quoxcli 0.2.0 → 0.3.1

package/lib/quoxon/onboarding/view.js

@@ -10,7 +10,7 @@
  */
 import React from 'react';
 import { Box, Static, Text, useStdin, useStdout } from 'ink';
-import { HistoryItem, Row, introAnimates, clampCols } from '../render.js';
+import { HistoryItem, Row, introAnimates, clampCols, AskCard } from '../render.js';
 import { c, clip } from '../theme.js';
 import { parseChunk, initialKeyState, PASTE_ON, PASTE_OFF } from '../keys.js';
 import { packageVersion } from '../welcome.js';
@@ -18,10 +18,15 @@ import * as T from './copy.js';
 import { matchIntent, yesNo, parseConnect } from './intent.js';
 import { loadJourney, saveJourney, clearJourney, resumeStep } from './journey.js';
 import { pendingRows, runPreflight, preflightPassed, detectOllama, defaultDeps } from './preflight.js';
-import { credentialOptions, KEY_PROVIDERS, normaliseOllamaUrl } from './credential.js';
+import { credentialOptions, KEY_PROVIDERS, normaliseOllamaUrl, nextSelectable } from './credential.js';
+import { needsConsent, providerLabel } from '../consent.js';
 import { HelloIntro, helloIntroMs } from '../qmotion.js';
 import { launchEgg } from '../egg.js';
 import { passwordProblem, emailOk, generatePassword } from './finish.js';
+import { dockerOffer } from './dockerOffer.js';
+
+// FIRSTRUN: a number pick means its example ("1" is "watch my servers"); the request is replayed as the first real turn.
+const requestText = (text) => { const n = /^\s*([1-9])\s*$/.exec(String(text ?? '')); return n && T.EXAMPLES[Number(n[1]) - 1] ? T.EXAMPLES[Number(n[1]) - 1] : text; };
 
 const h = React.createElement;
 const GLYPH = { ok: '✔', fail: '✖', warn: '⚠', running: '◐', pending: '·' };
@@ -55,6 +60,7 @@ function Item({ item, cols }) {
     case 'header': return h(Box, { flexDirection: 'column', marginTop: 1 },
       h(Text, null, h(Text, { color: c('violet'), bold: true }, T.LABEL), h(Text, { color: c('dim') }, ' ' + '─'.repeat(Math.max(1, cols - T.LABEL.length - 1)))),
       h(Text, { color: c('dim') }, clip(T.LABEL_SUB, cols)));
+    case 'ask': return h(AskCard, { text: item.text, cols }); // QUOXON-ASK: the same card as an approval
     case 'guide': return h(Box, { marginTop: item.gap === false ? 0 : 1, paddingLeft: 2 }, h(Para, { width: cols - 2, color: c(item.tone || 'text'), bold: Boolean(item.bold), text: item.text }));
     case 'dim': return h(Box, { paddingLeft: 2 }, h(Para, { width: cols - 2, color: c(item.tone || 'dim'), text: item.text }));
     case 'cmd': return h(Box, { paddingLeft: 4 }, h(Para, { width: cols - 4, color: c('sky'), text: item.text }));
@@ -95,7 +101,7 @@ const Hint = ({ text, cols }) => h(Box, { paddingLeft: 2 }, h(Text, { color: c('
 
 // ---- the view ---------------------------------------------------------------------------------
 export function GettingStarted({
-  columns, version = '0.2.0', cwd = '', welcome = false, animateIntro, earlyInput = null,
+  columns, version = '0.3.1', cwd = '', welcome = false, animateIntro, earlyInput = null,
   journeyPath, dryRun = false, runner = null, preflightDeps, runChecks = runPreflight, findOllama = detectOllama,
   requestCredential, broker = null, finisher = null, onExit = () => {}, now = () => Date.now()
 }) {
@@ -114,7 +120,7 @@ export function GettingStarted({
     const items = [introItem, ...(welcome ? [{ id: 'welcome', kind: 'welcome', version: packageVersion() }] : []), { id: 'hdr', kind: 'header' }];
     if (resumeAt) {
       items.push({ id: 'resume', kind: 'guide', text: T.RESUME });
-      if (saved.request) items.push({ id: 'resumeReq', kind: 'dim', text: T.resumeRequest(saved.request) });
+      if (saved.request) items.push({ id: 'resumeReq', kind: 'dim', text: T.resumeRequest(requestText(saved.request)) });
     } else {
       items.push({ id: 'greet', kind: 'guide', text: T.GREETING_REST }, { id: 'q', kind: 'guide', text: T.QUESTION }, { id: 'ex', kind: 'list', items: T.EXAMPLES, numbered: true });
     }
@@ -122,7 +128,7 @@ export function GettingStarted({
   };
 
   const S = React.useRef({
-    history: [], step: 'ask', input: '', intent: saved?.intent || null, request: saved?.request || null, provider: null,
+    history: [], step: 'ask', input: '', intent: saved?.intent || null, request: saved?.request ? requestText(saved.request) : null, provider: saved?.provider === 'skip' ? 'skip' : null,
     rows: [], fixNote: null, options: [], sel: 1, flash: null, install: null, logs: [], showLog: false, done: false, secret: null,
     installStage: saved?.installStage || null, installDir: saved?.installDir || null, dashboardUrl: saved?.dashboardUrl || null,
     ownerEmail: saved?.ownerEmail || null, finRows: [], stopping: false, vault: null
@@ -139,7 +145,7 @@ export function GettingStarted({
 
   // ---- intro (Orbit & Lock), then the opening lines move into <Static> --------------------------
   const animating = animateIntro ?? introAnimates(stdout?.isTTY);
-  // Orbit & Lock, then the Q says hello (T.HELLO decodes in beside it); rarely the Dragon's Eye after that.
+  // Orbit & Lock, then the Q says hello (T.HELLO decodes in beside it); rarely the dragon's googly-eye greeting after that.
   const eye = React.useMemo(() => (animating && animateIntro === undefined ? launchEgg({ tty: Boolean(stdout?.isTTY) }) : false), []);
   const introMs = helloIntroMs({ eye, text: T.HELLO });
   const introStart = React.useRef(Date.now());
@@ -173,7 +179,7 @@ export function GettingStarted({
 
   function offerLines() {
     const items = [{ kind: 'guide', text: T.OFFER }];
-    items.push({ kind: 'guide', text: T.OFFER_ASK, bold: true, gap: false }, { kind: 'dim', text: T.ALREADY });
+    items.push({ kind: 'ask', text: T.OFFER_ASK }, { kind: 'dim', text: T.ALREADY });
     push(...items);
     set({ step: 'offer' });
     persist();
@@ -184,7 +190,7 @@ export function GettingStarted({
     if (m.intent === 'empty') return;
     push({ kind: 'user', text });
     if (m.intent === 'connect') { push({ kind: 'guide', text: T.CONNECT_INTENT_LINE }); set({ step: 'ask' }); return; }
-    set({ intent: m.intent, request: text });
+    set({ intent: m.intent, request: requestText(text) });
     push({ kind: 'guide', text: m.intent === 'offscript' ? T.DEFERRAL : T.INTENT_LINES[m.intent] });
     offerLines();
   }
@@ -197,7 +203,7 @@ export function GettingStarted({
     if (conn) {
       push({ kind: 'user', text: t });
       if (!conn.ok) { push({ kind: 'dim', tone: 'warn', text: conn.reason === 'url' ? T.connectBadUrl(conn.value) : T.CONNECT_USAGE }); return true; }
-      push({ kind: 'guide', text: T.connectHandoff(conn.url) });
+      push({ kind: 'guide', text: T.connectChecking(conn.url) });
       exit({ action: 'connect', url: conn.url });
       return true;
     }
@@ -233,6 +239,11 @@ export function GettingStarted({
 
   async function toCredential() {
     set({ rows: [] });
+    if (S.current.provider === 'skip') { // Z2H-R2B: the owner already chose "Skip for now"; never re-ask on resume (/connect stays open)
+      push({ kind: 'guide', tone: 'warn', text: T.CRED_SKIPPED });
+      startInstall();
+      return;
+    }
     const ollama = await findOllama();
     if (!live.current || S.current.done) return;
     const options = credentialOptions({ ollama });
@@ -250,8 +261,10 @@ export function GettingStarted({
       const held = await requestCredential(opt.id); // THE hook: K1 secure card once it merges
       if (!live.current || S.current.done) { held?.drop?.(); return; }
       if (!held) { set({ step: 'credential', input: '' }); return; }
-      push({ kind: 'user', text: opt.label }, { kind: 'guide', tone: 'ok', text: T.credHeld(opt.label, held.fingerprint) });
+      push({ kind: 'user', text: opt.label }, { kind: 'guide', tone: 'ok', text: T.credHeld(opt.label, held.fingerprint) }, ...(needsConsent(opt.id) ? [{ kind: 'guide', text: T.credConsent(opt.label) }] : []));
       set({ secret: held, input: '' });
+      if (needsConsent(opt.id)) { set({ step: 'cloudConsent', cloudConsent: null }); return; } // ask once; the answer is the user's own
+
     } else if (opt.id === 'ollama' && !opt.detected) {
       set({ step: 'ollamaUrl', input: '' }); // B3: nothing answered locally; ask for the LAN URL
       return;
@@ -261,6 +274,13 @@ export function GettingStarted({
     startInstall();
   }
 
+  function answerCloudConsent(yes) {
+    const p = S.current.provider; const who = providerLabel(p);
+    push({ kind: 'user', text: yes ? 'yes' : 'no' }, { kind: 'guide', tone: yes ? 'ok' : 'warn', text: yes ? T.credConsentYes(who) : T.credConsentNo(who, p) });
+    set({ cloudConsent: yes });
+    startInstall();
+  }
+
   function submitOllamaUrl() {
     const url = normaliseOllamaUrl(S.current.input);
     if (!url) { set({ flash: T.OLLAMA_URL_BAD }); return; }
@@ -300,6 +320,7 @@ export function GettingStarted({
         if (!live.current) return;
         if (ev.type === 'log') set(s => ({ logs: [...s.logs, ev.line].slice(-8) }));
         if (ev.type === 'script') push({ kind: 'long', tone: 'dim', gap: false, text: T.installScript(ev.url, ev.sha256, ev.bytes), lead: T.installScriptLead(ev.url, ev.bytes), value: ev.sha256 });
+        if (ev.type === 'stage-label') set(s => ({ install: { ...s.install, stages: s.install.stages.map(x => (x.id === ev.id ? { ...x, body: ev.label } : x)) } }));
         if (ev.type === 'stage') set(s => ({ install: { ...s.install, stages: s.install.stages.map(x => (x.id === ev.id ? { ...x, status: ev.status, startedAt: ev.status === 'running' ? ev.at : x.startedAt, ms: ev.ms ?? x.ms, earlier: Boolean(ev.earlier) } : x)) } }));
       }
     });
@@ -308,9 +329,10 @@ export function GettingStarted({
     if (res.interrupted || S.current.stopping) {
       push({ kind: 'dim', text: T.INSTALL_STOPPED }); persist({ step: 'install' }); exit({ action: 'exit' }); return;
     }
+    if (res.logPath) set({ installLogPath: res.logPath });
     if (res.dashboardUrl) set({ dashboardUrl: res.dashboardUrl });
     const rows = S.current.install.stages.map(st => ({ ...st, tail: st.earlier ? T.INSTALL_EARLIER : st.ms != null ? fmtS(st.ms) : '' }));
-    if (!res.ok) { set(s => ({ step: 'installFail', install: { ...s.install, failed: res.failedStage || '?', degraded: Boolean(res.degraded), error: res.error || null } })); persist({ step: 'install' }); return; }
+    if (!res.ok) { set(s => ({ step: 'installFail', install: { ...s.install, failed: res.failedStage || '?', degraded: Boolean(res.degraded), error: res.error || null, logPath: res.logPath || null, cause: res.cause?.message || null } })); persist({ step: 'install' }); return; }
     push({ kind: 'guide', text: T.INSTALL_TITLE + (dry ? ` (${T.INSTALL_DRY})` : ''), bold: true }, { kind: 'rows', rows });
     if (dry || !finisher) { finale({ dashboardUrl: res.dashboardUrl, dry }); return; }
     toOwner();
@@ -351,6 +373,7 @@ export function GettingStarted({
       { id: 'account', name: F.account.name, status: 'running', body: F.account.running },
       { id: 'signin', name: F.signin.name, status: 'pending', body: F.signin.running },
       { id: 'vault', name: F.vault.name, status: 'pending', body: S.current.secret ? F.vault.running(opt?.label || 'key') : F.vault.skipped },
+      ...(S.current.cloudConsent === true ? [{ id: 'consent', name: F.consent.name, status: 'pending', body: F.consent.running(providerLabel(S.current.provider)) }] : []),
       { id: 'link', name: F.link.name, status: 'pending', body: F.link.running }
     ];
     const row = (id, patch) => set(s => ({ finRows: s.finRows.map(r => (r.id === id ? { ...r, ...patch } : r)) }));
@@ -385,15 +408,27 @@ export function GettingStarted({
     }
     set({ vault });
 
+    if (S.current.cloudConsent === true && finisher.grantConsent) { // the owner said yes at the credential step
+      row('consent', { status: 'running' });
+      const g = await finisher.grantConsent(S.current.provider);
+      if (!live.current || S.current.done) return;
+      const who = providerLabel(S.current.provider);
+      row('consent', g?.ok ? { status: 'ok', body: F.consent.ok(who) } : { status: 'warn', body: F.consent.fail(g?.error || 'unknown error', S.current.provider) });
+    }
+
     row('link', { status: 'running' });
     const link = await finisher.loginLink(S.current.dashboardUrl);
     if (!live.current || S.current.done) return;
     row('link', link.ok ? { status: 'ok', body: F.link.ok } : { status: 'warn', body: F.link.fail(link.error) });
 
+    // Z2H-R5 E: only mention adding a host where this install can serve its host installer (unknown = as before).
+    let hostsAvailable = true;
+    try { const hi = finisher.hostInstaller ? await finisher.hostInstaller() : null; if (hi && hi.ok === false && Number(hi.status) >= 400) hostsAvailable = false; } catch { /* unknown */ }
+    if (!live.current || S.current.done) return;
     push({ kind: 'guide', text: T.FINISH_TITLE, bold: true }, { kind: 'rows', rows: S.current.finRows });
     if (vault) push({ kind: 'dim', text: vault.ok ? T.KEY_GONE_AFTER : `${T.KEY_GONE_AFTER} ${T.keyNotStored(vault.provider || S.current.provider)}` });
     set({ finRows: [] });
-    finale({ dashboardUrl: S.current.dashboardUrl, link: link.ok ? link.url : null, dry: false });
+    finale({ dashboardUrl: S.current.dashboardUrl, link: link.ok ? link.url : null, dry: false, hostsAvailable });
   }
 
   function replayText() {
@@ -402,7 +437,7 @@ export function GettingStarted({
     return request;
   }
 
-  function finale({ dashboardUrl, link = null, dry }) {
+  function finale({ dashboardUrl, link = null, dry, hostsAvailable = true }) {
     const items = [];
     const intent = S.current.intent && T.TIPS[S.current.intent] ? S.current.intent : 'explore';
     if (dry) items.push({ kind: 'guide', tone: 'warn', text: T.FINALE_DRY_BANNER });
@@ -414,9 +449,11 @@ export function GettingStarted({
     else items.push({ kind: 'long', text: T.finaleDashboardPlain(url), lead: T.FINALE_DASHBOARD_LEAD_PLAIN, value: url });
     items.push({ kind: 'guide', gap: false, text: T.FINALE_PROOF });
     if (!dry) items.push({ kind: 'dim', text: T.FINALE_CERT });
+    if (!dry && S.current.installLogPath) items.push({ kind: 'dim', text: T.INSTALL_LOG_PATH(S.current.installLogPath) });
     items.push({ kind: 'guide', text: T.FINALE_TIPS_TITLE }, { kind: 'list', items: dry ? T.FINALE_TIPS : T.TIPS[intent] });
     const noAi = !dry && (S.current.provider === 'skip' || (S.current.vault && !S.current.vault.ok));
-    if (!dry) items.push({ kind: 'guide', text: noAi ? T.k2NoAi(S.current.provider === 'anthropic' ? 'anthropic' : 'openai') : T.K2[intent] });
+    if (noAi && hostsAvailable) items.push({ kind: 'guide', text: T.FINALE_HOSTS_NO_AI });
+    if (!dry) items.push({ kind: 'guide', text: noAi ? T.k2NoAi(S.current.provider === 'anthropic' ? 'anthropic' : 'openai') : (!hostsAvailable && intent === 'servers' ? T.K2_SERVERS_NO_INSTALLER : T.K2[intent]) });
     push(...items);
     S.current.secret?.drop?.();
     set({ step: 'finale', secret: null, finaleDry: dry });
@@ -455,15 +492,23 @@ export function GettingStarted({
           toCredential();
         }
         else if (ev.type === 'text' && /^q$/i.test(ev.text)) { push({ kind: 'dim', text: T.BYE }); persist({ step: 'preflight' }); exit({ action: 'exit' }); }
+        else if (ev.type === 'text' && /^y$/i.test(ev.text) && !dryRun) { // FIRSTRUN: the guide fixes Docker itself
+          const offer = dockerOffer(s.rows);
+          if (offer) { push({ kind: 'ask', text: offer.ask }, { kind: 'user', text: 'yes' }); persist({ step: 'preflight' }); exit({ action: 'docker', kind: offer.kind }); }
+        }
         return;
       case 'credential': {
         const n = s.options.length;
-        if (ev.type === 'key' && ev.name === 'up') set({ sel: (s.sel - 1 + n) % n, flash: null });
-        else if (ev.type === 'key' && (ev.name === 'down' || ev.name === 'tab')) set({ sel: (s.sel + 1) % n, flash: null });
+        if (ev.type === 'key' && ev.name === 'up') set({ sel: nextSelectable(s.options, s.sel, -1), flash: null }); // #1288: never land on a disabled row
+        else if (ev.type === 'key' && (ev.name === 'down' || ev.name === 'tab')) set({ sel: nextSelectable(s.options, s.sel, 1), flash: null });
         else if (ev.type === 'key' && ev.name === 'enter') choose(s.options[s.sel]);
         else if (ev.type === 'text' && /^[1-9]$/.test(ev.text) && Number(ev.text) <= n) { set({ sel: Number(ev.text) - 1 }); choose(s.options[Number(ev.text) - 1]); }
         return;
       }
+      case 'cloudConsent':
+        if (ev.type === 'text' && /^y(es)?$/i.test(ev.text.trim())) answerCloudConsent(true);
+        else if ((ev.type === 'text' && /^n(o)?$/i.test(ev.text.trim())) || (ev.type === 'key' && (ev.name === 'enter' || ev.name === 'escape'))) answerCloudConsent(false);
+        return;
       case 'install': if (ev.type === 'text' && /^v$/i.test(ev.text)) set({ showLog: !s.showLog }); return;
       case 'installStop':
         if (ev.type === 'text' && /^y/i.test(ev.text)) stopInstall();
@@ -484,7 +529,7 @@ export function GettingStarted({
     }
   };
   function stopInstall() {
-    push({ kind: 'dim', text: T.INSTALL_STOP_ASK }, { kind: 'user', text: 'yes' });
+    push({ kind: 'ask', text: T.INSTALL_STOP_ASK }, { kind: 'user', text: 'yes' });
     set({ stopping: true, step: 'install' });
     S.current.abort?.abort?.(); // the runner stops the installer's process group; startInstall then exits
   }
@@ -549,7 +594,11 @@ export function GettingStarted({
       case 'preflight': case 'preflightFail':
         liveParts.push(h(Box, { key: 'pf', marginTop: 1, paddingLeft: 2 }, h(Text, { bold: true, color: c('text') }, T.PREFLIGHT_TITLE)),
           ...s.rows.map((r) => h(CheckRow, { key: r.id, r, cols })));
-        if (s.step === 'preflightFail') liveParts.push(h(Box, { key: 'pfn', marginTop: 1, paddingLeft: 2, width: cols }, h(Para, { width: cols - 2, color: c('warn'), text: s.fixNote })), h(Hint, { key: 'h', text: dryRun ? T.PREFLIGHT_RETRY_DRY : T.PREFLIGHT_RETRY, cols }));
+        if (s.step === 'preflightFail') {
+          const offer = dryRun ? null : dockerOffer(s.rows); // FIRSTRUN: offer, never "go and do this"
+          if (offer) liveParts.push(h(Box, { key: 'pfo', marginTop: 1 }, h(AskCard, { text: offer.ask, cols })), h(Hint, { key: 'h', text: T.DOCKER_OFFER_HINT, cols }));
+          else liveParts.push(h(Box, { key: 'pfn', marginTop: 1, paddingLeft: 2, width: cols }, h(Para, { width: cols - 2, color: c('warn'), text: s.fixNote })), h(Hint, { key: 'h', text: dryRun ? T.PREFLIGHT_RETRY_DRY : T.PREFLIGHT_RETRY, cols }));
+        }
         break;
       case 'credential':
         liveParts.push(h(Box, { key: 'opts', flexDirection: 'column', marginTop: 1 }, ...s.options.map((o, i) => {
@@ -573,6 +622,11 @@ export function GettingStarted({
           h(Text, { color: c('violet') }, '─'.repeat(cols))));
         break;
       }
+      case 'cloudConsent':
+        liveParts.push(h(Box, { key: 'cc', flexDirection: 'column', marginTop: 1 },
+          h(AskCard, { text: T.credConsentAsk(providerLabel(s.provider)), cols }),
+          h(Hint, { text: T.CRED_CONSENT_HINT, cols })));
+        break;
       case 'ollamaUrl':
         liveParts.push(h(Box, { key: 'card', flexDirection: 'column', marginTop: 1 },
           h(Text, { color: c('violet') }, '─'.repeat(cols)),
@@ -606,10 +660,13 @@ export function GettingStarted({
         if (s.step === 'installFail') {
           liveParts.push(h(Box, { key: 'if', paddingLeft: 2, width: cols, marginTop: 1, flexDirection: 'column' },
             h(Para, { width: cols - 2, color: c('fail'), text: T.INSTALL_FAILED(T.STAGES[s.install.failed] || s.install.failed) }),
+            s.install.cause ? h(Para, { width: cols - 2, color: c('warn'), text: s.install.cause }) : null, // FIRSTRUN: why, in one line
             s.install.error ? h(Para, { width: cols - 2, color: c('dim'), text: s.install.error }) : null,
+            s.install.logPath ? h(Para, { width: cols - 2, color: c('dim'), text: T.INSTALL_LOG_PATH(s.install.logPath) }) : null,
+            s.install.logPath ? h(Para, { width: cols - 2, color: c('dim'), text: T.INSTALL_RERUN_HINT }) : null,
             s.install.degraded ? h(Para, { width: cols - 2, color: c('warn'), text: T.INSTALL_DEGRADED }) : null));
         }
-        if (s.step === 'installStop') liveParts.push(h(Box, { key: 'stop', paddingLeft: 2, width: cols, marginTop: 1 }, h(Para, { width: cols - 2, color: c('warn'), bold: true, text: T.INSTALL_STOP_ASK })));
+        if (s.step === 'installStop') liveParts.push(h(Box, { key: 'stop', width: cols }, h(AskCard, { text: T.INSTALL_STOP_ASK, cols })));
         liveParts.push(h(Hint, { key: 'h', text: s.step === 'installFail' ? T.INSTALL_FAIL_HINT : s.step === 'installStop' ? 'y to stop · n or Enter to carry on' : T.INSTALL_HINT, cols }));
         break;
       }

package/lib/quoxon/orgLabel.js

@@ -0,0 +1,10 @@
+/** The org as the status line shows it: its name, or a short "org …H398" until the name arrives. Never a raw ULID. */
+const ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
+export const isOrgId = (s) => ULID.test(String(s || '').trim());
+export function orgLabel(name, id = null) {
+  const n = name == null ? '' : String(name).trim();
+  if (n && !isOrgId(n)) return n;
+  const raw = isOrgId(n) ? n : (id ? String(id).trim() : '');
+  if (!raw) return null;
+  return isOrgId(raw) ? `org …${raw.slice(-4)}` : raw; // only a real ULID is masked
+}

package/lib/quoxon/orgSwitch.js

@@ -0,0 +1,33 @@
+/** /org helpers (pure). Org list rows, fuzzy match, and the lines the command prints. QUOXON-FW3. */
+const norm = (s) => String(s ?? '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
+
+export const orgRows = (list) => (Array.isArray(list) ? list : []).map((o) => ({ id: o.id, name: o.name || o.slug || o.id, slug: o.slug || null, role: o.role || null }));
+
+/**
+ * Resolve a typed name or id against the user's orgs. Exact id, exact slug/name, then every word of the
+ * query found in the name or slug (so "hot tubs hampshire" finds "Hot Tubs Hampshire Ltd"). Never guesses between ties.
+ * -> { org } | { ambiguous: [orgs] } | { none: true }
+ */
+export function matchOrg(query, list) {
+  const rows = orgRows(list);
+  const q = norm(query);
+  if (!q) return { none: true };
+  // An exact slug wins outright, so a slug never ties with another org's look-alike name (#1141).
+  const bySlug = rows.filter((o) => o.slug && o.slug === String(query).trim());
+  if (bySlug.length === 1) return { org: bySlug[0] };
+  const exact = rows.filter((o) => String(o.id).toLowerCase() === String(query).trim().toLowerCase() || norm(o.slug) === q || norm(o.name) === q);
+  if (exact.length === 1) return { org: exact[0] };
+  if (exact.length > 1) return { ambiguous: exact };
+  const words = q.split(' ');
+  const fuzzy = rows.filter((o) => { const hay = `${norm(o.name)} ${norm(o.slug)}`; return words.every((w) => hay.includes(w)); });
+  if (fuzzy.length === 1) return { org: fuzzy[0] };
+  if (fuzzy.length > 1) return { ambiguous: fuzzy };
+  return { none: true };
+}
+
+/** One line per org; the current one is marked. */
+export function orgLines(list, currentId) {
+  const rows = orgRows(list);
+  const w = Math.min(36, Math.max(4, ...rows.map((o) => [...o.name].length)));
+  return rows.map((o) => `${o.id === currentId ? '* ' : '  '}${o.name.padEnd(w)}  ${o.slug || o.id}${o.role ? `  (${o.role})` : ''}`);
+}

package/lib/quoxon/ownBroadcast.js

@@ -0,0 +1,22 @@
+/**
+ * Your own broadcast is not news to you: the fan-out reaches every held slot in the org, including this window's, and
+ * the "BROADCAST sent" card already told the sender. Match by the sender's identity, never by text.
+ */
+import { parseBroadcastText } from './slash/broadcast.js';
+
+const norm = (s) => String(s || '').toLowerCase().replace(/\s*\(.*?\)\s*/g, ' ').replace(/\s+/g, ' ').trim();
+
+/**
+ * @param {object} m           the slot message
+ * @param {object} me          { label: this window's sender label, display: the signed-in display name, userId }
+ */
+export function isOwnBroadcast(m, me = {}) {
+  const bc = parseBroadcastText(m?.text);
+  if (!bc) return false;
+  const uid = me.userId ? String(me.userId) : null;
+  if (uid && [m.user_id, m.from_user_id, m.author_user_id, m.author_id].some((x) => x != null && String(x) === uid)) return true;
+  const sender = norm(bc.sender), from = norm(m.from);
+  const mine = [me.label, me.display].map(norm).filter(Boolean);
+  if (!mine.length) return false;
+  return mine.some((x) => x === sender || x === from) || (me.label && m.from === me.label) || false;
+}

package/lib/quoxon/palette.js

@@ -0,0 +1,43 @@
+/**
+ * The semantic palette (QUOXON-FW11). One role per MEANING, so a reader can see where prose stops and a thing
+ * they can type starts:
+ *
+ *   prose    default text. White on dark, ink on light. Never grey.
+ *   command  anything the user can type: /slash commands, `quox ...`, !bang, flags and args INCLUDED. The whole
+ *            command is ONE span in ONE colour (never split into differently coloured parts).
+ *   value    ids, names, numbers, paths, URLs (theme role `id`; theme's `value` stays the near-white card text).
+ *   ok / warn / error   state. Carried by a glyph or label ("⚠"), never by tinting the sentence, so commands and
+ *            values inside keep their own colours.
+ *   brand    Quox purple: chrome only (logo, status-bar labels, headers). Never a command inside prose.
+ *   quiet    secondary text and rules: a tinted, readable shade (never a mid-grey).
+ *
+ * Both tables: [truecolor hex, ansi256 index]. DARK >= 4.5:1 on #000, LIGHT >= 4.5:1 on #fff (tests).
+ */
+export const SEMANTIC_DARK = {
+  prose: ['#f1f5f9', 255], command: ['#2dd4bf', 80], value: ['#93c5fd', 117],
+  ok: ['#4ade80', 78], warn: ['#f59e0b', 214], error: ['#f87171', 210],
+  brand: ['#a855f7', 135], quiet: ['#bcc8e8', 189], rule: ['#7c8fe0', 105]
+};
+export const SEMANTIC_LIGHT = {
+  prose: ['#0f172a', 234], command: ['#0f766e', 30], value: ['#1d4ed8', 26],
+  ok: ['#15803d', 28], warn: ['#b45309', 130], error: ['#b91c1c', 124],
+  brand: ['#7e22ce', 91], quiet: ['#3b4f87', 60], rule: ['#7280c8', 104]
+};
+export const SEMANTIC_ROLES = Object.keys(SEMANTIC_DARK);
+
+/** Is this hex a mid-grey? Low saturation in the middle of the lightness range (white and ink are allowed). */
+export function isGrey(hex) {
+  const [r, g, b] = [1, 3, 5].map(i => parseInt(hex.slice(i, i + 2), 16) / 255);
+  const max = Math.max(r, g, b), min = Math.min(r, g, b), l = (max + min) / 2, d = max - min;
+  const s = d === 0 ? 0 : d / (1 - Math.abs(2 * l - 1));
+  return s < 0.25 && l > 0.2 && l < 0.85;
+}
+
+// ---- inline markup used by every notice producer --------------------------------------------------
+// ⟦text⟧ = a command (one span, markers dropped on screen). ⟪text⟫ = a value. Helpers build them. (Not backticks:
+// plain backticks already appear literally in notices.)
+export const cmd = (s) => `⟦${s}⟧`;
+export const val = (s) => `⟪${s}⟫`;
+export const MARK = /⟦([^⟧\n]+)⟧|⟪([^⟫\n]+)⟫/g;
+/** The on-screen characters of marked-up text (markers dropped). Use for width and wrapping. */
+export const stripMarks = (s) => String(s ?? '').replace(MARK, (_, a, b) => a ?? b);

package/lib/quoxon/print.js

@@ -7,6 +7,7 @@
 import { textGate } from './events.js';
 import { streamFields, fallbackNote } from './model.js';
 import { connectOfferFor } from './connect.js';
+import { isConsentError, consentPrintMessage } from './consent.js';
 
 export const EXIT = { ok: 0, error: 1, approval: 2, interrupted: 3, auth: 4, unconfirmed: 5 };
 
@@ -28,7 +29,7 @@ const isAuth = (e) => e?.status === 401 || /valid jwt|service key|unauthor|not a
 const newTurnId = () => `QXN_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
 
 /** Runs one turn. out/err are write(string) sinks. Returns the exit code. */
-export async function runPrint({ api, prompt, output = 'text', conversation = null, turnId = newTurnId(), timeoutS = 0, color = false, stopGraceMs = 8000, context = undefined, choice = null, promptProfile = undefined, out, err }) {
+export async function runPrint({ api, prompt, agent = 'quox', output = 'text', conversation = null, turnId = newTurnId(), timeoutS = 0, color = false, stopGraceMs = 8000, context = undefined, choice = null, promptProfile = undefined, profile = null, out, err }) {
   if (!prompt || !prompt.trim()) { err('quox: empty prompt (pass --print "<prompt>" or pipe it on stdin)\n'); return EXIT.error; }
   const ctrl = new AbortController();
   let abandoned = false, graceTimer = null;
@@ -45,10 +46,10 @@ export async function runPrint({ api, prompt, output = 'text', conversation = nu
   const sum = { tools: 0, approvals: 0, receipts: [] };
   let convo = conversation, doneSession = null, status = null, text = '', sawApproval = false, errorMsg = null, authFail = false;
   const seen = new Set();
-  let offer = null;
+  let offer = null, handoff = null;
   let gate = null;
   try {
-    for await (const ev of api.stream({ turnId, message: prompt, agent: 'quox', conversationId: conversation, context, ...streamFields(choice), ...(promptProfile ? { promptProfile } : {}) }, ctrl.signal)) {
+    for await (const ev of api.stream({ turnId, message: prompt, agent: agent || 'quox', conversationId: conversation, context, ...streamFields(choice), ...(promptProfile ? { promptProfile } : {}), ...(timeoutS > 0 ? { turnBudgetMs: timeoutS * 1000 } : {}) }, ctrl.signal)) {
       if (output === 'json') out(JSON.stringify(ev) + '\n');
       const fb = fallbackNote(choice, ev);
       if (fb) err(`quox: ${fb}\n`);
@@ -61,8 +62,9 @@ export async function runPrint({ api, prompt, output = 'text', conversation = nu
       else if (ev.type === 'tool.finished') { if (!seen.has(ev.call_id)) { seen.add(ev.call_id); sum.tools++; } if (ev.receipt?.ward_seq != null) sum.receipts.push(ev.receipt.ward_seq); }
       else if (ev.type === 'approval.requested') { sawApproval = true; sum.approvals++; }
       else if (ev.type === 'approval.resolved') sawApproval = false;
+      else if (ev.type === 'turn.handoff_suggested' && ev.handoff_suggested?.agent) handoff = ev.handoff_suggested; // QUOXON handoff offer
       else if (ev.type === 'turn.finished') status = ev.status || 'completed';
-      else if (ev.type === 'error') errorMsg = ev.error || 'stream error';
+      else if (ev.type === 'error') errorMsg = isConsentError(ev) ? consentPrintMessage(ev, profile) : (ev.error || 'stream error');
     }
   } catch (e) {
     if (ctrl.signal.aborted) { status = 'abandoned'; errorMsg = `timed out after ${timeoutS}s; the server was not confirmed stopped`; }
@@ -83,12 +85,14 @@ export async function runPrint({ api, prompt, output = 'text', conversation = nu
   if (!status) status = authFail ? 'auth' : 'failed';
 
   if (output === 'json') {
-    out(JSON.stringify({ type: 'summary', status, turn_id: turnId, conversation_id: convo, duration_ms: Date.now() - t0, server_stopped: serverStopped, ...sum }) + '\n');
+    out(JSON.stringify({ type: 'summary', status, turn_id: turnId, conversation_id: convo, duration_ms: Date.now() - t0, server_stopped: serverStopped, ...sum, ...(handoff ? { handoff_suggested: handoff } : {}) }) + '\n');
   } else if (text) out(text.endsWith('\n') ? text : text + '\n');
   if (authFail) err(`Not signed in for chat. Run: quox login -p <profile>\n`);
   else if (code === EXIT.approval) err('Held for approval: approve it in the dashboard or with `quox` /approvals.\n');
   else if (code === EXIT.unconfirmed) err('quox: Ended without confirmation from the server\n');
   else if (errorMsg) err(`quox: ${errorMsg}\n`);
   if (offer && code !== EXIT.ok) err(`${offer}\n`);
+  // QUOXON handoff offer: no y/N here, so name the exact one-turn command (same question, same conversation).
+  if (handoff && output !== 'json' && code === EXIT.ok) err(`quox: ${handoff.reason ? `${String(handoff.reason).replace(/\s+$/, '')} ` : ''}${handoff.name || handoff.agent} can answer it: quox --print --agent ${handoff.agent}${convo ? ` --conversation ${convo}` : ''} ${JSON.stringify(prompt)}\n`);
   return code;
 }

package/lib/quoxon/profileSwitch.js

@@ -0,0 +1,53 @@
+// PROFILE-SWITCH (owner 2026-10-16): switch this window between logged-in profiles with one y, never automatically.
+import { askText } from './ask.js';
+
+/**
+ * The App's api, swappable in place: every reader (and every controller built at mount) goes through this proxy,
+ * so a profile switch replaces ref.current.live and the whole window follows. Methods are bound to the live api.
+ */
+export function liveApi(ref) {
+  return new Proxy({}, {
+    get(_, k) {
+      const a = ref.current?.live;
+      if (a == null) return undefined;
+      const v = a[k];
+      return typeof v === 'function' ? v.bind(a) : v;
+    },
+    has(_, k) { const a = ref.current?.live; return a != null && k in Object(a); },
+  });
+}
+
+/** The ask card offering to switch an agent-login window to a human login. */
+export const switchAskLine = (profile, human) => askText('Switch?', {
+  title: `This window is an agent login (${profile}).`,
+  action: `switch this window to your login '${human}' (same conversation, attach, slot and groups)`,
+});
+
+/** The ask card for a /slot name that does not exist (the near misses are said on the line above). */
+export const slotCreateAskLine = (nm) => askText('Create it?', { title: `No slot ${nm}.`, action: `create and hold slot ${nm}` });
+
+/** A local run request (the shared run card): sign a profile in with the real `quox login`, terminal handed over. */
+export function loginRunRequest(name, why, now = Date.now()) {
+  return { id: null, cmd: `quox login -p ${name}`, why, who: 'Quox', runnable: true, refuse: null, danger: null, expiresAt: now + 120000 };
+}
+
+/** A safe profile name to put on a command line (letters, digits, . _ -). */
+export const okProfileName = (n) => /^[A-Za-z0-9._-]{1,64}$/.test(String(n || ''));
+
+/**
+ * /profile chooser rows (PROFILE-CHOOSER): signed-in profiles first (this window's marked), then profiles on this
+ * machine that are not signed in, then the current login's orgs (the window's org marked). Each row carries `pick`:
+ * { profile } switches this window in place, { login } offers `quox login -p`, { org } goes through /org switch
+ * (window-scoped since #1034, confirmed first). Nothing here writes the shared default profile.
+ */
+export function profileChooserRows({ current, humanProfiles = [], loginCandidates = [], orgs = [], orgId = null }) {
+  const names = [...new Set([current, ...humanProfiles].filter(okProfileName))];
+  const later = loginCandidates.filter(n => okProfileName(n) && !names.includes(n));
+  const orgList = (Array.isArray(orgs) ? orgs : []).map(o => ({ id: o.id, name: o.name || o.slug || o.id, slug: o.slug || null, role: o.role || null }));
+  const w = Math.min(28, Math.max(8, ...[...names, ...later].map(n => n.length + 8), ...orgList.map(o => [...o.name].length + 4)));
+  const rows = [];
+  for (const n of names) rows.push({ key: `${n === current ? '* ' : '  '}${`profile ${n}`.padEnd(w)}`, text: n === current ? 'this window' : 'signed in: switch this window to it', pick: { profile: n } });
+  for (const n of later) rows.push({ key: `  ${`profile ${n}`.padEnd(w)}`, text: 'not signed in: offers quox login', pick: { login: n } });
+  for (const o of orgList) rows.push({ key: `${o.id === orgId ? '* ' : '  '}${`org ${o.name}`.padEnd(w)}`, text: `${o.slug || o.id}${o.role ? `  (${o.role})` : ''}${o.id === orgId ? '  this window' : ''}`, pick: { org: o } });
+  return rows;
+}

package/lib/quoxon/promptHistory.js

@@ -0,0 +1,41 @@
+/**
+ * QUOXON-HISTORY: what the user typed, kept across quox runs so Up recalls it (most recent first), like a shell.
+ * Local only (~/.quox/history.jsonl, mode 0600), capped. The caller never offers it anything that looks like a key:
+ * keys, PINs and /connect secrets are refused before they reach history.
+ */
+import { readFileSync, appendFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, dirname } from 'node:path';
+
+export const HISTORY_CAP = 500;
+export const defaultHistoryPath = (home = homedir()) => join(home, '.quox', 'history.jsonl');
+
+/** -> { load(): string[] oldest first, add(text) } on the given file. Every failure is quiet: history is a convenience. */
+export function fileHistory(path = defaultHistoryPath(), { cap = HISTORY_CAP } = {}) {
+  const load = () => {
+    try {
+      const out = [];
+      for (const ln of readFileSync(path, 'utf8').split('\n')) {
+        if (!ln) continue;
+        try { const t = JSON.parse(ln)?.t; if (typeof t === 'string' && t) out.push(t); } catch { /* a torn line */ }
+      }
+      return out.slice(-cap);
+    } catch { return []; }
+  };
+  const add = (text) => {
+    try {
+      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+      appendFileSync(path, JSON.stringify({ t: text }) + '\n', { mode: 0o600 });
+      if (statSync(path).size > cap * 400) { const keep = load(); writeFileSync(path, keep.map(t => JSON.stringify({ t })).join('\n') + '\n', { mode: 0o600 }); }
+    } catch { /* read-only home: this run still has it in memory */ }
+  };
+  return { load, add };
+}
+
+/** Push onto the in-memory list, skipping an exact repeat of the last entry (shell ignoredups). -> true when added. */
+export function pushHistory(list, text) {
+  if (typeof text !== 'string' || !text.trim()) return false;
+  if (list.length && list[list.length - 1] === text) return false;
+  list.push(text);
+  return true;
+}

package/lib/quoxon/providers.js

@@ -0,0 +1,48 @@
+/**
+ * Provider availability, one source of truth for /model, /connect, /doctor and /capabilities (R3 audit D5:
+ * the Claude subscription used to tell five different stories).
+ *
+ * The SERVER decides: GET /api/v1/capabilities reports `provider.<id>` from real signals (org vault keys,
+ * instance keys, the server's Claude sign-in). The org vault list only adds detail (which credential, a
+ * stored-but-not-default key). A provider the server does not report (Ollama) falls back to the vault; when
+ * neither answers the state is unknown, never "not connected".
+ *
+ * Pure: `caps` is { ok, capabilities } from api.capabilities(), `vault` is { ok, rows } from api.connections().
+ */
+
+export const SUBSCRIPTION_NAME = 'Claude (subscription, dev only)';
+const DISPLAY = { 'provider.claude_subscription': SUBSCRIPTION_NAME };
+
+/** The name every surface shows for a capability (the server's own name, except where Quox has a fixed one). */
+export const capabilityName = (c) => DISPLAY[c?.id] || c?.name || c?.id;
+
+/** The server could not read this provider's status (not "not available"): shown as ? unknown on every surface. */
+export const statusUnreadable = (c) => c?.availability === 'unavailable' && /^Could not read .* status/i.test(c.reason || '');
+
+export const vaultPick = (rows, type) => {
+  const of = rows.filter(r => r.integration_type === type);
+  return { def: of.find(r => r.is_default === 1 || r.is_default === true) || null, any: of[0] || null };
+};
+
+/**
+ * -> { state, row?, reason?, setup?, source } for one provider.
+ * state: 'connected' (the server can use it) | 'stored' (a key exists but is not the org default) |
+ *        'missing' (needs setup) | 'unavailable' (not on this server) | 'unknown' (nothing answered).
+ * p: { cap: 'openai' | 'claude_subscription' | ..., vault?: integration type }
+ */
+export function providerState(p, caps, vault) {
+  const rows = vault?.ok && Array.isArray(vault.rows) ? vault.rows : null;
+  const v = rows && p.vault ? vaultPick(rows, p.vault) : { def: null, any: null };
+  const c = caps?.ok && Array.isArray(caps.capabilities) ? caps.capabilities.find(x => x?.id === `provider.${p.cap}`) : null;
+  if (c && statusUnreadable(c)) return { state: 'unknown', reason: c.reason, source: 'server' };
+  if (c) {
+    const base = { reason: c.reason || null, setup: c.setup || null, source: 'server' };
+    if (c.availability === 'installed') return { ...base, state: 'connected', row: v.def || null };
+    if (c.availability === 'requires_setup') return v.any && !v.def ? { ...base, state: 'stored', row: v.any } : { ...base, state: 'missing' };
+    return { ...base, state: 'unavailable' };
+  }
+  if (!rows || !p.vault) return { state: 'unknown', source: 'none' };
+  if (v.def) return { state: 'connected', row: v.def, source: 'vault' };
+  if (v.any) return { state: 'stored', row: v.any, source: 'vault' };
+  return { state: 'missing', source: 'vault' };
+}