quoxcli 0.0.0-stage → 0.3.1

package/lib/quoxon/objects/fetch.js

@@ -0,0 +1,182 @@
+/**
+ * Data for the inline object views, from the real services only. Every read is bounded (timeouts are
+ * short on purpose: an inline card must not hang the composer) and every failure comes back as a
+ * reason string, never as an empty result. Status is checked before anything is parsed: the client
+ * throws on non-2xx, and the throw is what becomes the reason.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { findSkill } from '../skills.js';
+import { packFrom } from './ladder.js';
+import { slotFor } from './agent.js';
+import { listFailure } from '../session.js';
+import { resolveEndpoint } from '../../api/endpoints.js';
+import { fleetFetchers } from './fleet.js';
+import { healthFetchers } from './health.js';
+import { proveFetchers } from './prove.js';
+import { replayFetchers } from './replay.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const ASSISTANTS_DIR = path.resolve(HERE, '../../../../src/config/entities/assistants');
+const listOf = (d, ...keys) => { for (const k of keys) if (Array.isArray(d?.[k])) return d[k]; return Array.isArray(d) ? d : []; };
+const why = (e) => (e?.status ? `HTTP ${e.status}` : /timed out/i.test(e?.message || '') ? 'timed out' : e?.message || 'failed');
+
+/** The shipped assistant identities: id -> { name, tagline, description }. */
+export function bundledIdentities(dir = ASSISTANTS_DIR) {
+  const out = new Map();
+  let files = [];
+  try { files = fs.readdirSync(dir).filter(f => f.endsWith('.json')); } catch { return out; }
+  for (const f of files) {
+    try {
+      const j = JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8'));
+      if (j?.id) out.set(j.id, { name: j.identity?.name || j.id, tagline: j.identity?.tagline || null, description: j.identity?.description || null });
+    } catch { /* skip unreadable */ }
+  }
+  return out;
+}
+
+export function createObjectsApi({ client, orgId = () => null, home = os.homedir(), identities = bundledIdentities, profile = null }) {
+  const get = (service, p, query, timeout = 12000) => client.get(p, { service, query, retries: 0, timeout });
+  const post = (service, p, body, timeout = 8000) => client.post(p, { service, body, retries: 0, timeout });
+  const org = () => { const o = orgId(); return typeof o === 'string' ? o : null; };
+  let ids = null;
+  const idents = () => (ids ??= identities());
+  const nameOf = (id) => idents().get(id)?.name || id;
+
+  async function verifyReceipt(envelopeId, timeoutS = 8) {
+    try { const d = await post('collector', '/ward/verify-receipt', { source_id: envelopeId, source_kind: 'AEE' }, timeoutS * 1000); return { ok: true, result: d?.result || d }; }
+    catch (e) { return { ok: false, error: why(e), timeout: /timed out/i.test(e?.message || '') ? timeoutS : null }; }
+  }
+  async function aeeGet(id) {
+    try { const d = await get('collector', `/aee/${encodeURIComponent(id)}`, undefined, 10000); return { ok: true, env: d?.envelope || d }; }
+    catch (e) { return { ok: false, status: e?.status, error: why(e) }; }
+  }
+
+  /** Workflow by id or display name (quoxflow GET /api/workflows). -> { id, name, definition } | null */
+  async function findWorkflow(ref) {
+    const r = String(ref || '').trim();
+    try { const d = await get('quoxflow', `/api/workflows/${encodeURIComponent(r)}`); const w = d?.data || d; if (w?.id) return w; } catch (e) { if (e?.status && e.status !== 404) throw e; }
+    const all = listOf(await get('quoxflow', '/api/workflows', { limit: 100 }), 'data', 'workflows', 'items');
+    const lc = r.toLowerCase();
+    return all.find(w => String(w.name || '').toLowerCase() === lc) || all.find(w => String(w.name || '').toLowerCase().includes(lc)) || null;
+  }
+  async function pageExecutions(workflowId, status, max = 500) {
+    const out = [];
+    for (let offset = 0; offset < max; offset += 100) {
+      const rows = listOf(await get('quoxflow', '/api/executions', { workflowId, status, limit: 100, offset }), 'data', 'executions');
+      out.push(...rows);
+      if (rows.length < 100) break;
+    }
+    return out;
+  }
+
+  const self = {
+    ...fleetFetchers({ get, org, listOf, why, resolveEndpoint }),
+    ...healthFetchers({ get, org, listOf, why, resolveEndpoint }),
+    ...replayFetchers({ get, listOf, why, verifyReceipt: (id, t) => verifyReceipt(id, t), aeeGet: (id) => aeeGet(id) }),
+    ...proveFetchers({ get, listOf, resolveEndpoint, self: { proof: (t) => self.proof(t) } }),
+    /** E1 */
+    async skill(name) {
+      const all = listOf(await get('collector', '/quoxflow/skills', { orgId: org() || undefined }), 'data', 'skills');
+      const hit = findSkill(all, name);
+      if (!hit) return { error: `No skill named "${name}". /skills lists them.`, tone: 'warn' };
+      let skill = hit;
+      try { const d = await get('collector', `/quoxflow/skills/${encodeURIComponent(hit.id)}`, { orgId: org() || undefined }); skill = d?.data || d || hit; } catch { /* the list row is the same record */ }
+      let scoreboard = null;
+      // The org-scoped per-skill route; 404 = no recorded runs. (The bulk /scoreboards list is not
+      // org-filtered in quoxflow, so it is deliberately not used here.)
+      try { const d = await get('quoxflow', `/api/quox-skills/${encodeURIComponent(skill.id)}/scoreboard`, undefined, 8000); scoreboard = { ok: true, row: d?.data || null }; }
+      catch (e) { scoreboard = e?.status === 404 ? { ok: true, row: null } : { ok: false, error: why(e) }; }
+      return { data: { skill, scoreboard, agentName: nameOf } };
+    },
+
+    /** E2: ref = execution id / correlation id, or a workflow id or name (its latest run). */
+    async workflowRun(ref) {
+      let execution = null;
+      try { const d = await get('quoxflow', `/api/executions/${encodeURIComponent(ref)}`); execution = d?.data || d; } catch (e) { if (e?.status && e.status !== 404) throw e; }
+      if (!execution?.id) {
+        const wf = await findWorkflow(ref);
+        if (!wf) return { error: `No workflow or run called "${ref}".`, tone: 'warn' };
+        const rows = listOf(await get('quoxflow', '/api/executions', { workflowId: wf.id, limit: 1 }), 'data', 'executions');
+        if (!rows.length) return { error: `${wf.name || wf.id} has never run.`, tone: 'warn' };
+        execution = rows[0];
+      }
+      let envelopes = null, def = null;
+      try { const d = await get('quoxflow', `/api/executions/${encodeURIComponent(execution.id)}/envelopes`); envelopes = listOf(d?.data || d, 'envelopes'); } catch { envelopes = null; }
+      try { const d = await get('quoxflow', `/api/workflows/${encodeURIComponent(execution.workflowId)}`); def = (d?.data || d)?.definition || null; } catch { def = null; }
+      return { data: { execution, envelopes, def } };
+    },
+
+    /** E3 */
+    async crystal(ref) {
+      const wf = await findWorkflow(ref);
+      if (!wf) return { error: `No workflow called "${ref}".`, tone: 'warn' };
+      const [completed, failed] = await Promise.all([pageExecutions(wf.id, 'completed'), pageExecutions(wf.id, 'failed')]);
+      return { data: { workflow: { id: wf.id, name: wf.name }, executions: [...completed, ...failed], def: wf.definition || null } };
+    },
+
+    /** E4 */
+    async agent(name) {
+      const q = String(name || '').trim().toLowerCase();
+      let toolMap = null, toolErr = null, toolFail = null;
+      try { toolMap = (await client.get('/api/v1/tools/agents', { service: 'collector', retries: 0, timeout: 10000 }))?.agentTools || null; } catch (e) { toolErr = why(e); toolFail = e; }
+      let orgAgents = [];
+      try { if (org()) orgAgents = listOf(await get('auth', `/api/orgs/${org()}/agents`, { includeTools: 'false' }), 'agents', 'data'); } catch { /* optional */ }
+      const known = new Set([...Object.keys(toolMap || {}), ...idents().keys(), ...orgAgents.map(a => a.agent_id)]);
+      let id = [...known].find(k => k.toLowerCase() === q);
+      if (!id) id = [...known].find(k => String(nameOf(k)).toLowerCase() === q) || orgAgents.find(a => String(a.name || '').toLowerCase() === q)?.agent_id;
+      if (!id && toolFail) return { error: `Couldn't check agents: ${listFailure(toolFail, profile)}`, tone: 'warn' }; // a failed list is a failure, never "no such agent"
+      if (!id) return { error: `No agent called "${name}".`, tone: 'warn' };
+      const record = orgAgents.find(a => a.agent_id === id) || null;
+      const ident = idents().get(id) || {};
+      let slot = null;
+      try { slot = slotFor(listOf(await get('collector', '/api/v1/slots', undefined, 10000), 'slots'), id); } catch { slot = null; }
+      let last = null, lastErr = null, receipt = null;
+      try { last = listOf(await get('collector', '/aee/query', { from: `agent.${id}`, limit: 1 }, 10000), 'envelopes')[0] || null; } catch (e) { lastErr = why(e); }
+      if (last?.id) receipt = await verifyReceipt(last.id);
+      return { data: { id, name: ident.name || record?.name || id, tagline: ident.tagline, description: record?.description || ident.description || null, status: record?.status || null, record, tools: toolMap ? (toolMap[id] || []) : null, toolsErr: toolErr, slot, last, lastErr, receipt } };
+    },
+
+    /** E6 */
+    async memory(query) {
+      const d = await get('memory', '/api/memory/search', { q: query, limit: 10 });
+      return { data: { query, results: listOf(d, 'results', 'memories', 'data') } };
+    },
+
+    /** E7 */
+    async rules() {
+      let policies;
+      const o = org();
+      if (!o) policies = { ok: false, error: 'no org on this profile' };
+      else {
+        try { policies = { ok: true, list: listOf(await get('collector', `/orgs/${o}/governance/policies`, undefined, 15000), 'policies') }; }
+        catch (e) { policies = { ok: false, error: why(e) }; }
+      }
+      const pack = packFrom((f) => fs.readFileSync(path.join(home, '.claude', 'skills', f), 'utf8'));
+      return { data: { policies, pack } };
+    },
+
+    /** D1 */
+    async proof(tool) {
+      const envelope = await aeeGet(tool.envelopeId);
+      let aocl = null;
+      const corr = envelope.ok ? envelope.env?.corr : null;
+      if (corr) {
+        try { aocl = { ok: true, list: listOf(await get('collector', '/aee/query', { corr, limit: 50 }, 10000), 'envelopes').filter(e => /^aocl\./.test(String(e.intent || ''))) }; }
+        catch (e) { aocl = { ok: false, error: why(e) }; }
+      }
+      const receipt = await verifyReceipt(tool.envelopeId);
+      return { data: { tool, envelope, aocl, receipt } };
+    },
+
+    /** D3 */
+    async reconcile(tools) {
+      const items = [];
+      for (const t of tools) items.push({ tool: t.tool, envelopeId: t.envelopeId || null, record: t.envelopeId ? await aeeGet(t.envelopeId) : null });
+      return { data: { items } };
+    }
+  };
+  return self;
+}

package/lib/quoxon/objects/fleet.js

@@ -0,0 +1,149 @@
+/**
+ * /fleet: computers, agents, missions and SubFleets in one compact block, with health. Read-only.
+ * Sources (the same routes `quox fleet ...` and `quox objective list` use): GET /api/v1/agents
+ * (heartbeats), GET /api/v1/fleet/hosts (Bastion registry), org agents, GET /api/objectives. A source
+ * that could not be read is named on the "Can't see" line, never counted as zero. SubFleets have an
+ * RFC but no API yet, so that row says so. Moving work is not here: the hint points at plain words.
+ */
+import { seg, fit, fitRow, ago, plural, boxWidth } from './model.js';
+import { fromObjective } from '../roster.js';
+
+const OFFLINE = /^(dead|offline|down|disconnected|unreachable)$/;
+const HEALTHY = /^(healthy|ok|good)$/;
+const DEGRADED = /^(warning|warn|degraded|stale)$/;
+const UNHEALTHY = /^(critical|unhealthy|error|failed|fail)$/;
+const FLEET_OVERVIEW_WORDS = new Set(['health', 'status', 'list', 'all', 'overview', 'summary', 'hosts', 'agents', 'quoxagents']);
+
+export const ORDER = ['healthy', 'degraded', 'unhealthy', 'offline', 'unknown'];
+const SEVERITY = { unhealthy: 0, offline: 1, degraded: 2, unknown: 3, healthy: 4 };
+
+/** A heartbeat row or a Bastion host row -> healthy | degraded | unhealthy | offline | unknown. */
+export function healthOf(row) {
+  const s = row?.status;
+  const st = String(typeof s === 'object' && s ? s.state ?? '' : s ?? '').toLowerCase();
+  const h = String(typeof s === 'object' && s ? s.health ?? '' : '').toLowerCase();
+  if (OFFLINE.test(st) || OFFLINE.test(h)) return 'offline';
+  if (UNHEALTHY.test(h) || UNHEALTHY.test(st)) return 'unhealthy';
+  if (DEGRADED.test(h) || DEGRADED.test(st)) return 'degraded';
+  if (HEALTHY.test(h) || HEALTHY.test(st)) return 'healthy';
+  return 'unknown';
+}
+
+const listOk = (s) => (s?.ok ? s.list || [] : null);
+
+/** d: { agents, hosts, orgAgents, missions } each { ok, list } | { ok:false, error } -> merged view model. */
+export function collectFleet(d, now = Date.now()) {
+  const byId = new Map();
+  const cant = [];
+  const sources = [['heartbeats', d.agents], ['hosts', d.hosts]];
+  for (const [label, src] of sources) {
+    if (!src) continue;
+    if (!src.ok) { cant.push(`${label} (${src.error || 'failed'})`); continue; }
+    for (const r of src.list || []) {
+      const id = r.host_id || r.id || r.hostname;
+      if (!id) continue;
+      const cur = byId.get(id) || { id };
+      if (label === 'heartbeats') {
+        const s = r.status;
+        byId.set(id, { ...cur, health: healthOf(r), version: r.version ?? cur.version, lastSeenS: typeof s === 'object' ? s?.last_seen_seconds : undefined, heartbeat: true });
+      } else {
+        byId.set(id, { ...cur, ip: r.ip ?? cur.ip, group: r.group ?? cur.group, registryHealth: healthOf(r), health: cur.heartbeat ? cur.health : healthOf(r) });
+      }
+    }
+  }
+  const computers = [...byId.values()].sort((a, b) => SEVERITY[a.health] - SEVERITY[b.health] || a.id.localeCompare(b.id));
+  const counts = Object.fromEntries(ORDER.map(k => [k, 0]));
+  for (const c of computers) counts[c.health]++;
+  const org = listOk(d.orgAgents);
+  if (d.orgAgents && !d.orgAgents.ok) cant.push(`agents (${d.orgAgents.error || 'failed'})`);
+  const agents = org ? { active: org.filter(a => !a.status || a.status === 'active').length, other: org.filter(a => a.status && a.status !== 'active').length } : null;
+  let missions = null;
+  if (d.missions && !d.missions.ok) cant.push(`missions (${d.missions.error || 'failed'})`);
+  else if (d.missions) {
+    const rows = (d.missions.list || []).map(o => fromObjective(o, now)).filter(Boolean);
+    missions = { running: rows.filter(r => r.state === 'running').length, waiting: rows.filter(r => r.state === 'waiting').length, loops: rows.filter(r => r.kind === 'loop' && (r.state === 'running' || r.state === 'waiting')).length, rows: rows.filter(r => r.state === 'running' || r.state === 'waiting') };
+  }
+  return { computers, counts, agents, missions, cant };
+}
+
+const ROLE = { healthy: 'ok', degraded: 'warn', unhealthy: 'error', offline: 'error', unknown: 'muted' };
+const HINT = 'ask in plain words to move work';
+
+/** d: { agents, hosts, orgAgents, missions, now } -> view { box, rows } */
+export function fleetCard(d, cols) {
+  const now = d.now ?? Date.now();
+  const f = collectFleet(d, now);
+  const w = boxWidth(cols, 78), inner = w - 4;
+  const L = (label, parts) => [seg(label.padEnd(12), 'muted'), ...parts];
+  const rows = [];
+  if (f.computers.length || (d.agents?.ok || d.hosts?.ok)) {
+    const bits = [];
+    for (const k of ORDER) if (f.counts[k]) { if (bits.length) bits.push(seg(' · ', 'muted')); bits.push(seg(`${f.counts[k]} ${k}`, ROLE[k], k !== 'healthy')); }
+    rows.push(L('Computers', [seg(`${f.computers.length}  `, 'value', true), ...bits]));
+    const bad = f.computers.filter(c => c.health !== 'healthy');
+    if (bad.length) rows.push([seg('not healthy'.padEnd(12), 'muted'), seg(fit(bad.map(c => `${c.id} ${c.health}`).join(', '), inner - 12), 'warn')]);
+  } else rows.push(L('Computers', [seg('?', 'warn'), seg(' not read', 'muted')]));
+  rows.push(f.agents ? L('Agents', [seg(`${f.agents.active} active`, 'value'), ...(f.agents.other ? [seg(` · ${f.agents.other} other`, 'muted')] : [])]) : L('Agents', [seg('?', 'warn')]));
+  if (f.missions) {
+    const m = f.missions;
+    const extra = [m.waiting ? plural(m.waiting, 'waiting', 'waiting') : null, m.loops ? plural(m.loops, 'loop') : null].filter(Boolean);
+    rows.push(L('Missions', [seg(`${m.running} running`, 'value'), ...(extra.length ? [seg(` · ${extra.join(' · ')}`, 'muted')] : [])]));
+    for (const r of m.rows.slice(0, 3)) rows.push([seg('  ', 'muted'), seg(fit(`${r.name}${r.activity ? ` · ${r.activity}` : ''}`, inner - 2), 'muted')]);
+    if (m.rows.length > 3) rows.push([seg(`  …and ${m.rows.length - 3} more`, 'muted')]);
+  } else rows.push(L('Missions', [seg('?', 'warn')]));
+  rows.push(L('SubFleets', [seg('none yet', 'muted'), seg(w < 60 ? '' : ' (designed, no API in this Quox)', 'muted')]));
+  if (f.cant.length) rows.push([seg("Can't see ", 'warn'), seg(fit(f.cant.join(', '), inner - 12), 'warn')]);
+  rows.push([seg(HINT, 'muted')]);
+  return { box: { width: w, title: 'Fleet', titleRole: 'sky', border: 'sky' }, rows: rows.map(r => fitRow(r, inner)) };
+}
+
+/** d: { host, now } -> view for one computer. */
+export function hostCard(d, cols) {
+  const h = d.host;
+  const w = boxWidth(cols, 66), inner = w - 4;
+  const L = (label, v, role = 'value') => [seg(label.padEnd(8), 'muted'), seg(fit(v, inner - 8), role)];
+  const rows = [L('health', h.health, ROLE[h.health])];
+  if (h.ip) rows.push(L('ip', h.ip));
+  if (h.group) rows.push(L('group', h.group));
+  if (h.version) rows.push(L('version', h.version));
+  if (typeof h.lastSeenS === 'number') rows.push(L('seen', `${ago(Date.now() - h.lastSeenS * 1000, Date.now()) || '0s'} ago`, 'muted'));
+  if (!h.heartbeat) rows.push(L('agent', 'no heartbeat (in the registry only)', 'muted'));
+  rows.push([seg(HINT, 'muted')]);
+  return { box: { width: w, title: h.id, titleRole: 'sky', right: h.health, rightRole: ROLE[h.health], border: 'sky' }, rows };
+}
+
+/** Builder registered as BUILDERS.fleet: one host when d.host is set, else the whole fleet. */
+export function fleetView(d, cols) { return d.host ? hostCard(d, cols) : fleetCard(d, cols); }
+
+/** Fetchers for createObjectsApi (kept here so fetch.js only spreads them in). */
+export function fleetFetchers({ get, org, listOf, why, resolveEndpoint }) {
+  const read = async (fn) => { try { return { ok: true, list: await fn() }; } catch (e) { return { ok: false, error: why(e) }; } };
+  return {
+    /** Host ids for /fleet <TAB>: [{ value, desc }]; a failed read suggests nothing. */
+    async fleetNames() {
+      const hb = resolveEndpoint('v1.agents.list');
+      const rows = listOf(await get(hb.service, hb.path, undefined, 6000), 'agents');
+      return rows.map(r => r.host_id || r.id).filter(Boolean).map(id => ({ value: String(id), desc: healthOf(rows.find(r => (r.host_id || r.id) === id)) }));
+    },
+    /** E-fleet: name '' = the whole fleet, else one computer by id (case-insensitive, then prefix). */
+    async fleet(name) {
+      const q = String(name || '').trim().toLowerCase();
+      const hb = resolveEndpoint('v1.agents.list'), hs = resolveEndpoint('v1.fleet.hosts.list'), ob = resolveEndpoint('objectives.list');
+      const [agents, hosts, orgAgents, missions] = await Promise.all([
+        read(async () => listOf(await get(hb.service, hb.path, undefined, 10000), 'agents')),
+        read(async () => listOf(await get(hs.service, hs.path, undefined, 10000), 'hosts')),
+        org() ? read(async () => { const ep = resolveEndpoint('agents.list', { orgId: org() }); return listOf(await get(ep.service, ep.path, { includeTools: 'false' }, 10000), 'agents', 'data'); }) : Promise.resolve(null),
+        read(async () => listOf(await get(ob.service, ob.path, { limit: 100 }, 10000), 'objectives'))
+      ]);
+      const data = { agents, hosts, orgAgents, missions, now: Date.now() };
+      if (!q) return { data };
+      const f = collectFleet(data, data.now);
+      const host = f.computers.find(c => c.id.toLowerCase() === q) || f.computers.find(c => c.id.toLowerCase().startsWith(q));
+      if (host) return { data: { host, now: data.now } };
+      // owner 2026-10-15 typed "/fleet health": overview words mean the whole fleet (a real host by that name still wins above)
+      if (FLEET_OVERVIEW_WORDS.has(q)) return { data };
+      if (!agents.ok && !hosts.ok) return { error: `Couldn't check hosts: ${agents.error}.`, tone: 'warn' }; // a failed list is never "no such host"
+      return { error: `No host called "${name}". /fleet lists them.`, tone: 'warn' };
+    }
+  };
+}

package/lib/quoxon/objects/health.js

@@ -0,0 +1,186 @@
+/**
+ * /health (and /core): a compact summary of what the Core dashboard's overview (/dashboard) shows.
+ * Read-only, no model call, server-side reads only (the same truth the dashboard reads):
+ *   services   GET collector /api/v1/health/aggregate (the dashboard's service ring)
+ *   computers  GET /api/v1/agents heartbeats + GET /api/v1/fleet/hosts (as /fleet)
+ *   agents     org agents (as /fleet)
+ *   approvals  GET auth /api/orgs/:org/inbox/stats (the dashboard's "Attention needed")
+ *   missions   GET tasks /api/objectives (the dashboard's live objectives)
+ *   failures   GET quoxflow /api/executions?status=failed&since=24h
+ *   licence    GET auth /api/setup/licensing/entitlements
+ * A section whose read failed says "unavailable: <reason>"; an error body is never shown as zero.
+ * /status stays the session panel; /collector-health still goes to /status.
+ */
+import { seg, fit, fitRow, plural, boxWidth } from './model.js';
+import { collectFleet, fleetFetchers } from './fleet.js';
+
+const DAY_MS = 24 * 3600 * 1000;
+const SVC_ROLE = { ok: 'ok', degraded: 'warn', down: 'error' };
+const reasons = (...srcs) => [...new Set(srcs.filter(s => s && !s.ok).map(s => s.error || 'failed'))].join(', ');
+
+/** d: { aggregate, agents, hosts, orgAgents, missions, inbox, failures, licence, now } -> per-section model ({ error } when unread). */
+export function collectHealth(d) {
+  const now = d.now ?? Date.now();
+  const out = {};
+
+  const a = d.aggregate;
+  if (!a?.ok) out.services = { error: a?.error || 'not read' };
+  else {
+    const all = Object.entries(a.data?.services || {});
+    // Z2H run-6: an optional service this install does not ship (collector says not_installed) is neither up nor down.
+    const entries = all.filter(([, s]) => s?.status !== 'not_installed');
+    out.services = {
+      up: entries.filter(([, s]) => s?.status === 'ok').length,
+      total: entries.length,
+      score: typeof a.data?.score === 'number' ? a.data.score : null,
+      bad: entries.filter(([, s]) => s?.status !== 'ok').map(([name, s]) => ({ name, status: s?.status || 'unknown' })),
+      notInstalled: all.filter(([, s]) => s?.status === 'not_installed').map(([name]) => name),
+    };
+  }
+
+  const f = collectFleet({ agents: d.agents, hosts: d.hosts, orgAgents: d.orgAgents, missions: d.missions }, now);
+  if (d.agents?.ok || d.hosts?.ok) {
+    out.computers = { healthy: f.counts.healthy, total: f.computers.length, bad: f.computers.filter(c => c.health !== 'healthy').map(c => ({ id: c.id, health: c.health })), partial: reasons(d.agents, d.hosts) || null };
+  } else out.computers = { error: reasons(d.agents, d.hosts) || 'not read' };
+
+  if (!d.orgAgents) out.agents = { error: 'no org selected' };
+  else out.agents = f.agents ? { ...f.agents } : { error: d.orgAgents.error || 'failed' };
+
+  out.missions = f.missions ? { running: f.missions.running, waiting: f.missions.waiting, loops: f.missions.loops } : { error: d.missions?.error || 'not read' };
+
+  const ib = d.inbox;
+  if (!ib?.ok) out.approvals = { error: ib?.error || 'not read' };
+  else {
+    const s = ib.data || {};
+    out.approvals = { approvals: Number(s.pending_approvals) || 0, active: Number(s.total_active) || 0, urgent: Number(s.urgent) || 0, overdue: Number(s.overdue) || 0 };
+  }
+
+  const fl = d.failures;
+  if (!fl?.ok) out.failures = { error: fl?.error || 'not read' };
+  else {
+    const list = fl.list || [];
+    const r = list[0];
+    out.failures = { count: typeof fl.total === 'number' ? fl.total : list.length, last: r ? (r.workflowName || r.workflow_name || r.name || r.workflowId || r.workflow_id || r.id || null) : null };
+  }
+
+  const li = d.licence;
+  if (!li?.ok) out.licence = { error: li?.error || 'not read' };
+  else {
+    const L = li.data || {};
+    const leases = Array.isArray(L.licenses) ? L.licenses : [];
+    const plugins = Array.isArray(L.entitlements) ? L.entitlements.length : 0;
+    const errors = Array.isArray(L.entitlement_errors) ? L.entitlement_errors.length : 0;
+    if (!leases.length) out.licence = { core: true, plugins, errors };
+    else {
+      const plans = [...new Set(leases.flatMap(x => Array.isArray(x.plans) ? x.plans : []))];
+      const exp = leases.map(x => Date.parse(x.expires_at)).filter(Number.isFinite).sort((x, y) => x - y)[0];
+      out.licence = { core: false, plans, plugins, errors, expiresAt: Number.isFinite(exp) ? exp : null, expired: Number.isFinite(exp) && exp < now };
+    }
+  }
+  return out;
+}
+
+/** Overall verdict for the title: partial (a section unread) > needs attention > all good. */
+function verdict(h) {
+  if (Object.values(h).some(s => s?.error)) return ['partial', 'warn'];
+  const attention = h.services.up < h.services.total || h.computers.bad.length || h.failures.count || h.approvals.approvals || h.approvals.urgent || h.approvals.overdue || h.licence.errors || h.licence.expired;
+  return attention ? ['needs attention', 'warn'] : ['all good', 'ok'];
+}
+
+const HINT = [seg('/fleet', 'key'), seg(' computers · ', 'label'), seg('/status', 'key'), seg(' this session · ', 'label'), seg('/dashboard', 'key'), seg(' open it', 'label')];
+
+/** d -> view { box, rows }. */
+export function healthCard(d, cols) {
+  const h = collectHealth(d);
+  const w = boxWidth(cols, 78), inner = w - 4;
+  const L = (label, parts) => [seg(label.padEnd(11), 'label'), ...parts];
+  const na = (s) => [seg('unavailable: ', 'warn'), seg(s.error, 'warn')];
+  const sep = () => seg(' · ', 'label');
+  const rows = [];
+
+  const s = h.services;
+  if (s.error) rows.push(L('Services', na(s)));
+  else {
+    const parts = [seg(`${s.up}/${s.total} up`, s.up === s.total ? 'ok' : 'warn', true)];
+    for (const b of s.bad) parts.push(sep(), seg(`${b.name} ${b.status}`, SVC_ROLE[b.status] || 'warn'));
+    for (const n of s.notInstalled || []) parts.push(sep(), seg(`${n} not installed`, 'value'));
+    rows.push(L('Services', parts));
+  }
+
+  const c = h.computers;
+  if (c.error) rows.push(L('Computers', na(c)));
+  else if (!c.total) rows.push(L('Computers', [seg('none connected', 'value')]));
+  else {
+    const parts = [seg(`${c.healthy}/${c.total} healthy`, c.healthy === c.total ? 'ok' : 'warn', true)];
+    if (c.bad.length) parts.push(sep(), seg(fit(c.bad.map(x => `${x.id} ${x.health}`).join(', '), inner), c.bad.some(x => x.health === 'offline' || x.health === 'unhealthy') ? 'error' : 'warn'));
+    if (c.partial) parts.push(sep(), seg(`partial: ${c.partial}`, 'warn'));
+    rows.push(L('Computers', parts));
+  }
+
+  const ag = h.agents;
+  rows.push(L('Agents', ag.error ? na(ag) : [seg(`${ag.active} active`, 'value', true), ...(ag.other ? [sep(), seg(`${ag.other} other`, 'value')] : [])]));
+
+  const ap = h.approvals;
+  if (ap.error) rows.push(L('Approvals', na(ap)));
+  else {
+    const parts = [seg(ap.approvals ? `${ap.approvals} open` : 'none open', ap.approvals ? 'warn' : 'ok', true)];
+    if (ap.active) parts.push(sep(), seg(`${ap.active} in inbox`, 'value'));
+    if (ap.urgent) parts.push(sep(), seg(`${ap.urgent} urgent`, 'error'));
+    if (ap.overdue) parts.push(sep(), seg(`${ap.overdue} overdue`, 'error'));
+    rows.push(L('Approvals', parts));
+  }
+
+  const m = h.missions;
+  if (m.error) rows.push(L('Missions', na(m)));
+  else {
+    const parts = [seg(`${m.running} running`, 'value', true)];
+    if (m.waiting) parts.push(sep(), seg(`${m.waiting} waiting`, 'warn'));
+    if (m.loops) parts.push(sep(), seg(plural(m.loops, 'loop'), 'value'));
+    rows.push(L('Missions', parts));
+  }
+
+  const fl = h.failures;
+  if (fl.error) rows.push(L('Failures', na(fl)));
+  else if (!fl.count) rows.push(L('Failures', [seg('none in 24h', 'ok')]));
+  else rows.push(L('Failures', [seg(`${plural(fl.count, 'failed run')} in 24h`, 'error', true), ...(fl.last ? [sep(), seg(`last: ${fl.last}`, 'value')] : [])]));
+
+  const li = h.licence;
+  if (li.error) rows.push(L('Licence', na(li)));
+  else {
+    const parts = li.core ? [seg('Core (free)', 'value', true)] : [seg(li.plans.length ? li.plans.join(', ') : 'licensed', 'value', true)];
+    if (li.plugins) parts.push(sep(), seg(plural(li.plugins, 'plugin'), 'value'));
+    if (!li.core && li.expiresAt) parts.push(sep(), seg(li.expired ? `expired ${new Date(li.expiresAt).toISOString().slice(0, 10)}` : `until ${new Date(li.expiresAt).toISOString().slice(0, 10)}`, li.expired ? 'error' : 'value'));
+    if (li.errors) parts.push(sep(), seg(plural(li.errors, 'licence error'), 'error'));
+    rows.push(L('Licence', parts));
+  }
+
+  rows.push(HINT);
+  const [right, rightRole] = verdict(h);
+  return { box: { width: w, title: 'Health', titleRole: 'sky', right, rightRole, border: 'sky' }, rows: rows.map(r => fitRow(r, inner)) };
+}
+
+/** Fetchers for createObjectsApi. Every read is bounded and every failure carries its reason. */
+export function healthFetchers({ get, org, listOf, why, resolveEndpoint }) {
+  const fleet = fleetFetchers({ get, org, listOf, why, resolveEndpoint });
+  const read = async (fn) => { try { return { ok: true, ...(await fn()) }; } catch (e) { return { ok: false, error: why(e) }; } };
+  const noOrg = { ok: false, error: 'no org selected' };
+  return {
+    /** -> { data } for the health card (now injectable for tests). */
+    async health(now = Date.now()) {
+      const ag = resolveEndpoint('v1.health.aggregate.list'), ex = resolveEndpoint('executions.list'), lic = resolveEndpoint('setup.licensing.entitlements.list');
+      const o = org();
+      const [fl, aggregate, inbox, failures, licence] = await Promise.all([
+        fleet.fleet(''),
+        read(async () => ({ data: await get(ag.service, ag.path, undefined, 15000) })),
+        o ? read(async () => { const ep = resolveEndpoint('inbox.stats.list', { orgId: o }); return { data: await get(ep.service, ep.path, undefined, 8000) }; }) : Promise.resolve(noOrg),
+        read(async () => {
+          const d = await get(ex.service, ex.path, { status: 'failed', since: new Date(now - DAY_MS).toISOString(), limit: 5 }, 8000);
+          const total = d?.pagination?.total;
+          return { list: listOf(d, 'data', 'executions'), total: typeof total === 'number' ? total : undefined };
+        }),
+        read(async () => ({ data: await get(lic.service, lic.path, undefined, 8000) })),
+      ]);
+      return { data: { ...fl.data, aggregate, inbox, failures, licence, now } };
+    }
+  };
+}

package/lib/quoxon/objects/index.js

@@ -0,0 +1,106 @@
+/**
+ * Inline object views: one entry point for app.js. `runObjectCommand` fetches and returns either an
+ * object item ({ type, data }) that history renders with <ObjectView/>, or a note ({ text, tone }).
+ * The view itself is rebuilt from data at render width (resize reprints history), so items stay
+ * pure data.
+ */
+import { skillCard } from './skill.js';
+import { stepFlow } from './workflow.js';
+import { crystalCard } from './crystal.js';
+import { agentCard } from './agent.js';
+import { memoryFacts } from './memory.js';
+import { rulesLadder } from './ladder.js';
+import { proofChain, reconcileView } from './proof.js';
+import { awayCard } from './away.js';
+import { sitrepCard } from './sitrep.js';
+import { fleetView } from './fleet.js';
+import { healthCard } from './health.js';
+import { proveView, lastTurnCalls } from './prove.js';
+import { replayView, parseReplayArg } from './replay.js';
+import { mirrorCard } from './mirror.js';
+import { peekCard } from './peek.js';
+
+export { skillCard, stepFlow, crystalCard, agentCard, memoryFacts, rulesLadder, proofChain, reconcileView, awayCard, sitrepCard };
+export { createObjectsApi } from './fetch.js';
+export { decodeRow, arrivalSeconds } from './model.js';
+
+export const BUILDERS = { skill: skillCard, workflow: stepFlow, crystal: crystalCard, agent: agentCard, memory: memoryFacts, rules: rulesLadder, proof: proofChain, reconcile: reconcileView, away: awayCard, sitrep: sitrepCard, fleet: fleetView, health: healthCard, prove: proveView, replay: replayView, mirror: mirrorCard, peek: peekCard };
+
+/** -> view { box?, rows } for an object item at this width (now injected for tests). */
+export function buildObject(obj, cols, now = Date.now()) {
+  const b = BUILDERS[obj?.type];
+  if (!b) return { rows: [] };
+  return b({ now, ...obj.data }, cols);
+}
+
+/** Tool blocks of this session that carry an envelope id, newest last. */
+export function toolCalls(items) {
+  return (items || []).filter(b => b && b.kind === 'tool' && b.status !== 'running');
+}
+
+const USAGE = {
+  '/workflow': 'Usage: /workflow <name | workflow id | run id>',
+  '/crystal': 'Usage: /crystal <workflow name or id>',
+  '/memory': 'Usage: /memory <query>',
+  '/agents': 'Usage: /agents <name>'
+};
+
+/**
+ * cmd: '/skills' (with a name), '/workflow', '/crystal', '/agents' (with a name), '/memory', '/rules',
+ * '/proof', '/reconcile'. ctx: { objects (createObjectsApi), rules, rulesOn, items (history + live
+ * blocks) }. -> { object: { type, data } } | { note: text, tone } | null (not ours).
+ */
+export async function runObjectCommand(cmd, arg, ctx) {
+  const o = ctx.objects;
+  const a = String(arg || '').trim();
+  // A bare /skills or /agents is a list, not an object: leave it to its own handler.
+  if (!['/workflow', '/crystal', '/memory', '/rules', '/proof', '/reconcile', '/fleet', '/prove', '/replay', '/health', '/core'].includes(cmd) && !((cmd === '/skills' || cmd === '/agents') && a)) return null;
+  if (!o?.health && (cmd === '/health' || cmd === '/core')) return null; // no objects api (demo, local): app.js shows /status instead
+  if (!o) return cmd === '/rules' || cmd === '/skills' ? null : { note: 'Object views are not available in this mode.', tone: 'warn' };
+  const wrap = async (type, fn) => {
+    try {
+      const r = await fn();
+      if (r?.error) return { note: r.error, tone: r.tone || 'warn' };
+      return { object: { type, data: r.data } };
+    } catch (e) {
+      return { note: `${type}: ${e?.status ? `HTTP ${e.status}: ` : ''}${e?.message || 'failed'}`, tone: 'warn' };
+    }
+  };
+  switch (cmd) {
+    case '/skills': return a ? wrap('skill', () => o.skill(a)) : null;
+    case '/agents': return a ? wrap('agent', () => o.agent(a)) : null;
+    case '/workflow': return a ? wrap('workflow', () => o.workflowRun(a)) : { note: USAGE['/workflow'], tone: 'warn' };
+    case '/crystal': return a ? wrap('crystal', () => o.crystal(a)) : { note: USAGE['/crystal'], tone: 'warn' };
+    case '/memory': return a ? wrap('memory', () => o.memory(a)) : { note: USAGE['/memory'], tone: 'warn' };
+    case '/replay': {
+      const { ref, page } = parseReplayArg(a);
+      if (!ref && !ctx.conversationId && !toolCalls(ctx.items).length) return { note: 'Nothing to replay yet: no turn in this conversation. /replay <run or conversation id> replays an earlier one.' };
+      return wrap('replay', () => o.replay({ ref, page, conversationId: ctx.conversationId || null, calls: lastTurnCalls(ctx.items) }));
+    }
+    case '/prove': {
+      const calls = lastTurnCalls(ctx.items);
+      if (!calls.length) return { note: 'No tool calls in the last turn: nothing to prove.' };
+      return wrap('prove', () => o.prove(calls));
+    }
+    case '/fleet': return wrap('fleet', () => o.fleet(a));
+    case '/health': case '/core': return wrap('health', () => o.health()); // the Core dashboard summary (objects/health.js)
+    case '/rules': {
+      return wrap('rules', async () => {
+        const r = await o.rules();
+        return { data: { ...r.data, quoxmd: ctx.rules || null, enabled: ctx.rulesOn !== false } };
+      });
+    }
+    case '/proof': {
+      const calls = toolCalls(ctx.items).filter(b => b.envelopeId);
+      const t = a ? calls.find(b => b.envelopeId === a || b.callId === a) : calls[calls.length - 1];
+      if (!t) return { note: a ? `No tool call "${a}" with an envelope in this session.` : 'No tool call with an envelope id in this session yet.', tone: 'warn' };
+      return wrap('proof', () => o.proof({ tool: t.tool, status: t.status, envelopeId: t.envelopeId, callId: t.callId }));
+    }
+    case '/reconcile': {
+      const unk = toolCalls(ctx.items).filter(b => b.status === 'effect_unknown');
+      if (!unk.length) return { note: 'Nothing to reconcile: no tool call in this session ended with effect unknown.' };
+      return wrap('reconcile', () => o.reconcile(unk.map(b => ({ tool: b.tool, envelopeId: b.envelopeId }))));
+    }
+    default: return null;
+  }
+}