@oxygen-agent/cli 1.1014.1138 → 1.1014.1221

package/dist/diagnostics.js

@@ -7,10 +7,11 @@ import { fileURLToPath } from "node:url";
 import { acquireDiagnosticLock } from "@oxygen/shared/diagnostic-lock";
 import { StringDecoder } from "node:string_decoder";
 import { gzipSync } from "node:zlib";
-import { createDiagnosticRecord, credentialSafeDiagnostic, diagnosticId, DIAGNOSTIC_INVOCATION_HEADER, DIAGNOSTIC_MAX_BYTES, DIAGNOSTIC_RECORD_MAX_BYTES, diagnosticOutcome, sanitizeDiagnosticArgv, sanitizeDiagnosticContent } from "@oxygen/shared/diagnostics";
+import { createDiagnosticRecord, credentialSafeDiagnostic, diagnosticId, DIAGNOSTIC_MAX_BYTES, DIAGNOSTIC_RECORD_MAX_BYTES, diagnosticOutcome, sanitizeDiagnosticArgv, sanitizeDiagnosticContent } from "@oxygen/shared/diagnostics";
 import { OXYGEN_VERSION } from "@oxygen/shared/version";
 import { loadCredentialsWithEndpoint } from "./credentials.js";
-let active;
+import { currentCliDiagnosticContext, recordCliDiagnosticRequest, setCliDiagnosticContext } from "./diagnostic-context.js";
+export { cliDiagnosticHeaders, cliDiagnosticInvocation, recordCliDiagnosticRequest } from "./diagnostic-context.js";
 export function cliDiagnosticDirectory() {
     return join(process.env.OXYGEN_CONFIG_DIR?.trim() || (process.platform === "win32"
         ? join(process.env.APPDATA || join(homedir(), "AppData", "Roaming"), "oxygen")
@@ -20,7 +21,7 @@ export function credentialFingerprint(credentials) {
     return createHash("sha256").update(credentials.token).digest("hex");
 }
 export function beginCliDiagnostics(argv = process.argv.slice(2)) {
-    if (active || process.env.OXYGEN_DIAGNOSTICS_ENABLED !== "1")
+    if (currentCliDiagnosticContext() || process.env.OXYGEN_DIAGNOSTICS_ENABLED !== "1")
         return;
     const invocation = createDiagnosticRecord({ surface: "cli", operation: "cli parse",
         client_version: OXYGEN_VERSION, input: { argv: sanitizeDiagnosticArgv(argv) },
@@ -32,7 +33,7 @@ export function beginCliDiagnostics(argv = process.argv.slice(2)) {
     const context = { record: invocation, credentialEnv, scope: loadCredentialsWithEndpoint(credentialEnv).catch(() => null),
         organizationRef: credentialEnv.OXYGEN_ORG?.trim() || null, signalHandlers: [],
         requests: [], bytes: 0, droppedBytes: 0, stdout: [], stderr: [], restore: () => undefined };
-    active = context;
+    setCliDiagnosticContext(context);
     const restorers = [];
     for (const [stream, output] of [[process.stdout, context.stdout], [process.stderr, context.stderr]]) {
         const original = stream.write;
@@ -68,46 +69,27 @@ export function beginCliDiagnostics(argv = process.argv.slice(2)) {
     }
 }
 export function setCliDiagnosticOperation(command) {
+    const active = currentCliDiagnosticContext();
     if (active)
         active.record.operation = command.slice(0, 512);
 }
-export function cliDiagnosticInvocation() { return active?.record.invocation_id; }
-export function cliDiagnosticHeaders() {
-    return active ? { [DIAGNOSTIC_INVOCATION_HEADER]: active.record.invocation_id, traceparent: active.record.traceparent } : {};
-}
-export function recordCliDiagnosticRequest(input) {
-    if (!active)
-        return;
-    try {
-        const sanitized = sanitizeDiagnosticContent(input);
-        const size = Buffer.byteLength(JSON.stringify(sanitized));
-        if (active.bytes + size <= DIAGNOSTIC_RECORD_MAX_BYTES) {
-            active.requests.push(sanitized);
-            active.bytes += size;
-        }
-        else
-            active.droppedBytes += size;
-    }
-    catch {
-        active.droppedBytes++;
-    }
-}
 export function recordCliDiagnosticFailure(error) {
-    if (!active)
+    if (!currentCliDiagnosticContext())
         return;
+    // An error getter can finish or replace the invocation before these writes.
     const code = error && typeof error === "object" && "code" in error ? String(error.code) : "unexpected_error";
-    active.record.error_code = code;
-    active.record.outcome = diagnosticOutcome(false, null, code);
+    currentCliDiagnosticContext().record.error_code = code;
+    currentCliDiagnosticContext().record.outcome = diagnosticOutcome(false, null, code);
     recordCliDiagnosticRequest({ error });
 }
 export async function finishCliDiagnostics(exitCode) {
-    const context = active;
+    const context = currentCliDiagnosticContext();
     if (!context)
         return null;
     context.restore();
     for (const remove of context.signalHandlers)
         remove();
-    active = undefined;
+    setCliDiagnosticContext(undefined);
     try {
         const loaded = await context.scope;
         const credentials = loaded?.credentials;

package/dist/http-client.js

@@ -1,7 +1,7 @@
 import { readGeoExportPagination } from "@oxygen/shared/geo";
 import { OXYGEN_VERSION, OxygenError, isCliResult, isVersionGreater, parseSemver, readEnvelopeCompatibility, vercelProtectionBypassHeaders, withRetryAfterDetails, } from "@oxygen/shared";
 import { randomUUID } from "node:crypto";
-import { cliDiagnosticHeaders, cliDiagnosticInvocation, recordCliDiagnosticRequest } from "./diagnostics.js";
+import { cliDiagnosticHeaders, cliDiagnosticInvocation, recordCliDiagnosticRequest } from "./diagnostic-context.js";
 import { readBoundedBinaryResponse, streamBinaryResponse } from "./refactor-internals/binary-download.js";
 import { recordMutatingRequestAnswered, recoverFromCliFloorRejection } from "./auto-update.js";
 import { defaultApiUrl, loadCredentialsWithEndpoint } from "./credentials.js";

package/dist/network-mining-host.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Network Mining is DEV-only and its server answers feature_disabled elsewhere.
+ * The CLI cannot read the server's gate, so it shows Network Mining commands
+ * (and routes discovery to them) only when its API host is not production.
+ */
+export declare function networkMiningHostServed(env?: NodeJS.ProcessEnv): boolean;

package/dist/network-mining-host.js

@@ -0,0 +1,10 @@
+import { defaultApiUrl } from "./credentials.js";
+import { isProdApiUrl } from "./runtime.js";
+/**
+ * Network Mining is DEV-only and its server answers feature_disabled elsewhere.
+ * The CLI cannot read the server's gate, so it shows Network Mining commands
+ * (and routes discovery to them) only when its API host is not production.
+ */
+export function networkMiningHostServed(env = process.env) {
+    return !isProdApiUrl(defaultApiUrl(env));
+}

package/node_modules/@oxygen/formula/dist/value-normalizers.d.ts

@@ -5,7 +5,7 @@
  * "does foo@Bar.com match FOO@bar.com" answers the same everywhere — including
  * in the browser. Pure string functions — no I/O, no tenant context.
  */
-export declare const VALUE_NORMALIZATIONS: readonly ["exact_text_v1", "lower_trim_v1", "email_v1", "domain_v1", "linkedin_url_v1", "uuid_v1"];
+export declare const VALUE_NORMALIZATIONS: readonly ["exact_text_v1", "lower_trim_v1", "email_v1", "domain_v1", "linkedin_url_v1", "linkedin_member_id_v1", "uuid_v1"];
 export type ValueNormalization = (typeof VALUE_NORMALIZATIONS)[number];
 export declare function isValueNormalization(value: unknown): value is ValueNormalization;
 /** `email_v1`: case-insensitive mailbox match. */

package/node_modules/@oxygen/formula/dist/value-normalizers.js

@@ -5,12 +5,14 @@
  * "does foo@Bar.com match FOO@bar.com" answers the same everywhere — including
  * in the browser. Pure string functions — no I/O, no tenant context.
  */
+import { normalizeLinkedinMemberId } from "@oxygen/shared/linkedin-connection-identity";
 export const VALUE_NORMALIZATIONS = [
     "exact_text_v1",
     "lower_trim_v1",
     "email_v1",
     "domain_v1",
     "linkedin_url_v1",
+    "linkedin_member_id_v1",
     "uuid_v1",
 ];
 export function isValueNormalization(value) {
@@ -69,6 +71,9 @@ export function normalizeValue(normalization, value) {
             return normalizeDomain(value);
         case "linkedin_url_v1":
             return normalizeLinkedinUrl(value);
+        case "linkedin_member_id_v1":
+            // Case-preserving and provider-scoped: see normalizeLinkedinMemberId.
+            return normalizeLinkedinMemberId(value);
         case "uuid_v1":
             return normalizeUuid(value);
         case "lower_trim_v1":

package/node_modules/@oxygen/shared/dist/agent-sessions.d.ts

@@ -133,4 +133,173 @@ export declare const AGENT_SESSION_TEMPLATES: readonly [{
     readonly actions: readonly ["oxygen_crm_notes_add"];
     readonly events: readonly [];
 }];
+export declare function agentSessionTemplates(env?: Record<string, string | undefined>): ({
+    readonly id: "campaign-monitor";
+    readonly title: "Campaign monitor";
+    readonly goal: "Watch this native campaign. Compare sends, replies and meetings with earlier reviews; explain changes, propose improvements and schedule the next review.";
+    readonly resources: readonly ["sequences"];
+    readonly actions: readonly ["oxygen_sequences_set_status"];
+    readonly events: readonly ["sequencer.contact_activity.any"];
+} | {
+    readonly id: "lead-replenishment";
+    readonly title: "Lead replenishment";
+    readonly goal: "Maintain a qualified lead pool in the selected Table for this native campaign. Research gaps, deduplicate and enroll only qualified leads within the approved scope.";
+    readonly resources: readonly ["tables", "sequences"];
+    readonly actions: readonly ["oxygen_rows_upsert", "oxygen_sequences_enroll"];
+    readonly events: readonly [];
+} | {
+    readonly id: "reply-handling";
+    readonly title: "Reply handling";
+    readonly goal: "Review the selected conversations, remember prior responses, qualify intent and draft replies. Send only when explicitly authorized; hand off uncertain or sensitive replies.";
+    readonly resources: readonly ["conversations"];
+    readonly actions: readonly ["oxygen_inbox_set_status"];
+    readonly events: readonly ["crm.email_reply_classified"];
+} | {
+    readonly id: "deliverability";
+    readonly title: "Deliverability";
+    readonly goal: "Watch the selected mailboxes for sending health changes. Explain evidence and recommend or apply only approved cap and status adjustments.";
+    readonly resources: readonly ["mailboxes"];
+    readonly actions: readonly ["oxygen_mailboxes_set_cap", "oxygen_mailboxes_set_status"];
+    readonly events: readonly [];
+} | {
+    readonly id: "account-research";
+    readonly title: "Account research";
+    readonly goal: "Maintain cited account research for the selected records and knowledge pages. Track changes and recommend next actions; keep facts separate from hypotheses.";
+    readonly resources: readonly ["records", "knowledge"];
+    readonly actions: readonly ["oxygen_crm_notes_add", "oxygen_knowledge_page_upsert"];
+    readonly events: readonly [];
+} | {
+    readonly id: "inbound-qualification";
+    readonly title: "Inbound qualification";
+    readonly goal: "Qualify the selected inbound conversations and records against workspace ICP and product knowledge. Record evidence and recommendations; hand off high intent to a person.";
+    readonly resources: readonly ["conversations", "records"];
+    readonly actions: readonly ["oxygen_inbox_set_status", "oxygen_crm_notes_add"];
+    readonly events: readonly ["crm.email_reply_classified"];
+} | {
+    readonly id: "crm-hygiene";
+    readonly title: "CRM hygiene";
+    readonly goal: "Review the selected CRM objects for duplicates and missing or inconsistent fields. Propose repairs with evidence, and apply only explicitly authorized changes.";
+    readonly resources: readonly ["objects"];
+    readonly actions: readonly ["oxygen_crm_merge"];
+    readonly events: readonly [];
+} | {
+    readonly id: "pipeline-review";
+    readonly title: "Pipeline review";
+    readonly goal: "Review the selected pipeline and lifecycle stages. Remember earlier reviews, identify stalled opportunities and recommend the next action with evidence.";
+    readonly resources: readonly ["objects", "records"];
+    readonly actions: readonly ["oxygen_crm_notes_add"];
+    readonly events: readonly [];
+} | {
+    id: "campaign-monitor";
+    title: "Campaign monitor";
+    resources: readonly ["sequences"];
+    actions: readonly ["oxygen_sequences_set_status"];
+    events: readonly ["sequencer.contact_activity.any"];
+    goal: string;
+} | {
+    id: "lead-replenishment";
+    title: "Lead replenishment";
+    resources: readonly ["tables", "sequences"];
+    actions: readonly ["oxygen_rows_upsert", "oxygen_sequences_enroll"];
+    events: readonly [];
+    goal: string;
+} | {
+    id: "reply-handling";
+    title: "Reply handling";
+    resources: readonly ["conversations"];
+    actions: readonly ["oxygen_inbox_set_status"];
+    events: readonly ["crm.email_reply_classified"];
+    goal: string;
+} | {
+    id: "deliverability";
+    title: "Deliverability";
+    resources: readonly ["mailboxes"];
+    actions: readonly ["oxygen_mailboxes_set_cap", "oxygen_mailboxes_set_status"];
+    events: readonly [];
+    goal: string;
+} | {
+    id: "account-research";
+    title: "Account research";
+    resources: readonly ["records", "knowledge"];
+    actions: readonly ["oxygen_crm_notes_add", "oxygen_knowledge_page_upsert"];
+    events: readonly [];
+    goal: string;
+} | {
+    id: "inbound-qualification";
+    title: "Inbound qualification";
+    resources: readonly ["conversations", "records"];
+    actions: readonly ["oxygen_inbox_set_status", "oxygen_crm_notes_add"];
+    events: readonly ["crm.email_reply_classified"];
+    goal: string;
+} | {
+    id: "crm-hygiene";
+    title: "CRM hygiene";
+    resources: readonly ["objects"];
+    actions: readonly ["oxygen_crm_merge"];
+    events: readonly [];
+    goal: string;
+} | {
+    id: "pipeline-review";
+    title: "Pipeline review";
+    resources: readonly ["objects", "records"];
+    actions: readonly ["oxygen_crm_notes_add"];
+    events: readonly [];
+    goal: string;
+})[] | readonly [{
+    readonly id: "campaign-monitor";
+    readonly title: "Campaign monitor";
+    readonly goal: "Watch this native campaign. Compare sends, replies and meetings with earlier reviews; explain changes, propose improvements and schedule the next review.";
+    readonly resources: readonly ["sequences"];
+    readonly actions: readonly ["oxygen_sequences_set_status"];
+    readonly events: readonly ["sequencer.contact_activity.any"];
+}, {
+    readonly id: "lead-replenishment";
+    readonly title: "Lead replenishment";
+    readonly goal: "Maintain a qualified lead pool in the selected Table for this native campaign. Research gaps, deduplicate and enroll only qualified leads within the approved scope.";
+    readonly resources: readonly ["tables", "sequences"];
+    readonly actions: readonly ["oxygen_rows_upsert", "oxygen_sequences_enroll"];
+    readonly events: readonly [];
+}, {
+    readonly id: "reply-handling";
+    readonly title: "Reply handling";
+    readonly goal: "Review the selected conversations, remember prior responses, qualify intent and draft replies. Send only when explicitly authorized; hand off uncertain or sensitive replies.";
+    readonly resources: readonly ["conversations"];
+    readonly actions: readonly ["oxygen_inbox_set_status"];
+    readonly events: readonly ["crm.email_reply_classified"];
+}, {
+    readonly id: "deliverability";
+    readonly title: "Deliverability";
+    readonly goal: "Watch the selected mailboxes for sending health changes. Explain evidence and recommend or apply only approved cap and status adjustments.";
+    readonly resources: readonly ["mailboxes"];
+    readonly actions: readonly ["oxygen_mailboxes_set_cap", "oxygen_mailboxes_set_status"];
+    readonly events: readonly [];
+}, {
+    readonly id: "account-research";
+    readonly title: "Account research";
+    readonly goal: "Maintain cited account research for the selected records and knowledge pages. Track changes and recommend next actions; keep facts separate from hypotheses.";
+    readonly resources: readonly ["records", "knowledge"];
+    readonly actions: readonly ["oxygen_crm_notes_add", "oxygen_knowledge_page_upsert"];
+    readonly events: readonly [];
+}, {
+    readonly id: "inbound-qualification";
+    readonly title: "Inbound qualification";
+    readonly goal: "Qualify the selected inbound conversations and records against workspace ICP and product knowledge. Record evidence and recommendations; hand off high intent to a person.";
+    readonly resources: readonly ["conversations", "records"];
+    readonly actions: readonly ["oxygen_inbox_set_status", "oxygen_crm_notes_add"];
+    readonly events: readonly ["crm.email_reply_classified"];
+}, {
+    readonly id: "crm-hygiene";
+    readonly title: "CRM hygiene";
+    readonly goal: "Review the selected CRM objects for duplicates and missing or inconsistent fields. Propose repairs with evidence, and apply only explicitly authorized changes.";
+    readonly resources: readonly ["objects"];
+    readonly actions: readonly ["oxygen_crm_merge"];
+    readonly events: readonly [];
+}, {
+    readonly id: "pipeline-review";
+    readonly title: "Pipeline review";
+    readonly goal: "Review the selected pipeline and lifecycle stages. Remember earlier reviews, identify stalled opportunities and recommend the next action with evidence.";
+    readonly resources: readonly ["objects", "records"];
+    readonly actions: readonly ["oxygen_crm_notes_add"];
+    readonly events: readonly [];
+}];
 export declare function validateAgentSessionConfig(config: AgentSessionConfig, requireResources?: boolean): void;

package/node_modules/@oxygen/shared/dist/agent-sessions.js

@@ -1,5 +1,6 @@
 import { agentsEnabled, agentsEnabledIn } from "./agents-enabled.js";
 import { guidedActivationEnabled } from "./guided-activation.js";
+import { networkMiningEnabled } from "./network-mining.js";
 import { validateContract } from "./contracts/schema.js";
 import { GUIDED_ACTIVATION_SCAN_POLICY_CONTRACT } from "./contracts/guided-activation.js";
 import { isStaffEmail } from "./staff.js";
@@ -50,6 +51,9 @@ export const AGENT_SESSION_ADAPTERS = {
     oxygen_rows_upsert: { resource: "tables", field: "table", read: false },
     oxygen_rows_update: { resource: "tables", field: "table", read: false },
     oxygen_tables_dedupe: { resource: "tables", field: "table", read: false },
+    oxygen_inbox_reply_oxygent_queue: { resource: "knowledge", field: "voice_slug", read: true },
+    oxygen_inbox_reply_oxygent_prepare: { resource: "knowledge", field: "voice_slug", read: false },
+    oxygen_inbox_reply_oxygent_voice: { resource: "knowledge", field: "voice_slug", read: false },
     oxygen_inbox_get: { resource: "conversations", field: "conversation", read: true },
     oxygen_inbox_set_status: { resource: "conversations", field: "conversation", read: false },
     oxygen_inbox_send: { resource: "conversations", field: "conversation", read: false },
@@ -127,6 +131,19 @@ export const AGENT_SESSION_TEMPLATES = [
     { id: "crm-hygiene", title: "CRM hygiene", goal: "Review the selected CRM objects for duplicates and missing or inconsistent fields. Propose repairs with evidence, and apply only explicitly authorized changes.", resources: ["objects"], actions: ["oxygen_crm_merge"], events: [] },
     { id: "pipeline-review", title: "Pipeline review", goal: "Review the selected pipeline and lifecycle stages. Remember earlier reviews, identify stalled opportunities and recommend the next action with evidence.", resources: ["objects", "records"], actions: ["oxygen_crm_notes_add"], events: [] },
 ];
+/**
+ * Where Network Mining is served (DEV), record work starts from the one read
+ * of everything stored about a record. Elsewhere the templates are unchanged.
+ */
+const BRIEF_FIRST_TEMPLATES = new Set(["account-research", "inbound-qualification"]);
+const BRIEF_FIRST_SENTENCE = "Start each record with its brief (oxygen_crm_record_brief): one free read of its fields, signals, conversations, team connections, notes, tasks and company.";
+export function agentSessionTemplates(env = typeof process === "undefined" ? {} : process.env) {
+    if (!networkMiningEnabled(env))
+        return AGENT_SESSION_TEMPLATES;
+    return AGENT_SESSION_TEMPLATES.map((template) => BRIEF_FIRST_TEMPLATES.has(template.id)
+        ? { ...template, goal: `${BRIEF_FIRST_SENTENCE} ${template.goal}` }
+        : template);
+}
 export function validateAgentSessionConfig(config, requireResources = true) {
     const fail = (message) => { throw new OxygenError("invalid_session_config", message); };
     if (!config.title?.trim() || !config.goal?.trim())

package/node_modules/@oxygen/shared/dist/capability-discovery.d.ts

@@ -107,6 +107,14 @@ export declare function serializeCapabilityRoute(route: CapabilityRouteMatch | n
 }, options?: {
     visibleSkills?: readonly string[];
 }): Record<string, unknown> | null;
+/**
+ * Put the Network Mining record brief first on a record-dossier route where the
+ * host serves it, and take it off where it does not. The shared router decides
+ * by `networkMiningEnabled` in its own process; the CLI decides again by its
+ * API host, because its local environment says nothing about the server's.
+ * Idempotent; any other route is returned unchanged.
+ */
+export declare function withRecordBrief<T extends Pick<CapabilityRouteMatch, "card" | "recommendedTools" | "recommendedCommands">>(route: T, served: boolean): T;
 /** One schedule for every channel of a Sequence, the same as Launch's Sending schedule. */
 export declare const SEQUENCE_SENDING_SCHEDULE_COMMAND = "oxygen sequences update <sequence> --schedule-timezone <IANA zone> --schedule-days mon-fri --schedule-hours-start 09:00 --schedule-hours-end 17:00 --json";
 /** Launch's unsubscribe switch: the visible link and the one-click headers together. */

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -1,4 +1,5 @@
 import { findEnrichmentIntentByAlias } from "./enrichment-intents.js";
+import { networkMiningEnabled } from "./network-mining.js";
 import { RECIPE_PRIMITIVES } from "./recipes.js";
 // One compact semantic index covers every top-level /api/cli endpoint section.
 // It is navigation, never execution: live schemas, prices, readiness, and
@@ -567,6 +568,10 @@ const NORMALIZED_ROUTE_PRIMITIVES = OXYGEN_PRIMITIVE_ROUTES.map((card) => card.p
 if (NORMALIZED_PRIMITIVES.join("|") !== NORMALIZED_ROUTE_PRIMITIVES.join("|")) {
     throw new Error("OXYGEN capability routes must cover the shared fifteen-primitive catalog exactly.");
 }
+/** Server env where one exists; a browser bundle has no process and serves no gated tool. */
+function runtimeEnv() {
+    return typeof process === "undefined" ? {} : process.env;
+}
 export function getCapabilityRoute(id) {
     return ROUTE_BY_ID.get(id.trim().toLowerCase()) ?? null;
 }
@@ -618,7 +623,7 @@ export function inferCapabilityRoute(query) {
     // Sourcing filters belong to the planner, not per-company enrichment.
     const catalogue = catalogRow && CATALOGUE_CARD_IDS.has(card.id) && !isCompanySourcingIntent(normalized)
         ? catalogueRecommendations(catalogRow, card) : null;
-    return {
+    return withRecordBrief({
         card: routeCardFor(card, normalized),
         recommendedTools: recommendations.tools,
         recommendedCommands: recommendations.commands,
@@ -627,7 +632,7 @@ export function inferCapabilityRoute(query) {
         ...(catalogue && catalogRow
             ? { catalogIntent: { id: catalogRow.id, label: catalogRow.label, status: catalogRow.status, group: catalogRow.group, tools: catalogue.tools, commands: catalogue.commands, exactCommand: catalogue.exactCommand, exactMcpCall: catalogue.exactMcpCall } }
             : {}),
-    };
+    }, networkMiningEnabled(runtimeEnv()));
 }
 /**
  * A data-type ask ("tech stack", "decision makers at each account", "funding
@@ -698,6 +703,7 @@ export function inferPrimitiveRoute(query) {
 export const RETIRED_PRODUCT_SKILLS = Object.freeze(["oxygen-playbooks", "oxygen-visual-design", "oxygen-linkedin-marketing"]);
 /** Current hosted instruction audiences, shared by discovery and Agent snapshots. */
 export const OXYGEN_PRODUCT_SKILL_AUDIENCES = Object.freeze({
+    "oxygen-reply-oxygent": "internal_dev",
     "oxygen-geo": "internal_dev",
     "oxygen-onboarding": "workspace",
     "oxygen-gtm-consultant": "workspace",
@@ -1000,6 +1006,84 @@ function crmConnectionsReadRecommendation(query) {
         execution: "Read stored conversations and Sequence links for one CRM record with oxygen_crm_record_connections. Request projection=compact and a max_chars window; conversation_limit and sequence_limit bound the recent links. hasMore includes older or omitted links; this read has no cursor for older links and does not sync Messages, contact anyone or spend credits.",
     };
 }
+/**
+ * "Tell me everything about this person" is a stored-Records read. Before this
+ * rule it matched no card, and lexical search ranked a write tool
+ * (oxygen_profile_viewers_enrichment) first. Every recommended tool is free.
+ */
+function recordDossierReadRecommendation(query) {
+    const recordNoun = "(?:person|people|lead|leads|contact|contacts|prospect|prospects|account|accounts|customer|buyer|record|company|someone)";
+    const subject = new RegExp(`\\b(?:this|that|the|my|our|a|one)\\s+(?:${recordNoun})\\b`).test(query)
+        || /\b(?:them|him|her|they)\b/.test(query)
+        || /\b(?:know|knows|have|has|got)\s+(?:about|on)\s+(?!our\b|my\b|the\b|us\b)[a-z]+(?:\s+[a-z]+)?\s*\??$/.test(query)
+        || /\b(?:call|meeting|chat)\s+with\s+[a-z]+(?:\s+[a-z]+)?\s*\??$/.test(query);
+    // "profile, timeline, notes, conversations, meetings": several facets of one record at once.
+    const facets = query.match(/\b(?:profile|timeline|activity|notes?|signals?|conversations?|messages|sequences?|meetings?|calls?|tasks?|related|connections?)\b/g) ?? [];
+    const enumerated = new Set(facets.map((facet) => facet.replace(/s$/, ""))).size >= 3
+        && new RegExp(`\\b(?:${recordNoun})\\b`).test(query);
+    const dossier = enumerated
+        || /\beverything\s+(?:about|on|we\s+(?:know|have))\b/.test(query)
+        || /\beverything\b.{0,40}\b(?:knows?|has|have|stores?|stored)\b(?:.{0,12}\b(?:about|on)\b)?/.test(query)
+        || /\bwhat\s+(?:do|does|did)\s+(?:we|i|you|oxygen|the\s+workspace)\s+(?:already\s+)?know\b/.test(query)
+        || /\ball\s+(?:the\s+)?(?:info|information|data|details|context)\s+(?:on|about|for)\b/.test(query)
+        || /\bfull\s+(?:picture|story|history|context)\b/.test(query)
+        || /\b(?:prep|prepare)\s+(?:me\s+)?for\s+(?:a\s+|my\s+|the\s+)?(?:call|meeting|chat)\s+with\b/.test(query)
+        || /\b(?:full|complete|quick|short)?\s*(?:brief|briefing|dossier|background|profile|summary|overview)\s+(?:on|of|for|about)\b/.test(query)
+        || /\b(?:summari[sz]e|brief me on|tell me about|catch me up on|background on)\b/.test(query);
+    if (!subject && !enumerated)
+        return null;
+    if (!dossier)
+        return null;
+    if (isHostedWorkflowIntent(query)
+        || /\b(?:send\w*|repl(?:y|ies)|draft\w*|writ\w*|enroll\w*|enrich\w*|find (?:their |the |a )?(?:email|phone|mobile)|scrape\w*|creat\w*|updat\w*|edit\w*|merg\w*|delet\w*|remov\w*|import\w*|sync\w*|tag\w*)\b/.test(query))
+        return null;
+    // Naming another primitive's object is a different owner, unless the ask
+    // enumerates one record's facets ("its notes, conversations, sequences").
+    if (!enumerated && /\b(?:icp|ideal customer|positioning|offers?|brand|voice|meetings?|calls? (?:transcript|recording)s?|tables?|rows?|columns?|spreadsheets?|workflows?|agents?|sequences?|campaigns?|dashboards?|reports?|billing|credits?)\b/.test(query))
+        return null;
+    return {
+        tools: [
+            "oxygen_crm_record_search", "oxygen_crm_record_get", "oxygen_crm_record_timeline",
+            "oxygen_crm_record_connections", "oxygen_crm_notes_list", "oxygen_crm_record_related",
+        ],
+        commands: ["crm search", "crm get", "crm activity timeline", "crm connections", "crm notes list", "crm related"],
+        execution: "Read what the workspace already stores about one record: resolve it with search (a name, email, domain or LinkedIn URL), then get its fields and identities, its timeline (signals, calls, meetings, notes), connected conversations and Sequences, notes and related records. Every read is free and contacts no one. Finding missing contact data or enriching is a separate paid action. External MCP uses oxygen_capabilities_read for unlisted reads; built-in agents invoke the native tools.",
+    };
+}
+const RECORD_DOSSIER_FIRST_COMMANDS = ["crm search", "crm get", "crm activity timeline"];
+const RECORD_BRIEF_TOOL = "oxygen_crm_record_brief";
+const RECORD_BRIEF_COMMAND = "crm brief";
+const RECORD_BRIEF_EXECUTION_PREFIX = `Start with ${RECORD_BRIEF_COMMAND} (${RECORD_BRIEF_TOOL}): one free read of everything stored about the record, with a cursor to each section's rest. `;
+/**
+ * Put the Network Mining record brief first on a record-dossier route where the
+ * host serves it, and take it off where it does not. The shared router decides
+ * by `networkMiningEnabled` in its own process; the CLI decides again by its
+ * API host, because its local environment says nothing about the server's.
+ * Idempotent; any other route is returned unchanged.
+ */
+export function withRecordBrief(route, served) {
+    if (route.card.id !== "records")
+        return route;
+    const briefed = route.recommendedTools[0] === RECORD_BRIEF_TOOL;
+    if (!served) {
+        if (!briefed)
+            return route;
+        return {
+            ...route,
+            card: { ...route.card, execution: route.card.execution.replace(RECORD_BRIEF_EXECUTION_PREFIX, "") },
+            recommendedTools: route.recommendedTools.slice(1),
+            recommendedCommands: route.recommendedCommands.filter((command) => command !== RECORD_BRIEF_COMMAND),
+        };
+    }
+    if (briefed || !RECORD_DOSSIER_FIRST_COMMANDS.every((command, index) => route.recommendedCommands[index] === command))
+        return route;
+    return {
+        ...route,
+        card: { ...route.card, execution: `${RECORD_BRIEF_EXECUTION_PREFIX}${route.card.execution}` },
+        recommendedTools: [RECORD_BRIEF_TOOL, ...route.recommendedTools],
+        recommendedCommands: [RECORD_BRIEF_COMMAND, ...route.recommendedCommands],
+    };
+}
 /** Record-file lifecycle asks outrank the generic workspace label vocabulary. */
 function crmFileUploadRecommendation(query) {
     // Literal filenames and record identities are values, not competing owners:
@@ -1167,6 +1251,9 @@ function routeCardFor(card, query) {
     const crmConnections = card.id === "records" ? crmConnectionsReadRecommendation(query) : null;
     if (crmConnections)
         return { ...card, posture: "read_only", execution: crmConnections.execution };
+    const dossier = card.id === "records" ? recordDossierReadRecommendation(query) : null;
+    if (dossier)
+        return { ...card, posture: "read_only", execution: dossier.execution };
     const crmFileUpload = card.id === "records" ? crmFileUploadRecommendation(query) : null;
     if (crmFileUpload)
         return { ...card, execution: crmFileUpload.execution };
@@ -1553,9 +1640,26 @@ function isOxygentChatIntent(query) {
         return true;
     if (/\b(chatgpt|claude|codex|oauth|mcp|connectors?|connected apps?)\b/.test(query))
         return false;
-    const chatPrivacy = /\b(chats?|conversations?|histor(?:y|ies)|visibility|shared|private|personal)\b/.test(query);
-    if (/\bai (?:assistants?|teammates?)\b/.test(query))
-        return chatPrivacy;
+    const conversation = /\b(chats?|conversations?|histor(?:y|ies))\b/.test(query);
+    const assistantAudience = /\b(?:agents?|assistants?|teammates?)(?:'s)? visibility\b/.test(query)
+        || /\bvisibility (?:of|for) (?:(?:my|our|the|an?) )?(?:ai )?(?:agents?|assistants?|teammates?)\b/.test(query)
+        // An audience phrase ends here or introduces a relative clause.
+        // Trailing inputs such as "workspace email enrichment" keep their owner.
+        || /\b(?:assistants?|teammates?) for (?:(?:my|our|the|a) )?(?:(?:personal|private) use|(?:shared|team) workspace(?=$|[,.!?;:)]| (?:that|which|where|with)\b))\b/.test(query)
+        || /\b(?:private|personal|shared) (?:ai )?(?:agents?|assistants?|teammates?|chats?|conversations?)\b/.test(query);
+    // "Run my private agent only once" is execution, not creator-only access.
+    // An execution request changes owner only when it also names a visibility edit.
+    if (/\bagents?\b/.test(query) && /\b(?:run|execut\w*)\b/.test(query)
+        && !(assistantAudience && /\bvisibility\b/.test(query) && /\b(?:chang\w*|updat\w*|configur\w*|set)\b/.test(query)))
+        return false;
+    if (/\bai (?:agents? )?(?:assistants?|teammates?)\b/.test(query)) {
+        return (conversation || assistantAudience) && (!/\b(?:run|execut\w*)\b/.test(query) || assistantAudience);
+    }
+    // Privacy of an Agent itself belongs to Oxygents, not custom Agent runs.
+    // Keep ordinary run requests and private input data on the Agent gateway.
+    if (/\bagents?\b/.test(query) && assistantAudience
+        && /\b(?:visibility|only|creat\w*|make|new|privacy|configur\w*|settings?)\b/.test(query))
+        return true;
     // Human membership asks must not re-enter Oxygent mutations through the
     // generic fallback after the user-facing routine router excludes them.
     // Explicit Oxygent/AI teammate access above keeps its native owner.
@@ -2087,6 +2191,8 @@ function explicitCapabilityIntent(query) {
         return ROUTE_BY_ID.get("records") ?? null;
     if (crmConnectionsReadRecommendation(query))
         return ROUTE_BY_ID.get("records") ?? null;
+    if (recordDossierReadRecommendation(query))
+        return ROUTE_BY_ID.get("records") ?? null;
     if (crmFileUploadRecommendation(query))
         return ROUTE_BY_ID.get("records") ?? null;
     if (crmMaintenanceRecommendation(query))
@@ -2461,6 +2567,9 @@ function recommendationsFor(card, query) {
     const crmConnections = card.id === "records" ? crmConnectionsReadRecommendation(query) : null;
     if (crmConnections)
         return crmConnections;
+    const dossier = card.id === "records" ? recordDossierReadRecommendation(query) : null;
+    if (dossier)
+        return dossier;
     const crmSample = card.id === "records" ? crmSampleRecordRecommendation(query) : null;
     const crmFileUpload = card.id === "records" ? crmFileUploadRecommendation(query) : null;
     if (crmFileUpload)

package/node_modules/@oxygen/shared/dist/contracts/customer-operations.js

@@ -31,7 +31,7 @@ export const CUSTOMER_OPERATIONS = [
     operation("activation.state", "/api/cli/activation/state", "GET", "activation state", "oxygen_activation_state", "workspace", "Read this workspace's onboarding activation state and next available actions.", {}, [], mcpOnly),
     operation("activation.checklist", "/api/cli/activation/checklist", "GET", "activation checklist", "oxygen_activation_checklist", "workspace", "Read this workspace's getting-started checklist: leads in a table, a first sequence, a connected sending account and a launched sequence, each with whether it is done and a link to do it; eligible says whether the sidebar shows it. Read-only, 0 credits."),
     operation("api_keys.list", "/api/cli/api-keys", "GET", "api-keys list", "oxygen_api_keys_list", "workspace", "List workspace API keys without revealing their tokens.", {}, [], mcpOnly),
-    operation("api_keys.create", "/api/cli/api-keys", "POST", "api-keys create", "oxygen_api_keys_create", "workspace", "Create a workspace API key; requires the caller's personal user session. The token is returned once.", { name: text(), expires_at: text("ISO timestamp; omit for no expiry.") }, [], mcpOnly),
+    operation("api_keys.create", "/api/cli/api-keys", "POST", "api-keys create", "oxygen_api_keys_create", "workspace", "Create a workspace API key; requires the caller's personal user session. The token is returned once.", { name: text(), expires_at: text("ISO timestamp; omit for no expiry."), access: enumOf(["full", "read_only"]) }, [], mcpOnly),
     operation("api_keys.revoke", "/api/cli/api-keys/{key_id}", "DELETE", "api-keys revoke", "oxygen_api_keys_revoke", "workspace", "Revoke a workspace API key; requires the caller's personal user session.", {}, [], mcpOnly),
     operation("comments.edit", "/api/cli/collab/comments/{comment_id}", "PATCH", "comments edit", "oxygen_comments_edit", "collaboration", "Edit your own internal workspace comment; records the edit time.", { body: text() }, ["body"], mcpOnly),
     operation("comments.delete", "/api/cli/collab/comments/{comment_id}", "DELETE", "comments delete", "oxygen_comments_delete", "collaboration", "Retract your own internal workspace comment while retaining its audit trail.", {}, [], mcpOnly),