@bli-cockpit/cli 0.2.240 → 0.2.242

package/dist/commands/cal-view-settings.js

@@ -0,0 +1,61 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { readPipedText, isInteractiveStdin, writeLine } from "./cli-io.js";
+const FAIL_TAG = "[cal cli]";
+const REQUEST_TIMEOUT_MS = 30000;
+const PATH = "/api/cal/view-settings";
+/** `cal view-settings` (read) and `cal view-settings-change` (partial patch). Same door the browser uses. */
+export async function runCalViewSettings(command, door) {
+    if (command.action === "view-settings-change")
+        return change(command, door);
+    const answer = await askAgentDoor(door, { method: "GET", path: PATH, label: "cal view-settings", timeoutMs: REQUEST_TIMEOUT_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, FAIL_TAG, answer.reason, answer.detail);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    writeSettings(door, answer.body, true);
+    return 0;
+}
+async function change(command, door) {
+    let body = command.viewSettings ?? {};
+    if (!Object.keys(body).length && !isInteractiveStdin(door.io)) {
+        const piped = await readPipedSettings(door);
+        if (piped === null)
+            return failAgentDoor(door, FAIL_TAG, "invalid_body", "Pipe a JSON object of settings, or use --view, --days, --week-start, --hide-weekends, --density, --zone.");
+        body = piped;
+    }
+    if (!Object.keys(body).length) {
+        return failAgentDoor(door, FAIL_TAG, "invalid_body", "Name a setting: --view month, --days 4, --week-start sunday, --hide-weekends on, --density compact, --zone America/Toronto (or --zone none).");
+    }
+    const answer = await askAgentDoor(door, { method: "PATCH", path: PATH, body, label: "cal view-settings-change", timeoutMs: REQUEST_TIMEOUT_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, FAIL_TAG, answer.reason, answer.detail);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    writeLine(door.io.stdout, "View settings saved.");
+    writeSettings(door, answer.body, false);
+    return 0;
+}
+function writeSettings(door, settings, withActions) {
+    const out = door.io.stdout;
+    writeLine(out, settings.saved ? `Saved ${settings.updated_at ?? ""}`.trim() : "Not saved yet: these are the defaults.");
+    writeLine(out, `default view: ${settings.default_view}${settings.default_view === "days" ? ` (${settings.day_count} days)` : ` · N days: ${settings.day_count}`}`);
+    writeLine(out, `week starts: ${settings.week_start} · weekends: ${settings.hide_weekends ? "hidden in week and N-day views" : "shown"} · density: ${settings.density}`);
+    writeLine(out, `extra time zones: ${settings.extra_zones.length ? settings.extra_zones.join(", ") : "none"}`);
+    if (withActions) {
+        writeLine(out, "Keyboard shortcuts:");
+        for (const action of settings.actions ?? [])
+            writeLine(out, `  ${action.keys.join(" ")}  ${action.label}: ${action.description}`);
+    }
+}
+/** Piped JSON settings, or null when the pipe is unreadable or not a JSON object. */
+async function readPipedSettings(door) {
+    try {
+        const parsed = JSON.parse(await readPipedText(door.io.stdin, { maxChars: 4000, overflowMessage: "Settings are too large." }));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/commands/cal.js

@@ -24,6 +24,7 @@ import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor, } from "./ag
 import { runCalAddIcal, runCalDetach, runCalShare, runCalSync } from "./cal-calendars-write.js";
 import { runCalDetail } from "./cal-detail.js";
 import { runCalOverlay } from "./cal-overlay.js";
+import { runCalViewSettings } from "./cal-view-settings.js";
 import { runCalDelete } from "./cal-delete.js";
 import { detailFields, runCalRsvp, scopeFields, writeScopeFacts } from "./cal-scope.js";
 import { runCalDirect } from "./cal-direct.js";
@@ -46,6 +47,9 @@ export async function runCal(command, io) {
         case "conflicts":
         case "calendar-change":
             return runCalOverlay(command, door);
+        case "view-settings":
+        case "view-settings-change":
+            return runCalViewSettings(command, door);
         case "today":
         case "week":
         case "next":

package/dist/commands/local-arg-values.js

@@ -9,9 +9,13 @@
  * verbatim: no logic changed, and `normalizeUrl` is still re-exported from
  * `./local-args.js` for the callers that had it there.
  *
- * `rejectServiceRoleLikeArgument` runs on every token, flag or positional, and
- * is why a service-role credential cannot enter a collector command from the
- * command line at all.
+ * `rejectSupabaseServiceCredential` runs on every token, flag or positional of every command, and is
+ * why a Supabase service credential (a service-role JWT, or the newer `sb_secret_…` key) cannot enter a
+ * collector command from the command line. It looks at
+ * the SHAPE of a value, never at words: a note that says "the Supabase service-role key" is
+ * plain text. The wider telemetry-core secret rulebook (`rejectSecretLikeValue`) is NOT run
+ * here: it reads words like "password: x" or "M0-…-review" as secrets, which no other command
+ * may be refused for. Only `cockpit manager`'s free-text values go through it (BLI-5777).
  */
 const WORK_ROOT_FLAGS = ["--repo", "--workspace"];
 export function parseNamedArgs(args, options) {
@@ -23,12 +27,15 @@ export function parseNamedArgs(args, options) {
     const positionals = [];
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index] ?? "";
-        rejectServiceRoleLikeArgument(arg);
+        rejectSupabaseServiceCredential(arg);
         if (!arg.startsWith("--")) {
             positionals.push(arg);
             continue;
         }
-        const [flag, inlineValue] = arg.split("=", 2);
+        // Split on the FIRST "=" only: the value may hold more of them ("ARR = 1M", a URL query).
+        const equalsAt = arg.indexOf("=");
+        const flag = equalsAt === -1 ? arg : arg.slice(0, equalsAt);
+        const inlineValue = equalsAt === -1 ? undefined : arg.slice(equalsAt + 1);
         if (!allowed.has(flag))
             throw new Error(`Unknown flag: ${flag}`);
         if (valueFlags.has(flag)) {
@@ -36,7 +43,7 @@ export function parseNamedArgs(args, options) {
             if (!value || value.startsWith("--")) {
                 throw new Error(`${flag} requires a value.`);
             }
-            rejectServiceRoleLikeArgument(value);
+            rejectSupabaseServiceCredential(value);
             flags.set(flag, value);
             const existing = flagValues.get(flag) ?? [];
             existing.push(value);
@@ -139,14 +146,84 @@ export function normalizeUrl(value) {
         throw new Error("URL value cannot be empty.");
     return trimmed;
 }
-function rejectServiceRoleLikeArgument(value) {
-    if (!looksLikeServiceRoleSecret(value))
-        return;
-    throw new Error("Service-role credentials are not accepted by local collector commands.");
+/**
+ * Supabase's newer secret key format (`SUPABASE_SECRET_KEY`, admin-contracts.ts): not a JWT, so it needs its own shape.
+ * A provider prefix plus a key-length body: prose about the key ("SUPABASE_SECRET_KEY docs") never matches.
+ */
+const SUPABASE_SECRET_KEY_SHAPE = /\bsb_secret_[A-Za-z0-9_-]{16}[A-Za-z0-9_-]*/;
+/**
+ * Every command, every token: refuses a Supabase service credential, by SHAPE: a JWT whose payload says it is the
+ * privileged role, or an `sb_secret_…` key. The words "service-role key" are plain text (BLI-5777: a meeting note that
+ * named one was refused, and an agent reworded the client's words to get through).
+ */
+export function rejectSupabaseServiceCredential(value) {
+    if (looksLikeServiceRoleJwt(value) || containsServiceRoleJwt(value) || SUPABASE_SECRET_KEY_SHAPE.test(value)) {
+        throw new Error("Service-role credentials are not accepted by local collector commands.");
+    }
+}
+/**
+ * The key SHAPES `cockpit manager` free text is refused for: only high-precision ones, each a provider's own key format, so a
+ * sentence about a key, a commit sha or a session name is never refused. Copied from the telemetry-core rulebook
+ * (`packages/cockpit-telemetry-core/src/secret-guards-content-rules.ts`, `SECRET_VALUE_PATTERNS` and the password rule), which is
+ * built to over-match for redaction (it masks and uploads, never refuses) and is NOT used here: its mem0 rule `m0[-_]…` reads
+ * "M0-deliverable-review-session" as a key. Left out on purpose: that rule, `name=value` assignments other than a password, and
+ * any generic entropy, token or session-id shape.
+ */
+export const MANAGER_KEY_SHAPES = [
+    // Any JWT (a Supabase anon, service-role or user token): three base64url parts, the first starting `eyJ`.
+    /\beyJ[A-Za-z0-9_-]{10}[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{10}[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{10}[A-Za-z0-9_-]*\b/,
+    // Real keys are long and hold digits; prose ("Upgrade sk-learn-pipeline-improvements", "rk_quarterly_review_notes_final") does not: a digit is required,
+    // and sk- needs a 32+ character body, rk_ and the _live_/_test_ keys 24+. (Not pk_live_: a publishable key is public.)
+    /\bsk-(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]{32,}/,
+    /\b(?:sk|rk)_(?:live|test)_(?=[A-Za-z0-9]*\d)[A-Za-z0-9]{24,}/,
+    /\brk_(?=[A-Za-z0-9_]*\d)[A-Za-z0-9_]{24,}/,
+    SUPABASE_SECRET_KEY_SHAPE,
+    /\bgh[pousr]_(?=[A-Za-z0-9_]*\d)[A-Za-z0-9_]{16,}/,
+    /\bgithub_pat_(?=[A-Za-z0-9_]*\d)[A-Za-z0-9_]{20,}/,
+    /\blin_api_(?=[A-Za-z0-9]*\d)[A-Za-z0-9]{16,}/,
+    /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+    /\bxox[abprs]-(?=[A-Za-z0-9-]*\d)[A-Za-z0-9-]{16,}/,
+    /\bBearer\s+(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]{16,}/,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+];
+/** A candidate password: the word, then `:` or `=` and a value (its quotes aside). */
+const PASSWORD_ASSIGNMENT = /(?<![A-Za-z0-9])(?:password|passwd|passcode)(?:[_-][A-Za-z0-9_-]{0,40})?["']?\s*[:=]\s*["']?([^\s"'`,;<>(){}\[\]]{6,})/gi;
+/**
+ * A password ASSIGNED a value is a secret when the value holds a digit or a symbol ("password: hunter2", `passwd="x1y2z3"`, "admin password: Tr0ub4dor&3").
+ * Prose is text: the word alone ("password reset flow"), a value of letters ("Password: rotated."), sentence punctuation after it (".,!?;:"), a hyphen or
+ * apostrophe between letters ("password: on-site", "Client password: e-mailed to Jo") and the product name 1Password ("Shared password: 1Password vault").
+ */
+export function looksLikePasswordAssignment(value) {
+    for (const match of value.matchAll(PASSWORD_ASSIGNMENT)) {
+        const plain = match[1].replace(/[.,!?;:]+$/, "").replace(/1password/gi, "").replace(/(?<=[A-Za-z])[-'’](?=[A-Za-z])/g, "");
+        if (/[^A-Za-z]/.test(plain))
+            return true;
+    }
+    return false;
+}
+/** The whole manager free-text question: does this text hold a key shape or an assigned password? */
+export function looksLikeManagerSecret(value) {
+    return MANAGER_KEY_SHAPES.some((shape) => shape.test(value)) || looksLikePasswordAssignment(value);
+}
+/**
+ * `cockpit manager` free text only (its text flags and every `--fields-file` value): the service-role JWT, plus the key shapes above.
+ * `where` names the flag or file key, so the sentence says which one; the value is never echoed.
+ */
+export function rejectSecretLikeValue(value, where) {
+    // The named sentence first (KEY_SHAPES holds the JWT and sb_secret_ shapes too); the service-role JWT check stays as the floor.
+    if (looksLikeManagerSecret(value)) {
+        throw new Error(`The value of ${where} looks like a secret (a key, token or password), and secrets are not accepted there. Take the secret out and run it again; text that only talks about a key is fine.`);
+    }
+    rejectSupabaseServiceCredential(value);
 }
-function looksLikeServiceRoleSecret(value) {
-    if (serviceCredentialNamePattern().test(value))
-        return true;
+/**
+ * A service-role JWT anywhere inside the value ("the service-role key=<jwt> for staging."): every token that starts at a JWT header (`eyJ`, which every
+ * Supabase JWT does) is decoded. Anchored on the header, not on any three dotted words, so a JWT glued after a dotted word ("staging.eyJ….….…") is found whole.
+ */
+function containsServiceRoleJwt(value) {
+    return (value.match(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g) ?? []).some((token) => looksLikeServiceRoleJwt(token));
+}
+function looksLikeServiceRoleJwt(value) {
     const parts = value.split(".");
     if (parts.length !== 3)
         return false;
@@ -162,12 +239,6 @@ function looksLikeServiceRoleSecret(value) {
         return false;
     }
 }
-function serviceCredentialNamePattern() {
-    return new RegExp([
-        ["SUPABASE", "SERVICE", "ROLE", "KEY"].join("[_-]?"),
-        ["service", "role"].join("[_-]?"),
-    ].join("|"), "i");
-}
 function serviceCredentialPayloadPattern() {
     const privilegedRole = ["service", "role"].join("_");
     return new RegExp(`"role"\\s*:\\s*"${privilegedRole}"`);

package/dist/commands/local-args-tower-cal.js

@@ -20,7 +20,7 @@
  */
 import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, } from "./local-arg-values.js";
 const CAL_ACTIONS = new Set([
-    "event", "export", "duplicate", "batch", "undo", "conflicts", "calendar-change",
+    "event", "export", "duplicate", "batch", "undo", "conflicts", "calendar-change", "view-settings", "view-settings-change",
     "today",
     "week",
     "next",
@@ -72,6 +72,7 @@ const CAL_ALLOWED_FLAGS = [
     "--expected-version",
     "--reason",
     "--scope", "--occurrence", "--response", "--comment", "--reminder", "--visibility", "--transparency", "--key",
+    "--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone",
 ];
 const CAL_VALUE_FLAGS = [
     "--home",
@@ -96,6 +97,7 @@ const CAL_VALUE_FLAGS = [
     "--expected-version",
     "--reason",
     "--scope", "--occurrence", "--response", "--comment", "--reminder", "--visibility", "--transparency", "--key",
+    "--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone",
 ];
 export function parseCalArgs(args) {
     const values = parseNamedArgs(args, { allowedFlags: CAL_ALLOWED_FLAGS, valueFlags: CAL_VALUE_FLAGS });
@@ -109,13 +111,13 @@ export function parseCalArgs(args) {
     const limit = optionalPositiveInteger(values.flags.get("--limit"), "--limit");
     const offset = readCalOffset(values);
     const command = buildCalCommand(values, action, subject, query, title, startsAt, endsAt, offset, limit);
-    return { ...command, ...readCalEventScope(action, values) };
+    return { ...command, ...readCalEventScope(action, values), ...readViewSettingsPatch(action, values) };
 }
 function readCalAction(values) {
     const first = values.positionals[0];
     const action = (first === undefined ? "today" : first);
     if (!CAL_ACTIONS.has(action)) {
-        throw new Error(`Unknown cal command: ${first}. Try today, week, conflicts, calendar-change, next, find, calendars, add-ical, create, duplicate, batch, undo, share, detach, sync, sync-status, or delete.`);
+        throw new Error(`Unknown cal command: ${first}. Try today, week, conflicts, calendar-change, view-settings, view-settings-change, next, find, calendars, add-ical, create, duplicate, batch, undo, share, detach, sync, sync-status, or delete.`);
     }
     return { action, rest: values.positionals.slice(first === undefined ? 0 : 1) };
 }
@@ -321,4 +323,51 @@ function readReminders(raw) {
             throw new Error("A reminder method is popup or email.");
         return { minutes, ...(method ? { method } : {}) };
     });
+}
+const VIEW_FLAG_KEYS = ["--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone"];
+/**
+ * BLI-21423 `view-settings-change`: the flags become the same partial patch the
+ * door takes. Types are read here; the door owns the ranges and the zone list.
+ */
+function readViewSettingsPatch(action, values) {
+    if (action !== "view-settings-change") {
+        for (const flag of VIEW_FLAG_KEYS) {
+            if (values.flags.has(flag))
+                throw new Error(`cal ${action} does not take ${flag}; it belongs to cal view-settings-change.`);
+        }
+        return {};
+    }
+    const patch = {};
+    const view = optionalNonEmpty(values.flags.get("--view"));
+    if (view !== undefined)
+        patch.default_view = view;
+    const days = optionalNonEmpty(values.flags.get("--days"));
+    if (days !== undefined) {
+        if (!/^\d+$/.test(days))
+            throw new Error("--days takes a whole number from 2 to 9.");
+        patch.day_count = Number(days);
+    }
+    const weekStart = optionalNonEmpty(values.flags.get("--week-start"));
+    if (weekStart !== undefined)
+        patch.week_start = weekStart;
+    const hide = optionalNonEmpty(values.flags.get("--hide-weekends"));
+    if (hide !== undefined) {
+        if (hide !== "on" && hide !== "off")
+            throw new Error("--hide-weekends takes on or off.");
+        patch.hide_weekends = hide === "on";
+    }
+    const density = optionalNonEmpty(values.flags.get("--density"));
+    if (density !== undefined)
+        patch.density = density;
+    const zones = values.flagValues.get("--zone") ?? [];
+    if (zones.length) {
+        if (zones.includes("none")) {
+            if (zones.length > 1)
+                throw new Error("--zone none stands alone: it clears the extra zones.");
+            patch.extra_zones = [];
+        }
+        else
+            patch.extra_zones = zones;
+    }
+    return Object.keys(patch).length ? { viewSettings: patch } : {};
 }

package/dist/commands/local-args-tower-manager.js

@@ -4,27 +4,33 @@
  *   cockpit manager clients
  *   cockpit manager client <client>
  *   cockpit manager home <client>
- *   cockpit manager summary <client> --version <v>|none [--health on_track|at_risk|blocked] [--headline <t>] [--bullet "YYYY-MM-DD: t"|"t"]... [--next <t>|none] [--blocker <t>|none]
+ *   cockpit manager summary <client> --version <v>|none [--health on_track|at_risk|blocked] [--headline <t>] [--bullet 'YYYY-MM-DD: t'|'t']... [--next <t>|none] [--blocker <t>|none]
  *   cockpit manager run <run-id>
  *   cockpit manager list <client> [--timeline] [--needs-review] [--status open|done|dropped|closed|all] [--owner <name> | --no-owner] [--overdue] [--kind <kind>] [--search <text>] [--archived] [--review dismissed|all]
  *   cockpit manager queue <client>
  *   cockpit manager show <id> [--timeline]
- *   cockpit manager add <client> --title <t> [--owners "A, B"] [--due YYYY-MM-DD] [--meeting <timeline-id>] [--detail <text>] [--source-url <url>] [--source-note <text>] [--request-id <uuid>]
+ *   cockpit manager add <client> --title <t> [--owners 'A, B'] [--due YYYY-MM-DD] [--meeting <timeline-id>] [--detail <text>] [--source-url <url>] [--source-note <text>] [--request-id <uuid>]
  *   cockpit manager add <client> --timeline --kind <kind> --title <t> [--date YYYY-MM-DD] [--owner <one name>] [--detail <text>] [--source-url <url>] [--source-note <text>] [--request-id <uuid>]
- *   cockpit manager edit <id> --version <v> [--timeline] [--title] [--detail] [--due <date>|none] [--owners "A, B"|none]
+ *   cockpit manager edit <id> --version <v> [--timeline] [--title] [--detail] [--due <date>|none] [--owners 'A, B'|none]
  *                            (timeline: --kind, --date <date>|none, --owner <one name>|none)
- *   cockpit manager done|reopen <action> --version <v>
+ *   cockpit manager done|drop|reopen <action> --version <v>
  *   cockpit manager link <action> --version <v> --meeting <timeline-id> | --none
  *   cockpit manager approve <id> --version <v> [--timeline] [--restore]   (--restore brings a dismissed item back)
  *   cockpit manager dismiss|archive|unarchive <id> --version <v> [--timeline]
  *   cockpit manager proposal <id> <proposal-id> accept|dismiss|add-new --version <v> [--timeline]
  *
+ * Free text goes in a JSON file or on stdin with `--fields-file <path>|-` on add, edit and summary (no shell quoting at all,
+ * `manager-fields-file.ts`); on a flag it goes in SINGLE quotes (the shell leaves `$` alone) and the help says how to write
+ * an apostrophe. The parser is synchronous and a file is not: `--fields-file` parses to a command that carries `fieldsFile`
+ * and `rawArgs`, and `runManager` reads the file and parses the same args again with its text (`options.fieldsText`).
  * Every verb is one `/api/manager` door on this machine's device token. A bare `cockpit manager`,
  * `help` and `--help` are the help, never a list and never another command.
  */
-import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+import { optionalNonEmpty, optionalUrl, parseNamedArgs, rejectSecretLikeValue } from "./local-arg-values.js";
+import { mergeFieldsFile } from "./manager-fields-file.js";
+import { runIdRefusal } from "./manager-hints.js";
 export const MANAGER_VERBS = [
-    "clients", "client", "home", "summary", "run", "list", "queue", "show", "add", "edit", "done", "reopen", "link",
+    "clients", "client", "home", "summary", "run", "list", "queue", "show", "add", "edit", "done", "drop", "reopen", "link",
     "approve", "dismiss", "proposal", "archive", "unarchive",
 ];
 export const MANAGER_ACTION_STATUSES = ["open", "done", "dropped", "closed", "all"];
@@ -38,14 +44,16 @@ const ONE_VERB = `manager takes one verb: ${MANAGER_VERBS.join(", ")}. Example:
 const OWN_FLAGS = [
     "--timeline", "--needs-review", "--status", "--owner", "--owners", "--no-owner", "--kind", "--search", "--archived", "--review",
     "--title", "--detail", "--due", "--date", "--meeting", "--none", "--version", "--request-id", "--restore", "--overdue", "--source-url", "--source-note",
-    "--health", "--headline", "--bullet", "--next", "--blocker",
+    "--health", "--headline", "--bullet", "--next", "--blocker", "--fields-file",
 ];
 const COMMON_FLAGS = ["--home", "--dashboard-url", "--json", "--help"];
 const VALUE_FLAGS = [
     "--status", "--owner", "--owners", "--kind", "--search", "--review", "--title", "--detail", "--due", "--date", "--meeting",
     "--version", "--request-id", "--source-url", "--source-note", "--home", "--dashboard-url",
-    "--health", "--headline", "--bullet", "--next", "--blocker",
+    "--health", "--headline", "--bullet", "--next", "--blocker", "--fields-file",
 ];
+/** The flags whose value is a person's own words (not an id, a version or a choice). */
+const TEXT_FLAGS = ["--title", "--detail", "--headline", "--bullet", "--next", "--blocker", "--owners", "--owner", "--source-note", "--source-url"];
 /** `summary --bullet` is given once per bullet: the one value flag that may repeat. */
 const REPEATABLE_FLAGS = new Set(["--bullet"]);
 /** Which flags each verb owns, so a flag on the wrong verb is refused by name rather than ignored. */
@@ -53,14 +61,15 @@ export const FLAGS_BY_VERB = {
     clients: [],
     client: [],
     home: [],
-    summary: ["--version", "--health", "--headline", "--bullet", "--next", "--blocker"],
+    summary: ["--version", "--health", "--headline", "--bullet", "--next", "--blocker", "--fields-file"],
     run: [],
     list: ["--timeline", "--needs-review", "--status", "--owner", "--no-owner", "--overdue", "--kind", "--search", "--archived", "--review"],
     queue: [],
     show: ["--timeline"],
-    add: ["--timeline", "--title", "--detail", "--owners", "--owner", "--due", "--meeting", "--kind", "--date", "--source-url", "--source-note", "--request-id"],
-    edit: ["--timeline", "--version", "--title", "--detail", "--owners", "--owner", "--due", "--kind", "--date"],
+    add: ["--timeline", "--title", "--detail", "--owners", "--owner", "--due", "--meeting", "--kind", "--date", "--source-url", "--source-note", "--request-id", "--fields-file"],
+    edit: ["--timeline", "--version", "--title", "--detail", "--owners", "--owner", "--due", "--kind", "--date", "--fields-file"],
     done: ["--version"],
+    drop: ["--version"],
     reopen: ["--version"],
     link: ["--version", "--meeting", "--none"],
     approve: ["--timeline", "--version", "--restore"],
@@ -82,6 +91,7 @@ const POSITIONALS = {
     add: ["client"],
     edit: ["id"],
     done: ["action id"],
+    drop: ["action id"],
     reopen: ["action id"],
     link: ["action id"],
     approve: ["id"],
@@ -103,9 +113,13 @@ function refuseRepeatedFlags(args) {
         }
     }
 }
-export function parseManagerArgs(args) {
+export function parseManagerArgs(args, options = {}) {
     refuseRepeatedFlags(args);
     const values = parseNamedArgs(args, { allowedFlags: [...OWN_FLAGS, ...COMMON_FLAGS], valueFlags: VALUE_FLAGS });
+    // Free text is the one place a key could be pasted by mistake: the wider secret rulebook runs on these flags (and on a fields file's values), no other command's.
+    for (const flag of TEXT_FLAGS)
+        for (const value of values.flagValues.get(flag) ?? [])
+            rejectSecretLikeValue(value, flag);
     const base = {
         kind: "manager",
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
@@ -136,9 +150,9 @@ export function parseManagerArgs(args) {
     if (CLIENT_VERBS.has(verb))
         shape.client = rest[0];
     else if (verb === "run")
-        shape.runId = readId(rest[0], "A run");
+        shape.runId = readRunId(rest[0]);
     else if (verb !== "clients")
-        shape.id = readId(rest[0], verb === "done" || verb === "reopen" || verb === "link" ? "An action" : "An item");
+        shape.id = readId(rest[0], verb === "done" || verb === "drop" || verb === "reopen" || verb === "link" ? "An action" : "An item");
     if (verb === "proposal") {
         shape.proposalId = rest[1];
         shape.decision = readDecision(rest[2]);
@@ -146,8 +160,16 @@ export function parseManagerArgs(args) {
     const needsVersion = !["clients", "client", "home", "summary", "run", "list", "queue", "show", "add"].includes(verb);
     if (needsVersion)
         shape.version = readVersion(flag("--version"), verb);
+    let fileBullets;
+    const fieldsFile = flag("--fields-file");
+    if (fieldsFile !== undefined && (verb === "add" || verb === "edit" || verb === "summary")) {
+        // Not read yet: `runManager` reads the file (or stdin) and parses these same args again with its text.
+        if (options.fieldsText === undefined)
+            return { ...shape, fieldsFile, rawArgs: args };
+        fileBullets = mergeFieldsFile(values, verb, options.fieldsText).bullets;
+    }
     if (verb === "summary")
-        readSummaryFields(values, shape);
+        readSummaryFields(values, shape, fileBullets);
     if (verb === "list")
         readListFilters(values, shape);
     if (verb === "add")
@@ -160,6 +182,12 @@ export function parseManagerArgs(args) {
         shape.restore = true;
     return shape;
 }
+/** A run's receipt id: a uuid. Anything else is refused with where run ids really come from (a read's workflow id, `sched_wf_…`, is named for what it is). */
+function readRunId(value) {
+    if (!ID.test(value))
+        throw new Error(runIdRefusal(value));
+    return value;
+}
 function readId(value, what) {
     if (!ID.test(value))
         throw new Error(`${what} id looks like 8f14e45f-ceea-467a-9575-1d3a4e7b2c10 (\`cockpit manager list <client>\` prints them).`);
@@ -253,13 +281,24 @@ function refuseWrongItemFlags(values, shape) {
     }
     else {
         if (given("--owner"))
-            throw new Error("An action has several owners: use --owners \"A, B\" (or --owners none). --owner is for a timeline item.");
+            throw new Error("An action has several owners: use --owners 'A, B' (or --owners none). --owner is for a timeline item.");
         const item = ["--kind", "--date"].find(given);
         if (item)
             throw new Error(`${item} belongs to a timeline item. Add --timeline, or use --due for an action's date.`);
     }
 }
+/** A day written with a month name at the start of a bullet: "Oct 3:", "Sat, Oct 3rd, 2026:", "3 October:". */
+const MONTH = "(?:jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|june?|july?|aug(?:ust)?|sep(?:t(?:ember)?)?|oct(?:ober)?|nov(?:ember)?|dec(?:ember)?)\\.?";
+const MONTH_NAME_DAY = new RegExp(`^((?:(?:mon|tue|wed|thu|fri|sat|sun)[a-z]*\\.?,?\\s+)?(?:${MONTH}\\s+\\d{1,2}(?:st|nd|rd|th)?|\\d{1,2}(?:st|nd|rd|th)?\\s+${MONTH})(?:,?\\s+\\d{4})?)\\s*:`, "i");
 const isNone = (value) => value.trim().toLowerCase() === "none";
+/**
+ * Nothing a person can read: empty, whitespace, or only invisible characters, the same set the server's "Where we are"
+ * blank test reads as invisible (`summary-answer.ts` INVISIBLE: default-ignorable code points, format characters,
+ * combining marks such as U+FE0F and U+034F, the Hangul fillers and the blank braille U+2800), plus control characters.
+ * `trim()` alone leaves U+FE0F and U+200B behind, so free text that looks empty used to be sent (and, as --next, cleared
+ * the field while the terminal said "Saved").
+ */
+const isBlank = (value) => /^[\s\p{Z}\p{Cc}\p{Default_Ignorable_Code_Point}\p{Cf}\p{M}\u115F\u1160\u3164\uFFA0\u2800]*$/u.test(value);
 /** `--owners "A, B"` replaces the whole list; `none` is the only way to clear it; a list of blanks is neither. */
 function readOwnersList(raw) {
     if (isNone(raw))
@@ -282,7 +321,11 @@ function readOneOwner(raw) {
 }
 function readAddFields(values, shape) {
     refuseWrongItemFlags(values, shape);
-    const title = optionalNonEmpty(values.flags.get("--title"));
+    const raw = values.flags.get("--title");
+    // A title of only invisible characters (U+200B, U+FE0F, U+3164 …) shows nothing: refused as blank, like edit's.
+    if (raw !== undefined && raw.trim() !== "" && isBlank(raw))
+        throw new Error("--title cannot be blank.");
+    const title = optionalNonEmpty(raw);
     if (!title)
         throw new Error("`cockpit manager add` needs --title <text>.");
     shape.title = title;
@@ -338,7 +381,7 @@ function readEditFields(values, shape) {
     let changes = 0;
     const title = values.flags.get("--title");
     if (title !== undefined) {
-        if (title.trim() === "")
+        if (isBlank(title))
             throw new Error("--title cannot be blank.");
         shape.title = title.trim();
         changes += 1;
@@ -397,24 +440,69 @@ function readSummaryVersion(raw) {
         throw new Error("--version is the card's summary.updatedAt exactly as `cockpit manager home <client> --json` gives it, like 2026-10-09T17:03:11.123456+00:00, or none.");
     return raw;
 }
-/** `--bullet "2026-10-14: Signed the SOW"` is a dated bullet; without a leading `YYYY-MM-DD: ` it is undated. */
+/**
+ * The card's text limits, in characters (code points), as the help and the server's `TOWER_MANAGER_SUMMARY_LIMITS` say
+ * (`manager-cli-limits.test.ts` in the dashboard fails when they differ). Checked here so a long text is refused by this
+ * sentence, not by the server's raw schema message ("String must contain at most 4000 character(s)") that a text over 4,000 reaches first.
+ */
+export const SUMMARY_TEXT_LIMITS = { headline: 140, bullet: 160, next: 200, blocker: 200 };
+function refuseTooLong(flag, text, max) {
+    const length = [...text].length;
+    if (length > max)
+        throw new Error(`${flag} is ${length.toLocaleString("en-US")} characters; at most ${max}. Shorten it.`);
+}
+/** `--bullet '2026-10-14: Signed the SOW'` is a dated bullet; without a leading `YYYY-MM-DD: ` it is undated. */
 export function readBullet(raw) {
     // A bullet pasted from a list keeps no "- " or "* " of its own.
     const value = raw.trim().replace(/^[-*•]\s+/u, "");
-    const dated = /^(\d{4}-\d{2}-\d{2}):\s*(.*)$/s.exec(value);
-    const dateLike = dated ? null : /^(\d{1,4}[-/.]\d{1,2}[-/.]\d{1,4})\s*:/.exec(value);
+    const dated = /^(\d{4}-\d{2}-\d{2})\s*:\s*(.*)$/s.exec(value);
+    // A shape of digits split by dashes or slashes was always read as a mistyped day ("26-10-01:", "10/14/2026:",
+    // "2026-10/14:"). A DOT only counts with a 4-digit year: first and then dash/slash or dot ("2026-10.14:",
+    // "2026.10.14:"), or last in a dotted-only shape ("14.10.2026:"). Short ranges ("1-2.5:", "9-10.30:") and
+    // versions ("2.1.0:") are plain text.
+    const dateLike = dated ? null : /^(\d{1,4}[-/]\d{1,2}[-/]\d{1,4}|\d{4}[-/]\d{1,2}\.\d{1,4}|\d{4}\.\d{1,2}\.\d{1,2}|\d{1,2}\.\d{1,2}\.\d{4})\s*:/.exec(value);
     if (dateLike)
         throw new Error(`--bullet "${raw}" starts with ${dateLike[1]}, which is not a YYYY-MM-DD day. Write it like 2026-10-14, or leave the date out for an undated bullet.`);
+    // A day spelled with a month name ("Oct 3: x", "3 October 2026: x") is a date too: saved undated it would lose the day without a word.
+    const worded = dated ? null : MONTH_NAME_DAY.exec(value);
+    if (worded)
+        throw new Error(`--bullet "${raw}" starts with ${worded[1].trim()}, which looks like a date but is not YYYY-MM-DD. Write it like 2026-10-14 to date the bullet, or reword the text so it does not start with a date.`);
     const date = dated ? dated[1] : null;
     const text = (dated ? dated[2] : value).trim();
     if (date !== null && !isCalendarDate(date))
         throw new Error(`--bullet "${raw}" starts with ${date}, which is not a real day. Write the date YYYY-MM-DD, like 2026-10-14, or leave it out for an undated bullet.`);
-    if (text === "")
-        throw new Error("--bullet needs words after its date. Example: --bullet \"2026-10-14: Signed the SOW\".");
+    return checkedBullet(date, text);
+}
+/** A bullet's words are never blank (the same rule for `--bullet` and a fields file's `{date, text}`). */
+function checkedBullet(date, text) {
+    if (isBlank(text)) {
+        throw new Error(date === null
+            ? "--bullet needs some words, and this one is empty. Example: --bullet 'Export still missing' (a day first makes it dated: --bullet '2026-10-14: Signed the SOW')."
+            : "--bullet needs words after its date. Example: --bullet '2026-10-14: Signed the SOW'.");
+    }
     return { date, text };
 }
+/**
+ * A fields file's `{date, text}` bullet. With a date, the date must be a real day and the text is the text. With none (null or
+ * left out), the text is read exactly like a `--bullet` value: a leading "YYYY-MM-DD: " dates it, a day spelled any other way is
+ * refused, never saved undated (the same rule MCP's manager_set_summary applies).
+ */
+function readObjectBullet(bullet) {
+    if (bullet.date === null)
+        return readBullet(bullet.text);
+    if (!isCalendarDate(bullet.date)) {
+        throw new Error(`A bullet's date "${bullet.date}" is not a real day. Write the date YYYY-MM-DD, like 2026-10-14, or null for an undated bullet.`);
+    }
+    return checkedBullet(bullet.date, bullet.text.trim());
+}
+/** --next and --blocker: text, or `none` to clear. A value with nothing readable in it is refused, never sent as a silent clear. */
+function readClearable(flag, raw) {
+    if (isBlank(raw))
+        throw new Error(`${flag} is blank, and a blank would clear it. To clear ${flag} write ${flag} none; otherwise give words.`);
+    return raw.trim();
+}
 /** The card's fields. Counts, lengths and "blocked needs a blocker" are the server's rules, refused there by name. */
-function readSummaryFields(values, shape) {
+function readSummaryFields(values, shape, fileBullets) {
     shape.version = readSummaryVersion(values.flags.get("--version"));
     let changes = 0;
     const health = values.flags.get("--health");
@@ -426,26 +514,38 @@ function readSummaryFields(values, shape) {
     }
     const headline = values.flags.get("--headline");
     if (headline !== undefined) {
-        if (headline.trim() === "")
+        if (isBlank(headline))
             throw new Error("--headline cannot be blank.");
+        refuseTooLong("--headline", headline.trim(), SUMMARY_TEXT_LIMITS.headline);
         shape.headline = headline.trim();
         changes += 1;
     }
     const bullets = values.flagValues.get("--bullet");
-    if (bullets !== undefined && bullets.length > 0) {
+    if (fileBullets !== undefined) {
+        // An empty list is a mistake, not "no change": the server wants 1 to 5 and refuses 0 by name.
+        shape.bullets = fileBullets.map((bullet) => (typeof bullet === "string" ? readBullet(bullet) : readObjectBullet(bullet)));
+        changes += 1;
+    }
+    else if (bullets !== undefined && bullets.length > 0) {
         shape.bullets = bullets.map(readBullet);
         changes += 1;
     }
+    for (const bullet of shape.bullets ?? [])
+        refuseTooLong("A bullet", bullet.text, SUMMARY_TEXT_LIMITS.bullet);
     const next = values.flags.get("--next");
     if (next !== undefined) {
-        shape.next = isNone(next) ? null : next.trim();
+        shape.next = isNone(next) ? null : readClearable("--next", next);
         changes += 1;
     }
     const blocker = values.flags.get("--blocker");
     if (blocker !== undefined) {
-        shape.blocker = isNone(blocker) ? null : blocker.trim();
+        shape.blocker = isNone(blocker) ? null : readClearable("--blocker", blocker);
         changes += 1;
     }
+    if (shape.next)
+        refuseTooLong("--next", shape.next, SUMMARY_TEXT_LIMITS.next);
+    if (shape.blocker)
+        refuseTooLong("--blocker", shape.blocker, SUMMARY_TEXT_LIMITS.blocker);
     if (changes === 0) {
         throw new Error("`cockpit manager summary` has nothing to change. Give at least one of --health, --headline, --bullet (1 to 5 of them, replacing the list), --next, --blocker. A flag you leave out keeps its value; none clears --next or --blocker.");
     }