@oxygen-agent/cli 1.1014.779 → 1.1014.951

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.1014.779
+Version: 1.1014.951

package/dist/command-manifest.js

@@ -105,6 +105,11 @@ const MUTATING_VERBS = new Set([
 // status persists state and can pause the provider; reconnect replaces its
 // connection and can restart provider history. Other status commands are reads.
 const MUTATING_COMMANDS = new Set([
+    // Live DNS checks save observations; --cached explicitly reads saved evidence.
+    "domains dns",
+    // Sends the workspace's company documents to Twilio for a human review that
+    // cannot be edited once started. `submit` is its only leaf, so it is exact.
+    "voice verification submit",
     // Approved runs write relation edges, Records fields or delete duplicate rows.
     // Exact names: a `link` verb would also catch the read-only `tables link-suggest`.
     "tables link",
@@ -165,6 +170,8 @@ const MUTATING_COMMANDS = new Set([
 // mode, but a small number of approved operations are explicitly
 // zero-credit. Keep those exceptions exact so discovery never invents spend.
 const ZERO_CREDIT_APPROVAL_COMMANDS = new Set([
+    // --approved hands documents to the carrier's reviewers; no credits, no carrier fee.
+    "voice verification submit",
     "domains dns apply",
     // The compatibility --approved flag never bypasses canonical proposal review.
     // Wiki revisions and canonical pin changes are free (Knowledge audit, 2026-10-06).
@@ -250,6 +257,8 @@ const READ_ONLY_COMMANDS = new Set([
 // invocation still previews, so machine-readable discovery must not imply that
 // calling the command without its confirmation flag writes anything.
 const PREVIEW_BY_DEFAULT_COMMANDS = new Set([
+    // A bare call validates and names what would be sent; --approved submits.
+    "voice verification submit",
     "domains dns apply",
     "mailboxes warmup enable",
     "mailboxes warmup google",
@@ -280,7 +289,7 @@ const PREVIEW_BY_DEFAULT_COMMANDS = new Set([
     // audience and caps and writes nothing. Without this entry discovery would tell
     // an agent that previewing the play arms it, and the preview would go unrun.
     "linkedin intent autoenroll",
-    "mailboxes emailguard auto-enroll",
+    "mailboxes deliverability auto-enroll",
     "domains delete",
     "mailboxes delete",
     "mailboxes connect-oauth",

package/dist/commands/admin.js

@@ -46,7 +46,7 @@ export function registerAdminFamily(program, handleAsyncAction, binaryName) {
         .command("admin")
         .description("Staff-only commands.")
         .addCommand(new Command("kpis")
-        .description("Show the company conversion funnel (visitors → signups → activation on any surface, web, CLI or MCP → paid, with step rates and agent connected beside it), self-reported signup-channel attribution, new and positive-paid MRR/ARR, and paid churn separated from trial loss. OXYGEN staff only; workspace admin role alone does not grant access.")
+        .description("Show the company conversion funnel (visitors → signups → activation on any surface, web, CLI or MCP → paid, with step rates, and agent connected then activated through it beside it), self-reported signup-channel attribution, new and positive-paid MRR/ARR, and paid churn separated from trial loss. OXYGEN staff only; workspace admin role alone does not grant access.")
         .addOption(new Option("--range <range>", "Range for acquisition, the funnel's signup cohort, new revenue, and churn; current MRR/ARR and scheduled cancellations remain point-in-time.")
         .choices(["7d", "30d", "90d"])
         .default("30d"))

package/dist/commands/billing.js

@@ -107,7 +107,7 @@ export function registerBillingFamily(program, handleAsyncAction, billingDocsUrl
         await handleAsyncAction("billing commitments", options, () => requestOxygen(`/api/cli/billing/commitments${options.view ? `?view=${encodeURIComponent(options.view)}` : ""}`));
     }))
         .addCommand(new Command("estimate")
-        .description("Quote prospective enrichment, senders, X/WhatsApp, EmailGuard tests and an unsaved Workflow without provider calls, writes or reservations. Work-email figures are labelled conservative ceilings until matching measured populations exist; LinkedIn finder prices distinguish found results, misses and declared averages. Current workspace plan_fit uses stored spendable balance and balance-only months; --plan selects a hypothetical monthly allowance instead. Unknown/floor costs suppress complete plan recommendations. Workflow quotes include step floors, 30-day cadence and a separate declared ceiling; no execution authority. Own-key test vendor charges are separate. Prices are in force; opening the quote costs 0 credits. Example: oxygen billing estimate --leads 50 --enrich linkedin_url --whatsapp-accounts 2 --x-accounts 1 --json.")
+        .description("Quote prospective enrichment, senders, X/WhatsApp, OXYGEN deliverability tests and an unsaved Workflow without provider calls, writes or reservations. Work-email figures are labelled conservative ceilings until matching measured populations exist; LinkedIn finder prices distinguish found results, misses and declared averages. Current workspace plan_fit uses stored spendable balance and balance-only months; --plan selects a hypothetical monthly allowance instead. Unknown/floor costs suppress complete plan recommendations. Workflow quotes include step floors, 30-day cadence and a separate declared ceiling; no execution authority. Own-key test vendor charges are separate. Prices are in force; opening the quote costs 0 credits. Example: oxygen billing estimate --leads 50 --enrich linkedin_url --whatsapp-accounts 2 --x-accounts 1 --json.")
         .option("--leads <n>", "Leads you work through a month.")
         .option("--enrich <id>", "An enrichment run on every lead, by id from `oxygen enrichment catalog --json` (work_email, mobile_phone, person_enrich, capability:verify_email …). Repeat for several.", collectRepeatable, [])
         .option("--email-steps <n>", "Email steps per lead (only the email ones; LinkedIn steps go in --linkedin-steps).")
@@ -117,10 +117,14 @@ export function registerBillingFamily(program, handleAsyncAction, billingDocsUrl
         .option("--linkedin-accounts <n>", "LinkedIn accounts you connect.")
         .option("--x-accounts <n>", "X accounts; prospective scenario quantity.")
         .option("--whatsapp-accounts <n>", "WhatsApp accounts; prospective scenario quantity.")
-        .option("--emailguard-inboxes <n>", "Managed EmailGuard inboxes; prospective scenario quantity.")
-        .option("--emailguard-tests-per-inbox <n>", "Managed tests per inbox per cycle; prospective scenario quantity.")
-        .option("--emailguard-byok-inboxes <n>", "Own-key EmailGuard inboxes; prospective scenario quantity.")
-        .option("--emailguard-byok-tests-per-inbox <n>", "Own-key tests per inbox per cycle; prospective scenario quantity.")
+        .addOption(new Option("--emailguard-inboxes <n>").hideHelp())
+        .addOption(new Option("--emailguard-tests-per-inbox <n>").hideHelp())
+        .addOption(new Option("--emailguard-byok-inboxes <n>").hideHelp())
+        .addOption(new Option("--emailguard-byok-tests-per-inbox <n>").hideHelp())
+        .option("--deliverability-inboxes <n>", "Managed OXYGEN deliverability inboxes; prospective scenario quantity.")
+        .option("--deliverability-tests-per-inbox <n>", "Managed tests per inbox per cycle; prospective scenario quantity.")
+        .option("--deliverability-byok-inboxes <n>", "Own-key OXYGEN deliverability inboxes; prospective scenario quantity.")
+        .option("--deliverability-byok-tests-per-inbox <n>", "Own-key tests per inbox per cycle; prospective scenario quantity.")
         .option("--workflow-manifest <json>", "Unsaved oxygen-workflows-v2 draft JSON. Saves nothing.")
         .option("--workflow-cron <cron>", "Five-field schedule for a 30-day step-cost floor; arms nothing.")
         .option("--workflow-max-credits <n>", "Declared ceiling for comparison only; grants no approval or authority.")
@@ -139,10 +143,10 @@ export function registerBillingFamily(program, handleAsyncAction, billingDocsUrl
                 linkedin_accounts: readPositiveNumberOrZero(options.linkedinAccounts) ?? 0,
                 x_accounts: options.xAccounts === undefined ? 0 : Number(options.xAccounts),
                 whatsapp_accounts: options.whatsappAccounts === undefined ? 0 : Number(options.whatsappAccounts),
-                emailguard_inboxes: options.emailguardInboxes === undefined ? 0 : Number(options.emailguardInboxes),
-                emailguard_tests_per_inbox: options.emailguardTestsPerInbox === undefined ? 0 : Number(options.emailguardTestsPerInbox),
-                emailguard_byok_inboxes: options.emailguardByokInboxes === undefined ? 0 : Number(options.emailguardByokInboxes),
-                emailguard_byok_tests_per_inbox: options.emailguardByokTestsPerInbox === undefined ? 0 : Number(options.emailguardByokTestsPerInbox),
+                emailguard_inboxes: Number(options.deliverabilityInboxes ?? options.emailguardInboxes ?? 0),
+                emailguard_tests_per_inbox: Number(options.deliverabilityTestsPerInbox ?? options.emailguardTestsPerInbox ?? 0),
+                emailguard_byok_inboxes: Number(options.deliverabilityByokInboxes ?? options.emailguardByokInboxes ?? 0),
+                emailguard_byok_tests_per_inbox: Number(options.deliverabilityByokTestsPerInbox ?? options.emailguardByokTestsPerInbox ?? 0),
                 ...(options.workflowManifest ? { workflow_manifest: parseJsonObject(options.workflowManifest) } : {}),
                 ...(options.workflowCron ? { workflow_cron: options.workflowCron } : {}),
                 ...(options.workflowMaxCredits === undefined ? {} : { workflow_max_credits: Number(options.workflowMaxCredits) }),

package/dist/commands/columns.js

@@ -1,7 +1,7 @@
 import { parseKeyValuePairs, parseJsonObject, readNonNegativeInt, readPositiveInt, readRecordString } from "../cli-values.js";
 import { readColumnDecisionFlags } from "../column-decision-options.js";
 import { formatAiPromptPreviewNotice, formatColumnReferenceNotices, formatEnrichmentInputMappingNotice } from "../column-run-notices.js";
-import { collectRepeatable, parseJsonArray, parseJsonValue, readCsvOption, readFileIfPresent, readFilterSelectionOption, readFormulaValuesOption, readJsonFileValue, readNonNegativeNumber, readPositiveNumber, tableRunsListPath, waitForTableActionRun } from "../command-support.js";
+import { collectRepeatable, parseJsonArray, parseJsonValue, readCsvOption, readFileIfPresent, readFilterSelectionOption, readFormulaValuesOption, readJsonFileValue, readNonNegativeNumber, tableRunsListPath, waitForTableActionRun } from "../command-support.js";
 import { requestOxygen } from "../http-client.js";
 import { runLocalCustomHttpColumn } from "../local-custom-http-column.js";
 import { isRecord, readOption } from "../util.js";
@@ -830,7 +830,7 @@ export function registerColumnsFamily(program, handleAsyncAction) {
         .addCommand(new Command("add")
         .description("Add a nullable column, a catalog template (--prompt-key) or a multi-column enrichment bundle (--preset) to a workspace table. Writes the definition only — this never runs the column and never spends credits; use `columns run` for that, with --dry-run first to see the cost. For a page, posting or filing the row already links to, or a company fact Oxygen already knows how to research (founders, parent company, funding, cloud provider, offers demos, industry, NAICS, HQ, a LinkedIn or Crunchbase page), pick a template from `columns catalog` (--prompt-key) instead of writing a prompt; or read a URL column with --kind research --research-url. The guide is the oxygen-tables skill (`oxygen skills get oxygen-tables --json`). For ICP fit, use Classify Score: `columns add <table> --label 'ICP fit' --score 'low,medium,high' --prompt 'Assess {{company_name}}: {{description}}, {{employees}} employees' --grounding workspace` (0.075 credits/row). A formula column needs no run at all: it evaluates on read from its current inputs, so `tables query` shows its values immediately. A plain field is --type: text, number, checkbox, date, json, markdown, image, or a choice column — select, multi_select or status, with --options \"Lead,Contacted,Won\". To link another table row to row, use `oxygen tables relate <table> --to <other-table> --live`; to read a value out of one, --lookup-table.")
         .argument("<table>", "Table id or slug.")
-        .option("--preset <preset>", "Add a pre-built column bundle instead of one column, which is what --prompt-key adds: a preset writes SEVERAL columns at once and needs no --input on a table whose identity column it can find, while --prompt-key adds one template column and binds each input you name. Presets: `person_enrich` (one LinkedIn profile lookup — Blitz first, Professional Network Data (Up2Data) only when Blitz has no match — then first/last/full name, current company and its LinkedIn URL, job title, start date, education, school, headline, bio, location and followers as free stored fields that fill when the lookup runs, followers only on rows Professional Network Data answers because Blitz publishes none; the person templates in `columns catalog --category people` all read its payload column), `company_enrich` (one company lookup from a domain or LinkedIn URL — Blitz first, Professional Network Data (Up2Data) only when Blitz has no match, about 1 credit a company — keeping the whole profile in its JSON column plus name, domain, LinkedIn URL, headcount, industry, description, founded year and HQ country as free stored fields; no field choices; binds to the person preset's current_company_linkedin_url automatically), `company_tech_stack` (the technologies a company runs, from its website and hiring), `company_funding` (total raised, latest round, number of rounds and investors), `company_revenue` (an annual revenue estimate), `company_hiring` (the roles a company is hiring for, with a count) — each of these four is one paid lookup column that fills its own columns, priced per row in `tools search --for-table` — plus `company_lookalikes` (one managed lookup from --input company_domain=website; keeps similar companies separate from the seed; dry-run for price) — or `domain_check` (1 credit/row for a live/redirect/parked/not_found/dead verdict on every domain, cached 30 days, plus a free label column to filter on). For a single cleaned or classified column, use a template from `columns catalog` instead — that is one column, not a bundle. Name the input column with --input: `url` for person_enrich, `domain` and/or `linkedin_url` for the company presets. Any column works whatever it is called; without --input Oxygen guesses from column names. Creating the columns is free; run them afterwards, --dry-run first.")
+        .option("--preset <preset>", "Add a pre-built column bundle instead of one column, which is what --prompt-key adds: a preset writes SEVERAL columns at once and needs no --input on a table whose identity column it can find, while --prompt-key adds one template column and binds each input you name. Presets: `person_enrich` (one LinkedIn profile lookup — Blitz first, Professional Network Data (Up2Data) only when Blitz has no match — then first/last/full name, current company and its LinkedIn URL, job title, start date, education, school, headline, bio, location and followers as free stored fields that fill when the lookup runs, followers only on rows Professional Network Data answers because Blitz publishes none; the person templates in `columns catalog --category people` all read its payload column), `company_enrich` (one company lookup from a domain or LinkedIn URL — Blitz first, Professional Network Data (Up2Data) only when Blitz has no match, about 1 credit a company — keeping the whole profile in its JSON column plus name, domain, LinkedIn URL, headcount, industry, description, founded year and HQ country as free stored fields; no field choices; binds to the person preset's current_company_linkedin_url automatically), `company_tech_stack` (the technologies a company runs, from its website and hiring), `company_funding` (total raised, latest round, number of rounds and investors), `company_revenue` (an annual revenue estimate), `company_hiring` (the roles a company is hiring for, with a count) — each of these four is one paid lookup column that fills its own columns, priced per row in `tools search --for-table` — plus `company_lookalikes` (one managed lookup from --input company_domain=website; keeps similar companies separate from the seed; dry-run for price) — or `domain_check` (0.1 credits/row at list price for a live/redirect/parked/not_found/dead verdict on every domain, cached 30 days, plus a free label column to filter on). For a single cleaned or classified column, use a template from `columns catalog` instead — that is one column, not a bundle. Name the input column with --input: `url` for person_enrich, `domain` and/or `linkedin_url` for the company presets. Any column works whatever it is called; without --input Oxygen guesses from column names. Creating the columns is free; run them afterwards, --dry-run first.")
         .option("--input <slot=column...>", "Bind a preset or template input to an exact column, e.g. --input url=pricing_url with --prompt-key, or --input domain=website --input linkedin_url=company_li with --preset. Repeatable. For a preset it is only needed when the automatic match is wrong or missing; for a template it names the column each declared input reads.", collectRepeatable, [])
         // No preset takes a field list any more (founder, 2026-09-24). Hidden,
         // not removed: an old script passing them gets the server's refusal,
@@ -1158,7 +1158,7 @@ export function registerColumnsFamily(program, handleAsyncAction) {
         .action(async (table, column, options) => {
         const limit = readPositiveInt(options.limit);
         const localConcurrency = readPositiveInt(options.localConcurrency);
-        const maxCredits = readPositiveNumber(options.maxCredits);
+        const maxCredits = readNonNegativeNumber(options.maxCredits);
         const maxConcurrency = readPositiveInt(options.maxConcurrency);
         const filterSelection = readFilterSelectionOption(options.filterJson);
         const formulaValues = readFormulaValuesOption(options.formulaValues);

package/dist/commands/crm.js

@@ -906,7 +906,7 @@ export function registerCrmFamily(program, handleAsyncAction) {
     })
         .addCommand(new Command("create")
         .description("Create or repair a custom CRM object. Defaults to dry-run.")
-        .requiredOption("--slug <slug>", "Object slug (snake_case), such as projects or tasks.")
+        .requiredOption("--slug <slug>", "Object slug (snake_case), such as projects or vendors. Slugs CRM already uses for its own objects and pages (companies, deals, tasks, dashboards, ...) are refused.")
         .requiredOption("--display-name <name>", "Human-readable object name, such as Projects.")
         .requiredOption("--columns-json <json>", 'JSON array. Every column requires key,label,data_type,semantic_type; camelCase aliases are accepted. Example: [{"key":"name","label":"Name","data_type":"text","semantic_type":"text","is_record_label":true}].')
         .option("--identities-json <json>", "JSON array. Every identity requires column_key and normalization; camelCase columnKey is accepted. normalization is one of email_v1, domain_v1, linkedin_url_v1, exact_text_v1, uuid_v1 — the versioned CRM names, NOT the short exact/email/domain spellings --lookup-normalize takes. At most one identity may set is_primary.")
@@ -930,7 +930,7 @@ export function registerCrmFamily(program, handleAsyncAction) {
     }))
         .addCommand(new Command("delete")
         .description("Delete a CUSTOM CRM object: removes the object and schedules its backing table for deletion (restorable for 14 days). Standard objects (companies, people, deals) are permanent and refused. Defaults to dry-run; --live requires --confirm. Re-run on an object a teammate already deleted, it reports alreadyArchived with the table's deletion state and purge date. Restoring that table returns its rows as an ordinary table; the object stays deleted. Purging it also removes the object's archived definition.")
-        .argument("<object>", "Custom CRM object slug, such as projects or tasks.")
+        .argument("<object>", "Custom CRM object slug, such as projects or vendors.")
         .option("--keep-table", "Deregister the object but keep its table as an ordinary workspace table (no delete timer). Ignored once the table is already scheduled.")
         .option("--purge-after <days>", "Days until the backing table's physical purge. Defaults to 14; restorable via `tables restore` until then. Ignored once the table is already scheduled.")
         .option("--dry-run", "Preview the object, rows, relationships, and edges the delete would take. Default.")

package/dist/commands/deliverability.js

@@ -3,17 +3,17 @@ import { readOption } from "../util.js";
 import { Command, CommanderError, Option } from "commander";
 export function registerDeliverabilityFamily(program, handleAsyncAction) {
     program.addCommand(new Command("deliverability")
-        .description("External email deliverability: fleet reputation health and DIRECTIONAL inbox-placement (spam) tests via EmailGuard, Zapmail, or an explicitly configured OXYGEN placement evaluation pilot. Start with `placement-test list` and `placement-test get` to inspect existing results for 0 credits without creating or sending a test. For continuous EmailGuard account monitoring use `oxygen mailboxes emailguard connect`. Placement tests are approval-gated paid runs (managed bills Oxygen credits; own-key tests pay the in-force platform fee plus separate vendor charges — Zapmail bills your Zapmail wallet ~$2/test). OXYGEN placement evaluation is never auto-selected or generally available: it is a limited pilot with one 0-credit test for its configured eligible connected sender.")
+        .description("External email deliverability: fleet reputation health and DIRECTIONAL inbox-placement (spam) tests via OXYGEN deliverability, Zapmail, or an explicitly configured OXYGEN placement evaluation pilot. Start with `placement-test list` and `placement-test get` to inspect existing results for 0 credits without creating or sending a test. For continuous OXYGEN deliverability account monitoring use `oxygen mailboxes deliverability connect`. Placement tests are approval-gated paid runs (managed bills Oxygen credits; own-key tests pay the in-force platform fee plus separate vendor charges — Zapmail bills your Zapmail wallet ~$2/test). OXYGEN placement evaluation is never auto-selected or generally available: it is a limited pilot with one 0-credit test for its configured eligible connected sender.")
         .addCommand(new Command("placement-test")
         .description("Inspect saved directional inbox-placement results with list/get (0 credits; no test email is sent). New tests use preview and approval through run/send.")
         .addCommand(new Command("run")
-        .description("Create a placement test for one sending mailbox. Without --approved this returns a cost PREVIEW. EmailGuard creation returns exact seeds + phrase but sends nothing; next run `placement-test send <id>` to preview and approve that external email. Zapmail owns its probe delivery and completes async (2-24h). OXYGEN placement evaluation requires explicit --provider oxygen_placement plus --subject and --body, and is available only for the eligible connected sender enabled for the limited pilot. Its approval creates AND sends one probe with no separate send step: preview first, then re-run the same mailbox, provider, subject, and body with --approved --max-credits 0 --plan <plan_hash>.")
+        .description("Create a placement test for one sending mailbox. Without --approved this returns a cost PREVIEW. OXYGEN deliverability creation returns exact seeds + phrase but sends nothing; next run `placement-test send <id>` to preview and approve that external email. Zapmail owns its probe delivery and completes async (2-24h). OXYGEN placement evaluation requires explicit --provider oxygen_placement plus --subject and --body, and is available only for the eligible connected sender enabled for the limited pilot. Its approval creates AND sends one probe with no separate send step: preview first, then re-run the same mailbox, provider, subject, and body with --approved --max-credits 0 --plan <plan_hash>.")
         .argument("<mailbox>", "Sending mailbox address to test (e.g. ada@send.acme.com).")
-        .addOption(new Option("--provider <provider>", "Health provider: emailguard, zapmail, or oxygen_placement. Omit to auto-resolve EmailGuard/Zapmail. OXYGEN placement evaluation is never auto-selected and requires the sender enabled for the limited pilot.").choices(["emailguard", "zapmail", "oxygen_placement"])
+        .addOption(new Option("--provider <provider>", "Health provider: oxygen_deliverability, zapmail, or oxygen_placement. Omit to auto-resolve OXYGEN deliverability/Zapmail. OXYGEN placement evaluation is never auto-selected and requires the sender enabled for the limited pilot.")
         .argParser((value) => {
         const provider = value === "sendkit" ? "oxygen_placement" : value;
-        if (!["emailguard", "zapmail", "oxygen_placement"].includes(provider)) {
-            throw new CommanderError(2, "commander.invalidArgument", "Choose emailguard, zapmail, or oxygen_placement.");
+        if (!["oxygen_deliverability", "emailguard", "zapmail", "oxygen_placement"].includes(provider)) {
+            throw new CommanderError(2, "commander.invalidArgument", "Choose oxygen_deliverability, zapmail, or oxygen_placement.");
         }
         return provider;
     }))
@@ -52,7 +52,7 @@ export function registerDeliverabilityFamily(program, handleAsyncAction) {
         }));
     }))
         .addCommand(new Command("send")
-        .description("Preview or send the exact EmailGuard seed message for a provider-created test. Preview returns sender, all recipients, exact content, and plan_hash. Live send requires --approved --plan <hash>, costs 0 additional credits, and sends one message only.")
+        .description("Preview or send the exact OXYGEN deliverability seed message for a provider-created test. Preview returns sender, all recipients, exact content, and plan_hash. Live send requires --approved --plan <hash>, costs 0 additional credits, and sends one message only.")
         .argument("<id>", "Oxygen placement-test id returned by `placement-test run`.")
         .option("--allow-paused-probe", "Opt in to one diagnostic probe while preserving campaign pause; repeat at both create and send approvals. Never permits disabled senders.")
         .option("--approved", "Send the exact previewed seed message (otherwise preview only).")
@@ -71,17 +71,25 @@ export function registerDeliverabilityFamily(program, handleAsyncAction) {
         }));
     }))
         .addCommand(new Command("list")
-        .description("Inspect recent directional inbox-placement tests, their status, results, and credits used, plus `pricing`: EmailGuard monitoring credits per inbox-month, two included tests per inbox per cycle, and the managed extra-test price in force. Covered tests cost no extra credits. The allowance resets each UTC calendar month; unused tests do not roll over. Own-key tests pay the quoted OXYGEN platform fee separately from provider charges. The returned web link opens Accounts; use get for an exact result link. Costs 0 credits and never creates or sends a test; active tests may refresh their observations.")
+        .description("Inspect directional inbox-placement tests. Use --view summary for inventory, --status to filter, and pass next_cursor as --cursor until null. count is this page; total and status_counts cover all matches before the cursor. creditsUsed is the original charge; results.refund (summary: refund) records restoration. Plus `pricing`: OXYGEN deliverability monitoring credits per inbox-month, two included tests per inbox per cycle, and the managed extra-test price in force. Covered tests cost no extra credits. The allowance resets each UTC calendar month; unused tests do not roll over. Own-key tests pay the quoted OXYGEN platform fee separately from provider charges. The returned web link opens Accounts; use get for an exact result link. Costs 0 credits and never creates or sends a test; active tests may refresh their observations.")
         .option("--limit <n>", "Max rows (default 50, cap 200).")
+        .option("--status <status>", "Filter: pending_send, sending, awaiting_results, completed, incomplete, failed.")
+        .option("--cursor <cursor>", "Continue from next_cursor with the same status filter.")
+        .option("--view <view>", "full (default) or summary for compact inventory.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("deliverability placement-test list", options, () => {
-            const limit = readOption(options.limit);
-            return requestOxygen(`/api/cli/deliverability/placement-tests${limit ? `?limit=${encodeURIComponent(limit)}` : ""}`);
+            const params = new URLSearchParams();
+            for (const key of ["limit", "status", "cursor", "view"]) {
+                const value = readOption(options[key]);
+                if (value)
+                    params.set(key, value);
+            }
+            return requestOxygen(`/api/cli/deliverability/placement-tests${params.size ? `?${params}` : ""}`);
         });
     }))
         .addCommand(new Command("get")
-        .description("Inspect one saved directional inbox-placement test by id: status, seed counts, per-provider results, and a web result link. Costs 0 credits and never creates or sends a test; active tests may refresh their observations. Zapmail results land async (2-24h); keep polling while status is awaiting_results.")
+        .description("Inspect one saved directional inbox-placement test by id: status, seed counts, per-provider results, and a web result link. creditsUsed is the original charge; results.refund records any restoration. Costs 0 credits and never creates or sends a test; active tests may refresh their observations. Zapmail results land async (2-24h); keep polling while status is awaiting_results.")
         .argument("<id>", "Placement test id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (id, options) => {

package/dist/commands/domains.js

@@ -290,11 +290,13 @@ export function registerDomainsFamily(program, handleAsyncAction) {
     program.addCommand(new Command("domains")
         .description("Cold-email domains: sync zones from your own Cloudflare account (BYOK), inspect age/warmup/DNS health, check availability and pricing, buy domains, and archive or delete domains with their inboxes (OXYGEN-bought domains included). Your own Cloudflare account bills purchases to its payment method; domains registered by OXYGEN cost credits at the vendor price. Preview `domains buy` before approval.")
         .addCommand(new Command("list")
-        .description("List the org's cached Cloudflare domains with cold-email metadata (age, mailboxes, warmup, sending volume, DNS health). Each row's `dns` object explains the status (ok, issues, not checked, check failed, partial check, no zone) with a reason and fix path; `managed_domains` lists InboxKit-managed bundle domains (vendor-registered + vendor-DNS'd — manage via `managed-inboxes`), each carrying `internal_billing_status` (ok|past_due) and `last_billed_cycle_key` — a domain the vendor keeps live can still be one OXYGEN could not renew. summary.by_dns_state gives all DNS-state counts in one read. volume.outbound_30d counts outbound email messages in the synced inbox ledger, including mail outside Sequences. Reads the cache only — run `domains sync` to refresh.")
+        .description("Saved domain health, no external calls. Use --authentication for compact daily SPF/DKIM/DMARC/MX/DNS results across managed, Cloudflare and imported sending domains; --attention returns issues, unverified, stale and failed checks. Daily checks cover non-disabled sending mailboxes, including paused mailboxes; disabled/deleted mailboxes are excluded. Default output includes cached Cloudflare rows, managed domains and standalone registrations, mailbox/warmup rollups, sending volume and DNS health. summary.by_dns_state gives all zone-state counts in one read. Run domains sync to refresh the Cloudflare cache.")
+        .option("--authentication", "Only saved daily authentication summaries and coverage counts; q narrows domains. No provider calls.")
+        .option("--attention", "Only authentication domains needing attention; implies --authentication. No provider calls.")
         .option("--status <status>", "Filter by zone status: unknown, initializing, pending, active, moved, or deleted.")
         .option("--registrar <registrar>", "Filter by registrar name.")
         .option("--q <text>", "Filter by domain substring.")
-        .option("--dns <state>", "Filter by one derived DNS state: ok, issues, not_checked, check_failed, check_incomplete, or no_zone; summary.by_dns_state gives all state counts.")
+        .option("--dns <state>", "Filter cached zone DNS only: ok, issues, not_checked, check_failed, check_incomplete, no_zone. summary.by_dns_state gives all counts; --attention filters daily authentication instead.")
         .option("--expiring", "Only non-deleted domains expiring within 60 days.")
         .option("--has-mailboxes <bool>", "true → only domains with sending mailboxes; false → only domains without.")
         .option("--include-archived", "Include archived domains (hidden by default).")
@@ -303,6 +305,10 @@ export function registerDomainsFamily(program, handleAsyncAction) {
         .action(async (options) => {
         await handleAsyncAction("domains list", options, () => {
             const params = new URLSearchParams();
+            if (options.authentication || options.attention)
+                params.set("authentication", "true");
+            if (options.attention)
+                params.set("attention", "true");
             const status = readOption(options.status);
             if (status)
                 params.set("status", status);
@@ -431,12 +437,14 @@ export function registerDomainsFamily(program, handleAsyncAction) {
         await handleAsyncAction("domains get", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}`));
     }))
         .addCommand(new Command("dns")
-        .description("Run a live read-only DNS health check (SPF, DKIM, DMARC, MX) against the domain's Cloudflare zone and persist the result. Add --deep for content-level checks (SPF DNS-lookup budget, DMARC enforcement, MX provider) plus an external DNS-over-HTTPS nameserver-authority check. An Oxygen-managed domain reads its vendor-held records and verdict instead (--deep ignored). A domain hosted outside Oxygen that you send from returns rail=external: the records public DNS resolves — the mail set, delegation, policy records and web root — with health.enumerable=false, because public DNS cannot list a zone (a DKIM key is probed at common selectors, so dkim=unknown means unproven, never missing). `dns plan`/`dns apply` edit your own Cloudflare zones only. DNS editing is unavailable for Oxygen-bought domains; keep their nameservers and contact support.")
+        .description("Read domain DNS health, 0 credits. --cached reads saved daily authentication evidence without external calls; --authentication checks public SPF/DKIM/DMARC/MX/nameservers and saves the observation. Otherwise check the domain's live records: Cloudflare persists its verdict; managed domains contact their provider; external domains query public DNS. DNS records are never changed by this command. Add --deep for content-level checks (SPF DNS-lookup budget, DMARC enforcement, MX provider) plus an external DNS-over-HTTPS nameserver-authority check. An Oxygen-managed domain reads its vendor-held records and verdict instead (--deep ignored). A domain hosted outside Oxygen that you send from returns rail=external: the records public DNS resolves — the mail set, delegation, policy records and web root — with health.enumerable=false, because public DNS cannot list a zone (a DKIM key is probed at common selectors, so dkim=unknown means unproven, never missing). `dns plan`/`dns apply` edit your own Cloudflare zones only. DNS editing is unavailable for Oxygen-bought domains; keep their nameservers and contact support.")
         .argument("[domain]", "Domain name, such as acme.com.")
         // NOT --provider: commander parses parent options greedily by default,
         // so a --provider here would swallow the `dns plan`/`dns apply`
         // subcommands' required --provider flag.
         .option("--mx-provider <provider>", "With --deep: report whether the live MX matches this mailbox provider (google or microsoft).")
+        .option("--cached", "Read saved authentication evidence and monitoring eligibility; no DNS/provider calls or observation writes.")
+        .option("--authentication", "Save one free public-DNS check. Does not enable daily monitoring or paid services; no DNS changes.")
         .option("--deep", "Add content-level DNS analysis (SPF lookup budget, DMARC enforcement, MX provider) and an external DoH nameserver-authority check.")
         .option("--json", "Print a JSON envelope.")
         .action(async (domain, options) => {
@@ -444,6 +452,10 @@ export function registerDomainsFamily(program, handleAsyncAction) {
             throw new Error("Provide a domain (oxygen domains dns <domain>) or use a subcommand: `dns plan` / `dns apply`.");
         }
         const query = new URLSearchParams();
+        if (options.cached)
+            query.set("cached", "true");
+        if (options.authentication)
+            query.set("authentication", "true");
         if (options.deep)
             query.set("deep", "true");
         if (options.mxProvider)

package/dist/commands/mailboxes.js

@@ -404,9 +404,9 @@ async function readMailboxImportFile(path) {
 }
 export function registerMailboxesFamily(program, handleAsyncAction) {
     program.addCommand(new Command("mailboxes")
-        .description("Connect customer-owned Gmail/Microsoft 365 inboxes with `oxygen mailboxes connect-oauth --vendor composio` for mail history in Unibox and business activity in CRM; read and control progress with `oxygen mailboxes sync`. Also operate the native email sending pool: register/refresh Google/Microsoft mailboxes (including Microsoft SMTP transport and secure local credential-file transfer), pause, disable or delete inboxes, connect EmailGuard monitoring, and inspect/control OXYGEN Warm-up. Fresh managed InboxKit Google/Microsoft/Azure orders activate exact-scope warm-up automatically after provisioning under their approved default-on add-on. Google reuses the managed credential just in time; Microsoft/Azure uses native export. Standalone warm-up plans and credit caps are for BYOK/imported mailboxes, managed opt-outs, or later separate enrollment. OXYGEN Warm-up never owns campaign dispatch. Every inbox here always belongs to a sender profile (the person it sends as) — list, create, and attach those with `oxygen senders profiles`. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
+        .description("Connect customer-owned Gmail/Microsoft 365 inboxes with `oxygen mailboxes connect-oauth --vendor composio` for mail history in Unibox and business activity in CRM; read and control progress with `oxygen mailboxes sync`. Also operate the native email sending pool: register/refresh Google/Microsoft mailboxes (including Microsoft SMTP transport and secure local credential-file transfer), pause, disable or delete inboxes, connect OXYGEN deliverability monitoring, and inspect/control OXYGEN Warm-up. Fresh managed InboxKit Google/Microsoft/Azure orders activate exact-scope warm-up automatically after provisioning under their approved default-on add-on. Google reuses the managed credential just in time; Microsoft/Azure uses native export. Standalone warm-up plans and credit caps are for BYOK/imported mailboxes, managed opt-outs, or later separate enrollment. OXYGEN Warm-up never owns campaign dispatch. Every inbox here always belongs to a sender profile (the person it sends as) — list, create, and attach those with `oxygen senders profiles`. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
         .addCommand(new Command("google-workspace")
-        .description("Authorize a Workspace administrator for Gmail audit/usage, domains, users, groups, verification and Postmaster data. Separate from individual mailbox consent and paid warm-up/EmailGuard enrollment.")
+        .description("Authorize a Workspace administrator for Gmail audit/usage, domains, users, groups, verification and Postmaster data. Separate from individual mailbox consent and paid warm-up/OXYGEN deliverability enrollment.")
         .addCommand(new Command("connect")
         .description("Preview requested Google admin permissions; --approved creates an expiring consent link. Complete authorization in Google as a Workspace administrator.")
         .option("--approved", "Create the administrator consent link after reviewing permissions.")
@@ -500,7 +500,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         writeMailboxPoolOverview(result, { filtered: suffix.length > 0, filterFlags });
     }))
         .addCommand(new Command("get")
-        .description("Get one sending mailbox's configuration/readiness detail (provider, status, daily cap, warmup state, auth mode, and source — managed vs bring-your-own) plus a one-row pool summary. effective_cap comes first: today's campaign limit (effective_daily_cap), the ramp-up mode and its ramp_schedule. This is not sent/replied/bounced performance; use `oxygen sequences analytics` for native Sequence attribution by mailbox/domain. An ineligible native-send transport includes transport_reason + transport_hint; it does not by itself block OXYGEN Warm-up or EmailGuard monitoring. <mailbox> accepts a mailbox id or email address.")
+        .description("Get one sending mailbox's configuration/readiness detail (provider, status, daily cap, warmup state, auth mode, and source — managed vs bring-your-own) plus a one-row pool summary. effective_cap comes first: today's campaign limit (effective_daily_cap), the ramp-up mode and its ramp_schedule. This is not sent/replied/bounced performance; use `oxygen sequences analytics` for native Sequence attribution by mailbox/domain. An ineligible native-send transport includes transport_reason + transport_hint; it does not by itself block OXYGEN Warm-up or OXYGEN deliverability monitoring. <mailbox> accepts a mailbox id or email address.")
         .argument("<mailbox>", "Mailbox id or email address.")
         .option("--json", "Print a JSON envelope.")
         .action(async (mailbox, options) => {
@@ -548,7 +548,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         await handleAsyncAction("mailboxes health", options, () => requestOxygen("/api/cli/mailboxes/health"));
     }))
         .addCommand(new Command("compatibility")
-        .description("Read-only compatibility report per mailbox — select with --mailboxes <address,…> (omit for the whole pool; filter here, not in a script): generic origin class, real infrastructure tier (including InboxKit Azure), OXYGEN native-send connection quality, OXYGEN Warm-up path, EmailGuard monitoring path, and exact next actions. Read automatic_repair for native send and warmup_automatic_repair for an existing warm-up seat: mode=automatic means OXYGEN owns the next bounded retry. Native send distinguishes destination-bound OAuth, provider-managed API transport, admin delegation, and authorization_required. Use --catalog-only for the compact workspace-independent import contract. JSON data.compatibility contains checked rows; data.import_methods and data.import_fields describe accepted transfer inputs; data.provider_matrix is the current public product matrix; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. Downstream states distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
+        .description("Read-only compatibility report per mailbox — select with --mailboxes <address,…> (omit for the whole pool; filter here, not in a script): generic origin class, real infrastructure tier (including InboxKit Azure), OXYGEN native-send connection quality, OXYGEN Warm-up path, OXYGEN deliverability monitoring path, and exact next actions. Read automatic_repair for native send and warmup_automatic_repair for an existing warm-up seat: mode=automatic means OXYGEN owns the next bounded retry. Native send distinguishes destination-bound OAuth, provider-managed API transport, admin delegation, and authorization_required. Use --catalog-only for the compact workspace-independent import contract. JSON data.compatibility contains checked rows; data.import_methods and data.import_fields describe accepted transfer inputs; data.provider_matrix is the current public product matrix; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. Downstream states distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--catalog-only", "Return only the bounded import-method, field, auth-boundary, and public provider catalogs; do not read or return workspace mailbox rows.")
         .option("--json", "Print a JSON envelope.")
@@ -570,7 +570,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         });
     }))
         .addCommand(new Command("import")
-        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer from customer files: fresh managed InboxKit Google orders reuse the vendor-held credential just in time for automatic warmup, while fresh managed Microsoft/Azure orders use native InboxKit Sequencer export; opted-out/separate managed enrollment uses standalone `warmup enable`; eligible non-InboxKit Microsoft warmup uses the Outlook OAuth fallback (`mailboxes warmup microsoft`); EmailGuard remains vendor_blocked for Microsoft. Google app passwords supplied through an authorized credential import are sent only in the request body, encrypted server-side, and never returned. Every imported inbox is attached to a sender profile: --sender <id> names the person, a row's first/last or display name finds or creates them, otherwise OXYGEN creates a profile named from the address for you to correct.")
+        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer from customer files: fresh managed InboxKit Google orders reuse the vendor-held credential just in time for automatic warmup, while fresh managed Microsoft/Azure orders use native InboxKit Sequencer export; opted-out/separate managed enrollment uses standalone `warmup enable`; eligible non-InboxKit Microsoft warmup uses the Outlook OAuth fallback (`mailboxes warmup microsoft`); OXYGEN deliverability remains vendor_blocked for Microsoft. Google app passwords supplied through an authorized credential import are sent only in the request body, encrypted server-side, and never returned. Every imported inbox is attached to a sender profile: --sender <id> names the person, a row's first/last or display name finds or creates them, otherwise OXYGEN creates a profile named from the address for you to correct.")
         .addHelpText("after", [
         "",
         "Ordinary identity file contract (CSV / JSON / JSONL / XLSX):",
@@ -698,7 +698,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         .addCommand(new Command("cap")
         .description("View and adjust a single mailbox's daily send cap (throttle a problem inbox without pausing it). The campaign ramp-up that climbs to it is `mailboxes ramp set`.")
         .addCommand(new Command("set")
-        .description("Set one sending mailbox's daily send cap (sends per day; new mailboxes get 25). --daily-cap must be a positive whole number; `oxygen limits show` reports the maximum in force. The campaign ramp-up (standard 5, 10, then 20/day over the first nine sending days) climbs to this cap; customize or turn it off with `mailboxes ramp set`. Optional provider warm-up is configured with `mailboxes warmup config`. Consumes no Oxygen credits. <mailbox> accepts a mailbox id or email address.")
+        .description("Set one sending mailbox's daily send cap (sends per day; new mailboxes get 25). --daily-cap must be a positive whole number; `oxygen limits show` reports the maximum in force. The campaign ramp-up (standard 5, 10, then 20/day over the first nine sending days) climbs to this cap; customize or turn it off with `mailboxes ramp set`. Entra stays capped at 2 campaign sends/day even with its ramp off. Optional provider warm-up is configured with `mailboxes warmup config`. Consumes no Oxygen credits. <mailbox> accepts a mailbox id or email address.")
         .argument("<mailbox>", "Mailbox id or email address.")
         .requiredOption("--daily-cap <n>", "New daily send cap (a positive whole number of sends per day).")
         .option("--json", "Print a JSON envelope.")
@@ -802,7 +802,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         });
     }))
         .addCommand(new Command("sync")
-        .description("Read or control full Inbox, Sent and archive import for Gmail or Microsoft 365. History sync and CRM analysis are included in the mailbox’s 100-credit monthly connection. Spam, trash and drafts are excluded. Without --action, this is a free progress read; controls preview until --approved. Disconnect keeps mail and CRM records, stops sync/sends and future mailbox commitment renewals, with no current-period refund. Paid seats and add-ons retain their own billing contracts.")
+        .description("Read or control full Inbox, Sent and archive import for Gmail or Microsoft 365. History sync and CRM analysis are included in the monthly mailbox connection (100 credits standard; 25 for Entra). Spam, trash and drafts are excluded. Without --action, this is a free progress read; controls preview until --approved. Disconnect keeps mail and CRM records, stops sync/sends and future mailbox commitment renewals, with no current-period refund. Paid seats and add-ons retain their own billing contracts.")
         .argument("<mailbox>", "Mailbox ID or exact email address.")
         .option("--action <action>", "start, pause, resume or disconnect; omit to read progress.")
         .option("--approved", "Apply the reviewed control; default is preview.")
@@ -814,12 +814,13 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
             : requestOxygen(`/api/cli/mailboxes/sync?${new URLSearchParams({ mailbox }).toString()}`));
     }))
         .addCommand(new Command("connect-oauth")
-        .description("Connect Gmail/Microsoft 365 with --vendor composio to import all mail into Unibox and business activity into CRM. The listed recurring rate is 100 credits per mailbox per month including history, sync and analysis; previews cost 0, with no extra execution fee. Before consent, inspect current monthly connection prices and first-debit timing with billing commitments --view connection-prices --json. Quote a mailbox count with billing estimate --mailboxes <n> --json; the managed preview shows the listed rate; an unavailable managed Gmail connection directs you to OXYGEN support, and an unavailable managed Microsoft connection offers OXYGEN's own sign-in (--vendor oxygen --authorization-mode individual) as an explicit, sending-only choice. Managed OAuth requires provider rollout readiness and exact registered addresses, max 10. Use mailboxes sync for progress and pause/resume/disconnect. Composio uses individual owner consent only. Native --vendor oxygen retains its existing polling; full history/CRM requires managed reconnection. Warm-up retains its existing eligibility and pricing. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. For --vendor oxygen only, Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). For Microsoft's built-in roles, tenant mode requires a Global Administrator or Privileged Role Administrator because it requests the Microsoft Graph application Mail.Send and Mail.Read permissions; Application Administrator and Cloud Application Administrator cannot consent to Microsoft Graph application roles. Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. For non-managed Microsoft mailboxes, native-send approval does not authorize OXYGEN Warm-up: every mailbox still needs its own `mailboxes warmup microsoft` Outlook consent before standalone enrollment. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options.")
+        .description("Connect Gmail/Microsoft 365 with --vendor composio to import all mail into Unibox and business activity into CRM. The recurring rate is 100 credits per standard mailbox-month or 25 for Entra, including history, sync and analysis; previews cost 0, with no extra execution fee. Before consent, inspect current monthly connection prices and first-debit timing with billing commitments --view connection-prices --json. Quote a standard mailbox count with billing estimate --mailboxes <n> --json; the managed preview shows the listed rate; an unavailable managed Gmail connection directs you to OXYGEN support, and an unavailable managed Microsoft connection offers OXYGEN's own sign-in (--vendor oxygen --authorization-mode individual) as an explicit, sending-only choice. Managed OAuth requires provider rollout readiness and exact registered addresses, max 10. Use mailboxes sync for progress and pause/resume/disconnect. Composio uses individual owner consent only. Native --vendor oxygen retains its existing polling; full history/CRM requires managed reconnection. Warm-up retains its existing eligibility and pricing. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. For --vendor oxygen only, Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). For Microsoft's built-in roles, tenant mode requires a Global Administrator or Privileged Role Administrator because it requests the Microsoft Graph application Mail.Send and Mail.Read permissions; Application Administrator and Cloud Application Administrator cannot consent to Microsoft Graph application roles. Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. For non-managed Microsoft mailboxes, native-send approval does not authorize OXYGEN Warm-up: every mailbox still needs its own `mailboxes warmup microsoft` Outlook consent before standalone enrollment. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth; --google-smtp with vendor=oxygen explicitly previews full-mail SMTP OAuth consent. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options.")
         .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--provider <provider>", "Mailbox provider: google or microsoft.")
         .option("--vendor <vendor>", "Authorization path: composio for customer-owned Gmail/Microsoft 365 with managed consent, history and CRM; oxygen for native/tenant consent; zapmail (default) or inboxkit for provisioned inboxes.")
         .option("--mailboxes <list>", "Comma-separated exact mailbox addresses. Required for vendor=composio (max 10) or vendor=oxygen (tenant mode max 500; individual mode max 10).")
         .option("--authorization-mode <mode>", "vendor=oxygen only: auto, tenant, or individual. Tenant is Microsoft-only and never scans the directory.")
+        .option("--google-smtp", "oxygen + google only: request full-mail OAuth access for SMTP XOAUTH2. Preview scopes before approval.")
         .option("--domains <list>", "Comma-separated sending domains to limit an inboxkit run to. Omit to cover every domain in the pool.")
         .option("--no-canary", "inboxkit only: fan out to every eligible mailbox on a domain that has never connected one, instead of firing a single canary first.")
         .option("--connection <id>", "Zapmail connection id. Defaults to the org's active Zapmail connection.")
@@ -855,6 +856,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
                 method: "POST",
                 body: {
                     provider,
+                    ...(options.googleSmtp === true ? { google_smtp: true } : {}),
                     // Every key stays absent unless it was asked for, so a run
                     // without the new flags is the request this command has always
                     // sent — the server reads an absent vendor as zapmail.
@@ -878,17 +880,17 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         .action(async (options) => {
         await handleAsyncAction("mailboxes oauth-health", options, () => requestOxygen("/api/cli/mailboxes/oauth-health"));
     }))
-        .addCommand(new Command("emailguard")
-        .description("Assess every mailbox origin for EmailGuard and connect credential-capable Google Workspace mailboxes from managed, Zapmail, or compatible encrypted external imports. Manual/native Google rows report credential_required; Microsoft 365/Azure reports vendor_blocked. Preview never materializes a password; approved execution fetches it just in time and never prints it.")
+        .addCommand(new Command("deliverability")
+        .description("Assess every mailbox origin for OXYGEN deliverability and connect credential-capable Google Workspace mailboxes from managed, Zapmail, or compatible encrypted external imports. Manual/native Google rows report credential_required; Microsoft 365/Azure reports vendor_blocked. Preview never materializes a password; approved execution fetches it just in time and never prints it.")
         .addCommand(new Command("connect")
-        .description("Preview or connect selected mailboxes to EmailGuard. Managed mode is 100 credits/inbox-month, with two placement tests per inbox per cycle included; an extra managed test costs 66 credits. The preview shows the price in force. Own-key monitoring has no monthly Oxygen fee; placement tests pay the in-force platform fee and vendor charges separately. Google Workspace requires a real app password, fetched only after approval. Microsoft 365/Azure is explicitly vendor-blocked because EmailGuard exposes neither Microsoft OAuth nor tenant consent; Oxygen never downgrades it to password auth. Starts with a 0-credit, no-provider-write preview. Account connection sends no placement probe.")
+        .description("Preview or connect selected mailboxes to OXYGEN deliverability. Managed mode is 100 credits/inbox-month, with two placement tests per inbox per cycle included; an extra managed test costs 66 credits. The preview shows the price in force. Own-key monitoring has no monthly Oxygen fee; placement tests pay the in-force platform fee and vendor charges separately. Google Workspace requires a real app password, fetched only after approval. Microsoft 365/Azure is explicitly vendor-blocked because OXYGEN deliverability exposes neither Microsoft OAuth nor tenant consent; Oxygen never downgrades it to password auth. Starts with a 0-credit, no-provider-write preview. Account connection sends no placement probe.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
-        .option("--approved", "Perform the external EmailGuard account write.")
+        .option("--approved", "Perform the external OXYGEN deliverability account write.")
         .option("--plan <hash>", "Exact hash from the fresh preview (required with --approved).")
         .option("--max-credits <n>", "Hard first-cycle credit cap from the preview (required with --approved, including 0 for BYOK).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("mailboxes emailguard connect", options, () => {
+        await handleAsyncAction("mailboxes deliverability connect", options, () => {
             const mailboxes = readCsvOption(options.mailboxes);
             const planHash = readOption(options.plan);
             const maxCredits = options.approved
@@ -914,13 +916,13 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         });
     }))
         .addCommand(new Command("disconnect")
-        .description("Preview or remove selected mailboxes from EmailGuard and cancel their recurring monitoring subscription. Remote absence is confirmed before billing stops.")
+        .description("Preview or remove selected mailboxes from OXYGEN deliverability and cancel their recurring monitoring subscription. Remote absence is confirmed before billing stops.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
-        .option("--approved", "Perform the external EmailGuard account deletion and cancel billing.")
+        .option("--approved", "Perform the external OXYGEN deliverability account deletion and cancel billing.")
         .option("--plan <hash>", "Exact hash from the fresh preview (required with --approved).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("mailboxes emailguard disconnect", options, () => {
+        await handleAsyncAction("mailboxes deliverability disconnect", options, () => {
             const mailboxes = readCsvOption(options.mailboxes);
             const planHash = readOption(options.plan);
             if (options.approved && !planHash) {
@@ -937,7 +939,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         });
     }))
         .addCommand(new Command("auto-enroll")
-        .description("Standing permission to connect NEW eligible mailboxes to EmailGuard automatically, so monitoring keeps up with the fleet instead of needing a manual connect per inbox. Enrolment is a RECURRING monthly charge per inbox, so arming is approval-gated and always bounded by a per-cycle credit ceiling. Without --arm/--disarm/--run this reports the current state (0 credits).")
+        .description("Standing permission to connect NEW eligible mailboxes to OXYGEN deliverability automatically, so monitoring keeps up with the fleet instead of needing a manual connect per inbox. Enrolment is a RECURRING monthly charge per inbox, so arming is approval-gated and always bounded by a per-cycle credit ceiling. Without --arm/--disarm/--run this reports the current state (0 credits).")
         .option("--arm", "Arm the standing permission. Requires --max-credits; previews unless --approved.")
         .option("--disarm", "Turn it off. Existing subscriptions are untouched. 0 credits, no approval needed.")
         .option("--run", "Enrol one bounded batch now.")
@@ -946,7 +948,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         .option("--approved", "Actually arm (otherwise --arm returns a preview).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("mailboxes emailguard auto-enroll", options, () => {
+        await handleAsyncAction("mailboxes deliverability auto-enroll", options, () => {
             const path = "/api/cli/mailboxes/emailguard/auto-enroll";
             if (options.disarm) {
                 return requestOxygen(path, {
@@ -981,7 +983,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         });
     })))
         .addCommand(new Command("delegation")
-        .description("Google sending-domain delegation only — not Microsoft OAuth and not a credential-file handoff to OXYGEN Warm-up or EmailGuard. Reports covered domains plus the exact client id/scopes; --probe mints a real token per mailbox. Read-only, sends no mail, 0 Oxygen credits.")
+        .description("Google sending-domain delegation only — not Microsoft OAuth and not a credential-file handoff to OXYGEN Warm-up or OXYGEN deliverability. Reports covered domains plus the exact client id/scopes; --probe mints a real token per mailbox. Read-only, sends no mail, 0 Oxygen credits.")
         .option("--domain <domain>", "Only report this sending domain.")
         .option("--probe", "Verify each delegated domain by minting a real delegated token per mailbox. Makes one Google token call per mailbox; still 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
@@ -998,7 +1000,7 @@ export function registerMailboxesFamily(program, handleAsyncAction) {
         });
     }))
         .addCommand(new Command("warmup")
-        .description("OXYGEN Warm-up for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. It costs 100 credits per warming inbox per month ($1), or nothing once it is included in your own mailbox's 100-credit monthly connection (2026-09 repricing); the preview shows which applies. Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warm-up add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Google reuses the InboxKit-held credential only during activation and never stores or returns it; Microsoft/Azure uses exact native export. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off for Microsoft/Azure because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warm-up blocks either handoff so one mailbox cannot warm twice. OXYGEN Warm-up never owns campaign dispatch: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down there with `warmup disable`; they are never silently moved to the current managed rail. On existing active paid seats, Google credential repair uses its own enabled-by-default switch. When the separate worker recovery mode is enforce (the unset default), Microsoft OAuth or tenant-consent seats get a credential-free vendor reactivation, and stalled dispatch or DNS readiness is rechecked. Shadow reports candidates in those enabled lanes without their vendor writes; off skips those lanes. Google credential repair can still run in shadow/off. Correct bad DNS records yourself; an active unpaused paid seat in enforce mode needs no manual resume after that correction. OXYGEN never invents consent, resumes a human or safety pause, starts a new paid enrollment, or blindly repeats an ambiguous provider write. Check `warmup status` and `mailboxes list` for the exact next action.")
+        .description("OXYGEN Warm-up for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. It costs 100 credits per warming inbox per month ($1), or nothing once it is included in the mailbox connection (100 credits standard; 25 for Entra, with warm-up included); the preview shows which applies. Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warm-up add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Google reuses the InboxKit-held credential only during activation and never stores or returns it; Microsoft/Azure uses exact native export. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off for Microsoft/Azure because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warm-up blocks either handoff so one mailbox cannot warm twice. OXYGEN Warm-up never owns campaign dispatch: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down there with `warmup disable`; they are never silently moved to the current managed rail. On existing active paid seats, Google credential repair uses its own enabled-by-default switch. When the separate worker recovery mode is enforce (the unset default), Microsoft OAuth or tenant-consent seats get a credential-free vendor reactivation, and stalled dispatch or DNS readiness is rechecked. Shadow reports candidates in those enabled lanes without their vendor writes; off skips those lanes. Google credential repair can still run in shadow/off. Correct bad DNS records yourself; an active unpaused paid seat in enforce mode needs no manual resume after that correction. OXYGEN never invents consent, resumes a human or safety pause, starts a new paid enrollment, or blindly repeats an ambiguous provider write. Check `warmup status` and `mailboxes list` for the exact next action.")
         .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .addCommand(new Command("enable")
         .description("Optional provider warm-up defaults to 1/day, +1/day, max 10/day (dedicated-tenant profiles stay stricter); see `mailboxes warmup config` for the effective plan and unsupported OXYGEN Warm-up reply-rate control. This is separate from the 5/10/20 campaign ramp. STANDALONE ENROLLMENT: enroll BYOK/imported mailboxes, a managed order that opted out, or mailboxes being added to warmup later. Fresh managed InboxKit Google/Microsoft/Azure orders whose approved quote included warmup activate automatically after provisioning and do not need this command. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is handed off, enrolled, or billed. The price is 100 credits per warming mailbox-month, or 0 once warm-up is included in the mailbox's 100-credit monthly connection (2026-09 repricing; the preview's included_in_connection says which, and its max_credits is then 0); the preview returns the exact first-cycle ceiling. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Gmail connected through Composio uses that connection after approval of standard mailbox access (send, read and organize), without a second Google consent. The preview names this access and disabling warm-up revokes it. Existing vendor-consent seats are preserved. Eligible InboxKit-managed Google targets use the InboxKit-held credential just in time without storing or returning it; Microsoft/Azure targets use native InboxKit Sequencer export with exact UIDs and auto-export off. Any non-cancelled InboxKit warmup must be cancelled before either handoff (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. OXYGEN Warm-up retains no campaign authority — OXYGEN Sequences own enrollment and dispatch. New enrollments only ever land on the managed OXYGEN rail; the retired TrulyInbox rail is refused here and only accepts teardown.")

package/dist/commands/managed-inboxes.js

@@ -138,7 +138,7 @@ export function registerManagedInboxesFamily(program, handleAsyncAction) {
         await handleAsyncAction("managed-inboxes registrant", options, () => requestOxygen("/api/cli/managed-inboxes/registrant"));
     }))
         .addCommand(new Command("subscribe")
-        .description("Buy managed monthly inboxes on a new domain or your existing Cloudflare domain. Use --existing-domain for Cloudflare: the read-only preview shows ownership, occupancy, DNS scope and blockers, with zero registration charge. --max-per-domain saves a stricter limit with the approved order, including existing addresses; later additions honor it. Preview does not save the limit or change workspace data. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. OXYGEN Warm-up defaults on for Google, Microsoft, and Azure when available: preview and approved responses carry `warmup_activation` with the exact `mailboxes` and `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, Google carries `transport=inboxkit_managed_google_handoff`; Microsoft/Azure carries `transport=inboxkit_sequencer_export`. Both carry `mailbox_credentials_required=false` and `native_send_oauth_separate=true`, so managed warm-up needs no customer-supplied OAuth or mailbox password. Google retrieves the existing managed credential only during activation and never persists or returns it; Microsoft/Azure uses native export. Native sending authorization is separate and may still be required before OXYGEN can send. Verify each exact address with `mailboxes oauth-health --json`; InboxKit's unattended Google domain approval usually lands within minutes and the worker keeps retrying, so a waiting row is not a reason to ask the customer to sign in. This order authorizes automatic OXYGEN Warm-up activation after provisioning, so no second `mailboxes warmup enable` approval is needed. The preview shows the price in force: from the 2026-09 repricing date a Google Workspace or Microsoft 365 inbox is one flat mailbox line plus the 100-credit mailbox connection, warm-up included, which `connection_monthly_credits` shows and your balance reserves once the inbox connects (400 credits a month all-in at the committed price), and an Azure tenant is one flat charge for its domain (4,000 a month) plus each inbox's connection; `managed-inboxes list --json` reports the prices in force under `prices`. Domains are priced from the vendor's LIVE domain price, and any price below vendor cost is refused. A domain you bought on its own through Oxygen (`domains buy`) takes its first inboxes here too: the preview says `domain_source: owned`, nothing is registered again and `one_off_credits` is 0 (Google or Microsoft; omit --years). To add mailboxes to a domain that already has inboxes use `managed-inboxes add-inboxes`.")
+        .description("Buy managed monthly inboxes on a new domain or your existing Cloudflare domain. Use --existing-domain for Cloudflare: the read-only preview shows ownership, occupancy, DNS scope and blockers, with zero registration charge. --max-per-domain saves a stricter limit with the approved order, including existing addresses; later additions honor it. Preview does not save the limit or change workspace data. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. OXYGEN Warm-up defaults on for Google, Microsoft, and Azure when available: preview and approved responses carry `warmup_activation` with the exact `mailboxes` and `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, Google carries `transport=inboxkit_managed_google_handoff`; Microsoft/Azure carries `transport=inboxkit_sequencer_export`. Both carry `mailbox_credentials_required=false` and `native_send_oauth_separate=true`, so managed warm-up needs no customer-supplied OAuth or mailbox password. Google retrieves the existing managed credential only during activation and never persists or returns it; Microsoft/Azure uses native export. Native sending authorization is separate and may still be required before OXYGEN can send. Verify each exact address with `mailboxes oauth-health --json`; InboxKit's unattended Google domain approval usually lands within minutes and the worker keeps retrying, so a waiting row is not a reason to ask the customer to sign in. This order authorizes automatic OXYGEN Warm-up activation after provisioning, so no second `mailboxes warmup enable` approval is needed. The preview shows the price in force: from the 2026-09 repricing date a Google Workspace or Microsoft 365 inbox is one flat mailbox line plus the 100-credit mailbox connection, warm-up included, which `connection_monthly_credits` shows and your balance reserves once the inbox connects (400 credits a month all-in at the committed price), and an Azure/Entra tenant is one flat hosting charge for its domain (4,000 credits/$40 a month) plus each inbox's 25-credit ($0.25) Sequencer connection with warm-up included: 6,500 credits/$65 monthly for 100 inboxes; `managed-inboxes list --json` reports the prices in force under `prices`. Domains are priced from the vendor's LIVE domain price, and any price below vendor cost is refused. A domain you bought on its own through Oxygen (`domains buy`) takes its first inboxes here too: the preview says `domain_source: owned`, nothing is registered again and `one_off_credits` is 0 (Google, Microsoft or Azure; omit --years). To add mailboxes to a domain that already has inboxes use `managed-inboxes add-inboxes`.")
         .argument("[domain]", "Sending domain to register + host the mailboxes (e.g. send.acme.com), or one you already bought through Oxygen. May also be passed as --domain.")
         .option("--domain <domain>", "Sending domain (alternative to the positional argument).")
         .requiredOption("--provider <provider>", "Mailbox PLATFORM: google, microsoft, or azure. (google/microsoft cap at 5 mailboxes per domain; azure allows 100.)")