@oxygen-agent/cli 1.1011.855 → 1.1011.1091

package/dist/index.js

@@ -1,3 +1,4 @@
+import { registerAdminLeadMagnetCommands } from "./admin-lead-magnet-commands.js";
 import { renderPrimaryProviderBoard } from "./admin-primary-providers-render.js";
 import { isTruthyEnv, markStdinConsumed, maybeScheduleBackgroundUpdate, readAutoUpdateStatus, runBackgroundUpdate, } from "./auto-update.js";
 import { createBrowserLoginSession, createRelayLoginSession, openBrowser } from "./browser-login.js";
@@ -9,7 +10,7 @@ import { registerConnectorsCommands } from "./connectors-commands.js";
 import { addContractFlags, readContractFlags } from "./contract-flags.js";
 import { clearCredentials, defaultApiUrl, listCredentialProfiles, loadCredentials, normalizeApiUrl, pickProfileNameForIdentity, pickProfileNameForUserSession, readEnvToken, resolveActiveProfile, saveCredentials, switchCredentialProfile, updateActiveOrganizationForProfile, } from "./credentials.js";
 import { registerCrmFileReadCommands } from "./crm-file-read-commands.js";
-import { registerCrmSupportFlags, readCrmNoteEditFields, readCrmPhotoFields, readCrmFileLabel, buildCrmObjectsPath, buildCrmConnectionsPath } from "./crm-support-flags.js";
+import { registerCrmSupportFlags, readCrmNoteEditFields, readCrmPhotoFields, readCrmFileLabel, buildCrmObjectsPath, buildCrmConnectionsPath, buildCrmRecordPath } from "./crm-support-flags.js";
 import { registerCustomerOperationCommands } from "./customer-operation-commands.js";
 import { DATABASE_QUERY_FLAG_OVERLAY } from "./database-query-flags.js";
 import { addFeedReadFlags, feedReadWindowParams } from "./feed-read-flags.js";
@@ -25,7 +26,7 @@ import { formatMailboxRampNotice } from "./mailbox-ramp-notice.js";
 import { waitForCliRun } from "./run-wait.js";
 import { resolveCliBinaryName } from "./runtime.js";
 import { formatSearchAiFilterTotalsNotice } from "./search-ai-filter-notice.js";
-import { buildSenderLimitsBody, parseWorkingDaysOption, SENDER_LIMITS_FLAG_OVERLAY } from "./sender-limits-flags.js";
+import { addWhatsAppLimitFlags, buildSenderLimitsBody, parseWorkingDaysOption, SENDER_LIMITS_FLAG_OVERLAY } from "./sender-limits-flags.js";
 import { addSessionOutput, addSessionStatus, getSessionUsage, startSession, updateSessionStep, } from "./session.js";
 import { registerSettingsCommands } from "./settings-commands.js";
 import { doctorAgentSkills, getAgentSkill, installAgentSkills, listAgentSkills, runAutomaticSkillsInstall, searchAgentSkills, } from "./skills.js";
@@ -40,6 +41,7 @@ import { registerVisualCommands } from "./visual-commands.js";
 import { WHATSAPP_ACCOUNT_FLAGS, whatsappAccountQuery } from "./whatsapp-account-flags.js";
 import { formatWorkflowPlanLimitNotices } from "./workflow-plan-limit-notices.js";
 import { WORKFLOW_RUN_LIST_FLAG_OVERLAY, readWorkflowRunListFlags } from "./workflow-run-list-flags.js";
+import { addProviderLimitFlags, addSuppressionListFlags, providerLimitBody, providerLimitQuery, suppressionListQuery } from "./workspace-utility-flags.js";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
 import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatCopilotPlanDuration, formatCopilotPlanSeconds, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, chunk, isVersionGreater, isVersionLess, KNOWLEDGE_BOOTSTRAP_MAX_CREDITS, MAX_CLI_JSON_BODY_BYTES, MAX_MCP_TOOL_NAME_LENGTH, normalizeCopilotPlanStepStatus, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferUserCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { PURCHASABLE_PLAN_KEYS, planVolumeBonusPercent, resolveBasePricingPlan } from "@oxygen/shared/billing";
@@ -66,12 +68,14 @@ import { WHATSAPP_ACCOUNTS_READ_CONTRACT } from "@oxygen/shared/contracts/whatsa
 import { WORKFLOW_RUN_LIST_CONTRACT, workflowRunListQueryParams } from "@oxygen/shared/contracts/workflow-run-list";
 import { MANAGED_DATA_SUPPLIERS } from "@oxygen/shared/data-suppliers";
 import { MAX_BUFFERED_IMPORT_PARSE_BYTES, assertImportFormatWithinBufferedLimit, inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, parseXlsxWorkbookBuffer, } from "@oxygen/shared/file-import";
+import { KNOWLEDGE_PAGE_TYPES } from "@oxygen/shared/knowledge-constants";
 import { LINKEDIN_SENDER_LIMIT_DEFAULTS, LINKEDIN_SENDER_LIMIT_MAXIMUMS, } from "@oxygen/shared/linkedin-sequences";
 import { MAILBOX_IMPORT_FILE_MAX_BYTES as SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES, MAILBOX_IMPORT_ROW_LIMIT as SHARED_MAILBOX_IMPORT_ROW_LIMIT, normalizeMailboxImportFile as normalizeSharedMailboxImportFile, normalizeMailboxImportVendor as normalizeSharedMailboxImportVendor, normalizeMailboxWorkbookRows, parseMailboxImportText, summarizeMailboxImportValidation as summarizeSharedMailboxImportValidation, } from "@oxygen/shared/mailbox-import";
 import { PUBLIC_WEBHOOK_INGRESS_PER_TARGET_PER_MINUTE } from "@oxygen/shared/plan-band";
 import { AI_COLUMN_CREDITS, AI_COLUMN_WEB_SEARCH_TYPICAL_CREDITS } from "@oxygen/shared/pricing-sheet";
 import { TAG_COLORS } from "@oxygen/shared/select-options";
 import { SEQUENCE_LIFECYCLES, sequenceDisplayStatus } from "@oxygen/shared/sequence-lifecycle";
+import { FILTER_TREE_OPERATORS } from "@oxygen/shared/table-filter-operators";
 import { assertRecipeBundleSafe, assertPortableWorkflowDefinition, assertWorkflowGraphManifest, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowGraphManifest, isWorkflowManifest, hashPortableWorkflowGraphManifest, WORKFLOW_GRAPH_COMPILER_VERSION, WORKFLOW_GRAPH_MANIFEST_VERSION, } from "@oxygen/workflows";
 import { Command, CommanderError, Option } from "commander";
 import { execFileSync } from "node:child_process";
@@ -352,6 +356,20 @@ function suppressionListParams(options) {
 // feed): `translateScheduleEvery` in apps/web resolves all four forms, so this
 // string is the single place the CLI spells them out.
 const CADENCE_FLAG_DESCRIPTION = "Shorthand schedule: hourly, every_6h, daily@<hour>, or weekly@<day><hour> (e.g. weekly@mon9). Hours 0-23 UTC.";
+/** A --value for the pricing book: a number, true/false for a charge's active flag, or "none" for no plan limit. */
+function readPriceBookValue(raw) {
+    if (raw === undefined)
+        return undefined;
+    const value = raw.trim();
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    if (value === "none" || value === "null")
+        return null;
+    const number = Number(value);
+    return value !== "" && Number.isFinite(number) ? number : value;
+}
 const BROWSER_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 const BROWSER_LOGIN_FALLBACK_HINT_MS = 15 * 1000;
 const OXYGEN_SPINNER_INTERVAL_MS = 90;
@@ -1703,6 +1721,15 @@ function writeMaxCreditsHint(error) {
             process.stderr.write(`hint: the estimate is ${estimated} credits; re-run with --max-credits ${estimated} or higher\n`);
             return;
         }
+        case "copilot_send_timeout": {
+            const nextStep = readDetailsString(error.details, "next_step");
+            const interrupt = readDetailsString(error.details, "interrupt_command");
+            if (nextStep)
+                process.stderr.write(`hint: the turn is still running; read it with \`${nextStep}\`\n`);
+            if (interrupt)
+                process.stderr.write(`hint: stop it (and its spend) with \`${interrupt}\`\n`);
+            return;
+        }
         default:
     }
 }
@@ -3798,6 +3825,7 @@ export function createProgram() {
     const workspaceCommand = program
         .command("workspace")
         .description("Inspect this workspace or end its managed external infrastructure.")
+        .addHelpText("before", "\nActive workspace and identity: oxygen whoami --summary-json (read-only, 0 credits).\n")
         .addCommand(new Command("map")
         .description("What this workspace actually contains: the newest tables, CRM objects, sequences, workflows, agents, wiki pages, posts and projects, each with its id, last activity, tags and link. Read-only, 0 credits. Capability search tells you what OXYGEN can do; this tells you what is here.")
         .option("--kind <kinds>", "Comma-separated kinds to include: table, crm_object, sequence, workflow, agent, knowledge_page, post, project.")
@@ -4013,7 +4041,7 @@ export function createProgram() {
         });
     }))
         .addCommand(new Command("billing-link")
-        .description("Cover a workspace with a plan you already pay for in another organization (one plan, many workspaces) instead of buying a second subscription. Omit --owner when exactly one of your organizations can pay and Oxygen will use it; `orgs billing-owners` lists them all. You must be an admin of BOTH organizations, the workspace being linked must not hold a live subscription of its own, and an org-bound key (oxy_live_…) can only link the workspace it is bound to. Credit billing moves, workspace data access does not; plan gates and sending seats then resolve through the owner, so the linked workspace connects senders against the owner's seats and seats are bought there. `plan_tier` in the response is the plan the workspace now runs on; `free` means the owner holds no active paid plan, so connecting senders stays blocked. From the owner, `billing usage --group-by workspace` reports the credits each linked workspace spent.")
+        .description("Cover a workspace with another organization's paid plan instead of buying a second subscription. Omit --owner when exactly one owner is eligible; orgs billing-owners lists them. You must administer both organizations, the workspace must not hold its own live subscription, and an org-bound key can link only its workspace. The owner funds credits; data access stays unchanged. billing estimate reports sender_billing: credit_reservations uses the owner's credits, including when plan_tier is free; legacy sending_seats uses the owner's paid plan and seats. BYOK and Instagram/TikTok/YouTube/Facebook publishing still need a paid plan. billing usage --group-by workspace reports each linked workspace's spend.")
         .option("--owner <organization>", "Billing owner organization id, Clerk org id, or slug. Optional — when omitted, Oxygen uses your one eligible organization, and refuses to pick if there is more than one.")
         .option("--organization <organization>", "Workspace organization to link. Defaults to the active organization.")
         .option("--organization-id <id>", "Alias for --organization.")
@@ -4041,7 +4069,7 @@ export function createProgram() {
         });
     }))
         .addCommand(new Command("billing-unlink")
-        .description("Return a workspace to owning its own billing: it stops being covered by another organization's plan and needs a subscription of its own again.")
+        .description("Return a workspace to its own billing owner and credit balance. Its own subscription state, plan and sender_billing model determine which actions need a plan.")
         .option("--organization <organization>", "Workspace organization to unlink. Defaults to the active organization.")
         .option("--organization-id <id>", "Alias for --organization.")
         .option("--json", "Print a JSON envelope.")
@@ -4188,11 +4216,12 @@ Examples:
         await handleAsyncAction("support admin list", options, () => requestOxygen(withSupportListQuery("/api/cli/admin/support/tickets", options)));
     }))
         .addCommand(new Command("get")
-        .description("Show one live Plain Thread, its routing metadata, and customer-visible messages (staff only).")
+        .description("Show one live Plain Thread, its routing metadata, and customer-visible messages (staff only). Add --include-notes to also read back the Thread's team-only notes and staged reply drafts as `internal_notes` (kind note, reply_draft, suggested_reply_provenance or undelivered_customer_report); read-only, never shown to the customer.")
         .argument("<ticketId>", "Plain Thread ID (th_...) or Thread ref (T-<n>), as shown by `oxygen support admin list`.")
+        .option("--include-notes", "Also return team-only internal notes and staged drafts.")
         .option("--json", "Print a JSON envelope.")
         .action(async (ticketId, options) => {
-        await handleAsyncAction("support admin get", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}`));
+        await handleAsyncAction("support admin get", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}${options.includeNotes ? "?include_notes=1" : ""}`));
     }))
         .addCommand(new Command("open")
         .description("Return the exact Plain Inbox URL for one live Thread (staff only).")
@@ -4756,7 +4785,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("color")
-        .description("Set a project's colour in the Tables rail. `--color auto` restores the automatic colour.")
+        .description("Set a folder's colour in the Tables sidebar (rail) for everyone in the workspace. `--color auto` restores the automatic colour. Free.")
         .argument("<project>", "Project slug or id.")
         .requiredOption("--color <color>", "Colour name (gray, red, orange, amber, yellow, green, teal, blue, indigo, purple, pink) or `auto` to clear.")
         .option("--json", "Print a JSON envelope.")
@@ -5189,9 +5218,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     })))
         .addCommand(new Command("comments")
-        .description("Publishing Community for public comments on every recent post owned by a connected LinkedIn account, including posts created directly on LinkedIn. Start with `oxygen publishing comments list --view unanswered --json`. These are network conversations, not workspace review notes. The local queue targets a six-hour background discovery + comment poll; provider quota/backoff can delay it, and list reports the exact freshness plus empty_queue_is_current. If that field is false, do not conclude there are no comments: wait for next_sync_at. The worker retries automatically; there is no manual retry by design because it could loop against LinkedIn quota. Queue reads use 0 credits and make no provider call; only explicit approval can post a public reply.")
+        .description("Publishing Community for public comments on every recent post owned by a connected LinkedIn account, including posts created directly on LinkedIn. Start with `oxygen publishing comments list --view unanswered --json`. These are network conversations, not workspace review notes. The local queue targets a six-hour background discovery + comment poll; provider quota/backoff can delay it. Read freshness, empty_queue_is_current and guidance before trusting an empty queue. automatic_retry_at reports a future retry; next_sync_at alone does not confirm one. An unconfirmed provider read can pause refresh; contact support when guidance says to. No manual retry is available. Queue reads use 0 credits and make no provider call; only explicit approval can post a public reply.")
         .addCommand(new Command("list")
-        .description("List the Publishing Community work queue, oldest first, with polling freshness/backoff even when empty. Defaults to the Unanswered view: needs_reply, draft, awaiting_approval, and action_unavailable. All means every lifecycle state inside the rolling 30-day recent-owned-post scope, not lifetime LinkedIn history. Read-only: no provider call, 0 credits.")
+        .description("List the Publishing Community work queue, oldest first, with polling freshness/backoff even when empty. Defaults to the Unanswered view: needs_reply, draft, awaiting_approval, and action_unavailable. All covers every lifecycle state on published owned posts within 30 days plus UGC-linked posts, not lifetime LinkedIn history. Completed coverage counts earlier successful polls and can overlap failed coverage after a later error. Read-only: no provider call, 0 credits.")
         .option("--view <view>", "Community view: unanswered (default) or all; all is bounded to recent owned posts.")
         .option("--status <status>", "Advanced exact-state filter: needs_reply, draft, awaiting_approval, replied, resolved, ignored, spam, or action_unavailable. Cannot be combined with --view.")
         .option("--post <post_id>", "Only comments on one scheduled Publishing post.")
@@ -5287,7 +5316,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     })))
         .addCommand(new Command("analytics")
-        .description("Stored LinkedIn and X engagement snapshots synced in the background. LinkedIn includes owned posts discovered from the provider; X includes only posts published through OXYGEN. Reading analytics makes no provider call and uses 0 credits. A snapshotted post completed a sync pass; use per-metric coverage to see which values were populated. Null is unknown, never zero. Stale or pending snapshots retry automatically; no manual provider retry is available or needed.")
+        .description("Stored LinkedIn and X engagement snapshots synced in the background. LinkedIn includes owned posts discovered from the provider; X includes only posts published through OXYGEN. Reading analytics makes no provider call and uses 0 credits. A snapshotted post completed a sync pass; use per-metric coverage to see which values were populated. Null is unknown, never zero. Read freshness and guidance for delayed refresh; an unconfirmed provider read can pause it. No manual provider retry is available.")
         .addCommand(new Command("summary")
         .description("Workspace LinkedIn or X analytics. LinkedIn includes owned posts discovered from the provider; X currently includes posts published through OXYGEN. Uses each post's latest stored snapshot; snapshotted_posts (legacy measured_posts) counts sync passes, while coverage counts non-null values. Read-only: no provider call, 0 credits.")
         .option("--channel <channel>", "Channel to summarize: linkedin (default) or x.")
@@ -5344,7 +5373,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("publishing analytics post", options, () => requestOxygen(publishingReadQueryPath(buildPublishingAnalyticsPath(`/api/cli/publishing/analytics/posts/${encodeURIComponent(postId)}`, { since: readOption(options.since) }), publishingAnalyticsQueryContract, options)));
     }))
         .addCommand(addContractFlags(new Command("account"), publishingAnalyticsQueryContract)
-        .description("Stored per-account metric series (followers) for connected LinkedIn and X publishing accounts, read once a day in the background. Read-only: no provider call, 0 credits.")
+        .description("Stored per-account metric series (followers) for connected LinkedIn and X publishing accounts, read once a day in the background. Each account reports its snapshot freshness; stale values remain available. Read-only: no provider call, 0 credits.")
         .option("--provider <provider>", "Channel to read: linkedin or x. Omit for every connected channel.")
         .option("--since <date>", "ISO date to start the series from.")
         .option("--account <key>", PUBLISHING_ANALYTICS_ACCOUNT_HELP, collectRepeatable, [])
@@ -5513,7 +5542,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .command("dashboards")
         .description("Your saved dashboards, plus the built-in GTM funnel. `summary` reads the built-in Command Center funnel across the sequencer, unibox and CRM; everything else creates and edits dashboards you save yourself and open again later, from charts, saved table views, notes, embeds and live sources.")
         .addCommand(new Command("summary")
-        .description("Show the GTM funnel summary: touches → replies → positive → meetings → deals → won, with this-period revenue, channel split, and needs-action triage counts.")
+        .description("Show the GTM funnel summary: touches → replies → positive → meetings → deals → won, with this-period revenue, channel split, and current needs-action triage. Unread replies across channels and interested email conversations are current inbox counts, independent of the selected range.")
         .option("--range <range>", "Preset range: 7d, 14d, 28d, 30d, 90d, 180d, 365d, or all. Defaults to 14d.")
         .option("--from <date>", "Custom start date (YYYY-MM-DD).")
         .option("--to <date>", "Custom end date (YYYY-MM-DD).")
@@ -5805,16 +5834,16 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         // and options.json is undefined here. optsWithGlobals() reads --json
         // wherever it landed, so the envelope is emitted like every other
         // crm_* command instead of printing the bare result.
-        await handleAsyncAction("crm object create", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen("/api/cli/crm/objects", {
+        await handleAsyncAction("crm objects create", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen("/api/cli/crm/objects", {
             method: "POST",
             body: buildCrmObjectCreateBody(options),
         }));
     }))
         .addCommand(new Command("delete")
-        .description("Delete a CUSTOM CRM object: removes the object and schedules its backing table for deletion (restorable for 14 days). Standard objects (companies, people, deals) are permanent and refused. Defaults to dry-run; --live requires --confirm. Re-run on an object a teammate already deleted, it reports alreadyArchived with the table's deletion state and purge date.")
+        .description("Delete a CUSTOM CRM object: removes the object and schedules its backing table for deletion (restorable for 14 days). Standard objects (companies, people, deals) are permanent and refused. Defaults to dry-run; --live requires --confirm. Re-run on an object a teammate already deleted, it reports alreadyArchived with the table's deletion state and purge date. Restoring that table returns its rows as an ordinary table; the object stays deleted. Purging it also removes the object's archived definition.")
         .argument("<object>", "Custom CRM object slug, such as projects or tasks.")
-        .option("--keep-table", "Deregister the object but keep its table as an ordinary workspace table (no delete timer).")
-        .option("--purge-after <days>", "Days until the backing table's physical purge. Defaults to 14; restorable via `tables restore` until then.")
+        .option("--keep-table", "Deregister the object but keep its table as an ordinary workspace table (no delete timer). Ignored once the table is already scheduled.")
+        .option("--purge-after <days>", "Days until the backing table's physical purge. Defaults to 14; restorable via `tables restore` until then. Ignored once the table is already scheduled.")
         .option("--dry-run", "Preview the object, rows, relationships, and edges the delete would take. Default.")
         .option("--live", "Apply the delete. Requires --confirm.")
         .option("--confirm", "Confirm the live delete after inspecting the dry-run impact.")
@@ -5822,7 +5851,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .action(async (object, options, command) => {
         // See `objects create` above: optsWithGlobals() recovers --json,
         // which the parent command otherwise swallows.
-        await handleAsyncAction("crm object delete", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}`, {
+        await handleAsyncAction("crm objects delete", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}`, {
             method: "DELETE",
             body: buildCrmObjectDeleteBody(options),
         }));
@@ -5838,7 +5867,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .action(async (object, options, command) => {
         // See `objects create` above: optsWithGlobals() recovers --json,
         // which the parent command otherwise swallows.
-        await handleAsyncAction("crm object add-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes`, {
+        await handleAsyncAction("crm objects add-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes`, {
             method: "POST",
             body: buildCrmObjectAddAttrBody(options),
         }));
@@ -5855,7 +5884,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--live", "Apply the change. Default is dry-run.")
         .option("--json", "Print a JSON envelope.")
         .action(async (object, attribute, options, command) => {
-        await handleAsyncAction("crm object update-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes/${encodeURIComponent(attribute)}`, { method: "PATCH", body: buildCrmObjectUpdateAttrBody(options) }));
+        await handleAsyncAction("crm objects update-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes/${encodeURIComponent(attribute)}`, { method: "PATCH", body: buildCrmObjectUpdateAttrBody(options) }));
     }))
         .addCommand(new Command("remove-attr")
         .description("Remove a field you added to a CRM object. The column is archived (restorable with `columns restore <table> <key>`, which brings the field back; no cell destroyed), the object stops listing it, and the key is free for a new field at once. Oxygen-shipped fields, the title field, identity fields and relations cannot be removed. Defaults to dry-run.")
@@ -5865,7 +5894,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--live", "Remove the field. Default is dry-run.")
         .option("--json", "Print a JSON envelope.")
         .action(async (object, attribute, options, command) => {
-        await handleAsyncAction("crm object remove-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes/${encodeURIComponent(attribute)}`, { method: "DELETE", body: { mode: resolveLiveDryRunMode(options) } }));
+        await handleAsyncAction("crm objects remove-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes/${encodeURIComponent(attribute)}`, { method: "DELETE", body: { mode: resolveLiveDryRunMode(options) } }));
     })))
         .addCommand(new Command("search")
         .description("Search CRM records by identity or record label. Takes ONE query; narrow the objects with --object, not a second argument.")
@@ -5901,7 +5930,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .argument("<row_id>", "CRM record row id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (object, rowId, options) => {
-        await handleAsyncAction("crm get", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}`));
+        await handleAsyncAction("crm get", options, () => requestOxygen(buildCrmRecordPath(object, rowId, options)));
     }))
         .addCommand(new Command("connections")
         .description("Show the conversations and sequence enrollments connected to one CRM record, resolved through its people and identities \u2014 never by fuzzy name or domain.")
@@ -5926,7 +5955,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("crm files list", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/files`));
     }))
         .addCommand(new Command("attach")
-        .description("Upload a local file and attach it to a CRM record. Attaching the same file twice is a no-op, not a duplicate.")
+        .description("Upload a local file and attach it to a CRM record. Each call creates a new file and attachment, including identical retries. If a response is lost, inspect the record's files before retrying. No credits.")
         .argument("<object>", "CRM object slug, such as companies or people.")
         .argument("<record>", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
         .argument("<path>", "Local file path.")
@@ -6161,6 +6190,14 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
+    }))
+        .addCommand(new Command("keep")
+        .description("Keep one sample record as real. A new workspace starts with sample companies, CEOs and deals: their reads carry `_sample: true` (`sample: true` on `crm pipeline` deals) and pipeline totals leave them out. Keep one only when it is real; it then counts like any record. Linked records stay as they are: a kept sample deal's company and contact stay samples until each is kept. Free and idempotent, no undo.")
+        .argument("<object>", "CRM object slug: companies, people or deals.")
+        .argument("<record>", "Row id (`crm pipeline` lists each deal's), or an identity value such as stripe.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, record, options) => {
+        await handleAsyncAction("crm keep", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(record)}/keep`, { method: "POST" }));
     }))
         .addCommand(new Command("relationships")
         .description("Define CRM relationships and manage record relationship edges.")
@@ -6259,7 +6296,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("crm activity timeline", options, () => requestOxygen(buildCrmTimelinePath(object, rowId, options)));
     })))
         .addCommand(new Command("describe")
-        .description("Describe one configured CRM object: its fields, identities and relationships. Pass --field <key> to read just one field (its name, type, choices, flags) instead of the whole object. A deleted custom object answers not found; `crm objects delete <slug> --dry-run` shows its archived state.")
+        .description("Describe one configured CRM object: its fields, identities and relationships. Pass --field <key> to read just one field (its name, type, choices, flags) instead of the whole object. Custom slugs accept hyphens. A deleted custom object answers crm_object_not_found with state archived; its next step, `crm objects delete <slug> --dry-run`, shows the purge time.")
         .argument("<object>", "CRM object slug, such as companies or people.")
         .option("--field <key>", "Narrow the answer to one field by its key, e.g. --field pipeline_stage. Also accepted as --attribute.")
         .option("--attribute <key>", "Alias for --field.")
@@ -6293,7 +6330,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("pipeline")
-        .description("Show the deals pipeline grouped by stage, with per-stage counts and amount totals.")
+        .description("Show the deals pipeline grouped by stage, with per-stage counts and amount totals. Seeded sample deals are listed with `sample: true` but never counted; `samples` reports them.")
         .option("--pipeline <name>", "Filter to one pipeline, such as sales, expansion, or renewal.")
         .option("--limit <limit>", "Maximum deals to return per stage.")
         .option("--json", "Print a JSON envelope.")
@@ -6371,7 +6408,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, attio people|companies, or pipedrive persons|organizations|deals. Import Pipedrive persons and organizations before deals so each deal links to them.")
         .option("--into <object>", "Oxygen CRM object slug to import into. Defaults to the natural mapping.")
         .option("--limit <n>", "Max records to pull this run.")
-        .option("--max-credits <n>", "OXYGEN spend ceiling for the run. Own-API-key calls cost 0.05 credits each; OAuth follows its tool quote, and Workflow steps are billed separately. Use --limit for rows; CRM API quota also applies.")
+        .option("--max-credits <n>", "OXYGEN credit ceiling for the run. Review the current quote: own-API-key calls cost 0.05 credits each after repricing takes effect; OAuth follows its tool quote. Workflow steps count toward the ceiling after repricing takes effect. Use --limit for rows; provider billing and API quota are separate.")
         .option("--approved", "Confirm a live import after inspecting a dry run.")
         .option("--dry-run", "Preview the import without pulling. Default.")
         .option("--live", "Run the live import. Requires --approved and --max-credits.")
@@ -6390,7 +6427,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--cron <cron>", "Cron expression for the scheduled reconciliation cadence, e.g. '*/15 * * * *'.")
         .option("--timezone <tz>", "IANA timezone the cron schedule runs in, e.g. America/New_York. Defaults to UTC.")
         .option("--max-rows <n>", "Per-cycle row cap, separate from the --max-credits OXYGEN spend ceiling. OAuth provider calls follow their tool quote; own-API-key calls and live Workflow steps have separate charges.")
-        .option("--max-credits <n>", "Managed-credit + external-quota cap per cycle.")
+        .option("--max-credits <n>", "OXYGEN credit ceiling per cycle. Provider/data-read fees count toward it; Workflow steps count after repricing takes effect. Provider billing and API quota are separate.")
         .option("--field-mappings-json <json>", "HubSpot custom-property mappings as a JSON array of {oxygen_field, provider_field, direction}. Pass [] to clear; canonical identity/name mappings stay fixed.")
         .option("--approved", "Confirm a live configuration after inspecting a dry run.")
         .option("--dry-run", "Preview the configuration and next cycle without writing. Inbound/bidirectional previews perform bounded CRM reads and may use external API quota. Default.")
@@ -6409,8 +6446,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--direction <direction>", "Override this cycle's direction: inbound, outbound, or bidirectional.")
         .option("--since <iso>", "Read provider changes since this watermark.")
         .option("--config-id <id>", "Use this standing CRM sync configuration for the cycle.")
-        .option("--max-rows <n>", "Per-cycle row cap. The real volume brake on provider writes (BYOK writes cost 0 Oxygen credits).")
-        .option("--max-credits <n>", "Managed-credit + external-quota cap for this cycle.")
+        .option("--max-rows <n>", "Per-cycle row cap, separate from the --max-credits OXYGEN spend ceiling. OAuth provider calls follow their tool quote; own-API-key calls and live Workflow steps have separate charges.")
+        .option("--max-credits <n>", "OXYGEN credit ceiling per cycle. Provider/data-read fees count toward it; Workflow steps count after repricing takes effect. Provider billing and API quota are separate.")
         .option("--approved", "Confirm a live cycle after inspecting a dry run.")
         .option("--dry-run", "Preview the cycle without pulling or pushing. Default.")
         .option("--live", "Run the live reconciliation cycle. Requires --approved and --max-credits.")
@@ -6429,7 +6466,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--cron <cron>", "Cron expression for the cadence, e.g. '*/15 * * * *'. Defaults to every 15 minutes.")
         .option("--timezone <tz>", "IANA timezone the cron runs in. Defaults to UTC.")
         .requiredOption("--max-rows <n>", "Per-cycle row cap — the volume brake on provider writes (required).")
-        .requiredOption("--max-credits <n>", "Managed-credit + external-quota cap per cycle (required).")
+        .requiredOption("--max-credits <n>", "OXYGEN credit ceiling per cycle. Provider/data-read fees count toward it; Workflow steps count after repricing takes effect. Provider billing and API quota are separate.")
         .option("--field-mappings-json <json>", "HubSpot custom-property mappings as a JSON array of {oxygen_field, provider_field, direction}. Omit to preserve the configured mappings.")
         .option("--approved", "Confirm enabling scheduled provider writes after inspecting a dry run.")
         .option("--no-run-now", "Do not run an immediate first cycle after enabling.")
@@ -6466,7 +6503,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("crm sync status", resolved, () => requestOxygen(buildCrmSyncConfigStatusPath(resolved)));
     }))
         .addCommand(new Command("links")
-        .description("Show provider record links (HubSpot/Attio ids) mapped to one Oxygen CRM record.")
+        .description("Show provider record links (HubSpot/Attio/Pipedrive ids) mapped to one Oxygen CRM record.")
         .argument("<object>", "Oxygen CRM object slug, such as companies or people.")
         .argument("<row_id>", "Oxygen CRM record row id.")
         .option("--json", "Print a JSON envelope.")
@@ -6705,6 +6742,61 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             return requestOxygen(`/api/cli/tables/sources${qs}`);
         });
     }))
+        .addCommand(new Command("records")
+        .description("Copy a Records object or saved view into a working Table, once or kept in sync. One-way: Records stay unchanged, the Table is keyed by record_id, cells edited in the Table are kept, and records that leave the source stay as rows with in_records=false.")
+        .addCommand(new Command("import")
+        .description("Create a Table from a Records object or saved view. --dry-run counts the records and lists the columns without creating anything. --refresh sync also arms a schedule (a Workflow you can pause) that repeats the copy. The copy costs 0 credits and calls no provider; each scheduled sync bills one workflow step (credits_per_scheduled_sync).")
+        .requiredOption("--object <slug>", "Records object slug, such as companies, people or deals (`crm objects`).")
+        .option("--view <id|name>", "Saved view on that object, by id or exact name (`tables views list <object table>`). Omit for every record.")
+        .option("--name <table>", "Name for the new Table. Defaults to the object and view name.")
+        .option("--project <project>", "Project id or slug. Defaults to General.")
+        .option("--refresh <once|sync>", "once (default) copies now; sync also keeps it in sync (needs --approved).")
+        .option("--every <cadence>", "With --refresh sync: hourly, every_6h, daily@<hour> or weekly@<day><hour> (UTC). Default daily@6.")
+        .option("--dry-run", "Preview without creating the Table.")
+        .option("--approved", "Approve the standing per-sync charge that --refresh sync arms.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("tables records import", options, () => requestOxygen("/api/cli/tables/records-import", {
+            method: "POST",
+            body: {
+                object: options.object,
+                ...(readOption(options.view) ? { view: readOption(options.view) } : {}),
+                ...(readOption(options.name) ? { name: readOption(options.name) } : {}),
+                ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
+                ...(readOption(options.refresh) ? { refresh: readOption(options.refresh) } : {}),
+                ...(readOption(options.every) ? { every: readOption(options.every) } : {}),
+                ...(options.dryRun ? { dry_run: true } : {}),
+                ...(options.approved ? { approved: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("sync")
+        .description("Copy a Records-imported Table's source again now: new records are added, changed cells updated, edited cells kept, and departed records marked in_records=false (they flip back if they return). Without --refresh the schedule stays as it is; --refresh sync --approved arms or retimes it, --refresh once removes it. preserved_cells counts copied-field cells left as someone edited them in the Table; columns you added are never touched and not counted. Running it now costs 0 credits; each scheduled sync bills one workflow step (credits_per_scheduled_sync in an import dry run).")
+        .argument("<table>", "Table id, slug or URL.")
+        .option("--refresh <once|sync>", "Omit to keep the schedule; sync (with --approved) arms or retimes it; once removes it.")
+        .option("--every <cadence>", "With --refresh sync: hourly, every_6h, daily@<hour> or weekly@<day><hour> (UTC). Default daily@6.")
+        .option("--dry-run", "Count what would change without writing.")
+        .option("--approved", "Approve the standing per-sync charge that --refresh sync arms.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables records sync", options, () => requestOxygen("/api/cli/tables/records-sync", {
+            method: "POST",
+            body: {
+                table,
+                ...(readOption(options.refresh) ? { refresh: readOption(options.refresh) } : {}),
+                ...(readOption(options.every) ? { every: readOption(options.every) } : {}),
+                ...(options.dryRun ? { dry_run: true } : {}),
+                ...(options.approved ? { approved: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("status")
+        .description("Show a Records-imported Table's source object and view, the last sync's counts and its schedule. Read-only, 0 credits.")
+        .argument("<table>", "Table id, slug or URL.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables records status", options, () => requestOxygen(`/api/cli/tables/records-sync?table=${encodeURIComponent(table)}`));
+    })))
         .addCommand(new Command("hubspot")
         .description("Import HubSpot contacts or companies into a new table or Records, optionally from a saved list and with do-not-contact suppression.")
         .addCommand(new Command("lists")
@@ -7004,7 +7096,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("delete-rows")
-        .description("Delete multiple workspace table rows. Leads enrolled in a campaign stay enrolled; the response names those campaigns.")
+        .description("Delete exact workspace row IDs. For a matching filtered selection, use tables rows remove-selection. Campaign enrollments stay enrolled; the response names those campaigns.")
+        .addHelpText("after", "\nFor a matching filtered selection, use tables rows remove-selection --help.")
         .argument("<table>", "Table id or slug.")
         .option("--row-ids-json <json>", "JSON array of workspace row UUIDs.")
         .option("--row-ids-file <path>", "File containing row UUIDs or rows with a _row_id column.")
@@ -7147,7 +7240,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--offset <n>", "Skip this many rows and start there — jump straight to a row without paging to it. Mutually exclusive with --cursor.")
         .option("--fields <columns>", "Comma-separated column keys or ids to include.")
         .option("--filter-json <json>", "Legacy filter object or array, e.g. '{\"column\":\"mobile_phone_e164\",\"op\":\"is_null\"}'. Mutually exclusive with --filter-tree-json/--sort-json.")
-        .option("--filter-tree-json <json>", "Airtable-style filter group, e.g. '{\"type\":\"group\",\"conjunction\":\"and\",\"children\":[{\"type\":\"leaf\",\"columnKey\":\"stage\",\"operator\":\"is\",\"value\":\"won\"}]}'. Add \"path\":\"a.b\" to a leaf to match a key inside a JSON cell, e.g. the rows one Function run touched: {\"columnKey\":\"<function_column>\",\"path\":\"action_run_id\",\"operator\":\"is\",\"value\":\"<run_id>\"}. Mutually exclusive with --filter-json.")
+        .option("--filter-tree-json <json>", `Airtable-style filter group, e.g. '{\"type\":\"group\",\"conjunction\":\"and\",\"children\":[{\"type\":\"leaf\",\"columnKey\":\"stage\",\"operator\":\"is\",\"value\":\"won\"}]}'. Add \"path\":\"a.b\" to a leaf to match a key inside a JSON cell, e.g. the rows one Function run touched: {\"columnKey\":\"<function_column>\",\"path\":\"action_run_id\",\"operator\":\"is\",\"value\":\"<run_id>\"}. Leaf operators: ${FILTER_TREE_OPERATORS.join(", ")} (is_true/is_false need a checkbox column; --filter-json's is_null/is_not_null are is_empty/is_not_empty here). Mutually exclusive with --filter-json.`)
         .option("--search <text>", "Find rows by one piece of text, matched against every text, number, date and checkbox column at once — the grid's magnifier. Combines with --filter-tree-json (both must hold). Use --filter-tree-json when you know which column to match.")
         .option("--formula-values <mode>", "Formula filters are refused by default because displayed formulas are evaluated live. Refresh the formula's stored cells with `columns run <table> <column> --force` (0 credits), then pass 'materialized'; filtering uses that stored snapshot and returns a freshness note.")
         .option("--sort-json <json>", "Ordered sort rules, e.g. '[{\"columnKey\":\"_created_at\",\"direction\":\"desc\"}]'. Earlier rules dominate. Mutually exclusive with --filter-json.")
@@ -7431,13 +7524,13 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }
     const followersCommand = tablesCommand.command("followers")
-        .description("Order a LinkedIn company page's followers as a table of leads — a competitor's audience. `check` is free and quotes the exact cost; `order` places it. The order is fulfilled by ScrapeLi, so the table is created immediately and its rows land later; there is no published delivery time.");
+        .description("Order a LinkedIn company page's followers as a table of leads — a competitor's audience. `check` is free and quotes the order; fee-positive own-key previews leave the follower count unknown. `order` places it. The order is fulfilled by ScrapeLi, so the table is created immediately and its rows land later; there is no published delivery time.");
     followersCommand.command("check")
-        .description("Free: read the page's follower count and quote the exact credits an order would reserve. No spend, no table; `orderable: false` means no order can be placed yet.")
+        .description("Free order preview. Managed quotes the follower cost; your own key quotes placement and later check fees, with a total ceiling you choose. No spend or table; `orderable: false` means the order is unavailable.")
         .requiredOption("--company <url>", "LinkedIn company page URL, e.g. https://www.linkedin.com/company/hubspot.")
         .option("--records <n>", "How many followers to price. Minimum 100; defaults to 1000.")
         .option("--package <package>", "Basic (default): profile, job title, location, employer. Advanced (10x the credits): also a verified work email and region.")
-        .option("--credential-mode <mode>", "managed (default): Oxygen credits. user_api_key: your own ScrapeLi key saved in Connections, billed by ScrapeLi.")
+        .option("--credential-mode <mode>", "managed (default): Oxygen credits. user_api_key: your saved ScrapeLi key, billed by ScrapeLi, plus Oxygen placement/recovery platform fees.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("tables followers check", options, () => requestOxygen("/api/cli/tables/linkedin-company-followers", {
@@ -7452,16 +7545,16 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     });
     followersCommand.command("order")
-        .description("Place the follower order after checking it. Requires --approved, and with managed credits --max-credits at or above the quoted cost: this buys a real audience and is never approved implicitly. Creates the table now; rows land when ScrapeLi delivers.")
+        .description("Place the follower order after checking it. Requires --approved and --max-credits: managed uses the quoted order cost; own-key uses a TOTAL placement/recovery platform-fee ceiling. A ceiling equal to placement cannot recover rows. Budget exhaustion lands no partial rows; refetched pages consume the same ceiling. Creates the Table now; rows arrive later.")
         .requiredOption("--approved", "Approve this purchase. Required, as on every command that buys data.")
         .requiredOption("--company <url>", "LinkedIn company page URL whose followers to order.")
-        .option("--max-credits <credits>", "Hard credit ceiling for this order. Must be at least the amount `tables followers check` quoted. Not needed with --credential-mode user_api_key.")
-        .requiredOption("--request-id <uuid>", "One stable UUID for this order. Reuse it after a timeout; a new key would buy the same audience twice.")
+        .option("--max-credits <credits>", "Approved order ceiling. On your key, TOTAL platform fees for placement and later checks; exhaustion stops recovery. At least the quoted placement fee. ScrapeLi charges separately.")
+        .requiredOption("--request-id <uuid>", "One stable UUID and identical order payload for retries. A new ID can buy the audience again.")
         .option("--records <n>", "How many followers to buy. Minimum 100; defaults to 1000.")
         .option("--package <package>", "Basic (default) or Advanced (10x the credits; adds a verified work email and region).")
         .option("--name <name>", "Table name. Defaults to \"<Company> Followers\".")
         .option("--project <project>", "Project id or slug; defaults to General.")
-        .option("--credential-mode <mode>", "managed (default): Oxygen credits. user_api_key: your own ScrapeLi key saved in Connections, billed by ScrapeLi.")
+        .option("--credential-mode <mode>", "managed (default): Oxygen credits. user_api_key: your saved ScrapeLi key, billed by ScrapeLi, plus Oxygen placement/recovery platform fees.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("tables followers order", options, () => requestOxygen("/api/cli/tables/linkedin-company-followers", {
@@ -7480,6 +7573,23 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             },
         }));
     });
+    followersCommand.command("status")
+        .description("Read a fee-budgeted own-key follower order's total fee ceiling, allocated attempts, recorded fees and recovery outcome by its original request ID, including interrupted setup. Optional --table-id verifies the saved Table binding. Recorded fees may settle later. Makes no provider call.")
+        .requiredOption("--request-id <uuid>", "Original order request ID.")
+        .option("--table-id <id>", "Optional saved Table ID; verifies the order belongs to that Table.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("tables followers status", options, () => {
+            const requestId = readOption(options.requestId);
+            if (!requestId)
+                throw new OxygenError("invalid_input", "--request-id must be the original nonblank order request ID.", { exitCode: 2 });
+            const query = new URLSearchParams({ request_id: requestId });
+            const tableId = readOption(options.tableId);
+            if (tableId)
+                query.set("table_id", tableId);
+            return requestOxygen(`/api/cli/tables/linkedin-company-followers?${query}`, { method: "GET" });
+        });
+    });
     tablesCommand.addCommand(new Command("relate")
         .description("Relate two tables: define empty Tables-owned relation columns on the source and target. Then use `oxygen tables link` to populate row-to-row edges. Works on any workspace table; plain tables stay plain and are never registered as CRM objects. Defaults to dry-run.")
         .argument("<table>", "Source table id or slug.")
@@ -8329,7 +8439,7 @@ Examples:
         .option("--body <text>", "Asset body text.")
         .option("--data-json <json>", "Flexible JSON object for structured asset data.")
         .option("--asset-json <json>", "Full asset JSON object. CLI flags override matching fields.")
-        .option("--default", "Pin as the canonical default for its type (auto-applied to copy generation). brand/voice/positioning defaults are injected into AI message columns.")
+        .option("--default", "Ask to pin as the canonical default for its type (auto-applied to copy generation). For brand, voice, positioning and playbooks the asset saves unpinned and the pin waits for approval of a proposal (pin.ok false; oxygen knowledge proposals approve <id>); other types pin at once.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("context asset upsert", options, () => requestOxygen("/api/cli/context/assets/upsert", {
@@ -8338,7 +8448,7 @@ Examples:
         }));
     }))
         .addCommand(new Command("set-default")
-        .description("Pin a context asset as the canonical default for its type. The canonical brand/voice/positioning docs are auto-applied to AI copy generation.")
+        .description("Pin a context asset as the canonical default for its type. The canonical brand/voice/positioning docs are auto-applied to AI copy generation. For brand, voice, positioning and playbooks a pin or unpin files a proposal a human approves (oxygen knowledge proposals approve <id>) and fails with knowledge_approval_required; other types pin at once.")
         .argument("<asset_id>", "Context asset UUID.")
         .option("--off", "Unpin instead of pin (clears the canonical default for this type).")
         .option("--json", "Print a JSON envelope.")
@@ -8349,7 +8459,7 @@ Examples:
         }));
     }))
         .addCommand(new Command("archive")
-        .description("Archive a context asset.")
+        .description("Archive a context asset. Archiving the canonical brand, voice, positioning or playbook files an approval proposal and fails with knowledge_approval_required.")
         .argument("<asset_id>", "Context asset UUID.")
         .option("--json", "Print a JSON envelope.")
         .action(async (assetId, options) => {
@@ -8371,7 +8481,7 @@ Examples:
         .option("--live", "Authorize this manual run to spend and write. Requires --max-credits. Without it the command previews and nothing is billed.")
         .option("--approved", "Same as --live. Accepted because the global help footer names --approved as the way to authorize a credit-spending command.")
         .option("--max-credits <credits>", `Hard credit ceiling for the whole pass. Required with --live, and clamped server-side to ${KNOWLEDGE_BOOTSTRAP_MAX_CREDITS}.`)
-        .option("--force", "Clear an existing once-ever marker first and re-arm the pass. This is the one deliberate way to research the same workspace twice — pair it with --live to actually spend again.")
+        .option("--force", "Re-arm past an existing once-ever marker, the one deliberate way to research the same workspace twice. Without --live it only previews the re-arm for free: nothing is cleared or written. With --live it replaces the marker with a new pass and spends again.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("knowledge bootstrap", options, () => requestOxygen("/api/cli/knowledge/bootstrap", {
@@ -8442,14 +8552,14 @@ Examples:
         .addCommand(new Command("page")
         .description("Knowledge wiki pages (slug-addressed, revision-guarded).")
         .addCommand(new Command("upsert")
-        .description("Create or update a knowledge wiki page.")
-        .option("--slug <slug>", "Stable page slug to create or address. Omit to create by title.")
-        .option("--folder <folder_id>", "Folder UUID, or root to remove folder placement. Omit to preserve the current folder.")
+        .description("Create or update a knowledge wiki page. Free internal write; canonical edits require proposal approval.")
+        .option("--slug <slug>", "Stable page key. Omit to derive from title; an existing slug updates unless --create-only is set.")
+        .option("--folder <folder_id>", "Folder UUID, or root to clear placement; omit to preserve. Moving creates a revision and changes data.knowledge_folder_id.")
         .option("--create-only", "Fail if the page already exists instead of updating it.")
-        .option("--id <page_id>", "Existing page UUID to update. Omit to create.")
-        .option("--type <type>", "Page type (positioning, competitor, research_note, playbook, strategy, other). Defaults to other on create.")
+        .option("--id <page_id>", "Existing page UUID to update. For a new file, omit and use --create-only.")
+        .option("--type <type>", `Page type: ${KNOWLEDGE_PAGE_TYPES.join(", ")}. voice, brand and positioning are canonical copy once pinned. Defaults to other on create.`)
         .option("--title <title>", "Page title. Required on create.")
-        .option("--status <status>", "draft, active, or archived.")
+        .option("--status <status>", "draft, active, or archived. Restore with draft and --expected-revision; omit --body to retain content.")
         .option("--tags <csv>", "Comma-separated page tags.")
         .option("--summary <text>", "Short page summary.")
         .option("--body <text>", "Page body (Markdown, supports [[wikilinks]]).")
@@ -8468,7 +8578,7 @@ Examples:
         });
     }))
         .addCommand(addContractFlags(new Command("get")
-        .description("Read one knowledge wiki page by slug or UUID. Read-only, 0 credits.")
+        .description("Read one knowledge wiki page by slug or UUID. Use --view sources for its evidence ledger or --view full for content, links and sources. Read-only, 0 credits.")
         .argument("<slug_or_id>", "Page slug or UUID.")
         .option("--json", "Print a JSON envelope."), knowledgePageReadContract, { slug: { omit: true }, id: { omit: true } })
         .action(async (slugOrId, options) => {
@@ -8488,14 +8598,22 @@ Examples:
         }));
     }))
         .addCommand(new Command("archive")
-        .description("Archive a knowledge wiki page.")
+        .description("Archive a knowledge wiki page while retaining its content and history. Links become unresolved. Restore with page upsert --status draft and the current --expected-revision.")
         .argument("<slug_or_id>", "Page slug or UUID.")
+        .option("--expected-revision <n>", "Fail if the current page revision differs from the version you reviewed.")
         .option("--json", "Print a JSON envelope.")
         .action(async (slugOrId, options) => {
         await handleAsyncAction("knowledge page archive", options, async () => {
+            const expectedRevision = readPositiveInt(options.expectedRevision);
+            if (options.expectedRevision !== undefined && (expectedRevision === undefined || !Number.isSafeInteger(expectedRevision))) {
+                throw new OxygenError("invalid_request", "--expected-revision must be a positive integer.", { exitCode: 2 });
+            }
             const data = await requestOxygen("/api/cli/knowledge/pages/archive", {
                 method: "POST",
-                body: knowledgePageRefBody(slugOrId),
+                body: {
+                    ...knowledgePageRefBody(slugOrId),
+                    ...(expectedRevision !== undefined ? { expected_revision: expectedRevision } : {}),
+                },
             });
             await markKnowledgeMirrorStaleAfterWrite();
             return data;
@@ -8565,7 +8683,7 @@ Examples:
         .description("Search wiki pages by meaning and keywords. Read-only, 0 credits. Plain language uses hybrid retrieval when available; check match_type and semantic_status. Quotes, OR, and exclusions stay lexical. If the platform-funded embedding allowance is unavailable, keyword search still works.")
         .argument("<query>", "Search text. Supports quoted phrases, OR, and -exclude.")
         .option("--type <type>", "Filter by page type.")
-        .option("--status <status>", "Filter by draft, active, or archived.")
+        .option("--status <status>", "Filter by draft, active, or archived. Omitted, archived pages are excluded.")
         .option("--tags <csv>", "Comma-separated tags that must be present.")
         .option("--limit <n>", "Maximum pages to return.")
         .option("--json", "Print a JSON envelope.")
@@ -8737,13 +8855,14 @@ Examples:
     }))
         .addCommand(knowledgeBootstrapCommand)
         .addCommand(new Command("synthesize")
-        .description("Synthesize knowledge from workspace evidence (one low-cost AI call, priced as one low-reasoning AI column cell): campaign learnings from auto-filed outreach outcomes, or your writing voice (a voice guide) learned from your sent LinkedIn and WhatsApp messages. Every run spends credits, the preview included, unless fewer than 3 sent messages exist (insufficient_source_messages, nothing charged); without --approved nothing is saved. To keep the guide a preview showed, pass its body back with --approved --body (no new AI call); --approved alone synthesizes and charges again. A pinned voice guide is the canonical voice at once and grounds message, reply, sequence and post drafts and AI columns.")
+        .description("Synthesize knowledge from workspace evidence (one low-cost AI call, priced as one low-reasoning AI column cell): campaign learnings from auto-filed outreach outcomes, or your writing voice (a voice guide) learned from your sent LinkedIn and WhatsApp messages. Every run spends credits, the preview included, unless fewer than 3 sent messages exist (insufficient_source_messages, nothing charged); without --approved nothing is saved. To keep the guide a preview showed, pass its body back with --approved --body (no new AI call); --approved alone synthesizes and charges again. A saved voice guide becomes the canonical voice once a human approves its pin proposal (oxygen knowledge proposals approve <id>); it then grounds message, reply, sequence and post drafts and AI columns.")
         .option("--kind <kind>", "What to synthesize: campaign_learnings (default) or voice (your writing voice from sent LinkedIn and WhatsApp messages).", "campaign_learnings")
         .option("--sequence <sequence_id>", "Scope campaign learnings to one sequence's learnings page. Omit for the org-wide [[outreach-learnings]] page.")
-        .option("--approved", "Write the synthesized result (learnings page revision / pinned voice guide) instead of previewing.")
-        .option("--body <markdown>", "With --approved: save this body verbatim (the guide a preview showed, or your edit) with no new AI call.")
+        .option("--approved", "Write the synthesized result (learnings page revision / voice guide saved with a pin proposal) instead of previewing.")
+        .option("--body <markdown>", "With --approved: save this body verbatim (the guide a preview showed, or your edit) with no new AI call, at 0 credits.")
         .option("--title <title>", "Optional title for a newly created page/asset.")
         .option("--limit <n>", "Voice only: how many recent sent messages to learn from (max 200).")
+        .option("--max-credits <n>", "Hard cap OXYGEN enforces on this call: it is charged exactly its estimate, so never more than n. A higher estimate is refused before any AI call, with nothing charged, and the refusal reports the estimate (--max-credits 0 shows it for free). --approved --body makes no AI call and needs none.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("knowledge synthesize", options, () => requestOxygen("/api/cli/knowledge/synthesize", {
@@ -8755,6 +8874,7 @@ Examples:
                 ...(readOption(options.body) ? { body: readOption(options.body) } : {}),
                 ...(readOption(options.title) ? { title: readOption(options.title) } : {}),
                 ...(readPositiveInt(options.limit) !== undefined ? { limit: readPositiveInt(options.limit) } : {}),
+                ...(readNonNegativeNumber(options.maxCredits) !== undefined ? { max_credits: readNonNegativeNumber(options.maxCredits) } : {}),
             },
         }));
     }))
@@ -9715,8 +9835,8 @@ Examples:
         .option("--reasoning-level <level>", REASONING_LEVEL_OPTION_HELP)
         .option("--run-condition <formula>", "Formula expression gating whether the AI column runs per row. A formula over bare column keys (eu_israel = true), not {{tokens}}.")
         .option("--run-condition-columns <csv>", "Comma-separated column keys referenced by --run-condition.")
-        .option("--no-structured-output", "Keep an AI column answering in plain text even when its prompt names output sections. Use this for copy — an email body is one answer, not a set of fields.")
         .option("--structured-output", "Undo --no-structured-output: let the prompt's named sections shape the answer again.")
+        .option("--no-structured-output", "Keep an AI column answering in plain text even when its prompt names output sections. Use this for copy — an email body is one answer, not a set of fields.")
         .option("--output-schema-json <json>", "AI column output JSON schema as inline JSON.")
         .option("--output-schema-file <path>", "AI column output JSON schema read from a file path.")
         .addOption(new Option("--classify <labels>", "Classification column: label every row with one of these comma-separated labels (2-20), answering --prompt. Each cell holds the label, a 0-1 confidence and uncertain:true below --min-confidence (the best guess is kept). Flat ~0.075 credits/row; see `columns run --dry-run`."))
@@ -10161,8 +10281,10 @@ Examples:
         .option("--reasoning-level <level>", REASONING_LEVEL_OPTION_HELP)
         .option("--run-condition <formula>", "Formula expression gating whether the AI column runs per row. A formula over bare column keys (eu_israel = true), not {{tokens}}.")
         .option("--run-condition-columns <csv>", "Comma-separated column keys referenced by --run-condition.")
+        // Positive first keeps omission undefined; negative first defaults true
+        // and silently overwrites a saved prose choice on an unrelated update.
+        .option("--structured-output", "Restore the prompt's named JSON fields. Existing AI columns must store jsonb; for a text column, add a new AI column with --data-type jsonb.")
         .option("--no-structured-output", "Keep an AI column answering in plain text even when its prompt names output sections. Use this for copy — an email body is one answer, not a set of fields.")
-        .option("--structured-output", "Undo --no-structured-output: let the prompt's named sections shape the answer again.")
         .option("--output-schema-json <json>", "AI column output JSON schema as inline JSON.")
         .option("--output-schema-file <path>", "AI column output JSON schema read from a file path.")
         .option("--research-query <template>", "Research columns: replace the per-row web search query template, e.g. \"{{company_name}} pricing page\".")
@@ -10189,7 +10311,8 @@ Examples:
                 readOption(options.reasoningLevel) ||
                 readOption(options.runCondition) ||
                 readOption(options.outputSchemaJson) ||
-                readOption(options.outputSchemaFile);
+                readOption(options.outputSchemaFile) ||
+                typeof options.structuredOutput === "boolean";
             let definition = options.definitionJson
                 ? parseJsonObject(options.definitionJson)
                 : undefined;
@@ -10951,9 +11074,10 @@ Examples:
         await handleAsyncAction("companies search filters", options, () => requestOxygen(`/api/cli/companies/search/preview${readCompanySourceQuery(options.source)}`));
     }))
         .addCommand(new Command("preview")
-        .description("Preview up to 50 rows free, using native filters from companies search filters. --source google_maps previews 20 businesses with a q business-and-area filter; total_results is unavailable when the API publishes no total. --source hiring previews matching job postings with an exact total.")
+        .description("Preview up to 50 rows free, using native filters from companies search filters. --source google_maps previews 20 businesses with a q business-and-area filter; total_results is unavailable when the API publishes no total. --source hiring previews matching job postings with an exact total. Totals, notes and the priced next step come first and the rows last; each row is compact (name, domain, LinkedIn, headcount, industry, location, a one-line description) unless --view full.")
         .requiredOption("--filters-json <json-or-file>", 'Native filters as JSON or @file/path. Google Maps requires q, placeId or cid; other sources accept {} for all results.')
         .option("--source <source>", "company_search (default), hiring or google_maps. Filters for hiring nest under job and company, e.g. {\"job\":{\"title\":{\"include\":[\"Account Executive\"]}}}.")
+        .option("--view <view>", "compact (default) or full: full adds each row's provider record as raw_source, about 2.5 KB a company.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("companies search preview", options, () => requestOxygen("/api/cli/companies/search/preview", {
@@ -10961,6 +11085,7 @@ Examples:
             body: {
                 filters: parseJsonObject(readFileIfPresent(options.filtersJson)),
                 ...(readCompanySearchSource(options.source) !== "company_search" ? { source: readCompanySearchSource(options.source) } : {}),
+                ...(options.view !== undefined ? { view: options.view } : {}),
             },
         }));
     }))
@@ -11082,7 +11207,7 @@ Examples:
         await handleAsyncAction("people search filters", options, () => requestOxygen("/api/cli/people/search/preview"));
     }))
         .addCommand(new Command("preview")
-        .description("Preview up to 50 people free, using native filters from people search filters. For the companies in one of your tables, pass --from-table with --linkedin-url-column; for a few named companies, put their LinkedIn company URLs in company.linkedin_url. Then people search run --source people_search --source-filters-json <same filters> for a quoted, approved table fill; people search run --from-table instead runs one paid search per company in a table and covers each one.")
+        .description("Preview up to 50 people free, using native filters from people search filters. For the companies in one of your tables, pass --from-table with --linkedin-url-column; for a few named companies, put their LinkedIn company URLs in company.linkedin_url. Totals, per-company counts, company_fit (what a person row cannot tell you about fit) and the priced next step come first, the rows last. Then people search run --source people_search --source-filters-json <same filters> for a quoted, approved table fill; people search run --from-table instead runs one paid search per company in a table and covers each one.")
         .requiredOption("--filters-json <json-or-file>", 'Nested native filters as JSON or @file/path, e.g. {"people":{"job_title":{"include":["VP Sales"]}},"company":{"linkedin_url":["https://linkedin.com/company/acme"]}}; {} searches all.')
         .option("--from-table <table>", "Free sample of Find decision makers at companies: search the first 50 companies in this table in one free page. Pair with --linkedin-url-column.")
         .option("--linkedin-url-column <key>", "Column of --from-table that holds each company's LinkedIn URL.")
@@ -11269,49 +11394,32 @@ Examples:
     }))
         .addCommand(new Command("provider")
         .description("Per-provider call-rate overrides and BYOK daily warning thresholds. With no subcommand, lists policies (same as `limits provider list`).")
-        .addCommand(new Command("list")
-        .description("List enforced provider overrides and the plan-tier BYOK daily threshold with its enforcement mode.")
-        .option("--provider <provider>", "Filter saved overrides to one provider id; plan-tier defaults are always returned.")
+        .addCommand(addProviderLimitFlags(new Command("list")
+        .description("List enforced provider overrides and the plan-tier BYOK daily threshold with its enforcement mode."), "list")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        const query = new URLSearchParams();
-        if (readOption(options.provider))
-            query.set("provider", readOption(options.provider) ?? "");
-        const suffix = query.toString();
+        const suffix = providerLimitQuery(options, "list");
         await handleAsyncAction("limits provider list", options, () => requestOxygen(`/api/cli/limits/provider${suffix ? `?${suffix}` : ""}`));
     }), { isDefault: true })
-        .addCommand(new Command("set")
-        .description("Set an enforced per-provider call ceiling. Use --window-seconds 86400 for an explicit daily policy.")
-        .requiredOption("--provider <provider>", "Provider id (e.g. hubspot, leadmagic).")
-        .requiredOption("--limit <n>", "Calls allowed per window.")
-        .requiredOption("--window-seconds <n>", "Window size in seconds (86400 = one day).")
-        .option("--operation <operation>", "Scope to one operation; omitted = provider-wide.")
+        .addCommand(addProviderLimitFlags(new Command("set")
+        .description("Set an enforced provider request limit; admin/owner only. Approve the exact provider, operation and window before running; execution saves the policy. Raising a cap can permit more use. 0 credits."), "set")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("limits provider set", options, () => requestOxygen("/api/cli/limits/provider", {
             method: "POST",
-            body: {
-                provider: options.provider,
-                limit: Number(options.limit),
-                window_seconds: Number(options.windowSeconds),
-                ...(options.operation ? { operation: options.operation } : {}),
-            },
+            body: providerLimitBody(options),
         }));
     }))
-        .addCommand(new Command("delete")
-        .description("Remove a per-provider override (falls back to the plan-tier default).")
-        .requiredOption("--provider <provider>", "Provider id.")
-        .option("--operation <operation>", "Operation scope; omitted targets the provider-wide row.")
+        .addCommand(addProviderLimitFlags(new Command("delete")
+        .description("Remove one provider override; admin/owner only. Approve its selector before running; execution deletes the policy. Other overrides remain; BYOK defaults may be observe-only. 0 credits."), "delete")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        const query = new URLSearchParams({ provider: options.provider });
-        if (options.operation)
-            query.set("operation", options.operation);
+        const query = providerLimitQuery(options, "delete");
         await handleAsyncAction("limits provider delete", options, () => requestOxygen(`/api/cli/limits/provider?${query.toString()}`, { method: "DELETE" }));
     })));
     program
         .command("billing")
-        .description("Plan and managed credit commands. Spend splits into FLEXIBLE (ad-hoc: enrichment, AI, automation — drawn from your free-to-spend balance) and FIXED recurring per-resource monthly commitments blocked out of it; see `billing commitments`. THREE CLOCKS, deliberately different: the CREDIT CYCLE that `billing allowance` reports against (your plan's monthly grant window); each resource's own COMMITMENT RENEWAL, anchored to the day you connected it, so `billing commitments --json` next_due_at rarely matches the cycle end; and your SUBSCRIPTION PERIOD in `billing balance` (annual plans span many credit cycles). A number from one clock will not reconcile against another. On a plan that pays for several workspaces, `billing usage --group-by workspace` totals what each one spent. To price a month of outreach before building it (leads, enrichment, sequence steps, senders), run `billing estimate`. Failed-payment grace, suspension, and recovery: https://oxygen-agent.com/docs/safety/billing.")
+        .description("Plan and managed credit commands. Credits reserved but not yet charged are listed hold by hold with `billing usage --meter holds`. Spend splits into FLEXIBLE (ad-hoc: enrichment, AI, automation — drawn from your free-to-spend balance) and FIXED recurring per-resource monthly commitments blocked out of it; see `billing commitments`. THREE CLOCKS, deliberately different: the CREDIT CYCLE that `billing allowance` reports against (your plan's monthly grant window); each resource's own COMMITMENT RENEWAL, anchored to the day you connected it, so `billing commitments --json` next_due_at rarely matches the cycle end; and your SUBSCRIPTION PERIOD in `billing balance` (annual plans span many credit cycles). A number from one clock will not reconcile against another. On a plan that pays for several workspaces, `billing usage --group-by workspace` totals what each one spent. To price a month of outreach before building it (leads, enrichment, sequence steps, senders), run `billing estimate`. Failed-payment grace, suspension, and recovery: https://oxygen-agent.com/docs/safety/billing.")
         .addCommand(new Command("change")
         .description("Create an approval link (`approval_url`) to start or change a plan; nothing changes until an organization admin confirms. Compare all six prices, credits and yearly terms with `billing balance` first. Use --interval month --term year for twelve discounted monthly payments, renewing for another year: the $99 plan costs $82.50 per month before tax, not $990 upfront. Credits arrive monthly after successful payment. On a workspace that has never had a plan, the Checkout for any monthly plan from $99 up carries the first-month offer, half its first month, while its 24-hour window is open (`offer`; `billing balance` lists every size under `first_month_offer.plans`): `amount_due_now` is then the discounted first month and `next_invoice_total` the regular price, both before tax. Creating that Checkout starts the window if nothing has started it yet. Upgrades during an annual commitment apply immediately with proration and keep its end date; downgrades and switching to a monthly commitment wait for the term end. Switching from a monthly commitment to yearly starts at the next monthly boundary. Existing prepaid yearly plans keep their cadence unless a new term is selected; transitions wait until their paid period ends. Omit interval and term to preserve the current contract. For an existing subscription, a yearly preview returns charges, start and term-end dates; nothing changes until separate confirmation.")
         .requiredOption("--to <plan>", 
@@ -11345,16 +11453,17 @@ Examples:
         }));
     }))
         .addCommand(new Command("balance")
-        .description("Compare all six subscription sizes in `available_plans`: monthly prices, yearly paid-monthly prices, credit allowances and savings. `annual_monthly_billing_available` says whether yearly paid monthly is offered; `annual_monthly_terms` explains the 12-month commitment, annual renewal, remaining payments after cancellation and plan-change timing. `first_month_offer` is the first-month offer this workspace can still claim: every size it applies to (`plans`, from `minimum_plan` up) with its first-month and regular price before tax, and `ends_at`, null until its 24-hour window starts. The window starts the first time the workspace meets the offer: the app showing it, signup from a browser that saw it on the website, or creating its Checkout with `billing change`. Also show the current plan, commitment, subscription entitlement, and managed credit balance: available and reserved credits, FIXED credits committed to recurring per-resource charges, and the FLEXIBLE free-to-spend remainder. `next_renewal` answers \"will I be charged?\": read `will_charge` first — true only when this workspace's own Stripe plan is going to charge its card, in which case `charge_at` and the subscription's recurring amount in money say when and roughly how much (the exact amount, with any promotion code or tax, is on the invoice); `period_ends_at` is the trial or period end either way, `cancellation_scheduled` says whether a cancellation is already set, and `stop_command` names the one command that changes it (`billing cancel`, undone by `billing resume`) or is null when nothing here can stop it (staff-invoiced, billed through another workspace, not active). `billing_interval` is payment cadence; `commitment` distinguishes yearly paid monthly from monthly and legacy prepaid yearly plans. Credits are granted monthly; `next_credit_grant_at` is the next grant. For a yearly commitment, cancellation stops annual renewal but remaining monthly payments continue until commitment.ends_at. `renewals_past_due` lists infrastructure renewals (managed-inbox domains, warm-ups) OXYGEN could NOT charge this month, what they cost, and the exact top-up that clears them — nothing is cancelled and billing retries automatically after a top-up. `warnings` also flags a recurring_shortfall when your connected infrastructure costs more per month than the plan grants. `partner_bonus` says whether this workspace earns the agency partner bonus (+15% credits a month for a published directory partner on $99 or above), how many credits, and why not when it does not; the bonus arrives as its own ledger line (`billing usage --category partner_bonus`), never inside plan.monthly_credits. A workspace linked to another organization (`orgs billing-link`) reads its billing at that owner: the balance is the owner's pool, `shared_billing` is true and `billing_owner_organization_id` names the owner. After failed-payment grace expires, mutations stop while read/export and billing recovery remain available. Recovery: https://oxygen-agent.com/billing. Policy: https://oxygen-agent.com/docs/safety/billing.")
+        .description("Compare all six subscription sizes in `available_plans`: monthly prices, yearly paid-monthly prices, credit allowances and savings. `annual_monthly_billing_available` says whether yearly paid monthly is offered; `annual_monthly_terms` explains the 12-month commitment, annual renewal, remaining payments after cancellation and plan-change timing. `first_month_offer` is the first-month offer this workspace can still claim: every size it applies to (`plans`, from `minimum_plan` up) with its first-month and regular price before tax, and `ends_at`, null until its 24-hour window starts. The window starts the first time the workspace meets the offer: the app showing it, signup from a browser that saw it on the website, or creating its Checkout with `billing change`. Also show the current plan, commitment, subscription entitlement, and managed credit balance: available and reserved credits, FIXED credits committed to recurring per-resource charges, and the FLEXIBLE free-to-spend remainder. `next_renewal` answers \"will I be charged?\": read `will_charge` first — true only when this workspace's own Stripe plan is going to charge its card, in which case `charge_at` and the subscription's recurring amount in money say when and roughly how much (the exact amount, with any promotion code or tax, is on the invoice); `period_ends_at` is the trial or period end either way, `cancellation_scheduled` says whether a cancellation is already set, and `stop_command` names the one command that changes it (`billing cancel`, undone by `billing resume`) or is null when nothing here can stop it (staff-invoiced, billed through another workspace, not active). `billing_interval` is payment cadence; `commitment` distinguishes yearly paid monthly from monthly and legacy prepaid yearly plans. Credits are granted monthly; `next_credit_grant_at` is the next grant. For a yearly commitment, cancellation stops annual renewal but remaining monthly payments continue until commitment.ends_at. `renewals_past_due` lists infrastructure renewals (managed-inbox domains, warm-ups) OXYGEN could NOT charge this month, what they cost, and the exact top-up that clears them — nothing is cancelled and billing retries automatically after a top-up. `warnings` also flags a recurring_shortfall when your connected infrastructure costs more per month than the plan grants. `partner_bonus` says whether this workspace earns the agency partner bonus (+15% credits a month for a published directory partner on $99 or above), how many credits, and why not when it does not; the bonus arrives as its own ledger line (`billing usage --category partner_bonus`), never inside plan.monthly_credits. A workspace linked to another organization (`orgs billing-link`) reads its billing at that owner: the balance is the owner's pool, `shared_billing` is true and `billing_owner_organization_id` names the owner. After failed-payment grace expires, mutations stop while read/export and billing recovery remain available. Recovery: https://oxygen-agent.com/billing. Policy: https://oxygen-agent.com/docs/safety/billing. 0 credits; reserves nothing. Due plan grants or credit expiry may apply.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing balance", options, () => requestOxygen("/api/cli/billing/balance"));
     }))
         .addCommand(new Command("commitments")
-        .description("List the fixed monthly credit commitments blocked at your subscription renewal — per connected sending mailbox, OXYGEN-sold mailbox, warm-up, deliverability, connected LinkedIn, WhatsApp and X account, and rented phone number — with unit price, quantity, and next-due date. When your balance cannot cover an account's renewal, sending from that account pauses at once and it disconnects 7 days later (a phone number is released after 30): paused_quantity, past_due_since, disconnects_at and topup_url say which kind, since when and by when to top up; a top-up resumes it within minutes. This is the FORWARD run-rate: what your currently-connected resources will cost at their next renewal. It is NOT this cycle's charges — compare `billing allowance` fixed_spent_credits for that, and expect the two to differ. Each resource renews on its OWN anchor (the day it was connected), so next_due_at is per-resource and rarely lines up with the credit cycle. The top-level count is the number of individual resource rows; the commitments list groups them by kind. A past next_due_at is an unpaid renewal still due. To stop all infrastructure renewals while retaining records, preview `workspace infrastructure-exit`; plan cancellation alone does not stop these resources. Read-only, 0 Oxygen credits.")
+        .description("List recurring commitments, or inspect monthly connection prices and first-debit timing with --view connection-prices without creating authorization. Default: list the fixed monthly credit commitments — per connected sending mailbox, OXYGEN-sold mailbox, warm-up, deliverability, connected LinkedIn, WhatsApp and X account, and rented phone number — with unit price, quantity, and next-due date. When your balance cannot cover an account's renewal, sending from that account pauses at once and it disconnects 7 days later (a phone number is released after 30): paused_quantity, past_due_since, disconnects_at and topup_url say which kind, since when and by when to top up; a top-up resumes it within minutes. This is the FORWARD run-rate: what your currently-connected resources will cost at their next renewal. It is NOT this cycle's charges — compare `billing allowance` fixed_spent_credits for that, and expect the two to differ. Each resource renews on its OWN anchor (the day it was connected), so next_due_at is per-resource and rarely lines up with the credit cycle. The top-level count is the number of individual resource rows; the commitments list groups them by kind. A past next_due_at is an unpaid renewal still due. To stop all infrastructure renewals while retaining records, preview `workspace infrastructure-exit`; plan cancellation alone does not stop these resources. Read-only, 0 Oxygen credits.")
+        .addOption(new Option("--view <view>", "Inspect connection-prices before authorizing a new account, or current commitments (default).").choices(["commitments", "connection-prices"]))
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("billing commitments", options, () => requestOxygen("/api/cli/billing/commitments"));
+        await handleAsyncAction("billing commitments", options, () => requestOxygen(`/api/cli/billing/commitments${options.view ? `?view=${encodeURIComponent(options.view)}` : ""}`));
     }))
         .addCommand(new Command("estimate")
         .description("Estimate what a month of outreach costs before you build it: leads × enrichment × sequence steps × senders. Returns one line per cost (enrichment credits expected and worst case, each mailbox and LinkedIn account at its monthly price, sends at 0 credits), `totals`, `plan_fit` (does your plan cover it, and the top-up if not), `recommended_plan` (the cheapest plan plus top-ups that covers it) and `limits` (emails per mailbox, LinkedIn invites and messages per account; `limits_hit` names each one the scenario exceeds and `senders_needed` how many senders it takes). Steps are counted per channel: a 3-step sequence of two emails and one LinkedIn invite is `--email-steps 2 --linkedin-steps 1`, and `summary` restates what was priced. `monthly_usd` is all in: plan, top-ups and dollar seats. Prices are the ones in force; `sender_billing` says whether senders are paid as dollar seats or monthly credit reservations. Example: `oxygen billing estimate --leads 500 --enrich work_email --email-steps 2 --linkedin-steps 1 --mailboxes 1 --linkedin-accounts 1 --json`. `web_url` opens the same estimate in Settings → Plan limits. Read-only, 0 Oxygen credits.")
@@ -11383,13 +11492,13 @@ Examples:
         }));
     }))
         .addCommand(new Command("seats")
-        .description("Show sending capacity per channel: how many seats are purchased, how many are grandfathered, how many senders are connected, and how many are left. Sending seats are what let you CONNECT a sender — a LinkedIn account, WhatsApp number, phone number, or email mailbox — and they are billed in dollars on their own subscription, separate from your plan and separate from credits. You do not need a plan to buy seats. Seats belong to the billing owner: a workspace linked to another organization's plan with `orgs billing-link` connects senders against that organization's seats and buys them there. A grandfathered value of null means unlimited for that channel. Email mailbox allocation is read from this workspace's own database; when it cannot be read, the email seat's allocated/available/can_connect read null and `email_sender_allocation` is `tenant_unavailable`. When seats are retired because connected accounts reserve credits instead, the envelope says `status: seats_retired` with a `next_step`; seats already held keep covering their accounts until they end at renewal (`held_seats_end_at`), and from then on each of those accounts reserves credits instead, never both (`after_seats_end` on each channel gives the monthly reservation). Read-only, 0 Oxygen credits.")
+        .description("Show sending seats, current billing-period end and next-connection eligibility (null: unknown, with a reason). Includes purchased, grandfathered (null: unlimited), connected and left per channel. Seats belong to the billing owner. Email mailbox allocation is workspace-scoped; unreadable mailbox data leaves allocated/available/can_connect null. When retired, held_seats_end_at_reason and held_seats_end_at_message distinguish no paying subscription from an unknown end date; after_seats_end gives monthly credit prices (null: unconfirmed). connect_eligibility explains a single new connection's credit affordability, sponsorship and attachment capacity; paying-seat coverage may remain unknown. Existing accounts and reconnects differ. Charges 0 credits and creates no reservation; like billing balance, it may apply a due plan grant or already-due sponsored-credit expiry.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing seats", options, () => requestOxygen("/api/cli/billing/seats"));
     })
         .addCommand(new Command("set")
-        .description("Set how many sending seats of one channel this workspace holds. The quantity is ABSOLUTE, not a delta: `--quantity 3` means you end up with three, so a retried command cannot buy extra. Increasing charges the card pro rata immediately; decreasing credits you pro rata. Reducing below the number of senders you have connected is REFUSED and names how many to disconnect first, because an orphaned sender is one you keep paying a provider for while Oxygen has stopped honouring it. An email_sender reduction is refused with `seat_allocation_unavailable` (503) while the workspace's mailbox count cannot be read; retry it in a moment. Once seats are retired, any increase is refused with `seats_retired` and lowering held seats still works. Charges real money.")
+        .description("Manage legacy dollar sending seats for one channel; check `billing seats` for retirement status. The quantity is ABSOLUTE, not a delta: `--quantity 3` means you end up with three, so a retried command cannot buy extra. Increasing charges the card pro rata immediately; decreasing credits you pro rata. Reducing below the number of senders you have connected is REFUSED and names how many to disconnect first, because an orphaned sender is one you keep paying a provider for while Oxygen has stopped honouring it. An email_sender reduction is refused with `seat_allocation_unavailable` (503) while the workspace's mailbox count cannot be read; retry it in a moment. Once seats are retired, any increase is refused with `seats_retired` and lowering held seats still works. Charges real money.")
         .requiredOption("--seat-key <kind>", "linkedin, whatsapp, phone_number, or email_sender.")
         .requiredOption("--quantity <n>", "Total seats to hold for this channel, 0 or more.")
         .option("--json", "Print a JSON envelope.")
@@ -11409,14 +11518,14 @@ Examples:
         await handleAsyncAction("billing invoices", options, () => requestOxygen("/api/cli/billing/invoices"));
     }))
         .addCommand(new Command("allowance")
-        .description("Show this billing cycle's credit pool as one breakdown: fixed spend, flexible spend, credits committed to the next renewal, and what is free to spend — the numbers behind the bar on the credit-usage page. The parts always sum to the total, with ONE deliberate exception: `renewals_past_due` (and its region=past_due segment) reports renewals that FAILED to charge, which is money not taken and therefore outside total_credits. fixed_spent_credits is what has ALREADY been charged this cycle, NOT your monthly run-rate — for the forward figure billed at the next renewal see `billing commitments`, which is normally much larger. For organization wallet scope, reserved_credits is in-flight spend already removed from the available balance: do not subtract it again from free_to_spend_credits. Reserved credits can exceed the remaining free balance without implying an overdraft. For workspace_cap scope, free_to_spend_credits is remaining allowance, not the billing owner's wallet; live execution still checks that wallet and spend policies. Every segment carries region=fixed|flexible. Read-only, 0 Oxygen credits.")
+        .description("Show this billing cycle's credit pool as one breakdown: fixed spend, flexible spend, credits committed to the next renewal, and what is free to spend — the numbers behind the bar on the credit-usage page. The parts always sum to the total, with ONE deliberate exception: `renewals_past_due` (and its region=past_due segment) reports renewals that FAILED to charge, which is money not taken and therefore outside total_credits. fixed_spent_credits is what has ALREADY been charged this cycle, NOT your monthly run-rate — for the forward figure billed at the next renewal see `billing commitments`, which is normally much larger. For organization wallet scope, reserved_credits is in-flight spend already removed from the available balance: do not subtract it again from free_to_spend_credits. Reserved credits can exceed the remaining free balance without implying an overdraft. For workspace_cap scope, free_to_spend_credits is remaining allowance, not the billing owner's wallet; live execution still checks that wallet and spend policies. Every segment carries region=fixed|flexible. 0 credits; reserves nothing. Due plan grants or credit expiry may apply.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing allowance", options, () => requestOxygen("/api/cli/billing/allowance"));
     }))
         .addCommand(new Command("usage")
-        .description("Show credit ledger events (each tagged with its FIXED/FLEXIBLE spend_class), workflow step usage (automation_actions: credits per step, credits billed; writing rows is free), calls with your own API keys (byok_calls: the platform fee per call and the fee credits this month; your provider bills the call itself), or connected LinkedIn and WhatsApp accounts (provider_seats: the rolling-30d peak and its implied Unipile cost; what each account is charged is its credit reservation in `billing commitments`). On a plan that pays for several workspaces (an agency covering client workspaces), `--group-by workspace` totals the credits each workspace spent (`by_workspace`) and `--workspace <id|slug>` narrows the ledger to one of them; a linked client workspace sees only its own spend.")
-        .option("--meter <meter>", "credits, automation_actions, byok_calls, or provider_seats (rolling-30d peak connected accounts and the flat per-account charge; each account's reservation is listed by `billing commitments`). Defaults to credits.")
+        .description("Show credit ledger events (each tagged with its FIXED/FLEXIBLE spend_class), workflow step usage (automation_actions: credits per step, credits billed; writing rows is free), calls with your own API keys (byok_calls: the platform fee per call and the fee credits this month; your provider bills the call itself), or connected LinkedIn and WhatsApp accounts (provider_seats: the rolling-30d peak and its implied connectivity cost; what each account is charged is its credit reservation in `billing commitments`). On a plan that pays for several workspaces (an agency covering client workspaces), `--group-by workspace` totals the credits each workspace spent (`by_workspace`) and `--workspace <id|slug>` narrows the ledger to one of them; a linked client workspace sees only its own spend. managed_credits_used counts captured credits; for where credits went by category, provider or tool, with shares, run `billing audit`.")
+        .option("--meter <meter>", "credits, automation_actions, byok_calls, provider_seats (rolling-30d peak connected accounts and the flat per-account charge; each account's reservation is listed by `billing commitments`), or holds (each held reservation behind reserved_credits in this workspace: credits, run, why it is held (an unmarked LinkedIn lookup hold cannot say whether its result was unknown or delivered), and automatic_return: only a LinkedIn lookup hold from 24 hours to 30 days old is eligible, only while that is switched on, and an hourly release returns it on a later pass with no fixed deadline; read-only, newest first, --days up to 365 and --limit apply). Defaults to credits.")
         .option("--days <n>", "Lookback window in days. Defaults to 30.")
         .option("--from <iso>", "Only include ledger events at or after this ISO timestamp.")
         .option("--to <iso>", "Only include ledger events at or before this ISO timestamp.")
@@ -11444,7 +11553,7 @@ Examples:
         });
     }))
         .addCommand(new Command("audit")
-        .description("Summarize where managed credits were granted, reserved, captured, released, or spent. Groups carrying a category are tagged with a FIXED/FLEXIBLE spend_class, and totals include fixed_credits_spent/flexible_credits_spent — pass --group-by category (or include it alongside other keys) for that split to be meaningful.")
+        .description("Summarize where managed credits were granted, reserved, captured, released, or spent. Every result lists spend_by_category (each spend area's credits and share of the window's spend, largest first) and totals fixed_credits_spent/flexible_credits_spent over the whole window, whatever --group-by is. groups_truncated says when --limit cut grouped rows, and managed_credits_spent_outside_groups how much they carried. Spent is reserved minus released in the window, so it differs from totals.managed_credits_captured (`billing usage`'s managed_credits_used) by holds still open (reserved_credits) and holds settling across the window edge. byok_usage_events counts only nonzero rows unless --type byok. 0 credits; reserves nothing. Due plan grants or credit expiry may apply.")
         .option("--days <n>", "Lookback window in days. Defaults to 365.")
         .option("--from <iso>", "Only include ledger events at or after this ISO timestamp.")
         .option("--to <iso>", "Only include ledger events at or before this ISO timestamp.")
@@ -11816,8 +11925,8 @@ Examples:
         .command("admin")
         .description("Staff-only commands.")
         .addCommand(new Command("kpis")
-        .description("Show company acquisition with self-reported signup-channel attribution, signup-to-CLI/MCP activation, matured seven-day trial conversion, positive-paid MRR/ARR, and paid churn separated from trial loss. OXYGEN staff only; workspace admin role alone does not grant access.")
-        .addOption(new Option("--range <range>", "Range for acquisition, actor-and-surface-tracked activation, seven-day trial cohorts, and churn; current MRR/ARR and scheduled cancellations remain point-in-time.")
+        .description("Show the company conversion funnel (visitors → signups → agent connected → CLI/MCP activation → paid, with step rates), self-reported signup-channel attribution, new and positive-paid MRR/ARR, and paid churn separated from trial loss. OXYGEN staff only; workspace admin role alone does not grant access.")
+        .addOption(new Option("--range <range>", "Range for acquisition, the funnel's signup cohort, new revenue, and churn; current MRR/ARR and scheduled cancellations remain point-in-time.")
         .choices(["7d", "30d", "90d"])
         .default("30d"))
         .option("--json", "Print a JSON envelope.")
@@ -11853,6 +11962,49 @@ Examples:
             return requestOxygen(`/api/cli/admin/costs${suffix}`);
         });
     }))
+        .addCommand(new Command("price-book")
+        .description("The runtime prices charging reads from the control DB: recurring charges, plan allowances and scalars, each with its committed default and whether staff may edit it. An edit reaches every instance within 60 seconds. Staff only.")
+        .addCommand(new Command("list")
+        .description("List every pricing-book row with its stored value, what charging bills now, the committed default, and who reads it. Read-only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("admin price-book list", options, () => requestOxygen("/api/cli/admin/costs?section=pricing_book"));
+    }))
+        .addCommand(new Command("set")
+        .description("Set one editable pricing-book field. A charge takes --field credits or active; a plan takes monthly_credits, weekly_credits_limit or rollover_cap (value none for no limit); a scalar takes value. Rows charging does not read from the book are refused.")
+        .requiredOption("--table <table>", "charge, plan, or scalar.")
+        .requiredOption("--key <key>", "The row key, e.g. addon.egress_dedicated_ip, oxygen_499, markup.copilot_inference.")
+        .requiredOption("--field <field>", "credits | active (charge); monthly_credits | weekly_credits_limit | rollover_cap (plan); value (scalar).")
+        .requiredOption("--value <value>", "A non-negative number, true/false for active, or none for no plan limit.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("admin price-book set", options, () => requestOxygen("/api/cli/admin/costs", {
+            method: "POST",
+            body: {
+                price_table: options.table,
+                price_key: options.key,
+                price_field: options.field,
+                value: readPriceBookValue(options.value),
+            },
+        }));
+    }))
+        .addCommand(new Command("restore")
+        .description("Put a pricing-book row back to its committed default. For a plan, --field restores one allowance field; without it all three are restored.")
+        .requiredOption("--table <table>", "charge, plan, or scalar.")
+        .requiredOption("--key <key>", "The row key.")
+        .option("--field <field>", "Plan only: monthly_credits, weekly_credits_limit or rollover_cap.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("admin price-book restore", options, () => requestOxygen("/api/cli/admin/costs", {
+            method: "POST",
+            body: {
+                price_table: options.table,
+                price_key: options.key,
+                ...(options.field ? { price_field: options.field } : {}),
+                restore: true,
+            },
+        }));
+    })))
         .addCommand(new Command("primary-providers")
         .description("Board of the PRIMARY managed external data providers (enrichment, people/company search, web search, scraping, signals, AI-column web grounding, LLM inference): per provider health probe, 7d traffic, balance, 30d/7d COGS, rate policy, spend ceilings, breaker, and posture, plus the platform runaway guards and how old each snapshot is. Reads the snapshots the crons write; --refresh re-runs those same zero-credit snapshots first. Staff only.")
         .option("--refresh", "Re-run the zero-credit snapshot work the three crons run (provider health probes, managed balances, cost snapshot) before reading the board. No paid provider call and no credit spend; takes up to a few minutes.")
@@ -12478,7 +12630,7 @@ Examples:
         .description("Start an attended Workspace Copilot session on Oxygen Auto — Oxygen picks the model, keeps one conversation on one model, and runs its own errands on a cheaper one. Starting is free; the next send starts inference. No inference budget is required; inference bills at 5x actual model cost under a 3,000-credit internal platform safety backstop. Legacy budget and tier flags remain accepted for older clients but do not authorize or cap spend. Paid or external actions require separate approval.")
         .option("--budget-credits <number>", "Legacy compatibility only: accepted and clamped, but does not authorize or cap attended Copilot inference.")
         .option("--tier <auto|low|medium|high>", "Legacy. Sessions run on Oxygen Auto; Oxygen picks the model. The three older tiers are still accepted so existing scripts keep working.")
-        .option("--model <id>", "Pin a specific priced model id instead of letting Oxygen choose.")
+        .option("--model <id>", "Pin a specific priced model id instead of letting Oxygen choose. An id Oxygen does not price is ignored and the session runs on Oxygen Auto.")
         .option("--per-turn-ceiling <number>", "Legacy compatibility only: accepted and clamped, but does not cap an attended turn.")
         .option("--journey <slug>", "Optional journey slug to seed the session's goal and context.")
         .option("--title <text>", "Optional human title for the session.")
@@ -12669,8 +12821,8 @@ Examples:
         .command("runs")
         .description("Workspace run ledger and provenance. `runs list --table <table>` is one table's full run history: imports, row writes and column runs.")
         .addCommand(new Command("list")
-        .description("List recent tenant runs, newest first.")
-        .option("--table <table>", "Only runs of this table (id, slug or table URL), e.g. to check whether a column run started.")
+        .description("List workspace runs, newest first; --table gives one table's full run history.")
+        .option("--table <table>", "One table's full run history (id, slug or table URL): imports, row writes, column runs and Function calls.")
         .option("--limit <n>", "Maximum runs to return. Defaults to 50.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13065,7 +13217,7 @@ Examples:
         .option("--return <mode>", "Legacy response shape: raw, compact, or summary. Defaults to raw.")
         .option("--return-mode <mode>", "Response shape: raw, compact, or summary. Prefer summary for large search responses.")
         .option("--oxygen-cursor <cursor>", "Short Oxygen cursor returned as oxygen_next_cursor by a previous tool run.")
-        .option("--max-credits <n>", "Credit ceiling for live paid tools; not needed for no-bill tools, and 0 is accepted for no-bill operations.")
+        .option("--max-credits <n>", "Credit ceiling for live paid tools; not needed for no-bill tools. 0 runs no-bill operations, which may call providers, and reuses a managed lookup's cached result for the exact same input for free (the dry run's preview.cache says whether one exists). A paid cache miss at 0 calls and charges nothing.")
         .option("--approved", "Required for live paid tools and external writes after inspecting dry-run output.")
         .option("--json", "Print a JSON envelope.")
         .action(async (toolId, options) => {
@@ -13198,7 +13350,7 @@ Examples:
         .option("--company-domain <domain>", "Company apex domain, e.g. acme.com.")
         .option("--company-name <name>", "Company name.")
         .option("--mode <mode>", "dry_run (default) previews the plan and spends nothing; live spends credits and returns the answer.")
-        .option("--max-credits <credits>", "Spend ceiling. Required for --mode live. Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that lets the WHOLE resolved waterfall run, plus estimate.min_credits and a per-leg breakdown. When the resolved chain runs the guessed-address pass (the name+domain and first/last+domain profiles, not the LinkedIn-URL one) the block also carries estimate.pattern_guess_verification_credits — the verification checks that pass bills before any named provider is dialled. A lower ceiling does NOT stop the run: each lane priced above what is left of it is refused on its own (spend_cap_too_low) and the waterfall advances, so a cheaper lane further down the chain can still run and bill.")
+        .option("--max-credits <credits>", "Spend ceiling in Oxygen credits; a lane that runs on your own provider key bills your provider account and is outside it (cap that with `oxygen limits provider set`). Required for --mode live. Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that lets the WHOLE resolved waterfall run, plus estimate.min_credits and a per-leg breakdown. When the resolved chain runs the guessed-address pass (the name+domain and first/last+domain profiles, not the LinkedIn-URL one) the block also carries estimate.pattern_guess_verification_credits — the verification checks that pass bills before any named provider is dialled. A lower ceiling does NOT stop the run: each lane priced above what is left of it is refused on its own (spend_cap_too_low) and the waterfall advances, so a cheaper lane further down the chain can still run and bill.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("find email", options, () => requestOxygen("/api/cli/find/run", { method: "POST", body: buildFindBody("email", options) }));
@@ -13211,7 +13363,7 @@ Examples:
         .option("--company-domain <domain>", "Company apex domain, e.g. acme.com.")
         .option("--company-name <name>", "Company name.")
         .option("--mode <mode>", "dry_run (default) previews the plan and spends nothing; live spends credits and returns the answer.")
-        .option("--max-credits <credits>", "Spend ceiling. Required for --mode live. Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that lets the WHOLE resolved waterfall run, plus estimate.min_credits and a per-leg breakdown. A lower ceiling does NOT stop the run: each lane priced above what is left of it is refused on its own (spend_cap_too_low) and the waterfall advances, so a cheaper lane further down the chain can still run and bill.")
+        .option("--max-credits <credits>", "Spend ceiling in Oxygen credits; a lane that runs on your own provider key bills your provider account and is outside it (cap that with `oxygen limits provider set`). Required for --mode live. Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that lets the WHOLE resolved waterfall run, plus estimate.min_credits and a per-leg breakdown. A lower ceiling does NOT stop the run: each lane priced above what is left of it is refused on its own (spend_cap_too_low) and the waterfall advances, so a cheaper lane further down the chain can still run and bill.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("find personal-email", options, () => requestOxygen("/api/cli/find/run", { method: "POST", body: buildFindBody("personal_email", options) }));
@@ -13225,7 +13377,7 @@ Examples:
         .option("--company-name <name>", "Company name.")
         .option("--verify", "Verify the found number with ClearoutPhone — adds line_type/carrier and keeps the number on a non-verdict (only a genuine 'not valid' is discarded).")
         .option("--mode <mode>", "dry_run (default) previews the plan and spends nothing; live spends credits and returns the answer.")
-        .option("--max-credits <credits>", "Spend ceiling. Required for --mode live. Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that lets the WHOLE resolved waterfall run, plus estimate.min_credits and a per-leg breakdown. A lower ceiling does NOT stop the run: each lane priced above what is left of it is refused on its own (spend_cap_too_low) and the waterfall advances, so a cheaper lane further down the chain can still run and bill.")
+        .option("--max-credits <credits>", "Spend ceiling in Oxygen credits; a lane that runs on your own provider key bills your provider account and is outside it (cap that with `oxygen limits provider set`). Required for --mode live. Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that lets the WHOLE resolved waterfall run, plus estimate.min_credits and a per-leg breakdown. A lower ceiling does NOT stop the run: each lane priced above what is left of it is refused on its own (spend_cap_too_low) and the waterfall advances, so a cheaper lane further down the chain can still run and bill.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("find phone", options, () => requestOxygen("/api/cli/find/run", { method: "POST", body: buildFindBody("phone", options) }));
@@ -13238,15 +13390,15 @@ Examples:
         .option("--company-name <name>", "Company name.")
         .option("--company-linkedin-url <url>", "Company LinkedIn URL.")
         .option("--mode <mode>", "dry_run (default) previews the plan and spends nothing; live spends credits and returns the answer.")
-        .option("--max-credits <credits>", "Spend ceiling. Required for --mode live. Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that lets the WHOLE resolved waterfall run, plus estimate.min_credits and a per-leg breakdown. A lower ceiling does NOT stop the run: each lane priced above what is left of it is refused on its own (spend_cap_too_low) and the waterfall advances, so a cheaper lane further down the chain can still run and bill.")
+        .option("--max-credits <credits>", "Spend ceiling in Oxygen credits; a lane that runs on your own provider key bills your provider account and is outside it (cap that with `oxygen limits provider set`). Required for --mode live. Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that lets the WHOLE resolved waterfall run, plus estimate.min_credits and a per-leg breakdown. A lower ceiling does NOT stop the run: each lane priced above what is left of it is refused on its own (spend_cap_too_low) and the waterfall advances, so a cheaper lane further down the chain can still run and bill.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("find linkedin", options, () => requestOxygen("/api/cli/find/run", { method: "POST", body: buildFindBody("linkedin", options) }));
     }))
         .addCommand(new Command("person")
-        .description("Enrich one person from a LinkedIn URL, a LinkedIn public id, a Sales Navigator link, or an email / name + company: one managed profile lookup returns the profile block — first, last and full name, current company and its LinkedIn URL, job title, job start date, education and school, headline, bio, location and follower count — the same fields the person_enrich table preset extracts for free. An email or name is first resolved to the profile through the LinkedIn URL waterfall (priced as an identity prerequisite). A Sales Navigator link or member id resolves only on the workspace's own HarvestAPI key. dry_run previews the lookup and its price for free.")
+        .description("Enrich one person from a LinkedIn URL, a LinkedIn public id or member id, a Sales Navigator link, or an email / name + company: one managed profile lookup returns the profile block — first, last and full name, current company and its LinkedIn URL, job title, job start date, education and school, headline, bio, location and follower count — the same fields the person_enrich table preset extracts for free. An email or name is first resolved to the profile through the LinkedIn URL waterfall (priced as an identity prerequisite). A member id uses managed enrichment. A Sales Navigator link resolves on the workspace's own HarvestAPI key. dry_run previews the lookup and its price for free.")
         .option("--linkedin-url <url>", "Person LinkedIn profile URL (linkedin.com/in/<handle>).")
-        .option("--linkedin-id <id>", "LinkedIn public identifier (the part after /in/), or an ACoAA/ACwAA member id (BYOK HarvestAPI only).")
+        .option("--linkedin-id <id>", "LinkedIn public identifier (the part after /in/), or a member ID beginning ACo/ACw; both support managed enrichment. Preview checks input shape and price without resolving the ID.")
         .option("--sales-navigator-url <url>", "Sales Navigator lead or people link; resolved on the workspace's own HarvestAPI key.")
         .option("--email <email>", "Known email; resolved to the profile through the LinkedIn URL waterfall first.")
         .option("--full-name <name>", "Person full name; with --company-domain or --company-name, resolved through the LinkedIn URL waterfall first.")
@@ -13256,7 +13408,7 @@ Examples:
         .option("--company-name <name>", "Company name.")
         .option("--include-raw", "Also return the provider's raw profile payload (profile_raw) for fields the profile block does not carry.")
         .option("--mode <mode>", "dry_run (default) previews the plan and spends nothing; live spends credits and returns the profile.")
-        .option("--max-credits <credits>", "Spend ceiling. Required for --mode live. Run the free dry_run first: estimate.recommended_max_credits funds the profile lookup plus, for an email or name input, every lane of the LinkedIn URL waterfall that resolves it.")
+        .option("--max-credits <credits>", "Spend ceiling in Oxygen credits; a lane that runs on your own provider key bills your provider account and is outside it (cap that with `oxygen limits provider set`). Required for --mode live. Run the free dry_run first: estimate.recommended_max_credits funds the profile lookup plus, for an email or name input, every lane of the LinkedIn URL waterfall that resolves it.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("find person", options, () => requestOxygen("/api/cli/find/run", { method: "POST", body: buildFindBody("person", options) }));
@@ -13270,7 +13422,7 @@ Examples:
         .option("--list-fields", "Print the field catalog (category, description, provider count, per-row credits: free / fixed / ~estimated) and exit. Needs no identity; spends nothing.")
         .option("--check-technologies <names>", "Comma-separated technology names for the technology_check field, answered yes/no against the detected stack (e.g. hubspot,salesforce).")
         .option("--mode <mode>", "dry_run (default) previews the plan and spends nothing; live spends credits and returns the answer.")
-        .option("--max-credits <credits>", "Spend ceiling. Required for --mode live; 0 runs only the zero-credit lanes (the priced lanes are skipped as credit_ceiling_reached). Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that funds every lane in the plan, and estimate.min_credits, what the plan costs if each field is answered by its first lane.")
+        .option("--max-credits <credits>", "Spend ceiling in Oxygen credits; a lane that runs on your own provider key bills your provider account and is outside it (cap that with `oxygen limits provider set`). Required for --mode live; 0 can still call providers on zero-credit lanes and reuse any priced lane this workspace already has a cached answer for (the other priced lanes are skipped as credit_ceiling_reached). Run the free dry_run first: it returns estimate.recommended_max_credits, the ceiling that funds every lane in the plan, and estimate.min_credits, what the plan costs if each field is answered by its first lane.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("find company", options, () => requestOxygen("/api/cli/find/run", { method: "POST", body: buildFindBody("company", options) }));
@@ -13537,17 +13689,21 @@ Examples:
         });
     })))
         .addCommand(new Command("list")
-        .description("List supported integrations and this org's connections.")
+        .description("List supported integrations and this org's connections. Add --integration <id> to read one integration and its connection state.")
+        .option("--integration <id>", "Return only this integration and its connections, such as hubspot.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("integrations list", options, () => requestOxygen("/api/cli/integrations/composio/list"));
+        await handleAsyncAction("integrations list", options, () => {
+            const integration = readOption(options.integration)?.trim();
+            return requestOxygen(`/api/cli/integrations/composio/list${integration ? `?integration=${encodeURIComponent(integration)}` : ""}`);
+        });
     }))
         .addCommand(addContractFlags(new Command("connect")
-        .description("Connect an integration. For OAuth toolkits, running this command immediately creates a pending provider authorization and returns a redirect URL; account access starts only if you approve on the provider's page. This is not a price preview. On a repriced workspace, a connected X account reserves 1,000 credits ($10) monthly; inspect the current pricing schedule with `oxygen limits show --json` before connecting. API-key integrations accept --api-key. Run without credentials only for an API-key integration to get a 0-credit preview of its exact fields (mode: needs_api_key): no credential is submitted, nothing is stored, and no provider call is made. Use repeatable --credential name=value when a provider also requires a host, subdomain, or other named value. To keep a secret out of shell history and process arguments, open the preview's web_url and submit it in Connections; --api-key is for controlled noninteractive use. Credential submission creates or replaces the connection immediately and needs no separate --approved flag. LinkedIn and WhatsApp return a Unipile hosted-auth URL instead (`oxygen senders connect` / `oxygen whatsapp connect` are the canonical paths).")
+        .description("Connect an integration. For OAuth toolkits, running this command immediately creates a pending provider authorization and returns a redirect URL; account access starts only if you approve on the provider's page. This is not a price preview. On a repriced workspace, a connected X account reserves 1,000 credits ($10) monthly; inspect current connection prices and first billing timing with `oxygen billing commitments --view connection-prices --json` before connecting. API-key integrations accept --api-key. Run without credentials only for an API-key integration to get a 0-credit preview of its exact fields (mode: needs_api_key): no credential is submitted, nothing is stored, and no provider call is made. Use repeatable --credential name=value when a provider also requires a host, subdomain, or other named value. To keep a secret out of shell history and process arguments, open the preview's web_url and submit it in Connections; --api-key is for controlled noninteractive use. Credential submission creates or replaces the connection immediately and needs no separate --approved flag. LinkedIn and WhatsApp return a hosted sign-in link instead (`oxygen senders connect` / `oxygen whatsapp connect` are the canonical paths).")
         .argument("<integration_id>", "Integration id, such as 'slack' or 'serpapi'.")
         .option("--api-key <value>", "API key for controlled noninteractive use. Literal values can appear in shell history and process arguments; prefer the preview web_url for manual entry.")
         .option("--credential <name=value>", "Named provider credential field. Repeat for multi-field integrations (for example, PostHog: --credential subdomain=us).", collectRepeatable, [])
-        .option("--country <code>", "ISO 3166-1 alpha-2 country where the LinkedIn account owner normally signs in (required for `connect linkedin`; picks the egress proxy).")
+        .option("--country <code>", "ISO 3166-1 alpha-2 country where the LinkedIn account owner normally signs in (required for `connect linkedin`; picks the egress proxy from the 56 countries OXYGEN has LinkedIn proxies in).")
         .option("--pairing-phone-number <e164>", "WhatsApp only: pair by code sent to this E.164 number instead of showing a QR.")
         .addOption(new Option("--acknowledge-risk", "Deprecated: LinkedIn connect no longer needs it. Still accepted so older scripts keep running.").hideHelp())
         .option("--return-to <path>", "In-product destination after OAuth approval.")
@@ -13594,7 +13750,7 @@ Examples:
         }));
     }))
         .addCommand(new Command("disconnect")
-        .description("Disconnect an integration. LinkedIn and WhatsApp remove the Unipile connected account; pass --connection-id when more than one is connected.")
+        .description("Disconnect an integration. LinkedIn and WhatsApp remove the connected account; pass --connection-id when more than one is connected.")
         .argument("<integration_id>", "Integration id, such as 'slack'.")
         .option("--connection-id <id>", "Disconnect a specific connected account when multiple exist.")
         .option("--json", "Print a JSON envelope.")
@@ -13705,12 +13861,12 @@ Examples:
         await handleAsyncAction("senders checkpoints", options, () => requestOxygen("/api/cli/senders/checkpoints"));
     }))
         .addCommand(new Command("connect")
-        .description("Get a Unipile hosted-auth URL to connect a new LinkedIn account (or reconnect with --reconnect). This command creates a pending provider authorization; it does not preview a price. Each connected LinkedIn account has one monthly charge, never two: an existing dollar seat until it ends at renewal, or a monthly credit reservation after seats retire. Once the workspace is repriced that reservation is 3,400 credits ($34) monthly; a connect the balance cannot cover fails with insufficient_credits. Invites, messages and other LinkedIn actions cost 0 credits on top. `oxygen billing seats --json` reports the charge that applies to this workspace now, and `oxygen billing estimate --linkedin-accounts <n> --json` prices n accounts against your plan. A workspace linked to another organization's plan is billed at that organization. New accounts require --country (the owner's normal LinkedIn login country) and default to syncing only conversations OXYGEN starts; use --inbox-scope all to opt into the full LinkedIn inbox. Use --cookie-auth and --custom-proxy to expose those inputs inside Unipile's hosted wizard; their secrets never pass through OXYGEN. Use --count for bulk onboarding; --count above 1 needs --owner-consent (each owner connects their own account). Links are shareable and valid for 10 minutes.")
+        .description("Get a hosted sign-in link to connect a new LinkedIn account (or reconnect with --reconnect). This command creates a pending provider authorization. Inspect prices first with `oxygen billing commitments --view connection-prices --json`, which creates no authorization. A covering dollar seat and a credit reservation are alternative billing rails. Read the seat coverage and actual commitment before relying on the next monthly billing date, especially on reconnect. Once the workspace is repriced that reservation is 3,400 credits ($34) monthly; with the credit gate active, a connect the balance cannot cover fails with insufficient_credits. Invites, messages and other LinkedIn actions cost 0 credits on top. `oxygen billing seats --json` shows held seats and next-connection eligibility; paying-seat coverage may remain unknown. Inspect `oxygen billing commitments --json` for an account’s actual reservation, and `oxygen billing estimate --linkedin-accounts <n> --json` prices n accounts against your plan. A workspace linked to another organization's plan is billed at that organization. New accounts require --country (the owner's normal LinkedIn login country) and default to syncing only conversations OXYGEN starts; use --inbox-scope all to opt into the full LinkedIn inbox. Use --cookie-auth and --custom-proxy to expose those inputs in the hosted sign-in wizard; their secrets never pass through OXYGEN. Use --count for bulk onboarding; --count above 1 needs --owner-consent (each owner connects their own account). Links are shareable and valid for 10 minutes.")
         .option("--reconnect <connection_id>", "Reconnect an existing connection instead of creating a new one. Accepts a connection id.")
-        .option("--country <code>", "Required for new accounts: ISO 3166-1 alpha-2 code for the account owner's normal LinkedIn login country (for example DE or US).")
-        .option("--sales-nav", "Request Classic + Sales Navigator access during Unipile hosted authentication.")
-        .option("--cookie-auth", "Offer LinkedIn cookie authentication in Unipile's hosted wizard. The account owner enters li_at/li_a there; OXYGEN never receives them.")
-        .option("--custom-proxy", "Let the account owner enter a custom proxy in Unipile's hosted wizard. OXYGEN never receives the proxy credentials.")
+        .option("--country <code>", "Required for new accounts: ISO 3166-1 alpha-2 code for the account owner's normal LinkedIn login country (for example DE or US); one of the 56 countries OXYGEN has LinkedIn proxies in.")
+        .option("--sales-nav", "Request Classic + Sales Navigator access during hosted sign-in.")
+        .option("--cookie-auth", "Offer LinkedIn cookie authentication in the hosted sign-in wizard. The account owner enters li_at/li_a there; OXYGEN never receives them.")
+        .option("--custom-proxy", "Let the account owner enter a custom proxy in the hosted sign-in wizard. OXYGEN never receives the proxy credentials.")
         .option("--count <n>", "Mint N hosted-auth links in one call for bulk onboarding (1-25, default 1). Every link uses the same --country; use separate calls for different login countries. Ignored when reconnecting.")
         .option("--share-link", "Return a shareable connection link for one account; its owner completes authentication.")
         .option("--inbox-scope <scope>", "LinkedIn inbox privacy for new accounts: oxygen_initiated (default) or all. Reconnect preserves the existing account setting.")
@@ -13762,6 +13918,17 @@ Examples:
             body: { scope: options.scope },
         }));
     })))
+        .addCommand(new Command("proxy-country")
+        .description("Move a LinkedIn sender's automatic proxy to another country without reconnecting. The account picks a proxy there at once when one is free; otherwise its sequences stay paused and each `senders sync` asks again. Zero credits.")
+        .argument("<id>", "Sender account id, connection id, or Unipile account id.")
+        .requiredOption("--country <code>", "ISO 3166-1 alpha-2 country where the account owner logs in; one of the 56 countries OXYGEN has LinkedIn proxies in (others are refused with the list).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (id, options) => {
+        await handleAsyncAction("senders proxy-country", options, () => requestOxygen(`/api/cli/senders/${encodeURIComponent(id)}/proxy-country`, {
+            method: "PATCH",
+            body: { country: options.country.trim().toUpperCase() },
+        }));
+    }))
         .addCommand(new Command("get")
         .description("Get one LinkedIn sender account with status, limits, daily-reset timezone, and usage. <id> accepts a sender account id, connection id, or Unipile account id.")
         .argument("<id>", "Sender account id, connection id, or Unipile account id.")
@@ -13781,7 +13948,7 @@ Examples:
         }));
     }))
         .addCommand(new Command("health")
-        .description("Show a one-call health snapshot for a LinkedIn sender: status, the latest error reason, any open security checkpoint, today's usage, the warm-up ramp, and when the daily quota resets. Read-only — no provider call, no credits. <id> accepts a sender account id, connection id, or Unipile account id.")
+        .description("Show a one-call health snapshot for a LinkedIn sender: status, the latest error reason, any open security checkpoint, today's usage, the warm-up ramp, when the daily quota resets, and inbox sync (last sync, latest failure, back-off). Read-only — no provider call, no credits. <id> accepts a sender account id, connection id, or Unipile account id.")
         .argument("<id>", "Sender account id, connection id, or Unipile account id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (id, options) => {
@@ -13820,7 +13987,7 @@ Examples:
         });
     }))
         .addCommand(new Command("disconnect")
-        .description("Disconnect a LinkedIn sender account so it stops sending and frees its sending seat for another account. Works on an account that is already disconnected. <id> accepts a sender account id, connection id, or Unipile account id.")
+        .description("Disconnect a LinkedIn sender account so it stops sending. Works on an account that is already disconnected. <id> accepts a sender account id, connection id, or Unipile account id.")
         .argument("<id>", "Sender account id, connection id, or Unipile account id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (id, options) => {
@@ -14445,7 +14612,7 @@ Examples:
     program.addCommand(new Command("linkedin")
         .description("Put your own LinkedIn network in a table and keep it current. `linkedin network setup` captures everyone you are connected to and everyone who follows you into one self-refreshing 'LinkedIn Network' table (free, read-only on your account, paced so the account is never at risk); `linkedin network status` reports the pace and `linkedin network pause` switches it off. `linkedin invitations setup` does the same for open connection requests — received and sent — in one self-updating table. Also home to `linkedin intent` (engagement capture) and `linkedin ingestion status` (every LinkedIn read drip and each account's remaining read budget).")
         .addCommand(new Command("network")
-        .description("Capture everyone already in your LinkedIn network \u2014 the people you are connected to and the people who follow you \u2014 into one self-refreshing workspace table you can filter, enrich and enroll from. READ-ONLY on your LinkedIn account: it lists your own connections and followers and nothing else. It sends no messages, no connection requests, and does not visit anyone's profile. Runs as a slow background drip on its OWN per-account read budget, so it cannot slow down or starve anything else the account does: about 2,000 people a day while it first walks your network (40 reads of up to 50 people), then a light check a few times a day for new arrivals. Only inside each account's own 07:00-22:00 working hours, spaced minutes apart, never in a burst; a newly armed account eases in over its first two weeks. LinkedIn does not say how big a network is until the walk has been through it, so a large network takes days \u2014 `status` reports the rate, not a completion date it cannot know. Free \u2014 no Oxygen credits; it uses the LinkedIn seat you already pay for.")
+        .description("Capture everyone already in your LinkedIn network \u2014 the people you are connected to and the people who follow you \u2014 into one self-refreshing workspace table you can filter, enrich and enroll from. READ-ONLY on your LinkedIn account: it lists your own connections and followers and nothing else. It sends no messages, no connection requests, and does not visit anyone's profile. Runs as a slow background drip on its OWN per-account read budget, so it cannot slow down or starve anything else the account does: about 2,000 people a day while it first walks your network (40 reads of up to 50 people), then a light check a few times a day for new arrivals. Only inside each account's own 07:00-22:00 working hours, spaced minutes apart, never in a burst; a newly armed account eases in over its first two weeks. LinkedIn does not say how big a network is until the walk has been through it, so a large network takes days \u2014 `status` reports the rate, not a completion date it cannot know. Free \u2014 no Oxygen credits for this read; it uses your connected LinkedIn account, whose seat or credit reservation has its own terms.")
         .addCommand(new Command("setup")
         .description("Arm (or re-arm) network capture. Creates or reuses one merged 'LinkedIn Network' table and starts a connections drip and a followers drip per account, both writing into that one table deduped on LinkedIn member id \u2014 somebody who is both shows as 'both' in the Relationship column. This is a STANDING permission: capture keeps running until you switch it off with `linkedin network pause`, and a LinkedIn account you connect later is armed automatically. A newly connected account eases into full read speed over its first two weeks. Nothing is sent and no credits are charged. The response names each account it armed (`senders[].display_name`) \u2014 check it is yours before leaving it running.")
         .option("--account <ref>", "Account to capture (sender id, connection id, or Unipile account id). Omit to capture every connected LinkedIn account.")
@@ -14654,7 +14821,7 @@ Examples:
         });
     }))));
     program.addCommand(new Command("whatsapp")
-        .description("Manage the org's connected WhatsApp accounts for Sequencer: list, connect, sync, inspect, disconnect, tune daily limits, and warm-send into an existing conversation. Cold outbound runs through a WhatsApp sequence (sequences create --channels whatsapp).")
+        .description("Manage the org's connected WhatsApp accounts for Sequencer: accounts (list), connect, sync, inspect, disconnect, tune daily limits, and warm-send into an existing conversation. Cold outbound runs through a WhatsApp sequence (sequences create --channels whatsapp).")
         .addCommand(addContractFlags(new Command("accounts")
         .description("Read stored WhatsApp account health. Disconnected accounts are hidden by default; --include-disconnected includes retained accounts, --status selects one status. Presence is not send readiness. Use summary and exact account-id/value for long public metadata."), WHATSAPP_ACCOUNTS_READ_CONTRACT, WHATSAPP_ACCOUNT_FLAGS)
         .option("--json", "Print a JSON envelope.")
@@ -14665,7 +14832,7 @@ Examples:
         });
     }))
         .addCommand(new Command("connect")
-        .description("Get a Unipile hosted-auth URL to connect a new WhatsApp account by scanning a QR in WhatsApp → Linked Devices (or reconnect with --reconnect). Newly connected accounts start a mandatory warm-up ramp.")
+        .description("Get a hosted sign-in link to connect a new WhatsApp account by scanning a QR in WhatsApp → Linked Devices (or reconnect with --reconnect). Running this command creates a pending provider authorization. Inspect the current monthly price and first billing timing with `oxygen billing commitments --view connection-prices --json` before connecting. Newly connected accounts start a mandatory warm-up ramp.")
         .option("--reconnect <connection_id>", "Reconnect an existing connection id instead of linking a new account.")
         .option("--pairing-phone-number <phone>", "Offer phone-number pairing instead of QR where supported; use your international number.")
         .option("--json", "Print a JSON envelope.")
@@ -14703,7 +14870,7 @@ Examples:
         });
     }))
         .addCommand(new Command("disconnect")
-        .description("Disconnect a WhatsApp account so it stops sending and frees its sending seat for another account. Works on an account that is already disconnected. <id> accepts an account id, connection id, or Unipile account id.")
+        .description("Disconnect a WhatsApp account so it stops sending. Works on an account that is already disconnected. <id> accepts an account id, connection id, or Unipile account id.")
         .argument("<id>", "WhatsApp account id, connection id, or Unipile account id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (id, options) => {
@@ -14718,14 +14885,9 @@ Examples:
         .action(async (id, options) => {
         await handleAsyncAction("whatsapp limits get", options, () => requestOxygen(`/api/cli/whatsapp/accounts/${encodeURIComponent(id)}/limits`));
     }))
-        .addCommand(new Command("set")
+        .addCommand(addWhatsAppLimitFlags(new Command("set")
         .description("Adjust per-account WhatsApp daily limits and the daily-reset timezone. Values are clamped to safe maximums; the warm-up ceiling still applies to direct and Sequence traffic. <id> accepts an account id, connection id, or Unipile account id.")
-        .argument("<id>", "WhatsApp account id, connection id, or Unipile account id.")
-        .option("--messages-per-day <n>", "Daily WhatsApp messages cap across direct and Sequence traffic (subject to the warm-up ceiling).")
-        .option("--total-actions-per-day <n>", "Daily cap across all WhatsApp action types.")
-        .option("--messages-reads-per-day <n>", "Daily cap on chat and message-history reads.")
-        .option("--min-spacing-seconds <n>", "Minimum seconds between actions.")
-        .option("--spacing-jitter-seconds <n>", "Random jitter seconds added to action spacing.")
+        .argument("<id>", "WhatsApp account id, connection id, or Unipile account id."))
         .option("--working-days <days>", "Allowed weekdays, e.g. mon-fri or 1,3,5.")
         .option("--working-hours-start <HH:MM>", "Local start of the allowed sending window.")
         .option("--working-hours-end <HH:MM>", "Local end of the allowed sending window.")
@@ -14900,7 +15062,8 @@ Examples:
         .option("--domain <domains>", "Email only: comma-separated counterpart domains to include.")
         .option("--exclude-domain <domains>", "Email only: comma-separated counterpart domains to exclude.")
         .option("--mailbox-id <ids>", "Email only: comma-separated mailbox ids.")
-        .option("--sender-profile <ids>", "Comma-separated sender profile ids (people, from `senders profiles list`): only conversations on their own inboxes and LinkedIn/WhatsApp accounts. Merged stream only; narrow channels with --channels.")
+        .option("--sender-profile-id <ids>", "Comma-separated sender profile ids (people; `unibox metadata` and `senders profiles list` list them): only conversations on their own inboxes and LinkedIn/WhatsApp accounts. The same `sender_profile_id` key a saved view's --filters takes. Merged stream only; narrow channels with --channels.")
+        .addOption(new Option("--sender-profile <ids>", "Alias of --sender-profile-id.").hideHelp())
         .option("--search <text>", "Fuzzy search (typos, word order, prefixes) over names, addresses, subjects and the text of every message in EVERY non-warmup conversation: all channels unless --channel narrows, archived and sent-only threads included. --segment, --unanswered and the Primary tab's negative-tier exclusion are ignored while set; explicit facets such as --status still narrow. For structured filters use --status or --tag, not a text search.")
         .option("--include-archived", "Include archived conversations.")
         .option("--limit <n>", "Maximum conversations to return (1-200). Defaults to 50.")
@@ -14938,6 +15101,7 @@ Examples:
                 ["excludeDomain", "exclude_domain"],
                 ["mailboxId", "mailbox_id"],
                 ["senderProfile", "sender_profile_id"],
+                ["senderProfileId", "sender_profile_id"],
                 ["cursor", "cursor"],
             ]) {
                 const value = readOption(options[flag]);
@@ -14961,7 +15125,7 @@ Examples:
         });
     }))
         .addCommand(new Command("get")
-        .description("Get one conversation with its full message thread. <conversation> accepts a conversation id, Unipile chat id, or (email) Zapbox thread id, and is resolved on any channel by default (email first, then LinkedIn/WhatsApp). Opening a WhatsApp thread may fetch provider history and merge provider-confirmed phone/contact identities in the local mirror. This uses no Oxygen credits and sends no message; old conversation references remain usable. For stored-only inspection, use messages query.")
+        .description("Get one conversation with its full message thread. <conversation> accepts a conversation id, Unipile chat id, or (email) Zapbox thread id, and is resolved on any channel by default (email first, then LinkedIn/WhatsApp). Opening a LinkedIn or WhatsApp thread may fetch provider history and update the local mirror. WhatsApp also merges provider-confirmed phone/contact identities. This uses no Oxygen credits and sends no message; old conversation references remain usable. For stored-only inspection, use messages query.")
         .argument("<conversation>", "Conversation id, Unipile chat id, or Zapbox thread id.")
         .option("--channel <channel>", "Inbox channel: all (default, resolves the id on any channel), email, linkedin, or whatsapp.")
         .option("--message-limit <n>", "Maximum messages to return (1-500). Defaults to 100.")
@@ -15095,7 +15259,7 @@ Examples:
         }));
     }))
         .addCommand(new Command("mark-read")
-        .description("Mark a conversation and all its messages as read.")
+        .description("Mark a conversation and all its messages as read (LinkedIn by default; use --channel email or whatsapp for those channels).")
         .argument("<conversation>", "Conversation id, Unipile chat id, or (email) Zapbox thread id.")
         .option("--channel <channel>", "Inbox channel: linkedin (default), whatsapp, or email.")
         .option("--json", "Print a JSON envelope.")
@@ -15120,7 +15284,8 @@ Examples:
         .option("--exclude-domain <domains>", "Email only: comma-separated counterpart domains to exclude.")
         .option("--mailbox-id <ids>", "Email only: comma-separated mailbox ids.")
         .option("--sender-account-id <ids>", "DMs only: comma-separated OXYGEN sender UUIDs from `oxygen senders list --json` (not LinkedIn member ids).")
-        .option("--sender-profile <ids>", "Comma-separated sender profile ids (people, from `senders profiles list`): only their own inboxes and LinkedIn/WhatsApp accounts, as in `inbox list --sender-profile`.")
+        .option("--sender-profile-id <ids>", "Comma-separated sender profile ids (people; `unibox metadata` lists them): only their own inboxes and LinkedIn/WhatsApp accounts, as in `inbox list --sender-profile-id`.")
+        .addOption(new Option("--sender-profile <ids>", "Alias of --sender-profile-id.").hideHelp())
         .option("--since <iso>", "Only conversations whose last message is on/after this ISO date/timestamp. Excludes conversations without a last-message date. Cross-channel.")
         .option("--until <iso>", "Only conversations whose last message is on/before this ISO date/timestamp. Excludes conversations without a last-message date. Cross-channel.")
         .option("--search <text>", "Fuzzy search (typos, word order, prefixes) over names, addresses, subjects and the text of every message in EVERY non-warmup conversation: all channels unless --channel narrows, archived and sent-only threads included. --segment, --unanswered and the Primary tab's negative-tier exclusion are ignored while set; explicit facets such as --status still narrow.")
@@ -15151,6 +15316,7 @@ Examples:
                 ["mailboxId", "mailbox_id"],
                 ["senderAccountId", "sender_account_id"],
                 ["senderProfile", "sender_profile_id"],
+                ["senderProfileId", "sender_profile_id"],
                 ["since", "since"],
                 ["until", "until"],
                 ["search", "search"],
@@ -15169,6 +15335,7 @@ Examples:
                 params.set("needs_reply", "true");
             return requestOxygen(`/api/cli/inbox/read-all?${params.toString()}`, {
                 method: "POST",
+                previewOnly: !options.yes,
                 // Approval rides in the body: a bodyless POST reads as
                 // approved=false server-side, i.e. a preview that mutates
                 // nothing. --yes (not --approved) because this spends no
@@ -15331,6 +15498,7 @@ Examples:
                 .filter(Boolean);
             return requestOxygen("/api/cli/inbox/bulk", {
                 method: "POST",
+                previewOnly: !options.yes,
                 body: {
                     action,
                     channel,
@@ -15352,7 +15520,7 @@ Examples:
         .addCommand(new Command("create")
         .description("Save a view for the team.")
         .requiredOption("--name <name>", "View name, unique in the workspace (up to 80 characters).")
-        .option("--filters <url-or-query>", "A Unibox URL or its query string, e.g. 'sender_profile_id=<id>&channels=linkedin&status=interested' (the `inbox list` params). Omit for every conversation.")
+        .option("--filters <url-or-query>", "A Unibox URL or its query string, e.g. 'sender_profile_id=<id>&channels=linkedin&status=interested'. Keys are the `inbox list` filters (sender_profile_id is --sender-profile-id); a view without segment opens on the Primary tab, segment=all on every conversation. Omit for every conversation.")
         .option("--default", "Also make it your own default view.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -15369,7 +15537,7 @@ Examples:
         .description("Rename, re-filter or reorder a view, or set it as (or stop using it as) your own default.")
         .argument("<view>", "View id (from `inbox views list`).")
         .option("--name <name>", "New name.")
-        .option("--filters <url-or-query>", "Replace the view's filters: a Unibox URL or its query string.")
+        .option("--filters <url-or-query>", "Replace the view's filters: a Unibox URL or its query string (the `inbox list` filter keys; without segment the view opens on the Primary tab).")
         .option("--position <n>", "Zero-based order in the team's list.")
         .option("--default", "Make it your own default view.")
         .option("--no-default", "Stop using it as your default view (you open on the built-in view).")
@@ -15948,7 +16116,7 @@ Examples:
         });
     })))
         .addCommand(addContractFlags(new Command("analytics")
-        .description("Show selected-window sequencer analytics with persisted status kept separate from operational state, fleet marked-active versus operationally-live counts, current open work, sent/terminal-failed/deferral totals, failure classes, and action-kind breakdowns. Also includes per-sequence funnels and native email attribution under analytics.emailAttribution: byMailbox, byDomain, and explicit unattributed facts. With --sequence, analytics.senderPerformance groups channel-conditional counts and rates by sending person; analytics.messagePerformance reports each copy-bearing deterministic step variant, target/actual distribution, contacted recipients, and type-specific accepted/reply/positive outcomes (absent for note-less connect-only campaigns). Message-level reply outcomes require preserved step/variant provenance, so older unattributed replies remain in campaign totals without being guessed into a message row. Provider-owned campaigns appear only after their telemetry is normalized into Oxygen's native Sequence ledgers. Also reports whether the reply → CRM automation is armed, with a link to the workflow.")
+        .description("Show selected-window sequencer analytics with persisted status kept separate from operational state, fleet marked-active versus operationally-live counts, current open work, sent/terminal-failed/deferral totals, failure classes, and action-kind breakdowns. Also includes per-sequence funnels and native email attribution under analytics.emailAttribution: byMailbox, byDomain, and explicit unattributed facts. With --sequence, analytics.senderPerformance groups channel-conditional counts and rates by sending person; analytics.messagePerformance reports each copy-bearing deterministic step variant, target/actual distribution, contacted recipients, and type-specific accepted/reply/positive outcomes (absent for note-less connect-only campaigns). Message-level reply outcomes require preserved step/variant provenance, so older unattributed replies remain in campaign totals without being guessed into a message row. Provider-owned campaigns appear only after their telemetry is normalized into Oxygen's native Sequence ledgers. Also reports whether the reply → CRM automation is armed, with a link to the workflow. Omit --projection for all sections in one read; --projection value --path /analytics selects all analytics sections. value_json is escaped JSON text, paged losslessly with value_cursor.")
         .option("--sender <id>", "Filter to one sender from `oxygen senders list` or `oxygen senders profiles list`, or a key from this output's senders list. Repeatable.", collectRepeatable, [])
         .option("--json", "Print a JSON envelope."), SEQUENCE_ANALYTICS_READ_CONTRACT, {
         range: { valueName: "<preset>", parse: readOption },
@@ -16224,7 +16392,7 @@ Examples:
         });
     }))
         .addCommand(new Command("get")
-        .description("Get a sequence's definition, senders, status, and credit usage. --readiness adds the launch check — whether it CAN go live, why not, and the mailbox pool it would send from — without touching it; `sequences start <sequence>` without --approved shows who sends each step (sender_journey).")
+        .description("Get a sequence's definition, senders, status, and credit usage. --readiness adds the launch check — whether it CAN go live, why not, and the mailbox pool it would send from — without touching it; `sequences preview <sequence>` (a read; 0 credits) shows who sends each step (sender_journey).")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--readiness", "Add launch_readiness: blockers (e.g. a missing send cap), warnings, and the resolved sending mailboxes. Read-only — sends nothing, changes nothing, spends nothing. Skips the LinkedIn rendered-copy scan, which stays in `sequences start` without --approved.")
         .option("--json", "Print a JSON envelope.")
@@ -16232,7 +16400,7 @@ Examples:
         await handleAsyncAction("sequences get", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}${options.readiness ? "?include=readiness" : ""}`));
     }))
         .addCommand(new Command("enroll")
-        .description("Enroll leads into a sequence. Enrolling spends no credits. An active sequence contacts the new leads on its next dispatch tick; a draft or paused one holds them until `sequences start`. --from-table enrolls every not-yet-enrolled row of the sequence's bound source table (up to 500 per run; the response's from_table.has_more says whether to run again) — for a LinkedIn sequence the profile is read from the bound table's URL column, where a full /in/ URL and a bare public handle carrying a hyphen or digit (ada-lovelace) both work, so no pre-resolved provider ids are needed; each handle Oxygen canonicalized is echoed in linkedin_handles_canonicalized (value + url) to check before start, and every row that still cannot be resolved is named in unresolved_linkedin_lead_details (row, value, reason) rather than only counted in unresolved_linkedin_leads. --leads-file enrolls an explicit JSON list { leads: [...] }: for an email/WhatsApp sequence a lead identified only by an email (row_values.email) or phone (row_values.phone) is auto-filed as a row in the sequence's leads table (auto-creating and binding one if there is none), deduped by email/phone, so no table has to exist first (the table is returned as leads_table with a web_url); a LinkedIn lead needs a lead_provider_id, a lead_profile_url (a /in/ URL or a bare public handle with a hyphen or digit), or a table_row_id whose row carries one of those. A CRM-only lead needs a stable table_row_id or lead_provider_id in addition to mapped row_values; a HubSpot contact id used in crm_task associations identifies the destination record, not the Oxygen enrollment. When the sequence is bound to a source table, a lead's table_row_id auto-snapshots that row's columns (incl. AI/tool outputs) into row_values for {{column}} copy — explicit row_values win. Idempotent per table row (and per email/phone for auto-filed leads). WhatsApp-only campaigns also enroll each normalized number once across all source rows and enrollment statuses; mixed campaigns keep other channels and skip duplicate WhatsApp actions. Duplicate protection defaults to this campaign; --whatsapp-duplicate-scope on create/update can additionally block identical copy across all campaigns. The org do-not-contact list is always enforced; --exclude-contacted and --suppress-list add further opt-in skips (reported under skipped_by_reason). Leads already owned by a sender account (from an earlier real send) are routed back to that same account; a lead owned by a sender NOT on this sequence is skipped (bound_to_other_sender) unless --ignore-sender-bindings. This enrolls into an OXYGEN Sequence; to put the same rows into a campaign you already run in Smartlead, Instantly, lemlist or HeyReach, use `sequences push-external`.")
+        .description("Enroll leads into a sequence. Enrolling spends no credits. An active sequence contacts the new leads on its next dispatch tick; a draft or paused one holds them until `sequences start`. --from-table enrolls every not-yet-enrolled row of the sequence's bound source table (up to 500 per run; the response's from_table.has_more says whether to run again) — for a LinkedIn sequence the profile is read from the bound table's URL column, where a full /in/ URL and a bare public handle carrying a hyphen or digit (ada-lovelace) both work, so no pre-resolved provider ids are needed; each handle Oxygen canonicalized is echoed in linkedin_handles_canonicalized (value + url) to check before start, and every row that still cannot be resolved is named in unresolved_linkedin_lead_details (row, value, reason) rather than only counted in unresolved_linkedin_leads. In a LinkedIn + email sequence a row with no usable profile but a recipient email is still enrolled for the email steps (its LinkedIn steps are skipped as no_linkedin_profile, a connection wait passes at once and a connection branch takes its not-connected path) and is listed in linkedin_unavailable_lead_details instead; unresolved_linkedin_leads names only rows that were not enrolled. --leads-file enrolls an explicit JSON list { leads: [...] }: for an email/WhatsApp sequence a lead identified only by an email (row_values.email) or phone (row_values.phone) is auto-filed as a row in the sequence's leads table (auto-creating and binding one if there is none), deduped by email/phone, so no table has to exist first (the table is returned as leads_table with a web_url); a LinkedIn + email sequence auto-files an email-only lead the same way; a LinkedIn lead needs a lead_provider_id, a lead_profile_url (a /in/ URL or a bare public handle with a hyphen or digit), or a table_row_id whose row carries one of those. A CRM-only lead needs a stable table_row_id or lead_provider_id in addition to mapped row_values; a HubSpot contact id used in crm_task associations identifies the destination record, not the Oxygen enrollment. When the sequence is bound to a source table, a lead's table_row_id auto-snapshots that row's columns (incl. AI/tool outputs) into row_values for {{column}} copy — explicit row_values win. Idempotent per table row (and per email/phone for auto-filed leads). WhatsApp-only campaigns also enroll each normalized number once across all source rows and enrollment statuses; mixed campaigns keep other channels and skip duplicate WhatsApp actions. Duplicate protection defaults to this campaign; --whatsapp-duplicate-scope on create/update can additionally block identical copy across all campaigns. The org do-not-contact list is always enforced; --exclude-contacted and --suppress-list add further opt-in skips (reported under skipped_by_reason). Leads already owned by a sender account (from an earlier real send) are routed back to that same account; a lead owned by a sender NOT on this sequence is skipped (bound_to_other_sender) unless --ignore-sender-bindings. This enrolls into an OXYGEN Sequence; to put the same rows into a campaign you already run in Smartlead, Instantly, lemlist or HeyReach, use `sequences push-external`. esp.pool_scope identifies the active workspace inventory used for routing and strict_deferred_leads estimates; these estimates omit sequence sender restrictions, readiness and daily limits. A zero estimate does not guarantee readiness. Review sequences preview before launch.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--leads-file <path>", "Path to a JSON file: { \"leads\": [{ row_values: { email }, lead_name }] } for cold email; { lead_provider_id, lead_name, table_row_id, row_values } for LinkedIn/existing rows; CRM-only leads require table_row_id or a stable lead_provider_id alongside mapped row_values. A CRM association object id is not the enrollment identity. Exactly one of --leads-file or --from-table.")
         .option("--from-table", "Enroll every not-yet-enrolled row of the sequence's bound source table (up to 500 per run; re-run to continue). Exactly one of --leads-file or --from-table.")
@@ -16323,7 +16491,7 @@ Examples:
         }, formatSequencePushExternal);
     }))
         .addCommand(new Command("start")
-        .description("Preview or start a sequence. Without --approved this is the launch check and changes nothing: it returns launch_readiness (blockers such as a missing send cap or the WhatsApp cold-initiate opt-in, plus warnings), who sends each step (sender_journey: each step's From, its candidate inboxes and how a lead's inbox is picked; no leads needed), scans pending LinkedIn copy, and returns exact rendered recipient samples, character counts/limits, copy blockers, per-kind scope, sender/mailbox capacity, CRM readiness, and safety caps. Live start requires --approved; --max-credits is optional. Email/WhatsApp/CRM-task journeys additionally require --max-live-sends because their external actions cost 0 Oxygen credits. --dry-run is not this preview: it starts the sequence in simulated mode (it leaves draft), with no send, provider campaign, CRM task, or credits. The first live start also switches on the standing reply → CRM automation for the workspace.")
+        .description("Preview or start a sequence. Without --approved this is the launch check and changes nothing: it returns launch_readiness (blockers and warnings), sender_journey (each step's From, candidate inboxes and assignment; no leads needed), rendered pending-lead LinkedIn/WhatsApp copy, character counts/limits, copy blockers, per-kind scope, sender/mailbox capacity, CRM readiness and safety caps. Email copy is not rendered; inspect its saved templates and unsubscribe settings with sequences get. Live start requires --approved; --max-credits is optional. Email/WhatsApp/CRM-task journeys additionally require --max-live-sends because their external actions cost 0 Oxygen credits. --dry-run starts the sequence in simulated mode (it leaves draft), with no send, provider campaign, CRM task or credits. Live start enables the standing reply → CRM automation only if it has never been configured. Planned counts include only leads each step's channel can reach; skipped_actions_by_reason and channel_coverage show the rest.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--approved", "Approve and activate live. Without this flag, returns a preview only, including copy_preview rendered samples and blockers.")
         .option("--max-credits <n>", "Optional positive credit ceiling. Omit for the free launch preview. Live start uses the saved ceiling when omitted; an unset ceiling means unbounded credits, not recipient approval.")
@@ -16344,6 +16512,15 @@ Examples:
                 },
             });
         });
+    }))
+        .addCommand(new Command("preview")
+        .description("The free launch check, as a read: the same preview sequences start returns without --approved. It returns launch_readiness (blockers and warnings), sender_journey (who sends each step and how an inbox is picked), copy_preview (rendered pending-lead LinkedIn/WhatsApp copy, character counts and scan), caps and estimated credits. Email copy is not rendered; inspect its saved templates and unsubscribe settings with sequences get. Changes nothing and costs 0 credits; it never starts, resumes or dry-runs the sequence. Start with sequences start <sequence> --approved after review. Planned counts include only leads each step's channel can reach; skipped_actions_by_reason, channel_coverage and copy_preview.skipped_leads show the rest.")
+        .argument("<sequence>", "Sequence id or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleAsyncAction("sequences preview", options, () => 
+        // The start route's preview branch: no approved, no dry_run, no ceilings.
+        requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/start`, { method: "POST", body: {} }));
     }))
         .addCommand(new Command("signal")
         .description("Record an external GTM signal (e.g. linkedin_connected, email_replied, company_raised_funds, job_change, web_visit, intent) onto a running sequence's enrollment(s) to drive signal-triggered branch/wait control. Target an enrollment by --enrollment or --lead (at least one is required); the server validates the signal name.")
@@ -16375,7 +16552,7 @@ Examples:
         }));
     }))
         .addCommand(new Command("resume")
-        .description("Resume a paused sequence.")
+        .description("Resume a paused sequence. A campaign paused at its live send cap pauses again at once: raise the cap and resume in one step with `sequences start <sequence> --max-live-sends <n>` (preview, then --approved).")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
@@ -16392,10 +16569,15 @@ Examples:
         await handleAsyncAction("sequences delete", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}${options.approved ? "?approved=true" : ""}`, { method: "DELETE" }));
     }))
         .addCommand(new Command("enrollments")
-        .description("List per-lead enrollment state plus the latest action status, error, attempts, and retry time. missing_source_row is true for a lead whose source-table row was deleted: still enrolled and contacted (remove with `contacts-remove --missing-source-rows`); null when the campaign has no live source table to check against, or the check failed.")
+        .description("List per-lead enrollment state plus the latest action status, error, attempts, and retry time. --view compact answers 'when is each lead's next message due' per lead: lead, status, invite (accepted, pending, not_invited), accepted_at, current_step and next_due. next_due.summary says it in words, at_local/gives_up_at_local give the time in the campaign's timezone (its schedule's, else UTC) and at/gives_up_at in UTC. Reasons: step_scheduled (planned send time; held_by names what holds it, e.g. send_cap_reached), planner_due (when the planner next looks at the lead), not_started (begins when the campaign is started or resumed), nothing_scheduled (enrolled, no step will run), waiting_for_connection / waiting_for_signal (no send time; acceptance makes the next step due at once; gives_up_at is when the wait ends, and on_timeout says whether the lead then leaves or moves on), finished. A failed lead carries failure: the cause in words (cause_recorded false when OXYGEN never recorded one) and provider_contact (made; none = the step never started; nothing_sent; unknown). missing_source_row is true for a lead whose source-table row was deleted: still enrolled and contacted (remove with `contacts-remove --missing-source-rows`); null when the campaign has no live source table to check against, or the check failed. channels says which of the sequence's channels reach each lead: usable, and unavailable with a reason (no_linkedin_profile = enrolled for email only, its LinkedIn steps are skipped; no_recipient_email; no_phone_number).")
         .argument("<sequence>", "Sequence id or slug.")
-        .option("--status <status>", "Filter by enrollment status (active, waiting_connection, replied, completed, stopped, failed).")
+        .option("--status <status>", "Filter by enrollment status (pending, active, waiting_connection, waiting_signal, replied, completed, stopped, failed, excluded). pending = enrolled, not started (next_due not_started); waiting_connection = invite sent, not accepted yet. Status is the lead's progress, not its invite: use --invite accepted for the leads that accepted.")
+        .option("--step <n>", "Only leads currently on this step (0-based index, as in the sequence's steps).")
+        .option("--invite <state>", "Only leads in this LinkedIn invite state: accepted (invited and connected), pending (invited, not accepted yet) or not_invited (no invite: already connected before, suppressed or email-only).")
+        .option("--view <view>", "full (default, every enrollment field) or compact (one short row per lead with next_due in words and local time).")
+        .option("--order <order>", "created (default) or due: soonest next_due first, then waiting leads by gives_up_at, then leads with nothing due.")
         .option("--limit <n>", "Maximum enrollments to return (1-500).")
+        .option("--offset <n>", "Skip this many enrollments; pass next_offset from the previous page to continue.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences enrollments", options, () => {
@@ -16403,9 +16585,24 @@ Examples:
             const status = readOption(options.status);
             if (status)
                 params.set("status", status);
+            const step = readOption(options.step);
+            if (step)
+                params.set("step", step);
+            const invite = readOption(options.invite);
+            if (invite)
+                params.set("invite", invite);
+            const view = readOption(options.view);
+            if (view)
+                params.set("view", view);
+            const order = readOption(options.order);
+            if (order)
+                params.set("order", order);
             const limit = readOption(options.limit);
             if (limit)
                 params.set("limit", limit);
+            const offset = readOption(options.offset);
+            if (offset)
+                params.set("offset", offset);
             const suffix = params.toString();
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/enrollments${suffix ? `?${suffix}` : ""}`);
         });
@@ -16581,7 +16778,7 @@ Examples:
         });
     }))
         .addCommand(new Command("reconcile")
-        .description("Safely reconcile one ambiguous LinkedIn invite/message from provider reads. Preview-only unless --approved; never resends.")
+        .description("Safely reconcile one ambiguous LinkedIn invite/message from provider reads. Zero credits. Preview-only unless --approved; never resends.")
         .argument("<sequence>", "Sequence id or slug. The sequence must be paused.")
         .requiredOption("--action <id>", "Failed/canceled live action UUID to reconcile.")
         .option("--approved", "Apply an exact provider match to local state. No provider write or resend occurs.")
@@ -17494,55 +17691,21 @@ Examples:
             });
         });
     })))
-        .addCommand(new Command("domains")
-        .description("List the org's whole-domain email blocks, newest first. Filter by --reason (manual | complaint | policy) or --search (case-insensitive substring of the domain).")
-        .option("--reason <reason>", "Filter by reason: manual, complaint, policy.")
-        .option("--search <text>", "Case-insensitive substring match on the domain.")
-        .option("--limit <n>", "Maximum domain blocks to return (1-500; default 100).")
-        .option("--offset <n>", "Pagination offset (0-based).")
+        .addCommand(addSuppressionListFlags(new Command("domains")
+        .description("List the org's whole-domain email blocks, newest first. Filter by --reason (manual | complaint | policy) or --search (case-insensitive substring of the domain)."), "domains")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("suppressions domains", options, () => {
-            const params = new URLSearchParams();
-            const reason = readOption(options.reason);
-            if (reason)
-                params.set("reason", reason);
-            const search = readOption(options.search);
-            if (search)
-                params.set("search", search);
-            const limit = readOption(options.limit);
-            if (limit)
-                params.set("limit", limit);
-            const offset = readOption(options.offset);
-            if (offset)
-                params.set("offset", offset);
-            const suffix = params.toString();
+            const suffix = suppressionListQuery(options, "domains");
             return requestOxygen(`/api/cli/suppressions/domains${suffix ? `?${suffix}` : ""}`);
         });
     }))
-        .addCommand(new Command("addresses")
-        .description("List the org's blocked email ADDRESSES, newest first (bounces, unsubscribes, and `suppressions import` land here). Filter by --reason (hard_bounce | complaint | unsubscribe | manual) or --search (case-insensitive substring of the address). Rows carry a CRM person name when one matches.")
-        .option("--reason <reason>", "Filter by reason: hard_bounce, complaint, unsubscribe, manual.")
-        .option("--search <text>", "Case-insensitive substring match on the address.")
-        .option("--limit <n>", "Maximum addresses to return (1-500; default 100).")
-        .option("--offset <n>", "Pagination offset (0-based).")
+        .addCommand(addSuppressionListFlags(new Command("addresses")
+        .description("List the org's blocked email ADDRESSES, newest first (bounces, unsubscribes, and `suppressions import` land here). Filter by --reason (hard_bounce | complaint | unsubscribe | manual) or --search (case-insensitive substring of the address). Rows carry a CRM person name when one matches."), "addresses")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("suppressions addresses", options, () => {
-            const params = new URLSearchParams();
-            const reason = readOption(options.reason);
-            if (reason)
-                params.set("reason", reason);
-            const search = readOption(options.search);
-            if (search)
-                params.set("search", search);
-            const limit = readOption(options.limit);
-            if (limit)
-                params.set("limit", limit);
-            const offset = readOption(options.offset);
-            if (offset)
-                params.set("offset", offset);
-            const suffix = params.toString();
+            const suffix = suppressionListQuery(options, "addresses");
             return requestOxygen(`/api/cli/suppressions/addresses${suffix ? `?${suffix}` : ""}`);
         });
     }))
@@ -18262,7 +18425,7 @@ Examples:
             : requestOxygen(`/api/cli/mailboxes/sync?${new URLSearchParams({ mailbox }).toString()}`));
     }))
         .addCommand(new Command("connect-oauth")
-        .description("Connect Gmail/Microsoft 365 with --vendor composio to import all mail into Unibox and business activity into CRM. Each connected own mailbox costs 100 credits/month including history, sync and analysis; previews cost 0, with no extra execution fee. Managed OAuth requires provider rollout readiness and exact registered addresses, max 10. Use mailboxes sync for progress and pause/resume/disconnect. Composio uses individual owner consent only. Native --vendor oxygen retains its existing polling; full history/CRM requires managed reconnection. Quote any mailbox count with billing estimate --mailboxes <n> --json. Warm-up retains its existing eligibility and pricing. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. For --vendor oxygen only, Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). For Microsoft's built-in roles, tenant mode requires a Global Administrator or Privileged Role Administrator because it requests the Microsoft Graph application Mail.Send and Mail.Read permissions; Application Administrator and Cloud Application Administrator cannot consent to Microsoft Graph application roles. Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. For non-managed Microsoft mailboxes, native-send approval does not authorize OXYGEN Warm-up: every mailbox still needs its own `mailboxes warmup microsoft` Outlook consent before standalone enrollment. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options.")
+        .description("Connect Gmail/Microsoft 365 with --vendor composio to import all mail into Unibox and business activity into CRM. The listed recurring rate is 100 credits per mailbox per month including history, sync and analysis; previews cost 0, with no extra execution fee. Before consent, inspect current monthly connection prices and first-debit timing with billing commitments --view connection-prices --json. Quote a mailbox count with billing estimate --mailboxes <n> --json; the managed preview shows the listed rate; an unavailable managed connection directs you to OXYGEN support. Managed OAuth requires provider rollout readiness and exact registered addresses, max 10. Use mailboxes sync for progress and pause/resume/disconnect. Composio uses individual owner consent only. Native --vendor oxygen retains its existing polling; full history/CRM requires managed reconnection. Warm-up retains its existing eligibility and pricing. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. For --vendor oxygen only, Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). For Microsoft's built-in roles, tenant mode requires a Global Administrator or Privileged Role Administrator because it requests the Microsoft Graph application Mail.Send and Mail.Read permissions; Application Administrator and Cloud Application Administrator cannot consent to Microsoft Graph application roles. Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. For non-managed Microsoft mailboxes, native-send approval does not authorize OXYGEN Warm-up: every mailbox still needs its own `mailboxes warmup microsoft` Outlook consent before standalone enrollment. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options.")
         .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--provider <provider>", "Mailbox provider: google or microsoft.")
         .option("--vendor <vendor>", "Authorization path: composio for customer-owned Gmail/Microsoft 365 with managed consent, history and CRM; oxygen for native/tenant consent; zapmail (default) or inboxkit for provisioned inboxes.")
@@ -18455,7 +18618,7 @@ Examples:
         .option("--approved", "Execute the PRICED enrollment. Without it the response is a priced preview and nothing is enrolled or billed.")
         .option("--plan <hash>", "Hash from the fresh preview (required with --approved).")
         .option("--max-credits <n>", "Hard first-cycle credit cap from the preview (required with --approved).")
-        .option("--ramp-weeks <n>", "Auto-unenroll after this many weeks (the ramp window) so billing stops by itself.")
+        .option("--ramp-weeks <n>", "Weeks the warm-up volume climb is spread over (default 4). A paid enrollment completes its ramp after 28 days with a provider-confirmed warm-up send, then keeps warming at 10 a day until you disable it.")
         .option("--dry-run", "Simulate without calling the provider (mailboxes marked pending).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -18492,6 +18655,29 @@ Examples:
                 },
             });
         });
+    }))
+        .addCommand(new Command("google")
+        .description("Authorize one to ten connected Google inboxes for OXYGEN Warm-up. Separate from native sending: no passwords or OXYGEN tokens transfer. Preview costs 0 credits and creates no link. Approve its hash with --max-credits 0, open each consent_url as that exact inbox, then poll --status. Google shows the warm-up provider's consent application. Warmup stays off until a separately approved warmup enable; its fresh preview shows the price, including 0 extra credits when included in the mailbox connection.")
+        .requiredOption("--mailboxes <list>", "Exact Google inbox ids or addresses, comma-separated; maximum ten.")
+        .option("--approved", "Create the previewed authorization links.")
+        .option("--plan <hash>", "Fresh preview hash; required with approval.")
+        .option("--max-credits <n>", "Exactly 0; required with approval.")
+        .option("--status", "Verify completed Google authorizations; never starts warmup.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("mailboxes warmup google", options, () => {
+            const mailboxes = readCsvOption(options.mailboxes);
+            const planHash = readOption(options.plan);
+            const maxCredits = options.maxCredits === undefined ? undefined : readNonNegativeNumber(options.maxCredits);
+            if (options.approved && options.status)
+                throw new Error("Status and approval cannot be combined.");
+            if (options.approved && (!planHash || maxCredits !== 0))
+                throw new Error("Approval requires a fresh --plan and --max-credits 0.");
+            return requestOxygen("/api/cli/mailboxes/warmup/google", { method: "POST", body: {
+                    mailboxes, ...(options.approved ? { approved: true } : {}), ...(options.status ? { status: true } : {}),
+                    ...(planHash ? { plan_hash: planHash } : {}), ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                } });
+        });
     }))
         .addCommand(new Command("microsoft")
         .description("NON-INBOXKIT FALLBACK ONLY: authorize eligible Microsoft/Outlook mailboxes for OXYGEN Warm-up with ONE browser consent PER MAILBOX, never a password or app password. Do not run this for managed InboxKit mailboxes: fresh Microsoft/Azure orders activate native InboxKit warm-up exports automatically when the approved order includes warmup; opted-out or later separate managed enrollment uses standalone `warmup enable`. For the non-InboxKit fallback there is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact fallback mailboxes and outstanding links at 0 credits. Approve that fresh hash with --max-credits 0, open every returned consent_url, then re-run with --status. Warmup itself stays OFF until standalone `warmup enable`.")
@@ -18758,6 +18944,7 @@ Examples:
         .addOption(new Option("--provider <provider>", "Health provider: emailguard, zapmail, or sendkit. Omit to auto-resolve EmailGuard/Zapmail. SendKit is never auto-selected and requires the configured dev canary sender.").choices(["emailguard", "zapmail", "sendkit"]))
         .option("--subject <subject>", "Seed-message subject. Required with --provider sendkit; Zapmail ignores it beyond labeling the test.")
         .option("--body <text>", "Plain-text seed-message body. Required with --provider sendkit; ignored by Zapmail.")
+        .option("--allow-paused-probe", "Opt in to one diagnostic probe while preserving campaign pause; repeat at both create and send approvals. Never permits disabled senders.")
         .option("--approved", "Actually run the test (otherwise a preview is returned).")
         .option("--max-credits <n>", "Credit cap the caller accepts (must be >= credits_required for managed runs).")
         .option("--plan <hash>", "plan_hash from a fresh create preview (required with --approved).")
@@ -18777,6 +18964,7 @@ Examples:
                     ? { body_text: readOption(options.body) }
                     : {}),
                 ...(options.approved ? { approved: true } : {}),
+                ...(options.allowPausedProbe ? { allow_paused_probe: true } : {}),
                 ...(readOption(options.maxCredits)
                     ? {
                         max_credits: Number(readOption(options.maxCredits)),
@@ -18791,6 +18979,7 @@ Examples:
         .addCommand(new Command("send")
         .description("Preview or send the exact EmailGuard seed message for a provider-created test. Preview returns sender, all recipients, exact content, and plan_hash. Live send requires --approved --plan <hash>, costs 0 additional credits, and sends one message only.")
         .argument("<id>", "Oxygen placement-test id returned by `placement-test run`.")
+        .option("--allow-paused-probe", "Opt in to one diagnostic probe while preserving campaign pause; repeat at both create and send approvals. Never permits disabled senders.")
         .option("--approved", "Send the exact previewed seed message (otherwise preview only).")
         .option("--plan <hash>", "plan_hash from a fresh send preview (required with --approved).")
         .option("--json", "Print a JSON envelope.")
@@ -18799,6 +18988,7 @@ Examples:
             method: "POST",
             body: {
                 ...(options.approved ? { approved: true } : {}),
+                ...(options.allowPausedProbe ? { allow_paused_probe: true } : {}),
                 ...(readOption(options.plan)
                     ? { plan_hash: readOption(options.plan) }
                     : {}),
@@ -18825,11 +19015,11 @@ Examples:
     program.addCommand(new Command("domains")
         .description("Cold-email domains: sync zones from your own Cloudflare account (BYOK), inspect age/warmup/DNS health, check availability and pricing, buy domains, and archive or delete domains with their inboxes (OXYGEN-bought domains included). Your own Cloudflare account bills purchases to its payment method; domains registered by OXYGEN cost credits at the vendor price. Preview `domains buy` before approval.")
         .addCommand(new Command("list")
-        .description("List the org's cached Cloudflare domains with cold-email metadata (age, mailboxes, warmup, sending volume, DNS health). Each row's `dns` object explains the status (ok, issues, not checked, check failed, partial check, no zone) with a reason and fix path; `managed_domains` lists InboxKit-managed bundle domains (vendor-registered + vendor-DNS'd — manage via `managed-inboxes`), each carrying `internal_billing_status` (ok|past_due) and `last_billed_cycle_key` — a domain the vendor keeps live can still be one OXYGEN could not renew. Reads the cache only — run `domains sync` to refresh.")
+        .description("List the org's cached Cloudflare domains with cold-email metadata (age, mailboxes, warmup, sending volume, DNS health). Each row's `dns` object explains the status (ok, issues, not checked, check failed, partial check, no zone) with a reason and fix path; `managed_domains` lists InboxKit-managed bundle domains (vendor-registered + vendor-DNS'd — manage via `managed-inboxes`), each carrying `internal_billing_status` (ok|past_due) and `last_billed_cycle_key` — a domain the vendor keeps live can still be one OXYGEN could not renew. summary.by_dns_state gives all DNS-state counts in one read. volume.outbound_30d counts outbound email messages in the synced inbox ledger, including mail outside Sequences. Reads the cache only — run `domains sync` to refresh.")
         .option("--status <status>", "Filter by zone status: unknown, initializing, pending, active, moved, or deleted.")
         .option("--registrar <registrar>", "Filter by registrar name.")
         .option("--q <text>", "Filter by domain substring.")
-        .option("--dns <state>", "Filter by the derived DNS state: ok, issues, not_checked, check_failed, check_incomplete, or no_zone.")
+        .option("--dns <state>", "Filter by one derived DNS state: ok, issues, not_checked, check_failed, check_incomplete, or no_zone; summary.by_dns_state gives all state counts.")
         .option("--expiring", "Only non-deleted domains expiring within 60 days.")
         .option("--has-mailboxes <bool>", "true → only domains with sending mailboxes; false → only domains without.")
         .option("--include-archived", "Include archived domains (hidden by default).")
@@ -19240,6 +19430,14 @@ Examples:
         .action(async (callable, options) => {
         await handleAsyncAction("callables disable", options, () => requestOxygen("/api/cli/callables/status", { method: "POST", body: { callable, status: "disabled" } }));
     }));
+    const workflowRunReadbackHelp = `
+Stored run values:
+  oxygen workflows runs --run-id <run_id> --projection value --path /runs/0/output --json
+  Canonical graph output is a steps map keyed by node id.
+  Read the observed cost receipt with oxygen workflows run <run_id> --json.
+  For large values, follow next_value_cursor with --value-cursor and the same selection.
+  Append value_json fragments in offset order until next_value_cursor is null, then parse the combined JSON.
+`;
     program
         .command("workflows")
         .description("Durable workflow automation commands.")
@@ -19269,8 +19467,10 @@ without --draft publishes the revision; calling or enabling it remains a separat
 execution/authorization step.
 
 Run completion:
-  Calls enqueue asynchronously. Follow the returned run_id with:
+  Calls without --preview enqueue asynchronously. Use the returned data.run.id as <run_id>:
   oxygen workflows tail <run_id>
+  Preview calls return data.preview and create no run.
+${workflowRunReadbackHelp}
 `)
         .addCommand(new Command("templates")
         .description("Deprecated aliases for `oxygen blueprints` — these route through the canonical blueprint surface (built-in seed templates plus this workspace's saved blueprints).")
@@ -19501,7 +19701,7 @@ Run completion:
         });
     }))
         .addCommand(new Command("get")
-        .description("Get one workflow automation, including any cron slowdown to your plan's minimum interval.")
+        .description("Get one workflow automation, including any cron slowdown to your plan's minimum interval and `draftRevision` when a saved revision is newer than the published one. The top-level `status` is the live state; `manifest.workflow.status` is what the revision was authored with and does not change on enable or disable.")
         .argument("<workflow>", "Workflow id, slug, or name.")
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
@@ -19509,6 +19709,7 @@ Run completion:
         await handleAsyncAction("workflows get", options, async () => {
             const data = await requestOxygen("/api/cli/workflows/get", {
                 method: "POST",
+                readOnly: true,
                 body: { workflow },
             });
             if (!options.json) {
@@ -19551,12 +19752,12 @@ Run completion:
         }), options));
     }))
         .addCommand(new Command("call")
-        .description("Run a workflow — or preview it first. `--preview` shows every step that leaves Oxygen, the accounts it would use, and what one run costs, without running anything. Enqueues asynchronously without simulating the trigger; follow the returned run_id with `oxygen workflows tail <run_id>`.")
+        .description("Run a workflow — or preview it first. `--preview` returns data.preview without creating a run: it shows every step that leaves Oxygen, the accounts it would use, and what one run costs. Calls without --preview enqueue asynchronously without simulating the trigger; use the returned data.run.id as <run_id> in `oxygen workflows tail <run_id>`.")
         .argument("[workflow]", "Workflow id, slug, or name.")
         .option("--workflow <workflow>", "Workflow id, slug, or name.")
         .option("--workflow-id <workflow_id>", "Workflow id or slug.")
         .option("--workflow-name <workflow_name>", "Workflow name.")
-        .option("--input-json <json>", "Workflow input object. Defaults to {}.")
+        .option("--input-json <json>", "Workflow input object in every mode, including smoke-test. Defaults to {}.")
         .option("--mode <mode>", "Execution mode. smoke-test/dry-run: 0 credits, no paid provider calls or external writes; internal reads still execute. live: may spend/write and requires approval + cap. Not needed with --preview, which runs nothing.")
         .option("--idempotency-key <key>", "Optional idempotency key.")
         .option("--max-credits <n>", "Required credit ceiling for live calls.")
@@ -19567,7 +19768,8 @@ Run completion:
         .option("--preview", "Show what a live run of this exact version would do — every step that leaves Oxygen, the accounts it would use, and the minimum number of billable steps and credits it would cost — without running anything. AI and enrichment steps bill per row and can cost more than that floor. Needs no --mode: it always describes a live run.")
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
-        .addHelpText("after", "\nSafety: smoke_test and dry_run share one boundary: 0 credits, no paid provider calls, no external writes. Oxygen internal reads use current workspace data, and oxygen.http_json_request may make a real outbound GET. Every mode creates an inspectable Workflow run record.\n\n--node scopes a test to one step. Oxygen plans the slice on the server from the exact saved version and records it on the run, so the run shows precisely which nodes were allowed to execute; you never submit a node list. Selecting the trigger, a disabled node, or a node unreachable from the trigger is refused with the reason. Only canonical graph workflows support it.\n")
+        .addHelpText("after", "\nSafety: smoke_test and dry_run share one boundary: 0 credits, no paid provider calls, no external writes. Oxygen internal reads use current workspace data, and oxygen.http_json_request may make a real outbound GET. Every execution mode creates an inspectable Workflow run record; --preview creates none.\n\n--node scopes a test to one step. Oxygen plans the slice on the server from the exact saved version and records it on the run, so the run shows precisely which nodes were allowed to execute; you never submit a node list. Selecting the trigger, a disabled node, or a node unreachable from the trigger is refused with the reason. Only canonical graph workflows support it.\n")
+        .addHelpText("after", workflowRunReadbackHelp)
         .action(async (workflowArg, options) => {
         const maxCredits = readPositiveNumber(options.maxCredits);
         const revisionVersion = readPositiveNumber(options.revision);
@@ -19581,15 +19783,18 @@ Run completion:
             if (!options.preview && !readOption(options.mode)) {
                 throw new OxygenError("invalid_request", "--mode is required. Use smoke-test, dry-run, or live. To see what a live run would do without running it, use --preview — it runs nothing and needs no mode.", { exitCode: 2 });
             }
+            const idempotencyKey = readOption(options.idempotencyKey);
             return prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/call", {
                 method: "POST",
+                ...(options.preview ? { previewOnly: true } : {}),
+                ...(idempotencyKey ? { idempotencyKey } : {}),
                 body: {
                     workflow: readOption(workflowArg) ?? readOption(options.workflow),
                     ...(readOption(options.workflowId) ? { workflow_id: readOption(options.workflowId) } : {}),
                     ...(readOption(options.workflowName) ? { workflow_name: readOption(options.workflowName) } : {}),
                     input: options.inputJson ? parseJsonObject(options.inputJson) : {},
                     ...(readOption(options.mode) ? { mode: readOption(options.mode) } : {}),
-                    ...(readOption(options.idempotencyKey) ? { idempotency_key: readOption(options.idempotencyKey) } : {}),
+                    ...(idempotencyKey ? { idempotency_key: idempotencyKey } : {}),
                     ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
                     ...(options.approved ? { approved: true } : {}),
                     ...(revisionVersion !== undefined ? { revision_version: revisionVersion } : {}),
@@ -19601,7 +19806,7 @@ Run completion:
         });
     }))
         .addCommand(new Command("webhooks")
-        .description("Workflow webhook trigger utilities. A trigger's inbound URL and the deliveries a minute it accepts (`rate_limit`) are in `oxygen workflows get <workflow>`.")
+        .description("Workflow webhook trigger utilities. A trigger's inbound URL and the deliveries a minute it accepts (`rate_limit`) are in `oxygen workflows get <workflow>`. Senders authenticate by sending the trigger's shared secret in the `x-oxygen-workflow-secret` header; a missing or wrong secret is recorded as a `rejected` delivery that starts no run and costs nothing.")
         .addCommand(new Command("rotate")
         .description("Replace a workflow webhook's shared secret. Previews by default; the old sender secret stops working immediately after approval.")
         .argument("<workflow>", "Webhook workflow id, slug, or name.")
@@ -19609,6 +19814,7 @@ Run completion:
         .option("--json", "Print a JSON envelope.")
         .action((workflow, options) => handleAsyncAction("workflows webhooks rotate", options, () => requestOxygen("/api/cli/workflows/webhooks/rotate", {
         method: "POST",
+        previewOnly: !options.approved,
         body: {
             workflow,
             ...(options.approved ? { approved: true } : {}),
@@ -19627,9 +19833,9 @@ Run completion:
         },
     }))))
         .addCommand(new Command("deliveries")
-        .description("List inbound workflow webhook deliveries: what arrived, whether it verified, and the run it started. Replays never append here; only a verified outcome=ran delivery can be replayed.")
+        .description("List inbound workflow webhook deliveries: what arrived, whether it verified, and the run it started. Stored headers never include `x-oxygen-workflow-secret`, so its absence does not show whether a rejected sender's secret was missing or wrong. Replays never append here; only a verified outcome=ran delivery can be replayed.")
         .argument("[trigger_id]", "Optional webhook trigger name, such as lead-created.")
-        .option("--workflow-id <id>", "Filter to deliveries that started a run of this workflow.")
+        .option("--workflow-id <id>", "Filter to this workflow's deliveries, including rejected and blocked ones that started no run.")
         .option("--outcome <outcome>", "Filter by rejected (sender authentication failed), blocked (authenticated, no run), or ran.")
         .option("--limit <n>", "Maximum deliveries to return. Defaults to 50.")
         .option("--json", "Print a JSON envelope.")
@@ -19835,6 +20041,7 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
         .action(async (runId, options) => {
         await handleAsyncAction("workflows run", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/run", {
             method: "POST",
+            readOnly: true,
             body: { run_id: runId },
         }), options));
     }))
@@ -19850,6 +20057,7 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
             const maxCredits = readPositiveNumber(options.maxCredits);
             return prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/retry", {
                 method: "POST",
+                previewOnly: !options.approved,
                 body: {
                     run_id: runId,
                     ...(options.approved ? { approved: true } : {}),
@@ -19860,11 +20068,12 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
     }))
         .addCommand(new Command("tail")
         .description("Poll until a workflow finishes or parks in waiting/awaiting_approval; clock waits resume automatically.")
-        .argument("<run_id>", "Workflow run UUID.")
+        .argument("<run_id>", "Workflow run UUID returned as data.run.id by workflows call; distinct from data.run.runId.")
         .option("--timeout-seconds <n>", "Maximum time to wait. Defaults to 600.")
         .option("--interval-seconds <n>", "Polling interval. Defaults to 2.")
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", workflowRunReadbackHelp)
         .action(async (runId, options) => {
         await handleAsyncAction("workflows tail", options, async () => prepareWorkflowCliOutput(await waitForWorkflowRun(runId, options), options));
     }))
@@ -19877,6 +20086,7 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
         .action(async (runId, options) => {
         await handleAsyncAction("workflows cancel", options, () => requestOxygen("/api/cli/workflows/cancel", {
             method: "POST",
+            ...(options.preview ? { previewOnly: true } : {}),
             body: {
                 run_id: runId,
                 ...(options.preview ? { preview: true } : {}),
@@ -20016,6 +20226,7 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
             const single = workflows.length === 1;
             const data = await requestOxygen("/api/cli/workflows/delete", {
                 method: "POST",
+                previewOnly: !options.yes,
                 body: {
                     ...(single ? { workflow: workflows[0] } : { workflows }),
                     ...(options.yes ? { approved: true } : {}),
@@ -20171,6 +20382,7 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
     registerFunctionsCommands(program, handleAsyncAction);
     registerUgcCommands(program, handleAsyncAction);
     registerKnowledgeRepositoryCommands(program, handleAsyncAction);
+    registerAdminLeadMagnetCommands(program, handleAsyncAction);
     registerConnectorsCommands(program, handleAsyncAction);
     registerSettingsCommands(program, handleAsyncAction);
     registerCrmSupportFlags(program);
@@ -20748,6 +20960,7 @@ function waitForWorkflowRun(runId, options) {
         fetchRun: async () => {
             latestEnvelope = await requestOxygen("/api/cli/workflows/run", {
                 method: "POST",
+                readOnly: true,
                 body: { run_id: runId },
             });
             return isRecord(latestEnvelope.run) ? latestEnvelope.run : latestEnvelope;
@@ -21056,8 +21269,17 @@ function waitForCopilotTurn(options) {
         isTerminal: isTerminalCopilotTurnStatus,
         shapeTerminal: () => latestData,
         timeoutCode: "copilot_send_timeout",
-        timeoutMessage: "Timed out waiting for the copilot turn to finish.",
+        // Only the CLI stops waiting. The turn keeps running on the server and keeps
+        // billing until it finishes or is interrupted, so the timeout says so and names
+        // the commands that read and stop it.
+        timeoutMessage: "Stopped waiting for the copilot turn. It is still running and keeps spending credits until it finishes or you interrupt it.",
         timeoutDetailIdKey: "turn_id",
+        timeoutExtraDetails: () => ({
+            session_id: options.sessionId,
+            turn_still_running: true,
+            next_step: `oxygen copilot get ${options.sessionId}`,
+            interrupt_command: `oxygen copilot interrupt ${options.sessionId} ${options.turnId}`,
+        }),
     });
 }
 function workflowTemplateActionBody(templateId, options) {
@@ -26639,11 +26861,23 @@ function formatCrmObjects(data) {
         // System attributes are bookkeeping, not fields anyone chose.
         const fieldCount = attributes.filter((attribute) => attribute.attributeKind !== "system").length;
         const primary = identities.find((identity) => identity.isPrimary === true) ?? identities[0];
+        // A compact projection carries no attributes or identities (and an older
+        // server no standardKey): print what it does carry, never "custom, 0
+        // fields, can duplicate" for companies/people/deals.
+        const compact = !Array.isArray(object.attributes);
+        const kind = object.standardKey ? "standard" : object.standardKey === null || !compact ? "custom" : "—";
+        let identity = describeCrmIdentity(primary, attributes);
+        if (!Array.isArray(object.identities) && Object.hasOwn(object, "primaryIdentitySlug")) {
+            identity = typeof object.primaryIdentitySlug === "string" ? object.primaryIdentitySlug : "nothing — can duplicate";
+        }
+        else if (compact && !Array.isArray(object.identities)) {
+            identity = "—";
+        }
         return [
             String(object.pluralName || object.displayName || object.slug || "—"),
-            object.standardKey ? "standard" : "custom",
-            String(fieldCount),
-            describeCrmIdentity(primary, attributes),
+            kind,
+            compact ? "—" : String(fieldCount),
+            identity,
             String(object.slug ?? "—"),
         ];
     });
@@ -29412,8 +29646,10 @@ async function pushOneMirrorPage(dir, state, candidate) {
                 slug,
                 kind,
                 status: "proposal_created",
-                ...(typeof details.proposalId === "string" ? { proposal_id: details.proposalId } : {}),
-                ...(typeof details.proposalSlug === "string" ? { proposal_slug: details.proposalSlug } : {}),
+                // The API sends snake_case details; camelCase never matched, so push hid the proposal.
+                ...(typeof details.proposal_id === "string" ? { proposal_id: details.proposal_id } : {}),
+                ...(typeof details.proposal_slug === "string" ? { proposal_slug: details.proposal_slug } : {}),
+                ...(typeof details.proposal_web_url === "string" ? { proposal_web_url: details.proposal_web_url } : {}),
                 reason: typeof details.reason === "string" ? details.reason : "sensitive_page",
             };
         }