@bli-cockpit/cli 0.2.222 → 0.2.236

package/dist/commands/local-args.js

@@ -16,10 +16,11 @@
  * verbatim, no logic change.
  */
 import { parseGlossaryArgs } from "./glossary.js";
+import { parseSpendArgs } from "./spend.js";
 import { parseRootsArgs } from "./roots.js";
 import { SURFACE_ALIASES } from "./local-help.js";
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
-import { parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseSetupArgs, parseSpeedArgs, parseLogsArgs, parseBrainArgs, parseApprovalsArgs, parseManagerArgs, parseImageArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
+import { parseCiArgs, parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseSetupArgs, parseSpeedArgs, parseLogsArgs, parseBrainArgs, parseHitsArgs, parseIntentionsArgs, parseWhoArgs, parsePeopleArgs, parseApprovalsArgs, parseDrillsArgs, parseManagerArgs, parseImageArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
 // `normalizeUrl` has always been part of this module's surface — `local.ts` and
 // `local-auth.ts` import it from here — so it stays exported from this address
 // even though it now lives next door. The same goes for the four names the
@@ -76,6 +77,7 @@ export function parseLocalArgs(argv) {
             return parseModelsArgs(argv.slice(1));
         case "scout":
             return parseScoutArgs(argv.slice(1));
+        case "ci": return parseCiArgs(argv.slice(1));
         case "ops":
             return parseOpsArgs(argv.slice(1));
         case "slack":
@@ -112,6 +114,8 @@ export function parseLocalArgs(argv) {
             return parseSourcesArgs(argv.slice(1));
         case "glossary":
             return parseGlossaryArgs(argv.slice(1));
+        case "spend":
+            return parseSpendArgs(argv.slice(1));
         case "docs":
             return parseDocsArgs(argv.slice(1));
         case "msg":
@@ -144,8 +148,18 @@ export function parseLocalArgs(argv) {
             return parseLogsArgs(argv.slice(1));
         case "brain":
             return parseBrainArgs(argv.slice(1));
+        case "hits":
+            return parseHitsArgs(argv.slice(1));
+        case "intentions":
+            return parseIntentionsArgs(argv.slice(1));
+        case "who":
+            return parseWhoArgs(argv.slice(1));
+        case "people":
+            return parsePeopleArgs(argv.slice(1));
         case "approvals":
             return parseApprovalsArgs(argv.slice(1));
+        case "drills":
+            return parseDrillsArgs(argv.slice(1));
         case "manager":
             return parseManagerArgs(argv.slice(1));
         case "image":

package/dist/commands/local-auth.js

@@ -10,7 +10,7 @@
 import { execFile } from "node:child_process";
 import { errorMessage, isInteractiveStdin, readLine, writeLine, settleYesNo, } from "./cli-io.js";
 import { normalizeUrl } from "./local-args.js";
-import { getCollectorRuntimePaths, pairLocalCollector, readLocalCollectorSessionFile, readLocalSessionReference, } from "../local-state.js";
+import { getCollectorRuntimePaths, pairLocalCollector, readLocalCollectorSessionFile, sameDashboardUrl, readLocalSessionReference, } from "../local-state.js";
 const OTP_CODE_PROMPT = [
     "Email code needed:",
     "  Check your latest Tower email for a 6- to 10-digit code.",
@@ -254,8 +254,11 @@ export function canReuseOnboardSession(session, claimedOwnerEmail, dashboardUrl)
         return false;
     }
     const expectedDashboardUrl = normalizeUrlForComparison(dashboardUrl);
+    // The two production addresses are one deployment: a session paired on the
+    // old vercel.app address stays reusable against the new default.
+    const sessionDashboardUrl = normalizeUrlForComparison(session.dashboard_url);
     if (expectedDashboardUrl &&
-        normalizeUrlForComparison(session.dashboard_url) !== expectedDashboardUrl) {
+        !(sessionDashboardUrl && sameDashboardUrl(sessionDashboardUrl, expectedDashboardUrl))) {
         return false;
     }
     return true;

package/dist/commands/local-command-shapes-auth.js

@@ -0,0 +1 @@
+export {};

package/dist/commands/local-command-shapes-drills.js

@@ -0,0 +1,7 @@
+/**
+ * `cockpit drills` command shape (BLI-19259), beside `local-command-shapes-approvals.ts` for the same reason:
+ * `local-command-shapes.ts` sits at the readability ceiling.
+ *
+ * `theme set` is typed as two words and parsed to ONE action word (`theme-set`), the way `rules create` becomes `rules-create`.
+ */
+export {};

package/dist/commands/local-command-shapes-hits.js

@@ -0,0 +1,5 @@
+/**
+ * `cockpit hits` command shape (BLI-19257), beside `local-command-shapes-brain.ts` for the same reason:
+ * `local-command-shapes.ts` sits at the readability ceiling.
+ */
+export {};

package/dist/commands/local-help-commands-tower-ops.js

@@ -42,7 +42,29 @@ export const TOWER_OPS_COMMAND_HELP = [
             "--json writes one object to stdout: { ok, kind, source, window, lines, templates[], routine, notes, text, measure };",
             "a refusal is { ok: false, error, detail } and exits 1. Run list and teaching: docs/runbooks/tower-logs.md.",
             "cockpit logs keys mint|rotate <source> [--json]: super admin only; prints the source ingest key once. Rotation invalidates the old key.",
-            "The bli-tower MCP server has the twins: logs_digest and logs_key_mint.",
+            "cockpit logs search <project> [--since 30m|6h (default 1h) | --from <iso> [--to <iso>]] [--source gcp|supabase|vercel|railway|deploys|db-host|<label>] [--stream api|postgres|auth]",
+            "    [--status 500|5xx|500-503] [--method GET] [--route <text>] [--severity error] [--q <text>] [--limit <n>] [--context] [--json]: owner or admin only.",
+            "    Reads the project's RAW logs live (window at most 24h), scrubs every line, caps the answer (default 100, at most 200) and says \"capped at N of M\".",
+            "    Nothing is stored. --context adds the application lines that share each request's trace (Google Cloud). A member gets admin_or_brain_only.",
+            "The bli-tower MCP server has the twins: logs_digest, logs_key_mint and logs_search.",
+        ],
+    ],
+    [
+        "intentions",
+        [
+            "Usage: cockpit intentions [list] [--status open|overdue|done|dropped|all] [--project <name>] [--limit <n>] [--dashboard-url <url>] [--json]",
+            "       cockpit intentions show <id> [--json]",
+            "       cockpit intentions done <id> --evidence \"<what settled it>\" [--by person|agent] [--json]",
+            "       cockpit intentions drop <id> --evidence \"<why>\" [--by person|agent] [--json]",
+            "       cockpit intentions reopen <id> [--json]",
+            "Prospective memory: what a person or an agent said they would do later, tied to a trigger (a date, a merged PR, a switch, a ticket,",
+            "a meeting). Tower reads sessions, meeting notes and messages for such promises, closes the ones a machine can verify (a PR merged,",
+            "a switch holding the value, a ticket Done) and tells the brain and the daily DM about the overdue ones. A promise to switch something",
+            "on is done only when the switch is on. <id> is the uuid or the 8-character prefix list prints. Closing needs evidence (3 to 300 characters).",
+            "A private one (from a private session or a direct message) is visible to its owner only.",
+            "--json writes one object to stdout: { ok, text, intentions[], counts, coverage } (list) or { ok, text, intention } (show, done, drop, reopen);",
+            "a refusal is { ok: false, error, detail } and exits 1 (invalid_status, intention_not_found_or_unreadable, already_closed, not_paired, ...).",
+            "Teaching: docs/architecture/intentions.md. The bli-tower MCP server has the twins: intentions_list, intentions_show, intentions_settle.",
         ],
     ],
     [
@@ -54,6 +76,15 @@ export const TOWER_OPS_COMMAND_HELP = [
             "Ids are incident UUIDs or BLI issue identifiers. Retry reopens needs_human or not_actionable rows, resets attempts and claims,",
             "and records who, why and when. --all-needs-human selects only needs_human; --project narrows every selection. Other states are skipped.",
             "Only members and super admins can retry. One comment is posted per incident issue. MCP twin: brain_retry.",
+            "",
+            "Ladder (BLI-19250, the Tower owner only): cockpit brain ladder show|promote <class> [--anyway] [--note <text>]|demote <class>|predict \"<question>\"|answer \"<reply>\" [--json]",
+            "Before the brain or an agent asks you for a call it writes down what it predicts you will answer; your answer scores it. `show` lists",
+            "every decision class with hits of scored calls, trend and whether it is eligible (95% over at least 20 scored). `promote <class>` switches one",
+            "class on so the brain may decide those itself; only you run it, nothing promotes automatically, and money, people, destructive and",
+            "rls_widening can never be promoted. `--anyway` switches on a class that is not yet eligible. `demote` switches it off again.",
+            "`predict` and `answer` are what an agent calls around an ask (--source-kind/--source-ref name the ask; --prediction names the row).",
+            "MCP twins: brain_ladder_show, brain_ladder_promote, brain_ladder_demote, brain_ladder_predict, brain_ladder_answer. Teaching: docs/architecture/edward-predictor.md.",
+            "",
             "Tower's incident queue. Every 15 minutes the log-digest cron turns each recurring problem in a project's logs (classes",
             "our_bug, config_drift, capacity, unknown) into ONE incident with ONE Tower issue; a repeat adds to its count, never a twin.",
             "A template quiet for 24 hours is marked cleared. This prints, per project, how many incidents are open, being worked,",
@@ -66,6 +97,75 @@ export const TOWER_OPS_COMMAND_HELP = [
             "Teaching: docs/architecture/tower-brain.md. The bli-tower MCP server has the twin: brain_status.",
         ],
     ],
+    [
+        "who",
+        [
+            "Usage: cockpit who [<topic>] [--layer frontend|backend|data|infrastructure|docs|tooling] [--limit <1-10>] [--dashboard-url <url>] [--json]",
+            "",
+            "Who knows what. A team remembers who to ask: this prints, for a project, one layer of it, or a category, the people and the",
+            "standing per-repo agent who hold the most recent and most frequent work there, ranked, with the counts of sessions, memories,",
+            "tickets, pull requests and commits behind each, and who to ask first. With no topic it prints the top three of every project.",
+            "<topic>          a project (Tower, Pearl Portal, Kolm, PortPal, ...) or a category label, exact. Several words need no quotes.",
+            "                 Anything else answers unknown_topic with the project names and the nearest category names.",
+            "--layer <layer>  one layer of the project. Layer and category rankings count only the shared memories Jev filed with that",
+            "                 label; project rankings also count sessions (by transcript start), tickets, pull requests and commits.",
+            "--limit <n>      holders shown per area, 1 to 10 (default 5).",
+            "Identity is the repo's one resolver: an exact match, never a guess. A handle that matches nobody is counted, not ranked.",
+            "--json writes one object to stdout: { ok, topic, resolved_as, layer, as_of, run, scope, areas[{ project, category, layer, holders[], route }], text };",
+            "a refusal is { ok: false, error, detail } and exits 1 (unknown_topic, no_directory_yet, invalid_layer, not_paired, ...).",
+            "Teaching: docs/architecture/who-knows-what.md. The bli-tower MCP server has the twin: who_knows.",
+        ],
+    ],
+    [
+        "hits",
+        [
+            "Usage: cockpit hits [--mine | --person <email|github-login|name> | --agent | --project <id>] [--days <n>] [--patterns] [--learning] [--top <n>] [--dashboard-url <url>] [--json]",
+            "       cockpit hits timeline [--weeks <n>] [--dashboard-url <url>] [--json]",
+            "       cockpit hits coach [--dashboard-url <url>] [--json]",
+            "       cockpit hits approve --scope <team|agents|project:<id>> [--version <n>] [--dashboard-url <url>] [--json]",
+            "",
+            "The hit ledger. A HIT is one machine-evidenced punch a person or an agent took: a red CI run, a revert, a closed-unmerged PR,",
+            "a rolled-back deploy, an incident, a correction. Hits of the same masked failure class (a signature) repeat, and a repeat weighs more.",
+            "This prints the heaviest classes, the 5 to 10 root patterns they roll up into (with the share of the weight the top 5 and top 10",
+            "cover), and the fighters with the most weight. Over the last --days (default 30). Never a prompt or a transcript line.",
+            "Who sees what: an owner or admin reads everyone and defaults to the team; a member reads only their own hits and defaults to --mine.",
+            "--person, --agent, --project and the team view are owner or admin only; a member who asks gets owner_or_admin_only.",
+            "--mine             your own hits (works for everyone).",
+            "--person <label>   one person, by email, exact GitHub login or exact name (no fuzzy match: unknown_person, ambiguous_person).",
+            "--agent            the agents' hits.      --project <id>   one registry project's hits.",
+            "--patterns         lead with the patterns, ranked by weight, each with its variations.",
+            "--learning         per-class repeats, days between hits and recovery trend, for --mine or --person.",
+            "--top <n>          how many classes and patterns to list (default 10, at most 50).   --days <n>   window (at most 365).",
+            "",
+            "Timeline: cockpit hits timeline is your weekly review: for each of the last --weeks (default 8, at most 26) YOUR hits, repeat rate,",
+            "recovery time, wins, and the levels your prompts were judged at, with the week's low (worst distress) and high (best win). It shows only",
+            "the signed-in person's OWN hits, wins and distress levels and nobody else's, for everyone, owners and admins included.",
+            "Coach: cockpit hits coach prints the open coach alerts (a spike, a weekly pile-up, a plateau where someone is stuck or is not sparring),",
+            "newest first, one plain sentence each. Owner or admin only. It is for the coaches and is never shown to the person it is about.",
+            "Approve: cockpit hits approve --scope team approves the proposed pattern list of that scope (the newest version, or --version <n>).",
+            "Owner or admin only; a retired or empty list is refused by name.",
+            "--json writes one object to stdout: the door's whole answer with raw labels and a text field; a refusal is { ok: false, error, detail } and exits 1.",
+            "The bli-tower MCP server has the twins: hits_read, hits_timeline, hits_coach and hits_approve_patterns.",
+        ],
+    ],
+    [
+        "people",
+        [
+            "Usage: cockpit people show [<person>] [--dashboard-url <url>] [--json]",
+            "",
+            "People models, OWNER ONLY. One profile per principal and teammate, rebuilt weekly from material the whole org can already",
+            "read (public Slack channels, Tower channels that are neither direct nor private, tickets, pull requests, shared memories,",
+            "team-visible meeting claims; never direct messages, mail, private channels, or anyone's private memories or sessions):",
+            "the projects they are active in, open commitments, what they care about, how fast and where they answer, which kinds of asks",
+            "they say yes to, and their pronouns only when they stated them (otherwise they/them). Every line carries its as-of date and the",
+            "number of items behind it; an empty field says why it is empty.",
+            "<person>   an exact name, email or person id. Several words need no quotes. No person lists everyone with a profile.",
+            "Only the company owner (and the owner's own owner-scoped brain token) is answered; anyone else gets owner_only (403).",
+            "--json writes one object to stdout: { ok, person_id, name, built_at, profile, text } (or { ok, people[], text } for the list);",
+            "a refusal is { ok: false, error, detail } and exits 1 (owner_only, unknown_person, ambiguous_person, no_profile_yet, not_paired, ...).",
+            "Teaching: docs/architecture/people-models.md. The bli-tower MCP server has the twin: people_show.",
+        ],
+    ],
     [
         "approvals",
         [
@@ -89,6 +189,24 @@ export const TOWER_OPS_COMMAND_HELP = [
             "approvals_edit, approvals_reject, approvals_rules, approvals_rules_create, approvals_rules_revoke.",
         ],
     ],
+    [
+        "drills",
+        [
+            "Usage: cockpit drills [list] [--dashboard-url <url>] [--json]",
+            "",
+            "  cockpit drills start                          open the next drill: the change or command, what it printed, and the question. The cause is NOT shown",
+            "  cockpit drills answer --confidence <1-5>      your answer on stdin (or --text), and how sure you are; then the real cause and the guard are shown",
+            "  cockpit drills theme                          your theme and the choices",
+            "  cockpit drills theme set <theme> [--play <t>] [--watch <t>] [--train <t>]    video-game (the default), boxing, muay-thai, crime-drama, anime, sports, or your own words",
+            "  cockpit drills review                         your own week: hits, wins, highs, lows, where you have stopped improving, what to practise",
+            "A drill replays a real mistake the team already paid for. You answer first, so a wrong answer you were sure about is the one you remember; it comes back 1, 3 and 7 days later.",
+            "Each of your top patterns is a boss: pass its drills, then a stretch of your own PRs without taking that hit again. There is no leaderboard; these are your own rows only.",
+            "Anything that needs your hit history says so when it is not connected yet, instead of showing a zero.",
+            "--home <dir> and --dashboard-url <url> are for tests and staging.",
+            "--json writes one object to stdout (the door's body) and nothing else; a refusal is { ok: false, error, detail } and exits 1.",
+            "Teaching: docs/architecture/drills.md. The bli-tower MCP server has the twins: drills_list, drills_start, drills_answer, drills_theme, drills_theme_set, drills_review.",
+        ],
+    ],
     [
         "manager",
         [
@@ -246,6 +364,10 @@ export const TOWER_OPS_COMMAND_HELP = [
             "Run `cockpit login` first if this machine is not paired.",
         ],
     ],
+    [
+        "ci",
+        ["Usage: cockpit ci report [--repo <owner/name>] [--json]", "Reads the daily stored CI report, as-of age and coverage. MCP twin: ci_report."],
+    ],
     [
         "ops",
         [

package/dist/commands/local-help-commands-tower.js

@@ -47,7 +47,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "docs",
         [
-            "Usage: cockpit docs [list|tree|read <id|slug> [<id|slug>...]|read --parent <id> --bodies|create|update <id>|delete <id|slug> [<id|slug>...]|link <id|slug> <notion-page>|sync-status [<id|slug>]] [flags]",
+            "Usage: cockpit docs [list|tree|read <id|slug> [<id|slug>...]|read --parent <id> --bodies|create|update <id>|delete <id|slug> [<id|slug>...]|link <id|slug> <notion-page>|sync-status [<id|slug>]|export <id|slug> [--format md|pdf|docx|txt] [--out <path>]] [flags]",
             "",
             "The Tower document library, typed. Bare `cockpit docs` lists every document you may read.",
             "list [--parent <id>|root] [--query <text> [--word]] [--limit <n>] — every document you may see: id, visibility, body size, slug, title. Metadata only — a list never carries a body, so it stays cheap enough for an agent to call (--json was 604 KB for 155 documents before BLI-3737, and is now a few tens of KB). --json shape: { documents: [{ id, slug, title, visibility, parent_id, source, updated_at, body_chars }] }.",
@@ -67,6 +67,7 @@ export const TOWER_COMMAND_HELP = [
             "delete <id|slug> [<id|slug>...] — soft-deletes one or more documents (BLI-10555): the browser's own delete, sets deleted_at, never a real SQL DELETE. Recoverable — only a super_admin clearing deleted_at brings it back, there is no self-service undo. Deleting a parent does NOT delete its children; they keep their own parent_id and stay exactly where they were. Several refs resolve against ONE shared list call, then one DELETE each — one bad ref never loses the rest. --json shape: one ref answers { ok, document_id }; several answer { documents: [{ ref, ok, document_id } | { ref, ok: false, error, detail }] }.",
             "link <id|slug> <notion-url|page-id> — ties the document to a Notion page so the two-way sync moves it both ways. The page is the truth from then on: the next sync pulls it over this copy and keeps the copy as a version. `link <id|slug> --clear` unties it. Refusals: invalid_notion_page, notion_page_already_linked, document_not_writable.",
             "sync-status [<id|slug>] — every linked document's Notion sync state, or one's: synced (the body is what both sides last agreed on), tower_changed (edited here since; the next write-back pushes it), never_synced (linked, no baseline yet). Tower's half only: a Notion edit shows up at the next pull, not here. Metadata only, never a body.",
+            "export <id|slug> [--format md|pdf|docx|txt] [--out <path>] — writes the document as a file (ticket 20694): md is the stored Markdown exactly, txt is readable plain text, docx is a Word file with real headings, lists, tables and links, pdf is a paginated page with the title and last-updated date in the header. Default format md; default path is the document's slug plus the extension in the current directory (--out names a file, or a directory to put it in), and an existing file is replaced. Prints the path; --json shape: { ok, path, bytes, format }. To copy a page's text, `cockpit docs read` already does it.",
             "A document body is never accepted on the command line — --file (safest on Windows) or a pipe only, same discipline as `cockpit notes paste`.",
             "--json writes one machine-readable object to stdout; every reason and receipt line stays on stderr.",
             "A refusal keeps Tower's own reason label — needs_rls_client, document_not_found_or_unreadable, document_not_writable, slug_taken, circular_parent, and so on.",
@@ -207,15 +208,15 @@ export const TOWER_COMMAND_HELP = [
     [
         "usage",
         [
-            "Usage: cockpit usage people [--by-repo | --by-topic | --by-subject | --by-task] [--min-confidence high|medium|low] [--person <email|me>] [--all] [--since <n>d|<n>h|<iso>] [--detail] [--until <iso>] [--include-automated] [--json]",
+            "Usage: cockpit usage people [--by-repo | --by-topic | --by-subject | --by-task | --by-client] [--min-confidence high|medium|low] [--person <email|me>] [--all] [--since <n>d|<n>h|<iso>] [--detail] [--until <iso>] [--include-automated] [--json]",
             "  cockpit usage sessions [--person <exact-name>] [--task <BLI-NNNN> | --subject <name>] [--repo <label>] [--tool claude|codex] [--since <window>] [--until <iso>] [--cursor <cursor>] [--limit <n>] [--json]",
             "  cockpit usage session <id> [--from-window <n>] [--json]",
             "  --by-topic groups work types; --by-subject groups open subjects from session summaries.",
             "",
-            "--by-topic adds topic rows, including (unlabelled). Choose only one grouping. --by-repo adds project rows under each person (top 10; --all shows every repo). --person me uses your signed-in email.",
+            "--by-client (ticket 19258) shows which app each person worked in (Claude Code CLI, desktop or IDE; Codex CLI, desktop, IDE or exec): the share of sessions and of session time, and the median hours from session start to the pull request opened and merged and the active minutes per merged PR, each with its N, compared only within one person and only with 5 or more sessions on each side. --by-topic adds topic rows, including (unlabelled). Choose only one grouping. --by-repo adds project rows under each person (top 10; --all shows every repo). --person me uses your signed-in email.",
             "Claude Code and Codex usage per person: sessions observed and extracted, tokens (total, output,",
             "and the input / cache split when the row carries it), and an API list-price equivalent that is",
-            "labelled as such and is never actual spend. A super_admin sees everyone; a member sees their own row.",
+            "labelled as such and is never actual spend. Every signed-in role sees everyone's numbers (a team decision, BLI-13026); `usage sessions` still lists a member only their own sessions.",
             "--since takes <n>d (1 to 365), <n>h (1 to 8760), or an ISO timestamp; --until an ISO timestamp (default now).",
             "--detail adds Output, Input, Cache read and Cache creation. Counts use K/M/B; dollars are rounded.",
             "PRs opened, PRs merged and Commits come from the pull requests Tower mirrors from GitHub, matched to people by GitHub login. n/a means Tower cannot match that person to a login: unknown, not zero. The footer says how many repositories the mirror holds, the range of its pull requests and what matched nobody; --json lists the repositories.",
@@ -364,7 +365,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "notes",
         [
-            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>] [flags]",
+            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>] [flags]",
             "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 1 GB. Over 4 MB (a whole meeting) the file goes straight to storage and is transcribed in the background; --wait then polls for up to 4 hours and prints progress, otherwise for at most 330 seconds.",
             "",
             "folders [--tree] [--json]: list folders and visible note counts.",
@@ -381,6 +382,7 @@ export const TOWER_COMMAND_HELP = [
             "paste [--file <path>] [--name <n>] [--exclude \"<sentence>\"] — put text in. --file <path> is safest (any editor encoding is decoded). Stdin works too: `pbpaste | cockpit notes paste` on macOS; on Windows use PowerShell 7 (`Get-Clipboard | cockpit notes paste`) — PowerShell 5.1 turns non-ASCII into `?` on pipes.",
             "--exclude carries your own sentence about what to leave out, exactly as the browser's box does.",
             "share <id> [--yes] — let everyone signed in read the statements that are safe to share. Asks first in a terminal; --yes is required without one, and --json implies --yes.",
+            "summarize <id> — write a new summary (decisions, action items, key points) where every claim cites the speaker, timestamp and segment id (s12) it came from; claims the transcript does not support are dropped. Takes up to a minute; earlier summaries are kept. `show <id>` prints the newest one.",
             "unshare <id> — take it back. Never asks: it only ever narrows who can read.",
             "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
             "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
@@ -409,13 +411,18 @@ export const TOWER_COMMAND_HELP = [
     [
         "memory",
         [
-            "Usage: cockpit memory [map|knowledge|rules|search|save|update|forget|private|public|profile|consolidation|chain|requeue|install|status|log] [flags]",
+            "Usage: cockpit memory [map|knowledge|rules|search|save|update|forget|private|public|profile|consolidation|chain|source|exam|requeue|install|status|log] [flags]",
             "",
             "  map [--json] — projects, topics, memory counts and importance from the shared map.",
             "  knowledge [--person <name>] [--project <name>] [--by-project] [--limit <n>] [--json] — ranked project ideas.",
             "  rules [--person <name>] [--project <name>] [--limit <n>] [--json] — standing rules grouped by person.",
             "The STORE, over the same /api/memory/* doors the bli-memory MCP server calls:",
-            "  search \"<question>\" [--container <tag>] [--limit 1..20] [--no-recent]",
+            "  search \"<question>\" [--container <tag>] [--limit 1..20] [--no-recent] [--include-originals|--no-originals] [--include-source|--no-source]",
+            "      a memory the nightly dream merged keeps its originals, shown under it. A question with a number, version,",
+            "      date or id (or 'exactly') also searches them, and so does a question about how things were ('used to', 'previously'):",
+            "      the facts a newer one replaced come back with when they were true. --include-originals does that for any question, --no-originals for none.",
+            "      --include-source adds, under the top hits, the verbatim stretch of the raw session or meeting each came from;",
+            "      a question that asks for an exact detail does that for the top two with no flag; --no-source never.",
             "      repeat --container to search more than one space; omit it for this repository's own.",
             "      --limit caps the memories (default 5); up to 3 Tower pages and tickets ride beside",
             "      them whatever it says. For more Tower rows, use `cockpit search`.",
@@ -438,6 +445,11 @@ export const TOWER_COMMAND_HELP = [
             "      Read-only: the pass is a nightly cron, it never deletes a memory, and",
             "      report mode changes nothing on the shelf at all.",
             "  chain <id>   the originals behind a consolidated memory (\"from 4 memories by Edward, Vee\").",
+            "  exam [--night <YYYY-MM-DD>] [--misses]   the nightly memory exam (BLI-19249): purity (right answers over graded),",
+            "      graded of planned, the trend against the last seven nights and the worst project. --misses lists the missed",
+            "      questions with the reason label. Yours alone: the exam quotes your own sessions, so no one else reads it.",
+            "  source <id> [--query \"<words>\"] [--chars 200..6000]   the raw session or meeting behind a memory: the verbatim",
+            "      stretch around the fact (3,000 characters by default), as stored. Only what your own session may read.",
             "      Private originals show only to their owner or a super admin; the rest are counted.",
             "  requeue --since <iso> [--until <iso>] [--source hook|harvest] [--reason <label>] [--apply]",
             "      puts finished extractions back in the queue after the store refused their",

package/dist/commands/local-help-commands.js

@@ -23,6 +23,7 @@ import { TOWER_OPS_COMMAND_HELP } from "./local-help-commands-tower-ops.js";
 export function localSubcommandHelp(command) {
     const helpByCommand = new Map([
         ["glossary", ["Usage: cockpit glossary list|add <wrong> --to <name>|remove <wrong> [--json]", "Quote phrases. Removing a form prevents future corrections of it."]],
+        ["spend", ["Usage: cockpit spend memory [--days 1|7|30] [--dashboard-url <url>] [--json]", "Spend by memory operation (write, recall, dream, update_forget, backfill, label, exam, predictor, people, who, intentions, salience, chat, other), ranked top first with list and real dollars, share, trend against the previous window, and how much of the real OpenAI bill the ledger explains. What it does not explain is shown as untagged. A super_admin reads it."]],
         ["roots", ["Usage: cockpit roots add <dir> [--allow-home-root] [--json]", "Approves a work directory, saves an approval receipt, and adds it to collection. Run cockpit doctor afterward."]],
         // BLI-3709: the Tower nouns live next door, split along the same seam the
         // argument parsers already use — see `local-help-commands-tower.ts`.
@@ -191,6 +192,8 @@ export function localSubcommandHelp(command) {
                 "      Open to every role; it says so when the view is read-only for you.",
                 "  cockpit team github-login add|remove <person> <login> [--json] — exact roster UUID, name or email; super admin or a member managing their own extra logins. History stays.",
                 "  cockpit team github-login list <person> [--json] — primary and extra GitHub logins.",
+                "  cockpit team timezone set <person> <iana-zone> [--json] — super admin only. Sets the zone a person lives their day in, e.g. Asia/Ho_Chi_Minh or America/Vancouver; the person is an exact roster name, email or roster UUID. The word `unknown` clears it. EST, +07:00 and other non-IANA names are refused.",
+                "  cockpit team timezone list [--json] — super admin only. Everyone on the roster with their zone; `unknown` means nobody set one (readers then use UTC and say so).",
                 "  cockpit team invite <email> --role <role> [--team-id <uuid>]",
                 "      Admin only. Defaults to your own team; Tower emails them a sign-in link.",
                 "  cockpit team role <userId> --role <role> [--yes]",

package/dist/commands/local-help.js

@@ -52,6 +52,7 @@ export const rootCommandNames = new Set([
     "model",
     "models",
     "scout",
+    "ci",
     "ops",
     "slack",
     "settings",
@@ -70,6 +71,7 @@ export const rootCommandNames = new Set([
     "clean",
     "sources",
     "glossary",
+    "spend",
     "docs",
     "msg",
     "issue",
@@ -86,7 +88,12 @@ export const rootCommandNames = new Set([
     "speed",
     "logs",
     "brain",
+    "hits",
+    "intentions",
+    "who",
+    "people",
     "approvals",
+    "drills",
     "manager",
     "image",
     ...SURFACE_ALIASES.keys(),
@@ -113,16 +120,18 @@ export function localCommandHelp(command) {
         "  cockpit model [show|set <provider:model>] [--json]",
         "  cockpit models [list|show <provider:model>|compare <provider:model> <provider:model> [...]] [--highlight] [--dashboard-url <url>] [--json]",
         "  cockpit scout [board|start|dismiss|undo <experiment-id>] [--days <n>] [--dashboard-url <url>] [--json]",
+        "  cockpit ci report [--repo <owner/name>] [--json]",
         "  cockpit ops [status [--job <id>] [--skips] [--memory] [--models] | recompile --person <email|name|id> [--dry-run]] [--dashboard-url <url>] [--json]",
         "  cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [--person <p>] [--channel <c>] [--query <text> [--word]] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--format compact|full]] [--json]",
         "  cockpit settings [personal [--chat-model <key>] [--brief-model <key>] | switches [set <key> <value>] | models [set --chat <key>] [--memory <id>] | cli-floor [<version>] | env list|set --project <p> --file <f> --content-stdin|delete --id <uuid> [--yes]] [--json]",
         "  cockpit team github-login add|remove <person> <login> | list <person> [--json]",
+        "  cockpit team timezone set <person> <iana-zone|unknown> | list [--json]",
         "  cockpit team [members | invite <email> --role <role> [--team-id <uuid>] | role <userId> --role <role> [--yes] | device [list] | device revoke <id|name> --reason <label> [--note \"<text>\"] [--yes]] [--json]",
         "  cockpit workbook [<project> [<doc>]] [--section <id>] [--markdown] [--width <n>] [--dashboard-url <url>] [--json]",
         "  cockpit brief [edit|rewrite|history] [--for <person>] [--date <YYYY-MM-DD>] [--delta [--against <YYYY-MM-DD>]] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--days <n>] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
         "  cockpit brief status [--who <person>] [--render] [--dashboard-url <url>] [--json]",
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
-        "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
+        "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
         "  cockpit notes [accounts [--show-webhook <account-id>]|connect --provider fellow --workspace <sub> --key-stdin [--name <n>]|connect --provider wisprflow|recordings <note-id>|recording <id>|webhook <account-id> --secret-stdin|detach <account-id>|sync <account-id>] [--json]   (the key and the signing secret are read from stdin, never a flag)",
         "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--lock-wait <seconds>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
@@ -130,7 +139,7 @@ export function localCommandHelp(command) {
         "  cockpit serve [--port <port>] [--workspace <path>]",
         "  cockpit autostart [install|uninstall|status] [--workspace <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
         "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",
-        "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|install|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
+        "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|install|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--include-originals|--no-originals] [--include-source|--no-source] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
         "  cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
         "  cockpit sources check [--older-than <days>] [--dashboard-url <url>] [--json]",
         "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>|delete <id|slug>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",
@@ -145,10 +154,20 @@ export function localCommandHelp(command) {
         "  cockpit release [--dry-run] [--skip-checks] [--no-floor] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
         "  cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <passed_on|archived|reopen>|followup <id> [--record-sent-at <iso>]|interview <id> <--at <iso>|--clear>|grade <id> [--now]|resume <id> [--out <path>]|takehome show <role>|takehome set <role> --body-file <path>|settings show|settings set --enabled <true|false> --followup-enabled <true|false> --followup-after-days <n> --takehome-window-hours <n>] [--role <slug>] [--min-score <n>] [--since <date>] [--stage <s>] [--force] [--json]",
         "  cockpit glossary list|add <wrong> --to <name>|remove <wrong> [--dashboard-url <url>] [--json]",
+        "  cockpit spend memory [--days 1|7|30] [--dashboard-url <url>] [--json]",
         "  cockpit rename [list|resolve <id> --scope <page|everywhere|undo>] [--dashboard-url <url>] [--json]",
         "  cockpit logs <collector|dashboard|railway|railway:<service>|-> [--since 15m|1h|2d|<iso>] [--raw <template-id> [--limit <n>]] [--all-levels] [--table <file>] [--json]",
+        "  cockpit intentions [list [--status open|overdue|done|dropped|all] [--project <name>] [--limit <n>]|show <id>|done <id> --evidence <text>|drop <id> --evidence <text>|reopen <id>] [--dashboard-url <url>] [--json]",
+        "  cockpit who [<topic>] [--layer frontend|backend|data|infrastructure|docs|tooling] [--limit <1-10>] [--dashboard-url <url>] [--json]",
+        "  cockpit people show [<person>] [--dashboard-url <url>] [--json]",
         "  cockpit brain status [--project <id>] [--show open|running|needs_human|fixed|not_actionable|cleared] [--dashboard-url <url>] [--json]",
+        "  cockpit brain ladder <show|promote <class> [--anyway]|demote <class>|predict \"<question>\"|answer \"<reply>\" --prediction <id>> [--json]",
+        "  cockpit hits [--mine | --person <email|github-login|name> | --agent | --project <id>] [--days <n>] [--patterns] [--learning] [--top <n>] [--dashboard-url <url>] [--json]",
+        "  cockpit hits timeline [--weeks <n>] [--dashboard-url <url>] [--json]",
+        "  cockpit hits coach [--dashboard-url <url>] [--json]",
+        "  cockpit hits approve --scope <team|agents|project:<id>> [--version <n>] [--dashboard-url <url>] [--json]",
         "  cockpit approvals [list|show <id>|create|approve <id> [--edit]|edit <id> [--approve]|reject <id>|rules [--active true|false]|rules create <card-id> [--any-audience] [--label <text>]|rules revoke <rule-id> [--reason <text>]] [--status <s>] [--limit <n>] [--before <cursor>] [--dashboard-url <url>] [--json]",
+        "  cockpit drills [list|start|answer --confidence <1-5> [--text <words>] [--attempt <id>]|theme|theme set <theme> [--play <t>] [--watch <t>] [--train <t>]|review] [--dashboard-url <url>] [--json]",
         "  cockpit manager <clients|client <client>|run <run-id>|list <client>|queue <client>|show <id>|add <client> --title <t>|edit <id> --version <v>|done|reopen|link|approve|dismiss|proposal|archive|unarchive> [--timeline] [--dashboard-url <url>] [--json]",
         "  cockpit image <describe <file> [--session <id>]|show <sha256-or-prefix>> [--dashboard-url <url>] [--json]",
         "  cockpit setup [--since <7d|30d|date>] [--details] [--person <name|email>] [--compare <name,name>] [--json]",
@@ -162,7 +181,7 @@ export function localCommandHelp(command) {
         "  cockpit messages [same verbs and flags as cockpit msg]",
         "  cockpit meeting-notes [same verbs and flags as cockpit notes]",
         "  cockpit speed [--page <name>]... [--runs <n>] [--dashboard-url <url>] [--json]",
-        "  cockpit usage people [--by-repo | --by-topic | --by-subject | --by-task] [--min-confidence high|medium|low] [--person <email|me>] [--all] [--detail] [--since <n>d|<n>h|<iso>] [--until <iso>] [--include-automated] [--dashboard-url <url>] [--json]",
+        "  cockpit usage people [--by-repo | --by-topic | --by-subject | --by-task | --by-client] [--min-confidence high|medium|low] [--person <email|me>] [--all] [--detail] [--since <n>d|<n>h|<iso>] [--until <iso>] [--include-automated] [--dashboard-url <url>] [--json]",
         "",
         `Default dashboard: ${DEFAULT_DASHBOARD_URL}. Omit --dashboard-url for normal production use; pass it only for staging/custom dashboards or to force a different pairing.`,
         "--quiet on any command (or COCKPIT_QUIET=1) drops the `[tower client] responded {...}` trace line from stderr; --json already implies it. A failure still logs — only that success-path trace goes quiet (BLI-10450).",
@@ -180,7 +199,8 @@ export function suggestCommand(word) {
         const distance = editDistance(typed, name);
         if (distance > 2 || distance >= name.length)
             continue;
-        if (!best || distance < best.distance)
+        // A tie goes to the name closest in length to what was typed, so `wrok` is `work` and not the shorter `who`.
+        if (!best || distance < best.distance || (distance === best.distance && Math.abs(name.length - typed.length) < Math.abs(best.name.length - typed.length)))
             best = { name, distance };
     }
     return best?.name ?? null;

package/dist/commands/local-run-ops.js

@@ -0,0 +1,11 @@
+import { runScout } from "./scout.js";
+import { runCi } from "./ci.js";
+import { runOps } from "./ops.js";
+/** Dispatch the operational report commands. */
+export function runOpsCommand(command, io) {
+    switch (command.kind) {
+        case "scout": return runScout(command, io);
+        case "ci": return runCi(command, io);
+        case "ops": return runOps(command, io);
+    }
+}

package/dist/commands/local.js

@@ -1,4 +1,6 @@
+import { runOpsCommand } from "./local-run-ops.js";
 import { runGlossary } from "./glossary.js";
+import { runSpend } from "./spend.js";
 import { defaultIo, errorMessage, writeLine } from "./cli-io.js";
 import { isLocalHelpRequest, localCommandHelp, rootCommandNames } from "./local-help.js";
 import { beginStage, endStage } from "../crash-guard.js";
@@ -20,8 +22,6 @@ import { runStatus } from "./status.js";
 import { runSessions } from "./sessions.js";
 import { runJarvis } from "./jarvis.js";
 import { runModels } from "./models.js";
-import { runScout } from "./scout.js";
-import { runOps } from "./ops.js";
 import { runSlack } from "./slack.js";
 import { runModel, runSettings } from "./settings.js";
 import { runTeam } from "./team.js";
@@ -54,14 +54,16 @@ import { runSetup } from "./setup.js";
 import { runUsage } from "./usage.js";
 import { runSpeed } from "./speed.js";
 import { runLogs } from "./logs.js";
-import { runApprovals } from "./approvals.js";
+import { runApprovals, runDrills } from "./approvals.js";
 import { runManager } from "./manager.js";
 import { runImage } from "./image.js";
 import { runBrain } from "./brain.js";
+import { runHits } from "./hits.js";
+import { runIntentions } from "./intentions.js";
+import { runWho } from "./who.js";
+import { runPeople } from "./people.js";
 import { parseLocalArgs } from "./local-args.js";
-// `./local.js` is the published entry point for this command surface: the
-// public CLI's generated root, commands/root.ts, doctor.ts and the test suite
-// all import from here. Splitting the file must not move a name off it.
+// `./local.js` is the published entry point (the public CLI root, root.ts, doctor.ts, tests): a split must not move a name off it.
 export { rootCommandNames, localCommandHelp, SURFACE_ALIASES, unknownCommandJson, unknownCommandLine, } from "./local-help.js";
 export { buildCollectorHeartbeat, collectionRootLabel, collectionRootLabels, sendCollectorHeartbeatBestEffort, } from "./heartbeat.js";
 export { classifySyncFailureRecords, classifySyncHealthError, redactedSyncErrorDetail, reportInstallEventsBestEffort, SYNC_ERROR_DETAIL_MAX_CHARS, } from "./install-receipts.js";
@@ -171,9 +173,9 @@ export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorA
             case "models":
                 return await runModels(command, io);
             case "scout":
-                return await runScout(command, io);
+            case "ci":
             case "ops":
-                return await runOps(command, io);
+                return await runOpsCommand(command, io);
             case "slack":
                 return await runSlack(command, io);
             case "settings":
@@ -229,6 +231,7 @@ export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorA
                 return await runSourcesCheck(command, io);
             case "glossary":
                 return await runGlossary(command, io);
+            case "spend": return await runSpend(command, io);
             case "docs": return await runDocs(command, io);
             case "msg": return await runMsg(command, io);
             case "issue": return await runIssue(command, io);
@@ -245,7 +248,12 @@ export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorA
             case "speed": return await runSpeed(command, io);
             case "logs": return await runLogs(command, io);
             case "brain": return await runBrain(command, io);
+            case "hits": return await runHits(command, io);
+            case "intentions": return await runIntentions(command, io);
+            case "who": return await runWho(command, io);
+            case "people": return await runPeople(command, io);
             case "approvals": return await runApprovals(command, io);
+            case "drills": return await runDrills(command, io);
             case "manager": return await runManager(command, io);
             case "image": return await runImage(command, io);
         }

package/dist/commands/logs-search.js

@@ -0,0 +1,45 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[logs search cli]";
+const READ_DEADLINE_MS = 65_000;
+export async function runLogsSearch(command, io) {
+    const search = command.search;
+    let door;
+    try {
+        door = await openAgentDoor("logs search", command, io);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : "this machine is not paired with Tower";
+        writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason: "not_paired" })}`);
+        if (command.json)
+            writeLine(io.stdout, JSON.stringify({ ok: false, error: "not_paired", detail }));
+        else
+            writeLine(io.stderr, detail);
+        return 1;
+    }
+    const query = new URLSearchParams({ project: command.source });
+    const set = (name, value) => value && query.set(name, value);
+    set("source", search.logSource);
+    set("stream", search.stream);
+    set("since", search.since);
+    set("from", search.from);
+    set("to", search.to);
+    set("status", search.status);
+    set("method", search.method);
+    set("route", search.route);
+    set("severity", search.severity);
+    set("q", search.q);
+    if (search.limit !== undefined)
+        query.set("limit", String(search.limit));
+    if (search.context)
+        query.set("context", "1");
+    const answer = await askAgentDoor(door, { path: `/api/logs/search?${query.toString()}`, method: "GET", label: "logs search", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(io.stderr, `${TAG} answered ${JSON.stringify({ project: command.source, source: body.source, matched: body.matched, returned: body.returned, capped: body.capped })}`);
+    if (command.json)
+        return emitAgentDoor(door, body);
+    writeLine(io.stdout, body.text ?? "");
+    return 0;
+}