@oxygen-agent/cli 1.1010.954 → 1.1011.21

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.1010.954
+Version: 1.1011.21

package/dist/command-manifest.js

@@ -28,6 +28,7 @@ const MUTATING_VERBS = new Set([
     "brand-approve", "revoke-invite", "confirm",
     // Exact leaf: `ugc creators set-target` writes one creator's posting deal.
     "set-target",
+    "infrastructure-exit",
     // `ugc creators decline` settles an application for good.
     "decline",
     "accept", "ack", "add", "adopt", "apply", "approve", "archive",

package/dist/index.js

@@ -27,6 +27,7 @@ import { addContractFlags } from "./contract-flags.js";
 import { buildSenderLimitsBody, parseWorkingDaysOption, SENDER_LIMITS_FLAG_OVERLAY } from "./sender-limits-flags.js";
 import { readColumnDecisionFlags } from "./column-decision-options.js";
 import { MANAGED_DATA_SUPPLIERS } from "@oxygen/shared/data-suppliers";
+import { COMPANY_REPLY_PAUSE_DEFAULT_STATUSES, COMPANY_REPLY_PAUSE_LEGACY_STATUSES, COMPANY_REPLY_PAUSE_STATUS_KEY_PATTERN, } from "@oxygen/shared/company-reply-pause";
 import { MAX_BUFFERED_IMPORT_PARSE_BYTES, assertImportFormatWithinBufferedLimit, inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, parseXlsxWorkbookBuffer, } from "@oxygen/shared/file-import";
 import { MAILBOX_IMPORT_FILE_MAX_BYTES as SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES, MAILBOX_IMPORT_ROW_LIMIT as SHARED_MAILBOX_IMPORT_ROW_LIMIT, normalizeMailboxImportFile as normalizeSharedMailboxImportFile, normalizeMailboxImportVendor as normalizeSharedMailboxImportVendor, normalizeMailboxWorkbookRows, parseMailboxImportText, summarizeMailboxImportValidation as summarizeSharedMailboxImportValidation, } from "@oxygen/shared/mailbox-import";
 import { assertRecipeBundleSafe, assertPortableWorkflowDefinition, assertWorkflowGraphManifest, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowGraphManifest, isWorkflowManifest, hashPortableWorkflowGraphManifest, WORKFLOW_GRAPH_COMPILER_VERSION, WORKFLOW_GRAPH_MANIFEST_VERSION, } from "@oxygen/workflows";
@@ -3685,9 +3686,9 @@ export function createProgram() {
     // `oxygen workspace map` sits beside `oxygen home` on purpose: home answers
     // "what needs me", the map answers "what is in here". Both are Control-surface
     // compositions over reads the primitives already own — neither is a primitive.
-    program
+    const workspaceCommand = program
         .command("workspace")
-        .description("Read what this workspace contains, across every primitive.")
+        .description("Inspect this workspace or end its managed external infrastructure.")
         .addCommand(new Command("map")
         .description("What this workspace actually contains: the newest tables, CRM objects, sequences, workflows, agents, wiki pages, posts and projects, each with its id, last activity, tags and link. Read-only, 0 credits. Capability search tells you what OXYGEN can do; this tells you what is here.")
         .option("--kind <kinds>", "Comma-separated kinds to include: table, crm_object, sequence, workflow, agent, knowledge_page, post, project.")
@@ -3714,6 +3715,22 @@ export function createProgram() {
             return data;
         });
     }));
+    workspaceCommand.addCommand(new Command("infrastructure-exit")
+        .description("Leave, close or offboard a workspace's managed external infrastructure in one action. Preview every renewing resource, then with --approved stop renewals and begin provider teardown through paid terms. Sending connections are disconnected; records and history remain. Requires an exact workspace confirmation and the fresh preview hash. Free, 0 credits.")
+        .option("--approved", "Begin the approved teardown.")
+        .option("--confirm <workspace>", "Echo the exact workspace slug or ID from the preview.")
+        .option("--plan-hash <hash>", "The plan_hash from the immediately preceding preview.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workspace infrastructure exit", options, () => requestOxygen("/api/cli/workspace/infrastructure/exit", {
+            method: "POST",
+            body: {
+                approved: options.approved === true,
+                confirm_workspace: options.confirm ?? null,
+                plan_hash: options.planHash ?? null,
+            },
+        }));
+    }));
     const ACTIVATION_DESCRIPTION = "Where this workspace stands in the prescribed activation play (inbound-led outbound) and the ONE thing to do next: each step's state, what blocks a blocked one, the exact CLI / MCP tool / API call for the next step, and an honest pacing note — LinkedIn is read on a metered drip and a sender's warm-up ramp, not the size of your list, sets how fast anyone is contacted. Read-only, 0 credits. Read the play itself with `oxygen recipes list --stage day-1 --json`.";
     // Bare `oxygen activation` is the spelling a founder guesses; `activation state`
     // is the exact name discovery routes to (it is a gatewayCommand of the
@@ -4729,7 +4746,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("get")
-        .description("Get one scheduled post with resolved media previews, its LinkedIn video cover, and attempt history. For an X post, publish_plan lists every post that will be sent, in order, with media, alt text, poll and reply settings (free); for a LinkedIn post that tags a company page, it shows the text sent, each company tag as its page id. Open web_url to preview the post as it will look on LinkedIn or X.")
+        .description("Get one scheduled post with resolved media previews, its LinkedIn video cover, and attempt history. For an X post, publish_plan lists every post that will be sent, in order, with media, alt text, poll and reply settings (free); for a LinkedIn post that tags a company page, it shows the text sent, each company tag as its page id, once `publishing posts approve` has resolved the tags (before approval it is absent). Open web_url to preview the post as it will look on LinkedIn or X.")
         .argument("<post_id>", "Scheduled post id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (postId, options) => {
@@ -11019,7 +11036,7 @@ Examples:
         await handleAsyncAction("billing balance", options, () => requestOxygen("/api/cli/billing/balance"));
     }))
         .addCommand(new Command("commitments")
-        .description("List the fixed monthly credit commitments blocked at your subscription renewal — per connected sending mailbox, OXYGEN-sold mailbox, warm-up, deliverability, connected LinkedIn, WhatsApp and X account, and rented phone number — with unit price, quantity, and next-due date. When your balance cannot cover an account's renewal, sending from that account pauses at once and it disconnects 7 days later (a phone number is released after 30): paused_quantity, past_due_since, disconnects_at and topup_url say which kind, since when and by when to top up; a top-up resumes it within minutes. This is the FORWARD run-rate: what your currently-connected resources will cost at their next renewal. It is NOT this cycle's charges — compare `billing allowance` fixed_spent_credits for that, and expect the two to differ. Each resource renews on its OWN anchor (the day it was connected), so next_due_at is per-resource and rarely lines up with the credit cycle. Read-only, 0 Oxygen credits.")
+        .description("List the fixed monthly credit commitments blocked at your subscription renewal — per connected sending mailbox, OXYGEN-sold mailbox, warm-up, deliverability, connected LinkedIn, WhatsApp and X account, and rented phone number — with unit price, quantity, and next-due date. When your balance cannot cover an account's renewal, sending from that account pauses at once and it disconnects 7 days later (a phone number is released after 30): paused_quantity, past_due_since, disconnects_at and topup_url say which kind, since when and by when to top up; a top-up resumes it within minutes. This is the FORWARD run-rate: what your currently-connected resources will cost at their next renewal. It is NOT this cycle's charges — compare `billing allowance` fixed_spent_credits for that, and expect the two to differ. Each resource renews on its OWN anchor (the day it was connected), so next_due_at is per-resource and rarely lines up with the credit cycle. The top-level count is the number of individual resource rows; the commitments list groups them by kind. A past next_due_at is an unpaid renewal still due. To stop all infrastructure renewals while retaining records, preview `workspace infrastructure-exit`; plan cancellation alone does not stop these resources. Read-only, 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing commitments", options, () => requestOxygen("/api/cli/billing/commitments"));
@@ -11211,7 +11228,7 @@ Examples:
         }));
     }))
         .addCommand(new Command("cancel")
-        .description("Schedule the plan subscription to cancel at period end. Free (no fee, no credits); the plan stays usable until then and the card is not charged again (during a trial, never). Prints the end date; undo any time before then with billing resume.")
+        .description("Schedule the plan subscription to cancel at period end. Free (no fee, no credits); the plan stays usable until then and the card is not charged again (during a trial, never). Separately funded external resources keep renewing; preview `workspace infrastructure-exit` if you want to end those too. Prints the end date; undo any time before then with billing resume.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing cancel", options, () => requestOxygen("/api/cli/billing/cancel", {
@@ -15193,7 +15210,7 @@ Examples:
         });
     })));
     program.addCommand(new Command("sequences")
-        .description("Multichannel outreach sequences: one enrollment per lead can span LinkedIn, email, WhatsApp, human call tasks, and connected-CRM tasks. LinkedIn steps dispatch natively (rate-limited, credit-capped); email steps send natively or place/move/stop the lead in a bound Instantly campaign (BYOK); crm_task can exact-match/upsert/link CRM records and create a mapped external follow-up (HubSpot first), with replay-safe per-operation receipts. Cross-channel reply-stop is intrinsic.")
+        .description("Multichannel outreach sequences: one enrollment per lead can span LinkedIn, email, WhatsApp, human call tasks, and connected-CRM tasks. LinkedIn steps dispatch natively (rate-limited, credit-capped); email steps send natively or place/move/stop the lead in a bound Instantly campaign (BYOK); crm_task can exact-match/upsert/link CRM records and create a mapped external follow-up (HubSpot first), with replay-safe per-operation receipts. A reply always stops that lead, on every channel. To also pause the replier's colleagues, set `--company-reply-pause` on `create`/`update` (pick the reply categories); to pause or resume a company by hand or from a workflow (e.g. a meeting was booked), use `pause-company` / `resume-company` / `paused-companies`. A pause is resumable; a company do-not-contact entry (`suppressions`) is a permanent block.")
         .addCommand(new Command("list")
         .description("List sequences with persisted launch status kept separate from current operational state. Fleet counts report marked-active versus operationally-live (active with nonterminal work), and rows explain flowing, paced, blocked, degraded, drained, or empty work without SQL. --stats joins each row's LIFETIME funnel.")
         .option("--status <status>", "Filter by status: draft, active, paused, or archived.")
@@ -15468,6 +15485,7 @@ Examples:
     }))
         .addCommand(new Command("create")
         .description("Create a draft multichannel sequence from a steps JSON file. Supports LinkedIn, email, WhatsApp, human call_task, and connected-CRM crm_task journeys. Assign LinkedIn senders with --senders (optional at create — a draft can sit senderless, but enroll/start require at least one for LinkedIn journeys). Native email sends through connected Google/Microsoft mailboxes, including Microsoft SMTP transport; optional --email-* flags bind an Instantly campaign. Install/read the oxygen-sequencer skill for complete mapped CRM task examples.")
+        .addHelpText("after", "\nEmail From: selected sender profiles rotate new leads across their inboxes; normal email steps stay with the lead's assigned inbox. In a draft email_send step, sender_mailbox_id chooses one exact inbox for that step. Give sender transitions, including the return to the assigned inbox, their own subject_template to start new threads.\n")
         .requiredOption("--name <name>", "Human-readable sequence name.")
         .requiredOption("--slug <slug>", "Unique slug for the sequence.")
         .requiredOption("--steps-file <path>", "Path to a JSON file: { \"steps\": [...] }. LinkedIn steps (visit_profile | invite | wait_for_connection | message | inmail | follow | like_post | comment_post | withdraw_invite), email steps (email_send | email_enroll | email_move | email_stop), WhatsApp (whatsapp_message), human call tasks (call_task), connected-CRM tasks (crm_task; channel crm; exact identity record_mappings + explicit create/update policy + record_links + dynamic task property_mappings/associations), and control steps (wait | wait_for_signal | branch | stop), each with an `id`. Copy templates support {{column}} interpolation from the lead's row, {{column|fallback}} inline fallbacks, deterministic spintax — {{RANDOM|a|b|c}} or industry-standard bare {Hi|Hey|Hello}, nestable like {Would {Tuesday|Thursday} work|next week?} — and {% if column %}…{% endif %} conditionals; a bare {…} region is spintax only when it contains a top-level |, so literal braces (CSS/JSON) pass through. Native email sends (email_send) also expose three reserved sender variables from the sending mailbox: {{sender_name}} (mailbox display name), {{sender_first_name}} (its first word), and {{sender_email}} (the from address); a row column of the same name WINS on collision, and a missing display name renders empty. comment_post takes text_template and/or ai_prompt — a KG-grounded comment generated at send time (a paid AI call) that falls back to text_template if generation fails. A `branch` routes on signals (then/else) or the legacy connection_accepted/already_connected/open_profile sugar (then_id/else_id). A signal condition can also branch on the LEAD'S DATA: a data leaf { has_column: \"email\" } is true when that row_values column has a non-empty value (add present:false for \"missing\") — e.g. route leads that have an email down an email arm and the rest down a LinkedIn arm. MINIMAL EMAIL STEP SHAPE: { \"id\": \"s1\", \"channel\": \"email\", \"kind\": \"email_send\", \"subject_template\": \"...\", \"body_template\": \"...\" } — body_template is REQUIRED on email_send; subject_template is OPTIONAL and is the one control that decides threading: give a step its own subject and it goes out as a NEW email, omit it and the step continues the lead's previous email in the same thread, going out as \"Re: <the previous email's subject>\" (what the retired email_reply kind used to be — still accepted on input, rewritten into this shape, and reported under `warnings` in the response). The FIRST email step of a sequence must carry a subject, since it has no earlier thread to continue. MINIMAL WHATSAPP STEP SHAPE: { \"id\": \"s1\", \"channel\": \"whatsapp\", \"kind\": \"whatsapp_message\", \"template\": \"Hi {{first_name|there}} …\" } — template is REQUIRED, and a live WhatsApp start also needs the sequence's --whatsapp-cold-initiate opt-in. A/B tests use an explicit `variants` array of copy partials on the step (up to 25 alternates, a–z; spintax varies wording INSIDE one variant and is not A/B-tracked). For the complete replay-safe crm_task upsert mapping shape, install/read the oxygen-sequencer skill.")
@@ -15503,7 +15521,8 @@ Examples:
         .option("--no-stop-on-bounce", "Keep a lead's enrollment running after a hard bounce (default: stop it). The bounce is still recorded as an email_bounced signal either way.")
         .option("--exclude-contacted", "Default every enroll into this sequence to cross-campaign exclusion — skip leads any OTHER active sequence is already contacting. A per-enroll `sequences enroll --exclude-contacted` / `--no-exclude-contacted` always overrides this default. Off by default.")
         .option("--no-exclude-contacted", "Turn the sequence-level exclude-contacted default back OFF (enrollments then exclude cross-campaign only when a call opts in).")
-        .option("--stop-on-reply-scope <scope>", "Native-email reply stop: 'lead' (default) stops the replying enrollment; 'company_domain' also stops active enrollments at the same non-freemail company domain.")
+        .option("--company-reply-pause <off|default|statuses>", "Pause the replier's company in this campaign when a reply has one of these statuses. Oxygen detects the company from work-email domains or explicit company fields; with no company identity, only the replier stops. New sequences start with this setting off. 'default' = interested,neutral,not_now,not_interested; or comma-separated Inbox status keys (`inbox labels list`); 'off' disables it. Read the saved setting with `sequences get`.")
+        .option("--stop-on-reply-scope <scope>", "(deprecated: use --company-reply-pause) 'company_domain' = --company-reply-pause interested,neutral,not_now,not_interested,wrong_person; 'lead' = off.")
         .option("--bounce-protection <json>", "Sequence bounce policy JSON (partial updates merge): enabled=true, warning_rate=.02, pause_rate=.03, min_sends=20, window_days=7. Hard bounces / accepted sends in the rolling window; pauses this sequence, not the fleet. Rates are fractions; mailbox protection is separate.")
         .option("--include-unsubscribe-headers", "Opt in to one-click unsubscribe headers (default off); visible link is separate.")
         .option("--no-include-unsubscribe-headers", "Omit one-click headers.")
@@ -15587,6 +15606,7 @@ Examples:
     }))
         .addCommand(new Command("update")
         .description("Update a sequence. Journey structure/channels/email binding are draft-only so revised scope receives a fresh launch approval; a started sequence may only re-time waits it already has (clear a delay by zeroing it, never by deleting the step — enrollments track position by index); sender pools can change while draft or paused; launch caps change through `sequences start` after first start. Name, throttles, tags, the default-off visible unsubscribe footer, and open/click tracking toggles remain editable as allowed by the server. Pass only the fields you want to change.")
+        .addHelpText("after", "\nEmail From: email_send.sender_mailbox_id chooses one exact inbox from a selected sender profile for that step. Omit it to use the lead's assigned inbox. Sender changes need a new subject_template and thread.\n")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--name <name>", "New human-readable sequence name.")
         .option("--steps-file <path>", "Draft only: path to a JSON file: { \"steps\": [...] } replacing the journey. Copy supports {{column}} interpolation; native email steps also expose {{sender_name}} / {{sender_first_name}} / {{sender_email}} from the sending mailbox (a same-named row column wins). A `branch` can also route on the lead's data with a data leaf { has_column: \"email\" } (true when that row_values column is non-empty; present:false for \"missing\").")
@@ -15622,7 +15642,8 @@ Examples:
         .option("--no-stop-on-bounce", "Keep a lead's enrollment running after a hard bounce (default: stop it). The bounce is still recorded as an email_bounced signal either way.")
         .option("--exclude-contacted", "Default every enroll into this sequence to cross-campaign exclusion — skip leads any OTHER active sequence is already contacting. A per-enroll `sequences enroll --exclude-contacted` / `--no-exclude-contacted` always overrides this default. Off by default.")
         .option("--no-exclude-contacted", "Turn the sequence-level exclude-contacted default back OFF (enrollments then exclude cross-campaign only when a call opts in).")
-        .option("--stop-on-reply-scope <scope>", "Native-email reply stop: 'lead' (default) stops the replying enrollment; 'company_domain' also stops active enrollments at the same non-freemail company domain.")
+        .option("--company-reply-pause <off|default|statuses>", "Pause the replier's company in this campaign when a reply has one of these statuses. Oxygen detects the company from work-email domains or explicit company fields; with no company identity, only the replier stops. New sequences start with this setting off. 'default' = interested,neutral,not_now,not_interested; or comma-separated Inbox status keys (`inbox labels list`); 'off' disables it. Read the saved setting with `sequences get`.")
+        .option("--stop-on-reply-scope <scope>", "(deprecated: use --company-reply-pause) 'company_domain' = --company-reply-pause interested,neutral,not_now,not_interested,wrong_person; 'lead' = off.")
         .option("--bounce-protection <json>", "Sequence bounce policy JSON (partial updates merge): enabled=true, warning_rate=.02, pause_rate=.03, min_sends=20, window_days=7. Hard bounces / accepted sends in the rolling window; pauses this sequence, not the fleet. Rates are fractions; mailbox protection is separate.")
         .option("--include-unsubscribe-headers", "Opt in to one-click unsubscribe headers (default off); visible link is separate.")
         .option("--no-include-unsubscribe-headers", "Omit one-click headers.")
@@ -15687,7 +15708,7 @@ Examples:
                     body.email = email;
             }
             if (Object.keys(body).length === 0) {
-                throw new Error("Provide at least one field to update (--name, --steps-file, --source-table, --channels, --senders, --tags, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, --send-window-file, --linkedin-* schedule, --stop-on-reply-scope, --[no-]include-unsubscribe-link, --no-stop-on-bounce, --[no-]exclude-contacted, or --[no-]tracking-opens / --[no-]tracking-clicks).");
+                throw new Error("Provide at least one field to update (--name, --steps-file, --source-table, --channels, --senders, --tags, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, --send-window-file, --linkedin-* schedule, --company-reply-pause, --[no-]include-unsubscribe-link, --no-stop-on-bounce, --[no-]exclude-contacted, or --[no-]tracking-opens / --[no-]tracking-clicks).");
             }
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`, {
                 method: "PATCH",
@@ -15940,6 +15961,90 @@ Examples:
                 },
             });
         });
+    }))
+        .addCommand(new Command("pause-company")
+        .description("Pause messaging to a company in your campaigns — e.g. after a meeting is booked — and resume it later. Holds every lead of that company (work-email domain, company domain, or LinkedIn company page) in every campaign, or only the --sequence ones; nothing is sent to them until `sequences resume-company`. --dry-run previews the leads it would hold.")
+        .option("--domain <domain>", "The company's domain, e.g. acme.com.")
+        .option("--email <email>", "Any work email at the company; its domain names the company (personal mail hosts such as gmail.com are refused).")
+        .option("--linkedin-company <url>", "The company's LinkedIn page, e.g. https://www.linkedin.com/company/acme.")
+        .option("--record <id>", "A CRM record id: a company; a person (their work-email domain and every linked company); or any record linked to companies, such as a deal.")
+        .option("--sequence <id>", "Pause only in this campaign (id or slug). Repeat for several; omit to pause in every campaign.", collectRepeatable, [])
+        .option("--note <text>", "Why it is paused, shown with the pause (max 500 characters).")
+        .option("--dry-run", "Preview the campaigns and leads that would be held; change nothing.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("sequences pause-company", options, async () => {
+            const sequenceIds = readRepeatableIds(options.sequence);
+            const note = readOption(options.note);
+            const data = await requestOxygen("/api/cli/sequences/company-pauses", {
+                method: "POST",
+                body: {
+                    ...readCompanyIdentityOptions(options, "pause"),
+                    ...(sequenceIds.length > 0 ? { sequence_ids: sequenceIds } : {}),
+                    ...(note ? { note } : {}),
+                    ...(options.dryRun ? { dry_run: true } : {}),
+                },
+            });
+            if (!options.json)
+                writeCompanyPauseSummary(data);
+            return data;
+        });
+    }))
+        .addCommand(new Command("resume-company")
+        .description("Resume messaging to a paused company: its held leads continue where they stopped (due steps are spread over the next hour, waits keep their remaining time). Name one pause with --hold, or the company with one identity flag; --sequence narrows the resume to those campaigns.")
+        .option("--hold <id>", "The pause to resume (`id` from `sequences paused-companies`).")
+        .option("--domain <domain>", "The company's domain, e.g. acme.com.")
+        .option("--email <email>", "Any work email at the company.")
+        .option("--linkedin-company <url>", "The company's LinkedIn page URL.")
+        .option("--record <id>", "A CRM company, person or deal record id.")
+        .option("--sequence <id>", "Resume only in this campaign (id or slug). Repeatable.", collectRepeatable, [])
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("sequences resume-company", options, async () => {
+            const hold = readOption(options.hold);
+            if (hold && countCompanyIdentityOptions(options) > 0) {
+                throw new OxygenError("company_identity_ambiguous", "Name the pause with --hold, or the company with one of --domain, --email, --linkedin-company, or --record — not both.", { exitCode: 2 });
+            }
+            const sequenceIds = readRepeatableIds(options.sequence);
+            const data = await requestOxygen("/api/cli/sequences/company-pauses/resume", {
+                method: "POST",
+                body: {
+                    ...(hold ? { hold_id: hold } : readCompanyIdentityOptions(options, "resume")),
+                    ...(sequenceIds.length > 0 ? { sequence_ids: sequenceIds } : {}),
+                },
+            });
+            if (!options.json)
+                writeCompanyPauseSummary(data);
+            return data;
+        });
+    }))
+        .addCommand(new Command("paused-companies")
+        .description("List the companies paused in your campaigns — by a reply (waiting for its classification, or classified into a paused status) or by hand/automation — with the leads each one holds.")
+        .option("--sequence <id>", "Only pauses in this campaign (id or slug).")
+        .option("--all", "Include resumed/released pauses (history).")
+        .option("--limit <n>", "Maximum pauses to return (1-500, default 100).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("sequences paused-companies", options, async () => {
+            const params = new URLSearchParams();
+            const sequence = readOption(options.sequence);
+            if (sequence)
+                params.set("sequence_id", sequence);
+            if (options.all)
+                params.set("include_released", "true");
+            const limitRaw = readOption(options.limit);
+            if (limitRaw !== null) {
+                const limit = readPositiveInt(limitRaw);
+                if (limit === undefined || limit > 500)
+                    throw new Error("--limit must be between 1 and 500.");
+                params.set("limit", String(limit));
+            }
+            const suffix = params.toString();
+            const data = await requestOxygen(`/api/cli/sequences/company-pauses${suffix ? `?${suffix}` : ""}`);
+            if (!options.json)
+                writeCompanyPauseSummary(data);
+            return data;
+        });
     }))
         .addCommand(new Command("reconcile")
         .description("Safely reconcile one ambiguous LinkedIn invite/message from provider reads. Preview-only unless --approved; never resends.")
@@ -16620,7 +16725,7 @@ Examples:
         }
     }))
         .addCommand(new Command("import-identities")
-        .description("Import a source-neutral typed JSON array into DNC. Kinds: email, phone, linkedin_person, company_domain, linkedin_company. Preferred for integrations; company identities apply across every Sequence channel and are never inferred from a person's email.")
+        .description("Import a source-neutral typed JSON array into DNC. Kinds: email, phone, linkedin_person, company_domain, linkedin_company. Preferred for integrations; company identities apply across every Sequence channel and are never inferred from a person's email. A company entry is a permanent block on every campaign; to pause a company and resume it later, use `sequences pause-company`.")
         .requiredOption("--file <path>", "JSON file containing [{kind,value,reason?,source?,detail?,metadata?}], max 5000.")
         .option("--reason <reason>", "Default reason for entries that omit one.")
         .option("--source <text>", "Default provenance for entries that omit one.")
@@ -17111,7 +17216,7 @@ Examples:
         });
     }))
         .addCommand(new Command("exit")
-        .description("Leave OXYGEN with a managed domain INTACT: stop every OXYGEN renewal for it (inboxes, warm-up, inbox placement) at the end of the period already paid for, keep the domain, mailboxes, DNS, warm-up state and data exactly as they are, and record a handoff request. Nothing is cancelled, disconnected, or released — for that use `managed-inboxes cancel`. WITHOUT --approved prints the plan: each renewal line with the date it stops, what stays, and the vendor-carry note (OXYGEN keeps paying the inbox vendor for these mailboxes after that date until a human completes the handoff or you cancel). To record it, re-run with --approved AND --confirm <domain> echoing the domain exactly. The Google Workspace / registrar handoff itself is coordinated by a human with the vendor — this command records the request, it does not perform the transfer. --revoke resumes renewals on a domain whose exit was requested. Free, 0 Oxygen credits; re-running on an already-exited domain changes nothing (effect_outcome no_change).")
+        .description("Transfer ONE managed domain out of OXYGEN: stop every OXYGEN renewal for this domain after the paid period; keep the domain, mailboxes, DNS, warm-up state and data exactly as they are. Nothing is cancelled, disconnected, or released; the handoff is coordinated by a human with the vendor. OXYGEN continues paying the inbox vendor until that handoff or `managed-inboxes cancel`; the customer does not pay that vendor-carry cost. For all external resources in a workspace, preview `workspace infrastructure-exit` instead. WITHOUT --approved prints the domain plan; to record the transfer, re-run with --approved AND --confirm <domain>. --revoke resumes OXYGEN renewals. Free, 0 credits.")
         .argument("[domain]", "The managed domain to stop renewing. May also be passed as --domain.")
         .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
         .option("--contact <email>", "Who the human handoff should be coordinated with (recorded on the request).")
@@ -28798,6 +28903,108 @@ function readNonNegativeNumber(value) {
     }
     return parsed;
 }
+function countCompanyIdentityOptions(options) {
+    return [options.domain, options.email, options.linkedinCompany, options.record]
+        .filter((value) => readOption(value) !== null)
+        .length;
+}
+// Exactly one company identity flag, mapped onto the route's body fields. The
+// server re-checks (and resolves record ids); refusing locally names the flags.
+function readCompanyIdentityOptions(options, verb) {
+    const fields = [
+        ["domain", readOption(options.domain)],
+        ["email", readOption(options.email)],
+        ["linkedin_company_url", readOption(options.linkedinCompany)],
+        ["record_id", readOption(options.record)],
+    ];
+    const provided = fields.filter((entry) => entry[1] !== null);
+    if (provided.length !== 1) {
+        const which = verb === "resume" ? "--hold, or exactly one of " : "exactly one of ";
+        throw new OxygenError(provided.length === 0 ? "company_identity_required" : "company_identity_ambiguous", `Name the company with ${which}--domain, --email, --linkedin-company, or --record.`, { exitCode: 2 });
+    }
+    return Object.fromEntries(provided);
+}
+function readRepeatableIds(values) {
+    return [...new Set((values ?? []).flatMap((value) => readCsvOption(value)))];
+}
+// Human-mode summary of a company pause/resume/list on stderr (stdout keeps the
+// machine-readable envelope): what was held or resumed, per campaign, and where
+// to see it.
+function writeCompanyPauseSummary(data) {
+    const payload = asPayloadRecord(data);
+    if (!payload)
+        return;
+    const lines = [];
+    if (typeof payload.message === "string")
+        lines.push(payload.message);
+    const affected = Array.isArray(payload.affected) ? payload.affected : [];
+    for (const entry of affected) {
+        const record = asPayloadRecord(entry);
+        if (!record)
+            continue;
+        const count = typeof record.enrollments === "number" ? record.enrollments : 0;
+        lines.push(`  ${String(record.sequence_name ?? record.sequence_id)}: ${count} lead${count === 1 ? "" : "s"}`);
+    }
+    // A pause reaching a campaign whose email is sent by Instantly does not stop
+    // those emails; the route says which campaigns, and a human reader must see it.
+    const warnings = Array.isArray(payload.warnings) ? payload.warnings : [];
+    for (const entry of warnings) {
+        const warning = asPayloadRecord(entry);
+        if (warning && typeof warning.message === "string")
+            lines.push(`Warning: ${warning.message}`);
+    }
+    const holds = Array.isArray(payload.holds) && typeof payload.message !== "string" ? payload.holds : [];
+    if (Array.isArray(payload.holds) && typeof payload.message !== "string" && holds.length === 0) {
+        lines.push("No companies are paused.");
+    }
+    for (const entry of holds) {
+        const hold = asPayloadRecord(entry);
+        if (!hold)
+            continue;
+        const scope = typeof hold.sequence_name === "string" ? hold.sequence_name : hold.sequence_id ? String(hold.sequence_id) : "every campaign";
+        const held = typeof hold.held_enrollments === "number" ? hold.held_enrollments : 0;
+        lines.push(`  ${String(hold.display_name)} — ${scope} — ${String(hold.state)} — ${held} lead${held === 1 ? "" : "s"} held (hold ${String(hold.id)})`);
+    }
+    if (typeof payload.next_step === "string")
+        lines.push(payload.next_step);
+    if (typeof payload.web_url === "string")
+        lines.push(`Open: ${payload.web_url}`);
+    if (lines.length > 0)
+        process.stderr.write(`${lines.join("\n")}\n`);
+}
+// `--company-reply-pause` (and its deprecated alias `--stop-on-reply-scope`) as
+// the `settings.company_reply_pause` object the server stores. `default` names
+// the statuses a new campaign gets; the alias maps `company_domain` to exactly
+// what the legacy scope always stopped on and `lead` to off, so an old script
+// keeps its behavior while the server stores one key.
+function readCompanyReplyPauseOption(value, legacyScope) {
+    const raw = readOption(value);
+    const legacy = readOption(legacyScope);
+    if (raw && legacy) {
+        throw new OxygenError("invalid_company_reply_pause", "Pass --company-reply-pause only; --stop-on-reply-scope is its deprecated alias.", { exitCode: 2 });
+    }
+    if (legacy) {
+        if (legacy === "company_domain")
+            return { enabled: true, statuses: [...COMPANY_REPLY_PAUSE_LEGACY_STATUSES] };
+        if (legacy === "lead")
+            return { enabled: false, statuses: [] };
+        throw new OxygenError("invalid_company_reply_pause", "--stop-on-reply-scope must be lead or company_domain (deprecated: use --company-reply-pause).", { details: { value: legacy }, exitCode: 2 });
+    }
+    if (!raw)
+        return undefined;
+    const normalized = raw.toLowerCase();
+    if (normalized === "off")
+        return { enabled: false, statuses: [] };
+    if (normalized === "default" || normalized === "on") {
+        return { enabled: true, statuses: [...COMPANY_REPLY_PAUSE_DEFAULT_STATUSES] };
+    }
+    const statuses = [...new Set(readCsvOption(normalized))];
+    const invalid = statuses.filter((status) => !COMPANY_REPLY_PAUSE_STATUS_KEY_PATTERN.test(status));
+    if (statuses.length === 0 || invalid.length > 0) {
+        throw new OxygenError("invalid_company_reply_pause", "--company-reply-pause takes off, default, or comma-separated Inbox status keys such as interested,not_now.", { details: { invalid }, exitCode: 2 });
+    }
+    return { enabled: true, statuses };
+}
 // Folds the sequence-level email send controls (--max-emails-per-mailbox-per-day,
 // --send-window-file) into a partial `settings` object. Returns undefined when
 // neither flag is set so the field is omitted from the request body entirely.
@@ -28853,9 +29060,9 @@ function readSequenceSettings(options) {
     if (options.includeUnsubscribeLink !== undefined) {
         settings.include_unsubscribe_link = options.includeUnsubscribeLink;
     }
-    const stopOnReplyScope = readOption(options.stopOnReplyScope);
-    if (stopOnReplyScope)
-        settings.stop_on_reply_scope = stopOnReplyScope;
+    const companyReplyPause = readCompanyReplyPauseOption(options.companyReplyPause, options.stopOnReplyScope);
+    if (companyReplyPause)
+        settings.company_reply_pause = companyReplyPause;
     const maxEmailsPerDay = readPositiveInt(options.maxEmailsPerDay);
     if (maxEmailsPerDay !== undefined)
         settings.max_emails_per_day = maxEmailsPerDay;

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -338,17 +338,17 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         id: "sequences",
         layer: "Action",
         primitive: "sequences",
-        owns: "Net-new LinkedIn outreach plus versioned multichannel programs, cadence, enrollment, sender limits, suppression, reply-stop, and dispatch.",
+        owns: "Net-new LinkedIn outreach plus versioned multichannel programs, cadence, enrollment, sender limits, suppression, reply-stop, pausing a company when someone there replies, and dispatch.",
         notFor: "A reply in an existing conversation or a direct one-off email; use Messages. Not for general deterministic automation.",
         // The external-campaign sentence exists because a 2026-09-16 blind user asked
         // to "push table rows to smartlead campaign", landed here, read the native
         // email track's "Only 'instantly' is supported" and concluded Smartlead was
         // unreachable. The governed path for a campaign the customer already runs
         // elsewhere is `sequences push-external`; it is not a Sequence.
-        execution: "Use the one-step gateway for new LinkedIn initiation or create/enroll/start a hosted campaign with bounded send authority. Native email sends through connected Google/Microsoft mailboxes, including Microsoft SMTP transport. To push table rows into an existing Smartlead, Instantly, lemlist or HeyReach campaign you already run, use `sequences push-external` (dry_run preview, then --approved).",
+        execution: "Use the one-step gateway for new LinkedIn initiation or create/enroll/start a hosted campaign with bounded send authority. Native email sends through connected Google/Microsoft mailboxes, including Microsoft SMTP transport. To push table rows into an existing Smartlead, Instantly, lemlist or HeyReach campaign you already run, use `sequences push-external` (dry_run preview, then --approved). To stop a company's other leads when one of them replies, set `--company-reply-pause` on the campaign (choose the reply categories); to pause or resume a company on demand, e.g. from a workflow when a meeting is booked, use `sequences pause-company` / `resume-company`. A pause is resumable; a company do-not-contact entry is a permanent block on every campaign.",
         posture: "external_write",
-        gatewayTools: ["oxygen_sequences_send", "oxygen_sequences_create", "oxygen_sequences_enroll", "oxygen_sequences_start", "oxygen_sequences_list", "oxygen_sequences_push_external"],
-        gatewayCommands: ["sequences send", "sequences create", "sequences enroll", "sequences start", "sequences list", "sequences push-external"],
+        gatewayTools: ["oxygen_sequences_send", "oxygen_sequences_create", "oxygen_sequences_enroll", "oxygen_sequences_start", "oxygen_sequences_list", "oxygen_sequences_push_external", "oxygen_sequences_company_pause"],
+        gatewayCommands: ["sequences send", "sequences create", "sequences enroll", "sequences start", "sequences list", "sequences push-external", "sequences pause-company"],
         skills: ["oxygen-sequencer"],
         endpointSections: ["senders", "sequencer", "sequences", "spintax", "suppressions", "voice"],
         // "sender identity", "sender profile" and "phone number" are here because a
@@ -356,7 +356,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         // to workspace-access — "identity" matched the AUTH sense. The nouns a user
         // reaches for when naming a sending identity or the dialing pool have to land
         // on the group that actually owns `senders profiles` and `voice numbers`.
-        intentTerms: ["sequence", "campaign", "cadence", "enroll", "outreach", "linkedin message", "linkedin dm", "nurture", "follow up", "sender rotation", "stop on reply", "sender identity", "sending identity", "sender profile", "phone number", "dialing", "dialer", "call", "cold call", "smartlead", "instantly", "lemlist", "heyreach", "external sequencer", "push to campaign", "push rows to campaign", "add leads to campaign"],
+        intentTerms: ["sequence", "campaign", "cadence", "enroll", "outreach", "linkedin message", "linkedin dm", "nurture", "follow up", "sender rotation", "stop on reply", "company replied", "pause company", "pause outreach to a company", "stop outreach to a company", "stop emailing a company", "colleagues", "do not contact a company", "sender identity", "sending identity", "sender profile", "phone number", "dialing", "dialer", "call", "cold call", "smartlead", "instantly", "lemlist", "heyreach", "external sequencer", "push to campaign", "push rows to campaign", "add leads to campaign"],
     },
     {
         id: "publishing",

package/node_modules/@oxygen/shared/dist/company-reply-pause.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Pause a company on reply: when one lead at a company replies, every other lead
+ * of that company is HELD (resumable, nothing is sent) until the reply is
+ * classified or a human resumes it. Shared by the tenant-db hold ledger, the
+ * inbound reply hooks, and the API/CLI/MCP surfaces so a company identity and
+ * the campaign setting resolve identically everywhere.
+ */
+/** Reply statuses that keep a company paused when the setting is enabled. */
+export declare const COMPANY_REPLY_PAUSE_DEFAULT_STATUSES: readonly string[];
+/**
+ * What the retired `stop_on_reply_scope: "company_domain"` meant: every
+ * AI-settable status except out_of_office stopped the company.
+ */
+export declare const COMPANY_REPLY_PAUSE_LEGACY_STATUSES: readonly string[];
+/**
+ * A reply status is an Inbox label key. Keys are minted by `slugifyLabelKey`
+ * (tenant-db email-labels): lower snake_case, never a leading underscore. The
+ * slug has no length limit of its own, so the bound here is generous.
+ */
+export declare const COMPANY_REPLY_PAUSE_STATUS_KEY_PATTERN: RegExp;
+export type CompanyReplyPauseSetting = {
+    enabled: boolean;
+    statuses: string[];
+};
+export type ResolvedCompanyReplyPause = CompanyReplyPauseSetting & {
+    source: "setting" | "legacy_scope" | "off";
+};
+/**
+ * Read a Sequence's `settings.company_reply_pause`. An explicit setting (even a
+ * disabled one) wins over the deprecated `stop_on_reply_scope` alias; without
+ * it, `"company_domain"` reads as enabled with the legacy statuses.
+ */
+export declare function resolveCompanyReplyPause(settings: Record<string, unknown> | null | undefined): ResolvedCompanyReplyPause;
+/**
+ * Every company identity key an enrollment row carries: explicit company-domain
+ * and LinkedIn-company fields plus the recipient email's domain. A consumer mail
+ * host (gmail, outlook, …) is never a company, from either source, so strangers
+ * who share a mail provider are never grouped. Deduplicated and sorted.
+ */
+export declare function companyIdentityKeysFromRowValues(rowValues: Record<string, unknown> | null | undefined, emailColumnKey?: string | null): string[];
+export type CompanyIdentityErrorCode = "company_identity_required" | "company_identity_ambiguous" | "company_domain_invalid" | "company_email_freemail" | "company_email_invalid" | "company_linkedin_invalid";
+/** Resolve the one company a pause/resume action names. */
+export declare function companyIdentityFromActionInput(input: {
+    domain?: string | null;
+    email?: string | null;
+    linkedinCompanyUrl?: string | null;
+}): {
+    ok: true;
+    keys: string[];
+    displayName: string;
+} | {
+    ok: false;
+    code: CompanyIdentityErrorCode;
+    message: string;
+};

package/node_modules/@oxygen/shared/dist/company-reply-pause.js

@@ -0,0 +1,146 @@
+import { companyDncIdentitiesFromRowValues, companyDncIdentityKey, normalizeCompanyDncDomain, normalizeLinkedinCompanyUrl, } from "./dnc-identities.js";
+import { isFreemailDomain } from "./freemail-domains.js";
+import { recipientEmailFromRow } from "./sequences.js";
+/**
+ * Pause a company on reply: when one lead at a company replies, every other lead
+ * of that company is HELD (resumable, nothing is sent) until the reply is
+ * classified or a human resumes it. Shared by the tenant-db hold ledger, the
+ * inbound reply hooks, and the API/CLI/MCP surfaces so a company identity and
+ * the campaign setting resolve identically everywhere.
+ */
+/** Reply statuses that keep a company paused when the setting is enabled. */
+export const COMPANY_REPLY_PAUSE_DEFAULT_STATUSES = [
+    "interested",
+    "neutral",
+    "not_now",
+    "not_interested",
+];
+/**
+ * What the retired `stop_on_reply_scope: "company_domain"` meant: every
+ * AI-settable status except out_of_office stopped the company.
+ */
+export const COMPANY_REPLY_PAUSE_LEGACY_STATUSES = [
+    ...COMPANY_REPLY_PAUSE_DEFAULT_STATUSES,
+    "wrong_person",
+];
+/**
+ * A reply status is an Inbox label key. Keys are minted by `slugifyLabelKey`
+ * (tenant-db email-labels): lower snake_case, never a leading underscore. The
+ * slug has no length limit of its own, so the bound here is generous.
+ */
+export const COMPANY_REPLY_PAUSE_STATUS_KEY_PATTERN = /^[a-z0-9][a-z0-9_]{0,127}$/;
+/**
+ * Read a Sequence's `settings.company_reply_pause`. An explicit setting (even a
+ * disabled one) wins over the deprecated `stop_on_reply_scope` alias; without
+ * it, `"company_domain"` reads as enabled with the legacy statuses.
+ */
+export function resolveCompanyReplyPause(settings) {
+    const raw = settings?.company_reply_pause;
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+        const record = raw;
+        const statuses = Array.isArray(record.statuses)
+            ? [...new Set(record.statuses.filter((status) => typeof status === "string" && COMPANY_REPLY_PAUSE_STATUS_KEY_PATTERN.test(status)))]
+            : [];
+        if (record.enabled !== true)
+            return { enabled: false, statuses, source: "setting" };
+        return {
+            enabled: true,
+            statuses: statuses.length > 0 ? statuses : [...COMPANY_REPLY_PAUSE_DEFAULT_STATUSES],
+            source: "setting",
+        };
+    }
+    if (settings?.stop_on_reply_scope === "company_domain") {
+        return { enabled: true, statuses: [...COMPANY_REPLY_PAUSE_LEGACY_STATUSES], source: "legacy_scope" };
+    }
+    return { enabled: false, statuses: [], source: "off" };
+}
+function emailDomain(email) {
+    const at = email.lastIndexOf("@");
+    if (at <= 0)
+        return null;
+    return normalizeCompanyDncDomain(email.slice(at + 1));
+}
+/**
+ * Every company identity key an enrollment row carries: explicit company-domain
+ * and LinkedIn-company fields plus the recipient email's domain. A consumer mail
+ * host (gmail, outlook, …) is never a company, from either source, so strangers
+ * who share a mail provider are never grouped. Deduplicated and sorted.
+ */
+export function companyIdentityKeysFromRowValues(rowValues, emailColumnKey) {
+    if (!rowValues)
+        return [];
+    const keys = new Set();
+    for (const identity of companyDncIdentitiesFromRowValues(rowValues)) {
+        if (identity.kind === "domain" && isFreemailDomain(identity.value))
+            continue;
+        keys.add(identity.key);
+    }
+    const email = recipientEmailFromRow(rowValues, emailColumnKey);
+    const domain = email ? emailDomain(email) : null;
+    if (domain && !isFreemailDomain(domain))
+        keys.add(companyDncIdentityKey("domain", domain));
+    return [...keys].sort();
+}
+/** Resolve the one company a pause/resume action names. */
+export function companyIdentityFromActionInput(input) {
+    const domain = input.domain?.trim() || null;
+    const email = input.email?.trim() || null;
+    const linkedinCompanyUrl = input.linkedinCompanyUrl?.trim() || null;
+    const provided = [domain, email, linkedinCompanyUrl].filter((value) => value !== null).length;
+    if (provided === 0) {
+        return {
+            ok: false,
+            code: "company_identity_required",
+            message: "Name the company with a domain, an email address, or a LinkedIn company URL.",
+        };
+    }
+    if (provided > 1) {
+        return {
+            ok: false,
+            code: "company_identity_ambiguous",
+            message: "Name the company one way only: a domain, an email address, or a LinkedIn company URL.",
+        };
+    }
+    if (domain) {
+        const normalized = normalizeCompanyDncDomain(domain);
+        if (!normalized) {
+            return { ok: false, code: "company_domain_invalid", message: `"${domain}" is not a company domain.` };
+        }
+        if (isFreemailDomain(normalized)) {
+            return {
+                ok: false,
+                code: "company_domain_invalid",
+                message: `${normalized} is a personal email provider, not a company.`,
+            };
+        }
+        return { ok: true, keys: [companyDncIdentityKey("domain", normalized)], displayName: normalized };
+    }
+    if (email) {
+        const at = email.lastIndexOf("@");
+        const normalized = at > 0 && !/\s/.test(email) ? emailDomain(email) : null;
+        if (!normalized) {
+            return { ok: false, code: "company_email_invalid", message: `"${email}" is not an email address.` };
+        }
+        if (isFreemailDomain(normalized)) {
+            return {
+                ok: false,
+                code: "company_email_freemail",
+                message: `${normalized} is a personal email provider, so the address does not identify a company.`,
+            };
+        }
+        return { ok: true, keys: [companyDncIdentityKey("domain", normalized)], displayName: normalized };
+    }
+    const url = normalizeLinkedinCompanyUrl(linkedinCompanyUrl);
+    if (!url) {
+        return {
+            ok: false,
+            code: "company_linkedin_invalid",
+            message: `"${linkedinCompanyUrl}" is not a LinkedIn company page URL.`,
+        };
+    }
+    return {
+        ok: true,
+        keys: [companyDncIdentityKey("linkedin_company", url)],
+        displayName: url.replace(/^https:\/\/www\./, ""),
+    };
+}

package/node_modules/@oxygen/shared/dist/freemail-domains.d.ts

@@ -17,9 +17,9 @@
  *   Two consumers ride on that answer, and they fail in OPPOSITE directions, which is
  *   why this tier is conservative rather than generous:
  *
- *     1. The company-scope reply stop (`settings.stop_on_reply_scope = "company_domain"`)
- *        terminalizes an enrollment's colleagues by matching domain. A host wrongly IN
- *        this tier is harmless here; a host wrongly OUT of it stops strangers who merely
+ *     1. Pause a company on reply (`settings.company_reply_pause`, company-reply-pause.ts)
+ *        holds an enrollment's colleagues by matching domain. A host wrongly IN this
+ *        tier is harmless here; a host wrongly OUT of it pauses strangers who merely
  *        share a mail host — real, customer-visible damage.
  *     2. Company derivation from a person's email domain
  *        (`deriveCompanyDomainFromEmail`, `packages/tenant-db/src/table-link-plan.ts`)

package/node_modules/@oxygen/shared/dist/freemail-domains.js

@@ -17,9 +17,9 @@
  *   Two consumers ride on that answer, and they fail in OPPOSITE directions, which is
  *   why this tier is conservative rather than generous:
  *
- *     1. The company-scope reply stop (`settings.stop_on_reply_scope = "company_domain"`)
- *        terminalizes an enrollment's colleagues by matching domain. A host wrongly IN
- *        this tier is harmless here; a host wrongly OUT of it stops strangers who merely
+ *     1. Pause a company on reply (`settings.company_reply_pause`, company-reply-pause.ts)
+ *        holds an enrollment's colleagues by matching domain. A host wrongly IN this
+ *        tier is harmless here; a host wrongly OUT of it pauses strangers who merely
  *        share a mail host — real, customer-visible damage.
  *     2. Company derivation from a person's email domain
  *        (`deriveCompanyDomainFromEmail`, `packages/tenant-db/src/table-link-plan.ts`)

package/node_modules/@oxygen/shared/dist/sequences.d.ts

@@ -557,6 +557,8 @@ export type SequenceEmailSendStep = {
     id: string;
     channel: "email";
     kind: "email_send";
+    /** Advanced: send this step from this exact inbox instead of the lead's normal assignment. */
+    sender_mailbox_id?: string;
     /**
      * Subject line. Supports {{column}} interpolation.
      *
@@ -990,6 +992,18 @@ export type SequenceMissingCopy = {
  * stored under `draft`. Empty means nothing to send, so starting would
  * either dispatch a blank message or fail per lead at send time.
  */
+/**
+ * Threaded email steps that would continue another inbox's thread. A provider
+ * thread belongs to the mailbox that opened it, so a step that changes From —
+ * an exact-inbox step, or the return to the lead's assigned inbox after one —
+ * must open a new thread under its own subject. Checked on save and again at
+ * launch, because a draft may be saved half-written.
+ */
+export declare function sequenceSenderThreadConflicts(steps: readonly SequenceStep[]): {
+    index: number;
+    stepId: string;
+    message: string;
+}[];
 export declare function sequenceStepsMissingCopy(steps: readonly SequenceStep[]): SequenceMissingCopy[];
 /**
  * Validate + normalize a raw sequence definition. Assigns stable ids to steps

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -1032,6 +1032,33 @@ export function sequenceChannels(definition) {
  * stored under `draft`. Empty means nothing to send, so starting would
  * either dispatch a blank message or fail per lead at send time.
  */
+/**
+ * Threaded email steps that would continue another inbox's thread. A provider
+ * thread belongs to the mailbox that opened it, so a step that changes From —
+ * an exact-inbox step, or the return to the lead's assigned inbox after one —
+ * must open a new thread under its own subject. Checked on save and again at
+ * launch, because a draft may be saved half-written.
+ */
+export function sequenceSenderThreadConflicts(steps) {
+    const conflicts = [];
+    let precedingSender;
+    let seenEmail = false;
+    steps.forEach((step, index) => {
+        if (step.kind !== "email_send" && step.kind !== "email_reply")
+            return;
+        const sender = step.kind === "email_send" ? step.sender_mailbox_id : undefined;
+        if (seenEmail && sequenceEmailStepThreads(step) && sender !== precedingSender) {
+            conflicts.push({
+                index,
+                stepId: step.id,
+                message: `step '${step.id}' changes the sending inbox. Give it a new subject to start a new thread.`,
+            });
+        }
+        seenEmail = true;
+        precedingSender = sender;
+    });
+    return conflicts;
+}
 export function sequenceStepsMissingCopy(steps) {
     const missing = [];
     const check = (step, field, value) => {
@@ -1174,6 +1201,9 @@ export function validateSequenceDefinition(input, options = {}) {
                 message: `step '${step.id}' has no subject, which means "continue the previous email" — but no earlier step sends one. Give the first email of the sequence a subject.`,
             });
         });
+        for (const conflict of sequenceSenderThreadConflicts(normalized)) {
+            issues.push({ path: `steps[${conflict.index}].subject_template`, message: conflict.message });
+        }
     }
     if (issues.length > 0) {
         throw new OxygenError("invalid_sequence", `Sequence definition is invalid: ${issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`, { details: { issues }, exitCode: 1 });
@@ -1372,8 +1402,13 @@ raw, index, options, issues) {
             const cc = optionalEmailList(raw.cc, `${path}.cc`, issues);
             const bcc = optionalEmailList(raw.bcc, `${path}.bcc`, issues);
             const sendWindow = normalizeSendWindow(raw.send_window, `${path}.send_window`, issues);
+            const senderMailboxId = optionalString(raw.sender_mailbox_id, `${path}.sender_mailbox_id`, issues);
+            if (senderMailboxId && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(senderMailboxId)) {
+                issues.push({ path: `${path}.sender_mailbox_id`, message: "must be an inbox id." });
+            }
             return {
                 id, channel: "email", kind: "email_send",
+                ...(senderMailboxId ? { sender_mailbox_id: senderMailboxId } : {}),
                 ...(threaded ? {} : { subject_template: subject }),
                 body_template: body ?? "",
                 ...(bodyHtml !== undefined ? { body_html_template: bodyHtml } : {}),

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1010.954";
+export declare const OXYGEN_BUILD_VERSION = "1.1011.21";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1010.954";
+export const OXYGEN_BUILD_VERSION = "1.1011.21";

package/node_modules/@oxygen/shared/package.json

@@ -121,6 +121,11 @@
       "import": "./dist/dnc-identities.js",
       "default": "./dist/dnc-identities.js"
     },
+    "./company-reply-pause": {
+      "types": "./dist/company-reply-pause.d.ts",
+      "import": "./dist/company-reply-pause.js",
+      "default": "./dist/company-reply-pause.js"
+    },
     "./provider-funding-errors": {
       "types": "./dist/provider-funding-errors.d.ts",
       "import": "./dist/provider-funding-errors.js",

package/node_modules/@oxygen/workflows/dist/graph/lint.js

@@ -812,7 +812,7 @@ function lintToolNode(node, path, add, scope, options) {
         add(`${path}.mode`, "invalid_step_mode", "Node mode is invalid.");
     }
     else if (node.mode !== undefined && (node.effect !== "external_write" || node.mode !== "dry_run")) {
-        add(`${path}.mode`, "unsupported_step_mode", "A tool-node mode is only supported as 'dry_run' on an external write.");
+        add(`${path}.mode`, "unsupported_step_mode", "Omit mode to run this step live. The only mode a tool node may set is 'dry_run', on an external write, and it previews without writing.");
     }
     if (node.effect === "external_write" && node.retry !== undefined) {
         add(`${path}.retry`, "unsafe_external_write_retry", "External writes cannot have a node retry policy because an ambiguous failure may already have landed.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1010.954",
+  "version": "1.1011.21",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",