@bli-cockpit/cli 0.2.286 → 0.2.287

package/dist/commands/memory-install-report.js

@@ -75,12 +75,17 @@ export function logMemoryOutcome(outcome, platform) {
         memory_on: memoryInstallGaps(outcome.receipt).length === 0,
         memory_gaps: memoryInstallGaps(outcome.receipt),
         codex_hooks: outcome.receipt.codex.hooks,
+        ...(outcome.opted_out ? { opted_out: true, removed_count: outcome.removed_count ?? 0 } : {}),
     };
     // stderr on both branches: launchd captures it to sync.err.log, and stdout is
     // reserved for `--json`.
-    console.error(outcome.status === "failed"
-        ? "[memory-install] BLI Memory is not fully registered on this machine"
-        : "[memory-install] BLI Memory registration converged", JSON.stringify(fields));
+    console.error(outcome.opted_out
+        ? outcome.status === "failed"
+            ? "[memory-install] BLI Memory is off on this machine and an entry could not be removed"
+            : "[memory-install] BLI Memory is off on this machine; nothing of it was registered"
+        : outcome.status === "failed"
+            ? "[memory-install] BLI Memory is not fully registered on this machine"
+            : "[memory-install] BLI Memory registration converged", JSON.stringify(fields));
 }
 export function memoryOutcomeLines(outcome) {
     const headline = memoryOutcomeHeadline(outcome);
@@ -89,6 +94,11 @@ export function memoryOutcomeLines(outcome) {
     // daemon", because nothing looked.
     if (outcome.daemon)
         lines.push(`  ${memoryDaemonLine(outcome.daemon)}`);
+    // BLI-22640: a non-founder's "off" is ignored, and said so where they read.
+    if (outcome.opt_out_ignored) {
+        lines.push("  This machine's BLI Memory \"off\" is ignored: only Tower's founders can turn it off, " +
+            "because work on BLI machines goes to Tower (opt_out_ignored_not_founder).");
+    }
     // The trust step is the one thing a person has to do by hand, so it is said
     // here in words rather than left as a status word they have to look up.
     if (outcome.receipt.codex.hooks === "needs_trust") {
@@ -108,6 +118,12 @@ export function memoryOutcomeLines(outcome) {
     return lines;
 }
 function memoryOutcomeHeadline(outcome) {
+    // BLI-22640: the person's choice is the headline, whatever the files say.
+    if (outcome.opted_out) {
+        return outcome.action === "status"
+            ? "BLI Memory is off on this machine (your choice). `cockpit memory on` turns it back on."
+            : "BLI Memory is off on this machine (your choice); none of it was registered. `cockpit memory on` turns it back on.";
+    }
     if (outcome.status === "installed")
         return "BLI Memory registered on this machine.";
     if (outcome.status === "already")

package/dist/commands/memory-install-toml.js

@@ -148,6 +148,28 @@ export function removeTomlTable(text, tablePath) {
     const lines = text.split("\n");
     return [...lines.slice(0, span.start_line), ...lines.slice(span.end_line)].join("\n");
 }
+/**
+ * BLI-22640. Removes our table AND every sub-table under it (`[a.b.env]`,
+ * `[a.b.tools.x]`), each with the lines it owns; every other table survives
+ * byte for byte. `cockpit memory off` uses it, so no half of our entry is left
+ * for a host to start a server from.
+ */
+export function removeTomlTableTree(text, tablePath) {
+    const lines = text.split("\n");
+    const kept = [];
+    let dropping = false;
+    for (const line of lines) {
+        const header = parseTableHeader(line);
+        if (header || isArrayTableHeader(line)) {
+            dropping = header !== null &&
+                header.length >= tablePath.length &&
+                samePath(header.slice(0, tablePath.length), tablePath);
+        }
+        if (!dropping)
+            kept.push(line);
+    }
+    return kept.join("\n");
+}
 export function renderTomlTable(tablePath, entries) {
     const header = `[${tablePath.map(renderKey).join(".")}]`;
     const body = entries.map(([key, value]) => `${renderKey(key)} = ${renderValue(value)}`);

package/dist/commands/memory-install.js

@@ -47,7 +47,10 @@ import { installTowerIntegration, inspectTowerIntegration } from "./tower-mcp-in
 import { defaultMemoryFileIo, } from "./memory-install-files.js";
 import { installClaudeMemoryIntegration, inspectClaudeMemoryIntegration, } from "./memory-install-claude.js";
 import { installCodexMemoryIntegration, inspectCodexMemoryIntegration, } from "./memory-install-codex.js";
-import { resolveMemoryConfig } from "./memory-install-config.js";
+import { resolveMemoryConfig, resolveMemoryMcpBin } from "./memory-install-config.js";
+import { removeMemoryIntegration } from "./memory-uninstall.js";
+import { readEffectiveMemoryCapture, readMemoryCaptureChoice, writeMemoryCaptureChoice } from "../memory-capture-choice.js";
+import { envWithNodeRuntimeOnPath } from "../scheduled-self-update.js";
 import { probeMemoryDaemon } from "./memory-daemon-probe.js";
 import { expectedCodexTrustRows, readCodexHookTrustFromDisk, } from "./memory-install-codex-hooks.js";
 import { buildMemoryInstallReceipt, writeMemoryReceiptFile, } from "./memory-install-receipt.js";
@@ -60,6 +63,12 @@ export { memoryOutcomeLines, resolveDashboardUrl } from "./memory-install-report
 export { buildMemoryInstallReceipt, memoryReceiptLine, readMemoryReceiptFile, writeMemoryReceiptFile, MEMORY_RECEIPT_FILE, } from "./memory-install-receipt.js";
 export { codexHooksFile, readCodexHookTrust, } from "./memory-install-codex-hooks.js";
 export async function runMemoryInstall(command, io, deps = {}) {
+    // BLI-22640: a person typing `install` is choosing BLI Memory for this
+    // machine, which clears an earlier `off`. Unattended callers never come
+    // through here; they call `installMemoryIntegration` and only read the choice.
+    const wasOff = command.action === "install" && !command.dryRun
+        ? await recordInstallChoice(command, deps)
+        : false;
     const outcome = command.action === "status"
         ? await inspectMemoryIntegration(command, io, deps)
         : await installMemoryIntegration(command, io, deps);
@@ -77,6 +86,8 @@ export async function runMemoryInstall(command, io, deps = {}) {
         writeLine(io.stdout, JSON.stringify({ ...outcome, setup_receipt: receipt?.receipt ?? null }, null, 2));
     }
     else {
+        if (wasOff)
+            writeLine(io.stdout, "BLI Memory is back on for this machine (it was off). Undo: cockpit memory off");
         for (const line of memoryOutcomeLines(outcome))
             writeLine(io.stdout, line);
         if (receipt) {
@@ -88,10 +99,31 @@ export async function runMemoryInstall(command, io, deps = {}) {
     }
     return outcome.status === "failed" ? 1 : 0;
 }
+/** Records "on" for a person-typed `install`; true when it replaced an "off". A write that fails is logged and the install still runs. */
+async function recordInstallChoice(command, deps) {
+    const paths = getCollectorRuntimePaths(deps.homeDir ?? command.homeDir ?? os.homedir());
+    const wasOff = (await readMemoryCaptureChoice(paths)).state === "off";
+    try {
+        await writeMemoryCaptureChoice(paths, true, "memory_install");
+    }
+    catch (error) {
+        console.error("[memory-install] choice not saved; an earlier off still stands", JSON.stringify({ reason: "choice_write_failed", error_name: error instanceof Error ? error.name : typeof error }));
+        return false;
+    }
+    return wasOff;
+}
 export async function installMemoryIntegration(command, io, deps = {}) {
     const homeDir = deps.homeDir ?? command.homeDir ?? os.homedir();
     const platform = deps.platform ?? process.platform;
     const fileIo = deps.io ?? defaultMemoryFileIo();
+    // BLI-22640: the person's "off" outranks every unattended caller (doctor,
+    // onboard, update, the sync tick), because they all come through here.
+    // Only a founder's "off" is obeyed (Jeetesh's review of 2026-10-25); for
+    // anybody else the install runs as usual and the outcome names what it ignored.
+    const capture = await readEffectiveMemoryCapture(getCollectorRuntimePaths(homeDir), { fetch: io.fetch, ...(command.dashboardUrl ? { dashboardUrl: command.dashboardUrl } : {}) });
+    if (capture.off && capture.reading.state === "off") {
+        return installWhileOptedOut(command, io, deps, { homeDir, platform, fileIo, reason: capture.reading.reason });
+    }
     const resolved = await resolveMemoryConfig(command, io, platform, deps);
     const targets = [resolved.binTarget];
     // `no_bin_no_write`: with no resolved server there is nothing safe to
@@ -106,18 +138,10 @@ export async function installMemoryIntegration(command, io, deps = {}) {
     // tower-mcp-install.ts's header for why this rides here rather than a
     // separate, un-invoked verb. Independent of the memory outcome above: a
     // machine with one server but not the other is a real machine.
-    targets.push(...(await installTowerIntegration({
-        io: fileIo,
-        platform,
-        homeDir,
-        dashboardUrl: await resolveDashboardUrl(command, deps),
-        env: io.env ?? process.env,
-        fileExists: deps.fileExists,
-        cliEntryPoint: deps.cliEntryPoint,
-        realpath: deps.realpath,
-    }, command.dryRun)));
+    targets.push(...(await towerTargets(command, io, deps, { homeDir, platform, fileIo })));
     const outcome = {
         action: "install",
+        ...(capture.ignored ? { opt_out_ignored: "opt_out_ignored_not_founder" } : {}),
         ...(await readBackOutcome(targets, resolved, homeDir, fileIo)),
     };
     logMemoryOutcome(outcome, platform);
@@ -129,6 +153,75 @@ export async function installMemoryIntegration(command, io, deps = {}) {
     }
     return outcome;
 }
+/** BLI-3706: `bli-tower` registers beside `bli-memory`, opted out or not. */
+async function towerTargets(command, io, deps, scope) {
+    return installTowerIntegration({
+        io: scope.fileIo,
+        platform: scope.platform,
+        homeDir: scope.homeDir,
+        dashboardUrl: await resolveDashboardUrl(command, deps),
+        env: io.env ?? process.env,
+        fileExists: deps.fileExists,
+        cliEntryPoint: deps.cliEntryPoint,
+        realpath: deps.realpath,
+    }, command.dryRun);
+}
+/**
+ * BLI-22640. The install on a machine that turned BLI Memory off: write none
+ * of it, take back any of our entries that are still there (an older CLI, a
+ * restored backup, a hand edit), and keep `bli-tower`. Every BLI Memory target
+ * reads `skipped explicit_opt_out` (or `choice_unreadable`), so the sync
+ * tick's receipt, the heartbeat and the doctor row all name the choice.
+ *
+ * The bin is LOOKED UP but never run: `bin_found` stays a true fact about the
+ * machine, and no `--print-config` child is spawned for a server we will not
+ * register.
+ */
+async function installWhileOptedOut(command, io, deps, scope) {
+    const removal = await removeMemoryIntegration({ homeDir: scope.homeDir, io: scope.fileIo, dryRun: command.dryRun });
+    const targets = removal.map((result) => result.status === "failed"
+        ? { target: result.target, status: "failed", reason: result.reason, path: result.path, ...(result.detail ? { detail: result.detail } : {}) }
+        : {
+            target: result.target,
+            status: "skipped",
+            reason: scope.reason,
+            path: result.path,
+            ...(result.status === "removed" ? { detail: `removed ${result.removed ?? 0} BLI Memory entry(ies)` } : {}),
+            ...(result.status === "would_remove" ? { detail: `would remove ${result.removed ?? 0} BLI Memory entry(ies)` } : {}),
+        });
+    targets.push({ target: "codex_skills", status: "skipped", reason: scope.reason });
+    targets.push(...(await towerTargets(command, io, deps, scope)));
+    const bin = await resolveMemoryMcpBin({
+        env: envWithNodeRuntimeOnPath(io.env ?? process.env),
+        platform: scope.platform,
+        fileExists: deps.fileExists,
+        cliEntryPoint: deps.cliEntryPoint,
+        realpath: deps.realpath,
+    }).catch(() => null);
+    const failed = targets.find((target) => target.status === "failed");
+    const outcome = {
+        action: "install",
+        status: failed ? "failed" : "skipped",
+        reason: failed ? failed.reason : scope.reason,
+        opted_out: true,
+        // A dry run counts what it WOULD remove, so doctor's check can say "entries left".
+        removed_count: removal.reduce((sum, result) => sum + (result.status === "removed" || result.status === "would_remove" ? result.removed ?? 0 : 0), 0),
+        config_source: "none",
+        bin_found: bin !== null,
+        ...(bin ? { bin_source: bin.source } : {}),
+        targets,
+        receipt: buildMemoryInstallReceipt({
+            targets,
+            binFound: bin !== null,
+            codexTrust: await codexTrustFor(scope.homeDir, scope.fileIo),
+            expectedTrustRows: 0,
+        }),
+    };
+    logMemoryOutcome(outcome, scope.platform);
+    if (!command.dryRun)
+        await cacheReceipt(scope.homeDir, outcome.receipt);
+    return outcome;
+}
 /** What both `install` and `status` report once the targets are known: their verdict and the receipt. */
 async function readBackOutcome(targets, resolved, homeDir, fileIo) {
     return {
@@ -197,8 +290,14 @@ export async function inspectMemoryIntegration(command, io, deps = {}) {
         cliEntryPoint: deps.cliEntryPoint,
         realpath: deps.realpath,
     })));
+    // BLI-22640: `status` reads what is on disk either way, and says when the
+    // person turned BLI Memory off, so "not registered" is not read as broken.
+    const capture = await readEffectiveMemoryCapture(getCollectorRuntimePaths(homeDir), { fetch: io.fetch, ...(command.dashboardUrl ? { dashboardUrl: command.dashboardUrl } : {}) });
+    const optedOut = capture.off;
     const outcome = {
         action: "status",
+        ...(optedOut ? { opted_out: true } : {}),
+        ...(capture.ignored ? { opt_out_ignored: "opt_out_ignored_not_founder" } : {}),
         // The one live question on this surface: is the daemon answering? It is
         // bounded, it opens nothing but a local socket, and a machine without one
         // is reported as exactly that rather than as a problem.

package/dist/commands/memory-store.js

@@ -58,6 +58,7 @@ import { cacheAgeLabel, cacheCoverage, readThroughCache } from "./read-cache.js"
 import { runMemoryRequeue } from "./memory-requeue.js";
 import { runMemoryVisibility } from "./memory-visibility.js";
 import { readNoteFile } from "./notes-file.js";
+import { FOUNDER_TEXT_VERBS, founderMemoryVerbRefusal } from "../shelf-state.js";
 export { runMemoryVerbList } from "./memory-verb-list.js";
 const TAG = "[memory cli]";
 const SEARCH_DEADLINE_MS = 60_000;
@@ -69,6 +70,10 @@ const BODY_MAX_CHARS = 200_000;
 const FORGET_MAX_CHARS = 10_000;
 export async function runMemoryStore(command, io) {
     const door = await openAgentDoor("memory", command, io);
+    // BLI-23478: on a founder's laptop the text-carrying verbs refuse locally, as the Memory MCP does (`shelf-state.ts`).
+    const founderRefusal = FOUNDER_TEXT_VERBS.has(command.action) ? await founderMemoryVerbRefusal(door.homeDir, io.fetch) : null;
+    if (founderRefusal)
+        return failAgentDoor(door, TAG, founderRefusal.reason, founderRefusal.detail);
     switch (command.action) {
         case "map":
             return runMemoryMap(door);

package/dist/commands/memory-switch.js

@@ -0,0 +1,165 @@
+/**
+ * `cockpit memory on|off` and their long names `install|uninstall`
+ * (BLI-22640): the per-machine BLI Memory switch a person flips by hand.
+ *
+ * `off` records this machine's "no" (`memory-capture-choice.ts`) and then runs
+ * the ordinary install, which, on an opted-out machine, registers nothing of
+ * BLI Memory and takes back any of our hooks and MCP entries it finds
+ * (`installWhileOptedOut`, memory-install.ts). `on` records "yes" and runs the
+ * same install, which registers them. Going through the one install keeps the
+ * receipt, the heartbeat and the doctor row reading the same thing the switch
+ * just did.
+ *
+ * The choice is written FIRST. If it cannot be written, nothing else happens
+ * and the command fails: a removal without the recorded "no" would be undone
+ * by the next sync tick, which is the bug this switch exists to end.
+ *
+ * `off` and `uninstall` are founders only (Jeetesh's review of 2026-10-25):
+ * before anything is written, Tower is asked live whether this machine's
+ * person is a founder (`mayRecordOff`, founder-standing.ts). Anybody else is
+ * refused with `memory_off_founders_only`, and a Tower that cannot be asked
+ * refuses with `founder_check_unavailable`; either way nothing is written and
+ * BLI Memory stays on. `on` is open to everyone.
+ *
+ * Each verb prints one line: what changed, and the command that undoes it.
+ * `uninstall` (and `install`, in memory-install.ts) add the per-target detail
+ * under it.
+ */
+import os from "node:os";
+import { writeLine } from "./cli-io.js";
+import { installMemoryIntegration, memoryOutcomeLines, } from "./memory-install.js";
+import { removeMemoryIntegration } from "./memory-uninstall.js";
+import { defaultMemoryFileIo } from "./memory-install-files.js";
+import { refreshSetupReceipt } from "./setup-receipt.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { readMemoryCaptureChoice, writeMemoryCaptureChoice, } from "../memory-capture-choice.js";
+import { mayRecordOff } from "../founder-standing.js";
+const VIA = {
+    on: "memory_on",
+    off: "memory_off",
+    uninstall: "memory_uninstall",
+};
+export async function runMemorySwitch(command, io, deps = {}) {
+    const homeDir = deps.homeDir ?? command.homeDir ?? os.homedir();
+    const paths = getCollectorRuntimePaths(homeDir);
+    const turnOn = command.action === "on";
+    const before = await readMemoryCaptureChoice(paths);
+    if (!turnOn) {
+        const permission = await mayRecordOff({
+            homeDir,
+            ...(command.dashboardUrl ? { dashboardUrl: command.dashboardUrl } : {}),
+            fetch: io.fetch,
+            door: `memory_${command.action}`,
+        });
+        if (!permission.allowed) {
+            print(command, io, {
+                line: permission.line,
+                // A non-founder's "off" is never obeyed, so for them memory is on whatever the file says.
+                memory_capture: permission.reason === "memory_off_founders_only" || before.state !== "off",
+                changed: false,
+                status: "refused",
+                reason: permission.reason,
+            });
+            return 1;
+        }
+    }
+    if (command.dryRun)
+        return dryRunSwitch(command, io, deps, { homeDir, turnOn });
+    try {
+        await writeMemoryCaptureChoice(paths, turnOn, VIA[command.action]);
+    }
+    catch (error) {
+        const reason = error instanceof Error && error.message.startsWith("memory_capture") ? error.message : "choice_write_failed";
+        console.error("[memory-switch] choice not saved; nothing was changed", JSON.stringify({ reason, action: command.action }));
+        const line = `BLI Memory could not be turned ${turnOn ? "on" : "off"}: this machine's choice could not be saved (${reason}). Nothing was changed.`;
+        print(command, io, { line, memory_capture: before.state !== "off", changed: false, status: "failed", reason });
+        return 1;
+    }
+    const outcome = await installMemoryIntegration({ ...command, action: "install" }, io, deps);
+    const line = turnOn ? onLine(before, outcome) : offLine(before, outcome);
+    const receipt = await refreshSetupReceipt(io, {
+        homeDir,
+        ...(command.dashboardUrl ? { dashboardUrl: command.dashboardUrl } : {}),
+    });
+    const changed = turnOn ? before.state !== "on" || outcome.status === "installed" : before.state !== "off" || (outcome.removed_count ?? 0) > 0;
+    console.error("[memory-switch] BLI Memory switched", JSON.stringify({ action: command.action, memory_capture: turnOn, changed, status: outcome.status, reason: outcome.reason, removed_count: outcome.removed_count ?? 0 }));
+    print(command, io, {
+        line,
+        memory_capture: turnOn,
+        changed,
+        status: outcome.status,
+        reason: outcome.reason,
+        outcome,
+        setup_receipt: receipt?.receipt ?? null,
+    });
+    return outcome.status === "failed" ? 1 : 0;
+}
+/** Writes nothing at all: not the choice, not a host file. */
+async function dryRunSwitch(command, io, deps, scope) {
+    if (scope.turnOn) {
+        const outcome = await installMemoryIntegration({ ...command, action: "install", dryRun: true }, io, deps);
+        const line = "Dry run: BLI Memory would be turned on for this machine and registered with Claude Code and Codex. Nothing was written.";
+        print(command, io, { line, memory_capture: true, changed: false, status: outcome.status, reason: "dry_run", outcome });
+        return 0;
+    }
+    const removal = await removeMemoryIntegration({ homeDir: scope.homeDir, io: deps.io ?? defaultMemoryFileIo(), dryRun: true });
+    const pending = removal.reduce((sum, result) => sum + (result.status === "would_remove" ? result.removed ?? 0 : 0), 0);
+    const line = `Dry run: BLI Memory would be turned off for this machine and ${pending} of its entries removed from Claude Code and Codex. Nothing was written.`;
+    print(command, io, { line, memory_capture: false, changed: false, status: "would_remove", reason: "dry_run", removal });
+    return removal.some((result) => result.status === "failed") ? 1 : 0;
+}
+export function offLine(before, outcome) {
+    const undo = " Undo: cockpit memory on";
+    if (outcome.status === "failed") {
+        const failed = outcome.targets.find((target) => target.status === "failed");
+        return `BLI Memory is off for this machine, but ${failed?.target ?? "an entry"} could not be cleaned (${outcome.reason}); `
+            + "its save hooks send nothing while it is off, and `cockpit memory off` tries again." + undo;
+    }
+    const removed = outcome.removed_count ?? 0;
+    if (removed > 0) {
+        return `BLI Memory is off for this machine: removed its ${removed} hook and MCP entries from Claude Code and Codex, `
+            + "and doctor, onboard, update and the background sync will not add them back." + undo;
+    }
+    if (before.state === "off")
+        return "BLI Memory was already off for this machine; nothing changed." + undo;
+    return "BLI Memory is off for this machine: nothing of it was registered, and doctor, onboard, update and the background sync will not add it." + undo;
+}
+export function onLine(before, outcome) {
+    const undo = " Undo: cockpit memory off";
+    if (outcome.status === "failed") {
+        return `BLI Memory is on for this machine, but registering it failed (${outcome.reason}); \`cockpit doctor\` repairs it.` + undo;
+    }
+    if (outcome.status === "skipped") {
+        return "BLI Memory is on for this machine; its server is not installed yet, so nothing was registered, "
+            + "and the next `cockpit doctor` or background sync registers it." + undo;
+    }
+    if (outcome.status === "installed") {
+        return "BLI Memory is on for this machine: registered its hooks and MCP server with Claude Code and Codex, "
+            + "so each session is saved and agents remember it." + undo;
+    }
+    if (before.state === "on")
+        return "BLI Memory was already on for this machine; nothing changed." + undo;
+    return "BLI Memory is on for this machine (it was already registered); your choice is saved, so doctor will not ask again." + undo;
+}
+function print(command, io, result) {
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({
+            action: command.action,
+            memory_capture: result.memory_capture,
+            changed: result.changed,
+            status: result.status,
+            reason: result.reason,
+            message: result.line,
+            ...(result.outcome ? { targets: result.outcome.targets, receipt: result.outcome.receipt } : {}),
+            ...(result.removal ? { removal: result.removal } : {}),
+            ...(result.setup_receipt !== undefined ? { setup_receipt: result.setup_receipt } : {}),
+        }, null, 2));
+        return;
+    }
+    writeLine(io.stdout, result.line);
+    // `uninstall` is the long name: the same line, then what each file says.
+    if (command.action === "uninstall" && result.outcome) {
+        for (const line of memoryOutcomeLines(result.outcome).slice(1))
+            writeLine(io.stdout, line);
+    }
+}

package/dist/commands/memory-uninstall.js

@@ -0,0 +1,187 @@
+/**
+ * `cockpit memory off` / `cockpit memory uninstall` (BLI-22640): take BLI
+ * Memory's registration back off this machine.
+ *
+ * Removes exactly what `cockpit memory install` writes that can send or
+ * receive conversation text, and nothing a person wrote themselves:
+ *
+ *   claude_mcp    ~/.claude.json            `mcpServers["bli-memory"]`
+ *   claude_hooks  ~/.claude/settings.json   our hook commands, by bin name (`stripOurHooks`)
+ *   codex_mcp     ~/.codex/config.toml      `[mcp_servers.bli-memory]` and its sub-tables
+ *   codex_hooks   ~/.codex/hooks.json       our hook commands, by bin name
+ *
+ * Only OUR commands come out of a hook group. A group a person shares with
+ * ours keeps their commands and its matcher; a group left empty is dropped
+ * (the Codex review point on PR 2615).
+ *
+ * Left in place on purpose: the read-only `permissions.allow` entry (it names
+ * a tool that no longer exists, so it allows nothing) and the Codex skill
+ * files (instructions to an agent, not a hook; they send nothing). `bli-tower`
+ * stays registered: it carries Tower's docs and messages tools, not memory.
+ *
+ * Same three rules as the installer: merge, never clobber (another server or
+ * another hook comes out untouched; a file that will not parse is refused,
+ * never rewritten); idempotent (a second run finds nothing and says so); and
+ * read back what the disk stored (BLI-2541): a removal is only `removed` once
+ * the re-read file holds none of ours.
+ *
+ * Never throws at the caller. The sync tick calls this to keep an opted-out
+ * machine clean, and a failure is a named result, not a lost tick.
+ */
+import { MEMORY_MCP_SERVER_ID, } from "./memory-install-contract.js";
+import { claudeMcpConfigFile, claudeSettingsFile, ourHookCommandCount, parseJsonRecord, stripOurHooks, serializeJson, } from "./memory-install-claude.js";
+import { codexConfigFile } from "./memory-install-codex.js";
+import { codexHooksFile } from "./memory-install-codex-hooks.js";
+import { removeTomlTableTree } from "./memory-install-toml.js";
+const MEMORY_TOML_PATH = ["mcp_servers", MEMORY_MCP_SERVER_ID];
+export async function removeMemoryIntegration(options) {
+    const results = [
+        await removeFromJson("claude_mcp", claudeMcpConfigFile(options.homeDir), options, countOurServer, dropOurServer),
+        await removeFromJson("claude_hooks", claudeSettingsFile(options.homeDir), options, countOurHookGroups, dropOurHookGroups),
+        await removeFromCodexToml(options),
+        await removeFromJson("codex_hooks", codexHooksFile(options.homeDir), options, countOurHookGroups, dropOurHookGroups),
+    ];
+    console.error("[memory-uninstall] BLI Memory registration removal finished", JSON.stringify({
+        dry_run: options.dryRun,
+        removed_count: results.reduce((sum, result) => sum + (result.status === "removed" ? result.removed ?? 0 : 0), 0),
+        targets: results.map((result) => `${result.target}:${result.status}/${result.reason}`),
+    }));
+    return results;
+}
+/** True when every target is clean (or would be, on a dry run). */
+export function removalSucceeded(results) {
+    return results.every((result) => result.status !== "failed");
+}
+/** Whether anything of ours is still on disk, for a check that must not write. */
+export function removalPending(results) {
+    return results.some((result) => result.status === "would_remove");
+}
+async function removeFromJson(target, file, options, count, drop) {
+    let raw;
+    try {
+        raw = await options.io.readText(file);
+    }
+    catch (error) {
+        return failed(target, file, "read_failed", error);
+    }
+    if (raw === null || !raw.trim())
+        return { target, status: "absent", reason: "file_absent", path: file };
+    const root = parseJsonRecord(raw);
+    if (!root) {
+        return {
+            target,
+            status: "failed",
+            reason: "config_unreadable",
+            path: file,
+            detail: "the file is not valid JSON; nothing was changed",
+        };
+    }
+    const ours = count(root);
+    if (ours === 0)
+        return { target, status: "absent", reason: "entry_absent", path: file };
+    if (options.dryRun)
+        return { target, status: "would_remove", reason: "dry_run", path: file, removed: ours };
+    try {
+        await options.io.writeText(file, serializeJson(drop(structuredClone(root)), raw));
+    }
+    catch (error) {
+        return failed(target, file, "write_failed", error);
+    }
+    const storedRaw = await options.io.readText(file).catch(() => null);
+    const stored = storedRaw === null ? null : parseJsonRecord(storedRaw);
+    if (!stored || count(stored) !== 0) {
+        return {
+            target,
+            status: "failed",
+            reason: "read_back_mismatch",
+            path: file,
+            detail: "the file on disk still holds a BLI Memory entry",
+        };
+    }
+    return { target, status: "removed", reason: "removed_entry", path: file, removed: ours };
+}
+async function removeFromCodexToml(options) {
+    const target = "codex_mcp";
+    const file = codexConfigFile(options.homeDir);
+    let raw;
+    try {
+        raw = await options.io.readText(file);
+    }
+    catch (error) {
+        return failed(target, file, "read_failed", error);
+    }
+    if (raw === null)
+        return { target, status: "absent", reason: "file_absent", path: file };
+    const next = removeTomlTableTree(raw, MEMORY_TOML_PATH);
+    if (next === raw)
+        return { target, status: "absent", reason: "entry_absent", path: file };
+    if (options.dryRun)
+        return { target, status: "would_remove", reason: "dry_run", path: file, removed: 1 };
+    try {
+        await options.io.writeText(file, next);
+    }
+    catch (error) {
+        return failed(target, file, "write_failed", error);
+    }
+    const stored = await options.io.readText(file).catch(() => null);
+    if (stored === null || removeTomlTableTree(stored, MEMORY_TOML_PATH) !== stored) {
+        return {
+            target,
+            status: "failed",
+            reason: "read_back_mismatch",
+            path: file,
+            detail: "the table on disk still holds the bli-memory server",
+        };
+    }
+    return { target, status: "removed", reason: "removed_entry", path: file, removed: 1 };
+}
+function countOurServer(root) {
+    const servers = asRecord(root["mcpServers"]);
+    return servers && MEMORY_MCP_SERVER_ID in servers ? 1 : 0;
+}
+function dropOurServer(root) {
+    const servers = asRecord(root["mcpServers"]);
+    if (servers)
+        delete servers[MEMORY_MCP_SERVER_ID];
+    return root;
+}
+function countOurHookGroups(root) {
+    return ourHookCommandCount(root);
+}
+/**
+ * Takes our commands out and keeps everything else: a person's command in a
+ * group shared with ours stays, with the group's matcher. A group left with no
+ * hooks is dropped, and an event left with no groups at all is dropped, not
+ * left as `[]`.
+ */
+function dropOurHookGroups(root) {
+    const hooks = asRecord(root["hooks"]);
+    if (!hooks)
+        return root;
+    for (const [event, groups] of Object.entries(hooks)) {
+        if (!Array.isArray(groups))
+            continue;
+        const stripped = stripOurHooks(groups);
+        if (stripped.removed === 0)
+            continue;
+        if (stripped.groups.length === 0)
+            delete hooks[event];
+        else
+            hooks[event] = stripped.groups;
+    }
+    return root;
+}
+function failed(target, file, reason, error) {
+    return {
+        target,
+        status: "failed",
+        reason,
+        path: file,
+        detail: error instanceof Error ? error.name : "unknown",
+    };
+}
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    return value;
+}

package/dist/commands/memory-verb-list.js

@@ -47,7 +47,11 @@ const VERB_LIST_LINES = [
     "      their writes; super admins only, and a DRY RUN unless you pass --apply",
     "",
     "This machine:",
-    "  cockpit memory install [--dry-run] [--json]   register the MCP server and the three hooks",
+    "  cockpit memory on [--dry-run] [--json]       turn BLI Memory on here and register its hooks",
+    "  cockpit memory off [--dry-run] [--json]      turn it off here: remove its hooks and MCP entry,",
+    "      and doctor, onboard, update and the background sync never add them back",
+    "  cockpit memory install [--dry-run] [--json]   on, printing every file it checked",
+    "  cockpit memory uninstall [--dry-run] [--json] off, printing every file it checked",
     "  cockpit memory status [--json]                read the stored config back",
     "",
     "The experience log:",
@@ -73,7 +77,7 @@ export function runMemoryVerbList(io, json) {
         writeLine(io.stdout, JSON.stringify({
             ok: true,
             noun: "memory",
-            machine_verbs: ["install", "status"],
+            machine_verbs: ["on", "off", "install", "uninstall", "status"],
             store_verbs: ["rules", "knowledge", "search", "save", "update", "forget", "private", "public", "profile", "consolidation", "chain", "source", "exam", "requeue"],
             log_verbs: ["log"],
         }));

package/dist/commands/onboard.js

@@ -1,6 +1,7 @@
 import { resolveOnboardEmail } from "./local-auth.js";
 import { discoverCommandWorktrees } from "./local-discovery.js";
 import { handleOnboardFailure, } from "./onboard-completion.js";
+import { askMemoryChoiceOnce } from "./memory-capture-prompt.js";
 import { runOnboardMultiRepoFlow, runOnboardSingleRepoFlow, } from "./onboard-flows.js";
 import { writeOnboardBanner } from "./onboard-report.js";
 import { prepareOnboardRoots, installOnboardConfig, pairForOnboarding } from "./onboard-setup.js";
@@ -28,6 +29,10 @@ export async function runOnboard(command, io) {
         const claimedOwnerEmail = await resolveOnboardEmail(roots.resolvedCommand, roots.collectionRoots, roots.existingConfig, io);
         install = await installOnboardConfig(command, roots.resolvedRoots, installEvents, io);
         pair = await pairForOnboarding(command, { primaryRoot: roots.primaryRoot, claimedOwnerEmail }, installEvents, io);
+        // BLI-22640: asked once, before the flows below can register BLI Memory,
+        // and after pairing, because only a founder is asked and Tower is the one
+        // who says who is a founder.
+        await askMemoryChoiceOnce(io, { ...(command.homeDir ? { homeDir: command.homeDir } : {}), json: command.json });
         const worktrees = await discoverOnboardWorktrees(command, roots, io);
         const ctx = {
             command,