@bli-cockpit/cli 0.2.261 → 0.2.262

package/dist/commands/local-args.js

@@ -19,6 +19,7 @@ import { parseGlossaryArgs } from "./glossary.js";
 import { parseSpendArgs } from "./spend.js";
 import { parsePushArgs } from "./push.js";
 import { parseRootsArgs } from "./roots.js";
+import { parseSlackPrivacyArgs } from "./slack-privacy-args.js";
 import { parseMilestoneArgs } from "./local-args-tower-milestone.js";
 import { SURFACE_ALIASES } from "./local-help.js";
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
@@ -67,7 +68,8 @@ const COMMAND_PARSERS = new Map([
     ["ci", (_command, rest) => parseCiArgs(rest)],
     ["delivery", (_command, rest) => parseDeliveryArgs(rest)],
     ["ops", (_command, rest) => parseOpsArgs(rest)],
-    ["slack", (_command, rest) => parseSlackArgs(rest)],
+    // BLI-23244: `slack privacy` has its own flags and its own file.
+    ["slack", (_command, rest) => (rest.includes("privacy") ? parseSlackPrivacyArgs(rest.filter((arg) => arg !== "privacy")) : parseSlackArgs(rest))],
     ["settings", (_command, rest) => parseSettingsArgs(rest)],
     ["team", (_command, rest) => parseTeamArgs(rest)],
     ["workbook", (_command, rest) => parseWorkbookArgs(rest)],

package/dist/commands/local-help-commands-tower.js

@@ -304,7 +304,13 @@ export const TOWER_COMMAND_HELP = [
     [
         "slack",
         [
-            "Usage: cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [filters] [--format compact|full]] [--json]",
+            "Usage: cockpit slack [connect [--workspace bli|blue_pearl] | disconnect --workspace bli|blue_pearl | coverage [--workspace bli|blue_pearl] [--stale-only] [--list] | read [filters] [--format compact|full] | privacy] [--json]",
+            "",
+            "  cockpit slack privacy   (founders only)",
+            "      Lists which Slack conversations Tower keeps out and lets in, and the founders' Slack ids.",
+            "      A DM or group DM that includes a founder, and any channel a founder excludes, never enters",
+            "      Tower unless a founder lets it in. Ids only (C…, D…, G…), never names. Changing a list needs",
+            "      a signed-in browser session (ticket 23265), never this machine's token. Anyone else: owner_only.",
             "",
             "  cockpit slack coverage",
             "      What Cockpit's Slack bot can see: how many channels it is in, what each",

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.261");
+    writeLine(io?.stdout ?? process.stdout, "0.2.262");
     return 0;
   }
 

package/dist/commands/slack-privacy-args.js

@@ -0,0 +1,28 @@
+/**
+ * `cockpit slack privacy` arguments (BLI-23244): a founder LISTS their Slack privacy lists (which conversations Tower
+ * keeps out or lets in, and the founders' Slack identities). Ids only, never names.
+ *
+ * Read-only on purpose. Changing a list needs a signed-in browser session, so that an agent holding a founder's device
+ * token can never opt a founder's conversation in; the server refuses device-token writes. The browser card is
+ * ticket 23265. Split from `local-args-tower-admin.ts`, which is at this repo's readability band.
+ */
+import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+const VALUE_FLAGS = ["--home", "--dashboard-url"];
+const WRITE_FLAGS = ["--exclude", "--optin", "--remove", "--identity", "--no-account"];
+const ALLOWED_FLAGS = [...VALUE_FLAGS, "--json"];
+export const SLACK_PRIVACY_WRITE_REFUSAL = "slack privacy only lists. Changing a founder privacy list needs a signed-in browser session, so an agent holding this machine's token can never opt a founder's conversation in (the Settings card is ticket 23265).";
+export function parseSlackPrivacyArgs(args) {
+    if (args.some((arg) => WRITE_FLAGS.includes(arg)))
+        throw new Error(SLACK_PRIVACY_WRITE_REFUSAL);
+    const values = parseNamedArgs(args, { allowedFlags: ALLOWED_FLAGS, valueFlags: VALUE_FLAGS });
+    if (values.positionals.length > 0)
+        throw new Error("slack privacy takes no arguments; it lists the founder privacy lists.");
+    return {
+        kind: "slack",
+        action: "privacy",
+        privacy: { op: "list" },
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        json: values.booleans.has("--json"),
+    };
+}

package/dist/commands/slack-privacy.js

@@ -0,0 +1,31 @@
+import { writeLine } from "./cli-io.js";
+import { asRecord, callTower, openTower, writeCommandFailure } from "./tower-command.js";
+export async function runSlackPrivacy(command, io) {
+    const tower = await openTower("slack", command, io);
+    const result = await callTower(tower, { path: "/api/slack/founder-privacy", label: "slack-privacy" });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    writeLine(io.stderr, `[slack cli] privacy answered ${JSON.stringify({ op: "list", reason: "ok" })}`);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(body));
+        return 0;
+    }
+    for (const line of describe(body))
+        writeLine(io.stdout, line);
+    return 0;
+}
+/** Plain lines for a person. Exported for its test. */
+export function describe(body) {
+    const rows = (key) => (Array.isArray(body[key]) ? body[key] : []);
+    const mark = (row) => `  ${String(row["conversationId"])} (${String(row["workspace"])}) since ${String(row["addedAt"]).slice(0, 10)}${row["addedByYou"] ? " — you" : " — the other founder"}`;
+    const identities = rows("identities");
+    return [
+        `Kept out (${rows("exclusions").length}):`, ...rows("exclusions").map(mark),
+        `Let in (${rows("optins").length}):`, ...rows("optins").map(mark),
+        `Founder Slack ids stated (${identities.length}):`,
+        ...identities.map((row) => `  ${String(row["workspace"])}: ${row["slackUserId"] ? String(row["slackUserId"]) : "no account"}${row["yours"] ? " — you" : ""}`),
+        "Any DM or group DM that includes a founder is kept out unless it is on the let-in list.",
+        "To change a list, use Tower in the browser (ticket 23265); this command only lists.",
+    ];
+}

package/dist/commands/slack.js

@@ -22,7 +22,10 @@
  */
 import { colorEnabled, dim, writeLine } from "./cli-io.js";
 import { asRecord, callTower, openTower, writeCommandFailure } from "./tower-command.js";
+import { runSlackPrivacy } from "./slack-privacy.js";
 export async function runSlack(command, io) {
+    if (command.action === "privacy")
+        return runSlackPrivacy(command, io);
     const tower = await openTower("slack", command, io);
     if (command.action === "connect" || command.action === "disconnect") {
         const result = await callTower(tower, { path: `/api/slack/connections${command.action === "disconnect" ? `?workspace=${command.workspace}` : ""}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.261",
+  "version": "0.2.262",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.77",
-    "@bli-cockpit/mcp": "0.1.160",
+    "@bli-cockpit/mcp": "0.1.161",
     "@bli-cockpit/telemetry-core": "0.1.84"
   },
   "repository": {