quoxcli 0.4.0 → 0.5.0

package/lib/commands/approvals.js

@@ -8,9 +8,23 @@
 import { resolveEndpoint } from '../api/endpoints.js';
 
 import { attachWalkthrough } from './walkthrough.js';
+import { resolveOrgId } from './helpers.js';
+import { confirmInteractive, askTyped } from '../core/confirm.js';
+import { QuoxUserError } from '../core/errors.js';
+import { announce, announceFailure, announceOnFail } from '../core/announce.js';
+import { withStepUp } from '../core/stepUpPrompt.js';
+import { formatOutput, printSuccess } from '../core/output.js';
+import { needsPin } from '../quoxon/approvalsView.js';
+import { describeInboxItem, approvalSourceLabel } from '../quoxon/events.js';
+import { runCallMe, statusLines } from '../core/callMe.js';
+import { isDestructive, destructiveObject } from '../quoxon/destructive.js';
+import { otherOrgsWaiting, crossOrgLines, clientForTarget } from '../core/crossOrgApprovals.js';
 
 export function registerApprovalsCommands(program, ctx) {
-  const { client, auth } = ctx;
+  const { client: baseClient, auth, clientForOrg } = ctx;
+  // The client for the org a verb targets: --org another org (a verb in CROSS_ORG, see core/org-override.js) uses that org's own token.
+  const clientFor = (orgId) => clientForTarget({ client: baseClient, clientForOrg, sessionOrgId: auth.getOrgId(), orgId });
+  const client = baseClient; // `result`, grants and the rest stay on the session org
 
   const approvals = program
     .command('approvals')
@@ -39,6 +53,10 @@ export function registerApprovalsCommands(program, ctx) {
         const via = data.decided_via && data.decided_via.channel ? ` via ${data.decided_via.channel}` : '';
         console.log(`decided by ${who} (${data.decided_by.actor_type || 'user'})${via} at ${data.decided_at || 'unknown time'}`);
       }
+      if (data.human_decision) {
+        const hd = { yes: 'yes (a person approved it with a verified step-up PIN)', no: 'no (not human-verified: denied, withdrawn, expired, approved by an agent, or approved without a verified PIN)', pending: 'pending' }[data.human_decision] || data.human_decision;
+        console.log(`human decision: ${hd}`);
+      }
       if (data.result === null || data.result === undefined) {
         if (data.status === 'pending') console.log('Still pending: a human has not decided yet.');
         else if (data.status === 'resuming') console.log('Approved, executing. Re-run shortly.');
@@ -53,6 +71,26 @@ export function registerApprovalsCommands(program, ctx) {
       else console.log(JSON.stringify(r, null, 2));
     });
 
+  // Call-me: the switch for the ApprovalsQ watcher that phones a human when a high-risk
+  // approval sits unanswered. It never approves anything; the call only asks the human.
+  approvals
+    .command('call-me [action]')
+    .description('Phone me when a high-risk approval sits unanswered: status (default), on or off (human org admin only)')
+    .option('--after <minutes>', 'ring after this many minutes unanswered (1-1440)')
+    .option('--quiet <HH:MM-HH:MM>', 'quiet hours, no calls in this window (e.g. 22:00-08:00)')
+    .action(announceOnFail('quox', 'approvals call-me', async (action, options) => {
+      auth.requireAuth();
+      const act = action || 'status';
+      if (act === 'status' && (options.after || options.quiet)) {
+        throw new QuoxUserError('--after and --quiet change the policy: use `quox approvals call-me on --after 10` (or off).', { code: 'bad_args' });
+      }
+      const { data, changed } = await runCallMe(client, { action: act, after: options.after, quiet: options.quiet });
+      if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      const p = (data && data.policy) || {};
+      announce('quox', 'approvals call-me', { result: `${changed ? 'set ' : ''}${p.enabled ? `ON after ${p.age_threshold_minutes} min` : 'OFF'}` });
+      for (const l of statusLines(data)) console.log(l);
+    }));
+
   // Fleet standing grants: an org admin pre-approves ONE host + an anchored command
   // shape + a VMID range until an expiry, for ssh_exec. Every use still lands in
   // approvals history with an AEE envelope; anything outside the grant files HITL.
@@ -61,7 +99,7 @@ export function registerApprovalsCommands(program, ctx) {
     .description('Standing grants: org-admin pre-approved fleet command lanes (ssh_exec)');
 
   grants
-    .command('list')
+    .command('list', { isDefault: true })
     .description('List active standing grants (--all includes revoked and expired)')
     .option('--all', 'include revoked and expired grants')
     .action(async (options) => {
@@ -74,7 +112,7 @@ export function registerApprovalsCommands(program, ctx) {
       for (const g of rows) {
         const state = g.revoked_at ? `revoked ${g.revoked_at}` : `expires ${g.expires_at}`;
         const range = g.vmid_min != null ? `  vmids ${g.vmid_min}-${g.vmid_max}` : '';
-        console.log(`${g.grant_id}  ${g.tool}@${g.host}${range}  ${g.preset || `${g.patterns.length} patterns`}  uses ${g.use_count}  ${state}`);
+        console.log(`${g.tool} on ${g.host}${range}  ${g.preset || `${(g.patterns || []).length} patterns`}  uses ${g.use_count}  ${state}  [${g.grant_id}]`);
         console.log(`  reason: ${g.reason}  (by ${g.created_by})`);
       }
     });
@@ -107,6 +145,7 @@ export function registerApprovalsCommands(program, ctx) {
       const data = await client.post(ep.path, { service: ep.service, body });
       if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
       const g = data.grant || {};
+      announce('approvals', `grant created ${g.tool || 'ssh_exec'}@${g.host || options.host}`, { result: g.grant_id });
       console.log(`Created ${g.grant_id}: ${g.tool}@${g.host}${g.vmid_min != null ? ` vmids ${g.vmid_min}-${g.vmid_max}` : ''}, expires ${g.expires_at}`);
       console.log(`Revoke any time: quox approvals grants revoke ${g.grant_id}`);
     });
@@ -119,6 +158,157 @@ export function registerApprovalsCommands(program, ctx) {
       const ep = resolveEndpoint('v1.approvals.grants.revoke', { id: grantId });
       const data = await client.post(ep.path, { service: ep.service, body: {} });
       if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      announce('approvals', `grant revoked ${grantId}`);
       console.log(`Revoked ${data.grant?.grant_id || grantId} at ${data.grant?.revoked_at || 'now'}.`);
     });
+
+  // ---- list | approve | deny: the verb people expect, over the SAME server path as `quox inbox respond`.
+  const OPEN_QUERY = { status: 'open', kind: 'approval', limit: 200 };
+  const listOpen = async (orgId, status, cl = client) => {
+    const ep = resolveEndpoint('inbox.list', { orgId });
+    const data = await cl.get(ep.path, { service: ep.service, query: { ...OPEN_QUERY, ...(status ? { status } : {}) } });
+    const items = (data && (data.items || data)) || [];
+    return Array.isArray(items) ? items : [];
+  };
+  const shortId = (id) => String(id).slice(-6);
+
+  async function pickApproval(orgId, given, cl = client) {
+    const want = String(given).trim().toUpperCase();
+    const items = await listOpen(orgId, undefined, cl);
+    const hits = items.filter((it) => {
+      const id = String(it.id).toUpperCase();
+      return id === want || id.endsWith(want) || String(it.aee_correlation_id || '').toUpperCase() === want;
+    });
+    const exact = hits.filter((it) => String(it.id).toUpperCase() === want);
+    if (exact.length === 1) return exact[0];
+    if (hits.length === 1) return hits[0];
+    if (hits.length > 1) {
+      throw new QuoxUserError(`"${given}" is ambiguous: it matches ${hits.length} open approvals (${hits.map((h) => shortId(h.id)).join(', ')}).`, {
+        next: 'use more of the id, or the full id from `quox approvals list`.', exitCode: 2, code: 'ambiguous_id',
+      });
+    }
+    throw new QuoxUserError(`No open approval matches "${given}" in this org.`, {
+      next: '`quox approvals list` shows what is waiting; `quox inbox get <id>` finds an answered one.', exitCode: 5, code: 'not_found',
+    });
+  }
+
+  function summaryLine(it) {
+    const d = describeInboxItem(it);
+    const what = [d.tool, d.target && d.target !== d.tool ? d.target : null].filter(Boolean).join(' on ') || d.title || it.title || it.id;
+    const who = d.by || approvalSourceLabel(it);
+    return `[${shortId(it.id)}] ${what}  (asked by ${who})`;
+  }
+
+  async function decide(verb, given, options) {
+    auth.requireAuth();
+    const orgId = resolveOrgId(auth, program);
+    const client = await clientFor(orgId); // another org only when --org names one
+    const it = await pickApproval(orgId, given, client);
+    const approve = verb === 'approve';
+    console.log(`${approve ? 'Approve' : 'Deny'}: ${summaryLine(it)}`);
+    if (approve) {
+      if (needsPin(it)) {
+        throw new QuoxUserError('High risk: a yes needs your step-up PIN, which a plain command cannot take.', {
+          next: 'answer it in `quox` with /approvals, or deny it here with `quox approvals deny`.', exitCode: 4, code: 'step_up_required',
+        });
+      }
+      if (isDestructive(it)) {
+        const { name } = destructiveObject(it);
+        if (!process.stdin.isTTY) {
+          throw new QuoxUserError(`This deletes "${name}": its name must be typed at a terminal. --yes does not cover it.`, {
+            next: 'run this command in an interactive terminal.', exitCode: 2, code: 'no_terminal',
+          });
+        }
+        const typed = await askTyped(`This is destructive. Type "${name}" to approve`);
+        if (String(typed ?? '').trim() !== name) {
+          throw new QuoxUserError(`What you typed did not match "${name}". Nothing was approved.`, { exitCode: 1, code: 'confirm_mismatch' });
+        }
+      } else if (!options.yes) {
+        const ok = await confirmInteractive('Approve this?', { flag: '--yes', purpose: 'approve' });
+        if (!ok) { console.log('Not approved. The request stays open.'); return; }
+      }
+    }
+    const ep = resolveEndpoint('inbox.respond', { orgId, itemId: it.id });
+    try {
+      const body = { action: approve ? 'approve' : 'reject', ...(options.note ? { comment: options.note } : {}) };
+      // DS-010 / #1335: only an approve can hit a step-up sink; ask for the PIN (hidden, TTY only) and retry once.
+      if (approve) await withStepUp((headers) => client.post(ep.path, { service: ep.service, headers, body }), { client, orgId, io: ctx.stepUpIO, what: 'This approval' });
+      else await client.post(ep.path, { service: ep.service, body });
+    } catch (err) {
+      announceFailure('approvals', `${approve ? 'approve' : 'deny'} ${shortId(it.id)}`, err);
+      if (err && (err.status === 403 || err.status === 401) && !(err instanceof QuoxUserError)) {
+        const msg = err.body?.message || err.body?.error || err.message;
+        const denied = new QuoxUserError(String(msg), { exitCode: 4, code: err.body?.error || 'forbidden', status: err.status, body: err.body });
+        Object.defineProperty(denied, 'quoxAnnounced', { value: true });
+        throw denied;
+      }
+      throw err;
+    }
+    announce('approvals', `${approve ? 'approved' : 'denied'} ${shortId(it.id)}`, { result: summaryLine(it).replace(/^\[\w+\]\s*/, '').replace(/\s+\(asked by .*$/, '') });
+    printSuccess(`${approve ? 'Approved' : 'Denied'} ${shortId(it.id)}.`);
+  }
+
+  approvals
+    .command('list')
+    .description('List approvals waiting for a human (same call as `quox inbox list`, approvals only)')
+    .option('--status <status>', 'open (default), all, or a status list')
+    .option('--limit <n>', 'max results', '50')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const cl = await clientFor(orgId);
+      const ep = resolveEndpoint('inbox.list', { orgId });
+      const data = await cl.get(ep.path, { service: ep.service, query: { ...OPEN_QUERY, limit: options.limit, ...(options.status ? { status: options.status } : {}) } });
+      const items = ((data && (data.items || data)) || []).map((it) => ({ ...it, short: shortId(it.id), what: summaryLine(it).replace(/^\[\w+\]\s*/, '') }));
+      formatOutput({
+        columns: ['short', 'what', 'status', 'created_at', 'id'],
+        headers: ['ID', 'What', 'Status', 'Created', 'Full id'],
+        rows: items,
+      }, { format: program.opts().output, emptyMessage: 'No approvals are waiting.' });
+      // Waiting in the user's OTHER orgs: a count and the exact command, table output only (json stays pure data).
+      if (program.opts().output === 'table' || !program.opts().output) {
+        for (const l of crossOrgLines(await otherOrgsWaiting({ client: baseClient, currentOrgId: orgId }))) console.log(l);
+      }
+    });
+
+  approvals
+    .command('approve <id>')
+    .description('Approve one waiting request by id (full id or the short tail on its card). A high-risk yes needs a PIN, so use `quox`.')
+    .option('--note <text>', 'a note recorded with the decision')
+    .option('-y, --yes', 'skip the y/N question (not a destructive delete, which needs its name typed)')
+    .addHelpText('after', '\nExamples:\n  quox approvals list\n  quox approvals approve D05HQY\n  quox approvals approve D05HQY --yes --note "checked the host"\n')
+    .action(announceOnFail('approvals', (id) => `approve ${id}`, (id, options) => decide('approve', id, options)));
+
+  approvals
+    .command('deny <id>')
+    .description('Deny one waiting request by id (full id or the short tail on its card)')
+    .option('--note <text>', 'why, recorded with the decision')
+    .addHelpText('after', '\nExamples:\n  quox approvals deny FJ340S --note "wrong host"\n')
+    .action(announceOnFail('approvals', (id) => `deny ${id}`, (id, options) => decide('deny', id, options)));
+
+  approvals
+    .command('withdraw <id>')
+    .description('Take back an approval request YOU raised (full id). It is marked withdrawn, never denied; the held call cannot run; only the identity that raised it may do this')
+    .option('--note <text>', 'why, recorded with the withdrawal')
+    .addHelpText('after', '\nExamples:\n  quox approvals withdraw 01KXYZ... --note "raised by mistake"\n')
+    .action(announceOnFail('approvals', (id) => `withdraw ${id}`, async (given, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      // The full item id or approval id goes straight to the server, which checks you are the requester. A short tail is
+      // looked up among the open approvals you can see; one you cannot see is not yours to withdraw by tail.
+      let id = String(given).trim();
+      if (id.length < 20) { const it = await pickApproval(orgId, id); id = it.id; }
+      const ep = resolveEndpoint('inbox.withdraw', { orgId, itemId: id });
+      try {
+        await client.post(ep.path, { service: ep.service, body: { ...(options.note ? { reason: options.note } : {}) } });
+      } catch (err) {
+        if (err && (err.status === 403 || err.status === 404 || err.status === 400) && !(err instanceof QuoxUserError)) {
+          const msg = err.body?.message || err.body?.error || err.message;
+          throw new QuoxUserError(String(msg), { exitCode: err.status === 403 ? 4 : 5, code: err.body?.error || 'withdraw_refused', status: err.status, body: err.body });
+        }
+        throw err;
+      }
+      announce('approvals', `withdrew ${shortId(id)}`, { result: 'withdrawn, nothing ran' });
+      printSuccess(`Withdrew ${shortId(id)}. It is marked withdrawn and cannot run.`);
+    }));
 }

package/lib/commands/ask.js

@@ -130,7 +130,7 @@ export function registerAskCommands(program, { client, auth }) {
       const d = (await client.get(ep.path, { service: ep.service })).decision;
       if (program.opts().output === 'json') { console.log(JSON.stringify(d, null, 2)); return; }
       console.log(`${d.state}${d.answer?.option ? ` ${d.answer.option}` : ''}${d.answer?.note ? ` (${d.answer.note})` : ''}`);
-      if (d.state === 'expired' || d.state === 'denied') process.exitCode = EXIT_NO_ANSWER;
+      if (d.state === 'expired' || d.state === 'denied' || d.state === 'withdrawn') process.exitCode = EXIT_NO_ANSWER;
     });
 
   ask

package/lib/commands/auth.js

@@ -7,7 +7,19 @@ import { formatDetail, printSuccess, printInfo } from '../core/output.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { loadResidentProfile, residentLogin, resolveResidentBaseUrl } from '../core/residentAuth.js';
 import { readStoredKit, resolveMyAttach, sessionKey, myAttachState } from './agentAttach.js';
+import { loginPrefillEmail, profileHoldingEmail, isNonDefaultProfile, sameIdentityWarning } from '../core/loginGuard.js';
 import { resolveActing } from '../core/actingAs.js';
+import { QuoxUserError } from '../core/errors.js';
+
+const PASSWORD_POLICY_HINT = 'Password policy: at least 12 characters, with an upper-case letter, a lower-case letter, a digit and a symbol.';
+
+/** whoami line for "-p/--profile given": say which agent is acting when the profile is an agent identity. */
+export function profileActingLine({ actorType, profile, user }) {
+  if (actorType === 'agent') {
+    return `  Acting as agent ${user || 'unknown'} via profile ${profile || 'unknown'} (-p/--profile given)`;
+  }
+  return '  Acting as yourself (-p/--profile given)';
+}
 
 export function registerAuthCommands(program, ctx) {
   const { config, auth, client } = ctx;
@@ -122,6 +134,7 @@ export function registerAuthCommands(program, ctx) {
             type: 'input',
             name: 'email',
             message: 'Email:',
+            default: loginPrefillEmail(config) || undefined,
             validate: v => v.includes('@') || 'Please enter a valid email',
           }]);
           email = ans.email;
@@ -138,6 +151,21 @@ export function registerAuthCommands(program, ctx) {
         }
       }
 
+      // Stop agent-only profiles quietly becoming another profile's (the owner's) identity.
+      if (isNonDefaultProfile(config)) {
+        const holder = profileHoldingEmail(config, email, config.getActiveProfile?.()?.url || null);
+        if (holder) {
+          const msg = sameIdentityWarning(email, holder, config.getActiveProfileName());
+          if (!process.stdin.isTTY) {
+            console.error(`Error: ${msg}\nRefusing in a non-interactive shell. Use the profile's own account, or run interactively and answer y.`);
+            process.exit(1);
+          }
+          const { default: inquirer } = await import('inquirer');
+          const ans = await inquirer.prompt([{ type: 'confirm', name: 'ok', message: msg.replace(/ y\/N$/, ''), default: false }]);
+          if (!ans.ok) { printInfo('Cancelled. Nothing was sent.'); return; }
+        }
+      }
+
       const baseUrl = config.getServiceUrl('auth');
       const ora = (await import('ora')).default;
       const spinner = ora('Authenticating...').start();
@@ -196,6 +224,7 @@ export function registerAuthCommands(program, ctx) {
   program
     .command('whoami')
     .description('Show current user and session info')
+    .addHelpText('after', '\nAdd --json for machine output (user, email, org, role, mfa, session, profile, actor_type, host_id).')
     .action(async () => {
       auth.requireAuth();
       const data = await client.get(resolveEndpoint('auth.me.list').path, { service: resolveEndpoint('auth.me.list').service });
@@ -309,7 +338,7 @@ export function registerAuthCommands(program, ctx) {
         } else if (acting.source === 'self') {
           printInfo('  Acting as yourself (--as self)');
         } else if (acting.source === 'profile') {
-          printInfo('  Acting as yourself (-p/--profile given)');
+          printInfo(profileActingLine({ actorType, profile: info.profile, user: info.user }));
         } else if (myAttachState().state === 'ambiguous') {
           printInfo('  Acting as yourself: this session has more than one attach (ambiguous), so no agent default applies. Pick one with --as <agent>.');
         }
@@ -337,18 +366,42 @@ export function registerAuthCommands(program, ctx) {
     .command('signup')
     .description('Create a new user account')
     .requiredOption('--email <email>', 'email address')
-    .requiredOption('--password <password>', 'password')
+    .option('--password <password>', 'password (prefer --password-stdin: argv is visible in process lists)')
+    .option('--password-stdin', 'read the password from stdin (one line), no secret in argv or shell history')
     .requiredOption('--name <name>', 'display name')
     .action(async (options) => {
-      const data = await client.post(resolveEndpoint('auth.signup').path, {
-        service: resolveEndpoint('auth.signup').service,
-        body: {
-          email: options.email,
-          password: options.password,
-          display_name: options.name,
-        },
-        noAuth: true,
-      });
+      let password = options.password;
+      if (!password && options.passwordStdin) {
+        const chunks = [];
+        for await (const chunk of process.stdin) chunks.push(chunk);
+        password = Buffer.concat(chunks).toString('utf8').split('\n')[0].trim();
+        if (!password) throw new QuoxUserError('--password-stdin given but stdin was empty', { next: 'Pipe the password in, for example: printf %s "$PW" | quox signup --password-stdin ...' });
+      } else if (password) {
+        console.error('Warning: argv is visible to other users (process list) and lands in shell history, so a password given with --password is exposed. Prefer --password-stdin.');
+      }
+      if (!password) {
+        throw new QuoxUserError('A password is required. Use --password-stdin (reads one line from stdin) or --password <password>.');
+      }
+      const ep = resolveEndpoint('auth.signup');
+      try {
+        await client.post(ep.path, {
+          service: ep.service,
+          body: { email: options.email, password, display_name: options.name },
+          noAuth: true,
+        });
+      } catch (err) {
+        if (err?.status === 400 && err?.code === 'validation_error') {
+          const reason = err.body?.message || err.message;
+          const list = Array.isArray(err.body?.errors) ? err.body.errors.filter((e) => typeof e === 'string' && e !== reason) : [];
+          const detail = [reason, ...list].join('; ');
+          const aboutPassword = /password/i.test(detail);
+          throw new QuoxUserError(`Signup was rejected: ${detail}`, {
+            next: aboutPassword ? PASSWORD_POLICY_HINT : null,
+            code: 'validation_error', status: 400, body: err.body,
+          });
+        }
+        throw err;
+      }
       printSuccess(`Account created for ${options.email}. Check your email for verification.`);
     });
 

package/lib/commands/backup.js

@@ -37,12 +37,19 @@ export function registerBackupCommands(program, ctx) {
       auth.requireAuth();
       const orgId = resolveOrgId(auth, program);
       const data = await client.get(resolveEndpoint('backups.list', { orgId }).path, { service: resolveEndpoint('backups.list', { orgId }).service, query: { limit: options.limit } });
+      const items = data.items || data.backups || data;
+      // Name leads (ids are for scripting: --json, -q). A failed row says why, clipped.
+      const clip = (t, n = 60) => { const x = String(t).replace(/\s+/g, ' ').trim(); return x.length > n ? `${x.slice(0, n - 1)}…` : x; };
+      const rows = (Array.isArray(items) ? items : []).map((b) => ({
+        ...b,
+        status: b.status === 'failed' && b.error_message ? `failed: ${clip(b.error_message)}` : b.status,
+      }));
       formatOutput({
         // fleet #392: backups has name/backup_type/archive_size_bytes.
-        columns: ['id', 'name', 'backup_type', 'archive_size_bytes', 'status', 'created_at'],
-        headers: ['ID', 'Name', 'Type', 'Size (bytes)', 'Status', 'Created'],
-        rows: data.items || data.backups || data,
-      }, { format: program.opts().output });
+        columns: ['name', 'backup_type', 'archive_size_bytes', 'status', 'created_at', 'id'],
+        headers: ['Name', 'Type', 'Size (bytes)', 'Status', 'Created', 'ID'],
+        rows,
+      }, { format: program.opts().output, raw: Array.isArray(items) ? items : undefined, quietColumn: 'id' });
     });
 
   backup

package/lib/commands/capabilities.js

@@ -8,18 +8,19 @@
  */
 
 import { resolveEndpoint } from '../api/endpoints.js';
-import { capabilityLines, findCapability, offerFor } from '../quoxon/capabilities.js';
+import { capabilityLines, findCapability, offerFor, needsSetupNames } from '../quoxon/capabilities.js';
 
 export function registerCapabilitiesCommands(program, ctx) {
   const { client, auth } = ctx;
   program
     .command('capabilities [name]')
     .description('What this Quox can do for your org: ready, needs setup, not available, planned')
+    .addHelpText('after', '\nAdd --json for the full list (id, name, availability, reason, setup, permissions_ok).')
     .action(async (name) => {
       auth.requireAuth();
       const ep = resolveEndpoint('v1.capabilities');
       const data = await client.get(ep.path, { service: ep.service });
-      if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      if (program.opts().output === 'json') { console.log(JSON.stringify({ needs_setup: needsSetupNames(data?.capabilities), ...data }, null, 2)); return; }
       const res = { ok: Array.isArray(data?.capabilities), capabilities: data?.capabilities, error: 'unexpected response' };
       if (name) {
         const c = findCapability(name, res);

package/lib/commands/chat.js

@@ -4,6 +4,7 @@
 
 import chalk from 'chalk';
 import { formatDetail } from '../core/output.js';
+import { eventLine, announceMuted } from '../core/announce.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { existsSync } from 'node:fs';
 import { lastConversation, saveLastConversation } from './chatState.js';
@@ -70,6 +71,14 @@ function printTrace(ev) {
   if (f) process.stderr.write((TONE_PAINT[f.tone] || chalk.cyan)(f.text) + '\n');
 }
 
+/** A turn's quox_event frame as its QuoxGlyph line on stderr (stdout stays the answer); silent under --json/--quiet. */
+export function printQuoxEvent(ev) {
+  if (announceMuted()) return null;
+  const q = eventLine(ev);
+  if (q) process.stderr.write(`${q}\n`);
+  return q;
+}
+
 function generateQueryId() {
   return `CLI_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
 }
@@ -81,6 +90,7 @@ function generateQueryId() {
 export async function consumeStream(client, { message, agent, sessionId, context }, { onAgentLabel, trace = false, companionPath, companionDisplay } = {}) {
   const queryId = generateQueryId();
   const body = buildStreamQuery({ queryId, message, agent, sessionId, context });
+  body.turn_id = queryId; // an explicit turn id selects the v1 event stream: tool and quox_event frames only flow with it
 
   let text = '';
   let resultSessionId = sessionId;
@@ -145,6 +155,10 @@ export async function consumeStream(client, { message, agent, sessionId, context
         write('\n');
         break;
 
+      case 'quox_event':
+        printQuoxEvent(event);
+        break;
+
       case 'error':
         throw new Error(event.error || 'Stream error');
 
@@ -361,6 +375,7 @@ export function registerChatCommands(program, ctx) {
         });
         spinner.stop();
         noteConversation(convId);
+        for (const qe of Array.isArray(data.quox_events) ? data.quox_events : []) printQuoxEvent(qe); // the server's per-turn Quox effects, when it returns them
 
         if (program.opts().output === 'json') {
           console.log(JSON.stringify({ ...data, conversation_id: convId || null }, null, 2));

package/lib/commands/claude.js

@@ -29,6 +29,7 @@ export {
  */
 export function parseClaudeArgs(raw) {
   let noTmux = false;
+  let force = false;
   let as;
   let slot;
   const args = [];
@@ -38,6 +39,7 @@ export function parseClaudeArgs(raw) {
     if (past) { args.push(a); continue; }
     if (a === '--') { past = true; args.push(a); continue; }
     if (a === '--no-tmux') noTmux = true;
+    else if (a === '--force') force = true;
     else if ((a === '--as' || a === '--slot') && raw[i + 1] && !raw[i + 1].startsWith('-')) {
       if (a === '--as') as = raw[i + 1]; else slot = raw[i + 1];
       i++;
@@ -72,7 +74,7 @@ export function parseClaudeArgs(raw) {
     }
   }
   if (name !== undefined && !validateName(name)) name = undefined;
-  return { args, name, resume, noTmux, as, slot };
+  return { args, name, resume, noTmux, ...(force ? { force } : {}), as, slot };
 }
 
 /**
@@ -151,6 +153,7 @@ quox's own flags (consumed here, not passed to claude):
   --as <agent>    start already attached to a Quox agent
   --slot <name>   start already holding a dev slot
   --no-tmux       run claude directly, without tmux
+  --force         with --resume: start a second copy even if that conversation is already running
   -n, --name <n>  name the session (also names the tmux session; claude's own flag)
   --resume <n>    resume the named session (claude's own flag)
   -h, --help      show this help

package/lib/commands/compliance.js

@@ -0,0 +1,109 @@
+/**
+ * Compliance commands: scheduled compliance report jobs.
+ *
+ * `compliance jobs list` calls GET /compliance/jobs (services/collector/server.js),
+ * the same route the compliance_list_jobs agent tool uses. Jobs can carry an
+ * optional name (set via the compliance_schedule_job tool / POST body `name`).
+ *
+ * `compliance reports list|show` read GET /compliance/reports and /compliance/reports/:id, the
+ * routes compliance_get_reports reads (org-scoped by the caller's session). The ORG column is
+ * always shown: a row with no org (org_id null) is printed as `none`, never hidden.
+ */
+
+import { formatOutput, formatDetail } from '../core/output.js';
+import { resolveOrgId } from './helpers.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+export function registerComplianceCommands(program, ctx) {
+  const { client, auth } = ctx;
+
+  const compliance = program
+    .command('compliance')
+    .description('Compliance: generated reports and scheduled report jobs');
+
+  const jobs = compliance
+    .command('jobs')
+    .description('Scheduled compliance report jobs');
+
+  jobs
+    .command('list')
+    .description('List scheduled compliance report jobs (with NAME)')
+    .option('--status <status>', 'filter by status (active|paused|error)')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('compliance.jobs.list');
+      const data = await client.get(ep.path, { service: ep.service, query: { org_id: orgId } });
+      let rows = data.jobs || [];
+      if (options.status) rows = rows.filter((j) => j.status === options.status);
+      formatOutput({
+        columns: ['id', 'name', 'format', 'schedule_interval', 'status', 'next_run'],
+        headers: ['ID', 'NAME', 'Format', 'Interval', 'Status', 'Next run'],
+        rows: rows.map((j) => ({ ...j, name: j.name || '-' })),
+      }, { format: program.opts().output, emptyMessage: 'No compliance jobs found.', raw: rows });
+    });
+
+  const reports = compliance
+    .command('reports')
+    .description('Generated compliance reports (read only)');
+
+  const scoreOf = (r) => (r.summary && typeof r.summary === 'object' && r.summary.overallScore != null ? r.summary.overallScore : '-');
+
+  reports
+    .command('list')
+    .description('List generated compliance reports: framework, period, score, sampled evidence, ORG')
+    .option('--format <format>', 'only this framework (soc2, hipaa, gdpr, iso27001, euAiAct, iso42001, nistAiRmf)')
+    .option('--limit <n>', 'max rows', '20')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('compliance.reports.list');
+      const query = { org_id: orgId, limit: String(options.limit || 20) };
+      if (options.format) query.format = options.format;
+      const data = await client.get(ep.path, { service: ep.service, query });
+      let rows = data.reports || [];
+      // the route does not filter by format, so the flag is applied here too
+      if (options.format) rows = rows.filter((r) => r.format === options.format);
+      formatOutput({
+        columns: ['id', 'format', 'generated_at', 'period_days', 'score', 'status', 'sample', 'org'],
+        headers: ['ID', 'Format', 'Generated', 'Days', 'Score', 'Status', 'Evidence sample', 'ORG'],
+        rows: rows.map((r) => ({
+          ...r,
+          period_days: r.period_days ?? '-',
+          score: scoreOf(r),
+          status: (r.summary && r.summary.overallStatus) || '-',
+          sample: (r.summary && Array.isArray(r.summary.evidenceSample) && r.summary.evidenceSample.length) ? r.summary.evidenceSample.join(' ') : '-',
+          org: r.org_id || 'none',
+        })),
+      }, { format: program.opts().output, emptyMessage: 'No compliance reports found.', raw: rows });
+    });
+
+  reports
+    .command('show <id>')
+    .description('Show one generated report: framework, period, score, per-control status, sampled evidence')
+    .action(async (id) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('compliance.reports.get', { id });
+      const data = await client.get(ep.path, { service: ep.service, query: { org_id: orgId } });
+      const r = data.report || data;
+      const fmt = program.opts().output;
+      if (fmt && fmt !== 'table') { formatDetail(r, { format: fmt }); return; }
+      const s = (r.summary && typeof r.summary === 'object') ? r.summary : {};
+      const body = (r.report_data && typeof r.report_data === 'object') ? r.report_data : {};
+      const lines = [
+        `Report     ${r.id}`,
+        `Framework  ${s.framework || body.framework || r.format}`,
+        `Org        ${r.org_id || 'none'}`,
+        `Period     ${r.period_start || '-'} .. ${r.period_end || '-'} (${r.period_days ?? '-'} days)`,
+        `Score      ${s.overallScore ?? body.overallScore ?? '-'}  status ${s.overallStatus || body.overallStatus || '-'}`,
+        `Evidence   ${Array.isArray(s.evidenceSample) && s.evidenceSample.length ? s.evidenceSample.join(' ') : '-'}`,
+      ];
+      const sections = body.sections && typeof body.sections === 'object' ? body.sections : {};
+      for (const [key, sec] of Object.entries(sections)) {
+        lines.push('', `${key}  ${sec && sec.name ? sec.name : ''}`.trimEnd());
+        for (const c of (sec && Array.isArray(sec.controls) ? sec.controls : [])) lines.push(`  ${String(c.id || '-').padEnd(10)} ${String(c.status || '-').padEnd(16)} ${c.name || ''}`);
+      }
+      for (const l of lines) console.log(l);
+    });
+}