quoxcli 0.6.0 → 0.6.1

package/lib/commands/research.js

@@ -5,9 +5,20 @@
  * Stored as the org setting RESEARCH_TRUSTED_DOMAINS through the SAME governed settings path as
  * `quox settings set` (PATCH /api/v1/platform/settings/flags/:key, human org admin, witnessed there).
  * Unset or empty means the built-in default list, which add/remove seed from so a first edit never drops it.
+ *
+ * quox research ask "<question>" [--save [--collection <name>]]
+ *
+ * Asks the research agent (registry id `perplexity`, the agent holding the governed web_search/web_read
+ * tools) through the SAME governed chat-turn route as `quox chat --agent perplexity --no-stream`
+ * (POST /chat/claude, Prefer: respond-async, polled at /chat/turns/:id). --save writes the answer and its
+ * sources as a NotesQ note through the same create route as `quox notes new`.
+ * Sources are the URLs the agent cited in its answer: the chat route returns tool names, not tool results,
+ * so a URL the agent read but did not cite is not shown, and none is ever invented.
  */
 
 import { resolveEndpoint } from '../api/endpoints.js';
+import { QuoxError } from '../core/errors.js';
+import { sendOneShot } from './chat.js';
 
 const KEY = 'RESEARCH_TRUSTED_DOMAINS';
 
@@ -41,6 +52,25 @@ async function write(client, list) {
   return client.patch(ep.path, { service: ep.service, body: { value: list.join(',') } });
 }
 
+export const RESEARCH_AGENT = 'perplexity';
+
+/** URLs cited in an answer (bare or markdown links), trailing punctuation trimmed, first-seen order, deduped. */
+export function extractSources(text) {
+  const seen = new Set();
+  for (const m of String(text || '').matchAll(/https?:\/\/[^\s<>()\[\]"'`]+(?:\([^\s()]*\)[^\s<>()\[\]"'`]*)*/g)) {
+    const url = m[0].replace(/[.,;:!?*_]+$/, '');
+    if (url.length > 'https://'.length) seen.add(url);
+  }
+  return [...seen];
+}
+
+function noteMarkdown({ question, answer, sources, toolsUsed, agent }) {
+  const title = question.replace(/\s+/g, ' ').trim().slice(0, 120);
+  const src = sources.length ? sources.map((u) => `- ${u}`).join('\n') : '_No sources were returned for this answer: the agent cited no URL._';
+  return `# ${title}\n\n**Question:** ${question}\n\n${answer.trim()}\n\n## Sources\n\n_URLs cited in the answer. The research route does not report which pages were actually read; check the answer text._\n\n${src}\n\n---\n` +
+    `Asked with \`quox research ask\` (agent ${agent}) on ${new Date().toISOString()}. Tools called: ${toolsUsed.length ? toolsUsed.join(', ') : 'none'}.\n`;
+}
+
 export function registerResearchCommands(program, ctx) {
   const { client } = ctx;
   const r = program.command('research').description('Governed web research settings');
@@ -76,4 +106,52 @@ export function registerResearchCommands(program, ctx) {
       await write(client, next);
       process.stdout.write(`removed ${dom} (${next.length} entries, org setting)\n`);
     });
+
+  r.command('ask <question...>')
+    .description('Ask the research agent a question; prints the answer and the sources it cited (--save keeps it as a NotesQ note)')
+    .option('--save', 'save the answer and sources as a NotesQ note')
+    .option('--collection <name>', 'NotesQ collection for --save', 'research')
+    .action(async (words, options) => {
+      if (ctx.auth && ctx.auth.requireAuth) ctx.auth.requireAuth();
+      const question = words.join(' ').trim();
+      if (!question) throw new QuoxError('Ask a question: quox research ask "<question>"', 2);
+      const g = program.opts();
+      const json = g.output === 'json' || g.json === true;
+
+      const { data, sessionId } = await sendOneShot(client, { message: question, agent: RESEARCH_AGENT });
+      const raw = data && (data.result ?? data.response ?? data.text);
+      const answer = typeof raw === 'string' ? raw : '';
+      if (!answer.trim()) throw new QuoxError(`The research agent returned no answer${data && data.error ? ` (${data.error})` : ''}.`, 1);
+      const toolsUsed = Array.isArray(data.tools_used) ? [...new Set(data.tools_used.map((t) => (typeof t === 'string' ? t : t && (t.name || t.tool))).filter(Boolean))] : [];
+      const agent = data.agent_used || RESEARCH_AGENT;
+      const sources = extractSources(answer);
+
+      let note = null;
+      if (options.save) {
+        const ep = resolveEndpoint('notesq.notes.create');
+        const saved = await client.post(ep.path, {
+          service: ep.service,
+          body: { scope: 'org', markdown: noteMarkdown({ question, answer, sources, toolsUsed, agent }), properties: { collection: options.collection, tags: ['research'] } },
+        });
+        note = saved && saved.note;
+        if (!note || !note.id) throw new QuoxError('NotesQ returned no note id: the answer was not saved.', 1);
+      }
+
+      if (json) {
+        console.log(JSON.stringify({ question, agent, answer, sources, tools_used: toolsUsed, conversation_id: sessionId || null, note }, null, 2));
+        return;
+      }
+      console.log(answer.trim());
+      console.log('');
+      if (sources.length) {
+        console.log(`Sources (${sources.length} URLs cited in the answer; the route does not report which pages were actually read):`);
+        sources.forEach((u, i) => console.log(`  ${i + 1}. ${u}`));
+      } else {
+        console.log('Sources: none. The agent cited no URL in its answer.');
+      }
+      const ranSearch = toolsUsed.includes('web_search');
+      console.log(`Tools called: ${toolsUsed.length ? toolsUsed.join(', ') : 'none'}${ranSearch ? ' (called, not necessarily successful: read the answer)' : ' (web_search did not run on this turn)'}`);
+      if (agent !== RESEARCH_AGENT) console.log(`Answered by: ${agent}`);
+      if (note) console.log(`Saved note ${note.id} in collection ${options.collection}.`);
+    });
 }

package/lib/commands/settings.js

@@ -12,6 +12,7 @@
 import { formatOutput, formatDetail } from '../core/output.js';
 import { line as glyphLine, printEvent } from '../core/quoxglyph.js';
 import { resolveEndpoint } from '../api/endpoints.js';
+import { withStepUp } from '../core/stepUpPrompt.js';
 
 async function fetchFlags(client) {
   const ep = resolveEndpoint('v1.settings.list');
@@ -59,7 +60,12 @@ export function registerSettingsCommands(program, ctx) {
     .action(async (key, value) => {
       auth.requireAuth();
       const ep = resolveEndpoint('v1.settings.set', { key });
-      const data = await client.patch(ep.path, { service: ep.service, body: { value } });
+      // VULCAN: weakening an approval control (STEP_UP_ENFORCE off) needs a step-up PIN; the server
+      // decides, and withStepUp asks for the PIN on a hidden prompt and retries once (scope override).
+      const data = await withStepUp(
+        (headers) => client.patch(ep.path, { service: ep.service, headers, body: { value } }),
+        { client, orgId: auth.getOrgId?.(program.opts().org) || null, scope: 'override', io: ctx.stepUpIO, what: `Changing ${key}` },
+      );
       if (program.opts().output === 'json') {
         console.log(JSON.stringify(data, null, 2));
         return;

package/lib/commands/wazuh.js

@@ -380,6 +380,15 @@ export function attachWazuhVerbs(wazuh, program, ctx, { writes = true } = {}) {
       head('coverage', s.covered === null || s.covered === undefined ? 'fleet unknown' : `${s.covered} of ${s.fleet_hosts} covered`,
         degraded || s.missing_agent > 0 || s.disconnected > 0 ? 'warn' : 'ok');
       console.log([n(s.fleet_hosts, 'fleet hosts'), `${s.wazuh_agents} Wazuh agents`, n(s.covered, 'covered'), n(s.missing_agent, 'missing agent'), `${s.disconnected} disconnected`, n(s.no_vuln_inventory, 'without vulnerability inventory')].join(', '));
+      // WAZ-11 (audit batch 5, N4): an unknown fleet-side number always says why, on stdout beside the summary (the JSON
+      // carries the reason as fleet_note / fleet_error; the human line used to print "unknown" with no reason).
+      if (s.fleet_hosts === null || s.fleet_hosts === undefined || s.covered === null || s.covered === undefined) {
+        const why = data.fleet_note
+          || (data.fleet_error === 'fleet_not_permitted' ? 'this organisation is not permitted to compare against the server fleet on this Quox instance (fleet_not_permitted)' : '')
+          || (data.fleet_error ? `the fleet list could not be read (${data.fleet_error})` : '')
+          || 'the collector gave no reason';
+        console.log(`Fleet hosts and covered are unknown: ${why}`);
+      }
       if (data.fleet_error) console.error(`Fleet list could not be read (${data.fleet_error}); fleet-side numbers are unknown, not zero.`);
       if (data.vuln_error) console.error(`Vulnerability inventory could not be read (${data.vuln_error}); that section is unknown, not empty.`);
       const section = (title, list, cols, row) => {

package/lib/commands/wazuhIntake.js

@@ -246,10 +246,11 @@ export function registerWazuhIntake(wazuh, { client, auth, jsonOut, guard, WazFa
       const printQuiet = () => {
         if (qUnknown) { console.log(`\nstill open in governance: unknown (${q.error || 'the collector could not read it'})`); return; }
         if (!qN) return;
-        const qr = [['GOVERNANCE', 'STATUS', 'SEVERITY', 'ASSIGNED', 'WAZUH', 'CLOSED AS', 'CLOSED', 'AGENT', 'RULE']];
+        // WAZ-11 (audit batch 5, NEW-D a): VERDICT, ARGUS's triage verdict of the Wazuh incident ('-' = not triaged).
+        const qr = [['GOVERNANCE', 'STATUS', 'SEVERITY', 'ASSIGNED', 'WAZUH', 'CLOSED AS', 'CLOSED', 'AGENT', 'RULE', 'VERDICT']];
         for (const g of qRows) {
           qr.push([g.id, g.status, g.severity, g.assigned_to || '-', g.wazuh_incident_id || '-', g.wazuh_close_reason || '-', ago(g.wazuh_closed_at),
-            g.agent_name || g.agent_id || '-', g.rule_id || '-']);
+            g.agent_name || g.agent_id || '-', g.rule_id || '-', g.verdict || '-']);
         }
         console.log(`\n${q.label || 'Wazuh went quiet; still open in governance'} (${qN}):`);
         console.log(pad(qr).join('\n'));
@@ -302,7 +303,14 @@ export function registerWazuhIntake(wazuh, { client, auth, jsonOut, guard, WazFa
       const dg = i.diagnosis;
       rows.push(['Diagnosis', dg ? `${dg.status} (${dg.trigger || dg.mode || 'manual'}) ${dg.summary || ''}`.trim() : `not run (quox wazuh incidents diagnose ${i.id})`]);
       const es = i.escalation;
-      rows.push(['Escalated', es && es.finding_id ? `finding ${es.finding_id} in engagement ${es.engagement_id}${es.engagement_name ? ` (${es.engagement_name})` : ''}` : `no (quox wazuh incidents escalate ${i.id})`]);
+      // WAZ-11 (audit batch 5, N3): two different escalations, labelled apart. Escalated = sent to QuoxSecurity as a
+      // finding; Unowned = the governance incident's own flag (escalated because nobody claimed it).
+      rows.push(['Escalated', es && es.finding_id ? `finding ${es.finding_id} in engagement ${es.engagement_id}${es.engagement_name ? ` (${es.engagement_name})` : ''}: sent to QuoxSecurity (${es.finding_id})` : `not sent to QuoxSecurity (quox wazuh incidents escalate ${i.id})`]);
+      if (typeof i.governance_unowned_escalated === 'boolean') {
+        rows.push(['Unowned', i.governance_unowned_escalated
+          ? `unowned-escalated (nobody claimed ${i.governance_incident_id} in time: inbox item + LUCID ask; claim it: quox monitoring incidents claim ${i.governance_incident_id})`
+          : 'not unowned-escalated']);
+      }
       if (!i.open) rows.push(['Closed', `${i.closed_at}${i.closed_by ? ` by ${i.closed_by}` : ''}${i.close_reason ? `: ${i.close_reason}` : ''}`]);
       console.log(pad(rows).join('\n'));
       if (dg) printChecks(dg, pad);

package/lib/core/commandRegistrars.js

@@ -115,6 +115,7 @@ export const COMMAND_REGISTRARS = [
   ['../commands/awareness.js', 'registerAwarenessCommands'],
   ['../commands/mind.js', 'registerMindCommands'],
   ['../commands/lucid.js', 'registerLucidCommands'],
+  ['../commands/lens.js', 'registerLensCommands'],
   ['../commands/hyperion.js', 'registerHyperionCommands'],
   ['../commands/tg.js', 'registerTgCommands'],
   ['../commands/dev.js', 'registerDevCommands'],

package/lib/core/version.js

@@ -18,19 +18,32 @@ import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve } from 'node:path';
 
-export const BASE_VERSION = '0.6.0';
+export const BASE_VERSION = '0.6.1';
 
 // The CLI source root (…/cli). version.js lives at cli/lib/core/, so two
 // levels up is the tree whose HEAD identifies the running build.
 const CLI_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
-function git(args) {
+function rawGit(args) {
   return execFileSync('git', ['-C', CLI_ROOT, ...args], {
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'ignore'],
   }).trim();
 }
 
+// An npm install can sit inside SOMEONE ELSE'S git repo (~/.nvm is a git
+// clone), and `git -C` happily walks up to it. Git facts only count when the
+// enclosing repo actually tracks this CLI's own files; otherwise behave as a
+// plain-package install.
+let ownRepo;
+function git(args) {
+  if (ownRepo === undefined) {
+    try { rawGit(['ls-files', '--error-unmatch', 'lib/core/version.js']); ownRepo = true; } catch { ownRepo = false; }
+  }
+  if (!ownRepo) throw new Error('not a quox git worktree');
+  return rawGit(args);
+}
+
 /**
  * Human version string: "0.1.0 (7bac4f67, session/vulcan)" — or bare
  * "0.1.0" when git facts are unavailable. Unlike the drift check this never

package/lib/dragon/select.js

@@ -1,5 +1,5 @@
 /**
- * Dragon companions (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus): which one, whether to show it, and where its art lives.
+ * Dragon companions (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus, Janus, Archivist, Architect, Roady, Weaver): which one, whether to show it, and where its art lives.
  * Pure. The art, animation and activity reducer stay in quoxai/dragonlab (integration/companions-v1);
  * Quox only chooses and loads. See docs/dragons/COMPANION-UX.md for the decisions behind each rule.
  */
@@ -10,7 +10,7 @@ import { fileURLToPath } from 'node:url';
 export const VENDORED_DRAGONLAB = fileURLToPath(new URL('../../vendor/dragonlab', import.meta.url));
 
 /** Registry agent ids (and display names) to approved dragon. Others, including quox/commanderq, get none. */
-export const AGENT_DRAGON = Object.freeze({ lucid: 'lucid', hyperion: 'hyperion', atlas: 'hyperion', seer: 'seer', sentinel: 'sentinel', warden: 'sentinel', security_lead: 'drago', drago: 'drago', cipher: 'cipher', vulcan: 'vulcan', forge: 'vulcan', quoxperticus: 'quoxperticus' });
+export const AGENT_DRAGON = Object.freeze({ lucid: 'lucid', hyperion: 'hyperion', atlas: 'hyperion', seer: 'seer', sentinel: 'sentinel', warden: 'sentinel', security_lead: 'drago', drago: 'drago', cipher: 'cipher', vulcan: 'vulcan', forge: 'vulcan', quoxperticus: 'quoxperticus', janus: 'janus', archivist: 'archivist', architect: 'architect', roady: 'roady', weaver: 'weaver' });
 export const COMPANION_MODES = ['on', 'greeting', 'off'];
 /** One-line change: the owner decides this after his Mac check (docs/dragons/COMPANION-UX.md section 4). */
 export const DEFAULT_COMPANION_MODE = 'on';

package/lib/quoxon/app.js

@@ -691,7 +691,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     return () => clearInterval(id);
   }, []);
   // ---- QUOXON-MESH: slot chat (slotChat.js) ----------------------------------------------------------------
-  // Dragon companion (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus): attach state + real stream events; art and reducer live in dragonlab.
+  // Dragon companion (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus, Janus, Archivist, Architect, Roady, Weaver): attach state + real stream events; art and reducer live in dragonlab.
   const DC = React.useRef(null); DC.current ??= createCompanionController({ settings: () => api.settings?.() || {}, isTTY: Boolean(stdout?.isTTY), typing: () => B.current.text !== '', jobs: createDragonJobs({ reads: api.dragonReads || {}, context: () => ({ envelopeId: receiptMentions([...S.current.history, ...S.current.blocks])[0]?.value || null }) }) }); // each dragon's one job: a real read (dragon/jobs.js)
   const dispatchEv = (a) => { DC.current.tap(a); dispatch(markDelegationDragon(a, a?.ev?.tool === 'delegate_to_agent' && delegationDragonOn(api.settings?.() || {}, env))); }; // dragons on: CommanderQ's hand-off gets a static dragon
   // QLOOP-LIVE: live loop cards in the chat stream (loopCards.js). A card is held live (commitLimit) until its loop finishes.

package/lib/quoxon/commands.js

@@ -63,7 +63,7 @@ const ARGS = {
   broadcast: [{ after: [], choices: [{ value: '--slots', desc: 'only these slots, comma separated' }, { value: '--priority', desc: 'urgent shows red' }, { value: '--ack', desc: 'ask recipients to /ack' }, { value: '--active', desc: 'only sessions listening now; dormant are skipped' }, { value: '--dry-run', desc: 'with --active: list who would be reached, send nothing' }] }],
   send: [{ after: [], src: 'slots' }, { after: ['*'], src: 'files', of: 'partial' }],
   dragon: [
-    { after: [], choices: ['explain', 'ask', 'sleep', 'fly', 'hero', 'fire', 'classic', { value: 'companion', desc: 'the dragon beside an attached Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan or Quoxperticus' }] },
+    { after: [], choices: ['explain', 'ask', 'sleep', 'fly', 'hero', 'fire', 'classic', { value: 'companion', desc: 'the dragon beside an attached Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus, Janus, Archivist, Architect, Roady or Weaver' }] },
     { after: ['companion'], choices: [{ value: 'on', desc: 'on attach and key moments, then leaves' }, { value: 'greeting', desc: 'only on attach, then leaves' }, { value: 'off', desc: 'never on its own (/dragon shows it)' }, { value: 'status', desc: 'what is set and whether the art loads' }] }
   ],
   ext: [

package/lib/quoxon/dragonCompanion.js

@@ -1,5 +1,5 @@
 /**
- * Dragon companion for Quoxon (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus). The controller owns attach state and feeds REAL stream
+ * Dragon companion for Quoxon (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus, Janus, Archivist, Architect, Roady, Weaver). The controller owns attach state and feeds REAL stream
  * events to dragonlab's pure view (integration/companions-v1/view.mjs: the same reducer and renderer the CLI
  * uses). No art, state logic or timers are duplicated here; this file only decides, translates and lays out.
  * Decisions: docs/dragons/COMPANION-UX.md. The reducer never overwrites pending approvals or failures, but the host only SHOWS the dragon during a dwell (attach, key moment, invoke).
@@ -226,20 +226,33 @@ export function createCompanionController({ settings = () => ({}), env = process
       const mood = job?.mood === 'concerned' && !state.approvals.length ? 'concerned' : null;
       try { v = view.view(state, t, { cols, rows: big ? rows : 1, mood }); } catch { return null; }
       if (v.hidden) return null;
-      // One caption per trigger: "Attached." only on an attach; an invoke says who is here; an approval always says so.
-      let caption = v.caption;
-      const summonedCaption = summonCaption;
-      if (state.approvals.length) caption = 'Waiting for your approval.';
-      else if (job?.caption && !state.issue) caption = job.caption; // the dragon's job: a real read (jobs.js); an approval or a recorded failure still comes first
-      else if (state.phase === 'connecting') caption = trigger === 'attach' ? 'Attached.' : trigger === 'invoke' ? `${view.name} is here.` : v.caption;
-      if (summonedCaption && now() < showUntil) caption = summonedCaption; // a domain moment states its own fact
-      if (!big) return { kind: 'label', text: `${view.name}: ${caption}` };
+      // Owner, 2026-11-10: no caption by default. A caption only names a real event: an approval waiting, a failed step, a stream that
+      // ended with the outcome unknown, a job read that found something wrong, or a domain moment's own fact. Idle, arrival, generic
+      // work, power flourishes, mottos and calm job reads say nothing (the reducer's own captions are never shown).
+      const summonedCaption = summonCaption && now() < showUntil ? summonCaption : null; // a domain moment states its own fact
+      const caption = summonedCaption || eventCaption(state, job);
+      if (!big) return caption ? { kind: 'label', text: `${view.name}: ${caption}` } : null;
       if (!v.frame) { waitingFrame = true; return null; } // the first frame is still being drawn off the main thread: draw nothing rather than a gap
       return { kind: 'art', frame: v.frame, caption, name: view.name };
     },
   };
 }
 
+/**
+ * The only captions the companion shows: each names a real host event. -> string | null. Pure.
+ * Allowlist, in priority order: an approval waiting, a failed step (an error, a failed tool or turn, a denied approval), a stream that
+ * ended without a verified outcome, a job read that found something wrong. Anything else (idle, arrival, working, thinking, power
+ * flourishes, mottos, a calm job read) is null.
+ */
+export function eventCaption(state, job = null) {
+  if (!state) return null;
+  if (state.approvals?.length) return 'Waiting for your approval.';
+  if (state.issue || state.phase === 'error') return 'That step failed.';
+  if (state.phase === 'disconnected') return 'Stream ended, outcome unknown.';
+  if (job?.mood === 'concerned' && job.caption) return job.caption;
+  return null;
+}
+
 /** "/dragon companion <arg>" -> { text, tone, save?, refresh? }. Pure. */
 export function companionCommand(arg, { settings = {}, plan = null, artProblem = null } = {}) {
   // `invoke: true` = the host also plays the attached agent's dragon for a dwell (a status check is a call for the dragon too).
@@ -249,7 +262,7 @@ export function companionCommand(arg, { settings = {}, plan = null, artProblem =
     const mode = cur || plan?.mode || 'on';
     const now = plan?.enabled ? `showing ${plan.id}` : `not showing (${plan?.why || 'no agent attached'})`;
     if (artProblem && mode !== 'off') return { text: `Dragon companion: ${mode}, but the art can't be loaded so no dragon will show (${artProblem}). /dragon companion on|greeting|off.`, tone: 'warn' };
-    return { text: `Dragon companion: ${mode}, ${now}. /dragon companion on|greeting|off. Only Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan and Quoxperticus have dragons.`, invoke: true };
+    return { text: `Dragon companion: ${mode}, ${now}. /dragon companion on|greeting|off. Only Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus, Janus, Archivist, Architect, Roady and Weaver have dragons.`, invoke: true };
   }
   const m = normaliseMode(w);
   if (!m) return { text: `Usage: /dragon companion ${COMPANION_MODES.join('|')}|status`, tone: 'warn' };
@@ -270,8 +283,7 @@ export function DragonCompanionLive({ ctl, cols, rows }) {
   return h(Box, { flexDirection: 'row', marginTop: 1 },
     h(Box, { flexDirection: 'column', flexShrink: 0 }, ...snap.frame.map((r, k) => h(Text, { key: k, wrap: 'truncate' }, ...cellNodes(r, `dc${k}-`)))),
     h(Box, { flexDirection: 'column', paddingLeft: 2 },
-      h(Text, { bold: true }, snap.name.toUpperCase()),
-      h(Text, { wrap: 'wrap' }, snap.caption)));
+      ...(snap.caption ? [h(Text, { key: 'n', bold: true }, snap.name.toUpperCase()), h(Text, { key: 'c', wrap: 'wrap' }, snap.caption)] : [])));
 }
 
 /**

package/lib/quoxon/main.js

@@ -41,7 +41,7 @@ export async function main(argv = process.argv.slice(2)) {
   if (opts.errors.length) { early?.release(); process.stderr.write(`quox: ${opts.errors.join('; ')}\n${USAGE}\n`); process.exitCode = 1; return; }
   const cwd = process.cwd().replace(process.env.HOME || '\0', '~');
   const { resolveCliVersion } = await import('../core/version.js');
-  let version = '0.6.0';
+  let version = '0.6.1';
   try { version = resolveCliVersion?.() || version; } catch { /* keep default */ }
   if (opts.print) return mainPrint(opts);
   let replay = null;

package/lib/quoxon/onboarding/view.js

@@ -102,7 +102,7 @@ const Hint = ({ text, cols }) => h(Box, { paddingLeft: 2 }, h(Text, { color: c('
 
 // ---- the view ---------------------------------------------------------------------------------
 export function GettingStarted({
-  columns, version = '0.6.0', cwd = '', welcome = false, animateIntro, earlyInput = null,
+  columns, version = '0.6.1', cwd = '', welcome = false, animateIntro, earlyInput = null,
   journeyPath, dryRun = false, runner = null, preflightDeps, runChecks = runPreflight, findLocal = probeLocalQuox, findOllama = detectOllama,
   requestCredential, broker = null, finisher = null, onExit = () => {}, now = () => Date.now()
 }) {

package/lib/quoxon/slash/cliLeaves.json

@@ -23,6 +23,9 @@
 "admin retention cleanup":"write",
 "admin retention config":"write",
 "admin retention stats":"read",
+"admin scratch-orgs list":"read",
+"admin scratch-orgs mark":"never",
+"admin scratch-orgs unmark":"never",
 "admin service list":"read",
 "admin stats":"read",
 "admin users verify-email":"write",
@@ -142,6 +145,7 @@
 "build status":"read",
 "build targets":"read",
 "calendar agenda":"read",
+"calendar connections add":"never",
 "calendar coverage":"read",
 "calendar layers":"read",
 "calendar propose":"write",
@@ -338,7 +342,15 @@
 "fleet gpu":"read",
 "fleet host-update":"write",
 "fleet hosts":"read",
+"fleet hw events":"read",
+"fleet hw identify":"write",
+"fleet hw refresh":"read",
 "fleet ping":"write",
+"fleet recipe add":"write",
+"fleet recipe list":"read",
+"fleet recipe remove":"write",
+"fleet recipe run":"write",
+"fleet recipe show":"read",
 "fleet rehome-agent":"write",
 "fleet status":"read",
 "fleet summary":"read",
@@ -430,6 +442,10 @@
 "kuma status-incident publish":"write",
 "kuma status-incident resolve":"write",
 "kuma uptime":"write",
+"lens apply":"write",
+"lens list":"read",
+"lens panel":"write",
+"lens show":"read",
 "licence catalogue-sign":"never",
 "licence refresh":"write",
 "licence reissue":"never",
@@ -475,6 +491,8 @@
 "lucid goals show":"read",
 "lucid herald set":"write",
 "lucid herald test":"write",
+"lucid insights accept":"write",
+"lucid insights reject":"write",
 "lucid insights show":"read",
 "lucid insights status":"read",
 "lucid journal":"read",
@@ -760,6 +778,7 @@
 "quoxchat widgets":"read",
 "reach agent":"read",
 "reach unused":"read",
+"research ask":"write",
 "research domains add":"write",
 "research domains list":"read",
 "research domains remove":"write",

package/lib/quoxon/whatsnew.jsonl

@@ -174,3 +174,4 @@
 {"id":"quoxon-2026-11-07-offload-lease-warn","date":"2026-11-07T13:20:00Z","since":"0.4.0","title":"Offload warns before a worker lease runs out","shell":"quox offload leases","text":"quox offload status and the new quox offload leases list every offload worker with EXPIRED, EXPIRING or OK, and every offload command warns when a lease ends within 12 hours, naming the command a human runs to renew it."}
 {"id":"quoxon-2026-11-07-select-dot-whole-result","date":"2026-11-07T13:50:00Z","since":"0.4.0","title":"quox tool exec --select . returns the whole result","text":"A dot means the whole result, as in jq, so --select . (and count(.)) no longer fails with \"bad path\". Every other --select path works as before."}
 {"id":"quoxon-2026-11-08-walk-revalidate","date":"2026-11-08T04:55:00Z","since":"0.4.0","title":"A stopped walkthrough only lists what is still waiting","text":"When a walkthrough stops, the TUI asks the server again before listing what is still waiting, so questions answered from another window drop off the list. A held list is re-checked the same way before its first card. If the server cannot be reached, the list says it may be out of date."}
+{"id": "quoxon-2026-11-10-dragons-quiet-and-four-new", "date": "2026-11-10T16:00:00Z", "since": "0.4.0", "sha": "4a4a9b326", "title": "Dragons stay quiet, and four new companions", "text": "A companion dragon only shows a caption when something real happens: an approval waiting, a failed step, a status check that found a problem. Arriving, idling and working show no label. Janus has the original look back, and Archivist, Architect, Roady and Weaver now have their own dragons.", "try": "/attach agent:janus"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quoxcli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Quox: the conversational front door to your self-hosted AI agent control plane",
   "type": "module",
   "bin": {

package/vendor/dragonlab/SOURCE

@@ -1,4 +1,4 @@
 repo: quoxai/dragonlab
-commit: a4dda5ef12c417689768664022b8de1245794c56
-branch: integration/companions-vulcan-quoxperticus
-files: 66
+commit: ff114e97025be305b350e29de0d98220b66f77ce
+branch: design/janus-v5
+files: 112

package/vendor/dragonlab/design/architect/v2/architect-master.svg

@@ -0,0 +1,67 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 480">
+<title>Architect — ivory keeper of the Grand Design</title>
+<g id="far-wing">
+<path id="far-membrane" fill="#514763" d="M 349 305 C 379 203 436 103 533 53 C 499 117 499 174 546 210 Q 483 184 453 239 Q 409 225 383 293 Z"/>
+<path id="far-vault" fill="none" stroke="#b6a9c6" stroke-width="8" d="M 349 305 C 379 203 436 103 533 53 M 349 305 Q 444 164 533 53 M 349 305 Q 457 182 546 210"/>
+</g>
+<g id="near-wing">
+<path id="vaulted-membrane" fill="#6d647c" d="M 305 305 C 260 206 205 100 92 62 C 139 142 111 211 57 248 Q 128 218 162 273 Q 214 237 251 309 L 292 331 Z"/>
+<path id="wing-lit-panel" fill="#968a9f" d="M 305 305 Q 230 141 92 62 Q 189 162 176 237 Q 224 229 251 309 Z"/>
+<path id="vault-ribs" fill="none" stroke="#e5dcc8" stroke-width="9" d="M 305 305 C 260 206 205 100 92 62 M 305 305 Q 218 182 92 62 M 305 305 Q 197 155 57 248 M 305 305 Q 224 201 162 273"/>
+<path id="wing-tip" fill="#f3e8d0" d="M 92 62 Q 71 46 62 25 Q 69 61 103 84 Z"/>
+<path id="wing-violet-vein" fill="none" stroke="#a57ee1" stroke-width="4" d="M 295 304 Q 215 192 115 128"/>
+</g>
+<g id="tail">
+<path id="long-tail" fill="#8c8490" d="M 306 371 C 225 397 227 446 145 440 C 75 436 53 384 88 349 C 111 326 150 342 145 371 Q 136 388 121 382 Q 141 363 121 356 C 91 347 84 387 110 402 C 166 440 212 379 256 351 Z"/>
+<path id="tail-ivory-ridge" fill="none" stroke="#d7cfbd" stroke-width="7" d="M 287 374 C 219 406 212 430 154 428 C 106 428 77 397 92 367"/>
+<path id="tail-tip" fill="#c5acee" d="M 125 382 Q 146 381 146 359 Q 163 379 147 395 Z"/>
+</g>
+<g id="body">
+<path id="torso" fill="#8e8790" d="M 309 273 Q 351 258 379 289 Q 416 336 389 397 Q 348 430 285 409 Q 254 354 278 313 Z"/>
+<path id="breast" fill="#e8dfcd" d="M 340 285 Q 376 295 379 335 L 361 389 Q 331 408 307 383 L 303 333 Z"/>
+<path id="breast-scales" fill="none" stroke="#a8a1a4" stroke-width="5" d="M 312 329 Q 340 343 376 329 M 307 353 Q 335 369 370 353 M 313 377 Q 335 389 360 375"/>
+<path id="far-leg" fill="#625e6b" d="M 367 351 Q 404 344 405 379 L 401 413 L 446 423 Q 459 430 445 440 L 369 440 L 352 414 Z"/>
+<path id="near-haunch" fill="#a49ca2" d="M 292 343 Q 332 332 341 367 Q 340 392 320 409 L 344 430 L 332 442 L 258 441 Q 245 421 261 402 Q 253 363 292 343 Z"/>
+<path id="feet-claws" fill="#f4e9d2" d="M 270 425 L 258 444 L 280 436 L 293 424 L 289 443 L 310 436 L 323 424 L 321 442 L 344 436 M 389 425 L 377 443 L 398 437 L 413 425 L 411 443 L 431 437 L 443 426 L 442 440 L 458 433"/>
+<path id="shoulder" fill="#ded3c0" d="M 297 276 Q 314 261 331 284 L 332 313 Q 306 327 292 304 Z"/>
+</g>
+<g id="neck">
+<path id="swan-neck" fill="#c8c0b3" d="M 371 169 Q 401 190 380 228 C 363 258 333 261 345 304 L 304 321 Q 277 270 313 237 C 347 210 351 200 339 180 Z"/>
+<path id="throat" fill="#f2e9d5" d="M 374 187 Q 387 208 366 232 C 344 256 322 267 337 301 L 318 304 C 302 268 329 247 346 229 Q 370 207 360 190 Z"/>
+<path id="graphite-crest" fill="#575365" d="M 344 193 L 322 203 L 337 216 L 309 224 L 317 239 L 291 247 L 298 265 L 278 280 L 295 291 L 307 264 L 338 233 L 359 200 Z"/>
+</g>
+<g id="head">
+<path id="far-horn" fill="#c3b9ad" d="M 370 127 C 340 111 310 87 304 57 Q 331 86 389 103 Z"/>
+<path id="near-horn" fill="#f2e6cc" d="M 405 121 C 371 92 340 61 345 29 Q 359 66 425 97 Z"/>
+<path id="horn-bands" fill="none" stroke="#686171" stroke-width="6" d="M 354 65 L 366 57 M 372 85 L 386 75 M 329 89 L 339 81"/>
+<path id="skull" fill="#e9dfca" d="M 346 129 Q 359 105 390 112 Q 425 104 443 139 L 441 173 Q 428 204 392 207 L 353 184 Q 337 158 346 129 Z"/>
+<path id="ear" fill="#bdb2bd" d="M 351 139 L 313 120 Q 316 143 327 153 L 310 166 Q 340 181 359 164 Z"/>
+<path id="long-muzzle" fill="#f4ead7" d="M 413 164 Q 445 153 475 173 Q 490 183 478 194 L 433 210 Q 403 207 398 190 Z"/>
+<path id="mouth-opening" fill="#282633" d="M 412 193 Q 445 200 479 186 L 469 205 Q 440 222 417 208 Z"/>
+<path id="lower-jaw" fill="#c8bdad" d="M 414 207 Q 440 220 469 204 Q 455 228 429 225 L 404 208 Z"/>
+<path id="fang" fill="#fff4dd" d="M 434 200 L 445 199 L 441 210 Z"/>
+<path id="nostril" fill="#383340" d="M 465 177 Q 474 173 474 182 L 464 184 Z"/>
+<path id="brow-ridge" fill="none" stroke="#9f949b" stroke-width="5" d="M 356 133 Q 372 123 386 133 M 395 130 Q 414 121 430 134"/>
+</g>
+<g id="arms">
+<path id="far-arm" fill="#a59ba4" d="M 354 292 Q 377 277 398 301 L 427 331 L 478 335 L 501 326 L 516 334 L 503 351 L 421 355 L 382 329 Z"/>
+<path id="raised-arm" fill="#dfd4c2" d="M 328 289 Q 338 269 359 280 L 391 300 Q 421 298 447 268 L 470 244 L 487 247 Q 478 268 460 282 L 420 319 Q 393 336 368 316 Z"/>
+<path id="drawing-finger" fill="#f5e9d2" d="M 466 247 Q 480 225 502 225 L 527 233 L 523 242 L 499 238 L 485 251 L 502 253 L 499 264 L 478 263 Z"/>
+<path id="lower-fingers" fill="#f1e5d1" d="M 477 335 L 494 317 L 501 321 L 493 335 L 513 325 L 521 332 L 506 346 L 483 349 Z"/>
+<path id="armour-cuffs" fill="none" stroke="#686071" stroke-width="9" d="M 440 275 L 455 290 M 466 334 L 466 352"/>
+</g>
+<g id="design">
+<path id="seed" fill="#e6caff" d="M 548 226 L 555 233 L 548 240 L 541 233 Z"/>
+<path id="draft-plane" fill="none" stroke="#9165c5" stroke-width="5" d="M 541 354 L 614 325 L 692 354 L 616 390 Z M 577 369 L 650 339 M 577 340 L 652 372"/>
+<path id="grand-arch" fill="none" stroke="#d0a4ff" stroke-width="6" d="M 563 349 L 563 301 Q 590 252 617 301 L 617 372 M 617 301 L 657 283 Q 683 292 683 320 L 683 349 M 563 301 L 603 283 Q 630 234 657 283"/>
+<path id="design-ribs" fill="none" stroke="#a07bd1" stroke-width="4" d="M 590 277 L 630 259 M 590 277 L 590 358 M 617 331 L 683 309 M 563 325 L 617 348"/>
+</g>
+<g id="eyes">
+<path id="far-eye-socket" fill="#080d19" d="M 349 151 C 349 136.08831175 359.745166 124 373 124 C 386.254834 124 397 136.08831175 397 151 C 397 165.91168825 386.254834 178 373 178 C 359.745166 178 349 165.91168825 349 151 Z"/>
+<path id="far-eye-white" fill="#ffffff" d="M 358.38 151 C 358.38 139.954305 364.9256 131 373.0 131 C 381.0744 131 387.62 139.954305 387.62 151 C 387.62 162.045695 381.0744 171 373.0 171 C 364.9256 171 358.38 162.045695 358.38 151 Z"/>
+<path id="far-pupil" fill="#282633" d="M 373 154 C 373 150.13400675 375.23857625 147 378 147 C 380.76142375 147 383 150.13400675 383 154 C 383 157.86599325 380.76142375 161 378 161 C 375.23857625 161 373 157.86599325 373 154 Z"/>
+<path id="near-eye-socket" fill="#080d19" d="M 382 150 C 382 132.87917275 394.98374225 119 411 119 C 427.01625775 119 440 132.87917275 440 150 C 440 167.12082725 427.01625775 181 411 181 C 394.98374225 181 382 167.12082725 382 150 Z"/>
+<path id="near-eye-white" fill="#ffffff" d="M 392.08 150 C 392.08 136.745166 400.5508 126 411.0 126 C 421.4492 126 429.92 136.745166 429.92 150 C 429.92 163.254834 421.4492 174 411.0 174 C 400.5508 174 392.08 163.254834 392.08 150 Z"/>
+<path id="near-pupil" fill="#282633" d="M 411 153 C 411 149.13400675 413.23857625 146 416 146 C 418.76142375 146 421 149.13400675 421 153 C 421 156.86599325 418.76142375 160 416 160 C 413.23857625 160 411 156.86599325 411 153 Z"/>
+</g>
+</svg>

package/vendor/dragonlab/design/architect/v2/character.mjs

@@ -0,0 +1,83 @@
+import {renderSvgRig} from '../../../factory/svg-rig-contour.mjs';
+export const ARCHITECT_CLIPS=Object.freeze([
+ {id:'idle',title:'Considering possibilities',duration:12000},
+ {id:'attach',title:'A first thought',duration:3000},
+ {id:'design',title:'Grand Design',duration:12000},
+ {id:'rethink',title:'Fold a possibility',duration:10000}
+]);
+export const STORY_DURATION=15000;
+const ease=x=>{x=Math.max(0,Math.min(1,x));return x*x*(3-2*x);};
+const pulse=(t,a,b)=>t<=a||t>=b?0:Math.sin(Math.PI*(t-a)/(b-a))**2;
+const mix=(a,b,u)=>a.map((c,i)=>Math.round(c+(b[i]-c)*u));
+
+export function poseRig(rig,scene,ms,{deck=false}={}){
+ if(scene==='design'&&ms>=12000)return poseRig(rig,'idle',ms-12000,{deck});
+ if(scene==='attach'&&ms>=3000)return poseRig(rig,'idle',ms-3000,{deck});
+
+ if(scene==='rethink'){
+  if(ms>=10000)return poseRig(rig,'idle',ms-10000,{deck});
+  if(ms>=8000)return poseRig(rig,'design',10000+ms-8000,{deck});
+  const base=poseRig(rig,'design',5200+4800*ease((ms-7400)/600),{deck});
+  const fold=pulse(ms,900,7400),angle=Math.PI*fold;
+  const paths=base.paths.filter(p=>p.id!=='design-ribs').map(p=>{
+   if(p.id!=='grand-arch')return p;
+   return {...p,rgb:mix(p.rgb,[246,220,255],fold),polygons:p.polygons.map((poly,i)=>i<2?poly:poly.map(([x,y])=>[617+(x-617)*Math.cos(angle),y+8*Math.sin(angle)]))};
+  });
+  return {...base,paths};
+ }
+ const active=scene==='design',t=active?ms:ms%12000;
+ const attention=active?pulse(t,0,11500):scene==='attach'?pulse(t,0,3000):.22*pulse(t,1500,7500);
+ const lift=active?ease((t-1800)/2600)*(1-ease((t-9500)/2500)):0;
+ const plane=ease((t-700)/1700)*(1-ease((t-10500)/1500));
+ const height=ease((t-2400)/2800)*(1-ease((t-10000)/1600));
+ const turn=.65*pulse(t,5200,8000);
+ const paths=[];
+ for(const p of rig.paths){
+  if(p.group==='design')continue;
+  const q={...p,polygons:p.polygons.map(poly=>poly.map(([x,y])=>{
+   if(p.group==='head'||p.group==='eyes')return [x+3*attention,y+5*attention];
+   if(p.group==='neck'){const w=Math.max(0,Math.min(1,(305-y)/105));return [x+3*attention*w,y+5*attention*w];}
+   if(p.group==='arms'){const w=Math.max(0,Math.min(1,(x-360)/170));return [x+7*attention*w,y+(y<300?-19*lift:6*lift)*w];}
+   if(p.group==='tail'){const w=Math.max(0,(260-x)/210);return [x,y-3*attention*w*w];}
+   return [x,y];
+  }))};
+  paths.push(q);
+ }
+ const seed=rig.paths.find(p=>p.id==='seed');
+ const seedTravel=active?plane:0;
+ paths.push({...seed,polygons:seed.polygons.map(poly=>poly.map(([x,y])=>[x+68*seedTravel,y+121*seedTravel]))});
+ if(active&&plane>.002){
+  const draft=rig.paths.find(p=>p.id==='draft-plane');
+  paths.push({...draft,polygons:draft.polygons.map(poly=>poly.map(([x,y])=>[616+(x-616)*plane,354+(y-354)*plane]))});
+  if(height>.002)for(const id of deck?['grand-arch','design-ribs']:['grand-arch']){
+   const p=rig.paths.find(p=>p.id===id);
+   const light=pulse(t,id==='grand-arch'?7900:8500,id==='grand-arch'?9900:10500);
+   paths.push({...p,rgb:mix(p.rgb,[255,243,225],light),polygons:p.polygons.map(poly=>poly.map(([x,y])=>{
+    const base=354+.12*(x-616),yy=base+(y-base)*height;
+    return [616+(x-616)*Math.cos(turn)+(yy-330)*Math.sin(turn)*.25,yy];
+   }))});
+  }
+  if(t>=8000&&t<10000){
+   // Light travels along the completed design, never outside its reserved space.
+   const u=(t-8000)/2000,x=563+120*u,y=354-74*Math.sin(Math.PI*u);
+   paths.push({id:'travelling-light',group:'effect',rgb:[255,244,230],stroke:0,erase:false,polygons:[[[x-4,y],[x,y-5],[x+4,y],[x,y+5]]]});
+  }
+ }
+ const map=new Map(paths.map(p=>[p.id,p]));
+ return {...rig,paths,eyes:rig.eyes.map(e=>({...e,socket:map.get(e.socket.id),white:map.get(e.white.id),pupil:map.get(e.pupil.id)}))};
+}
+export function renderArchitect(rig,scene='idle',ms=0,options={}){
+ if(!ARCHITECT_CLIPS.some(c=>c.id===scene))return {ok:false,code:'UNKNOWN_CLIP'};
+ if(!Number.isFinite(ms)||ms<0)return {ok:false,code:'INVALID_TIME'};
+ if(!options.still&&scene==='rethink'&&ms>=10000)return renderArchitect(rig,'idle',ms-10000,options);
+ if(!options.still&&scene==='design'&&ms>=12000)return renderArchitect(rig,'idle',ms-12000,options);
+ if(!options.still&&scene==='attach'&&ms>=3000)return renderArchitect(rig,'idle',ms-3000,options);
+ const t=options.still?({idle:0,attach:1500,design:6500,rethink:4200}[scene]):ms;
+ const caption=scene==='rethink'?(t<900?'Hold the design.':t<4200?'Fold a possibility through itself.':t<7400?'Consider it from the other side.':t<8000?'The shape of an idea.':'Fold the thought away.'):scene==='design'?(t<700?'A single possibility.':t<2400?'Stretch a plane of light.':t<5200?'Lift the Grand Design.':t<8000?'Turn it. Consider every angle.':t<10000?'Illuminate the connections.':'Fold the thought away.'):scene==='attach'?'An idea takes shape.':'Imagine. Shape. Illuminate.';
+ return {...renderSvgRig(poseRig(rig,scene,t,options),options),clip:scene,scene,caption};
+}
+export function renderStory(rig,ms,options={}){
+ if(!Number.isFinite(ms)||ms<0)return {ok:false,code:'INVALID_TIME'};
+ if(options.still)return renderArchitect(rig,'design',6500,options);
+ return ms<3000?renderArchitect(rig,'attach',ms,options):renderArchitect(rig,'design',ms-3000,options);
+}