quoxcli 0.2.0 → 0.3.1

package/LICENSE

@@ -30,6 +30,6 @@ THIS IS A SOURCE-AVAILABLE PROPRIETARY LICENCE. IT IS NOT AN OPEN-SOURCE LICENCE
 
 13. Law and versions. This licence is governed by the law of England and Wales, subject to mandatory protections in Your jurisdiction. Courts of England and Wales have jurisdiction where legally permitted. Quox may offer NEW versions under revised terms. Publishing new terms does not retroactively withdraw grants validly received for earlier versions. Separately signed agreements and applicable third-party licences govern where they apply.
 
-14. Contact. For white-label, managed-hosting, OEM, redistribution or other permissions: contact@quox.ai.
+14. Contact. For white-label, managed-hosting, OEM, redistribution or other permissions: hello@quox.ai.
 
 Copyright (c) 2025-2026 Quox LTD. All rights reserved.

package/README.md

@@ -12,6 +12,8 @@ npm install -g quoxcli
 
 Needs Node.js 20 or later. This installs two commands: `quox`, and `quoxon` (an alias that opens the conversation).
 
+Docs: https://cli.quox.ai/docs/start/
+
 ## Prerequisite: a running QuoxCORE
 
 You need a QuoxCORE instance to talk to. Install one on a machine you control: see https://github.com/quoxai/quoxcore, or run:

package/bin/quox.js

@@ -1,22 +1,16 @@
 #!/usr/bin/env node
 import '../lib/core/prodEnv.js'; // first: production React unless NODE_ENV is set (before anything loads React)
 
-import { Command } from 'commander';
-import { loadConfig, resolveProfileFlagFromArgv } from '../lib/core/config.js';
-import { resolveCliVersion, BASE_VERSION } from '../lib/core/version.js';
-import { mergeShadowedGlobals } from '../lib/core/global-flags.js';
-import { createAuth } from '../lib/core/auth.js';
-import { extractActingAs } from '../lib/core/actingAs.js';
-import { createClient } from '../lib/core/client.js';
-import { handleError } from '../lib/core/errors.js';
-import { assertOrgOverrideSafe, commandPath } from '../lib/core/org-override.js';
-// QUOXIFY pass 2 (DEVSUITE phase 15): the two dev-suite members that had no
-// unified verb at all. Gripe's own definition of done named `quox gripe`.
-import { generateCompletion } from '../lib/core/completions.js';
-import { loadAllPlugins } from '../lib/plugins/loader.js';
-import { registerCommandGroups } from '../lib/core/lazyCommands.js';
 import v8 from 'node:v8';
 
+// QUOXON-LATENCY: a warm `claude` spare cannot carry this turn's conversation id in its
+// (fixed) env, so the collector writes it to QUOX_SESSION_ID_FILE for the turn. Surface it
+// as QUOX_SESSION_ID before any command reads it. An explicit QUOX_SESSION_ID wins.
+if (!process.env.QUOX_SESSION_ID && process.env.QUOX_SESSION_ID_FILE) {
+  // dynamic, not a static import: bin/quox.js keeps its static imports to prodEnv + node:v8 (r3early, input capture first)
+  try { process.env.QUOX_SESSION_ID = (await import('node:fs')).readFileSync(process.env.QUOX_SESSION_ID_FILE, 'utf8').trim(); } catch { /* turn ended: no session */ }
+}
+
 // CORTEX-BENCH: Node's fetch parses HTTP with a WebAssembly module, and V8
 // recompiles it at the optimising tier on a background thread; Node waits for
 // that compile before exiting, adding 350-700ms to every short command after
@@ -27,13 +21,29 @@ v8.setFlagsFromString('--liftoff-only');
 // subcommand and only client flags, a TTY gets the QUOXON client and
 // `--print` runs headless. The old 15-item menu is `quox tui`. Decided from
 // argv alone, before config or any command module loads.
+// R3 D4: raw mode before ANY heavy module loads. The command modules below used to be static imports,
+// evaluated before this block, so keys typed in the first ~2 s echoed cooked and an Enter was lost.
 {
   const { routesToQuoxon } = await import('../lib/quoxon/route.js');
   const qArgv = process.argv.slice(2);
   if (routesToQuoxon(qArgv, process.stdout.isTTY)) {
-    const { main: quoxonMain } = await import('../lib/quoxon/main.js');
+    // QUOXON-RESTART-LEAK: the first interactive client on a terminal becomes a tiny launcher (no TUI, no polling)
+    // that runs the client as its child and re-runs it on /restart, so restarts never nest (98 deep, 15 GB, 2026-10-17).
+    const launcher = await import('../lib/quoxon/launcher.js');
+    if (launcher.shouldLaunch({ argv: qArgv })) {
+      const code = await launcher.runLauncher({ argv: qArgv });
+      if (code !== null) process.exit(code); // null: no handoff dir, so run the client in this process as before
+    }
+    launcher.takeLauncherHandoff(); // a launched client: read and drop the handoff var before anything can spawn
+    if (!qArgv.some(a => a === '--print' || a.startsWith('--print=') || a === '-h' || a === '--help')) (await import('../lib/quoxon/earlyInput.js')).captureEarlyInput();
     try {
-      await quoxonMain(qArgv);
+      // QUOXON-LATENCY: --print runs headless without loading React / Ink / the App (~2 s cold).
+      const headless = qArgv.some(a => a === '--print' || a.startsWith('--print='))
+        && await (await import('../lib/quoxon/headless.js')).runHeadless(qArgv);
+      if (!headless) {
+        const { main: quoxonMain } = await import('../lib/quoxon/main.js');
+        await quoxonMain(qArgv);
+      }
     } catch (err) {
       console.error(err?.message || err);
       process.exitCode = 1;
@@ -42,6 +52,24 @@ v8.setFlagsFromString('--liftoff-only');
   }
 }
 
+// The commander CLI: loaded only when the conversation client is not (see the block above).
+// `quox --update` is `quox update` (owner 2026-10-16): one updater, lib/core/selfUpdate.js.
+if (process.argv.includes('--update')) process.argv = [...process.argv.slice(0, 2), ...(await import('../lib/core/selfUpdate.js')).rewriteUpdateFlag(process.argv.slice(2))];
+const { Command } = await import('commander');
+const { loadConfig, resolveProfileFlagFromArgv } = await import('../lib/core/config.js');
+const { resolveCliVersion, BASE_VERSION } = await import('../lib/core/version.js');
+const { applyRootOptions, installFlagDeliveryHooks } = await import('../lib/core/rootOptions.js');
+const { createAuth } = await import('../lib/core/auth.js');
+const { extractActingAs } = await import('../lib/core/actingAs.js');
+const { createClient } = await import('../lib/core/client.js');
+const { handleError } = await import('../lib/core/errors.js');
+const { assertOrgOverrideSafe, commandPath } = await import('../lib/core/org-override.js');
+// QUOXIFY pass 2 (DEVSUITE phase 15): the two dev-suite members that had no
+// unified verb at all. Gripe's own definition of done named `quox gripe`.
+const { generateCompletion } = await import('../lib/core/completions.js');
+const { loadAllPlugins } = await import('../lib/plugins/loader.js');
+const { registerCommandGroups } = await import('../lib/core/lazyCommands.js');
+
 // #610: --version must reflect the ACTUAL running commit, not a frozen literal
 // (the global CLI worktree was silently 32 commits behind and --version never
 // showed it). The git-backed resolution lives in ../lib/core/version.js, shared
@@ -56,18 +84,9 @@ const program = new Command();
 program
   .name('quox')
   .description('QuoxCORE CLI — manage agents, workflows, memory, fleet, and more')
-  .version(versionRequested ? resolveCliVersion() : BASE_VERSION)
-  .option('-o, --output <format>', 'output format: table, json, csv, quiet', 'table')
-  .option('--json', 'shorthand for --output json')
-  .option('-q, --quiet', 'suppress output, show IDs only')
-  .option('--org <slug>', 'override active organization')
-  .option('-p, --profile <name>', 'use a specific config profile')
-  .option('--no-color', 'disable colored output')
-  .option('-v, --verbose', 'show detailed output')
-  .option('--debug', 'show HTTP request/response details')
-  .option('--dry-run', 'show what would happen without executing')
-  .option('-y, --yes', 'skip confirmation prompts')
-  .option('--insecure', 'allow self-signed SSL certificates')
+  .version(versionRequested ? resolveCliVersion() : BASE_VERSION);
+// Global options live in lib/core/rootOptions.js so the safety-flag test builds this same root.
+applyRootOptions(program)
   .addHelpText('after', '\nConversation (QUOXON client):\n  quox                                  interactive conversation (terminal only)\n  quox --print "<prompt>" [--output text|json] [--conversation <id>] [--timeout <s>]   one headless turn; exit 0 completed, 2 held for approval, 3 interrupted, 4 not signed in, 5 unconfirmed\n  quox --demo                           simulated journey, nothing real runs\n');
 
 // Wire up global flags
@@ -81,8 +100,30 @@ program.hook('preAction', (thisCommand) => {
 // never receives it: commander resolves against the root first and the
 // subcommand reads undefined forever. See lib/core/global-flags.js for the
 // 13 places this had already shipped, including --dry-run executing for real.
-program.hook('preAction', (thisCommand, actionCommand) => {
-  mergeShadowedGlobals(thisCommand, actionCommand);
+// Also: a --dry-run the leaf cannot honour is refused, never silently dropped
+// (quox#1077 follow-up). Both hooks live in lib/core/rootOptions.js.
+installFlagDeliveryHooks(program);
+
+// #1141: `--org <slug>` (and a slug in QUOX_ORG_ID) resolves to the org ID once, here, so every verb and
+// the GRIPE-709 guard below see an ID. ID-shaped values pass through with no call. Login-type verbs are left alone.
+program.hook('preAction', async (thisCommand, actionCommand) => {
+  const { isOrgId, resolveOrgRef } = await import('../lib/core/orgResolve.js');
+  const { EXEMPT } = await import('../lib/core/org-override.js');
+  if (EXEMPT.has(commandPath(actionCommand))) return;
+  const rootOrg = thisCommand.opts().org;
+  const leafOrg = actionCommand !== thisCommand ? actionCommand.getOptionValue?.('org') : undefined;
+  const envOrg = process.env.QUOX_ORG_ID;
+  if ([rootOrg, leafOrg, envOrg].every((v) => !v || typeof v !== 'string' || isOrgId(v))) return;
+  const { resolveEndpoint } = await import('../lib/api/endpoints.js');
+  const listOrgs = async () => {
+    const ep = resolveEndpoint('orgs.list');
+    const d = await client.get(ep.path, { service: ep.service });
+    return Array.isArray(d) ? d : (d?.organizations || d?.orgs || d?.data || []);
+  };
+  const base = { profile: config.getActiveProfileName?.() || 'default', authData: config.getAuth?.() || null, listOrgs };
+  if (typeof rootOrg === 'string' && !isOrgId(rootOrg)) thisCommand.setOptionValue('org', await resolveOrgRef(rootOrg, base));
+  if (typeof leafOrg === 'string' && !isOrgId(leafOrg)) actionCommand.setOptionValue('org', await resolveOrgRef(leafOrg, base));
+  if (envOrg && !isOrgId(envOrg)) process.env.QUOX_ORG_ID = await resolveOrgRef(envOrg, { ...base, source: 'QUOX_ORG_ID' });
 });
 
 // GRIPE-709: --org must be honoured or refused, never silently ignored.
@@ -135,101 +176,8 @@ const ctx = { config, auth, client, program };
 // module(s) that define the command being run (see lib/core/lazyCommands.js),
 // with a full load whenever the command is unknown, help is asked for, or the
 // lazy path fails. A miss can only be slower, never wrong.
-const COMMAND_REGISTRARS = [
-  ['../lib/commands/auth.js', 'registerAuthCommands'],
-  ['../lib/commands/service.js', 'registerServiceCommands'],
-  ['../lib/commands/status.js', 'registerStatusCommand'],
-  ['../lib/commands/doctor.js', 'registerDoctorCommand'],
-  ['../lib/commands/open.js', 'registerOpenCommand'],
-  ['../lib/commands/motion.js', 'registerMotionCommand'],
-  ['../lib/commands/config-cmd.js', 'registerConfigCommands'],
-  ['../lib/commands/org.js', 'registerOrgCommands'],
-  ['../lib/commands/invites.js', 'registerInvitesCommands'],
-  ['../lib/commands/team.js', 'registerTeamCommands'],
-  ['../lib/commands/department.js', 'registerDepartmentCommands'],
-  ['../lib/commands/agent.js', 'registerAgentCommands'],
-  ['../lib/commands/tool.js', 'registerToolCommands'],
-  ['../lib/commands/workflow.js', 'registerWorkflowCommands'],
-  ['../lib/commands/objective.js', 'registerObjectiveCommands'],
-  ['../lib/commands/assistant.js', 'registerAssistantCommands'],
-  ['../lib/commands/fleet.js', 'registerFleetCommands'],
-  ['../lib/commands/chat.js', 'registerChatCommands'],
-  ['../lib/commands/memory.js', 'registerMemoryCommands'],
-  ['../lib/commands/brain.js', 'registerBrainCommands'],
-  ['../lib/commands/entity.js', 'registerEntityCommands'],
-  ['../lib/commands/backup.js', 'registerBackupCommands'],
-  ['../lib/commands/inbox.js', 'registerInboxCommands'],
-  ['../lib/commands/approvals.js', 'registerApprovalsCommands'],
-  ['../lib/commands/mail.js', 'registerMailCommands'],
-  ['../lib/commands/calendar.js', 'registerCalendarCommands'],
-  ['../lib/commands/notes.js', 'registerNotesCommands'],
-  ['../lib/commands/contacts.js', 'registerContactsCommands'],
-  ['../lib/commands/licence.js', 'registerLicenceCommands'],
-  ['../lib/commands/run.js', 'registerRunCommands'],
-  ['../lib/commands/file.js', 'registerFileCommands'],
-  ['../lib/commands/admin.js', 'registerAdminCommands'],
-  ['../lib/commands/aee.js', 'registerAeeCommands'],
-  ['../lib/commands/integration.js', 'registerIntegrationCommands'],
-  ['../lib/commands/consent.js', 'registerConsentCommands'],
-  ['../lib/commands/setup.js', 'registerSetupCommands'],
-  ['../lib/commands/watch.js', 'registerWatchCommands'],
-  ['../lib/commands/tag.js', 'registerTagCommands'],
-  ['../lib/commands/scope.js', 'registerScopeCommands'],
-  ['../lib/commands/notification.js', 'registerNotificationCommands'],
-  ['../lib/commands/prompt.js', 'registerPromptCommands'],
-  ['../lib/commands/plugin.js', 'registerPluginCommands'],
-  ['../lib/commands/powers.js', 'registerPowersCommands'],
-  ['../lib/commands/conversation.js', 'registerConversationCommands'],
-  ['../lib/commands/vault.js', 'registerVaultCommands'],
-  ['../lib/commands/volt.js', 'registerVoltCommands'],
-  ['../lib/commands/governance.js', 'registerGovernanceCommands'],
-  ['../lib/commands/skills.js', 'registerSkillsCommands'],
-  ['../lib/commands/claude.js', 'registerClaudeCommands'],
-  ['../lib/commands/monitoring.js', 'registerMonitoringCommands'],
-  ['../lib/commands/trigger.js', 'registerTriggerCommands'],
-  ['../lib/commands/webhook.js', 'registerWebhookCommands'],
-  ['../lib/commands/sso.js', 'registerSsoCommands'],
-  ['../lib/commands/role.js', 'registerRoleCommands'],
-  ['../lib/commands/domain.js', 'registerDomainCommands'],
-  ['../lib/commands/security.js', 'registerSecurityCommands'],
-  ['../lib/commands/safety.js', 'registerSafetyCommands'],
-  ['../lib/commands/scim.js', 'registerScimCommands'],
-  ['../lib/commands/llm-policy.js', 'registerLlmPolicyCommands'],
-  ['../lib/commands/hat.js', 'registerHatCommands'],
-  ['../lib/commands/settings.js', 'registerSettingsCommands'],
-  ['../lib/commands/llm.js', 'registerLlmCommands'],
-  ['../lib/commands/capabilities.js', 'registerCapabilitiesCommands'],
-  ['../lib/commands/quoxchat.js', 'registerQuoxchatCommands'],
-  ['../lib/commands/budget.js', 'registerBudgetCommands'],
-  ['../lib/commands/trace.js', 'registerTraceCommands'],
-  ['../lib/commands/mon.js', 'registerMonCommands'],
-  ['../lib/commands/quoxbox.js', 'registerQuoxboxCommands'],
-  ['../lib/commands/plan.js', 'registerPlanCommands'],
-  ['../lib/commands/engagement.js', 'registerEngagementCommands'],
-  ['../lib/commands/done.js', 'registerDoneCommands'],
-  ['../lib/commands/discord.js', 'registerDiscordCommands'],
-  ['../lib/commands/qlarity.js', 'registerQlarityCommands'],
-  ['../lib/commands/reach.js', 'registerReachCommands'],
-  ['../lib/commands/inventory.js', 'registerInventoryCommands'],
-  ['../lib/commands/policy.js', 'registerPolicyCommands'],
-  ['../lib/commands/quoxseo.js', 'registerQuoxseoCommands'],
-  ['../lib/commands/voice.js', 'registerVoiceCommands'],
-  ['../lib/commands/awareness.js', 'registerAwarenessCommands'],
-  ['../lib/commands/lucid.js', 'registerLucidCommands'],
-  ['../lib/commands/tg.js', 'registerTgCommands'],
-  ['../lib/commands/dev.js', 'registerDevCommands'],
-  ['../lib/commands/build.js', 'registerBuildCommands'],
-  ['../lib/commands/slot.js', 'registerSlotCommands'],
-  ['../lib/commands/gripe.js', 'registerGripeCommands'],
-  ['../lib/commands/nucleus.js', 'registerNucleusCommands'],
-  ['../lib/commands/onboard.js', 'registerOnboardCommands'],
-  ['../lib/commands/x.js', 'registerXCommands'],
-  ['../lib/commands/linkedin.js', 'registerLinkedInCommands'],
-  ['../lib/commands/facebook.js', 'registerFacebookCommands'],
-  ['../lib/commands/instagram.js', 'registerInstagramCommands'],
-  ['../lib/commands/tiktok.js', 'registerTikTokCommands'],
-];
-await registerCommandGroups(program, ctx, COMMAND_REGISTRARS, process.argv.slice(2), import.meta.url);
+const { COMMAND_REGISTRARS, COMMAND_REGISTRARS_BASE } = await import('../lib/core/commandRegistrars.js');
+await registerCommandGroups(program, ctx, COMMAND_REGISTRARS, process.argv.slice(2), COMMAND_REGISTRARS_BASE);
 
 // TUI command
 program
@@ -272,6 +220,20 @@ try {
   // Plugin loading should never crash the CLI
 }
 
+// C4: once a day, warn when this CLI and the server differ in major/minor. Never for JSON/quiet output,
+// a non-TTY stderr, or `quox server …` itself (that verb shows versions); never fails a command.
+async function warnVersionSkew() {
+  try {
+    const o = program.opts();
+    if (o.output === 'json' || o.output === 'quiet' || o.json || o.quiet || !process.stderr.isTTY || process.env.QUOX_NO_SKEW_CHECK) return;
+    const first = process.argv.slice(2).find((a) => !a.startsWith('-'));
+    if (!first || first === 'server') return;
+    const { checkSkewOncePerDay } = await import('../lib/server/skew.js');
+    const sk = await checkSkewOncePerDay({ collectorUrl: config.getServiceUrl('collector') });
+    if (sk) process.stderr.write(`\u26a0 version skew: ${sk.message}\n`);
+  } catch { /* advisory only */ }
+}
+
 // Bare `quox` in a TTY never reaches here (routed to QUOXON above); bare
 // non-TTY prints the banner so a script never hangs.
 {
@@ -285,8 +247,19 @@ try {
       process.exit(0);
     }
     await program.parseAsync(process.argv);
+    await warnVersionSkew();
   } catch (err) {
-    handleError(err, program.opts().output);
+    // #1101: Ctrl-C at any inquirer prompt is the user leaving: "Cancelled.", cursor back, exit 130, no stack.
+    const { exitOnPromptCancel } = await import('../lib/core/promptCancel.js');
+    exitOnPromptCancel(err); // exits 130 on a cancel; otherwise falls through to the normal error printer
+    // #995: tell the error printer which group failed and what verbs it has, so a 404 hint names a real one
+    let ctx = null;
+    try {
+      const word = process.argv.slice(2).find((a, i, all) => !a.startsWith('-') && !['-p', '--profile', '--org', '-o', '--output'].includes(all[i - 1]));
+      const grp = word && program.commands.find((c) => c.name() === word || c.aliases().includes(word));
+      if (grp) ctx = { group: grp.name(), subcommands: grp.commands.map((c) => c.name()) };
+    } catch { /* the hint is advisory */ }
+    handleError(err, program.opts().output, ctx);
     process.exit(err.exitCode || 1);
   }
 }

package/lib/api/endpoints/admin.js

@@ -17,6 +17,32 @@ export const admin = {
     path: () => '/api/admin/agent-identities',
     tags: ['admin-write'],
   },
+  // Instance basics after setup (app URL etc). Served by services/auth/routes/admin-instance.js.
+  'admin.instance.basics.get': {
+    method: 'GET',
+    service: 'auth',
+    path: () => '/api/admin/instance/basics',
+    tags: ['live-safe'],
+  },
+  'admin.instance.basics.set': {
+    method: 'PUT',
+    service: 'auth',
+    path: () => '/api/admin/instance/basics',
+    tags: ['admin-write'],
+  },
+  // LAN integration targets gate (allow_lan_integration_targets). Served by services/auth/routes/admin-instance.js.
+  'admin.instance.lan_targets.get': {
+    method: 'GET',
+    service: 'auth',
+    path: () => '/api/admin/instance/lan-targets',
+    tags: ['live-safe'],
+  },
+  'admin.instance.lan_targets.set': {
+    method: 'PUT',
+    service: 'auth',
+    path: () => '/api/admin/instance/lan-targets',
+    tags: ['admin-write'],
+  },
   'admin.config.update': {
     method: 'PATCH',
     service: 'auth',

package/lib/api/endpoints/agent-schedules.js

@@ -0,0 +1,26 @@
+/**
+ * 'agent-schedules.*' endpoints (tasks service, services/tasks/server.js "agent-schedules" routes).
+ * A cron-driven task for an agent: the scheduler creates an objective and runs the prompt each tick,
+ * escalating to the owner's approvals inbox per the escalation policy. /watch (quoxon) stands on this.
+ */
+
+export const agentSchedules = {
+  'agent-schedules.create': {
+    method: 'POST',
+    service: 'tasks',
+    path: () => `/api/agent-schedules`,
+    tags: ['live-write'],
+  },
+  'agent-schedules.list': {
+    method: 'GET',
+    service: 'tasks',
+    path: () => `/api/agent-schedules`,
+    tags: ['live-safe'],
+  },
+  'agent-schedules.delete': {
+    method: 'DELETE',
+    service: 'tasks',
+    path: ({ id }) => `/api/agent-schedules/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/agents.js

@@ -23,6 +23,13 @@ export const agents = {
     path: ({ orgId, agentId }) => `/api/orgs/${orgId}/agents/${agentId}`,
     tags: ['live-safe'],
   },
+  // ASIDE: a no-tools, no-conversation model call (quox aside, the TUI /aside). Spends tokens, changes nothing.
+  'agents.invoke.notools': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/internal/agents/invoke`,
+    tags: ['skip-live'],
+  },
   'agents.list': {
     method: 'GET',
     service: 'auth',

package/lib/api/endpoints/assistants.js

@@ -23,12 +23,24 @@ export const assistants = {
     path: ({ orgId, assistantId }) => `/api/orgs/${orgId}/assistants/${assistantId}/deploy`,
     tags: ['live-write'],
   },
+  'assistants.undeploy': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, assistantId, deploymentId }) => `/api/orgs/${orgId}/assistants/${assistantId}/deployments/${deploymentId}`,
+    tags: ['live-write'],
+  },
   'assistants.fork': {
     method: 'POST',
     service: 'auth',
     path: ({ orgId, assistantId }) => `/api/orgs/${orgId}/assistants/${assistantId}/fork`,
     tags: ['live-write'],
   },
+  'assistants.publish': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, assistantId }) => `/api/orgs/${orgId}/assistants/${assistantId}/publish`,
+    tags: ['live-write'],
+  },
   'assistants.get': {
     method: 'GET',
     service: 'auth',

package/lib/api/endpoints/away.js

@@ -0,0 +1,15 @@
+/**
+ * 'away.*' endpoints: E5 "What happened while I was away?" (`/away` in the quox client).
+ * Collector route GET /api/v1/away?since=<iso> (org + user scoped, requireServiceOrUserAuth).
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const away = {
+  'away.digest': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/away`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/chat.js

@@ -31,6 +31,13 @@ export const chat = {
     path: () => `/api/v1/providers/ollama/probe`,
     tags: ['live-safe'],
   },
+  // QUOXON-MODEL: live model list for the hosted providers (openai | anthropic), server cached 1 h.
+  'chat.providers.models': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ provider }) => `/api/v1/providers/${encodeURIComponent(provider)}/models`,
+    tags: ['live-safe'],
+  },
   'chat.providers.ollama.models': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/contactsq.js

@@ -57,8 +57,10 @@ export const contactsq = {
   'contactsq.sync.remove': { method: 'DELETE', service: 'collector', path: ({ id }) => `${B}/sync/sources/${id}`, tags: ['live-write'] },
   // P8a: morning brief, timeline / touchpoints / policy (selftest), handoff notes.
   'contactsq.brief': { method: 'GET', service: 'collector', path: () => `${B}/brief`, tags: ['live-safe'] },
+  'contactsq.count': { method: 'GET', service: 'collector', path: () => `${B}/count`, tags: ['live-safe'] },
   'contactsq.timeline': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/timeline`, tags: ['live-safe'] },
   'contactsq.touchpoints.add': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/touchpoints`, tags: ['live-write'] },
+  'contactsq.best_channel': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/best-channel`, tags: ['live-safe'] },
   'contactsq.policy': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/policy`, tags: ['live-safe'] },
   'contactsq.handoffs.add': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/handoffs` },
   'contactsq.handoffs': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/handoffs`, tags: ['live-safe'] },

package/lib/api/endpoints/conversations.js

@@ -5,6 +5,20 @@
  */
 
 export const conversations = {
+  // #1016: chat conversations (the collector's chat_session_turns, what chat writes). The memory-service
+  // routes below are the IMPORTED conversation archive, reached with --archive.
+  'conversations.chat.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/conversations`,
+    tags: ['live-safe'],
+  },
+  'conversations.chat.turns': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/conversations/${encodeURIComponent(id)}/turns`,
+    tags: ['live-safe'],
+  },
   'conversations.get': {
     method: 'GET',
     service: 'memory',

package/lib/api/endpoints/executions.js

@@ -29,4 +29,17 @@ export const executions = {
     path: () => `/api/executions`,
     tags: ['live-safe'],
   },
+  // #997: `run cancel`/`run resume` reach the engine first (these are the runs `run list` shows)
+  'executions.cancel': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ executionId }) => `/api/executions/${executionId}/cancel`,
+    tags: ['live-write'],
+  },
+  'executions.resume': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ executionId }) => `/api/executions/${executionId}/resume`,
+    tags: ['live-write'],
+  },
 };

package/lib/api/endpoints/fetchAllowlist.js

@@ -0,0 +1,27 @@
+/**
+ * 'fetchAllowlist.*' endpoints: the per-org URL-prefix allowlist behind the governed
+ * agent fetch tool (web_fetch_allowlisted, quox#1171). Collector-owned routes
+ * (services/collector/lib/agentFetchAllowlistRoutes.js). Writes are human org
+ * admin only on the server.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const fetchAllowlist = {
+  'fetchAllowlist.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/fetch-allowlist`,
+    tags: ['live-safe'],
+  },
+  'fetchAllowlist.add': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/fetch-allowlist`,
+  },
+  'fetchAllowlist.remove': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ prefix }) => `/api/v1/fetch-allowlist?url_prefix=${encodeURIComponent(prefix)}`,
+  },
+};

package/lib/api/endpoints/files.js

@@ -23,4 +23,18 @@ export const files = {
     path: () => `/upload`,
     tags: ['live-write'],
   },
+  // F01 A': quarantined legacy files (no proven owner) and their owner-approved assignment. Collector routes,
+  // human instance admin only (enforced server-side).
+  'files.quarantine.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/admin/files/quarantine`,
+    tags: ['live-safe'],
+  },
+  'files.quarantine.assign': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/admin/files/assign`,
+    tags: ['live-write'],
+  },
 };

package/lib/api/endpoints/hat.js

@@ -26,6 +26,36 @@ export const hat = {
     path: ({ orgId, hatId }) => `/api/orgs/${orgId}/quoxhat/hats/${encodeURIComponent(hatId)}`,
     tags: ['live-safe'],
   },
+  // quox#1183: which hat a conversation is on, and the person's own switch (audited quoxhat.binding.selected).
+  'hat.resolve': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/quoxhat/resolve`,
+    tags: ['live-safe'],
+  },
+  'hat.bind': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId, conversationId }) => `/api/orgs/${orgId}/quoxhat/bindings/${encodeURIComponent(conversationId)}`,
+  },
+  // CUSTOM-HATS (owner 2026-10-17): create / edit (definition + optional rename) / delete a custom
+  // hat. Same auth routes the dashboard uses; org hats need org manage-settings, a private hat only
+  // its owner. Every write is revisioned and audited server-side (quoxhat.hat.created|updated|deleted).
+  'hat.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/quoxhat/hats`,
+  },
+  'hat.update': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId, hatId }) => `/api/orgs/${orgId}/quoxhat/hats/${encodeURIComponent(hatId)}`,
+  },
+  'hat.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, hatId }) => `/api/orgs/${orgId}/quoxhat/hats/${encodeURIComponent(hatId)}`,
+  },
   // Audited reset of an org-edited built-in hat back to its current template
   // (needs org manage-settings); writes quoxhat.hat.reset_to_template.
   'hat.reset': {

package/lib/api/endpoints/inbox.js

@@ -17,12 +17,32 @@ export const inbox = {
     path: ({ orgId }) => `/api/orgs/${orgId}/inbox`,
     tags: ['live-safe'],
   },
+  // quox#827: the ONE server-side set of open approvals this user can act on (also backs stats.pending_approvals and LUCID).
+  'inbox.approvals.open': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/approvals/open`,
+    tags: ['live-safe'],
+  },
   'inbox.respond': {
     method: 'POST',
     service: 'auth',
     path: ({ orgId, itemId }) => `/api/orgs/${orgId}/inbox/${itemId}/respond`,
     tags: ['live-write'],
   },
+  // quox ask: a session files a decision request (one inbox item) and waits for the human's answer.
+  'inbox.decision.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/decisions`,
+    tags: ['live-write'],
+  },
+  'inbox.decision.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, id }) => `/api/orgs/${orgId}/decisions/${id}`,
+    tags: ['live-safe'],
+  },
   'inbox.stats.list': {
     method: 'GET',
     service: 'auth',