quoxcli 0.4.0 → 0.5.0

package/lib/quoxon/promptHistory.js

@@ -6,6 +6,7 @@
 import { readFileSync, appendFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
+import { redactSecrets } from './secretShape.js';
 
 export const HISTORY_CAP = 500;
 export const defaultHistoryPath = (home = homedir()) => join(home, '.quox', 'history.jsonl');
@@ -22,7 +23,8 @@ export function fileHistory(path = defaultHistoryPath(), { cap = HISTORY_CAP } =
       return out.slice(-cap);
     } catch { return []; }
   };
-  const add = (text) => {
+  const add = (text0) => {
+    const text = redactSecrets(text0); // SECRET-GUARD: a value never reaches the file
     try {
       mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
       appendFileSync(path, JSON.stringify({ t: text }) + '\n', { mode: 0o600 });

package/lib/quoxon/render.js

@@ -30,6 +30,7 @@ import { Markdown, wrapCell, markdownRows, wrapRows, WText, Heading } from './ma
 import { parseAsk, keysLabel, askText } from './ask.js';
 import { parseAsideNote } from './asideView.js';
 import { formatSlotBody, inlineable, codeRows } from './slotFormat.js';
+import { BACKGROUND_NOTE } from './backgroundWork.js';
 import { termRows } from './term.js';
 import { cellWidth, ambiguousWide } from './cells.js';
 import { welcomeModel } from './welcome.js';
@@ -733,10 +734,12 @@ function TipView({ item, cols }) {
   const body = wrapPlain(item.text, inner).map((l, i) => row(`t${i}`, [h(Text, { key: 0, color: c('prose') }, l)], [...l].length));
   const cmdText = clip(item.cmd, inner - 5);
   const tryRow = row('try', [h(Text, { key: 0, color: c('prose'), bold: true }, 'Try: '), h(Text, { key: 1, color: c('command') }, cmdText)], 5 + [...cmdText].length);
-  const hintRow = row('hint', runs(paintRuns(TIP_HINT, 'quiet')), [...stripMarks(TIP_HINT)].length);
+  const hintPlain = stripMarks(TIP_HINT); // too long for the frame: wrap it inside, never let the terminal wrap the border
+  const hintRows = [...hintPlain].length <= inner ? [row('hint', runs(paintRuns(TIP_HINT, 'quiet')), [...hintPlain].length)]
+    : wrapPlain(hintPlain, inner).map((l, i) => row(`hint${i}`, [h(Text, { key: 0, color: c('quiet') }, l)], [...l].length));
   return h(Box, { paddingLeft: 2, flexDirection: 'column' },
     h(Text, edge, '╭─ ', h(Text, { bold: true }, 'Tip'), ' ', '─'.repeat(W - 8), '╮'),
-    ...body, tryRow, hintRow,
+    ...body, tryRow, ...hintRows,
     h(Text, edge, '╰', '─'.repeat(W - 2), '╯'));
 }
 
@@ -764,9 +767,13 @@ function WhatsNewView({ item, cols }) {
     return out;
   });
   if (more) rows.push(row('more', [h(Text, { key: 0, color: c('prose') }, lead), h(Text, { key: 1, color: c('prose'), bold: true }, 'Try: '), h(Text, { key: 2, color: c('command') }, '/whatsnew')], [...more].length));
+  // a head that does not fit in the top edge (the compact "N new commands (...)" line at a narrow width) goes inside the
+  // frame, wrapped, under a bare top edge: the terminal must never be the one to wrap a border row
+  const headFits = [...HEAD].length <= W - 6;
+  if (!headFits) rows.unshift(...wrapPlain(HEAD, inner).map((l, i) => row(`h${i}`, [h(Text, { key: 0, color: c('prose'), bold: true }, l)], [...l].length)));
   if (item.pad) { rows.unshift(row('p0', [], 0)); rows.push(row('p1', [], 0)); }
   return h(Box, { paddingLeft: 2, flexDirection: 'column' },
-    h(Text, edge, '╭─ ', h(Text, { bold: true }, HEAD), ' ', '─'.repeat(Math.max(1, W - 5 - HEAD.length)), '╮'),
+    headFits ? h(Text, edge, '╭─ ', h(Text, { bold: true }, HEAD), ' ', '─'.repeat(W - 5 - [...HEAD].length), '╮') : h(Text, edge, '╭', '─'.repeat(W - 2), '╮'),
     ...rows,
     h(Text, edge, '╰', '─'.repeat(W - 2), '╯'));
 }
@@ -843,6 +850,12 @@ export function modelRuleLabel(cols, model, reserve = 0) {
   return reserve ? '' : clip(name, room); // with the approvals indicator the model is dropped before the indicator is cut
 }
 
+/** Pure: a failed approvals poll goes stale (footer `?`) only after 3 consecutive misses or 60 s without a good read. */
+export function approvalsPollStale({ fails, lastOkAt, now }) {
+  if (!(fails > 0)) return false;
+  return fails >= 3 || (typeof lastOkAt === 'number' && now - lastOkAt > 60000);
+}
+
 /**
  * Pure: the permanent approvals indicator on the bottom rule. `a` = { count, error, signedOut }.
  * Never a false 0: signed out, an unreachable inbox, or a count not read yet is `approvals ?` (warn).
@@ -850,9 +863,20 @@ export function modelRuleLabel(cols, model, reserve = 0) {
 export function approvalsIndicator(a) {
   if (!a) return null;
   const n = a.count;
+  if (!a.signedOut && a.error && a.slow) return { text: 'approvals ? (server slow)', role: 'warn' }; // sustained failure, never an all-clear
   if (a.signedOut || a.error || typeof n !== 'number') return { text: 'approvals ?', role: 'warn' };
+  // Never an all-clear next to outstanding items or an unseen source: scope the claim to approvals and say what else is open.
+  const out = Number(a.outstanding) || 0, blind = Number(a.blind) || 0;
+  if (n === 0 && (out > 0 || blind > 0)) {
+    const more = [out > 0 ? `${out} other item${out === 1 ? '' : 's'} open` : null, blind > 0 ? `can't see ${blind} source${blind === 1 ? '' : 's'}` : null].filter(Boolean).join(' · ');
+    return { text: `no approvals in this view · ${more}`, role: 'warn' };
+  }
+  // Other orgs the user belongs to (cached counts, core/crossOrgApprovals): never an all-clear beside a waiting approval elsewhere.
+  const others = (Array.isArray(a.others) ? a.others : []).filter((o) => o && o.count > 0);
+  const elsewhere = others.reduce((t, o) => t + o.count, 0);
+  if (n === 0 && elsewhere > 0) return { text: others.length === 1 ? `⏸ ${elsewhere} in ${others[0].name} · /approvals` : `⏸ ${elsewhere} in ${others.length} other orgs · /approvals`, role: 'warn' };
   if (n === 0) return { text: '✔ nothing waiting', role: 'ok' };
-  return { text: `⏸ ${n} approval${n === 1 ? '' : 's'} waiting`, role: 'warn' };
+  return { text: `⏸ ${n} approval${n === 1 ? '' : 's'} waiting${elsewhere ? ` · +${elsewhere} in ${others.length === 1 ? others[0].name : `${others.length} other orgs`}` : ''}`, role: 'warn' };
 }
 
 /** Pure: the labels for this width. The indicator sits top-left, the model bottom-right: independent of each other. */
@@ -1031,11 +1055,12 @@ export function AskFoot({ footer }) {
   return h(Box, { paddingLeft: 2 }, h(Box, { width: 2, flexShrink: 0 }, h(Text, { bold: true }, ...runs(paintLine('▶ ', 'ask')))), h(Box, { flexGrow: 1, flexShrink: 1 }, h(Text, { color: c('prose'), bold: true, wrap: 'wrap' }, ...runs(paintLine(f.slice(2), 'ask')))));
 }
 const footRows = (footer, cols) => (HANG_ASK.test(footer) ? wrapRows(footer.slice(2), cols - 4) : wrapRows(footer, cols - 2));
-export function NeedsYouCard({ cols, title, rows = [], block = [], notes = [], footer, arming = null, motionE = null }) {
+export function NeedsYouCard({ cols, title, rows = [], block = [], notes = [], footer, arming = null, motionE = null, lead = null }) {
   const e = motionE;
   return h(Box, { flexDirection: 'column', width: cols, marginTop: 1 },
     e == null ? h(Rule, { cols, color: 'warn' }) : h(DrawRule, { cols, color: 'warn', e }),
     e == null ? h(Text, { color: c('warn'), bold: true, wrap: 'wrap' }, title) : h(Text, null, ...fxNodes([{ t: title, color: 'warn', bold: true }], { e: e - 0.1, timing: TIMING.title }, 23)),
+    lead ? h(Text, { color: c('warn'), bold: true, wrap: 'wrap' }, `  ${lead}`) : null, // a destructive approval leads with what it deletes
     // APPROVAL-WHAT: wrap at word boundaries under the label instead of cutting the action or target off
     ...rows.flatMap(([k, v], ri) => wrapPlain(String(v), Math.max(10, cols - 10)).slice(0, 8).map((line, i) => h(Text, { key: `${ri}${k}${i}`, color: c('text') }, '  ', h(Text, { color: c('label') }, (i ? '' : k).padEnd(7)), h(Text, { color: c(k === 'risk' ? 'warn' : 'value') }, line)))),
     // block: pre-shaped segment rows shown verbatim (a command to run: never word-wrapped, never clipped)
@@ -1068,7 +1093,16 @@ export const askCardRows = (text, cols) => {
   return 4 + wrapRows(m.title, cols) + m.rows.reduce((n, [, v]) => n + Math.min(8, wrapPlain(String(v), Math.max(10, cols - 10)).length), 0) + footRows(m.footer, cols);
 };
 
-export function ApprovalCard({ card, org, cols, armed, draftHint = null, motionE = null, confirm = false, position = null }) {
+/** APPROVAL-BURST: one card for 2+ approvals from one agent for one tool (approvalBatch.batchModel). */
+export function BatchCard({ model, cols, armed, motionE = null }) {
+  const e = motionE;
+  const block = model.lines.map((l) => [{ t: `• ${clip(l, Math.max(10, cols - 8))}`, role: 'text' }]);
+  if (model.more) block.push([{ t: model.more, role: 'dim' }]);
+  const footer = askText(`Approve all ${model.n}?`, { keys: model.keys });
+  return h(NeedsYouCard, { cols, title: model.title, rows: [], block, notes: model.notes, footer, arming: armed ? null : (e == null ? h(Text, { color: c('dim') }, '  arming…') : null), motionE: e });
+}
+
+export function ApprovalCard({ card, org, cols, armed, draftHint = null, motionE = null, confirm = false, position = null, signedOut = false }) {
   const when = card.askedAt ? String(card.askedAt).replace('T', ' ').slice(0, 16) + ' UTC' : null;
   const rows = card.undescribable ? [['what', card.what], ['from', card.askedBy || card.origin], ['asked', when], ['org', org]].filter(r => r[1]) : [
     ['what', card.what && card.what !== card.tool ? card.what : null], ['tool', card.tool], ['target', card.target], ['scope', card.scope], ['risk', card.risk], ['from', card.foreign ? card.origin : null], ['org', card.plan && (card.plan.orgName || card.plan.orgId) ? orgLabel(card.plan.orgName, card.plan.orgId) : org]
@@ -1082,8 +1116,9 @@ export function ApprovalCard({ card, org, cols, armed, draftHint = null, motionE
   const f = card.facts || null; const block = [];
   if (f && !card.undescribable) {
     if (f.where && /^\d+ (hosts|targets):/.test(f.where)) { for (const k of ['target', 'what']) { const i = rows.findIndex(r => r[0] === k && (k === 'target' || String(r[1]).includes(f.hostList[1]))); if (i >= 0) rows.splice(i, 1); } }
+    if (f.background) { const i = rows.findIndex(r => r[0] === 'what'); const note = BACKGROUND_NOTE[0].toUpperCase() + BACKGROUND_NOTE.slice(1); if (i >= 0) rows[i] = ['what', `${rows[i][1]}. ${note}`]; else rows.unshift(['what', note]); }
     if (f.command) { block.push([{ t: f.command.kind === 'input' ? 'input:' : 'command:', role: 'label' }]); block.push(...codeRows(f.command.shown.split('\n'), cols - 4)); }
-    for (const r of [['where', f.where], ['who', f.who], ['why', f.why], ['asked', [f.asked && `"${f.asked}"`, f.when].filter(Boolean).join(' · ') || null], ['class', f.access]]) if (r[1]) rows.push(r);
+    for (const r of [['where', f.where], ['who', f.who], ['why', f.why], ['asked', [f.asked && (f.askedRich ? f.asked : `"${f.asked}"`), f.when].filter(Boolean).join(' · ') || null], ['class', f.access]]) if (r[1]) rows.push(r);
   }
   const e = motionE;
   const title = `⚠ Approval needed${position && position.n > 1 ? ` (${position.i} of ${position.n})` : ''}: execution is held`;
@@ -1091,12 +1126,15 @@ export function ApprovalCard({ card, org, cols, armed, draftHint = null, motionE
   const arming = e == null || mono()
     ? h(Text, { color: c('dim') }, e == null ? '  arming…' : `  arming… ${'▰'.repeat(filled)}${'▱'.repeat(ARM_BAR - filled)}`)
     : h(Text, null, h(Text, { color: c('dim') }, '  arming… '), h(Text, { color: c('warn') }, '▰'.repeat(filled)), h(Text, { color: c('faint') }, '▱'.repeat(ARM_BAR - filled)));
-  const footer = card.privileged && confirm ? `▶ Grant ${[card.tool, card.target].filter(Boolean).join(' ')}? press y again to confirm, any other key cancels`
+  const footer = signedOut ? askText('Read-only while signed out. Sign in to answer?', { keys: 'y signs in' })
+    : card.privileged && confirm ? `▶ Grant ${[card.tool, card.target].filter(Boolean).join(' ')}? press y again to confirm, any other key cancels`
     : card.undescribable && confirm ? '▶ Quox could not describe this action. Approve it anyway? press y again to confirm, any other key cancels'
+      : draftHint === 'reason' ? askText('Why deny it?', { keys: 'type a reason · Enter denies · Esc goes back to y/n' })
       : draftHint === 'focus' ? askText('Approve it?', { keys: 'y approve · n deny · card focused (Esc returns to your draft)' }) // RESTORE-TUI: every y/n goes through askText (same text)
       : draftHint === 'draft' ? askText('Approve it?', { keys: 'y/n answer once your draft is empty · Tab to answer the approval card (your draft is kept)' })
-        : '▶ Approve it? y approve · n deny · c chat · Tab later · /approvals all';
-  return h(NeedsYouCard, { cols, title, rows, block, notes: [...(card.undescribable && !confirm ? ['Quox could not describe this action'] : []), ...(position && position.others > 0 ? [`other sessions: ${position.others} waiting · /approvals`] : [])], footer, arming: armed ? null : arming, motionE: e });
+        : card.destructive ? '▶ Delete it? y then type the name · n deny · c chat · Tab later · /approvals all'
+          : '▶ Approve it? y approve · n deny · c chat · Tab later · /approvals all';
+  return h(NeedsYouCard, { cols, title, rows, block, lead: card.destructive ? `DELETES ${card.destructive.label}` : null, notes: [...(f && f.askedNone ? ['nothing in your request asks for this'] : []), ...(card.undescribable && !confirm ? ['Quox could not describe this action'] : []), ...(position && position.others > 0 ? [`other sessions: ${position.others} waiting · /approvals`] : [])], footer, arming: armed ? null : arming, motionE: e });
 }
 
 /** Columns the status line's Q takes: 2 for the Braille glyph, 1 for the Ⓠ fallback (2 where Ambiguous is wide). */
@@ -1221,11 +1259,22 @@ function hintNodes(hint) {
 }
 
 /** Live, actionable counts under the status line. Never a transcript message. */
-export function NotifyBar({ approvals, error, cols, signedOut = false, alerts = [], hideCount = false, inbox = '' }) {
+export function NotifyBar({ approvals, error, cols, signedOut = false, alerts = [], hideCount = false, inbox = '', spinner = '', away = false, awayCount = 0, dnd = false, dndCount = 0, awaySince = 0, dndUntil = 0, awayUnknown = false }) {
+  const hm = (ms) => { const d = new Date(ms); return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`; };
+  if (away && dnd && !signedOut) { // DND: one persistent quiet line, shown even at 0 waiting so the mode is never invisible
+    const head = dndUntil ? `🌙 do not disturb until ${hm(dndUntil)}` : '🌙 do not disturb';
+    return h(Text, { color: c('ask'), bold: true }, ' ' + clip(`${head}${dndCount ? ` · ${dndCount} waiting` : ''} · /morningreport`, cols - 3));
+  }
+  if (away && !signedOut) { // AFK-QUIET-CARDS: away shows one quiet line, never a prompt
+    const n = awayCount || approvals || 0;
+    const head = awaySince ? `🌙 away since ${hm(awaySince)} · /back` : awayUnknown ? '🌙 away (since before this window opened) · /back' : '🌙 away · /back';
+    return h(Text, { color: c('ask'), bold: true }, ' ' + clip(n ? `⏸ ${n} approval${n === 1 ? '' : 's'} waiting · /back to review` : head, cols - 3)); // >0 keeps the existing wording (asserted elsewhere)
+  }
   const base = NotifyBarBase({ approvals, error, cols, signedOut, alerts, hideCount });
-  if (!inbox || signedOut) return base;
-  const line = h(Text, { key: 'inbox', color: c('ask'), bold: true }, ' ' + clip(inbox, cols - 3)); // HITL-INBOX-BAR: 📨 N new · newest title
-  return base ? h(Box, { flexDirection: 'column' }, base, line) : line;
+  const line = inbox && !signedOut ? h(Text, { key: 'inbox', color: c('ask'), bold: true }, ' ' + clip(inbox, cols - 3)) : null; // HITL-INBOX-BAR: 📨 N new · newest title
+  const spin = spinner ? h(Text, { key: 'spin', color: c('ask') }, ' ' + clip(spinner, cols - 3)) : null; // INSTANT-FEEDBACK: ⠋ <verb>…
+  const parts = [base, line, spin].filter(Boolean);
+  return parts.length > 1 ? h(Box, { flexDirection: 'column' }, ...parts) : (parts[0] || base);
 }
 function NotifyBarBase({ approvals, error, cols, signedOut = false, alerts = [], hideCount = false }) {
   if (signedOut) return h(Text, { color: c('warn') }, ' ' + clip('not signed in: approvals unavailable until you sign in', cols - 2));

package/lib/quoxon/roster.js

@@ -258,14 +258,14 @@ export function countsLine(rows) {
  * one row each plus a summary line (owner, live 05:29): the bottom area must never grow with the inbox. A single approval
  * keeps its own row. Focus (the user is walking the roster) shows the real rows so selection stays truthful.
  */
-export function collapseApprovals(rows, now = Date.now()) {
+export function collapseApprovals(rows, now = Date.now(), staleAt = null) {
   const aps = rows.filter(r => r.kind === 'approval' && r.state === 'waiting');
-  if (aps.length < 2) return rows;
+  if (aps.length < (staleAt ? 1 : 2)) return rows;
   const started = aps.map(r => r.startedAt).filter(x => x != null);
   const newest = aps.reduce((a, b) => ((b.startedAt ?? -Infinity) > (a.startedAt ?? -Infinity) ? b : a));
   const one = { key: 'approval:*', id: '*', source: 'approvals', kind: 'approval', state: 'waiting', background: false, collapsed: true, count: aps.length,
     name: `${aps.length} approvals waiting`, activity: '/approvals', status: 'pending', startedAt: started.length ? Math.min(...started) : null, finishedAt: null,
-    oldestMs: started.length ? now - Math.min(...started) : null, newestTitle: String(newest.detail?.description || newest.name || ''), detail: {} };
+    oldestMs: started.length ? now - Math.min(...started) : null, staleAt: staleAt || null, newestTitle: String(newest.detail?.description || newest.name || ''), detail: {} };
   let placed = false;
   return rows.flatMap(r => (aps.includes(r) ? (placed ? [] : (placed = true, [one])) : [r]));
 }
@@ -273,9 +273,9 @@ export function collapseApprovals(rows, now = Date.now()) {
 const KIND_ICON = { loop: '∞', objective: '◎' }; // QuoxGlyph registry keys qloop / objective
 export const kindLabel = k => (KIND_ICON[k] ? `${KIND_ICON[k]} ${k}` : k);
 
-export function rosterView({ rows, cols, termRows = 40, max = MAX_ROWS, on = true, sel = 0, focus = false, now = Date.now(), motion = false }) {
+export function rosterView({ rows, cols, termRows = 40, max = MAX_ROWS, on = true, sel = 0, focus = false, now = Date.now(), motion = false, staleAt = null }) {
   if (!on || !rows.length) return { mode: 'hidden', lines: [], more: 0 };
-  if (!focus) rows = collapseApprovals(rows, now);
+  if (!focus || staleAt) rows = collapseApprovals(rows, now, staleAt); // signed out: the cached count is last-known, always one stale row
   if (cols < MIN_FULL_COLS || termRows < MIN_FULL_ROWS) {
     return { mode: 'summary', lines: [], more: 0, summary: clip(' ' + countsLine(rows) + ' · /roster', cols - 1) };
   }
@@ -293,6 +293,11 @@ export function rosterView({ rows, cols, termRows = 40, max = MAX_ROWS, on = tru
     const nameW = Math.max(8, cols - 2 - fixed - 1);
     const name = clip(r.name, nameW).padEnd(nameW);
     const marker = focus && i === sel ? '›' : ' ';
+    if (r.collapsed && r.staleAt) { // signed out: last-known count with its time, never worded as live (owner live 2026-10-27)
+      const d = new Date(r.staleAt), at = `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`;
+      const text = clip(`${r.count} waiting as of ${at} · sign in to see more: /login`, cols - 4);
+      return { key: r.key, kind: 'approval', state: r.state, tone: 'dim', selected: false, marker: ' ', glyph: GLYPH[r.state], rest: ' ' + text, pulse: '', pulseRole: 'dim', pulseKind: 'none', text: ` ${GLYPH[r.state]} ${text}` };
+    }
     if (r.collapsed) { // one summary row: count, oldest age, newest title, where to go; clipped to the line
       const head = `${r.count} approvals waiting · oldest ${elapsed(r.oldestMs)} · newest: `, tail = ' · /approvals';
       const room = cols - 5 - [...head].length - [...tail].length;

package/lib/quoxon/rosterSessions.js

@@ -0,0 +1,44 @@
+/**
+ * /roster text for the two things that are not work rows: attached agents (org lease list) and this box's live
+ * `claude --resume` processes. Pure; the process list and the attach list are injected by the caller.
+ */
+
+const age = (sec) => {
+  const s = Math.max(0, Math.round(sec));
+  if (s < 60) return `${s}s`;
+  if (s < 3600) return `${Math.floor(s / 60)}m`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h`;
+  return `${Math.floor(s / 86400)}d`;
+};
+
+const sinceText = (iso, now) => {
+  const t = Date.parse(iso || '');
+  return Number.isNaN(t) ? '?' : age((now - t) / 1000);
+};
+
+/** attached agents -> one line each: agent, splinter, session, lease id, heartbeat age, expiry. */
+export function attachLines(items, now = Date.now()) {
+  if (!items || !items.length) return ['  attached agents: none'];
+  return items.map((a) => `  ${a.agent_id} ${a.splinter || 'S1'} · ${a.session_label || '(no label)'} · lease ${a.lease_id} · heartbeat ${sinceText(a.last_heartbeat_at, now)} ago · expires ${a.expires_at || '?'}`);
+}
+
+const where = (p) => (p.tmux ? `tmux ${p.tmux}` : `not in tmux${p.tty && p.tty !== '?' ? ` ${p.tty}` : ''}`);
+const one = (p) => `${p.pid} ${where(p)} ${age(p.ageSec || 0)}`;
+
+/** live claude processes -> lines, grouped by name case-insensitively; a name held more than once is flagged. */
+export function sessionLines(procs) {
+  if (!procs || !procs.length) return ["  this box's sessions: none"];
+  const groups = new Map();
+  for (const p of procs) {
+    const k = String(p.name).toLowerCase();
+    if (!groups.has(k)) groups.set(k, []);
+    groups.get(k).push(p);
+  }
+  const out = [];
+  for (const g of groups.values()) {
+    const name = g[0].name;
+    if (g.length === 1) out.push(`  ${name}: ${one(g[0])}`);
+    else out.push(`  ⚠ ${name} x${g.length}: ${g.map(one).join(', ')}`);
+  }
+  return out;
+}

package/lib/quoxon/screenContext.js

@@ -48,7 +48,7 @@ const age = (ms) => {
 };
 
 /** A line the user cannot have meant as a command they want repeated (PIN-bearing verbs): name only. */
-const PIN_VERBS = /^\/(authenticate|authorise|authorize|pin|login|connect|key)\b/i;
+const PIN_VERBS = /^\/(authenticate|authorise|authorize|pin|login|connect|key|verify-email)\b/i;
 
 function whoSection(w) {
   const bits = [];

package/lib/quoxon/secretShape.js

@@ -0,0 +1,86 @@
+/**
+ * QUOXON-SECRET-GUARD: one detector for secret-shaped text, shared by the composer (offer before send), the
+ * history writer and the transcript writer (redact before write). Low false positives on purpose: a bare number
+ * never matches unless a keyword sits next to it, or it is a Luhn-valid card number.
+ */
+const REDACTED = '[REDACTED';
+
+const luhn = (digits) => {
+  let sum = 0, dbl = false;
+  for (let i = digits.length - 1; i >= 0; i--) { let d = digits.charCodeAt(i) - 48; if (dbl) { d *= 2; if (d > 9) d -= 9; } sum += d; dbl = !dbl; }
+  return sum % 10 === 0;
+};
+
+// keyword, then a value: after ":" or "=" anything non-space; after plain space/"is" only a value carrying a digit (4+ chars)
+const KEYWORDS = [
+  ['pin', 'pin'], ['passcode', 'pass\\s?code'], ['password', 'password|passwd|pass\\s?word'],
+  ['api-key', 'api[ _-]?key'], ['secret', 'secret'], ['token', 'token']
+];
+const kwRe = (kw) => new RegExp(`\\b(?:${kw})\\b(?:[ \\t]+(?:number|no\\.?|code))?(?:[ \\t]*[:=][ \\t]*["']?([^\\s"',;]+)|[ \\t]+(?:is[ \\t]+)?["']?([^\\s"',;]*\\d[^\\s"',;]*))`, 'gi');
+
+const ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
+const trimVal = (v) => v.replace(/^[(\[`<*_]+/, '').replace(/[)\]`>*_.,;:!?]+$/, '');
+/**
+ * Precision mode: is a keyword-adjacent value really secret-shaped, or just prose ("PIN ask", "token budget",
+ * a ULID, a path, a placeholder)? pin/passcode need a 4-8 digit run; the others need a 8+ char value that mixes
+ * letters and digits (or carries a symbol) and is not an id, path, url, placeholder or short hex.
+ */
+function preciseValueOk(kind, raw) {
+  if (/^[<$\{\[~\/]|^[a-z]+:\/\/|\.\.\.|^\$|^\.{0,2}\//i.test(raw)) return false;
+  const v = trimVal(raw);
+  if (kind === 'pin' || kind === 'passcode') return /^\d{4,8}$/.test(v);
+  if (v.length < 8 || ULID.test(v) || /^[0-9a-f]{7,12}$/i.test(v) || /^\d{4}-\d{2}-\d{2}/.test(v)) return false;
+  if (/[<>{}()/\\]|^\W/.test(v) && !/^[\w!@#$%^&*+=.-]+$/.test(v)) return false;
+  return /[A-Za-z]/.test(v) && /\d/.test(v);
+}
+const CARD_FORM = /^(?:\d{13,19}|\d{4}(?:[ -]\d{4}){2,3}(?:[ -]\d{1,3})?|\d{4}[ -]\d{6}[ -]\d{5})$/;
+
+/** -> [{ kind, start, end }] value spans, sorted, non-overlapping. opts.precise = memory-sync mode (words are not secrets). */
+export function findSecrets(text, opts = {}) {
+  const s = String(text ?? '');
+  const precise = !!opts.precise;
+  const hits = [];
+  const add = (kind, start, end) => { if (!/^\[redacted/i.test(s.slice(start, end))) hits.push({ kind, start, end }); };
+  const grp = (m, i) => { const v = m[i]; const at = m.index + m[0].lastIndexOf(v); return [at, at + v.length]; };
+  for (const [kind, kw] of KEYWORDS) {
+    for (const m of s.matchAll(kwRe(kw))) {
+      const i = m[1] ? 1 : 2;
+      if (i === 2 && m[2].length < 4) continue;
+      if (i === 1 && m[1].length < 2) continue;
+      if (precise && !preciseValueOk(kind, m[i])) continue;
+      add(kind, ...grp(m, i));
+    }
+  }
+  for (const m of s.matchAll(/sort[ \t]*code[^\d\n]{0,15}(\d{2}-?\d{2}-?\d{2})(?!\d)/gi)) add('sort-code', ...grp(m, 1));
+  for (const m of s.matchAll(/account(?:[ \t]*(?:number|no\.?|num))?[^\d\n]{0,15}(\d{8})(?!\d)/gi)) add('account-number', ...grp(m, 1));
+  for (const m of s.matchAll(/customer[ \t]*(?:number|no\.?|num|id)[^\d\n]{0,15}(\d{6,})(?!\d)/gi)) add('customer-number', ...grp(m, 1));
+  for (const m of s.matchAll(/(?<![\d-])\d(?:[ -]?\d){12,18}(?![\d-])/g)) {
+    const d = m[0].replace(/[ -]/g, '');
+    if (precise) {
+      if (!CARD_FORM.test(m[0]) || /[A-Za-z_]/.test(s[m.index - 1] ?? '') || /[A-Za-z_]/.test(s[m.index + m[0].length] ?? '')) continue;
+      if (/^\d{4}(?:-\d{4}){3}$/.test(m[0]) && /[0-9a-f]{4,}-$/i.test(s.slice(Math.max(0, m.index - 6), m.index))) continue;
+    }
+    if (d.length >= 13 && d.length <= 19 && luhn(d)) add('card-number', m.index, m.index + m[0].length);
+  }
+  for (const m of s.matchAll(/\bsk-[A-Za-z0-9_-]{8,}/g)) if (!precise || m[0].length >= 20) add('api-key', m.index, m.index + m[0].length);
+  for (const m of s.matchAll(/\b(?:ghp|gho|ghs)_[A-Za-z0-9]{16,}/g)) add('api-key', m.index, m.index + m[0].length);
+  for (const m of s.matchAll(/\bAKIA[0-9A-Z]{16}\b/g)) add('api-key', m.index, m.index + m[0].length);
+  for (const m of s.matchAll(/\beyJ[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]+){1,2}/g)) add('jwt', m.index, m.index + m[0].length);
+  hits.sort((a, b) => a.start - b.start || b.end - a.end);
+  const out = [];
+  for (const h of hits) { const last = out[out.length - 1]; if (last && h.start < last.end) continue; out.push(h); }
+  return out;
+}
+
+/** -> unique kinds in order of appearance ([] when clean). */
+export const secretKinds = (text, opts) => [...new Set(findSecrets(text, opts).map(h => h.kind))];
+
+/** Matched values become [REDACTED:<kind>]; everything else is untouched. */
+export function redactSecrets(text) {
+  if (typeof text !== 'string' || !text) return text;
+  const hits = findSecrets(text);
+  if (!hits.length) return text;
+  let out = '', at = 0;
+  for (const h of hits) { out += text.slice(at, h.start) + `${REDACTED}:${h.kind}]`; at = h.end; }
+  return out + text.slice(at);
+}

package/lib/quoxon/slash/agents.js

@@ -101,11 +101,12 @@ export const LOOSE_SAFE = new Set(['help', 'status', 'context', 'cost', 'agents'
 export function looseCommand(cmd, restArg) {
   const words = String(restArg || '').trim().split(/\s+/).filter(Boolean);
   for (let i = 0; i < words.length; i++) {
+    if (words[i].replace(/^\//, '').length < 2 && !words[i].startsWith('/')) continue; // a bare "r" in prose is not the /r alias
     const e = findEntry(words[i].replace(/^\//, ''));
     if (!e || e.kind !== 'command' || e.status !== 'active') continue;
     const rest = words.slice(i + 1).join(' ');
     if (LOOSE_SAFE.has(e.id)) return { run: `/${e.id}${rest ? ` ${rest}` : ''}`, name: `/${e.id}` };
-    return { suggest: `/${e.id}${rest ? ` ${rest}` : ''}` };
+    return { suggest: `/${e.id}` }; // a command NAME only, never the user's message text
   }
   if (words.length && !suggestCommands(cmd).length) return { ask: `${String(cmd).replace(/^\//, '')} ${words.join(' ')}` };
   return null;

package/lib/quoxon/slash/argSources.js

@@ -6,6 +6,7 @@
 import { CHOICES, connectedChoices, providerId } from '../model.js';
 import { liveModels } from '../modelPrefs.js';
 import { pathItems } from '../slotChat.js';
+import { fromOf, activeMutes } from '../inboxView.js';
 
 /** Provider ids /connect understands (one per provider; the subscription has no key). */
 export const connectIds = () => [
@@ -14,7 +15,7 @@ export const connectIds = () => [
   ).values(),
 ];
 
-export function createArgSources({ api, getPrefs = () => ({ favourites: [], default: null }), getRows = () => [] }) {
+export function createArgSources({ api, getPrefs = () => ({ favourites: [], default: null }), getRows = () => [], getExt = null, getInbox = null }) {
   return async function source(src, param) {
     switch (src) {
       case 'providers':
@@ -38,12 +39,18 @@ export function createArgSources({ api, getPrefs = () => ({ favourites: [], defa
           value: String(i + 1),
           desc: `${f.provider} ${f.model}`,
         }));
+      case 'ext.listed': return (getExt?.().listed?.() || []).map((v) => ({ value: v }));
+      case 'ext.loaded': return (getExt?.().loaded?.() || []).map((v) => ({ value: v }));
+      case 'ext.panels': return [...(getExt?.().panels?.() || []).map((p) => ({ value: p.name, desc: p.title })), { value: 'off', desc: 'collapse the panel region' }];
+      case 'ext.keys': return (getExt?.().keys?.(param) || []).map((d) => ({ value: d.key, desc: d.help }));
+      case 'inbox.sources': return [...new Set((getInbox?.().list?.() || []).map((i) => fromOf(i).toLowerCase()))].map((v) => ({ value: v }));
+      case 'inbox.mutes': return Object.keys(activeMutes(getInbox?.().mutes?.())).map((v) => ({ value: v }));
       case 'rows':
         return (getRows?.() || []).map((r) => ({ value: r.id, desc: r.source.type }));
       case 'orgs':
         return (await api.orgs()).map((o) => ({ value: o.slug || o.id, desc: o.name || '' }));
       case 'agents':
-        return (await api.agents()).map((a) => ({
+        return [...(await api.agents())].sort((x, y) => String(x.agent_id).localeCompare(String(y.agent_id))).map((a) => ({
           value: a.agent_id,
           desc: a.name && a.name !== a.agent_id ? a.name : '',
         }));

package/lib/quoxon/slash/args.js

@@ -41,7 +41,7 @@ const asItem = (x) =>
 /** Static choices of a level as items. */
 export const staticItems = (lv) => (lv?.choices || []).map(asItem);
 
-/** Prefix matches first, then substring; the exact sole match is dropped (nothing to add). */
+/** Prefix matches first, then substring, then display-name matches; the exact sole match is dropped (nothing to add). */
 export function rankArgs(items, partial) {
   const q = String(partial || '').toLowerCase();
   const seen = new Set();
@@ -51,7 +51,9 @@ export function rankArgs(items, partial) {
   const sub = uniq.filter(
     (i) => !i.value.toLowerCase().startsWith(q) && i.value.toLowerCase().includes(q),
   );
-  const out = [...pre, ...sub];
+  // A display name (desc) that matches also surfaces the item, after every id match: /attach vulcan finds forge.
+  const byDesc = uniq.filter((i) => !pre.includes(i) && !sub.includes(i) && String(i.desc || '').toLowerCase().includes(q));
+  const out = [...pre, ...sub, ...byDesc];
   return out.length === 1 && out[0].value.toLowerCase() === q ? [] : out;
 }
 

package/lib/quoxon/slash/broadcast.js

@@ -3,7 +3,7 @@
  * No I/O. v1 scope: all held slots or --slots, --priority urgent, --ack, /page. Scheduling, voice,
  * fleet and org reach, bulletins and drafting are not built.
  */
-export const BROADCAST_USAGE = 'Usage: /broadcast [--slots a,b] [--priority urgent] [--ack] <text>';
+export const BROADCAST_USAGE = 'Usage: /broadcast [--slots a,b] [--priority urgent] [--ack] [--active [--dry-run]] <text>';
 export const PAGE_USAGE = 'Usage: /page <slot> <text>';
 const NOT_YET = new Set(['--fleet', '--org', '--voice', '--at']);
 
@@ -13,13 +13,15 @@ const NOT_YET = new Set(['--fleet', '--org', '--voice', '--at']);
  */
 export function parseBroadcastArgs(arg) {
   const toks = String(arg || '').trim().split(/\s+/).filter(Boolean);
-  let slots = null; let priority = 'normal'; let ack = false;
+  let slots = null; let priority = 'normal'; let ack = false; let active = false; let dryRun = false;
   let i = 0;
   for (; i < toks.length && toks[i].startsWith('--'); i += 1) {
     const [flag, inline] = toks[i].split(/=(.*)/s);
     if (NOT_YET.has(flag)) return { ok: false, message: `${flag} is not available yet (v1 sends to held slots in this org: --slots, --priority, --ack).` };
     if (flag === '--all') { slots = null; continue; }
     if (flag === '--ack') { ack = true; continue; }
+    if (flag === '--active') { active = true; continue; }
+    if (flag === '--dry-run') { dryRun = true; continue; }
     const val = inline !== undefined ? inline : toks[++i];
     if (flag === '--slots') {
       const list = String(val || '').split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
@@ -34,7 +36,12 @@ export function parseBroadcastArgs(arg) {
   }
   const text = toks.slice(i).join(' ');
   if (!text) return { ok: false, message: BROADCAST_USAGE };
-  return { ok: true, text, slots, priority, ack };
+  return { ok: true, text, slots, priority, ack, ...(active ? { active: true } : {}), ...(dryRun ? { dryRun: true } : {}) };
+}
+
+/** QuoxGlyph announce line for a broadcast to active sessions: { reached, skipped, dryRun }. */
+export function activeLine({ reached = 0, skipped = 0, dryRun = false } = {}) {
+  return `\u{1F4CD} QUOXSLOTS \u2502 broadcast to active \u2502 ${reached} ${dryRun ? 'would reach' : 'reached'} \u00B7 ${skipped} skipped dormant \u2714`;
 }
 
 /** `/page <slot> <text>` -> urgent, ack-required, one recipient. */
@@ -72,9 +79,10 @@ export function broadcastCard(r, { kind = 'broadcast' } = {}) {
   const c = r?.counts || {};
   const rc = roomC(r);
   const rows = [];
-  if (!c.total) rows.push([['\u26A0 no held slots in this org to hear it', 'warn']]);
+  if (!c.total) rows.push([[r?.skipped_dormant ? `\u26A0 no active sessions to hear it \u00B7 ${r.skipped_dormant.length} dormant skipped` : '\u26A0 no held slots in this org to hear it', 'warn']]);
   else if (c.delivered) {
-    rows.push([[`\u2714 ${c.delivered} ${c.delivered === 1 ? 'session has' : 'sessions have'} it`, 'ok']]);
+    const act = r?.skipped_dormant ? 'active ' : ''; // --active: say who was left alone
+    rows.push([[`\u2714 ${c.delivered} ${act}${c.delivered === 1 ? 'session has' : 'sessions have'} it${r?.skipped_dormant ? ` \u00B7 ${c.dormant_skipped ?? r.skipped_dormant.length} dormant skipped` : ''}`, 'ok']]);
     if (namesRow(r)) rows.push([[namesRow(r), 'prose']]); // an older server sends no per-slot list: no empty row
   }
   for (const d of badSlots(r).slice(0, 3)) rows.push([[`\u2716 ${failText(d)}`, 'error']]);
@@ -105,7 +113,12 @@ export function broadcastSummary(r) {
   const c = r?.counts || {};
   const rc = roomC(r);
   const lines = [];
+  if (!c.total && r.skipped_dormant) return [[`Broadcast ${r.id}: no active sessions to hear it \u00B7 ${r.skipped_dormant.length} dormant skipped${r.skipped_dormant.length ? ` (${r.skipped_dormant.join(', ')})` : ''}.`, 'warn']];
   if (!c.total) return [[`Broadcast ${r.id}: no held slots in this org to hear it.`, 'warn']];
+  if (r.skipped_dormant) { // --active: say who was left alone
+    const dn = r.skipped_dormant;
+    lines.push([`Broadcast ${r.id} ${titleWord(r)}: ${(c.delivered || 0) + (c.queued || 0)} active have it${okSlots(r).length ? ` (${okSlots(r).map((d) => d.slot).join(', ')})` : ''} \u00B7 ${dn.length} dormant skipped${dn.length ? ` (${dn.join(', ')})` : ''}`, c.failed ? 'warn' : 'plain']);
+  } else
   lines.push([`Broadcast ${r.id} ${titleWord(r)}: ${(c.delivered || 0) + (c.queued || 0)} of ${c.total} ${plural(c.total)} have it${okSlots(r).length ? ` (${okSlots(r).map((d) => d.slot).join(', ')})` : ''}`, c.failed ? 'warn' : 'plain']);
   if (c.delivered && roomText(rc, ', ')) lines.push([`  chat rooms: ${roomText(rc, ', ')}`, rc.failed ? 'warn' : 'plain']);
   for (const d of badSlots(r)) lines.push([`  ${failText(d)}`, 'warn']);

package/lib/quoxon/slash/broadcastRun.js

@@ -3,7 +3,7 @@
  * One server call fans out (POST /api/v1/slots/broadcast); with --ack the sender then sees the delivery line
  * update as recipients acknowledge. The poll is display only: the broadcast and its acks live on the server.
  */
-import { parseBroadcastArgs, parsePageArgs, parseAckArgs, parseStatusArgs, broadcastSummary, broadcastCard, BROADCAST_USAGE } from './broadcast.js';
+import { parseBroadcastArgs, parsePageArgs, parseAckArgs, parseStatusArgs, broadcastSummary, broadcastCard, BROADCAST_USAGE, activeLine } from './broadcast.js';
 
 const roomC = (r) => ({ sent: 0, sending: 0, failed: 0, ...(r?.counts?.room || {}) });
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -22,9 +22,20 @@ export async function runBroadcast({ api, kind, arg, from, say, card = null, isC
   }
   const parsed = kind === 'page' ? parsePageArgs(arg) : parseBroadcastArgs(arg);
   if (!parsed.ok) return say(parsed.message, parsed.message === BROADCAST_USAGE ? 'plain' : 'warn');
-  const r = await api.slotBroadcast({ text: parsed.text, slots: parsed.slots, priority: parsed.priority, ack: parsed.ack, from });
+  const r = await api.slotBroadcast({ text: parsed.text, slots: parsed.slots, priority: parsed.priority, ack: parsed.ack, active: parsed.active, ...(parsed.dryRun ? { dryRun: true } : {}), from });
   if (!r.ok) return say(`${kind === 'page' ? 'Page' : 'Broadcast'} failed: ${r.message}`, 'warn');
+  if (r.data?.dry_run) { // BROADCAST-ACTIVE --dry-run: who would hear it, who is dormant; nothing sent, no card
+    const would = r.data.would_reach || []; const dorm = r.data.skipped_dormant || [];
+    say(activeLine({ reached: would.length, skipped: dorm.length, dryRun: true }), 'ok');
+    if (would.length) say(`  would reach: ${would.join(', ')}`, 'plain');
+    if (dorm.length) say(`  skipped dormant: ${dorm.join(', ')}`, 'plain');
+    return say('Dry run: nothing was sent.', 'plain');
+  }
   show(r.data);
+  if (parsed.active && r.data?.skipped_dormant) {
+    say(activeLine({ reached: r.data.counts?.delivered || 0, skipped: r.data.skipped_dormant.length }), 'ok');
+    if (r.data.skipped_dormant.length) say(`  skipped dormant: ${r.data.skipped_dormant.join(', ')}`, 'plain');
+  }
   // PRESENCE: it reached a human slot whose human is away; approvals to them will queue.
   if (r.data?.human_presence?.away && r.data.human_presence.notice) say(`⏸ ${r.data.human_presence.notice}`, 'warn');
   // POKE-WAKE: a page also asks each delivered slot's keeper to wake its idle session, so the page is read now,