quoxcli 0.2.0 → 0.3.1

package/lib/quoxon/connect.js

@@ -13,6 +13,12 @@
  * the composer buffer or history, never sent to the chat stream, never written to a transcript.
  */
 
+import { askText } from './ask.js';
+import { consentCovers, connectConsentNote, needsConsent, providerLabel } from './consent.js';
+import { providerState, SUBSCRIPTION_NAME } from './providers.js';
+import { isLoopbackUrl, detectLanIp } from './hostUrls.js';
+import { cmd } from './palette.js';
+
 export const PROVIDERS = {
   openai: {
     id: 'openai', type: 'openai', name: 'OpenAI', field: 'api_key', card: true, minLen: 20,
@@ -41,14 +47,14 @@ export const PROVIDERS = {
     id: 'custom', type: 'openai_compatible', name: 'Custom', field: 'api_key', card: false, url: true, custom: true, minLen: 8,
     why: 'This endpoint wants an API key. It is stored in your org vault with the base URL.',
     keyUrl: 'the provider of that endpoint',
-    disclosure: 'Custom endpoint: your prompts and tool results leave this server for that URL. Unless it is your own server, that is a third party. Your org\'s AI data sharing consent applies.'
+    disclosure: 'Custom endpoint: your prompts and tool results leave this server for that URL. Unless it is your own server, that is a third party. Your own AI data sharing consent applies (/consent).'
   }
 };
 function hosted(id, name, field, keyUrl, who) {
   return {
     id, type: id, name, field, card: true, hosted: true, minLen: 20, keyUrl,
     why: `Quox needs a ${name} key to use ${name} models for your org.`,
-    disclosure: `Hosted: your prompts and tool results leave this server for ${who}. Your org's AI data sharing consent applies.`
+    disclosure: `Hosted: your prompts and tool results leave this server for ${who}. Your own AI data sharing consent applies (/consent).`
   };
 }
 function selfHosted(id, name, port) {
@@ -115,10 +121,11 @@ export const pickRow = (rows, type) => {
 };
 
 /**
- * -> [[text, tone?]] lines for /connect. `res` is { ok:true, rows } from the vault list, or
- * { ok:false, error }. Only the org vault is readable by a user; anything it cannot answer is "? unknown".
+ * -> [[text, tone?]] lines for /connect. `res` is { ok:true, rows } from the vault list, or { ok:false, error };
+ * `caps` is the server's capabilities answer, the source of truth for whether each provider is usable
+ * (providers.js, shared with /model and /doctor). Anything neither can answer is "? unknown".
  */
-export function connectionLines(res) {
+export function connectionLines(res, caps = null) {
   const STATUS_PROVIDERS = [PROVIDERS.openai, PROVIDERS.anthropic, PROVIDERS.ollama, PROVIDERS.openrouter, PROVIDERS.huggingface, PROVIDERS.groq, PROVIDERS.together, PROVIDERS.lmstudio, PROVIDERS.vllm, PROVIDERS.custom];
   const out = [];
   const ok = res && res.ok && Array.isArray(res.rows);
@@ -126,13 +133,19 @@ export function connectionLines(res) {
   out.push(['Connections for this org:']);
   for (const p of STATUS_PROVIDERS) {
     const hint = p.custom ? '/connect custom https://<host>/v1' : p.card ? `/connect ${p.id}` : p.url ? `/connect ${p.id} http://<host>:${p.port || 11434}` : `quox vault create --type ${p.type}`;
-    if (!ok) { out.push([`? ${p.name}  unknown (vault not readable)`, 'warn']); continue; }
-    const { def, any } = pickRow(rows, p.type);
-    if (def) out.push([`● ${p.name}  connected · ${def.label || def.id} · ${testTag(def)}`, def.test_status === 'failed' ? 'warn' : 'ok']);
-    else if (any) out.push([`◐ ${p.name}  stored but not the default · quox vault set-default ${any.id}`, 'warn']);
+    const st = providerState({ cap: p.id, vault: p.type }, caps, res);
+    const def = st.row;
+    if (st.state === 'unknown') out.push([`? ${p.name}  unknown (vault not readable)`, 'warn']);
+    else if (st.state === 'connected' && def) out.push([`● ${p.name}  connected · ${def.label || def.id} · ${testTag(def)}`, def.test_status === 'failed' ? 'warn' : 'ok']);
+    else if (st.state === 'connected') out.push([`● ${p.name}  ready on this server (an instance-wide key, not in your org vault)`, 'ok']);
+    else if (st.state === 'stored') out.push([`◐ ${p.name}  stored but not the default · quox vault set-default ${st.row.id}`, 'warn']);
+    else if (st.state === 'unavailable') out.push([`○ ${p.name}  not available here${st.reason ? `: ${st.reason}` : ''}`]);
     else out.push([`○ ${p.name}  not connected · ${hint}`]);
   }
-  out.push(['? Claude (subscription)  unknown · this server has no status route for it']);
+  const sub = providerState({ cap: 'claude_subscription' }, caps, res);
+  if (sub.state === 'connected') out.push([`● ${SUBSCRIPTION_NAME}  ready on this server · /model claude-cli`, 'ok']);
+  else if (sub.state === 'unknown') out.push([`? ${SUBSCRIPTION_NAME}  unknown (the server did not say)`, 'warn']);
+  else out.push([`○ ${SUBSCRIPTION_NAME}  ${sub.reason || 'not signed in on this server'} · sign in from the dashboard Terminal`]);
   if (!ok) { out.push([`  could not read the vault: ${res?.error || 'no answer'}`, 'warn']); return out; }
   const known = new Set(Object.values(PROVIDERS).map(p => p.type));
   const others = new Map();
@@ -210,6 +223,9 @@ export async function connectFlow(api, providerId, secret, extra) {
   return { ok: true, provider: p.id, last4, text: `✔ ${p.name} connected · key …${last4} · tested`, ...(p.disclosure ? { disclosure: p.disclosure } : {}) };
 }
 
+/** QUOXON-Z2H lane R: the one consent question asked after a cloud connect. Default No: cloud processing stays opt-in. */
+export const consentAskLine = (type) => askText(`Allow Quox to send your conversations to ${providerLabel(type)}?`, { keys: 'y/N', who: 'Quox', action: `send your messages and any tool results to ${providerLabel(type)}, a third party, when it answers`, reason: 'Nothing is sent until you say yes; withdraw it any time in Settings > Privacy.' }) // no consent yet: nothing to chat with;
+
 // ---- card controller ---------------------------------------------------------------------------
 /**
  * Owns the open card and its secret box. The app routes every input event here while the card is
@@ -233,11 +249,64 @@ export function createConnectController({ api, note, emit, refresh }) {
       note(r.text, 'ok');
       if (r.disclosure) note(r.disclosure, 'warn');
       note('Your next turns can use it. Servers cache keys briefly, so allow up to a minute.');
+      await askConsent(p.type); // never meet the consent error cold: ask now, once
       return;
     }
     card.phase = 'input'; card.error = r.text; refresh();
   }
+  /**
+   * QUOXON-Z2H lane R: when `type` is a cloud provider and this user's OK is not in place, open the card on
+   * the consent question. y records it (the user's own direct act, POST /api/consent); anything else leaves
+   * it off and says how to give it later. -> true when the question opened.
+   */
+  async function askConsent(type) {
+    if (!needsConsent(type) || !api.consentStatus) return false;
+    let rec = null; try { rec = await api.consentStatus(); } catch { rec = null; }
+    if (consentCovers(rec, type)) return false;
+    if (!api.grantConsent) { note(connectConsentNote(type), 'warn'); return false; }
+    box.clear();
+    card = { provider: providerFor(type) || Object.values(PROVIDERS).find((x) => x.type === type) || { id: type, type, name: providerLabel(type) }, phase: 'consent', consentType: type, error: null, question: consentAskLine(type) };
+    refresh();
+    return true;
+  }
+  async function answerConsent(yes) {
+    const type = card.consentType;
+    if (!yes) { close(); note(`Left off: nothing goes to ${providerLabel(type)} until you say so. ${connectConsentNote(type)}`, 'warn'); return; }
+    card.phase = 'saving'; refresh();
+    try {
+      await api.grantConsent(type);
+      close(); note(`✔ Your OK is recorded: ${providerLabel(type)} can now answer. Withdraw it any time: quox consent list, or Settings > Privacy.`, 'ok');
+    } catch (e) {
+      close(); note(`Quox could not record your OK (${e?.message || e}). Nothing was sent. Try /consent grant ${type}.`, 'warn');
+    }
+  }
+  /**
+   * #1288: "Connect to <host>? It's on your private network." y/N. y runs offer.retry() (the save with a
+   * confirm for that exact origin) and hands its result to after(); n, Enter or Esc saves nothing.
+   */
+  function askPrivate(offer, after) {
+    box.clear();
+    card = {
+      provider: PROVIDERS.ollama || { id: 'ollama', type: 'ollama', name: 'Ollama' },
+      phase: 'private', error: null, privateOffer: offer, privateAfter: after,
+      question: askText(`Connect to ${offer.host}?`, { keys: 'y/N', who: 'Quox', reason: "It's on your private network", action: `save ${offer.origin} as your org's Ollama. Only this address is allowed, after the server checks it answers as Ollama. Needs an org admin.` })
+    };
+    refresh();
+    return true;
+  }
+  async function answerPrivate(yes) {
+    const { privateOffer: offer, privateAfter: after } = card;
+    if (!yes) { close(); note(`Left blocked: ${offer.host} was not connected. Nothing was saved.`); return; }
+    card.phase = 'saving'; refresh();
+    let r;
+    try { r = await offer.retry(); } catch (e) { r = { ok: false, lines: [[`✖ ${e?.message || e}. Nothing was saved.`, 'warn']] }; }
+    close();
+    for (const [t, tone] of r.lines || []) note(t, tone);
+    if (after) await after(r);
+  }
   return {
+    askConsent,
+    askPrivate,
     isOpen: () => Boolean(card),
     view: () => (card ? { card: { ...card }, mask: box.mask() } : null),
     /** -> true when a card opened. */
@@ -263,6 +332,16 @@ export function createConnectController({ api, note, emit, refresh }) {
     onEvent(e) {
       if (!card) return false;
       if (card.phase === 'saving') return true;
+      if (card.phase === 'private') {
+        if (e.type === 'text' && /^y(es)?$/i.test(String(e.text).trim())) { answerPrivate(true); return true; }
+        if ((e.type === 'text' && /^n(o)?$/i.test(String(e.text).trim())) || (e.type === 'key' && ['enter', 'escape', 'ctrl-c'].includes(e.name))) { answerPrivate(false); return true; }
+        return true; // the question takes only y or n
+      }
+      if (card.phase === 'consent') {
+        if (e.type === 'text' && /^y(es)?$/i.test(String(e.text).trim())) { answerConsent(true); return true; }
+        if ((e.type === 'text' && /^n(o)?$/i.test(String(e.text).trim())) || (e.type === 'key' && ['enter', 'escape', 'ctrl-c'].includes(e.name))) { answerConsent(false); return true; }
+        return true; // the question takes only y or n
+      }
       if (e.type === 'paste') { box.paste(e.text); card.error = null; refresh(); return true; }
       if (e.type === 'text') { box.type(e.text); card.error = null; refresh(); return true; }
       if (e.type !== 'key') return true;
@@ -275,6 +354,61 @@ export function createConnectController({ api, note, emit, refresh }) {
   };
 }
 
+
+// ---- private-network refusal: explain it, offer the instance gate, retry once --------------------
+/** The vault refused the base URL because the address is private (HTTP 400, SSRF guard). */
+export const isPrivateNetworkError = (s) => s?.status === 400 && /private|internal/i.test(s?.message || '');
+
+const WHO_CAN = [
+  'Only an instance admin can allow this. Ask one to run:',
+  '  quox server config lan-targets on'
+];
+
+/**
+ * The save failed because the address is on a private network. -> { ok:false, lines, lanOffer? }.
+ * An admin gets a card and { lanOffer } (the app keeps it for "/connect yes"); anyone else is told
+ * who can. `retry` re-runs the same connect once the gate is on.
+ */
+/** The true scope of a saved private address: the instance gate is server-wide, not per connection. */
+function privateScopeNote(origin) {
+  return [
+    [`  ${origin} is a private address. This Quox server allows private-network`],
+    ['  addresses for AI and monitoring connections. Turn off: quox server config lan-targets off']
+  ];
+}
+
+export async function lanGateCard(api, name, retry, { retried } = {}) {
+  const lines = [[`✖ ${name} is on a private network, so Quox did not save it.`, 'warn']];
+  const st = api.lanTargets ? await api.lanTargets() : null;
+  if (retried || st?.enabled) {
+    lines.push(['  Private-network targets are already on, so Quox still refuses this address.']);
+    lines.push(['  Loopback and link-local addresses are always blocked. Use the machine\'s LAN address.']);
+    return { ok: false, lines };
+  }
+  lines.push(['  Quox blocks private addresses by default, so an AI cannot be pointed at internal services.']);
+  if (!api.setLanTargets || st?.status === 403) {
+    for (const l of WHO_CAN) lines.push([l, l.startsWith('  ') ? undefined : 'warn']);
+    return { ok: false, lines };
+  }
+  lines.push(['  Allowing it applies to every AI and monitoring connection on this Quox server,']);
+  lines.push(['  not just this one. Loopback and link-local stay blocked. Turn off later:']);
+  lines.push(['    quox server config lan-targets off']);
+  lines.push(['  Allow it and connect now? /connect yes   (leave it blocked: /connect no)', 'warn']);
+  return { ok: false, lines, lanOffer: { name, retry } };
+}
+
+/** "/connect yes": set the gate, then run the connect once more. Never offers a second time. */
+export async function confirmLanAllow(api, offer) {
+  if (!offer?.retry) return { ok: false, lines: [['Nothing to confirm. Run /connect again.', 'warn']] };
+  const set = await api.setLanTargets(true);
+  if (!set?.ok) {
+    if (set?.status === 403) return { ok: false, lines: [['✖ Only an instance admin can allow that. Nothing was changed.', 'warn'], ...WHO_CAN.map(l => [l])] };
+    return { ok: false, lines: [[`✖ Could not turn it on (${set?.status ? `HTTP ${set.status}: ` : ''}${set?.message || 'failed'}). Nothing was saved.`, 'warn']] };
+  }
+  const r = await offer.retry();
+  return { ...r, lines: [['✔ Private-network targets are on for this instance. Retrying…', 'ok'], ...r.lines] };
+}
+
 // ---- Ollama (B3): a server URL, no key -----------------------------------------------------------
 /** "/connect ollama <url> [model]" rest -> { url, model } ; a bare host gets http:// and :11434. */
 export function parseOllamaArg(rest) {
@@ -314,25 +448,64 @@ export function ollamaModelRows(models, current) {
   return out;
 }
 
+/**
+ * Z2H-R4: how to make Ollama listen on the network. The official Linux installer runs it as a systemd
+ * service on 127.0.0.1, so `OLLAMA_HOST=0.0.0.0 ollama serve` fails there ("address already in use");
+ * the service override comes first, the plain serve only for a non-service run.
+ */
+export const OLLAMA_LISTEN_LINES = [
+  'Linux (installed as a service): ' + cmd('sudo systemctl edit ollama'),
+  '  add under [Service]: ' + cmd('Environment="OLLAMA_HOST=0.0.0.0"'),
+  '  then: ' + cmd('sudo systemctl restart ollama'),
+  'Not a service: ' + cmd('OLLAMA_HOST=0.0.0.0 ollama serve')
+];
+
 export const OLLAMA_REACH_HINT = [
-  'On the Ollama machine: start it listening on the network, OLLAMA_HOST=0.0.0.0 ollama serve',
+  'On the Ollama machine, make it listen on the network:',
+  ...OLLAMA_LISTEN_LINES.map(l => `  ${l}`),
   'and allow port 11434 through its firewall. "localhost" is not reachable from the server; use the machine\'s LAN address.'
 ];
 
+/** Z2H-R3: the hint for a loopback Ollama URL, with this machine's LAN address filled in. */
+export function ollamaLoopbackHint(lan) {
+  return [
+    'The Quox server runs in Docker, so "localhost" there is the container, not this machine.',
+    'Make Ollama listen on the network:',
+    ...OLLAMA_LISTEN_LINES.map(l => `  ${l}`),
+    `Then connect with this machine's LAN address: ${cmd(`/connect ollama http://${lan}:11434`)}`
+  ];
+}
+
+/** Z2H-R4: bare /connect ollama, the whole setup from nothing, with this machine's LAN address filled in. */
+export function ollamaSetupCard(lan) {
+  return [
+    ['Ollama runs AI models on your own machine, no account or key. To set it up:'],
+    ['  1. Install it: ' + cmd('curl -fsSL https://ollama.com/install.sh | sh')],
+    ['  2. Get a model that can use tools: ' + cmd('ollama pull qwen2.5')],
+    ['  3. Let the Quox server reach it:'],
+    ...OLLAMA_LISTEN_LINES.map(l => [`     ${l}`]),
+    [`  4. Connect: ${cmd(`/connect ollama http://${lan}:11434`)}`],
+    ['     (Ollama on another machine? Use that machine\'s address.)']
+  ];
+}
+
 /**
  * Server-side probe (GET <url>/api/tags; human org admin; nothing stored), then the governed vault
  * write as the org default: { base_url, default_model, allow_private_origin? }. A private address is
  * allow-listed only for the exact origin probed. -> { ok, lines: [[text, tone?]] }
  */
-export async function connectOllamaFlow(api, rest) {
+export async function connectOllamaFlow(api, rest, { retried = false, confirmOrigin = null } = {}) {
   const { url, model } = parseOllamaArg(rest);
-  if (!url) return { ok: false, lines: [['Usage: /connect ollama http://<host>:11434 [model]', 'warn']] };
+  if (!url) return { ok: false, lines: ollamaSetupCard((api.lanIp ? api.lanIp() : detectLanIp()) || '<lan-ip>') };
   if (!api.ollamaProbe || !api.saveProviderKey) return { ok: false, lines: [['Connecting is not available in this mode.', 'warn']] };
   const p = await api.ollamaProbe(url);
   if (!p?.ok) {
     if (p?.status === 403) return { ok: false, lines: [['✖ Connecting Ollama needs an org admin. Nothing was saved.', 'warn']] };
     const lines = [[`✖ ${p?.message || 'Ollama could not be reached'}. Nothing was saved.`, 'warn']];
-    if (p?.error === 'ollama_unreachable' || p?.status === 502) for (const h of OLLAMA_REACH_HINT) lines.push([`  ${h}`]);
+    if (isLoopbackUrl(url)) { // Z2H-R3: the server is in Docker, so loopback is the container; give the exact command
+      const lan = (api.lanIp ? api.lanIp() : detectLanIp()) || '<lan-ip>';
+      for (const h of ollamaLoopbackHint(lan)) lines.push([`  ${h}`]);
+    } else if (p?.error === 'ollama_unreachable' || p?.status === 502) for (const h of OLLAMA_REACH_HINT) lines.push([`  ${h}`]);
     return { ok: false, lines };
   }
   const models = Array.isArray(p.models) ? p.models : [];
@@ -342,20 +515,32 @@ export async function connectOllamaFlow(api, rest) {
   }
   const credentials = { base_url: p.base_url, ...(def ? { default_model: def } : {}), ...(p.private ? { allow_private_origin: p.origin } : {}) };
   const label = `Ollama · ${p.host}`;
-  let s = await api.saveProviderKey({ type: 'ollama', label, credentials, isDefault: true });
+  const confirm = confirmOrigin ? { confirmPrivateOrigin: confirmOrigin } : {};
+  let s = await api.saveProviderKey({ type: 'ollama', label, credentials, isDefault: true, ...confirm });
   if (!s?.ok && s?.status === 409 && api.connections && api.updateProviderCredential) {
     // Same host connected before: refresh that credential (URL, default model, allowance) instead.
     const c = await api.connections();
     const row = c?.ok ? c.rows.find(r => r.integration_type === 'ollama' && r.label === label) : null;
-    s = row ? await api.updateProviderCredential({ id: row.id, credentials, isDefault: true }) : s;
+    s = row ? await api.updateProviderCredential({ id: row.id, credentials, isDefault: true, ...confirm }) : s;
+  }
+  if (!s?.ok && s?.confirmable && !confirmOrigin) {
+    // #1288: the server lets an org admin allow THIS one private address for their own Ollama. Ask y/N.
+    const origin = s.origin || p.origin;
+    return { ok: false, lines: [], privateAsk: { host: p.host, origin, retry: () => connectOllamaFlow(api, rest, { retried: true, confirmOrigin: origin }) } };
+  }
+  if (!s?.ok && confirmOrigin) {
+    return { ok: false, lines: [[`✖ Ollama at ${p.host} was not saved (${s?.status ? `HTTP ${s.status}: ` : ''}${s?.message || 'failed'}).`, 'warn']] };
+  }
+  if (!s?.ok && isPrivateNetworkError(s)) {
+    return lanGateCard(api, `Ollama at ${p.host}`, () => connectOllamaFlow(api, rest, { retried: true }), { retried });
   }
   if (!s?.ok) {
     const role = s?.status === 403 ? ' Storing org connections needs the secrets.write capability; ask an org admin.' : '';
-    const lan = s?.status === 400 && /private|internal/i.test(s?.message || '') ? ' This instance does not allow LAN integration targets yet; an operator enables allow_lan_integration_targets.' : '';
-    return { ok: false, lines: [[`✖ Ollama answered but the connection was not saved (${s?.status ? `HTTP ${s.status}: ` : ''}${s?.message || 'failed'}).${role}${lan}`, 'warn']] };
+    return { ok: false, lines: [[`✖ Ollama answered but the connection was not saved (${s?.status ? `HTTP ${s.status}: ` : ''}${s?.message || 'failed'}).${role}`, 'warn']] };
   }
   const lines = [[`✔ Ollama connected · ${p.host} · ${models.length} model${models.length === 1 ? '' : 's'}${def ? ` · default ${def}` : ''}`, 'ok']];
-  if (p.private) lines.push([`  ${p.origin} is a private address; it is allow-listed for this org's Ollama connection only.`]);
+  if (p.private && confirmOrigin) lines.push([`  ${confirmOrigin} is on your private network. Quox allows only this address, for this connection.`]);
+  else if (p.private) lines.push(...privateScopeNote(p.origin));
   if (!models.length) lines.push(['  No models installed yet. On that machine run: ollama pull qwen2.5', 'warn']);
   else {
     lines.push(...ollamaModelRows(models, def));
@@ -415,7 +600,7 @@ export function compatModelRows(models, current) {
  * { ok:false, needsKey:true, extra } so the app can open the key card carrying base_url.
  * -> { ok, lines: [[text, tone?]], needsKey?, extra? }
  */
-export async function connectCompatFlow(api, presetId, rest) {
+export async function connectCompatFlow(api, presetId, rest, { retried = false } = {}) {
   const p = PROVIDERS[presetId];
   if (!p?.url || p.id === 'ollama') return { ok: false, lines: [[`${presetId} cannot be connected by URL.`, 'warn']] };
   const { url, model, error } = parseCompatArg(p.id, rest);
@@ -453,13 +638,15 @@ export async function connectCompatFlow(api, presetId, rest) {
     const row = c?.ok ? c.rows.find(r => r.integration_type === p.type && r.label === label) : null;
     s = row ? await api.updateProviderCredential({ id: row.id, credentials, isDefault: true }) : s;
   }
+  if (!s?.ok && isPrivateNetworkError(s)) {
+    return lanGateCard(api, `${p.name} at ${pr.host}`, () => connectCompatFlow(api, presetId, rest, { retried: true }), { retried });
+  }
   if (!s?.ok) {
     const role = s?.status === 403 ? ' Storing org connections needs the secrets.write capability; ask an org admin.' : '';
-    const lan = s?.status === 400 && /private|internal/i.test(s?.message || '') ? ' This instance does not allow LAN integration targets yet; an operator enables allow_lan_integration_targets.' : '';
-    return { ok: false, lines: [[`✖ ${p.name} answered but the connection was not saved (${s?.status ? `HTTP ${s.status}: ` : ''}${s?.message || 'failed'}).${role}${lan}`, 'warn']] };
+    return { ok: false, lines: [[`✖ ${p.name} answered but the connection was not saved (${s?.status ? `HTTP ${s.status}: ` : ''}${s?.message || 'failed'}).${role}`, 'warn']] };
   }
   const lines = [[`✔ ${p.name} connected · ${pr.host} · ${models.length} model${models.length === 1 ? '' : 's'}${model ? ` · default ${model}` : ''}`, 'ok']];
-  if (pr.private && !p.custom) lines.push([`  ${pr.origin} is a private address; it is allow-listed for this org's ${p.name} connection only.`]);
+  if (pr.private && !p.custom) lines.push(...privateScopeNote(pr.origin));
   lines.push(p.custom ? [`  ${p.disclosure}`, 'warn'] : [`  ${SELF_HOSTED_NOTE}`]);
   lines.push(...compatModelRows(models, model));
   lines.push([`  Use it: /model ${p.id}${model ? '' : ' [model]'}`]);

package/lib/quoxon/connectCard.js

@@ -5,14 +5,31 @@
 import React from 'react';
 import { Box, Text } from 'ink';
 import { c, clip } from './theme.js';
-import { Rule } from './render.js';
+import { Rule, AskCard } from './render.js';
 
 const h = React.createElement;
 
-/** card: { provider: PROVIDERS entry, phase: 'input'|'saving', error?: string }, mask: string */
+/** card: { provider: PROVIDERS entry, phase: 'input'|'saving'|'consent', error?: string, question?: string }, mask: string */
 export function ConnectCard({ card, mask, cols }) {
   const p = card.provider;
   const w = Math.max(10, cols - 4);
+  // QUOXON-Z2H lane R: the one consent question after a cloud connect (y records the user's own OK).
+  if (card.phase === 'consent') return h(AskCard, { text: card.question, cols }); // QUOXON-ASK: the same card as an approval
+  // #1288: an org admin's own Ollama on a private address: y/N, then the save with a confirm for that origin.
+  if (card.phase === 'private') return h(AskCard, { text: card.question, cols });
+  if (card.phase === 'saving' && card.privateOffer) {
+    return h(Box, { flexDirection: 'column', width: cols, marginTop: 1 },
+      h(Text, { color: c('dim') }, clip(`  ◐ checking ${card.privateOffer.host} answers as Ollama, then saving…`, cols)));
+  }
+  if (card.phase === 'saving' && card.consentType) {
+    return h(Box, { flexDirection: 'column', width: cols, marginTop: 1 },
+      h(Rule, { cols, color: 'sky' }),
+      h(Text, { color: c('sky'), bold: true }, clip(`Ⓠ ${p.name} is connected · one question`, cols)),
+      h(Text, { color: c('text'), wrap: 'wrap' }, `  Your messages and any tool results go to ${p.name}, a third party, when it answers. Nothing is sent until you say yes. You can withdraw this any time (Settings > Privacy).`),
+      h(Text, { color: c('warn'), bold: true }, clip(`  ${card.question}`, cols)),
+      h(Text, { color: c('text') }, card.phase === 'saving' ? clip('  ◐ recording your OK…', cols) : clip('  y yes · n or Enter no · Esc no', cols)),
+      h(Rule, { cols, color: 'sky' }));
+  }
   return h(Box, { flexDirection: 'column', width: cols, marginTop: 1 },
     h(Rule, { cols, color: 'sky' }),
     h(Text, { color: c('sky'), bold: true }, clip(`Ⓠ Connect ${p.name}${card.subtitle ? ` · ${card.subtitle}` : ''} · goes straight to your org vault, never into chat`, cols)),

package/lib/quoxon/consent.js

@@ -0,0 +1,86 @@
+/**
+ * QUOXON-CONSENT: AI data sharing consent, in words a stuck user can act on.
+ * Consent is PERSONAL (one record per user, POST /api/consent), so the person typing grants it; no admin is
+ * involved. Cloud providers that receive the conversation need it; a local model (Ollama) never does.
+ * This file only words things and shapes the two API calls. The gate itself is the server's.
+ */
+export const PRIVACY_PATH = '/settings#privacy';
+const LABELS = { openai: 'OpenAI', perplexity: 'Perplexity', gemini: 'Google Gemini', google: 'Google', openrouter: 'OpenRouter', huggingface: 'Hugging Face', groq: 'Groq', together: 'Together AI', openai_compatible: 'your custom hosted endpoint' };
+export const providerLabel = (p) => LABELS[String(p || '').toLowerCase()] || (p ? String(p) : 'your cloud AI provider');
+
+// Keep in step with services/collector/lib/consentVerification.js THIRD_PARTY_PROVIDERS. Anthropic and local models are not in it.
+export const CONSENT_PROVIDERS = ['openai', 'perplexity', 'gemini', 'google', 'openrouter', 'huggingface', 'groq', 'together', 'openai_compatible'];
+export const needsConsent = (type) => CONSENT_PROVIDERS.includes(String(type || '').toLowerCase());
+
+export const isConsentError = (ev) => ev?.type === 'error' && ev?.error === 'ai_consent_required';
+
+/** The one-line headline for the error block (the card's first line). */
+export function consentErrorText(ev) {
+  if (ev?.retryable) return 'Quox could not check your AI data sharing consent just now, so nothing was sent. Try again in a moment.';
+  return `Quox needs your OK before sending this conversation to ${providerLabel(ev?.provider)}.`;
+}
+
+/** The lines under the headline: what is shared, how to grant it, the local alternative, the dashboard link. Short lines, no clipping. */
+export function consentHintLines(ev, dashboardBase) {
+  if (ev?.retryable) return [];
+  const who = providerLabel(ev?.provider);
+  const prov = ev?.provider || '<provider>';
+  const why = ev?.reason === 'consent_expired' ? 'Your earlier OK is out of date and needs renewing.'
+    : ev?.reason === 'provider_blocked' ? `You have blocked ${who} in your privacy settings; granting turns it back on.` : null;
+  const lines = [];
+  if (why) lines.push(why);
+  lines.push(`Shared: your messages and any tool results go to ${who}, a third party. Nothing was sent.`);
+  lines.push('Grant it: /consent grant (records your OK and sends this message again), or quox consent grant --provider ' + prov + ' in a shell.');
+  lines.push('Consent is personal, so you can give it yourself; no admin is needed.');
+  if (dashboardBase) lines.push(`Or in the dashboard: ${String(dashboardBase).replace(/\/$/, '')}${ev?.grant?.dashboard_path || PRIVACY_PATH}`);
+  lines.push('No cloud at all: a local model (Ollama) needs no consent. /connect ollama');
+  return lines;
+}
+
+/** GET /api/consent record -> { granted, providers: { name: bool } }. */
+export function consentState(rec) {
+  const providers = rec?.provider_consent && typeof rec.provider_consent === 'object' ? rec.provider_consent : {};
+  return { granted: Boolean(rec?.ai_data_sharing_consent), providers };
+}
+
+/** Is `provider` allowed to receive data under this record? Mirrors the server: overall consent on, provider not set false. */
+export const consentCovers = (rec, provider) => {
+  const s = consentState(rec);
+  return s.granted && s.providers[String(provider || '').toLowerCase()] !== false;
+};
+
+export function consentStatusLines(rec, { provider = null } = {}) {
+  const s = consentState(rec);
+  const names = Object.entries(s.providers).map(([k, v]) => `${k} ${v ? 'yes' : 'blocked'}`);
+  const lines = [[s.granted ? '✔ AI data sharing: you have given your OK.' : '· AI data sharing: not given yet, so nothing is sent to a cloud AI.', s.granted ? 'ok' : 'warn']];
+  if (names.length) lines.push([`Per provider: ${names.join(', ')}.`]);
+  if (!s.granted) lines.push([`/consent grant${provider ? ` ${provider}` : ''} gives it. Your messages and tool results then go to the cloud AI you chose. A local model (Ollama) never needs it.`]);
+  return lines;
+}
+
+/** The body for POST /api/consent: keeps every other provider's setting (the server replaces the map wholesale). */
+export function grantBody(rec, provider) {
+  const keep = consentState(rec).providers;
+  const p = String(provider || '').toLowerCase();
+  return { ai_data_sharing_consent: true, provider_consent: { ...keep, ...(p ? { [p]: true } : {}) } };
+}
+
+/** What to say after /connect saves a hosted key and consent is not yet in place. */
+export function connectConsentNote(providerId) {
+  return `One more step before it can answer: ${providerLabel(providerId)} receives your messages, so Quox needs your OK. /consent grant ${providerId}`;
+}
+
+/**
+ * QUOXON-Z2H lane R: the plain-text message `quox --print` gives for ai_consent_required, naming the exact
+ * shell command (there is no /consent in a one-shot run). profile = the -p the user named, if any.
+ */
+export function consentPrintMessage(ev, profile = null) {
+  if (ev?.retryable) return consentErrorText(ev);
+  const who = providerLabel(ev?.provider);
+  const prov = ev?.provider || '<provider>';
+  const p = profile ? `-p ${profile} ` : '';
+  return `${consentErrorText(ev)} Nothing was sent.\n`
+    + `  Your messages and any tool results would go to ${who}, a third party. Consent is personal; no admin is needed.\n`
+    + `  Grant it, then send again: quox ${p}consent grant --provider ${prov}\n`
+    + '  Or use a local model (Ollama), which needs no consent.';
+}

package/lib/quoxon/copy.js

@@ -1,7 +1,8 @@
 /** /copy helpers: pick the text and build the OSC 52 clipboard escape. */
+import { stripMarks } from './palette.js';
 
 export function osc52(text, env = process.env) {
-  const seq = `\x1b]52;c;${Buffer.from(String(text), 'utf8').toString('base64')}\x07`;
+  const seq = `\x1b]52;c;${Buffer.from(stripMarks(text), 'utf8').toString('base64')}\x07`;
   return env.TMUX ? `\x1bPtmux;${seq.replace(/\x1b/g, '\x1b\x1b')}\x1b\\` : seq;
 }
 
@@ -23,11 +24,11 @@ export function pickCopy(answers, arg) {
   const list = (answers || []).filter(a => a.text && a.text.trim());
   if (!list.length) return { error: 'No answer to copy yet.' };
   if (arg === 'code') {
-    for (let i = list.length - 1; i >= 0; i--) { const b = codeBlocks(list[i].text); if (b.length) return { text: b[b.length - 1] }; }
+    for (let i = list.length - 1; i >= 0; i--) { const b = codeBlocks(list[i].text); if (b.length) return { text: stripMarks(b[b.length - 1]) }; }
     return { error: 'No code block in the answers so far.' };
   }
   const n = arg ? Number(arg) : 1;
   if (!Number.isInteger(n) || n < 1) return { error: 'Usage: /copy [N|code]' };
   if (n > list.length) return { error: `Only ${list.length} answer${list.length === 1 ? '' : 's'} so far.` };
-  return { text: list[list.length - n].text };
+  return { text: stripMarks(list[list.length - n].text) };
 }

package/lib/quoxon/countdownLine.js

@@ -0,0 +1,11 @@
+/** The restart countdown line, fitted to the width: full text when it fits, shorter forms below, never wrapped. */
+export function countdownLine(secs, cols) {
+  const room = Math.max(20, (cols || 80) - 4); // paddingLeft 2 plus a margin
+  const forms = [
+    `↻ New version ready. Restarting in ${secs}s · Esc to stay on this version · Enter to restart now`,
+    `↻ New version · restarting in ${secs}s · Esc stay · Enter now`,
+    `↻ Restarting in ${secs}s · Esc stay · Enter now`,
+    `↻ Restart in ${secs}s · Esc stay`,
+  ];
+  return forms.find(f => f.length <= room) || forms[forms.length - 1];
+}

package/lib/quoxon/demo.autoplay.js

@@ -0,0 +1,29 @@
+/**
+ * Deterministic script for `quox --demo --autoplay`: the same timings on every run, so a screen
+ * recording is repeatable. No Math.random, no wall clock in the plan; only fixed numbers and a seeded PRNG.
+ */
+export const AUTOPLAY_LABEL = 'DEMO: demo data, nothing real runs.';
+export const AUTOPLAY_REQUEST = 'Show me what you can do (demo)';
+export const AUTOPLAY_PROOF = '/proof';
+export const AUTOPLAY = Object.freeze({ seed: 20261013, startMs: 900, typeMinMs: 38, typeMaxMs: 78, afterTypeMs: 450, approvalHoldMs: 2500, afterKeyMs: 400, afterTurnMs: 900, finalHoldMs: 600 });
+
+/** Small seeded PRNG (mulberry32): deterministic across runs and platforms. */
+export function prng(seed) {
+  let a = seed >>> 0;
+  return () => {
+    a = (a + 0x6D2B79F5) >>> 0;
+    let t = a;
+    t = Math.imul(t ^ (t >>> 15), t | 1);
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+/** Per-character delays (ms) for typing `text` at a human pace; identical for the same seed. */
+export function typingPlan(text, seed = AUTOPLAY.seed, { min = AUTOPLAY.typeMinMs, max = AUTOPLAY.typeMaxMs } = {}) {
+  const r = prng(seed);
+  return [...text].map(() => Math.round(min + r() * (max - min)));
+}
+
+/** Is autoplay requested? flag or QUOX_DEMO_AUTOPLAY=1. */
+export const autoplayOn = (flag, env = process.env) => Boolean(flag) || /^(1|true|yes|on)$/i.test(String(env.QUOX_DEMO_AUTOPLAY || ''));

package/lib/quoxon/demo.fixtures.js

@@ -14,7 +14,7 @@ export const DEMO_STEPS = (turnId) => [
   { when: 'reject', wait: 300, ev: { type: 'text.delta', turn_id: turnId, content: 'Understood. The note is saved; web on edge-02 was NOT restarted because you denied it (demo data).' } },
   { when: 'reject', wait: 200, ev: { type: 'turn.finished', turn_id: turnId, status: 'completed', conversation_id: 'demo-conv' } },
   { when: 'approve', wait: 200, ev: { type: 'approval.resolved', turn_id: turnId, call_id: 'c2', inbox_item_id: 'demo-item', decision: 'approved' } },
-  { when: 'approve', wait: 900, ev: { type: 'tool.finished', turn_id: turnId, call_id: 'c2', tool: 'host_restart', status: 'ok', result_summary: 'restart web on edge-02', duration_ms: 2300, envelope_id: 'env2', receipt: { ward_seq: 4069513, verified: true } } },
+  { when: 'approve', wait: 900, ev: { type: 'tool.finished', turn_id: turnId, call_id: 'c2', tool: 'host_restart', status: 'ok', result_summary: 'restarted', duration_ms: 2300, envelope_id: 'env2', receipt: { ward_seq: 4069513, verified: true } } },
   { when: 'approve', wait: 100, ev: { type: 'trace', turn_id: turnId, protocol: 'aocl', label: 'ingress ok identity ok policy ok' } },
   { when: 'approve', wait: 100, ev: { type: 'trace', turn_id: turnId, protocol: 'ward', label: 'witnessed', ref: '4069513' } },
   { when: 'approve', wait: 300, ev: { type: 'text.delta', turn_id: turnId, content: 'Done. The note is saved and web on edge-02 restarted (demo data, nothing real ran).' } },

package/lib/quoxon/demo.js

@@ -1,3 +1,4 @@
+import { readFileSync, writeFileSync } from 'node:fs';
 import { DEMO_STEPS } from './demo.fixtures.js';
 
 const sleep = (ms, signal) => new Promise((res) => {
@@ -7,7 +8,32 @@ const sleep = (ms, signal) => new Promise((res) => {
 });
 
 /** A fake api with the same surface as createApi(), driven by DEMO_STEPS. */
-export function createDemoApi({ speed = 1 } = {}) {
+/**
+ * WALK-FIXES pty seam (demo only, never a real server): decisionsFile is a JSON state file
+ * { items: [decision inbox items], log: [], answerDelayMs?, approvalsDelayMs? }. approvals() lists the open ones,
+ * answerDecision() marks one answered and appends { id, key, note, at } to log, so a test in another process reads
+ * exactly what was submitted, and when.
+ */
+function decisionStore(file) {
+  const load = () => JSON.parse(readFileSync(file, 'utf8'));
+  const wait = (ms) => new Promise(r => setTimeout(r, ms || 0));
+  return {
+    // staleMs: an answered item is still listed for this long (a server that lags behind its own answers)
+    async open() { const d = load(); await wait(d.approvalsDelayMs); return d.items.filter(x => x.status === 'open' || (d.staleMs && x.answeredAt && Date.now() - x.answeredAt < d.staleMs)); },
+    async answer(id, key, note) {
+      const d0 = load(); await wait(d0.answerDelayMs);
+      const d = load(); const it = d.items.find(x => x.id === id);
+      if (!it || it.status !== 'open') { const e = new Error('already handled'); e.status = 404; throw e; }
+      it.status = 'answered'; it.answeredAt = Date.now(); it.answer = { key, note: note || null };
+      d.log.push({ id, key, note: note || null, at: Date.now() });
+      writeFileSync(file, JSON.stringify(d));
+      return { ok: true };
+    }
+  };
+}
+
+export function createDemoApi({ speed = 1, objects = false, decisionsFile = null } = {}) {
+  const decs = decisionsFile ? decisionStore(decisionsFile) : null;
   let gate = null;
   let decision = 'approve';
   return {
@@ -26,10 +52,25 @@ export function createDemoApi({ speed = 1 } = {}) {
     async steer() { return { ok: false, reason: 'unsupported' }; },
     async interrupt() { return { ok: false }; },
     async health() { return { ok: true, url: 'demo' }; },
-    async approvals() { return []; },
+    // the open approval is in the inbox while the demo holds at the gate, so a poll never prunes its card
+    async approvals() { return [...(gate ? [{ id: 'demo-item', title: 'host_restart on web on edge-02', approval_id: 'demo-appr', created_at: new Date().toISOString() }] : []), ...(decs ? await decs.open() : [])]; },
+    ...(decs ? { async answerDecision(id, key, { note } = {}) { return decs.answer(id, key, note); }, async approvalStats() { return { awaiting: (await decs.open()).length + (gate ? 1 : 0) }; } } : {}),
     async skills() { return [{ id: 'sk1', name: 'daily-fleet-check', description: 'Check fleet health and summarise.', edition: 'stable' }]; },
     async skill(id) { return { id, name: 'daily-fleet-check', description: 'Check fleet health and summarise.', edition: 'stable' }; },
     async conversationExists() { return { exists: true }; },
-    async respond(_id, action) { decision = action === 'reject' ? 'reject' : 'approve'; const g = gate; gate = null; g?.(); return { ok: true }; }
+    // /proof works in the demo journey (main.js asks for it); the other object views stay unavailable offline
+    ...(objects ? { objects: {
+      async proof(tool) {
+        const env = { id: tool.envelopeId, corr: 'demo-corr', payload: { success: true, tool_name: tool.tool } };
+        return { data: { tool, envelope: { ok: true, env },
+          aocl: { ok: true, list: [{ intent: 'aocl.identity.verified' }, { intent: 'aocl.policy.evaluated', payload: { allPassed: true } }] },
+          receipt: { ok: true, result: { status: 'WITNESSED', entry: { seq: 4069513 } } } } };
+      },
+      ...Object.fromEntries(['skill', 'agent', 'workflowRun', 'crystal', 'memory', 'rules', 'reconcile'].map((k) => [k, async () => ({ error: 'Object views are not available in the demo.' })]))
+    } } : {}),
+    async respond(_id, action) {
+      if (decs && _id !== 'demo-item') return decs.answer(_id, action === 'reject' ? 'n' : 'y', null); // a yes/no decision answered as an approval (the bulk card)
+      decision = action === 'reject' ? 'reject' : 'approve'; const g = gate; gate = null; g?.(); return { ok: true };
+    }
   };
 }