@bli-cockpit/mcp 0.1.113 → 0.1.114

package/README.md

@@ -109,7 +109,7 @@ about what an agent can reach.
 
 <!-- BEGIN GENERATED verb census — `npm run mcp:readme` -->
 
-**150 of 155 Tower verbs have an MCP twin.**
+**159 of 164 Tower verbs have an MCP twin.**
 Each tool goes through the SAME door its CLI verb calls, with the same
 collector device token — never a second route and never a service-role
 reader. `src/verb-census.test.ts` fails when a verb is in none of the
@@ -167,6 +167,7 @@ three tables below.
 | `cockpit glossary add` | `glossary_add` | `POST /api/glossary` |
 | `cockpit glossary list` | `glossary_list` | `GET /api/glossary` |
 | `cockpit glossary remove` | `glossary_remove` | `POST /api/glossary` |
+| `cockpit issue board` | `work_board` | `GET /api/work/board` |
 | `cockpit issue comment` | `work_comment_issue` | `POST /api/work/issues/[id]/comments` |
 | `cockpit issue create` | `work_create_issue` | `POST /api/work/issues` |
 | `cockpit issue history` | `work_issue_history` | `GET /api/work/issues/[id]/history` |
@@ -177,6 +178,8 @@ three tables below.
 | `cockpit jarvis` | `jarvis_ask` | `POST /api/jarvis/cli` |
 | `cockpit jarvis --trace` | `jarvis_trace` | `GET /api/ops/trace/[id]` |
 | `cockpit logs` | `logs_digest` | `LOCAL @bli-cockpit/telemetry-core/log-digest (this machine's logs); `project` reads GET /api/logs (the stored digests)` |
+| `cockpit logs keys mint` | `logs_key_mint` | `POST /api/settings/log-ingest-keys` |
+| `cockpit logs keys rotate` | `logs_key_mint` | `POST /api/settings/log-ingest-keys` |
 | `cockpit mail accounts` | `mail_accounts` | `GET /api/mail/accounts` |
 | `cockpit mail attachment` | `mail_attachment` | `GET /api/mail/attachments/[id]?meta=1` |
 | `cockpit mail default` | `mail_default` | `PATCH /api/mail/accounts` |
@@ -196,6 +199,7 @@ three tables below.
 | `cockpit memory forget` | `forget_memory` (`bli-memory`) | `POST /api/memory/forget` |
 | `cockpit memory knowledge` | `memory_knowledge` | `GET /api/memory/knowledge` |
 | `cockpit memory log` | `memory_experience` | `POST /api/memory/experience` |
+| `cockpit memory map` | `memory_map` | `GET /api/memory/map` |
 | `cockpit memory private` | `set_memory_visibility` (`bli-memory`) | `POST /api/memory/visibility` |
 | `cockpit memory profile` | `memory_profile` | `GET /api/memory/profile` |
 | `cockpit memory public` | `set_memory_visibility` (`bli-memory`) | `POST /api/memory/visibility` |
@@ -261,8 +265,13 @@ three tables below.
 | `cockpit team device doctor` | `team_device_doctor` | `POST /api/ambient/devices/[deviceId]/doctor` |
 | `cockpit team device list` | `team_device_list` | `GET /api/team/devices` |
 | `cockpit team device revoke` | `team_device_revoke` | `POST /api/ambient/devices/[deviceId]/revoke` |
+| `cockpit team github-login add` | `team_github_login_add` | `POST /api/team/members/[userId]/github-logins` |
+| `cockpit team github-login list` | `team_github_login_list` | `GET /api/team/members/[userId]/github-logins` |
+| `cockpit team github-login remove` | `team_github_login_remove` | `DELETE /api/team/members/[userId]/github-logins` |
+| `cockpit team grant` | `team_grant` | `POST /api/team/grants` |
 | `cockpit team invite` | `team_invite` | `POST /api/team/invite` |
 | `cockpit team members` | `team_members` | `GET /api/team/members` |
+| `cockpit team revoke` | `team_revoke` | `POST /api/team/grants` |
 | `cockpit team role` | `team_role` | `PATCH /api/team/members/[userId]/role` |
 | `cockpit usage people` | `usage_people` | `GET /api/usage/people` |
 | `cockpit usage sessions` | `usage_sessions` | `GET /api/usage/sessions` |

package/dist/logs-tools.js

@@ -34,6 +34,16 @@ const MAX_TEXT_CHARS = 256_000;
 export function registerLogsTools(server, deps = {}) {
     const digest = deps.digest ?? digestSource;
     const door = { fetchImpl: deps.fetchImpl ?? fetch, ...(deps.loadSession ? { loadSession: deps.loadSession } : {}) };
+    registrarFor(server)("logs_key_mint", {
+        title: "Mint or rotate a source log ingest key",
+        description: "Super admin only. Returns the key once. Rotation invalidates the old key. Same door as cockpit logs keys mint|rotate.",
+        inputSchema: { source: z.string().min(3).max(120).describe("The push source id, e.g. droplet:kaiben-ridestyler."), action: z.enum(["mint", "rotate"]).describe("mint creates the first key; rotate replaces it and invalidates the old one.") },
+    }, async (args) => withSession(door, async (session) => {
+        const response = await callAgentDoor(session, door.fetchImpl, "POST", "/api/settings/log-ingest-keys", args);
+        if (!response.ok)
+            return errorResult(doorFailureText("logs_key_mint", response));
+        return textResult(String(response.body.key), response.body);
+    }));
     registrarFor(server)("logs_digest", {
         title: "Digest Tower's logs (about 2 KB)",
         description: "A token-cheap digest of Tower's own logs, read on THIS machine and never uploaded. Use it BEFORE reading raw logs: a 15-minute window of a "

package/dist/memory-rules-tools.js

@@ -2,6 +2,19 @@ import { z } from "zod";
 import { callAgentDoor } from "./agent-door.js";
 import { doorFailureText, errorResult, queryString, registrarFor, textResult, withSession } from "./tool-result.js";
 export function registerMemoryRulesTools(server, deps) {
+    registrarFor(server)("memory_map", {
+        title: "Read the memory map",
+        description: "Visible projects, topics, memory counts, importance, top ideas and shared-session edges. Same door as cockpit memory map; coverage and age are included.",
+        inputSchema: {},
+    }, async () => withSession(deps, async (session) => {
+        const response = await callAgentDoor(session, deps.fetchImpl, "GET", "/api/memory/map");
+        if (!response.ok)
+            return errorResult(doorFailureText("memory_map", response));
+        const body = response.body;
+        const lines = body.projects.flatMap(project => [`${project.project} (${project.count} memories)`, ...project.topics.map(topic => `  ${topic.label}: ${topic.count}`)]);
+        lines.push(`${body.examined} of ${body.total} visible memories counted; as of ${body.computedAt}.${body.capped ? " Scan capped at 10,000." : ""}`);
+        return textResult(lines.join("\n"), response.body);
+    }));
     for (const action of ["rules", "knowledge"])
         registrarFor(server)(`memory_${action}`, {
             title: `Read BLI agent ${action}`,

package/dist/speed-tools.d.ts

@@ -18,7 +18,7 @@ export interface SpeedPage {
     path: string;
     note?: string;
 }
-export declare function speedPages(memoryContainer: string): SpeedPage[];
+export declare function speedPages(_memoryContainer: string): SpeedPage[];
 export declare const SPEED_PAGE_NAMES: string[];
 export interface SpeedSample {
     status: number | null;

package/dist/speed-tools.js

@@ -14,7 +14,7 @@
 import { z } from "zod";
 import { callAgentDoor } from "./agent-door.js";
 import { dataResult, doorFailureText, errorResult, registrarFor, withSession } from "./tool-result.js";
-export function speedPages(memoryContainer) {
+export function speedPages(_memoryContainer) {
     return [
         { name: "today", label: "Today (JARVIS home)", path: "/api/jarvis/brief" },
         { name: "meeting-notes", label: "Meeting notes", path: "/api/notes/library" },
@@ -23,13 +23,10 @@ export function speedPages(memoryContainer) {
         { name: "messages", label: "Messages", path: "/api/msg/channels" },
         { name: "mail", label: "Mail", path: "/api/mail/inbox" },
         { name: "docs", label: "Docs", path: "/api/docs/tree" },
-        {
-            name: "memory",
-            label: "Memory",
-            path: `/api/memory/profile?container=${encodeURIComponent(memoryContainer)}`,
-            note: "the page reads agent_memories on the server; the profile door is the nearest read",
-        },
-        { name: "tickets", label: "Tickets", path: "/api/work/issues" },
+        { name: "memory-knowledge", label: "Memory knowledge", path: "/api/memory/knowledge" },
+        { name: "memory-rules", label: "Memory rules", path: "/api/memory/rules" },
+        { name: "tickets", label: "Tickets", path: "/api/work/board" },
+        { name: "tickets-list", label: "Tickets list", path: "/api/work/issues" },
         { name: "setup", label: "Setup", path: "/api/setup" },
         { name: "usage", label: "Usage", path: "/api/usage/people?since=30d" },
         { name: "calendar", label: "Calendar", path: "/api/cal/week" },
@@ -212,7 +209,7 @@ export function registerSpeedTools(server, deps) {
                 .describe("Only these pages. Omit for every page."),
             runs: z.number().int().min(1).max(MAX_RUNS).optional().describe("Requests per page (default 5)."),
             container: z.string().min(1).max(200).optional()
-                .describe("The memory container tag to time the Memory page with. Without it the Memory page is left out."),
+                .describe("Legacy container tag; Memory tab doors no longer require it."),
         },
     }, async (args) => withSession(deps, async (session) => {
         const runs = typeof args.runs === "number" ? args.runs : DEFAULT_RUNS;
@@ -222,14 +219,10 @@ export function registerSpeedTools(server, deps) {
         const chosen = speedPages(container ?? "-").filter((page) => {
             if (asked.length > 0 && !asked.includes(page.name))
                 return false;
-            if (page.name === "memory" && container === null) {
-                skipped.push("memory");
-                return false;
-            }
             return true;
         });
         if (chosen.length === 0) {
-            return errorResult("speed_read has nothing to time: the Memory page needs a `container` tag.");
+            return errorResult("speed_read has nothing to time.");
         }
         const results = [];
         for (const page of chosen) {

package/dist/team-write-tools.js

@@ -62,6 +62,48 @@ async function listDevices(deps, session) {
 }
 export function registerTeamWriteTools(server, deps) {
     const register = registrarFor(server);
+    for (const action of ["add", "remove", "list"]) {
+        const name = `team_github_login_${action}`;
+        register(name, {
+            title: `${action} an extra GitHub login`,
+            description: "Manage extra GitHub logins by exact person UUID, name or email. Server permits super admins or members managing themselves. Primary login and history are preserved.",
+            inputSchema: { person: z.string().min(1).describe("Exact roster UUID, name or email from team_members."),
+                ...(action === "list" ? {} : { login: z.string().min(1).max(39).describe("GitHub login; the server validates its format.") }) },
+        }, async (args) => withSession(deps, async (session) => {
+            let personId = String(args.person);
+            if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(personId)) {
+                const directory = await callAgentDoor(session, deps.fetchImpl, "GET", "/api/team/members");
+                if (!directory.ok)
+                    return errorResult(doorFailureText(name, directory));
+                if (directory.body.rosterError)
+                    return errorResult("Refused (roster_read_failed): use a person UUID or retry.");
+                const needle = personId.toLowerCase();
+                const people = (Array.isArray(directory.body.people) ? directory.body.people : []);
+                const ids = [...new Set(people.filter(person => [person.rosterId, person.name, person.email]
+                        .some(label => typeof label === "string" && label.toLowerCase() === needle))
+                        .map(person => person.rosterId).filter((id) => typeof id === "string"))];
+                if (ids.length !== 1)
+                    return errorResult(`Refused (${ids.length ? "ambiguous_person" : "person_not_found"}): use an exact roster UUID, name or email.`);
+                personId = ids[0];
+            }
+            const response = await callAgentDoor(session, deps.fetchImpl, action === "list" ? "GET" : action === "add" ? "POST" : "DELETE", `/api/team/members/${encodeURIComponent(personId)}/github-logins`, action === "list" ? undefined : { login: args.login });
+            if (!response.ok)
+                return errorResult(doorFailureText(name, response));
+            return textResult(JSON.stringify(response.body), response.body);
+        }));
+    }
+    for (const action of ["grant", "revoke"]) {
+        register(`team_${action}`, {
+            title: `${action === "grant" ? "Grant" : "Revoke"} Careers access`,
+            description: "Change one person's see or act grant. Super admin only, decided by the shared Team door. Levels are independent; defaults to see.",
+            inputSchema: { person_id: z.string().uuid().describe("The person (roster user id) whose access changes."), section: z.enum(["careers"]).describe("The section; only careers is grantable today."), level: z.enum(["see", "act"]).optional().describe("Defaults to see. see reads candidates; act also decides, sends take-homes and changes settings.") },
+        }, async (args) => withSession(deps, async (session) => {
+            const response = await callAgentDoor(session, deps.fetchImpl, "POST", "/api/team/grants", { person_id: args.person_id, section: args.section, level: args.level ?? "see", action }, WRITE_DEADLINE_MS);
+            if (!response.ok)
+                return errorResult(doorFailureText(`team_${action}`, response));
+            return textResult(`Careers ${String(args.level ?? "see")} ${action === "grant" ? "granted" : "revoked"}.`, response.body);
+        }));
+    }
     register("team_invite", {
         title: "Invite somebody to Tower",
         description: "Sends a sign-in link to an email address — `cockpit team invite`, same door. super_admin, decided on the "

package/dist/tool-catalog.d.ts

@@ -10,7 +10,7 @@
  * from `src/` under Node's type stripping, so it may import nothing.
  */
 /** Tools that change nothing. The smoke calls every one. */
-export declare const READ_TOOLS: readonly ["get_ticket_timeline", "get_active_tickets", "docs_list", "docs_tree", "docs_read", "docs_sync_status", "msg_channels", "msg_read", "msg_thread", "work_list_issues", "work_get_issue", "work_issue_history", "work_list_projects", "careers_list", "careers_show", "careers_resume_url", "careers_takehome_show", "careers_settings_show", "rename_pending", "github_pr", "setup_read", "speed_read", "speed_seen", "usage_people", "usage_sessions", "mail_accounts", "mail_inbox", "mail_read", "mail_search", "mail_attachment", "mail_sync_status", "cal_today", "cal_week", "cal_next", "cal_find", "cal_calendars", "cal_sync_status", "jarvis_ask", "jarvis_trace", "jarvis_check", "models_list", "models_card", "models_compare", "brief_read", "brief_history", "brief_status", "brief_missed", "notes_folders", "notes_list", "glossary_list", "notes_show", "notes_shelf", "notes_shelves", "notes_place", "notes_accounts", "notes_recordings", "notes_recording", "notes_sync_status", "notes_granola_status", "notes_bot_upcoming", "ops_status", "slack_coverage", "slack_connect", "slack_disconnect", "slack_read", "memory_rules", "memory_knowledge", "memory_profile", "memory_consolidation", "settings_show", "settings_list", "model_show", "team_members", "team_device_list", "scout_board", "workbook_read", "tower_search", "sources_check", "logs_digest", "brain_status"];
+export declare const READ_TOOLS: readonly ["get_ticket_timeline", "get_active_tickets", "docs_list", "docs_tree", "docs_read", "docs_sync_status", "msg_channels", "msg_read", "msg_thread", "work_board", "work_list_issues", "work_get_issue", "work_issue_history", "work_list_projects", "careers_list", "careers_show", "careers_resume_url", "careers_takehome_show", "careers_settings_show", "rename_pending", "github_pr", "setup_read", "speed_read", "speed_seen", "usage_people", "usage_sessions", "mail_accounts", "mail_inbox", "mail_read", "mail_search", "mail_attachment", "mail_sync_status", "cal_today", "cal_week", "cal_next", "cal_find", "cal_calendars", "cal_sync_status", "jarvis_ask", "jarvis_trace", "jarvis_check", "models_list", "models_card", "models_compare", "brief_read", "brief_history", "brief_status", "brief_missed", "notes_folders", "notes_list", "glossary_list", "notes_show", "notes_shelf", "notes_shelves", "notes_place", "notes_accounts", "notes_recordings", "notes_recording", "notes_sync_status", "notes_granola_status", "notes_bot_upcoming", "ops_status", "slack_coverage", "slack_connect", "slack_disconnect", "slack_read", "memory_map", "memory_rules", "memory_knowledge", "memory_profile", "memory_consolidation", "settings_show", "settings_list", "model_show", "team_members", "team_github_login_add", "team_github_login_remove", "team_github_login_list", "team_device_list", "scout_board", "workbook_read", "tower_search", "sources_check", "logs_digest", "brain_status"];
 /**
  * Tools that write, but answer a dry run that writes nothing. The smoke calls
  * each one ONLY with its dry-run flag set (`scripts/smoke.ts` says which).
@@ -21,7 +21,7 @@ export declare const DRY_RUN_TOOLS: readonly ["ops_recompile", "memory_requeue"]
  * candidates, share calendars. Never called by the smoke; covered by the unit
  * suites (`write-tools.test.ts` and each family's own).
  */
-export declare const WRITE_TOOLS: readonly ["brain_retry", "emit_event", "docs_create", "docs_update", "docs_delete", "docs_link", "msg_create_channel", "msg_dm", "msg_send", "work_create_issue", "work_update_issue", "work_move_issue", "work_comment_issue", "careers_rescreen", "careers_send_takehome", "careers_invite", "careers_grade", "careers_decide", "careers_followup", "careers_interview", "careers_takehome_set", "careers_settings_set", "rename_resolve", "github_merge", "github_retitle", "github_rerun", "mail_send", "mail_draft", "mail_rename", "mail_enable", "mail_disable", "mail_default", "mail_remove", "cal_change", "mail_sync", "mail_detach", "cal_create", "cal_share", "cal_sync", "cal_detach", "cal_delete", "jarvis_dispatch", "glossary_add", "glossary_remove", "notes_mkdir", "notes_rmdir", "notes_rename", "notes_upload", "notes_paste", "notes_share", "notes_unshare", "notes_move", "notes_sync", "notes_detach", "memory_experience", "scout_start", "scout_dismiss", "scout_undo", "brief_rewrite", "brief_correct", "brief_done", "brief_undone", "settings_set", "settings_delete", "model_set", "team_invite", "team_role", "team_device_revoke", "team_device_doctor"];
+export declare const WRITE_TOOLS: readonly ["logs_key_mint", "brain_retry", "emit_event", "docs_create", "docs_update", "docs_delete", "docs_link", "msg_create_channel", "msg_dm", "msg_send", "work_create_issue", "work_update_issue", "work_move_issue", "work_comment_issue", "careers_rescreen", "careers_send_takehome", "careers_invite", "careers_grade", "careers_decide", "careers_followup", "careers_interview", "careers_takehome_set", "careers_settings_set", "rename_resolve", "github_merge", "github_retitle", "github_rerun", "mail_send", "mail_draft", "mail_rename", "mail_enable", "mail_disable", "mail_default", "mail_remove", "cal_change", "mail_sync", "mail_detach", "cal_create", "cal_share", "cal_sync", "cal_detach", "cal_delete", "jarvis_dispatch", "glossary_add", "glossary_remove", "notes_mkdir", "notes_rmdir", "notes_rename", "notes_upload", "notes_paste", "notes_share", "notes_unshare", "notes_move", "notes_sync", "notes_detach", "memory_experience", "scout_start", "scout_dismiss", "scout_undo", "brief_rewrite", "brief_correct", "brief_done", "brief_undone", "settings_set", "settings_delete", "model_set", "team_invite", "team_role", "team_grant", "team_revoke", "team_device_revoke", "team_device_doctor"];
 /** Reads that spend a model turn. The smoke's `--no-model` leaves these out. */
 export declare const MODEL_SPENDING_TOOLS: readonly ["jarvis_ask", "jarvis_check"];
 /**

package/dist/tool-catalog.js

@@ -20,6 +20,7 @@ export const READ_TOOLS = [
     "msg_channels",
     "msg_read",
     "msg_thread",
+    "work_board",
     "work_list_issues",
     "work_get_issue",
     "work_issue_history",
@@ -77,6 +78,7 @@ export const READ_TOOLS = [
     "slack_connect",
     "slack_disconnect",
     "slack_read",
+    "memory_map",
     "memory_rules",
     "memory_knowledge",
     "memory_profile",
@@ -85,6 +87,9 @@ export const READ_TOOLS = [
     "settings_list",
     "model_show",
     "team_members",
+    "team_github_login_add",
+    "team_github_login_remove",
+    "team_github_login_list",
     "team_device_list",
     "scout_board",
     "workbook_read",
@@ -106,6 +111,7 @@ export const DRY_RUN_TOOLS = ["ops_recompile", "memory_requeue"];
  * suites (`write-tools.test.ts` and each family's own).
  */
 export const WRITE_TOOLS = [
+    "logs_key_mint",
     "brain_retry",
     "emit_event",
     "docs_create",
@@ -169,6 +175,8 @@ export const WRITE_TOOLS = [
     "model_set",
     "team_invite",
     "team_role",
+    "team_grant",
+    "team_revoke",
     "team_device_revoke",
     "team_device_doctor",
 ];

package/dist/usage-tools.js

@@ -84,28 +84,26 @@ export function registerUsageTools(server, deps) {
         return dataResult(`${response.body.read_coverage?.join(" ") ?? ""} ${coverage?.sessions_extracted ?? 0} of ${coverage?.sessions_observed ?? 0} sessions extracted.${why} ${coverage?.sessions_counted_at_upload ?? 0} of ${coverage?.sessions_observed ?? 0} sessions counted at upload, ${coverage?.sessions_counted_by_server ?? 0} by server backfill, ${coverage?.sessions_counted_by_ladder ?? 0} by the ladder.${args.groupBy === "task_type" ? ` ${coverage?.sessions_labelled ?? 0} of ${coverage?.sessions_observed ?? 0} sessions labelled by topic.` : ""}${priceLabel}${github}`, response.body);
     }));
     registrarFor(server)("usage_sessions", {
-        title: "Read task or subject sessions",
-        description: "The sessions behind one ticket or one topic: titles, tokens and work types. Name exactly one of task (a BLI-#### id) or subject (a TOPIC label, as usage_people with groupBy topic lists it; not a person). Or pass session (a session id) alone to read that session's digest windows, ten at a time from fromWindow. This read can take 25 seconds.",
+        title: "Read sessions and session detail",
+        description: "List a bounded page of sessions filtered by exact person, window, repo, tool, ticket or topic. Returns transcript start time, predominant model by tokens, known effort, tokens, duration, tool calls, recorded commit/PR links and L1 summary or its missing reason. Continue with next_cursor. Pass session for detail even if no digest exists.",
         inputSchema: {
+            cursor: z.string().max(500).optional().describe("next_cursor from the previous page; keep filters and absolute window unchanged."),
+            limit: z.number().int().min(1).max(200).optional().describe("Page size, default 100."),
+            tool: z.enum(["claude", "codex"]).optional().describe("Only this agent tool."),
             task: z.string().regex(/^BLI-[0-9]+$/).optional().describe("A ticket id, e.g. BLI-4258: the sessions labelled with it."),
             subject: z.string().min(1).max(300).optional().describe("A topic label exactly as usage_people groupBy topic prints it. Not a person or an email."),
             repo: z.string().min(1).max(200).optional().describe("Only sessions in this repo label."),
-            person: z.string().min(1).max(64).optional().describe("Only this person's sessions, by user id (usage_people user_id)."),
+            person: z.string().min(1).max(320).optional().describe("Exact roster name, alias, email, GitHub login or account id; me means the caller."),
             subtopic: z.string().min(1).max(300).optional().describe("Only sessions with this subtopic label."),
             since: z.string().min(1).max(40).optional().describe(`${WINDOW_BOUND}. Default 30d.`),
             until: z.string().min(1).max(40).optional().describe(`${WINDOW_BOUND}. Default now.`),
             include_automated: z.boolean().optional().describe("Count automated sessions too. Off by default."),
-            session: z.string().min(1).max(200).optional().describe("A session id: read its digest windows instead of listing sessions."),
+            session: z.string().min(1).max(200).optional().describe("An ambient row UUID or transcript session id: session detail plus optional digest windows, independent of the list window."),
             fromWindow: z.number().int().min(1).optional().describe("With session: the first window number to read. Default 1."),
         },
     }, async (args) => withSession(deps, async (session) => {
-        // The door answers a bare 400 `subject_and_valid_window_required` when
-        // neither is named; say what to pass instead of "Tower answered 400".
-        if (args.session === undefined && args.task === undefined && (typeof args.subject !== "string" || args.subject.trim() === "")) {
-            return errorResult("usage_sessions needs task (a BLI-#### id), subject (a topic label from usage_people groupBy topic) or session (a session id) (task_or_subject_required). Nothing was read.");
-        }
         const query = new URLSearchParams();
-        for (const key of ["task", "subject", "repo", "person", "subtopic", "since", "until", "session", "fromWindow"])
+        for (const key of ["tool", "cursor", "limit", "task", "subject", "repo", "person", "subtopic", "since", "until", "session", "fromWindow"])
             if (args[key] !== undefined)
                 query.set(key, String(args[key]));
         if (args.include_automated)
@@ -115,9 +113,9 @@ export function registerUsageTools(server, deps) {
             return errorResult(doorFailureText("usage_sessions", response));
         if (args.session !== undefined) {
             const windows = Array.isArray(response.body.windows) ? response.body.windows.length : 0;
-            return dataResult(`${windows} digest window(s) of session ${String(args.session)}.`, response.body);
+            return dataResult(`Session detail and ${windows} digest window(s) of session ${String(args.session)}.`, response.body);
         }
         const sessions = Array.isArray(response.body.sessions) ? response.body.sessions.length : 0;
-        return dataResult(`${response.body.read_coverage?.join(" ") ?? ""} ${sessions} session(s) for ${args.task ? `task ${String(args.task)}` : `topic "${String(args.subject)}"`}.`, response.body);
+        return dataResult(`${response.body.read_coverage?.join(" ") ?? ""} ${sessions} session(s) for ${args.task ? `task ${String(args.task)}` : args.subject ? `topic "${String(args.subject)}"` : args.person ? `person ${String(args.person)}` : "the requested window"}.`, response.body);
     }));
 }

package/dist/verb-census-spellings.js

@@ -31,6 +31,9 @@ export const TYPED_SPELLING = {
     "settings list": "settings env list",
     "settings set": "settings switches set",
     "settings delete": "settings env delete",
+    "team github-login-add": "team github-login add",
+    "team github-login-remove": "team github-login remove",
+    "team github-login-list": "team github-login list",
     "team device-list": "team device list",
     "team device-revoke": "team device revoke",
     "team device-doctor": "team device doctor",

package/dist/verb-census.js

@@ -137,6 +137,7 @@ export function towerVerbs() {
     const verbs = [
         { noun: "memory", action: "log", spelling: "memory log" },
         ...memoryStoreVerbs(aliases),
+        ...["mint", "rotate"].map(action => ({ noun: "logs", action: `keys ${action}`, spelling: `logs keys ${action}` })),
     ];
     const seenNouns = new Set();
     for (const variant of commandVariants()) {
@@ -238,6 +239,8 @@ export const MCP_TWINS = {
     // BLI-12833: a local read, not a Tower door: it runs the shared log digest over
     // this machine's collector logs and the `vercel` / `railway` CLIs.
     // BLI-12855: a project name (or --stored, or a local CLI that is missing) reads the digests Tower's cron stored, through GET /api/logs.
+    "logs keys mint": { tool: "logs_key_mint", door: "POST /api/settings/log-ingest-keys" },
+    "logs keys rotate": { tool: "logs_key_mint", door: "POST /api/settings/log-ingest-keys" },
     "logs": { tool: "logs_digest", door: "LOCAL @bli-cockpit/telemetry-core/log-digest (this machine's logs); `project` reads GET /api/logs (the stored digests)" },
     "brain retry": { tool: "brain_retry", door: "POST /api/brain/incidents/retry" },
     "brain status": { tool: "brain_status", door: "GET /api/brain/incidents" },
@@ -265,6 +268,7 @@ export const MCP_TWINS = {
     "msg read": { tool: "msg_read", door: "GET /api/msg/channels/[id]/messages" },
     "msg thread": { tool: "msg_thread", door: "GET /api/msg/channels/[id]/messages?thread_parent_id=" },
     "msg send": { tool: "msg_send", door: "POST /api/msg/channels/[id]/messages" },
+    "issue board": { tool: "work_board", door: "GET /api/work/board" },
     "issue list": { tool: "work_list_issues", door: "GET /api/work/issues" },
     "issue show": { tool: "work_get_issue", door: "GET /api/work/issues/[id]" },
     "issue create": { tool: "work_create_issue", door: "POST /api/work/issues" },
@@ -342,6 +346,7 @@ export const MCP_TWINS = {
     // BLI-4533: the compiled one-page profile. Its twin is on `bli-tower`, not
     // `bli-memory`: that server's four tools are the vendor-compatible set the
     // Claude Code plugin expects, and this page is ours.
+    "memory map": { tool: "memory_map", door: "GET /api/memory/map" },
     "memory knowledge": { tool: "memory_knowledge", door: "GET /api/memory/knowledge" },
     "memory rules": { tool: "memory_rules", door: "GET /api/memory/rules" },
     "memory profile": { tool: "memory_profile", door: "GET /api/memory/profile" },
@@ -363,9 +368,14 @@ export const MCP_TWINS = {
     "settings list": { tool: "settings_list", door: "GET /api/settings/env-blobs" },
     "settings set": { tool: "settings_set", door: "POST /api/settings/{jarvis-model,switches,model-routing,env-blobs} + PUT /api/settings/cli-floor" },
     "settings delete": { tool: "settings_delete", door: "DELETE /api/settings/env-blobs" },
+    "team github-login-add": { tool: "team_github_login_add", door: "POST /api/team/members/[userId]/github-logins" },
+    "team github-login-remove": { tool: "team_github_login_remove", door: "DELETE /api/team/members/[userId]/github-logins" },
+    "team github-login-list": { tool: "team_github_login_list", door: "GET /api/team/members/[userId]/github-logins" },
     "team members": { tool: "team_members", door: "GET /api/team/members" },
     "team device-list": { tool: "team_device_list", door: "GET /api/team/devices" },
     "team invite": { tool: "team_invite", door: "POST /api/team/invite" },
+    "team grant": { tool: "team_grant", door: "POST /api/team/grants" },
+    "team revoke": { tool: "team_revoke", door: "POST /api/team/grants" },
     "team role": { tool: "team_role", door: "PATCH /api/team/members/[userId]/role" },
     "team device-doctor": { tool: "team_device_doctor", door: "POST /api/ambient/devices/[deviceId]/doctor" },
     "team device-revoke": { tool: "team_device_revoke", door: "POST /api/ambient/devices/[deviceId]/revoke" },

package/dist/work-board-tools.d.ts

@@ -0,0 +1,5 @@
+import { type ToolDeps } from "./tool-result.js";
+/** Board windows and coverage over the same door the Tickets page reader backs. */
+export declare function registerWorkBoardTool(server: {
+    registerTool: (...args: never[]) => unknown;
+}, deps: ToolDeps): void;

package/dist/work-board-tools.js

@@ -0,0 +1,20 @@
+import { z } from "zod";
+import { callAgentDoor } from "./agent-door.js";
+import { doorFailureText, errorResult, registrarFor, textResult, withSession } from "./tool-result.js";
+/** Board windows and coverage over the same door the Tickets page reader backs. */
+export function registerWorkBoardTool(server, deps) {
+    const register = registrarFor(server);
+    register("work_board", { title: "Read Tower Tickets board", description: "Per-state card windows, counts, coverage and named failures, matching /tickets.",
+        inputSchema: { state: z.enum(["backlog", "todo", "in_progress", "in_review", "done", "canceled"]).describe("Show one state column only.").optional(), assignee: z.string().describe("me, unassigned, or a user uuid.").optional(),
+            project: z.string().uuid().describe("Project id (uuid).").optional(), label: z.string().describe("Label name to filter by.").optional(), rows: z.string().describe("Per-state row window tokens, as the board page uses.").optional() } }, async (args) => withSession(deps, async (session) => {
+        const query = new URLSearchParams();
+        for (const key of ["state", "assignee", "project", "label", "rows"])
+            if (args[key] !== undefined)
+                query.set(key, String(args[key]));
+        const suffix = query.toString();
+        const response = await callAgentDoor(session, deps.fetchImpl, "GET", `/api/work/board${suffix ? `?${suffix}` : ""}`);
+        if (!response.ok)
+            return errorResult(doorFailureText("work_board", response));
+        return textResult(JSON.stringify(response.body), response.body);
+    }));
+}

package/dist/work-flag-census.js

@@ -86,6 +86,30 @@ export function mcpToolFieldNames(toolName) {
     return Object.keys(shape);
 }
 export const EXPECTED_ONE_SIDED_FIELDS = [
+    {
+        verb: "issue create",
+        side: "cli",
+        field: "label",
+        reason: "a board filter: the parser accepts --label only for `cockpit issue board` (BLI-13354) and refuses it on create; work_board carries the matching field.",
+    },
+    {
+        verb: "issue create",
+        side: "cli",
+        field: "rows",
+        reason: "a board filter: the parser accepts --rows only for `cockpit issue board` (BLI-13354) and refuses it on create; work_board carries the matching field.",
+    },
+    {
+        verb: "issue update",
+        side: "cli",
+        field: "label",
+        reason: "a board filter: the parser accepts --label only for `cockpit issue board` (BLI-13354) and refuses it on update; work_board carries the matching field.",
+    },
+    {
+        verb: "issue update",
+        side: "cli",
+        field: "rows",
+        reason: "a board filter: the parser accepts --rows only for `cockpit issue board` (BLI-13354) and refuses it on update; work_board carries the matching field.",
+    },
     {
         verb: "issue update",
         side: "mcp",

package/dist/work-tools.js

@@ -15,6 +15,7 @@
  * server's other tools and only a `work_` call fails, by name.
  */
 import { z } from "zod";
+import { registerWorkBoardTool } from "./work-board-tools.js";
 import { callAgentDoor } from "./agent-door.js";
 import { DEFAULT_LIST_LIMIT, doorFailureText, errorResult, moreNote, registrarFor, textResult, withSession, } from "./tool-result.js";
 import { assigneeLabel, resolveAssigneeDirectory, withAssigneeIdentity } from "./work-directory.js";
@@ -83,6 +84,7 @@ async function resolveParentId(deps, session, ref) {
 }
 export function registerWorkTools(server, deps) {
     const register = registrarFor(server);
+    registerWorkBoardTool(server, deps);
     register("work_list_issues", {
         title: "List Tower tickets",
         description: "Tower tickets you may see, most recently updated first: identifier, state, title, priority, assignee, project. "

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/mcp",
-  "version": "0.1.113",
+  "version": "0.1.114",
   "private": false,
   "description": "bli-tower: an MCP server over BLI Cockpit's agent doors: JARVIS (jarvis_*), documents (docs_*), channels (msg_*), issues (work_*), the daily page (brief_*), meeting notes (notes_*), the ops board (ops_status/slack_*), settings/team/model, Scout and the workbook, plus the legacy event-stream tools (emit_event, get_ticket_timeline, get_active_tickets).",
   "type": "module",
@@ -37,7 +37,7 @@
     "readme": "npm run build && node scripts/write-readme-census.mjs"
   },
   "dependencies": {
-    "@bli-cockpit/telemetry-core": "0.1.69",
+    "@bli-cockpit/telemetry-core": "0.1.70",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^4.3.6"
   },