quoxcli 0.2.0 → 0.4.0

package/lib/api/endpoints/safety.js

@@ -43,4 +43,11 @@ export const safety = {
     path: () => `/api/v1/safety/history`,
     tags: ['live-safe'],
   },
+  // QUOXON-STEPUP: a human with a live step-up token overrides ONE blocked action (collector routes/overrides.js).
+  'safety.override': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/overrides`,
+    tags: ['live-write'],
+  },
 };

package/lib/api/endpoints/server.js

@@ -0,0 +1,21 @@
+/**
+ * 'server.*' endpoints: moved out of admin.js so each key carries its fragment's own domain prefix.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const server = {
+  // DEVFLEET CX-2: server roles registry (role -> url, read before env by resolveServiceUrl). Collector routes;
+  // list is instance-admin readable, set/unset/test are instance-OWNER only (see services/collector/server.js).
+  'server.roles.list': {
+    method: 'GET', service: 'collector', path: () => '/api/v1/server/roles', tags: ['live-safe'],
+  },
+  'server.roles.set': {
+    method: 'PUT', service: 'collector', path: ({ role }) => `/api/v1/server/roles/${encodeURIComponent(role)}`, tags: ['admin-write'],
+  },
+  'server.roles.unset': {
+    method: 'DELETE', service: 'collector', path: ({ role }) => `/api/v1/server/roles/${encodeURIComponent(role)}`, tags: ['admin-write'],
+  },
+  'server.roles.test': {
+    method: 'POST', service: 'collector', path: ({ role }) => `/api/v1/server/roles/${encodeURIComponent(role)}/test`, tags: ['admin-write'],
+  },
+};

package/lib/api/endpoints/setup.js

@@ -81,6 +81,12 @@ export const setup = {
     path: ({ pluginId }) => `/api/setup/licensing/seats/${encodeURIComponent(pluginId)}/release-dead`,
     tags: ['live-write'],
   },
+  'setup.licensing.seats.release': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ pluginId }) => `/api/setup/licensing/seats/${encodeURIComponent(pluginId)}/release`,
+    tags: ['live-write'],
+  },
   'setup.status.list': {
     method: 'GET',
     service: 'auth',

package/lib/api/endpoints/skills.js

@@ -161,6 +161,19 @@ export const skills = {
     path: ({ qid }) => `/api/quox-skills/review-queue/${qid}/reject`,
     tags: ['live-write'],
   },
+  // #1006: the crystal store (quoxflow skills.ts), where `skills from-execution` writes; list/show merge it in
+  'skills.crystals.list': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/skills`,
+    tags: ['live-safe'],
+  },
+  'skills.crystals.get': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: ({ id }) => `/api/skills/${id}`,
+    tags: ['live-safe'],
+  },
   'skills.rollbackToVersion': {
     method: 'POST',
     service: 'quoxflow',
@@ -171,6 +184,13 @@ export const skills = {
   // It actually runs a workflow/crystal (side effects beyond a rejected
   // write); 'skip-live' keeps it out of the live-contract harness entirely
   // per the WP2.3 brief ("Do NOT seed execute as live").
+  // QSKL create (quoxflow quox-skills.ts POST /): firewall-scanned; ?dry_run=true returns the verdict without writing.
+  'skills.create': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: () => `/api/quox-skills`,
+    tags: ['live-write'],
+  },
   'skills.run': {
     method: 'POST',
     service: 'quoxflow',

package/lib/api/endpoints/stepup.js

@@ -0,0 +1,20 @@
+/**
+ * 'stepup.*' endpoints: QUOXON-STEPUP human step-up PIN (auth service routes/stepUp.js).
+ * There is deliberately NO endpoint here that sets or changes the PIN: that is a dashboard-only act
+ * (browser session plus fresh password). The CLI can read status and verify, nothing else.
+ */
+
+export const stepup = {
+  'stepup.status': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/auth/me/step-up-pin`,
+    tags: ['live-safe'],
+  },
+  'stepup.verify': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/auth/me/step-up`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/teams.js

@@ -43,8 +43,8 @@ export const teams = {
   },
   'teams.provisionRoom': {
     method: 'POST',
-    service: 'tasks',
-    path: ({ teamId }) => `/api/teams/${teamId}/provision-room`,
+    service: 'auth',
+    path: ({ orgId, teamId }) => `/api/orgs/${orgId}/teams/${teamId}/provision-room`,
     tags: ['live-write'],
   },
   'teams.update': {

package/lib/api/endpoints/triggers.js

@@ -67,4 +67,30 @@ export const triggers = {
     path: () => `/api/triggers/webhooks`,
     tags: ['live-safe'],
   },
+  // SITE-CLI 2026-10-19: pause/resume a schedule without re-applying the workflow JSON. quoxflow's
+  // src/api/routes/schedules.ts (mounted at /api/schedules) is org-scoped (cross-org = 404), persists
+  // node.config.paused and emits SCHEDULE.PAUSED / SCHEDULE.RESUMED envelopes.
+  'triggers.schedule-list': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/schedules`,
+    tags: ['live-safe'],
+  },
+  'triggers.schedule-pause': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId, nodeId }) => `/api/schedules/${encodeURIComponent(workflowId)}/${encodeURIComponent(nodeId)}/pause`,
+  },
+  'triggers.schedule-resume': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId, nodeId }) => `/api/schedules/${encodeURIComponent(workflowId)}/${encodeURIComponent(nodeId)}/resume`,
+  },
+  // The public webhook ingress (quoxflow src/api/routes/webhook-triggers.ts, mounted at /webhooks). It copies every
+  // request header into the run's trigger data, so the CLI fires it with NO credentials (noAuth).
+  'triggers.webhook-fire': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ path }) => `/webhooks/${path}`,
+  },
 };

package/lib/api/endpoints/v1.js

@@ -59,6 +59,14 @@ export const v1 = {
     path: () => `/api/v1/fleet/hosts`,
     tags: ['live-safe'],
   },
+  // quoxbastion#34 — `quox fleet ping [host]`: governed Bastion host-state
+  // refresh (org admin; emits a quox.fleet.ping evidence envelope).
+  'v1.fleet.ping': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/fleet/ping`,
+    tags: ['admin-write'],
+  },
   // DEVSUITE-HUB Phase 2 — `quox dev enable` (see lib/commands/dev.js).
   // Constructs + signs + delivers a quoxagent dev.CapabilityProfile onto a
   // target host via Bastion. See services/collector/server.js's
@@ -290,12 +298,47 @@ export const v1 = {
     path: () => `/api/v1/policies/validate`,
     tags: ['live-write'],
   },
+  // LAZY-AI-CLI: vendor CLIs (Claude Code, Codex) the user's own server installs from npm. Status is any
+  // signed-in caller; plan + install need a human instance admin (the binary is instance-wide).
+  'v1.providers.cli.status': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/providers/cli`,
+    tags: ['live-safe'],
+  },
+  'v1.providers.cli.plan': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ tool }) => `/api/v1/providers/cli/${encodeURIComponent(tool)}/plan`,
+    tags: ['live-safe'],
+  },
+  'v1.providers.cli.install': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ tool }) => `/api/v1/providers/cli/${encodeURIComponent(tool)}/install`,
+    tags: ['live-write'],
+  },
+  'v1.providers.cli.job': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/providers/cli/jobs/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
   'v1.tools.execute': {
     method: 'POST',
     service: 'collector',
     path: () => `/api/v1/tools/execute`,
     tags: ['live-write'],
   },
+  // DEVFLEET: HYPERION VM pool, human REST surface (a human acting directly is the
+  // authorization; agents use the proxmox_pool_* tools, which are approval-governed).
+  'v1.proxmox.pool': { method: 'GET', service: 'collector', path: () => `/api/v1/proxmox/pool`, tags: ['live-safe'] },
+  'v1.proxmox.pool.config.put': { method: 'PUT', service: 'collector', path: () => `/api/v1/proxmox/pool/config`, tags: ['live-write'] },
+  'v1.proxmox.pool.lease': { method: 'POST', service: 'collector', path: () => `/api/v1/proxmox/pool/lease`, tags: ['live-write'] },
+  'v1.proxmox.pool.release': { method: 'POST', service: 'collector', path: ({ vmid }) => `/api/v1/proxmox/pool/${encodeURIComponent(vmid)}/release`, tags: ['live-write'] },
+  // DEVFLEET-P15: HYPERION activity (VMs, who holds each, node load, recent ops), read only.
+  'v1.proxmox.activity': { method: 'GET', service: 'collector', path: () => `/api/v1/proxmox/activity`, tags: ['live-safe'] },
+  'v1.proxmox.rehearsal': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/proxmox/rehearsals/${encodeURIComponent(id)}`, tags: ['live-safe'] },
   // quox#791: stored outcome of an approved gated tool call.
   'v1.approvals.result': {
     method: 'GET',
@@ -303,12 +346,38 @@ export const v1 = {
     path: ({ id }) => `/api/v1/approvals/${encodeURIComponent(id)}/result`,
     tags: ['live-safe'],
   },
+  // Fleet standing grants (2026-10-13): org-admin pre-approved ssh_exec lanes.
+  'v1.approvals.grants.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/approvals/grants`,
+    tags: ['live-safe'],
+  },
+  'v1.approvals.grants.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/approvals/grants`,
+    tags: ['live-write'],
+  },
+  'v1.approvals.grants.revoke': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/approvals/grants/${encodeURIComponent(id)}/revoke`,
+    tags: ['live-write'],
+  },
   'v1.tools.list': {
     method: 'GET',
     service: 'collector',
     path: () => `/api/v1/tools/list`,
     tags: ['live-safe'],
   },
+  // QUOXON-REACH: registered specialist roster (entity JSONs), used by `quox agent list`.
+  'v1.agents.registry': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/agent-registry`,
+    tags: ['live-safe'],
+  },
   // DEVSUITE-GRIPE-P7 / quox#567 (CLI half): agent-to-tool permission
   // mapping, keyed by agent id (Object.keys(...).agentTools) — the
   // no-auth-gate source of truth for "which agent ids currently exist",
@@ -431,6 +500,25 @@ export const v1 = {
     path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/say`,
     tags: ['live-write'],
   },
+  // QUOXON-BROADCAST: fan one message out to the org's held slots; status and per-slot acks.
+  'v1.slots.broadcast': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/slots/broadcast`,
+    tags: ['live-write'],
+  },
+  'v1.slots.broadcast.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/slots/broadcast/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'v1.slots.broadcast.ack': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/slots/broadcast/${encodeURIComponent(id)}/ack`,
+    tags: ['live-write'],
+  },
   'v1.slots.messages': {
     method: 'GET',
     service: 'collector',
@@ -445,6 +533,38 @@ export const v1 = {
     path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/wait`,
     tags: ['live-safe'],
   },
+  // QUOXON-MESH: SSE push of a slot's messages (the quox TUI's live inbound).
+  'v1.slots.stream': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/stream`,
+    tags: ['live-safe'],
+  },
+  // QUOXON-ROOMS: a slot as a group room. Join = subscribe + post without holding.
+  'v1.slots.join': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/join`,
+    tags: ['live-write'],
+  },
+  'v1.slots.leave': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/leave`,
+    tags: ['live-write'],
+  },
+  'v1.slots.members': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/slots/${encodeURIComponent(name)}/members`,
+    tags: ['live-safe'],
+  },
+  'v1.slots.rooms': {
+    method: 'GET',
+    service: 'collector',
+    path: () => '/api/v1/slot-rooms',
+    tags: ['live-safe'],
+  },
   // "Option B" assign model (plan v2 note #2831): assign an expected holder
   // ahead of time, claim checks out every slot assigned to a session name.
   'v1.slots.assign': {

package/lib/api/endpoints/ward.js

@@ -17,6 +17,13 @@ export const ward = {
     path: () => `/ward/entries`,
     tags: ['live-safe'],
   },
+  // PEEK: one WARD entry (a receipt) by its ward_entry_id; org-scoped for a user login.
+  'ward.entries.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/ward/entries/${id}`,
+    tags: ['live-safe'],
+  },
   'ward.stats.list': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/workflows.js

@@ -81,6 +81,13 @@ export const workflows = {
   // quoxflow#7: execute an engine-store workflow directly (the auth-service
   // runs route only knows auth-store workflows). Org comes from the caller's
   // auth context server-side, like the other quoxflow-direct entries.
+  // #997: `workflow delete` reaches engine workflows (the ones `workflow list` labels "engine")
+  'workflows.applyDelete': {
+    method: 'DELETE',
+    service: 'quoxflow',
+    path: ({ workflowId }) => `/api/workflows/${workflowId}`,
+    tags: ['live-write'],
+  },
   'workflows.applyExecute': {
     method: 'POST',
     service: 'quoxflow',

package/lib/api/endpoints/x.js

@@ -19,6 +19,14 @@ export const x = {
     path: () => `/x/media`,
     tags: ['live-write'],
   },
+  // GET /x/activity: recent claims + ledger + live budget (camelCase), org-scoped. `quox x status`
+  // reads the budget from here.
+  'x.activity': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/x/activity`,
+    tags: ['live-safe'],
+  },
 };
 
 export default x;

package/lib/commands/actions.js

@@ -0,0 +1,131 @@
+/**
+ * Action Tracker commands (read-only): `quox actions list | get`.
+ *
+ * #839 / #891: the agent has action_list but the CLI had no verb, so Action
+ * Tracker answers could not be checked against CLI truth. These verbs call the
+ * SAME governed tool the Action Tracker UI and the agent use (POST
+ * /api/v1/tools/execute, tool_name action_list), so chat, UI and CLI read one
+ * source. `add` and `done` write through the collector route the dashboard
+ * uses (POST/PATCH /api/v1/actions) as the logged-in user, via core/actionItems.js,
+ * the same core the Quox TUI /todo uses. Move/update/delete stay in chat and the UI.
+ */
+
+import { formatOutput, formatDetail, printSuccess } from '../core/output.js';
+import { QuoxError } from '../core/errors.js';
+import { confirmDestructive } from '../core/confirm.js';
+import { executeGovernedTool } from './tool.js';
+import { addActionItem, completeActionItem, moveActionItem, deleteActionItem, STATUS_COLUMNS, PRIORITIES } from '../core/actionItems.js';
+
+const STATUSES = ['todo', 'doing', 'done', 'all'];
+const MAX_PAGES = 50;
+
+async function listItems(ctx, { status = 'all', limit = 100, scope } = {}) {
+  if (!STATUSES.includes(status)) {
+    throw new QuoxError(`--status must be one of ${STATUSES.join(', ')}`);
+  }
+  const pageSize = Math.min(Math.max(Number(limit) || 20, 1), 100);
+  // Page through everything: a silent cap at one page hid 4 of 24 items (owner, 2026-10-20).
+  const all = [];
+  for (let page = 1; page <= MAX_PAGES; page++) {
+    const input = { status, limit: pageSize };
+    if (scope) input.scope_id = scope;
+    if (page > 1) input.page = page;
+    const data = await executeGovernedTool(ctx, 'action_list', input);
+    const result = data && data.result !== undefined ? data.result : data;
+    if (!result || result.success === false) {
+      throw new QuoxError(`action_list failed: ${(result && (result.error || result.message)) || 'no result'}`);
+    }
+    all.push(...(Array.isArray(result.items) ? result.items : []));
+    if (!result.hasMore) return all;
+  }
+  throw new QuoxError(`More than ${MAX_PAGES * pageSize} items; narrow with --status or --scope.`);
+}
+
+export function registerActionsCommands(program, ctx) {
+  const actions = program
+    .command('actions')
+    .description('Action Tracker items: list, get, add, done, move, delete (edit in chat or the dashboard)');
+
+  actions
+    .command('list')
+    .description('List action items')
+    .option('--status <status>', 'todo, doing, done or all', 'all')
+    .option('--limit <n>', 'page size (1-100); every page is listed', '100')
+    .option('--scope <scopeId>', 'only items in this team/department/division scope')
+    .action(async (options) => {
+      const items = await listItems({ ...ctx, program }, options);
+      formatOutput({
+        columns: ['id', 'status', 'priority', 'title', 'dueDate'],
+        headers: ['ID', 'Status', 'Priority', 'Title', 'Due'],
+        rows: items.map((i) => ({ ...i, dueDate: i.dueDate || '-' })),
+      }, { raw: items });
+    });
+
+  actions
+    .command('get')
+    .description('Show one action item by id')
+    .argument('<id>', 'action item id (from `quox actions list`)')
+    .action(async (id) => {
+      const items = await listItems({ ...ctx, program }, { status: 'all', limit: 100 });
+      const item = items.find((i) => i.id === id);
+      if (!item) throw new QuoxError(`No action item ${id} among the latest 100 items.`);
+      formatDetail(item);
+    });
+
+  actions
+    .command('add')
+    .description('Add an Action Tracker item (todo) as the logged-in user')
+    .argument('<text...>', 'what needs doing')
+    .option('--due <date>', 'YYYY-MM-DD, today or tomorrow')
+    .option('--priority <priority>', `one of ${PRIORITIES.join(', ')}`)
+    .option('--description <text>', 'longer notes')
+    .action(async (words, options) => {
+      ctx.auth.requireAuth();
+      const item = await addActionItem(ctx.client, { title: words, due: options.due, priority: options.priority, description: options.description });
+      if (program.opts().output === 'json') return formatDetail(item);
+      printSuccess(`Added action item ${item.id}: ${item.title}${item.due_date ? ` (due ${String(item.due_date).slice(0, 10)})` : ''}`);
+      return undefined;
+    });
+
+  actions
+    .command('done')
+    .description('Mark an Action Tracker item done')
+    .argument('<id>', 'action item id (from `quox actions list`)')
+    .action(async (id) => {
+      ctx.auth.requireAuth();
+      const item = await completeActionItem(ctx.client, id);
+      if (program.opts().output === 'json') return formatDetail(item);
+      printSuccess(`Marked done ${item.id}: ${item.title}`);
+      return undefined;
+    });
+
+  actions
+    .command('move')
+    .description('Move an Action Tracker item to todo, doing or done')
+    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<status>', STATUS_COLUMNS.join(', '))
+    .action(async (id, status) => {
+      ctx.auth.requireAuth();
+      const item = await moveActionItem(ctx.client, id, status);
+      if (program.opts().output === 'json') return formatDetail(item);
+      printSuccess(`Moved ${item.id} to ${item.status}: ${item.title}`);
+      return undefined;
+    });
+
+  actions
+    .command('delete')
+    .description('Delete one of your Action Tracker items (asks first; --yes skips, required without a terminal)')
+    .argument('<id>', 'action item id (from `quox actions list`)')
+    .option('-y, --yes', 'do not ask')
+    .action(async (id, options) => {
+      ctx.auth.requireAuth();
+      if (!(await confirmDestructive(program, { force: options.yes === true }, `Delete action item ${id}?`))) {
+        console.log('Not deleted.');
+        return undefined;
+      }
+      const r = await deleteActionItem(ctx.client, id);
+      if (program.opts().output === 'json') return formatDetail(r);
+      printSuccess(`Deleted ${r.id}${r.title ? `: ${r.title}` : ''}`);
+      return undefined;
+    });
+}

package/lib/commands/admin.js

@@ -27,6 +27,13 @@ export function registerAdminCommands(program, ctx) {
       const config = data.config || data;
       if (key) {
         // quox#533: `get <key>` used to be rejected outright.
+        // #1010: auth returns an ARRAY of { key, value, ... } rows; an object map is handled too.
+        if (Array.isArray(config)) {
+          const row = config.find((r) => r && r.key === key);
+          if (!row) throw new Error(`config key "${key}" not found. Run \`quox admin config get\` to list all keys.`);
+          formatDetail(row, { format: program.opts().output, title: 'Platform Config' });
+          return;
+        }
         if (!config || typeof config !== 'object' || !(key in config)) {
           throw new Error(`config key "${key}" not found. Run \`quox admin config get\` to list all keys.`);
         }
@@ -345,6 +352,15 @@ export function registerAdminCommands(program, ctx) {
       const body = {};
       if (options.dryRun) body.dry_run = true;
       const data = await client.post(resolveEndpoint('admin.retention.cleanup').path, { service: resolveEndpoint('admin.retention.cleanup').service, body });
+      if (options.dryRun) {
+        // quox#1084: servers before the fix ignored dry_run and deleted for real.
+        // Never present an unconfirmed result as a harmless preview.
+        if (!data || data.dry_run !== true) {
+          throw new Error('the server did not honour --dry-run (it predates quox#1084): the cleanup may have run for real. Check `quox admin retention stats`.');
+        }
+        formatDetail(data, { format: program.opts().output, title: 'Cleanup preview (dry run): nothing deleted' });
+        return;
+      }
       formatDetail(data, { format: program.opts().output, title: 'Cleanup Result' });
     });