@bli-cockpit/cli 0.2.286 → 0.2.288

package/dist/capture-opt-outs.js

@@ -0,0 +1,129 @@
+import { optOutVerdict, } from "@bli-cockpit/telemetry-core";
+import { writeLine } from "./commands/cli-io.js";
+import { askTowerFounderStanding } from "./founder-standing.js";
+import { recallLiveFounderAnswer } from "./live-founder-memo.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig } from "./local-state.js";
+import { readMemoryCaptureChoice } from "./memory-capture-choice.js";
+import { configOptOutLabels } from "./source-opt-out.js";
+/**
+ * BLI-22640 (Jeetesh's review of 2026-10-25): this machine's opt-outs, which of
+ * them it obeys, and the founder answer it acted on, in one reading.
+ *
+ * - The sync tick calls `refreshFounderStandingForOptOuts` first: a machine
+ *   that holds any opt-out asks Tower live before anything is collected, and
+ *   every decider in that tick reuses the answer (memory only,
+ *   `live-founder-memo.ts`). A machine with no opt-out asks nothing.
+ * - The heartbeat carries `readCaptureOptOuts` as `capture_opt_outs`, so
+ *   Tower's fleet records see what each machine obeyed, ignored and held, and
+ *   Tower can compare `obeyed` with its own owners list. It reports what THIS
+ *   process heard from Tower; it never reads the saved `founder-standing.json`.
+ * - `cockpit doctor` prints `captureOptOutLine` when something is ignored and
+ *   `heldOptOutLine` when Tower could not be asked.
+ *
+ * Never throws: a reading that fails is logged and reads as "no opt-out".
+ * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
+ */
+export async function readCaptureOptOuts(homeDir) {
+    const paths = getCollectorRuntimePaths(homeDir);
+    try {
+        const found = await foundOptOuts(homeDir);
+        // What this process heard from Tower this tick; no answer means unknown (held).
+        const standing = found.length > 0 ? (recallLiveFounderAnswer(paths.state_dir)?.standing ?? "unknown") : "unknown";
+        return splitByVerdict(found, standing);
+    }
+    catch (error) {
+        console.error("[capture-opt-outs] opt-outs could not be read; reporting none", JSON.stringify({ reason: "opt_outs_unreadable", error_name: error instanceof Error ? error.name : typeof error }));
+        return { standing: "unknown", obeyed: [], ignored: [] };
+    }
+}
+/**
+ * Asks Tower live when this machine holds an opt-out, so this tick decides on
+ * Tower's current answer. When Tower cannot be asked the answer is `unknown`
+ * and the opt-outs are HELD (`owner_check_unavailable`), never decided on the
+ * saved file. Never throws; logs both branches.
+ */
+export async function refreshFounderStandingForOptOuts(options) {
+    let found;
+    try {
+        found = await foundOptOuts(options.homeDir);
+    }
+    catch {
+        found = [];
+    }
+    if (found.length === 0) {
+        console.error("[capture-opt-outs] no opt-out on this machine; Tower not asked", JSON.stringify({ reason: "no_opt_out" }));
+        return { standing: "unknown", obeyed: [], ignored: [] };
+    }
+    const answer = await askTowerFounderStanding({
+        ...(options.homeDir === undefined ? {} : { homeDir: options.homeDir }),
+        ...(options.dashboardUrl === undefined ? {} : { dashboardUrl: options.dashboardUrl }),
+        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
+    });
+    const report = splitByVerdict(found, answer.standing);
+    console.error("[capture-opt-outs] this tick's opt-outs", JSON.stringify({
+        reason: optOutVerdict(report.standing).reason,
+        ...(answer.standing === "unknown" ? { not_live_reason: answer.reason } : {}),
+        obeyed: report.obeyed,
+        ignored: report.ignored,
+    }));
+    return report;
+}
+/** The one line doctor prints, or null when nothing is ignored. */
+export function captureOptOutLine(report) {
+    if (report.ignored.length === 0)
+        return null;
+    return `Ignored on this machine: ${report.ignored.map(labelWords).join(", ")}. Only Tower's founders can keep work out of Tower, `
+        + "so BLI Memory stays on and these sessions upload; your settings are left as you wrote them (opt_out_ignored_not_founder).";
+}
+/** The line doctor prints when Tower could not be asked, or null when nothing is held. */
+export function heldOptOutLine(report) {
+    if (report.standing !== "unknown" || report.obeyed.length === 0)
+        return null;
+    return `Held on this machine: ${report.obeyed.map(labelWords).join(", ")}. Tower could not say whether you are a founder, `
+        + "so nothing these cover is sent until it can; your settings are left as you wrote them (owner_check_unavailable).";
+}
+/**
+ * `cockpit doctor`'s step: asks Tower when this machine holds an opt-out, and
+ * prints one line when any is ignored because the person is not a founder, or
+ * held because Tower could not be asked.
+ * `--json` keeps stdout for its object; the line goes to stderr there. Never
+ * throws: doctor is never lost to this line.
+ */
+export async function reportIgnoredOptOuts(options, io) {
+    try {
+        const report = await refreshFounderStandingForOptOuts({
+            ...(options.homeDir === undefined ? {} : { homeDir: options.homeDir }),
+            fetch: io.fetch,
+        });
+        const line = captureOptOutLine(report) ?? heldOptOutLine(report);
+        if (line)
+            writeLine(options.json ? io.stderr : io.stdout, line);
+    }
+    catch (error) {
+        console.error("[doctor] opt-out report failed; doctor carries on", JSON.stringify({ reason: "opt_out_report_threw", error_name: error instanceof Error ? error.name : typeof error }));
+    }
+}
+async function foundOptOuts(homeDir) {
+    const paths = getCollectorRuntimePaths(homeDir);
+    const config = await readLocalCollectorConfig(paths).catch(() => null);
+    const choice = await readMemoryCaptureChoice(paths);
+    return [
+        ...(choice.state === "off" ? ["memory_capture_off"] : []),
+        ...configOptOutLabels(config),
+    ];
+}
+function splitByVerdict(found, standing) {
+    if (found.length === 0)
+        return { standing, obeyed: [], ignored: [] };
+    return optOutVerdict(standing).obeyed
+        ? { standing, obeyed: found, ignored: [] }
+        : { standing, obeyed: [], ignored: found };
+}
+function labelWords(label) {
+    switch (label) {
+        case "memory_capture_off": return "BLI Memory off";
+        case "collect_claude_jsonl_false": return "collect_claude_jsonl: false";
+        case "collect_codex_jsonl_false": return "collect_codex_jsonl: false";
+        case "raw_evidence_upload_disabled": return "raw_evidence_upload: \"disabled\"";
+    }
+}

package/dist/collection-scope.js

@@ -0,0 +1,201 @@
+/**
+ * BLI-23590: "only collect from my approved folders" (`collection_scope: "roots_only"`).
+ *
+ * Roots are labels by default (session-first collection, BLI-10734): every session the machine can see is uploaded
+ * and tagged inside or outside. A person Tower names eligible (the founders and Ed, decided on the SERVER) can choose
+ * `roots_only`: a session whose working directory is outside every approved root is dropped from the scan result
+ * before anything is staged, uploaded, reported, committed-to-git-scanned or saved to the local work scan. Its only
+ * trace is a count on the heartbeat with {@link COLLECTION_SCOPE_ROOTS_ONLY_REASON}.
+ *
+ * Where the answer comes from, in order:
+ *
+ *   1. Tower's last reply (`collection_scope: { scope, eligible }` on the install-events reply), kept in
+ *      `collection-scope.json` in the state directory so an offline tick keeps the last answer.
+ *   2. The local config key `collection_scope: "roots_only"`, honoured ONLY when the cached reply says
+ *      `eligible: true`. An ineligible person's key, or one nobody has confirmed yet, is ignored and the reason is
+ *      logged. Editing a laptop's config therefore cannot switch this on for anyone Tower has not cleared.
+ *   3. Otherwise `all`, today's behaviour for everyone.
+ *
+ * Plain-words note on "not read": the scan has to open a session file's head to learn its working directory, so the
+ * file is touched; nothing from an outside-root session is kept past that decision (no staging, upload, session row,
+ * hash in a report, git scan or work-scan entry).
+ *
+ * Holds scope, eligibility and a timestamp. Never a path, an id or a byte of a session.
+ *
+ * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
+ */
+import path from "node:path";
+import { COLLECTION_SCOPE_ROOTS_ONLY_REASON, CollectionScopeReplySchema, } from "@bli-cockpit/telemetry-core";
+import { isPathWithin } from "./adapters/attribution-core-paths.js";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
+import { readJsonFile, writeJsonFileAtomic } from "./local-state-files.js";
+export const COLLECTION_SCOPE_STATE_FILENAME = "collection-scope.json";
+const TAG = "[collection-scope]";
+export function collectionScopeStatePath(stateDir) {
+    return path.join(stateDir, COLLECTION_SCOPE_STATE_FILENAME);
+}
+/** The cached answer, or null when there is none or it cannot be trusted (said out loud when unreadable). */
+export async function readCollectionScopeState(stateDir) {
+    let raw;
+    try {
+        raw = await readJsonFile(collectionScopeStatePath(stateDir));
+    }
+    catch (error) {
+        if (isMissingFileFailure(error))
+            return null;
+        console.error(TAG + " cache unreadable, collecting as the default", JSON.stringify({ reason: "collection_scope_cache_unreadable", ...describeError(error) }));
+        return null;
+    }
+    const parsed = CollectionScopeReplySchema.safeParse(raw && typeof raw === "object" && !Array.isArray(raw)
+        ? { scope: raw["scope"], eligible: raw["eligible"] }
+        : null);
+    if (!parsed.success) {
+        console.error(TAG + " cache shape invalid, collecting as the default", JSON.stringify({ reason: "collection_scope_cache_shape_invalid" }));
+        return null;
+    }
+    const observedAt = raw["observed_at"];
+    return { ...parsed.data, observed_at: typeof observedAt === "string" ? observedAt : "" };
+}
+/**
+ * Put Tower's reply on file. A reply that names no scope (older server, failed read) is ignored and the previous
+ * answer stays in force. An unknown shape is ignored with a log. Returns true only when the file now holds the reply.
+ */
+export async function recordObservedCollectionScope(stateDir, observed, now = () => new Date()) {
+    if (observed === undefined || observed === null)
+        return false;
+    const parsed = CollectionScopeReplySchema.safeParse(observed);
+    if (!parsed.success) {
+        console.error(TAG + " reply carried a scope this collector does not understand, ignored", JSON.stringify({ reason: "collection_scope_reply_invalid" }));
+        return false;
+    }
+    const previous = await readCollectionScopeState(stateDir);
+    try {
+        await writeJsonFileAtomic(collectionScopeStatePath(stateDir), {
+            schema_version: "cockpit-collection-scope.v1",
+            ...parsed.data,
+            observed_at: now().toISOString(),
+        });
+    }
+    catch (error) {
+        console.error(TAG + " could not cache the answer Tower sent; the previous answer stays in force", JSON.stringify({ reason: "collection_scope_cache_write_failed", ...describeError(error) }));
+        return false;
+    }
+    if (previous?.scope !== parsed.data.scope || previous?.eligible !== parsed.data.eligible) {
+        console.error(TAG + " answer for this person changed", JSON.stringify({ reason: "collection_scope_changed", from: previous?.scope ?? "none", to: parsed.data.scope, eligible: parsed.data.eligible }));
+    }
+    return true;
+}
+/** Pure: the scope a tick runs under, from Tower's cached answer and the local config request. */
+export function resolveEffectiveCollectionScope(input) {
+    const { cache, localRequest } = input;
+    if (cache?.scope === "roots_only") {
+        // Tower only ever sends roots_only for a person it cleared; an `eligible: false` beside it is a contradiction,
+        // and the safe reading of a contradiction is the default.
+        if (cache.eligible)
+            return { scope: "roots_only", source: "server", reason: "tower_set_roots_only" };
+        return { scope: "all", source: "default", reason: "tower_answer_contradicts_itself_ignored" };
+    }
+    if (localRequest === "roots_only") {
+        if (cache?.eligible)
+            return { scope: "roots_only", source: "local_config_eligible", reason: "local_roots_only_request_tower_confirms_eligible" };
+        return {
+            scope: "all",
+            source: "default",
+            reason: cache ? "local_roots_only_ignored_not_eligible" : "local_roots_only_ignored_eligibility_unconfirmed",
+        };
+    }
+    return { scope: "all", source: "default", reason: cache ? "tower_says_all" : "no_answer_from_tower_yet" };
+}
+/**
+ * The tick's decision, logged once. `localRequest` is the config key. Never throws: a read failure is the default
+ * scope with its reason, and the failure was already logged by the reader.
+ */
+export async function settleCollectionScope(stateDir, localRequest) {
+    const cache = await readCollectionScopeState(stateDir);
+    const effective = resolveEffectiveCollectionScope({ cache, localRequest });
+    console.error(TAG + " scope for this tick", JSON.stringify({ reason: effective.reason, scope: effective.scope, source: effective.source, eligible: cache?.eligible ?? null }));
+    return effective;
+}
+/** `settleCollectionScope` for the sync tick, which it must never fail. */
+export async function settleTickCollectionScopeBestEffort(stateDir, observed) {
+    try {
+        await recordObservedCollectionScope(stateDir, observed);
+    }
+    catch (error) {
+        console.error(TAG + " could not settle the answer for this tick", JSON.stringify({ reason: "collection_scope_settle_failed", ...describeError(error) }));
+    }
+}
+// ---------------------------------------------------------------------------
+// The root test and the filter
+// ---------------------------------------------------------------------------
+/**
+ * Is this working directory inside an approved root? Uses the collector's one containment rule
+ * (`isPathWithin`): the platform is read from each path itself (a drive letter or UNC share is Windows), Windows
+ * compares case-insensitively with either slash, `projects-old` is not inside `projects`, and a Windows path never
+ * matches a POSIX root or the reverse.
+ */
+export function cwdInsideRoots(cwd, roots) {
+    if (!cwd || roots.length === 0)
+        return false;
+    return roots.some((root) => isPathWithin(cwd, root));
+}
+/**
+ * A session stays when its working directory is inside an approved root, or when attribution put it in a worktree
+ * that discovery found under the roots and its working directory is inside that worktree (a Codex-managed worktree
+ * of an approved repo lives outside the roots but is the approved repo's work). No recorded working directory means
+ * it cannot be proven inside, so it is withheld.
+ */
+export function sessionInsideRoots(result, roots) {
+    if (cwdInsideRoots(result.local_cwd, roots))
+        return true;
+    return Boolean(result.worktree && cwdInsideRoots(result.local_cwd, [result.worktree.repo_root]));
+}
+export function withholdOutsideRoots(results, roots) {
+    const kept = [];
+    let withheld = 0;
+    let withoutCwd = 0;
+    for (const result of results) {
+        if (sessionInsideRoots(result, roots)) {
+            kept.push(result);
+            continue;
+        }
+        withheld += 1;
+        if (!result.local_cwd)
+            withoutCwd += 1;
+    }
+    return { kept, withheld, withheld_without_cwd: withoutCwd };
+}
+/**
+ * Drop the outside-root sessions from one source's scan result and keep its per-state counts honest (a count of
+ * `unattributed` that still included a withheld session would say the machine saw something it was told to forget).
+ * The other counters (files discovered, scanned) describe the READ and stay as they were.
+ */
+export function scopeScanResult(scan, roots) {
+    const { kept, withheld, withheld_without_cwd } = withholdOutsideRoots(scan.results, roots);
+    if (withheld === 0)
+        return { scan, withheld: 0, withheld_without_cwd: 0 };
+    const counts = Object.fromEntries(Object.keys(scan.counts).map((state) => [state, kept.filter((result) => result.state === state).length]));
+    return { scan: { ...scan, results: kept, counts }, withheld, withheld_without_cwd };
+}
+/**
+ * `cockpit backfill`'s version of the same drop: under `roots_only` a session outside every approved root never becomes
+ * a candidate, so backfill can never upload what the scheduled sync withholds. Under `all` the scans pass through.
+ */
+export function scopeHistoryScans(options, codex, claude) {
+    if (options.collectionScope.scope !== "roots_only")
+        return { codex, claude };
+    const codexScoped = codex ? scopeScanResult(codex, options.collectionRoots) : null;
+    const claudeScoped = claude ? scopeScanResult(claude, options.collectionRoots) : null;
+    logScopeWithhold("backfill", {
+        source: "codex+claude_code",
+        kept: (codexScoped?.scan.results.length ?? 0) + (claudeScoped?.scan.results.length ?? 0),
+        withheld: (codexScoped?.withheld ?? 0) + (claudeScoped?.withheld ?? 0),
+        withheld_without_cwd: (codexScoped?.withheld_without_cwd ?? 0) + (claudeScoped?.withheld_without_cwd ?? 0),
+        roots: options.collectionRoots.length,
+    });
+    return { codex: codexScoped?.scan ?? null, claude: claudeScoped?.scan ?? null };
+}
+/** The one log line every acting site writes, so a withhold is never silent. Counts only. */
+export function logScopeWithhold(site, facts) {
+    console.error(`[${site}] sessions outside the approved roots withheld by collection scope`, JSON.stringify({ reason: COLLECTION_SCOPE_ROOTS_ONLY_REASON, ...facts }));
+}

package/dist/commands/agent-session-report.js

@@ -152,6 +152,9 @@ function sessionReportEntry(result, context) {
         attribution_score: result.attribution_score,
         path_score: result.path_score,
         root_scope: rootScopeForReason(result.reason),
+        // BLI-23478 (three shelves): every row this collector sends is a team-shelf row; a drawer session sends no row
+        // (it left the pass in `session-sync-shelf.ts`). Tower refuses a founder's row without it once routing is on.
+        shelf: "team",
         signals: result.signals,
         ...(result.content_hash_sha256
             ? { session_file_hash_sha256: result.content_hash_sha256 }

package/dist/commands/agreements-render.js

@@ -0,0 +1,61 @@
+/**
+ * How `cockpit agreements` prints the doors' answers as plain text. The shapes copy
+ * `apps/dashboard/src/lib/agreements/contracts.ts` (this package does not import the dashboard); only the fields
+ * printed here are named.
+ */
+const STATUS_WORDS = { open: "waiting for your signature", signed: "signed", cancelled: "cancelled" };
+/** One request in `cockpit agreements`: what, its state, and the id to show it. */
+export function rowLines(row) {
+    const when = row.status === "signed" && row.signed_at ? `, ${row.signed_at.slice(0, 10)}` : row.status === "open" && row.due_at ? `, due ${row.due_at.slice(0, 10)}` : "";
+    return [`${row.document_title} (${row.version_label}): ${STATUS_WORDS[row.status] ?? row.status}${when}`, `  cockpit agreements show ${row.request_id}`];
+}
+/** A box as it was answered once signed; empty before then, because a box is never pre-ticked. */
+function boxLine(box, ticked) {
+    return `  ${ticked ? "[x]" : "[ ]"} ${box.wording} (${box.required ? "required" : "optional"})`;
+}
+/** `cockpit agreements show`: the exact text, the boxes, and the record once signed, or where to sign while open. */
+export function agreementLines(agreement, dashboardUrl) {
+    const lines = [
+        `${agreement.document_title} (${agreement.version_label})`,
+        `Status: ${STATUS_WORDS[agreement.status] ?? agreement.status}${agreement.status === "open" && agreement.due_at ? `, due ${agreement.due_at.slice(0, 10)}` : ""}`,
+        `Published ${agreement.published_at}. Text fingerprint (SHA-256): ${agreement.text_sha256}`,
+        "",
+        agreement.body,
+        "",
+    ];
+    const signature = agreement.signature;
+    if (agreement.consent_boxes.length > 0) {
+        lines.push("Boxes:", ...agreement.consent_boxes.map((box) => boxLine(box, signature?.consents[box.key] === true)), "");
+    }
+    if (signature) {
+        lines.push("Signing record:", `  Signed by: ${signature.typed_name}${signature.signer_email ? ` <${signature.signer_email}>` : ""}`, `  Signed at: ${signature.signed_at}`, `  Identified by: ${signature.identity_method === "tower_session+email_code" ? "Tower sign-in and a one-time code sent by email" : signature.identity_method}`, `  Event number in Tower's signing log: ${signature.event_seq}`, `Your copy: cockpit agreements copy ${agreement.request_id} --out <file>`);
+    }
+    else if (agreement.status === "open") {
+        lines.push(`Sign it in Tower in your browser: ${dashboardUrl}/agreements/${agreement.request_id}`);
+    }
+    else {
+        lines.push("This request was cancelled. Nothing was signed.");
+    }
+    return lines;
+}
+function flagWords(doc) {
+    const flags = [doc.needs_countersign ? "needs a countersignature" : "", doc.required_for_access ? "required for Tower access" : "", doc.needs_handwritten_confirmation ? "needs a handwritten confirmation" : ""].filter(Boolean);
+    return flags.length > 0 ? ` (${flags.join("; ")})` : "";
+}
+/** `cockpit agreements documents`: each document, its versions, and who was asked to sign each. */
+export function documentLines(doc) {
+    const lines = [`${doc.title} [${doc.slug}]${flagWords(doc)}`, `  document ${doc.document_id}`];
+    if (doc.versions.length === 0)
+        lines.push("  No versions yet.");
+    for (const version of doc.versions) {
+        const state = version.published_at ? `published ${version.published_at.slice(0, 10)}` : "draft, not published";
+        const boxes = version.consent_boxes.length === 0 ? "no boxes" : `${version.consent_boxes.length} box${version.consent_boxes.length === 1 ? "" : "es"}`;
+        lines.push(`  ${version.label} (${version.language}): ${state}, ${boxes}`, `    version ${version.version_id}`);
+        for (const asked of version.requests) {
+            const who = asked.signer_name ?? asked.signer_user_id;
+            const due = asked.status === "open" && asked.due_at ? `, due ${asked.due_at.slice(0, 10)}` : "";
+            lines.push(`    - ${who}: ${asked.status}${due} (request ${asked.request_id})`);
+        }
+    }
+    return lines;
+}

package/dist/commands/agreements.js

@@ -0,0 +1,196 @@
+/**
+ * `cockpit agreements` (docs/architecture/agreements.md): agreements to sign, from the terminal.
+ *
+ * Plain words: a founder publishes a document as a fixed version and asks named people to sign it. Each person reads it
+ * and signs in Tower in their browser; this command reads their own requests and the signed copy, and lets a founder
+ * draft a document, ask someone to sign a published version, or cancel a request.
+ *
+ * Seven verbs, each one `/api/agreements` door on this machine's device token, the same doors the web page, the MCP
+ * twins (`agreements_*`) and JARVIS use. The door's own words are printed; `--json` carries the raw body on stdout and
+ * nothing else. A draft arrives as JSON on stdin. There is deliberately no verb to ask for a signing code, to sign, or
+ * to publish: those are a person's own act in the browser, and their doors refuse a device token (founders, 2026-10-28).
+ */
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { askAgentDoor, emitAgentDoor, failAgentDoor, fetchAgentDoorFile, openAgentDoor } from "./agent-door.js";
+import { agreementLines, documentLines, rowLines } from "./agreements-render.js";
+import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
+const TAG = "[agreements cli]";
+const READ_DEADLINE_MS = 30_000;
+const WRITE_DEADLINE_MS = 55_000;
+/** A document's text is at most 200,000 characters (`MAX_BODY_CHARS`); the boxes and names ride on top. */
+const DRAFT_MAX_CHARS = 300_000;
+export async function runAgreements(command, io) {
+    let door;
+    try {
+        door = await openAgentDoor("agreements", command, io);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : "this machine is not paired with Tower";
+        writeLine(io.stderr, `${TAG} refused ${JSON.stringify({ reason: "not_paired" })}`);
+        if (command.json)
+            writeLine(io.stdout, JSON.stringify({ ok: false, error: "not_paired", detail }));
+        else
+            writeLine(io.stderr, detail);
+        return 1;
+    }
+    switch (command.action) {
+        case "list": return list(door);
+        case "show": return show(command, door);
+        case "copy": return copy(command, door);
+        case "documents": return documents(door);
+        case "draft": return draft(door);
+        case "request": return request(command, door);
+        case "cancel": return cancel(command, door);
+    }
+}
+async function list(door) {
+    const answer = await askAgentDoor(door, { path: "/api/agreements", method: "GET", label: "agreements list", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    const open = body.agreements.filter((row) => row.status === "open").length;
+    writeLine(door.io.stderr, `${TAG} list answered ${JSON.stringify({ returned: body.agreements.length, open })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    const out = door.io.stdout;
+    if (body.agreements.length === 0) {
+        writeLine(out, "Nothing to sign, and nothing signed yet.");
+        return 0;
+    }
+    writeLine(out, open === 0 ? "Nothing is waiting for your signature." : `${open} waiting for your signature.`);
+    for (const row of body.agreements) {
+        writeLine(out, "");
+        for (const line of rowLines(row))
+            writeLine(out, line);
+    }
+    return 0;
+}
+async function show(command, door) {
+    const id = command.requestId ?? "";
+    const answer = await askAgentDoor(door, { path: `/api/agreements/${encodeURIComponent(id)}`, method: "GET", label: "agreements show", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(door.io.stderr, `${TAG} show answered ${JSON.stringify({ request_id: body.agreement.request_id, status: body.agreement.status, boxes: body.agreement.consent_boxes.length })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    for (const line of agreementLines(body.agreement, door.dashboardUrl))
+        writeLine(door.io.stdout, line);
+    return 0;
+}
+/** The signed copy, as the door wrote it: to `--out`, or on stdout. Only a signed agreement has one. */
+async function copy(command, door) {
+    const id = command.requestId ?? "";
+    const answer = await fetchAgentDoorFile(door, { path: `/api/agreements/${encodeURIComponent(id)}/copy`, label: "agreements copy", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const text = answer.bytes.toString("utf8");
+    if (!command.outPath) {
+        writeLine(door.io.stderr, `${TAG} copy answered ${JSON.stringify({ request_id: id, bytes: answer.bytes.length, written: false })}`);
+        if (door.json)
+            return emitAgentDoor(door, { ok: true, request_id: id, filename: answer.filename, text });
+        door.io.stdout.write(text);
+        return 0;
+    }
+    const target = path.resolve(command.outPath);
+    try {
+        await mkdir(path.dirname(target), { recursive: true });
+        await writeFile(target, answer.bytes);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return failAgentDoor(door, TAG, "copy_write_failed", `Could not write ${target}: ${detail}`);
+    }
+    writeLine(door.io.stderr, `${TAG} copy answered ${JSON.stringify({ request_id: id, bytes: answer.bytes.length, written: true })}`);
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, request_id: id, path: target, bytes: answer.bytes.length });
+    writeLine(door.io.stdout, `Saved your signed copy: ${target}`);
+    return 0;
+}
+async function documents(door) {
+    const answer = await askAgentDoor(door, { path: "/api/agreements/documents", method: "GET", label: "agreements documents", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(door.io.stderr, `${TAG} documents answered ${JSON.stringify({ documents: body.documents.length, versions: body.documents.reduce((sum, doc) => sum + doc.versions.length, 0) })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    if (body.documents.length === 0) {
+        writeLine(door.io.stdout, "No documents yet. Draft one with `cockpit agreements draft` (the JSON on stdin).");
+        return 0;
+    }
+    for (const doc of body.documents) {
+        for (const line of documentLines(doc))
+            writeLine(door.io.stdout, line);
+        writeLine(door.io.stdout, "");
+    }
+    return 0;
+}
+async function draft(door) {
+    const piped = await readJsonObject(door);
+    if (!piped.ok)
+        return failAgentDoor(door, TAG, piped.reason, piped.detail);
+    const answer = await askAgentDoor(door, { path: "/api/agreements/documents", method: "POST", label: "agreements draft", timeoutMs: WRITE_DEADLINE_MS, body: piped.value });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(door.io.stderr, `${TAG} draft saved ${JSON.stringify({ document_id: body.document_id, version_id: body.version_id })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    const out = door.io.stdout;
+    writeLine(out, "Saved the draft. Nobody can sign it until a founder publishes it.");
+    writeLine(out, `  document ${body.document_id}`);
+    writeLine(out, `  version  ${body.version_id}`);
+    writeLine(out, "Publishing is done in Tower in your browser, where a founder reads the text and confirms it.");
+    return 0;
+}
+async function request(command, door) {
+    const requestBody = { version_id: command.versionId, signer_user_id: command.personId, ...(command.dueAt ? { due_at: command.dueAt } : {}) };
+    const answer = await askAgentDoor(door, { path: "/api/agreements/requests", method: "POST", label: "agreements request", timeoutMs: WRITE_DEADLINE_MS, body: requestBody });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(door.io.stderr, `${TAG} request created ${JSON.stringify({ request_id: body.request_id, due: Boolean(command.dueAt) })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    writeLine(door.io.stdout, body.message ?? "Asked.");
+    writeLine(door.io.stdout, `  request ${body.request_id}`);
+    return 0;
+}
+async function cancel(command, door) {
+    const id = command.requestId ?? "";
+    const answer = await askAgentDoor(door, { path: `/api/agreements/requests/${encodeURIComponent(id)}/cancel`, method: "POST", label: "agreements cancel", timeoutMs: WRITE_DEADLINE_MS, body: {} });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const body = answer.body;
+    writeLine(door.io.stderr, `${TAG} cancelled ${JSON.stringify({ request_id: body.request_id })}`);
+    if (door.json)
+        return emitAgentDoor(door, answer.body);
+    writeLine(door.io.stdout, body.message ?? "Request cancelled.");
+    return 0;
+}
+/** A JSON object from stdin. A document's text never travels on the command line, and a terminal is refused instead of waited on. */
+async function readJsonObject(door) {
+    if (isInteractiveStdin(door.io)) {
+        return { ok: false, reason: "nothing_piped", detail: "Pipe the draft in as JSON, e.g. `cockpit agreements draft < draft.json`. Nothing was saved." };
+    }
+    let text;
+    try {
+        text = await readPipedText(door.io.stdin, { maxChars: DRAFT_MAX_CHARS, overflowMessage: `The JSON on stdin is limited to ${DRAFT_MAX_CHARS} characters.` });
+    }
+    catch (error) {
+        return { ok: false, reason: "body_too_long", detail: error instanceof Error ? error.message : String(error) };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, reason: "invalid_json_body", detail: `stdin was not valid JSON (${text.length} characters read). Nothing was saved.` };
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return { ok: false, reason: "invalid_json_body", detail: "stdin must be one JSON object, like {\"slug\":\"...\",\"title\":\"...\",\"label\":\"v1\",\"body\":\"...\"}. Nothing was saved." };
+    }
+    return { ok: true, value: parsed };
+}

package/dist/commands/analyze.js

@@ -3,6 +3,7 @@ import { normalizeUrl } from "./local-args.js";
 import { runSync } from "./sync.js";
 import { describeError, isMissingFileFailure } from "../health-detail.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorSessionFile, } from "../local-state.js";
+import { collectorShelfHeaders } from "../shelf-headers.js";
 export async function runAnalyze(command, io) {
     const sync = await runAnalysisSync(command, io);
     if (sync.exitCode !== 0 || !isUploadedSyncResult(sync.output)) {
@@ -56,6 +57,7 @@ async function queueAnalysis(command, io, sync) {
         method: "POST",
         headers: {
             authorization: `Bearer ${session.device_token}`,
+            ...collectorShelfHeaders(),
             "content-type": "application/json",
         },
         body: "{}",