@bli-cockpit/cli 0.2.213 → 0.2.217

package/dist/commands/local-args-tower-admin.js

@@ -347,6 +347,13 @@ export function parseTeamArgs(args) {
  */
 function parseTeamDeviceArgs(rest, flags, common) {
     const [deviceVerb, deviceRef, ...extra] = rest;
+    if (deviceVerb === "scope") {
+        const [deviceScope, ...surplus] = extra;
+        if (!deviceRef || (deviceScope !== "notetaker_bot" && deviceScope !== "none") || surplus.length > 0) {
+            throw new Error("team device scope takes <id|name> notetaker_bot|none.");
+        }
+        return { kind: "team", action: "device-scope", deviceRef, deviceScope, ...common };
+    }
     if (extra.length > 0)
         throw new Error("team device does not accept that many arguments.");
     if (!deviceVerb || deviceVerb === "list") {
@@ -378,7 +385,7 @@ function parseTeamDeviceArgs(rest, flags, common) {
             ...common,
         };
     }
-    throw new Error("team device takes one verb: list, doctor <id|name>, or revoke <id|name>.");
+    throw new Error("team device takes one verb: list, doctor <id|name>, scope <id|name> notetaker_bot|none, or revoke <id|name>.");
 }
 /** `cockpit model [show|set <key>]` — the alias surface for the personal chat model. */
 export function parseModelArgs(args) {

package/dist/commands/local-help-commands-tower.js

@@ -391,7 +391,7 @@ export const TOWER_COMMAND_HELP = [
             "recording <recording-id> [--json] — one recording, text and all, shown or alternate.",
             "accounts --show-webhook <account-id> — that account's webhook URL, where to paste it at the vendor, and whether a signing secret is stored (BLI-4394). Until one is, every request to that URL is refused, which is the right way to be off.",
             "webhook <account-id> --secret-stdin — store the VENDOR's webhook signing secret. THE SECRET IS READ FROM STDIN, never a flag: printf \"%s\" \"<signing secret>\" | cockpit notes webhook <account-id> --secret-stdin",
-            "connect --provider wisprflow [--name <n>] — Wispr Flow has no API key: this prints an address and a code, you approve in your browser (Google, Apple, Microsoft or company single sign-on), and Tower reads your Notetaker meetings from then on. Needs Notetaker and MCP access on your Wispr account (BLI-12926).",
+            "connect --provider wisprflow — Wispr Flow has no API key: this asks Tower to start the sign-in (the same door the Settings button, the MCP tool notes_connect_wisprflow and JARVIS use), prints and opens Wispr's approval page (Google, Apple, Microsoft or company single sign-on), and waits up to 10 minutes for Tower to report it connected, then Tower reads your Notetaker meetings from then on. Needs Notetaker and MCP access on your Wispr account. Exits 1 with a reason if nothing connects (BLI-12926, BLI-17973).",
             "connect --provider fellow|circleback [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
             "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
             "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",

package/dist/commands/local-help-commands.js

@@ -204,6 +204,9 @@ export function localSubcommandHelp(command) {
                 "      Every paired collector device: name, id, trust state, owner, and why",
                 "      (revoked reason, or when it was approved, or that it's still waiting).",
                 "      Admin only.",
+                "  cockpit team device scope <id|name> notetaker_bot|none [--json]",
+                "      Super admin only. Gives the meeting bot's device the scope Tower's claim door requires,",
+                "      or takes it away. Without it the bot is refused every meeting (bot_scope_required).",
                 "  cockpit team device revoke <id|name> --reason <label> [--note \"<text>\"] [--yes]",
                 "      Admin only. Names the device, asks first unless --yes, then revokes it —",
                 "      this cannot be undone. --reason must be one of: stale_test_pairing,",

package/dist/commands/notes-accounts.js

@@ -19,12 +19,14 @@
 import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
 import { ask, emit, fail, READ_DEADLINE_MS, TAG } from "./notes-door.js";
 import { printCoverage, readCoverage } from "./notes-recordings.js";
-import { signInToWisprflow } from "./notes-wisprflow-login.js";
+import { connectWisprflowInBrowser } from "./notes-wisprflow-login.js";
+// BLI-17974: the sync loop lives in `notes-sync-loop.ts`; re-exported so `notes.ts` is unchanged.
+export { syncNotetaker } from "./notes-sync-loop.js";
 /** A pass can take a while; a read never should. */
 const WRITE_DEADLINE_MS = 120_000;
 /** An API key is long; anything past this is not one, and is refused by size. */
 const KEY_MAX_CHARS = 500;
-/** BLI-12926: a Wispr Flow sign-in bundle holds an OAuth refresh token, which can run longer. */
+/** BLI-12926: a pre-built Wispr Flow sign-in bundle (`--key-stdin`) holds an OAuth refresh token, which can run longer. */
 const SIGN_IN_MAX_CHARS = 4000;
 /**
  * Granola, read through the one door that answers for it
@@ -102,7 +104,7 @@ export async function listNotesAccounts(command, door) {
         writeLine(door.io.stdout, "");
         writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fellow api key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
         writeLine(door.io.stdout, '          or:  printf "%s" "<your circleback api key>" | cockpit notes connect --provider circleback --key-stdin');
-        writeLine(door.io.stdout, "          or:  cockpit notes connect --provider wisprflow   (signs in through your browser; no key)");
+        writeLine(door.io.stdout, "          or:  cockpit notes connect --provider wisprflow   (opens Wispr's sign-in in your browser and waits; no key)");
         if (coverage)
             printCoverage(door, coverage);
         return 0;
@@ -126,37 +128,51 @@ export async function listNotesAccounts(command, door) {
     void command;
     return 0;
 }
-export async function connectNotetaker(command, door) {
-    let apiKey;
+/**
+ * BLI-17973. Wispr Flow has no API key: this calls the same start door the
+ * Settings button, the MCP tool and JARVIS call, opens the address it returns
+ * and polls the same status door. Nothing is read from stdin and no credential
+ * passes through here; the server holds the sign-in's state and seals the result.
+ */
+async function connectWisprflowViaBrowser(command, door, options) {
+    if (command.name) {
+        writeLine(door.io.stderr, `${TAG} --name ignored for wisprflow ${JSON.stringify({ reason: "web_sign_in_names_the_account" })}`);
+    }
+    const connected = await connectWisprflowInBrowser(door, options);
+    if (!connected.ok)
+        return fail(door, connected.reason, connected.detail);
+    if (door.json)
+        return emit(door, { ok: true, account: connected.account, already_connected: connected.already });
+    writeLine(door.io.stdout, connected.already
+        ? `Wispr Flow is already connected (${connected.account.id}).`
+        : `Connected wisprflow (${connected.account.id}).`);
+    writeLine(door.io.stdout, "Nothing is read until a sync runs: `cockpit notes sync <id>`, or wait for the half-hourly cron.");
+    return 0;
+}
+export async function connectNotetaker(command, door, wisprflow = {}) {
     if (command.provider === "wisprflow" && !command.keyStdin) {
-        // BLI-12926. Wispr Flow has no API key: the person signs in through their
-        // browser and what gets sealed is the sign-in. Nothing is read from stdin.
-        const signedIn = await signInToWisprflow({ io: door.io });
-        if (!signedIn.ok)
-            return fail(door, signedIn.reason, signedIn.detail);
-        apiKey = signedIn.bundle;
+        return connectWisprflowViaBrowser(command, door, wisprflow);
     }
-    else {
-        // The key comes from stdin and nowhere else. An interactive terminal with
-        // nothing piped in is told how, rather than left waiting on a prompt that
-        // would echo the secret into the scrollback.
-        if (isInteractiveStdin(door.io)) {
-            return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
-        }
-        try {
-            apiKey = (await readPipedText(door.io.stdin, {
-                // A Wispr Flow sign-in bundle carries an OAuth refresh token, which
-                // can be far longer than any API key.
-                maxChars: command.provider === "wisprflow" ? SIGN_IN_MAX_CHARS : KEY_MAX_CHARS,
-                overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
-            })).trim();
-        }
-        catch (error) {
-            return fail(door, "key_unreadable", error instanceof Error ? error.message : String(error));
-        }
-        if (apiKey === "") {
-            return fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.");
-        }
+    // The key comes from stdin and nowhere else. An interactive terminal with
+    // nothing piped in is told how, rather than left waiting on a prompt that
+    // would echo the secret into the scrollback.
+    if (isInteractiveStdin(door.io)) {
+        return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
+    }
+    let apiKey;
+    try {
+        apiKey = (await readPipedText(door.io.stdin, {
+            // A pre-built Wispr Flow sign-in bundle carries an OAuth refresh token,
+            // which can be far longer than any API key.
+            maxChars: command.provider === "wisprflow" ? SIGN_IN_MAX_CHARS : KEY_MAX_CHARS,
+            overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
+        })).trim();
+    }
+    catch (error) {
+        return fail(door, "key_unreadable", error instanceof Error ? error.message : String(error));
+    }
+    if (apiKey === "") {
+        return fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.");
     }
     const answer = await ask(door, {
         path: "/api/notes/accounts",
@@ -281,34 +297,6 @@ export async function detachNotetaker(command, door) {
     writeLine(door.io.stdout, "The meetings it already filed stay where they are.");
     return 0;
 }
-export async function syncNotetaker(command, door) {
-    const accountId = command.accountId ?? "";
-    if (accountId === "") {
-        // One account per call on purpose: the sweep over ALL of them is the cron,
-        // and a terminal asking for "everything" would hide which one failed.
-        return fail(door, "account_required", "Name the notetaker to sync: `cockpit notes sync <account-id>`. `cockpit notes accounts` lists the ids.");
-    }
-    const answer = await ask(door, {
-        path: `/api/notes/accounts/${encodeURIComponent(accountId)}/sync`,
-        method: "POST",
-        label: "notes sync",
-        timeoutMs: WRITE_DEADLINE_MS,
-    });
-    if (!answer.ok)
-        return fail(door, answer.reason, answer.detail);
-    const run = answer.body.run;
-    if (door.json)
-        return emit(door, { ok: true, run });
-    if (!run) {
-        writeLine(door.io.stdout, "Tower answered without a run.");
-        return 0;
-    }
-    // The ledger row's own words, relayed rather than rephrased.
-    writeLine(door.io.stdout, `${run.reason}: ${run.notesAdded} stored, ${run.notesUpdated} unchanged, ${run.notesSkipped} skipped.`);
-    if (run.detail)
-        writeLine(door.io.stdout, run.detail);
-    return run.ok ? 0 : 1;
-}
 /**
  * `sync-status [<account id>]` → `GET /api/notes/sync-status`. Ticket 10730:
  * the read the integrations audit went to `notes_sync_runs` directly for.

package/dist/commands/notes-sync-loop.js

@@ -0,0 +1,129 @@
+/**
+ * `cockpit notes sync <account-id>` — read one notetaker now, until it is caught
+ * up (BLI-17974; split out of `notes-accounts.ts`).
+ *
+ * ONE door call is a bounded pass: it answers well inside Vercel's 60 s limit
+ * with `more: true` and a cursor it saved after every meeting. The terminal asks
+ * again until Tower says the account is caught up, printing each pass, and exits
+ * 1 with the reason when a pass fails. The loop calls the same door the web
+ * Sync button, the MCP `notes_sync` tool and JARVIS call; nothing here reads a
+ * notetaker itself.
+ *
+ * stdout is the answer, stderr is the commentary (in `--json` the progress lines
+ * move to stderr so stdout stays one object).
+ */
+import { writeLine } from "./cli-io.js";
+import { ask, emit, fail, TAG } from "./notes-door.js";
+/** One door call is a bounded pass (under a minute); the terminal allows twice that. */
+const WRITE_DEADLINE_MS = 120_000;
+/** BLI-17974: bounds on the sync loop, so a stuck account ends in a reason, not a hang. */
+const MAX_SYNC_PASSES = 200;
+const MAX_STALLED_PASSES = 3;
+const MAX_TRANSIENT_FAILURES = 3;
+const MAX_LIVE_WAITS = 40;
+/** How long to wait for a pass another caller has live before asking again. */
+const LIVE_PASS_WAIT_MS = 5_000;
+export async function syncNotetaker(command, door) {
+    const accountId = command.accountId ?? "";
+    if (accountId === "") {
+        // One account per call on purpose: the sweep over ALL of them is the cron,
+        // and a terminal asking for "everything" would hide which one failed.
+        return fail(door, "account_required", "Name the notetaker to sync: `cockpit notes sync <account-id>`. `cockpit notes accounts` lists the ids.");
+    }
+    // BLI-17974: ONE door call is a bounded pass (it answers well inside Vercel's
+    // 60 s limit with `more: true` and a saved cursor). The terminal asks again
+    // until Tower says the account is caught up, printing each pass, and exits 1
+    // with the reason when a pass fails. The loop is the same door the web button
+    // and the MCP tool call; nothing here reads a notetaker itself.
+    const env = door.io.env ?? {};
+    const pollMs = Number.parseInt(env["COCKPIT_NOTES_SYNC_POLL_MS"] ?? "", 10);
+    const liveWaitMs = Number.isFinite(pollMs) && pollMs >= 0 ? pollMs : LIVE_PASS_WAIT_MS;
+    const totals = { stored: 0, unchanged: 0, skipped: 0 };
+    let passes = 0;
+    let stalled = 0;
+    let liveWaits = 0;
+    let transientFailures = 0;
+    let last;
+    while (passes < MAX_SYNC_PASSES) {
+        const answer = await ask(door, {
+            path: `/api/notes/accounts/${encodeURIComponent(accountId)}/sync`,
+            method: "POST",
+            label: "notes sync",
+            timeoutMs: WRITE_DEADLINE_MS,
+        });
+        if (!answer.ok) {
+            // A timeout or a 5xx mid-history is the call's, not the account's: the
+            // cursor was saved after every meeting, so asking again resumes. Three in
+            // a row is a real outage and is reported with its reason.
+            const transient = /^(timeout|network|unreachable|http_5\d\d|BLI-E5\d\d|read_failed)/i.test(answer.reason);
+            if (transient && transientFailures < MAX_TRANSIENT_FAILURES) {
+                transientFailures += 1;
+                writeLine(door.io.stderr, `${TAG} sync call failed, retrying ${JSON.stringify({ reason: answer.reason, attempt: transientFailures })}`);
+                await sleepMs(liveWaitMs);
+                continue;
+            }
+            return failRun(door, answer.reason, answer.detail, last, passes, totals);
+        }
+        transientFailures = 0;
+        const run = answer.body.run;
+        if (!run) {
+            writeLine(door.io.stdout, "Tower answered without a run.");
+            return failRun(door, "no_run_in_answer", "Tower answered the sync without a run.", last, passes, totals);
+        }
+        last = run;
+        if (run.reason === "running") {
+            // Another pass (the cron, a second terminal) is live on this account. It
+            // writes the same cursor; wait for it rather than racing it.
+            liveWaits += 1;
+            writeLine(door.io.stderr, `${TAG} another pass is running ${JSON.stringify({ run_id: run.runId ?? null, waits: liveWaits })}`);
+            if (liveWaits > MAX_LIVE_WAITS) {
+                return failRun(door, "pass_still_running", "Another pass kept running on this notetaker. Check `cockpit notes sync-status`, then try again.", last, passes, totals);
+            }
+            await sleepMs(liveWaitMs);
+            continue;
+        }
+        passes += 1;
+        totals.stored += run.notesAdded;
+        totals.unchanged += run.notesUpdated;
+        totals.skipped += run.notesSkipped;
+        const waiting = typeof run.remaining === "number" ? `; ${run.remaining} waiting` : "";
+        const line = `pass ${passes}: ${run.reason}: ${run.notesAdded} stored, ${run.notesUpdated} unchanged, ${run.notesSkipped} skipped${run.more ? `${waiting}, continuing` : ""}.`;
+        // Progress is commentary in --json (stdout is the one answer), and the
+        // answer in a terminal.
+        writeLine(door.json ? door.io.stderr : door.io.stdout, line);
+        if (run.detail && !run.ok)
+            writeLine(door.json ? door.io.stderr : door.io.stdout, run.detail);
+        if (!run.ok) {
+            return failRun(door, run.reason, run.detail || `The pass ended ${run.reason}.`, run, passes, totals);
+        }
+        if (!run.more) {
+            if (door.json)
+                return emit(door, { ok: true, passes, totals, run });
+            writeLine(door.io.stdout, `Caught up after ${passes} pass${passes === 1 ? "" : "es"}: ${totals.stored} stored, ${totals.unchanged} unchanged, ${totals.skipped} skipped.`);
+            return 0;
+        }
+        // A pass that handled nothing and still says "more" would loop forever.
+        if (run.notesAdded + run.notesUpdated + run.notesSkipped === 0)
+            stalled += 1;
+        else
+            stalled = 0;
+        if (stalled >= MAX_STALLED_PASSES) {
+            return failRun(door, "no_progress", `Three passes in a row handled no meeting (last: ${run.reason}). The cursor is saved; try again later or check \`cockpit notes sync-status\`.`, run, passes, totals);
+        }
+    }
+    return failRun(door, "too_many_passes", `Stopped after ${MAX_SYNC_PASSES} passes with meetings still waiting. Run \`cockpit notes sync ${accountId}\` again to continue from the saved cursor.`, last, passes, totals);
+}
+/** A sync that did not finish: the reason on stderr, the structured answer on stdout in --json. */
+function failRun(door, reason, detail, run, passes, totals) {
+    writeLine(door.io.stderr, `${TAG} sync stopped ${JSON.stringify({ reason, passes })}`);
+    if (door.json) {
+        writeLine(door.io.stdout, JSON.stringify({ ok: false, error: reason, detail, passes, totals, run }));
+    }
+    else {
+        writeLine(door.io.stderr, detail);
+    }
+    return 1;
+}
+function sleepMs(ms) {
+    return ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
+}

package/dist/commands/notes-wisprflow-login.js

@@ -1,219 +1,188 @@
 /**
- * `cockpit notes connect --provider wisprflow` — signing a person into Wispr
- * Flow's MCP server from a terminal (BLI-12926).
+ * `cockpit notes connect --provider wisprflow` — connecting Wispr Flow from a
+ * terminal (BLI-12926, rebuilt by BLI-17973 as one backend door).
  *
- * Wispr Flow has no API key for meetings. Its Notetaker is read through a
- * remote MCP server behind OAuth (docs.wisprflow.ai, "Connect Claude, ChatGPT
- * or another MCP client to Wispr Flow": "no API key or token is needed"). Its
- * authorization server publishes, at
- * `https://mcp-auth.wisprflow.com/.well-known/oauth-authorization-server`
- * (read 2026-10-08), dynamic client registration, PKCE `S256`, a refresh-token
- * grant and the RFC 8628 DEVICE grant. The device grant is the one a terminal
- * can use: it prints an address and a short code, the person approves in their
- * own browser (Google, Apple, Microsoft or company single sign-on; an
- * email-and-password Wispr account cannot complete MCP authorization), and this
- * file polls until Wispr hands back a refresh token.
+ * Wispr Flow has no API key for meetings: its Notetaker is read through a
+ * remote MCP server behind OAuth, and the sign-in is a person approving on
+ * Wispr's page. The first terminal version registered a device-grant client
+ * straight from the collector; Wispr's registration endpoint now refuses it
+ * (HTTP 400 `invalid_client_metadata`) and the command still exited 0. The
+ * second version only opened Tower's Settings page, which made the CLI a
+ * wrapper around the web UI.
  *
- * What leaves this machine: a client registration, then the device and token
- * calls, all to Wispr's own authorization server. The refresh token goes into a
- * bundle (`{ v, client_id, refresh_token }`) that `connect` posts to Tower's
- * accounts door, which seals it. It is never printed, never written to a file
- * and never put in a flag; `--json` shows the account, not the bundle.
+ * Now the terminal is a plain client of the same backend door the Settings
+ * button, the MCP tools and JARVIS call, with its own caller identity (this
+ * machine's device token):
  *
- * **No live call has been made from this code.** Every shape is the RFC's, and
- * the first real sign-in is the proof. In particular it is NOT known whether
- * Wispr's server accepts a dynamically registered client on the device grant
- * (the document lists both, not that they combine); if it does not, the refusal
- * below says what Wispr answered and `--key-stdin` accepts a bundle made by any
- * other means.
+ * 1. `POST /api/notes/accounts/wisprflow/start` answers `{ authorize_url,
+ *    attempt_id, expires_at }`. The OAuth state and PKCE verifier stay on
+ *    Tower's server; the terminal never sees a secret. Wispr Flow already
+ *    connected is refused by the door (`account_already_connected`).
+ * 2. The address is printed first (a machine with no browser loses nothing),
+ *    then opened with `browser-open.ts`, the one opener the collector has.
+ * 3. `GET /api/notes/accounts/wisprflow/status?attempt_id=` is polled every few
+ *    seconds, up to ten minutes, until the attempt is `connected`, `failed` or
+ *    `expired`. Every refusal carries a reason label and the caller exits 1.
  *
  * stdout carries nothing from here; every line is stderr commentary.
  */
 import { writeLine } from "./cli-io.js";
-export const WISPRFLOW_AUTH_ISSUER = "https://mcp-auth.wisprflow.com";
-export const WISPRFLOW_MCP_RESOURCE = "https://api.wisprflow.ai/connect/mcp";
-const SCOPE = "openid offline_access";
-const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-const REQUEST_DEADLINE_MS = 30_000;
-/** RFC 8628: a client polls no faster than the server's interval, default 5 s. */
-const DEFAULT_INTERVAL_SECONDS = 5;
-/** Never wait on a person longer than this, whatever the server says. */
-const MAX_WAIT_SECONDS = 15 * 60;
+import { openInBrowser } from "./browser-open.js";
+import { ask, READ_DEADLINE_MS } from "./notes-door.js";
+export const WISPRFLOW_START_PATH = "/api/notes/accounts/wisprflow/start";
+export const WISPRFLOW_STATUS_PATH = "/api/notes/accounts/wisprflow/status";
+/** How often the status door is asked whether the sign-in has landed. */
+const POLL_INTERVAL_MS = 5_000;
+/** Never wait on a person longer than this. */
+const MAX_WAIT_MS = 10 * 60 * 1000;
+/** A flaky read is retried; this many in a row is a real outage and ends the wait. */
+const MAX_CONSECUTIVE_READ_FAILURES = 4;
 const TAG = "[notes wisprflow signin]";
-export async function signInToWisprflow(options) {
-    const { io } = options;
+/** What a person reads for a failed attempt, keyed on the status door's reason label. */
+const FAILURE_SENTENCES = {
+    access_denied: "Wispr Flow says the sign-in was declined, so nothing was connected.",
+    state_expired: "The sign-in was not approved within ten minutes, so it expired and nothing was connected.",
+    state_already_used: "That sign-in link was already used, so nothing was connected.",
+    wisprflow_token_refused: "Wispr Flow refused to finish the sign-in, so nothing was connected.",
+    no_refresh_token: "Wispr Flow signed you in but did not allow Tower to keep reading, so it would stop working within the hour. Nothing was connected.",
+    account_already_connected: "Wispr Flow is already connected to your Tower account. Detach it first, then sign in again.",
+    credential_key_unavailable: "Tower could not safely store the sign-in just now, so nothing was connected.",
+    wisprflow_unreachable: "Tower could not reach Wispr Flow just now, so nothing was connected.",
+    wisprflow_registration_refused: "Wispr Flow would not start a sign-in for Tower, so nothing was connected.",
+};
+function failureDetail(reason) {
+    return FAILURE_SENTENCES[reason] ?? `The Wispr Flow sign-in ended without connecting (${reason}).`;
+}
+export async function connectWisprflowInBrowser(door, options = {}) {
     const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const now = options.now ?? Date.now;
-    const metadata = await readMetadata(io);
-    if (!metadata.ok)
-        return metadata;
-    // 1. Register a client. A public client: no secret, only an id.
-    const registered = await postJson(io, metadata.value.registration_endpoint, {
-        client_name: "Tower (BLI) notes sync",
-        grant_types: [DEVICE_GRANT, "refresh_token"],
-        response_types: [],
-        token_endpoint_auth_method: "none",
-        scope: SCOPE,
+    const open = options.open ?? ((url) => openInBrowser(url));
+    const stderr = door.io.stderr;
+    // 1. Ask the one start door for a sign-in.
+    const started = await ask(door, {
+        path: WISPRFLOW_START_PATH,
+        method: "POST",
+        label: "notes wisprflow start",
+        timeoutMs: READ_DEADLINE_MS,
+        body: {},
     });
-    if (!registered.ok)
-        return explain(io, "registration", registered);
-    const clientId = stringField(registered.body, "client_id");
-    if (!clientId) {
-        return { ok: false, reason: "wisprflow_registration_unusable", detail: "Wispr Flow accepted the registration but sent no client id." };
+    if (!started.ok) {
+        log(door, "start refused", { reason: started.reason });
+        if (started.reason === "account_already_connected")
+            return alreadyConnected(door);
+        return { ok: false, reason: started.reason, detail: started.detail };
     }
-    // 2. Ask for a code.
-    const device = await postForm(io, metadata.value.device_authorization_endpoint, {
-        client_id: clientId,
-        scope: SCOPE,
-        resource: WISPRFLOW_MCP_RESOURCE,
-    });
-    if (!device.ok)
-        return explain(io, "device code", device);
-    const deviceCode = stringField(device.body, "device_code");
-    const userCode = stringField(device.body, "user_code");
-    const address = stringField(device.body, "verification_uri_complete") ?? stringField(device.body, "verification_uri");
-    if (!deviceCode || !userCode || !address) {
-        return { ok: false, reason: "wisprflow_device_unusable", detail: "Wispr Flow's device answer was missing its code or its address." };
+    const body = started.body;
+    const authorizeUrl = typeof body.authorize_url === "string" ? body.authorize_url : "";
+    const attemptId = typeof body.attempt_id === "string" ? body.attempt_id : "";
+    if (authorizeUrl === "" || attemptId === "") {
+        log(door, "start answer unusable", { reason: "start_answer_unusable" });
+        return {
+            ok: false,
+            reason: "start_answer_unusable",
+            detail: "Tower started a sign-in but did not say where to send you or how to watch it, so nothing was connected.",
+        };
     }
-    const waitSeconds = Math.min(numberField(device.body, "expires_in") ?? MAX_WAIT_SECONDS, MAX_WAIT_SECONDS);
-    let intervalMs = (numberField(device.body, "interval") ?? DEFAULT_INTERVAL_SECONDS) * 1000;
-    writeLine(io.stderr, "Sign in to Wispr Flow to let Tower read your meeting notes:");
-    writeLine(io.stderr, `  1. Open  ${address}`);
-    writeLine(io.stderr, `  2. If it asks, enter the code  ${userCode}`);
-    writeLine(io.stderr, "  Use the Wispr account that holds your notes, signed in with Google, Apple, Microsoft or company single sign-on.");
-    writeLine(io.stderr, `Waiting up to ${Math.round(waitSeconds / 60)} minutes for you to approve...`);
-    log(io, "waiting", { interval_s: intervalMs / 1000, wait_s: waitSeconds });
-    // 3. Poll.
-    const deadline = now() + waitSeconds * 1000;
+    log(door, "started", { attempt_id: attemptId, expires_at: typeof body.expires_at === "string" ? body.expires_at : null });
+    // 2. Print the address first, then open it.
+    writeLine(stderr, "Connect Wispr Flow to Tower: approve on Wispr's page in your browser.");
+    writeLine(stderr, `  ${authorizeUrl}`);
+    writeLine(stderr, "  Use the Wispr account that holds your notes, signed in with Google, Apple, Microsoft or company single sign-on.");
+    const opened = open(authorizeUrl);
+    log(door, "browser open attempted", opened.ok ? { reason: opened.reason, program: opened.program } : { reason: opened.reason });
+    if (!opened.ok)
+        writeLine(stderr, `(${opened.detail} The address above still works.)`);
+    writeLine(stderr, `Waiting up to ${MAX_WAIT_MS / 60_000} minutes for the sign-in to finish...`);
+    // 3. Poll the one status door.
+    const deadline = now() + MAX_WAIT_MS;
+    let polls = 0;
+    let failures = 0;
     while (now() < deadline) {
-        await sleep(intervalMs);
-        const polled = await postForm(io, metadata.value.token_endpoint, {
-            grant_type: DEVICE_GRANT,
-            device_code: deviceCode,
-            client_id: clientId,
-            resource: WISPRFLOW_MCP_RESOURCE,
+        polls += 1;
+        const polled = await ask(door, {
+            path: `${WISPRFLOW_STATUS_PATH}?attempt_id=${encodeURIComponent(attemptId)}`,
+            method: "GET",
+            label: "notes wisprflow status",
+            timeoutMs: READ_DEADLINE_MS,
         });
-        if (polled.ok) {
-            const refreshToken = stringField(polled.body, "refresh_token");
-            if (!refreshToken) {
-                return {
-                    ok: false,
-                    reason: "wisprflow_no_offline_access",
-                    detail: "Wispr Flow signed you in but did not hand back a refresh token, so Tower could not read your meetings"
-                        + " every half hour without you. Nothing was connected.",
-                };
+        if (!polled.ok) {
+            failures += 1;
+            log(door, "poll failed", { attempt_id: attemptId, polls, reason: polled.reason, consecutive_failures: failures });
+            // The attempt itself is gone or not ours: waiting longer cannot change that.
+            if (polled.reason === "attempt_not_found" || failures >= MAX_CONSECUTIVE_READ_FAILURES) {
+                return { ok: false, reason: polled.reason, detail: polled.detail };
             }
-            log(io, "signed in", { client_registered: true, refresh_token_received: true });
-            return {
-                ok: true,
-                bundle: JSON.stringify({ v: 1, client_id: clientId, refresh_token: refreshToken }),
-            };
-        }
-        const code = stringField(polled.body, "error");
-        if (code === "authorization_pending")
-            continue;
-        if (code === "slow_down") {
-            intervalMs += 5000;
-            continue;
         }
-        if (code === "expired_token") {
-            return { ok: false, reason: "wisprflow_code_expired", detail: "The code expired before it was approved. Run the command again." };
-        }
-        if (code === "access_denied") {
-            return { ok: false, reason: "wisprflow_denied", detail: "Wispr Flow says the request was declined. Nothing was connected." };
+        else {
+            failures = 0;
+            const status = polled.body;
+            const state = typeof status.status === "string" ? status.status : "unknown";
+            const reason = typeof status.reason === "string" ? status.reason : null;
+            log(door, "poll", { attempt_id: attemptId, polls, status: state, reason });
+            if (state === "connected") {
+                const accountId = typeof status.account_id === "string" ? status.account_id : "";
+                log(door, "connected", { attempt_id: attemptId, account_id: accountId || null, polls });
+                return { ok: true, account: await readAccount(door, accountId), already: false };
+            }
+            if (state === "failed" || state === "expired") {
+                const why = reason ?? (state === "expired" ? "state_expired" : "unknown");
+                log(door, "ended without connecting", { attempt_id: attemptId, status: state, reason: why });
+                return { ok: false, reason: why, detail: failureDetail(why) };
+            }
         }
-        return explain(io, "sign-in", polled);
+        await sleep(POLL_INTERVAL_MS);
     }
-    return { ok: false, reason: "wisprflow_timed_out", detail: "Nobody approved the code in time. Run the command again." };
-}
-/** Metadata only: a step, a status and an OAuth error label. Never a code or a token. */
-function log(io, message, fields) {
-    writeLine(io.stderr, `${TAG} ${message} ${JSON.stringify(fields)}`);
+    log(door, "timed out", { attempt_id: attemptId, polls });
+    return {
+        ok: false,
+        reason: "wisprflow_timed_out",
+        detail: "The sign-in did not finish within 10 minutes, so nothing was connected."
+            + " Run this again for a fresh link, or check `cockpit notes accounts`.",
+    };
 }
-async function readMetadata(io) {
-    const got = await send(io, `${WISPRFLOW_AUTH_ISSUER}/.well-known/oauth-authorization-server`, { method: "GET" });
-    if (!got.ok)
-        return explain(io, "discovery", got);
-    const registration = stringField(got.body, "registration_endpoint");
-    const device = stringField(got.body, "device_authorization_endpoint");
-    const token = stringField(got.body, "token_endpoint");
-    if (!registration || !device || !token) {
+/** The start door said Wispr Flow is already connected: read which account and report it honestly. */
+async function alreadyConnected(door) {
+    const accounts = await readAccounts(door);
+    const existing = accounts?.find((account) => account.provider === "wisprflow");
+    if (!existing) {
         return {
             ok: false,
-            reason: "wisprflow_discovery_changed",
-            detail: "Wispr Flow's sign-in no longer advertises client registration and the device flow. Tower cannot sign you in from a terminal until it does.",
+            reason: "account_already_connected",
+            detail: failureDetail("account_already_connected"),
         };
     }
-    // Every endpoint must stay on Wispr's own host: a discovery document that
-    // points the token call somewhere else is not one to send a code to.
-    for (const endpoint of [registration, device, token]) {
-        if (!endpoint.startsWith(`${WISPRFLOW_AUTH_ISSUER}/`)) {
-            return { ok: false, reason: "wisprflow_discovery_changed", detail: "Wispr Flow's sign-in points at a host Tower does not recognise, so nothing was sent." };
-        }
-    }
-    return { ok: true, value: { registration_endpoint: registration, device_authorization_endpoint: device, token_endpoint: token } };
-}
-async function postJson(io, url, body) {
-    return send(io, url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
-        body: JSON.stringify(body),
-    });
-}
-async function postForm(io, url, body) {
-    return send(io, url, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
-        body: new URLSearchParams(body).toString(),
-    });
-}
-async function send(io, url, init) {
-    const call = io.fetch;
-    const controller = new AbortController();
-    const deadline = setTimeout(() => controller.abort(), REQUEST_DEADLINE_MS);
-    try {
-        const response = await call(url, { ...init, signal: controller.signal });
-        let body = null;
-        try {
-            body = await response.json();
-        }
-        catch {
-            body = null;
-        }
-        return response.ok ? { ok: true, body } : { ok: false, status: response.status, body, network: false };
-    }
-    catch {
-        return { ok: false, status: 0, body: null, network: true };
-    }
-    finally {
-        clearTimeout(deadline);
-    }
-}
-/** A refusal in the vendor's own words: its OAuth error label, never a body dump. */
-function explain(io, step, failure) {
-    if (failure.network) {
-        return { ok: false, reason: "wisprflow_unreachable", detail: `Could not reach Wispr Flow's sign-in during ${step}. Check the connection and try again.` };
-    }
-    const label = stringField(failure.body, "error");
-    const words = stringField(failure.body, "error_description");
-    log(io, "refused", { step, http_status: failure.status, oauth_error: label ?? "none" });
+    log(door, "already connected", { account_id: existing.id, status: existing.status });
+    if (existing.status === "active")
+        return { ok: true, account: existing, already: true };
     return {
         ok: false,
-        reason: `wisprflow_${step.replace(/\s+/g, "_")}_refused`,
-        detail: `Wispr Flow refused the ${step} step (HTTP ${failure.status}${label ? `, ${label}` : ""}).`
-            + `${words ? ` It said: ${words.slice(0, 200)}` : ""}`
-            + " Nothing was connected.",
+        reason: "wisprflow_needs_detach",
+        detail: `Wispr Flow is connected (${existing.id}) but its status is ${existing.status}`
+            + `${existing.status_reason ? ` (${existing.status_reason})` : ""}. `
+            + `Detach it first with \`cockpit notes detach ${existing.id}\`, then run this again.`,
     };
 }
-function stringField(body, name) {
-    if (typeof body !== "object" || body === null)
-        return null;
-    const value = body[name];
-    return typeof value === "string" && value.trim() !== "" ? value : null;
+/** The account row for the id the status door named. A failed read still reports the id. */
+async function readAccount(door, accountId) {
+    const accounts = await readAccounts(door);
+    const found = accounts?.find((account) => account.id === accountId) ?? accounts?.find((account) => account.provider === "wisprflow");
+    return found ?? { id: accountId, provider: "wisprflow", label: null, workspace: null, status: "active", status_reason: null };
 }
-function numberField(body, name) {
-    if (typeof body !== "object" || body === null)
+async function readAccounts(door) {
+    const answer = await ask(door, {
+        path: "/api/notes/accounts",
+        method: "GET",
+        label: "notes accounts",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok) {
+        log(door, "accounts read failed", { reason: answer.reason });
         return null;
-    const value = body[name];
-    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+    }
+    const accounts = answer.body.accounts;
+    return Array.isArray(accounts) ? accounts : [];
+}
+/** Metadata only: a step and counts or a reason label. Never a token, never a URL, never a body. */
+function log(door, message, fields) {
+    writeLine(door.io.stderr, `${TAG} ${message} ${JSON.stringify(fields)}`);
 }

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.213");
+    writeLine(io?.stdout ?? process.stdout, "0.2.217");
     return 0;
   }
 

package/dist/commands/team.js

@@ -37,6 +37,8 @@ export async function runTeam(command, io) {
         return deviceList(command, tower, io);
     if (command.action === "device-doctor")
         return deviceDoctor(command, tower, io);
+    if (command.action === "device-scope")
+        return deviceScope(command, tower, io);
     return deviceRevoke(command, tower, io);
 }
 async function showMembers(command, tower, io) {
@@ -212,6 +214,36 @@ async function deviceDoctor(command, tower, io) {
     writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, ...asRecord(result.body) }) : `Doctor requested for ${device.device_name ?? device.device_id}. Waiting for its next check-in.`);
     return 0;
 }
+/**
+ * `cockpit team device scope <id|name> notetaker_bot|none` (BLI-17978): the ONE door that gives the meeting bot's
+ * device the capability Tower's claim door requires, or takes it away. Super admin on the server; the word `none`
+ * is the CLI's spelling of "no scope". It replaces the manual SQL step the bot's README used to carry.
+ */
+async function deviceScope(command, tower, io) {
+    const listed = await callTower(tower, { path: "/api/team/devices", label: "team device scope lookup" });
+    if (!listed.ok)
+        return writeCommandFailure(io, command.json, listed);
+    const device = findDevice(devicesOf(asRecord(listed.body)), command.deviceRef ?? "");
+    if (!device)
+        return writeCommandFailure(io, command.json, { reason: "device_not_found", detail: "No unique device matches. Run cockpit team device list to see ids and names." });
+    const result = await callTower(tower, {
+        path: `/api/ambient/devices/${encodeURIComponent(device.device_id)}/scope`,
+        method: "POST", label: "team device scope", body: { scope: command.deviceScope },
+    });
+    writeLine(io.stderr, `[team cli] device scope ${JSON.stringify({ device_id: device.device_id, scope: command.deviceScope, outcome: result.ok ? "answered" : result.reason })}`);
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    const name = String(device.device_name ?? device.device_id);
+    writeLine(io.stdout, body.changed === false
+        ? `${name} already has ${command.deviceScope === "none" ? "no scope" : "the notetaker_bot scope"}. Nothing changed.`
+        : command.deviceScope === "none" ? `Took the service scope away from ${name}.` : `${name} now holds the notetaker_bot scope. The bot's next claim will go through.`);
+    return 0;
+}
 /** Exact directory labels locate a roster id; attribution remains the server resolver's job. */
 async function githubLogin(command, tower, io) {
     let personId = command.personRef ?? "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.213",
+  "version": "0.2.217",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.66",
-    "@bli-cockpit/mcp": "0.1.122",
+    "@bli-cockpit/mcp": "0.1.125",
     "@bli-cockpit/telemetry-core": "0.1.75"
   },
   "repository": {