@bli-cockpit/cli 0.2.255 → 0.2.257

package/dist/commands/agent-session-root-scope.js

@@ -16,4 +16,23 @@ import { OUTSIDE_APPROVED_ROOT_REASONS } from "./session-sync-health.js";
  */
 export function rootScopeForReason(reason) {
     return OUTSIDE_APPROVED_ROOT_REASONS.has(reason) ? "outside" : "inside";
+}
+/**
+ * The terminal attribution states: attribution finished and named no repo. They
+ * are labels, never a reason to withhold (session-first collection).
+ */
+const TERMINAL_ATTRIBUTION_STATES = new Set(["ambiguous", "unattributed", "skipped"]);
+/**
+ * Reasons a session carries no workspace of its own that are NOT an outside-root
+ * fact, so `rootScopeForReason` keeps calling them "inside". Today: a transcript
+ * with no cwd, workspace or origin signal at all (`no_repo_signals`).
+ */
+export const NO_WORKSPACE_REASONS = new Set(["no_repo_signals"]);
+/**
+ * Does this session still lack a workspace the upload can stand in? Every
+ * terminal state without a worktree rides the collector's synthetic workspace,
+ * whatever its reason; attribution stays exactly as scored.
+ */
+export function needsTransportWorkspace(result) {
+    return !result.worktree && TERMINAL_ATTRIBUTION_STATES.has(result.state);
 }

package/dist/commands/backfill-outside-roots.js

@@ -24,7 +24,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { repoFingerprintFromLocalRoot, stableWorktreeFingerprint, } from "../repo-identity.js";
-import { rootScopeForReason } from "./agent-session-root-scope.js";
+import { NO_WORKSPACE_REASONS, needsTransportWorkspace, rootScopeForReason } from "./agent-session-root-scope.js";
 /**
  * The label the sync path writes for a report with no real worktree
  * (`session-sync-record.ts`). Reused verbatim: one label, not a second one.
@@ -64,18 +64,22 @@ export function isOutsideRootCandidate(candidate) {
 export function labelOutsideRootCandidates(candidates, workspace) {
     let codex = 0;
     let claude = 0;
+    let noRepoSignals = 0;
     const labelled = candidates.map((candidate) => {
-        if (candidate.worktree || !isOutsideRootCandidate(candidate))
+        if (!needsTransportWorkspace(candidate))
             return candidate;
         if (candidate.source === "codex")
             codex += 1;
         else
             claude += 1;
+        if (NO_WORKSPACE_REASONS.has(candidate.reason))
+            noRepoSignals += 1;
         return { ...candidate, worktree: workspace };
     });
     console.error("[backfill] outside-root sessions labelled for upload", JSON.stringify({
-        root_scope: "outside",
+        reason: "unattributed_sessions_labelled_for_upload",
         count: codex + claude,
+        no_repo_signals_count: noRepoSignals,
         codex_count: codex,
         claude_count: claude,
         candidate_count: candidates.length,

package/dist/commands/codex-mcp-table.js

@@ -0,0 +1,185 @@
+import { findTomlTableSpan, tableContentEnd, readTomlTable, renderTomlTable, upsertTomlTable, } from "./memory-install-toml.js";
+import { findTomlDuplicateKey } from "./toml-duplicate-keys.js";
+/**
+ * Reads EVERY env sub-table before removing any (BLI-22766 review: reading one
+ * span and then deleting all of them lost the second table's keys), then the
+ * inline form from what is left.
+ */
+export function readStoredCodexEnv(text, tablePath) {
+    const envPath = [...tablePath, "env"];
+    const subTables = [];
+    let rest = text;
+    while (findTomlTableSpan(rest, envPath)) {
+        subTables.push(stringEntries(readTomlTable(rest, envPath) ?? {}));
+        rest = removeTableKeepingTrailingNotes(rest, envPath);
+    }
+    const inlineValue = readTomlTable(rest, tablePath)?.["env"];
+    return {
+        inline: inlineValue && typeof inlineValue === "object" && !Array.isArray(inlineValue)
+            ? inlineValue
+            : null,
+        subTables,
+        withoutSubTables: rest,
+    };
+}
+/**
+ * The env we write: our owned keys win, then the first-seen person value
+ * (inline form first, then sub-tables in file order). No key is dropped.
+ */
+export function mergeCodexEnv(stored, owned) {
+    const merged = {};
+    for (const form of [stored.inline ?? {}, ...stored.subTables]) {
+        for (const [key, value] of Object.entries(form)) {
+            if (!(key in merged))
+                merged[key] = value;
+        }
+    }
+    return { ...merged, ...owned };
+}
+/**
+ * True when the stored table already says what we would write. A table with
+ * env in more than one form (inline plus a sub-table, or two sub-tables) never
+ * matches: it is the broken shape, and only a write repairs it. One sub-table
+ * alone matches, so a config Codex itself wrote is not churned every tick.
+ */
+export function codexServerTableMatches(raw, tablePath, config) {
+    const stored = readStoredCodexEnv(raw, tablePath);
+    const table = readTomlTable(stored.withoutSubTables, tablePath);
+    if (!table)
+        return false;
+    if (table["command"] !== config.mcp_server.command)
+        return false;
+    const args = table["args"];
+    if (!Array.isArray(args)) {
+        if (config.mcp_server.args.length !== 0)
+            return false;
+    }
+    else {
+        if (args.length !== config.mcp_server.args.length)
+            return false;
+        if (!args.every((entry, index) => entry === config.mcp_server.args[index]))
+            return false;
+    }
+    const hasInlineKey = Object.prototype.hasOwnProperty.call(table, "env");
+    const forms = (hasInlineKey ? 1 : 0) + stored.subTables.length;
+    if (forms > 1)
+        return false;
+    const env = stored.inline ?? stored.subTables[0] ?? {};
+    return Object.entries(config.mcp_server.env).every(([key, value]) => env[key] === value);
+}
+/**
+ * Writes our table in the inline form, folding in and removing every env
+ * sub-table. Returns the new file text and how many env keys came from the
+ * person's own forms (for the log line; never the values).
+ */
+export function upsertCodexServerTable(raw, tablePath, config) {
+    const stored = readStoredCodexEnv(raw, tablePath);
+    const env = mergeCodexEnv(stored, config.mcp_server.env);
+    const keptKeys = Object.keys(env).filter((key) => !(key in config.mcp_server.env)).length;
+    const entries = [
+        ["command", config.mcp_server.command],
+        ["args", config.mcp_server.args],
+    ];
+    if (Object.keys(env).length > 0)
+        entries.push(["env", env]);
+    const text = upsertTomlTable(stored.withoutSubTables, tablePath, renderTomlTable(tablePath, entries));
+    return { text, keptKeys, removedSubTable: stored.subTables.length > 0 };
+}
+/**
+ * The verdict `cockpit doctor` and the installers attach to a Codex config
+ * that Codex cannot load. Null when the file is absent or loads. `ignorePaths`
+ * lets a writer verifying its own work skip a duplicate inside the OTHER Tower
+ * server's table, which that server's own writer repairs on the same run.
+ */
+export function codexConfigUnparseable(raw, file, target, ignorePaths = []) {
+    if (raw === null)
+        return null;
+    const found = findTomlDuplicateKey(raw);
+    if (!found)
+        return null;
+    if (ignorePaths.some((ignored) => isWithin(found.key, ignored)))
+        return null;
+    return {
+        target,
+        status: "failed",
+        reason: "config_unparseable",
+        path: file,
+        detail: `${file} line ${found.line}: the key ${found.key} is defined twice, so Codex will not start;`
+            + " `cockpit memory install` repairs it when the key is one of Tower's own servers",
+    };
+}
+function isWithin(key, tablePath) {
+    const prefix = tablePath.join(".");
+    return key === prefix || key.startsWith(`${prefix}.`);
+}
+function stringEntries(values) {
+    const out = {};
+    for (const [key, value] of Object.entries(values)) {
+        if (typeof value === "string")
+            out[key] = value;
+    }
+    return out;
+}
+/**
+ * Removes a table's header and key lines, but keeps the comments and blank
+ * lines at its tail: those usually introduce the NEXT section, which is not
+ * ours to delete.
+ */
+function removeTableKeepingTrailingNotes(text, tablePath) {
+    const span = findTomlTableSpan(text, tablePath);
+    if (!span)
+        return text;
+    const lines = text.split("\n");
+    const end = tableContentEnd(lines, span);
+    return [...lines.slice(0, span.start_line), ...lines.slice(end)].join("\n");
+}
+/** The one write path for both servers' Codex tables. */
+export async function applyCodexServerTable(options) {
+    const { file, target, tablePath, siblingPath } = options;
+    const raw = (await options.io.readText(file)) ?? "";
+    if (codexServerTableMatches(raw, tablePath, options.config)) {
+        // Our table being current does not make the file loadable.
+        const broken = codexConfigUnparseable(raw, file, target, [siblingPath]);
+        if (broken) {
+            console.error("[memory-install] codex config does not load", JSON.stringify({ target, reason: broken.reason }));
+            return broken;
+        }
+        return { target, status: "already", reason: "already_current", path: file };
+    }
+    const next = upsertCodexServerTable(raw, tablePath, options.config);
+    if (options.dryRun)
+        return { target, status: "would_install", reason: "dry_run", path: file };
+    if (next.removedSubTable) {
+        console.error("[memory-install] folded a separate env table into the inline env", JSON.stringify({ target, kept_keys: next.keptKeys }));
+    }
+    try {
+        await options.io.writeText(file, next.text);
+    }
+    catch (error) {
+        return {
+            target,
+            status: "failed",
+            reason: "write_failed",
+            path: file,
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    // BLI-2541: parse the table back out of the stored bytes the way Codex will
+    // read it. A successful write is not a correct registration.
+    const stored = await options.io.readText(file);
+    if (stored === null || !codexServerTableMatches(stored, tablePath, options.config)) {
+        return {
+            target,
+            status: "failed",
+            reason: "read_back_mismatch",
+            path: file,
+            detail: "the table on disk does not parse back to the entry that was written",
+        };
+    }
+    const broken = codexConfigUnparseable(stored, file, target, [siblingPath]);
+    if (broken) {
+        console.error("[memory-install] codex config still does not load after our write", JSON.stringify({ target, reason: broken.reason }));
+        return broken;
+    }
+    return { target, status: "installed", reason: "wrote_entry", path: file };
+}

package/dist/commands/doctor-registration.js

@@ -100,7 +100,11 @@ function memoryStepState(outcome, phase) {
     const broken = outcome.targets.filter((target) => target.target !== "bin" && target.status === "failed");
     if (broken.length > 0) {
         const first = broken[0];
-        const message = `${first?.target ?? "memory"}: ${first?.reason ?? "failed"}`;
+        // BLI-22766: an unloadable Codex config is named by file and line, so the
+        // person can find it even when the repair cannot (a duplicate in their own
+        // section of the file).
+        const named = first?.reason === "config_unparseable" && first.detail ? ` (${first.detail})` : "";
+        const message = `${first?.target ?? "memory"}: ${first?.reason ?? "failed"}${named}`;
         return phase === "fix"
             ? fail("memory-registered", first?.reason ?? "memory_install_failed", message)
             : needsFix("memory-registered", first?.reason ?? "memory_install_failed", message);

package/dist/commands/local-args-tower-notes.js

@@ -53,6 +53,7 @@ const NOTES_ACTIONS = new Set([
     "granola-status",
     "transcription-stats",
     "bot-upcoming",
+    "record",
 ]);
 /** Actions whose first positional is the note it acts on. */
 const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
@@ -141,6 +142,7 @@ export function parseNotesArgs(args) {
     const workspace = optionalNonEmpty(values.flags.get("--workspace"));
     if (action === "connect")
         rejectBadConnectRequest(values, provider, workspace, rest);
+    const record = action === "record" ? readRecordRequest(rest) : undefined;
     const paths = readNotesPaths(action, rest);
     if (action === "rename" && !optionalNonEmpty(values.flags.get("--name")))
         throw new Error("notes rename needs --name <name>.");
@@ -163,6 +165,7 @@ export function parseNotesArgs(args) {
         ...(showWebhook ? { showWebhook: true } : {}),
         ...(action === "connect" && values.booleans.has("--key-stdin") ? { keyStdin: true } : {}),
         ...(paths ? { paths } : {}),
+        ...(record ? record : {}),
         filePath: optionalNonEmpty(values.flags.get("--file")),
         name: optionalNonEmpty(values.flags.get("--name")),
         exclude: optionalNonEmpty(values.flags.get("--exclude")),
@@ -187,10 +190,23 @@ function readNotesAction(first) {
     // almost always wants — same reasoning as bare `cockpit` running convergence.
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, summarize, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, granola-status, or transcription-stats.`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, summarize, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, granola-status, or transcription-stats (and record start|stop|status|cancel).`);
     }
     return action;
 }
+const RECORD_VERBS = ["start", "stop", "status", "cancel"];
+/** BLI-22979: `record <start|stop|status|cancel>`; only `stop` takes a session id (to finish a recoverable one). */
+function readRecordRequest(rest) {
+    const verb = rest[0];
+    if (!verb || !RECORD_VERBS.includes(verb)) {
+        throw new Error("notes record needs one of: start, stop, status, cancel.");
+    }
+    if (verb === "stop" && rest.length === 2 && rest[1].trim())
+        return { recordAction: verb, sessionId: rest[1].trim() };
+    if (rest.length > 1)
+        throw new Error(`notes record ${verb} does not take "${rest[1]}".`);
+    return { recordAction: verb };
+}
 function readRepairTruncated(action, values) {
     const repairTruncated = values.booleans.has("--repair-truncated");
     if (repairTruncated && action !== "sync") {
@@ -297,6 +313,7 @@ function readNotesPaths(action, rest) {
         return undefined;
     }
     const takesNoPositional = action !== "paste"
+        && action !== "record"
         && action !== "connect"
         && action !== "sync"
         && action !== "sync-status"

package/dist/commands/local-command-shapes-notes.js

@@ -0,0 +1 @@
+export {};

package/dist/commands/local-help-commands-tower.js

@@ -11,6 +11,7 @@
  * Every string moved verbatim. Help output is what an intern pastes back when
  * something breaks, so it is a user-visible contract like any other.
  */
+import { NOTES_HELP } from "./local-help-notes.js";
 import { DOCS_FILES_HELP } from "./local-help-docs-files.js";
 import { DOCS_REFS_HELP } from "./local-help-docs-refs.js";
 import { DOCS_SYNC_HELP } from "./local-help-docs-sync.js";
@@ -401,52 +402,7 @@ export const TOWER_COMMAND_HELP = [
             "The command uses the existing paired device identity. Run `cockpit login` first if this machine is not paired.",
         ],
     ],
-    [
-        "notes",
-        [
-            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>] [flags]",
-            "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 1 GB. Over 4 MB (a whole meeting) the file goes straight to storage and is transcribed in the background; --wait then polls for up to 4 hours and prints progress, otherwise for at most 330 seconds.",
-            "",
-            "folders [--tree] [--json]: list folders and visible note counts.",
-            "mkdir <path> [--json]: create a folder and any missing ancestors.",
-            "rename <path> --name <name> [--json]: rename a folder and its descendant paths.",
-            "rmdir <path> [--json]: delete an empty folder; refuses notes or subfolders.",
-            "upload, paste and move accept --folder <path>; use / for Root. Shelf placement stays independent.",
-            "The /meeting-notes surface, typed. Bare `cockpit notes` lists the library.",
-            "list [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] — every note you may open, grouped by shelf, newest meeting first. Never a word of a note.",
-            "show <id> [--offset <chars>] [--limit <chars>] — one note with its text, its shelf, and why you are allowed to see it. A long transcript can be read in parts: --offset and --limit are characters (as in `docs read`), and the answer says the note's total size and the --offset to continue from (BLI-18006).",
-            "shelf [--limit <n>] — the notes YOU have put in, and what became of each.",
-            "shelves — the shelves in use, with how many notes are on each.",
-            "upload <paths...> [--exclude \"<sentence>\"] — put one or more local files in. Explicit paths only; your shell does any globbing, and a file that does not exist is named rather than skipped.",
-            "paste [--file <path>] [--name <n>] [--exclude \"<sentence>\"] — put text in. --file <path> is safest (any editor encoding is decoded). Stdin works too: `pbpaste | cockpit notes paste` on macOS; on Windows use PowerShell 7 (`Get-Clipboard | cockpit notes paste`) — PowerShell 5.1 turns non-ASCII into `?` on pipes.",
-            "--exclude carries your own sentence about what to leave out, exactly as the browser's box does.",
-            "share <id> [--yes] — let everyone signed in read the statements that are safe to share. Asks first in a terminal; --yes is required without one, and --json implies --yes.",
-            "summarize <id> — write a new summary (decisions, action items, key points) where every claim cites the speaker, timestamp and segment id (s12) it came from; claims the transcript does not support are dropped. Takes up to a minute; earlier summaries are kept. `show <id>` prints the newest one.",
-            "unshare <id> — take it back. Never asks: it only ever narrows who can read.",
-            "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
-            "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
-            "",
-            "Your own notetaker (BLI-4383). Fellow, Circleback, Fireflies and Wispr Flow today; Otter needs an Enterprise plan and Granola still runs on its own cron.",
-            "accounts [--json] — the notetakers you have connected, with health and when each was last read, and under it who on the team feeds Tower with which notetaker (a member with none is named: that is the gap).",
-            "recordings <note-id> [--json] — every recording of the meeting this note is. When several notetakers or people recorded one meeting, the library shows ONE note, the recording with the longest transcript; the others are alternates kept by id (BLI-12926).",
-            "recording <recording-id> [--json] — one recording, text and all, shown or alternate.",
-            "accounts --show-webhook <account-id> — that account's webhook URL, where to paste it at the vendor, and whether a signing secret is stored (BLI-4394). Until one is, every request to that URL is refused, which is the right way to be off.",
-            "webhook <account-id> --secret-stdin — store the VENDOR's webhook signing secret. THE SECRET IS READ FROM STDIN, never a flag: printf \"%s\" \"<signing secret>\" | cockpit notes webhook <account-id> --secret-stdin",
-            "connect --provider wisprflow — Wispr Flow has no API key: this asks Tower to start the sign-in (the same door the Settings button, the MCP tool notes_connect_wisprflow and JARVIS use), prints and opens Wispr's approval page (Google, Apple, Microsoft or company single sign-on), and waits up to 10 minutes for Tower to report it connected, then Tower reads your Notetaker meetings from then on. Needs Notetaker and MCP access on your Wispr account. Exits 1 with a reason if nothing connects (BLI-12926, BLI-17973).",
-            "connect --provider fellow|circleback|fireflies [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
-            "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
-            "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
-            "sync <account-id> --repair-truncated — re-read Wispr Flow notes that were stored with only the first part of a long transcript (the \"truncated, N chars remaining\" line), and rewrite them whole. Same door and the same bounded passes; prints found, fixed and failed with each failure's reason, and is safe to run again (BLI-18006).",
-            "sync-status [<account-id>] — every notetaker's health, or one's: last successful sync, the last pass's own reason, how many meetings it carried, failures in the last 24h, and the lag between the newest meeting it has read and when it last ran (ticket 10730).",
-            "bot-upcoming [--json] — your own Google Meet meetings today that the bot will join, with claim state. Decline or mark private to opt out.",
-            "granola-status [--limit <n>] [--json] — the Granola cron's own last several runs (ticket 10718): reason, counts, model, spend and which lookback it used. Granola runs on a shared server-side key, not a connected account, so this is its own read rather than `accounts`.",
-            "transcription-stats [--month YYYY-MM] [--json] — what meeting transcription cost and did (BLI-18003): minutes, dollars (list and real), requests, failures and fallbacks per provider for the UTC month (default: this one), the spend against the monthly cap and how close the 80% message and the hold are, how many meetings are waiting for budget, which provider keys the deploy holds (by name), and how old the numbers are. Switch providers or move the cap with `cockpit settings switches set transcription.provider|transcription.fallback_chain|transcription.monthly_cap_usd <value>`.",
-            "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
-            "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
-            "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",
-            "The command uses the existing paired device identity. Run `cockpit login` first if this machine is not paired.",
-        ],
-    ],
+    ...NOTES_HELP,
     [
         "memory",
         [

package/dist/commands/local-help-notes.js

@@ -0,0 +1,50 @@
+/** The `notes` help entry, split out of `local-help-commands-tower.ts`, which sits at the file-size ratchet. */
+export const NOTES_HELP = [
+    [
+        "notes",
+        [
+            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>|record start|stop|status|cancel] [flags]",
+            "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 1 GB. Over 4 MB (a whole meeting) the file goes straight to storage and is transcribed in the background; --wait then polls for up to 4 hours and prints progress, otherwise for at most 330 seconds.",
+            "",
+            "record start|stop [<session-id>]|status|cancel — record a meeting in a room from this Mac's microphone (Apple Silicon macOS; Windows says it is not supported yet). Nothing leaves the machine while recording and there is no auto-stop. `stop` trims the silence away locally, uploads only the speech, and Tower writes a note with Speaker 1, Speaker 2... lines (add --wait to watch the transcription). `cancel` stops and KEEPS the file; `status` lists what is recording or waiting; `stop <session-id>` finishes a cancelled or crashed session. The original recording stays on this machine.",
+            "folders [--tree] [--json]: list folders and visible note counts.",
+            "mkdir <path> [--json]: create a folder and any missing ancestors.",
+            "rename <path> --name <name> [--json]: rename a folder and its descendant paths.",
+            "rmdir <path> [--json]: delete an empty folder; refuses notes or subfolders.",
+            "upload, paste and move accept --folder <path>; use / for Root. Shelf placement stays independent.",
+            "The /meeting-notes surface, typed. Bare `cockpit notes` lists the library.",
+            "list [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] — every note you may open, grouped by shelf, newest meeting first. Never a word of a note.",
+            "show <id> [--offset <chars>] [--limit <chars>] — one note with its text, its shelf, and why you are allowed to see it. A long transcript can be read in parts: --offset and --limit are characters (as in `docs read`), and the answer says the note's total size and the --offset to continue from (BLI-18006).",
+            "shelf [--limit <n>] — the notes YOU have put in, and what became of each.",
+            "shelves — the shelves in use, with how many notes are on each.",
+            "upload <paths...> [--exclude \"<sentence>\"] — put one or more local files in. Explicit paths only; your shell does any globbing, and a file that does not exist is named rather than skipped.",
+            "paste [--file <path>] [--name <n>] [--exclude \"<sentence>\"] — put text in. --file <path> is safest (any editor encoding is decoded). Stdin works too: `pbpaste | cockpit notes paste` on macOS; on Windows use PowerShell 7 (`Get-Clipboard | cockpit notes paste`) — PowerShell 5.1 turns non-ASCII into `?` on pipes.",
+            "--exclude carries your own sentence about what to leave out, exactly as the browser's box does.",
+            "share <id> [--yes] — let everyone signed in read the statements that are safe to share. Asks first in a terminal; --yes is required without one, and --json implies --yes.",
+            "summarize <id> — write a new summary (decisions, action items, key points) where every claim cites the speaker, timestamp and segment id (s12) it came from; claims the transcript does not support are dropped. Takes up to a minute; earlier summaries are kept. `show <id>` prints the newest one.",
+            "unshare <id> — take it back. Never asks: it only ever narrows who can read.",
+            "move <id> (--to \"<shelf>\"|--clear-shelf) — put it on a different shelf, or take the shelf off.",
+            "place <id> [--apply] — say which shelf this note belongs on and why, from the meeting it is part of, who was in the room and its own name. Moves nothing without --apply, and never overrules a shelf somebody typed.",
+            "",
+            "Your own notetaker (BLI-4383). Fellow, Circleback, Fireflies and Wispr Flow today; Otter needs an Enterprise plan and Granola still runs on its own cron.",
+            "accounts [--json] — the notetakers you have connected, with health and when each was last read, and under it who on the team feeds Tower with which notetaker (a member with none is named: that is the gap).",
+            "recordings <note-id> [--json] — every recording of the meeting this note is. When several notetakers or people recorded one meeting, the library shows ONE note, the recording with the longest transcript; the others are alternates kept by id (BLI-12926).",
+            "recording <recording-id> [--json] — one recording, text and all, shown or alternate.",
+            "accounts --show-webhook <account-id> — that account's webhook URL, where to paste it at the vendor, and whether a signing secret is stored (BLI-4394). Until one is, every request to that URL is refused, which is the right way to be off.",
+            "webhook <account-id> --secret-stdin — store the VENDOR's webhook signing secret. THE SECRET IS READ FROM STDIN, never a flag: printf \"%s\" \"<signing secret>\" | cockpit notes webhook <account-id> --secret-stdin",
+            "connect --provider wisprflow — Wispr Flow has no API key: this asks Tower to start the sign-in (the same door the Settings button, the MCP tool notes_connect_wisprflow and JARVIS use), prints and opens Wispr's approval page (Google, Apple, Microsoft or company single sign-on), and waits up to 10 minutes for Tower to report it connected, then Tower reads your Notetaker meetings from then on. Needs Notetaker and MCP access on your Wispr account. Exits 1 with a reason if nothing connects (BLI-12926, BLI-17973).",
+            "connect --provider fellow|circleback|fireflies [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
+            "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
+            "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
+            "sync <account-id> --repair-truncated — re-read Wispr Flow notes that were stored with only the first part of a long transcript (the \"truncated, N chars remaining\" line), and rewrite them whole. Same door and the same bounded passes; prints found, fixed and failed with each failure's reason, and is safe to run again (BLI-18006).",
+            "sync-status [<account-id>] — every notetaker's health, or one's: last successful sync, the last pass's own reason, how many meetings it carried, failures in the last 24h, and the lag between the newest meeting it has read and when it last ran (ticket 10730).",
+            "bot-upcoming [--json] — your own Google Meet meetings today that the bot will join, with claim state. Decline or mark private to opt out.",
+            "granola-status [--limit <n>] [--json] — the Granola cron's own last several runs (ticket 10718): reason, counts, model, spend and which lookback it used. Granola runs on a shared server-side key, not a connected account, so this is its own read rather than `accounts`.",
+            "transcription-stats [--month YYYY-MM] [--json] — what meeting transcription cost and did (BLI-18003): minutes, dollars (list and real), requests, failures and fallbacks per provider for the UTC month (default: this one), the spend against the monthly cap and how close the 80% message and the hold are, how many meetings are waiting for budget, which provider keys the deploy holds (by name), and how old the numbers are. Switch providers or move the cap with `cockpit settings switches set transcription.provider|transcription.fallback_chain|transcription.monthly_cap_usd <value>`.",
+            "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
+            "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
+            "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",
+            "The command uses the existing paired device identity. Run `cockpit login` first if this machine is not paired.",
+        ],
+    ],
+];

package/dist/commands/memory-install-codex.js

@@ -29,10 +29,14 @@
  */
 import path from "node:path";
 import { MEMORY_MCP_SERVER_ID, } from "./memory-install-contract.js";
-import { findTomlTableSpan, readTomlTable, renderTomlTable, upsertTomlTable, } from "./memory-install-toml.js";
+import { findTomlTableSpan } from "./memory-install-toml.js";
 import { memoryCodexSkillFiles } from "./memory-install-skills.js";
 import { installCodexMemoryHooks, inspectCodexMemoryHooks, } from "./memory-install-codex-hooks.js";
+import { applyCodexServerTable, codexConfigUnparseable, codexServerTableMatches, } from "./codex-mcp-table.js";
+import { TOWER_MCP_SERVER_ID } from "./tower-mcp-contract.js";
 const MEMORY_TOML_PATH = ["mcp_servers", MEMORY_MCP_SERVER_ID];
+/** `bli-tower`'s writer runs right after this one and repairs its own table. */
+const SIBLING_TOML_PATH = ["mcp_servers", TOWER_MCP_SERVER_ID];
 export function codexConfigFile(homeDir) {
     return path.join(homeDir, ".codex", "config.toml");
 }
@@ -51,13 +55,15 @@ export async function installCodexMemoryIntegration(options) {
 export async function inspectCodexMemoryIntegration(options) {
     const file = codexConfigFile(options.homeDir);
     const raw = await options.io.readText(file);
+    // BLI-22766: a file Codex cannot load is named first, whatever our table says.
     const mcp = raw === null
         ? { target: "codex_mcp", status: "missing", reason: "file_absent", path: file }
-        : tableMatches(raw, options.config)
-            ? { target: "codex_mcp", status: "installed", reason: "already_current", path: file }
-            : findTomlTableSpan(raw, MEMORY_TOML_PATH)
-                ? { target: "codex_mcp", status: "mismatch", reason: "entry_differs", path: file }
-                : { target: "codex_mcp", status: "missing", reason: "entry_absent", path: file };
+        : codexConfigUnparseable(raw, file, "codex_mcp") ??
+            (codexServerTableMatches(raw, MEMORY_TOML_PATH, options.config)
+                ? { target: "codex_mcp", status: "installed", reason: "already_current", path: file }
+                : findTomlTableSpan(raw, MEMORY_TOML_PATH)
+                    ? { target: "codex_mcp", status: "mismatch", reason: "entry_differs", path: file }
+                    : { target: "codex_mcp", status: "missing", reason: "entry_absent", path: file });
     const directory = codexSkillDirectory(options.homeDir);
     const files = memoryCodexSkillFiles();
     let present = 0;
@@ -85,40 +91,15 @@ export async function inspectCodexMemoryIntegration(options) {
     return [mcp, skills, await inspectCodexMemoryHooks(options)];
 }
 async function applyCodexMcpTable(options) {
-    const file = codexConfigFile(options.homeDir);
-    const raw = (await options.io.readText(file)) ?? "";
-    if (tableMatches(raw, options.config)) {
-        return { target: "codex_mcp", status: "already", reason: "already_current", path: file };
-    }
-    const next = upsertTomlTable(raw, MEMORY_TOML_PATH, renderMemoryTable(options.config), "memory-install");
-    if (options.dryRun) {
-        return { target: "codex_mcp", status: "would_install", reason: "dry_run", path: file };
-    }
-    try {
-        await options.io.writeText(file, next);
-    }
-    catch (error) {
-        return {
-            target: "codex_mcp",
-            status: "failed",
-            reason: "write_failed",
-            path: file,
-            detail: error instanceof Error ? error.message : String(error),
-        };
-    }
-    // BLI-2541: parse the table back out of the stored bytes the way Codex will
-    // read it. A successful write is not a correct registration.
-    const stored = await options.io.readText(file);
-    if (stored === null || !tableMatches(stored, options.config)) {
-        return {
-            target: "codex_mcp",
-            status: "failed",
-            reason: "read_back_mismatch",
-            path: file,
-            detail: "the table on disk does not parse back to the entry that was written",
-        };
-    }
-    return { target: "codex_mcp", status: "installed", reason: "wrote_entry", path: file };
+    return applyCodexServerTable({
+        file: codexConfigFile(options.homeDir),
+        target: "codex_mcp",
+        tablePath: MEMORY_TOML_PATH,
+        siblingPath: SIBLING_TOML_PATH,
+        config: options.config,
+        dryRun: options.dryRun,
+        io: options.io,
+    });
 }
 async function applyCodexSkills(options) {
     const directory = codexSkillDirectory(options.homeDir);
@@ -184,36 +165,4 @@ async function findStaleCodexSkillFiles(directory, files, io) {
             stale.push(relative);
     }
     return stale;
-}
-export function renderMemoryTable(config) {
-    const entries = [
-        ["command", config.mcp_server.command],
-        ["args", config.mcp_server.args],
-    ];
-    if (Object.keys(config.mcp_server.env).length > 0) {
-        entries.push(["env", config.mcp_server.env]);
-    }
-    return renderTomlTable(MEMORY_TOML_PATH, entries);
-}
-function tableMatches(raw, config) {
-    const table = readTomlTable(raw, MEMORY_TOML_PATH);
-    if (!table)
-        return false;
-    if (table["command"] !== config.mcp_server.command)
-        return false;
-    const args = table["args"];
-    if (!Array.isArray(args))
-        return config.mcp_server.args.length === 0;
-    if (args.length !== config.mcp_server.args.length)
-        return false;
-    if (!args.every((entry, index) => entry === config.mcp_server.args[index]))
-        return false;
-    const env = table["env"];
-    for (const [key, value] of Object.entries(config.mcp_server.env)) {
-        if (!env || Array.isArray(env) || typeof env === "string")
-            return false;
-        if (env[key] !== value)
-            return false;
-    }
-    return true;
 }

package/dist/commands/memory-install-toml.js

@@ -121,9 +121,25 @@ export function upsertTomlTable(text, tablePath, renderedTable, logTag) {
     }
     const lines = text.split("\n");
     const before = lines.slice(0, span.start_line);
-    const after = lines.slice(span.end_line);
+    const after = lines.slice(tableContentEnd(lines, span));
     return [...before, ...block.split("\n"), ...after].join("\n");
 }
+/**
+ * Where a table's own lines stop. Comments and blank lines at the tail of a
+ * span usually introduce the NEXT section (BLI-22766: a person's
+ * `# the projects I trust` above `[projects]` was being deleted with our
+ * table), so they are left in place.
+ */
+export function tableContentEnd(lines, span) {
+    let end = span.end_line;
+    while (end > span.start_line + 1) {
+        const trimmed = (lines[end - 1] ?? "").trim();
+        if (trimmed && !trimmed.startsWith("#"))
+            break;
+        end -= 1;
+    }
+    return end;
+}
 /** Removes our table's lines. Used by `--uninstall`-shaped callers and tests. */
 export function removeTomlTable(text, tablePath) {
     const span = findTomlTableSpan(text, tablePath);