@bli-cockpit/cli 0.2.242 → 0.2.243

package/dist/commands/local-help-docs-recovery.js

@@ -0,0 +1,10 @@
+/**
+ * The `cockpit docs trash|restore|versions` lines of the docs `--help` (BLI-21413), split from
+ * `local-help-commands-tower.ts` to keep that file under the readability ratchet.
+ */
+export const DOCS_RECOVERY_HELP = [
+    "trash [--cursor <c>] [--limit <n>] — the deleted pages YOU may restore (the ones you wrote; a super_admin sees all), newest deletion first, 50 at a time. A reader of someone else's deleted page is shown nothing. If more follow, the answer carries next_cursor: pass it as --cursor. --json shape: { documents: [{ id, title, slug, visibility, deleted_at }], next_cursor, complete }.",
+    "restore <id> [--request-id <uuid>] — takes a page out of the trash (BLI-21413). The id is the one `docs trash` printed. The page keeps its id; if a live page now holds its slug it comes back at the next free slug-N and the answer says so (slug_changed, old_slug, new_slug). Author or super_admin only: anyone else gets not_restore_manager; a live page is not_in_trash. --json shape: { ok, document_id, slug, slug_changed, old_slug, new_slug, mutation }.",
+    "versions <id|slug> [--before <n>] [--limit <n>] — the page's saved versions, newest first, METADATA ONLY (id, number, who, when, origin), 50 at a time (--limit max 200), with the exact total and next_before. `versions <id|slug> --version <version-id>` prints that ONE version's body. --json shape: { versions, next_before, total, permission }.",
+    "restore <id|slug> --version <version-id> [--expected-revision <n>] [--request-id <uuid>] — makes that version the page's current text through the ordinary atomic save (what was there is kept as a version) and records a version_restored event. A stale --expected-revision writes nothing and answers revision_conflict (--json: mutation.current); a reader gets not_page_editor. --json shape: { document, mutation }.",
+];

package/dist/commands/local-help-docs-refs.js

@@ -0,0 +1,11 @@
+/**
+ * The `cockpit docs templates|create --template|refs|review|maintenance` lines of the docs `--help` (BLI-21849), split from
+ * `local-help-commands-tower.ts` to keep that file under the readability ratchet.
+ */
+export const DOCS_REFS_HELP = [
+    "templates — the curated page templates: the pages directly under the top-level page whose address is `templates`, that you can read. With no such page it says how to make one. --json shape: { ok, templates_page_id, templates: [{ id, title, slug, revision, updated_at, body_chars }], coverage: { returned, coverage: complete|capped }, hint }.",
+    "create --template <id|slug> --title <title> [--parent <id>] [--visibility org|private] — makes a new page whose body is a copy of that template's CURRENT text (files stay the template's), and records the template and its revision on the new page. A body is not accepted beside a template (template_and_body); a page that is not one of the templates is template_not_found_or_unreadable. If the page was made but the template link could not be written the answer says provenance_recorded: false. --json shape: { ok, document, template: { id, revision }, provenance_recorded }.",
+    "refs <id|slug> — links from and to a page, derived from saved link targets (/docs/<id>, /tickets/<ID>, /meeting-notes/<id>; a slug link is not indexed, an id link survives a rename). \"Linked from\" lists only pages you can read now (another person's private page never appears; there is no hidden count). A ticket or note you cannot read prints as \"Not available to you\" with no title. A link grants nothing. --json shape: { ok, document_id, backlinks: [{ id, title, slug, updated_at, href }], outgoing: [{ kind, key, title, href } | { kind, key, state: \"unavailable\" }], coverage: { backlinks: { returned, coverage }, outgoing: { listed, returned, unavailable, coverage } } }.",
+    "review <id|slug> [--owner <email|me|none>] [--every <days>|--no-schedule] [--reviewed] — a page's owner and review schedule; with a flag it changes them (page editors only: stewardship_write_refused otherwise). --owner takes a team member's exact email, me or none (owner_not_member for anyone else); --every is 1 to 730 days (invalid_review_schedule); --reviewed stamps the time and you as the reviewer from Tower's own clock, never a date you give. State is no_schedule, ok or review_due (computed when read; nothing is approved for you). --json shape: { ok, stewardship: { document_id, recorded, owner, review_every_days, review_due_at, last_reviewed_at, last_reviewed_by, created_from_template_id, created_from_template_revision, state } }.",
+    "maintenance [--mine] [--state review_due|unowned|all] — pages that need a person: due for review, with no owner (default all), or with --mine everything you own. Reads on your own access; coverage says complete or capped. --json shape: { ok, state, items: [{ id, title, slug, owner, review_every_days, review_due_at, last_reviewed_at, state, reasons }], coverage: { scanned, returned, coverage } }.",
+];

package/dist/commands/local-help-docs-sync.js

@@ -0,0 +1,9 @@
+/**
+ * The `cockpit docs sync-status <page>` detail, `sync-resolve` and `manifest` lines of the docs `--help` (BLI-21875), split
+ * from `local-help-commands-tower.ts` to keep that file under the readability ratchet.
+ */
+export const DOCS_SYNC_HELP = [
+    "sync-status <id|slug> — one linked page's Notion sync, from what the last push and pull passes RECORDED (Tower never asks Notion from a request): the state sentence, the newest push and pull receipt each with its reason label and age, what could not be carried (\"1 file kept only as a link\", blocks missing, content Tower cannot write back), the conflicts (versions a sync kept, open or resolved, newest 50 with a total) and the decisions made. A page Notion no longer shares reads \"Notion no longer shares this page\", not synced. --json adds { detail: { can_edit, state_sentence, last_receipt: { push, pull }, losses, conflicts: { total, open, shown, items: [{ version_id, version_number, origin, status, sentence, resolution }] }, resolutions, resolve_note, incomplete, as_of } }.",
+    "sync-resolve <id|slug> --version <id> --keep-current|--use-kept [--expected-revision <n>] [--request-id <uuid>] — decide one conflict; you choose, Tower never picks. --keep-current records the decision and writes no text. --use-kept makes the kept version the page's current text through a version restore (a new history row, revision +1) over your --expected-revision (the page revision you read; stale = revision_conflict, nothing is written or recorded), then records the decision. One decision per kept version: a repeat answers already_resolved with the stored one and writes nothing. Refusals: resolution_write_refused (not a page editor), not_a_sync_conflict (an ordinary version), version_not_found, invalid_resolution. The next push sends the restored text to Notion through the same checks as any push; a page Notion holds content on that Tower cannot write stays protected. --json shape: { ok, outcome: resolved|already_resolved, document_id, resolution: { version_id, choice, resolved_by, resolved_at, resulting_revision }, revision, body_written, note }.",
+    "manifest [--under <id|slug>] [--cursor <c>] [--all] [--out <file>] — the library export manifest for a Notion cutover review: readiness facts only, no cutover verdict and no Notion turn-off. Per page you can read (another person's private page never appears): id, slug, title, parent, visibility, author, revision, body_sha256, body_chars, Notion link, editor ids (\"not_visible\" when you may not see them), files (id, name, type, byte size, state; no URLs, no bytes) and no body. 2,000 pages per call with next_cursor; --all walks every call (at most 100) and reports requested, returned, unique and coverage exhausted|capped|failed_partial (a failed call keeps the pages already read and prints the cursor to resume). --out writes the full JSON to a new file (never overwrites). --json shape: { ok, entries, requested, returned, unique, coverage: { status, calls, reason? }, coverage_text, failures: [{ stage, reason, count, document_ids }], next_cursor, under, generated_at }.",
+];

package/dist/commands/local-help-inbox.js

@@ -0,0 +1,9 @@
+/** `cockpit ticket inbox` help (BLI-21703, P9), one line a verb, joined into the `issue` help. */
+export const INBOX_HELP_LINES = [
+    "inbox [--unread] [--kind assigned|mentioned|commented] [--before <cursor>] [--limit n] — YOUR inbox, newest first: tickets assigned to you, comments that mention you, and comments on tickets you follow. 50 items by default, at most 100; continue with --before <next_cursor>. --json shape: { items: [{ id, kind, issue_id, identifier, title, state, actor_id, created_at, read_at }], next_cursor, has_more, coverage: { returned, dropped }, counts: { unread, capped } }. An item whose ticket you cannot read is left out and counted in coverage.dropped. Unread counts stop at 500 (capped).",
+    "read <notification-id>... | --all — mark your own items read (1 to 200 ids, or every unread item). Another member's id changes nothing. Read state is yours alone.",
+    "unread <notification-id>... — mark your own items unread again.",
+    "subscribe <id> — follow a ticket (reason manual). You also follow a ticket you create, get assigned, are mentioned on or comment on.",
+    "unsubscribe <id> — stop following. An explicit unsubscribe beats auto-follow: you get no more commented items, but a direct assignment or @mention still arrives.",
+    "Mention someone in a comment with [@Name](mention:person:<uuid>). Refusals keep Tower's label: inbox_ids_invalid, inbox_too_many_ids, invalid_cursor, invalid_filter, issue_not_found_or_unreadable.",
+];

package/dist/commands/local-help-project.js

@@ -0,0 +1,21 @@
+/** `cockpit project` help (BLI-21659), kept beside the parser in project-args.ts. */
+export const PROJECT_HELP = [
+    "project",
+    [
+        "Usage: cockpit project [list] [--archived] [--limit <n>] [--cursor <c>] [--json]",
+        "       cockpit project show <id|name> [--json]",
+        '       cockpit project create --name "<name>" [--description <text>|--file <path>] [--color <c>] [--request-id <uuid>] [--json]',
+        "       cockpit project update <id|name> [--name <n>] [--description <text>|none|--file <path>] [--request-id <uuid>] [--expected-updated-at <ts>] [--json]",
+        "       cockpit project archive|restore <id|name> [--request-id <uuid>] [--expected-updated-at <ts>] [--json]",
+        "",
+        "The projects tickets are filed under. Bare `cockpit project` lists them.",
+        "list [--archived] [--limit <n>] [--cursor <c>] — id, active/archived, name. --archived includes archived projects. A page is at most 500; when more exist the output (and --json: next_cursor, has_more, coverage, requested, returned, unique) carries the cursor to pass back as --cursor.",
+        "show <ref> — the project, the first page of its tickets and the filtered ticket-list link. <ref> is an id or an exact name (case-folded, never fuzzy).",
+        "create / update — name 1 to 200 characters; `--description none` clears the description; `--file` reads it from a local file. Update changes only the fields you give.",
+        "archive / restore — soft: tickets keep their project, the Linear mapping is untouched, nothing is deleted. There is no delete verb.",
+        "Every write returns a receipt with delivery tower_only: a project write never reaches Linear and never queues a Linear change. The same --request-id replays the first receipt; with another body it is request_id_reused.",
+        "--expected-updated-at is the updated_at you last read (shown by show and --json); a stale one is revision_conflict with the current project and changes nothing.",
+        "Refusals keep Tower's label: project_name_required, project_name_taken, project_owned_by_linear (a project imported from Linear is named there; archive and restore still work), project_already_archived, project_not_archived, project_not_found_or_unreadable, revision_conflict, request_id_reused, invalid_body.",
+        "--json writes one machine-readable object to stdout; every reason and receipt line stays on stderr.",
+    ],
+];

package/dist/commands/local-help-templates.js

@@ -0,0 +1,9 @@
+/** `cockpit ticket templates` help (BLI-21779, P11), one line a verb, joined into the `issue` help. */
+export const TEMPLATES_HELP_LINES = [
+    "templates [list] [--include-archived] — every ticket template (all members read them), newest definition first by name. --json shape: { templates: [{ id, owner_id, name, description, state, priority, estimate, size, project_id, label_names, version, archived_at, updated_at, mine }], archived_hidden }.",
+    "templates show <id|name> — one template. A name is exact and case-insensitive; two templates with one name are template_ref_ambiguous (use the id). --json shape: { template }. templates versions <id|name> — every version, newest first: each save or change is one append-only row. --json shape: { template, versions }.",
+    "templates save --name \"<n>\" [--description <text|->] [--state <s>] [--priority 0-4] [--size S|M|L] [--project <name|id>] [--label <name>]... [--request-id <uuid>] — saves a template at version 1. A template holds description TEXT and optional presets, never a title, assignee, due date or parent. `--description -` reads the text from stdin. The request id is the template id: the same --request-id with the same fields returns the one template, another definition under it is request_id_reused. You can keep 50 active templates.",
+    "templates update <id|name> [the same flags] [--archive|--restore] [--expected-updated-at <ts>] — only the OWNER (anyone else gets template_owned_by_other); only the fields you give change, `none` clears a preset (--label none clears the labels). Each change makes a new version. A stale --expected-updated-at is revision_conflict with the current template. There is no delete: --archive hides it from apply, --restore brings it back.",
+    "templates apply <id|name> --title \"<t>\" [--description <text|->] [--state <s>] [--priority 0-4] [--size S|M|L] [--project <name|id>] [--label <name>]... [--assignee me|<uuid>] [--parent <id>] [--due YYYY-MM-DD] [--request-id <uuid>] — creates a ticket by COPYING the template's values at that moment: a flag you give wins, `none` clears what the template would have copied, and later template changes never touch the ticket. The title is always yours: without --title the answer is template_title_required and nothing is created. The same --request-id returns the same ticket; with a different title it is request_id_reused. An unknown label is refused before anything is written; if the label write fails afterwards the ticket stays and the answer says labels failed. --json shape: { issue, mutation, template: { id, version }, labels: { status: none|applied|failed, names, reason? } }.",
+    "Template refusals keep Tower's label: template_name_required, template_name_taken, template_not_found_or_unreadable, template_ref_ambiguous, template_owned_by_other, template_archived, template_limit_reached, template_title_required, template_field_invalid (names the field), label_not_found, request_id_reused, revision_conflict.",
+];

package/dist/commands/local-help-views.js

@@ -0,0 +1,10 @@
+/** `cockpit ticket views` help (BLI-21686, P8), one line a verb, joined into the `issue` help. */
+export const VIEWS_HELP_LINES = [
+    "views [list] — My Work (built in, first), your favorites, your own views and the shared ones. --json shape: { my_work, favorites, mine, shared, favorites_hidden }.",
+    "views show <id|name> — a view and the first 50 tickets it means FOR YOU (`me` is whoever runs it), in the view's own sort, with the web link. A name is exact and case-insensitive; two views with one name are view_ref_ambiguous (use the id). `my-work` is the built-in preset. --json shape: { view, issues, next_cursor, coverage, href }.",
+    "views save --name \"<n>\" [--state <s>] [--assignee me|unassigned|<uuid>] [--project <name|id>] [--label <name>] [--q <text>] [--layout list|board] [--sort updated_at|created_at] [--dir asc|desc] [--shared] [--request-id <uuid>] — saves a QUERY, never rows: `--assignee me` is stored as \"me\" and resolves to each reader. Private unless --shared (then every signed-in member can open it; they still see only tickets they may read). The request id is the view id: the same --request-id with the same definition returns the one view, with another definition it is request_id_reused. You can keep 50 active views.",
+    "views update <id|name> [the same flags] [--private] [--archive|--restore] [--expected-updated-at <ts>] — only the owner (anyone else gets view_owned_by_other); only the fields you give change. A stale --expected-updated-at is revision_conflict with the current view. There is no delete: --archive hides it, --restore brings it back.",
+    "views favorite|unfavorite <id|name> — your own favorites (at most 20); the view and everyone else's favorites are untouched. A favorite you can no longer read is left out of the list and counted as favorites_hidden.",
+    "views settings [--hide <field>]... [--show <field>]... — which row fields YOUR ticket list hides (priority, labels, project, assignee, updated). Per reader: colleagues are not affected. With no flag it prints the current setting.",
+    "Refusals keep Tower's label: view_name_required, view_name_taken, view_not_found_or_unreadable (a private view of someone else looks exactly like a missing one), view_ref_ambiguous, view_owned_by_other, view_filters_invalid (names the key), view_limit_reached, view_favorites_full, view_field_unknown, request_id_reused, revision_conflict.",
+];

package/dist/commands/local-help-work-notify.js

@@ -0,0 +1,6 @@
+/** `cockpit ticket notifications` help (BLI-21736, P10), one line a verb, joined into the `issue` help. */
+export const WORK_NOTIFY_HELP_LINES = [
+    "notifications [--json] — your Slack delivery switch for work-inbox items: slack_enabled, slack_enabled_at, and slack_linked (do you have a Slack account Tower knows; null with a reason when it could not check). Off by default. --json shape: { settings: { slack_enabled, slack_enabled_at, slack_linked, slack_linked_reason } }.",
+    "notifications set --slack on|off — turn the DM on or off for yourself. On: tickets ASSIGNED to you and comments that @mention you are sent to your Slack DM once an item is 5 minutes old (and under 24 hours), unless you read it first (then it is suppressed, reason read_before_delivery). The sweep runs every 15 minutes, so allow about 20 minutes. Only items created after you turn it on are sent. commented items are never sent. DMs only, never a channel.",
+    "notifications receipts [--notification <id>] [--before <cursor>] [--limit n] — your delivery receipts, newest first (20 by default, at most 100). outcome is sent (Slack accepted the post, not that you read it), suppressed (read_before_delivery, issue_unreadable) or failed (slack_identity_missing, dm_open_failed, slack_post_failed, rls_mint_unavailable, ticket_read_failed; a failed item stays in your inbox and is not retried). --json shape: { receipts: [{ id, notification_id, kind, outcome, reason, slack_ts, created_at, issue_id, identifier }], next_cursor, has_more }. Refusal labels: invalid_notification_setting, invalid_cursor, invalid_filter.",
+];

package/dist/commands/local-help.js

@@ -141,11 +141,11 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|install|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--include-originals|--no-originals] [--include-source|--no-source] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
     "  cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
     "  cockpit sources check [--older-than <days>] [--dashboard-url <url>] [--json]",
-    "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>|delete <id|slug>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",
+    "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>|delete <id|slug>|trash|versions <id|slug>|restore <id>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",
     "  cockpit msg [channels|create <name>|dm <email>|read <channel>|send <channel>|thread <id> --channel <channel>|show <message-id>] [--private] [--members a@x,b@y] [--description <text>] [--thread <id>] [--limit <n>] [--before <cursor>] [--dashboard-url <url>] [--json]",
     "  cockpit issue [list|show <BLI-id>|create --title <t>|update <BLI-id>|move <BLI-id> <state>|comment <BLI-id>|history <BLI-id>] [--state <s>] [--assignee me|unassigned|<uuid>] [--project <name|id>] [--limit <n>] [--priority 0-4] [--size S|M|L] [--parent <BLI-id>] [--file <path>|--body-stdin] [--dashboard-url <url>] [--json]",
     "  cockpit mail [accounts|add-imap --address <a>|inbox|read <thread>|search \"<words>\"|send --account <id> --to <a> --subject <s>|draft --account <id> --to <a> --subject <s> [--reply-to <message id>]|attachment <id> --out <path>|sync <account>|detach <account>] [--account <id>] [--limit <n>] [--unread] [--label <l>] [--file <path>] [--attach <path>]... [--dashboard-url <url>] [--json]",
-    "  cockpit cal [event <id> [--occurrence-start <iso>]|export <id> [--occurrence-start <iso>]|today|week|conflicts|calendar-change <id> --color <hex-or-provider>|view-settings|view-settings-change|next|find \"<words>\"|calendars|add-ical|create --calendar <id> --title <t> --at <iso> --until <iso>|duplicate <event id> [--keep-invitees]|batch|undo [<change id>]|share <id> --org-visible|--private|sync <id> [--full]|detach <id>] [--tz <zone>] [--offset <n>] [--hours <n>] [--from <d> --to <d>] [--calendar <id>] [--limit <n>] [--all] [--dashboard-url <url>] [--json]",
+    "  cockpit cal [event <id> [--occurrence-start <iso>]|export <id> [--occurrence-start <iso>]|today|week|conflicts|calendar-change <id> --color <hex-or-provider>|view-settings|view-settings-change|people <label>|availability --with <label|email> --from <d> --to <d>|overlays [--pin <label|email>|--remove <email>]|next|find \"<words>\"|calendars|add-ical|create --calendar <id> --title <t> --at <iso> --until <iso>|duplicate <event id> [--keep-invitees]|batch|undo [<change id>]|share <id> --org-visible|--private|sync <id> [--full]|detach <id>] [--tz <zone>] [--offset <n>] [--hours <n>] [--from <d> --to <d>] [--calendar <id>] [--limit <n>] [--all] [--dashboard-url <url>] [--json]",
     "  cockpit project [list] [--archived] [--dashboard-url <url>] [--json]",
     "  cockpit github <pr|merge|retitle|rerun> <owner/repo> <n> [--claim <state>] [--method squash|merge|rebase] [--title \"<text>\"] [--run <id>] [--confirm <code>] [--dashboard-url <url>] [--json]",
     `  cockpit search "<words>" [--kind <category,...>] [--limit <n>] [--dashboard-url <url>] [--json]`,

package/dist/commands/mcp-stdio-probe.js

@@ -260,6 +260,7 @@ function defaultSpawn(command, args, options) {
     return spawn(command, args, {
         env: options.env,
         stdio: ["pipe", "pipe", "ignore"],
+        windowsHide: true,
     });
 }
 function defaultRealpath(value) {

package/dist/commands/msg-activity.js

@@ -0,0 +1,134 @@
+/**
+ * The activity verbs of `cockpit msg` (BLI-21598): `activity`, `follow`, `unfollow` and `react`. Same doors
+ * the browser calls (`/api/msg/activity`, `/messages/<id>/follow`, `/messages/<id>/reactions`); `--json`
+ * prints the door's body unchanged so ids, rows, coverage and reasons match HTTP. Split out of `msg.ts` for the file-size ratchet.
+ */
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { runMsgNotify } from "./msg-notify.js";
+const TAG = "[msg cli]";
+const READ_DEADLINE_MS = 30_000;
+const WRITE_DEADLINE_MS = 30_000;
+/** One line for a body: the first line of text, trimmed to a readable length. */
+function preview(content) {
+    const line = (content ?? "").split("\n")[0] ?? "";
+    return line.length > 140 ? `${line.slice(0, 137)}...` : line;
+}
+function countsLine(counts) {
+    if (!counts)
+        return "Unread counts are unavailable right now.";
+    const part = (label, count) => `${label} ${count.unread}${count.capped ? "+" : ""}`;
+    return `Unread: ${part("mentions", counts.mention)}, ${part("threads", counts.reply)}.`;
+}
+/** `cockpit msg activity [--mentions|--threads] [--unread] [--before <cursor>] [--limit <n>] [--mark-read]` */
+export async function runMsgActivity(command, door) {
+    const query = new URLSearchParams();
+    if (command.activityKind)
+        query.set("kind", command.activityKind);
+    if (command.unreadOnly)
+        query.set("unread", "1");
+    if (command.before)
+        query.set("before", command.before);
+    if (command.limit)
+        query.set("limit", String(command.limit));
+    const answer = await askAgentDoor(door, {
+        path: `/api/msg/activity${query.size > 0 ? `?${query.toString()}` : ""}`,
+        method: "GET",
+        label: "msg activity",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    const items = body.items ?? [];
+    writeLine(door.io.stderr, `${TAG} activity ${JSON.stringify({ returned: items.length, dropped: body.coverage?.dropped ?? 0, has_more: body.hasMore === true })}`);
+    // `--mark-read` is the person asking to be told these now: it marks exactly the unread items just printed.
+    let marked = null;
+    const unreadIds = items.filter((item) => item.read_at === null).map((item) => item.message_id);
+    if (command.markRead && unreadIds.length > 0) {
+        const read = await askAgentDoor(door, {
+            path: "/api/msg/activity/read",
+            method: "POST",
+            label: "msg activity read",
+            timeoutMs: WRITE_DEADLINE_MS,
+            body: { message_ids: unreadIds },
+        });
+        if (!read.ok)
+            return failAgentDoor(door, TAG, read.reason, `${read.detail} The items above were NOT marked read.`);
+        marked = read.body;
+    }
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...body, ...(command.markRead ? { markRead: marked ?? { requested: 0, marked: 0 } } : {}) });
+    writeLine(door.io.stdout, countsLine(body.counts));
+    if (items.length === 0) {
+        writeLine(door.io.stdout, command.unreadOnly ? "Nothing unread." : "No activity yet.");
+    }
+    for (const item of items) {
+        const channel = body.channels?.[item.channel_id];
+        const where = channel ? (channel.is_dm ? "a direct message" : `#${channel.name ?? "unnamed"}`) : item.channel_id;
+        const who = (item.message.user_id ? body.displayNameById?.[item.message.user_id] : null) ?? item.message.agent_label ?? item.message.slack_author_label ?? "Someone";
+        writeLine(door.io.stdout, `${item.message_id}  ${item.created_at}  ${item.kind}${item.read_at === null ? " (unread)" : ""}  ${where}  ${who}  ${preview(item.message.content)}`);
+    }
+    if ((body.coverage?.dropped ?? 0) > 0)
+        writeLine(door.io.stdout, `${body.coverage?.dropped} item(s) no longer readable were left out.`);
+    if (body.nextCursor)
+        writeLine(door.io.stdout, `More: --before ${body.nextCursor}`);
+    if (marked)
+        writeLine(door.io.stdout, `Marked ${marked.marked} read.`);
+    return 0;
+}
+/** `cockpit msg follow|unfollow <message-id>` — the id is the thread's top-level message. */
+export async function runMsgFollow(command, door) {
+    const following = command.action === "follow";
+    const answer = await askAgentDoor(door, {
+        path: `/api/msg/messages/${encodeURIComponent(command.targetId ?? "")}/follow`,
+        method: following ? "PUT" : "DELETE",
+        label: `msg ${command.action}`,
+        timeoutMs: WRITE_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const follow = answer.body.follow ?? {};
+    writeLine(door.io.stderr, `${TAG} ${command.action} ${JSON.stringify({ message_id: command.targetId, following: follow.following === true, changed: follow.changed === true })}`);
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...answer.body });
+    const state = follow.following ? "Following" : "Not following";
+    writeLine(door.io.stdout, `${state} thread ${command.targetId}${follow.reason ? ` (${follow.reason})` : ""}${follow.changed === false ? ": it was already that way." : "."}`);
+    return 0;
+}
+/** `cockpit msg react <message-id> <emoji> [--remove]` */
+export async function runMsgReact(command, door) {
+    const emoji = command.emoji ?? "";
+    const id = encodeURIComponent(command.targetId ?? "");
+    const answer = command.remove
+        ? await askAgentDoor(door, {
+            path: `/api/msg/messages/${id}/reactions?emoji=${encodeURIComponent(emoji)}`,
+            method: "DELETE",
+            label: "msg react remove",
+            timeoutMs: WRITE_DEADLINE_MS,
+        })
+        : await askAgentDoor(door, {
+            path: `/api/msg/messages/${id}/reactions`,
+            method: "POST",
+            label: "msg react",
+            timeoutMs: WRITE_DEADLINE_MS,
+            body: { emoji },
+        });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    writeLine(door.io.stderr, `${TAG} react ${JSON.stringify({ message_id: command.targetId, removed: command.remove === true })}`);
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, removed: command.remove === true, ...(answer.body ?? {}) });
+    writeLine(door.io.stdout, command.remove ? `Removed ${emoji} from ${command.targetId}.` : `Reacted ${emoji} on ${command.targetId}.`);
+    return 0;
+}
+/** The one entry `runMsg` calls for activity, follow, unfollow, react and notify (BLI-21605; `resolve` turns a channel name into its id). */
+export function runMsgActivityVerb(command, door, resolve) {
+    if (command.action === "notify")
+        return runMsgNotify(command, door, resolve);
+    if (command.action === "activity")
+        return runMsgActivity(command, door);
+    if (command.action === "react")
+        return runMsgReact(command, door);
+    return runMsgFollow(command, door);
+}

package/dist/commands/msg-channel-args.js

@@ -0,0 +1,92 @@
+/**
+ * Arguments of `cockpit msg channel|members|hide|unhide` (BLI-21685): `channel <channel>` shows details, with
+ * `--rename <name> | --describe <text> | --archive | --unarchive` it changes them; `members <channel>` lists, with
+ * `--add <email> | --remove <email>` it changes membership; `hide <channel>` / `unhide <channel>` change only your own
+ * sidebar. Split out of `local-args-tower-msg.ts`.
+ *
+ * `--remove` is a switch for `msg react`, and an email here. `members` is spotted in the raw words and its `--remove` is
+ * renamed before the shared parser sees it (`msgChannelNormalizeArgs`).
+ */
+import { optionalNonEmpty, optionalUrl } from "./local-arg-values.js";
+export const MSG_CHANNEL_ACTIONS = ["channel", "members", "hide", "unhide"];
+export const MSG_CHANNEL_VALUE_FLAGS = ["--rename", "--describe", "--add", "--remove-member"];
+export const MSG_CHANNEL_BOOLEAN_FLAGS = ["--archive", "--unarchive"];
+const MSG_CHANNEL_ONLY_FLAGS = [...MSG_CHANNEL_VALUE_FLAGS, ...MSG_CHANNEL_BOOLEAN_FLAGS];
+export function isMsgChannelAction(action) {
+    return MSG_CHANNEL_ACTIONS.includes(action);
+}
+/** For `msg members ... --remove <email>`: the shared parser sees `--remove-member`, so `msg react --remove` is untouched. */
+export function msgChannelNormalizeArgs(args) {
+    const action = args.find((arg) => !arg.startsWith("--") && (isMsgChannelAction(arg) || ["channels", "read", "send", "react", "thread", "create", "dm", "show"].includes(arg)));
+    if (action !== "members")
+        return args;
+    return args.map((arg) => (arg === "--remove" ? "--remove-member" : arg.startsWith("--remove=") ? `--remove-member=${arg.slice(9)}` : arg));
+}
+/** A flag of these verbs used on another msg verb is named, not ignored. */
+export function rejectMsgChannelFlags(values) {
+    const stray = MSG_CHANNEL_ONLY_FLAGS.find((flag) => values.flags.has(flag) || values.booleans.has(flag));
+    if (stray)
+        throw new Error(`${stray === "--remove-member" ? "--remove" : stray} does not belong here; it is for \`cockpit msg channel\` or \`cockpit msg members\`.`);
+}
+function emailOf(raw, flag) {
+    const email = optionalNonEmpty(raw) ?? "";
+    if (!email.includes("@"))
+        throw new Error(`${flag} takes an email address; "${email}" is not one.`);
+    return email;
+}
+export function parseMsgChannelArgs(action, values, rest) {
+    const has = (flag) => values.flags.has(flag) || values.booleans.has(flag);
+    const stray = ["--thread", "--channel", "--members", "--description", "--from", "--request-id", "--expected-revision", "--name", "--out", "--file", "--mark-read", "--mentions", "--threads", "--unread", "--private", "--before", "--limit", "--level", "--timezone", "--message", "--mute", "--unmute", "--clear", "--off"].find(has);
+    if (stray)
+        throw new Error(`${stray} does not belong to \`cockpit msg ${action}\`.`);
+    if (values.booleans.has("--remove"))
+        throw new Error("--remove belongs to `cockpit msg react`; for members use `cockpit msg members <channel> --remove <email>`.");
+    const channelRef = optionalNonEmpty(rest[0]);
+    if (!channelRef)
+        throw new Error(`msg ${action} needs a channel id or name, e.g. \`cockpit msg ${action} general\`.`);
+    if (rest.length > 1)
+        throw new Error(`msg ${action} takes one channel, not ${rest.length}.`);
+    const rename = values.flags.get("--rename");
+    const describe = values.flags.get("--describe");
+    const archive = values.booleans.has("--archive");
+    const unarchive = values.booleans.has("--unarchive");
+    const add = values.flags.get("--add");
+    const remove = values.flags.get("--remove-member");
+    const base = {
+        kind: "msg",
+        action,
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        isPrivate: false,
+        channelRef,
+        json: values.booleans.has("--json"),
+    };
+    if (action === "channel") {
+        if (add || remove)
+            throw new Error("--add and --remove belong to `cockpit msg members`.");
+        if (archive && unarchive)
+            throw new Error("Pick one of --archive or --unarchive.");
+        const changes = [];
+        if (rename !== undefined)
+            changes.push({ kind: "rename", name: rename.replace(/^#/, "") });
+        if (describe !== undefined)
+            changes.push({ kind: "describe", text: describe });
+        if (archive)
+            changes.push({ kind: "archive" });
+        if (unarchive)
+            changes.push({ kind: "unarchive" });
+        return { ...base, channelChanges: changes };
+    }
+    if (rename !== undefined || describe !== undefined || archive || unarchive) {
+        throw new Error("--rename, --describe, --archive and --unarchive belong to `cockpit msg channel`.");
+    }
+    if (action === "members") {
+        if (add && remove)
+            throw new Error("Pick one of --add or --remove.");
+        const memberChange = add ? { kind: "add", email: emailOf(add, "--add") } : remove ? { kind: "remove", email: emailOf(remove, "--remove") } : undefined;
+        return { ...base, ...(memberChange ? { memberChange } : {}) };
+    }
+    if (add || remove)
+        throw new Error(`--add and --remove belong to \`cockpit msg members\`, not \`msg ${action}\`.`);
+    return base;
+}

package/dist/commands/msg-channel.js

@@ -0,0 +1,125 @@
+/**
+ * `cockpit msg channel|members|hide|unhide` (BLI-21685): a channel's details and its changes, its people, and your own
+ * sidebar. Same doors the browser calls (`/api/msg/channels/<id>`, `.../members`, `.../hidden`); `--json` prints the
+ * door's body unchanged so ids, audience and the manage answer match HTTP. A refusal keeps the door's reason:
+ * channel_manage_refused, channel_name_taken, dm_not_editable, hide_not_public, person_not_found.
+ */
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[msg cli]";
+const DEADLINE_MS = 30_000;
+function audienceLine(details) {
+    if (details.audience === "org")
+        return "Audience: everyone in the org can read it";
+    if (details.audience === "participants")
+        return `Audience: ${details.member_count ?? 0} people in this conversation`;
+    return `Audience: ${details.member_count ?? 0} members`;
+}
+function printDetails(door, details) {
+    const out = door.io.stdout;
+    writeLine(out, `${details.is_dm ? "Direct message" : `#${details.name ?? ""}`} (${details.id})`);
+    writeLine(out, `Kind: ${details.is_dm ? "direct message" : details.is_private ? "private channel" : "public channel"}${details.archived_at ? " (archived)" : ""}`);
+    writeLine(out, `Description: ${details.description ?? "none"}`);
+    writeLine(out, audienceLine(details));
+    if (details.source_workspace)
+        writeLine(out, `Imported from the ${details.source_workspace} Slack workspace (a label; it grants no access)`);
+    writeLine(out, `You can manage it: ${details.can_manage ? "yes" : "no"}`);
+    if (!details.is_dm && !details.is_private)
+        writeLine(out, `Hidden from your sidebar: ${details.hidden ? "yes" : "no"}`);
+}
+async function resolveOrFail(command, door, resolve) {
+    const ref = command.channelRef ?? "";
+    const resolved = await resolve(ref);
+    if (resolved.status === "list_failed")
+        return failAgentDoor(door, TAG, resolved.reason, resolved.detail);
+    if (resolved.status === "not_found") {
+        return failAgentDoor(door, TAG, "channel_not_found_or_unreadable", `That channel does not exist, or you cannot read it: ${ref}`);
+    }
+    return resolved.id;
+}
+async function channelVerb(command, door, id) {
+    const path = `/api/msg/channels/${encodeURIComponent(id)}`;
+    const changes = command.channelChanges ?? [];
+    if (changes.length === 0) {
+        const answer = await askAgentDoor(door, { path, method: "GET", label: "msg channel", timeoutMs: DEADLINE_MS });
+        if (!answer.ok)
+            return failAgentDoor(door, TAG, answer.reason, answer.detail);
+        const details = answer.body.channel;
+        writeLine(door.io.stderr, `${TAG} channel details ${JSON.stringify({ channel_id: id, audience: details.audience, can_manage: details.can_manage })}`);
+        if (door.json)
+            return emitAgentDoor(door, { ok: true, ...answer.body });
+        printDetails(door, details);
+        return 0;
+    }
+    const body = {};
+    for (const change of changes) {
+        if (change.kind === "rename")
+            body["name"] = change.name;
+        if (change.kind === "describe")
+            body["description"] = change.text;
+        if (change.kind === "archive")
+            body["archived"] = true;
+        if (change.kind === "unarchive")
+            body["archived"] = false;
+    }
+    const answer = await askAgentDoor(door, { path, method: "PATCH", label: "msg channel update", timeoutMs: DEADLINE_MS, body });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    writeLine(door.io.stderr, `${TAG} channel updated ${JSON.stringify({ channel_id: id, fields: Object.keys(body) })}`);
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...answer.body });
+    printDetails(door, answer.body.channel);
+    return 0;
+}
+async function membersVerb(command, door, id) {
+    const path = `/api/msg/channels/${encodeURIComponent(id)}/members`;
+    const change = command.memberChange;
+    if (change) {
+        const answer = change.kind === "add"
+            ? await askAgentDoor(door, { path, method: "POST", label: "msg members add", timeoutMs: DEADLINE_MS, body: { email: change.email } })
+            : await askAgentDoor(door, { path: `${path}?email=${encodeURIComponent(change.email)}`, method: "DELETE", label: "msg members remove", timeoutMs: DEADLINE_MS });
+        if (!answer.ok)
+            return failAgentDoor(door, TAG, answer.reason, answer.detail);
+        writeLine(door.io.stderr, `${TAG} members ${change.kind} ${JSON.stringify({ channel_id: id })}`);
+        if (door.json)
+            return emitAgentDoor(door, { ok: true, channel_id: id, change: change.kind, email: change.email });
+        writeLine(door.io.stdout, change.kind === "add" ? `Added ${change.email}.` : `Removed ${change.email}. Their next read of a private channel is refused.`);
+        return 0;
+    }
+    const answer = await askAgentDoor(door, { path, method: "GET", label: "msg members", timeoutMs: DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    const members = body.members ?? [];
+    writeLine(door.io.stderr, `${TAG} members listed ${JSON.stringify({ channel_id: id, count: members.length, audience: body.audience ?? null })}`);
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...body });
+    if (body.audience === "org")
+        writeLine(door.io.stdout, "Everyone in the org can read this channel.");
+    for (const member of members)
+        writeLine(door.io.stdout, `${member.user_id}  ${member.role.padEnd(14)}  ${body.display_names?.[member.user_id] ?? "someone"}`);
+    if (members.length === 0 && body.audience !== "org")
+        writeLine(door.io.stdout, "No members.");
+    return 0;
+}
+async function hideVerb(command, door, id) {
+    const hide = command.action === "hide";
+    const answer = await askAgentDoor(door, { path: `/api/msg/channels/${encodeURIComponent(id)}/hidden`, method: hide ? "PUT" : "DELETE", label: hide ? "msg hide" : "msg unhide", timeoutMs: DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    writeLine(door.io.stderr, `${TAG} ${command.action} ${JSON.stringify({ channel_id: id })}`);
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...answer.body });
+    writeLine(door.io.stdout, hide ? "Hidden from your sidebar. Everyone can still read, search and link to it." : "Shown in your sidebar again.");
+    return 0;
+}
+export async function runMsgChannel(command, door, resolve) {
+    const id = await resolveOrFail(command, door, resolve);
+    if (typeof id === "number")
+        return id;
+    if (command.action === "channel")
+        return channelVerb(command, door, id);
+    if (command.action === "members")
+        return membersVerb(command, door, id);
+    return hideVerb(command, door, id);
+}

package/dist/commands/msg-context-args.js

@@ -0,0 +1,67 @@
+/**
+ * Arguments of `cockpit msg context <message-id> [--add <kind:id>] [--remove <link-id>] [--json]` (BLI-21829).
+ * `--add doc:<id>|ticket:<BLI-id or uuid>|event:<id>[@<iso occurrence>]|note:<id>`; `--remove` takes the message id first and the
+ * link id after it. Split out of `local-args-tower-msg.ts`.
+ */
+import { optionalNonEmpty, optionalUrl } from "./local-arg-values.js";
+export const MSG_CONTEXT_VALUE_FLAGS = ["--add"];
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const IDENTIFIER = /^[A-Za-z][A-Za-z0-9]{1,12}-\d+$/;
+const KINDS = ["doc", "ticket", "event", "note"];
+/** `--add` used on another msg verb is named, not ignored. */
+export function rejectMsgContextFlags(values) {
+    if (values.flags.has("--add"))
+        throw new Error("--add belongs to `cockpit msg context`.");
+}
+export function parseContextSpec(spec) {
+    const match = /^(doc|ticket|event|note):(.+)$/i.exec(spec.trim());
+    if (!match)
+        throw new Error("--add takes doc:<id>, ticket:<BLI-id or uuid>, event:<id>[@<iso occurrence>] or note:<id>.");
+    const kind = match[1].toLowerCase();
+    const [id = "", occurrence] = match[2].split("@", 2);
+    const ok = kind === "ticket" ? UUID.test(id) || IDENTIFIER.test(id) : UUID.test(id);
+    if (!ok)
+        throw new Error(`--add ${kind}: needs ${kind === "ticket" ? "a BLI id or a uuid" : "a uuid"}, not "${id}".`);
+    if (occurrence !== undefined) {
+        if (kind !== "event")
+            throw new Error("An @<iso occurrence> belongs to event: only.");
+        const time = Date.parse(occurrence);
+        if (Number.isNaN(time))
+            throw new Error(`--add event: the occurrence "${occurrence}" is not an ISO time.`);
+        return { kind, id, occurrence: new Date(time).toISOString() };
+    }
+    return { kind, id };
+}
+export function parseMsgContextArgs(values, rest) {
+    const stray = ["--channel", "--members", "--description", "--from", "--expected-revision", "--name", "--out", "--file", "--level", "--timezone", "--message", "--to", "--before", "--limit", "--thread", "--request-id"]
+        .find((flag) => values.flags.has(flag));
+    if (stray || values.booleans.has("--private"))
+        throw new Error(`${stray ?? "--private"} does not belong to \`cockpit msg context\`.`);
+    const targetId = optionalNonEmpty(rest[0]);
+    if (!targetId || !UUID.test(targetId)) {
+        throw new Error("msg context needs a message id (a UUID), e.g. `cockpit msg context <message-id> --json`.");
+    }
+    const add = optionalNonEmpty(values.flags.get("--add"));
+    const removing = values.booleans.has("--remove");
+    if (add && removing)
+        throw new Error("msg context takes --add or --remove, not both.");
+    const base = {
+        kind: "msg",
+        action: "context",
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        isPrivate: false,
+        json: values.booleans.has("--json"),
+        targetId,
+    };
+    if (removing) {
+        const linkId = optionalNonEmpty(rest[1]);
+        if (!linkId || !UUID.test(linkId) || rest.length > 2) {
+            throw new Error("msg context --remove takes the message id and then the link id, e.g. `cockpit msg context <message-id> --remove <link-id>`.");
+        }
+        return { ...base, contextRemove: linkId };
+    }
+    if (rest.length > 1)
+        throw new Error(`msg context takes one message id, not ${rest.length}.`);
+    return { ...base, ...(add ? { contextAdd: parseContextSpec(add) } : {}) };
+}