@bli-cockpit/cli 0.2.242 → 0.2.244

package/dist/commands/view-args.js

@@ -0,0 +1,131 @@
+/**
+ * `cockpit ticket views [list|show|save|update|favorite|unfavorite|settings]` argument parsing
+ * (BLI-21686, P8). `views` is an `issue` action; its flags are read here so `local-args-tower-work.ts`
+ * only lists their names, the way `issue-relations.ts` does for relations.
+ */
+import { optionalNonEmpty, optionalUrl } from "./local-arg-values.js";
+export const VIEW_VALUE_FLAGS = ["--name", "--layout", "--hide", "--show", "--expected-updated-at", "--description"];
+export const VIEW_BOOLEAN_FLAGS = ["--shared", "--private", "--archive", "--restore", "--include-archived"];
+export const VIEW_FIELDS = ["priority", "labels", "project", "assignee", "updated"];
+const VIEW_VERBS = ["list", "show", "save", "update", "favorite", "unfavorite", "settings"];
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const STATES = ["backlog", "todo", "in_progress", "in_review", "done", "canceled"];
+function listOf(values, flag) {
+    return (values.flagValues.get(flag) ?? []).map((v) => v.trim()).filter(Boolean);
+}
+export function parseViewArgs(values, rest) {
+    const first = rest[0];
+    const verb = (first === undefined ? "list" : first);
+    if (!VIEW_VERBS.includes(verb)) {
+        throw new Error(`Unknown views command: ${first}. Try list, show, save, update, favorite, unfavorite or settings.`);
+    }
+    const positional = rest.slice(first === undefined ? 0 : 1);
+    const needsRef = verb === "show" || verb === "update" || verb === "favorite" || verb === "unfavorite";
+    if (needsRef && positional.length !== 1)
+        throw new Error(`ticket views ${verb} takes exactly one view id or name.`);
+    if (!needsRef && positional.length > 0)
+        throw new Error(`ticket views ${verb} does not take "${positional[0]}".`);
+    const given = (flag) => values.flags.has(flag) || values.booleans.has(flag);
+    const definitionFlags = ["--name", "--description", "--state", "--assignee", "--project", "--label", "--q", "--layout", "--sort", "--dir", "--shared", "--private"];
+    const writes = verb === "save" || verb === "update";
+    for (const flag of definitionFlags) {
+        if (given(flag) && !writes)
+            throw new Error(`${flag} belongs to \`cockpit ticket views save\` and \`update\`.`);
+    }
+    if (!writes && (given("--archive") || given("--restore") || given("--expected-updated-at"))) {
+        throw new Error("--archive, --restore and --expected-updated-at belong to `cockpit ticket views update`.");
+    }
+    if (verb === "save" && (given("--archive") || given("--restore") || given("--expected-updated-at"))) {
+        throw new Error("save takes --shared (or nothing for private); --archive, --restore and --expected-updated-at belong to `update`.");
+    }
+    if (given("--include-archived"))
+        throw new Error("--include-archived belongs to `cockpit ticket templates list`.");
+    if (verb !== "save" && given("--request-id"))
+        throw new Error("--request-id belongs to `cockpit ticket views save`.");
+    if (given("--private") && given("--shared"))
+        throw new Error("Give --shared or --private, not both.");
+    if (given("--archive") && given("--restore"))
+        throw new Error("Give --archive or --restore, not both.");
+    if (verb !== "settings" && (given("--hide") || given("--show")))
+        throw new Error("--hide and --show belong to `cockpit ticket views settings`.");
+    if (verb === "list" || verb === "show" || verb === "favorite" || verb === "unfavorite" || verb === "settings") {
+        if (given("--expected-revision") || given("--limit"))
+            throw new Error("That flag does not belong to ticket views.");
+    }
+    const name = optionalNonEmpty(values.flags.get("--name"));
+    if (verb === "save" && !name)
+        throw new Error('ticket views save needs --name "<name>".');
+    const filters = {};
+    const state = optionalNonEmpty(values.flags.get("--state"));
+    if (state) {
+        if (!STATES.includes(state))
+            throw new Error(`--state must be one of: ${STATES.join(", ")}.`);
+        filters["state"] = state;
+    }
+    const assignee = optionalNonEmpty(values.flags.get("--assignee"));
+    if (assignee) {
+        if (assignee !== "me" && assignee !== "unassigned" && !UUID.test(assignee)) {
+            throw new Error('--assignee must be "me", "unassigned" or a person\'s uuid. "me" stays "me" and means whoever opens the view.');
+        }
+        filters["assignee"] = assignee;
+    }
+    for (const [flag, key] of [["--project", "project"], ["--label", "label"], ["--q", "q"]]) {
+        const value = optionalNonEmpty(values.flags.get(flag));
+        if (value)
+            filters[key] = value;
+    }
+    const layout = optionalNonEmpty(values.flags.get("--layout"));
+    if (layout && layout !== "list" && layout !== "board")
+        throw new Error("--layout must be list or board.");
+    const sort = optionalNonEmpty(values.flags.get("--sort"));
+    if (sort && sort !== "updated_at" && sort !== "created_at")
+        throw new Error("--sort must be updated_at or created_at.");
+    const dir = optionalNonEmpty(values.flags.get("--dir"));
+    if (dir && dir !== "asc" && dir !== "desc")
+        throw new Error("--dir must be asc or desc.");
+    const expectedUpdatedAt = optionalNonEmpty(values.flags.get("--expected-updated-at"));
+    if (expectedUpdatedAt && Number.isNaN(Date.parse(expectedUpdatedAt))) {
+        throw new Error("--expected-updated-at must be the updated_at timestamp you last read.");
+    }
+    const requestId = optionalNonEmpty(values.flags.get("--request-id"));
+    if (requestId && !UUID.test(requestId))
+        throw new Error("--request-id must be a UUID.");
+    const rawDescription = values.flags.get("--description");
+    const hide = listOf(values, "--hide");
+    const show = listOf(values, "--show");
+    for (const field of [...hide, ...show]) {
+        if (!VIEW_FIELDS.includes(field))
+            throw new Error(`"${field}" is not a field. Use ${VIEW_FIELDS.join(", ")}.`);
+    }
+    if (verb === "settings" && (hide.length === 0 && show.length === 0) === false && hide.some((f) => show.includes(f))) {
+        throw new Error("A field cannot be in both --hide and --show.");
+    }
+    if (verb === "update" && !name && rawDescription === undefined && Object.keys(filters).length === 0 && !layout && !sort && !dir
+        && !given("--shared") && !given("--private") && !given("--archive") && !given("--restore")) {
+        throw new Error("ticket views update needs a field to change: --name, a filter, --layout, --sort, --dir, --shared, --private, --archive or --restore.");
+    }
+    const views = {
+        verb,
+        ...(needsRef ? { ref: positional[0] } : {}),
+        ...(name ? { name } : {}),
+        ...(rawDescription === undefined ? {} : { description: rawDescription.trim().toLowerCase() === "none" ? null : rawDescription }),
+        ...(Object.keys(filters).length > 0 ? { filters } : {}),
+        ...(layout ? { layout } : {}),
+        ...(sort ? { sort } : {}),
+        ...(dir ? { dir } : {}),
+        ...(given("--shared") ? { visibility: "shared" } : given("--private") ? { visibility: "private" } : {}),
+        ...(given("--archive") ? { archived: true } : given("--restore") ? { archived: false } : {}),
+        ...(expectedUpdatedAt ? { expectedUpdatedAt } : {}),
+        ...(hide.length > 0 ? { hide } : {}),
+        ...(show.length > 0 ? { show } : {}),
+    };
+    return {
+        kind: "issue",
+        action: "views",
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        ...(requestId ? { requestId } : {}),
+        json: values.booleans.has("--json"),
+        views,
+    };
+}

package/dist/commands/views.js

@@ -0,0 +1,138 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { pageFieldsOf, pageFooter } from "./issue-list-page.js";
+import { READ_DEADLINE_MS, WRITE_DEADLINE_MS } from "./issue-contracts.js";
+const TAG = "[ticket views cli]";
+const filterText = (filters) => {
+    const parts = Object.entries(filters).map(([key, value]) => `${key}=${value}`);
+    return parts.length === 0 ? "no filters" : parts.join(" ");
+};
+const viewLine = (view) => `${view.id}  ${view.name}  [${view.preset ? "built in" : view.visibility}${view.archived_at ? ", archived" : ""}${view.favorite ? ", favorite" : ""}]  ${filterText(view.filters)}`;
+export async function runViews(command, io, door) {
+    void io;
+    const views = command.views;
+    const ref = views.ref ? encodeURIComponent(views.ref) : "";
+    switch (views.verb) {
+        case "list":
+            return listViews(door, command);
+        case "show":
+            return showView(door, ref, views.ref ?? "");
+        case "favorite":
+        case "unfavorite": {
+            const answer = await askAgentDoor(door, {
+                path: `/api/work/views/${ref}/favorite`,
+                method: views.verb === "favorite" ? "POST" : "DELETE",
+                label: `ticket views ${views.verb}`,
+                timeoutMs: WRITE_DEADLINE_MS,
+            });
+            if (!answer.ok)
+                return failAgentDoor(door, TAG, answer.reason, answer.detail);
+            const body = answer.body;
+            console.error(`${TAG} ${views.verb} done`, JSON.stringify({ view_id: body.view?.id ?? views.ref, count: body.favorite_view_ids?.length ?? 0 }));
+            if (door.json)
+                return emitAgentDoor(door, { ok: true, ...body });
+            writeLine(door.io.stdout, `${views.verb === "favorite" ? "Favorited" : "Removed from favorites"}: ${body.view?.name ?? views.ref}. ${body.favorite_view_ids?.length ?? 0} favorite(s).`);
+            return 0;
+        }
+        case "settings":
+            return settings(door, command);
+        case "save":
+        case "update":
+            return writeView(door, command, ref);
+    }
+}
+async function listViews(door, command) {
+    void command;
+    const answer = await askAgentDoor(door, { path: "/api/work/views", method: "GET", label: "ticket views list", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...body });
+    const out = door.io.stdout;
+    if (body.my_work)
+        writeLine(out, viewLine(body.my_work));
+    for (const [title, rows] of [["Favorites", body.favorites], ["Mine", body.mine], ["Shared", body.shared]]) {
+        if (!rows || rows.length === 0)
+            continue;
+        writeLine(out, "");
+        writeLine(out, `${title}:`);
+        for (const view of rows)
+            writeLine(out, viewLine(view));
+    }
+    if (body.favorites_hidden)
+        writeLine(out, `\n${body.favorites_hidden} favorite(s) are not shown: archived, private to someone else or gone.`);
+    return 0;
+}
+async function showView(door, ref, label) {
+    const answer = await askAgentDoor(door, { path: `/api/work/views/${ref}`, method: "GET", label: "ticket views show", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...body, ...pageFieldsOf(body) });
+    const out = door.io.stdout;
+    const view = body.view;
+    writeLine(out, `${view?.name ?? label}  (${view?.preset ? "built in" : view?.visibility}, ${view?.layout}, ${view?.sort} ${view?.dir})`);
+    writeLine(out, `Filters: ${filterText(view?.filters ?? {})}${view?.filters?.["assignee"] === "me" ? "  (me is you)" : ""}`);
+    for (const issue of body.issues ?? [])
+        writeLine(out, `${(issue.identifier ?? "").padEnd(9)}  ${(issue.state ?? "").padEnd(11)}  ${issue.title ?? ""}`);
+    const footer = pageFooter(body, "tickets");
+    if (footer)
+        writeLine(out, footer);
+    if (body.href)
+        writeLine(out, `Open on the web: ${body.href}`);
+    return 0;
+}
+async function settings(door, command) {
+    const { hide, show } = command.views;
+    const changing = Boolean(hide?.length || show?.length);
+    const answer = await askAgentDoor(door, {
+        path: "/api/work/view-settings",
+        method: changing ? "PATCH" : "GET",
+        label: "ticket views settings",
+        timeoutMs: changing ? WRITE_DEADLINE_MS : READ_DEADLINE_MS,
+        ...(changing ? { body: { ...(hide?.length ? { hide } : {}), ...(show?.length ? { show } : {}) } } : {}),
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...body });
+    writeLine(door.io.stdout, `Hidden fields on your ticket rows: ${body.hidden_fields?.length ? body.hidden_fields.join(", ") : "none"}. Fields: ${(body.available_fields ?? []).join(", ")}.`);
+    return 0;
+}
+async function writeView(door, command, ref) {
+    const v = command.views;
+    const payload = {
+        ...(v.verb === "save" && command.requestId ? { request_id: command.requestId } : {}),
+        ...(v.verb === "update" && v.expectedUpdatedAt ? { expected_updated_at: v.expectedUpdatedAt } : {}),
+        ...(v.name === undefined ? {} : { name: v.name }),
+        ...(v.description === undefined ? {} : { description: v.description }),
+        ...(v.filters ? { filters: v.filters } : {}),
+        ...(v.layout ? { layout: v.layout } : {}),
+        ...(v.sort ? { sort: v.sort } : {}),
+        ...(v.dir ? { dir: v.dir } : {}),
+        ...(v.visibility ? { visibility: v.visibility } : {}),
+        ...(v.archived === undefined ? {} : { archived: v.archived }),
+    };
+    const answer = await askAgentDoor(door, {
+        path: v.verb === "save" ? "/api/work/views" : `/api/work/views/${ref}`,
+        method: v.verb === "save" ? "POST" : "PATCH",
+        label: `ticket views ${v.verb}`,
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: payload,
+    });
+    if (!answer.ok) {
+        const mutation = answer.body?.mutation;
+        return failAgentDoor(door, TAG, answer.reason, answer.detail, mutation ? { mutation } : {});
+    }
+    const body = answer.body;
+    console.error(`${TAG} ${v.verb} done`, JSON.stringify({ view_id: body.view?.id, replayed: Boolean(body.replayed) }));
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...body });
+    writeLine(door.io.stdout, `${v.verb === "save" ? (body.replayed ? "Already saved" : "Saved") : "Updated"}: ${body.view?.name ?? ""} (${body.view?.id ?? ""}), ${body.view?.visibility ?? ""}${body.view?.archived_at ? ", archived" : ""}.`);
+    if (body.view?.href)
+        writeLine(door.io.stdout, `Open on the web: ${body.view.href}`);
+    return 0;
+}

package/dist/commands/work-notify-args.js

@@ -0,0 +1,67 @@
+/**
+ * `cockpit ticket notifications [set|receipts]` argument parsing (BLI-21736, P10). An `issue` action; its flags are
+ * read here so `local-args-tower-work.ts` only lists the names.
+ */
+import { optionalNonEmpty, optionalPositiveInteger, optionalUrl } from "./local-arg-values.js";
+export const NOTIFY_ACTIONS = ["notifications"];
+export const NOTIFY_VALUE_FLAGS = ["--slack", "--notification"];
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function isNotifyAction(action) {
+    return NOTIFY_ACTIONS.includes(action);
+}
+export function parseNotifyArgs(values, rest) {
+    const given = (flag) => values.flags.has(flag) || values.booleans.has(flag);
+    const word = rest[0];
+    if (word !== undefined && word !== "set" && word !== "receipts") {
+        throw new Error(`ticket notifications does not take "${word.slice(0, 40)}". Try: notifications, notifications set --slack on|off, notifications receipts.`);
+    }
+    if (rest.length > 1)
+        throw new Error(`ticket notifications ${word} takes no further arguments.`);
+    for (const flag of ["--request-id", "--expected-revision", "--all", "--kind", "--unread"]) {
+        if (given(flag))
+            throw new Error(`${flag} does not apply to \`cockpit ticket notifications\`.`);
+    }
+    const notify = { sub: word === "set" ? "set" : word === "receipts" ? "receipts" : "show" };
+    const onlyFor = (flags, sub) => {
+        for (const flag of flags)
+            if (given(flag))
+                throw new Error(`${flag} belongs to \`cockpit ticket notifications ${sub}\`.`);
+    };
+    if (notify.sub === "set") {
+        onlyFor(["--notification", "--before", "--limit"], "receipts");
+        const slack = optionalNonEmpty(values.flags.get("--slack"));
+        if (slack !== "on" && slack !== "off")
+            throw new Error("ticket notifications set needs --slack on or --slack off.");
+        notify.slackEnabled = slack === "on";
+    }
+    else if (notify.sub === "receipts") {
+        onlyFor(["--slack"], "set");
+        const notification = optionalNonEmpty(values.flags.get("--notification"));
+        if (notification) {
+            if (!UUID.test(notification))
+                throw new Error("--notification must be a notification id. Copy it from `cockpit ticket inbox --json`.");
+            notify.notification = notification;
+        }
+        const before = optionalNonEmpty(values.flags.get("--before"));
+        if (before)
+            notify.before = before;
+        const limit = optionalPositiveInteger(values.flags.get("--limit"), "--limit");
+        if (limit !== undefined) {
+            if (limit > 100)
+                throw new Error("--limit is at most 100.");
+            notify.limit = limit;
+        }
+    }
+    else {
+        onlyFor(["--slack"], "set");
+        onlyFor(["--notification", "--before", "--limit"], "receipts");
+    }
+    return {
+        kind: "issue",
+        action: "notifications",
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        json: values.booleans.has("--json"),
+        notify,
+    };
+}

package/dist/commands/work-notify.js

@@ -0,0 +1,63 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+import { READ_DEADLINE_MS, WRITE_DEADLINE_MS } from "./issue-contracts.js";
+const TAG = "[ticket notifications cli]";
+function writeSettings(door, settings) {
+    const out = door.io.stdout;
+    writeLine(out, `Slack delivery: ${settings.slack_enabled ? "on" : "off"}${settings.slack_enabled_at && settings.slack_enabled ? ` (since ${settings.slack_enabled_at})` : ""}`);
+    if (settings.slack_linked === null)
+        writeLine(out, `Slack account: could not check (${settings.slack_linked_reason ?? "unknown"}).`);
+    else
+        writeLine(out, settings.slack_linked ? "Slack account: linked." : "Slack account: none linked, so delivery would fail with slack_identity_missing.");
+}
+export async function runWorkNotify(command, io, door) {
+    void io;
+    const notify = command.notify;
+    if (notify.sub === "receipts") {
+        const query = new URLSearchParams();
+        if (notify.notification)
+            query.set("notification_id", notify.notification);
+        if (notify.before)
+            query.set("before", notify.before);
+        if (notify.limit !== undefined)
+            query.set("limit", String(notify.limit));
+        const suffix = query.toString();
+        const answer = await askAgentDoor(door, {
+            path: `/api/work/notifications/receipts${suffix ? `?${suffix}` : ""}`,
+            method: "GET",
+            label: "ticket notifications receipts",
+            timeoutMs: READ_DEADLINE_MS,
+        });
+        if (!answer.ok)
+            return failAgentDoor(door, TAG, answer.reason, answer.detail);
+        const body = answer.body;
+        if (door.json)
+            return emitAgentDoor(door, { ok: true, ...body });
+        const receipts = body.receipts ?? [];
+        if (receipts.length === 0)
+            writeLine(door.io.stdout, "No delivery receipts yet.");
+        for (const receipt of receipts) {
+            writeLine(door.io.stdout, `${receipt.id}  ${receipt.outcome.padEnd(10)}  ${(receipt.reason ?? "-").padEnd(22)}  ${(receipt.identifier ?? "(ticket not readable)").padEnd(9)}  ${receipt.created_at}`);
+        }
+        if (body.has_more && body.next_cursor)
+            writeLine(door.io.stdout, `More receipts available. Continue with --before ${body.next_cursor}`);
+        return 0;
+    }
+    const setting = notify.sub === "set";
+    const answer = await askAgentDoor(door, {
+        path: "/api/work/notifications/settings",
+        method: setting ? "PUT" : "GET",
+        label: setting ? "ticket notifications set" : "ticket notifications",
+        timeoutMs: setting ? WRITE_DEADLINE_MS : READ_DEADLINE_MS,
+        ...(setting ? { body: { slack_enabled: notify.slackEnabled } } : {}),
+    });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    console.error(`${TAG} ${setting ? "set" : "read"} done`, JSON.stringify({ slack_enabled: body.settings?.slack_enabled }));
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, ...body });
+    if (body.settings)
+        writeSettings(door, body.settings);
+    return 0;
+}

package/dist/delivery-hold-notice.js

@@ -163,4 +163,38 @@ function reasonWord(reason, budget) {
     if (safe.length === 0)
         return ABSENT;
     return safe.slice(0, budget);
+}
+/**
+ * Ticket 21952: the per-tick SIZE BUDGET's hold, the second token this file owns.
+ *
+ * A tick that sent some evidence and held the rest for the next tick reports
+ * `ok` with this token instead of failing, because overflow defers and converges
+ * by design. The collector writes it and the fleet board reads it
+ * (`apps/dashboard/src/lib/ops/fleet-budget-hold.ts`), which turns a hold that
+ * never drains into a RED row, so a growing backlog cannot stay green.
+ *
+ *     held_budget:<held objects>:<held MiB>:<sent MiB>
+ *     held_budget:3:901:2043
+ */
+export const BUDGET_HOLD_NOTICE_PREFIX = "held_budget";
+const MIB = 1024 * 1024;
+/** Render the size-budget hold, or null for a hold of nothing. Held MiB rounds up so a held byte never reads as 0. */
+export function formatBudgetHoldNotice(use) {
+    if (use.deferredObjects <= 0)
+        return null;
+    const heldMib = Math.ceil(Math.max(0, use.deferredBytes) / MIB);
+    const sentMib = Math.round(Math.max(0, use.admittedBytes) / MIB);
+    return `${BUDGET_HOLD_NOTICE_PREFIX}:${Math.trunc(use.deferredObjects)}:${heldMib}:${sentMib}`;
+}
+/** Find a size-budget hold token anywhere in a receipt's detail. A search, for the same reason as `parseDeliveryHoldNotice`. */
+export function parseBudgetHoldNotice(text) {
+    if (!text)
+        return null;
+    const match = new RegExp(String.raw `${BUDGET_HOLD_NOTICE_PREFIX}:(\d+):(\d+):(\d+)`, "u").exec(text);
+    if (!match)
+        return null;
+    const heldObjects = Number.parseInt(match[1], 10);
+    if (!Number.isFinite(heldObjects) || heldObjects <= 0)
+        return null;
+    return { heldObjects, heldMib: Number.parseInt(match[2], 10), sentMib: Number.parseInt(match[3], 10) };
 }

package/dist/evidence-transcripts-client.js

@@ -78,6 +78,7 @@ function addTranscriptObject(object, files, state) {
     const key = transcriptFileKey(identity);
     const list = files.get(key) ?? [];
     list.push({
+        ref_id: object.ref_id,
         object_key: object.object_key,
         byte_size: object.byte_size,
         content_hash_sha256: object.content_hash_sha256,

package/dist/log-rotation.js

@@ -47,8 +47,8 @@ import path from "node:path";
  */
 export const DEFAULT_LOG_ROTATION_MAX_BYTES = 10 * 1024 * 1024;
 export const DEFAULT_LOG_ROTATION_KEEP = 2;
-/** The two files launchd writes for the scheduled tick. */
-export const ROTATED_LOG_NAMES = ["sync.log", "sync.err.log"];
+/** The files launchd writes for the scheduled ticks (sync, and BLI-21564 the reminder job). */
+export const ROTATED_LOG_NAMES = ["sync.log", "sync.err.log", "remind.log", "remind.err.log"];
 /**
  * Caps the scheduled tick's own logs. Never throws: a rotation failure is data
  * for the caller to log, never a reason a sync does not run.

package/dist/notifier.js

@@ -0,0 +1,83 @@
+/**
+ * The one place the collector paints an OS banner (BLI-21564, calendar slice 11).
+ *
+ * macOS goes through `osascript -e 'display notification ...'`, Windows through
+ * a PowerShell toast on PowerShell's own app id. Both are spawned through
+ * `process-runner.ts` with an ARRAY of arguments (never a shell line), and every
+ * string a person or a calendar can influence is escaped (AppleScript) or passed
+ * by environment variable (PowerShell), so a meeting title cannot become code.
+ *
+ * The result is always one of three named outcomes. A banner the OS refused is
+ * `permission_denied`; a helper that failed any other way is `notifier_failed`
+ * with its exit code; nothing here is silent. `osascript` exits 0 when the user
+ * switched notifications off for it, so a silent denial is not detectable: a
+ * desktop receipt, not this module, is the proof a banner appeared.
+ */
+import { createCapturedExecRunner } from "./process-runner.js";
+const NOTIFIER_TIMEOUT_MS = 15_000;
+const MAX_TEXT = 200;
+const DENIAL = /not allowed|not authorized|not permitted|access.*denied|notifications? (?:are |is )?(?:disabled|blocked|turned off)|\(-1743\)|\(-1744\)|blocked by/i;
+/** Controls become spaces and the length is bounded; the text is a banner, not a document. */
+function plain(value) {
+    // eslint-disable-next-line no-control-regex
+    return value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, MAX_TEXT);
+}
+/** An AppleScript string literal body: backslash and double quote are the only escapes it needs. */
+export function appleScriptEscape(value) {
+    return plain(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+export function macNotifyArgs(request) {
+    const sound = request.sound ? ' sound name "Glass"' : "";
+    return ["-e", `display notification "${appleScriptEscape(request.message)}" with title "${appleScriptEscape(request.title)}"${sound}`];
+}
+/** The toast script reads its text from the environment, so no title can reach the script body. */
+export const WINDOWS_TOAST_SCRIPT = [
+    "$ErrorActionPreference = 'Stop'",
+    "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null",
+    "[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null",
+    "$title = [System.Security.SecurityElement]::Escape($env:TOWER_TOAST_TITLE)",
+    "$message = [System.Security.SecurityElement]::Escape($env:TOWER_TOAST_MESSAGE)",
+    "$audio = if ($env:TOWER_TOAST_SOUND -eq '1') { '' } else { '<audio silent=\"true\"/>' }",
+    "$xml = New-Object Windows.Data.Xml.Dom.XmlDocument",
+    "$xml.LoadXml('<toast><visual><binding template=\"ToastText02\"><text id=\"1\">' + $title + '</text><text id=\"2\">' + $message + '</text></binding></visual>' + $audio + '</toast>')",
+    "$toast = New-Object Windows.UI.Notifications.ToastNotification $xml",
+    "$appId = '{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe'",
+    "[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($appId).Show($toast)",
+].join("\n");
+export function windowsNotifyArgs() {
+    const encoded = Buffer.from(WINDOWS_TOAST_SCRIPT, "utf16le").toString("base64");
+    return ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded];
+}
+export async function showNotification(request, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const exec = options.exec ?? createCapturedExecRunner({ platform });
+    let command;
+    let args;
+    let env;
+    if (platform === "darwin") {
+        command = "osascript";
+        args = macNotifyArgs(request);
+    }
+    else if (platform === "win32") {
+        command = "powershell.exe";
+        args = windowsNotifyArgs();
+        env = { ...(options.env ?? process.env), TOWER_TOAST_TITLE: plain(request.title), TOWER_TOAST_MESSAGE: plain(request.message), TOWER_TOAST_SOUND: request.sound ? "1" : "0" };
+    }
+    else {
+        const reason = `no_notifier_for_${platform}`;
+        console.error("[notifier] not shown", JSON.stringify({ outcome: "notifier_failed", reason }));
+        return { outcome: "notifier_failed", reason };
+    }
+    const result = await exec(command, args, { timeoutMs: NOTIFIER_TIMEOUT_MS, ...(env ? { env } : {}) });
+    if (result.code === 0) {
+        console.error("[notifier] shown", JSON.stringify({ outcome: "shown", platform }));
+        return { outcome: "shown", reason: null };
+    }
+    if (DENIAL.test(`${result.stderr}\n${result.stdout}`)) {
+        console.error("[notifier] not shown", JSON.stringify({ outcome: "permission_denied", platform, exit: result.code }));
+        return { outcome: "permission_denied", reason: `os_refused_exit_${result.code}` };
+    }
+    const reason = result.code === 124 ? "timed_out" : `exit_${result.code}`;
+    console.error("[notifier] not shown", JSON.stringify({ outcome: "notifier_failed", platform, exit: result.code }));
+    return { outcome: "notifier_failed", reason };
+}

package/dist/process-runner.js

@@ -35,6 +35,7 @@ export function createCapturedExecRunner(options = {}) {
             encoding: "utf8",
             env,
             windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+            windowsHide: true,
             ...(runOptions?.timeoutMs ? { timeout: runOptions.timeoutMs } : {}),
         }, (error, stdout, stderr) => {
             const code = capturedExitCode(error, runOptions?.timeoutMs);
@@ -86,6 +87,9 @@ export function createInteractiveExecRunner(options = {}) {
             stdio,
             env,
             windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+            // Ticket 21952: a scheduled sync has no console, so a child without this opens a visible window on Windows.
+            // With a console (a person typing `cockpit doctor`) the child shares it and the flag changes nothing.
+            windowsHide: true,
         });
         let settled = false;
         child.on("error", (error) => {

package/dist/repo-identity-git.js

@@ -14,6 +14,7 @@ export async function runGit(args, cwd) {
     const { stdout } = await execFileAsync("git", args, {
         cwd,
         timeout: 2_000,
+        windowsHide: true,
         maxBuffer: 1024 * 1024,
     });
     return stdout;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.242",
+  "version": "0.2.244",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.70",
-    "@bli-cockpit/mcp": "0.1.147",
-    "@bli-cockpit/telemetry-core": "0.1.77"
+    "@bli-cockpit/memory-mcp": "0.1.72",
+    "@bli-cockpit/mcp": "0.1.149",
+    "@bli-cockpit/telemetry-core": "0.1.79"
   },
   "repository": {
     "type": "git",