@oxygen-agent/cli 1.1011.322 → 1.1011.405

package/dist/index.js

@@ -1,3 +1,4 @@
+import { registerCrmSupportFlags, readCrmNoteEditFields, readCrmPhotoFields, readCrmFileLabel, buildCrmObjectsPath, buildCrmConnectionsPath } from "./crm-support-flags.js";
 import { execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, createReadStream, createWriteStream, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
@@ -9,6 +10,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, CommanderError, Option } from "commander";
 import { registerUgcCommands } from "./ugc-commands.js";
 import { registerConnectorsCommands } from "./connectors-commands.js";
+import { registerSettingsCommands } from "./settings-commands.js";
 import { registerKnowledgeRepositoryCommands } from "./knowledge-repository-commands.js";
 import { registerVisualCommands } from "./visual-commands.js";
 import { renderPrimaryProviderBoard } from "./admin-primary-providers-render.js";
@@ -25,7 +27,8 @@ import { LINKEDIN_SENDER_LIMIT_DEFAULTS, LINKEDIN_SENDER_LIMIT_MAXIMUMS, } from
 import { SEQUENCE_LIFECYCLES, sequenceDisplayStatus } from "@oxygen/shared/sequence-lifecycle";
 import { operationPath } from "@oxygen/shared/contracts/operations";
 import { SENDER_LIMITS_SET_OPERATION } from "@oxygen/shared/contracts/sender-limits";
-import { addContractFlags } from "./contract-flags.js";
+import { addContractFlags, readContractFlags } from "./contract-flags.js";
+import { INTEGRATION_CONNECT_ACCOUNT_CONTRACT } from "@oxygen/shared/contracts/integration-connect";
 import { buildSenderLimitsBody, parseWorkingDaysOption, SENDER_LIMITS_FLAG_OVERLAY } from "./sender-limits-flags.js";
 import { readColumnDecisionFlags } from "./column-decision-options.js";
 import { MANAGED_DATA_SUPPLIERS } from "@oxygen/shared/data-suppliers";
@@ -5641,7 +5644,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .action(async (options) => {
         await handleAsyncAction("crm photos", options, () => requestOxygen("/api/cli/crm/photos", {
             method: "POST",
-            body: buildCrmPhotosBody(options),
+            body: readCrmPhotoFields(options),
         }));
     }))
         .addCommand(new Command("fields")
@@ -5679,7 +5682,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("List configured CRM objects, or create/extend custom objects.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleReadActionWithLens("crm objects", options, () => requestOxygen("/api/cli/crm/objects"), formatCrmObjects);
+        await handleReadActionWithLens("crm objects", options, () => requestOxygen(buildCrmObjectsPath(options)), formatCrmObjects);
     })
         .addCommand(new Command("create")
         .description("Create or repair a custom CRM object. Defaults to dry-run.")
@@ -5807,14 +5810,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (object, rowId, options) => {
         await handleAsyncAction("crm connections", options, () => {
-            const params = new URLSearchParams();
-            if (options.conversationLimit)
-                params.set("conversation_limit", options.conversationLimit);
-            if (options.sequenceLimit)
-                params.set("sequence_limit", options.sequenceLimit);
-            const query = params.toString();
-            const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/connections`;
-            return requestOxygen(query ? `${base}?${query}` : base);
+            return requestOxygen(buildCrmConnectionsPath(object, rowId, options));
         });
     }))
         .addCommand(new Command("files")
@@ -5876,9 +5872,13 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             if (!put.ok) {
                 throw new OxygenError("attachment_upload_failed", `Object storage rejected the upload (${put.status}).`, { exitCode: 1 });
             }
-            return requestOxygen(completeUrl, {
+            const fileId = readRecordString(ticket.file, "id");
+            const recordRowId = readRecordString(ticket.record, "row_id");
+            if (!fileId || !recordRowId)
+                throw new OxygenError("attachment_upload_failed", "The upload reservation has no file or record id.", { exitCode: 1 });
+            return requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(recordRowId)}/files/${encodeURIComponent(fileId)}/uploaded`, {
                 method: "POST",
-                body: readOption(options.label) ? { label: readOption(options.label) } : {},
+                body: readCrmFileLabel(options),
             });
         });
     }))
@@ -6018,16 +6018,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (noteId, options) => {
         await handleAsyncAction("crm notes update", options, () => {
-            // Absent --title leaves it; --title "" clears it.
-            const title = readClearableOption(options.title);
             return requestOxygen(`/api/cli/crm/notes/${encodeURIComponent(noteId)}`, {
                 method: "PATCH",
-                body: {
-                    ...(readOption(options.body) ? { body: readOption(options.body) } : {}),
-                    ...(title !== undefined ? { title } : {}),
-                    ...(options.pin ? { pinned: true } : {}),
-                    ...(options.unpin ? { pinned: false } : {}),
-                },
+                body: readCrmNoteEditFields(options),
             });
         });
     }))
@@ -6886,21 +6879,26 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("delete-row")
-        .description("Delete one workspace table row.")
+        .description("Delete one workspace table row. A lead enrolled in a campaign stays enrolled; the response names those campaigns.")
         .argument("<table>", "Table id or slug.")
         .argument("<row_id>", "Workspace row UUID.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, rowId, options) => {
-        await handleAsyncAction("tables delete-row", options, () => requestOxygen("/api/cli/tables/rows/delete", {
-            method: "POST",
-            body: {
-                table,
-                row_id: rowId,
-            },
-        }));
+        await handleAsyncAction("tables delete-row", options, async () => {
+            const data = await requestOxygen("/api/cli/tables/rows/delete", {
+                method: "POST",
+                body: {
+                    table,
+                    row_id: rowId,
+                },
+            });
+            if (!options.json)
+                writeRowDeleteWarnings(data);
+            return data;
+        });
     }))
         .addCommand(new Command("delete-rows")
-        .description("Delete multiple workspace table rows.")
+        .description("Delete multiple workspace table rows. Leads enrolled in a campaign stay enrolled; the response names those campaigns.")
         .argument("<table>", "Table id or slug.")
         .option("--row-ids-json <json>", "JSON array of workspace row UUIDs.")
         .option("--row-ids-file <path>", "File containing row UUIDs or rows with a _row_id column.")
@@ -6911,13 +6909,16 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .action(async (table, options) => {
         await handleAsyncAction("tables delete-rows", options, async () => {
             const rowIds = await readDeleteRowIdsOption(options);
-            return requestOxygen("/api/cli/tables/rows/delete", {
+            const data = await requestOxygen("/api/cli/tables/rows/delete", {
                 method: "POST",
                 body: {
                     table,
                     row_ids: rowIds,
                 },
             });
+            if (!options.json)
+                writeRowDeleteWarnings(data);
+            return data;
         });
     }))
         .addCommand(new Command("upsert")
@@ -6967,6 +6968,19 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--limit <n>", "Maximum rows to export. Defaults to 100; hard cap is 1000.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, options) => {
+        if (!options.json && !options.output && options.format?.trim().toLowerCase() === "table") {
+            // The human-readable table itself, not a JSON object holding it as one
+            // escaped string (blind user evals, 2026-09-30). --json keeps the envelope.
+            try {
+                const { content } = await exportRows(table, options);
+                const text = typeof content === "string" ? content : "";
+                process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+            }
+            catch (error) {
+                emitCliFailure("tables export", error);
+            }
+            return;
+        }
         await handleAsyncAction("tables export", options, () => exportRows(table, options));
     }))
         .addCommand(new Command("export-bundle")
@@ -13336,21 +13350,24 @@ Examples:
         .action(async (options) => {
         await handleAsyncAction("integrations list", options, () => requestOxygen("/api/cli/integrations/composio/list"));
     }))
-        .addCommand(new Command("connect")
+        .addCommand(addContractFlags(new Command("connect")
         .description("Connect an integration. For OAuth toolkits, running this command immediately creates a pending provider authorization and returns a redirect URL; account access starts only if you approve on the provider's page. This is not a price preview. On a repriced workspace, a connected X account reserves 1,000 credits ($10) monthly; inspect the current pricing schedule with `oxygen limits show --json` before connecting. API-key integrations accept --api-key. Run without credentials only for an API-key integration to get a 0-credit preview of its exact fields (mode: needs_api_key): no credential is submitted, nothing is stored, and no provider call is made. Use repeatable --credential name=value when a provider also requires a host, subdomain, or other named value. To keep a secret out of shell history and process arguments, open the preview's web_url and submit it in Connections; --api-key is for controlled noninteractive use. Credential submission creates or replaces the connection immediately and needs no separate --approved flag. LinkedIn and WhatsApp return a Unipile hosted-auth URL instead (`oxygen senders connect` / `oxygen whatsapp connect` are the canonical paths).")
         .argument("<integration_id>", "Integration id, such as 'slack' or 'serpapi'.")
         .option("--api-key <value>", "API key for controlled noninteractive use. Literal values can appear in shell history and process arguments; prefer the preview web_url for manual entry.")
         .option("--credential <name=value>", "Named provider credential field. Repeat for multi-field integrations (for example, PostHog: --credential subdomain=us).", collectRepeatable, [])
-        .option("--account-id <id>", "Provider account id for integrations that span multiple accounts (e.g. Cloudflare when the token can access more than one account).")
         .option("--country <code>", "ISO 3166-1 alpha-2 country where the LinkedIn account owner normally signs in (required for `connect linkedin`; picks the egress proxy).")
         .option("--pairing-phone-number <e164>", "WhatsApp only: pair by code sent to this E.164 number instead of showing a QR.")
         .option("--acknowledge-risk", "LinkedIn only, required for a new account: LinkedIn restricts automated activity; pacing reduces but does not remove the risk.")
-        .option("--json", "Print a JSON envelope.")
+        .option("--json", "Print a JSON envelope."), INTEGRATION_CONNECT_ACCOUNT_CONTRACT, {
+        account_id: {
+            valueName: "<id>",
+            help: "Provider account id for integrations that span multiple accounts (e.g. Cloudflare when the token can access more than one account).",
+        },
+    })
         .action(async (integrationId, options) => {
         await handleAsyncAction("integrations connect", options, () => {
             const apiKey = readOption(options.apiKey)?.trim();
             const credentials = readNamedCredentials(options.credential);
-            const accountId = readOption(options.accountId);
             const country = readOption(options.country)?.trim();
             const pairingPhoneNumber = readOption(options.pairingPhoneNumber)?.trim();
             return requestOxygen("/api/cli/integrations/connect", {
@@ -13359,7 +13376,7 @@ Examples:
                     integration_id: integrationId,
                     ...(apiKey ? { api_key: apiKey } : {}),
                     ...(credentials ? { credentials } : {}),
-                    ...(accountId ? { account_id: accountId } : {}),
+                    ...readContractFlags(options, INTEGRATION_CONNECT_ACCOUNT_CONTRACT),
                     ...(country ? { country } : {}),
                     ...(pairingPhoneNumber ? { pairing_phone_number: pairingPhoneNumber } : {}),
                     ...(options.acknowledgeRisk ? { acknowledge_linkedin_risk: true } : {}),
@@ -15683,11 +15700,11 @@ Examples:
         }, formatSequenceAnalyticsHealth);
     }))
         .addCommand(new Command("create")
-        .description("Create a draft multichannel sequence from a steps JSON file. Supports LinkedIn, email, WhatsApp, human call_task, and connected-CRM crm_task journeys. Assign LinkedIn senders with --senders (optional at create — a draft can sit senderless, but enroll/start require at least one for LinkedIn journeys). Native email sends through connected Google/Microsoft mailboxes, including Microsoft SMTP transport; optional --email-* flags bind an Instantly campaign. Install/read the oxygen-sequencer skill for complete mapped CRM task examples.")
-        .addHelpText("after", "\nSenders: each new lead gets one of the --sender-profiles people, and its LinkedIn and email steps come from that person (email from one of their inboxes). Per step, in the steps file: email_send.sender_mailbox_id sends that email from one exact inbox; a LinkedIn step's sender_profile_id sends it from one selected person. Invite, message, inmail and withdraw_invite steps must share one sender_profile_id or none: that person then owns every lead's LinkedIn thread (LinkedIn allows one of your accounts per conversation). visit_profile, follow, like_post and comment_post may each name anyone selected. An email whose From changes, including the return to the lead's inbox, needs its own subject_template.\n")
+        .description("Create a draft multichannel sequence from a steps JSON file. Supports LinkedIn, email, WhatsApp, human call_task, and connected-CRM crm_task journeys. Assign LinkedIn senders with --senders (optional at create — a draft can sit senderless, but enroll/start require at least one for LinkedIn journeys). Native email sends through connected Google/Microsoft mailboxes, including Microsoft SMTP transport; optional --email-* flags bind an Instantly campaign. Install/read the oxygen-sequencer skill for per-step senders, the launch preview and complete mapped CRM task examples.")
+        .addHelpText("after", "\nSenders: each new lead gets one of the --sender-profiles people, the one with the fewest of this sequence's leads (a lead already talking to one of your LinkedIn accounts keeps that account's person), and its LinkedIn and email steps come from that person (email from one of their inboxes). Per step, in the steps file: email_send.sender_profile_id sends that email from any inbox of one selected person (the normal inbox rotation spreads leads across that person's inboxes and each lead keeps its one; a lead already assigned to that person keeps its own inbox; with none usable the lead waits, never using a colleague's inbox), and email_send.sender_mailbox_id from one exact inbox (set one or neither); a LinkedIn step's sender_profile_id sends it from one selected person. Invite, message, inmail and withdraw_invite steps must share one sender_profile_id or none: that person then owns every lead's LinkedIn thread (LinkedIn allows one of your accounts per conversation). visit_profile, follow, like_post and comment_post may each name anyone selected. An email whose From changes, including the return to the lead's inbox, needs its own subject_template. To check who sends each step, run `sequences start <sequence>` without --approved; nothing changes.\n")
         .requiredOption("--name <name>", "Human-readable sequence name.")
         .requiredOption("--slug <slug>", "Unique slug for the sequence.")
-        .requiredOption("--steps-file <path>", "Path to a JSON file: { \"steps\": [...] }. LinkedIn steps (visit_profile | invite | wait_for_connection | message | inmail | follow | like_post | comment_post | withdraw_invite), email steps (email_send | email_enroll | email_move | email_stop), WhatsApp (whatsapp_message), human call tasks (call_task), connected-CRM tasks (crm_task; channel crm; exact identity record_mappings + explicit create/update policy + record_links + dynamic task property_mappings/associations), and control steps (wait | wait_for_signal | branch | stop), each with an `id`. Copy templates support {{column}} interpolation from the lead's row, {{column|fallback}} inline fallbacks, deterministic spintax — {{RANDOM|a|b|c}} or industry-standard bare {Hi|Hey|Hello}, nestable like {Would {Tuesday|Thursday} work|next week?} — and {% if column %}…{% endif %} conditionals; a bare {…} region is spintax only when it contains a top-level |, so literal braces (CSS/JSON) pass through. Every step's copy can also use {{sender_first_name}}, {{sender_last_name}} and {{sender_full_name}} (alias {{sender_name}}): the name of the person who sends that step (their sender profile, else the account or inbox display name), with no table column needed; email steps add {{sender_email}} (the from address). A row column of the same name WINS on collision, and a missing name renders empty. comment_post takes text_template and/or ai_prompt — a KG-grounded comment generated at send time (a paid AI call) that falls back to text_template if generation fails. A `branch` routes on signals (then/else) or the legacy connection_accepted/already_connected/open_profile sugar (then_id/else_id). A signal condition can also branch on the LEAD'S DATA: a data leaf { has_column: \"email\" } is true when that row_values column has a non-empty value (add present:false for \"missing\") — e.g. route leads that have an email down an email arm and the rest down a LinkedIn arm. MINIMAL EMAIL STEP SHAPE: { \"id\": \"s1\", \"channel\": \"email\", \"kind\": \"email_send\", \"subject_template\": \"...\", \"body_template\": \"...\" } — body_template is REQUIRED on email_send; subject_template is OPTIONAL and is the one control that decides threading: give a step its own subject and it goes out as a NEW email, omit it and the step continues the lead's previous email in the same thread, going out as \"Re: <the previous email's subject>\" (what the retired email_reply kind used to be — still accepted on input, rewritten into this shape, and reported under `warnings` in the response). The FIRST email step of a sequence must carry a subject, since it has no earlier thread to continue. MINIMAL WHATSAPP STEP SHAPE: { \"id\": \"s1\", \"channel\": \"whatsapp\", \"kind\": \"whatsapp_message\", \"template\": \"Hi {{first_name|there}} …\" } — template is REQUIRED, and a live WhatsApp start also needs the sequence's --whatsapp-cold-initiate opt-in. A/B tests use an explicit `variants` array of copy partials on the step (up to 25 alternates, a–z; spintax varies wording INSIDE one variant and is not A/B-tracked). For the complete replay-safe crm_task upsert mapping shape, install/read the oxygen-sequencer skill.")
+        .requiredOption("--steps-file <path>", "Path to a JSON file: { \"steps\": [...] }. LinkedIn steps (visit_profile | invite | wait_for_connection | message | inmail | follow | like_post | comment_post | withdraw_invite), email steps (email_send | email_enroll | email_move | email_stop), WhatsApp (whatsapp_message), human call tasks (call_task), connected-CRM tasks (crm_task; channel crm; exact identity record_mappings + explicit create/update policy + record_links + dynamic task property_mappings/associations), and control steps (wait | wait_for_signal | branch | stop), each with an `id`. Copy templates support {{column}} interpolation from the lead's row, {{column|fallback}} inline fallbacks, deterministic spintax — {{RANDOM|a|b|c}} or industry-standard bare {Hi|Hey|Hello}, nestable like {Would {Tuesday|Thursday} work|next week?} — and {% if column %}…{% endif %} conditionals; a bare {…} region is spintax only when it contains a top-level |, so literal braces (CSS/JSON) pass through. Every step's copy can also use {{sender_first_name}}, {{sender_last_name}} and {{sender_full_name}} (alias {{sender_name}}): the name of the person who sends that step (their sender profile, else the account or inbox display name), with no table column needed; email steps add {{sender_email}} (the from address). A row column of the same name WINS on collision, and a missing name renders empty. comment_post takes text_template and/or ai_prompt — a KG-grounded comment generated at send time (a paid AI call) that falls back to text_template if generation fails. A `branch` routes on signals (then/else) or the legacy connection_accepted/already_connected/open_profile sugar (then_id/else_id). A signal condition can also branch on the LEAD'S DATA: a data leaf { has_column: \"email\" } is true when that row_values column has a non-empty value (add present:false for \"missing\") — e.g. route leads that have an email down an email arm and the rest down a LinkedIn arm. MINIMAL EMAIL STEP SHAPE: { \"id\": \"s1\", \"channel\": \"email\", \"kind\": \"email_send\", \"subject_template\": \"...\", \"body_template\": \"...\" } — body_template is REQUIRED on email_send; subject_template is OPTIONAL and is the one control that decides threading: give a step its own subject and it goes out as a NEW email, omit it and the step continues the lead's previous email in the same thread, going out as \"Re: <the previous email's subject>\" (what the retired email_reply kind used to be — still accepted on input, rewritten into this shape, and reported under `warnings` in the response). The FIRST email step of a sequence must carry a subject, since it has no earlier thread to continue. MINIMAL WHATSAPP STEP SHAPE: { \"id\": \"s1\", \"channel\": \"whatsapp\", \"kind\": \"whatsapp_message\", \"template\": \"Hi {{first_name|there}} …\" } — template is REQUIRED, and a live WhatsApp start also needs the sequence's --whatsapp-cold-initiate opt-in. MINIMAL WAIT STEP SHAPE: { \"id\": \"w1\", \"kind\": \"wait\", \"days\": 3 } — days and/or hours, at least 1 hour in total. A/B tests use an explicit `variants` array of copy partials on the step (up to 25 alternates, a–z; spintax varies wording INSIDE one variant and is not A/B-tracked). For the complete replay-safe crm_task upsert mapping shape, install/read the oxygen-sequencer skill.")
         .option("--channels <list>", "Comma-separated channels: linkedin,email,whatsapp,call,crm. Defaults to the channels the journey touches. crm_task currently supports HubSpot.")
         .option("--whatsapp-cold-initiate", "WhatsApp: allow cold-initiating new chats (no prior conversation). Required to start a WhatsApp sequence live — WhatsApp via Unipile is unofficial WhatsApp Web, so cold-initiating is an explicit ban-risk opt-in.")
         .option("--phone-column-key <key>", "WhatsApp: row_values key holding each lead's phone number (else falls back to phone/phone_number/mobile).")
@@ -15715,7 +15732,7 @@ Examples:
         .option("--email-min-gap-minutes <n>", "Minimum same-mailbox gap, default 12 minutes (integer 0-720; 0 disables the extra gap). Sends are spread across the window and may be farther apart. Daily caps and windows still apply.")
         .option("--opportunity-value <usd>", "Estimated USD value of one positive-reply opportunity (>= 0). Analytics-only: sequence stats multiply it by the positive-reply count to report pipeline $ (stats.opportunities). Never gates a send or spends a credit.")
         .option("--mailboxes <ids>", "Per-sequence sending-account allowlist for native email (Instantly's 'Accounts to use'): comma-separated mailbox ids. Native email sends rotate ONLY over these mailboxes instead of the whole pool. Omit for the whole pool. Note: a narrow allowlist plus --esp-matching strict can starve sends when no allowed same-provider mailbox exists (surfaced as blocked defer reasons in stats).")
-        .option("--sender-profiles <ids>", "Send from these sender profiles (unified LinkedIn/WhatsApp/inbox identities): comma-separated profile ids. The server resolves each into its senders + inboxes. Live start is blocked if a selected profile lacks an account for a channel the journey uses.")
+        .option("--sender-profiles <ids>", "Send from these sender profiles (unified LinkedIn/WhatsApp/inbox identities): comma-separated profile ids (`oxygen senders profiles list` lists them). The server resolves each into its senders + inboxes. Live start is blocked if a selected profile lacks an account for a channel the journey uses.")
         .option("--no-stop-on-bounce", "Keep a lead's enrollment running after a hard bounce (default: stop it). The bounce is still recorded as an email_bounced signal either way.")
         .option("--exclude-contacted", "Default every enroll into this sequence to cross-campaign exclusion — skip leads any OTHER active sequence is already contacting. A per-enroll `sequences enroll --exclude-contacted` / `--no-exclude-contacted` always overrides this default. Off by default.")
         .option("--no-exclude-contacted", "Turn the sequence-level exclude-contacted default back OFF (enrollments then exclude cross-campaign only when a call opts in).")
@@ -15802,7 +15819,7 @@ Examples:
     }))
         .addCommand(new Command("update")
         .description("Update a sequence. Journey structure/channels/email binding are draft-only so revised scope receives a fresh launch approval; a started sequence may only re-time waits it already has (clear a delay by zeroing it, never by deleting the step — enrollments track position by index); sender pools can change while draft or paused; launch caps change through `sequences start` after first start. Name, throttles, the sending schedule, tags, the unsubscribe option (off by default), and open/click tracking toggles remain editable as allowed by the server. Pass only the fields you want to change.")
-        .addHelpText("after", "\nSenders: email_send.sender_mailbox_id sends one email from an exact inbox of a selected sender; a LinkedIn step's sender_profile_id sends it from a selected person (invite, message, inmail and withdraw_invite share one or none). Omit both to use the lead's assigned person. An email whose From changes needs its own subject_template.\n")
+        .addHelpText("after", "\nSenders: email_send.sender_profile_id sends one email from any inbox of a selected person (a lead already assigned to that person keeps its own inbox), and email_send.sender_mailbox_id from one exact inbox of a selected sender; a LinkedIn step's sender_profile_id sends it from a selected person (invite, message, inmail and withdraw_invite share one or none). Omit both to use the lead's assigned person. An email whose From changes needs its own subject_template. `sequences start <sequence>` without --approved shows who sends each step; nothing changes.\n")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--name <name>", "New human-readable sequence name.")
         .option("--steps-file <path>", "Draft only: path to a JSON file: { \"steps\": [...] } replacing the journey. Copy supports {{column}} interpolation; every step also takes {{sender_first_name}} / {{sender_last_name}} / {{sender_full_name}} for the person who sends it, and email adds {{sender_email}} (a same-named row column wins). A `branch` can also route on the lead's data with a data leaf { has_column: \"email\" } (true when that row_values column is non-empty; present:false for \"missing\").")
@@ -15838,7 +15855,7 @@ Examples:
         .option("--email-min-gap-minutes <n>", "Minimum same-mailbox gap, default 12 minutes (integer 0-720; 0 disables the extra gap). Sends are spread across the window and may be farther apart. Daily caps and windows still apply.")
         .option("--opportunity-value <usd>", "Estimated USD value of one positive-reply opportunity (>= 0). Analytics-only: sequence stats multiply it by the positive-reply count to report pipeline $ (stats.opportunities). Never gates a send or spends a credit.")
         .option("--mailboxes <ids>", "Per-sequence sending-account allowlist for native email (Instantly's 'Accounts to use'): comma-separated mailbox ids. Native email sends rotate ONLY over these mailboxes instead of the whole pool. Note: a narrow allowlist plus --esp-matching strict can starve sends when no allowed same-provider mailbox exists (surfaced as blocked defer reasons in stats).")
-        .option("--sender-profiles <ids>", "Send from these sender profiles (unified LinkedIn/WhatsApp/inbox identities): comma-separated profile ids. The server resolves each into its senders + inboxes. Live start is blocked if a selected profile lacks an account for a channel the journey uses.")
+        .option("--sender-profiles <ids>", "Send from these sender profiles (unified LinkedIn/WhatsApp/inbox identities): comma-separated profile ids (`oxygen senders profiles list` lists them). The server resolves each into its senders + inboxes. Live start is blocked if a selected profile lacks an account for a channel the journey uses.")
         .option("--no-stop-on-bounce", "Keep a lead's enrollment running after a hard bounce (default: stop it). The bounce is still recorded as an email_bounced signal either way.")
         .option("--exclude-contacted", "Default every enroll into this sequence to cross-campaign exclusion — skip leads any OTHER active sequence is already contacting. A per-enroll `sequences enroll --exclude-contacted` / `--no-exclude-contacted` always overrides this default. Off by default.")
         .option("--no-exclude-contacted", "Turn the sequence-level exclude-contacted default back OFF (enrollments then exclude cross-campaign only when a call opts in).")
@@ -15919,7 +15936,7 @@ Examples:
         });
     }))
         .addCommand(new Command("get")
-        .description("Get a sequence's definition, senders, status, and credit usage. --readiness adds the launch check — whether it CAN go live, why not, and which mailboxes it would send from — without touching it.")
+        .description("Get a sequence's definition, senders, status, and credit usage. --readiness adds the launch check — whether it CAN go live, why not, and the mailbox pool it would send from — without touching it; `sequences start <sequence>` without --approved shows who sends each step (sender_journey).")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--readiness", "Add launch_readiness: blockers (e.g. a missing send cap), warnings, and the resolved sending mailboxes. Read-only — sends nothing, changes nothing, spends nothing. Skips the LinkedIn rendered-copy scan, which stays in `sequences start` without --approved.")
         .option("--json", "Print a JSON envelope.")
@@ -16014,12 +16031,12 @@ Examples:
         }, formatSequencePushExternal);
     }))
         .addCommand(new Command("start")
-        .description("Preview or start a sequence. Without --approved this is the launch check: it returns launch_readiness (blockers such as a missing send cap or the WhatsApp cold-initiate opt-in, plus warnings), scans pending LinkedIn copy, and returns exact rendered recipient samples, character counts/limits, copy blockers, per-kind scope, sender/mailbox capacity, CRM readiness, and safety caps. Live start requires --approved; --max-credits is optional. Email/WhatsApp/CRM-task journeys additionally require --max-live-sends because their external actions cost 0 Oxygen credits. Use --dry-run to simulate without any send, provider campaign, CRM task, or credits. The first live start also switches on the standing reply → CRM automation for the workspace.")
+        .description("Preview or start a sequence. Without --approved this is the launch check and changes nothing: it returns launch_readiness (blockers such as a missing send cap or the WhatsApp cold-initiate opt-in, plus warnings), who sends each step (sender_journey: each step's From, its candidate inboxes and how a lead's inbox is picked; no leads needed), scans pending LinkedIn copy, and returns exact rendered recipient samples, character counts/limits, copy blockers, per-kind scope, sender/mailbox capacity, CRM readiness, and safety caps. Live start requires --approved; --max-credits is optional. Email/WhatsApp/CRM-task journeys additionally require --max-live-sends because their external actions cost 0 Oxygen credits. --dry-run is not this preview: it starts the sequence in simulated mode (it leaves draft), with no send, provider campaign, CRM task, or credits. The first live start also switches on the standing reply → CRM automation for the workspace.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--approved", "Approve and activate live. Without this flag, returns a preview only, including copy_preview rendered samples and blockers.")
         .option("--max-credits <n>", "Optional credit ceiling for the LinkedIn track (omit for an unbounded run).")
         .option("--max-live-sends <n>", "Live external-action ceiling (positive integer). Required for email, WhatsApp, or crm_task steps.")
-        .option("--dry-run", "Activate the sequence (status draft → active, startedAt set) in dry-run mode: every step advances with simulated actions — no sends, CRM writes, provider calls, or credits. This is NOT the preview: `sequences start` with no flags is the side-effect-free launch preview, and a dry-run sequence must be paused or deleted to leave that state.")
+        .option("--dry-run", "Activate the sequence (status draft → active, startedAt set) in dry-run mode: every step advances with simulated actions — no sends, CRM writes, provider calls, or credits. This is NOT the preview: `sequences start` with no flags is the side-effect-free launch preview. A later live start (--approved) restarts those leads from the first step so they are contacted for real, except deleted source rows, a person another live campaign contacts under exclude_contacted, and older duplicates of a person.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences start", options, () => {
@@ -16083,7 +16100,7 @@ Examples:
         await handleAsyncAction("sequences delete", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}${options.approved ? "?approved=true" : ""}`, { method: "DELETE" }));
     }))
         .addCommand(new Command("enrollments")
-        .description("List per-lead enrollment state plus the latest action status, error, attempts, and retry time.")
+        .description("List per-lead enrollment state plus the latest action status, error, attempts, and retry time. missing_source_row is true for a lead whose source-table row was deleted: still enrolled and contacted (remove with `contacts-remove --missing-source-rows`); null when the campaign has no live source table to check against, or the check failed.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--status <status>", "Filter by enrollment status (active, waiting_connection, replied, completed, stopped, failed).")
         .option("--limit <n>", "Maximum enrollments to return (1-500).")
@@ -16102,7 +16119,7 @@ Examples:
         });
     }))
         .addCommand(new Command("contacts")
-        .description("List a launched campaign's table-backed contacts with full source variables, contact tags, and factual or assigned sender. A contact carries every tag it reached: contacted means an invite, message or email was sent (a profile visit is not), and a positive reply is also replied and contacted. Contacts removed from this campaign are hidden; source rows remain intact.")
+        .description("List a launched campaign's table-backed contacts with full source variables, contact tags, and factual or assigned sender. A contact carries every tag it reached: contacted means an invite, message or email was sent (a profile visit is not), and a positive reply is also replied and contacted. Contacts removed from this campaign are hidden; source rows remain intact. missing_source_row_count (first page only) counts enrolled leads whose source-table row was deleted: still contacted, never listed (remove them with `contacts-remove --missing-source-rows`).")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--contact-state <tags>", "Only contacts with any of these tags, comma-separated: not_contacted, contacted, connected, replied, positive_reply; or all.", "all")
         .option("--exclude-contact-state <tags>", "Hide contacts with any of these tags, comma-separated.")
@@ -16152,27 +16169,39 @@ Examples:
         });
     }))
         .addCommand(new Command("contacts-remove")
-        .description("Remove selected source-table rows from this campaign only. Preview by default; --approved stops pending enrollment work and queues delegated-provider cleanup while preserving source rows and historical analytics.")
+        .description("Remove leads from this campaign only: selected source-table rows (--table-row-ids), or every enrolled lead whose source-table row was deleted (--missing-source-rows; deleting a row never removes its lead). Preview by default and names those leads; --approved stops pending enrollment work and queues delegated-provider cleanup while preserving source rows and historical analytics. Permanent: a removed lead cannot be re-enrolled in this campaign. Finished leads stay as they are, except one a dry run finished while the sequence is still in dry run, which a live start would otherwise restart.")
         .argument("<sequence>", "Sequence id or slug.")
-        .requiredOption("--table-row-ids <ids>", "Comma-separated source table row UUIDs (maximum 500).")
+        .option("--table-row-ids <ids>", "Comma-separated source table row UUIDs (maximum 500).")
+        .option("--missing-source-rows", "Select enrolled leads whose source-table row was deleted (up to 500 per call, oldest first).")
         .option("--approved", "Apply the previewed campaign-only removal.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
-        await handleAsyncAction("sequences contacts-remove", options, () => {
-            const tableRowIds = options.tableRowIds
-                .split(",")
-                .map((value) => value.trim())
-                .filter(Boolean);
-            if (tableRowIds.length === 0 || tableRowIds.length > 500) {
-                throw new Error("--table-row-ids must contain between 1 and 500 row UUIDs.");
+        await handleAsyncAction("sequences contacts-remove", options, async () => {
+            const rowIdsOption = readOption(options.tableRowIds);
+            if (Boolean(rowIdsOption) === (options.missingSourceRows === true)) {
+                throw new OxygenError("invalid_request", "Pass exactly one of --table-row-ids <ids> or --missing-source-rows.", { exitCode: 2 });
             }
-            return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/contacts`, {
+            let selector = { missing_source_rows: true };
+            if (rowIdsOption) {
+                const tableRowIds = rowIdsOption
+                    .split(",")
+                    .map((value) => value.trim())
+                    .filter(Boolean);
+                if (tableRowIds.length === 0 || tableRowIds.length > 500) {
+                    throw new Error("--table-row-ids must contain between 1 and 500 row UUIDs.");
+                }
+                selector = { table_row_ids: tableRowIds };
+            }
+            const data = await requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/contacts`, {
                 method: "POST",
                 body: {
-                    table_row_ids: tableRowIds,
+                    ...selector,
                     approved: options.approved === true,
                 },
             });
+            if (!options.json)
+                writeContactsRemoveSummary(data);
+            return data;
         });
     }))
         .addCommand(new Command("pause-company")
@@ -17275,7 +17304,7 @@ Examples:
         await handleAsyncAction("managed-inboxes registrant", options, () => requestOxygen("/api/cli/managed-inboxes/registrant"));
     }))
         .addCommand(new Command("subscribe")
-        .description("Subscribe a NEW domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. OXYGEN Warm-up defaults on for Google, Microsoft, and Azure when available: preview and approved responses carry `warmup_activation` with the exact `mailboxes` and `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, Google carries `transport=inboxkit_managed_google_handoff`; Microsoft/Azure carries `transport=inboxkit_sequencer_export`. Both carry `mailbox_credentials_required=false` and `native_send_oauth_separate=true`, so managed warm-up needs no customer-supplied OAuth or mailbox password. Google retrieves the existing managed credential only during activation and never persists or returns it; Microsoft/Azure uses native export. Native sending authorization is separate and may still be required before OXYGEN can send. Verify each exact address with `mailboxes oauth-health --json`; InboxKit's unattended Google domain approval usually lands within minutes and the worker keeps retrying, so a waiting row is not a reason to ask the customer to sign in. This order authorizes automatic OXYGEN Warm-up activation after provisioning, so no second `mailboxes warmup enable` approval is needed. The preview shows the price in force: from the 2026-09 repricing date a Google inbox is 500 credits a month all-in (a flat 400 mailbox line plus the 100-credit mailbox connection, warm-up included, which `connection_monthly_credits` shows and your balance reserves once the inbox connects); Microsoft and Azure mailboxes are priced from the vendor's LIVE rate card. Domains are priced from the vendor's LIVE domain price, and any price below vendor cost is refused. A domain you bought on its own through Oxygen (`domains buy`) takes its first inboxes here too: the preview says `domain_source: owned`, nothing is registered again and `one_off_credits` is 0 (Google or Microsoft; omit --years). To add mailboxes to a domain that already has inboxes use `managed-inboxes add-inboxes`.")
+        .description("Buy managed monthly inboxes on a new domain or your existing Cloudflare domain. Use --existing-domain for Cloudflare: the read-only preview shows ownership, occupancy, DNS scope and blockers, with zero registration charge. --max-per-domain saves a stricter limit with the approved order, including existing addresses; later additions honor it. Preview does not save the limit or change workspace data. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. OXYGEN Warm-up defaults on for Google, Microsoft, and Azure when available: preview and approved responses carry `warmup_activation` with the exact `mailboxes` and `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, Google carries `transport=inboxkit_managed_google_handoff`; Microsoft/Azure carries `transport=inboxkit_sequencer_export`. Both carry `mailbox_credentials_required=false` and `native_send_oauth_separate=true`, so managed warm-up needs no customer-supplied OAuth or mailbox password. Google retrieves the existing managed credential only during activation and never persists or returns it; Microsoft/Azure uses native export. Native sending authorization is separate and may still be required before OXYGEN can send. Verify each exact address with `mailboxes oauth-health --json`; InboxKit's unattended Google domain approval usually lands within minutes and the worker keeps retrying, so a waiting row is not a reason to ask the customer to sign in. This order authorizes automatic OXYGEN Warm-up activation after provisioning, so no second `mailboxes warmup enable` approval is needed. The preview shows the price in force: from the 2026-09 repricing date a Google inbox is 500 credits a month all-in (a flat 400 mailbox line plus the 100-credit mailbox connection, warm-up included, which `connection_monthly_credits` shows and your balance reserves once the inbox connects); Microsoft and Azure mailboxes are priced from the vendor's LIVE rate card. Domains are priced from the vendor's LIVE domain price, and any price below vendor cost is refused. A domain you bought on its own through Oxygen (`domains buy`) takes its first inboxes here too: the preview says `domain_source: owned`, nothing is registered again and `one_off_credits` is 0 (Google or Microsoft; omit --years). To add mailboxes to a domain that already has inboxes use `managed-inboxes add-inboxes`.")
         .argument("[domain]", "Sending domain to register + host the mailboxes (e.g. send.acme.com), or one you already bought through Oxygen. May also be passed as --domain.")
         .option("--domain <domain>", "Sending domain (alternative to the positional argument).")
         .requiredOption("--provider <provider>", "Mailbox PLATFORM: google, microsoft, or azure. (google/microsoft cap at 5 mailboxes per domain; azure allows 100.)")
@@ -17284,7 +17313,10 @@ Examples:
         .option("--locals <list>", "Comma-separated local parts to create for --sender, e.g. `--locals talia,talia.rosen,t.rosen` on send.acme.com orders talia@, talia.rosen@, and t.rosen@ — all owned by that one person. Requires --sender, because a bare local part carries no name and the vendor's stamp is permanent.")
         .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\",\"profile_picture_url\"}], or [{\"username\",\"sender_profile_id\"}] to take the identity from a sender profile per item (mix freely). profile_picture_url is optional and must be a PUBLIC, PERMANENT https URL — the vendor fetches it server-side at provisioning, so an expiring CDN link (e.g. a media.licdn.com URL with e=<epoch>) ships the mailbox faceless. Use `oxygen managed-inboxes upload-avatar <path>` to host one, or --sender / sender_profile_id, whose photo Oxygen already mirrors.")
         .option("--file <path>", "Path to a JSON file { \"mailboxes\": [...] } (alternative to --mailboxes).")
-        .option("--years <n>", "Years to register the domain for (1-10). Defaults to 1.")
+        .addOption(new Option("--preview", "Explicit read-only quote: connects nothing, buys nothing and charges nothing. Cannot be combined with --approved.").conflicts("approved"))
+        .option("--existing-domain", "Use an existing Cloudflare domain from oxygen domains list; never register or transfer it.")
+        .option("--max-per-domain <n>", "Save a stricter mailbox limit with the approved order, including existing addresses (e.g. 2). Preview does not save it.")
+        .option("--years <n>", "Years to register a new domain for (1-10). Omit for existing domains.")
         .option("--redirect-url <url>", "Where the domain's web root redirects. Defaults to your workspace's company website; editable later with `oxygen domains forwarding set`.")
         .option("--billing <path>", "Path to a JSON file with the registrant/WHOIS contact (first_name, last_name, phone, country, city, state, address_line_one, postal_code). Required on your FIRST order; later orders reuse the registrant already on file.")
         .option("--no-warmup", "Order WITHOUT automatic OXYGEN Warm-up. Warm-up is included by default and starts after provisioning under this order approval for the exact quoted Google/Microsoft/Azure addresses; opting out means using BYO warm-up or a later standalone warmup approval.")
@@ -17321,6 +17353,8 @@ Examples:
                     mailboxes,
                     ...(vendor ? { vendor } : {}),
                     ...(years ? { years: Number(years) } : {}),
+                    ...(options.existingDomain ? { existing_domain: true } : {}),
+                    ...(options.maxPerDomain !== undefined ? { max_mailboxes_per_domain: Number(options.maxPerDomain) } : {}),
                     ...(redirectUrl ? { redirect_url: redirectUrl } : {}),
                     ...(billing ? { billing } : {}),
                     // Warm-up is on unless --no-warmup. Placement is opt-in: it is sent only
@@ -19735,14 +19769,19 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
         .action(async (options) => {
         await handleAsyncAction("skills install", options, () => installAgentSkills(options));
     }));
-    applyOxygenHelp(program, binaryName);
     registerVisualCommands(program, handleAsyncAction);
     registerFunctionsCommands(program, handleAsyncAction);
     registerUgcCommands(program, handleAsyncAction);
     registerKnowledgeRepositoryCommands(program, handleAsyncAction);
     registerConnectorsCommands(program, handleAsyncAction);
-    // Last, so every command registered above is covered — including the ones the
-    // register* helpers add after applyOxygenHelp.
+    registerSettingsCommands(program, handleAsyncAction);
+    registerCrmSupportFlags(program);
+    // After the register* helpers: help groups are assigned to the commands that
+    // exist when this runs, and a family registered later fell into commander's
+    // trailing default "Commands:" list (the 2026-09-30 blind agent read the first
+    // 80 lines of help and missed `connectors` there).
+    applyOxygenHelp(program, binaryName);
+    // Last, so every command registered above is covered.
     enableCommandSuggestions(program);
     return program;
 }
@@ -26315,7 +26354,15 @@ function formatSequenceListHealth(data) {
         lines.push("No sequences match these filters.");
     }
     else {
-        lines.push(...renderTextTable(["SEQUENCE", "PERSISTED", "OPERATIONAL", "OPEN WORK", "SENT / FAILED", "REASONS"], sequences.map((sequence) => sequenceHealthRow(sequence))));
+        lines.push(...renderTextTable(["SEQUENCE", "PERSISTED", "OPERATIONAL", "OPEN WORK", "SENT / FAILED", "REASONS"], sequences.map((sequence) => {
+            // Warnings print below the table, so the row points at them: a reader
+            // skimming the rows missed the deleted-row warning (T-220 acceptance).
+            const row = sequenceHealthRow(sequence);
+            const warningCount = sequenceRowWarnings([sequence]).length;
+            if (warningCount > 0)
+                row[row.length - 1] = `${row[row.length - 1]}; ${warningCount} warning${warningCount === 1 ? "" : "s"} below`;
+            return row;
+        })));
         const warnings = sequenceRowWarnings(sequences);
         if (warnings.length > 0)
             lines.push("", ...warnings);
@@ -26466,7 +26513,10 @@ function formatSequenceStatsHealth(data) {
     if (failureMix !== "—")
         lines.push(`Failure mix: ${failureMix}`);
     lines.push(...formatActionKindBreakdown(operational.failureAnalytics));
-    lines.push("", `Enrolled: ${numberText(stats.enrolled)}`);
+    // Every lead ever enrolled, removed and finished included, so name the split
+    // beside it: "Enrolled: 6" next to 4 in progress read as a miscount (T-220 acceptance).
+    const byStatus = formatCountRecord(recordValue(stats.byStatus));
+    lines.push("", `Enrolled (all time): ${numberText(stats.enrolled)}${byStatus === "—" ? "" : ` — ${byStatus}`}`);
     const replyLine = formatSequenceReplyRollup(stats.replies);
     if (replyLine)
         lines.push(replyLine);
@@ -29215,6 +29265,66 @@ function readCompanyIdentityOptions(options, verb) {
 function readRepeatableIds(values) {
     return [...new Set((values ?? []).flatMap((value) => readCsvOption(value)))];
 }
+// `sequences contacts-remove` for a human reader: what the call selects, the
+// people it names (a --missing-source-rows preview exists so nobody approves a
+// removal by UUID), and the next step. stderr, like the other summaries.
+function writeContactsRemoveSummary(data) {
+    const payload = asPayloadRecord(data);
+    if (!payload)
+        return;
+    const count = (value) => (typeof value === "number" ? value : 0);
+    const lines = [];
+    const leads = asPayloadRecord(payload.leads);
+    const approved = payload.approved === true;
+    if (payload.mode === "missing_source_rows") {
+        const total = count(leads?.total);
+        // Counts recorded deletions only, so zero is never read as "none deleted".
+        lines.push(`${total} enrolled lead${total === 1 ? " has" : "s have"} a recorded deletion from this campaign's source table.`);
+    }
+    lines.push(approved
+        ? `Removed ${count(payload.removed)} from the campaign.`
+        : `Preview: ${count(payload.removable)} removable, ${count(payload.contacted)} already contacted, ${count(payload.skippedTerminal)} already finished.`);
+    // What approving costs and touches, stated where the reader decides; with
+    // nothing removable there is nothing to approve, so no line invites it.
+    if (!approved && count(payload.removable) > 0 && typeof payload.credits_used === "number") {
+        lines.push(`Cost: ${payload.credits_used} credits. Approving stops only these campaign enrollments: nothing is sent, and table rows are kept.`);
+    }
+    const items = Array.isArray(leads?.items) ? leads.items : [];
+    for (const entry of items) {
+        const lead = asPayloadRecord(entry);
+        if (!lead)
+            continue;
+        const name = typeof lead.name === "string" && lead.name.trim() ? lead.name.trim() : "(unnamed lead)";
+        // After approval the server reports each lead's new state; "stopped" is this removal.
+        const state = approved
+            ? lead.status === "stopped" ? "removed" : `not removed (${String(lead.status ?? "unknown")})`
+            : String(lead.status ?? "unknown");
+        lines.push(`  ${name} — ${state}${lead.contacted === true ? ", already contacted" : ""}`);
+    }
+    // One call covers at most per_call_limit leads (the oldest); the server's
+    // next_step says to repeat for the rest, so count the unnamed ones in this call.
+    const total = count(leads?.total);
+    const covered = typeof payload.per_call_limit === "number" ? Math.min(total, payload.per_call_limit) : total;
+    const unnamed = covered - items.length;
+    if (unnamed > 0)
+        lines.push(`  …and ${unnamed} more${covered < total ? " in this call" : ""}`);
+    if (typeof payload.next_step === "string")
+        lines.push(payload.next_step);
+    if (typeof payload.web_url === "string")
+        lines.push(`Open: ${payload.web_url}`);
+    process.stderr.write(`${lines.join("\n")}\n`);
+}
+// `tables delete-row|delete-rows` for a human reader: a deleted row's lead stays
+// enrolled in its campaigns, so name them where the delete was typed.
+function writeRowDeleteWarnings(data) {
+    const payload = asPayloadRecord(data);
+    const warnings = Array.isArray(payload?.warnings) ? payload.warnings : [];
+    for (const entry of warnings) {
+        const warning = asPayloadRecord(entry);
+        if (warning && typeof warning.message === "string")
+            process.stderr.write(`Warning: ${warning.message}\n`);
+    }
+}
 // Human-mode summary of a company pause/resume/list on stderr (stdout keeps the
 // machine-readable envelope): what was held or resumed, per campaign, and where
 // to see it.

package/dist/settings-commands.d.ts

@@ -0,0 +1,11 @@
+import { Command } from "commander";
+import { type ContractFlagOverlay } from "./contract-flags.js";
+type JsonOptions = {
+    json?: boolean;
+};
+type Handle = (command: string, options: JsonOptions, action: () => Promise<unknown>) => Promise<void>;
+export declare const WORKSPACE_PAGES_FLAG_OVERLAY: ContractFlagOverlay;
+/** The POST body for the flags given; --hide, --show or --show-all is required. */
+export declare function buildWorkspacePagesBody(options: Record<string, unknown>): Record<string, unknown>;
+export declare function registerSettingsCommands(program: Command, handle: Handle): void;
+export {};

package/dist/settings-commands.js

@@ -0,0 +1,72 @@
+// `oxygen settings`: workspace settings every member reads and admins change.
+// Its family today is `settings pages`, the web app's sidebar pages a workspace
+// hides for everyone (Settings → Customise). The set command's flags come from
+// the shared contract that also generates `oxygen_settings_pages_update` and
+// validates the route, so the CLI and MCP cannot disagree about what can be set.
+import { Command } from "commander";
+import { OxygenError } from "@oxygen/shared/cli-result";
+import { WORKSPACE_PAGES_UPDATE_OPERATION } from "@oxygen/shared/contracts/workspace-pages";
+import { addContractFlags, readContractFlags } from "./contract-flags.js";
+import { requestOxygen } from "./http-client.js";
+const update = WORKSPACE_PAGES_UPDATE_OPERATION;
+export const WORKSPACE_PAGES_FLAG_OVERLAY = {
+    hide: {
+        help: "Pages to hide from the sidebar for everyone, comma-separated, each by its path (/unibox) or name (Unibox) from `settings pages list`. Hiding a section hides its sub-pages.",
+        valueName: "<pages>",
+    },
+    show: {
+        help: "Hidden pages to show again, comma-separated, by path or name.",
+        valueName: "<pages>",
+    },
+    show_all: {
+        help: "Show every page again. With --hide, only those pages stay hidden.",
+        // `--no-show-all` would change nothing, and reads like "hide all".
+        noNegate: true,
+    },
+};
+function names(value) {
+    return Array.isArray(value) && value.length > 0;
+}
+/** The POST body for the flags given; --hide, --show or --show-all is required. */
+export function buildWorkspacePagesBody(options) {
+    const body = readContractFlags(options, update.contract, WORKSPACE_PAGES_FLAG_OVERLAY);
+    if (!names(body.hide) && !names(body.show) && body.show_all !== true) {
+        throw new OxygenError("invalid_request", "Nothing to change: pass --hide <pages> to hide pages for everyone, --show <pages> to show hidden ones again, or --show-all. `settings pages list` names every page.", { exitCode: 1 });
+    }
+    return body;
+}
+export function registerSettingsCommands(program, handle) {
+    const settings = program
+        .command("settings")
+        .description("Workspace settings: what every member of this workspace sees. "
+        + "`settings pages` is Settings → Customise in the web app: hide or show pages in the sidebar navigation (the left menu) for everyone. "
+        + "`settings pages list` shows each page and whether it is hidden; an admin or owner changes it with `settings pages set --hide <pages>`, `--show <pages>` or `--show-all`. "
+        + "Nothing is deleted: a hidden page stays reachable by URL. Free.");
+    const pages = new Command("pages")
+        .description("The web app's sidebar pages this workspace hides for every member (Settings → Customise): page visibility in the navigation menu. "
+        + "`list` shows every page with its section and whether it is hidden or visible; `set` hides or shows pages (admins and owners only). "
+        + "Hiding a section hides its sub-pages. Presentation only: nothing is deleted, and a hidden page stays reachable by URL and deep-link. Every response carries its `web_url`.");
+    pages.addCommand(new Command("list")
+        .description("Page visibility in the web app's sidebar navigation menu (Settings → Customise): every page (path, name, section, parent), whether it is shown or hidden for everyone in this workspace, and whether you may customize it (can_change: admins and owners). Read-only, 0 credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handle("settings pages list", options, () => requestOxygen(update.route));
+    }));
+    pages.addCommand(addContractFlags(new Command(update.cli.path.at(-1) ?? "set").description(update.cli.summary), update.contract, WORKSPACE_PAGES_FLAG_OVERLAY)
+        .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", `
+Examples:
+  oxygen settings pages list
+  oxygen settings pages set --hide Unibox,Publishing
+  oxygen settings pages set --show /unibox
+  oxygen settings pages set --show-all
+  oxygen settings pages set --show-all --hide Workflows
+`)
+        .action(async (options) => {
+        await handle("settings pages set", options, () => requestOxygen(update.route, {
+            method: update.method,
+            body: buildWorkspacePagesBody(options),
+        }));
+    }));
+    settings.addCommand(pages);
+}