quoxcli 0.4.0 → 0.5.0

package/lib/core/errors.js

@@ -214,6 +214,14 @@ export function explainError(err, ctx = null) {
   const raw = RAW_HEADLINE.test(String(err.message || '').split('\n')[0]) || err.reasonFromError === true;
   const reason = serverReason(err);
 
+  // SKILLRIGHTS #478: require-acceptance refusal is not a generic 409 conflict.
+  if (status === 409 && (code === 'acceptance_required' || body.error === 'acceptance_required')) {
+    const pack = typeof body.packId === 'string' && body.packId ? body.packId : 'quox-core-dev-pack';
+    return {
+      headline: sentence(reason || `This org's distribution policy is require-acceptance, and nobody has accepted the current terms for pack '${pack}'`),
+      next: `accept the terms as yourself: quox dev skills accept ${pack} (add --i-accept with no terminal), then re-run the sync.`,
+    };
+  }
   // #8 service-key fallback: the real problem is "no stored session", say it once.
   if (err.serviceKeyFallback && (status === 401 || status === 403)) {
     return {
@@ -268,6 +276,28 @@ export function explainError(err, ctx = null) {
   if (status === 404 && /^approval not found$/i.test(reason || '')) {
     return { headline: 'No approval with that id in this org; it may belong to another org or be past retention.', next: notFoundNext(ctx) || '`quox approvals --help` shows how to list what exists.' };
   }
+  // DS-010 / #1335: a step-up refusal is about WHO is at the keyboard, not about org or role. The old fall-through
+  // sent people to "switch org / ask an admin", which cannot help: only the approver's own PIN does.
+  if (status === 403 && /step_up_required/.test(all)) {
+    if (body.reason === 'non_human') {
+      return { headline: 'This approval needs a person, and this login is an agent or service identity.', next: 'approve it from a person\'s own login (the dashboard, or `quox` in their terminal).' };
+    }
+    return {
+      headline: 'This approval needs your step-up PIN.',
+      next: body.pin_set === false
+        ? 'set a PIN in the dashboard (Settings > Account > Approval PIN), then run this again in a terminal.'
+        : 'run this command in an interactive terminal; it will ask for the PIN with hidden input. The PIN cannot be passed as a flag or environment variable.',
+    };
+  }
+  // the auth service's requireInstanceAdmin refusal (code instance_admin_required): instance admin is instance-wide,
+  // so neither switching org nor asking an org admin can help
+  if (status === 403 && /instance_admin_required|instance administrator access required/i.test(all)) {
+    return { headline: sentence(reason || 'Instance administrator access required'), next: 'this needs an instance administrator account. Run it with a profile that is one (quox -p <profile> ...), or ask your instance admin.' };
+  }
+  // an instance-admin gate: switching org cannot help, only an instance admin can
+  if (status === 403 && /instance admin required/i.test(all)) {
+    return { headline: 'This needs an instance admin, and this login is not one.', next: 'ask an instance admin of this Quox server to run it, or to make your login an instance admin.' };
+  }
   // #5 a role refusal is not an org-context problem
   if (status === 403 && /insufficient permissions?|lacks?[ _]capability|requires? (an? |the )?(admin|owner) role|not an? (org )?(admin|owner)/i.test(all)) {
     return { headline: sentence(reason || 'Your role does not allow this'), next: 'your role in this org does not allow this; ask an org owner or admin to do it or to raise your role.' };
@@ -332,6 +362,7 @@ function fallbackExplain(err, ctx) {
 }
 
 // CLI-ERRORS: an instruction sentence (the step the user takes) vs the rest (what happened).
+const TLS_HINT_CODES = ['DEPTH_ZERO_SELF_SIGNED_CERT', 'SELF_SIGNED_CERT_IN_CHAIN', 'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', 'ERR_TLS_CERT_ALTNAME_INVALID', 'CERT_HAS_EXPIRED'];
 const INSTRUCTION = /^(run|check|use|retry|try|pass|fix|set|pick|switch|ask|log ?in|re-?run|please)\b/i;
 
 function splitInstruction(text) {
@@ -351,6 +382,10 @@ function splitInstruction(text) {
  * CLI-ERRORS: errors the CLI raises itself (auth, network, validation, anything else) in the same
  * contract as API errors: one headline, at most one Next, the rest (`more`) only with --verbose.
  */
+function connectUrl(u) {
+  try { return new URL(u).origin; } catch { return '<url>'; }
+}
+
 export function explainLocal(err) {
   if (!err || err instanceof QuoxApiError || err instanceof QuoxUserError) return null;
   const message = String(err.message || '');
@@ -362,7 +397,7 @@ export function explainLocal(err) {
     const more = message.split('\n').slice(1).map((l) => l.trim()).filter(Boolean);
     if (m && code && /CERT|SELF_SIGNED|UNABLE_TO_VERIFY/.test(code)) {
       return { headline: `Could not reach the ${svc} service at ${url}: its certificate is not trusted (${code}).`,
-        next: 'trust it with export NODE_EXTRA_CA_CERTS=<path to quox.crt> (on the server: ~/quox-install/quox/ssl/quox.crt); never disable TLS verification.', more };
+        next: `trust this server for one profile with quox connect ${connectUrl(url)} --profile <name> (it shows the certificate SHA256 and asks y/N; with no terminal add --fingerprint <sha256>); never disable TLS verification.`, more };
     }
     if (m && (code === 'ERR_SSL_WRONG_VERSION_NUMBER' || code === 'EPROTO')) {
       return { headline: `The ${svc} service at ${url} speaks plain http, but this profile's URL says https://.`,
@@ -389,6 +424,20 @@ export function explainLocal(err) {
     return sp;
   }
   if (err instanceof QuoxValidationError) return splitInstruction(message);
+  // H4: a bare fetch (login, MFA, refresh) that died on a certificate this machine does not trust. undici reports it
+  // as "fetch failed"; name the problem and the exact next command. Never auto-trust, never TLS-off.
+  const tlsCode = TLS_HINT_CODES.find((c) => c === (err.cause?.cause?.code || err.cause?.code || err.code));
+  if (tlsCode && err.quoxUrl) {
+    const profile = err.quoxProfile ? ` --profile ${err.quoxProfile}` : '';
+    const expired = tlsCode === 'CERT_HAS_EXPIRED' || tlsCode === 'ERR_TLS_CERT_ALTNAME_INVALID';
+    return { headline: expired
+        ? `The server at ${err.quoxUrl} presents a certificate that ${tlsCode === 'CERT_HAS_EXPIRED' ? 'has expired' : 'does not name the address you used'} (${tlsCode}).`
+        : `The server at ${err.quoxUrl} uses a certificate this machine does not trust yet.`,
+      next: expired
+        ? 'the server needs a certificate that is current and names this address; trusting it would not help. Never disable TLS verification.'
+        : `run quox connect ${err.quoxUrl}${profile} (it shows the SHA256 fingerprint and asks y/N); with no terminal use quox connect ${err.quoxUrl}${profile} --trust-cert, or --fingerprint <sha256> to pin it. Never disable TLS verification.`,
+      more: [`TLS error: ${tlsCode}`] };
+  }
   const first = message.split('\n')[0];
   return { headline: sentence(first || 'Something went wrong'), next: null, more: message.split('\n').slice(1), stack: true };
 }
@@ -404,6 +453,7 @@ function renderContract(err, ex, ctx) {
   }
   if (err.detail) console.error(chalk.dim(`  Detail: ${renderDetail(err.detail)}`));
   if (isVerbose(ctx)) {
+    if (err.debug) console.error(chalk.dim(`  Debug: ${renderDetail(err.debug)}`));
     if (err.status) console.error(chalk.dim(`  Status: ${err.status} ${typeof err.code === 'object' && err.code ? renderDetail(err.code) : (err.code || '')}`));
     if (err instanceof QuoxApiError && err.message && err.message !== ex.headline) console.error(chalk.dim(`  Server said: ${err.message}`));
     for (const line of ex.more || []) if (line) console.error(chalk.dim(`  More: ${line}`));
@@ -420,6 +470,7 @@ export function handleError(err, outputFormat = 'table', ctx = null) {
     };
     if (err.status) obj.status = err.status;
     if (err.detail) obj.detail = err.detail;
+    if (err.debug) obj.debug = err.debug; // plumbing kept out of the headline, still there for scripts
     // LL-3d: scripts parsing --json get the server's own body verbatim, not
     // our prose rendering of it.
     if (err.body && typeof err.body === 'object') obj.body = err.body;

package/lib/core/governedSession.js

@@ -12,7 +12,18 @@ import os from 'node:os';
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync as realSpawnSync } from 'node:child_process';
-import { qArt, colorOn } from './banner.js';
+import { colorOn } from './banner.js';
+import { qLines, qDims } from '../quoxon/qart.js';
+
+/**
+ * The session banner's Q is quoxon's settled vector horned-Q (the face of the app, same mark as
+ * bare `quox` and cli.quox.ai), not the old half-block bitmap. 'small' for a narrow terminal, 'mid'
+ * otherwise. Returns the art rows and their visible width (used to pad the text column alignment).
+ */
+function introArt(color, cols) {
+  const size = cols && cols < 72 ? 'small' : 'mid';
+  return { lines: qLines(size, { color }), width: qDims(size).cols };
+}
 import { startHeartbeat as realStartHeartbeat } from './sessionHeartbeat.js';
 
 const NAME_RE = /^[A-Za-z0-9._-]{1,48}$/;
@@ -160,10 +171,10 @@ export function howItWorksLines({ name, program = 'claude', bare }) {
   ];
 }
 
-export function renderIntro({ name, host, mode, tmuxSession, note, program = 'claude', preattach }, { color = false } = {}) {
+export function renderIntro({ name, host, mode, tmuxSession, note, program = 'claude', preattach }, { color = false, cols = process.stdout?.columns } = {}) {
   const b = (s) => (color ? `\x1b[1m${s}\x1b[0m` : s);
   const d = (s) => (color ? `\x1b[2m${s}\x1b[0m` : s);
-  const art = qArt(color);
+  const { lines: art, width: artW } = introArt(color, cols);
   const modeText = {
     NEW: 'NEW',
     REATTACH: 'REATTACH (same process, no context reload)',
@@ -182,7 +193,7 @@ export function renderIntro({ name, host, mode, tmuxSession, note, program = 'cl
     b('How this works'),
     ...howItWorksLines({ name, program }).map(([k, v]) => `${d(k.padEnd(19))}${v}`),
   ];
-  const w = art[0] ? 14 : 0;
+  const w = art[0] ? artW : 0;
   const lines = [];
   for (let i = 0; i < Math.max(art.length, text.length); i++) {
     lines.push(`  ${art[i] || ' '.repeat(w)}   ${text[i] || ''}`);
@@ -254,7 +265,108 @@ export function ensureHelpBinding(d) {
   return r && r.status === 0 ? 'bound' : 'failed';
 }
 
-export function runGoverned({ program = 'claude', name, args = [], resume = false, noTmux = false, bin, preattach }, over) {
+/**
+ * SESSION-LAUNCH-DEDUPE: tmux session names are case-sensitive but conversation names are not, so
+ * `--resume quoxon` must find `quox-QUOXON`. Returns the real session name or null.
+ */
+export function findSessionCI(d, wanted) {
+  const r = d.spawnSync('tmux', ['list-sessions', '-F', '#{session_name}'], { encoding: 'utf8' });
+  if (!r || r.error || r.status !== 0) return null;
+  const w = String(wanted).toLowerCase();
+  const names = String(r.stdout || '').split('\n').map((l) => l.split('\t')[0].trim()).filter(Boolean);
+  return names.find((n) => n.toLowerCase() === w) || null;
+}
+
+const PS_RE = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/;
+const base = (t) => String(t || '').split('/').pop();
+
+/** True when argv is a claude process resuming `name` (case-insensitive), also via `node .../claude`. */
+export function resumesName(args, name) {
+  const t = String(args).trim().split(/\s+/);
+  let i = 0;
+  if (base(t[0]) === 'node' && base(t[1]) === 'claude') i = 1;
+  else if (base(t[0]) !== 'claude') return false;
+  const want = String(name).toLowerCase();
+  for (let k = i + 1; k < t.length; k++) {
+    if ((t[k] === '--resume' || t[k] === '-r') && String(t[k + 1] || '').toLowerCase() === want) return true;
+    if (t[k].startsWith('--resume=') && t[k].slice(9).toLowerCase() === want) return true;
+  }
+  return false;
+}
+
+/** Live claude processes already holding conversation `name`: [{ pid, tty, tmux }]. */
+export function findLiveHolders(d, name) {
+  const ps = d.spawnSync('ps', ['-eo', 'pid=,ppid=,tty=,args='], { encoding: 'utf8' });
+  if (!ps || ps.error || ps.status !== 0) return [];
+  const procs = new Map();
+  for (const line of String(ps.stdout || '').split('\n')) {
+    const m = PS_RE.exec(line);
+    if (m) procs.set(Number(m[1]), { pid: Number(m[1]), ppid: Number(m[2]), tty: m[3], args: m[4] });
+  }
+  const self = d.pid ?? process.pid;
+  const hits = [...procs.values()].filter((p) => p.pid !== self && p.pid !== process.ppid && resumesName(p.args, name));
+  if (!hits.length) return [];
+  const panes = new Map();
+  const lp = d.spawnSync('tmux', ['list-panes', '-a', '-F', '#{pane_pid} #{session_name}'], { encoding: 'utf8' });
+  if (lp && !lp.error && lp.status === 0) {
+    for (const l of String(lp.stdout || '').split('\n')) {
+      const m = /^(\d+)\s+(\S+)$/.exec(l.trim());
+      if (m) panes.set(Number(m[1]), m[2]);
+    }
+  }
+  return hits.map((p) => {
+    let tmux = null;
+    for (let pid = p.pid, hops = 0; pid > 1 && hops < 32 && !tmux; hops++) { tmux = panes.get(pid) || null; pid = procs.get(pid)?.ppid ?? (hops === 0 ? p.ppid : 0); }
+    return { pid: p.pid, tty: p.tty, tmux };
+  });
+}
+
+/** The conversation name a claude argv resumes (`--resume X`, `-r X`, `--resume=X`), or null. */
+function resumedName(args) {
+  const t = String(args).trim().split(/\s+/);
+  let i = 0;
+  if (base(t[0]) === 'node' && base(t[1]) === 'claude') i = 1;
+  else if (base(t[0]) !== 'claude') return null;
+  for (let k = i + 1; k < t.length; k++) {
+    if ((t[k] === '--resume' || t[k] === '-r') && t[k + 1]) return t[k + 1];
+    if (t[k].startsWith('--resume=') && t[k].length > 9) return t[k].slice(9);
+  }
+  return null;
+}
+
+const PS_AGE_RE = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(\d+)\s+(.*)$/;
+
+/**
+ * Every live `claude --resume <name>` on this box (same argv detection as findLiveHolders):
+ * [{ name, pid, tty, tmux, ageSec }]. tmux is the enclosing tmux session or null. [] if ps fails.
+ */
+export function listLiveSessions(d) {
+  const ps = d.spawnSync('ps', ['-eo', 'pid=,ppid=,tty=,etimes=,args='], { encoding: 'utf8' });
+  if (!ps || ps.error || ps.status !== 0) return [];
+  const procs = new Map();
+  for (const line of String(ps.stdout || '').split('\n')) {
+    const m = PS_AGE_RE.exec(line);
+    if (m) procs.set(Number(m[1]), { pid: Number(m[1]), ppid: Number(m[2]), tty: m[3], ageSec: Number(m[4]), args: m[5] });
+  }
+  const self = d.pid ?? process.pid;
+  const hits = [...procs.values()].filter((p) => p.pid !== self && resumedName(p.args));
+  if (!hits.length) return [];
+  const panes = new Map();
+  const lp = d.spawnSync('tmux', ['list-panes', '-a', '-F', '#{pane_pid} #{session_name}'], { encoding: 'utf8' });
+  if (lp && !lp.error && lp.status === 0) {
+    for (const l of String(lp.stdout || '').split('\n')) {
+      const m = /^(\d+)\s+(\S+)$/.exec(l.trim());
+      if (m) panes.set(Number(m[1]), m[2]);
+    }
+  }
+  return hits.map((p) => {
+    let tmux = null;
+    for (let pid = p.pid, hops = 0; pid > 1 && hops < 32 && !tmux; hops++) { tmux = panes.get(pid) || null; pid = procs.get(pid)?.ppid ?? (hops === 0 ? p.ppid : 0); }
+    return { name: resumedName(p.args), pid: p.pid, tty: p.tty, tmux, ageSec: p.ageSec };
+  });
+}
+
+export function runGoverned({ program = 'claude', name, args = [], resume = false, noTmux = false, force = false, bin, preattach }, over) {
   const d = defaults(over);
   const n = name || autoName(d.now());
   if (program === 'run') {
@@ -281,6 +393,24 @@ export function runGoverned({ program = 'claude', name, args = [], resume = fals
       return 1;
     }
     alive = r.status === 0;
+    if (!alive && resume && program === 'claude') {
+      const real = findSessionCI(d, PREFIX + full);
+      if (real) {
+        // Same conversation, different case: attach, never start a second Claude.
+        const attach = `tmux attach -t ${real}`;
+        if (!(d.isTTY ?? process.stdout.isTTY)) { d.write(`${n} is already running in tmux ${real}. Attach: ${attach}\n`); return 0; }
+        const a = d.spawnSync('tmux', ['attach-session', '-t', real], { stdio: 'inherit' });
+        return a && typeof a.status === 'number' ? a.status : 0;
+      }
+    }
+  }
+  if (!alive && resume && program === 'claude' && !force) {
+    const [h] = findLiveHolders(d, n);
+    if (h) {
+      const where = h.tmux ? `tmux ${h.tmux}` : `not in tmux on ${h.tty}`;
+      d.write(`${n} is already running (pid ${h.pid}, ${where}). ${h.tmux ? `Attach: tmux attach -t ${h.tmux}. ` : ''}To start a second copy anyway: --force.\n`);
+      return 1;
+    }
   }
   const plan = planLaunch({ name: n, args, env: d.env, alive, resume, noTmux, program, bin, preattach });
   const shown = program === 'run' ? bin : program;

package/lib/core/inboxResolution.js

@@ -41,13 +41,14 @@ export function humanUtc(iso) {
 export function resolutionFromItem(item, requestedAction) {
   if (!item || !item.id) return null;
   const response = item.response || null;
-  const outcome = item.status === 'expired' ? 'expired' : item.status === 'cancelled' ? 'cancelled' : (outcomeOf(response) || 'resolved');
+  const outcome = item.status === 'expired' ? 'expired' : item.status === 'cancelled' ? 'cancelled' : item.status === 'withdrawn' ? 'withdrawn' : (outcomeOf(response) || 'resolved');
   const name = item.resolved_by_name || response?.responded_by_name || null;
   const at = toIso(item.resolved_at) || toIso(response?.responded_at) || null;
   const requested = String(requestedAction || '').trim().toLowerCase() || null;
-  const matches = Boolean(requested) && outcome !== 'expired' && outcome !== 'cancelled' && normalise(requested) === outcome;
+  const matches = Boolean(requested) && outcome !== 'expired' && outcome !== 'cancelled' && outcome !== 'withdrawn' && normalise(requested) === outcome;
   let message;
   if (outcome === 'expired') message = `This approval expired at ${humanUtc(at)}; nothing was approved. Ask for it again.`;
+  else if (outcome === 'withdrawn') message = `This request was withdrawn at ${humanUtc(at)}${name ? ` by ${name}` : ''}; nothing was decided and nothing ran.`;
   else if (outcome === 'cancelled') message = `This item was cancelled at ${humanUtc(at)}${name ? ` by ${name}` : ''}; there is nothing to respond to.`;
   else {
     const head = `Already ${outcome}${name ? ` by ${name}` : ''} at ${humanUtc(at)}`;

package/lib/core/loginGuard.js

@@ -0,0 +1,73 @@
+/**
+ * Login guards shared by `quox login` and the TUI /login.
+ *  - prefill comes ONLY from the active profile's own last_email
+ *  - a non-default profile signing in as an email another profile already holds gets a y/N warning
+ *  - a 429 says how long to wait (or that retrying may extend the limit)
+ */
+
+/** The active profile's own last_email, or ''. Never another profile's, never a global. */
+export function loginPrefillEmail(config) {
+  try { return String(config.getActiveProfile?.()?.last_email || '').trim(); } catch { return ''; }
+}
+
+/** A server URL reduced to scheme://host:port so https://H, https://h/ and https://h:443 compare equal. '' when not a URL. */
+export function normalizeServerUrl(u) {
+  try { const x = new URL(String(u)); return `${x.protocol}//${x.hostname.toLowerCase()}:${x.port || (x.protocol === 'https:' ? '443' : '80')}`; } catch { return ''; }
+}
+
+/**
+ * Name of ANOTHER profile currently signed in as `email` (case-insensitive), else null.
+ * H2: the same email on a DIFFERENT server is a different account. When `url` (the server this sign-in targets) is
+ * given and the other profile has its own server URL that differs, it does not count. A profile with no URL of its
+ * own is unknown, so it still counts (the safe side for an identity guard).
+ */
+export function profileHoldingEmail(config, email, url = null) {
+  const want = String(email || '').trim().toLowerCase();
+  if (!want) return null;
+  const me = config.getActiveProfileName?.();
+  for (const [name, p] of Object.entries(config._data?.profiles || {})) {
+    if (name === me) continue;
+    if (String(p?.auth?.email || '').trim().toLowerCase() !== want) continue;
+    const mine = normalizeServerUrl(url), theirs = normalizeServerUrl(p?.url);
+    if (mine && theirs && mine !== theirs) continue;
+    return name;
+  }
+  return null;
+}
+
+/** Only a non-default profile needs the warning: it is how agent-only profiles become the owner. */
+export function isNonDefaultProfile(config) {
+  return Boolean(config._data?.activeProfile) && config.getActiveProfileName?.() !== config._data.activeProfile;
+}
+
+export function sameIdentityWarning(email, holder, profile) {
+  return `${email} is already signed in as profile '${holder}'. Sign profile '${profile}' in as the same user? y/N`;
+}
+
+/** Plain-language wait guidance for a rate-limited sign-in. */
+export function rateLimitHint({ retryAfterMs } = {}) {
+  if (Number.isFinite(retryAfterMs) && retryAfterMs > 0) {
+    const min = Math.max(1, Math.ceil(retryAfterMs / 60000));
+    return `Too many authentication attempts: try again in ~${min} min; each retry may extend the limit.`;
+  }
+  return 'Too many authentication attempts: wait a few minutes; retrying now may extend the limit.';
+}
+
+/** Retry-After (seconds or HTTP date) header and common body fields -> ms, else null. */
+export function retryAfterMsFrom(res, data) {
+  const h = res?.headers?.get?.('retry-after');
+  if (h != null && h !== '') {
+    const n = Number(h);
+    if (Number.isFinite(n)) return n * 1000;
+    const t = Date.parse(h);
+    if (Number.isFinite(t)) return Math.max(0, t - Date.now());
+  }
+  const s = data?.retry_after ?? data?.retryAfter ?? data?.retry_after_seconds;
+  if (Number.isFinite(Number(s)) && s != null) return Number(s) * 1000;
+  const reset = data?.reset_at ?? data?.resetAt ?? data?.reset;
+  if (reset != null) {
+    const t = typeof reset === 'number' ? (reset < 1e12 ? reset * 1000 : reset) : Date.parse(reset);
+    if (Number.isFinite(t)) return Math.max(0, t - Date.now());
+  }
+  return null;
+}

package/lib/core/offload.js

@@ -531,3 +531,40 @@ export function gitToplevel(cwd) {
   const r = spawnSync('git', ['rev-parse', '--show-toplevel'], { cwd, encoding: 'utf8' });
   return r.status === 0 ? r.stdout.trim() : cwd;
 }
+
+// #1485: the git repo root for cwd, or null when cwd is not inside a repo.
+// Unlike gitToplevel (which falls back to cwd), this reports the no-repo case
+// so resolveSyncDir can refuse rather than sync an unbounded tree.
+export function gitRepoRoot(cwd, { run = (c, a, o) => spawnSync(c, a, o) } = {}) {
+  const r = run('git', ['rev-parse', '--show-toplevel'], { cwd, encoding: 'utf8' });
+  return r.status === 0 ? r.stdout.trim() : null;
+}
+
+// #1485: resolve the ONE directory offload rsyncs to the shared worker, and
+// refuse an unbounded one. `quox offload` from a non-repo dir used to fall
+// back to cwd, so running it from the home directory rsynced all ~29G of $HOME
+// (including a live token file) onto the worker and filled its disk. The sync
+// must be a bounded git repo root, never $HOME and never an ancestor of it.
+export function resolveSyncDir(cwd, optionDir, { home = os.homedir(), repoRoot = gitRepoRoot } = {}) {
+  const h = path.resolve(home);
+  const guardHome = (dir, what) => {
+    if (dir === h) {
+      throw new OffloadError(`offload refuses to sync your home directory (${dir}). cd into a project repo, or pass --dir <repo-root>.`);
+    }
+    if (h === dir || h.startsWith(dir + path.sep) || dir === path.parse(dir).root) {
+      throw new OffloadError(`offload refuses to sync ${what} (${dir}): it contains your home directory, so the whole tree would be copied to the shared worker. Pass --dir <repo-root>.`);
+    }
+  };
+  if (optionDir) {
+    const d = path.resolve(optionDir);
+    guardHome(d, 'the --dir path');
+    return d;
+  }
+  const root = repoRoot(cwd);
+  if (!root) {
+    throw new OffloadError(`offload must run from inside a git repository (cwd ${cwd} is not one). cd into a repo, or pass --dir <repo-root>. Refusing so your whole home directory is not synced to the shared worker.`);
+  }
+  const d = path.resolve(root);
+  guardHome(d, 'the resolved repo root');
+  return d;
+}

package/lib/core/org-override.js

@@ -20,6 +20,10 @@ import { QuoxValidationError } from './errors.js';
 // Commands where --org legitimately means something other than "act in".
 export const EXEMPT = new Set(['login', 'logout', 'signup', 'org switch', 'invites list', 'invites accept']);
 
+// Verbs that mint a same-user token for the named org themselves (core/crossOrgApprovals.clientForTarget), so --org
+// naming another org is honoured on that org, not refused. Membership is enforced server-side by the mint.
+export const CROSS_ORG = new Set(['approvals list', 'approvals approve', 'approvals deny', 'approvals walkthrough']);
+
 export function commandPath(cmd) {
   const parts = [];
   for (let c = cmd; c && c.parent; c = c.parent) parts.unshift(c.name());
@@ -35,7 +39,7 @@ export function commandPath(cmd) {
  * @throws {QuoxValidationError} when the override differs from the session org
  */
 export function assertOrgOverrideSafe({ override, authData, hasUserToken, command = '' }) {
-  if (!override || !hasUserToken || EXEMPT.has(command)) return;
+  if (!override || !hasUserToken || EXEMPT.has(command) || CROSS_ORG.has(command)) return;
   const want = String(override).toLowerCase();
   const sid = authData?.org_id || null;
   const known = [sid, authData?.org_slug, authData?.org_name]

package/lib/core/output.js

@@ -45,7 +45,7 @@ export function formatOutput(result, options = {}) {
       formatCsv(rows, columns, headers);
       break;
     case 'quiet':
-      formatQuiet(rows, columns);
+      formatQuiet(rows, options.quietColumn ? [options.quietColumn] : columns);
       break;
     default:
       formatTable(rows, columns, headers, options);

package/lib/core/profileTrust.js

@@ -0,0 +1,182 @@
+/**
+ * ONBOARD-P1: per-profile trust for a server's own certificate (`quox connect`).
+ *
+ * A new QuoxCORE serves a self-signed edge certificate. The sanctioned fix is to trust THAT certificate, for the
+ * profile that talks to that server, and nowhere else. This module:
+ *   - reads the certificate chain a server presents (a handshake only: nothing is ever sent over it, the
+ *     certificate is shown to the user and trusted only after they say yes),
+ *   - refuses what trusting cannot fix (expired, wrong name),
+ *   - stores the PEM under ~/.config/quox/certs/<profile>.pem and records it on the profile as `caCert`,
+ *   - makes later requests for that profile trust it: bin/quox.js re-runs itself once with NODE_EXTRA_CA_CERTS
+ *     set to the profile's file (Node 20 has no per-request CA for the built-in fetch). The global environment
+ *     is never touched, and TLS verification is never turned off.
+ */
+import tls from 'node:tls';
+import https from 'node:https';
+import { createHash, X509Certificate } from 'node:crypto';
+import { existsSync, mkdirSync, writeFileSync, chmodSync, readFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { getConfigDir, getConfigFile, resolveProfileFlagFromArgv } from './config.js';
+
+const CODES_TRUST_CAN_FIX = new Set(['DEPTH_ZERO_SELF_SIGNED_CERT', 'SELF_SIGNED_CERT_IN_CHAIN', 'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'UNABLE_TO_GET_ISSUER_CERT', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY']);
+export const isTrustFixable = (code) => CODES_TRUST_CAN_FIX.has(code);
+
+const TLS_SENTENCE_CODES = new Set([...CODES_TRUST_CAN_FIX, 'CERT_HAS_EXPIRED', 'ERR_TLS_CERT_ALTNAME_INVALID']);
+/**
+ * H4: one plain sentence for a TLS certificate failure, with the fix. undici reports all of these as a bare
+ * "fetch failed". -> null when `code` is not a certificate-trust code.
+ * A self-signed or unknown-issuer certificate is fixed by trusting it for one profile; an expired or wrong-name
+ * certificate is NOT (trusting a file would not cure it), so those say what does.
+ */
+export function tlsFailureSentence(code, url) {
+  if (!TLS_SENTENCE_CODES.has(code)) return null;
+  if (code === 'CERT_HAS_EXPIRED') return `${url} presents a certificate that has expired (${code}). Trusting it would not help: the server needs a new certificate.`;
+  if (code === 'ERR_TLS_CERT_ALTNAME_INVALID') return `${url} presents a certificate that does not name the address you used (${code}). Use an address the certificate names; trusting it would not help.`;
+  return `${url} presents a certificate this machine does not trust: it is self-signed or its issuer is unknown (${code}). If this is your own server, check its fingerprint and trust it for one profile only: quox connect ${url} --trust-cert`;
+}
+
+export const certDir = () => join(getConfigDir(), 'certs');
+const safeName = (profile) => String(profile).replace(/[^A-Za-z0-9._-]/g, '_').replace(/\.{2,}/g, '_');
+export const certPathFor = (profile) => join(certDir(), `${safeName(profile)}.pem`);
+
+/** A short, filesystem- and shell-safe profile name derived from a server URL (203.0.113.10:3000 -> 203-0-113-10). */
+export function profileNameForUrl(url) {
+  try { return new URL(url).hostname.replace(/[^A-Za-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'server'; } catch { return 'server'; }
+}
+
+const pemOf = (der) => `-----BEGIN CERTIFICATE-----\n${der.toString('base64').match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----\n`;
+export const fingerprint256 = (der) => createHash('sha256').update(der).digest('hex').toUpperCase().match(/../g).join(':');
+
+/**
+ * Read the certificate chain `url` presents. -> { host, port, chain: [{ subject, issuer, validFrom, validTo, san,
+ * fingerprint256, pem, isCA, selfSigned }], leaf } . Throws a plain Error when there is no TLS answer.
+ * The handshake runs with chain validation off ONLY so the certificate can be read; the socket is destroyed
+ * before any byte of application data, so nothing is trusted and nothing is sent.
+ */
+export function readPeerChain(url, { timeout = 5000, connect = tls.connect } = {}) {
+  const u = new URL(url);
+  if (u.protocol !== 'https:') return Promise.reject(new Error('the address is not https://, so there is no certificate to trust'));
+  const host = u.hostname;
+  const port = Number(u.port || 443);
+  return new Promise((resolve, reject) => {
+    const isIp = /^[\d.]+$/.test(host) || host.includes(':');
+    const sock = connect({ host, port, servername: isIp ? undefined : host, rejectUnauthorized: false, timeout }, () => {
+      try {
+        const peer = sock.getPeerCertificate(true);
+        sock.destroy();
+        if (!peer || !peer.raw) return reject(new Error('the server presented no certificate'));
+        const seen = new Set();
+        const chain = [];
+        for (let c = peer; c && c.raw && !seen.has(c.fingerprint256); c = c.issuerCertificate) {
+          seen.add(c.fingerprint256);
+          let isCA = false;
+          try { isCA = Boolean(new X509Certificate(c.raw).ca); } catch { /* unreadable: not a CA */ }
+          const fp = fingerprint256(c.raw);
+          chain.push({
+            subject: c.subject?.CN || Object.values(c.subject || {}).join(' ') || '(no subject)',
+            issuer: c.issuer?.CN || Object.values(c.issuer || {}).join(' ') || '(no issuer)',
+            validFrom: c.valid_from, validTo: c.valid_to, san: c.subjectaltname || '',
+            fingerprint256: fp, pem: pemOf(c.raw), isCA,
+            selfSigned: JSON.stringify(c.subject) === JSON.stringify(c.issuer)
+          });
+        }
+        resolve({ host, port, chain, leaf: peer });
+      } catch (e) { sock.destroy(); reject(e); }
+    });
+    sock.on('error', (e) => reject(Object.assign(new Error(e.message), { code: e.code })));
+    sock.on('timeout', () => { sock.destroy(); reject(Object.assign(new Error(`no answer within ${Math.round(timeout / 1000)} s`), { code: 'TIMEOUT' })); });
+  });
+}
+
+/** Trusting a certificate only fixes an untrusted-but-valid one. -> null when fine, else the reason it cannot be trusted. */
+export function untrustableReason(peer, host, { now = Date.now(), checkServerIdentity = tls.checkServerIdentity } = {}) {
+  const from = Date.parse(peer.leaf?.valid_from), to = Date.parse(peer.leaf?.valid_to);
+  if (Number.isFinite(to) && to < now) return `its certificate expired on ${peer.leaf.valid_to}. Trusting it would not help; the server needs a new certificate.`;
+  if (Number.isFinite(from) && from > now) return `its certificate is not valid until ${peer.leaf.valid_from} (check this machine's clock).`;
+  const err = checkServerIdentity(host, peer.leaf);
+  if (err) return `its certificate does not name ${host} (${(peer.leaf?.subjectaltname || 'no names').replace(/IP Address:/g, '')}). Trusting it would not help; use an address the certificate names.`;
+  return null;
+}
+
+/** The card the user compares with `quox server status` on the server. */
+export function certCard(url, peer) {
+  const leaf = peer.chain[0];
+  const lines = [
+    `${url} presents this certificate:`,
+    `  Subject      ${leaf.subject}`,
+    `  Issuer       ${leaf.selfSigned ? `${leaf.issuer} (self-signed)` : leaf.issuer}`,
+    `  Names        ${leaf.san.replace(/IP Address:/g, 'IP:') || '(none listed)'}`,
+    `  Valid        ${leaf.validFrom} to ${leaf.validTo}`,
+    `  SHA256       ${leaf.fingerprint256}`
+  ];
+  for (const c of peer.chain.slice(1)) lines.push(`  Signed by    ${c.subject}  SHA256 ${c.fingerprint256}`);
+  lines.push('Compare the SHA256 with the one on the server (run `quox server status` there) before you trust it.');
+  return lines.join('\n');
+}
+
+/** Write the chain's PEM for `profile` (0600 file in a 0700 directory). -> the path. */
+export function storeProfileCert(profile, peer) {
+  const dir = certDir();
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { chmodSync(dir, 0o700); } catch { /* best effort */ }
+  const file = certPathFor(profile);
+  writeFileSync(file, peer.chain.map((c) => c.pem).join(''), { mode: 0o600 });
+  try { chmodSync(file, 0o600); } catch { /* best effort */ }
+  return file;
+}
+export function removeProfileCert(profile) { try { unlinkSync(certPathFor(profile)); } catch { /* not there */ } }
+
+/** A fetch-shaped function that trusts exactly `ca` (a PEM string) for this one request. For probeQuoxCore. */
+export function fetchTrusting(ca, { request = https.request } = {}) {
+  return (target, { signal, headers } = {}) => new Promise((resolve, reject) => {
+    const req = request(target, { ca, headers, signal, method: 'GET' }, (res) => {
+      const chunks = [];
+      res.on('data', (d) => chunks.push(d));
+      res.on('end', () => {
+        const body = Buffer.concat(chunks).toString('utf8');
+        resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode, text: async () => body });
+      });
+      res.on('error', reject);
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+/** The CA file recorded on `profileName` in a parsed config object, if it exists on disk. */
+export function profileCaPath(configData, profileName, { exists = existsSync } = {}) {
+  const f = configData?.profiles?.[profileName]?.caCert;
+  return typeof f === 'string' && f && exists(f) ? f : null;
+}
+
+/**
+ * bin/quox.js calls this first. When the profile this run uses has a stored server certificate (and the user has
+ * not set their own NODE_EXTRA_CA_CERTS), re-run the same command with NODE_EXTRA_CA_CERTS set to it, for this
+ * process tree only. -> an exit code when it ran the command, or null (carry on in this process).
+ */
+export function reexecWithProfileTrust(argv, env = process.env, {
+  readConfig = () => JSON.parse(readFileSync(getConfigFile(), 'utf8')),
+  spawn = spawnSync, exists = existsSync, execPath = process.execPath, execArgv = process.execArgv, script = process.argv[1]
+} = {}) {
+  // A NODE_EXTRA_CA_CERTS the user set themselves always wins. One WE set (QUOX_PROFILE_TRUST_APPLIED names the file)
+  // belongs to the profile that set it: a nested `quox -p other` must not inherit it.
+  const ours = env.QUOX_PROFILE_TRUST_APPLIED && env.NODE_EXTRA_CA_CERTS === env.QUOX_PROFILE_TRUST_APPLIED;
+  if (env.NODE_EXTRA_CA_CERTS && !ours) return null;
+  let data;
+  try { data = readConfig(); } catch { return null; }
+  const name = resolveProfileFlagFromArgv(argv) || env.QUOX_PROFILE || data?.activeProfile;
+  const ca = name ? profileCaPath(data, name, { exists }) : null;
+  if (ours ? ca === env.NODE_EXTRA_CA_CERTS : !ca) return null; // already right, or nothing to apply
+  const childEnv = { ...env };
+  if (ca) { childEnv.NODE_EXTRA_CA_CERTS = ca; childEnv.QUOX_PROFILE_TRUST_APPLIED = ca; }
+  else { delete childEnv.NODE_EXTRA_CA_CERTS; delete childEnv.QUOX_PROFILE_TRUST_APPLIED; }
+  // Ctrl-C reaches the whole foreground group; the child handles it, this parent must outlive it to pass on the code.
+  const hold = () => {};
+  process.on('SIGINT', hold);
+  try {
+    const r = spawn(execPath, [...execArgv, script, ...argv], { stdio: 'inherit', env: childEnv });
+    if (typeof r.status === 'number') return r.status;
+    return r.signal === 'SIGINT' ? 130 : 1;
+  } finally { process.removeListener('SIGINT', hold); }
+}