@oxygen-agent/cli 1.1014.1600 → 1.1014.1696

package/dist/credentials.js

@@ -1,16 +1,10 @@
-import { execFile, spawn } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, chmodSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { promisify } from "node:util";
+import { createCredentialStorage } from "./credential-storage/store.js";
 import { OxygenError } from "@oxygen/shared/cli-result";
 import { sameApiOrigin } from "./runtime.js";
-const execFileAsync = promisify(execFile);
-const SERVICE_NAME = "oxygen-cli";
-const ACCOUNT_NAME = "default";
+export { resolveConfigDir } from "./credential-storage/store.js";
+const { readSystemCredentialPayload, writeSystemCredentialPayload, deleteSystemCredentialPayload } = createCredentialStorage();
 const DEFAULT_API_URL = "https://oxygen-agent.com";
 const DEFAULT_PROFILE_NAME = "default";
-const WINDOWS_CREDENTIAL_PAYLOAD_ENV = "OXYGEN_CLI_WINDOWS_CREDENTIAL_PAYLOAD";
 function readEnvApiUrl(env) {
     const apiUrl = env.OXYGEN_API_URL?.trim();
     return apiUrl ? normalizeApiUrl(apiUrl) : null;
@@ -347,38 +341,6 @@ async function readSystemCredentialDocument(env) {
         return null;
     return parseCredentialDocument(payload);
 }
-async function readSystemCredentialPayload(env) {
-    const store = credentialStore(env);
-    if (store === "keychain")
-        return readMacOSKeychainPayload(env);
-    if (store === "credential-manager")
-        return readWindowsCredentialManagerPayload(env);
-    return readFileCredentialPayload(env);
-}
-async function writeSystemCredentialPayload(payload, env) {
-    const store = credentialStore(env);
-    if (store === "keychain") {
-        await writeMacOSKeychainPayload(payload, env);
-        return;
-    }
-    if (store === "credential-manager") {
-        await writeWindowsCredentialManagerPayload(payload, env);
-        return;
-    }
-    writeFileCredentialPayload(payload, env);
-}
-async function deleteSystemCredentialPayload(env) {
-    const store = credentialStore(env);
-    if (store === "keychain") {
-        await deleteMacOSKeychain(env);
-        return;
-    }
-    if (store === "credential-manager") {
-        await deleteWindowsCredentialManager(env);
-        return;
-    }
-    deleteFileCredentials(env);
-}
 async function writeCredentialDocument(input, env) {
     const activeCredentials = input.profiles[input.activeProfile];
     if (!activeCredentials) {
@@ -397,240 +359,6 @@ async function writeCredentialDocument(input, env) {
         document.identity = activeCredentials.identity;
     await writeSystemCredentialPayload(serializeCredentialDocument(document), env);
 }
-function credentialStore(env) {
-    const forced = env.OXYGEN_CREDENTIAL_STORE?.trim().toLowerCase();
-    if (forced === "file")
-        return "file";
-    if (forced === "keychain")
-        return "keychain";
-    if (forced === "credential-manager")
-        return "credential-manager";
-    if (process.platform === "darwin")
-        return "keychain";
-    if (process.platform === "win32")
-        return "credential-manager";
-    return "file";
-}
-/** The CLI's per-user config directory; `OXYGEN_CONFIG_DIR` overrides it. */
-export function resolveConfigDir(env = process.env) {
-    return env.OXYGEN_CONFIG_DIR?.trim()
-        || (process.platform === "win32"
-            ? join(env.APPDATA || join(homedir(), "AppData", "Roaming"), "oxygen")
-            : join(homedir(), ".config", "oxygen"));
-}
-function credentialsPath(env) {
-    return join(resolveConfigDir(env), "credentials.json");
-}
-function readFileCredentialPayload(env) {
-    const path = credentialsPath(env);
-    if (!existsSync(path))
-        return null;
-    return readFileSync(path, "utf8");
-}
-function writeFileCredentialPayload(payload, env) {
-    const path = credentialsPath(env);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const tempPath = `${path}.${process.pid}.tmp`;
-    writeFileSync(tempPath, payload, { mode: 0o600 });
-    chmodSync(tempPath, 0o600);
-    renameSync(tempPath, path);
-    chmodSync(path, 0o600);
-}
-function deleteFileCredentials(env) {
-    const path = credentialsPath(env);
-    rmSync(path, { force: true });
-}
-async function readMacOSKeychainPayload(env) {
-    try {
-        const { stdout } = await execFileAsync(macOSSecurityCommand(env), [
-            "find-generic-password",
-            "-a",
-            ACCOUNT_NAME,
-            "-s",
-            SERVICE_NAME,
-            "-w",
-        ], { env });
-        return stdout;
-    }
-    catch {
-        return null;
-    }
-}
-// `security -i` reads commands with a line buffer that traditionally caps at
-// 4096 bytes. Beyond that, the input is silently truncated, which would
-// corrupt the stored credential and break re-auth. Reject early with a clear
-// error so a user with too many profiles gets actionable feedback instead of
-// a partial-write that only surfaces on the next CLI invocation.
-const MACOS_SECURITY_LINE_LIMIT_BYTES = 4096;
-async function writeMacOSKeychainPayload(payload, env) {
-    // `security add-generic-password -w PAYLOAD` would put the token in argv
-    // (visible to any same-UID `ps`). Use `security -i` instead: the subcommand
-    // is written on stdin, so the only argv `ps` ever sees is `security -i`.
-    const command = macOSSecurityCommand(env);
-    const escaped = payload.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-    const line = `add-generic-password -a "${ACCOUNT_NAME}" -s "${SERVICE_NAME}" -w "${escaped}" -U\n`;
-    const lineBytes = Buffer.byteLength(line, "utf8");
-    if (lineBytes >= MACOS_SECURITY_LINE_LIMIT_BYTES) {
-        throw credentialStoreError("write", "macOS Keychain", {
-            code: "payload_too_large",
-            stderr: `Credential document is ${lineBytes} bytes; \`security -i\` truncates lines at ${MACOS_SECURITY_LINE_LIMIT_BYTES} bytes. Reduce stored profiles (oxygen logout <profile>) and retry.`,
-        });
-    }
-    await new Promise((resolve, reject) => {
-        const child = spawn(command, ["-i"], { env, stdio: ["pipe", "pipe", "pipe"] });
-        let stderr = "";
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk.toString("utf8");
-        });
-        child.once("error", (error) => {
-            reject(credentialStoreError("write", "macOS Keychain", error));
-        });
-        child.once("close", (code, signal) => {
-            const trimmedStderr = stderr.trim();
-            if (code === 0 && !trimmedStderr) {
-                resolve();
-                return;
-            }
-            reject(credentialStoreError("write", "macOS Keychain", { code, signal, stderr: trimmedStderr }));
-        });
-        child.stdin.end(line);
-    });
-}
-async function deleteMacOSKeychain(env) {
-    await execFileAsync(macOSSecurityCommand(env), [
-        "delete-generic-password",
-        "-a",
-        ACCOUNT_NAME,
-        "-s",
-        SERVICE_NAME,
-    ], { env }).catch(() => undefined);
-}
-async function readWindowsCredentialManagerPayload(env) {
-    try {
-        const { stdout } = await runPowerShell(`${windowsCredentialManagerScript()}
-$ptr = [IntPtr]::Zero
-try {
-  if (-not [OxygenCredMan]::CredRead("${SERVICE_NAME}", 1, 0, [ref]$ptr)) { exit 2 }
-  $cred = [Runtime.InteropServices.Marshal]::PtrToStructure($ptr, [type][OxygenCredMan+CREDENTIAL])
-  $secret = [Runtime.InteropServices.Marshal]::PtrToStringUni($cred.CredentialBlob, [int]($cred.CredentialBlobSize / 2))
-  [Console]::Out.Write($secret)
-} finally {
-  if ($ptr -ne [IntPtr]::Zero) { [OxygenCredMan]::CredFree($ptr) }
-}
-`, env);
-        return stdout;
-    }
-    catch {
-        return null;
-    }
-}
-async function writeWindowsCredentialManagerPayload(value, env) {
-    const payload = Buffer.from(value, "utf16le").toString("base64");
-    try {
-        await runPowerShell(`${windowsCredentialManagerScript()}
-$payload = $env:${WINDOWS_CREDENTIAL_PAYLOAD_ENV}
-if ([string]::IsNullOrWhiteSpace($payload)) { exit 1 }
-$secret = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($payload))
-$bytes = [Text.Encoding]::Unicode.GetBytes($secret)
-$blob = [Runtime.InteropServices.Marshal]::StringToCoTaskMemUni($secret)
-try {
-  $cred = New-Object OxygenCredMan+CREDENTIAL
-  $cred.Type = 1
-  $cred.TargetName = "${SERVICE_NAME}"
-  $cred.UserName = "${ACCOUNT_NAME}"
-  $cred.CredentialBlob = $blob
-  $cred.CredentialBlobSize = $bytes.Length
-  $cred.Persist = 2
-  if (-not [OxygenCredMan]::CredWrite([ref]$cred, 0)) { exit 1 }
-} finally {
-  [Runtime.InteropServices.Marshal]::FreeCoTaskMem($blob)
-}
-`, {
-            ...env,
-            [WINDOWS_CREDENTIAL_PAYLOAD_ENV]: payload,
-        });
-    }
-    catch (error) {
-        throw credentialStoreError("write", "Windows Credential Manager", error);
-    }
-}
-async function deleteWindowsCredentialManager(env) {
-    await runPowerShell(`${windowsCredentialManagerScript()}
-[void][OxygenCredMan]::CredDelete("${SERVICE_NAME}", 1, 0)
-`, env).catch(() => undefined);
-}
-function runPowerShell(script, env) {
-    const encodedCommand = Buffer.from(script, "utf16le").toString("base64");
-    return execFileAsync(windowsPowerShellCommand(env), [
-        "-NoProfile",
-        "-NonInteractive",
-        "-ExecutionPolicy",
-        "Bypass",
-        "-EncodedCommand",
-        encodedCommand,
-    ], { env });
-}
-function credentialStoreError(operation, store, error) {
-    const child = error;
-    const details = {
-        operation,
-        store,
-    };
-    if (typeof child.code === "number") {
-        details.exit_code = child.code;
-    }
-    else if (typeof child.code === "string") {
-        details.reason = child.code;
-    }
-    if (typeof child.signal === "string")
-        details.signal = child.signal;
-    if (typeof child.stderr === "string" && child.stderr.trim()) {
-        details.stderr = sanitizeCredentialErrorText(child.stderr.trim()).slice(0, 4000);
-    }
-    return new OxygenError("credential_store_failed", `Unable to ${operation} Oxygen CLI credentials in ${store}.`, { details, exitCode: 1 });
-}
-function sanitizeCredentialErrorText(value) {
-    return value.replace(/\boxy_(?:live|user)_[A-Za-z0-9_-]+\b/g, "[redacted_token]");
-}
-function macOSSecurityCommand(env) {
-    return env.OXYGEN_SECURITY_COMMAND?.trim() || "security";
-}
-function windowsPowerShellCommand(env) {
-    return env.OXYGEN_POWERSHELL_COMMAND?.trim() || "powershell.exe";
-}
-function windowsCredentialManagerScript() {
-    return `
-Add-Type @"
-using System;
-using System.Runtime.InteropServices;
-public static class OxygenCredMan {
-  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
-  public struct CREDENTIAL {
-    public UInt32 Flags;
-    public UInt32 Type;
-    public string TargetName;
-    public string Comment;
-    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
-    public UInt32 CredentialBlobSize;
-    public IntPtr CredentialBlob;
-    public UInt32 Persist;
-    public UInt32 AttributeCount;
-    public IntPtr Attributes;
-    public string TargetAlias;
-    public string UserName;
-  }
-  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-  public static extern bool CredWrite([In] ref CREDENTIAL userCredential, UInt32 flags);
-  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-  public static extern bool CredRead(string target, UInt32 type, UInt32 reservedFlag, out IntPtr credentialPtr);
-  [DllImport("advapi32.dll", SetLastError = true)]
-  public static extern bool CredDelete(string target, UInt32 type, UInt32 flags);
-  [DllImport("advapi32.dll", SetLastError = true)]
-  public static extern void CredFree([In] IntPtr cred);
-}
-"@
-`;
-}
 function serializeCredentialDocument(document) {
     return JSON.stringify(document);
 }

package/dist/mailbox-fleet-output.js

@@ -29,9 +29,9 @@ export function formatMailboxFleetHealth(data) {
         `Warm-up stop causes: ${counts(warmup.byCause)}`,
         "Enrollment and next actions: oxygen mailboxes list --json (warmupTruth).",
         "",
-        "Domains (worst first):",
+        ...(Array.isArray(data.domain_context) ? ["Selected inbox domains (whole-domain totals):"] : ["Domains (worst first):"]),
     ];
-    const domains = Array.isArray(data.domains) ? data.domains.map(record) : [];
+    const domains = Array.isArray(data.domain_context) ? data.domain_context.map(record) : Array.isArray(data.domains) ? data.domains.map(record) : [];
     for (const domain of domains)
         lines.push(`  ${text(domain.domain)} · ${count(domain.mailboxes)} inboxes · provider rejections ${count(domain.providerRejections7d)} (Google ${count(domain.googleRejections7d)}) · hard bounces ${count(domain.hardBounces7d)} / ${count(domain.coldSends7d)} sequence sends · youngest warm-up day ${count(domain.warmupDayMin)}`);
     if (!domains.length)
@@ -50,11 +50,20 @@ export function formatMailboxFleetHealth(data) {
     }
     const mailboxes = Array.isArray(data.mailboxes) ? data.mailboxes.map(record) : null;
     if (mailboxes) {
+        const selection = record(data.mailbox_selection);
+        if (Object.keys(selection).length)
+            lines.push("", `Selected inbox details: ${count(selection.matched)} of ${count(selection.fleet_total)}; fleet totals remain unfiltered.`);
         lines.push("", `Inbox roster (${mailboxes.length}):`);
         for (const mailbox of mailboxes) {
             const mailboxWarmup = record(mailbox.warmup);
             const warnings = Array.isArray(mailbox.warnings) ? mailbox.warnings.join(", ") : "";
             lines.push(`  ${text(mailbox.emailAddress)} · ${text(mailbox.status)} · health ${text(mailbox.healthState)} (${text(mailbox.healthFreshness)}) · stored warm-up rail ${text(mailboxWarmup.state)}${typeof mailboxWarmup.pauseCode === "string" ? ` / ${mailboxWarmup.pauseCode}` : ""}${warnings ? ` · ${warnings}` : ""}`);
+            if (data.view === "full") {
+                const evidence = record(mailbox.signals);
+                lines.push(`    Last-known external score: ${count(mailbox.healthScore)} · ${text(mailbox.healthProvider)} · checked ${text(mailbox.healthCheckedAt)}`);
+                lines.push(`    ${text(evidence.window)} evidence: ${count(evidence.coldSends7d)} sequence sends · ${count(evidence.hardBounces7d)} hard bounces · ${count(evidence.googleRejections7d)} Google rejections (all send sources)`);
+                lines.push(`    Delivery notifications: ${counts(evidence.dsn7d)} · diagnostic codes: ${counts(evidence.dsnCodes7d)}`);
+            }
         }
     }
     else if (data.view === "fleet")

package/dist/workspace-placement-commands.js

@@ -11,7 +11,8 @@ export function registerWorkspacePlacementCommands(root, handle) {
         .option("--request-id <id>", "Request UUID from preview.").option("--plan <hash>", "Exact preview plan hash.").option("--max-live-sends <n>", "Maximum approved diagnostic emails (1–50).")
         .option("--preview-cursor <id>", "Read the next manifest page using the same input, request ID and rendering time.").option("--preview-limit <n>", "Preview manifest page size (1–20); never use with approval.")
         .option("--preview-probe-id <id>", "Read exact rendered copy for a preview probe; reuse request ID and rendering time.").option("--preview-part <part>", "body_text or body_html.").option("--preview-offset <n>", "Unicode character offset returned by copy preview.").option("--preview-copy-limit <n>", "Copy page size (1–3000 characters).")
-        .option("--allow-paused-probe", "Explicitly allow diagnostic sends from paused senders, preserving pauses.").option("--json", "Print JSON.")
+        .option("--allow-paused-probe", "Explicitly allow diagnostic sends from paused senders, preserving pauses.")
+        .option("--allow-daily-limit-override", "Staff only: approve daily sender/receiver quota exceptions for this exact test, one diagnostic per sender. Preserve mailbox settings.").option("--json", "Print JSON.")
         .action(async (options) => handle("deliverability workspace-test run", options, () => {
         const input = readJsonFileValue(resolve(options.input), "--input");
         if (!input || typeof input !== "object" || Array.isArray(input))
@@ -20,7 +21,7 @@ export function registerWorkspacePlacementCommands(root, handle) {
                 ...(options.approved ? { approved: true } : {}), ...(options.requestId ? { request_id: options.requestId } : {}),
                 ...(options.plan ? { plan_hash: options.plan } : {}), ...(options.renderedAt ? { rendered_at: options.renderedAt } : {}), ...(options.trackingOpens ? { tracking_opens: true } : {}), ...(options.trackingClicks ? { tracking_clicks: true } : {}), ...(options.maxLiveSends ? { max_live_sends: Number(options.maxLiveSends) } : {}),
                 ...(options.receiverEnvironment ? { receiver_environment: options.receiverEnvironment } : {}), ...(options.receiverWorkspace ? { receiver_workspace_id: options.receiverWorkspace } : {}),
-                ...(options.allowPausedProbe ? { allow_paused_probe: true } : {}), ...(options.receiverScope ? { receiver_scope: options.receiverScope } : {}), ...(options.receiverProviders ? { receiver_providers: String(options.receiverProviders).split(",") } : {}),
+                ...(options.allowPausedProbe ? { allow_paused_probe: true } : {}), ...(options.allowDailyLimitOverride ? { allow_daily_limit_override: true } : {}), ...(options.receiverScope ? { receiver_scope: options.receiverScope } : {}), ...(options.receiverProviders ? { receiver_providers: String(options.receiverProviders).split(",") } : {}),
                 ...(options.previewCursor ? { preview_cursor: options.previewCursor } : {}), ...(options.previewLimit !== undefined ? { preview_limit: Number(options.previewLimit) } : {}),
                 ...(options.previewProbeId ? { preview_probe_id: options.previewProbeId } : {}), ...(options.previewPart ? { preview_part: options.previewPart } : {}), ...(options.previewOffset !== undefined ? { preview_offset: Number(options.previewOffset) } : {}), ...(options.previewCopyLimit !== undefined ? { preview_copy_limit: Number(options.previewCopyLimit) } : {}) } });
     })))

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -26,7 +26,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         posture: "workspace_write",
         gatewayTools: ["oxygen_visual_source_create", "oxygen_visual_render_preview", "oxygen_visual_render_get", "oxygen_visual_image_view"],
         gatewayCommands: ["visuals source-create", "visuals render-preview", "visuals render-get", "visuals download"],
-        skills: ["oxygen-knowledge"],
+        skills: ["oxygen-linkedin-content", "oxygen-knowledge"],
         endpointSections: ["visuals"],
         intentTerms: ["infographic", "gtm flow image", "render html", "visual design", "carousel pages", "svg", "png", "pdf export", "graphic designer"],
     },
@@ -114,8 +114,8 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         notFor: "Primitive run diagnosis when no support report is needed; inspect Observability first.",
         execution: "Start or continue a hosted support conversation, optionally file structured metadata, and return its deep link; never send a customer reply automatically.",
         posture: "workspace_write",
-        gatewayTools: ["oxygen_feedback", "oxygen_support_ticket_create", "oxygen_support_tickets_list", "oxygen_chat_channel", "oxygen_chat_thread_get", "oxygen_chat_thread_create", "oxygen_chat_thread_reply", "oxygen_chat_file_upload", "oxygen_chat_file_get", "oxygen_chat_thread_read"],
-        gatewayCommands: ["feedback", "support chat", "support file", "support list", "chat channel", "chat threads get", "chat threads create", "chat threads reply", "chat files upload", "chat files get", "chat threads read"],
+        gatewayTools: ["oxygen_feedback", "oxygen_support_ticket_create", "oxygen_support_tickets_list", "oxygen_chat_threads_list", "oxygen_chat_channel", "oxygen_chat_thread_get", "oxygen_chat_thread_create", "oxygen_chat_thread_reply", "oxygen_chat_file_upload", "oxygen_chat_file_get", "oxygen_chat_thread_read"],
+        gatewayCommands: ["feedback", "support chat", "support file", "support list", "chat threads list", "chat channel", "chat threads get", "chat threads create", "chat threads reply", "chat files upload", "chat files get", "chat threads read"],
         skills: ["oxygen-feedback"],
         endpointSections: ["feedback", "support", "chat"],
         intentTerms: ["support", "feedback", "bug report", "feature request", "report issue", "ticket", "complaint", "support chat", "support thread", "chat attachment"],
@@ -398,12 +398,12 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         posture: "external_write",
         gatewayTools: ["oxygen_publishing_posts_create", "oxygen_publishing_posts_list", "oxygen_publishing_posts_approve", "oxygen_ugc_get"],
         gatewayCommands: ["publishing posts create", "publishing posts list", "publishing posts approve", "ugc programs list", "ugc programs duplicate", "ugc programs archive"],
-        skills: ["oxygen-publishing", "oxygen-ugc"],
+        skills: ["oxygen-publishing", "oxygen-linkedin-content", "oxygen-ugc"],
         endpointSections: ["publishing", "ugc"],
         // "remove program" / "delete program" landed on route: null in a blind eval
         // (2026-09-10); a program is a UGC noun here, and its lifecycle verbs must
         // resolve to the group that owns `ugc programs archive|delete|duplicate`.
-        intentTerms: ["publish", "publishing", "schedule post", "content calendar", "posting calendar", "approve post", "social publishing", "video cover", "video thumbnail", "cover image", "post preview", "ugc", "creator program", "user generated content", "creator voice", "sponsored creator", "ugc program", "archive program", "delete program", "remove program", "duplicate program", "copy program"],
+        intentTerms: ["publish", "publishing", "schedule post", "content calendar", "posting calendar", "approve post", "social publishing", "video cover", "video thumbnail", "cover image", "post preview", "ugc", "creator program", "user generated content", "creator voice", "sponsored creator", "ugc program", "archive program", "delete program", "remove program", "duplicate program", "copy program", "write posts", "write a post", "post ideas", "content pillars", "hook", "linkedin content"],
     },
     {
         id: "workflows",
@@ -486,7 +486,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         posture: "mixed",
         gatewayTools: ["oxygen_integrations_list", "oxygen_integrations_connect", "oxygen_integrations_list_actions"],
         gatewayCommands: ["integrations list", "integrations connect", "custom-integrations list"],
-        skills: ["oxygen-tables", "oxygen-gtm"],
+        skills: ["oxygen-custom-http", "oxygen-tables", "oxygen-gtm"],
         endpointSections: ["custom-integrations", "integrations"],
         intentTerms: ["integration", "integrations", "connect provider", "oauth", "byok", "bring your own key", "provider key", "provider connection", "custom http", "custom integration", "connection readiness"],
     },
@@ -591,6 +591,19 @@ export function inferCapabilityRoute(query) {
     const normalized = normalizeIntent(query);
     if (!normalized)
         return null;
+    if (/\b(custom http|custom integrations?|own (?:rest|http) api)\b/.test(normalized)) {
+        const integrations = ROUTE_BY_ID.get("connected-integrations");
+        if (integrations) {
+            const removal = /\b(remov\w*|delet\w*|disconnect\w*|cleanup|clean up|throwaway|disposable)\b/.test(normalized);
+            const tools = removal ? ["oxygen_custom_integrations_remove", "oxygen_custom_integrations_list"] : ["oxygen_custom_integrations_list", "oxygen_custom_integrations_apply", "oxygen_custom_integration_connect"];
+            const commands = removal ? ["custom-integrations remove", "custom-integrations list"] : ["custom-integrations list", "custom-integrations apply", "custom-integrations connect"];
+            return {
+                card: { ...integrations, gatewayTools: tools, gatewayCommands: commands, skills: ["oxygen-custom-http"], execution: removal ? "Preview the exact custom HTTP connection and tools, then approve the returned plan_hash. Caller definitions and history remain, but bound callers stop working; provider-side key revocation is separate." : "Read oxygen-custom-http for the manifest schema and auth types. Apply registers catalog tools without a provider call; connect stores credentials separately. Preview a tool request before approved live execution." },
+                recommendedTools: tools,
+                recommendedCommands: commands,
+            };
+        }
+    }
     if (/\b(mailbox(?:es)?|inbox(?:es)?)\b/.test(normalized) && /\b(standby|reserve|replacement|replace|burn(?:ed|t)?)\b/.test(normalized)) {
         const campaign = /\b(campaign|sequence|cadence)\b/.test(normalized);
         const card = ROUTE_BY_ID.get(campaign ? "sequences" : "sending-infrastructure") ?? ROUTE_BY_PRIMITIVE.get("sequences");
@@ -734,12 +747,14 @@ export const OXYGEN_PRODUCT_SKILL_AUDIENCES = Object.freeze({
     "oxygen-deliverability": "workspace",
     "oxygen-sequencer": "workspace",
     "oxygen-publishing": "workspace",
+    "oxygen-linkedin-content": "workspace",
     "oxygen-signals": "workspace",
     "oxygen-table-tidy": "workspace",
     "oxygen-diagnostics": "workspace",
     "oxygen-feedback": "workspace",
     "oxygen-clay-migration": "workspace",
     "oxygen-ugc": "workspace",
+    "oxygen-custom-http": "workspace",
     // Retired (RETIRED_PRODUCT_SKILLS): readable for existing pins, never served.
     "oxygen-playbooks": "workspace",
     "oxygen-visual-design": "workspace",
@@ -1149,6 +1164,20 @@ function readInspectionRecommendation(query) {
     if (action)
         return null;
     const stored = positive.replace(/\bwithout\s+(?:changing|approving|rejecting|publishing|running|executing|refreshing)\b(?:\s+(?:widget\s+)?data\b)?/g, "");
+    // A daily cap is context for an inbox inspection, not a recurring job or a
+    // request to change its volume. Keep explicit writes and other owners intact.
+    const mailboxInspection = stored.replace(/\bdaily (?:(?:campaign|sending|email) )?(?:limits?|caps?)\b/g, "sending limit");
+    if (/\b(?:mailbox(?:es)?|inbox(?:es)?|email accounts?|email senders?)\b/.test(stored)
+        && /\b(?:health|reputation|rejections?|bounc\w*|deliverability|dsn|ndr)\b/.test(stored)
+        && !isHostedWorkflowIntent(mailboxInspection)
+        && !isSecondPartyDecisionIntent(stored)
+        && !/\b(?:linkedin|whatsapp|sequences?|campaigns?|tables?|columns?|crm|posts?|messages?|conversations?|threads?|dns|spf|dkim|dmarc|verify|verification|create|write|edit|update|change|delete|remove|archive|save|approve|reject|publish|run|running|execute|send|refresh|launch|enable|disable|apply|import|sync|schedule|enroll|add|set|pause|resume|test)\b/.test(mailboxInspection))
+        return {
+            capabilityId: "sending-infrastructure",
+            tools: ["oxygen_mailboxes_health", "oxygen_mailboxes_get", "oxygen_mailboxes_deliverability_evidence"],
+            commands: ["mailboxes health", "mailboxes get", "mailboxes deliverability evidence"],
+            execution: "Read stored reputation, measurement freshness and seven-day rejection/send evidence with oxygen_mailboxes_health. Its mailboxes selector accepts inbox ids or addresses and defaults to full evidence; fleet totals and coverage stay unfiltered. CLI: mailboxes health --mailboxes <id-or-address> --json. Read oxygen_mailboxes_get for today's effective cap; deliverability evidence adds stored placement and domain checks. These reads cost 0 credits and do not sync providers or change settings. External MCP uses oxygen_capabilities_read; hydrate the selected tool's schema before calling.",
+        };
     // A trigger diagnosis needs the live definition, not run tailing or a call.
     // Keep execution, authoring and run-history requests with their own owners.
     if (/\bworkflows?\b/.test(stored)
@@ -1247,8 +1276,11 @@ function isPartnerBonusReadIntent(query) {
 /** The card a route reports: Publishing's own, or its UGC view for a creator-program ask. */
 function routeCardFor(card, query) {
     const readOnly = readInspectionRecommendation(query);
-    if (readOnly?.capabilityId === card.id)
-        return { ...card, posture: "read_only", execution: readOnly.execution };
+    if (readOnly?.capabilityId === card.id) {
+        const skill = preferredSkillForIntent(card, query);
+        return { ...card, posture: "read_only", execution: readOnly.execution,
+            ...(skill ? { skills: [skill, ...card.skills.filter(name => name !== skill)] } : {}) };
+    }
     const placementGuide = card.id === "sending-infrastructure" ? placementGuideRecommendation(query) : null;
     if (placementGuide)
         card = { ...card, posture: "read_only", execution: placementGuide.execution };
@@ -1361,6 +1393,9 @@ function routeCardFor(card, query) {
     const removal = card.primitive === "tables" ? tableRowRemovalRecommendation(query) : null;
     if (removal)
         card = { ...card, posture: "workspace_write", execution: removal.execution };
+    const insert = card.primitive === "tables" ? tableRowInsertRecommendation(query) : null;
+    if (insert)
+        card = { ...card, posture: "workspace_write", execution: insert.execution };
     const sent = card.id === "connected-linkedin" ? sentLinkedInInvitationReadRecommendation(query) : null;
     if (sent)
         card = { ...card, execution: sent.execution };
@@ -1400,7 +1435,7 @@ function preferredSkillForIntent(card, query) {
         return "oxygen-enrichment";
     if (card.id === "billing-and-budgets" && /\b(explain|why|reduce|increas\w*|burn|spent)\b/.test(query))
         return "oxygen-diagnostics";
-    if (card.id === "sending-infrastructure" && /\b(bounc\w*|health|placement|deliverability|spam)\b/.test(query))
+    if (card.id === "sending-infrastructure" && /\b(bounc\w*|health|reputation|rejections?|placement|deliverability|spam)\b/.test(query))
         return "oxygen-deliverability";
     if (["signals", "linkedin-public-research"].includes(card.id) && /\blinkedin\b/.test(query))
         return "oxygen-signals";
@@ -1865,6 +1900,22 @@ function tableRowRemovalRecommendation(query) {
         execution: "Delete Table rows with tables rows remove-selection (oxygen_table_rows_remove_selection): the rows a readable filter tree matches (--filter-tree-json / filter_tree, the same tree tables query takes), exact row_ids, or an all_matching selection with search, sort, range and exclusions. Hydrate its schema first. Unreadable filter nodes and filters arrays are refused; unqualified all_matching deletes every row. This is permanent and costs 0 credits; to keep a restorable copy first, tables duplicate (oxygen_tables_duplicate, 0 credits). Read the matching rows before deletion and the survivors afterward; each removed row's values stay readable with rows history (oxygen_rows_history). Deleting rows does not stop campaign enrollment.",
     };
 }
+/**
+ * Literal row values go in with the row-insert tool. Without this card "add rows"
+ * ranked create, enrichment and the external Records import first (sweep 3).
+ */
+function tableRowInsertRecommendation(query) {
+    if (!/\brows?\b/.test(query) || !/\b(add|adding|insert\w*|append\w*|put|enter|write)\b/.test(query)
+        || /\b(delete|remove|update|edit|change|set|mark|import\w*|csv|crm|records?|enrich\w*|sync\w*|workflows?|agents?|campaigns?|sequences?|webhooks?|feeds?|functions?|callables?|cells?|dedup\w*|duplicates?)\b/.test(query)
+        || /\b(?:add|insert|new)\s+(?:an?\s+|the\s+)?(?:\w+\s+)?columns?\b/.test(query)
+        || isSecondPartyDecisionIntent(query))
+        return null;
+    return {
+        tools: ["oxygen_table_rows_insert", "oxygen_tables_create", "oxygen_tables_query"],
+        commands: ["tables rows insert", "tables create", "tables query"],
+        execution: "Add literal rows with tables rows insert (oxygen_table_rows_insert): table plus rows, an array of {column_key: value} objects. tables create (oxygen_tables_create) makes the columns but takes no rows, so insert after it. Manual rows are a free internal write. Read the rows back with tables query (oxygen_tables_query).",
+    };
+}
 /** Reads of grid values/state are separate from executing or resolving actions. */
 function tableReadRecommendation(query) {
     if (isFunctionIntent(query) || isSecondPartyDecisionIntent(query)
@@ -2917,6 +2968,9 @@ function recommendationsFor(card, query) {
         const removal = tableRowRemovalRecommendation(query);
         if (removal)
             return removal;
+        const insert = tableRowInsertRecommendation(query);
+        if (insert)
+            return insert;
         const read = tableReadRecommendation(query);
         if (read)
             return read;

package/node_modules/@oxygen/shared/dist/clay-migration-auth-state.d.ts

@@ -1,3 +1,9 @@
-export declare function tagClayMigrationFailureState(error: unknown, encryptedState: string): void;
+type FailureState = {
+    encryptedState: string;
+    expiresAt?: string;
+};
+export declare function tagClayMigrationFailureState(error: unknown, encryptedState: string, expiresAt?: string): void;
 /** Consume only state attached in this process by the migration adapter. */
+export declare function consumeClayMigrationFailureState(error: unknown): FailureState | null;
 export declare function readClayMigrationFailureState(error: unknown): string | null;
+export {};

package/node_modules/@oxygen/shared/dist/clay-migration-auth-state.js

@@ -1,15 +1,16 @@
-// Rotated credentials must survive a failed source read, without becoming part
-// of a customer error, operator log or serialized tool result.
 const failureStates = new WeakMap();
-export function tagClayMigrationFailureState(error, encryptedState) {
+export function tagClayMigrationFailureState(error, encryptedState, expiresAt) {
     if (error !== null && typeof error === "object")
-        failureStates.set(error, encryptedState);
+        failureStates.set(error, { encryptedState, ...(expiresAt === undefined ? {} : { expiresAt }) });
 }
 /** Consume only state attached in this process by the migration adapter. */
-export function readClayMigrationFailureState(error) {
+export function consumeClayMigrationFailureState(error) {
     if (error === null || typeof error !== "object")
         return null;
     const state = failureStates.get(error) ?? null;
     failureStates.delete(error);
     return state;
 }
+export function readClayMigrationFailureState(error) {
+    return consumeClayMigrationFailureState(error)?.encryptedState ?? null;
+}

package/node_modules/@oxygen/shared/dist/contracts/browser-operations.js

@@ -115,6 +115,7 @@ export const BROWSER_OPERATIONS = [
         return_to: text("Same-origin path to return to after Checkout, for example /home."),
         source: text("Optional upgrade-entry attribution; omit if unknown."),
         blocked: text("Optional capability that led to the upgrade; omit if unknown."),
+        allow_promotion_codes: bool({ description: "Show the promotion-code field instead of the first-month offer." }),
     }, ["plan"]),
     operation("billing.confirm", "/api/cli/billing/confirm", "POST", "billing confirm", "oxygen_billing_confirm", "billing", "Confirm a plan-change preview within 15 minutes; approved accepts payment, term and effective date. Unrestricted members allowed; restricted clients denied.", { token: text(), approved: bool() }, ["token", "approved"], { spends: true }),
     operation("billing.portal", "/api/cli/billing/portal", "POST", "billing portal", "oxygen_billing_portal", "billing", "Create a Stripe billing-portal URL. Unrestricted members allowed; restricted clients denied.", { returnUrl: text() }),

package/node_modules/@oxygen/shared/dist/contracts/clay-migration.d.ts

@@ -3,6 +3,41 @@ import { type ContractIssue, type Infer } from "./schema.js";
 export declare const CLAY_MIGRATION_ACTIONS: readonly ["connect", "status", "discover", "read", "transfer", "checkpoint", "report", "disconnect"];
 export declare const CLAY_RESOURCE_TYPES: readonly ["workspace", "folder", "workbook", "table", "audience", "workflow", "function", "claygent", "knowledge", "schedule", "campaign"];
 export declare const CLAY_RESOURCE_DISPOSITIONS: readonly ["pending", "copied", "rebuilt", "needs_decision", "unsupported", "inaccessible", "excluded", "failed"];
+type GlobalAudienceScope = {
+    entity_type: "people" | "companies" | "deals";
+    global: true;
+    archived?: true;
+};
+export declare const CLAY_GLOBAL_AUDIENCE_SCOPES: {
+    readonly "global-people": {
+        readonly entity_type: "people";
+        readonly global: true;
+    };
+    readonly "global-companies": {
+        readonly entity_type: "companies";
+        readonly global: true;
+    };
+    readonly "global-deals": {
+        readonly entity_type: "deals";
+        readonly global: true;
+    };
+    readonly "global-archived-people": {
+        readonly entity_type: "people";
+        readonly global: true;
+        readonly archived: true;
+    };
+    readonly "global-archived-companies": {
+        readonly entity_type: "companies";
+        readonly global: true;
+        readonly archived: true;
+    };
+    readonly "global-archived-deals": {
+        readonly entity_type: "deals";
+        readonly global: true;
+        readonly archived: true;
+    };
+};
+export declare function clayGlobalAudienceScope(resourceId: string): GlobalAudienceScope | null;
 export declare const CLAY_MIGRATION_CONTRACT: import("./schema.js").ContractObject<{
     readonly action: {
         type: "string";
@@ -17,9 +52,10 @@ export declare const CLAY_MIGRATION_CONTRACT: import("./schema.js").ContractObje
         description?: string;
     };
     readonly resource_id: import("./schema.js").StringProperty;
+    readonly row_id: import("./schema.js").StringProperty;
     readonly section: {
         type: "string";
-        enum: readonly ("columns" | "fields" | "graph" | "metadata" | "record_ids" | "records" | "rows" | "sequence")[];
+        enum: readonly ("columns" | "fields" | "graph" | "metadata" | "record_ids" | "records" | "row" | "rows" | "sequence")[];
         description?: string;
     };
     readonly path: import("./schema.js").StringProperty;
@@ -35,6 +71,7 @@ export declare const CLAY_MIGRATION_CONTRACT: import("./schema.js").ContractObje
         enum: readonly ("companies" | "deals" | "people")[];
         description?: string;
     };
+    readonly archived: import("./schema.js").BooleanProperty;
     readonly record_ids: import("./schema.js").ArrayProperty<{
         type: "integer";
         description?: string;
@@ -69,3 +106,4 @@ export declare const CLAY_MIGRATION_CONTRACT: import("./schema.js").ContractObje
 export type ClayMigrationInput = Infer<typeof CLAY_MIGRATION_CONTRACT>;
 export declare function clayMigrationInputIssues(args: Readonly<Record<string, unknown>>): ContractIssue[];
 export declare const CLAY_MIGRATION_OPERATION: OperationSpec<typeof CLAY_MIGRATION_CONTRACT>;
+export {};