quoxcli 0.3.1 → 0.4.0

package/lib/quoxon/slash/qpeCmd.js

@@ -0,0 +1,35 @@
+/**
+ * TUI-QPE (owner 2026-10-19): /qpe 0|1|2|3|4, how many Quox Proof Engine lines show above the status bar.
+ * The lines are the ones whose status-row JSON says grid "qpe" (quox-qpe-row all prints four: headline, movement,
+ * coverage, and the cli.quox.ai content line, owner 2026-10-20). The count is a CLI setting
+ * on the active profile (quoxon.qpeRows); unset shows every QPE row. 0 hides them; the rows keep refreshing, so
+ * turning them back on shows a current value at once. Narrow windows still drop the coverage row (min_cols).
+ */
+export const QPE_GRID = 'qpe';
+export const QPE_MAX = 4;
+
+/** The saved count, or null (show all) when unset or not a whole number 0..4. */
+export function qpeRowsSetting(settings) {
+  const n = settings?.qpeRows;
+  return Number.isInteger(n) && n >= 0 && n <= QPE_MAX ? n : null;
+}
+
+/** "/qpe <arg>" -> { text, tone, save? }. save is the value to store under qpeRows. Pure. */
+export function qpeCommand(arg, settings) {
+  const words = String(arg || '').trim().toLowerCase().split(/\s+/).filter(Boolean);
+  const cur = qpeRowsSetting(settings);
+  const now = cur == null ? 'all 3 proof rows and the content row' : String(cur);
+  if (!words.length || (words[0] === 'rows' && words.length === 1)) {
+    return { text: `QPE rows above the status bar: ${now}. /qpe 0|1|2|3|4 or /qpe all changes it (0 hides them, 4 adds content).` };
+  }
+  // Owner typed `/qpe 3` and `/qpe all` (2026-10-20): "rows" is optional and words map to counts.
+  const vals = words[0] === 'rows' ? words.slice(1) : words;
+  const WORD = { all: 3, full: 3, on: 3, show: 3, max: 3, off: 0, hide: 0, none: 0, hidden: 0 };
+  const v = vals.length === 1 ? (/^[0-4]$/.test(vals[0]) ? Number(vals[0]) : WORD[vals[0]]) : undefined;
+  if (v === undefined) {
+    return { text: 'Usage: /qpe 0|1|2|3|4, or all / off (0 hides the proof engine rows, 3 shows headline, movement and coverage, 4 adds content).', tone: 'warn' };
+  }
+  const n = v;
+  const what = ['hidden', 'headline only', 'headline and movement', 'headline, movement and coverage', 'headline, movement, coverage and content'][n];
+  return { text: `QPE rows: ${n} (${what}). Saved to this profile.`, tone: 'ok', save: n };
+}

package/lib/quoxon/slash/restart.js

@@ -83,7 +83,14 @@ export function settleMsFrom(env = process.env) {
   return env.QUOX_RESTART_SETTLE_MS != null && env.QUOX_RESTART_SETTLE_MS !== '' && Number.isFinite(n) && n >= 0 ? n : RESTART_SETTLE_MS;
 }
 
-export function startBuildWatch({ onNotice, everyMs = 60000, check = newerBuild, repeat = false, buildId = installedBuildId, settleMs = 0, now = Date.now, ...opts } = {}) {
+export const RESTART_MIN_GAP_MS = 15 * 60 * 1000; // no auto-restart offer this soon after this process started (builds seen meanwhile are remembered)
+
+export function minGapMsFrom(env = process.env) {
+  const n = Number(env.QUOX_RESTART_MIN_GAP_MS);
+  return env.QUOX_RESTART_MIN_GAP_MS != null && env.QUOX_RESTART_MIN_GAP_MS !== '' && Number.isFinite(n) && n >= 0 ? n : RESTART_MIN_GAP_MS;
+}
+
+export function startBuildWatch({ onNotice, everyMs = 60000, check = newerBuild, repeat = false, buildId = installedBuildId, settleMs = 0, minGapMs = 0, now = Date.now, ...opts } = {}) {
   let last; // repeat mode: the last build announced
   let seen; let seenAt = 0; let seenNotice = null; // repeat mode: the build waiting to settle, and when it last changed
   const bootAt = now();
@@ -99,6 +106,7 @@ export function startBuildWatch({ onNotice, everyMs = 60000, check = newerBuild,
     seenNotice = t;
     const t0 = now() - bootAt < RESTART_BOOT_WINDOW_MS ? Math.max(seenAt, bootAt) : seenAt;
     if (now() - t0 < settleMs) return;
+    if (now() - bootAt < minGapMs) return; // min gap since start: remembered in seen, offered once the gap has passed
     last = b;
     onNotice(seenNotice, b);
   }, everyMs);
@@ -200,3 +208,19 @@ export function execRestart({ argv, conversationId, profile = null, name = null,
   if (r.error) return { error: `${r.error.code || 'failed'}: ${r.error.message}`, bin: plan.cmd };
   return { code: r.status ?? (r.signal ? 128 + (os.constants.signals[r.signal] || 0) : 1), bin: plan.cmd };
 }
+
+export const SERVER_WAIT_EVERY_MS = 2000; // poll the collector /health this often while a restart waits for it
+export const SERVER_WAIT_MAX_MS = 3 * 60 * 1000; // ...for up to this long, then carry on as before
+
+/** Poll `probe` (-> { ok } | truthy/falsy, may throw) until it answers ok. -> true when healthy, false on timeout or cancel. */
+export async function waitForHealthy({ probe, everyMs = SERVER_WAIT_EVERY_MS, maxMs = SERVER_WAIT_MAX_MS, cancelled = () => false, sleep = (ms) => new Promise((r) => { const t = setTimeout(r, ms); t.unref?.(); }), now = Date.now } = {}) {
+  if (typeof probe !== 'function') return true;
+  const end = now() + maxMs;
+  for (;;) {
+    if (cancelled()) return false;
+    let r = null; try { r = await probe(); } catch { r = null; }
+    if (r === true || r?.ok === true) return true;
+    if (cancelled() || now() + everyMs > end) return false;
+    await sleep(everyMs);
+  }
+}

package/lib/quoxon/slash/resume.js

@@ -16,13 +16,30 @@ export function age(iso, now = Date.now()) {
   return `${Math.round(s / 86400)}d ago`;
 }
 
+// Box-drawing, block, geometric, braille and halfwidth-kana characters are what the TUI itself paints (dividers, busy strip,
+// dragon art, scrambled labels). A title containing them was derived from rendered UI, never typed by anyone.
+const RENDERED = /[\u2500-\u259F\u25A0-\u25FF\u2800-\u28FF\uFF61-\uFF9F]/g;
+/** A conversation title safe to show, or null when it is made of rendered UI (3+ painted characters) or empty. */
+export function cleanTitle(t) {
+  const s = String(t ?? '');
+  if ((s.match(RENDERED) || []).length >= 3) return null;
+  const c = s.replace(RENDERED, ' ').replace(/\s+/g, ' ').trim();
+  return c || null;
+}
+/** The first user message of stored turns as a title (<= 60 chars), or null. */
+export function titleFromTurns(turns = []) {
+  const u = (turns || []).find(t => t.role === 'user' && String(t.content || '').trim());
+  const c = u ? cleanTitle(String(u.content).split('\n')[0]) : null;
+  return c ? (c.length > 60 ? `${c.slice(0, 60).trimEnd()}…` : c) : null;
+}
+
 /** -> [{ id, title, agent, updated_at, turns }] newest first. */
 export function resumeRows(conversations = [], index = null, names = {}) {
   const agentOf = new Map();
   for (const r of index?.rows || []) if (r.kind === 'conversation' && r.id) agentOf.set(r.id, r.agent || null);
   return conversations.map(c => ({
     id: c.id,
-    title: names[c.id]?.name || c.title || '(untitled)',
+    title: cleanTitle(names[c.id]?.name) || cleanTitle(c.title) || '(untitled)',
     agent: agentOf.get(c.id) ?? null,
     updated_at: c.updated_at || null,
     turns: c.turn_count ?? null

package/lib/quoxon/slash/todoCmd.js

@@ -0,0 +1,122 @@
+/**
+ * /todo <text> adds an Action Tracker item; /todo alone and /todos list the board; /todo move do5 done moves one
+ * (owner typed /todo, 2026-10-20). The writes and reads are core/actionItems.js, the same core as `quox actions`.
+ * Items get per-listing short ids by column: td1.. (to do), do1.. (doing), dn1.. (done). They are positions in the
+ * last list, mapped to real item ids; a move re-reads the board and says so when the list has changed.
+ * Pure helpers here: parse, short ids, wording.
+ */
+export const DONE_SHOWN = 10;
+const PREFIX = { backlog: 'td', doing: 'do', done: 'dn' };
+const COLUMN_NAME = { backlog: 'To do', doing: 'Doing', done: 'Done' };
+const REF = /^(td|do|dn)(\d+)$/i;
+const STATUS_WORD = { todo: 'todo', 'to-do': 'todo', td: 'todo', doing: 'doing', do: 'doing', wip: 'doing', progress: 'doing', 'in-progress': 'doing', done: 'done', dn: 'done', complete: 'done', completed: 'done', finished: 'done' };
+const USAGE = 'Usage: /todo <text> adds. /todos lists. /todo move do5 done (or /todo do5 done, /todo mark do2 done, /todo td3 doing) moves one.';
+
+/** A column word -> 'todo' | 'doing' | 'done' | null. Accepts "to do" and "in progress" as two words. */
+export function statusWord(words) {
+  const w = (Array.isArray(words) ? words.join('-') : String(words || '')).trim().toLowerCase();
+  return STATUS_WORD[w] || null;
+}
+
+/** Leading short ids from words, comma and/or space separated ("td1,td2", "td1 td2", "td1, td2") -> { refs, used } (used = words consumed). */
+export function takeRefs(words) {
+  const refs = [];
+  let used = 0;
+  for (const w of words) {
+    const parts = String(w).split(',').filter(Boolean);
+    if (!parts.length || !parts.every((p) => REF.test(p))) break;
+    refs.push(...parts.map((p) => p.toLowerCase()));
+    used += 1;
+  }
+  return { refs: [...new Set(refs)], used };
+}
+
+/** "/done td1,td2" argument -> { kind: 'done', refs } | { kind: 'usage', text }. Nothing but short ids is accepted. */
+export function parseDone(arg) {
+  const words = String(arg || '').trim().split(/\s+/).filter(Boolean);
+  const { refs, used } = takeRefs(words);
+  if (!refs.length || used !== words.length) return { kind: 'usage', text: 'Usage: /done td1,td2 (or /done td1 td2) marks those items done. /todos lists the ids.' };
+  return { kind: 'done', refs };
+}
+
+export function todoDoneLine(title) {
+  return `\u2714 Done: ${title}`;
+}
+
+/**
+ * "/todo ..." or "/todos ..." + its argument ->
+ *   { kind: 'list' } | { kind: 'add', text } | { kind: 'move', ref, to } | { kind: 'usage', text }.
+ * Only /todo with free text adds. A short id plus a column word moves; an id with a bad column is a usage error, never an add.
+ */
+export function parseTodo(command, arg) {
+  const text = String(arg || '').trim();
+  if (String(command || '').toLowerCase() === '/todos' || !text) return { kind: 'list' };
+  const words = text.split(/\s+/);
+  const verb = /^(move|mv|mark|set)$/i.test(words[0]);
+  const rest = verb ? words.slice(1) : words;
+  const lead = takeRefs(rest);
+  if (lead.refs.length) {
+    const to = statusWord(rest.slice(lead.used));
+    if (to) return lead.refs.length > 1 ? { kind: 'move', ref: lead.refs[0], refs: lead.refs, to } : { kind: 'move', ref: lead.refs[0], to };
+    return { kind: 'usage', text: USAGE };
+  }
+  if (verb) return { kind: 'usage', text: USAGE };
+  return { kind: 'add', text };
+}
+
+/** board {backlog,doing,done} (backlog = the to-do column) -> { map: { td1: id, ... }, shown: { todo, doing, done } } (done is capped at DONE_SHOWN). */
+export function numberBoard(board, doneShown = DONE_SHOWN) {
+  const shown = { backlog: board.backlog || [], doing: board.doing || [], done: (board.done || []).slice(0, doneShown) };
+  const map = {};
+  for (const col of Object.keys(PREFIX)) shown[col].forEach((it, n) => { map[`${PREFIX[col]}${n + 1}`] = it.id; });
+  return { map, shown };
+}
+
+/** Confirmation after an add: the item id plus where to see the list. */
+export function todoAddedLine(item) {
+  return `Added to your Action Tracker: ${item.id}  ${item.title}. /todos lists them.`;
+}
+
+/** The board as short numbered lines, per column, with short ids. -> string. */
+export function todoBoardText(board, numbered = numberBoard(board)) {
+  const total = (board.backlog || []).length + (board.doing || []).length + (board.done || []).length;
+  if (!total) return 'Nothing in your Action Tracker. /todo <text> adds an item.';
+  const out = [`Your Action Tracker (${(board.backlog || []).length} to do, ${(board.doing || []).length} doing, ${(board.done || []).length} done). /todo <text> adds, /todo move do2 done moves:`];
+  for (const col of ['backlog', 'doing', 'done']) {
+    const items = numbered.shown[col];
+    const all = (board[col] || []).length;
+    if (!all) continue;
+    out.push(`${COLUMN_NAME[col]}:`);
+    items.forEach((i, n) => out.push(`  ${PREFIX[col]}${n + 1}  ${i.title}${i.due_date ? `  due ${String(i.due_date).slice(0, 10)}` : ''}`));
+    if (all > items.length) out.push(`  ... and ${all - items.length} more ${col === 'done' ? 'done (quox actions list --status done)' : ''}`.trimEnd());
+  }
+  return out.join('\n');
+}
+
+/**
+ * Resolve a short id for a move. oldMap is the map from the last /todos (or null if none yet); fresh is the board
+ * read just now. The item is found by its REAL id from the old list, so a list that shifted still moves the item
+ * you saw. -> { id, title, note? } | { error }.
+ */
+export function resolveRef(ref, oldMap, board) {
+  const fresh = numberBoard(board, Infinity);
+  const byId = {};
+  for (const [short, id] of Object.entries(fresh.map)) byId[id] = short;
+  const titleOf = (id) => [...(board.backlog || []), ...(board.doing || []), ...(board.done || [])].find((i) => i.id === id)?.title || '';
+  if (!oldMap || !oldMap[ref]) {
+    const id = fresh.map[ref];
+    if (!id) return { error: `No ${ref} on your board. /todos lists the current ids.` };
+    return { id, title: titleOf(id), note: oldMap ? undefined : `No list shown yet in this window, so ${ref} is read from the board as it is now.` };
+  }
+  const id = oldMap[ref];
+  if (!byId[id]) return { error: `${ref} is gone from your board (done elsewhere or deleted). /todos lists the current ids.` };
+  const nowRef = byId[id];
+  const shownNow = numberBoard(board).map[nowRef] === id; // the id is one the user could see in a fresh listing
+  return nowRef === ref
+    ? { id, title: titleOf(id) }
+    : { id, title: titleOf(id), note: `The list changed since /todos: "${titleOf(id)}" is ${nowRef} now${shownNow ? '' : ' (beyond the short list)'}. Moving that one.` };
+}
+
+export function todoMovedLine(item) {
+  return `Moved ${item.title} to ${item.status}.`;
+}

package/lib/quoxon/suggestCommand.js

@@ -33,14 +33,45 @@ export function vetSuggestion(raw) {
  */
 export function namedCommand(text) {
   const src = String(text || '');
+  const closing = closingProposal(src);
+  if (closing !== undefined) return closing; // the answer's own closing question names THE command: that one or nothing
   const seen = new Set();
   for (const m of src.matchAll(/`(\/[a-z][^`\n]{0,118})`/gi)) {
     if (mentionsAPath(src, m.index, m[0].length, m[1])) continue; // `/health` the endpoint is not /health the command
     seen.add(m[1].trim().replace(/\s+/g, ' '));
   }
   if (seen.size !== 1) return null;
-  const v = vetSuggestion([...seen][0]);
-  return v.ok ? v : null;
+  return offerable([...seen][0]);
+}
+
+// Commands that SEND or WRITE something: a mention is never an offer (the model must call terminal_suggest_command).
+export const WRITE_COMMANDS = new Set(['broadcast', 'roar', 'say', 'page', 'ack', 'reply', 'r', 'ask', 'aside', 'afk', 'back', 'observe', 'awaken', 'poke', 'wake', 'nudge', 'ping', 'slap', 'feedback', 'gripe', 'gripe!', 'note', 'dragon', 'wish', 'challenge', 'huh']);
+
+// vetted AND safe to offer from a mention: not a write/send, and no required <arg> left unfilled.
+function offerable(line) {
+  const v = vetSuggestion(line);
+  if (!v.ok) return null;
+  if (WRITE_COMMANDS.has(v.id) || WRITE_COMMANDS.has(line.slice(1).split(/\s+/)[0].toLowerCase())) return null;
+  const entry = findCommandEntry(line.slice(1).split(/\s+/)[0]);
+  const bare = line.trim().split(/\s+/).length === 1;
+  if (bare && /</.test(String(entry?.usage || ''))) return null; // "/ack <broadcast id>" needs its argument
+  return v;
+}
+
+// "Do you want me to run X?" / "Shall I run X?" -> undefined (no such question) | the offer for X | null.
+// X as a slash command is offered when safe; X as a `quox <verb>` CLI line is offered only as the matching read-only slash view.
+function closingProposal(src) {
+  const m = /(?:do you want me to|want me to|would you like me to|shall i|should i|can i)\s+(?:run|try|use|show you)\s+`?([^?`\n]{1,120}?)`?\s*(?:and\b[^?\n]*)?\?\s*$/i.exec(src.trim());
+  if (!m) return undefined;
+  const x = m[1].trim();
+  if (x.startsWith('/')) return offerable(x.replace(/\s+/g, ' '));
+  const cli = /^!?quox\s+([a-z][\w-]*)\s*$/i.exec(x);
+  if (cli) {
+    const slash = '/' + cli[1].toLowerCase();
+    const v = offerable(slash);
+    return v && v.readOnly ? v : null;
+  }
+  return null;
 }
 
 // A URL path, not a command (owner live 05:26: "the `/health` endpoint is erroring" offered "Run /health?").

package/lib/quoxon/toolCards.js

@@ -0,0 +1,30 @@
+/**
+ * HITL-INBOX-BAR (owner 2026-10-26: "more programmatic output, so nice and clear"): when a tool's result is a list, the
+ * facts are drawn as a table from the tool result, above whatever the model then says. Keyed by tool name; the server
+ * puts a bounded `card` on tool.finished (services/collector/lib/conversationToolEvents.js RESULT_CARDS). To add a
+ * list answer: add a renderer here and the matching projection there.
+ */
+import { ageOf, fromOf } from './inboxView.js';
+
+const clip = (s, n) => { const t = String(s ?? '').replace(/\s+/g, ' ').trim(); return t.length > n ? `${t.slice(0, Math.max(0, n - 1))}…` : t; };
+const pad = (s, n) => { const t = clip(s, n); return t + ' '.repeat(Math.max(0, n - [...t].length)); };
+
+const RENDERERS = {
+  /** inbox_pending rows -> `#  when  kind  priority  title  state` */
+  inbox_pending(card, { cols, now }) {
+    const rows = card.rows || [];
+    const tw = Math.max(16, Math.min(60, cols - 46));
+    const out = [{ head: true, text: `${pad('#', 3)}${pad('when', 6)}${pad('kind', 10)}${pad('prio', 8)}${pad('title', tw)} state` }];
+    rows.forEach((r, i) => out.push({ text: `${pad(i + 1, 3)}${pad(ageOf(r.created_at, now), 6)}${pad(r.kind || fromOf(r), 10)}${pad(r.priority || '', 8)}${pad(r.title || 'untitled', tw)} ${r.status || ''}` }));
+    if (Number.isInteger(card.total) && card.total > rows.length) out.push({ head: true, text: `showing ${rows.length} of ${card.total} · /inbox` });
+    return out;
+  },
+};
+
+/** -> [{ text, head? }] for a settled tool block that carries a card; [] otherwise. Never throws. */
+export function toolCardLines(b, cols = 100, now = Date.now()) {
+  const fn = b && b.card && Array.isArray(b.card.rows) && RENDERERS[b.tool];
+  if (!fn) return [];
+  try { return fn(b.card, { cols, now }); } catch { return []; }
+}
+export const cardTools = () => Object.keys(RENDERERS);

package/lib/quoxon/whatsnew.jsonl

@@ -87,3 +87,48 @@
 {"id":"footer-tool-count","date":"2026-10-19T12:00:00Z","since":"0.3.1","title":"Turn footer counts tools properly","text":"The line under an answer now reads 1 tool or 3 tools. Some builds printed [object Object]1 tools after a turn that used a tool."}
 {"id":"cancelled-reads-cancelled","date":"2026-10-19T14:00:00Z","since":"0.3.1","title":"Cancelled reads cancelled","text":"A stopped objective in the activity list now says cancelled (a neutral circle), not failed. Expired and rejected say their own word too, and an empty question no longer draws a stray rule above the composer."}
 {"id":"one-rule-above-composer","date":"2026-10-19T15:00:00Z","since":"0.3.1","title":"One rule above the composer","text":"Under an approval card the composer no longer draws a blank line and a second rule: the card's closing rule is the only one."}
+{"id":"install-claude-code-codex","date":"2026-10-19T19:30:00Z","since":"0.3.1","title":"Install Claude Code and Codex from Quox","text":"Quox works best with both Claude and OpenAI models. If this server has no Claude Code or Codex, Quox offers to install it the moment you need it (a y/N card), or run quox provider install claude-code. It is the vendor's own npm package, downloaded to your server.","shell":"quox provider install claude-code","sha":"e802e90ce"}
+{"id":"polish8-card-lists","date":"2026-10-19T19:40:00Z","since":"0.3.1","title":"Approval cards keep list lines, ask loosening takes --recommend","text":"A walk card now shows a file list one item per line under WHY, and text with HTML escapes shows as plain characters. A session can add its advice to a test-edit approval with --recommend y or n.","shell":"quox ask loosening --help"}
+{"id":"polish8-exec-entities","date":"2026-10-19T20:00:00Z","since":"0.3.1","title":"Approval cards show commands as typed","text":"An approval for a command no longer shows HTML escapes like > in the command, reason or request lines.","shell":"quox ask loosening --help"}
+{"id":"restart-min-gap","date":"2026-10-19T20:10:00Z","since":"0.3.1","title":"At most one auto-restart offer every 15 minutes","text":"The window no longer offers a restart within 15 minutes of starting; the newest settled build is offered once after that, and /restart still works any time.","try":"/restart"}
+{"id":"named-offer-one-readonly","date":"2026-10-19T20:20:00Z","since":"0.3.1","title":"Only one complete read-only command is offered from an answer","text":"When an answer merely mentions a command, the window no longer offers a write like /broadcast or one missing its required text; it offers nothing unless there is exactly one safe command."}
+{"id":"fun-commands-try-these","date":"2026-10-19T20:30:00Z","since":"0.3.1","title":"Ask Quox for fun commands and get a real list","text":"Ask for fun or cool commands, or what Quox can do, and the answer is a hand-picked set (the dragon verbs, /challenge, /spawn, /crystallize and more), each with a one-line reason to try it. /help ends with a short Try these block.","try":"/help"}
+{"id":"q-shortcut","date":"2026-10-19T20:30:00Z","since":"0.3.1","title":"A short q command for quox","text":"Run quox shortcut add to make q start quox. It never replaces a q you already have, and quox shortcut remove undoes it.","shell":"quox shortcut add --help"}
+{"id":"note-notesq","date":"2026-10-19T20:30:00Z","title":"/note saves a NotesQ note","text":"/note <text> now creates a NotesQ note and /notes lists them. The developer observer note moved to /devnote (// text still works).","try":"/note buy milk","since":"0.3.0"}
+{"id":"findings-reconcile","date":"2026-10-19T21:15:00Z","since":"0.3.1","title":"Fixed security findings stop raising alarms","text":"quox engagement reconcile checks each open finding against its linked issue and fix commit. A finding whose fix is on main or in the running build now reads \"fix deployed, awaiting verification\" in /sitrep instead of an alarm. It is closed only when the issue is closed AND the fix is deployed, a critical never closes on its own, and quox engagement reconciliations shows the audit trail.","shell":"quox engagement reconcile --dry-run"}
+{"id":"walk-recheck","date":"2026-10-19T22:40:00Z","since":"0.3.1","title":"The walkthrough ends by re-checking the server","text":"After your last answer the approvals walkthrough fetches the list fresh and ends with \"Nothing else is currently waiting for you.\", or tells you how many new ones arrived, or that it could not re-check. No need to run /approvals again.","try":"/walkthrough"}
+{"id":"slash-plugins","date":"2026-10-19T23:55:00Z","since":"0.3.1","title":"/plugins lists your installed extensions","text":"/plugins (also /extensions, /addons, /apps) shows the plugins your org has installed with their state and version, and a mistyped slash command now suggests the nearest real one.","try":"/plugins"}
+{"id":"qpe-rows","date":"2026-10-19T23:59:00Z","since":"0.3.1","title":"The proof engine rows are coloured, lined up and three deep","text":"The QPE rows now read as three rows on one grid: the score coloured by health with its sparkline, 24 h change and release-proven jobs; what got fixed and broke, the last run and who ran it, the next run; coverage coloured by ratio with the weakest area named. Narrow windows drop whole items rather than cutting words. Status rows can now send coloured cells (quox rows contract).","try":"/qpe rows 3"}
+{"id":"qpe-content","date":"2026-10-20T03:30:00Z","since":"0.3.1","title":"A fourth QPE line: your cli.quox.ai content","text":"The proof engine lines now add, not just respread: the newest broken case by name, what the newest release is waiting on, the next run (and why today's was deferred), and a fourth line for cli.quox.ai content: pages backed by proof, guides, things to try, journeys and command pages. One call draws all four. /qpe 4 (or unset) shows them all.","try":"/qpe 4"}
+{"id":"slash-todo","date":"2026-10-20T10:00:00Z","since":"0.3.1","title":"/todo adds Action Tracker items, /todos moves them","text":"/todo <text> adds an item and confirms with its id. /todos lists every item by column as td1 (to do), do1 (doing), dn1 (done); then /todo move do2 done, /todo td3 doing. From a shell: quox actions add \"<text>\" [--due tomorrow], quox actions move <id> done, quox actions list (every page).","try":"/todos"}
+{"id":"approve-says-who","date":"2026-10-23T12:00:00Z","since":"0.3.1","title":"Approving or denying says who, what and where","text":"After you answer a card, the confirmation now reads: You approved VULCAN-SEC to run a shell command on web01. Denials use the same shape. Anything the card did not say is left out.","try":"/approvals"}
+{"id":"bar-approvals","date":"2026-10-23T12:00:00Z","since":"0.3.1","title":"The line above the input says what is waiting","text":"The divider above the input box now always shows your approvals: ✔ nothing waiting, ⏸ 5 approvals waiting, or approvals ? when the inbox cannot be read or you are signed out (never a false zero). On narrow windows the model name goes first, the approvals note stays whole.","try":"/approvals"}
+{"id":"done-cmd","date":"2026-10-23T14:00:00Z","since":"0.3.1","title":"/done marks Action Tracker items done","text":"Type /done td1,td2 (ids from /todos) to mark several items done at once; /todo move td1,td2 done takes lists too.","try":"/done"}
+{"id":"server-chip","date":"2026-10-23T20:00:00Z","since":"0.3.1","title":"The status line names the server you are on","text":"If the machine Quox runs on is a registered server, the status line now shows it, for example server dev01 (fleet), and the remote instance when your profile talks to another one.","shell":"quox fleet hosts"}
+{"id":"evidence-bundle","date":"2026-10-23T19:10:00Z","since":"0.3.1","title":"/evidence exports this conversation as a signed bundle","text":"/evidence writes every envelope, WARD receipt and VOLT run of this conversation to ~/quox-evidence/ as a signed zip and prints how to check it offline (quox evidence verify <file>). /proof now lists the envelope ids of the conversation, newest first. /ward, /envelope, /envelopes, /aee and /volt point at the same evidence.","try":"/evidence"}
+{"id":"server-go","date":"2026-10-23T21:00:00Z","since":"0.3.1","title":"Open a Quox window on any dev server","text":"quox server list shows your registered dev servers and which are reachable; quox server go <name> opens Quox on one. The status line now shows the server purpose (for example main dev). /server lists them in the app.","try":"/server"}
+{"id":"dragon-companion","date":"2026-10-23T21:00:00Z","since":"0.3.1","title":"Dragon companions: your attached agent's dragon greets you","text":"Dragon companions: your attached agent's dragon greets you. /dragon companion on|greeting|off.","try":"/dragon companion status"}
+{"id":"stop-cmd","date":"2026-10-23T21:00:00Z","since":"0.3.1","title":"/stop and /cancel stop the running turn","text":"Type /stop (or /cancel) to stop the current turn, same as Esc. /clear now cancels a running turn too, and a stopped turn no longer leaves the status line animating.","try":"/stop"}
+{"id":"approvals-ux","date":"2026-10-23T22:00:00Z","since":"0.3.1","title":"Approvals: readable rows, full content, walkthrough covers them","text":"/approvals rows now show what each approval says (the start of an X post), /approvals N shows the full content, a bare y after a list asks which one instead of going to chat, and /walkthrough walks plain approvals as cards.","try":"/walkthrough"}
+{"id": "dragon-transient", "date": "2026-10-23T23:00:00Z", "since": "0.3.1", "title": "The dragon comes and goes", "text": "The dragon companion no longer stays on screen. It appears when you attach, at key moments (a new approval, a failed turn, a long task finishing) and when you type /dragon, then leaves after a few seconds or on your next keypress.", "try": "/dragon"}
+{"id": "resume-attach-coherent", "date": "2026-10-24T01:00:00Z", "since": "0.3.1", "title": "Resume keeps the right agent", "text": "Resuming a conversation now attaches you to the agent it was with, so the footer and your next turn agree. After a restart, if the saved attachment and conversation differ, you get one warning and a fresh conversation. Resumed titles never show painted screen characters.", "try": "/resume"}
+{"id": "dragon-smooth", "date": "2026-10-24T03:30:00Z", "since": "0.3.1", "title": "Companion dragons animate smoothly, and bigger", "text": "Lucid, Hyperion and Seer now play through frames drawn off the main thread, so they move as smoothly as the Quox dragon and no longer stutter the screen. They are larger, stay for 10 seconds (a keypress in the first 2 seconds will not send them away), every typed /attach greets, and /dragon companion calls the dragon too.", "try": "/dragon"}
+{"id": "say-last-target", "date": "2026-10-24T19:00:00Z", "since": "0.3.1", "title": "/say remembers who you were talking to", "text": "If the first word of a /say is not a slot (a URL, a path, plain text), Quox offers to send the whole message to the slot you last said something to. A URL is never taken as a slot name.", "try": "/say"}
+{"id": "full-envelope-ids", "date": "2026-10-25T08:00:00Z", "since": "0.3.1", "title": "/proof and tool lines show the whole envelope id", "text": "Envelope ids, WARD seqs and bundle paths now wrap instead of being cut off, even in a narrow window. /proof puts the full id on its own line to copy, with the quox aee get and quox evidence verify commands, and the model can quote the id too.", "try": "/proof"}
+{"id": "contacts-from-chat", "date": "2026-10-25T09:00:00Z", "since": "0.3.1", "title": "Add and list contacts by just asking", "text": "Ask Quox to add Sam Lee to your contacts with a number and it does, through the same approval rules as the CLI; ask to list your contacts and it pages through all of them. /contact new now builds a valid quox contacts add command (--mobile and --tel become --phone, multi-word names are quoted) and refuses flags the command does not have. quox contacts list pages with --offset.", "try": "/contact new"}
+{"id": "contacts-send-at", "date": "2026-10-25T09:00:00Z", "since": "0.3.1", "title": "Schedule an SMS for a time, and see why a send failed", "text": "quox contacts send now takes --at (10am, 14:30 or a full ISO time, read in Europe/London unless you pass --tz) and the server delivers it then, even if you close the terminal. The answer states the exact time, and quox contacts scheduled list or cancel manages the queue. A failed send now says why in plain words.", "shell": "quox contacts send <contact> --channel sms --at 10am \"hello\""}
+{"id": "attach-agent-first", "date": "2026-10-25T12:00:00Z", "since": "0.3.1", "title": "/attach seer now picks the agent first", "text": "When a name is both an agent and a slot, /attach <name> attaches the agent and tells you the slot exists. Use /attach slot:<name> for the slot or /attach agent:<name> to be explicit. A name that is only a slot still attaches the slot.", "try": "/attach slot:seer"}
+{"id": "dragons-sentinel-drago", "date": "2026-10-25T19:00:00Z", "since": "0.3.1", "title": "Two new dragons: Sentinel (Warden) and Drago", "text": "Two new dragons: Sentinel (Warden) and Drago. Attach Warden or the security lead and they greet you, wait with you at approvals and show when something needs attention. Sentinel shows its shield icon on smaller terminals.", "try": "/attach sentinel"}
+{"id": "dragons-cipher", "date": "2026-10-25T21:00:00Z", "since": "0.3.1", "title": "New dragon: Cipher", "text": "New dragon: Cipher, the network operations dragon. Attach cipher and it greets you, listens while you work, waits with you at approvals and shows when something needs attention.", "try": "/attach cipher"}
+{"id": "objective-offer", "date": "2026-10-25T22:00:00Z", "since": "0.3.1", "title": "Ask for something your agent cannot do, get an objective", "text": "Ask an attached agent for a multi-step job it has no tools for and Quox now offers (y or n) to make it an objective that runs until done. You approve the plan, then each step.", "try": "/attach seer"}
+{"id": "dragon-jobs", "date": "2026-10-25T23:00:00Z", "since": "0.3.1", "title": "Dragons now report real state", "text": "Each companion dragon has one job and says it from a live read: Sentinel the WARD state of your last answer, Cipher route health, Seer the plan, Hyperion the fleet, Drago open security findings, Lucid recovery. If a read fails it says it could not check.", "try": "/attach cipher"}
+{"id": "dragon-summons", "date": "2026-10-25T23:30:00Z", "since": "0.3.1", "title": "Dragons turn up when your work finishes", "text": "With the dragon companion on, a finished or failed objective or loop calls Seer for a few seconds with the real result, even with no agent attached. Never while you are typing, and each dragon waits a minute before it can be called again.", "try": "/dragon companion status"}
+{"id": "loop-card", "date": "2026-10-26T00:00:00Z", "since": "0.3.1", "title": "Watch a loop as it runs", "text": "A loop you start from chat now shows a live card that updates in place: turns, receipts witnessed, and the last lines of its output. Milestones and errors land as chat lines under it, and a finished loop prints its proof command.", "try": "/loop list"}
+{"id": "loop-offer", "date": "2026-10-26T01:00:00Z", "since": "0.3.1", "title": "Ask for a loop and Quox offers one", "text": "Say \"keep checking until it is green\" or \"run it as a loop\" and Quox offers to create a loop with a tool list worked out from your goal (read-only unless the goal writes a file or runs a command). You see exactly which tools it may use and approve it before it starts. A fixed cadence like \"every 15 minutes\" is offered as a schedule instead.", "try": "/loop list"}
+{"id": "dragon-fit", "date": "2026-10-26T01:00:00Z", "since": "0.3.1", "title": "Dragons fit your window, or tell you why not", "text": "/dragon fire and /dragon-fly now size to your real window and say how many rows they need when it is too small. /detach brings the Q dragon back to greet you when dragons are on.", "try": "/dragon-fly"}
+{"id":"restart-waits-server","date":"2026-10-26T02:10:00Z","title":"Auto restart waits for Quox to come back","text":"When a new version lands while the Quox server is restarting, the window now waits for the server before it restarts, and picks its slot back up once the server answers.","try":"/restart","since":"0.3.1"}
+{"id":"keep-going-plain-words","date":"2026-10-26T04:00:00Z","title":"Ask for a watch in plain words","text":"Say \"keep an eye on quox.ai for the next 10 minutes\" or \"watch the build until it is green\" and Quox offers to keep going for you, no need to say loop. One key to start it, one to just answer once.","try":"/watch quox.ai for downtime","since":"0.3.1"}
+{"id": "objective-offer-reports-back", "date": "2026-10-26T05:30:00Z", "title": "Objectives report back in the chat", "text": "Say a long multi-step ask to an advisory agent and Quox offers to run it as an objective. The plan routes each step to an agent that holds the tool, a fallback like \"if something goes wrong, save the draft\" is honoured, and when it ends the chat tells you what happened and where things are.", "try": "/attach seer", "since": "0.3.1"}
+{"id": "loop-card-polish", "date": "2026-10-26T13:00:00Z", "since": "0.3.1", "title": "The loop card keeps its own count", "text": "The card now counts the loop's own turns (turn 2 of 5, not the message count), shows the whole runway, fills a receipts bar as each one is witnessed, and says a milestone once. With an empty composer, press Down to reach its keys. A finished loop calls its dragon.", "try": "/loop list"}
+{"id": "org-picker", "date": "2026-10-26T16:30:00Z", "since": "0.3.1", "title": "Switch org in one keystroke", "text": "Type /org for a list of your orgs, arrow to one and press Enter: this window moves there at once and the status bar follows. Press d instead to also make it your default. /org hampshire switches straight away when only one org matches, and quox org switch with no argument gives a numbered list.", "try": "/org"}
+{"id":"quoxcli-0-4-0","date":"2026-10-26T18:00:00Z","since":"0.4.0","title":"quoxon extensions, an inbox bar, history and mouse editing","text":"Add and manage extensions with quox ext add, quox ext remove and quox ext list, or /ext in the window. /inbox and a notification bar show what is waiting. Up and Ctrl+R search your history. /mouse turns on optional mouse editing. Plan approval cards now list their steps, and live loop cards no longer freeze the window.","try":"/ext","shell":"quox ext list"}

package/lib/quoxon/windowOrg.js

@@ -97,7 +97,17 @@ export function createWindowOrg({ auth, baseClient, now = () => Date.now() }) {
  */
 export function createWindowClient({ config, auth, createClient }) {
   const windowOrg = createWindowOrg({ auth, baseClient: createClient(config, auth) });
-  return { client: createClient(config, windowOrg.auth), auth: windowOrg.auth, windowOrg };
+  // A client on the SAME user's token for another org, without moving this window (cached; each has its own overlay).
+  const scoped = new Map();
+  const clientForOrg = async (orgId) => {
+    if (scoped.has(orgId)) return scoped.get(orgId);
+    let cl;
+    if (orgId === (() => { try { return auth.getOrgId(); } catch { return null; } })()) cl = createClient(config, auth);
+    else { const sub = createWindowOrg({ auth, baseClient: createClient(config, auth) }); await sub.switchTo(orgId); cl = createClient(config, sub.auth); }
+    scoped.set(orgId, cl);
+    return cl;
+  };
+  return { client: createClient(config, windowOrg.auth), auth: windowOrg.auth, windowOrg, clientForOrg };
 }
 
 /**

package/lib/server/devServers.js

@@ -0,0 +1,137 @@
+// DEVFLEET: the dev-server list behind `quox server list|go|mark` and the TUI /server picker.
+// A dev server is a Bastion host (`quox fleet hosts`) that has a local entry in dev-servers.json
+// (purpose, and optionally project, repo, workdir, ci, user, jump). Bastion supplies address + state;
+// the entry supplies what the server is FOR. Pure functions here; the file read/write is the only IO.
+import { readFileSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
+import { homedir, hostname } from 'node:os';
+import { join, dirname } from 'node:path';
+import { matchServer, localIps } from '../quoxon/serverChip.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+const FIELDS = ['purpose', 'project', 'repo', 'workdir', 'ci', 'user', 'jump', 'lastDeploy'];
+const SAFE = /^[A-Za-z0-9._@:\/~+-]+$/;
+
+export function registryPath(env = process.env) {
+  return join(env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'quox', 'dev-servers.json');
+}
+
+/** -> { servers: { [name]: entry } }; a missing file is empty, a corrupt one throws (never clobbered). */
+export function readRegistry(path = registryPath()) {
+  let raw;
+  try { raw = readFileSync(path, 'utf8'); } catch (e) { if (e.code === 'ENOENT') return { servers: {} }; throw e; }
+  const j = JSON.parse(raw);
+  return { servers: j && typeof j.servers === 'object' && j.servers ? j.servers : {}, defaults: j && typeof j.defaults === 'object' && j.defaults ? j.defaults : {} };
+}
+
+/** Additive upsert of one server's entry; unspecified fields are kept. Atomic write. */
+export function markServer(name, fields, path = registryPath()) {
+  if (!name || !SAFE.test(name)) throw new Error(`invalid server name: ${name}`);
+  const reg = readRegistry(path);
+  const next = { ...(reg.servers[name] || {}) };
+  for (const k of FIELDS) if (fields[k] != null && fields[k] !== '') next[k] = String(fields[k]);
+  reg.servers[name] = next;
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(reg, null, 2) + '\n', { mode: 0o600 });
+  renameSync(tmp, path);
+  return next;
+}
+
+function writeCache(reg, path) {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(reg, null, 2) + '\n', { mode: 0o600 });
+  renameSync(tmp, path);
+}
+
+const pickFields = (e) => Object.fromEntries(FIELDS.filter(k => e && e[k] != null && e[k] !== '').map(k => [k, String(e[k])]));
+
+/**
+ * The registry lives SERVER-SIDE (org-scoped, collector); the local file is an offline cache only.
+ * -> { servers, source: 'server' | 'cache', migrated }. A good server read refreshes the cache. If the server
+ * has no entries and the cache has some, they are uploaded once (migration). Unreachable or a non-registry
+ * answer -> the cache (a corrupt cache throws, never clobbered).
+ */
+export async function loadRegistry({ client, path = registryPath() } = {}) {
+  let remote = null;
+  let defaults = {}; // local-only preferences (e.g. defaults.jump, the ssh ProxyJump alias): never uploaded, kept across cache refreshes
+  try { defaults = readRegistry(path).defaults; } catch { /* corrupt cache: no local defaults */ }
+  try {
+    const ep = resolveEndpoint('devServerRegistry.list');
+    const d = await client.get(ep.path, { service: ep.service, retries: 0, timeout: 5000 });
+    if (d && typeof d.servers === 'object' && d.servers && !Array.isArray(d.servers)) remote = d.servers;
+  } catch { /* offline: fall back to the cache */ }
+  if (!remote) return { servers: readRegistry(path).servers, defaults, source: 'cache', migrated: 0 };
+  let migrated = 0;
+  let intact = true;
+  if (!Object.keys(remote).length) {
+    let local = {};
+    try { local = readRegistry(path).servers; } catch { /* unreadable cache: nothing to migrate */ }
+    for (const [name, e] of Object.entries(local)) {
+      try {
+        const ep = resolveEndpoint('devServerRegistry.put', { name });
+        await client.put(ep.path, { service: ep.service, body: pickFields(e) });
+        remote[name] = pickFields(e); migrated++;
+      } catch { intact = false; break; /* the cache keeps what did not upload; the next read retries */ }
+    }
+    // A failed upload must never be followed by a cache overwrite: the cache is then the only copy.
+    if (!intact) return { servers: { ...local, ...remote }, defaults, source: 'cache', migrated };
+  }
+  try { writeCache({ servers: remote, defaults }, path); } catch { /* cache is best effort */ }
+  return { servers: remote, defaults, source: 'server', migrated };
+}
+
+/** Upsert one entry on the server (additive), then refresh the cache. Offline -> throws, nothing written. */
+export async function saveServer({ client, name, fields, path = registryPath() }) {
+  if (!name || !SAFE.test(name)) throw new Error(`invalid server name: ${name}`);
+  const ep = resolveEndpoint('devServerRegistry.put', { name });
+  let r;
+  try { r = await client.put(ep.path, { service: ep.service, body: pickFields(fields) }); }
+  catch (e) { throw new Error(`could not save to the Quox server (${e?.message || 'failed'}); nothing was recorded`); }
+  let entry = r && r.entry && typeof r.entry === 'object' ? pickFields(r.entry) : null;
+  if (!entry) { try { entry = markServer(name, fields, path); } catch { entry = pickFields(fields); } }
+  else { try { const reg = readRegistry(path); reg.servers[name] = entry; writeCache(reg, path); } catch { /* cache is best effort */ } }
+  return entry;
+}
+
+/** Bastion host list + registry -> rows for each registered server. `here` = { hostname, ips }. */
+export function buildRows(hosts, registry, here = {}) {
+  const list = Array.isArray(hosts) ? hosts : [];
+  const me = matchServer(list, here);
+  return Object.entries(registry?.servers || {}).map(([name, e]) => {
+    const h = list.find(x => x && x.id === name) || null;
+    return {
+      name, purpose: e.purpose || null, project: e.project || null, repo: e.repo || null, workdir: e.workdir || null,
+      ci: e.ci || null, lastDeploy: e.lastDeploy || null,
+      ip: h?.ip || null,
+      registered: Boolean(h),
+      reachable: h ? (h.status?.state ?? h.state) === 'active' : false,
+      current: Boolean(me && me.name === name),
+      user: e.user || null, jump: e.jump || null, defaultJump: registry?.defaults?.jump || null
+    };
+  });
+}
+
+const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
+
+/**
+ * What `go` will run. -> { error } | { local: true, cmd, args, cwd, text } | { cmd:'ssh', args, text }.
+ * Remote: the user's own ssh config/keys via the jump host alias; nothing is copied anywhere.
+ */
+export function planGo(row) {
+  if (!row) return { error: 'unknown server' };
+  if (!row.registered) return { error: `${row.name} is not in the Bastion host registry (quox fleet hosts), so go cannot reach it` };
+  if (!row.reachable) return { error: `${row.name} is not reachable according to the Bastion registry; try: quox fleet ping ${row.name}` };
+  if (row.current) {
+    const cwd = row.workdir || process.cwd();
+    return { local: true, cmd: 'quox', args: [], cwd, text: `cd ${cwd} && quox   (this is ${row.name}; local)` };
+  }
+  if (!row.ip) return { error: `${row.name} has no address in the Bastion registry` };
+  const target = `${row.user || 'control'}@${row.ip}`;
+  const remote = `${row.workdir ? `cd ${shq(row.workdir)} && ` : ''}exec quox`;
+  const jump = row.jump || row.defaultJump || null; // a per-server --jump, else the registry's defaults.jump, else a direct ssh
+  const args = ['-t', ...(jump ? ['-o', `ProxyJump=${jump}`] : []), target, remote];
+  return { cmd: 'ssh', args, text: `ssh ${args.slice(0, 4).join(' ')} ${shq(remote)}` };
+}
+
+export const hereIdentity = () => ({ hostname: hostname(), ips: localIps() });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quoxcli",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Quox: the conversational front door to your self-hosted AI agent control plane",
   "type": "module",
   "bin": {
@@ -53,6 +53,7 @@
   "files": [
     "bin/",
     "lib/",
+    "vendor/",
     "!lib/**/*.test.js",
     "!lib/**/*.test.jsx",
     "!lib/**/__tests__/",

package/vendor/dragonlab/SOURCE

@@ -0,0 +1,4 @@
+repo: quoxai/dragonlab
+commit: 5b478a813554eb80793b848d14da1468ea3bdcef
+branch: HEAD
+files: 52