quoxcli 0.2.0 → 0.3.1

package/lib/commands/lucid.js

@@ -102,6 +102,7 @@ export function registerLucidCommands(program, ctx) {
     if (o.json) { console.log(JSON.stringify(data, null, 2)); return; }
     if (o.agent) { console.log(data.text_agent ?? data.text ?? ''); return; }
     if (o.spoken) { console.log(data.spoken ?? data.text ?? ''); return; }
+    if (o.markdown) { const { renderSitrepMarkdown } = await import('../lucid/markdown.js'); console.log(renderSitrepMarkdown(data)); return; }
     const { renderSitrep } = await import('../lucid/sitrep.js');
     const tty = Boolean(process.stdout.isTTY);
     process.stdout.write(renderSitrep(data, {
@@ -118,14 +119,15 @@ export function registerLucidCommands(program, ctx) {
   const sitrepOpts = (c) => c
     .option('--agent', 'compact, id-rich form for agents')
     .option('--json', 'the full structured situation')
-    .option('--spoken', 'sentences only, as read on the phone');
+    .option('--spoken', 'sentences only, as read on the phone')
+    .option('--markdown', 'chat-ready Markdown for Discord, Matrix and slots (fits one message)');
 
   sitrepOpts(lu
     .command('sitrep')
     .description('One-shot formatted snapshot (areas, what needs you, what changed, what I cannot see)'))
     .action(async (o) => showSitrep(o));
 
-  // Top-level shortcut so any human or agent can ask for a sitrep: `quox sitrep [--agent|--json|--spoken]`.
+  // Top-level shortcut so any human or agent can ask for a sitrep: `quox sitrep [--agent|--json|--spoken|--markdown]`.
   sitrepOpts(program
     .command('sitrep')
     .description('LUCID situation report: what needs you, every area, what changed, what LUCID cannot see'))
@@ -393,9 +395,13 @@ export function registerLucidCommands(program, ctx) {
       if (wantJson(cmd)) { console.log(JSON.stringify(data, null, 2)); return; }
       if (data.status === 'filed') {
         printSuccess(`Filed${data.approval_id ? ` (approval ${data.approval_id})` : ''}. Approve it in Approvals.`);
-      } else if (data.status === 'manual') {
+      } else if (data.status === 'manual' && data.command) {
         console.log('This one is manual. Run this yourself:');
-        console.log(`  ${data.command ?? ''}`);
+        console.log(`  ${data.command}`);
+      } else if (data.status === 'manual') {
+        // #992: a 'say' measure has no command; print what it says and how to ask, never a blank instruction.
+        console.log(data.say || (m && m.label) || 'There is nothing to run for this one.');
+        console.log(`  quox lucid ask "${((m && m.label) || 'Look into it').replace(/"/g, "'")} (${ref})"`);
       } else if (data.status === 'opened') {
         console.log(`Opened: ${data.url ?? ''}`);
       } else {

package/lib/commands/memory.js

@@ -26,6 +26,7 @@ import { resolveEndpoint } from '../api/endpoints.js';
 import { QuoxError } from '../core/errors.js';
 import { resolveOrgId } from './helpers.js';
 import { resolveMyAttach } from './agentAttach.js';
+import { hasExplicitProfile } from '../core/actingAs.js';
 
 // QUOXIDENTITY P9: which agent this session acts as is resolved session-scoped
 // (QUOX_T subtree / QUOX_ATTACH_AGENT override / single-attach fallback), so
@@ -46,7 +47,12 @@ async function callMemoryTool({ client, auth, program }, toolName, input) {
   const body = { tool_name: toolName, input };
   const requestOptions = { service: ep.service, body };
 
-  const lease = detectSoleAttachLease();
+  // An explicit -p/--profile (or QUOX_PROFILE) is the caller saying "as me":
+  // it wins over the session's attach lease, same precedence as
+  // core/actingAs. Before this, `quox -p moo memory search` inside an attached
+  // session went out on the lease token and 401'd (proof engine 2026-10-14).
+  const argv = (program.rawArgs || process.argv).slice(2);
+  const lease = hasExplicitProfile(argv) ? null : detectSoleAttachLease();
   if (lease) {
     requestOptions.noAuth = true;
     requestOptions.headers = { Authorization: `Bearer ${lease.token}` };
@@ -260,16 +266,87 @@ export function registerMemoryCommands(program, ctx) {
       }, { format: program.opts().output });
     });
 
+  // QUOXMIND #1111: the old view counted only rows under YOUR user id, so an
+  // org holding hundreds of agent-written memories looked nearly empty. Default
+  // is now the org view (per agent, per writer), falling back honestly.
   memory
     .command('stats')
-    .description('Show memory statistics')
-    .action(async () => {
+    .description('Show memory statistics: the whole org by agent and writer (org admins), else your own')
+    .option('--mine', 'only memories written under your own login')
+    .action(async (options) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('memory.stats.list');
+      let data;
+      let note = '';
+      if (options.mine) {
+        data = await client.get(ep.path, { service: ep.service, query: {} });
+      } else {
+        try {
+          data = await client.get(ep.path, { service: ep.service, query: { scope: 'org' } });
+        } catch (err) {
+          if (err?.status !== 403) throw err;
+          data = await client.get(ep.path, { service: ep.service, query: {} });
+          note = 'Org-wide counts need an org admin or owner. Showing only memories written under your own login; agents write under their own identities, so the org holds more.';
+        }
+      }
+      const format = program.opts().output;
+      if (format === 'json') { console.log(JSON.stringify(note ? { ...data, note } : data, null, 2)); return; }
+      if (data?.scope !== 'org') {
+        formatDetail(data.stats || data, { format, title: 'Memory Stats (your login only)' });
+        console.log(note || 'Counts only memories written under your own login. `quox memory stats` without --mine shows the whole org (org admins).');
+        return;
+      }
+      const m = data.memories || {};
+      console.log(`Memory Stats (org): ${m.total ?? 0} valid memories, ${m.not_valid ?? 0} superseded or deleted (kept for history), ${data.pinned ?? 0} pinned, last write ${data.last_write_at || 'never'}`);
+      if (m.by_type) console.log(`By type: ${Object.entries(m.by_type).map(([k, v]) => `${k} ${v}`).join(', ')}`);
+      formatOutput({
+        columns: ['agent', 'count'], headers: ['Agent', 'Memories'],
+        rows: Object.entries(data.by_agent || {}).map(([agent, count]) => ({ agent, count })),
+      }, { format });
+      formatOutput({
+        columns: ['user_id', 'kind', 'count', 'agents'], headers: ['Writer', 'Kind', 'Memories', 'Agents'],
+        rows: (data.by_user || []).map((u) => ({ ...u, agents: (u.agents || []).join(',') })),
+      }, { format });
+      console.log('Valid = not deleted and not superseded. A writer is the login a memory was saved under: your own, an agent identity, service/system (internal agents), or org-shared beliefs.');
+    });
+
+  memory
+    .command('core')
+    .description('Show the core set: memories loaded into every chat turn (pinned, plus auto-promoted decisions and facts rated high or critical)')
+    .option('--limit <n>', 'max memories', '20')
+    .action(async (options) => {
       auth.requireAuth();
-      const data = await client.get(resolveEndpoint('memory.stats.list').path, { service: resolveEndpoint('memory.stats.list').service });
-      formatDetail(data.stats || data, {
-        format: program.opts().output,
-        title: 'Memory Stats',
-      });
+      const ep = resolveEndpoint('memory.core-set');
+      const data = await client.get(ep.path, { service: ep.service, query: { limit: options.limit } });
+      formatOutput({
+        columns: ['id', 'core_reason', 'agent_id', 'memory_type', 'content'],
+        headers: ['ID', 'Why', 'Agent', 'Type', 'Content'],
+        rows: (data.memories || []).map((m) => ({ ...m, content: (m.content || '').slice(0, 80) })),
+      }, { format: program.opts().output, raw: data });
+    });
+
+  memory
+    .command('pin')
+    .description('Pin a memory into the core set so every chat turn carries it')
+    .argument('<id>', 'memory ID')
+    .action(async (id) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('memory.pin', { id });
+      const data = await client.post(ep.path, { service: ep.service, body: {} });
+      if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      printSuccess(`Pinned ${id} into the core set.`);
+    });
+
+  memory
+    .command('unpin')
+    .description('Take a memory out of the core set (also stops it being auto-promoted)')
+    .argument('<id>', 'memory ID')
+    .action(async (id) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('memory.unpin', { id });
+      const data = await client.delete(ep.path, { service: ep.service });
+      if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      printSuccess(`Unpinned ${id}: it stays a memory, but is no longer in the core set.`);
     });
 
   memory

package/lib/commands/mind.js

@@ -0,0 +1,71 @@
+/**
+ * `quox mind implants|implant <id>|health`: QuoxMind cognitive implants (read-only).
+ * Collector routes under /api/v1/mind (org-scoped). Implants with no recorded
+ * activity say so; nothing is invented.
+ */
+import { formatOutput } from '../core/output.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+import { resolveOrgId } from './helpers.js';
+
+export function registerMindCommands(program, ctx) {
+  const { client, auth } = ctx;
+  const get = async (name, params) => {
+    auth.requireAuth();
+    const ep = resolveEndpoint(name, params);
+    return client.get(ep.path, { service: ep.service, query: { org_id: resolveOrgId(auth, program) } });
+  };
+  const isJson = () => program.opts().output === 'json';
+
+  const mind = program.command('mind').description('QuoxMind: the cognitive implants (read-only)');
+
+  mind
+    .command('implants')
+    .description('List the cognitive implants: purpose, status, last activity')
+    .action(async () => {
+      const data = await get('mind.implants');
+      const rows = data.implants || [];
+      formatOutput(rows.map((i) => ({
+        ID: i.short,
+        NAME: i.name,
+        PURPOSE: i.purpose,
+        STATUS: i.status,
+        'LAST ACTIVITY': i.last_activity || 'no activity recorded',
+        // QUOXMIND-PROOF: firing evidence from the implant's own table (null = not tracked).
+        'LAST FIRED': i.activity_error ? 'unknown' : (typeof i.fired_7d === 'number' ? (i.last_fired || 'never') : 'not tracked'),
+        '7D': typeof i.fired_7d === 'number' && !i.activity_error ? i.fired_7d : '-',
+      })), {
+        format: program.opts().output,
+        columns: ['ID', 'NAME', 'STATUS', 'LAST FIRED', '7D', 'PURPOSE'],
+        emptyMessage: 'No implants registered.',
+        raw: rows,
+      });
+    });
+
+  mind
+    .command('implant <id>')
+    .description('One implant in detail (e.g. predict, reflect, repobrain, qortex)')
+    .action(async (id) => {
+      const d = await get('mind.implant', { id });
+      if (isJson()) { console.log(JSON.stringify(d, null, 2)); return; }
+      console.log(`${d.name} (${d.short}) · ${d.status}${d.tier ? ` · ${d.tier}` : ''}`);
+      console.log(d.description || d.purpose);
+      if (d.inspired_by) console.log(`Inspired by: ${d.inspired_by}`);
+      if (d.summary) console.log(`Now: ${d.summary}`);
+      console.log(d.activity);
+      if (typeof d.fired_7d === 'number' && !d.activity_error) console.log(`Fired: ${d.last_fired || 'never'} · ${d.fired_7d} in the last 7 days${d.activity_source ? ` (from ${d.activity_source})` : ''}`);
+      else if (d.activity_error) console.log(`Fired: unknown (${d.activity_error})`);
+      for (const [k, v] of Object.entries(d.metrics || {})) if (v !== null && typeof v !== 'object') console.log(`  ${k}: ${v}`);
+    });
+
+  mind
+    .command('health')
+    .description('Summary of QuoxMind health across all implants')
+    .action(async () => {
+      const d = await get('mind.health');
+      if (isJson()) { console.log(JSON.stringify(d, null, 2)); return; }
+      console.log(`${d.total} implants: ${Object.entries(d.by_status).map(([k, v]) => `${v} ${k}`).join(', ')}`);
+      console.log(`${d.with_activity} with recorded activity, ${d.no_activity} with no activity recorded`);
+      if (typeof d.fired_7d_total === 'number') console.log(`Last 7 days: ${d.fired_7d_implants} implants fired (${d.fired_7d_total} firings), ${d.silent_7d} silent, ${d.activity_unknown} not tracked`);
+      console.log(d.average_health === null ? 'Average health: not enough data' : `Average health: ${d.average_health} (over ${d.scored} scored)`);
+    });
+}

package/lib/commands/mon.js

@@ -2,7 +2,7 @@
  * Monitoring commands: Docker fleet, Wazuh security monitoring, AGH-chain
  * agent honesty leaderboard, Prometheus metrics, and monitoring config.
  *
- * quox mon docker fleet|containers|container|logs|stats|stacks|df|action
+ * quox mon docker fleet|containers|container|inspect|logs|stats|stacks|df|action
  * quox mon wazuh status|agents|alerts|vulns|deploy-history|deploy-agent|deploy-bulk|active-response
  * quox mon agh-chain leaderboard|agent|events
  * quox mon metrics
@@ -36,6 +36,47 @@ async function confirmOrSkip(program, options, message) {
   return ans.confirm;
 }
 
+
+/** One readable line per fact from the inspect health block (null when the container has no healthcheck). */
+function healthRows(h) {
+  if (!h) return null;
+  const rows = [];
+  const streak = h.failing_streak ? ` (failing ${h.failing_streak} times)` : '';
+  rows.push(`health: ${h.status || 'unknown'}${streak}`);
+  if (h.test) {
+    const parts = [h.interval && `every ${h.interval}`, h.timeout && `timeout ${h.timeout}`, h.retries != null && `retries ${h.retries}`].filter(Boolean);
+    rows.push(`probe: ${h.test}${parts.length ? ' ' + parts.join(', ') : ''}`);
+  }
+  for (const p of h.last_probes || []) {
+    const o = String(p.output || '').replace(/\s+/g, ' ').trim();
+    rows.push(`last: exit ${p.exit_code}${o ? ` '${o}'` : ''}${p.end ? ` at ${p.end}` : ''}`);
+  }
+  return rows;
+}
+
+/**
+ * DEVFLEET-DOCKER: an error body is not data. If the collector reports a refused/failed Docker
+ * read, say so (stderr) and set a non-zero exit instead of printing an empty list. Partial fleets
+ * print the failed hosts as warnings. Returns true when the whole read failed (caller stops).
+ */
+function reportDockerReadFailures(data) {
+  if (!data) return false;
+  const failedHosts = Array.isArray(data.hosts_failed) ? data.hosts_failed
+    : (data.success === false && Array.isArray(data.hosts) ? data.hosts.filter((h) => h && h.ok === false) : []);
+  if (data.success === false) {
+    const tag = data.refused ? ' (refused, error_code ' + (data.error_code || 'approval_required') + ')' : '';
+    console.error('Docker read failed' + tag + ': ' + (data.error || 'unknown error'));
+    for (const h of failedHosts) console.error('  ' + h.host + ': ' + (h.error || 'failed'));
+    process.exitCode = 1;
+    return true;
+  }
+  if (data.partial) {
+    console.error('Partial result: ' + failedHosts.length + ' host(s) could not be read; the list below is incomplete.');
+    for (const h of failedHosts) console.error('  ' + h.host + ': ' + (h.error || 'failed'));
+  }
+  return false;
+}
+
 export function registerMonCommands(program, ctx) {
   const { client, auth } = ctx;
 
@@ -59,6 +100,7 @@ export function registerMonCommands(program, ctx) {
       auth.requireAuth();
       const ep = resolveEndpoint('mon.docker.fleet.list');
       const data = await client.get(ep.path, { service: ep.service, query: options.refresh ? { refresh: 'true' } : undefined });
+      if (reportDockerReadFailures(data)) return;
       const hosts = data.hosts || [];
       formatOutput({
         // fleet #392: docker fleet rows are id/containers_total/docker_version; ip and status don't exist.
@@ -82,6 +124,7 @@ export function registerMonCommands(program, ctx) {
       if (options.all === false) query.all = 'false';
       if (options.refresh) query.refresh = 'true';
       const data = await client.get(ep.path, { service: ep.service, query });
+      if (reportDockerReadFailures(data)) return;
       formatOutput({
         columns: ['host_id', 'id', 'name', 'image', 'state', 'status'],
         headers: ['Host', 'ID', 'Name', 'Image', 'State', 'Status'],
@@ -98,6 +141,9 @@ export function registerMonCommands(program, ctx) {
       auth.requireAuth();
       const ep = resolveEndpoint('mon.docker.containers.get', { id });
       const data = await client.get(ep.path, { service: ep.service, query: { host: options.host } });
+      // quox#1001: a 200 with success:false (e.g. "Bastion not configured") is a failure, not an
+      // empty container. Surface the error on stderr + exit non-zero instead of rendering a blank card.
+      if (reportDockerReadFailures(data)) return;
       formatDetail(data, {
         format: program.opts().output,
         title: `Container: ${id} (${options.host})`,
@@ -106,6 +152,24 @@ export function registerMonCommands(program, ctx) {
       });
     });
 
+  docker
+    .command('inspect')
+    .description('Show container state and health (failing probe command and last results)')
+    .argument('<id>', 'container ID')
+    .requiredOption('--host <hostId>', 'host the container lives on')
+    .action(async (id, options) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('mon.docker.containers.inspect', { id });
+      const data = await client.get(ep.path, { service: ep.service, query: { host: options.host } });
+      if (reportDockerReadFailures(data)) return;
+      if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      const d = data.details || {};
+      console.log(`Container: ${id} (${options.host})`);
+      console.log(`state: ${d.status || 'unknown'} · image: ${d.image || 'unknown'}`);
+      const rows = healthRows(d.health);
+      console.log(rows ? rows.join('\n') : 'health: no healthcheck configured');
+    });
+
   docker
     .command('logs')
     .description('Show container logs')
@@ -143,6 +207,7 @@ export function registerMonCommands(program, ctx) {
       auth.requireAuth();
       const ep = resolveEndpoint('mon.docker.stacks.list');
       const data = await client.get(ep.path, { service: ep.service, query: options.host ? { host: options.host } : undefined });
+      if (reportDockerReadFailures(data)) return;
       formatOutput({
         columns: ['host_id', 'name', 'status', 'services'],
         headers: ['Host', 'Stack', 'Status', 'Services'],
@@ -181,7 +246,9 @@ export function registerMonCommands(program, ctx) {
       const ep = resolveEndpoint('mon.docker.containers.action', { id, action });
       const data = await client.post(ep.path, { service: ep.service, body: { host: options.host } });
       if (data.success === false) {
-        printWarning(`Action failed: ${data.error || 'unknown error'}`);
+        // quox#1001: surface the real server error and exit non-zero (was exit 0 = success on failure).
+        printWarning(`Action failed: ${data.error || data.message || 'unknown error'}`);
+        process.exitCode = 1;
         return;
       }
       printSuccess(`Container ${id}: ${action} succeeded.`);

package/lib/commands/monitoring.js

@@ -35,7 +35,7 @@ export function registerMonitoringCommands(program, ctx) {
       // nothing is stored); logged-in now actually sends the token.
       const data = await client.get(resolveEndpoint('v1.health.aggregate.list').path, {
         service: resolveEndpoint('v1.health.aggregate.list').service,
-        timeout: 5000,
+        timeout: 15000, // #930: aggregate fan-out, 5s too tight under load
       });
       formatDetail(data, { format: program.opts().output, title: 'Platform Health' });
     });

package/lib/commands/motion.js

@@ -5,8 +5,8 @@
 export function registerMotionCommand(program) {
   program
     .command('motion')
-    .description('Play the Quox motion gallery: the Q intro, portal, particle, the Dragon\'s Eye, the status Q, ring and reveals (no server needed)')
-    .argument('[scenes...]', 'only these: orbit portal particle eye hello perpetual ring fx')
+    .description('Play the Quox motion gallery: the Q intro, portal, particle, the Dragon\'s Eye, the status Q, ring, reveals and the living dragon (no server needed)')
+    .argument('[scenes...]', 'only these: orbit portal particle eye hello perpetual ring fx dragon dragon-fire dragon-moods')
     .option('--narrow', 'use the 40-column layout (the compact Q)')
     .option('--slow', 'play three times slower')
     .option('--mono', 'no colour (also honoured: NO_COLOR)')

package/lib/commands/nucleus.js

@@ -23,6 +23,36 @@ import { line as glyphLine, printEvent } from '../core/quoxglyph.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { resolveOrgId } from './helpers.js';
 
+// codebase_query's schema (collector agentTools.js): question (required),
+// target, max_snippets. quox#836: the CLI used to send query/repo/limit,
+// every call failed "Missing required parameter: question", and the failure
+// printed as "0 hits".
+export function buildNucleusInput(question, options = {}) {
+  const input = { question };
+  if (options.target) input.target = options.target;
+  const n = parseInt(options.limit, 10);
+  if (n > 0) input.max_snippets = n;
+  return input;
+}
+
+// The tool result shape varies by engine version, so normalise rather than
+// assuming: an unexpected shape must still print SOMETHING true. An error
+// body is an error, never an empty result.
+export function readNucleusResult(data) {
+  if (data && data.success === false) return { error: data.error || data.message || 'tool call failed' };
+  // The collector's codebase_query returns agent-friendly text with
+  // file:line citations ({ success, output, resultCount }), not an array.
+  if (typeof data?.output === 'string') return { text: data.output, count: data.resultCount ?? null, result: data };
+  const result = data && (data.result || data.output || data);
+  if (result && result.success === false) return { error: result.error || result.message || 'tool call failed' };
+  if (typeof result?.output === 'string') return { text: result.output, count: result.resultCount ?? null, result };
+  const results = Array.isArray(result?.results) ? result.results
+    : Array.isArray(result?.snippets) ? result.snippets
+    : Array.isArray(result) ? result
+    : null;
+  return { results, result };
+}
+
 export function registerNucleusCommands(program, { client, auth }) {
   const nucleus = program
     .command('nucleus')
@@ -43,33 +73,34 @@ export function registerNucleusCommands(program, { client, auth }) {
       const started = Date.now();
 
       const ep = resolveEndpoint('v1.tools.execute');
-      const body = {
-        tool_name: 'codebase_query',
-        input: {
-          query: question,
-          ...(options.target ? { repo: options.target } : {}),
-          ...(options.limit ? { limit: parseInt(options.limit, 10) || 8 } : {}),
-        },
-      };
+      const body = { tool_name: 'codebase_query', input: buildNucleusInput(question, options) };
       const orgId = resolveOrgId(auth, program);
       if (orgId) body.org_id = orgId;
 
       const data = await client.post(ep.path, { service: ep.service, body, timeout: 60000 });
       const ms = Date.now() - started;
-
-      // The tool result shape varies by engine version, so normalise rather
-      // than assuming: an unexpected shape must still print SOMETHING true.
-      const result = data && (data.result || data.output || data);
-      const results = Array.isArray(result?.results) ? result.results
-        : Array.isArray(result?.snippets) ? result.snippets
-        : Array.isArray(result) ? result
-        : null;
+      const { error, results, result, text, count } = readNucleusResult(data);
 
       if (program.opts().output === 'json') {
         formatDetail(data, { format: 'json' });
         return;
       }
 
+      if (error) {
+        printEvent(glyphLine('repobrain', `query "${question}"`, { result: 'failed', ms }));
+        printWarning(`The query failed: ${error}`);
+        process.exitCode = 1;
+        return;
+      }
+
+      if (typeof text === 'string') {
+        const hits = count === null ? 'answered' : `${count} hits`;
+        printEvent(glyphLine('repobrain', `query "${question}"`, { result: count === 0 ? '0 hits' : hits, ms }));
+        console.log('');
+        console.log(text.split('\n').map((l) => `  ${l}`).join('\n'));
+        return;
+      }
+
       if (!results || results.length === 0) {
         printEvent(glyphLine('repobrain', `query "${question}"`, { result: '0 hits', ms }));
         printWarning('Nothing matched. Try naming a concrete symbol, filename or behaviour rather than a general description.');
@@ -85,7 +116,7 @@ export function registerNucleusCommands(program, { client, auth }) {
         const line = r.line || r.start_line || null;
         console.log('');
         console.log(`  ${loc}${line ? `:${line}` : ''}`);
-        const snippet = r.snippet || r.content || r.text || '';
+        const snippet = r.snippet || r.code || r.content || r.text || '';
         for (const l of String(snippet).split('\n').slice(0, 20)) console.log(`    ${l}`);
       }
     });

package/lib/commands/objective.js

@@ -209,6 +209,17 @@ export function registerObjectiveCommands(program, ctx) {
       printSuccess(`Checkpoint ${checkpointId}: ${data.status}${data.objective_status ? ` (objective ${data.objective_status})` : ''}`);
     });
 
+  objective
+    .command('cancel')
+    .description('Cancel an objective (pending ones included, e.g. proof leftovers that never started); its open tasks are cancelled too. For a RUNNING loop prefer `halt`, which also kills the live session.')
+    .argument('<objectiveId>', 'objective ID')
+    .action(async (objectiveId) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('objectives.cancel', { id: objectiveId });
+      const data = await client.delete(ep.path, { service: ep.service });
+      printSuccess(`Objective ${objectiveId}: ${data?.status || 'cancelled'}`);
+    });
+
   objective
     .command('halt')
     .description('Halt a running QLoop loop ON DEMAND (unconditional human stop; no pending gate needed). Fires the same signed-kill as a gate deny.')

package/lib/commands/offload.js

@@ -0,0 +1,89 @@
+/**
+ * `quox offload` : run a heavy command on a pool worker VM and behave like running it locally.
+ *
+ *   quox offload [--dir <path>] [--fresh] [--keep] [--cores N --memory-gb N --disk-gb N] -- <command...>
+ *   quox offload status
+ *   quox offload release
+ *
+ * Engine: lib/core/offload.js. The worker is leased through the human pool REST API
+ * (same as `quox vm pool lease`) with a dedicated key at ~/.config/quox/offload_ed25519.
+ */
+
+import path from 'node:path';
+import { printInfo } from '../core/output.js';
+import { makePoolRest } from '../core/vm.js';
+import { OffloadError, realDeps, runOffload, releaseWorker, workerStatus, gitToplevel, WORKER_NAME_RE } from '../core/offload.js';
+
+export function registerOffloadCommands(program, ctx, { deps: injected } = {}) {
+  const { client, auth } = ctx;
+  const json = () => program.opts().output === 'json';
+  const base = () => injected || realDeps({ rest: makePoolRest({ client }) });
+  // --worker <name> / QUOX_OFFLOAD_WORKER: your own worker (state, lease, size), not the box's shared one.
+  const mk = (options = {}) => {
+    const d = base();
+    const name = options.worker ?? d.env?.QUOX_OFFLOAD_WORKER;
+    if (name !== undefined && name !== '' && !WORKER_NAME_RE.test(String(name))) {
+      throw new OffloadError(`worker name must be lowercase letters, digits and dashes (up to 32), got ${JSON.stringify(name)}`);
+    }
+    return name ? Object.assign(Object.create(Object.getPrototypeOf(d)), d, { worker: String(name) }) : d;
+  };
+  const WORKER_HELP = 'use your own named worker (its own lease and size) instead of the shared one; or set QUOX_OFFLOAD_WORKER';
+
+  const off = program
+    .command('offload')
+    .description('Run a heavy command on a pool worker VM (synced dir, cached npm ci, live output, same exit code)')
+    .argument('[command...]', 'command to run remotely (put it after --)')
+    .option('--dir <path>', 'directory to sync (default: git toplevel of the current directory)')
+    .option('--fresh', 'release the current worker, lease a new one and reinstall dependencies')
+    .option('--keep', 'leave the worker leased for reuse (the default; kept for compatibility)')
+    .option('--cores <n>', 'vCPU cores for a newly leased worker')
+    .option('--memory-gb <n>', 'memory in GB for a newly leased worker')
+    .option('--disk-gb <n>', 'disk in GB for a newly leased worker')
+    .option('--worker <name>', WORKER_HELP)
+    .option('--docker', 'also give the worker Docker (user hyp in the docker group) and build the quox-sandbox images from the synced repo when they are missing or changed')
+    .allowExcessArguments(true)
+    .action(async (command, options) => {
+      auth.requireAuth();
+      const cwd = process.cwd();
+      const dir = path.resolve(options.dir || gitToplevel(cwd));
+      try {
+        const code = await runOffload(mk(options), {
+          dir, cwd, command, fresh: !!options.fresh, docker: !!options.docker,
+          cores: options.cores, memoryGb: options.memoryGb, diskGb: options.diskGb,
+        });
+        process.exitCode = code;
+      } catch (e) {
+        if (!(e instanceof OffloadError)) throw e;
+        process.stderr.write(`offload: ${e.message}\n`);
+        process.exitCode = 1;
+      }
+    });
+
+  off.command('status')
+    .description('Show your offload worker: vmid, ip, lease expiry, synced dirs')
+    .option('--worker <name>', WORKER_HELP)
+    .action(async (options) => {
+      auth.requireAuth();
+      const s = await workerStatus(mk(options));
+      if (json()) { console.log(JSON.stringify(s, null, 2)); return; }
+      if (!s.worker) { printInfo('no offload worker leased (it is leased on the next `quox offload -- <command>`)'); return; }
+      const w = s.worker;
+      console.log(`worker ${w.vmid}  ${w.ip || '?'}  ${w.state}  lessee ${w.lessee}  lease expires ${w.lease_expires_at || '?'}`);
+      for (const d of s.dirs) console.log(`  synced ${d.local} -> ${d.remote}  ${d.synced_at || ''}`);
+    });
+
+  off.command('release')
+    .description('Release (destroy) your offload worker via the pool')
+    .option('--worker <name>', WORKER_HELP)
+    .action(async (options) => {
+      auth.requireAuth();
+      try {
+        const vmid = await releaseWorker(mk(options));
+        if (json()) console.log(JSON.stringify({ released: vmid }));
+        else printInfo(vmid ? `released worker ${vmid}` : 'no offload worker to release');
+      } catch (e) {
+        process.stderr.write(`offload: release failed: ${e.message}\n`);
+        process.exitCode = 1;
+      }
+    });
+}

package/lib/commands/onboard.js

@@ -64,7 +64,8 @@ export function inferTargetType(value) {
 /** curl install command for a host that is not yet a fleet-enrolled dev server. */
 export function buildOnboardInstallCommand(collectorBase, host) {
   const base = String(collectorBase || '').replace(/\/+$/, '');
-  return `curl -sSL ${base}/install | sudo bash -s -- --host-id ${host}`;
+  // REL-423: fail loud, never `curl | sudo bash` (that pipe reports success when the download fails).
+  return `( f=$(mktemp) && trap 'rm -f "$f"' EXIT && curl -fsSL ${base}/install -o "$f" && sudo bash "$f" --host-id ${host} )`;
 }
 
 // ── the wizard ──────────────────────────────────────────────────────────────

package/lib/commands/org.js

@@ -3,7 +3,8 @@
  */
 
 import { QuoxError } from '../core/errors.js';
-import { formatOutput, formatDetail, printSuccess } from '../core/output.js';
+import { formatOutput, formatDetail, printSuccess, printWarning } from '../core/output.js';
+import { otherProfileUsers, listProcs } from '../core/profileUsers.js';
 import { resolveOrgId } from './helpers.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 
@@ -120,6 +121,15 @@ export function registerOrgCommands(program, ctx) {
       config.setAuth(authData);
 
       printSuccess(`Switched to ${data.org?.name || orgId}`);
+      // #1034: this changed the SHARED profile. Name the other live sessions that will follow it.
+      try {
+        const name = config.getActiveProfileName?.();
+        const others = name ? otherProfileUsers({ profile: name, defaultProfile: config._data?.activeProfile, procs: listProcs(), selfPids: [process.pid, process.ppid] }) : [];
+        if (others.length) {
+          printWarning(`${others.length} other quox session${others.length === 1 ? '' : 's'} use profile "${name}" (pid ${others.map(p => p.pid).join(', ')}). `
+            + 'They follow this org on their next token refresh or restart. To move one window only, use /org switch inside it.');
+        }
+      } catch { /* best effort: never fail the switch over the warning */ }
     });
 
   // Members subcommands

package/lib/commands/peek.js

@@ -0,0 +1,28 @@
+/**
+ * quox peek <id>
+ *
+ * Look up an id without knowing what it is: an AEE envelope, inbox (approval) item, objective, workflow
+ * run, WARD receipt or agent. The id's shape picks what to ask; every lookup is an existing read
+ * endpoint; a miss names each kind tried and what it answered. The TUI's /peek prints the same card.
+ */
+import { createPeekFetchers, peekId, peekLines } from '../core/peek.js';
+import { resolveOrgId } from './helpers.js';
+
+export function registerPeekCommand(program, ctx) {
+  const { client, auth } = ctx;
+  program
+    .command('peek')
+    .description('Look up an envelope, inbox item, objective, run, WARD receipt or agent by id (read only)')
+    .argument('<id>', 'the id, e.g. a ULID, a WARD entry UUID or an agent name')
+    .action(async (id) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const r = await peekId(id, createPeekFetchers({ client, orgId: () => orgId }));
+      if (program.opts().output === 'json') {
+        console.log(JSON.stringify({ id: r.id, shape: r.shape, kind: r.hit?.kind || null, data: r.hit?.data || null, also: r.also, tried: r.tried }, null, 2));
+      } else {
+        for (const l of peekLines(r)) console.log(l.text);
+      }
+      if (!r.hit) process.exitCode = 5; // not found (the inbox verbs use 5 for not_found too)
+    });
+}