quoxcli 0.4.0 → 0.6.0

package/lib/commands/capabilities.js

@@ -8,18 +8,19 @@
  */
 
 import { resolveEndpoint } from '../api/endpoints.js';
-import { capabilityLines, findCapability, offerFor } from '../quoxon/capabilities.js';
+import { capabilityLines, findCapability, offerFor, needsSetupNames } from '../quoxon/capabilities.js';
 
 export function registerCapabilitiesCommands(program, ctx) {
   const { client, auth } = ctx;
   program
     .command('capabilities [name]')
     .description('What this Quox can do for your org: ready, needs setup, not available, planned')
+    .addHelpText('after', '\nAdd --json for the full list (id, name, availability, reason, setup, permissions_ok).')
     .action(async (name) => {
       auth.requireAuth();
       const ep = resolveEndpoint('v1.capabilities');
       const data = await client.get(ep.path, { service: ep.service });
-      if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      if (program.opts().output === 'json') { console.log(JSON.stringify({ needs_setup: needsSetupNames(data?.capabilities), ...data }, null, 2)); return; }
       const res = { ok: Array.isArray(data?.capabilities), capabilities: data?.capabilities, error: 'unexpected response' };
       if (name) {
         const c = findCapability(name, res);

package/lib/commands/chat.js

@@ -4,6 +4,7 @@
 
 import chalk from 'chalk';
 import { formatDetail } from '../core/output.js';
+import { eventLine, announceMuted } from '../core/announce.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { existsSync } from 'node:fs';
 import { lastConversation, saveLastConversation } from './chatState.js';
@@ -70,6 +71,14 @@ function printTrace(ev) {
   if (f) process.stderr.write((TONE_PAINT[f.tone] || chalk.cyan)(f.text) + '\n');
 }
 
+/** A turn's quox_event frame as its QuoxGlyph line on stderr (stdout stays the answer); silent under --json/--quiet. */
+export function printQuoxEvent(ev) {
+  if (announceMuted()) return null;
+  const q = eventLine(ev);
+  if (q) process.stderr.write(`${q}\n`);
+  return q;
+}
+
 function generateQueryId() {
   return `CLI_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
 }
@@ -81,6 +90,7 @@ function generateQueryId() {
 export async function consumeStream(client, { message, agent, sessionId, context }, { onAgentLabel, trace = false, companionPath, companionDisplay } = {}) {
   const queryId = generateQueryId();
   const body = buildStreamQuery({ queryId, message, agent, sessionId, context });
+  body.turn_id = queryId; // an explicit turn id selects the v1 event stream: tool and quox_event frames only flow with it
 
   let text = '';
   let resultSessionId = sessionId;
@@ -145,6 +155,10 @@ export async function consumeStream(client, { message, agent, sessionId, context
         write('\n');
         break;
 
+      case 'quox_event':
+        printQuoxEvent(event);
+        break;
+
       case 'error':
         throw new Error(event.error || 'Stream error');
 
@@ -361,6 +375,7 @@ export function registerChatCommands(program, ctx) {
         });
         spinner.stop();
         noteConversation(convId);
+        for (const qe of Array.isArray(data.quox_events) ? data.quox_events : []) printQuoxEvent(qe); // the server's per-turn Quox effects, when it returns them
 
         if (program.opts().output === 'json') {
           console.log(JSON.stringify({ ...data, conversation_id: convId || null }, null, 2));

package/lib/commands/claude.js

@@ -29,6 +29,7 @@ export {
  */
 export function parseClaudeArgs(raw) {
   let noTmux = false;
+  let force = false;
   let as;
   let slot;
   const args = [];
@@ -38,6 +39,7 @@ export function parseClaudeArgs(raw) {
     if (past) { args.push(a); continue; }
     if (a === '--') { past = true; args.push(a); continue; }
     if (a === '--no-tmux') noTmux = true;
+    else if (a === '--force') force = true;
     else if ((a === '--as' || a === '--slot') && raw[i + 1] && !raw[i + 1].startsWith('-')) {
       if (a === '--as') as = raw[i + 1]; else slot = raw[i + 1];
       i++;
@@ -72,7 +74,7 @@ export function parseClaudeArgs(raw) {
     }
   }
   if (name !== undefined && !validateName(name)) name = undefined;
-  return { args, name, resume, noTmux, as, slot };
+  return { args, name, resume, noTmux, ...(force ? { force } : {}), as, slot };
 }
 
 /**
@@ -151,6 +153,7 @@ quox's own flags (consumed here, not passed to claude):
   --as <agent>    start already attached to a Quox agent
   --slot <name>   start already holding a dev slot
   --no-tmux       run claude directly, without tmux
+  --force         with --resume: start a second copy even if that conversation is already running
   -n, --name <n>  name the session (also names the tmux session; claude's own flag)
   --resume <n>    resume the named session (claude's own flag)
   -h, --help      show this help

package/lib/commands/compliance.js

@@ -0,0 +1,109 @@
+/**
+ * Compliance commands: scheduled compliance report jobs.
+ *
+ * `compliance jobs list` calls GET /compliance/jobs (services/collector/server.js),
+ * the same route the compliance_list_jobs agent tool uses. Jobs can carry an
+ * optional name (set via the compliance_schedule_job tool / POST body `name`).
+ *
+ * `compliance reports list|show` read GET /compliance/reports and /compliance/reports/:id, the
+ * routes compliance_get_reports reads (org-scoped by the caller's session). The ORG column is
+ * always shown: a row with no org (org_id null) is printed as `none`, never hidden.
+ */
+
+import { formatOutput, formatDetail } from '../core/output.js';
+import { resolveOrgId } from './helpers.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+export function registerComplianceCommands(program, ctx) {
+  const { client, auth } = ctx;
+
+  const compliance = program
+    .command('compliance')
+    .description('Compliance: generated reports and scheduled report jobs');
+
+  const jobs = compliance
+    .command('jobs')
+    .description('Scheduled compliance report jobs');
+
+  jobs
+    .command('list')
+    .description('List scheduled compliance report jobs (with NAME)')
+    .option('--status <status>', 'filter by status (active|paused|error)')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('compliance.jobs.list');
+      const data = await client.get(ep.path, { service: ep.service, query: { org_id: orgId } });
+      let rows = data.jobs || [];
+      if (options.status) rows = rows.filter((j) => j.status === options.status);
+      formatOutput({
+        columns: ['id', 'name', 'format', 'schedule_interval', 'status', 'next_run'],
+        headers: ['ID', 'NAME', 'Format', 'Interval', 'Status', 'Next run'],
+        rows: rows.map((j) => ({ ...j, name: j.name || '-' })),
+      }, { format: program.opts().output, emptyMessage: 'No compliance jobs found.', raw: rows });
+    });
+
+  const reports = compliance
+    .command('reports')
+    .description('Generated compliance reports (read only)');
+
+  const scoreOf = (r) => (r.summary && typeof r.summary === 'object' && r.summary.overallScore != null ? r.summary.overallScore : '-');
+
+  reports
+    .command('list')
+    .description('List generated compliance reports: framework, period, score, sampled evidence, ORG')
+    .option('--format <format>', 'only this framework (soc2, hipaa, gdpr, iso27001, euAiAct, iso42001, nistAiRmf)')
+    .option('--limit <n>', 'max rows', '20')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('compliance.reports.list');
+      const query = { org_id: orgId, limit: String(options.limit || 20) };
+      if (options.format) query.format = options.format;
+      const data = await client.get(ep.path, { service: ep.service, query });
+      let rows = data.reports || [];
+      // the route does not filter by format, so the flag is applied here too
+      if (options.format) rows = rows.filter((r) => r.format === options.format);
+      formatOutput({
+        columns: ['id', 'format', 'generated_at', 'period_days', 'score', 'status', 'sample', 'org'],
+        headers: ['ID', 'Format', 'Generated', 'Days', 'Score', 'Status', 'Evidence sample', 'ORG'],
+        rows: rows.map((r) => ({
+          ...r,
+          period_days: r.period_days ?? '-',
+          score: scoreOf(r),
+          status: (r.summary && r.summary.overallStatus) || '-',
+          sample: (r.summary && Array.isArray(r.summary.evidenceSample) && r.summary.evidenceSample.length) ? r.summary.evidenceSample.join(' ') : '-',
+          org: r.org_id || 'none',
+        })),
+      }, { format: program.opts().output, emptyMessage: 'No compliance reports found.', raw: rows });
+    });
+
+  reports
+    .command('show <id>')
+    .description('Show one generated report: framework, period, score, per-control status, sampled evidence')
+    .action(async (id) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('compliance.reports.get', { id });
+      const data = await client.get(ep.path, { service: ep.service, query: { org_id: orgId } });
+      const r = data.report || data;
+      const fmt = program.opts().output;
+      if (fmt && fmt !== 'table') { formatDetail(r, { format: fmt }); return; }
+      const s = (r.summary && typeof r.summary === 'object') ? r.summary : {};
+      const body = (r.report_data && typeof r.report_data === 'object') ? r.report_data : {};
+      const lines = [
+        `Report     ${r.id}`,
+        `Framework  ${s.framework || body.framework || r.format}`,
+        `Org        ${r.org_id || 'none'}`,
+        `Period     ${r.period_start || '-'} .. ${r.period_end || '-'} (${r.period_days ?? '-'} days)`,
+        `Score      ${s.overallScore ?? body.overallScore ?? '-'}  status ${s.overallStatus || body.overallStatus || '-'}`,
+        `Evidence   ${Array.isArray(s.evidenceSample) && s.evidenceSample.length ? s.evidenceSample.join(' ') : '-'}`,
+      ];
+      const sections = body.sections && typeof body.sections === 'object' ? body.sections : {};
+      for (const [key, sec] of Object.entries(sections)) {
+        lines.push('', `${key}  ${sec && sec.name ? sec.name : ''}`.trimEnd());
+        for (const c of (sec && Array.isArray(sec.controls) ? sec.controls : [])) lines.push(`  ${String(c.id || '-').padEnd(10)} ${String(c.status || '-').padEnd(16)} ${c.name || ''}`);
+      }
+      for (const l of lines) console.log(l);
+    });
+}

package/lib/commands/connect.js

@@ -0,0 +1,69 @@
+/**
+ * quox connect <url>: point a profile at a QuoxCORE server on another machine and sign in (ONBOARD-P1).
+ *
+ * Probes <url>/health, and when the server answers with its own certificate shows its SHA256 fingerprint and,
+ * after a yes (--trust-cert, or the y/N), stores that certificate for THAT PROFILE ONLY. It is never the global
+ * NODE_EXTRA_CA_CERTS and TLS checks are never turned off. Then hands to `quox -p <profile> login`.
+ * One implementation with the TUI's /connect server (lib/quoxon/onboarding/connectServer.js).
+ */
+import { announce, announceOnFail } from '../core/announce.js';
+import { QuoxUserError } from '../core/errors.js';
+import { confirmInteractive } from '../core/confirm.js';
+import { profileNameForUrl } from '../core/profileTrust.js';
+import { loadConfig } from '../core/config.js';
+
+/** H1: no terminal and no pin: the safer non-interactive choice is the fingerprint pin, --trust-cert the alternative. */
+export const noTerminalTrustMessage = () => 'No terminal to answer y/N here. Read the certificate fingerprint above, then re-run with --fingerprint <sha256> to trust only that exact certificate (safer), or --trust-cert to trust whatever this server presents.';
+
+export function registerConnectCommand(program, ctx) {
+  program
+    .command('connect')
+    .description('Connect to a Quox server on another machine: probe it, trust its certificate for one profile, sign in')
+    .argument('<url>', 'the server address, for example https://192.0.2.10:3000')
+    .option('--profile <name>', 'profile to create or update (default: named from the address; -p also works)')
+    .option('--trust-cert', "trust the server's own certificate for this profile without asking (its fingerprint is still printed)")
+    .option('--fingerprint <sha256>', "trust the server's own certificate only if its SHA256 fingerprint is exactly this (colons optional); implies --trust-cert for that one certificate")
+    .option('--email <email>', 'sign in with this email without a prompt (use with --password-stdin to run with no terminal)')
+    .option('--password-stdin', 'read the password from stdin, one line (never an argument)')
+    .addHelpText('after', '\nA new QuoxCORE serves its own self-signed certificate. Compare the SHA256 printed here with the one `quox server status` shows on the server before you trust it. The certificate is stored for the one profile; TLS checks are never turned off.')
+    .action(announceOnFail('quox', (url) => `connect ${url}`, async (url, options, cmd) => {
+      const { connectServer } = await import('../quoxon/onboarding/connectServer.js');
+      const root = cmd.parent?.opts?.() || {};
+      const profile = options.profile || root.profile || profileNameForUrl(url);
+      // H1: the password comes from stdin only, never argv.
+      let password = null;
+      if (options.passwordStdin) {
+        const chunks = [];
+        for await (const chunk of process.stdin) chunks.push(chunk);
+        password = Buffer.concat(chunks).toString('utf8').split('\n')[0].replace(/\r$/, '');
+        if (!password) throw new QuoxUserError('--password-stdin given but stdin was empty. Pipe the password in, for example: printf %s "$PW" | quox connect <url> --email <email> --password-stdin', { exitCode: 2, code: 'empty_password' });
+      }
+      const email = options.email ? String(options.email).trim() : null;
+      const pin = options.fingerprint ? String(options.fingerprint).replace(/[:\s]/g, '').toUpperCase() : null;
+      const trust = async (card, peer) => {
+        if (pin) {
+          const got = String(peer?.chain?.[0]?.fingerprint256 || '').replace(/:/g, '').toUpperCase();
+          if (got === pin) return true;
+          throw new QuoxUserError(`The certificate ${url} presents has SHA256 ${peer?.chain?.[0]?.fingerprint256 || '(unreadable)'}, not the --fingerprint you gave. Nothing was saved.`, { exitCode: 2, code: 'fingerprint_mismatch' });
+        }
+        if (options.trustCert) return true;
+        if (!process.stdin.isTTY) throw new QuoxUserError(noTerminalTrustMessage(), { exitCode: 2, code: 'no_terminal' });
+        return confirmInteractive(`Trust this server's certificate for profile "${profile}" only?`, { flag: '--trust-cert', purpose: 'trust it' });
+      };
+      // loadConfig, not ctx.config: fresh each time, because the sign-in runs in a child process and writes the file.
+      // ctx.connectOverrides is for tests only.
+      const r = await connectServer(url, { profile, trust, email, password, loadConfigImpl: loadConfig, ...(ctx.connectOverrides || {}) });
+      if (r.action === 'connected') {
+        announce('quox', `connected ${url}`, { result: `profile ${profile}` });
+        console.log(`Connected as profile "${profile}". Use it with: quox -p ${profile} <command>. Make it your default with: quox config profile use ${profile}`);
+        return;
+      }
+      // H1: no terminal and no way to sign in: say which flags are missing, exit 2 (not 130, which means "cancelled").
+      const missing = [!email && '--email <email>', !password && '--password-stdin'].filter(Boolean);
+      if (!process.stdin.isTTY && missing.length && r.action !== 'connected') {
+        throw new QuoxUserError(`No terminal to sign in with. Re-run with ${missing.join(' and ')}; nothing was left saved.`, { exitCode: 2, code: 'no_terminal' });
+      }
+      if (r.action === 'connect-cancelled') { announce('quox', `connect ${url}`, { result: 'cancelled', status: 'warn' }); process.exitCode = 130; return; }
+      throw new QuoxUserError(`Could not connect to ${url}. See the message above; nothing was left saved.`, { exitCode: 1, code: 'connect_failed' });
+    }));
+}

package/lib/commands/contacts.js

@@ -408,6 +408,8 @@ export function registerContactsCommands(program, ctx) {
       if (isJson(program)) return printJson(d);
       console.log(`channel: ${d.channel || 'none allowed'}`);
       for (const a of d.alternatives || []) console.log(`  ${a.channel}: ${a.decision}${(a.reasons || []).length ? ` (${a.reasons.join(', ')})` : ''}`);
+      if (d.evaluated_for) console.log(`for: ${d.evaluated_for === 'agent' ? 'an agent' : 'you (a person)'}`);
+      if ((d.quiet_hours_for_agents || []).length) console.log(`quiet hours: an agent reaching them by ${d.quiet_hours_for_agents.join(', ')} now needs approval`);
       announce('contacts best-channel', d.channel || 'none allowed');
     });
 

package/lib/commands/dev.js

@@ -325,14 +325,12 @@ export function registerDevCommands(program, ctx) {
       printInfo(`Terms hash: ${offer.termsSha256} (presentation ${offer.presentationVersion})`);
 
       if (!options.iAccept) {
-        const { default: inquirer } = await import('inquirer');
-        const ans = await inquirer.prompt([{
-          type: 'confirm',
-          name: 'confirm',
-          message: `Do you accept these terms, on behalf of your organisation, for exactly this pack content?`,
-          default: false,
-        }]);
-        if (!ans.confirm) {
+        const { confirmInteractive } = await import('../core/confirm.js');
+        const accepted = await confirmInteractive(
+          `Do you accept these terms, on behalf of your organisation, for exactly this pack content?`,
+          { flag: '--i-accept', purpose: 'accept them as yourself' },
+        );
+        if (!accepted) {
           printInfo('Not accepted. Nothing was recorded.');
           return;
         }

package/lib/commands/doctor.js

@@ -8,6 +8,9 @@
  */
 
 import chalk from 'chalk';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import { SERVICE_PORTS } from '../core/config.js';
 import { emitCliEvent } from '../core/aee.js';
 import { resolveCliVersion, checkCliDrift } from '../core/version.js';
@@ -20,7 +23,7 @@ const CHECKS = [
   { name: 'QuoxFlow', service: 'quoxflow', port: 3200, path: '/health' },
   { name: 'Files service', service: 'files', port: 3102, path: '/health' },
   // External services
-  { name: 'QuoxAgent daemon', port: 9847, path: '/health', url: 'http://localhost:9847' },
+  { name: 'QuoxAgent daemon', port: 9847, path: '/health', url: 'http://localhost:9847', optionalUnlessEnrolled: true },
   { name: 'Qdrant vectors', port: 6333, path: '/', url: 'http://localhost:6333' },
 ];
 
@@ -40,11 +43,20 @@ async function checkEndpoint(url, path, timeoutMs = 3000) {
   }
 }
 
+/**
+ * F2 (ONBOARD-P1): is a QuoxAgent installed/enrolled on THIS machine? Its config is the evidence: the system
+ * install writes /etc/quoxagent/quoxagent.yaml, a user install ~/.quoxagent/. Absent both, nothing is enrolled
+ * and a daemon that is not running is the normal state of a single-box install, not a critical.
+ */
+export function defaultAgentEnrolled({ exists = existsSync, home = homedir() } = {}) {
+  return ['/etc/quoxagent/quoxagent.yaml', join(home, '.quoxagent', 'quoxagent.yaml'), join(home, '.quoxagent', 'config.yaml')].some((p) => exists(p));
+}
+
 /**
  * Every doctor check, in this process: services, auth token, CLI version. Shared by `quox doctor` and the
  * conversation's /doctor so the two can never disagree. -> [{ name, status, detail?, latency_ms?, ... }].
  */
-export async function runDoctorChecks({ config }) {
+export async function runDoctorChecks({ config, agentEnrolled = defaultAgentEnrolled } = {}) {
   // Check all services in parallel — per-item try/catch so one failure doesn't lose all results
   const checks = await Promise.all(
     CHECKS.map(async (check) => {
@@ -71,6 +83,9 @@ export async function runDoctorChecks({ config }) {
             }
           }
         }
+        if (result.status === 'fail' && check.optionalUnlessEnrolled && !agentEnrolled()) {
+          result = { status: 'skip', latency_ms: null, detail: 'optional: not running, and no QuoxAgent is enrolled on this machine (install one with the fleet enrol steps if you want a fleet)' };
+        }
         return {
           name: check.name,
           port: check.port,
@@ -130,6 +145,7 @@ export function registerDoctorCommand(program, ctx) {
   program
     .command('doctor')
     .description('Run platform health diagnostics')
+    .addHelpText('after', '\nAdd --json for machine output: { checks: [...], summary: { passed, warnings, failed } }.')
     .action(async (opts, cmd) => {
       const outputFormat = cmd.parent?.opts()?.output || 'table';
       const isJson = outputFormat === 'json' || cmd.parent?.opts()?.json;
@@ -140,9 +156,10 @@ export function registerDoctorCommand(program, ctx) {
       const passed = checks.filter(c => c.status === 'pass').length;
       const warnings = checks.filter(c => c.status === 'warn').length;
       const failed = checks.filter(c => c.status === 'fail').length;
+      const skipped = checks.filter(c => c.status === 'skip').length;
 
       if (isJson) {
-        console.log(JSON.stringify({ checks, summary: { passed, warnings, failed } }, null, 2));
+        console.log(JSON.stringify({ checks, summary: { passed, warnings, failed, skipped } }, null, 2));
         return;
       }
 
@@ -151,6 +168,7 @@ export function registerDoctorCommand(program, ctx) {
       for (const c of checks) {
         const icon = c.status === 'pass' ? chalk.green(' ✓')
           : c.status === 'warn' ? chalk.yellow(' ⚠')
+          : c.status === 'skip' ? chalk.dim(' ·')
           : chalk.red(' ✗');
 
         const latency = c.latency_ms != null ? chalk.dim(` (${c.latency_ms}ms)`) : '';
@@ -165,6 +183,7 @@ export function registerDoctorCommand(program, ctx) {
       if (passed) parts.push(chalk.green(`${passed} passed`));
       if (warnings) parts.push(chalk.yellow(`${warnings} warning${warnings > 1 ? 's' : ''}`));
       if (failed) parts.push(chalk.red(`${failed} critical`));
+      if (skipped) parts.push(chalk.dim(`${skipped} optional, not set up`));
       console.log(` ${parts.join('  ')}`);
       console.log('');
 

package/lib/commands/evidence.js

@@ -53,7 +53,8 @@ export function registerEvidenceCommands(program, ctx) {
 
   evidence
     .command('status')
-    .description('Evidence stores (AEE, WARD, VOLT): size, rows, time span, growth, archive and backup, read-only')
+    .description('Evidence stores (AEE, WARD, VOLT): size, rows, time span, growth, archive and backup, read-only. Instance admin only')
+    .addHelpText('after', '\nInstance admin only: an org owner or admin who is not an instance admin gets a 403 (exit 4).')
     .action(async () => {
       auth.requireAuth();
       const ep = resolveEndpoint('evidence.status');

package/lib/commands/gripe.js

@@ -22,7 +22,7 @@
  */
 
 import { formatDetail, printInfo, printWarning } from '../core/output.js';
-import { events, line as glyphLine, printEvent } from '../core/quoxglyph.js';
+import { events, gripeFiledLine, line as glyphLine, printEvent } from '../core/quoxglyph.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { resolveOrgId } from './helpers.js';
 
@@ -50,20 +50,28 @@ export function registerGripeCommands(program, { client, auth }) {
         return;
       }
       printEvent(glyphLine('quox', 'filing gripe via GRIPE'));
-      const data = await askGripe({ client, complaint, repo: options.repo, label: options.label, yes: !!options.yes, orgId });
-
-      if (program.opts().output === 'json') {
-        formatDetail(data, { format: 'json' });
-        return;
-      }
-
-      const r = await settleGripe({ client, data, complaint, options, orgId });
+      // GRIPE-QUEUE: a timeout / network / 5xx saves the gripe locally instead of losing it (/gripes in quox lists it).
+      const { gripeQueue, fileOrQueue } = await import('../quoxon/gripeQueue.js');
+      let rawData = null;
+      const f = await fileOrQueue({
+        text: complaint, repo: options.repo || null, queue: gripeQueue(), queueable: !!options.yes,
+        run: async (key) => {
+          const o = { ...options, idempotencyKey: key, queueRetryable: true };
+          rawData = await askGripe({ client, complaint, repo: options.repo, label: options.label, yes: !!options.yes, orgId });
+          if (program.opts().output === 'json') return { json: true };
+          return settleGripe({ client, data: rawData, complaint, options: o, orgId });
+        },
+      });
+      if (!f.ok && f.queued) { printWarning(`${f.saved} (${f.message})`); process.exitCode = 1; return; }
+      if (!f.ok) throw new Error(f.message);
+      if (f.json) { formatDetail(rawData, { format: 'json' }); return; }
+      const r = f;
       console.log('');
       if (r.superseded) printInfo(SUPERSEDED_MESSAGE);
       else console.log(r.response || '(no response)');
       console.log('');
       for (const n of r.notes) {
-        if (n.kind === 'created') printEvent(events.created('quox', 'issue', n.url));
+        if (n.kind === 'created') { printEvent(gripeFiledLine(n.url, complaint)); console.log(n.url); }
         else if (n.kind === 'info') printInfo(n.text);
         else printWarning(n.text);
       }
@@ -117,7 +125,7 @@ export async function settleGripe({ client, data, complaint, options = {}, orgId
   const notes = [];
   let url = null;
   const det = async () => {
-    const r = await fileDeterministically({ client, complaint, options, orgId, quiet: true });
+    const r = await fileDeterministically({ client, complaint, options, orgId, quiet: true, throwRetryable: !!options.queueRetryable });
     notes.push(...r.notes); if (r.url) url = r.url;
     return r;
   };
@@ -181,7 +189,7 @@ async function promptConfirmPublic(repo) {
   } finally { rl.close(); }
 }
 
-export async function fileDeterministically({ client, complaint, options, orgId, quiet = false, confirmPublic = null }) {
+export async function fileDeterministically({ client, complaint, options, orgId, quiet = false, confirmPublic = null, throwRetryable = false }) {
   const notes = [];
   const say = (n) => { notes.push(n); if (quiet) return; if (n.kind === 'created') printEvent(events.created('quox', 'issue', n.url)); else if (n.kind === 'info') printInfo(n.text); else printWarning(n.text); };
   const repoArg = options.repo || 'quoxai/quox';
@@ -201,9 +209,10 @@ export async function fileDeterministically({ client, complaint, options, orgId,
         owner,
         repo,
         title,
-        body: `## Gripe\n${complaint}\n\n## Context\n- Filed deterministically by \`quox gripe --yes\` (the GRIPE agent run did not file; quox#478 guarantee path)\n- Priority: minor / off-task observation\n\n## Suggested Action\nInvestigate and fix if confirmed.`,
+        body: `${options.idempotencyKey ? `<!-- quox-gripe-key: ${options.idempotencyKey} -->\n` : ''}## Gripe\n${complaint}\n\n## Context\n- Filed deterministically by \`quox gripe --yes\` (the GRIPE agent run did not file; quox#478 guarantee path)\n- Priority: minor / off-task observation\n\n## Suggested Action\nInvestigate and fix if confirmed.`,
         labels: [options.label || 'fleet/qa'],
         ...(orgId ? { org_id: orgId } : {}),
+        ...(options.idempotencyKey ? { idempotency_key: options.idempotencyKey } : {}),
         ...(confirmed ? { confirm_public: true } : {}),
       },
     });
@@ -216,6 +225,8 @@ export async function fileDeterministically({ client, complaint, options, orgId,
     say({ kind: 'warn', text: 'Deterministic file returned no issue URL; treat as NOT filed until you can see the issue.' });
     return { filed: false, notes };
   } catch (err) {
+    // GRIPE-QUEUE: a timeout / network / 5xx is "Quox did not answer", not a refusal; the caller queues it.
+    if (throwRetryable && (err?.status == null || Number(err.status) >= 500)) throw err;
     say({ kind: 'warn', text: `Not filed: the GRIPE run did not file and the deterministic fallback failed too (${err.message}).` });
     return { filed: false, error: err.message, notes };
   }

package/lib/commands/inbox.js

@@ -9,6 +9,8 @@ import { attachWalkthrough } from './walkthrough.js';
 import { getApprovalContext, formatApprovalContext, approvalListColumns } from '../core/approvalContext.js';
 import { QuoxUserError } from '../core/errors.js';
 import { resolutionFromItem, alreadyResolvedError } from '../core/inboxResolution.js';
+import { withStepUp } from '../core/stepUpPrompt.js';
+import { announce, announceFailure } from '../core/announce.js';
 import chalk from 'chalk';
 
 export function registerInboxCommands(program, ctx) {
@@ -55,7 +57,7 @@ export function registerInboxCommands(program, ctx) {
   inbox
     .command('list')
     .description('List inbox items')
-    .option('--status <status>', 'filter: one status, a comma list (resolved,cancelled,expired), or all (includes answered approvals). Default: active only')
+    .option('--status <status>', 'filter: one status, a comma list (resolved,cancelled,expired,withdrawn), or all (includes answered approvals). Default: active only')
     .option('--decision <decision>', 'with resolved/all: approved or rejected')
     .option('--page <n>', 'page number (newest first)')
     .option('--priority <priority>', 'filter: low, normal, high, urgent')
@@ -78,7 +80,15 @@ export function registerInboxCommands(program, ctx) {
         columns: ['id', 'kind', 'priority', 'title', 'source', 'reason', 'status', 'created_at'],
         headers: ['ID', 'Kind', 'Priority', 'Title', 'Source', 'Reason', 'Status', 'Created'],
         rows: items,
-      }, { format: program.opts().output });
+      }, {
+        format: program.opts().output,
+        emptyMessage: 'Nothing waiting for you. Try `--status all` for answered items, or `--awaiting-human` for approvals waiting on a human org-wide.',
+      });
+      const limit = Number(options.limit);
+      if (program.opts().output !== 'json' && items.length > 0 && Number.isFinite(limit) && items.length >= limit) {
+        const total = typeof data.total === 'number' ? data.total : null;
+        console.log(`showing ${items.length}${total && total > items.length ? ` of ${total}` : ''} · --limit to see more`);
+      }
     });
 
   inbox
@@ -116,9 +126,13 @@ export function registerInboxCommands(program, ctx) {
       auth.requireAuth();
       const orgId = resolveOrgId(auth, program);
       const format = program.opts().output;
+      // DS-010 / #1335: a step-up sink answers 403 step_up_required; ask the person for their PIN (hidden, TTY only) and retry once.
       const post = (itemId) => {
         const ep = resolveEndpoint('inbox.respond', { orgId, itemId });
-        return client.post(ep.path, { service: ep.service, body: { action: options.action, comment: options.comment } });
+        return withStepUp(
+          (headers) => client.post(ep.path, { service: ep.service, headers, body: { action: options.action, comment: options.comment } }),
+          { client, orgId, io: ctx.stepUpIO, what: 'This approval' },
+        );
       };
       // Resolve an approvalId to its card (server-side on a current server, else the client scan). When
       // this profile cannot see the card, still ask the server: it knows WHY (an agent login, another
@@ -161,6 +175,26 @@ export function registerInboxCommands(program, ctx) {
     } catch { return null; }
   }
 
+  inbox
+    .command('unread')
+    .description('Mark inbox items unread again (undo a mark-as-read), for you only')
+    .argument('<itemId...>', 'one or more inbox item IDs')
+    .action(async (ids) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      let done = 0;
+      for (const id of ids) {
+        try {
+          await client.patch(`${resolveEndpoint('inbox.get', { orgId, itemId: encodeURIComponent(id) }).path}/read`, { service: resolveEndpoint('inbox.get', { orgId, itemId: id }).service, body: { is_read: false } });
+          done++;
+        } catch (err) {
+          announceFailure('inbox', `unread ${id}`, err);
+          throw err.status === 404 ? notFound(id, err) : err;
+        }
+      }
+      announce('inbox', `marked ${done} unread`, { result: ids.length === 1 ? ids[0] : `${done} items` });
+    });
+
   inbox
     .command('stats')
     .description('Show inbox statistics')