@oxygen-agent/cli 1.365.3 → 1.575.19

package/node_modules/@oxygen/shared/dist/spend-safety.d.ts

@@ -0,0 +1,70 @@
+import type { PlanTier } from "./billing.js";
+import type { LimitsTier } from "./plan-limits.js";
+/**
+ * Spend-safety defaults: plan-scaled ceilings applied when an autonomous
+ * spend path was armed WITHOUT an explicit cap. They restore the ADR-0011
+ * doctrine that every cron/webhook/event trigger persists a per-delivery
+ * ceiling — absence of a cap is no longer unbounded. Explicit user caps always
+ * win and are never clamped down; `null` means no default applies (enterprise
+ * runs on custom limits; free has no BYOK).
+ *
+ * Values anchor to ≥ one day-equivalent of the plan's monthly credits
+ * (monthlyCredits / 30), orders of magnitude above typical per-delivery spend,
+ * so the ceiling binds on runaway loops, not legitimate heavy runs.
+ */
+/** Where an effective cap came from: caller-declared or a plan-tier default. */
+export type EffectiveCapSource = "explicit" | "trigger_default";
+/** Workflow run trigger types that fire without a human in the loop. */
+export declare const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES: ReadonlySet<string>;
+/**
+ * Per-run managed-credit ceiling for a LIVE workflow run fired by an autonomous
+ * trigger when neither run metadata nor the manifest declares `max_credits`.
+ */
+export declare const DEFAULT_TRIGGER_RUN_CREDIT_CEILING: Record<PlanTier, number | null>;
+/**
+ * Per-delivery credit ceiling stamped onto a standing/webhook table auto-run
+ * batch when the armed configuration carries no explicit `max_credits`.
+ */
+export declare const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING: Record<PlanTier, number | null>;
+/**
+ * Row ceiling for a BYOK AI-column run whose caller gave no explicit row bound
+ * (no limit, no row_ids, selection "all"). BYOK bills the customer's own
+ * provider account, so a credit ceiling is meaningless — row count is the
+ * enforceable unit. An explicit limit (up to the 500k platform row cap) wins.
+ */
+export declare const DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS: Record<PlanTier, number | null>;
+/**
+ * Default per-provider DAILY call cap for BYOK provider traffic (the customer's
+ * own key). Short-window pacing defaults already exist in provider-fetch; this
+ * bounds daily volume. Warn-first: enforcement flips only after telemetry and
+ * with the self-serve override surface live. A workspace
+ * provider_rate_limit_policies row with windowSeconds=86400 overrides it.
+ */
+export declare const DEFAULT_BYOK_PROVIDER_DAILY_CALL_CAP: Record<PlanTier, number | null>;
+export declare const BYOK_PROVIDER_DAILY_WINDOW_SECONDS: number;
+/**
+ * Implicit org-level DAILY budget guard, evaluated only when the org has no
+ * explicit org-scope daily budget policy and the plan has finite positive
+ * monthly credits. Warn when one rolling day spends past WARN_PCT of the
+ * monthly grant; hard-block at BLOCK_PCT (a loop burning a whole month in a
+ * day is near-certainly runaway — this also protects large top-up balances).
+ * Setting any explicit org-daily policy fully suppresses the implicit pair.
+ */
+export declare const DEFAULT_ORG_DAILY_SPEND_WARN_PCT = 0.25;
+export declare const DEFAULT_ORG_DAILY_SPEND_BLOCK_PCT = 1;
+export declare function resolveDefaultTriggerRunCreditCeiling(tier: PlanTier): number | null;
+export declare function resolveDefaultAutoRunBatchCreditCeiling(tier: PlanTier): number | null;
+export declare function resolveDefaultByokColumnRunMaxRows(tier: PlanTier): number | null;
+export declare function resolveDefaultByokProviderDailyCallCap(tier: PlanTier): number | null;
+/**
+ * The plan tiers the spend-safety default tables above are keyed by. `limitsTier`
+ * collapses "enterprise" onto the "scale" enforcement rung, but these tables carry
+ * a distinct "enterprise" column (null = runs on custom limits) — so prefer the
+ * raw plan_tier whenever it is itself a table key, and fall back to the limits rung
+ * (always a valid PlanTier key) when plan_tier is absent or an unknown/legacy
+ * string (e.g. a Stripe price nickname). Single source of truth for the
+ * `oxygen limits` report, the org-facing provider-limits API, and the BYOK
+ * daily-cap enforcement resolver — they must agree on which column an org reads.
+ */
+export declare const SPEND_SAFETY_PLAN_TIERS: readonly PlanTier[];
+export declare function resolveSpendSafetyPlanTier(planTier: string | null, limitsTier: LimitsTier): PlanTier;

package/node_modules/@oxygen/shared/dist/spend-safety.js

@@ -0,0 +1,106 @@
+/** Workflow run trigger types that fire without a human in the loop. */
+export const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES = new Set([
+    "cron",
+    "webhook",
+    "event",
+]);
+/**
+ * Per-run managed-credit ceiling for a LIVE workflow run fired by an autonomous
+ * trigger when neither run metadata nor the manifest declares `max_credits`.
+ */
+export const DEFAULT_TRIGGER_RUN_CREDIT_CEILING = {
+    free: 500,
+    starter: 5_000,
+    pro: 10_000,
+    team: 25_000,
+    scale: 250_000,
+    enterprise: null,
+};
+/**
+ * Per-delivery credit ceiling stamped onto a standing/webhook table auto-run
+ * batch when the armed configuration carries no explicit `max_credits`.
+ */
+export const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING = {
+    free: 500,
+    starter: 5_000,
+    pro: 10_000,
+    team: 25_000,
+    scale: 250_000,
+    enterprise: null,
+};
+/**
+ * Row ceiling for a BYOK AI-column run whose caller gave no explicit row bound
+ * (no limit, no row_ids, selection "all"). BYOK bills the customer's own
+ * provider account, so a credit ceiling is meaningless — row count is the
+ * enforceable unit. An explicit limit (up to the 500k platform row cap) wins.
+ */
+export const DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS = {
+    free: null,
+    starter: 25_000,
+    pro: 50_000,
+    team: 100_000,
+    scale: 250_000,
+    enterprise: null,
+};
+/**
+ * Default per-provider DAILY call cap for BYOK provider traffic (the customer's
+ * own key). Short-window pacing defaults already exist in provider-fetch; this
+ * bounds daily volume. Warn-first: enforcement flips only after telemetry and
+ * with the self-serve override surface live. A workspace
+ * provider_rate_limit_policies row with windowSeconds=86400 overrides it.
+ */
+export const DEFAULT_BYOK_PROVIDER_DAILY_CALL_CAP = {
+    free: null,
+    starter: 10_000,
+    pro: 25_000,
+    team: 50_000,
+    scale: 200_000,
+    enterprise: null,
+};
+export const BYOK_PROVIDER_DAILY_WINDOW_SECONDS = 24 * 60 * 60;
+/**
+ * Implicit org-level DAILY budget guard, evaluated only when the org has no
+ * explicit org-scope daily budget policy and the plan has finite positive
+ * monthly credits. Warn when one rolling day spends past WARN_PCT of the
+ * monthly grant; hard-block at BLOCK_PCT (a loop burning a whole month in a
+ * day is near-certainly runaway — this also protects large top-up balances).
+ * Setting any explicit org-daily policy fully suppresses the implicit pair.
+ */
+export const DEFAULT_ORG_DAILY_SPEND_WARN_PCT = 0.25;
+export const DEFAULT_ORG_DAILY_SPEND_BLOCK_PCT = 1;
+export function resolveDefaultTriggerRunCreditCeiling(tier) {
+    return DEFAULT_TRIGGER_RUN_CREDIT_CEILING[tier];
+}
+export function resolveDefaultAutoRunBatchCreditCeiling(tier) {
+    return DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING[tier];
+}
+export function resolveDefaultByokColumnRunMaxRows(tier) {
+    return DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS[tier];
+}
+export function resolveDefaultByokProviderDailyCallCap(tier) {
+    return DEFAULT_BYOK_PROVIDER_DAILY_CALL_CAP[tier];
+}
+/**
+ * The plan tiers the spend-safety default tables above are keyed by. `limitsTier`
+ * collapses "enterprise" onto the "scale" enforcement rung, but these tables carry
+ * a distinct "enterprise" column (null = runs on custom limits) — so prefer the
+ * raw plan_tier whenever it is itself a table key, and fall back to the limits rung
+ * (always a valid PlanTier key) when plan_tier is absent or an unknown/legacy
+ * string (e.g. a Stripe price nickname). Single source of truth for the
+ * `oxygen limits` report, the org-facing provider-limits API, and the BYOK
+ * daily-cap enforcement resolver — they must agree on which column an org reads.
+ */
+export const SPEND_SAFETY_PLAN_TIERS = [
+    "free",
+    "starter",
+    "pro",
+    "team",
+    "scale",
+    "enterprise",
+];
+export function resolveSpendSafetyPlanTier(planTier, limitsTier) {
+    if (planTier && SPEND_SAFETY_PLAN_TIERS.includes(planTier)) {
+        return planTier;
+    }
+    return limitsTier;
+}

package/node_modules/@oxygen/shared/dist/tags.d.ts

@@ -1,7 +1,45 @@
+import type { TagColor } from "./select-options.js";
 /** Primitive kinds that participate in the workspace tag union today. */
-export declare const TAG_KINDS: readonly ["knowledge_page", "publishing_post", "sequence", "table", "workflow", "recipe"];
+export declare const TAG_KINDS: readonly ["knowledge_page", "publishing_post", "sequence", "table", "workflow", "recipe", "conversation", "mailbox", "sender", "record", "domain", "project", "engagement_watch"];
 export type TagKind = (typeof TAG_KINDS)[number];
+/**
+ * The taggable kinds in prose, for CLI `--help` and MCP tool descriptions.
+ *
+ * Lives next to {@link TAG_KINDS} because those descriptions are the *discovery*
+ * surface: a blind-user eval (2026-07-21) found the tags help still advertising
+ * the original seven kinds, so a user reading `tags --help` had no way to learn
+ * that domains, projects, or engagement watches were taggable at all — they had
+ * to stumble on each owning group's own help. One string, one import, and
+ * `TAG_KIND_PROSE_MARKERS` fails the build/test if a new kind skips it.
+ */
+export declare const TAG_KINDS_PROSE: string;
+/**
+ * The phrase each kind must contribute to {@link TAG_KINDS_PROSE}. Typed as a
+ * total map over TagKind, so adding a kind is a compile error until it is named
+ * here, and the paired test asserts the phrase actually appears in the prose.
+ */
+export declare const TAG_KIND_PROSE_MARKERS: Record<TagKind, string>;
 export declare function isTagKind(value: unknown): value is TagKind;
+/**
+ * How each kind is named when a tag's footprint is listed. Total over TagKind,
+ * so adding a kind is a compile error until it is labelled — the same guarantee
+ * {@link TAG_KIND_PROSE_MARKERS} gives the help text.
+ *
+ * `many` is sentence-form with proper nouns preserved ("CRM records"), which is
+ * what an inline count wants ("3 CRM records"). Headings run it through
+ * {@link tagKindHeading}, which only uppercases a leading lowercase letter, so
+ * "CRM records" survives intact where a naive capitalize would yield "Crm".
+ * Three hand-maintained copies of this map used to drift (the /tags page said
+ * "knowledge", the detail page and the MCP widget said "Knowledge pages").
+ */
+export declare const TAG_KIND_LABELS: Record<TagKind, {
+    one: string;
+    many: string;
+}>;
+/** Inline label for a count: `tagKindLabel("sequence", 1)` → "sequence". */
+export declare function tagKindLabel(kind: string, count: number): string;
+/** Section heading for a kind: "Knowledge pages", "CRM records". */
+export declare function tagKindHeading(kind: string): string;
 /** Hard cap per tagged item — matches the wiki's long-standing limit. */
 export declare const MAX_TAGS_PER_ITEM = 50;
 /**
@@ -12,3 +50,54 @@ export declare const MAX_TAGS_PER_ITEM = 50;
 export declare function normalizeTagList(values: readonly unknown[]): string[];
 /** Lenient variant: `undefined`/`null`/non-arrays normalize to `[]`. */
 export declare function normalizeTags(value: unknown): string[];
+/**
+ * Registry-only caps (ADR 0017). Deliberately NOT enforced by
+ * {@link normalizeTagList}: that runs on every writer's hot path, so adding a
+ * length filter there would silently drop an existing long tag the next time
+ * any row carrying it was rewritten. A longer tag stays legal to carry — it
+ * just cannot be declared.
+ */
+export declare const MAX_TAG_LABEL_LENGTH = 200;
+export declare const MAX_TAG_DESCRIPTION_LENGTH = 500;
+/**
+ * Normalize ONE label the way {@link normalizeTagList} normalizes each element,
+ * and reject what the registry cannot store: non-strings, blanks, and anything
+ * over {@link MAX_TAG_LABEL_LENGTH}. Returns `null` so callers can raise their
+ * own typed error.
+ *
+ * Note this lowercases and trims but does NOT slugify — "Q3 Outbound" becomes
+ * "q3 outbound", space intact. Any character is legal in a tag.
+ */
+export declare function normalizeTagLabel(value: unknown): string | null;
+/**
+ * One tag as every read surface sees it: carrier counts unioned across stores,
+ * plus the registry annotation when the tag is declared.
+ *
+ * Canonical here rather than in the web app because two consumers used to
+ * declare it independently (`WorkspaceTagIndexEntry` server-side and
+ * `WorkspaceTagVocabularyEntry` in the TagPicker). Extra properties are
+ * structurally compatible in TypeScript, so widening one and not the other
+ * compiled silently and the picker simply never saw the new fields.
+ *
+ * `color` is the explicit OVERRIDE or null — never the derived color. Resolving
+ * `tagColorForLabel` here would force every chip render to consult the index
+ * instead of computing locally, which is the property that lets undeclared tags
+ * stay color-stable with nothing stored.
+ */
+export type WorkspaceTagEntry = {
+    tag: string;
+    /** Carriers only. 0 for a declared tag nothing carries yet. */
+    total: number;
+    counts: Partial<Record<TagKind, number>>;
+    /** Has a registry row. */
+    declared: boolean;
+    description: string | null;
+    color: TagColor | null;
+    pinned: boolean;
+};
+/**
+ * Index ordering, shared by the web page, the CLI/MCP payload, and the picker.
+ * Pinned first matters beyond the tags page: the picker truncates its suggestion
+ * list, and a curated tag with few carriers would otherwise fall off that cliff.
+ */
+export declare function compareWorkspaceTagEntries(a: Pick<WorkspaceTagEntry, "tag" | "total" | "pinned">, b: Pick<WorkspaceTagEntry, "tag" | "total" | "pinned">): number;

package/node_modules/@oxygen/shared/dist/tags.js

@@ -1,9 +1,15 @@
-// Workspace tags (Tags primitive, ADR 0010): free-form lowercase labels shared
-// across primitives so campaign knowledge links across stores — a sequence, its
-// campaign-learnings wiki page, the source table, and the workflow that feeds it
-// can all carry `q3-outbound`. Storage stays per-store (`tags text[]` + GIN,
-// the 0009/0025 pattern); this module is the one vocabulary: which kinds
-// participate, and how a tag list is normalized before it is written anywhere.
+// Workspace tags (Tags primitive, ADR 0010; registry per ADR 0017): free-form
+// lowercase labels shared across primitives so campaign knowledge links across
+// stores — a sequence, its campaign-learnings wiki page, the source table, and
+// the workflow that feeds it can all carry `q3-outbound`. Carrier storage stays
+// per-store (`tags text[]` + GIN, the 0009/0025 pattern); this module is the one
+// vocabulary: which kinds participate, and how a tag is normalized before it is
+// written anywhere.
+//
+// Since ADR 0017 a tag exists iff it is DECLARED (a row in the tenant registry,
+// `ox_context.workspace_tags`) OR CARRIED (some store's tags array holds it).
+// The registry is an ANNOTATION table — description, color override, pinned —
+// and never records which items carry a tag. Drift is legal in both directions.
 /** Primitive kinds that participate in the workspace tag union today. */
 export const TAG_KINDS = [
     "knowledge_page",
@@ -12,10 +18,90 @@ export const TAG_KINDS = [
     "table",
     "workflow",
     "recipe",
+    "conversation",
+    "mailbox",
+    "sender",
+    "record",
+    "domain",
+    "project",
+    "engagement_watch",
 ];
+/**
+ * The taggable kinds in prose, for CLI `--help` and MCP tool descriptions.
+ *
+ * Lives next to {@link TAG_KINDS} because those descriptions are the *discovery*
+ * surface: a blind-user eval (2026-07-21) found the tags help still advertising
+ * the original seven kinds, so a user reading `tags --help` had no way to learn
+ * that domains, projects, or engagement watches were taggable at all — they had
+ * to stumble on each owning group's own help. One string, one import, and
+ * `TAG_KIND_PROSE_MARKERS` fails the build/test if a new kind skips it.
+ */
+export const TAG_KINDS_PROSE = "publishing posts, knowledge pages, sequences, tables, workflows, recipes, " +
+    "inbox conversations, CRM records, mailboxes, sender accounts, sending domains, " +
+    "projects, and engagement watches";
+/**
+ * The phrase each kind must contribute to {@link TAG_KINDS_PROSE}. Typed as a
+ * total map over TagKind, so adding a kind is a compile error until it is named
+ * here, and the paired test asserts the phrase actually appears in the prose.
+ */
+export const TAG_KIND_PROSE_MARKERS = {
+    knowledge_page: "knowledge page",
+    publishing_post: "publishing post",
+    sequence: "sequence",
+    table: "table",
+    workflow: "workflow",
+    recipe: "recipe",
+    conversation: "inbox conversation",
+    mailbox: "mailbox",
+    sender: "sender account",
+    record: "CRM record",
+    domain: "sending domain",
+    project: "project",
+    engagement_watch: "engagement watch",
+};
 export function isTagKind(value) {
     return typeof value === "string" && TAG_KINDS.includes(value);
 }
+/**
+ * How each kind is named when a tag's footprint is listed. Total over TagKind,
+ * so adding a kind is a compile error until it is labelled — the same guarantee
+ * {@link TAG_KIND_PROSE_MARKERS} gives the help text.
+ *
+ * `many` is sentence-form with proper nouns preserved ("CRM records"), which is
+ * what an inline count wants ("3 CRM records"). Headings run it through
+ * {@link tagKindHeading}, which only uppercases a leading lowercase letter, so
+ * "CRM records" survives intact where a naive capitalize would yield "Crm".
+ * Three hand-maintained copies of this map used to drift (the /tags page said
+ * "knowledge", the detail page and the MCP widget said "Knowledge pages").
+ */
+export const TAG_KIND_LABELS = {
+    knowledge_page: { one: "knowledge page", many: "knowledge pages" },
+    publishing_post: { one: "publishing post", many: "publishing posts" },
+    sequence: { one: "sequence", many: "sequences" },
+    table: { one: "table", many: "tables" },
+    workflow: { one: "workflow", many: "workflows" },
+    recipe: { one: "recipe", many: "recipes" },
+    conversation: { one: "conversation", many: "conversations" },
+    mailbox: { one: "mailbox", many: "mailboxes" },
+    sender: { one: "sender account", many: "sender accounts" },
+    record: { one: "CRM record", many: "CRM records" },
+    domain: { one: "domain", many: "domains" },
+    project: { one: "project", many: "projects" },
+    engagement_watch: { one: "engagement watch", many: "engagement watches" },
+};
+/** Inline label for a count: `tagKindLabel("sequence", 1)` → "sequence". */
+export function tagKindLabel(kind, count) {
+    const entry = isTagKind(kind) ? TAG_KIND_LABELS[kind] : null;
+    if (!entry)
+        return kind;
+    return count === 1 ? entry.one : entry.many;
+}
+/** Section heading for a kind: "Knowledge pages", "CRM records". */
+export function tagKindHeading(kind) {
+    const entry = isTagKind(kind) ? TAG_KIND_LABELS[kind] : null;
+    const label = entry ? entry.many : kind;
+    return label.charAt(0).toUpperCase() + label.slice(1);
+}
 /** Hard cap per tagged item — matches the wiki's long-standing limit. */
 export const MAX_TAGS_PER_ITEM = 50;
 /**
@@ -32,3 +118,37 @@ export function normalizeTags(value) {
         return [];
     return normalizeTagList(value);
 }
+/**
+ * Registry-only caps (ADR 0017). Deliberately NOT enforced by
+ * {@link normalizeTagList}: that runs on every writer's hot path, so adding a
+ * length filter there would silently drop an existing long tag the next time
+ * any row carrying it was rewritten. A longer tag stays legal to carry — it
+ * just cannot be declared.
+ */
+export const MAX_TAG_LABEL_LENGTH = 200;
+export const MAX_TAG_DESCRIPTION_LENGTH = 500;
+/**
+ * Normalize ONE label the way {@link normalizeTagList} normalizes each element,
+ * and reject what the registry cannot store: non-strings, blanks, and anything
+ * over {@link MAX_TAG_LABEL_LENGTH}. Returns `null` so callers can raise their
+ * own typed error.
+ *
+ * Note this lowercases and trims but does NOT slugify — "Q3 Outbound" becomes
+ * "q3 outbound", space intact. Any character is legal in a tag.
+ */
+export function normalizeTagLabel(value) {
+    if (typeof value !== "string")
+        return null;
+    const normalized = value.trim().toLowerCase();
+    if (!normalized || normalized.length > MAX_TAG_LABEL_LENGTH)
+        return null;
+    return normalized;
+}
+/**
+ * Index ordering, shared by the web page, the CLI/MCP payload, and the picker.
+ * Pinned first matters beyond the tags page: the picker truncates its suggestion
+ * list, and a curated tag with few carriers would otherwise fall off that cliff.
+ */
+export function compareWorkspaceTagEntries(a, b) {
+    return Number(b.pinned) - Number(a.pinned) || b.total - a.total || a.tag.localeCompare(b.tag);
+}

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const OXYGEN_VERSION = "1.365.3";
+export declare const OXYGEN_VERSION = "1.575.19";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.365.3";
+export const OXYGEN_VERSION = "1.575.19";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/node_modules/@oxygen/shared/dist/workflow-trigger-metadata.d.ts

@@ -1,2 +1,2 @@
-export declare const WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS: readonly ["consecutive_failure_count", "last_failure_code", "last_failure_at", "auto_paused_at", "auto_pause_reason"];
+export declare const WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS: readonly ["consecutive_failure_count", "consecutive_capacity_failure_count", "last_failure_code", "last_failure_at", "auto_paused_at", "auto_pause_reason"];
 export declare function clearWorkflowTriggerAutoPauseMetadata(metadata: Record<string, unknown>): Record<string, unknown>;

package/node_modules/@oxygen/shared/dist/workflow-trigger-metadata.js

@@ -1,5 +1,9 @@
 export const WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS = [
     "consecutive_failure_count",
+    // The provider-capacity streak, counted independently of the deterministic one
+    // so the two classes cannot borrow each other's budget. Listed here so a
+    // success — or a re-enable — clears it through the same single path.
+    "consecutive_capacity_failure_count",
     "last_failure_code",
     "last_failure_at",
     "auto_paused_at",

package/node_modules/@oxygen/shared/dist/workspace-agents.d.ts

@@ -1,11 +1,11 @@
-/** The three implemented Workspace Agent specialists, by stable slug. */
-export type WorkspaceAgentSlug = "inbox-reply-drafts" | "meeting-notetaker" | "knowledge-synthesis";
+/** The implemented general Workspace Agent and specialists (incl. the auto-tagger), by stable slug. */
+export type WorkspaceAgentSlug = "workspace" | "inbox-reply-drafts" | "meeting-notetaker" | "knowledge-synthesis" | "inbox-auto-tagger";
 /**
  * How the web layer builds a specialist's deep-link. A pure hint on the
  * descriptor (shared can't import the web URL helpers) that agent-registry
  * switches on to produce the actual `https://oxygen-agent.com/...` URL.
  */
-export type WorkspaceAgentDeepLinkKind = "inbox_reply_agent" | "notetaker" | "knowledge_agent";
+export type WorkspaceAgentDeepLinkKind = "workspace_agent" | "inbox_reply_agent" | "notetaker" | "knowledge_agent" | "inbox_auto_tagger";
 /** A pure, serializable descriptor for one Workspace Agent specialist. */
 export type WorkspaceAgentDescriptor = {
     /** Stable identifier used across CLI/MCP/API. Never derived from the title. */
@@ -54,12 +54,13 @@ export type WorkspaceAgentRunItem = {
     webUrl: string | null;
 };
 /**
- * The roster. Exactly three entries — one per implemented specialist. Order is
- * stable (it drives the default CLI/widget ordering). Adding a fourth entry is a
- * deliberate product decision that requires the specialist to actually ship first.
+ * The roster. The general Workspace Agent plus the implemented specialists
+ * (five entries). Order is stable (it drives the default CLI/widget ordering).
+ * Adding an entry is a deliberate product decision that requires the worker to
+ * actually ship first.
  */
 export declare const WORKSPACE_AGENT_ROSTER: readonly WorkspaceAgentDescriptor[];
-/** True when `value` is one of the three implemented specialist slugs. */
+/** True when `value` is one of the implemented specialist slugs. */
 export declare function isWorkspaceAgentSlug(value: unknown): value is WorkspaceAgentSlug;
 /** The descriptor for `slug`, or `undefined` when it is not a known specialist. */
 export declare function getWorkspaceAgentDescriptor(slug: string): WorkspaceAgentDescriptor | undefined;

package/node_modules/@oxygen/shared/dist/workspace-agents.js

@@ -1,11 +1,13 @@
 // The Agents primitive's roster (ADR 0011): the governed registry of OXYGEN's
-// built-in workspace agents. Still deliberately a *computed* registry — each
+// built-in workspace agents. The general Workspace Agent is backed by the
+// first-class ox_agents runtime; specialists remain computed from their owning
+// primitive stores. Each
 // entry is a product-defined agent that ships as an approval-gated, observable
 // behavior elsewhere in the product, surfaced under /agents and `oxygen agent`.
 // Agents are governed workspace workers: the runtime envelope (approval posture,
 // credit budgets, run observability) is platform-enforced, never agent-optional.
-// User-defined custom agents are ratified (ADR 0011) but arrive with the unified
-// runtime envelope in a later phase — until then there is no create/define verb,
+// User-defined custom agents are ratified (ADR 0011) but arrive after the unified
+// Workspace Agent runtime — until then there is no custom create/delete verb,
 // and there are never placeholder rows: the roster lists only agents that are
 // actually implemented today. CRM-hygiene, deliverability, and any other roadmap
 // agent stay OUT until they ship — the no-placeholder-surface rule.
@@ -15,11 +17,24 @@
 // (config read/write, run history, deep-links) lives in the web layer's
 // agent-registry, which composes these descriptors with the existing helpers.
 /**
- * The roster. Exactly three entries — one per implemented specialist. Order is
- * stable (it drives the default CLI/widget ordering). Adding a fourth entry is a
- * deliberate product decision that requires the specialist to actually ship first.
+ * The roster. The general Workspace Agent plus the implemented specialists
+ * (five entries). Order is stable (it drives the default CLI/widget ordering).
+ * Adding an entry is a deliberate product decision that requires the worker to
+ * actually ship first.
  */
 export const WORKSPACE_AGENT_ROSTER = [
+    {
+        slug: "workspace",
+        title: "Workspace Agent",
+        subtitle: "Runs organization-grounded goals through OXYGEN's governed capability catalog.",
+        description: "Takes a workspace goal, plans the work, and operates tables, CRM, context, workflows, sequences, files, and integrations as one durable Agent run.",
+        owningPrimitive: "Agents",
+        configCommand: "oxygen agent set workspace",
+        configApiPath: "/api/cli/agent/workspace",
+        mcpConfigTools: ["oxygen_agent_update", "oxygen_agent_run"],
+        approvalPosture: "Uses a versioned standing authorization with optional allow, ask, and deny rules; platform previews, caps, deny rules, and run provenance always apply.",
+        deepLinkKind: "workspace_agent",
+    },
     {
         slug: "inbox-reply-drafts",
         title: "AI Sales Agent",
@@ -56,8 +71,20 @@ export const WORKSPACE_AGENT_ROSTER = [
         approvalPosture: "Writes working knowledge pages as logged revisions; canonical and pinned pages still require proposal approval.",
         deepLinkKind: "knowledge_agent",
     },
+    {
+        slug: "inbox-auto-tagger",
+        title: "AI Inbox Tagger",
+        subtitle: "Auto-tags new inbound conversations from your tag allowlist.",
+        description: "Classifies every new inbound email, LinkedIn, and WhatsApp conversation against your workspace tag allowlist and applies the matching tags automatically.",
+        owningPrimitive: "Messages",
+        configCommand: "oxygen inbox auto-tagger",
+        configApiPath: "/api/cli/inbox/auto-tagger",
+        mcpConfigTools: ["oxygen_inbox_auto_tagger_get", "oxygen_inbox_auto_tagger_set"],
+        approvalPosture: "Auto-applies internal workspace tags only — additive, never re-adds a tag you removed, and needs no approval queue because tags never leave the workspace.",
+        deepLinkKind: "inbox_auto_tagger",
+    },
 ];
-/** True when `value` is one of the three implemented specialist slugs. */
+/** True when `value` is one of the implemented specialist slugs. */
 export function isWorkspaceAgentSlug(value) {
     return (typeof value === "string" &&
         WORKSPACE_AGENT_ROSTER.some((descriptor) => descriptor.slug === value));