quoxcli 0.0.0-stage → 0.3.1

package/lib/api/endpoints/tg.js

@@ -0,0 +1,56 @@
+/**
+ * 'tg.*' endpoints — Telegram Pro (QTG-PRO P0), collector-direct
+ * (services/collector/server.js), no org segment in the URL — same shape
+ * as `quoxbox.*`/`quoxplan.*`/`traces.*`/`aee.*`/`mon.*`. Every route below
+ * is `requireServiceOrUserAuth()` server-side (X-Service-Key /
+ * INTERNAL_SERVICE_KEY or a user JWT), not org-scoped.
+ *
+ * - tg.status: GET /telegram-pro/onboarding/status (server.js, thin wrapper
+ *   around services/collector/lib/telegramPro/onboardingService.js
+ *   getOnboardingStatus()). Optional ?bot_id= query param.
+ * - tg.bindOwner: POST /telegram-pro/onboarding/bind-owner (onboardingService
+ *   bindOwner()) — 409 when a primary owner binding already exists for the
+ *   bot/chat, body carries the existing binding.
+ * - tg.leases.list: GET /session-leases (sessionLeaseStore.list()) — terminal
+ *   identity leases for parallel Claude Code sessions on this dev box.
+ * - tg.webhook.info: GET /webhook/telegram/info — bot_id is NOT yet honored
+ *   server-side (single-bot lookup only); passed through here so the CLI is
+ *   forward-compatible once the backend adds per-bot support.
+ * - tg.webhook.setup: POST /webhook/telegram/setup — registers the webhook
+ *   with Telegram and persists config via the auth service.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const tg = {
+  'tg.status': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/telegram-pro/onboarding/status`,
+    tags: ['live-safe'],
+  },
+  'tg.bindOwner': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/telegram-pro/onboarding/bind-owner`,
+    tags: ['live-write'],
+  },
+  'tg.leases.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/session-leases`,
+    tags: ['live-safe'],
+  },
+  'tg.webhook.info': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/webhook/telegram/info`,
+    tags: ['live-safe'],
+  },
+  'tg.webhook.setup': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/webhook/telegram/setup`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/tools.js

@@ -0,0 +1,50 @@
+/**
+ * 'tools.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const tools = {
+  'tools.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/tools`,
+    tags: ['live-write'],
+  },
+  'tools.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, toolId }) => `/api/orgs/${orgId}/tools/${toolId}`,
+    tags: ['live-write'],
+  },
+  'tools.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, toolId }) => `/api/orgs/${orgId}/tools/${toolId}`,
+    tags: ['live-safe'],
+  },
+  'tools.install-to-scope': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/tools/install-to-scope`,
+    tags: ['live-write'],
+  },
+  'tools.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/tools`,
+    tags: ['live-safe'],
+  },
+  'tools.publish': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, toolId }) => `/api/orgs/${orgId}/tools/${toolId}/publish`,
+    tags: ['live-write'],
+  },
+  'tools.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, toolId }) => `/api/orgs/${orgId}/tools/${toolId}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/traces.js

@@ -0,0 +1,157 @@
+/**
+ * 'traces.*' endpoints — TRV (Trace Replay & Visualization) API, added as
+ * part of WP4.1 (STREAM_CLI_PARITY_PLAN.md §2.3 #8).
+ *
+ * Backend: services/collector/server.js, mounted at plain `/traces` (NOT
+ * org-scoped in the URL — collector-direct, same pattern as aee.js/chat.js).
+ * Verified at the handlers (server.js:11718-12348).
+ *
+ * ORG-SCOPING FINDING (backend, not fixed here — feeds the multi-tenant
+ * audit): none of the three list reads below (traces.list, replaySessions.list,
+ * comparisons.list, correlations.list) filter by org, despite the write side
+ * accepting an optional `org_id` body field on create:
+ *   - `GET /traces` queries the `envelopes` table, which has NO org_id
+ *     column at all (see migrations/aee/000-baseline.sql) — every trace on
+ *     the instance is returned regardless of caller.
+ *   - `GET /traces/replay-sessions`, `GET /traces/comparisons`, and
+ *     `GET /traces/correlations` all run a bare `SELECT * ... LIMIT ? OFFSET ?`
+ *     with no `WHERE org_id = ?` (server.js:2014/2026/2037 prepared
+ *     statements), even though `replay_sessions.org_id`, `trace_comparisons
+ *     .org_id`, and `trace_correlations.org_id` columns exist WITH indexes
+ *     built specifically for this (migrations/volt/000-baseline.sql:175-206)
+ *     — org_id is stored on write but never used to filter on read. Same
+ *     "leak" shape as the triggers.* / workflows.list findings documented in
+ *     endpoints/triggers.js and endpoints/workflows.js. Not fixed here —
+ *     out of scope for a CLI work package; flagging for the multi-tenant
+ *     audit that requested this check.
+ */
+
+export const traces = {
+  // ── Trace assembly (TRV-2) ──
+  'traces.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/traces`,
+    tags: ['live-safe'],
+  },
+  'traces.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/traces/${id}`,
+    tags: ['live-safe'],
+  },
+  'traces.simulate': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/traces/${id}/simulate`,
+    tags: ['live-write'],
+  },
+  'traces.compare': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/traces/compare`,
+    tags: ['live-write'],
+  },
+
+  // ── Replay sessions (TRV-1) ──
+  'traces.replaySessions.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/traces/replay-sessions`,
+    tags: ['live-write'],
+  },
+  'traces.replaySessions.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/traces/replay-sessions`,
+    tags: ['live-safe'],
+  },
+  'traces.replaySessions.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/traces/replay-sessions/${id}`,
+    tags: ['live-safe'],
+  },
+  'traces.replaySessions.update': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ id }) => `/traces/replay-sessions/${id}`,
+    tags: ['live-write'],
+  },
+  'traces.replaySessions.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id }) => `/traces/replay-sessions/${id}`,
+    tags: ['live-write'],
+  },
+  'traces.replaySessions.deleteAll': {
+    method: 'DELETE',
+    service: 'collector',
+    path: () => `/traces/replay-sessions`,
+    tags: ['live-write'],
+  },
+
+  // ── Comparisons (TRV-1) ──
+  'traces.comparisons.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/traces/comparisons`,
+    tags: ['live-write'],
+  },
+  'traces.comparisons.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/traces/comparisons`,
+    tags: ['live-safe'],
+  },
+  'traces.comparisons.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/traces/comparisons/${id}`,
+    tags: ['live-safe'],
+  },
+  'traces.comparisons.update': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ id }) => `/traces/comparisons/${id}`,
+    tags: ['live-write'],
+  },
+  'traces.comparisons.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id }) => `/traces/comparisons/${id}`,
+    tags: ['live-write'],
+  },
+  'traces.comparisons.deleteAll': {
+    method: 'DELETE',
+    service: 'collector',
+    path: () => `/traces/comparisons`,
+    tags: ['live-write'],
+  },
+
+  // ── Correlation cache (TRV-1) ──
+  'traces.correlations.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ runId }) => `/traces/correlations/${runId}`,
+    tags: ['live-safe'],
+  },
+  'traces.correlations.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/traces/correlations`,
+    tags: ['live-write'],
+  },
+  'traces.correlations.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/traces/correlations`,
+    tags: ['live-safe'],
+  },
+  'traces.correlations.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ runId }) => `/traces/correlations/${runId}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/triggers.js

@@ -0,0 +1,96 @@
+/**
+ * 'triggers.*' endpoints — WP2.2 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #2).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * STEP 0 — quoxflow access path decision (documented here so future quoxflow
+ * work packages don't have to re-derive it):
+ *
+ *   DIRECT to quoxflow (service: 'quoxflow'), NOT via the collector proxy.
+ *
+ *   Evidence:
+ *   - services/collector/server.js proxies quoxflow ONLY on three explicit,
+ *     hand-mounted paths: `GET /quoxflow/evidence`, `GET /quoxflow/observations`,
+ *     `GET /quoxflow/skills[/:id]` (server.js ~19140-19260, "STUDY-REV P6.C —
+ *     QuoxFlow evidence + observations proxy" / "CLI-COCKPIT — QuoxFlow
+ *     skill-library (QSKL) read-only proxy"). Nothing forwards `/api/triggers/*`
+ *     or `/api/workflows/:id/activate|deactivate` — grepping server.js for
+ *     'quoxflow' turns up no catch-all proxy, only these three routes plus
+ *     health-check plumbing. Fable's note that collector proxies are
+ *     per-path explicit (not a wildcard) is confirmed live in this file.
+ *   - quoxflow/src/api/app.ts mounts `createTriggersRoutes` at `app.route('/api/triggers', ...)`
+ *     and `createWorkflowLifecycleRoutes` at `app.route('/api/workflows', ...)`
+ *     (both confirmed by reading app.ts directly) — i.e. the real paths are
+ *     `/api/triggers/webhooks|schedules|events` and
+ *     `/api/workflows/:id/activate|deactivate`, neither proxied by collector.
+ *   - quoxflow/src/api/middleware/auth.ts verifies the SAME JWT_SECRET as the
+ *     QuoxCORE auth service, so a normal `quox login` bearer token is valid
+ *     against quoxflow directly with zero extra auth plumbing.
+ *   - cli/lib/commands/doctor.js already references `service: 'quoxflow',
+ *     port: 3200` for its health check, establishing the service name — but
+ *     cli/lib/core/config.js's SERVICE_PORTS never actually had a `quoxflow`
+ *     key, so that health check silently resolved to the wrong URL (falls
+ *     through to the base profile URL, unmodified port). Fixed alongside
+ *     this fragment by adding `quoxflow: 3200` to SERVICE_PORTS, matching
+ *     docker-compose.yml's `127.0.0.1:${QUOXFLOW_PORT:-3200}:3200` mapping.
+ *
+ *   Conclusion: direct is both the only reachable path AND now correctly
+ *   wired (QUOX_QUOXFLOW_URL env override still available per the standard
+ *   getServiceUrl() convention for non-docker-compose deployments).
+ *
+ * BACKEND FINDING (not fixed here — flagged for triage): none of
+ * GET /api/triggers/webhooks, /schedules, or /events accept or filter by an
+ * org/workflow scope — quoxflow/src/api/routes/triggers.ts calls
+ * `config.webhookRegistry.getAll()` / `config.eventBus.getSubscriptions()`
+ * unfiltered, returning every registered trigger across every org/workflow
+ * on the instance. This is a cross-tenant read surface; the CLI commands
+ * here pass the data through as-is (no client-side org filtering exists to
+ * mask it) and this comment intentionally does not silently filter either,
+ * since a client-side filter would hide the real gap instead of surfacing it.
+ */
+
+export const triggers = {
+  'triggers.events': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/triggers/events`,
+    tags: ['live-safe'],
+  },
+  'triggers.schedules': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/triggers/schedules`,
+    tags: ['live-safe'],
+  },
+  'triggers.webhooks': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/triggers/webhooks`,
+    tags: ['live-safe'],
+  },
+  // SITE-CLI 2026-10-19: pause/resume a schedule without re-applying the workflow JSON. quoxflow's
+  // src/api/routes/schedules.ts (mounted at /api/schedules) is org-scoped (cross-org = 404), persists
+  // node.config.paused and emits SCHEDULE.PAUSED / SCHEDULE.RESUMED envelopes.
+  'triggers.schedule-list': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/schedules`,
+    tags: ['live-safe'],
+  },
+  'triggers.schedule-pause': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId, nodeId }) => `/api/schedules/${encodeURIComponent(workflowId)}/${encodeURIComponent(nodeId)}/pause`,
+  },
+  'triggers.schedule-resume': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId, nodeId }) => `/api/schedules/${encodeURIComponent(workflowId)}/${encodeURIComponent(nodeId)}/resume`,
+  },
+  // The public webhook ingress (quoxflow src/api/routes/webhook-triggers.ts, mounted at /webhooks). It copies every
+  // request header into the run's trigger data, so the CLI fires it with NO credentials (noAuth).
+  'triggers.webhook-fire': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ path }) => `/webhooks/${path}`,
+  },
+};

package/lib/api/endpoints/user-library.js

@@ -0,0 +1,41 @@
+/**
+ * 'user-library.*' endpoints — WP2.3 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #3).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * Per-org/per-user saved workflow library ("My Library"). Backend: the auth
+ * service (NOT quoxflow, NOT proxied) — services/auth/routes/user-library.js,
+ * mounted at plain `/api` (server.js:724), so the router's own
+ * `/orgs/:orgId/user-library` paths are the real, final routes.
+ *
+ * Always scoped to `user_id = req.user.id` in addition to `org_id` (see the
+ * route file's own header comment) — another user in the same org cannot see
+ * or delete these entries. No cross-tenant/cross-user leak found here, unlike
+ * the quoxflow triggers.* list routes.
+ *
+ *   POST   /api/orgs/:orgId/user-library         body: { name, description?, definition_json, source?, source_workflow_id?, tags? }
+ *                                                 201 { entry } | 400 name/definition_json missing | 409 duplicate name
+ *   GET    /api/orgs/:orgId/user-library          query: { source? } ('curated'|'n8n-imported'|'mine')
+ *                                                 200 { entries: [...] } ordered by updated_at DESC
+ *   DELETE /api/orgs/:orgId/user-library/:id      200 { ok: true } | 404 (not found or wrong owner — same code, no leak)
+ */
+
+export const userLibrary = {
+  'user-library.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/user-library`,
+    tags: ['live-write'],
+  },
+  'user-library.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, id }) => `/api/orgs/${orgId}/user-library/${id}`,
+    tags: ['live-write'],
+  },
+  'user-library.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/user-library`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/users.js

@@ -0,0 +1,20 @@
+/**
+ * 'users.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const users = {
+  'users.me.notification-channels.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/users/me/notification-channels`,
+    tags: ['live-safe'],
+  },
+  'users.me.notification-channels.update': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ type }) => `/api/users/me/notification-channels/${type}`,
+    tags: ['live-write'],
+  },
+};