@oxygen-agent/cli 1.1014.1600 → 1.1014.1763

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -2,6 +2,8 @@ import { findEnrichmentIntentByAlias } from "./enrichment-intents.js";
 import { networkMiningEnabled } from "./network-mining.js";
 import { nativeChatEnabled, withNativeChatDiscovery } from "./native-chat-discovery.js";
 import { RECIPE_PRIMITIVES } from "./recipes.js";
+import { matchSkillPlay } from "./skill-play-routing.js";
+export { matchSkillPlay, SKILL_PLAY_TRIGGERS } from "./skill-play-routing.js";
 // One compact semantic index covers every top-level /api/cli endpoint section.
 // It is navigation, never execution: live schemas, prices, readiness, and
 // approval enforcement remain on the exact command/tool selected from here.
@@ -26,7 +28,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         posture: "workspace_write",
         gatewayTools: ["oxygen_visual_source_create", "oxygen_visual_render_preview", "oxygen_visual_render_get", "oxygen_visual_image_view"],
         gatewayCommands: ["visuals source-create", "visuals render-preview", "visuals render-get", "visuals download"],
-        skills: ["oxygen-knowledge"],
+        skills: ["oxygen-linkedin-content", "oxygen-knowledge"],
         endpointSections: ["visuals"],
         intentTerms: ["infographic", "gtm flow image", "render html", "visual design", "carousel pages", "svg", "png", "pdf export", "graphic designer"],
     },
@@ -114,8 +116,8 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         notFor: "Primitive run diagnosis when no support report is needed; inspect Observability first.",
         execution: "Start or continue a hosted support conversation, optionally file structured metadata, and return its deep link; never send a customer reply automatically.",
         posture: "workspace_write",
-        gatewayTools: ["oxygen_feedback", "oxygen_support_ticket_create", "oxygen_support_tickets_list", "oxygen_chat_channel", "oxygen_chat_thread_get", "oxygen_chat_thread_create", "oxygen_chat_thread_reply", "oxygen_chat_file_upload", "oxygen_chat_file_get", "oxygen_chat_thread_read"],
-        gatewayCommands: ["feedback", "support chat", "support file", "support list", "chat channel", "chat threads get", "chat threads create", "chat threads reply", "chat files upload", "chat files get", "chat threads read"],
+        gatewayTools: ["oxygen_feedback", "oxygen_support_ticket_create", "oxygen_support_tickets_list", "oxygen_chat_threads_list", "oxygen_chat_channel", "oxygen_chat_thread_get", "oxygen_chat_thread_create", "oxygen_chat_thread_reply", "oxygen_chat_file_upload", "oxygen_chat_file_get", "oxygen_chat_thread_read"],
+        gatewayCommands: ["feedback", "support chat", "support file", "support list", "chat threads list", "chat channel", "chat threads get", "chat threads create", "chat threads reply", "chat files upload", "chat files get", "chat threads read"],
         skills: ["oxygen-feedback"],
         endpointSections: ["feedback", "support", "chat"],
         intentTerms: ["support", "feedback", "bug report", "feature request", "report issue", "ticket", "complaint", "support chat", "support thread", "chat attachment"],
@@ -298,7 +300,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         primitive: "signals",
         owns: "Durable typed pulse, engagement, and product events resolved onto records.",
         notFor: "Message bodies, post artifacts, or ad-hoc provider webhooks as private automation state.",
-        execution: "Read the hosted signal stream and type registry; tag a registered type with tags attach. Feed subscriptions, Sequences, or Workflows.",
+        execution: "Read the hosted signal stream and type registry; tag a registered type with tags attach. Feed subscriptions, Sequences, or Workflows. A visit or view the user reports goes on the person with oxygen_crm_activity_log (activity_type website_visit, direction inbound, live), after creating a missing person with oxygen_crm_record_assert (free, no approval); oxygen_crm_signal_record is for a provider webhook.",
         posture: "workspace_write",
         gatewayTools: ["oxygen_signals_list", "oxygen_signals_leads_today", "oxygen_signals_registry", "oxygen_tags_attach"],
         gatewayCommands: ["signals list", "signals leads-today", "signals registry", "tags attach"],
@@ -375,7 +377,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         gatewayTools: ["oxygen_sequences_send", "oxygen_sequences_create", "oxygen_sequences_enroll", "oxygen_sequences_start", "oxygen_sequences_list", "oxygen_sequences_update", "oxygen_sequences_get", "oxygen_sequences_push_external", "oxygen_sequences_company_pause"],
         gatewayCommands: ["sequences send", "sequences create", "sequences enroll", "sequences start", "sequences list", "sequences update", "sequences get", "sequences push-external", "sequences pause-company"],
         skills: ["oxygen-sequencer"],
-        endpointSections: ["senders", "sequencer", "sequences", "spintax", "subscriptions", "suppressions", "voice"],
+        endpointSections: ["email-assets", "email-documents", "senders", "sequencer", "sequences", "spintax", "subscriptions", "suppressions", "voice"],
         // "sender identity", "sender profile" and "phone number" are here because a
         // blind-user eval (2026-08-09) asked for "our sender identity" and got routed
         // to workspace-access — "identity" matched the AUTH sense. The nouns a user
@@ -398,12 +400,12 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         posture: "external_write",
         gatewayTools: ["oxygen_publishing_posts_create", "oxygen_publishing_posts_list", "oxygen_publishing_posts_approve", "oxygen_ugc_get"],
         gatewayCommands: ["publishing posts create", "publishing posts list", "publishing posts approve", "ugc programs list", "ugc programs duplicate", "ugc programs archive"],
-        skills: ["oxygen-publishing", "oxygen-ugc"],
+        skills: ["oxygen-publishing", "oxygen-linkedin-content", "oxygen-ugc"],
         endpointSections: ["publishing", "ugc"],
         // "remove program" / "delete program" landed on route: null in a blind eval
         // (2026-09-10); a program is a UGC noun here, and its lifecycle verbs must
         // resolve to the group that owns `ugc programs archive|delete|duplicate`.
-        intentTerms: ["publish", "publishing", "schedule post", "content calendar", "posting calendar", "approve post", "social publishing", "video cover", "video thumbnail", "cover image", "post preview", "ugc", "creator program", "user generated content", "creator voice", "sponsored creator", "ugc program", "archive program", "delete program", "remove program", "duplicate program", "copy program"],
+        intentTerms: ["publish", "publishing", "schedule post", "content calendar", "posting calendar", "approve post", "social publishing", "video cover", "video thumbnail", "cover image", "post preview", "ugc", "creator program", "user generated content", "creator voice", "sponsored creator", "ugc program", "archive program", "delete program", "remove program", "duplicate program", "copy program", "write posts", "write a post", "post ideas", "content pillars", "hook", "linkedin content"],
     },
     {
         id: "workflows",
@@ -411,7 +413,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         primitive: "workflows",
         owns: "Deterministic hosted automation definitions, versions, triggers, branching, retries, approvals, modes, and durable runs.",
         notFor: "Local cron, client-side execution, adaptive Agent goals, or outreach cadence already owned by Sequences.",
-        execution: "Author locally if useful, then schema/lint/apply and call the Workflow on OXYGEN workers; outbound uses internal oxygen.sequence_enroll against an already active bounded Sequence. Start from the graph schema's examples[0] (oxygen_workflows_schema subject graph): a minimal valid manifest whose tool node adds a Table row with oxygen_table_rows_insert. A draft that is not saved exists only in your reply, so show its manifest there. To find why a definition fails, lint it as written first. Saving without running is apply with publish false and workflow and trigger status disabled.",
+        execution: "Author locally if useful, then schema/lint/apply and call the Workflow on OXYGEN workers; outbound uses internal oxygen.sequence_enroll against an already active bounded Sequence. Start from the graph schema's examples[0] (oxygen_workflows_schema subject graph): a minimal valid manifest whose tool node adds a Table row with oxygen_table_rows_insert. To change existing rows, a tool node runs oxygen_tables_query with filters, a loop goes over steps.<node>.output.rows (body edge source_handle loop_body, plus an edge back to the loop), and the body calls oxygen_rows_update with row_id loop.each.item._row_id and values. A fixed change on a schedule stays a Workflow: draft and lint it rather than offering a formula column instead; a routine is for checks that need judgment. A cron time is in the person's time zone: set trigger.timezone, and ask for it in your first question when you do not know it. To find why a definition fails, lint it as written first. Saving without running is apply with publish false and workflow and trigger status disabled. If apply is refused, nothing was saved: say so once, never call it saved or a draft in OXYGEN, and never offer another way around the refusal (such as writing the rows directly). Then say in plain words what it would do once saved, and include the full manifest below that: show its manifest every time, since it exists only in your reply.",
         posture: "mixed",
         gatewayTools: ["oxygen_workflows_schema", "oxygen_workflows_lint", "oxygen_workflows_apply", "oxygen_workflows_call", "oxygen_workflows_tail"],
         gatewayCommands: ["workflows schema", "workflows lint", "workflows apply", "workflows call", "workflows tail"],
@@ -459,7 +461,11 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         gatewayCommands: ["companies search plan", "people search plan", "tools search", "find company"],
         skills: ["oxygen-sourcing", "oxygen-enrichment"],
         endpointSections: ["companies", "find", "lead-sourcing", "people", "search", "sourcing", "tools", "verify"],
-        intentTerms: ["find companies", "find people", "source leads", "build a list", "tam", "prospect", "provider", "tool catalog", "find email", "find phone", "local businesses", "local business", "google maps", "storefronts"],
+        // Contacts at accounts are a people search: "merge two lists then find
+        // contacts" scored Records on "merge"/"contact", and "who we should reach at
+        // each company ... cost" scored Billing on "cost".
+        intentTerms: ["find companies", "find people", "source leads", "build a list", "tam", "prospect", "provider", "tool catalog", "find email", "find phone", "local businesses", "local business", "google maps", "storefronts", "find contacts", "contacts per account", "contacts per company", "contacts at each", "reach at each", "people at each"],
+        negativeTerms: ["in my crm", "in our crm", "in the crm", "existing contacts"],
     },
     {
         id: "linkedin-public-research",
@@ -486,7 +492,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         posture: "mixed",
         gatewayTools: ["oxygen_integrations_list", "oxygen_integrations_connect", "oxygen_integrations_list_actions"],
         gatewayCommands: ["integrations list", "integrations connect", "custom-integrations list"],
-        skills: ["oxygen-tables", "oxygen-gtm"],
+        skills: ["oxygen-custom-http", "oxygen-tables", "oxygen-gtm"],
         endpointSections: ["custom-integrations", "integrations"],
         intentTerms: ["integration", "integrations", "connect provider", "oauth", "byok", "bring your own key", "provider key", "provider connection", "custom http", "custom integration", "connection readiness"],
     },
@@ -591,6 +597,19 @@ export function inferCapabilityRoute(query) {
     const normalized = normalizeIntent(query);
     if (!normalized)
         return null;
+    if (/\b(custom http|custom integrations?|own (?:rest|http) api)\b/.test(normalized)) {
+        const integrations = ROUTE_BY_ID.get("connected-integrations");
+        if (integrations) {
+            const removal = /\b(remov\w*|delet\w*|disconnect\w*|cleanup|clean up|throwaway|disposable)\b/.test(normalized);
+            const tools = removal ? ["oxygen_custom_integrations_remove", "oxygen_custom_integrations_list"] : ["oxygen_custom_integrations_list", "oxygen_custom_integrations_apply", "oxygen_custom_integration_connect"];
+            const commands = removal ? ["custom-integrations remove", "custom-integrations list"] : ["custom-integrations list", "custom-integrations apply", "custom-integrations connect"];
+            return {
+                card: { ...integrations, gatewayTools: tools, gatewayCommands: commands, skills: ["oxygen-custom-http"], execution: removal ? "Preview the exact custom HTTP connection and tools, then approve the returned plan_hash. Caller definitions and history remain, but bound callers stop working; provider-side key revocation is separate." : "Read oxygen-custom-http for the manifest schema and auth types. Apply registers catalog tools without a provider call; connect stores credentials separately. Preview a tool request before approved live execution." },
+                recommendedTools: tools,
+                recommendedCommands: commands,
+            };
+        }
+    }
     if (/\b(mailbox(?:es)?|inbox(?:es)?)\b/.test(normalized) && /\b(standby|reserve|replacement|replace|burn(?:ed|t)?)\b/.test(normalized)) {
         const campaign = /\b(campaign|sequence|cadence)\b/.test(normalized);
         const card = ROUTE_BY_ID.get(campaign ? "sequences" : "sending-infrastructure") ?? ROUTE_BY_PRIMITIVE.get("sequences");
@@ -624,7 +643,10 @@ export function inferCapabilityRoute(query) {
     // Card scoring stays the owner of routing; the catalogue only breaks a
     // no-match tie ("get the funding round for these accounts" names no card
     // term) and decorates the data cards it belongs to.
-    const card = explicit ?? highestScoringRoute(normalized) ?? (catalogRow ? cardForCatalogueIntent(catalogRow) : null);
+    // A feature-skill play the ask matches votes for the cards its skill owns and,
+    // when the chosen card lists that skill, travels on the route as the file to open.
+    const play = matchSkillPlay(normalized) ?? sourcingPlaybookFor(normalized);
+    const card = explicit ?? highestScoringRoute(normalized, play?.skill) ?? (catalogRow ? cardForCatalogueIntent(catalogRow) : null);
     if (!card)
         return null;
     const recommendations = recommendationsFor(card, normalized);
@@ -634,7 +656,7 @@ export function inferCapabilityRoute(query) {
     // Sourcing filters belong to the planner, not per-company enrichment.
     const catalogue = catalogRow && CATALOGUE_CARD_IDS.has(card.id) && !isCompanySourcingIntent(normalized)
         ? catalogueRecommendations(catalogRow, card) : null;
-    return withRecordBrief({
+    return withSkillPlay(withRecordBrief({
         card: routeCardFor(card, normalized),
         recommendedTools: recommendations.tools,
         recommendedCommands: recommendations.commands,
@@ -643,7 +665,30 @@ export function inferCapabilityRoute(query) {
         ...(catalogue && catalogRow
             ? { catalogIntent: { id: catalogRow.id, label: catalogRow.label, status: catalogRow.status, group: catalogRow.group, tools: catalogue.tools, commands: catalogue.commands, exactCommand: catalogue.exactCommand, exactMcpCall: catalogue.exactMcpCall } }
             : {}),
-    }, networkMiningEnabled(runtimeEnv()));
+    }, networkMiningEnabled(runtimeEnv())), play);
+}
+/**
+ * Contacts at accounts has no play of its own: oxygen-sourcing's SKILL.md sends
+ * "merging sources, setting contacts per account" to its playbook reference,
+ * so the route points there (2026-10-22 suite: the merge-then-contacts case
+ * missed two contacts per account and the second-source rule without it).
+ * Contacts already in the CRM stay with Records.
+ */
+function sourcingPlaybookFor(query) {
+    return /\b(find contacts|contacts (per|at each) (account|company)|reach at each|people at each)\b/.test(query)
+        && !/\b(crm|existing contacts)\b/.test(query)
+        ? { skill: "oxygen-sourcing", slug: "playbook", file: "references/playbook.md" }
+        : null;
+}
+/** The play rides only on a card that lists its skill, and that skill is named first. */
+function withSkillPlay(route, play) {
+    if (!play || !route.card.skills.includes(play.skill))
+        return route;
+    return {
+        ...route,
+        card: { ...route.card, skills: [play.skill, ...route.card.skills.filter((skill) => skill !== play.skill)] },
+        play,
+    };
 }
 /**
  * A data-type ask ("tech stack", "decision makers at each account", "funding
@@ -734,12 +779,14 @@ export const OXYGEN_PRODUCT_SKILL_AUDIENCES = Object.freeze({
     "oxygen-deliverability": "workspace",
     "oxygen-sequencer": "workspace",
     "oxygen-publishing": "workspace",
+    "oxygen-linkedin-content": "workspace",
     "oxygen-signals": "workspace",
     "oxygen-table-tidy": "workspace",
     "oxygen-diagnostics": "workspace",
     "oxygen-feedback": "workspace",
     "oxygen-clay-migration": "workspace",
     "oxygen-ugc": "workspace",
+    "oxygen-custom-http": "workspace",
     // Retired (RETIRED_PRODUCT_SKILLS): readable for existing pins, never served.
     "oxygen-playbooks": "workspace",
     "oxygen-visual-design": "workspace",
@@ -803,6 +850,8 @@ export function serializeCapabilityRoute(route, surfaceOrOptions = "cli", option
         return null;
     const nativeChat = (typeof surfaceOrOptions === "string" ? options.nativeChat : surfaceOrOptions.nativeChat) ?? nativeChatEnabled(runtimeEnv());
     route = withNativeChatDiscovery(route, nativeChat);
+    const play = route.play && (isPublicCapabilitySkill(route.play.skill) || visibleSkills?.includes(route.play.skill))
+        ? route.play : null;
     return {
         capability_id: route.card.id,
         layer: route.card.layer,
@@ -812,6 +861,15 @@ export function serializeCapabilityRoute(route, surfaceOrOptions = "cli", option
         execution: route.card.execution,
         posture: route.card.posture,
         skills: route.card.skills.filter((name) => isPublicCapabilitySkill(name) || visibleSkills?.includes(name)),
+        // The play to open before planning, in both read forms like `hydrate` below.
+        ...(play ? {
+            play: {
+                skill: play.skill,
+                file: play.file,
+                read_cli: `oxygen skills get ${play.skill} --file ${play.file} --json`,
+                read_mcp: { tool: "oxygen_skills_get", arguments: { name: play.skill, file: play.file } },
+            },
+        } : {}),
         endpoint_sections: route.card.endpointSections,
         recommended_commands: route.recommendedCommands,
         recommended_tools: route.recommendedTools,
@@ -1149,6 +1207,20 @@ function readInspectionRecommendation(query) {
     if (action)
         return null;
     const stored = positive.replace(/\bwithout\s+(?:changing|approving|rejecting|publishing|running|executing|refreshing)\b(?:\s+(?:widget\s+)?data\b)?/g, "");
+    // A daily cap is context for an inbox inspection, not a recurring job or a
+    // request to change its volume. Keep explicit writes and other owners intact.
+    const mailboxInspection = stored.replace(/\bdaily (?:(?:campaign|sending|email) )?(?:limits?|caps?)\b/g, "sending limit");
+    if (/\b(?:mailbox(?:es)?|inbox(?:es)?|email accounts?|email senders?)\b/.test(stored)
+        && /\b(?:health|reputation|rejections?|bounc\w*|deliverability|dsn|ndr)\b/.test(stored)
+        && !isHostedWorkflowIntent(mailboxInspection)
+        && !isSecondPartyDecisionIntent(stored)
+        && !/\b(?:linkedin|whatsapp|sequences?|campaigns?|tables?|columns?|crm|posts?|messages?|conversations?|threads?|dns|spf|dkim|dmarc|verify|verification|create|write|edit|update|change|delete|remove|archive|save|approve|reject|publish|run|running|execute|send|refresh|launch|enable|disable|apply|import|sync|schedule|enroll|add|set|pause|resume|test)\b/.test(mailboxInspection))
+        return {
+            capabilityId: "sending-infrastructure",
+            tools: ["oxygen_mailboxes_health", "oxygen_mailboxes_get", "oxygen_mailboxes_deliverability_evidence"],
+            commands: ["mailboxes health", "mailboxes get", "mailboxes deliverability evidence"],
+            execution: "Read stored reputation, measurement freshness and seven-day rejection/send evidence with oxygen_mailboxes_health. Its mailboxes selector accepts inbox ids or addresses and defaults to full evidence; fleet totals and coverage stay unfiltered. CLI: mailboxes health --mailboxes <id-or-address> --json. Read oxygen_mailboxes_get for today's effective cap; deliverability evidence adds stored placement and domain checks. These reads cost 0 credits and do not sync providers or change settings. External MCP uses oxygen_capabilities_read; hydrate the selected tool's schema before calling.",
+        };
     // A trigger diagnosis needs the live definition, not run tailing or a call.
     // Keep execution, authoring and run-history requests with their own owners.
     if (/\bworkflows?\b/.test(stored)
@@ -1247,8 +1319,11 @@ function isPartnerBonusReadIntent(query) {
 /** The card a route reports: Publishing's own, or its UGC view for a creator-program ask. */
 function routeCardFor(card, query) {
     const readOnly = readInspectionRecommendation(query);
-    if (readOnly?.capabilityId === card.id)
-        return { ...card, posture: "read_only", execution: readOnly.execution };
+    if (readOnly?.capabilityId === card.id) {
+        const skill = preferredSkillForIntent(card, query);
+        return { ...card, posture: "read_only", execution: readOnly.execution,
+            ...(skill ? { skills: [skill, ...card.skills.filter(name => name !== skill)] } : {}) };
+    }
     const placementGuide = card.id === "sending-infrastructure" ? placementGuideRecommendation(query) : null;
     if (placementGuide)
         card = { ...card, posture: "read_only", execution: placementGuide.execution };
@@ -1280,6 +1355,10 @@ function routeCardFor(card, query) {
         return { ...card, execution: feed.execution };
     if (card.primitive === "publishing" && isUgcIntent(query))
         return { ...card, ...UGC_ROUTE_VIEW };
+    if (card.primitive === "publishing" && isPostDraftIntent(query))
+        return { ...card, execution: POST_DRAFT_EXECUTION };
+    if (card.primitive === "signals" && isSignalCaptureIntent(query))
+        return { ...card, execution: SIGNAL_CAPTURE_EXECUTION, skills: ["oxygen-signals", "oxygen-crm"] };
     const contactFind = card.id === "sourcing-and-provider-tools" ? oneShotContactFindingRecommendation(query) : null;
     if (contactFind)
         card = { ...card, execution: contactFind.execution };
@@ -1320,6 +1399,8 @@ function routeCardFor(card, query) {
         card = { ...card, posture: "read_only", execution: CANONICAL_COPY_READ_EXECUTION };
     else if (card.id === "knowledge-graph" && isWorkspaceVoiceIntent(query))
         card = { ...card, execution: WORKSPACE_VOICE_EXECUTION };
+    if (card.primitive === "agents" && isAdaptiveWatchIntent(query))
+        card = { ...card, execution: ADAPTIVE_WATCH_EXECUTION };
     if (card.primitive === "workflows" && isRecurringCompanyMonitoringIntent(query))
         card = {
             ...card,
@@ -1361,6 +1442,12 @@ function routeCardFor(card, query) {
     const removal = card.primitive === "tables" ? tableRowRemovalRecommendation(query) : null;
     if (removal)
         card = { ...card, posture: "workspace_write", execution: removal.execution };
+    const insert = card.primitive === "tables" ? tableRowInsertRecommendation(query) : null;
+    if (insert)
+        card = { ...card, posture: "workspace_write", execution: insert.execution };
+    const update = card.primitive === "tables" ? tableRowUpdateRecommendation(query) : null;
+    if (update)
+        card = { ...card, posture: "workspace_write", execution: update.execution };
     const sent = card.id === "connected-linkedin" ? sentLinkedInInvitationReadRecommendation(query) : null;
     if (sent)
         card = { ...card, execution: sent.execution };
@@ -1400,7 +1487,7 @@ function preferredSkillForIntent(card, query) {
         return "oxygen-enrichment";
     if (card.id === "billing-and-budgets" && /\b(explain|why|reduce|increas\w*|burn|spent)\b/.test(query))
         return "oxygen-diagnostics";
-    if (card.id === "sending-infrastructure" && /\b(bounc\w*|health|placement|deliverability|spam)\b/.test(query))
+    if (card.id === "sending-infrastructure" && /\b(bounc\w*|health|reputation|rejections?|placement|deliverability|spam)\b/.test(query))
         return "oxygen-deliverability";
     if (["signals", "linkedin-public-research"].includes(card.id) && /\blinkedin\b/.test(query))
         return "oxygen-signals";
@@ -1519,6 +1606,14 @@ export const CAPABILITY_ROUTE_MCP_CALLS = {
     sequenceReplyToStop: () => ({ tool: "oxygen_sequences_update", arguments: { sequence: "<sequence>", reply_to_stop_text: "Reply STOP to opt out." } }),
     ugcProgramCreate: () => ({ tool: "oxygen_ugc_program_create", arguments: { product_url: "<your product site>" } }),
     // The first comment rides in `content`, as the CLI's --first-comment does.
+    publishingPostDraft: () => ({
+        tool: "oxygen_publishing_posts_create",
+        arguments: { content_text: "<post>", publish_at: "<iso>", status: "draft" },
+    }),
+    signalCapture: () => ({
+        tool: "oxygen_crm_activity_log",
+        arguments: { object: "people", row_id: "<person rowId or email>", activity_type: "website_visit", direction: "inbound", summary: "<what they viewed>", occurred_at: "<iso>", mode: "live" },
+    }),
     publishingFirstComment: () => ({
         tool: "oxygen_publishing_posts_create",
         arguments: { content_text: "<post>", publish_at: "<iso>", sender_account_id: "<sender_id>", content: { first_comment: "<comment, e.g. the link>" } },
@@ -1614,6 +1709,8 @@ function isSequenceUnsubscribeIntent(query) {
         && !/\b(unsubscribed|lists?|import\w*|suppress\w*|block ?list|blocklist|do not contact|dnc)\b/.test(query);
 }
 /** A post's first comment is set with the post; `publishing posts update` takes the same flag. */
+export const POST_DRAFT_COMMAND = 'oxygen publishing posts create --draft --publish-at <iso> --text "<post>" --json';
+export const SIGNAL_CAPTURE_COMMAND = 'oxygen crm activity log people <rowId or email> --type website_visit --direction inbound --summary "<what they viewed>" --live --json';
 export const PUBLISHING_FIRST_COMMENT_COMMAND = 'oxygen publishing posts create --publish-at <iso> --sender <sender_id> --text "<post>" --first-comment "<comment, e.g. the link>" --json';
 /**
  * The comment OXYGEN posts right after a post goes out ("put the link in the first
@@ -1865,6 +1962,41 @@ function tableRowRemovalRecommendation(query) {
         execution: "Delete Table rows with tables rows remove-selection (oxygen_table_rows_remove_selection): the rows a readable filter tree matches (--filter-tree-json / filter_tree, the same tree tables query takes), exact row_ids, or an all_matching selection with search, sort, range and exclusions. Hydrate its schema first. Unreadable filter nodes and filters arrays are refused; unqualified all_matching deletes every row. This is permanent and costs 0 credits; to keep a restorable copy first, tables duplicate (oxygen_tables_duplicate, 0 credits). Read the matching rows before deletion and the survivors afterward; each removed row's values stay readable with rows history (oxygen_rows_history). Deleting rows does not stop campaign enrollment.",
     };
 }
+/**
+ * Literal row values go in with the row-insert tool. Without this card "add rows"
+ * ranked create, enrichment and the external Records import first (sweep 3).
+ */
+function tableRowInsertRecommendation(query) {
+    if (!/\brows?\b/.test(query) || !/\b(add|adding|insert\w*|append\w*|put|enter|write)\b/.test(query)
+        || /\b(delete|remove|update|edit|change|set|mark|existing|import\w*|csv|crm|records?|enrich\w*|sync\w*|workflows?|agents?|campaigns?|sequences?|webhooks?|feeds?|functions?|callables?|cells?|dedup\w*|duplicates?)\b/.test(query)
+        || /\b(?:add|insert|new)\s+(?:an?\s+|the\s+)?(?:\w+\s+)?columns?\b/.test(query)
+        || isSecondPartyDecisionIntent(query))
+        return null;
+    return {
+        tools: ["oxygen_table_rows_insert", "oxygen_tables_create", "oxygen_tables_query"],
+        commands: ["tables rows insert", "tables create", "tables query"],
+        execution: "Add literal rows with tables rows insert (oxygen_table_rows_insert): table plus rows, an array of {column_key: value} objects. tables create (oxygen_tables_create) makes the columns but takes no rows, so insert after it. Manual rows are a free internal write. Read the rows back with tables query (oxygen_tables_query).",
+    };
+}
+/**
+ * Changing values on rows that already exist is oxygen_rows_update. Without this
+ * card "update rows" / "set a cell" ranked create and enrichment tools, and an
+ * Oxygent concluded no row update existed and offered a formula column instead of
+ * the weekly Workflow it was asked for (System 1 routing case, 2026-10-22).
+ */
+function tableRowUpdateRecommendation(query) {
+    if (!/\b(rows?|cells?)\b/.test(query)
+        || !(/\b(update\w*|edit\w*|chang\w*|sets?|setting|overwrit\w*|mark\w*)\b/.test(query) || /\bexisting (?:table )?rows?\b/.test(query))
+        || /\b(delete|remove|insert\w*|append\w*|import\w*|csv|crm|records?|enrich\w*|sync\w*|campaigns?|sequences?|functions?|callables?|dedup\w*|duplicates?|history|provenance|rerun|re-run|retry|columns? run|run columns?|formulas?)\b/.test(query)
+        || /\b(?:add|insert|new|create)\s+(?:an?\s+|the\s+)?(?:\w+\s+)?(?:columns?|rows?)\b/.test(query)
+        || isSecondPartyDecisionIntent(query))
+        return null;
+    return {
+        tools: ["oxygen_rows_update", "oxygen_tables_query", "oxygen_rows_upsert"],
+        commands: ["tables update", "tables query", "tables upsert"],
+        execution: "Change values on existing rows with tables update (oxygen_rows_update): table, row_id and values as {column_key: value}, one row per call, a free internal write. Find the rows and their _row_id with tables query (oxygen_tables_query) and filters first; tables upsert (oxygen_rows_upsert) writes by a key column instead. In a Workflow, loop over the query's rows and call oxygen_rows_update with row_id loop.each.item._row_id. Read the rows back after writing.",
+    };
+}
 /** Reads of grid values/state are separate from executing or resolving actions. */
 function tableReadRecommendation(query) {
     if (isFunctionIntent(query) || isSecondPartyDecisionIntent(query)
@@ -2219,6 +2351,12 @@ function explicitCapabilityIntent(query) {
         return ROUTE_BY_ID.get(readOnly.capabilityId) ?? null;
     if (isOxygentChatIntent(query))
         return ROUTE_BY_ID.get("agents") ?? null;
+    // Values on existing Table rows, ahead of the sourcing rule whose "prospect"
+    // claimed "set a value on rows where stage is prospect". Scheduled or tag
+    // wording keeps its Workflow and Tags owners.
+    if (tableRowUpdateRecommendation(query)
+        && !/\b(workflows?|agents?|routines?|automat\w*|schedul\w*|weekly|daily|nightly|hourly|every|cron|tags?|tagg\w*)\b/.test(query))
+        return ROUTE_BY_ID.get("tables") ?? null;
     // Importing an AI answer is GEO evidence, rather than a Table file import.
     if (/\b(?:geo|aeo|ai (?:(?:search|answer) )?visibility|consumer ai answers?|answer engine optimization|generative engine optimization)\b/.test(query))
         return ROUTE_BY_ID.get("geo") ?? null;
@@ -2334,6 +2472,15 @@ function explicitCapabilityIntent(query) {
     // claimed "a first comment on my LinkedIn post" and "... automatically".
     if (isFirstCommentIntent(query))
         return ROUTE_BY_PRIMITIVE.get("publishing") ?? null;
+    // Writing the workspace's own post is a Publishing draft, ahead of the keyword
+    // post search ("a LinkedIn post about ...") and the public LinkedIn read owner,
+    // which claimed "write a LinkedIn post and save it as a draft".
+    if (isPostDraftIntent(query))
+        return ROUTE_BY_PRIMITIVE.get("publishing") ?? null;
+    // One event the user reports ("log that she visited our pricing page") is a
+    // Signal on the person, not a CRM note or a table row.
+    if (isSignalCaptureIntent(query))
+        return ROUTE_BY_PRIMITIVE.get("signals") ?? null;
     // Publish/approve are writes even when the noun is a public LinkedIn post.
     // The 2026-09-30 connector baseline offered the cookieless read owner first.
     if (isPublishingPostIntent(query))
@@ -2355,6 +2502,8 @@ function explicitCapabilityIntent(query) {
     if (isMailboxVolumeIntent(query) && !/\b(workflow|automation|automate|webhook|cron)\b/.test(query)) {
         return ROUTE_BY_ID.get("sending-infrastructure") ?? null;
     }
+    if (isAdaptiveWatchIntent(query))
+        return ROUTE_BY_PRIMITIVE.get("agents") ?? null;
     if (isHostedWorkflowIntent(query))
         return ROUTE_BY_PRIMITIVE.get("workflows") ?? null;
     if (placementGuideRecommendation(query))
@@ -2531,10 +2680,16 @@ function matchesIntentTerm(query, term) {
     }
     return false;
 }
-function highestScoringRoute(query) {
+/**
+ * A matched play's skill counts as one multi-word term for each card that names
+ * it first: "cold email the whole market" matched the whole-market play, yet its
+ * one card term ("email") picked Messages over Sequences.
+ */
+const PLAY_SKILL_TERM_SCORE = 6;
+function highestScoringRoute(query, playSkill) {
     let best = null;
     for (const card of OXYGEN_CAPABILITY_ROUTES) {
-        let score = 0;
+        let score = playSkill !== undefined && card.skills[0] === playSkill ? PLAY_SKILL_TERM_SCORE : 0;
         for (const term of card.intentTerms) {
             if (matchesIntentTerm(query, term))
                 score += term.includes(" ") ? 6 : 2;
@@ -2561,6 +2716,25 @@ export const LOCAL_BUSINESS_SCRAPE_COMMAND = `oxygen companies search preview --
 function isLocalBusinessIntent(query) {
     return /\b(local business(?:es)?|google maps|maps listings?|storefronts?|near me|(?:dental|medical|law|veterinary) (?:practices?|offices?|clinics?)|dentists?|restaurants?|cafes?|coffee shops?|gyms?|salons?|plumbers?|electricians?|contractors?|hvac|auto repair|real estate agents?|businesses (?:in|near|around) [a-z])\b/.test(query);
 }
+/** Writing or saving the workspace's own post, or asking to post it: a Publishing draft. */
+function isPostDraftIntent(query) {
+    if (/\b(engagers?|engag(?:ed|ing|ement)|comments?|commenters?|react\w*|harvest|scrape|competitors?|creators?|repl(?:y|ies)|tables?|rows?|workflows?|automat\w*|sequences?|campaigns?)\b/.test(query))
+        return false;
+    if (/\b(find|search|research|monitor|watch)\b/.test(query))
+        return false;
+    return (/\b(write|draft|drafts|drafted|compose|save|saved)\b/.test(query) && /\bposts?\b/.test(query))
+        || /\bpost (?:it|this|that)\b|\bpost (?:on|to) (?:linkedin|x|twitter)\b/.test(query);
+}
+/** Recording one reported event (a visit, a view) on a person: a Signal, logged on the Record. */
+function isSignalCaptureIntent(query) {
+    return /\b(record|log|logs|logged|track|note|save|add|capture)\b/.test(query)
+        && /\b(visit(?:s|ed|or)?|viewed|profile views?|signals?)\b/.test(query)
+        // Outreach wording ("set up an email follow-up ... add the people") is a
+        // Sequence for signalled people, not one reported event.
+        && !/\b(list|show|read|which|who|rank|leads? to contact|registry|search|find|inbox|webhook|automat\w*|workflows?|sequences?|enrich\w*|tables?|columns?|feeds?|follow ups?|campaigns?|cadences?|outreach|emails)\b/.test(query);
+}
+const POST_DRAFT_EXECUTION = "Read the voice page first (oxygen_knowledge_page_get, slug voice) and use only numbers a page states. Save the post with oxygen_publishing_posts_create, status draft and no approved flag: it needs no sender, publishes nothing and opens in Publishing for review. A post written only in the reply is not saved. Publishing it is a separate oxygen_publishing_posts_approve after the user says yes; a missing connected sender is the one blocker to name. End by saying it is a draft, not live, with its web_url; if the save is refused, say the post exists only in this chat.";
+const SIGNAL_CAPTURE_EXECUTION = "Find the person with oxygen_crm_record_search; if there is no record, create it with oxygen_crm_record_assert (identity email, values full_name and company_domain when known; free, no card). Then log the event on that record with oxygen_crm_activity_log: row_id the rowId the assert or search returned (not object.id) or her email, activity_type website_visit (or profile_view, post_reaction, new_follower), direction inbound, occurred_at, a one-line summary such as the page viewed. It then shows in the Signals feed and on the person's timeline. Not a note or a table row; contacting nobody. End by saying it is recorded as a website-visit Signal and where it shows (the record's web_url); if a write is refused, say nothing was recorded.";
 function isPublishingPostIntent(query) {
     return /\b(posts?|publishing|content calendar)\b/.test(query)
         && /\b(publish|publishing|schedule|scheduled|approve|approval)\b/.test(query)
@@ -2702,6 +2876,22 @@ function recommendationsFor(card, query) {
             exactMcpCall: CAPABILITY_ROUTE_MCP_CALLS.ugcProgramCreate(),
         };
     }
+    if (card.primitive === "publishing" && isPostDraftIntent(query)) {
+        return {
+            tools: ["oxygen_knowledge_page_get", "oxygen_publishing_posts_create", "oxygen_publishing_posts_get"],
+            commands: ["knowledge page get", "publishing posts create", "publishing posts get"],
+            exactCommand: POST_DRAFT_COMMAND,
+            exactMcpCall: CAPABILITY_ROUTE_MCP_CALLS.publishingPostDraft(),
+        };
+    }
+    if (card.primitive === "signals" && isSignalCaptureIntent(query)) {
+        return {
+            tools: ["oxygen_crm_record_search", "oxygen_crm_record_assert", "oxygen_crm_activity_log", "oxygen_signals_list"],
+            commands: ["crm search", "crm assert", "crm activity log", "signals list"],
+            exactCommand: SIGNAL_CAPTURE_COMMAND,
+            exactMcpCall: CAPABILITY_ROUTE_MCP_CALLS.signalCapture(),
+        };
+    }
     if (card.primitive === "publishing" && isFirstCommentIntent(query)) {
         return {
             tools: ["oxygen_publishing_posts_create", "oxygen_publishing_posts_update", "oxygen_publishing_posts_get"],
@@ -2917,6 +3107,12 @@ function recommendationsFor(card, query) {
         const removal = tableRowRemovalRecommendation(query);
         if (removal)
             return removal;
+        const insert = tableRowInsertRecommendation(query);
+        if (insert)
+            return insert;
+        const update = tableRowUpdateRecommendation(query);
+        if (update)
+            return update;
         const read = tableReadRecommendation(query);
         if (read)
             return read;
@@ -3224,6 +3420,14 @@ function recommendationsFor(card, query) {
                 commands: ["workflows templates search", "workflows templates describe", "workflows templates preflight", "workflows templates apply"],
             };
         }
+        // A scheduled change to existing rows: the query and row-update tools the
+        // graph's nodes call rank beside the authoring gateway.
+        if (/\b(rows?|cells?)\b/.test(query) && /\b(updat\w*|edit\w*|chang\w*|sets?|setting|tag\w*|mark\w*|writ\w*)\b/.test(query)
+            && !/\b(insert\w*|add\w*|append\w*|new rows?|delete\w*|remove\w*)\b/.test(query))
+            return {
+                tools: ["oxygen_workflows_schema", "oxygen_workflows_lint", "oxygen_tables_query", "oxygen_rows_update", "oxygen_workflows_apply"],
+                commands: ["workflows schema", "workflows lint", "tables query", "tables update", "workflows apply"],
+            };
         if (isNetNewLinkedInInitiation(query) || /\b(outreach|sequence|enroll|message)\b/.test(query)) {
             return {
                 tools: ["oxygen_workflows_schema", "oxygen_workflows_lint", "oxygen_workflows_apply", "oxygen_tools_get", "oxygen_sequences_list", "oxygen_sequences_start"],
@@ -3679,6 +3883,20 @@ function isHostedWorkflowIntent(query) {
     return /\b(nightly|hourly|daily|weekly|every (?:monday|tuesday|wednesday|thursday|friday|saturday|sunday|day|night|week|month))\b/.test(query)
         || (/\bschedule(?:d)?\b/.test(query) && !/\bpost|content\b/.test(query));
 }
+/**
+ * Watching items that change and working out what each one needs is an Agent's
+ * judgment, not a Workflow's fixed rule: "keep an eye on open deals and suggest
+ * what to do next for each" routed to Records reads, and the Oxygent proposed a
+ * routine without saying why (System 1 routing case, 2026-10-22).
+ */
+function isAdaptiveWatchIntent(query) {
+    if (/\b(workflows?|webhooks?|cron|deterministic|fixed rule|sequences?|campaigns?|posts?|mailbox\w*|deliverability|bounce\w*)\b/.test(query))
+        return false;
+    return /\b(keeps? an eye on|keeps? tabs on|keeps? track of|watch(?:es|ing)?|monitor(?:s|ing)?|look(?:s|ing)? after)\b/.test(query)
+        && /\b(suggest\w*|decid\w*|works? out|figures? out|recommend\w*|judg\w*|what to do|next steps?|next moves?)\b/.test(query)
+        && /\b(each|every|individual\w*|differently|deals?|pipeline|opportunit(?:y|ies)|accounts?)\b/.test(query);
+}
+const ADAPTIVE_WATCH_EXECUTION = "Watching items that change and deciding what fits each one is an Agent's job: each run looks at every item and works out what it needs, while a Workflow repeats one fixed rule. Tell the person that in one plain line. Set it up as an ongoing Agent session with per-run and rolling 24-hour credit caps; in an Oxygent chat, propose a routine and put that line in its why. Read the items first so the goal names real fields (for deals: stage, amount, last activity). Size the caps to one check, about 10 credits a run for reading a few dozen records and writing suggestions, and say so when that is above a limit the person gave. Suggestions stay inside OXYGEN (a task or a note); contacting anyone needs its own approval.";
 function isRecurringCompanyMonitoringIntent(query) {
     return /\b(companies|company|competitors?)\b/.test(query)
         && /\b(monitor(?:ing)?|watch(?:ing|list)?|track(?:ing)?)\b/.test(query)

package/node_modules/@oxygen/shared/dist/clay-migration-auth-state.d.ts

@@ -1,3 +1,9 @@
-export declare function tagClayMigrationFailureState(error: unknown, encryptedState: string): void;
+type FailureState = {
+    encryptedState: string;
+    expiresAt?: string;
+};
+export declare function tagClayMigrationFailureState(error: unknown, encryptedState: string, expiresAt?: string): void;
 /** Consume only state attached in this process by the migration adapter. */
+export declare function consumeClayMigrationFailureState(error: unknown): FailureState | null;
 export declare function readClayMigrationFailureState(error: unknown): string | null;
+export {};

package/node_modules/@oxygen/shared/dist/clay-migration-auth-state.js

@@ -1,15 +1,16 @@
-// Rotated credentials must survive a failed source read, without becoming part
-// of a customer error, operator log or serialized tool result.
 const failureStates = new WeakMap();
-export function tagClayMigrationFailureState(error, encryptedState) {
+export function tagClayMigrationFailureState(error, encryptedState, expiresAt) {
     if (error !== null && typeof error === "object")
-        failureStates.set(error, encryptedState);
+        failureStates.set(error, { encryptedState, ...(expiresAt === undefined ? {} : { expiresAt }) });
 }
 /** Consume only state attached in this process by the migration adapter. */
-export function readClayMigrationFailureState(error) {
+export function consumeClayMigrationFailureState(error) {
     if (error === null || typeof error !== "object")
         return null;
     const state = failureStates.get(error) ?? null;
     failureStates.delete(error);
     return state;
 }
+export function readClayMigrationFailureState(error) {
+    return consumeClayMigrationFailureState(error)?.encryptedState ?? null;
+}

package/node_modules/@oxygen/shared/dist/contracts/browser-operations.js

@@ -115,6 +115,7 @@ export const BROWSER_OPERATIONS = [
         return_to: text("Same-origin path to return to after Checkout, for example /home."),
         source: text("Optional upgrade-entry attribution; omit if unknown."),
         blocked: text("Optional capability that led to the upgrade; omit if unknown."),
+        allow_promotion_codes: bool({ description: "Show the promotion-code field instead of the first-month offer." }),
     }, ["plan"]),
     operation("billing.confirm", "/api/cli/billing/confirm", "POST", "billing confirm", "oxygen_billing_confirm", "billing", "Confirm a plan-change preview within 15 minutes; approved accepts payment, term and effective date. Unrestricted members allowed; restricted clients denied.", { token: text(), approved: bool() }, ["token", "approved"], { spends: true }),
     operation("billing.portal", "/api/cli/billing/portal", "POST", "billing portal", "oxygen_billing_portal", "billing", "Create a Stripe billing-portal URL. Unrestricted members allowed; restricted clients denied.", { returnUrl: text() }),

package/node_modules/@oxygen/shared/dist/contracts/clay-migration.d.ts

@@ -3,6 +3,41 @@ import { type ContractIssue, type Infer } from "./schema.js";
 export declare const CLAY_MIGRATION_ACTIONS: readonly ["connect", "status", "discover", "read", "transfer", "checkpoint", "report", "disconnect"];
 export declare const CLAY_RESOURCE_TYPES: readonly ["workspace", "folder", "workbook", "table", "audience", "workflow", "function", "claygent", "knowledge", "schedule", "campaign"];
 export declare const CLAY_RESOURCE_DISPOSITIONS: readonly ["pending", "copied", "rebuilt", "needs_decision", "unsupported", "inaccessible", "excluded", "failed"];
+type GlobalAudienceScope = {
+    entity_type: "people" | "companies" | "deals";
+    global: true;
+    archived?: true;
+};
+export declare const CLAY_GLOBAL_AUDIENCE_SCOPES: {
+    readonly "global-people": {
+        readonly entity_type: "people";
+        readonly global: true;
+    };
+    readonly "global-companies": {
+        readonly entity_type: "companies";
+        readonly global: true;
+    };
+    readonly "global-deals": {
+        readonly entity_type: "deals";
+        readonly global: true;
+    };
+    readonly "global-archived-people": {
+        readonly entity_type: "people";
+        readonly global: true;
+        readonly archived: true;
+    };
+    readonly "global-archived-companies": {
+        readonly entity_type: "companies";
+        readonly global: true;
+        readonly archived: true;
+    };
+    readonly "global-archived-deals": {
+        readonly entity_type: "deals";
+        readonly global: true;
+        readonly archived: true;
+    };
+};
+export declare function clayGlobalAudienceScope(resourceId: string): GlobalAudienceScope | null;
 export declare const CLAY_MIGRATION_CONTRACT: import("./schema.js").ContractObject<{
     readonly action: {
         type: "string";
@@ -17,11 +52,13 @@ export declare const CLAY_MIGRATION_CONTRACT: import("./schema.js").ContractObje
         description?: string;
     };
     readonly resource_id: import("./schema.js").StringProperty;
+    readonly row_id: import("./schema.js").StringProperty;
     readonly section: {
         type: "string";
-        enum: readonly ("columns" | "fields" | "graph" | "metadata" | "record_ids" | "records" | "rows" | "sequence")[];
+        enum: readonly ("columns" | "fields" | "graph" | "metadata" | "record_ids" | "records" | "row" | "rows" | "sequence")[];
         description?: string;
     };
+    readonly full: import("./schema.js").BooleanProperty;
     readonly path: import("./schema.js").StringProperty;
     readonly text_offset: {
         type: "integer";
@@ -35,6 +72,7 @@ export declare const CLAY_MIGRATION_CONTRACT: import("./schema.js").ContractObje
         enum: readonly ("companies" | "deals" | "people")[];
         description?: string;
     };
+    readonly archived: import("./schema.js").BooleanProperty;
     readonly record_ids: import("./schema.js").ArrayProperty<{
         type: "integer";
         description?: string;
@@ -69,3 +107,4 @@ export declare const CLAY_MIGRATION_CONTRACT: import("./schema.js").ContractObje
 export type ClayMigrationInput = Infer<typeof CLAY_MIGRATION_CONTRACT>;
 export declare function clayMigrationInputIssues(args: Readonly<Record<string, unknown>>): ContractIssue[];
 export declare const CLAY_MIGRATION_OPERATION: OperationSpec<typeof CLAY_MIGRATION_CONTRACT>;
+export {};