@bli-cockpit/cli 0.2.99 → 0.2.101

package/dist/commands/doctor-update.js

@@ -1,3 +1,4 @@
+import { isSemverBelow } from "../scheduled-self-update.js";
 import { DEFAULT_DASHBOARD_URL, LOCAL_COLLECTOR_VERSION } from "../local-state.js";
 import { createInteractiveExecRunner } from "../process-runner.js";
 import { asRecord, fail, needsFix, ok } from "./doctor-report.js";
@@ -11,7 +12,7 @@ export async function checkCliLatest(context) {
     if (!latest) {
         return needsFix("cli-latest", "latest_version_unknown", `could not confirm npm latest; will run npm install for ${LOCAL_COLLECTOR_VERSION}`);
     }
-    if (latest === LOCAL_COLLECTOR_VERSION) {
+    if (latest === LOCAL_COLLECTOR_VERSION || (!context.command.updateTag && /^\d+\.\d+\.\d+$/u.test(latest) && !isSemverBelow(LOCAL_COLLECTOR_VERSION, latest))) {
         return ok("cli-latest", "already_latest", `current ${LOCAL_COLLECTOR_VERSION}`);
     }
     return needsFix("cli-latest", "stale_cli", `current ${LOCAL_COLLECTOR_VERSION}; npm latest ${latest}`);
@@ -28,7 +29,7 @@ export async function fixCliLatest(context, state) {
     }
     if (context.io.env["COCKPIT_DOCTOR_REEXEC"] === "1") {
         if (state.code === "stale_cli") {
-            return fail("cli-latest", "stale_after_self_update", "self-update ran but this process still reports the old CLI version; rerun `cockpit do-everything`.");
+            return fail("cli-latest", "stale_after_self_update", "self-update ran but this process still reports the old CLI version; rerun `cockpit doctor`.");
         }
         return ok("cli-latest", "updated_reexec_guarded", "self-update ran; re-exec guard already set, continuing.");
     }
@@ -67,9 +68,19 @@ function parseNpmVersion(stdout) {
     }
 }
 export function reexecDoctor(command, io) {
-    const args = ["do-everything"];
-    if (command.repoRoot)
-        args.push("--workspace", command.repoRoot);
+    const args = ["doctor"];
+    if (command.homeDir)
+        args.push("--home", command.homeDir);
+    if (command.lockWaitSeconds)
+        args.push("--lock-wait", String(command.lockWaitSeconds));
+    if (command.allowHomeRoot)
+        args.push("--allow-home-root");
+    if (command.maxDepth)
+        args.push("--max-depth", String(command.maxDepth));
+    if (command.maxRepos)
+        args.push("--max-repos", String(command.maxRepos));
+    for (const root of command.collectionRoots ?? (command.repoRoot ? [command.repoRoot] : []))
+        args.push("--workspace", root);
     if (command.dashboardUrl !== DEFAULT_DASHBOARD_URL) {
         args.push("--dashboard-url", command.dashboardUrl);
     }

package/dist/commands/doctor.js

@@ -1,11 +1,14 @@
+import { LOCAL_COLLECTOR_VERSION } from "../local-state.js";
+import { isSemverBelow } from "../scheduled-self-update.js";
+import { describeError } from "../health-detail.js";
 import { withStage } from "../crash-guard.js";
 import { checkSingleInstallState, fixAuthState, fixRootState, readAuthState, readRootState, } from "./doctor-access.js";
-import { backfillCompletionStepState, checkBackfillState, checkDiskState, checkGcState, checkSyncState, fixBackfillState, fixDiskState, fixGcState, fixSyncState, syncBacklogDrainingVerdict, } from "./doctor-pipeline.js";
+import { backfillCompletionStepState, backfillFixVerdict, checkBackfillState, checkDiskState, checkGcState, checkSyncState, fixBackfillState, fixDiskState, fixGcState, fixSyncState, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline.js";
 import { checkMcpAnswersState } from "./doctor-mcp.js";
 import { checkMemoryDaemonState } from "./doctor-memory-daemon.js";
-import { checkAutostartState, checkMemoryState, fixAutostartState, fixMemoryState, } from "./doctor-registration.js";
-import { dryRunPreview, isInteractiveDoctorFix, maybeReportDoctorEvents, writeDoctorOutput, } from "./doctor-report.js";
-import { refreshSetupReceipt } from "./setup-receipt.js";
+import { checkDoctorAgentRules, fixDoctorAgentRules, checkAutostartState, checkMemoryState, fixAutostartState, fixMemoryState, } from "./doctor-registration.js";
+import { dryRunPreview, isInteractiveDoctorFix, maybeReportDoctorEvents, writeDoctorOutput, doctorNeedsPerson, } from "./doctor-report.js";
+import { buildSetupReceipt, refreshSetupReceipt } from "./setup-receipt.js";
 import { checkCliLatest, fixCliLatest, latestCliVersionFromNpm, reexecDoctor, } from "./doctor-update.js";
 export async function runDoctor(command, io, hooks, overrides = {}) {
     const deps = { ...defaultDoctorDeps(hooks), ...overrides };
@@ -14,58 +17,93 @@ export async function runDoctor(command, io, hooks, overrides = {}) {
 export async function runDoctorWithDeps(command, io, deps) {
     const context = { command, io, deps };
     const rows = [];
+    const repairs = [];
+    const diagnoseOnly = command.dryRun || command.checkOnly;
+    const diagnosed = new Map();
     for (const invariant of doctorInvariants()) {
-        const checked = await withStage(`doctor:check:${invariant.id}`, () => invariant.check(context));
-        if (checked.status === "ok" || checked.status === "skipped") {
-            rows.push(checked);
-            continue;
+        try {
+            diagnosed.set(invariant.id, await withStage(`doctor:check:${invariant.id}`, () => invariant.check(context)));
         }
-        if (command.dryRun && invariant.fix) {
-            rows.push(dryRunPreview(checked));
-            continue;
+        catch (error) {
+            console.error(`[doctor] ${invariant.id} diagnosis_failed`, JSON.stringify({ reason: "check_threw", ...describeError(error) }));
+            diagnosed.set(invariant.id, { id: invariant.id, status: "fail", code: "check_threw", message: "Run `cockpit doctor` to retry this check." });
         }
-        const canFix = Boolean(invariant.fix) &&
-            (!invariant.requiresInteractiveFix || isInteractiveDoctorFix(context));
-        if (!canFix || !invariant.fix) {
-            rows.push(withoutAFix(checked));
-            if (checked.hardStop)
-                break;
-            continue;
+    }
+    for (const invariant of doctorInvariants()) {
+        let row;
+        try {
+            row = diagnosed.get(invariant.id);
+            const needsCollection = ["backfill-complete", "sync-fresh"].includes(invariant.id);
+            const prerequisitesReady = !needsCollection || rows.filter((prior) => prior.id === "authed" || prior.id === "roots-ok").every((prior) => prior.status === "ok");
+            const canFix = !diagnoseOnly && prerequisitesReady && invariant.fix &&
+                (!invariant.requiresInteractiveFix || isInteractiveDoctorFix(context) || Boolean(command.collectionRoots?.length));
+            if (row.status !== "ok" && row.status !== "skipped" && canFix && invariant.fix) {
+                row = await withStage(`doctor:fix:${invariant.id}`, () => invariant.fix(context, row));
+                repairs.push({ step: invariant.id, outcome: row.status === "ok" ? "repaired" : "needs_person", reason: row.code });
+                // The replacement process owns the one final receipt, including JSON.
+                if (row.reexecExitCode !== undefined)
+                    return row.reexecExitCode;
+                row = { ...row, fixed: row.status === "ok" };
+            }
+            else {
+                repairs.push({ step: invariant.id, outcome: diagnoseOnly ? "check_only" : row.status === "ok" ? "already_ok" : row.status === "skipped" ? "not_needed" : "needs_person", reason: row.code });
+                if (command.dryRun && invariant.fix && row.status !== "ok" && row.status !== "skipped")
+                    row = dryRunPreview(row);
+            }
         }
-        // BLI-4110: named so a crash inside a repair says WHICH repair. The
-        // 2026-09-09 incident printed a bare `read ENOTCONN` stack and the only
-        // way to place it was the log line that happened to precede it.
-        const fixed = await withStage(`doctor:fix:${invariant.id}`, () => invariant.fix(context, checked));
-        rows.push({ ...fixed, fixed: fixed.status !== "fail" });
-        if (fixed.hardStop)
-            break;
-        if (fixed.reexecExitCode !== undefined) {
-            await maybeReportDoctorEvents(context, rows);
-            writeDoctorOutput(command, io, rows, await deps.readSetupReceipt(context));
-            return fixed.reexecExitCode;
+        catch (error) {
+            console.error(`[doctor] ${invariant.id} failed`, JSON.stringify({ reason: "step_threw", ...describeError(error) }));
+            row = { id: invariant.id, status: "fail", code: "step_threw", message: "The step could not finish. Run `cockpit doctor`." };
+            repairs.push({ step: invariant.id, outcome: "needs_person", reason: row.code });
         }
+        console.error(`[doctor] ${invariant.id} ${row.status}`, JSON.stringify({ reason: row.code, repaired: row.fixed ?? false }));
+        rows.push(row);
     }
-    await maybeReportDoctorEvents(context, rows);
-    // Doctor is the surface a person opens when something is wrong, so it
-    // re-READS the machine rather than quoting a cache — and caching what it
-    // read is what keeps the 15-minute heartbeat from paying for the probe.
-    writeDoctorOutput(command, io, rows, await deps.readSetupReceipt(context));
-    return rows.some((row) => row.status === "fail" || row.hardStop) ? 1 : 0;
-}
-/**
- * What a broken row looks like when nothing can repair it from here.
- *
- * A check that says `needs_fix` and has no fix is still `needs_fix` — the
- * person is being told what to do. A check that says `fail` KEEPS that word
- * (BLI-3804): it used to be quietly rewritten to `needs_fix`, which turned the
- * run green and, because `doctor-report.ts` maps every non-`fail` row to `ok`
- * in the install-event ledger, threw the reason label away on the way to the
- * fleet as well. `hardStop` is untouched and still ends the walk.
- */
-function withoutAFix(checked) {
-    if (checked.hardStop || checked.status === "fail")
-        return checked;
-    return { ...checked, status: "needs_fix" };
+    // Re-read host state after repairs. Sync is proven by its upload receipts;
+    // re-running its diagnostic would always request a new upload by design.
+    if (!diagnoseOnly) {
+        for (const invariant of doctorInvariants()) {
+            if (["cli-latest", "authed", "roots-ok", "backfill-complete", "sync-fresh", "gc-checked", "disk-bounded"].includes(invariant.id))
+                continue;
+            const index = rows.findIndex((row) => row.id === invariant.id);
+            if (rows[index]?.status === "fail")
+                continue;
+            try {
+                const checked = await invariant.check(context);
+                rows[index] = { ...checked, fixed: rows[index]?.fixed && checked.status === "ok" };
+                console.error(`[doctor] ${invariant.id} verified`, JSON.stringify({ reason: checked.code, status: checked.status }));
+                if (checked.status === "needs_fix" || checked.status === "fail") {
+                    const repair = repairs.find((entry) => entry.step === invariant.id);
+                    if (repair) {
+                        repair.outcome = "needs_person";
+                        repair.reason = checked.code;
+                    }
+                }
+            }
+            catch (error) {
+                console.error(`[doctor] ${invariant.id} recheck_failed`, JSON.stringify({ reason: "recheck_threw", ...describeError(error) }));
+                rows[index] = { id: invariant.id, status: "fail", code: "recheck_threw", message: "Run `cockpit doctor` to retry the host check." };
+            }
+        }
+    }
+    const floor = await maybeReportDoctorEvents(context, rows);
+    if (floor && isSemverBelow(LOCAL_COLLECTOR_VERSION, floor)) {
+        const index = rows.findIndex((row) => row.id === "cli-latest");
+        rows[index] = { id: "cli-latest", status: "needs_fix", code: "below_fleet_floor", message: `This process is below the fleet floor ${floor}. Run \`cockpit doctor\` to update.`, nextAction: "cockpit doctor" };
+        console.error("[doctor] cli-latest below_fleet_floor", JSON.stringify({ reason: "below_fleet_floor", current_version: LOCAL_COLLECTOR_VERSION, minimum_version: floor }));
+    }
+    let receipt = null;
+    if (!command.dryRun) {
+        try {
+            receipt = await deps.readSetupReceipt(context);
+        }
+        catch (error) {
+            console.error("[doctor] setup_receipt failed", JSON.stringify({ reason: "receipt_read_threw", ...describeError(error) }));
+            rows.push({ id: "memory-registered", status: "needs_fix", code: "receipt_read_threw", message: "Run `cockpit doctor` to read the final setup receipt." });
+        }
+    }
+    writeDoctorOutput(command, io, rows, receipt, repairs);
+    return doctorNeedsPerson(rows, receipt).length === 0 ? 0 : 1;
 }
 function doctorInvariants() {
     return [
@@ -74,7 +112,6 @@ function doctorInvariants() {
             id: "authed",
             check: (context) => context.deps.readAuth(context),
             fix: fixAuthState,
-            requiresInteractiveFix: true,
         },
         {
             id: "roots-ok",
@@ -99,6 +136,7 @@ function doctorInvariants() {
             check: (context) => context.deps.checkMemory(context),
             fix: (context, _state) => context.deps.fixMemory(context),
         },
+        { id: "agent-rules", check: (context) => context.deps.checkAgentRules(context), fix: (context) => context.deps.fixAgentRules(context) },
         // BLI-3804. Right after the registration row, because it asks the second
         // half of the same question: `memory-registered` proves the entry exists
         // and names a bin, this one proves the server behind it starts, speaks the
@@ -122,6 +160,11 @@ function doctorInvariants() {
             check: (context) => context.deps.checkBackfill(context),
             fix: (context, _state) => context.deps.fixBackfill(context),
         },
+        {
+            id: "sync-fresh",
+            check: (context) => context.deps.checkSync(context),
+            fix: (context, _state) => context.deps.fixSync(context),
+        },
         {
             id: "gc-checked",
             check: (context) => context.deps.checkGc(context),
@@ -136,15 +179,12 @@ function doctorInvariants() {
             check: (context) => context.deps.checkDisk(context),
             fix: (context, _state) => context.deps.fixDisk(context),
         },
-        {
-            id: "sync-fresh",
-            check: (context) => context.deps.checkSync(context),
-            fix: (context, _state) => context.deps.fixSync(context),
-        },
     ];
 }
 function defaultDoctorDeps(hooks) {
     return {
+        checkAgentRules: checkDoctorAgentRules,
+        fixAgentRules: fixDoctorAgentRules,
         latestCliVersion: latestCliVersionFromNpm,
         selfUpdate: hooks.selfUpdate,
         reexecDoctor: reexecDoctor,
@@ -168,7 +208,7 @@ function defaultDoctorDeps(hooks) {
         fixDisk: fixDiskState,
         checkSync: checkSyncState,
         fixSync: fixSyncState,
-        readSetupReceipt: (context) => refreshSetupReceipt(context.io, {
+        readSetupReceipt: (context) => (context.command.checkOnly ? buildSetupReceipt : refreshSetupReceipt)(context.io, {
             ...(context.command.homeDir ? { homeDir: context.command.homeDir } : {}),
             ...(context.command.dashboardUrl
                 ? { dashboardUrl: context.command.dashboardUrl }
@@ -178,4 +218,4 @@ function defaultDoctorDeps(hooks) {
 }
 // Re-exported so every consumer keeps importing from `./doctor.js` regardless
 // of which sibling a symbol now lives in.
-export { backfillCompletionStepState, syncBacklogDrainingVerdict };
+export { backfillCompletionStepState, backfillFixVerdict, syncBacklogDrainingVerdict, syncStandAsideVerdict, };

package/dist/commands/local-args-collector-setup.js

@@ -98,6 +98,9 @@ export function parseDoctorArgs(alias, args) {
             "--dashboard-url",
             "--update-tag",
             "--dry-run",
+            "--check",
+            "--no-repair",
+            "--lock-wait",
             "--json",
             "--allow-home-root",
             "--max-depth",
@@ -113,6 +116,7 @@ export function parseDoctorArgs(alias, args) {
             "--timeout-ms",
         ],
         valueFlags: [
+            "--lock-wait",
             "--home",
             "--repo",
             "--workspace",
@@ -135,6 +139,8 @@ export function parseDoctorArgs(alias, args) {
     }
     return {
         kind: "doctor",
+        checkOnly: values.booleans.has("--check") || values.booleans.has("--no-repair"),
+        lockWaitSeconds: optionalPositiveInteger(values.flags.get("--lock-wait"), "--lock-wait") ?? 600,
         alias,
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         repoRoot: optionalNonEmpty(workRootFlagValue(values)),

package/dist/commands/local-args-tower-careers.js

@@ -0,0 +1,20 @@
+import { optionalNonEmpty, optionalUrl, parseNamedArgs } from './local-arg-values.js';
+export function parseCareersArgs(args) {
+    const values = parseNamedArgs(args, { allowedFlags: ['--role', '--min-score', '--since', '--home', '--dashboard-url', '--json'], valueFlags: ['--role', '--min-score', '--since', '--home', '--dashboard-url'] });
+    const action = values.positionals[0] ?? 'list';
+    if (action !== 'list' && action !== 'show' && action !== 'rescreen')
+        throw new Error('careers takes list, show, or rescreen.');
+    const id = values.positionals[1];
+    if (action !== 'list' && !id)
+        throw new Error(`careers ${action} needs an application id.`);
+    if (values.positionals.length > (action === 'list' ? 1 : 2))
+        throw new Error('Unexpected careers argument.');
+    const rawScore = values.flags.get('--min-score');
+    const minScore = rawScore === undefined ? undefined : Number(rawScore);
+    if (minScore !== undefined && (!Number.isFinite(minScore) || minScore < 0 || minScore > 100))
+        throw new Error('--min-score must be 0 to 100.');
+    const since = optionalNonEmpty(values.flags.get('--since'));
+    if (since && !Number.isFinite(Date.parse(since)))
+        throw new Error('--since must be a date.');
+    return { kind: 'careers', action, id, role: optionalNonEmpty(values.flags.get('--role')), minScore, since: since ? new Date(since).toISOString() : undefined, homeDir: optionalNonEmpty(values.flags.get('--home')), dashboardUrl: optionalUrl(values.flags.get('--dashboard-url')), json: values.booleans.has('--json') };
+}

package/dist/commands/local-args-tower-pages.js

@@ -153,6 +153,7 @@ export function parseBriefArgs(args) {
     };
 }
 const NOTES_ACTIONS = new Set([
+    "folders", "mkdir", "rmdir", "rename",
     "list",
     "show",
     "shelf",
@@ -175,12 +176,14 @@ const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
 export function parseNotesArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
+            "--wait",
             "--home",
             "--dashboard-url",
             "--file",
             "--name",
             "--exclude",
             "--to",
+            "--folder",
             "--clear-shelf",
             "--apply",
             "--series",
@@ -190,6 +193,7 @@ export function parseNotesArgs(args) {
             "--limit",
             "--yes",
             "--json",
+            "--tree",
         ],
         valueFlags: [
             "--home",
@@ -198,6 +202,7 @@ export function parseNotesArgs(args) {
             "--name",
             "--exclude",
             "--to",
+            "--folder",
             "--series",
             "--kind",
             "--since",
@@ -236,23 +241,33 @@ export function parseNotesArgs(args) {
         if (paths.length === 0)
             throw new Error("notes upload needs at least one file path.");
     }
+    else if (action === "mkdir" || action === "rmdir" || action === "rename") {
+        if (rest.length !== 1 || !rest[0]?.trim())
+            throw new Error(`notes ${action} needs one folder path.`);
+    }
     else if (action !== "paste" && !NOTES_ACTIONS_NEEDING_A_NOTE.has(action) && rest.length > 0) {
         throw new Error(`notes ${action} does not take "${rest[0]}".`);
     }
+    if (action === "rename" && !optionalNonEmpty(values.flags.get("--name")))
+        throw new Error("notes rename needs --name <name>.");
     const to = optionalNonEmpty(values.flags.get("--to"));
     const clearShelf = values.booleans.has("--clear-shelf");
     if (action === "move") {
         if (to && clearShelf) {
             throw new Error("notes move accepts either --to or --clear-shelf, not both.");
         }
-        if (!to && !clearShelf) {
-            throw new Error('notes move needs --to "<shelf>" or --clear-shelf.');
+        if (!to && !clearShelf && !values.flags.get("--folder")) {
+            throw new Error('notes move needs --to "<shelf>", --clear-shelf, or --folder "<path>".');
         }
     }
     const limit = optionalPositiveInteger(values.flags.get("--limit"), "--limit");
     return {
         kind: "notes",
+        ...(values.booleans.has("--wait") ? { wait: true } : {}),
         action,
+        ...(values.flags.has("--folder") ? { folder: values.flags.get("--folder") } : {}),
+        ...(action === "mkdir" || action === "rmdir" || action === "rename" ? { folder: rest[0] } : {}),
+        ...(values.booleans.has("--tree") ? { tree: true } : {}),
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
         ...(noteId ? { noteId } : {}),

package/dist/commands/local-args-tower-usage.js

@@ -1,8 +1,8 @@
 import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
 export function parseUsageArgs(args) {
-    const values = parseNamedArgs(args, { allowedFlags: ["--since", "--until", "--include-automated", "--home", "--dashboard-url", "--json"], valueFlags: ["--since", "--until", "--home", "--dashboard-url"] });
+    const values = parseNamedArgs(args, { allowedFlags: ["--since", "--until", "--include-automated", "--detail", "--home", "--dashboard-url", "--json"], valueFlags: ["--since", "--until", "--home", "--dashboard-url"] });
     const action = values.positionals[0] ?? "people";
     if (action !== "people" || values.positionals.length > 1)
         throw new Error("usage takes one verb: people.");
-    return { kind: "usage", action: "people", since: optionalNonEmpty(values.flags.get("--since")) ?? "30d", until: optionalNonEmpty(values.flags.get("--until")), includeAutomated: values.booleans.has("--include-automated"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")), json: values.booleans.has("--json") };
+    return { kind: "usage", action: "people", since: optionalNonEmpty(values.flags.get("--since")) ?? "30d", until: optionalNonEmpty(values.flags.get("--until")), detail: values.booleans.has("--detail"), includeAutomated: values.booleans.has("--include-automated"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")), json: values.booleans.has("--json") };
 }

package/dist/commands/local-args-tower.js

@@ -36,4 +36,5 @@ export { SEARCH_KINDS, parseSearchArgs } from "./local-args-tower-search.js";
 export { parseModelsArgs } from "./local-args-tower-models.js";
 export { parseMailArgs } from "./local-args-tower-mail.js";
 export { parseCalArgs } from "./local-args-tower-cal.js";
-export { parseUsageArgs } from "./local-args-tower-usage.js";
+export { parseUsageArgs } from "./local-args-tower-usage.js";
+export { parseCareersArgs } from './local-args-tower-careers.js';

package/dist/commands/local-args.js

@@ -16,7 +16,7 @@
  * verbatim, no logic change.
  */
 import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
-import { parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, } from "./local-args-tower.js";
+import { parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseCareersArgs, } from "./local-args-tower.js";
 // `normalizeUrl` has always been part of this module's surface — `local.ts` and
 // `local-auth.ts` import it from here — so it stays exported from this address
 // even though it now lives next door. The same goes for the four names the
@@ -115,6 +115,8 @@ export function parseLocalArgs(argv) {
             return parseSearchArgs(argv.slice(1));
         case "release":
             return parseReleaseArgs(argv.slice(1));
+        case "careers":
+            return parseCareersArgs(argv.slice(1));
         case "usage":
             return parseUsageArgs(argv.slice(1));
         default:

package/dist/commands/local-help-commands-tower.js

@@ -22,6 +22,7 @@ const SEARCH_KIND_LIST = SEARCH_KINDS.join(",");
 const SEARCH_CORPORA_COUNT = SEARCH_KINDS.length;
 /** One entry per Tower noun, in the order `cockpit --help` lists them. */
 export const TOWER_COMMAND_HELP = [
+    ["careers", ["Usage: cockpit careers [list|show <id>|rescreen <id>] [--role <slug>] [--min-score <n>] [--since <date>] [--json]", "Super-admin application review. Lists at most 100 matches with total and has_more; use filters to narrow."]],
     [
         "docs",
         [
@@ -142,12 +143,13 @@ export const TOWER_COMMAND_HELP = [
     [
         "usage",
         [
-            "Usage: cockpit usage people [--since 30d|<iso>] [--until <iso>] [--include-automated] [--json]",
+            "Usage: cockpit usage people [--since <n>d|<n>h|<iso>] [--detail] [--until <iso>] [--include-automated] [--json]",
             "",
             "Claude Code and Codex usage per person: sessions observed and extracted, tokens (total, output,",
             "and the input / cache split when the row carries it), and an API list-price equivalent that is",
             "labelled as such and is never actual spend. A super_admin sees everyone; a member sees their own row.",
-            "--since takes 7d, 30d, 90d or an ISO timestamp; --until an ISO timestamp (default now).",
+            "--since takes <n>d (1 to 365), <n>h (1 to 8760), or an ISO timestamp; --until an ISO timestamp (default now).",
+            "--detail adds Output, Input, Cache read and Cache creation. Counts use K/M/B; dollars are rounded.",
             "--include-automated adds harness, subagent and scheduled sessions, which are excluded by default.",
             "It presses the same door as the /usage page and the usage_people MCP tool (GET /api/usage/people).",
             "--json writes one machine-readable object to stdout; every reason and receipt line stays on stderr.",

package/dist/commands/local-help-commands.js

@@ -71,30 +71,40 @@ export function localSubcommandHelp(command) {
         [
             "do-everything",
             [
-                "Usage: cockpit do-everything [--workspace <path>] [--dashboard-url <url>] [--update-tag <tag>] [--dry-run] [--json]",
+                "Usage: cockpit do-everything [--workspace <path>] [--check | --no-repair] [--lock-wait <seconds>] [--json]",
                 "",
-                "Gets this machine fully set up, whether it is brand new, already set up, or handed down: latest CLI, sign-in and collection-root recovery when needed, saved folders, background sync, catching up on old sessions, cleaning up old files, and one fresh upload.",
-                "`cockpit fix` is an alias.",
-                "Maintainers only: use `--update-tag next` so self-update and re-exec stay on the prerelease candidate.",
-                "--dry-run shows what it would do without changing anything.",
+                "Diagnose, repair, and verify this machine. doctor, do-everything, and fix run the same job.",
+                "Repairs CLI, background sync, sign-in, roots, memory and hooks, agent rules, catch-up, uploads, and cleanup.",
+                "--check or --no-repair diagnoses without repairs. --dry-run previews repairs.",
+                "--lock-wait defaults to 600 seconds; progress prints every 30 seconds.",
+                "--json includes steps, repairs, and needs_person. Exit 0 means nothing needs you.",
+                "Maintainers: --update-tag next keeps self-update on the prerelease candidate.",
             ],
         ],
         [
             "fix",
             [
-                "Usage: cockpit fix [same flags as cockpit do-everything]",
+                "Usage: cockpit fix [--workspace <path>] [--check | --no-repair] [--lock-wait <seconds>] [--json]",
                 "",
-                "Alias for `cockpit do-everything`.",
+                "Diagnose, repair, and verify this machine. doctor, do-everything, and fix run the same job.",
+                "Repairs CLI, background sync, sign-in, roots, memory and hooks, agent rules, catch-up, uploads, and cleanup.",
+                "--check or --no-repair diagnoses without repairs. --dry-run previews repairs.",
+                "--lock-wait defaults to 600 seconds; progress prints every 30 seconds.",
+                "--json includes steps, repairs, and needs_person. Exit 0 means nothing needs you.",
+                "Maintainers: --update-tag next keeps self-update on the prerelease candidate.",
             ],
         ],
         [
             "doctor",
             [
-                "Usage: cockpit doctor [same flags as cockpit do-everything]",
+                "Usage: cockpit doctor [--workspace <path>] [--check | --no-repair] [--lock-wait <seconds>] [--json]",
                 "",
-                "Alias for `cockpit do-everything`. It checks this machine row by row —",
-                "CLI version, sign-in, saved folders, background sync, backfill, disk — and",
-                "fixes each row it can. `--dry-run` prints the diagnosis and changes nothing.",
+                "Diagnose, repair, and verify this machine. doctor, do-everything, and fix run the same job.",
+                "Repairs CLI, background sync, sign-in, roots, memory and hooks, agent rules, catch-up, uploads, and cleanup.",
+                "--check or --no-repair diagnoses without repairs. --dry-run previews repairs.",
+                "--lock-wait defaults to 600 seconds; progress prints every 30 seconds.",
+                "--json includes steps, repairs, and needs_person. Exit 0 means nothing needs you.",
+                "Maintainers: --update-tag next keeps self-update on the prerelease candidate.",
             ],
         ],
         [
@@ -450,8 +460,14 @@ export function localSubcommandHelp(command) {
         [
             "notes",
             [
-                "Usage: cockpit notes [list|show <id>|shelf|shelves|upload <paths...>|paste|share <id>|unshare <id>|move <id>] [flags]",
+                "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>] [flags]",
+                "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 4 MB. --wait polls transcription for at most 330 seconds.",
                 "",
+                "folders [--tree] [--json]: list folders and visible note counts.",
+                "mkdir <path> [--json]: create a folder and any missing ancestors.",
+                "rename <path> --name <name> [--json]: rename a folder and its descendant paths.",
+                "rmdir <path> [--json]: delete an empty folder; refuses notes or subfolders.",
+                "upload, paste and move accept --folder <path>; use / for Root. Shelf placement stays independent.",
                 "The /meeting-notes surface, typed. Bare `cockpit notes` lists the library.",
                 "list [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] — every note you may open, grouped by shelf, newest meeting first. Never a word of a note.",
                 "show <id> — one note with its text, its shelf, and why you are allowed to see it.",

package/dist/commands/local-help.js

@@ -52,6 +52,7 @@ export const rootCommandNames = new Set([
     "project",
     "search",
     "release",
+    "careers",
     "usage",
 ]);
 export function localCommandHelp(command) {
@@ -63,7 +64,7 @@ export function localCommandHelp(command) {
         "  cockpit upgrade [same flags as update]",
         "  cockpit do-everything [--workspace <path>] [--dashboard-url <url>] [--update-tag <tag>] [--dry-run] [--json]",
         "  cockpit fix [same flags as do-everything]",
-        "  cockpit doctor [same flags as do-everything]",
+        "  cockpit doctor [--check | --no-repair] [--lock-wait <seconds>] [--json]",
         "  cockpit install [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--json]",
         "  cockpit login [--pair <code>] [--no-browser] [--legacy-pair] [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--no-auth] [--json]",
         "  cockpit pair [--pair <code>] [--no-browser] [--legacy-pair] [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--no-auth] [--json]",
@@ -83,7 +84,7 @@ export function localCommandHelp(command) {
         "  cockpit brief [edit|rewrite|history] [--for <person>] [--date <YYYY-MM-DD>] [--delta [--against <YYYY-MM-DD>]] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--days <n>] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
         "  cockpit brief status [--who <person>] [--render] [--dashboard-url <url>] [--json]",
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
-        "  cockpit notes [list|show <id>|shelf|shelves|upload <paths...>|paste|share <id>|unshare <id>|move <id>|place <id>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
+        "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
         "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
@@ -100,6 +101,7 @@ export function localCommandHelp(command) {
         "  cockpit project [list] [--archived] [--dashboard-url <url>] [--json]",
         `  cockpit search "<words>" [--kind ${SEARCH_KINDS.join(",")}] [--limit <n>] [--dashboard-url <url>] [--json]`,
         "  cockpit release [--dry-run] [--skip-checks] [--no-floor] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
+        "  cockpit careers [list|show <id>|rescreen <id>] [--role <slug>] [--min-score <n>] [--since <date>] [--json]",
         "  cockpit usage people [--since 30d|<iso>] [--until <iso>] [--include-automated] [--dashboard-url <url>] [--json]",
         "",
         `Default dashboard: ${DEFAULT_DASHBOARD_URL}. Omit --dashboard-url for normal production use; pass it only for staging/custom dashboards or to force a different pairing.`,

package/dist/commands/local.js

@@ -43,6 +43,7 @@ import { runCal } from "./cal.js";
 import { runMail } from "./mail.js";
 import { runProject } from "./project.js";
 import { runSearch } from "./search.js";
+import { runCareers } from "./careers.js";
 import { runUsage } from "./usage.js";
 import { parseLocalArgs } from "./local-args.js";
 // `./local.js` is the published entry point for this command surface: the
@@ -180,6 +181,8 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
                 return await runSearch(command, io);
             case "release":
                 return await runRelease(command, io);
+            case "careers":
+                return await runCareers(command, io);
             case "usage":
                 return await runUsage(command, io);
         }
@@ -206,6 +209,7 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
 async function runDoctorLogin(command, io) {
     return runLogin({
         kind: "login",
+        homeDir: command.homeDir,
         dashboardUrl: command.dashboardUrl,
         json: command.json,
         noAuth: false,

package/dist/commands/notes-file.js

@@ -34,6 +34,10 @@ import { errorMessage } from "./cli-io.js";
  * courtesy check to avoid uploading something the server is certain to refuse,
  * not a second source of truth.
  */
+export function noteAudioMime(name) {
+    const mime = { mp3: "audio/mpeg", m4a: "audio/mp4", wav: "audio/wav", webm: "audio/webm", ogg: "audio/ogg" };
+    return mime[name.split(".").at(-1)?.toLowerCase() ?? ""];
+}
 export const NOTE_FILE_MAX_BYTES = 20 * 1024 * 1024;
 /**
  * Above this, the terminal says it is working before it starts. The route's own
@@ -52,7 +56,7 @@ export function noteFileRefusalSentence(refusal, filePath) {
         case "file_empty":
             return `There is nothing in that file: ${filePath}`;
         case "file_too_big":
-            return "That file is too big to put in as a note — keep it under 20 MB.";
+            return "That file is too big. Audio is limited to 4 MB; other notes to 20 MB.";
         case "looks_like_a_key_file":
             // The same rule the server's gate applies, said the same way: the name is
             // all it takes to decide, and looking inside to be sure would already be
@@ -88,6 +92,9 @@ export async function readNoteFile(filePath) {
     }
     if (size === 0)
         return { ok: false, refusal: "file_empty", detail: "byte_size_0" };
+    if (noteAudioMime(fileName) && size > 4_000_000) {
+        return { ok: false, refusal: "file_too_big", detail: "file_too_large: audio limit is 4 MB (4,000,000 bytes)" };
+    }
     if (size > NOTE_FILE_MAX_BYTES) {
         return { ok: false, refusal: "file_too_big", detail: `byte_size_${size}` };
     }