quoxcli 0.2.0 → 0.3.1

package/lib/commands/plan.js

@@ -137,6 +137,23 @@ function renderRoadmapsList(roadmaps) {
   return lines;
 }
 
+function renderSearchResults(data) {
+  const results = data.results || [];
+  if (results.length === 0) return [chalk.dim(`  No streams match "${data.q}".`)];
+  const lines = [''];
+  for (const r of results) {
+    const g = statusGlyph(r.status);
+    const where = [...new Set((r.matches || []).map((m) => m.where))].join(', ');
+    const first = (r.matches || []).find((m) => m.snippet) || {};
+    lines.push(
+      `  ${g.color(g.glyph)} ${pad(truncate(r.id, ID_WIDTH), ID_WIDTH)} ${pad(truncate(r.name, NAME_WIDTH), NAME_WIDTH)} `
+      + `${pad(r.status, 15)} ${pad(where, 18)} ${chalk.dim(truncate(first.snippet || '', 60))}`
+    );
+  }
+  lines.push('', chalk.dim(`  ${results.length} stream${results.length === 1 ? '' : 's'} matched "${data.q}"`));
+  return lines;
+}
+
 function streamLine(s, { indent = 0, showReasons = false } = {}) {
   const prefix = indent > 0 ? '  '.repeat(indent) + '└ ' : '  ';
   const g = statusGlyph(s.status);
@@ -546,6 +563,27 @@ export function registerPlanCommands(program, ctx) {
       printSuccess(`Created roadmap ${created.id || options.id} for org ${orgId}`);
     });
 
+  // ── search ───────────────────────────────────────────────────────────
+
+  plan
+    .command('search <text...>')
+    .description('Search streams by text (id, name, notes, plan, phase titles)')
+    .option('--roadmap <id>', 'limit to one roadmap')
+    .option('--status <status>', `limit to one status (${VALID_STATUSES.join(', ')})`)
+    .action(async (textParts, options) => {
+      auth.requireAuth();
+      if (options.status && !VALID_STATUSES.includes(options.status)) {
+        throw new Error(`invalid --status "${options.status}" (expected ${VALID_STATUSES.join(', ')})`);
+      }
+      const query = { q: textParts.join(' ') };
+      if (options.roadmap) query.roadmap = options.roadmap;
+      if (options.status) query.status = options.status;
+      const ep = resolveEndpoint('quoxplan.search');
+      const data = await client.get(ep.path, { service: ep.service, query });
+      if (isJsonOutput(program)) return printJson(data);
+      console.log(renderSearchResults(data).join('\n'));
+    });
+
   // ── list ─────────────────────────────────────────────────────────────
 
   plan

package/lib/commands/plugin.js

@@ -2,10 +2,12 @@
  * Plugin commands: org-scoped plugin install registry (PD-1..PD-8)
  *
  * quox plugin list|get|install|update|uninstall|mine
+ * quox plugin enable <id>   (PLUGIN-IMG #1012: prebuilt private image, licence first)
  * quox plugin data list|get|set|delete
  * quox plugin secrets list|set|reveal|delete
  * quox plugin assign list|add|remove
  * quox plugin trusted-keys list|add|remove
+ * quox plugin revocations list|add|remove
  *
  * Backend: services/auth/routes/plugins.js, mounted org-scoped at
  * `/api/orgs/:orgId/...` (server.js). Install/update/uninstall and all
@@ -18,6 +20,9 @@ import { readFileSync } from 'node:fs';
 import { formatOutput, formatDetail, printSuccess, printWarning, printInfo } from '../core/output.js';
 import { resolveOrgId, parseJSON } from './helpers.js';
 import { resolveEndpoint } from '../api/endpoints.js';
+import { enablePlugin, entitlementFrom } from '../server/pluginEnable.js';
+import { resolveInstall, readEnvKeys } from '../server/install.js';
+import { createSys } from '../server/sys.js';
 
 /** Read + JSON.parse a file, wrapping errors with the file path for context. */
 function readJsonFile(filePath, label) {
@@ -113,6 +118,56 @@ export function registerPluginCommands(program, ctx) {
       }, { title: `Licence: ${pluginId}` });
     });
 
+  // ── plugin enable (PLUGIN-IMG #1012) ────────────────────────────────────────
+  // Starts a licensed plugin from its prebuilt private image on this
+  // self-hosted install. Licence first: unlicensed means nothing runs.
+
+  plugin
+    .command('enable')
+    .description('Start a licensed plugin from its prebuilt image on this self-hosted install (QuoxPlan for now). Unlicensed: refused, nothing pulled.')
+    .argument('<pluginId>', 'plugin id, e.g. quoxplan')
+    .option('--dir <path>', 'the install directory (default: the one Getting started recorded)')
+    .action(async (pluginId, opts) => {
+      auth.requireAuth();
+      const deps = ctx.serverDeps || {};
+      const env = deps.env || process.env;
+      const sys = deps.sys || createSys();
+      const checkEntitlement = async (id) => {
+        const ep = resolveEndpoint('setup.licensing.entitlements.list');
+        const data = await client.get(ep.path, { service: ep.service });
+        return entitlementFrom(data, id);
+      };
+      // Licence before anything that touches the box: an unlicensed enable must not even look for the install.
+      let ent;
+      try { ent = await checkEntitlement(pluginId); } catch (err) { ent = err; }
+      const resolveFirst = !(ent instanceof Error) && ent && ent.entitled;
+      let install = null;
+      if (resolveFirst) {
+        const i = await resolveInstall({ dir: opts.dir, env, sys, journey: deps.journey });
+        if (i.error) { const e = new Error(i.error); e.exitCode = 2; throw e; }
+        install = i;
+      }
+      const tag = install ? (env.QUOX_IMAGE_TAG || readEnvKeys(install.repoDir, ['QUOX_IMAGE_TAG']).QUOX_IMAGE_TAG || '') : '';
+      const result = await enablePlugin({
+        pluginId,
+        checkEntitlement: async () => { if (ent instanceof Error) throw ent; return ent; },
+        install: install || { repoDir: '' },
+        sys,
+        tag,
+        ...(deps.getPullCredential ? { getPullCredential: deps.getPullCredential } : {}),
+        ...(deps.sleep ? { sleep: deps.sleep } : {}),
+        log: (l) => printInfo(l),
+      });
+      if (program.opts().output === 'json') {
+        console.log(JSON.stringify({ plugin: pluginId, ok: result.ok, stage: result.stage, message: result.message }, null, 2));
+      } else if (result.ok) {
+        printSuccess(result.message);
+      } else {
+        printWarning(result.message);
+      }
+      if (!result.ok) process.exitCode = result.stage === 'licence' ? 3 : 1;
+    });
+
   // ── plugin list ─────────────────────────────────────────────────────────────
 
   plugin
@@ -536,4 +591,59 @@ export function registerPluginCommands(program, ctx) {
       await client.delete(ep.path, reqOpts);
       printSuccess('Trusted key removed.');
     });
+
+  // ── plugin revocations (SDK-TEAM W5) ────────────────────────────────────────
+
+  const revocations = plugin
+    .command('revocations')
+    .description('Revoke a plugin signer key or one bundle digest for this org (admin only). A revoked plugin cannot be installed and stops loading on the next page load.');
+
+  revocations
+    .command('list')
+    .description('List revocations')
+    .action(async () => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('plugins.revocations.list', { orgId });
+      const result = await client.get(ep.path, { service: ep.service });
+      const rows = result.revocations || result || [];
+      formatOutput({
+        columns: ['id', 'kind', 'value', 'reason', 'revoked_by', 'revoked_at'],
+        headers: ['ID', 'Kind', 'Value', 'Reason', 'Revoked By', 'Revoked'],
+        rows,
+      }, { format: program.opts().output, emptyMessage: 'No revocations.' });
+    });
+
+  revocations
+    .command('add')
+    .description('Revoke a signer key or a bundle digest')
+    .option('--signer-key <hex>', 'raw Ed25519 public key (64 hex), as in signature.json public_key_hex')
+    .option('--bundle-digest <hex>', 'sha256 of plugin.esm.js (64 hex), as shown by quox plugin list')
+    .option('--reason <text>', 'why (kept in the audit trail)')
+    .action(async (options) => {
+      auth.requireAuth();
+      if (!!options.signerKey === !!options.bundleDigest) {
+        throw new Error('Specify exactly one of --signer-key or --bundle-digest.');
+      }
+      const orgId = resolveOrgId(auth, program);
+      const body = options.signerKey
+        ? { kind: 'signer_key', value: options.signerKey, reason: options.reason }
+        : { kind: 'bundle_digest', value: options.bundleDigest, reason: options.reason };
+      const ep = resolveEndpoint('plugins.revocations.create', { orgId });
+      const result = await client.post(ep.path, { service: ep.service, body });
+      printSuccess('Revoked.');
+      formatDetail(result.revocation || result, { format: program.opts().output });
+    });
+
+  revocations
+    .command('remove')
+    .description('Lift a revocation')
+    .argument('<revocationId>', 'revocation ID')
+    .action(async (revocationId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('plugins.revocations.delete', { orgId, revocationId });
+      await client.delete(ep.path, { service: ep.service });
+      printSuccess('Revocation lifted.');
+    });
 }

package/lib/commands/presence.js

@@ -0,0 +1,89 @@
+/**
+ * `quox presence [who]` / `quox presence set present|away|sleeping`: PRESENCE (owner 2026-10-16).
+ * A human says they are not at their terminal (/afk, /sleep in quox do the same). Sessions and agents
+ * read it so they stop waiting on approvals, which still queue normally: nothing is ever auto-approved.
+ * Collector routes GET/PUT /api/v1/presence; the org is the caller's, only a human login sets its own.
+ */
+import { resolveEndpoint } from '../api/endpoints.js';
+import { resolveOrgId } from './helpers.js';
+
+const STATES = ['present', 'away', 'sleeping'];
+
+function stamp(iso) {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? String(iso || '') : `${d.toISOString().slice(0, 10)} ${d.toISOString().slice(11, 16)} UTC`;
+}
+
+/** One plain line for a presence record. */
+export function presenceText(p) {
+  if (!p || !p.away) return `${p?.who || 'they'}: present`;
+  const note = p.note ? `, "${p.note}"` : '';
+  return `${p.who}: ${p.auto ? 'away (idle)' : p.state} since ${stamp(p.since)}${note} (approvals will queue)`;
+}
+
+/** The fields an approval request reports, from GET /api/v1/presence. */
+export function approvalPresenceFields(list) {
+  const away = (list && Array.isArray(list.presence) ? list.presence : []).filter((p) => p && p.away);
+  if (!away.length) return { owner_away: false };
+  const p = away.find((x) => x.who === 'owner') || away[0];
+  return { owner_away: true, owner_away_since: p.since, owner_presence: p.state, owner_away_notice: list.notice || presenceText(p) };
+}
+
+/** Read the org's presence; null on any failure (a presence read never fails the caller). */
+export async function readPresence(client, orgId) {
+  try {
+    const ep = resolveEndpoint('presence.list');
+    return await client.get(ep.path, { service: ep.service, query: orgId ? { org_id: orgId } : undefined, retries: 0, timeout: 5000 });
+  } catch { return null; }
+}
+
+export function registerPresenceCommands(program, { client, auth }) {
+  const pr = program
+    .command('presence')
+    .description('Is a person at their terminal? With no name: everyone with presence on record. When someone is away, approvals queue; work on something else')
+    .argument('[who]', 'user id, email, email name, "owner" or "me"')
+    .action(async (who) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const json = program.opts().output === 'json';
+      if (who) {
+        const ep = resolveEndpoint('presence.get', { who });
+        const d = await client.get(ep.path, { service: ep.service, query: { org_id: orgId } });
+        if (json) { console.log(JSON.stringify(d, null, 2)); return; }
+        console.log(presenceText(d.presence));
+        return;
+      }
+      const ep = resolveEndpoint('presence.list');
+      const d = await client.get(ep.path, { service: ep.service, query: { org_id: orgId } });
+      if (json) { console.log(JSON.stringify(d, null, 2)); return; }
+      const list = Array.isArray(d.presence) ? d.presence : [];
+      if (!list.some((p) => p.away)) console.log('Everyone is present: nobody has marked themselves away.');
+      for (const p of list) console.log(presenceText(p));
+    });
+
+  pr
+    .command('set')
+    .description('Say where you are: present, away or sleeping (a human login only). Same as /afk, /sleep, /back in quox')
+    .argument('<state>', 'present | away | sleeping')
+    .option('--note <text>', 'a short note sessions will see ("school run")')
+    .option('--slots <list>', 'your own window slots, comma separated (hitl and triage-q always count)')
+    .option('--auto-away <minutes>', 'read as away after this many idle minutes; "off" to disable (default off)')
+    .action(async (state, options) => {
+      if (!STATES.includes(state)) throw new Error('state must be present, away or sleeping');
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const body = { state };
+      if (options.note !== undefined) body.note = options.note;
+      if (options.slots) body.slots = String(options.slots).split(',').map((s) => s.trim()).filter(Boolean);
+      if (options.autoAway !== undefined) {
+        const off = /^(off|0|no)$/i.test(String(options.autoAway));
+        const n = Number(options.autoAway);
+        if (!off && (!Number.isInteger(n) || n < 1 || n > 1440)) throw new Error('--auto-away is minutes (1 to 1440) or off');
+        body.auto_away_minutes = off ? 0 : n;
+      }
+      const ep = resolveEndpoint('presence.set');
+      const d = await client.put(ep.path, { service: ep.service, body, query: { org_id: orgId } });
+      if (program.opts().output === 'json') { console.log(JSON.stringify(d, null, 2)); return; }
+      console.log(presenceText(d.presence));
+    });
+}

package/lib/commands/provider.js

@@ -0,0 +1,159 @@
+/**
+ * quox provider list | connect <kind> | test [<kind>]  (quox#1281, CLI verb first)
+ *
+ * The SAME backend calls as the TUI's /connect: cli/lib/quoxon/connect.js flows (connectFlow, connectOllamaFlow,
+ * connectCompatFlow, connectionLines) over cli/lib/quoxon/api.js createApi (the auth vault create/update with
+ * confirm_private_origin, the server-side key test and Ollama / OpenAI-compatible probes, capabilities, consent).
+ * Nothing here talks to the backend on its own, so the TUI and the CLI cannot drift. The vault routes audit every
+ * write server side (integration.private_origin for a private address), org-scoped by the caller's session.
+ *
+ * Secrets: a key is never an argv flag or argument. It arrives on stdin (--key-from-stdin) or from a hidden prompt,
+ * is sent once to the server test and the vault, and is never printed (connectFlow scrubs it from any message).
+ */
+import { formatDetail, printInfo } from '../core/output.js';
+import { resolveOrgId } from './helpers.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+import { createApi, isInteractiveHuman } from '../quoxon/api.js';
+import { PROVIDERS, providerFor, looksLikeKey, connectionLines, connectFlow, connectOllamaFlow, connectCompatFlow } from '../quoxon/connect.js';
+import { needsConsent, consentCovers, connectConsentNote, providerLabel } from '../quoxon/consent.js';
+import { readStdin } from '../quoxon/print.js';
+
+const KINDS = Object.keys(PROVIDERS);
+const SAFE_ROW = ['id', 'integration_type', 'label', 'is_default', 'test_status', 'last_tested_at', 'created_at'];
+const CONTAINER_NOTE = 'Quox runs in containers: 127.0.0.1 or localhost means the Quox container, not your machine. Use the host\'s LAN IP, e.g. http://192.0.2.10:11434';
+
+function defaultIO() {
+  return {
+    isTTY: () => isInteractiveHuman(),
+    readStdin: () => readStdin(),
+    promptSecret: async (message) => {
+      const { default: inquirer } = await import('inquirer');
+      const a = await inquirer.prompt([{ type: 'password', name: 'v', message, mask: '*' }]);
+      return a.v;
+    },
+    confirm: async (message) => {
+      const { default: inquirer } = await import('inquirer');
+      const a = await inquirer.prompt([{ type: 'confirm', name: 'v', message, default: false }]);
+      return Boolean(a.v);
+    },
+  };
+}
+
+const say = (lines) => { for (const [t] of lines || []) printInfo(t); };
+
+export function registerProviderCommands(program, ctx) {
+  const { client, auth, config } = ctx;
+  const io = ctx.providerIO || defaultIO();
+  const api = () => (ctx.makeApi ? ctx.makeApi() : createApi({ client, config, auth }));
+
+  const provider = program
+    .command('provider')
+    .description('Connect the AI providers your org uses (the same as /connect in the Quox terminal)');
+
+  // ── provider list ──────────────────────────────────────────────────────────
+  provider
+    .command('list')
+    .description('Show which AI providers this org can use, and how each is connected')
+    .action(async () => {
+      auth.requireAuth();
+      const a = api();
+      const [vault, caps] = await Promise.all([a.connections(), a.capabilities ? a.capabilities() : null]);
+      if (program.opts().output === 'json') {
+        const rows = vault?.ok ? vault.rows.map((r) => Object.fromEntries(SAFE_ROW.filter((k) => r[k] !== undefined).map((k) => [k, r[k]]))) : null;
+        formatDetail({ connections: rows, ...(vault?.ok ? {} : { error: vault?.error || 'vault not readable' }), capabilities: caps?.ok ? caps.capabilities : null }, { format: 'json' });
+        return;
+      }
+      say(connectionLines(vault, caps));
+    });
+
+  // ── provider connect ───────────────────────────────────────────────────────
+  const readKey = async (p, opts) => {
+    if (opts.keyFromStdin) return String(await io.readStdin() || '').replace(/\r?\n$/, '').trim();
+    if (io.isTTY()) return String(await io.promptSecret(`${p.name} key (hidden, never shown or stored on this machine):`) || '').trim();
+    throw new Error(`No key given. Pipe it in with --key-from-stdin (for example: quox provider connect ${p.id} --key-from-stdin < keyfile), or run this in a terminal to be asked. A key is never taken as an argument.`);
+  };
+  const consentAfter = async (type) => {
+    const a = api();
+    if (!needsConsent(type) || !a.consentStatus) return;
+    let rec = null; try { rec = await a.consentStatus(); } catch { rec = null; }
+    if (consentCovers(rec, type)) return;
+    // --yes never grants consent: it is this person's own OK to send their conversations to a third party
+    if (!io.isTTY() || !a.grantConsent) { printInfo(connectConsentNote(type)); return; }
+    const yes = await io.confirm(`Allow Quox to send your conversations to ${providerLabel(type)}? Your messages and tool results go to ${providerLabel(type)}, a third party, when it answers. Nothing is sent until you say yes.`);
+    if (!yes) { printInfo(`Left off: nothing goes to ${providerLabel(type)} until you say so. ${connectConsentNote(type)}`); return; }
+    try { await a.grantConsent(type); printInfo(`✔ Your OK is recorded: ${providerLabel(type)} can now answer. Withdraw it any time: quox consent list.`); }
+    catch (e) { printInfo(`Quox could not record your OK (${e?.message || e}). Try: quox consent grant ${type}`); }
+  };
+
+  provider
+    .command('connect')
+    .description('Connect an AI provider for this org: a keyed provider (openai, anthropic, groq...) takes its key on stdin or a hidden prompt; a self-hosted one (ollama, lmstudio, vllm, custom) takes a URL')
+    .argument('<kind>', `provider: ${KINDS.join(', ')}`)
+    .argument('[url]', 'server URL for ollama / lmstudio / vllm / custom (same as --url)')
+    .option('--url <url>', `server URL for a self-hosted provider. ${CONTAINER_NOTE}`)
+    .option('--model <model>', 'default model to use on that server')
+    .option('--key-from-stdin', 'read the API key from stdin (never pass a key as an argument)')
+    .option('--yes', 'confirm connecting to an address on your private network (the server still checks it and audits the decision)')
+    .addHelpText('after', `\n${CONTAINER_NOTE}\nKeys: --key-from-stdin, or run in a terminal to be asked with a hidden prompt.`)
+    .action(async (kind, urlArg, opts) => {
+      auth.requireAuth();
+      const p = providerFor(kind);
+      if (!p) throw new Error(`No provider called "${kind}". Use one of: ${KINDS.join(', ')}`);
+      if (urlArg && (looksLikeKey(urlArg) || (p.card && !p.url))) throw new Error('never pass a key as an argument (it would sit in your shell history and process list). Use --key-from-stdin, or run in a terminal to be asked.');
+      const a = api();
+      const url = opts.url || urlArg || '';
+      let r;
+      if (p.id === 'ollama') {
+        r = await connectOllamaFlow(a, [url, opts.model].filter(Boolean).join(' '));
+        say(r.lines);
+        if (r.privateAsk) {
+          const q = `Connect to ${r.privateAsk.host}? It's on your private network. Quox saves only ${r.privateAsk.origin}, after the server checks it answers as Ollama.`;
+          let yes = Boolean(opts.yes);
+          if (!yes && io.isTTY()) yes = await io.confirm(q);
+          if (!yes && !io.isTTY()) throw new Error(`${r.privateAsk.host} is on your private network. Run again with --yes to confirm this one address. Nothing was saved.`);
+          if (!yes) throw new Error(`Left blocked: ${r.privateAsk.host} was not connected. Nothing was saved.`);
+          r = await r.privateAsk.retry();
+          say(r.lines);
+        }
+      } else if (p.url) {
+        r = await connectCompatFlow(a, p.id, [url, opts.model].filter(Boolean).join(' '));
+        say(r.lines);
+        if (r.needsKey) { r = await connectFlow(a, 'custom', await readKey(PROVIDERS.custom, opts), r.extra); printInfo(r.text); if (r.disclosure) printInfo(r.disclosure); }
+      } else {
+        r = await connectFlow(a, p.id, await readKey(p, opts));
+        printInfo(r.text);
+        if (r.ok && r.disclosure) printInfo(r.disclosure);
+      }
+      if (r?.lanOffer) printInfo('  From the CLI an instance admin allows private targets with: quox server config lan-targets on   then run this again.');
+      if (!r?.ok) throw new Error(r?.text || `${p.name} was not connected. Nothing was saved.`);
+      await consentAfter(p.type);
+    });
+
+  // ── provider test ──────────────────────────────────────────────────────────
+  provider
+    .command('test')
+    .description('Test the stored connection for a provider (or every default connection) through the vault test')
+    .argument('[kind]', 'provider to test (default: every connected provider)')
+    .action(async (kind) => {
+      auth.requireAuth();
+      const p = kind ? providerFor(kind) : null;
+      if (kind && !p) throw new Error(`No provider called "${kind}". Use one of: ${KINDS.join(', ')}`);
+      const vault = await api().connections();
+      if (!vault?.ok) throw new Error(`Could not read the vault: ${vault?.error || 'no answer'}`);
+      const types = new Set(p ? [p.type] : Object.values(PROVIDERS).map((x) => x.type));
+      const rows = vault.rows.filter((r) => types.has(r.integration_type) && (r.is_default === 1 || r.is_default === true));
+      if (!rows.length) throw new Error(p ? `No ${p.id} connection is stored for this org. Connect one: quox provider connect ${p.id}` : 'No provider connection is stored for this org. Connect one: quox provider connect <kind>');
+      const orgId = resolveOrgId(auth, program);
+      let failed = 0;
+      for (const row of rows) {
+        const name = (Object.values(PROVIDERS).find((x) => x.type === row.integration_type) || {}).name || row.integration_type;
+        const ep = resolveEndpoint('vault.test', { orgId, id: row.id });
+        let res;
+        try { res = await client.post(ep.path, { service: ep.service, retries: 0 }); }
+        catch (e) { res = { success: false, message: e?.message || 'failed' }; }
+        if (res?.success === false) { failed++; printInfo(`✖ ${name}  ${row.label || row.id}  failed: ${res?.message || 'no reason given'}`); }
+        else printInfo(`✔ ${name}  ${row.label || row.id}  ok${res?.message ? `: ${res.message}` : ''}`);
+      }
+      if (failed) process.exitCode = 1;
+    });
+}

package/lib/commands/qlarity.js

@@ -49,9 +49,12 @@ function annotate(err) {
   throw err;
 }
 
-async function call(client, id, params = {}, body) {
+// quox#907: a browser login is slower than a read; well above the client's 30s default.
+const LOGIN_TIMEOUT_MS = 120000;
+
+async function call(client, id, params = {}, body, extra = {}) {
   const ep = resolveEndpoint(id, params);
-  const opts = { service: ep.service };
+  const opts = { service: ep.service, ...extra };
   if (body) opts.body = body;
   switch (ep.method) {
     case 'POST': return client.post(ep.path, opts);
@@ -634,15 +637,28 @@ export function registerQlarityCommands(program, ctx) {
           (await call(client, 'qlarity.sessions.list')).sessions || [],
           normalizedOrigin,
         );
+        let fresh = false;
         if (!sessionId) {
           const s = await call(client, 'qlarity.session.create', {}, {});
           sessionId = s.id;
+          fresh = true;
         }
 
         const body = { origin: normalizedOrigin, credential_id: credentialId };
         if (options.loginPath) body.login_path = options.loginPath;
 
-        const r = await call(client, 'qlarity.session.login', { sessionId }, body);
+        // quox#907: a real login (page load, form fill, cookie wait) can outlast the CLI's 30s default on a loaded
+        // box, and the server kept finishing it, so every timed-out retry left a headless browser behind. Give login
+        // its own budget, and close a session THIS call created when the login call fails (as openSession does, #680).
+        let r;
+        try {
+          r = await call(client, 'qlarity.session.login', { sessionId }, body, { timeout: LOGIN_TIMEOUT_MS });
+        } catch (loginErr) {
+          if (fresh) {
+            try { await call(client, 'qlarity.session.close', { sessionId }); } catch { /* the server reaper will get it */ }
+          }
+          throw loginErr;
+        }
 
         if (r.logged_in) {
           loggedIn[normalizedOrigin] = { sessionId, logged_in_at: new Date().toISOString() };

package/lib/commands/quoxchat.js

@@ -131,11 +131,19 @@ export function registerQuoxchatCommands(program, ctx) {
     .action(async () => {
       auth.requireAuth();
       const orgId = resolveOrgId(auth, program);
-      const data = await client.get(resolveEndpoint('quoxchat.widgets.list', { orgId }).path, { service: resolveEndpoint('quoxchat.widgets.list', { orgId }).service });
+      // QC-BRUTALOOP-W15: the route pages at 20; listing only page 1 silently
+      // under-reported the org's widgets (20 of 34). Walk every page.
+      const ep = resolveEndpoint('quoxchat.widgets.list', { orgId });
+      const rows = [];
+      for (let page = 1; page <= 50; page++) {
+        const data = await client.get(page === 1 ? ep.path : `${ep.path}?page=${page}`, { service: ep.service });
+        rows.push(...(Array.isArray(data) ? data : (data.items || [])));
+        if (Array.isArray(data) || !data.pagination?.has_more) break;
+      }
       formatOutput({
         columns: ['id', 'name', 'assistant_name', 'status', 'operator_online', 'created_at'],
         headers: ['ID', 'Name', 'Assistant', 'Status', 'Operator online', 'Created'],
-        rows: data.items || data,
+        rows,
       }, { format: program.opts().output, emptyMessage: 'No widgets found.' });
     });
 
@@ -209,7 +217,8 @@ export function registerQuoxchatCommands(program, ctx) {
     .description('Print a conversation transcript in chronological order')
     .argument('<widgetId>', 'widget ID')
     .argument('<conversationId>', 'conversation ID')
-    .action(async (widgetId, conversationId) => {
+    .option('--full', 'do not truncate long messages in table output (JSON output is never truncated)')
+    .action(async (widgetId, conversationId, cmdOpts = {}) => {
       auth.requireAuth();
       const orgId = resolveOrgId(auth, program);
 
@@ -236,7 +245,7 @@ export function registerQuoxchatCommands(program, ctx) {
           from: m.role === 'user' ? visitorName : m.role === 'operator' ? (m.sender_name || 'Operator') : 'AI assistant',
           content: m.content || '',
         })),
-      }, { format: program.opts().output, emptyMessage: 'No messages in this conversation yet.' });
+      }, { format: program.opts().output, full: cmdOpts.full === true, emptyMessage: 'No messages in this conversation yet.' });
     });
 
   quoxchat

package/lib/commands/quoxseo.js

@@ -100,6 +100,44 @@ export function registerQuoxseoCommands(program, ctx) {
       } catch (err) { annotate(err); }
     });
 
+  s.command('remove-site <site>')
+    .description('Remove a registered site and its warehouse data for this org (governed, witnessed). <site> is an origin or property id')
+    .option('-y, --yes', 'skip the confirmation prompt')
+    .action(async (site, opts) => {
+      try {
+        const list = await get(client, 'quoxseo.sites');
+        const props = list.properties || [];
+        const norm = (v) => String(v).trim().replace(/\/+$/, '').toLowerCase();
+        const target = props.find((p) => String(p.id) === String(site).trim() || norm(p.origin) === norm(site));
+        if (!target) {
+          throw new Error(`Site not found: ${site} is not registered for this org. List them with: quox seo sites`);
+        }
+        const warn = `This permanently removes ${target.origin} (#${target.id}) from this org and deletes its crawl, GSC and GA4 warehouse data. This cannot be undone.`;
+        if (!opts.yes && program.opts().yes !== true) {
+          if (!process.stdin.isTTY) {
+            throw new Error(`${warn} Confirmation needed; re-run with --yes in a non-interactive shell: quox seo remove-site ${target.origin} --yes`);
+          }
+          console.log(warn);
+          const { confirmDestructive } = await import('../core/confirm.js');
+          const ok = await confirmDestructive(program, {}, `Remove ${target.origin}?`);
+          if (!ok) { console.log('Aborted. Nothing was removed.'); return; }
+        }
+        const ep = resolveEndpoint('quoxseo.sites.remove', { id: target.id });
+        let data;
+        try {
+          data = await client.delete(ep.path, { service: ep.service });
+        } catch (err) {
+          const code = err?.status ?? err?.statusCode ?? err?.response?.status;
+          if (code === 404 || code === 405 || /\b(404|405)\b|not found|read.only/i.test(err?.message || '')) {
+            err.message = `${err.message}\nThis install's QuoxSEO service does not support site removal (no DELETE route), or the site no longer exists. Nothing was removed.`;
+          }
+          throw err;
+        }
+        if (jsonOut(data)) return;
+        console.log(`removed #${target.id}  ${target.origin}`);
+      } catch (err) { annotate(err); }
+    });
+
   s.command('urls')
     .description('Warehouse rows for the latest crawl')
     .option('--filter <f>', 'orphans | noindex | errors | no-gsc | discovered')

package/lib/commands/reach.js

@@ -103,7 +103,8 @@ export function registerReachCommands(program, ctx) {
       const orgId = resolveOrgId(auth, program);
       const days = parseInt(options.days, 10) || 30;
       const ep = resolveEndpoint('reach.agent.leastPrivilege', { orgId, agentId, days });
-      const result = await client.get(ep.path, { service: ep.service });
+      // #923: the report scans the usage window and outlived the 30 s default under load
+      const result = await client.get(ep.path, { service: ep.service, timeout: 120000 });
 
       if (isJsonOutput(program)) {
         process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);