quoxcli 0.4.0 → 0.6.0

package/lib/quoxon/slash/args.js

@@ -41,7 +41,7 @@ const asItem = (x) =>
 /** Static choices of a level as items. */
 export const staticItems = (lv) => (lv?.choices || []).map(asItem);
 
-/** Prefix matches first, then substring; the exact sole match is dropped (nothing to add). */
+/** Prefix matches first, then substring, then display-name matches; the exact sole match is dropped (nothing to add). */
 export function rankArgs(items, partial) {
   const q = String(partial || '').toLowerCase();
   const seen = new Set();
@@ -51,7 +51,9 @@ export function rankArgs(items, partial) {
   const sub = uniq.filter(
     (i) => !i.value.toLowerCase().startsWith(q) && i.value.toLowerCase().includes(q),
   );
-  const out = [...pre, ...sub];
+  // A display name (desc) that matches also surfaces the item, after every id match: /attach vulcan finds forge.
+  const byDesc = uniq.filter((i) => !pre.includes(i) && !sub.includes(i) && String(i.desc || '').toLowerCase().includes(q));
+  const out = [...pre, ...sub, ...byDesc];
   return out.length === 1 && out[0].value.toLowerCase() === q ? [] : out;
 }
 

package/lib/quoxon/slash/broadcast.js

@@ -3,8 +3,8 @@
  * No I/O. v1 scope: all held slots or --slots, --priority urgent, --ack, /page. Scheduling, voice,
  * fleet and org reach, bulletins and drafting are not built.
  */
-export const BROADCAST_USAGE = 'Usage: /broadcast [--slots a,b] [--priority urgent] [--ack] <text>';
-export const PAGE_USAGE = 'Usage: /page <slot> <text>';
+export const BROADCAST_USAGE = 'Usage: /broadcast [--slots a,b] [--priority urgent] [--ack] [--active [--dry-run]] <text>';
+export const PAGE_USAGE = 'Usage: /page <slot>[,<slot>...] <text>  (several slots: a,b,c or a b c)';
 const NOT_YET = new Set(['--fleet', '--org', '--voice', '--at']);
 
 /**
@@ -13,13 +13,15 @@ const NOT_YET = new Set(['--fleet', '--org', '--voice', '--at']);
  */
 export function parseBroadcastArgs(arg) {
   const toks = String(arg || '').trim().split(/\s+/).filter(Boolean);
-  let slots = null; let priority = 'normal'; let ack = false;
+  let slots = null; let priority = 'normal'; let ack = false; let active = false; let dryRun = false;
   let i = 0;
   for (; i < toks.length && toks[i].startsWith('--'); i += 1) {
     const [flag, inline] = toks[i].split(/=(.*)/s);
     if (NOT_YET.has(flag)) return { ok: false, message: `${flag} is not available yet (v1 sends to held slots in this org: --slots, --priority, --ack).` };
     if (flag === '--all') { slots = null; continue; }
     if (flag === '--ack') { ack = true; continue; }
+    if (flag === '--active') { active = true; continue; }
+    if (flag === '--dry-run') { dryRun = true; continue; }
     const val = inline !== undefined ? inline : toks[++i];
     if (flag === '--slots') {
       const list = String(val || '').split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
@@ -34,14 +36,43 @@ export function parseBroadcastArgs(arg) {
   }
   const text = toks.slice(i).join(' ');
   if (!text) return { ok: false, message: BROADCAST_USAGE };
-  return { ok: true, text, slots, priority, ack };
+  return { ok: true, text, slots, priority, ack, ...(active ? { active: true } : {}), ...(dryRun ? { dryRun: true } : {}) };
 }
 
-/** `/page <slot> <text>` -> urgent, ack-required, one recipient. */
-export function parsePageArgs(arg) {
-  const m = /^(\S+)\s+([\s\S]*\S[\s\S]*)$/.exec(String(arg || '').trim());
-  if (!m || m[1].startsWith('--')) return { ok: false, message: PAGE_USAGE };
-  return { ok: true, text: m[2].trim(), slots: [m[1].toLowerCase()], priority: 'urgent', ack: true };
+/** QuoxGlyph announce line for a broadcast to active sessions: { reached, skipped, dryRun }. */
+export function activeLine({ reached = 0, skipped = 0, dryRun = false } = {}) {
+  return `\u{1F4CD} QUOXSLOTS \u2502 broadcast to active \u2502 ${reached} ${dryRun ? 'would reach' : 'reached'} \u00B7 ${skipped} skipped dormant \u2714`;
+}
+
+/**
+ * TUI-WAKE-MULTI (owner 2026-11-08): the leading slot names of a /page or /wake line, then the message.
+ * The first name is always a target. A name joined by a tight comma (seer,quoxon) is always a target, known or not,
+ * so an unknown one is reported per slot by the server. A name after a space, or after ", ", is a target only when
+ * it is in `known` (the org's slot names); the first word that is not starts the message, kept exactly as typed.
+ * With no `known` list only the tight comma list is targets. -> { slots: [lowercase, deduped], text } | null.
+ */
+export function splitTargets(arg, known = null) {
+  const set = known ? new Set([...known].map((x) => String(x).toLowerCase())) : null;
+  const slots = []; let rest = String(arg || '').trim(); let tight = true;
+  for (;;) {
+    const m = /^\s*([^\s,]+)/.exec(rest);
+    if (!m) break;
+    const name = m[1].toLowerCase();
+    if (!slots.length && name.startsWith('--')) return null;
+    if (!tight && !(set && set.has(name))) break;
+    slots.push(name); rest = rest.slice(m[0].length);
+    const c = /^\s*,(\s*)/.exec(rest);
+    tight = Boolean(c && !c[1]);
+    if (c) rest = rest.slice(c[0].length);
+  }
+  return slots.length ? { slots: [...new Set(slots)], text: rest.trim() } : null;
+}
+
+/** `/page <slot>[,<slot>...| <known slot>...] <text>` -> urgent, ack-required, every named recipient. */
+export function parsePageArgs(arg, known = null) {
+  const t = splitTargets(arg, known);
+  if (!t || !t.text) return { ok: false, message: PAGE_USAGE };
+  return { ok: true, text: t.text, slots: t.slots, priority: 'urgent', ack: true };
 }
 
 const plural = (n) => (n === 1 ? 'session' : 'sessions');
@@ -72,9 +103,10 @@ export function broadcastCard(r, { kind = 'broadcast' } = {}) {
   const c = r?.counts || {};
   const rc = roomC(r);
   const rows = [];
-  if (!c.total) rows.push([['\u26A0 no held slots in this org to hear it', 'warn']]);
+  if (!c.total) rows.push([[r?.skipped_dormant ? `\u26A0 no active sessions to hear it \u00B7 ${r.skipped_dormant.length} dormant skipped` : '\u26A0 no held slots in this org to hear it', 'warn']]);
   else if (c.delivered) {
-    rows.push([[`\u2714 ${c.delivered} ${c.delivered === 1 ? 'session has' : 'sessions have'} it`, 'ok']]);
+    const act = r?.skipped_dormant ? 'active ' : ''; // --active: say who was left alone
+    rows.push([[`\u2714 ${c.delivered} ${act}${c.delivered === 1 ? 'session has' : 'sessions have'} it${r?.skipped_dormant ? ` \u00B7 ${c.dormant_skipped ?? r.skipped_dormant.length} dormant skipped` : ''}`, 'ok']]);
     if (namesRow(r)) rows.push([[namesRow(r), 'prose']]); // an older server sends no per-slot list: no empty row
   }
   for (const d of badSlots(r).slice(0, 3)) rows.push([[`\u2716 ${failText(d)}`, 'error']]);
@@ -105,7 +137,12 @@ export function broadcastSummary(r) {
   const c = r?.counts || {};
   const rc = roomC(r);
   const lines = [];
+  if (!c.total && r.skipped_dormant) return [[`Broadcast ${r.id}: no active sessions to hear it \u00B7 ${r.skipped_dormant.length} dormant skipped${r.skipped_dormant.length ? ` (${r.skipped_dormant.join(', ')})` : ''}.`, 'warn']];
   if (!c.total) return [[`Broadcast ${r.id}: no held slots in this org to hear it.`, 'warn']];
+  if (r.skipped_dormant) { // --active: say who was left alone
+    const dn = r.skipped_dormant;
+    lines.push([`Broadcast ${r.id} ${titleWord(r)}: ${(c.delivered || 0) + (c.queued || 0)} active have it${okSlots(r).length ? ` (${okSlots(r).map((d) => d.slot).join(', ')})` : ''} \u00B7 ${dn.length} dormant skipped${dn.length ? ` (${dn.join(', ')})` : ''}`, c.failed ? 'warn' : 'plain']);
+  } else
   lines.push([`Broadcast ${r.id} ${titleWord(r)}: ${(c.delivered || 0) + (c.queued || 0)} of ${c.total} ${plural(c.total)} have it${okSlots(r).length ? ` (${okSlots(r).map((d) => d.slot).join(', ')})` : ''}`, c.failed ? 'warn' : 'plain']);
   if (c.delivered && roomText(rc, ', ')) lines.push([`  chat rooms: ${roomText(rc, ', ')}`, rc.failed ? 'warn' : 'plain']);
   for (const d of badSlots(r)) lines.push([`  ${failText(d)}`, 'warn']);

package/lib/quoxon/slash/broadcastRun.js

@@ -3,7 +3,7 @@
  * One server call fans out (POST /api/v1/slots/broadcast); with --ack the sender then sees the delivery line
  * update as recipients acknowledge. The poll is display only: the broadcast and its acks live on the server.
  */
-import { parseBroadcastArgs, parsePageArgs, parseAckArgs, parseStatusArgs, broadcastSummary, broadcastCard, BROADCAST_USAGE } from './broadcast.js';
+import { parseBroadcastArgs, parsePageArgs, splitTargets, parseAckArgs, parseStatusArgs, broadcastSummary, broadcastCard, BROADCAST_USAGE, activeLine } from './broadcast.js';
 
 const roomC = (r) => ({ sent: 0, sending: 0, failed: 0, ...(r?.counts?.room || {}) });
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -20,11 +20,22 @@ export async function runBroadcast({ api, kind, arg, from, say, card = null, isC
     const st = api.slotBroadcastStatus ? await api.slotBroadcastStatus(st0.id) : { ok: false, message: 'not available in this mode' };
     return st.ok ? show(st.data) : say(`Broadcast status failed: ${st.message}`, 'warn');
   }
-  const parsed = kind === 'page' ? parsePageArgs(arg) : parseBroadcastArgs(arg);
+  const parsed = kind === 'page' ? parsePageArgs(arg, await slotNames(api)) : parseBroadcastArgs(arg);
   if (!parsed.ok) return say(parsed.message, parsed.message === BROADCAST_USAGE ? 'plain' : 'warn');
-  const r = await api.slotBroadcast({ text: parsed.text, slots: parsed.slots, priority: parsed.priority, ack: parsed.ack, from });
+  const r = await api.slotBroadcast({ text: parsed.text, slots: parsed.slots, priority: parsed.priority, ack: parsed.ack, active: parsed.active, ...(parsed.dryRun ? { dryRun: true } : {}), from });
   if (!r.ok) return say(`${kind === 'page' ? 'Page' : 'Broadcast'} failed: ${r.message}`, 'warn');
+  if (r.data?.dry_run) { // BROADCAST-ACTIVE --dry-run: who would hear it, who is dormant; nothing sent, no card
+    const would = r.data.would_reach || []; const dorm = r.data.skipped_dormant || [];
+    say(activeLine({ reached: would.length, skipped: dorm.length, dryRun: true }), 'ok');
+    if (would.length) say(`  would reach: ${would.join(', ')}`, 'plain');
+    if (dorm.length) say(`  skipped dormant: ${dorm.join(', ')}`, 'plain');
+    return say('Dry run: nothing was sent.', 'plain');
+  }
   show(r.data);
+  if (parsed.active && r.data?.skipped_dormant) {
+    say(activeLine({ reached: r.data.counts?.delivered || 0, skipped: r.data.skipped_dormant.length }), 'ok');
+    if (r.data.skipped_dormant.length) say(`  skipped dormant: ${r.data.skipped_dormant.join(', ')}`, 'plain');
+  }
   // PRESENCE: it reached a human slot whose human is away; approvals to them will queue.
   if (r.data?.human_presence?.away && r.data.human_presence.notice) say(`⏸ ${r.data.human_presence.notice}`, 'warn');
   // POKE-WAKE: a page also asks each delivered slot's keeper to wake its idle session, so the page is read now,
@@ -61,13 +72,19 @@ export async function runBroadcast({ api, kind, arg, from, say, card = null, isC
 }
 
 /**
- * FORCE-WAKE: `/poke|/wake|/slap|/nudge <slot> [text]`. `--force` is accepted anywhere as a no-op (every human
+ * FORCE-WAKE: `/poke|/wake|/slap|/nudge <slot>[,<slot>...] [text]` (several slots: see splitTargets). `--force` is accepted anywhere as a no-op (every human
  * wake already sets an unsent draft aside and puts it back) and is never page text. null = no slot given.
  */
-export function parsePokeArgs(restArg) {
+export function parsePokeArgs(restArg, known = null) {
   const s = String(restArg || '').replace(/(^|\s)--force(?=\s|$)/g, '$1').trim();
-  const m = /^(\S+)(?:\s+([\s\S]+))?$/.exec(s);
-  return m ? { slot: m[1], text: m[2] ? m[2].trim() : null } : null;
+  const t = splitTargets(s, known); // TUI-WAKE-MULTI: `slot` is the comma-joined target list, /page splits it again
+  return t ? { slot: t.slots.join(','), text: t.text || null } : null;
+}
+
+/** The org's slot names for splitTargets, or null when they cannot be read (then only a comma list is targets). */
+export async function slotNames(api) {
+  if (!api?.slots) return null;
+  try { const rows = await api.slots(); return Array.isArray(rows) ? rows.map((r) => r?.name).filter(Boolean) : null; } catch { return null; }
 }
 
 /**

package/lib/quoxon/slash/cliLeaves.json

@@ -25,6 +25,7 @@
 "admin retention stats":"read",
 "admin service list":"read",
 "admin stats":"read",
+"admin users verify-email":"write",
 "aee conversations":"read",
 "aee get":"read",
 "aee query":"read",
@@ -34,6 +35,7 @@
 "agent attach":"never",
 "agent attach-heartbeat":"never",
 "agent attach-status":"read",
+"agent attaches":"write",
 "agent bind-slot":"write",
 "agent create":"write",
 "agent deactivate":"write",
@@ -53,11 +55,16 @@
 "agent tool revoke":"write",
 "agent unbind-slot":"write",
 "agent update":"write",
+"approvals approve":"write",
+"approvals call-me":"write",
+"approvals deny":"write",
 "approvals grants create":"write",
 "approvals grants list":"read",
 "approvals grants revoke":"write",
+"approvals list":"read",
 "approvals result":"read",
 "approvals walkthrough":"never",
+"approvals withdraw":"write",
 "aside":"never",
 "ask loosening":"write",
 "ask status":"read",
@@ -147,12 +154,16 @@
 "chat-status":"read",
 "claude":"never",
 "completion":"never",
+"compliance jobs list":"read",
+"compliance reports list":"read",
+"compliance reports show":"read",
 "config get":"read",
 "config profile add":"write",
 "config profile list":"read",
 "config profile remove":"write",
 "config profile use":"write",
 "config set":"write",
+"connect":"write",
 "consent grant":"never",
 "consent history":"read",
 "consent list":"read",
@@ -374,6 +385,7 @@
 "inbox list":"read",
 "inbox respond":"write",
 "inbox stats":"read",
+"inbox unread":"write",
 "inbox walkthrough":"never",
 "instagram accounts":"read",
 "instagram comments":"read",
@@ -409,6 +421,7 @@
 "kuma monitors pause":"write",
 "kuma monitors remove":"write",
 "kuma monitors resume":"write",
+"kuma monitors wire-alerts":"write",
 "kuma refresh":"write",
 "kuma sla list":"read",
 "kuma sla verify":"read",
@@ -428,6 +441,7 @@
 "linkedin org":"write",
 "linkedin post":"write",
 "linkedin posts":"read",
+"linkedin whoami":"read",
 "llm status":"read",
 "llm-policy get":"read",
 "llm-policy set":"write",
@@ -444,12 +458,25 @@
 "lucid area":"read",
 "lucid ask":"read",
 "lucid blind":"write",
+"lucid brief":"read",
 "lucid deck":"never",
 "lucid do":"write",
 "lucid feeds":"read",
 "lucid forget":"write",
+"lucid goals add":"write",
+"lucid goals archive":"write",
+"lucid goals change":"write",
+"lucid goals confirm":"write",
+"lucid goals erase":"never",
+"lucid goals export":"write",
+"lucid goals history":"read",
+"lucid goals link":"write",
+"lucid goals restore":"never",
+"lucid goals show":"read",
 "lucid herald set":"write",
 "lucid herald test":"write",
+"lucid insights show":"read",
+"lucid insights status":"read",
 "lucid journal":"read",
 "lucid lessons":"read",
 "lucid replay":"read",
@@ -460,10 +487,14 @@
 "lucid teach":"write",
 "lucid told":"read",
 "lucid why":"read",
+"mail account pin":"write",
 "mail accounts":"read",
+"mail block":"write",
+"mail blocked":"read",
 "mail connect":"never",
 "mail disconnect":"write",
 "mail import":"never",
+"mail junk":"write",
 "mail list":"read",
 "mail moves":"read",
 "mail proposals":"read",
@@ -471,11 +502,19 @@
 "mail report":"write",
 "mail resolve":"write",
 "mail sync":"write",
+"mail sync-status":"write",
+"mail trust":"write",
+"mail unblock":"write",
 "mail undo":"write",
 "mail watch active":"write",
 "mail watch add":"write",
 "mail watch list":"read",
+"mail watch rm":"write",
 "mail zones":"read",
+"mcp bundle":"never",
+"mcp token create":"never",
+"mcp token list":"read",
+"mcp token revoke":"write",
 "memory core":"read",
 "memory create":"write",
 "memory delete":"write",
@@ -488,6 +527,7 @@
 "memory reinstate":"write",
 "memory search":"read",
 "memory stats":"read",
+"memory sync":"never",
 "memory timeline":"read",
 "memory unpin":"write",
 "memory update":"write",
@@ -515,16 +555,23 @@
 "mon docker stats":"read",
 "mon metrics":"read",
 "mon wazuh active-response":"write",
-"mon wazuh agents":"read",
+"mon wazuh agents get":"read",
 "mon wazuh alerts":"read",
+"mon wazuh coverage":"read",
 "mon wazuh deploy-agent":"write",
 "mon wazuh deploy-bulk":"write",
 "mon wazuh deploy-history":"read",
+"mon wazuh fim":"read",
+"mon wazuh rootcheck":"read",
+"mon wazuh sca":"read",
 "mon wazuh status":"read",
+"mon wazuh triage":"read",
 "mon wazuh vulns":"read",
 "monitoring health":"read",
+"monitoring incidents claim":"write",
 "monitoring incidents get":"read",
 "monitoring incidents list":"read",
+"monitoring incidents status":"write",
 "motion":"write",
 "notes actions":"write",
 "notes append":"write",
@@ -555,6 +602,14 @@
 "notes schedule resume":"write",
 "notes schedule rm":"write",
 "notes scorecard":"write",
+"notes seal convert":"never",
+"notes seal edit":"never",
+"notes seal init":"write",
+"notes seal new":"write",
+"notes seal open":"never",
+"notes seal print":"write",
+"notes seal purge":"never",
+"notes seal status":"read",
 "notes search":"read",
 "notes settings list":"read",
 "notes settings set":"write",
@@ -577,6 +632,7 @@
 "objective list":"read",
 "objective retry":"write",
 "objective start":"write",
+"offload leases":"read",
 "offload release":"write",
 "offload status":"read",
 "onboard":"write",
@@ -598,15 +654,22 @@
 "org update":"write",
 "peek":"read",
 "plan add":"write",
+"plan brief":"read",
 "plan completed":"read",
 "plan focus":"read",
+"plan followup add":"write",
+"plan followup done":"write",
+"plan followup status":"write",
+"plan followups":"read",
 "plan list":"read",
 "plan move":"write",
 "plan note":"write",
 "plan phase":"write",
 "plan plan":"write",
 "plan rename":"write",
+"plan roadmap archive":"write",
 "plan roadmap create":"write",
+"plan roadmap unarchive":"write",
 "plan roadmaps":"read",
 "plan search":"read",
 "plan show":"read",
@@ -614,6 +677,7 @@
 "plan status":"write",
 "plan timeline":"read",
 "plan update":"write",
+"plan watch":"never",
 "plugin assign add":"write",
 "plugin assign list":"read",
 "plugin assign remove":"write",
@@ -772,6 +836,7 @@
 "server diag":"write",
 "server doctor":"read",
 "server go":"never",
+"server install":"never",
 "server list":"read",
 "server mark":"write",
 "server roles list":"read",
@@ -881,8 +946,10 @@
 "tool exec":"write",
 "tool get":"read",
 "tool install":"write",
+"tool installed":"read",
 "tool list":"read",
 "tool publish":"write",
+"tool uninstall":"write",
 "tool update":"write",
 "trace compare":"read",
 "trace comparison create":"write",
@@ -982,6 +1049,35 @@
 "volt verify":"read",
 "watch fleet":"read",
 "watch services":"read",
+"wazuh active-response":"write",
+"wazuh agents get":"read",
+"wazuh alerts":"read",
+"wazuh connect":"never",
+"wazuh coverage":"read",
+"wazuh deploy":"write",
+"wazuh deploy-bulk":"write",
+"wazuh deploy-history":"read",
+"wazuh fim":"read",
+"wazuh hooks create":"never",
+"wazuh hooks delete":"write",
+"wazuh hooks install":"never",
+"wazuh hooks list":"read",
+"wazuh hooks rotate":"never",
+"wazuh incidents close":"write",
+"wazuh incidents diagnose":"write",
+"wazuh incidents escalate":"write",
+"wazuh incidents show":"read",
+"wazuh indexer install-credential":"write",
+"wazuh remove":"write",
+"wazuh report generate":"write",
+"wazuh report list":"read",
+"wazuh report show":"read",
+"wazuh report verify":"read",
+"wazuh rootcheck":"read",
+"wazuh sca":"read",
+"wazuh status":"read",
+"wazuh triage":"read",
+"wazuh vulns":"read",
 "webhook create":"write",
 "webhook delete":"write",
 "webhook list":"read",
@@ -1015,6 +1111,7 @@
 "x status":"read",
 "x thread":"write",
 "x timeline":"write",
+"x whoami":"write",
 "youtube analytics":"write",
 "youtube channel":"write",
 "youtube comment":"write",

package/lib/quoxon/slash/dashboard.js

@@ -10,6 +10,7 @@
  * on the dashboard home instead; nothing breaks.
  */
 import { spawn as nodeSpawn } from 'node:child_process';
+import { isWebPty } from '../webPty.js';
 
 /** Page name -> real route in src/config/routeRegistry.js (approvals = the HITL /inbox, inbox = InboxQ mail). */
 export const PAGES = {
@@ -40,6 +41,7 @@ export function openerFor(platform = process.platform) {
 
 /** -> { opened: true } | { opened: false, reason: 'ssh' | 'no-opener' | 'failed' }. Never throws, never uses a shell. */
 export function openInBrowser(url, { env = process.env, platform = process.platform, spawn = nodeSpawn } = {}) {
+  if (isWebPty(env)) return Promise.resolve({ opened: false, reason: 'no-opener' }); // QUOXON web PTY: the link is printed, nothing starts on the server
   if (isRemoteSession(env)) return Promise.resolve({ opened: false, reason: 'ssh' });
   const op = openerFor(platform);
   if (!op) return Promise.resolve({ opened: false, reason: 'no-opener' });

package/lib/quoxon/slash/hatWalk.js

@@ -122,7 +122,7 @@ export function createHatWalk({ api, say, bump = () => {} }) {
     if (!m.hat) { say(`No hat matches "${arg}". Your own hats: ${hatChoices(mine) || 'none yet'}.`, 'warn'); return null; }
     if (!isCustom(m.hat)) {
       say(verb === 'edit'
-        ? `${nameOf(m.hat)} is a built-in hat, so it is not edited here. It can be reset, or used as a starting point with /hat new.`
+        ? `${nameOf(m.hat)} is a built-in hat, so it is not edited here. Reset it, or start from it with /hat new.`
         : `${nameOf(m.hat)} is a built-in hat and cannot be deleted. It can be reset, or used as a starting point with /hat new.`, 'warn');
       return null;
     }

package/lib/quoxon/slash/listView.js

@@ -9,7 +9,7 @@ import { c, clip } from '../theme.js';
 
 const h = React.createElement;
 
-export function ListView({ title = null, rows = [], sel = 0, cols = 80, hint = null, empty = null, more = 0 }) {
+export function ListView({ title = null, rows = [], sel = 0, cols = 80, hint = null, empty = null, more = 0, notes = [] }) {
   // The key column grows with the window (22 cells minimum, 32 at most) and always leaves a one-cell gap, so a name that fits is shown whole;
   // one that does not gets the ellipsis from truncate-end, never a silent cut.
   const keyW = Math.min(Math.max(22, Math.min(32, Math.floor(cols / 3))), Math.max(8, ...rows.map(r => [...String(r.key || '')].length)) + 1);
@@ -26,5 +26,6 @@ export function ListView({ title = null, rows = [], sel = 0, cols = 80, hint = n
         h(Text, { color: c(r.dim ? 'muted' : 'text'), wrap: 'truncate-end' }, clip(String(body || ''), textW)));
     }),
     more > 0 ? h(Text, { color: c('muted') }, `  … ${more} more, keep typing to narrow`) : null,
+    ...(notes || []).map((n, i) => h(Text, { key: `note:${i}`, color: c('muted'), wrap: 'truncate-end' }, `  ${clip(n, cols - 4)}`)), // never selectable: no marker, not in rows
     hint ? h(Text, { color: c('dim') }, `  ${clip(hint, cols - 4)}`) : null);
 }

package/lib/quoxon/slash/palette.js

@@ -16,6 +16,10 @@ export function paletteQuery(draft) {
   return t.slice(1).toLowerCase();
 }
 
+const TRANSIENT = /not running|not reachable|unreachable|could not reach|cannot reach|connection (refused|reset)|timed? ?out|econn|enotfound|fetch failed|service unavailable|\b50[234]\b/i;
+/** Does this capability reason read as a failed dynamic check rather than a standing fact about the command? */
+export const transientReason = (r) => TRANSIENT.test(String(r || ''));
+
 /**
  * Why a command cannot run in this session, or null. `api` is the session's server wrapper (a method
  * missing means this mode has no route for it); `caps` is GET /api/v1/capabilities when the server has
@@ -23,7 +27,10 @@ export function paletteQuery(draft) {
  */
 export function unavailableReason(entry, { api = {}, caps = null, blocked = null } = {}) {
   const cap = caps ? caps[entry.cap || entry.id] : null;
-  if (cap && cap.available === false) return cap.reason || 'not available on this server';
+  // A reason that is really a failed probe ("Auth service not running or not reachable...") is an error string, not a
+  // property of the command: it never becomes the palette note. The row keeps its static description; running the
+  // command reports the real failure.
+  if (cap && cap.available === false && !transientReason(cap.reason)) return cap.reason || 'not available on this server';
   for (const m of entry.needs || []) if (typeof api[m] !== 'function') return 'not available in this mode';
   if (blocked && entry.server) return '(sign in)';
   return null;
@@ -102,6 +109,61 @@ export function filterPalette(items, query) {
   return scored.sort((a, b) => a.best - b.best || a.idx - b.idx).map(x => x.it);
 }
 
+/**
+ * A match too loose to pre-highlight: not a prefix of the name or an alias, and not a description word that starts
+ * with a 2+ letter query. "/y" -> /hyperion (a letter inside the name) is weak; "/one" -> /approvals ("one at a time")
+ * is not. A weak top row is shown without the marker until the user moves the selection.
+ */
+const isSubsequence = (q, s) => { let i = 0; for (const ch of s) if (ch === q[i]) i++; return i === q.length; };
+
+export function weakMatch(query, it) {
+  const q = String(query ?? '').toLowerCase();
+  if (!q || !it) return false;
+  if ([it.id, ...(it.aliases || []).map(a => a.slice(1))].some(n => String(n).toLowerCase().startsWith(q))) return false;
+  // A 3+ letter abbreviation of the name ("/aprvl" -> /approvals) is deliberate, not a stray letter inside it.
+  if (q.length >= 3 && isSubsequence(q, String(it.id).toLowerCase())) return false;
+  const long = String(it.longDesc || it.desc || '').toLowerCase();
+  return !(q.length >= 2 && new RegExp('(^|[^a-z0-9])' + q.replace(/[^a-z0-9]/g, '\\$&')).test(long));
+}
+
+/** Bulk or destructive commands: never offered (so never pre-highlighted) by a loose query (owner 2026-10-26: Enter on "/" approved everything). */
+export const GUARDED_IDS = new Set(['yestoall', 'approve', 'deny']);
+
+/**
+ * Drops GUARDED_IDS rows unless the query is an exact name, or a 3+ letter prefix of the name that no unguarded command
+ * shares. So they are reachable only by typing enough of the name to make them the unique match.
+ */
+export function guardBulk(list, query) {
+  const q = String(query ?? '').toLowerCase();
+  const names = (it) => [it.id, ...it.aliases.map(a => a.slice(1))].map(n => n.toLowerCase());
+  const shared = list.some(o => !GUARDED_IDS.has(o.id) && names(o).some(n => q && n.startsWith(q)));
+  return list.filter(it => !GUARDED_IDS.has(it.id) || names(it).includes(q) || (q.length >= 3 && !shared && names(it).some(n => n.startsWith(q))));
+}
+
+/**
+ * The guarded commands a loose query hid, so the palette can say why they are missing instead of leaving a weak
+ * fuzzy hit on top (owner 2026-11-05: "/y" showed /hyperion). Only names that START with the query count, and only
+ * for a non-empty query (a bare "/" stays quiet). `reach` is the shortest input that makes it the unique match.
+ * These are notes, never rows: the guard still decides what can be selected.
+ */
+export function guardedHints(items, query) {
+  const q = String(query ?? '').toLowerCase();
+  if (!q) return [];
+  const shown = (p) => guardBulk(filterPalette(items, p), p).map(i => i.id);
+  const now = shown(q);
+  const out = [];
+  for (const it of items) {
+    if (!GUARDED_IDS.has(it.id) || it.planned || now.includes(it.id) || !it.id.startsWith(q)) continue;
+    let reach = it.name;
+    for (let n = Math.max(3, q.length + 1); n < it.id.length; n++) {
+      const p = it.id.slice(0, n);
+      if (shown(p).includes(it.id)) { reach = '/' + p; break; }
+    }
+    out.push({ name: it.name, reach });
+  }
+  return out;
+}
+
 /** What Tab puts in the draft: the name, plus a space when the command takes arguments. */
 export function completion(item) {
   const takesArgs = /^\S+\s+\S/.test(String(item.usage).trim());

package/lib/quoxon/slash/paletteController.js

@@ -5,7 +5,7 @@
  */
 import { findEntry } from '../commands.js';
 import { signedOutNotice } from '../sessionDead.js';
-import { paletteQuery, paletteItems, filterPalette, completion, paletteView, PALETTE_MAX } from './palette.js';
+import { paletteQuery, paletteItems, filterPalette, guardBulk, guardedHints, weakMatch, completion, paletteView, PALETTE_MAX } from './palette.js';
 import { argContext, levelFor, staticItems, rankArgs, applyArg } from './args.js';
 import { mentionContext, rankMentions, applyMention } from '../mentions.js';
 
@@ -21,7 +21,7 @@ export function createPalette({
   getDraft, setDraft, run, say, ctx = () => ({}), source = null, refresh = () => {}, now = Date.now,
   mentions = null // MENTIONS: { cache (mentions.js createMentionCache), local: () => receipt items }
 }) {
-  const st = { sel: 0, q: null, dismissed: null, picked: false, aq: null, mq: null };
+  const st = { hold: null, sel: 0, q: null, dismissed: null, picked: false, aq: null, mq: null };
   const cache = new Map(); // 'src:param' -> { at, ttl, items, pending }
   /** Cached items for an async source; fetches when missing or stale. Never throws or blocks. */
   const fetchItems = (src, param) => {
@@ -77,10 +77,16 @@ export function createPalette({
   const rows = () => {
     const q = paletteQuery(getDraft());
     if (q !== st.q) { st.q = q; st.sel = 0; st.picked = false; }
-    return q === null ? [] : filterPalette(paletteItems(ctx()), q);
+    return q === null ? [] : guardBulk(filterPalette(paletteItems(ctx()), q), q);
   };
+  /** The top row is only a weak match (weakMatch) and the user has not moved the selection: it is not highlighted. */
+  const weakTop = (list) => !st.picked && list.length > 0 && weakMatch(st.q, list[0]);
   const isOpen = () => {
     const d = getDraft();
+    if (st.hold !== null) { // a command was just submitted: closed until the draft is genuinely edited (owner 2026-10-27: a stale palette ran /sleep)
+      if (d === st.hold || d === '') return false;
+      st.hold = null;
+    }
     if (st.dismissed !== null && st.dismissed !== d) st.dismissed = null;
     if (paletteQuery(d) === null) return argOpen() !== null || mentionOpen() !== null;
     return st.dismissed !== d;
@@ -158,12 +164,16 @@ export function createPalette({
     }
     const list = rows();
     const v = paletteView(list, st.sel, PALETTE_MAX);
+    const q = paletteQuery(getDraft());
+    const notes = guardedHints(paletteItems(ctx()), q).map(g => `${g.name} is held back so a stray Enter cannot run it: type ${g.reach} to reach it`);
     return {
       rows: v.rows.map(it => ({ key: it.name, text: (it.aliases.length ? `(also ${it.aliases.join(', ')}) ` : '') + it.desc, dim: Boolean(it.disabled), note: it.disabled || null })),
-      sel: v.sel, more: v.more,
+      sel: weakTop(list) ? -1 : v.sel, more: v.more, notes,
       empty: 'No command matches. Enter sends it anyway; /help lists everything.',
       hint: '↑↓ select · Tab complete · Enter run · Esc close'
     };
   }
-  return { isOpen, onKey, view, state: st };
+  /** The app calls this when Enter submits a command line: the palette closes and that Enter activates nothing. */
+  const submitted = (draft = getDraft()) => { st.hold = String(draft ?? ''); st.sel = 0; st.picked = false; };
+  return { isOpen, onKey, view, submitted, state: st };
 }