@bli-cockpit/cli 0.2.286 → 0.2.288

package/dist/commands/local-help-agreements.js

@@ -0,0 +1,24 @@
+/** `cockpit agreements` help (docs/architecture/agreements.md), kept beside the parser in local-args-tower-agreements.ts. */
+export const AGREEMENTS_HELP = [
+    "agreements",
+    [
+        "Usage: cockpit agreements [list] [--dashboard-url <url>] [--json]",
+        "",
+        "  cockpit agreements show <request-id>                   the exact text, its boxes (required or optional), the status, and the record once signed",
+        "  cockpit agreements copy <request-id> [--out <file>]    your signed copy as plain text: the text, then the record. Signed agreements only",
+        "  cockpit agreements documents                           founders: every document, its versions, and who was asked to sign each",
+        "  cockpit agreements draft                               founders: save a draft; the POST /api/agreements/documents body as JSON on stdin",
+        "  cockpit agreements request --version <id> --person <user-id> [--due <date>]    founders: ask a person to sign a published version",
+        "  cockpit agreements cancel <request-id>                 founders: withdraw a request that is not signed",
+        "A founder publishes a document as a fixed version and asks named people to sign it. Your own requests are yours to read; only the founders read anyone else's.",
+        "Signing is done in Tower in your browser, never here: show prints the link. Asking for a signing code, signing and publishing a version have no CLI verb or MCP tool,",
+        "because an agent holding your token can often read your inbox and could fetch the code and sign, and a published version freezes text people will sign.",
+        "draft JSON: {slug, title, label, language?, body, consent_boxes: [{key, wording, required}], needs_countersign?, required_for_access?, needs_handwritten_confirmation?}",
+        "creates a document; {document_id, label, ...} adds a draft version to it; {version_id, label, ...} edits a draft that is not published.",
+        "--home <dir> and --dashboard-url <url> are for tests and staging.",
+        "--json writes one object to stdout (the door's body) and nothing else; a refusal is { ok: false, error, detail } and exits 1",
+        "(founders_only, not_found, not_open, not_published, already_asked, slug_taken, label_taken, already_published, invalid_input, not_paired, ...).",
+        "Teaching: docs/architecture/agreements.md. The bli-tower MCP server has the twins: agreements_list, agreements_show, agreements_copy, agreements_documents,",
+        "agreements_draft, agreements_request, agreements_cancel.",
+    ],
+];

package/dist/commands/local-help-commands-tower-ops.js

@@ -41,7 +41,7 @@ export const TOWER_OPS_COMMAND_HELP = [
             "project unknown_project, since_exceeds_retention, stored_read_failed, not_paired, ...",
             "--json writes one object to stdout: { ok, kind, source, window, lines, templates[], routine, notes, text, measure };",
             "a refusal is { ok: false, error, detail } and exits 1. Run list and teaching: docs/runbooks/tower-logs.md.",
-            "cockpit logs keys mint|rotate <source> [--json]: super admin only; prints the source ingest key once. Rotation invalidates the old key.",
+            "cockpit logs keys mint|rotate <source> [--json]: admin or developer only; prints the source ingest key once. Rotation invalidates the old key.",
             "cockpit logs search <project> [--since 30m|6h (default 1h) | --from <iso> [--to <iso>]] [--source gcp|supabase|vercel|railway|deploys|db-host|<label>] [--stream api|postgres|auth]",
             "    [--status 500|5xx|500-503] [--method GET] [--route <text>] [--severity error] [--q <text>] [--limit <n>] [--context] [--json]: owner or admin only.",
             "    Reads the project's RAW logs live (window at most 24h), scrubs every line, caps the answer (default 100, at most 200) and says \"capped at N of M\".",
@@ -75,7 +75,7 @@ export const TOWER_OPS_COMMAND_HELP = [
             "Retry: cockpit brain retry <id...> [--all-needs-human] [--project <p>] --reason <text> [--json]",
             "Ids are incident UUIDs or BLI issue identifiers. Retry reopens needs_human or not_actionable rows, resets attempts and claims,",
             "and records who, why and when. --all-needs-human selects only needs_human; --project narrows every selection. Other states are skipped.",
-            "Only members and super admins can retry. One comment is posted per incident issue. MCP twin: brain_retry.",
+            "Only team members (members, developers and owners) can retry. One comment is posted per incident issue. MCP twin: brain_retry.",
             "",
             "Ladder (BLI-19250, the Tower owner only): cockpit brain ladder show|promote <class> [--anyway] [--note <text>]|demote <class>|predict \"<question>\"|answer \"<reply>\" [--json]",
             "Before the brain or an agent asks you for a call it writes down what it predicts you will answer; your answer scores it. `show` lists",
@@ -403,7 +403,7 @@ export const TOWER_OPS_COMMAND_HELP = [
             "is `scout_board` on the bli-tower server, over the same GET /api/cockpit/scout door.",
             "--days <n> widens or narrows the window (1 to 90; the board defaults to 14).",
             "Reading follows the Scout page audience setting, so whoever can open /scout can run this.",
-            "start, dismiss, and undo move one card and are super_admin actions on every surface;",
+            "start, dismiss, and undo move one card and are admin or developer actions on every surface;",
             "a refusal is printed as Tower worded it and the board stays readable underneath.",
             "The id can be the first 6 or more characters printed beside each card; an ambiguous",
             "prefix is refused with the candidates rather than acting on the first match.",

package/dist/commands/local-help-commands-tower.js

@@ -20,6 +20,7 @@ import { DOCS_INBOX_HELP } from "./local-help-docs-inbox.js";
 import { DOCS_RECOVERY_HELP } from "./local-help-docs-recovery.js";
 import { PROJECT_HELP } from "./local-help-project.js";
 import { MILESTONE_HELP } from "./local-help-milestone.js";
+import { AGREEMENTS_HELP } from "./local-help-agreements.js";
 import { INBOX_HELP_LINES } from "./local-help-inbox.js";
 import { WORK_NOTIFY_HELP_LINES } from "./local-help-work-notify.js";
 import { VIEWS_HELP_LINES } from "./local-help-views.js";
@@ -76,14 +77,14 @@ export const TOWER_COMMAND_HELP = [
             "  --offset <n> --limit <n> — a character range of the body, instead of the whole thing.",
             "  --json shape: one ref answers { document }, unchanged from before BLI-10450. Several refs answer { documents: [{ ref, ok, document } | { ref, ok: false, error, detail }] }. The meta line (and --json document.revision) shows the page revision. Agent writes are never queued offline: a write that did not reach Tower fails with its reason, and `docs mutation-status <request-id>` tells whether it landed. Pass the revision you read as expected_revision.",
             "read --parent <id>|root --bodies [--limit <n>] — every document filed directly under that parent, bodies included, in ONE call (GET /api/docs/documents?parent_id=...&bodies=true). --limit here caps the DOCUMENT COUNT (1-50), not characters. --json shape: { documents: [{ id, ..., body_markdown }] }.",
-            "create --title \"<title>\" [--parent <id>] [--visibility org|private] [--file <path>|--body-stdin] — the body comes from --file, or stdin (`cat body.md | cockpit docs create --title \"...\"`); neither means an empty body, matching the browser's own default. --json shape: { document }.",
+            "create --title \"<title>\" [--parent <id>] [--visibility org|private] [--file <path>|--body-stdin] — the body comes from --file, or stdin (`cat body.md | cockpit docs create --title \"...\"`); neither means an empty body, matching the browser's own default. A new page is visible to everyone (org) unless you pass --visibility private; a page made with --parent starts with its parent's visibility and a copy of the parent's named people, and the parent's owner joins it as an editor (share it with `cockpit docs share`). --json shape: { document }.",
             "update <id|slug> [--title \"<t>\"] [--visibility org|private] [--parent <id>|--clear-parent] [--file <path>|--body-stdin] [--allow-empty] [--expected-revision <n>] [--request-id <uuid>] — only the fields you pass change; a `--parent` change IS a move, there is no separate move verb. --json shape: { document, mutation }.",
             "  --expected-revision <n> is the page revision you read (`docs read --json` shows document.revision). The save is one atomic step: if someone saved since, nothing is written and you get revision_conflict with the current page (--json: mutation.current). Omit it for an unconditional save. Every save advances the revision.",
             "  --request-id <uuid> makes a retry apply once (minted and printed when absent). Reusing it with different input is request_id_reused. If the response is lost, run `cockpit docs mutation-status <uuid>`, then retry the SAME input with the SAME id.",
             "mutation-status <request-uuid> — your own save receipt: committed (with the stored revision), not_committed (with the reason) or unknown_check_again (no receipt yet; it never proves nothing changed). --json shape: { mutation }.",
             "  --allow-empty clears the page on purpose. A body that would empty a document that holds text is refused (refused_empty_body) unless you say so, because far more often it is a surface that lost the content than a person who meant it.",
-            "access <id|slug> — who may do what on a page and why, in plain sentences (BLI-21313): your role (author, admin, granted_editor, reader), can_read/can_edit/can_manage, the named editors you may see (the owner and administrators see all; a named editor sees only their own grant), and the grant history for the owner and administrators. The same explanation the page, its versions and its export carry. --json shape: { ok, document_id, permission: { role, can_read, can_edit, can_manage, editors, editors_complete, reasons }, events }.",
-            "share <id|slug> --add <email> | --remove <email> [--reason \"<note>\"] — owner or administrator only. Names (or removes) an editor of an ORGANIZATION page by exact email, never fuzzy. An editor can change the title and text; they cannot change visibility, move, delete or manage editors, and nobody new gains the right to read. A page you made private refuses with private_page_grant_needs_decision (sharing a private page waits for a decision) and nothing is written. Other refusals: not_grant_manager, person_not_found, grantee_is_author, document_not_found_or_unreadable. Adding someone already named, or removing someone not named, answers outcome unchanged. --json shape: { ok, outcome, reason, document_id, grantee_id, request_id, permission }.",
+            "access <id|slug> — who may do what on a page and why, in plain sentences (BLI-21313, BLI-23558): your role (author, admin, granted_editor, granted_viewer, reader), can_read/can_edit/can_manage, the named editors and viewers you may see (on a private page everyone who can open it sees everyone named; on an Everyone page the owner and administrators do, and a named editor sees only their own entry), and the grant history for the owner. An administrator has no special access to a private page: they read it only if the owner named them. The same explanation the page, its versions and its export carry. --json shape: { ok, document_id, permission: { role, can_read, can_edit, can_manage, editors, viewers, editors_complete, reasons }, events }.",
+            "share <id|slug> --add <email> [--role viewer|editor] | --remove <email> [--reason \"<note>\"] — the page owner only (an administrator too, on an Everyone page). Names a person on a page, private or Everyone, by exact email, never fuzzy. --role viewer lets them read it; --role editor (the default) also lets them change its title and text, but not visibility, move, delete or who has access. Adding someone already named with a different role changes their role; --remove takes them off whatever role they hold. Refusals: not_grant_manager, person_not_found, grantee_is_author, invalid_role, document_not_found_or_unreadable. Adding someone already named in that role, or removing someone not named, answers outcome unchanged. --json shape: { ok, outcome, reason, role, document_id, grantee_id, request_id, permission }.",
             "comments <id|slug> [--status open|resolved|all] [--cursor <c>] — the page's discussion (BLI-21701): threads newest activity first, 50 per page, each with its comments (author, time, edited), a \"A comment was deleted by <who> on <when>.\" line for a deleted one, and who resolved a resolved thread. Anyone who can read the page can read it. Ends with the open/resolved counts, a `More: --cursor` line, and a coverage note when some comments could not be read. --json shape: { ok, status, can_comment, counts: { open, resolved }, threads: [{ id, resolved, resolved_at, resolved_by_name, comments: [{ id, author_name, body, created_at, edited_at, deleted, marker, can_edit, can_delete }] }], next_cursor, coverage: exhausted|capped|failed_partial, coverage_note, note }.",
             "comment <id|slug> \"<text>\" | - [--request-id <uuid>] — starts a thread (the text is the second argument, or `-` to read stdin; 1-10,000 characters). Add --reply <thread id> to answer a thread, --edit <comment id> to replace your own comment's text (earlier text is not kept), --delete <comment id> (its author, the page owner or an administrator; a soft delete), --resolve <thread id> or --reopen <thread id>. Exactly one action. Only the page owner, administrators and named editors of an organization page can write; everyone else who can read the page is refused with not_commenter and nothing is written. Other labels, verbatim: not_comment_author, comment_not_found, thread_not_found, invalid_body, document_not_found_or_unreadable. The same --request-id twice gives one comment (outcome unchanged); resolving a resolved thread answers unchanged. --json shape: { ok, outcome, reason, document_id, thread_id, comment_id, request_id }.",
             "delete <id|slug> [<id|slug>...] — soft-deletes one or more documents (BLI-10555): the browser's own delete, sets deleted_at, never a real SQL DELETE. Recoverable: `cockpit docs trash` lists what you may restore and `cockpit docs restore <id>` brings it back (BLI-21413). Deleting a parent does NOT delete its children; they keep their own parent_id and stay exactly where they were. Each ref is one exact lookup, then one DELETE each — one bad ref never loses the rest. --json shape: one ref answers { ok, document_id }; several answer { documents: [{ ref, ok, document_id } | { ref, ok: false, error, detail }] }.",
@@ -220,6 +221,7 @@ export const TOWER_COMMAND_HELP = [
     ],
     PROJECT_HELP,
     MILESTONE_HELP,
+    AGREEMENTS_HELP,
     [
         "speed",
         [
@@ -241,7 +243,7 @@ export const TOWER_COMMAND_HELP = [
             "--seen reads what REAL visits saw instead: per page the visit count, p50 and p95 first-useful milliseconds (the moment",
             "real content showed, from the last-known screen or the fresh one), the share painted from the snapshot, and median HTML",
             "and script transfer. The browser sends one metadata-only beacon per page view; nothing is measured from this machine.",
-            "--since <n>m|h|d is the window (default 24h, at most 30d). --everyone reads every person's visits (super_admin only).",
+            "--since <n>m|h|d is the window (default 24h, at most 30d). --everyone reads other people's visits (only Vee, Jeetesh and Ed; a founder's visits stay with that founder; anyone else is refused everyone_needs_super_admin and still gets their own).",
             "A member sees their own visits. --page limits the table to those pages. The same read is the speed_seen MCP tool.",
         ],
     ],
@@ -256,7 +258,7 @@ export const TOWER_COMMAND_HELP = [
             "--by-client (ticket 19258) shows which app each person worked in (Claude Code CLI, desktop or IDE; Codex CLI, desktop, IDE or exec): the share of sessions and of session time, and the median hours from session start to the pull request opened and merged and the active minutes per merged PR, each with its N, compared only within one person and only with 5 or more sessions on each side. --by-topic adds topic rows, including (unlabelled). Choose only one grouping. --by-repo adds project rows under each person (top 10; --all shows every repo). --person me uses your signed-in email.",
             "Claude Code and Codex usage per person: sessions observed and extracted, tokens (total, output,",
             "and the input / cache split when the row carries it), and an API list-price equivalent that is",
-            "labelled as such and is never actual spend. Every signed-in role sees everyone's numbers (a team decision, BLI-13026); `usage sessions` still lists a member only their own sessions.",
+            "labelled as such and is never actual spend. You see your own numbers; Vee, Jeetesh and Ed also see everyone else's, except a founder's, which only that founder sees (BLI-23585, BLI-23624). When rows were left out the answer says how many people are shown and how many were withheld. `usage sessions` follows the same rule.",
             "--since takes <n>d (1 to 365), <n>h (1 to 8760), or an ISO timestamp; --until an ISO timestamp (default now).",
             "--detail adds Output, Input, Cache read and Cache creation. Counts use K/M/B; dollars are rounded.",
             "PRs opened, PRs merged and Commits come from the pull requests Tower mirrors from GitHub, matched to people by GitHub login. n/a means Tower cannot match that person to a login: unknown, not zero. The footer says how many repositories the mirror holds, the range of its pull requests and what matched nobody; --json lists the repositories.",
@@ -412,7 +414,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "memory",
         [
-            "Usage: cockpit memory [map|knowledge|rules|search|save|update|forget|private|public|profile|consolidation|chain|source|exam|requeue|install|status|log] [flags]",
+            "Usage: cockpit memory [map|knowledge|rules|search|save|update|forget|private|public|profile|consolidation|chain|source|exam|requeue|on|off|install|uninstall|status|log] [flags]",
             "",
             "  map [--json] — projects, topics, memory counts and importance from the shared map.",
             "  knowledge [--person <name>] [--project <name>] [--by-project] [--limit <n>] [--json] — ranked project ideas.",
@@ -469,6 +471,11 @@ export const TOWER_COMMAND_HELP = [
             "Idempotent: it merges with what is already there, never duplicates its own",
             "entries, and reads the stored config back before reporting success.",
             "`cockpit doctor` runs it, and the sync tick re-runs it at most once a day.",
+            "off (alias uninstall) turns BLI Memory off on THIS machine: it records the choice, removes",
+            "our hooks and MCP entry from both hosts (your other hooks stay), and doctor, onboard,",
+            "update and the sync tick never add them back; the Stop and PreCompact hooks send nothing.",
+            "on (alias install) records the opposite choice and registers them again. Each prints",
+            "one line saying what changed and how to undo it. See docs/architecture/agent-memory.md.",
             "See docs/runbooks/bli-memory-install.md.",
             "log appends an opinion to ~/.codex/AGENT-EXPERIENCE.md and posts it to Tower.",
             "Use --reason-stdin instead of a quoted reason; --json reports shipped status.",

package/dist/commands/local-help-commands.js

@@ -17,16 +17,29 @@
  * something breaks, so it is a user-visible contract like any other.
  */
 import { DEFAULT_DASHBOARD_URL } from "../local-state.js";
+import { BOOKS_USAGE } from "./books-usage.js";
 import { localCommandHelp, SURFACE_ALIASES } from "./local-help.js";
 import { TOWER_COMMAND_HELP } from "./local-help-commands-tower.js";
 import { TOWER_OPS_COMMAND_HELP } from "./local-help-commands-tower-ops.js";
 /** One manual per collector command; the Tower nouns are spread in from their own file. */
 const COMMAND_HELP = new Map([
+    ["books", [BOOKS_USAGE, "Client Books: each engagement's record (timeline, actions, documents, meetings, ...). A member of a book reads it; a member with edit access, or a founder, writes it; only founders create books and manage members. put without --merge replaces the record's data; --merge changes only the fields given. --version <n> makes a write conditional: refused as version_conflict when someone changed the record since you read version n (0 = must not exist yet). delete is soft. export writes <dir>/<collection>/<doc_id>.json; import reads that layout and writes 50 records per batch. MCP twins: books_list, books_create, books_members, books_read, books_write, books_batch. Docs: docs/architecture/client-books.md."]],
     ["glossary", ["Usage: cockpit glossary list|add <wrong> --to <name>|remove <wrong> [--json]", "Quote phrases. Removing a form prevents future corrections of it."]],
-    ["skills", ["Usage: cockpit skills library [--weeks <1-52>] [--json] | cockpit skills refresh [--weeks <1-104>] [--json]", "The Skill Library: every agent skill and command our GitHub repos define (name, description, repo, path, versions) with weekly use by person, from the sessions Tower already collects. Uses that match no scanned skill are listed as unmatched, never dropped. The first line is the coverage: repos scanned, skills, invocations matched of total. A member sees their own usage; a super_admin sees everyone's except an owner's. refresh scans the repos and recomputes the weekly totals now (super_admin only; a stale library also refreshes itself when read). MCP twins: skills_library, skills_refresh. Web: TEAM > Skills."]],
+    ["skills", ["Usage: cockpit skills library [--weeks <1-52>] [--json] | cockpit skills refresh [--weeks <1-104>] [--json]", "The Skill Library: every agent skill and command our GitHub repos define (name, description, repo, path, versions) with weekly use by person, from the sessions Tower already collects. Uses that match no scanned skill are listed as unmatched, never dropped. The first line is the coverage: repos scanned, skills, invocations matched of total. You see your own usage; Vee, Jeetesh and Ed see everyone's except a founder's. refresh scans the repos and recomputes the weekly totals now (super_admin only; a stale library also refreshes itself when read). MCP twins: skills_library, skills_refresh. Web: TEAM > Skills."]],
     ["push", ["Usage: cockpit push status | test [--dashboard-url <url>] [--json]", "Phone notifications. status lists your saved devices and whether the server has its push keys; test sends a test push to every saved device. Turn a phone on from Settings on the phone."]],
     ["spend", ["Usage: cockpit spend memory [--days 1|7|30] [--dashboard-url <url>] [--json]", "Spend by memory operation (write, recall, dream, update_forget, backfill, label, exam, predictor, people, who, intentions, salience, chat, other), ranked top first with list and real dollars, share, trend against the previous window, and how much of the real OpenAI bill the ledger explains. What it does not explain is shown as untagged. A super_admin reads it."]],
-    ["roots", ["Usage: cockpit roots add <dir> [--allow-home-root] [--json]", "Approves a work directory, saves an approval receipt, and adds it to collection. Run cockpit doctor afterward."]],
+    ["roots", [
+            "Usage: cockpit roots add <dir> [--allow-home-root] [--json] | label <dir> team|drawer [--json] | list [--json]",
+            "add approves a work directory, saves an approval receipt, and adds it to collection. Run cockpit doctor afterward.",
+            "label (founders' laptops): team sends that folder's sessions and memories to Tower as today; drawer keeps them on this laptop and sends only bare numbers. safe is refused until the safe is live.",
+            "list shows each approved or labelled folder and the shelf it resolves to.",
+        ]],
+    ["shelf", [
+            "Usage: cockpit shelf status | default team|drawer | metrics --allow <day,tool,model,spawn|none> | drawer purge --older-than <days> [--json]",
+            "A founder's shelves on THIS laptop. status: Tower's founder lock, the default, and what is in the drawer here (not backed up).",
+            "default: where work outside every labelled folder goes. metrics: the opt-in categories a drawer session's bare record may carry (all off by default).",
+            "drawer purge: the only way drawer items are removed.",
+        ]],
     // BLI-3709: the Tower nouns live next door, split along the same seam the
     // argument parsers already use — see `local-help-commands-tower.ts`.
     ...TOWER_COMMAND_HELP,
@@ -92,12 +105,14 @@ const COMMAND_HELP = new Map([
     [
         "doctor",
         [
-            "Usage: cockpit doctor [--workspace <path>] [--check | --no-repair] [--no-usage-telemetry] [--lock-wait <seconds>] [--backfill-budget <seconds>] [--json]",
+            "Usage: cockpit doctor [--workspace <path>] [--check | --no-repair] [--no-usage-telemetry] [--no-memory] [--lock-wait <seconds>] [--backfill-budget <seconds>] [--json]",
             "",
             "Diagnose, repair, and verify this machine.",
             "Repairs CLI, background sync, sign-in, roots, memory and hooks, agent rules, catch-up, uploads, and cleanup.",
             "roots-cover-work is informational: it names how many sessions are inside vs. outside saved roots (all already uploaded, outside ones labelled) and gives cockpit roots add commands for attributing a folder's sessions to a repo (outside-root transcripts upload either way). It never needs a fix.",
             "--no-usage-telemetry switches off Claude Code and Codex usage export, including later doctor runs.",
+            "--no-memory turns BLI Memory off on this machine (same as `cockpit memory off`), including later runs and the background sync.",
+            "In a terminal, the first doctor or onboard asks once whether BLI Memory may save your sessions; `cockpit memory on|off` changes the answer.",
             "--check or --no-repair diagnoses without repairs. --dry-run previews repairs.",
             "--backfill-budget defaults to 900 seconds; catch-up repeats chunks until complete, with progress every 30 seconds.",
             "Doctor never waits for the background sync: a running sync is reported as running (with how long ago it started) and doctor finishes; a sync that stopped responding or made no progress for 15 minutes is ended and doctor carries on. --lock-wait is accepted and changes nothing. Progress prints at most every 30 seconds and says what changed.",
@@ -199,7 +214,7 @@ const COMMAND_HELP = new Map([
             "  cockpit team invite <email> --role <role> [--team-id <uuid>]",
             "      Admin only. Defaults to your own team; Tower emails them a sign-in link.",
             "  cockpit team role <userId> --role <role> [--yes]",
-            "      Admin only. Asks first unless --yes. You cannot change your own role.",
+            "      Admin only. Asks first unless --yes. You cannot change your own role. Making someone an admin or developer works only from a signed-in browser.",
             "  cockpit team grant <person-uuid> careers [see|act] [--json]",
             "  cockpit team revoke <person-uuid> careers [see|act] [--json]",
             "      Super admins manage separate See and Act grants. Default level: see.",
@@ -210,7 +225,7 @@ const COMMAND_HELP = new Map([
             "      (revoked reason, or when it was approved, or that it's still waiting).",
             "      Admin only.",
             "  cockpit team device scope <id|name> notetaker_bot|none [--json]",
-            "      Super admin only. Gives the meeting bot's device the scope Tower's claim door requires,",
+            "      Admin or developer only. Gives the meeting bot's device the scope Tower's claim door requires,",
             "      or takes it away. Without it the bot is refused every meeting (bot_scope_required).",
             "  cockpit team device mark-service <id|name> --reason <label> [--json]",
             "  cockpit team device unmark-service <id|name> [--json]",

package/dist/commands/local-help.js

@@ -36,6 +36,7 @@ export const SURFACE_ALIASES = new Map([
 ]);
 export const rootCommandNames = new Set([
     "roots",
+    "shelf",
     "onboard",
     "update",
     "upgrade",
@@ -75,6 +76,7 @@ export const rootCommandNames = new Set([
     "clean",
     "sources",
     "glossary",
+    "books",
     "skills",
     "spend",
     "push",
@@ -102,6 +104,7 @@ export const rootCommandNames = new Set([
     "people",
     "approvals",
     "drills",
+    "agreements",
     "manager",
     "image",
     ...SURFACE_ALIASES.keys(),
@@ -110,7 +113,8 @@ export const rootCommandNames = new Set([
 export const publicCommandNames = new Set([...rootCommandNames].filter((name) => name !== "do-everything" && name !== "fix"));
 /** The one-screen summary `cockpit --help` prints: one line per command, then the shared footnotes. */
 const COMMAND_SUMMARY_LINES = [
-    "  cockpit roots add <dir> [--allow-home-root] [--json]",
+    "  cockpit roots add <dir> [--allow-home-root] [--json] | label <dir> team|drawer | list",
+    "  cockpit shelf status | default team|drawer | metrics --allow <categories|none> | drawer purge --older-than <days> [--json]",
     "  cockpit onboard [--ticket <id>] [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--branch <name>] [--no-auth] [--max-depth <n>] [--max-repos <n>] [--json]",
     "  cockpit update [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--no-auth] [--json]",
     "  cockpit upgrade [same flags as update]",
@@ -148,7 +152,7 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit serve [--port <port>] [--workspace <path>]",
     "  cockpit autostart [install|uninstall|status] [--workspace <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
     "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",
-    "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|install|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--include-originals|--no-originals] [--include-source|--no-source] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
+    "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|on|off|install|uninstall|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--include-originals|--no-originals] [--include-source|--no-source] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
     "  cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
     "  cockpit sources check [--reconcile] [--older-than <days>] [--dashboard-url <url>] [--json]",
     "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>|delete <id|slug>|trash|versions <id|slug>|restore <id>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",
@@ -164,6 +168,7 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit release [--dry-run] [--skip-checks] [--no-floor] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
     "  cockpit careers [list|show <id>|rescreen <id>|send-takehome <id>|decide <id> --decision <passed_on|archived|reopen>|followup <id> [--record-sent-at <iso>]|interview <id> <--at <iso>|--clear>|grade <id> [--now]|resume <id> [--out <path>]|takehome show <role>|takehome set <role> --body-file <path>|settings show|settings set --enabled <true|false> --followup-enabled <true|false> --followup-after-days <n> --takehome-window-hours <n>] [--role <slug>] [--min-score <n>] [--since <date>] [--stage <s>] [--force] [--json]",
     "  cockpit glossary list|add <wrong> --to <name>|remove <wrong> [--dashboard-url <url>] [--json]",
+    "  cockpit books list|create|members|ls|get|put|delete|batch|export|import ... [--dashboard-url <url>] [--json]",
     "  cockpit skills library [--weeks <1-52>] | refresh [--weeks <1-104>] [--dashboard-url <url>] [--json]",
     "  cockpit spend memory [--days 1|7|30] [--dashboard-url <url>] [--json]",
     "  cockpit push status|test [--dashboard-url <url>] [--json]",
@@ -181,6 +186,7 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit ai-skills [--who <me|team|email|user-id>] [--weeks <n>] [--week <YYYY-MM-DD>] [--dashboard-url <url>] [--json]",
     "  cockpit approvals [list|show <id>|create|approve <id> [--edit]|edit <id> [--approve]|reject <id>|rules [--active true|false]|rules create <card-id> [--any-audience] [--label <text>]|rules revoke <rule-id> [--reason <text>]] [--status <s>] [--limit <n>] [--before <cursor>] [--dashboard-url <url>] [--json]",
     "  cockpit drills [list|start|answer --confidence <1-5> [--text <words>] [--attempt <id>]|theme|theme set <theme> [--play <t>] [--watch <t>] [--train <t>]|review] [--dashboard-url <url>] [--json]",
+    "  cockpit agreements [list|show <request-id>|copy <request-id> [--out <file>]|documents|draft|request --version <id> --person <user-id> [--due <date>]|cancel <request-id>] [--dashboard-url <url>] [--json]",
     "  cockpit manager <clients|client <client>|run <run-id>|list <client>|queue <client>|show <id>|add <client> --title <t>|edit <id> --version <v>|done|reopen|link|approve|dismiss|proposal|archive|unarchive> [--timeline] [--dashboard-url <url>] [--json]",
     "  cockpit image <describe <file> [--session <id>]|show <sha256-or-prefix>> [--dashboard-url <url>] [--json]",
     "  cockpit setup [--since <duration|date>] [--until <date>] [--machines] [--details] [--person <name|email>] [--compare <name,name>] [--json]",

package/dist/commands/local.js

@@ -9,6 +9,8 @@ export { rootCommandNames, localCommandHelp, SURFACE_ALIASES, unknownCommandJson
 /** Commands that act on THIS machine; the rest talk to Tower. */
 const MACHINE_COMMAND_KINDS = [
     "roots",
+    // BLI-23478 (three shelves): acts on this laptop only.
+    "shelf",
     "install",
     "onboard",
     "update",
@@ -81,6 +83,7 @@ export async function runLocalCockpitCli(argv, io = { ...defaultIo(), runDoctorA
 async function runMachineCommand(command, io) {
     switch (command.kind) {
         case "roots": return await (await import("./roots.js")).runRoots(command, io);
+        case "shelf": return await (await import("./shelf.js")).runShelf(command, io);
         case "install": return await (await import("./install-update.js")).runInstall(command, io);
         case "onboard": return await (await import("./onboard.js")).runOnboard(command, io);
         case "update": return await (await import("./install-update.js")).runUpdate(command, io);
@@ -109,6 +112,10 @@ async function runMachineCommand(command, io) {
             // caller asks for it by name in code.
             if (command.action === "help")
                 return (await import("./memory-store.js")).runMemoryVerbList(io, command.json);
+            // BLI-22640: the per-machine switch. `install`/`status` keep their page.
+            if (command.action === "on" || command.action === "off" || command.action === "uninstall") {
+                return await (await import("./memory-switch.js")).runMemorySwitch({ ...command, action: command.action }, io);
+            }
             return await (await import("./memory-install.js")).runMemoryInstall(command, io);
         case "memory-store": return await (await import("./memory-store.js")).runMemoryStore(command, io);
         case "clean": return await (await import("./clean.js")).runClean(command, io);
@@ -136,6 +143,7 @@ async function runTowerCommand(command, io) {
         case "correct": return await (await import("./correct.js")).runCorrect(command, io);
         case "notes": return await (await import("./notes.js")).runNotes(command, io);
         case "glossary": return await (await import("./glossary.js")).runGlossary(command, io);
+        case "books": return await (await import("./books.js")).runBooks(command, io);
         case "skills": return await (await import("./skills.js")).runSkills(command, io);
         case "sessions-forget": return await (await import("./sessions-forget.js")).runSessionsForget(command, io);
         case "spend": return await (await import("./spend.js")).runSpend(command, io);
@@ -162,6 +170,7 @@ async function runTowerCommand(command, io) {
         case "people": return await (await import("./people.js")).runPeople(command, io);
         case "approvals": return await (await import("./approvals.js")).runApprovals(command, io);
         case "drills": return await (await import("./approvals.js")).runDrills(command, io);
+        case "agreements": return await (await import("./agreements.js")).runAgreements(command, io);
         case "manager": return await (await import("./manager.js")).runManager(command, io);
         case "image": return await (await import("./image.js")).runImage(command, io);
     }

package/dist/commands/memory-capture-prompt.js

@@ -0,0 +1,130 @@
+/**
+ * The one-time BLI Memory question (BLI-22640).
+ *
+ * An interactive `cockpit doctor` or `cockpit onboard` on a machine that has
+ * never chosen asks once, and the answer becomes this machine's choice
+ * (`memory-capture-choice.ts`). Once answered, never asked again: `cockpit
+ * memory on|off` is how a person changes their mind.
+ *
+ * Asked only when a person is plainly there: stdin AND stdout are terminals,
+ * `--json` is off, and this is not the scheduler's tick, a dry run or a
+ * `--check`. launchd, Task Scheduler, CI and every piped run keep today's
+ * default (on) without a question, and say why in the log.
+ *
+ * Founders only (Jeetesh's review of 2026-10-25): the question is shown only
+ * when Tower answers, live, that this machine's person is a founder. Anybody
+ * else never sees it and keeps BLI Memory on; the log names why
+ * (`not_founder`, or `founder_check_unavailable` when Tower could not be
+ * asked). A cached "not a founder" skips the question without asking Tower.
+ *
+ * An answer that is neither yes nor no is asked once more; a second unclear
+ * answer records NOTHING, so the default holds and the next interactive run
+ * asks again. A choice this important is never inferred from a typo.
+ */
+import os from "node:os";
+import { readLine, writeLine } from "./cli-io.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { readMemoryCaptureChoice, writeMemoryCaptureChoice } from "../memory-capture-choice.js";
+import { mayRecordOff } from "../founder-standing.js";
+import { parseYesNo } from "../yes-no.js";
+export const MEMORY_CHOICE_QUESTION = "BLI Memory: save what you work on so agents remember it across sessions? [Y/n] ";
+export const MEMORY_CHOICE_EXPLAINER = "Answering n keeps BLI Memory's hooks off on this machine, so nothing from your sessions is sent to memory; `cockpit memory on` or `cockpit memory off` changes it later.";
+/** Why this run may not ask, or null when it may. */
+export function memoryChoicePromptBlocker(io, options) {
+    if (options.json)
+        return "json";
+    if (options.automaticTick)
+        return "scheduled_tick";
+    if (options.dryRun || options.checkOnly)
+        return "diagnose_only";
+    if (((io.env ?? process.env)["CI"] ?? "") !== "")
+        return "ci";
+    const stdinTty = Boolean(io.stdin.isTTY);
+    const stdoutTty = Boolean(io.stdout.isTTY);
+    return stdinTty && stdoutTty ? null : "not_a_tty";
+}
+export async function askMemoryChoiceOnce(io, options) {
+    const blocker = memoryChoicePromptBlocker(io, options);
+    if (blocker) {
+        console.error("[memory-capture] question not asked; the default stands", JSON.stringify({ reason: blocker }));
+        return "not_interactive";
+    }
+    const paths = getCollectorRuntimePaths(options.homeDir ?? os.homedir());
+    const current = await readMemoryCaptureChoice(paths);
+    if (current.state !== "unchosen") {
+        console.error("[memory-capture] question not asked; already answered", JSON.stringify({ reason: "already_chosen", state: current.state }));
+        return "already_chosen";
+    }
+    const founder = await founderMayBeAsked(io, options);
+    if (founder !== null)
+        return founder;
+    writeLine(io.stdout, MEMORY_CHOICE_EXPLAINER);
+    let verdict = parseYesNo(await readLine(io, MEMORY_CHOICE_QUESTION), { emptyIsYes: true });
+    if (verdict === "unclear") {
+        verdict = parseYesNo(await readLine(io, `Please answer y or n. ${MEMORY_CHOICE_QUESTION}`), { emptyIsYes: true });
+    }
+    if (verdict === "unclear") {
+        console.error("[memory-capture] answer unclear twice; nothing recorded", JSON.stringify({ reason: "unclear_answer" }));
+        writeLine(io.stdout, "No answer recorded; BLI Memory stays on for now, and the next `cockpit doctor` asks again.");
+        return "unclear_answer";
+    }
+    const on = verdict === "yes";
+    try {
+        await writeMemoryCaptureChoice(paths, on, "prompt");
+    }
+    catch (error) {
+        console.error("[memory-capture] answer could not be saved", JSON.stringify({ reason: "choice_write_failed", error_name: error instanceof Error ? error.name : typeof error }));
+        writeLine(io.stdout, "Your answer could not be saved; run `cockpit memory " + (on ? "on" : "off") + "` to record it.");
+        return "choice_write_failed";
+    }
+    writeLine(io.stdout, on
+        ? "BLI Memory is on for this machine. Undo: cockpit memory off"
+        : "BLI Memory stays off on this machine; its hooks are removed and not added back. Undo: cockpit memory on");
+    return on ? "chose_on" : "chose_off";
+}
+/** Null when the question may be shown; otherwise why not. Logs both branches. */
+async function founderMayBeAsked(io, options) {
+    // Only Tower's live "founder" is enough to ask, because the answer can
+    // record an off; the saved copy decides nothing (BLI-22640).
+    const permission = await mayRecordOff({
+        ...(options.homeDir ? { homeDir: options.homeDir } : {}),
+        ...(options.dashboardUrl ? { dashboardUrl: options.dashboardUrl } : {}),
+        fetch: io.fetch,
+        door: "prompt",
+    });
+    if (permission.allowed)
+        return null;
+    const reason = permission.reason === "memory_off_founders_only" ? "not_founder" : "founder_check_unavailable";
+    console.error("[memory-capture] question not asked; founders only", JSON.stringify({ reason, source: "live", detail: permission.detail }));
+    return reason;
+}
+/**
+ * What `cockpit doctor` does with the choice before its first row: honour
+ * `--no-memory`, otherwise ask once when a person is there. Never throws; a
+ * doctor run is never lost to this question.
+ */
+export async function settleDoctorMemoryChoice(command, io) {
+    try {
+        if (command.noMemory && !command.dryRun && !command.checkOnly) {
+            // Founders only, on Tower's live answer; anybody else is told why and doctor carries on.
+            const permission = await mayRecordOff({
+                ...(command.homeDir ? { homeDir: command.homeDir } : {}),
+                ...(command.dashboardUrl ? { dashboardUrl: command.dashboardUrl } : {}),
+                fetch: io.fetch,
+                door: "doctor_no_memory",
+            });
+            if (!permission.allowed) {
+                // stdout belongs to `--json`; the refusal is on stderr there, by name.
+                writeLine(command.json ? io.stderr : io.stdout, `--no-memory: ${permission.line}`);
+                return "flag_refused";
+            }
+            await writeMemoryCaptureChoice(getCollectorRuntimePaths(command.homeDir ?? os.homedir()), false, "doctor_flag");
+            return "flag_off";
+        }
+        return await askMemoryChoiceOnce(io, command);
+    }
+    catch (error) {
+        console.error("[memory-capture] choice step failed; doctor carries on with what is recorded", JSON.stringify({ reason: "choice_step_threw", error_name: error instanceof Error ? error.name : typeof error }));
+        return "choice_write_failed";
+    }
+}

package/dist/commands/memory-install-claude.js

@@ -200,8 +200,10 @@ export function applyHookGroups(root, hookSpecs) {
             ? hooks[spec.event].slice()
             : [];
         // Somebody else's Stop hook survives untouched; only OUR entries — matched
-        // by bin name plus `hook`, wherever the bin ended up — are replaced.
-        const survivors = groups.filter((group) => !groupIsOurs(group));
+        // by bin name plus `hook`, wherever the bin ended up — are replaced. A group
+        // a person shares with ours keeps their commands (BLI-22640, the Codex
+        // review point): only our command comes out of it.
+        const survivors = stripOurHooks(groups).groups;
         survivors.push({
             hooks: [
                 {
@@ -268,9 +270,54 @@ export function ourHookCount(root) {
     }
     return count;
 }
-function groupIsOurs(group) {
+/** Exported for `memory-uninstall.ts` (BLI-22640): the off-switch removes exactly what the installer would replace. */
+export function groupIsOurs(group) {
     return hookCommands(group).some(isMemoryHookCommand);
 }
+/**
+ * BLI-22640 (the Codex review point on PR 2615). Takes OUR commands out of
+ * each hook group and keeps everything else: a group a person shares with
+ * ours keeps their own commands (and its matcher and any other key), and only
+ * a group left with no hooks at all is dropped. A group that holds none of
+ * ours comes back as the same object, byte for byte once serialised.
+ *
+ * `removed` counts our commands taken out. Used by the installer (before it
+ * appends our fresh group) and by `cockpit memory off`.
+ */
+export function stripOurHooks(groups) {
+    const kept = [];
+    let removed = 0;
+    for (const group of groups) {
+        const record = asRecord(group);
+        const entries = record && Array.isArray(record["hooks"]) ? record["hooks"] : null;
+        if (!record || !entries) {
+            kept.push(group);
+            continue;
+        }
+        const others = entries.filter((entry) => {
+            const command = asRecord(entry)?.["command"];
+            return !(typeof command === "string" && isMemoryHookCommand(command));
+        });
+        removed += entries.length - others.length;
+        if (others.length === entries.length)
+            kept.push(group);
+        else if (others.length > 0)
+            kept.push({ ...record, hooks: others });
+    }
+    return { groups: kept, removed };
+}
+/** How many of OUR hook commands a settings or hooks.json root holds, across every event and group. */
+export function ourHookCommandCount(root) {
+    const hooks = asRecord(root["hooks"]);
+    if (!hooks)
+        return 0;
+    let count = 0;
+    for (const groups of Object.values(hooks)) {
+        if (Array.isArray(groups))
+            count += stripOurHooks(groups).removed;
+    }
+    return count;
+}
 function hookCommands(group) {
     const record = asRecord(group);
     if (!record || !Array.isArray(record["hooks"]))
@@ -310,7 +357,7 @@ function sameStringArray(value, expected) {
  * itself, so this is cosmetic — but a diff that reindents a person's whole
  * configuration reads like damage even when it is not.
  */
-function serializeJson(root, previous) {
+export function serializeJson(root, previous) {
     const indent = detectIndent(previous);
     return `${JSON.stringify(root, null, indent)}\n`;
 }

package/dist/commands/memory-install-report.js

@@ -75,12 +75,17 @@ export function logMemoryOutcome(outcome, platform) {
         memory_on: memoryInstallGaps(outcome.receipt).length === 0,
         memory_gaps: memoryInstallGaps(outcome.receipt),
         codex_hooks: outcome.receipt.codex.hooks,
+        ...(outcome.opted_out ? { opted_out: true, removed_count: outcome.removed_count ?? 0 } : {}),
     };
     // stderr on both branches: launchd captures it to sync.err.log, and stdout is
     // reserved for `--json`.
-    console.error(outcome.status === "failed"
-        ? "[memory-install] BLI Memory is not fully registered on this machine"
-        : "[memory-install] BLI Memory registration converged", JSON.stringify(fields));
+    console.error(outcome.opted_out
+        ? outcome.status === "failed"
+            ? "[memory-install] BLI Memory is off on this machine and an entry could not be removed"
+            : "[memory-install] BLI Memory is off on this machine; nothing of it was registered"
+        : outcome.status === "failed"
+            ? "[memory-install] BLI Memory is not fully registered on this machine"
+            : "[memory-install] BLI Memory registration converged", JSON.stringify(fields));
 }
 export function memoryOutcomeLines(outcome) {
     const headline = memoryOutcomeHeadline(outcome);
@@ -89,6 +94,11 @@ export function memoryOutcomeLines(outcome) {
     // daemon", because nothing looked.
     if (outcome.daemon)
         lines.push(`  ${memoryDaemonLine(outcome.daemon)}`);
+    // BLI-22640: a non-founder's "off" is ignored, and said so where they read.
+    if (outcome.opt_out_ignored) {
+        lines.push("  This machine's BLI Memory \"off\" is ignored: only Tower's founders can turn it off, " +
+            "because work on BLI machines goes to Tower (opt_out_ignored_not_founder).");
+    }
     // The trust step is the one thing a person has to do by hand, so it is said
     // here in words rather than left as a status word they have to look up.
     if (outcome.receipt.codex.hooks === "needs_trust") {
@@ -108,6 +118,12 @@ export function memoryOutcomeLines(outcome) {
     return lines;
 }
 function memoryOutcomeHeadline(outcome) {
+    // BLI-22640: the person's choice is the headline, whatever the files say.
+    if (outcome.opted_out) {
+        return outcome.action === "status"
+            ? "BLI Memory is off on this machine (your choice). `cockpit memory on` turns it back on."
+            : "BLI Memory is off on this machine (your choice); none of it was registered. `cockpit memory on` turns it back on.";
+    }
     if (outcome.status === "installed")
         return "BLI Memory registered on this machine.";
     if (outcome.status === "already")

package/dist/commands/memory-install-toml.js

@@ -148,6 +148,28 @@ export function removeTomlTable(text, tablePath) {
     const lines = text.split("\n");
     return [...lines.slice(0, span.start_line), ...lines.slice(span.end_line)].join("\n");
 }
+/**
+ * BLI-22640. Removes our table AND every sub-table under it (`[a.b.env]`,
+ * `[a.b.tools.x]`), each with the lines it owns; every other table survives
+ * byte for byte. `cockpit memory off` uses it, so no half of our entry is left
+ * for a host to start a server from.
+ */
+export function removeTomlTableTree(text, tablePath) {
+    const lines = text.split("\n");
+    const kept = [];
+    let dropping = false;
+    for (const line of lines) {
+        const header = parseTableHeader(line);
+        if (header || isArrayTableHeader(line)) {
+            dropping = header !== null &&
+                header.length >= tablePath.length &&
+                samePath(header.slice(0, tablePath.length), tablePath);
+        }
+        if (!dropping)
+            kept.push(line);
+    }
+    return kept.join("\n");
+}
 export function renderTomlTable(tablePath, entries) {
     const header = `[${tablePath.map(renderKey).join(".")}]`;
     const body = entries.map(([key, value]) => `${renderKey(key)} = ${renderValue(value)}`);