@bli-cockpit/cli 0.2.40 → 0.2.42

package/dist/commands/local-args.js

@@ -1009,16 +1009,45 @@ function parseBriefArgs(args) {
             "--full",
             "--versions",
             "--claims",
+            "--reason",
+            "--wait",
+            "--no-wait",
             "--json",
         ],
-        valueFlags: ["--home", "--dashboard-url", "--for", "--as", "--version"],
+        valueFlags: ["--home", "--dashboard-url", "--for", "--as", "--version", "--reason"],
     });
-    assertNoPositionals(values.positionals, "brief");
+    // Bare `cockpit brief` reads the page, which is what somebody typing it almost
+    // always wants — the same shape `cockpit notes` and `cockpit scout` have.
+    const first = values.positionals[0];
+    const action = (first === undefined ? "read" : first);
+    if (!["read", "edit", "rewrite"].includes(action)) {
+        throw new Error(`Unknown brief command: ${first}. Try edit or rewrite, or nothing to read it.`);
+    }
+    if (values.positionals.length > (first === undefined ? 0 : 1)) {
+        throw new Error(`brief ${action} does not take "${values.positionals[1]}".`);
+    }
     const tldr = values.booleans.has("--tldr");
     const full = values.booleans.has("--full");
     if (tldr && full) {
         throw new Error("brief accepts either --tldr or --full, not both.");
     }
+    const wait = values.booleans.has("--wait");
+    const noWait = values.booleans.has("--no-wait");
+    if (wait && noWait) {
+        throw new Error("brief rewrite accepts either --wait or --no-wait, not both.");
+    }
+    const reason = optionalNonEmpty(values.flags.get("--reason"));
+    if (reason && reason.length > 280) {
+        // The server's own ceiling (`REASON_MAX`). Said here so the person is told
+        // before the page is opened rather than after they have finished editing.
+        throw new Error("A reason is limited to 280 characters.");
+    }
+    if (action !== "edit" && reason) {
+        throw new Error("--reason belongs to `cockpit brief edit`.");
+    }
+    if (action !== "rewrite" && (wait || noWait)) {
+        throw new Error("--wait and --no-wait belong to `cockpit brief rewrite`.");
+    }
     // `--as` is accepted as an alias so the two conversational commands read the
     // same way; `cockpit jarvis --as <person>` has meant this since BLI-3380.
     const forPerson = optionalNonEmpty(values.flags.get("--for"));
@@ -1028,6 +1057,7 @@ function parseBriefArgs(args) {
     }
     return {
         kind: "brief",
+        action,
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
         subject: forPerson ?? asPerson,
@@ -1035,6 +1065,10 @@ function parseBriefArgs(args) {
         tldr,
         versions: values.booleans.has("--versions"),
         claims: values.booleans.has("--claims"),
+        ...(reason ? { reason } : {}),
+        // Waiting is the default; only an explicit `--no-wait` turns it off. A
+        // person who typed `rewrite` wants the page, not a receipt.
+        ...(noWait ? { wait: false } : {}),
         json: values.booleans.has("--json"),
     };
 }

package/dist/commands/local-discovery.js

@@ -38,6 +38,26 @@ export async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
         throw new Error(message);
     }
     if (worktrees.length === 0 && !discovery.allowEmpty) {
+        // "No git repos found" is only true when the scan could actually SEE
+        // everywhere it looked. With unreadable folders in hand, the sentence sent
+        // the operator to the wrong repair — "run from a git repo", when the repos
+        // may be sitting right there behind a permission wall (BLI-3483). The
+        // warning above prints the folders; this refusal has to carry the fact,
+        // because it is the line that ends the command.
+        if (result.unreadable_dirs.length > 0) {
+            console.error("[local-discovery] scan found no repos while folders were unopenable", JSON.stringify({
+                reason: "empty_scan_with_unreadable_dirs",
+                unreadable_dir_count: result.unreadable_dirs.length,
+                codes: [...new Set(result.unreadable_dirs.map((dir) => dir.code))],
+            }));
+            throw new Error([
+                `No git repos found, and ${result.unreadable_dirs.length} folder(s) could not be opened — so this is not proof there are none.`,
+                ...(io
+                    ? ["The folders are listed in the warning above."]
+                    : ["Run `cockpit doctor` to see which folders."]),
+                "Fix the permissions on those folders and run the command again, or point --workspace at the project folders you can read.",
+            ].join("\n"));
+        }
         throw new Error("No git repos found. Run from a git repo, or from a parent folder containing git repos.");
     }
     return worktrees;

package/dist/commands/local-help.js

@@ -60,7 +60,7 @@ export function localCommandHelp(command) {
         "  cockpit settings [personal [--chat-model <key>] [--brief-model <key>] | switches [set <key> <value>] | models [set --chat <key>] [--memory <id>] | env list|set --project <p> --file <f> --content-stdin|delete --id <uuid> [--yes]] [--json]",
         "  cockpit team [members | invite <email> --role <role> [--team-id <uuid>] | role <userId> --role <role> [--yes]] [--json]",
         "  cockpit workbook [<project> [<doc>]] [--section <id>] [--markdown] [--width <n>] [--dashboard-url <url>] [--json]",
-        "  cockpit brief [--for <person>] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--dashboard-url <url>] [--json]",
+        "  cockpit brief [edit|rewrite] [--for <person>] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
         "  cockpit notes [list|show <id>|shelf|shelves|upload <paths...>|paste|share <id>|unshare <id>|move <id>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--yes] [--dashboard-url <url>] [--json]",
         "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
@@ -326,7 +326,7 @@ function localSubcommandHelp(command) {
         [
             "brief",
             [
-                "Usage: cockpit brief [--for <person>] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--dashboard-url <url>] [--json]",
+                "Usage: cockpit brief [edit|rewrite] [--for <person>] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
                 "",
                 "Prints the TODAY page — the same page the Tower website shows, rendered for a terminal.",
                 "--for opens somebody else's page; the website's own rule decides whether you may, and it refuses in plain words when you may not.",
@@ -334,6 +334,17 @@ function localSubcommandHelp(command) {
                 "--version <pageId> steps back to one exact earlier version; --versions lists them with their ids.",
                 "--claims prints the [claimId] beside every line, which is what `cockpit correct --claim` takes.",
                 "Reading it here counts as opening it, exactly as opening it in a browser does.",
+                "",
+                "edit — opens the page in $VISUAL/$EDITOR as a document: one [claimId] line per sentence you may rewrite, everything else a # comment. Change the words after an id, save, close. Only the lines that really changed are sent, so an accidental save writes nothing.",
+                "  An id you delete or invent is refused by name BEFORE anything is sent: a missing line reads as no opinion at all, not as a sentence to remove, and Tower cannot tell those apart.",
+                "  --reason \"<why>\" rides on every row, exactly like a commit message. Optional; the before-and-after already teaches on its own.",
+                "  With no editor, or with something piped in, the edited document is read from stdin instead — `cockpit brief edit < page.md`.",
+                "  The edit IS the correction: each changed line is filed in the ledger before the page is republished, so a publish that falls over never costs you the edit.",
+                "",
+                "rewrite — asks Tower to compile the page again and waits for the new version. Writing a page takes minutes, so this queues the work and watches your page rather than holding one long request open.",
+                "  --no-wait returns as soon as the ask is on the record. Waiting is the default.",
+                "  Running out of patience is not a failure and says so: the work is still going, and `cockpit brief` will show it when it lands.",
+                "  Whose page you may ask about is the website's own rule — your own always, anybody's if you are an admin.",
                 "The command uses the existing paired device identity. Run `cockpit login` first if this machine is not paired.",
             ],
         ],

package/dist/commands/local.js

@@ -22,6 +22,9 @@
  *   workbook.ts          `cockpit workbook` — the project document library
  *                        (+ workbook-render.ts, the pure layout half)
  *   brief.ts             `cockpit brief` — the TODAY page in the terminal
+ *   brief-edit.ts        `cockpit brief edit` — rewrite it like a document
+ *   brief-rewrite.ts     `cockpit brief rewrite` — have Tower compile it again
+ *   editor.ts            the one place a person's own $EDITOR is spawned
  *   correct.ts           `cockpit correct` — one line on it is wrong
  *   notes.ts             `cockpit notes` — the meeting-notes surface, typed
  *   notes-file.ts        the local screen a note file passes before it is sent
@@ -52,6 +55,8 @@ import { runTeam } from "./team.js";
 import { asRecord, callTower, openTower } from "./tower-command.js";
 import { runWorkbook } from "./workbook.js";
 import { runBrief } from "./brief.js";
+import { runBriefEdit } from "./brief-edit.js";
+import { runBriefRewrite } from "./brief-rewrite.js";
 import { runCorrect } from "./correct.js";
 import { runNotes } from "./notes.js";
 import { createCollectorServer } from "../server.js";
@@ -133,6 +138,14 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
             case "workbook":
                 return await runWorkbook(command, io);
             case "brief":
+                // BLI-3458 S2.7/S2.8: `edit` and `rewrite` are the two PANEL actions
+                // reaching the terminal. Dispatched here rather than inside `brief.ts`
+                // so each one stays its own module — `brief.ts` owns reading and
+                // nothing else.
+                if (command.action === "edit")
+                    return await runBriefEdit(command, io);
+                if (command.action === "rewrite")
+                    return await runBriefRewrite(command, io);
                 return await runBrief(command, io);
             case "correct":
                 return await runCorrect(command, io);
@@ -155,6 +168,17 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
         }
     }
     catch (error) {
+        // The outermost net under every subcommand. It printed `error.message` and
+        // dropped the name, the code, the syscall and the cause — and never said
+        // WHICH subcommand died, so a scheduled `cockpit sync` and a hand-typed
+        // `cockpit doctor` failing the same way were indistinguishable in
+        // sync.err.log (BLI-3483). The human line is unchanged; the structured one
+        // beside it carries names and codes only, scrubbed by `describeError`.
+        console.error("[cockpit-cli] command failed", JSON.stringify({
+            reason: "command_failed",
+            command: command.kind,
+            ...describeError(error),
+        }));
         writeLine(io.stderr, errorMessage(error));
         return 1;
     }
@@ -1115,8 +1139,26 @@ async function runAutostartSelfHealAfterSync(command, io, dashboardUrl) {
     let result;
     try {
         const rawExec = io.exec;
-        if (!rawExec)
+        if (!rawExec) {
+            // BLI-3483: this was a bare `return`. On Windows the self-heal is the
+            // only thing that puts a broken scheduler back, so abandoning it here
+            // meant a machine could stop collecting forever and leave no receipt
+            // anywhere — the exact shape the fleet contract forbids. The packed CLI
+            // always supplies a runner (`commands/cli-io.ts`), so this fires only for
+            // an embedder that built its own `io`; it costs one line either way.
+            console.error("[autostart-self-heal] no process runner on this io; the repair could not be attempted", JSON.stringify({
+                reason: "runner_unavailable",
+                platform: process.platform,
+                next_action: "reinstall the CLI (npm i -g @bli-cockpit/cli) and run `cockpit autostart install`",
+            }));
+            result = {
+                status: "skipped",
+                reason: "runner_unavailable",
+                detail: "No process runner available to this CLI invocation; run `cockpit autostart install` by hand.",
+            };
+            await reportAutostartSelfHealOutcome(command, io, dashboardUrl, result);
             return;
+        }
         const spawnEnv = envWithNodeRuntimeOnPath(io.env ?? process.env);
         const exec = (cmd, args, options) => rawExec(cmd, args, { ...options, env: options?.env ?? spawnEnv });
         result = await runAutostartSelfHeal(getCollectorRuntimePaths(command.homeDir), {
@@ -1137,6 +1179,10 @@ async function runAutostartSelfHealAfterSync(command, io, dashboardUrl) {
     // throttle are silent; an actual repair attempt reports either way.
     if (!result || result.reason === "repair_throttled_recent_attempt")
         return;
+    await reportAutostartSelfHealOutcome(command, io, dashboardUrl, result);
+}
+/** One receipt for the repair, whichever branch above produced the outcome. */
+async function reportAutostartSelfHealOutcome(command, io, dashboardUrl, result) {
     await reportInstallEventsBestEffort({
         homeDir: command.homeDir,
         dashboardUrl,

package/dist/commands/notes.js

@@ -293,8 +293,14 @@ async function pasteNote(command, door) {
         form.set("name", command.name);
     if (command.exclude)
         form.set("exclusions", command.exclude);
-    if (text.length >= NOTE_SLOW_UPLOAD_BYTES) {
-        writeLine(door.io.stderr, `Reading ${Math.round(text.length / 1024)} KB of pasted text. This can take a couple of minutes.`);
+    // Bytes, not `.length` (BLI-3482). `NOTE_SLOW_UPLOAD_BYTES` is a BYTE
+    // threshold, and the file path above already compares `bytes.byteLength`
+    // against it; `text.length` counts UTF-16 units, so a note in any non-Latin
+    // script was measured at a third to a half of the size actually being sent
+    // and the "this will take a while" line stayed silent through the wait.
+    const pastedBytes = Buffer.byteLength(text, "utf8");
+    if (pastedBytes >= NOTE_SLOW_UPLOAD_BYTES) {
+        writeLine(door.io.stderr, `Reading ${Math.round(pastedBytes / 1024)} KB of pasted text. This can take a couple of minutes.`);
     }
     const answer = await ask(door, {
         path: "/api/notes/upload",
@@ -311,6 +317,7 @@ async function pasteNote(command, door) {
         note_id: body.noteId ?? null,
         scope: body.scope ?? null,
         chars: text.length,
+        byte_size: pastedBytes,
         named_by_caller: Boolean(command.name),
     })}`);
     if (door.json)

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.40");
+    writeLine(io?.stdout ?? process.stdout, "0.2.42");
     return 0;
   }
 

package/dist/commands/scout-render.js

@@ -15,12 +15,15 @@
  * **A bounded read says so.** The server returns at most 8 cards and 12
  * signals; when there are more, `truncationLines` prints how many. A quiet
  * board and a truncated board must never look alike.
+ *
+ * **Styling arrives as an argument, never as a global.** `styled` says whether
+ * this run's stdout is a terminal that asked for colour (BLI-3482); `scout.ts`
+ * decides it once with `colorEnabled(io)` and the layout stays deterministic.
  */
-const DIM = "\x1b[2m";
-const RESET = "\x1b[0m";
+import { dim } from "./cli-io.js";
 // ------------------------------------------------------------------ rendering
 /** The whole board as terminal lines, in the page's three sections and order. */
-export function renderScoutBoard(payload) {
+export function renderScoutBoard(payload, styled) {
     const board = payload.board ?? {};
     const lines = payload.lines ?? {};
     const out = [];
@@ -35,7 +38,7 @@ export function renderScoutBoard(payload) {
     }
     else {
         for (const card of experiments)
-            out.push(...renderExperiment(card));
+            out.push(...renderExperiment(card, styled));
     }
     const settled = board.settled ?? [];
     if (settled.length > 0) {
@@ -51,14 +54,14 @@ export function renderScoutBoard(payload) {
     }
     else {
         for (const signal of signals)
-            out.push(...renderSignal(signal));
+            out.push(...renderSignal(signal, styled));
     }
     const truncation = truncationLines(board);
     if (truncation.length > 0)
         out.push("", ...truncation);
     return out;
 }
-function renderExperiment(card) {
+function renderExperiment(card, styled) {
     const sourceCount = card.sourceCount ?? 0;
     const head = [
         shortId(card.id ?? ""),
@@ -74,23 +77,25 @@ function renderExperiment(card) {
     if (card.claimSummary)
         out.push(`    ${card.claimSummary}`);
     if (card.title)
-        out.push(dim(`    ${card.title}`));
+        out.push(dim(`    ${card.title}`, styled));
     for (const row of card.crossref ?? []) {
-        if (row.person)
-            out.push(dim(`    On your team · ${row.person} · ${row.observedPattern ?? ""}`));
+        if (row.person) {
+            out.push(dim(`    On your team · ${row.person} · ${row.observedPattern ?? ""}`, styled));
+        }
     }
     if (card.expectedPayoff)
-        out.push(dim(`    Worth trying · ${card.expectedPayoff}`));
+        out.push(dim(`    Worth trying · ${card.expectedPayoff}`, styled));
     for (const source of card.sources ?? []) {
-        if (source.title)
-            out.push(dim(`    ${source.title} · ${source.source ?? ""} · ${source.url ?? ""}`));
+        if (source.title) {
+            out.push(dim(`    ${source.title} · ${source.source ?? ""} · ${source.url ?? ""}`, styled));
+        }
     }
     return out;
 }
-function renderSignal(signal) {
+function renderSignal(signal, styled) {
     const out = [`  ⏺ ${signal.title ?? "untitled"} · ${dayStamp(signal.gatheredAt)}`];
     if (signal.synopsis)
-        out.push(dim(`    ${signal.synopsis}`));
+        out.push(dim(`    ${signal.synopsis}`, styled));
     const foot = [
         signal.source,
         signal.evidenceStrength ?? undefined,
@@ -99,7 +104,7 @@ function renderSignal(signal) {
         signal.url,
     ].filter((part) => Boolean(part));
     if (foot.length > 0)
-        out.push(dim(`    ${foot.join(" · ")}`));
+        out.push(dim(`    ${foot.join(" · ")}`, styled));
     return out;
 }
 /**
@@ -164,9 +169,6 @@ export function shortId(id) {
 function dayStamp(iso) {
     return iso ? iso.slice(0, 10) : "";
 }
-function dim(text) {
-    return `${DIM}${text}${RESET}`;
-}
 function indent(text) {
     return `  ${text}`;
 }

package/dist/commands/scout.js

@@ -16,7 +16,7 @@
  * as the page is; moving a card is super_admin whichever surface asks, and a
  * refusal never costs a person the board.
  */
-import { writeLine } from "./cli-io.js";
+import { colorEnabled, writeLine } from "./cli-io.js";
 import { renderScoutBoard, resolveExperimentRef, refusalSentence, shortId, truncationLines, } from "./scout-render.js";
 import { loadPairedSession, towerFailureDetail, towerJsonRequest, } from "../tower-client.js";
 /** The dashboard route caps nothing here, but a board read should never hang a shell. */
@@ -49,7 +49,7 @@ export async function runScout(command, io) {
             writeLine(io.stdout, JSON.stringify({ ok: true, audience: payload.audience ?? null, windowDays: payload.windowDays ?? board.windowDays ?? null, board, lines }));
         }
         else {
-            for (const line of renderScoutBoard(payload))
+            for (const line of renderScoutBoard(payload, colorEnabled(io)))
                 writeLine(io.stdout, line);
         }
         writeLine(io.stderr, `[scout cli] board read ${JSON.stringify({
@@ -78,7 +78,7 @@ export async function runScout(command, io) {
         }
         else {
             writeLine(io.stderr, sentence);
-            for (const line of renderScoutBoard(payload))
+            for (const line of renderScoutBoard(payload, colorEnabled(io)))
                 writeLine(io.stdout, line);
         }
         return 1;
@@ -119,7 +119,7 @@ export async function runScout(command, io) {
         if (applied.httpStatus === 403) {
             writeLine(io.stderr, "Deciding a Scout card is a super_admin action; reading the board is not.");
         }
-        for (const line of renderScoutBoard(payload))
+        for (const line of renderScoutBoard(payload, colorEnabled(io)))
             writeLine(io.stdout, line);
         return 1;
     }

package/dist/commands/sessions.js

@@ -71,9 +71,16 @@ export async function runSessions(command, io) {
             reason: sidecar.skipped_reason,
         })),
     }));
+    // BLI-3483: the scanners have always counted the folders and files they
+    // could not read, and this command has always thrown those counts away
+    // except for one field in `--json`. So "No sessions observed" was printed on
+    // a machine where the scan had been blocked from looking — the operator's
+    // one diagnostic tool answering the question with the failure removed.
+    const readFailures = countReadFailures(codex, claude);
     if (command.json) {
         writeLine(io.stdout, JSON.stringify({
             window,
+            read_failures: readFailures,
             ...(codex
                 ? { codex: { counts: codex.counts, sessions: codexRows } }
                 : {}),
@@ -101,10 +108,47 @@ export async function runSessions(command, io) {
         }
     }
     if (codexRows.length === 0 && claudeRows.length === 0) {
-        writeLine(io.stdout, "No sessions observed in the scan window.");
+        writeLine(io.stdout, readFailures.total > 0
+            ? `No sessions listed, but ${readFailures.total} read failure(s) mean the scan could not see everywhere — this is not proof there were none.`
+            : "No sessions observed in the scan window.");
+    }
+    if (readFailures.total > 0) {
+        for (const line of readFailureLines(readFailures)) {
+            writeLine(io.stdout, line);
+        }
     }
     return 0;
 }
+/**
+ * Everything the two scanners looked at and could not read. Counts only — the
+ * project-dir slug encodes a local path and never leaves this machine.
+ */
+function countReadFailures(codex, claude) {
+    const failures = {
+        codex_directory_read_failed: codex?.directory_read_failed_count ?? 0,
+        codex_stat_failed: codex?.stat_failed_count ?? 0,
+        codex_secret_path_skipped: codex?.secret_path_skipped_count ?? 0,
+        claude_project_dir_read_failed: claude?.project_dir_read_failed_count ?? 0,
+        claude_project_dirs_skipped: claude?.project_dirs_skipped ?? 0,
+        claude_session_stat_failed: claude?.session_stat_failed_count ?? 0,
+        claude_sidecar_dir_read_failed: claude?.sidecar_dir_read_failed_count ?? 0,
+        claude_sidecar_stat_failed: claude?.sidecar_stat_failed_count ?? 0,
+    };
+    return {
+        total: Object.values(failures).reduce((sum, count) => sum + count, 0),
+        ...failures,
+    };
+}
+function readFailureLines(failures) {
+    const named = Object.entries(failures)
+        .filter(([field, count]) => field !== "total" && Number(count) > 0)
+        .map(([field, count]) => `  ${field}: ${count}`);
+    return [
+        `read failures during this scan (${failures.total}) — sessions under these are not listed:`,
+        ...named,
+        "  a permission wall is the usual cause; on macOS grant Full Disk Access, on Windows check the folder ACL",
+    ];
+}
 /** `--all`, an explicit `--since-days` capped at pairing, or the default window. */
 async function sessionsScanWindow(command, now) {
     if (command.all) {

package/dist/commands/settings-render.js

@@ -8,7 +8,12 @@
  * Every one of these is defensive about shape on purpose. These bodies come off
  * the wire from a dashboard that may be a release ahead or behind the installed
  * CLI, and a missing field should cost one line of output, not the command.
+ *
+ * Columns are padded in SCREEN CELLS, not UTF-16 code units (BLI-3482) — a
+ * display name written in another script is exactly the row where `padEnd`
+ * silently stops lining up.
  */
+import { padEndDisplay } from "./text-width.js";
 const INDENT = "  ";
 function text(value, fallback = "—") {
     if (typeof value === "string" && value.trim())
@@ -82,7 +87,7 @@ export function renderTeamMembers(body) {
     for (const person of people) {
         const standing = text(person.standing, "");
         const name = text(person.displayName, text(person.email));
-        lines.push(`${INDENT}${name.padEnd(28)} ${text(person.role, "—").padEnd(20)} ${standing}`);
+        lines.push(`${INDENT}${padEndDisplay(name, 28)} ${padEndDisplay(text(person.role, "—"), 20)} ${standing}`);
         if (typeof person.userId === "string") {
             lines.push(`${INDENT}${INDENT}id ${person.userId}`);
         }
@@ -101,7 +106,7 @@ export function renderSwitches(body) {
         const options = Array.isArray(entry.options)
             ? entry.options.map((option) => text(record(option).value)).join(" | ")
             : "";
-        return `${INDENT}${text(entry.key).padEnd(24)} ${text(entry.value).padEnd(12)} (${text(entry.source)}${options ? `; choices: ${options}` : ""})`;
+        return `${INDENT}${padEndDisplay(text(entry.key), 24)} ${padEndDisplay(text(entry.value), 12)} (${text(entry.source)}${options ? `; choices: ${options}` : ""})`;
     });
     if (typeof body.readFailureReason === "string") {
         lines.push(`${INDENT}values could not be read: ${body.readFailureReason}`);
@@ -114,7 +119,7 @@ export function renderModelRouting(body) {
         `${INDENT}memory  ${text(body.memoryEffectiveLabel)} (${text(body.memorySource)}${typeof body.memoryVia === "string" ? ` via ${body.memoryVia}` : ""})`,
     ];
     for (const slot of list(body.displaySlots)) {
-        lines.push(`${INDENT}${text(slot.name).padEnd(24)} ${text(slot.currentLabel)} — set in code (${text(slot.pointer)})`);
+        lines.push(`${INDENT}${padEndDisplay(text(slot.name), 24)} ${text(slot.currentLabel)} — set in code (${text(slot.pointer)})`);
     }
     if (typeof body.readFailureReason === "string") {
         lines.push(`${INDENT}settings could not be read: ${body.readFailureReason}`);
@@ -132,6 +137,6 @@ export function renderEnvBlobs(body) {
     const blobs = list(body.blobs);
     if (blobs.length === 0)
         return [`${INDENT}no env files stored`];
-    return blobs.map((blob) => `${INDENT}${text(blob.project).padEnd(12)} ${text(blob.file_name).padEnd(16)} ` +
+    return blobs.map((blob) => `${INDENT}${padEndDisplay(text(blob.project), 12)} ${padEndDisplay(text(blob.file_name), 16)} ` +
         `updated ${text(blob.updated_at)}  id ${text(blob.id)}`);
 }

package/dist/commands/settings.js

@@ -213,6 +213,12 @@ async function setModels(command, tower, io) {
         return 0;
     }
     writeLine(io.stdout, `Saved: ${asList(body.saved).join(", ") || "nothing"}.`);
+    // BLI-3481: the save succeeded but the belt pre-flight could not reach the
+    // provider, so nobody has checked that the model just chosen will accept
+    // Tower's tool belt. A bare "Saved." there would be a silent success.
+    if (typeof body.warning === "string" && body.warning.length > 0) {
+        writeLine(io.stderr, body.warning);
+    }
     return 0;
 }
 // ── env files ─────────────────────────────────────────────────────────

package/dist/commands/text-width.js

@@ -0,0 +1,108 @@
+/**
+ * How wide a string is ON SCREEN, in terminal cells (BLI-3482).
+ *
+ * `"".length` counts UTF-16 code units, which is the wrong number twice over
+ * for a column: an emoji costs two units and draws two cells, a CJK ideograph
+ * costs one unit and draws two, and a combining accent costs one unit and draws
+ * nothing. Padding by `.length` therefore ragged-edges any table whose cells are
+ * not plain ASCII — the failure a person sees is a column that no longer lines
+ * up, on exactly the rows that carry a name or a title in another script.
+ *
+ * This is a deliberately small wcwidth, not the real one, and its limits are
+ * honest:
+ *
+ * - The wide ranges below are the common East Asian Wide/Fullwidth blocks plus
+ *   the main emoji planes. Ambiguous-width characters (box drawing, `⏺`, Greek,
+ *   Cyrillic) are counted as ONE cell, which is what a Western-locale terminal
+ *   draws; a CJK-locale terminal may draw some of them as two.
+ * - A ZWJ emoji sequence (👨‍👩‍👧) is measured as the sum of its parts, so it
+ *   over-counts on terminals that draw the whole cluster in two cells. Nothing
+ *   here inspects grapheme clusters; that needs `Intl.Segmenter` and a real
+ *   emoji table, which is more machinery than a column deserves.
+ * - U+FE0F (emoji presentation) is counted as zero, so a text-default symbol
+ *   promoted to emoji presentation is under-counted by one.
+ *
+ * Every one of those errors costs alignment, never content: nothing in this
+ * file may drop, cut or reorder text.
+ */
+/** SGR colour sequences occupy no cells, so they are removed before counting. */
+// eslint-disable-next-line no-control-regex
+const ANSI_SGR = /\x1b\[[0-9;]*m/gu;
+/** Zero-cell code points: combining marks, joiners, variation selectors. */
+const ZERO_WIDTH = [
+    [0x0300, 0x036f], // combining diacritical marks
+    [0x0483, 0x0489],
+    [0x0591, 0x05bd],
+    [0x0610, 0x061a],
+    [0x064b, 0x065f],
+    [0x0670, 0x0670],
+    [0x06d6, 0x06dc],
+    [0x0e31, 0x0e31],
+    [0x0e34, 0x0e3a],
+    [0x0e47, 0x0e4e],
+    [0x1ab0, 0x1aff], // combining diacritical marks extended
+    [0x1dc0, 0x1dff], // combining diacritical marks supplement
+    [0x200b, 0x200f], // zero-width space through RTL mark (incl. ZWNJ, ZWJ)
+    [0x20d0, 0x20f0], // combining marks for symbols
+    [0xfe00, 0xfe0f], // variation selectors
+    [0xfe20, 0xfe2f], // combining half marks
+    [0xfeff, 0xfeff], // byte-order mark
+];
+/** Two-cell code points: the common Wide / Fullwidth blocks and emoji planes. */
+const WIDE = [
+    [0x1100, 0x115f], // Hangul Jamo
+    [0x2e80, 0x303e], // CJK radicals, Kangxi, CJK symbols and punctuation
+    [0x3041, 0x33ff], // Hiragana, Katakana, Bopomofo, Hangul Compatibility Jamo
+    [0x3400, 0x4dbf], // CJK Unified Ideographs Extension A
+    [0x4e00, 0x9fff], // CJK Unified Ideographs
+    [0xa000, 0xa4cf], // Yi
+    [0xa960, 0xa97f], // Hangul Jamo Extended-A
+    [0xac00, 0xd7a3], // Hangul syllables
+    [0xf900, 0xfaff], // CJK compatibility ideographs
+    [0xfe10, 0xfe19], // vertical forms
+    [0xfe30, 0xfe6f], // CJK compatibility forms
+    [0xff00, 0xff60], // fullwidth forms
+    [0xffe0, 0xffe6], // fullwidth signs
+    [0x1f300, 0x1f64f], // misc symbols and pictographs, emoticons
+    [0x1f680, 0x1f6ff], // transport and map symbols
+    [0x1f900, 0x1f9ff], // supplemental symbols and pictographs
+    [0x20000, 0x3fffd], // CJK Unified Ideographs Extensions B onward
+];
+function inRanges(code, ranges) {
+    for (const [low, high] of ranges) {
+        if (code < low)
+            return false; // ranges are ascending
+        if (code <= high)
+            return true;
+    }
+    return false;
+}
+/** Cells one code point draws: 0 for combining/invisible, 2 for wide, else 1. */
+export function codePointWidth(code) {
+    if (code === 0x0a || code === 0x0d)
+        return 0;
+    if (code < 0x20 || (code >= 0x7f && code < 0xa0))
+        return 0; // control characters
+    if (inRanges(code, ZERO_WIDTH))
+        return 0;
+    if (inRanges(code, WIDE))
+        return 2;
+    return 1;
+}
+/** Cells a string draws, ignoring any SGR colour sequences inside it. */
+export function displayWidth(text) {
+    let total = 0;
+    for (const character of text.replace(ANSI_SGR, "")) {
+        total += codePointWidth(character.codePointAt(0) ?? 0);
+    }
+    return total;
+}
+/**
+ * `padEnd` that counts cells instead of code units. Like `padEnd`, a string
+ * already at or past the column is returned untouched — a column is a minimum,
+ * never a limit, because cutting a cell to fit loses content.
+ */
+export function padEndDisplay(text, width) {
+    const missing = width - displayWidth(text);
+    return missing > 0 ? `${text}${" ".repeat(missing)}` : text;
+}