@oxygen-agent/cli 1.1014.1138 → 1.1014.1221

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.1014.1138
+Version: 1.1014.1221

package/dist/command-manifest.js

@@ -107,6 +107,8 @@ const MUTATING_VERBS = new Set([
 const MUTATING_COMMANDS = new Set([
     // Live DNS checks save observations; --cached explicitly reads saved evidence.
     "domains dns",
+    // Stores one copy-score check run (0 credits, nothing sent); the noun leaf would read as a read.
+    "mailboxes deliverability score-copy",
     // Sends the workspace's company documents to Twilio for a human review that
     // cannot be edited once started. `submit` is its only leaf, so it is exact.
     "voice verification submit",

package/dist/command-support.d.ts

@@ -1,3 +1,4 @@
+import { Option } from "commander";
 import { JsonOptions, handleAsyncAction } from "./cli-output.js";
 import { type CliProfileSource } from "./cli-profile-context.js";
 import { type ProfileResolution, type StoredCredentials, type StoredProfileIdentity, type StoredOrganization } from "./credentials.js";
@@ -91,7 +92,14 @@ export type CrmSignalRecordOptions = JsonOptions & {
 export type CrmLeadsTodayOptions = JsonOptions & {
     limit?: string;
     withinDays?: string;
+    rank?: string;
 };
+/**
+ * `--rank focus` (Network Mining's warmth → fit → decayed-intent rank). Hidden
+ * while Network Mining is DEV-only: production help must not offer a flag its
+ * API refuses (focus_rank_unavailable). Unhide with the production rollout.
+ */
+export declare function leadsTodayRankOption(): Option;
 export type ContextProfileUpdateOptions = JsonOptions & {
     dataJson?: string;
     summary?: string;

package/dist/command-support.js

@@ -1,3 +1,4 @@
+import { Option } from "commander";
 import { emitCliFailure, writeJson } from "./cli-output.js";
 import { cliProfileSource } from "./cli-profile-context.js";
 import { parseJsonObject, readNonNegativeInt, readPositiveInt, readRecordString } from "./cli-values.js";
@@ -58,6 +59,14 @@ export function readCollabPath(value) {
     const raw = readOption(value);
     return raw ? formatSubjectPath(parseSubjectPath(raw)) : undefined;
 }
+/**
+ * `--rank focus` (Network Mining's warmth → fit → decayed-intent rank). Hidden
+ * while Network Mining is DEV-only: production help must not offer a flag its
+ * API refuses (focus_rank_unavailable). Unhide with the production rollout.
+ */
+export function leadsTodayRankOption() {
+    return new Option("--rank <rank>", "signal (default) or focus: warmth, then ICP fit, then decayed 90-day inbound intent, each lead with reasons, evidence ids and the teammates who know them. Only where Network Mining is enabled; elsewhere the API answers focus_rank_unavailable.").hideHelp();
+}
 // One cadence vocabulary across every scheduled surface (column refresh, table
 // feed): `translateScheduleEvery` in apps/web resolves all four forms, so this
 // string is the single place the CLI spells them out.
@@ -264,6 +273,8 @@ export function buildCrmLeadsTodayPath(options) {
         params.set("limit", options.limit);
     if (options.withinDays)
         params.set("within_days", options.withinDays);
+    if (options.rank)
+        params.set("rank", options.rank);
     const query = params.toString();
     return query ? `/api/cli/crm/signals/leads-today?${query}` : "/api/cli/crm/signals/leads-today";
 }

package/dist/commands/api-keys.d.ts

@@ -1,3 +1,12 @@
+import { JsonOptions } from "../cli-output.js";
 import { ExtractedCommandActionHandler } from "../command-support.js";
 import { Command } from "commander";
+type ApiKeysCreateOptions = JsonOptions & {
+    name?: string;
+    expiresAt?: string;
+    expiresInDays?: string;
+    readOnly?: boolean;
+};
+export declare function buildApiKeyCreateBody(options: ApiKeysCreateOptions): Record<string, unknown>;
 export declare function registerApiKeysFamily(program: Command, handleAsyncAction: ExtractedCommandActionHandler): void;
+export {};

package/dist/commands/api-keys.js

@@ -3,7 +3,7 @@ import { requestOxygen } from "../http-client.js";
 import { readOption } from "../util.js";
 import { OxygenError } from "@oxygen/shared/cli-result";
 import { Command } from "commander";
-function buildApiKeyCreateBody(options) {
+export function buildApiKeyCreateBody(options) {
     const body = {};
     const name = readOption(options.name);
     if (name)
@@ -11,6 +11,8 @@ function buildApiKeyCreateBody(options) {
     const expiresAt = resolveApiKeyExpiresAt(options);
     if (expiresAt)
         body.expires_at = expiresAt;
+    if (options.readOnly)
+        body.access = "read_only";
     return body;
 }
 function resolveApiKeyExpiresAt(options) {
@@ -58,6 +60,7 @@ export function registerApiKeysFamily(program, handleAsyncAction) {
         .option("--name <name>", "Key name. Defaults to 'CLI key'.")
         .option("--expires-at <iso>", "Expiration timestamp as ISO 8601.")
         .option("--expires-in-days <days>", "Expire the key after this many days.")
+        .option("--read-only", "Mint a key that can read but never change the workspace.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("api-keys create", options, () => requestOxygen("/api/cli/api-keys", {

package/dist/commands/capabilities.js

@@ -1,4 +1,5 @@
-import { OXYGEN_CAPABILITY_ROUTES, getCapabilityRouteMatch, serializeCapabilityRoute } from "@oxygen/shared/capability-discovery";
+import { OXYGEN_CAPABILITY_ROUTES, getCapabilityRouteMatch, serializeCapabilityRoute, withRecordBrief } from "@oxygen/shared/capability-discovery";
+import { networkMiningHostServed } from "../network-mining-host.js";
 import { OxygenError } from "@oxygen/shared/cli-result";
 import { inferUserCapabilityRoute } from "@oxygen/shared/user-capability-routing";
 import { capabilityDiscoveryRecovery } from "@oxygen/shared/user-capability-routing";
@@ -14,7 +15,8 @@ export function registerCapabilitiesFamily(program, handleAsyncAction) {
         .action(async (queryParts, options) => {
         await handleAsyncAction("capabilities search", options, async () => {
             const query = queryParts.join(" ");
-            const route = inferUserCapabilityRoute(query);
+            const inferred = inferUserCapabilityRoute(query);
+            const route = inferred ? withRecordBrief(inferred, networkMiningHostServed()) : null;
             return {
                 query,
                 route: serializeCapabilityRoute(route),

package/dist/commands/crm.js

@@ -1,9 +1,11 @@
 import { emitCliFailure, writeJson } from "../cli-output.js";
 import { parseJsonObject, readPositiveInt, readRecordString, resolveLiveDryRunMode } from "../cli-values.js";
-import { ansi, buildCrmLeadsTodayPath, buildCrmSignalRecordBody, clipCell, handleReadActionWithLens, parseJsonArray, parseJsonValue, readCsvOption, readPositiveNumber, renderTextTable, splitCommaList } from "../command-support.js";
+import { ansi, buildCrmLeadsTodayPath, leadsTodayRankOption, buildCrmSignalRecordBody, clipCell, handleReadActionWithLens, parseJsonArray, parseJsonValue, readCsvOption, readPositiveNumber, renderTextTable, splitCommaList } from "../command-support.js";
 import { addContractFlags, readContractFlags } from "../contract-flags.js";
 import { readCrmNoteEditFields, readCrmPhotoFields, readCrmFileLabel, buildCrmObjectsPath, buildCrmConnectionsPath, buildCrmRecordPath } from "../crm-support-flags.js";
 import { requestOxygen } from "../http-client.js";
+import { networkMiningHostServed } from "../network-mining-host.js";
+import { CRM_RECORD_BRIEF_SECTIONS } from "@oxygen/shared/crm-record-brief";
 import { isRecord, readClearableOption, readOption } from "../util.js";
 import { OxygenError, success } from "@oxygen/shared/cli-result";
 import { CRM_ENRICHMENT_READ_CONTRACT } from "@oxygen/shared/contracts/crm-enrichment-read";
@@ -329,6 +331,17 @@ function buildCrmTimelinePath(object, rowId, options) {
     const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/timeline`;
     return query ? `${base}?${query}` : base;
 }
+function buildCrmBriefPath(object, record, options) {
+    const params = new URLSearchParams();
+    const sections = splitCommaList(options.sections);
+    if (sections.length > 0)
+        params.set("sections", sections.join(","));
+    if (options.maxChars)
+        params.set("max_chars", options.maxChars);
+    const query = params.toString();
+    const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(record)}/brief`;
+    return query ? `${base}?${query}` : base;
+}
 function buildCrmRelatedPath(object, rowId, options) {
     const params = new URLSearchParams();
     if (options.previewLimit)
@@ -1257,6 +1270,16 @@ export function registerCrmFamily(program, handleAsyncAction) {
         .action(async (object, rowId, options) => {
         await handleAsyncAction("crm related", options, () => requestOxygen(buildCrmRelatedPath(object, rowId, options)));
     }))
+        .addCommand(new Command("brief")
+        .description("Network Mining (dev): everything stored about one CRM record in one free read — fields, identities, intent signals, teammates connected on LinkedIn, calls and meetings, recent activity, linked conversations and Sequences, notes, open tasks, related records and pinned Knowledge pages. Address the record by row id or any identity (email, domain, LinkedIn URL). Each section reports coverage and freshness; a cut section names the read for the rest.")
+        .argument("<object>", "CRM object slug, such as people or companies.")
+        .argument("<record>", "CRM record row id, an identity value such as sarah@acme.com or acme.com, or the record's exact name.")
+        .option("--sections <list>", `Comma-separated subset: ${CRM_RECORD_BRIEF_SECTIONS.join(", ")}. Default all.`)
+        .option("--max-chars <n>", "Character budget for the whole brief, 3000-20000. Default 8000.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, record, options) => {
+        await handleAsyncAction("crm brief", options, () => requestOxygen(buildCrmBriefPath(object, record, options)));
+    }), { hidden: !networkMiningHostServed() })
         .addCommand(new Command("tag")
         .description("Add/remove workspace tags on one CRM record (Tags primitive — the same vocabulary as sequences, tables, conversations; see `oxygen tags list`). Delta semantics: --add unions, --remove subtracts, remove wins. Standard objects carry the tags attribute after `oxygen crm setup`.")
         .argument("<object>", "CRM object slug, such as companies or people.")
@@ -1341,7 +1364,9 @@ export function registerCrmFamily(program, handleAsyncAction) {
         .description("Log a timeline activity on a CRM record. Defaults to dry-run.")
         .argument("<object>", "CRM object slug, such as companies or people.")
         .argument("<row_id>", "CRM record row id.")
-        .requiredOption("--type <type>", "Activity type, such as note, call, meeting_booked, stage_changed.")
+        .requiredOption("--type <type>", networkMiningHostServed()
+        ? "Activity type, such as note, call, meeting_booked, stage_changed. research_finding: --summary is one claim; --metadata-json gives source_kind (message|activity|url) with message_id, activity_id or source_url of this record's evidence, confidence 0-1, observed_at and class (role|interest|stated_need|company|other)."
+        : "Activity type, such as note, call, meeting_booked, stage_changed.")
         .option("--summary <summary>", "Short one-line summary of the activity.")
         .option("--body <body>", "Longer activity body or details.")
         .option("--channel <channel>", "Channel, such as email, linkedin, or phone.")
@@ -1453,6 +1478,7 @@ export function registerCrmFamily(program, handleAsyncAction) {
         .description("List people to contact today, ranked by their most recent GTM intent signal. When the output has rankedBy, equal signals are ordered by the company's ICP fit (see each lead's fit). Do-not-contact filtering is best-effort (email-only leads surface unchecked).")
         .option("--limit <limit>", "Maximum leads to return. Defaults to 25, max 100.")
         .option("--within-days <days>", "Signal look-back window in days. Defaults to 7, max 30.")
+        .addOption(leadsTodayRankOption())
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("crm signals leads-today", options, () => requestOxygen(buildCrmLeadsTodayPath(options)));

package/dist/commands/dashboards.js

@@ -159,9 +159,9 @@ export function registerDashboardsFamily(program, handleAsyncAction) {
         await handleAsyncAction("dashboards widget kinds", options, () => requestOxygen("/api/cli/dashboards/widget-kinds"));
     }))
         .addCommand(new Command("add")
-        .description("Add a widget. Kinds: chart, view, iframe, rich_text, code, live_source. The configuration shape depends on the kind — run `oxygen dashboards widgets kinds` to see each one with an example.")
+        .description("Add a widget. Kinds: chart, view, iframe, rich_text, code, live_source, deliverability_evidence. Run `oxygen dashboards widgets kinds` for each configuration shape and an example.")
         .argument("<dashboard>", "Dashboard slug or id.")
-        .argument("<kind>", "chart | view | iframe | rich_text | code | live_source")
+        .argument("<kind>", "chart | view | iframe | rich_text | code | live_source | deliverability_evidence")
         .argument("<title>", "Widget title.")
         .option("--tab <tab_id>", "Tab to place it on. Defaults to the dashboard's first tab.")
         .option("--config <json>", "Widget configuration as JSON.")

package/dist/commands/db.js

@@ -143,6 +143,40 @@ export function registerDbFamily(program, handleAsyncAction) {
                 },
             });
         });
+    }))
+        .addCommand(new Command("backfill-linkedin-member-ids")
+        .description("Fill the people LinkedIn Member ID identity from LinkedIn data one workspace already holds (member-id profile URLs, profile payloads, connections, enrollments). Staff only; 0 credits, no provider calls. Defaults to a dry run that reports filled, conflicts, ambiguous and mismatched counts.")
+        .option("--org <id>", "The organization id to backfill. Required.")
+        .option("--live", "Write the resolved ids, converging the People template first if needed. Requires --confirm.")
+        .option("--revert", "Archive exactly the identities a --live run wrote and clear their cells. Requires --confirm.")
+        .option("--confirm", "Confirm --live or --revert.")
+        .option("--limit <n>", "Maximum people rows to scan in this batch. Defaults to 2000; hard cap is 10000.")
+        .option("--cursor <row-id>", "Continue a scan from the previous run's nextCursor.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("db backfill-linkedin-member-ids", options, () => {
+            if (options.live && options.revert) {
+                throw new OxygenError("invalid_request", "Pass --live or --revert, not both.", { exitCode: 1 });
+            }
+            const mode = options.live ? "live" : options.revert ? "revert" : "dry_run";
+            if (mode !== "dry_run" && !options.confirm) {
+                throw new OxygenError("confirmation_required", `Refusing to run --${mode} without --confirm.`, { exitCode: 1 });
+            }
+            const limit = readPositiveInt(options.limit);
+            // `--org` is also a root option; read both scopes (see backfill-upsert-indexes).
+            const organizationId = readOption(options.org) ?? readOption(program.opts().org);
+            const cursor = readOption(options.cursor);
+            return requestOxygen("/api/cli/db/backfill-linkedin-member-ids", {
+                method: "POST",
+                body: {
+                    mode,
+                    confirm: Boolean(options.confirm),
+                    ...(organizationId ? { organization_id: organizationId } : {}),
+                    ...(limit !== undefined ? { limit } : {}),
+                    ...(cursor ? { cursor } : {}),
+                },
+            });
+        });
     }))
         .addCommand(new Command("cost-policy")
         .description("Read-only, 0 credits. Show the retired Neon cost-policy status. Its managed field describes the policy, not database hosting; PostgreSQL has no per-workspace sleep control.")

package/dist/commands/find.js

@@ -112,7 +112,7 @@ export function registerFindFamily(program, handleAsyncAction) {
         await handleAsyncAction("find phone", options, () => requestOxygen("/api/cli/find/run", { method: "POST", body: buildFindBody("phone", options) }));
     }))
         .addCommand(new Command("linkedin")
-        .description("Resolve a person's LinkedIn URL from name + company (or email), with identity validation. Each lane tried bills until the 2026-09 repricing date; from it a URL found that matches the person costs a flat 5 credits and a miss costs 0.")
+        .description("Resolve a person's LinkedIn URL from name + company (or email), with identity validation. Each lane tried bills until the 2026-09 repricing date; from it a URL found that matches the person costs one flat price, which the dry run quotes, and a miss costs 0.")
         .option("--full-name <name>", "Person full name.")
         .option("--email <email>", "Known email.")
         .option("--company-domain <domain>", "Company apex domain.")

package/dist/commands/knowledge.js

@@ -789,6 +789,7 @@ export function registerKnowledgeFamily(program, handleAsyncAction) {
         .option("--body <markdown>", "With --approved: save this body verbatim (the guide a preview showed, or your edit) with no new AI call, at 0 credits.")
         .option("--title <title>", "Optional title for a newly created page/asset.")
         .option("--limit <n>", "Voice only: how many recent sent messages to learn from (max 200).")
+        .option("--sender <profile_id>", "Voice only, Network Mining (dev): learn one sender profile's voice from their own hand-written DMs and posts; --approved saves it and proposes it as that sender's voice.")
         .option("--max-credits <n>", "Hard cap OXYGEN enforces on this call: it is charged exactly its estimate, so never more than n. A higher estimate is refused before any AI call, with nothing charged, and the refusal reports the estimate (--max-credits 0 shows it for free). --approved --body makes no AI call and needs none.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -797,6 +798,7 @@ export function registerKnowledgeFamily(program, handleAsyncAction) {
             body: {
                 kind: options.kind ?? "campaign_learnings",
                 ...(readOption(options.sequence) ? { sequence: readOption(options.sequence) } : {}),
+                ...(readOption(options.sender) ? { sender: readOption(options.sender) } : {}),
                 ...(options.approved ? { approved: true } : {}),
                 ...(readOption(options.body) ? { body: readOption(options.body) } : {}),
                 ...(readOption(options.title) ? { title: readOption(options.title) } : {}),

package/dist/commands/mailboxes.js

@@ -3,6 +3,7 @@ import { readNonNegativeInt, readPositiveInt } from "../cli-values.js";
 import { readCsvOption, readNonNegativeNumber, splitCommaList } from "../command-support.js";
 import { requestOxygen } from "../http-client.js";
 import { readOption } from "../util.js";
+import { withDeliverabilityEvidenceCommands } from "../deliverability-evidence-commands.js";
 import { OxygenError } from "@oxygen/shared/cli-result";
 import { inferRowsFileFormat, parseXlsxWorkbookBuffer } from "@oxygen/shared/file-import";
 import { MAILBOX_IMPORT_FILE_MAX_BYTES as SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES, MAILBOX_IMPORT_ROW_LIMIT as SHARED_MAILBOX_IMPORT_ROW_LIMIT, normalizeMailboxImportFile as normalizeSharedMailboxImportFile, normalizeMailboxImportVendor as normalizeSharedMailboxImportVendor, normalizeMailboxWorkbookRows, parseMailboxImportText, summarizeMailboxImportValidation as summarizeSharedMailboxImportValidation } from "@oxygen/shared/mailbox-import";
@@ -880,7 +881,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         .action(async (options) => {
         await handleAsyncAction("mailboxes oauth-health", options, () => requestOxygen("/api/cli/mailboxes/oauth-health"));
     }))
-        .addCommand(new Command("deliverability")
+        .addCommand(withDeliverabilityEvidenceCommands(new Command("deliverability")
         .description("Assess every mailbox origin for OXYGEN deliverability and connect credential-capable Google Workspace mailboxes from managed, Zapmail, or compatible encrypted external imports. Manual/native Google rows report credential_required; Microsoft 365/Azure reports vendor_blocked. Preview never materializes a password; approved execution fetches it just in time and never prints it.")
         .addCommand(new Command("connect")
         .description("Preview or connect selected mailboxes to OXYGEN deliverability. Managed mode is 100 credits/inbox-month, with two placement tests per inbox per cycle included; an extra managed test costs 66 credits. The preview shows the price in force. Own-key monitoring has no monthly Oxygen fee; placement tests pay the in-force platform fee and vendor charges separately. Google Workspace requires a real app password, fetched only after approval. Microsoft 365/Azure is explicitly vendor-blocked because OXYGEN deliverability exposes neither Microsoft OAuth nor tenant consent; Oxygen never downgrades it to password auth. Starts with a 0-credit, no-provider-write preview. Account connection sends no placement probe.")
@@ -981,7 +982,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
             }
             return requestOxygen(path);
         });
-    })))
+    })), handleAsyncAction))
         .addCommand(new Command("delegation")
         .description("Google sending-domain delegation only — not Microsoft OAuth and not a credential-file handoff to OXYGEN Warm-up or OXYGEN deliverability. Reports covered domains plus the exact client id/scopes; --probe mints a real token per mailbox. Read-only, sends no mail, 0 Oxygen credits.")
         .option("--domain <domain>", "Only report this sending domain.")

package/dist/commands/messages.js

@@ -1,6 +1,7 @@
 import { requestOxygen } from "../http-client.js";
 import { readOption } from "../util.js";
-import { Command } from "commander";
+import { Command, Option } from "commander";
+import { networkMiningHostServed } from "../network-mining-host.js";
 export function registerMessagesFamily(program, handleAsyncAction) {
     program.addCommand(new Command("messages")
         .description("Cross-channel message corpus: every individual email + LinkedIn + WhatsApp message as one searchable stream (Postgres full-text search over bodies, keyset paginated by recency), plus INBOX-WIDE conversation analytics. NOT campaign performance: for per-channel campaign reply rates use `oxygen sequences analytics`. Message-level, unlike inbox (conversation-level triage).")
@@ -12,6 +13,8 @@ export function registerMessagesFamily(program, handleAsyncAction) {
         .option("--direction <direction>", "Filter by direction: inbound or outbound.")
         .option("--account <id>", "Mailbox id (email) or sender account id (DM) to filter to.")
         .option("--contact <text>", "Filter by counterpart name or handle (address / provider id).")
+        .addOption(new Option("--record <record>", "Network Mining (dev): one CRM record's messages, by row id or identity (email, LinkedIn URL); its linked conversations, never a name match.").hideHelp(!networkMiningHostServed()))
+        .addOption(new Option("--object <slug>", "With --record: the record's CRM object. Defaults to people.").hideHelp(!networkMiningHostServed()))
         .option("--sequence-id <id>", "Email only: campaign (sequence) id (restricts the result to email).")
         .option("--status <keys>", "Comma-separated conversation status keys (e.g. interested,meeting_booked).")
         .option("--tag <tag>", "Only messages whose conversation carries this workspace tag (see `oxygen tags list`).")
@@ -32,6 +35,8 @@ export function registerMessagesFamily(program, handleAsyncAction) {
                 ["direction", "direction"],
                 ["account", "account"],
                 ["contact", "contact"],
+                ["record", "record"],
+                ["object", "object"],
                 ["sequenceId", "sequence_id"],
                 ["status", "status"],
                 ["tag", "tag"],

package/dist/commands/senders.js

@@ -295,6 +295,7 @@ export function registerSendersFamily(program, handleAsyncAction) {
         .option("--last-name <name>", "New last name — the exact one an inbox vendor stamps on mailboxes ordered for this sender. Fix it BEFORE ordering: the vendor cannot rename a mailbox afterwards.")
         .option("--avatar-url <url>", "New avatar image URL (empty string clears it). Must be a public https URL; an expiring link is stored but marked non-durable and is NOT sent to an inbox vendor.")
         .option("--status <status>", "New status: active, paused, or archived.")
+        .option("--voice-page <slug>", "Network Mining (dev): propose this voice page as the sender's own voice; a person approves it in Knowledge proposals. \"none\" unbinds (people only).")
         .option("--json", "Print a JSON envelope.")
         .action(async (id, options) => {
         await handleAsyncAction("senders profiles update", options, () => requestOxygen(`/api/cli/senders/profiles/${encodeURIComponent(id)}`, {
@@ -305,6 +306,7 @@ export function registerSendersFamily(program, handleAsyncAction) {
                 ...(readOption(options.lastName) ? { last_name: readOption(options.lastName) } : {}),
                 ...(options.avatarUrl !== undefined ? { avatar_url: readOption(options.avatarUrl) ?? "" } : {}),
                 ...(readOption(options.status) ? { status: readOption(options.status) } : {}),
+                ...(readOption(options.voicePage) ? { voice_page: readOption(options.voicePage) } : {}),
             },
         }));
     }))

package/dist/commands/sequences.js

@@ -1961,7 +1961,7 @@ export function registerSequencesFamily(program, handleAsyncAction) {
         .description("Preview or start a sequence. Without --approved this is the launch check and changes nothing: it returns launch_readiness (blockers and warnings), sender_journey (each step's From, candidate inboxes and assignment; no leads needed), rendered pending-lead LinkedIn/WhatsApp copy, character counts/limits, copy blockers, per-kind scope, sender/mailbox capacity, CRM readiness and safety caps. Email copy is not rendered; inspect its saved templates and unsubscribe settings with sequences get. Live start requires --approved; --max-credits is optional. Email/WhatsApp/CRM-task journeys additionally require --max-live-sends because their external actions cost 0 Oxygen credits. --dry-run starts the sequence in simulated mode (it leaves draft), with no send, provider campaign, CRM task or credits. Live start enables the standing reply → CRM automation only if it has never been configured. Planned counts include only leads each step's channel can reach; skipped_actions_by_reason and channel_coverage show the rest.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--approved", "Approve and activate live. Without this flag, returns a preview only, including copy_preview rendered samples and blockers.")
-        .option("--max-credits <n>", "Optional credit ceiling. Ordinary sequences require >0; guided LinkedIn permits 0 with a positive action ceiling and exact launch review.")
+        .option("--max-credits <n>", "Optional credit ceiling (0 or more); 0 approves no credit spend and is refused when AI-written comments bill per draft. Guided LinkedIn also needs a positive action ceiling and the exact launch review.")
         .option("--max-live-sends <n>", "Total live-send and CRM-write ceiling across channels, including LinkedIn invites/messages (positive integer). Required for email, WhatsApp, or crm_task steps; guided LinkedIn binds its positive cap in launch_review.")
         .option("--launch-review-json <json>", "Guided onboarding: echo the exact preview.launch_review (digest, expiry, positive action ceiling and nonnegative credit cap). Changed inputs require a new preview.")
         .option("--launch-review-file <path>", "Read the exact launch_review object from a JSON file instead of --launch-review-json.")

package/dist/commands/signals.js

@@ -1,9 +1,10 @@
 import { parseJsonObject, readPositiveInt } from "../cli-values.js";
-import { CADENCE_FLAG_DESCRIPTION, buildCrmLeadsTodayPath, buildCrmSignalRecordBody, readCsvOption, readFileIfPresent, readPositiveNumber, readSearchPlanJson } from "../command-support.js";
+import { CADENCE_FLAG_DESCRIPTION, buildCrmLeadsTodayPath, leadsTodayRankOption, buildCrmSignalRecordBody, readCsvOption, readFileIfPresent, readPositiveNumber, readSearchPlanJson } from "../command-support.js";
 import { requestOxygen } from "../http-client.js";
 import { readOption } from "../util.js";
 import { OxygenError } from "@oxygen/shared/cli-result";
-import { Command } from "commander";
+import { Command, Option } from "commander";
+import { networkMiningHostServed } from "../network-mining-host.js";
 function buildSignalsListPath(options) {
     const params = new URLSearchParams();
     if (options.types)
@@ -12,6 +13,11 @@ function buildSignalsListPath(options) {
         params.set("since", options.since);
     if (options.limit)
         params.set("limit", options.limit);
+    if (options.record) {
+        params.set("record", options.record);
+        if (options.object)
+            params.set("object", options.object);
+    }
     const query = params.toString();
     return query ? `/api/cli/signals?${query}` : "/api/cli/signals";
 }
@@ -148,6 +154,8 @@ export function registerSignalsFamily(program, handleAsyncAction) {
         .option("--types <types>", "Comma-separated signal types to include. Defaults to all four.")
         .option("--since <days>", "Look-back window in days. Defaults to 7; your plan's maximum (30 on free, up to 365) is in `oxygen limits show`.")
         .option("--limit <limit>", "Maximum events to return. Defaults to 25; your plan's maximum (100 on free, up to 1,000) is in `oxygen limits show`.")
+        .addOption(new Option("--record <record>", "Network Mining (dev): one CRM record's signals, by row id or identity (email, LinkedIn URL).").hideHelp(!networkMiningHostServed()))
+        .addOption(new Option("--object <slug>", "With --record: the record's CRM object. Defaults to people.").hideHelp(!networkMiningHostServed()))
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("signals list", options, () => requestOxygen(buildSignalsListPath(options)));
@@ -183,6 +191,7 @@ export function registerSignalsFamily(program, handleAsyncAction) {
         .description("List people to contact today, ranked by their most recent GTM intent signal. When the output has rankedBy, equal signals are ordered by the company's ICP fit (see each lead's fit). Do-not-contact filtering is best-effort (email-only leads surface unchecked).")
         .option("--limit <limit>", "Maximum leads to return. Defaults to 25, max 100.")
         .option("--within-days <days>", "Signal look-back window in days. Defaults to 7, max 30.")
+        .addOption(leadsTodayRankOption())
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("signals leads-today", options, () => requestOxygen(buildCrmLeadsTodayPath(options)));

package/dist/deliverability-evidence-commands.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import type { ExtractedCommandActionHandler } from "./command-support.js";
+/** Adds the evidence leaves to the `mailboxes deliverability` group and returns it. */
+export declare function withDeliverabilityEvidenceCommands(root: Command, handle: ExtractedCommandActionHandler): Command;

package/dist/deliverability-evidence-commands.js

@@ -0,0 +1,104 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { DELIVERABILITY_CHECK_LIST_FIELDS, DELIVERABILITY_EVIDENCE_FIELDS, DELIVERABILITY_OBSERVATION_LIST_FIELDS, DELIVERABILITY_SURFACE_BUCKETS, DELIVERABILITY_SURFACE_CHECK_KINDS, DELIVERABILITY_SURFACE_FINDING_STATUSES, DELIVERABILITY_SURFACE_FOLDERS, DELIVERABILITY_SURFACE_MAX_LIMIT, DELIVERABILITY_SURFACE_RECEIVER_PROVIDERS, DELIVERABILITY_SURFACE_RUN_STATUSES, DELIVERABILITY_SURFACE_SOURCES, DELIVERABILITY_SURFACE_SUBJECT_TYPES, deliverabilitySurfaceQuery, } from "@oxygen/shared/deliverability-surface";
+import { Command, Option } from "commander";
+import { requestOxygen } from "./http-client.js";
+const WINDOW_HELP = "ISO 8601 time or a relative window such as 7d or 24h.";
+const LIMIT_HELP = `Rows per page (1–${DELIVERABILITY_SURFACE_MAX_LIMIT}, default 25).`;
+/** Commander camelCases flags; the routes read snake_case query fields of the same name. */
+function queryValues(fields, options) {
+    return Object.fromEntries(fields.map((field) => [field, options[field.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase())]]));
+}
+function readTextOption(options, inline, file, label) {
+    const value = options[inline];
+    const path = options[file];
+    if (typeof value === "string" && typeof path === "string")
+        throw new Error(`Pass ${label} inline or from a file, not both.`);
+    if (typeof path === "string")
+        return readFileSync(resolve(path), "utf8");
+    return typeof value === "string" ? value : undefined;
+}
+/** Adds the evidence leaves to the `mailboxes deliverability` group and returns it. */
+export function withDeliverabilityEvidenceCommands(root, handle) {
+    root.addCommand(new Command("checks")
+        .description("Stored deliverability check runs: DNS authentication, BIMI, tracking CNAME, blacklist, copy score and header proof, each with typed findings. 0 credits; runs no check.")
+        .addCommand(new Command("list")
+        .description("List stored check runs, newest first, with pass/warn/fail/unknown finding counts. Follow next_cursor with the same filters.")
+        .addOption(new Option("--kind <kind>", "Check kind.").choices([...DELIVERABILITY_SURFACE_CHECK_KINDS]))
+        .addOption(new Option("--subject-type <type>", "What was checked.").choices([...DELIVERABILITY_SURFACE_SUBJECT_TYPES]))
+        .option("--subject <subject>", "Exact subject: a domain, mailbox id or copy content hash.")
+        .addOption(new Option("--status <status>", "Run status.").choices([...DELIVERABILITY_SURFACE_RUN_STATUSES]))
+        .addOption(new Option("--finding-status <status>", "Only runs with at least one finding of this status.").choices([...DELIVERABILITY_SURFACE_FINDING_STATUSES]))
+        .option("--since <time>", `Started at or after. ${WINDOW_HELP}`)
+        .option("--until <time>", `Started before. ${WINDOW_HELP}`)
+        .option("--limit <n>", LIMIT_HELP)
+        .option("--cursor <id>", "next_cursor from the previous page.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => handle("mailboxes deliverability checks list", options, () => requestOxygen(`/api/cli/deliverability/checks${deliverabilitySurfaceQuery(DELIVERABILITY_CHECK_LIST_FIELDS, queryValues(DELIVERABILITY_CHECK_LIST_FIELDS, options))}`))))
+        .addCommand(new Command("get")
+        .description("Read one stored check run: every finding (worst first) with its value, and the bounded raw evidence.")
+        .argument("<id>", "Check run id from `checks list`.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (id, options) => handle("mailboxes deliverability checks get", options, () => requestOxygen(`/api/cli/deliverability/checks/${encodeURIComponent(id)}`)))));
+    root.addCommand(new Command("observations")
+        .description("Stored inbox-placement observations: one row per probe from workspace copy tests, cross-workspace tests and placement tests, with folder, tab, receiver provider, header proof and copy hash. 0 credits.")
+        .addCommand(new Command("list")
+        .description("List placement observations, newest first by placement time (sent, else observed, else recorded), the time evidence buckets on. Follow next_cursor with the same filters.")
+        .addOption(new Option("--source <source>", "Test source.").choices([...DELIVERABILITY_SURFACE_SOURCES]))
+        .option("--sender-domain <domain>", "Sending domain.")
+        .option("--sender-mailbox-id <id>", "Sending mailbox id.")
+        .addOption(new Option("--receiver-provider <provider>", "Receiving mailbox provider.").choices([...DELIVERABILITY_SURFACE_RECEIVER_PROVIDERS]))
+        .addOption(new Option("--folder <folder>", "Observed folder.").choices([...DELIVERABILITY_SURFACE_FOLDERS]))
+        .option("--run-ref <id>", "One test: workspace test id or placement test id.")
+        .option("--content-hash <hash>", "Copy content hash (64 hex characters).")
+        .option("--since <time>", `Placed at or after. ${WINDOW_HELP}`)
+        .option("--until <time>", `Placed before. ${WINDOW_HELP}`)
+        .option("--limit <n>", LIMIT_HELP)
+        .option("--cursor <id>", "next_cursor from the previous page.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => handle("mailboxes deliverability observations list", options, () => requestOxygen(`/api/cli/deliverability/observations${deliverabilitySurfaceQuery(DELIVERABILITY_OBSERVATION_LIST_FIELDS, queryValues(DELIVERABILITY_OBSERVATION_LIST_FIELDS, options))}`)))));
+    root.addCommand(new Command("evidence")
+        .description("What changed and what placement did, for one sender domain, sender mailbox, copy hash or receiver provider: placement per UTC day or week and per receiver provider, latest DNS/BIMI/blacklist state with every finding change, copy scores, campaign outcomes and placement Signals. Rates carry sample sizes. Defaults to the last 28 days by day. 0 credits.")
+        .option("--sender-domain <domain>", "Sending domain.")
+        .option("--sender-mailbox-id <id>", "Sending mailbox id.")
+        .option("--content-hash <hash>", "Copy content hash.")
+        .addOption(new Option("--receiver-provider <provider>", "Receiving mailbox provider.").choices([...DELIVERABILITY_SURFACE_RECEIVER_PROVIDERS]))
+        .option("--since <time>", `Window start (default 28 days before until). ${WINDOW_HELP}`)
+        .option("--until <time>", `Window end (default now). ${WINDOW_HELP}`)
+        .addOption(new Option("--bucket <bucket>", "Bucket size (day: at most 120 UTC day buckets, so --since 119d; week: 60).").choices([...DELIVERABILITY_SURFACE_BUCKETS]))
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => handle("mailboxes deliverability evidence", options, () => requestOxygen(`/api/cli/deliverability/evidence${deliverabilitySurfaceQuery(DELIVERABILITY_EVIDENCE_FIELDS, queryValues(DELIVERABILITY_EVIDENCE_FIELDS, options))}`))));
+    root.addCommand(new Command("compare")
+        .description("Diff two stored runs of one kind: two placement tests (workspace test or placement test ids) by receiver provider with sample sizes, copy and rule changes and domain check states at each run; or two check runs of one kind (check run ids) finding by finding. 0 credits.")
+        .argument("<a>", "First run: check run id, workspace test id or placement test id.")
+        .argument("<b>", "Second run of the same kind.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (a, b, options) => handle("mailboxes deliverability compare", options, () => requestOxygen(`/api/cli/deliverability/compare${deliverabilitySurfaceQuery(["a", "b"], { a, b })}`))));
+    root.addCommand(new Command("score-copy")
+        .description("Score one email copy for spam-filter content signals on OXYGEN's own scorer and store it as a copy-score check run (content hash, score, fired rules, link domains). Sends nothing; 0 credits.")
+        .requiredOption("--subject <text>", "Subject line.")
+        .option("--body <text>", "Plain-text body.")
+        .option("--body-file <path>", "Read the plain-text body from a file.")
+        .option("--html <html>", "HTML body.")
+        .option("--html-file <path>", "Read the HTML body from a file.")
+        .option("--from <address>", "Sender address; its domain is scored with the copy (default sender@example.com).")
+        .option("--request-id <id>", "Retry key: the same id returns the stored score of unchanged copy instead of scoring again (at most 5 attempts per id).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => handle("mailboxes deliverability score-copy", options, () => {
+        const bodyText = readTextOption(options, "body", "bodyFile", "the body");
+        if (bodyText === undefined)
+            throw new Error("--body <text> or --body-file <path> is required.");
+        const bodyHtml = readTextOption(options, "html", "htmlFile", "the HTML body");
+        return requestOxygen("/api/cli/deliverability/score-copy", {
+            method: "POST",
+            body: {
+                subject: options.subject,
+                body_text: bodyText,
+                ...(bodyHtml !== undefined ? { body_html: bodyHtml } : {}),
+                ...(typeof options.from === "string" ? { from: options.from } : {}),
+                ...(typeof options.requestId === "string" ? { request_id: options.requestId } : {}),
+            },
+        });
+    })));
+    return root;
+}

package/dist/diagnostic-context.d.ts

@@ -0,0 +1,21 @@
+import { type DiagnosticRecord } from "@oxygen/shared/diagnostics";
+import type { LoadedCredentials } from "./credentials.js";
+/** One invocation object shared by HTTP capture and diagnostic orchestration. */
+export type CliDiagnosticContext = {
+    record: DiagnosticRecord;
+    scope: Promise<LoadedCredentials | null>;
+    credentialEnv: NodeJS.ProcessEnv;
+    requests: unknown[];
+    bytes: number;
+    droppedBytes: number;
+    stdout: string[];
+    stderr: string[];
+    restore: () => void;
+    organizationRef: string | null;
+    signalHandlers: (() => void)[];
+};
+export declare function currentCliDiagnosticContext(): CliDiagnosticContext | undefined;
+export declare function setCliDiagnosticContext(context: CliDiagnosticContext | undefined): void;
+export declare function cliDiagnosticInvocation(): string | undefined;
+export declare function cliDiagnosticHeaders(): Record<string, string>;
+export declare function recordCliDiagnosticRequest(input: unknown): void;

package/dist/diagnostic-context.js

@@ -0,0 +1,25 @@
+import { DIAGNOSTIC_INVOCATION_HEADER, DIAGNOSTIC_RECORD_MAX_BYTES, sanitizeDiagnosticContent } from "@oxygen/shared/diagnostics";
+let active;
+export function currentCliDiagnosticContext() { return active; }
+export function setCliDiagnosticContext(context) { active = context; }
+export function cliDiagnosticInvocation() { return active?.record.invocation_id; }
+export function cliDiagnosticHeaders() {
+    return active ? { [DIAGNOSTIC_INVOCATION_HEADER]: active.record.invocation_id, traceparent: active.record.traceparent } : {};
+}
+export function recordCliDiagnosticRequest(input) {
+    if (!active)
+        return;
+    try {
+        const sanitized = sanitizeDiagnosticContent(input);
+        const size = Buffer.byteLength(JSON.stringify(sanitized));
+        if (active.bytes + size <= DIAGNOSTIC_RECORD_MAX_BYTES) {
+            active.requests.push(sanitized);
+            active.bytes += size;
+        }
+        else
+            active.droppedBytes += size;
+    }
+    catch {
+        active.droppedBytes++;
+    }
+}

package/dist/diagnostics.d.ts

@@ -1,5 +1,6 @@
 import { type DiagnosticRecord } from "@oxygen/shared/diagnostics";
 import { type StoredCredentials } from "./credentials.js";
+export { cliDiagnosticHeaders, cliDiagnosticInvocation, recordCliDiagnosticRequest } from "./diagnostic-context.js";
 export type CliDiagnosticScope = {
     api_url: string;
     fingerprint: string | null;
@@ -14,9 +15,6 @@ export declare function cliDiagnosticDirectory(): string;
 export declare function credentialFingerprint(credentials: StoredCredentials): string;
 export declare function beginCliDiagnostics(argv?: string[]): void;
 export declare function setCliDiagnosticOperation(command: string): void;
-export declare function cliDiagnosticInvocation(): string | undefined;
-export declare function cliDiagnosticHeaders(): Record<string, string>;
-export declare function recordCliDiagnosticRequest(input: unknown): void;
 export declare function recordCliDiagnosticFailure(error: unknown): void;
 export declare function finishCliDiagnostics(exitCode: number): Promise<string | null>;
 export declare function writeCliDiagnosticSpool(directory: string, entry: CliDiagnosticSpoolEntry): Promise<string | null>;