quoxcli 0.3.1 → 0.4.0

package/lib/quoxon/rows.js

@@ -21,8 +21,11 @@ import { execFile } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { cellWidth } from './cells.js';
 
 export const MAX_ROWS = 3;
+/** Lines drawn above the status bar (a row can bring several with `lines`); the stored-row cap stays MAX_ROWS. */
+export const MAX_LINES = 4;
 export const FETCH_TIMEOUT_MS = 5000;
 /** url rows fetch from busy boxes (the proof board is ~400 KB): 15 s. cmd rows keep FETCH_TIMEOUT_MS. */
 export const URL_TIMEOUT_MS = 15000;
@@ -220,11 +223,55 @@ const trendText = (t) => {
   return '';
 };
 
+/* ---- cells (contract v1.1, TUI-QPE 2026-10-19) --------------------------------------------------
+ * A row may carry `cells`: [{ parts: [{ text, tone?, bold?, keep?, group? }], keep? }]. Each part has its own colour
+ * (a tone), so one row can say "70%" in amber and "▼12 broke" in red. `keep` says what goes first when the window is
+ * narrow: the lowest keep is dropped whole (a part, the parts sharing its group, or a cell; never half a word); no keep
+ * = never dropped. Rows with the same `grid` share one keep order and line their cells up in columns; `min_cols` hides
+ * a row in a narrower window.
+ */
+export const CELL_LIMITS = { cells: 6, parts: 12, text: 80 };
+const keepOf = (k) => (typeof k === 'number' && Number.isFinite(k) ? Math.max(0, Math.min(99, k)) : null);
+
+function parseCells(list, warnings) {
+  if (!Array.isArray(list)) { warnings.push('"cells" is a list of {parts: [{text, tone}]}; ignored.'); return []; }
+  const out = [];
+  for (const c of list.slice(0, CELL_LIMITS.cells)) {
+    const raw = Array.isArray(c?.parts) ? c.parts : typeof c?.text === 'string' ? [c] : null;
+    if (!raw) { warnings.push('A cell needs "parts" (or "text"); skipped.'); continue; }
+    const parts = [];
+    for (const p of raw.slice(0, CELL_LIMITS.parts)) {
+      // Keep edge spaces (a part's own joiner, " · reach 214/266"): clean the middle, not the ends.
+      const t = typeof p?.text === 'string' ? p.text : typeof p?.text === 'number' ? fmtNum(p.text) : '';
+      const lead = /^\s/.test(t) ? ' ' : ''; const trail = /\s$/.test(t) ? ' ' : '';
+      const body = cleanText(t, CELL_LIMITS.text);
+      if (!body) continue;
+      const part = { text: lead + body + trail };
+      if (p.tone !== undefined && p.tone !== null) {
+        if (STATUS_ROW_TONES.includes(p.tone)) { if (p.tone !== 'neutral') part.tone = p.tone; }
+        else warnings.push(`a part's "tone" is one of ${STATUS_ROW_TONES.join(', ')}; "${cleanText(p.tone, 16)}" shows as neutral.`);
+      }
+      if (p.bold === true) part.bold = true;
+      const k = keepOf(p.keep); if (k !== null) part.keep = k;
+      if (typeof p.group === 'string' && /^[A-Za-z0-9_-]{1,16}$/.test(p.group)) part.group = p.group; // parts that drop together
+      parts.push(part);
+    }
+    if (!parts.length) continue;
+    const cell = { parts };
+    const k = keepOf(c.keep); if (k !== null) cell.keep = k;
+    out.push(cell);
+  }
+  return out;
+}
+
+/** cells -> one plain line (screen context, /row list, a narrow fallback). */
+export const cellsText = (cells) => (cells || []).map((c) => c.parts.map((p) => p.text).join('').trim()).join(' │ ');
+
 /**
  * Parsed data -> { seg, warnings } | { error }. Lenient on read (an unknown tone shows neutral and is named
  * in warnings, so `quox rows test` can say so); strict on what it prints (everything passes cleanText).
  */
-export function parseStatusRow(d) {
+export function parseStatusRow(d, depth = 0) {
   if (!d || typeof d !== 'object' || Array.isArray(d)) return { error: 'A status row is a JSON object: {"text": "..."}.' };
   const warnings = [];
   const seg = {};
@@ -233,7 +280,25 @@ export function parseStatusRow(d) {
   if (typeof d.value === 'number' && Number.isFinite(d.value)) seg.value = fmtNum(d.value);
   else if (typeof d.value === 'string' && cleanText(d.value, 24)) seg.value = cleanText(d.value, 24);
   else if (d.value !== undefined && d.value !== null) warnings.push('"value" is a number or a short string; ignored.');
+  if (depth === 0 && d.lines !== undefined && d.lines !== null) { // TUI-QPE 2026-10-20: one source, several lines (v1.1)
+    if (!Array.isArray(d.lines)) warnings.push('"lines" is a list of status rows; ignored.');
+    else {
+      const lines = [];
+      for (const x of d.lines.slice(0, MAX_LINES)) { const q = parseStatusRow(x, 1); if (q.error) warnings.push(`a line: ${q.error}`); else { lines.push(q.seg); warnings.push(...q.warnings); } }
+      if (lines.length) { seg.lines = lines; if (!seg.text) seg.text = lines.map((l) => l.text).join(' / ').slice(0, 160); }
+    }
+  }
+  if (d.cells !== undefined && d.cells !== null) { // TUI-QPE: coloured, responsive cells (v1.1)
+    const cells = parseCells(d.cells, warnings);
+    if (cells.length) { seg.cells = cells; if (!seg.text) seg.text = cellsText(cells); }
+  }
   if (!seg.text && !seg.value) return { error: 'Not a status row: it needs "text" (see quox rows contract).' };
+  if (d.grid !== undefined && d.grid !== null) {
+    if (typeof d.grid === 'string' && /^[A-Za-z0-9_-]{1,16}$/.test(d.grid)) seg.grid = d.grid; else warnings.push('"grid" is a short name (letters, digits, - and _); ignored.');
+  }
+  if (d.min_cols !== undefined && d.min_cols !== null) {
+    if (Number.isInteger(d.min_cols) && d.min_cols >= 20 && d.min_cols <= 400) seg.minCols = d.min_cols; else warnings.push('"min_cols" is a whole number from 20 to 400; ignored.');
+  }
   if (d.tone !== undefined && d.tone !== null) {
     if (STATUS_ROW_TONES.includes(d.tone)) { if (d.tone !== 'neutral') seg.tone = d.tone; }
     else warnings.push(`"tone" is one of ${STATUS_ROW_TONES.join(', ')}; "${cleanText(d.tone, 16)}" shows as neutral.`);
@@ -620,6 +685,12 @@ export function rowParts(st, { now = Date.now(), labelW = 0 } = {}) {
   const live = st.status === 'ok' || (st.status === 'error' && d.role !== 'error');
   if (!live || st.status === 'loading') return [[d.text, d.role]];
   const label = row.label || seg?.label || '';
+  if (seg?.cells?.length) { // TUI-QPE: one cells row on its own (quox rows test); RowsBar uses layoutRows
+    const out = label ? [[label + ' ', 'brand', true]] : [];
+    seg.cells.forEach((c, i) => { if (i) out.push([CELL_SEP, 'label']); for (const p of c.parts) out.push(partSeg(p)); });
+    if (st.status === 'error') out.push([` · ${ageMark(now - st.at)} old`, 'warn']);
+    return out;
+  }
   const toneR = seg?.tone ? toneRole(seg.tone) : null;
   if (!label && !seg?.tone && !seg?.value && !seg?.trend) return [[d.text, d.role]];
   const out = [];
@@ -651,6 +722,178 @@ export function clipParts(parts, width) {
   return out;
 }
 
+/* ---- cells layout (TUI-QPE) ---------------------------------------------------------------- */
+
+export const CELL_SEP = ' │ ';
+const W = (t) => cellWidth(String(t));
+const cellW = (c) => c.parts.reduce((a, p) => a + W(p.text), 0);
+const cellsW = (cs) => cs.reduce((a, c, i) => a + cellW(c) + (i ? W(CELL_SEP) : 0), 0);
+
+/**
+ * cells -> the cells that fit in `room` columns. Whole items go, lowest `keep` first (a tie drops the rightmost); an
+ * item with no keep stays. If even the kept items do not fit, the line ends at a word boundary with … (never mid-word).
+ */
+/** Drop the one lowest-keep item (a tie drops the rightmost; a part takes its group with it). -> new cells, or null. */
+export function dropLowest(cells) {
+  let best = null;
+  cells.forEach((c, i) => {
+    const cand = (keep, pos, j) => { if (keep == null) return; if (!best || keep < best.keep || (keep === best.keep && pos > best.pos)) best = { keep, pos, i, j }; };
+    cand(c.keep, i * 1000 + 999, -1);
+    c.parts.forEach((p, j) => cand(p.keep, i * 1000 + j, j));
+  });
+  if (!best) return null;
+  const cs = cells.map((c) => ({ ...c, parts: [...c.parts] }));
+  if (best.j < 0) cs.splice(best.i, 1);
+  else {
+    const c = cs[best.i]; const g = c.parts[best.j].group;
+    c.parts = lead(g ? c.parts.filter((p) => p.group !== g) : c.parts.filter((_, j) => j !== best.j));
+    if (!c.parts.length) cs.splice(best.i, 1);
+  }
+  return cs;
+}
+
+export function fitCells(cells, room) {
+  let cs = (cells || []).map((c) => ({ ...c, parts: c.parts.map((p) => ({ ...p })) }));
+  while (cellsW(cs) > room) { const next = dropLowest(cs); if (!next) break; cs = next; }
+  if (cellsW(cs) <= room) return { cells: cs, clipped: false };
+  // Still too wide with only the must-keep items: cut at the last word that fits.
+  const out = []; let used = 0; const max = Math.max(1, room - 1);
+  for (let i = 0; i < cs.length; i++) {
+    const parts = [];
+    if (i) { if (used + W(CELL_SEP) > max) break; used += W(CELL_SEP); }
+    let full = true;
+    for (const p of cs[i].parts) {
+      const w = W(p.text);
+      if (used + w <= max) { parts.push(p); used += w; continue; }
+      const words = p.text.split(/(\s+)/); let t = '';
+      for (const wd of words) { if (used + W(t + wd) > max) break; t += wd; }
+      t = t.replace(/\s+$/, '');
+      if (t.trim()) { parts.push({ ...p, text: t }); used += W(t); } // whole words only, so this is a word boundary
+      full = false; break;
+    }
+    if (parts.length) out.push({ ...cs[i], parts });
+    if (!full) break;
+  }
+  if (!out.length) out.push({ parts: [{ text: '' }] });
+  const last = out[out.length - 1].parts; last[last.length - 1] = { ...last[last.length - 1], text: last[last.length - 1].text.replace(/\s+$/, '') };
+  last.push({ text: '…' });
+  return { cells: out, clipped: true };
+}
+
+/** A cell whose first item was dropped must not start with its joiner (" · CLI 578/958"): trim a leading " · ". */
+const lead = (parts) => (parts.length && /^\s*·\s*/.test(parts[0].text) ? [{ ...parts[0], text: parts[0].text.replace(/^\s*·\s*/, '') }, ...parts.slice(1)] : parts);
+
+/** One part -> a [text, role, bold] segment (the RowsBar shape). Tones are palette roles, never grey. */
+const partSeg = (p) => [p.text, p.tone ? toneRole(p.tone) : 'prose', Boolean(p.bold)];
+
+/** States whose seg has cells and something to show. */
+const hasCells = (st) => Boolean(st?.seg?.cells?.length) && (st.status === 'ok' || (st.status === 'error' && st.text));
+
+/**
+ * The rows RowsBar draws at `cols`, in order -> [{ st, parts }]: rows below their min_cols are left out; cells rows
+ * are fitted, and rows sharing a `grid` share a lead (label) column and pad their cells so the separators line up.
+ * Other rows keep the classic rowParts + clipParts path, unchanged.
+ */
+/**
+ * Rows -> one state per drawn line: a row whose seg has `lines` becomes one state per line (ids `<id>.<n>`, the row's
+ * label on the first only, the row's grid unless a line names its own). Other rows pass through unchanged.
+ */
+export function expandLines(states) {
+  const out = [];
+  for (const st of states || []) {
+    const ls = st?.seg?.lines;
+    if (!ls?.length || !(st.status === 'ok' || (st.status === 'error' && st.text))) { out.push(st); continue; }
+    ls.forEach((seg, i) => out.push({ ...st, row: { ...st.row, id: `${st.row.id}.${i + 1}`, label: i === 0 ? st.row.label : '' },
+      text: seg.text, seg: { ...seg, grid: seg.grid || st.seg.grid || `#${st.row.id}`, ...(i === 0 ? {} : { label: undefined }) } }));
+  }
+  return out;
+}
+
+export function layoutRows(states, cols, { now = Date.now() } = {}) {
+  const shown = expandLines(states).filter((st) => !(st?.seg?.minCols && cols < st.seg.minCols)).slice(0, MAX_LINES);
+  const room = Math.max(1, cols - 2);
+  const labelW = labelWidth(shown.filter((st) => !hasCells(st)));
+  const groups = new Map();
+  for (const st of shown) if (hasCells(st)) { const g = st.seg.grid || `#${st.row.id}`; if (!groups.has(g)) groups.set(g, []); groups.get(g).push(st); }
+  const done = new Map();
+  for (const list of groups.values()) {
+    const leadOf = (st) => String(st.row.label || st.seg.label || '');
+    const leadW = Math.min(16, Math.max(0, ...list.map((st) => W(leadOf(st)))));
+    const leadCols = leadW ? leadW + 1 : 0;
+    const roomL = room - leadCols;
+    const base = list.map((st) => {
+      const cells = st.seg.cells.map((c) => ({ ...c, parts: [...c.parts] }));
+      return cells;
+    });
+    // `keep` is ONE priority across the grid. The layout drops the shortest prefix of the grid-wide order (lowest keep
+    // first; a tie drops the rightmost, then the lower row) that lets every row fit with its columns lined up. A wider
+    // window can only shorten that prefix, so it never shows less (2026-10-20: a greedy per-row pass did, at 68/69 cols).
+    const units = [];
+    base.forEach((cells, r) => cells.forEach((c, i) => {
+      if (c.keep != null) units.push({ r, i, j: -1, keep: c.keep, pos: i * 1000 + 999 });
+      const seenG = new Set();
+      c.parts.forEach((p, j) => {
+        if (p.keep == null) return;
+        if (p.group) { if (seenG.has(p.group)) return; seenG.add(p.group); }
+        units.push({ r, i, j, group: p.group, keep: p.keep, pos: i * 1000 + j });
+      });
+    }));
+    units.sort((x, y) => x.keep - y.keep || y.pos - x.pos || y.r - x.r);
+    const build = (k) => {
+      const gone = units.slice(0, k);
+      return base.map((cells, r) => cells.map((c, i) => {
+        if (gone.some((u) => u.r === r && u.i === i && u.j < 0)) return null;
+        const parts = c.parts.filter((p, j) => !gone.some((u) => u.r === r && u.i === i && u.j >= 0 && (u.group ? p.group === u.group : u.j === j)));
+        return parts.length ? { ...c, parts: lead(parts) } : null;
+      }).filter(Boolean));
+    };
+    const colWidths = (rows) => { const w = []; for (const cs of rows) cs.forEach((c, i) => { if (i < cs.length - 1) w[i] = Math.max(w[i] || 0, cellW(c)); }); return w; };
+    const alignedW = (cs, w) => cs.reduce((a, c, i) => a + (i < cs.length - 1 ? Math.max(w[i] || 0, cellW(c)) : cellW(c)) + (i ? W(CELL_SEP) : 0), 0);
+    let rows = null;
+    for (let k = 0; k <= units.length; k++) {
+      const cand = build(k);
+      // A row whose must-keep items alone are too wide is cut at a word below and left out of the column widths.
+      const over = cand.map((cs) => cellsW(cs) > roomL);
+      const w = colWidths(cand.filter((_, r) => !over[r]));
+      if (cand.every((cs, r) => over[r] ? !units.slice(k).some((u) => u.r === r) : alignedW(cs, w) <= roomL)) { rows = cand; break; }
+    }
+    rows ??= build(units.length);
+    const over = rows.map((cs) => cellsW(cs) > roomL);
+    const colW = colWidths(rows.filter((_, r) => !over[r]));
+    list.forEach((st, r) => {
+      const f = over[r] ? fitCells(rows[r], roomL) : { cells: rows[r], clipped: false };
+      const pads = f.cells.map((c, i) => (!f.clipped && i < f.cells.length - 1 ? Math.max(0, (colW[i] || 0) - cellW(c)) : 0));
+      const out = [];
+      if (leadCols) out.push([leadOf(st) + ' '.repeat(Math.max(0, leadW - W(leadOf(st)))) + ' ', 'brand', true]);
+      f.cells.forEach((c, i) => {
+        if (i) out.push([CELL_SEP, 'label']);
+        for (const p of c.parts) out.push(partSeg(p));
+        if (pads[i]) out.push([' '.repeat(pads[i]), 'prose']);
+      });
+      done.set(st, out);
+    });
+    // The age of a stale value is said ONCE per grid and only in space the fit left over, never in the fit budget:
+    // appended per line it pushed whole items out every minute as the data aged (coordinator 2026-10-20 03:39Z).
+    // It goes on the first stale line that has room, else the line with the most room; with no room it is left out.
+    const stale = list.filter((st) => st.status === 'error' && st.at != null);
+    if (stale.length) {
+      const age = ` · ${ageMark(now - Math.min(...stale.map((st) => st.at)))} old`;
+      const used = (st) => done.get(st).reduce((a, [t]) => a + W(t), 0);
+      const roomOf = (st) => room - used(st);
+      const pick = stale.find((st) => roomOf(st) >= W(age)) || [...list].sort((a, b) => roomOf(b) - roomOf(a))[0];
+      if (pick && roomOf(pick) >= W(age)) done.get(pick).push([age, 'warn']);
+    }
+  }
+  return shown.map((st) => ({ st, parts: done.get(st) || clipParts(rowParts(st, { now, labelW }), room) }));
+}
+
+/** /qpe rows N: keep the first n rows of a grid (0 hides the grid). Rows not in the grid are untouched. */
+export function limitGrid(states, grid, n) {
+  if (n == null || !Number.isInteger(n) || n < 0) return states;
+  let seen = 0;
+  return (states || []).filter((st) => st?.seg?.grid !== grid || ++seen <= n);
+}
+
 /* ---- local-only store for cmd rows -------------------------------------------------------- */
 
 export const localRowsFile = () => join(homedir(), '.config', 'quox', 'quoxon-rows.local.json');

package/lib/quoxon/serverChip.js

@@ -0,0 +1,42 @@
+// TUI-STATUS: which REGISTERED server this quox runs on (the fleet host registry, `quox fleet hosts`).
+// Pure matcher + a once-per-session resolver. Unregistered or any failure -> null: the status line shows nothing,
+// and never the raw hostname (screenshots).
+import os from 'node:os';
+
+/** This machine's non-internal IPv4 addresses. */
+export function localIps(ifaces = os.networkInterfaces()) {
+  return Object.values(ifaces || {}).flat().filter(a => a && a.family === 'IPv4' && !a.internal).map(a => a.address);
+}
+
+const bare = (s) => String(s || '').toLowerCase().split('.')[0];
+
+/** hosts: [{ id, ip, group }] -> { name, role } for the host matching this machine's hostname or IP, else null. */
+export function matchServer(hosts, { hostname, ips = [] } = {}, registry) {
+  if (!Array.isArray(hosts)) return null;
+  const hn = bare(hostname);
+  const mine = new Set(ips);
+  const hit = hosts.find(h => h && h.id && hn && bare(h.id) === hn)
+    || hosts.find(h => h && h.id && h.ip && h.ip !== '0.0.0.0' && mine.has(h.ip));
+  if (!hit) return null;
+  // DEVFLEET: with a registry the role is the server's PURPOSE (e.g. "main dev"), never the Bastion group; no entry -> nothing.
+  if (registry !== undefined) { const p = registry?.servers?.[hit.id]?.purpose; return { name: String(hit.id), role: p ? String(p) : null }; }
+  return { name: String(hit.id), role: hit.group ? String(hit.group) : null };
+}
+
+/** The profile's instance host when it is NOT this machine (a remote instance), else null. */
+export function remoteHost(url, { hostname, ips = [] } = {}) {
+  let h;
+  try { h = new URL(url).hostname.toLowerCase(); } catch { return null; }
+  if (!h || h === 'localhost' || h === '::1' || h === '[::1]' || h.startsWith('127.') || mine(h, ips) || bare(h) === bare(hostname)) return null;
+  return h;
+}
+function mine(h, ips) { return ips.includes(h); }
+
+/** -> { name, role, remote } | null. Never throws; `listHosts` is async () => hosts[]. */
+export async function resolveServerChip({ listHosts, hostname = os.hostname(), ips = localIps(), url = null, registry } = {}) {
+  try {
+    const m = matchServer(await listHosts(), { hostname, ips }, registry);
+    if (!m) return null;
+    return { ...m, remote: url ? remoteHost(url, { hostname, ips }) : null };
+  } catch { return null; }
+}

package/lib/quoxon/session.js

@@ -141,6 +141,16 @@ export function sayMissText(input, rows, cap = 8) {
   ].filter(Boolean).join('\n');
 }
 
+/** SAY-LAST-TARGET: a word that is a URL, a path or an address (has / : or .) is never a slot or session name. */
+export const looksLikeAddress = (w) => /[/:.]/.test(String(w || ''));
+
+/** SAY-LAST-TARGET: "/say" with no usable target and nothing recent to offer: who to, and who is reachable. */
+export function sayWhoText(rows, cap = 8) {
+  const held = (Array.isArray(rows) ? rows : []).filter(r => r?.name && r.holder_session && r.state !== 'free');
+  const reach = held.slice(0, cap).map(r => `${r.name} (${r.holder_session})`).join(', ');
+  return ['Who to? /say <slot> <message>', reach ? `Reachable now: ${reach}${held.length > cap ? `, +${held.length - cap} more (/slots)` : ''}` : null].filter(Boolean).join('\n');
+}
+
 const idOf = (a) => String(a?.agent_id ?? a?.id ?? a?.name ?? '');
 const nameOf = (a) => String(a?.name ?? a?.agent_id ?? a?.id ?? '');
 

package/lib/quoxon/slash/cliCommand.js

@@ -25,6 +25,42 @@ function variants(w) {
 
 const MAX_DEPTH = 4;
 
+// CONTACTSQ: `/contact new Cristina Cowles --relationship Wife --mobile +44...` must become a command the verb accepts.
+// Per-leaf flag tables (value flags and bare switches), synonyms people type, and a clear refusal for anything else.
+const CONTACTS_ADD = {
+  value: ['phone', 'email', 'kind', 'organisation', 'job-title', 'relationship', 'notes', 'given', 'family', 'middle', 'prefix', 'suffix', 'nickname', 'phonetic-given', 'phonetic-family'],
+  bare: ['org-kind'],
+  synonyms: { mobile: 'phone', tel: 'phone', telephone: 'phone', cell: 'phone', number: 'phone', 'e-mail': 'email', rel: 'relationship', org: 'organisation', company: 'organisation', title: 'job-title' },
+  lower: ['relationship', 'kind'],
+};
+const NORMALISERS = { 'contacts add': (args) => normaliseFlags(args, CONTACTS_ADD, 'quox contacts add') };
+
+/** args = [...path, ...rest]. Positional words before the first flag become ONE name; flags are mapped and checked. */
+function normaliseFlags(args, spec, verb) {
+  const head = args.slice(0, 2);
+  const rest = args.slice(2);
+  const name = [];
+  const out = [];
+  let i = 0;
+  while (i < rest.length && !rest[i].startsWith('-')) name.push(rest[i++]);
+  while (i < rest.length) {
+    const tok = rest[i++];
+    if (!tok.startsWith('--')) return { error: `Unexpected "${tok}" after the flags. Quote values with spaces. ${verb} takes: ${[...spec.value, ...spec.bare].map(f => `--${f}`).join(' ')}` };
+    const eq = tok.indexOf('=');
+    const raw = (eq > 0 ? tok.slice(2, eq) : tok.slice(2)).toLowerCase();
+    const flag = spec.synonyms[raw] || raw;
+    if (spec.bare.includes(flag)) { out.push(`--${flag}`); continue; }
+    if (!spec.value.includes(flag)) return { error: `--${raw} is not a flag of ${verb}. It takes: ${[...spec.value, ...spec.bare].map(f => `--${f}`).join(' ')}` };
+    const vals = eq > 0 ? [tok.slice(eq + 1)] : [];
+    while (i < rest.length && !rest[i].startsWith('--')) vals.push(rest[i++]);
+    if (!vals.length || !vals.join('')) return { error: `--${raw} needs a value.` };
+    let v = vals.join(' ');
+    if (spec.lower.includes(flag)) v = v.toLowerCase();
+    out.push(`--${flag}`, v);
+  }
+  return { args: [...head, ...(name.length ? [name.join(' ')] : []), ...out] };
+}
+
 /** -> { path, cls, args, display } | null. args is the full argv after `quox` (quoted args preserved). */
 export function resolveCliSlash(cmd, restArg, leaves = LEAVES) {
   const first = String(cmd || '').replace(/^\//, '');
@@ -44,7 +80,12 @@ export function resolveCliSlash(cmd, restArg, leaves = LEAVES) {
     for (const p of walk(n)) {
       const path = p.join(' ');
       if (Object.prototype.hasOwnProperty.call(leaves, path)) {
-        const args = [...p, ...words.slice(n)];
+        let args = [...p, ...words.slice(n)];
+        if (NORMALISERS[path]) {
+          const nr = NORMALISERS[path](args);
+          if (nr.error) return { path, cls: leaves[path], args, display: `quox ${args.join(' ')}`, error: nr.error };
+          args = nr.args;
+        }
         return { path, cls: leaves[path], args, display: `quox ${args.map(a => (/[\s"']/.test(a) || a === '' ? JSON.stringify(a) : a)).join(' ')}` };
       }
     }

package/lib/quoxon/slash/cliLeaves.json

@@ -1,6 +1,10 @@
 {"account password":"never",
+"actions add":"write",
+"actions delete":"write",
+"actions done":"write",
 "actions get":"read",
 "actions list":"read",
+"actions move":"write",
 "active":"read",
 "admin agent-identity mint":"never",
 "admin config get":"read",
@@ -85,6 +89,10 @@
 "backup server restore-status":"read",
 "backup server status":"read",
 "backup verify":"write",
+"blog draft list":"read",
+"blog draft mark-published":"write",
+"blog draft show":"read",
+"blog draft submit":"write",
 "brain add":"write",
 "brain brief":"read",
 "brain check":"read",
@@ -180,8 +188,11 @@
 "contacts retention run":"write",
 "contacts retention status":"read",
 "contacts rewrap":"never",
+"contacts scheduled cancel":"write",
+"contacts scheduled list":"read",
 "contacts search":"read",
 "contacts selftest":"write",
+"contacts send":"write",
 "contacts settings":"write",
 "contacts show":"read",
 "contacts strict-names":"write",
@@ -258,6 +269,8 @@
 "engagement jobs":"read",
 "engagement list":"read",
 "engagement propose":"write",
+"engagement reconcile":"write",
+"engagement reconciliations":"write",
 "engagement regrade-finding":"write",
 "engagement report":"read",
 "engagement report-finding":"write",
@@ -275,6 +288,7 @@
 "engagement show":"read",
 "engagement sync-issues":"write",
 "engagement tools":"read",
+"engagement verify":"read",
 "engagement verify-finding":"write",
 "engagement verify-target":"write",
 "entity create":"write",
@@ -284,6 +298,12 @@
 "entity relate":"write",
 "entity search":"read",
 "entity unrelate":"write",
+"evidence bundle":"write",
+"evidence status":"read",
+"evidence verify":"read",
+"ext add":"write",
+"ext list":"read",
+"ext remove":"write",
 "facebook insights":"read",
 "facebook lead-forms":"read",
 "facebook leads":"read",
@@ -307,6 +327,7 @@
 "fleet gpu":"read",
 "fleet host-update":"write",
 "fleet hosts":"read",
+"fleet ping":"write",
 "fleet rehome-agent":"write",
 "fleet status":"read",
 "fleet summary":"read",
@@ -343,10 +364,12 @@
 "hat list":"read",
 "hat reset":"write",
 "hat show":"read",
+"hat upgrade":"never",
 "hat use":"never",
 "health":"read",
 "hyperion deck":"never",
 "hyperion status":"read",
+"image generate":"write",
 "inbox get":"read",
 "inbox list":"read",
 "inbox respond":"write",
@@ -368,6 +391,32 @@
 "inventory":"read",
 "invites accept":"never",
 "invites list":"read",
+"kuma coverage propose":"write",
+"kuma coverage show":"read",
+"kuma diagnose":"write",
+"kuma down":"write",
+"kuma hooks create":"never",
+"kuma hooks delete":"write",
+"kuma hooks list":"read",
+"kuma incidents":"write",
+"kuma maintenance end":"write",
+"kuma maintenance list":"read",
+"kuma maintenance open":"never",
+"kuma monitors add":"write",
+"kuma monitors edit":"write",
+"kuma monitors get":"read",
+"kuma monitors list":"read",
+"kuma monitors pause":"write",
+"kuma monitors remove":"write",
+"kuma monitors resume":"write",
+"kuma refresh":"write",
+"kuma sla list":"read",
+"kuma sla verify":"read",
+"kuma status":"read",
+"kuma status-incident draft":"write",
+"kuma status-incident publish":"write",
+"kuma status-incident resolve":"write",
+"kuma uptime":"write",
 "licence catalogue-sign":"never",
 "licence refresh":"write",
 "licence reissue":"never",
@@ -385,6 +434,12 @@
 "llm-policy test":"write",
 "login":"never",
 "logout":"never",
+"loop core-local add":"write",
+"loop core-local list":"read",
+"loop core-local remove":"write",
+"loop list":"read",
+"loop status":"read",
+"loop watch":"never",
 "lucid ack":"write",
 "lucid area":"read",
 "lucid ask":"read",
@@ -520,6 +575,7 @@
 "objective get":"read",
 "objective halt":"write",
 "objective list":"read",
+"objective retry":"write",
 "objective start":"write",
 "offload release":"write",
 "offload status":"read",
@@ -608,6 +664,7 @@
 "prompt update":"write",
 "prompt versions":"read",
 "provider connect":"write",
+"provider install":"write",
 "provider list":"read",
 "provider test":"read",
 "qlarity allowlist":"write",
@@ -639,6 +696,9 @@
 "quoxchat widgets":"read",
 "reach agent":"read",
 "reach unused":"read",
+"research domains add":"write",
+"research domains list":"read",
+"research domains remove":"write",
 "role agent clear":"write",
 "role agent list":"read",
 "role agent set":"write",
@@ -698,6 +758,7 @@
 "seo gaps":"read",
 "seo health":"read",
 "seo keywords":"read",
+"seo queries":"read",
 "seo remove-site":"write",
 "seo report deliver":"write",
 "seo sites":"read",
@@ -710,6 +771,12 @@
 "server config lan-targets":"write",
 "server diag":"write",
 "server doctor":"read",
+"server go":"never",
+"server list":"read",
+"server mark":"write",
+"server roles list":"read",
+"server roles set":"write",
+"server roles unset":"write",
 "server rollback":"write",
 "server status":"read",
 "server uninstall":"never",
@@ -730,6 +797,8 @@
 "setup license link":"write",
 "setup license status":"read",
 "setup status":"read",
+"shortcut add":"write",
+"shortcut remove":"write",
 "signup":"never",
 "sitrep":"read",
 "skills disclosures":"read",
@@ -945,4 +1014,10 @@
 "x search":"write",
 "x status":"read",
 "x thread":"write",
-"x timeline":"write"}
+"x timeline":"write",
+"youtube analytics":"write",
+"youtube channel":"write",
+"youtube comment":"write",
+"youtube thumbnail":"write",
+"youtube upload":"write",
+"youtube videos":"read"}

package/lib/quoxon/slash/evidenceCmd.js

@@ -0,0 +1,34 @@
+/**
+ * /evidence: export this conversation's signed evidence bundle (the same call as `quox evidence bundle`) to
+ * ~/quox-evidence/<conversation>-<timestamp>.zip and say what is in it. /ward lists the WARD receipts the export found
+ * (newest ten, then N more). /envelope, /envelopes and /aee are pointers to /proof (the envelope ids); /volt is the
+ * VOLT run, which travels inside the bundle. Pure formatting plus one api call; the lines are { text, tone }.
+ */
+import { wrapHang } from '../objects/model.js';
+export const EVIDENCE_ALIASES = ['envelope', 'envelopes', 'aee', 'volt', 'ward'];
+const SHOWN = 10;
+
+export async function runEvidenceCommand({ cmd, api, conversationId, cols = Infinity }) {
+  const W = Number.isFinite(cols) ? Math.max(20, cols - 4) : 1e9;
+  const wrapT = (l) => wrapHang(l.text, W, 4).map(text => ({ ...l, text }));
+  if (!api || typeof api.evidenceExport !== 'function') return [{ text: 'Evidence export is not available in this mode. In a terminal: quox evidence bundle', tone: 'warn' }].flatMap(wrapT);
+  if (!conversationId) return [{ text: 'No conversation to export yet: send a message first, or in a terminal run quox evidence bundle <conversation id>.', tone: 'warn' }].flatMap(wrapT);
+  let r;
+  try { r = await api.evidenceExport(conversationId); } catch (e) {
+    return [{ text: `Evidence export failed: ${e?.message || 'failed'}. Nothing was written.`, tone: 'warn' }].flatMap(wrapT);
+  }
+  const out = [];
+  const ok = r.verify && r.verify.ok;
+  out.push({ text: `${ok ? '✔' : '✖'} evidence bundle ${ok ? 'written and verified' : 'written but FAILED verification'}: ${r.path}`, tone: ok ? 'ok' : 'warn' });
+  out.push({ text: `  ${r.envelopes} envelopes, ${r.receipts} WARD receipts, conversation ${r.corr}`, tone: 'dim' });
+  if (cmd === '/ward') {
+    out.push({ text: '  WARD receipts for this conversation (the same bundle /evidence writes):', tone: 'dim' });
+    const rows = [...(r.receiptRows || [])].sort((a, b) => (b.seq || 0) - (a.seq || 0));
+    for (const x of rows.slice(0, SHOWN)) out.push({ text: `  WARD seq ${x.seq}  envelope ${x.envelope_id}`, tone: 'dim' });
+    if (rows.length > SHOWN) out.push({ text: `  ${rows.length - SHOWN} more in the bundle`, tone: 'dim' });
+    if (!rows.length) out.push({ text: '  No WARD receipt was found for this conversation\'s envelopes yet (witnessing can lag a few seconds).', tone: 'warn' });
+  }
+  if (cmd === '/volt') out.push({ text: '  The VOLT run (if this conversation has one) is volt.json inside the bundle.', tone: 'dim' });
+  out.push({ text: `  check it offline: quox evidence verify ${r.path}`, tone: 'dim' });
+  return out.flatMap(wrapT);
+}

package/lib/quoxon/slash/palette.js

@@ -96,7 +96,7 @@ export function filterPalette(items, query) {
     }
     if (best == null) return;
     if (exact(it)) best = -1;
-    if (it.disabled) best += 0.5; // a working command outranks an unavailable one on a tie
+    if (it.disabled) best += best >= 10 ? 1000 : 0.5; // a non-prefix match on an unavailable command ranks below every working match; a prefix keeps its place on a tie
     scored.push({ it, best, idx });
   });
   return scored.sort((a, b) => a.best - b.best || a.idx - b.idx).map(x => x.it);