@oxygen-agent/cli 1.1011.600 → 1.1011.607

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.1011.600
+Version: 1.1011.607

package/dist/command-manifest.js

@@ -147,6 +147,10 @@ const ZERO_CREDIT_APPROVAL_COMMANDS = new Set([
     // Both previews without --approved; approval cancels or archives, never charges.
     "domains delete",
     "mailboxes delete",
+    // Consent setup creates links without an execution debit; sync controls and
+    // progress are covered by the existing monthly mailbox commitment.
+    "mailboxes connect-oauth",
+    "mailboxes sync",
     // Previews without --approved; with it, removes a program no creator ever
     // joined. No provider call, no credits.
     "ugc programs delete",
@@ -201,6 +205,9 @@ const PREVIEW_BY_DEFAULT_COMMANDS = new Set([
     "mailboxes emailguard auto-enroll",
     "domains delete",
     "mailboxes delete",
+    "mailboxes connect-oauth",
+    // No action reads progress; an action previews until --approved.
+    "mailboxes sync",
     "sequences recover-capacity",
     "support admin done",
     "support admin reply",

package/dist/index.js

@@ -18112,7 +18112,7 @@ Examples:
         });
     }))
         .addCommand(new Command("sync")
-        .description("Read or control full Inbox, Sent and archive import for Gmail or Microsoft 365. History sync and CRM analysis are included in the mailbox’s 100-credit monthly connection. Spam, trash and drafts are excluded. Disconnect keeps imported history and stops sync and sends.")
+        .description("Read or control full Inbox, Sent and archive import for Gmail or Microsoft 365. History sync and CRM analysis are included in the mailbox’s 100-credit monthly connection. Spam, trash and drafts are excluded. Without --action, this is a free progress read; controls preview until --approved. Disconnect keeps imported mail and CRM records and stops sync and sends.")
         .argument("<mailbox>", "Mailbox ID or exact email address.")
         .option("--action <action>", "start, pause, resume or disconnect; omit to read progress.")
         .option("--approved", "Apply the reviewed control; default is preview.")
@@ -18124,7 +18124,7 @@ Examples:
             : requestOxygen(`/api/cli/mailboxes/sync?${new URLSearchParams({ mailbox }).toString()}`));
     }))
         .addCommand(new Command("connect-oauth")
-        .description("Connect Gmail/Microsoft 365 with --vendor composio to import all mail into Unibox and business activity into CRM. Each connected own mailbox costs 100 credits/month including history, sync and analysis; connection costs 0. Managed OAuth requires provider rollout readiness and exact registered addresses, max 10. Use mailboxes sync for progress and pause/resume/disconnect. Existing native OAuth remains available with --vendor oxygen. Authorization costs 0 credits; once connected, each own mailbox reserves 100 credits per month when the repricing credit commitments are active, including warm-up. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). For Microsoft's built-in roles, tenant mode requires a Global Administrator or Privileged Role Administrator because it requests the Microsoft Graph application Mail.Send and Mail.Read permissions; Application Administrator and Cloud Application Administrator cannot consent to Microsoft Graph application roles. Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. For non-managed Microsoft mailboxes, native-send approval does not authorize OXYGEN Warm-up: every mailbox still needs its own `mailboxes warmup microsoft` Outlook consent before standalone enrollment. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options.")
+        .description("Connect Gmail/Microsoft 365 with --vendor composio to import all mail into Unibox and business activity into CRM. Each connected own mailbox costs 100 credits/month including history, sync and analysis; connection costs 0. Managed OAuth requires provider rollout readiness and exact registered addresses, max 10. Use mailboxes sync for progress and pause/resume/disconnect. Existing native OAuth remains available with --vendor oxygen. Warm-up retains its existing eligibility and pricing. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). For Microsoft's built-in roles, tenant mode requires a Global Administrator or Privileged Role Administrator because it requests the Microsoft Graph application Mail.Send and Mail.Read permissions; Application Administrator and Cloud Application Administrator cannot consent to Microsoft Graph application roles. Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. For non-managed Microsoft mailboxes, native-send approval does not authorize OXYGEN Warm-up: every mailbox still needs its own `mailboxes warmup microsoft` Outlook consent before standalone enrollment. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options.")
         .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--provider <provider>", "Mailbox provider to provision: google or microsoft.")
         .option("--vendor <vendor>", "Authorization path: composio for customer-owned Gmail/Microsoft 365 with managed consent, history and CRM; oxygen for native/tenant consent; zapmail (default) or inboxkit for provisioned inboxes.")

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -478,7 +478,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         primitive: null,
         owns: "Sending domains, managed/BYOK mailboxes, customer Gmail/Microsoft 365 connections, mail history controls, warmup, deliverability, egress IPs, and infrastructure health.",
         notFor: "Writing campaign copy or sending outside a Sequence/Message owner.",
-        execution: "Inspect or provision hosted sending infrastructure with explicit recurring-cost and external-write approval. Connect existing Gmail or Microsoft 365/Exchange Online mailboxes using mailboxes connect-oauth --vendor composio where enabled; 100 credits/month includes mail history and CRM analysis. Read or control progress with mailboxes sync.",
+        execution: "Inspect or provision hosted sending infrastructure with explicit recurring-cost and external-write approval. Connect existing Gmail or Microsoft 365/Exchange Online mailboxes using mailboxes connect-oauth --vendor composio where enabled; 100 credits/month per mailbox includes mail history and CRM analysis. Read progress with oxygen_mailboxes_sync_status (CLI: mailboxes sync without --action); control it with oxygen_mailboxes_sync. Read oxygen-email-infra for history coverage and CRM rules.",
         posture: "mixed",
         gatewayTools: ["oxygen_mailboxes_list", "oxygen_mailboxes_connect_oauth", "oxygen_mailboxes_sync_status", "oxygen_mailboxes_sync", "oxygen_domains_list", "oxygen_mailboxes_health"],
         gatewayCommands: ["mailboxes list", "mailboxes connect-oauth", "mailboxes sync", "domains list", "mailboxes health"],
@@ -2011,12 +2011,15 @@ function recommendationsFor(card, query) {
                 "oxygen_mailboxes_compatibility",
                 "oxygen_mailboxes_import",
                 "oxygen_mailboxes_connect_oauth",
+                "oxygen_mailboxes_sync_status",
+                "oxygen_mailboxes_sync",
                 "oxygen_mailboxes_oauth_health",
             ],
             commands: [
                 "mailboxes compatibility",
                 "mailboxes import",
                 "mailboxes connect-oauth",
+                "mailboxes sync",
                 "mailboxes oauth-health",
             ],
         };

package/node_modules/@oxygen/shared/dist/pricing-sheet.d.ts

@@ -294,16 +294,5 @@ export declare const ENRICHMENT_CREDITS: {
     readonly page_scrape: 1.6;
     readonly linkedin_profile_scrape: 1;
 };
-/**
- * What the default work-email column spends per email it finds, measured, not
- * the single-finder list price above. 23,400 production `find_email` rows across
- * 10 tenants (2026-08-11 to 2026-09-11) spent 2.6 credits per found email in
- * today's units: the cheap first lane (Blitz at 1.5 credits, plus 0.225 to
- * verify) finds most of them, and a lane that misses bills nothing. Rounded up
- * to 3, so a plan's "about N work emails" stays below what was measured.
- * Source and method: `.agents/skills/oxygen-enrichment-waterfall` § find_email
- * in production.
- */
-export declare const WORK_EMAIL_CREDITS_PER_FOUND_MEASURED = 3;
 /** Editable calculator default: blended credits per fully-enriched row. */
 export declare const ENRICHMENT_CREDITS_PER_ROW_TYPICAL = 10;

package/node_modules/@oxygen/shared/dist/pricing-sheet.js

@@ -274,16 +274,5 @@ export const ENRICHMENT_CREDITS = {
     page_scrape: 1.6, // Firecrawl, 5x of $0.0032 (repricing 2026-09, S44)
     linkedin_profile_scrape: 1, // Managed profile credit at $0.002 COGS, exactly 5x
 };
-/**
- * What the default work-email column spends per email it finds, measured, not
- * the single-finder list price above. 23,400 production `find_email` rows across
- * 10 tenants (2026-08-11 to 2026-09-11) spent 2.6 credits per found email in
- * today's units: the cheap first lane (Blitz at 1.5 credits, plus 0.225 to
- * verify) finds most of them, and a lane that misses bills nothing. Rounded up
- * to 3, so a plan's "about N work emails" stays below what was measured.
- * Source and method: `.agents/skills/oxygen-enrichment-waterfall` § find_email
- * in production.
- */
-export const WORK_EMAIL_CREDITS_PER_FOUND_MEASURED = 3;
 /** Editable calculator default: blended credits per fully-enriched row. */
 export const ENRICHMENT_CREDITS_PER_ROW_TYPICAL = SNAPSHOT_ENRICHMENT_CREDITS_PER_ROW_TYPICAL;

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1011.600";
+export declare const OXYGEN_BUILD_VERSION = "1.1011.607";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1011.600";
+export const OXYGEN_BUILD_VERSION = "1.1011.607";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1011.600",
+  "version": "1.1011.607",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",