@bli-cockpit/cli 0.2.218 → 0.2.221

package/dist/commands/heartbeat-token-lock.js

@@ -0,0 +1,138 @@
+/**
+ * The single-flight lock around the heartbeat's token exchange (BLI-17994).
+ *
+ * The heartbeat is the one door a device token is offered a successor
+ * through, and it is called from three places: the launchd / Task Scheduler
+ * tick, a manual `cockpit sync`, and `cockpit doctor`. Two of them can fire in
+ * the same second. Without a lock both read `session.json` holding the same
+ * token, both knock with it, and the second's rotation request races the
+ * first's reply (the server answers "rotation_pending", but two writers of
+ * `session.json` still interleave). With it they take turns: the second one
+ * reads the file AFTER the first stored the pending token and knocks with that,
+ * which is exactly the "first use" that promotes it.
+ *
+ * The same code runs on macOS and Windows: an exclusive-create (`wx`) lock file
+ * in the state directory, no `flock`, no platform branch. A holder that died
+ * leaves a file that goes stale after a minute and is taken over.
+ *
+ * The lock is a courtesy, never a gate. The server is safe without it (a
+ * request can never destroy a token that is still in use), so a lock file that
+ * cannot be created at all (read-only volume, antivirus) lets the heartbeat go
+ * ahead, loudly. Only a lock that stays HELD past the wait skips this tick, and
+ * a heartbeat is not spooled: the next tick is fifteen minutes away.
+ *
+ * A new module here must also join `scripts/build-public-cli.mjs`
+ * `runtimeFiles`, or the repo tests stay green while the packed CLI breaks.
+ */
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { describeError } from "../health-detail.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+const LOCK_FILENAME = "token-rotation.lock";
+/** A heartbeat holds the lock for one HTTP call (5 s timeout) plus a few file reads. */
+export const TOKEN_LOCK_STALE_MS = 60_000;
+/** How long a second caller waits for the first before skipping this tick's heartbeat. */
+export const TOKEN_LOCK_WAIT_MS = 8_000;
+const POLL_MS = 150;
+export async function acquireTokenRotationLock(homeDir, options = {}) {
+    const paths = getCollectorRuntimePaths(homeDir);
+    const lockPath = path.join(paths.state_dir, LOCK_FILENAME);
+    const waitMs = options.waitMs ?? TOKEN_LOCK_WAIT_MS;
+    const staleMs = options.staleMs ?? TOKEN_LOCK_STALE_MS;
+    const pollMs = options.pollMs ?? POLL_MS;
+    const owner = crypto.randomUUID();
+    const started = Date.now();
+    try {
+        await fs.mkdir(paths.state_dir, { recursive: true, mode: 0o700 });
+    }
+    catch (error) {
+        return unlocked("state_dir_unavailable", error, started);
+    }
+    for (;;) {
+        try {
+            const handle = await fs.open(lockPath, "wx", 0o600);
+            await handle.writeFile(`${JSON.stringify({ pid: process.pid, owner, at_ms: Date.now() })}\n`);
+            await handle.close();
+            const waited = Date.now() - started;
+            if (waited > pollMs) {
+                console.error("[heartbeat] waited for another heartbeat to finish its token exchange", JSON.stringify({ reason: "token_lock_acquired_after_wait", waited_ms: waited }));
+            }
+            return {
+                acquired: true,
+                waited_ms: waited,
+                mode: "held",
+                release: async () => {
+                    // Only remove a lock that is still ours: a holder that was taken over
+                    // as stale must not delete its successor's lock.
+                    const current = await readOwner(lockPath);
+                    if (current === owner)
+                        await fs.rm(lockPath, { force: true }).catch(() => undefined);
+                },
+            };
+        }
+        catch (error) {
+            if (error?.code !== "EEXIST") {
+                return unlocked("lock_file_unwritable", error, started);
+            }
+        }
+        const heldAt = await readHeldAt(lockPath);
+        if (heldAt === "gone")
+            continue; // released between our create and our read: try again at once
+        if (Date.now() - heldAt > staleMs) {
+            // A holder that died: take the lock over.
+            console.error("[heartbeat] removing a stale token-exchange lock", JSON.stringify({ reason: "token_lock_stale_taken_over", age_ms: Date.now() - heldAt }));
+            await fs.rm(lockPath, { force: true }).catch(() => undefined);
+            continue;
+        }
+        if (Date.now() - started >= waitMs) {
+            console.error("[heartbeat] another heartbeat is still exchanging the device token; skipping this tick's check-in", JSON.stringify({ reason: "token_lock_busy", waited_ms: Date.now() - started, next_action: "the next tick checks in" }));
+            return { acquired: false, waited_ms: Date.now() - started };
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollMs));
+    }
+}
+/** Run `work` under the lock; `skipped` is the answer when the lock stays held past the wait. */
+export async function withTokenRotationLock(homeDir, options, skipped, work) {
+    const lock = await acquireTokenRotationLock(homeDir, options);
+    if (!lock.acquired)
+        return skipped;
+    try {
+        return await work();
+    }
+    finally {
+        await lock.release();
+    }
+}
+function unlocked(reason, error, started) {
+    console.error("[heartbeat] could not create the token-exchange lock; checking in without it (the dashboard stays safe without it)", JSON.stringify({ reason: `token_lock_${reason}`, ...describeError(error) }));
+    return { acquired: true, waited_ms: Date.now() - started, mode: "unlocked", release: async () => undefined };
+}
+async function readOwner(lockPath) {
+    try {
+        const raw = JSON.parse(await fs.readFile(lockPath, "utf8"));
+        return typeof raw["owner"] === "string" ? raw["owner"] : null;
+    }
+    catch {
+        // Gone or unreadable: not provably ours, so release leaves it alone.
+        return null;
+    }
+}
+/** When the lock was taken (ms), `"gone"` if the file no longer exists. A half-written file is dated by its mtime. */
+async function readHeldAt(lockPath) {
+    try {
+        const raw = JSON.parse(await fs.readFile(lockPath, "utf8"));
+        if (typeof raw["at_ms"] === "number" && Number.isFinite(raw["at_ms"]))
+            return raw["at_ms"];
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return "gone";
+    }
+    try {
+        return (await fs.stat(lockPath)).mtimeMs;
+    }
+    catch {
+        return "gone";
+    }
+}

package/dist/commands/heartbeat-token.js

@@ -1,5 +1,8 @@
 import { describeError } from "../health-detail.js";
+import { writeJsonFileAtomic } from "../local-state-files.js";
 import { getCollectorRuntimePaths, readLocalCollectorSessionFile, recordDeviceTokenExpiry, toSessionReference, } from "../local-state.js";
+/** The request header that tells the dashboard this build stores a rotated token (BLI-17994). */
+export const TOKEN_ROTATION_HEADER = "x-cockpit-token-rotation";
 /**
  * Read the session and decide whether this tick may check in.
  *
@@ -33,7 +36,7 @@ export async function readHeartbeatSession(homeDir) {
         console.error("[heartbeat] this machine's session looks expired; checking in anyway so the dashboard can renew it", JSON.stringify({
             reason: "session_expired_locally",
             expires_at: session.expires_at ?? null,
-            next_action: "the dashboard renews a token that lapsed inside its 30-day grace window on this call",
+            next_action: "a token inside its rotation window is swapped on this call; one past its date needs `cockpit doctor`",
         }));
     }
     return { usable: true, session, state: state };
@@ -66,6 +69,43 @@ export async function recordHeartbeatTokenExpiry(homeDir, response) {
         return null;
     });
 }
+/**
+ * Store the PENDING device token the heartbeat door handed back (BLI-17994).
+ *
+ * `reply` is the parsed heartbeat body. No `pending_device_token` in it is the
+ * normal case (nothing was due, or a successor is already waiting) and says
+ * nothing. When there is one, it is written to `session.json` in ONE atomic
+ * rename (write a temp file, rename over the session), so no reader (the sync,
+ * the memory hooks, the MCP servers) ever sees a half-written file. The date is
+ * deliberately NOT touched: a pending token has not been used yet, so the
+ * server has not moved the date. The first request that carries it promotes it
+ * and retires the old token; the reply to that request carries the new date,
+ * which `recordHeartbeatTokenExpiry` stores.
+ *
+ * A reply that is malformed, or a write that fails, keeps the current token,
+ * which stays valid until its own date; the server offers another pending
+ * token after ten minutes. Never throws.
+ */
+export async function recordHeartbeatPendingToken(homeDir, reply) {
+    const incoming = reply?.["pending_device_token"];
+    if (incoming === undefined)
+        return { status: "none" };
+    if (typeof incoming !== "string" || !/^bli_dev_[A-Za-z0-9_-]{16,}$/.test(incoming)) {
+        console.error("[heartbeat] the dashboard sent a device token this build does not recognise; keeping the one it has", JSON.stringify({ reason: "pending_token_malformed" }));
+        return { status: "skipped", reason: "pending_token_malformed" };
+    }
+    const paths = getCollectorRuntimePaths(homeDir);
+    try {
+        const session = await readLocalCollectorSessionFile(paths);
+        await writeJsonFileAtomic(paths.session_file, { ...session, device_token: incoming });
+        console.error("[heartbeat] stored the pending device token; the first request that uses it makes it current", JSON.stringify({ reason: "pending_token_stored", expires_at: session.expires_at ?? null }));
+        return { status: "stored" };
+    }
+    catch (error) {
+        console.error("[heartbeat] the pending device token could not be stored; keeping the one this machine has, which stays valid until its date", JSON.stringify({ reason: "pending_token_write_failed", ...describeError(error) }));
+        return { status: "skipped", reason: "pending_token_write_failed" };
+    }
+}
 async function readTokenExpiry(response) {
     try {
         const body = (await response.json());

package/dist/commands/heartbeat.js

@@ -31,7 +31,8 @@ import { readStagingInventory } from "../disk-usage.js";
 import { describeError } from "../health-detail.js";
 import { shouldSuppressFleetReceipts, } from "../dev-build.js";
 import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, } from "../local-state.js";
-import { noteHeartbeatRefusal, readHeartbeatSession, recordHeartbeatTokenExpiry, } from "./heartbeat-token.js";
+import { noteHeartbeatRefusal, readHeartbeatSession, recordHeartbeatTokenExpiry, recordHeartbeatPendingToken, TOKEN_ROTATION_HEADER, } from "./heartbeat-token.js";
+import { withTokenRotationLock } from "./heartbeat-token-lock.js";
 import { classifySyncHealthError } from "../sync-health-class.js";
 import { readMemoryReceiptFile } from "./memory-install-receipt.js";
 import { readMemoryHookCounts } from "./memory-hook-counts.js";
@@ -220,6 +221,11 @@ export async function readHeartbeatMemoryReceipt(options) {
  * `sync.err.log` alone when the dashboard says a device is quiet.
  */
 export async function sendCollectorHeartbeatBestEffort(options) {
+    // BLI-17994. Single-flight: a launchd tick and a manual sync take turns, so
+    // the second reads `session.json` AFTER the first stored its pending token.
+    return withTokenRotationLock(options.homeDir, options.lock, false, () => sendCollectorHeartbeatLocked(options));
+}
+async function sendCollectorHeartbeatLocked(options) {
     // BLI-3554. A checkout's heartbeat would move `last_seen_at` on a real fleet
     // device row, so an agent's worktree could keep a genuinely dead machine
     // looking alive to the BLI-3550 reader.
@@ -282,6 +288,9 @@ export async function sendCollectorHeartbeatBestEffort(options) {
             headers: {
                 "Content-Type": "application/json",
                 Authorization: `Bearer ${session.device_token}`,
+                // BLI-17994. "I store a renewed token if you send one": the dashboard
+                // only rotates for a collector that says so.
+                [TOKEN_ROTATION_HEADER]: "1",
             },
             body: JSON.stringify(heartbeat),
             signal: controller.signal,
@@ -293,24 +302,33 @@ export async function sendCollectorHeartbeatBestEffort(options) {
             // that decides what a failure is — a 401/403 is `auth_failed` and
             // anything else is not, read off the observed status and never off the
             // words in a message (BLI-3551's rule).
+            // BLI-17994. The door names why it refused (`device_token_expired`,
+            // `device_token_replaced`) in a `reason` field; say it here rather than
+            // leaving a bare status.
+            const refusal = await Promise.resolve().then(() => response.clone().json()).catch(() => null);
             console.error("[heartbeat] the dashboard refused this tick's heartbeat", JSON.stringify({
                 reason: "heartbeat_rejected",
                 health_class: classifySyncHealthError({ httpStatus: response.status }),
                 http_status: response.status,
                 root_count: heartbeat.roots.length,
+                ...(typeof refusal?.["reason"] === "string" ? { server_reason: refusal["reason"] } : {}),
                 ...(response.status === 401 || response.status === 403
                     ? {
-                        next_action: "past the 30-day grace window this needs `cockpit login` on this machine",
+                        next_action: "this token expired, was replaced or was revoked: run `cockpit doctor` to pair this machine again",
                     }
                     : {}),
             }));
             return false;
         }
-        // BLI-4019. The server slides `token_expires_at` out on every call it
-        // authenticates and answers with the result; the sibling records it, so
-        // this machine's own copy follows the server rather than drifting.
+        // The reply carries `token_expires_at` (and a `pending_device_token` when
+        // the token was near its end); the sibling records both, so this machine's
+        // own copy follows the server rather than drifting.
         const reply = await response.clone().json().catch(() => null);
         noteDoctorRequest(reply?.device_action);
+        // BLI-17994. Store a pending successor if the door handed one out (the
+        // date does not move: a pending token has not been used), then the date the
+        // door reports, which moves only when this request promoted a token.
+        await recordHeartbeatPendingToken(options.homeDir, reply);
         await recordHeartbeatTokenExpiry(options.homeDir, response);
         console.error("[heartbeat] checked in", JSON.stringify({
             reason: "heartbeat_recorded",

package/dist/commands/local-args-tower-pages.js

@@ -215,6 +215,7 @@ const NOTES_ACTIONS = new Set([
     "webhook",
     // Ticket 10718: the Granola cron's own last-several-runs health.
     "granola-status",
+    "transcription-stats",
     "bot-upcoming",
 ]);
 /** Actions whose first positional is the note it acts on. */
@@ -252,6 +253,8 @@ export function parseNotesArgs(args) {
             "--since",
             "--until",
             "--limit",
+            "--month",
+            "--offset",
             "--yes",
             "--json",
             "--tree",
@@ -266,6 +269,10 @@ export function parseNotesArgs(args) {
             // reason `--key-stdin` is: the signing secret never touches argv.
             "--secret-stdin",
             "--show-webhook",
+            // BLI-18006. `sync <id> --repair-truncated` re-reads Wispr Flow notes whose
+            // transcript was stored cut short. A FLAG, not a verb: it is the same sync
+            // door with a different request.
+            "--repair-truncated",
         ],
         valueFlags: [
             "--home",
@@ -280,6 +287,8 @@ export function parseNotesArgs(args) {
             "--since",
             "--until",
             "--limit",
+            "--month",
+            "--offset",
             "--provider",
             "--workspace",
             "--show-webhook",
@@ -290,7 +299,7 @@ export function parseNotesArgs(args) {
     const first = values.positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, or granola-status.`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, granola-status, or transcription-stats.`);
     }
     const rest = values.positionals.slice(first === undefined ? 0 : 1);
     const json = values.booleans.has("--json");
@@ -395,7 +404,30 @@ export function parseNotesArgs(args) {
             throw new Error('notes move needs --to "<shelf>", --clear-shelf, or --folder "<path>".');
         }
     }
+    const repairTruncated = values.booleans.has("--repair-truncated");
+    if (repairTruncated && action !== "sync") {
+        throw new Error("--repair-truncated belongs to `cockpit notes sync <account-id> --repair-truncated`.");
+    }
     const limit = optionalPositiveInteger(values.flags.get("--limit"), "--limit");
+    const month = optionalNonEmpty(values.flags.get("--month"));
+    if (month !== undefined) {
+        if (action !== "transcription-stats") {
+            throw new Error("--month belongs to `cockpit notes transcription-stats --month YYYY-MM`.");
+        }
+        if (!/^\d{4}-(0[1-9]|1[0-2])$/.test(month)) {
+            throw new Error("--month is a calendar month like 2026-10.");
+        }
+    }
+    // BLI-18006: a long note is read in parts, like `cockpit docs read --offset`.
+    const offsetRaw = optionalNonEmpty(values.flags.get("--offset"));
+    let offset;
+    if (offsetRaw !== undefined) {
+        if (action !== "show")
+            throw new Error("--offset belongs to `cockpit notes show <id> --offset <characters> --limit <characters>`.");
+        offset = Number(offsetRaw);
+        if (!Number.isInteger(offset) || offset < 0)
+            throw new Error("--offset must be a whole number 0 or greater.");
+    }
     return {
         kind: "notes",
         ...(values.booleans.has("--wait") ? { wait: true } : {}),
@@ -424,6 +456,9 @@ export function parseNotesArgs(args) {
         since: optionalNonEmpty(values.flags.get("--since")),
         until: optionalNonEmpty(values.flags.get("--until")),
         ...(limit === undefined ? {} : { limit }),
+        ...(month ? { month } : {}),
+        ...(offset === undefined ? {} : { offset }),
+        ...(repairTruncated ? { repairTruncated: true } : {}),
         yes,
         json,
     };

package/dist/commands/local-help-commands-tower.js

@@ -374,7 +374,7 @@ export const TOWER_COMMAND_HELP = [
             "upload, paste and move accept --folder <path>; use / for Root. Shelf placement stays independent.",
             "The /meeting-notes surface, typed. Bare `cockpit notes` lists the library.",
             "list [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] — every note you may open, grouped by shelf, newest meeting first. Never a word of a note.",
-            "show <id> — one note with its text, its shelf, and why you are allowed to see it.",
+            "show <id> [--offset <chars>] [--limit <chars>] — one note with its text, its shelf, and why you are allowed to see it. A long transcript can be read in parts: --offset and --limit are characters (as in `docs read`), and the answer says the note's total size and the --offset to continue from (BLI-18006).",
             "shelf [--limit <n>] — the notes YOU have put in, and what became of each.",
             "shelves — the shelves in use, with how many notes are on each.",
             "upload <paths...> [--exclude \"<sentence>\"] — put one or more local files in. Explicit paths only; your shell does any globbing, and a file that does not exist is named rather than skipped.",
@@ -395,9 +395,11 @@ export const TOWER_COMMAND_HELP = [
             "connect --provider fellow|circleback [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
             "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
             "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
+            "sync <account-id> --repair-truncated — re-read Wispr Flow notes that were stored with only the first part of a long transcript (the \"truncated, N chars remaining\" line), and rewrite them whole. Same door and the same bounded passes; prints found, fixed and failed with each failure's reason, and is safe to run again (BLI-18006).",
             "sync-status [<account-id>] — every notetaker's health, or one's: last successful sync, the last pass's own reason, how many meetings it carried, failures in the last 24h, and the lag between the newest meeting it has read and when it last ran (ticket 10730).",
             "bot-upcoming [--json] — your own Google Meet meetings today that the bot will join, with claim state. Decline or mark private to opt out.",
             "granola-status [--limit <n>] [--json] — the Granola cron's own last several runs (ticket 10718): reason, counts, model, spend and which lookback it used. Granola runs on a shared server-side key, not a connected account, so this is its own read rather than `accounts`.",
+            "transcription-stats [--month YYYY-MM] [--json] — what meeting transcription cost and did (BLI-18003): minutes, dollars (list and real), requests, failures and fallbacks per provider for the UTC month (default: this one), the spend against the monthly cap and how close the 80% message and the hold are, how many meetings are waiting for budget, which provider keys the deploy holds (by name), and how old the numbers are. Switch providers or move the cap with `cockpit settings switches set transcription.provider|transcription.fallback_chain|transcription.monthly_cap_usd <value>`.",
             "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
             "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
             "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",

package/dist/commands/notes-reads.js

@@ -107,9 +107,19 @@ export async function listShelves(command, door) {
     }
     return 0;
 }
+/** `?offset=&limit=` for `notes show`: characters, like `docs read` (BLI-18006). */
+function showQuery(command) {
+    const query = new URLSearchParams();
+    if (command.offset !== undefined)
+        query.set("offset", String(command.offset));
+    if (command.limit !== undefined)
+        query.set("limit", String(command.limit));
+    const rendered = query.toString();
+    return rendered === "" ? "" : `?${rendered}`;
+}
 export async function showNote(command, door) {
     const answer = await ask(door, {
-        path: `/api/notes/library/${encodeURIComponent(command.noteId ?? "")}`,
+        path: `/api/notes/library/${encodeURIComponent(command.noteId ?? "")}${showQuery(command)}`,
         method: "GET",
         label: "notes show",
         timeoutMs: READ_DEADLINE_MS,
@@ -135,6 +145,10 @@ export async function showNote(command, door) {
         const detail = body.audio.transcription_detail ? ` ${body.audio.transcription_detail}` : "";
         writeLine(door.io.stdout, `Transcription: ${body.audio.transcription_status}.${detail}`);
     }
+    if (body.slice) {
+        const { offset, returnedChars, totalChars, nextOffset } = body.slice;
+        writeLine(door.io.stdout, `Characters ${offset}-${offset + returnedChars} of ${totalChars}${nextOffset === null ? " (the end)" : `; continue with --offset ${nextOffset}`}.`);
+    }
     writeLine(door.io.stdout, "");
     writeLine(door.io.stdout, note.content.replace(/^In the room:/gm, "Invited:"));
     return 0;

package/dist/commands/notes-sync-loop.js

@@ -23,6 +23,11 @@ const MAX_TRANSIENT_FAILURES = 3;
 const MAX_LIVE_WAITS = 40;
 /** How long to wait for a pass another caller has live before asking again. */
 const LIVE_PASS_WAIT_MS = 5_000;
+/** The repair's own counts, with every failure's reason, in one line. */
+function repairLine(repair) {
+    const why = Object.entries(repair.reasons).map(([reason, count]) => `${reason} ${count}`).join(", ");
+    return `found ${repair.found}, fixed ${repair.fixed}, failed ${repair.failed}${why ? ` (${why})` : ""}, ${repair.deferred} left${repair.capped ? ", list capped" : ""}`;
+}
 export async function syncNotetaker(command, door) {
     const accountId = command.accountId ?? "";
     if (accountId === "") {
@@ -39,6 +44,11 @@ export async function syncNotetaker(command, door) {
     const pollMs = Number.parseInt(env["COCKPIT_NOTES_SYNC_POLL_MS"] ?? "", 10);
     const liveWaitMs = Number.isFinite(pollMs) && pollMs >= 0 ? pollMs : LIVE_PASS_WAIT_MS;
     const totals = { stored: 0, unchanged: 0, skipped: 0 };
+    // BLI-18006: `--repair-truncated` asks the same door to re-read Wispr Flow notes
+    // that were stored cut short. Fixed ones count as "unchanged" in the totals
+    // (the ledger's column), failed ones as "skipped"; the repair line says which.
+    const repairing = command.repairTruncated === true;
+    const repairTotals = { fixed: 0, failed: 0, found: 0 };
     let passes = 0;
     let stalled = 0;
     let liveWaits = 0;
@@ -48,8 +58,9 @@ export async function syncNotetaker(command, door) {
         const answer = await ask(door, {
             path: `/api/notes/accounts/${encodeURIComponent(accountId)}/sync`,
             method: "POST",
-            label: "notes sync",
+            label: repairing ? "notes sync (repair truncated)" : "notes sync",
             timeoutMs: WRITE_DEADLINE_MS,
+            ...(repairing ? { body: { repair: "truncated_transcripts" } } : {}),
         });
         if (!answer.ok) {
             // A timeout or a 5xx mid-history is the call's, not the account's: the
@@ -87,7 +98,14 @@ export async function syncNotetaker(command, door) {
         totals.unchanged += run.notesUpdated;
         totals.skipped += run.notesSkipped;
         const waiting = typeof run.remaining === "number" ? `; ${run.remaining} waiting` : "";
-        const line = `pass ${passes}: ${run.reason}: ${run.notesAdded} stored, ${run.notesUpdated} unchanged, ${run.notesSkipped} skipped${run.more ? `${waiting}, continuing` : ""}.`;
+        if (run.repair) {
+            repairTotals.fixed += run.repair.fixed;
+            repairTotals.failed += run.repair.failed;
+            repairTotals.found = Math.max(repairTotals.found, run.repair.found);
+        }
+        const line = run.repair
+            ? `pass ${passes}: ${run.reason}: repair: ${repairLine(run.repair)}${run.more ? ", continuing" : ""}.`
+            : `pass ${passes}: ${run.reason}: ${run.notesAdded} stored, ${run.notesUpdated} unchanged, ${run.notesSkipped} skipped${run.more ? `${waiting}, continuing` : ""}.`;
         // Progress is commentary in --json (stdout is the one answer), and the
         // answer in a terminal.
         writeLine(door.json ? door.io.stderr : door.io.stdout, line);
@@ -98,8 +116,10 @@ export async function syncNotetaker(command, door) {
         }
         if (!run.more) {
             if (door.json)
-                return emit(door, { ok: true, passes, totals, run });
-            writeLine(door.io.stdout, `Caught up after ${passes} pass${passes === 1 ? "" : "es"}: ${totals.stored} stored, ${totals.unchanged} unchanged, ${totals.skipped} skipped.`);
+                return emit(door, { ok: true, passes, totals, ...(repairing ? { repair: repairTotals } : {}), run });
+            writeLine(door.io.stdout, repairing
+                ? `Repair finished after ${passes} pass${passes === 1 ? "" : "es"}: ${repairTotals.fixed} fixed, ${repairTotals.failed} failed (${repairTotals.found} carried the marker when the first pass began).`
+                : `Caught up after ${passes} pass${passes === 1 ? "" : "es"}: ${totals.stored} stored, ${totals.unchanged} unchanged, ${totals.skipped} skipped.`);
             return 0;
         }
         // A pass that handled nothing and still says "more" would loop forever.

package/dist/commands/notes-transcription-stats.js

@@ -0,0 +1,69 @@
+/**
+ * `cockpit notes transcription-stats [--month YYYY-MM] [--json]` — what meeting
+ * transcription cost and did (BLI-18003). Sibling of `notes.ts`, named in its header.
+ *
+ * One read of `GET /api/notes/transcription-stats`, the same door the MCP tool
+ * `notes_transcription_stats` and JARVIS call. The terminal prints minutes and
+ * dollars per provider, the month's spend against the cap, and how old the
+ * numbers are; `--json` prints the door's body untouched.
+ */
+import { writeLine } from "./cli-io.js";
+import { ask, emit, fail, READ_DEADLINE_MS } from "./notes-door.js";
+const usd = (value) => (value === null ? "unknown" : `$${value.toFixed(value < 1 ? 4 : 2)}`);
+export function ageWords(seconds) {
+    if (seconds === null)
+        return "no request yet this month";
+    if (seconds < 90)
+        return `${seconds} s ago`;
+    if (seconds < 5400)
+        return `${Math.round(seconds / 60)} min ago`;
+    if (seconds < 172_800)
+        return `${Math.round(seconds / 3600)} h ago`;
+    return `${Math.round(seconds / 86_400)} days ago`;
+}
+const STATE_WORDS = {
+    no_cap: "no cap set", within_cap: "within the cap", alert_line: "past the 80% line", over_cap: "past the cap, still inside the $5 allowance",
+    waiting: "past cap plus the allowance: new meetings wait for budget", unknown: "spend could not be read",
+};
+export function renderTranscriptionStats(body) {
+    const lines = [];
+    const { budget } = body;
+    lines.push(`Meeting transcription, ${body.month} (UTC). As of ${body.as_of}; newest request ${ageWords(body.age_seconds)}.`);
+    lines.push(`Spend ${usd(budget.spend_usd)} of ${budget.cap_usd === null ? "no cap" : `$${budget.cap_usd.toFixed(0)}`}`
+        + `${budget.percent === null ? "" : ` (${budget.percent}%)`}: ${STATE_WORDS[budget.state] ?? budget.state}.`
+        + `${budget.alert_sent === null ? "" : budget.alert_sent ? " The 80% message was sent." : ""}`
+        + `${body.waiting_for_budget ? ` ${body.waiting_for_budget} meeting(s) waiting for budget.` : ""}`);
+    lines.push(`In force: provider ${body.settings.provider}, fallback ${body.settings.fallback_chain.join(" > ") || "none"}; order tried: ${body.settings.order.join(" > ") || "none (no key set)"}.`);
+    for (const skipped of body.settings.skipped)
+        lines.push(`Skipped ${skipped.id}: ${skipped.reason} (${skipped.key_name} is not set on this deploy).`);
+    lines.push("");
+    const header = ["provider", "model", "requests", "failed", "fallback", "minutes", "list $", "real $", "avg ms", "key"];
+    const rows = body.providers.map((p) => [
+        p.id, p.model, String(p.requests), String(p.failed_requests), String(p.fallback_requests), p.minutes.toFixed(1),
+        p.list_cost_usd.toFixed(4), p.effective_cost_usd.toFixed(4), p.avg_latency_ms === null ? "-" : String(p.avg_latency_ms), p.key_present ? "set" : `missing ${p.key_name}`,
+    ]);
+    const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+    const format = (cells) => cells.map((cell, i) => cell.padEnd(widths[i])).join("  ").trimEnd();
+    lines.push(format(header), ...rows.map(format));
+    lines.push(format(["total", "", String(body.totals.requests), "", "", body.totals.minutes.toFixed(1), body.totals.list_cost_usd.toFixed(4), body.totals.effective_cost_usd.toFixed(4), "", ""]));
+    if (body.unreadable.length > 0)
+        lines.push("", `Could not read: ${body.unreadable.join(", ")}. The rest is shown as read.`);
+    return lines;
+}
+export async function showTranscriptionStats(command, door) {
+    const query = command.month === undefined ? "" : `?month=${encodeURIComponent(command.month)}`;
+    const answer = await ask(door, {
+        path: `/api/notes/transcription-stats${query}`,
+        method: "GET",
+        label: "notes transcription-stats",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const body = answer.body;
+    if (door.json)
+        return emit(door, { ok: true, ...body });
+    for (const line of renderTranscriptionStats(body))
+        writeLine(door.io.stdout, line);
+    return 0;
+}

package/dist/commands/notes.js

@@ -36,6 +36,8 @@
  *  - `notes-granola-status.ts` — ticket 10718: the Granola CRON's own health
  *    (it runs on a shared server-side key, not a `notes_accounts` row), read
  *    off its `granola_sync_runs` ledger.
+ *  - `notes-transcription-stats.ts` — BLI-18003: what meeting transcription
+ *    cost and did per provider for a month, and the spend against the cap.
  *
  * Every public name is still importable from this file.
  */
@@ -46,11 +48,13 @@ import { runFolderCommand } from "./notes-folders.js";
 import { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, syncStatusNotetakers, } from "./notes-accounts.js";
 import { showBotUpcoming } from "./notes-bot-upcoming.js";
 import { showGranolaStatus } from "./notes-granola-status.js";
+import { showTranscriptionStats } from "./notes-transcription-stats.js";
 import { listRecordings, showRecording } from "./notes-recordings.js";
 export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 export { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
 export { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, syncStatusNotetakers, } from "./notes-accounts.js";
 export { showGranolaStatus } from "./notes-granola-status.js";
+export { showTranscriptionStats } from "./notes-transcription-stats.js";
 export { listRecordings, showRecording } from "./notes-recordings.js";
 export { ask, emit, fail, sayUpload, sayScope, errorText, TAG, } from "./notes-door.js";
 export async function runNotes(command, io) {
@@ -111,5 +115,7 @@ export async function runNotes(command, io) {
             return showBotUpcoming(command, door);
         case "granola-status":
             return showGranolaStatus(command, door);
+        case "transcription-stats":
+            return showTranscriptionStats(command, door);
     }
 }

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.218");
+    writeLine(io?.stdout ?? process.stdout, "0.2.221");
     return 0;
   }
 

package/dist/commands/setup-receipt-lines.js

@@ -28,14 +28,15 @@ const FIXES = {
  * the same gap has two different next actions (BLI-4019).
  *
  * `device` says "run `cockpit login`" for every lapse, and for an expired
- * session that is now the wrong instruction most of the time: the dashboard
- * slides a device token's expiry out on every call it authenticates and renews
- * one that lapsed inside a 30-day grace window, so the ordinary answer is to do
- * nothing and let the next tick fix it. Telling somebody to sign in again on a
- * machine that is about to heal itself is how a receipt stops being believed.
+ * session that can be the wrong instruction: a device token lives 30 days and
+ * the heartbeat swaps it for a fresh one when 7 days or fewer are left
+ * (BLI-17994), so a machine whose local copy merely lags heals on the next
+ * tick. Only a token that stays expired (the machine was offline past its date)
+ * needs `cockpit doctor`. Telling somebody to sign in again on a machine that
+ * is about to heal itself is how a receipt stops being believed.
  */
 const REASON_FIXES = {
-    session_expired: "Renews on the next sync tick while inside the 30-day grace window; past it, run `cockpit login`.",
+    session_expired: "Renews on the next sync tick; if it stays expired this machine was offline too long, so run `cockpit doctor` to pair it again.",
 };
 /** Codex hooks a person switched OFF is a decision, not a fault. */
 const UNSUPPORTED_FIX = "Switched off in your own config; nothing to do.";

package/dist/commands/sync-heal.js

@@ -93,8 +93,8 @@ async function healAgentRules(command, paths, now) {
         : { step: "agent_rules_install", status: "fail", error_code: "agent_rules_still_missing", error_detail: "before=missing; after=missing" };
 }
 /**
- * Sign-in: the heartbeat (which ran just before this) renews a lapsed token
- * inside the server's grace window without a browser. If this machine is STILL
+ * Sign-in: the heartbeat (which ran just before this) swaps a token near its
+ * end for a fresh one without a browser (BLI-17994). If this machine is STILL
  * signed out or the door refused the token (401/403), only a browser can fix
  * it, so record the one action and say it once a day instead of every fifteen
  * minutes. A lapsed local date with no refusal (offline, a checkout build)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.218",
+  "version": "0.2.221",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.66",
-    "@bli-cockpit/mcp": "0.1.126",
+    "@bli-cockpit/mcp": "0.1.128",
     "@bli-cockpit/telemetry-core": "0.1.75"
   },
   "repository": {