quoxcli 0.2.0 → 0.3.1

package/lib/core/output.js

@@ -12,7 +12,7 @@ import Table from 'cli-table3';
  * Format and print tabular data
  *
  * @param {Object} result - { columns, headers, rows } or array of objects
- * @param {Object} options - { format, title, emptyMessage }
+ * @param {Object} options - { format, title, emptyMessage, full } (full: no 60-char cell truncation in table mode)
  */
 export function formatOutput(result, options = {}) {
   const format = options.format || getOutputFormat();
@@ -168,7 +168,7 @@ function formatTable(rows, columns, headers, options) {
   });
 
   for (const row of rows) {
-    table.push(columns.map(col => formatValue(row[col])));
+    table.push(columns.map(col => formatValue(row[col], options.full === true)));
   }
 
   console.log(table.toString());
@@ -202,7 +202,7 @@ function csvEscape(value) {
   return str;
 }
 
-function formatValue(value) {
+function formatValue(value, full = false) {
   if (value == null) return chalk.dim('-');
   if (typeof value === 'boolean') return value ? chalk.green('yes') : chalk.dim('no');
 
@@ -221,7 +221,7 @@ function formatValue(value) {
   }
 
   // Truncate long values in table mode
-  if (str.length > 60) return str.slice(0, 57) + '...';
+  if (!full && str.length > 60) return str.slice(0, 57) + '...';
 
   return str;
 }

package/lib/core/peek.js

@@ -0,0 +1,126 @@
+/**
+ * PEEK: look up one id without knowing what it is. `quox peek <id>` and the TUI /peek share this.
+ *
+ * The id's shape picks the kinds worth asking for (an envelope, inbox item, objective and workflow run
+ * are all ULIDs, so a ULID asks all four at once; a WARD receipt is a UUID; an agent is a slug). Every
+ * lookup reuses an existing read endpoint. A 404 means "not this kind"; any other failure is kept and
+ * said, so an unknown id always names exactly what was tried and what each answered.
+ */
+import { resolveEndpoint } from '../api/endpoints.js';
+
+const ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SLUG = /^[a-z][a-z0-9_-]{0,63}$/i;
+
+export const KIND_LABEL = { envelope: 'envelope', inbox: 'inbox item', objective: 'objective', run: 'workflow run', receipt: 'WARD receipt', agent: 'agent' };
+
+/** -> { id (normalised), kinds: ordered kinds to try, shape: a plain word for the id's shape }. */
+export function idShapes(raw) {
+  const id = String(raw ?? '').trim();
+  if (!id) return { id, kinds: [], shape: 'empty' };
+  if (/^ENV_/i.test(id)) return { id, kinds: ['envelope'], shape: 'envelope id' };
+  const obj = id.match(/^OBJ_([0-9A-HJKMNP-TV-Z]{26})$/i); // an objective's corr id
+  if (obj) return { id: obj[1], kinds: ['objective'], shape: 'objective correlation id' };
+  if (UUID.test(id)) return { id, kinds: ['receipt', 'inbox'], shape: 'UUID' };
+  if (ULID.test(id)) return { id: id.toUpperCase(), kinds: ['envelope', 'inbox', 'objective', 'run'], shape: 'ULID' };
+  if (SLUG.test(id)) return { id, kinds: ['agent', 'inbox'], shape: 'name' };
+  return { id, kinds: [], shape: 'unrecognised' };
+}
+
+const unwrap = (d, ...keys) => { for (const k of keys) if (d && d[k] && typeof d[k] === 'object') return d[k]; return d; };
+
+/**
+ * One fetcher per kind on a CLI client. Each resolves to the object or throws the client's error
+ * (with .status). orgId: a function returning the org the caller is acting in (the window org in the TUI).
+ */
+export function createPeekFetchers({ client, orgId }) {
+  const org = () => { const o = typeof orgId === 'function' ? orgId() : orgId; return typeof o === 'string' && o ? o : null; };
+  const get = (name, params, opts = {}) => { const ep = resolveEndpoint(name, params); return client.get(ep.path, { service: ep.service, retries: 0, timeout: 25000, ...opts }); };
+  const needOrg = () => { const o = org(); if (!o) { const e = new Error('no org on this login'); e.status = 0; throw e; } return o; };
+  return {
+    envelope: async (id) => unwrap(await get('aee.get', { id: encodeURIComponent(id) }), 'envelope'),
+    inbox: async (id) => unwrap(await get('inbox.get', { orgId: needOrg(), itemId: encodeURIComponent(id) }), 'item'),
+    objective: async (id) => unwrap(await get('objectives.get', { id: encodeURIComponent(id) }), 'objective', 'data'),
+    run: async (id) => {
+      try { return unwrap(await get('executions.get', { executionId: encodeURIComponent(id) }), 'data', 'execution'); }
+      catch (e) { if (e?.status !== 404) throw e; }
+      return unwrap(await get('runs.get', { orgId: needOrg(), pollRunId: encodeURIComponent(id) }), 'run', 'data');
+    },
+    receipt: async (id) => unwrap(await get('ward.entries.get', { id: encodeURIComponent(id) }), 'entry'),
+    agent: async (id) => {
+      try { return unwrap(await get('agents.get', { orgId: needOrg(), agentId: encodeURIComponent(id) }), 'agent'); }
+      catch (e) { if (e?.status !== 404) throw e; }
+      const reg = await get('v1.agents.registry', {});
+      const hit = (reg?.agents || []).find(r => r.agent_id === id || String(r.name || '').toLowerCase() === id.toLowerCase());
+      if (!hit) { const e = new Error('Agent not found'); e.status = 404; throw e; }
+      return { ...hit, source: 'registry' };
+    },
+  };
+}
+
+const failText = (e) => {
+  if (e?.status === 404) return 'not found';
+  if (e?.status === 401 || e?.status === 403) return `HTTP ${e.status} (not allowed for this login)`;
+  if (e?.status) return `HTTP ${e.status}${e.message ? `: ${String(e.message).slice(0, 80)}` : ''}`;
+  return String(e?.message || 'failed').slice(0, 80);
+};
+
+/**
+ * Ask every candidate kind at once; the first hit in shape order wins, other hits are named.
+ * -> { id, shape, hit: { kind, data } | null, also: [kind], tried: [{ kind, result }] }
+ */
+export async function peekId(raw, fetchers) {
+  const { id, kinds, shape } = idShapes(raw);
+  const settled = await Promise.all(kinds.map(async (kind) => {
+    try {
+      const data = await fetchers[kind](id);
+      if (data == null || (typeof data === 'object' && !Object.keys(data).length)) return { kind, result: 'empty answer' };
+      return { kind, data };
+    } catch (e) { return { kind, result: failText(e) }; }
+  }));
+  const hits = settled.filter(s => 'data' in s);
+  return {
+    id, shape,
+    hit: hits[0] ? { kind: hits[0].kind, data: hits[0].data } : null,
+    also: hits.slice(1).map(s => s.kind),
+    tried: settled.map(s => ({ kind: s.kind, result: 'data' in s ? 'found' : s.result })),
+  };
+}
+
+const s = (v) => (v == null || v === '' ? null : String(v));
+const short = (v, n = 16) => { const t = s(v); return t && t.length > n ? `${t.slice(0, n)}…` : t; };
+const when = (v) => { const t = s(v); return t ? t.replace('T', ' ').replace(/\.\d+Z$/, 'Z') : null; };
+const parse = (v) => { if (v && typeof v === 'object') return v; try { return JSON.parse(v); } catch { return null; } };
+
+export const MORE = { envelope: (id) => `quox aee get ${id}`, inbox: (id) => `quox inbox get ${id}`, objective: (id) => `quox objective get ${id}`, run: (id) => `quox run get ${id}`, receipt: () => 'quox governance ward entries', agent: (id) => `quox agent get ${id}` };
+
+/** kind -> data -> [[label, value|null]]: the card fields, shared by peekLines and the TUI card. */
+export const ROWS = {
+  envelope: (d) => [['intent', s(d.intent)], ['from', s(d.from) && `${d.from} → ${d.to || '?'}`], ['type', s(d.type)], ['corr', s(d.corr)], ['at', when(d.ts || d.timestamp)]],
+  inbox: (d) => { const p = parse(d.payload_json) || {}; return [['title', s(d.title)], ['kind', s(d.kind)], ['status', [d.status, d.priority && `${d.priority} priority`].filter(Boolean).join(', ') || null], ['from', s(p.agent || p.session || p.source || d.created_by)], ['created', when(d.created_at)]]; },
+  objective: (d) => [['title', s(d.title)], ['status', s(d.status)], ['tasks', d.task_count != null ? `${d.tasks_completed ?? 0} of ${d.task_count} done${d.tasks_failed ? `, ${d.tasks_failed} failed` : ''}` : null], ['team', s(d.team_id)], ['created', when(d.created_at)]],
+  run: (d) => [['workflow', s(d.workflowName || d.workflow_name || d.workflowId || d.workflow_id)], ['status', s(d.status)], ['trigger', s(d.triggerData?.trigger || d.trigger)], ['started', when(d.startedAt || d.started_at || d.createdAt || d.created_at)], ['finished', when(d.finishedAt || d.completedAt || d.completed_at)]],
+  receipt: (d) => [['chain', d.chain_id ? `${d.chain_id} #${d.seq ?? '?'}` : null], ['witnessed', s(d.source_kind) && `${d.source_kind} ${d.source_id || ''}`.trim()], ['at', when(d.witnessed_at)], ['hash', short(d.chain_hash)]],
+  agent: (d) => [['name', s(d.name)], ['role', [d.role, d.level != null && `level ${d.level}`].filter(Boolean).join(', ') || null], ['about', s(d.description)], ['tools', d.tool_count != null ? String(d.tool_count) : null], ['source', s(d.source)]],
+};
+
+/**
+ * Plain lines for a peek result: [{ text, tone }] (tone ok | warn | dim | null). Width-agnostic; the caller clips.
+ */
+export function peekLines(r) {
+  if (!r) return [];
+  if (!r.hit) {
+    if (r.shape === 'empty') return [{ text: 'Usage: peek <id>. An envelope, inbox item, objective, workflow run, WARD receipt or agent id.', tone: 'warn' }];
+    if (!r.tried.length) return [{ text: `"${r.id}" does not look like any id Quox issues (envelope, inbox item, objective, run or agent ULID, WARD receipt UUID, agent name). Nothing was looked up.`, tone: 'warn' }];
+    return [
+      { text: `Nothing found for ${r.id}.`, tone: 'warn' },
+      { text: `Tried (${r.shape}): ${r.tried.map(t => `${KIND_LABEL[t.kind]} ${t.result}`).join(' · ')}`, tone: 'dim' },
+    ];
+  }
+  const { kind, data } = r.hit;
+  const out = [{ text: `◇ ${KIND_LABEL[kind]} ${r.id}`, tone: 'ok' }];
+  for (const [k, v] of ROWS[kind](data || {})) if (v) out.push({ text: `  ${k.padEnd(9)} ${v}`, tone: null });
+  if (r.also.length) out.push({ text: `  ${'also'.padEnd(9)} an id of the same value: ${r.also.map(k => KIND_LABEL[k]).join(', ')}`, tone: 'dim' });
+  out.push({ text: `  ${'more'.padEnd(9)} ${MORE[kind](r.id)}`, tone: 'dim' });
+  return out;
+}

package/lib/core/profileUsers.js

@@ -0,0 +1,51 @@
+/**
+ * #1034: which OTHER quox processes on this machine use a given CLI profile. `quox org switch` changes the shared
+ * profile's default org, so it names the sessions that will follow it (a TUI `/org switch` only moves its own window).
+ * Linux /proc only; elsewhere the answer is an empty list. Reads argv and the single QUOX_PROFILE env field, nothing else.
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+
+const isQuox = (a) => /(^|\/)quox(\.js|\.mjs)?$/.test(String(a || ''));
+
+/** The profile a process selected: a name, '' for "the config default", or null when it is not quox. */
+export function profileOf({ argv = [], env = {} }) {
+  const at = argv.slice(0, 2).findIndex(isQuox);
+  if (at < 0) return null;
+  const rest = argv.slice(at + 1);
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === '-p' || a === '--profile') return rest[i + 1] || '';
+    if (a.startsWith('--profile=')) return a.slice('--profile='.length);
+  }
+  return env.QUOX_PROFILE || '';
+}
+
+export function otherProfileUsers({ profile, defaultProfile, procs, selfPids = [] }) {
+  const self = new Set(selfPids);
+  return procs.filter(p => {
+    if (self.has(p.pid)) return false;
+    const sel = profileOf(p);
+    if (sel === null) return false;
+    return sel === profile || (sel === '' && profile === defaultProfile);
+  });
+}
+
+/** Live processes of this user: [{ pid, argv, env: { QUOX_PROFILE? } }]. */
+export function listProcs(root = '/proc') {
+  let dirs;
+  try { dirs = readdirSync(root).filter(d => /^\d+$/.test(d)); } catch { return []; }
+  const out = [];
+  for (const d of dirs) {
+    try {
+      const argv = readFileSync(`${root}/${d}/cmdline`, 'utf8').split('\0').filter(Boolean);
+      if (!argv.slice(0, 2).some(isQuox)) continue;
+      let env = {};
+      try {
+        const line = readFileSync(`${root}/${d}/environ`, 'utf8').split('\0').find(l => l.startsWith('QUOX_PROFILE='));
+        if (line) env = { QUOX_PROFILE: line.slice('QUOX_PROFILE='.length) };
+      } catch { /* not ours to read */ }
+      out.push({ pid: Number(d), argv, env });
+    } catch { /* exited */ }
+  }
+  return out;
+}

package/lib/core/promptCancel.js

@@ -0,0 +1,18 @@
+/**
+ * #1101: Ctrl-C (or a closed stdin) at an inquirer prompt rejects with ExitPromptError
+ * ("User force closed the prompt with SIGINT"). That is the user leaving, not a crash: say so in one word,
+ * put the cursor back, and exit 130 instead of printing a raw Error line.
+ */
+export const PROMPT_CANCELLED = 'Cancelled.';
+
+export function isPromptCancel(err) {
+  if (!err) return false;
+  return err.name === 'ExitPromptError' || /User force closed the prompt/.test(String(err.message || ''));
+}
+
+export function exitOnPromptCancel(err, { stderr = process.stderr, exit = process.exit } = {}) {
+  if (!isPromptCancel(err)) return false;
+  try { stderr.write(`\x1b[?25h\n${PROMPT_CANCELLED}\n`); } catch { /* the exit still happens */ }
+  exit(130);
+  return true;
+}

package/lib/core/repoPath.js

@@ -0,0 +1,11 @@
+// Repo-relative path normaliser for loosening asks. Keep in step with services/auth/lib/repoPath.js and
+// scripts/guards/check-test-loosening.mjs (cli/test/core/repoPath.test.js asserts all three agree).
+// "<anywhere>/quox-dashboard-wt-x/cli/a.test.js" -> "cli/a.test.js"; "./cli/a.test.js" -> "cli/a.test.js".
+export function toRepoRelative(p) {
+  let s = String(p ?? '').trim().replace(/\\/g, '/');
+  s = s.replace(/^(?:.*?\/)?quox-dashboard(?:-wt-[^/]+)?\//, '');
+  s = s.replace(/^(?:\.\/)+/, '').replace(/^\/+/, '');
+  return s;
+}
+
+export const LOOSENING_HINT = 'quox ask loosening --paths <repo-relative test files...> --justify "<why it is safe, plain words>"';

package/lib/core/residentSeed.js

@@ -53,10 +53,12 @@ function oneLine(text) {
 }
 
 function builtInTemplate({ hostId, slotName }) {
+  // #1021: Claude names a project dir by its path with separators turned into '-'.
+  const projectDirName = (process.env.QUOX_HOST_HOME || homedir()).replace(/[\\/]/g, '-');
   const claimCmd = `quox slot checkout ${slotName} --session resident-${slotName} --kind interactive --host ${hostId} --create`;
   return (
     `You are the resident Claude session for host ${hostId} (slot ${slotName}). ` +
-    `Before doing anything else: read ~/.claude/projects/-home-control/memory/MEMORY.md and every ` +
+    `Before doing anything else: read ~/.claude/projects/${projectDirName}/memory/MEMORY.md and every ` +
     `memory file it indexes, then read ~/NOTES_TO_SELF.md if it exists, then read any identity or ` +
     `onboarding docs in your home directory for this host. Read all of it before you act on anything. ` +
     `Once you have read everything, claim your slot with: ${claimCmd}. ` +

package/lib/core/rootOptions.js

@@ -0,0 +1,39 @@
+/**
+ * The root `quox` program's global options, in one place so the binary
+ * (bin/quox.js) and the safety-flag test (test/safetyFlagsReachLeaf.test.js)
+ * build the SAME root. A test that re-typed this list would pass against a
+ * root the binary does not have.
+ */
+import { mergeShadowedGlobals, assertDryRunHonoured } from './global-flags.js';
+
+export function applyRootOptions(program) {
+  return program
+    .option('-o, --output <format>', 'output format: table, json, csv, quiet', 'table')
+    .option('--json', 'shorthand for --output json')
+    .option('-q, --quiet', 'suppress output, show IDs only')
+    .option('--org <slug|id>', 'override active organization (slug, name or ID; must match your session org)')
+    .option('-p, --profile <name>', 'use a specific config profile')
+    .option('--no-color', 'disable colored output')
+    .option('-v, --verbose', 'show detailed output')
+    .option('--debug', 'show HTTP request/response details')
+    .option('--dry-run', 'show what would happen without executing')
+    .option('-y, --yes', 'skip confirmation prompts')
+    .option('--insecure', 'allow self-signed SSL certificates');
+}
+
+/**
+ * The flag-delivery hooks every invocation needs, in order:
+ *  1. a value typed on the root or on a parent group reaches the leaf that
+ *     declared the same option (commander binds it to the first command that
+ *     knows it, so the leaf would otherwise read undefined or its default);
+ *  2. a --dry-run the leaf cannot honour is refused before anything runs.
+ */
+export function installFlagDeliveryHooks(program) {
+  program.hook('preAction', (thisCommand, actionCommand) => {
+    mergeShadowedGlobals(thisCommand, actionCommand);
+  });
+  program.hook('preAction', (thisCommand, actionCommand) => {
+    assertDryRunHonoured(thisCommand, actionCommand);
+  });
+  return program;
+}

package/lib/core/router.js

@@ -0,0 +1,168 @@
+/**
+ * ROUTEROS-WIRE: engine for `quox router`, the read-only MikroTik RouterOS views.
+ *
+ * Every verb is one NETWATCH tool run through the governed tool route
+ * (POST /api/v1/tools/execute, agent_id netwatch). The collector's mikrotikExecutor
+ * reaches the org's configured router through the allowlisted RouterOS proxy; nothing
+ * here talks to a router directly and no verb writes. Formatters are pure so the human
+ * output is tested without a router.
+ */
+import { resolveEndpoint } from '../api/endpoints.js';
+
+/** verb -> the tool it runs. All read-only (aoclClassification layer 1, autonomy FULL). */
+export const ROUTER_TOOLS = Object.freeze({
+  health: 'mikrotik_monitoring_health',
+  leases: 'mikrotik_dhcp_leases',
+  pools: 'mikrotik_dhcp_pool_status',
+  conflicts: 'mikrotik_dhcp_conflict_check',
+  'free-ip': 'mikrotik_dhcp_find_free_ip',
+  vpn: 'mikrotik_vpn_health',
+  wireguard: 'mikrotik_vpn_wireguard_peers',
+  inventory: 'mikrotik_discovery_inventory',
+});
+
+export function makeRouterExec({ client, orgId }) {
+  return async function exec(tool, input = {}) {
+    const ep = resolveEndpoint('v1.tools.execute');
+    const body = { tool_name: tool, input, agent_id: 'netwatch' };
+    if (orgId) body.org_id = orgId;
+    const data = await client.post(ep.path, { service: ep.service, body });
+    if (data && data.success === false) {
+      const detail = data.detail ? ` (${data.detail})` : '';
+      const err = new Error(`${tool} via POST ${ep.path} returned success:false: ${data.error || 'unknown error'}${detail}`);
+      err.toolError = data.error || 'unknown error';
+      err.tool = tool;
+      throw err;
+    }
+    return routerPayload(data);
+  };
+}
+
+/** Unwrap the tool route envelope to the executor's own result object. */
+export function routerPayload(data) {
+  let p = data;
+  for (let i = 0; i < 3 && p && typeof p === 'object' && !Array.isArray(p); i++) {
+    const inner = ['result', 'output', 'data'].map((k) => p[k]).find((v) => v !== undefined && v !== null);
+    if (inner === undefined) break;
+    p = inner;
+  }
+  if (typeof p === 'string') { try { p = JSON.parse(p); } catch { /* keep text */ } }
+  if (p && typeof p === 'object' && p.success === false) {
+    const err = new Error(`router read failed: ${p.error || 'unknown error'}${p.detail ? ` (${p.detail})` : ''}`);
+    err.toolError = p.error;
+    throw err;
+  }
+  return p;
+}
+
+const dash = (v) => (v === null || v === undefined || v === '' ? '-' : String(v));
+const mib = (b) => (b === null || b === undefined ? '-' : `${Math.round(Number(b) / 1048576)} MiB`);
+const pad = (rows) => {
+  const w = [];
+  for (const r of rows) r.forEach((c, i) => { w[i] = Math.max(w[i] || 0, String(c).length); });
+  return rows.map((r) => r.map((c, i) => (i === r.length - 1 ? String(c) : String(c).padEnd(w[i]))).join('  ').trimEnd());
+};
+
+export function healthLines(p) {
+  const s = p.summary || {};
+  return [
+    `Router health score: ${dash(p.score)}/100`,
+    `CPU load:     ${s.cpu_load_pct === null || s.cpu_load_pct === undefined ? '-' : `${s.cpu_load_pct}%`}${s.cpu_count ? ` (${s.cpu_count} cpu)` : ''}`,
+    `Memory:       ${s.memory_used_pct === null || s.memory_used_pct === undefined ? '-' : `${s.memory_used_pct}% used`} (${mib(s.memory_free_bytes)} free of ${mib(s.memory_total_bytes)})`,
+    `Temperature:  ${s.temperature_c === null || s.temperature_c === undefined ? 'unknown (no sensor reported)' : `${s.temperature_c} C`}`,
+    `Uptime:       ${dash(s.uptime)}`,
+    `RouterOS:     ${dash(s.version)}  board ${dash(s.board_name)}  ${dash(s.architecture)}`,
+    ...(p.issues || []).map((i) => `! ${i}`),
+  ];
+}
+
+export function leaseLines(p) {
+  const rows = (p.leases || []).map((l) => [dash(l.address), dash(l['mac-address']), dash(l['host-name']), dash(l.status), l.dynamic === 'true' || l.dynamic === true ? 'dynamic' : 'static']);
+  return [`${p.total ?? rows.length} DHCP lease(s), ${p.bound ?? 0} bound`, ...(rows.length ? pad([['ADDRESS', 'MAC', 'HOST', 'STATUS', 'TYPE'], ...rows]) : [])];
+}
+
+export function poolLines(p) {
+  const rows = (p.pools || []).map((x) => [dash(x.name), dash(x.ranges), x.size, x.used, x.free, x.used_pct === null || x.used_pct === undefined ? '-' : `${x.used_pct}%`]);
+  return [
+    `${p.pool_count ?? rows.length} DHCP pool(s): ${p.total_used ?? 0} of ${p.total_size ?? 0} addresses used, ${p.total_avail ?? 0} free`,
+    ...(rows.length ? pad([['POOL', 'RANGES', 'SIZE', 'USED', 'FREE', 'USED%'], ...rows]) : []),
+  ];
+}
+
+export function conflictLines(p) {
+  const out = [p.plain_english || (p.healthy ? 'No IP address conflicts found.' : 'IP address conflicts found.')];
+  for (const c of p.conflicts || []) {
+    out.push(`  ${c.address}: ${(c.claims || []).map((k) => `${k.mac} (${(k.seen_in || []).join(', ')})`).join(' vs ') || (c.macs || []).join(' vs ')}`);
+  }
+  if (p.limits) out.push(`Limit: ${p.limits}`);
+  for (const i of p.issues || []) out.push(`! ${i}`);
+  return out;
+}
+
+export function freeIpLines(p) {
+  const ips = p.free_ips || [];
+  return [
+    `${ips.length} free address(es) in pool ${dash(p.pool_searched)} (checked against DHCP leases${p.arp_checked ? ' and ARP' : ', ARP unavailable'}). Nothing was reserved.`,
+    ...ips.map((f) => `  ${f.address}  (${dash(f.pool)})`),
+    ...(p.note ? [`! ${p.note}`] : []),
+  ];
+}
+
+function peerRow(x) {
+  return [dash(x.name || x.public_key), dash(x.interface), dash(x.endpoint), dash(x.allowed_address), dash(x.last_handshake), x.disabled ? 'disabled' : x.connected ? 'connected' : 'not connected'];
+}
+
+export function wireguardLines(p) {
+  const rows = (p.peers || []).map(peerRow);
+  return [
+    `${p.total ?? rows.length} WireGuard peer(s), ${p.connected ?? 0} connected`,
+    ...(rows.length ? pad([['PEER', 'IFACE', 'ENDPOINT', 'ALLOWED', 'HANDSHAKE', 'STATE'], ...rows]) : []),
+    ...(p.connected_rule ? [`Rule: ${p.connected_rule}`] : []),
+  ];
+}
+
+export function vpnLines(p) {
+  const h = p.health || {};
+  const out = [p.plain_english || `${p.tunnels_up ?? 0} of ${p.tunnels_total ?? 0} VPN tunnel(s) up.`, `Score: ${p.score === null || p.score === undefined ? '- (no tunnels)' : `${p.score}/100`}`];
+  for (const x of h.wireguard || []) out.push(`  wg peer ${peerRow(x)[0]}: ${peerRow(x)[5]} (handshake ${dash(x.last_handshake)})`);
+  for (const x of h.ipsec || []) out.push(`  ipsec ${dash(x.remote_address)}: ${dash(x.state)}, up ${dash(x.uptime)}`);
+  for (const i of p.issues || []) out.push(`! ${i}`);
+  return out;
+}
+
+export function inventoryLines(p) {
+  const routers = (p.routers || []).map((r) => [dash(r.identity || [r.platform, r.board_name].filter(Boolean).join(' ')), dash(r.role), dash(r.address), dash(r.version), dash(r.board_name)]);
+  const devices = (p.devices || []).map((d) => [dash(d.address), dash(d.mac), dash(d.host_name), dash(d.interface), d.seen_in_arp ? 'arp' : 'lease only']);
+  return [
+    `${p.router_count ?? routers.length} MikroTik router(s)`,
+    ...pad([['ROUTER', 'ROLE', 'ADDRESS', 'VERSION', 'BOARD'], ...routers]),
+    `${p.total ?? devices.length} connected device(s)`,
+    ...(devices.length ? pad([['ADDRESS', 'MAC', 'HOST', 'IFACE', 'SEEN'], ...devices]) : []),
+  ];
+}
+
+export const ROUTER_FORMATTERS = Object.freeze({
+  health: healthLines, leases: leaseLines, pools: poolLines, conflicts: conflictLines,
+  'free-ip': freeIpLines, vpn: vpnLines, wireguard: wireguardLines, inventory: inventoryLines,
+});
+
+/** `quox router trust --show`: the fingerprint to compare out of band. Pure. */
+export function formatTrust(d) {
+  if (!d || d.success === false) {
+    return [`Could not read the router certificate: ${(d && (d.error || d.detail)) || 'unknown error'}`, 'No credentials were sent.'];
+  }
+  const lines = [
+    `Router endpoint: ${d.host}:${d.port}`,
+    `Certificate SHA-256: ${d.cert_sha256_formatted}`,
+    `Public key SHA-256:  ${d.spki_sha256_formatted}`,
+    `Subject: ${d.subject ? String(d.subject).replace(/\n/g, ', ') : '-'}`,
+    `Issuer:  ${d.issuer ? String(d.issuer).replace(/\n/g, ', ') : '-'}${d.self_signed ? ' (self-signed)' : ''}`,
+    `Valid until: ${d.valid_to || '-'}`,
+    d.pin_configured
+      ? (d.matches_configured_pin ? 'MIKROTIK_TLS_PIN is set and MATCHES this endpoint.' : 'MIKROTIK_TLS_PIN is set and does NOT match this endpoint. Do not trust it until you know why.')
+      : 'MIKROTIK_TLS_PIN is not set, so the collector sends nothing to this router yet.',
+    'No credentials were sent. Nothing was pinned.',
+    'Compare the fingerprint with the one on the router itself (System > Certificates) over a channel you trust, then set MIKROTIK_TLS_PIN to the SHA-256 value.',
+  ];
+  return lines;
+}