quoxcli 0.3.1 → 0.5.0

package/lib/quoxon/backgroundWork.js

@@ -0,0 +1,59 @@
+// Does a shell command start detached work? Then the approver's "it ran fine" only covers the launch. Pure: text in, boolean out.
+// Quote-aware: '&' inside quotes, '&&', redirects (2>&1, >&2, &>f), '|&', a backslash-escaped '\&' and '# comments' are not background.
+
+export const BACKGROUND_NOTE = 'starts background work: the result you see is only the launch, not the outcome';
+
+const WRAPPERS = new Set(['sudo', 'env', 'command', 'exec', 'time', 'nice', 'ionice', 'doas', 'stdbuf', 'timeout']);
+const DETACHERS = new Set(['nohup', 'setsid', 'disown', 'at', 'batch']);
+
+/** One command's words (quotes removed) -> true when its command word detaches. */
+function segmentDetaches(words) {
+  let i = 0;
+  while (i < words.length) {
+    const w = words[i];
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w)) { i++; continue; } // FOO=1 cmd
+    if (WRAPPERS.has(w)) { i++; while (i < words.length && /^-/.test(words[i])) i++; continue; }
+    break;
+  }
+  const cmd = (words[i] || '').replace(/^.*\//, '');
+  const rest = words.slice(i + 1);
+  if (DETACHERS.has(cmd)) return true;
+  if (cmd === 'systemd-run') return !rest.some(a => /^(--wait|--pipe|--pty|--scope|--shell|-P|-t|-S)$/.test(a)); // these wait for the unit; plain systemd-run returns at once
+  if (cmd === 'screen') return rest.some(a => /^-[A-Za-z]*d[A-Za-z]*m?[A-Za-z]*$/.test(a) && /^-[A-Za-z]+$/.test(a) && (/d/.test(a)) && (/m/.test(a) || rest.includes('-m'))); // screen -d -m / -dm / -dmS
+  if (cmd === 'tmux') return /^(new|new-session)$/.test(rest[0] || '') && rest.slice(1).some(a => /^-[A-Za-z]*d[A-Za-z]*$/.test(a));
+  if (cmd === 'docker') {
+    const sub = rest.filter(a => !/^-/.test(a));
+    if (sub[0] === 'run') return rest.some(a => a === '--detach' || /^-[A-Za-z]*d[A-Za-z]*$/.test(a));
+    if (sub[0] === 'compose' && rest.includes('up')) return rest.some(a => a === '--detach' || /^-[A-Za-z]*d[A-Za-z]*$/.test(a));
+    return false;
+  }
+  if (cmd === 'docker-compose') return rest[0] === 'up' && rest.some(a => a === '--detach' || /^-[A-Za-z]*d[A-Za-z]*$/.test(a));
+  if (cmd === 'systemctl') return rest.includes('--no-block') && rest.some(a => /^(start|restart|reload|try-restart|reload-or-restart|stop|isolate)$/.test(a));
+  return false;
+}
+
+export function startsBackgroundWork(text) {
+  const s = typeof text === 'string' ? text : '';
+  if (!s) return false;
+  let words = []; let cur = null; let q = null; let found = false;
+  const endWord = () => { if (cur !== null) { words.push(cur); cur = null; } };
+  const endSeg = () => { endWord(); if (words.length && segmentDetaches(words)) found = true; words = []; };
+  for (let i = 0; i < s.length && !found; i++) {
+    const ch = s[i];
+    if (q) { if (ch === q) q = null; else if (q === '"' && ch === '\\' && i + 1 < s.length) { cur += s[++i]; } else cur += ch; continue; }
+    if (ch === '\\') { cur = (cur ?? '') + (s[++i] ?? ''); continue; }
+    if (ch === "'" || ch === '"') { q = ch; cur = cur ?? ''; continue; }
+    if (ch === '#' && cur === null) { while (i < s.length && s[i] !== '\n') i++; endSeg(); continue; }
+    if (/\s/.test(ch)) { if (ch === '\n') endSeg(); else endWord(); continue; }
+    if (ch === '&') {
+      if (s[i + 1] === '&') { endSeg(); i++; continue; }
+      const prev = s[i - 1];
+      if (s[i + 1] === '>' || prev === '>' || prev === '<' || prev === '|') { cur = (cur ?? '') + ch; continue; } // &>f, 2>&1, <&3, |&
+      endSeg(); found = true; break; // a lone '&' detaches the command before it
+    }
+    if (ch === ';' || ch === '|' || ch === '(' || ch === ')' || ch === '{' || ch === '}') { endSeg(); continue; }
+    cur = (cur ?? '') + ch;
+  }
+  if (!found) endSeg();
+  return found;
+}

package/lib/quoxon/bang.js

@@ -187,7 +187,7 @@ export function runBang(plan, { cwd = process.cwd(), env = process.env, timeoutM
 /** The "exit N · 1.2s" footer, plus the plain-words reasons. */
 export function footer(r, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   const secs = `${(r.ms / 1000).toFixed(1)}s`;
-  if (r.timedOut) return `timed out after ${Math.round(timeoutMs / 1000)}s and was stopped · ${secs} (QUOX_BANG_TIMEOUT_MS changes the limit)`;
+  if (r.timedOut) return `timed out after ${Math.round(timeoutMs / 1000)}s · stopped; anything it already started may have completed. Run long commands in a terminal, or set QUOX_BANG_TIMEOUT_MS · ${secs}`;
   if (r.killed) return `stopped (Ctrl+C) · ${secs}`;
   if (r.signal) return `killed by ${r.signal} · ${secs}`;
   return `exit ${r.code} · ${secs}`;

package/lib/quoxon/capabilities.js

@@ -45,6 +45,11 @@ export function offerFor(capabilityId, res) {
   }
 }
 
+/** -> display names of every requires_setup capability, in server order. */
+export function needsSetupNames(caps) {
+  return (Array.isArray(caps) ? caps : []).filter(c => c.availability === 'requires_setup').map(capabilityName);
+}
+
 /** -> [[text, tone?]] for /capabilities. */
 export function capabilityLines(res) {
   if (!res?.ok || !Array.isArray(res.capabilities)) {
@@ -59,7 +64,7 @@ export function capabilityLines(res) {
   if (!installed.length) out.push(['  nothing is ready yet']);
   const setup = of('requires_setup');
   if (setup.length) {
-    out.push(['Needs setup:']);
+    out.push([`Needs setup (${setup.length}): ${needsSetupNames(caps).join(', ')}`]);
     for (const c of setup) out.push([`◐ ${capabilityName(c)}  ${c.reason || 'needs setup'}${c.setup ? ` · ${c.setup}` : ''}`, 'warn']);
   }
   const unk = caps.filter(statusUnreadable);
@@ -70,7 +75,7 @@ export function capabilityLines(res) {
   const off = of('unavailable').filter(c => !statusUnreadable(c));
   if (off.length) {
     out.push(['Not available here:']);
-    for (const c of off) out.push([`○ ${capabilityName(c)}  ${c.reason || 'unavailable'}${c.setup ? ` · ${c.setup}` : ''}`]);
+    for (const c of off) out.push([`○ ${capabilityName(c)}  ${c.reason === 'No signal to check' ? 'not checked: nothing here reports on it yet' : (c.reason || 'unavailable')}${c.setup ? ` · ${c.setup}` : ''}`]);
   }
   const planned = of('planned');
   if (planned.length) {

package/lib/quoxon/commandShort.js

@@ -7,6 +7,8 @@
 export const SHORT_MAX = 54;
 export const SHORT = {
   walkthrough: 'a guided pass: what it does, why, my advice',
+  inbox: 'your Quox inbox: latest items, read, open',
+  mail: 'your triaged email, read only: latest, or N to read',
   approvals: 'the questions waiting for you, one at a time',
   peek: 'look up an envelope, item, run or receipt by id',
   aside: 'a read-only side question, kept out of the chat',
@@ -16,17 +18,22 @@ export const SHORT = {
   answer: 'answer a question a session asked you',
   authenticate: 'enter your PIN once, good for 10 minutes',
   override: 'override one blocked action (PIN, witnessed)',
+  'verify-email': 'mark a user email verified (admin, PIN, audited)',
   skills: 'list your org\'s governed skills, or show one',
   skill: 'ask Quox to run a skill (approvals still apply)',
   rules: 'which rules win: QUOX.md, dev pack, server policy',
   clear: 'fresh conversation and a clear screen',
+  stop: 'stop the current turn, same as Esc',
+  devservers: 'your registered dev servers, and how to open one',
   resume: 'pick a recent conversation and carry on',
   compact: 'summarise the conversation, keeping decisions',
   challenge: 'a second opinion on the last answer (one extra turn)',
   spawn: 'ask HYPERION for a disposable VM (max 24h)',
   consent: 'AI data sharing: see where you stand, or agree',
+  contact: 'add a contact, or list them (as quox contacts)',
   help: 'this reference, or detail for one command',
-  note: 'jot a note for the dev observer (also // text)',
+  note: 'save a note to NotesQ (/notes lists them)',
+  devnote: 'jot a note for the dev observer (also // text)',
   share: 'attach your last ! command\'s output to your message',
   copy: 'copy the last answer to the clipboard',
   dragon: 'the Q comes alive; explain, ask, sleep',
@@ -45,6 +52,8 @@ export const SHORT = {
   demo: 'play the simulated demo; nothing real runs',
   feedback: 'tell the Quox team something (you see it first)',
   gripe: 'file a GitHub issue; /gripe! files at once',
+  gripes: 'gripes waiting to be filed, and recent ones',
+  outbox: 'messages waiting for QuoxCORE to answer',
   sessions: 'everything live in your org, and where it runs',
   active: 'who is doing what, one line per worker',
   dashboard: 'open the web dashboard already signed in',
@@ -92,13 +101,20 @@ export const SHORT = {
   org: 'list your orgs, switch to one, or go back',
   r: 'reply to whoever last messaged you (also /reply)',
   poke: 'wake a session with an urgent page (also /wake)',
+  donotdisturb: 'sleep means sleep: collect quietly, read at morning',
+  morningreport: 'what came in while do not disturb was on',
+  callmeforapprovals: 'phone me when a high-risk approval sits unanswered',
   afk: 'tell sessions you are away; approvals still queue',
   back: 'mark yourself present and show what you missed',
   observe: 'post a note to the session watching your window',
-  huh: 'the dragon explains what just happened',
-  sleep: 'mark yourself sleeping; the dragon curls up',
+  huh: 'explain the last output in plain words',
+  sleep: 'say you are asleep; sessions stop waiting on you',
   mode: 'ask first (default) or plan only',
   slots: 'held slots: who holds them and where',
+  todo: 'add an Action Tracker item; /todo alone lists',
+  done: 'mark Action Tracker items done: /done td1,td2',
+  todos: 'your Action Tracker by column: td1 do1 dn1',
+  plugins: 'installed plugins (extensions) and their state',
   mirror: 'what CommanderQ sees about this org right now',
   health: 'dashboard summary: services, agents, approvals',
   status: 'profile, org, server health, model, agent, slot',
@@ -108,5 +124,8 @@ export const SHORT = {
   server: 'your self-hosted install: version, health, disk',
   config: 'settings: theme, motion, verbose, model',
   model: 'choose the provider and model for your next turns',
+  qpe: 'how many proof engine rows show',
   row: 'your own live lines above the status bar',
+  deck: 'QuoxDeck MIDI pads (the quoxdeck extension)',
+  ext: 'installed extensions: list, turn on or off',
 };

package/lib/quoxon/commands.js

@@ -34,7 +34,7 @@ const ARGS = {
   fleet: [{ after: [], src: 'fleetHosts' }],
   replay: [{ after: [], src: 'conversations' }],
   org: [
-    { after: [], choices: [
+    { after: [], src: 'orgs', choices: [
       { value: 'switch', desc: 'move this session to another org' },
       { value: 'back', desc: 'return to the org you were in before' },
       { value: 'list', desc: 'your orgs' }] },
@@ -60,9 +60,18 @@ const ARGS = {
   slot: [{ after: [], src: 'slots', choices: [{ value: 'log', desc: 'recent messages in the held slot' }] }],
   mode: [{ after: [], choices: [{ value: 'ask', desc: 'ask first (the default)' }, { value: 'plan', desc: 'plan only: investigates and proposes, changes nothing' }] }],
   say: [{ after: [], src: 'slots' }],
-  broadcast: [{ after: [], choices: [{ value: '--slots', desc: 'only these slots, comma separated' }, { value: '--priority', desc: 'urgent shows red' }, { value: '--ack', desc: 'ask recipients to /ack' }] }],
+  broadcast: [{ after: [], choices: [{ value: '--slots', desc: 'only these slots, comma separated' }, { value: '--priority', desc: 'urgent shows red' }, { value: '--ack', desc: 'ask recipients to /ack' }, { value: '--active', desc: 'only sessions listening now; dormant are skipped' }, { value: '--dry-run', desc: 'with --active: list who would be reached, send nothing' }] }],
   send: [{ after: [], src: 'slots' }, { after: ['*'], src: 'files', of: 'partial' }],
-  dragon: [{ after: [], choices: ['explain', 'ask', 'sleep', 'fly', 'hero', 'fire', 'classic'] }],
+  dragon: [
+    { after: [], choices: ['explain', 'ask', 'sleep', 'fly', 'hero', 'fire', 'classic', { value: 'companion', desc: 'the dragon beside an attached Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan or Quoxperticus' }] },
+    { after: ['companion'], choices: [{ value: 'on', desc: 'on attach and key moments, then leaves' }, { value: 'greeting', desc: 'only on attach, then leaves' }, { value: 'off', desc: 'never on its own (/dragon shows it)' }, { value: 'status', desc: 'what is set and whether the art loads' }] }
+  ],
+  ext: [
+    { after: [], choices: [{ value: 'list', desc: 'each listed extension and where it was found' }, { value: 'on', desc: 'load one now and at every start' }, { value: 'off', desc: 'unload one' }, { value: 'tab', desc: 'focus an extension panel (off collapses)' }, { value: 'set', desc: 'change one of its settings' }, { value: 'settings', desc: 'show its settings' }] },
+    { after: ['on'], src: 'ext.listed' }, { after: ['off'], src: 'ext.loaded' }, { after: ['tab'], src: 'ext.panels' },
+    { after: ['set'], src: 'ext.loaded' }, { after: ['settings'], src: 'ext.loaded' }, { after: ['set', '*'], src: 'ext.keys', of: 1 }
+  ],
+  inbox: [{ after: [], choices: [{ value: 'read', desc: 'read N | all: mark items read' }, { value: 'open', desc: 'open N: take an approval to /approvals' }, { value: 'latest', desc: 'the latest 10' }, { value: 'mute', desc: 'mute <from> [1h|8h|1d]: no arrival lines from that source (approvals never muted)' }, { value: 'unmute', desc: 'unmute <from>' }, { value: 'mutes', desc: 'muted sources and when they expire' }] }, { after: ['mute'], src: 'inbox.sources' }, { after: ['unmute'], src: 'inbox.mutes' }],
   tips: [{ after: [], choices: topicList().map(t => ({ value: t.topic, desc: `${t.count} tip${t.count === 1 ? "" : "s"}` })) }],
   whatsnew: [{ after: [], choices: [{ value: 'all', desc: 'every command and entry, regardless of seen' }, { value: 'on', desc: 'show the card at startup when something is new' }, { value: 'off', desc: 'stop the startup card' }] }],
   'tip-settings': [{ after: [], choices: [
@@ -93,6 +102,19 @@ const ARGS = {
   ]
 };
 
+// Dev-only entries (dev: true) are vendor tooling: they live in lib/vendor/devCommands.js, which package.json
+// "files" keeps out of the published quoxcli (same mechanism as the owner-only licence verbs, quox#1134).
+// Present in the dev tree, absent for every npm user.
+let DEV_ENTRIES = [];
+// TUI-QPE 2026-10-20 (owner: "/qpe is extension right?"): owner tooling that is not dev-observer gated also lives in
+// lib/vendor (VENDOR_ENTRIES), so the public build has no /qpe; customers have no proof engine.
+let VENDOR_ENTRIES = [];
+try {
+  const v = await import('../vendor/devCommands.js');
+  DEV_ENTRIES = v.DEV_ENTRIES || [];
+  VENDOR_ENTRIES = v.VENDOR_ENTRIES || [];
+} catch (e) { if (e?.code !== 'ERR_MODULE_NOT_FOUND') throw e; }
+
 export const REGISTRY = [
   // Talk (keys)
   { id: 'type', kind: 'key', group: 'Talk', usage: 'just type', desc: 'ask Quox anything; CommanderQ routes it to the right agent', status: 'active' },
@@ -109,7 +131,10 @@ export const REGISTRY = [
   { id: 'paste', kind: 'key', group: 'Talk', usage: 'paste', desc: 'long pastes collapse to [Pasted text #N +L lines] and expand on send', status: 'active' },
   { id: 'ctrlc', kind: 'key', group: 'Talk', usage: 'Ctrl+C', desc: 'clear the draft; during a turn interrupt; twice when idle quits', status: 'active' },
   // Approvals
-  { id: 'approvals', kind: 'command', group: 'Approvals', usage: '/approvals [mine|agents|old|<agent>|N]', desc: 'the questions waiting for you, one at a time', server: true, cap: 'approvals', status: 'active' },
+  { id: 'approvals', kind: 'command', group: 'Approvals', usage: '/approvals [mine|agents|old|<agent>|N|auto on|off]', desc: 'the questions waiting for you, one at a time', server: true, cap: 'approvals', status: 'active',
+    detail: 'New approvals and questions open by themselves as the one-at-a-time card (after your draft, typing pause or turn; never mid-typing, never answered for you), including ones in your other orgs, which are answered there without switching. /approvals auto off keeps them as the ⏸ line; the setting is saved on this profile.' },
+  { id: 'inbox', kind: 'command', new: true, group: 'Approvals', usage: '/inbox [N | read N|N-M|all | open N | mute <from> [1h|8h|1d] | unmute <from> | mutes]', desc: 'your Quox inbox: the latest 10 as a table, N shows one in full, read marks read, open takes an approval to /approvals; mute silences a source\'s arrival lines (default 8h, approvals never muted), repeats of the same title collapse to (×N)', needs: ['inboxItems'], cap: 'approvals', status: 'active', args: ARGS.inbox },
+  { id: 'mail', kind: 'command', new: true, group: 'Approvals', usage: '/mail [N | focus|fyi|auto|screened]', desc: 'your triaged email (InboxQ), read only: the latest 10, N reads one with its triage reason', needs: ['mailMessages'], status: 'active' },
   { id: 'walkthrough', kind: 'command', new: true, group: 'Approvals', usage: '/walkthrough', desc: 'walk through what is waiting for you one question at a time: what it does, why, my advice, then your choice (same as /approvals walkthrough)', server: true, cap: 'approvals', status: 'active' },
   { id: 'yestoall', kind: 'command', new: true, group: 'Approvals', usage: '/yestoall', desc: 'approve everything waiting for you (same as /approve all; privileged ones still ask)', server: true, cap: 'approvals', status: 'active' },
   { id: 'approve', kind: 'command', group: 'Approvals', usage: '/approve N | 1 y 2 n | agent <name>', desc: 'approve item N from the list, or everything one agent asked', server: true, cap: 'approvals', status: 'active',
@@ -123,16 +148,30 @@ export const REGISTRY = [
     detail: 'Like /approve N, but asks for your step-up PIN first when there is no live human-present window. The digits are never shown, saved, or sent anywhere except the PIN check.' },
   { id: 'override', kind: 'command', group: 'Approvals', usage: '/override <block id|last> <reason>', desc: 'override ONE blocked action (PIN, recorded and witnessed)', server: true, cap: 'approvals', status: 'active',
     detail: 'When a policy block refuses an action (safety level, budget cap, AOCL or WARD deny), a person with a fresh PIN can override that one action. The reason, your name and the block are recorded and witnessed. Today only safety blocks (E-STOP, DEFCON RED dispatch refusals) are honoured by a gate; other block types are recorded but stay blocked, and the answer says so. "last" is the most recent block this window saw.' },
+  { id: 'verify-email', kind: 'command', group: 'Approvals', usage: '/verify-email <email> --reason "<why>"', desc: 'mark a user email verified (instance admin; preview, then your PIN; audited)', server: true, cap: 'approvals', status: 'active',
+    detail: 'The TUI front of quox admin users verify-email: the same endpoint, and the server stays the only gate (instance admin, a human caller, a one-shot step-up token, a reason). --reason is required and is recorded in the audit log; --user-id <id> refuses unless the address belongs to that user. You see what will happen and answer y/N, then the private PIN card opens. It always asks for the PIN afresh: a live /authenticate window is not reused or spent. The PIN is never an argument, never shown, saved or logged.' },
   // Skills and rules
   { id: 'skills', kind: 'command', group: 'Skills', usage: '/skills [name]', desc: 'list your org\'s governed skills, or show one as a card', needs: ['skills'], cap: 'skills', status: 'active',
     detail: 'Lists your org skills (reusable procedures an agent follows; not Crystals, which are deterministic replays) with edition and one-line description. /skills <name> shows its card: purpose, version and review state, tests (results only when run-tests recorded them), the agents it is for, where it came from, recorded use, and how to run it.' },
   { id: 'skill', kind: 'command', group: 'Skills', usage: '/skill <name> [args]', desc: 'ask Quox to run a skill (governed: approvals still apply)', server: true, cap: 'skills', status: 'active',
     detail: 'Sends "Run the skill <name> with: <args>" as a normal turn, so CommanderQ runs it through the usual governed path. Nothing is executed from here, and approval cards work as always.' },
+  { id: 'callmeforapprovals', kind: 'command', new: true, group: 'Approvals', usage: '/callmeforapprovals [on|off|status]', desc: 'phone me when a high-risk approval sits unanswered: status, on or off (human org admin only)', needs: ['callMe'], status: 'active', aliases: ['callme'],
+    detail: 'The same call as quox approvals call-me. Alone it shows whether the phone-me switch is on, how long an approval waits before the call, quiet hours, the minimum risk tier, and whether the watcher on the server is actually alive (or says it cannot tell). on or off flips only the switch (add --after <minutes> or --quiet 22:00-08:00 to tune it); every other setting is kept. The call only reads you one approval and asks: approve needs a keypad PIN, nothing is ever approved for you. Org admins only; an agent login is refused.' },
+  { id: 'plugins', kind: 'command', group: 'Skills', usage: '/plugins [name]', desc: 'plugins (extensions, add-ons) your org has installed: enabled state and version; /plugins <name> shows one', needs: ['pluginList'], status: 'active', aliases: ['plugin', 'extensions', 'extension', 'addons', 'apps'],
+    detail: 'Read-only. Lists the plugins installed for the active org (the same call as quox plugin list) with enabled or disabled and the version. /plugins <name> shows one plugin (as quox plugin get). Also answers to /extensions, /extension, /addons and /apps; "/extension list" works too.' },
+  { id: 'todo', kind: 'command', group: 'Awareness', usage: '/todo <text>', desc: 'add an Action Tracker item; /todo move do2 done moves one; /todo alone lists', needs: ['todoAdd', 'todoList', 'todoMove'], status: 'active',
+    detail: 'Moves: /todo move do5 done, /todo do5 done, /todo mark do2 done, /todo td3 doing (td = to do, do = doing, dn = done; the numbers are the ones /todos last showed, and if the list changed since, it says so and still moves the item you saw). Adds one item to your Action Tracker (status todo) as you, the same as quox actions add "<text>" or adding it in the dashboard, then confirms with the item id. No model call and no approval: you typing it is the authorization. /todo with no text lists your open items, the same as /todos. Mark one done with quox actions done <id>.' },
+  { id: 'done', kind: 'command', group: 'Awareness', usage: '/done <ids>', desc: 'mark Action Tracker items done: /done td1,td2', needs: ['todoList', 'todoMove'], status: 'active',
+    detail: 'Marks Action Tracker items done by the short ids /todos last showed: /done td1,td2 or /done td1 td2. Each one is confirmed by title. Same as /todo move td1,td2 done. No model call and no approval: you typing it is the authorization.' },
+  { id: 'todos', kind: 'command', group: 'Awareness', usage: '/todos', desc: 'your Action Tracker by column, numbered td1 do1 dn1 for /todo move', needs: ['todoList'], status: 'active',
+    detail: 'Read-only. Lists your whole Action Tracker (every page) by column: To do td1.., Doing do1.., Done dn1.. (the 10 newest; the rest via quox actions list --status done), newest first. Use the numbers with /todo move do2 done. /todo <text> adds one.' },
   { id: 'rules', kind: 'command', group: 'Skills', usage: '/rules [files|off|on|N]', desc: 'which rules win: advisory QUOX.md, the dev pack, enforced server policy', status: 'active',
     detail: '/rules shows the precedence: QUOX.md and the dev pack only guide; armed governance policies on the server are enforced and win. /rules files shows the QUOX.md text. QUOX.md in this directory and parents up to the git root, plus ~/.quox/QUOX.md, are sent with each turn as your rules. World-writable files and symlinks leaving your home or repo are ignored. /rules N shows page N.' },
   // Conversation
   { id: 'clear', kind: 'command', group: 'Conversation', usage: '/clear', desc: 'fresh conversation and a clear screen; rules and memory kept, /resume goes back', status: 'active', aliases: ['new', 'reset'],
     detail: 'Clears the screen and starts a new conversation. Your QUOX.md rules, attached agent, model choice and Quox memory stay as they are. The previous conversation is kept on the server: /resume lists it.' },
+  { id: 'stop', kind: 'command', group: 'Conversation', usage: '/stop', desc: 'stop the current turn, same as Esc', status: 'active', aliases: ['cancel'],
+    detail: 'Stops the turn that is running, exactly like Esc: the stream is cancelled, the working animation ends and the status line goes back to normal. /cancel does the same. With nothing running it says so.' },
   { id: 'resume', kind: 'command', group: 'Conversation', usage: '/resume [id|name]', desc: 'pick a recent conversation and carry on where it left off', status: 'active', needs: ['conversations', 'conversationTurns'],
     detail: 'Alone: a picker of your recent conversations (title, agent, age); Up/Down and Enter resume, Esc cancels. With an id (or the start of one) or a /rename name it resumes directly. The last turns are shown as history and your next message continues that conversation. Also at launch: quox --resume [id|name] or quox --conversation <id>.' },
   { id: 'compact', kind: 'command', group: 'Conversation', usage: '/compact [show]', desc: 'summarise the conversation on the server, keeping decisions', status: 'active', needs: ['compactConversation'],
@@ -149,15 +188,19 @@ export const REGISTRY = [
       'suggested too (providers, live model ids, orgs, agents, slots, options): Up and Down' +
       ' choose, Tab completes, Esc closes, and keep typing to narrow. Suggestions that ' +
       'cannot be fetched are simply left out.' },
-  { id: 'note', kind: 'command', group: 'Conversation', usage: '/note <text>', desc: 'jot an observation for the dev observer (also: // text); not sent to Quox', status: 'active', dev: true,
-    detail: 'Records your text in the dev transcript only: not sent to the model or the server, no turn, not in chat history. Needs dev transcripts on (touch ~/.config/quox/dev-transcripts). Up to 2000 characters.' },
+  { id: 'note', kind: 'command', group: 'Conversation', usage: '/note <text>', desc: 'save a NotesQ note (first line is the title); not sent to Quox. /notes lists them', status: 'active',
+    detail: 'Creates a NotesQ note through the same backend as quox notes new: the first line (or first 60 characters) becomes the title and your text is the body. It confirms with the title and id. If NotesQ is not licensed or enabled for your org it says so and how to enable it. /notes lists recent notes (quox notes ls).' },
+  { id: 'notes', kind: 'command', group: 'Conversation', usage: '/notes', desc: 'list your recent NotesQ notes (same as quox notes ls)', status: 'active',
+    detail: 'Runs quox notes list in this window. /note <text> saves a new one.' },
+  { id: 'contact', kind: 'command', group: 'Conversation', usage: '/contact new <name> [--phone N] [--email E] [--relationship R]', desc: 'add a contact (same as quox contacts add); /contact list pages them', status: 'active',
+    detail: 'Builds a quox contacts add command from what you type: --mobile, --tel and --number become --phone, a multi-word name is quoted for you, and a flag the command does not have is refused with the list it does take. It goes through the same approval rules as the CLI.' },
   { id: 'bang', kind: 'key', group: 'Talk', usage: '!<command>', desc: 'run a shell command here without leaving (!quox <args> runs this quox as you); output stays on your screen', status: 'active',
     detail: 'A line starting with ! runs on this machine in the current directory via your shell and prints inline: "$ <command>", the output, then "exit N". It is never sent to Quox, starts no turn and needs no approval, because it is your own command. !quox <args> (or !q <args>) runs THIS quox binary with your current profile, so !quox inbox list works as you; bare quox and tui need the terminal and are refused. Ctrl+C stops it (SIGTERM, then SIGKILL after 2 s) without quitting; one command at a time; stdin is closed, so a command that waits for input gets end-of-file; 120 s limit (QUOX_BANG_TIMEOUT_MS); output is capped at 2000 lines / 256 KB. !! is reserved. Only the command line and exit code go in the dev transcript, never the output.' },
   { id: 'share', kind: 'command', group: 'Talk', usage: '/share [N]', desc: 'attach the output of your last ! command (or the Nth-last) to your next message', status: 'active',
     detail: 'Command output is not shared with Quox by default, because it can contain secrets. /share attaches the latest ! result to your next message (up to 16 KB, and it says when it was cut); /share 2 picks the one before. A line "shared with Quox: output of `<command>`" appears when it is sent.' },
   { id: 'copy', kind: 'command', group: 'Conversation', usage: '/copy [N|code]', desc: 'copy the last answer (raw markdown) to the clipboard; N = Nth-last, code = last code block', status: 'active',
     detail: 'Uses the OSC 52 terminal escape (works over SSH in most terminals; wrapped for tmux). Needs a terminal that allows OSC 52. Mouse selection is untouched: select and copy with your terminal as usual.' },
-  { id: 'dragon', kind: 'command', group: 'Conversation', usage: '/dragon [explain|ask [question]|sleep|fly|hero|fire|classic]', desc: 'the Q comes alive; /dragon explain gives the simplest possible explanation of the last output, /dragon ask [question] answers one question just as simply, /dragon sleep is a katakana screensaver (any key wakes)', status: 'active', args: ARGS.dragon,
+  { id: 'dragon', kind: 'command', group: 'Conversation', usage: '/dragon [explain|ask [question]|sleep|fly|hero|fire|classic|companion on|greeting|off|status]', desc: 'the Q comes alive; /dragon explain gives the simplest possible explanation of the last output, /dragon ask [question] answers one question just as simply, /dragon sleep is a katakana screensaver (any key wakes)', status: 'active', args: ARGS.dragon,
     detail: 'Plain /dragon plays the dragon (googly eyes, a talking smile, tail sway and whip, then fire from its mouth); classic and hero are the same show, /dragon fire is the breath alone. explain and ask are ordinary turns on whichever AI you have selected (tools and approvals still apply); the answer stays in the conversation as "Dragon explains" or "Dragon answers". With no AI connected you get the usual connect card. /dragon ask with no question waits for your next line. /dragon sleep hides the screen under katakana with the dragon asleep; any key wakes it and is not typed, an approval wakes it, Ctrl+C quits. It only changes what is drawn, never the conversation. Quiet motion or NO_COLOR shows a still screen.' },
   { id: 'dragon-fly', kind: 'command', group: 'Conversation', usage: '/dragon-fly', desc: 'the dragon flies across the screen, wings beating (same as /dragon fly)', status: 'active',
     detail: 'One 9 second pass of the dragon in flight, wings beating; Esc stops it early. It only changes what is drawn, never the conversation. Quiet motion or NO_COLOR shows a single still frame instead.' },
@@ -187,6 +230,10 @@ export const REGISTRY = [
     detail: '/feedback <text> shows exactly what will be sent (type feedback, your text, and the quox CLI version; no name, email, org or token) to https://api.quox.ai/api/feedback, the Quox team rather than your own Quox server, and asks y/N. y sends it; anything else leaves it unsent. The Quox site takes 5 a hour per address. /gripe is different: it files a GitHub issue through your org.' },
   { id: 'gripe', kind: 'command', group: 'Conversation', usage: '/gripe <text>', desc: 'file a GitHub issue through the GRIPE agent; shows it first, /gripe! files at once', needs: ['gripe'], status: 'active', aliases: ['gripe!'],
     detail: 'The same governed path as `quox gripe`: the GRIPE agent files the issue through your org\'s GitHub connector (default repo quoxai/quox). /gripe <text> shows what would be filed and asks; /gripe! (alone, within 2 minutes) files it, or /gripe! <text> files straight away. The issue link is shown when one comes back; with no link it says so and treats it as not filed.' },
+  { id: 'gripes', kind: 'command', group: 'Conversation', usage: '/gripes', desc: 'gripes waiting to be filed and recently filed, with issue links', status: 'active',
+    detail: 'When Quox does not answer (timeout, network, server error) /gripe! saves the gripe on this machine, in ~/.quox/gripe-queue.json, and files it when Quox answers again: on start, then at most every 2 minutes, giving up after 24 hours with a visible line. Each gripe carries a key so a filing that actually succeeded before the timeout is never filed twice. /gripes lists what is waiting and what was filed, with the issue links.' },
+  { id: 'outbox', kind: 'command', group: 'Conversation', usage: '/outbox [drop N|send]', desc: 'messages saved while QuoxCORE did not answer; sent when it does', needs: ['slotSay'], status: 'active',
+    detail: 'When a /say or @slot message cannot be sent because QuoxCORE is not answering (connection failed, refused, timeout, server error), it is kept on this machine in ~/.quox/slot-outbox.json (mode 0600, up to 50) and sent in order when QuoxCORE answers again, with a line per message. A refusal (permission, no such slot) is never queued: the error shows and your text is back in the prompt. /outbox lists them, /outbox drop N removes one, /outbox send retries now. A message whose window closed mid-send is marked as possibly delivered and is only retried by /outbox send, so nothing is sent twice by surprise.' },
   { id: 'sessions', kind: 'command', group: 'Conversation', usage: '/sessions [all|refs]', desc: 'everything live in your org by name and where it runs; refs adds ids, all adds every chat', needs: ['sessionsIndex'], status: 'active',
     detail: 'Each row leads with the session name and where it runs (host, or "host unknown" when the server does not know), then how long it has been up and when it was last active. Sections: terminal sessions, slots, work (objectives, loops, workflows) and chats. /sessions refs adds ids and attach commands under each row; /sessions all includes every chat from the last 24 h. The same data as `quox sessions`. Names set with /rename are kept on this machine (~/.config/quox/sessions.json).' },
   { id: 'active', kind: 'command', new: true, group: 'Conversation', usage: '/active [sessions|slots|agents]', desc: 'who is doing what: one line per active worker, grouped working / waiting on you / idle (same as `quox active`)', needs: ['sessionsIndex'], status: 'active',
@@ -203,8 +250,8 @@ export const REGISTRY = [
     detail: 'Subscribes this window to the slot\'s live stream; the last ~10 messages show first. Holding (/slot) stays separate and exclusive. Post with #<slot> <text> or /say; #<slot> alone makes it the default target (a bare # undoes it). /<slot> join, /<slot> leave and /join #<slot> work too. Your lines are signed with this session\'s name and person, never as a human profile.' },
   { id: 'leave', kind: 'command', group: 'Conversation', usage: '/leave <slot>', desc: 'leave a slot room you joined (does not release a hold)', needs: ['slotSay'], cap: 'slots', status: 'active', args: ARGS.say },
   { id: 'rooms', kind: 'command', new: true, group: 'Conversation', usage: '/rooms', desc: 'rooms (groups) this window has joined, with unread counts; also on the status line', needs: ['slotSay'], cap: 'slots', status: 'active', aliases: ['groups'] },
-  { id: 'broadcast', kind: 'command', new: true, group: 'Conversation', usage: '/broadcast [--slots a,b] [--priority urgent] [--ack] <text>', desc: 'tell every held slot in this org at once, signed as you', needs: ['slotBroadcast'], cap: 'slots', status: 'active', aliases: ['roar'], args: ARGS.broadcast,
-    detail: 'One server call delivers to every slot held in this org (never another org), or only --slots a,b. --priority urgent marks it red for recipients. --ack asks them to reply /ack <id>; you then see "Broadcast delivery: delivered N / acknowledged M / awaiting K" update. You get a framed card: how many sessions have it (stored in the slot, listening sessions see it at once) and a separate chat-rooms count (sent / sending / failed). /broadcast status <id> redraws it. Typing it is your consent. Not yet: --at (schedule), --fleet, --org, --voice.' },
+  { id: 'broadcast', kind: 'command', new: true, group: 'Conversation', usage: '/broadcast [--slots a,b] [--priority urgent] [--ack] [--active [--dry-run]] <text>', desc: 'tell every held slot in this org at once, signed as you', needs: ['slotBroadcast'], cap: 'slots', status: 'active', aliases: ['roar', 'broadcast-active'], args: ARGS.broadcast,
+    detail: 'One server call delivers to every slot held in this org (never another org), or only --slots a,b. --priority urgent marks it red for recipients. --ack asks them to reply /ack <id>; you then see "Broadcast delivery: delivered N / acknowledged M / awaiting K" update. You get a framed card: how many sessions have it (stored in the slot, listening sessions see it at once) and a separate chat-rooms count (sent / sending / failed). /broadcast status <id> redraws it. Typing it is your consent. --active (or /broadcast-active) reaches only sessions listening right now (a live slot wait); dormant slots are skipped and not woken, and the card says how many. --dry-run (with --active) lists who would be reached and who is skipped, and sends nothing. Not yet: --at (schedule), --fleet, --org, --voice.' },
   { id: 'page', kind: 'command', new: true, group: 'Conversation', usage: '/page <slot> <text>', desc: 'urgent message to one slot, acknowledgement requested', needs: ['slotBroadcast'], cap: 'slots', status: 'active', args: ARGS.say,
     detail: 'Like /broadcast to a single slot with --priority urgent --ack: it shows red there, asks them to /ack, and you see when they have.' },
   { id: 'ack', kind: 'command', new: true, group: 'Conversation', usage: '/ack <broadcast id>', desc: 'acknowledge a broadcast, as the slot this window holds', needs: ['slotAck'], cap: 'slots', status: 'active',
@@ -234,6 +281,8 @@ export const REGISTRY = [
     detail: 'off (default) keeps the screen to your conversation, the tool result lines and ONE AOCL footer per turn (layers, tool count, time). on shows the compact AEE / VOLT / AOCL / WARD protocol lines as they happen. full adds the thinking stream. Saved to your profile. The full list of tools offered to the model for the last turn is in /aocl.' },
   { id: 'proof', kind: 'command', group: 'Verbose', usage: '/proof [envelope]', desc: 'the evidence chain for the last tool call: AEE, AOCL, tool, WARD', server: true, cap: 'receipts', status: 'active',
     detail: 'Each link is read back from the server and drawn confirmed only when the read says so. WARD is the server-verified inclusion receipt; it can be slow on a large chain and is bounded, so a link may stay open.' },
+  { id: 'evidence', kind: 'command', new: true, group: 'Verbose', usage: '/evidence', desc: 'signed evidence bundle for this conversation', server: true, cap: 'receipts', status: 'active', aliases: ['envelope', 'envelopes', 'aee', 'volt', 'ward'],
+    detail: 'The same export as `quox evidence bundle`: a zip with envelopes.json/csv, ward-receipts.json, volt.json, a manifest of file hashes and an Ed25519 signature, scoped to your org and this conversation. It prints the path, the envelope count, the receipt count and the command to check it offline (`quox evidence verify <file>`). /ward does the same and lists the WARD receipts; /envelope, /envelopes and /aee show the envelope ids (same as /proof); /volt points at the VOLT run inside the bundle.' },
   { id: 'prove', kind: 'command', new: true, group: 'Verbose', usage: '/prove', desc: 'independently check that the last turn\'s tool calls really did what they said: receipt chain plus a read-back of the effect', server: true, cap: 'receipts', status: 'active',
     detail: 'For each tool call of the last turn: the receipt chain is re-read from the server (as in /proof), and where the tool is a write we know how to read back (today: slot_create, memory_save) the effect is read from the system of record. ✔ proven = the chain agrees and the effect is there (or it was a read and the chain agrees). ⚠ unproven = it cannot be shown from here (no read mapping for that write, a read failed, no receipt). ✖ contradicts = the call failed, the server recorded a failure, or the effect is not there. Nothing is assumed: an unmapped write is never called proven. /proof is unchanged and shows one call\'s chain.' },
   { id: 'replay', kind: 'command', new: true, group: 'Verbose', usage: '/replay [run or conversation id] [page]', desc: 'rebuild an earlier run from the audit trail: decisions, tools with args, outputs and receipts, in order, paged', server: true, cap: 'receipts', status: 'active', args: ARGS.replay,
@@ -244,6 +293,8 @@ export const REGISTRY = [
   // Awareness
   { id: 'roster', kind: 'command', group: 'Awareness', usage: '/roster [all]', desc: 'show or hide the live roster under the status line; all includes background work', needs: ['roster'], status: 'active',
     detail: 'The roster lists what needs you: pending approvals, then work you started (objectives, loops, manual workflows). Scheduled and event-driven workflows are hidden; background failures show once per workflow in the bar below. /roster all shows everything. Refreshed every 15 s from the server. Down on an empty composer focuses it; Enter peeks, s asks to stop (y confirms), Esc returns. A source the server cannot answer shows nothing and is named here.' },
+  { id: 'loop', kind: 'command', group: 'Awareness', usage: '/loop [list|watch <id>|peek <id>|focus]', desc: 'follow a loop live in a card that updates in place', server: true, status: 'active',
+    detail: 'A loop you start from chat gets a live card: the turn strip (✔ ok, ⚠ waiting or denied, ✖ error, ◐ running), the receipts counter, host and scope, and the last lines of what it is writing. Milestones and errors land as normal chat lines beneath it, and a finished loop prints one line with the proof command. /loop list shows loops, /loop watch <id> follows one that is already running (and gives it the keys), /loop peek <id> prints one snapshot, /loop focus gives the keys back. Keys: Enter expands the output, s asks to halt (y confirms, never immediate), Esc collapses and leaves. Under 60 columns the card is one line. Needs a server with the loop event routes; one without them says so.' },
   { id: 'workflow', kind: 'command', group: 'Skills', usage: '/workflow <name|id|run>', desc: 'the step flow of a workflow\'s latest run (or one run): state, timings, human gates', server: true, cap: 'workflows', status: 'active',
     detail: 'Steps come from the workflow definition and each state and duration from that run\'s recorded envelopes. A reached human gate shows amber. Enter on a workflow row in the roster shows the same flow.' },
   { id: 'crystal', kind: 'command', group: 'Skills', usage: '/crystal <workflow>', desc: 'is this workflow eligible to become a Crystal? checked against the real gate', server: true, cap: 'crystals', status: 'active',
@@ -287,12 +338,15 @@ export const REGISTRY = [
   { id: 'poke', kind: 'command', new: true, group: 'Conversation', usage: '/poke <slot or session> [text]', desc: 'wake a session: an urgent page asking it to acknowledge (also /wake, /nudge, /ping)', needs: ['slotBroadcast'], cap: 'slots', status: 'active', aliases: ['wake', 'nudge', 'ping', 'slap', 'awaken'] },
   { id: 'afk', kind: 'command', new: true, group: 'Context', usage: '/afk [note]', desc: 'tell sessions you are away (they stop waiting on approvals, which still queue); /back then shows everything since, grouped', status: 'active',
     detail: 'Sets your presence on the server (per user and org): sessions saying into hitl, triage-q or this window\'s slot see "owner away since 15:54 UTC (note): approvals will queue"; `quox presence`, `quox slot list`, quox ask and agents see it too. Nothing is approved while you are away. /back or any typed message marks you present.' },
+  { id: 'donotdisturb', kind: 'command', new: true, group: 'Context', usage: '/donotdisturb [on|off] [until HH:MM]', desc: 'sleep means sleep: collect arrivals quietly (no notices, cards, bells) until you ask for /morningreport; also /dnd', status: 'active', aliases: ['dnd'],
+    detail: 'On sets your presence to sleeping with the note "do not disturb" (sessions see it) and the window only counts what arrives: "🌙 do not disturb · N waiting · /morningreport". Bare /dnd toggles. /afk and /sleep imply it. Saying you are going to sleep (chat or /broadcast) offers it, y/N. A restarted window restores it from the server. /back or /dnd off ends it.' },
+  { id: 'morningreport', kind: 'command', new: true, group: 'Context', usage: '/morningreport', desc: 'everything collected while do not disturb was on: incidents first, approvals, inbox (xN), slot messages, sessions that need you; then offers to turn it off', status: 'active' },
   { id: 'back', kind: 'command', new: true, group: 'Context', usage: '/back', desc: 'mark yourself present and show what happened since /afk (same as /away)', status: 'active' },
-  { id: 'observe', kind: 'command', new: true, group: 'Context', usage: '/observe <text>', desc: 'a note to the observer: posts your text to the session that watches your window', status: 'active', dev: true },
-  { id: 'huh', kind: 'command', new: true, group: 'Conversation', usage: '/huh [question]', desc: 'the dragon explains what just happened (same as /dragon explain)', status: 'active' },
-  { id: 'sleep', kind: 'command', new: true, group: 'Conversation', usage: '/sleep', desc: 'mark yourself sleeping (sessions stop waiting on approvals, which still queue) and the dragon curls up (/dragon sleep)', status: 'active' },
+  { id: 'huh', kind: 'command', new: true, group: 'Conversation', usage: '/huh [question]', desc: 'explain the last output in plain words, using one turn on your model (same as /dragon explain)', status: 'active' },
+  { id: 'sleep', kind: 'command', new: true, group: 'Conversation', usage: '/sleep', desc: 'tell other sessions you are away sleeping so they stop waiting on your approvals (they still queue), then the dragon curls up (same as /dragon sleep)', status: 'active' },
   { id: 'mode', kind: 'command', new: true, group: 'Context', usage: '/mode [ask|plan]', desc: 'this window\'s mode: ask first (default) or plan only', status: 'active', args: ARGS.mode,
     detail: 'Alone it shows the current mode and the options. /mode plan: Quox investigates with read tools and proposes the steps and the exact commands, and runs nothing that changes state; the server enforces it, and the answer ends with "Run this plan now? y/N/c" (y switches back to ask and sends the go-ahead). /mode ask goes back. For this window only: kept across /restart, never saved to your profile. Auto mode is not available yet: it needs standing grants (planned).' },
+  { id: 'devservers', kind: 'command', new: true, group: 'Connect', usage: '/devservers [name]', desc: 'your registered dev servers; /devservers <name> shows its go command', status: 'active' },
   { id: 'slots', kind: 'command', new: true, group: 'Conversation', usage: '/slots [all]', desc: 'held slots: who holds them and where; free ones are summarised, /slots all lists them (same as /slot list)', needs: ['slots'], cap: 'slots', status: 'active' },
   { id: 'mirror', kind: 'command', new: true, group: 'Context', usage: '/mirror [agents]', desc: 'the Mirror: what CommanderQ sees about this org right now', needs: ['mirror'], status: 'active',
     detail: 'Read-only, no model call. The org-scoped Mirror the server builds from each service and injects into CommanderQ on every turn: identity, health, implants, capabilities, plugins, memory, codebase, and every value it could not read with the reason. /mirror agents lists the agents. For the QuoxMind implants alone use /mind.' },
@@ -333,6 +387,10 @@ export const REGISTRY = [
       'prompt profile: compact is a short system prompt for small or local models (the ' +
       'default on Ollama, LM Studio and vLLM), full is the default elsewhere; --prompt-' +
       'profile does the same for one --print run.' },
+  { id: 'deck', ext: 'quoxdeck', kind: 'command', group: 'Context', usage: '/deck on|off|status', desc: 'QuoxDeck: an optional MIDI pad surface; pads open an approval or preselect an answer, you confirm here', status: 'active',
+    detail: 'Provided by the optional quoxdeck extension, not by core: npm i -g quoxdeck, then quox ext add quoxdeck (until then /deck says so). quoxon pushes approvals, health and loops to the deck at most once a second. A pad only opens an approval view or fills the composer with the answer; it never answers for you, and high risk still needs the step-up PIN. The setting is saved, so the deck comes back on at the next start.' },
+  { id: 'ext', kind: 'command', group: 'Context', usage: '/ext list|on|off|tab|set|settings <name>', desc: 'optional extensions (npm packages) that add surfaces to this window', status: 'active', args: ARGS.ext,
+    detail: 'Extensions load only when installed (npm i -g <pkg>) and listed (quox ext add <pkg>). /ext list shows each one and where it was found, on|off switches one for the next start and now. An extension can open an approval or preselect an answer; it cannot answer for you. /ext tab <name> (or Ctrl+]) focuses an extension panel and Esc returns to the composer; /ext set <name> <key> <value> and /ext settings <name> change and show its settings. Contract: cli/lib/quoxon/EXTENSIONS.md.' },
   { id: 'row', kind: 'command', group: 'Context', usage: '/row [new|add|list|edit <id>|rm <id>|test <id>|reload|on|off]', desc: 'your own live lines above the status bar: stats from a URL, your Quox, a plugin or a command', status: 'active', args: ARGS.row,
     detail:
       '/row new walks you through one row with y/N cards and shows what it will say before saving; /row edit <id> changes one. ' +
@@ -350,12 +408,36 @@ export const REGISTRY = [
     detail: 'Type @ at the start of a word: a list under the composer suggests agents, fleet hosts, tasks (your newest objectives) and receipts (the envelope ids of this session\'s tool calls), filtered as you type by id or name. Tab or Enter puts it in, Esc closes the list. The lists are fetched once per session on your first @ and then filtered locally, so typing never sends a request; receipts come from this session and need no request at all. /peek <id> shows what an id is.' }
 ];
 
+// Splice dev entries back next to their neighbours (after /notes and /back); absent in the public build.
+for (const e of DEV_ENTRIES) {
+  const after = e.id === 'devnote' ? 'notes' : 'back';
+  const i = REGISTRY.findIndex((x) => x.id === after);
+  REGISTRY.splice(i < 0 ? REGISTRY.length : i + 1, 0, e);
+}
+// Vendor (owner tooling) entries go just before /row; absent in the public build.
+for (const e of VENDOR_ENTRIES) {
+  const i = REGISTRY.findIndex((x) => x.id === 'row');
+  REGISTRY.splice(i < 0 ? REGISTRY.length : i, 0, e);
+}
+
 // The palette row's one-line wording (commandShort.js); /help keeps the long desc.
 for (const e of REGISTRY) if (e.kind === 'command' && !e.short && SHORT[e.id]) e.short = SHORT[e.id];
 
+/** Commands of loaded extensions join the registry (help, palette, Tab) while loaded: [{ name, help, ext, subcommands }]. Static ids win. */
+export function setExtEntries(cmds) {
+  for (let i = REGISTRY.length - 1; i >= 0; i--) if (REGISTRY[i].dyn) REGISTRY.splice(i, 1);
+  for (const c of cmds || []) {
+    const id = String(c.name || '').replace(/^\//, '');
+    if (!id || REGISTRY.some((e) => e.id === id)) continue;
+    const subs = c.subcommands || [];
+    REGISTRY.push({ id, dyn: true, ext: c.ext, kind: 'command', group: 'Context', usage: subs.length ? `/${id} ${subs.map((s) => s.name).join('|')}` : `/${id}`, desc: c.help || `from the ${c.ext} extension`, status: 'active',
+      ...(subs.length ? { args: [{ after: [], choices: subs.map((s) => ({ value: s.name, desc: s.help || '' })) }] } : {}) });
+  }
+}
+
 const norm = (s) => String(s || '').trim().toLowerCase().replace(/^\//, '');
 
-/** Dev-only entries (/observe, /note) are invisible unless a dev observer is configured. */
+/** Dev-only entries (/observe, /devnote) are invisible unless a dev observer is configured. */
 export const entryVisible = (e) => !e.dev || devObserverOn();
 /** REGISTRY minus entries hidden on this install. */
 export const visibleRegistry = () => REGISTRY.filter(entryVisible);
@@ -397,6 +479,14 @@ const STATUS_LINE_HELP = [
   { kind: 'row', key: '── model ─', text: 'the divider under the composer names the provider and model (/model)' }
 ];
 
+/** QUOXON-DELIGHT: the short "Try these" block at the end of /help (the full verified set is the collector's tryThese.json). */
+export const TRY_THESE = [
+  { id: 'challenge', usage: '/challenge', hook: 'a different AI provider argues with the answer you just got' },
+  { id: 'spawn', usage: '/spawn 2c 4G 20G 1h for X', hook: 'a disposable VM in seconds, gone when the timer ends' },
+  { id: 'crystallize', usage: '/crystallize', hook: 'turn what you just did into a reusable skill' },
+  { id: 'roar', usage: '/roar <text>', hook: 'shout to every session you hold at once' }
+];
+
 /** registry: the entries to list (default: this install's visible registry; tests pass a fixture). */
 export function helpModel(topic, caps = {}, registry = visibleRegistry()) {
   if (topic) {
@@ -425,6 +515,11 @@ export function helpModel(topic, caps = {}, registry = visibleRegistry()) {
     out.push({ kind: 'gap' }, { kind: 'head', text: 'Coming', dim: true });
     for (const e of planned) out.push({ kind: 'dim', key: e.usage, text: e.desc });
   }
+  const tries = TRY_THESE.filter(t => registry.some(e => e.status === 'active' && (e.id === t.id || (e.aliases || []).includes(t.id))));
+  if (tries.length) {
+    out.push({ kind: 'gap' }, { kind: 'subhead', text: 'Try these' });
+    for (const t of tries) out.push({ kind: 'row', key: t.usage, text: t.hook });
+  }
   out.push({ kind: 'gap' }, { kind: 'dim', text: '/help <command> for detail, e.g. /help esc' });
   return out;
 }
@@ -435,7 +530,7 @@ export function suggestCommands(input, max = 3) {
   if (!q) return [];
   const names = [...new Set(commandNames())];
   const lev = (a, b) => { const dp = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]); for (let j = 1; j <= b.length; j++) dp[0][j] = j; for (let i = 1; i <= a.length; i++) for (let j = 1; j <= b.length; j++) dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)); return dp[a.length][b.length]; };
-  return names.map(n => { const k = n.slice(1); const rel = q.startsWith(k) || k.startsWith(q) || (k.length >= 2 && q.includes(k)) || (q.length >= 2 && k.includes(q)); const head = q.length >= 3 && k.length > q.length ? lev(q, k.slice(0, q.length)) + 0.5 : Infinity; return { n, d: rel ? 0 : Math.min(lev(q, k), head), len: Math.abs(k.length - q.length) }; })
+  return names.map(n => { const k = n.slice(1); const sep = k.length >= 2 && q.length > k.length && q.startsWith(k) && /[-_ :]/.test(q[k.length]); const rel = sep || k.startsWith(q) || (k.length >= 2 && q.includes(k) && q.length - k.length <= 2) || (q.length >= 2 && k.includes(q)); const head = q.length >= 3 && k.length > q.length ? lev(q, k.slice(0, q.length)) + 0.5 : Infinity; return { n, d: sep ? -1 : rel ? 0 : Math.min(lev(q, k), head), len: Math.abs(k.length - q.length) }; })
     .filter(x => x.d <= Math.max(2, Math.floor(q.length / 3)))
     .sort((a, b) => a.d - b.d || a.len - b.len || a.n.localeCompare(b.n)).slice(0, max).map(x => x.n);
 }
@@ -467,7 +562,7 @@ export function nearestCommands(input, max = 3) {
 }
 
 // Commands whose last argument is free text: a pasted line that the terminal wrapped is still one command.
-const FREE_TEXT_CMDS = new Set(['ask', 'aside', 'afk', 'observe', 'roar', 'awaken', 'poke', 'wake', 'nudge', 'ping', 'slap', 'feedback', 'huh', 'r', 'reply', 'say', 'page', 'broadcast', 'gripe', 'gripe!', 'note', 'dragon', 'deny', 'wish', 'challenge']);
+const FREE_TEXT_CMDS = new Set(['ask', 'aside', 'afk', 'observe', 'roar', 'awaken', 'poke', 'wake', 'nudge', 'ping', 'slap', 'feedback', 'huh', 'r', 'reply', 'say', 'page', 'broadcast', 'gripe', 'gripe!', 'note', 'devnote', 'dragon', 'deny', 'wish', 'challenge']);
 /** "/say a long\n text" -> { text: '/say a long text', lines: 2 }; null when it is not a wrapped free-text command. */
 export function joinWrappedSlash(text) {
   const t = String(text || '');

package/lib/quoxon/connect.js

@@ -125,7 +125,7 @@ export const pickRow = (rows, type) => {
  * `caps` is the server's capabilities answer, the source of truth for whether each provider is usable
  * (providers.js, shared with /model and /doctor). Anything neither can answer is "? unknown".
  */
-export function connectionLines(res, caps = null) {
+export function connectionLines(res, caps = null, { includeOthers = true } = {}) {
   const STATUS_PROVIDERS = [PROVIDERS.openai, PROVIDERS.anthropic, PROVIDERS.ollama, PROVIDERS.openrouter, PROVIDERS.huggingface, PROVIDERS.groq, PROVIDERS.together, PROVIDERS.lmstudio, PROVIDERS.vllm, PROVIDERS.custom];
   const out = [];
   const ok = res && res.ok && Array.isArray(res.rows);
@@ -136,7 +136,7 @@ export function connectionLines(res, caps = null) {
     const st = providerState({ cap: p.id, vault: p.type }, caps, res);
     const def = st.row;
     if (st.state === 'unknown') out.push([`? ${p.name}  unknown (vault not readable)`, 'warn']);
-    else if (st.state === 'connected' && def) out.push([`● ${p.name}  connected · ${def.label || def.id} · ${testTag(def)}`, def.test_status === 'failed' ? 'warn' : 'ok']);
+    else if (st.state === 'connected' && def) out.push([`● ${p.name}  connected · ${def.label || def.id} · ${testTag(def)}${def.test_status === 'failed' ? ` · re-test: quox provider test ${p.id}` : ''}`, def.test_status === 'failed' ? 'warn' : 'ok']);
     else if (st.state === 'connected') out.push([`● ${p.name}  ready on this server (an instance-wide key, not in your org vault)`, 'ok']);
     else if (st.state === 'stored') out.push([`◐ ${p.name}  stored but not the default · quox vault set-default ${st.row.id}`, 'warn']);
     else if (st.state === 'unavailable') out.push([`○ ${p.name}  not available here${st.reason ? `: ${st.reason}` : ''}`]);
@@ -155,7 +155,9 @@ export function connectionLines(res, caps = null) {
     if (!cur || (r.is_default && !cur.is_default)) others.set(r.integration_type, r);
   }
   const list = [...others.values()];
-  if (list.length) {
+  if (!includeOthers) {
+    if (list.length) out.push([`  ${list.length} other integration${list.length === 1 ? '' : 's'} in your vault: quox provider list --all`]);
+  } else if (list.length) {
     out.push(['Integrations in your vault:']);
     for (const r of list.slice(0, 12)) out.push([`● ${r.integration_type}  ${r.label || r.id} · ${testTag(r)}`, r.test_status === 'failed' ? 'warn' : undefined]);
     if (list.length > 12) out.push([`  +${list.length - 12} more · quox vault list`]);

package/lib/quoxon/countdownLine.js

@@ -1,6 +1,15 @@
 /** The restart countdown line, fitted to the width: full text when it fits, shorter forms below, never wrapped. */
-export function countdownLine(secs, cols) {
+export function countdownLine(secs, cols, { waiting = false } = {}) {
   const room = Math.max(20, (cols || 80) - 4); // paddingLeft 2 plus a margin
+  if (waiting) { // the countdown is over but the Quox server is down (a land is redeploying it): hold the restart until it answers
+    const w = [
+      '↻ New version ready, waiting for Quox server to come back before restarting · Esc to stay · Enter to restart now',
+      '↻ Waiting for Quox server to come back before restarting · Esc stay · Enter now',
+      '↻ Waiting for Quox server before restarting · Esc stay',
+      '↻ Waiting for Quox server · Esc stay',
+    ];
+    return w.find(f => f.length <= room) || w[w.length - 1];
+  }
   const forms = [
     `↻ New version ready. Restarting in ${secs}s · Esc to stay on this version · Enter to restart now`,
     `↻ New version · restarting in ${secs}s · Esc stay · Enter now`,

package/lib/quoxon/deck.js

@@ -0,0 +1,30 @@
+/**
+ * QuoxDeck compatibility shim. The deck is no longer part of core: it is an installable extension ("quoxdeck") run by the
+ * generic host in extensions.js (see EXTENSIONS.md). This file only keeps the old deck-shaped surface (on/off/status, the
+ * QUOXDECK_MODULE override, the "not installed" text) as a thin wrapper over that host. New code should use extensions.js.
+ */
+import { createExtensionHost, buildSnapshot, pickDraft, notInstalled, THROTTLE_MS } from './extensions.js';
+
+export const DECK_PACKAGE = 'quoxdeck';
+export const DECK_NOT_INSTALLED = notInstalled(DECK_PACKAGE);
+export const DECK_THROTTLE_MS = THROTTLE_MS;
+export const buildDeckState = buildSnapshot;
+export const deckPickDraft = pickDraft;
+
+export function createDeckHost({ env = process.env, ...rest } = {}) {
+  const legacy = env?.QUOXDECK_MODULE; // the old override still works, mapped to QUOX_EXT_QUOXDECK_MODULE
+  const h = createExtensionHost({ ...rest, env: legacy ? { ...env, QUOX_EXT_QUOXDECK_MODULE: legacy } : env });
+  return {
+    armed: h.armed,
+    emit: (msg) => h.emit(msg),
+    push: h.push,
+    async on() {
+      if (h.armed()) return { ok: true, text: 'QuoxDeck is already on.' };
+      const r = await h.load(DECK_PACKAGE);
+      if (r.ok) return { ok: true, text: 'QuoxDeck is on. Pads can open an approval or preselect an answer; you confirm in this window.' };
+      return { ok: false, text: r.notFound ? `QuoxDeck ${DECK_NOT_INSTALLED}` : `QuoxDeck ${r.text.replace(/^quoxdeck /, '')}`.replace('could not load: the package has no create().', 'could not load: the package has no createDeck.') };
+    },
+    off() { const was = h.armed(); h.unloadAll(); return was ? { ok: true, text: 'QuoxDeck is off.' } : { ok: true, text: 'QuoxDeck was not on.' }; },
+    status: () => (h.armed() ? 'QuoxDeck: on (armed).' : 'QuoxDeck: off. /deck on arms it.')
+  };
+}