@bli-cockpit/cli 0.2.286 → 0.2.288

package/dist/commands/doctor-registration.js

@@ -2,6 +2,7 @@ import { inspectAgentRules, installAgentRules } from "../agent-rules.js";
 import { doctorRoots } from "./doctor-access.js";
 import { installAutostartAgent } from "../autostart.js";
 import { clearAutostartOptOut } from "../autostart-opt-out.js";
+import { isMemoryCaptureOff } from "../memory-capture-choice.js";
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { fail, needsFix, ok, skipped } from "./doctor-report.js";
 import { autostartDoctorStatus, autostartRegistrationRoots, readAutostartRegistration, } from "./autostart-reading.js";
@@ -73,10 +74,21 @@ export async function fixAutostartState(context) {
  * a hook failure, which is worse than waiting a day.
  */
 export async function checkMemoryState(context) {
+    if (await memoryOptedOut(context)) {
+        // BLI-22640: a dry run of the opted-out install writes nothing and says
+        // whether any of our entries (or `bli-tower`) still needs the fix.
+        const preview = await installMemoryIntegration({ ...memoryCommandFor(context), dryRun: true }, context.io);
+        return optedOutStepState(preview, "check");
+    }
     const outcome = await inspectMemoryIntegration(memoryCommandFor(context), context.io);
     return memoryStepState(outcome, "check");
 }
 export async function fixMemoryState(context) {
+    if (await memoryOptedOut(context)) {
+        // Never re-adds BLI Memory: the opted-out install only takes our entries
+        // back off and keeps `bli-tower`, which `mcp-answers`' repair relies on.
+        return optedOutStepState(await installMemoryIntegration(memoryCommandFor(context), context.io), "fix");
+    }
     let outcome = await installMemoryIntegration(memoryCommandFor(context), context.io);
     if (!outcome.bin_found) {
         // The public CLI declares the memory and Tower MCP packages as dependencies.
@@ -86,6 +98,33 @@ export async function fixMemoryState(context) {
     }
     return memoryStepState(outcome, "fix");
 }
+async function memoryOptedOut(context) {
+    return isMemoryCaptureOff(getCollectorRuntimePaths(context.command.homeDir), { fetch: context.io.fetch });
+}
+/**
+ * BLI-22640. The row on a machine whose owner turned BLI Memory off: never
+ * red for the absent registration (that is the choice), `skipped
+ * explicit_opt_out` once nothing of ours is left, and a fix only when an
+ * entry of ours is still on disk or `bli-tower` is missing.
+ */
+function optedOutStepState(outcome, phase) {
+    const failed = outcome.targets.find((target) => target.status === "failed");
+    if (failed) {
+        const message = `BLI Memory is off on this machine, but ${failed.target} could not be cleaned: ${failed.reason}`;
+        return phase === "fix"
+            ? fail("memory-registered", failed.reason, message)
+            : needsFix("memory-registered", failed.reason, message);
+    }
+    const leftover = outcome.removed_count ?? 0;
+    const towerPending = outcome.targets.some((target) => target.status === "would_install");
+    if (phase === "check" && (leftover > 0 || towerPending)) {
+        return needsFix("memory-registered", leftover > 0 ? "opted_out_entries_left" : "registration_incomplete", leftover > 0
+            ? `BLI Memory is off on this machine, but ${leftover} of its entries are still registered; doctor removes them`
+            : "BLI Memory is off on this machine; bli-tower is not registered yet");
+    }
+    const removed = phase === "fix" && leftover > 0 ? ` Removed ${leftover} of its entries.` : "";
+    return skipped("memory-registered", outcome.reason === "choice_unreadable" ? "choice_unreadable" : "explicit_opt_out", `BLI Memory is off on this machine (your choice); nothing of it is registered.${removed} \`cockpit memory on\` turns it back on.`);
+}
 function memoryCommandFor(context) {
     return {
         kind: "memory",

package/dist/commands/doctor-report.js

@@ -169,6 +169,7 @@ export function doctorNeedsPerson(rows, receipt) {
         "authed": "cockpit doctor",
         "roots-ok": "cockpit doctor",
         "roots-cover-work": "cockpit doctor",
+        "shelf-routing": "cockpit doctor",
         "single-install": "Run npm uninstall -g @bli-cockpit/cli with the Node installation that owns the extra CLI listed above.",
         "autostart-alive": "cockpit doctor",
         "usage-telemetry": "cockpit doctor",

package/dist/commands/doctor-shelf.js

@@ -0,0 +1,62 @@
+/**
+ * The `shelf-routing` doctor row (BLI-23478, three-shelves design 9.1 item 13).
+ *
+ * Reads what the last heartbeat stored about Tower's founder lock (`shelf-state.json`) and this laptop's default.
+ * On a founder's laptop, once Tower enforces the lock AND an owner has switched founder routing on, the repair sets
+ * `shelf_default: drawer`, so a founder's work outside every labelled folder stays on the laptop from then on. It
+ * never overrides a default the founder chose (`cockpit shelf default team`), and it never runs before Tower says
+ * the lock is on: labels and the default do nothing until both locks exist (design 4.1).
+ *
+ * Every other laptop: one `ok` line, nothing written.
+ */
+import os from "node:os";
+import { safeLog } from "@bli-cockpit/telemetry-core";
+import { ensureLocalCollectorConfig } from "../local-state.js";
+import { writeJsonFile } from "../local-state-files.js";
+import { readShelfState } from "../shelf-state.js";
+import { askFounderLive } from "../shelf-decision.js";
+import { configForDisk } from "../source-opt-out.js";
+import { needsFix, ok, skipped } from "./doctor-report.js";
+const ID = "shelf-routing";
+/**
+ * Whether this laptop's founder should have the drawer default now. Shared with the usage-telemetry row. The
+ * switch's state comes from the saved heartbeat answer; WHO is a founder is Tower's live answer, never the saved
+ * copy (`shelf-decision.ts`): a forged `is_owner` in the file changes nothing here.
+ */
+export async function founderRoutingOn(homeDir, fetchImpl) {
+    const state = readShelfState(homeDir);
+    if (!state?.shelf_enforced || state.founder_routing_enabled !== true)
+        return false;
+    return (await askFounderLive({ homeDir, fetchImpl })).standing === "founder";
+}
+export async function checkShelfRouting(context) {
+    const homeDir = context.command.homeDir ?? os.homedir();
+    const state = readShelfState(homeDir);
+    if (!state)
+        return skipped(ID, "not_enforced", "shelf routing: Tower has not answered this laptop yet; nothing changes until it does");
+    if (state.is_owner !== true)
+        return ok(ID, "enforced", "shelf routing: not a founder's laptop; nothing changes here");
+    if (state.cli_too_old) {
+        return { ...needsFix(ID, "cli_too_old", "shelf routing: this CLI is older than Tower's founder lock accepts; run `cockpit update`"), nextAction: "cockpit update" };
+    }
+    if (state.founder_routing_enabled !== true || !state.shelf_enforced) {
+        return ok(ID, "routing_disabled_by_owner", "shelf routing: founder routing is off in Tower; labels wait until an owner switches it on");
+    }
+    const config = await ensureLocalCollectorConfig({ homeDir }).then((result) => result.config).catch(() => null);
+    if (config?.shelf_default === "drawer")
+        return ok(ID, "drawer_default_set", "shelf routing: on; work outside team-labelled folders stays in the drawer on this laptop");
+    if (config?.shelf_default === "team")
+        return ok(ID, "team_default_chosen", "shelf routing: on; you chose team as the default (`cockpit shelf default drawer` to change it)");
+    return needsFix(ID, "drawer_default_missing", "shelf routing: on, but this laptop has no default yet; doctor sets it to drawer");
+}
+export async function fixShelfRouting(context) {
+    const homeDir = context.command.homeDir ?? os.homedir();
+    if (!(await founderRoutingOn(homeDir, context.io.fetch)))
+        return checkShelfRouting(context);
+    const { config, paths } = await ensureLocalCollectorConfig({ homeDir });
+    if (config.shelf_default)
+        return checkShelfRouting(context);
+    await writeJsonFile(paths.config_file, configForDisk({ ...config, shelf_default: "drawer" }));
+    safeLog("shelf", "drawer_default_set", { by: "doctor" });
+    return { ...ok(ID, "drawer_default_set", "shelf routing: on; work outside team-labelled folders now stays in the drawer on this laptop"), fixed: true };
+}

package/dist/commands/doctor-update.js

@@ -78,6 +78,8 @@ export function reexecDoctor(command, io) {
     const args = ["doctor"];
     if (command.noUsageTelemetry)
         args.push("--no-usage-telemetry");
+    if (command.noMemory)
+        args.push("--no-memory");
     if (command.homeDir)
         args.push("--home", command.homeDir);
     if (command.backfillBudgetSeconds)

package/dist/commands/doctor-usage-telemetry.js

@@ -1,6 +1,7 @@
 import os from "node:os";
 import path from "node:path";
-import { getCollectorRuntimePaths, readLocalCollectorSessionFile } from "../local-state.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile } from "../local-state.js";
+import { founderRoutingOn } from "./doctor-shelf.js";
 import { claudeSettingsFile } from "./memory-install-claude.js";
 import { codexConfigFile } from "./tower-mcp-codex.js";
 import { defaultMemoryFileIo } from "./memory-install-files.js";
@@ -83,7 +84,7 @@ async function usageTelemetryStep(context, checkOnly) {
         if (!session?.device_token)
             return needsFix("usage-telemetry", "device_token_missing", "usage telemetry: needs Tower sign-in");
         const result = await configureUsageTelemetry({ homeDir: home, origin: context.command.dashboardUrl, token: session.device_token,
-            optOut: context.command.noUsageTelemetry, checkOnly, io: defaultMemoryFileIo({ mode: 0o600 }) });
+            optOut: context.command.noUsageTelemetry || (await founderWithholdsModels(home, context.io.fetch)), checkOnly, io: defaultMemoryFileIo({ mode: 0o600 }) });
         const message = result.off ? "usage telemetry: off (explicit opt-out)" : "usage telemetry: on (claude code, codex)";
         return checkOnly && result.changed ? needsFix("usage-telemetry", "settings_differ", message) : ok("usage-telemetry", result.off ? "explicit_opt_out" : "already_current", message);
     }
@@ -93,5 +94,20 @@ async function usageTelemetryStep(context, checkOnly) {
         return fail("usage-telemetry", reason, "usage telemetry: settings could not be safely merged");
     }
 }
+/**
+ * BLI-23478 (three shelves, design 3.2 category C): usage telemetry names the model and tool of every session, so
+ * on a founder's laptop, once founder routing is on, it is opted out unless the founder allowed `model` with
+ * `cockpit shelf metrics --allow`. The opt-out persists like any other (the marker), so allowing `model` later
+ * needs the marker removed by hand: deliberate, since turning a channel back on is a person's call.
+ */
+async function founderWithholdsModels(homeDir, fetchImpl) {
+    if (!(await founderRoutingOn(homeDir, fetchImpl)))
+        return false;
+    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(homeDir)).catch(() => null);
+    const withheld = !(config?.shelf_metrics_allow ?? []).includes("model");
+    if (withheld)
+        console.error("[usage telemetry] founder opt-out", JSON.stringify({ reason: "shelf_model_category_off" }));
+    return withheld;
+}
 export const checkUsageTelemetry = (context) => usageTelemetryStep(context, true);
 export const fixUsageTelemetry = (context) => usageTelemetryStep(context, false);

package/dist/commands/doctor.js

@@ -1,5 +1,8 @@
 import { checkSlackConnected } from "./doctor-slack.js";
 import { checkUsageTelemetry, fixUsageTelemetry } from "./doctor-usage-telemetry.js";
+import { settleDoctorMemoryChoice } from "./memory-capture-prompt.js";
+import { reportIgnoredOptOuts } from "../capture-opt-outs.js";
+import { checkShelfRouting, fixShelfRouting } from "./doctor-shelf.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION } from "../local-state.js";
 import { withCommandGuard } from "../command-guard.js";
 import { installHttp1GlobalFetch } from "../http1-fetch.js";
@@ -31,6 +34,10 @@ export async function runDoctorWithDeps(command, io, deps) {
     const deadlineMs = doctorRunDeadline(command, runStarted);
     const context = { command, io, deps, deadlineMs };
     console.error("[doctor] run started", JSON.stringify({ json: command.json, check_only: Boolean(command.dryRun || command.checkOnly), budget_seconds: deadlineMs === null ? null : DOCTOR_JSON_BUDGET_SECONDS }));
+    // BLI-22640: `--no-memory`, or the one-time question, before any row reads the choice.
+    await settleDoctorMemoryChoice(command, io);
+    // Founders only: a non-founder's opt-outs are ignored, and doctor says so in one line.
+    await reportIgnoredOptOuts({ ...(command.homeDir ? { homeDir: command.homeDir } : {}), json: command.json }, io);
     const rows = [];
     const repairs = [];
     const diagnoseOnly = command.dryRun || command.checkOnly;
@@ -178,6 +185,8 @@ function doctorInvariants() {
         // no fix because a session outside an approved root is not a defect
         // doctor can repair; it names the counts and moves on.
         { id: "roots-cover-work", check: context => context.deps.readRootsCoverWork(context) },
+        // BLI-23478: a founder's drawer default once Tower's lock is on (`doctor-shelf.ts`); everyone else: one ok line.
+        { id: "shelf-routing", check: (c) => (c.deps.checkShelfRouting ?? checkShelfRouting)(c), fix: (c) => (c.deps.fixShelfRouting ?? fixShelfRouting)(c) },
         // Deliberately has NO fix: uninstalling software the operator did not ask
         // to have uninstalled is not a repair (BLI-3218/BLI-3553). Doctor names the
         // other install and the exact command; the person decides.

package/dist/commands/heartbeat-post.js

@@ -11,6 +11,10 @@ import { describeError } from "../health-detail.js";
 import { classifySyncHealthError } from "../sync-health-class.js";
 import { noteHeartbeatRefusal, recordHeartbeatPendingToken, recordHeartbeatTokenExpiry, TOKEN_ROTATION_HEADER, } from "./heartbeat-token.js";
 import { noteDoctorRequest } from "./sync-doctor-request.js";
+import { recordFounderStanding } from "../founder-standing-file.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { collectorShelfHeaders } from "../shelf-headers.js";
+import { recordShelfState } from "../shelf-state.js";
 const HEARTBEAT_TIMEOUT_MS = 5_000;
 export async function postHeartbeat(options, deviceToken, heartbeat, memory) {
     const controller = new AbortController();
@@ -21,6 +25,8 @@ export async function postHeartbeat(options, deviceToken, heartbeat, memory) {
             headers: {
                 "Content-Type": "application/json",
                 Authorization: `Bearer ${deviceToken}`,
+                // BLI-23478: the CLI release, so Tower records `cli_too_old` on an owner's old laptop.
+                ...collectorShelfHeaders(),
                 // BLI-17994. "I store a renewed token if you send one": the dashboard
                 // only rotates for a collector that says so.
                 [TOKEN_ROTATION_HEADER]: "1",
@@ -84,6 +90,19 @@ async function recordAcceptedHeartbeat(options, response, heartbeat, memory) {
     // door reports, which moves only when this request promoted a token.
     await recordHeartbeatPendingToken(options.homeDir, reply);
     await recordHeartbeatTokenExpiry(options.homeDir, response);
+    // BLI-22640: Tower's answer to "is this machine's person a founder?", kept
+    // for DISPLAY (doctor, support). No decision reads this file: every reader
+    // that decides what leaves the machine asks Tower live. Only a Tower reply
+    // writes it. A reply that could not read the owners list says null, and the
+    // last displayed answer stands.
+    if (typeof reply?.["is_owner"] === "boolean") {
+        await recordFounderStanding(getCollectorRuntimePaths(options.homeDir), reply["is_owner"], "heartbeat");
+    }
+    else {
+        console.error("[heartbeat] no founder answer in this reply; the last one stands", JSON.stringify({ reason: "is_owner_absent" }));
+    }
+    // BLI-23478 (three shelves): what the lock is for this laptop's person, for the hooks, the MCP server and doctor.
+    await recordShelfState(options.homeDir, reply);
     console.error("[heartbeat] checked in", JSON.stringify({
         reason: "heartbeat_recorded",
         http_status: response.status,

package/dist/commands/heartbeat.js

@@ -24,7 +24,7 @@ import { collectAgentSetup } from "./agent-setup.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { COLLECTOR_HEARTBEAT_SCHEMA_VERSION, MemoryInstallReceiptSchema, setupReceiptGaps, } from "@bli-cockpit/telemetry-core";
+import { COLLECTOR_HEARTBEAT_MAX_ROOTS, COLLECTOR_HEARTBEAT_SCHEMA_VERSION, MemoryInstallReceiptSchema, setupReceiptGaps, } from "@bli-cockpit/telemetry-core";
 import { readCachedSetupReceipt } from "./setup-receipt.js";
 import { readStagingInventory } from "../disk-usage.js";
 import { readStagingGate } from "../staging-gate.js";
@@ -32,6 +32,8 @@ import { describeError } from "../health-detail.js";
 import { shouldSuppressFleetReceipts, } from "../dev-build.js";
 import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, } from "../local-state.js";
 import { postHeartbeat } from "./heartbeat-post.js";
+import { readCaptureOptOuts } from "../capture-opt-outs.js";
+import { teamRootsForHeartbeat } from "../shelf-state.js";
 import { readHeartbeatSession } from "./heartbeat-token.js";
 import { withTokenRotationLock } from "./heartbeat-token-lock.js";
 import { readMemoryReceiptFile } from "./memory-install-receipt.js";
@@ -103,6 +105,9 @@ export function buildCollectorHeartbeat(options) {
         collector_version: options.collectorVersion ?? LOCAL_COLLECTOR_VERSION,
         os_platform: platform,
         roots: collectionRootLabels(options.roots, platform),
+        ...(options.shelvedRoots
+            ? { shelved_roots: Array.from({ length: Math.min(options.shelvedRoots, COLLECTOR_HEARTBEAT_MAX_ROOTS) }, () => ({ shelf: "drawer" })) }
+            : {}),
         last_sync_status: options.facts.status,
         ...(options.facts.outsideRootDirectories ? { outside_root_directories: options.facts.outsideRootDirectories } : {}),
         ...(options.facts.reason ? { last_sync_reason: options.facts.reason } : {}),
@@ -118,6 +123,7 @@ export function buildCollectorHeartbeat(options) {
         ...(typeof options.facts.sessionsPendingUpload === "number"
             ? { sessions_pending_upload: options.facts.sessionsPendingUpload }
             : {}),
+        ...(options.facts.collectionScope ? { collection_scope: options.facts.collectionScope } : {}),
         ...(typeof options.facts.stagingUncommittedBytes === "number"
             ? { staging_uncommitted_bytes: options.facts.stagingUncommittedBytes }
             : {}),
@@ -127,6 +133,7 @@ export function buildCollectorHeartbeat(options) {
         ...(options.facts.disk ? { disk: options.facts.disk } : {}),
         ...(options.memoryInstall ? { memory_install: options.memoryInstall } : {}),
         ...(options.setupReceipt ? { setup_receipt: options.setupReceipt } : {}),
+        ...(options.captureOptOuts ? { capture_opt_outs: options.captureOptOuts } : {}),
     };
 }
 /**
@@ -280,9 +287,13 @@ async function sendCollectorHeartbeatLocked(options) {
     }).catch(() => ({ receipt: null, reason: "receipt_read_threw" }));
     const setupReceipt = await readCachedSetupReceipt(options.homeDir, options.now ?? new Date());
     logSetupReceiptCarried(setupReceipt);
+    // BLI-23478: a drawer-labelled folder's name and path hash never travel; only its shelf, counted.
+    const shelfRoots = await teamRootsForHeartbeat(options.roots, options.homeDir, options.io.fetch);
     const heartbeat = buildCollectorHeartbeat({
-        roots: options.roots,
+        roots: shelfRoots.team,
+        shelvedRoots: shelfRoots.shelved,
         facts: options.facts,
+        captureOptOuts: await readCaptureOptOuts(options.homeDir),
         setupReceipt: setupReceipt ? { ...setupReceipt, agent_setup: await collectAgentSetup(options.homeDir ?? os.homedir()) } : null,
         ...(options.now ? { now: options.now } : {}),
         memoryInstall: memory.receipt,

package/dist/commands/install-receipts.js

@@ -144,6 +144,9 @@ async function deliverPendingInstallEvents(options, paths, deviceToken) {
             if (receipt.imageHandlingMode !== undefined && options.observed) {
                 options.observed.imageHandlingMode = receipt.imageHandlingMode;
             }
+            if (receipt.collectionScope !== undefined && options.observed) {
+                options.observed.collectionScope = receipt.collectionScope;
+            }
             delivered += 1;
         })));
     }
@@ -215,6 +218,7 @@ async function readReceiptReply(response) {
             ? receipt.min_cli_version.trim()
             : null,
         imageHandlingMode: receipt?.image_handling_mode,
+        collectionScope: receipt?.collection_scope,
     };
 }
 async function keepFailedInstallEventEntry(paths, entry, error, failures) {

package/dist/commands/local-args-collector-setup.js

@@ -95,6 +95,7 @@ const DOCTOR_ALLOWED_FLAGS = [
     "--check",
     "--no-repair",
     "--no-usage-telemetry",
+    "--no-memory",
     "--lock-wait",
     "--backfill-budget",
     "--json",
@@ -141,6 +142,7 @@ export function parseDoctorArgs(alias, args) {
     return {
         kind: "doctor",
         noUsageTelemetry: values.booleans.has("--no-usage-telemetry"),
+        noMemory: values.booleans.has("--no-memory"),
         checkOnly: values.booleans.has("--check") || values.booleans.has("--no-repair"),
         // Absent stays absent (BLI-11101): `doctor-budget.ts` owns the defaults,
         // and `--json` without either flag runs under one bounded budget.

package/dist/commands/local-args-collector-status.js

@@ -168,23 +168,9 @@ export function parseAgentRulesArgs(args) {
         json: values.booleans.has("--json"),
     };
 }
-/**
- * BLI-3580, amended by BLI-4047.
- *
- * `cockpit memory` is now SIX verbs behind one noun: the two that configure
- * this machine (`install`, `status`), the experience log (`log`), and the four
- * that read and write the memory store itself (`search`, `save`, `update`,
- * `forget`, parsed next door in `local-args-tower-memory.ts`).
- *
- * **A bare `cockpit memory` prints the verb list; it no longer installs.**
- * BLI-3580 made `install` the default because the command is run unasked by
- * `doctor` and by the sync tick, but those callers build
- * `{ kind: "memory", action: "install" }` in code (`doctor-registration.ts`,
- * `sync-followups-memory.ts`, `onboard-completion.ts`) and never pass through
- * this parser. The only caller the default ever served was a PERSON typing the
- * noun to find out what it does, and what they got was an MCP server and three
- * hooks registered on their machine. Installing stays one word away.
- */
+const MEMORY_MACHINE_ACTIONS = new Set([
+    "install", "uninstall", "on", "off", "status", "help",
+]);
 export function parseMemoryArgs(args) {
     // The verb word first, always: reading it off `args[0]` rather than "the
     // first token without a leading dash" is what keeps `cockpit memory --home
@@ -214,16 +200,16 @@ export function parseMemoryArgs(args) {
     if (values.flags.has("--store") || values.booleans.has("--reason-stdin"))
         throw new Error("--store and --reason-stdin require memory log");
     if (values.positionals.length > 1) {
-        throw new Error("memory accepts at most one action (install|status).");
+        throw new Error("memory accepts at most one action (on|off|install|uninstall|status).");
     }
     // BLI-4047: no positional means "tell me what this noun does", not "install".
     const action = values.positionals[0] ?? "help";
-    if (action !== "install" && action !== "status" && action !== "help") {
-        throw new Error("memory action must be install, status, help, log, search, save, update, or forget.");
+    if (!MEMORY_MACHINE_ACTIONS.has(action)) {
+        throw new Error("memory action must be on, off, install, uninstall, status, help, log, search, save, update, or forget.");
     }
     return {
         kind: "memory",
-        action,
+        action: action,
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
         dryRun: values.booleans.has("--dry-run"),

package/dist/commands/local-args-tower-agreements.js

@@ -0,0 +1,80 @@
+/**
+ * `cockpit agreements` argument parsing (docs/architecture/agreements.md).
+ *
+ *   cockpit agreements [list]                                   your own requests to sign: open, signed, cancelled
+ *   cockpit agreements show <request-id>                        the text, its boxes, and the record once signed
+ *   cockpit agreements copy <request-id> [--out <file>]         your signed copy as plain text
+ *   cockpit agreements documents                                founders: every document, its versions and who was asked
+ *   cockpit agreements draft                                    founders: save a draft (the DraftInput JSON on stdin)
+ *   cockpit agreements request --version <id> --person <user-id> [--due <date>]    founders: ask a person to sign
+ *   cockpit agreements cancel <request-id>                      founders: withdraw a request that is not signed
+ *
+ * Every verb is one `/api/agreements` door on this machine's device token, the same doors the web page, the MCP twins
+ * and JARVIS use. Asking for a signing code, signing and publishing have no verb: they are a person's own act in the
+ * browser, and those doors refuse a device token.
+ */
+import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+const ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const ID_EXAMPLE = "8f14e45f-ceea-467a-9575-1d3a4e7b2c10";
+const ONE_VERB = "agreements takes one verb: list, show, copy, documents, draft, request or cancel. Example: `cockpit agreements` or `cockpit agreements show <request-id>`.";
+/** Which flags each verb owns, so a flag on the wrong verb is refused by name rather than ignored. */
+const FLAGS_BY_ACTION = {
+    list: [],
+    show: [],
+    copy: ["--out"],
+    documents: [],
+    draft: [],
+    request: ["--version", "--person", "--due"],
+    cancel: [],
+};
+const OWN_FLAGS = ["--out", "--version", "--person", "--due"];
+const COMMON_FLAGS = ["--home", "--dashboard-url", "--json"];
+const NEEDS_REQUEST_ID = ["show", "copy", "cancel"];
+export function parseAgreementsArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: [...OWN_FLAGS, ...COMMON_FLAGS],
+        valueFlags: [...OWN_FLAGS, "--home", "--dashboard-url"],
+    });
+    const first = values.positionals[0];
+    if (first !== undefined && !Object.keys(FLAGS_BY_ACTION).includes(first))
+        throw new Error(ONE_VERB);
+    const action = (first ?? "list");
+    const given = [...values.flags.keys()].filter((flag) => OWN_FLAGS.includes(flag));
+    const owned = FLAGS_BY_ACTION[action];
+    const stray = given.find((flag) => !owned.includes(flag));
+    if (stray)
+        throw new Error(`${stray} does not belong to \`cockpit agreements ${action}\`.`);
+    const rest = values.positionals.slice(first === undefined ? 0 : 1);
+    const needsId = NEEDS_REQUEST_ID.includes(action);
+    if (needsId ? rest.length !== 1 : rest.length > 0) {
+        throw new Error(needsId ? `\`cockpit agreements ${action}\` takes exactly one request id.` : `\`cockpit agreements ${action}\` takes no positional arguments.`);
+    }
+    const requestId = needsId ? rest[0] : undefined;
+    if (requestId !== undefined && !ID.test(requestId))
+        throw new Error(`A request id looks like ${ID_EXAMPLE} (\`cockpit agreements\` lists yours).`);
+    const versionId = optionalNonEmpty(values.flags.get("--version"));
+    const personId = optionalNonEmpty(values.flags.get("--person"));
+    const dueAt = optionalNonEmpty(values.flags.get("--due"));
+    if (action === "request") {
+        if (!versionId || !personId)
+            throw new Error("`cockpit agreements request` needs --version <version-id> and --person <user-id> (`cockpit agreements documents` lists both).");
+        if (!ID.test(versionId))
+            throw new Error(`--version looks like ${ID_EXAMPLE} (\`cockpit agreements documents\` lists the versions).`);
+        if (!ID.test(personId))
+            throw new Error(`--person is a user id like ${ID_EXAMPLE} (\`cockpit team members\` lists them).`);
+        if (dueAt !== undefined && Number.isNaN(Date.parse(dueAt)))
+            throw new Error("--due wants a date, like 2026-11-15.");
+    }
+    return {
+        kind: "agreements",
+        action,
+        ...(requestId ? { requestId } : {}),
+        ...(optionalNonEmpty(values.flags.get("--out")) ? { outPath: optionalNonEmpty(values.flags.get("--out")) } : {}),
+        ...(versionId ? { versionId } : {}),
+        ...(personId ? { personId } : {}),
+        ...(dueAt ? { dueAt } : {}),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        json: values.booleans.has("--json"),
+    };
+}

package/dist/commands/local-args-tower-docs-msg.js

@@ -47,6 +47,7 @@ const DOCS_ALLOWED_FLAGS = [
     "--out",
     "--add",
     "--remove",
+    "--role",
     "--reason",
     "--cursor",
     "--before",
@@ -70,6 +71,7 @@ const DOCS_VALUE_FLAGS = [
     "--out",
     "--add",
     "--remove",
+    "--role",
     "--reason",
     "--cursor",
     "--before",
@@ -296,24 +298,34 @@ function parseDocsReadFlags(action, values) {
     return { query, wholeWord, limit, bodies, section, offset };
 }
 /**
- * BLI-21313: `docs share <doc> --add <email> | --remove <email> [--reason <text>]` names or removes a page editor;
- * `docs access <doc>` reads who may edit and why. A person is an exact email address, never a fuzzy name.
+ * BLI-21313, BLI-23558: `docs share <doc> --add <email> [--role viewer|editor] | --remove <email> [--reason <text>]` names
+ * or removes a person on a page (a private page too); `docs access <doc>` reads who may read and edit and why. A person
+ * is an exact email address, never a fuzzy name. `--role` is for `--add` only; absent means editor (what share did
+ * before viewers existed).
  */
 function parseDocsShareFlags(action, values) {
     const addPerson = optionalNonEmpty(values.flags.get("--add"));
     const removePerson = optionalNonEmpty(values.flags.get("--remove"));
+    const role = optionalNonEmpty(values.flags.get("--role"));
     const reason = optionalNonEmpty(values.flags.get("--reason"));
-    if ((addPerson || removePerson || reason) && action !== "share") {
-        throw new Error("--add, --remove and --reason belong to `cockpit docs share`.");
+    if ((addPerson || removePerson || reason || role) && action !== "share") {
+        throw new Error("--add, --remove, --role and --reason belong to `cockpit docs share`.");
     }
+    if (role !== undefined && role !== "viewer" && role !== "editor")
+        throw new Error('docs share --role must be "viewer" or "editor".');
     if (action === "share") {
         if (Boolean(addPerson) === Boolean(removePerson)) {
             throw new Error("docs share needs exactly one of --add <email> or --remove <email>.");
         }
+        if (role && !addPerson)
+            throw new Error("--role goes with --add; --remove takes the person off whatever role they hold.");
         if (reason && reason.length > 200)
             throw new Error("--reason can be at most 200 characters.");
     }
-    return { ...(addPerson ? { addPerson } : {}), ...(removePerson ? { removePerson } : {}), ...(reason ? { reason } : {}) };
+    return {
+        ...(addPerson ? { addPerson } : {}), ...(removePerson ? { removePerson } : {}),
+        ...(role ? { shareRole: role } : {}), ...(reason ? { reason } : {}),
+    };
 }
 /**
  * BLI-21413: `docs trash [--cursor C] [--limit N]`, `docs versions <doc> [--before N] [--limit N] [--version V]`,

package/dist/commands/local-args-tower.js

@@ -50,11 +50,13 @@ export { parseWhoArgs } from "./local-args-tower-who.js";
 export { parsePeopleArgs } from "./local-args-tower-people.js";
 export { parseApprovalsArgs } from "./local-args-tower-approvals.js";
 export { parseDrillsArgs } from "./local-args-tower-drills.js";
+export { parseAgreementsArgs } from "./local-args-tower-agreements.js";
 export { parseManagerArgs } from "./local-args-tower-manager.js";
 export { parseImageArgs } from "./local-args-tower-image.js";
 export { parseCareersArgs } from './local-args-tower-careers.js';
 export { parseRenameArgs } from './local-args-tower-rename.js';
 export { parseGlossaryArgs } from "./glossary.js";
+export { parseBooksArgs } from "./books.js";
 export { parseSkillsArgs } from "./skills.js";
 export { parseSpendArgs } from "./spend.js";
 export { parsePushArgs } from "./push.js";

package/dist/commands/local-args.js

@@ -16,15 +16,17 @@
  * verbatim, no logic change.
  */
 import { parseGlossaryArgs } from "./glossary.js";
+import { parseBooksArgs } from "./books.js";
 import { parseSkillsArgs } from "./skills.js";
 import { parseSpendArgs } from "./spend.js";
 import { parsePushArgs } from "./push.js";
 import { parseRootsArgs } from "./roots.js";
+import { parseShelfArgs } from "./shelf.js";
 import { parseSlackPrivacyArgs } from "./slack-privacy-args.js";
 import { parseMilestoneArgs } from "./local-args-tower-milestone.js";
 import { SURFACE_ALIASES } from "./local-help.js";
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
-import { parseCiArgs, parseDeliveryArgs, parsePrOutputArgs, parseAiSpendArgs, parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseSetupArgs, parseSpeedArgs, parseLogsArgs, parseBrainArgs, parseHitsArgs, parseAiSkillsArgs, parseIntentionsArgs, parseWhoArgs, parsePeopleArgs, parseApprovalsArgs, parseDrillsArgs, parseManagerArgs, parseImageArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
+import { parseCiArgs, parseDeliveryArgs, parsePrOutputArgs, parseAiSpendArgs, parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseGithubArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseSetupArgs, parseSpeedArgs, parseLogsArgs, parseBrainArgs, parseHitsArgs, parseAiSkillsArgs, parseIntentionsArgs, parseWhoArgs, parsePeopleArgs, parseApprovalsArgs, parseDrillsArgs, parseAgreementsArgs, parseManagerArgs, parseImageArgs, parseCareersArgs, parseRenameArgs, } from "./local-args-tower.js";
 // `normalizeUrl` has always been part of this module's surface — `local.ts` and
 // `local-auth.ts` import it from here — so it stays exported from this address
 // even though it now lives next door. The same goes for the four names the
@@ -42,6 +44,7 @@ export { SCOUT_MIN_PREFIX_LENGTH, SLACK_WORKSPACE_KEYS, WORKBOOK_MIN_WIDTH, ISSU
  */
 const COMMAND_PARSERS = new Map([
     ["roots", (_command, rest) => parseRootsArgs(rest)],
+    ["shelf", (_command, rest) => parseShelfArgs(rest)],
     ["onboard", (_command, rest) => parseOnboardArgs(rest)],
     ["update", (command, rest) => parseUpdateArgs(command, rest)],
     ["upgrade", (command, rest) => parseUpdateArgs(command, rest)],
@@ -89,6 +92,7 @@ const COMMAND_PARSERS = new Map([
     ["clean", (_command, rest) => parseCleanArgs(rest)],
     ["sources", (_command, rest) => parseSourcesArgs(rest)],
     ["glossary", (_command, rest) => parseGlossaryArgs(rest)],
+    ["books", (_command, rest) => parseBooksArgs(rest)], // BLI-23711: Client Books
     ["skills", (_command, rest) => parseSkillsArgs(rest)], // BLI-23364 D: the Skill Library
     ["spend", (_command, rest) => parseSpendArgs(rest)],
     ["push", (_command, rest) => parsePushArgs(rest)],
@@ -116,6 +120,7 @@ const COMMAND_PARSERS = new Map([
     ["people", (_command, rest) => parsePeopleArgs(rest)],
     ["approvals", (_command, rest) => parseApprovalsArgs(rest)],
     ["drills", (_command, rest) => parseDrillsArgs(rest)],
+    ["agreements", (_command, rest) => parseAgreementsArgs(rest)],
     ["manager", (_command, rest) => parseManagerArgs(rest)],
     ["image", (_command, rest) => parseImageArgs(rest)],
 ]);

package/dist/commands/local-command-shapes-agreements.js

@@ -0,0 +1,5 @@
+/**
+ * `cockpit agreements` command shape (docs/architecture/agreements.md), beside `local-command-shapes-approvals.ts` for
+ * the same reason: `local-command-shapes.ts` sits at the readability ceiling.
+ */
+export {};

package/dist/commands/local-discovery.js

@@ -16,7 +16,7 @@
  * binding a ticket from a scratch folder to every approved root on the machine
  * is far wider than the operator asked for, so it keeps the old refusal.
  */
-import { resolveSourceSwitches } from "../source-opt-out.js";
+import { readSourceSwitches } from "../source-opt-out.js";
 import { writeLine } from "./cli-io.js";
 import { resolveDiscoveryLimits, saveDiscoveryLimits, } from "../discovery-limits.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
@@ -196,7 +196,7 @@ export async function scanWorkDirectories(homeDir, persist = true) {
         return null; throw error; });
     const now = new Date();
     const options = { worktrees: [], collectionRoots: config?.default_repo_paths ?? [], now, sinceMinutes: ROOT_WORK_SCAN_WINDOW_DAYS * 24 * 60, limit: Number.MAX_SAFE_INTEGER };
-    const switches = resolveSourceSwitches(config);
+    const switches = await readSourceSwitches(config, paths, "discovery");
     if (!switches.codex)
         console.error("[discovery] codex scan withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason }));
     const codex = switches.codex ? await scanAndAttributeCodexSessions({ ...options, sessionsDirs: defaultCodexSessionDirs(homeDir) }) : null;