@bli-cockpit/cli 0.2.258 → 0.2.260

package/dist/commands/cal.js

@@ -350,6 +350,7 @@ async function create(command, door) {
             ...(command.allDay ? { all_day: true } : {}),
             ...(command.attendees.length > 0 ? { attendees: command.attendees } : {}),
             ...(command.meet ? { meet: true } : {}),
+            ...(command.recurrence?.length ? { recurrence: command.recurrence } : {}),
             ...(command.recheck ? { recheck_availability: true } : {}),
             ...detailFields(command),
             ...(command.idempotencyKey ? { idempotency_key: command.idempotencyKey } : {}),

package/dist/commands/local-args-tower-cal.js

@@ -78,7 +78,7 @@ const CAL_ALLOWED_FLAGS = [
     "--scope", "--occurrence", "--response", "--comment", "--reminder", "--visibility", "--transparency", "--key",
     "--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone",
     "--with", "--pin", "--remove",
-    "--duration", "--weekends", "--recheck", ...SHARE_BOOLEANS, ...SHARE_VALUE_FLAGS, ...BOOKING_BOOLEANS, ...BOOKING_VALUE_FLAGS, ...REMIND_BOOLEANS, ...REMIND_VALUE_FLAGS, ...LINKS_BOOLEANS, ...LINKS_VALUE_FLAGS,
+    "--duration", "--weekends", "--recheck", "--rrule", ...SHARE_BOOLEANS, ...SHARE_VALUE_FLAGS, ...BOOKING_BOOLEANS, ...BOOKING_VALUE_FLAGS, ...REMIND_BOOLEANS, ...REMIND_VALUE_FLAGS, ...LINKS_BOOLEANS, ...LINKS_VALUE_FLAGS,
 ];
 const CAL_VALUE_FLAGS = [
     "--home",
@@ -104,7 +104,7 @@ const CAL_VALUE_FLAGS = [
     "--reason",
     "--scope", "--occurrence", "--response", "--comment", "--reminder", "--visibility", "--transparency", "--key",
     "--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone",
-    "--with", "--pin", "--remove", "--duration", ...SHARE_VALUE_FLAGS, ...BOOKING_VALUE_FLAGS, ...REMIND_VALUE_FLAGS, ...LINKS_VALUE_FLAGS,
+    "--with", "--pin", "--remove", "--duration", "--rrule", ...SHARE_VALUE_FLAGS, ...BOOKING_VALUE_FLAGS, ...REMIND_VALUE_FLAGS, ...LINKS_VALUE_FLAGS,
 ];
 export function parseCalArgs(args) {
     const values = parseNamedArgs(args, { allowedFlags: CAL_ALLOWED_FLAGS, valueFlags: CAL_VALUE_FLAGS });
@@ -406,8 +406,14 @@ function readPeopleFlags(action, values) {
     }
     if (values.booleans.has("--recheck") && action !== "create")
         throw new Error(`cal ${action} does not take --recheck; it belongs to cal create.`);
-    if (action === "create" && values.booleans.has("--recheck"))
-        return { recheck: true };
+    if (values.flags.has("--rrule") && action !== "create")
+        throw new Error(`cal ${action} does not take --rrule; it belongs to cal create.`);
+    if (action === "create") {
+        const recurrence = (values.flagValues.get("--rrule") ?? []).map((line) => line.trim()).filter(Boolean);
+        if (recurrence.some((line) => !/^(RRULE|EXRULE|RDATE|EXDATE)[:;]/i.test(line)))
+            throw new Error("--rrule takes a Google recurrence line such as \"RRULE:FREQ=WEEKLY;COUNT=4\".");
+        return { ...(values.booleans.has("--recheck") ? { recheck: true } : {}), ...(recurrence.length ? { recurrence } : {}) };
+    }
     if (action === "suggest")
         return readSuggestFlags(values);
     if (action === "availability") {

package/dist/commands/local-args-tower-msg.js

@@ -1,5 +1,7 @@
 import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** One `@`, no spaces: `"ping @bob"` is text, not an address (BLI-23213). */
+const DM_ADDRESS_PATTERN = /^[^\s@]+@[^\s@]+$/;
 import { MSG_CHANNEL_BOOLEAN_FLAGS, MSG_CHANNEL_VALUE_FLAGS, isMsgChannelAction, msgChannelNormalizeArgs, parseMsgChannelArgs, rejectMsgChannelFlags } from "./msg-channel-args.js";
 import { MSG_CONTEXT_VALUE_FLAGS, parseMsgContextArgs, rejectMsgContextFlags } from "./msg-context-args.js";
 import { MSG_MARK_VALUE_FLAGS, isMsgMarkAction, parseMsgMarkArgs, rejectMsgMarkFlags } from "./msg-mark-args.js";
@@ -123,14 +125,16 @@ export function parseMsgArgs(rawArgs) {
         throw new Error("--before belongs to msg read or msg thread.");
     }
     const { markRead, unreadFrom } = parseMsgReadLineFlags(action, values);
-    const { channelName, dmEmail } = parseMsgCreateTarget(action, rest);
+    const { channelName, dmEmail, dmTextArgument } = parseMsgCreateTarget(action, rest);
     const { isPrivate, memberEmails, description } = parseMsgCreateFlags(action, values);
     const { channelRef, threadId, limit } = parseMsgReadTarget(action, rest, values);
     const writeSafety = parseMsgWriteSafety(action, rest, values);
     const built = buildMsgCommand(values, action, channelRef, channelName, dmEmail, memberEmails, description, isPrivate, threadId, limit, markRead, unreadFrom, writeSafety);
     // `msg dm a@x b@y` is a group message: the single-address shape (dmEmail) is unchanged (BLI-21685).
     const withGroup = action === "dm" && rest.length > 1 ? { ...built, dmEmails: rest } : built;
-    return fileIds.length > 0 ? { ...withGroup, fileIds } : withGroup;
+    // BLI-23213: text typed after `msg dm <email>` is refused by name at run time (no help dump); the text is piped in.
+    const withText = dmTextArgument ? { ...withGroup, dmTextArgument } : withGroup;
+    return fileIds.length > 0 ? { ...withText, fileIds } : withText;
 }
 /**
  * `cockpit msg search [words] [--from <email|me>]... [--in <channel>] [--since <day>] [--until <day>] [--timezone <zone>]
@@ -333,8 +337,8 @@ function parseMsgWriteSafety(action, rest, values) {
     const requestId = optionalNonEmpty(values.flags.get("--request-id"));
     if (requestId && !UUID_PATTERN.test(requestId))
         throw new Error("--request-id must be a UUID.");
-    if (requestId && action !== "send" && action !== "edit" && action !== "delete") {
-        throw new Error("--request-id belongs to `cockpit msg send`, `edit` or `delete`.");
+    if (requestId && action !== "send" && action !== "dm" && action !== "edit" && action !== "delete") {
+        throw new Error("--request-id belongs to `cockpit msg send`, `dm`, `edit` or `delete`.");
     }
     const expectedRevision = optionalPositiveInteger(values.flags.get("--expected-revision"), "--expected-revision");
     if (expectedRevision !== undefined && action !== "edit" && action !== "delete") {
@@ -379,6 +383,7 @@ function parseMsgAction(positionals) {
 function parseMsgCreateTarget(action, rest) {
     let channelName;
     let dmEmail;
+    let dmTextArgument = false;
     if (action === "create") {
         channelName = optionalNonEmpty(rest[0]);
         if (!channelName)
@@ -396,11 +401,9 @@ function parseMsgCreateTarget(action, rest) {
         dmEmail = optionalNonEmpty(rest[0]);
         if (!dmEmail)
             throw new Error("msg dm needs the person's email address, e.g. `cockpit msg dm ada@example.com` (several for a group message).");
-        const notAnAddress = rest.find((email) => !email.includes("@"));
-        if (notAnAddress !== undefined)
-            throw new Error(`msg dm takes email addresses; "${notAnAddress}" is not one.`);
+        dmTextArgument = rest.some((email) => !DM_ADDRESS_PATTERN.test(email));
     }
-    return { channelName, dmEmail };
+    return { channelName, dmEmail, dmTextArgument };
 }
 function parseMsgCreateFlags(action, values) {
     const isPrivate = values.booleans.has("--private");

package/dist/commands/local-args-tower-notes.js

@@ -54,6 +54,7 @@ const NOTES_ACTIONS = new Set([
     "transcription-stats",
     "bot-upcoming",
     "record",
+    "app",
 ]);
 /** Actions whose first positional is the note it acts on. */
 const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
@@ -143,6 +144,7 @@ export function parseNotesArgs(args) {
     if (action === "connect")
         rejectBadConnectRequest(values, provider, workspace, rest);
     const record = action === "record" ? readRecordRequest(rest) : undefined;
+    const app = action === "app" ? readAppRequest(rest) : undefined;
     const paths = readNotesPaths(action, rest);
     if (action === "rename" && !optionalNonEmpty(values.flags.get("--name")))
         throw new Error("notes rename needs --name <name>.");
@@ -166,6 +168,7 @@ export function parseNotesArgs(args) {
         ...(action === "connect" && values.booleans.has("--key-stdin") ? { keyStdin: true } : {}),
         ...(paths ? { paths } : {}),
         ...(record ? record : {}),
+        ...(app ? app : {}),
         filePath: optionalNonEmpty(values.flags.get("--file")),
         name: optionalNonEmpty(values.flags.get("--name")),
         exclude: optionalNonEmpty(values.flags.get("--exclude")),
@@ -190,7 +193,7 @@ function readNotesAction(first) {
     // almost always wants — same reasoning as bare `cockpit` running convergence.
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, summarize, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, granola-status, or transcription-stats (and record start|stop|status|cancel).`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, summarize, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, granola-status, or transcription-stats (and record start|stop|status|cancel, app install|uninstall|status).`);
     }
     return action;
 }
@@ -207,6 +210,16 @@ function readRecordRequest(rest) {
         throw new Error(`notes record ${verb} does not take "${rest[1]}".`);
     return { recordAction: verb };
 }
+const APP_VERBS = ["install", "uninstall", "status"];
+/** BLI-23207: `app <install|uninstall|status>`; bare `app` is the status. */
+function readAppRequest(rest) {
+    const verb = (rest[0] ?? "status");
+    if (!APP_VERBS.includes(verb))
+        throw new Error("notes app needs one of: install, uninstall, status.");
+    if (rest.length > 1)
+        throw new Error(`notes app ${verb} does not take "${rest[1]}".`);
+    return { appAction: verb };
+}
 function readRepairTruncated(action, values) {
     const repairTruncated = values.booleans.has("--repair-truncated");
     if (repairTruncated && action !== "sync") {
@@ -314,6 +327,7 @@ function readNotesPaths(action, rest) {
     }
     const takesNoPositional = action !== "paste"
         && action !== "record"
+        && action !== "app"
         && action !== "connect"
         && action !== "sync"
         && action !== "sync-status"

package/dist/commands/local-help-commands-tower.js

@@ -107,7 +107,7 @@ export const TOWER_COMMAND_HELP = [
             "Channels and messages, typed. <channel> is a channel id, or its name with or without a leading #.",
             "channels — every channel you are a member of (or, as a super_admin, every channel).",
             "create <name> [--private] [--members a@x.test,b@y.test] [--description \"<text>\"] — makes a channel and prints its id. A leading # is fine; --private means membership decides who may read it, and --members names who joins at birth BY EMAIL. An address Tower does not carry refuses the whole create — no half-built channel.",
-            "dm <email> — opens (or re-opens) the direct message with one person. Idempotent: the same address always resolves to the same channel, and you never have to name yourself.",
+            "dm <email> [--request-id <uuid>] — opens (or re-opens) the direct message with one person. Idempotent: the same address always resolves to the same channel, and you never have to name yourself. Pipe text in and it is also sent there in the same call, through the same door and request-id receipt as send: `echo \"hello\" | cockpit msg dm ada@example.com` (retry a lost answer with the SAME --request-id; it posts once). The text is never accepted on the command line: `msg dm ada@example.com \"hello\"` is refused dm_text_argument, exit 1, and nothing is sent.",
             "dm <email> [<email>...] — with several addresses, opens (or re-opens) the group message with exactly those people plus you; the same set always resolves to the same channel. channel <channel> [--json] — the channel's details: name, description, kind, archived, audience (a public channel is everyone in the org, not a member count), source workspace label (where it came from; it grants no access), whether you can manage it, and whether you hid it. channel <channel> --rename <name> | --describe <text> | --archive | --unarchive — changes it (one update; --rename and --describe can go together). Only the person who made the channel, its owners and its moderators can; anyone else is refused channel_manage_refused, a name in use channel_name_taken, a direct message dm_not_editable. Archiving keeps every message and link and stops new posts (channel_archived); unarchive restores posting. members <channel> [--json] — who is in a private channel or a direct message; a public channel says everyone in the org can read it. members <channel> --add <email> | --remove <email> — private channels only, by the same people who can manage it; a removed person's next read is refused. A direct message keeps the people it started with (dm_not_editable): start a new group with `msg dm a@x b@y`. hide <channel> / unhide <channel> — drops a PUBLIC channel from your own sidebar, or puts it back; it changes nothing for anyone else and nothing about reading, search, mentions or notifications. A private channel or direct message is refused hide_not_public.",
             "read <channel> [--limit <n>] [--thread <id>] [--mark-read] — the channel's most recent top-level messages, oldest first; --thread <id> reads one thread's replies instead. The first page also says where the messages come from (for an imported Slack channel: how long ago the archive was checked, or that it is unknown) and where YOUR read line stands. Reading never moves the read line; --mark-read moves it to the newest message shown, and says plainly if that failed.",
             "unread <channel> --from <message-id> — marks that message and everything after it unread, so the web sidebar badge and the NEW MESSAGES line start there. Opening or reading a channel never clears unseen history.",
@@ -182,7 +182,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "cal",
         [
-            'Usage: cockpit cal [event <id>|export <id>|today|week|conflicts|calendar-change <id> --color <hex-or-provider>|view-settings|view-settings-change|people <label>|availability --with <label|email> --from <d> --to <d>|overlays [--pin <label|email>|--remove <email>]|suggest --with <label|email> --from <d> --to <d>|availability-share --range <start>/<end> [--link]|availability-revoke <id>|booking-page [--list|--id <id>]|booking-slots <link>|book <link> --start <iso> --name <n> --email <e>|booking-change <manage link> --start <iso>|booking-cancel <manage link>|next|find "<words>"|calendars|add-ical|create [--recheck]|duplicate <event id>|batch|undo [<change id>]|rsvp <event id> --response <accepted|declined|tentative>|change <event id>|cancel <event id> --yes|share <id>|sync <id>|sync-status [<id>]|detach <id>|delete <event id> --yes|remind|join [--event <id> --occurrence <iso>] [--print]|reminders [--on|--off] [--lead <min>] [--sound on|off]|snooze <event id> --occurrence <iso> --minutes <5|10|15>|dismiss <event id> --occurrence <iso>|links <event id> [--occurrence <iso>] [--add doc:<id>|note:<id> [--series]] [--remove <link id>]|agenda [--from <d> --to <d>]] [flags]',
+            'Usage: cockpit cal [event <id>|export <id>|today|week|conflicts|calendar-change <id> --color <hex-or-provider>|view-settings|view-settings-change|people <label>|availability --with <label|email> --from <d> --to <d>|overlays [--pin <label|email>|--remove <email>]|suggest --with <label|email> --from <d> --to <d>|availability-share --range <start>/<end> [--link]|availability-revoke <id>|booking-page [--list|--id <id>]|booking-slots <link>|book <link> --start <iso> --name <n> --email <e>|booking-change <manage link> --start <iso>|booking-cancel <manage link>|next|find "<words>"|calendars|add-ical|create [--recheck] [--rrule <line>]|duplicate <event id>|batch|undo [<change id>]|rsvp <event id> --response <accepted|declined|tentative>|change <event id>|cancel <event id> --yes|share <id>|sync <id>|sync-status [<id>]|detach <id>|delete <event id> --yes|remind|join [--event <id> --occurrence <iso>] [--print]|reminders [--on|--off] [--lead <min>] [--sound on|off]|snooze <event id> --occurrence <iso> --minutes <5|10|15>|dismiss <event id> --occurrence <iso>|links <event id> [--occurrence <iso>] [--add doc:<id>|note:<id> [--series]] [--remove <link id>]|agenda [--from <d> --to <d>]] [flags]',
             "",
             "Every calendar you attached, in one place — plus any calendar a colleague marked shared.",
             "today [--offset 1] [--tz <zone>] — what is on today, in YOUR zone (this machine's, unless --tz says otherwise). --offset 1 is tomorrow, -1 yesterday.",
@@ -192,7 +192,7 @@ export const TOWER_COMMAND_HELP = [
             "conflicts [--from <iso> --to <iso>] [--tz <IANA>] — own-account double-bookings with duplicate invitation merging, checked calendars and age. Visible calendars only by default; --all includes hidden calendars. All-day and free events never conflict.",
             "event <id> [--occurrence-start <iso>] [--tz <zone>] [--json] — exact occurrence details, human recurrence, named guests/RSVP, organizer, source zone, HTTPS Join and edit capability. The selector must match a real occurrence; cancelled/missing instances are refused.",
             "export <id> [--occurrence-start <iso>] [--json] — iCalendar text to stdout; redirect to event.ics. Recurring exports include the complete series and exceptions, keeping source zone/recurrence. No calendar credentials.",
-            "calendar-change <id> --color <hex|provider> — persistent owner colour override, or reset to provider colour. Also accepts stdin JSON {color_override, selected}. History is retained. view-settings [--json] reads your saved view settings (default view, N days, week start, weekends, density, up to 3 extra time zones) plus the calendar actions and keyboard shortcuts; never saved means the defaults, said so. view-settings-change [--view day|week|days|month] [--days 2-9] [--week-start monday|sunday] [--hide-weekends on|off] [--density normal|compact] [--zone <IANA>]... changes only what you name; --zone repeats (up to 3), --zone none clears; stdin JSON like {\"day_count\":4} works too. people <label> [--json] — exact team search: a display name or alias (any case) or an email; an address nobody on the team owns comes back as typed. No fuzzy, prefix or nickname match; an ambiguous label lists every match. availability --with <label|email> [--with ...] --from <d> --to <d> [--tz <IANA>] [--account <id>] [--json] — when people are BUSY, start and end only, asked of Google with your own grant (up to 100 people, 31 days). A person Google will not answer for is unknown, never free. Stdin JSON {with|emails, from, to, tz, account_id} works too. overlays — the people pinned on your calendar (at most 10). overlays --pin <label|email> pins one, overlays --remove <email> drops one; history is kept. The web calendar shows pinned people's busy time. suggest --with <label|email> [--with ...] --from <d> --to <d> [--duration 30] [--hours 09:00-17:00] [--weekends] [--tz <IANA>] [--account <id>] [--limit <n>] [--json] — ranked common free slots for several people (up to 10 shown, 50 max; 15 to 480 minutes): everyone free first, then outside someone's local hours, then slots with an unknown person (never shown as free); Tower defaults (30 minutes, 09:00 to 17:00 your zone, no weekends) are named when used; stdin JSON works. create --recheck re-reads everyone's busy time just before writing and refuses with the reason (slot_taken, slot_unconfirmed) instead of double-booking. availability-share --range <start>/<end> [--range ...] [--duration 30] [--tz <IANA>] [--text|--link] [--expires <iso>] [--location <where>] [--meet] [--single-use] [--allow-conflicts] [--label <s>] [--json] offers your free time inside the ranges (a time without an offset is read in --tz; your own busy time is skipped unless --allow-conflicts): --text (default) prints words to paste, stores nothing, names the zone and the time it was made; --link stores a revocable link (14 days by default, 90 at most) whose times are rechecked on every open and prints the URL ONCE; a repeat of the same --key gives no second link. --list shows your links; --id <id> with --expires or --label changes one; availability-revoke <id> turns one off. Stdin JSON works. If your own calendars could not be fully read it says so. booking-page --title <t> --weekly mon/09:00-12:00 [--weekly ...] [--duration 30] [--buffer-before 0] [--buffer-after 0] [--notice 240] [--window 14] [--meet] [--location <s>] [--single-use] [--tz <IANA>] makes a public booking page on your own Google calendar (30 minutes, no buffers, 4 hours notice, 14 days by default; up to 21 weekly ranges) and prints its link ONCE; --list shows pages and upcoming bookings; --id <id> with --rotate, --close|--open or any field above changes one; stdin JSON works. A guest (no Tower login needed) runs booking-slots <link>, book <link> --start <slot start> --name <n> --email <e> [--note <s>] (3 upcoming bookings per email per page), booking-change <manage link> --start <iso> (the old manage link stops working; the new one shows once) and booking-cancel <manage link>; the manage link expires when the meeting starts. Laptop reminders (slice 11): reminders shows or sets your switch (--on|--off, --lead 0 to 60 minutes, default 10, --sound on|off); they are OFF until you turn them on. Once on, a scheduled `cockpit cal remind` tick (every minute, installed with the sync agent) shows one TOWER banner per meeting per lead time across all your laptops, never one for a meeting you declined or that was cancelled, and records a banner more than 5 minutes late as missed. join opens the link of the meeting running now or starting within 15 minutes (or --event <id> --occurrence <iso>); --print only prints it; a missing or non-https link is refused by name. snooze <event id> --occurrence <iso> --minutes 5|10|15 and dismiss <event id> --occurrence <iso> change one nudge. next leaves out meetings you declined (the door takes ?declined=1 to keep them). Event links (slice 12): links <event id> [--occurrence <iso>] lists YOUR docs and meeting notes linked to that occurrence plus its series, each read again for you (a doc or note you can no longer open prints as unavailable, no title), a note showing its status and recording, alternate and missed counts, and suggests notes the bot recorded for exactly this event (never by title); --add doc:<id>|note:<id> --occurrence <iso> (or --series for every occurrence) attaches one you can read now (20 per event; a repeat is already_linked); --remove <link id> removes it and the history keeps it. A link is private to you and gives attendees no access. agenda [--from <d> --to <d>] [--tz <IANA>] [--json] lists events plus tickets due in the window as DUE lines (all-day markers, never busy time, never sent to Google), with how many rows were read.",
+            "calendar-change <id> --color <hex|provider> — persistent owner colour override, or reset to provider colour. Also accepts stdin JSON {color_override, selected}. History is retained. view-settings [--json] reads your saved view settings (default view, N days, week start, weekends, density, up to 3 extra time zones) plus the calendar actions and keyboard shortcuts (d or 1 day, w or 0 week, m month, 2 to 9 that many days, t today, j and k or the left and right arrows move, c a new event draft, / search, ` the sidebar, \\ the side panel, ? the list, Esc closes one layer); never saved means the defaults, said so. view-settings-change [--view day|week|days|month] [--days 2-9] [--week-start monday|sunday] [--hide-weekends on|off] [--density normal|compact] [--zone <IANA>]... changes only what you name; --zone repeats (up to 3), --zone none clears; stdin JSON like {\"day_count\":4} works too. people <label> [--json] — exact team search: a display name or alias (any case) or an email; an address nobody on the team owns comes back as typed. No fuzzy, prefix or nickname match; an ambiguous label lists every match. availability --with <label|email> [--with ...] --from <d> --to <d> [--tz <IANA>] [--account <id>] [--json] — when people are BUSY, start and end only, asked of Google with your own grant (up to 100 people, 31 days). A person Google will not answer for is unknown, never free. Stdin JSON {with|emails, from, to, tz, account_id} works too. overlays — the people pinned on your calendar (at most 10). overlays --pin <label|email> pins one, overlays --remove <email> drops one; history is kept. The web calendar shows pinned people's busy time. suggest --with <label|email> [--with ...] --from <d> --to <d> [--duration 30] [--hours 09:00-17:00] [--weekends] [--tz <IANA>] [--account <id>] [--limit <n>] [--json] — ranked common free slots for several people (up to 10 shown, 50 max; 15 to 480 minutes): everyone free first, then outside someone's local hours, then slots with an unknown person (never shown as free); Tower defaults (30 minutes, 09:00 to 17:00 your zone, no weekends) are named when used; stdin JSON works. create --recheck re-reads everyone's busy time just before writing and refuses with the reason (slot_taken, slot_unconfirmed) instead of double-booking. create --rrule \"RRULE:FREQ=WEEKLY;COUNT=4\" makes the event repeat (a Google recurrence line; repeatable for EXDATE or RDATE lines). availability-share --range <start>/<end> [--range ...] [--duration 30] [--tz <IANA>] [--text|--link] [--expires <iso>] [--location <where>] [--meet] [--single-use] [--allow-conflicts] [--label <s>] [--json] offers your free time inside the ranges (a time without an offset is read in --tz; your own busy time is skipped unless --allow-conflicts): --text (default) prints words to paste, stores nothing, names the zone and the time it was made; --link stores a revocable link (14 days by default, 90 at most) whose times are rechecked on every open and prints the URL ONCE; a repeat of the same --key gives no second link. --list shows your links; --id <id> with --expires or --label changes one; availability-revoke <id> turns one off. Stdin JSON works. If your own calendars could not be fully read it says so. booking-page --title <t> --weekly mon/09:00-12:00 [--weekly ...] [--duration 30] [--buffer-before 0] [--buffer-after 0] [--notice 240] [--window 14] [--meet] [--location <s>] [--single-use] [--tz <IANA>] makes a public booking page on your own Google calendar (30 minutes, no buffers, 4 hours notice, 14 days by default; up to 21 weekly ranges) and prints its link ONCE; --list shows pages and upcoming bookings; --id <id> with --rotate, --close|--open or any field above changes one; stdin JSON works. A guest (no Tower login needed) runs booking-slots <link>, book <link> --start <slot start> --name <n> --email <e> [--note <s>] (3 upcoming bookings per email per page), booking-change <manage link> --start <iso> (the old manage link stops working; the new one shows once) and booking-cancel <manage link>; the manage link expires when the meeting starts. Laptop reminders (slice 11): reminders shows or sets your switch (--on|--off, --lead 0 to 60 minutes, default 10, --sound on|off); they are OFF until you turn them on. Once on, a scheduled `cockpit cal remind` tick (every minute, installed with the sync agent) shows one TOWER banner per meeting per lead time across all your laptops, never one for a meeting you declined or that was cancelled, and records a banner more than 5 minutes late as missed. join opens the link of the meeting running now or starting within 15 minutes (or --event <id> --occurrence <iso>); --print only prints it; a missing or non-https link is refused by name. snooze <event id> --occurrence <iso> --minutes 5|10|15 and dismiss <event id> --occurrence <iso> change one nudge. next leaves out meetings you declined (the door takes ?declined=1 to keep them). Event links (slice 12): links <event id> [--occurrence <iso>] lists YOUR docs and meeting notes linked to that occurrence plus its series, each read again for you (a doc or note you can no longer open prints as unavailable, no title), a note showing its status and recording, alternate and missed counts, and suggests notes the bot recorded for exactly this event (never by title); --add doc:<id>|note:<id> --occurrence <iso> (or --series for every occurrence) attaches one you can read now (20 per event; a repeat is already_linked); --remove <link id> removes it and the history keeps it. A link is private to you and gives attendees no access. agenda [--from <d> --to <d>] [--tz <IANA>] [--json] lists events plus tickets due in the window as DUE lines (all-day markers, never busy time, never sent to Google), with how many rows were read.",
             "calendars — every calendar, its provider (google_oauth or ical_url), whether it is shared, and when it last synced. The ids other verbs take are on the last line.",
             "add-ical [--name \"<what to call it>\"] — attaches a personal calendar by its SECRET iCal ADDRESS, read from stdin. There is no flag for it:",
             '      macOS:      printf "%s" "https://calendar.google.com/calendar/ical/…/basic.ics" | cockpit cal add-ical --name "Personal"',

package/dist/commands/local-help-notes.js

@@ -3,10 +3,11 @@ export const NOTES_HELP = [
     [
         "notes",
         [
-            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>|record start|stop|status|cancel] [flags]",
+            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>|record start|stop|status|cancel|app install|uninstall|status] [flags]",
             "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 1 GB. Over 4 MB (a whole meeting) the file goes straight to storage and is transcribed in the background; --wait then polls for up to 4 hours and prints progress, otherwise for at most 330 seconds.",
             "",
             "record start|stop [<session-id>]|status|cancel — record a meeting in a room from this Mac's microphone (Apple Silicon macOS; Windows says it is not supported yet). Nothing leaves the machine while recording and there is no auto-stop. `stop` trims the silence away locally, uploads only the speech, and Tower writes a note with Speaker 1, Speaker 2... lines (add --wait to watch the transcription). `cancel` stops and KEEPS the file; `status` lists what is recording or waiting; `stop <session-id>` finishes a cancelled or crashed session. The original recording stays on this machine.",
+            "app install|uninstall|status [--json] — the BLI Notetaker menu-bar app (Apple Silicon macOS; Windows and Linux say they are not supported yet). `install` asks Tower for the newest release, downloads it, refuses it if its sha256 differs, puts it in ~/Applications/BLI Notetaker.app (replacing an older one), clears the download quarantine and starts it at login with a LaunchAgent. The menu runs the `record` verbs above: Record, Stop, Open last note, Finish last recording. Log: ~/Library/Logs/BLI Notetaker.log. `uninstall` removes the app and the LaunchAgent and keeps your recordings; `status` says what is installed, whether it runs, and whether a newer release exists.",
             "folders [--tree] [--json]: list folders and visible note counts.",
             "mkdir <path> [--json]: create a folder and any missing ancestors.",
             "rename <path> --name <name> [--json]: rename a folder and its descendant paths.",

package/dist/commands/msg-dm.js

@@ -1,13 +1,39 @@
-/** `cockpit msg dm <email>`: lookup-or-create a direct message (BLI-3749). Split out of `msg.ts` for the file-size ratchet. */
+/**
+ * `cockpit msg dm <email> [<email>...]`: lookup-or-create a direct message (BLI-3749). Split out of `msg.ts` for the file-size ratchet.
+ * BLI-23213: text piped in is sent into the DM through the same send door `msg send` uses (request id, receipt,
+ * `--request-id` for a retry); text typed on the command line is refused by name, because a message never travels there.
+ */
+import { randomUUID } from "node:crypto";
 import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
-import { writeLine } from "./cli-io.js";
+import { isInteractiveStdin, writeLine } from "./cli-io.js";
+import { postMessage, readContent } from "./msg-write.js";
 const TAG = "[msg cli]";
 const WRITE_DEADLINE_MS = 30_000;
+export const DM_TEXT_ARGUMENT_DETAIL = "dm takes addresses only; pipe the text in: echo \"<text>\" | cockpit msg dm <email>";
+/**
+ * `msg dm a@x "hello"` used to drown its one reason line in the whole msg manual and send nothing, so reports
+ * written that way vanished. It is refused here, before pairing or any request, with the reason and the right form.
+ */
+export function refuseDmTextArgument(command, io) {
+    writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason: "dm_text_argument" })}`);
+    if (command.json)
+        writeLine(io.stdout, JSON.stringify({ ok: false, error: "dm_text_argument", detail: DM_TEXT_ARGUMENT_DETAIL }));
+    else
+        writeLine(io.stderr, DM_TEXT_ARGUMENT_DETAIL);
+    return 1;
+}
 export async function openDm(command, door) {
     const emails = command.dmEmails ?? (command.dmEmail ? [command.dmEmail] : []);
     const email = emails.join(", ");
     if (emails.length === 0)
         return failAgentDoor(door, TAG, "invalid_body", "msg dm needs an email address.");
+    // Read before opening, so text over the limit is refused before anything is created.
+    const piped = isInteractiveStdin(door.io) ? { ok: true, text: "" } : await readContent(door.io);
+    if (!piped.ok)
+        return failAgentDoor(door, TAG, piped.reason, piped.detail);
+    if (command.requestId && piped.text === "") {
+        return failAgentDoor(door, TAG, "invalid_body", "--request-id on msg dm goes with piped text, e.g. `echo \"hello\" | cockpit msg dm <email> --request-id <uuid>`. Nothing was opened or sent.");
+    }
     const answer = await askAgentDoor(door, {
         path: "/api/msg/channels",
         method: "POST",
@@ -18,11 +44,25 @@ export async function openDm(command, door) {
     if (!answer.ok)
         return failAgentDoor(door, TAG, answer.reason, answer.detail);
     const channel = answer.body.channel ?? null;
-    writeLine(door.io.stderr, `${TAG} dm resolved ${JSON.stringify({ channel_id: channel?.id ?? null })}`);
-    if (door.json)
-        return emitAgentDoor(door, { ok: true, channel });
+    writeLine(door.io.stderr, `${TAG} dm resolved ${JSON.stringify({ channel_id: channel?.id ?? null, piped_chars: piped.text.length })}`);
     // Idempotent by contract (`get_or_create_dm`), so the wording says what is
     // true either way rather than claiming a creation that may not have happened.
-    writeLine(door.io.stdout, `${emails.length > 1 ? "Group message" : "Direct message"} with ${email}: ${channel?.id ?? "?"}`);
+    const opened = `${emails.length > 1 ? "Group message" : "Direct message"} with ${email}: ${channel?.id ?? "?"}`;
+    if (piped.text === "") {
+        if (door.json)
+            return emitAgentDoor(door, { ok: true, channel });
+        writeLine(door.io.stdout, opened);
+        return 0;
+    }
+    if (!channel?.id)
+        return failAgentDoor(door, TAG, "dm_channel_missing", "Tower answered without the direct message's id, so the piped text was NOT sent.");
+    const requestId = command.requestId ?? randomUUID();
+    const sent = await postMessage(door, channel.id, { text: piped.text, requestId });
+    if (!sent.ok)
+        return sent.exitCode;
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, channel, message: sent.message, mutation: sent.mutation });
+    writeLine(door.io.stdout, opened);
+    writeLine(door.io.stdout, `Sent to ${email} (${sent.message?.id ?? "?"}).`);
     return 0;
 }

package/dist/commands/msg-write.js

@@ -60,6 +60,31 @@ export function refuseMsgWrite(door, answer, requestId, verb) {
     }
     return failAgentDoor(door, TAG, answer.reason, answer.detail, mutation ? { mutation } : {});
 }
+/**
+ * The ONE send door `msg send` and `msg dm` (with piped text, BLI-23213) share: `POST /api/msg/channels/<id>/messages`
+ * with a request id, so a lost answer can be checked with `msg outcome` and a retry with the same id posts once.
+ * A refusal has already been printed when this answers `ok: false`; the receipt line is printed on success.
+ */
+export async function postMessage(door, channelId, post) {
+    const fileIds = post.fileIds ?? [];
+    const answer = await askAgentDoor(door, {
+        path: `/api/msg/channels/${encodeURIComponent(channelId)}/messages`,
+        method: "POST",
+        label: "msg send",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: {
+            ...(post.text === "" ? {} : { content: post.text }),
+            ...(fileIds.length > 0 ? { file_ids: fileIds } : {}),
+            request_id: post.requestId,
+            ...(post.threadId ? { thread_parent_id: post.threadId } : {}),
+        },
+    });
+    if (!answer.ok)
+        return { ok: false, exitCode: refuseMsgWrite(door, answer, post.requestId, "send") };
+    const { message = null, mutation = null } = answer.body;
+    writeLine(door.io.stderr, `${TAG} sent ${JSON.stringify({ channel_id: channelId, message_id: message?.id ?? null, request_id: post.requestId, chars: post.text.length, files: fileIds.length })}`);
+    return { ok: true, message, mutation };
+}
 /** `cockpit msg edit <message-id> [--expected-revision <n>] [--request-id <uuid>]` — the new text is piped in. */
 export async function editMessage(command, door) {
     const content = await readContent(door.io);

package/dist/commands/msg.js

@@ -23,14 +23,16 @@ import { markReadThrough } from "./msg-read-line.js";
 import { runMsgActivityVerb } from "./msg-activity.js";
 import { runMsgDraft } from "./msg-draft.js";
 import { runMsgSearch } from "./msg-search.js";
-import { openDm } from "./msg-dm.js";
+import { openDm, refuseDmTextArgument } from "./msg-dm.js";
 import { runMsgMark } from "./msg-mark.js";
 import { runMsgChannel } from "./msg-channel.js";
 import { runMsgFile } from "./msg-file.js";
-import { deleteMessage, editMessage, messageOutcome, messageText, readContent, refuseMsgWrite } from "./msg-write.js";
+import { deleteMessage, editMessage, messageOutcome, messageText, postMessage, readContent } from "./msg-write.js";
 const TAG = "[msg cli]";
 const [READ_DEADLINE_MS, WRITE_DEADLINE_MS] = [30_000, 30_000];
 export async function runMsg(command, io) {
+    if (command.action === "dm" && command.dmTextArgument)
+        return refuseDmTextArgument(command, io);
     const door = await openAgentDoor("msg", command, io);
     switch (command.action) {
         case "show": return showMessage(command, door);
@@ -327,22 +329,10 @@ async function sendMessage(command, door) {
         return failAgentDoor(door, TAG, "invalid_body", "There was nothing to send. Nothing was sent.");
     // BLI-21314: every send carries a request id, so a lost response can be checked and a retry posts once.
     const requestId = command.requestId ?? randomUUID();
-    const answer = await askAgentDoor(door, {
-        path: `/api/msg/channels/${encodeURIComponent(resolved.id)}/messages`,
-        method: "POST",
-        label: "msg send",
-        timeoutMs: WRITE_DEADLINE_MS,
-        body: {
-            ...(text === "" ? {} : { content: text }),
-            ...(fileIds.length > 0 ? { file_ids: fileIds } : {}),
-            request_id: requestId,
-            ...(command.threadId ? { thread_parent_id: command.threadId } : {}),
-        },
-    });
-    if (!answer.ok)
-        return refuseMsgWrite(door, answer, requestId, "send");
-    const { message = null, mutation = null } = answer.body;
-    writeLine(door.io.stderr, `${TAG} sent ${JSON.stringify({ channel_id: resolved.id, message_id: message?.id ?? null, request_id: requestId, chars: text.length, files: fileIds.length })}`);
+    const sent = await postMessage(door, resolved.id, { text, fileIds, requestId, ...(command.threadId ? { threadId: command.threadId } : {}) });
+    if (!sent.ok)
+        return sent.exitCode;
+    const { message, mutation } = sent;
     if (door.json)
         return emitAgentDoor(door, { ok: true, message, mutation });
     writeLine(door.io.stdout, `Sent to ${ref} (${message?.id ?? "?"}).`);

package/dist/commands/notes-app-plist.js

@@ -0,0 +1,58 @@
+/**
+ * BLI-23207: where the BLI Notetaker menu-bar app lives on a Mac, and the
+ * LaunchAgent that starts it at login. Sibling of `notes-app.ts`, which installs it.
+ *
+ * The LaunchAgent runs the bundle's executable directly (RunAtLoad, KeepAlive
+ * false: Quit means quit) and routes the app's stderr, where its
+ * `[notetaker-app]` log lines go, to `~/Library/Logs/BLI Notetaker.log`. Two
+ * environment values ride along: the paired Tower address, so "Open last
+ * note" opens the right dashboard without the app ever reading the CLI's
+ * session file (it holds the device token), and the person's login shell, which
+ * the app asks once for `node` and `cockpit` (launchd's PATH has neither).
+ */
+import path from "node:path";
+import { getCollectorRuntimePaths } from "../local-state-paths.js";
+import { xmlEscape } from "../autostart-xml.js";
+export const NOTETAKER_APP_LABEL = "ca.buildlaunchiterate.notetaker";
+export const NOTETAKER_APP_NAME = "BLI Notetaker.app";
+export const NOTETAKER_APP_EXECUTABLE = "bli-notetaker";
+export function notetakerAppPaths(homeDir) {
+    const applications = path.join(homeDir, "Applications");
+    const app = path.join(applications, NOTETAKER_APP_NAME);
+    return {
+        app,
+        executable: path.join(app, "Contents", "MacOS", NOTETAKER_APP_EXECUTABLE),
+        applications,
+        plist: path.join(homeDir, "Library", "LaunchAgents", `${NOTETAKER_APP_LABEL}.plist`),
+        log: path.join(homeDir, "Library", "Logs", "BLI Notetaker.log"),
+        receipt: path.join(getCollectorRuntimePaths(homeDir).state_dir, "notetaker-app.json"),
+    };
+}
+export function renderNotetakerAppPlist(input) {
+    const env = [];
+    if (input.towerUrl)
+        env.push(["BLI_TOWER_URL", input.towerUrl]);
+    if (input.shell && input.shell.startsWith("/"))
+        env.push(["SHELL", input.shell]);
+    const s = (value) => `<string>${xmlEscape(value)}</string>`;
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        "<dict>",
+        `  <key>Label</key>${s(NOTETAKER_APP_LABEL)}`,
+        `  <key>ProgramArguments</key><array>${s(input.paths.executable)}</array>`,
+        "  <key>RunAtLoad</key><true/>",
+        "  <key>KeepAlive</key><false/>",
+        `  <key>ProcessType</key>${s("Interactive")}`,
+        `  <key>LimitLoadToSessionType</key>${s("Aqua")}`,
+        `  <key>StandardOutPath</key>${s(input.paths.log)}`,
+        `  <key>StandardErrorPath</key>${s(input.paths.log)}`,
+        ...(env.length
+            ? ["  <key>EnvironmentVariables</key>", "  <dict>", ...env.map(([k, v]) => `    <key>${xmlEscape(k)}</key>${s(v)}`), "  </dict>"]
+            : []),
+        "</dict>",
+        "</plist>",
+        "",
+    ].join("\n");
+}

package/dist/commands/notes-app.js

@@ -0,0 +1,225 @@
+/**
+ * `cockpit notes app install | uninstall | status` (BLI-23207): put the BLI
+ * Notetaker menu-bar app on this Mac, take it off, or say what is there.
+ *
+ *   install    asks Tower for the newest `notetaker-app-v*` release
+ *              (`GET /api/notes/app/release`; the repository is private, so
+ *              Tower reads it with its own GitHub token and hands back the
+ *              sha256 and a short-lived signed download link), downloads the
+ *              zip, REFUSES it if the hash differs, unpacks it to
+ *              `~/Applications/BLI Notetaker.app` (replacing an older one),
+ *              clears the download quarantine, writes the LaunchAgent and
+ *              starts it.
+ *   uninstall  stops it and removes the app, the LaunchAgent and the receipt.
+ *              Recordings and the log stay.
+ *   status     what is installed, whether it is running, and whether a newer
+ *              release exists.
+ *
+ * Apple Silicon macOS only; Windows and Linux are refused by name. The app is
+ * a shell over `cockpit notes record`; it captures nothing itself. Its layout
+ * and LaunchAgent are `notes-app-plist.ts`.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { launchdUserDomain, reregisterDarwinAgent } from "../autostart-darwin.js";
+import { writeLine } from "./cli-io.js";
+import { ask } from "./notes-door.js";
+import { NOTETAKER_APP_EXECUTABLE, NOTETAKER_APP_LABEL, NOTETAKER_APP_NAME, notetakerAppPaths, renderNotetakerAppPlist, } from "./notes-app-plist.js";
+const TAG = "[notes app]";
+const RELEASE_DEADLINE_MS = 30_000;
+const DOWNLOAD_DEADLINE_MS = 10 * 60_000;
+function say(io, command, human, json) {
+    writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, ...json }) : human);
+    return 0;
+}
+function refuse(io, command, reason, sentence, fields = {}) {
+    writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason, ...fields })}`);
+    if (command.json)
+        writeLine(io.stdout, JSON.stringify({ ok: false, reason, detail: sentence }));
+    else
+        writeLine(io.stderr, sentence);
+    return 1;
+}
+const exists = async (file) => stat(file).then(() => true, () => false);
+async function readReceipt(file) {
+    try {
+        const parsed = JSON.parse(await readFile(file, "utf8"));
+        return typeof parsed.tag === "string" && typeof parsed.version === "string" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function runNotesApp(command, io, deps) {
+    const verb = command.appAction ?? "status";
+    if (deps.platform !== "darwin") {
+        const where = deps.platform === "win32" ? "Windows" : deps.platform === "linux" ? "Linux" : deps.platform;
+        return refuse(io, command, "platform_not_supported", `The BLI Notetaker app is not available on ${where} yet. It runs in the menu bar on Apple Silicon Macs; Windows is a follow-up. \`cockpit notes record\` is the terminal way to record.`, { platform: deps.platform });
+    }
+    const paths = notetakerAppPaths(deps.homeDir);
+    if (verb === "uninstall")
+        return await uninstall(command, io, deps, paths);
+    if (verb === "install")
+        return await install(command, io, deps, paths);
+    return await status(command, io, deps, paths);
+}
+/** Ask the paired Tower for the newest release; a refusal comes back as reason + sentence. */
+async function newestRelease(deps) {
+    const door = await deps.door();
+    if (!("deviceToken" in door))
+        return { ok: false, reason: door.reason, detail: door.detail };
+    const answer = await ask(door, { path: "/api/notes/app/release", method: "GET", label: "notes app release", timeoutMs: RELEASE_DEADLINE_MS });
+    if (!answer.ok)
+        return answer;
+    const body = answer.body;
+    const sha = typeof body.sha256 === "string" ? body.sha256.toLowerCase() : "";
+    if (!body.tag || !body.version || !/^[0-9a-f]{64}$/.test(sha) || !body.zip?.url?.startsWith("https://")) {
+        return { ok: false, reason: "release_answer_unreadable", detail: "Tower answered without a release this command can install." };
+    }
+    return { ok: true, release: { tag: body.tag, version: body.version, sha256: sha, zip: body.zip }, door };
+}
+/** Stream `url` to `dest`, hashing as it goes. No credential is sent: the link is GitHub's own signed one. */
+export async function downloadToFile(fetchImpl, url, dest) {
+    let response;
+    try {
+        response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_DEADLINE_MS) });
+    }
+    catch {
+        return { ok: false, reason: "download_unreachable" };
+    }
+    if (!response.ok || !response.body)
+        return { ok: false, reason: `download_http_${response.status}` };
+    const hash = createHash("sha256");
+    let bytes = 0;
+    const meter = new Transform({
+        transform(chunk, _encoding, done) {
+            hash.update(chunk);
+            bytes += chunk.length;
+            done(null, chunk);
+        },
+    });
+    try {
+        await pipeline(Readable.fromWeb(response.body), meter, createWriteStream(dest, { mode: 0o600 }));
+    }
+    catch {
+        return { ok: false, reason: "download_interrupted" };
+    }
+    return { ok: true, bytes, sha256: hash.digest("hex") };
+}
+async function appleSilicon(deps) {
+    const answer = await deps.exec("sysctl", ["-n", "hw.optional.arm64"]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+    return answer.code === 0 && answer.stdout.trim() === "1";
+}
+async function install(command, io, deps, paths) {
+    if (!(await appleSilicon(deps))) {
+        return refuse(io, command, "apple_silicon_only", "The BLI Notetaker app is built for Apple Silicon Macs (M1 and later); this Mac is not one. `cockpit notes record` works here from a terminal.");
+    }
+    const found = await newestRelease(deps);
+    if (!found.ok)
+        return refuse(io, command, found.reason, found.detail);
+    const { release, door } = found;
+    const previous = await readReceipt(paths.receipt);
+    writeLine(io.stderr, `${TAG} release ${JSON.stringify({ tag: release.tag, zip_bytes: release.zip.bytes, previous: previous?.tag ?? null })}`);
+    if (!command.json)
+        writeLine(io.stderr, `Downloading BLI Notetaker ${release.version} (${(release.zip.bytes / 1_000_000).toFixed(1)} MB)...`);
+    await mkdir(paths.applications, { recursive: true });
+    const staging = path.join(paths.applications, `.bli-notetaker-install-${randomBytes(4).toString("hex")}`);
+    await mkdir(staging, { recursive: true, mode: 0o700 });
+    try {
+        const zip = path.join(staging, "app.zip");
+        const downloaded = await downloadToFile(io.fetch, release.zip.url, zip);
+        if (!downloaded.ok) {
+            return refuse(io, command, downloaded.reason, `The download did not finish (${downloaded.reason}). Nothing was installed; try again.`);
+        }
+        if (downloaded.sha256 !== release.sha256) {
+            return refuse(io, command, "sha256_mismatch", "The downloaded app does not match the checksum its release publishes, so it was not installed. Nothing on this Mac changed.", { tag: release.tag, bytes: downloaded.bytes, expected_prefix: release.sha256.slice(0, 12), got_prefix: downloaded.sha256.slice(0, 12) });
+        }
+        writeLine(io.stderr, `${TAG} downloaded ${JSON.stringify({ tag: release.tag, bytes: downloaded.bytes, sha256_prefix: downloaded.sha256.slice(0, 12), reason: "sha256_match" })}`);
+        const unpacked = path.join(staging, "unpacked");
+        const ditto = await deps.exec("ditto", ["-x", "-k", zip, unpacked]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+        const stagedApp = path.join(unpacked, NOTETAKER_APP_NAME);
+        if (ditto.code !== 0 || !(await exists(path.join(stagedApp, "Contents", "MacOS", NOTETAKER_APP_EXECUTABLE)))) {
+            return refuse(io, command, "bundle_unreadable", "The downloaded zip did not hold a BLI Notetaker app. Nothing was installed.", { ditto_exit: ditto.code });
+        }
+        // Stop the running copy first. A recording in progress keeps going: the recorder is its own process, and the new app adopts it.
+        const stopped = await deps.exec("launchctl", ["bootout", `${launchdUserDomain(deps.uid)}/${NOTETAKER_APP_LABEL}`]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+        const replaced = await exists(paths.app);
+        if (replaced)
+            await rm(paths.app, { recursive: true, force: true });
+        await rename(stagedApp, paths.app);
+        const xattr = await deps.exec("xattr", ["-dr", "com.apple.quarantine", paths.app]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+        writeLine(io.stderr, `${TAG} unpacked ${JSON.stringify({ replaced, previous: previous?.tag ?? null, bootout_exit: stopped.code, xattr_exit: xattr.code })}`);
+        await mkdir(path.dirname(paths.plist), { recursive: true });
+        await mkdir(path.dirname(paths.log), { recursive: true });
+        await writeFile(paths.plist, renderNotetakerAppPlist({ paths, towerUrl: door.dashboardUrl, shell: deps.shell }), "utf8");
+        const receipt = { tag: release.tag, version: release.version, sha256: release.sha256, installed_at: deps.now().toISOString() };
+        await mkdir(path.dirname(paths.receipt), { recursive: true });
+        await writeFile(paths.receipt, `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+        const started = await reregisterDarwinAgent({ exec: deps.exec, plistPath: paths.plist, uid: deps.uid, label: NOTETAKER_APP_LABEL });
+        if (!started.ok) {
+            return refuse(io, command, "launchagent_bootstrap_failed", `BLI Notetaker ${release.version} is installed at ${paths.app}, but launchd would not start it (${started.detail ?? started.reason}). Open it from ~/Applications, or run \`cockpit notes app install\` again.`, { tag: release.tag });
+        }
+        writeLine(io.stderr, `${TAG} installed ${JSON.stringify({ tag: release.tag, replaced, reason: started.reason })}`);
+        return say(io, command, [
+            `Installed BLI Notetaker ${release.version}${replaced ? ` (replaced ${previous?.version ?? "an older copy"})` : ""} and started it.`,
+            "Look for the ring in the menu bar: Record, Stop, Open last note. It starts again at login.",
+            `App: ${paths.app}`,
+            `Log: ${paths.log}`,
+            "The app is ad-hoc signed, not notarized; the installer cleared the download quarantine so macOS opens it. The first Record asks for the microphone.",
+        ].join("\n"), { installed: true, tag: release.tag, version: release.version, replaced, previous: previous?.tag ?? null, app: paths.app, launch_agent: paths.plist, log: paths.log });
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+async function uninstall(command, io, deps, paths) {
+    const stopped = await deps.exec("launchctl", ["bootout", `${launchdUserDomain(deps.uid)}/${NOTETAKER_APP_LABEL}`]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+    const had = { app: await exists(paths.app), launch_agent: await exists(paths.plist), receipt: await exists(paths.receipt) };
+    await rm(paths.plist, { force: true });
+    await rm(paths.app, { recursive: true, force: true });
+    await rm(paths.receipt, { force: true });
+    writeLine(io.stderr, `${TAG} uninstalled ${JSON.stringify({ ...had, bootout_exit: stopped.code })}`);
+    if (!had.app && !had.launch_agent) {
+        return say(io, command, "BLI Notetaker was not installed. Nothing to remove.", { removed: false });
+    }
+    return say(io, command, [
+        "Removed BLI Notetaker: the app, its LaunchAgent and its receipt.",
+        `Your recordings stay on this Mac (\`cockpit notes record status\` lists any not yet uploaded), and so does the log: ${paths.log}`,
+    ].join("\n"), { removed: true, ...had });
+}
+async function status(command, io, deps, paths) {
+    const receipt = await readReceipt(paths.receipt);
+    const installed = await exists(paths.executable);
+    const plist = await exists(paths.plist);
+    const printed = await deps.exec("launchctl", ["print", `${launchdUserDomain(deps.uid)}/${NOTETAKER_APP_LABEL}`]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
+    const loaded = printed.code === 0;
+    const running = loaded && /\bstate = running\b/.test(printed.stdout);
+    const pid = Number(/\bpid = (\d+)/.exec(printed.stdout)?.[1] ?? NaN);
+    // The newest release is best effort: a status line without it is still an answer.
+    const newest = await newestRelease(deps);
+    const newestTag = newest.ok ? newest.release.tag : null;
+    const update = Boolean(installed && newestTag && receipt?.tag !== newestTag);
+    writeLine(io.stderr, `${TAG} status ${JSON.stringify({ installed, tag: receipt?.tag ?? null, plist, loaded, running, newest: newestTag, newest_reason: newest.ok ? null : newest.reason })}`);
+    const json = {
+        installed, tag: receipt?.tag ?? null, version: receipt?.version ?? null, installed_at: receipt?.installed_at ?? null,
+        app: paths.app, launch_agent: { path: paths.plist, present: plist, loaded, running, pid: Number.isFinite(pid) ? pid : null },
+        log: paths.log, newest: newest.ok ? { tag: newest.release.tag, version: newest.release.version } : { reason: newest.reason },
+        update_available: update,
+    };
+    const lines = installed
+        ? [
+            `BLI Notetaker ${receipt?.version ?? "(version unknown)"} is installed: ${paths.app}`,
+            running ? `Running (pid ${pid}).` : loaded ? "Registered with launchd but not running; it starts at login, or run `cockpit notes app install` to start it now." : plist ? "Its LaunchAgent is on disk but not loaded; run `cockpit notes app install` to start it." : "No LaunchAgent; run `cockpit notes app install` to start it at login.",
+            newest.ok ? (update ? `A newer release exists: ${newest.release.version}. Run \`cockpit notes app install\` to update.` : "It is the newest release.") : `Could not check for a newer release (${newest.reason}).`,
+            `Log: ${paths.log}`,
+        ]
+        : [
+            "BLI Notetaker is not installed. Run `cockpit notes app install`.",
+            newest.ok ? `Newest release: ${newest.release.version}.` : `Could not check the newest release (${newest.reason}).`,
+        ];
+    return say(io, command, lines.join("\n"), json);
+}

package/dist/commands/notes.js

@@ -36,11 +36,14 @@
  *  - `notes-granola-status.ts` — ticket 10718: the Granola CRON's own health
  *    (it runs on a shared server-side key, not a `notes_accounts` row), read
  *    off its `granola_sync_runs` ledger.
+ *  - `notes-app.ts` — BLI-23207: `app install|uninstall|status`, the BLI
+ *    Notetaker menu-bar app on this Mac (its LaunchAgent: `notes-app-plist.ts`).
  *  - `notes-transcription-stats.ts` — BLI-18003: what meeting transcription
  *    cost and did per provider for a month, and the spend against the cap.
  *
  * Every public name is still importable from this file.
  */
+import os from "node:os";
 import { loadPairedSession } from "../tower-client.js";
 import { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 import { uploadNotes, pasteNote, shareNote, summarizeNote, moveNote, placeNote } from "./notes-writes.js";
@@ -51,6 +54,8 @@ import { showGranolaStatus } from "./notes-granola-status.js";
 import { showTranscriptionStats } from "./notes-transcription-stats.js";
 import { listRecordings, showRecording } from "./notes-recordings.js";
 import { defaultRecordDeps, runNotesRecord } from "./notes-record.js";
+import { runNotesApp } from "./notes-app.js";
+import { defaultExec, errorMessage } from "./cli-io.js";
 export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 export { uploadNotes, pasteNote, shareNote, summarizeNote, moveNote, placeNote } from "./notes-writes.js";
 export { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, syncStatusNotetakers, } from "./notes-accounts.js";
@@ -100,6 +105,26 @@ export async function runNotes(command, io) {
             });
         }));
     }
+    // BLI-23207: the menu-bar app is installed on this Mac; only install and status ask Tower (for the newest release).
+    if (command.action === "app") {
+        return runNotesApp(command, io, {
+            platform: process.platform,
+            homeDir: command.homeDir ?? os.homedir(),
+            uid: process.getuid?.() ?? 0,
+            exec: io.exec ?? defaultExec(),
+            shell: io.env.SHELL,
+            now: () => new Date(),
+            door: async () => {
+                try {
+                    const session = await loadPairedSession("notes app", command.homeDir);
+                    return { dashboardUrl: command.dashboardUrl ?? session.dashboard_url, deviceToken: session.device_token, io, json: command.json };
+                }
+                catch (error) {
+                    return { reason: "not_paired", detail: errorMessage(error) };
+                }
+            },
+        });
+    }
     const session = await loadPairedSession("notes", command.homeDir);
     const door = {
         dashboardUrl: command.dashboardUrl ?? session.dashboard_url,

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.258");
+    writeLine(io?.stdout ?? process.stdout, "0.2.260");
     return 0;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.258",
+  "version": "0.2.260",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.76",
-    "@bli-cockpit/mcp": "0.1.158",
-    "@bli-cockpit/telemetry-core": "0.1.83"
+    "@bli-cockpit/memory-mcp": "0.1.77",
+    "@bli-cockpit/mcp": "0.1.159",
+    "@bli-cockpit/telemetry-core": "0.1.84"
   },
   "repository": {
     "type": "git",