@bli-cockpit/cli 0.2.237 → 0.2.239

package/dist/commands/msg.js

@@ -1,7 +1,7 @@
 /**
  * `cockpit msg` — channels and messages, typed (BLI-3706, BLI-3749).
  *
- * Six verbs over `/api/msg/**` (BLI-3654 Wave 1a), which already accepts the
+ * Eight verbs over `/api/msg/**` (BLI-3654 Wave 1a), which already accepts the
  * collector device token through `resolveCaller({ allowDeviceToken: true })`
  * on every route — no server-side door change was needed for this terminal.
  *
@@ -18,6 +18,7 @@
 import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor, } from "./agent-door.js";
 import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
 import { cacheAgeLabel, cacheCoverage, readThroughCache } from "./read-cache.js";
+import { markReadThrough } from "./msg-read-line.js";
 const TAG = "[msg cli]";
 const READ_DEADLINE_MS = 30_000;
 const WRITE_DEADLINE_MS = 30_000;
@@ -31,6 +32,8 @@ export async function runMsg(command, io) {
             return listChannels(door);
         case "read":
             return readChannel(command, door);
+        case "unread":
+            return markUnread(command, door);
         case "send":
             return sendMessage(command, door);
         case "thread":
@@ -151,11 +154,20 @@ async function readChannel(command, door) {
     // BLI-10449: whether this channel is Tower's own or a Slack snapshot, and
     // how fresh — the door's own sentence, printed as sent.
     const provenance = body.provenance ?? null;
+    const readBoundary = body.readBoundary ?? null;
     const limitApplied = body.limitApplied ?? null;
-    if (door.json)
-        return emitAgentDoor(door, { ok: true, ...body, channelId: resolved.id, provenance, limitApplied, messages, nextCursor: body.nextCursor, hasMore: body.hasMore, coverage: body.coverage });
+    // `--mark-read` (BLI-21299): the person has just been shown these messages, so
+    // the read line moves to the newest top-level one - the only way a terminal
+    // moves it. Never implied by reading alone.
+    const readMove = command.markRead ? await markReadThrough(door, resolved.id, messages) : null;
+    const exitCode = readMove && !readMove.ok ? 1 : 0;
+    if (door.json) {
+        return emitAgentDoor(door, { ok: true, ...body, channelId: resolved.id, provenance, readBoundary, limitApplied, messages, nextCursor: body.nextCursor, hasMore: body.hasMore, coverage: body.coverage, ...(readMove ? { readMove } : {}) }, exitCode);
+    }
     if (provenance?.sentence)
         writeLine(door.io.stdout, provenance.sentence);
+    if (readBoundary?.sentence)
+        writeLine(door.io.stdout, readBoundary.sentence);
     if (limitApplied !== null) {
         writeLine(door.io.stdout, `Showing the newest ${limitApplied}: one read returns at most ${limitApplied} messages.`);
     }
@@ -170,6 +182,36 @@ async function readChannel(command, door) {
         const who = message.agent_label ?? message.user_id ?? message.slack_author_label ?? "someone";
         writeLine(door.io.stdout, `${message.id}  ${message.created_at}  ${who}  ${message.content ?? ""}`);
     }
+    if (readMove) {
+        writeLine(readMove.ok ? door.io.stdout : door.io.stderr, readMove.ok
+            ? `Read line moved to ${readMove.messageId} (${readMove.changed ? "advanced" : "already at or past it"}).`
+            : `Read line NOT moved (${readMove.reason}): ${readMove.detail} Run the same command again to retry.`);
+    }
+    return exitCode;
+}
+/** `cockpit msg unread <channel> --from <message-id>` — this message and everything after it counts as unread. */
+async function markUnread(command, door) {
+    const ref = command.channelRef ?? "";
+    const messageId = command.unreadFrom ?? "";
+    const resolved = await resolveChannelId(door, ref);
+    if (resolved.status === "list_failed")
+        return failAgentDoor(door, TAG, resolved.reason, resolved.detail);
+    if (resolved.status === "not_found")
+        return channelNotFound(door, ref);
+    const answer = await askAgentDoor(door, {
+        path: `/api/msg/channels/${encodeURIComponent(resolved.id)}/read`,
+        method: "POST",
+        label: "msg unread",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: { message_id: messageId, action: "unread" },
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const move = answer.body.move ?? {};
+    writeLine(door.io.stderr, `${TAG} unread ${JSON.stringify({ channel_id: resolved.id, message_id: messageId })}`);
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, channelId: resolved.id, messageId, move });
+    writeLine(door.io.stdout, `Marked ${messageId} and everything after it unread in ${ref}. Read line now at ${move.lastReadAt ?? "the start"}.`);
     return 0;
 }
 async function readThread(command, door) {

package/dist/commands/notes-accounts.js

@@ -80,6 +80,25 @@ function writeSharedFeeds(door, feeds) {
     }
     writeLine(door.io.stdout, "  Its runs in full: `cockpit notes granola-status`.");
 }
+function writeHowToConnect(door) {
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fellow api key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
+    writeLine(door.io.stdout, '          or:  printf "%s" "<your circleback api key>" | cockpit notes connect --provider circleback --key-stdin');
+    writeLine(door.io.stdout, "          or:  cockpit notes connect --provider wisprflow   (opens Wispr's sign-in in your browser and waits; no key)");
+}
+function writeAccountRows(door, accounts) {
+    for (const account of accounts) {
+        const health = account.status === "active"
+            ? "active"
+            : `${account.status}: ${account.status_reason ?? "no reason recorded"}`;
+        // The workspace rides beside the provider because a Fellow account that
+        // points at the wrong subdomain fails with a 401 and nothing else says so.
+        const where = account.workspace ? `${account.provider}/${account.workspace}` : account.provider;
+        writeLine(door.io.stdout, `${(account.label ?? account.provider).padEnd(20)}  ${where.padEnd(20)}  ${health.padEnd(24)}  ${account.last_synced_at ?? "never read"}`);
+    }
+    writeLine(door.io.stdout, "");
+    writeLine(door.io.stdout, `${accounts.length} notetaker(s). ids: ${accounts.map((account) => account.id).join(", ")}`);
+}
 export async function listNotesAccounts(command, door) {
     const answer = await ask(door, {
         path: "/api/notes/accounts",
@@ -101,25 +120,12 @@ export async function listNotesAccounts(command, door) {
     if (accounts.length === 0) {
         writeLine(door.io.stdout, "You have not connected a notetaker of your own.");
         writeSharedFeeds(door, sharedFeeds);
-        writeLine(door.io.stdout, "");
-        writeLine(door.io.stdout, 'Connect one:  printf "%s" "<your fellow api key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
-        writeLine(door.io.stdout, '          or:  printf "%s" "<your circleback api key>" | cockpit notes connect --provider circleback --key-stdin');
-        writeLine(door.io.stdout, "          or:  cockpit notes connect --provider wisprflow   (opens Wispr's sign-in in your browser and waits; no key)");
+        writeHowToConnect(door);
         if (coverage)
             printCoverage(door, coverage);
         return 0;
     }
-    for (const account of accounts) {
-        const health = account.status === "active"
-            ? "active"
-            : `${account.status}: ${account.status_reason ?? "no reason recorded"}`;
-        // The workspace rides beside the provider because a Fellow account that
-        // points at the wrong subdomain fails with a 401 and nothing else says so.
-        const where = account.workspace ? `${account.provider}/${account.workspace}` : account.provider;
-        writeLine(door.io.stdout, `${(account.label ?? account.provider).padEnd(20)}  ${where.padEnd(20)}  ${health.padEnd(24)}  ${account.last_synced_at ?? "never read"}`);
-    }
-    writeLine(door.io.stdout, "");
-    writeLine(door.io.stdout, `${accounts.length} notetaker(s). ids: ${accounts.map((account) => account.id).join(", ")}`);
+    writeAccountRows(door, accounts);
     writeSharedFeeds(door, sharedFeeds);
     if (coverage)
         printCoverage(door, coverage);
@@ -159,21 +165,10 @@ export async function connectNotetaker(command, door, wisprflow = {}) {
     if (isInteractiveStdin(door.io)) {
         return fail(door, "key_required_on_stdin", 'The API key is read from stdin, never from a flag. Try: printf "%s" "<your key>" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin');
     }
-    let apiKey;
-    try {
-        apiKey = (await readPipedText(door.io.stdin, {
-            // A pre-built Wispr Flow sign-in bundle carries an OAuth refresh token,
-            // which can be far longer than any API key.
-            maxChars: command.provider === "wisprflow" ? SIGN_IN_MAX_CHARS : KEY_MAX_CHARS,
-            overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
-        })).trim();
-    }
-    catch (error) {
-        return fail(door, "key_unreadable", error instanceof Error ? error.message : String(error));
-    }
-    if (apiKey === "") {
-        return fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.");
-    }
+    const key = await readConnectKey(command, door);
+    if ("exitCode" in key)
+        return key.exitCode;
+    const apiKey = key.apiKey;
     const answer = await ask(door, {
         path: "/api/notes/accounts",
         method: "POST",
@@ -194,10 +189,32 @@ export async function connectNotetaker(command, door, wisprflow = {}) {
     const account = answer.body.account;
     if (door.json)
         return emit(door, { ok: true, account });
-    const named = account?.provider ?? command.provider ?? "fellow";
+    writeConnected(door, account, command.provider ?? "fellow");
+    return 0;
+}
+/** The key as piped on stdin, or the exit code of the refusal already written. */
+async function readConnectKey(command, door) {
+    let apiKey;
+    try {
+        apiKey = (await readPipedText(door.io.stdin, {
+            // A pre-built Wispr Flow sign-in bundle carries an OAuth refresh token,
+            // which can be far longer than any API key.
+            maxChars: command.provider === "wisprflow" ? SIGN_IN_MAX_CHARS : KEY_MAX_CHARS,
+            overflowMessage: "That is longer than any notetaker API key; nothing was sent.",
+        })).trim();
+    }
+    catch (error) {
+        return { exitCode: fail(door, "key_unreadable", error instanceof Error ? error.message : String(error)) };
+    }
+    if (apiKey === "") {
+        return { exitCode: fail(door, "key_required_on_stdin", "Nothing arrived on stdin, so nothing was connected.") };
+    }
+    return { apiKey };
+}
+function writeConnected(door, account, requestedProvider) {
+    const named = account?.provider ?? requestedProvider;
     writeLine(door.io.stdout, `Connected ${account?.workspace ? `${named}/${account.workspace}` : named} (${account?.id ?? "no id returned"}).`);
     writeLine(door.io.stdout, "Nothing is read until a sync runs: `cockpit notes sync <id>`, or wait for the half-hourly cron.");
-    return 0;
 }
 /**
  * `cockpit notes accounts --show-webhook <id>` and

package/dist/commands/notes-sync-loop.js

@@ -44,96 +44,122 @@ export async function syncNotetaker(command, door) {
     // and the MCP tool call; nothing here reads a notetaker itself.
     const env = door.io.env ?? {};
     const pollMs = Number.parseInt(env["COCKPIT_NOTES_SYNC_POLL_MS"] ?? "", 10);
-    const liveWaitMs = Number.isFinite(pollMs) && pollMs >= 0 ? pollMs : LIVE_PASS_WAIT_MS;
-    const totals = { stored: 0, unchanged: 0, skipped: 0 };
-    // BLI-18006: `--repair-truncated` asks the same door to re-read Wispr Flow notes
-    // that were stored cut short. Fixed ones count as "unchanged" in the totals
-    // (the ledger's column), failed ones as "skipped"; the repair line says which.
-    const repairing = command.repairTruncated === true;
-    const repairTotals = { fixed: 0, failed: 0, found: 0 };
-    let passes = 0;
-    let stalled = 0;
-    let liveWaits = 0;
-    let transientFailures = 0;
-    let last;
-    while (passes < MAX_SYNC_PASSES) {
-        const answer = await ask(door, {
-            path: `/api/notes/accounts/${encodeURIComponent(accountId)}/sync`,
-            method: "POST",
-            label: repairing ? "notes sync (repair truncated)" : "notes sync",
-            timeoutMs: repairing ? REPAIR_DEADLINE_MS : WRITE_DEADLINE_MS,
-            ...(repairing ? { body: { repair: "truncated_transcripts" } } : {}),
-        });
-        if (!answer.ok) {
-            // A timeout or a 5xx mid-history is the call's, not the account's: the
-            // cursor was saved after every meeting, so asking again resumes. Three in
-            // a row is a real outage and is reported with its reason.
-            const transient = /^(timeout|network|unreachable|http_5\d\d|BLI-E5\d\d|read_failed)/i.test(answer.reason);
-            if (transient && transientFailures < MAX_TRANSIENT_FAILURES) {
-                transientFailures += 1;
-                writeLine(door.io.stderr, `${TAG} sync call failed, retrying ${JSON.stringify({ reason: answer.reason, attempt: transientFailures })}`);
-                await sleepMs(liveWaitMs);
-                continue;
-            }
-            return failRun(door, answer.reason, answer.detail, last, passes, totals);
-        }
-        transientFailures = 0;
-        const run = answer.body.run;
-        if (!run) {
-            writeLine(door.io.stdout, "Tower answered without a run.");
-            return failRun(door, "no_run_in_answer", "Tower answered the sync without a run.", last, passes, totals);
-        }
-        last = run;
-        if (run.reason === "running") {
-            // Another pass (the cron, a second terminal) is live on this account. It
-            // writes the same cursor; wait for it rather than racing it.
-            liveWaits += 1;
-            writeLine(door.io.stderr, `${TAG} another pass is running ${JSON.stringify({ run_id: run.runId ?? null, waits: liveWaits })}`);
-            if (liveWaits > MAX_LIVE_WAITS) {
-                return failRun(door, "pass_still_running", "Another pass kept running on this notetaker. Check `cockpit notes sync-status`, then try again.", last, passes, totals);
-            }
-            await sleepMs(liveWaitMs);
-            continue;
-        }
-        passes += 1;
-        totals.stored += run.notesAdded;
-        totals.unchanged += run.notesUpdated;
-        totals.skipped += run.notesSkipped;
-        const waiting = typeof run.remaining === "number" ? `; ${run.remaining} waiting` : "";
-        if (run.repair) {
-            repairTotals.fixed += run.repair.fixed;
-            repairTotals.failed += run.repair.failed;
-            repairTotals.found = Math.max(repairTotals.found, run.repair.found);
-        }
-        const line = run.repair
-            ? `pass ${passes}: ${run.reason}: repair: ${repairLine(run.repair)}${run.more ? ", continuing" : ""}.`
-            : `pass ${passes}: ${run.reason}: ${run.notesAdded} stored, ${run.notesUpdated} unchanged, ${run.notesSkipped} skipped${run.more ? `${waiting}, continuing` : ""}.`;
-        // Progress is commentary in --json (stdout is the one answer), and the
-        // answer in a terminal.
-        writeLine(door.json ? door.io.stderr : door.io.stdout, line);
-        if (run.detail && !run.ok)
-            writeLine(door.json ? door.io.stderr : door.io.stdout, run.detail);
-        if (!run.ok) {
-            return failRun(door, run.reason, run.detail || `The pass ended ${run.reason}.`, run, passes, totals);
-        }
-        if (!run.more) {
-            if (door.json)
-                return emit(door, { ok: true, passes, totals, ...(repairing ? { repair: repairTotals } : {}), run });
-            writeLine(door.io.stdout, repairing
-                ? `Repair finished after ${passes} pass${passes === 1 ? "" : "es"}: ${repairTotals.fixed} fixed, ${repairTotals.failed} failed (${repairTotals.found} carried the marker when the first pass began).`
-                : `Caught up after ${passes} pass${passes === 1 ? "" : "es"}: ${totals.stored} stored, ${totals.unchanged} unchanged, ${totals.skipped} skipped.`);
-            return 0;
-        }
-        // A pass that handled nothing and still says "more" would loop forever.
-        if (run.notesAdded + run.notesUpdated + run.notesSkipped === 0)
-            stalled += 1;
-        else
-            stalled = 0;
-        if (stalled >= MAX_STALLED_PASSES) {
-            return failRun(door, "no_progress", `Three passes in a row handled no meeting (last: ${run.reason}). The cursor is saved; try again later or check \`cockpit notes sync-status\`.`, run, passes, totals);
-        }
+    const settings = {
+        accountId,
+        // BLI-18006: `--repair-truncated` asks the same door to re-read Wispr Flow notes
+        // that were stored cut short. Fixed ones count as "unchanged" in the totals
+        // (the ledger's column), failed ones as "skipped"; the repair line says which.
+        repairing: command.repairTruncated === true,
+        liveWaitMs: Number.isFinite(pollMs) && pollMs >= 0 ? pollMs : LIVE_PASS_WAIT_MS,
+    };
+    const state = {
+        passes: 0,
+        stalled: 0,
+        liveWaits: 0,
+        transientFailures: 0,
+        last: undefined,
+        totals: { stored: 0, unchanged: 0, skipped: 0 },
+        repairTotals: { fixed: 0, failed: 0, found: 0 },
+    };
+    while (state.passes < MAX_SYNC_PASSES) {
+        const outcome = await runOnePass(door, settings, state);
+        if (outcome !== "again")
+            return outcome;
     }
-    return failRun(door, "too_many_passes", `Stopped after ${MAX_SYNC_PASSES} passes with meetings still waiting. Run \`cockpit notes sync ${accountId}\` again to continue from the saved cursor.`, last, passes, totals);
+    return stopSync(door, state, "too_many_passes", `Stopped after ${MAX_SYNC_PASSES} passes with meetings still waiting. Run \`cockpit notes sync ${accountId}\` again to continue from the saved cursor.`);
+}
+/** One door call and what follows it: an exit code when the sync is over, "again" when it is not. */
+async function runOnePass(door, settings, state) {
+    const answer = await ask(door, {
+        path: `/api/notes/accounts/${encodeURIComponent(settings.accountId)}/sync`,
+        method: "POST",
+        label: settings.repairing ? "notes sync (repair truncated)" : "notes sync",
+        timeoutMs: settings.repairing ? REPAIR_DEADLINE_MS : WRITE_DEADLINE_MS,
+        ...(settings.repairing ? { body: { repair: "truncated_transcripts" } } : {}),
+    });
+    if (!answer.ok)
+        return await retryOrStop(door, settings, state, answer);
+    state.transientFailures = 0;
+    const run = answer.body.run;
+    if (!run) {
+        writeLine(door.io.stdout, "Tower answered without a run.");
+        return stopSync(door, state, "no_run_in_answer", "Tower answered the sync without a run.");
+    }
+    state.last = run;
+    if (run.reason === "running")
+        return await waitForLivePass(door, settings, state, run);
+    recordPass(door, state, run);
+    if (!run.ok) {
+        return stopSync(door, state, run.reason, run.detail || `The pass ended ${run.reason}.`);
+    }
+    if (!run.more)
+        return finishSync(door, settings, state, run);
+    return checkProgress(door, state, run);
+}
+/** A timeout or a 5xx mid-history is the call's, not the account's: the cursor was saved after every meeting. */
+async function retryOrStop(door, settings, state, answer) {
+    // Asking again resumes. Three in a row is a real outage and is reported with its reason.
+    const transient = /^(timeout|network|unreachable|http_5\d\d|BLI-E5\d\d|read_failed)/i.test(answer.reason);
+    if (!transient || state.transientFailures >= MAX_TRANSIENT_FAILURES) {
+        return stopSync(door, state, answer.reason, answer.detail);
+    }
+    state.transientFailures += 1;
+    writeLine(door.io.stderr, `${TAG} sync call failed, retrying ${JSON.stringify({ reason: answer.reason, attempt: state.transientFailures })}`);
+    await sleepMs(settings.liveWaitMs);
+    return "again";
+}
+/** Another pass (the cron, a second terminal) is live on this account. It writes the same cursor; wait for it rather than racing it. */
+async function waitForLivePass(door, settings, state, run) {
+    state.liveWaits += 1;
+    writeLine(door.io.stderr, `${TAG} another pass is running ${JSON.stringify({ run_id: run.runId ?? null, waits: state.liveWaits })}`);
+    if (state.liveWaits > MAX_LIVE_WAITS) {
+        return stopSync(door, state, "pass_still_running", "Another pass kept running on this notetaker. Check `cockpit notes sync-status`, then try again.");
+    }
+    await sleepMs(settings.liveWaitMs);
+    return "again";
+}
+/** Add the pass to the totals and print its line. */
+function recordPass(door, state, run) {
+    state.passes += 1;
+    state.totals.stored += run.notesAdded;
+    state.totals.unchanged += run.notesUpdated;
+    state.totals.skipped += run.notesSkipped;
+    const waiting = typeof run.remaining === "number" ? `; ${run.remaining} waiting` : "";
+    if (run.repair) {
+        state.repairTotals.fixed += run.repair.fixed;
+        state.repairTotals.failed += run.repair.failed;
+        state.repairTotals.found = Math.max(state.repairTotals.found, run.repair.found);
+    }
+    const line = run.repair
+        ? `pass ${state.passes}: ${run.reason}: repair: ${repairLine(run.repair)}${run.more ? ", continuing" : ""}.`
+        : `pass ${state.passes}: ${run.reason}: ${run.notesAdded} stored, ${run.notesUpdated} unchanged, ${run.notesSkipped} skipped${run.more ? `${waiting}, continuing` : ""}.`;
+    // Progress is commentary in --json (stdout is the one answer), and the
+    // answer in a terminal.
+    writeLine(door.json ? door.io.stderr : door.io.stdout, line);
+    if (run.detail && !run.ok)
+        writeLine(door.json ? door.io.stderr : door.io.stdout, run.detail);
+}
+function finishSync(door, settings, state, run) {
+    const { passes, totals, repairTotals } = state;
+    if (door.json)
+        return emit(door, { ok: true, passes, totals, ...(settings.repairing ? { repair: repairTotals } : {}), run });
+    writeLine(door.io.stdout, settings.repairing
+        ? `Repair finished after ${passes} pass${passes === 1 ? "" : "es"}: ${repairTotals.fixed} fixed, ${repairTotals.failed} failed (${repairTotals.found} carried the marker when the first pass began).`
+        : `Caught up after ${passes} pass${passes === 1 ? "" : "es"}: ${totals.stored} stored, ${totals.unchanged} unchanged, ${totals.skipped} skipped.`);
+    return 0;
+}
+/** A pass that handled nothing and still says "more" would loop forever. */
+function checkProgress(door, state, run) {
+    if (run.notesAdded + run.notesUpdated + run.notesSkipped === 0)
+        state.stalled += 1;
+    else
+        state.stalled = 0;
+    if (state.stalled < MAX_STALLED_PASSES)
+        return "again";
+    return stopSync(door, state, "no_progress", `Three passes in a row handled no meeting (last: ${run.reason}). The cursor is saved; try again later or check \`cockpit notes sync-status\`.`);
+}
+function stopSync(door, state, reason, detail) {
+    return failRun(door, reason, detail, state.last, state.passes, state.totals);
 }
 /** A sync that did not finish: the reason on stderr, the structured answer on stdout in --json. */
 function failRun(door, reason, detail, run, passes, totals) {

package/dist/commands/notes-wisprflow-login.js

@@ -57,8 +57,14 @@ export async function connectWisprflowInBrowser(door, options = {}) {
     const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const now = options.now ?? Date.now;
     const open = options.open ?? ((url) => openInBrowser(url));
-    const stderr = door.io.stderr;
-    // 1. Ask the one start door for a sign-in.
+    const started = await startSignIn(door);
+    if ("failure" in started)
+        return started.failure;
+    announceSignIn(door, started.signIn.authorizeUrl, open);
+    return await waitForSignIn(door, started.signIn.attemptId, sleep, now);
+}
+/** 1. Ask the one start door for a sign-in. */
+async function startSignIn(door) {
     const started = await ask(door, {
         path: WISPRFLOW_START_PATH,
         method: "POST",
@@ -69,8 +75,8 @@ export async function connectWisprflowInBrowser(door, options = {}) {
     if (!started.ok) {
         log(door, "start refused", { reason: started.reason });
         if (started.reason === "account_already_connected")
-            return alreadyConnected(door);
-        return { ok: false, reason: started.reason, detail: started.detail };
+            return { failure: await alreadyConnected(door) };
+        return { failure: { ok: false, reason: started.reason, detail: started.detail } };
     }
     const body = started.body;
     const authorizeUrl = typeof body.authorize_url === "string" ? body.authorize_url : "";
@@ -78,13 +84,19 @@ export async function connectWisprflowInBrowser(door, options = {}) {
     if (authorizeUrl === "" || attemptId === "") {
         log(door, "start answer unusable", { reason: "start_answer_unusable" });
         return {
-            ok: false,
-            reason: "start_answer_unusable",
-            detail: "Tower started a sign-in but did not say where to send you or how to watch it, so nothing was connected.",
+            failure: {
+                ok: false,
+                reason: "start_answer_unusable",
+                detail: "Tower started a sign-in but did not say where to send you or how to watch it, so nothing was connected.",
+            },
         };
     }
     log(door, "started", { attempt_id: attemptId, expires_at: typeof body.expires_at === "string" ? body.expires_at : null });
-    // 2. Print the address first, then open it.
+    return { signIn: { attemptId, authorizeUrl } };
+}
+/** 2. Print the address first, then open it. */
+function announceSignIn(door, authorizeUrl, open) {
+    const stderr = door.io.stderr;
     writeLine(stderr, "Connect Wispr Flow to Tower: approve on Wispr's page in your browser.");
     writeLine(stderr, `  ${authorizeUrl}`);
     writeLine(stderr, "  Use the Wispr account that holds your notes, signed in with Google, Apple, Microsoft or company single sign-on.");
@@ -93,7 +105,9 @@ export async function connectWisprflowInBrowser(door, options = {}) {
     if (!opened.ok)
         writeLine(stderr, `(${opened.detail} The address above still works.)`);
     writeLine(stderr, `Waiting up to ${MAX_WAIT_MS / 60_000} minutes for the sign-in to finish...`);
-    // 3. Poll the one status door.
+}
+/** 3. Poll the one status door. */
+async function waitForSignIn(door, attemptId, sleep, now) {
     const deadline = now() + MAX_WAIT_MS;
     let polls = 0;
     let failures = 0;
@@ -115,20 +129,9 @@ export async function connectWisprflowInBrowser(door, options = {}) {
         }
         else {
             failures = 0;
-            const status = polled.body;
-            const state = typeof status.status === "string" ? status.status : "unknown";
-            const reason = typeof status.reason === "string" ? status.reason : null;
-            log(door, "poll", { attempt_id: attemptId, polls, status: state, reason });
-            if (state === "connected") {
-                const accountId = typeof status.account_id === "string" ? status.account_id : "";
-                log(door, "connected", { attempt_id: attemptId, account_id: accountId || null, polls });
-                return { ok: true, account: await readAccount(door, accountId), already: false };
-            }
-            if (state === "failed" || state === "expired") {
-                const why = reason ?? (state === "expired" ? "state_expired" : "unknown");
-                log(door, "ended without connecting", { attempt_id: attemptId, status: state, reason: why });
-                return { ok: false, reason: why, detail: failureDetail(why) };
-            }
+            const ended = await readEndOfSignIn(door, attemptId, polls, polled.body);
+            if (ended)
+                return ended;
         }
         await sleep(POLL_INTERVAL_MS);
     }
@@ -140,6 +143,24 @@ export async function connectWisprflowInBrowser(door, options = {}) {
             + " Run this again for a fresh link, or check `cockpit notes accounts`.",
     };
 }
+/** The sign-in's answer once it has one; undefined while it is still pending. */
+async function readEndOfSignIn(door, attemptId, polls, pollBody) {
+    const status = pollBody;
+    const state = typeof status.status === "string" ? status.status : "unknown";
+    const reason = typeof status.reason === "string" ? status.reason : null;
+    log(door, "poll", { attempt_id: attemptId, polls, status: state, reason });
+    if (state === "connected") {
+        const accountId = typeof status.account_id === "string" ? status.account_id : "";
+        log(door, "connected", { attempt_id: attemptId, account_id: accountId || null, polls });
+        return { ok: true, account: await readAccount(door, accountId), already: false };
+    }
+    if (state === "failed" || state === "expired") {
+        const why = reason ?? (state === "expired" ? "state_expired" : "unknown");
+        log(door, "ended without connecting", { attempt_id: attemptId, status: state, reason: why });
+        return { ok: false, reason: why, detail: failureDetail(why) };
+    }
+    return undefined;
+}
 /** The start door said Wispr Flow is already connected: read which account and report it honestly. */
 async function alreadyConnected(door) {
     const accounts = await readAccounts(door);