quoxcli 0.4.0 → 0.5.0

package/lib/quoxon/slotOutbox.js

@@ -0,0 +1,113 @@
+/**
+ * SLOT-OUTBOX: a /say or @slot message that could not be sent because QuoxCORE did not answer (fetch failed,
+ * ECONNREFUSED, socket error, timeout, 5xx) is kept on disk and sent when it answers again, never lost.
+ * Local only (~/.quox/slot-outbox.json, mode 0600, per OS user; each entry also carries the profile it was typed in,
+ * and a window only ever sends its own profile's entries, so a message never changes org).
+ *
+ * Never for a 4xx (auth, permission, no such slot): that is the user's to fix, so the text stays in the prompt.
+ *
+ * ONE-SEND RULE (the slot-say endpoint has no idempotency key, so the client must be conservative):
+ *   1. An entry is flipped to `sending` and persisted BEFORE the request goes out.
+ *   2. Success removes it (it is never sent again).
+ *   3. A clean failure (the server did not answer) puts it back to `queued`.
+ *   4. An entry still `sending` when the file is next read by a process that is not flushing is `unsure`: the window
+ *      died mid-request, so the message may have been delivered. `unsure` entries are never auto-sent; /outbox shows
+ *      them and `/outbox send` (explicit) is the only thing that will try them.
+ *   Residual risk, stated: a timeout where the server did receive the message but the reply was lost can duplicate it
+ *   once on flush. Duplicate over lost is the chosen side for a message the owner typed and saw fail.
+ */
+import { readFileSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { randomBytes } from 'node:crypto';
+
+export const OUTBOX_CAP = 50;
+export const defaultOutboxPath = (home = homedir()) => join(home, '.quox', 'slot-outbox.json');
+
+/** A send result worth queueing: no HTTP status (fetch failed, refused, socket, timeout) or a 5xx. Never a 4xx, ambiguity, or a licence refusal. */
+export function isConnectivityFailure(r) {
+  if (!r || r.ok || r.ambiguous || r.unlicensed) return false;
+  if (r.status == null) return true;
+  return Number(r.status) >= 500;
+}
+
+export function slotOutbox(path = defaultOutboxPath(), { now = () => Date.now() } = {}) {
+  const read = () => {
+    try { const d = JSON.parse(readFileSync(path, 'utf8')); return Array.isArray(d?.items) ? d : { items: [] }; }
+    catch { return { items: [] }; }
+  };
+  const write = (d) => {
+    try {
+      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+      const tmp = `${path}.${process.pid}.tmp`;
+      writeFileSync(tmp, JSON.stringify(d), { mode: 0o600 });
+      renameSync(tmp, path);
+      return true;
+    } catch { return false; }
+  };
+  let flushing = false; // this process is mid-flush: its own `sending` entry is live, not crashed
+  const settle = (d) => { // a `sending` entry nobody in this process is sending is a crashed send; persist that verdict
+    if (flushing) return d;
+    let changed = false;
+    for (const it of d.items) if (it.status === 'sending') { it.status = 'unsure'; changed = true; }
+    if (changed) write(d);
+    return d;
+  };
+  const mine = (it, profile) => profile == null || it.profile == null || it.profile === profile;
+  return {
+    /** Entries in send order (oldest first), optionally only this profile's. */
+    list: ({ profile = null } = {}) => settle(read()).items.filter(i => mine(i, profile)),
+    /** -> { ok:true, item, count } | { ok:false, full:true, count }. The cap is on entries not yet sent. */
+    enqueue({ slot, text, profile = null }) {
+      const d = settle(read());
+      if (d.items.length >= OUTBOX_CAP) return { ok: false, full: true, count: d.items.length };
+      const item = { id: `ob_${now().toString(36)}_${randomBytes(3).toString('hex')}`, slot, text: String(text), profile, created_at: new Date(now()).toISOString(), status: 'queued', tries: 0 };
+      d.items.push(item);
+      if (!write(d)) return { ok: false, unsaved: true, count: d.items.length };
+      return { ok: true, item, count: d.items.filter(i => mine(i, profile)).length };
+    },
+    /** Remove the Nth entry (1-based, as /outbox lists this profile's). -> the dropped item, or null. */
+    drop(n, { profile = null } = {}) {
+      const d = settle(read());
+      const visible = d.items.filter(i => mine(i, profile));
+      const it = visible[Number(n) - 1];
+      if (!it) return null;
+      d.items = d.items.filter(i => i.id !== it.id);
+      write(d);
+      return it;
+    },
+    /**
+     * Send what is queued, in order, once. send(item) -> { ok:true } | { ok:false, retryable }. A retryable failure stops
+     * the flush (the server is still down; order is kept). A non-retryable one marks that entry `failed` and moves on.
+     * `includeUnsure` (explicit /outbox send only) also tries entries that may already have been delivered.
+     * -> { sent:[items], failed:[items {error}], pending:n, busy? }.
+     */
+    async flush(send, { profile = null, includeUnsure = false } = {}) {
+      if (flushing) return { sent: [], failed: [], pending: 0, busy: true };
+      flushing = true;
+      const sent = []; const failed = [];
+      try {
+        const ids = settle(read()).items.filter(i => mine(i, profile) && (i.status === 'queued' || (includeUnsure && i.status === 'unsure'))).map(i => i.id);
+        for (const id of ids) {
+          const d = read();
+          const it = d.items.find(i => i.id === id);
+          if (!it || !(it.status === 'queued' || it.status === 'unsure')) continue; // dropped or sent meanwhile
+          it.status = 'sending'; it.tries = (it.tries || 0) + 1; write(d); // persisted BEFORE the request
+          let r;
+          try { r = await send(it); } catch (e) { r = { ok: false, retryable: true, error: e?.message }; }
+          const after = read();
+          const cur = after.items.find(i => i.id === id);
+          if (r?.ok) { after.items = after.items.filter(i => i.id !== id); write(after); sent.push(it); continue; }
+          if (cur) { cur.status = r?.retryable === false ? 'failed' : 'queued'; if (r?.error) cur.error = String(r.error); write(after); }
+          if (r?.retryable === false) { failed.push({ ...it, error: r.error || 'refused' }); continue; }
+          break; // still not answering: keep the rest, in order, for the next recovery
+        }
+      } finally { flushing = false; }
+      return { sent, failed, pending: settle(read()).items.filter(i => mine(i, profile) && i.status === 'queued').length };
+    },
+  };
+}
+
+export const queuedLine = (slot, count) => `⏸ queued for ${slot}: will send when QuoxCORE answers (${count} queued) · /outbox`;
+export const sentLine = (slot) => `✔ sent queued message to ${slot}`;
+export const fullLine = (cap = OUTBOX_CAP) => `Outbox is full (${cap} queued). Not queued: your text is back in the prompt. /outbox shows them, /outbox drop N removes one, /outbox send retries now.`;

package/lib/quoxon/suggestCommand.js

@@ -8,7 +8,7 @@
 import { findCommandEntry } from './commands.js';
 
 // Commands that need the human's own typing: never offered, never run from a model suggestion.
-export const HUMAN_TYPED = new Set(['approve', 'yestoall', 'deny', 'authorise', 'authorize', 'authenticate', 'override', 'restart', 'quit', 'exit', 'login']);
+export const HUMAN_TYPED = new Set(['approve', 'yestoall', 'deny', 'authorise', 'authorize', 'authenticate', 'override', 'verify-email', 'restart', 'quit', 'exit', 'login']);
 // Pure views, no effect: may run without asking when explicit, and only with no arguments.
 export const READ_ONLY_VIEWS = new Set(['approvals', 'mind', 'which', 'context', 'rooms', 'active', 'slots']);
 

package/lib/quoxon/term.js

@@ -48,8 +48,19 @@ export function inkStdout(out, { tap = null } = {}) {
     if (cb) out.write('', cb); // nothing to send: still a barrier behind the earlier writes
     return true;
   } : null;
-  return new Proxy(out, {
+  // Resize: Ink repaints its last committed tree at the new width the moment 'resize' fires, which wraps every 78-wide rule for a
+  // beat (owner 2026-10-27: top rule and model label wrapped after 79 -> 58). Listeners for 'resize' run RESIZE_SETTLE_MS late, so
+  // the app (which flags its own listener `resizeFirst`) commits the new column count first and Ink paints the right width once.
+  const lateOf = new WeakMap();
+  const lateListener = (fn) => {
+    if (fn.resizeFirst) return fn;
+    if (!lateOf.has(fn)) lateOf.set(fn, (...a) => { const t = setTimeout(() => fn(...a), RESIZE_SETTLE_MS); t.unref?.(); });
+    return lateOf.get(fn);
+  };
+  const proxy = new Proxy(out, {
     get(target, prop) {
+      if ((prop === 'on' || prop === 'addListener' || prop === 'once') && typeof target[prop] === 'function') return (ev, fn, ...r) => { target[prop](ev, ev === 'resize' && typeof fn === 'function' ? lateListener(fn) : fn, ...r); return proxy; };
+      if ((prop === 'off' || prop === 'removeListener') && typeof target[prop] === 'function') return (ev, fn, ...r) => { target[prop](ev, ev === 'resize' && typeof fn === 'function' ? lateListener(fn) : fn, ...r); return proxy; };
       if (prop === 'write' && write) return write;
       if (prop === 'rows') return Infinity;
       if (prop === 'termRows') return target.rows;
@@ -61,7 +72,20 @@ export function inkStdout(out, { tap = null } = {}) {
     },
     set(target, prop, value) { return Reflect.set(target, prop, value, target); }
   });
+  return proxy;
+}
+const RESIZE_SETTLE_MS = 40;
+
+/**
+ * The width to print history at, read from the terminal NOW. The `cols` state lags a resize (the listener attaches after mount,
+ * and the commit is async), and a <Static> item printed at the stale width is wider than the new terminal, so the terminal
+ * breaks it mid-word. Never wider than the state either (a pinned `columns` prop wins when it is narrower).
+ */
+export function liveCols(stdout, stateCols) {
+  const n = Number(stdout?.columns);
+  return Number.isFinite(n) && n > 0 ? Math.min(stateCols, Math.max(MIN_STATIC_COLS, n - 1)) : stateCols;
 }
+const MIN_STATIC_COLS = 20;
 
 /** Real terminal height, or null when unknown (not a TTY, tests). */
 export function termRows(stdout) {

package/lib/quoxon/transcript.js

@@ -11,6 +11,7 @@ import { stripMarks } from './palette.js';
 import { textGate } from './events.js';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
+import { redactSecrets } from './secretShape.js';
 
 export const MAX_FIELD = 4000;
 export const SILENT_GAP_MS = 10000;
@@ -33,7 +34,7 @@ const SCRUBS = [
 export function scrub(s) {
   let out = String(s);
   for (const [re, rep] of SCRUBS) out = out.replace(re, rep);
-  return out;
+  return redactSecrets(out); // SECRET-GUARD: bank/PIN/card shapes, after the key patterns
 }
 
 /** Strings are scrubbed and truncated; non-strings become a scrubbed JSON string (never a raw object). */

package/lib/quoxon/welcome.js

@@ -6,7 +6,7 @@ import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 
-export const DOCS_URL = 'https://cli.quox.ai/docs/start/'; // #1100: CLI docs "Start here" (cli.quox.ai/docs/ itself has no index page)
+export const DOCS_URL = 'https://quox.ai/cli/'; // #1100: CLI docs start page (cli.quox.ai retired 2026-10-26, moved to quox.ai/cli)
 export const TERMS_URL = 'https://quox.ai/terms';
 export const PRIVACY_URL = 'https://quox.ai/privacy';
 export const LICENCE = 'Quox Community Source Licence 1.0 (source-available)';

package/lib/quoxon/whatsnew.js

@@ -109,7 +109,7 @@ export function listWhatsNew(arg = '', entries = ENTRIES) {
 // Startup preference: quoxon.whatsNewStartup = 'on' | 'off' (default on). Both live in the synced profile settings.
 export const startupEnabled = (settings) => String(settings?.whatsNewStartup || 'on').toLowerCase() !== 'off';
 
-const activeCommands = (registry) => registry.filter(e => e.kind === 'command' && e.status === 'active');
+const activeCommands = (registry) => registry.filter(e => e.kind === 'command' && e.status === 'active' && !e.dyn);
 
 /**
  * Commands the user has not been shown, newest first (registry is oldest first, so reversed). With no record yet

package/lib/quoxon/whatsnew.jsonl

@@ -132,3 +132,39 @@
 {"id": "loop-card-polish", "date": "2026-10-26T13:00:00Z", "since": "0.3.1", "title": "The loop card keeps its own count", "text": "The card now counts the loop's own turns (turn 2 of 5, not the message count), shows the whole runway, fills a receipts bar as each one is witnessed, and says a milestone once. With an empty composer, press Down to reach its keys. A finished loop calls its dragon.", "try": "/loop list"}
 {"id": "org-picker", "date": "2026-10-26T16:30:00Z", "since": "0.3.1", "title": "Switch org in one keystroke", "text": "Type /org for a list of your orgs, arrow to one and press Enter: this window moves there at once and the status bar follows. Press d instead to also make it your default. /org hampshire switches straight away when only one org matches, and quox org switch with no argument gives a numbered list.", "try": "/org"}
 {"id":"quoxcli-0-4-0","date":"2026-10-26T18:00:00Z","since":"0.4.0","title":"quoxon extensions, an inbox bar, history and mouse editing","text":"Add and manage extensions with quox ext add, quox ext remove and quox ext list, or /ext in the window. /inbox and a notification bar show what is waiting. Up and Ctrl+R search your history. /mouse turns on optional mouse editing. Plan approval cards now list their steps, and live loop cards no longer freeze the window.","try":"/ext","shell":"quox ext list"}
+{"id": "dragons-vulcan-quoxperticus", "date": "2026-10-27T09:00:00Z", "since": "0.3.1", "title": "Two new dragons: Vulcan and Quoxperticus", "text": "Two new dragons: Vulcan, the forge dragon, and Quoxperticus, the fleet conductor. Attach either agent and the dragon greets you, listens while you work, waits with you at approvals and shows when something needs attention.", "try": "/attach vulcan"}
+{"id": "quoxon-2026-10-27-honest-window", "date": "2026-10-27T12:30:00Z", "since": "0.4.0", "title": "A calmer, more honest window", "text": "When your model hits a usage limit, the window offers a working one (y/N). Auto-restart waits at least 30 minutes between restarts and only when you are idle; inside that time a new version shows a quiet line and Enter restarts. The status bar no longer says nothing is waiting while items are open or a source can't be read. /say and /observe reach your slots in your other orgs (name@org picks one). /approvals opens faster, and a refused loop shows why instead of fake progress.", "try": "/approvals"}
+{"id": "quoxon-2026-10-27-delete-confirm", "date": "2026-10-27T16:30:00Z", "since": "0.4.0", "title": "Deletes need the name typed", "text": "An approval that deletes something (delete_*, remove_*, purge_*, destroy_*, drop_*, wipe_*) now leads with DELETES and the object, and a single y no longer approves it: y asks you to type the name, Esc or n goes back, n on the card still denies. Bulk approve (/yestoall, /approve all) skips deletes and tells you how many are left to confirm one by one.", "try": "/approvals"}
+{"id": "quoxon-2026-10-28-approval-burst", "date": "2026-10-28T00:30:00Z", "since": "0.4.0", "title": "A burst of approvals is one card", "text": "When one agent asks to run the same tool several times within 5 minutes (say nine wire_alerts), you get ONE card: 'VIGIL wants to run wire_alerts on 9 items'. y approves all, n denies all, p walks them one by one, Tab puts it away. Deletes and risky asks are never in the batch; they keep their own card and confirm. The inbox arrival line collapses the same way.", "try": "/approvals"}
+{"id": "quoxon-2026-10-28-burst-across-polls", "date": "2026-10-28T04:00:00Z", "since": "0.4.0", "title": "Pack installs on many hosts are one card", "text": "DevSuite pack installs filed a few seconds apart for different hosts used to arrive as one card each. They now merge into ONE card (y approves all, n denies all, p picks), and the card says who asked in plain words ('DevSuite (skill-pack sync)') instead of an internal key. Restart, deploy and other disruptive asks still never batch.", "try": "/approvals"}
+{"id": "quoxon-2026-10-28-afk-quiet-cards", "date": "2026-10-28T06:45:00Z", "since": "0.4.0", "title": "Away means quiet", "text": "After /afk or /sleep, new approvals no longer open a card or arm y/n (a stray key cannot answer one). They are only counted: \"⏸ N approvals waiting · /back to review\". /back, or any message you type, opens them as before. Nothing is ever answered for you."}
+{"id": "quoxon-2026-10-28-agent-profile-offer", "date": "2026-10-28T15:00:00Z", "since": "0.4.0", "title": "Opened as an agent? Quox offers your own login", "text": "Starting quox on an agent profile while you have a signed-in human profile now asks once (y/N) to restart as you. Typing \"attach to hitl slot\" offers /slot hitl instead of going to the model."}
+{"id": "quoxon-2026-10-28-secret-paste-guard", "date": "2026-10-28T17:00:00Z", "since": "0.4.0", "title": "Pasted credentials are caught", "text": "A message that looks like bank details, a PIN, a password, a card number or an API key now asks \"Don't send it?\" (y keeps it out, n sends anyway). Nothing is sent or saved on y, and history and transcripts store [REDACTED:kind] in place of the value either way."}
+{"id": "quoxon-2026-10-28-do-not-disturb", "date": "2026-10-28T18:00:00Z", "since": "0.4.0", "title": "Sleep means sleep: /donotdisturb and /morningreport", "text": "/donotdisturb (or /dnd, optionally until 07:30) collects everything quietly: no notices, approval cards, bells or dragon. The status line shows \"🌙 do not disturb · N waiting · /morningreport\". /morningreport groups what came in (incidents first, repeats as ×N) and offers to turn it off. /afk and /sleep imply it, saying you are going to sleep offers it, and a restarted window restores it."}
+{"id": "quoxon-2026-10-29-provider-test-json", "date": "2026-10-29T12:00:00Z", "since": "0.4.0", "title": "quox provider test --json says why", "text": "quox provider test --json now prints every provider's result (ok, error, reason code) and a summary, instead of nothing, and still exits 1 when one fails."}
+{"id": "quoxon-2026-10-29-connect-server-install", "date": "2026-10-29T13:00:00Z", "since": "0.4.0", "title": "quox connect and quox server install", "text": "quox connect links this machine to a Quox server. quox server install sets up a new server on this machine: checks, download, start, owner account and a one-time sign-in link. Try quox server install --dry-run first. The sign-in link is not printed into piped or --json output unless you pass --print-login-link.", "shell": "quox server install --dry-run", "sha": "34a547724"}
+{"id": "quoxon-2026-10-29-morningreport-fallback", "date": "2026-10-29T14:00:00Z", "since": "0.4.0", "title": "/morningreport shows the digest when nothing was held", "text": "With do not disturb off, /morningreport now says nothing was held and shows the same While you were away digest as /away, so you no longer need a second command.", "sha": "c4f2a3c90"}
+{"id": "quoxon-2026-10-29-never-answered-offer", "date": "2026-10-29T15:00:00Z", "since": "0.4.0", "title": "A server that never answered now offers to connect elsewhere", "text": "If this machine has never reached the server a profile points at, Quox now asks whether to connect to a different one instead of waiting on a restart that is not happening. Say y, type the address, and it checks the server, shows its certificate and signs you in."}
+{"id": "quoxon-2026-10-29-approval-outcome", "date": "2026-10-29T16:00:00Z", "since": "0.4.0", "title": "You now see whether an approved action worked", "text": "After you approve a request from another session, Quox follows up with one line saying whether it finished or failed and why. The failed-to-execute notice now carries the approval id, so quox inbox show <id> opens it."}
+{"id": "quoxon-2026-10-29-deck-lazy-offer", "date": "2026-10-29T17:00:00Z", "since": "0.4.0", "title": "/deck now offers to install what it needs", "text": "If quoxdeck is missing, or its audio headers (libasound2-dev) are, /deck on asks once whether to install them, shows the exact commands, and runs them with your own sudo prompt. Say n and it prints the commands to run later."}
+{"id":"quoxon-2026-10-29-connect-no-terminal","date":"2026-10-29T08:50:36Z","since":"0.4.0","title":"quox connect can run with no terminal","text":"quox connect now takes --email, --password-stdin and --fingerprint <sha256>, so a script or chat can connect and sign in with no prompts. quox server status shows the certificate fingerprint to compare, a certificate Quox does not trust now says so in plain words with the fix, and the same email on a different server no longer trips the same-user warning."}
+{"id":"quoxcli-2026-10-29-tls-trust-hint","date":"2026-10-29T09:26:52Z","since":"0.4.0","title":"A certificate Quox does not trust now says so on login","text":"If a server uses a certificate this machine does not trust yet, quox login now says so in plain words and prints the exact quox connect command to trust it (it shows the fingerprint and asks y/N; --trust-cert or --fingerprint for no terminal), instead of just \"fetch failed\"."}
+{"id":"quoxon-2026-10-29-gripe-queue","date":"2026-10-29T09:46:49Z","since":"0.4.0","title":"/gripe no longer loses a gripe when Quox is slow","text":"If /gripe! times out or the server errors, the gripe is saved on your machine and filed when Quox answers again, without making a duplicate issue if the first try had actually gone through. /gripes shows what is waiting and what was filed."}
+{"id":"quoxon-2026-10-29-gripe-paste-lines","date":"2026-10-29T10:10:00Z","since":"0.4.0","title":"/gripe keeps the lines of what you paste","text":"A multi-line paste into /gripe now reaches the issue with its lines intact instead of one run-on line, and the confirm says how many more lines will be filed."}
+{"id":"quoxon-2026-10-29-advice-independent","date":"2026-10-29T11:00:00Z","since":"0.4.0","title":"Test-edit approvals no longer echo the asker as advice","text":"On a test-edit approval card, ADVICE now cites the diff when it is known, or says there is no independent view, instead of repeating the asker's own recommendation; the starred recommended-by line stays."}
+{"id":"quoxon-2026-10-29-resume-no-duplicate","date":"2026-10-29T12:00:00Z","since":"0.4.0","title":"quox claude --resume no longer starts a second copy","text":"Resuming a named session now finds its tmux session whatever the capitals and attaches to it, and refuses with the pid and the attach command when that conversation is already running anywhere. --force starts a second copy on purpose."}
+{"id": "quoxon-2026-10-29-sleep-one-step", "date": "2026-10-29T09:00:00Z", "since": "0.4.0", "title": "/sleep is one step", "text": "/sleep (or /afk going to bed) sets you asleep with do not disturb on in one command. A bare /dnd now only ever turns it on; /dnd off ends it. Plain /afk offers do not disturb with one y/N."}
+{"id": "quoxon-2026-10-29-roster-sessions", "date": "2026-10-29T17:30:00Z", "since": "0.4.0", "title": "/roster shows attached agents and duplicate sessions", "text": "/roster now lists the live agent attaches in your org and every claude --resume process on this box, grouped by name. A conversation running more than once is flagged with each pid. The same attach list is quox agent attaches."}
+{"id": "quoxon-2026-10-29-announce-everything", "date": "2026-10-29T20:00:00Z", "since": "0.4.0", "title": "Quox announces what it does", "text": "Memory saves, approvals, slot messages, connect and vault create now print one Quox line saying what happened, success or failure, and the chat transcript shows the same line for what a turn did (a saved memory, an approval, a delegation). Silent under --json and --quiet.", "shell": "quox memory create --type fact --content hello"}
+{"id": "quoxon-2026-10-29-walkthrough-command", "date": "2026-10-29T22:30:00Z", "since": "0.4.0", "title": "The walkthrough shows the command", "text": "Each approval card in the walkthrough now shows the exact command in full, never cut off, and the host it runs on. When the reason was guessed from the command rather than stated by the asker, it is labelled so.", "try": "/walkthrough"}
+{"id": "quoxon-2026-10-29-chat-quox-lines", "date": "2026-10-29T22:31:00Z", "since": "0.4.0", "title": "quox chat prints what Quox did", "text": "quox chat, streaming or --no-stream, now prints one Quox line on stderr for what a turn did (a saved memory, an approval, a delegation). Silent under --json and --quiet.", "shell": "quox chat --no-stream \"remember that the proof tag is QA-1036\""}
+{"id": "quoxon-2026-10-30-inbox-unread-quiet-noreply", "date": "2026-10-30T07:00:00Z", "since": "0.4.0", "title": "Undo a read, quieter no-reply, honest timeouts", "text": "/inbox unread N puts an item back as unread. The no reply from a slot notice is dim and skipped when that slot spoke in the last 10 minutes. An approved action whose result timed out is titled no result in time (it may still have run) instead of FAILED.", "try": "/inbox unread 1"}
+{"id": "quoxon-2026-10-30-reattach-deploy-line", "date": "2026-10-30T08:00:00Z", "since": "0.4.0", "title": "A slot reattach during a deploy says so", "text": "When QuoxCORE is being redeployed, a slow slot reattach now says it is restarting and reconnecting, instead of suggesting a stale URL or QUOX_COLLECTOR_URL. A URL that never answered still gets the full diagnostic.", "try": "/slot"}
+{"id":"quoxon-2026-10-30-inbox-unread-cli","date":"2026-10-30T08:27:43Z","since":"0.4.0","title":"Mark unread from a shell, read items whole","text":"quox inbox unread <id> undoes a mark-as-read from a shell, and /inbox unread all flips back every read item. /inbox N now shows the full body of every item (it missed the stored body before), the sender and subject for mail, and the actions that apply.","try":"/inbox 1","shell":"quox inbox unread <id>"}
+{"id":"quoxon-2026-10-30-presence-owner-level","date":"2026-10-30T08:56:21Z","since":"0.4.0","title":"Good morning waits for you; /back agrees across windows","text":"LUCID no longer says good morning at 08:00 while you are asleep or away: it waits until you are back. If another window already marked you present, /back reports that same away span instead of its own.","try":"/back"}
+{"id":"quoxon-2026-10-30-tui-mail","date":"2026-10-30T09:30:00Z","since":"0.4.0","title":"Read your email in the terminal: /mail","text":"/mail lists your newest triaged email (sender, subject, age, zone) and /mail N opens one with its body excerpt and why it was triaged that way. Read only: nothing is sent, moved or deleted. With no mailbox connected it names the connect command. /inbox now points at /mail.","try":"/mail"}
+{"id":"quoxon-2026-10-30-dnd-survives-restart","date":"2026-10-30T10:40:24Z","since":"0.4.0","title":"Do not disturb now survives restarts","text":"Do not disturb is saved on the server for you, not just in one window, so an auto-restart no longer drops it, even when the server is slow to answer at that moment: the window keeps retrying until it can read it.","try":"/dnd"}
+{"id":"quoxon-2026-10-30-reply-address","date":"2026-10-30T11:00:00Z","since":"0.4.0","title":"Messages from slot holders now show their reply address","text":"A message from a session that holds a slot no longer says (no reply address): the TUI looks up the slot the sender holds, so Tab or /r replies to it. It says so only when the sender truly holds no slot."}
+{"id":"quoxon-2026-10-30-approval-row-background","date":"2026-10-30T12:00:00Z","since":"0.4.0","title":"Approval rows flag background work","text":"/approvals rows now say when a command runs in the background, including screen, tmux and docker detached runs."}
+{"id":"quoxon-2026-10-30-confirm-target-once","date":"2026-10-30T22:00:00Z","since":"0.4.0","title":"Approval confirmations name the hosts once","text":"The line after you approve a multi-host command no longer repeats the host list twice."}
+{"id":"quoxon-2026-10-30-away-retry","date":"2026-10-30T22:10:00Z","since":"0.4.0","title":"While you were away retries a slow source","text":"If a source times out right after sign-in, the digest asks it once more before it says it cannot see it."}

package/lib/server/installFlow.js

@@ -0,0 +1,168 @@
+/**
+ * `quox server install`: the existing guided installer behind a CLI verb (ONBOARD-P1).
+ *
+ * Not a second installer. Preflight (onboarding/preflight.js), the real runner (installRunner.js: get.quox.ai ->
+ * setup.sh) and the finisher (finish.js: owner account, sign-in, one-time link) are the same modules the Getting
+ * started screen uses; this file only sequences them and turns their events into stage events:
+ *
+ *   preflight  docker  download  compose-up  health  owner  vault  link
+ *
+ * The runner's own stages fold in as: fetch + configure + build -> download, start -> compose-up, health -> health.
+ * `vault` is skipped here (no AI key is taken on argv); the next step is printed.
+ * Nothing is claimed ok that did not answer: health is the runner's own 2xx probe of the auth service.
+ */
+import { resolve } from 'node:path';
+import { QuoxUserError } from '../core/errors.js';
+import { confirmInteractive } from '../core/confirm.js';
+import { runPreflight, preflightPassed, defaultDeps as preflightDeps } from '../quoxon/onboarding/preflight.js';
+import { defaultInstallDir } from '../quoxon/onboarding/installRunner.js';
+import { passwordProblem, emailOk } from '../quoxon/onboarding/finish.js';
+
+export const INSTALL_STAGES = ['preflight', 'docker', 'download', 'compose-up', 'health', 'owner', 'vault', 'link'];
+const FOLD = { fetch: 'download', configure: 'download', build: 'download', start: 'compose-up', health: 'health' };
+export const PLAN_STEPS = [
+  'check Docker, Compose, git, openssl, disk, RAM and ports (read-only)',
+  'download the installer from get.quox.ai and show its SHA256',
+  'clone the Quox source into the install directory',
+  'write secrets (.env) and a self-signed certificate',
+  'download the Quox images',
+  'start the services with docker compose up -d',
+  'wait until the auth service answers /health with a 2xx',
+  'create your owner account and sign in',
+  'print a one-time dashboard sign-in link (10 minutes)'
+];
+const AGAIN = 'quox server install';
+const LINK_HOW = 'quox -p <profile> dashboard (mints a fresh one-time sign-in link), or re-run with --print-login-link';
+
+/** The preflight copy is shared with the TUI ("press r"); the CLI/JSON path speaks CLI. */
+const cliWords = (t) => String(t == null ? t : t).replace(/,? then press r to check again\.?/gi, ` Then run: ${AGAIN}`).replace(/,? then press r( to try again)?\.?/gi, '.').replace(/\s+\./g, '.').replace(/\.\s*\./g, '.');
+/** This verb never installs Docker: the honest offer is a manual one with the doc link. */
+const cliRow = (r) => ({
+  ...r,
+  ...(r.fix ? { fix: cliWords(r.fix) } : {}),
+  ...(r.offer === 'install' ? { offer: 'manual' } : {})
+});
+
+/** First line of stdin, no trailing newline. */
+export async function readPasswordStdin(readStdin) {
+  const first = String(await readStdin()).split(/\r?\n/)[0];
+  if (!first) throw new QuoxUserError('--password-stdin got an empty first line. Pipe the password in, for example: printf %s "$PW" | quox server install --password-stdin', { exitCode: 2, code: 'empty_password' });
+  return first;
+}
+
+export async function defaultReadStdin() {
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(c);
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+async function defaultPrompt(message, type) {
+  const { default: inquirer } = await import('inquirer');
+  const a = await inquirer.prompt([{ type, name: 'v', message, ...(type === 'password' ? { mask: '*' } : {}) }]);
+  return a.v;
+}
+
+export async function defaultMakeInstall({ dir, env = process.env } = {}) {
+  const { realInstall } = await import('../quoxon/onboarding/index.js');
+  return realInstall({ env, installDir: dir });
+}
+
+/**
+ * -> { ok, ... }. Throws QuoxUserError (exit 2) for refusals made before anything changes.
+ * opts: { dir, dryRun, yes, email, passwordStdin }; deps: see defaults; emit(event).
+ */
+export async function runInstallFlow(opts = {}, deps = {}, emit = () => {}) {
+  const d = {
+    runChecks: runPreflight, makeInstall: defaultMakeInstall, confirm: confirmInteractive,
+    isTTY: () => Boolean(process.stdin.isTTY), readStdin: defaultReadStdin,
+    promptEmail: () => defaultPrompt('Owner email', 'input'), promptPassword: () => defaultPrompt('Owner password (hidden)', 'password'),
+    ...deps
+  };
+  const { dryRun = false, yes = false, passwordStdin = false } = opts;
+  const dir = resolve(opts.dir || defaultInstallDir());
+  const printLink = Boolean(opts.printLink);
+  const stage = (s, status, extra = {}) => emit({ type: 'stage', stage: s, status, ...extra });
+  const fail = (failedStage, error, next, extra = {}) => {
+    stage(failedStage, 'fail', { error, next });
+    const res = { ok: false, failedStage, error, next, ...extra };
+    emit({ type: 'result', ...res });
+    return res;
+  };
+
+  // ---- refusals first: nothing has been touched --------------------------------------------------------------
+  if (!dryRun) {
+    if (!yes && !d.isTTY()) throw new QuoxUserError('No terminal to answer y/N here. Read the plan with --dry-run, then re-run with --yes to install.', { exitCode: 2, code: 'no_terminal' });
+    if (!d.isTTY() && !passwordStdin) throw new QuoxUserError('No terminal for the owner password prompt. Pipe it in with --password-stdin (the password is never taken as an argument).', { exitCode: 2, code: 'no_terminal' });
+  }
+
+  // ---- preflight (read-only, also in a dry run) --------------------------------------------------------------
+  stage('preflight', 'running');
+  const rows = (await d.runChecks(preflightDeps(), () => {})).map(cliRow);
+  const dockerRows = rows.filter(r => r.id === 'docker' || r.id === 'compose');
+  const otherRows = rows.filter(r => r.id !== 'docker' && r.id !== 'compose');
+  const nextFor = (rs) => rs.filter(r => r.status === 'fail').map(r => `${r.fix || r.body}`).join(' ');
+  const bad = rows.filter(r => r.status === 'fail');
+  const otherBad = bad.filter(r => r.id !== 'docker' && r.id !== 'compose');
+  if (otherBad.length) return fail('preflight', bad.map(r => r.body).join('; '), `${nextFor(bad)} Then run: ${AGAIN}`, { checks: rows });
+  stage('preflight', 'ok', { detail: otherRows.map(r => r.body).join('; ') });
+  if (bad.length) return fail('docker', bad.map(r => r.body).join('; '), `${nextFor(bad)} Then run: ${AGAIN}`, { checks: rows });
+  stage('docker', 'ok', { detail: dockerRows.map(r => r.body).join('; ') });
+
+  if (dryRun) {
+    emit({ type: 'plan', dir, installerUrl: 'https://get.quox.ai', checks: rows.map(r => ({ id: r.id, status: r.status, body: r.body })), steps: PLAN_STEPS, changed: 'nothing' });
+    const res = { ok: true, dryRun: true };
+    emit({ type: 'result', ...res });
+    return res;
+  }
+
+  // ---- confirm, then collect the owner credentials BEFORE the long install -----------------------------------
+  if (!yes && !(await d.confirm(`Install Quox into ${dir} now?`, { flag: '--yes', purpose: 'install' }))) {
+    const res = { ok: false, declined: true, error: 'not confirmed', next: `Nothing was changed. Run ${AGAIN} --dry-run to see the plan.` };
+    emit({ type: 'result', ...res });
+    return res;
+  }
+  let email = opts.email ? String(opts.email).trim() : null;
+  if (!email && d.isTTY()) email = String(await d.promptEmail()).trim();
+  if (!emailOk(email)) throw new QuoxUserError('A valid owner email is needed: pass --email <address>.', { exitCode: 2, code: 'bad_email' });
+  const password = passwordStdin ? await readPasswordStdin(d.readStdin) : await d.promptPassword();
+  const weak = passwordProblem(password);
+  if (weak) throw new QuoxUserError(`The owner password is not accepted: ${weak}`, { exitCode: 2, code: 'weak_password' });
+
+  // ---- the install itself (the same runner Getting started uses) ----------------------------------------------
+  const { runner, finisher } = await d.makeInstall({ dir });
+  const open = {};
+  const res = await runner.run({
+    onEvent: (e) => {
+      if (e.type === 'log') { emit({ type: 'log', line: e.line }); return; }
+      if (e.type !== 'stage') return;
+      const s = FOLD[e.id]; if (!s) return;
+      if (e.status === 'running') { if (!open[s]) { open[s] = true; stage(s, 'running'); } return; }
+      if (e.status === 'ok' && (e.id === 'build' || e.id === 'start' || e.id === 'health')) { stage(s, 'ok', e.ms != null ? { ms: e.ms } : {}); open[s] = false; }
+    }
+  });
+  if (!res.ok) {
+    const failed = FOLD[res.failedStage] || res.failedStage || 'download';
+    if (res.interrupted) return fail(failed, 'interrupted', `Run ${AGAIN} again; finished steps are kept.`);
+    const next = [res.cause?.next || res.cause?.fix, res.hint || 'Finished steps are kept.', `Then run: ${AGAIN}`].filter(Boolean).join(' ');
+    return fail(failed, res.error || 'the installer failed', next, { logPath: res.logPath, ...(res.dashboardUrl ? { dashboardUrl: res.dashboardUrl } : {}) });
+  }
+
+  // ---- owner account, sign-in, vault, link ---------------------------------------------------------------------
+  stage('owner', 'running');
+  const made = await finisher.createOwner({ email, password });
+  if (!made.ok) {
+    return fail('owner', made.error || 'the owner account was not created',
+      made.existed ? 'An owner already exists on this server. Sign in with: quox login' : `The server is running. Create the owner with: quox setup`, { dashboardUrl: res.dashboardUrl, logPath: res.logPath });
+  }
+  const signed = await finisher.signIn({ email, password });
+  if (!signed.ok) return fail('owner', `owner created, but sign-in failed: ${signed.error}`, 'Sign in with: quox login', { dashboardUrl: res.dashboardUrl, logPath: res.logPath });
+  stage('owner', 'ok', { detail: email });
+  stage('vault', 'skip', { detail: 'no AI key was given here', next: 'Add one with: quox provider connect' });
+  const link = await finisher.loginLink(res.dashboardUrl);
+  if (!link.ok) return fail('link', link.error || 'could not create the sign-in link', `Open ${res.dashboardUrl || 'https://localhost:3000'} and sign in with ${email}.`, { dashboardUrl: res.dashboardUrl, logPath: res.logPath });
+  stage('link', 'ok', { ttlSeconds: link.ttlSeconds, linkIssued: true, ...(printLink ? {} : { linkHow: LINK_HOW }) });
+  const done = { ok: true, dashboardUrl: res.dashboardUrl, link: link.url, installDir: runner.installDir, logPath: res.logPath };
+  const { link: liveLink, ...safe } = done;
+  emit({ type: 'result', ...(printLink ? done : { ...safe, linkIssued: true, linkHow: LINK_HOW }) });
+  return done;
+}

package/lib/server/status.js

@@ -4,6 +4,7 @@
  */
 import { readFileSync, writeFileSync, mkdirSync, appendFileSync, renameSync } from 'node:fs';
 import { join, dirname } from 'node:path';
+import { X509Certificate } from 'node:crypto';
 import { readInstalled } from './install.js';
 
 const STATE_FILE = 'lifecycle-state.json';
@@ -67,6 +68,18 @@ async function getJson(url, fetchImpl, timeout = 3000) {
   } catch (e) { return { ok: false, error: e?.cause?.code || e?.message || 'no answer' }; }
 }
 
+/**
+ * H3: the SHA256 fingerprint of the certificate the edge serves (ssl/quox.crt in the checkout), in the same format
+ * as the `quox connect` card, so the two can be compared by eye or by script. Never throws.
+ */
+export function certFingerprint(repoDir, { read = readFileSync } = {}) {
+  const file = join(repoDir || '', 'ssl', 'quox.crt');
+  try {
+    const c = new X509Certificate(read(file));
+    return { ok: true, file, fingerprint256: c.fingerprint256, validTo: c.validTo };
+  } catch (e) { return { ok: false, file, error: e?.code === 'ENOENT' ? 'no certificate file' : 'could not read the certificate' }; }
+}
+
 /** The running build, from the collector's public /version. */
 export async function runningVersion(collectorUrl, fetchImpl = globalThis.fetch) {
   const r = await getJson(`${collectorUrl.replace(/\/+$/, '')}/version`, fetchImpl);
@@ -99,7 +112,7 @@ export async function gatherStatus({ install, sys, fetchImpl = globalThis.fetch,
   const hist = backups ? readHistory(backups) : [];
   const lastUpdate = [...hist].reverse().find((e) => e.op === 'update' || e.op === 'rollback') || null;
   const state = backups ? readState(backups) : null;
-  return { install, installed, running, services: svc, disk, http, lastUpdate, inFlight: state && state.status === 'running' ? state : null };
+  return { install, installed, running, services: svc, disk, http, cert: certFingerprint(install.repoDir), lastUpdate, inFlight: state && state.status === 'running' ? state : null };
 }
 
 const svcIcon = (s) => (s.state === 'running' ? (s.health && s.health !== 'healthy' ? '⚠' : '✔') : '✖');
@@ -113,6 +126,7 @@ export function statusRows(st) {
   out.push(row('Version', `${i.release || '? no VERSION file'}${i.tag ? ` (${i.tag})` : ''} · checkout ${i.commit || '?'}${i.dirty ? ' · local changes' : ''}`));
   const rv = st.running;
   out.push(row('Running', rv.ok ? `${rv.commit || '?'}${rv.stamped === false ? ' (unstamped build)' : ''}${rv.commit && i.commit && !String(rv.commit).startsWith(i.commit) && !String(i.commit).startsWith(rv.commit) ? ' · differs from the checkout' : ''}` : `? ${rv.error}`));
+  if (st.cert) out.push(row('Certificate', st.cert.ok ? `SHA256 ${st.cert.fingerprint256} · valid to ${st.cert.validTo} (compare with the card \`quox connect\` shows)` : `? ${st.cert.error} (${st.cert.file})`));
   for (const h of st.http) out.push(row(`${h.ok ? '✔' : '✖'} ${h.name}`, `${h.url} · ${h.detail} · ${h.ms}ms`));
   if (!st.services.ok) out.push(row('✖ Services', `? ${st.services.error}`));
   else {

package/lib/toolOutputShape.js

@@ -270,6 +270,59 @@ function smallTopFields(body, found) {
   return Object.keys(out).length ? out : null;
 }
 
+
+/**
+ * OVERSIZED-IDS: the oversized summary used to carry only a sample of whole rows, which a big row (logs, blobs)
+ * pushes out entirely, so the model lost every id/name and answered from another tool (keeper_backup_list,
+ * bob_log_tail). id_index keeps the first ID_INDEX_ROWS rows of every list (top level, or under a top key) reduced
+ * to identifier/status fields, inside ID_INDEX_BUDGET chars in total, and says how many rows were left out.
+ */
+export const ID_INDEX_ROWS = 20;
+export const ID_INDEX_BUDGET = 6000;
+const ID_FIELD_RE = /^(id|name|title|status|state|created_at|started_at|key|host|host_id|hostname|slug|label|kind|type)$|_id$/i;
+const ID_VALUE_MAX = 80;
+
+function idRow(row) {
+  if (!isObj(row)) return (row === null || typeof row === 'object') ? null : (typeof row === 'string' ? row.slice(0, ID_VALUE_MAX) : row);
+  const r = {};
+  for (const [k, v] of Object.entries(row)) {
+    if (BLOCKED.has(k) || !ID_FIELD_RE.test(k)) continue;
+    if (v === null || typeof v === 'object') continue;
+    r[k] = typeof v === 'string' && v.length > ID_VALUE_MAX ? `${v.slice(0, ID_VALUE_MAX)}...` : v;
+  }
+  return r;
+}
+
+function idIndex(body, found) {
+  const lists = [];
+  if (Array.isArray(body)) lists.push(['(root)', body]);
+  else if (isObj(body)) {
+    for (const [k, v] of Object.entries(body)) if (!BLOCKED.has(k) && Array.isArray(v) && v.length) lists.push([k, v]);
+    if (!lists.length && found && found.path) lists.push([found.path, found.list]);
+  }
+  if (!lists.length) return null;
+  // the main list first, then the rest by size
+  const mainPath = found && found.path;
+  lists.sort((a, b) => ((b[0] === mainPath) - (a[0] === mainPath)) || b[1].length - a[1].length);
+  const out = {};
+  let used = 0;
+  for (const [path, list] of lists.slice(0, 8)) {
+    const rows = [];
+    for (const it of list.slice(0, ID_INDEX_ROWS)) {
+      const r = idRow(it);
+      if (r === null || (isObj(r) && !Object.keys(r).length)) continue;
+      const n = jsonLen(r) + 2;
+      if (used + n + 120 > ID_INDEX_BUDGET) break;
+      rows.push(r);
+      used += n;
+    }
+    if (!rows.length) continue;
+    used += 120;
+    out[path] = { total: list.length, shown: rows.length, omitted: list.length - rows.length, rows };
+  }
+  return Object.keys(out).length ? out : null;
+}
+
 export function capInline(value, { maxChars = INLINE_MAX_CHARS } = {}) {
   const size = jsonLen(value);
   if (size <= maxChars) return { value, capped: false };
@@ -299,6 +352,8 @@ export function capInline(value, { maxChars = INLINE_MAX_CHARS } = {}) {
     : `--select '${lp ? `${lp}[field=value].name` : '[0]'}', --select 'count(${lp || ''})' or --select '${lp ? `${lp}[*].field` : '[*].field'}'`;
   const next = `Result is ${fullKb} KB, too large to show whole, so this is the --summary view. For the exact part you need, run the same quox tool exec again with ${example} (or --summary --limit N for a bigger sample)${via ? `; the list is inside ${via}` : ''}. Never read or post-process a saved output with a shell.`;
   const head = { oversized: true, full_size_kb: fullKb, next, top_keys: isObj(body) ? Object.keys(body).slice(0, 40) : undefined };
+  const idx = idIndex(body, found);
+  if (idx) head.id_index = idx;
   const extra = smallTopFields(body, found);
   for (const limit of [DEFAULT_SAMPLE, 5, 3, 1, 0]) {
     const s = summarize(body, { limit });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quoxcli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Quox: the conversational front door to your self-hosted AI agent control plane",
   "type": "module",
   "bin": {
@@ -61,6 +61,7 @@
     "!lib/core/websiteSession.js",
     "!lib/quoxon/whatsnew.md",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "repository": {
@@ -68,7 +69,7 @@
     "url": "git+https://github.com/quoxai/quoxcore.git",
     "directory": "cli"
   },
-  "homepage": "https://cli.quox.ai",
+  "homepage": "https://quox.ai/cli",
   "bugs": {
     "url": "https://github.com/quoxai/quoxcore/issues"
   },

package/vendor/dragonlab/SOURCE

@@ -1,4 +1,4 @@
 repo: quoxai/dragonlab
-commit: 5b478a813554eb80793b848d14da1468ea3bdcef
-branch: HEAD
-files: 52
+commit: a4dda5ef12c417689768664022b8de1245794c56
+branch: integration/companions-vulcan-quoxperticus
+files: 66