quoxcli 0.5.0 → 0.6.1

package/lib/commands/research.js

@@ -5,9 +5,20 @@
  * Stored as the org setting RESEARCH_TRUSTED_DOMAINS through the SAME governed settings path as
  * `quox settings set` (PATCH /api/v1/platform/settings/flags/:key, human org admin, witnessed there).
  * Unset or empty means the built-in default list, which add/remove seed from so a first edit never drops it.
+ *
+ * quox research ask "<question>" [--save [--collection <name>]]
+ *
+ * Asks the research agent (registry id `perplexity`, the agent holding the governed web_search/web_read
+ * tools) through the SAME governed chat-turn route as `quox chat --agent perplexity --no-stream`
+ * (POST /chat/claude, Prefer: respond-async, polled at /chat/turns/:id). --save writes the answer and its
+ * sources as a NotesQ note through the same create route as `quox notes new`.
+ * Sources are the URLs the agent cited in its answer: the chat route returns tool names, not tool results,
+ * so a URL the agent read but did not cite is not shown, and none is ever invented.
  */
 
 import { resolveEndpoint } from '../api/endpoints.js';
+import { QuoxError } from '../core/errors.js';
+import { sendOneShot } from './chat.js';
 
 const KEY = 'RESEARCH_TRUSTED_DOMAINS';
 
@@ -41,6 +52,25 @@ async function write(client, list) {
   return client.patch(ep.path, { service: ep.service, body: { value: list.join(',') } });
 }
 
+export const RESEARCH_AGENT = 'perplexity';
+
+/** URLs cited in an answer (bare or markdown links), trailing punctuation trimmed, first-seen order, deduped. */
+export function extractSources(text) {
+  const seen = new Set();
+  for (const m of String(text || '').matchAll(/https?:\/\/[^\s<>()\[\]"'`]+(?:\([^\s()]*\)[^\s<>()\[\]"'`]*)*/g)) {
+    const url = m[0].replace(/[.,;:!?*_]+$/, '');
+    if (url.length > 'https://'.length) seen.add(url);
+  }
+  return [...seen];
+}
+
+function noteMarkdown({ question, answer, sources, toolsUsed, agent }) {
+  const title = question.replace(/\s+/g, ' ').trim().slice(0, 120);
+  const src = sources.length ? sources.map((u) => `- ${u}`).join('\n') : '_No sources were returned for this answer: the agent cited no URL._';
+  return `# ${title}\n\n**Question:** ${question}\n\n${answer.trim()}\n\n## Sources\n\n_URLs cited in the answer. The research route does not report which pages were actually read; check the answer text._\n\n${src}\n\n---\n` +
+    `Asked with \`quox research ask\` (agent ${agent}) on ${new Date().toISOString()}. Tools called: ${toolsUsed.length ? toolsUsed.join(', ') : 'none'}.\n`;
+}
+
 export function registerResearchCommands(program, ctx) {
   const { client } = ctx;
   const r = program.command('research').description('Governed web research settings');
@@ -76,4 +106,52 @@ export function registerResearchCommands(program, ctx) {
       await write(client, next);
       process.stdout.write(`removed ${dom} (${next.length} entries, org setting)\n`);
     });
+
+  r.command('ask <question...>')
+    .description('Ask the research agent a question; prints the answer and the sources it cited (--save keeps it as a NotesQ note)')
+    .option('--save', 'save the answer and sources as a NotesQ note')
+    .option('--collection <name>', 'NotesQ collection for --save', 'research')
+    .action(async (words, options) => {
+      if (ctx.auth && ctx.auth.requireAuth) ctx.auth.requireAuth();
+      const question = words.join(' ').trim();
+      if (!question) throw new QuoxError('Ask a question: quox research ask "<question>"', 2);
+      const g = program.opts();
+      const json = g.output === 'json' || g.json === true;
+
+      const { data, sessionId } = await sendOneShot(client, { message: question, agent: RESEARCH_AGENT });
+      const raw = data && (data.result ?? data.response ?? data.text);
+      const answer = typeof raw === 'string' ? raw : '';
+      if (!answer.trim()) throw new QuoxError(`The research agent returned no answer${data && data.error ? ` (${data.error})` : ''}.`, 1);
+      const toolsUsed = Array.isArray(data.tools_used) ? [...new Set(data.tools_used.map((t) => (typeof t === 'string' ? t : t && (t.name || t.tool))).filter(Boolean))] : [];
+      const agent = data.agent_used || RESEARCH_AGENT;
+      const sources = extractSources(answer);
+
+      let note = null;
+      if (options.save) {
+        const ep = resolveEndpoint('notesq.notes.create');
+        const saved = await client.post(ep.path, {
+          service: ep.service,
+          body: { scope: 'org', markdown: noteMarkdown({ question, answer, sources, toolsUsed, agent }), properties: { collection: options.collection, tags: ['research'] } },
+        });
+        note = saved && saved.note;
+        if (!note || !note.id) throw new QuoxError('NotesQ returned no note id: the answer was not saved.', 1);
+      }
+
+      if (json) {
+        console.log(JSON.stringify({ question, agent, answer, sources, tools_used: toolsUsed, conversation_id: sessionId || null, note }, null, 2));
+        return;
+      }
+      console.log(answer.trim());
+      console.log('');
+      if (sources.length) {
+        console.log(`Sources (${sources.length} URLs cited in the answer; the route does not report which pages were actually read):`);
+        sources.forEach((u, i) => console.log(`  ${i + 1}. ${u}`));
+      } else {
+        console.log('Sources: none. The agent cited no URL in its answer.');
+      }
+      const ranSearch = toolsUsed.includes('web_search');
+      console.log(`Tools called: ${toolsUsed.length ? toolsUsed.join(', ') : 'none'}${ranSearch ? ' (called, not necessarily successful: read the answer)' : ' (web_search did not run on this turn)'}`);
+      if (agent !== RESEARCH_AGENT) console.log(`Answered by: ${agent}`);
+      if (note) console.log(`Saved note ${note.id} in collection ${options.collection}.`);
+    });
 }

package/lib/commands/settings.js

@@ -12,6 +12,7 @@
 import { formatOutput, formatDetail } from '../core/output.js';
 import { line as glyphLine, printEvent } from '../core/quoxglyph.js';
 import { resolveEndpoint } from '../api/endpoints.js';
+import { withStepUp } from '../core/stepUpPrompt.js';
 
 async function fetchFlags(client) {
   const ep = resolveEndpoint('v1.settings.list');
@@ -59,7 +60,12 @@ export function registerSettingsCommands(program, ctx) {
     .action(async (key, value) => {
       auth.requireAuth();
       const ep = resolveEndpoint('v1.settings.set', { key });
-      const data = await client.patch(ep.path, { service: ep.service, body: { value } });
+      // VULCAN: weakening an approval control (STEP_UP_ENFORCE off) needs a step-up PIN; the server
+      // decides, and withStepUp asks for the PIN on a hidden prompt and retries once (scope override).
+      const data = await withStepUp(
+        (headers) => client.patch(ep.path, { service: ep.service, headers, body: { value } }),
+        { client, orgId: auth.getOrgId?.(program.opts().org) || null, scope: 'override', io: ctx.stepUpIO, what: `Changing ${key}` },
+      );
       if (program.opts().output === 'json') {
         console.log(JSON.stringify(data, null, 2));
         return;

package/lib/commands/volt.js

@@ -511,7 +511,12 @@ export function registerVoltCommands(program, ctx = {}) {
       console.log(`  Agents:     ${(m.agents_involved || []).join(', ') || 'none'}`);
       console.log(`  Policies:   ${(m.policy_ids_evaluated || []).length} evaluated`);
       console.log(`  HITL:       ${m.hitl_decisions || 0} decisions`);
-      console.log(`  Signed:     ${m.signed ? 'yes' : 'no'}`);
+      // Signatures live beside the manifest (fetched bundles: `signatures[]`;
+      // stored rows: `signature`); collector manifests never set m.signed.
+      const sigCount = Array.isArray(parsed.signatures) && parsed.signatures.length > 0
+        ? parsed.signatures.length
+        : (parsed.signature ? 1 : (m.signed ? 1 : 0));
+      console.log(`  Signed:     ${sigCount > 0 ? `yes (${sigCount} signature${sigCount === 1 ? '' : 's'}, not checked here; run quox volt verify)` : 'no'}`);
       console.log(`  Redacted:   ${m.redactions_present ? 'yes' : 'no'}`);
       console.log(`  Created:    ${m.created_ts || 'N/A'}`);
       console.log(`  Started:    ${m.started_at || 'N/A'}`);

package/lib/commands/wazuh.js

@@ -28,6 +28,7 @@
  * the verb, endpoint and status. It is never rendered as "0 agents". `status` exits 3 when the manager is unhealthy.
  */
 
+import fs from 'fs';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { line as glyphLine } from '../core/quoxglyph.js';
 import { resolveOrgId } from './helpers.js';
@@ -209,8 +210,10 @@ export function attachWazuhVerbs(wazuh, program, ctx, { writes = true } = {}) {
     const a = await allAgents('status');
     const counts = countStates(a.items);
     if (a.total > a.items.length) counts.total = a.total;
+    // WAZ-11: agent 000 is the manager's own agent; coverage leaves it out, so status says when its count includes it.
+    const includesManager = a.items.some((x) => String(x && x.id) === '000');
     if (jsonOut()) {
-      console.log(JSON.stringify({ healthy, daemons, stopped_core: brokenCore, agents: counts }, null, 2));
+      console.log(JSON.stringify({ healthy, daemons, stopped_core: brokenCore, agents: { ...counts, includes_manager: includesManager, excluding_manager: includesManager ? counts.total - 1 : counts.total } }, null, 2));
     } else {
       head('status', `manager ${healthy ? 'healthy' : 'unhealthy'} · ${plural(counts.total, 'agent')}`, healthy ? 'ok' : 'fail');
       console.log(`Manager ${healthy ? 'healthy' : 'unhealthy'}: ${running.length} running${stopped.length ? `, ${stopped.length} stopped` : ''}`);
@@ -218,6 +221,7 @@ export function attachWazuhVerbs(wazuh, program, ctx, { writes = true } = {}) {
         console.log(pad(stopped.map((n) => [`  ${n}`, OPTIONAL_DAEMONS.has(n) ? `${daemons[n]} (optional)` : String(daemons[n])])).join('\n'));
       }
       console.log(`Agents: ${countText(counts)}${a.total > a.items.length ? ` (counted the first ${a.items.length} of ${a.total})` : ''}`);
+      if (includesManager) console.log(`${plural(counts.total, 'agent')} (incl. the manager, agent 000); ${plural(counts.total - 1, 'agent')} excluding it, as quox wazuh coverage counts.`);
       if (!healthy) console.log(`Not running: ${brokenCore.join(', ')}. Check the manager host's service logs.`);
     }
     if (!healthy) process.exitCode = 3;
@@ -376,6 +380,15 @@ export function attachWazuhVerbs(wazuh, program, ctx, { writes = true } = {}) {
       head('coverage', s.covered === null || s.covered === undefined ? 'fleet unknown' : `${s.covered} of ${s.fleet_hosts} covered`,
         degraded || s.missing_agent > 0 || s.disconnected > 0 ? 'warn' : 'ok');
       console.log([n(s.fleet_hosts, 'fleet hosts'), `${s.wazuh_agents} Wazuh agents`, n(s.covered, 'covered'), n(s.missing_agent, 'missing agent'), `${s.disconnected} disconnected`, n(s.no_vuln_inventory, 'without vulnerability inventory')].join(', '));
+      // WAZ-11 (audit batch 5, N4): an unknown fleet-side number always says why, on stdout beside the summary (the JSON
+      // carries the reason as fleet_note / fleet_error; the human line used to print "unknown" with no reason).
+      if (s.fleet_hosts === null || s.fleet_hosts === undefined || s.covered === null || s.covered === undefined) {
+        const why = data.fleet_note
+          || (data.fleet_error === 'fleet_not_permitted' ? 'this organisation is not permitted to compare against the server fleet on this Quox instance (fleet_not_permitted)' : '')
+          || (data.fleet_error ? `the fleet list could not be read (${data.fleet_error})` : '')
+          || 'the collector gave no reason';
+        console.log(`Fleet hosts and covered are unknown: ${why}`);
+      }
       if (data.fleet_error) console.error(`Fleet list could not be read (${data.fleet_error}); fleet-side numbers are unknown, not zero.`);
       if (data.vuln_error) console.error(`Vulnerability inventory could not be read (${data.vuln_error}); that section is unknown, not empty.`);
       const section = (title, list, cols, row) => {
@@ -432,11 +445,13 @@ export function attachWazuhVerbs(wazuh, program, ctx, { writes = true } = {}) {
       const { ep, data } = await getRoute('vulns', 'mon.wazuh.vulnerabilities.list', query);
       if (!data || data.success === false || !Array.isArray(data.data)) throw new WazFail(`quox wazuh vulns: ${ep.method} ${ep.path} returned an error body: ${(data && (data.message || data.error)) || 'no vulnerabilities array'}`);
       const list = data.data;
-      if (jsonOut()) { console.log(JSON.stringify({ vulnerabilities: list, total: data.total ?? list.length }, null, 2)); return; }
+      if (jsonOut()) { console.log(JSON.stringify({ vulnerabilities: list, total: data.total ?? list.length, total_is_lower_bound: data.total_is_lower_bound === true }, null, 2)); return; }
       const bySev = {};
       for (const v of list) { const s = (v.vulnerability && v.vulnerability.severity) || 'Unknown'; bySev[s] = (bySev[s] || 0) + 1; }
       const sevText = ['Critical', 'High', 'Medium', 'Low', 'Unknown'].filter((s) => bySev[s]).map((s) => `${bySev[s]} ${s}`).join(' · ');
-      head('vulns', `${list.length === 0 ? 'none' : sevText}${(data.total ?? 0) > list.length ? ` (showing ${list.length} of ${data.total})` : ''}`, bySev.Critical ? 'warn' : 'ok');
+      // WAZ-11: an indexer-capped total is a lower bound ("10,000+"), never shown as an exact count.
+      const totalText = data.total_is_lower_bound === true ? `${Number(data.total).toLocaleString('en-GB')}+` : data.total;
+      head('vulns', `${list.length === 0 ? 'none' : sevText}${(data.total ?? 0) > list.length ? ` (showing ${list.length} of ${totalText})` : ''}`, bySev.Critical ? 'warn' : 'ok');
       if (!list.length) { console.log('No vulnerabilities.'); return; }
       const rows = [['SEVERITY', 'SCORE', 'CVE', 'AGENT', 'PACKAGE']];
       for (const v of list) rows.push([(v.vulnerability && v.vulnerability.severity) || '-', (v.vulnerability && v.vulnerability.score && v.vulnerability.score.base) ?? '-', (v.vulnerability && v.vulnerability.id) || '-', (v.agent && v.agent.name) || '-', v.package ? `${v.package.name || ''} ${v.package.version || ''}`.trim() : '-']);
@@ -728,15 +743,44 @@ export function attachWazuhVerbs(wazuh, program, ctx, { writes = true } = {}) {
 // ---------------------------------------------------------------------------------------------------------------
 
 async function hiddenPrompt(message) {
-  if (!process.stdin.isTTY) throw new WazFail(`quox wazuh connect: ${message} needs a terminal (the password is typed hidden, never passed as a flag or piped)`);
+  if (!process.stdin.isTTY) throw new WazFail(`quox wazuh connect: ${message} needs a terminal (the password is typed hidden, never passed as a flag); without a terminal pipe it in with --password-stdin / --indexer-password-stdin`);
   const { default: inquirer } = await import('inquirer');
   const ans = await inquirer.prompt([{ type: 'password', name: 'v', message, mask: '*', validate: (v) => (v && v.length > 0) || 'required' }]);
   return ans.v;
 }
 
+/** All of stdin as text (quox#1588 --password-stdin). Never echoed. */
+async function readAllStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+const CA_MAX_BYTES = 64 * 1024;
+/**
+ * quox#1588: read the indexer CA for --indexer-ca. A public certificate, but the file is still never printed: errors name
+ * the path only. Must hold at least one PEM CERTIFICATE block and NO private key (a bundle with a key is refused, so a key
+ * never lands in the vault entry by mistake).
+ */
+function readIndexerCa(file) {
+  let text;
+  try {
+    const st = fs.statSync(file);
+    if (!st.isFile()) throw new Error('not a file');
+    if (st.size > CA_MAX_BYTES) throw new Error(`larger than ${CA_MAX_BYTES} bytes`);
+    text = fs.readFileSync(file, 'utf8');
+  } catch (err) {
+    throw new WazFail(`quox wazuh connect: --indexer-ca ${file} could not be read (${err && err.code ? err.code : (err && err.message) || 'error'})`);
+  }
+  if (/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(text)) throw new WazFail(`quox wazuh connect: --indexer-ca ${file} contains a private key; pass the CA certificate only (nothing was saved)`);
+  if (!/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/.test(text)) throw new WazFail(`quox wazuh connect: --indexer-ca ${file} is not a PEM certificate (expected -----BEGIN CERTIFICATE-----)`);
+  return text;
+}
+
 export function attachWazuhConnect(wazuh, program, ctx) {
   const { client, auth } = ctx;
   const promptSecret = ctx.promptSecret || hiddenPrompt;
+  const readStdin = ctx.readStdin || readAllStdin;
   async function importInstanceEnv() {
     const ep = resolveEndpoint('mon.wazuh.credential.import-instance-env');
     let res;
@@ -765,19 +809,22 @@ export function attachWazuhConnect(wazuh, program, ctx) {
   }
 
   wazuh.command('connect')
-    .description('Connect this organisation to its Wazuh: stores the API (and optional indexer) credential in the vault, then runs status. Admin only. Passwords are prompted, never flags.')
+    .description('Connect this organisation to its Wazuh: stores the API (and optional indexer) credential in the vault, then runs status. Admin only. Passwords are prompted (or piped with --password-stdin), never flags.')
     .option('--from-instance-env', 'import the collector\'s own WAZUH_* environment into this org\'s vault (instance superadmin who is also an org admin; no prompts, no other flags)')
     .option('--url <url>', 'Wazuh manager API URL, e.g. https://wazuh-host:55000')
     .option('--user <user>', 'Wazuh API username, e.g. wazuh-wui')
     .option('--indexer-url <url>', 'Wazuh indexer URL, e.g. https://wazuh-host:9200')
     .option('--indexer-user <user>', 'Wazuh indexer username (a password is then prompted)')
     .option('--transport <mode>', 'indexer transport: auto|direct|host', 'auto')
-    .addHelpText('after', '\nExample:  quox wazuh connect --url https://wazuh.example:55000 --user wazuh-wui --indexer-user admin --transport host')
+    .option('--indexer-ca <file>', 'PEM CA certificate file for a self-signed indexer; stored as indexer_ca in the vault entry')
+    .option('--password-stdin', 'read the Wazuh API password from stdin (line 1) instead of the hidden prompt; never argv, never echoed')
+    .option('--indexer-password-stdin', 'read the indexer password from stdin (the next line after the API password, if both) instead of the prompt; needs --indexer-user')
+    .addHelpText('after', '\nExample:  quox wazuh connect --url https://wazuh.example:55000 --user wazuh-wui --indexer-user admin --transport host\nNo terminal:  printf \'%s\\n%s\\n\' "$API_PW" "$IDX_PW" | quox wazuh connect --url https://wazuh.example:55000 --user wazuh-wui --indexer-user admin --indexer-ca root-ca.pem --password-stdin --indexer-password-stdin')
     .action(async (options) => {
       try {
         auth.requireAuth();
         if (options.fromInstanceEnv) {
-          if (options.url || options.user || options.indexerUrl || options.indexerUser) throw new WazFail('quox wazuh connect: --from-instance-env cannot be combined with --url, --user, --indexer-url or --indexer-user');
+          if (options.url || options.user || options.indexerUrl || options.indexerUser || options.indexerCa || options.passwordStdin || options.indexerPasswordStdin) throw new WazFail('quox wazuh connect: --from-instance-env cannot be combined with --url, --user, --indexer-url, --indexer-user, --indexer-ca, --password-stdin or --indexer-password-stdin');
           await importInstanceEnv();
           return;
         }
@@ -786,6 +833,23 @@ export function attachWazuhConnect(wazuh, program, ctx) {
         if (!/^https:\/\/[^\s/]+/.test(options.url)) throw new WazFail('quox wazuh connect: --url must be an https:// URL (the credential is sent to it)');
         if (options.indexerUrl && !/^https:\/\/[^\s/]+/.test(options.indexerUrl)) throw new WazFail('quox wazuh connect: --indexer-url must be an https:// URL');
         if (!['auto', 'direct', 'host'].includes(options.transport)) throw new WazFail('quox wazuh connect: --transport must be auto, direct or host');
+        if (options.indexerPasswordStdin && !options.indexerUser) throw new WazFail('quox wazuh connect: --indexer-password-stdin needs --indexer-user <user>');
+        // quox#1588: the CA file is read and checked BEFORE anything is prompted or saved.
+        const indexerCa = options.indexerCa ? readIndexerCa(String(options.indexerCa)) : null;
+        // quox#1588: stdin is read once; line 1 = API password (--password-stdin), the next = indexer password.
+        let stdinLines = null;
+        if (options.passwordStdin || options.indexerPasswordStdin) {
+          const text = String((await readStdin()) || '');
+          stdinLines = text.split(/\r?\n/).map((l) => l.trim());
+          if (!stdinLines.some(Boolean)) throw new WazFail('quox wazuh connect: --password-stdin / --indexer-password-stdin given but stdin was empty');
+        }
+        const fromStdin = (what) => {
+          const v = stdinLines.shift();
+          if (!v) throw new WazFail(`quox wazuh connect: stdin had no ${what} line (send the API password on line 1 and the indexer password on line 2 when both stdin flags are set)`);
+          return v;
+        };
+        const apiPassword = options.passwordStdin ? fromStdin('API password') : null;
+        const indexerPassword = options.indexerPasswordStdin ? fromStdin('indexer password') : null;
         const orgId = resolveOrgId(auth, program);
         const listEp = resolveEndpoint('vault.list', { orgId });
         let existing;
@@ -795,12 +859,13 @@ export function attachWazuhConnect(wazuh, program, ctx) {
         } catch (err) { throw failFrom('connect', listEp.method, listEp.path, err); }
 
         const credentials = { base_url: options.url, username: options.user };
-        credentials.password = await promptSecret(`Wazuh API password for ${options.user}`);
+        credentials.password = apiPassword || await promptSecret(`Wazuh API password for ${options.user}`);
         if (options.indexerUser) {
           credentials.indexer_username = options.indexerUser;
-          credentials.indexer_password = await promptSecret(`Wazuh indexer password for ${options.indexerUser}`);
+          credentials.indexer_password = indexerPassword || await promptSecret(`Wazuh indexer password for ${options.indexerUser}`);
         }
         if (options.indexerUrl) credentials.indexer_url = options.indexerUrl;
+        if (indexerCa) credentials.indexer_ca = indexerCa;
         credentials.indexer_transport = options.transport;
 
         const verb = existing ? 'update' : 'create';

package/lib/commands/wazuhIntake.js

@@ -25,11 +25,19 @@ import { relDuration } from './kuma.js';
 
 const RUNBOOK = 'docs/wazuh/custom-quox-integration.md';
 
+// WAZ-11: ARGUS's routing proposal from the verdict: what it proposes and the command a person runs to accept it.
+function proposalCell(p) {
+  if (!p || typeof p !== 'object' || !p.proposed_action) return 'none';
+  return `${p.proposed_action}${p.verdict ? ` (ARGUS verdict ${p.verdict})` : ''}${p.command ? `: ${p.command}` : ''}`;
+}
+
 // WAZ P7: compact context flags. A source that could not answer shows as SRC?, never as "nothing".
+// WAZ-11: a source the org never set up (context.not_configured, e.g. no Uptime Kuma) is left out, not SRC? on every row.
 const UNKNOWN_FLAG = { maintenance: 'MAINT?', kuma: 'KUMA?', deploys: 'DEPLOY?' };
 export function contextFlags(ctx) {
   if (!ctx || typeof ctx !== 'object') return '-';
-  const parts = [...(ctx.flags || []), ...(ctx.unavailable || []).map((s) => UNKNOWN_FLAG[s] || `${String(s).toUpperCase()}?`)];
+  const skip = new Set(Array.isArray(ctx.not_configured) ? ctx.not_configured : []);
+  const parts = [...(ctx.flags || []), ...(ctx.unavailable || []).filter((s) => !skip.has(s)).map((s) => UNKNOWN_FLAG[s] || `${String(s).toUpperCase()}?`)];
   return parts.length ? parts.join(' ') : '-';
 }
 
@@ -210,6 +218,10 @@ export function registerWazuhIntake(wazuh, { client, auth, jsonOut, guard, WazFa
   }
 
   // ---- incidents ----
+  // WAZ P11: the governance incident a level >= notify-level Wazuh incident opened (shared lifecycle: status, assignee, tickets).
+  const governanceCell = (i) => (i.governance_incident_id
+    ? `${i.governance_incident_id} (${i.governance_incident && i.governance_incident.status ? i.governance_incident.status : 'status unavailable'})`
+    : '-');
   const ago = (iso) => { const t = Date.parse(iso); return Number.isFinite(t) ? relDuration(Date.now() - t).replace(/ /g, '') : (iso || '-'); };
 
   const incidents = example(wazuh.command('incidents')
@@ -223,16 +235,42 @@ export function registerWazuhIntake(wazuh, { client, auth, jsonOut, guard, WazFa
       if (bad(data) || !Array.isArray(data.incidents)) throw errBody('incidents', ep, data, 'response had no incidents array');
       if (jsonOut()) { console.log(JSON.stringify(data, null, 2)); return; }
       const openN = data.incidents.filter((i) => i.open).length;
-      head('incidents', `${data.incidents.length} shown · ${openN} open`, openN ? 'warn' : 'ok');
-      if (!data.incidents.length) return;
+      // WAZ-11: governance incidents still open/investigating after their Wazuh side went quiet (additive; the same
+      // section ARGUS's wazuh_incidents returns, so the CLI and chat count the same).
+      const q = data.quiet_still_open && typeof data.quiet_still_open === 'object' ? data.quiet_still_open : null;
+      const qRows = q && Array.isArray(q.incidents) ? q.incidents : [];
+      const qUnknown = !!(q && q.count === null);
+      const qN = qRows.length;
+      const qHead = qUnknown ? ' · gov-open: unknown' : (qN ? ` · ${qN} gov-open (quiet)` : '');
+      head('incidents', `${data.incidents.length} shown · ${openN} open${qHead}`, openN || qN || qUnknown ? 'warn' : 'ok');
+      const printQuiet = () => {
+        if (qUnknown) { console.log(`\nstill open in governance: unknown (${q.error || 'the collector could not read it'})`); return; }
+        if (!qN) return;
+        // WAZ-11 (audit batch 5, NEW-D a): VERDICT, ARGUS's triage verdict of the Wazuh incident ('-' = not triaged).
+        const qr = [['GOVERNANCE', 'STATUS', 'SEVERITY', 'ASSIGNED', 'WAZUH', 'CLOSED AS', 'CLOSED', 'AGENT', 'RULE', 'VERDICT']];
+        for (const g of qRows) {
+          qr.push([g.id, g.status, g.severity, g.assigned_to || '-', g.wazuh_incident_id || '-', g.wazuh_close_reason || '-', ago(g.wazuh_closed_at),
+            g.agent_name || g.agent_id || '-', g.rule_id || '-', g.verdict || '-']);
+        }
+        console.log(`\n${q.label || 'Wazuh went quiet; still open in governance'} (${qN}):`);
+        console.log(pad(qr).join('\n'));
+        console.log('Resolve or claim: quox monitoring incidents claim <id> | quox monitoring incidents status <id> resolved --resolution "<what was done>"');
+      };
+      if (!data.incidents.length) { printQuiet(); return; }
       // WAZ P7: CONTEXT (MAINT / KUMA-DOWN / DEPLOYED, SRC? when a source could not answer) when the collector sent it.
       const withCtx = data.incidents.some((i) => i.context);
-      const rows = [['ID', 'STATE', 'LEVEL', 'AGENT', 'RULE', 'DESCRIPTION', 'COUNT', 'LAST SEEN', 'MITRE', ...(withCtx ? ['CONTEXT'] : [])]];
+      // WAZ P11: GOVERNANCE (the linked governance incident id + its status) when any incident is linked.
+      const withGov = data.incidents.some((i) => i.governance_incident_id);
+      // WAZ P11 1c: VERDICT (ARGUS's rule-based first pass: noise / fix_needed / security_event) when any incident has one.
+      const withVerdict = data.incidents.some((i) => i.triage && i.triage.verdict);
+      const rows = [['ID', 'STATE', 'LEVEL', 'AGENT', 'RULE', 'DESCRIPTION', 'COUNT', 'LAST SEEN', 'MITRE', ...(withCtx ? ['CONTEXT'] : []), ...(withGov ? ['GOVERNANCE'] : []), ...(withVerdict ? ['VERDICT'] : [])]];
       for (const i of data.incidents) {
         rows.push([i.id, i.open ? 'open' : `closed${i.close_reason === 'quiet' ? ' (quiet)' : ''}`, i.level, i.agent_name || i.agent_id, i.rule_id,
-          String(i.rule_description || '-').slice(0, 60), i.count ?? '-', ago(i.last_seen), (i.mitre_ids || []).join(',') || '-', ...(withCtx ? [contextFlags(i.context)] : [])]);
+          String(i.rule_description || '-').slice(0, 60), i.count ?? '-', ago(i.last_seen), (i.mitre_ids || []).join(',') || '-', ...(withCtx ? [contextFlags(i.context)] : []),
+          ...(withGov ? [governanceCell(i)] : []), ...(withVerdict ? [(i.triage && i.triage.verdict) || '-'] : [])]);
       }
       console.log(pad(rows).join('\n'));
+      printQuiet();
     })), 'quox wazuh incidents --open --since 24h');
 
   example(incidents.command('show')
@@ -256,12 +294,23 @@ export function registerWazuhIntake(wazuh, { client, auth, jsonOut, guard, WazFa
           ? `no: suppressed, host was in a Kuma maintenance window (${(i.suppressed.monitors || []).join(', ') || 'monitor'})`
           : 'no (digest only)')],
         ['Log', i.log_snippet || '-'],
+        ['Governance', governanceCell(i)],
+        ['Verdict', i.triage && i.triage.verdict ? `${i.triage.verdict} (ARGUS rule-based first pass, no model)` : 'not triaged (set when a governance incident is opened)'],
+        ...(i.triage && Array.isArray(i.triage.reasons) && i.triage.reasons.length ? [['Why', i.triage.reasons.join('; ')]] : []),
+        ['Proposal', proposalCell(i.proposal)],
         ...contextRows(i.context),
       ];
       const dg = i.diagnosis;
       rows.push(['Diagnosis', dg ? `${dg.status} (${dg.trigger || dg.mode || 'manual'}) ${dg.summary || ''}`.trim() : `not run (quox wazuh incidents diagnose ${i.id})`]);
       const es = i.escalation;
-      rows.push(['Escalated', es && es.finding_id ? `finding ${es.finding_id} in engagement ${es.engagement_id}${es.engagement_name ? ` (${es.engagement_name})` : ''}` : `no (quox wazuh incidents escalate ${i.id})`]);
+      // WAZ-11 (audit batch 5, N3): two different escalations, labelled apart. Escalated = sent to QuoxSecurity as a
+      // finding; Unowned = the governance incident's own flag (escalated because nobody claimed it).
+      rows.push(['Escalated', es && es.finding_id ? `finding ${es.finding_id} in engagement ${es.engagement_id}${es.engagement_name ? ` (${es.engagement_name})` : ''}: sent to QuoxSecurity (${es.finding_id})` : `not sent to QuoxSecurity (quox wazuh incidents escalate ${i.id})`]);
+      if (typeof i.governance_unowned_escalated === 'boolean') {
+        rows.push(['Unowned', i.governance_unowned_escalated
+          ? `unowned-escalated (nobody claimed ${i.governance_incident_id} in time: inbox item + LUCID ask; claim it: quox monitoring incidents claim ${i.governance_incident_id})`
+          : 'not unowned-escalated']);
+      }
       if (!i.open) rows.push(['Closed', `${i.closed_at}${i.closed_by ? ` by ${i.closed_by}` : ''}${i.close_reason ? `: ${i.close_reason}` : ''}`]);
       console.log(pad(rows).join('\n'));
       if (dg) printChecks(dg, pad);

package/lib/core/commandRegistrars.js

@@ -56,6 +56,7 @@ export const COMMAND_REGISTRARS = [
   ['../commands/file.js', 'registerFileCommands'],
   ['../commands/evidence.js', 'registerEvidenceCommands'],
   ['../commands/admin.js', 'registerAdminCommands'],
+  ['../commands/mcp.js', 'registerMcpCommands'],
   ['../commands/aee.js', 'registerAeeCommands'],
   ['../commands/integration.js', 'registerIntegrationCommands'],
   ['../commands/consent.js', 'registerConsentCommands'],
@@ -114,6 +115,7 @@ export const COMMAND_REGISTRARS = [
   ['../commands/awareness.js', 'registerAwarenessCommands'],
   ['../commands/mind.js', 'registerMindCommands'],
   ['../commands/lucid.js', 'registerLucidCommands'],
+  ['../commands/lens.js', 'registerLensCommands'],
   ['../commands/hyperion.js', 'registerHyperionCommands'],
   ['../commands/tg.js', 'registerTgCommands'],
   ['../commands/dev.js', 'registerDevCommands'],

package/lib/core/config.js

@@ -41,6 +41,15 @@ function acquireLock(lockFile) {
 function releaseLock(lockFile) { try { unlinkSync(lockFile); } catch { /* already gone */ } }
 const J = (v) => JSON.stringify(v === undefined ? null : v);
 
+function envTokenExpiryMs(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(String(token).split('.')[1], 'base64url').toString('utf8'));
+    return typeof payload.exp === 'number' ? payload.exp * 1000 : null;
+  } catch {
+    return null;
+  }
+}
+
 const DEFAULT_CONFIG = {
   version: 1,
   activeProfile: 'local',
@@ -417,7 +426,11 @@ export function loadConfig(profileOverride) {
     getAuth() {
       // Env var override
       if (process.env.QUOX_TOKEN) {
-        return { access_token: process.env.QUOX_TOKEN };
+        // The JWT's own exp is the env token's expiry. Without it auth.isExpired() read every env
+        // token as expired and tried a refresh there is no refresh token for (the dashboard /cli
+        // browser terminal then opened the conversation app signed out). Not verification: the server verifies.
+        const exp = envTokenExpiryMs(process.env.QUOX_TOKEN);
+        return exp ? { access_token: process.env.QUOX_TOKEN, expires_at: exp } : { access_token: process.env.QUOX_TOKEN };
       }
       return this.getActiveProfile()?.auth || null;
     },

package/lib/core/offload.js

@@ -501,6 +501,89 @@ export async function workerStatus(deps) {
   };
 }
 
+// 2026-11-07: three worker leases expired overnight with no warning and the nightly suite died on the human-lease
+// error. Every offload command now warns inside this window, and status/leases list every configured worker.
+export const LEASE_WARN_H = 12;
+const STATE_FILE_RE = /^offload(?:-([a-z0-9][a-z0-9-]{0,31}))?\.json$/;
+
+/** Configured workers from the state files: '' is the shared default, then named ones sorted. */
+export function listWorkerNames(deps) {
+  let files = [];
+  try { files = deps.fs.readdirSync(configDir(deps.home)); } catch { return []; }
+  const names = [];
+  for (const f of files) {
+    const m = STATE_FILE_RE.exec(f);
+    if (m) names.push(m[1] || '');
+  }
+  return names.sort((a, b) => (a === '' ? -1 : b === '' ? 1 : a.localeCompare(b)));
+}
+
+/** Lease state for an expiry timestamp: EXPIRED, EXPIRING (within LEASE_WARN_H), OK, or UNKNOWN. */
+export function leaseInfo(expiresAt, now) {
+  const t = expiresAt ? Date.parse(expiresAt) : NaN;
+  if (!Number.isFinite(t)) return { lease: 'UNKNOWN', hours_left: null };
+  const hours = Math.round(((t - now) / 3600000) * 10) / 10;
+  if (t <= now) return { lease: 'EXPIRED', hours_left: hours };
+  return { lease: hours <= LEASE_WARN_H ? 'EXPIRING' : 'OK', hours_left: hours };
+}
+
+/** What a HUMAN runs to renew: there is no lease-extend verb, so lease a fresh worker (the old one is released after). */
+export function renewCommand(name) {
+  return `quox -p <human-profile> offload --fresh${name ? ` --worker ${name}` : ''} -- true`;
+}
+
+const fmtLeft = (h) => (Math.abs(h) < 1 ? `${Math.round(Math.abs(h) * 60)}m` : `${Math.round(Math.abs(h))}h`);
+export function describeLease(l) {
+  if (l.lease === 'EXPIRED') return l.hours_left == null ? 'EXPIRED (the pool no longer holds it)' : `EXPIRED ${fmtLeft(l.hours_left)} ago`;
+  if (l.lease === 'EXPIRING' || l.lease === 'OK') return `${l.lease}, expires in ${fmtLeft(l.hours_left)}`;
+  return l.lease;
+}
+
+function leaseEntry(name, st, live, now) {
+  const base = { worker: name || 'default', vmid: null, ip: null, lessee: null, pool_state: null, lease_expires_at: null, lease: 'NONE', hours_left: null, renew: null };
+  if (!st.worker) return base;
+  const expires = live?.lease_expires_at || st.worker.expires || null;
+  let info = leaseInfo(expires, now);
+  const pool = live === undefined ? 'unknown' : live ? live.state : 'missing';
+  // The pool is the truth when it answered: a VM it no longer holds (or holds for someone else) is gone.
+  if (live === null || (live && (live.state !== 'leased' || (st.worker.lessee && live.lessee && live.lessee !== st.worker.lessee)))) {
+    info = { lease: 'EXPIRED', hours_left: info.lease === 'EXPIRED' ? info.hours_left : null };
+  }
+  return {
+    ...base, vmid: st.worker.vmid, ip: live?.ip || st.worker.ip || null, lessee: st.worker.lessee || null,
+    pool_state: pool, lease_expires_at: expires, ...info,
+    renew: info.lease === 'EXPIRED' || info.lease === 'EXPIRING' ? renewCommand(name) : null,
+  };
+}
+
+/**
+ * Every configured worker's lease. `live: true` asks the pool once (a failure is reported, the cached expiry is
+ * used); `live: false` reads only the local state files (the pre-run warning must not add a pool call).
+ * Read-only: never leases, renews or releases.
+ */
+export async function allLeases(deps, { live = true } = {}) {
+  const now = deps.now();
+  let pool = null; let poolErr = null;
+  if (live) {
+    try { pool = await poolStatus(deps.rest); } catch (e) { poolErr = String(e?.message || e); }
+  }
+  const leases = listWorkerNames(deps).map((name) => {
+    const st = loadState({ ...deps, worker: name || undefined });
+    const v = pool && st.worker ? vmOf(pool, st.worker.vmid) : undefined;
+    return leaseEntry(name, st, v, now);
+  });
+  return {
+    checked_at: new Date(now).toISOString(), warn_within_h: LEASE_WARN_H, source: pool ? 'pool' : 'cache',
+    ...(poolErr ? { pool_error: poolErr } : {}),
+    any_attention: leases.some((l) => l.renew), leases,
+  };
+}
+
+/** One line per expired or expiring lease, naming the command a human runs. */
+export function leaseWarnings(report) {
+  return report.leases.filter((l) => l.renew).map((l) => `warning: worker ${l.worker} (vm ${l.vmid}) lease ${l.lease === 'EXPIRED' ? describeLease(l) : `expires in ${fmtLeft(l.hours_left)} (${l.lease_expires_at})`}; leasing needs a human, who renews it with: ${l.renew}`);
+}
+
 /** Real side effects. */
 export function realDeps({ rest, env = process.env, log = (m) => process.stderr.write(`offload: ${m}\n`) }) {
   return {

package/lib/core/output.js

@@ -12,7 +12,8 @@ import Table from 'cli-table3';
  * Format and print tabular data
  *
  * @param {Object} result - { columns, headers, rows } or array of objects
- * @param {Object} options - { format, title, emptyMessage, full } (full: no 60-char cell truncation in table mode)
+ * @param {Object} options - { format, title, emptyMessage, full, fit } (full: no 60-char cell truncation in table mode;
+ *   fit: { width, flex } opt-in, shortens the `flex` column with an ellipsis so each table line fits `width`)
  */
 export function formatOutput(result, options = {}) {
   const format = options.format || getOutputFormat();
@@ -167,9 +168,9 @@ function formatTable(rows, columns, headers, options) {
     },
   });
 
-  for (const row of rows) {
-    table.push(columns.map(col => formatValue(row[col], options.full === true)));
-  }
+  const cells = rows.map(row => columns.map(col => formatValue(row[col], options.full === true)));
+  if (options.fit) fitCells(cells, columns, headers, options.fit);
+  for (const r of cells) table.push(r);
 
   console.log(table.toString());
 
@@ -179,6 +180,30 @@ function formatTable(rows, columns, headers, options) {
   }
 }
 
+// eslint-disable-next-line no-control-regex
+const ANSI = /\x1b\[[0-9;]*m/g;
+const visibleLength = (s) => [...String(s).replace(ANSI, '')].length;
+
+/**
+ * Opt-in width fitting (fit: { width, flex }). cli-table3 here pads each cell by 1 on both sides and joins
+ * cells with a 2-space middle, so a line is sum(w + 2) + 2 * (n - 1). When that passes `width`, the `flex`
+ * column is cut to the remaining room with an ellipsis instead of letting the terminal wrap the row
+ * (owner 2026-11-07: wrapped `quox actions list` rows in the 73-column TUI).
+ */
+function fitCells(cells, columns, headers, { width, flex } = {}) {
+  const w = Number(width);
+  const fi = columns.indexOf(flex);
+  if (!(w > 0) || fi < 0) return;
+  const widths = columns.map((_, i) => Math.max(visibleLength(headers[i] ?? ''), ...cells.map(r => visibleLength(r[i]))));
+  const total = widths.reduce((a, b) => a + b + 2, 0) + 2 * (columns.length - 1);
+  if (total <= w) return;
+  const room = Math.max(visibleLength(headers[fi] ?? ''), 8, widths[fi] - (total - w));
+  for (const r of cells) {
+    const plain = String(r[fi]).replace(ANSI, '');
+    if ([...plain].length > room) r[fi] = [...plain].slice(0, room - 1).join('').trimEnd() + '…';
+  }
+}
+
 function formatCsv(rows, columns, headers) {
   console.log(headers.map(csvEscape).join(','));
   for (const row of rows) {

package/lib/core/selfUpdate.js

@@ -20,6 +20,7 @@ import os from 'node:os';
 import { RUNNING_ROOT, findOnPath } from '../quoxon/slash/restart.js';
 import { cmpSemver } from '../server/install.js';
 import { askText } from '../quoxon/ask.js';
+import { isWebPty, SHELL_REFUSED } from '../quoxon/webPty.js';
 
 export const NPM_PACKAGE = 'quoxcli';
 export const NOTES_MAX = 5;
@@ -146,6 +147,7 @@ export async function checkUpdate(info, { deps = {} } = {}) {
 
 /** Run the update with the terminal handed over (prompts, sudo). -> { ok, code } or { ok:false, error } */
 export function runUpdate(plan, { spawn = spawnSync, env = process.env } = {}) {
+  if (isWebPty(env)) return { ok: false, error: SHELL_REFUSED }; // QUOXON web PTY: no npm/sudo on the server
   const r = spawn(plan.command.cmd, plan.command.args, { stdio: 'inherit', env });
   if (r.error) return { ok: false, error: `${r.error.code || 'failed'}: ${r.error.message}` };
   const code = r.status ?? (r.signal ? 128 + (os.constants.signals[r.signal] || 0) : 1);