@oxygen-agent/cli 1.1014.135 → 1.1014.618

package/node_modules/@oxygen/shared/dist/contracts/teammates.js

@@ -0,0 +1,115 @@
+import { TEAMMATE_GROUP_MAX_MEMBERS, TEAMMATE_GROUP_MIN_MEMBERS, TEAMMATE_GROUP_TITLE_MAX_CHARS } from "../teammate-groups.js";
+import { TEAMMATE_SLUG_PATTERN } from "../teammate-messages.js";
+import { TEAMMATE_TASK_LIMITS } from "../teammate-tasks.js";
+import { NEW_TEAMMATE_NAME, TEAMMATE_AVATAR_COLORS, TEAMMATE_AVATAR_KEYS, TEAMMATE_DESCRIPTION_MAX_CHARS, TEAMMATE_NAME_MAX_CHARS, } from "../teammates.js";
+import { arr, bool, enumOf, int, obj, str } from "./schema.js";
+/**
+ * AI teammates (ADR 0032), branded Oxygents: Agents each person talks to in one
+ * ongoing private chat, the workspace's first one ("New Bot" until named) and
+ * any others added, none with a role (Tim, 2026-10-13). Staff on dev only.
+ * The people-facing names say Oxygent (`oxygen oxygents`, `oxygen_oxygents_*`,
+ * Tim 2026-10-12); the HTTP family and the code keep "teammates".
+ */
+function teammateOperation(id, verb, method, suffix, summary, fields = {}, required = [], spends = false) {
+    const route = `/api/cli/teammates${suffix}`;
+    return {
+        id, route, method,
+        parameters: [...route.matchAll(/\{(\w+)\}/g)].map((match) => match[1]),
+        contract: obj(fields, { required }),
+        cli: { path: ["oxygents", verb.replace(/_/g, "-")], summary },
+        mcp: { name: `oxygen_oxygents_${verb}`, title: `Oxygen: Oxygents ${verb}`, description: summary, pack: "agents" },
+        mutates: method !== "GET", spends,
+    };
+}
+/**
+ * Group chats (phase 7): one person's private chat with two to six Oxygents,
+ * the way Grok Bot's are. Their own route family, so a group never shadows a
+ * teammate whose slug happens to read like a route word.
+ */
+function teammateGroupOperation(id, verb, method, suffix, summary, fields = {}, required = [], spends = false) {
+    const route = `/api/cli/teammate-groups${suffix}`;
+    return {
+        id, route, method,
+        parameters: [...route.matchAll(/\{(\w+)\}/g)].map((match) => match[1]),
+        contract: obj(fields, { required }),
+        cli: { path: ["oxygents", verb.replace(/_/g, "-")], summary },
+        mcp: { name: `oxygen_oxygents_${verb}`, title: `Oxygen: Oxygents ${verb.replace(/_/g, " ")}`, description: summary, pack: "agents" },
+        mutates: method !== "GET", spends,
+    };
+}
+const GROUP_MEMBER_SLUGS = (description) => arr(str({ minLength: 2, maxLength: 49, pattern: TEAMMATE_SLUG_PATTERN }), { maxItems: TEAMMATE_GROUP_MAX_MEMBERS, description });
+export const TEAMMATE_PROFILE_FIELDS = {
+    name: str({ minLength: 1, maxLength: TEAMMATE_NAME_MAX_CHARS, description: "What everyone calls it." }),
+    description: str({
+        maxLength: TEAMMATE_DESCRIPTION_MAX_CHARS,
+        description: "The job it does, in a sentence or two; other Oxygents hand it work by it. Empty clears it.",
+    }),
+    avatar_key: enumOf([...TEAMMATE_AVATAR_KEYS], { description: "The shape of its face." }),
+    avatar_color: enumOf([...TEAMMATE_AVATAR_COLORS], { description: "The colour of its face." }),
+};
+export const TEAMMATE_OPERATIONS = [
+    teammateOperation("teammates.list", "list", "GET", "", "List this workspace's Oxygents, the first one (is_default) on top: name, what each does, its look and your chat with each (working or waiting for you, unread, its latest words). Pinned ones follow the first; hidden ones are marked."),
+    // Adding a teammate (phase 7): a custom Agent that can chat at once and run
+    // on its own, under a policy that asks before any write, send or spend. As in
+    // Grok Bot, it can start as just "New Bot" and learn its job in the chat.
+    teammateOperation("teammates.create", "create", "POST", "", `Add an Oxygent to the workspace, named "${NEW_TEAMMATE_NAME}" unless you name it; tell it its job in your chat with it. It can chat at once and run on its own (background tasks, routines), reading freely and asking before anything that writes, sends or spends. The whole workspace sees it; you own it. Free: adding one starts no inference.`, {
+        ...TEAMMATE_PROFILE_FIELDS,
+        slug: str({ minLength: 2, maxLength: 49, pattern: TEAMMATE_SLUG_PATTERN, description: "Its permanent handle in commands and links; made from the name when omitted." }),
+    }),
+    teammateOperation("teammates.get", "get", "GET", "/{slug}", "Read one Oxygent's profile and your ongoing private chat with it."),
+    teammateOperation("teammates.update", "update", "PATCH", "/{slug}", "Edit an Oxygent's name, what it does (description) or its look (avatar_key, avatar_color). Its instructions, tools and versions are unchanged. Free.", TEAMMATE_PROFILE_FIELDS),
+    // Copy and delete (Tim, 2026-10-13: "CRUD actions ... through the right
+    // click"; "'delete' should be 'full delete'"), as Grok Bot's Bot menu has.
+    teammateOperation("teammates.duplicate", "duplicate", "POST", "/{slug}/duplicate", `Copy an Oxygent as a new one you own, named "<name> copy" unless you name it: its job, look, instructions, skills and tool settings, but not its chats, memory or routines. Free.`, {
+        name: str({
+            minLength: 1, maxLength: TEAMMATE_NAME_MAX_CHARS,
+            description: "What everyone calls the copy. Its slug is made from the name, and a deleted Oxygent's slug stays taken, so a copy can get a numbered one (scout-2).",
+        }),
+    }),
+    teammateOperation("teammates.delete", "delete", "POST", "/{slug}/delete", "Delete an Oxygent for good, for everyone: its profile, every chat with it (group chats included), its routines, team memory and runs. What it made in the workspace stays. Its owner or a workspace admin only; never the first Oxygent. Preview first to see what would go, then delete with confirm set to its slug. Its slug stays taken afterwards. Free; cannot be undone.", {
+        preview: bool({ description: "Only say what would go: its chats and the people they belong to, group chats, routines, runs, attached files and team memory entries." }),
+        confirm: str({ maxLength: 49, description: "Its slug, repeated, to delete it." }),
+    }),
+    teammateOperation("teammates.chat", "chat", "POST", "/{slug}/chat", "Open your ongoing private chat with an Oxygent, creating it the first time. Starts no inference."),
+    teammateOperation("teammates.message", "message", "POST", "/{slug}/messages", "Send a message in your ongoing private chat with an Oxygent. Starts a turn billed from workspace credits; paid or external actions still need approval.", { message: str({ minLength: 1, maxLength: 16000 }) }, ["message"], true),
+    // Read state is the reader's own: a person's client may mark it, a runtime
+    // acting in a chat never does (platform-denied, and refused at the route).
+    teammateOperation("teammates.read", "read", "POST", "/{slug}/read", "Mark your chat with an Oxygent read up to its newest turn (or turn_index), or mark its newest turn unread again. Free.", { turn_index: int({ minimum: 0 }), unread: bool({ description: "On marks its newest turn unread again." }) }),
+    // How a person arranges their own roster (phase 7): only their sidebar moves.
+    teammateOperation("teammates.pin", "pin", "POST", "/{slug}/pin", "Pin an Oxygent near the top of your own sidebar, or unpin it. Only your sidebar changes. Free.", { pinned: bool({ description: "Off unpins it; on, or left out, pins it." }) }),
+    teammateOperation("teammates.hide", "hide", "POST", "/{slug}/hide", "Hide an Oxygent from your own sidebar, or show it again. Its chat is kept; only your sidebar changes. Free. The first Oxygent cannot be hidden.", { hidden: bool({ description: "Off shows it again; on, or left out, hides it." }) }),
+    // Grok Bot's per-Bot "Notifications" switch (Tim, 2026-10-14): one person's own.
+    teammateOperation("teammates.notify", "notify", "POST", "/{slug}/notify", "Turn your notifications from an Oxygent off, or back on: whether it notifies you when it finishes or waits on you. Only yours change (for an API key, those of the person who made it). Free.", { notify: bool({ description: "Off silences it for you; on, or left out, turns them back on." }) }),
+    // Routines (phase 5) are ongoing Agent sessions: set up, paused and resumed
+    // through `agent session`; this lists the caller's own with one teammate.
+    teammateOperation("teammates.routines", "routines", "GET", "/{slug}/routines", "List your routines with an Oxygent: schedule, status, next run and last report. Manage one with `agent session` (pause, resume)."),
+    teammateOperation("teammates.task", "task", "POST", "/{slug}/tasks", "Start a background task from your chat with an Oxygent: an unattended run of it, as you, within max_credits. Its result posts into the chat; it and the run are visible to the workspace. Requires approved:true.", {
+        title: str({ minLength: 1, maxLength: TEAMMATE_TASK_LIMITS.titleChars }),
+        goal: str({ minLength: 1, maxLength: TEAMMATE_TASK_LIMITS.goalChars, description: "What the run does, without needing the chat." }),
+        max_credits: int({ minimum: 1, maximum: TEAMMATE_TASK_LIMITS.maxCredits }),
+        approved: bool({ description: "true: you approve this run and its ceiling." }),
+        proposal_id: str({ maxLength: 64, description: "The proposal from the chat this starts; starting it twice starts one run." }),
+    }, ["title", "goal", "max_credits", "approved"], true),
+    // Shared context (phase 4): the team's memory for a teammate (a Knowledge
+    // page every chat with it reads), each person's own notes, and its work log.
+    teammateOperation("teammates.memory", "memory", "GET", "/{slug}/memory", "List what the team asked an Oxygent to remember. Every chat with it reads this; it is a Knowledge page."),
+    teammateOperation("teammates.remember", "remember", "POST", "/{slug}/memory", "Add one thing to an Oxygent's team memory: every chat with it reads it, and the whole workspace can see it. Free.", { text: str({ minLength: 1, maxLength: 500 }) }, ["text"]),
+    teammateOperation("teammates.forget", "forget", "DELETE", "/{slug}/memory/{entry_id}", "Remove one entry from an Oxygent's team memory."),
+    teammateOperation("teammates.notes", "notes", "GET", "/{slug}/notes", "Read what an Oxygent keeps about you: private to you, read only in your own chat with it."),
+    teammateOperation("teammates.notes_set", "notes_set", "POST", "/{slug}/notes", "Replace what an Oxygent keeps about you; empty clears it. Private to you.", { notes: str({ maxLength: 4000 }) }, ["notes"]),
+    teammateOperation("teammates.activity", "activity", "GET", "/{slug}/activity", "List an Oxygent's recent work: its runs and the actions taken in its chats, as metadata only (no goals or messages)."),
+    teammateGroupOperation("teammate_groups.list", "groups", "GET", "", "List your group chats with Oxygents: name, members and the chat (working or waiting for you, unread, the latest words and who said them). Private to you."),
+    teammateGroupOperation("teammate_groups.create", "group_create", "POST", "", `Start a private group chat with ${TEAMMATE_GROUP_MIN_MEMBERS} to ${TEAMMATE_GROUP_MAX_MEMBERS} Oxygents (members, by slug), named name. Starts no inference: @mention a member in a message to have it answer.`, {
+        name: str({ minLength: 1, maxLength: TEAMMATE_GROUP_TITLE_MAX_CHARS }),
+        members: GROUP_MEMBER_SLUGS("The Oxygents in it, by slug, in the order they show."),
+    }, ["name", "members"]),
+    teammateGroupOperation("teammate_groups.get", "group", "GET", "/{group_id}", "Read one of your group chats: its name, members and the chat's state."),
+    teammateGroupOperation("teammate_groups.update", "group_update", "PATCH", "/{group_id}", `Rename a group chat, or add or remove Oxygents (by slug); it keeps ${TEAMMATE_GROUP_MIN_MEMBERS} to ${TEAMMATE_GROUP_MAX_MEMBERS}. A removed member's earlier messages stay.`, {
+        name: str({ minLength: 1, maxLength: TEAMMATE_GROUP_TITLE_MAX_CHARS }),
+        add: GROUP_MEMBER_SLUGS("Oxygents to add, by slug."),
+        remove: GROUP_MEMBER_SLUGS("Oxygents to remove, by slug."),
+    }),
+    teammateGroupOperation("teammate_groups.message", "group_message", "POST", "/{group_id}/messages", "Send a message in a group chat. The first Oxygent it @mentions answers (else whoever answered last), then each other one it mentions, or one an answer brings in. Each answer is a turn billed from workspace credits; paid or external actions still need approval.", { message: str({ minLength: 1, maxLength: 16000 }) }, ["message"], true),
+    teammateGroupOperation("teammate_groups.read", "group_read", "POST", "/{group_id}/read", "Mark a group chat read up to its newest turn, or up to turn_index.", { turn_index: int({ minimum: 0 }) }),
+    teammateGroupOperation("teammate_groups.end", "group_end", "POST", "/{group_id}/end", "End a group chat: nobody answers in it again, and its messages stay readable."),
+];

package/node_modules/@oxygen/shared/dist/cost-estimate-view.js

@@ -24,15 +24,32 @@ function lineDetail(line) {
     const scheduled = line.scheduled_unit_credits !== undefined && line.scheduled_unit_credits !== null
         ? `; ${credits(line.scheduled_unit_credits)} from the scheduled date`
         : "";
-    return `${quantity} × ${credits(line.unit_credits)}${worst}${scheduled}`;
+    const basis = line.estimate_kind === "floor" ? " minimum" : line.estimate_kind === "ceiling" ? " ceiling" : line.estimate_kind === "typical" ? " estimated average" : "";
+    const found = line.found_unit_credits === undefined ? "" : `; ${credits(line.found_unit_credits)} per found result, 0 on a miss`;
+    const range = line.found_unit_credits !== undefined && line.minimum_credits_per_month !== undefined && line.worst_case_credits_per_month !== null
+        ? `; outcome range ${credits(line.minimum_credits_per_month)}–${credits(line.worst_case_credits_per_month)}`
+        : "";
+    return `${quantity} × ${credits(line.unit_credits)}${basis}${found}${worst}${range}${scheduled}`;
 }
 function lineMonthly(line, worst) {
     if (line.billed_as === "usd")
         return usd(line.usd_per_month);
     return credits(worst ? line.worst_case_credits_per_month : line.credits_per_month);
 }
+function topupText(outcome) {
+    return `short ${credits(outcome.shortfall_credits)}, top up ${credits(outcome.topup_credits)} (${usd(outcome.topup_usd)})`;
+}
 function planText(outcome) {
+    // A top-up cannot clear a plan wall: sending accounts connect only on a paid plan.
+    if (outcome.plan_wall)
+        return "Sending accounts need a paid plan; a top-up does not help";
     const total = outcome.monthly_usd === null ? "" : `${usd(outcome.monthly_usd)} a month all in`;
+    if (outcome.basis === "spendable_balance") {
+        const runway = outcome.months_covered === null ? "zero-credit scenario" : `${outcome.months_covered} months without future grants`;
+        if (outcome.workspace_cap_covers === false)
+            return `${credits(outcome.spendable_credits)} spendable; workspace cap remaining ${credits(outcome.workspace_cap_remaining)} is too low. Top-ups do not raise that cap.`;
+        return `${credits(outcome.spendable_credits)} spendable; ${outcome.covered ? `covers ${runway}; no top-up needed` : topupText(outcome)}`;
+    }
     if (outcome.covered)
         return total ? `Covers it: ${total}` : "Covers it";
     const topup = `short ${credits(outcome.shortfall_credits)}, top up ${credits(outcome.topup_credits)} (${usd(outcome.topup_usd)})`;
@@ -51,7 +68,7 @@ export function costEstimateView(envelope) {
     if (envelope.recommended_plan) {
         const { expected, worst_case: worstCase } = envelope.recommended_plan;
         plans.push({
-            label: "Cheapest plan",
+            label: "Monthly allowance comparison",
             expected: `${expected.label}: ${planText(expected)}`,
             worstCase: `${worstCase.label}: ${planText(worstCase)}`,
         });
@@ -68,7 +85,7 @@ export function costEstimateView(envelope) {
         })),
         totals: totals
             ? [
-                { label: "Credits a month", expected: credits(totals.credits_per_month), worstCase: credits(totals.worst_case_credits_per_month) },
+                { label: envelope.quote_bounds?.expected_complete === false ? "Priced subtotal / floor" : "Credits a month", expected: credits(totals.credits_per_month), worstCase: envelope.quote_bounds?.upper_bound_credits_per_month === null ? "Unknown" : credits(totals.worst_case_credits_per_month) },
                 ...(totals.usd_seats_per_month > 0
                     ? [{ label: "Sending seats (card)", expected: usd(totals.usd_seats_per_month), worstCase: usd(totals.usd_seats_per_month) }]
                     : []),
@@ -84,6 +101,7 @@ export function costEstimateView(envelope) {
         })),
         notes: [
             ...(envelope.warnings ?? []),
+            ...(envelope.lines ?? []).flatMap((line) => line.note ? [line.note] : []),
             ...(envelope.pricing_schedule?.note ? [envelope.pricing_schedule.note] : []),
         ],
     };

package/node_modules/@oxygen/shared/dist/cost-estimate.d.ts

@@ -47,6 +47,10 @@ export type CostEstimateEnrichmentPrice = {
     expectedCreditsPerRow: number | null;
     worstCaseCreditsPerRow: number | null;
     hitRatesAssumed: boolean;
+    note?: string;
+    estimateKind?: "typical" | "ceiling";
+    minimumCreditsPerRow?: number;
+    foundCreditsPerRow?: number;
 };
 export type CostEstimateSenderPrice = {
     billedAs: "credits";
@@ -76,6 +80,11 @@ export type CostEstimatePriceSheet = {
     rungs: readonly CostEstimatePlanRung[];
     /** The plan the estimate is checked against (the workspace's own by default). */
     comparePlan: CostEstimatePlanRung | null;
+    /** Extra recurring resources and static Workflow floors, resolved server-side. */
+    additionalLines?: readonly CostEstimateLine[];
+    /** A non-reconciling billing-owner snapshot; absent for hypothetical plan comparisons. */
+    spendableCredits?: number;
+    workspaceCapRemaining?: number | null;
     creditsPerUsd: number;
     topupUsdCentsPer100: number;
     topupMinCredits: number;
@@ -95,7 +104,7 @@ export type CostEstimatePriceSheet = {
 };
 export type CostEstimateLine = {
     key: string;
-    group: "enrichment" | "senders" | "sending";
+    group: "enrichment" | "senders" | "sending" | "workflow" | "placement";
     label: string;
     quantity: number;
     unit: string;
@@ -109,6 +118,9 @@ export type CostEstimateLine = {
     usd_per_month: number | null;
     scheduled_unit_credits?: number | null;
     note?: string;
+    estimate_kind?: "fixed" | "typical" | "ceiling" | "floor" | "unknown";
+    minimum_credits_per_month?: number;
+    found_unit_credits?: number;
 };
 export type CostEstimatePlanOutcome = {
     plan_key: string;
@@ -116,12 +128,26 @@ export type CostEstimatePlanOutcome = {
     monthly_price_usd: number | null;
     monthly_credits: number;
     covered: boolean;
+    basis?: "spendable_balance" | "monthly_allowance";
+    spendable_credits?: number;
+    workspace_cap_remaining?: number | null;
+    workspace_cap_covers?: boolean;
+    /** Balance-only runway; null for zero cost, not a promise of future grants. */
+    months_covered?: number | null;
     /** Credits the plan does not cover, before rounding to a purchasable top-up. */
     shortfall_credits: number;
     topup_credits: number;
     topup_usd: number;
     /** Plan price + top-ups + seats billed in dollars. */
     monthly_usd: number | null;
+    /**
+     * The scenario needs something this plan cannot connect, whatever the
+     * balance: every sending account connects only on a paid plan (founder,
+     * 2026-10-12), `linkedin_connect` for a LinkedIn account and
+     * `sender_connect` for a mailbox. `covered` is then false and a top-up does
+     * not help.
+     */
+    plan_wall?: "linkedin_connect" | "sender_connect";
 };
 export type CostEstimateLimit = {
     key: "email_per_mailbox" | "linkedin_invites_per_account" | "linkedin_messages_per_account";
@@ -154,6 +180,10 @@ export type CostEstimateResult = {
         usd_seats_per_month: number;
         unpriced_lines: string[];
     };
+    quote_bounds?: {
+        expected_complete: boolean;
+        upper_bound_credits_per_month: number | null;
+    };
     plan_fit: {
         expected: CostEstimatePlanOutcome;
         worst_case: CostEstimatePlanOutcome;

package/node_modules/@oxygen/shared/dist/cost-estimate.js

@@ -27,6 +27,8 @@ export const COST_ESTIMATE_BOUNDS = {
     maxSendersPerKind: 1_000,
     maxEnrichments: 12,
 };
+/** Extra estimate lines that are sending accounts, each walled on Free like a mailbox. */
+const EXTRA_SENDING_ACCOUNT_LINES = new Set(["senders.x_account", "senders.whatsapp_account"]);
 function round2(value) {
     return Math.round((value + Number.EPSILON) * 100) / 100;
 }
@@ -79,8 +81,8 @@ function senderLine(input) {
             : `${formatInt(unit)} credits per ${input.unit} a month, reserved from your balance on the day it connects. ${input.note}`,
     };
 }
-function planOutcome(rung, credits, usdSeats, sheet) {
-    const shortfall = Math.max(0, Math.ceil(credits - rung.monthlyCredits));
+function planOutcome(rung, credits, usdSeats, sheet, spendableCredits, planWall) {
+    const shortfall = Math.max(0, Math.ceil(credits - (spendableCredits ?? rung.monthlyCredits)));
     // The amount `billing topup` actually sells: whole 100-credit steps, never
     // below the smallest pack. Above 100,000 it takes more than one checkout.
     const topupCredits = shortfall === 0
@@ -93,11 +95,19 @@ function planOutcome(rung, credits, usdSeats, sheet) {
         label: rung.label,
         monthly_price_usd: price,
         monthly_credits: rung.monthlyCredits,
-        covered: shortfall === 0,
+        covered: !planWall && shortfall === 0 && (spendableCredits === undefined || sheet.workspaceCapRemaining == null || credits <= sheet.workspaceCapRemaining),
+        basis: spendableCredits === undefined ? "monthly_allowance" : "spendable_balance",
+        ...(spendableCredits === undefined ? {} : {
+            spendable_credits: spendableCredits,
+            workspace_cap_remaining: sheet.workspaceCapRemaining ?? null,
+            workspace_cap_covers: sheet.workspaceCapRemaining == null || credits <= sheet.workspaceCapRemaining,
+            months_covered: credits === 0 ? null : Math.floor(spendableCredits / credits),
+        }),
         shortfall_credits: shortfall,
         topup_credits: topupCredits,
         topup_usd: topupUsd,
         monthly_usd: price === null ? null : round2(price + topupUsd + usdSeats),
+        ...(planWall ? { plan_wall: planWall } : {}),
     };
 }
 /** The cheapest monthly bill: plan plus top-ups, the smallest plan that covers winning a tie. */
@@ -174,7 +184,7 @@ export function estimateScenarioCost(rawScenario, sheet) {
     const warnings = [];
     for (const enrichment of sheet.enrichments) {
         const expected = enrichment.expectedCreditsPerRow;
-        const worst = enrichment.worstCaseCreditsPerRow ?? expected;
+        const worst = enrichment.worstCaseCreditsPerRow;
         const credits = expected === null ? null : round2(leads * expected);
         const worstCredits = worst === null ? null : round2(leads * worst);
         if (enrichment.kind === "unavailable" || expected === null) {
@@ -192,11 +202,14 @@ export function estimateScenarioCost(rawScenario, sheet) {
             credits_per_month: credits,
             worst_case_credits_per_month: worstCredits,
             usd_per_month: credits === null ? null : round2(credits / sheet.creditsPerUsd),
-            note: enrichment.kind === "estimated"
+            estimate_kind: enrichment.estimateKind ?? (enrichment.kind === "fixed" ? "fixed" : enrichment.kind === "estimated" ? "typical" : "unknown"),
+            ...(enrichment.minimumCreditsPerRow === undefined ? {} : { minimum_credits_per_month: round2(leads * enrichment.minimumCreditsPerRow) }),
+            ...(enrichment.foundCreditsPerRow === undefined ? {} : { found_unit_credits: enrichment.foundCreditsPerRow }),
+            note: enrichment.note ?? (enrichment.kind === "estimated"
                 ? `Billed only when a provider finds a result${enrichment.hitRatesAssumed ? "; the expected figure uses assumed hit rates" : ""}. Up to ${worst === null ? "an unknown amount" : `${round2(worst)} credits`} a row if the dearest provider answers every row.`
                 : enrichment.kind === "fixed"
                     ? "The same price on every row."
-                    : "No estimate available.",
+                    : "No estimate available."),
         });
     }
     const mailboxNote = "Warm-up is included.";
@@ -256,10 +269,11 @@ export function estimateScenarioCost(rawScenario, sheet) {
             note: "Sending costs 0 credits; the limits below bound how fast it goes.",
         });
     }
+    lines.push(...(sheet.additionalLines ?? []));
     const sum = (pick, filter) => round2(lines.filter(filter).reduce((total, line) => total + (pick(line) ?? 0), 0));
     const fixed = sum((line) => line.credits_per_month, (line) => line.group === "senders" && line.billed_as === "credits");
-    const flexible = sum((line) => line.credits_per_month, (line) => line.group === "enrichment");
-    const flexibleWorst = sum((line) => line.worst_case_credits_per_month, (line) => line.group === "enrichment");
+    const flexible = sum((line) => line.credits_per_month, (line) => line.group === "enrichment" || line.group === "workflow" || line.group === "placement");
+    const flexibleWorst = sum((line) => line.worst_case_credits_per_month, (line) => line.group === "enrichment" || line.group === "workflow" || line.group === "placement");
     const usdSeats = sum((line) => line.usd_per_month, (line) => line.billed_as === "usd");
     const unpriced = lines
         .filter((line) => line.billed_as === "credits" && line.credits_per_month === null)
@@ -271,15 +285,31 @@ export function estimateScenarioCost(rawScenario, sheet) {
     }
     const credits = round2(fixed + flexible);
     const worstCredits = round2(fixed + flexibleWorst);
-    const planFit = sheet.comparePlan
+    const expectedComplete = unpriced.length === 0 && !lines.some((line) => line.estimate_kind === "floor");
+    const upperBound = lines.some((line) => line.billed_as === "credits" && line.worst_case_credits_per_month === null) ? null : worstCredits;
+    if (!expectedComplete || upperBound === null)
+        warnings.push("Totals are priced subtotals. A floor or unknown cost is not a complete scenario estimate or an approval ceiling; plan recommendations are omitted.");
+    // Every sending account connects only on a paid plan (founder, 2026-10-12),
+    // so the Free plan cannot carry a scenario with any, however many credits it
+    // holds: LinkedIn, mailboxes, and the X and WhatsApp accounts that arrive as
+    // extra lines. The LinkedIn wall is named first when several apply.
+    const freePlan = sheet.comparePlan?.planKey === "free";
+    const extraSendingAccounts = (sheet.additionalLines ?? []).some((line) => EXTRA_SENDING_ACCOUNT_LINES.has(line.key) && line.quantity > 0);
+    const planWall = !freePlan ? undefined
+        : scenario.linkedinAccounts > 0 ? "linkedin_connect"
+            : scenario.mailboxes + scenario.managedMailboxes > 0 || extraSendingAccounts ? "sender_connect"
+                : undefined;
+    if (planWall)
+        warnings.push("Sending accounts connect only on a paid plan; the Free plan cannot connect one, whatever its credits.");
+    const planFit = sheet.comparePlan && expectedComplete && upperBound !== null
         ? {
-            expected: planOutcome(sheet.comparePlan, credits, usdSeats, sheet),
-            worst_case: planOutcome(sheet.comparePlan, worstCredits, usdSeats, sheet),
+            expected: planOutcome(sheet.comparePlan, credits, usdSeats, sheet, sheet.spendableCredits, planWall),
+            worst_case: planOutcome(sheet.comparePlan, worstCredits, usdSeats, sheet, sheet.spendableCredits, planWall),
         }
         : null;
     const recommendedExpected = cheapestRung(credits, usdSeats, sheet);
     const recommendedWorst = cheapestRung(worstCredits, usdSeats, sheet);
-    const recommended = recommendedExpected && recommendedWorst
+    const recommended = expectedComplete && upperBound !== null && recommendedExpected && recommendedWorst
         ? { expected: recommendedExpected, worst_case: recommendedWorst }
         : null;
     const { sending } = sheet;
@@ -329,6 +359,7 @@ export function estimateScenarioCost(rawScenario, sheet) {
     const firstMonthRampHit = limits.find((row) => row.key === "email_per_mailbox"
         && row.first_month_hit && row.first_month_capacity !== null && row.first_month_capacity < row.capacity_per_month);
     const assumptions = [
+        "Entered resources are prospective additions. Existing commitments are already excluded from spendable credits; do not enter already-covered resources again. Quotes create no reservations or authority.",
         "Every lead is already in a table and goes through each enrichment and every sequence step. Finding new leads is priced separately.",
         `Sending limits use ${sending.sendingDaysPerMonth} sending days a month and the defaults for a newly connected account (a sender you already run may be set lower): ${sending.emailPerMailboxPerDay} emails a mailbox a day, ${sending.linkedinInvitesPerDay} LinkedIn invites a day and ${sending.linkedinInvitesPerWeek} a week, ${sending.linkedinMessagesPerDay} LinkedIn messages a day.`,
         "The first LinkedIn step is a connection invite and each later step a message to every lead, so the message count is an upper bound: only accepted invites receive messages.",
@@ -339,14 +370,23 @@ export function estimateScenarioCost(rawScenario, sheet) {
         const ramp = sending.emailRamp.map((step) => step.perDay).join(", ");
         assumptions.push(`A newly connected mailbox ramps up (${ramp} a day) before it sends at its full daily limit; first_month_capacity, first_month_senders_needed and first_month_hit show that first ${sending.sendingDaysPerMonth}-sending-day window. The other capacity and hit fields describe steady state.`);
     }
-    const planText = recommended
+    const cheapestText = recommended
         ? `cheapest all in: the ${recommended.expected.label} plan${recommended.expected.topup_credits > 0 ? " with top-ups" : ""}${usdSeats > 0 ? " and seats" : ""}, ${formatUsd(recommended.expected.monthly_usd ?? 0)} a month`
-        : "no plan could be priced";
+        : !expectedComplete || upperBound === null ? "complete plan comparison withheld" : "no plan could be priced";
+    const planText = planWall
+        ? `sending accounts connect only on a paid plan; ${cheapestText}`
+        : sheet.spendableCredits !== undefined && planFit?.expected.covered
+            ? `current spendable credits cover ${planFit.expected.months_covered === null ? "this zero-credit scenario" : `${planFit.expected.months_covered} months of this scenario without future grants`}; no top-up is needed`
+            : sheet.spendableCredits !== undefined && planFit?.expected.workspace_cap_covers === false
+                ? "workspace monthly cap is too low; a top-up does not raise that cap"
+                : cheapestText;
+    const ceilingOnly = lines.some((line) => line.estimate_kind === "ceiling")
+        && !lines.some((line) => line.estimate_kind === "typical");
     const steps = scenario.emailSteps + scenario.linkedinSteps;
     const scenarioText = `Priced: ${formatInt(leads)} leads a month, ${steps} sequence ${steps === 1 ? "step" : "steps"} per lead (${scenario.emailSteps} email, ${scenario.linkedinSteps} LinkedIn), ${formatInt(totalMailboxes)} ${totalMailboxes === 1 ? "mailbox" : "mailboxes"}, ${formatInt(scenario.linkedinAccounts)} LinkedIn ${scenario.linkedinAccounts === 1 ? "account" : "accounts"}.`;
     const summary = [
         scenarioText,
-        `About ${formatInt(credits)} credits a month expected (up to ${formatInt(worstCredits)} worst case)${usdSeats > 0 ? ` plus ${formatUsd(usdSeats)} a month in sending seats` : ""}; ${planText}.`,
+        `${expectedComplete ? (ceilingOnly ? "Conservative ceiling" : "About") : "Priced subtotal / floor"}: ${formatInt(credits)} credits a month (${upperBound === null ? "upper bound unknown" : `up to ${formatInt(upperBound)} within the model`})${usdSeats > 0 ? ` plus ${formatUsd(usdSeats)} a month in sending seats` : ""}; ${planText}.`,
         limitsHit.length > 0
             ? `Limits hit: ${limits.filter((row) => row.hit).map((row) => `${row.label.toLowerCase()} (needs ${formatInt(row.senders_needed)})`).join(", ")}.`
             : limits.length > 0 ? firstMonthRampHit ? "No steady-state sending limit is hit." : "No sending limit is hit." : "",
@@ -365,6 +405,7 @@ export function estimateScenarioCost(rawScenario, sheet) {
             usd_seats_per_month: usdSeats,
             unpriced_lines: unpriced,
         },
+        quote_bounds: { expected_complete: expectedComplete, upper_bound_credits_per_month: upperBound },
         plan_fit: planFit,
         recommended_plan: recommended,
         limits,

package/node_modules/@oxygen/shared/dist/diagnostic-credentials.d.ts

@@ -1,4 +1,6 @@
 /** Credential-bearing tool contracts already excluded by MCP analytics. */
 export declare const MCP_ARGUMENT_DENYLIST_TOOLS: ReadonlySet<string>;
 export declare const MCP_RESPONSE_DENYLIST_TOOLS: ReadonlySet<string>;
+/** Operations whose output is what a person said aloud (the composer's dictation): never stored. */
+export declare const SPOKEN_OUTPUT_OPERATIONS: ReadonlySet<string>;
 export declare function credentialBearingOperation(operation: string, direction: "input" | "output"): boolean;

package/node_modules/@oxygen/shared/dist/diagnostic-credentials.js

@@ -5,6 +5,8 @@ export const MCP_ARGUMENT_DENYLIST_TOOLS = new Set([
 export const MCP_RESPONSE_DENYLIST_TOOLS = new Set([
     "oxygen_senders_connect", "oxygen_whatsapp_connect", "oxygen_mailboxes_connect_oauth", "oxygen_integrations_connect",
 ]);
+/** Operations whose output is what a person said aloud (the composer's dictation): never stored. */
+export const SPOKEN_OUTPUT_OPERATIONS = new Set(["copilot dictation"]);
 export function credentialBearingOperation(operation, direction) {
     if (direction === "input")
         return MCP_ARGUMENT_DENYLIST_TOOLS.has(operation) || /(?:senders|linkedin).*checkpoint.*solve|custom.integrations.apply/.test(operation);

package/node_modules/@oxygen/shared/dist/diagnostic-lock.js

@@ -1,58 +1,85 @@
 import { randomUUID } from "node:crypto";
 import { link, open, readFile, unlink } from "node:fs/promises";
+import { acquireDiagnosticStorageLock } from "./diagnostic-storage-lock.js";
 /** Private spool lock. A dead owner is recoverable; age never evicts a live writer. */
 export async function acquireDiagnosticLock(path) {
-    for (let attempt = 0; attempt < 2; attempt++) {
-        // Publish only an initialized owner. A crash between exclusive creation and
-        // writing a PID must not leave an empty, permanently unknowable lock.
-        const temporary = path + `.${randomUUID()}.tmp`;
-        const contents = JSON.stringify({ pid: process.pid, nonce: randomUUID(), start: await processStart(process.pid) });
-        const handle = await open(temporary, "wx", 0o600).catch(() => null);
-        if (!handle)
-            return null;
-        let published = false;
-        try {
-            await handle.writeFile(contents);
-            await handle.sync();
-            published = await link(temporary, path).then(() => true, () => false);
-        }
-        finally {
-            await unlink(temporary).catch(() => undefined);
-            if (!published)
-                await handle.close();
-        }
-        if (published) {
-            return async () => {
-                await handle.close();
-                if (await readFile(path, "utf8").catch(() => null) === contents)
-                    await unlink(path).catch(() => undefined);
-            };
-        }
-        const ownerContents = await readFile(path, "utf8").catch(() => null);
-        if (!ownerContents)
-            return null; // Unknown/unfinished owner stays protected.
-        try {
-            const owner = JSON.parse(ownerContents);
-            if (!Number.isInteger(owner.pid) || owner.pid <= 0)
+    // Comparing an owner and unlinking its pathname is not atomic: two recoverers
+    // can both observe a dead owner, then one removes the other's newly live lock.
+    // Hold the kernel mutex through recovery, publication and release. The owner
+    // file still protects live/unknown clients using the earlier lock protocol.
+    const releaseMutex = await acquireDiagnosticStorageLock(path);
+    if (!releaseMutex)
+        return null;
+    let held = false;
+    try {
+        for (let attempt = 0; attempt < 2; attempt++) {
+            // Publish only an initialized owner. A crash between exclusive creation and
+            // writing a PID must not leave an empty, permanently unknowable lock.
+            const temporary = path + `.${randomUUID()}.tmp`;
+            const contents = JSON.stringify({ pid: process.pid, nonce: randomUUID(), start: await processStart(process.pid) });
+            const handle = await open(temporary, "wx", 0o600).catch(() => null);
+            if (!handle)
                 return null;
-            let alive = true;
+            let published = false;
             try {
-                process.kill(owner.pid, 0);
+                await handle.writeFile(contents);
+                await handle.sync();
+                published = await link(temporary, path).then(() => true, () => false);
+            }
+            finally {
+                await unlink(temporary).catch(() => undefined);
+                if (!published)
+                    await handle.close();
             }
-            catch (error) {
-                alive = error.code !== "ESRCH";
+            if (published) {
+                held = true;
+                let closed = false;
+                return async () => {
+                    if (closed)
+                        return;
+                    closed = true;
+                    try {
+                        await handle.close();
+                        if (await readFile(path, "utf8").catch(() => null) === contents)
+                            await unlink(path).catch(() => undefined);
+                    }
+                    finally {
+                        await releaseMutex();
+                    }
+                };
             }
-            const start = alive ? await processStart(owner.pid) : null;
-            if (alive && (!owner.start || !start || owner.start === start))
+            const ownerContents = await readFile(path, "utf8").catch(() => null);
+            if (!ownerContents)
+                return null; // Unknown/unfinished owner stays protected.
+            try {
+                const owner = JSON.parse(ownerContents);
+                if (!Number.isInteger(owner.pid) || owner.pid <= 0)
+                    return null;
+                if (owner.start !== undefined && owner.start !== null && typeof owner.start !== "string")
+                    return null;
+                let alive = true;
+                try {
+                    process.kill(owner.pid, 0);
+                }
+                catch (error) {
+                    alive = error.code !== "ESRCH";
+                }
+                const start = alive ? await processStart(owner.pid) : null;
+                if (alive && (!owner.start || !start || owner.start === start))
+                    return null;
+                if (await readFile(path, "utf8").catch(() => null) === ownerContents)
+                    await unlink(path).catch(() => undefined);
+            }
+            catch {
                 return null;
-            if (await readFile(path, "utf8").catch(() => null) === ownerContents)
-                await unlink(path).catch(() => undefined);
-        }
-        catch {
-            return null;
+            }
         }
+        return null;
+    }
+    finally {
+        if (!held)
+            await releaseMutex();
     }
-    return null;
 }
 async function processStart(pid) {
     const value = await readFile(`/proc/${pid}/stat`, "utf8").catch(() => null);

package/node_modules/@oxygen/shared/dist/diagnostic-spool.d.ts

@@ -0,0 +1,18 @@
+import { type DiagnosticRecord } from "./diagnostics.js";
+export type UploadReservation = {
+    path: string;
+};
+export type UploadProgress = {
+    sha256: string;
+    store: string;
+    published: boolean;
+};
+/** Admit durable content plus bounded receipt bytes; acknowledge only after publication. */
+export declare function admitDiagnosticSpool(directory: string, record: DiagnosticRecord, compressed: Buffer): Promise<() => Promise<void>>;
+/** Receipt writes share the admission owner's protected byte count and retry reservation. */
+export declare function saveDiagnosticUploadProgress(directory: string, record: DiagnosticRecord, progress: UploadProgress, reservation?: UploadReservation): Promise<void>;
+/** A fixed set of stripes bounds SQLite lock files while coordinating direct and retry owners. */
+export declare function lockDiagnosticUpload(directory: string, id: string, waitMs?: number): Promise<() => Promise<void>>;
+export declare function readUploadProgress(directory: string, id: string, storeFingerprint: string): Promise<UploadProgress | null>;
+/** Replay retained bytes under their stripe; publication owns the upload acknowledgment. */
+export declare function retryDiagnosticSpool(directory: string, storeFingerprint: string, upload: (compressed: Buffer, reservation?: UploadReservation) => Promise<void>): Promise<void>;