@oxygen-agent/cli 1.177.1 → 1.184.3

package/dist/index.js

@@ -9,7 +9,7 @@ import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, Option } from "commander";
-import { formatCellForDisplay, OXYGEN_VERSION, OxygenError, success, toFailure } from "@oxygen/shared";
+import { formatCellForDisplay, formatPublicBudgetScopes, OXYGEN_VERSION, OxygenError, success, toFailure, } from "@oxygen/shared";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, } from "@oxygen/shared/file-import";
 import { assertRecipeBundleSafe, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowManifest, } from "@oxygen/workflows";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
@@ -382,6 +382,15 @@ function buildCrmAssertBody(object, options) {
         mode: resolveCrmSetupMode(options),
     };
 }
+function buildCrmSearchBody(query, options) {
+    const objects = readCsvOption(options.objects);
+    const limit = readPositiveInt(options.limit);
+    return {
+        query,
+        ...(objects.length > 0 ? { objects } : {}),
+        ...(limit !== undefined ? { limit } : {}),
+    };
+}
 function buildCrmRelationshipUpsertBody(object, rowId, options) {
     return {
         object,
@@ -1025,6 +1034,18 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("crm objects", options, () => requestOxygen("/api/cli/crm/objects"));
+    }))
+        .addCommand(new Command("search")
+        .description("Search CRM records by identity or record label.")
+        .argument("<query>", "Domain, email, LinkedIn URL, or record name to search for.")
+        .option("--objects <objects>", "Comma-separated CRM object slugs to search. Defaults to all configured objects.")
+        .option("--limit <limit>", "Maximum records to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (query, options) => {
+        await handleAsyncAction("crm search", options, () => requestOxygen("/api/cli/crm/records/search", {
+            method: "POST",
+            body: buildCrmSearchBody(query, options),
+        }));
     }))
         .addCommand(new Command("assert")
         .description("Create or update one CRM record by object identity. Defaults to dry-run.")
@@ -2017,6 +2038,7 @@ export function createProgram() {
         .option("--force", "Run even when the target cell already has a value.")
         .option("--connection-id <connection_id>", "Optional provider integration connection id.")
         .option("--background", "Create a durable background table action run instead of executing synchronously.")
+        .option("--approved", "Confirm the paid background run after inspecting a dry run or preview.")
         .option("--max-credits <n>", "Maximum managed/provider credits to reserve for a background run.")
         .option("--max-concurrency <n>", "Maximum concurrent row items for a background run. Defaults to 250 for AI columns and 50 otherwise.")
         .option("--local", "Run a custom HTTP column in this CLI process so env-var secrets stay local.")
@@ -2075,6 +2097,7 @@ export function createProgram() {
                 ...(options.force ? { force: true } : {}),
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
                 ...(options.background ? { background: true } : {}),
+                ...(options.approved ? { approved: true } : {}),
                 ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
                 ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
                 ...(options.dryRun ? { dry_run: true } : {}),
@@ -2262,6 +2285,7 @@ export function createProgram() {
         .option("--filter-json <json>", "Filter object or array for server-side row selection.")
         .option("--force", "Run even when the target cell already has a value.")
         .option("--connection-id <connection_id>", "Optional provider integration connection id.")
+        .option("--approved", "Confirm the paid table action run after inspecting a dry run or preview.")
         .option("--max-credits <n>", "Maximum managed/provider credits to reserve for this run.")
         .option("--max-concurrency <n>", "Maximum concurrent row items for this run.")
         .option("--metadata-json <json>", "Optional metadata object to attach to the run.")
@@ -2279,6 +2303,7 @@ export function createProgram() {
                 selection: readTableRunSelection(options),
                 ...(options.force ? { force: true } : {}),
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+                ...(options.approved ? { approved: true } : {}),
                 ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
                 ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
                 ...(options.metadataJson ? { metadata: parseJsonObject(options.metadataJson) } : {}),
@@ -2975,7 +3000,7 @@ export function createProgram() {
         .description("Standing credit caps (org/table daily/monthly hard-blocks) beyond per-run max_credits.")
         .addCommand(new Command("list")
         .description("List the organization's standing budget policies.")
-        .option("--scope <scope>", "Filter by scope: org, table, api_key, workflow_trigger, monitor.")
+        .option("--scope <scope>", `Filter by scope: ${formatPublicBudgetScopes()}.`)
         .option("--status <status>", "Filter by status. Defaults to all.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -2991,7 +3016,7 @@ export function createProgram() {
     }))
         .addCommand(new Command("set")
         .description("Set, raise, or lower a standing credit cap (idempotent per scope+window).")
-        .requiredOption("--scope <scope>", "org, table, api_key, workflow_trigger, or monitor.")
+        .requiredOption("--scope <scope>", formatPublicBudgetScopes())
         .requiredOption("--window <window>", "per_run, daily, or monthly.")
         .requiredOption("--max-credits <credits>", "Cap in Oxygen credits.")
         .option("--scope-id <id>", "Table id/slug for --scope table (or other scope id). Omit for a scope-wide cap.")
@@ -3732,6 +3757,8 @@ export function createProgram() {
         .option("--live", "Execute the action live. Default is dry-run.")
         .option("--dry-run", "Force dry-run (no provider call).")
         .option("--mode <mode>", "'live' or 'dry_run'. Overridden by --live/--dry-run if provided.")
+        .option("--approved", "Required for live actions after inspecting dry-run output.")
+        .option("--max-credits <n>", "Required positive credit cap for live actions.")
         .option("--json", "Print a JSON envelope.")
         .action(async (integrationId, actionSlug, options) => {
         await handleAsyncAction("integrations run", options, () => {
@@ -3739,6 +3766,7 @@ export function createProgram() {
                 ? parseJsonObject(readOption(options.input))
                 : {};
             const mode = resolveComposioRunMode(options);
+            const maxCredits = readPositiveNumber(options.maxCredits);
             return requestOxygen("/api/cli/integrations/composio/run", {
                 method: "POST",
                 body: {
@@ -3746,6 +3774,8 @@ export function createProgram() {
                     action_slug: actionSlug,
                     arguments: args,
                     mode,
+                    ...(options.approved ? { approved: true } : {}),
+                    ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
                 },
             });
         });
@@ -3857,10 +3887,18 @@ export function createProgram() {
     program.addCommand(new Command("inbox")
         .description("Unified inbox (unibox): LinkedIn conversations and (--channel email) the fleet's email conversations synced from Zapmail Zapbox. Scan, read threads, and reply.")
         .addCommand(new Command("list")
-        .description("List conversations across all connected accounts, newest first. --channel email lists the Zapbox-synced email inbox.")
+        .description("List conversations across all connected accounts, newest first. --channel email lists the Zapbox-synced email inbox; filter it by status, campaign, mailbox provider/domain, and Primary/Others bucket.")
         .option("--channel <channel>", "Inbox channel: linkedin (default) or email.")
         .option("--account <id>", "LinkedIn only: filter to one sender account (sender id, connection id, or Unipile account id).")
         .option("--unread", "Only show conversations with unread messages.")
+        .option("--responses-only", "Email only: only conversations with an inbound reply (never sent-only threads).")
+        .option("--bucket <bucket>", "Email only: primary or others.")
+        .option("--status <keys>", "Email only: comma-separated status keys (e.g. interested,meeting_booked).")
+        .option("--sequence-id <ids>", "Email only: comma-separated campaign (sequence) ids.")
+        .option("--provider <providers>", "Email only: comma-separated providers (google,microsoft).")
+        .option("--domain <domains>", "Email only: comma-separated counterpart domains to include.")
+        .option("--exclude-domain <domains>", "Email only: comma-separated counterpart domains to exclude.")
+        .option("--mailbox-id <ids>", "Email only: comma-separated mailbox ids.")
         .option("--search <text>", "Filter by attendee name or last-message text.")
         .option("--include-archived", "Include archived conversations.")
         .option("--limit <n>", "Maximum conversations to return (1-200). Defaults to 50.")
@@ -3876,6 +3914,21 @@ export function createProgram() {
                 params.set("account", account);
             if (options.unread)
                 params.set("unread", "true");
+            if (options.responsesOnly)
+                params.set("responses_only", "true");
+            for (const [flag, key] of [
+                ["bucket", "bucket"],
+                ["status", "status"],
+                ["sequenceId", "sequence_id"],
+                ["provider", "provider"],
+                ["domain", "domain"],
+                ["excludeDomain", "exclude_domain"],
+                ["mailboxId", "mailbox_id"],
+            ]) {
+                const value = readOption(options[flag]);
+                if (value)
+                    params.set(key, value);
+            }
             const search = readOption(options.search);
             if (search)
                 params.set("search", search);
@@ -3913,16 +3966,19 @@ export function createProgram() {
         .requiredOption("--text <message>", "Reply text to send.")
         .option("--channel <channel>", "Inbox channel: linkedin (default) or email.")
         .option("--approved", "Approve and send the message. Without this flag, returns a preview only.")
+        .option("--draft-id <id>", "Email only: when approving an AI reply-agent draft, its id (marks it sent on success).")
         .option("--json", "Print a JSON envelope.")
         .action(async (conversation, options) => {
         await handleAsyncAction("inbox send", options, () => {
             const channel = readOption(options.channel);
+            const draftId = readOption(options.draftId);
             return requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}/send`, {
                 method: "POST",
                 body: {
                     text: readOption(options.text),
                     ...(channel ? { channel } : {}),
                     ...(options.approved ? { approved: true } : {}),
+                    ...(draftId ? { draft_id: draftId } : {}),
                 },
             });
         });
@@ -3977,7 +4033,167 @@ export function createProgram() {
                 body.message_limit = Number(messageLimit);
             return requestOxygen("/api/cli/inbox/sync", { method: "POST", body });
         });
-    })));
+    }))
+        .addCommand(new Command("status")
+        .description("Set an email conversation's status (the Instantly-style tier). A manual override that locks out AI re-classification.")
+        .argument("<conversation>", "Conversation id or Zapbox thread id.")
+        .argument("<status>", "A status label key (e.g. interested, meeting_booked, won, not_interested).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (conversation, status, options) => {
+        await handleAsyncAction("inbox status", options, () => requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}/status`, {
+            method: "POST",
+            body: { status },
+        }));
+    }))
+        .addCommand(new Command("labels")
+        .description("Manage inbox status labels (the Instantly-style system set + custom labels).")
+        .addCommand(new Command("list")
+        .description("List status labels.")
+        .option("--include-archived", "Include archived custom labels.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox labels list", options, () => requestOxygen(`/api/cli/inbox/labels${options.includeArchived ? "?include_archived=true" : ""}`));
+    }))
+        .addCommand(new Command("create")
+        .description("Create a custom status label.")
+        .argument("<name>", "Display name.")
+        .option("--color <hex>", "Hex color (e.g. #22c55e).")
+        .option("--bucket <bucket>", "primary (default) or others.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (name, options) => {
+        await handleAsyncAction("inbox label create", options, () => {
+            const color = readOption(options.color);
+            const bucket = readOption(options.bucket);
+            return requestOxygen("/api/cli/inbox/labels", {
+                method: "POST",
+                body: { name, ...(color ? { color } : {}), ...(bucket ? { bucket } : {}) },
+            });
+        });
+    }))
+        .addCommand(new Command("update")
+        .description("Update a status label's name, color, or bucket.")
+        .argument("<key>", "The label key.")
+        .option("--name <name>", "New display name.")
+        .option("--color <hex>", "New hex color.")
+        .option("--bucket <bucket>", "New bucket (primary or others).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (key, options) => {
+        await handleAsyncAction("inbox label update", options, () => {
+            const name = readOption(options.name);
+            const color = readOption(options.color);
+            const bucket = readOption(options.bucket);
+            return requestOxygen(`/api/cli/inbox/labels/${encodeURIComponent(key)}`, {
+                method: "PATCH",
+                body: { ...(name ? { name } : {}), ...(color ? { color } : {}), ...(bucket ? { bucket } : {}) },
+            });
+        });
+    }))
+        .addCommand(new Command("delete")
+        .description("Archive a custom status label (system labels and in-use labels are rejected).")
+        .argument("<key>", "The custom label key.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (key, options) => {
+        await handleAsyncAction("inbox label archive", options, () => requestOxygen(`/api/cli/inbox/labels/${encodeURIComponent(key)}`, { method: "DELETE" }));
+    })))
+        .addCommand(new Command("drafts")
+        .description("The AI reply-agent draft queue (the approve-before-send review queue).")
+        .addCommand(new Command("list")
+        .description("List drafts awaiting review (queued + edited by default).")
+        .option("--status <keys>", "Comma-separated draft statuses (queued,edited,sent,rejected).")
+        .option("--sequence-id <id>", "Filter to one campaign (sequence) id.")
+        .option("--limit <n>", "Maximum drafts to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox drafts list", options, () => {
+            const params = new URLSearchParams();
+            const status = readOption(options.status);
+            if (status)
+                params.set("status", status);
+            const sequenceId = readOption(options.sequenceId);
+            if (sequenceId)
+                params.set("sequence_id", sequenceId);
+            const limit = readOption(options.limit);
+            if (limit)
+                params.set("limit", limit);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/inbox/drafts${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("edit")
+        .description("Edit an open draft's body before approval. Does not send.")
+        .argument("<draft>", "The draft id.")
+        .requiredOption("--text <message>", "The new draft body.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (draft, options) => {
+        await handleAsyncAction("inbox draft update", options, () => requestOxygen(`/api/cli/inbox/drafts/${encodeURIComponent(draft)}`, {
+            method: "PATCH",
+            body: { text: readOption(options.text) },
+        }));
+    }))
+        .addCommand(new Command("reject")
+        .description("Reject an open draft so it leaves the queue. Does not send.")
+        .argument("<draft>", "The draft id.")
+        .option("--reason <text>", "Optional reason.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (draft, options) => {
+        await handleAsyncAction("inbox draft reject", options, () => {
+            const reason = readOption(options.reason);
+            return requestOxygen(`/api/cli/inbox/drafts/${encodeURIComponent(draft)}/reject`, {
+                method: "POST",
+                body: reason ? { reason } : {},
+            });
+        });
+    })))
+        .addCommand(new Command("reply-agent")
+        .description("The draft-only AI reply agent (the 'AI Sales Agent'): auto-classifies + auto-drafts replies into the review queue. It NEVER auto-sends.")
+        .addCommand(new Command("get")
+        .description("Show the reply-agent config.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox reply-agent get", options, () => requestOxygen("/api/cli/inbox/reply-agent"));
+    }))
+        .addCommand(new Command("set")
+        .description("Configure the reply agent (enable, persona/tone, targets). It drafts into the queue; a human approves+sends.")
+        .option("--enabled", "Enable the agent.")
+        .option("--disabled", "Disable the agent.")
+        .option("--persona <text>", "Who the agent is.")
+        .option("--tone <text>", "Reply tone.")
+        .option("--instructions <text>", "Extra drafting instructions.")
+        .option("--signature <text>", "Signature appended to drafts.")
+        .option("--target-statuses <keys>", "Comma-separated statuses to draft for (empty = all draftable).")
+        .option("--target-sequence-ids <ids>", "Comma-separated campaign ids to draft for (empty = all).")
+        .option("--max-drafts-per-day <n>", "Per-day draft cap.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox reply-agent set", options, () => {
+            const body = {};
+            if (options.enabled)
+                body.enabled = true;
+            if (options.disabled)
+                body.enabled = false;
+            // Presence (flag passed) — not readOption — decides inclusion, so an
+            // absent flag leaves the field untouched rather than clearing it.
+            const opts = options;
+            for (const [flag, key] of [
+                ["persona", "persona"],
+                ["tone", "tone"],
+                ["instructions", "instructions"],
+                ["signature", "signature"],
+            ]) {
+                if (opts[flag] !== undefined)
+                    body[key] = opts[flag];
+            }
+            if (options.targetStatuses !== undefined) {
+                body.target_statuses = options.targetStatuses.split(",").map((s) => s.trim()).filter(Boolean);
+            }
+            if (options.targetSequenceIds !== undefined) {
+                body.target_sequence_ids = options.targetSequenceIds.split(",").map((s) => s.trim()).filter(Boolean);
+            }
+            if (options.maxDraftsPerDay !== undefined)
+                body.max_drafts_per_day = Number(options.maxDraftsPerDay);
+            return requestOxygen("/api/cli/inbox/reply-agent", { method: "POST", body });
+        });
+    }))));
     program.addCommand(new Command("sequences")
         .description("Multichannel outreach sequences: one enrollment per lead spans LinkedIn + email over a journey. LinkedIn steps dispatch natively (rate-limited, credit-capped); email steps send natively or place/move/stop the lead in a bound Instantly campaign (BYOK). Cross-channel reply-stop is intrinsic. A LinkedIn-only sequence behaves exactly like the original sequencer.")
         .addCommand(new Command("list")
@@ -4033,6 +4249,9 @@ export function createProgram() {
         .option("--email-connection <id>", "Instantly connection id for the email track. Defaults to the org's active Instantly connection.")
         .option("--email-definition-file <path>", "Path to a JSON file with the email content spec (subjects/bodies/delays/subsequences) compiled to an Instantly campaign on start.")
         .option("--max-credits <n>", "Credit cap for the LinkedIn track (also set when starting).")
+        .option("--max-live-sends <n>", "Send ceiling for the email track (positive integer). Required to start an email sequence live.")
+        .option("--max-emails-per-mailbox-per-day <n>", "Per-mailbox daily email cap (positive integer) applied across the sending pool.")
+        .option("--send-window-file <path>", "Path to a JSON file with the sequence-level email send window: { timezone, days?, start, end, timezone_mode?, recipient_timezone_column? }.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("sequences create", options, () => {
@@ -4044,6 +4263,8 @@ export function createProgram() {
             const senders = readCsvOption(options.senders);
             const email = readCampaignEmailBinding(options);
             const maxCredits = readPositiveNumber(options.maxCredits);
+            const maxLiveSends = readPositiveInteger(options.maxLiveSends);
+            const settings = readSequenceSettings(options);
             return requestOxygen("/api/cli/sequences", {
                 method: "POST",
                 body: {
@@ -4056,6 +4277,8 @@ export function createProgram() {
                     ...(readOption(options.urlColumn) ? { linkedin_url_column_key: readOption(options.urlColumn) } : {}),
                     ...(email ? { email } : {}),
                     ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                    ...(maxLiveSends !== undefined ? { max_live_sends: maxLiveSends } : {}),
+                    ...(settings ? { settings } : {}),
                 },
             });
         });
@@ -4072,6 +4295,9 @@ export function createProgram() {
         .option("--email-definition-file <path>", "Path to a JSON file with the email content spec (subjects/bodies/delays/subsequences).")
         .option("--clear-email", "Remove the email binding from the sequence (draft only).")
         .option("--max-credits <n>", "Credit cap for the LinkedIn track (draft only).")
+        .option("--max-live-sends <n>", "Send ceiling for the email track (positive integer). Required to start an email sequence live.")
+        .option("--max-emails-per-mailbox-per-day <n>", "Per-mailbox daily email cap (positive integer) applied across the sending pool.")
+        .option("--send-window-file <path>", "Path to a JSON file with the sequence-level email send window: { timezone, days?, start, end, timezone_mode?, recipient_timezone_column? }.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences update", options, () => {
@@ -4092,6 +4318,12 @@ export function createProgram() {
             const maxCredits = readPositiveNumber(options.maxCredits);
             if (maxCredits !== undefined)
                 body.max_credits = maxCredits;
+            const maxLiveSends = readPositiveInteger(options.maxLiveSends);
+            if (maxLiveSends !== undefined)
+                body.max_live_sends = maxLiveSends;
+            const settings = readSequenceSettings(options);
+            if (settings)
+                body.settings = settings;
             if (options.clearEmail) {
                 body.email = null;
             }
@@ -4101,7 +4333,7 @@ export function createProgram() {
                     body.email = email;
             }
             if (Object.keys(body).length === 0) {
-                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --email-*, --clear-email, or --max-credits).");
+                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, or --send-window-file).");
             }
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`, {
                 method: "PATCH",
@@ -4138,20 +4370,33 @@ export function createProgram() {
         .argument("<sequence>", "Sequence id or slug.")
         .option("--approved", "Approve and activate live. Without this flag, returns a preview only.")
         .option("--max-credits <n>", "Credit cap (required with --approved).")
+        .option("--max-live-sends <n>", "Email send ceiling (positive integer). Required to start a sequence with email steps live.")
         .option("--dry-run", "Activate in dry-run mode: advance every step with simulated sends, no LinkedIn actions, no credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences start", options, () => {
             const maxCredits = readPositiveNumber(options.maxCredits);
+            const maxLiveSends = readPositiveInteger(options.maxLiveSends);
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/start`, {
                 method: "POST",
                 body: {
                     ...(options.dryRun ? { dry_run: true } : {}),
                     ...(options.approved ? { approved: true } : {}),
                     ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                    ...(maxLiveSends !== undefined ? { max_live_sends: maxLiveSends } : {}),
                 },
             });
         });
+    }))
+        .addCommand(new Command("signal")
+        .description("Record an external GTM signal (e.g. linkedin_connected, email_replied, company_raised_funds, job_change, web_visit, intent) onto a running sequence's enrollment(s) to drive signal-triggered branch/wait control. Target an enrollment by --enrollment or --lead (at least one is required); the server validates the signal name.")
+        .argument("<sequence>", "Sequence id or slug.")
+        .requiredOption("--signal <name>", "Signal to record: linkedin_connected, linkedin_replied, email_sent, email_opened, email_clicked, email_replied, email_bounced, company_hiring, company_raised_funds, job_change, new_hire, web_visit, intent.")
+        .option("--enrollment <id>", "Target enrollment id.")
+        .option("--lead <provider_id>", "Target enrollment by its lead provider id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleSequenceSignalAction(sequence, options);
     }))
         .addCommand(new Command("pause")
         .description("Pause an active sequence (stops new dispatches; enrollments resume on un-pause).")
@@ -4205,6 +4450,13 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences stats", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/stats`));
+    }))
+        .addCommand(new Command("variants")
+        .description("Break the sequence's email performance down by A/B variant (per step) and by sending mailbox: sent, replied, reply rate, bounced/failed, and credits used.")
+        .argument("<sequence>", "Sequence id or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleSequenceVariantsAction(sequence, options);
     })));
     program.addCommand(new Command("email")
         .description("Ad-hoc email from the org's sending fleet: one-off sends with no sequence, enrollment, or contact sync. Zapbox-connected mailboxes send through Zapmail's API (no Google/Microsoft consent); BYOK — 0 Oxygen credits.")
@@ -4459,6 +4711,16 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (domains, options) => {
         await handleAsyncAction("domains buy", options, () => runDomainsBuy(domains, options));
+    }))
+        .addCommand(new Command("adopt")
+        .description("STAFF: Import domains that already exist in the shared Oxygen-managed Cloudflare account into a workspace, then mirror them into the domain cache. FREE — no Oxygen credits and no Cloudflare purchase (the domains are already registered); this differs from `domains buy`. Idempotent. Without --yes, prints a preview of what would be adopted/skipped.")
+        .argument("[domains...]", "Specific domains to adopt. Omit and pass --all to adopt every zone in the managed account.")
+        .option("--all", "Adopt every zone discovered in the managed Cloudflare account.")
+        .option("--organization-id <id>", "STAFF override: adopt into this workspace instead of the calling org.")
+        .option("--yes", "Execute the adoption. Without this flag, prints a preview only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domains, options) => {
+        await handleAsyncAction("domains adopt", options, () => runDomainsAdopt(domains, options));
     }))
         .addCommand(new Command("registrations")
         .description("List the org's domain purchase ledger: every registration attempt with status and price snapshot.")
@@ -4765,6 +5027,44 @@ export function createProgram() {
             method: "POST",
             body: { run_id: runId },
         }));
+    }))
+        .addCommand(new Command("approvals")
+        .description("List workflow runs awaiting a human approval decision (the mid-run approval inbox).")
+        .option("--status <status>", "Filter: pending (default), approved, rejected, expired, or all.")
+        .option("--run-id <run_id>", "Only approvals for this workflow run.")
+        .option("--limit <n>", "Maximum approvals to return. Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workflows approvals", options, () => {
+            const query = new URLSearchParams();
+            if (readOption(options.status))
+                query.set("status", readOption(options.status) ?? "");
+            if (readOption(options.runId))
+                query.set("run_id", readOption(options.runId) ?? "");
+            const limit = readPositiveInt(options.limit);
+            if (limit)
+                query.set("limit", String(limit));
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/workflows/approvals${suffix}`);
+        });
+    }))
+        .addCommand(new Command("resume")
+        .description("Approve or reject a paused mid-run workflow approval, resuming the run.")
+        .argument("<run_id>", "Workflow run UUID.")
+        .requiredOption("--decision <decision>", "approve or reject.")
+        .option("--step-id <step_id>", "Approval step id, when a run has more than one pending gate.")
+        .option("--plan-hash <plan_hash>", "Reviewed plan hash; the decision is refused if the plan changed since review.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("workflows resume", options, () => requestOxygen("/api/cli/workflows/resume", {
+            method: "POST",
+            body: {
+                run_id: runId,
+                decision: readOption(options.decision),
+                ...(readOption(options.stepId) ? { step_id: readOption(options.stepId) } : {}),
+                ...(readOption(options.planHash) ? { plan_hash: readOption(options.planHash) } : {}),
+            },
+        }));
     }))
         .addCommand(new Command("enable")
         .description("Enable a workflow automation and its current trigger.")
@@ -4817,7 +5117,46 @@ export function createProgram() {
     }));
     return program;
 }
+/**
+ * Map a workflow compile/validation throw to a typed `OxygenError`. The
+ * compiler and linter (`compileWorkflowDefinition`, `assertWorkflowManifest`,
+ * `serializeWorkflowFunction`, cron parsing) throw ordinary `Error`s shaped
+ * `"<code>: <message>"`, which `@oxygen/shared`'s `toFailure` would otherwise
+ * flatten to a machine-hostile `unexpected_error` — making `workflows lint`
+ * (whose whole job is to report authoring mistakes) read like an internal
+ * crash. Preserve the embedded lint code so the failure mirrors what a manifest
+ * lint would return (`duplicate_step_id`, `invalid_cron`, `invalid_max_credits`,
+ * …). Same precedent as `parseJsonValue`.
+ */
+function asWorkflowCompileError(error, filePath) {
+    if (error instanceof OxygenError)
+        return error;
+    const fsCode = error?.code;
+    if (typeof fsCode === "string" && /^E[A-Z]+$/.test(fsCode)) {
+        return new OxygenError("workflow_file_unreadable", `Could not read workflow file: ${error instanceof Error ? error.message : fsCode}`, { details: { file: filePath }, exitCode: 1 });
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    const match = /^([a-z][a-z0-9_]*): ([\s\S]+)$/.exec(message);
+    if (match?.[1] && match[2]) {
+        return new OxygenError(match[1], match[2], {
+            details: { file: filePath, phase: "compile" },
+            exitCode: 1,
+        });
+    }
+    return new OxygenError("invalid_workflow", message, {
+        details: { file: filePath, phase: "compile" },
+        exitCode: 1,
+    });
+}
 async function compileWorkflowFile(filePath) {
+    try {
+        return await loadWorkflowManifestFromFile(filePath);
+    }
+    catch (error) {
+        throw asWorkflowCompileError(error, filePath);
+    }
+}
+async function loadWorkflowManifestFromFile(filePath) {
     const absolutePath = resolve(filePath);
     const source = readFileSync(absolutePath, "utf8");
     const extension = extname(absolutePath).toLowerCase();
@@ -5214,7 +5553,10 @@ function normalizeWorkflowRunErrors(value) {
     return output;
 }
 function isTerminalWorkflowRunStatus(status) {
-    return status === "completed" || status === "failed" || status === "canceled";
+    // 'awaiting_approval' pauses the run indefinitely for a human decision (lease
+    // cleared, excluded from claim + lease sweep), so it must stop the tail and
+    // surface the approval rather than poll forever.
+    return status === "completed" || status === "failed" || status === "canceled" || status === "awaiting_approval";
 }
 function tableWebhookListPath(options) {
     const params = new URLSearchParams();
@@ -6496,6 +6838,38 @@ function domainsBuyRerunCommand(domains, quoteId, options, data) {
     ];
     return `${resolveCliBinaryName()} domains buy ${domains.join(" ")} ${flags.join(" ")}`;
 }
+// Staff import of pre-existing managed-account domains. Exactly one of an explicit
+// list or --all; without --yes the server returns a preview and the CLI appends a
+// copy-paste rerun command to execute it.
+async function runDomainsAdopt(domains, options) {
+    const hasExplicit = domains.length > 0;
+    if (hasExplicit === Boolean(options.all)) {
+        throw new Error("Pass exactly one of <domains...> or --all. Use --all to adopt every domain in the managed account, or list specific domains.");
+    }
+    const organizationId = readOption(options.organizationId);
+    const data = await requestOxygen("/api/cli/domains/adopt", {
+        method: "POST",
+        body: {
+            ...(options.all ? { all: true } : {}),
+            ...(hasExplicit ? { domains } : {}),
+            ...(organizationId ? { organization_id: organizationId } : {}),
+            ...(options.yes ? { approved: true } : {}),
+        },
+    });
+    if (options.yes)
+        return data;
+    return { ...data, rerun_command: domainsAdoptRerunCommand(domains, options) };
+}
+function domainsAdoptRerunCommand(domains, options) {
+    const organizationId = readOption(options.organizationId);
+    const flags = [
+        ...(options.all ? ["--all"] : []),
+        ...(organizationId ? [`--organization-id ${organizationId}`] : []),
+        "--yes",
+    ];
+    const args = domains.length > 0 ? ` ${domains.join(" ")}` : "";
+    return `${resolveCliBinaryName()} domains adopt${args} ${flags.join(" ")}`;
+}
 // succeeded/failed are terminal; action_required stops the wait too because
 // only the user (in the Cloudflare dashboard) can move it forward.
 function isSettledDomainRegistrationStatus(status) {
@@ -8108,6 +8482,125 @@ function formatProfileUseSuccess(profile, options) {
     }
     return lines.join("\n");
 }
+// `sequences signal` records an external GTM signal onto a running sequence's
+// enrollment(s). The signal *name* is validated server-side against the typed
+// enum; the CLI only enforces that a signal was supplied and that at least one
+// enrollment target (--enrollment / --lead) is present, so an unscoped call
+// fails before spending a request.
+async function handleSequenceSignalAction(sequence, options) {
+    try {
+        const signal = readOption(options.signal);
+        if (!signal)
+            throw new Error("--signal is required.");
+        const enrollmentId = readOption(options.enrollment);
+        const leadProviderId = readOption(options.lead);
+        if (!enrollmentId && !leadProviderId) {
+            throw new Error("Provide a target enrollment with --enrollment <id> and/or --lead <provider_id>.");
+        }
+        const data = await requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/signal`, {
+            method: "POST",
+            body: {
+                signal,
+                ...(enrollmentId ? { enrollment_id: enrollmentId } : {}),
+                ...(leadProviderId ? { lead_provider_id: leadProviderId } : {}),
+            },
+        });
+        if (options.json) {
+            writeJson(success("sequences signal", data));
+            return;
+        }
+        const updated = typeof data.enrollments_updated === "number" ? data.enrollments_updated : 0;
+        const recordedSignal = data.signal ?? signal;
+        const link = data.deepLink ?? data.web_url;
+        process.stdout.write(`Recorded ${recordedSignal} on ${updated} enrollment(s).${link ? ` ${link}` : ""}\n`);
+    }
+    catch (error) {
+        const failure = toFailure("sequences signal", error);
+        writeJson(failure);
+        writeMaxCreditsHint(error);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleSequenceVariantsAction(sequence, options) {
+    try {
+        const data = await requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/variants`);
+        if (options.json) {
+            writeJson(success("sequences variants", data));
+            return;
+        }
+        process.stdout.write(formatSequenceVariants(data));
+    }
+    catch (error) {
+        const failure = toFailure("sequences variants", error);
+        writeJson(failure);
+        writeMaxCreditsHint(error);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+function formatVariantCell(value) {
+    if (value === null || value === undefined)
+        return "—";
+    return String(value);
+}
+function formatRatePercent(value) {
+    if (typeof value !== "number" || !Number.isFinite(value))
+        return "—";
+    // Rates arrive as a 0–1 fraction; render as a one-decimal percentage.
+    return `${(value * 100).toFixed(1)}%`;
+}
+function renderVariantTable(headers, rows) {
+    const widths = headers.map((header, columnIndex) => {
+        let max = header.length;
+        for (const row of rows) {
+            const cell = row[columnIndex] ?? "";
+            if (cell.length > max)
+                max = cell.length;
+        }
+        return max;
+    });
+    const renderRow = (cells) => `  ${cells.map((cell, i) => cell.padEnd(widths[i] ?? 0)).join("  ")}`.replace(/\s+$/, "");
+    const separator = `  ${widths.map((width) => "-".repeat(width)).join("  ")}`;
+    return [renderRow(headers), separator, ...rows.map(renderRow)];
+}
+function formatSequenceVariants(data) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const byVariant = Array.isArray(data.by_variant) ? data.by_variant : [];
+    const byMailbox = Array.isArray(data.by_mailbox) ? data.by_mailbox : [];
+    const lines = ["", styles.bold("By variant")];
+    if (byVariant.length === 0) {
+        lines.push(`  ${styles.dim("No variant analytics yet.")}`);
+    }
+    else {
+        const headers = ["STEP", "VARIANT", "SENT", "REPLIED", "REPLY RATE", "BOUNCED", "CREDITS"];
+        const rows = byVariant.map((row) => [
+            formatVariantCell(row.step_index),
+            formatVariantCell(row.variant_id),
+            formatVariantCell(row.sent),
+            formatVariantCell(row.replied),
+            formatRatePercent(row.reply_rate),
+            formatVariantCell(row.bounced),
+            formatVariantCell(row.credits_used),
+        ]);
+        lines.push(...renderVariantTable(headers, rows));
+    }
+    lines.push("", styles.bold("By mailbox"));
+    if (byMailbox.length === 0) {
+        lines.push(`  ${styles.dim("No mailbox analytics yet.")}`);
+    }
+    else {
+        const headers = ["MAILBOX", "SENT", "REPLIED", "REPLY RATE", "FAILED"];
+        const rows = byMailbox.map((row) => [
+            formatVariantCell(row.email_address),
+            formatVariantCell(row.sent),
+            formatVariantCell(row.replied),
+            formatRatePercent(row.reply_rate),
+            formatVariantCell(row.failed),
+        ]);
+        lines.push(...renderVariantTable(headers, rows));
+    }
+    lines.push("");
+    return lines.join("\n");
+}
 function formatWhoami(identity, context) {
     const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     const email = identity.user.email ?? identity.user.id;
@@ -8615,6 +9108,37 @@ function readNonNegativeInt(value) {
     }
     return parsed;
 }
+function readPositiveInteger(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = Number(trimmed);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        throw new OxygenError("invalid_number", "Expected a positive integer.", {
+            details: { value },
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
+// Folds the sequence-level email send controls (--max-emails-per-mailbox-per-day,
+// --send-window-file) into a partial `settings` object. Returns undefined when
+// neither flag is set so the field is omitted from the request body entirely.
+// The server shallow-merges this fragment over the sequence's current settings
+// (apps/web .../sequences/[sequenceId]/route.ts), so a throttle-only PATCH
+// preserves other settings the server already holds, e.g. dispatch_mode/schedule.
+function readSequenceSettings(options) {
+    const settings = {};
+    const maxPerMailbox = readPositiveInteger(options.maxEmailsPerMailboxPerDay);
+    if (maxPerMailbox !== undefined) {
+        settings.max_emails_per_mailbox_per_day = maxPerMailbox;
+    }
+    const windowPath = readOption(options.sendWindowFile);
+    if (windowPath) {
+        settings.email_send_window = readJsonFileValue(resolve(windowPath), "--send-window-file");
+    }
+    return Object.keys(settings).length > 0 ? settings : undefined;
+}
 function muteTokenEcho() {
     if (!input.isTTY || process.platform === "win32")
         return () => undefined;