@bli-cockpit/cli 0.2.286 → 0.2.287

package/dist/commands/doctor-update.js

@@ -78,6 +78,8 @@ export function reexecDoctor(command, io) {
     const args = ["doctor"];
     if (command.noUsageTelemetry)
         args.push("--no-usage-telemetry");
+    if (command.noMemory)
+        args.push("--no-memory");
     if (command.homeDir)
         args.push("--home", command.homeDir);
     if (command.backfillBudgetSeconds)

package/dist/commands/doctor-usage-telemetry.js

@@ -1,6 +1,7 @@
 import os from "node:os";
 import path from "node:path";
-import { getCollectorRuntimePaths, readLocalCollectorSessionFile } from "../local-state.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile } from "../local-state.js";
+import { founderRoutingOn } from "./doctor-shelf.js";
 import { claudeSettingsFile } from "./memory-install-claude.js";
 import { codexConfigFile } from "./tower-mcp-codex.js";
 import { defaultMemoryFileIo } from "./memory-install-files.js";
@@ -83,7 +84,7 @@ async function usageTelemetryStep(context, checkOnly) {
         if (!session?.device_token)
             return needsFix("usage-telemetry", "device_token_missing", "usage telemetry: needs Tower sign-in");
         const result = await configureUsageTelemetry({ homeDir: home, origin: context.command.dashboardUrl, token: session.device_token,
-            optOut: context.command.noUsageTelemetry, checkOnly, io: defaultMemoryFileIo({ mode: 0o600 }) });
+            optOut: context.command.noUsageTelemetry || (await founderWithholdsModels(home, context.io.fetch)), checkOnly, io: defaultMemoryFileIo({ mode: 0o600 }) });
         const message = result.off ? "usage telemetry: off (explicit opt-out)" : "usage telemetry: on (claude code, codex)";
         return checkOnly && result.changed ? needsFix("usage-telemetry", "settings_differ", message) : ok("usage-telemetry", result.off ? "explicit_opt_out" : "already_current", message);
     }
@@ -93,5 +94,20 @@ async function usageTelemetryStep(context, checkOnly) {
         return fail("usage-telemetry", reason, "usage telemetry: settings could not be safely merged");
     }
 }
+/**
+ * BLI-23478 (three shelves, design 3.2 category C): usage telemetry names the model and tool of every session, so
+ * on a founder's laptop, once founder routing is on, it is opted out unless the founder allowed `model` with
+ * `cockpit shelf metrics --allow`. The opt-out persists like any other (the marker), so allowing `model` later
+ * needs the marker removed by hand: deliberate, since turning a channel back on is a person's call.
+ */
+async function founderWithholdsModels(homeDir, fetchImpl) {
+    if (!(await founderRoutingOn(homeDir, fetchImpl)))
+        return false;
+    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(homeDir)).catch(() => null);
+    const withheld = !(config?.shelf_metrics_allow ?? []).includes("model");
+    if (withheld)
+        console.error("[usage telemetry] founder opt-out", JSON.stringify({ reason: "shelf_model_category_off" }));
+    return withheld;
+}
 export const checkUsageTelemetry = (context) => usageTelemetryStep(context, true);
 export const fixUsageTelemetry = (context) => usageTelemetryStep(context, false);

package/dist/commands/doctor.js

@@ -1,5 +1,8 @@
 import { checkSlackConnected } from "./doctor-slack.js";
 import { checkUsageTelemetry, fixUsageTelemetry } from "./doctor-usage-telemetry.js";
+import { settleDoctorMemoryChoice } from "./memory-capture-prompt.js";
+import { reportIgnoredOptOuts } from "../capture-opt-outs.js";
+import { checkShelfRouting, fixShelfRouting } from "./doctor-shelf.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION } from "../local-state.js";
 import { withCommandGuard } from "../command-guard.js";
 import { installHttp1GlobalFetch } from "../http1-fetch.js";
@@ -31,6 +34,10 @@ export async function runDoctorWithDeps(command, io, deps) {
     const deadlineMs = doctorRunDeadline(command, runStarted);
     const context = { command, io, deps, deadlineMs };
     console.error("[doctor] run started", JSON.stringify({ json: command.json, check_only: Boolean(command.dryRun || command.checkOnly), budget_seconds: deadlineMs === null ? null : DOCTOR_JSON_BUDGET_SECONDS }));
+    // BLI-22640: `--no-memory`, or the one-time question, before any row reads the choice.
+    await settleDoctorMemoryChoice(command, io);
+    // Founders only: a non-founder's opt-outs are ignored, and doctor says so in one line.
+    await reportIgnoredOptOuts({ ...(command.homeDir ? { homeDir: command.homeDir } : {}), json: command.json }, io);
     const rows = [];
     const repairs = [];
     const diagnoseOnly = command.dryRun || command.checkOnly;
@@ -178,6 +185,8 @@ function doctorInvariants() {
         // no fix because a session outside an approved root is not a defect
         // doctor can repair; it names the counts and moves on.
         { id: "roots-cover-work", check: context => context.deps.readRootsCoverWork(context) },
+        // BLI-23478: a founder's drawer default once Tower's lock is on (`doctor-shelf.ts`); everyone else: one ok line.
+        { id: "shelf-routing", check: (c) => (c.deps.checkShelfRouting ?? checkShelfRouting)(c), fix: (c) => (c.deps.fixShelfRouting ?? fixShelfRouting)(c) },
         // Deliberately has NO fix: uninstalling software the operator did not ask
         // to have uninstalled is not a repair (BLI-3218/BLI-3553). Doctor names the
         // other install and the exact command; the person decides.

package/dist/commands/heartbeat-post.js

@@ -11,6 +11,10 @@ import { describeError } from "../health-detail.js";
 import { classifySyncHealthError } from "../sync-health-class.js";
 import { noteHeartbeatRefusal, recordHeartbeatPendingToken, recordHeartbeatTokenExpiry, TOKEN_ROTATION_HEADER, } from "./heartbeat-token.js";
 import { noteDoctorRequest } from "./sync-doctor-request.js";
+import { recordFounderStanding } from "../founder-standing-file.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { collectorShelfHeaders } from "../shelf-headers.js";
+import { recordShelfState } from "../shelf-state.js";
 const HEARTBEAT_TIMEOUT_MS = 5_000;
 export async function postHeartbeat(options, deviceToken, heartbeat, memory) {
     const controller = new AbortController();
@@ -21,6 +25,8 @@ export async function postHeartbeat(options, deviceToken, heartbeat, memory) {
             headers: {
                 "Content-Type": "application/json",
                 Authorization: `Bearer ${deviceToken}`,
+                // BLI-23478: the CLI release, so Tower records `cli_too_old` on an owner's old laptop.
+                ...collectorShelfHeaders(),
                 // BLI-17994. "I store a renewed token if you send one": the dashboard
                 // only rotates for a collector that says so.
                 [TOKEN_ROTATION_HEADER]: "1",
@@ -84,6 +90,19 @@ async function recordAcceptedHeartbeat(options, response, heartbeat, memory) {
     // door reports, which moves only when this request promoted a token.
     await recordHeartbeatPendingToken(options.homeDir, reply);
     await recordHeartbeatTokenExpiry(options.homeDir, response);
+    // BLI-22640: Tower's answer to "is this machine's person a founder?", kept
+    // for DISPLAY (doctor, support). No decision reads this file: every reader
+    // that decides what leaves the machine asks Tower live. Only a Tower reply
+    // writes it. A reply that could not read the owners list says null, and the
+    // last displayed answer stands.
+    if (typeof reply?.["is_owner"] === "boolean") {
+        await recordFounderStanding(getCollectorRuntimePaths(options.homeDir), reply["is_owner"], "heartbeat");
+    }
+    else {
+        console.error("[heartbeat] no founder answer in this reply; the last one stands", JSON.stringify({ reason: "is_owner_absent" }));
+    }
+    // BLI-23478 (three shelves): what the lock is for this laptop's person, for the hooks, the MCP server and doctor.
+    await recordShelfState(options.homeDir, reply);
     console.error("[heartbeat] checked in", JSON.stringify({
         reason: "heartbeat_recorded",
         http_status: response.status,

package/dist/commands/heartbeat.js

@@ -24,7 +24,7 @@ import { collectAgentSetup } from "./agent-setup.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { COLLECTOR_HEARTBEAT_SCHEMA_VERSION, MemoryInstallReceiptSchema, setupReceiptGaps, } from "@bli-cockpit/telemetry-core";
+import { COLLECTOR_HEARTBEAT_MAX_ROOTS, COLLECTOR_HEARTBEAT_SCHEMA_VERSION, MemoryInstallReceiptSchema, setupReceiptGaps, } from "@bli-cockpit/telemetry-core";
 import { readCachedSetupReceipt } from "./setup-receipt.js";
 import { readStagingInventory } from "../disk-usage.js";
 import { readStagingGate } from "../staging-gate.js";
@@ -32,6 +32,8 @@ import { describeError } from "../health-detail.js";
 import { shouldSuppressFleetReceipts, } from "../dev-build.js";
 import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, } from "../local-state.js";
 import { postHeartbeat } from "./heartbeat-post.js";
+import { readCaptureOptOuts } from "../capture-opt-outs.js";
+import { teamRootsForHeartbeat } from "../shelf-state.js";
 import { readHeartbeatSession } from "./heartbeat-token.js";
 import { withTokenRotationLock } from "./heartbeat-token-lock.js";
 import { readMemoryReceiptFile } from "./memory-install-receipt.js";
@@ -103,6 +105,9 @@ export function buildCollectorHeartbeat(options) {
         collector_version: options.collectorVersion ?? LOCAL_COLLECTOR_VERSION,
         os_platform: platform,
         roots: collectionRootLabels(options.roots, platform),
+        ...(options.shelvedRoots
+            ? { shelved_roots: Array.from({ length: Math.min(options.shelvedRoots, COLLECTOR_HEARTBEAT_MAX_ROOTS) }, () => ({ shelf: "drawer" })) }
+            : {}),
         last_sync_status: options.facts.status,
         ...(options.facts.outsideRootDirectories ? { outside_root_directories: options.facts.outsideRootDirectories } : {}),
         ...(options.facts.reason ? { last_sync_reason: options.facts.reason } : {}),
@@ -118,6 +123,7 @@ export function buildCollectorHeartbeat(options) {
         ...(typeof options.facts.sessionsPendingUpload === "number"
             ? { sessions_pending_upload: options.facts.sessionsPendingUpload }
             : {}),
+        ...(options.facts.collectionScope ? { collection_scope: options.facts.collectionScope } : {}),
         ...(typeof options.facts.stagingUncommittedBytes === "number"
             ? { staging_uncommitted_bytes: options.facts.stagingUncommittedBytes }
             : {}),
@@ -127,6 +133,7 @@ export function buildCollectorHeartbeat(options) {
         ...(options.facts.disk ? { disk: options.facts.disk } : {}),
         ...(options.memoryInstall ? { memory_install: options.memoryInstall } : {}),
         ...(options.setupReceipt ? { setup_receipt: options.setupReceipt } : {}),
+        ...(options.captureOptOuts ? { capture_opt_outs: options.captureOptOuts } : {}),
     };
 }
 /**
@@ -280,9 +287,13 @@ async function sendCollectorHeartbeatLocked(options) {
     }).catch(() => ({ receipt: null, reason: "receipt_read_threw" }));
     const setupReceipt = await readCachedSetupReceipt(options.homeDir, options.now ?? new Date());
     logSetupReceiptCarried(setupReceipt);
+    // BLI-23478: a drawer-labelled folder's name and path hash never travel; only its shelf, counted.
+    const shelfRoots = await teamRootsForHeartbeat(options.roots, options.homeDir, options.io.fetch);
     const heartbeat = buildCollectorHeartbeat({
-        roots: options.roots,
+        roots: shelfRoots.team,
+        shelvedRoots: shelfRoots.shelved,
         facts: options.facts,
+        captureOptOuts: await readCaptureOptOuts(options.homeDir),
         setupReceipt: setupReceipt ? { ...setupReceipt, agent_setup: await collectAgentSetup(options.homeDir ?? os.homedir()) } : null,
         ...(options.now ? { now: options.now } : {}),
         memoryInstall: memory.receipt,

package/dist/commands/install-receipts.js

@@ -144,6 +144,9 @@ async function deliverPendingInstallEvents(options, paths, deviceToken) {
             if (receipt.imageHandlingMode !== undefined && options.observed) {
                 options.observed.imageHandlingMode = receipt.imageHandlingMode;
             }
+            if (receipt.collectionScope !== undefined && options.observed) {
+                options.observed.collectionScope = receipt.collectionScope;
+            }
             delivered += 1;
         })));
     }
@@ -215,6 +218,7 @@ async function readReceiptReply(response) {
             ? receipt.min_cli_version.trim()
             : null,
         imageHandlingMode: receipt?.image_handling_mode,
+        collectionScope: receipt?.collection_scope,
     };
 }
 async function keepFailedInstallEventEntry(paths, entry, error, failures) {

package/dist/commands/local-args-collector-setup.js

@@ -95,6 +95,7 @@ const DOCTOR_ALLOWED_FLAGS = [
     "--check",
     "--no-repair",
     "--no-usage-telemetry",
+    "--no-memory",
     "--lock-wait",
     "--backfill-budget",
     "--json",
@@ -141,6 +142,7 @@ export function parseDoctorArgs(alias, args) {
     return {
         kind: "doctor",
         noUsageTelemetry: values.booleans.has("--no-usage-telemetry"),
+        noMemory: values.booleans.has("--no-memory"),
         checkOnly: values.booleans.has("--check") || values.booleans.has("--no-repair"),
         // Absent stays absent (BLI-11101): `doctor-budget.ts` owns the defaults,
         // and `--json` without either flag runs under one bounded budget.

package/dist/commands/local-args-collector-status.js

@@ -168,23 +168,9 @@ export function parseAgentRulesArgs(args) {
         json: values.booleans.has("--json"),
     };
 }
-/**
- * BLI-3580, amended by BLI-4047.
- *
- * `cockpit memory` is now SIX verbs behind one noun: the two that configure
- * this machine (`install`, `status`), the experience log (`log`), and the four
- * that read and write the memory store itself (`search`, `save`, `update`,
- * `forget`, parsed next door in `local-args-tower-memory.ts`).
- *
- * **A bare `cockpit memory` prints the verb list; it no longer installs.**
- * BLI-3580 made `install` the default because the command is run unasked by
- * `doctor` and by the sync tick, but those callers build
- * `{ kind: "memory", action: "install" }` in code (`doctor-registration.ts`,
- * `sync-followups-memory.ts`, `onboard-completion.ts`) and never pass through
- * this parser. The only caller the default ever served was a PERSON typing the
- * noun to find out what it does, and what they got was an MCP server and three
- * hooks registered on their machine. Installing stays one word away.
- */
+const MEMORY_MACHINE_ACTIONS = new Set([
+    "install", "uninstall", "on", "off", "status", "help",
+]);
 export function parseMemoryArgs(args) {
     // The verb word first, always: reading it off `args[0]` rather than "the
     // first token without a leading dash" is what keeps `cockpit memory --home
@@ -214,16 +200,16 @@ export function parseMemoryArgs(args) {
     if (values.flags.has("--store") || values.booleans.has("--reason-stdin"))
         throw new Error("--store and --reason-stdin require memory log");
     if (values.positionals.length > 1) {
-        throw new Error("memory accepts at most one action (install|status).");
+        throw new Error("memory accepts at most one action (on|off|install|uninstall|status).");
     }
     // BLI-4047: no positional means "tell me what this noun does", not "install".
     const action = values.positionals[0] ?? "help";
-    if (action !== "install" && action !== "status" && action !== "help") {
-        throw new Error("memory action must be install, status, help, log, search, save, update, or forget.");
+    if (!MEMORY_MACHINE_ACTIONS.has(action)) {
+        throw new Error("memory action must be on, off, install, uninstall, status, help, log, search, save, update, or forget.");
     }
     return {
         kind: "memory",
-        action,
+        action: action,
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
         dryRun: values.booleans.has("--dry-run"),

package/dist/commands/local-args.js

@@ -20,6 +20,7 @@ import { parseSkillsArgs } from "./skills.js";
 import { parseSpendArgs } from "./spend.js";
 import { parsePushArgs } from "./push.js";
 import { parseRootsArgs } from "./roots.js";
+import { parseShelfArgs } from "./shelf.js";
 import { parseSlackPrivacyArgs } from "./slack-privacy-args.js";
 import { parseMilestoneArgs } from "./local-args-tower-milestone.js";
 import { SURFACE_ALIASES } from "./local-help.js";
@@ -42,6 +43,7 @@ export { SCOUT_MIN_PREFIX_LENGTH, SLACK_WORKSPACE_KEYS, WORKBOOK_MIN_WIDTH, ISSU
  */
 const COMMAND_PARSERS = new Map([
     ["roots", (_command, rest) => parseRootsArgs(rest)],
+    ["shelf", (_command, rest) => parseShelfArgs(rest)],
     ["onboard", (_command, rest) => parseOnboardArgs(rest)],
     ["update", (command, rest) => parseUpdateArgs(command, rest)],
     ["upgrade", (command, rest) => parseUpdateArgs(command, rest)],

package/dist/commands/local-discovery.js

@@ -16,7 +16,7 @@
  * binding a ticket from a scratch folder to every approved root on the machine
  * is far wider than the operator asked for, so it keeps the old refusal.
  */
-import { resolveSourceSwitches } from "../source-opt-out.js";
+import { readSourceSwitches } from "../source-opt-out.js";
 import { writeLine } from "./cli-io.js";
 import { resolveDiscoveryLimits, saveDiscoveryLimits, } from "../discovery-limits.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
@@ -196,7 +196,7 @@ export async function scanWorkDirectories(homeDir, persist = true) {
         return null; throw error; });
     const now = new Date();
     const options = { worktrees: [], collectionRoots: config?.default_repo_paths ?? [], now, sinceMinutes: ROOT_WORK_SCAN_WINDOW_DAYS * 24 * 60, limit: Number.MAX_SAFE_INTEGER };
-    const switches = resolveSourceSwitches(config);
+    const switches = await readSourceSwitches(config, paths, "discovery");
     if (!switches.codex)
         console.error("[discovery] codex scan withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason }));
     const codex = switches.codex ? await scanAndAttributeCodexSessions({ ...options, sessionsDirs: defaultCodexSessionDirs(homeDir) }) : null;

package/dist/commands/local-help-commands-tower.js

@@ -412,7 +412,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "memory",
         [
-            "Usage: cockpit memory [map|knowledge|rules|search|save|update|forget|private|public|profile|consolidation|chain|source|exam|requeue|install|status|log] [flags]",
+            "Usage: cockpit memory [map|knowledge|rules|search|save|update|forget|private|public|profile|consolidation|chain|source|exam|requeue|on|off|install|uninstall|status|log] [flags]",
             "",
             "  map [--json] — projects, topics, memory counts and importance from the shared map.",
             "  knowledge [--person <name>] [--project <name>] [--by-project] [--limit <n>] [--json] — ranked project ideas.",
@@ -469,6 +469,11 @@ export const TOWER_COMMAND_HELP = [
             "Idempotent: it merges with what is already there, never duplicates its own",
             "entries, and reads the stored config back before reporting success.",
             "`cockpit doctor` runs it, and the sync tick re-runs it at most once a day.",
+            "off (alias uninstall) turns BLI Memory off on THIS machine: it records the choice, removes",
+            "our hooks and MCP entry from both hosts (your other hooks stay), and doctor, onboard,",
+            "update and the sync tick never add them back; the Stop and PreCompact hooks send nothing.",
+            "on (alias install) records the opposite choice and registers them again. Each prints",
+            "one line saying what changed and how to undo it. See docs/architecture/agent-memory.md.",
             "See docs/runbooks/bli-memory-install.md.",
             "log appends an opinion to ~/.codex/AGENT-EXPERIENCE.md and posts it to Tower.",
             "Use --reason-stdin instead of a quoted reason; --json reports shipped status.",

package/dist/commands/local-help-commands.js

@@ -26,7 +26,18 @@ const COMMAND_HELP = new Map([
     ["skills", ["Usage: cockpit skills library [--weeks <1-52>] [--json] | cockpit skills refresh [--weeks <1-104>] [--json]", "The Skill Library: every agent skill and command our GitHub repos define (name, description, repo, path, versions) with weekly use by person, from the sessions Tower already collects. Uses that match no scanned skill are listed as unmatched, never dropped. The first line is the coverage: repos scanned, skills, invocations matched of total. A member sees their own usage; a super_admin sees everyone's except an owner's. refresh scans the repos and recomputes the weekly totals now (super_admin only; a stale library also refreshes itself when read). MCP twins: skills_library, skills_refresh. Web: TEAM > Skills."]],
     ["push", ["Usage: cockpit push status | test [--dashboard-url <url>] [--json]", "Phone notifications. status lists your saved devices and whether the server has its push keys; test sends a test push to every saved device. Turn a phone on from Settings on the phone."]],
     ["spend", ["Usage: cockpit spend memory [--days 1|7|30] [--dashboard-url <url>] [--json]", "Spend by memory operation (write, recall, dream, update_forget, backfill, label, exam, predictor, people, who, intentions, salience, chat, other), ranked top first with list and real dollars, share, trend against the previous window, and how much of the real OpenAI bill the ledger explains. What it does not explain is shown as untagged. A super_admin reads it."]],
-    ["roots", ["Usage: cockpit roots add <dir> [--allow-home-root] [--json]", "Approves a work directory, saves an approval receipt, and adds it to collection. Run cockpit doctor afterward."]],
+    ["roots", [
+            "Usage: cockpit roots add <dir> [--allow-home-root] [--json] | label <dir> team|drawer [--json] | list [--json]",
+            "add approves a work directory, saves an approval receipt, and adds it to collection. Run cockpit doctor afterward.",
+            "label (founders' laptops): team sends that folder's sessions and memories to Tower as today; drawer keeps them on this laptop and sends only bare numbers. safe is refused until the safe is live.",
+            "list shows each approved or labelled folder and the shelf it resolves to.",
+        ]],
+    ["shelf", [
+            "Usage: cockpit shelf status | default team|drawer | metrics --allow <day,tool,model,spawn|none> | drawer purge --older-than <days> [--json]",
+            "A founder's shelves on THIS laptop. status: Tower's founder lock, the default, and what is in the drawer here (not backed up).",
+            "default: where work outside every labelled folder goes. metrics: the opt-in categories a drawer session's bare record may carry (all off by default).",
+            "drawer purge: the only way drawer items are removed.",
+        ]],
     // BLI-3709: the Tower nouns live next door, split along the same seam the
     // argument parsers already use — see `local-help-commands-tower.ts`.
     ...TOWER_COMMAND_HELP,
@@ -92,12 +103,14 @@ const COMMAND_HELP = new Map([
     [
         "doctor",
         [
-            "Usage: cockpit doctor [--workspace <path>] [--check | --no-repair] [--no-usage-telemetry] [--lock-wait <seconds>] [--backfill-budget <seconds>] [--json]",
+            "Usage: cockpit doctor [--workspace <path>] [--check | --no-repair] [--no-usage-telemetry] [--no-memory] [--lock-wait <seconds>] [--backfill-budget <seconds>] [--json]",
             "",
             "Diagnose, repair, and verify this machine.",
             "Repairs CLI, background sync, sign-in, roots, memory and hooks, agent rules, catch-up, uploads, and cleanup.",
             "roots-cover-work is informational: it names how many sessions are inside vs. outside saved roots (all already uploaded, outside ones labelled) and gives cockpit roots add commands for attributing a folder's sessions to a repo (outside-root transcripts upload either way). It never needs a fix.",
             "--no-usage-telemetry switches off Claude Code and Codex usage export, including later doctor runs.",
+            "--no-memory turns BLI Memory off on this machine (same as `cockpit memory off`), including later runs and the background sync.",
+            "In a terminal, the first doctor or onboard asks once whether BLI Memory may save your sessions; `cockpit memory on|off` changes the answer.",
             "--check or --no-repair diagnoses without repairs. --dry-run previews repairs.",
             "--backfill-budget defaults to 900 seconds; catch-up repeats chunks until complete, with progress every 30 seconds.",
             "Doctor never waits for the background sync: a running sync is reported as running (with how long ago it started) and doctor finishes; a sync that stopped responding or made no progress for 15 minutes is ended and doctor carries on. --lock-wait is accepted and changes nothing. Progress prints at most every 30 seconds and says what changed.",

package/dist/commands/local-help.js

@@ -36,6 +36,7 @@ export const SURFACE_ALIASES = new Map([
 ]);
 export const rootCommandNames = new Set([
     "roots",
+    "shelf",
     "onboard",
     "update",
     "upgrade",
@@ -110,7 +111,8 @@ export const rootCommandNames = new Set([
 export const publicCommandNames = new Set([...rootCommandNames].filter((name) => name !== "do-everything" && name !== "fix"));
 /** The one-screen summary `cockpit --help` prints: one line per command, then the shared footnotes. */
 const COMMAND_SUMMARY_LINES = [
-    "  cockpit roots add <dir> [--allow-home-root] [--json]",
+    "  cockpit roots add <dir> [--allow-home-root] [--json] | label <dir> team|drawer | list",
+    "  cockpit shelf status | default team|drawer | metrics --allow <categories|none> | drawer purge --older-than <days> [--json]",
     "  cockpit onboard [--ticket <id>] [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--branch <name>] [--no-auth] [--max-depth <n>] [--max-repos <n>] [--json]",
     "  cockpit update [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--no-auth] [--json]",
     "  cockpit upgrade [same flags as update]",
@@ -148,7 +150,7 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit serve [--port <port>] [--workspace <path>]",
     "  cockpit autostart [install|uninstall|status] [--workspace <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
     "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",
-    "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|install|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--include-originals|--no-originals] [--include-source|--no-source] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
+    "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|on|off|install|uninstall|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--include-originals|--no-originals] [--include-source|--no-source] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
     "  cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
     "  cockpit sources check [--reconcile] [--older-than <days>] [--dashboard-url <url>] [--json]",
     "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>|delete <id|slug>|trash|versions <id|slug>|restore <id>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",

package/dist/commands/local.js

@@ -9,6 +9,8 @@ export { rootCommandNames, localCommandHelp, SURFACE_ALIASES, unknownCommandJson
 /** Commands that act on THIS machine; the rest talk to Tower. */
 const MACHINE_COMMAND_KINDS = [
     "roots",
+    // BLI-23478 (three shelves): acts on this laptop only.
+    "shelf",
     "install",
     "onboard",
     "update",
@@ -81,6 +83,7 @@ export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorA
 async function runMachineCommand(command, io) {
     switch (command.kind) {
         case "roots": return await (await import("./roots.js")).runRoots(command, io);
+        case "shelf": return await (await import("./shelf.js")).runShelf(command, io);
         case "install": return await (await import("./install-update.js")).runInstall(command, io);
         case "onboard": return await (await import("./onboard.js")).runOnboard(command, io);
         case "update": return await (await import("./install-update.js")).runUpdate(command, io);
@@ -109,6 +112,10 @@ async function runMachineCommand(command, io) {
             // caller asks for it by name in code.
             if (command.action === "help")
                 return (await import("./memory-store.js")).runMemoryVerbList(io, command.json);
+            // BLI-22640: the per-machine switch. `install`/`status` keep their page.
+            if (command.action === "on" || command.action === "off" || command.action === "uninstall") {
+                return await (await import("./memory-switch.js")).runMemorySwitch({ ...command, action: command.action }, io);
+            }
             return await (await import("./memory-install.js")).runMemoryInstall(command, io);
         case "memory-store": return await (await import("./memory-store.js")).runMemoryStore(command, io);
         case "clean": return await (await import("./clean.js")).runClean(command, io);

package/dist/commands/memory-capture-prompt.js

@@ -0,0 +1,130 @@
+/**
+ * The one-time BLI Memory question (BLI-22640).
+ *
+ * An interactive `cockpit doctor` or `cockpit onboard` on a machine that has
+ * never chosen asks once, and the answer becomes this machine's choice
+ * (`memory-capture-choice.ts`). Once answered, never asked again: `cockpit
+ * memory on|off` is how a person changes their mind.
+ *
+ * Asked only when a person is plainly there: stdin AND stdout are terminals,
+ * `--json` is off, and this is not the scheduler's tick, a dry run or a
+ * `--check`. launchd, Task Scheduler, CI and every piped run keep today's
+ * default (on) without a question, and say why in the log.
+ *
+ * Founders only (Jeetesh's review of 2026-10-25): the question is shown only
+ * when Tower answers, live, that this machine's person is a founder. Anybody
+ * else never sees it and keeps BLI Memory on; the log names why
+ * (`not_founder`, or `founder_check_unavailable` when Tower could not be
+ * asked). A cached "not a founder" skips the question without asking Tower.
+ *
+ * An answer that is neither yes nor no is asked once more; a second unclear
+ * answer records NOTHING, so the default holds and the next interactive run
+ * asks again. A choice this important is never inferred from a typo.
+ */
+import os from "node:os";
+import { readLine, writeLine } from "./cli-io.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { readMemoryCaptureChoice, writeMemoryCaptureChoice } from "../memory-capture-choice.js";
+import { mayRecordOff } from "../founder-standing.js";
+import { parseYesNo } from "../yes-no.js";
+export const MEMORY_CHOICE_QUESTION = "BLI Memory: save what you work on so agents remember it across sessions? [Y/n] ";
+export const MEMORY_CHOICE_EXPLAINER = "Answering n keeps BLI Memory's hooks off on this machine, so nothing from your sessions is sent to memory; `cockpit memory on` or `cockpit memory off` changes it later.";
+/** Why this run may not ask, or null when it may. */
+export function memoryChoicePromptBlocker(io, options) {
+    if (options.json)
+        return "json";
+    if (options.automaticTick)
+        return "scheduled_tick";
+    if (options.dryRun || options.checkOnly)
+        return "diagnose_only";
+    if (((io.env ?? process.env)["CI"] ?? "") !== "")
+        return "ci";
+    const stdinTty = Boolean(io.stdin.isTTY);
+    const stdoutTty = Boolean(io.stdout.isTTY);
+    return stdinTty && stdoutTty ? null : "not_a_tty";
+}
+export async function askMemoryChoiceOnce(io, options) {
+    const blocker = memoryChoicePromptBlocker(io, options);
+    if (blocker) {
+        console.error("[memory-capture] question not asked; the default stands", JSON.stringify({ reason: blocker }));
+        return "not_interactive";
+    }
+    const paths = getCollectorRuntimePaths(options.homeDir ?? os.homedir());
+    const current = await readMemoryCaptureChoice(paths);
+    if (current.state !== "unchosen") {
+        console.error("[memory-capture] question not asked; already answered", JSON.stringify({ reason: "already_chosen", state: current.state }));
+        return "already_chosen";
+    }
+    const founder = await founderMayBeAsked(io, options);
+    if (founder !== null)
+        return founder;
+    writeLine(io.stdout, MEMORY_CHOICE_EXPLAINER);
+    let verdict = parseYesNo(await readLine(io, MEMORY_CHOICE_QUESTION), { emptyIsYes: true });
+    if (verdict === "unclear") {
+        verdict = parseYesNo(await readLine(io, `Please answer y or n. ${MEMORY_CHOICE_QUESTION}`), { emptyIsYes: true });
+    }
+    if (verdict === "unclear") {
+        console.error("[memory-capture] answer unclear twice; nothing recorded", JSON.stringify({ reason: "unclear_answer" }));
+        writeLine(io.stdout, "No answer recorded; BLI Memory stays on for now, and the next `cockpit doctor` asks again.");
+        return "unclear_answer";
+    }
+    const on = verdict === "yes";
+    try {
+        await writeMemoryCaptureChoice(paths, on, "prompt");
+    }
+    catch (error) {
+        console.error("[memory-capture] answer could not be saved", JSON.stringify({ reason: "choice_write_failed", error_name: error instanceof Error ? error.name : typeof error }));
+        writeLine(io.stdout, "Your answer could not be saved; run `cockpit memory " + (on ? "on" : "off") + "` to record it.");
+        return "choice_write_failed";
+    }
+    writeLine(io.stdout, on
+        ? "BLI Memory is on for this machine. Undo: cockpit memory off"
+        : "BLI Memory stays off on this machine; its hooks are removed and not added back. Undo: cockpit memory on");
+    return on ? "chose_on" : "chose_off";
+}
+/** Null when the question may be shown; otherwise why not. Logs both branches. */
+async function founderMayBeAsked(io, options) {
+    // Only Tower's live "founder" is enough to ask, because the answer can
+    // record an off; the saved copy decides nothing (BLI-22640).
+    const permission = await mayRecordOff({
+        ...(options.homeDir ? { homeDir: options.homeDir } : {}),
+        ...(options.dashboardUrl ? { dashboardUrl: options.dashboardUrl } : {}),
+        fetch: io.fetch,
+        door: "prompt",
+    });
+    if (permission.allowed)
+        return null;
+    const reason = permission.reason === "memory_off_founders_only" ? "not_founder" : "founder_check_unavailable";
+    console.error("[memory-capture] question not asked; founders only", JSON.stringify({ reason, source: "live", detail: permission.detail }));
+    return reason;
+}
+/**
+ * What `cockpit doctor` does with the choice before its first row: honour
+ * `--no-memory`, otherwise ask once when a person is there. Never throws; a
+ * doctor run is never lost to this question.
+ */
+export async function settleDoctorMemoryChoice(command, io) {
+    try {
+        if (command.noMemory && !command.dryRun && !command.checkOnly) {
+            // Founders only, on Tower's live answer; anybody else is told why and doctor carries on.
+            const permission = await mayRecordOff({
+                ...(command.homeDir ? { homeDir: command.homeDir } : {}),
+                ...(command.dashboardUrl ? { dashboardUrl: command.dashboardUrl } : {}),
+                fetch: io.fetch,
+                door: "doctor_no_memory",
+            });
+            if (!permission.allowed) {
+                // stdout belongs to `--json`; the refusal is on stderr there, by name.
+                writeLine(command.json ? io.stderr : io.stdout, `--no-memory: ${permission.line}`);
+                return "flag_refused";
+            }
+            await writeMemoryCaptureChoice(getCollectorRuntimePaths(command.homeDir ?? os.homedir()), false, "doctor_flag");
+            return "flag_off";
+        }
+        return await askMemoryChoiceOnce(io, command);
+    }
+    catch (error) {
+        console.error("[memory-capture] choice step failed; doctor carries on with what is recorded", JSON.stringify({ reason: "choice_step_threw", error_name: error instanceof Error ? error.name : typeof error }));
+        return "choice_write_failed";
+    }
+}

package/dist/commands/memory-install-claude.js

@@ -200,8 +200,10 @@ export function applyHookGroups(root, hookSpecs) {
             ? hooks[spec.event].slice()
             : [];
         // Somebody else's Stop hook survives untouched; only OUR entries — matched
-        // by bin name plus `hook`, wherever the bin ended up — are replaced.
-        const survivors = groups.filter((group) => !groupIsOurs(group));
+        // by bin name plus `hook`, wherever the bin ended up — are replaced. A group
+        // a person shares with ours keeps their commands (BLI-22640, the Codex
+        // review point): only our command comes out of it.
+        const survivors = stripOurHooks(groups).groups;
         survivors.push({
             hooks: [
                 {
@@ -268,9 +270,54 @@ export function ourHookCount(root) {
     }
     return count;
 }
-function groupIsOurs(group) {
+/** Exported for `memory-uninstall.ts` (BLI-22640): the off-switch removes exactly what the installer would replace. */
+export function groupIsOurs(group) {
     return hookCommands(group).some(isMemoryHookCommand);
 }
+/**
+ * BLI-22640 (the Codex review point on PR 2615). Takes OUR commands out of
+ * each hook group and keeps everything else: a group a person shares with
+ * ours keeps their own commands (and its matcher and any other key), and only
+ * a group left with no hooks at all is dropped. A group that holds none of
+ * ours comes back as the same object, byte for byte once serialised.
+ *
+ * `removed` counts our commands taken out. Used by the installer (before it
+ * appends our fresh group) and by `cockpit memory off`.
+ */
+export function stripOurHooks(groups) {
+    const kept = [];
+    let removed = 0;
+    for (const group of groups) {
+        const record = asRecord(group);
+        const entries = record && Array.isArray(record["hooks"]) ? record["hooks"] : null;
+        if (!record || !entries) {
+            kept.push(group);
+            continue;
+        }
+        const others = entries.filter((entry) => {
+            const command = asRecord(entry)?.["command"];
+            return !(typeof command === "string" && isMemoryHookCommand(command));
+        });
+        removed += entries.length - others.length;
+        if (others.length === entries.length)
+            kept.push(group);
+        else if (others.length > 0)
+            kept.push({ ...record, hooks: others });
+    }
+    return { groups: kept, removed };
+}
+/** How many of OUR hook commands a settings or hooks.json root holds, across every event and group. */
+export function ourHookCommandCount(root) {
+    const hooks = asRecord(root["hooks"]);
+    if (!hooks)
+        return 0;
+    let count = 0;
+    for (const groups of Object.values(hooks)) {
+        if (Array.isArray(groups))
+            count += stripOurHooks(groups).removed;
+    }
+    return count;
+}
 function hookCommands(group) {
     const record = asRecord(group);
     if (!record || !Array.isArray(record["hooks"]))
@@ -310,7 +357,7 @@ function sameStringArray(value, expected) {
  * itself, so this is cosmetic — but a diff that reindents a person's whole
  * configuration reads like damage even when it is not.
  */
-function serializeJson(root, previous) {
+export function serializeJson(root, previous) {
     const indent = detectIndent(previous);
     return `${JSON.stringify(root, null, indent)}\n`;
 }