@oxygen-agent/cli 1.1014.1600 → 1.1014.1763

package/node_modules/@oxygen/shared/dist/skill-plays.generated.js

@@ -0,0 +1,269 @@
+// GENERATED by apps/web/scripts/generate-copilot-playbooks.ts from the play
+// catalog (`skill`, `title`, `trigger_phrases` in apps/web/src/lib/agent-skill-plays.ts).
+// Do not edit by hand — run `npm run skills:metadata -w @oxygen/web`.
+export const SKILL_PLAY_TRIGGERS_GENERATED = [
+    {
+        skill: "oxygen-clay-migration",
+        slug: "migrate-from-clay",
+        phrases: [
+            "Migrate from Clay",
+            "Move my whole Clay workspace into Oxygen",
+            "Clay is too expensive — what's the switch cost?",
+            "Rebuild my Clay waterfalls here",
+            "Import a Clay CSV and re-enrich it",
+            "How do I replace Claygent with Oxygen?",
+            "Bring my Clay company list over and score it",
+        ],
+    },
+    {
+        skill: "oxygen-crm",
+        slug: "website-visitor-outreach",
+        phrases: [
+            "Turn de-anonymized website visitors into warm pipeline",
+            "People visit our website but never convert",
+            "Who is on my site right now — and can we contact them?",
+            "Which companies visited our website this week?",
+            "Turn website traffic into leads",
+            "Set up visitor de-anonymization",
+            "Connect RB2B to OXYGEN",
+        ],
+    },
+    {
+        skill: "oxygen-diagnostics",
+        slug: "day-30-review",
+        phrases: [
+            "Day 30: review, scale, or kill",
+            "What worked this month and what did it cost?",
+            "Review my GTM runs and decide what to scale",
+            "Monthly review of sequences and spend",
+            "Should I kill or scale this play?",
+            "Where did my credits go this month?",
+        ],
+    },
+    {
+        skill: "oxygen-email-infra",
+        slug: "email-infra-setup",
+        phrases: [
+            "Set up cold email infrastructure",
+            "Set up cold email infrastructure",
+            "I need sending domains and mailboxes for outbound",
+            "How do I send cold email without burning my domain?",
+            "Buy me some inboxes for a cold email campaign",
+            "Stand up a warmed mailbox pool for outreach",
+            "What do sending inboxes cost per month?",
+        ],
+    },
+    {
+        skill: "oxygen-knowledge",
+        slug: "client-workspace-launch",
+        phrases: [
+            "Stand up a new client workspace",
+            "Onboard a new client into Oxygen",
+            "Set up a workspace for a new client",
+            "How do I run Oxygen for multiple clients?",
+            "Stand up a client account from scratch",
+            "Repeatable client onboarding for my agency",
+        ],
+    },
+    {
+        skill: "oxygen-onboarding",
+        slug: "day-1-first-win",
+        phrases: [
+            "Day 1: from your offer to your warmest leads",
+            "I just signed up — what do I actually do with this?",
+            "Where do I start with Oxygen?",
+            "Who should I contact first?",
+            "Find my warmest leads",
+            "What should I do in my first session?",
+        ],
+    },
+    {
+        skill: "oxygen-publishing",
+        slug: "founder-posting-system",
+        phrases: [
+            "A founder posting system grounded in your knowledge base",
+            "I should be posting on LinkedIn but never do",
+            "Draft LinkedIn posts in my voice",
+            "Plan my LinkedIn content for the week",
+            "Set up a content calendar",
+            "I can't post consistently — schedule my posts for me",
+            "Turn my company knowledge into LinkedIn posts",
+        ],
+    },
+    {
+        skill: "oxygen-sequencer",
+        slug: "inbound-led-outbound",
+        phrases: [
+            "Inbound-led outbound: post engagers into a capped warm sequence",
+            "Turn the people who engage with my LinkedIn posts into pipeline",
+            "Who is engaging with my competitors' or my niche creators' posts?",
+            "Reach the people engaging with LinkedIn posts about my topic",
+            "Turn my LinkedIn connections and followers into pipeline",
+            "Turn my LinkedIn profile viewers into leads",
+            "I have no lead list. Where do I start on LinkedIn?",
+        ],
+    },
+    {
+        skill: "oxygen-sequencer",
+        slug: "multichannel-top-tier",
+        phrases: [
+            "Email + LinkedIn for top-tier leads",
+            "Combine email and LinkedIn for our best accounts",
+            "Run a multichannel sequence for top-tier leads",
+            "Email plus a LinkedIn invite for high-fit accounts",
+            "LinkedIn first for warm leads, email as the fallback",
+        ],
+    },
+    {
+        skill: "oxygen-sequencer",
+        slug: "outbound-pilot-50",
+        phrases: [
+            "Launch a 50-lead outbound pilot",
+            "I need outbound running this week",
+            "Build me a cold outreach pilot",
+            "Find 50 leads and draft first emails for me to review",
+            "I have no pipeline — start outbound",
+        ],
+    },
+    {
+        skill: "oxygen-sequencer",
+        slug: "signal-outbound",
+        phrases: [
+            "Signal-based email outbound",
+            "Email companies that are hiring for this role",
+            "Reach people who just showed buying intent",
+            "Turn hiring signals into cold email",
+            "Email our website visitors and signups who fit",
+        ],
+    },
+    {
+        skill: "oxygen-sequencer",
+        slug: "whole-tam-email",
+        phrases: [
+            "Whole-market cold email",
+            "Run cold email across our whole market",
+            "Set up evergreen cold email at full capacity",
+            "A/B test our cold email CTAs and subject lines",
+            "Re-contact the people who never replied",
+            "The pilot worked — how do I scale cold email?",
+            "Build a repeatable cold email system",
+        ],
+    },
+    {
+        skill: "oxygen-signals",
+        slug: "daily-warm-lead-queue",
+        phrases: [
+            "A daily ranked queue of your warmest leads",
+            "Who should I reach out to today?",
+            "Give me one ranked list of my warmest leads every morning",
+            "Turn all my intent signals into a daily to-do list",
+            "Make Oxygen do something while I'm not looking",
+            "What should I set up in my first week?",
+            "Set up a weekly CRM cleanup routine",
+        ],
+    },
+    {
+        skill: "oxygen-signals",
+        slug: "existing-network",
+        phrases: [
+            "Hand-written first messages to buyers already in your network",
+            "Work my network",
+            "Reactivate my connections",
+            "Message the buyers I'm already connected to",
+            "Write personal messages to my LinkedIn connections",
+        ],
+    },
+    {
+        skill: "oxygen-signals",
+        slug: "new-connections",
+        phrases: [
+            "Message the buyers among your new connections",
+            "Follow up with my new LinkedIn connections",
+            "Message the people who just connected with me",
+            "Which of my new connections are buyers?",
+            "Start conversations with my recent connections",
+        ],
+    },
+    {
+        skill: "oxygen-signals",
+        slug: "post-engagers",
+        phrases: [
+            "Start conversations with the buyers who engage with your posts",
+            "Reach the people who engage with my LinkedIn posts",
+            "Message the people who commented on my post",
+            "Who reacted to my post, and are they buyers?",
+            "Turn my post engagers into conversations",
+        ],
+    },
+    {
+        skill: "oxygen-signals",
+        slug: "profile-viewers-and-followers",
+        phrases: [
+            "Invite the buyers who view your profile or follow you",
+            "Reach out to the people who viewed my LinkedIn profile",
+            "Turn my LinkedIn followers into conversations",
+            "Invite my followers who aren't connected yet",
+            "Who viewed my profile, and should I contact them?",
+        ],
+    },
+    {
+        skill: "oxygen-sourcing",
+        slug: "icp-to-account-map",
+        phrases: [
+            "Turn your ICP into a scored account map",
+            "Turn my ICP into a list of target accounts",
+            "Find B2B SaaS accounts that match our ideal customer profile",
+            "Who should we actually be selling to?",
+            "Map my market and score the companies by fit",
+            "Pull the companies off this VC portfolio, partner directory or event page",
+            "I have a list of companies, which ones fit us best?",
+        ],
+    },
+    {
+        skill: "oxygen-sourcing",
+        slug: "local-business-maps",
+        phrases: [
+            "Local businesses from Google Maps",
+            "Find local businesses in my cities",
+            "Get a list of clinics or restaurants by city",
+            "Pull businesses from Google Maps",
+            "Our buyers are local businesses with a physical location",
+        ],
+    },
+    {
+        skill: "oxygen-sourcing",
+        slug: "lookalike-tam",
+        phrases: [
+            "Lookalike TAM",
+            "Find more companies like our best customers",
+            "Build a lookalike list from our customers",
+            "Who else looks like the customers we already have?",
+            "Use our customers as seeds to map our market",
+        ],
+    },
+    {
+        skill: "oxygen-tables",
+        slug: "speed-to-lead",
+        phrases: [
+            "Answer inbound leads in minutes",
+            "New signups sit for days before anyone reaches out",
+            "Route my inbound leads into the CRM automatically",
+            "Answer trial signups the same day they arrive",
+            "Set up speed-to-lead for my demo requests",
+            "Enrich and follow up on form fills without me watching",
+        ],
+    },
+    {
+        skill: "oxygen-unibox",
+        slug: "reply-to-meeting",
+        phrases: [
+            "Turn replies into booked meetings",
+            "I get replies but they never turn into meetings",
+            "Help me handle my inbound replies faster",
+            "Book more meetings from the replies I already have",
+            "Log booked calls in my CRM automatically",
+            "What do I do with 'circle back next quarter' replies?",
+            "Bring deferred leads back when they're ready",
+        ],
+    },
+];

package/node_modules/@oxygen/shared/dist/spend-safety.d.ts

@@ -158,6 +158,13 @@ export type CopilotApprovalFreeAllowance = {
  * largest session allowance stays below the attended turn backstop above.
  */
 export declare const COPILOT_APPROVAL_FREE_ALLOWANCE_BY_PLAN_BAND: Readonly<Record<PlanBand, CopilotApprovalFreeAllowance>>;
+/**
+ * On every plan, an Oxygent call whose declared ceiling (`max_credits`, the
+ * maximum quote, never the estimate) is strictly BELOW this runs without an
+ * approval card (Philipp, 2026-10-21). It only adds to the per-call allowance
+ * above, never lowers one, and the per-session allowance still applies.
+ */
+export declare const OXYGENT_APPROVAL_FREE_BELOW_CREDITS = 100;
 /** A plan size's approval-free Copilot allowance. */
 export declare function copilotApprovalFreeAllowanceForBand(band: PlanBand): CopilotApprovalFreeAllowance;
 export declare function resolveDefaultByokColumnRunMaxRows(tier: SpendSafetyPlanTier): number | null;

package/node_modules/@oxygen/shared/dist/spend-safety.js

@@ -191,6 +191,13 @@ export const COPILOT_APPROVAL_FREE_ALLOWANCE_BY_PLAN_BAND = Object.freeze({
     "999": Object.freeze({ perCallCredits: 300, perSessionCredits: 1_500 }),
     "1999": Object.freeze({ perCallCredits: 500, perSessionCredits: 2_500 }),
 });
+/**
+ * On every plan, an Oxygent call whose declared ceiling (`max_credits`, the
+ * maximum quote, never the estimate) is strictly BELOW this runs without an
+ * approval card (Philipp, 2026-10-21). It only adds to the per-call allowance
+ * above, never lowers one, and the per-session allowance still applies.
+ */
+export const OXYGENT_APPROVAL_FREE_BELOW_CREDITS = 100;
 /** A plan size's approval-free Copilot allowance. */
 export function copilotApprovalFreeAllowanceForBand(band) {
     return COPILOT_APPROVAL_FREE_ALLOWANCE_BY_PLAN_BAND[band];

package/node_modules/@oxygen/shared/dist/teammates.js

@@ -169,5 +169,6 @@ export function teammateSlugFromName(name) {
  */
 export const TEAMMATE_STARTER_INSTRUCTIONS = [
     "You are an Oxygent on the team. Do the job your profile and the person give you, and hand work that is another Oxygent's job to them.",
-    "Read whatever you need from the workspace; ask before anything that writes, sends or spends.",
+    "Read whatever you need from the workspace; ask before anything that writes, sends or spends 100 credits or more.",
+    "A paid step quoted under 100 credits, such as a sample lead list, runs without asking, rows it writes included: say what it cost in one plain line.",
 ].join("\n");

package/node_modules/@oxygen/shared/dist/tool-call-arguments.d.ts

@@ -0,0 +1,24 @@
+/**
+ * One reader for a model tool call's `arguments` string, shared by the Copilot
+ * (packages/copilot model-output.ts) and the Agents runtime host
+ * (apps/worker agent-cycle.ts) so an Oxygent run and a Copilot turn accept and
+ * refuse exactly the same payloads.
+ *
+ * Only a plain JSON object is an argument set. A complete object followed only
+ * by surplus closing brackets is read as the object: measured on the medium tier
+ * (System 1, s1-knowledge-update-page, 2026-10-21), a capability_run with a
+ * nested page body closed with one `}` too many four times in one turn, each
+ * `Unexpected non-whitespace character after JSON`. The object before the
+ * surplus is exactly what the model wrote; any other trailing text still fails.
+ */
+export type ToolCallArgumentsRead = {
+    ok: true;
+    value: Record<string, unknown>;
+} | {
+    ok: false;
+    /** The parse error, or why a parsed value is not an argument set. */
+    error: string;
+    /** The text around the break, from the FULL payload (an echoed head may end before it). */
+    near?: string;
+};
+export declare function readToolCallArgumentObject(raw: string): ToolCallArgumentsRead;

package/node_modules/@oxygen/shared/dist/tool-call-arguments.js

@@ -0,0 +1,68 @@
+const NOT_AN_OBJECT = "Tool-call arguments must be a JSON object.";
+export function readToolCallArgumentObject(raw) {
+    let parsed;
+    let error;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (caught) {
+        error = caught instanceof Error ? caught.message : String(caught);
+        const trimmed = withoutSurplusClosers(raw);
+        if (trimmed !== null) {
+            try {
+                parsed = JSON.parse(trimmed);
+                error = undefined;
+            }
+            catch {
+                parsed = undefined;
+            }
+        }
+    }
+    // An ARRAY and a bare string both survive JSON.parse; only a plain object is a
+    // valid argument set, so the check is on the shape rather than on the throw.
+    if (error === undefined && parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return { ok: true, value: parsed };
+    }
+    const message = error ?? NOT_AN_OBJECT;
+    const position = Number(/at position (\d+)/.exec(message)?.[1]);
+    return {
+        ok: false,
+        error: message,
+        ...(Number.isFinite(position)
+            ? { near: raw.slice(Math.max(0, position - 60), position + 20) }
+            : {}),
+    };
+}
+/** The payload up to its first complete top-level object when only closers follow, else null. */
+function withoutSurplusClosers(raw) {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    const start = raw.search(/\S/);
+    if (start < 0 || raw[start] !== "{")
+        return null;
+    for (let index = start; index < raw.length; index += 1) {
+        const char = raw[index];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === '"')
+                inString = false;
+            continue;
+        }
+        if (char === '"')
+            inString = true;
+        else if (char === "{" || char === "[")
+            depth += 1;
+        else if (char === "}" || char === "]") {
+            depth -= 1;
+            if (depth === 0) {
+                const rest = raw.slice(index + 1);
+                return rest.trim() !== "" && /^[\s}\]]*$/.test(rest) ? raw.slice(0, index + 1) : null;
+            }
+        }
+    }
+    return null;
+}

package/node_modules/@oxygen/shared/dist/user-capability-routing.js

@@ -1,4 +1,5 @@
 import { getCapabilityRoute, getCapabilityRouteMatch, inferCapabilityRoute, } from "./capability-discovery.js";
+const GROUP_CHAT_CHANNEL_PATTERN = /\b(?:whatsapp|teams|slack|telegram|linkedin|discord|signal|sms|e ?mail|inbox|unibox)\b/;
 /** A null route has no command to hydrate yet. Keep recovery bounded and executable. */
 export function capabilityDiscoveryRecovery(query, surface) {
     if (surface === "mcp") {
@@ -166,6 +167,19 @@ export function inferUserCapabilityRoute(query) {
                 exactMcpCall: { tool: "oxygen_agent_session_list", arguments: { slug: "workspace" } },
             };
     }
+    if (/\b(?:files?|attachments?|documents?|uploads?)\b/.test(normalized)
+        && /\b(?:group\s+(?:chats?|conversations?)|team\s+(?:chats?|conversations?))\b/.test(normalized)
+        && !GROUP_CHAT_CHANNEL_PATTERN.test(normalized)
+        && !/\b(?:support|external)\b/.test(normalized)) {
+        const route = getCapabilityRouteMatch("agents");
+        if (route) {
+            const tools = ["oxygen_oxygents_group", "oxygen_oxygents_group_message", "oxygen_copilot_attachments", "oxygen_copilot_get"];
+            const commands = ["oxygents group", "copilot attach", "copilot attachments", "oxygents group-message", "copilot get"];
+            return { ...route, recommendedTools: tools, recommendedCommands: commands,
+                card: { ...route.card, endpointSections: [...route.card.endpointSections, "copilot"], gatewayTools: tools, gatewayCommands: commands,
+                    execution: "A group_id is its Copilot session id. Upload your file with oxygen copilot attach <group_id> <path>, list its ready ids with copilot attachments (oxygen_copilot_attachments), then send attachment_ids with oxygents group-message (oxygen_oxygents_group_message). Read messages and bound files with copilot get (oxygen_copilot_get). Existing uploader, session, readiness and group-access checks apply. A message mentioning only a person goes to them; Oxygent answers are billed turns." } };
+        }
+    }
     const oxygents = oxygentsRoute(normalized);
     if (oxygents)
         return oxygents;
@@ -335,7 +349,7 @@ const OXYGENT_GROUP_VERBS = [
  */
 function oxygentsRoute(normalized) {
     const groupChat = /\bgroup chats?\b/.test(normalized)
-        && !/\b(?:whatsapp|teams|slack|telegram|linkedin|discord|signal|sms|e ?mail|inbox|unibox)\b/.test(normalized);
+        && !GROUP_CHAT_CHANNEL_PATTERN.test(normalized);
     const nativeTeammate = /^\s*teammates?\s*$/.test(normalized)
         || (/\bteammates?\b/.test(normalized) && /\b(?:routines?|schedul\w*|private chat)\b/.test(normalized)
             && !/\b(?:invite|membership|permissions?|roles?|human|colleague|coworker|slack|teams|whatsapp)\b/.test(normalized));

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1014.1600";
+export declare const OXYGEN_BUILD_VERSION = "1.1014.1763";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1014.1600";
+export const OXYGEN_BUILD_VERSION = "1.1014.1763";

package/node_modules/@oxygen/shared/dist/workspace-event-catalog.js

@@ -144,10 +144,10 @@ function sequenceActivityDescription(key, label) {
 }
 function crmActivityDescription(key, label) {
     if (key === "email_bounced") {
-        return "An email-bounce activity was added to a CRM record timeline, regardless of which producer logged it. Use the Sequencer preset for an outreach enrollment's own bounce outcome.";
+        return "An email-bounce activity was added to a CRM record timeline by anything except a workflow. Use the Sequencer preset for an outreach enrollment's own bounce outcome.";
     }
     if (key === "meeting_booked") {
-        return "A meeting-booked activity was added to a CRM record timeline, regardless of which producer logged it. Use the Sequencer preset for an outreach enrollment's own meeting outcome.";
+        return "A meeting-booked activity was added to a CRM record timeline by anything except a workflow (a workflow-logged meeting, such as from the Cal.com router, never fires it). Use the Sequencer preset for an outreach enrollment's own meeting outcome.";
     }
     if (key === "placement_changed") {
         return "Inbox placement for a sender domain at one receiver provider changed (inbox rate drop or Gmail Primary to Promotions). A workspace Signal with no CRM record; placement never pauses a sender.";

package/node_modules/@oxygen/shared/dist/workspace-placement.d.ts

@@ -20,6 +20,7 @@ export type StaffPlacementGrant = {
     source_environment: "dev" | "prod";
     receiver_environment: "dev" | "prod";
     receiver_workspace_id: string;
+    allow_daily_limit_override?: true;
 };
 export type WorkspacePlacementProbe = {
     id: string;
@@ -51,6 +52,8 @@ export declare function workspacePlacementId(value: unknown): value is string;
 export declare function readWorkspacePlacementVariants(value: unknown): WorkspacePlacementVariant[];
 export declare function readWorkspacePlacementMailboxIds(value: unknown): string[];
 export declare function workspacePlacementPlanHash(plan: Omit<WorkspacePlacementPlan, "plan_hash">): string;
+/** Exact staff approval can exempt one diagnostic per sender from daily quotas. */
+export declare function workspacePlacementDailyLimitOverride(plan: Pick<WorkspacePlacementPlan, "receiver_scope" | "staff" | "probes" | "message_count">): boolean;
 export declare function buildWorkspacePlacementPlan(input: {
     requestId: string;
     organizationId: string;

package/node_modules/@oxygen/shared/dist/workspace-placement.js

@@ -48,6 +48,15 @@ function canonicalPlacementValue(value) {
 export function workspacePlacementPlanHash(plan) {
     return createHash("sha256").update(JSON.stringify(plan.receiver_scope === "staff" ? canonicalPlacementValue(plan) : plan)).digest("hex");
 }
+/** Exact staff approval can exempt one diagnostic per sender from daily quotas. */
+export function workspacePlacementDailyLimitOverride(plan) {
+    if (plan.receiver_scope !== "staff" || plan.staff?.allow_daily_limit_override !== true || typeof plan.staff.actor_id !== "string" || !plan.staff.actor_id.trim()
+        || !Array.isArray(plan.probes) || plan.probes.length < 1 || plan.probes.length > 50 || plan.message_count !== plan.probes.length
+        || plan.probes.some(p => typeof p?.sender?.address !== "string" || !workspacePlacementId(p.sender.id)))
+        return false;
+    return new Set(plan.probes.map(p => p.sender.address.toLowerCase())).size === plan.probes.length
+        && new Set(plan.probes.map(p => `${p.sender.environment}:${p.sender.organization_id}:${p.sender.id}`)).size === plan.probes.length;
+}
 export function buildWorkspacePlacementPlan(input) {
     if (!workspacePlacementId(input.requestId) || !workspacePlacementId(input.organizationId))
         invalid("The workspace test request is invalid.");
@@ -95,6 +104,8 @@ export function buildWorkspacePlacementPlan(input) {
         ...(input.network ? { receiver_scope: "network" } : input.staff ? { receiver_scope: "staff", staff: input.staff } : {}), billing_mode: "internal", credits: 0, allow_paused_probe: input.allowPausedProbe,
         ...(input.renderedAt ? { rendered_at: input.renderedAt } : {}), ...(input.rendering ? { rendering: input.rendering } : {}),
         probes, excluded_self_sends: excluded, message_count: probes.length };
+    if (input.staff?.allow_daily_limit_override && !workspacePlacementDailyLimitOverride(plan))
+        invalid("Daily-limit overrides allow only one diagnostic email per sender in the approved staff test.");
     return { ...plan, plan_hash: workspacePlacementPlanHash(plan) };
 }
 export function googleWorkspacePlacement(labels, messageId, observedAt) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1014.1600",
+  "version": "1.1014.1763",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",
@@ -42,7 +42,7 @@
     "@opentelemetry/resources": "2.10.0",
     "@opentelemetry/sdk-trace-base": "2.10.0",
     "commander": "14.0.3",
-    "esbuild": "0.27.7",
+    "esbuild": "0.28.2",
     "read-excel-file": "6.0.3",
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "yaml": "2.9.0",