quoxcli 0.3.1 → 0.5.0

package/lib/api/endpoints/mon.js

@@ -127,6 +127,185 @@ export const mon = {
     path: () => `/docker/system-df`,
     tags: ['live-safe'],
   },
+  'mon.kuma.monitors.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.monitors.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.monitors.create': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.monitors.update': {
+    method: 'PATCH',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.monitors.pause': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}/pause`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.monitors.resume': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}/resume`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.monitors.wire-alerts': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}/wire-alerts`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.monitors.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.incidents.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ open, limit } = {}) => {
+      const q = [];
+      if (open) q.push('open=1');
+      if (limit) q.push(`limit=${encodeURIComponent(limit)}`);
+      return `/api/v1/kuma/incidents${q.length ? `?${q.join('&')}` : ''}`;
+    },
+    tags: ['live-safe'],
+  },
+  'mon.kuma.incidents.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/incidents/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.coverage.get': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/kuma/coverage`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.coverage.propose': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/coverage/propose`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.maintenance.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/kuma/maintenance`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.maintenance.open': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/maintenance`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.maintenance.end': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/maintenance/${encodeURIComponent(id)}/end`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.statusIncident.draft': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/status-incidents/${encodeURIComponent(id)}/draft`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.statusIncident.publish': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/status-incidents/${encodeURIComponent(id)}/publish`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.statusIncident.resolve': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/status-incidents/resolve`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.diagnose.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/diagnose`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.sla.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/sla`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.sla.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/kuma/sla`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.sla.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/sla/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.sla.verify': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/sla/${encodeURIComponent(id)}/verify`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.hooks.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/kuma/hooks`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.hooks.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/kuma/hooks`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.hooks.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/hooks/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.refresh.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/monitoring/uptime-kuma/refresh`,
+    tags: ['live-write'],
+  },
+  'mon.kuma.live.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ fresh } = {}) => `/api/v1/kuma/status${fresh ? '?fresh=1' : ''}`,
+    tags: ['live-safe'],
+  },
+  'mon.kuma.status.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ slug }) => `/api/v1/monitoring/uptime-kuma/status/${encodeURIComponent(slug)}`,
+    tags: ['live-safe'],
+  },
   'mon.metrics.get': {
     method: 'GET',
     service: 'collector',
@@ -145,12 +324,36 @@ export const mon = {
     path: () => `/api/v1/wazuh/agents`,
     tags: ['live-safe'],
   },
+  'mon.wazuh.read': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ tool }) => `/api/v1/wazuh/read/${tool}`,
+    tags: ['live-safe'],
+  },
   'mon.wazuh.alerts.list': {
     method: 'GET',
     service: 'collector',
     path: () => `/api/v1/wazuh/alerts`,
     tags: ['live-safe'],
   },
+  'mon.wazuh.alerts.triage': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/alerts/triage`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.coverage': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/coverage`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.credential.import-instance-env': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/credential/import-instance-env`,
+    tags: ['live-write'],
+  },
   'mon.wazuh.deploy-agent': {
     method: 'POST',
     service: 'collector',
@@ -175,6 +378,98 @@ export const mon = {
     path: () => `/api/v1/wazuh/manager/status`,
     tags: ['live-safe'],
   },
+  'mon.wazuh.reports.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/reports`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.reports.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/reports`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.reports.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/reports/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.reports.verify': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/reports/${encodeURIComponent(id)}/verify`,
+    tags: ['live-safe'],
+  },
+  // WAZ P6: Wazuh integratord alert hooks (org admin) and the incidents they open.
+  'mon.wazuh.hooks.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/hooks`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.hooks.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/hooks`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.hooks.rotate': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/hooks/${encodeURIComponent(id)}/rotate`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.hooks.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/hooks/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.incidents.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ open, since, limit } = {}) => {
+      const q = [];
+      if (open) q.push('open=1');
+      if (since) q.push(`since=${encodeURIComponent(since)}`);
+      if (limit) q.push(`limit=${encodeURIComponent(limit)}`);
+      return `/api/v1/wazuh/incidents${q.length ? `?${q.join('&')}` : ''}`;
+    },
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.incidents.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/incidents/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.incidents.close': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/incidents/${encodeURIComponent(id)}/close`,
+    tags: ['live-write'],
+  },
+  // WAZ P7: read-only host diagnosis (off-list reads are held by the ssh_exec approval gate) and hand-off to QuoxSecurity.
+  'mon.wazuh.incidents.diagnose': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/incidents/${encodeURIComponent(id)}/diagnose`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.incidents.escalate': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/incidents/${encodeURIComponent(id)}/escalate`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.vulnerabilities.priority': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/vulnerabilities/priority`,
+    tags: ['live-safe'],
+  },
   'mon.wazuh.vulnerabilities.list': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/objectives.js

@@ -11,6 +11,12 @@ export const objectives = {
     path: ({ id }) => `/api/objectives/${id}/approve-plan`,
     tags: ['live-write'],
   },
+  'objectives.retry': {
+    method: 'POST',
+    service: 'tasks',
+    path: ({ id }) => `/api/objectives/${id}/retry`,
+    tags: ['live-write'],
+  },
   'objectives.cancel': {
     method: 'DELETE',
     service: 'tasks',

package/lib/api/endpoints/quoxseo.js

@@ -59,6 +59,12 @@ export const quoxseo = {
     path: ({ query = '' }) => `/api/v1/quoxseo/trends${query}`,
     tags: ['live-safe'],
   },
+  'quoxseo.queries.rows': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ query = '' }) => `/api/v1/quoxseo/queries/rows${query}`,
+    tags: ['live-safe'],
+  },
   'quoxseo.inspection': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/server.js

@@ -0,0 +1,21 @@
+/**
+ * 'server.*' endpoints: moved out of admin.js so each key carries its fragment's own domain prefix.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const server = {
+  // DEVFLEET CX-2: server roles registry (role -> url, read before env by resolveServiceUrl). Collector routes;
+  // list is instance-admin readable, set/unset/test are instance-OWNER only (see services/collector/server.js).
+  'server.roles.list': {
+    method: 'GET', service: 'collector', path: () => '/api/v1/server/roles', tags: ['live-safe'],
+  },
+  'server.roles.set': {
+    method: 'PUT', service: 'collector', path: ({ role }) => `/api/v1/server/roles/${encodeURIComponent(role)}`, tags: ['admin-write'],
+  },
+  'server.roles.unset': {
+    method: 'DELETE', service: 'collector', path: ({ role }) => `/api/v1/server/roles/${encodeURIComponent(role)}`, tags: ['admin-write'],
+  },
+  'server.roles.test': {
+    method: 'POST', service: 'collector', path: ({ role }) => `/api/v1/server/roles/${encodeURIComponent(role)}/test`, tags: ['admin-write'],
+  },
+};

package/lib/api/endpoints/setup.js

@@ -81,6 +81,12 @@ export const setup = {
     path: ({ pluginId }) => `/api/setup/licensing/seats/${encodeURIComponent(pluginId)}/release-dead`,
     tags: ['live-write'],
   },
+  'setup.licensing.seats.release': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ pluginId }) => `/api/setup/licensing/seats/${encodeURIComponent(pluginId)}/release`,
+    tags: ['live-write'],
+  },
   'setup.status.list': {
     method: 'GET',
     service: 'auth',

package/lib/api/endpoints/tools.js

@@ -29,6 +29,19 @@ export const tools = {
     path: () => `/api/tools/install-to-scope`,
     tags: ['live-write'],
   },
+  // CLI-COV 2026-11-05: read and undo what `tool install` wrote (tool_installations, not the org's tool definitions)
+  'tools.installed': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/tools/installed`,
+    tags: ['live-safe'],
+  },
+  'tools.uninstall-from-scope': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ toolId }) => `/api/tools/install-to-scope/${encodeURIComponent(toolId)}`,
+    tags: ['live-write'],
+  },
   'tools.list': {
     method: 'GET',
     service: 'auth',

package/lib/api/endpoints/v1.js

@@ -59,6 +59,14 @@ export const v1 = {
     path: () => `/api/v1/fleet/hosts`,
     tags: ['live-safe'],
   },
+  // quoxbastion#34 — `quox fleet ping [host]`: governed Bastion host-state
+  // refresh (org admin; emits a quox.fleet.ping evidence envelope).
+  'v1.fleet.ping': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/fleet/ping`,
+    tags: ['admin-write'],
+  },
   // DEVSUITE-HUB Phase 2 — `quox dev enable` (see lib/commands/dev.js).
   // Constructs + signs + delivers a quoxagent dev.CapabilityProfile onto a
   // target host via Bastion. See services/collector/server.js's
@@ -290,6 +298,32 @@ export const v1 = {
     path: () => `/api/v1/policies/validate`,
     tags: ['live-write'],
   },
+  // LAZY-AI-CLI: vendor CLIs (Claude Code, Codex) the user's own server installs from npm. Status is any
+  // signed-in caller; plan + install need a human instance admin (the binary is instance-wide).
+  'v1.providers.cli.status': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/providers/cli`,
+    tags: ['live-safe'],
+  },
+  'v1.providers.cli.plan': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ tool }) => `/api/v1/providers/cli/${encodeURIComponent(tool)}/plan`,
+    tags: ['live-safe'],
+  },
+  'v1.providers.cli.install': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ tool }) => `/api/v1/providers/cli/${encodeURIComponent(tool)}/install`,
+    tags: ['live-write'],
+  },
+  'v1.providers.cli.job': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/providers/cli/jobs/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
   'v1.tools.execute': {
     method: 'POST',
     service: 'collector',
@@ -331,6 +365,19 @@ export const v1 = {
     path: ({ id }) => `/api/v1/approvals/grants/${encodeURIComponent(id)}/revoke`,
     tags: ['live-write'],
   },
+  // ApprovalsQ call-me policy (2026-11-03): human org admin only; flips the stale-approval phone watcher.
+  'v1.approvals.call-me.get': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/approvalsq/call-me`,
+    tags: ['live-safe'],
+  },
+  'v1.approvals.call-me.put': {
+    method: 'PUT',
+    service: 'collector',
+    path: () => `/api/v1/approvalsq/call-me`,
+    tags: ['live-write'],
+  },
   'v1.tools.list': {
     method: 'GET',
     service: 'collector',

package/lib/commands/actions.js

@@ -5,39 +5,52 @@
  * Tracker answers could not be checked against CLI truth. These verbs call the
  * SAME governed tool the Action Tracker UI and the agent use (POST
  * /api/v1/tools/execute, tool_name action_list), so chat, UI and CLI read one
- * source. Writes (add/move/update/delete) stay in chat and the UI for now.
+ * source. `add` and `done` write through the collector route the dashboard
+ * uses (POST/PATCH /api/v1/actions) as the logged-in user, via core/actionItems.js,
+ * the same core the Quox TUI /todo uses. Move/update/delete stay in chat and the UI.
  */
 
-import { formatOutput, formatDetail } from '../core/output.js';
+import { formatOutput, formatDetail, printSuccess } from '../core/output.js';
 import { QuoxError } from '../core/errors.js';
+import { confirmDestructive } from '../core/confirm.js';
 import { executeGovernedTool } from './tool.js';
+import { addActionItem, completeActionItem, moveActionItem, deleteActionItem, STATUS_COLUMNS, PRIORITIES } from '../core/actionItems.js';
 
 const STATUSES = ['todo', 'doing', 'done', 'all'];
+const MAX_PAGES = 50;
 
 async function listItems(ctx, { status = 'all', limit = 100, scope } = {}) {
   if (!STATUSES.includes(status)) {
     throw new QuoxError(`--status must be one of ${STATUSES.join(', ')}`);
   }
-  const input = { status, limit: Math.min(Math.max(Number(limit) || 20, 1), 100) };
-  if (scope) input.scope_id = scope;
-  const data = await executeGovernedTool(ctx, 'action_list', input);
-  const result = data && data.result !== undefined ? data.result : data;
-  if (!result || result.success === false) {
-    throw new QuoxError(`action_list failed: ${(result && (result.error || result.message)) || 'no result'}`);
+  const pageSize = Math.min(Math.max(Number(limit) || 20, 1), 100);
+  // Page through everything: a silent cap at one page hid 4 of 24 items (owner, 2026-10-20).
+  const all = [];
+  for (let page = 1; page <= MAX_PAGES; page++) {
+    const input = { status, limit: pageSize };
+    if (scope) input.scope_id = scope;
+    if (page > 1) input.page = page;
+    const data = await executeGovernedTool(ctx, 'action_list', input);
+    const result = data && data.result !== undefined ? data.result : data;
+    if (!result || result.success === false) {
+      throw new QuoxError(`action_list failed: ${(result && (result.error || result.message)) || 'no result'}`);
+    }
+    all.push(...(Array.isArray(result.items) ? result.items : []));
+    if (!result.hasMore) return all;
   }
-  return Array.isArray(result.items) ? result.items : [];
+  throw new QuoxError(`More than ${MAX_PAGES * pageSize} items; narrow with --status or --scope.`);
 }
 
 export function registerActionsCommands(program, ctx) {
   const actions = program
     .command('actions')
-    .description('Action Tracker items (read-only; add and move items in chat or the dashboard)');
+    .description('Action Tracker items: list, get, add, done, move, delete (edit in chat or the dashboard)');
 
   actions
     .command('list')
     .description('List action items')
     .option('--status <status>', 'todo, doing, done or all', 'all')
-    .option('--limit <n>', 'max items (1-100)', '100')
+    .option('--limit <n>', 'page size (1-100); every page is listed', '100')
     .option('--scope <scopeId>', 'only items in this team/department/division scope')
     .action(async (options) => {
       const items = await listItems({ ...ctx, program }, options);
@@ -58,4 +71,61 @@ export function registerActionsCommands(program, ctx) {
       if (!item) throw new QuoxError(`No action item ${id} among the latest 100 items.`);
       formatDetail(item);
     });
+
+  actions
+    .command('add')
+    .description('Add an Action Tracker item (todo) as the logged-in user')
+    .argument('<text...>', 'what needs doing')
+    .option('--due <date>', 'YYYY-MM-DD, today or tomorrow')
+    .option('--priority <priority>', `one of ${PRIORITIES.join(', ')}`)
+    .option('--description <text>', 'longer notes')
+    .action(async (words, options) => {
+      ctx.auth.requireAuth();
+      const item = await addActionItem(ctx.client, { title: words, due: options.due, priority: options.priority, description: options.description });
+      if (program.opts().output === 'json') return formatDetail(item);
+      printSuccess(`Added action item ${item.id}: ${item.title}${item.due_date ? ` (due ${String(item.due_date).slice(0, 10)})` : ''}`);
+      return undefined;
+    });
+
+  actions
+    .command('done')
+    .description('Mark an Action Tracker item done')
+    .argument('<id>', 'action item id (from `quox actions list`)')
+    .action(async (id) => {
+      ctx.auth.requireAuth();
+      const item = await completeActionItem(ctx.client, id);
+      if (program.opts().output === 'json') return formatDetail(item);
+      printSuccess(`Marked done ${item.id}: ${item.title}`);
+      return undefined;
+    });
+
+  actions
+    .command('move')
+    .description('Move an Action Tracker item to todo, doing or done')
+    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<status>', STATUS_COLUMNS.join(', '))
+    .action(async (id, status) => {
+      ctx.auth.requireAuth();
+      const item = await moveActionItem(ctx.client, id, status);
+      if (program.opts().output === 'json') return formatDetail(item);
+      printSuccess(`Moved ${item.id} to ${item.status}: ${item.title}`);
+      return undefined;
+    });
+
+  actions
+    .command('delete')
+    .description('Delete one of your Action Tracker items (asks first; --yes skips, required without a terminal)')
+    .argument('<id>', 'action item id (from `quox actions list`)')
+    .option('-y, --yes', 'do not ask')
+    .action(async (id, options) => {
+      ctx.auth.requireAuth();
+      if (!(await confirmDestructive(program, { force: options.yes === true }, `Delete action item ${id}?`))) {
+        console.log('Not deleted.');
+        return undefined;
+      }
+      const r = await deleteActionItem(ctx.client, id);
+      if (program.opts().output === 'json') return formatDetail(r);
+      printSuccess(`Deleted ${r.id}${r.title ? `: ${r.title}` : ''}`);
+      return undefined;
+    });
 }

package/lib/commands/admin.js

@@ -4,6 +4,9 @@
 
 import { formatOutput, formatDetail, printSuccess } from '../core/output.js';
 import { resolveEndpoint } from '../api/endpoints.js';
+import { withStepUp } from '../core/stepUpPrompt.js';
+import { announce, announceFailure } from '../core/announce.js';
+import { resolveOrgId } from './helpers.js';
 
 export function registerAdminCommands(program, ctx) {
   const { client, auth } = ctx;
@@ -154,6 +157,38 @@ export function registerAdminCommands(program, ctx) {
       console.log(data.token);
     });
 
+  // ADMIN-VERIFY-EMAIL: accounts with no real mailbox (test/service accounts) can never click the
+  // emailed link, so they never see org invites. Instance-admin, human, step-up PIN (hidden prompt).
+  const users = admin
+    .command('users')
+    .description('Instance user administration');
+
+  users
+    .command('verify-email')
+    .description('Mark a user email verified (instance admin; asks for your step-up PIN; audited)')
+    .argument('<email>', 'the email address to mark verified')
+    .requiredOption('--reason <text>', 'why this address is verified without a mailbox (recorded in the audit log)')
+    .option('--user-id <id>', 'refuse unless the email belongs to this user id')
+    .action(async (email, opts) => {
+      auth.requireAuth();
+      const reason = String(opts.reason || '').trim();
+      if (!reason) throw new Error('--reason must not be empty');
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('admin.users.verify_email');
+      let data;
+      try {
+        data = await withStepUp(
+          (headers) => client.post(ep.path, { service: ep.service, headers, body: { email, reason, ...(opts.userId ? { user_id: opts.userId } : {}) } }),
+          { client, orgId, scope: 'override', io: ctx.stepUpIO, what: 'Verifying an email address' },
+        );
+      } catch (err) {
+        announceFailure('quox', `admin verify-email ${email}`, err);
+        throw err;
+      }
+      announce('quox', `admin verify-email ${email}`, { result: `verified · user ${data.user_id}` });
+      printSuccess(`Email ${data.email} is now verified. Reason recorded in the audit log.`);
+    });
+
   // Email / SMTP (QCPRO-SMTP): instance email onboarding parity
   const email = admin
     .command('email')