quoxcli 0.3.1 → 0.4.0

package/lib/api/endpoints/actions.js

@@ -0,0 +1,15 @@
+/**
+ * 'actions.*' endpoints — Action Tracker items through the collector proxy
+ * (services/collector/server.js /api/v1/actions*, which forwards to the auth
+ * service's org-scoped actions routes with the caller's own bearer token).
+ * No org segment in the URL: the collector takes the org from the verified JWT.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const actions = {
+  'actions.list': { method: 'GET', service: 'collector', path: () => '/api/v1/actions', tags: ['live-safe'] },
+  'actions.create': { method: 'POST', service: 'collector', path: () => '/api/v1/actions', tags: ['live-write'] },
+  'actions.update': { method: 'PATCH', service: 'collector', path: ({ id }) => `/api/v1/actions/${id}`, tags: ['live-write'] },
+  'actions.delete': { method: 'DELETE', service: 'collector', path: ({ id }) => `/api/v1/actions/${id}`, tags: ['live-write'] },
+};

package/lib/api/endpoints/admin.js

@@ -43,6 +43,26 @@ export const admin = {
     path: () => '/api/admin/instance/lan-targets',
     tags: ['admin-write'],
   },
+  // SECURITY containment (2026-10-26): orgs allowed to run QLoop loops in-server (core-local). Served by
+  // services/auth/routes/admin-instance.js; writes are instance-admin only.
+  'admin.instance.core_local_orgs.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => '/api/admin/instance/core-local-orgs',
+    tags: ['live-safe'],
+  },
+  'admin.instance.core_local_orgs.add': {
+    method: 'POST',
+    service: 'auth',
+    path: () => '/api/admin/instance/core-local-orgs',
+    tags: ['admin-write'],
+  },
+  'admin.instance.core_local_orgs.remove': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId }) => `/api/admin/instance/core-local-orgs/${orgId}`,
+    tags: ['admin-write'],
+  },
   'admin.config.update': {
     method: 'PATCH',
     service: 'auth',

package/lib/api/endpoints/blog.js

@@ -0,0 +1,16 @@
+/**
+ * 'blog.*' endpoints: BLOG-DRAFT. Blog drafts are NotesQ notes in the blog-drafts collection,
+ * submitted and handed to the blog publisher through the collector
+ * (services/collector/lib/blogDraftRoutes.js). Nothing here publishes.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+const B = '/api/v1/blog/drafts';
+
+export const blog = {
+  'blog.drafts.submit': { method: 'POST', service: 'collector', path: () => B, tags: ['live-write'] },
+  'blog.drafts.list': { method: 'GET', service: 'collector', path: () => B, tags: ['live-safe'] },
+  'blog.drafts.get': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/${id}`, tags: ['live-safe'] },
+  'blog.drafts.published': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/${id}/published`, tags: ['live-write'] },
+};

package/lib/api/endpoints/chat.js

@@ -11,6 +11,13 @@ export const chat = {
     path: () => `/chat/claude`,
     tags: ['live-write'],
   },
+  // CHAT-TIMEOUTS: poll an async chat turn (POST /chat/claude with Prefer: respond-async) by id.
+  'chat.turn.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/chat/turns/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
   'chat.status.list': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/contactsq.js

@@ -64,5 +64,9 @@ export const contactsq = {
   'contactsq.policy': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/policy`, tags: ['live-safe'] },
   'contactsq.handoffs.add': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/handoffs` },
   'contactsq.handoffs': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/handoffs`, tags: ['live-safe'] },
+  // Scheduled sends: a human send (now or --at), the pending queue, cancel.
+  'contactsq.sends.create': { method: 'POST', service: 'collector', path: () => `${B}/sends`, tags: ['live-write'] },
+  'contactsq.sends.scheduled': { method: 'GET', service: 'collector', path: () => `${B}/sends/scheduled`, tags: ['live-safe'] },
+  'contactsq.sends.cancel': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/sends/scheduled/${id}/cancel`, tags: ['live-write'] },
   'contactsq.settings.update': { method: 'PUT', service: 'collector', path: () => `${B}/settings`, tags: ['live-write'] },
 };

package/lib/api/endpoints/devServerRegistry.js

@@ -0,0 +1,25 @@
+/**
+ * 'devServerRegistry.*' endpoints: the org-scoped dev-server registry behind `quox server list|mark|go`
+ * and the TUI server chip (DEVFLEET). Collector-owned (services/collector/lib/devServerRegistryRoutes.js).
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const devServerRegistry = {
+  'devServerRegistry.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/dev-server-registry`,
+    tags: ['live-safe'],
+  },
+  'devServerRegistry.put': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/dev-server-registry/${encodeURIComponent(name)}`,
+  },
+  'devServerRegistry.remove': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/dev-server-registry/${encodeURIComponent(name)}`,
+  },
+};

package/lib/api/endpoints/engagement.js

@@ -36,6 +36,12 @@ export const engagement = {
     path: ({ id }) => `/api/v1/security/engagements/${id}`,
     tags: ['live-safe'],
   },
+  'engagement.verify': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/security/engagements/${id}/verify`,
+    tags: ['live-safe'],
+  },
   // Per-engagement gripe target: which repo a finding filed from this
   // engagement goes to, and which org's GitHub connector token files it.
   // lib/securityEngagement.js's setEngagementGripeTarget.
@@ -141,6 +147,26 @@ export const engagement = {
     path: ({ findingId }) => `/api/v1/security/findings/${findingId}/resolve`,
     tags: ['live-write'],
   },
+  // SITREP-FINDINGS: reconcile a finding against gathered evidence (issue state, fix commit
+  // landed or deployed). The collector decides; lib/securityFindings.js reconcileFinding.
+  'engagement.findings.reconcile': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ findingId }) => `/api/v1/security/findings/${findingId}/reconcile`,
+    tags: ['live-write'],
+  },
+  'engagement.findings.reconciliations': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ findingId }) => `/api/v1/security/findings/${findingId}/reconciliations`,
+    tags: ['live-safe'],
+  },
+  'engagement.findings.open': {
+    method: 'GET',
+    service: 'collector',
+    path: () => '/api/v1/security/findings/open',
+    tags: ['live-safe'],
+  },
   // Re-grade a finding's severity after it was reported (quox#601). Governed +
   // witnessed; a reason is required. lib/securityFindings.js regradeFinding.
   'engagement.findings.regrade': {

package/lib/api/endpoints/evidence.js

@@ -0,0 +1,20 @@
+/**
+ * 'evidence.*' endpoints (DEVFLEET EV-1): read-only status of the evidence stores.
+ * Collector route, instance admin only (enforced server-side).
+ */
+
+export const evidence = {
+  'evidence.status': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/admin/evidence/status`,
+    tags: ['live-safe'],
+  },
+  // The signed zip for one conversation (collector GET /aee/conversation/:corr/bundle?format=zip), org-scoped server-side.
+  'evidence.bundle': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ corr }) => `/aee/conversation/${encodeURIComponent(corr)}/bundle`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/hat.js

@@ -63,4 +63,18 @@ export const hat = {
     service: 'auth',
     path: ({ orgId, hatId }) => `/api/orgs/${orgId}/quoxhat/hats/${encodeURIComponent(hatId)}/reset-to-template`,
   },
+  // Merge-upgrade (2026-10-19): 3-way merge of an org-edited built-in onto the current
+  // template. Preview is a dry run (writes nothing); upgrade appends one system-authored
+  // revision (audited quoxhat.hat.template_merged) and refuses a stale preview (409).
+  'hat.upgrade.preview': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, hatId }) => `/api/orgs/${orgId}/quoxhat/hats/${encodeURIComponent(hatId)}/upgrade-preview`,
+    tags: ['live-safe'],
+  },
+  'hat.upgrade': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, hatId }) => `/api/orgs/${orgId}/quoxhat/hats/${encodeURIComponent(hatId)}/upgrade`,
+  },
 };

package/lib/api/endpoints/index.js

@@ -50,6 +50,7 @@
  *   of silently landing in the wrong file.
  */
 
+import { actions } from './actions.js';
 import { admin } from './admin.js';
 import { aee } from './aee.js';
 import { agentAttach } from './agent-attach.js';
@@ -61,6 +62,7 @@ import { awareness } from './awareness.js';
 import { router } from './router.js';
 import { mind } from './mind.js';
 import { lucid } from './lucid.js';
+import { loops } from './loops.js';
 import { away } from './away.js';
 import { presence } from './presence.js';
 import { invites } from './invites.js';
@@ -83,10 +85,12 @@ import { engine } from './engine.js';
 import { executions } from './executions.js';
 import { file } from './file.js';
 import { files } from './files.js';
+import { evidence } from './evidence.js';
 import { governance } from './governance.js';
 import { inbox } from './inbox.js';
 import { inboxq } from './inboxq.js';
 import { notesq } from './notesq.js';
+import { blog } from './blog.js';
 import { contactsq } from './contactsq.js';
 import { x } from './x.js';
 import { llmPolicy } from './llm-policy.js';
@@ -106,6 +110,7 @@ import { quoxflow } from './quoxflow.js';
 import { quoxplan } from './quoxplan.js';
 import { qlarity } from './qlarity.js';
 import { fetchAllowlist } from './fetchAllowlist.js';
+import { devServerRegistry } from './devServerRegistry.js';
 import { quoxseo } from './quoxseo.js';
 import { telephony } from './telephony.js';
 import { voice } from './voice.js';
@@ -115,6 +120,7 @@ import { runs } from './runs.js';
 import { scim } from './scim.js';
 import { scopes } from './scopes.js';
 import { security } from './security.js';
+import { server } from './server.js';
 import { setup } from './setup.js';
 import { skills } from './skills.js';
 import { sso } from './sso.js';
@@ -136,6 +142,7 @@ import { webhooks } from './webhooks.js';
 import { workflows } from './workflows.js';
 
 export const ENDPOINTS = {
+  ...actions,
   ...admin,
   ...aee,
   ...agentAttach,
@@ -147,6 +154,7 @@ export const ENDPOINTS = {
   ...router,
   ...mind,
   ...lucid,
+  ...loops,
   ...away,
   ...presence,
   ...invites,
@@ -169,10 +177,12 @@ export const ENDPOINTS = {
   ...executions,
   ...file,
   ...files,
+  ...evidence,
   ...governance,
   ...inbox,
   ...inboxq,
   ...notesq,
+  ...blog,
   ...contactsq,
   ...x,
   ...llmPolicy,
@@ -192,6 +202,7 @@ export const ENDPOINTS = {
   ...quoxplan,
   ...qlarity,
   ...fetchAllowlist,
+  ...devServerRegistry,
   ...quoxseo,
   ...telephony,
   ...voice,
@@ -201,6 +212,7 @@ export const ENDPOINTS = {
   ...scim,
   ...scopes,
   ...security,
+  ...server,
   ...setup,
   ...skills,
   ...sso,

package/lib/api/endpoints/loops.js

@@ -0,0 +1,26 @@
+/**
+ * 'loops.*' endpoints: QLOOP-LIVE, observe a loop as it runs.
+ * Served by the collector (/api/v1/loops/*), which forwards the caller's identity to the tasks
+ * service that owns the durable per-loop event log. Contract: ~/quoxon-work/qloop-live-design.md section 1.
+ */
+
+export const loops = {
+  'loops.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/loops`,
+    tags: ['live-safe'],
+  },
+  'loops.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/loops/${id}`,
+    tags: ['live-safe'],
+  },
+  'loops.events': {
+    method: 'STREAM',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/loops/${id}/events`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/mon.js

@@ -127,6 +127,179 @@ export const mon = {
     path: () => `/docker/system-df`,
     tags: ['live-safe'],
   },
+  'mon.kuma.monitors.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.monitors.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.monitors.create': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.monitors.update': {
+    method: 'PATCH',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.monitors.pause': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}/pause`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.monitors.resume': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}/resume`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.monitors.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.incidents.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ open, limit } = {}) => {
+      const q = [];
+      if (open) q.push('open=1');
+      if (limit) q.push(`limit=${encodeURIComponent(limit)}`);
+      return `/api/v1/kuma/incidents${q.length ? `?${q.join('&')}` : ''}`;
+    },
+    tags: ['live-safe'],
+  },
+  'mon.kuma.incidents.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/incidents/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.coverage.get': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/kuma/coverage`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.coverage.propose': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/coverage/propose`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.maintenance.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/kuma/maintenance`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.maintenance.open': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/maintenance`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.maintenance.end': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/maintenance/${encodeURIComponent(id)}/end`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.statusIncident.draft': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/status-incidents/${encodeURIComponent(id)}/draft`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.statusIncident.publish': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/status-incidents/${encodeURIComponent(id)}/publish`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.statusIncident.resolve': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/status-incidents/resolve`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.diagnose.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/diagnose`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.sla.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/sla`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.sla.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/kuma/sla`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.sla.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/sla/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.sla.verify': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/sla/${encodeURIComponent(id)}/verify`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.hooks.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/kuma/hooks`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.hooks.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/hooks`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.hooks.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/hooks/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.refresh.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/monitoring/uptime-kuma/refresh`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.live.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ fresh } = {}) => `/api/v1/kuma/status${fresh ? '?fresh=1' : ''}`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.status.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ slug }) => `/api/v1/monitoring/uptime-kuma/status/${encodeURIComponent(slug)}`,
+    tags: ['live-safe'],
+  },
   'mon.metrics.get': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/objectives.js

@@ -11,6 +11,12 @@ export const objectives = {
     path: ({ id }) => `/api/objectives/${id}/approve-plan`,
     tags: ['live-write'],
   },
+  'objectives.retry': {
+    method: 'POST',
+    service: 'tasks',
+    path: ({ id }) => `/api/objectives/${id}/retry`,
+    tags: ['live-write'],
+  },
   'objectives.cancel': {
     method: 'DELETE',
     service: 'tasks',

package/lib/api/endpoints/quoxseo.js

@@ -59,6 +59,12 @@ export const quoxseo = {
     path: ({ query = '' }) => `/api/v1/quoxseo/trends${query}`,
     tags: ['live-safe'],
   },
+  'quoxseo.queries.rows': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ query = '' }) => `/api/v1/quoxseo/queries/rows${query}`,
+    tags: ['live-safe'],
+  },
   'quoxseo.inspection': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/server.js

@@ -0,0 +1,21 @@
+/**
+ * 'server.*' endpoints: moved out of admin.js so each key carries its fragment's own domain prefix.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const server = {
+  // DEVFLEET CX-2: server roles registry (role -> url, read before env by resolveServiceUrl). Collector routes;
+  // list is instance-admin readable, set/unset/test are instance-OWNER only (see services/collector/server.js).
+  'server.roles.list': {
+    method: 'GET', service: 'collector', path: () => '/api/v1/server/roles', tags: ['live-safe'],
+  },
+  'server.roles.set': {
+    method: 'PUT', service: 'collector', path: ({ role }) => `/api/v1/server/roles/${encodeURIComponent(role)}`, tags: ['admin-write'],
+  },
+  'server.roles.unset': {
+    method: 'DELETE', service: 'collector', path: ({ role }) => `/api/v1/server/roles/${encodeURIComponent(role)}`, tags: ['admin-write'],
+  },
+  'server.roles.test': {
+    method: 'POST', service: 'collector', path: ({ role }) => `/api/v1/server/roles/${encodeURIComponent(role)}/test`, tags: ['admin-write'],
+  },
+};

package/lib/api/endpoints/setup.js

@@ -81,6 +81,12 @@ export const setup = {
     path: ({ pluginId }) => `/api/setup/licensing/seats/${encodeURIComponent(pluginId)}/release-dead`,
     tags: ['live-write'],
   },
+  'setup.licensing.seats.release': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ pluginId }) => `/api/setup/licensing/seats/${encodeURIComponent(pluginId)}/release`,
+    tags: ['live-write'],
+  },
   'setup.status.list': {
     method: 'GET',
     service: 'auth',

package/lib/api/endpoints/v1.js

@@ -59,6 +59,14 @@ export const v1 = {
     path: () => `/api/v1/fleet/hosts`,
     tags: ['live-safe'],
   },
+  // quoxbastion#34 — `quox fleet ping [host]`: governed Bastion host-state
+  // refresh (org admin; emits a quox.fleet.ping evidence envelope).
+  'v1.fleet.ping': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/fleet/ping`,
+    tags: ['admin-write'],
+  },
   // DEVSUITE-HUB Phase 2 — `quox dev enable` (see lib/commands/dev.js).
   // Constructs + signs + delivers a quoxagent dev.CapabilityProfile onto a
   // target host via Bastion. See services/collector/server.js's
@@ -290,6 +298,32 @@ export const v1 = {
     path: () => `/api/v1/policies/validate`,
     tags: ['live-write'],
   },
+  // LAZY-AI-CLI: vendor CLIs (Claude Code, Codex) the user's own server installs from npm. Status is any
+  // signed-in caller; plan + install need a human instance admin (the binary is instance-wide).
+  'v1.providers.cli.status': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/providers/cli`,
+    tags: ['live-safe'],
+  },
+  'v1.providers.cli.plan': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ tool }) => `/api/v1/providers/cli/${encodeURIComponent(tool)}/plan`,
+    tags: ['live-safe'],
+  },
+  'v1.providers.cli.install': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ tool }) => `/api/v1/providers/cli/${encodeURIComponent(tool)}/install`,
+    tags: ['live-write'],
+  },
+  'v1.providers.cli.job': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/providers/cli/jobs/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
   'v1.tools.execute': {
     method: 'POST',
     service: 'collector',