });
+            writeLine(door.io.stdout, `Caught up after ${passes} pass${passes === 1 ? "" : "es"}: ${totals.stored} stored, ${totals.unchanged} unchanged, ${totals.skipped} skipped.`);
+            return 0;
+        }
+        // A pass that handled nothing and still says "more" would loop forever.
+        if (run.notesAdded + run.notesUpdated + run.notesSkipped === 0)
+            stalled += 1;
+        else
+            stalled = 0;
+        if (stalled >= MAX_STALLED_PASSES) {
+            return failRun(door, "no_progress", `Three passes in a row handled no meeting (last: ${run.reason}). The cursor is saved; try again later or check \`cockpit notes sync-status\`.`, run, passes, totals);
+        }
+    }
+    return failRun(door, "too_many_passes", `Stopped after ${MAX_SYNC_PASSES} passes with meetings still waiting. Run \`cockpit notes sync ${accountId}\` again to continue from the saved cursor.`, last, passes, totals);
+}
+/** A sync that did not finish: the reason on stderr, the structured answer on stdout in --json. */
+function failRun(door, reason, detail, run, passes, totals) {
+    writeLine(door.io.stderr, `${TAG} sync stopped ${JSON.stringify({ reason, passes })}`);
+    if (door.json) {
+        writeLine(door.io.stdout, JSON.stringify({ ok: false, error: reason, detail, passes, totals, run }));
+    }
+    else {
+        writeLine(door.io.stderr, detail);
+    }
+    return 1;
+}
+function sleepMs(ms) {
+    return ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
+}

package/dist/commands/notes-wisprflow-login.js

@@ -1,219 +1,188 @@
 /**
- * `cockpit notes connect --provider wisprflow` — signing a person into Wispr
- * Flow's MCP server from a terminal (BLI-12926).
+ * `cockpit notes connect --provider wisprflow` — connecting Wispr Flow from a
+ * terminal (BLI-12926, rebuilt by BLI-17973 as one backend door).
  *
- * Wispr Flow has no API key for meetings. Its Notetaker is read through a
- * remote MCP server behind OAuth (docs.wisprflow.ai, "Connect Claude, ChatGPT
- * or another MCP client to Wispr Flow": "no API key or token is needed"). Its
- * authorization server publishes, at
- * `https://mcp-auth.wisprflow.com/.well-known/oauth-authorization-server`
- * (read 2026-10-08), dynamic client registration, PKCE `S256`, a refresh-token
- * grant and the RFC 8628 DEVICE grant. The device grant is the one a terminal
- * can use: it prints an address and a short code, the person approves in their
- * own browser (Google, Apple, Microsoft or company single sign-on; an
- * email-and-password Wispr account cannot complete MCP authorization), and this
- * file polls until Wispr hands back a refresh token.
+ * Wispr Flow has no API key for meetings: its Notetaker is read through a
+ * remote MCP server behind OAuth, and the sign-in is a person approving on
+ * Wispr's page. The first terminal version registered a device-grant client
+ * straight from the collector; Wispr's registration endpoint now refuses it
+ * (HTTP 400 `invalid_client_metadata`) and the command still exited 0. The
+ * second version only opened Tower's Settings page, which made the CLI a
+ * wrapper around the web UI.
  *
- * What leaves this machine: a client registration, then the device and token
- * calls, all to Wispr's own authorization server. The refresh token goes into a
- * bundle (`{ v, client_id, refresh_token }`) that `connect` posts to Tower's
- * accounts door, which seals it. It is never printed, never written to a file
- * and never put in a flag; `--json` shows the account, not the bundle.
+ * Now the terminal is a plain client of the same backend door the Settings
+ * button, the MCP tools and JARVIS call, with its own caller identity (this
+ * machine's device token):
  *
- * **No live call has been made from this code.** Every shape is the RFC's, and
- * the first real sign-in is the proof. In particular it is NOT known whether
- * Wispr's server accepts a dynamically registered client on the device grant
- * (the document lists both, not that they combine); if it does not, the refusal
- * below says what Wispr answered and `--key-stdin` accepts a bundle made by any
- * other means.
+ * 1. `POST /api/notes/accounts/wisprflow/start` answers `{ authorize_url,
+ *    attempt_id, expires_at }`. The OAuth state and PKCE verifier stay on
+ *    Tower's server; the terminal never sees a secret. Wispr Flow already
+ *    connected is refused by the door (`account_already_connected`).
+ * 2. The address is printed first (a machine with no browser loses nothing),
+ *    then opened with `browser-open.ts`, the one opener the collector has.
+ * 3. `GET /api/notes/accounts/wisprflow/status?attempt_id=` is polled every few
+ *    seconds, up to ten minutes, until the attempt is `connected`, `failed` or
+ *    `expired`. Every refusal carries a reason label and the caller exits 1.
  *
  * stdout carries nothing from here; every line is stderr commentary.
  */
 import { writeLine } from "./cli-io.js";
-export const WISPRFLOW_AUTH_ISSUER = "https://mcp-auth.wisprflow.com";
-export const WISPRFLOW_MCP_RESOURCE = "https://api.wisprflow.ai/connect/mcp";
-const SCOPE = "openid offline_access";
-const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-const REQUEST_DEADLINE_MS = 30_000;
-/** RFC 8628: a client polls no faster than the server's interval, default 5 s. */
-const DEFAULT_INTERVAL_SECONDS = 5;
-/** Never wait on a person longer than this, whatever the server says. */
-const MAX_WAIT_SECONDS = 15 * 60;
+import { openInBrowser } from "./browser-open.js";
+import { ask, READ_DEADLINE_MS } from "./notes-door.js";
+export const WISPRFLOW_START_PATH = "/api/notes/accounts/wisprflow/start";
+export const WISPRFLOW_STATUS_PATH = "/api/notes/accounts/wisprflow/status";
+/** How often the status door is asked whether the sign-in has landed. */
+const POLL_INTERVAL_MS = 5_000;
+/** Never wait on a person longer than this. */
+const MAX_WAIT_MS = 10 * 60 * 1000;
+/** A flaky read is retried; this many in a row is a real outage and ends the wait. */
+const MAX_CONSECUTIVE_READ_FAILURES = 4;
 const TAG = "[notes wisprflow signin]";
-export async function signInToWisprflow(options) {
-    const { io } = options;
+/** What a person reads for a failed attempt, keyed on the status door's reason label. */
+const FAILURE_SENTENCES = {
+    access_denied: "Wispr Flow says the sign-in was declined, so nothing was connected.",
+    state_expired: "The sign-in was not approved within ten minutes, so it expired and nothing was connected.",
+    state_already_used: "That sign-in link was already used, so nothing was connected.",
+    wisprflow_token_refused: "Wispr Flow refused to finish the sign-in, so nothing was connected.",
+    no_refresh_token: "Wispr Flow signed you in but did not allow Tower to keep reading, so it would stop working within the hour. Nothing was connected.",
+    account_already_connected: "Wispr Flow is already connected to your Tower account. Detach it first, then sign in again.",
+    credential_key_unavailable: "Tower could not safely store the sign-in just now, so nothing was connected.",
+    wisprflow_unreachable: "Tower could not reach Wispr Flow just now, so nothing was connected.",
+    wisprflow_registration_refused: "Wispr Flow would not start a sign-in for Tower, so nothing was connected.",
+};
+function failureDetail(reason) {
+    return FAILURE_SENTENCES[reason] ?? `The Wispr Flow sign-in ended without connecting (${reason}).`;
+}
+export async function connectWisprflowInBrowser(door, options = {}) {
     const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const now = options.now ?? Date.now;
-    const metadata = await readMetadata(io);
-    if (!metadata.ok)
-        return metadata;
-    // 1. Register a client. A public client: no secret, only an id.
-    const registered = await postJson(io, metadata.value.registration_endpoint, {
-        client_name: "Tower (BLI) notes sync",
-        grant_types: [DEVICE_GRANT, "refresh_token"],
-        response_types: [],
-        token_endpoint_auth_method: "none",
-        scope: SCOPE,
+    const open = options.open ?? ((url) => openInBrowser(url));
+    const stderr = door.io.stderr;
+    // 1. Ask the one start door for a sign-in.
+    const started = await ask(door, {
+        path: WISPRFLOW_START_PATH,
+        method: "POST",
+        label: "notes wisprflow start",
+        timeoutMs: READ_DEADLINE_MS,
+        body: {},
     });
-    if (!registered.ok)
-        return explain(io, "registration", registered);
-    const clientId = stringField(registered.body, "client_id");
-    if (!clientId) {
-        return { ok: false, reason: "wisprflow_registration_unusable", detail: "Wispr Flow accepted the registration but sent no client id." };
+    if (!started.ok) {
+        log(door, "start refused", { reason: started.reason });
+        if (started.reason === "account_already_connected")
+            return alreadyConnected(door);
+        return { ok: false, reason: started.reason, detail: started.detail };
     }
-    // 2. Ask for a code.
-    const device = await postForm(io, metadata.value.device_authorization_endpoint, {
-        client_id: clientId,
-        scope: SCOPE,
-        resource: WISPRFLOW_MCP_RESOURCE,
-    });
-    if (!device.ok)
-        return explain(io, "device code", device);
-    const deviceCode = stringField(device.body, "device_code");
-    const userCode = stringField(device.body, "user_code");
-    const address = stringField(device.body, "verification_uri_complete") ?? stringField(device.body, "verification_uri");
-    if (!deviceCode || !userCode || !address) {
-        return { ok: false, reason: "wisprflow_device_unusable", detail: "Wispr Flow's device answer was missing its code or its address." };
+    const body = started.body;
+    const authorizeUrl = typeof body.authorize_url === "string" ? body.authorize_url : "";
+    const attemptId = typeof body.attempt_id === "string" ? body.attempt_id : "";
+    if (authorizeUrl === "" || attemptId === "") {
+        log(door, "start answer unusable", { reason: "start_answer_unusable" });
+        return {
+            ok: false,
+            reason: "start_answer_unusable",
+            detail: "Tower started a sign-in but did not say where to send you or how to watch it, so nothing was connected.",
+        };
     }
-    const waitSeconds = Math.min(numberField(device.body, "expires_in") ?? MAX_WAIT_SECONDS, MAX_WAIT_SECONDS);
-    let intervalMs = (numberField(device.body, "interval") ?? DEFAULT_INTERVAL_SECONDS) * 1000;
-    writeLine(io.stderr, "Sign in to Wispr Flow to let Tower read your meeting notes:");
-    writeLine(io.stderr, `  1. Open  ${address}`);
-    writeLine(io.stderr, `  2. If it asks, enter the code  ${userCode}`);
-    writeLine(io.stderr, "  Use the Wispr account that holds your notes, signed in with Google, Apple, Microsoft or company single sign-on.");
-    writeLine(io.stderr, `Waiting up to ${Math.round(waitSeconds / 60)} minutes for you to approve...`);
-    log(io, "waiting", { interval_s: intervalMs / 1000, wait_s: waitSeconds });
-    // 3. Poll.
-    const deadline = now() + waitSeconds * 1000;
+    log(door, "started", { attempt_id: attemptId, expires_at: typeof body.expires_at === "string" ? body.expires_at : null });
+    // 2. Print the address first, then open it.
+    writeLine(stderr, "Connect Wispr Flow to Tower: approve on Wispr's page in your browser.");
+    writeLine(stderr, `  ${authorizeUrl}`);
+    writeLine(stderr, "  Use the Wispr account that holds your notes, signed in with Google, Apple, Microsoft or company single sign-on.");
+    const opened = open(authorizeUrl);
+    log(door, "browser open attempted", opened.ok ? { reason: opened.reason, program: opened.program } : { reason: opened.reason });
+    if (!opened.ok)
+        writeLine(stderr, `(${opened.detail} The address above still works.)`);
+    writeLine(stderr, `Waiting up to ${MAX_WAIT_MS / 60_000} minutes for the sign-in to finish...`);
+    // 3. Poll the one status door.
+    const deadline = now() + MAX_WAIT_MS;
+    let polls = 0;
+    let failures = 0;
     while (now() < deadline) {
-        await sleep(intervalMs);
-        const polled = await postForm(io, metadata.value.token_endpoint, {
-            grant_type: DEVICE_GRANT,
-            device_code: deviceCode,
-            client_id: clientId,
-            resource: WISPRFLOW_MCP_RESOURCE,
+        polls += 1;
+        const polled = await ask(door, {
+            path: `${WISPRFLOW_STATUS_PATH}?attempt_id=${encodeURIComponent(attemptId)}`,
+            method: "GET",
+            label: "notes wisprflow status",
+            timeoutMs: READ_DEADLINE_MS,
         });
-        if (polled.ok) {
-            const refreshToken = stringField(polled.body, "refresh_token");
-            if (!refreshToken) {
-                return {
-                    ok: false,
-                    reason: "wisprflow_no_offline_access",
-                    detail: "Wispr Flow signed you in but did not hand back a refresh token, so Tower could not read your meetings"
-                        + " every half hour without you. Nothing was connected.",
-                };
+        if (!polled.ok) {
+            failures += 1;
+            log(door, "poll failed", { attempt_id: attemptId, polls, reason: polled.reason, consecutive_failures: failures });
+            // The attempt itself is gone or not ours: waiting longer cannot change that.
+            if (polled.reason === "attempt_not_found" || failures >= MAX_CONSECUTIVE_READ_FAILURES) {
+                return { ok: false, reason: polled.reason, detail: polled.detail };
             }
-            log(io, "signed in", { client_registered: true, refresh_token_received: true });
-            return {
-                ok: true,
-                bundle: JSON.stringify({ v: 1, client_id: clientId, refresh_token: refreshToken }),
-            };
-        }
-        const code = stringField(polled.body, "error");
-        if (code === "authorization_pending")
-            continue;
-        if (code === "slow_down") {
-            intervalMs += 5000;
-            continue;
         }
-        if (code === "expired_token") {
-            return { ok: false, reason: "wisprflow_code_expired", detail: "The code expired before it was approved. Run the command again." };
-        }
-        if (code === "access_denied") {
-            return { ok: false, reason: "wisprflow_denied", detail: "Wispr Flow says the request was declined. Nothing was connected." };
+        else {
+            failures = 0;
+            const status = polled.body;
+            const state = typeof status.status === "string" ? status.status : "unknown";
+            const reason = typeof status.reason === "string" ? status.reason : null;
+            log(door, "poll", { attempt_id: attemptId, polls, status: state, reason });
+            if (state === "connected") {
+                const accountId = typeof status.account_id === "string" ? status.account_id : "";
+                log(door, "connected", { attempt_id: attemptId, account_id: accountId || null, polls });
+                return { ok: true, account: await readAccount(door, accountId), already: false };
+            }
+            if (state === "failed" || state === "expired") {
+                const why = reason ?? (state === "expired" ? "state_expired" : "unknown");
+                log(door, "ended without connecting", { attempt_id: attemptId, status: state, reason: why });
+                return { ok: false, reason: why, detail: failureDetail(why) };
+            }
         }
-        return explain(io, "sign-in", polled);
+        await sleep(POLL_INTERVAL_MS);
     }
-    return { ok: false, reason: "wisprflow_timed_out", detail: "Nobody approved the code in time. Run the command again." };
-}
-/** Metadata only: a step, a status and an OAuth error label. Never a code or a token. */
-function log(io, message, fields) {
-    writeLine(io.stderr, `${TAG} ${message} ${JSON.stringify(fields)}`);
+    log(door, "timed out", { attempt_id: attemptId, polls });
+    return {
+        ok: false,
+        reason: "wisprflow_timed_out",
+        detail: "The sign-in did not finish within 10 minutes, so nothing was connected."
+            + " Run this again for a fresh link, or check `cockpit notes accounts`.",
+    };
 }
-async function readMetadata(io) {
-    const got = await send(io, `${WISPRFLOW_AUTH_ISSUER}/.well-known/oauth-authorization-server`, { method: "GET" });
-    if (!got.ok)
-        return explain(io, "discovery", got);
-    const registration = stringField(got.body, "registration_endpoint");
-    const device = stringField(got.body, "device_authorization_endpoint");
-    const token = stringField(got.body, "token_endpoint");
-    if (!registration || !device || !token) {
+/** The start door said Wispr Flow is already connected: read which account and report it honestly. */
+async function alreadyConnected(door) {
+    const accounts = await readAccounts(door);
+    const existing = accounts?.find((account) => account.provider === "wisprflow");
+    if (!existing) {
         return {
             ok: false,
-            reason: "wisprflow_discovery_changed",
-            detail: "Wispr Flow's sign-in no longer advertises client registration and the device flow. Tower cannot sign you in from a terminal until it does.",
+            reason: "account_already_connected",
+            detail: failureDetail("account_already_connected"),
         };
     }
-    // Every endpoint must stay on Wispr's own host: a discovery document that
-    // points the token call somewhere else is not one to send a code to.
-    for (const endpoint of [registration, device, token]) {
-        if (!endpoint.startsWith(`${WISPRFLOW_AUTH_ISSUER}/`)) {
-            return { ok: false, reason: "wisprflow_discovery_changed", detail: "Wispr Flow's sign-in points at a host Tower does not recognise, so nothing was sent." };
-        }
-    }
-    return { ok: true, value: { registration_endpoint: registration, device_authorization_endpoint: device, token_endpoint: token } };
-}
-async function postJson(io, url, body) {
-    return send(io, url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
-        body: JSON.stringify(body),
-    });
-}
-async function postForm(io, url, body) {
-    return send(io, url, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
-        body: new URLSearchParams(body).toString(),
-    });
-}
-async function send(io, url, init) {
-    const call = io.fetch;
-    const controller = new AbortController();
-    const deadline = setTimeout(() => controller.abort(), REQUEST_DEADLINE_MS);
-    try {
-        const response = await call(url, { ...init, signal: controller.signal });
-        let body = null;
-        try {
-            body = await response.json();
-        }
-        catch {
-            body = null;
-        }
-        return response.ok ? { ok: true, body } : { ok: false, status: response.status, body, network: false };
-    }
-    catch {
-        return { ok: false, status: 0, body: null, network: true };
-    }
-    finally {
-        clearTimeout(deadline);
-    }
-}
-/** A refusal in the vendor's own words: its OAuth error label, never a body dump. */
-function explain(io, step, failure) {
-    if (failure.network) {
-        return { ok: false, reason: "wisprflow_unreachable", detail: `Could not reach Wispr Flow's sign-in during ${step}. Check the connection and try again.` };
-    }
-    const label = stringField(failure.body, "error");
-    const words = stringField(failure.body, "error_description");
-    log(io, "refused", { step, http_status: failure.status, oauth_error: label ?? "none" });
+    log(door, "already connected", { account_id: existing.id, status: existing.status });
+    if (existing.status === "active")
+        return { ok: true, account: existing, already: true };
     return {
         ok: false,
-        reason: `wisprflow_${step.replace(/\s+/g, "_")}_refused`,
-        detail: `Wispr Flow refused the ${step} step (HTTP ${failure.status}${label ? `, ${label}` : ""}).`
-            + `${words ? ` It said: ${words.slice(0, 200)}` : ""}`
-            + " Nothing was connected.",
+        reason: "wisprflow_needs_detach",
+        detail: `Wispr Flow is connected (${existing.id}) but its status is ${existing.status}`
+            + `${existing.status_reason ? ` (${existing.status_reason})` : ""}. `
+            + `Detach it first with \`cockpit notes detach ${existing.id}\`, then run this again.`,
     };
 }
-function stringField(body, name) {
-    if (typeof body !== "object" || body === null)
-        return null;
-    const value = body[name];
-    return typeof value === "string" && value.trim() !== "" ? value : null;
+/** The account row for the id the status door named. A failed read still reports the id. */
+async function readAccount(door, accountId) {
+    const accounts = await readAccounts(door);
+    const found = accounts?.find((account) => account.id === accountId) ?? accounts?.find((account) => account.provider === "wisprflow");
+    return found ?? { id: accountId, provider: "wisprflow", label: null, workspace: null, status: "active", status_reason: null };
 }
-function numberField(body, name) {
-    if (typeof body !== "object" || body === null)
+async function readAccounts(door) {
+    const answer = await ask(door, {
+        path: "/api/notes/accounts",
+        method: "GET",
+        label: "notes accounts",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok) {
+        log(door, "accounts read failed", { reason: answer.reason });
         return null;
-    const value = body[name];
-    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+    }
+    const accounts = answer.body.accounts;
+    return Array.isArray(accounts) ? accounts : [];
+}
+/** Metadata only: a step and counts or a reason label. Never a token, never a URL, never a body. */
+function log(door, message, fields) {
+    writeLine(door.io.stderr, `${TAG} ${message} ${JSON.stringify(fields)}`);
 }

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.212");
+    writeLine(io?.stdout ?? process.stdout, "0.2.217");
     return 0;
   }
 

package/dist/commands/team.js

@@ -37,6 +37,8 @@ export async function runTeam(command, io) {
         return deviceList(command, tower, io);
     if (command.action === "device-doctor")
         return deviceDoctor(command, tower, io);
+    if (command.action === "device-scope")
+        return deviceScope(command, tower, io);
     return deviceRevoke(command, tower, io);
 }
 async function showMembers(command, tower, io) {
@@ -212,6 +214,36 @@ async function deviceDoctor(command, tower, io) {
     writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, ...asRecord(result.body) }) : `Doctor requested for ${device.device_name ?? device.device_id}. Waiting for its next check-in.`);
     return 0;
 }
+/**
+ * `cockpit team device scope <id|name> notetaker_bot|none` (BLI-17978): the ONE door that gives the meeting bot's
+ * device the capability Tower's claim door requires, or takes it away. Super admin on the server; the word `none`
+ * is the CLI's spelling of "no scope". It replaces the manual SQL step the bot's README used to carry.
+ */
+async function deviceScope(command, tower, io) {
+    const listed = await callTower(tower, { path: "/api/team/devices", label: "team device scope lookup" });
+    if (!listed.ok)
+        return writeCommandFailure(io, command.json, listed);
+    const device = findDevice(devicesOf(asRecord(listed.body)), command.deviceRef ?? "");
+    if (!device)
+        return writeCommandFailure(io, command.json, { reason: "device_not_found", detail: "No unique device matches. Run cockpit team device list to see ids and names." });
+    const result = await callTower(tower, {
+        path: `/api/ambient/devices/${encodeURIComponent(device.device_id)}/scope`,
+        method: "POST", label: "team device scope", body: { scope: command.deviceScope },
+    });
+    writeLine(io.stderr, `[team cli] device scope ${JSON.stringify({ device_id: device.device_id, scope: command.deviceScope, outcome: result.ok ? "answered" : result.reason })}`);
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    const name = String(device.device_name ?? device.device_id);
+    writeLine(io.stdout, body.changed === false
+        ? `${name} already has ${command.deviceScope === "none" ? "no scope" : "the notetaker_bot scope"}. Nothing changed.`
+        : command.deviceScope === "none" ? `Took the service scope away from ${name}.` : `${name} now holds the notetaker_bot scope. The bot's next claim will go through.`);
+    return 0;
+}
 /** Exact directory labels locate a roster id; attribution remains the server resolver's job. */
 async function githubLogin(command, tower, io) {
     let personId = command.personRef ?? "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.212",
+  "version": "0.2.217",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.66",
-    "@bli-cockpit/mcp": "0.1.121",
+    "@bli-cockpit/mcp": "0.1.125",
     "@bli-cockpit/telemetry-core": "0.1.75"
   },
   "repository": {