quoxcli 0.5.0 → 0.6.1

package/CHANGELOG.md

@@ -4,7 +4,64 @@ User-visible changes to the `quoxcli` package. Items marked *(unproven)* ship in
 the package and pass their tests, but nobody has run them end to end from the
 published package yet.
 
-## 0.5.0 (unreleased)
+## 0.6.1 (2026-11-10)
+
+- `quox --version` and `quox doctor` no longer report another project's git commit. Installed
+  under nvm, 0.6.0 printed `0.6.0 (bab86d5, detached)`: `bab86d5` was nvm's own commit,
+  because `~/.nvm` is a git clone. Git details now show only when the CLI runs from its own
+  source checkout; a package install prints the bare version. *(driven live: the 0.6.0
+  npm install patched with this fix printed `0.6.0`)*
+- New: `quox lens panel` runs several QuoxLens critiques over one target, repeated, and keeps the
+  findings that recur across runs. *(unproven from the package; landed by another session the
+  same day)*
+- `quox lens apply` now waits past the 5 minute model ceiling instead of the 30 second client
+  default. *(unproven from the package)*
+
+## 0.6.0 (2026-11-10)
+
+Driven from the published 0.6.0 package on 2026-11-10 (npm install -g, Node under nvm):
+`notes ls`, `doctor` (9 of 9), and the full seal round trip (`notes seal init`, `status`,
+`new`, `open` by id, `print` then `open --armor-file`; the server copy held no plaintext).
+Everything else below has not been run from the package yet. Items marked *(driven live)*
+were driven against a live instance from the source tree before release.
+
+### New commands
+- `quox notes seal convert <id>` and `quox notes seal purge <id>` (human sessions only):
+  seal an existing plaintext note in place, then wipe its old plaintext revisions. Convert
+  names any attachments and says they are NOT protected. *(driven live)*
+- Sealed notes harden: each sealed note is bound to its note id (another note's envelope
+  is refused), the version comes from the authenticated envelope, and a local rollback
+  floor fails closed under a lock.
+- `quox notes seal` finds ENQRYPT without setup: `QUOX_ENQRYPT_PATH`, then
+  `~/.quox/enqrypt-src` (a clone of quoxai/enqrypt main plus `npm ci`); a copy missing a
+  function the CLI calls is refused by name. ENQRYPT is not on npm, and the npm package
+  named `enqrypt` is unrelated malware. *(driven live)*
+- `quox mail block | unblock | blocked | junk | trust`.
+- `quox mcp token create | list | revoke`.
+- `quox lucid goals`, `quox lucid insights`, `quox lucid brief`.
+- `quox plan brief`, `quox plan watch`, `quox plan followups` / `followup add | done | status`,
+  `quox plan roadmap archive | unarchive`, `quox plan roadmaps --archived`.
+- `quox monitoring incidents claim <id>` and `quox monitoring incidents status <id> <status>`: claim and move a
+  governance incident (witnessed, org scoped). `quox wazuh connect --indexer-ca` and
+  `--password-stdin` / `--indexer-password-stdin`.
+
+### Changes
+- `quox plan add` honours `roadmap_id` in the JSON (streams used to land in the first
+  roadmap). `quox plan focus` counts substreams and caps its output; unblockers name the
+  whole chain.
+- `quox wazuh vulns` totals are exact or labelled a lower bound (10,000+); `quox wazuh status`
+  says its agent count includes the manager; no MAINT? column when the org has no Uptime Kuma.
+- `quox offload` lists every worker lease and warns 12h before one expires; `offload release
+  --worker` targets that worker, never the shared default.
+- `quox tool exec --select .` returns the whole result. `quox actions list` fits the terminal.
+- Conversation app (`quox` with no arguments): `/wake`, `/poke` and `/page` take several
+  slots; `/inbox show N` reads a whole item; `/morningreport` digests what happened since you
+  were last here; a typed `/org switch` or `/org back` no longer asks a second y/n; an inline
+  approval says approved only after the server records it and no longer re-opens as a popup;
+  decision cards never echo the asker's pick as their own advice; contact-consent approvals ask
+  for the lawful basis; slot messages from other sessions never show raw colour codes.
+
+## 0.5.0 (2026-11-06)
 
 ### New commands
 - `quox wazuh`: first-class Wazuh commands. `agents`, `fim`, `sca`, `rootcheck`
@@ -32,6 +89,13 @@ published package yet.
 - `quox notes seal init | status | new | open | edit | print`: ENQRYPT sealed
   notes. Encryption happens on your machine and the server stores only the
   envelope. *(unproven from the package)*
+- `quox notes seal convert <id> --yes [--keep-title]` seals an existing note and
+  purges its earlier plaintext from the server (revisions, embeddings, derived
+  beliefs; human sessions only); `quox notes seal purge <id> --yes` reruns the
+  purge. Both say that backups taken earlier still hold the old text until they
+  expire. `seal edit` now takes the version from the sealed envelope, not from a
+  server field, and the local rollback floor refuses a damaged or missing floor
+  file instead of starting again from zero. *(unproven from the package)*
 - `quox admin users verify-email <email> --reason` (step-up PIN).
 - `quox memory sync`: Claude file memory is saved to Quox memory too
   (idempotent; credential-shaped text is refused).

package/lib/api/endpoints/admin.js

@@ -175,4 +175,25 @@ export const admin = {
     path: () => `/api/admin/stats`,
     tags: ['live-safe'],
   },
+  // AQ-9H LADON-P1B: the scratch-org registry (fixture mail/calendar providers load only for a marked org, and
+  // only on a QUOX_FIXTURE_PROVIDERS=1 deployment). Collector routes, human instance admin only, enforced
+  // server-side by requireInstanceAdminMw (services/collector/server.js).
+  'admin.scratch_orgs.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/admin/scratch-orgs`,
+    tags: ['live-safe'],
+  },
+  'admin.scratch_orgs.mark': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ orgId }) => `/api/v1/admin/scratch-orgs/${encodeURIComponent(orgId)}`,
+    tags: ['admin-write'],
+  },
+  'admin.scratch_orgs.unmark': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ orgId }) => `/api/v1/admin/scratch-orgs/${encodeURIComponent(orgId)}`,
+    tags: ['admin-write'],
+  },
 };

package/lib/api/endpoints/calendarq.js

@@ -38,6 +38,14 @@ export const calendarq = {
     path: () => `/api/v1/calendarq/changes`,
     tags: ['live-safe'],
   },
+  // AQ-9H LADON-P1B: create a seeded FIXTURE calendar connection (scratch orgs on a fixture-enabled
+  // deployment only; the collector's gate decides). Google connects through the OAuth flow, not here.
+  'calendarq.connections.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/connections`,
+    tags: ['live-write'],
+  },
   'calendarq.sync': {
     method: 'POST',
     service: 'collector',

package/lib/api/endpoints/governance.js

@@ -22,6 +22,13 @@ export const governance = {
     path: () => `/governance/incidents`,
     tags: ['live-safe'],
   },
+  // WAZ P11 slice 1b: the witnessed lifecycle move (claim = self, status with a resolution for terminal states).
+  // Collector: lib/governanceIncidentLifecycle.js. Writes, so not live-safe.
+  'governance.incidents.transition': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/governance/incidents/${encodeURIComponent(id)}/transition`,
+  },
   'governance.policy.compile': {
     method: 'POST',
     service: 'collector',

package/lib/api/endpoints/inboxq.js

@@ -136,4 +136,43 @@ export const inboxq = {
     path: ({ proposalId }) => `/api/v1/inboxq/proposals/${proposalId}/resolve`,
     tags: ['live-write'],
   },
+  // EMAIL-Q CLI audit (2026-11-09): the sender/junk routes the dashboard already
+  // calls (src/components/inboxq/lib/api.js), wrapped by `quox mail block|unblock|
+  // blocked|junk|trust`. No new server logic: these are the existing InboxQ routes.
+  'inboxq.messages.search': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/messages/search`,
+    tags: ['live-safe'],
+  },
+  'inboxq.messages.confirmJunk': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/messages/confirm-junk`,
+    tags: ['live-write'],
+  },
+  'inboxq.senders.block': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/block`,
+    tags: ['live-write'],
+  },
+  'inboxq.senders.unblock': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/unblock`,
+    tags: ['live-write'],
+  },
+  'inboxq.senders.blocked': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/blocked`,
+    tags: ['live-safe'],
+  },
+  'inboxq.senders.trust': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/trust`,
+    tags: ['live-write'],
+  },
 };

package/lib/api/endpoints/index.js

@@ -62,6 +62,7 @@ import { awareness } from './awareness.js';
 import { router } from './router.js';
 import { mind } from './mind.js';
 import { lucid } from './lucid.js';
+import { lens } from './lens.js';
 import { loops } from './loops.js';
 import { away } from './away.js';
 import { presence } from './presence.js';
@@ -96,6 +97,7 @@ import { contactsq } from './contactsq.js';
 import { x } from './x.js';
 import { llmPolicy } from './llm-policy.js';
 import { hat } from './hat.js';
+import { mcp } from './mcp.js';
 import { members } from './members.js';
 import { memory } from './memory.js';
 import { mfa } from './mfa.js';
@@ -155,6 +157,7 @@ export const ENDPOINTS = {
   ...router,
   ...mind,
   ...lucid,
+  ...lens,
   ...loops,
   ...away,
   ...presence,
@@ -189,6 +192,7 @@ export const ENDPOINTS = {
   ...x,
   ...llmPolicy,
   ...hat,
+  ...mcp,
   ...members,
   ...memory,
   ...mfa,

package/lib/api/endpoints/lens.js

@@ -0,0 +1,34 @@
+/**
+ * 'lens.*' endpoints: QuoxLens (`quox lens`).
+ * Collector routes under /api/v1/lens (services/collector/routes/quoxlens.js), mounted behind
+ * requireServiceOrUserAuth + requirePluginEntitlement('quoxlens') (402 LICENSE_REQUIRED).
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const lens = {
+  'lens.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/lens/lenses`,
+    tags: ['live-safe'],
+  },
+  'lens.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/lens/lenses/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'lens.apply': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/lens/apply`,
+    tags: ['live-write'],
+  },
+  'lens.panel': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/lens/panel`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/lucid.js

@@ -86,4 +86,22 @@ export const lucid = {
     path: () => `/api/v1/lucid/herald/test`,
     tags: ['live-safe'],
   },
+  // LUCID-INTELLIGENCE World Model (LI-1): goals, initiatives, decisions, links. People confirm; agents propose.
+  'lucid.world.list': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/world`, tags: ['live-safe'] },
+  'lucid.world.create': { method: 'POST', service: 'collector', path: () => `/api/v1/lucid/intelligence/world`, tags: ['live-write'] },
+  'lucid.world.export': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/world/export`, tags: ['live-safe'] },
+  'lucid.world.erase': { method: 'DELETE', service: 'collector', path: () => `/api/v1/lucid/intelligence/world/mine`, tags: ['live-write'] },
+  'lucid.world.get': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}`, tags: ['live-safe'] },
+  'lucid.world.amend': { method: 'PATCH', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}`, tags: ['live-write'] },
+  'lucid.world.confirm': { method: 'POST', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/confirm`, tags: ['live-write'] },
+  'lucid.world.archive': { method: 'POST', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/archive`, tags: ['live-write'] },
+  'lucid.world.restore': { method: 'POST', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/restore`, tags: ['live-write'] },
+  'lucid.world.history': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/history`, tags: ['live-safe'] },
+  // LUCID-INTELLIGENCE LI-2 shadow insights (read-only, except a person deciding a proposed link).
+  'lucid.insights.list': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/insights`, tags: ['live-safe'] },
+  'lucid.insights.status': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/insights/status`, tags: ['live-safe'] },
+  'lucid.insights.decide': { method: 'POST', service: 'collector', path: ({ id, goalId }) => `/api/v1/lucid/intelligence/insights/${encodeURIComponent(id)}/links/${encodeURIComponent(goalId)}`, tags: ['live-write'] },
+  'lucid.insights.get': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/insights/${encodeURIComponent(id)}`, tags: ['live-safe'] },
+  // LUCID-INTELLIGENCE LI-3 brief (read-only, never moves a cursor).
+  'lucid.brief': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/brief`, tags: ['live-safe'] },
 };

package/lib/api/endpoints/mcp.js

@@ -0,0 +1,35 @@
+/**
+ * 'mcp.*' endpoints: per-user QuoxMCP tokens and the personalised Claude Desktop bundle.
+ *
+ *   - mcp.tokens.*   auth service, services/auth/routes/mcp-tokens.js (mounted /api/auth/tokens/mcp, requireAuth,
+ *                    scoped to the caller: list/revoke only ever see the caller's own tokens; create needs an org context).
+ *   - mcp.bundle     collector, services/collector/routes/mcp-bundle.js (JWT only). POST { token, collector_url, agent_id }
+ *                    returns a .mcpb zip whose manifest EMBEDS the token as QUOX_SERVICE_KEY. Binary, read with raw: true.
+ */
+
+export const mcp = {
+  'mcp.tokens.create': {
+    method: 'POST',
+    service: 'auth',
+    path: () => '/api/auth/tokens/mcp',
+    tags: ['live-write'],
+  },
+  'mcp.tokens.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => '/api/auth/tokens/mcp',
+    tags: ['live-safe'],
+  },
+  'mcp.tokens.revoke': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ id }) => `/api/auth/tokens/mcp/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mcp.bundle': {
+    method: 'POST',
+    service: 'collector',
+    path: () => '/api/v1/mcp/bundle',
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/mon.js

@@ -6,13 +6,12 @@
  * collector-direct (no org segment in the URL — same shape as
  * `traces.*`/`aee.*`):
  *
- *   - Docker fleet (`/docker/*`) — VERIFIED at the handlers (server.js
- *     ~7232-7401): these routes have NO auth middleware applied at all, and
- *     no org filtering — a bare fleet-wide scan/cache read across every
- *     Docker host the collector can reach. The CLI still sends a bearer
- *     (harmless) and still gates `quox mon docker *` behind
- *     `auth.requireAuth()` for a consistent logged-in CLI UX, but the
- *     backend itself would serve these to an unauthenticated caller.
+ *   - Docker fleet (`/docker/*`) — the instance operator's fleet. Every
+ *     route needs a login (requireServiceOrUserAuth). The reads run
+ *     instanceFleetRouteGate: the operator org or an instance admin sees the
+ *     fleet, any other org gets an honest empty list (or 404 for one
+ *     container). The start/stop/restart action goes through executeTool and
+ *     is refused for any other org (VULCAN FND_01M71D6KXP402M7CE1NGH0GVVZ).
  *   - Wazuh (`/api/v1/wazuh/*`) — gated by `requireServiceOrUserAuth()`.
  *     Reads (manager/status, agents, alerts, vulnerabilities,
  *     deploy-history) are not org-filtered by the Wazuh API itself (the org

package/lib/api/endpoints/notesq.js

@@ -19,6 +19,8 @@ export const notesq = {
   'notesq.notes.revisions': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/notes/${id}/revisions`, tags: ['live-safe'] },
   'notesq.notes.revision': { method: 'GET', service: 'collector', path: ({ id, rev }) => `${B}/notes/${id}/revisions/${rev}`, tags: ['live-safe'] },
   'notesq.notes.restore': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/notes/${id}/restore`, tags: ['live-write'] },
+  // ENQRYPT-NOTES: human-only purge of a sealed note's earlier plaintext (revisions, embeddings, derived beliefs).
+  'notesq.notes.sealPurge': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/notes/${id}/seal-purge`, tags: ['live-write'] },
   'notesq.import': { method: 'POST', service: 'collector', path: () => `${B}/import`, tags: ['live-write'] },
   // AQ-9D P4: Action-Q item create (auth, org-scoped), used by `quox notes actions`.
   'notesq.actionq.create': { method: 'POST', service: 'auth', path: ({ orgId }) => `/api/orgs/${orgId}/actions`, tags: ['live-write'] },

package/lib/api/endpoints/quoxplan.js

@@ -40,6 +40,14 @@ export const quoxplan = {
     path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/streams`,
     tags: ['live-safe'],
   },
+  // One-screen roadmap brief (QUOXPLAN-TERMINAL): top priorities, needs-you,
+  // unblockers, recent movers, stale count. Query: top (1..25), days (1..60).
+  'quoxplan.roadmap.brief.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/brief`,
+    tags: ['live-safe'],
+  },
   'quoxplan.roadmap.timeline.get': {
     method: 'GET',
     service: 'collector',
@@ -58,6 +66,21 @@ export const quoxplan = {
     path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/streams`,
     tags: ['live-write'],
   },
+  // Archive / unarchive a roadmap (QUOXPLAN-TERMINAL, gripe quoxai/quox#1586):
+  // hides it from GET /roadmaps and /search and refuses writes to its streams;
+  // reads by id keep working. Both idempotent server-side.
+  'quoxplan.roadmap.archive': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/archive`,
+    tags: ['live-write'],
+  },
+  'quoxplan.roadmap.unarchive': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/unarchive`,
+    tags: ['live-write'],
+  },
   'quoxplan.roadmap.export.get': {
     method: 'GET',
     service: 'collector',
@@ -118,4 +141,32 @@ export const quoxplan = {
     path: ({ id }) => `/api/v1/quoxplan/streams/${id}/plan/versions`,
     tags: ['live-safe'],
   },
+  // Action items (QUOXPLAN-TERMINAL: the dashboard's action-item panel had no
+  // CLI counterpart). Server: quoxplan/server/src/api/actionItems.js. Auto
+  // items (kind blocked/decision) are raised by stream status transitions;
+  // manual items are added here. Statuses: OPEN | DONE | CANCELLED.
+  'quoxplan.roadmap.actionItems.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/action-items`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.stream.actionItems.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/action-items`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.stream.actionItems.create': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/action-items`,
+    tags: ['live-write'],
+  },
+  'quoxplan.actionItem.update': {
+    method: 'PATCH',
+    service: 'collector',
+    path: ({ actionId }) => `/api/v1/quoxplan/action-items/${actionId}`,
+    tags: ['live-write'],
+  },
 };

package/lib/api/endpoints/v1.js

@@ -67,6 +67,38 @@ export const v1 = {
     path: () => `/api/v1/fleet/ping`,
     tags: ['admin-write'],
   },
+  // BASTION-JANUS P3 — `quox fleet recipe list|show|add|remove|run`: the org's governed fleet
+  // recipe library. run hands the rendered recipe to the collector's ssh_exec gate (one card).
+  'v1.fleet.recipes.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/fleet/recipes`,
+    tags: ['live-safe'],
+  },
+  'v1.fleet.recipes.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/fleet/recipes/${encodeURIComponent(name)}`,
+    tags: ['live-safe'],
+  },
+  'v1.fleet.recipes.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/fleet/recipes`,
+    tags: ['admin-write'],
+  },
+  'v1.fleet.recipes.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/fleet/recipes/${encodeURIComponent(name)}`,
+    tags: ['admin-write'],
+  },
+  'v1.fleet.recipes.run': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/fleet/recipes/run`,
+    tags: ['live-write'],
+  },
   // DEVSUITE-HUB Phase 2 — `quox dev enable` (see lib/commands/dev.js).
   // Constructs + signs + delivers a quoxagent dev.CapabilityProfile onto a
   // target host via Bastion. See services/collector/server.js's
@@ -202,6 +234,31 @@ export const v1 = {
     path: () => `/api/v1/build-status`,
     tags: ['live-safe'],
   },
+  // HYPERION-NEXT P10: fleet hardware health (bare-metal IPMI / RAID / SMART), `quox fleet hw`.
+  'v1.fleet.hw.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/fleet/hw`,
+    tags: ['live-safe'],
+  },
+  'v1.fleet.hw.events': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/fleet/hw/events`,
+    tags: ['live-safe'],
+  },
+  'v1.fleet.hw.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ host }) => `/api/v1/fleet/hw/${encodeURIComponent(host)}`,
+    tags: ['live-safe'],
+  },
+  'v1.fleet.hw.refresh': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/fleet/hw/refresh`,
+    tags: ['live-write'],
+  },
   'v1.gpu.nodes.list': {
     method: 'GET',
     service: 'collector',

package/lib/commands/actions.js

@@ -41,6 +41,39 @@ async function listItems(ctx, { status = 'all', limit = 100, scope } = {}) {
   throw new QuoxError(`More than ${MAX_PAGES * pageSize} items; narrow with --status or --scope.`);
 }
 
+// Short ids, as `quox approvals` shows them: the last 6 characters of the ULID. --json keeps the full id.
+const SHORT_LEN = 6;
+export const shortActionId = (id) => String(id ?? '').slice(-SHORT_LEN);
+
+// The width to fit: the terminal when there is one, else COLUMNS (the Quox TUI sets it for ! and /<verb> runs).
+function outputWidth() {
+  if (process.stdout.isTTY && process.stdout.columns) return process.stdout.columns;
+  const env = Number(process.env.COLUMNS);
+  return env > 0 ? env : 0;
+}
+
+/** An exact id, or a unique id suffix (the short id the list shows). -> item | null; ambiguous throws. */
+function findByIdOrSuffix(items, given) {
+  const want = String(given || '').trim().toUpperCase();
+  if (!want) return null;
+  const exact = items.find((i) => String(i.id).toUpperCase() === want);
+  if (exact) return exact;
+  const hits = items.filter((i) => String(i.id).toUpperCase().endsWith(want));
+  if (hits.length > 1) {
+    throw new QuoxError(`"${given}" matches ${hits.length} action items (${hits.map((h) => h.id).join(', ')}); use more of the id.`, 2);
+  }
+  return hits[0] || null;
+}
+
+// A short id (base32, shorter than a ULID) is resolved against the list; anything else goes to the server as given.
+const looksShort = (id) => /^[0-9A-Z]{4,25}$/i.test(String(id || '').trim());
+async function resolveActionId(ctx, given) {
+  if (!looksShort(given)) return given;
+  const item = findByIdOrSuffix(await listItems(ctx, { status: 'all', limit: 100 }), given);
+  if (!item) throw new QuoxError(`No action item matches ${given}.`, 5);
+  return item.id;
+}
+
 export function registerActionsCommands(program, ctx) {
   const actions = program
     .command('actions')
@@ -54,20 +87,24 @@ export function registerActionsCommands(program, ctx) {
     .option('--scope <scopeId>', 'only items in this team/department/division scope')
     .action(async (options) => {
       const items = await listItems({ ...ctx, program }, options);
+      // Fit the terminal (owner 2026-11-07): short id, title cut with an ellipsis, no all-empty Due column.
+      const hasDue = items.some((i) => i.dueDate);
+      const columns = ['id', 'status', 'priority', 'title', ...(hasDue ? ['dueDate'] : [])];
+      const headers = ['ID', 'Status', 'Priority', 'Title', ...(hasDue ? ['Due'] : [])];
       formatOutput({
-        columns: ['id', 'status', 'priority', 'title', 'dueDate'],
-        headers: ['ID', 'Status', 'Priority', 'Title', 'Due'],
-        rows: items.map((i) => ({ ...i, dueDate: i.dueDate || '-' })),
-      }, { raw: items });
+        columns,
+        headers,
+        rows: items.map((i) => ({ ...i, fullId: i.id, id: shortActionId(i.id), dueDate: i.dueDate ? String(i.dueDate).slice(0, 10) : '' })),
+      }, { raw: items, quietColumn: 'fullId', fit: { width: outputWidth(), flex: 'title' } });
     });
 
   actions
     .command('get')
     .description('Show one action item by id')
-    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<id>', 'action item id, or the short id `quox actions list` shows')
     .action(async (id) => {
       const items = await listItems({ ...ctx, program }, { status: 'all', limit: 100 });
-      const item = items.find((i) => i.id === id);
+      const item = findByIdOrSuffix(items, id);
       if (!item) throw new QuoxError(`No action item ${id} among the latest 100 items.`);
       formatDetail(item);
     });
@@ -90,10 +127,10 @@ export function registerActionsCommands(program, ctx) {
   actions
     .command('done')
     .description('Mark an Action Tracker item done')
-    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<id>', 'action item id, or the short id `quox actions list` shows')
     .action(async (id) => {
       ctx.auth.requireAuth();
-      const item = await completeActionItem(ctx.client, id);
+      const item = await completeActionItem(ctx.client, await resolveActionId({ ...ctx, program }, id));
       if (program.opts().output === 'json') return formatDetail(item);
       printSuccess(`Marked done ${item.id}: ${item.title}`);
       return undefined;
@@ -102,11 +139,11 @@ export function registerActionsCommands(program, ctx) {
   actions
     .command('move')
     .description('Move an Action Tracker item to todo, doing or done')
-    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<id>', 'action item id, or the short id `quox actions list` shows')
     .argument('<status>', STATUS_COLUMNS.join(', '))
     .action(async (id, status) => {
       ctx.auth.requireAuth();
-      const item = await moveActionItem(ctx.client, id, status);
+      const item = await moveActionItem(ctx.client, await resolveActionId({ ...ctx, program }, id), status);
       if (program.opts().output === 'json') return formatDetail(item);
       printSuccess(`Moved ${item.id} to ${item.status}: ${item.title}`);
       return undefined;
@@ -115,15 +152,16 @@ export function registerActionsCommands(program, ctx) {
   actions
     .command('delete')
     .description('Delete one of your Action Tracker items (asks first; --yes skips, required without a terminal)')
-    .argument('<id>', 'action item id (from `quox actions list`)')
+    .argument('<id>', 'action item id, or the short id `quox actions list` shows')
     .option('-y, --yes', 'do not ask')
     .action(async (id, options) => {
       ctx.auth.requireAuth();
-      if (!(await confirmDestructive(program, { force: options.yes === true }, `Delete action item ${id}?`))) {
+      const fullId = await resolveActionId({ ...ctx, program }, id);
+      if (!(await confirmDestructive(program, { force: options.yes === true }, `Delete action item ${fullId}?`))) {
         console.log('Not deleted.');
         return undefined;
       }
-      const r = await deleteActionItem(ctx.client, id);
+      const r = await deleteActionItem(ctx.client, fullId);
       if (program.opts().output === 'json') return formatDetail(r);
       printSuccess(`Deleted ${r.id}${r.title ? `: ${r.title}` : ''}`);
       return undefined;