@bli-cockpit/cli 0.2.257 → 0.2.259

package/dist/commands/cal.js

@@ -350,6 +350,7 @@ async function create(command, door) {
             ...(command.allDay ? { all_day: true } : {}),
             ...(command.attendees.length > 0 ? { attendees: command.attendees } : {}),
             ...(command.meet ? { meet: true } : {}),
+            ...(command.recurrence?.length ? { recurrence: command.recurrence } : {}),
             ...(command.recheck ? { recheck_availability: true } : {}),
             ...detailFields(command),
             ...(command.idempotencyKey ? { idempotency_key: command.idempotencyKey } : {}),

package/dist/commands/local-args-tower-admin.js

@@ -375,6 +375,18 @@ function parseTeamDeviceArgs(rest, flags, common) {
         }
         return { kind: "team", action: "device-scope", deviceRef, deviceScope, ...common };
     }
+    if (deviceVerb === "mark-service" || deviceVerb === "unmark-service") {
+        const reasonLabel = optionalNonEmpty(flags.get("--reason"));
+        if (!deviceRef || extra.length > 0)
+            throw new Error(`team device ${deviceVerb} takes one <id|name>${deviceVerb === "mark-service" ? " and --reason <label>" : ""}.`);
+        if (deviceVerb === "mark-service") {
+            if (!reasonLabel || !/^[a-z0-9][a-z0-9_-]{1,39}$/.test(reasonLabel)) {
+                throw new Error("team device mark-service needs --reason <label> (2-40 chars: a-z, 0-9, _ or -), e.g. --reason boat-agent.");
+            }
+            return { kind: "team", action: "device-mark-service", deviceRef, reasonLabel, ...common };
+        }
+        return { kind: "team", action: "device-unmark-service", deviceRef, ...common };
+    }
     if (extra.length > 0)
         throw new Error("team device does not accept that many arguments.");
     if (!deviceVerb || deviceVerb === "list") {
@@ -406,7 +418,7 @@ function parseTeamDeviceArgs(rest, flags, common) {
             ...common,
         };
     }
-    throw new Error("team device takes one verb: list, doctor <id|name>, scope <id|name> notetaker_bot|none, or revoke <id|name>.");
+    throw new Error("team device takes one verb: list, doctor <id|name>, scope <id|name> notetaker_bot|none, mark-service <id|name> --reason <label>, unmark-service <id|name>, or revoke <id|name>.");
 }
 /** `cockpit model [show|set <key>]` — the alias surface for the personal chat model. */
 export function parseModelArgs(args) {

package/dist/commands/local-args-tower-cal.js

@@ -78,7 +78,7 @@ const CAL_ALLOWED_FLAGS = [
     "--scope", "--occurrence", "--response", "--comment", "--reminder", "--visibility", "--transparency", "--key",
     "--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone",
     "--with", "--pin", "--remove",
-    "--duration", "--weekends", "--recheck", ...SHARE_BOOLEANS, ...SHARE_VALUE_FLAGS, ...BOOKING_BOOLEANS, ...BOOKING_VALUE_FLAGS, ...REMIND_BOOLEANS, ...REMIND_VALUE_FLAGS, ...LINKS_BOOLEANS, ...LINKS_VALUE_FLAGS,
+    "--duration", "--weekends", "--recheck", "--rrule", ...SHARE_BOOLEANS, ...SHARE_VALUE_FLAGS, ...BOOKING_BOOLEANS, ...BOOKING_VALUE_FLAGS, ...REMIND_BOOLEANS, ...REMIND_VALUE_FLAGS, ...LINKS_BOOLEANS, ...LINKS_VALUE_FLAGS,
 ];
 const CAL_VALUE_FLAGS = [
     "--home",
@@ -104,7 +104,7 @@ const CAL_VALUE_FLAGS = [
     "--reason",
     "--scope", "--occurrence", "--response", "--comment", "--reminder", "--visibility", "--transparency", "--key",
     "--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone",
-    "--with", "--pin", "--remove", "--duration", ...SHARE_VALUE_FLAGS, ...BOOKING_VALUE_FLAGS, ...REMIND_VALUE_FLAGS, ...LINKS_VALUE_FLAGS,
+    "--with", "--pin", "--remove", "--duration", "--rrule", ...SHARE_VALUE_FLAGS, ...BOOKING_VALUE_FLAGS, ...REMIND_VALUE_FLAGS, ...LINKS_VALUE_FLAGS,
 ];
 export function parseCalArgs(args) {
     const values = parseNamedArgs(args, { allowedFlags: CAL_ALLOWED_FLAGS, valueFlags: CAL_VALUE_FLAGS });
@@ -406,8 +406,14 @@ function readPeopleFlags(action, values) {
     }
     if (values.booleans.has("--recheck") && action !== "create")
         throw new Error(`cal ${action} does not take --recheck; it belongs to cal create.`);
-    if (action === "create" && values.booleans.has("--recheck"))
-        return { recheck: true };
+    if (values.flags.has("--rrule") && action !== "create")
+        throw new Error(`cal ${action} does not take --rrule; it belongs to cal create.`);
+    if (action === "create") {
+        const recurrence = (values.flagValues.get("--rrule") ?? []).map((line) => line.trim()).filter(Boolean);
+        if (recurrence.some((line) => !/^(RRULE|EXRULE|RDATE|EXDATE)[:;]/i.test(line)))
+            throw new Error("--rrule takes a Google recurrence line such as \"RRULE:FREQ=WEEKLY;COUNT=4\".");
+        return { ...(values.booleans.has("--recheck") ? { recheck: true } : {}), ...(recurrence.length ? { recurrence } : {}) };
+    }
     if (action === "suggest")
         return readSuggestFlags(values);
     if (action === "availability") {

package/dist/commands/local-args-tower-notes.js

@@ -54,6 +54,7 @@ const NOTES_ACTIONS = new Set([
     "transcription-stats",
     "bot-upcoming",
     "record",
+    "app",
 ]);
 /** Actions whose first positional is the note it acts on. */
 const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
@@ -143,6 +144,7 @@ export function parseNotesArgs(args) {
     if (action === "connect")
         rejectBadConnectRequest(values, provider, workspace, rest);
     const record = action === "record" ? readRecordRequest(rest) : undefined;
+    const app = action === "app" ? readAppRequest(rest) : undefined;
     const paths = readNotesPaths(action, rest);
     if (action === "rename" && !optionalNonEmpty(values.flags.get("--name")))
         throw new Error("notes rename needs --name <name>.");
@@ -166,6 +168,7 @@ export function parseNotesArgs(args) {
         ...(action === "connect" && values.booleans.has("--key-stdin") ? { keyStdin: true } : {}),
         ...(paths ? { paths } : {}),
         ...(record ? record : {}),
+        ...(app ? app : {}),
         filePath: optionalNonEmpty(values.flags.get("--file")),
         name: optionalNonEmpty(values.flags.get("--name")),
         exclude: optionalNonEmpty(values.flags.get("--exclude")),
@@ -190,7 +193,7 @@ function readNotesAction(first) {
     // almost always wants — same reasoning as bare `cockpit` running convergence.
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, summarize, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, granola-status, or transcription-stats (and record start|stop|status|cancel).`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, summarize, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, granola-status, or transcription-stats (and record start|stop|status|cancel, app install|uninstall|status).`);
     }
     return action;
 }
@@ -207,6 +210,16 @@ function readRecordRequest(rest) {
         throw new Error(`notes record ${verb} does not take "${rest[1]}".`);
     return { recordAction: verb };
 }
+const APP_VERBS = ["install", "uninstall", "status"];
+/** BLI-23207: `app <install|uninstall|status>`; bare `app` is the status. */
+function readAppRequest(rest) {
+    const verb = (rest[0] ?? "status");
+    if (!APP_VERBS.includes(verb))
+        throw new Error("notes app needs one of: install, uninstall, status.");
+    if (rest.length > 1)
+        throw new Error(`notes app ${verb} does not take "${rest[1]}".`);
+    return { appAction: verb };
+}
 function readRepairTruncated(action, values) {
     const repairTruncated = values.booleans.has("--repair-truncated");
     if (repairTruncated && action !== "sync") {
@@ -314,6 +327,7 @@ function readNotesPaths(action, rest) {
     }
     const takesNoPositional = action !== "paste"
         && action !== "record"
+        && action !== "app"
         && action !== "connect"
         && action !== "sync"
         && action !== "sync-status"

package/dist/commands/local-help-commands-tower.js

@@ -182,7 +182,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "cal",
         [
-            'Usage: cockpit cal [event <id>|export <id>|today|week|conflicts|calendar-change <id> --color <hex-or-provider>|view-settings|view-settings-change|people <label>|availability --with <label|email> --from <d> --to <d>|overlays [--pin <label|email>|--remove <email>]|suggest --with <label|email> --from <d> --to <d>|availability-share --range <start>/<end> [--link]|availability-revoke <id>|booking-page [--list|--id <id>]|booking-slots <link>|book <link> --start <iso> --name <n> --email <e>|booking-change <manage link> --start <iso>|booking-cancel <manage link>|next|find "<words>"|calendars|add-ical|create [--recheck]|duplicate <event id>|batch|undo [<change id>]|rsvp <event id> --response <accepted|declined|tentative>|change <event id>|cancel <event id> --yes|share <id>|sync <id>|sync-status [<id>]|detach <id>|delete <event id> --yes|remind|join [--event <id> --occurrence <iso>] [--print]|reminders [--on|--off] [--lead <min>] [--sound on|off]|snooze <event id> --occurrence <iso> --minutes <5|10|15>|dismiss <event id> --occurrence <iso>|links <event id> [--occurrence <iso>] [--add doc:<id>|note:<id> [--series]] [--remove <link id>]|agenda [--from <d> --to <d>]] [flags]',
+            'Usage: cockpit cal [event <id>|export <id>|today|week|conflicts|calendar-change <id> --color <hex-or-provider>|view-settings|view-settings-change|people <label>|availability --with <label|email> --from <d> --to <d>|overlays [--pin <label|email>|--remove <email>]|suggest --with <label|email> --from <d> --to <d>|availability-share --range <start>/<end> [--link]|availability-revoke <id>|booking-page [--list|--id <id>]|booking-slots <link>|book <link> --start <iso> --name <n> --email <e>|booking-change <manage link> --start <iso>|booking-cancel <manage link>|next|find "<words>"|calendars|add-ical|create [--recheck] [--rrule <line>]|duplicate <event id>|batch|undo [<change id>]|rsvp <event id> --response <accepted|declined|tentative>|change <event id>|cancel <event id> --yes|share <id>|sync <id>|sync-status [<id>]|detach <id>|delete <event id> --yes|remind|join [--event <id> --occurrence <iso>] [--print]|reminders [--on|--off] [--lead <min>] [--sound on|off]|snooze <event id> --occurrence <iso> --minutes <5|10|15>|dismiss <event id> --occurrence <iso>|links <event id> [--occurrence <iso>] [--add doc:<id>|note:<id> [--series]] [--remove <link id>]|agenda [--from <d> --to <d>]] [flags]',
             "",
             "Every calendar you attached, in one place — plus any calendar a colleague marked shared.",
             "today [--offset 1] [--tz <zone>] — what is on today, in YOUR zone (this machine's, unless --tz says otherwise). --offset 1 is tomorrow, -1 yesterday.",
@@ -192,7 +192,7 @@ export const TOWER_COMMAND_HELP = [
             "conflicts [--from <iso> --to <iso>] [--tz <IANA>] — own-account double-bookings with duplicate invitation merging, checked calendars and age. Visible calendars only by default; --all includes hidden calendars. All-day and free events never conflict.",
             "event <id> [--occurrence-start <iso>] [--tz <zone>] [--json] — exact occurrence details, human recurrence, named guests/RSVP, organizer, source zone, HTTPS Join and edit capability. The selector must match a real occurrence; cancelled/missing instances are refused.",
             "export <id> [--occurrence-start <iso>] [--json] — iCalendar text to stdout; redirect to event.ics. Recurring exports include the complete series and exceptions, keeping source zone/recurrence. No calendar credentials.",
-            "calendar-change <id> --color <hex|provider> — persistent owner colour override, or reset to provider colour. Also accepts stdin JSON {color_override, selected}. History is retained. view-settings [--json] reads your saved view settings (default view, N days, week start, weekends, density, up to 3 extra time zones) plus the calendar actions and keyboard shortcuts; never saved means the defaults, said so. view-settings-change [--view day|week|days|month] [--days 2-9] [--week-start monday|sunday] [--hide-weekends on|off] [--density normal|compact] [--zone <IANA>]... changes only what you name; --zone repeats (up to 3), --zone none clears; stdin JSON like {\"day_count\":4} works too. people <label> [--json] — exact team search: a display name or alias (any case) or an email; an address nobody on the team owns comes back as typed. No fuzzy, prefix or nickname match; an ambiguous label lists every match. availability --with <label|email> [--with ...] --from <d> --to <d> [--tz <IANA>] [--account <id>] [--json] — when people are BUSY, start and end only, asked of Google with your own grant (up to 100 people, 31 days). A person Google will not answer for is unknown, never free. Stdin JSON {with|emails, from, to, tz, account_id} works too. overlays — the people pinned on your calendar (at most 10). overlays --pin <label|email> pins one, overlays --remove <email> drops one; history is kept. The web calendar shows pinned people's busy time. suggest --with <label|email> [--with ...] --from <d> --to <d> [--duration 30] [--hours 09:00-17:00] [--weekends] [--tz <IANA>] [--account <id>] [--limit <n>] [--json] — ranked common free slots for several people (up to 10 shown, 50 max; 15 to 480 minutes): everyone free first, then outside someone's local hours, then slots with an unknown person (never shown as free); Tower defaults (30 minutes, 09:00 to 17:00 your zone, no weekends) are named when used; stdin JSON works. create --recheck re-reads everyone's busy time just before writing and refuses with the reason (slot_taken, slot_unconfirmed) instead of double-booking. availability-share --range <start>/<end> [--range ...] [--duration 30] [--tz <IANA>] [--text|--link] [--expires <iso>] [--location <where>] [--meet] [--single-use] [--allow-conflicts] [--label <s>] [--json] offers your free time inside the ranges (a time without an offset is read in --tz; your own busy time is skipped unless --allow-conflicts): --text (default) prints words to paste, stores nothing, names the zone and the time it was made; --link stores a revocable link (14 days by default, 90 at most) whose times are rechecked on every open and prints the URL ONCE; a repeat of the same --key gives no second link. --list shows your links; --id <id> with --expires or --label changes one; availability-revoke <id> turns one off. Stdin JSON works. If your own calendars could not be fully read it says so. booking-page --title <t> --weekly mon/09:00-12:00 [--weekly ...] [--duration 30] [--buffer-before 0] [--buffer-after 0] [--notice 240] [--window 14] [--meet] [--location <s>] [--single-use] [--tz <IANA>] makes a public booking page on your own Google calendar (30 minutes, no buffers, 4 hours notice, 14 days by default; up to 21 weekly ranges) and prints its link ONCE; --list shows pages and upcoming bookings; --id <id> with --rotate, --close|--open or any field above changes one; stdin JSON works. A guest (no Tower login needed) runs booking-slots <link>, book <link> --start <slot start> --name <n> --email <e> [--note <s>] (3 upcoming bookings per email per page), booking-change <manage link> --start <iso> (the old manage link stops working; the new one shows once) and booking-cancel <manage link>; the manage link expires when the meeting starts. Laptop reminders (slice 11): reminders shows or sets your switch (--on|--off, --lead 0 to 60 minutes, default 10, --sound on|off); they are OFF until you turn them on. Once on, a scheduled `cockpit cal remind` tick (every minute, installed with the sync agent) shows one TOWER banner per meeting per lead time across all your laptops, never one for a meeting you declined or that was cancelled, and records a banner more than 5 minutes late as missed. join opens the link of the meeting running now or starting within 15 minutes (or --event <id> --occurrence <iso>); --print only prints it; a missing or non-https link is refused by name. snooze <event id> --occurrence <iso> --minutes 5|10|15 and dismiss <event id> --occurrence <iso> change one nudge. next leaves out meetings you declined (the door takes ?declined=1 to keep them). Event links (slice 12): links <event id> [--occurrence <iso>] lists YOUR docs and meeting notes linked to that occurrence plus its series, each read again for you (a doc or note you can no longer open prints as unavailable, no title), a note showing its status and recording, alternate and missed counts, and suggests notes the bot recorded for exactly this event (never by title); --add doc:<id>|note:<id> --occurrence <iso> (or --series for every occurrence) attaches one you can read now (20 per event; a repeat is already_linked); --remove <link id> removes it and the history keeps it. A link is private to you and gives attendees no access. agenda [--from <d> --to <d>] [--tz <IANA>] [--json] lists events plus tickets due in the window as DUE lines (all-day markers, never busy time, never sent to Google), with how many rows were read.",
+            "calendar-change <id> --color <hex|provider> — persistent owner colour override, or reset to provider colour. Also accepts stdin JSON {color_override, selected}. History is retained. view-settings [--json] reads your saved view settings (default view, N days, week start, weekends, density, up to 3 extra time zones) plus the calendar actions and keyboard shortcuts (d or 1 day, w or 0 week, m month, 2 to 9 that many days, t today, j and k or the left and right arrows move, c a new event draft, / search, ` the sidebar, \\ the side panel, ? the list, Esc closes one layer); never saved means the defaults, said so. view-settings-change [--view day|week|days|month] [--days 2-9] [--week-start monday|sunday] [--hide-weekends on|off] [--density normal|compact] [--zone <IANA>]... changes only what you name; --zone repeats (up to 3), --zone none clears; stdin JSON like {\"day_count\":4} works too. people <label> [--json] — exact team search: a display name or alias (any case) or an email; an address nobody on the team owns comes back as typed. No fuzzy, prefix or nickname match; an ambiguous label lists every match. availability --with <label|email> [--with ...] --from <d> --to <d> [--tz <IANA>] [--account <id>] [--json] — when people are BUSY, start and end only, asked of Google with your own grant (up to 100 people, 31 days). A person Google will not answer for is unknown, never free. Stdin JSON {with|emails, from, to, tz, account_id} works too. overlays — the people pinned on your calendar (at most 10). overlays --pin <label|email> pins one, overlays --remove <email> drops one; history is kept. The web calendar shows pinned people's busy time. suggest --with <label|email> [--with ...] --from <d> --to <d> [--duration 30] [--hours 09:00-17:00] [--weekends] [--tz <IANA>] [--account <id>] [--limit <n>] [--json] — ranked common free slots for several people (up to 10 shown, 50 max; 15 to 480 minutes): everyone free first, then outside someone's local hours, then slots with an unknown person (never shown as free); Tower defaults (30 minutes, 09:00 to 17:00 your zone, no weekends) are named when used; stdin JSON works. create --recheck re-reads everyone's busy time just before writing and refuses with the reason (slot_taken, slot_unconfirmed) instead of double-booking. create --rrule \"RRULE:FREQ=WEEKLY;COUNT=4\" makes the event repeat (a Google recurrence line; repeatable for EXDATE or RDATE lines). availability-share --range <start>/<end> [--range ...] [--duration 30] [--tz <IANA>] [--text|--link] [--expires <iso>] [--location <where>] [--meet] [--single-use] [--allow-conflicts] [--label <s>] [--json] offers your free time inside the ranges (a time without an offset is read in --tz; your own busy time is skipped unless --allow-conflicts): --text (default) prints words to paste, stores nothing, names the zone and the time it was made; --link stores a revocable link (14 days by default, 90 at most) whose times are rechecked on every open and prints the URL ONCE; a repeat of the same --key gives no second link. --list shows your links; --id <id> with --expires or --label changes one; availability-revoke <id> turns one off. Stdin JSON works. If your own calendars could not be fully read it says so. booking-page --title <t> --weekly mon/09:00-12:00 [--weekly ...] [--duration 30] [--buffer-before 0] [--buffer-after 0] [--notice 240] [--window 14] [--meet] [--location <s>] [--single-use] [--tz <IANA>] makes a public booking page on your own Google calendar (30 minutes, no buffers, 4 hours notice, 14 days by default; up to 21 weekly ranges) and prints its link ONCE; --list shows pages and upcoming bookings; --id <id> with --rotate, --close|--open or any field above changes one; stdin JSON works. A guest (no Tower login needed) runs booking-slots <link>, book <link> --start <slot start> --name <n> --email <e> [--note <s>] (3 upcoming bookings per email per page), booking-change <manage link> --start <iso> (the old manage link stops working; the new one shows once) and booking-cancel <manage link>; the manage link expires when the meeting starts. Laptop reminders (slice 11): reminders shows or sets your switch (--on|--off, --lead 0 to 60 minutes, default 10, --sound on|off); they are OFF until you turn them on. Once on, a scheduled `cockpit cal remind` tick (every minute, installed with the sync agent) shows one TOWER banner per meeting per lead time across all your laptops, never one for a meeting you declined or that was cancelled, and records a banner more than 5 minutes late as missed. join opens the link of the meeting running now or starting within 15 minutes (or --event <id> --occurrence <iso>); --print only prints it; a missing or non-https link is refused by name. snooze <event id> --occurrence <iso> --minutes 5|10|15 and dismiss <event id> --occurrence <iso> change one nudge. next leaves out meetings you declined (the door takes ?declined=1 to keep them). Event links (slice 12): links <event id> [--occurrence <iso>] lists YOUR docs and meeting notes linked to that occurrence plus its series, each read again for you (a doc or note you can no longer open prints as unavailable, no title), a note showing its status and recording, alternate and missed counts, and suggests notes the bot recorded for exactly this event (never by title); --add doc:<id>|note:<id> --occurrence <iso> (or --series for every occurrence) attaches one you can read now (20 per event; a repeat is already_linked); --remove <link id> removes it and the history keeps it. A link is private to you and gives attendees no access. agenda [--from <d> --to <d>] [--tz <IANA>] [--json] lists events plus tickets due in the window as DUE lines (all-day markers, never busy time, never sent to Google), with how many rows were read.",
             "calendars — every calendar, its provider (google_oauth or ical_url), whether it is shared, and when it last synced. The ids other verbs take are on the last line.",
             "add-ical [--name \"<what to call it>\"] — attaches a personal calendar by its SECRET iCal ADDRESS, read from stdin. There is no flag for it:",
             '      macOS:      printf "%s" "https://calendar.google.com/calendar/ical/…/basic.ics" | cockpit cal add-ical --name "Personal"',

package/dist/commands/local-help-commands.js

@@ -211,6 +211,11 @@ const COMMAND_HELP = new Map([
             "  cockpit team device scope <id|name> notetaker_bot|none [--json]",
             "      Super admin only. Gives the meeting bot's device the scope Tower's claim door requires,",
             "      or takes it away. Without it the bot is refused every meeting (bot_scope_required).",
+            "  cockpit team device mark-service <id|name> --reason <label> [--json]",
+            "  cockpit team device unmark-service <id|name> [--json]",
+            "      Super admin only. Marks a device as automation (cloud agents, alert senders) so the fleet board",
+            "      lists it under service identities, judged only on when it last called Tower, instead of a red laptop.",
+            "      --reason is a short label such as boat-agent. Only this door can set it; a device cannot.",
             "  cockpit team device revoke <id|name> --reason <label> [--note \"<text>\"] [--yes]",
             "      Admin only. Names the device, asks first unless --yes, then revokes it —",
             "      this cannot be undone. --reason must be one of: stale_test_pairing,",

package/dist/commands/local-help-notes.js

@@ -3,10 +3,11 @@ export const NOTES_HELP = [
     [
         "notes",
         [
-            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>|record start|stop|status|cancel] [flags]",
+            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>|record start|stop|status|cancel|app install|uninstall|status] [flags]",
             "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 1 GB. Over 4 MB (a whole meeting) the file goes straight to storage and is transcribed in the background; --wait then polls for up to 4 hours and prints progress, otherwise for at most 330 seconds.",
             "",
             "record start|stop [<session-id>]|status|cancel — record a meeting in a room from this Mac's microphone (Apple Silicon macOS; Windows says it is not supported yet). Nothing leaves the machine while recording and there is no auto-stop. `stop` trims the silence away locally, uploads only the speech, and Tower writes a note with Speaker 1, Speaker 2... lines (add --wait to watch the transcription). `cancel` stops and KEEPS the file; `status` lists what is recording or waiting; `stop <session-id>` finishes a cancelled or crashed session. The original recording stays on this machine.",
+            "app install|uninstall|status [--json] — the BLI Notetaker menu-bar app (Apple Silicon macOS; Windows and Linux say they are not supported yet). `install` asks Tower for the newest release, downloads it, refuses it if its sha256 differs, puts it in ~/Applications/BLI Notetaker.app (replacing an older one), clears the download quarantine and starts it at login with a LaunchAgent. The menu runs the `record` verbs above: Record, Stop, Open last note, Finish last recording. Log: ~/Library/Logs/BLI Notetaker.log. `uninstall` removes the app and the LaunchAgent and keeps your recordings; `status` says what is installed, whether it runs, and whether a newer release exists.",
             "folders [--tree] [--json]: list folders and visible note counts.",
             "mkdir <path> [--json]: create a folder and any missing ancestors.",
             "rename <path> --name <name> [--json]: rename a folder and its descendant paths.",

package/dist/commands/notes-app-plist.js

@@ -0,0 +1,58 @@
+/**
+ * BLI-23207: where the BLI Notetaker menu-bar app lives on a Mac, and the
+ * LaunchAgent that starts it at login. Sibling of `notes-app.ts`, which installs it.
+ *
+ * The LaunchAgent runs the bundle's executable directly (RunAtLoad, KeepAlive
+ * false: Quit means quit) and routes the app's stderr, where its
+ * `[notetaker-app]` log lines go, to `~/Library/Logs/BLI Notetaker.log`. Two
+ * environment values ride along: the paired Tower address, so "Open last
+ * note" opens the right dashboard without the app ever reading the CLI's
+ * session file (it holds the device token), and the person's login shell, which
+ * the app asks once for `node` and `cockpit` (launchd's PATH has neither).
+ */
+import path from "node:path";
+import { getCollectorRuntimePaths } from "../local-state-paths.js";
+import { xmlEscape } from "../autostart-xml.js";
+export const NOTETAKER_APP_LABEL = "ca.buildlaunchiterate.notetaker";
+export const NOTETAKER_APP_NAME = "BLI Notetaker.app";
+export const NOTETAKER_APP_EXECUTABLE = "bli-notetaker";
+export function notetakerAppPaths(homeDir) {
+    const applications = path.join(homeDir, "Applications");
+    const app = path.join(applications, NOTETAKER_APP_NAME);
+    return {
+        app,
+        executable: path.join(app, "Contents", "MacOS", NOTETAKER_APP_EXECUTABLE),
+        applications,
+        plist: path.join(homeDir, "Library", "LaunchAgents", `${NOTETAKER_APP_LABEL}.plist`),
+        log: path.join(homeDir, "Library", "Logs", "BLI Notetaker.log"),
+        receipt: path.join(getCollectorRuntimePaths(homeDir).state_dir, "notetaker-app.json"),
+    };
+}
+export function renderNotetakerAppPlist(input) {
+    const env = [];
+    if (input.towerUrl)
+        env.push(["BLI_TOWER_URL", input.towerUrl]);
+    if (input.shell && input.shell.startsWith("/"))
+        env.push(["SHELL", input.shell]);
+    const s = (value) => `<string>${xmlEscape(value)}</string>`;
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        "<dict>",
+        `  <key>Label</key>${s(NOTETAKER_APP_LABEL)}`,
+        `  <key>ProgramArguments</key><array>${s(input.paths.executable)}</array>`,
+        "  <key>RunAtLoad</key><true/>",
+        "  <key>KeepAlive</key><false/>",
+        `  <key>ProcessType</key>${s("Interactive")}`,
+        `  <key>LimitLoadToSessionType</key>${s("Aqua")}`,
+        `  <key>StandardOutPath</key>${s(input.paths.log)}`,
+        `  <key>StandardErrorPath</key>${s(input.paths.log)}`,
+        ...(env.length
+            ? ["  <key>EnvironmentVariables</key>", "  <dict>", ...env.map(([k, v]) => `    <key>${xmlEscape(k)}</key>${s(v)}`), "  </dict>"]
+            : []),
+        "</dict>",
+        "</plist>",
+        "",
+    ].join("\n");
+}

package/dist/commands/notes-app.js

@@ -0,0 +1,225 @@
+/**
+ * `cockpit notes app install | uninstall | status` (BLI-23207): put the BLI
+ * Notetaker menu-bar app on this Mac, take it off, or say what is there.
+ *
+ *   install    asks Tower for the newest `notetaker-app-v*` release
+ *              (`GET /api/notes/app/release`; the repository is private, so
+ *              Tower reads it with its own GitHub token and hands back the
+ *              sha256 and a short-lived signed download link), downloads the
+ *              zip, REFUSES it if the hash differs, unpacks it to
+ *              `~/Applications/BLI Notetaker.app` (replacing an older one),
+ *              clears the download quarantine, writes the LaunchAgent and
+ *              starts it.
+ *   uninstall  stops it and removes the app, the LaunchAgent and the receipt.
+ *              Recordings and the log stay.
+ *   status     what is installed, whether it is running, and whether a newer
+ *              release exists.
+ *
+ * Apple Silicon macOS only; Windows and Linux are refused by name. The app is
+ * a shell over `cockpit notes record`; it captures nothing itself. Its layout
+ * and LaunchAgent are `notes-app-plist.ts`.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { launchdUserDomain, reregisterDarwinAgent } from "../autostart-darwin.js";
+import { writeLine } from "./cli-io.js";
+import { ask } from "./notes-door.js";
+import { NOTETAKER_APP_EXECUTABLE, NOTETAKER_APP_LABEL, NOTETAKER_APP_NAME, notetakerAppPaths, renderNotetakerAppPlist, } from "./notes-app-plist.js";
+const TAG = "[notes app]";
+const RELEASE_DEADLINE_MS = 30_000;
+const DOWNLOAD_DEADLINE_MS = 10 * 60_000;
+function say(io, command, human, json) {
+    writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, ...json }) : human);
+    return 0;
+}
+function refuse(io, command, reason, sentence, fields = {}) {
+    writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason, ...fields })}`);
+    if (command.json)
+        writeLine(io.stdout, JSON.stringify({ ok: false, reason, detail: sentence }));
+    else
+        writeLine(io.stderr, sentence);
+    return 1;
+}
+const exists = async (file) => stat(file).then(() => true, () => false);
+async function readReceipt(file) {
+    try {
+        const parsed = JSON.parse(await readFile(file, "utf8"));
+        return typeof parsed.tag === "string" && typeof parsed.version === "string" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function runNotesApp(command, io, deps) {
+    const verb = command.appAction ?? "status";
+    if (deps.platform !== "darwin") {
+        const where = deps.platform === "win32" ? "Windows" : deps.platform === "linux" ? "Linux" : deps.platform;
+        return refuse(io, command, "platform_not_supported", `The BLI Notetaker app is not available on ${where} yet. It runs in the menu bar on Apple Silicon Macs; Windows is a follow-up. \`cockpit notes record\` is the terminal way to record.`, { platform: deps.platform });
+    }
+    const paths = notetakerAppPaths(deps.homeDir);
+    if (verb === "uninstall")
+        return await uninstall(command, io, deps, paths);
+    if (verb === "install")
+        return await install(command, io, deps, paths);
+    return await status(command, io, deps, paths);
+}
+/** Ask the paired Tower for the newest release; a refusal comes back as reason + sentence. */
+async function newestRelease(deps) {
+    const door = await deps.door();
+    if (!("deviceToken" in door))
+        return { ok: false, reason: door.reason, detail: door.detail };
+    const answer = await ask(door, { path: "/api/notes/app/release", method: "GET", label: "notes app release", timeoutMs: RELEASE_DEADLINE_MS });
+    if (!answer.ok)
+        return answer;
+    const body = answer.body;
+    const sha = typeof body.sha256 === "string" ? body.sha256.toLowerCase() : "";
+    if (!body.tag || !body.version || !/^[0-9a-f]{64}$/.test(sha) || !body.zip?.url?.startsWith("https://")) {
+        return { ok: false, reason: "release_answer_unreadable", detail: "Tower answered without a release this command can install." };
+    }
+    return { ok: true, release: { tag: body.tag, version: body.version, sha256: sha, zip: body.zip }, door };
+}
+/** Stream `url` to `dest`, hashing as it goes. No credential is sent: the link is GitHub's own signed one. */
+export async function downloadToFile(fetchImpl, url, dest) {
+    let response;
+    try {
+        response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_DEADLINE_MS) });
+    }
+    catch {
+        return { ok: false, reason: "download_unreachable" };
+    }
+    if (!response.ok || !response.body)
+        return { ok: false, reason: `download_http_${response.status}` };
+    const hash = createHash("sha256");
+    let bytes = 0;
+    const meter = new Transform({
+        transform(chunk, _encoding, done) {
+            hash.update(chunk);
+            bytes += chunk.length;
+            done(null, chunk);
+        },
+    });
+    try {
+        await pipeline(Readable.fromWeb(response.body), meter, createWriteStream(dest, { mode: 0o600 }));
+    }
+    catch {
+        return { ok: false, reason: "download_interrupted" };
+    }
+    return { ok: true, bytes, sha256: hash.digest("hex") };
+}
+async function appleSilicon(deps) {
+    const answer = await deps.exec("sysctl", ["-n", "hw.optional.arm64"]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+    return answer.code === 0 && answer.stdout.trim() === "1";
+}
+async function install(command, io, deps, paths) {
+    if (!(await appleSilicon(deps))) {
+        return refuse(io, command, "apple_silicon_only", "The BLI Notetaker app is built for Apple Silicon Macs (M1 and later); this Mac is not one. `cockpit notes record` works here from a terminal.");
+    }
+    const found = await newestRelease(deps);
+    if (!found.ok)
+        return refuse(io, command, found.reason, found.detail);
+    const { release, door } = found;
+    const previous = await readReceipt(paths.receipt);
+    writeLine(io.stderr, `${TAG} release ${JSON.stringify({ tag: release.tag, zip_bytes: release.zip.bytes, previous: previous?.tag ?? null })}`);
+    if (!command.json)
+        writeLine(io.stderr, `Downloading BLI Notetaker ${release.version} (${(release.zip.bytes / 1_000_000).toFixed(1)} MB)...`);
+    await mkdir(paths.applications, { recursive: true });
+    const staging = path.join(paths.applications, `.bli-notetaker-install-${randomBytes(4).toString("hex")}`);
+    await mkdir(staging, { recursive: true, mode: 0o700 });
+    try {
+        const zip = path.join(staging, "app.zip");
+        const downloaded = await downloadToFile(io.fetch, release.zip.url, zip);
+        if (!downloaded.ok) {
+            return refuse(io, command, downloaded.reason, `The download did not finish (${downloaded.reason}). Nothing was installed; try again.`);
+        }
+        if (downloaded.sha256 !== release.sha256) {
+            return refuse(io, command, "sha256_mismatch", "The downloaded app does not match the checksum its release publishes, so it was not installed. Nothing on this Mac changed.", { tag: release.tag, bytes: downloaded.bytes, expected_prefix: release.sha256.slice(0, 12), got_prefix: downloaded.sha256.slice(0, 12) });
+        }
+        writeLine(io.stderr, `${TAG} downloaded ${JSON.stringify({ tag: release.tag, bytes: downloaded.bytes, sha256_prefix: downloaded.sha256.slice(0, 12), reason: "sha256_match" })}`);
+        const unpacked = path.join(staging, "unpacked");
+        const ditto = await deps.exec("ditto", ["-x", "-k", zip, unpacked]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+        const stagedApp = path.join(unpacked, NOTETAKER_APP_NAME);
+        if (ditto.code !== 0 || !(await exists(path.join(stagedApp, "Contents", "MacOS", NOTETAKER_APP_EXECUTABLE)))) {
+            return refuse(io, command, "bundle_unreadable", "The downloaded zip did not hold a BLI Notetaker app. Nothing was installed.", { ditto_exit: ditto.code });
+        }
+        // Stop the running copy first. A recording in progress keeps going: the recorder is its own process, and the new app adopts it.
+        const stopped = await deps.exec("launchctl", ["bootout", `${launchdUserDomain(deps.uid)}/${NOTETAKER_APP_LABEL}`]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+        const replaced = await exists(paths.app);
+        if (replaced)
+            await rm(paths.app, { recursive: true, force: true });
+        await rename(stagedApp, paths.app);
+        const xattr = await deps.exec("xattr", ["-dr", "com.apple.quarantine", paths.app]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+        writeLine(io.stderr, `${TAG} unpacked ${JSON.stringify({ replaced, previous: previous?.tag ?? null, bootout_exit: stopped.code, xattr_exit: xattr.code })}`);
+        await mkdir(path.dirname(paths.plist), { recursive: true });
+        await mkdir(path.dirname(paths.log), { recursive: true });
+        await writeFile(paths.plist, renderNotetakerAppPlist({ paths, towerUrl: door.dashboardUrl, shell: deps.shell }), "utf8");
+        const receipt = { tag: release.tag, version: release.version, sha256: release.sha256, installed_at: deps.now().toISOString() };
+        await mkdir(path.dirname(paths.receipt), { recursive: true });
+        await writeFile(paths.receipt, `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+        const started = await reregisterDarwinAgent({ exec: deps.exec, plistPath: paths.plist, uid: deps.uid, label: NOTETAKER_APP_LABEL });
+        if (!started.ok) {
+            return refuse(io, command, "launchagent_bootstrap_failed", `BLI Notetaker ${release.version} is installed at ${paths.app}, but launchd would not start it (${started.detail ?? started.reason}). Open it from ~/Applications, or run \`cockpit notes app install\` again.`, { tag: release.tag });
+        }
+        writeLine(io.stderr, `${TAG} installed ${JSON.stringify({ tag: release.tag, replaced, reason: started.reason })}`);
+        return say(io, command, [
+            `Installed BLI Notetaker ${release.version}${replaced ? ` (replaced ${previous?.version ?? "an older copy"})` : ""} and started it.`,
+            "Look for the ring in the menu bar: Record, Stop, Open last note. It starts again at login.",
+            `App: ${paths.app}`,
+            `Log: ${paths.log}`,
+            "The app is ad-hoc signed, not notarized; the installer cleared the download quarantine so macOS opens it. The first Record asks for the microphone.",
+        ].join("\n"), { installed: true, tag: release.tag, version: release.version, replaced, previous: previous?.tag ?? null, app: paths.app, launch_agent: paths.plist, log: paths.log });
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+async function uninstall(command, io, deps, paths) {
+    const stopped = await deps.exec("launchctl", ["bootout", `${launchdUserDomain(deps.uid)}/${NOTETAKER_APP_LABEL}`]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+    const had = { app: await exists(paths.app), launch_agent: await exists(paths.plist), receipt: await exists(paths.receipt) };
+    await rm(paths.plist, { force: true });
+    await rm(paths.app, { recursive: true, force: true });
+    await rm(paths.receipt, { force: true });
+    writeLine(io.stderr, `${TAG} uninstalled ${JSON.stringify({ ...had, bootout_exit: stopped.code })}`);
+    if (!had.app && !had.launch_agent) {
+        return say(io, command, "BLI Notetaker was not installed. Nothing to remove.", { removed: false });
+    }
+    return say(io, command, [
+        "Removed BLI Notetaker: the app, its LaunchAgent and its receipt.",
+        `Your recordings stay on this Mac (\`cockpit notes record status\` lists any not yet uploaded), and so does the log: ${paths.log}`,
+    ].join("\n"), { removed: true, ...had });
+}
+async function status(command, io, deps, paths) {
+    const receipt = await readReceipt(paths.receipt);
+    const installed = await exists(paths.executable);
+    const plist = await exists(paths.plist);
+    const printed = await deps.exec("launchctl", ["print", `${launchdUserDomain(deps.uid)}/${NOTETAKER_APP_LABEL}`]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+    const loaded = printed.code === 0;
+    const running = loaded && /\bstate = running\b/.test(printed.stdout);
+    const pid = Number(/\bpid = (\d+)/.exec(printed.stdout)?.[1] ?? NaN);
+    // The newest release is best effort: a status line without it is still an answer.
+    const newest = await newestRelease(deps);
+    const newestTag = newest.ok ? newest.release.tag : null;
+    const update = Boolean(installed && newestTag && receipt?.tag !== newestTag);
+    writeLine(io.stderr, `${TAG} status ${JSON.stringify({ installed, tag: receipt?.tag ?? null, plist, loaded, running, newest: newestTag, newest_reason: newest.ok ? null : newest.reason })}`);
+    const json = {
+        installed, tag: receipt?.tag ?? null, version: receipt?.version ?? null, installed_at: receipt?.installed_at ?? null,
+        app: paths.app, launch_agent: { path: paths.plist, present: plist, loaded, running, pid: Number.isFinite(pid) ? pid : null },
+        log: paths.log, newest: newest.ok ? { tag: newest.release.tag, version: newest.release.version } : { reason: newest.reason },
+        update_available: update,
+    };
+    const lines = installed
+        ? [
+            `BLI Notetaker ${receipt?.version ?? "(version unknown)"} is installed: ${paths.app}`,
+            running ? `Running (pid ${pid}).` : loaded ? "Registered with launchd but not running; it starts at login, or run `cockpit notes app install` to start it now." : plist ? "Its LaunchAgent is on disk but not loaded; run `cockpit notes app install` to start it." : "No LaunchAgent; run `cockpit notes app install` to start it at login.",
+            newest.ok ? (update ? `A newer release exists: ${newest.release.version}. Run \`cockpit notes app install\` to update.` : "It is the newest release.") : `Could not check for a newer release (${newest.reason}).`,
+            `Log: ${paths.log}`,
+        ]
+        : [
+            "BLI Notetaker is not installed. Run `cockpit notes app install`.",
+            newest.ok ? `Newest release: ${newest.release.version}.` : `Could not check the newest release (${newest.reason}).`,
+        ];
+    return say(io, command, lines.join("\n"), json);
+}

package/dist/commands/notes.js

@@ -36,11 +36,14 @@
  *  - `notes-granola-status.ts` — ticket 10718: the Granola CRON's own health
  *    (it runs on a shared server-side key, not a `notes_accounts` row), read
  *    off its `granola_sync_runs` ledger.
+ *  - `notes-app.ts` — BLI-23207: `app install|uninstall|status`, the BLI
+ *    Notetaker menu-bar app on this Mac (its LaunchAgent: `notes-app-plist.ts`).
  *  - `notes-transcription-stats.ts` — BLI-18003: what meeting transcription
  *    cost and did per provider for a month, and the spend against the cap.
  *
  * Every public name is still importable from this file.
  */
+import os from "node:os";
 import { loadPairedSession } from "../tower-client.js";
 import { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 import { uploadNotes, pasteNote, shareNote, summarizeNote, moveNote, placeNote } from "./notes-writes.js";
@@ -51,6 +54,8 @@ import { showGranolaStatus } from "./notes-granola-status.js";
 import { showTranscriptionStats } from "./notes-transcription-stats.js";
 import { listRecordings, showRecording } from "./notes-recordings.js";
 import { defaultRecordDeps, runNotesRecord } from "./notes-record.js";
+import { runNotesApp } from "./notes-app.js";
+import { defaultExec, errorMessage } from "./cli-io.js";
 export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 export { uploadNotes, pasteNote, shareNote, summarizeNote, moveNote, placeNote } from "./notes-writes.js";
 export { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, syncStatusNotetakers, } from "./notes-accounts.js";
@@ -100,6 +105,26 @@ export async function runNotes(command, io) {
             });
         }));
     }
+    // BLI-23207: the menu-bar app is installed on this Mac; only install and status ask Tower (for the newest release).
+    if (command.action === "app") {
+        return runNotesApp(command, io, {
+            platform: process.platform,
+            homeDir: command.homeDir ?? os.homedir(),
+            uid: process.getuid?.() ?? 0,
+            exec: io.exec ?? defaultExec(),
+            shell: io.env.SHELL,
+            now: () => new Date(),
+            door: async () => {
+                try {
+                    const session = await loadPairedSession("notes app", command.homeDir);
+                    return { dashboardUrl: command.dashboardUrl ?? session.dashboard_url, deviceToken: session.device_token, io, json: command.json };
+                }
+                catch (error) {
+                    return { reason: "not_paired", detail: errorMessage(error) };
+                }
+            },
+        });
+    }
     const session = await loadPairedSession("notes", command.homeDir);
     const door = {
         dashboardUrl: command.dashboardUrl ?? session.dashboard_url,

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.257");
+    writeLine(io?.stdout ?? process.stdout, "0.2.259");
     return 0;
   }
 

package/dist/commands/team.js

@@ -41,6 +41,8 @@ export async function runTeam(command, io) {
         return deviceDoctor(command, tower, io);
     if (command.action === "device-scope")
         return deviceScope(command, tower, io);
+    if (command.action === "device-mark-service" || command.action === "device-unmark-service")
+        return deviceMarkService(command, tower, io);
     return deviceRevoke(command, tower, io);
 }
 async function showMembers(command, tower, io) {
@@ -246,6 +248,37 @@ async function deviceScope(command, tower, io) {
         : command.deviceScope === "none" ? `Took the service scope away from ${name}.` : `${name} now holds the notetaker_bot scope. The bot's next claim will go through.`);
     return 0;
 }
+/**
+ * `cockpit team device mark-service <id|name> --reason <label>` and `unmark-service <id|name>` (ticket 23031): the ONE
+ * door that tells the fleet board a device is automation, not a laptop. Super admin on the server.
+ */
+async function deviceMarkService(command, tower, io) {
+    const mark = command.action === "device-mark-service";
+    const listed = await callTower(tower, { path: "/api/team/devices", label: "team device mark-service lookup" });
+    if (!listed.ok)
+        return writeCommandFailure(io, command.json, listed);
+    const device = findDevice(devicesOf(asRecord(listed.body)), command.deviceRef ?? "");
+    if (!device)
+        return writeCommandFailure(io, command.json, { reason: "device_not_found", detail: "No unique device matches. Run cockpit team device list to see ids and names." });
+    const result = await callTower(tower, {
+        path: `/api/ambient/devices/${encodeURIComponent(device.device_id)}/service-mark`,
+        method: "POST", label: "team device mark-service", body: mark ? { mark: true, reason: command.reasonLabel } : { mark: false },
+    });
+    writeLine(io.stderr, `[team cli] device mark-service ${JSON.stringify({ device_id: device.device_id, mark, reason: mark ? command.reasonLabel : null, outcome: result.ok ? "answered" : result.reason })}`);
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    const name = String(device.device_name ?? device.device_id);
+    writeLine(io.stdout, body.changed === false
+        ? `${name} was already ${mark ? "marked as automation" : "not marked"}. Nothing changed.`
+        : mark ? `${name} is now marked as automation (${command.reasonLabel}). The fleet board lists it under service identities.`
+            : `Took the automation mark off ${name}. The fleet board grades it as a laptop again.`);
+    return 0;
+}
 /** Exact directory labels locate a roster id; attribution remains the server resolver's job. */
 async function githubLogin(command, tower, io) {
     let personId = command.personRef ?? "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.257",
+  "version": "0.2.259",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.76",
-    "@bli-cockpit/mcp": "0.1.157",
-    "@bli-cockpit/telemetry-core": "0.1.83"
+    "@bli-cockpit/memory-mcp": "0.1.77",
+    "@bli-cockpit/mcp": "0.1.159",
+    "@bli-cockpit/telemetry-core": "0.1.84"
   },
   "repository": {
     "type": "git",