quoxcli 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -4,7 +4,49 @@ User-visible changes to the `quoxcli` package. Items marked *(unproven)* ship in
 the package and pass their tests, but nobody has run them end to end from the
 published package yet.
 
-## 0.5.0 (unreleased)
+## 0.6.0 (2026-11-10)
+
+Nothing below has been run end to end from the published 0.6.0 package yet: treat every
+item as *(unproven from the package)*. Items marked *(driven live)* were driven against a
+live instance from the source tree before release.
+
+### New commands
+- `quox notes seal convert <id>` and `quox notes seal purge <id>` (human sessions only):
+  seal an existing plaintext note in place, then wipe its old plaintext revisions. Convert
+  names any attachments and says they are NOT protected. *(driven live)*
+- Sealed notes harden: each sealed note is bound to its note id (another note's envelope
+  is refused), the version comes from the authenticated envelope, and a local rollback
+  floor fails closed under a lock.
+- `quox notes seal` finds ENQRYPT without setup: `QUOX_ENQRYPT_PATH`, then
+  `~/.quox/enqrypt-src` (a clone of quoxai/enqrypt main plus `npm ci`); a copy missing a
+  function the CLI calls is refused by name. ENQRYPT is not on npm, and the npm package
+  named `enqrypt` is unrelated malware. *(driven live)*
+- `quox mail block | unblock | blocked | junk | trust`.
+- `quox mcp token create | list | revoke`.
+- `quox lucid goals`, `quox lucid insights`, `quox lucid brief`.
+- `quox plan brief`, `quox plan watch`, `quox plan followups` / `followup add | done | status`,
+  `quox plan roadmap archive | unarchive`, `quox plan roadmaps --archived`.
+- `quox monitoring incidents claim <id>` and `quox monitoring incidents status <id> <status>`: claim and move a
+  governance incident (witnessed, org scoped). `quox wazuh connect --indexer-ca` and
+  `--password-stdin` / `--indexer-password-stdin`.
+
+### Changes
+- `quox plan add` honours `roadmap_id` in the JSON (streams used to land in the first
+  roadmap). `quox plan focus` counts substreams and caps its output; unblockers name the
+  whole chain.
+- `quox wazuh vulns` totals are exact or labelled a lower bound (10,000+); `quox wazuh status`
+  says its agent count includes the manager; no MAINT? column when the org has no Uptime Kuma.
+- `quox offload` lists every worker lease and warns 12h before one expires; `offload release
+  --worker` targets that worker, never the shared default.
+- `quox tool exec --select .` returns the whole result. `quox actions list` fits the terminal.
+- Conversation app (`quox` with no arguments): `/wake`, `/poke` and `/page` take several
+  slots; `/inbox show N` reads a whole item; `/morningreport` digests what happened since you
+  were last here; a typed `/org switch` or `/org back` no longer asks a second y/n; an inline
+  approval says approved only after the server records it and no longer re-opens as a popup;
+  decision cards never echo the asker's pick as their own advice; contact-consent approvals ask
+  for the lawful basis; slot messages from other sessions never show raw colour codes.
+
+## 0.5.0 (2026-11-06)
 
 ### New commands
 - `quox wazuh`: first-class Wazuh commands. `agents`, `fim`, `sca`, `rootcheck`
@@ -32,6 +74,13 @@ published package yet.
 - `quox notes seal init | status | new | open | edit | print`: ENQRYPT sealed
   notes. Encryption happens on your machine and the server stores only the
   envelope. *(unproven from the package)*
+- `quox notes seal convert <id> --yes [--keep-title]` seals an existing note and
+  purges its earlier plaintext from the server (revisions, embeddings, derived
+  beliefs; human sessions only); `quox notes seal purge <id> --yes` reruns the
+  purge. Both say that backups taken earlier still hold the old text until they
+  expire. `seal edit` now takes the version from the sealed envelope, not from a
+  server field, and the local rollback floor refuses a damaged or missing floor
+  file instead of starting again from zero. *(unproven from the package)*
 - `quox admin users verify-email <email> --reason` (step-up PIN).
 - `quox memory sync`: Claude file memory is saved to Quox memory too
   (idempotent; credential-shaped text is refused).

package/lib/api/endpoints/governance.js

@@ -22,6 +22,13 @@ export const governance = {
     path: () => `/governance/incidents`,
     tags: ['live-safe'],
   },
+  // WAZ P11 slice 1b: the witnessed lifecycle move (claim = self, status with a resolution for terminal states).
+  // Collector: lib/governanceIncidentLifecycle.js. Writes, so not live-safe.
+  'governance.incidents.transition': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/governance/incidents/${encodeURIComponent(id)}/transition`,
+  },
   'governance.policy.compile': {
     method: 'POST',
     service: 'collector',

package/lib/api/endpoints/inboxq.js

@@ -136,4 +136,43 @@ export const inboxq = {
     path: ({ proposalId }) => `/api/v1/inboxq/proposals/${proposalId}/resolve`,
     tags: ['live-write'],
   },
+  // EMAIL-Q CLI audit (2026-11-09): the sender/junk routes the dashboard already
+  // calls (src/components/inboxq/lib/api.js), wrapped by `quox mail block|unblock|
+  // blocked|junk|trust`. No new server logic: these are the existing InboxQ routes.
+  'inboxq.messages.search': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/messages/search`,
+    tags: ['live-safe'],
+  },
+  'inboxq.messages.confirmJunk': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/messages/confirm-junk`,
+    tags: ['live-write'],
+  },
+  'inboxq.senders.block': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/block`,
+    tags: ['live-write'],
+  },
+  'inboxq.senders.unblock': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/unblock`,
+    tags: ['live-write'],
+  },
+  'inboxq.senders.blocked': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/blocked`,
+    tags: ['live-safe'],
+  },
+  'inboxq.senders.trust': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/trust`,
+    tags: ['live-write'],
+  },
 };

package/lib/api/endpoints/index.js

@@ -96,6 +96,7 @@ import { contactsq } from './contactsq.js';
 import { x } from './x.js';
 import { llmPolicy } from './llm-policy.js';
 import { hat } from './hat.js';
+import { mcp } from './mcp.js';
 import { members } from './members.js';
 import { memory } from './memory.js';
 import { mfa } from './mfa.js';
@@ -189,6 +190,7 @@ export const ENDPOINTS = {
   ...x,
   ...llmPolicy,
   ...hat,
+  ...mcp,
   ...members,
   ...memory,
   ...mfa,

package/lib/api/endpoints/lucid.js

@@ -86,4 +86,21 @@ export const lucid = {
     path: () => `/api/v1/lucid/herald/test`,
     tags: ['live-safe'],
   },
+  // LUCID-INTELLIGENCE World Model (LI-1): goals, initiatives, decisions, links. People confirm; agents propose.
+  'lucid.world.list': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/world`, tags: ['live-safe'] },
+  'lucid.world.create': { method: 'POST', service: 'collector', path: () => `/api/v1/lucid/intelligence/world`, tags: ['live-write'] },
+  'lucid.world.export': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/world/export`, tags: ['live-safe'] },
+  'lucid.world.erase': { method: 'DELETE', service: 'collector', path: () => `/api/v1/lucid/intelligence/world/mine`, tags: ['live-write'] },
+  'lucid.world.get': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}`, tags: ['live-safe'] },
+  'lucid.world.amend': { method: 'PATCH', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}`, tags: ['live-write'] },
+  'lucid.world.confirm': { method: 'POST', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/confirm`, tags: ['live-write'] },
+  'lucid.world.archive': { method: 'POST', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/archive`, tags: ['live-write'] },
+  'lucid.world.restore': { method: 'POST', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/restore`, tags: ['live-write'] },
+  'lucid.world.history': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/history`, tags: ['live-safe'] },
+  // LUCID-INTELLIGENCE LI-2 shadow insights (read-only).
+  'lucid.insights.list': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/insights`, tags: ['live-safe'] },
+  'lucid.insights.status': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/insights/status`, tags: ['live-safe'] },
+  'lucid.insights.get': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/insights/${encodeURIComponent(id)}`, tags: ['live-safe'] },
+  // LUCID-INTELLIGENCE LI-3 brief (read-only, never moves a cursor).
+  'lucid.brief': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/brief`, tags: ['live-safe'] },
 };

package/lib/api/endpoints/mcp.js

@@ -0,0 +1,35 @@
+/**
+ * 'mcp.*' endpoints: per-user QuoxMCP tokens and the personalised Claude Desktop bundle.
+ *
+ *   - mcp.tokens.*   auth service, services/auth/routes/mcp-tokens.js (mounted /api/auth/tokens/mcp, requireAuth,
+ *                    scoped to the caller: list/revoke only ever see the caller's own tokens; create needs an org context).
+ *   - mcp.bundle     collector, services/collector/routes/mcp-bundle.js (JWT only). POST { token, collector_url, agent_id }
+ *                    returns a .mcpb zip whose manifest EMBEDS the token as QUOX_SERVICE_KEY. Binary, read with raw: true.
+ */
+
+export const mcp = {
+  'mcp.tokens.create': {
+    method: 'POST',
+    service: 'auth',
+    path: () => '/api/auth/tokens/mcp',
+    tags: ['live-write'],
+  },
+  'mcp.tokens.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => '/api/auth/tokens/mcp',
+    tags: ['live-safe'],
+  },
+  'mcp.tokens.revoke': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ id }) => `/api/auth/tokens/mcp/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mcp.bundle': {
+    method: 'POST',
+    service: 'collector',
+    path: () => '/api/v1/mcp/bundle',
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/notesq.js

@@ -19,6 +19,8 @@ export const notesq = {
   'notesq.notes.revisions': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/notes/${id}/revisions`, tags: ['live-safe'] },
   'notesq.notes.revision': { method: 'GET', service: 'collector', path: ({ id, rev }) => `${B}/notes/${id}/revisions/${rev}`, tags: ['live-safe'] },
   'notesq.notes.restore': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/notes/${id}/restore`, tags: ['live-write'] },
+  // ENQRYPT-NOTES: human-only purge of a sealed note's earlier plaintext (revisions, embeddings, derived beliefs).
+  'notesq.notes.sealPurge': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/notes/${id}/seal-purge`, tags: ['live-write'] },
   'notesq.import': { method: 'POST', service: 'collector', path: () => `${B}/import`, tags: ['live-write'] },
   // AQ-9D P4: Action-Q item create (auth, org-scoped), used by `quox notes actions`.
   'notesq.actionq.create': { method: 'POST', service: 'auth', path: ({ orgId }) => `/api/orgs/${orgId}/actions`, tags: ['live-write'] },

package/lib/api/endpoints/quoxplan.js

@@ -40,6 +40,14 @@ export const quoxplan = {
     path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/streams`,
     tags: ['live-safe'],
   },
+  // One-screen roadmap brief (QUOXPLAN-TERMINAL): top priorities, needs-you,
+  // unblockers, recent movers, stale count. Query: top (1..25), days (1..60).
+  'quoxplan.roadmap.brief.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/brief`,
+    tags: ['live-safe'],
+  },
   'quoxplan.roadmap.timeline.get': {
     method: 'GET',
     service: 'collector',
@@ -58,6 +66,21 @@ export const quoxplan = {
     path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/streams`,
     tags: ['live-write'],
   },
+  // Archive / unarchive a roadmap (QUOXPLAN-TERMINAL, gripe quoxai/quox#1586):
+  // hides it from GET /roadmaps and /search and refuses writes to its streams;
+  // reads by id keep working. Both idempotent server-side.
+  'quoxplan.roadmap.archive': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/archive`,
+    tags: ['live-write'],
+  },
+  'quoxplan.roadmap.unarchive': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/unarchive`,
+    tags: ['live-write'],
+  },
   'quoxplan.roadmap.export.get': {
     method: 'GET',
     service: 'collector',
@@ -118,4 +141,32 @@ export const quoxplan = {
     path: ({ id }) => `/api/v1/quoxplan/streams/${id}/plan/versions`,
     tags: ['live-safe'],
   },
+  // Action items (QUOXPLAN-TERMINAL: the dashboard's action-item panel had no
+  // CLI counterpart). Server: quoxplan/server/src/api/actionItems.js. Auto
+  // items (kind blocked/decision) are raised by stream status transitions;
+  // manual items are added here. Statuses: OPEN | DONE | CANCELLED.
+  'quoxplan.roadmap.actionItems.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/action-items`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.stream.actionItems.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/action-items`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.stream.actionItems.create': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/action-items`,
+    tags: ['live-write'],
+  },
+  'quoxplan.actionItem.update': {
+    method: 'PATCH',
+    service: 'collector',
+    path: ({ actionId }) => `/api/v1/quoxplan/action-items/${actionId}`,
+    tags: ['live-write'],
+  },
 };

package/lib/commands/actions.js

@@ -41,6 +41,39 @@ async function listItems(ctx, { status = 'all', limit = 100, scope } = {}) {
   throw new QuoxError(`More than ${MAX_PAGES * pageSize} items; narrow with --status or --scope.`);
 }
 
+// Short ids, as `quox approvals` shows them: the last 6 characters of the ULID. --json keeps the full id.
+const SHORT_LEN = 6;
+export const shortActionId = (id) => String(id ?? '').slice(-SHORT_LEN);
+
+// The width to fit: the terminal when there is one, else COLUMNS (the Quox TUI sets it for ! and /<verb> runs).
+function outputWidth() {
+  if (process.stdout.isTTY && process.stdout.columns) return process.stdout.columns;
+  const env = Number(process.env.COLUMNS);
+  return env > 0 ? env : 0;
+}
+
+/** An exact id, or a unique id suffix (the short id the list shows). -> item | null; ambiguous throws. */
+function findByIdOrSuffix(items, given) {
+  const want = String(given || '').trim().toUpperCase();
+  if (!want) return null;
+  const exact = items.find((i) => String(i.id).toUpperCase() === want);
+  if (exact) return exact;
+  const hits = items.filter((i) => String(i.id).toUpperCase().endsWith(want));
+  if (hits.length > 1) {
+    throw new QuoxError(`"${given}" matches ${hits.length} action items (${hits.map((h) => h.id).join(', ')}); use more of the id.`, 2);
+  }
+  return hits[0] || null;
+}
+
+// A short id (base32, shorter than a ULID) is resolved against the list; anything else goes to the server as given.
+const looksShort = (id) => /^[0-9A-Z]{4,25}$/i.test(String(id || '').trim());
+async function resolveActionId(ctx, given) {
+  if (!looksShort(given)) return given;
+  const item = findByIdOrSuffix(await listItems(ctx, { status: 'all', limit: 100 }), given);
+  if (!item) throw new QuoxError(`No action item matches ${given}.`, 5);
+  return item.id;
+}
+
 export function registerActionsCommands(program, ctx) {
   const actions = program
     .command('actions')
@@ -54,20 +87,24 @@ export function registerActionsCommands(program, ctx) {
     .option('--scope <scopeId>', 'only items in this team/department/division scope')
     .action(async (options) => {
       const items = await listItems({ ...ctx, program }, options);
+      // Fit the terminal (owner 2026-11-07): short id, title cut with an ellipsis, no all-empty Due column.
+      const hasDue = items.some((i) => i.dueDate);
+      const columns = ['id', 'status', 'priority', 'title', ...(hasDue ? ['dueDate'] : [])];
+      const headers = ['ID', 'Status', 'Priority', 'Title', ...(hasDue ? ['Due'] : [])];
       formatOutput({
-        columns: ['id', 'status', 'priority', 'title', 'dueDate'],
-        headers: ['ID', 'Status', 'Priority', 'Title', 'Due'],
-        rows: items.map((i) => ({ ...i, dueDate: i.dueDate || '-' })),
-      }, { raw: items });
+        columns,
+        headers,
+        rows: items.map((i) => ({ ...i, fullId: i.id, id: shortActionId(i.id), dueDate: i.dueDate ? String(i.dueDate).slice(0, 10) : '' })),
+      }, { raw: items, quietColumn: 'fullId', fit: { width: outputWidth(), flex: 'title' } });
     });
 
   actions
     .command('get')
     .description('Show one action item by id')
-    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<id>', 'action item id, or the short id `quox actions list` shows')
     .action(async (id) => {
       const items = await listItems({ ...ctx, program }, { status: 'all', limit: 100 });
-      const item = items.find((i) => i.id === id);
+      const item = findByIdOrSuffix(items, id);
       if (!item) throw new QuoxError(`No action item ${id} among the latest 100 items.`);
       formatDetail(item);
     });
@@ -90,10 +127,10 @@ export function registerActionsCommands(program, ctx) {
   actions
     .command('done')
     .description('Mark an Action Tracker item done')
-    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<id>', 'action item id, or the short id `quox actions list` shows')
     .action(async (id) => {
       ctx.auth.requireAuth();
-      const item = await completeActionItem(ctx.client, id);
+      const item = await completeActionItem(ctx.client, await resolveActionId({ ...ctx, program }, id));
       if (program.opts().output === 'json') return formatDetail(item);
       printSuccess(`Marked done ${item.id}: ${item.title}`);
       return undefined;
@@ -102,11 +139,11 @@ export function registerActionsCommands(program, ctx) {
   actions
     .command('move')
     .description('Move an Action Tracker item to todo, doing or done')
-    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<id>', 'action item id, or the short id `quox actions list` shows')
     .argument('<status>', STATUS_COLUMNS.join(', '))
     .action(async (id, status) => {
       ctx.auth.requireAuth();
-      const item = await moveActionItem(ctx.client, id, status);
+      const item = await moveActionItem(ctx.client, await resolveActionId({ ...ctx, program }, id), status);
       if (program.opts().output === 'json') return formatDetail(item);
       printSuccess(`Moved ${item.id} to ${item.status}: ${item.title}`);
       return undefined;
@@ -115,15 +152,16 @@ export function registerActionsCommands(program, ctx) {
   actions
     .command('delete')
     .description('Delete one of your Action Tracker items (asks first; --yes skips, required without a terminal)')
-    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<id>', 'action item id, or the short id `quox actions list` shows')
     .option('-y, --yes', 'do not ask')
     .action(async (id, options) => {
       ctx.auth.requireAuth();
-      if (!(await confirmDestructive(program, { force: options.yes === true }, `Delete action item ${id}?`))) {
+      const fullId = await resolveActionId({ ...ctx, program }, id);
+      if (!(await confirmDestructive(program, { force: options.yes === true }, `Delete action item ${fullId}?`))) {
         console.log('Not deleted.');
         return undefined;
       }
-      const r = await deleteActionItem(ctx.client, id);
+      const r = await deleteActionItem(ctx.client, fullId);
       if (program.opts().output === 'json') return formatDetail(r);
       printSuccess(`Deleted ${r.id}${r.title ? `: ${r.title}` : ''}`);
       return undefined;

package/lib/commands/contacts.js

@@ -408,6 +408,8 @@ export function registerContactsCommands(program, ctx) {
       if (isJson(program)) return printJson(d);
       console.log(`channel: ${d.channel || 'none allowed'}`);
       for (const a of d.alternatives || []) console.log(`  ${a.channel}: ${a.decision}${(a.reasons || []).length ? ` (${a.reasons.join(', ')})` : ''}`);
+      if (d.evaluated_for) console.log(`for: ${d.evaluated_for === 'agent' ? 'an agent' : 'you (a person)'}`);
+      if ((d.quiet_hours_for_agents || []).length) console.log(`quiet hours: an agent reaching them by ${d.quiet_hours_for_agents.join(', ')} now needs approval`);
       announce('contacts best-channel', d.channel || 'none allowed');
     });
 

package/lib/commands/lucid.js

@@ -9,12 +9,14 @@
  *   quox lucid teach <target> <field>=<value> | lessons | forget <id>
  *   quox lucid herald [set key=value... | test]   when LUCID speaks first, and what it has said
  *   quox lucid blind          sources live/silent/failing/never heard, and what doesn't add up
+ *   quox lucid goals ...      your goals and decisions, so LUCID ranks against them (see lucidGoals.js)
  */
 import { formatOutput, printSuccess } from '../core/output.js';
 import { line as glyphLine, printEvent } from '../core/quoxglyph.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { confirmDestructive } from '../core/confirm.js';
 import { resolveOrgId } from './helpers.js';
+import { registerLucidGoalsCommands, registerLucidInsightsCommands, registerLucidBriefCommand } from './lucidGoals.js';
 
 const SURFACE = 'cli';
 
@@ -505,6 +507,10 @@ export function registerLucidCommands(program, ctx) {
       if (st.length) console.log(`Stats: ${st.map(([k, v]) => `${k}=${Array.isArray(v) ? v.join(',') : v}`).join(' · ')}`);
     });
 
+  registerLucidGoalsCommands(lu, program, ctx);
+  registerLucidInsightsCommands(lu, program, ctx);
+  registerLucidBriefCommand(lu, program, ctx);
+
   // ---- herald: when LUCID reaches out on its own ----
   const LEVELS = { l1_inbox: 'filed in your Approvals inbox', l2_slot: 'nudged you in your slot', l3_call: 'called you', resolved: 'resolved' };
   const levelWords = (l) => LEVELS[l] || l || 'not yet reached out';