quoxcli 0.0.0-stage → 0.3.1

package/lib/quoxon/transcript.js

@@ -0,0 +1,188 @@
+/**
+ * Dev transcript capture (opt-in, off by default). One JSONL line per client event so a local
+ * review loop can analyse sessions without the owner pasting terminal output.
+ *
+ * On when QUOX_DEV_TRANSCRIPT=1 or the flag file ~/.config/quox/dev-transcripts exists;
+ * QUOX_DEV_TRANSCRIPT=0 forces it off. Fields are ALLOWLISTED per event: objects are never
+ * dumped wholesale, and every string passes a token scrubber as a second line of defence.
+ */
+import { mkdirSync, openSync, writeSync, closeSync, existsSync, chmodSync } from 'node:fs';
+import { stripMarks } from './palette.js';
+import { textGate } from './events.js';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+export const MAX_FIELD = 4000;
+export const SILENT_GAP_MS = 10000;
+export const MAX_ANSWER = 8192;
+
+export function transcriptEnabled({ env = process.env, home = homedir(), exists = existsSync } = {}) {
+  if (env.QUOX_DEV_TRANSCRIPT === '0') return false;
+  if (env.QUOX_DEV_TRANSCRIPT === '1') return true;
+  return exists(join(home, '.config', 'quox', 'dev-transcripts'));
+}
+
+const SCRUBS = [
+  [/eyJ[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]+)*/g, '[redacted-jwt]'],
+  [/\bBearer\s+[^\s"']+/gi, 'Bearer [redacted]'],
+  [/\bsk-[A-Za-z0-9_-]{8,}/g, '[redacted-key]'],
+  [/\b(?:ghp|gho|ghs|xox[abp]|qsk|AKIA)[A-Za-z0-9_-]{12,}/g, '[redacted-key]'],
+  [/((?:api[_-]?key|access[_-]?token|refresh[_-]?token|service[_-]?key|secret|password|passwd|authorization)["']?\s*[:=]\s*["']?)[^\s"',}]+/gi, '$1[redacted]']
+];
+
+export function scrub(s) {
+  let out = String(s);
+  for (const [re, rep] of SCRUBS) out = out.replace(re, rep);
+  return out;
+}
+
+/** Strings are scrubbed and truncated; non-strings become a scrubbed JSON string (never a raw object). */
+export function clean(v) {
+  if (v == null || typeof v === 'number' || typeof v === 'boolean') return v;
+  let s = typeof v === 'string' ? v : (() => { try { return JSON.stringify(v); } catch { return String(v); } })();
+  s = stripMarks(scrub(s)); // ⟦⟧ colour markup never reaches a record
+  return s.length > MAX_FIELD ? `${s.slice(0, MAX_FIELD)}…[truncated ${s.length - MAX_FIELD} chars]` : s;
+}
+
+// SSE event fields worth keeping, by name. Anything not listed is dropped.
+const SSE_FIELDS = ['type', 'agent', 'model', 'provider', 'hat', 'conversation_id', 'session_id', 'stage', 'message',
+  'content', 'call_id', 'tool', 'summary', 'status', 'result_summary', 'duration_ms', 'envelope_id', 'target', 'scope',
+  'risk', 'describable', 'dashboard_url', 'inbox_item_id', 'approval_id', 'decision', 'text', 'protocol', 'label', 'ref',
+  'detail', 'error', 'full_response'];
+const RECEIPT_FIELDS = ['verified', 'ward_seq'];
+// Metering only (numbers, never strings): lets a local eval loop sum the cost of interactive turns.
+const USAGE_FIELDS = ['input_tokens', 'output_tokens', 'cache_read_input_tokens', 'cache_creation_input_tokens'];
+const num = (v) => typeof v === 'number' && Number.isFinite(v);
+
+export function pickSse(ev) {
+  const o = {};
+  if (!ev || typeof ev !== 'object') return o;
+  for (const k of SSE_FIELDS) if (ev[k] !== undefined) o[k] = clean(ev[k]);
+  if (ev.receipt && typeof ev.receipt === 'object') {
+    o.receipt = {};
+    for (const k of RECEIPT_FIELDS) if (ev.receipt[k] !== undefined) o.receipt[k] = clean(ev.receipt[k]);
+  }
+  if (num(ev.cost_usd)) o.cost_usd = ev.cost_usd;
+  if (ev.usage && typeof ev.usage === 'object') {
+    const u = {};
+    for (const k of USAGE_FIELDS) if (num(ev.usage[k])) u[k] = ev.usage[k];
+    if (Object.keys(u).length) o.usage = u;
+  }
+  return o;
+}
+
+/** Map one app dispatch action to a transcript record (or null to skip). */
+export function recordFor(a) {
+  switch (a?.type) {
+    case 'event': return { t: 'sse', ...pickSse(a.ev) };
+    case 'user': return { t: 'user', mode: a.echo ? 'command' : a.queued ? 'queue-drain' : 'send', text: clean(a.full ?? a.text) };
+    case 'steer.add': return { t: 'user', mode: 'steer', id: clean(a.id), text: clean(a.text) };
+    case 'queue.add': return { t: 'user', mode: 'queue', text: clean(a.text) };
+    case 'walk.reply': return { t: 'user', mode: 'walk', id: clean(a.id), text: clean(a.text) }; // WALK-FIXES: what was typed at each walkthrough card
+    case 'steer.failed': case 'steer.converted': return { t: 'notice', kind: a.type, id: clean(a.id), text: clean(a.reason) };
+    case 'note': return { t: 'notice', kind: 'note', tone: clean(a.tone), text: clean(a.text) };
+    case 'ask.open': return { t: 'notice', kind: 'note', tone: 'ask', text: clean(a.text) }; // ASK-SETTLE: same record as before
+    case 'ask.settle': case 'slotmsg.settle': return { t: 'notice', kind: 'ask.settled', tone: clean(a.tone), text: clean(a.text) };
+    case 'restart.countdown': return { t: 'restart.countdown', phase: clean(a.phase), seconds: Number.isFinite(a.seconds) ? a.seconds : null, build: clean(a.build ?? null) }; // started | cancelled | restart-now | timed-out | held: lets a reviewer verify the owner was shown the countdown
+    case 'error': return { t: 'error', text: clean(a.text) };
+    case 'notify': return { t: 'notify', approvals: a.patch?.approvals ?? null, error: clean(a.patch?.error ?? null) };
+    case 'turn.begin': return { t: 'turn.begin', turnId: clean(a.turnId) };
+    case 'approval.sent': return { t: 'approval.sent', action: clean(a.action), callId: clean(a.callId), tool: clean(a.tool), target: clean(a.target) };
+    case 'approval.result': return { t: 'approval.result', callId: clean(a.callId), outcome: clean(a.outcome), text: clean(a.text ?? null) };
+    case 'screen.sent': return { t: 'screen.sent', summary: clean(a.text) }; // SCREEN-CONTEXT: size and sections only, never the block itself
+    case 'verbose': return { t: 'verbose', mode: clean(a.mode) };
+    case 'ctx': return { t: 'ctx', conversationId: clean(a.ctx?.conversationId ?? null) };
+    // /connect: provider and last 4 only, by construction (the key is never in an action).
+    case 'connect.started': return { t: 'connect.started', provider: clean(a.provider) };
+    case 'connect.saved': return { t: 'connect.saved', provider: clean(a.provider), last4: clean(a.last4) };
+    case 'help': return { t: 'action', type: 'help', rows: (Array.isArray(a.model) ? a.model : []).map(m => clean([m.key, m.text].filter(Boolean).join(' '))).slice(0, 80) };
+    case 'inbox.sync': return null; // every 30 s, ids only: noise
+    default: return { t: 'action', type: clean(a?.type) };
+  }
+}
+
+/**
+ * -> null when disabled. Otherwise { action(a), command(line), resize(cols, rows), end(reason), path }.
+ * Never throws into the app: a write failure disables capture for the rest of the session.
+ */
+export function createTranscript({ env = process.env, home = homedir(), now = Date.now, exists = existsSync, meta = {} } = {}) {
+  if (!transcriptEnabled({ env, home, exists })) return null;
+  const dir = env.QUOX_DEV_TRANSCRIPT_DIR || join(home, '.local', 'share', 'quox', 'transcripts');
+  let fd = null;
+  const start = now();
+  const path = join(dir, `${new Date(start).toISOString().replace(/[:.]/g, '-')}-${process.pid}.jsonl`);
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    try { chmodSync(dir, 0o700); } catch { /* best-effort */ }
+    fd = openSync(path, 'a', 0o600);
+    chmodSync(path, 0o600);
+  } catch { return null; }
+  const turn = { id: null, t0: 0, firstText: false, lastSse: 0, text: '', provider: null, model: null, offered: null, tokens: null, answered: false };
+  const write = (rec) => {
+    if (fd == null || !rec) return;
+    try { writeSync(fd, JSON.stringify({ ts: new Date(now()).toISOString(), ...rec }) + '\n'); }
+    catch { try { closeSync(fd); } catch { /* ignore */ } fd = null; }
+  };
+  write({ t: 'start', version: clean(meta.version ?? null), cols: meta.cols ?? null, rows: meta.rows ?? null,
+    profile: clean(meta.profile ?? null), org: clean(meta.org ?? null), cwd: clean(meta.cwd ?? null), pid: process.pid });
+
+  const action = (a) => {
+    const t = now();
+    const rec = recordFor(a);
+    if (a?.type === 'turn.begin') Object.assign(turn, { id: a.turnId, t0: t, firstText: false, lastSse: t, text: '', gate: null, provider: null, model: null, offered: null, tokens: null, answered: false });
+    if (a?.type === 'event' && turn.id) {
+      if (t - turn.lastSse > SILENT_GAP_MS) write({ t: 'gap', turnId: turn.id, ms: t - turn.lastSse, before: clean(a.ev?.type) });
+      turn.lastSse = t;
+    }
+    write(rec);
+    if (a?.type === 'event' && turn.id) {
+      const ty = a.ev?.type;
+      const ev = a.ev;
+      if (ty === 'turn.started') {
+        turn.provider = ev.provider ?? turn.provider; turn.model = ev.model ?? turn.model;
+        const n = [ev.tools_offered, ev.tool_count, ev.tools_available].find(num);
+        if (n !== undefined) turn.offered = n;
+      }
+      // QUOXON-FW19: the server mirrors every delta as a full-text chunk; the same gate the screen uses decides what is answer text.
+      if (ty === 'turn.started' || ty === 'chunk' || ty === 'text.delta') {
+        const g = textGate(turn.gate, ev);
+        turn.gate = g.st;
+        if (g.append && typeof ev.content === 'string' && turn.text.length <= MAX_ANSWER) turn.text += ev.content;
+      }
+      // a final full text is authoritative: it replaces what accumulated, never adds to it
+      if (ty === 'done' && typeof ev.full_response === 'string' && ev.full_response) turn.text = ev.full_response;
+      if (ty === 'tool.finished') {
+        const failed = ev.status === 'failed' || ev.status === 'denied';
+        write({ t: 'tool', turnId: turn.id, name: clean(ev.tool ?? null), ok: ev.status === 'ok', ...(failed || ev.error ? { error: clean(ev.error ?? ev.result_summary ?? ev.status) } : {}), ms: num(ev.duration_ms) ? ev.duration_ms : null });
+      }
+      if (ty === 'error') write({ t: 'turn.error', turnId: turn.id, message: clean(ev.error ?? ev.message ?? 'stream error'), provider: clean(turn.provider), model: clean(turn.model) });
+      if (!turn.firstText && (ty === 'chunk' || ty === 'text.delta') && a.ev?.content) {
+        turn.firstText = true;
+        write({ t: 'timing', turnId: turn.id, first_text_ms: t - turn.t0 });
+      }
+      if (ty === 'turn.finished') {
+        if (ev.usage && typeof ev.usage === 'object') turn.tokens = { input: num(ev.usage.input_tokens) ? ev.usage.input_tokens : null, output: num(ev.usage.output_tokens) ? ev.usage.output_tokens : null };
+        if (turn.text) {
+          const raw = scrub(turn.text);
+          const text = raw.length > MAX_ANSWER ? `${raw.slice(0, MAX_ANSWER)}…[truncated ${raw.length - MAX_ANSWER} chars]` : raw;
+          write({ t: 'answer', turnId: turn.id, provider: clean(turn.provider), model: clean(turn.model), tokens: turn.tokens, duration_ms: t - turn.t0, tools_offered: turn.offered, text });
+        }
+        write({ t: 'timing', turnId: turn.id, finish_ms: t - turn.t0, status: clean(a.ev?.status ?? null), saw_text: turn.firstText });
+        turn.id = null;
+      }
+    }
+  };
+  return {
+    path,
+    action,
+    command: (line) => { const [cmd, ...rest] = String(line).trim().split(/\s+/); write({ t: 'command', cmd: clean(cmd), arg: clean(rest.join(' ') || null) }); },
+    // Owner observation (/note): recorded verbatim (scrubbed, 2000 chars), never sent anywhere else.
+    note: (text) => write({ t: 'note', text: clean(String(text).slice(0, 2000)), ts: new Date(now()).toISOString() }),
+    // ! commands (QUOXON-FW8): the command line and exit code only, never the output.
+    bang: (cmd, code) => write({ t: 'bang', cmd: clean(String(cmd).slice(0, 2000)), exit: clean(code) }),
+    resize: (cols, rows) => write({ t: 'resize', cols: cols ?? null, rows: rows ?? null }),
+    // SCREEN-FRAMES: the visible screen as plain text (screenFrames.js caps it at 16 KB), scrubbed, local file only.
+    screen: ({ cols = null, rows = null, text = '', colors = {}, truncated } = {}) => write({ t: 'screen', cols, rows, text: scrub(String(text)), colors: colors && typeof colors === 'object' ? colors : {}, ...(truncated ? { truncated } : {}) }),
+    end: (reason = 'exit') => { write({ t: 'end', reason: clean(reason), duration_ms: now() - start }); if (fd != null) { try { closeSync(fd); } catch { /* ignore */ } fd = null; } }
+  };
+}

package/lib/quoxon/web/qface.js

@@ -0,0 +1,89 @@
+/**
+ * The Q face for the web (cli.quox.ai): the SAME pure frames the CLI draws (qart.js, qglyph.js, qhello.js),
+ * rendered into <pre> elements as coloured spans. Plays Orbit & Lock, then the Q says hello (the line
+ * decodes in from katakana), then idles: the mark breathes, the status Q breathes beside "Ready", and now
+ * and then the dragon's googly eyes open and blink. prefers-reduced-motion: the settled frame only.
+ *
+ * Browser ESM, no dependencies, no build: import it next to ../qart.js, ../qglyph.js, ../qhello.js.
+ *   import { mountQFace } from './qface.js';
+ *   mountQFace(document.getElementById('face'), { hello: "Hi, I'm Quox!" });
+ */
+import { introPlan, restCellsAt, INTRO_MS } from '../qart.js';
+import { eggCells, EGG_MS } from '../qdragonScenes.js';
+import { qGlyph } from '../qglyph.js';
+import { helloCells, helloGradient, helloMs } from '../qhello.js';
+
+const esc = (s) => s.replace(/[&<>]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' }[c]));
+
+/** One row of cells -> HTML spans, merging runs of the same colour. */
+export function rowToHTML(row) {
+  let html = '', run = '', key = null;
+  const flush = () => { if (!run) return; html += key ? `<span style="${key}">${esc(run)}</span>` : esc(run); run = ''; };
+  for (const c of row) {
+    const parts = [c.rgb ? `color:rgb(${c.rgb.join(',')})` : null, c.bg ? `background-color:rgb(${c.bg.join(',')})` : null, c.bold ? 'font-weight:700' : null].filter(Boolean);
+    const k = parts.length ? parts.join(';') : null; // bg: the dragon's quadrant-block eyes (solid whites, dark pupil)
+    if (k !== key) { flush(); key = k; }
+    run += c.ch;
+  }
+  flush();
+  return html;
+}
+// Blank cells in Braille art are drawn as U+2800 (the empty Braille pattern), not a space: a browser can
+// give a space and a Braille glyph different advances (font fallback), which shears the Q row by row.
+const BLANK = '\u2800';
+export const cellsToHTML = (rows) => rows.map((r) => rowToHTML(r.map((c) => (c.ch === ' ' ? { ...c, ch: BLANK } : c)))).join('\n');
+
+/** Which Q size fits a container of `px` CSS pixels at a monospace advance of `cw` px. */
+export function sizeForWidth(px, cw = 8.4) {
+  const cols = Math.floor(px / cw);
+  return cols >= 34 ? 'large' : cols >= 22 ? 'mid' : 'small';
+}
+
+/**
+ * Timeline state at t ms (pure): which picture, the hello progress, and whether the eye is open.
+ * eyeAt: list of start times (ms) for idle eye blinks.
+ */
+export function faceFrame(t, { size, hello, eyeAt = [], color = true }) {
+  const plan = introPlan(size, { color, quant: false });
+  const hT = t - INTRO_MS, settledAt = INTRO_MS + helloMs(hello);
+  let q;
+  const eye = eyeAt.find((s) => t >= s && t < s + EGG_MS + 400);
+  if (t < INTRO_MS) q = plan.at(t);
+  else if (eye != null) q = eggCells(size, t - eye, { color });
+  else q = restCellsAt(size, Math.max(0, t - settledAt), { color, quant: false });
+  const line = helloCells(hello, hT, { fg: helloGradient(hello), mono: !color });
+  const glyph = qGlyph('resting', Math.max(0, t - settledAt), { mono: !color });
+  return { q, line, glyph, showStatus: t >= settledAt };
+}
+
+export function mountQFace(root, { hello = "Hi, I'm Quox!", status = 'Ready', seed = 7, reduced = null, eyeEveryMs = [9000, 16000] } = {}) {
+  const doc = root.ownerDocument, win = doc.defaultView;
+  root.classList.add('qface');
+  root.innerHTML = '<pre class="qface-q" aria-hidden="true"></pre><div class="qface-side"><pre class="qface-hello"></pre><pre class="qface-status"></pre></div>';
+  root.setAttribute('role', 'img');
+  root.setAttribute('aria-label', `The Quox Q says: ${hello}`);
+  const [qEl, hEl, sEl] = ['.qface-q', '.qface-hello', '.qface-status'].map((s) => root.querySelector(s));
+  const still = reduced ?? Boolean(win.matchMedia?.('(prefers-reduced-motion: reduce)').matches);
+  let r = seed; const rand = () => { r = (r * 16807) % 2147483647; return r / 2147483647; };
+  const eyeAt = [];
+  let next = INTRO_MS + helloMs(hello) + 2500; // the first blink comes soon after hello, then rarely
+  for (let i = 0; i < 40; i++) { eyeAt.push(next); next += EGG_MS + eyeEveryMs[0] + rand() * (eyeEveryMs[1] - eyeEveryMs[0]); }
+  const size = () => sizeForWidth(Math.min(root.clientWidth || 600, win.innerWidth || 600) * (root.clientWidth > 520 ? 0.55 : 1));
+  const draw = (t) => {
+    const f = faceFrame(t, { size: size(), hello, eyeAt });
+    qEl.innerHTML = cellsToHTML(f.q);
+    hEl.innerHTML = rowToHTML(f.line);
+    sEl.innerHTML = f.showStatus ? `${rowToHTML(f.glyph.cells)} <span class="qface-word">${esc(status)}</span>` : '&nbsp;';
+  };
+  if (still) { draw(INTRO_MS + helloMs(hello) + 10); return { stop() {}, pause() {}, resume() {}, seek: draw }; }
+  // pause()/resume() keep the animation's own clock: time spent paused (offscreen, hidden tab) is not skipped.
+  let raf = 0, t0 = null, stopped = false, paused = false, pausedAt = null, last = 0;
+  const tick = (now) => { if (stopped || paused) return; t0 ??= now; last = now - t0; draw(last); raf = win.requestAnimationFrame(tick); };
+  raf = win.requestAnimationFrame(tick);
+  return {
+    stop() { stopped = true; win.cancelAnimationFrame(raf); },
+    pause() { if (paused || stopped) return; paused = true; pausedAt = last; win.cancelAnimationFrame(raf); },
+    resume() { if (!paused || stopped) return; paused = false; t0 = null; const base = pausedAt; raf = win.requestAnimationFrame((now) => { t0 = now - base; tick(now); }); },
+    seek: draw,
+  };
+}

package/lib/quoxon/welcome.js

@@ -0,0 +1,52 @@
+/**
+ * First-run notice for bare `quox`: who we are, legal, docs. Pure model + a tiny "seen" marker kept in the
+ * CLI's existing config dir (~/.config/quox, same place as config.json). Links live ONLY here.
+ */
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export const DOCS_URL = 'https://cli.quox.ai/docs/start/'; // #1100: CLI docs "Start here" (cli.quox.ai/docs/ itself has no index page)
+export const TERMS_URL = 'https://quox.ai/terms';
+export const PRIVACY_URL = 'https://quox.ai/privacy';
+export const LICENCE = 'Quox Community Source Licence 1.0 (source-available)';
+export const WELCOME_VERSION = 1;
+
+export function packageVersion() {
+  try { return JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version || '0.1.0'; } catch { return '0.1.0'; }
+}
+
+/** [{ kind: 'title'|'sub'|'rule'|'field'|'para'|'gap'|'hint', ... }] */
+export function welcomeModel(version = packageVersion()) {
+  return [
+    { kind: 'title', text: 'Welcome to Quox' },
+    { kind: 'sub', text: `Quox CLI ${version}` },
+    { kind: 'para', text: 'The main front door to Quox, your self-hosted control plane for AI agents.' },
+    { kind: 'rule' },
+    { kind: 'field', label: 'Docs', value: DOCS_URL, link: true },
+    { kind: 'field', label: 'Terms', value: TERMS_URL, link: true },
+    { kind: 'field', label: 'Privacy', value: PRIVACY_URL, link: true },
+    { kind: 'field', label: 'Licence', value: LICENCE },
+    { kind: 'rule' },
+    { kind: 'para', text: 'Your prompts go to your own QuoxCORE server and to the AI provider you connect to it.' },
+    { kind: 'para', text: 'Risky actions ask you first, and the actions Quox takes leave receipts you can verify.' },
+    { kind: 'para', text: 'This CLI sends no telemetry to Quox.' },
+    { kind: 'para', text: 'By using Quox CLI you agree to the Terms.' },
+    { kind: 'hint', text: 'Enter to continue · /about to see this again' }
+  ];
+}
+
+export const welcomeStatePath = () => join(homedir(), '.config', 'quox', 'welcome.json');
+
+export function welcomeSeen(path = welcomeStatePath()) {
+  try { return (JSON.parse(readFileSync(path, 'utf8')).version || 0) >= WELCOME_VERSION; } catch { return false; }
+}
+export function markWelcomeSeen(path = welcomeStatePath()) {
+  try { mkdirSync(join(path, '..'), { recursive: true }); writeFileSync(path, JSON.stringify({ version: WELCOME_VERSION, seenAt: new Date().toISOString() }) + '\n'); return true; } catch { return false; }
+}
+
+/** First interactive launch only: a TTY, not suppressed, not seen at this notice version. */
+export function shouldShowWelcome({ env = process.env, isTTY = process.stdout.isTTY && process.stdin.isTTY, print = false, path } = {}) {
+  if (print || !isTTY || env.QUOX_NO_WELCOME === '1') return false;
+  return !welcomeSeen(path);
+}

package/lib/quoxon/whatsnew.js

@@ -0,0 +1,136 @@
+/**
+ * "What's new" (QUOXON-FW16, derived in QUOXON-WHATSNEW3). Curated entries live in whatsnew.jsonl: append-only, one
+ * JSON object per line, added by the commit that ships the change (see whatsnew.md). ENTRIES is sorted newest first.
+ * With no curated source (a dev checkout without the file) entries are derived from git: commits on the CLI tree with
+ * a `Whatsnew: <title> | <command>` trailer or a `[whatsnew]` subject tag.
+ * Last-seen state is kept on the CLI profile (quoxon.whatsNew = { build, id, date }): the build the user last ran and
+ * the newest entry they have been shown.
+ */
+import { readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const byDateDesc = (a, b) => (Date.parse(b.date) || 0) - (Date.parse(a.date) || 0);
+
+/** whatsnew.jsonl text -> entries newest first. Blank or unparsable lines are skipped. */
+export function parseEntries(text) {
+  const out = [];
+  for (const line of String(text || '').split('\n')) {
+    const t = line.trim(); if (!t) continue;
+    try { const e = JSON.parse(t); if (e && e.id && e.title) out.push(e); } catch { /* skip a broken line */ }
+  }
+  return out.sort(byDateDesc);
+}
+
+// %x1f between fields, %x1e between commits; the trailer value is "title | command" (command optional).
+export const GIT_LOG_FORMAT = '%h%x1f%cI%x1f%s%x1f%(trailers:key=Whatsnew,valueonly,separator=%x20)%x1e';
+
+/** git log output (GIT_LOG_FORMAT) -> entries, keeping only commits marked user-facing. */
+export function gitEntries(log) {
+  const out = [];
+  for (const rec of String(log || '').split('\x1e')) {
+    const [sha, date, subject = '', trailer = ''] = rec.replace(/^\s+/, '').split('\x1f');
+    if (!sha) continue;
+    const tv = trailer.trim();
+    let title = '', cmd = '';
+    if (tv && tv.toLowerCase() !== 'none') [title, cmd = ''] = tv.split('|').map(x => x.trim());
+    else if (/\[whatsnew\]/i.test(subject)) title = subject.replace(/\[[^\]]*\]\s*/g, '').trim();
+    if (!title) continue;
+    out.push({ id: `git-${sha}`, date: (date || '').trim(), title, text: title, ...(cmd ? (cmd.startsWith('/') ? { try: cmd } : { shell: cmd }) : {}), sha });
+  }
+  return out.sort(byDateDesc);
+}
+
+/** Curated file first; git only when the file is missing or empty. Never throws. */
+export function loadEntries({ readCurated, readGit }) {
+  let curated = [];
+  try { curated = parseEntries(readCurated()); } catch { /* no curated source */ }
+  if (curated.length) return curated;
+  try { return gitEntries(readGit()); } catch { return []; }
+}
+
+/**
+ * Curated text: whatsnew.jsonl in this repo; the public mirror export ships the same entries as a whatsnew.json array
+ * (scripts/release/public-mirror/export.js), which is turned back into one JSON object per line here.
+ */
+export function readCuratedText(read) {
+  try { return read('./whatsnew.jsonl'); } catch { /* not here: try the exported array */ }
+  const arr = JSON.parse(read('./whatsnew.json'));
+  return Array.isArray(arr) ? arr.map(e => JSON.stringify(e)).join('\n') : '';
+}
+
+const CLI_ROOT = fileURLToPath(new URL('../..', import.meta.url));
+export const ENTRIES = loadEntries({
+  readCurated: () => readCuratedText(f => readFileSync(new URL(f, import.meta.url), 'utf8')),
+  readGit: () => execFileSync('git', ['-C', CLI_ROOT, 'log', '-n', '300', `--format=${GIT_LOG_FORMAT}`, '--', '.'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000 }),
+});
+
+/** Entries newer than the last one shown: by id, else by date (the id is unknown after a source switch). */
+export function unseenEntries(last, entries = ENTRIES) {
+  if (!last || typeof last !== 'object' || (!last.id && !last.date)) return entries;
+  const at = last.id ? entries.findIndex(e => e.id === last.id) : -1;
+  if (at >= 0) return entries.slice(0, at);
+  const t = Date.parse(last.date);
+  return Number.isFinite(t) ? entries.filter(e => Date.parse(e.date) > t) : entries;
+}
+
+/** The profile record after showing: build + newest entry. */
+export const seenRecord = (build, entries = ENTRIES) => ({ build: String(build || ''), id: entries[0]?.id, date: entries[0]?.date });
+
+/** The command to try for an entry: a slash command, else a shell command. */
+export const tryText = (e) => e.try || e.shell || '';
+
+export const BOX_MAX = 5;
+export const LIST_DEFAULT = 10;
+
+export const tryCommand = (e) => String(e.try || '').trim().split(/\s+/)[0];
+
+/** Startup decision. -> { show: entries[], more: n, record: {build,id} | null }. Nothing recorded when there are no entries. */
+export function startupWhatsNew({ build, last, entries = ENTRIES }) {
+  const newest = entries[0]?.id;
+  if (!newest) return { show: [], more: 0, record: null };
+  const record = { build: String(build || ''), id: newest };
+  if (!last || typeof last !== 'object' || !last.id) return { show: [], more: 0, record }; // first ever run: record silently
+  if (last.build === record.build) return { show: [], more: 0, record: last.id === newest ? null : record };
+  const at = entries.findIndex(e => e.id === last.id);
+  const unseen = at < 0 ? entries : entries.slice(0, at); // unknown last id (e.g. a rollback): treat all as unseen
+  return { show: unseen.slice(0, BOX_MAX), more: Math.max(0, unseen.length - BOX_MAX), record };
+}
+
+/** /whatsnew [all]. -> { entries, more } */
+export function listWhatsNew(arg = '', entries = ENTRIES) {
+  const all = String(arg).trim().toLowerCase() === 'all';
+  const shown = all ? entries : entries.slice(0, LIST_DEFAULT);
+  return { entries: shown, more: entries.length - shown.length };
+}
+
+// ---- New commands (QUOXON-WHATSNEW2) -------------------------------------------------------------------------------
+// Per-profile record of registry command ids the user has already been shown: quoxon.whatsNewSeen = [id...].
+// Startup preference: quoxon.whatsNewStartup = 'on' | 'off' (default on). Both live in the synced profile settings.
+export const startupEnabled = (settings) => String(settings?.whatsNewStartup || 'on').toLowerCase() !== 'off';
+
+const activeCommands = (registry) => registry.filter(e => e.kind === 'command' && e.status === 'active');
+
+/**
+ * Commands the user has not been shown, newest first (registry is oldest first, so reversed). With no record yet
+ * (first run, or an install that predates this) only entries flagged `new: true` count, so nobody gets a wall of
+ * every command. all=true ignores the record.
+ */
+export function unseenCommands({ registry, seen, all = false }) {
+  const cmds = activeCommands(registry);
+  const pool = all ? cmds : Array.isArray(seen) ? cmds.filter(e => !seen.includes(e.id)) : cmds.filter(e => e.new);
+  return [...pool].reverse();
+}
+
+/** The ids to store after showing: everything currently active (so later additions show as new). */
+export const seenAfter = (registry) => activeCommands(registry).map(e => e.id);
+
+/** One compact startup line, or null. e.g. "6 new commands (/mind, /ask, /page, ...) · /whatsnew for more". */
+export function startupCommandLine(list, max = 3) {
+  if (!list.length) return null;
+  const names = list.slice(0, max).map(e => '/' + e.id).join(', ') + (list.length > max ? ', ...' : '');
+  return `${list.length} new command${list.length === 1 ? '' : 's'} (${names}) \u00b7 /whatsnew for more`;
+}
+
+/** /whatsnew on|off. -> 'on' | 'off' | null */
+export const toggleArg = (arg) => { const a = String(arg).trim().toLowerCase(); return a === 'on' || a === 'off' ? a : null; };

package/lib/quoxon/whatsnew.jsonl

@@ -0,0 +1,89 @@
+{"id":"bang-tty","date":"2026-10-16T16:00:00Z","title":"! hands over the terminal when a command needs it","text":"!quox lucid deck, !vim, !top, !less, !ssh host and other interactive commands now get the real terminal; quit them to come back. A ! command that fails for want of a terminal is re-run handed over. Everything else is still captured, so /share works.","since":"0.3.0","shell":"quox lucid deck"}
+{"id":"fw12-demo","date":"2026-10-13T16:00:00Z","title":"Play the demo","text":"See a short guided run of Quox without touching your real setup.","try":"/demo","since":"0.3.0"}
+{"id":"fw12-lan-ollama","date":"2026-10-13T16:30:00Z","title":"Connect a model on your network","text":"Connect an Ollama server on another machine on your network. Quox asks first, and you confirm with /connect yes.","try":"/connect","since":"0.3.0"}
+{"id":"engine-chat-actions","date":"2026-10-13T17:00:00Z","title":"Chat can do things for you","text":"Ask in plain words and chat can create a slot or run a quox command for you. This is rolling out, so it may not be on your server yet.","since":"0.3.0"}
+{"id":"fw13-attach-message","date":"2026-10-13T17:30:00Z","title":"Attach and speak in one go","text":"Attach to an agent by name and send it a message in the same line.","try":"/attach","since":"0.3.0"}
+{"id":"fw13-one-dragon","date":"2026-10-13T18:00:00Z","title":"One dragon everywhere","text":"The dragon is the same everywhere in Quox now. The old eye is retired.","try":"/dragon","since":"0.3.0"}
+{"id":"fw13-aocl-line","date":"2026-10-13T18:30:00Z","title":"One AOCL line per turn","text":"Each turn ends with a single AOCL line. Open the full table whenever you want it.","try":"/aocl","since":"0.3.0"}
+{"id":"fw13-calmer-screen","date":"2026-10-13T19:00:00Z","title":"A calmer screen","text":"Each role gets one colour, history has more room, and protocol lines are hidden until you ask for them.","try":"/verbose on","since":"0.3.0"}
+{"id":"fw14-slots-survive","date":"2026-10-13T19:30:00Z","title":"Your slot survives a restart","text":"Restarting keeps the slot you hold, and renaming the session renames the slot.","try":"/restart","since":"0.3.0"}
+{"id":"fw12-login-in-place","date":"2026-10-13T20:00:00Z","title":"Sign in without leaving","text":"Sign in again right where you are. CLI sign-ins now last 30 days.","try":"/login","since":"0.3.0"}
+{"id":"fw13-tips-search","date":"2026-10-13T20:30:00Z","title":"Search the tips","text":"Tips now come in a frame, and you can search them by topic or by what you want to do.","try":"/tips","since":"0.3.0"}
+{"id":"fw14-shell-share","date":"2026-10-13T21:00:00Z","title":"Run shell commands, share the output","text":"Start a line with ! to run a shell command here, then attach its output to your next message.","try":"/share","since":"0.3.0"}
+{"id":"fw14-tab-suggestions","date":"2026-10-13T21:30:00Z","title":"Tab suggests arguments","text":"After a command and a space, press Tab to see what can come next.","try":"/model","since":"0.3.0"}
+{"id":"fw14-model-chooser","date":"2026-10-13T22:00:00Z","title":"Model chooser with favourites","text":"Pick a model from what is connected, star your favourites and set the one new sessions start on.","try":"/model","since":"0.3.0"}
+{"id":"fw15-approve-many","date":"2026-10-13T22:30:00Z","title":"Approve several at once","text":"Approve more than one request in a single line, or all of them.","try":"/approve all","since":"0.3.0"}
+{"id":"fw15-yn-approvals","date":"2026-10-13T23:00:00Z","title":"Answer approvals with y or n","text":"With an empty composer, y or n answers the approval card you can see. Privileged actions need y twice.","try":"/approvals","since":"0.3.0"}
+{"id":"fw16-whatsnew","date":"2026-10-14T00:00:00Z","title":"What's new","text":"Quox now tells you what changed since you last ran it, once, when you start it.","try":"/whatsnew","since":"0.3.0"}
+{"id":"history-across-runs","date":"2026-10-15T16:00:00Z","title":"Up recalls what you typed","text":"Up steps back through your earlier prompts and commands, most recent first, including ones from earlier runs. /say also takes a session name now: /say SITE-CLI reaches the slot that session holds.","try":"/say SITE-CLI hello","since":"0.3.0"}
+{"id":"say-many-bell","date":"2026-10-15T16:30:00Z","title":"Message several sessions at once","text":"/say a,b,c <text> sends each one a copy that starts with who else it went to. Incoming slot messages now ring the terminal bell; /settings turns it off.","try":"/say cli-site,provisioner hello","since":"0.3.0"}
+{"id":"reconnect-restart","date":"2026-10-15T19:46:21Z","title":"Calm reconnect when the server restarts","text":"If the Quox server restarts, the TUI says it is reconnecting and carries on; nothing is lost.","since":"0.3.0","sha":"716b979f7"}
+{"id":"restart-keeps-agent","date":"2026-10-15T21:17:49Z","title":"/restart keeps your agent and slot","text":"Restart and you come back attached to the same agent, still holding the same slot.","try":"/restart","since":"0.3.0","sha":"0c69c2042"}
+{"id":"poke-wake","date":"2026-10-15T22:33:32Z","title":"/poke and /wake really wake a session","text":"An idle session holding a slot is woken to read its messages, and a draft you are typing is never typed over.","try":"/wake <slot>","since":"0.3.0","sha":"7142e5679"}
+{"id":"health-card","date":"2026-10-15T23:05:16Z","title":"/health shows a Core summary card","text":"Services, computers, agents, approvals and missions, all in one card.","try":"/health","since":"0.3.0","sha":"e6dfaa69e"}
+{"id":"late-answers","date":"2026-10-16T02:19:16Z","title":"Late answers still reach you","text":"When a helper agent answers after the wait, its answer is delivered in the same turn instead of being lost.","since":"0.3.0","sha":"21a609308"}
+{"id":"slots-columns","date":"2026-10-16T02:21:38Z","title":"/slots in tidy columns","text":"Every slot with who holds it and when it was last used, yours first.","try":"/slots","since":"0.3.0","sha":"90f4ccd83"}
+{"id":"sleep-cmd","date":"2026-10-16T02:37:50Z","title":"/sleep","text":"The dragon curls up and sleeps.","try":"/sleep","since":"0.3.0","sha":"da9c1b188"}
+{"id":"mirror-real","date":"2026-10-16T03:06:04Z","title":"/mirror shows the real Mirror","text":"See what CommanderQ sees about your org: identity, health, plugins and memory, with how old it is.","try":"/mirror","since":"0.3.0","sha":"2eb27da6e"}
+{"id":"status-two-rows","date":"2026-10-16T03:08:06Z","title":"A two-row status line with labels","text":"Profile, org, mode, agent, slot and groups each have a label, and the model sits on the line above where you type.","try":"/groups","since":"0.3.0","sha":"6244dbc43"}
+{"id":"update-cmd","date":"2026-10-16T03:11:38Z","title":"/update and quox update","text":"Update Quox to the latest version from inside the TUI or from your shell, then restart.","try":"/update","since":"0.3.0","sha":"30afdffbc"}
+{"id":"run-requests","date":"2026-10-16T03:18:53Z","title":"Run requests in messages","text":"A slot message can ask you to run a command here; you see the whole command first and answer y, N or c.","shell":"quox slot say <slot> --run \"<command>\" \"<why>\"","since":"0.3.0","sha":"fa9b7f9d4"}
+{"id":"triage-q-queue","date":"2026-10-16T04:35:00Z","title":"TRIAGE-Q works your approvals queue","text":"TRIAGE-Q pages through the whole queue, opens items, and snoozes, assigns or dismisses them one at a time.","try":"/attach triage-q","since":"0.3.0","sha":"7374985e2"}
+{"id":"asks-are-cards","date":"2026-10-16T04:37:48Z","title":"Every question is an approval card","text":"Questions and approvals share one card that says what will happen and why; answer y, N, or c to talk it through.","try":"/approvals","since":"0.3.0","sha":"16a82f01d"}
+{"id":"ask-session","date":"2026-10-16T05:11:59Z","title":"/ask a session a question","text":"/ask <slot> <question> sends your question straight to that session, like /say.","try":"/ask <slot> <question>","since":"0.3.0","sha":"2e064d05c"}
+{"id":"org-window-back","date":"2026-10-16T05:38:46Z","title":"/org switch stays in this window, /org back returns","text":"Switching org in one window no longer moves your other windows, and /org back takes you to the org you were in.","try":"/org back","since":"0.3.0","sha":"dab35b8bd"}
+{"id":"memory-core","date":"2026-10-16T05:44:08Z","title":"Memory core, pin and recall","text":"Pin the facts that matter into your org core memory, and chat recalls them with where they came from.","shell":"quox memory core","since":"0.3.0","sha":"be605c485"}
+{"id":"mouse-cmd","date":"2026-10-16T05:59:04Z","title":"/mouse turns on clicks","text":"Click a sender to reply, or y, n or c on a card to answer; hold Shift to copy text.","try":"/mouse on","since":"0.3.0","sha":"dabc66f54"}
+{"id":"org-slugs","date":"2026-10-16T07:05:41Z","title":"--org takes the org short name","text":"quox --org <slug> works with the org short name, not only its ID.","shell":"quox --org <slug> whoami","since":"0.3.0","sha":"9f85dec70"}
+{"id":"mode-plan","date":"2026-10-16T07:21:11Z","title":"/mode plan: plan without changing anything","text":"In plan mode Quox investigates and proposes, the server refuses changes, and you say y to run the plan.","try":"/mode plan","since":"0.3.0","sha":"1351de192"}
+{"id":"partial-says-partial","date":"2026-10-16T07:58:19Z","title":"Partial answers say partial","text":"When a turn could only finish part of the job, the answer says so instead of claiming it is complete.","since":"0.3.0","sha":"56e8a88a1"}
+{"id":"current-focus","date":"2026-10-16T09:34:27Z","title":"Chat knows your current focus","text":"Each chat turn now carries your open objectives and recent asks, so answers stay on what you are working on.","since":"0.3.0","sha":"c62572590"}
+{"id":"whatsnew-derived","date":"2026-10-16T15:15:00Z","title":"What's new shows only what changed","text":"/whatsnew lists what is new since you last looked, then marks it seen; when there is nothing new it says so.","try":"/whatsnew","since":"0.3.0"}
+{"id":"profile-switch","date":"2026-10-16T15:10:00Z","title":"Switch profile without quitting","text":"An agent-login window that hits approvals or a step-up now offers your signed-in login as a y/N card: y switches this window, same conversation, attach, slot and groups. /profile <name> switches directly. A /slot name that does not exist asks to create it.","try":"/profile","since":"0.3.0","sha":"bb00994c8"}
+{"id":"restore-tui-fixes","date":"2026-10-16T18:00:00Z","title":"Tab answers the approval card again","text":"With a draft in the composer, Tab focuses the approval card (your draft is kept, Esc returns to it) instead of sending the draft. /dragon-fly now fits short terminals, the background-agents line shows again, and streamed text is never cut.","try":"/approvals","since":"0.3.0"}
+{"id":"presence-afk-sleep","date":"2026-10-16T16:40:00Z","title":"/afk and /sleep tell your sessions","text":"/afk [note] and /sleep mark you away or sleeping on the server, so sessions saying into hitl or your slot see \"owner away since 15:54 UTC: approvals will queue\" (quox ask and quox slot list too). Nothing is approved while you are away; /back or any message marks you present. quox presence shows who is away; /observe <text> sends a note to the observer.","try":"/afk lunch","since":"0.3.0","sha":"560262bc6"}
+{"id":"answer-pairs-yestoall-pin","date":"2026-10-16T21:00:00Z","title":"Answer many at once: /approve 1 y 2 n","text":"/approve and /answer take pairs: 1 y 2 n, 1 y, 2 n or 1y 2n, mixed yes and no, all checked first, and the PIN is asked once if any yes is high risk (a no never needs it). /yestoall now shows one card for every yes/no question instead of one per item, and a yes on a high-risk ask needs your PIN.","try":"/approve 1 y 2 n","since":"0.3.0"}
+{"id":"hat-command","date":"2026-10-16T19:20:00Z","title":"/hat changes hat without asking the AI","text":"/hat lists your hats with the current one marked. /hat DevOps (the key, the name, or a unique start of it) switches this conversation straight away, recorded on the server; a privileged hat asks y/N first. Works with any model, including small local ones.","try":"/hat","since":"0.3.0"}
+{"id":"approval-wwwh","date":"2026-10-16T21:50:00Z","title":"Approval cards say what, where, who and why","text":"Every approval card, /approvals row and /approvals N detail now shows the exact command (verbatim, cut only with a visible count), the host count and names, the delegation chain and the human it acts for, the reason, your original request and the time, and whether the server judged it read-only. New items also keep your request text when the turn registry lost it.","try":"/approvals","since":"0.3.0"}
+{"id":"slot-reply-path","date":"2026-10-17T00:45:00Z","title":"Replies to your /say now reach you","text":"A /say, @slot or /send from a window that holds a slot is now stamped with that slot by the server, so the other side replies to you. After you say into a slot, the window also shows that slot's holder's lines arriving in it for 30 minutes, and the \"no reply yet\" nudge no longer fires for a reply that showed.","try":"/say lucid sitrep","since":"0.3.0"}
+{"id":"wake-real","date":"2026-10-17T01:15:00Z","title":"/wake really wakes","text":"/poke, /wake and /slap now make an idle session start a turn: the keeper checks the wake line left the prompt box and presses Enter again if Claude Code swallowed it. You are told whether the session was woken or, mid-turn, queued until its turn ends.","try":"/poke <slot>","since":"0.3.0"}
+{"id":"ask-settle","date":"2026-10-17T01:15:00Z","title":"Answered questions go away","text":"A y/N/c question (Wake it now?, Run it?, Switch?, and the rest) now stays a live card only while it is open. Once you answer, it expires or it is no longer open, the card goes and one line stays, such as ✔ Wake it now? yes (00:44).","try":"/poke <slot>","since":"0.3.0"}
+{"id":"active-and-hints","date":"2026-10-17T09:00:00Z","title":"/active: who is doing what","text":"/active (and quox active) is one short summary of every active worker, grouped Working, Waiting on you and Idle, newest first, with what each is doing and since when; /active sessions, slots and agents filter it. A mistyped command now names the 1-3 nearest real commands, by spelling and by what they do, and a single strong match is a y/N card that runs it.","try":"/active","since":"0.3.0"}
+{"id":"restart-no-pileup","date":"2026-10-17T10:00:00Z","title":"/restart no longer piles up old windows","text":"/restart, /update and auto-restart now replace the running client instead of starting a new one inside it, so a terminal keeps exactly one Quox client however many times you restart, and old ones no longer sit in memory.","try":"/restart","since":"0.3.0"}
+{"id":"decision-labels","date":"2026-10-17T10:00:00Z","title":"Questions one at a time, in words","text":"When several questions are waiting, /approvals now walks you through them one at a time: what it is, what I would do in plain words, then just say yes, no or the option. /answer and /deny notes keep their full text, even with an unclosed quote or a line break.","try":"/approvals","since":"0.3.0"}
+{"id":"bulk-yes-never-risky","date":"2026-10-17T09:00:00Z","title":"A bulk yes never covers a risky ask","text":"/yestoall and number ranges now answer only the low-risk questions; high-risk, test-changing and restart asks come one at a time with their full text, and a typed number is refused if the list moved.","try":"/yestoall","since":"0.3.0"}
+{"id":"walkthrough-esc-summary","date":"2026-10-17T10:30:00Z","title":"Walkthrough: Esc exits with a summary","text":"Esc now leaves /walkthrough with a summary. It shows one card at a time, keeps every answer, and answered questions never come back.","try":"/walkthrough","since":"0.3.0"}
+{"id":"walkthrough-yesno-only","date":"2026-10-17T14:30:00Z","title":"Walkthrough: yes/no only answers yes/no questions","text":"On a numbered question, typing yes or no no longer picks anything. The walkthrough shows the choices in words and never picks the asker's favourite for you.","try":"/walkthrough","since":"0.3.0"}
+{"id":"custom-hats","date":"2026-10-17T16:00:00Z","title":"Make your own hats","text":"/hat new walks you through a hat of your own: name it, pick a starting hat and the agents it includes. Under it a turn carries only those agents. /hat edit and /hat delete change or remove one.","try":"/hat new","since":"0.3.0"}
+{"id":"recommended-first","date":"2026-10-17T17:00:00Z","title":"Recommended option shown first","text":"On a decision card, the option the asker recommends is listed first in bold with a star and who recommends it. Keys do not change, and a card with no recommendation shows none.","try":"/walkthrough","since":"0.3.0"}
+{"id":"pin-card-big","date":"2026-10-17T18:30:00Z","title":"A bigger PIN card","text":"The approval PIN card now shows six large slots that light up as you type, a shimmer while it checks, a green tick when authorised and a red flash on a wrong PIN. The full decision title is shown, wrapped.","try":"/authenticate","since":"0.3.0"}
+{"id":"tui-render-fixes","date":"2026-10-17T18:30:00Z","title":"Tables, /help and /slots fit your terminal","text":"Chat tables wrap long cells instead of cutting them with an ellipsis. /help keeps usage and description apart. /slots shows held slots first and folds free ones into +N free (/slots all lists them). Tall cards and the dragon no longer leave garbled frames in a short terminal.","try":"/slots","since":"0.3.0"}
+{"id":"status-rows","date":"2026-10-17T19:00:00Z","title":"Make your own status rows","text":"/row new walks you through a live line above the status bar and shows what it will say before saving: approvals waiting, hosts up, a plugin status or your own script. quox rows does the same from a shell, and a row can now carry a label, a tone colour, a value and a trend.","try":"/row new","since":"0.3.0"}
+{"id":"cli-errors-plain","date":"2026-10-17T19:05:00Z","title":"Plainer error messages","text":"Errors now lead with what happened and why, then one next step, instead of \"Request failed with status 404\". Approving something that was already approved says who approved it and when, and exits 0. Add --verbose to see the HTTP status and server code.","shell":"quox inbox respond <id> --action approve","since":"0.3.0"}
+{"id":"delegation-progress","date":"2026-10-17T20:30:00Z","title":"See what a specialist is doing while you wait","text":"When Quox hands a job to a specialist, the waiting line now names each real step it takes, for example Delegating HYPERION · proxmox_read (vm), instead of sitting silent. Tool footers fold repeats (proxmox_read ×3).","shell":"quox chat \"which VMs use the most memory\"","since":"0.3.0"}
+{"id":"ux-interaction-fixes","date":"2026-10-17T20:00:00Z","title":"Simpler cards and choosers","text":"Approval cards say each thing once and wrap cleanly. /hat, /org and /mode open the same arrow-key chooser as /model. A typo offers a Run /command? card. /sleep no longer swallows a slash command, and an offer you move on from closes itself.","try":"/hat","since":"0.3.0"}
+{"id":"ask-single-key","date":"2026-10-17T21:00:00Z","title":"y, n or c answer a question straight away","text":"y, n or c now answer an open question straight away, and a stray letter no longer sticks to your next command. Pressing Enter right after is ignored, and sending the same queued message twice says it is already queued.","since":"0.3.0"}
+{"id":"tidy-footer","date":"2026-10-17T20:30:00Z","title":"A tidier bottom bar","text":"The status under the input box is now one line that wraps onto a second or third row only when needed, at the same left edge, with no big gaps. It says agent: none when nothing is attached, and the key hints sit on their own row.","try":"/help status","since":"0.3.0"}
+{"id":"handoff-offer","date":"2026-10-17T21:30:00Z","title":"Attached agents offer to hand a question to CommanderQ","text":"When the agent you are attached to has no tools for a question (TRIAGE-Q asked about VM CPU), a card asks: Hand this question to CommanderQ? y asks CommanderQ that one question and you stay attached; n does nothing. quox --print names the same one-turn command.","try":"/attach triage-q","since":"0.3.0"}
+{"id":"divider-aocl","date":"2026-10-17T21:00:00Z","title":"Watch the governance layers light up","text":"After you send, the line under your message shows one mark per AOCL governance layer that lights up as the server reports it, then the model name shimmers while it thinks and turns green when the reply is done, or red with the blocking layer marked.","try":"/aocl","since":"0.3.0"}
+{"id":"approvals-card-first","date":"2026-10-17T22:00:00Z","title":"Approvals open on the card","text":"A plain /approvals now opens straight on the one-at-a-time card. An answer with a note asks you to confirm it first, and a question that has expired says so and moves on.","try":"/approvals","since":"0.3.1"}
+{"id":"welcome-cmd","date":"2026-10-17T21:45:00Z","title":"Replay the welcome screen","text":"/welcome shows the welcome screen again on demand, with the Q, the notice and the dragon greeting on a tall terminal. It changes no setup or config. quox welcome prints the same notice from the shell.","try":"/welcome","since":"0.3.0"}
+{"id":"restart-countdown","date":"2026-10-17T22:30:00Z","title":"Auto-restart counts down and Esc cancels","text":"When /restart auto is on and a newer quox is installed, a line counts down 10 seconds before the restart. Esc stays on this version, Enter restarts now. It waits while a turn runs or you have a draft. QUOX_RESTART_COUNTDOWN sets the seconds (0 restarts at once).","try":"/restart auto","since":"0.3.1"}
+{"id":"active-rows","date":"2026-10-17T22:45:00Z","title":"/active is one clean row per session","text":"Each session shows once, with a status glyph, a readable name, what it needs from you in plain words and its age. Long rows wrap instead of being cut off.","try":"/active","since":"0.3.0"}
+{"id":"no-hint-row","date":"2026-10-17T22:30:00Z","title":"No more Enter send · /help row","text":"The permanent key-hint row under the status line is gone, so the status line ends the screen. While Quox is working you still see how to steer, queue or stop.","try":"/help","since":"0.3.0"}
+{"id":"active-cli-rows","date":"2026-10-17T23:10:00Z","title":"quox active matches the window","text":"quox active now prints the same clean rows as /active, with the unread message count per session. --lines keeps the older layout.","shell":"quox active","since":"0.3.0"}
+{"id":"composer-edit","date":"2026-10-17T22:30:00Z","title":"Edit your draft anywhere, like Claude Code","text":"Move into the middle of your draft and edit there: Ctrl+Left/Right or Alt+B/F jump by word, Ctrl+W or Alt+Backspace delete the word before the cursor, Alt+D the word after, Ctrl+U and Ctrl+K cut to the start or end of the line, and Up/Down move through wrapped lines. Shift with the arrows, Home or End selects text: typing replaces it, Backspace deletes it, and it is copied to your clipboard (OSC 52, works over SSH where the terminal allows it). Your terminal's own mouse selection and copy keep working as usual.","since":"0.3.1"}
+{"id":"peek-id","date":"2026-10-17T22:30:00Z","title":"Look up any id with /peek","text":"/peek <id> works out whether an id is an envelope, inbox item, objective, workflow run, WARD receipt or agent and shows a short card; when nothing matches it says what it tried. Also quox peek <id>.","try":"/peek atlas","since":"0.3.0"}
+{"id":"aside-q","date":"2026-10-17T22:31:00Z","title":"Ask a side question with /aside","text":"/aside <question> asks with no tools and outside the conversation, so it cannot change anything and your next message carries on as if it never happened. The answer shows in its own block marked read only. Also quox aside.","try":"/aside what does a WARD receipt prove?","since":"0.3.0"}
+{"id":"profile-chooser","date":"2026-10-17T22:32:00Z","title":"Switch profile or org from one list","text":"/profile opens a list of your profiles and this login's orgs. Pick one with the arrows and Enter; it changes this window only, never the default your other windows use.","try":"/profile","since":"0.3.0"}
+{"id":"at-mentions","date":"2026-10-17T22:33:00Z","title":"@ completes agents, hosts, tasks and receipts","text":"Type @ in a message to pick an agent, fleet host, task or a receipt from this session; Tab or Enter puts it in. The lists load once per session, so typing never waits on the server.","try":"/help @mention","since":"0.3.0"}
+{"id":"guide-fixes-docker","date":"2026-10-19T06:15:00Z","title":"Getting started can install Docker for you","text":"On Linux, when Docker is missing or your user is not in the docker group, the setup guide offers to fix it (y/N, the exact command shown) and carries on without logging out. A failed install now says why in one line.","shell":"quox","since":"0.3.1","sha":"381c023a3"}
+{"id": "roster-chat-started-runs", "date": "2026-10-19T07:20:00Z", "title": "Workflows you start from chat show as yours", "text": "When you ask Quox to run a workflow, the run is now recorded as started by you, so it appears in your roster and in the away digest instead of being hidden as background work. Scheduled and webhook runs still show as background.", "try": "/roster", "since": "0.3.1", "sha": "d684cdfff"}
+{"id":"stale-signin-recover","date":"2026-10-19T05:30:00Z","title":"An open window picks up a new sign-in","text":"If you sign in again in another window or with quox login, this window now notices and carries on instead of saying it is signed out.","try":"/login","since":"0.3.1"}
+{"id":"presence-auto-clear","date":"2026-10-19T05:30:00Z","title":"Away clears when you are back","text":"If you set /afk and forget /back, your first real action in the terminal (a message, any slash command, or a PIN approval) clears it and says how long you were away. Scripts, --print runs and agents never clear it.","try":"/afk","since":"0.3.1"}
+{"id":"polish5-quiet","date":"2026-10-18T09:00:00Z","title":"Quieter, shorter, truer","text":"Palette descriptions fit one row and /luc finds LUCID first. Waiting approvals collapse to a single row. Your own broadcast no longer echoes back, the org shows by name, and a finished walkthrough leaves no stray line.","try":"/approvals","since":"0.3.0"}
+{"id": "ollama-private-address", "date": "2026-10-19T08:00:00Z", "title": "Connect your own Ollama on your network", "text": "/connect ollama http://<lan-ip>:11434 now asks \"It's on your private network. Connect to it?\" y/N. Say yes (org admins) and Quox checks it answers as Ollama, then allows only that address. No server-wide switch needed.", "try": "/connect ollama", "since": "0.3.1"}
+{"id":"restart-settle","date":"2026-10-19T09:00:00Z","since":"0.3.1","title":"One restart for back-to-back builds","text":"When several new builds land minutes apart, the restart offer now waits until the installed build has stayed unchanged for 2 minutes, so you get one restart instead of two."}
+{"id":"footer-tool-count","date":"2026-10-19T12:00:00Z","since":"0.3.1","title":"Turn footer counts tools properly","text":"The line under an answer now reads 1 tool or 3 tools. Some builds printed [object Object]1 tools after a turn that used a tool."}
+{"id":"cancelled-reads-cancelled","date":"2026-10-19T14:00:00Z","since":"0.3.1","title":"Cancelled reads cancelled","text":"A stopped objective in the activity list now says cancelled (a neutral circle), not failed. Expired and rejected say their own word too, and an empty question no longer draws a stray rule above the composer."}
+{"id":"one-rule-above-composer","date":"2026-10-19T15:00:00Z","since":"0.3.1","title":"One rule above the composer","text":"Under an approval card the composer no longer draws a blank line and a second rule: the card's closing rule is the only one."}