@oxygen-agent/cli 1.1011.288 → 1.1011.326

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.1011.288
+Version: 1.1011.326

package/dist/connectors-commands.d.ts

@@ -0,0 +1,11 @@
+import { Command } from "commander";
+import { type ContractFlagOverlay } from "./contract-flags.js";
+type JsonOptions = {
+    json?: boolean;
+};
+type Handle = (command: string, options: JsonOptions, action: () => Promise<unknown>) => Promise<void>;
+export declare const CONNECTORS_FLAG_OVERLAY: ContractFlagOverlay;
+/** The PATCH body for the flags given; one of the two workspace flags is required. */
+export declare function buildConnectorUpdateBody(options: Record<string, unknown>): Record<string, unknown>;
+export declare function registerConnectorsCommands(program: Command, handle: Handle): void;
+export {};

package/dist/connectors-commands.js

@@ -0,0 +1,63 @@
+// `oxygen connectors`: the apps a person connected to OXYGEN with OAuth
+// (ChatGPT, Claude, Codex…) and the workspace each one works in without asking.
+// The set command's flags come from the shared contract that also generates
+// `oxygen_connector_update` and validates the route, so the CLI and MCP cannot
+// disagree about what can be set.
+import { Command } from "commander";
+import { OxygenError } from "@oxygen/shared/cli-result";
+import { CONNECTOR_UPDATE_OPERATION } from "@oxygen/shared/contracts/connectors";
+import { operationPath } from "@oxygen/shared/contracts/operations";
+import { addContractFlags, readContractFlags } from "./contract-flags.js";
+import { requestOxygen } from "./http-client.js";
+const update = CONNECTOR_UPDATE_OPERATION;
+export const CONNECTORS_FLAG_OVERLAY = {
+    default_workspace: {
+        help: "The workspace this app should work in without asking: its id, slug or exact name from `orgs list`. You must be a member.",
+        valueName: "<workspace>",
+    },
+};
+/** The PATCH body for the flags given; one of the two workspace flags is required. */
+export function buildConnectorUpdateBody(options) {
+    const body = readContractFlags(options, update.contract, CONNECTORS_FLAG_OVERLAY);
+    if (!("default_workspace" in body)) {
+        throw new OxygenError("invalid_request", "Pass --default-workspace <workspace> to set where the app works, or --clear-default-workspace to have it ask each time.", { exitCode: 1 });
+    }
+    return body;
+}
+export function registerConnectorsCommands(program, handle) {
+    const connectors = program
+        .command("connectors")
+        .description("Connected apps: ChatGPT, Claude, Codex and any other app you connected to OXYGEN with OAuth, and the default workspace each one works in without asking. "
+        + "`connectors list` shows them; `connectors set <app> --default-workspace <workspace>` changes that app only. "
+        + "Picking a workspace inside an app changes the same setting, and the latest choice wins. This CLI keeps its own workspace (`orgs use`). "
+        + "Web: https://oxygen-agent.com/settings/connected-apps.");
+    connectors.addCommand(new Command("list")
+        .description("List your connected apps with each one's default workspace, when it was last used, and the workspaces you can choose from. Read-only, 0 credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handle("connectors list", options, () => requestOxygen("/api/cli/connectors"));
+    }));
+    connectors.addCommand(new Command("get")
+        .description("Show one connected app and its default workspace. Read-only, 0 credits.")
+        .argument("<connection>", update.cli.argument?.description ?? "The app's id or name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (connection, options) => {
+        await handle("connectors get", options, () => requestOxygen(`/api/cli/connectors/${encodeURIComponent(connection)}`));
+    }));
+    connectors.addCommand(addContractFlags(new Command(update.cli.path.at(-1) ?? "set")
+        .description(update.cli.summary)
+        .argument(`<${update.cli.argument?.name ?? "connection"}>`, update.cli.argument?.description), update.contract, CONNECTORS_FLAG_OVERLAY)
+        .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", `
+Examples:
+  oxygen connectors list
+  oxygen connectors set ChatGPT --default-workspace "Acme GTM"
+  oxygen connectors set <id> --clear-default-workspace
+`)
+        .action(async (connection, options) => {
+        await handle("connectors set", options, () => requestOxygen(operationPath(update, { connection }), {
+            method: update.method,
+            body: buildConnectorUpdateBody(options),
+        }));
+    }));
+}

package/dist/index.js

@@ -8,6 +8,7 @@ import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, CommanderError, Option } from "commander";
 import { registerUgcCommands } from "./ugc-commands.js";
+import { registerConnectorsCommands } from "./connectors-commands.js";
 import { registerKnowledgeRepositoryCommands } from "./knowledge-repository-commands.js";
 import { registerVisualCommands } from "./visual-commands.js";
 import { renderPrimaryProviderBoard } from "./admin-primary-providers-render.js";
@@ -3918,14 +3919,14 @@ export function createProgram() {
         await handleOrgsListAction(options);
     }))
         .addCommand(new Command("use")
-        .description("Select the active organization for this CLI profile.")
+        .description("Select the active organization for this CLI profile. Apps connected with OAuth (ChatGPT, Claude…) keep their own default workspace: `oxygen connectors`.")
         .argument("<organization>", "Organization id, Clerk org id, or slug returned by orgs list.")
         .option("--json", "Print a JSON envelope.")
         .action(async (organization, options) => {
         await handleOrgUseAction(organization, options, "orgs use");
     }))
         .addCommand(new Command("select")
-        .description("Alias for orgs use.")
+        .description("Alias for orgs use: this CLI profile only. For ChatGPT, Claude or another connected app, use `oxygen connectors set`.")
         .argument("<organization>", "Organization id, Clerk org id, or slug returned by orgs list.")
         .option("--json", "Print a JSON envelope.")
         .action(async (organization, options) => {
@@ -16323,7 +16324,7 @@ Examples:
         });
     }))
         .addCommand(new Command("stats")
-        .description("Show one sequence's persisted launch status and current operational state separately, including reasons, open work, lifetime sent/terminal-failed/deferral counts, and the funnel. daily_budget carries today's sends against the caps; operational.reasons carries why work is waiting (outside_send_window, mailbox_spacing, daily_send_cap_reached, ...). For a per-day send series use `sequences analytics --sequence <id> --range <window>`.")
+        .description("Show one sequence's persisted launch status and current operational state separately, including reasons, open work, lifetime sent/terminal-failed/deferral counts, and the funnel. Today's completed sends, reservations and remaining capacity appear in the default output and daily_budget. operational.reasons carries why work is waiting (outside_send_window, mailbox_spacing, daily_send_cap_reached, ...). For a per-day send series use `sequences analytics --sequence <id> --range <window>`.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
@@ -19739,6 +19740,7 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
     registerFunctionsCommands(program, handleAsyncAction);
     registerUgcCommands(program, handleAsyncAction);
     registerKnowledgeRepositoryCommands(program, handleAsyncAction);
+    registerConnectorsCommands(program, handleAsyncAction);
     // Last, so every command registered above is covered — including the ones the
     // register* helpers add after applyOxygenHelp.
     enableCommandSuggestions(program);
@@ -26443,6 +26445,7 @@ function formatSequenceReplyRollup(replies) {
 function formatSequenceStatsHealth(data) {
     const stats = recordValue(data.stats);
     const operational = recordValue(stats.operational);
+    const budget = recordValue(data.daily_budget);
     const lines = [
         stringValue(data.name) ?? stringValue(data.sequence_id) ?? "Sequence",
         `Persisted status: ${stringValue(data.status) ?? "unknown"}`,
@@ -26451,6 +26454,14 @@ function formatSequenceStatsHealth(data) {
         `Reasons: ${formatSequenceReasons(operational)}`,
         `${formatFailureWindow(operational.failureAnalytics)} outcomes: ${formatSequenceFailureTotals(operational.failureAnalytics)}`,
     ];
+    const sentToday = numericValue(budget.sends_used);
+    if (sentToday !== null) {
+        const reserved = numericValue(budget.sends_reserved);
+        const remaining = numericValue(budget.sends_remaining);
+        lines.push(`Today${stringValue(budget.day) ? ` (${budget.day} UTC)` : ""}: ${sentToday} sent`
+            + (reserved === null ? "" : ` · ${reserved} reserved`)
+            + ` · ${remaining === null ? "unlimited" : remaining} available`);
+    }
     const failureMix = formatCountRecord(recordValue(recordValue(operational.failureAnalytics).byFailureClass));
     if (failureMix !== "—")
         lines.push(`Failure mix: ${failureMix}`);

package/node_modules/@oxygen/shared/dist/capability-discovery.d.ts

@@ -93,6 +93,10 @@ export declare const SEQUENCE_UNSUBSCRIBE_COMMAND = "oxygen sequences update <se
  * Factories, so a caller can edit the object it gets.
  */
 export declare const CAPABILITY_ROUTE_MCP_CALLS: {
+    connectedAppsList: () => {
+        tool: string;
+        arguments: {};
+    };
     sequenceSendingSchedule: () => {
         tool: string;
         arguments: {

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -22,15 +22,16 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         id: "workspace-access",
         layer: "Control",
         primitive: null,
-        owns: "Authentication, CLI identities, API keys, sessions, organizations, and active-workspace selection.",
+        owns: "Authentication, CLI identities, API keys, sessions, organizations, active-workspace selection, and connected apps (ChatGPT, Claude, Codex…) with the default workspace each one works in.",
         notFor: "Workspace GTM data, provider credentials, or execution inside a primitive.",
-        execution: "Resolve identity and select the hosted workspace before operating its primitives.",
+        execution: "Resolve identity and select the hosted workspace before operating its primitives. Each app connected with OAuth keeps its own default workspace: `connectors list` shows them and `connectors set` changes one app only; orgs select changes only the app or CLI that calls it.",
         posture: "mixed",
-        gatewayTools: ["oxygen_whoami", "oxygen_orgs_list", "oxygen_orgs_select"],
-        gatewayCommands: ["whoami", "orgs list", "orgs select"],
+        gatewayTools: ["oxygen_whoami", "oxygen_orgs_list", "oxygen_orgs_select", "oxygen_connector_list", "oxygen_connector_update"],
+        gatewayCommands: ["whoami", "orgs list", "orgs select", "connectors list", "connectors set"],
         skills: ["oxygen-quickstart"],
-        endpointSections: ["api-keys", "auth", "login-requests", "orgs", "sessions", "settings", "whoami"],
-        intentTerms: ["login", "authenticate", "identity", "who am i", "workspace", "organization", "org", "api key", "session", "switch workspace"],
+        // `mcp`: the host-driven MCP Events routes an OAuth connection's subscriptions go through (ADR 0030 §2).
+        endpointSections: ["api-keys", "auth", "connectors", "login-requests", "mcp", "orgs", "sessions", "settings", "whoami"],
+        intentTerms: ["login", "authenticate", "identity", "who am i", "workspace", "organization", "org", "api key", "session", "switch workspace", "connected app", "connected apps", "default workspace"],
     },
     {
         id: "discovery-and-skills",
@@ -827,6 +828,7 @@ export const SEQUENCE_UNSUBSCRIBE_COMMAND = "oxygen sequences update <sequence>
  * Factories, so a caller can edit the object it gets.
  */
 export const CAPABILITY_ROUTE_MCP_CALLS = {
+    connectedAppsList: () => ({ tool: "oxygen_connector_list", arguments: {} }),
     sequenceSendingSchedule: () => ({
         tool: "oxygen_sequences_update",
         arguments: { sequence: "<sequence>", sending_schedule: { timezone: "<IANA zone>", days: [1, 2, 3, 4, 5], start: "09:00", end: "17:00" } },
@@ -926,7 +928,30 @@ function isOpenLinkedInRequestsIntent(query) {
     return /\b(connection|invitation|invite|connect) requests?\b/.test(query)
         || /\b(pending|open|unanswered|outstanding|received|sent) (linkedin )?(invitations?|invites?)\b/.test(query);
 }
+/**
+ * The apps a person connected with OAuth and where each one works: "make
+ * ChatGPT always use workspace X", "default workspace for my Claude
+ * connection", "list my connected apps". Both blind baselines (2026-09-30)
+ * searched exactly this and got only `orgs select`, which changes the calling
+ * app or CLI and never another app; "connection" alone also pulled in the
+ * LinkedIn connections card.
+ */
+function isConnectedAppsIntent(query) {
+    if (/\bconnected apps?\b/.test(query))
+        return true;
+    const connection = /\b(oauth (?:apps?|clients?|connections?|grants?)|mcp (?:clients?|connections?|connectors?))\b/.test(query);
+    const app = connection || /\b(chatgpt|claude|codex|ai (?:apps?|assistants?|clients?))\b/.test(query);
+    if (!app)
+        return false;
+    // An app name alone is not enough ("make Claude always use my brand voice"):
+    // the ask must be about which workspace it works in, or list the connections.
+    const workspaceChoice = /\b(workspaces?|organi[sz]ations?|orgs?)\b/.test(query)
+        && /\b(default|always|without asking|which|per (?:app|connection|client))\b/.test(query);
+    return workspaceChoice || (connection && /\b(list|show|see|which|my)\b/.test(query));
+}
 function explicitCapabilityIntent(query) {
+    if (isConnectedAppsIntent(query))
+        return ROUTE_BY_ID.get("workspace-access") ?? null;
     if (/\b(infographic|graphic designer|render html|carousel pages|visual design|gtm flow image)\b/.test(query))
         return ROUTE_BY_ID.get("visual-rendering") ?? null;
     if (isUgcIntent(query))
@@ -1236,6 +1261,14 @@ function recommendationsFor(card, query) {
             exactMcpCall: CAPABILITY_ROUTE_MCP_CALLS.localBusinessScrape(),
         };
     }
+    if (card.id === "workspace-access" && isConnectedAppsIntent(query)) {
+        return {
+            tools: ["oxygen_connector_list", "oxygen_connector_update"],
+            commands: ["connectors list", "connectors set"],
+            exactCommand: "oxygen connectors list --json",
+            exactMcpCall: CAPABILITY_ROUTE_MCP_CALLS.connectedAppsList(),
+        };
+    }
     if (card.id === "connected-linkedin" && isLinkedInAccountConnectIntent(query)) {
         return {
             tools: ["oxygen_senders_connect", "oxygen_senders_list", "oxygen_billing_commitments"],

package/node_modules/@oxygen/shared/dist/contracts/connectors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `PATCH /api/cli/connectors/{connection}`: the settings one connected app
+ * (an MCP OAuth client such as ChatGPT, Claude or Codex) keeps for itself.
+ *
+ * Today that is its default workspace: the workspace the app works in without
+ * asking. It is the same per-connection choice `oxygen_orgs_select` makes from
+ * inside the app, so either surface changes one setting and the latest choice
+ * wins. The contract is the extension point for later per-connection settings
+ * (a per-connection credit ceiling is planned, OXP-11.5.23): add the field here
+ * and the route, the CLI flags and the MCP tool follow.
+ */
+import type { OperationSpec } from "./operations.js";
+import { type Infer } from "./schema.js";
+export declare const CONNECTOR_UPDATE_CONTRACT: import("./schema.js").ContractObject<{
+    readonly default_workspace: {
+        oneOf: [import("./schema.js").StringProperty, import("./schema.js").NullProperty];
+        description?: string;
+    };
+}, never>;
+export type ConnectorUpdate = Infer<typeof CONNECTOR_UPDATE_CONTRACT>;
+/** The route's path value for "the app making this request". */
+export declare const CURRENT_CONNECTOR_REF = "current";
+export declare const CONNECTOR_UPDATE_OPERATION: OperationSpec<typeof CONNECTOR_UPDATE_CONTRACT>;

package/node_modules/@oxygen/shared/dist/contracts/connectors.js

@@ -0,0 +1,34 @@
+import { nullable, obj, str } from "./schema.js";
+export const CONNECTOR_UPDATE_CONTRACT = obj({
+    default_workspace: nullable(str({
+        minLength: 1,
+        maxLength: 200,
+        description: "Workspace id, slug or exact name (you must be a member). null = ask each time.",
+    })),
+});
+const inferMatchesRoute = true;
+void inferMatchesRoute;
+/** The route's path value for "the app making this request". */
+export const CURRENT_CONNECTOR_REF = "current";
+export const CONNECTOR_UPDATE_OPERATION = {
+    id: "connectors.update",
+    route: "/api/cli/connectors/{connection}",
+    method: "PATCH",
+    contract: CONNECTOR_UPDATE_CONTRACT,
+    cli: {
+        path: ["connectors", "set"],
+        summary: "Set the default workspace of one connected app (ChatGPT, Claude, Codex or another app connected to OXYGEN with OAuth), so that app works there without asking. Only that app changes; your other apps and this CLI keep their own workspace. It is the same setting the app changes when you pick a workspace inside it, so the latest choice wins. --clear-default-workspace makes the app ask again. Free; `connectors list` shows your apps and each one's current default.",
+        argument: {
+            name: "connection",
+            description: "The app's id from `connectors list`, or its name (e.g. ChatGPT) when you have one app of that name.",
+        },
+    },
+    mcp: {
+        name: "oxygen_connector_update",
+        title: "Oxygen: Set Connected App Workspace",
+        description: "Sets the default workspace of one connected app (ChatGPT, Claude, Codex…), leaving your other apps unchanged. Same setting as picking a workspace inside that app; latest wins. connection: id or name from oxygen_connector_list, or \"current\" for this app. Free.",
+        pack: "workspace",
+    },
+    mutates: true,
+    spends: false,
+};

package/node_modules/@oxygen/shared/dist/contracts/operations.d.ts

@@ -1,9 +1,3 @@
-/**
- * One entry per customer operation that edits a resource: the route it calls,
- * the contract its body satisfies, and the names it carries on the CLI and MCP.
- * The CLI command, the MCP tool and the route read the same spec, so the three
- * cannot disagree on which fields exist. Leaf and browser-safe.
- */
 import type { ContractObject } from "./schema.js";
 export type OperationSpec<C extends ContractObject = ContractObject> = {
     /** Stable id, `<resource>.<verb>`. */

package/node_modules/@oxygen/shared/dist/contracts/operations.js

@@ -1,3 +1,10 @@
+/**
+ * One entry per customer operation that edits a resource: the route it calls,
+ * the contract its body satisfies, and the names it carries on the CLI and MCP.
+ * The CLI command, the MCP tool and the route read the same spec, so the three
+ * cannot disagree on which fields exist. Leaf and browser-safe.
+ */
+import { CONNECTOR_UPDATE_OPERATION } from "./connectors.js";
 import { SENDER_LIMITS_SET_OPERATION } from "./sender-limits.js";
 /** The route with its `{param}` segments filled in, each URL-encoded. */
 export function operationPath(spec, params) {
@@ -8,4 +15,4 @@ export function operationPath(spec, params) {
         return encodeURIComponent(value);
     });
 }
-export const OPERATION_SPECS = [SENDER_LIMITS_SET_OPERATION];
+export const OPERATION_SPECS = [SENDER_LIMITS_SET_OPERATION, CONNECTOR_UPDATE_OPERATION];

package/node_modules/@oxygen/shared/dist/feature-gates.d.ts

@@ -80,6 +80,11 @@ export type FeatureGateResolution = {
  *   instead of a sending seat (`packages/shared/src/credit-gate.ts`). A wrong
  *   "on" while commitments do not bill every connectable kind would admit
  *   accounts nothing ever charges.
+ * - OXYGEN_MCP_EVENTS_ENABLED — (b). Lets workspace events leave OXYGEN as
+ *   signed POSTs to third-party callback URLs and lets those events start
+ *   unattended ChatGPT runs (`packages/shared/src/mcp-events-enabled.ts`, ADR
+ *   0030 §11). It stays off in production until the per-connection credit
+ *   ceiling exists; a remote "on" would bypass that decision.
  *
  * The list is a guard, not a to-do: none of these is migrated, and
  * `findFeatureGateRegistryViolations` fails the build's tests if one ever is.

package/node_modules/@oxygen/shared/dist/feature-gates.js

@@ -71,6 +71,11 @@
  *   instead of a sending seat (`packages/shared/src/credit-gate.ts`). A wrong
  *   "on" while commitments do not bill every connectable kind would admit
  *   accounts nothing ever charges.
+ * - OXYGEN_MCP_EVENTS_ENABLED — (b). Lets workspace events leave OXYGEN as
+ *   signed POSTs to third-party callback URLs and lets those events start
+ *   unattended ChatGPT runs (`packages/shared/src/mcp-events-enabled.ts`, ADR
+ *   0030 §11). It stays off in production until the per-connection credit
+ *   ceiling exists; a remote "on" would bypass that decision.
  *
  * The list is a guard, not a to-do: none of these is migrated, and
  * `findFeatureGateRegistryViolations` fails the build's tests if one ever is.
@@ -87,6 +92,7 @@ export const NEVER_FLAGGABLE = [
     "OXYGEN_BYOK_DAILY_CAPS",
     "OXYGEN_REPRICING_2026_09_EFFECTIVE_AT",
     "OXYGEN_CREDIT_GATE_ENABLED",
+    "OXYGEN_MCP_EVENTS_ENABLED",
 ];
 /**
  * Every server-side gate resolved through PostHog.

package/node_modules/@oxygen/shared/dist/knowledge-bootstrap.d.ts

@@ -3,7 +3,8 @@
  *
  * WHAT IT IS. Exactly once in a workspace's life, OXYGEN researches the customer's
  * OWN company from the domain the creator typed when the workspace was created
- * (control-DB `organizations.iconDomain`), then fills the typed company profile
+ * (control-DB `organizations.iconDomain`), or from the company LinkedIn page they
+ * typed instead when the company has no website, then fills the typed company profile
  * (`ox_context.company_profile`) and writes one cited wiki page. A founder who
  * signs up should not face an empty Knowledge Graph and have to type their own
  * positioning back at us; every grounded AI action downstream (message drafts, AI
@@ -25,8 +26,9 @@
  *                    sub-ceiling on the provider (external-money) half. The cap bounds
  *                    OXYGEN's own money now, and it is the same number.
  *   2. AUTHORIZED  — it runs only for a workspace whose creator typed the company
- *                    website into the REQUIRED field at workspace creation; that
- *                    entry is recorded as `knowledge_bootstrap_consent` (source
+ *                    website, or its LinkedIn company page when it has no website
+ *                    (Philipp, 2026-09-30), into the REQUIRED field at workspace
+ *                    creation; that entry is recorded as `knowledge_bootstrap_consent` (source
  *                    `workspace_creation`) and read FAIL-CLOSED, so a workspace that
  *                    predates the field is never researched and a personal-email
  *                    signup with no website never reaches the worker. We never
@@ -86,6 +88,17 @@ export declare const KNOWLEDGE_BOOTSTRAP_MAX_PAGES_READ = 5;
  * it. This bounds latency only; the credit ceilings above remain the money guard.
  */
 export declare const KNOWLEDGE_BOOTSTRAP_PROVIDER_TIMEOUT_MS = 45000;
+/**
+ * The company-page lookup's budget when a LinkedIn company page, not a domain, names
+ * the company. That lookup is then the pass's only company evidence, and there is no
+ * website to fall back on. The managed lane measured successful company lookups at
+ * p90 37.1 s, p99 62.2 s and max 68.6 s over 3,138 calls to 2026-09-20
+ * (packages/providers/src/scraper/managed.ts), so the 45 s leg budget would abandon
+ * real answers. 90 s matches that lane's own abort budget. A pass with a website
+ * behind the page can overrun the step deadline in the worst case. The abort check
+ * between legs then ends it as `step_aborted`, and the credit ceilings are unchanged.
+ */
+export declare const KNOWLEDGE_BOOTSTRAP_COMPANY_PAGE_LOOKUP_TIMEOUT_MS = 90000;
 /** Fleet-wide kill switch, matching OXYGEN_KNOWLEDGE_RETRIEVAL/AUTO_SOURCES_DISABLED. */
 export declare const KNOWLEDGE_BOOTSTRAP_DISABLED_ENV_VAR = "OXYGEN_KNOWLEDGE_BOOTSTRAP_DISABLED";
 /**
@@ -140,7 +153,11 @@ export type KnowledgeBootstrapMarker = {
     run_id: string | null;
     /** Managed credits actually spent, across every phase. Never exceeds the cap. */
     credits_used: number;
-    /** The workspace domain researched (from organizations.iconDomain). */
+    /**
+     * The workspace domain researched (from organizations.iconDomain). Null (stored
+     * as "", the key the execution and onboarding checks compare on) for a company
+     * named by its LinkedIn page, which `linkedin_url` then carries.
+     */
     domain: string | null;
     /** Why a pass was skipped/partial/failed — a short machine-ish token, not prose. */
     reason: string | null;
@@ -163,7 +180,8 @@ export type KnowledgeBootstrapMarker = {
      * Canonical company LinkedIn URL the requester supplied, when they supplied one.
      * The same hint `/setup` stores at KNOWLEDGE_BOOTSTRAP_LINKEDIN_METADATA_KEY, but
      * carried per-request so a one-off `--linkedin` never mutates the workspace's
-     * recorded answer.
+     * recorded answer. For a company named by its LinkedIn page it is the company
+     * itself: the page the automatic pass was claimed for.
      */
     linkedin_url?: string | null;
 };
@@ -180,11 +198,32 @@ export type KnowledgeBootstrapMarker = {
  * nobody recorded.
  */
 export declare const KNOWLEDGE_BOOTSTRAP_CONSENT_METADATA_KEY = "knowledge_bootstrap_consent";
+/**
+ * Control-DB `organizations.metadata` key for the consent of a workspace named by its
+ * LinkedIn company page because the company has no website (Philipp, 2026-09-30).
+ *
+ * A key of its own, not a field on the consent above, on purpose. A worker built before
+ * it existed reads only that key, and a consent there with a page and no domain would
+ * send it to its icon fallback (a domain derived from the creator's email address, so
+ * possibly another company) or to a durable `no_company_domain` skip. Under this key the
+ * same worker finds no consent at all: a transient `not_consented` that writes nothing,
+ * until a worker that reads pages takes the pass. A rolling deploy serves new web code
+ * well before the worker roles move, so this is a real window, not a hypothetical one.
+ * Writers set exactly one of the two keys.
+ */
+export declare const KNOWLEDGE_BOOTSTRAP_COMPANY_PAGE_CONSENT_METADATA_KEY = "knowledge_bootstrap_company_page_consent";
 /** The recorded consent, exactly as stored under the key above. */
 export type KnowledgeBootstrapConsent = {
     /** New workspace creation may authorize bounded creator-profile research. */
     scope?: "company_and_creator";
     domain?: string;
+    /**
+     * The company LinkedIn page the creator named INSTEAD of a website, canonical
+     * `/company/` form. Present only on a company-page consent
+     * (`KNOWLEDGE_BOOTSTRAP_COMPANY_PAGE_CONSENT_METADATA_KEY`), which never carries a
+     * domain; it is then the company the research pass starts from.
+     */
+    company_linkedin_url?: string;
     /** Canonical `/in/` profile supplied by this exact creator; never company evidence. */
     creator_linkedin_url?: string;
     /** ISO timestamp consent was recorded. Must parse; a marker that does not is not consent. */
@@ -222,11 +261,21 @@ export declare function readKnowledgeBootstrapConsent(metadata: unknown): Knowle
  * personal profile as if it were the company is exactly the confidently-wrong write
  * the bootstrap's domain gate exists to prevent.
  *
- * Optional by design. Its absence is normal and costs nothing: the research pass
- * resolves the company from the domain and pays for a LinkedIn lookup only when it
- * has a page worth looking up.
+ * Optional when the workspace named a domain: the research pass then resolves the
+ * company from the domain. For a company with no website it is the only company
+ * identity the workspace has, and the consent carries the same page as the anchor
+ * the research starts from.
  */
 export declare const KNOWLEDGE_BOOTSTRAP_LINKEDIN_METADATA_KEY = "company_linkedin_url";
+/**
+ * The company LinkedIn page a workspace names instead of a website, as canonical
+ * `https://www.linkedin.com/company/<slug>`, or null. A pasted sub-page
+ * (`/company/acme/about/`) resolves to its company; `/school/` pages and personal
+ * `/in/` profiles do not, because the research provider looks a company up by
+ * exactly this form, and researching a person as if they were the company is the
+ * confidently-wrong write the authorization exists to prevent.
+ */
+export declare function normalizeBootstrapCompanyLinkedinUrl(value: unknown): string | null;
 /**
  * How long a `running` marker may sit before the workspace is reported as STUCK.
  *

package/node_modules/@oxygen/shared/dist/knowledge-bootstrap.js

@@ -3,7 +3,8 @@
  *
  * WHAT IT IS. Exactly once in a workspace's life, OXYGEN researches the customer's
  * OWN company from the domain the creator typed when the workspace was created
- * (control-DB `organizations.iconDomain`), then fills the typed company profile
+ * (control-DB `organizations.iconDomain`), or from the company LinkedIn page they
+ * typed instead when the company has no website, then fills the typed company profile
  * (`ox_context.company_profile`) and writes one cited wiki page. A founder who
  * signs up should not face an empty Knowledge Graph and have to type their own
  * positioning back at us; every grounded AI action downstream (message drafts, AI
@@ -25,8 +26,9 @@
  *                    sub-ceiling on the provider (external-money) half. The cap bounds
  *                    OXYGEN's own money now, and it is the same number.
  *   2. AUTHORIZED  — it runs only for a workspace whose creator typed the company
- *                    website into the REQUIRED field at workspace creation; that
- *                    entry is recorded as `knowledge_bootstrap_consent` (source
+ *                    website, or its LinkedIn company page when it has no website
+ *                    (Philipp, 2026-09-30), into the REQUIRED field at workspace
+ *                    creation; that entry is recorded as `knowledge_bootstrap_consent` (source
  *                    `workspace_creation`) and read FAIL-CLOSED, so a workspace that
  *                    predates the field is never researched and a personal-email
  *                    signup with no website never reaches the worker. We never
@@ -52,6 +54,7 @@
  * Professional person evidence remains actor-scoped; ICP/offers are hypotheses.
  * The provider sub-cap covers every external research leg, including fallbacks.
  */
+import { normalizeLinkedinCompanyUrl } from "./dnc-identities.js";
 import { normalizeLinkedinProfileUrl } from "./linkedin-url.js";
 /** Hard ceiling on managed credits ONE workspace bootstrap may spend, all phases. */
 export const KNOWLEDGE_BOOTSTRAP_MAX_CREDITS = 30;
@@ -86,6 +89,17 @@ export const KNOWLEDGE_BOOTSTRAP_MAX_PAGES_READ = 5;
  * it. This bounds latency only; the credit ceilings above remain the money guard.
  */
 export const KNOWLEDGE_BOOTSTRAP_PROVIDER_TIMEOUT_MS = 45_000;
+/**
+ * The company-page lookup's budget when a LinkedIn company page, not a domain, names
+ * the company. That lookup is then the pass's only company evidence, and there is no
+ * website to fall back on. The managed lane measured successful company lookups at
+ * p90 37.1 s, p99 62.2 s and max 68.6 s over 3,138 calls to 2026-09-20
+ * (packages/providers/src/scraper/managed.ts), so the 45 s leg budget would abandon
+ * real answers. 90 s matches that lane's own abort budget. A pass with a website
+ * behind the page can overrun the step deadline in the worst case. The abort check
+ * between legs then ends it as `step_aborted`, and the credit ceilings are unchanged.
+ */
+export const KNOWLEDGE_BOOTSTRAP_COMPANY_PAGE_LOOKUP_TIMEOUT_MS = 90_000;
 /** Fleet-wide kill switch, matching OXYGEN_KNOWLEDGE_RETRIEVAL/AUTO_SOURCES_DISABLED. */
 export const KNOWLEDGE_BOOTSTRAP_DISABLED_ENV_VAR = "OXYGEN_KNOWLEDGE_BOOTSTRAP_DISABLED";
 /**
@@ -149,6 +163,20 @@ export function isKnowledgeBootstrapStatus(value) {
  * nobody recorded.
  */
 export const KNOWLEDGE_BOOTSTRAP_CONSENT_METADATA_KEY = "knowledge_bootstrap_consent";
+/**
+ * Control-DB `organizations.metadata` key for the consent of a workspace named by its
+ * LinkedIn company page because the company has no website (Philipp, 2026-09-30).
+ *
+ * A key of its own, not a field on the consent above, on purpose. A worker built before
+ * it existed reads only that key, and a consent there with a page and no domain would
+ * send it to its icon fallback (a domain derived from the creator's email address, so
+ * possibly another company) or to a durable `no_company_domain` skip. Under this key the
+ * same worker finds no consent at all: a transient `not_consented` that writes nothing,
+ * until a worker that reads pages takes the pass. A rolling deploy serves new web code
+ * well before the worker roles move, so this is a real window, not a hypothetical one.
+ * Writers set exactly one of the two keys.
+ */
+export const KNOWLEDGE_BOOTSTRAP_COMPANY_PAGE_CONSENT_METADATA_KEY = "knowledge_bootstrap_company_page_consent";
 /**
  * Read consent out of an organization's control-DB metadata blob, FAIL-CLOSED.
  *
@@ -163,7 +191,22 @@ export const KNOWLEDGE_BOOTSTRAP_CONSENT_METADATA_KEY = "knowledge_bootstrap_con
 export function readKnowledgeBootstrapConsent(metadata) {
     if (!metadata || typeof metadata !== "object" || Array.isArray(metadata))
         return null;
-    const raw = metadata[KNOWLEDGE_BOOTSTRAP_CONSENT_METADATA_KEY];
+    const record = metadata;
+    const domainConsent = readGrant(record[KNOWLEDGE_BOOTSTRAP_CONSENT_METADATA_KEY]);
+    if (domainConsent) {
+        const domain = domainConsent.record.domain;
+        return { ...domainConsent.grant, ...(typeof domain === "string" ? { domain } : {}) };
+    }
+    // Fail closed here too: a page consent counts only as the creator-scoped grant it is
+    // written as, naming a page that still resolves to a company. Anything less is no
+    // consent, never a reason to fall back to a domain nobody named.
+    const pageConsent = readGrant(record[KNOWLEDGE_BOOTSTRAP_COMPANY_PAGE_CONSENT_METADATA_KEY]);
+    const page = normalizeBootstrapCompanyLinkedinUrl(pageConsent?.record.company_linkedin_url);
+    if (!pageConsent || pageConsent.grant.scope !== "company_and_creator" || !page)
+        return null;
+    return { ...pageConsent.grant, company_linkedin_url: page };
+}
+function readGrant(raw) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
         return null;
     const record = raw;
@@ -182,12 +225,14 @@ export function readKnowledgeBootstrapConsent(metadata) {
         ? normalizeLinkedinProfileUrl(record.creator_linkedin_url)?.dispatchUrl ?? null
         : null;
     return {
-        granted_at: grantedAt,
-        ...(scope ? { scope } : {}),
-        ...(typeof record.domain === "string" ? { domain: record.domain } : {}),
-        ...(creatorLinkedinUrl ? { creator_linkedin_url: creatorLinkedinUrl } : {}),
-        source: typeof record.source === "string" && record.source.length > 0 ? record.source : null,
-        granted_by_clerk_user_id: grantedBy,
+        record,
+        grant: {
+            granted_at: grantedAt,
+            ...(scope ? { scope } : {}),
+            ...(creatorLinkedinUrl ? { creator_linkedin_url: creatorLinkedinUrl } : {}),
+            source: typeof record.source === "string" && record.source.length > 0 ? record.source : null,
+            granted_by_clerk_user_id: grantedBy,
+        },
     };
 }
 /**
@@ -203,11 +248,27 @@ export function readKnowledgeBootstrapConsent(metadata) {
  * personal profile as if it were the company is exactly the confidently-wrong write
  * the bootstrap's domain gate exists to prevent.
  *
- * Optional by design. Its absence is normal and costs nothing: the research pass
- * resolves the company from the domain and pays for a LinkedIn lookup only when it
- * has a page worth looking up.
+ * Optional when the workspace named a domain: the research pass then resolves the
+ * company from the domain. For a company with no website it is the only company
+ * identity the workspace has, and the consent carries the same page as the anchor
+ * the research starts from.
  */
 export const KNOWLEDGE_BOOTSTRAP_LINKEDIN_METADATA_KEY = "company_linkedin_url";
+/**
+ * The company LinkedIn page a workspace names instead of a website, as canonical
+ * `https://www.linkedin.com/company/<slug>`, or null. A pasted sub-page
+ * (`/company/acme/about/`) resolves to its company; `/school/` pages and personal
+ * `/in/` profiles do not, because the research provider looks a company up by
+ * exactly this form, and researching a person as if they were the company is the
+ * confidently-wrong write the authorization exists to prevent.
+ */
+export function normalizeBootstrapCompanyLinkedinUrl(value) {
+    if (typeof value !== "string")
+        return null;
+    const companyRoot = value.trim().replace(/(\/company\/[^/?#]+)\/[^?#]*/i, "$1");
+    const canonical = normalizeLinkedinCompanyUrl(companyRoot);
+    return canonical?.startsWith("https://www.linkedin.com/company/") ? canonical : null;
+}
 /**
  * How long a `running` marker may sit before the workspace is reported as STUCK.
  *