quoxcli 0.2.0 → 0.3.1

package/lib/api/endpoints/index.js

@@ -58,8 +58,13 @@ import { assistants } from './assistants.js';
 import { audit } from './audit.js';
 import { auth } from './auth.js';
 import { awareness } from './awareness.js';
+import { router } from './router.js';
+import { mind } from './mind.js';
 import { lucid } from './lucid.js';
+import { away } from './away.js';
+import { presence } from './presence.js';
 import { invites } from './invites.js';
+import { agentSchedules } from './agent-schedules.js';
 import { backupSchedules } from './backup-schedules.js';
 import { backups } from './backups.js';
 import { brain } from './brain.js';
@@ -100,6 +105,7 @@ import { quoxchat } from './quoxchat.js';
 import { quoxflow } from './quoxflow.js';
 import { quoxplan } from './quoxplan.js';
 import { qlarity } from './qlarity.js';
+import { fetchAllowlist } from './fetchAllowlist.js';
 import { quoxseo } from './quoxseo.js';
 import { telephony } from './telephony.js';
 import { voice } from './voice.js';
@@ -124,6 +130,7 @@ import { v1 } from './v1.js';
 import { vault } from './vault.js';
 import { volt } from './volt.js';
 import { safety } from './safety.js';
+import { stepup } from './stepup.js';
 import { ward } from './ward.js';
 import { webhooks } from './webhooks.js';
 import { workflows } from './workflows.js';
@@ -137,8 +144,13 @@ export const ENDPOINTS = {
   ...audit,
   ...auth,
   ...awareness,
+  ...router,
+  ...mind,
   ...lucid,
+  ...away,
+  ...presence,
   ...invites,
+  ...agentSchedules,
   ...backupSchedules,
   ...backups,
   ...brain,
@@ -179,6 +191,7 @@ export const ENDPOINTS = {
   ...quoxflow,
   ...quoxplan,
   ...qlarity,
+  ...fetchAllowlist,
   ...quoxseo,
   ...telephony,
   ...voice,
@@ -203,6 +216,7 @@ export const ENDPOINTS = {
   ...vault,
   ...volt,
   ...safety,
+  ...stepup,
   ...ward,
   ...webhooks,
   ...workflows,

package/lib/api/endpoints/memory.js

@@ -66,6 +66,25 @@ export const memory = {
     path: ({ id }) => `/api/memory/${id}/reinstate`,
     tags: ['live-write'],
   },
+  // QUOXMIND #1111: the core set.
+  'memory.core-set': {
+    method: 'GET',
+    service: 'memory',
+    path: () => `/api/memory/core-set`,
+    tags: ['live-safe'],
+  },
+  'memory.pin': {
+    method: 'POST',
+    service: 'memory',
+    path: ({ id }) => `/api/memory/${id}/pin`,
+    tags: ['live-write'],
+  },
+  'memory.unpin': {
+    method: 'DELETE',
+    service: 'memory',
+    path: ({ id }) => `/api/memory/${id}/pin`,
+    tags: ['live-write'],
+  },
   'memory.update': {
     method: 'PATCH',
     service: 'memory',

package/lib/api/endpoints/mind.js

@@ -0,0 +1,13 @@
+/**
+ * 'mind.*' endpoints: QuoxMind cognitive implants (read-only).
+ * Collector routes: GET /api/v1/mind/implants, /api/v1/mind/implants/:id,
+ * /api/v1/mind/health, /api/v1/mind/mirror (the compact System Status block CommanderQ
+ * is given, plus its age). Org-scoped, requireServiceOrUserAuth.
+ */
+
+export const mind = {
+  'mind.implants': { method: 'GET', service: 'collector', path: () => `/api/v1/mind/implants`, tags: ['live-safe'] },
+  'mind.implant': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/mind/implants/${encodeURIComponent(id)}`, tags: ['live-safe'] },
+  'mind.health': { method: 'GET', service: 'collector', path: () => `/api/v1/mind/health`, tags: ['live-safe'] },
+  'mind.mirror': { method: 'GET', service: 'collector', path: () => `/api/v1/mind/mirror`, tags: ['live-safe'] },
+};

package/lib/api/endpoints/mon.js

@@ -85,6 +85,12 @@ export const mon = {
     path: ({ id }) => `/docker/containers/${id}`,
     tags: ['live-safe'],
   },
+  'mon.docker.containers.inspect': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/docker/containers/${id}/inspect`,
+    tags: ['live-safe'],
+  },
   'mon.docker.containers.list': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/objectives.js

@@ -11,6 +11,12 @@ export const objectives = {
     path: ({ id }) => `/api/objectives/${id}/approve-plan`,
     tags: ['live-write'],
   },
+  'objectives.cancel': {
+    method: 'DELETE',
+    service: 'tasks',
+    path: ({ id }) => `/api/objectives/${id}`,
+    tags: ['live-write'],
+  },
   'objectives.checkpoint-approve': {
     method: 'POST',
     service: 'tasks',

package/lib/api/endpoints/plugins.js

@@ -101,6 +101,24 @@ export const plugins = {
     path: ({ orgId, pluginId, name }) => `/api/orgs/${orgId}/plugins/${pluginId}/secrets/${name}`,
     tags: ['live-write'],
   },
+  'plugins.revocations.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/plugin-revocations`,
+    tags: ['live-write'],
+  },
+  'plugins.revocations.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, revocationId }) => `/api/orgs/${orgId}/plugin-revocations/${revocationId}`,
+    tags: ['live-write'],
+  },
+  'plugins.revocations.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/plugin-revocations`,
+    tags: ['live-safe'],
+  },
   'plugins.trusted-keys.create': {
     method: 'POST',
     service: 'auth',

package/lib/api/endpoints/presence.js

@@ -0,0 +1,33 @@
+/**
+ * 'presence.*' endpoints: PRESENCE (owner 2026-10-16). /afk, /sleep, /back in quox, `quox presence`.
+ * Collector routes GET/PUT /api/v1/presence (org from the verified caller; only a human login sets its own).
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const presence = {
+  'presence.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/presence`,
+    tags: ['live-safe'],
+  },
+  'presence.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ who }) => `/api/v1/presence/${encodeURIComponent(who)}`,
+    tags: ['live-safe'],
+  },
+  'presence.activity': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/presence/activity`,
+    tags: ['live-write'],
+  },
+  'presence.set': {
+    method: 'PUT',
+    service: 'collector',
+    path: () => `/api/v1/presence`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/quoxplan.js

@@ -27,6 +27,13 @@ export const quoxplan = {
     path: () => `/api/v1/quoxplan/roadmaps`,
     tags: ['live-write'],
   },
+  // Read-only free-text search over streams (id, name, summary, notes, plan, phase titles).
+  'quoxplan.search': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/quoxplan/search`,
+    tags: ['live-safe'],
+  },
   'quoxplan.roadmap.streams.list': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/quoxseo.js

@@ -77,6 +77,12 @@ export const quoxseo = {
     service: 'collector',
     path: () => `/api/v1/quoxseo/sites`,
   },
+  // Symmetric removal (quoxwebsite#63); org-scoped at the collector proxy.
+  'quoxseo.sites.remove': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxseo/sites/${encodeURIComponent(id)}`,
+  },
   // quox#676: governed report delivery (email via instance SMTP and/or the HITL
   // inbox, AEE-witnessed at the collector).
   'quoxseo.report.deliver': {

package/lib/api/endpoints/router.js

@@ -0,0 +1,17 @@
+/**
+ * 'router.*' endpoints: RouterOS identity (quoxai/quox#1236).
+ * Collector route: GET /api/v1/mikrotik/tls-fingerprint (requireServiceOrUserAuth).
+ * Handshake only: the collector reads the certificate the configured router
+ * endpoint presents and sends NO credentials. Nothing is stored or pinned.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const router = {
+  'router.tlsFingerprint': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/mikrotik/tls-fingerprint`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/safety.js

@@ -43,4 +43,11 @@ export const safety = {
     path: () => `/api/v1/safety/history`,
     tags: ['live-safe'],
   },
+  // QUOXON-STEPUP: a human with a live step-up token overrides ONE blocked action (collector routes/overrides.js).
+  'safety.override': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/overrides`,
+    tags: ['live-write'],
+  },
 };

package/lib/api/endpoints/skills.js

@@ -161,6 +161,19 @@ export const skills = {
     path: ({ qid }) => `/api/quox-skills/review-queue/${qid}/reject`,
     tags: ['live-write'],
   },
+  // #1006: the crystal store (quoxflow skills.ts), where `skills from-execution` writes; list/show merge it in
+  'skills.crystals.list': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/skills`,
+    tags: ['live-safe'],
+  },
+  'skills.crystals.get': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: ({ id }) => `/api/skills/${id}`,
+    tags: ['live-safe'],
+  },
   'skills.rollbackToVersion': {
     method: 'POST',
     service: 'quoxflow',
@@ -171,6 +184,13 @@ export const skills = {
   // It actually runs a workflow/crystal (side effects beyond a rejected
   // write); 'skip-live' keeps it out of the live-contract harness entirely
   // per the WP2.3 brief ("Do NOT seed execute as live").
+  // QSKL create (quoxflow quox-skills.ts POST /): firewall-scanned; ?dry_run=true returns the verdict without writing.
+  'skills.create': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: () => `/api/quox-skills`,
+    tags: ['live-write'],
+  },
   'skills.run': {
     method: 'POST',
     service: 'quoxflow',

package/lib/api/endpoints/stepup.js

@@ -0,0 +1,20 @@
+/**
+ * 'stepup.*' endpoints: QUOXON-STEPUP human step-up PIN (auth service routes/stepUp.js).
+ * There is deliberately NO endpoint here that sets or changes the PIN: that is a dashboard-only act
+ * (browser session plus fresh password). The CLI can read status and verify, nothing else.
+ */
+
+export const stepup = {
+  'stepup.status': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/auth/me/step-up-pin`,
+    tags: ['live-safe'],
+  },
+  'stepup.verify': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/auth/me/step-up`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/teams.js

@@ -43,8 +43,8 @@ export const teams = {
   },
   'teams.provisionRoom': {
     method: 'POST',
-    service: 'tasks',
-    path: ({ teamId }) => `/api/teams/${teamId}/provision-room`,
+    service: 'auth',
+    path: ({ orgId, teamId }) => `/api/orgs/${orgId}/teams/${teamId}/provision-room`,
     tags: ['live-write'],
   },
   'teams.update': {

package/lib/api/endpoints/triggers.js

@@ -67,4 +67,30 @@ export const triggers = {
     path: () => `/api/triggers/webhooks`,
     tags: ['live-safe'],
   },
+  // SITE-CLI 2026-10-19: pause/resume a schedule without re-applying the workflow JSON. quoxflow's
+  // src/api/routes/schedules.ts (mounted at /api/schedules) is org-scoped (cross-org = 404), persists
+  // node.config.paused and emits SCHEDULE.PAUSED / SCHEDULE.RESUMED envelopes.
+  'triggers.schedule-list': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/schedules`,
+    tags: ['live-safe'],
+  },
+  'triggers.schedule-pause': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId, nodeId }) => `/api/schedules/${encodeURIComponent(workflowId)}/${encodeURIComponent(nodeId)}/pause`,
+  },
+  'triggers.schedule-resume': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId, nodeId }) => `/api/schedules/${encodeURIComponent(workflowId)}/${encodeURIComponent(nodeId)}/resume`,
+  },
+  // The public webhook ingress (quoxflow src/api/routes/webhook-triggers.ts, mounted at /webhooks). It copies every
+  // request header into the run's trigger data, so the CLI fires it with NO credentials (noAuth).
+  'triggers.webhook-fire': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ path }) => `/webhooks/${path}`,
+  },
 };

package/lib/api/endpoints/v1.js

@@ -296,6 +296,15 @@ export const v1 = {
     path: () => `/api/v1/tools/execute`,
     tags: ['live-write'],
   },
+  // DEVFLEET: HYPERION VM pool, human REST surface (a human acting directly is the
+  // authorization; agents use the proxmox_pool_* tools, which are approval-governed).
+  'v1.proxmox.pool': { method: 'GET', service: 'collector', path: () => `/api/v1/proxmox/pool`, tags: ['live-safe'] },
+  'v1.proxmox.pool.config.put': { method: 'PUT', service: 'collector', path: () => `/api/v1/proxmox/pool/config`, tags: ['live-write'] },
+  'v1.proxmox.pool.lease': { method: 'POST', service: 'collector', path: () => `/api/v1/proxmox/pool/lease`, tags: ['live-write'] },
+  'v1.proxmox.pool.release': { method: 'POST', service: 'collector', path: ({ vmid }) => `/api/v1/proxmox/pool/${encodeURIComponent(vmid)}/release`, tags: ['live-write'] },
+  // DEVFLEET-P15: HYPERION activity (VMs, who holds each, node load, recent ops), read only.
+  'v1.proxmox.activity': { method: 'GET', service: 'collector', path: () => `/api/v1/proxmox/activity`, tags: ['live-safe'] },
+  'v1.proxmox.rehearsal': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/proxmox/rehearsals/${encodeURIComponent(id)}`, tags: ['live-safe'] },
   // quox#791: stored outcome of an approved gated tool call.
   'v1.approvals.result': {
     method: 'GET',
@@ -303,12 +312,38 @@ export const v1 = {
     path: ({ id }) => `/api/v1/approvals/${encodeURIComponent(id)}/result`,
     tags: ['live-safe'],
   },
+  // Fleet standing grants (2026-10-13): org-admin pre-approved ssh_exec lanes.
+  'v1.approvals.grants.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/approvals/grants`,
+    tags: ['live-safe'],
+  },
+  'v1.approvals.grants.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/approvals/grants`,
+    tags: ['live-write'],
+  },
+  'v1.approvals.grants.revoke': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/approvals/grants/${encodeURIComponent(id)}/revoke`,
+    tags: ['live-write'],
+  },
   'v1.tools.list': {
     method: 'GET',
     service: 'collector',
     path: () => `/api/v1/tools/list`,
     tags: ['live-safe'],
   },
+  // QUOXON-REACH: registered specialist roster (entity JSONs), used by `quox agent list`.
+  'v1.agents.registry': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/agent-registry`,
+    tags: ['live-safe'],
+  },
   // DEVSUITE-GRIPE-P7 / quox#567 (CLI half): agent-to-tool permission
   // mapping, keyed by agent id (Object.keys(...).agentTools) — the
   // no-auth-gate source of truth for "which agent ids currently exist",
@@ -431,6 +466,25 @@ export const v1 = {
     path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/say`,
     tags: ['live-write'],
   },
+  // QUOXON-BROADCAST: fan one message out to the org's held slots; status and per-slot acks.
+  'v1.slots.broadcast': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/slots/broadcast`,
+    tags: ['live-write'],
+  },
+  'v1.slots.broadcast.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/slots/broadcast/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'v1.slots.broadcast.ack': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/slots/broadcast/${encodeURIComponent(id)}/ack`,
+    tags: ['live-write'],
+  },
   'v1.slots.messages': {
     method: 'GET',
     service: 'collector',
@@ -445,6 +499,38 @@ export const v1 = {
     path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/wait`,
     tags: ['live-safe'],
   },
+  // QUOXON-MESH: SSE push of a slot's messages (the quox TUI's live inbound).
+  'v1.slots.stream': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/stream`,
+    tags: ['live-safe'],
+  },
+  // QUOXON-ROOMS: a slot as a group room. Join = subscribe + post without holding.
+  'v1.slots.join': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/join`,
+    tags: ['live-write'],
+  },
+  'v1.slots.leave': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/leave`,
+    tags: ['live-write'],
+  },
+  'v1.slots.members': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/members`,
+    tags: ['live-safe'],
+  },
+  'v1.slots.rooms': {
+    method: 'GET',
+    service: 'collector',
+    path: () => '/api/v1/slot-rooms',
+    tags: ['live-safe'],
+  },
   // "Option B" assign model (plan v2 note #2831): assign an expected holder
   // ahead of time, claim checks out every slot assigned to a session name.
   'v1.slots.assign': {

package/lib/api/endpoints/ward.js

@@ -17,6 +17,13 @@ export const ward = {
     path: () => `/ward/entries`,
     tags: ['live-safe'],
   },
+  // PEEK: one WARD entry (a receipt) by its ward_entry_id; org-scoped for a user login.
+  'ward.entries.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/ward/entries/${id}`,
+    tags: ['live-safe'],
+  },
   'ward.stats.list': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/workflows.js

@@ -81,6 +81,13 @@ export const workflows = {
   // quoxflow#7: execute an engine-store workflow directly (the auth-service
   // runs route only knows auth-store workflows). Org comes from the caller's
   // auth context server-side, like the other quoxflow-direct entries.
+  // #997: `workflow delete` reaches engine workflows (the ones `workflow list` labels "engine")
+  'workflows.applyDelete': {
+    method: 'DELETE',
+    service: 'quoxflow',
+    path: ({ workflowId }) => `/api/workflows/${workflowId}`,
+    tags: ['live-write'],
+  },
   'workflows.applyExecute': {
     method: 'POST',
     service: 'quoxflow',

package/lib/api/endpoints/x.js

@@ -19,6 +19,14 @@ export const x = {
     path: () => `/x/media`,
     tags: ['live-write'],
   },
+  // GET /x/activity: recent claims + ledger + live budget (camelCase), org-scoped. `quox x status`
+  // reads the budget from here.
+  'x.activity': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/x/activity`,
+    tags: ['live-safe'],
+  },
 };
 
 export default x;

package/lib/commands/actions.js

@@ -0,0 +1,61 @@
+/**
+ * Action Tracker commands (read-only): `quox actions list | get`.
+ *
+ * #839 / #891: the agent has action_list but the CLI had no verb, so Action
+ * Tracker answers could not be checked against CLI truth. These verbs call the
+ * SAME governed tool the Action Tracker UI and the agent use (POST
+ * /api/v1/tools/execute, tool_name action_list), so chat, UI and CLI read one
+ * source. Writes (add/move/update/delete) stay in chat and the UI for now.
+ */
+
+import { formatOutput, formatDetail } from '../core/output.js';
+import { QuoxError } from '../core/errors.js';
+import { executeGovernedTool } from './tool.js';
+
+const STATUSES = ['todo', 'doing', 'done', 'all'];
+
+async function listItems(ctx, { status = 'all', limit = 100, scope } = {}) {
+  if (!STATUSES.includes(status)) {
+    throw new QuoxError(`--status must be one of ${STATUSES.join(', ')}`);
+  }
+  const input = { status, limit: Math.min(Math.max(Number(limit) || 20, 1), 100) };
+  if (scope) input.scope_id = scope;
+  const data = await executeGovernedTool(ctx, 'action_list', input);
+  const result = data && data.result !== undefined ? data.result : data;
+  if (!result || result.success === false) {
+    throw new QuoxError(`action_list failed: ${(result && (result.error || result.message)) || 'no result'}`);
+  }
+  return Array.isArray(result.items) ? result.items : [];
+}
+
+export function registerActionsCommands(program, ctx) {
+  const actions = program
+    .command('actions')
+    .description('Action Tracker items (read-only; add and move items in chat or the dashboard)');
+
+  actions
+    .command('list')
+    .description('List action items')
+    .option('--status <status>', 'todo, doing, done or all', 'all')
+    .option('--limit <n>', 'max items (1-100)', '100')
+    .option('--scope <scopeId>', 'only items in this team/department/division scope')
+    .action(async (options) => {
+      const items = await listItems({ ...ctx, program }, options);
+      formatOutput({
+        columns: ['id', 'status', 'priority', 'title', 'dueDate'],
+        headers: ['ID', 'Status', 'Priority', 'Title', 'Due'],
+        rows: items.map((i) => ({ ...i, dueDate: i.dueDate || '-' })),
+      }, { raw: items });
+    });
+
+  actions
+    .command('get')
+    .description('Show one action item by id')
+    .argument('<id>', 'action item id (from `quox actions list`)')
+    .action(async (id) => {
+      const items = await listItems({ ...ctx, program }, { status: 'all', limit: 100 });
+      const item = items.find((i) => i.id === id);
+      if (!item) throw new QuoxError(`No action item ${id} among the latest 100 items.`);
+      formatDetail(item);
+    });
+}

package/lib/commands/admin.js

@@ -27,6 +27,13 @@ export function registerAdminCommands(program, ctx) {
       const config = data.config || data;
       if (key) {
         // quox#533: `get <key>` used to be rejected outright.
+        // #1010: auth returns an ARRAY of { key, value, ... } rows; an object map is handled too.
+        if (Array.isArray(config)) {
+          const row = config.find((r) => r && r.key === key);
+          if (!row) throw new Error(`config key "${key}" not found. Run \`quox admin config get\` to list all keys.`);
+          formatDetail(row, { format: program.opts().output, title: 'Platform Config' });
+          return;
+        }
         if (!config || typeof config !== 'object' || !(key in config)) {
           throw new Error(`config key "${key}" not found. Run \`quox admin config get\` to list all keys.`);
         }
@@ -345,6 +352,15 @@ export function registerAdminCommands(program, ctx) {
       const body = {};
       if (options.dryRun) body.dry_run = true;
       const data = await client.post(resolveEndpoint('admin.retention.cleanup').path, { service: resolveEndpoint('admin.retention.cleanup').service, body });
+      if (options.dryRun) {
+        // quox#1084: servers before the fix ignored dry_run and deleted for real.
+        // Never present an unconfirmed result as a harmless preview.
+        if (!data || data.dry_run !== true) {
+          throw new Error('the server did not honour --dry-run (it predates quox#1084): the cleanup may have run for real. Check `quox admin retention stats`.');
+        }
+        formatDetail(data, { format: program.opts().output, title: 'Cleanup preview (dry run): nothing deleted' });
+        return;
+      }
       formatDetail(data, { format: program.opts().output, title: 'Cleanup Result' });
     });