quoxcli 0.3.1 → 0.5.0

package/lib/quoxon/slash/agents.js

@@ -101,11 +101,12 @@ export const LOOSE_SAFE = new Set(['help', 'status', 'context', 'cost', 'agents'
 export function looseCommand(cmd, restArg) {
   const words = String(restArg || '').trim().split(/\s+/).filter(Boolean);
   for (let i = 0; i < words.length; i++) {
+    if (words[i].replace(/^\//, '').length < 2 && !words[i].startsWith('/')) continue; // a bare "r" in prose is not the /r alias
     const e = findEntry(words[i].replace(/^\//, ''));
     if (!e || e.kind !== 'command' || e.status !== 'active') continue;
     const rest = words.slice(i + 1).join(' ');
     if (LOOSE_SAFE.has(e.id)) return { run: `/${e.id}${rest ? ` ${rest}` : ''}`, name: `/${e.id}` };
-    return { suggest: `/${e.id}${rest ? ` ${rest}` : ''}` };
+    return { suggest: `/${e.id}` }; // a command NAME only, never the user's message text
   }
   if (words.length && !suggestCommands(cmd).length) return { ask: `${String(cmd).replace(/^\//, '')} ${words.join(' ')}` };
   return null;

package/lib/quoxon/slash/argSources.js

@@ -6,6 +6,7 @@
 import { CHOICES, connectedChoices, providerId } from '../model.js';
 import { liveModels } from '../modelPrefs.js';
 import { pathItems } from '../slotChat.js';
+import { fromOf, activeMutes } from '../inboxView.js';
 
 /** Provider ids /connect understands (one per provider; the subscription has no key). */
 export const connectIds = () => [
@@ -14,7 +15,7 @@ export const connectIds = () => [
   ).values(),
 ];
 
-export function createArgSources({ api, getPrefs = () => ({ favourites: [], default: null }), getRows = () => [] }) {
+export function createArgSources({ api, getPrefs = () => ({ favourites: [], default: null }), getRows = () => [], getExt = null, getInbox = null }) {
   return async function source(src, param) {
     switch (src) {
       case 'providers':
@@ -38,12 +39,18 @@ export function createArgSources({ api, getPrefs = () => ({ favourites: [], defa
           value: String(i + 1),
           desc: `${f.provider} ${f.model}`,
         }));
+      case 'ext.listed': return (getExt?.().listed?.() || []).map((v) => ({ value: v }));
+      case 'ext.loaded': return (getExt?.().loaded?.() || []).map((v) => ({ value: v }));
+      case 'ext.panels': return [...(getExt?.().panels?.() || []).map((p) => ({ value: p.name, desc: p.title })), { value: 'off', desc: 'collapse the panel region' }];
+      case 'ext.keys': return (getExt?.().keys?.(param) || []).map((d) => ({ value: d.key, desc: d.help }));
+      case 'inbox.sources': return [...new Set((getInbox?.().list?.() || []).map((i) => fromOf(i).toLowerCase()))].map((v) => ({ value: v }));
+      case 'inbox.mutes': return Object.keys(activeMutes(getInbox?.().mutes?.())).map((v) => ({ value: v }));
       case 'rows':
         return (getRows?.() || []).map((r) => ({ value: r.id, desc: r.source.type }));
       case 'orgs':
         return (await api.orgs()).map((o) => ({ value: o.slug || o.id, desc: o.name || '' }));
       case 'agents':
-        return (await api.agents()).map((a) => ({
+        return [...(await api.agents())].sort((x, y) => String(x.agent_id).localeCompare(String(y.agent_id))).map((a) => ({
           value: a.agent_id,
           desc: a.name && a.name !== a.agent_id ? a.name : '',
         }));

package/lib/quoxon/slash/args.js

@@ -41,7 +41,7 @@ const asItem = (x) =>
 /** Static choices of a level as items. */
 export const staticItems = (lv) => (lv?.choices || []).map(asItem);
 
-/** Prefix matches first, then substring; the exact sole match is dropped (nothing to add). */
+/** Prefix matches first, then substring, then display-name matches; the exact sole match is dropped (nothing to add). */
 export function rankArgs(items, partial) {
   const q = String(partial || '').toLowerCase();
   const seen = new Set();
@@ -51,7 +51,9 @@ export function rankArgs(items, partial) {
   const sub = uniq.filter(
     (i) => !i.value.toLowerCase().startsWith(q) && i.value.toLowerCase().includes(q),
   );
-  const out = [...pre, ...sub];
+  // A display name (desc) that matches also surfaces the item, after every id match: /attach vulcan finds forge.
+  const byDesc = uniq.filter((i) => !pre.includes(i) && !sub.includes(i) && String(i.desc || '').toLowerCase().includes(q));
+  const out = [...pre, ...sub, ...byDesc];
   return out.length === 1 && out[0].value.toLowerCase() === q ? [] : out;
 }
 

package/lib/quoxon/slash/broadcast.js

@@ -3,7 +3,7 @@
  * No I/O. v1 scope: all held slots or --slots, --priority urgent, --ack, /page. Scheduling, voice,
  * fleet and org reach, bulletins and drafting are not built.
  */
-export const BROADCAST_USAGE = 'Usage: /broadcast [--slots a,b] [--priority urgent] [--ack] <text>';
+export const BROADCAST_USAGE = 'Usage: /broadcast [--slots a,b] [--priority urgent] [--ack] [--active [--dry-run]] <text>';
 export const PAGE_USAGE = 'Usage: /page <slot> <text>';
 const NOT_YET = new Set(['--fleet', '--org', '--voice', '--at']);
 
@@ -13,13 +13,15 @@ const NOT_YET = new Set(['--fleet', '--org', '--voice', '--at']);
  */
 export function parseBroadcastArgs(arg) {
   const toks = String(arg || '').trim().split(/\s+/).filter(Boolean);
-  let slots = null; let priority = 'normal'; let ack = false;
+  let slots = null; let priority = 'normal'; let ack = false; let active = false; let dryRun = false;
   let i = 0;
   for (; i < toks.length && toks[i].startsWith('--'); i += 1) {
     const [flag, inline] = toks[i].split(/=(.*)/s);
     if (NOT_YET.has(flag)) return { ok: false, message: `${flag} is not available yet (v1 sends to held slots in this org: --slots, --priority, --ack).` };
     if (flag === '--all') { slots = null; continue; }
     if (flag === '--ack') { ack = true; continue; }
+    if (flag === '--active') { active = true; continue; }
+    if (flag === '--dry-run') { dryRun = true; continue; }
     const val = inline !== undefined ? inline : toks[++i];
     if (flag === '--slots') {
       const list = String(val || '').split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
@@ -34,7 +36,12 @@ export function parseBroadcastArgs(arg) {
   }
   const text = toks.slice(i).join(' ');
   if (!text) return { ok: false, message: BROADCAST_USAGE };
-  return { ok: true, text, slots, priority, ack };
+  return { ok: true, text, slots, priority, ack, ...(active ? { active: true } : {}), ...(dryRun ? { dryRun: true } : {}) };
+}
+
+/** QuoxGlyph announce line for a broadcast to active sessions: { reached, skipped, dryRun }. */
+export function activeLine({ reached = 0, skipped = 0, dryRun = false } = {}) {
+  return `\u{1F4CD} QUOXSLOTS \u2502 broadcast to active \u2502 ${reached} ${dryRun ? 'would reach' : 'reached'} \u00B7 ${skipped} skipped dormant \u2714`;
 }
 
 /** `/page <slot> <text>` -> urgent, ack-required, one recipient. */
@@ -72,9 +79,10 @@ export function broadcastCard(r, { kind = 'broadcast' } = {}) {
   const c = r?.counts || {};
   const rc = roomC(r);
   const rows = [];
-  if (!c.total) rows.push([['\u26A0 no held slots in this org to hear it', 'warn']]);
+  if (!c.total) rows.push([[r?.skipped_dormant ? `\u26A0 no active sessions to hear it \u00B7 ${r.skipped_dormant.length} dormant skipped` : '\u26A0 no held slots in this org to hear it', 'warn']]);
   else if (c.delivered) {
-    rows.push([[`\u2714 ${c.delivered} ${c.delivered === 1 ? 'session has' : 'sessions have'} it`, 'ok']]);
+    const act = r?.skipped_dormant ? 'active ' : ''; // --active: say who was left alone
+    rows.push([[`\u2714 ${c.delivered} ${act}${c.delivered === 1 ? 'session has' : 'sessions have'} it${r?.skipped_dormant ? ` \u00B7 ${c.dormant_skipped ?? r.skipped_dormant.length} dormant skipped` : ''}`, 'ok']]);
     if (namesRow(r)) rows.push([[namesRow(r), 'prose']]); // an older server sends no per-slot list: no empty row
   }
   for (const d of badSlots(r).slice(0, 3)) rows.push([[`\u2716 ${failText(d)}`, 'error']]);
@@ -105,7 +113,12 @@ export function broadcastSummary(r) {
   const c = r?.counts || {};
   const rc = roomC(r);
   const lines = [];
+  if (!c.total && r.skipped_dormant) return [[`Broadcast ${r.id}: no active sessions to hear it \u00B7 ${r.skipped_dormant.length} dormant skipped${r.skipped_dormant.length ? ` (${r.skipped_dormant.join(', ')})` : ''}.`, 'warn']];
   if (!c.total) return [[`Broadcast ${r.id}: no held slots in this org to hear it.`, 'warn']];
+  if (r.skipped_dormant) { // --active: say who was left alone
+    const dn = r.skipped_dormant;
+    lines.push([`Broadcast ${r.id} ${titleWord(r)}: ${(c.delivered || 0) + (c.queued || 0)} active have it${okSlots(r).length ? ` (${okSlots(r).map((d) => d.slot).join(', ')})` : ''} \u00B7 ${dn.length} dormant skipped${dn.length ? ` (${dn.join(', ')})` : ''}`, c.failed ? 'warn' : 'plain']);
+  } else
   lines.push([`Broadcast ${r.id} ${titleWord(r)}: ${(c.delivered || 0) + (c.queued || 0)} of ${c.total} ${plural(c.total)} have it${okSlots(r).length ? ` (${okSlots(r).map((d) => d.slot).join(', ')})` : ''}`, c.failed ? 'warn' : 'plain']);
   if (c.delivered && roomText(rc, ', ')) lines.push([`  chat rooms: ${roomText(rc, ', ')}`, rc.failed ? 'warn' : 'plain']);
   for (const d of badSlots(r)) lines.push([`  ${failText(d)}`, 'warn']);

package/lib/quoxon/slash/broadcastRun.js

@@ -3,7 +3,7 @@
  * One server call fans out (POST /api/v1/slots/broadcast); with --ack the sender then sees the delivery line
  * update as recipients acknowledge. The poll is display only: the broadcast and its acks live on the server.
  */
-import { parseBroadcastArgs, parsePageArgs, parseAckArgs, parseStatusArgs, broadcastSummary, broadcastCard, BROADCAST_USAGE } from './broadcast.js';
+import { parseBroadcastArgs, parsePageArgs, parseAckArgs, parseStatusArgs, broadcastSummary, broadcastCard, BROADCAST_USAGE, activeLine } from './broadcast.js';
 
 const roomC = (r) => ({ sent: 0, sending: 0, failed: 0, ...(r?.counts?.room || {}) });
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -22,9 +22,20 @@ export async function runBroadcast({ api, kind, arg, from, say, card = null, isC
   }
   const parsed = kind === 'page' ? parsePageArgs(arg) : parseBroadcastArgs(arg);
   if (!parsed.ok) return say(parsed.message, parsed.message === BROADCAST_USAGE ? 'plain' : 'warn');
-  const r = await api.slotBroadcast({ text: parsed.text, slots: parsed.slots, priority: parsed.priority, ack: parsed.ack, from });
+  const r = await api.slotBroadcast({ text: parsed.text, slots: parsed.slots, priority: parsed.priority, ack: parsed.ack, active: parsed.active, ...(parsed.dryRun ? { dryRun: true } : {}), from });
   if (!r.ok) return say(`${kind === 'page' ? 'Page' : 'Broadcast'} failed: ${r.message}`, 'warn');
+  if (r.data?.dry_run) { // BROADCAST-ACTIVE --dry-run: who would hear it, who is dormant; nothing sent, no card
+    const would = r.data.would_reach || []; const dorm = r.data.skipped_dormant || [];
+    say(activeLine({ reached: would.length, skipped: dorm.length, dryRun: true }), 'ok');
+    if (would.length) say(`  would reach: ${would.join(', ')}`, 'plain');
+    if (dorm.length) say(`  skipped dormant: ${dorm.join(', ')}`, 'plain');
+    return say('Dry run: nothing was sent.', 'plain');
+  }
   show(r.data);
+  if (parsed.active && r.data?.skipped_dormant) {
+    say(activeLine({ reached: r.data.counts?.delivered || 0, skipped: r.data.skipped_dormant.length }), 'ok');
+    if (r.data.skipped_dormant.length) say(`  skipped dormant: ${r.data.skipped_dormant.join(', ')}`, 'plain');
+  }
   // PRESENCE: it reached a human slot whose human is away; approvals to them will queue.
   if (r.data?.human_presence?.away && r.data.human_presence.notice) say(`⏸ ${r.data.human_presence.notice}`, 'warn');
   // POKE-WAKE: a page also asks each delivered slot's keeper to wake its idle session, so the page is read now,

package/lib/quoxon/slash/cliCommand.js

@@ -25,6 +25,42 @@ function variants(w) {
 
 const MAX_DEPTH = 4;
 
+// CONTACTSQ: `/contact new Cristina Cowles --relationship Wife --mobile +44...` must become a command the verb accepts.
+// Per-leaf flag tables (value flags and bare switches), synonyms people type, and a clear refusal for anything else.
+const CONTACTS_ADD = {
+  value: ['phone', 'email', 'kind', 'organisation', 'job-title', 'relationship', 'notes', 'given', 'family', 'middle', 'prefix', 'suffix', 'nickname', 'phonetic-given', 'phonetic-family'],
+  bare: ['org-kind'],
+  synonyms: { mobile: 'phone', tel: 'phone', telephone: 'phone', cell: 'phone', number: 'phone', 'e-mail': 'email', rel: 'relationship', org: 'organisation', company: 'organisation', title: 'job-title' },
+  lower: ['relationship', 'kind'],
+};
+const NORMALISERS = { 'contacts add': (args) => normaliseFlags(args, CONTACTS_ADD, 'quox contacts add') };
+
+/** args = [...path, ...rest]. Positional words before the first flag become ONE name; flags are mapped and checked. */
+function normaliseFlags(args, spec, verb) {
+  const head = args.slice(0, 2);
+  const rest = args.slice(2);
+  const name = [];
+  const out = [];
+  let i = 0;
+  while (i < rest.length && !rest[i].startsWith('-')) name.push(rest[i++]);
+  while (i < rest.length) {
+    const tok = rest[i++];
+    if (!tok.startsWith('--')) return { error: `Unexpected "${tok}" after the flags. Quote values with spaces. ${verb} takes: ${[...spec.value, ...spec.bare].map(f => `--${f}`).join(' ')}` };
+    const eq = tok.indexOf('=');
+    const raw = (eq > 0 ? tok.slice(2, eq) : tok.slice(2)).toLowerCase();
+    const flag = spec.synonyms[raw] || raw;
+    if (spec.bare.includes(flag)) { out.push(`--${flag}`); continue; }
+    if (!spec.value.includes(flag)) return { error: `--${raw} is not a flag of ${verb}. It takes: ${[...spec.value, ...spec.bare].map(f => `--${f}`).join(' ')}` };
+    const vals = eq > 0 ? [tok.slice(eq + 1)] : [];
+    while (i < rest.length && !rest[i].startsWith('--')) vals.push(rest[i++]);
+    if (!vals.length || !vals.join('')) return { error: `--${raw} needs a value.` };
+    let v = vals.join(' ');
+    if (spec.lower.includes(flag)) v = v.toLowerCase();
+    out.push(`--${flag}`, v);
+  }
+  return { args: [...head, ...(name.length ? [name.join(' ')] : []), ...out] };
+}
+
 /** -> { path, cls, args, display } | null. args is the full argv after `quox` (quoted args preserved). */
 export function resolveCliSlash(cmd, restArg, leaves = LEAVES) {
   const first = String(cmd || '').replace(/^\//, '');
@@ -44,7 +80,12 @@ export function resolveCliSlash(cmd, restArg, leaves = LEAVES) {
     for (const p of walk(n)) {
       const path = p.join(' ');
       if (Object.prototype.hasOwnProperty.call(leaves, path)) {
-        const args = [...p, ...words.slice(n)];
+        let args = [...p, ...words.slice(n)];
+        if (NORMALISERS[path]) {
+          const nr = NORMALISERS[path](args);
+          if (nr.error) return { path, cls: leaves[path], args, display: `quox ${args.join(' ')}`, error: nr.error };
+          args = nr.args;
+        }
         return { path, cls: leaves[path], args, display: `quox ${args.map(a => (/[\s"']/.test(a) || a === '' ? JSON.stringify(a) : a)).join(' ')}` };
       }
     }

package/lib/quoxon/slash/cliLeaves.json

@@ -1,6 +1,10 @@
 {"account password":"never",
+"actions add":"write",
+"actions delete":"write",
+"actions done":"write",
 "actions get":"read",
 "actions list":"read",
+"actions move":"write",
 "active":"read",
 "admin agent-identity mint":"never",
 "admin config get":"read",
@@ -21,6 +25,7 @@
 "admin retention stats":"read",
 "admin service list":"read",
 "admin stats":"read",
+"admin users verify-email":"write",
 "aee conversations":"read",
 "aee get":"read",
 "aee query":"read",
@@ -30,6 +35,7 @@
 "agent attach":"never",
 "agent attach-heartbeat":"never",
 "agent attach-status":"read",
+"agent attaches":"write",
 "agent bind-slot":"write",
 "agent create":"write",
 "agent deactivate":"write",
@@ -49,11 +55,16 @@
 "agent tool revoke":"write",
 "agent unbind-slot":"write",
 "agent update":"write",
+"approvals approve":"write",
+"approvals call-me":"write",
+"approvals deny":"write",
 "approvals grants create":"write",
 "approvals grants list":"read",
 "approvals grants revoke":"write",
+"approvals list":"read",
 "approvals result":"read",
 "approvals walkthrough":"never",
+"approvals withdraw":"write",
 "aside":"never",
 "ask loosening":"write",
 "ask status":"read",
@@ -85,6 +96,10 @@
 "backup server restore-status":"read",
 "backup server status":"read",
 "backup verify":"write",
+"blog draft list":"read",
+"blog draft mark-published":"write",
+"blog draft show":"read",
+"blog draft submit":"write",
 "brain add":"write",
 "brain brief":"read",
 "brain check":"read",
@@ -139,12 +154,16 @@
 "chat-status":"read",
 "claude":"never",
 "completion":"never",
+"compliance jobs list":"read",
+"compliance reports list":"read",
+"compliance reports show":"read",
 "config get":"read",
 "config profile add":"write",
 "config profile list":"read",
 "config profile remove":"write",
 "config profile use":"write",
 "config set":"write",
+"connect":"write",
 "consent grant":"never",
 "consent history":"read",
 "consent list":"read",
@@ -180,8 +199,11 @@
 "contacts retention run":"write",
 "contacts retention status":"read",
 "contacts rewrap":"never",
+"contacts scheduled cancel":"write",
+"contacts scheduled list":"read",
 "contacts search":"read",
 "contacts selftest":"write",
+"contacts send":"write",
 "contacts settings":"write",
 "contacts show":"read",
 "contacts strict-names":"write",
@@ -258,6 +280,8 @@
 "engagement jobs":"read",
 "engagement list":"read",
 "engagement propose":"write",
+"engagement reconcile":"write",
+"engagement reconciliations":"write",
 "engagement regrade-finding":"write",
 "engagement report":"read",
 "engagement report-finding":"write",
@@ -275,6 +299,7 @@
 "engagement show":"read",
 "engagement sync-issues":"write",
 "engagement tools":"read",
+"engagement verify":"read",
 "engagement verify-finding":"write",
 "engagement verify-target":"write",
 "entity create":"write",
@@ -284,6 +309,12 @@
 "entity relate":"write",
 "entity search":"read",
 "entity unrelate":"write",
+"evidence bundle":"write",
+"evidence status":"read",
+"evidence verify":"read",
+"ext add":"write",
+"ext list":"read",
+"ext remove":"write",
 "facebook insights":"read",
 "facebook lead-forms":"read",
 "facebook leads":"read",
@@ -307,6 +338,7 @@
 "fleet gpu":"read",
 "fleet host-update":"write",
 "fleet hosts":"read",
+"fleet ping":"write",
 "fleet rehome-agent":"write",
 "fleet status":"read",
 "fleet summary":"read",
@@ -343,14 +375,17 @@
 "hat list":"read",
 "hat reset":"write",
 "hat show":"read",
+"hat upgrade":"never",
 "hat use":"never",
 "health":"read",
 "hyperion deck":"never",
 "hyperion status":"read",
+"image generate":"write",
 "inbox get":"read",
 "inbox list":"read",
 "inbox respond":"write",
 "inbox stats":"read",
+"inbox unread":"write",
 "inbox walkthrough":"never",
 "instagram accounts":"read",
 "instagram comments":"read",
@@ -368,6 +403,33 @@
 "inventory":"read",
 "invites accept":"never",
 "invites list":"read",
+"kuma coverage propose":"write",
+"kuma coverage show":"read",
+"kuma diagnose":"write",
+"kuma down":"write",
+"kuma hooks create":"never",
+"kuma hooks delete":"write",
+"kuma hooks list":"read",
+"kuma incidents":"write",
+"kuma maintenance end":"write",
+"kuma maintenance list":"read",
+"kuma maintenance open":"never",
+"kuma monitors add":"write",
+"kuma monitors edit":"write",
+"kuma monitors get":"read",
+"kuma monitors list":"read",
+"kuma monitors pause":"write",
+"kuma monitors remove":"write",
+"kuma monitors resume":"write",
+"kuma monitors wire-alerts":"write",
+"kuma refresh":"write",
+"kuma sla list":"read",
+"kuma sla verify":"read",
+"kuma status":"read",
+"kuma status-incident draft":"write",
+"kuma status-incident publish":"write",
+"kuma status-incident resolve":"write",
+"kuma uptime":"write",
 "licence catalogue-sign":"never",
 "licence refresh":"write",
 "licence reissue":"never",
@@ -379,12 +441,19 @@
 "linkedin org":"write",
 "linkedin post":"write",
 "linkedin posts":"read",
+"linkedin whoami":"read",
 "llm status":"read",
 "llm-policy get":"read",
 "llm-policy set":"write",
 "llm-policy test":"write",
 "login":"never",
 "logout":"never",
+"loop core-local add":"write",
+"loop core-local list":"read",
+"loop core-local remove":"write",
+"loop list":"read",
+"loop status":"read",
+"loop watch":"never",
 "lucid ack":"write",
 "lucid area":"read",
 "lucid ask":"read",
@@ -405,6 +474,7 @@
 "lucid teach":"write",
 "lucid told":"read",
 "lucid why":"read",
+"mail account pin":"write",
 "mail accounts":"read",
 "mail connect":"never",
 "mail disconnect":"write",
@@ -416,10 +486,12 @@
 "mail report":"write",
 "mail resolve":"write",
 "mail sync":"write",
+"mail sync-status":"write",
 "mail undo":"write",
 "mail watch active":"write",
 "mail watch add":"write",
 "mail watch list":"read",
+"mail watch rm":"write",
 "mail zones":"read",
 "memory core":"read",
 "memory create":"write",
@@ -433,6 +505,7 @@
 "memory reinstate":"write",
 "memory search":"read",
 "memory stats":"read",
+"memory sync":"never",
 "memory timeline":"read",
 "memory unpin":"write",
 "memory update":"write",
@@ -460,12 +533,17 @@
 "mon docker stats":"read",
 "mon metrics":"read",
 "mon wazuh active-response":"write",
-"mon wazuh agents":"read",
+"mon wazuh agents get":"read",
 "mon wazuh alerts":"read",
+"mon wazuh coverage":"read",
 "mon wazuh deploy-agent":"write",
 "mon wazuh deploy-bulk":"write",
 "mon wazuh deploy-history":"read",
+"mon wazuh fim":"read",
+"mon wazuh rootcheck":"read",
+"mon wazuh sca":"read",
 "mon wazuh status":"read",
+"mon wazuh triage":"read",
 "mon wazuh vulns":"read",
 "monitoring health":"read",
 "monitoring incidents get":"read",
@@ -500,6 +578,12 @@
 "notes schedule resume":"write",
 "notes schedule rm":"write",
 "notes scorecard":"write",
+"notes seal edit":"never",
+"notes seal init":"write",
+"notes seal new":"write",
+"notes seal open":"never",
+"notes seal print":"write",
+"notes seal status":"read",
 "notes search":"read",
 "notes settings list":"read",
 "notes settings set":"write",
@@ -520,6 +604,7 @@
 "objective get":"read",
 "objective halt":"write",
 "objective list":"read",
+"objective retry":"write",
 "objective start":"write",
 "offload release":"write",
 "offload status":"read",
@@ -608,6 +693,7 @@
 "prompt update":"write",
 "prompt versions":"read",
 "provider connect":"write",
+"provider install":"write",
 "provider list":"read",
 "provider test":"read",
 "qlarity allowlist":"write",
@@ -639,6 +725,9 @@
 "quoxchat widgets":"read",
 "reach agent":"read",
 "reach unused":"read",
+"research domains add":"write",
+"research domains list":"read",
+"research domains remove":"write",
 "role agent clear":"write",
 "role agent list":"read",
 "role agent set":"write",
@@ -698,6 +787,7 @@
 "seo gaps":"read",
 "seo health":"read",
 "seo keywords":"read",
+"seo queries":"read",
 "seo remove-site":"write",
 "seo report deliver":"write",
 "seo sites":"read",
@@ -710,6 +800,13 @@
 "server config lan-targets":"write",
 "server diag":"write",
 "server doctor":"read",
+"server go":"never",
+"server install":"never",
+"server list":"read",
+"server mark":"write",
+"server roles list":"read",
+"server roles set":"write",
+"server roles unset":"write",
 "server rollback":"write",
 "server status":"read",
 "server uninstall":"never",
@@ -730,6 +827,8 @@
 "setup license link":"write",
 "setup license status":"read",
 "setup status":"read",
+"shortcut add":"write",
+"shortcut remove":"write",
 "signup":"never",
 "sitrep":"read",
 "skills disclosures":"read",
@@ -812,8 +911,10 @@
 "tool exec":"write",
 "tool get":"read",
 "tool install":"write",
+"tool installed":"read",
 "tool list":"read",
 "tool publish":"write",
+"tool uninstall":"write",
 "tool update":"write",
 "trace compare":"read",
 "trace comparison create":"write",
@@ -913,6 +1014,35 @@
 "volt verify":"read",
 "watch fleet":"read",
 "watch services":"read",
+"wazuh active-response":"write",
+"wazuh agents get":"read",
+"wazuh alerts":"read",
+"wazuh connect":"never",
+"wazuh coverage":"read",
+"wazuh deploy":"write",
+"wazuh deploy-bulk":"write",
+"wazuh deploy-history":"read",
+"wazuh fim":"read",
+"wazuh hooks create":"never",
+"wazuh hooks delete":"write",
+"wazuh hooks install":"never",
+"wazuh hooks list":"read",
+"wazuh hooks rotate":"never",
+"wazuh incidents close":"write",
+"wazuh incidents diagnose":"write",
+"wazuh incidents escalate":"write",
+"wazuh incidents show":"read",
+"wazuh indexer install-credential":"write",
+"wazuh remove":"write",
+"wazuh report generate":"write",
+"wazuh report list":"read",
+"wazuh report show":"read",
+"wazuh report verify":"read",
+"wazuh rootcheck":"read",
+"wazuh sca":"read",
+"wazuh status":"read",
+"wazuh triage":"read",
+"wazuh vulns":"read",
 "webhook create":"write",
 "webhook delete":"write",
 "webhook list":"read",
@@ -945,4 +1075,11 @@
 "x search":"write",
 "x status":"read",
 "x thread":"write",
-"x timeline":"write"}
+"x timeline":"write",
+"x whoami":"write",
+"youtube analytics":"write",
+"youtube channel":"write",
+"youtube comment":"write",
+"youtube thumbnail":"write",
+"youtube upload":"write",
+"youtube videos":"read"}

package/lib/quoxon/slash/evidenceCmd.js

@@ -0,0 +1,34 @@
+/**
+ * /evidence: export this conversation's signed evidence bundle (the same call as `quox evidence bundle`) to
+ * ~/quox-evidence/<conversation>-<timestamp>.zip and say what is in it. /ward lists the WARD receipts the export found
+ * (newest ten, then N more). /envelope, /envelopes and /aee are pointers to /proof (the envelope ids); /volt is the
+ * VOLT run, which travels inside the bundle. Pure formatting plus one api call; the lines are { text, tone }.
+ */
+import { wrapHang } from '../objects/model.js';
+export const EVIDENCE_ALIASES = ['envelope', 'envelopes', 'aee', 'volt', 'ward'];
+const SHOWN = 10;
+
+export async function runEvidenceCommand({ cmd, api, conversationId, cols = Infinity }) {
+  const W = Number.isFinite(cols) ? Math.max(20, cols - 4) : 1e9;
+  const wrapT = (l) => wrapHang(l.text, W, 4).map(text => ({ ...l, text }));
+  if (!api || typeof api.evidenceExport !== 'function') return [{ text: 'Evidence export is not available in this mode. In a terminal: quox evidence bundle', tone: 'warn' }].flatMap(wrapT);
+  if (!conversationId) return [{ text: 'No conversation to export yet: send a message first, or in a terminal run quox evidence bundle <conversation id>.', tone: 'warn' }].flatMap(wrapT);
+  let r;
+  try { r = await api.evidenceExport(conversationId); } catch (e) {
+    return [{ text: `Evidence export failed: ${e?.message || 'failed'}. Nothing was written.`, tone: 'warn' }].flatMap(wrapT);
+  }
+  const out = [];
+  const ok = r.verify && r.verify.ok;
+  out.push({ text: `${ok ? '✔' : '✖'} evidence bundle ${ok ? 'written and verified' : 'written but FAILED verification'}: ${r.path}`, tone: ok ? 'ok' : 'warn' });
+  out.push({ text: `  ${r.envelopes} envelopes, ${r.receipts} WARD receipts, conversation ${r.corr}`, tone: 'dim' });
+  if (cmd === '/ward') {
+    out.push({ text: '  WARD receipts for this conversation (the same bundle /evidence writes):', tone: 'dim' });
+    const rows = [...(r.receiptRows || [])].sort((a, b) => (b.seq || 0) - (a.seq || 0));
+    for (const x of rows.slice(0, SHOWN)) out.push({ text: `  WARD seq ${x.seq}  envelope ${x.envelope_id}`, tone: 'dim' });
+    if (rows.length > SHOWN) out.push({ text: `  ${rows.length - SHOWN} more in the bundle`, tone: 'dim' });
+    if (!rows.length) out.push({ text: '  No WARD receipt was found for this conversation\'s envelopes yet (witnessing can lag a few seconds).', tone: 'warn' });
+  }
+  if (cmd === '/volt') out.push({ text: '  The VOLT run (if this conversation has one) is volt.json inside the bundle.', tone: 'dim' });
+  out.push({ text: `  check it offline: quox evidence verify ${r.path}`, tone: 'dim' });
+  return out.flatMap(wrapT);
+}

package/lib/quoxon/slash/hatWalk.js

@@ -122,7 +122,7 @@ export function createHatWalk({ api, say, bump = () => {} }) {
     if (!m.hat) { say(`No hat matches "${arg}". Your own hats: ${hatChoices(mine) || 'none yet'}.`, 'warn'); return null; }
     if (!isCustom(m.hat)) {
       say(verb === 'edit'
-        ? `${nameOf(m.hat)} is a built-in hat, so it is not edited here. It can be reset, or used as a starting point with /hat new.`
+        ? `${nameOf(m.hat)} is a built-in hat, so it is not edited here. Reset it, or start from it with /hat new.`
         : `${nameOf(m.hat)} is a built-in hat and cannot be deleted. It can be reset, or used as a starting point with /hat new.`, 'warn');
       return null;
     }