quoxcli 0.2.0 → 0.3.1

package/lib/quoxon/noai.js

@@ -0,0 +1,57 @@
+/**
+ * Z2H-R2B: what Quox does when NO AI provider is connected. A turn is answered locally (no server call),
+ * with a full friendly card; nothing here names one vendor as the default. "add a host" has a deterministic
+ * path that needs no AI.
+ */
+import { CHOICES } from './model.js';
+import { providerState } from './providers.js';
+
+export const NO_AI_STATUS = 'no AI connected';
+export const NO_AI_CARD = [
+  'No AI is connected yet. Pick one:',
+  '/connect openai (recommended), /connect anthropic, /connect ollama <host>, or /connect for the list.'
+];
+export const HOSTS_USAGE = '/hosts add';
+
+/** -> true when at least one provider is connected, false when readable and none is, null when nothing could be read. */
+export function anyProviderConnected(vault, caps) {
+  let known = false;
+  for (const c of CHOICES) {
+    const st = providerState({ cap: c.cap || c.id, vault: c.vault }, caps, vault).state;
+    if (st === 'connected') return true;
+    if (st !== 'unknown') known = true;
+  }
+  return known ? false : null;
+}
+
+export const asksAddHost = (text) => /^\s*(?:please\s+)?(?:(?:i\s+(?:want|need)\s+to|can\s+you|help\s+me|let'?s)\s+)?(?:add|connect|enrol+|enroll|register|onboard)\s+(?:a|my|another|the)?\s*(?:new\s+)?(?:host|server|machine|node|box)s?\b/i.test(String(text || '').replace(/[.?!]+\s*$/, ''));
+
+/** Z2H-R4: "watch my servers" and friends; watching starts with adding a host, which needs no AI. */
+export const asksWatchHosts = (text) => /^\s*(?:please\s+)?(?:(?:i\s+(?:want|need)\s+(?:you\s+)?to|can\s+you|help\s+me)\s+)?(?:watch|monitor|keep\s+an\s+eye\s+on|look\s+after|keep\s+watch\s+(?:on|over))\s+(?:my|our|the)\s+(?:\w+\s+)?(?:servers?|hosts?|machines?|nodes?|boxes|fleet|homelab|infrastructure|infra)\b/i.test(String(text || '').replace(/[.?!]+\s*$/, ''));
+
+/**
+ * The deterministic add-a-host lines. `base` = the server URL when known. `check` = the result of probing
+ * `${base}/install` ({ ok, status }) or null when it could not be read. Z2H-3c: a public install answered 503
+ * there (no QuoxAgent bundled), so the curl line we printed failed on the user's host; a failed probe now says
+ * so plainly instead of handing out a command that cannot work. Unreadable (null) keeps the old lines.
+ */
+export function addHostLines(base, check = null) {
+  const b = String(base || '').replace(/\/+$/, '') || '<your-quox-url>';
+  if (check && check.ok === false && Number(check.status) >= 400) {
+    return [
+      `This Quox cannot enrol hosts yet: its host installer is not available (${b}/install answered HTTP ${check.status}).`,
+      'The QuoxAgent installer is not bundled in this install, so the add-a-host command would fail on your machine.',
+      'Nothing was changed on either machine.'
+    ];
+  }
+  return [
+    'To add a host, no AI needed. On the machine you want to add, run:',
+    // REL-423: never `curl | sudo bash`: that pipe exits 0 when the download fails (TLS error, HTTP error) and runs
+    // whatever partial body arrived. Download to a temp file with curl -f, then run it, so a failure stops loudly.
+    // Two lines (shell continuation) so the TUI, which clips long lines, never cuts the command short.
+    `( f=$(mktemp) && trap 'rm -f "$f"' EXIT && curl -fsSL ${b}/install -o "$f" && \\`,
+    `  sudo bash "$f" --host-id <name> )`,
+    'Self-signed certificate? Run quox fleet enrol <name>: it prints this with the certificate pinned.',
+    'Then check it arrived with: quox fleet hosts'
+  ];
+}

package/lib/quoxon/objects/away.js

@@ -0,0 +1,72 @@
+/**
+ * E5 "While you were away": a factual digest since a moment, from GET /api/v1/away (collector). Every
+ * item carries the source that reported it and its time; nothing is summarised by a model. Sources the
+ * server could not read, or that went silent, come back in `blind` and are always named ("Can't see"),
+ * so an empty list never reads as an all clear it cannot vouch for.
+ */
+import { seg, fit, hhmm, plural, boxWidth, parseTs } from './model.js';
+
+/** Importance: approvals waiting first (they block work), then alerts, failures, then outcomes. */
+export const RANK = {
+  approval_waiting: 0, alert: 1, turn_failed: 2, objective_failed: 2, workflow_failed: 2,
+  approval_resolved: 3, objective_finished: 4, workflow_finished: 4, decision: 5
+};
+const GLYPH = {
+  approval_waiting: ['⚠ ', 'warn'], alert: ['⚠ ', 'warn'], turn_failed: ['✖ ', 'error'], objective_failed: ['✖ ', 'error'],
+  workflow_failed: ['✖ ', 'error'], approval_resolved: ['✔ ', 'ok'], objective_finished: ['✔ ', 'ok'],
+  workflow_finished: ['✔ ', 'ok'], decision: ['◆ ', 'indigo']
+};
+const rankOf = (it) => RANK[it?.kind] ?? 6;
+
+export function rankItems(items) {
+  return [...(items || [])].sort((a, b) => rankOf(a) - rankOf(b) || (parseTs(b.ts) ?? 0) - (parseTs(a.ts) ?? 0));
+}
+
+/** "5h", "45m", "2d" for the away window. */
+export function awayFor(sinceTs, now) {
+  const t = parseTs(sinceTs);
+  if (t == null) return '';
+  const m = Math.max(0, Math.round((now - t) / 60000));
+  if (m < 60) return `${m}m`;
+  const h = Math.round(m / 60);
+  return h < 48 ? `${h}h` : `${Math.round(h / 24)}d`;
+}
+
+/** d: { since, items, blind, activity, compact?, max?, now } */
+export function awayCard(d, cols) {
+  const now = d.now ?? Date.now();
+  const w = boxWidth(cols, 96), inner = w - 4;
+  const items = rankItems(d.items);
+  const max = d.compact ? (d.max ?? 5) : items.length;
+  const shown = items.slice(0, max);
+  const rows = [];
+  const win = awayFor(d.since, now);
+  if (!items.length) rows.push([seg(d.standing && d.standing.count > 0 ? 'Nothing new needed you.' : 'Nothing needed you.', 'muted')]);
+  for (const it of shown) {
+    const [g, role] = GLYPH[it.kind] || ['· ', 'muted'];
+    const meta = `${it.source || '?'} · ${hhmm(it.ts) || 'time unknown'}`;
+    if (d.compact) {
+      rows.push([seg(g, role), seg(fit(it.title, Math.max(8, inner - 2 - meta.length - 2)), 'value'), seg(`  ${meta}`, 'muted')]);
+    } else {
+      rows.push([seg(g, role), seg(fit(it.title, inner - 2), 'value', rankOf(it) === 0)]);
+      rows.push([seg('  '), seg(fit(meta, inner - 2), 'muted')]);
+    }
+  }
+  if (items.length > shown.length) rows.push([seg(`+${items.length - shown.length} more · /away`, 'muted')]);
+  if (d.standing && d.standing.count > 0) rows.push([seg(fit(`${plural(d.standing.count, 'older item')} still need${d.standing.count === 1 ? 's' : ''} you · quox lucid`, inner), 'muted')]);
+  const act = d.activity;
+  if (act && act.total > 0 && !d.compact) {
+    const top = (act.agents || []).slice(0, 4).map(a => `${a.agent} ${a.count}`).join(', ');
+    rows.push([seg(' ')]);
+    rows.push([seg(fit(`${act.partial ? 'at least ' : ''}${plural(act.total, 'agent action')}${top ? `: ${top}` : ''}${act.source ? ` (${act.source})` : ''}`, inner), 'muted')]);
+  }
+  const blind = d.blind || [];
+  if (blind.length && d.compact) {
+    const what = blind.map(b => (b.reason ? `${b.source} (${b.reason})` : b.source)).join(', ');
+    rows.push([seg(fit(`Can't see: ${what}`, inner), 'faint')]);
+  } else if (blind.length) {
+    rows.push([seg("Can't see:", 'faint')]);
+    for (const b of blind) rows.push([seg('  '), seg(fit(`${b.source}${b.reason ? `: ${b.reason}` : ''}`, inner - 2), 'faint')]);
+  }
+  return { box: { width: w, title: `While you were away${win ? ` (${win})` : ''}`, titleRole: 'value', right: d.compact ? '' : `since ${hhmm(d.since)}`, rightRole: 'muted', border: items.some(i => rankOf(i) === 0) ? 'warn' : 'muted' }, rows };
+}

package/lib/quoxon/objects/fetch.js

@@ -11,6 +11,12 @@ import { fileURLToPath } from 'node:url';
 import { findSkill } from '../skills.js';
 import { packFrom } from './ladder.js';
 import { slotFor } from './agent.js';
+import { listFailure } from '../session.js';
+import { resolveEndpoint } from '../../api/endpoints.js';
+import { fleetFetchers } from './fleet.js';
+import { healthFetchers } from './health.js';
+import { proveFetchers } from './prove.js';
+import { replayFetchers } from './replay.js';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const ASSISTANTS_DIR = path.resolve(HERE, '../../../../src/config/entities/assistants');
@@ -31,7 +37,7 @@ export function bundledIdentities(dir = ASSISTANTS_DIR) {
   return out;
 }
 
-export function createObjectsApi({ client, orgId = () => null, home = os.homedir(), identities = bundledIdentities }) {
+export function createObjectsApi({ client, orgId = () => null, home = os.homedir(), identities = bundledIdentities, profile = null }) {
   const get = (service, p, query, timeout = 12000) => client.get(p, { service, query, retries: 0, timeout });
   const post = (service, p, body, timeout = 8000) => client.post(p, { service, body, retries: 0, timeout });
   const org = () => { const o = orgId(); return typeof o === 'string' ? o : null; };
@@ -66,7 +72,11 @@ export function createObjectsApi({ client, orgId = () => null, home = os.homedir
     return out;
   }
 
-  return {
+  const self = {
+    ...fleetFetchers({ get, org, listOf, why, resolveEndpoint }),
+    ...healthFetchers({ get, org, listOf, why, resolveEndpoint }),
+    ...replayFetchers({ get, listOf, why, verifyReceipt: (id, t) => verifyReceipt(id, t), aeeGet: (id) => aeeGet(id) }),
+    ...proveFetchers({ get, listOf, resolveEndpoint, self: { proof: (t) => self.proof(t) } }),
     /** E1 */
     async skill(name) {
       const all = listOf(await get('collector', '/quoxflow/skills', { orgId: org() || undefined }), 'data', 'skills');
@@ -110,14 +120,15 @@ export function createObjectsApi({ client, orgId = () => null, home = os.homedir
     /** E4 */
     async agent(name) {
       const q = String(name || '').trim().toLowerCase();
-      let toolMap = null, toolErr = null;
-      try { toolMap = (await client.get('/api/v1/tools/agents', { service: 'collector', noAuth: true, retries: 0, timeout: 10000 }))?.agentTools || null; } catch (e) { toolErr = why(e); }
+      let toolMap = null, toolErr = null, toolFail = null;
+      try { toolMap = (await client.get('/api/v1/tools/agents', { service: 'collector', retries: 0, timeout: 10000 }))?.agentTools || null; } catch (e) { toolErr = why(e); toolFail = e; }
       let orgAgents = [];
       try { if (org()) orgAgents = listOf(await get('auth', `/api/orgs/${org()}/agents`, { includeTools: 'false' }), 'agents', 'data'); } catch { /* optional */ }
       const known = new Set([...Object.keys(toolMap || {}), ...idents().keys(), ...orgAgents.map(a => a.agent_id)]);
       let id = [...known].find(k => k.toLowerCase() === q);
       if (!id) id = [...known].find(k => String(nameOf(k)).toLowerCase() === q) || orgAgents.find(a => String(a.name || '').toLowerCase() === q)?.agent_id;
-      if (!id) return { error: `No agent called "${name}".${toolErr ? ` (agent list: ${toolErr})` : ''}`, tone: 'warn' };
+      if (!id && toolFail) return { error: `Couldn't check agents: ${listFailure(toolFail, profile)}`, tone: 'warn' }; // a failed list is a failure, never "no such agent"
+      if (!id) return { error: `No agent called "${name}".`, tone: 'warn' };
       const record = orgAgents.find(a => a.agent_id === id) || null;
       const ident = idents().get(id) || {};
       let slot = null;
@@ -167,4 +178,5 @@ export function createObjectsApi({ client, orgId = () => null, home = os.homedir
       return { data: { items } };
     }
   };
+  return self;
 }

package/lib/quoxon/objects/fleet.js

@@ -0,0 +1,149 @@
+/**
+ * /fleet: computers, agents, missions and SubFleets in one compact block, with health. Read-only.
+ * Sources (the same routes `quox fleet ...` and `quox objective list` use): GET /api/v1/agents
+ * (heartbeats), GET /api/v1/fleet/hosts (Bastion registry), org agents, GET /api/objectives. A source
+ * that could not be read is named on the "Can't see" line, never counted as zero. SubFleets have an
+ * RFC but no API yet, so that row says so. Moving work is not here: the hint points at plain words.
+ */
+import { seg, fit, fitRow, ago, plural, boxWidth } from './model.js';
+import { fromObjective } from '../roster.js';
+
+const OFFLINE = /^(dead|offline|down|disconnected|unreachable)$/;
+const HEALTHY = /^(healthy|ok|good)$/;
+const DEGRADED = /^(warning|warn|degraded|stale)$/;
+const UNHEALTHY = /^(critical|unhealthy|error|failed|fail)$/;
+const FLEET_OVERVIEW_WORDS = new Set(['health', 'status', 'list', 'all', 'overview', 'summary', 'hosts', 'agents', 'quoxagents']);
+
+export const ORDER = ['healthy', 'degraded', 'unhealthy', 'offline', 'unknown'];
+const SEVERITY = { unhealthy: 0, offline: 1, degraded: 2, unknown: 3, healthy: 4 };
+
+/** A heartbeat row or a Bastion host row -> healthy | degraded | unhealthy | offline | unknown. */
+export function healthOf(row) {
+  const s = row?.status;
+  const st = String(typeof s === 'object' && s ? s.state ?? '' : s ?? '').toLowerCase();
+  const h = String(typeof s === 'object' && s ? s.health ?? '' : '').toLowerCase();
+  if (OFFLINE.test(st) || OFFLINE.test(h)) return 'offline';
+  if (UNHEALTHY.test(h) || UNHEALTHY.test(st)) return 'unhealthy';
+  if (DEGRADED.test(h) || DEGRADED.test(st)) return 'degraded';
+  if (HEALTHY.test(h) || HEALTHY.test(st)) return 'healthy';
+  return 'unknown';
+}
+
+const listOk = (s) => (s?.ok ? s.list || [] : null);
+
+/** d: { agents, hosts, orgAgents, missions } each { ok, list } | { ok:false, error } -> merged view model. */
+export function collectFleet(d, now = Date.now()) {
+  const byId = new Map();
+  const cant = [];
+  const sources = [['heartbeats', d.agents], ['hosts', d.hosts]];
+  for (const [label, src] of sources) {
+    if (!src) continue;
+    if (!src.ok) { cant.push(`${label} (${src.error || 'failed'})`); continue; }
+    for (const r of src.list || []) {
+      const id = r.host_id || r.id || r.hostname;
+      if (!id) continue;
+      const cur = byId.get(id) || { id };
+      if (label === 'heartbeats') {
+        const s = r.status;
+        byId.set(id, { ...cur, health: healthOf(r), version: r.version ?? cur.version, lastSeenS: typeof s === 'object' ? s?.last_seen_seconds : undefined, heartbeat: true });
+      } else {
+        byId.set(id, { ...cur, ip: r.ip ?? cur.ip, group: r.group ?? cur.group, registryHealth: healthOf(r), health: cur.heartbeat ? cur.health : healthOf(r) });
+      }
+    }
+  }
+  const computers = [...byId.values()].sort((a, b) => SEVERITY[a.health] - SEVERITY[b.health] || a.id.localeCompare(b.id));
+  const counts = Object.fromEntries(ORDER.map(k => [k, 0]));
+  for (const c of computers) counts[c.health]++;
+  const org = listOk(d.orgAgents);
+  if (d.orgAgents && !d.orgAgents.ok) cant.push(`agents (${d.orgAgents.error || 'failed'})`);
+  const agents = org ? { active: org.filter(a => !a.status || a.status === 'active').length, other: org.filter(a => a.status && a.status !== 'active').length } : null;
+  let missions = null;
+  if (d.missions && !d.missions.ok) cant.push(`missions (${d.missions.error || 'failed'})`);
+  else if (d.missions) {
+    const rows = (d.missions.list || []).map(o => fromObjective(o, now)).filter(Boolean);
+    missions = { running: rows.filter(r => r.state === 'running').length, waiting: rows.filter(r => r.state === 'waiting').length, loops: rows.filter(r => r.kind === 'loop' && (r.state === 'running' || r.state === 'waiting')).length, rows: rows.filter(r => r.state === 'running' || r.state === 'waiting') };
+  }
+  return { computers, counts, agents, missions, cant };
+}
+
+const ROLE = { healthy: 'ok', degraded: 'warn', unhealthy: 'error', offline: 'error', unknown: 'muted' };
+const HINT = 'ask in plain words to move work';
+
+/** d: { agents, hosts, orgAgents, missions, now } -> view { box, rows } */
+export function fleetCard(d, cols) {
+  const now = d.now ?? Date.now();
+  const f = collectFleet(d, now);
+  const w = boxWidth(cols, 78), inner = w - 4;
+  const L = (label, parts) => [seg(label.padEnd(12), 'muted'), ...parts];
+  const rows = [];
+  if (f.computers.length || (d.agents?.ok || d.hosts?.ok)) {
+    const bits = [];
+    for (const k of ORDER) if (f.counts[k]) { if (bits.length) bits.push(seg(' · ', 'muted')); bits.push(seg(`${f.counts[k]} ${k}`, ROLE[k], k !== 'healthy')); }
+    rows.push(L('Computers', [seg(`${f.computers.length}  `, 'value', true), ...bits]));
+    const bad = f.computers.filter(c => c.health !== 'healthy');
+    if (bad.length) rows.push([seg('not healthy'.padEnd(12), 'muted'), seg(fit(bad.map(c => `${c.id} ${c.health}`).join(', '), inner - 12), 'warn')]);
+  } else rows.push(L('Computers', [seg('?', 'warn'), seg(' not read', 'muted')]));
+  rows.push(f.agents ? L('Agents', [seg(`${f.agents.active} active`, 'value'), ...(f.agents.other ? [seg(` · ${f.agents.other} other`, 'muted')] : [])]) : L('Agents', [seg('?', 'warn')]));
+  if (f.missions) {
+    const m = f.missions;
+    const extra = [m.waiting ? plural(m.waiting, 'waiting', 'waiting') : null, m.loops ? plural(m.loops, 'loop') : null].filter(Boolean);
+    rows.push(L('Missions', [seg(`${m.running} running`, 'value'), ...(extra.length ? [seg(` · ${extra.join(' · ')}`, 'muted')] : [])]));
+    for (const r of m.rows.slice(0, 3)) rows.push([seg('  ', 'muted'), seg(fit(`${r.name}${r.activity ? ` · ${r.activity}` : ''}`, inner - 2), 'muted')]);
+    if (m.rows.length > 3) rows.push([seg(`  …and ${m.rows.length - 3} more`, 'muted')]);
+  } else rows.push(L('Missions', [seg('?', 'warn')]));
+  rows.push(L('SubFleets', [seg('none yet', 'muted'), seg(w < 60 ? '' : ' (designed, no API in this Quox)', 'muted')]));
+  if (f.cant.length) rows.push([seg("Can't see ", 'warn'), seg(fit(f.cant.join(', '), inner - 12), 'warn')]);
+  rows.push([seg(HINT, 'muted')]);
+  return { box: { width: w, title: 'Fleet', titleRole: 'sky', border: 'sky' }, rows: rows.map(r => fitRow(r, inner)) };
+}
+
+/** d: { host, now } -> view for one computer. */
+export function hostCard(d, cols) {
+  const h = d.host;
+  const w = boxWidth(cols, 66), inner = w - 4;
+  const L = (label, v, role = 'value') => [seg(label.padEnd(8), 'muted'), seg(fit(v, inner - 8), role)];
+  const rows = [L('health', h.health, ROLE[h.health])];
+  if (h.ip) rows.push(L('ip', h.ip));
+  if (h.group) rows.push(L('group', h.group));
+  if (h.version) rows.push(L('version', h.version));
+  if (typeof h.lastSeenS === 'number') rows.push(L('seen', `${ago(Date.now() - h.lastSeenS * 1000, Date.now()) || '0s'} ago`, 'muted'));
+  if (!h.heartbeat) rows.push(L('agent', 'no heartbeat (in the registry only)', 'muted'));
+  rows.push([seg(HINT, 'muted')]);
+  return { box: { width: w, title: h.id, titleRole: 'sky', right: h.health, rightRole: ROLE[h.health], border: 'sky' }, rows };
+}
+
+/** Builder registered as BUILDERS.fleet: one host when d.host is set, else the whole fleet. */
+export function fleetView(d, cols) { return d.host ? hostCard(d, cols) : fleetCard(d, cols); }
+
+/** Fetchers for createObjectsApi (kept here so fetch.js only spreads them in). */
+export function fleetFetchers({ get, org, listOf, why, resolveEndpoint }) {
+  const read = async (fn) => { try { return { ok: true, list: await fn() }; } catch (e) { return { ok: false, error: why(e) }; } };
+  return {
+    /** Host ids for /fleet <TAB>: [{ value, desc }]; a failed read suggests nothing. */
+    async fleetNames() {
+      const hb = resolveEndpoint('v1.agents.list');
+      const rows = listOf(await get(hb.service, hb.path, undefined, 6000), 'agents');
+      return rows.map(r => r.host_id || r.id).filter(Boolean).map(id => ({ value: String(id), desc: healthOf(rows.find(r => (r.host_id || r.id) === id)) }));
+    },
+    /** E-fleet: name '' = the whole fleet, else one computer by id (case-insensitive, then prefix). */
+    async fleet(name) {
+      const q = String(name || '').trim().toLowerCase();
+      const hb = resolveEndpoint('v1.agents.list'), hs = resolveEndpoint('v1.fleet.hosts.list'), ob = resolveEndpoint('objectives.list');
+      const [agents, hosts, orgAgents, missions] = await Promise.all([
+        read(async () => listOf(await get(hb.service, hb.path, undefined, 10000), 'agents')),
+        read(async () => listOf(await get(hs.service, hs.path, undefined, 10000), 'hosts')),
+        org() ? read(async () => { const ep = resolveEndpoint('agents.list', { orgId: org() }); return listOf(await get(ep.service, ep.path, { includeTools: 'false' }, 10000), 'agents', 'data'); }) : Promise.resolve(null),
+        read(async () => listOf(await get(ob.service, ob.path, { limit: 100 }, 10000), 'objectives'))
+      ]);
+      const data = { agents, hosts, orgAgents, missions, now: Date.now() };
+      if (!q) return { data };
+      const f = collectFleet(data, data.now);
+      const host = f.computers.find(c => c.id.toLowerCase() === q) || f.computers.find(c => c.id.toLowerCase().startsWith(q));
+      if (host) return { data: { host, now: data.now } };
+      // owner 2026-10-15 typed "/fleet health": overview words mean the whole fleet (a real host by that name still wins above)
+      if (FLEET_OVERVIEW_WORDS.has(q)) return { data };
+      if (!agents.ok && !hosts.ok) return { error: `Couldn't check hosts: ${agents.error}.`, tone: 'warn' }; // a failed list is never "no such host"
+      return { error: `No host called "${name}". /fleet lists them.`, tone: 'warn' };
+    }
+  };
+}

package/lib/quoxon/objects/health.js

@@ -0,0 +1,186 @@
+/**
+ * /health (and /core): a compact summary of what the Core dashboard's overview (/dashboard) shows.
+ * Read-only, no model call, server-side reads only (the same truth the dashboard reads):
+ *   services   GET collector /api/v1/health/aggregate (the dashboard's service ring)
+ *   computers  GET /api/v1/agents heartbeats + GET /api/v1/fleet/hosts (as /fleet)
+ *   agents     org agents (as /fleet)
+ *   approvals  GET auth /api/orgs/:org/inbox/stats (the dashboard's "Attention needed")
+ *   missions   GET tasks /api/objectives (the dashboard's live objectives)
+ *   failures   GET quoxflow /api/executions?status=failed&since=24h
+ *   licence    GET auth /api/setup/licensing/entitlements
+ * A section whose read failed says "unavailable: <reason>"; an error body is never shown as zero.
+ * /status stays the session panel; /collector-health still goes to /status.
+ */
+import { seg, fit, fitRow, plural, boxWidth } from './model.js';
+import { collectFleet, fleetFetchers } from './fleet.js';
+
+const DAY_MS = 24 * 3600 * 1000;
+const SVC_ROLE = { ok: 'ok', degraded: 'warn', down: 'error' };
+const reasons = (...srcs) => [...new Set(srcs.filter(s => s && !s.ok).map(s => s.error || 'failed'))].join(', ');
+
+/** d: { aggregate, agents, hosts, orgAgents, missions, inbox, failures, licence, now } -> per-section model ({ error } when unread). */
+export function collectHealth(d) {
+  const now = d.now ?? Date.now();
+  const out = {};
+
+  const a = d.aggregate;
+  if (!a?.ok) out.services = { error: a?.error || 'not read' };
+  else {
+    const all = Object.entries(a.data?.services || {});
+    // Z2H run-6: an optional service this install does not ship (collector says not_installed) is neither up nor down.
+    const entries = all.filter(([, s]) => s?.status !== 'not_installed');
+    out.services = {
+      up: entries.filter(([, s]) => s?.status === 'ok').length,
+      total: entries.length,
+      score: typeof a.data?.score === 'number' ? a.data.score : null,
+      bad: entries.filter(([, s]) => s?.status !== 'ok').map(([name, s]) => ({ name, status: s?.status || 'unknown' })),
+      notInstalled: all.filter(([, s]) => s?.status === 'not_installed').map(([name]) => name),
+    };
+  }
+
+  const f = collectFleet({ agents: d.agents, hosts: d.hosts, orgAgents: d.orgAgents, missions: d.missions }, now);
+  if (d.agents?.ok || d.hosts?.ok) {
+    out.computers = { healthy: f.counts.healthy, total: f.computers.length, bad: f.computers.filter(c => c.health !== 'healthy').map(c => ({ id: c.id, health: c.health })), partial: reasons(d.agents, d.hosts) || null };
+  } else out.computers = { error: reasons(d.agents, d.hosts) || 'not read' };
+
+  if (!d.orgAgents) out.agents = { error: 'no org selected' };
+  else out.agents = f.agents ? { ...f.agents } : { error: d.orgAgents.error || 'failed' };
+
+  out.missions = f.missions ? { running: f.missions.running, waiting: f.missions.waiting, loops: f.missions.loops } : { error: d.missions?.error || 'not read' };
+
+  const ib = d.inbox;
+  if (!ib?.ok) out.approvals = { error: ib?.error || 'not read' };
+  else {
+    const s = ib.data || {};
+    out.approvals = { approvals: Number(s.pending_approvals) || 0, active: Number(s.total_active) || 0, urgent: Number(s.urgent) || 0, overdue: Number(s.overdue) || 0 };
+  }
+
+  const fl = d.failures;
+  if (!fl?.ok) out.failures = { error: fl?.error || 'not read' };
+  else {
+    const list = fl.list || [];
+    const r = list[0];
+    out.failures = { count: typeof fl.total === 'number' ? fl.total : list.length, last: r ? (r.workflowName || r.workflow_name || r.name || r.workflowId || r.workflow_id || r.id || null) : null };
+  }
+
+  const li = d.licence;
+  if (!li?.ok) out.licence = { error: li?.error || 'not read' };
+  else {
+    const L = li.data || {};
+    const leases = Array.isArray(L.licenses) ? L.licenses : [];
+    const plugins = Array.isArray(L.entitlements) ? L.entitlements.length : 0;
+    const errors = Array.isArray(L.entitlement_errors) ? L.entitlement_errors.length : 0;
+    if (!leases.length) out.licence = { core: true, plugins, errors };
+    else {
+      const plans = [...new Set(leases.flatMap(x => Array.isArray(x.plans) ? x.plans : []))];
+      const exp = leases.map(x => Date.parse(x.expires_at)).filter(Number.isFinite).sort((x, y) => x - y)[0];
+      out.licence = { core: false, plans, plugins, errors, expiresAt: Number.isFinite(exp) ? exp : null, expired: Number.isFinite(exp) && exp < now };
+    }
+  }
+  return out;
+}
+
+/** Overall verdict for the title: partial (a section unread) > needs attention > all good. */
+function verdict(h) {
+  if (Object.values(h).some(s => s?.error)) return ['partial', 'warn'];
+  const attention = h.services.up < h.services.total || h.computers.bad.length || h.failures.count || h.approvals.approvals || h.approvals.urgent || h.approvals.overdue || h.licence.errors || h.licence.expired;
+  return attention ? ['needs attention', 'warn'] : ['all good', 'ok'];
+}
+
+const HINT = [seg('/fleet', 'key'), seg(' computers · ', 'label'), seg('/status', 'key'), seg(' this session · ', 'label'), seg('/dashboard', 'key'), seg(' open it', 'label')];
+
+/** d -> view { box, rows }. */
+export function healthCard(d, cols) {
+  const h = collectHealth(d);
+  const w = boxWidth(cols, 78), inner = w - 4;
+  const L = (label, parts) => [seg(label.padEnd(11), 'label'), ...parts];
+  const na = (s) => [seg('unavailable: ', 'warn'), seg(s.error, 'warn')];
+  const sep = () => seg(' · ', 'label');
+  const rows = [];
+
+  const s = h.services;
+  if (s.error) rows.push(L('Services', na(s)));
+  else {
+    const parts = [seg(`${s.up}/${s.total} up`, s.up === s.total ? 'ok' : 'warn', true)];
+    for (const b of s.bad) parts.push(sep(), seg(`${b.name} ${b.status}`, SVC_ROLE[b.status] || 'warn'));
+    for (const n of s.notInstalled || []) parts.push(sep(), seg(`${n} not installed`, 'value'));
+    rows.push(L('Services', parts));
+  }
+
+  const c = h.computers;
+  if (c.error) rows.push(L('Computers', na(c)));
+  else if (!c.total) rows.push(L('Computers', [seg('none connected', 'value')]));
+  else {
+    const parts = [seg(`${c.healthy}/${c.total} healthy`, c.healthy === c.total ? 'ok' : 'warn', true)];
+    if (c.bad.length) parts.push(sep(), seg(fit(c.bad.map(x => `${x.id} ${x.health}`).join(', '), inner), c.bad.some(x => x.health === 'offline' || x.health === 'unhealthy') ? 'error' : 'warn'));
+    if (c.partial) parts.push(sep(), seg(`partial: ${c.partial}`, 'warn'));
+    rows.push(L('Computers', parts));
+  }
+
+  const ag = h.agents;
+  rows.push(L('Agents', ag.error ? na(ag) : [seg(`${ag.active} active`, 'value', true), ...(ag.other ? [sep(), seg(`${ag.other} other`, 'value')] : [])]));
+
+  const ap = h.approvals;
+  if (ap.error) rows.push(L('Approvals', na(ap)));
+  else {
+    const parts = [seg(ap.approvals ? `${ap.approvals} open` : 'none open', ap.approvals ? 'warn' : 'ok', true)];
+    if (ap.active) parts.push(sep(), seg(`${ap.active} in inbox`, 'value'));
+    if (ap.urgent) parts.push(sep(), seg(`${ap.urgent} urgent`, 'error'));
+    if (ap.overdue) parts.push(sep(), seg(`${ap.overdue} overdue`, 'error'));
+    rows.push(L('Approvals', parts));
+  }
+
+  const m = h.missions;
+  if (m.error) rows.push(L('Missions', na(m)));
+  else {
+    const parts = [seg(`${m.running} running`, 'value', true)];
+    if (m.waiting) parts.push(sep(), seg(`${m.waiting} waiting`, 'warn'));
+    if (m.loops) parts.push(sep(), seg(plural(m.loops, 'loop'), 'value'));
+    rows.push(L('Missions', parts));
+  }
+
+  const fl = h.failures;
+  if (fl.error) rows.push(L('Failures', na(fl)));
+  else if (!fl.count) rows.push(L('Failures', [seg('none in 24h', 'ok')]));
+  else rows.push(L('Failures', [seg(`${plural(fl.count, 'failed run')} in 24h`, 'error', true), ...(fl.last ? [sep(), seg(`last: ${fl.last}`, 'value')] : [])]));
+
+  const li = h.licence;
+  if (li.error) rows.push(L('Licence', na(li)));
+  else {
+    const parts = li.core ? [seg('Core (free)', 'value', true)] : [seg(li.plans.length ? li.plans.join(', ') : 'licensed', 'value', true)];
+    if (li.plugins) parts.push(sep(), seg(plural(li.plugins, 'plugin'), 'value'));
+    if (!li.core && li.expiresAt) parts.push(sep(), seg(li.expired ? `expired ${new Date(li.expiresAt).toISOString().slice(0, 10)}` : `until ${new Date(li.expiresAt).toISOString().slice(0, 10)}`, li.expired ? 'error' : 'value'));
+    if (li.errors) parts.push(sep(), seg(plural(li.errors, 'licence error'), 'error'));
+    rows.push(L('Licence', parts));
+  }
+
+  rows.push(HINT);
+  const [right, rightRole] = verdict(h);
+  return { box: { width: w, title: 'Health', titleRole: 'sky', right, rightRole, border: 'sky' }, rows: rows.map(r => fitRow(r, inner)) };
+}
+
+/** Fetchers for createObjectsApi. Every read is bounded and every failure carries its reason. */
+export function healthFetchers({ get, org, listOf, why, resolveEndpoint }) {
+  const fleet = fleetFetchers({ get, org, listOf, why, resolveEndpoint });
+  const read = async (fn) => { try { return { ok: true, ...(await fn()) }; } catch (e) { return { ok: false, error: why(e) }; } };
+  const noOrg = { ok: false, error: 'no org selected' };
+  return {
+    /** -> { data } for the health card (now injectable for tests). */
+    async health(now = Date.now()) {
+      const ag = resolveEndpoint('v1.health.aggregate.list'), ex = resolveEndpoint('executions.list'), lic = resolveEndpoint('setup.licensing.entitlements.list');
+      const o = org();
+      const [fl, aggregate, inbox, failures, licence] = await Promise.all([
+        fleet.fleet(''),
+        read(async () => ({ data: await get(ag.service, ag.path, undefined, 15000) })),
+        o ? read(async () => { const ep = resolveEndpoint('inbox.stats.list', { orgId: o }); return { data: await get(ep.service, ep.path, undefined, 8000) }; }) : Promise.resolve(noOrg),
+        read(async () => {
+          const d = await get(ex.service, ex.path, { status: 'failed', since: new Date(now - DAY_MS).toISOString(), limit: 5 }, 8000);
+          const total = d?.pagination?.total;
+          return { list: listOf(d, 'data', 'executions'), total: typeof total === 'number' ? total : undefined };
+        }),
+        read(async () => ({ data: await get(lic.service, lic.path, undefined, 8000) })),
+      ]);
+      return { data: { ...fl.data, aggregate, inbox, failures, licence, now } };
+    }
+  };
+}

package/lib/quoxon/objects/index.js

@@ -11,12 +11,20 @@ import { agentCard } from './agent.js';
 import { memoryFacts } from './memory.js';
 import { rulesLadder } from './ladder.js';
 import { proofChain, reconcileView } from './proof.js';
+import { awayCard } from './away.js';
+import { sitrepCard } from './sitrep.js';
+import { fleetView } from './fleet.js';
+import { healthCard } from './health.js';
+import { proveView, lastTurnCalls } from './prove.js';
+import { replayView, parseReplayArg } from './replay.js';
+import { mirrorCard } from './mirror.js';
+import { peekCard } from './peek.js';
 
-export { skillCard, stepFlow, crystalCard, agentCard, memoryFacts, rulesLadder, proofChain, reconcileView };
+export { skillCard, stepFlow, crystalCard, agentCard, memoryFacts, rulesLadder, proofChain, reconcileView, awayCard, sitrepCard };
 export { createObjectsApi } from './fetch.js';
 export { decodeRow, arrivalSeconds } from './model.js';
 
-export const BUILDERS = { skill: skillCard, workflow: stepFlow, crystal: crystalCard, agent: agentCard, memory: memoryFacts, rules: rulesLadder, proof: proofChain, reconcile: reconcileView };
+export const BUILDERS = { skill: skillCard, workflow: stepFlow, crystal: crystalCard, agent: agentCard, memory: memoryFacts, rules: rulesLadder, proof: proofChain, reconcile: reconcileView, away: awayCard, sitrep: sitrepCard, fleet: fleetView, health: healthCard, prove: proveView, replay: replayView, mirror: mirrorCard, peek: peekCard };
 
 /** -> view { box?, rows } for an object item at this width (now injected for tests). */
 export function buildObject(obj, cols, now = Date.now()) {
@@ -46,7 +54,8 @@ export async function runObjectCommand(cmd, arg, ctx) {
   const o = ctx.objects;
   const a = String(arg || '').trim();
   // A bare /skills or /agents is a list, not an object: leave it to its own handler.
-  if (!['/workflow', '/crystal', '/memory', '/rules', '/proof', '/reconcile'].includes(cmd) && !((cmd === '/skills' || cmd === '/agents') && a)) return null;
+  if (!['/workflow', '/crystal', '/memory', '/rules', '/proof', '/reconcile', '/fleet', '/prove', '/replay', '/health', '/core'].includes(cmd) && !((cmd === '/skills' || cmd === '/agents') && a)) return null;
+  if (!o?.health && (cmd === '/health' || cmd === '/core')) return null; // no objects api (demo, local): app.js shows /status instead
   if (!o) return cmd === '/rules' || cmd === '/skills' ? null : { note: 'Object views are not available in this mode.', tone: 'warn' };
   const wrap = async (type, fn) => {
     try {
@@ -63,6 +72,18 @@ export async function runObjectCommand(cmd, arg, ctx) {
     case '/workflow': return a ? wrap('workflow', () => o.workflowRun(a)) : { note: USAGE['/workflow'], tone: 'warn' };
     case '/crystal': return a ? wrap('crystal', () => o.crystal(a)) : { note: USAGE['/crystal'], tone: 'warn' };
     case '/memory': return a ? wrap('memory', () => o.memory(a)) : { note: USAGE['/memory'], tone: 'warn' };
+    case '/replay': {
+      const { ref, page } = parseReplayArg(a);
+      if (!ref && !ctx.conversationId && !toolCalls(ctx.items).length) return { note: 'Nothing to replay yet: no turn in this conversation. /replay <run or conversation id> replays an earlier one.' };
+      return wrap('replay', () => o.replay({ ref, page, conversationId: ctx.conversationId || null, calls: lastTurnCalls(ctx.items) }));
+    }
+    case '/prove': {
+      const calls = lastTurnCalls(ctx.items);
+      if (!calls.length) return { note: 'No tool calls in the last turn: nothing to prove.' };
+      return wrap('prove', () => o.prove(calls));
+    }
+    case '/fleet': return wrap('fleet', () => o.fleet(a));
+    case '/health': case '/core': return wrap('health', () => o.health()); // the Core dashboard summary (objects/health.js)
     case '/rules': {
       return wrap('rules', async () => {
         const r = await o.rules();