quoxcli 0.3.1 → 0.5.0

package/lib/commands/status.js

@@ -10,6 +10,8 @@
 import chalk from 'chalk';
 import { emitCliEvent } from '../core/aee.js';
 import { resolveEndpoint } from '../api/endpoints.js';
+import { probeService } from './watch.js';
+import { joinServiceUrl } from '../core/config.js';
 
 const STATUS_ICON = {
   ok: chalk.green('●'),
@@ -21,13 +23,66 @@ function statusDot(status) {
   return STATUS_ICON[status] || chalk.dim('○');
 }
 
+const OK_STATES = new Set(['ok', 'healthy', 'up']);
+
+/**
+ * Health percentage computed from the same data the screen shows (services plus
+ * fleet agents), so it can never say 100% beside "1 degraded, 1 down".
+ * Returns null when there is nothing to compute from.
+ */
+export function computeHealth(data) {
+  let total = 0;
+  let good = 0;
+  for (const s of Object.values(data?.services || {})) {
+    total += 1;
+    if (OK_STATES.has(s?.status)) good += 1;
+  }
+  const f = data?.fleet;
+  if (f && f.total) {
+    total += f.total;
+    good += Math.min(f.total, f.healthy || 0);
+  }
+  if (!total) return typeof data?.score === 'number' ? data.score : null;
+  return Math.round((100 * good) / total);
+}
+
+/**
+ * Get status without letting one slow source sink the verb: the aggregate and a
+ * set of quick direct service probes run in parallel. Aggregate answers -> full
+ * result. Aggregate fails but probes answer -> partial result (exit 0). Nothing
+ * answers -> error object (exit 1).
+ */
+export async function resolveStatus({ aggregate, probes }) {
+  const [agg, prb] = await Promise.allSettled([aggregate(), probes()]);
+  const probeMap = prb.status === 'fulfilled' ? prb.value : {};
+  if (agg.status === 'fulfilled' && agg.value) {
+    return { exitCode: 0, data: { ...agg.value, partial: false, sources: { aggregate: { status: 'ok' } } } };
+  }
+  const message = agg.reason?.message || 'no answer';
+  const sources = {
+    aggregate: { status: 'failed', error: message },
+    probes: { status: Object.values(probeMap).some((p) => p.status === 'healthy') ? 'ok' : 'failed' },
+  };
+  const services = {};
+  for (const [name, p] of Object.entries(probeMap)) {
+    services[name] = { status: p.status === 'healthy' ? 'ok' : p.status === 'down' ? 'down' : 'degraded', latency_ms: p.latency_ms ?? null };
+  }
+  if (sources.probes.status !== 'ok') {
+    return { exitCode: 1, data: { error: 'collector_unavailable', message, sources } };
+  }
+  return { exitCode: 0, data: { partial: true, degraded: true, score: null, timestamp: new Date().toISOString(), services, sources } };
+}
+
 function renderPulse(data) {
   const lines = [];
 
   // Header
-  const scoreColor = data.score >= 90 ? chalk.green : data.score >= 70 ? chalk.yellow : chalk.red;
+  const score = computeHealth(data);
+  const scoreColor = score >= 90 ? chalk.green : score >= 70 ? chalk.yellow : chalk.red;
+  const scoreText = score == null ? chalk.yellow('Health: partial') : scoreColor(`Health: ${score}%`);
   lines.push('');
-  lines.push(chalk.bold(` QUOX PLATFORM STATUS`) + chalk.dim(`  ${scoreColor(`Health: ${data.score}%`)}  ${data.timestamp || ''}`));
+  lines.push(chalk.bold(` QUOX PLATFORM STATUS`) + chalk.dim(`  ${scoreText}  ${data.timestamp || ''}`));
+  if (data.partial) lines.push(chalk.yellow(` Partial: the full status did not answer in time (${data.sources?.aggregate?.error || 'no answer'}); showing live service checks only.`));
   lines.push(chalk.dim(' ' + '─'.repeat(60)));
 
   // Services
@@ -43,7 +98,7 @@ function renderPulse(data) {
   // Sessions
   const s = data.sessions || {};
   const providers = Object.entries(s.providers || {}).map(([k, v]) => `${v} ${k}`).join(', ');
-  lines.push(` Sessions    ${s.active || 0} active  ${providers ? `(${providers})` : ''}  ${chalk.dim(`$${(s.cost_today_usd || 0).toFixed(2)} today`)}`);
+  lines.push(` Sessions    ${s.active || 0} active (usage sessions; "quox active" lists workers)  ${providers ? `(${providers})` : ''}  ${chalk.dim(`$${(s.cost_today_usd || 0).toFixed(2)} today`)}`);
 
   // Workflows
   const w = data.workflows || {};
@@ -78,60 +133,53 @@ function renderPulse(data) {
 }
 
 export function registerStatusCommand(program, ctx) {
-  const { client } = ctx;
+  const { client, config } = ctx;
 
   program
     .command('status')
     .description('Show platform health and status overview')
+    .addHelpText('after', '\nAdd --json for machine output. If the full status is slow, a partial answer (live service checks, partial: true) is returned with exit 0; only a total failure exits 1 with an error object.')
     .action(async (opts, cmd) => {
       const outputFormat = cmd.parent?.opts()?.output || 'table';
       const isJson = outputFormat === 'json' || cmd.parent?.opts()?.json;
 
-      try {
-        // fleet #602: this used to pass noAuth: true, which suppressed the
-        // Authorization header the client would otherwise attach. The TUI's
-        // useHealth/HealthView poll this same endpoint WITH the normal client
-        // auth, as does a comparable authenticated route (backup.js).
-        // (monitoring.js's `health` verb had the identical noAuth bug — fixed
-        // in the same change.) Dropping noAuth here matches that pattern: the
-        // request still works
-        // for a logged-out session (client.js sends no Authorization header
-        // when there's nothing stored), but a logged-in session's token now
-        // actually reaches the collector instead of being withheld.
-        const data = await client.get(resolveEndpoint('v1.health.aggregate.list').path, {
-          service: resolveEndpoint('v1.health.aggregate.list').service,
-          timeout: 15000, // #930: the aggregate fans out to several services; 5s was too tight under load
-        });
-
-        if (isJson) {
-          console.log(JSON.stringify(data, null, 2));
-        } else {
-          console.log(renderPulse(data));
-        }
+      const ep = resolveEndpoint('v1.health.aggregate.list');
+      const names = ['auth', 'memory', 'collector', 'quoxflow', 'files'];
+      const { exitCode, data } = await resolveStatus({
+        // fleet #602: the normal client auth applies (no noAuth). #930: the aggregate fans out to
+        // several services; it gets 8s here because direct probes cover a slow answer.
+        aggregate: () => client.get(ep.path, { service: ep.service, timeout: 8000 }),
+        probes: async () => {
+          const out = await Promise.all(names.map(async (n) => {
+            try {
+              return [n, await probeService(joinServiceUrl(config.getServiceUrl(n), '/health').href, fetch, 3000)];
+            } catch (err) {
+              return [n, { status: 'down', reason: err.message }];
+            }
+          }));
+          return Object.fromEntries(out);
+        },
+      });
+
+      if (isJson) {
+        console.log(JSON.stringify(data, null, 2));
+      } else if (data.error) {
+        console.log('');
+        console.log(chalk.red(' Platform status unavailable'));
+        console.log(chalk.dim(` Collector not reachable: ${data.message}`));
+        console.log('');
+      } else {
+        console.log(renderPulse(data));
+      }
 
+      if (!data.error) {
         emitCliEvent(client, {
           command: 'status',
           intent: 'quox.cli.status',
-          payload: { score: data.score, services: Object.keys(data.services || {}).length },
+          payload: { score: computeHealth(data), services: Object.keys(data.services || {}).length, partial: Boolean(data.partial) },
         });
-      } catch (err) {
-        if (isJson) {
-          console.log(JSON.stringify({ error: 'collector_unavailable', message: err.message }));
-        } else {
-          console.log('');
-          console.log(chalk.red(' Platform status unavailable'));
-          console.log(chalk.dim(` Collector not reachable: ${err.message}`));
-          console.log('');
-        }
-        // fleet #602: a real request failure (network error, non-2xx from
-        // the collector) was printing the message above and still exiting
-        // 0, hiding the failure from scripts/CI that check the exit code.
-        // client.get only reaches this catch on an actual error (thrown
-        // QuoxApiError / QuoxNetworkError / QuoxAuthError, see
-        // lib/core/client.js) — never on a successful 2xx — so it's safe to
-        // fail the process here without risking a false failure on a
-        // legitimately-empty-but-200 status payload.
-        process.exitCode = 1;
       }
+      // Only a total failure exits non-zero; a partial answer is still an answer.
+      if (exitCode) process.exitCode = exitCode;
     });
 }

package/lib/commands/tool.js

@@ -199,6 +199,8 @@ export function registerToolCommands(program, ctx) {
       // success on failure. A HELD (pending) call awaits a human, so it stays 0.
       const failed = failedOf(data);
       if (failed && !(data && data.pending)) process.exitCode = 1;
+      // A held call exits 0 (chat relies on it) but must not read as a success: say so on stderr.
+      { const heldId = data && data.pending && (data.approvalId || (data._approval && data._approval.id)); if (heldId) console.error(`HELD, not run: approval ${heldId}`); }
 
       if (program.opts().output === 'json') {
         console.log(JSON.stringify(shown, null, 2));
@@ -225,6 +227,34 @@ export function registerToolCommands(program, ctx) {
       });
       printSuccess('Tool installed.');
     });
+
+  // CLI-COV 2026-11-05: `tool list` shows the org's own tool definitions, never catalog installations, so
+  // an install had no CLI read-back and no undo. These read and soft-disable the tool_installations row.
+  tool
+    .command('installed')
+    .description('List catalog tools installed in this organization (what `tool install` added)')
+    .action(async () => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('tools.installed');
+      const data = await client.get(ep.path, { service: ep.service });
+      formatOutput({
+        columns: ['tool_id', 'name', 'category', 'enabled', 'installed_at'],
+        headers: ['Tool ID', 'Name', 'Category', 'Enabled', 'Installed'],
+        rows: (data && data.installations) || [],
+      }, { format: program.opts().output });
+    });
+
+  tool
+    .command('uninstall')
+    .description('Disable a catalog tool installed with `tool install` (soft: the row is kept, marked disabled)')
+    .argument('<toolId>', 'catalog tool_id, as `tool installed` lists it')
+    .action(async (toolId) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('tools.uninstall-from-scope', { toolId });
+      const data = await client.delete(ep.path, { service: ep.service });
+      if (data && data.removed) printSuccess(`Tool ${toolId} uninstalled (disabled for this organization).`);
+      else console.log(`Tool ${toolId} was not installed in this organization; nothing changed.`);
+    });
 }
 
 /**

package/lib/commands/vault.js

@@ -4,11 +4,13 @@
  * quox vault <subcommand> [options]
  */
 
+import { withStepUp } from '../core/stepUpPrompt.js';
 import chalk from 'chalk';
 import Table from 'cli-table3';
 import ora from 'ora';
 import { formatOutput, formatDetail, printSuccess, printWarning, printInfo } from '../core/output.js';
 import { events, printEvent, line as glyphLine } from '../core/quoxglyph.js';
+import { announce, announceOnFail } from '../core/announce.js';
 import { resolveOrgId } from './helpers.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 
@@ -177,7 +179,7 @@ export function makeVaultGetAction({ client, auth }, program) {
 }
 
 export function makeVaultCreateAction({ client, auth }, program) {
-  return async (options) => {
+  return announceOnFail('vault', (options) => `create credential ${options?.label || ''}`.trim(), async (options) => {
     auth.requireAuth();
     const orgId = resolveOrgId(auth, program);
 
@@ -397,9 +399,10 @@ export function makeVaultCreateAction({ client, auth }, program) {
       printInfo(`note: not set as default — run "quox vault set-default ${result.id}" to make it the active ${result.integration_type || integrationType} credential`);
     }
 
+    announce('vault', `credential created ${result.label || ''}`.trim(), { result: `${result.id} · ${result.integration_type || integrationType}` });
     formatDetail(result, { format: program.opts().output });
     return result;
-  };
+  });
 }
 
 export function makeVaultUpdateAction({ client, auth }, program) {
@@ -1305,7 +1308,7 @@ export function registerVaultCommands(program, ctx) {
         throw new Error('--duration must be a positive number of minutes.');
       }
       const ep = resolveEndpoint('vault.leases.approve', { orgId, leaseId });
-      const result = await client.post(ep.path, { service: ep.service, body: { duration_minutes: duration } });
+      const result = await withStepUp((headers) => client.post(ep.path, { service: ep.service, headers, body: { duration_minutes: duration } }), { client, orgId, io: ctx.stepUpIO, what: 'This lease approval' });
       printEvent(events.updated('quox', 'credential lease', leaseId, `approved for ${duration}m`));
       formatDetail(result, { format: program.opts().output });
     });

package/lib/commands/vm.js

@@ -19,7 +19,7 @@ import { resolveOrgId } from './helpers.js';
 import { formatOutput, printInfo, printWarning } from '../core/output.js';
 import {
   VM_ACTIONS, VmPendingError, pendingHint, makeExec, makePoolRest,
-  listVms, vmInfo, vmDoctor, doctorLines, vmAction, vmSnapshot, vmRehearse, waitRehearsal, poolStatus, poolLease, poolDone, poolConfig, poolHostKeyLines,
+  listVms, vmListRows, vmInfo, vmDoctor, doctorLines, vmAction, vmSnapshot, vmRehearse, waitRehearsal, poolStatus, poolLease, poolDone, poolConfig, poolHostKeyLines,
   readPubkey, textOf, payloadOf,
 } from '../core/vm.js';
 
@@ -92,7 +92,7 @@ export function registerVmCommands(program, ctx) {
       const vms = await listVms(exec, { node: options.node, type: options.type });
       if (json()) { console.log(JSON.stringify(vms.map((v) => v.raw), null, 2)); return; }
       formatOutput(
-        { columns: ['vmid', 'name', 'node', 'type', 'status'], rows: vms.map(({ raw, ...r }) => r) },
+        { columns: ['vmid', 'name', 'node', 'type', 'status', 'tags'], rows: vmListRows(vms) },
         { emptyMessage: 'No VMs found.' },
       );
     }));

package/lib/commands/walkthrough.js

@@ -3,14 +3,17 @@ import { createInterface } from 'node:readline';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { resolveOrgId } from './helpers.js';
 import { runWalkthrough } from '../core/walkthrough.js';
+import { otherOrgsWaiting, crossOrgLines, clientForTarget } from '../core/crossOrgApprovals.js';
 
-export function attachWalkthrough(parent, { client, auth }, program) {
+export function attachWalkthrough(parent, { client: baseClient, auth, clientForOrg }, program) {
   parent
     .command('walkthrough')
     .description('Walk through the questions waiting for you one at a time: what it does, why, my advice, then your choice')
     .action(async () => {
       auth.requireAuth();
       const orgId = resolveOrgId(auth, program);
+      const sessionOrg = auth.getOrgId();
+      const client = await clientForTarget({ client: baseClient, clientForOrg, sessionOrgId: sessionOrg, orgId });
       const lp = resolveEndpoint('inbox.list', { orgId });
       const data = await client.get(lp.path, { service: lp.service, query: { status: 'open', limit: 200 } });
       const items = (data && (data.items || data)) || [];
@@ -24,9 +27,18 @@ export function attachWalkthrough(parent, { client, auth }, program) {
           readLine, write: (l) => console.log(l),
           answer: async (it, key, note) => {
             const ep = resolveEndpoint('inbox.respond', { orgId, itemId: it.id });
-            await client.post(ep.path, { service: ep.service, body: { action: 'answer', option: key, ...(note ? { comment: String(note).slice(0, 4000) } : {}) } });
+            const comment = note ? { comment: String(note).slice(0, 4000) } : {};
+            if (it.__approval) { // a policy-held approval: the same respond path as `quox approvals approve|deny`
+              // No PIN prompt here (the walk owns stdin): a server step-up refusal leaves it open, `quox approvals approve <id>` takes the PIN.
+              await client.post(ep.path, { service: ep.service, body: { action: key === 'y' ? 'approve' : 'reject', ...comment } });
+              return;
+            }
+            await client.post(ep.path, { service: ep.service, body: { action: 'answer', option: key, ...comment } });
           },
         });
       } finally { rl.close(); }
+      // Approvals waiting in the user's OTHER orgs: a count and the command, never the cards.
+      const more = crossOrgLines(await otherOrgsWaiting({ client: baseClient, currentOrgId: orgId }), 'walkthrough');
+      for (const l of more) console.log(l);
     });
 }

package/lib/commands/watch.js

@@ -52,6 +52,14 @@ export async function probeService(url, fetchImpl = fetch, timeoutMs = 8000) {
   }
 }
 
+/** Parse --interval: honour it down to `min`, report when it was raised. */
+export function clampInterval(raw, min, def) {
+  const n = parseInt(raw, 10);
+  if (!Number.isFinite(n) || n <= 0) return { seconds: def, clamped: false };
+  if (n < min) return { seconds: min, clamped: true };
+  return { seconds: n, clamped: false };
+}
+
 export function registerWatchCommands(program, { client, auth, config }) {
   const watch = program
     .command('watch')
@@ -126,7 +134,8 @@ export function registerWatchCommands(program, { client, auth, config }) {
     .description('Live service health dashboard')
     .option('--interval <seconds>', 'Refresh interval', '10')
     .action(async (opts) => {
-      const interval = Math.max(5, parseInt(opts.interval, 10) || 10) * 1000;
+      const iv = clampInterval(opts.interval, 1, 10);
+      const interval = iv.seconds * 1000;
       const services = [
         { name: 'auth', port: 3101, path: '/health' },
         { name: 'collector', port: 9848, path: '/health' },
@@ -157,7 +166,7 @@ export function registerWatchCommands(program, { client, auth, config }) {
           else if (r.status === 'timeout') console.log(`  ${chalk.yellow('●')} ${r.name.padEnd(14)} ${chalk.yellow('slow (no answer in ' + Math.round(r.latency_ms / 1000) + 's)')}`);
           else console.log(`  ${chalk.red('●')} ${r.name.padEnd(14)} ${chalk.red('down')}  ${chalk.dim(r.reason || '')}`);
         }
-        console.log(chalk.dim('\n  refreshing every ' + (interval / 1000) + 's'));
+        console.log(chalk.dim('\n  refreshing every ' + (interval / 1000) + 's' + (iv.clamped ? ' (minimum is 1s)' : '')));
       };
 
       await tick();