@oxygen-agent/cli 1.1014.1599 → 1.1014.1696

package/node_modules/@oxygen/shared/dist/contracts/clay-migration.js

@@ -1,17 +1,30 @@
-import { arr, enumOf, int, obj, str } from "./schema.js";
+import { arr, bool, enumOf, int, obj, str } from "./schema.js";
 export const CLAY_MIGRATION_ACTIONS = ["connect", "status", "discover", "read", "transfer", "checkpoint", "report", "disconnect"];
 export const CLAY_RESOURCE_TYPES = ["workspace", "folder", "workbook", "table", "audience", "workflow", "function", "claygent", "knowledge", "schedule", "campaign"];
 export const CLAY_RESOURCE_DISPOSITIONS = ["pending", "copied", "rebuilt", "needs_decision", "unsupported", "inaccessible", "excluded", "failed"];
+export const CLAY_GLOBAL_AUDIENCE_SCOPES = {
+    "global-people": { entity_type: "people", global: true },
+    "global-companies": { entity_type: "companies", global: true },
+    "global-deals": { entity_type: "deals", global: true },
+    "global-archived-people": { entity_type: "people", global: true, archived: true },
+    "global-archived-companies": { entity_type: "companies", global: true, archived: true },
+    "global-archived-deals": { entity_type: "deals", global: true, archived: true },
+};
+export function clayGlobalAudienceScope(resourceId) {
+    return Object.hasOwn(CLAY_GLOBAL_AUDIENCE_SCOPES, resourceId) ? CLAY_GLOBAL_AUDIENCE_SCOPES[resourceId] : null;
+}
 export const CLAY_MIGRATION_CONTRACT = obj({
     action: enumOf(CLAY_MIGRATION_ACTIONS),
     migration_id: str({ minLength: 1, maxLength: 200 }),
     source_workspace_id: str({ minLength: 1, maxLength: 200 }),
     resource_type: enumOf(CLAY_RESOURCE_TYPES),
-    resource_id: str({ minLength: 1, maxLength: 200 }),
-    section: enumOf(["metadata", "columns", "rows", "graph", "fields", "record_ids", "records", "sequence"]),
-    path: str({ minLength: 1, maxLength: 1000, description: "Dotted path or JSON pointer into source configuration, e.g. data.0.settings." }),
+    resource_id: str({ minLength: 1, maxLength: 256 }),
+    row_id: str({ minLength: 1, maxLength: 200, pattern: "^[a-zA-Z0-9][a-zA-Z0-9_-]*$", description: "Source row ID for table read section=row; retains structured cell fields separately from displayed values." }),
+    section: enumOf(["metadata", "columns", "rows", "row", "graph", "fields", "record_ids", "records", "sequence"]),
+    path: str({ minLength: 1, maxLength: 1000, description: "Dotted path or JSON pointer into a source response, e.g. cells.f_1.fields." }),
     text_offset: int({ minimum: 0, maximum: 8388608, description: "Continue a large scalar read at next_text_offset." }),
     entity_type: enumOf(["people", "companies", "deals"]),
+    archived: bool({ description: "Read archived Audience IDs instead of the default scope; only read section=record_ids. Transfer scope is pinned by resource_id." }),
     record_ids: arr(int({ minimum: 1 }), { minItems: 1, maxItems: 100 }),
     cursor: str({ maxLength: 4000 }),
     limit: int({ minimum: 1, maximum: 100 }),
@@ -48,6 +61,21 @@ export function clayMigrationInputIssues(args) {
         requireField("entity_type");
         requireField("record_ids");
     }
+    if (args.archived !== undefined && !(args.action === "read" && args.resource_type === "audience" && args.section === "record_ids")) {
+        issues.push({ path: "archived", message: "archived is only available for Audience read section=record_ids; transfer scope is bound to its discovered resource." });
+    }
+    const rowRead = args.action === "read" && args.resource_type === "table" && args.section === "row";
+    if (args.section === "row" && !rowRead)
+        issues.push({ path: "section", message: "section=row requires action=read and resource_type=table." });
+    if (rowRead) {
+        requireField("row_id");
+        for (const key of ["cursor", "limit", "entity_type", "record_ids", "target_table", "mapping", "source_cells_column", "source_row_id_column", "disposition", "target_kind", "target_id", "notes"]) {
+            if (args[key] !== undefined)
+                issues.push({ path: key, message: `${key} is unavailable for a single row read.` });
+        }
+    }
+    else if (args.row_id !== undefined)
+        issues.push({ path: "row_id", message: "row_id is only available for table read section=row." });
     return issues;
 }
 export const CLAY_MIGRATION_OPERATION = {

package/node_modules/@oxygen/shared/dist/contracts/customer-operations.js

@@ -36,8 +36,9 @@ export const CUSTOMER_OPERATIONS = [
     operation("sequences.standby.get", "/api/cli/sequences/{sequence}/standby", "GET", "sequences standby get", "oxygen_sequences_standby_get", "sequences", "Read automatic mailbox replacement policy, ready reserve and replacements for a campaign."),
     operation("sequences.standby.set", "/api/cli/sequences/{sequence}/standby", "PATCH", "sequences standby set", "oxygen_sequences_standby_set", "sequences", "Enable or disable automatic replacement after bounce protection pauses a mailbox. Preview first; apply with approved and returned plan. Shared reserves may change sender identity for uncontacted leads. Contacted leads keep their original inbox and hold follow-ups. 0 credits.", { enabled: bool(), approved: bool(), plan: text() }, ["enabled"]),
     operation("chat.channel", "/api/cli/chat", "GET", "chat channel", "oxygen_chat_channel", "workspace", "Dev only: read or initialize this workspace's native support channel, persistent threads, unread counts and members; optional search matches messages.", {}, [], { contract: CHAT_CHANNEL_READ_CONTRACT, mutates: true }),
+    operation("chat.threads.list", "/api/cli/chat/threads", "GET", "chat threads list", "oxygen_chat_threads_list", "workspace", "Dev only: list up to 100 recently updated support threads in this workspace. Search retained subjects and visible messages; initialized=false means no channel. Never creates a channel or marks messages read.", {}, [], { contract: CHAT_CHANNEL_READ_CONTRACT }),
     operation("chat.threads.create", "/api/cli/chat/threads", "POST", "chat threads create", "oxygen_chat_thread_create", "workspace", "Dev only: create a persistent native support thread; subject and body are customer-visible. No Plain or Slack transport.", {}, [], { contract: CHAT_THREAD_CREATE_CONTRACT }),
-    operation("chat.threads.get", "/api/cli/chat/threads/{thread_id}", "GET", "chat threads get", "oxygen_chat_thread_get", "workspace", "Dev only: read a native support thread, messages, members and release progress. Continue message history with the returned cursor.", {}, [], { contract: CHAT_THREAD_READ_CONTRACT }),
+    operation("chat.threads.get", "/api/cli/chat/threads/{thread_id}", "GET", "chat threads get", "oxygen_chat_thread_get", "workspace", "Dev only: read a native support thread, messages, members and release progress (none: no verified deployment, dev: verified on dev, prod: verified in production; stale means recheck). Continue message history with the returned cursor.", {}, [], { contract: CHAT_THREAD_READ_CONTRACT }),
     operation("chat.threads.reply", "/api/cli/chat/threads/{thread_id}/messages", "POST", "chat threads reply", "oxygen_chat_thread_reply", "workspace", "Dev only: reply in a native support thread with uploaded attachment IDs and member mentions. Public by default; internal notes require staff.", {}, [], { contract: CHAT_MESSAGE_CONTRACT }),
     operation("chat.threads.update", "/api/cli/chat/threads/{thread_id}", "PATCH", "chat threads update", "oxygen_chat_thread_update", "workspace", "Staff-only. Dev only: update native support status, assignment, urgency, fixing-agent progress or fix evidence; release status is verified separately.", {}, [], { contract: CHAT_THREAD_PATCH_CONTRACT }),
     operation("chat.threads.read", "/api/cli/chat/threads/{thread_id}/read", "POST", "chat threads read", "oxygen_chat_thread_read", "workspace", "Dev only: mark a native support thread read through the viewed cursor; omit cursor to mark all currently visible messages.", { cursor: text() }, [], { bodyRequired: true }),

package/node_modules/@oxygen/shared/dist/copilot-journeys.generated.js

@@ -1,5 +1,5 @@
 // GENERATED by apps/web/scripts/generate-copilot-journeys.ts from the recipe
-// catalog (`journey:` blocks in apps/web/src/lib/recipes/plays).
+// catalog (`journey:` blocks in apps/web/src/lib/agent-skill-plays.ts).
 // Do not edit by hand — run `npm run skills:metadata -w @oxygen/web`.
 export const COPILOT_JOURNEYS_GENERATED = [
     {

package/node_modules/@oxygen/shared/dist/copilot-playbooks.generated.d.ts

@@ -1,7 +1,7 @@
 export declare const COPILOT_PLAYBOOKS_GENERATED: readonly [{
     readonly slug: "icp-to-account-map";
     readonly title: "TAM sourcing";
-    readonly prompt: "Find about 25 companies that look like our best customers, grade how well each one fits and why, and show me which kinds fit best. If I share a list, portfolio page or event list, grade that instead.";
+    readonly prompt: "Find about 25 companies that fit who we sell to, grade how well each one fits and why, and show me which kinds fit best. If I share a list, portfolio page or event list, grade that instead.";
 }, {
     readonly slug: "founder-posting-system";
     readonly title: "LinkedIn content strategy";

package/node_modules/@oxygen/shared/dist/copilot-playbooks.generated.js

@@ -1,12 +1,12 @@
 // GENERATED by apps/web/scripts/generate-copilot-playbooks.ts from the play
 // catalog (featured plays: `featured_order`, `label`, `prompt` in
-// apps/web/src/lib/recipes/plays).
+// apps/web/src/lib/agent-skill-plays.ts).
 // Do not edit by hand — run `npm run skills:metadata -w @oxygen/web`.
 export const COPILOT_PLAYBOOKS_GENERATED = [
     {
         slug: "icp-to-account-map",
         title: "TAM sourcing",
-        prompt: "Find about 25 companies that look like our best customers, grade how well each one fits and why, and show me which kinds fit best. If I share a list, portfolio page or event list, grade that instead.",
+        prompt: "Find about 25 companies that fit who we sell to, grade how well each one fits and why, and show me which kinds fit best. If I share a list, portfolio page or event list, grade that instead.",
     },
     {
         slug: "founder-posting-system",

package/node_modules/@oxygen/shared/dist/email-classification-scope.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Which inbound email conversations of a mailbox the paid inbox classifier
+ * triages (Tim, 2026-10-21, T-316). `replies`: Sequence threads and threads the
+ * workspace wrote in; every other conversation (newsletters, notifications,
+ * cold pitches) stays in Unibox unclassified and costs nothing. `all`: every
+ * inbound conversation.
+ *
+ * Without a choice, a Google mailbox the customer added themselves defaults to
+ * `replies`: most of its mail is not outreach, and its poll reads Sent mail, so
+ * a thread they wrote in is recognisable. Every other mailbox defaults to `all`:
+ * Microsoft's poll reads only the Inbox, and a reply to a campaign sent from
+ * another platform has no outbound message here to be recognised by.
+ * tenant-db's `emailClassificationInScopeSql` is the SQL twin of this default.
+ */
+export declare const EMAIL_CLASSIFICATION_SCOPES: readonly ["replies", "all"];
+export type EmailClassificationScope = (typeof EMAIL_CLASSIFICATION_SCOPES)[number];
+/** Mailbox metadata key holding an explicit choice. */
+export declare const EMAIL_CLASSIFICATION_SCOPE_KEY = "classification_scope";
+/** The `mailbox_origin` stamp of a mailbox the customer added themselves. */
+export declare const SELF_ADDED_MAILBOX_ORIGIN = "manual";
+/** The provider whose self-added mailboxes default to `replies`. */
+export declare const SELF_ADDED_REPLIES_PROVIDER = "google";
+export type EmailClassificationScopeView = {
+    scope: EmailClassificationScope;
+    /** `setting` when someone chose it; `default` when it follows the mailbox kind. */
+    source: "setting" | "default";
+};
+export declare function isEmailClassificationScope(value: unknown): value is EmailClassificationScope;
+/** True for a connected full-mail inbox: its analysis is included in the monthly connection, so no scope applies. */
+export declare function isMailboxSyncMetadata(metadata: Record<string, unknown> | null | undefined): boolean;
+/** The scope a mailbox's inbound mail is classified under, or null for a connected full-mail inbox. */
+export declare function resolveEmailClassificationScope(mailbox: {
+    provider: string;
+    metadata: Record<string, unknown> | null | undefined;
+}): EmailClassificationScopeView | null;

package/node_modules/@oxygen/shared/dist/email-classification-scope.js

@@ -0,0 +1,40 @@
+/**
+ * Which inbound email conversations of a mailbox the paid inbox classifier
+ * triages (Tim, 2026-10-21, T-316). `replies`: Sequence threads and threads the
+ * workspace wrote in; every other conversation (newsletters, notifications,
+ * cold pitches) stays in Unibox unclassified and costs nothing. `all`: every
+ * inbound conversation.
+ *
+ * Without a choice, a Google mailbox the customer added themselves defaults to
+ * `replies`: most of its mail is not outreach, and its poll reads Sent mail, so
+ * a thread they wrote in is recognisable. Every other mailbox defaults to `all`:
+ * Microsoft's poll reads only the Inbox, and a reply to a campaign sent from
+ * another platform has no outbound message here to be recognised by.
+ * tenant-db's `emailClassificationInScopeSql` is the SQL twin of this default.
+ */
+export const EMAIL_CLASSIFICATION_SCOPES = ["replies", "all"];
+/** Mailbox metadata key holding an explicit choice. */
+export const EMAIL_CLASSIFICATION_SCOPE_KEY = "classification_scope";
+/** The `mailbox_origin` stamp of a mailbox the customer added themselves. */
+export const SELF_ADDED_MAILBOX_ORIGIN = "manual";
+/** The provider whose self-added mailboxes default to `replies`. */
+export const SELF_ADDED_REPLIES_PROVIDER = "google";
+export function isEmailClassificationScope(value) {
+    return typeof value === "string" && EMAIL_CLASSIFICATION_SCOPES.includes(value);
+}
+/** True for a connected full-mail inbox: its analysis is included in the monthly connection, so no scope applies. */
+export function isMailboxSyncMetadata(metadata) {
+    return metadata != null && Object.hasOwn(metadata, "mailbox_sync");
+}
+/** The scope a mailbox's inbound mail is classified under, or null for a connected full-mail inbox. */
+export function resolveEmailClassificationScope(mailbox) {
+    const { metadata } = mailbox;
+    if (isMailboxSyncMetadata(metadata))
+        return null;
+    const stored = metadata?.[EMAIL_CLASSIFICATION_SCOPE_KEY];
+    if (isEmailClassificationScope(stored))
+        return { scope: stored, source: "setting" };
+    const selfAddedGoogle = metadata?.mailbox_origin === SELF_ADDED_MAILBOX_ORIGIN
+        && mailbox.provider === SELF_ADDED_REPLIES_PROVIDER;
+    return { scope: selfAddedGoogle ? "replies" : "all", source: "default" };
+}

package/node_modules/@oxygen/shared/dist/native-chat.d.ts

@@ -57,6 +57,7 @@ export type ChatMessage = {
         id: string | null;
         name: string;
         kind: "customer" | "staff" | "agent" | "system";
+        image_url?: string | null;
     };
     visibility: "public" | "internal";
     source: "web" | "cli" | "mcp";
@@ -78,6 +79,7 @@ export type ChatChannel = {
     id: string;
     organization_id: string;
     name: string;
+    icon_url?: string | null;
     updated_at: string;
     unread_count: number;
     open_count: number;
@@ -89,6 +91,7 @@ export type ChatMember = {
     id: string;
     name: string;
     email: string | null;
+    image_url?: string | null;
 };
 export type ChatChannelView = {
     channel: ChatChannel;
@@ -96,6 +99,10 @@ export type ChatChannelView = {
     members: ChatMember[];
     cursor: string;
 };
+export type ChatThreadsView = Omit<ChatChannelView, "channel"> & {
+    initialized: boolean;
+    channel: ChatChannel | null;
+};
 export type ChatThreadView = {
     thread: ChatThread;
     messages: ChatMessage[];
@@ -122,3 +129,5 @@ export type ChatThreadPatch = {
         required_roles?: string[];
     };
 };
+/** Display-only URLs; never fetch these server-side or expose credential-bearing URLs. */
+export declare function nativeChatImageUrl(value: unknown): string | null;

package/node_modules/@oxygen/shared/dist/native-chat.js

@@ -1 +1,12 @@
-export {};
+/** Display-only URLs; never fetch these server-side or expose credential-bearing URLs. */
+export function nativeChatImageUrl(value) {
+    if (typeof value !== "string" || value.length > 2_048)
+        return null;
+    try {
+        const url = new URL(value.trim());
+        return ["https:", "http:"].includes(url.protocol) && !url.username && !url.password ? url.href : null;
+    }
+    catch {
+        return null;
+    }
+}

package/node_modules/@oxygen/shared/dist/onboarding-research.d.ts

@@ -21,8 +21,15 @@ export declare const ONBOARDING_RESEARCH_MODEL: {
     readonly level: "medium";
     readonly reasoningEffort: "low";
 };
-/** Provider credits OXYGEN pays for one workspace's onboarding research, over its lifetime. */
-export declare const ONBOARDING_RESEARCH_MAX_CREDITS = 300;
+/**
+ * Provider credits OXYGEN pays for one workspace's onboarding research, over its
+ * lifetime, restarts included. Raised from 300 (Philipp, 2026-10-21: "we can
+ * increase the limit to make the research really good"): a full run took up to
+ * 121 credits, and the Oxygen Demo Workspace ran out on its eighth start.
+ */
+export declare const ONBOARDING_RESEARCH_MAX_CREDITS = 2000;
+/** What one onboarding run (one funded turn) may spend of it, so a run has room to go deep and a restart has room too. */
+export declare const ONBOARDING_RESEARCH_RUN_MAX_CREDITS = 500;
 /** Ceiling on any one research call; a call that names a higher one is lowered to it. */
 export declare const ONBOARDING_RESEARCH_MAX_CREDITS_PER_CALL = 15;
 /** The onboarding turn's own and its sub-agents' inference, credited back once the turn settles. */

package/node_modules/@oxygen/shared/dist/onboarding-research.js

@@ -18,8 +18,15 @@ export const ONBOARDING_RESEARCH_SUBAGENT = "onboarding_researcher";
  * Reliable calls first, then speed: one place to change once measured.
  */
 export const ONBOARDING_RESEARCH_MODEL = { level: "medium", reasoningEffort: "low" };
-/** Provider credits OXYGEN pays for one workspace's onboarding research, over its lifetime. */
-export const ONBOARDING_RESEARCH_MAX_CREDITS = 300;
+/**
+ * Provider credits OXYGEN pays for one workspace's onboarding research, over its
+ * lifetime, restarts included. Raised from 300 (Philipp, 2026-10-21: "we can
+ * increase the limit to make the research really good"): a full run took up to
+ * 121 credits, and the Oxygen Demo Workspace ran out on its eighth start.
+ */
+export const ONBOARDING_RESEARCH_MAX_CREDITS = 2_000;
+/** What one onboarding run (one funded turn) may spend of it, so a run has room to go deep and a restart has room too. */
+export const ONBOARDING_RESEARCH_RUN_MAX_CREDITS = 500;
 /** Ceiling on any one research call; a call that names a higher one is lowered to it. */
 export const ONBOARDING_RESEARCH_MAX_CREDITS_PER_CALL = 15;
 /** The onboarding turn's own and its sub-agents' inference, credited back once the turn settles. */

package/node_modules/@oxygen/shared/dist/recipes.d.ts

@@ -14,6 +14,8 @@ export type RecipePrimitive = typeof RECIPE_PRIMITIVES[number];
 export declare const RECIPE_PREREQUISITE_KINDS: readonly ["sender", "mailbox", "domain", "integration", "knowledge", "asset", "plan", "data"];
 export type RecipePrerequisiteKind = typeof RECIPE_PREREQUISITE_KINDS[number];
 export declare const RECIPE_BODY_SECTIONS: readonly ["The Play", "Before You Start", "Steps", "If It Goes Wrong"];
+export declare const RECIPE_SKILL_PLAY_BODY_SECTIONS: readonly ["When", "Numbers", "Steps", "Kill and scale"];
+export declare const RECIPE_BODY_SHAPES: readonly (readonly string[])[];
 export declare const RECIPE_SLUG_PATTERN: RegExp;
 export declare function recipeWikiSlug(recipeSlug: string): string;
 export declare const RECIPE_KIT_MAX_STAGES = 6;

package/node_modules/@oxygen/shared/dist/recipes.js

@@ -77,6 +77,19 @@ export const RECIPE_BODY_SECTIONS = [
     "Steps",
     "If It Goes Wrong",
 ];
+// The four sections of a play written inside its feature skill (the 2026-10-21
+// sourcing, sequencer and signals plays). The lint takes the shape a body's
+// first heading names and holds the body to exactly that shape.
+export const RECIPE_SKILL_PLAY_BODY_SECTIONS = [
+    "When",
+    "Numbers",
+    "Steps",
+    "Kill and scale",
+];
+export const RECIPE_BODY_SHAPES = [
+    RECIPE_BODY_SECTIONS,
+    RECIPE_SKILL_PLAY_BODY_SECTIONS,
+];
 export const RECIPE_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,119}$/;
 // Wiki slug an install writes: slots into the starter wiki's seeded
 // [[playbooks]] hub convention ([[playbook-outbound]] etc.).

package/node_modules/@oxygen/shared/dist/sending-domain-rollout.d.ts

@@ -0,0 +1,7 @@
+export declare const SENDING_DOMAIN_ROLLOUT_CODE = "sending_domain_rollout_unavailable";
+export declare const SENDING_DOMAIN_ROLLOUT_MESSAGE = "Sending-domain setup and delivery are not available yet.";
+export declare function sendingDomainDeliveryAvailable(): boolean;
+export declare function assertSendingDomainDeliveryAvailable(): void;
+/** Inspect raw intent: invalid/partial settings must never fall back to a mailbox. */
+export declare function hasSendingDomainDeliveryIntent(settings: unknown): boolean;
+export declare function assertSendingDomainSequenceReady(settings: unknown): void;

package/node_modules/@oxygen/shared/dist/sending-domain-rollout.js

@@ -0,0 +1,28 @@
+import { CliHttpError } from "./cli-http-error.js";
+export const SENDING_DOMAIN_ROLLOUT_CODE = "sending_domain_rollout_unavailable";
+export const SENDING_DOMAIN_ROLLOUT_MESSAGE = "Sending-domain setup and delivery are not available yet.";
+// Source-bound hold: shared SES ownership and the whole consuming cohort must
+// be qualified before a future reviewed change admits this lane. No caller,
+// environment, account role or queue-family selector can qualify it.
+export function sendingDomainDeliveryAvailable() { return false; }
+export function assertSendingDomainDeliveryAvailable() {
+    if (!sendingDomainDeliveryAvailable())
+        throw new CliHttpError(503, SENDING_DOMAIN_ROLLOUT_CODE, SENDING_DOMAIN_ROLLOUT_MESSAGE, {
+            details: { retryable: false, next_step: "Keep sending-domain campaigns stopped until sending-domain delivery is available." }, exitCode: 1,
+        });
+}
+/** Inspect raw intent: invalid/partial settings must never fall back to a mailbox. */
+export function hasSendingDomainDeliveryIntent(settings) {
+    if (!settings || typeof settings !== "object")
+        return false;
+    const value = settings.email_delivery;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const delivery = value;
+    return delivery.mode === "sending_domain" || ["sending_domain_id", "from_address", "from_name", "reply_to_mailbox_id", "subscription_list_id"]
+        .some(key => delivery[key] !== undefined);
+}
+export function assertSendingDomainSequenceReady(settings) {
+    if (hasSendingDomainDeliveryIntent(settings))
+        assertSendingDomainDeliveryAvailable();
+}

package/node_modules/@oxygen/shared/dist/tool-call-arguments.d.ts

@@ -0,0 +1,24 @@
+/**
+ * One reader for a model tool call's `arguments` string, shared by the Copilot
+ * (packages/copilot model-output.ts) and the Agents runtime host
+ * (apps/worker agent-cycle.ts) so an Oxygent run and a Copilot turn accept and
+ * refuse exactly the same payloads.
+ *
+ * Only a plain JSON object is an argument set. A complete object followed only
+ * by surplus closing brackets is read as the object: measured on the medium tier
+ * (System 1, s1-knowledge-update-page, 2026-10-21), a capability_run with a
+ * nested page body closed with one `}` too many four times in one turn, each
+ * `Unexpected non-whitespace character after JSON`. The object before the
+ * surplus is exactly what the model wrote; any other trailing text still fails.
+ */
+export type ToolCallArgumentsRead = {
+    ok: true;
+    value: Record<string, unknown>;
+} | {
+    ok: false;
+    /** The parse error, or why a parsed value is not an argument set. */
+    error: string;
+    /** The text around the break, from the FULL payload (an echoed head may end before it). */
+    near?: string;
+};
+export declare function readToolCallArgumentObject(raw: string): ToolCallArgumentsRead;

package/node_modules/@oxygen/shared/dist/tool-call-arguments.js

@@ -0,0 +1,68 @@
+const NOT_AN_OBJECT = "Tool-call arguments must be a JSON object.";
+export function readToolCallArgumentObject(raw) {
+    let parsed;
+    let error;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (caught) {
+        error = caught instanceof Error ? caught.message : String(caught);
+        const trimmed = withoutSurplusClosers(raw);
+        if (trimmed !== null) {
+            try {
+                parsed = JSON.parse(trimmed);
+                error = undefined;
+            }
+            catch {
+                parsed = undefined;
+            }
+        }
+    }
+    // An ARRAY and a bare string both survive JSON.parse; only a plain object is a
+    // valid argument set, so the check is on the shape rather than on the throw.
+    if (error === undefined && parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return { ok: true, value: parsed };
+    }
+    const message = error ?? NOT_AN_OBJECT;
+    const position = Number(/at position (\d+)/.exec(message)?.[1]);
+    return {
+        ok: false,
+        error: message,
+        ...(Number.isFinite(position)
+            ? { near: raw.slice(Math.max(0, position - 60), position + 20) }
+            : {}),
+    };
+}
+/** The payload up to its first complete top-level object when only closers follow, else null. */
+function withoutSurplusClosers(raw) {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    const start = raw.search(/\S/);
+    if (start < 0 || raw[start] !== "{")
+        return null;
+    for (let index = start; index < raw.length; index += 1) {
+        const char = raw[index];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === '"')
+                inString = false;
+            continue;
+        }
+        if (char === '"')
+            inString = true;
+        else if (char === "{" || char === "[")
+            depth += 1;
+        else if (char === "}" || char === "]") {
+            depth -= 1;
+            if (depth === 0) {
+                const rest = raw.slice(index + 1);
+                return rest.trim() !== "" && /^[\s}\]]*$/.test(rest) ? raw.slice(0, index + 1) : null;
+            }
+        }
+    }
+    return null;
+}

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const OXYGEN_VERSION: string;
-export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.987.20";
+export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.1003.12";
 export declare const GEO_EXPORT_MINIMUM_CLI_VERSION = "1.1013.0";

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1014.1599";
+export declare const OXYGEN_BUILD_VERSION = "1.1014.1696";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1014.1599";
+export const OXYGEN_BUILD_VERSION = "1.1014.1696";

package/node_modules/@oxygen/shared/dist/version.js

@@ -49,7 +49,7 @@ export const OXYGEN_VERSION = OXYGEN_BUILD_VERSION;
 // Since 2026-09-28 the release-preparation step advances this literal to the
 // highest CLI version published on npm for at least 30 days. It never lowers
 // the floor. The source change lands on dev before the next production release.
-export const OXYGEN_MINIMUM_CLI_VERSION = "1.987.20";
+export const OXYGEN_MINIMUM_CLI_VERSION = "1.1003.12";
 // The internal GEO export first gains required pagination in this dev version.
 // Earlier pilot clients would save a partial file without its continuation.
 export const GEO_EXPORT_MINIMUM_CLI_VERSION = "1.1013.0";

package/node_modules/@oxygen/shared/dist/workspace-placement.d.ts

@@ -20,6 +20,7 @@ export type StaffPlacementGrant = {
     source_environment: "dev" | "prod";
     receiver_environment: "dev" | "prod";
     receiver_workspace_id: string;
+    allow_daily_limit_override?: true;
 };
 export type WorkspacePlacementProbe = {
     id: string;
@@ -51,6 +52,8 @@ export declare function workspacePlacementId(value: unknown): value is string;
 export declare function readWorkspacePlacementVariants(value: unknown): WorkspacePlacementVariant[];
 export declare function readWorkspacePlacementMailboxIds(value: unknown): string[];
 export declare function workspacePlacementPlanHash(plan: Omit<WorkspacePlacementPlan, "plan_hash">): string;
+/** Exact staff approval can exempt one diagnostic per sender from daily quotas. */
+export declare function workspacePlacementDailyLimitOverride(plan: Pick<WorkspacePlacementPlan, "receiver_scope" | "staff" | "probes" | "message_count">): boolean;
 export declare function buildWorkspacePlacementPlan(input: {
     requestId: string;
     organizationId: string;

package/node_modules/@oxygen/shared/dist/workspace-placement.js

@@ -48,6 +48,15 @@ function canonicalPlacementValue(value) {
 export function workspacePlacementPlanHash(plan) {
     return createHash("sha256").update(JSON.stringify(plan.receiver_scope === "staff" ? canonicalPlacementValue(plan) : plan)).digest("hex");
 }
+/** Exact staff approval can exempt one diagnostic per sender from daily quotas. */
+export function workspacePlacementDailyLimitOverride(plan) {
+    if (plan.receiver_scope !== "staff" || plan.staff?.allow_daily_limit_override !== true || typeof plan.staff.actor_id !== "string" || !plan.staff.actor_id.trim()
+        || !Array.isArray(plan.probes) || plan.probes.length < 1 || plan.probes.length > 50 || plan.message_count !== plan.probes.length
+        || plan.probes.some(p => typeof p?.sender?.address !== "string" || !workspacePlacementId(p.sender.id)))
+        return false;
+    return new Set(plan.probes.map(p => p.sender.address.toLowerCase())).size === plan.probes.length
+        && new Set(plan.probes.map(p => `${p.sender.environment}:${p.sender.organization_id}:${p.sender.id}`)).size === plan.probes.length;
+}
 export function buildWorkspacePlacementPlan(input) {
     if (!workspacePlacementId(input.requestId) || !workspacePlacementId(input.organizationId))
         invalid("The workspace test request is invalid.");
@@ -95,6 +104,8 @@ export function buildWorkspacePlacementPlan(input) {
         ...(input.network ? { receiver_scope: "network" } : input.staff ? { receiver_scope: "staff", staff: input.staff } : {}), billing_mode: "internal", credits: 0, allow_paused_probe: input.allowPausedProbe,
         ...(input.renderedAt ? { rendered_at: input.renderedAt } : {}), ...(input.rendering ? { rendering: input.rendering } : {}),
         probes, excluded_self_sends: excluded, message_count: probes.length };
+    if (input.staff?.allow_daily_limit_override && !workspacePlacementDailyLimitOverride(plan))
+        invalid("Daily-limit overrides allow only one diagnostic email per sender in the approved staff test.");
     return { ...plan, plan_hash: workspacePlacementPlanHash(plan) };
 }
 export function googleWorkspacePlacement(labels, messageId, observedAt) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1014.1599",
+  "version": "1.1014.1696",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",