quoxcli 0.3.1 → 0.5.0

package/lib/quoxon/slash/palette.js

@@ -16,6 +16,10 @@ export function paletteQuery(draft) {
   return t.slice(1).toLowerCase();
 }
 
+const TRANSIENT = /not running|not reachable|unreachable|could not reach|cannot reach|connection (refused|reset)|timed? ?out|econn|enotfound|fetch failed|service unavailable|\b50[234]\b/i;
+/** Does this capability reason read as a failed dynamic check rather than a standing fact about the command? */
+export const transientReason = (r) => TRANSIENT.test(String(r || ''));
+
 /**
  * Why a command cannot run in this session, or null. `api` is the session's server wrapper (a method
  * missing means this mode has no route for it); `caps` is GET /api/v1/capabilities when the server has
@@ -23,7 +27,10 @@ export function paletteQuery(draft) {
  */
 export function unavailableReason(entry, { api = {}, caps = null, blocked = null } = {}) {
   const cap = caps ? caps[entry.cap || entry.id] : null;
-  if (cap && cap.available === false) return cap.reason || 'not available on this server';
+  // A reason that is really a failed probe ("Auth service not running or not reachable...") is an error string, not a
+  // property of the command: it never becomes the palette note. The row keeps its static description; running the
+  // command reports the real failure.
+  if (cap && cap.available === false && !transientReason(cap.reason)) return cap.reason || 'not available on this server';
   for (const m of entry.needs || []) if (typeof api[m] !== 'function') return 'not available in this mode';
   if (blocked && entry.server) return '(sign in)';
   return null;
@@ -96,12 +103,26 @@ export function filterPalette(items, query) {
     }
     if (best == null) return;
     if (exact(it)) best = -1;
-    if (it.disabled) best += 0.5; // a working command outranks an unavailable one on a tie
+    if (it.disabled) best += best >= 10 ? 1000 : 0.5; // a non-prefix match on an unavailable command ranks below every working match; a prefix keeps its place on a tie
     scored.push({ it, best, idx });
   });
   return scored.sort((a, b) => a.best - b.best || a.idx - b.idx).map(x => x.it);
 }
 
+/** Bulk or destructive commands: never offered (so never pre-highlighted) by a loose query (owner 2026-10-26: Enter on "/" approved everything). */
+export const GUARDED_IDS = new Set(['yestoall', 'approve', 'deny']);
+
+/**
+ * Drops GUARDED_IDS rows unless the query is an exact name, or a 3+ letter prefix of the name that no unguarded command
+ * shares. So they are reachable only by typing enough of the name to make them the unique match.
+ */
+export function guardBulk(list, query) {
+  const q = String(query ?? '').toLowerCase();
+  const names = (it) => [it.id, ...it.aliases.map(a => a.slice(1))].map(n => n.toLowerCase());
+  const shared = list.some(o => !GUARDED_IDS.has(o.id) && names(o).some(n => q && n.startsWith(q)));
+  return list.filter(it => !GUARDED_IDS.has(it.id) || names(it).includes(q) || (q.length >= 3 && !shared && names(it).some(n => n.startsWith(q))));
+}
+
 /** What Tab puts in the draft: the name, plus a space when the command takes arguments. */
 export function completion(item) {
   const takesArgs = /^\S+\s+\S/.test(String(item.usage).trim());

package/lib/quoxon/slash/paletteController.js

@@ -5,7 +5,7 @@
  */
 import { findEntry } from '../commands.js';
 import { signedOutNotice } from '../sessionDead.js';
-import { paletteQuery, paletteItems, filterPalette, completion, paletteView, PALETTE_MAX } from './palette.js';
+import { paletteQuery, paletteItems, filterPalette, guardBulk, completion, paletteView, PALETTE_MAX } from './palette.js';
 import { argContext, levelFor, staticItems, rankArgs, applyArg } from './args.js';
 import { mentionContext, rankMentions, applyMention } from '../mentions.js';
 
@@ -21,7 +21,7 @@ export function createPalette({
   getDraft, setDraft, run, say, ctx = () => ({}), source = null, refresh = () => {}, now = Date.now,
   mentions = null // MENTIONS: { cache (mentions.js createMentionCache), local: () => receipt items }
 }) {
-  const st = { sel: 0, q: null, dismissed: null, picked: false, aq: null, mq: null };
+  const st = { hold: null, sel: 0, q: null, dismissed: null, picked: false, aq: null, mq: null };
   const cache = new Map(); // 'src:param' -> { at, ttl, items, pending }
   /** Cached items for an async source; fetches when missing or stale. Never throws or blocks. */
   const fetchItems = (src, param) => {
@@ -77,10 +77,14 @@ export function createPalette({
   const rows = () => {
     const q = paletteQuery(getDraft());
     if (q !== st.q) { st.q = q; st.sel = 0; st.picked = false; }
-    return q === null ? [] : filterPalette(paletteItems(ctx()), q);
+    return q === null ? [] : guardBulk(filterPalette(paletteItems(ctx()), q), q);
   };
   const isOpen = () => {
     const d = getDraft();
+    if (st.hold !== null) { // a command was just submitted: closed until the draft is genuinely edited (owner 2026-10-27: a stale palette ran /sleep)
+      if (d === st.hold || d === '') return false;
+      st.hold = null;
+    }
     if (st.dismissed !== null && st.dismissed !== d) st.dismissed = null;
     if (paletteQuery(d) === null) return argOpen() !== null || mentionOpen() !== null;
     return st.dismissed !== d;
@@ -165,5 +169,7 @@ export function createPalette({
       hint: '↑↓ select · Tab complete · Enter run · Esc close'
     };
   }
-  return { isOpen, onKey, view, state: st };
+  /** The app calls this when Enter submits a command line: the palette closes and that Enter activates nothing. */
+  const submitted = (draft = getDraft()) => { st.hold = String(draft ?? ''); st.sel = 0; st.picked = false; };
+  return { isOpen, onKey, view, submitted, state: st };
 }

package/lib/quoxon/slash/qpeCmd.js

@@ -0,0 +1,35 @@
+/**
+ * TUI-QPE (owner 2026-10-19): /qpe 0|1|2|3|4, how many Quox Proof Engine lines show above the status bar.
+ * The lines are the ones whose status-row JSON says grid "qpe" (quox-qpe-row all prints four: headline, movement,
+ * coverage, and the cli.quox.ai content line, owner 2026-10-20). The count is a CLI setting
+ * on the active profile (quoxon.qpeRows); unset shows every QPE row. 0 hides them; the rows keep refreshing, so
+ * turning them back on shows a current value at once. Narrow windows still drop the coverage row (min_cols).
+ */
+export const QPE_GRID = 'qpe';
+export const QPE_MAX = 4;
+
+/** The saved count, or null (show all) when unset or not a whole number 0..4. */
+export function qpeRowsSetting(settings) {
+  const n = settings?.qpeRows;
+  return Number.isInteger(n) && n >= 0 && n <= QPE_MAX ? n : null;
+}
+
+/** "/qpe <arg>" -> { text, tone, save? }. save is the value to store under qpeRows. Pure. */
+export function qpeCommand(arg, settings) {
+  const words = String(arg || '').trim().toLowerCase().split(/\s+/).filter(Boolean);
+  const cur = qpeRowsSetting(settings);
+  const now = cur == null ? 'all 3 proof rows and the content row' : String(cur);
+  if (!words.length || (words[0] === 'rows' && words.length === 1)) {
+    return { text: `QPE rows above the status bar: ${now}. /qpe 0|1|2|3|4 or /qpe all changes it (0 hides them, 4 adds content).` };
+  }
+  // Owner typed `/qpe 3` and `/qpe all` (2026-10-20): "rows" is optional and words map to counts.
+  const vals = words[0] === 'rows' ? words.slice(1) : words;
+  const WORD = { all: 3, full: 3, on: 3, show: 3, max: 3, off: 0, hide: 0, none: 0, hidden: 0 };
+  const v = vals.length === 1 ? (/^[0-4]$/.test(vals[0]) ? Number(vals[0]) : WORD[vals[0]]) : undefined;
+  if (v === undefined) {
+    return { text: 'Usage: /qpe 0|1|2|3|4, or all / off (0 hides the proof engine rows, 3 shows headline, movement and coverage, 4 adds content).', tone: 'warn' };
+  }
+  const n = v;
+  const what = ['hidden', 'headline only', 'headline and movement', 'headline, movement and coverage', 'headline, movement, coverage and content'][n];
+  return { text: `QPE rows: ${n} (${what}). Saved to this profile.`, tone: 'ok', save: n };
+}

package/lib/quoxon/slash/restart.js

@@ -83,7 +83,14 @@ export function settleMsFrom(env = process.env) {
   return env.QUOX_RESTART_SETTLE_MS != null && env.QUOX_RESTART_SETTLE_MS !== '' && Number.isFinite(n) && n >= 0 ? n : RESTART_SETTLE_MS;
 }
 
-export function startBuildWatch({ onNotice, everyMs = 60000, check = newerBuild, repeat = false, buildId = installedBuildId, settleMs = 0, now = Date.now, ...opts } = {}) {
+export const RESTART_MIN_GAP_MS = 15 * 60 * 1000; // no auto-restart offer this soon after this process started (builds seen meanwhile are remembered)
+
+export function minGapMsFrom(env = process.env) {
+  const n = Number(env.QUOX_RESTART_MIN_GAP_MS);
+  return env.QUOX_RESTART_MIN_GAP_MS != null && env.QUOX_RESTART_MIN_GAP_MS !== '' && Number.isFinite(n) && n >= 0 ? n : RESTART_MIN_GAP_MS;
+}
+
+export function startBuildWatch({ onNotice, everyMs = 60000, check = newerBuild, repeat = false, buildId = installedBuildId, settleMs = 0, minGapMs = 0, now = Date.now, ...opts } = {}) {
   let last; // repeat mode: the last build announced
   let seen; let seenAt = 0; let seenNotice = null; // repeat mode: the build waiting to settle, and when it last changed
   const bootAt = now();
@@ -99,6 +106,7 @@ export function startBuildWatch({ onNotice, everyMs = 60000, check = newerBuild,
     seenNotice = t;
     const t0 = now() - bootAt < RESTART_BOOT_WINDOW_MS ? Math.max(seenAt, bootAt) : seenAt;
     if (now() - t0 < settleMs) return;
+    if (now() - bootAt < minGapMs) return; // min gap since start: remembered in seen, offered once the gap has passed
     last = b;
     onNotice(seenNotice, b);
   }, everyMs);
@@ -162,6 +170,8 @@ export const RESTART_NOTE_ENV = 'QUOX_RESTART_NOTE';
 export const RESTART_ORG_ENV = 'QUOX_RESTART_ORG';
 /** Env var carrying the window's /mode (PLAN MODE: only 'plan' is carried; ask is the default) to the restarted successor. */
 export const RESTART_MODE_ENV = 'QUOX_RESTART_MODE';
+/** Env var carrying the slot this window declined to reattach to ("n" at the startup ask), so a restart does not re-ask. */
+export const RESTART_DECLINED_ENV = 'QUOX_RESTART_DECLINED';
 
 /** Terminal modes the client turns on (bracketed paste, focus reporting, hidden cursor): all off before the hand-over. */
 export const TERMINAL_RESTORE = '\x1b[?2004l\x1b[?1004l\x1b[?25h\x1b[?1006l\x1b[?1002l\x1b[?1000l'; // bracketed paste, focus, cursor; mouse tracking off (QUOXON-MOUSE)
@@ -176,13 +186,14 @@ export function restoreTerminal({ stdin = process.stdin, stdout = process.stdout
  * What a restart runs: { cmd, args, env }. The installed quox (or this tree), the same arguments with --resume
  * for this conversation, and the one-shot hand-over env (held slot, attach, org, plan mode) for the successor.
  */
-export function restartPlan({ argv, conversationId, profile = null, name = null, slot = null, attach = null, org = null, mode = null, env = process.env, bin = findOnPath('quox', env) }) {
+export function restartPlan({ argv, conversationId, profile = null, name = null, slot = null, attach = null, org = null, mode = null, declined = null, env = process.env, bin = findOnPath('quox', env) }) {
   const args = restartArgs(argv, conversationId, { profile, name });
   let childEnv = profile && !argv.includes('--demo') ? { ...env, QUOX_PROFILE: profile } : env; // belt and braces: same profile even if -p were lost
   if (slot) childEnv = { ...childEnv, [RESTART_SLOT_ENV]: slot }; // the held slot rides along; the new client takes it over before this one is gone
   if (attach) childEnv = { ...childEnv, [RESTART_ATTACH_ENV]: attach }; // so does the attached agent or slot
   if (org) childEnv = { ...childEnv, [RESTART_ORG_ENV]: org }; // and the window's org (never the profile's file)
   if (mode === 'plan') childEnv = { ...childEnv, [RESTART_MODE_ENV]: 'plan' }; // and the window's /mode (never the profile)
+  if (declined) childEnv = { ...childEnv, [RESTART_DECLINED_ENV]: declined }; // and a declined reattach (never re-asked after a restart)
   const [cmd, lead] = restartTarget(env, bin);
   return { cmd, args: [...lead, ...args], env: childEnv };
 }
@@ -193,10 +204,26 @@ export function restartPlan({ argv, conversationId, profile = null, name = null,
  * Only used when there is no launcher (QUOX_NO_LAUNCHER=1, or no handoff dir): it NESTS the successor under
  * this process, which stays resident until the successor exits. The launcher path (launcher.js) does not.
  */
-export function execRestart({ argv, conversationId, profile = null, name = null, slot = null, attach = null, org = null, mode = null, env = process.env, spawn = spawnSync, bin = findOnPath('quox', env), restore = restoreTerminal }) {
-  const plan = restartPlan({ argv, conversationId, profile, name, slot, attach, org, mode, env, bin });
+export function execRestart({ argv, conversationId, profile = null, name = null, slot = null, attach = null, org = null, mode = null, declined = null, env = process.env, spawn = spawnSync, bin = findOnPath('quox', env), restore = restoreTerminal }) {
+  const plan = restartPlan({ argv, conversationId, profile, name, slot, attach, org, mode, declined, env, bin });
   restore(); // the child owns the terminal now
   const r = spawn(plan.cmd, plan.args, { stdio: 'inherit', env: plan.env });
   if (r.error) return { error: `${r.error.code || 'failed'}: ${r.error.message}`, bin: plan.cmd };
   return { code: r.status ?? (r.signal ? 128 + (os.constants.signals[r.signal] || 0) : 1), bin: plan.cmd };
 }
+
+export const SERVER_WAIT_EVERY_MS = 10000; // poll the collector /health this often while a restart waits for it
+export const SERVER_WAIT_MAX_MS = 3 * 60 * 1000; // ...for up to this long, then carry on as before
+
+/** Poll `probe` (-> { ok } | truthy/falsy, may throw) until it answers ok. -> true when healthy, false on timeout or cancel. */
+export async function waitForHealthy({ probe, everyMs = SERVER_WAIT_EVERY_MS, maxMs = SERVER_WAIT_MAX_MS, cancelled = () => false, sleep = (ms) => new Promise((r) => { const t = setTimeout(r, ms); t.unref?.(); }), now = Date.now } = {}) {
+  if (typeof probe !== 'function') return true;
+  const end = now() + maxMs;
+  for (;;) {
+    if (cancelled()) return false;
+    let r = null; try { r = await probe(); } catch { r = null; }
+    if (r === true || r?.ok === true) return true;
+    if (cancelled() || now() + everyMs > end) return false;
+    await sleep(everyMs);
+  }
+}

package/lib/quoxon/slash/resume.js

@@ -16,13 +16,30 @@ export function age(iso, now = Date.now()) {
   return `${Math.round(s / 86400)}d ago`;
 }
 
+// Box-drawing, block, geometric, braille and halfwidth-kana characters are what the TUI itself paints (dividers, busy strip,
+// dragon art, scrambled labels). A title containing them was derived from rendered UI, never typed by anyone.
+const RENDERED = /[\u2500-\u259F\u25A0-\u25FF\u2800-\u28FF\uFF61-\uFF9F]/g;
+/** A conversation title safe to show, or null when it is made of rendered UI (3+ painted characters) or empty. */
+export function cleanTitle(t) {
+  const s = String(t ?? '');
+  if ((s.match(RENDERED) || []).length >= 3) return null;
+  const c = s.replace(RENDERED, ' ').replace(/\s+/g, ' ').trim();
+  return c || null;
+}
+/** The first user message of stored turns as a title (<= 60 chars), or null. */
+export function titleFromTurns(turns = []) {
+  const u = (turns || []).find(t => t.role === 'user' && String(t.content || '').trim());
+  const c = u ? cleanTitle(String(u.content).split('\n')[0]) : null;
+  return c ? (c.length > 60 ? `${c.slice(0, 60).trimEnd()}…` : c) : null;
+}
+
 /** -> [{ id, title, agent, updated_at, turns }] newest first. */
 export function resumeRows(conversations = [], index = null, names = {}) {
   const agentOf = new Map();
   for (const r of index?.rows || []) if (r.kind === 'conversation' && r.id) agentOf.set(r.id, r.agent || null);
   return conversations.map(c => ({
     id: c.id,
-    title: names[c.id]?.name || c.title || '(untitled)',
+    title: cleanTitle(names[c.id]?.name) || cleanTitle(c.title) || '(untitled)',
     agent: agentOf.get(c.id) ?? null,
     updated_at: c.updated_at || null,
     turns: c.turn_count ?? null

package/lib/quoxon/slash/stepUp.js

@@ -211,7 +211,7 @@ export function createStepUp({ api, agentLogin = false, onAgentLogin = () => {},
     if (!card) return;
     if (res?.step_up_token) {
       const until = now() + WINDOW_MS;
-      for (const s of res.scopes || card.scopes) tokens.set(s, { token: res.step_up_token, until });
+      if (!card.fresh) for (const s of res.scopes || card.scopes) tokens.set(s, { token: res.step_up_token, until }); // a fresh (one-shot) token is handed to the caller only, never kept
       if (card.window) presentUntil = until;
       card.phase = 'ok'; card.until = until; card.now = now(); refresh(); emit({ type: 'stepup.result', ok: true });
       await sleep(RESULT_HOLD_MS);
@@ -245,16 +245,16 @@ export function createStepUp({ api, agentLogin = false, onAgentLogin = () => {},
     view() { return card ? { ...card, filled: box.count(), tries, now: now() } : null; },
     /**
      * Ask for a person. Resolves { ok, token?, reason? } and never throws. Reuses a live token for the scope.
-     * opts: { scope: 'approve'|'override', scopes?, orgId?, subject?, window?: true (the /authenticate window) }
+     * opts: { scope: 'approve'|'override', scopes?, orgId?, subject?, window?: true (the /authenticate window), fresh?: true (always ask for the PIN, never reuse a live token, never keep the one issued: for one-shot strict tokens) }
      */
-    request({ scope = 'approve', scopes = null, orgId = null, subject = {}, window: asWindow = false, title = null } = {}) {
+    request({ scope = 'approve', scopes = null, orgId = null, subject = {}, window: asWindow = false, title = null, fresh = false } = {}) {
       if (typeof agentLogin === 'function' ? agentLogin() : agentLogin) { note(`This window is an agent login: ${NEEDS_PERSON}.`, 'warn'); onAgentLogin(); return Promise.resolve({ ok: false, reason: 'agent_login' }); }
-      if (!asWindow && live(scope)) return Promise.resolve({ ok: true, token: live(scope).token, scopes: [scope], reused: true });
+      if (!asWindow && !fresh && live(scope)) return Promise.resolve({ ok: true, token: live(scope).token, scopes: [scope], reused: true });
       if (card) return Promise.resolve({ ok: false, reason: 'busy' });
       if (lockedUntil > now()) { note(`⛔ LOCKED · PIN entry is locked for ${mmss(lockedUntil - now())}. Use your phone or a human session.`, 'error'); return Promise.resolve({ ok: false, reason: 'locked' }); }
       tries = MAX_TRIES;
       box.clear();
-      card = { phase: 'input', subject, title, scope, scopes: scopes || (asWindow ? ['approve', 'override'] : [scope]), orgId, window: asWindow, error: null, offset: 0 };
+      card = { phase: 'input', subject, title, scope, scopes: scopes || (asWindow ? ['approve', 'override'] : [scope]), orgId, window: asWindow, fresh, error: null, offset: 0 };
       refresh();
       return new Promise((r) => { resolveCard = r; });
     },

package/lib/quoxon/slash/stepUpCmds.js

@@ -8,6 +8,8 @@
  *                            witnessed server-side. Honest about block types no gate honours yet.
  */
 import { mmss, NEEDS_PERSON } from './stepUp.js';
+import { STEP_UP_HEADER } from '../../core/stepUpPrompt.js';
+import { renderAnnounce } from '../../core/announce.js';
 
 export const BLOCK_TYPES = ['safety', 'budget', 'aocl', 'ward'];
 export const MIN_REASON = 8;
@@ -43,8 +45,79 @@ export function declinedText(reason) {
   }
 }
 
-export function createStepUpCmds({ api, stepUp, say, lastBlock = () => null, orgOf = () => null }) {
+export const verifyEmailUsage = '/verify-email <email> --reason "<why>" [--user-id <id>]  (instance admin; a person confirms with a PIN; audited)';
+const PIN_SHAPED = /(^|\D)\d{6}(\D|$)/;
+// eslint-disable-next-line no-control-regex
+const ANSI = /\x1b\[[0-9;]*m/g;
+
+/** Split on spaces, honouring "double" and 'single' quotes. */
+function words(s) {
+  const out = []; let cur = ''; let q = null; let has = false;
+  for (const ch of String(s || '')) {
+    if (q) { if (ch === q) q = null; else cur += ch; continue; }
+    if (ch === '"' || ch === "'") { q = ch; has = true; continue; }
+    if (/\s/.test(ch)) { if (has || cur) out.push(cur); cur = ''; has = false; continue; }
+    cur += ch; has = true;
+  }
+  if (has || cur) out.push(cur);
+  return out;
+}
+
+/** -> { ok:true, email, reason, userId } | { ok:false, error }. Never accepts a PIN-shaped argument. */
+export function parseVerifyEmail(args) {
+  const raw = String(args || '');
+  if (PIN_SHAPED.test(raw)) return { ok: false, error: 'That looks like a PIN. Never type your PIN after a command: it is asked for in a private card.' };
+  const w = words(raw);
+  let email = null; let reason = null; let userId = null;
+  for (let i = 0; i < w.length; i += 1) {
+    const t = w[i];
+    if (t === '--reason' || t.startsWith('--reason=')) {
+      const parts = t.startsWith('--reason=') ? [t.slice(9)] : [];
+      while (i + 1 < w.length && !w[i + 1].startsWith('--')) { i += 1; parts.push(w[i]); }
+      reason = parts.join(' ').trim();
+    } else if (t === '--user-id' || t.startsWith('--user-id=')) {
+      userId = t.startsWith('--user-id=') ? t.slice(10) : (w[i + 1] && !w[i + 1].startsWith('--') ? w[++i] : '');
+    } else if (!email && !t.startsWith('--')) email = t;
+    else return { ok: false, error: `Unexpected "${t}". Usage: ${verifyEmailUsage}` };
+  }
+  if (!email) return { ok: false, error: `Give the email address. Usage: ${verifyEmailUsage}` };
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return { ok: false, error: `"${email}" is not an email address. Usage: ${verifyEmailUsage}` };
+  if (!reason) return { ok: false, error: `--reason is required: it is recorded in the audit log. Usage: ${verifyEmailUsage}` };
+  return { ok: true, email, reason, userId: userId || null };
+}
+
+export function createStepUpCmds({ api, stepUp, say, lastBlock = () => null, orgOf = () => null, confirm = null }) {
   return {
+    /** The composer line after the /verify-email preview: true when consumed as the y/n answer. */
+    answer: (text) => Boolean(confirm?.answer(text)),
+    pending: () => Boolean(confirm?.pending()),
+    touch: () => confirm?.touch(),
+    /**
+     * /verify-email: the TUI front of `quox admin users verify-email`. Same endpoint, same scope ('override'); the
+     * server (instance admin, human caller, one-shot step-up token, reason) is the only gate. Preview + y/N first,
+     * then the hidden PIN card, always fresh: a live /authenticate token is never reused or spent here.
+     */
+    async verifyEmail(args) {
+      const p = parseVerifyEmail(args);
+      if (!p.ok) return say(p.error, 'warn');
+      if (!confirm) return say('/verify-email is not available in this mode.', 'warn');
+      const verb = `admin verify-email ${p.email}`;
+      const glyph = (opts) => renderAnnounce('quox', verb, opts).replace(ANSI, '');
+      say(`This will mark ${p.email} as email-verified WITHOUT a mailbox check${p.userId ? ` (only if it belongs to user ${p.userId})` : ''}. Reason (recorded in the audit log under your name): ${p.reason}`, 'warn');
+      say('A person must confirm with the step-up PIN next, asked in a private card. Instance admins only.');
+      return confirm.ask([], async () => {
+        const r = await stepUp.request({ scope: 'override', fresh: true, orgId: orgOf(), title: 'VERIFYING AN EMAIL NEEDS A PERSON', subject: { line1: `verify ${p.email}` } });
+        if (!r.ok) return say(`Not verified: ${declinedText(r.reason)}.`, 'warn');
+        try {
+          const data = await api.verifyEmail({ email: p.email, reason: p.reason, userId: p.userId, stepUp: { [STEP_UP_HEADER]: r.token } });
+          say(glyph({ result: `verified · user ${data.user_id}` }), 'ok');
+          say(`Email ${data.email} is now verified. Reason recorded in the audit log.`, 'ok');
+        } catch (e) {
+          say(glyph({ result: String(e?.body?.message || e?.body?.error || e?.message || e).replace(/\s+/g, ' ').trim(), status: 'fail' }), 'error');
+        }
+        return undefined;
+      }, { prompt: 'Go ahead and ask for your PIN?' });
+    },
     async authenticate() {
       const r = await stepUp.request({ window: true, orgId: orgOf(), subject: { line1: 'confirm a person is at this keyboard' } });
       if (!r.ok) return say(`Not authenticated: ${declinedText(r.reason)}.`, 'warn');

package/lib/quoxon/slash/todoCmd.js

@@ -0,0 +1,122 @@
+/**
+ * /todo <text> adds an Action Tracker item; /todo alone and /todos list the board; /todo move do5 done moves one
+ * (owner typed /todo, 2026-10-20). The writes and reads are core/actionItems.js, the same core as `quox actions`.
+ * Items get per-listing short ids by column: td1.. (to do), do1.. (doing), dn1.. (done). They are positions in the
+ * last list, mapped to real item ids; a move re-reads the board and says so when the list has changed.
+ * Pure helpers here: parse, short ids, wording.
+ */
+export const DONE_SHOWN = 10;
+const PREFIX = { backlog: 'td', doing: 'do', done: 'dn' };
+const COLUMN_NAME = { backlog: 'To do', doing: 'Doing', done: 'Done' };
+const REF = /^(td|do|dn)(\d+)$/i;
+const STATUS_WORD = { todo: 'todo', 'to-do': 'todo', td: 'todo', doing: 'doing', do: 'doing', wip: 'doing', progress: 'doing', 'in-progress': 'doing', done: 'done', dn: 'done', complete: 'done', completed: 'done', finished: 'done' };
+const USAGE = 'Usage: /todo <text> adds. /todos lists. /todo move do5 done (or /todo do5 done, /todo mark do2 done, /todo td3 doing) moves one.';
+
+/** A column word -> 'todo' | 'doing' | 'done' | null. Accepts "to do" and "in progress" as two words. */
+export function statusWord(words) {
+  const w = (Array.isArray(words) ? words.join('-') : String(words || '')).trim().toLowerCase();
+  return STATUS_WORD[w] || null;
+}
+
+/** Leading short ids from words, comma and/or space separated ("td1,td2", "td1 td2", "td1, td2") -> { refs, used } (used = words consumed). */
+export function takeRefs(words) {
+  const refs = [];
+  let used = 0;
+  for (const w of words) {
+    const parts = String(w).split(',').filter(Boolean);
+    if (!parts.length || !parts.every((p) => REF.test(p))) break;
+    refs.push(...parts.map((p) => p.toLowerCase()));
+    used += 1;
+  }
+  return { refs: [...new Set(refs)], used };
+}
+
+/** "/done td1,td2" argument -> { kind: 'done', refs } | { kind: 'usage', text }. Nothing but short ids is accepted. */
+export function parseDone(arg) {
+  const words = String(arg || '').trim().split(/\s+/).filter(Boolean);
+  const { refs, used } = takeRefs(words);
+  if (!refs.length || used !== words.length) return { kind: 'usage', text: 'Usage: /done td1,td2 (or /done td1 td2) marks those items done. /todos lists the ids.' };
+  return { kind: 'done', refs };
+}
+
+export function todoDoneLine(title) {
+  return `\u2714 Done: ${title}`;
+}
+
+/**
+ * "/todo ..." or "/todos ..." + its argument ->
+ *   { kind: 'list' } | { kind: 'add', text } | { kind: 'move', ref, to } | { kind: 'usage', text }.
+ * Only /todo with free text adds. A short id plus a column word moves; an id with a bad column is a usage error, never an add.
+ */
+export function parseTodo(command, arg) {
+  const text = String(arg || '').trim();
+  if (String(command || '').toLowerCase() === '/todos' || !text) return { kind: 'list' };
+  const words = text.split(/\s+/);
+  const verb = /^(move|mv|mark|set)$/i.test(words[0]);
+  const rest = verb ? words.slice(1) : words;
+  const lead = takeRefs(rest);
+  if (lead.refs.length) {
+    const to = statusWord(rest.slice(lead.used));
+    if (to) return lead.refs.length > 1 ? { kind: 'move', ref: lead.refs[0], refs: lead.refs, to } : { kind: 'move', ref: lead.refs[0], to };
+    return { kind: 'usage', text: USAGE };
+  }
+  if (verb) return { kind: 'usage', text: USAGE };
+  return { kind: 'add', text };
+}
+
+/** board {backlog,doing,done} (backlog = the to-do column) -> { map: { td1: id, ... }, shown: { todo, doing, done } } (done is capped at DONE_SHOWN). */
+export function numberBoard(board, doneShown = DONE_SHOWN) {
+  const shown = { backlog: board.backlog || [], doing: board.doing || [], done: (board.done || []).slice(0, doneShown) };
+  const map = {};
+  for (const col of Object.keys(PREFIX)) shown[col].forEach((it, n) => { map[`${PREFIX[col]}${n + 1}`] = it.id; });
+  return { map, shown };
+}
+
+/** Confirmation after an add: the item id plus where to see the list. */
+export function todoAddedLine(item) {
+  return `Added to your Action Tracker: ${item.id}  ${item.title}. /todos lists them.`;
+}
+
+/** The board as short numbered lines, per column, with short ids. -> string. */
+export function todoBoardText(board, numbered = numberBoard(board)) {
+  const total = (board.backlog || []).length + (board.doing || []).length + (board.done || []).length;
+  if (!total) return 'Nothing in your Action Tracker. /todo <text> adds an item.';
+  const out = [`Your Action Tracker (${(board.backlog || []).length} to do, ${(board.doing || []).length} doing, ${(board.done || []).length} done). /todo <text> adds, /todo move do2 done moves:`];
+  for (const col of ['backlog', 'doing', 'done']) {
+    const items = numbered.shown[col];
+    const all = (board[col] || []).length;
+    if (!all) continue;
+    out.push(`${COLUMN_NAME[col]}:`);
+    items.forEach((i, n) => out.push(`  ${PREFIX[col]}${n + 1}  ${i.title}${i.due_date ? `  due ${String(i.due_date).slice(0, 10)}` : ''}`));
+    if (all > items.length) out.push(`  ... and ${all - items.length} more ${col === 'done' ? 'done (quox actions list --status done)' : ''}`.trimEnd());
+  }
+  return out.join('\n');
+}
+
+/**
+ * Resolve a short id for a move. oldMap is the map from the last /todos (or null if none yet); fresh is the board
+ * read just now. The item is found by its REAL id from the old list, so a list that shifted still moves the item
+ * you saw. -> { id, title, note? } | { error }.
+ */
+export function resolveRef(ref, oldMap, board) {
+  const fresh = numberBoard(board, Infinity);
+  const byId = {};
+  for (const [short, id] of Object.entries(fresh.map)) byId[id] = short;
+  const titleOf = (id) => [...(board.backlog || []), ...(board.doing || []), ...(board.done || [])].find((i) => i.id === id)?.title || '';
+  if (!oldMap || !oldMap[ref]) {
+    const id = fresh.map[ref];
+    if (!id) return { error: `No ${ref} on your board. /todos lists the current ids.` };
+    return { id, title: titleOf(id), note: oldMap ? undefined : `No list shown yet in this window, so ${ref} is read from the board as it is now.` };
+  }
+  const id = oldMap[ref];
+  if (!byId[id]) return { error: `${ref} is gone from your board (done elsewhere or deleted). /todos lists the current ids.` };
+  const nowRef = byId[id];
+  const shownNow = numberBoard(board).map[nowRef] === id; // the id is one the user could see in a fresh listing
+  return nowRef === ref
+    ? { id, title: titleOf(id) }
+    : { id, title: titleOf(id), note: `The list changed since /todos: "${titleOf(id)}" is ${nowRef} now${shownNow ? '' : ' (beyond the short list)'}. Moving that one.` };
+}
+
+export function todoMovedLine(item) {
+  return `Moved ${item.title} to ${item.status}.`;
+}

package/lib/quoxon/slashSpinner.js

@@ -0,0 +1,35 @@
+/**
+ * INSTANT-FEEDBACK (owner 2026-10-26: "no spinner... I want a whirly thing like the npm install cursor"): one shared
+ * helper for every async slash command. The dispatcher wraps the handler; if it is still pending after `firstMs`
+ * (under 100 ms) a `⠋ <verb>…` line appears and turns at `frameMs`; it goes away when the handler settles (the result
+ * line or the error replaces it), when the handler prints its first line (`stop`), or after `maxMs`.
+ */
+export const SPIN_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+
+/** `/inbox read all` -> `inbox`; the verb is the command word without its slash. */
+export const spinnerVerb = (line) => String(line || '').trim().split(/\s+/)[0].replace(/^\/+/, '') || 'working';
+export const spinnerText = (verb, i = 0) => `${SPIN_FRAMES[i % SPIN_FRAMES.length]} ${verb}…`;
+
+/**
+ * Run `fn` (returns a value or a promise). show(text) paints a frame, hide() clears it. register(stop) hands the caller
+ * a way to cancel the spinner early. Always resolves/rejects exactly as fn does.
+ */
+export async function runWithSpinner(fn, { verb, show, hide, register, firstMs = 80, frameMs = 80, maxMs = 60000 } = {}) {
+  let frame = 0, shown = false, done = false, first = null, iv = null, cap = null;
+  const stop = () => {
+    done = true;
+    if (first) { clearTimeout(first); first = null; }
+    if (iv) { clearInterval(iv); iv = null; }
+    if (cap) { clearTimeout(cap); cap = null; }
+    if (shown) { shown = false; hide?.(); }
+  };
+  first = setTimeout(() => {
+    first = null;
+    if (done) return;
+    shown = true; show?.(spinnerText(verb, frame++));
+    iv = setInterval(() => { if (!done) show?.(spinnerText(verb, frame++)); }, frameMs);
+    cap = setTimeout(stop, maxMs);
+  }, firstMs);
+  register?.(stop);
+  try { return await fn(); } finally { stop(); }
+}

package/lib/quoxon/slotAttach.js

@@ -0,0 +1,8 @@
+// Plain-language slot attach (owner 2026-10-28): "attach to hitl slot" is a request for /slot hitl, so the window
+// OFFERS that command (y/N) instead of sending the sentence to the model. Only these two phrasings match.
+const ATTACH = /^\s*(?:attach\s+(?:me\s+)?to\s+(?:the\s+)?|attach\s+(?:the\s+)?|join\s+(?:the\s+)?)([A-Za-z0-9][A-Za-z0-9._-]{0,63})\s+slot\s*[.!]?\s*$/i;
+export function parseSlotAttach(text) {
+  if (typeof text !== 'string' || text.includes('\n') || text.startsWith('/')) return null;
+  const m = ATTACH.exec(text);
+  return m ? m[1] : null;
+}

package/lib/quoxon/slotChat.js

@@ -116,6 +116,15 @@ export function slotOfHolder(rows, name) {
   return r ? r.name : null;
 }
 
+/** REPLY-ADDRESS: a message with no from_slot gets one when its sender holds a slot (by held session name, else by the slot's own name). Returns m itself when nothing applies. */
+export function withSenderSlot(rows, m) {
+  if (!m || m.from_slot) return m;
+  const n = String(m.from || '').replace(/\s*\(.*\)\s*$/, '').trim().toLowerCase();
+  const held = (Array.isArray(rows) ? rows : []).filter(x => x?.name && x.state !== 'free');
+  const slot = slotOfHolder(held, m.from) || held.find(x => String(x.name).toLowerCase() === n)?.name || null;
+  return slot ? { ...m, from_slot: slot } : m;
+}
+
 /** A slot message as a chat line: { glyph, who, time, text, file }. */
 export function slotLine(m) {
   m = m && typeof m.text === 'string' ? { ...m, text: decodeEntities(m.text) } : m;
@@ -298,3 +307,11 @@ export function presenceLine(slot, presence, agoText) {
   const seen = presence.last_checked_in_at ? `last checked in ${agoText(presence.last_checked_in_at)}` : 'no check-in on record';
   return { text: `✔ delivered to ${slot} · not listening right now (${seen}); it sees this when it next checks`, tone: 'ok', listening: false };
 }
+
+const DEPLOY_WINDOW_MS = 10 * 60 * 1000;
+/** The "reattach is slow" line. During a deploy (restart signal seen, or the same URL answered within ~10 min) the stale-URL/env advice is wrong, so it says so calmly; a URL that never answered keeps the full diagnostic. */
+export function reattachSlowLine({ slot, message, restartSeenAt = 0, lastGoodAt = 0, now = Date.now() }) {
+  const recent = (t) => Number(t) > 0 && now - Number(t) <= DEPLOY_WINDOW_MS;
+  if (recent(restartSeenAt) || recent(lastGoodAt)) return `slot ${slot}: QuoxCORE is restarting (a deploy); reconnecting, nothing is lost.`;
+  return `slot ${slot}: reattaching after the restart is slow (${message}); retrying.`;
+}

package/lib/quoxon/slotFormat.js

@@ -153,7 +153,7 @@ function wrapRuns(runs, width, role, prefix) {
     let t = a.t;
     if (w + sep + len(t) > room && cur.length) newRow();
     else if (sep) { add({ t: ' ', role, bold: undefined }); w += 1; }
-    while (len(t) > room) { const g = graphemes(t); add({ t: g.slice(0, room - w).join(''), role: a.role, bold: a.bold }); t = g.slice(room - w).join(''); newRow(); }
+    while (len(t) > room) { const g = graphemes(t).map(x => x.text); add({ t: g.slice(0, room - w).join(''), role: a.role, bold: a.bold }); t = g.slice(room - w).join(''); newRow(); }
     add({ t, role: a.role, bold: a.bold }); w += len(t);
     gap = false;
   }