@bli-cockpit/cli 0.2.57 → 0.2.59

package/dist/commands/notes.js

@@ -22,20 +22,23 @@
  *    `--yes` without one. `--json` implies `--yes`, because a machine-readable
  *    run has nobody to ask and asking it to guess is worse than the flag it
  *    already typed the command for.
+ *
+ * This file is the dispatch table (BLI-3717 readability pass, 680 lines to a
+ * table of contents). Every responsibility lives in a `notes-*.ts` sibling:
+ *
+ *  - `notes-reads.ts` — the library, shelves list, one note, your own shelf.
+ *  - `notes-writes.ts` — upload, paste, share/unshare, move.
+ *  - `notes-door.ts` — the one HTTP request, and the shared answer / refusal /
+ *    emit / say-* rendering both halves above call.
+ *
+ * Every public name is still importable from this file.
  */
-import { isInteractiveStdin, readLine, readPipedText, writeLine, yesByDefault } from "./cli-io.js";
-import { NOTE_SLOW_UPLOAD_BYTES, decodeTextBytes, noteFileRefusalSentence, readNoteFile, } from "./notes-file.js";
-import { loadPairedSession, towerFailureDetail, towerRequest, } from "../tower-client.js";
-import { readResponseJson } from "../upload-http.js";
-/**
- * The upload route's own ceiling is `maxDuration = 300` — reading a note is one
- * model call over the whole file. The client waits slightly longer so the
- * server's named failure wins the race whenever it manages to send one.
- */
-const UPLOAD_DEADLINE_MS = 305_000;
-const READ_DEADLINE_MS = 60_000;
-const PASTE_MAX_CHARS = 2_000_000;
-const TAG = "[notes cli]";
+import { loadPairedSession } from "../tower-client.js";
+import { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
+import { uploadNotes, pasteNote, shareNote, moveNote } from "./notes-writes.js";
+export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
+export { uploadNotes, pasteNote, shareNote, moveNote } from "./notes-writes.js";
+export { ask, emit, fail, sayUpload, sayScope, errorText, TAG, } from "./notes-door.js";
 export async function runNotes(command, io) {
     const session = await loadPairedSession("notes", command.homeDir);
     const door = {
@@ -63,433 +66,4 @@ export async function runNotes(command, io) {
         case "move":
             return moveNote(command, door);
     }
-}
-function libraryQuery(command) {
-    const query = new URLSearchParams();
-    if (command.series)
-        query.set("series", command.series);
-    if (command.meetingKind)
-        query.set("kind", command.meetingKind);
-    if (command.since)
-        query.set("since", command.since);
-    if (command.until)
-        query.set("until", command.until);
-    if (command.limit !== undefined)
-        query.set("limit", String(command.limit));
-    const rendered = query.toString();
-    return rendered === "" ? "" : `?${rendered}`;
-}
-async function listNotes(command, door) {
-    const answer = await ask(door, {
-        path: `/api/notes/library${libraryQuery(command)}`,
-        method: "GET",
-        label: "notes list",
-        timeoutMs: READ_DEADLINE_MS,
-    });
-    if (!answer.ok)
-        return fail(door, answer.reason, answer.detail);
-    const body = answer.body;
-    if (door.json)
-        return emit(door, body);
-    sayScope(door, body);
-    const series = body.series ?? [];
-    if (series.length === 0) {
-        writeLine(door.io.stdout, "No meeting notes matched.");
-        return 0;
-    }
-    for (const one of series) {
-        writeLine(door.io.stdout, "");
-        writeLine(door.io.stdout, `${one.heading} (${one.notes.length})`);
-        for (const note of one.notes) {
-            const who = note.participants.length > 0 ? ` — ${note.participants.join(", ")}` : "";
-            writeLine(door.io.stdout, `  ${note.meetingDate}  ${note.id}  ${note.fileName}${who}`);
-        }
-    }
-    writeLine(door.io.stdout, "");
-    writeLine(door.io.stdout, `${body.count ?? 0} note(s)${body.more ? ", and more exist beyond the limit" : ""}.`);
-    return 0;
-}
-async function listShelves(command, door) {
-    const answer = await ask(door, {
-        path: `/api/notes/library${libraryQuery(command)}`,
-        method: "GET",
-        label: "notes shelves",
-        timeoutMs: READ_DEADLINE_MS,
-    });
-    if (!answer.ok)
-        return fail(door, answer.reason, answer.detail);
-    const body = answer.body;
-    const shelves = (body.series ?? []).map((one) => ({
-        shelf: one.heading,
-        notes: one.notes.length,
-        // A shelf somebody typed, rather than the one a kind implies. Only the
-        // first kind is reported: a shelf is free text and can hold any of them.
-        custom: (body.categories ?? []).includes(one.heading),
-    }));
-    if (door.json)
-        return emit(door, { scope: body.scope, shelves });
-    sayScope(door, body);
-    if (shelves.length === 0) {
-        writeLine(door.io.stdout, "No shelves yet.");
-        return 0;
-    }
-    for (const shelf of shelves) {
-        writeLine(door.io.stdout, `${String(shelf.notes).padStart(4)}  ${shelf.shelf}${shelf.custom ? "" : "  (from the meeting kind)"}`);
-    }
-    return 0;
-}
-async function showNote(command, door) {
-    const answer = await ask(door, {
-        path: `/api/notes/library/${encodeURIComponent(command.noteId ?? "")}`,
-        method: "GET",
-        label: "notes show",
-        timeoutMs: READ_DEADLINE_MS,
-    });
-    if (!answer.ok)
-        return fail(door, answer.reason, answer.detail);
-    const body = answer.body;
-    if (door.json)
-        return emit(door, body);
-    const note = body.note;
-    if (!note)
-        return fail(door, "no_note_in_answer", "Tower answered without a note.");
-    sayScope(door, body);
-    writeLine(door.io.stdout, note.title);
-    writeLine(door.io.stdout, `${note.meetingDate}  ·  ${note.shelf}  ·  ${note.fileName}  ·  ${note.lineCount} lines`);
-    if (note.participants.length > 0) {
-        writeLine(door.io.stdout, `In the room: ${note.participants.join(", ")}`);
-    }
-    writeLine(door.io.stdout, note.visibility);
-    writeLine(door.io.stdout, "");
-    writeLine(door.io.stdout, note.content);
-    return 0;
-}
-async function showShelf(command, door) {
-    const query = command.limit === undefined ? "" : `?limit=${command.limit}`;
-    const answer = await ask(door, {
-        path: `/api/notes/shelf${query}`,
-        method: "GET",
-        label: "notes shelf",
-        timeoutMs: READ_DEADLINE_MS,
-    });
-    if (!answer.ok)
-        return fail(door, answer.reason, answer.detail);
-    const body = answer.body;
-    if (door.json)
-        return emit(door, body);
-    sayScope(door, body);
-    const notes = body.notes ?? [];
-    if (notes.length === 0) {
-        writeLine(door.io.stdout, "You have not put any notes in yet.");
-        return 0;
-    }
-    for (const note of notes) {
-        const counts = note.countsKnown
-            ? `${note.statements} statements, ${note.openToTheTeam} open to the team, ${note.keptBack} kept back`
-            : "counts unknown on this server";
-        writeLine(door.io.stdout, `${note.meetingDate}  ${note.id}  ${note.shared ? "shared " : "yours  "}  ${note.name}`);
-        writeLine(door.io.stdout, `            ${counts}`);
-    }
-    return 0;
-}
-async function uploadNotes(command, door) {
-    const paths = command.paths ?? [];
-    const results = [];
-    let worstExit = 0;
-    for (const filePath of paths) {
-        // Read and screen locally BEFORE any network call — a refusal here never
-        // reaches the dashboard, same discipline as `cockpit jarvis --image`.
-        const read = await readNoteFile(filePath);
-        if (!read.ok) {
-            const sentence = noteFileRefusalSentence(read.refusal, filePath);
-            writeLine(door.io.stderr, `${TAG} file refused ${JSON.stringify({ reason: read.refusal, detail: read.detail })}`);
-            if (!door.json)
-                writeLine(door.io.stderr, sentence);
-            results.push({ path: filePath, ok: false, reason: read.refusal });
-            worstExit = 1;
-            continue;
-        }
-        if (read.bytes.byteLength >= NOTE_SLOW_UPLOAD_BYTES) {
-            // The route reads the whole note with one model call and may take
-            // minutes. A still cursor reads as a hang, so say what is happening.
-            writeLine(door.io.stderr, `Reading ${read.fileName} (${Math.round(read.bytes.byteLength / 1024)} KB). This can take a couple of minutes.`);
-        }
-        const form = new FormData();
-        form.set("file", new File([new Uint8Array(read.bytes)], read.fileName));
-        if (command.exclude)
-            form.set("exclusions", command.exclude);
-        const answer = await ask(door, {
-            path: "/api/notes/upload",
-            method: "POST",
-            label: "notes upload",
-            timeoutMs: UPLOAD_DEADLINE_MS,
-            body: form,
-        });
-        if (!answer.ok) {
-            writeLine(door.io.stderr, `${TAG} upload failed ${JSON.stringify({ reason: answer.reason })}`);
-            if (!door.json)
-                writeLine(door.io.stderr, `${read.fileName}: ${answer.detail}`);
-            results.push({ path: filePath, ok: false, reason: answer.reason });
-            worstExit = 1;
-            continue;
-        }
-        const body = answer.body;
-        results.push({ path: filePath, ok: body.stored === true, body });
-        if (body.stored !== true)
-            worstExit = 1;
-        if (!door.json)
-            sayUpload(door, body);
-        writeLine(door.io.stderr, `${TAG} upload answered ${JSON.stringify({
-            stored: body.stored === true,
-            note_id: body.noteId ?? null,
-            scope: body.scope ?? null,
-            byte_size: read.bytes.byteLength,
-            extension: read.extension,
-        })}`);
-    }
-    if (door.json) {
-        emit(door, { ok: worstExit === 0, uploaded: results.length, results });
-    }
-    return worstExit;
-}
-async function pasteNote(command, door) {
-    let text;
-    if (command.filePath) {
-        const read = await readNoteFile(command.filePath);
-        if (!read.ok) {
-            const sentence = noteFileRefusalSentence(read.refusal, command.filePath);
-            writeLine(door.io.stderr, `${TAG} file refused ${JSON.stringify({ reason: read.refusal, detail: read.detail })}`);
-            return fail(door, read.refusal, sentence);
-        }
-        const decoded = decodeTextBytes(read.bytes);
-        if (!decoded.ok) {
-            writeLine(door.io.stderr, `${TAG} file refused ${JSON.stringify({ reason: decoded.reason })}`);
-            return fail(door, decoded.reason, "That file is not text this command can decode (it may be a binary or an unusual encoding). Nothing was sent.");
-        }
-        text = decoded.text;
-    }
-    else {
-        if (isInteractiveStdin(door.io)) {
-            return fail(door, "nothing_piped", "Pass --file <path> (safest on Windows), or pipe the note in "
-                + "(`pbpaste | cockpit notes paste` on macOS; on Windows use PowerShell 7 — "
-                + "Windows PowerShell 5.1 turns non-ASCII into `?` on pipes).");
-        }
-        try {
-            text = await readPipedText(door.io.stdin, {
-                maxChars: PASTE_MAX_CHARS,
-                overflowMessage: `A pasted note is limited to ${PASTE_MAX_CHARS} characters. Save it to a file and use --file instead.`,
-            });
-        }
-        catch (error) {
-            return fail(door, "paste_too_long", errorText(error));
-        }
-    }
-    if (text.trim() === "") {
-        return fail(door, "empty_paste", "There was nothing to paste. Nothing was sent.");
-    }
-    const form = new FormData();
-    form.set("text", text);
-    if (command.name)
-        form.set("name", command.name);
-    if (command.exclude)
-        form.set("exclusions", command.exclude);
-    // Bytes, not `.length` (BLI-3482). `NOTE_SLOW_UPLOAD_BYTES` is a BYTE
-    // threshold, and the file path above already compares `bytes.byteLength`
-    // against it; `text.length` counts UTF-16 units, so a note in any non-Latin
-    // script was measured at a third to a half of the size actually being sent
-    // and the "this will take a while" line stayed silent through the wait.
-    const pastedBytes = Buffer.byteLength(text, "utf8");
-    if (pastedBytes >= NOTE_SLOW_UPLOAD_BYTES) {
-        writeLine(door.io.stderr, `Reading ${Math.round(pastedBytes / 1024)} KB of pasted text. This can take a couple of minutes.`);
-    }
-    const answer = await ask(door, {
-        path: "/api/notes/upload",
-        method: "POST",
-        label: "notes paste",
-        timeoutMs: UPLOAD_DEADLINE_MS,
-        body: form,
-    });
-    if (!answer.ok)
-        return fail(door, answer.reason, answer.detail);
-    const body = answer.body;
-    writeLine(door.io.stderr, `${TAG} paste answered ${JSON.stringify({
-        stored: body.stored === true,
-        note_id: body.noteId ?? null,
-        scope: body.scope ?? null,
-        chars: text.length,
-        byte_size: pastedBytes,
-        named_by_caller: Boolean(command.name),
-    })}`);
-    if (door.json)
-        return emit(door, body, body.stored === true ? 0 : 1);
-    sayUpload(door, body);
-    return body.stored === true ? 0 : 1;
-}
-async function shareNote(command, door) {
-    const wantsToShare = command.action === "share";
-    // Only sharing asks. Taking a note back narrows who can read it, and nobody
-    // needs to be talked out of that.
-    if (wantsToShare && !command.yes) {
-        if (!isInteractiveStdin(door.io)) {
-            return fail(door, "confirmation_required", "Sharing a note lets everyone signed in read it. Pass --yes to do it without being asked.");
-        }
-        const answer = await readLine(door.io, "Share this note with everyone signed in? [Y/n] ");
-        if (!yesByDefault(answer)) {
-            writeLine(door.io.stderr, `${TAG} share declined ${JSON.stringify({ reason: "operator_said_no" })}`);
-            writeLine(door.io.stdout, "Left alone. Nothing changed.");
-            return 0;
-        }
-    }
-    const answer = await ask(door, {
-        path: "/api/notes/share",
-        method: "POST",
-        label: wantsToShare ? "notes share" : "notes unshare",
-        timeoutMs: READ_DEADLINE_MS,
-        body: { note_id: command.noteId, share: wantsToShare },
-    });
-    if (!answer.ok)
-        return fail(door, answer.reason, answer.detail);
-    const body = answer.body;
-    writeLine(door.io.stderr, `${TAG} ${wantsToShare ? "shared" : "taken back"} ${JSON.stringify({
-        note_id: command.noteId ?? null,
-        stored: body.stored === true,
-    })}`);
-    if (door.json)
-        return emit(door, body);
-    sayUpload(door, body);
-    return 0;
-}
-async function moveNote(command, door) {
-    const answer = await ask(door, {
-        path: "/api/notes/move",
-        method: "POST",
-        label: "notes move",
-        timeoutMs: READ_DEADLINE_MS,
-        // `--clear-shelf` sends the empty string, which is what the browser's own
-        // move box sends when a person empties it.
-        body: { note_id: command.noteId, category: command.clearShelf ? "" : command.to },
-    });
-    if (!answer.ok)
-        return fail(door, answer.reason, answer.detail);
-    const body = answer.body;
-    writeLine(door.io.stderr, `${TAG} move answered ${JSON.stringify({
-        note_id: command.noteId ?? null,
-        ok: body.ok === true,
-        reason: body.reason ?? null,
-        cleared: Boolean(command.clearShelf),
-    })}`);
-    if (door.json)
-        return emit(door, body, body.ok === true ? 0 : 1);
-    writeLine(door.io.stdout, body.headline ?? "Tower answered without a sentence.");
-    for (const line of body.lines ?? [])
-        writeLine(door.io.stdout, line);
-    return body.ok === true ? 0 : 1;
-}
-/**
- * One request, and a refusal that keeps the ROUTE'S own words.
- *
- * `towerJsonRequest` maps a non-2xx through `responseErrorMessage`, which looks
- * for `message` or `error` — the shape the ingest routes answer with. Every
- * notes door answers in the browser's shape instead (`headline` plus `lines`,
- * with a `reason` label beside them), because the same body is what the page
- * renders. Reading it here rather than widening `responseErrorMessage` keeps one
- * meaning per field: the sentence is written where the outcome is known, and the
- * terminal relays it rather than inventing a second wording for the same thing.
- */
-async function ask(door, options) {
-    const result = await towerRequest({
-        dashboardUrl: door.dashboardUrl,
-        path: options.path,
-        deviceToken: door.deviceToken,
-        fetch: door.io.fetch,
-        method: options.method,
-        label: options.label,
-        timeoutMs: options.timeoutMs,
-        ...(options.body === undefined ? {} : { body: options.body }),
-        log: (line) => writeLine(door.io.stderr, line),
-    });
-    if (!result.ok) {
-        const failure = result;
-        return {
-            ok: false,
-            reason: failure.reason,
-            detail: towerFailureDetail(failure.reason, failure.detail),
-        };
-    }
-    const body = await readResponseJson(result.response);
-    if (!result.response.ok) {
-        const status = result.response.status;
-        return {
-            ok: false,
-            reason: refusalReason(body) ?? `http_${status}`,
-            detail: refusalSentence(body) ?? `Tower answered ${status} and said nothing about why.`,
-        };
-    }
-    return { ok: true, body };
-}
-function refusalReason(body) {
-    if (!body || typeof body !== "object")
-        return null;
-    const record = body;
-    for (const key of ["reason", "error", "code"]) {
-        const value = record[key];
-        if (typeof value === "string" && value.trim() !== "")
-            return value;
-    }
-    return null;
-}
-function refusalSentence(body) {
-    if (!body || typeof body !== "object")
-        return null;
-    const record = body;
-    const headline = typeof record["headline"] === "string" ? record["headline"] : null;
-    const message = typeof record["message"] === "string" ? record["message"] : null;
-    const lines = Array.isArray(record["lines"])
-        ? record["lines"].filter((line) => typeof line === "string")
-        : [];
-    const said = [headline ?? message, ...lines].filter(Boolean);
-    return said.length > 0 ? said.join(" ") : null;
-}
-/** One machine-readable object on stdout, and nothing else on it. */
-function emit(door, body, exitCode = 0) {
-    writeLine(door.io.stdout, JSON.stringify(body));
-    return exitCode;
-}
-function fail(door, reason, detail) {
-    writeLine(door.io.stderr, `${TAG} refused ${JSON.stringify({ reason })}`);
-    if (door.json) {
-        writeLine(door.io.stdout, JSON.stringify({ ok: false, error: reason, detail }));
-    }
-    else {
-        writeLine(door.io.stderr, detail);
-    }
-    return 1;
-}
-/**
- * The route's own words for what happened. Never rephrased here — the sentences
- * are written where the outcome is known, and a second wording in the terminal
- * would be a second thing to keep in step.
- */
-function sayUpload(door, body) {
-    writeLine(door.io.stdout, body.headline ?? "Tower answered without a sentence.");
-    for (const line of body.lines ?? [])
-        writeLine(door.io.stdout, line);
-    if (body.noteId)
-        writeLine(door.io.stdout, `Note id: ${body.noteId}`);
-}
-/**
- * Says out loud when an answer is narrower than the one a browser would give.
- *
- * A degraded read is still a real answer and is never withheld — but a person
- * who cannot see their own unshared note has to be told that is why, not left
- * to conclude it was never stored.
- */
-function sayScope(door, body) {
-    if (!body.degradedBecause)
-        return;
-    writeLine(door.io.stderr, `${TAG} narrowed ${JSON.stringify({ scope: body.scope ?? null, reason: body.degradedBecause })}`);
-    writeLine(door.io.stderr, body.degradedNote ?? "This answer is narrower than the browser's.");
-}
-function errorText(error) {
-    return error instanceof Error ? error.message : String(error);
 }

package/dist/commands/onboard-completion.js

@@ -3,6 +3,9 @@ import { agentRuleHostLabel } from "./agent-rules-command.js";
 import { autostartLocationLine } from "./autostart-command.js";
 import { backfillRetryCommand, runBackfill, } from "./backfill.js";
 import { addInstallEvent, reportInstallEventsBestEffort } from "./install-receipts.js";
+import { installMemoryIntegration } from "./memory-install.js";
+import { refreshSetupReceipt } from "./setup-receipt.js";
+import { setupReceiptBlock } from "./setup-receipt-lines.js";
 import { addAutostartInstallEvent, addOnboardFailureEvent, classifyOnboardBlocker, onboardAutostartFailed, } from "./onboard-receipts.js";
 import { nextStepForOnboardBlocker, onboardAgentRulesInstallLine, onboardJsonPayload, writeOnboardJson, } from "./onboard-report.js";
 import { installAgentRules } from "../agent-rules.js";
@@ -91,7 +94,51 @@ async function refreshOnboardAutostart(command, roots, io) {
  * report always fires, pass or blocked — replaces a `finish` closure that used
  * to live inside `runOnboard` so the flow functions below can call it too.
  */
+/**
+ * BLI-3731. The last thing onboarding does: install the agent integrations
+ * unasked, read the whole machine back, and print ONE block saying what is
+ * connected and what is not. It runs on every exit path, success or blocked,
+ * because "what did I actually end up with?" is the question a person has
+ * either way — and a failure that also prints the receipt is a failure
+ * somebody can act on.
+ *
+ * Never throws and never changes the exit code: this is a report.
+ */
+async function reportOnboardSetupReceipt(command, io) {
+    try {
+        await installMemoryIntegration({
+            kind: "memory",
+            action: "install",
+            ...(command.homeDir ? { homeDir: command.homeDir } : {}),
+            ...(command.dashboardUrl ? { dashboardUrl: command.dashboardUrl } : {}),
+            dryRun: false,
+            json: true,
+        }, io, { ...(command.homeDir ? { homeDir: command.homeDir } : {}) });
+    }
+    catch (error) {
+        // The receipt below will read whatever is actually there, so a failed
+        // install is reported by the words rather than by stopping onboarding.
+        console.error("[onboard] agent integrations could not be installed", JSON.stringify({
+            reason: "memory_install_threw",
+            error_name: error instanceof Error ? error.name : typeof error,
+        }));
+    }
+    const receipt = await refreshSetupReceipt(io, {
+        ...(command.homeDir ? { homeDir: command.homeDir } : {}),
+        ...(command.dashboardUrl ? { dashboardUrl: command.dashboardUrl } : {}),
+    });
+    if (command.json)
+        return;
+    writeLine(io.stdout, "");
+    writeLine(io.stdout, "Connected:");
+    for (const line of receipt
+        ? setupReceiptBlock(receipt, { indent: "  " })
+        : ["  unknown — run `cockpit doctor` to read this machine."]) {
+        writeLine(io.stdout, line);
+    }
+}
 export async function finishOnboardRun(command, installEvents, io, code) {
+    await reportOnboardSetupReceipt(command, io);
     await reportInstallEventsBestEffort({
         homeDir: command.homeDir,
         dashboardUrl: command.dashboardUrl,

package/dist/commands/onboard-setup.js

@@ -1,9 +1,10 @@
-import { writeLine } from "./cli-io.js";
+import { openInBrowser } from "./browser-open.js";
+import { errorMessage, writeLine } from "./cli-io.js";
 import { collectionRootConsentAliases, persistOnboardingRootConfig, resolveOnboardingRootsForCommand, } from "./collection-roots.js";
 import { addInstallEvent } from "./install-receipts.js";
 import { canReuseOnboardSession, pairLocalCollectorWithAuthFallback, readOnboardSessionReuseCandidate, requestPairingAccessTokenDetailed, } from "./local-auth.js";
 import { writePairingInstructions } from "./onboard-report.js";
-import { inspectLocalCollectorStatus, logoutLocalCollector, } from "../local-state.js";
+import { inspectLocalCollectorStatus, logoutLocalCollector, pairLocalCollectorViaLink, } from "../local-state.js";
 /** Step 0: which folders are approved, and who claims to own this machine's uploads. */
 export async function prepareOnboardRoots(command, installEvents, io) {
     const resolvedRoots = await resolveOnboardingRootsForCommand(command, io);
@@ -72,6 +73,22 @@ export async function pairForOnboarding(command, input, installEvents, io) {
             writeLine(io.stdout, "2/5 Existing valid device session does not match requested owner or dashboard; pairing again.");
         }
     }
+    // BLI-3731: one sign-in first. The link both signs the browser in and
+    // finishes the pairing, so nobody reads a second email. Every other arm
+    // below is the fallback, and it runs unchanged when this one cannot finish.
+    if (!command.legacyPair) {
+        const linked = await tryOneLinkOnboardPairing(command, input, io);
+        if (linked) {
+            addInstallEvent(installEvents, "auth", "skipped", "one_link_pairing");
+            addInstallEvent(installEvents, "pair", "ok");
+            if (!command.json) {
+                writeLine(io.stdout, "2/5 Device paired from one sign-in.");
+                writeLine(io.stdout, `User: ${linked.session.email ?? linked.session.auth_subject_id}`);
+                writeLine(io.stdout, `Device: ${linked.session.device_name ?? linked.session.device_id ?? "unknown"}`);
+            }
+            return linked;
+        }
+    }
     const authResult = await requestPairingAccessTokenDetailed({
         dashboardUrl: command.dashboardUrl,
         email: input.claimedOwnerEmail,
@@ -99,4 +116,67 @@ export async function pairForOnboarding(command, input, installEvents, io) {
         writeLine(io.stdout, `Device: ${pair.session.device_name ?? pair.session.device_id ?? "unknown"}`);
     }
     return pair;
+}
+/**
+ * The one-sign-in ceremony, inside onboarding (BLI-3731).
+ *
+ * Returns null when it could not finish, having already said why — onboarding
+ * then runs the older email-code arm rather than stopping. A regression in the
+ * new door must never leave a machine unable to onboard at all.
+ *
+ * `PairViaLinkResult` is mapped onto `PairLocalCollectorResult` here because
+ * the session underneath is the same one: the server issues it from the same
+ * `pollDevicePairRequest` whichever ceremony asked. `approve_url` carries the
+ * connect link so the onboarding receipt still names the address a person
+ * opened.
+ */
+async function tryOneLinkOnboardPairing(command, input, io) {
+    try {
+        const linked = await pairLocalCollectorViaLink({
+            homeDir: command.homeDir,
+            dashboardUrl: command.dashboardUrl,
+            deviceName: command.deviceName,
+            claimedOwnerEmail: input.claimedOwnerEmail,
+            pairCode: command.pairCode,
+            pollIntervalMs: command.pollIntervalMs,
+            timeoutMs: command.timeoutMs,
+            fetch: io.fetch,
+            onLinkReady: command.json
+                ? undefined
+                : (link) => announceOnboardLink(command, io, link),
+        });
+        return {
+            status: "paired",
+            session: linked.session,
+            session_file: linked.session_file,
+            dashboard_url: linked.dashboard_url,
+            approve_url: linked.connect_url ?? linked.dashboard_url,
+        };
+    }
+    catch (error) {
+        const reason = error && typeof error === "object" && "reason" in error
+            ? String(error.reason)
+            : "pair_link_failed";
+        console.error("[onboard] one-link pairing did not finish", JSON.stringify({ reason, falling_back: true }));
+        if (!command.json) {
+            writeLine(io.stderr, `Sign-in link did not finish: ${errorMessage(error)}`);
+            writeLine(io.stderr, "Falling back to the email-code sign-in.");
+        }
+        return null;
+    }
+}
+/** Print the link, then try to open it. Printing first is what makes the open optional. */
+function announceOnboardLink(command, io, link) {
+    writeLine(io.stdout, "2/5 Sign in to Tower once, and this machine is connected.");
+    writeLine(io.stdout, `Open: ${link.connect_url}`);
+    writeLine(io.stdout, "Waiting for that sign-in...");
+    if (command.noBrowser) {
+        console.error("[onboard] browser not opened", JSON.stringify({ reason: "no_browser_flag" }));
+        return;
+    }
+    const opened = openInBrowser(link.connect_url);
+    console.error("[onboard] browser open attempted", JSON.stringify(opened.ok ? { reason: opened.reason, program: opened.program } : { reason: opened.reason }));
+    if (!opened.ok) {
+        writeLine(io.stdout, `(${opened.detail} The link above still works.)`);
+    }
 }