@bli-cockpit/cli 0.2.259 → 0.2.261

package/dist/commands/local-args-tower-msg.js

@@ -1,5 +1,7 @@
 import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** One `@`, no spaces: `"ping @bob"` is text, not an address (BLI-23213). */
+const DM_ADDRESS_PATTERN = /^[^\s@]+@[^\s@]+$/;
 import { MSG_CHANNEL_BOOLEAN_FLAGS, MSG_CHANNEL_VALUE_FLAGS, isMsgChannelAction, msgChannelNormalizeArgs, parseMsgChannelArgs, rejectMsgChannelFlags } from "./msg-channel-args.js";
 import { MSG_CONTEXT_VALUE_FLAGS, parseMsgContextArgs, rejectMsgContextFlags } from "./msg-context-args.js";
 import { MSG_MARK_VALUE_FLAGS, isMsgMarkAction, parseMsgMarkArgs, rejectMsgMarkFlags } from "./msg-mark-args.js";
@@ -123,14 +125,16 @@ export function parseMsgArgs(rawArgs) {
         throw new Error("--before belongs to msg read or msg thread.");
     }
     const { markRead, unreadFrom } = parseMsgReadLineFlags(action, values);
-    const { channelName, dmEmail } = parseMsgCreateTarget(action, rest);
+    const { channelName, dmEmail, dmTextArgument } = parseMsgCreateTarget(action, rest);
     const { isPrivate, memberEmails, description } = parseMsgCreateFlags(action, values);
     const { channelRef, threadId, limit } = parseMsgReadTarget(action, rest, values);
     const writeSafety = parseMsgWriteSafety(action, rest, values);
     const built = buildMsgCommand(values, action, channelRef, channelName, dmEmail, memberEmails, description, isPrivate, threadId, limit, markRead, unreadFrom, writeSafety);
     // `msg dm a@x b@y` is a group message: the single-address shape (dmEmail) is unchanged (BLI-21685).
     const withGroup = action === "dm" && rest.length > 1 ? { ...built, dmEmails: rest } : built;
-    return fileIds.length > 0 ? { ...withGroup, fileIds } : withGroup;
+    // BLI-23213: text typed after `msg dm <email>` is refused by name at run time (no help dump); the text is piped in.
+    const withText = dmTextArgument ? { ...withGroup, dmTextArgument } : withGroup;
+    return fileIds.length > 0 ? { ...withText, fileIds } : withText;
 }
 /**
  * `cockpit msg search [words] [--from <email|me>]... [--in <channel>] [--since <day>] [--until <day>] [--timezone <zone>]
@@ -333,8 +337,8 @@ function parseMsgWriteSafety(action, rest, values) {
     const requestId = optionalNonEmpty(values.flags.get("--request-id"));
     if (requestId && !UUID_PATTERN.test(requestId))
         throw new Error("--request-id must be a UUID.");
-    if (requestId && action !== "send" && action !== "edit" && action !== "delete") {
-        throw new Error("--request-id belongs to `cockpit msg send`, `edit` or `delete`.");
+    if (requestId && action !== "send" && action !== "dm" && action !== "edit" && action !== "delete") {
+        throw new Error("--request-id belongs to `cockpit msg send`, `dm`, `edit` or `delete`.");
     }
     const expectedRevision = optionalPositiveInteger(values.flags.get("--expected-revision"), "--expected-revision");
     if (expectedRevision !== undefined && action !== "edit" && action !== "delete") {
@@ -379,6 +383,7 @@ function parseMsgAction(positionals) {
 function parseMsgCreateTarget(action, rest) {
     let channelName;
     let dmEmail;
+    let dmTextArgument = false;
     if (action === "create") {
         channelName = optionalNonEmpty(rest[0]);
         if (!channelName)
@@ -396,11 +401,9 @@ function parseMsgCreateTarget(action, rest) {
         dmEmail = optionalNonEmpty(rest[0]);
         if (!dmEmail)
             throw new Error("msg dm needs the person's email address, e.g. `cockpit msg dm ada@example.com` (several for a group message).");
-        const notAnAddress = rest.find((email) => !email.includes("@"));
-        if (notAnAddress !== undefined)
-            throw new Error(`msg dm takes email addresses; "${notAnAddress}" is not one.`);
+        dmTextArgument = rest.some((email) => !DM_ADDRESS_PATTERN.test(email));
     }
-    return { channelName, dmEmail };
+    return { channelName, dmEmail, dmTextArgument };
 }
 function parseMsgCreateFlags(action, values) {
     const isPrivate = values.booleans.has("--private");

package/dist/commands/local-help-commands-tower.js

@@ -107,7 +107,7 @@ export const TOWER_COMMAND_HELP = [
             "Channels and messages, typed. <channel> is a channel id, or its name with or without a leading #.",
             "channels — every channel you are a member of (or, as a super_admin, every channel).",
             "create <name> [--private] [--members a@x.test,b@y.test] [--description \"<text>\"] — makes a channel and prints its id. A leading # is fine; --private means membership decides who may read it, and --members names who joins at birth BY EMAIL. An address Tower does not carry refuses the whole create — no half-built channel.",
-            "dm <email> — opens (or re-opens) the direct message with one person. Idempotent: the same address always resolves to the same channel, and you never have to name yourself.",
+            "dm <email> [--request-id <uuid>] — opens (or re-opens) the direct message with one person. Idempotent: the same address always resolves to the same channel, and you never have to name yourself. Pipe text in and it is also sent there in the same call, through the same door and request-id receipt as send: `echo \"hello\" | cockpit msg dm ada@example.com` (retry a lost answer with the SAME --request-id; it posts once). The text is never accepted on the command line: `msg dm ada@example.com \"hello\"` is refused dm_text_argument, exit 1, and nothing is sent.",
             "dm <email> [<email>...] — with several addresses, opens (or re-opens) the group message with exactly those people plus you; the same set always resolves to the same channel. channel <channel> [--json] — the channel's details: name, description, kind, archived, audience (a public channel is everyone in the org, not a member count), source workspace label (where it came from; it grants no access), whether you can manage it, and whether you hid it. channel <channel> --rename <name> | --describe <text> | --archive | --unarchive — changes it (one update; --rename and --describe can go together). Only the person who made the channel, its owners and its moderators can; anyone else is refused channel_manage_refused, a name in use channel_name_taken, a direct message dm_not_editable. Archiving keeps every message and link and stops new posts (channel_archived); unarchive restores posting. members <channel> [--json] — who is in a private channel or a direct message; a public channel says everyone in the org can read it. members <channel> --add <email> | --remove <email> — private channels only, by the same people who can manage it; a removed person's next read is refused. A direct message keeps the people it started with (dm_not_editable): start a new group with `msg dm a@x b@y`. hide <channel> / unhide <channel> — drops a PUBLIC channel from your own sidebar, or puts it back; it changes nothing for anyone else and nothing about reading, search, mentions or notifications. A private channel or direct message is refused hide_not_public.",
             "read <channel> [--limit <n>] [--thread <id>] [--mark-read] — the channel's most recent top-level messages, oldest first; --thread <id> reads one thread's replies instead. The first page also says where the messages come from (for an imported Slack channel: how long ago the archive was checked, or that it is unknown) and where YOUR read line stands. Reading never moves the read line; --mark-read moves it to the newest message shown, and says plainly if that failed.",
             "unread <channel> --from <message-id> — marks that message and everything after it unread, so the web sidebar badge and the NEW MESSAGES line start there. Opening or reading a channel never clears unseen history.",

package/dist/commands/local-help-notes.js

@@ -6,8 +6,8 @@ export const NOTES_HELP = [
             "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>|record start|stop|status|cancel|app install|uninstall|status] [flags]",
             "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 1 GB. Over 4 MB (a whole meeting) the file goes straight to storage and is transcribed in the background; --wait then polls for up to 4 hours and prints progress, otherwise for at most 330 seconds.",
             "",
-            "record start|stop [<session-id>]|status|cancel — record a meeting in a room from this Mac's microphone (Apple Silicon macOS; Windows says it is not supported yet). Nothing leaves the machine while recording and there is no auto-stop. `stop` trims the silence away locally, uploads only the speech, and Tower writes a note with Speaker 1, Speaker 2... lines (add --wait to watch the transcription). `cancel` stops and KEEPS the file; `status` lists what is recording or waiting; `stop <session-id>` finishes a cancelled or crashed session. The original recording stays on this machine.",
-            "app install|uninstall|status [--json] — the BLI Notetaker menu-bar app (Apple Silicon macOS; Windows and Linux say they are not supported yet). `install` asks Tower for the newest release, downloads it, refuses it if its sha256 differs, puts it in ~/Applications/BLI Notetaker.app (replacing an older one), clears the download quarantine and starts it at login with a LaunchAgent. The menu runs the `record` verbs above: Record, Stop, Open last note, Finish last recording. Log: ~/Library/Logs/BLI Notetaker.log. `uninstall` removes the app and the LaunchAgent and keeps your recordings; `status` says what is installed, whether it runs, and whether a newer release exists.",
+            "record start|stop [<session-id>]|status|cancel — record a meeting in a room from this machine's microphone (Apple Silicon macOS and Windows; Linux says it is not supported). On Windows the microphone needs Settings > Privacy & security > Microphone on, including Let desktop apps access your microphone. Nothing leaves the machine while recording and there is no auto-stop. `stop` trims the silence away locally, uploads only the speech, and Tower writes a note with Speaker 1, Speaker 2... lines (add --wait to watch the transcription). `cancel` stops and KEEPS the file; `status` lists what is recording or waiting; `stop <session-id>` finishes a cancelled or crashed session. The original recording stays on this machine.",
+            "app install|uninstall|status [--json] — the BLI Notetaker app (Apple Silicon macOS menu bar, or 64-bit Windows 10/11 taskbar notification area; Linux and Windows on Arm say they are not supported yet). `install` asks Tower for the newest release for this machine, downloads it, refuses it if its sha256 differs, and starts it at login: on the Mac it goes in ~/Applications/BLI Notetaker.app (replacing an older one, download quarantine cleared) with a LaunchAgent; on Windows it goes in %LOCALAPPDATA%\\Programs\\BLI Notetaker\\bli-notetaker.exe with a Startup entry (HKCU Run value, no admin; Windows does not block it because the CLI downloaded it). The menu runs the `record` verbs above: Record, Stop, Open last note, Finish last recording. Log: ~/Library/Logs/BLI Notetaker.log on the Mac, %LOCALAPPDATA%\\BLI Notetaker\\notetaker.log on Windows. `uninstall` removes the app and its startup entry and keeps your recordings and the log; `status` says what is installed, whether it runs, whether it starts at login, and whether a newer release exists.",
             "folders [--tree] [--json]: list folders and visible note counts.",
             "mkdir <path> [--json]: create a folder and any missing ancestors.",
             "rename <path> --name <name> [--json]: rename a folder and its descendant paths.",

package/dist/commands/msg-dm.js

@@ -1,13 +1,39 @@
-/** `cockpit msg dm <email>`: lookup-or-create a direct message (BLI-3749). Split out of `msg.ts` for the file-size ratchet. */
+/**
+ * `cockpit msg dm <email> [<email>...]`: lookup-or-create a direct message (BLI-3749). Split out of `msg.ts` for the file-size ratchet.
+ * BLI-23213: text piped in is sent into the DM through the same send door `msg send` uses (request id, receipt,
+ * `--request-id` for a retry); text typed on the command line is refused by name, because a message never travels there.
+ */
+import { randomUUID } from "node:crypto";
 import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
-import { writeLine } from "./cli-io.js";
+import { isInteractiveStdin, writeLine } from "./cli-io.js";
+import { postMessage, readContent } from "./msg-write.js";
 const TAG = "[msg cli]";
 const WRITE_DEADLINE_MS = 30_000;
+export const DM_TEXT_ARGUMENT_DETAIL = "dm takes addresses only; pipe the text in: echo \"<text>\" | cockpit msg dm <email>";
+/**
+ * `msg dm a@x "hello"` used to drown its one reason line in the whole msg manual and send nothing, so reports
+ * written that way vanished. It is refused here, before pairing or any request, with the reason and the right form.
+ */
+export function refuseDmTextArgument(command, io) {
+    writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason: "dm_text_argument" })}`);
+    if (command.json)
+        writeLine(io.stdout, JSON.stringify({ ok: false, error: "dm_text_argument", detail: DM_TEXT_ARGUMENT_DETAIL }));
+    else
+        writeLine(io.stderr, DM_TEXT_ARGUMENT_DETAIL);
+    return 1;
+}
 export async function openDm(command, door) {
     const emails = command.dmEmails ?? (command.dmEmail ? [command.dmEmail] : []);
     const email = emails.join(", ");
     if (emails.length === 0)
         return failAgentDoor(door, TAG, "invalid_body", "msg dm needs an email address.");
+    // Read before opening, so text over the limit is refused before anything is created.
+    const piped = isInteractiveStdin(door.io) ? { ok: true, text: "" } : await readContent(door.io);
+    if (!piped.ok)
+        return failAgentDoor(door, TAG, piped.reason, piped.detail);
+    if (command.requestId && piped.text === "") {
+        return failAgentDoor(door, TAG, "invalid_body", "--request-id on msg dm goes with piped text, e.g. `echo \"hello\" | cockpit msg dm <email> --request-id <uuid>`. Nothing was opened or sent.");
+    }
     const answer = await askAgentDoor(door, {
         path: "/api/msg/channels",
         method: "POST",
@@ -18,11 +44,25 @@ export async function openDm(command, door) {
     if (!answer.ok)
         return failAgentDoor(door, TAG, answer.reason, answer.detail);
     const channel = answer.body.channel ?? null;
-    writeLine(door.io.stderr, `${TAG} dm resolved ${JSON.stringify({ channel_id: channel?.id ?? null })}`);
-    if (door.json)
-        return emitAgentDoor(door, { ok: true, channel });
+    writeLine(door.io.stderr, `${TAG} dm resolved ${JSON.stringify({ channel_id: channel?.id ?? null, piped_chars: piped.text.length })}`);
     // Idempotent by contract (`get_or_create_dm`), so the wording says what is
     // true either way rather than claiming a creation that may not have happened.
-    writeLine(door.io.stdout, `${emails.length > 1 ? "Group message" : "Direct message"} with ${email}: ${channel?.id ?? "?"}`);
+    const opened = `${emails.length > 1 ? "Group message" : "Direct message"} with ${email}: ${channel?.id ?? "?"}`;
+    if (piped.text === "") {
+        if (door.json)
+            return emitAgentDoor(door, { ok: true, channel });
+        writeLine(door.io.stdout, opened);
+        return 0;
+    }
+    if (!channel?.id)
+        return failAgentDoor(door, TAG, "dm_channel_missing", "Tower answered without the direct message's id, so the piped text was NOT sent.");
+    const requestId = command.requestId ?? randomUUID();
+    const sent = await postMessage(door, channel.id, { text: piped.text, requestId });
+    if (!sent.ok)
+        return sent.exitCode;
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, channel, message: sent.message, mutation: sent.mutation });
+    writeLine(door.io.stdout, opened);
+    writeLine(door.io.stdout, `Sent to ${email} (${sent.message?.id ?? "?"}).`);
     return 0;
 }

package/dist/commands/msg-write.js

@@ -60,6 +60,31 @@ export function refuseMsgWrite(door, answer, requestId, verb) {
     }
     return failAgentDoor(door, TAG, answer.reason, answer.detail, mutation ? { mutation } : {});
 }
+/**
+ * The ONE send door `msg send` and `msg dm` (with piped text, BLI-23213) share: `POST /api/msg/channels/<id>/messages`
+ * with a request id, so a lost answer can be checked with `msg outcome` and a retry with the same id posts once.
+ * A refusal has already been printed when this answers `ok: false`; the receipt line is printed on success.
+ */
+export async function postMessage(door, channelId, post) {
+    const fileIds = post.fileIds ?? [];
+    const answer = await askAgentDoor(door, {
+        path: `/api/msg/channels/${encodeURIComponent(channelId)}/messages`,
+        method: "POST",
+        label: "msg send",
+        timeoutMs: WRITE_DEADLINE_MS,
+        body: {
+            ...(post.text === "" ? {} : { content: post.text }),
+            ...(fileIds.length > 0 ? { file_ids: fileIds } : {}),
+            request_id: post.requestId,
+            ...(post.threadId ? { thread_parent_id: post.threadId } : {}),
+        },
+    });
+    if (!answer.ok)
+        return { ok: false, exitCode: refuseMsgWrite(door, answer, post.requestId, "send") };
+    const { message = null, mutation = null } = answer.body;
+    writeLine(door.io.stderr, `${TAG} sent ${JSON.stringify({ channel_id: channelId, message_id: message?.id ?? null, request_id: post.requestId, chars: post.text.length, files: fileIds.length })}`);
+    return { ok: true, message, mutation };
+}
 /** `cockpit msg edit <message-id> [--expected-revision <n>] [--request-id <uuid>]` — the new text is piped in. */
 export async function editMessage(command, door) {
     const content = await readContent(door.io);

package/dist/commands/msg.js

@@ -23,14 +23,16 @@ import { markReadThrough } from "./msg-read-line.js";
 import { runMsgActivityVerb } from "./msg-activity.js";
 import { runMsgDraft } from "./msg-draft.js";
 import { runMsgSearch } from "./msg-search.js";
-import { openDm } from "./msg-dm.js";
+import { openDm, refuseDmTextArgument } from "./msg-dm.js";
 import { runMsgMark } from "./msg-mark.js";
 import { runMsgChannel } from "./msg-channel.js";
 import { runMsgFile } from "./msg-file.js";
-import { deleteMessage, editMessage, messageOutcome, messageText, readContent, refuseMsgWrite } from "./msg-write.js";
+import { deleteMessage, editMessage, messageOutcome, messageText, postMessage, readContent } from "./msg-write.js";
 const TAG = "[msg cli]";
 const [READ_DEADLINE_MS, WRITE_DEADLINE_MS] = [30_000, 30_000];
 export async function runMsg(command, io) {
+    if (command.action === "dm" && command.dmTextArgument)
+        return refuseDmTextArgument(command, io);
     const door = await openAgentDoor("msg", command, io);
     switch (command.action) {
         case "show": return showMessage(command, door);
@@ -327,22 +329,10 @@ async function sendMessage(command, door) {
         return failAgentDoor(door, TAG, "invalid_body", "There was nothing to send. Nothing was sent.");
     // BLI-21314: every send carries a request id, so a lost response can be checked and a retry posts once.
     const requestId = command.requestId ?? randomUUID();
-    const answer = await askAgentDoor(door, {
-        path: `/api/msg/channels/${encodeURIComponent(resolved.id)}/messages`,
-        method: "POST",
-        label: "msg send",
-        timeoutMs: WRITE_DEADLINE_MS,
-        body: {
-            ...(text === "" ? {} : { content: text }),
-            ...(fileIds.length > 0 ? { file_ids: fileIds } : {}),
-            request_id: requestId,
-            ...(command.threadId ? { thread_parent_id: command.threadId } : {}),
-        },
-    });
-    if (!answer.ok)
-        return refuseMsgWrite(door, answer, requestId, "send");
-    const { message = null, mutation = null } = answer.body;
-    writeLine(door.io.stderr, `${TAG} sent ${JSON.stringify({ channel_id: resolved.id, message_id: message?.id ?? null, request_id: requestId, chars: text.length, files: fileIds.length })}`);
+    const sent = await postMessage(door, resolved.id, { text, fileIds, requestId, ...(command.threadId ? { threadId: command.threadId } : {}) });
+    if (!sent.ok)
+        return sent.exitCode;
+    const { message, mutation } = sent;
     if (door.json)
         return emitAgentDoor(door, { ok: true, message, mutation });
     writeLine(door.io.stdout, `Sent to ${ref} (${message?.id ?? "?"}).`);

package/dist/commands/notes-app-shared.js

@@ -0,0 +1,84 @@
+/**
+ * What the macOS and Windows halves of `cockpit notes app` share (BLI-23208): the dependency bag, the Tower release
+ * question (platform-aware), the checked download, and the one refusal / answer shape. Sibling of `notes-app.ts`
+ * (router and the Mac half) and `notes-app-windows.ts`.
+ */
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { readFile, stat } from "node:fs/promises";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { writeLine } from "./cli-io.js";
+import { ask } from "./notes-door.js";
+export const TAG = "[notes app]";
+const RELEASE_DEADLINE_MS = 30_000;
+const DOWNLOAD_DEADLINE_MS = 10 * 60_000;
+export function say(io, command, human, json) {
+    writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, ...json }) : human);
+    return 0;
+}
+export function refuse(io, command, reason, sentence, fields = {}) {
+    writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason, ...fields })}`);
+    if (command.json)
+        writeLine(io.stdout, JSON.stringify({ ok: false, reason, detail: sentence }));
+    else
+        writeLine(io.stderr, sentence);
+    return 1;
+}
+export const exists = async (file) => stat(file).then(() => true, () => false);
+export async function readReceipt(file) {
+    try {
+        const parsed = JSON.parse((await readFile(file, "utf8")).replace(/^/, ""));
+        return typeof parsed.tag === "string" && typeof parsed.version === "string" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Ask the paired Tower for the newest release for `platform`; a refusal comes back as reason + sentence. */
+export async function newestRelease(deps, platform) {
+    const door = await deps.door();
+    if (!("deviceToken" in door))
+        return { ok: false, reason: door.reason, detail: door.detail };
+    const answer = await ask(door, { path: `/api/notes/app/release?platform=${platform}`, method: "GET", label: "notes app release", timeoutMs: RELEASE_DEADLINE_MS });
+    if (!answer.ok)
+        return answer;
+    const body = answer.body;
+    const sha = typeof body.sha256 === "string" ? body.sha256.toLowerCase() : "";
+    if (!body.tag || !body.version || !/^[0-9a-f]{64}$/.test(sha) || !body.zip?.url?.startsWith("https://")) {
+        return { ok: false, reason: "release_answer_unreadable", detail: "Tower answered without a release this command can install." };
+    }
+    // A door older than BLI-23208 ignores `?platform=` and answers the Mac zip: never install that on another machine.
+    if (platform !== "darwin-arm64" && body.platform !== platform) {
+        return { ok: false, reason: "release_platform_mismatch", detail: `Tower answered for ${body.platform ?? "an unnamed platform"}, not ${platform}. Its release door needs the Windows update before this machine can install the app.` };
+    }
+    return { ok: true, release: { tag: body.tag, version: body.version, sha256: sha, zip: body.zip }, door };
+}
+/** Stream `url` to `dest`, hashing as it goes. No credential is sent: the link is GitHub's own signed one. */
+export async function downloadToFile(fetchImpl, url, dest) {
+    let response;
+    try {
+        response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_DEADLINE_MS) });
+    }
+    catch {
+        return { ok: false, reason: "download_unreachable" };
+    }
+    if (!response.ok || !response.body)
+        return { ok: false, reason: `download_http_${response.status}` };
+    const hash = createHash("sha256");
+    let bytes = 0;
+    const meter = new Transform({
+        transform(chunk, _encoding, done) {
+            hash.update(chunk);
+            bytes += chunk.length;
+            done(null, chunk);
+        },
+    });
+    try {
+        await pipeline(Readable.fromWeb(response.body), meter, createWriteStream(dest, { mode: 0o600 }));
+    }
+    catch {
+        return { ok: false, reason: "download_interrupted" };
+    }
+    return { ok: true, bytes, sha256: hash.digest("hex") };
+}

package/dist/commands/notes-app-windows.js

@@ -0,0 +1,220 @@
+/**
+ * `cockpit notes app install | uninstall | status` on Windows (BLI-23208): the same contract as the Mac half in
+ * `notes-app.ts`, with the Windows parts swapped in.
+ *
+ *   install    asks Tower for the `win32-x64` release, downloads the zip with Node (so it carries no Mark-of-the-Web
+ *              and SmartScreen has nothing to block), REFUSES it if the sha256 differs, unpacks it with the tar.exe
+ *              Windows 10 1803+ ships, stops a running copy, replaces
+ *              `%LOCALAPPDATA%\Programs\BLI Notetaker\bli-notetaker.exe`, writes `install-receipt.json`, registers the
+ *              HKCU Run value (no admin, no Task Scheduler) and starts the app now, windowless and detached.
+ *   uninstall  stops it, deletes the Run value and the install directory. Recordings and the log stay.
+ *   status     installed, startup registered (and pointing here), running (pid), newest release, update available.
+ *
+ * Every external program is addressed by its System32 path (a Git-for-Windows `tar` earlier on PATH must not win).
+ * Output of `reg` and `tasklist` is read defensively: NULs, a BOM and localised "no match" prose are all tolerated.
+ */
+import { randomBytes } from "node:crypto";
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import path from "node:path";
+import { writeLine } from "./cli-io.js";
+import { parseWmiLaunchOutput, startProcessScript, windowsPowerShellPath } from "./notes-record-capture-win32.js";
+import { TAG, downloadToFile, exists, newestRelease, readReceipt, refuse, say } from "./notes-app-shared.js";
+export const NOTETAKER_WIN_EXE = "bli-notetaker.exe";
+export const NOTETAKER_WIN_RUN_VALUE = "BLI Notetaker";
+export const NOTETAKER_WIN_RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+const WIN = "win32-x64";
+const REPLACE_ATTEMPTS = 7;
+const REPLACE_WAIT_MS = 500;
+const BUSY = new Set(["EPERM", "EBUSY", "EACCES"]);
+const NONE = { code: 1, stdout: "", stderr: "" };
+/** `%LOCALAPPDATA%` (or, failing that, the Local sibling of `%APPDATA%`, or `<home>\AppData\Local`). */
+export function notetakerWindowsPaths(env, homeDir, p = path.win32) {
+    const local = env.LOCALAPPDATA || (env.APPDATA ? p.join(p.dirname(env.APPDATA), "Local") : p.join(homeDir, "AppData", "Local"));
+    const programs = p.join(local, "Programs");
+    const dir = p.join(programs, "BLI Notetaker");
+    return { programs, dir, exe: p.join(dir, NOTETAKER_WIN_EXE), receipt: p.join(dir, "install-receipt.json"), log: p.join(local, "BLI Notetaker", "notetaker.log") };
+}
+export function windowsSystemTool(env, name, p = path.win32) {
+    return p.join(env.SystemRoot ?? env.WINDIR ?? "C:\\Windows", "System32", name);
+}
+/** The Run value: the quoted exe, then `--tower-url` when the address is plain enough to sit on a command line. */
+export function runValueCommand(exe, towerUrl) {
+    const plain = towerUrl !== undefined && /^https?:\/\/[^\s"]+$/.test(towerUrl);
+    return `"${exe}"${plain ? ` --tower-url ${towerUrl}` : ""}`;
+}
+/** `reg add` arguments. Node quotes the `/d` value for CreateProcess (`\"` for each embedded quote), which reg.exe reads back. */
+export const regAddArgs = (value) => ["add", NOTETAKER_WIN_RUN_KEY, "/v", NOTETAKER_WIN_RUN_VALUE, "/t", "REG_SZ", "/d", value, "/f"];
+const clean = (text) => text.replace(/\u0000/g, "").replace(/^\uFEFF/, "");
+/** `reg query ... /v "BLI Notetaker"` → the value's data, or null when there is none. */
+export function parseRunValue(stdout) {
+    const match = /^\s+BLI Notetaker\s+REG_(?:SZ|EXPAND_SZ)\s+(.*?)\s*$/im.exec(clean(stdout));
+    return match?.[1] ?? null;
+}
+/** First token of a Run value: the quoted exe path, or the text up to the first space. */
+export function runValueExe(value) {
+    return value.startsWith('"') ? value.slice(1).split('"')[0] ?? "" : value.split(" ")[0] ?? "";
+}
+/** `tasklist /FO CSV /NH` → the pid of the first `bli-notetaker.exe` row. Prose in any language means none. */
+export function parseTasklistPid(stdout) {
+    const match = /^"bli-notetaker\.exe","(\d+)"/im.exec(clean(stdout));
+    return match ? Number(match[1]) : null;
+}
+/**
+ * Start the app through Start-Process (ShellExecute), never as a Node child: libuv creates children with handle
+ * inheritance on, so a Node-spawned app held this CLI's stdout pipe for as long as it ran and anything reading
+ * `install` through a pipe (a script, an agent) waited until the app quit. Seen on a Windows 11 box.
+ */
+async function defaultLaunch(exe, args) {
+    const powershell = windowsPowerShellPath();
+    const script = startProcessScript(exe, args);
+    return await new Promise((resolve) => {
+        execFile(powershell, ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 20_000, encoding: "buffer" }, (error, stdout) => {
+            if (error && !stdout?.length)
+                return resolve({ ok: false, detail: error.code?.toString() ?? "start_process_failed" });
+            const answer = parseWmiLaunchOutput(stdout);
+            resolve(answer.ok ? { ok: true } : { ok: false, detail: `start_process_${answer.code}` });
+        });
+    });
+}
+const timer = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Run `action` until it stops failing with a "still in use" code, for about three seconds. */
+export async function whileBusy(deps, action) {
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            await action();
+            return { ok: true, attempts: attempt };
+        }
+        catch (error) {
+            const code = error.code ?? "unknown";
+            if (!BUSY.has(code) || attempt >= REPLACE_ATTEMPTS)
+                return { ok: false, code, attempts: attempt };
+            await (deps.sleep ?? timer)(REPLACE_WAIT_MS);
+        }
+    }
+}
+export async function runNotesAppWindows(command, io, deps) {
+    const env = deps.env ?? process.env;
+    const p = deps.pathApi ?? path.win32;
+    const paths = notetakerWindowsPaths(env, deps.homeDir, p);
+    const tool = (name) => windowsSystemTool(env, name, p);
+    const run = async (name, args) => await deps.exec(tool(name), args).catch(() => NONE);
+    const verb = command.appAction ?? "status";
+    if (verb === "install")
+        return await install(command, io, deps, paths, run, tool);
+    if (verb === "uninstall")
+        return await uninstall(command, io, deps, paths, run);
+    return await status(command, io, deps, paths, run);
+}
+const stopApp = (run) => run("taskkill.exe", ["/F", "/T", "/IM", NOTETAKER_WIN_EXE]);
+async function install(command, io, deps, paths, run, tool) {
+    const p = deps.pathApi ?? path.win32;
+    const found = await newestRelease(deps, WIN);
+    if (!found.ok)
+        return refuse(io, command, found.reason, found.detail, { platform: WIN });
+    const { release, door } = found;
+    const previous = await readReceipt(paths.receipt);
+    writeLine(io.stderr, `${TAG} release ${JSON.stringify({ platform: WIN, tag: release.tag, zip_bytes: release.zip.bytes, previous: previous?.tag ?? null })}`);
+    if (!command.json)
+        writeLine(io.stderr, `Downloading BLI Notetaker ${release.version} (${(release.zip.bytes / 1_000_000).toFixed(1)} MB)...`);
+    await mkdir(paths.programs, { recursive: true });
+    const staging = p.join(paths.programs, `.bli-notetaker-install-${randomBytes(4).toString("hex")}`);
+    await mkdir(staging, { recursive: true });
+    try {
+        const zip = p.join(staging, "app.zip");
+        const downloaded = await downloadToFile(io.fetch, release.zip.url, zip);
+        if (!downloaded.ok) {
+            return refuse(io, command, downloaded.reason, `The download did not finish (${downloaded.reason}). Nothing was installed; try again.`);
+        }
+        if (downloaded.sha256 !== release.sha256) {
+            return refuse(io, command, "sha256_mismatch", "The downloaded app does not match the checksum its release publishes, so it was not installed. Nothing on this PC changed.", { tag: release.tag, bytes: downloaded.bytes, expected_prefix: release.sha256.slice(0, 12), got_prefix: downloaded.sha256.slice(0, 12) });
+        }
+        writeLine(io.stderr, `${TAG} downloaded ${JSON.stringify({ tag: release.tag, bytes: downloaded.bytes, sha256_prefix: downloaded.sha256.slice(0, 12), reason: "sha256_match" })}`);
+        const unpacked = p.join(staging, "unpacked");
+        await mkdir(unpacked, { recursive: true });
+        const untar = await deps.exec(tool("tar.exe"), ["-xf", zip, "-C", unpacked]).catch(() => NONE);
+        const stagedExe = p.join(unpacked, NOTETAKER_WIN_EXE);
+        if (untar.code !== 0 || !(await exists(stagedExe))) {
+            return refuse(io, command, "bundle_unreadable", "The downloaded zip did not hold bli-notetaker.exe (or this PC's tar.exe could not unpack it). Nothing was installed.", { tar_exit: untar.code });
+        }
+        // Stop the running copy first. A recording in progress keeps going: the recorder is its own process, not the tray's child.
+        const stopped = await stopApp(run);
+        await mkdir(paths.dir, { recursive: true });
+        const replaced = await exists(paths.exe);
+        const moved = await whileBusy(deps, () => rename(stagedExe, paths.exe));
+        if (!moved.ok) {
+            return refuse(io, command, "exe_in_use", "BLI Notetaker is still running and Windows will not let it be replaced. Quit it from the notification area icon (click ^ if it is hidden), then run `cockpit notes app install` again.", { tag: release.tag, error_code: moved.code, attempts: moved.attempts, taskkill_exit: stopped.code });
+        }
+        writeLine(io.stderr, `${TAG} unpacked ${JSON.stringify({ replaced, previous: previous?.tag ?? null, taskkill_exit: stopped.code, replace_attempts: moved.attempts })}`);
+        const receipt = { tag: release.tag, version: release.version, sha256: release.sha256, installed_at: deps.now().toISOString() };
+        await writeFile(paths.receipt, `${JSON.stringify(receipt)}\n`, "utf8");
+        const registered = await run("reg.exe", regAddArgs(runValueCommand(paths.exe, door.dashboardUrl)));
+        writeLine(io.stderr, `${TAG} startup ${JSON.stringify({ registered: registered.code === 0, reg_exit: registered.code })}`);
+        const started = await (deps.launch ?? defaultLaunch)(paths.exe, door.dashboardUrl ? ["--tower-url", door.dashboardUrl] : []);
+        writeLine(io.stderr, `${TAG} installed ${JSON.stringify({ tag: release.tag, replaced, startup_registered: registered.code === 0, started: started.ok, launch_detail: started.detail ?? null })}`);
+        if (registered.code !== 0 || !started.ok) {
+            return refuse(io, command, registered.code !== 0 ? "startup_registration_failed" : "launch_failed", `BLI Notetaker ${release.version} is installed at ${paths.exe}, but ${registered.code !== 0 ? "Windows would not register it to start when you sign in" : `it could not be started (${started.detail ?? "unknown"})`}. Run \`cockpit notes app install\` again, or open it from that folder.`, { tag: release.tag, reg_exit: registered.code });
+        }
+        return say(io, command, [
+            `Installed BLI Notetaker ${release.version}${replaced ? ` (replaced ${previous?.version ?? "an older copy"})` : ""} and started it.`,
+            "Look for the BLI Notetaker icon in the taskbar notification area (click ^ if it is hidden): Record, Stop, Open last note. It starts again when you sign in.",
+            `App: ${paths.exe}`,
+            `Log: ${paths.log}`,
+            "The app is not code-signed. Windows SmartScreen does not block it because this command downloaded it itself, so it carries no \"downloaded from the internet\" mark. The first Record uses the microphone allowed in Settings > Privacy & security > Microphone.",
+        ].join("\n"), { installed: true, platform: WIN, tag: release.tag, version: release.version, replaced, previous: previous?.tag ?? null, app: paths.exe, startup: { registered: true, key: `${NOTETAKER_WIN_RUN_KEY}\\${NOTETAKER_WIN_RUN_VALUE}` }, log: paths.log });
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+async function uninstall(command, io, deps, paths, run) {
+    // taskkill exits 128 when nothing was running, which is fine.
+    const stopped = await stopApp(run);
+    const had = { app: await exists(paths.exe), receipt: await exists(paths.receipt), startup: parseRunValue((await run("reg.exe", ["query", NOTETAKER_WIN_RUN_KEY, "/v", NOTETAKER_WIN_RUN_VALUE])).stdout) !== null };
+    const deleted = await run("reg.exe", ["delete", NOTETAKER_WIN_RUN_KEY, "/v", NOTETAKER_WIN_RUN_VALUE, "/f"]);
+    const dirGone = await whileBusy(deps, () => rm(paths.dir, { recursive: true, force: true }));
+    writeLine(io.stderr, `${TAG} uninstalled ${JSON.stringify({ ...had, taskkill_exit: stopped.code, reg_delete_exit: deleted.code, dir_removed: dirGone.ok, error_code: dirGone.ok ? null : dirGone.code })}`);
+    if (!dirGone.ok) {
+        return refuse(io, command, "exe_in_use", "BLI Notetaker is still running and Windows will not let its folder be removed. Quit it from the notification area icon, then run `cockpit notes app uninstall` again.", { error_code: dirGone.code, attempts: dirGone.attempts });
+    }
+    if (!had.app && !had.startup)
+        return say(io, command, "BLI Notetaker was not installed. Nothing to remove.", { removed: false });
+    return say(io, command, [
+        "Removed BLI Notetaker: the app, its startup entry and its receipt.",
+        `Your recordings stay on this PC (\`cockpit notes record status\` lists any not yet uploaded), and so does the log: ${paths.log}`,
+    ].join("\n"), { removed: true, ...had });
+}
+async function status(command, io, deps, paths, run) {
+    const receipt = await readReceipt(paths.receipt);
+    const installed = await exists(paths.exe);
+    const value = parseRunValue((await run("reg.exe", ["query", NOTETAKER_WIN_RUN_KEY, "/v", NOTETAKER_WIN_RUN_VALUE])).stdout);
+    const p = deps.pathApi ?? path.win32;
+    const pointsHere = value !== null && p.normalize(runValueExe(value)).toLowerCase() === p.normalize(paths.exe).toLowerCase();
+    const pid = parseTasklistPid((await run("tasklist.exe", ["/FI", `IMAGENAME eq ${NOTETAKER_WIN_EXE}`, "/FO", "CSV", "/NH"])).stdout);
+    const running = pid !== null;
+    // The newest release is best effort: a status line without it is still an answer.
+    const newest = await newestRelease(deps, WIN);
+    const newestTag = newest.ok ? newest.release.tag : null;
+    const update = Boolean(installed && newestTag && receipt?.tag !== newestTag);
+    writeLine(io.stderr, `${TAG} status ${JSON.stringify({ platform: WIN, installed, tag: receipt?.tag ?? null, startup_registered: value !== null, points_here: pointsHere, running, newest: newestTag, newest_reason: newest.ok ? null : newest.reason })}`);
+    const json = {
+        platform: WIN, installed, tag: receipt?.tag ?? null, version: receipt?.version ?? null, installed_at: receipt?.installed_at ?? null,
+        app: paths.exe, startup: { registered: value !== null, points_here: pointsHere, key: `${NOTETAKER_WIN_RUN_KEY}\\${NOTETAKER_WIN_RUN_VALUE}` },
+        process: { running, pid }, log: paths.log,
+        newest: newest.ok ? { tag: newest.release.tag, version: newest.release.version } : { reason: newest.reason },
+        update_available: update,
+    };
+    const lines = installed
+        ? [
+            `BLI Notetaker ${receipt?.version ?? "(version unknown)"} is installed: ${paths.exe}`,
+            running ? `Running (pid ${pid}). Look for its icon in the taskbar notification area (click ^ if it is hidden).` : "Not running; run `cockpit notes app install` to start it now, or it starts when you sign in.",
+            value === null ? "Not set to start when you sign in; run `cockpit notes app install` to register it." : pointsHere ? "Starts again when you sign in." : "Its sign-in entry points at a different file; run `cockpit notes app install` to repair it.",
+            newest.ok ? (update ? `A newer release exists: ${newest.release.version}. Run \`cockpit notes app install\` to update.` : "It is the newest release.") : `Could not check for a newer release (${newest.reason}).`,
+            `Log: ${paths.log}`,
+        ]
+        : [
+            "BLI Notetaker is not installed. Run `cockpit notes app install`.",
+            newest.ok ? `Newest release: ${newest.release.version}.` : `Could not check the newest release (${newest.reason}).`,
+        ];
+    return say(io, command, lines.join("\n"), json);
+}