@bli-cockpit/cli 0.2.37 → 0.2.39

package/dist/commands/scout.js

@@ -0,0 +1,158 @@
+/**
+ * `cockpit scout` — the Scout board, and the three verbs that move a card, in
+ * the terminal (BLI-3460).
+ *
+ * This half talks to Tower and decides exit codes; `scout-render.ts` turns a
+ * board into lines and resolves a typed id, with no io of its own.
+ *
+ * The board is read FIRST even when a card is being moved, for two reasons: the
+ * id prefix is resolved against the board that was actually returned rather than
+ * against a guess, and a refused action still leaves a readable board on stdout.
+ * Being told no about a decision never costs a person the read they already had.
+ *
+ * `cockpit scout` is NOT JARVIS's `readScout` tool. This prints the board;
+ * `cockpit jarvis "..."` asks a question about it and gets an answer in
+ * sentences. Reading is governed by the `scout_page_audience` switch, exactly
+ * as the page is; moving a card is super_admin whichever surface asks, and a
+ * refusal never costs a person the board.
+ */
+import { writeLine } from "./cli-io.js";
+import { renderScoutBoard, resolveExperimentRef, refusalSentence, shortId, truncationLines, } from "./scout-render.js";
+import { loadPairedSession, towerFailureDetail, towerJsonRequest, } from "../tower-client.js";
+/** The dashboard route caps nothing here, but a board read should never hang a shell. */
+const READ_DEADLINE_MS = 30_000;
+export async function runScout(command, io) {
+    const session = await loadPairedSession("scout", command.homeDir);
+    const dashboardUrl = command.dashboardUrl ?? session.dashboard_url;
+    const log = (line) => writeLine(io.stderr, line);
+    // The board is read first even for an action: the id prefix is resolved
+    // against it locally, and a refused action still leaves a readable board.
+    const read = await towerJsonRequest({
+        dashboardUrl,
+        path: command.days ? `/api/cockpit/scout?days=${command.days}` : "/api/cockpit/scout",
+        method: "GET",
+        deviceToken: session.device_token,
+        fetch: io.fetch,
+        label: "scout",
+        timeoutMs: READ_DEADLINE_MS,
+        log,
+    });
+    if (!read.ok) {
+        writeFailure(command, io, read);
+        return 1;
+    }
+    const payload = read.body;
+    const board = payload.board ?? {};
+    const lines = payload.lines ?? {};
+    if (command.action === "board") {
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({ ok: true, audience: payload.audience ?? null, windowDays: payload.windowDays ?? board.windowDays ?? null, board, lines }));
+        }
+        else {
+            for (const line of renderScoutBoard(payload))
+                writeLine(io.stdout, line);
+        }
+        writeLine(io.stderr, `[scout cli] board read ${JSON.stringify({
+            audience: payload.audience ?? null,
+            window_days: payload.windowDays ?? board.windowDays ?? null,
+            experiments: board.experiments?.length ?? 0,
+            settled: board.settled?.length ?? 0,
+            signals: board.signals?.length ?? 0,
+            truncated: truncationLines(board).length > 0,
+        })}`);
+        return 0;
+    }
+    const ref = command.experimentRef ?? "";
+    const resolution = resolveExperimentRef(board, ref);
+    if (resolution.status !== "ok") {
+        const sentence = refusalSentence(resolution, ref);
+        writeLine(io.stderr, `[scout cli] action refused ${JSON.stringify({
+            reason: resolution.status,
+            action: command.action,
+            // The typed reference is a person's own input; only its shape is logged.
+            ref_length: ref.length,
+            candidates: resolution.status === "ambiguous_prefix" ? resolution.candidates.length : 0,
+        })}`);
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({ ok: false, error: resolution.status, detail: sentence }));
+        }
+        else {
+            writeLine(io.stderr, sentence);
+            for (const line of renderScoutBoard(payload))
+                writeLine(io.stdout, line);
+        }
+        return 1;
+    }
+    const serverAction = command.action === "undo" ? "undo_dismiss" : command.action;
+    const applied = await towerJsonRequest({
+        dashboardUrl,
+        path: "/api/cockpit/scout",
+        method: "POST",
+        deviceToken: session.device_token,
+        fetch: io.fetch,
+        label: "scout-action",
+        timeoutMs: READ_DEADLINE_MS,
+        body: { experiment_id: resolution.id, action: serverAction },
+        log,
+    });
+    if (!applied.ok) {
+        writeLine(io.stderr, `[scout cli] action failed ${JSON.stringify({
+            reason: applied.reason,
+            action: serverAction,
+            http_status: applied.httpStatus ?? null,
+        })}`);
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({
+                ok: false,
+                error: applied.reason,
+                detail: failureDetail(applied),
+                httpStatus: applied.httpStatus ?? null,
+                board,
+                lines,
+            }));
+            return 1;
+        }
+        // The server's own refusal first, then one line saying which gate it was —
+        // and the board underneath, because being refused an action never costs a
+        // person the read they already had.
+        writeLine(io.stderr, `Tower refused that action: ${failureDetail(applied)}`);
+        if (applied.httpStatus === 403) {
+            writeLine(io.stderr, "Deciding a Scout card is a super_admin action; reading the board is not.");
+        }
+        for (const line of renderScoutBoard(payload))
+            writeLine(io.stdout, line);
+        return 1;
+    }
+    const card = resolution.card;
+    writeLine(io.stderr, `[scout cli] action applied ${JSON.stringify({ action: serverAction, http_status: applied.httpStatus })}`);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, action: serverAction, experiment: applied.body?.experiment ?? null }));
+    }
+    else {
+        writeLine(io.stdout, `${pastTense(command.action)} ${shortId(resolution.id)} · ${card.claimSummary ?? card.title ?? "that card"}`);
+    }
+    return 0;
+}
+// ----------------------------------------------------------------- small parts
+function writeFailure(command, io, failure) {
+    const detail = failureDetail(failure);
+    writeLine(io.stderr, `[scout cli] read failed ${JSON.stringify({
+        reason: failure.reason,
+        http_status: failure.httpStatus ?? null,
+    })}`);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: false, error: failure.reason, detail, httpStatus: failure.httpStatus ?? null }));
+        return;
+    }
+    writeLine(io.stderr, `Scout could not be read: ${detail}`);
+}
+function failureDetail(failure) {
+    return towerFailureDetail(failure.reason, failure.detail);
+}
+function pastTense(action) {
+    if (action === "start")
+        return "Started";
+    if (action === "dismiss")
+        return "Dismissed";
+    return "Restored";
+}

package/dist/commands/settings-render.js

@@ -0,0 +1,137 @@
+/**
+ * How the settings surface reads in a terminal (BLI-3461).
+ *
+ * Pure functions from a response body to lines of text. No network, no
+ * filesystem, no `CliIo` — which is what makes the wording testable, and what
+ * keeps `settings.ts` about the decisions rather than the column widths.
+ *
+ * Every one of these is defensive about shape on purpose. These bodies come off
+ * the wire from a dashboard that may be a release ahead or behind the installed
+ * CLI, and a missing field should cost one line of output, not the command.
+ */
+const INDENT = "  ";
+function text(value, fallback = "—") {
+    if (typeof value === "string" && value.trim())
+        return value;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    return fallback;
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+function list(value) {
+    return Array.isArray(value) ? value.map(record) : [];
+}
+/** `provider:model`, or `unset` — the same key `--chat-model` accepts. */
+function modelKey(value) {
+    const pair = record(value);
+    if (typeof pair.provider === "string" && typeof pair.model === "string") {
+        return `${pair.provider}:${pair.model}`;
+    }
+    return "unset";
+}
+export function renderPersonal(body) {
+    const lines = [
+        `${INDENT}signed in as ${text(body.email)} (${text(body.role, "no role")})`,
+        `${INDENT}chat model   ${modelKey(body.chatModel)}`,
+        `${INDENT}brief model  ${modelKey(body.briefModel)}`,
+    ];
+    const memberships = list(body.teamMemberships);
+    if (memberships.length === 0) {
+        lines.push(`${INDENT}teams        none`);
+    }
+    else {
+        for (const [index, membership] of memberships.entries()) {
+            const team = record(membership.teams);
+            const label = text(team.name, text(membership.team_id));
+            lines.push(`${INDENT}${index === 0 ? "teams       " : "            "} ${label} (${text(membership.role_in_team)})`);
+        }
+    }
+    // "No teams" and "could not ask" are different answers and must stay apart.
+    if (typeof body.membershipsReadFailureReason === "string") {
+        lines.push(`${INDENT}teams could not be read: ${body.membershipsReadFailureReason}`);
+    }
+    return lines;
+}
+export function renderTeamSummary(body) {
+    const team = record(body.currentTeam);
+    const count = record(body.count);
+    if (!team.id) {
+        return [`${INDENT}no team yet — ask an admin to add you to one`];
+    }
+    const lines = [
+        `${INDENT}${text(team.name)} (${text(team.slug)}) — ${text(count.total, "0")} people`,
+        `${INDENT}${text(count.withAccounts, "0")} with accounts, ${text(count.rosterOnly, "0")} on the roster only`,
+    ];
+    if (typeof body.rosterError === "string") {
+        // An accounts-only list that looks complete is the failure this union
+        // exists to prevent; saying nothing here would recreate it in the terminal.
+        lines.push(`${INDENT}roster could not be read: ${body.rosterError}`);
+    }
+    return lines;
+}
+export function renderTeamMembers(body) {
+    const lines = renderTeamSummary(body);
+    const people = list(body.people);
+    if (people.length === 0)
+        return lines;
+    lines.push("");
+    for (const person of people) {
+        const standing = text(person.standing, "");
+        const name = text(person.displayName, text(person.email));
+        lines.push(`${INDENT}${name.padEnd(28)} ${text(person.role, "—").padEnd(20)} ${standing}`);
+        if (typeof person.userId === "string") {
+            lines.push(`${INDENT}${INDENT}id ${person.userId}`);
+        }
+    }
+    if (body.canManage !== true) {
+        lines.push("");
+        lines.push(`${INDENT}read-only — only an admin can invite or change roles`);
+    }
+    return lines;
+}
+export function renderSwitches(body) {
+    const switches = list(body.switches);
+    if (switches.length === 0)
+        return [`${INDENT}no switches registered`];
+    const lines = switches.map((entry) => {
+        const options = Array.isArray(entry.options)
+            ? entry.options.map((option) => text(record(option).value)).join(" | ")
+            : "";
+        return `${INDENT}${text(entry.key).padEnd(24)} ${text(entry.value).padEnd(12)} (${text(entry.source)}${options ? `; choices: ${options}` : ""})`;
+    });
+    if (typeof body.readFailureReason === "string") {
+        lines.push(`${INDENT}values could not be read: ${body.readFailureReason}`);
+    }
+    return lines;
+}
+export function renderModelRouting(body) {
+    const lines = [
+        `${INDENT}chat    ${text(body.chatEffectiveLabel)} (${text(body.chatSource)})`,
+        `${INDENT}memory  ${text(body.memoryEffectiveLabel)} (${text(body.memorySource)}${typeof body.memoryVia === "string" ? ` via ${body.memoryVia}` : ""})`,
+    ];
+    for (const slot of list(body.displaySlots)) {
+        lines.push(`${INDENT}${text(slot.name).padEnd(24)} ${text(slot.currentLabel)} — set in code (${text(slot.pointer)})`);
+    }
+    if (typeof body.readFailureReason === "string") {
+        lines.push(`${INDENT}settings could not be read: ${body.readFailureReason}`);
+    }
+    return lines;
+}
+/**
+ * Names, sizes and stamps only.
+ *
+ * There is no branch here that could print a value, because the server's own
+ * return type has no field carrying one — that is the design, and this renderer
+ * is deliberately the boring end of it.
+ */
+export function renderEnvBlobs(body) {
+    const blobs = list(body.blobs);
+    if (blobs.length === 0)
+        return [`${INDENT}no env files stored`];
+    return blobs.map((blob) => `${INDENT}${text(blob.project).padEnd(12)} ${text(blob.file_name).padEnd(16)} ` +
+        `updated ${text(blob.updated_at)}  id ${text(blob.id)}`);
+}

package/dist/commands/settings.js

@@ -0,0 +1,377 @@
+/**
+ * `cockpit settings` — the settings surface in the terminal (BLI-3461).
+ *
+ * Five sections, the same five tabs a person sees at `/settings`, reading and
+ * writing through the same `/api/settings/*` routes the browser uses. Nothing
+ * here decides policy: every allowlist, every super_admin check and every audit
+ * line lives on the server, so the terminal cannot drift into permitting
+ * something the browser refuses.
+ *
+ * Two things this file is careful about.
+ *
+ * **"Admin only" is not an error.** Bare `cockpit settings` shows everything
+ * this person can see, and renders a section they cannot as one line saying so.
+ * A read that 403s is the system working; printing a stack of refusals would
+ * teach an intern that the command is broken.
+ *
+ * **A secret never touches the terminal.** `settings env` lists names, sizes
+ * and stamps — the server cannot return a value, and this command has no flag
+ * that takes one. New content arrives on stdin and is forwarded without ever
+ * being written to stdout, stderr, or an argument vector.
+ */
+import { isInteractiveStdin, readLine, writeLine, yesByDefault } from "./cli-io.js";
+import { asList, asRecord, callTower, isForbidden, openTower, parseModelKey, readAllStdin, writeCommandFailure, } from "./tower-command.js";
+import { renderEnvBlobs, renderModelRouting, renderPersonal, renderSwitches, renderTeamSummary, } from "./settings-render.js";
+export async function runSettings(command, io) {
+    const tower = await openTower("settings", command, io);
+    switch (command.section) {
+        case "overview":
+            return showOverview(command, tower, io);
+        case "personal":
+            return command.action === "set"
+                ? setPersonal(command, tower, io)
+                : showPersonal(command, tower, io);
+        case "switches":
+            return command.action === "set"
+                ? setSwitch(command, tower, io)
+                : showSwitches(command, tower, io);
+        case "models":
+            return command.action === "set"
+                ? setModels(command, tower, io)
+                : showModels(command, tower, io);
+        case "env":
+            if (command.action === "set")
+                return setEnvBlob(command, tower, io);
+            if (command.action === "delete")
+                return deleteEnvBlob(command, tower, io);
+            return listEnvBlobs(command, tower, io);
+    }
+}
+// ── overview ──────────────────────────────────────────────────────────
+/**
+ * Everything at once, with the sections this person may not see named as such.
+ *
+ * The five reads go out together: they are independent, and a person waiting on
+ * five sequential round trips would reasonably conclude the command had hung.
+ */
+async function showOverview(command, tower, io) {
+    const [personal, switches, models, env, team] = await Promise.all([
+        callTower(tower, { path: "/api/settings/personal", label: "settings personal" }),
+        callTower(tower, { path: "/api/settings/switches", label: "settings switches" }),
+        callTower(tower, { path: "/api/settings/model-routing", label: "settings models" }),
+        callTower(tower, { path: "/api/settings/env-blobs", label: "settings env" }),
+        callTower(tower, { path: "/api/team/members", label: "settings team" }),
+    ]);
+    // The one read every signed-in person is entitled to. If THAT is refused,
+    // nothing else is going to work either, so say so once and stop.
+    if (!personal.ok && !isForbidden(personal)) {
+        return writeCommandFailure(io, command.json, personal);
+    }
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({
+            ok: true,
+            personal: sectionPayload(personal),
+            switches: sectionPayload(switches),
+            models: sectionPayload(models),
+            env: sectionPayload(env),
+            team: sectionPayload(team),
+        }));
+        return 0;
+    }
+    writeLine(io.stdout, "TOWER SETTINGS");
+    writeSection(io, "PERSONAL", personal, (body) => renderPersonal(body));
+    writeSection(io, "TEAM", team, (body) => renderTeamSummary(body));
+    writeSection(io, "SWITCHES", switches, (body) => renderSwitches(body));
+    writeSection(io, "MODELS", models, (body) => renderModelRouting(body));
+    writeSection(io, "ENV FILES", env, (body) => renderEnvBlobs(body));
+    writeLine(io.stderr, `[settings cli] overview ${JSON.stringify({
+        personal: outcome(personal),
+        team: outcome(team),
+        switches: outcome(switches),
+        models: outcome(models),
+        env: outcome(env),
+    })}`);
+    return 0;
+}
+/** One section's heading and body — or the one line that says it is not yours. */
+function writeSection(io, heading, result, render) {
+    writeLine(io.stdout, "");
+    writeLine(io.stdout, heading);
+    if (isForbidden(result)) {
+        writeLine(io.stdout, "  admin only");
+        return;
+    }
+    if (!result.ok) {
+        // Not "admin only" and not shown: a real failure, named where it happened.
+        writeLine(io.stdout, `  unavailable — ${result.detail}`);
+        return;
+    }
+    for (const line of render(asRecord(result.body)))
+        writeLine(io.stdout, line);
+}
+function sectionPayload(result) {
+    if (result.ok)
+        return result.body;
+    if (isForbidden(result))
+        return { visible: false, reason: "admin_only" };
+    return { visible: false, reason: result.reason, detail: result.detail };
+}
+function outcome(result) {
+    if (result.ok)
+        return "ok";
+    return isForbidden(result) ? "admin_only" : result.reason;
+}
+// ── personal ──────────────────────────────────────────────────────────
+async function showPersonal(command, tower, io) {
+    const result = await callTower(tower, {
+        path: "/api/settings/personal",
+        label: "settings personal",
+    });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    return writeBody(io, command.json, result.body, () => renderPersonal(asRecord(result.body)));
+}
+async function setPersonal(command, tower, io) {
+    const result = await callTower(tower, {
+        path: "/api/settings/jarvis-model",
+        method: "POST",
+        label: "settings personal set",
+        body: {
+            ...(command.chatModel ? { chatModel: parseModelKey(command.chatModel) } : {}),
+            ...(command.briefModel ? { briefModel: parseModelKey(command.briefModel) } : {}),
+        },
+    });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    writeLine(io.stdout, "Saved your model choices.");
+    for (const line of renderPersonal(body))
+        writeLine(io.stdout, line);
+    return 0;
+}
+// ── switches ──────────────────────────────────────────────────────────
+async function showSwitches(command, tower, io) {
+    const result = await callTower(tower, {
+        path: "/api/settings/switches",
+        label: "settings switches",
+    });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    return writeBody(io, command.json, result.body, () => renderSwitches(asRecord(result.body)));
+}
+async function setSwitch(command, tower, io) {
+    const result = await callTower(tower, {
+        path: "/api/settings/switches",
+        method: "POST",
+        label: "settings switches set",
+        body: { key: command.switchKey, value: command.switchValue },
+    });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    writeLine(io.stdout, `Switch ${String(body.key)} is now ${String(body.value)}.`);
+    return 0;
+}
+// ── models (org-wide) ─────────────────────────────────────────────────
+async function showModels(command, tower, io) {
+    const result = await callTower(tower, {
+        path: "/api/settings/model-routing",
+        label: "settings models",
+    });
+    if (!result.ok) {
+        if (isForbidden(result) && !command.json) {
+            writeLine(io.stderr, "The org-wide model map is admin only.");
+            return 1;
+        }
+        return writeCommandFailure(io, command.json, result);
+    }
+    return writeBody(io, command.json, result.body, () => renderModelRouting(asRecord(result.body)));
+}
+async function setModels(command, tower, io) {
+    const result = await callTower(tower, {
+        path: "/api/settings/model-routing",
+        method: "POST",
+        label: "settings models set",
+        body: {
+            ...(command.orgChatModel ? { chatModel: parseModelKey(command.orgChatModel) } : {}),
+            ...(command.orgMemoryModel ? { memoryModel: command.orgMemoryModel } : {}),
+        },
+    });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    writeLine(io.stdout, `Saved: ${asList(body.saved).join(", ") || "nothing"}.`);
+    return 0;
+}
+// ── env files ─────────────────────────────────────────────────────────
+async function listEnvBlobs(command, tower, io) {
+    const result = await callTower(tower, {
+        path: "/api/settings/env-blobs",
+        label: "settings env list",
+    });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    return writeBody(io, command.json, result.body, () => renderEnvBlobs(asRecord(result.body)));
+}
+/**
+ * Content arrives on stdin and leaves in the request body. It is never printed,
+ * never logged, and never an argument — the log line below carries the byte
+ * count and nothing else.
+ *
+ * Works the same on both supported hosts: `cat <path> | cockpit settings env set
+ * …` on macOS, `Get-Content <path> -Raw | cockpit settings env set …` in
+ * PowerShell. No shell built-ins, no here-strings, no process substitution.
+ */
+async function setEnvBlob(command, tower, io) {
+    if (isInteractiveStdin(io)) {
+        const failure = {
+            reason: "content_not_piped",
+            detail: "settings env set reads the file from stdin. Pipe it in: " +
+                "`cat <path> | cockpit settings env set --project <project> --file <name> --content-stdin` " +
+                "(PowerShell: `Get-Content <path> -Raw | cockpit settings env set …`).",
+        };
+        return writeCommandFailure(io, command.json, failure);
+    }
+    const content = await readAllStdin(io.stdin);
+    if (!content.trim()) {
+        return writeCommandFailure(io, command.json, {
+            reason: "content_empty",
+            detail: "Nothing arrived on stdin, so there is nothing to store.",
+        });
+    }
+    const result = await callTower(tower, {
+        path: "/api/settings/env-blobs",
+        method: "POST",
+        label: "settings env set",
+        body: { project: command.envProject, file_name: command.envFile, content },
+    });
+    writeLine(io.stderr, `[settings cli] env upload ${JSON.stringify({
+        project: command.envProject,
+        file: command.envFile,
+        byte_size: Buffer.byteLength(content, "utf8"),
+        outcome: result.ok ? "stored" : result.reason,
+    })}`);
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, blob: body.blob ?? null }));
+        return 0;
+    }
+    writeLine(io.stdout, `Stored ${String(command.envFile)} for ${String(command.envProject)}.`);
+    return 0;
+}
+async function deleteEnvBlob(command, tower, io) {
+    const confirmed = await confirmDestructive(command, io, `Delete env file ${command.envId}? [Y/n] `, "settings env delete");
+    if (!confirmed.ok)
+        return writeCommandFailure(io, command.json, confirmed);
+    const result = await callTower(tower, {
+        path: "/api/settings/env-blobs",
+        method: "DELETE",
+        label: "settings env delete",
+        body: { id: command.envId },
+    });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, deleted_id: body.deleted_id ?? null }));
+        return 0;
+    }
+    writeLine(io.stdout, `Deleted env file ${String(body.deleted_id ?? command.envId)}.`);
+    return 0;
+}
+/**
+ * The short way to say `settings personal --chat-model` (BLI-3457 S6).
+ *
+ * It exists because "which model am I talking to?" is the question people
+ * actually ask, and making them remember it lives under `settings personal`
+ * is the kind of friction that stops a surface being used at all.
+ */
+export async function runModel(command, io) {
+    const tower = await openTower("model", command, io);
+    if (command.action === "show") {
+        const result = await callTower(tower, {
+            path: "/api/settings/jarvis-model",
+            label: "model show",
+        });
+        if (!result.ok)
+            return writeCommandFailure(io, command.json, result);
+        const body = asRecord(result.body);
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+            return 0;
+        }
+        writeLine(io.stdout, `chat model:  ${modelKeyOf(body.chatModel)}`);
+        writeLine(io.stdout, `brief model: ${modelKeyOf(body.briefModel)}`);
+        return 0;
+    }
+    const result = await callTower(tower, {
+        path: "/api/settings/jarvis-model",
+        method: "POST",
+        label: "model set",
+        body: { chatModel: parseModelKey(command.modelKey ?? "") },
+    });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    writeLine(io.stdout, `Chat model is now ${modelKeyOf(body.chatModel)}.`);
+    return 0;
+}
+export function modelKeyOf(value) {
+    const pair = asRecord(value);
+    if (typeof pair.provider === "string" && typeof pair.model === "string") {
+        return `${pair.provider}:${pair.model}`;
+    }
+    return "unset";
+}
+// ── shared ────────────────────────────────────────────────────────────
+function writeBody(io, json, body, render) {
+    if (json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...asRecord(body) }));
+        return 0;
+    }
+    for (const line of render())
+        writeLine(io.stdout, line);
+    return 0;
+}
+/**
+ * A destructive step answers to `--yes` or to a person at a keyboard, and to
+ * nothing else. A headless run without `--yes` is refused by name rather than
+ * blocking forever on a stdin nobody is typing into.
+ */
+export async function confirmDestructive(command, io, prompt, label) {
+    if (command.yes)
+        return { ok: true };
+    if (command.json || !isInteractiveStdin(io)) {
+        return {
+            ok: false,
+            reason: "confirmation_required",
+            detail: `${label} changes something that cannot be undone. Re-run it with --yes.`,
+        };
+    }
+    const answer = await readLine(io, prompt);
+    if (yesByDefault(answer))
+        return { ok: true };
+    return {
+        ok: false,
+        reason: "declined",
+        detail: `${label} was cancelled.`,
+    };
+}