@oxygen-agent/cli 1.1011.804 → 1.1011.855

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.1011.804
+Version: 1.1011.855

package/dist/auto-update.d.ts

@@ -64,6 +64,7 @@ export declare function autoUpdateStatePath(env?: NodeJS.ProcessEnv): string;
 export declare function readAutoUpdateState(env?: NodeJS.ProcessEnv): AutoUpdateState;
 /** Best-effort: an unwritable config directory must never fail a command. */
 export declare function writeAutoUpdateState(state: AutoUpdateState, env?: NodeJS.ProcessEnv): boolean;
+export declare function isTruthyEnv(value: string | undefined): boolean;
 export declare function autoUpdateEligibility(runtime?: AutoUpdateRuntime & {
     endpoint?: CliEndpoint;
     state?: AutoUpdateState;

package/dist/auto-update.js

@@ -91,7 +91,7 @@ export function writeAutoUpdateState(state, env = process.env) {
         return false;
     }
 }
-function isTruthyEnv(value) {
+export function isTruthyEnv(value) {
     const normalized = value?.trim().toLowerCase();
     return Boolean(normalized && normalized !== "0" && normalized !== "false");
 }

package/dist/command-manifest.js

@@ -101,6 +101,8 @@ const MUTATING_VERBS = new Set([
 // status persists state and can pause the provider; reconnect replaces its
 // connection and can restart provider history. Other status commands are reads.
 const MUTATING_COMMANDS = new Set([
+    // A default preview is free; approval restores provider seats and billing.
+    "managed-inboxes recover",
     "mailboxes warmup status",
     "mailboxes warmup reconnect",
     // A noun leaf with its own action (not a group), so the default would
@@ -112,9 +114,15 @@ const MUTATING_COMMANDS = new Set([
     "viewers enrichment",
     // A noun leaf that switches a bought domain's yearly paid renewal on or off.
     "domains renewal",
-    // The standup reads AND moves the user's Home "last seen" marker, so the next
-    // standup, on the web too, starts from this call. An agent assessing a
-    // workspace must not mistake it for a pure read (2026-10-04 blind acceptance).
+    // The plain standup view in an interactive terminal moves the user's Home
+    // "last seen" marker, as a web Home visit does; `--json`, or output that is not
+    // a terminal (an agent's shell, a pipe), is a pure read that leaves it alone
+    // (founder decision, 2026-10-05; home-standup.ts). `mutates` is one bit per
+    // command and cannot say "only in a terminal without --json", so it keeps the
+    // capability answer every other mixed command gives — some invocation writes —
+    // while the `--json` flag's own description names the read. Reporting false
+    // would advertise the person's terminal view, the one that moves the marker,
+    // as a read.
     "home",
 ]);
 // `--approved` usually identifies a paid or externally mutating execution
@@ -182,6 +190,7 @@ const READ_ONLY_COMMANDS = new Set([
 // invocation still previews, so machine-readable discovery must not imply that
 // calling the command without its confirmation flag writes anything.
 const PREVIEW_BY_DEFAULT_COMMANDS = new Set([
+    "managed-inboxes recover",
     // /api/cli/find/run treats an omitted mode as dry_run for every Find capability.
     "find email",
     "find personal-email",

package/dist/contract-flags.js

@@ -17,6 +17,7 @@ import { Option } from "commander";
 import { OxygenError } from "@oxygen/shared/cli-result";
 import { unwrapNullable } from "@oxygen/shared/contracts/schema";
 const MAX_SPLAT_FIELDS = 6;
+const BOOLEAN_HELP_COMMANDS = new WeakSet();
 function kebab(name) {
     return name.replace(/_/g, "-");
 }
@@ -74,7 +75,12 @@ function propertyAt(contract, path) {
 }
 /** Registers the contract's flags on `command`, in contract order. */
 export function addContractFlags(command, contract, overlay = {}) {
-    for (const spec of contractFlagSpecs(contract.properties, overlay)) {
+    const specs = contractFlagSpecs(contract.properties, overlay);
+    if (specs.some((spec) => spec.kind === "boolean" || spec.kind === "pair") && !BOOLEAN_HELP_COMMANDS.has(command)) {
+        command.addHelpText("after", "\nBoolean flags: positive sends true; negative sends false; omitted fields are not sent.");
+        BOOLEAN_HELP_COMMANDS.add(command);
+    }
+    for (const spec of specs) {
         const property = "path" in spec ? propertyAt(contract, spec.path) : undefined;
         if (spec.kind === "pair") {
             command.addOption(new Option(`--${spec.on}`, spec.entry.pair?.onHelp));
@@ -86,7 +92,7 @@ export function addContractFlags(command, contract, overlay = {}) {
             continue;
         }
         if (spec.kind === "boolean") {
-            command.addOption(new Option(`--${spec.flag}`, helpFor(spec, property)));
+            command.addOption(new Option(`--${spec.flag}`, helpFor(spec, property) || `Set ${spec.path.join(".")}: true.`));
             if (!spec.entry.noNegate) {
                 command.addOption(new Option(`--no-${spec.flag}`, spec.entry.negateHelp ?? `Sends ${spec.path.join(".")}: false.`));
             }
@@ -100,7 +106,7 @@ export function addContractFlags(command, contract, overlay = {}) {
     return command;
 }
 function invalid(flag, value, message, code = "invalid_number") {
-    return new OxygenError(code, message, { details: { flag: `--${flag}`, value }, exitCode: 2 });
+    return new OxygenError(code, message, { details: { flag: `--${flag}`, value, next_step: `Correct --${flag}. ${message}` }, exitCode: 2 });
 }
 function parseScalar(property, raw, flag) {
     if (!("type" in property))
@@ -211,7 +217,9 @@ export function readContractFlags(options, contract, overlay = {}) {
         }
         else if (options[attribute(spec.flag)] === true) {
             if (given.has(spec.target)) {
-                throw new OxygenError("invalid_request", `Pass either --${spec.target} or --${spec.flag}, not both.`, { exitCode: 2 });
+                throw new OxygenError("invalid_request", `Pass either --${spec.target} or --${spec.flag}, not both.`, {
+                    details: { next_step: `Remove --${spec.flag} to keep the value, or remove --${spec.target} to clear it.` }, exitCode: 2,
+                });
             }
             setPath(body, spec.path, null);
         }

package/dist/credentials.d.ts

@@ -79,4 +79,5 @@ export declare function updateActiveOrganizationForProfile(profile: string, orga
 export declare function normalizeApiUrl(value: string): string;
 /** The CLI's per-user config directory; `OXYGEN_CONFIG_DIR` overrides it. */
 export declare function resolveConfigDir(env?: NodeJS.ProcessEnv): string;
+export declare function readEnvToken(env?: NodeJS.ProcessEnv): string | null;
 export {};

package/dist/credentials.js

@@ -769,7 +769,8 @@ function readProfiles(document) {
     }
     return profiles;
 }
-function readEnvToken(env) {
+// When this is set, every request runs on it and no stored profile is read.
+export function readEnvToken(env = process.env) {
     const token = env.OXYGEN_API_KEY ?? env.OXYGEN_TOKEN;
     return token?.trim() || null;
 }

package/dist/customer-operation-commands.js

@@ -5,16 +5,57 @@ import { CLI_OPERATIONS, operationFormData, operationInputContract, operationReq
 import { unwrapNullable, validateContract } from "@oxygen/shared/contracts/schema";
 import { addContractFlags, readContractFlags } from "./contract-flags.js";
 import { requestOxygen } from "./http-client.js";
+// Only newly registered groups use these purposes; manual owners retain their
+// descriptions, aliases and children.
+const GROUP_PURPOSES = {
+    "copilot policy": "Set an attended Copilot session's approval and screen-follow policies.",
+    "context canonical": "Read the workspace's pinned canonical context asset.",
+    "directory logo": "Upload the public agency listing's logo.",
+    "managed-inboxes avatars": "Prepare and confirm managed mailbox profile pictures.",
+    "settings beta-features": "Read or change the workspace's beta navigation opt-in.",
+    spintax: "Generate message variations with the declared credit cost.",
+    "table-actions": "Resolve an uncertain Table action from a verified outcome.",
+    "whatsapp drafts": "Read and edit saved WhatsApp drafts before sending.",
+    sessions: "Read or revoke your personal CLI and OAuth sessions.",
+    "linkedin followers": "Inspect durable follower capture progress into a Table.",
+    "linkedin inbox": "Inspect LinkedIn inbox backfill progress.",
+    "linkedin viewers": "Read named LinkedIn profile viewers within provider privacy limits.",
+    pricing: "Read customer credit prices and their provenance.",
+    "sequences leads": "Read enrolled Sequence leads, steps and action outcomes.",
+    unibox: "Read inbox accounts, filters and tags for message triage.",
+    "tables rows": "Read and edit scoped Table rows and CRM relationships.",
+    "tables runs": "Preview, run and recover Table actions within approved scope.",
+    "tables ingestion": "Stop or retry hosted Table ingestion.",
+    "billing ownership": "Read or change a workspace's shared billing owner.",
+    "notetaker calendar": "Connect calendars, sync meetings and approve meeting recording.",
+    "notetaker notes": "Edit saved meeting notes.",
+    onboarding: "Save workspace discovery choices and continue onboarding.",
+};
+const OPERATION_FLAGS = {
+    "tables favorite": { favorite: { negateHelp: "Unstar the selected Table or folder (favorite: false)." } },
+    "tables favorites": { details: { negateHelp: "Return stored star keys without names or links (details: false)." } },
+};
+function usageRecovery(error, path) {
+    if (!(error instanceof OxygenError) || error.exitCode !== 2)
+        return error;
+    const details = error.details && typeof error.details === "object" && !Array.isArray(error.details)
+        ? error.details : {};
+    const help = `Run \`oxygen ${path.join(" ")} --help\` for its options.`;
+    return new OxygenError(error.code, error.message, {
+        exitCode: error.exitCode,
+        details: { ...details, next_step: typeof details.next_step === "string" ? `${details.next_step} ${help}` : help },
+    });
+}
 /** Register each domain's selected operation as a native command with exact typed flags. */
 export function registerCustomerOperationCommands(program, handle) {
     for (const spec of CLI_OPERATIONS) {
         let parent = program;
         const words = [...spec.cli.path];
         const leaf = words.pop();
-        for (const word of words) {
+        for (const [index, word] of words.entries()) {
             let child = parent.commands.find((command) => command.name() === word);
             if (!child)
-                child = parent.command(word).description(`${word} workspace operations.`);
+                child = parent.command(word).description(GROUP_PURPOSES[words.slice(0, index + 1).join(" ")] ?? spec.cli.summary);
             parent = child;
         }
         // Never hide an existing owner behind a second Commander command.
@@ -22,7 +63,8 @@ export function registerCustomerOperationCommands(program, handle) {
             throw new Error(`Duplicate native operation command ${spec.cli.path.join(" ")}`);
         }
         const contract = operationInputContract(spec);
-        const command = addContractFlags(parent.command(leaf).description(spec.cli.summary), contract)
+        const overlay = OPERATION_FLAGS[spec.cli.path.join(" ")] ?? {};
+        const command = addContractFlags(parent.command(leaf).description(spec.cli.summary), contract, overlay)
             .option("--json", "Print a JSON envelope.");
         if (spec.binary)
             command.requiredOption("--output <path>", "Write the exact downloaded bytes to this local file.");
@@ -48,18 +90,24 @@ export function registerCustomerOperationCommands(program, handle) {
             }
         }
         command.action((options, selected) => handle(spec.cli.path.join(" "), { ...options, json: selected.optsWithGlobals().json === true }, async () => {
-            const input = readContractFlags(options, contract);
-            if (spec.multipart && options.file !== undefined) {
-                if (input[spec.multipart.contentField] !== undefined)
-                    throw new OxygenError("invalid_request", "Choose --file or the base64 content flag, not both.", { exitCode: 2 });
-                const filePath = String(options.file);
-                input[spec.multipart.contentField] = (await readFile(filePath)).toString("base64");
-                input[spec.multipart.nameField] ??= basename(filePath);
-                input[spec.multipart.typeField] ??= uploadContentType(filePath);
+            let input;
+            try {
+                input = readContractFlags(options, contract, overlay);
+                if (spec.multipart && options.file !== undefined) {
+                    if (input[spec.multipart.contentField] !== undefined)
+                        throw new OxygenError("invalid_request", "Choose --file or the base64 content flag, not both.", { exitCode: 2 });
+                    const filePath = String(options.file);
+                    input[spec.multipart.contentField] = (await readFile(filePath)).toString("base64");
+                    input[spec.multipart.nameField] ??= basename(filePath);
+                    input[spec.multipart.typeField] ??= uploadContentType(filePath);
+                }
+                const validation = validateContract(contract, input, { unknown: "reject", overMax: "reject" });
+                if (!validation.ok)
+                    throw new OxygenError("invalid_request", validation.issues.map((issue) => issue.message).join(" "), { exitCode: 2 });
+            }
+            catch (error) {
+                throw usageRecovery(error, spec.cli.path);
             }
-            const validation = validateContract(contract, input, { unknown: "reject", overMax: "reject" });
-            if (!validation.ok)
-                throw new OxygenError("invalid_request", validation.issues.map((issue) => issue.message).join(" "), { exitCode: 2 });
             const request = operationRequest(spec, input);
             if (spec.binary) {
                 if (spec.binary.stream)
@@ -83,7 +131,7 @@ export function registerCustomerOperationCommands(program, handle) {
                     formData = operationFormData(spec, request.body ?? {});
                 }
                 catch (error) {
-                    throw new OxygenError("invalid_request", error instanceof Error ? error.message : "Invalid upload.", { exitCode: 2 });
+                    throw usageRecovery(new OxygenError("invalid_request", error instanceof Error ? error.message : "Invalid upload.", { exitCode: 2 }), spec.cli.path);
                 }
                 return requestOxygen(request.path, { method: request.method, formData });
             }

package/dist/help.js

@@ -137,7 +137,7 @@ export function applyOxygenHelp(program, binaryName) {
     const exitCodeLine = Object.entries(CLI_EXIT_CODE_TABLE)
         .map(([code, meaning]) => `${code} ${meaning.split(" (")[0]}`)
         .join(" · ");
-    program.addHelpText("afterAll", [
+    program.addHelpText("before", [
         "",
         "Agent quickstart:",
         `  1. ${binaryName} login                      connect this terminal (or set OXYGEN_API_KEY)`,
@@ -166,9 +166,8 @@ export function applyOxygenHelp(program, binaryName) {
         "  Credit-spending commands require --approved --max-credits <n>; zero-credit",
         "  external writes require --approved plus the command's preview-bound plan token.",
         "  State-changing responses include a web_url deep-link to inspect the result.",
-        "",
-        `Exit codes: ${exitCodeLine}`,
     ].join("\n"));
+    program.addHelpText("afterAll", `\nExit codes: ${exitCodeLine}`);
 }
 /**
  * Turn commander's own edit-distance suggester on for EVERY command.

package/dist/home-standup.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Whether an `oxygen home` read is the person looking, and so marks Home as seen.
+ *
+ * Founder decision, 2026-10-05: "`oxygen home --json` and MCP reads leave the marker
+ * alone; your web visit and the plain terminal view still reset it." A terminal view
+ * is a person reading a terminal. `--json` is a machine read, and so is the plain view
+ * when stdout is not a terminal: in all four 2026-10-04 blind consultant CLI runs the
+ * agent ran `oxygen home 2>&1 | head -150`, a pipe its shell captured, and that read
+ * moved the founder's "since you last looked" window. Node reports a pipe or a file as
+ * `isTTY: undefined`, so only a literal `true` counts as a terminal.
+ */
+export declare function homeStandupMarksSeen(input: {
+    json?: boolean | undefined;
+    isTTY?: boolean | undefined;
+}): boolean;

package/dist/home-standup.js

@@ -0,0 +1,14 @@
+/**
+ * Whether an `oxygen home` read is the person looking, and so marks Home as seen.
+ *
+ * Founder decision, 2026-10-05: "`oxygen home --json` and MCP reads leave the marker
+ * alone; your web visit and the plain terminal view still reset it." A terminal view
+ * is a person reading a terminal. `--json` is a machine read, and so is the plain view
+ * when stdout is not a terminal: in all four 2026-10-04 blind consultant CLI runs the
+ * agent ran `oxygen home 2>&1 | head -150`, a pipe its shell captured, and that read
+ * moved the founder's "since you last looked" window. Node reports a pipe or a file as
+ * `isTTY: undefined`, so only a literal `true` counts as a terminal.
+ */
+export function homeStandupMarksSeen(input) {
+    return input.json !== true && input.isTTY === true;
+}

package/dist/index.js

@@ -1,5 +1,5 @@
 import { renderPrimaryProviderBoard } from "./admin-primary-providers-render.js";
-import { markStdinConsumed, maybeScheduleBackgroundUpdate, readAutoUpdateStatus, runBackgroundUpdate, } from "./auto-update.js";
+import { isTruthyEnv, markStdinConsumed, maybeScheduleBackgroundUpdate, readAutoUpdateStatus, runBackgroundUpdate, } from "./auto-update.js";
 import { createBrowserLoginSession, createRelayLoginSession, openBrowser } from "./browser-login.js";
 import { assertModeFlagsExclusive, parseKeyValuePairs, parseJsonObject, readJsonObjectOption, readNonNegativeInt, readPositiveInt, readRecordString, resolveLiveDryRunMode, } from "./cli-values.js";
 import { readColumnDecisionFlags } from "./column-decision-options.js";
@@ -7,7 +7,7 @@ import { formatAiPromptPreviewNotice, formatColumnReferenceNotices, formatEnrich
 import { buildCommandManifest, getCommandManifestEntry, searchCommandManifest, suggestCommandNames, } from "./command-manifest.js";
 import { registerConnectorsCommands } from "./connectors-commands.js";
 import { addContractFlags, readContractFlags } from "./contract-flags.js";
-import { clearCredentials, defaultApiUrl, listCredentialProfiles, loadCredentials, normalizeApiUrl, pickProfileNameForIdentity, pickProfileNameForUserSession, resolveActiveProfile, saveCredentials, switchCredentialProfile, updateActiveOrganizationForProfile, } from "./credentials.js";
+import { clearCredentials, defaultApiUrl, listCredentialProfiles, loadCredentials, normalizeApiUrl, pickProfileNameForIdentity, pickProfileNameForUserSession, readEnvToken, resolveActiveProfile, saveCredentials, switchCredentialProfile, updateActiveOrganizationForProfile, } from "./credentials.js";
 import { registerCrmFileReadCommands } from "./crm-file-read-commands.js";
 import { registerCrmSupportFlags, readCrmNoteEditFields, readCrmPhotoFields, readCrmFileLabel, buildCrmObjectsPath, buildCrmConnectionsPath } from "./crm-support-flags.js";
 import { registerCustomerOperationCommands } from "./customer-operation-commands.js";
@@ -15,6 +15,7 @@ import { DATABASE_QUERY_FLAG_OVERLAY } from "./database-query-flags.js";
 import { addFeedReadFlags, feedReadWindowParams } from "./feed-read-flags.js";
 import { registerFunctionsCommands } from "./functions-commands.js";
 import { applyOxygenHelp, argvRequestsJson, commanderUsageFailure, commandNameForArgv, enableCommandSuggestions, unknownCommandHint, unknownOptionHint, withoutHelpForUnknownCommand, validateRequiredOptionValues, } from "./help.js";
+import { homeStandupMarksSeen } from "./home-standup.js";
 import { ensureFreshCliForApiUrl, requestOxygen } from "./http-client.js";
 import { formatInboxNeedsReplyNotice } from "./inbox-needs-reply-notice.js";
 import { acquireMirrorLock, clearConflictFiles, deletePageFile, emptyMirrorState, findMirrorSlugByPageId, isFileDirty, listConflictFiles, listLocalMirrors, localPageSha256, markMirrorStale, mirrorExists, pageFilePath, planMirrorPush, purgeMirror, resetMirrorForFullResync, quarantineDirtyFile, readMirrorState, releaseMirrorLock, resolveDefaultConfigDir, resolveMirrorDir, writeGeneratedIndexFile, writeGeneratedLogFile, writeMirrorState, writePageFile, } from "./knowledge-mirror.js";
@@ -3786,10 +3787,10 @@ export function createProgram() {
     });
     program
         .command("home")
-        .description("Your workspace standup: what happened since you last looked, what needs you, and a year of workspace activity. 0 credits. It marks Home as seen, so the next standup (here or on the web) counts from now. The same neutral composition the web Home renders, so a terminal-first operator is not sent to the browser for a status check.")
-        .option("--json", "Print a JSON envelope.")
+        .description("Your workspace standup: what happened since you last looked, what needs you, and a year of workspace activity. 0 credits. With --json, or when the output is not a terminal (an agent's shell or a pipe), it is a pure read: the same window, and your Home \"last seen\" marker stays where you left it. Only the plain view in a terminal counts as you looking: like opening Home on the web, it marks Home as seen (at most every four hours), so your next standup counts from then.")
+        .option("--json", "Print a JSON envelope. A pure read: leaves your Home \"last seen\" marker alone.")
         .action(async (options) => {
-        await handleAsyncAction("home standup", options, readHomeStandup);
+        await handleAsyncAction("home standup", options, () => readHomeStandup(options));
     });
     // `oxygen workspace map` sits beside `oxygen home` on purpose: home answers
     // "what needs me", the map answers "what is in here". Both are Control-surface
@@ -6367,10 +6368,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("import")
         .description("Import provider records into an Oxygen CRM object (canonical CRM truth) as a durable workflow run. Defaults to dry-run. This pulls the WHOLE object and has no list/segment filter; to import one HubSpot saved list or one Pipedrive saved filter into a new table you can filter and enrich, use `oxygen tables hubspot import` or `oxygen tables pipedrive import` instead.")
         .argument("<provider>", "Connected CRM to import from: hubspot, attio, or pipedrive.")
-        .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, attio people|companies, or pipedrive persons|organizations. Pipedrive deals have no natural identity key and are not importable yet.")
+        .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, attio people|companies, or pipedrive persons|organizations|deals. Import Pipedrive persons and organizations before deals so each deal links to them.")
         .option("--into <object>", "Oxygen CRM object slug to import into. Defaults to the natural mapping.")
         .option("--limit <n>", "Max records to pull this run.")
-        .option("--max-credits <n>", "Volume + external-quota cap (BYOK reads cost 0 Oxygen credits but use your CRM API quota).")
+        .option("--max-credits <n>", "OXYGEN spend ceiling for the run. Own-API-key calls cost 0.05 credits each; OAuth follows its tool quote, and Workflow steps are billed separately. Use --limit for rows; CRM API quota also applies.")
         .option("--approved", "Confirm a live import after inspecting a dry run.")
         .option("--dry-run", "Preview the import without pulling. Default.")
         .option("--live", "Run the live import. Requires --approved and --max-credits.")
@@ -6388,7 +6389,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--direction <direction>", "Sync direction: inbound, outbound, or bidirectional. Defaults to bidirectional.")
         .option("--cron <cron>", "Cron expression for the scheduled reconciliation cadence, e.g. '*/15 * * * *'.")
         .option("--timezone <tz>", "IANA timezone the cron schedule runs in, e.g. America/New_York. Defaults to UTC.")
-        .option("--max-rows <n>", "Per-cycle row cap. The real volume brake on provider writes (BYOK writes cost 0 Oxygen credits).")
+        .option("--max-rows <n>", "Per-cycle row cap, separate from the --max-credits OXYGEN spend ceiling. OAuth provider calls follow their tool quote; own-API-key calls and live Workflow steps have separate charges.")
         .option("--max-credits <n>", "Managed-credit + external-quota cap per cycle.")
         .option("--field-mappings-json <json>", "HubSpot custom-property mappings as a JSON array of {oxygen_field, provider_field, direction}. Pass [] to clear; canonical identity/name mappings stay fixed.")
         .option("--approved", "Confirm a live configuration after inspecting a dry run.")
@@ -10491,7 +10492,7 @@ Examples:
     }));
     program
         .command("table-runs")
-        .description("Durable background table action run commands. `list --table <table> --status all` is a table's full run history, including Function runs launched from it; without --status, list shows only active runs.")
+        .description("Durable background table action run commands. `list --table <table> --status all` is a table's full action-run history, including Function runs launched from it; without --status, list shows only active runs. Imports and other writes: `runs list --table <table>`.")
         .addCommand(new Command("create")
         .description("Create a durable background run for table tool-column actions. Large runs are accepted immediately and their rows are prepared in the background (execution_status 'planning'); follow with `table-runs wait <run_id>`.")
         .argument("<table>", "Table id or slug.")
@@ -10533,9 +10534,9 @@ Examples:
         }));
     }))
         .addCommand(new Command("list")
-        .description("List durable table action runs for one table.")
+        .description("List durable table action runs for one table. For every run of the table, imports included, use `runs list --table <table>`.")
         .requiredOption("--table <table>", "Table id or slug.")
-        .option("--status <status>", "Filter by all, active, queued, running, paused, completed, completed_with_errors, failed, canceling, or canceled. Defaults to active; pass all for the full history in one call, including Function runs launched from this table.")
+        .option("--status <status>", "Filter by all, active, queued, running, paused, completed, completed_with_errors, failed, canceling, or canceled. Defaults to active; pass all for the full action-run history in one call, including Function runs launched from this table.")
         .option("--limit <n>", "Maximum runs to return. Defaults to 20.")
         .option("--format <format>", "Format run history as json, jsonl, csv, or table (same serializer as `tables export`). Omit to keep the default envelope output.")
         .option("--output <path>", "Write the formatted run history to a file instead of embedding it in the response.")
@@ -10645,7 +10646,7 @@ Examples:
     }));
     program
         .command("table-ingestions")
-        .description("Durable background table ingestion commands.")
+        .description("Durable background table ingestion commands. To find a table's ingestion runs: `runs list --table <table>`.")
         .addCommand(new Command("create-tool-page")
         .description("Create a paged tool-source ingestion run for a workspace table.")
         .argument("<table>", "Table id or slug.")
@@ -12666,15 +12667,23 @@ Examples:
     }));
     program
         .command("runs")
-        .description("Tenant run provenance commands.")
+        .description("Workspace run ledger and provenance. `runs list --table <table>` is one table's full run history: imports, row writes and column runs.")
         .addCommand(new Command("list")
-        .description("List recent tenant runs.")
+        .description("List recent tenant runs, newest first.")
+        .option("--table <table>", "Only runs of this table (id, slug or table URL), e.g. to check whether a column run started.")
         .option("--limit <n>", "Maximum runs to return. Defaults to 50.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("runs list", options, () => {
             const limit = readPositiveInt(options.limit);
-            return requestOxygen(`/api/cli/runs${limit ? `?limit=${limit}` : ""}`);
+            const params = new URLSearchParams();
+            const table = readOption(options.table);
+            if (table)
+                params.set("table", table);
+            if (limit)
+                params.set("limit", String(limit));
+            const query = params.toString();
+            return requestOxygen(`/api/cli/runs${query ? `?${query}` : ""}`);
         });
     }))
         .addCommand(new Command("get")
@@ -12917,16 +12926,16 @@ Examples:
     }));
     program
         .command("tools")
-        .description("The priced catalog: every provider operation and every OXYGEN column (enrichment bundles, waterfalls, templates, Functions) with its credit cost per row. Start with `tools search --for-table <table>` to see what a table's own columns can be enriched with and what each costs, before adding anything.")
+        .description("Find provider operations and OXYGEN columns. For one provider operation's effective price on this workspace's credential, use `tools get <tool_id> --view pricing --json`; for a request-specific quote at 0 credits and without a provider call, use `tools run <tool_id> --input-json '{}' --mode dry-run --json`. Use `tools search --for-table <table>` to price a table's enrichment columns per row.")
         .addCommand(addToolCatalogSearchWindowFlag(new Command("search")
-        .description("Search the priced catalog (0 credits): provider operations in `tools`, and OXYGEN's own columns in `native_columns` (enrichment bundles, waterfalls, templates, Functions), each with `price_label`, `estimated_credits_per_row`, `pricing_kind` and the exact `cli_add` command. With --for-table <table> it reads that table's columns and returns `suggestions`: the enrichments those columns already support, priced per row. Hydrate one provider operation with tools get. A response listing partial_sources means an optional catalog source timed out and totals may be understated — rerun for the complete catalog.")
+        .description("Search provider operations and OXYGEN columns for 0 credits; the default list is bounded. Use `tools get <tool_id> --view pricing --json` for one workspace-effective fee, or `tools run <tool_id> --input-json '{}' --mode dry-run --json` for a 0-credit quote without a provider call. With --for-table, suggestions prices enrichments per row. If partial_sources appears, totals may be understated; rerun.")
         .argument("[query]", "Search text, e.g. `web` for the Web Research Agent column and its modes (each priced in `modes`), or `email`.")
         .option("--verbosity <verbosity>", "minimal, summary, or full. Defaults to minimal; hydrate one result with tools get.")
         .option("--terse", "Alias for --verbosity minimal.")
         .option("--all", "Return the complete matching catalog — with no query that is every provider operation (7,000+ rows). Explicit because the default is bounded to 10; with --for-table the table-scoped answer is `suggestions`, which --all does not change.")
         .option("--only-runnable", "Only return tools runnable by the active organization.")
         .option("--workflow-eligible", "Only return tools a hosted workflow step may call, each annotated with the canonical `workflow_effect` its manifest step must declare. This is a narrower set than the table-column catalog — use it when authoring a workflow manifest so lint cannot reject a tool at apply time.")
-        .option("--no-access-check", "Skip per-tool availability checks for a fast complete-catalog listing. Tools are returned without availability info; pair with --terse for discovery sweeps.")
+        .option("--no-access-check", "Skip workspace availability checks for a fast catalog listing. Prices then show managed list estimates, not this workspace's effective credential fee; use tools get <tool_id> --view pricing for that. Pair with --terse for discovery sweeps.")
         .option("--category <category>", "Filter by Oxygen tool category, such as company_search, people_search, research, or local.")
         .option("--capability <tag>", "Filter by capability tag, such as mobile_phone.")
         .option("--provider <provider>", "Filter to one exact provider id, such as blitzapi.")
@@ -13044,10 +13053,10 @@ Examples:
         });
     })))
         .addCommand(new Command("run")
-        .description("Run an executable Oxygen tool through the HTTPS API.")
+        .description("Preview or run one tool. `--mode dry-run` quotes the exact inputs at 0 credits without a provider call or data write; `--mode live` executes after any required approval and credit ceiling.")
         .argument("<tool_id>", "Tool id.")
         .requiredOption("--input-json <json>", "Tool input as a JSON object.")
-        .option("--mode <mode>", "Execution mode: live or dry-run. Mutating tools default to dry-run.")
+        .option("--mode <mode>", "Execution mode: live or dry-run. Dry-run costs 0 credits and makes no provider call or data write; mutating tools default to dry-run.")
         .option("--credential-mode <mode>", "Credential mode: managed, user_api_key, or user_oauth.")
         .option("--org <organization_id>", "Optional organization id. Must match the stored CLI token.")
         .option("--org-id <organization_id>", "Optional organization id. Must match the stored CLI token.")
@@ -14874,7 +14883,7 @@ Examples:
         .option("--channels <list>", "Narrow the merged stream: comma-separated channel groups to include (email,linkedin,whatsapp). Implies --channel all.")
         .option("--account <id>", "LinkedIn only: filter to one sender account (sender id, connection id, or Unipile account id).")
         .option("--unread", "Only show conversations with unread messages.")
-        .option("--unanswered", "Only conversations you have not replied to — the last message in the thread is inbound. Not the same as needing a reply: it keeps thank-yous and automated mail. Cross-channel. Off by default: an unfiltered list still shows answered threads. (The web Unibox turns this on by default for its Primary tab.) It includes inbound mail no campaign sent — unsolicited or spam — so for replies to your outreach add --sequence-id; the ids and per-campaign counts are in sidebar_counts.byCampaign of the same --json response.")
+        .option("--unanswered", "Only conversations you have not replied to — the last message in the thread is inbound. Not the same as needing a reply: it keeps thank-yous and automated mail. Cross-channel. Off by default in the CLI and web Unibox: an unfiltered list still shows answered threads. It includes inbound mail no campaign sent — unsolicited or spam — so for replies to your outreach add --sequence-id; the ids and per-campaign counts are in sidebar_counts.byCampaign of the same --json response.")
         // Hidden while the AI inbox triage is dev-only (ADR 0027): production
         // help must not offer a flag its API refuses. Unhide with the flag's
         // production rollout.
@@ -14884,13 +14893,14 @@ Examples:
         .option("--segment <segment>", "Top tab: primary (everything but the negative status tier), all, or an email-only folder (others, sent, warmup, dmarc).")
         .option("--status <keys>", "Comma-separated reply-status keys, set by AI reply triage. System keys: interested, neutral, out_of_office, wrong_person, not_now, not_interested, lost, bounced; your workspace's full list, custom labels included, is `inbox labels list`. Cross-channel — filters email + LinkedIn + WhatsApp by the shared taxonomy.")
         .option("--tag <tags>", "Comma-separated campaign tags — matches email conversations whose campaign (sequence) carries any of these tags. DMs have no campaign link, so a tag filter shows email only.")
-        .option("--since <iso>", "Only conversations whose last message is on/after this ISO date/timestamp. Cross-channel.")
-        .option("--until <iso>", "Only conversations whose last message is on/before this ISO date/timestamp. Cross-channel.")
+        .option("--since <iso>", "Only conversations whose last message is on/after this ISO date/timestamp. Excludes conversations without a last-message date. Cross-channel.")
+        .option("--until <iso>", "Only conversations whose last message is on/before this ISO date/timestamp. Excludes conversations without a last-message date. Cross-channel.")
         .option("--sequence-id <ids>", "Email only: comma-separated campaign (sequence) UUIDs (not slugs — `sequences list` shows each campaign's id). Returns only conversations linked to that campaign; `sidebar_counts.byCampaign` is its size.")
         .option("--provider <providers>", "Email only: comma-separated providers (google,microsoft).")
         .option("--domain <domains>", "Email only: comma-separated counterpart domains to include.")
         .option("--exclude-domain <domains>", "Email only: comma-separated counterpart domains to exclude.")
         .option("--mailbox-id <ids>", "Email only: comma-separated mailbox ids.")
+        .option("--sender-profile <ids>", "Comma-separated sender profile ids (people, from `senders profiles list`): only conversations on their own inboxes and LinkedIn/WhatsApp accounts. Merged stream only; narrow channels with --channels.")
         .option("--search <text>", "Fuzzy search (typos, word order, prefixes) over names, addresses, subjects and the text of every message in EVERY non-warmup conversation: all channels unless --channel narrows, archived and sent-only threads included. --segment, --unanswered and the Primary tab's negative-tier exclusion are ignored while set; explicit facets such as --status still narrow. For structured filters use --status or --tag, not a text search.")
         .option("--include-archived", "Include archived conversations.")
         .option("--limit <n>", "Maximum conversations to return (1-200). Defaults to 50.")
@@ -14927,6 +14937,7 @@ Examples:
                 ["domain", "domain"],
                 ["excludeDomain", "exclude_domain"],
                 ["mailboxId", "mailbox_id"],
+                ["senderProfile", "sender_profile_id"],
                 ["cursor", "cursor"],
             ]) {
                 const value = readOption(options[flag]);
@@ -15109,8 +15120,9 @@ Examples:
         .option("--exclude-domain <domains>", "Email only: comma-separated counterpart domains to exclude.")
         .option("--mailbox-id <ids>", "Email only: comma-separated mailbox ids.")
         .option("--sender-account-id <ids>", "DMs only: comma-separated OXYGEN sender UUIDs from `oxygen senders list --json` (not LinkedIn member ids).")
-        .option("--since <iso>", "Only conversations whose last message is on/after this ISO date/timestamp. Cross-channel.")
-        .option("--until <iso>", "Only conversations whose last message is on/before this ISO date/timestamp. Cross-channel.")
+        .option("--sender-profile <ids>", "Comma-separated sender profile ids (people, from `senders profiles list`): only their own inboxes and LinkedIn/WhatsApp accounts, as in `inbox list --sender-profile`.")
+        .option("--since <iso>", "Only conversations whose last message is on/after this ISO date/timestamp. Excludes conversations without a last-message date. Cross-channel.")
+        .option("--until <iso>", "Only conversations whose last message is on/before this ISO date/timestamp. Excludes conversations without a last-message date. Cross-channel.")
         .option("--search <text>", "Fuzzy search (typos, word order, prefixes) over names, addresses, subjects and the text of every message in EVERY non-warmup conversation: all channels unless --channel narrows, archived and sent-only threads included. --segment, --unanswered and the Primary tab's negative-tier exclusion are ignored while set; explicit facets such as --status still narrow.")
         .option("--include-archived", "Also mark archived conversations read.")
         .option("--unanswered", "Only sweep conversations you have not replied to (the last message is inbound) — the same filter as `inbox list --unanswered`, so the scope is exactly that list.")
@@ -15138,6 +15150,7 @@ Examples:
                 ["excludeDomain", "exclude_domain"],
                 ["mailboxId", "mailbox_id"],
                 ["senderAccountId", "sender_account_id"],
+                ["senderProfile", "sender_profile_id"],
                 ["since", "since"],
                 ["until", "until"],
                 ["search", "search"],
@@ -15328,6 +15341,57 @@ Examples:
             });
         });
     }))
+        .addCommand(new Command("views")
+        .description("Saved Unibox views: named filter states the whole team shares (a sender, channels, statuses). Each member picks their own default, which the Unibox opens on.")
+        .addCommand(new Command("list")
+        .description("List the team's saved views; is_default marks your own default.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox views list", options, () => requestOxygen("/api/cli/inbox/views"));
+    }))
+        .addCommand(new Command("create")
+        .description("Save a view for the team.")
+        .requiredOption("--name <name>", "View name, unique in the workspace (up to 80 characters).")
+        .option("--filters <url-or-query>", "A Unibox URL or its query string, e.g. 'sender_profile_id=<id>&channels=linkedin&status=interested' (the `inbox list` params). Omit for every conversation.")
+        .option("--default", "Also make it your own default view.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox views create", options, () => requestOxygen("/api/cli/inbox/views", {
+            method: "POST",
+            body: {
+                name: readOption(options.name),
+                ...(readOption(options.filters) ? { filters: readOption(options.filters) } : {}),
+                ...(options.default === true ? { default: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("update")
+        .description("Rename, re-filter or reorder a view, or set it as (or stop using it as) your own default.")
+        .argument("<view>", "View id (from `inbox views list`).")
+        .option("--name <name>", "New name.")
+        .option("--filters <url-or-query>", "Replace the view's filters: a Unibox URL or its query string.")
+        .option("--position <n>", "Zero-based order in the team's list.")
+        .option("--default", "Make it your own default view.")
+        .option("--no-default", "Stop using it as your default view (you open on the built-in view).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (view, options) => {
+        await handleAsyncAction("inbox views update", options, () => requestOxygen(`/api/cli/inbox/views/${encodeURIComponent(view)}`, {
+            method: "PATCH",
+            body: {
+                ...(readOption(options.name) ? { name: readOption(options.name) } : {}),
+                ...(readOption(options.filters) !== null ? { filters: readOption(options.filters) } : {}),
+                ...(readOption(options.position) !== null ? { position: readNonNegativeInt(options.position) } : {}),
+                ...(typeof options.default === "boolean" ? { default: options.default } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("delete")
+        .description("Delete a view for the whole team. Anyone using it as their default opens on the built-in view.")
+        .argument("<view>", "View id (from `inbox views list`).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (view, options) => {
+        await handleAsyncAction("inbox views delete", options, () => requestOxygen(`/api/cli/inbox/views/${encodeURIComponent(view)}`, { method: "DELETE" }));
+    })))
         .addCommand(new Command("labels")
         .description("Manage inbox status labels (the Instantly-style system set + custom labels).")
         .addCommand(new Command("list")
@@ -17574,7 +17638,22 @@ Examples:
         });
     })));
     program.addCommand(new Command("managed-inboxes")
-        .description("Managed sending inboxes bought through OXYGEN: subscribe a domain + N InboxKit mailboxes (google/microsoft/azure) as a recurring monthly Oxygen-credit purchase, add inboxes to a domain you already own, inspect/verify, and cancel. OXYGEN Warm-up defaults on when available: its quoted recurring credits and exact future addresses are part of the order approval, and the worker activates it after provisioning without a second warmup approval. Warm-up does not prove native-send authorization: verify each exact address with `mailboxes oauth-health --json`. Subscribe/add-inboxes preview first (re-run with --approved --quote); cancel previews first (re-run with --approved --confirm <domain>). To remove several domains with their inboxes, use `domains delete`. The inbox vendor is chosen for you; --vendor pins one.")
+        .addCommand(new Command("recover")
+        .description("Restore a cancelled managed subscription using its original addresses and domain. Find candidates with managed-inboxes list --status cancelled --json. Without --approved, performs a read-only preview at 0 credits: eligibility, upfront credits, recurring charges and a quote_id. Review the preview, then use --approved --quote <id> --max-credits <n>. Interrupted provider attempts are inspected before any repeat. After provider recovery, verify sending authorization and warmup for the exact recovered mailboxes. If warmup is disabled, preview enrollment and review its scope and costs before approving it.")
+        .argument("<domain>", "The cancelled managed sending domain")
+        .option("--approved", "Execute the reviewed recovery quote", false)
+        .option("--quote <id>", "quote_id from the recovery preview")
+        .option("--rebuy", "Include replacement licenses in the recovery preview and approval", false)
+        .option("--max-credits <n>", "Upfront recovery credit ceiling; does not cap recurring charges", Number)
+        .option("--json", "Print a JSON envelope")
+        .action(async (domain, options) => {
+        await handleAsyncAction("managed-inboxes recover", options, () => requestOxygen("/api/cli/managed-inboxes/recover", {
+            method: "POST", body: { domain, approved: options.approved === true, rebuy: options.rebuy === true,
+                ...(options.quote ? { quote_id: options.quote } : {}),
+                ...(options.maxCredits !== undefined ? { max_credits: options.maxCredits } : {}) },
+        }));
+    }))
+        .description("Managed sending inboxes bought through OXYGEN: subscribe a domain + N InboxKit mailboxes (google/microsoft/azure) as a recurring monthly Oxygen-credit purchase, add inboxes to a domain you already own, inspect/verify, cancel, and recover cancelled original addresses. OXYGEN Warm-up defaults on when available: its quoted recurring credits and exact future addresses are part of the order approval, and the worker activates it after provisioning without a second warmup approval. Warm-up does not prove native-send authorization: verify each exact address with `mailboxes oauth-health --json`. Subscribe/add-inboxes preview first (re-run with --approved --quote); cancel previews first (re-run with --approved --confirm <domain>). To remove several domains with their inboxes, use `domains delete`. The inbox vendor is chosen for you; --vendor pins one.")
         .addCommand(new Command("verify")
         .description("Check that OXYGEN, STRIPE, and the VENDOR agree about what this org is buying. The truth about a managed inbox lives in three systems — what the customer asked for, what they are charged, and what is actually running — and a 200 from any one of them proves nothing. Reports every disagreement with WHO IS LOSING MONEY while it stands (customer_overbilled first, then oxygen_pays). Read-only, no writes, 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
@@ -17738,7 +17817,7 @@ Examples:
         });
     }))
         .addCommand(new Command("cancel")
-        .description("Cancel a managed inbox order by domain: the inboxes AND every recurring add-on on them (warm-up, inbox placement). WITHOUT --approved prints the itemized teardown — every line that stops billing, when the inboxes go dark, and which live sequences send from them. To cancel, re-run with --approved AND --confirm <domain> echoing the domain exactly. Irreversible; the domain itself stays registered until its term ends. Cancelling is free.")
+        .description("Cancel a managed inbox order by domain: the inboxes AND every recurring add-on on them (warm-up, inbox placement). WITHOUT --approved prints the itemized teardown — every line that stops billing, when the inboxes go dark, and which live sequences send from them. To cancel, re-run with --approved AND --confirm <domain> echoing the domain exactly. Once cancelled, original-address recovery depends on provider eligibility; preview with managed-inboxes recover. The domain stays registered until its term ends. Cancelling is free.")
         .argument("[domain]", "The managed inbox domain to cancel. May also be passed as --domain.")
         .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
         .option("--approved", "Actually cancel (otherwise the teardown preview is returned).")
@@ -25131,7 +25210,12 @@ async function handleWhoamiAction(options) {
             const cachedOrg = existingCredentials?.activeOrganization ?? cached?.organization ?? null;
             const orgChanged = !cachedOrg || cachedOrg.id !== identity.organization.id;
             const userChanged = !cached || cached.user.id !== identity.user.id;
-            if (existingCredentials && (orgChanged || userChanged)) {
+            // Heal only from a request that ran as this profile. An environment token
+            // replaces its token, and OXYGEN_ORG or --org picks a workspace for this
+            // command only; saving what either resolved repointed the profile, and with
+            // it every later unpinned command in every shell that shares it (2026-10-05).
+            const pinnedElsewhere = Boolean(process.env.OXYGEN_ORG?.trim()) && orgChanged;
+            if (existingCredentials && !readEnvToken() && !pinnedElsewhere && (orgChanged || userChanged)) {
                 const refreshed = {
                     token: existingCredentials.token,
                     apiUrl: existingCredentials.apiUrl,
@@ -25610,9 +25694,16 @@ async function handleUpdateAction(options) {
         emitCliFailure("update", error);
     }
 }
-/** `oxygen home`: the same outcome-neutral standup rendered by web Home. */
-async function readHomeStandup() {
-    return requestOxygen("/api/cli/home/standup");
+/**
+ * `oxygen home`: the outcome-neutral workspace standup. Only the plain view printed to
+ * an interactive terminal is the person looking and marks Home as seen; `--json`, or
+ * output an agent's shell or a pipe captures, sends `mark_seen=false` and leaves the
+ * person's Home marker alone (founder decision, 2026-10-05; see home-standup.ts).
+ */
+async function readHomeStandup(options) {
+    return requestOxygen(homeStandupMarksSeen({ json: options.json, isTTY: process.stdout.isTTY })
+        ? "/api/cli/home/standup"
+        : "/api/cli/home/standup?mark_seen=false");
 }
 function buildApiKeyCreateBody(options) {
     const body = {};
@@ -25894,7 +25985,12 @@ async function promptForToken(options) {
             exitCode: 1,
         });
     }
-    if (!process.stdin.isTTY) {
+    // The browser sign-in needs no terminal, so an agent's tool shell (Claude
+    // Code, Codex, Cursor), which has no TTY, can still run the setup prompt's
+    // `oxygen login` while the person approves in their browser. Only the pasted
+    // token fallback reads stdin. CI can never approve, so it still fails at once.
+    const interactive = process.stdin.isTTY === true;
+    if (!interactive && (!options.browser || isTruthyEnv(process.env.CI))) {
         throw new OxygenError("missing_token", `Pass a CLI API token with --token, or run \`oxygen login\` in an interactive terminal. Create a token at ${settingsUrl}.`, {
             details: { login_url: fallbackLoginUrl },
             exitCode: 1,
@@ -25932,7 +26028,8 @@ async function promptForToken(options) {
         }
         catch (error) {
             spinner.fail(`Browser login unavailable: ${readErrorMessage(error)}`);
-            output.write(`Paste a CLI API token instead (create one at ${settingsUrl}).\n`);
+            if (interactive)
+                output.write(`Paste a CLI API token instead (create one at ${settingsUrl}).\n`);
         }
         finally {
             clearTimeout(hintTimer);
@@ -25940,6 +26037,12 @@ async function promptForToken(options) {
             await browserSession.close();
         }
     }
+    if (!interactive) {
+        throw new OxygenError("missing_token", `The browser sign-in did not complete. Run \`oxygen login\` again and approve it in your browser, or pass a CLI API token with --token. Create a token at ${settingsUrl}.`, {
+            details: { login_url: fallbackLoginUrl },
+            exitCode: 1,
+        });
+    }
     return promptForManualToken();
 }
 /**

package/dist/tool-catalog-detail-command.js

@@ -5,7 +5,7 @@ import { requestOxygen } from "./http-client.js";
 /** Legacy no-flag invocation keeps the complete descriptor. */
 export function createToolCatalogDetailCommand(handle) {
     return addContractFlags(new Command("get")
-        .description("Get native tool metadata. Full by default; explicit views report omissions and retain exact schemas. Executable MCP definitions use capabilities schema.")
+        .description("Read one provider operation's workspace-effective fee with --view pricing --json. Full metadata is the default; explicit views report omissions and retain exact schemas. Executable MCP definitions use capabilities schema.")
         .argument("<tool_id>", "Tool id.")
         .option("--json", "Print a JSON envelope."), toolCatalogDetailQueryContract)
         .action(async (toolId, options) => {

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -969,6 +969,30 @@ function crmEnrichmentReadRecommendation(query) {
         exactMcpCall: { tool: "oxygen_crm_enrichment", arguments: { action: "list", ...(omitCounts ? { backfill: false } : {}), projection: "summary" } },
     };
 }
+/** CRM backfills and account projections use native Records repair owners. */
+function crmMaintenanceRecommendation(query) {
+    if (isHostedWorkflowIntent(query)
+        || /\b(workflows?|agents?|functions?|callables?|recurring)\b/.test(query)
+        || isSecondPartyDecisionIntent(query)
+        || isTableMaintenanceIntent(query))
+        return null;
+    if (/\bcrm\b/.test(query) && /\benrich\w*\b/.test(query)
+        && !/\b(run|running|execute|paid)\b/.test(query)
+        && /\b(backfill|missing|empty|blank|unfilled)\b/.test(query))
+        return {
+            tools: ["oxygen_crm_enrichment"],
+            commands: ["crm enrichment backfill", "crm enrichment list"],
+            execution: "Inspect the configured companies/people enrichments and preview one bounded backfill batch. A blank field does not prove enrichment never ran. oxygen_crm_enrichment action=backfill uses oxygen_capabilities_call even for its free preview. Paid live batches require approval for the exact object, batch scope and max_credits; retain existing values and read the run outcome before another batch.",
+        };
+    if (/\b(open deal|account stage|lifecycle stage)\b/.test(query)
+        || (/\bcrm\b/.test(query) && /\bdeal stage\b/.test(query)))
+        return {
+            tools: ["oxygen_crm_rollup", "oxygen_crm_record_get"],
+            commands: ["crm rollup", "crm get"],
+            execution: "Open Deal is the most advanced open deal stage; it is blank when none remain. Account Stage is the company lifecycle derived from people and deals, with a separate human override. Inspect the records; oxygen_crm_rollup previews the selected company scope for 0 credits without provider calls. include_lifecycle adds Account Stage; live applies the reviewed repair only after approval. MCP uses oxygen_capabilities_call.",
+        };
+    return null;
+}
 const CRM_ENRICHMENT_READ_VIEW = {
     owns: "Saved automatic-enrichment presets and batch caps for native CRM companies/people, backed by Tables auto-run.",
     notFor: "Running enrichment, provider catalog/sourcing, linked working Tables, external CRM sync, or changing the standing grant.",
@@ -979,6 +1003,9 @@ const CRM_ENRICHMENT_READ_VIEW = {
 function routeCardFor(card, query) {
     if (card.id === "records" && isCrmEnrichmentConfigurationRead(query))
         return { ...card, ...CRM_ENRICHMENT_READ_VIEW };
+    const crmMaintenance = card.id === "records" ? crmMaintenanceRecommendation(query) : null;
+    if (crmMaintenance)
+        card = { ...card, execution: crmMaintenance.execution };
     const feed = card.primitive === "tables" ? tableFeedRecommendation(query) : null;
     if (feed)
         return { ...card, execution: feed.execution };
@@ -1513,6 +1540,10 @@ function tableMaintenanceRecommendation(query) {
                 : result(["oxygen_table_action_item_resolve", "oxygen_table_runs_effect_unknown"], ["table-actions resolve", "table-runs effect-unknown"], "After verifying the external destination, record applied or not_applied by action item_id. This records an outcome without repeating the effect; retry remains a separate guarded action.");
         if (/\b(effect.*unknown|uncertain|verified outcome|blocked.*resolve)\b/.test(query))
             return result(["oxygen_table_runs_effect_unknown", "oxygen_table_runs_get", "oxygen_table_runs_items"], ["table-runs effect-unknown", "table-runs get", "table-runs items"], "Inspect exact effect-unknown items and verify the external destination. Only then record a verdict with oxygen_table_action_item_resolve by item_id or oxygen_table_cells_resolve by coordinates. Pending/failed items are not proof; retry is separate.");
+        // Everything that ran on one Table (imports, column runs, writes) is the workspace run
+        // ledger filtered by table; table-runs covers action runs only (blind CLI/MCP passes, 2026-10-05).
+        if (/\b(every|all|already|ever|history|imports?|ingestions?|touched|anything|everything)\b/.test(query) && !/\b(failures?|failed|items?|cells?|effect)\b/.test(query))
+            return result(["oxygen_runs_list", "oxygen_table_action_runs_list"], ["runs list", "table-runs list"], "List every recorded run of one Table, newest first, with `runs list --table <table>` (MCP oxygen_runs_list with table): imports, column runs and other writes. table-runs list covers column/action runs only.");
         return result(["oxygen_table_action_runs_list", "oxygen_table_runs_get", "oxygen_table_runs_items"], ["table-runs list", "table-runs get", "table-runs items"], "Find the Table's durable action run, then inspect its status and items. Pending, leased and failed are distinct from effect-unknown; do not record a verified verdict or retry an external effect without evidence.");
     }
     return null;
@@ -1584,6 +1615,8 @@ function explicitCapabilityIntent(query) {
         return ROUTE_BY_ID.get("connected-linkedin") ?? null;
     if (isCrmEnrichmentConfigurationRead(query))
         return ROUTE_BY_ID.get("records") ?? null;
+    if (crmMaintenanceRecommendation(query))
+        return ROUTE_BY_ID.get("records") ?? null;
     if (databaseRecommendation(query))
         return ROUTE_BY_ID.get("platform-operations") ?? null;
     if (oneShotContactFindingRecommendation(query))
@@ -1898,6 +1931,9 @@ function recommendationsFor(card, query) {
         return sent;
     if (card.id === "records" && isCrmEnrichmentConfigurationRead(query))
         return crmEnrichmentReadRecommendation(query);
+    const crmMaintenance = card.id === "records" ? crmMaintenanceRecommendation(query) : null;
+    if (crmMaintenance)
+        return crmMaintenance;
     const database = card.id === "platform-operations" ? databaseRecommendation(query) : null;
     if (database)
         return database;

package/node_modules/@oxygen/shared/dist/contracts/browser-operations.js

@@ -78,7 +78,7 @@ export const BROWSER_OPERATIONS = [
     operation("tables.resource.views.create", `${table}/views`, "POST", "tables views create", "oxygen_tables_views_create", "tables", "Create a saved Table view; group_by configures the same kanban grouping as the browser.", viewFields, ["name"], nativeCli),
     operation("tables.resource.views.edit", `${table}/views/{view}`, "PATCH", "tables views update", "oxygen_tables_views_update", "tables", "Edit a saved view's name, type, configuration, grouping, order or default status.", viewFields, [], nativeCli),
     operation("tables.resource.views.delete", `${table}/views/{view}`, "DELETE", "tables views delete", "oxygen_tables_views_delete", "tables", "Delete one saved Table view.", {}, [], nativeCli),
-    operation("tables.resource.runs.list", `${table}/runs`, "GET", "tables runs history", "oxygen_table_runs_history", "runs", "Read this Table's durable run history and progress.", { status: enumOf(["all", "active", "queued", "running", "paused", "completed", "completed_with_errors", "failed", "canceling", "canceled"]), limit: int({ minimum: 1 }) }),
+    operation("tables.resource.runs.list", `${table}/runs`, "GET", "tables runs history", "oxygen_table_runs_history", "runs", "Read this Table's action-run history and progress.", { status: enumOf(["all", "active", "queued", "running", "paused", "completed", "completed_with_errors", "failed", "canceling", "canceled"]), limit: int({ minimum: 1 }) }),
     operation("tables.resource.runs.start", `${table}/runs`, "POST", "tables runs start", "oxygen_table_resource_run_start", "runs", "Start selected Table actions using the browser's exact row-selection contract. Paid runs require an approved max_credits ceiling.", { actions, selection, max_credits: num({ minimum: 0 }), max_concurrency: int({ minimum: 1 }), force: bool(), approved: bool() }, ["actions"], { spends: true }),
     operation("tables.resource.runs.estimate", `${table}/runs/estimate`, "POST", "tables runs preview", "oxygen_table_resource_run_preview", "runs", "Preview selected Table action costs and provider availability, including draft column definitions; starts no run.", { actions, selection }, ["actions"], { mutates: false }),
     operation("tables.resource.runs.cancel", `${run}/cancel`, "POST", "tables runs stop", "oxygen_table_resource_run_stop", "runs", "Cancel one durable Table run; never repeats external provider effects."),

package/node_modules/@oxygen/shared/dist/contracts/customer-operations.js

@@ -80,8 +80,8 @@ export const CUSTOMER_OPERATIONS = [
     operation("spintax.generate", "/api/cli/spintax", "POST", "spintax generate", "oxygen_spintax_generate", "sequences", "Generate spintax for outreach text. Costs exactly 3 credits; failed generation refunds the reservation.", { text: str({ minLength: 1, maxLength: 4000 }), section: str({ maxLength: 80 }) }, ["text"], { spends: true }),
     operation("table_action_items.resolve", "/api/cli/table-action-items/{item_id}/resolve", "POST", "table-actions resolve", "oxygen_table_action_item_resolve", "tables", "Record a human-verified uncertain Table action outcome without repeating it. Use cells resolve for row/column coordinates.", TABLE_ITEM_RESOLVE_CONTRACT.properties, ["outcome"]),
     operation("table_ingestions.append", "/api/cli/table-ingestion-runs/{ingestion_run_id}/items", "POST", "table-ingestions append", "oxygen_table_ingestions_append_items", "runs", "Append bounded ingestion items to an existing run; preserves the run's approved scope.", { items: rows(), max_attempts: int({ minimum: 1 }) }, ["items"], cliOnly),
-    operation("tables.favorites.get", "/api/cli/tables/favorite", "GET", "tables favorites", "oxygen_tables_favorites", "tables", "Page Table/folder stars (per-member preference; free (0 credits)); use next_cursor. Tool-catalog favorites are separate.", TABLE_FAVORITES_LIST_CONTRACT.properties, [], { generated: { cli: true, mcp: false } }),
-    operation("tables.favorite.set", "/api/cli/tables/favorite", "POST", "tables favorite", "oxygen_tables_favorite", "tables", "Star/unstar exactly one table or folder; read back saved per-member preference. Free (0 credits). Tool-catalog favorites are separate.", TABLE_FAVORITE_CONTRACT.properties, ["favorite"]),
+    operation("tables.favorites.get", "/api/cli/tables/favorite", "GET", "tables favorites", "oxygen_tables_favorites", "tables", "Read starred Tables/folders (per-member preference; free (0 credits)); next_cursor. Catalog stars differ.", TABLE_FAVORITES_LIST_CONTRACT.properties, [], { generated: { cli: true, mcp: false } }),
+    operation("tables.favorite.set", "/api/cli/tables/favorite", "POST", "tables favorite", "oxygen_tables_favorite", "tables", "Star/unstar exactly one table or folder (saved per-member preference). Free (0 credits). Catalog stars differ.", TABLE_FAVORITE_CONTRACT.properties, ["favorite"]),
     operation("tables.import.csv", "/api/cli/tables/import-csv", "POST", "tables import-csv", "oxygen_tables_import_csv", "tables", "Import inline CSV into a hosted Table through its durable ingestion run. Use staged upload for large files.", { csv_text: text(), csv_base64: text(), table: text(), table_name: text(), project: text(), filename: text(), upsert_key: text(), batch_size: int({ minimum: 1, maximum: 5000 }) }, [], cliOnly),
     operation("tables.import.prepare", "/api/cli/tables/import-url", "POST", "tables import-upload", "oxygen_tables_import_upload", "tables", "Prepare a scoped storage upload for a hosted Table import; uploads and imports are separate, inspectable steps.", { file_name: text(), content_type: text(), byte_length: int({ minimum: 1 }), trace_id: text(), format: enumOf(["csv", "json", "xlsx"]) }, ["file_name", "byte_length"]),
     operation("tables.import.preview", "/api/cli/tables/import-preview", "POST", "tables import-preview", "oxygen_tables_import_preview", "tables", "Preview a staged file's headers, rows and existing-table mapping; writes no imported rows.", { storage_key: text(), file_name: text(), format: enumOf(["csv", "json", "xlsx"]), byte_length: int({ minimum: 1 }), table: text(), upsert_key: text() }, ["storage_key", "byte_length"], { mutates: false }),

package/node_modules/@oxygen/shared/dist/contracts/limits-read.js

@@ -25,6 +25,8 @@ function capacityProjection(value) {
             workspace_rows: reconciled ? usage.workspace_rows ?? null : null,
             largest_table_rows: reconciled ? usage.largest_table_rows ?? null : null,
             largest_table: reconciled ? usage.largest_table ?? null : null,
+            table_warning: reconciled ? usage.table_warning ?? null : null,
+            table_limit_reached: reconciled ? usage.table_limit_reached ?? null : null,
         } : null,
         note: "Rows are registry counts, available only after every Table is reconciled. Database bytes combine the last measured bytes and estimated subsequent growth; the estimate flag and timestamps name that state. Object storage is separate.",
     };

package/node_modules/@oxygen/shared/dist/contracts/publishing-reads.d.ts

@@ -5,6 +5,15 @@ export declare const PUBLISHING_NOTE_LIST_LIMIT = 500;
 export declare const PUBLISHING_REVISION_LIST_LIMIT = 200;
 export declare const PUBLISHING_METRIC_LIST_LIMIT = 400;
 export declare const PUBLISHING_AMPLIFICATION_SCOPE_KINDS: readonly ["all", "tag", "post", "ugc_program", "ugc_peer_program"];
+/** Exact stored GET branches of mixed Publishing owners. This is separate from
+ * no-spend previews: every omitted, malformed, write or future selector fails
+ * closed. Coarse tool annotations remain mixed; native identity/schema checks
+ * still run after this call-level classification. */
+export declare const PUBLISHING_STORED_READ_SELECTORS: Readonly<Record<string, {
+    argument: string;
+    values: readonly string[];
+}>>;
+export declare function isPublishingStoredRead(name: string, args: Record<string, unknown> | null | undefined): boolean;
 export declare const publishingReadProjectionContract: ContractObject<{
     readonly projection: {
         readonly type: "string";

package/node_modules/@oxygen/shared/dist/contracts/publishing-reads.js

@@ -7,6 +7,25 @@ export const PUBLISHING_NOTE_LIST_LIMIT = 500;
 export const PUBLISHING_REVISION_LIST_LIMIT = 200;
 export const PUBLISHING_METRIC_LIST_LIMIT = 400;
 export const PUBLISHING_AMPLIFICATION_SCOPE_KINDS = ["all", "tag", "post", "ugc_program", "ugc_peer_program"];
+/** Exact stored GET branches of mixed Publishing owners. This is separate from
+ * no-spend previews: every omitted, malformed, write or future selector fails
+ * closed. Coarse tool annotations remain mixed; native identity/schema checks
+ * still run after this call-level classification. */
+export const PUBLISHING_STORED_READ_SELECTORS = {
+    oxygen_publishing_notes: { argument: "action", values: ["list"] },
+    oxygen_publishing_revisions: { argument: "action", values: ["list"] },
+    oxygen_publishing_analytics: { argument: "scope", values: ["summary", "timeseries", "post", "account"] },
+    oxygen_publishing_amplification: { argument: "action", values: ["list", "get", "actions"] },
+};
+export function isPublishingStoredRead(name, args) {
+    if (!args || typeof args !== "object" || Array.isArray(args))
+        return false;
+    const rule = Object.hasOwn(PUBLISHING_STORED_READ_SELECTORS, name) ? PUBLISHING_STORED_READ_SELECTORS[name] : undefined;
+    if (!rule || !Object.hasOwn(args, rule.argument))
+        return false;
+    const selector = args[rule.argument];
+    return typeof selector === "string" && rule.values.includes(selector);
+}
 export const publishingReadProjectionContract = obj({
     projection: { ...str({ description: "full default; summary lists exact child metadata/indices; value streams lossless canonical JSON. Follow next_cursor with the same scope." }), enum: ["full", "summary", "value"] },
     value_path: str({ description: "Projection RFC6901 pointer: empty=root; /revisions/0/content_text, /comments/0/body, /series, /curve, /benchmarks or /accounts. No field is silently trimmed.", maxLength: 4096 }),

package/node_modules/@oxygen/shared/dist/contracts/table-operations.d.ts

@@ -1,5 +1,6 @@
 export declare const MAX_TABLE_RECOVERY_ITEMS = 1000;
 export declare const TABLE_FAVORITES_LIST_CONTRACT: import("./schema.js").ContractObject<{
+    readonly details: import("./schema.js").BooleanProperty;
     readonly limit: {
         type: "integer";
         description?: string;

package/node_modules/@oxygen/shared/dist/contracts/table-operations.js

@@ -3,12 +3,13 @@ import { bool, enumOf, int, jsonValue, num, obj, str } from "./schema.js";
 const table = str({ minLength: 1, description: "Table id, slug, or Oxygen table URL." });
 export const MAX_TABLE_RECOVERY_ITEMS = 1000;
 export const TABLE_FAVORITES_LIST_CONTRACT = obj({
-    limit: int({ minimum: 1, maximum: 200, description: "Page size; MCP default 20." }),
-    cursor: str({ maxLength: 512, description: "Previous next_cursor; restart if stars changed." }),
-    max_chars: int({ minimum: 500, maximum: 10_000, description: "Complete response cap in characters." }),
+    details: bool({ description: "Kind, id, name and web_url." }),
+    limit: int({ minimum: 1, maximum: 200, description: "Page size (default 20)." }),
+    cursor: str({ maxLength: 512, description: "next_cursor; restart if stars change." }),
+    max_chars: int({ minimum: 500, maximum: 10_000, description: "Response cap." }),
 });
 export const TABLE_FAVORITE_CONTRACT = obj({
-    table: str({ minLength: 1, description: "Table id, slug, or Oxygen table URL. Pass exactly one of table or folder." }),
+    table: str({ minLength: 1, description: "Table id, slug or same-workspace URL. Pass exactly one of table or folder." }),
     folder: str({ minLength: 1, description: "Folder id or slug. Pass exactly one of table or folder." }),
     favorite: bool({ description: "true stars; false unstars." }),
 }, { required: ["favorite"] });

package/node_modules/@oxygen/shared/dist/plan-limits-view.d.ts

@@ -82,6 +82,8 @@ export type PlanLimitsStorageCapacity = {
             id?: string;
             name?: string;
         } | null;
+        table_warning?: boolean | null;
+        table_limit_reached?: boolean | null;
         workspace_database_bytes?: number;
     } | null;
 };
@@ -177,6 +179,8 @@ export declare function planLimitsLadder(payload: PlanLimitsEnvelope): PlanLimit
  * named, so a full one is identifiable (decision F.2).
  */
 export declare function planLimitsStorageUsageLine(storage: PlanLimitsStorageCapacity | undefined): string | null;
+/** Status of the largest active Table, from the same flags CLI and MCP read. */
+export declare function planLimitsTableStatus(storage: PlanLimitsStorageCapacity | undefined): "full" | "nearly full" | null;
 /** Sending limits are the same on every plan: one row per channel. */
 export declare function planLimitsSendingRows(sending: PlanLimitsSendingLimits | undefined): Array<{
     label: string;

package/node_modules/@oxygen/shared/dist/plan-limits-view.js

@@ -201,13 +201,22 @@ export function planLimitsStorageUsageLine(storage) {
     if (!guard || !usage)
         return null;
     const largest = usage.largest_table?.name ? `Largest table “${usage.largest_table.name}”` : "Largest table";
+    const tableStatus = planLimitsTableStatus(storage);
     const parts = [
-        `${largest} ${formatLimitCount(usage.largest_table_rows)} / ${formatLimitCount(guard.table_row_limit)} rows`,
+        `${largest} ${formatLimitCount(usage.largest_table_rows)} / ${formatLimitCount(guard.table_row_limit)} rows${tableStatus ? ` (${tableStatus})` : ""}`,
         `workspace ${formatLimitCount(usage.workspace_rows)} / ${formatLimitCount(guard.workspace_row_limit)} rows`,
         `database ${formatLimitBytes(usage.workspace_database_bytes)} / ${formatLimitBytes(guard.workspace_database_limit_bytes)}`,
     ];
     return `Your storage: ${parts.join(" · ")}`;
 }
+/** Status of the largest active Table, from the same flags CLI and MCP read. */
+export function planLimitsTableStatus(storage) {
+    if (storage?.usage?.table_limit_reached === true)
+        return "full";
+    if (storage?.usage?.table_warning === true)
+        return "nearly full";
+    return null;
+}
 /** Sending limits are the same on every plan: one row per channel. */
 export function planLimitsSendingRows(sending) {
     if (!sending)

package/node_modules/@oxygen/shared/dist/table-capacity.d.ts

@@ -1,5 +1,13 @@
 import type { PlanBand } from "./plan-band.js";
 import { type RepricingOptions } from "./repricing.js";
+/** Row capacity warnings start at 80% of the limit currently enforced. */
+export declare const TABLE_ROW_CAPACITY_WARNING_RATIO = 0.8;
+export type TableRowCapacityFlags = {
+    /** Null until the row count is reconciled. Also true at or above the hard limit. */
+    tableWarning: boolean | null;
+    tableLimitReached: boolean | null;
+};
+export declare function tableRowCapacityFlags(rows: number | null, rowLimit: number): TableRowCapacityFlags;
 export type WorkspaceTableCapacityLimits = {
     tableRowLimit: number;
     workspaceRowLimit: number;

package/node_modules/@oxygen/shared/dist/table-capacity.js

@@ -1,5 +1,13 @@
 import { findRepricedValue, readRepricingSwitch, repricedValue, } from "./repricing.js";
 const GIB = 1024 ** 3;
+/** Row capacity warnings start at 80% of the limit currently enforced. */
+export const TABLE_ROW_CAPACITY_WARNING_RATIO = 0.8;
+export function tableRowCapacityFlags(rows, rowLimit) {
+    return {
+        tableWarning: rows === null ? null : rows >= rowLimit * TABLE_ROW_CAPACITY_WARNING_RATIO,
+        tableLimitReached: rows === null ? null : rows >= rowLimit,
+    };
+}
 /**
  * The envelope every workspace had before storage scaled with plan size, and
  * still the value in force for any workspace whose plan-resolved limits have not

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1011.804";
+export declare const OXYGEN_BUILD_VERSION = "1.1011.855";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1011.804";
+export const OXYGEN_BUILD_VERSION = "1.1011.855";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1011.804",
+  "version": "1.1011.855",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",