quoxcli 0.4.0 → 0.6.0

package/lib/commands/provider.js

@@ -58,17 +58,19 @@ export function registerProviderCommands(program, ctx) {
   // ── provider list ──────────────────────────────────────────────────────────
   provider
     .command('list')
-    .description('Show which AI providers this org can use, and how each is connected')
-    .action(async () => {
+    .description('Show which AI providers this org can use, and how each is connected (--all adds the other integrations in the vault)')
+    .option('--all', 'also list the other integrations in the vault (Slack, GitHub, bastion...), not just AI providers')
+    .action(async (opts = {}) => {
       auth.requireAuth();
       const a = api();
       const [vault, caps] = await Promise.all([a.connections(), a.capabilities ? a.capabilities() : null]);
       if (program.opts().output === 'json') {
-        const rows = vault?.ok ? vault.rows.map((r) => Object.fromEntries(SAFE_ROW.filter((k) => r[k] !== undefined).map((k) => [k, r[k]]))) : null;
+        const known = new Set(Object.values(PROVIDERS).map((p) => p.type));
+        const rows = vault?.ok ? vault.rows.filter((r) => opts.all || known.has(r.integration_type)).map((r) => Object.fromEntries(SAFE_ROW.filter((k) => r[k] !== undefined).map((k) => [k, r[k]]))) : null;
         formatDetail({ connections: rows, ...(vault?.ok ? {} : { error: vault?.error || 'vault not readable' }), capabilities: caps?.ok ? caps.capabilities : null }, { format: 'json' });
         return;
       }
-      say(connectionLines(vault, caps));
+      say(connectionLines(vault, caps, { includeOthers: Boolean(opts.all) }));
     });
 
   // ── provider connect ───────────────────────────────────────────────────────
@@ -202,16 +204,35 @@ export function registerProviderCommands(program, ctx) {
       const rows = vault.rows.filter((r) => types.has(r.integration_type) && (r.is_default === 1 || r.is_default === true));
       if (!rows.length) throw new Error(p ? `No ${p.id} connection is stored for this org. Connect one: quox provider connect ${p.id}` : 'No provider connection is stored for this org. Connect one: quox provider connect <kind>');
       const orgId = resolveOrgId(auth, program);
+      const asJson = program.opts().output === 'json';
+      const results = [];
       let failed = 0;
       for (const row of rows) {
-        const name = (Object.values(PROVIDERS).find((x) => x.type === row.integration_type) || {}).name || row.integration_type;
+        const meta = Object.values(PROVIDERS).find((x) => x.type === row.integration_type) || {};
+        const name = meta.name || row.integration_type;
         const ep = resolveEndpoint('vault.test', { orgId, id: row.id });
-        let res;
+        let res; let reason = null;
         try { res = await client.post(ep.path, { service: ep.service, retries: 0 }); }
-        catch (e) { res = { success: false, message: e?.message || 'failed' }; }
-        if (res?.success === false) { failed++; printInfo(`✖ ${name}  ${row.label || row.id}  failed: ${res?.message || 'no reason given'}`); }
+        catch (e) {
+          res = { success: false, message: e?.message || 'failed' };
+          reason = e?.body?.reason || (String(e?.message || '').match(/\(reason: ([^)]+)\)/) || [])[1] || null;
+        }
+        const ok = res?.success !== false;
+        if (!ok) failed++;
+        results.push({
+          id: row.id, kind: meta.id || row.integration_type, label: row.label || row.id, ok,
+          ...(ok ? (res?.message ? { message: res.message } : {}) : { error: res?.message || 'no reason given', reason }),
+        });
+        if (asJson) continue;
+        if (!ok) printInfo(`✖ ${name}  ${row.label || row.id}  failed: ${res?.message || 'no reason given'}`);
         else printInfo(`✔ ${name}  ${row.label || row.id}  ok${res?.message ? `: ${res.message}` : ''}`);
       }
+      if (asJson) formatDetail({
+        results,
+        summary: { total: results.length, ok: results.length - failed, failed },
+        // a top-level error string is what the collector's quox_cli wrapper quotes to the model on a non-zero exit
+        ...(failed ? { error: results.filter((r) => !r.ok).map((r) => `${r.kind}: ${r.error}`).join('; ') } : {}),
+      }, { format: 'json' });
       if (failed) process.exitCode = 1;
     });
 }

package/lib/commands/qlarity.js

@@ -49,6 +49,25 @@ function annotate(err) {
   throw err;
 }
 
+/**
+ * Inspectors whose server-side run() calls assertSelector (qlarity/src/inspectors.js).
+ * The registry lives in another repo and `inspectors list` does not expose the
+ * flag, so this mirrors it; storage, dom_summary, layout_health and
+ * responsive_sweep default or skip the selector and are deliberately absent.
+ */
+export const SELECTOR_INSPECTORS = ['computed_style', 'pseudo_style', 'text_content', 'attribute', 'count', 'bounding_box', 'expect'];
+
+/** Keep scheme+host+port only (lowercased); anything unparseable goes through for the server to explain. */
+export function normaliseOrigin(input) {
+  try {
+    const u = new URL(String(input).trim());
+    if (!/^https?:$/.test(u.protocol)) return input;
+    return u.origin;
+  } catch {
+    return input;
+  }
+}
+
 // quox#907: a browser login is slower than a read; well above the client's 30s default.
 const LOGIN_TIMEOUT_MS = 120000;
 
@@ -308,14 +327,21 @@ export function registerQlarityCommands(program, ctx) {
   al.command('add <origin>')
     .description('Declare an origin this org may inspect, e.g. https://staging.example.com')
     .option('--note <text>', 'why it is allowed, shown alongside it later')
-    .action(async (origin, opts) => {
+    .action(async (rawOrigin, opts) => {
+      const origin = normaliseOrigin(rawOrigin);
       try {
+        if (origin !== rawOrigin) process.stdout.write(`allowlisting ${origin} (scheme+host+port of ${rawOrigin})\n`);
         const d = await call(client, 'qlarity.orgAllowlist.add', {}, { origin, note: opts.note });
         process.stdout.write(`\u{1F50D} QLARITY: added ${d.entry.origin}\n`);
         process.stdout.write(`  ${d.origins.length} origin(s) now declared for this org\n`);
       } catch (err) {
         // A refusal here is usually a wildcard or a typo, and the server sends
         // the reason. Surface it instead of a bare 400.
+        if (err?.status === 403) {
+          process.stderr.write(`Not added: adding an origin is an org-admin action by design (an agent cannot self-authorize egress).\nRetry as an org admin: quox -p <admin-profile> qlarity origins add ${origin}\n`);
+          process.exitCode = 4;
+          return;
+        }
         if (err?.status === 400 && err?.message) {
           process.stderr.write(`Not added: ${err.message}\n`);
           process.exitCode = 1;
@@ -395,6 +421,11 @@ export function registerQlarityCommands(program, ctx) {
     .option('--session <id>', 'reuse an existing session (e.g. one left open by `quox qlarity login`) instead of opening a fresh one')
     .option('--json', 'raw JSON output')
     .action(async (url, options) => {
+      if (SELECTOR_INSPECTORS.includes(options.inspector) && !options.selector) {
+        process.stderr.write(`${options.inspector} needs --selector. Try: quox qlarity read ${url} --inspector ${options.inspector} --selector 'body'\n`);
+        process.exitCode = 2;
+        return;
+      }
       let sessionId = null;
       let reused = false;
       try {

package/lib/commands/run.js

@@ -39,7 +39,8 @@ export function registerRunCommands(program, ctx) {
         let items = data.data || data.items || (Array.isArray(data) ? data : []);
         // an older engine that ignores the filter must still never show another workflow's runs
         if (options.workflow) items = items.filter((it) => (it.workflowId ?? it.workflow_id) === options.workflow);
-        rows = items.map((item) => ({ ...item, source: 'engine' }));
+        // quoxflow rows are camelCase (workflowName, startedAt, completedAt); the table reads snake_case columns.
+        rows = items.map((item) => ({ ...item, workflow_name: item.workflow_name ?? item.workflowName, started_at: item.started_at ?? item.startedAt, finished_at: item.finished_at ?? item.completedAt ?? item.finishedAt, source: 'engine' }));
         source = 'engine';
       } catch (err) {
         printWarning(`Engine (quoxflow) execution list failed, falling back to the auth-service store: ${err.message}`);

package/lib/commands/server.js

@@ -24,6 +24,7 @@ import { planUninstall, runUninstall } from '../server/uninstall.js';
 import { serverChecks } from '../server/doctor.js';
 import { writeDiagBundle } from '../server/diag.js';
 import { latestSnapshot, listSnapshots } from '../server/snapshot.js';
+import { runInstallFlow } from '../server/installFlow.js';
 import { loadRegistry, saveServer, buildRows, planGo, hereIdentity, registryPath } from '../server/devServers.js';
 
 const icon = (s) => (s === 'pass' ? chalk.green('✔') : s === 'warn' ? chalk.yellow('⚠') : s === 'skip' ? chalk.dim('·') : chalk.red('✖'));
@@ -70,6 +71,42 @@ export function registerServerCommands(program, ctx = {}) {
   const server = program.command('server').description('Your self-hosted Quox install: status, update, rollback, uninstall, doctor, diag');
   const withDir = (c) => c.option('--dir <path>', 'the install directory (default: the one Getting started recorded)');
 
+  server.command('install')
+    .description('Install Quox on this machine: checks, download, start, owner account, one-time dashboard link (the same installer Getting started runs)')
+    .option('--dir <path>', 'where to install (default: ~/quox-install)')
+    .option('--dry-run', 'check this machine, print the plan, change nothing')
+    .option('-y, --yes', 'skip the confirmation (required without a terminal)')
+    .option('--json', 'one JSON object per line: stage events, then a result')
+    .option('--email <address>', 'owner account email (asked when there is a terminal)')
+    .option('--password-stdin', 'read the owner password from stdin, one line (never an argument)')
+    .option('--print-login-link', 'print the live one-time sign-in link (default: only on an interactive terminal, never in --json)')
+    .action(async (o) => {
+      const asJson = Boolean(o.json) || json();
+      const human = (e) => {
+        if (e.type === 'log') { console.log(chalk.dim(`    ${e.line}`)); return; }
+        if (e.type === 'stage') {
+          if (e.status === 'running') console.log(` ${chalk.cyan('◐')} ${e.stage}`);
+          else if (e.status === 'ok') console.log(` ${chalk.green('✔')} ${e.stage}${e.detail ? chalk.dim(`  ${e.detail}`) : ''}`);
+          else if (e.status === 'skip') console.log(` ${chalk.dim('·')} ${e.stage} skipped${e.detail ? `: ${e.detail}` : ''}${e.next ? `. ${e.next}` : ''}`);
+          else if (e.status === 'fail') { console.log(chalk.red(` ✖ ${e.stage} failed: ${e.error}`)); console.log(`   Next: ${e.next}`); }
+        } else if (e.type === 'plan') {
+          console.log(chalk.bold(`\n Plan: install Quox into ${e.dir || '~/quox-install'}`));
+          for (const c of e.checks) console.log(`   ${c.status === 'fail' ? chalk.red('✖') : c.status === 'warn' ? chalk.yellow('⚠') : chalk.green('✔')} ${c.id.padEnd(8)} ${c.body}`);
+          console.log(' It will:'); e.steps.forEach((s, i) => console.log(`   ${i + 1}. ${s}`));
+          console.log(chalk.dim('\n Dry run: nothing was changed. Run quox server install to install.\n'));
+        } else if (e.type === 'result' && e.ok && !e.dryRun) {
+          console.log(chalk.green('\n ✔ Your Quox is running.'));
+          if (e.link) console.log(` Dashboard sign-in link (single use, 10 minutes): ${e.link}`);
+          else console.log(` A one-time sign-in link was issued but not printed (stdout is not a terminal). Get one with: ${e.linkHow}`);
+          console.log(chalk.dim(' Your browser will warn about the certificate once: it is the self-signed one this install made.\n'));
+        }
+      };
+      const emit = (e) => (asJson ? console.log(JSON.stringify(e)) : human(e));
+      const r = await runInstallFlow({ dir: o.dir, dryRun: dry(o), yes: yes(o), email: o.email, passwordStdin: Boolean(o.passwordStdin), printLink: Boolean(o.printLoginLink) || (!asJson && Boolean(process.stdout.isTTY)) }, deps.installFlowDeps || {}, emit);
+      if (!r.ok && !r.dryRun) process.exitCode = r.declined ? 1 : 2;
+      if (!r.ok && r.dryRun === undefined && r.failedStage && dry(o)) process.exitCode = 2;
+    });
+
   withDir(server.command('status').description('Version, health per service, disk, ports and the last update (read-only)'))
     .action(async (o) => {
       const i = await install(o);

package/lib/commands/setup.js

@@ -8,6 +8,9 @@ import { resolveEndpoint } from '../api/endpoints.js';
 import { QuoxApiError, QuoxValidationError } from '../core/errors.js';
 import { confirmDestructive } from '../core/confirm.js';
 import { passwordProblem } from '../quoxon/onboarding/finish.js';
+import {
+  renderLinkCard, renderLinkedCard, linkedDetails, startWaiting, colorFor, animateFor,
+} from './licenceLinkView.js';
 
 // The auth service's rule (services/auth/utils/passwordValidation.js), said up front.
 export const PASSWORD_POLICY = 'Passwords need at least 12 characters, with an uppercase letter, a lowercase letter, a number and a special character (for example - or !).';
@@ -348,93 +351,142 @@ export function registerSetupCommands(program, ctx) {
         interval,
       });
 
+      // QUOXON (owner 2026-11-05): a framed card with the code, the full
+      // link and a countdown, then a live waiting line on a TTY. Not a TTY
+      // (CI, logs): plain lines, no ANSI, nothing animated.
+      const term = ctx.term || process.stdout;
+      const format = program.opts().output;
+      const pretty = !json && (format === undefined || format === 'table');
+      const color = pretty && colorFor(term);
+      const verificationUrl = started.verification_url || 'https://quox.ai/link';
+      let waiting = null;
       if (!json) {
-        printInfo(`Open ${started.verification_url || 'https://quox.ai/link'} and enter this code:`);
-        console.log('');
-        console.log(chalk.bold.cyan(`    ${started.user_code}`));
-        console.log('');
-        printInfo(`The code is good for ${Math.round(expiresIn / 60)} minutes. Waiting for approval...`);
+        if (pretty) {
+          console.log(renderLinkCard({
+            userCode: started.user_code, url: verificationUrl, remainingMs: expiresIn * 1000, color, cols: term.columns || 80,
+          }));
+          if (term.isTTY) {
+            waiting = startWaiting({ term, deadline, totalMs: expiresIn * 1000, color, animate: animateFor(term) });
+          }
+        } else {
+          printInfo(`Open ${verificationUrl} and enter this code:`);
+          console.log('');
+          console.log(chalk.bold.cyan(`    ${started.user_code}`));
+          console.log('');
+          printInfo(`The code is good for ${Math.round(expiresIn / 60)} minutes. Waiting for approval...`);
+        }
       }
-
-      const pollEp = resolveEndpoint('setup.licensing.device.poll');
-      let lastState = 'started';
-
-      while (Date.now() < deadline) {
-        await sleepFn(interval * 1000);
-
-        let result;
-        try {
-          result = await client.post(pollEp.path, {
-            service: pollEp.service,
-            body: { device_code: deviceCode, interval },
-          });
-        } catch (err) {
-          // 503 means quox.ai blipped, NOT that the activation died: the code
-          // is still live upstream and the customer may still be approving it.
-          // Anything else (409 seat_limit_reached, 403, 400) is terminal.
-          if (err instanceof QuoxApiError && err.status === 503) {
-            if (lastState !== 'unreachable') {
-              emit({ state: 'unreachable', message: err.message });
-              if (!json) printInfo('The licence server is unreachable right now. Still waiting...');
-              lastState = 'unreachable';
+      try {
+        await pollUntilDone();
+      } finally {
+        if (waiting) waiting.stop();
+      }
+      return;
+
+      async function pollUntilDone() {
+        const pollEp = resolveEndpoint('setup.licensing.device.poll');
+        let lastState = 'started';
+
+        while (Date.now() < deadline) {
+          await sleepFn(interval * 1000);
+
+          let result;
+          try {
+            result = await client.post(pollEp.path, {
+              service: pollEp.service,
+              body: { device_code: deviceCode, interval },
+            });
+          } catch (err) {
+            // 503 means quox.ai blipped, NOT that the activation died: the code
+            // is still live upstream and the customer may still be approving it.
+            // Anything else (409 seat_limit_reached, 403, 400) is terminal.
+            if (err instanceof QuoxApiError && err.status === 503) {
+              if (lastState !== 'unreachable') {
+                emit({ state: 'unreachable', message: err.message });
+                if (waiting) waiting.note('licence server unreachable, still waiting');
+                else if (!json) printInfo('The licence server is unreachable right now. Still waiting...');
+                lastState = 'unreachable';
+              }
+              continue;
             }
-            continue;
+            throw enrichLicenseError(err);
           }
-          throw enrichLicenseError(err);
-        }
 
-        const state = result.state || 'pending';
+          const state = result.state || 'pending';
 
-        if (state === 'slow_down') {
-          interval = Number(result.interval) > 0 ? Number(result.interval) : interval + 5;
-        } else if (Number(result.interval) > 0) {
-          interval = Number(result.interval);
-        }
+          if (state === 'slow_down') {
+            interval = Number(result.interval) > 0 ? Number(result.interval) : interval + 5;
+          } else if (Number(result.interval) > 0) {
+            interval = Number(result.interval);
+          }
 
-        if (state !== lastState) {
-          emit({ state, interval, ...(result.error ? { error: result.error } : {}) });
-          lastState = state;
-        }
+          if (state !== lastState) {
+            emit({ state, interval, ...(result.error ? { error: result.error } : {}) });
+            lastState = state;
+          }
 
-        if (state === 'approved') {
-          const lease = result.lease || {};
-          emit({ state: 'approved', lease });
-          if (!json) {
-            formatDetail({
-              license_id: lease.license_id || null,
-              entitlements: lease.entitlements || [],
-              lease_expires_at: lease.expires_at || null,
-            }, { format: program.opts().output, title: 'Licence activated' });
-            printSuccess('This instance is activated. No key was ever pasted into it.');
+          if (state === 'approved') {
+            const lease = result.lease || {};
+            // QUOXON (owner 2026-11-05): read the licence back through the
+            // route `quox licence status` uses, so the run NAMES what was
+            // linked (plan, plugins, seats). A failed read never hides the
+            // activation: the lease is the fallback, and the failure is said.
+            let status = null;
+            let readBackError = null;
+            if (json || pretty) {
+              try {
+                const readEp = resolveEndpoint('setup.licensing.entitlements.list');
+                status = await client.get(readEp.path, { service: readEp.service });
+              } catch (err) {
+                readBackError = err && err.message ? err.message : String(err);
+              }
+            }
+            const details = linkedDetails(lease, status, result);
+            // --json: the pre-existing { state, lease } plus an ADDITIVE `licence`.
+            emit({ state: 'approved', lease, licence: details });
+            if (waiting) { waiting.stop(); waiting = null; }
+            if (pretty) {
+              console.log(renderLinkedCard(details, {
+                color, cols: term.columns || 80, leaseExpiresAt: lease.expires_at || null,
+                profile: program.opts().profile || null, readBackError,
+              }));
+            } else if (!json) {
+              formatDetail({
+                license_id: lease.license_id || null,
+                entitlements: lease.entitlements || [],
+                lease_expires_at: lease.expires_at || null,
+              }, { format: program.opts().output, title: 'Licence activated' });
+              printSuccess('This instance is activated. No key was ever pasted into it.');
+            }
+            return;
           }
-          return;
-        }
 
-        if (state === 'denied') {
-          throw new QuoxApiError(403, 'access_denied',
-            'The activation was denied on quox.ai. Nothing was activated on this instance.');
-        }
-        if (state === 'expired') {
-          throw new QuoxApiError(410, 'expired_token',
-            'The code expired before it was approved. Run `quox setup license link` again for a fresh one.');
-        }
-        if (state === 'consumed') {
-          throw new QuoxApiError(409, 'consumed',
-            'That code was already used. Run `quox setup license link` again for a fresh one.');
-        }
-        if (state === 'activation_failed') {
-          throw new QuoxApiError(502, result.error || 'activation_failed',
-            `The approval landed but the licence could not be stored on this instance: ${result.message || result.error || 'unknown error'}. `
-            + 'Run `quox setup license link` again.');
-        }
-        if (state === 'error') {
-          throw new QuoxApiError(502, result.error || 'device_poll_failed',
-            result.message || 'Device activation failed.');
+          if (state === 'denied') {
+            throw new QuoxApiError(403, 'access_denied',
+              'The activation was denied on quox.ai. Nothing was activated on this instance.');
+          }
+          if (state === 'expired') {
+            throw new QuoxApiError(410, 'expired_token',
+              'The code expired before it was approved. Run `quox setup license link` again for a fresh one.');
+          }
+          if (state === 'consumed') {
+            throw new QuoxApiError(409, 'consumed',
+              'That code was already used. Run `quox setup license link` again for a fresh one.');
+          }
+          if (state === 'activation_failed') {
+            throw new QuoxApiError(502, result.error || 'activation_failed',
+              `The approval landed but the licence could not be stored on this instance: ${result.message || result.error || 'unknown error'}. `
+              + 'Run `quox setup license link` again.');
+          }
+          if (state === 'error') {
+            throw new QuoxApiError(502, result.error || 'device_poll_failed',
+              result.message || 'Device activation failed.');
+          }
         }
-      }
 
-      throw new QuoxApiError(410, 'expired_token',
-        'The code expired before it was approved. Run `quox setup license link` again for a fresh one.');
+        throw new QuoxApiError(410, 'expired_token',
+          'The code expired before it was approved. Run `quox setup license link` again for a fresh one.');
+      }
     });
 
   license

package/lib/commands/skills.js

@@ -84,6 +84,8 @@ export function registerSkillsCommands(program, ctx) {
           for (const it of Array.isArray(items) ? items : []) if (it && it.skill_id) active.set(it.skill_id, it.status || status);
         }
         rows = rows.map((r) => ({ ...r, review_status: active.get(r.id) || null, runnable: !active.has(r.id) }));
+        // Runnable first (stable): a skill that can run leads, so the first row is never one skill_view must refuse.
+        rows = [...rows.filter((r) => r.runnable), ...rows.filter((r) => !r.runnable)];
       } catch (err) {
         printWarning(`Skill review queue could not be read, so which skills can run is unknown: ${err.message}`);
       }
@@ -641,7 +643,8 @@ export function registerSkillsCommands(program, ctx) {
       try {
         const ep = resolveEndpoint('skills.sealed.create');
         const data = await client.post(ep.path, { service: ep.service, body });
-        printSuccess(`Sealed. sealedId ${data.sealedId}`);
+        // the collector answers { sealed: {...}, evidence }; an older/flat body carries sealedId at the top
+        printSuccess(`Sealed. sealedId ${(data && data.sealed && data.sealed.sealedId) || (data && data.sealedId)}`);
         formatDetail(data, { format: program.opts().output, title: 'Sealed skill' });
         printInfo(SEALED_SECTION_G_SENTENCE);
       } catch (err) {

package/lib/commands/slot.js

@@ -19,6 +19,7 @@ import { dirname, join } from 'node:path';
 
 import { formatDetail, formatOutput, printSuccess, printWarning, printInfo } from '../core/output.js';
 import { events, printEvent } from '../core/quoxglyph.js';
+import { announce, announceOnFail } from '../core/announce.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { QuoxApiError, QuoxNetworkError } from '../core/errors.js';
 import { resolveOrgId } from './helpers.js';
@@ -400,6 +401,23 @@ export function registerSlotCommands(program, ctx) {
     }
   }
 
+  // SLOT-FROM: the session name this process holds a slot under (held-slots.json lists it, or QUOX_SLOT
+  // names a held slot), sent as holder_session so the server's hold record stamps from_slot even when
+  // senderSlot() could not bind a live process. The server re-checks identity + session; never trusted.
+  function heldSessionFor(from) {
+    try {
+      const all = readHeldSlots();
+      const want = from ? String(from).toLowerCase() : null;
+      const bySlot = process.env.QUOX_SLOT ? all[String(process.env.QUOX_SLOT).trim()] : null;
+      if (bySlot && !bySlot.member && bySlot.session && (!want || String(bySlot.session).toLowerCase() === want)) return bySlot.session;
+      if (!want) return null;
+      const hit = Object.values(all).find((e) => e && !e.member && String(e.session || '').toLowerCase() === want);
+      return hit ? hit.session : null;
+    } catch {
+      return null;
+    }
+  }
+
   // P10: the collector recognises splinter members only via the ATTACH token.
   // When this Claude session is attached to an agent whose recorded slot is
   // `name`, send that token (same noAuth + Authorization pattern as
@@ -866,7 +884,7 @@ export function registerSlotCommands(program, ctx) {
     .option('--session <s>', 'session name to speak as (default: $QUOX_STREAM)')
     .option('--room', 'post as a joined room member (no hold needed); signed "session (person)" by the server')
     .option('--run <command>', 'ask the human to run ONE command in their own terminal (the text is why); the quox TUI shows it in full and runs it only on their y. Never run server-side')
-    .action(async (name, textParts, options) => {
+    .action(announceOnFail('quoxslots', (name) => `say into ${name}`, async (name, textParts, options) => {
       auth.requireAuth();
       // SLOT-RUN: same rule as the collector (one line, max 2000, no control/bidi characters), checked before sending.
       if (options.run !== undefined) {
@@ -900,6 +918,8 @@ export function registerSlotCommands(program, ctx) {
       // A room post already has its address (the room), so it carries none.
       const fromSlot = options.room ? null : senderSlot(from);
       if (fromSlot) body.from_slot = fromSlot;
+      const heldAs = options.room ? null : heldSessionFor(from);
+      if (heldAs) body.holder_session = heldAs;
       // A freshly created slot gets its Matrix room a few seconds AFTER
       // checkout returns (provisioning is async), so a say straight after
       // checkout used to fail with 409 "no Matrix room yet" (slots audit
@@ -952,6 +972,7 @@ export function registerSlotCommands(program, ctx) {
           throw err;
         }
       }
+      announce('quoxslots', `said into ${name}`, { result: data?.presence?.state === 'listening' ? 'delivered, listening' : 'posted' });
       printSuccess(`Said into ${name}.`);
       if (!options.room && !fromSlot) {
         printWarning(`${from || 'This session'} holds no slot, so replies cannot reach it. Claim one: quox slot checkout <name> --create --session ${from || '<session>'}`);
@@ -962,7 +983,7 @@ export function registerSlotCommands(program, ctx) {
       reportHumanPresence(data?.human_presence);
       reportBridgeDelivery(data?.bridges);
       if (program.opts().output === 'json') formatDetail(data, { format: 'json' });
-    });
+    }));
 
   // QUOXON-BROADCAST: one call fans a message out to every held slot in the org (or --slots).
   slot
@@ -972,24 +993,38 @@ export function registerSlotCommands(program, ctx) {
     .option('--slots <list>', 'comma-separated slot names instead of every held slot')
     .option('--priority <p>', 'normal or urgent', 'normal')
     .option('--ack', 'ask recipients to acknowledge with /ack <id>')
+    .option('--active', 'only sessions listening right now; dormant slots are skipped, not woken')
+    .option('--dry-run', 'with --active: print who would be reached and who is skipped dormant, send nothing')
     .option('--session <s>', 'session name to sign as (default: $QUOX_STREAM)')
-    .action(async (textParts, options) => {
+    .action(announceOnFail('quoxslots', 'broadcast', async (textParts, options) => {
       auth.requireAuth();
       const parsed = parseBroadcastArgs([
-        options.slots ? `--slots ${options.slots}` : '', `--priority ${options.priority}`, options.ack ? '--ack' : '', textParts.join(' '),
+        options.slots ? `--slots ${options.slots}` : '', `--priority ${options.priority}`, options.ack ? '--ack' : '', options.active ? '--active' : '', options.dryRun ? '--dry-run' : '', textParts.join(' '),
       ].filter(Boolean).join(' '));
       if (!parsed.ok) throw new Error(parsed.message);
       const from = options.session || process.env.QUOX_STREAM || null;
+      const bcFromSlot = senderSlot(from);
+      const bcHeldAs = heldSessionFor(from);
       const ep = resolveEndpoint('v1.slots.broadcast');
       const data = await client.post(ep.path, {
         service: ep.service, retries: 0,
-        body: { text: parsed.text, priority: parsed.priority, ack: parsed.ack, ...(parsed.slots ? { slots: parsed.slots } : {}), ...(from ? { from } : {}), org_id: resolveOrgId(auth, program) },
+        body: { text: parsed.text, priority: parsed.priority, ack: parsed.ack, ...(parsed.active ? { active: true } : {}), ...(parsed.dryRun ? { dry_run: true } : {}), ...(parsed.slots ? { slots: parsed.slots } : {}), ...(from ? { from } : {}), ...(bcFromSlot ? { from_slot: bcFromSlot } : {}), ...(bcHeldAs ? { holder_session: bcHeldAs } : {}), org_id: resolveOrgId(auth, program) },
       });
       if (program.opts().output === 'json') return formatDetail(data, { format: 'json' });
+      if (data?.dry_run) { // BROADCAST-ACTIVE --dry-run: nothing was sent
+        const would = data.would_reach || []; const dorm = data.skipped_dormant || [];
+        announce('quoxslots', 'broadcast to active', { result: `${would.length} would reach \u00B7 ${dorm.length} skipped dormant` });
+        if (would.length) printInfo(`  would reach: ${would.join(', ')}`);
+        if (dorm.length) printInfo(`  skipped dormant: ${dorm.join(', ')}`);
+        return printInfo('Dry run: nothing was sent.');
+      }
+      if (parsed.active && data?.skipped_dormant) {
+        announce('quoxslots', 'broadcast to active', { result: `${data.counts?.delivered || 0} reached \u00B7 ${data.skipped_dormant.length} skipped dormant` });
+      } else announce('quoxslots', 'broadcast sent', { result: data?.id || data?.broadcast?.id });
       for (const [line, kind] of broadcastSummary(data)) (kind === 'warn' ? printWarning : printInfo)(line);
       reportHumanPresence(data?.human_presence);
       return undefined;
-    });
+    }));
 
   slot
     .command('broadcast-status')
@@ -1052,12 +1087,14 @@ export function registerSlotCommands(program, ctx) {
   }
   function reportBridgeDelivery(bridges) {
     if (!Array.isArray(bridges) || bridges.length === 0) return;
-    for (const b of bridges) {
-      const where = b.target ? `${b.platform} (${b.target})` : b.platform || 'bridge';
+    // Two bridges that both report "still sending" with no platform/target printed two identical "bridge:" lines;
+    // number them so each line says which bridge it is about.
+    bridges.forEach((b, i) => {
+      const where = b.target ? `${b.platform} (${b.target})` : b.platform || (bridges.length > 1 ? `bridge ${i + 1} of ${bridges.length}` : 'bridge');
       if (b.ok === true) printInfo(`  rendered to ${where}`);
       else if (b.ok === null) printInfo(`  ${where}: still sending, check \`quox slot read\``);
       else printWarning(`  NOT rendered to ${where}: ${b.reason}`);
-    }
+    });
   }
 
   async function readMessages(name, options) {
@@ -1134,6 +1171,7 @@ export function registerSlotCommands(program, ctx) {
       let cursor = options.since || null;
       let netFailures = 0;
       let authSince = null; // start of the current run of consecutive 401/403s
+      let downSince = null; // start of the current outage, for the single resume line
 
       for (;;) {
         const query = { org_id: resolveOrgId(auth, program), timeout_ms: 50000 };
@@ -1145,6 +1183,7 @@ export function registerSlotCommands(program, ctx) {
         let data;
         try {
           data = await client.get(ep.path, { service: ep.service, ...attachAuthFor(name), query, timeout: 65000 });
+          if (downSince !== null) { printInfo(`reconnected after ${Math.round((Date.now() - downSince) / 1000)}s`); downSince = null; }
           netFailures = 0;
           authSince = null;
         } catch (err) {
@@ -1182,6 +1221,7 @@ export function registerSlotCommands(program, ctx) {
             authSince = null;
           }
           netFailures += 1;
+          if (downSince === null) downSince = Date.now();
           let delay = Math.min(2000 * 2 ** Math.min(netFailures - 1, 5), 60000);
           delay = Math.round(delay * (0.75 + Math.random() * 0.5));
           if (Number.isFinite(err.retryAfterMs)) delay = Math.min(Math.max(delay, err.retryAfterMs), 300000);