@bli-cockpit/cli 0.2.260 → 0.2.262

package/dist/commands/local-args.js

@@ -19,6 +19,7 @@ import { parseGlossaryArgs } from "./glossary.js";
 import { parseSpendArgs } from "./spend.js";
 import { parsePushArgs } from "./push.js";
 import { parseRootsArgs } from "./roots.js";
+import { parseSlackPrivacyArgs } from "./slack-privacy-args.js";
 import { parseMilestoneArgs } from "./local-args-tower-milestone.js";
 import { SURFACE_ALIASES } from "./local-help.js";
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
@@ -67,7 +68,8 @@ const COMMAND_PARSERS = new Map([
     ["ci", (_command, rest) => parseCiArgs(rest)],
     ["delivery", (_command, rest) => parseDeliveryArgs(rest)],
     ["ops", (_command, rest) => parseOpsArgs(rest)],
-    ["slack", (_command, rest) => parseSlackArgs(rest)],
+    // BLI-23244: `slack privacy` has its own flags and its own file.
+    ["slack", (_command, rest) => (rest.includes("privacy") ? parseSlackPrivacyArgs(rest.filter((arg) => arg !== "privacy")) : parseSlackArgs(rest))],
     ["settings", (_command, rest) => parseSettingsArgs(rest)],
     ["team", (_command, rest) => parseTeamArgs(rest)],
     ["workbook", (_command, rest) => parseWorkbookArgs(rest)],

package/dist/commands/local-help-commands-tower.js

@@ -304,7 +304,13 @@ export const TOWER_COMMAND_HELP = [
     [
         "slack",
         [
-            "Usage: cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [filters] [--format compact|full]] [--json]",
+            "Usage: cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [filters] [--format compact|full] | privacy] [--json]",
+            "",
+            "  cockpit slack privacy   (founders only)",
+            "      Lists which Slack conversations Tower keeps out and lets in, and the founders' Slack ids.",
+            "      A DM or group DM that includes a founder, and any channel a founder excludes, never enters",
+            "      Tower unless a founder lets it in. Ids only (C…, D…, G…), never names. Changing a list needs",
+            "      a signed-in browser session (ticket 23265), never this machine's token. Anyone else: owner_only.",
             "",
             "  cockpit slack coverage",
             "      What Cockpit's Slack bot can see: how many channels it is in, what each",

package/dist/commands/local-help-notes.js

@@ -6,8 +6,8 @@ export const NOTES_HELP = [
             "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>|record start|stop|status|cancel|app install|uninstall|status] [flags]",
             "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 1 GB. Over 4 MB (a whole meeting) the file goes straight to storage and is transcribed in the background; --wait then polls for up to 4 hours and prints progress, otherwise for at most 330 seconds.",
             "",
-            "record start|stop [<session-id>]|status|cancel — record a meeting in a room from this Mac's microphone (Apple Silicon macOS; Windows says it is not supported yet). Nothing leaves the machine while recording and there is no auto-stop. `stop` trims the silence away locally, uploads only the speech, and Tower writes a note with Speaker 1, Speaker 2... lines (add --wait to watch the transcription). `cancel` stops and KEEPS the file; `status` lists what is recording or waiting; `stop <session-id>` finishes a cancelled or crashed session. The original recording stays on this machine.",
-            "app install|uninstall|status [--json] — the BLI Notetaker menu-bar app (Apple Silicon macOS; Windows and Linux say they are not supported yet). `install` asks Tower for the newest release, downloads it, refuses it if its sha256 differs, puts it in ~/Applications/BLI Notetaker.app (replacing an older one), clears the download quarantine and starts it at login with a LaunchAgent. The menu runs the `record` verbs above: Record, Stop, Open last note, Finish last recording. Log: ~/Library/Logs/BLI Notetaker.log. `uninstall` removes the app and the LaunchAgent and keeps your recordings; `status` says what is installed, whether it runs, and whether a newer release exists.",
+            "record start|stop [<session-id>]|status|cancel — record a meeting in a room from this machine's microphone (Apple Silicon macOS and Windows; Linux says it is not supported). On Windows the microphone needs Settings > Privacy & security > Microphone on, including Let desktop apps access your microphone. Nothing leaves the machine while recording and there is no auto-stop. `stop` trims the silence away locally, uploads only the speech, and Tower writes a note with Speaker 1, Speaker 2... lines (add --wait to watch the transcription). `cancel` stops and KEEPS the file; `status` lists what is recording or waiting; `stop <session-id>` finishes a cancelled or crashed session. The original recording stays on this machine.",
+            "app install|uninstall|status [--json] — the BLI Notetaker app (Apple Silicon macOS menu bar, or 64-bit Windows 10/11 taskbar notification area; Linux and Windows on Arm say they are not supported yet). `install` asks Tower for the newest release for this machine, downloads it, refuses it if its sha256 differs, and starts it at login: on the Mac it goes in ~/Applications/BLI Notetaker.app (replacing an older one, download quarantine cleared) with a LaunchAgent; on Windows it goes in %LOCALAPPDATA%\\Programs\\BLI Notetaker\\bli-notetaker.exe with a Startup entry (HKCU Run value, no admin; Windows does not block it because the CLI downloaded it). The menu runs the `record` verbs above: Record, Stop, Open last note, Finish last recording. Log: ~/Library/Logs/BLI Notetaker.log on the Mac, %LOCALAPPDATA%\\BLI Notetaker\\notetaker.log on Windows. `uninstall` removes the app and its startup entry and keeps your recordings and the log; `status` says what is installed, whether it runs, whether it starts at login, and whether a newer release exists.",
             "folders [--tree] [--json]: list folders and visible note counts.",
             "mkdir <path> [--json]: create a folder and any missing ancestors.",
             "rename <path> --name <name> [--json]: rename a folder and its descendant paths.",

package/dist/commands/notes-app-shared.js

@@ -0,0 +1,84 @@
+/**
+ * What the macOS and Windows halves of `cockpit notes app` share (BLI-23208): the dependency bag, the Tower release
+ * question (platform-aware), the checked download, and the one refusal / answer shape. Sibling of `notes-app.ts`
+ * (router and the Mac half) and `notes-app-windows.ts`.
+ */
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { readFile, stat } from "node:fs/promises";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { writeLine } from "./cli-io.js";
+import { ask } from "./notes-door.js";
+export const TAG = "[notes app]";
+const RELEASE_DEADLINE_MS = 30_000;
+const DOWNLOAD_DEADLINE_MS = 10 * 60_000;
+export function say(io, command, human, json) {
+    writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, ...json }) : human);
+    return 0;
+}
+export function refuse(io, command, reason, sentence, fields = {}) {
+    writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason, ...fields })}`);
+    if (command.json)
+        writeLine(io.stdout, JSON.stringify({ ok: false, reason, detail: sentence }));
+    else
+        writeLine(io.stderr, sentence);
+    return 1;
+}
+export const exists = async (file) => stat(file).then(() => true, () => false);
+export async function readReceipt(file) {
+    try {
+        const parsed = JSON.parse((await readFile(file, "utf8")).replace(/^/, ""));
+        return typeof parsed.tag === "string" && typeof parsed.version === "string" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Ask the paired Tower for the newest release for `platform`; a refusal comes back as reason + sentence. */
+export async function newestRelease(deps, platform) {
+    const door = await deps.door();
+    if (!("deviceToken" in door))
+        return { ok: false, reason: door.reason, detail: door.detail };
+    const answer = await ask(door, { path: `/api/notes/app/release?platform=${platform}`, method: "GET", label: "notes app release", timeoutMs: RELEASE_DEADLINE_MS });
+    if (!answer.ok)
+        return answer;
+    const body = answer.body;
+    const sha = typeof body.sha256 === "string" ? body.sha256.toLowerCase() : "";
+    if (!body.tag || !body.version || !/^[0-9a-f]{64}$/.test(sha) || !body.zip?.url?.startsWith("https://")) {
+        return { ok: false, reason: "release_answer_unreadable", detail: "Tower answered without a release this command can install." };
+    }
+    // A door older than BLI-23208 ignores `?platform=` and answers the Mac zip: never install that on another machine.
+    if (platform !== "darwin-arm64" && body.platform !== platform) {
+        return { ok: false, reason: "release_platform_mismatch", detail: `Tower answered for ${body.platform ?? "an unnamed platform"}, not ${platform}. Its release door needs the Windows update before this machine can install the app.` };
+    }
+    return { ok: true, release: { tag: body.tag, version: body.version, sha256: sha, zip: body.zip }, door };
+}
+/** Stream `url` to `dest`, hashing as it goes. No credential is sent: the link is GitHub's own signed one. */
+export async function downloadToFile(fetchImpl, url, dest) {
+    let response;
+    try {
+        response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_DEADLINE_MS) });
+    }
+    catch {
+        return { ok: false, reason: "download_unreachable" };
+    }
+    if (!response.ok || !response.body)
+        return { ok: false, reason: `download_http_${response.status}` };
+    const hash = createHash("sha256");
+    let bytes = 0;
+    const meter = new Transform({
+        transform(chunk, _encoding, done) {
+            hash.update(chunk);
+            bytes += chunk.length;
+            done(null, chunk);
+        },
+    });
+    try {
+        await pipeline(Readable.fromWeb(response.body), meter, createWriteStream(dest, { mode: 0o600 }));
+    }
+    catch {
+        return { ok: false, reason: "download_interrupted" };
+    }
+    return { ok: true, bytes, sha256: hash.digest("hex") };
+}

package/dist/commands/notes-app-windows.js

@@ -0,0 +1,220 @@
+/**
+ * `cockpit notes app install | uninstall | status` on Windows (BLI-23208): the same contract as the Mac half in
+ * `notes-app.ts`, with the Windows parts swapped in.
+ *
+ *   install    asks Tower for the `win32-x64` release, downloads the zip with Node (so it carries no Mark-of-the-Web
+ *              and SmartScreen has nothing to block), REFUSES it if the sha256 differs, unpacks it with the tar.exe
+ *              Windows 10 1803+ ships, stops a running copy, replaces
+ *              `%LOCALAPPDATA%\Programs\BLI Notetaker\bli-notetaker.exe`, writes `install-receipt.json`, registers the
+ *              HKCU Run value (no admin, no Task Scheduler) and starts the app now, windowless and detached.
+ *   uninstall  stops it, deletes the Run value and the install directory. Recordings and the log stay.
+ *   status     installed, startup registered (and pointing here), running (pid), newest release, update available.
+ *
+ * Every external program is addressed by its System32 path (a Git-for-Windows `tar` earlier on PATH must not win).
+ * Output of `reg` and `tasklist` is read defensively: NULs, a BOM and localised "no match" prose are all tolerated.
+ */
+import { randomBytes } from "node:crypto";
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import path from "node:path";
+import { writeLine } from "./cli-io.js";
+import { parseWmiLaunchOutput, startProcessScript, windowsPowerShellPath } from "./notes-record-capture-win32.js";
+import { TAG, downloadToFile, exists, newestRelease, readReceipt, refuse, say } from "./notes-app-shared.js";
+export const NOTETAKER_WIN_EXE = "bli-notetaker.exe";
+export const NOTETAKER_WIN_RUN_VALUE = "BLI Notetaker";
+export const NOTETAKER_WIN_RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+const WIN = "win32-x64";
+const REPLACE_ATTEMPTS = 7;
+const REPLACE_WAIT_MS = 500;
+const BUSY = new Set(["EPERM", "EBUSY", "EACCES"]);
+const NONE = { code: 1, stdout: "", stderr: "" };
+/** `%LOCALAPPDATA%` (or, failing that, the Local sibling of `%APPDATA%`, or `<home>\AppData\Local`). */
+export function notetakerWindowsPaths(env, homeDir, p = path.win32) {
+    const local = env.LOCALAPPDATA || (env.APPDATA ? p.join(p.dirname(env.APPDATA), "Local") : p.join(homeDir, "AppData", "Local"));
+    const programs = p.join(local, "Programs");
+    const dir = p.join(programs, "BLI Notetaker");
+    return { programs, dir, exe: p.join(dir, NOTETAKER_WIN_EXE), receipt: p.join(dir, "install-receipt.json"), log: p.join(local, "BLI Notetaker", "notetaker.log") };
+}
+export function windowsSystemTool(env, name, p = path.win32) {
+    return p.join(env.SystemRoot ?? env.WINDIR ?? "C:\\Windows", "System32", name);
+}
+/** The Run value: the quoted exe, then `--tower-url` when the address is plain enough to sit on a command line. */
+export function runValueCommand(exe, towerUrl) {
+    const plain = towerUrl !== undefined && /^https?:\/\/[^\s"]+$/.test(towerUrl);
+    return `"${exe}"${plain ? ` --tower-url ${towerUrl}` : ""}`;
+}
+/** `reg add` arguments. Node quotes the `/d` value for CreateProcess (`\"` for each embedded quote), which reg.exe reads back. */
+export const regAddArgs = (value) => ["add", NOTETAKER_WIN_RUN_KEY, "/v", NOTETAKER_WIN_RUN_VALUE, "/t", "REG_SZ", "/d", value, "/f"];
+const clean = (text) => text.replace(/\u0000/g, "").replace(/^\uFEFF/, "");
+/** `reg query ... /v "BLI Notetaker"` → the value's data, or null when there is none. */
+export function parseRunValue(stdout) {
+    const match = /^\s+BLI Notetaker\s+REG_(?:SZ|EXPAND_SZ)\s+(.*?)\s*$/im.exec(clean(stdout));
+    return match?.[1] ?? null;
+}
+/** First token of a Run value: the quoted exe path, or the text up to the first space. */
+export function runValueExe(value) {
+    return value.startsWith('"') ? value.slice(1).split('"')[0] ?? "" : value.split(" ")[0] ?? "";
+}
+/** `tasklist /FO CSV /NH` → the pid of the first `bli-notetaker.exe` row. Prose in any language means none. */
+export function parseTasklistPid(stdout) {
+    const match = /^"bli-notetaker\.exe","(\d+)"/im.exec(clean(stdout));
+    return match ? Number(match[1]) : null;
+}
+/**
+ * Start the app through Start-Process (ShellExecute), never as a Node child: libuv creates children with handle
+ * inheritance on, so a Node-spawned app held this CLI's stdout pipe for as long as it ran and anything reading
+ * `install` through a pipe (a script, an agent) waited until the app quit. Seen on a Windows 11 box.
+ */
+async function defaultLaunch(exe, args) {
+    const powershell = windowsPowerShellPath();
+    const script = startProcessScript(exe, args);
+    return await new Promise((resolve) => {
+        execFile(powershell, ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 20_000, encoding: "buffer" }, (error, stdout) => {
+            if (error && !stdout?.length)
+                return resolve({ ok: false, detail: error.code?.toString() ?? "start_process_failed" });
+            const answer = parseWmiLaunchOutput(stdout);
+            resolve(answer.ok ? { ok: true } : { ok: false, detail: `start_process_${answer.code}` });
+        });
+    });
+}
+const timer = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Run `action` until it stops failing with a "still in use" code, for about three seconds. */
+export async function whileBusy(deps, action) {
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            await action();
+            return { ok: true, attempts: attempt };
+        }
+        catch (error) {
+            const code = error.code ?? "unknown";
+            if (!BUSY.has(code) || attempt >= REPLACE_ATTEMPTS)
+                return { ok: false, code, attempts: attempt };
+            await (deps.sleep ?? timer)(REPLACE_WAIT_MS);
+        }
+    }
+}
+export async function runNotesAppWindows(command, io, deps) {
+    const env = deps.env ?? process.env;
+    const p = deps.pathApi ?? path.win32;
+    const paths = notetakerWindowsPaths(env, deps.homeDir, p);
+    const tool = (name) => windowsSystemTool(env, name, p);
+    const run = async (name, args) => await deps.exec(tool(name), args).catch(() => NONE);
+    const verb = command.appAction ?? "status";
+    if (verb === "install")
+        return await install(command, io, deps, paths, run, tool);
+    if (verb === "uninstall")
+        return await uninstall(command, io, deps, paths, run);
+    return await status(command, io, deps, paths, run);
+}
+const stopApp = (run) => run("taskkill.exe", ["/F", "/T", "/IM", NOTETAKER_WIN_EXE]);
+async function install(command, io, deps, paths, run, tool) {
+    const p = deps.pathApi ?? path.win32;
+    const found = await newestRelease(deps, WIN);
+    if (!found.ok)
+        return refuse(io, command, found.reason, found.detail, { platform: WIN });
+    const { release, door } = found;
+    const previous = await readReceipt(paths.receipt);
+    writeLine(io.stderr, `${TAG} release ${JSON.stringify({ platform: WIN, tag: release.tag, zip_bytes: release.zip.bytes, previous: previous?.tag ?? null })}`);
+    if (!command.json)
+        writeLine(io.stderr, `Downloading BLI Notetaker ${release.version} (${(release.zip.bytes / 1_000_000).toFixed(1)} MB)...`);
+    await mkdir(paths.programs, { recursive: true });
+    const staging = p.join(paths.programs, `.bli-notetaker-install-${randomBytes(4).toString("hex")}`);
+    await mkdir(staging, { recursive: true });
+    try {
+        const zip = p.join(staging, "app.zip");
+        const downloaded = await downloadToFile(io.fetch, release.zip.url, zip);
+        if (!downloaded.ok) {
+            return refuse(io, command, downloaded.reason, `The download did not finish (${downloaded.reason}). Nothing was installed; try again.`);
+        }
+        if (downloaded.sha256 !== release.sha256) {
+            return refuse(io, command, "sha256_mismatch", "The downloaded app does not match the checksum its release publishes, so it was not installed. Nothing on this PC changed.", { tag: release.tag, bytes: downloaded.bytes, expected_prefix: release.sha256.slice(0, 12), got_prefix: downloaded.sha256.slice(0, 12) });
+        }
+        writeLine(io.stderr, `${TAG} downloaded ${JSON.stringify({ tag: release.tag, bytes: downloaded.bytes, sha256_prefix: downloaded.sha256.slice(0, 12), reason: "sha256_match" })}`);
+        const unpacked = p.join(staging, "unpacked");
+        await mkdir(unpacked, { recursive: true });
+        const untar = await deps.exec(tool("tar.exe"), ["-xf", zip, "-C", unpacked]).catch(() => NONE);
+        const stagedExe = p.join(unpacked, NOTETAKER_WIN_EXE);
+        if (untar.code !== 0 || !(await exists(stagedExe))) {
+            return refuse(io, command, "bundle_unreadable", "The downloaded zip did not hold bli-notetaker.exe (or this PC's tar.exe could not unpack it). Nothing was installed.", { tar_exit: untar.code });
+        }
+        // Stop the running copy first. A recording in progress keeps going: the recorder is its own process, not the tray's child.
+        const stopped = await stopApp(run);
+        await mkdir(paths.dir, { recursive: true });
+        const replaced = await exists(paths.exe);
+        const moved = await whileBusy(deps, () => rename(stagedExe, paths.exe));
+        if (!moved.ok) {
+            return refuse(io, command, "exe_in_use", "BLI Notetaker is still running and Windows will not let it be replaced. Quit it from the notification area icon (click ^ if it is hidden), then run `cockpit notes app install` again.", { tag: release.tag, error_code: moved.code, attempts: moved.attempts, taskkill_exit: stopped.code });
+        }
+        writeLine(io.stderr, `${TAG} unpacked ${JSON.stringify({ replaced, previous: previous?.tag ?? null, taskkill_exit: stopped.code, replace_attempts: moved.attempts })}`);
+        const receipt = { tag: release.tag, version: release.version, sha256: release.sha256, installed_at: deps.now().toISOString() };
+        await writeFile(paths.receipt, `${JSON.stringify(receipt)}\n`, "utf8");
+        const registered = await run("reg.exe", regAddArgs(runValueCommand(paths.exe, door.dashboardUrl)));
+        writeLine(io.stderr, `${TAG} startup ${JSON.stringify({ registered: registered.code === 0, reg_exit: registered.code })}`);
+        const started = await (deps.launch ?? defaultLaunch)(paths.exe, door.dashboardUrl ? ["--tower-url", door.dashboardUrl] : []);
+        writeLine(io.stderr, `${TAG} installed ${JSON.stringify({ tag: release.tag, replaced, startup_registered: registered.code === 0, started: started.ok, launch_detail: started.detail ?? null })}`);
+        if (registered.code !== 0 || !started.ok) {
+            return refuse(io, command, registered.code !== 0 ? "startup_registration_failed" : "launch_failed", `BLI Notetaker ${release.version} is installed at ${paths.exe}, but ${registered.code !== 0 ? "Windows would not register it to start when you sign in" : `it could not be started (${started.detail ?? "unknown"})`}. Run \`cockpit notes app install\` again, or open it from that folder.`, { tag: release.tag, reg_exit: registered.code });
+        }
+        return say(io, command, [
+            `Installed BLI Notetaker ${release.version}${replaced ? ` (replaced ${previous?.version ?? "an older copy"})` : ""} and started it.`,
+            "Look for the BLI Notetaker icon in the taskbar notification area (click ^ if it is hidden): Record, Stop, Open last note. It starts again when you sign in.",
+            `App: ${paths.exe}`,
+            `Log: ${paths.log}`,
+            "The app is not code-signed. Windows SmartScreen does not block it because this command downloaded it itself, so it carries no \"downloaded from the internet\" mark. The first Record uses the microphone allowed in Settings > Privacy & security > Microphone.",
+        ].join("\n"), { installed: true, platform: WIN, tag: release.tag, version: release.version, replaced, previous: previous?.tag ?? null, app: paths.exe, startup: { registered: true, key: `${NOTETAKER_WIN_RUN_KEY}\\${NOTETAKER_WIN_RUN_VALUE}` }, log: paths.log });
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+async function uninstall(command, io, deps, paths, run) {
+    // taskkill exits 128 when nothing was running, which is fine.
+    const stopped = await stopApp(run);
+    const had = { app: await exists(paths.exe), receipt: await exists(paths.receipt), startup: parseRunValue((await run("reg.exe", ["query", NOTETAKER_WIN_RUN_KEY, "/v", NOTETAKER_WIN_RUN_VALUE])).stdout) !== null };
+    const deleted = await run("reg.exe", ["delete", NOTETAKER_WIN_RUN_KEY, "/v", NOTETAKER_WIN_RUN_VALUE, "/f"]);
+    const dirGone = await whileBusy(deps, () => rm(paths.dir, { recursive: true, force: true }));
+    writeLine(io.stderr, `${TAG} uninstalled ${JSON.stringify({ ...had, taskkill_exit: stopped.code, reg_delete_exit: deleted.code, dir_removed: dirGone.ok, error_code: dirGone.ok ? null : dirGone.code })}`);
+    if (!dirGone.ok) {
+        return refuse(io, command, "exe_in_use", "BLI Notetaker is still running and Windows will not let its folder be removed. Quit it from the notification area icon, then run `cockpit notes app uninstall` again.", { error_code: dirGone.code, attempts: dirGone.attempts });
+    }
+    if (!had.app && !had.startup)
+        return say(io, command, "BLI Notetaker was not installed. Nothing to remove.", { removed: false });
+    return say(io, command, [
+        "Removed BLI Notetaker: the app, its startup entry and its receipt.",
+        `Your recordings stay on this PC (\`cockpit notes record status\` lists any not yet uploaded), and so does the log: ${paths.log}`,
+    ].join("\n"), { removed: true, ...had });
+}
+async function status(command, io, deps, paths, run) {
+    const receipt = await readReceipt(paths.receipt);
+    const installed = await exists(paths.exe);
+    const value = parseRunValue((await run("reg.exe", ["query", NOTETAKER_WIN_RUN_KEY, "/v", NOTETAKER_WIN_RUN_VALUE])).stdout);
+    const p = deps.pathApi ?? path.win32;
+    const pointsHere = value !== null && p.normalize(runValueExe(value)).toLowerCase() === p.normalize(paths.exe).toLowerCase();
+    const pid = parseTasklistPid((await run("tasklist.exe", ["/FI", `IMAGENAME eq ${NOTETAKER_WIN_EXE}`, "/FO", "CSV", "/NH"])).stdout);
+    const running = pid !== null;
+    // The newest release is best effort: a status line without it is still an answer.
+    const newest = await newestRelease(deps, WIN);
+    const newestTag = newest.ok ? newest.release.tag : null;
+    const update = Boolean(installed && newestTag && receipt?.tag !== newestTag);
+    writeLine(io.stderr, `${TAG} status ${JSON.stringify({ platform: WIN, installed, tag: receipt?.tag ?? null, startup_registered: value !== null, points_here: pointsHere, running, newest: newestTag, newest_reason: newest.ok ? null : newest.reason })}`);
+    const json = {
+        platform: WIN, installed, tag: receipt?.tag ?? null, version: receipt?.version ?? null, installed_at: receipt?.installed_at ?? null,
+        app: paths.exe, startup: { registered: value !== null, points_here: pointsHere, key: `${NOTETAKER_WIN_RUN_KEY}\\${NOTETAKER_WIN_RUN_VALUE}` },
+        process: { running, pid }, log: paths.log,
+        newest: newest.ok ? { tag: newest.release.tag, version: newest.release.version } : { reason: newest.reason },
+        update_available: update,
+    };
+    const lines = installed
+        ? [
+            `BLI Notetaker ${receipt?.version ?? "(version unknown)"} is installed: ${paths.exe}`,
+            running ? `Running (pid ${pid}). Look for its icon in the taskbar notification area (click ^ if it is hidden).` : "Not running; run `cockpit notes app install` to start it now, or it starts when you sign in.",
+            value === null ? "Not set to start when you sign in; run `cockpit notes app install` to register it." : pointsHere ? "Starts again when you sign in." : "Its sign-in entry points at a different file; run `cockpit notes app install` to repair it.",
+            newest.ok ? (update ? `A newer release exists: ${newest.release.version}. Run \`cockpit notes app install\` to update.` : "It is the newest release.") : `Could not check for a newer release (${newest.reason}).`,
+            `Log: ${paths.log}`,
+        ]
+        : [
+            "BLI Notetaker is not installed. Run `cockpit notes app install`.",
+            newest.ok ? `Newest release: ${newest.release.version}.` : `Could not check the newest release (${newest.reason}).`,
+        ];
+    return say(io, command, lines.join("\n"), json);
+}

package/dist/commands/notes-app.js

@@ -15,50 +15,30 @@
  *   status     what is installed, whether it is running, and whether a newer
  *              release exists.
  *
- * Apple Silicon macOS only; Windows and Linux are refused by name. The app is
- * a shell over `cockpit notes record`; it captures nothing itself. Its layout
- * and LaunchAgent are `notes-app-plist.ts`.
+ * Apple Silicon macOS and 64-bit Windows (BLI-23208); Linux and Windows on Arm are
+ * refused by name. The app is a shell over `cockpit notes record`; it captures
+ * nothing itself. The Mac layout and LaunchAgent are `notes-app-plist.ts`; the
+ * Windows half (Run key instead of a LaunchAgent) is `notes-app-windows.ts`;
+ * what both share (deps, release question, checked download) is
+ * `notes-app-shared.ts`.
  */
-import { createHash, randomBytes } from "node:crypto";
-import { createWriteStream } from "node:fs";
-import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { Readable, Transform } from "node:stream";
-import { pipeline } from "node:stream/promises";
 import { launchdUserDomain, reregisterDarwinAgent } from "../autostart-darwin.js";
 import { writeLine } from "./cli-io.js";
-import { ask } from "./notes-door.js";
 import { NOTETAKER_APP_EXECUTABLE, NOTETAKER_APP_LABEL, NOTETAKER_APP_NAME, notetakerAppPaths, renderNotetakerAppPlist, } from "./notes-app-plist.js";
-const TAG = "[notes app]";
-const RELEASE_DEADLINE_MS = 30_000;
-const DOWNLOAD_DEADLINE_MS = 10 * 60_000;
-function say(io, command, human, json) {
-    writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, ...json }) : human);
-    return 0;
-}
-function refuse(io, command, reason, sentence, fields = {}) {
-    writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason, ...fields })}`);
-    if (command.json)
-        writeLine(io.stdout, JSON.stringify({ ok: false, reason, detail: sentence }));
-    else
-        writeLine(io.stderr, sentence);
-    return 1;
-}
-const exists = async (file) => stat(file).then(() => true, () => false);
-async function readReceipt(file) {
-    try {
-        const parsed = JSON.parse(await readFile(file, "utf8"));
-        return typeof parsed.tag === "string" && typeof parsed.version === "string" ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
+import { TAG, downloadToFile, exists, newestRelease, readReceipt, refuse, say, } from "./notes-app-shared.js";
+import { runNotesAppWindows } from "./notes-app-windows.js";
+export { downloadToFile };
+const MAC = "darwin-arm64";
 export async function runNotesApp(command, io, deps) {
     const verb = command.appAction ?? "status";
+    if (deps.platform === "win32" && (deps.arch ?? "x64") === "x64")
+        return await runNotesAppWindows(command, io, deps);
     if (deps.platform !== "darwin") {
-        const where = deps.platform === "win32" ? "Windows" : deps.platform === "linux" ? "Linux" : deps.platform;
-        return refuse(io, command, "platform_not_supported", `The BLI Notetaker app is not available on ${where} yet. It runs in the menu bar on Apple Silicon Macs; Windows is a follow-up. \`cockpit notes record\` is the terminal way to record.`, { platform: deps.platform });
+        const where = deps.platform === "win32" ? `Windows on ${deps.arch ?? "this processor"}` : deps.platform === "linux" ? "Linux" : deps.platform;
+        return refuse(io, command, "platform_not_supported", `The BLI Notetaker app is not available on ${where} yet. It runs in the menu bar on Apple Silicon Macs and in the notification area on 64-bit (x64) Windows. \`cockpit notes record\` is the terminal way to record.`, { platform: deps.platform, arch: deps.arch ?? null });
     }
     const paths = notetakerAppPaths(deps.homeDir);
     if (verb === "uninstall")
@@ -67,49 +47,6 @@ export async function runNotesApp(command, io, deps) {
         return await install(command, io, deps, paths);
     return await status(command, io, deps, paths);
 }
-/** Ask the paired Tower for the newest release; a refusal comes back as reason + sentence. */
-async function newestRelease(deps) {
-    const door = await deps.door();
-    if (!("deviceToken" in door))
-        return { ok: false, reason: door.reason, detail: door.detail };
-    const answer = await ask(door, { path: "/api/notes/app/release", method: "GET", label: "notes app release", timeoutMs: RELEASE_DEADLINE_MS });
-    if (!answer.ok)
-        return answer;
-    const body = answer.body;
-    const sha = typeof body.sha256 === "string" ? body.sha256.toLowerCase() : "";
-    if (!body.tag || !body.version || !/^[0-9a-f]{64}$/.test(sha) || !body.zip?.url?.startsWith("https://")) {
-        return { ok: false, reason: "release_answer_unreadable", detail: "Tower answered without a release this command can install." };
-    }
-    return { ok: true, release: { tag: body.tag, version: body.version, sha256: sha, zip: body.zip }, door };
-}
-/** Stream `url` to `dest`, hashing as it goes. No credential is sent: the link is GitHub's own signed one. */
-export async function downloadToFile(fetchImpl, url, dest) {
-    let response;
-    try {
-        response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_DEADLINE_MS) });
-    }
-    catch {
-        return { ok: false, reason: "download_unreachable" };
-    }
-    if (!response.ok || !response.body)
-        return { ok: false, reason: `download_http_${response.status}` };
-    const hash = createHash("sha256");
-    let bytes = 0;
-    const meter = new Transform({
-        transform(chunk, _encoding, done) {
-            hash.update(chunk);
-            bytes += chunk.length;
-            done(null, chunk);
-        },
-    });
-    try {
-        await pipeline(Readable.fromWeb(response.body), meter, createWriteStream(dest, { mode: 0o600 }));
-    }
-    catch {
-        return { ok: false, reason: "download_interrupted" };
-    }
-    return { ok: true, bytes, sha256: hash.digest("hex") };
-}
 async function appleSilicon(deps) {
     const answer = await deps.exec("sysctl", ["-n", "hw.optional.arm64"]).catch(() => ({ code: 1, stdout: "", stderr: "" }));
     return answer.code === 0 && answer.stdout.trim() === "1";
@@ -118,7 +55,7 @@ async function install(command, io, deps, paths) {
     if (!(await appleSilicon(deps))) {
         return refuse(io, command, "apple_silicon_only", "The BLI Notetaker app is built for Apple Silicon Macs (M1 and later); this Mac is not one. `cockpit notes record` works here from a terminal.");
     }
-    const found = await newestRelease(deps);
+    const found = await newestRelease(deps, MAC);
     if (!found.ok)
         return refuse(io, command, found.reason, found.detail);
     const { release, door } = found;
@@ -200,7 +137,7 @@ async function status(command, io, deps, paths) {
     const running = loaded && /\bstate = running\b/.test(printed.stdout);
     const pid = Number(/\bpid = (\d+)/.exec(printed.stdout)?.[1] ?? NaN);
     // The newest release is best effort: a status line without it is still an answer.
-    const newest = await newestRelease(deps);
+    const newest = await newestRelease(deps, MAC);
     const newestTag = newest.ok ? newest.release.tag : null;
     const update = Boolean(installed && newestTag && receipt?.tag !== newestTag);
     writeLine(io.stderr, `${TAG} status ${JSON.stringify({ installed, tag: receipt?.tag ?? null, plist, loaded, running, newest: newestTag, newest_reason: newest.ok ? null : newest.reason })}`);

package/dist/commands/notes-record-capture-win32.js

@@ -0,0 +1,170 @@
+/**
+ * BLI-23208: the Windows microphone half of `cockpit notes record`.
+ *
+ * Capture mechanism: `record.ps1` in the session directory, run by Windows
+ * PowerShell 5.1, which `Add-Type`s a small C# class that records through the
+ * legacy winmm `waveIn` API (16 kHz, mono, 16-bit PCM, `WAVE_MAPPER`). Why this
+ * one: nothing is downloaded or shipped as a binary (the npm package copier
+ * reads files as UTF-8), `winmm.dll` and the .NET C# compiler ship with every
+ * Windows, and `waveIn` hands us raw buffers, so WE decide when bytes reach the
+ * disk. WinRT `MediaCapture` was rejected: PowerShell 7 has no WinRT projection
+ * and the Media Foundation sink only guarantees a readable file when it is
+ * finalized, which a killed recorder never does.
+ *
+ * Crash safety is the contract `repairWavHeader` relies on: the recorder writes
+ * a 44-byte header with the size fields at 36 / 0, then appends and flushes
+ * every completed 100 ms buffer. A `TerminateProcess` leaves header plus audio
+ * up to the last ~100 ms; a clean stop rewrites the real sizes.
+ *
+ * Same session contract as macOS (`notes-record-capture.ts`): `audio.wav`,
+ * `ready` (after the first buffer really arrived), a `stop` marker polled every
+ * buffer, `done`, and `failed.txt` holding a closed reason label.
+ *
+ * With Settings > Privacy & security > Microphone off, waveIn still opens and
+ * delivers SILENCE. So the recorder reads the consent store before opening and
+ * about once a second while recording; any `Deny` is `mic_denied`.
+ *
+ * The recorder must outlive `record start` and a tray Job Object kill, so it is
+ * started through WMI (`Win32_Process.Create`: its parent is the WMI provider,
+ * not the CLI) with a `Start-Process` fallback (never a Node child: it would inherit the CLI's pipes).
+ *
+ * This file imports nothing from `notes-record-capture.ts` (that file imports
+ * this one).
+ */
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+const TAG = "[notes record]";
+const WMI_TIMEOUT_MS = 15_000;
+/** Same quoting as `powershellLiteral` in `autostart-windows-scripts.ts`; not imported so this module stays free of that file's workspace imports. */
+export const powershellLiteral = (value) => `'${value.replace(/'/gu, "''")}'`;
+/** Windows PowerShell 5.1 by absolute path (same answer as `windowsPowerShellPath` in `autostart-windows-scripts.ts`); PATH is never consulted. */
+export function windowsPowerShellPath(env = process.env) {
+    const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
+    return path.win32.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}
+/** Set to `start_process` to skip WMI (a diagnostic knob for comparing the two launch paths on a machine). */
+export const LAUNCH_OVERRIDE_ENV = "BLI_NOTES_RECORD_LAUNCH";
+export { RECORDER_SCRIPT_WIN32 } from "./notes-record-win32-script.js";
+const POWERSHELL_FLAGS = ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden"];
+const encodeCommand = (script) => Buffer.from(script, "utf16le").toString("base64");
+/**
+ * The PowerShell that runs `record.ps1` for `dir`. The directory is one
+ * single-quoted literal and the script is read and compiled in-process, so
+ * execution policy, spaces, apostrophes and non-ASCII in the path cannot bite
+ * (no `-File`).
+ */
+export function recorderBootstrap(dir) {
+    return [
+        "$ErrorActionPreference = 'Stop'",
+        `$dir = ${powershellLiteral(dir)}`,
+        "try {",
+        "  & ([scriptblock]::Create([IO.File]::ReadAllText((Join-Path $dir 'record.ps1')))) $dir",
+        "} catch {",
+        "  try { [IO.File]::AppendAllText((Join-Path $dir 'recorder.log'), 'bootstrap_failed type=' + $_.Exception.GetType().Name + [Environment]::NewLine) } catch { <# best effort: a log line that cannot be written must not stop the recorder #> }",
+        "  if (-not [IO.File]::Exists((Join-Path $dir 'failed.txt'))) { try { [IO.File]::WriteAllText((Join-Path $dir 'failed.txt'), 'recorder_failed') } catch { <# nothing else to tell: the CLI then reports recorder_exited, and recorder.log says why #> } }",
+        "}",
+        "",
+    ].join("\r\n");
+}
+/** The recorder's argument list (also what the Start-Process fallback passes). */
+export function recorderArgs(dir) {
+    return [...POWERSHELL_FLAGS, "-EncodedCommand", encodeCommand(recorderBootstrap(dir))];
+}
+/** The recorder as one Windows command line, for `Win32_Process.Create`. */
+export function recorderCommandLine(powershell, dir) {
+    return [`"${powershell}"`, ...recorderArgs(dir)].join(" ");
+}
+/** The short PowerShell that starts `commandLine` through WMI and prints `ok <pid>` or `fail <code>`. */
+export function wmiLaunchScript(commandLine) {
+    return [
+        "$ErrorActionPreference = 'Stop'",
+        "try { [Console]::OutputEncoding = [Text.Encoding]::ASCII } catch { <# an older host refuses; parseWmiLaunchOutput also reads UTF-16 and BOMs #> }",
+        "try {",
+        "  $startup = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{ ShowWindow = [uint16]0 }",
+        `  $result = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = ${powershellLiteral(commandLine)}; ProcessStartupInformation = $startup }`,
+        "  if ([int]$result.ReturnValue -eq 0) { Write-Output ('ok ' + [int]$result.ProcessId) } else { Write-Output ('fail ' + [int]$result.ReturnValue) }",
+        "} catch {",
+        "  Write-Output 'fail exception'",
+        "}",
+        "",
+    ].join("\r\n");
+}
+/** A hidden PowerShell that starts `file args` through Start-Process (no handle inheritance) and prints `ok <pid>`. */
+export function startProcessScript(file, args) {
+    return [
+        "$ErrorActionPreference = 'Stop'",
+        "try { [Console]::OutputEncoding = [Text.Encoding]::ASCII } catch { <# an older host refuses; parseWmiLaunchOutput also reads UTF-16 and BOMs #> }",
+        "try {",
+        `  $p = Start-Process -FilePath ${powershellLiteral(file)} -ArgumentList @(${args.map(powershellLiteral).join(", ")}) -WindowStyle Hidden -PassThru`,
+        "  Write-Output ('ok ' + [int]$p.Id)",
+        "} catch {",
+        "  Write-Output 'fail exception'",
+        "}",
+        "",
+    ].join("\r\n");
+}
+/** Decode what the WMI helper printed: ASCII, UTF-8 with a BOM, or UTF-16LE (Windows PowerShell may emit any), CRLF or LF. */
+export function parseWmiLaunchOutput(output) {
+    let text;
+    if (typeof output === "string")
+        text = output;
+    else if (output.length >= 2 && output[0] === 0xff && output[1] === 0xfe)
+        text = output.subarray(2).toString("utf16le");
+    else if (output.includes(0))
+        text = output.toString("latin1");
+    else
+        text = output.toString("utf8");
+    const lines = text.split("\0").join("").split("\uFEFF").join("").split(/\r?\n/u).map((line) => line.trim());
+    for (const line of lines.reverse()) {
+        const ok = /^ok (\d+)$/u.exec(line);
+        if (ok) {
+            const pid = Number(ok[1]);
+            return pid > 0 ? { ok: true, pid } : { ok: false, code: "no_pid" };
+        }
+        const fail = /^fail (\S+)$/u.exec(line);
+        if (fail)
+            return { ok: false, code: fail[1].slice(0, 32) };
+    }
+    return { ok: false, code: "unparsed" };
+}
+const defaultWinLaunchDeps = () => ({
+    powershell: windowsPowerShellPath(),
+    env: process.env,
+    run: (file, args) => {
+        const result = spawnSync(file, args, { windowsHide: true, timeout: WMI_TIMEOUT_MS, stdio: ["ignore", "pipe", "ignore"] });
+        return { status: result.status, stdout: Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.alloc(0), error: result.error };
+    },
+    start: (file, args) => {
+        // Not a Node child: libuv creates children with handle inheritance on, so a recorder spawned here would hold
+        // the CLI's stdout pipe open for as long as it records (the tray reads `record start`'s answer from that pipe).
+        // Start-Process goes through ShellExecute, which inherits nothing; the short PowerShell in between exits at once.
+        const result = spawnSync(file, [...POWERSHELL_FLAGS, "-EncodedCommand", encodeCommand(startProcessScript(file, args))], {
+            windowsHide: true, timeout: WMI_TIMEOUT_MS, stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (result.error || !Buffer.isBuffer(result.stdout))
+            return null;
+        const answer = parseWmiLaunchOutput(result.stdout);
+        return answer.ok ? answer.pid : null;
+    },
+    log: (message, fields) => console.error(`${TAG} ${message}`, JSON.stringify(fields)),
+});
+/** Start the recorder for the session in `dir`, detached from this process. Returns its pid, or null. */
+export function launchRecorderWin32(dir, overrides = {}) {
+    const deps = { ...defaultWinLaunchDeps(), ...overrides };
+    const session = dir.split(/[\\/]/u).filter(Boolean).pop() ?? "unknown";
+    let wmiReturn = "skipped";
+    if (deps.env[LAUNCH_OVERRIDE_ENV] !== "start_process") {
+        const script = wmiLaunchScript(recorderCommandLine(deps.powershell, dir));
+        const ran = deps.run(deps.powershell, [...POWERSHELL_FLAGS, "-EncodedCommand", encodeCommand(script)]);
+        const answer = ran.error ? { ok: false, code: "run_error" } : parseWmiLaunchOutput(ran.stdout);
+        if (answer.ok) {
+            deps.log("recorder launch", { session, pid: answer.pid, launch: "wmi", wmi_return: "0" });
+            return answer.pid;
+        }
+        wmiReturn = answer.code;
+        deps.log("recorder launch wmi refused, falling back to start_process", { session, wmi_return: wmiReturn, exit: ran.status });
+    }
+    const pid = deps.start(deps.powershell, recorderArgs(dir));
+    deps.log(pid === null ? "recorder launch failed" : "recorder launch", { session, pid, launch: "start_process", wmi_return: wmiReturn });
+    return pid;
+}

package/dist/commands/notes-record-capture.js

@@ -1,5 +1,7 @@
 /**
- * BLI-22979: the microphone half of `cockpit notes record` (Apple Silicon macOS).
+ * BLI-22979: the microphone half of `cockpit notes record` (Apple Silicon macOS;
+ * the Windows backend is `notes-record-capture-win32.ts`, BLI-23208, behind the
+ * same session directory, marker files and WAV format).
  *
  * Capture mechanism: `osascript -l JavaScript` driving AVFoundation's
  * AVAudioRecorder. Why this one: `osascript` ships with every Mac, so nothing
@@ -24,6 +26,7 @@ import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
 import { getCollectorRuntimePaths } from "../local-state-paths.js";
+import { launchRecorderWin32, RECORDER_SCRIPT_WIN32 } from "./notes-record-capture-win32.js";
 export const RECORDING_SAMPLE_RATE = 16_000;
 /** The JXA recorder. `argv[0]` is the session directory. Reasons it writes to `failed.txt`: mic_denied, recorder_failed. */
 export const RECORDER_SCRIPT = `ObjC.import('AVFoundation');
@@ -119,8 +122,15 @@ export async function readReason(root, id) {
 export async function requestStop(root, id) {
     await writeFile(path.join(root, id, "stop"), "stop\n", { mode: 0o600 });
 }
-/** Start the detached recorder in `dir`. Returns its pid, or null when it could not be launched. */
-export function launchRecorder(dir) {
+/**
+ * Start the detached recorder in `dir`. Returns its pid, or null when it could not be launched.
+ * `platform` picks the backend: osascript on macOS, Windows PowerShell on Windows (BLI-23208).
+ */
+export function launchRecorder(dir, platform = process.platform) {
+    if (platform === "win32")
+        return launchRecorderWin32(dir);
+    if (platform !== "darwin")
+        return null;
     try {
         const child = spawn("/usr/bin/osascript", ["-l", "JavaScript", path.join(dir, "record.js"), dir], {
             windowsHide: true,
@@ -144,9 +154,13 @@ export function processAlive(pid) {
         return error.code === "EPERM";
     }
 }
-export async function prepareSessionDir(root, id) {
+/** Create the session directory and write the platform's recorder script into it: `record.js` (macOS) or `record.ps1` (Windows). */
+export async function prepareSessionDir(root, id, platform = process.platform) {
     const dir = sessionDir(root, id);
     await mkdir(dir, { recursive: true, mode: 0o700 });
-    await writeFile(path.join(dir, "record.js"), RECORDER_SCRIPT, { mode: 0o600 });
+    if (platform === "win32")
+        await writeFile(path.join(dir, "record.ps1"), RECORDER_SCRIPT_WIN32, { mode: 0o600 });
+    else
+        await writeFile(path.join(dir, "record.js"), RECORDER_SCRIPT, { mode: 0o600 });
     return dir;
 }

package/dist/commands/notes-record-win32-script.js

@@ -0,0 +1,332 @@
+/**
+ * BLI-23208: the Windows recorder itself, `record.ps1` and the C# it compiles. Split from
+ * `notes-record-capture-win32.ts` (which launches it) so each file stays readable; the design notes live there.
+ * Pure text: nothing here runs on import.
+ */
+/**
+ * The C# recorder. C# 5 and APIs of .NET Framework 4.x AND .NET 6+ only, so it
+ * compiles under Windows PowerShell 5.1 (CodeDom) and PowerShell 7 (Roslyn).
+ * Unmanaged WAVEHDRs and buffers, polled for WHDR_DONE: no delegate callback
+ * that the GC could collect. Exit codes: 0 stopped, 2 no microphone, 3 mic
+ * denied, 4 recorder failed.
+ */
+const RECORDER_CSHARP = String.raw `using System;
+using System.Diagnostics;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+using Microsoft.Win32;
+
+public sealed class BliRecorder
+{
+    [StructLayout(LayoutKind.Sequential, Pack = 1)]
+    public struct WaveFormatEx
+    {
+        public ushort wFormatTag;
+        public ushort nChannels;
+        public uint nSamplesPerSec;
+        public uint nAvgBytesPerSec;
+        public ushort nBlockAlign;
+        public ushort wBitsPerSample;
+        public ushort cbSize;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct WaveHdr
+    {
+        public IntPtr lpData;
+        public uint dwBufferLength;
+        public uint dwBytesRecorded;
+        public IntPtr dwUser;
+        public uint dwFlags;
+        public uint dwLoops;
+        public IntPtr lpNext;
+        public IntPtr reserved;
+    }
+
+    [DllImport("winmm.dll")] static extern uint waveInGetNumDevs();
+    [DllImport("winmm.dll")] static extern uint waveInOpen(out IntPtr hwi, uint deviceId, ref WaveFormatEx fmt, IntPtr callback, IntPtr instance, uint flags);
+    [DllImport("winmm.dll")] static extern uint waveInPrepareHeader(IntPtr hwi, IntPtr hdr, uint size);
+    [DllImport("winmm.dll")] static extern uint waveInUnprepareHeader(IntPtr hwi, IntPtr hdr, uint size);
+    [DllImport("winmm.dll")] static extern uint waveInAddBuffer(IntPtr hwi, IntPtr hdr, uint size);
+    [DllImport("winmm.dll")] static extern uint waveInStart(IntPtr hwi);
+    [DllImport("winmm.dll")] static extern uint waveInReset(IntPtr hwi);
+    [DllImport("winmm.dll")] static extern uint waveInClose(IntPtr hwi);
+
+    const uint WaveMapper = 0xFFFFFFFF;
+    const uint WhdrDone = 1;
+    const int BufferCount = 8;
+    const int BufferBytes = 3200;
+    const string Consent = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\microphone";
+
+    readonly string dir;
+    bool ready;
+    long total;
+    int buffers;
+    FileStream file;
+    byte[] scratch = new byte[BufferBytes];
+
+    BliRecorder(string sessionDir) { dir = sessionDir; }
+
+    public static int Run(string sessionDir, string host)
+    {
+        BliRecorder recorder = new BliRecorder(sessionDir);
+        try
+        {
+            recorder.Log("start host=" + host + " pid=" + Process.GetCurrentProcess().Id + " session_id=" + Process.GetCurrentProcess().SessionId);
+            return recorder.Record();
+        }
+        catch (Exception e)
+        {
+            recorder.Log("exception type=" + e.GetType().Name);
+            if (!recorder.ready) recorder.Fail("recorder_failed");
+            return 4;
+        }
+    }
+
+    void Log(string line)
+    {
+        try { File.AppendAllText(Path.Combine(dir, "recorder.log"), DateTime.UtcNow.ToString("o") + " " + line + "\r\n"); }
+        catch (Exception) { /* best effort: a log line that cannot be written must not stop the recording */ }
+    }
+
+    void Fail(string reason)
+    {
+        try { File.WriteAllText(Path.Combine(dir, "failed.txt"), reason); }
+        catch (Exception) { /* the CLI then reports recorder_exited; the Log line below still says why */ }
+        Log("failed reason=" + reason);
+    }
+
+    static string ReadConsent(RegistryHive hive, string subKey)
+    {
+        try
+        {
+            using (RegistryKey root = RegistryKey.OpenBaseKey(hive, RegistryView.Registry64))
+            using (RegistryKey key = root.OpenSubKey(subKey))
+            {
+                if (key == null) return "absent";
+                object value = key.GetValue("Value");
+                return value == null ? "absent" : value.ToString();
+            }
+        }
+        catch (Exception) { return "unreadable"; }
+    }
+
+    static bool Denied(out string summary)
+    {
+        string machine = ReadConsent(RegistryHive.LocalMachine, Consent);
+        string user = ReadConsent(RegistryHive.CurrentUser, Consent);
+        string desktop = ReadConsent(RegistryHive.CurrentUser, Consent + "\\NonPackaged");
+        summary = "machine=" + machine + " user=" + user + " desktop_apps=" + desktop;
+        return IsDeny(machine) || IsDeny(user) || IsDeny(desktop);
+    }
+
+    static bool IsDeny(string value) { return string.Equals(value, "Deny", StringComparison.OrdinalIgnoreCase); }
+
+    static byte[] Header(uint dataBytes)
+    {
+        using (MemoryStream memory = new MemoryStream())
+        using (BinaryWriter writer = new BinaryWriter(memory))
+        {
+            writer.Write(Encoding.ASCII.GetBytes("RIFF"));
+            writer.Write((uint)(36 + dataBytes));
+            writer.Write(Encoding.ASCII.GetBytes("WAVEfmt "));
+            writer.Write((uint)16);
+            writer.Write((ushort)1);
+            writer.Write((ushort)1);
+            writer.Write((uint)16000);
+            writer.Write((uint)32000);
+            writer.Write((ushort)2);
+            writer.Write((ushort)16);
+            writer.Write(Encoding.ASCII.GetBytes("data"));
+            writer.Write(dataBytes);
+            writer.Flush();
+            return memory.ToArray();
+        }
+    }
+
+    void Check(string what, uint rc)
+    {
+        if (rc == 0) return;
+        Log(what + " rc=" + rc);
+        throw new InvalidOperationException(what);
+    }
+
+    void Append(IntPtr hdr, IntPtr data, int bytesOffset)
+    {
+        int got = Marshal.ReadInt32(hdr, bytesOffset);
+        if (got > BufferBytes) got = BufferBytes;
+        if (got <= 0) return;
+        Marshal.Copy(data, scratch, 0, got);
+        file.Write(scratch, 0, got);
+        file.Flush();
+        total += got;
+        buffers++;
+        if (!ready)
+        {
+            File.WriteAllText(Path.Combine(dir, "ready"), "ok");
+            ready = true;
+            Log("ready first_buffer_bytes=" + got);
+        }
+        else if (buffers % 600 == 0)
+        {
+            Log("progress buffers=" + buffers + " bytes=" + total);
+        }
+    }
+
+    int Record()
+    {
+        string summary;
+        bool denied = Denied(out summary);
+        Log("privacy " + summary);
+        if (denied) { Fail("mic_denied"); return 3; }
+
+        uint devices = waveInGetNumDevs();
+        Log("devices=" + devices);
+        if (devices == 0) { Fail("no_microphone"); return 2; }
+
+        WaveFormatEx format = new WaveFormatEx();
+        format.wFormatTag = 1;
+        format.nChannels = 1;
+        format.nSamplesPerSec = 16000;
+        format.nAvgBytesPerSec = 32000;
+        format.nBlockAlign = 2;
+        format.wBitsPerSample = 16;
+        format.cbSize = 0;
+        IntPtr hwi;
+        uint rc = waveInOpen(out hwi, WaveMapper, ref format, IntPtr.Zero, IntPtr.Zero, 0);
+        Log("open rc=" + rc + " format=pcm,1ch,16000hz,16bit");
+        if (rc != 0)
+        {
+            bool none = rc == 2 || rc == 6;
+            Fail(none ? "no_microphone" : "recorder_failed");
+            return none ? 2 : 4;
+        }
+
+        int headerSize = Marshal.SizeOf(typeof(WaveHdr));
+        int flagsOffset = (int)Marshal.OffsetOf(typeof(WaveHdr), "dwFlags");
+        int bytesOffset = (int)Marshal.OffsetOf(typeof(WaveHdr), "dwBytesRecorded");
+        IntPtr[] headers = new IntPtr[BufferCount];
+        IntPtr[] data = new IntPtr[BufferCount];
+        bool[] prepared = new bool[BufferCount];
+        bool started = false;
+        string endedBy = "stop";
+        try
+        {
+            file = new FileStream(Path.Combine(dir, "audio.wav"), FileMode.Create, FileAccess.ReadWrite, FileShare.ReadWrite, 4096);
+            byte[] head = Header(0);
+            file.Write(head, 0, head.Length);
+            file.Flush();
+
+            for (int i = 0; i < BufferCount; i++)
+            {
+                data[i] = Marshal.AllocHGlobal(BufferBytes);
+                headers[i] = Marshal.AllocHGlobal(headerSize);
+                WaveHdr hdr = new WaveHdr();
+                hdr.lpData = data[i];
+                hdr.dwBufferLength = BufferBytes;
+                Marshal.StructureToPtr(hdr, headers[i], false);
+                Check("prepare", waveInPrepareHeader(hwi, headers[i], (uint)headerSize));
+                prepared[i] = true;
+                Check("addbuffer", waveInAddBuffer(hwi, headers[i], (uint)headerSize));
+            }
+            Check("start", waveInStart(hwi));
+            started = true;
+            Log("recording buffers=" + BufferCount + " buffer_bytes=" + BufferBytes);
+
+            string stopPath = Path.Combine(dir, "stop");
+            Stopwatch clock = Stopwatch.StartNew();
+            long lastPrivacy = 0;
+            int next = 0;
+            while (true)
+            {
+                if (File.Exists(stopPath)) break;
+                if (clock.ElapsedMilliseconds - lastPrivacy >= 1000)
+                {
+                    lastPrivacy = clock.ElapsedMilliseconds;
+                    string now;
+                    if (Denied(out now)) { Log("privacy " + now); endedBy = "mic_denied"; break; }
+                }
+                uint flags = (uint)Marshal.ReadInt32(headers[next], flagsOffset);
+                if ((flags & WhdrDone) == 0) { Thread.Sleep(10); continue; }
+                Append(headers[next], data[next], bytesOffset);
+                Check("addbuffer", waveInAddBuffer(hwi, headers[next], (uint)headerSize));
+                next = (next + 1) % BufferCount;
+            }
+
+            // Reset hands every queued buffer back (the oldest partly filled): keep what they hold, oldest first.
+            waveInReset(hwi);
+            started = false;
+            for (int i = 0; i < BufferCount; i++)
+            {
+                int index = (next + i) % BufferCount;
+                uint flags = (uint)Marshal.ReadInt32(headers[index], flagsOffset);
+                if ((flags & WhdrDone) != 0) Append(headers[index], data[index], bytesOffset);
+            }
+        }
+        finally
+        {
+            if (started) waveInReset(hwi);
+            for (int i = 0; i < BufferCount; i++)
+            {
+                if (prepared[i]) waveInUnprepareHeader(hwi, headers[i], (uint)headerSize);
+                if (headers[i] != IntPtr.Zero) Marshal.FreeHGlobal(headers[i]);
+                if (data[i] != IntPtr.Zero) Marshal.FreeHGlobal(data[i]);
+            }
+            waveInClose(hwi);
+            if (file != null)
+            {
+                try
+                {
+                    uint size = total > 0xFFFFFFFFL - 36 ? 0xFFFFFFFFu - 36 : (uint)total;
+                    file.Seek(0, SeekOrigin.Begin);
+                    byte[] sized = Header(size);
+                    file.Write(sized, 0, sized.Length);
+                    file.Flush();
+                }
+                catch (Exception e) { Log("size_rewrite_failed type=" + e.GetType().Name); }
+                file.Close();
+            }
+        }
+
+        Log("closed ended_by=" + endedBy + " buffers=" + buffers + " bytes=" + total);
+        if (endedBy == "mic_denied") { Fail("mic_denied"); return 3; }
+        File.WriteAllText(Path.Combine(dir, "done"), "ok");
+        return 0;
+    }
+}
+`;
+/**
+ * The recorder script, `record.ps1`. PURE ASCII (asserted by a test): Windows
+ * PowerShell 5.1 reads a BOM-less file as ANSI. `$args[0]` is the session
+ * directory. Reasons it writes to `failed.txt`: mic_denied, no_microphone,
+ * recorder_failed. Everything is written through [IO.File], never Out-File.
+ */
+export const RECORDER_SCRIPT_WIN32 = `param([Parameter(Position = 0)][string]$Dir)
+$ErrorActionPreference = 'Stop'
+if (-not $Dir) { exit 4 }
+$source = @'
+${RECORDER_CSHARP.replace(/\r?\n$/u, "")}
+'@
+function Write-RecorderLog([string]$Line) {
+  try { [IO.File]::AppendAllText((Join-Path $Dir 'recorder.log'), $Line + [Environment]::NewLine) } catch { <# best effort: a log line that cannot be written must not stop the recorder #> }
+}
+try {
+  Add-Type -TypeDefinition $source -Language CSharp
+} catch {
+  Write-RecorderLog ('add_type_failed type=' + $_.Exception.GetType().Name)
+  try { [IO.File]::WriteAllText((Join-Path $Dir 'failed.txt'), 'recorder_failed') } catch { <# nothing else to tell: the CLI then reports recorder_exited, and recorder.log says why #> }
+  exit 4
+}
+$code = 4
+try {
+  $code = [BliRecorder]::Run($Dir, ('powershell-' + $PSVersionTable.PSVersion.ToString()))
+} catch {
+  Write-RecorderLog ('run_exception type=' + $_.Exception.GetType().Name)
+  if (-not [IO.File]::Exists((Join-Path $Dir 'ready'))) {
+    try { [IO.File]::WriteAllText((Join-Path $Dir 'failed.txt'), 'recorder_failed') } catch { <# nothing else to tell: the CLI then reports recorder_exited, and recorder.log says why #> }
+  }
+}
+exit $code
+`.replace(/\r?\n/gu, "\r\n");

package/dist/commands/notes-record.js

@@ -14,10 +14,14 @@
  *
  * Nothing leaves the machine while recording, and there is no auto-stop. The
  * original file is never deleted or changed by the trim. Apple Silicon macOS
- * only for now: Windows says so by name (a follow-up ticket adds it).
+ * and Windows (BLI-23208) record; any other platform refuses by name. Both
+ * platforms share one session directory, marker files, JSON answers and WAV
+ * format, so the trim, upload and recovery below are the same code.
  *
- * Capture is `notes-record-capture.ts`; the speech trim is `notes-record-wav.ts`.
+ * Capture is `notes-record-capture.ts` (macOS) and
+ * `notes-record-capture-win32.ts` (Windows); the speech trim is `notes-record-wav.ts`.
  */
+import path from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { writeLine } from "./cli-io.js";
 import { audioPath, fileExists, fileSize, launchRecorder, listSessions, newSessionId, prepareSessionDir, processAlive, readReason, recordingsRoot, requestStop, sessionDir, trimmedPath, writeSession, RECORDING_SAMPLE_RATE, } from "./notes-record-capture.js";
@@ -31,7 +35,7 @@ export function defaultRecordDeps(io, upload) {
         platform: process.platform,
         now: () => new Date(),
         sleep: io.sleep ?? ((ms) => delay(ms)),
-        launch: launchRecorder,
+        launch: (dir) => launchRecorder(dir, process.platform),
         alive: processAlive,
         kill: (pid) => { try {
             process.kill(pid, "SIGTERM");
@@ -45,12 +49,19 @@ const stateOf = (session, deps) => {
         return deps.alive(session.pid) ? "recording" : "crashed";
     return session.endedBy === "cancel" ? "cancelled" : "stopped";
 };
-const MIC_DENIED = "The microphone is blocked for this terminal. Open System Settings > Privacy & Security > Microphone, switch your terminal app on, then run `cockpit notes record start` again.";
-const REFUSALS = {
-    mic_denied: MIC_DENIED,
-    mic_permission_unanswered: "macOS asked for microphone access and nobody answered. Run `cockpit notes record start` again and choose Allow.",
-    recorder_failed: "The recorder could not open the microphone. Check that a microphone is connected and not in use, then try again.",
-};
+const MIC_DENIED_DARWIN = "The microphone is blocked for this terminal. Open System Settings > Privacy & Security > Microphone, switch your terminal app on, then run `cockpit notes record start` again.";
+const MIC_DENIED_WIN32 = "The microphone is blocked. Open Settings > Privacy & security > Microphone, turn on Microphone access and Let desktop apps access your microphone, then run `cockpit notes record start` again.";
+/** The sentence for a recorder reason, per platform: the macOS and Windows microphone switches live in different places. */
+function refusalSentence(platform, reason) {
+    switch (reason) {
+        case "mic_denied": return platform === "win32" ? MIC_DENIED_WIN32 : MIC_DENIED_DARWIN;
+        case "mic_permission_unanswered": return "macOS asked for microphone access and nobody answered. Run `cockpit notes record start` again and choose Allow.";
+        case "no_microphone": return "No microphone was found. Connect or enable a microphone, then run `cockpit notes record start` again.";
+        case "recorder_failed": return "The recorder could not open the microphone. Check that a microphone is connected and not in use, then try again.";
+        default: return "The recorder stopped before it started.";
+    }
+}
+const RECORDER_NAME = { darwin: "macOS recorder (osascript)", win32: "Windows recorder (PowerShell)" };
 function say(io, command, human, json, ok = true) {
     writeLine(io.stdout, command.json ? JSON.stringify({ ok, ...json }) : human);
     return ok ? 0 : 1;
@@ -74,9 +85,8 @@ const megabytes = (bytes) => (bytes === null ? "no file yet" : `${(bytes / 1_000
 const audioSeconds = (bytes) => (bytes === null ? 0 : Math.max(0, bytes - 44) / (RECORDING_SAMPLE_RATE * 2));
 export async function runNotesRecord(command, io, deps) {
     const verb = command.recordAction ?? "status";
-    if (deps.platform !== "darwin") {
-        const where = deps.platform === "win32" ? "Windows" : deps.platform;
-        return refuse(io, command, "platform_not_supported", `Recording a meeting is not supported yet on ${where}. It works on Apple Silicon Macs today; Windows is a follow-up.`);
+    if (deps.platform !== "darwin" && deps.platform !== "win32") {
+        return refuse(io, command, "platform_not_supported", `Recording a meeting is not supported on ${deps.platform}. It works on Apple Silicon Macs and on Windows.`);
     }
     const root = recordingsRoot(command.homeDir);
     switch (verb) {
@@ -93,10 +103,10 @@ async function startRecording(command, io, deps, root) {
         return refuse(io, command, "already_recording", `A recording is already running (started ${running.startedAt}). Run \`cockpit notes record stop\` to finish it or \`cockpit notes record cancel\` to keep the file and stop.`);
     }
     const id = newSessionId(deps.now());
-    const dir = await prepareSessionDir(root, id);
+    const dir = await prepareSessionDir(root, id, deps.platform);
     const pid = deps.launch(dir);
     if (pid === null) {
-        return refuse(io, command, "recorder_not_launched", "Could not start the macOS recorder (osascript). Nothing was recorded.");
+        return refuse(io, command, "recorder_not_launched", `Could not start the ${RECORDER_NAME[deps.platform] ?? "recorder"}. Nothing was recorded.`);
     }
     const session = { id, startedAt: deps.now().toISOString(), pid };
     await writeSession(root, session);
@@ -106,7 +116,7 @@ async function startRecording(command, io, deps, root) {
         const failed = await readReason(root, id);
         if (failed) {
             await writeSession(root, { ...session, endedAt: deps.now().toISOString(), endedBy: "cancel" });
-            return refuse(io, command, failed, REFUSALS[failed] ?? "The recorder stopped before it started.");
+            return refuse(io, command, failed, refusalSentence(deps.platform, failed));
         }
         if (await fileExists(`${sessionDir(root, id)}/ready`)) {
             writeLine(io.stderr, `${TAG} recording ${JSON.stringify({ session: id, reason: "mic_open" })}`);
@@ -114,7 +124,8 @@ async function startRecording(command, io, deps, root) {
         }
         if (!deps.alive(pid)) {
             await writeSession(root, { ...session, endedAt: deps.now().toISOString(), endedBy: "cancel" });
-            return refuse(io, command, "recorder_exited", "The recorder exited before the microphone opened. Nothing was recorded.");
+            const log = deps.platform === "win32" ? ` Details: ${path.join(sessionDir(root, id), "recorder.log")}` : "";
+            return refuse(io, command, "recorder_exited", `The recorder exited before the microphone opened. Nothing was recorded.${log}`);
         }
         await deps.sleep(POLL_MS);
     }

package/dist/commands/notes.js

@@ -37,7 +37,7 @@
  *    (it runs on a shared server-side key, not a `notes_accounts` row), read
  *    off its `granola_sync_runs` ledger.
  *  - `notes-app.ts` — BLI-23207: `app install|uninstall|status`, the BLI
- *    Notetaker menu-bar app on this Mac (its LaunchAgent: `notes-app-plist.ts`).
+ *    Notetaker app on this Mac or Windows PC (Mac LaunchAgent: `notes-app-plist.ts`; Windows: `notes-app-windows.ts`).
  *  - `notes-transcription-stats.ts` — BLI-18003: what meeting transcription
  *    cost and did per provider for a month, and the spend against the cap.
  *
@@ -105,10 +105,12 @@ export async function runNotes(command, io) {
             });
         }));
     }
-    // BLI-23207: the menu-bar app is installed on this Mac; only install and status ask Tower (for the newest release).
+    // BLI-23207/23208: the menu-bar / notification-area app is installed on this Mac or Windows PC; only install and status ask Tower (for the newest release).
     if (command.action === "app") {
         return runNotesApp(command, io, {
             platform: process.platform,
+            arch: process.arch,
+            env: io.env,
             homeDir: command.homeDir ?? os.homedir(),
             uid: process.getuid?.() ?? 0,
             exec: io.exec ?? defaultExec(),

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.260");
+    writeLine(io?.stdout ?? process.stdout, "0.2.262");
     return 0;
   }
 

package/dist/commands/slack-privacy-args.js

@@ -0,0 +1,28 @@
+/**
+ * `cockpit slack privacy` arguments (BLI-23244): a founder LISTS their Slack privacy lists (which conversations Tower
+ * keeps out or lets in, and the founders' Slack identities). Ids only, never names.
+ *
+ * Read-only on purpose. Changing a list needs a signed-in browser session, so that an agent holding a founder's device
+ * token can never opt a founder's conversation in; the server refuses device-token writes. The browser card is
+ * ticket 23265. Split from `local-args-tower-admin.ts`, which is at this repo's readability band.
+ */
+import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+const VALUE_FLAGS = ["--home", "--dashboard-url"];
+const WRITE_FLAGS = ["--exclude", "--optin", "--remove", "--identity", "--no-account"];
+const ALLOWED_FLAGS = [...VALUE_FLAGS, "--json"];
+export const SLACK_PRIVACY_WRITE_REFUSAL = "slack privacy only lists. Changing a founder privacy list needs a signed-in browser session, so an agent holding this machine's token can never opt a founder's conversation in (the Settings card is ticket 23265).";
+export function parseSlackPrivacyArgs(args) {
+    if (args.some((arg) => WRITE_FLAGS.includes(arg)))
+        throw new Error(SLACK_PRIVACY_WRITE_REFUSAL);
+    const values = parseNamedArgs(args, { allowedFlags: ALLOWED_FLAGS, valueFlags: VALUE_FLAGS });
+    if (values.positionals.length > 0)
+        throw new Error("slack privacy takes no arguments; it lists the founder privacy lists.");
+    return {
+        kind: "slack",
+        action: "privacy",
+        privacy: { op: "list" },
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        json: values.booleans.has("--json"),
+    };
+}

package/dist/commands/slack-privacy.js

@@ -0,0 +1,31 @@
+import { writeLine } from "./cli-io.js";
+import { asRecord, callTower, openTower, writeCommandFailure } from "./tower-command.js";
+export async function runSlackPrivacy(command, io) {
+    const tower = await openTower("slack", command, io);
+    const result = await callTower(tower, { path: "/api/slack/founder-privacy", label: "slack-privacy" });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    writeLine(io.stderr, `[slack cli] privacy answered ${JSON.stringify({ op: "list", reason: "ok" })}`);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(body));
+        return 0;
+    }
+    for (const line of describe(body))
+        writeLine(io.stdout, line);
+    return 0;
+}
+/** Plain lines for a person. Exported for its test. */
+export function describe(body) {
+    const rows = (key) => (Array.isArray(body[key]) ? body[key] : []);
+    const mark = (row) => `  ${String(row["conversationId"])} (${String(row["workspace"])}) since ${String(row["addedAt"]).slice(0, 10)}${row["addedByYou"] ? " — you" : " — the other founder"}`;
+    const identities = rows("identities");
+    return [
+        `Kept out (${rows("exclusions").length}):`, ...rows("exclusions").map(mark),
+        `Let in (${rows("optins").length}):`, ...rows("optins").map(mark),
+        `Founder Slack ids stated (${identities.length}):`,
+        ...identities.map((row) => `  ${String(row["workspace"])}: ${row["slackUserId"] ? String(row["slackUserId"]) : "no account"}${row["yours"] ? " — you" : ""}`),
+        "Any DM or group DM that includes a founder is kept out unless it is on the let-in list.",
+        "To change a list, use Tower in the browser (ticket 23265); this command only lists.",
+    ];
+}

package/dist/commands/slack.js

@@ -22,7 +22,10 @@
  */
 import { colorEnabled, dim, writeLine } from "./cli-io.js";
 import { asRecord, callTower, openTower, writeCommandFailure } from "./tower-command.js";
+import { runSlackPrivacy } from "./slack-privacy.js";
 export async function runSlack(command, io) {
+    if (command.action === "privacy")
+        return runSlackPrivacy(command, io);
     const tower = await openTower("slack", command, io);
     if (command.action === "connect" || command.action === "disconnect") {
         const result = await callTower(tower, { path: `/api/slack/connections${command.action === "disconnect" ? `?workspace=${command.workspace}` : ""}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.260",
+  "version": "0.2.262",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.77",
-    "@bli-cockpit/mcp": "0.1.159",
+    "@bli-cockpit/mcp": "0.1.161",
     "@bli-cockpit/telemetry-core": "0.1.84"
   },
   "repository": {