quoxcli 0.4.0 → 0.6.0

package/lib/quoxon/onboarding/view.js

@@ -18,6 +18,7 @@ import * as T from './copy.js';
 import { matchIntent, yesNo, parseConnect } from './intent.js';
 import { loadJourney, saveJourney, clearJourney, resumeStep } from './journey.js';
 import { pendingRows, runPreflight, preflightPassed, detectOllama, defaultDeps } from './preflight.js';
+import { probeLocalQuox } from './probe.js';
 import { credentialOptions, KEY_PROVIDERS, normaliseOllamaUrl, nextSelectable } from './credential.js';
 import { needsConsent, providerLabel } from '../consent.js';
 import { HelloIntro, helloIntroMs } from '../qmotion.js';
@@ -101,8 +102,8 @@ const Hint = ({ text, cols }) => h(Box, { paddingLeft: 2 }, h(Text, { color: c('
 
 // ---- the view ---------------------------------------------------------------------------------
 export function GettingStarted({
-  columns, version = '0.4.0', cwd = '', welcome = false, animateIntro, earlyInput = null,
-  journeyPath, dryRun = false, runner = null, preflightDeps, runChecks = runPreflight, findOllama = detectOllama,
+  columns, version = '0.6.0', cwd = '', welcome = false, animateIntro, earlyInput = null,
+  journeyPath, dryRun = false, runner = null, preflightDeps, runChecks = runPreflight, findLocal = probeLocalQuox, findOllama = detectOllama,
   requestCredential, broker = null, finisher = null, onExit = () => {}, now = () => Date.now()
 }) {
   const { stdin, setRawMode, isRawModeSupported } = useStdin();
@@ -179,7 +180,7 @@ export function GettingStarted({
 
   function offerLines() {
     const items = [{ kind: 'guide', text: T.OFFER }];
-    items.push({ kind: 'ask', text: T.OFFER_ASK }, { kind: 'dim', text: T.ALREADY });
+    items.push({ kind: 'ask', text: T.OFFER_ASK }, { kind: 'dim', text: T.CHOICES }, { kind: 'dim', text: T.ALREADY });
     push(...items);
     set({ step: 'offer' });
     persist();
@@ -218,6 +219,10 @@ export function GettingStarted({
     if (text.startsWith('/')) { onSlash(text); return; }
     if (s.step === 'ask') return onRequest(text);
     if (s.step === 'offer' || s.step === 'declined') {
+      const pick = text.toLowerCase();
+      if (pick === 'a') { push({ kind: 'user', text }); startPreflight(); return; } // install here: the same flow as yes
+      if (pick === 'b') { push({ kind: 'user', text }, { kind: 'dim', text: T.LOCAL_CHECKING }); useLocal(); return; }
+      if (pick === 'c') { push({ kind: 'user', text }, { kind: 'guide', text: T.CONNECT_ELSEWHERE }); return; }
       const yn = yesNo(text);
       if (yn === true) { push({ kind: 'user', text: text || 'yes' }); startPreflight(); return; }
       if (yn === false) { push({ kind: 'user', text }, { kind: 'guide', text: T.DECLINED }, { kind: 'dim', text: T.DECLINED_HINT }); set({ step: 'declined' }); persist(); return; }
@@ -225,6 +230,14 @@ export function GettingStarted({
     }
   }
 
+  async function useLocal() {
+    const f = await findLocal();
+    if (!live.current || S.current.done) return;
+    if (!f.found) { push({ kind: 'guide', tone: 'warn', text: T.LOCAL_NONE }); return; }
+    push({ kind: 'guide', tone: 'ok', text: T.localFound(f.url) }, { kind: 'guide', text: T.connectChecking(f.url) });
+    exit({ action: 'connect', url: f.url });
+  }
+
   async function startPreflight() {
     set({ step: 'preflight', rows: pendingRows(), fixNote: null });
     persist();

package/lib/quoxon/orgSwitch.js

@@ -8,7 +8,29 @@ export const orgRows = (list) => (Array.isArray(list) ? list : []).map((o) => ({
  * query found in the name or slug (so "acme widgets" finds "Acme Widgets Ltd"). Never guesses between ties.
  * -> { org } | { ambiguous: [orgs] } | { none: true }
  */
+const VERBS = new Set(['switch', 'swith', 'swich', 'sw', 'to', 'go', 'use']);
+/** Drop ONE leading verb-ish token ("swith quox dev" -> "quox dev"); a lone verb is kept (it may be the name). */
+export function stripOrgVerb(query) {
+  const m = /^(\S+)\s+(\S[\s\S]*)$/.exec(String(query ?? '').trim());
+  return m && VERBS.has(m[1].toLowerCase()) ? m[2].trim() : String(query ?? '').trim();
+}
+
+/** Orgs for a picker when nothing matched uniquely: those hitting the most query words (verb stripped), at least one. */
+export function orgCandidates(query, list) {
+  const words = norm(stripOrgVerb(query)).split(' ').filter(Boolean);
+  const scored = orgRows(list).map((o) => { const hay = `${norm(o.name)} ${norm(o.slug)}`; return { o, n: words.filter((w) => hay.includes(w)).length }; });
+  const best = Math.max(0, ...scored.map((x) => x.n));
+  return best ? scored.filter((x) => x.n === best).map((x) => x.o) : [];
+}
+
 export function matchOrg(query, list) {
+  const first = matchOrgExact(query, list);
+  if (!first.none) return first;
+  const stripped = stripOrgVerb(query);
+  return stripped !== String(query ?? '').trim() ? matchOrgExact(stripped, list) : first;
+}
+
+function matchOrgExact(query, list) {
   const rows = orgRows(list);
   const q = norm(query);
   if (!q) return { none: true };

package/lib/quoxon/print.js

@@ -4,6 +4,7 @@
  * Exit codes: 0 completed, 2 held for approval, 3 interrupted, 4 auth, 5 unconfirmed
  * (stream closed without turn.finished), 1 other.
  */
+import { eventLine } from '../core/announce.js';
 import { textGate } from './events.js';
 import { streamFields, fallbackNote } from './model.js';
 import { connectOfferFor } from './connect.js';
@@ -60,6 +61,7 @@ export async function runPrint({ api, prompt, agent = 'quox', output = 'text', c
       else if (ev.type === 'done' && !text && ev.full_response) text = ev.full_response;
       else if (ev.type === 'tool.started' && !seen.has(ev.call_id)) { seen.add(ev.call_id); sum.tools++; }
       else if (ev.type === 'tool.finished') { if (!seen.has(ev.call_id)) { seen.add(ev.call_id); sum.tools++; } if (ev.receipt?.ward_seq != null) sum.receipts.push(ev.receipt.ward_seq); }
+      else if (ev.type === 'quox_event') { if (output !== 'json') { const q = eventLine(ev); if (q) err(`${q}\n`); } } // QUOX-ANNOUNCE A2: stdout stays the answer
       else if (ev.type === 'approval.requested') { sawApproval = true; sum.approvals++; }
       else if (ev.type === 'approval.resolved') sawApproval = false;
       else if (ev.type === 'turn.objective_suggested' && ev.objective_suggested?.goal) objective = ev.objective_suggested; // QUOXON objective offer

package/lib/quoxon/profileSwitch.js

@@ -23,6 +23,13 @@ export const switchAskLine = (profile, human) => askText('Switch?', {
   action: `switch this window to your login '${human}' (same conversation, attach, slot and groups)`,
 });
 
+/** The startup offer on an agent login (owner 2026-10-28): restart as the human profile; /profile lists the rest. */
+export const startupSwitchAskLine = (profile, human, others = 0) => askText(`Restart as you (${human})?`, {
+  title: `This window would run as the agent '${profile}'.`,
+  action: `restart this window as '${human}' (same directory, nothing else changes)`,
+  reason: others > 0 ? `${others} other signed-in profile${others === 1 ? '' : 's'}: /profile lists them` : '',
+});
+
 /** The ask card for a /slot name that does not exist (the near misses are said on the line above). */
 export const slotCreateAskLine = (nm) => askText('Create it?', { title: `No slot ${nm}.`, action: `create and hold slot ${nm}` });
 

package/lib/quoxon/promptHistory.js

@@ -6,6 +6,7 @@
 import { readFileSync, appendFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
+import { redactSecrets } from './secretShape.js';
 
 export const HISTORY_CAP = 500;
 export const defaultHistoryPath = (home = homedir()) => join(home, '.quox', 'history.jsonl');
@@ -22,7 +23,8 @@ export function fileHistory(path = defaultHistoryPath(), { cap = HISTORY_CAP } =
       return out.slice(-cap);
     } catch { return []; }
   };
-  const add = (text) => {
+  const add = (text0) => {
+    const text = redactSecrets(text0); // SECRET-GUARD: a value never reaches the file
     try {
       mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
       appendFileSync(path, JSON.stringify({ t: text }) + '\n', { mode: 0o600 });

package/lib/quoxon/render.js

@@ -3,6 +3,7 @@
  * horizontal rules only (no side borders), semantic colour, mono-safe.
  */
 import { toolCardLines } from './toolCards.js';
+import { DelegationDragon, delegationDragonLines } from './delegationDragon.js';
 import React from 'react';
 import chalk from 'chalk';
 import { Box, Text, useStdout } from 'ink';
@@ -30,6 +31,7 @@ import { Markdown, wrapCell, markdownRows, wrapRows, WText, Heading } from './ma
 import { parseAsk, keysLabel, askText } from './ask.js';
 import { parseAsideNote } from './asideView.js';
 import { formatSlotBody, inlineable, codeRows } from './slotFormat.js';
+import { BACKGROUND_NOTE } from './backgroundWork.js';
 import { termRows } from './term.js';
 import { cellWidth, ambiguousWide } from './cells.js';
 import { welcomeModel } from './welcome.js';
@@ -555,7 +557,9 @@ export function HistoryItem({ item, cols, live = false, fx = null, pulse = null,
         : h(Text, { key: i, color: c('dim') }, ...runs(paintRuns(l, 'muted'))))));
     }
     case 'text': return h(Box, { marginTop: gap ?? 1, paddingLeft: 2, flexDirection: 'column' }, h(Markdown, { text: item.text, cols: cols - 2, live }));
-    case 'tool': return h(ToolRow, { b: item, cols, fx, pulse, ignite });
+    case 'tool': return item.dragon // dragons on: a static dragon marks CommanderQ's hand-off (delegationDragon.js)
+      ? h(Box, { flexDirection: 'column' }, h(DelegationDragon, { b: item, cols }), h(ToolRow, { b: item, cols, fx, pulse, ignite }))
+      : h(ToolRow, { b: item, cols, fx, pulse, ignite });
     case 'trace': return h(TraceRow, { b: item, cols, fx, pulse });
     case 'aocl': return h(AoclRow, { item, cols });
     case 'error': return h(ErrorView, { item, cols, fx });
@@ -733,10 +737,12 @@ function TipView({ item, cols }) {
   const body = wrapPlain(item.text, inner).map((l, i) => row(`t${i}`, [h(Text, { key: 0, color: c('prose') }, l)], [...l].length));
   const cmdText = clip(item.cmd, inner - 5);
   const tryRow = row('try', [h(Text, { key: 0, color: c('prose'), bold: true }, 'Try: '), h(Text, { key: 1, color: c('command') }, cmdText)], 5 + [...cmdText].length);
-  const hintRow = row('hint', runs(paintRuns(TIP_HINT, 'quiet')), [...stripMarks(TIP_HINT)].length);
+  const hintPlain = stripMarks(TIP_HINT); // too long for the frame: wrap it inside, never let the terminal wrap the border
+  const hintRows = [...hintPlain].length <= inner ? [row('hint', runs(paintRuns(TIP_HINT, 'quiet')), [...hintPlain].length)]
+    : wrapPlain(hintPlain, inner).map((l, i) => row(`hint${i}`, [h(Text, { key: 0, color: c('quiet') }, l)], [...l].length));
   return h(Box, { paddingLeft: 2, flexDirection: 'column' },
     h(Text, edge, '╭─ ', h(Text, { bold: true }, 'Tip'), ' ', '─'.repeat(W - 8), '╮'),
-    ...body, tryRow, hintRow,
+    ...body, tryRow, ...hintRows,
     h(Text, edge, '╰', '─'.repeat(W - 2), '╯'));
 }
 
@@ -764,9 +770,13 @@ function WhatsNewView({ item, cols }) {
     return out;
   });
   if (more) rows.push(row('more', [h(Text, { key: 0, color: c('prose') }, lead), h(Text, { key: 1, color: c('prose'), bold: true }, 'Try: '), h(Text, { key: 2, color: c('command') }, '/whatsnew')], [...more].length));
+  // a head that does not fit in the top edge (the compact "N new commands (...)" line at a narrow width) goes inside the
+  // frame, wrapped, under a bare top edge: the terminal must never be the one to wrap a border row
+  const headFits = [...HEAD].length <= W - 6;
+  if (!headFits) rows.unshift(...wrapPlain(HEAD, inner).map((l, i) => row(`h${i}`, [h(Text, { key: 0, color: c('prose'), bold: true }, l)], [...l].length)));
   if (item.pad) { rows.unshift(row('p0', [], 0)); rows.push(row('p1', [], 0)); }
   return h(Box, { paddingLeft: 2, flexDirection: 'column' },
-    h(Text, edge, '╭─ ', h(Text, { bold: true }, HEAD), ' ', '─'.repeat(Math.max(1, W - 5 - HEAD.length)), '╮'),
+    headFits ? h(Text, edge, '╭─ ', h(Text, { bold: true }, HEAD), ' ', '─'.repeat(W - 5 - [...HEAD].length), '╮') : h(Text, edge, '╭', '─'.repeat(W - 2), '╮'),
     ...rows,
     h(Text, edge, '╰', '─'.repeat(W - 2), '╯'));
 }
@@ -804,7 +814,7 @@ export function liveRows(blocks, cols) {
       case 'summary': return n + noteLines(b.text, cols - 4).length;
       case 'error': return n + errorRows(b.text, cols);
       case 'slotmsg': return n + (b.line?.run && !b.line.run.settled ? 9 + Math.ceil(String(b.line.run.cmd || '').length / Math.max(10, cols - 8)) : 1); // ASK-SETTLE: an armed run card is held live
-      case 'tool': return n + 1 + (b.status === 'running' ? 0 : toolCardLines(b, cols).length);
+      case 'tool': return n + 1 + delegationDragonLines(b, cols).length + (b.status === 'running' ? 0 : toolCardLines(b, cols).length);
       case 'loopcard': return n + (loopPinned(b.card) ? 0 : 1 + loopCardLines(b.card, cols).length);
       default: return n + 1;
     }
@@ -843,6 +853,12 @@ export function modelRuleLabel(cols, model, reserve = 0) {
   return reserve ? '' : clip(name, room); // with the approvals indicator the model is dropped before the indicator is cut
 }
 
+/** Pure: a failed approvals poll goes stale (footer `?`) only after 3 consecutive misses or 60 s without a good read. */
+export function approvalsPollStale({ fails, lastOkAt, now }) {
+  if (!(fails > 0)) return false;
+  return fails >= 3 || (typeof lastOkAt === 'number' && now - lastOkAt > 60000);
+}
+
 /**
  * Pure: the permanent approvals indicator on the bottom rule. `a` = { count, error, signedOut }.
  * Never a false 0: signed out, an unreachable inbox, or a count not read yet is `approvals ?` (warn).
@@ -850,9 +866,20 @@ export function modelRuleLabel(cols, model, reserve = 0) {
 export function approvalsIndicator(a) {
   if (!a) return null;
   const n = a.count;
+  if (!a.signedOut && a.error && a.slow) return { text: 'approvals ? (server slow)', role: 'warn' }; // sustained failure, never an all-clear
   if (a.signedOut || a.error || typeof n !== 'number') return { text: 'approvals ?', role: 'warn' };
+  // Never an all-clear next to outstanding items or an unseen source: scope the claim to approvals and say what else is open.
+  const out = Number(a.outstanding) || 0, blind = Number(a.blind) || 0;
+  if (n === 0 && (out > 0 || blind > 0)) {
+    const more = [out > 0 ? `${out} other item${out === 1 ? '' : 's'} open` : null, blind > 0 ? `can't see ${blind} source${blind === 1 ? '' : 's'}` : null].filter(Boolean).join(' · ');
+    return { text: `no approvals in this view · ${more}`, role: 'warn' };
+  }
+  // Other orgs the user belongs to (cached counts, core/crossOrgApprovals): never an all-clear beside a waiting approval elsewhere.
+  const others = (Array.isArray(a.others) ? a.others : []).filter((o) => o && o.count > 0);
+  const elsewhere = others.reduce((t, o) => t + o.count, 0);
+  if (n === 0 && elsewhere > 0) return { text: others.length === 1 ? `⏸ ${elsewhere} in ${others[0].name} · /approvals` : `⏸ ${elsewhere} in ${others.length} other orgs · /approvals`, role: 'warn' };
   if (n === 0) return { text: '✔ nothing waiting', role: 'ok' };
-  return { text: `⏸ ${n} approval${n === 1 ? '' : 's'} waiting`, role: 'warn' };
+  return { text: `⏸ ${n} approval${n === 1 ? '' : 's'} waiting${elsewhere ? ` · +${elsewhere} in ${others.length === 1 ? others[0].name : `${others.length} other orgs`}` : ''}`, role: 'warn' };
 }
 
 /** Pure: the labels for this width. The indicator sits top-left, the model bottom-right: independent of each other. */
@@ -1031,11 +1058,12 @@ export function AskFoot({ footer }) {
   return h(Box, { paddingLeft: 2 }, h(Box, { width: 2, flexShrink: 0 }, h(Text, { bold: true }, ...runs(paintLine('▶ ', 'ask')))), h(Box, { flexGrow: 1, flexShrink: 1 }, h(Text, { color: c('prose'), bold: true, wrap: 'wrap' }, ...runs(paintLine(f.slice(2), 'ask')))));
 }
 const footRows = (footer, cols) => (HANG_ASK.test(footer) ? wrapRows(footer.slice(2), cols - 4) : wrapRows(footer, cols - 2));
-export function NeedsYouCard({ cols, title, rows = [], block = [], notes = [], footer, arming = null, motionE = null }) {
+export function NeedsYouCard({ cols, title, rows = [], block = [], notes = [], footer, arming = null, motionE = null, lead = null }) {
   const e = motionE;
   return h(Box, { flexDirection: 'column', width: cols, marginTop: 1 },
     e == null ? h(Rule, { cols, color: 'warn' }) : h(DrawRule, { cols, color: 'warn', e }),
     e == null ? h(Text, { color: c('warn'), bold: true, wrap: 'wrap' }, title) : h(Text, null, ...fxNodes([{ t: title, color: 'warn', bold: true }], { e: e - 0.1, timing: TIMING.title }, 23)),
+    lead ? h(Text, { color: c('warn'), bold: true, wrap: 'wrap' }, `  ${lead}`) : null, // a destructive approval leads with what it deletes
     // APPROVAL-WHAT: wrap at word boundaries under the label instead of cutting the action or target off
     ...rows.flatMap(([k, v], ri) => wrapPlain(String(v), Math.max(10, cols - 10)).slice(0, 8).map((line, i) => h(Text, { key: `${ri}${k}${i}`, color: c('text') }, '  ', h(Text, { color: c('label') }, (i ? '' : k).padEnd(7)), h(Text, { color: c(k === 'risk' ? 'warn' : 'value') }, line)))),
     // block: pre-shaped segment rows shown verbatim (a command to run: never word-wrapped, never clipped)
@@ -1068,7 +1096,16 @@ export const askCardRows = (text, cols) => {
   return 4 + wrapRows(m.title, cols) + m.rows.reduce((n, [, v]) => n + Math.min(8, wrapPlain(String(v), Math.max(10, cols - 10)).length), 0) + footRows(m.footer, cols);
 };
 
-export function ApprovalCard({ card, org, cols, armed, draftHint = null, motionE = null, confirm = false, position = null }) {
+/** APPROVAL-BURST: one card for 2+ approvals from one agent for one tool (approvalBatch.batchModel). */
+export function BatchCard({ model, cols, armed, motionE = null }) {
+  const e = motionE;
+  const block = model.lines.map((l) => [{ t: `• ${clip(l, Math.max(10, cols - 8))}`, role: 'text' }]);
+  if (model.more) block.push([{ t: model.more, role: 'dim' }]);
+  const footer = askText(`Approve all ${model.n}?`, { keys: model.keys });
+  return h(NeedsYouCard, { cols, title: model.title, rows: [], block, notes: model.notes, footer, arming: armed ? null : (e == null ? h(Text, { color: c('dim') }, '  arming…') : null), motionE: e });
+}
+
+export function ApprovalCard({ card, org, cols, armed, draftHint = null, motionE = null, confirm = false, position = null, signedOut = false }) {
   const when = card.askedAt ? String(card.askedAt).replace('T', ' ').slice(0, 16) + ' UTC' : null;
   const rows = card.undescribable ? [['what', card.what], ['from', card.askedBy || card.origin], ['asked', when], ['org', org]].filter(r => r[1]) : [
     ['what', card.what && card.what !== card.tool ? card.what : null], ['tool', card.tool], ['target', card.target], ['scope', card.scope], ['risk', card.risk], ['from', card.foreign ? card.origin : null], ['org', card.plan && (card.plan.orgName || card.plan.orgId) ? orgLabel(card.plan.orgName, card.plan.orgId) : org]
@@ -1082,8 +1119,9 @@ export function ApprovalCard({ card, org, cols, armed, draftHint = null, motionE
   const f = card.facts || null; const block = [];
   if (f && !card.undescribable) {
     if (f.where && /^\d+ (hosts|targets):/.test(f.where)) { for (const k of ['target', 'what']) { const i = rows.findIndex(r => r[0] === k && (k === 'target' || String(r[1]).includes(f.hostList[1]))); if (i >= 0) rows.splice(i, 1); } }
+    if (f.background) { const i = rows.findIndex(r => r[0] === 'what'); const note = BACKGROUND_NOTE[0].toUpperCase() + BACKGROUND_NOTE.slice(1); if (i >= 0) rows[i] = ['what', `${rows[i][1]}. ${note}`]; else rows.unshift(['what', note]); }
     if (f.command) { block.push([{ t: f.command.kind === 'input' ? 'input:' : 'command:', role: 'label' }]); block.push(...codeRows(f.command.shown.split('\n'), cols - 4)); }
-    for (const r of [['where', f.where], ['who', f.who], ['why', f.why], ['asked', [f.asked && `"${f.asked}"`, f.when].filter(Boolean).join(' · ') || null], ['class', f.access]]) if (r[1]) rows.push(r);
+    for (const r of [['where', f.where], ['who', f.who], ['why', f.why], ['asked', [f.asked && (f.askedRich ? f.asked : `"${f.asked}"`), f.when].filter(Boolean).join(' · ') || null], ['class', f.access]]) if (r[1]) rows.push(r);
   }
   const e = motionE;
   const title = `⚠ Approval needed${position && position.n > 1 ? ` (${position.i} of ${position.n})` : ''}: execution is held`;
@@ -1091,12 +1129,15 @@ export function ApprovalCard({ card, org, cols, armed, draftHint = null, motionE
   const arming = e == null || mono()
     ? h(Text, { color: c('dim') }, e == null ? '  arming…' : `  arming… ${'▰'.repeat(filled)}${'▱'.repeat(ARM_BAR - filled)}`)
     : h(Text, null, h(Text, { color: c('dim') }, '  arming… '), h(Text, { color: c('warn') }, '▰'.repeat(filled)), h(Text, { color: c('faint') }, '▱'.repeat(ARM_BAR - filled)));
-  const footer = card.privileged && confirm ? `▶ Grant ${[card.tool, card.target].filter(Boolean).join(' ')}? press y again to confirm, any other key cancels`
+  const footer = signedOut ? askText('Read-only while signed out. Sign in to answer?', { keys: 'y signs in' })
+    : card.privileged && confirm ? `▶ Grant ${[card.tool, card.target].filter(Boolean).join(' ')}? press y again to confirm, any other key cancels`
     : card.undescribable && confirm ? '▶ Quox could not describe this action. Approve it anyway? press y again to confirm, any other key cancels'
+      : draftHint === 'reason' ? askText('Why deny it?', { keys: 'type a reason · Enter denies · Esc goes back to y/n' })
       : draftHint === 'focus' ? askText('Approve it?', { keys: 'y approve · n deny · card focused (Esc returns to your draft)' }) // RESTORE-TUI: every y/n goes through askText (same text)
       : draftHint === 'draft' ? askText('Approve it?', { keys: 'y/n answer once your draft is empty · Tab to answer the approval card (your draft is kept)' })
-        : '▶ Approve it? y approve · n deny · c chat · Tab later · /approvals all';
-  return h(NeedsYouCard, { cols, title, rows, block, notes: [...(card.undescribable && !confirm ? ['Quox could not describe this action'] : []), ...(position && position.others > 0 ? [`other sessions: ${position.others} waiting · /approvals`] : [])], footer, arming: armed ? null : arming, motionE: e });
+        : card.destructive ? '▶ Delete it? y then type the name · n deny · c chat · Tab later · /approvals all'
+          : '▶ Approve it? y approve · n deny · c chat · Tab later · /approvals all';
+  return h(NeedsYouCard, { cols, title, rows, block, lead: card.destructive ? `DELETES ${card.destructive.label}` : null, notes: [...(f && f.askedNone ? ['nothing in your request asks for this'] : []), ...(card.undescribable && !confirm ? ['Quox could not describe this action'] : []), ...(position && position.others > 0 ? [`other sessions: ${position.others} waiting · /approvals`] : [])], footer, arming: armed ? null : arming, motionE: e });
 }
 
 /** Columns the status line's Q takes: 2 for the Braille glyph, 1 for the Ⓠ fallback (2 where Ambiguous is wide). */
@@ -1221,11 +1262,22 @@ function hintNodes(hint) {
 }
 
 /** Live, actionable counts under the status line. Never a transcript message. */
-export function NotifyBar({ approvals, error, cols, signedOut = false, alerts = [], hideCount = false, inbox = '' }) {
+export function NotifyBar({ approvals, error, cols, signedOut = false, alerts = [], hideCount = false, inbox = '', spinner = '', away = false, awayCount = 0, dnd = false, dndCount = 0, awaySince = 0, dndUntil = 0, awayUnknown = false }) {
+  const hm = (ms) => { const d = new Date(ms); return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`; };
+  if (away && dnd && !signedOut) { // DND: one persistent quiet line, shown even at 0 waiting so the mode is never invisible
+    const head = dndUntil ? `🌙 do not disturb until ${hm(dndUntil)}` : '🌙 do not disturb';
+    return h(Text, { color: c('ask'), bold: true }, ' ' + clip(`${head}${dndCount ? ` · ${dndCount} waiting` : ''} · /morningreport`, cols - 3));
+  }
+  if (away && !signedOut) { // AFK-QUIET-CARDS: away shows one quiet line, never a prompt
+    const n = awayCount || approvals || 0;
+    const head = awaySince ? `🌙 away since ${hm(awaySince)} · /back` : awayUnknown ? '🌙 away (since before this window opened) · /back' : '🌙 away · /back';
+    return h(Text, { color: c('ask'), bold: true }, ' ' + clip(n ? `⏸ ${n} approval${n === 1 ? '' : 's'} waiting · /back to review` : head, cols - 3)); // >0 keeps the existing wording (asserted elsewhere)
+  }
   const base = NotifyBarBase({ approvals, error, cols, signedOut, alerts, hideCount });
-  if (!inbox || signedOut) return base;
-  const line = h(Text, { key: 'inbox', color: c('ask'), bold: true }, ' ' + clip(inbox, cols - 3)); // HITL-INBOX-BAR: 📨 N new · newest title
-  return base ? h(Box, { flexDirection: 'column' }, base, line) : line;
+  const line = inbox && !signedOut ? h(Text, { key: 'inbox', color: c('ask'), bold: true }, ' ' + clip(inbox, cols - 3)) : null; // HITL-INBOX-BAR: 📨 N new · newest title
+  const spin = spinner ? h(Text, { key: 'spin', color: c('ask') }, ' ' + clip(spinner, cols - 3)) : null; // INSTANT-FEEDBACK: ⠋ <verb>…
+  const parts = [base, line, spin].filter(Boolean);
+  return parts.length > 1 ? h(Box, { flexDirection: 'column' }, ...parts) : (parts[0] || base);
 }
 function NotifyBarBase({ approvals, error, cols, signedOut = false, alerts = [], hideCount = false }) {
   if (signedOut) return h(Text, { color: c('warn') }, ' ' + clip('not signed in: approvals unavailable until you sign in', cols - 2));

package/lib/quoxon/resend.js

@@ -14,6 +14,20 @@ export function isServerDown(e) {
   return /ECONNREFUSED|ECONNRESET|ENOTFOUND|EAI_AGAIN|UND_ERR_SOCKET/.test(String(code)) || /Could not connect to|fetch failed|ECONNREFUSED/i.test(msg);
 }
 
+/**
+ * Owner 2026-11-07: a resend of the SAME turn_id that the server says it already holds (409 turn_id_reused, or
+ * turn_in_use while it still runs; also the in-stream error the registry race sends). The first send reached the
+ * server before the socket dropped, so the right move is to attach to that turn, never to show a bare failure.
+ */
+export function isTurnIdTaken(e) {
+  if (!e) return false;
+  const words = `${e.code || ''} ${e.body?.error || ''} ${typeof e.error === 'string' ? e.error : ''} ${e.message || ''}`;
+  if (e.type === 'error') return /turn_id_reused|this turn_id already ran|this turn_id is already running/i.test(words);
+  return Number(e.status) === 409 && /turn_id_reused|turn_in_use|turn_id already ran|already running/i.test(words);
+}
+/** The text shown when the held turn cannot be shown either: the message is restored, and the owner told it may have run. */
+export const HELD_NOT_SHOWN = 'The server already received this message before the connection dropped, but could not show what happened to it. Your message is back in the composer; it may have run, so check /resume before sending it again.';
+
 /** gh #1157: resume during a collector restart. Connection-class failures (refused, fetch failed, hang up, 502/503/504) are worth retrying; 401/404 are answers. */
 export function isResumeRetryable(e) {
   if (!e) return false;

package/lib/quoxon/roster.js

@@ -258,14 +258,14 @@ export function countsLine(rows) {
  * one row each plus a summary line (owner, live 05:29): the bottom area must never grow with the inbox. A single approval
  * keeps its own row. Focus (the user is walking the roster) shows the real rows so selection stays truthful.
  */
-export function collapseApprovals(rows, now = Date.now()) {
+export function collapseApprovals(rows, now = Date.now(), staleAt = null) {
   const aps = rows.filter(r => r.kind === 'approval' && r.state === 'waiting');
-  if (aps.length < 2) return rows;
+  if (aps.length < (staleAt ? 1 : 2)) return rows;
   const started = aps.map(r => r.startedAt).filter(x => x != null);
   const newest = aps.reduce((a, b) => ((b.startedAt ?? -Infinity) > (a.startedAt ?? -Infinity) ? b : a));
   const one = { key: 'approval:*', id: '*', source: 'approvals', kind: 'approval', state: 'waiting', background: false, collapsed: true, count: aps.length,
     name: `${aps.length} approvals waiting`, activity: '/approvals', status: 'pending', startedAt: started.length ? Math.min(...started) : null, finishedAt: null,
-    oldestMs: started.length ? now - Math.min(...started) : null, newestTitle: String(newest.detail?.description || newest.name || ''), detail: {} };
+    oldestMs: started.length ? now - Math.min(...started) : null, staleAt: staleAt || null, newestTitle: String(newest.detail?.description || newest.name || ''), detail: {} };
   let placed = false;
   return rows.flatMap(r => (aps.includes(r) ? (placed ? [] : (placed = true, [one])) : [r]));
 }
@@ -273,9 +273,9 @@ export function collapseApprovals(rows, now = Date.now()) {
 const KIND_ICON = { loop: '∞', objective: '◎' }; // QuoxGlyph registry keys qloop / objective
 export const kindLabel = k => (KIND_ICON[k] ? `${KIND_ICON[k]} ${k}` : k);
 
-export function rosterView({ rows, cols, termRows = 40, max = MAX_ROWS, on = true, sel = 0, focus = false, now = Date.now(), motion = false }) {
+export function rosterView({ rows, cols, termRows = 40, max = MAX_ROWS, on = true, sel = 0, focus = false, now = Date.now(), motion = false, staleAt = null }) {
   if (!on || !rows.length) return { mode: 'hidden', lines: [], more: 0 };
-  if (!focus) rows = collapseApprovals(rows, now);
+  if (!focus || staleAt) rows = collapseApprovals(rows, now, staleAt); // signed out: the cached count is last-known, always one stale row
   if (cols < MIN_FULL_COLS || termRows < MIN_FULL_ROWS) {
     return { mode: 'summary', lines: [], more: 0, summary: clip(' ' + countsLine(rows) + ' · /roster', cols - 1) };
   }
@@ -293,6 +293,11 @@ export function rosterView({ rows, cols, termRows = 40, max = MAX_ROWS, on = tru
     const nameW = Math.max(8, cols - 2 - fixed - 1);
     const name = clip(r.name, nameW).padEnd(nameW);
     const marker = focus && i === sel ? '›' : ' ';
+    if (r.collapsed && r.staleAt) { // signed out: last-known count with its time, never worded as live (owner live 2026-10-27)
+      const d = new Date(r.staleAt), at = `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`;
+      const text = clip(`${r.count} waiting as of ${at} · sign in to see more: /login`, cols - 4);
+      return { key: r.key, kind: 'approval', state: r.state, tone: 'dim', selected: false, marker: ' ', glyph: GLYPH[r.state], rest: ' ' + text, pulse: '', pulseRole: 'dim', pulseKind: 'none', text: ` ${GLYPH[r.state]} ${text}` };
+    }
     if (r.collapsed) { // one summary row: count, oldest age, newest title, where to go; clipped to the line
       const head = `${r.count} approvals waiting · oldest ${elapsed(r.oldestMs)} · newest: `, tail = ' · /approvals';
       const room = cols - 5 - [...head].length - [...tail].length;

package/lib/quoxon/rosterSessions.js

@@ -0,0 +1,44 @@
+/**
+ * /roster text for the two things that are not work rows: attached agents (org lease list) and this box's live
+ * `claude --resume` processes. Pure; the process list and the attach list are injected by the caller.
+ */
+
+const age = (sec) => {
+  const s = Math.max(0, Math.round(sec));
+  if (s < 60) return `${s}s`;
+  if (s < 3600) return `${Math.floor(s / 60)}m`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h`;
+  return `${Math.floor(s / 86400)}d`;
+};
+
+const sinceText = (iso, now) => {
+  const t = Date.parse(iso || '');
+  return Number.isNaN(t) ? '?' : age((now - t) / 1000);
+};
+
+/** attached agents -> one line each: agent, splinter, session, lease id, heartbeat age, expiry. */
+export function attachLines(items, now = Date.now()) {
+  if (!items || !items.length) return ['  attached agents: none'];
+  return items.map((a) => `  ${a.agent_id} ${a.splinter || 'S1'} · ${a.session_label || '(no label)'} · lease ${a.lease_id} · heartbeat ${sinceText(a.last_heartbeat_at, now)} ago · expires ${a.expires_at || '?'}`);
+}
+
+const where = (p) => (p.tmux ? `tmux ${p.tmux}` : `not in tmux${p.tty && p.tty !== '?' ? ` ${p.tty}` : ''}`);
+const one = (p) => `${p.pid} ${where(p)} ${age(p.ageSec || 0)}`;
+
+/** live claude processes -> lines, grouped by name case-insensitively; a name held more than once is flagged. */
+export function sessionLines(procs) {
+  if (!procs || !procs.length) return ["  this box's sessions: none"];
+  const groups = new Map();
+  for (const p of procs) {
+    const k = String(p.name).toLowerCase();
+    if (!groups.has(k)) groups.set(k, []);
+    groups.get(k).push(p);
+  }
+  const out = [];
+  for (const g of groups.values()) {
+    const name = g[0].name;
+    if (g.length === 1) out.push(`  ${name}: ${one(g[0])}`);
+    else out.push(`  ⚠ ${name} x${g.length}: ${g.map(one).join(', ')}`);
+  }
+  return out;
+}

package/lib/quoxon/rows.js

@@ -22,6 +22,7 @@ import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { cellWidth } from './cells.js';
+import { isWebPty, SHELL_REFUSED } from './webPty.js';
 
 export const MAX_ROWS = 3;
 /** Lines drawn above the status bar (a row can bring several with `lines`); the stored-row cap stays MAX_ROWS. */
@@ -566,8 +567,9 @@ export async function plainFetch(url, { timeoutMs = URL_TIMEOUT_MS, fetchImpl =
 }
 
 /** Run a shell command via the user's shell: timeout, output cap. -> stdout. Throws a short reason. */
-export function runShell(cmd, { timeoutMs = FETCH_TIMEOUT_MS, shell = process.env.SHELL || '/bin/sh', exec = execFile } = {}) {
+export function runShell(cmd, { timeoutMs = FETCH_TIMEOUT_MS, shell = process.env.SHELL || '/bin/sh', exec = execFile, env = process.env } = {}) {
   return new Promise((resolve, reject) => {
+    if (isWebPty(env)) return reject(new Error(SHELL_REFUSED)); // QUOXON web PTY: command rows never run on the server
     exec(shell, ['-c', cmd], { timeout: timeoutMs, maxBuffer: OUTPUT_CAP, killSignal: 'SIGKILL', windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] }, (err, stdout) => {
       if (!err) return resolve(String(stdout ?? ''));
       if (err.killed || err.signal === 'SIGKILL') return reject(new Error(`timed out after ${Math.round(timeoutMs / 1000)}s`));

package/lib/quoxon/screenContext.js

@@ -48,7 +48,7 @@ const age = (ms) => {
 };
 
 /** A line the user cannot have meant as a command they want repeated (PIN-bearing verbs): name only. */
-const PIN_VERBS = /^\/(authenticate|authorise|authorize|pin|login|connect|key)\b/i;
+const PIN_VERBS = /^\/(authenticate|authorise|authorize|pin|login|connect|key|verify-email)\b/i;
 
 function whoSection(w) {
   const bits = [];

package/lib/quoxon/secretShape.js

@@ -0,0 +1,88 @@
+/**
+ * QUOXON-SECRET-GUARD: one detector for secret-shaped text, shared by the composer (offer before send), the
+ * history writer and the transcript writer (redact before write). Low false positives on purpose: a bare number
+ * never matches unless a keyword sits next to it, or it is a Luhn-valid card number.
+ */
+const REDACTED = '[REDACTED';
+
+const luhn = (digits) => {
+  let sum = 0, dbl = false;
+  for (let i = digits.length - 1; i >= 0; i--) { let d = digits.charCodeAt(i) - 48; if (dbl) { d *= 2; if (d > 9) d -= 9; } sum += d; dbl = !dbl; }
+  return sum % 10 === 0;
+};
+
+// keyword, then a value: after ":" or "=" anything non-space; after plain space/"is" only a value carrying a digit (4+ chars)
+const KEYWORDS = [
+  ['pin', 'pin'], ['passcode', 'pass\\s?code'], ['password', 'password|passwd|pass\\s?word'],
+  ['api-key', 'api[ _-]?key'], ['secret', 'secret'], ['token', 'token']
+];
+const kwRe = (kw) => new RegExp(`\\b(?:${kw})\\b(?:[ \\t]+(?:number|no\\.?|code))?(?:[ \\t]*[:=][ \\t]*["']?([^\\s"',;]+)|[ \\t]+(?:is[ \\t]+)?["']?([^\\s"',;]*\\d[^\\s"',;]*))`, 'gi');
+
+const ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
+const trimVal = (v) => v.replace(/^[(\[`<*_]+/, '').replace(/[)\]`>*_.,;:!?]+$/, '');
+/**
+ * Precision mode: is a keyword-adjacent value really secret-shaped, or just prose ("PIN ask", "token budget",
+ * a ULID, a path, a placeholder)? pin/passcode need a 4-8 digit run; the others need a 8+ char value that mixes
+ * letters and digits (or carries a symbol) and is not an id, path, url, placeholder or short hex.
+ */
+function preciseValueOk(kind, raw) {
+  if (/^[<$\{\[~\/]|^[a-z]+:\/\/|\.\.\.|^\$|^\.{0,2}\//i.test(raw)) return false;
+  const v = trimVal(raw);
+  if (kind === 'pin' || kind === 'passcode') return /^\d{4,8}$/.test(v);
+  if (v.length < 8 || ULID.test(v) || /^[0-9a-f]{7,12}$/i.test(v) || /^\d{4}-\d{2}-\d{2}/.test(v)) return false;
+  if (/[<>{}()/\\]|^\W/.test(v) && !/^[\w!@#$%^&*+=.-]+$/.test(v)) return false;
+  return /[A-Za-z]/.test(v) && /\d/.test(v);
+}
+const CARD_FORM = /^(?:\d{13,19}|\d{4}(?:[ -]\d{4}){2,3}(?:[ -]\d{1,3})?|\d{4}[ -]\d{6}[ -]\d{5})$/;
+
+/** -> [{ kind, start, end }] value spans, sorted, non-overlapping. opts.precise = memory-sync mode (words are not secrets). */
+export function findSecrets(text, opts = {}) {
+  const s = String(text ?? '');
+  const precise = !!opts.precise;
+  const hits = [];
+  const add = (kind, start, end) => { if (!/^\[redacted/i.test(s.slice(start, end))) hits.push({ kind, start, end }); };
+  const grp = (m, i) => { const v = m[i]; const at = m.index + m[0].lastIndexOf(v); return [at, at + v.length]; };
+  for (const [kind, kw] of KEYWORDS) {
+    for (const m of s.matchAll(kwRe(kw))) {
+      const i = m[1] ? 1 : 2;
+      if (i === 2 && m[2].length < 4) continue;
+      if (i === 1 && m[1].length < 2) continue;
+      if (precise && !preciseValueOk(kind, m[i])) continue;
+      add(kind, ...grp(m, i));
+    }
+  }
+  for (const m of s.matchAll(/sort[ \t]*code[^\d\n]{0,15}(\d{2}-?\d{2}-?\d{2})(?!\d)/gi)) add('sort-code', ...grp(m, 1));
+  for (const m of s.matchAll(/account(?:[ \t]*(?:number|no\.?|num))?[^\d\n]{0,15}(\d{8})(?!\d)/gi)) add('account-number', ...grp(m, 1));
+  for (const m of s.matchAll(/customer[ \t]*(?:number|no\.?|num|id)[^\d\n]{0,15}(\d{6,})(?!\d)/gi)) add('customer-number', ...grp(m, 1));
+  for (const m of s.matchAll(/(?<![\d-])\d(?:[ -]?\d){12,18}(?![\d-])/g)) {
+    const d = m[0].replace(/[ -]/g, '');
+    // a digit run glued to letters/underscore is part of a longer token (hex disk serial, hash, id), never a PAN
+    if (/\w/.test(s[m.index - 1] ?? '') || /\w/.test(s[m.index + m[0].length] ?? '')) continue;
+    if (precise) {
+      if (!CARD_FORM.test(m[0]) || /[A-Za-z_]/.test(s[m.index - 1] ?? '') || /[A-Za-z_]/.test(s[m.index + m[0].length] ?? '')) continue;
+      if (/^\d{4}(?:-\d{4}){3}$/.test(m[0]) && /[0-9a-f]{4,}-$/i.test(s.slice(Math.max(0, m.index - 6), m.index))) continue;
+    }
+    if (d.length >= 13 && d.length <= 19 && luhn(d)) add('card-number', m.index, m.index + m[0].length);
+  }
+  for (const m of s.matchAll(/\bsk-[A-Za-z0-9_-]{8,}/g)) if (!precise || m[0].length >= 20) add('api-key', m.index, m.index + m[0].length);
+  for (const m of s.matchAll(/\b(?:ghp|gho|ghs)_[A-Za-z0-9]{16,}/g)) add('api-key', m.index, m.index + m[0].length);
+  for (const m of s.matchAll(/\bAKIA[0-9A-Z]{16}\b/g)) add('api-key', m.index, m.index + m[0].length);
+  for (const m of s.matchAll(/\beyJ[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]+){1,2}/g)) add('jwt', m.index, m.index + m[0].length);
+  hits.sort((a, b) => a.start - b.start || b.end - a.end);
+  const out = [];
+  for (const h of hits) { const last = out[out.length - 1]; if (last && h.start < last.end) continue; out.push(h); }
+  return out;
+}
+
+/** -> unique kinds in order of appearance ([] when clean). */
+export const secretKinds = (text, opts) => [...new Set(findSecrets(text, opts).map(h => h.kind))];
+
+/** Matched values become [REDACTED:<kind>]; everything else is untouched. */
+export function redactSecrets(text) {
+  if (typeof text !== 'string' || !text) return text;
+  const hits = findSecrets(text);
+  if (!hits.length) return text;
+  let out = '', at = 0;
+  for (const h of hits) { out += text.slice(at, h.start) + `${REDACTED}:${h.kind}]`; at = h.end; }
+  return out + text.slice(at);
+}

package/lib/quoxon/slash/agents.js

@@ -101,11 +101,12 @@ export const LOOSE_SAFE = new Set(['help', 'status', 'context', 'cost', 'agents'
 export function looseCommand(cmd, restArg) {
   const words = String(restArg || '').trim().split(/\s+/).filter(Boolean);
   for (let i = 0; i < words.length; i++) {
+    if (words[i].replace(/^\//, '').length < 2 && !words[i].startsWith('/')) continue; // a bare "r" in prose is not the /r alias
     const e = findEntry(words[i].replace(/^\//, ''));
     if (!e || e.kind !== 'command' || e.status !== 'active') continue;
     const rest = words.slice(i + 1).join(' ');
     if (LOOSE_SAFE.has(e.id)) return { run: `/${e.id}${rest ? ` ${rest}` : ''}`, name: `/${e.id}` };
-    return { suggest: `/${e.id}${rest ? ` ${rest}` : ''}` };
+    return { suggest: `/${e.id}` }; // a command NAME only, never the user's message text
   }
   if (words.length && !suggestCommands(cmd).length) return { ask: `${String(cmd).replace(/^\//, '')} ${words.join(' ')}` };
   return null;

package/lib/quoxon/slash/argSources.js

@@ -6,6 +6,7 @@
 import { CHOICES, connectedChoices, providerId } from '../model.js';
 import { liveModels } from '../modelPrefs.js';
 import { pathItems } from '../slotChat.js';
+import { fromOf, activeMutes } from '../inboxView.js';
 
 /** Provider ids /connect understands (one per provider; the subscription has no key). */
 export const connectIds = () => [
@@ -14,7 +15,7 @@ export const connectIds = () => [
   ).values(),
 ];
 
-export function createArgSources({ api, getPrefs = () => ({ favourites: [], default: null }), getRows = () => [] }) {
+export function createArgSources({ api, getPrefs = () => ({ favourites: [], default: null }), getRows = () => [], getExt = null, getInbox = null }) {
   return async function source(src, param) {
     switch (src) {
       case 'providers':
@@ -38,12 +39,18 @@ export function createArgSources({ api, getPrefs = () => ({ favourites: [], defa
           value: String(i + 1),
           desc: `${f.provider} ${f.model}`,
         }));
+      case 'ext.listed': return (getExt?.().listed?.() || []).map((v) => ({ value: v }));
+      case 'ext.loaded': return (getExt?.().loaded?.() || []).map((v) => ({ value: v }));
+      case 'ext.panels': return [...(getExt?.().panels?.() || []).map((p) => ({ value: p.name, desc: p.title })), { value: 'off', desc: 'collapse the panel region' }];
+      case 'ext.keys': return (getExt?.().keys?.(param) || []).map((d) => ({ value: d.key, desc: d.help }));
+      case 'inbox.sources': return [...new Set((getInbox?.().list?.() || []).map((i) => fromOf(i).toLowerCase()))].map((v) => ({ value: v }));
+      case 'inbox.mutes': return Object.keys(activeMutes(getInbox?.().mutes?.())).map((v) => ({ value: v }));
       case 'rows':
         return (getRows?.() || []).map((r) => ({ value: r.id, desc: r.source.type }));
       case 'orgs':
         return (await api.orgs()).map((o) => ({ value: o.slug || o.id, desc: o.name || '' }));
       case 'agents':
-        return (await api.agents()).map((a) => ({
+        return [...(await api.agents())].sort((x, y) => String(x.agent_id).localeCompare(String(y.agent_id))).map((a) => ({
           value: a.agent_id,
           desc: a.name && a.name !== a.agent_id ? a.name : '',
         }));