@oxygen-agent/cli 1.591.1 → 1.615.0

package/dist/index.js

@@ -8,8 +8,8 @@ import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, CommanderError, Option } from "commander";
 import { applyOxygenHelp } from "./help.js";
-import { buildCommandManifest } from "./command-manifest.js";
-import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, exitCodeForOxygenError, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_VERSION, OxygenError, parseKnowledgePageMarkdown, PLAN_LIMITS, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
+import { buildCommandManifest, getCommandManifestEntry, searchCommandManifest, suggestCommandNames, } from "./command-manifest.js";
+import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, exitCodeForOxygenError, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { TAG_COLORS } from "@oxygen/shared/select-options";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, } from "@oxygen/shared/file-import";
 import { assertRecipeBundleSafe, assertWorkflowGraphManifest, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowGraphManifest, isWorkflowManifest, } from "@oxygen/workflows";
@@ -24,7 +24,7 @@ import { formatAiPromptPreviewNotice } from "./column-run-notices.js";
 import { runLocalCustomHttpColumn } from "./local-custom-http-column.js";
 import { captureCurrentTranscript, collectFeedbackEnvironment, TranscriptCaptureError, } from "./transcript.js";
 import { addSessionOutput, addSessionStatus, getSessionUsage, startSession, updateSessionStep, } from "./session.js";
-import { doctorAgentSkills, installAgentSkills, listAgentSkills, runAutomaticSkillsInstall, } from "./skills.js";
+import { doctorAgentSkills, getAgentSkill, installAgentSkills, listAgentSkills, runAutomaticSkillsInstall, searchAgentSkills, } from "./skills.js";
 import { resolveCliBinaryName } from "./runtime.js";
 import { updateCli } from "./update.js";
 import { isRecord, readErrorMessage, readOption } from "./util.js";
@@ -289,6 +289,7 @@ async function handleAsyncAction(command, options, action) {
     try {
         const data = await action();
         emitSuccess(command, data, options);
+        writeDryRunNotice(data);
         writeCreditsReceipt(data);
     }
     catch (error) {
@@ -304,6 +305,24 @@ function emitCliFailure(command, error) {
     writeMaxCreditsHint(error);
     process.exitCode = error instanceof OxygenError ? exitCodeForOxygenError(error) : 1;
 }
+// A dry run's stdout envelope looks like a successful result — same shape, same
+// `ok: true` — so in a terminal the only tell that nothing was fetched was
+// `meta.mode` buried inside the payload. That is how a working provider key gets
+// reported as broken: the preview comes back empty and reads as a failed live
+// call. Mirror the server's preview banner on stderr, the same stdout/stderr
+// split the credits receipt uses, so the machine-read envelope stays clean.
+function writeDryRunNotice(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const preview = data.preview;
+    if (!preview || typeof preview !== "object" || Array.isArray(preview))
+        return;
+    const block = preview;
+    if (typeof block.message === "string")
+        process.stderr.write(`${block.message}\n`);
+    if (typeof block.next_step === "string")
+        process.stderr.write(`${block.next_step}\n`);
+}
 // Paid envelopes (push 3 legibility) carry a `credits` block: quote on
 // dry_run, receipt on live, remaining balance on both. Mirror it as one
 // stderr line so spend stays visible in a terminal without polluting the
@@ -2508,13 +2527,78 @@ export function createProgram() {
         .action(async (options) => {
         await handleAsyncAction("home standup", options, () => requestOxygen("/api/cli/home/standup"));
     });
-    program
+    const commandsCommand = program
         .command("commands")
-        .description("Print the machine-readable command manifest: every command with flags, spend/mutation markers, and the reserved exit-code table.")
+        .description("Discover CLI commands. With no subcommand, print the backwards-compatible full manifest.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("commands", options, async () => buildCommandManifest(program, binaryName));
     });
+    commandsCommand
+        .addCommand(new Command("search")
+        .description("Find a bounded set of CLI commands from a natural-language outcome.")
+        .argument("<query...>", "Outcome or capability to find.")
+        .option("--limit <n>", "Maximum results (default 10, max 25).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (queryParts, options) => {
+        const outputOptions = { ...options, json: options.json || Boolean(commandsCommand.opts().json) };
+        await handleAsyncAction("commands search", outputOptions, async () => {
+            const manifest = buildCommandManifest(program, binaryName);
+            return searchCommandManifest(manifest, queryParts.join(" "), readPositiveInt(options.limit) ?? 10);
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Hydrate one exact CLI command with its arguments, flags, and safety markers.")
+        .argument("<command...>", "Exact command name returned by commands search.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (commandParts, options) => {
+        const outputOptions = { ...options, json: options.json || Boolean(commandsCommand.opts().json) };
+        await handleAsyncAction("commands get", outputOptions, async () => {
+            const manifest = buildCommandManifest(program, binaryName);
+            const exactName = commandParts.join(" ");
+            const command = getCommandManifestEntry(manifest, exactName);
+            if (!command) {
+                throw new OxygenError("command_not_found", `Unknown Oxygen command: ${exactName}`, {
+                    details: { did_you_mean: suggestCommandNames(manifest, exactName) },
+                    exitCode: 2,
+                });
+            }
+            return command;
+        });
+    }));
+    program
+        .command("capabilities")
+        .description("Route an outcome to its owning OXYGEN layer and hosted primitive.")
+        .addCommand(new Command("search")
+        .description("Find the owning capability, boundary, gateways, and next hydration step.")
+        .argument("<query...>", "Natural-language GTM outcome.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (queryParts, options) => {
+        await handleAsyncAction("capabilities search", options, async () => {
+            const query = queryParts.join(" ");
+            return {
+                query,
+                route: serializeCapabilityRoute(inferCapabilityRoute(query)),
+                hint: "Hydrate one exact CLI command with `oxygen commands get <exact-command> --json`, or one MCP tool with `oxygen_capabilities_schema`.",
+            };
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Hydrate one exact capability card by id.")
+        .argument("<capability-id>", "Capability id returned by capabilities search.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (capabilityId, options) => {
+        await handleAsyncAction("capabilities get", options, async () => {
+            const route = getCapabilityRouteMatch(capabilityId);
+            if (!route) {
+                throw new OxygenError("capability_not_found", `Unknown OXYGEN capability: ${capabilityId}`, {
+                    details: { available_ids: OXYGEN_CAPABILITY_ROUTES.map((card) => card.id) },
+                    exitCode: 2,
+                });
+            }
+            return serializeCapabilityRoute(route);
+        });
+    }));
     program
         .command("status")
         .description("Compare the local Oxygen CLI version against the active profile's deployed Oxygen API.")
@@ -3066,7 +3150,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("resolve")
         .description("Resolve @handles, LinkedIn profile/company links, provider ids, and URNs — through a connected sender (notify=false, free) or the managed scraper (--source scraper, paid, no sender/window needed).")
         .option("--account <account>", "LinkedIn sender id, connection id, or Unipile account id. Required unless --source scraper.")
-        .option("--source <source>", "Resolution source: sender (default, free) or scraper (managed cookieless lookup, ~10 credits per identity, needs --approved --max-credits).")
+        .option("--source <source>", "Resolution source: sender (default, free) or scraper (managed cookieless lookup; fetch current cost from tools get/dry-run; needs --approved --max-credits).")
         .option("--approved", "Approve the paid scraper lookups (required with --source scraper).")
         .option("--max-credits <n>", "Credit ceiling for scraper lookups (required with --source scraper).")
         .option("--text <text>", "Post text containing @identifiers or LinkedIn URLs.")
@@ -3660,8 +3744,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     })))
         .addCommand(new Command("search")
-        .description("Search CRM records by identity or record label.")
-        .argument("<query>", "Domain, email, LinkedIn URL, or record name to search for.")
+        .description("Search CRM records by identity or record label. Takes ONE query; narrow the objects with --object, not a second argument.")
+        .argument("<query>", "Domain, email, LinkedIn URL, or record name to search for. Quote it if it contains spaces; to restrict to one object use --object companies.")
         .option("--objects <objects>", "Comma-separated CRM object slugs to search. Defaults to all configured objects.")
         .option("--object <object>", "Alias for --objects; every sibling crm command spells it singular.")
         .option("--limit <limit>", "Maximum records to return.")
@@ -5826,7 +5910,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("preflight")
-        .description("Preflight a blueprint (slug, local file, or shared URL) against this workspace.")
+        .description("Preflight a blueprint (slug, local file, or shared URL) against this workspace. Price-aware seeds return a current runtime descriptor upper bound, cap adequacy, and an exact zero-credit apply command.")
         .argument("[slug]", "Blueprint slug (for stored or seed blueprints).")
         .option("--file <path>", "Read a blueprint envelope from a local JSON file.")
         .option("--from-url <url>", "Fetch a shared blueprint envelope from a public Oxygen share URL.")
@@ -5987,6 +6071,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         "",
         "Safety:",
         "  list, describe, and preflight use 0 credits, make no provider calls, and do not change workspace state.",
+        "  Price-aware preflights fetch runtime descriptor pricing, label upper bounds versus exact-shape dry runs,",
+        "  and return the exact apply command that preserves the validated inputs.",
         "  export has the same workspace safety; --out only writes the named local file.",
         "  apply also uses 0 credits and makes no provider calls or external writes, but it creates workspace",
         "  tables, prompts, and a disabled workflow. Its response reports future per-run credit ceilings.",
@@ -6450,6 +6536,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--research-mode <mode>", "Research columns: strict (answer only from the sources) or estimate (reason to a figure from them).")
         .option("--research-results <n>", "Research columns: how many search results to ground each row on (1-25).")
         .option("--research-engine <engine>", "Research columns: pin the search provider (exa, parallel, or firecrawl).")
+        // Declaring BOTH forms leaves the default undefined (Commander only
+        // defaults to true when --no- is declared alone), so an update that
+        // doesn't mention visibility leaves it untouched.
+        .option("--always-show", "Keep this column visible even when it holds no values.")
+        .option("--no-always-show", "Stop pinning this column, so it collapses again while empty.")
         .option("--dry-run", "Return the would-be merged definition without writing.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, column, options) => {
@@ -6494,6 +6585,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     ...(definition ? { definition } : {}),
                     ...(definitionUnset.length > 0 ? { definition_unset: definitionUnset } : {}),
                     ...(readOption(options.dataType) ? { data_type: readOption(options.dataType) } : {}),
+                    ...(typeof options.alwaysShow === "boolean" ? { always_show: options.alwaysShow } : {}),
                     ...(options.dryRun ? { dry_run: true } : {}),
                 },
             });
@@ -7377,7 +7469,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     })));
     program
         .command("billing")
-        .description("Plan and managed credit commands. Spend splits into FLEXIBLE (ad-hoc: enrichment, AI, automation — drawn from your free-to-spend balance) and FIXED recurring per-resource monthly commitments blocked out of it; see `billing commitments`. THREE CLOCKS, deliberately different: the CREDIT CYCLE that `billing allowance` reports against (your plan's monthly grant window); each resource's own COMMITMENT RENEWAL, anchored to the day you connected it, so `billing commitments --json` next_due_at rarely matches the cycle end; and your SUBSCRIPTION PERIOD in `billing balance` (annual plans span many credit cycles). A number from one clock will not reconcile against another.")
+        .description("Plan and managed credit commands. Spend splits into FLEXIBLE (ad-hoc: enrichment, AI, automation — drawn from your free-to-spend balance) and FIXED recurring per-resource monthly commitments blocked out of it; see `billing commitments`. THREE CLOCKS, deliberately different: the CREDIT CYCLE that `billing allowance` reports against (your plan's monthly grant window); each resource's own COMMITMENT RENEWAL, anchored to the day you connected it, so `billing commitments --json` next_due_at rarely matches the cycle end; and your SUBSCRIPTION PERIOD in `billing balance` (annual plans span many credit cycles). A number from one clock will not reconcile against another. Failed-payment grace, suspension, and recovery: https://oxygen-agent.com/docs/safety/billing.")
         .addCommand(new Command("change")
         .description("Preview an upgrade or downgrade and return a Stripe confirmation link. Nothing changes until confirmed in Stripe.")
         .requiredOption("--to <tier>", "Target plan: starter, pro, or team.")
@@ -7389,7 +7481,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("balance")
-        .description("Show the current plan and managed credit balance: available and reserved credits, FIXED credits committed to recurring per-resource charges, and the FLEXIBLE free-to-spend remainder. Credits are Oxygen's native unit; the plan's price and $-per-credit are at https://oxygen-agent.com/billing.")
+        .description("Show the current plan, subscription entitlement, and managed credit balance: available and reserved credits, FIXED credits committed to recurring per-resource charges, and the FLEXIBLE free-to-spend remainder. After failed-payment grace expires, mutations stop while read/export and billing recovery remain available. Recovery: https://oxygen-agent.com/billing. Policy: https://oxygen-agent.com/docs/safety/billing.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing balance", options, () => requestOxygen("/api/cli/billing/balance"));
@@ -7774,8 +7866,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .command("admin")
         .description("Staff-only commands.")
         .addCommand(new Command("kpis")
-        .description("Show company acquisition, matured seven-day trial conversion, MRR/ARR, and churn. OXYGEN staff only; workspace admin role alone does not grant access.")
-        .addOption(new Option("--range <range>", "Range for acquisition, seven-day trial cohorts, and churn; current MRR/ARR remain point-in-time.")
+        .description("Show company acquisition with self-reported signup-channel attribution, signup-to-CLI/MCP activation, matured seven-day trial conversion, positive-paid MRR/ARR, and paid churn separated from trial loss. OXYGEN staff only; workspace admin role alone does not grant access.")
+        .addOption(new Option("--range <range>", "Range for acquisition, actor-and-surface-tracked activation, seven-day trial cohorts, and churn; current MRR/ARR and scheduled cancellations remain point-in-time.")
         .choices(["7d", "30d", "90d"])
         .default("30d"))
         .option("--json", "Print a JSON envelope.")
@@ -8676,10 +8768,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .command("tools")
         .description("Tool catalog commands.")
         .addCommand(new Command("search")
-        .description("Search the tool catalog. A response listing partial_sources means an optional catalog source timed out and totals may be understated — rerun for the complete catalog.")
+        .description("Search a bounded, compact provider-operation catalog; hydrate one result with tools get. A response listing partial_sources means an optional catalog source timed out and totals may be understated — rerun for the complete catalog.")
         .argument("[query]", "Search text.")
-        .option("--verbosity <verbosity>", "minimal, summary, or full. Defaults to summary. Use minimal for high-fanout discovery sweeps that need to stay under the MCP token budget.")
+        .option("--verbosity <verbosity>", "minimal, summary, or full. Defaults to minimal; hydrate one result with tools get.")
         .option("--terse", "Alias for --verbosity minimal.")
+        .option("--all", "Return the complete matching catalog. Explicit because the default is bounded to 10.")
         .option("--only-runnable", "Only return tools runnable by the active organization.")
         .option("--workflow-eligible", "Only return tools a hosted workflow step may call, each annotated with the canonical `workflow_effect` its manifest step must declare. This is a narrower set than the table-column catalog — use it when authoring a workflow manifest so lint cannot reject a tool at apply time.")
         .option("--no-access-check", "Skip per-tool availability checks for a fast complete-catalog listing. Tools are returned without availability info; pair with --terse for discovery sweeps.")
@@ -8695,6 +8788,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const verbosity = options.terse ? "minimal" : readOption(options.verbosity);
             if (verbosity)
                 params.set("verbosity", verbosity);
+            if (options.all)
+                params.set("all", "true");
             if (options.onlyRunnable)
                 params.set("only_runnable", "true");
             if (options.workflowEligible)
@@ -10861,24 +10956,57 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const suffix = params.toString();
             return requestOxygen(`/api/cli/sequences${suffix ? `?${suffix}` : ""}`);
         });
+    }))
+        .addCommand(new Command("send")
+        .description("Initiate one net-new LinkedIn message through a one-recipient, one-step hosted Sequence. First call without a sequence id: pass --recipient, --text/--text-file, and --sender to create the inert draft and preview (no message, no credits). After showing that preview, re-run with the returned sequence id plus --approved --max-credits N. Existing-thread replies stay in `oxygen inbox send`.")
+        .argument("[sequence]", "Sequence id returned by the preview call. Omit when creating the preview; required with --approved.")
+        .option("--recipient <url-or-id>", "LinkedIn personal-profile URL or provider member id. Preview call only.")
+        .option("--recipient-name <name>", "Optional display name stored on the enrollment. Preview call only.")
+        .option("--text <text>", "Message body. Preview call only; use either --text or --text-file.")
+        .option("--text-file <path>", "Read the message body from a file. Preview call only; use either --text-file or --text.")
+        .option("--sender <ref>", "Connected LinkedIn sender id, connection id, or Unipile account id. List choices with `oxygen senders list`.")
+        .option("--approved", "Approve the previewed Sequence for live dispatch. Requires the returned sequence id and --max-credits.")
+        .option("--max-credits <n>", "Positive credit ceiling for the live LinkedIn dispatch.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleAsyncAction("sequences send", options, () => {
+            const sequenceId = readOption(sequence);
+            const maxCredits = readPositiveNumber(options.maxCredits);
+            if (sequenceId) {
+                if (readOption(options.recipient) || readOption(options.recipientName) || readOption(options.text) || readOption(options.textFile) || readOption(options.sender)) {
+                    throw new OxygenError("conflicting_flags", "With a sequence id, pass only --approved and --max-credits; recipient, copy, and sender are fixed by the previewed draft.", { exitCode: 1 });
+                }
+                return requestOxygen("/api/cli/sequences/send", { method: "POST", body: { sequence: sequenceId, ...(options.approved ? { approved: true } : {}), ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}) } });
+            }
+            if (options.approved)
+                throw new OxygenError("sequence_preview_required", "Preview first without --approved; then pass the returned sequence id with --approved --max-credits N.", { exitCode: 1 });
+            const recipient = readOption(options.recipient);
+            const sender = readOption(options.sender);
+            const text = readPublishingPostText(options, true);
+            if (!recipient)
+                throw new OxygenError("invalid_request", "--recipient is required for the preview call.", { exitCode: 1 });
+            if (!sender)
+                throw new OxygenError("invalid_request", "--sender is required for the preview call; list choices with `oxygen senders list`.", { exitCode: 1 });
+            return requestOxygen("/api/cli/sequences/send", { method: "POST", body: { recipient, text, sender, ...(readOption(options.recipientName) ? { recipient_name: readOption(options.recipientName) } : {}) } });
+        });
     }))
         .addCommand(new Command("workflows")
-        .description("Configure the sequencer's editable reply workflows: internal CRM routing and positive-reply Microsoft Teams notifications.")
+        .description("Compatibility-only maintenance for existing sequencer presets. Do not create new Teams notifications here: use `oxygen workflows` (web: Sequence → Launch → Connected workflows) with a sequence event trigger and Microsoft Teams Send Message.")
         .addCommand(new Command("list")
-        .description("List reply workflows with armed state, editable config, and workflow deep-links.")
+        .description("List the two legacy sequencer presets with armed state, editable config, and ordinary workflow deep-links.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("sequences workflows list", options, () => requestOxygen("/api/cli/sequencer/reply-workflows"));
     }))
         .addCommand(new Command("configure")
-        .description("Preview or save one editable reply workflow. Live arming requires --armed --approved and a positive per-delivery --max-credits cap; Microsoft Teams requires at least 20.02.")
-        .argument("<template>", "crm-lead-stage-router or sequencer-positive-reply-teams.")
+        .description("Preview or maintain an existing legacy preset. New Teams notifications must use an ordinary connected workflow; this command remains only for compatibility. Omit --live for a zero-write preview. Live arming requires --armed --approved and a positive per-delivery --max-credits cap.")
+        .argument("<template>", "crm-lead-stage-router or the legacy sequencer-positive-reply-teams preset (existing configurations only).")
         .option("--config-file <path>", "JSON object containing the managed workflow configuration.")
         .option("--armed", "Arm the workflow.")
         .option("--disarmed", "Disarm the workflow.")
         .option("--live", "Persist the configuration. Omit for a dry-run preview.")
         .option("--approved", "Explicitly approve standing authority for this exact workflow revision.")
-        .option("--max-credits <n>", "Hard per-delivery credit ceiling (Teams requires at least 20.02).")
+        .option("--max-credits <n>", "Hard per-delivery credit ceiling (the legacy Teams preset requires at least 0.02).")
         .option("--json", "Print a JSON envelope.")
         .action(async (template, options) => {
         await handleAsyncAction("sequences workflows configure", options, () => {
@@ -10907,15 +11035,15 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })))
         .addCommand(new Command("hubspot-sync")
-        .description("Map actual sequencer events to contact datetime fields in the connected HubSpot portal. Event-driven and workspace-wide; no polling interval, direction, row batch, or operator credit-cap controls.")
+        .description("Map actual sequencer events to contact datetime fields in the connected HubSpot portal. Reuses native or provider-managed authorization and only requests known-missing property access if a preview needs new fields.")
         .addCommand(new Command("show")
-        .description("Fetch supported sequencer events, the connected portal's writable contact datetime fields, current mappings, and enabled state.")
+        .description("Show the connected portal and fetch its writable contact datetime fields, supported sequencer events, current mappings, and enabled state.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("sequences hubspot-sync show", options, () => requestOxygen("/api/cli/sequencer/hubspot-sync"));
     }))
         .addCommand(new Command("configure")
-        .description("Preview or save event → HubSpot property mappings. A live enable requires --approved after preview; missing recommended Oxygen properties are created on enable.")
+        .description("Preview or save event → HubSpot property mappings. Existing fields need no new grant; creating missing properties requires --approved and HubSpot property-creation access.")
         .option("--mappings-file <path>", "JSON object mapping every sequencer event key to a HubSpot contact datetime-property internal name; use an empty string to disable an event.")
         .option("--armed", "Enable future event delivery.")
         .option("--disarmed", "Disable future event delivery.")
@@ -11392,7 +11520,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     program.addCommand(new Command("voice")
         .description("The call channel. `tasks` works the call queue — leads waiting for a HUMAN to dial, queued by sequence call steps, CRM records, table rows, and replies. Claiming takes a lease so two reps never dial the same prospect. Nothing here places a call: dialing is a separate, metered, guardrail-gated action. Consumes 0 credits.")
         .addCommand(new Command("tasks")
-        .description("Work the call queue: queue | list | claim | complete | skip | override.\n\nWhat blocks a dial, and what you can do about it:\n  calling_window     lead's local time outside 09:00-20:00      waivable per lead\n  unknown_timezone   no timezone on the lead, so the window\n                     cannot be checked (fails closed)          waivable per lead\n  daily_cap          the chosen number hit today's dial cap     waivable per lead\n  suppressed         on the workspace do-not-call list          NEVER waivable\n  destination_blocked your numbers cannot reach that country    NEVER waivable\n\n`list` reports dialable, block_reason and block_detail per lead, plus\ndialable_count and blocked_by_reason for the page. Waive one with `override`.")
+        .description("Work the call queue: queue | list | claim | complete | extend | skip | override.\n\nA call that nobody answers is dispositioned for you from the call itself, which\nalso resumes any sequence enrollment parked on it — so `complete` and `skip`\nreport already_recorded:true rather than failing when that has happened. You log\nonly what a person said.\n\nWhat blocks a dial, and what you can do about it:\n  calling_window     lead's local time outside 09:00-20:00      waivable per lead\n  unknown_timezone   no timezone on the lead, so the window\n                     cannot be checked (fails closed)          waivable per lead\n  daily_cap          the chosen number hit today's dial cap     waivable per lead\n  suppressed         on the workspace do-not-call list          NEVER waivable\n  destination_blocked your numbers cannot reach that country    NEVER waivable\n\n`list` reports dialable, block_reason and block_detail per lead, plus\ndialable_count and blocked_by_reason for the page. Waive one with `override`.")
         .addCommand(new Command("queue")
         .description("Put a lead INTO the call queue. Idempotent: a lead who already has an open task comes back with created:false rather than a duplicate, because the queue guarantees one open call per person. Queuing is not dialing — it writes a row a human later acts on. Consumes 0 credits.")
         .requiredOption("--phone <e164>", "The lead's number in E.164 (a leading + then 2-15 digits).")
@@ -11552,6 +11680,25 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
+    }))
+        .addCommand(new Command("extend")
+        .description("Renew a claimed task's 15-minute lease. Completing needs a live lease, so a longer call must heartbeat or its outcome and notes are rejected as stale.")
+        .requiredOption("--task <id>", "The claimed task's id.")
+        .requiredOption("--lease <token>", "The lease_token returned by `claim`.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("voice tasks extend", options, () => {
+            const task = readOption(options.task);
+            if (!task)
+                throw new Error("--task is required.");
+            const lease = readOption(options.lease);
+            if (!lease)
+                throw new Error("--lease is required.");
+            return requestOxygen("/api/cli/voice/tasks", {
+                method: "POST",
+                body: { action: "extend", task_id: task, lease_token: lease },
+            });
+        });
     }))
         .addCommand(new Command("skip")
         .description("Drop a task out of the queue without dialing (bad data, a rep pass, a guardrail block). Needs no lease — the guardrail gate skips tasks it never claimed.")
@@ -11850,7 +11997,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("managed-inboxes")
-        .description("Whitelabel sending inboxes bought through OXYGEN: subscribe a domain + N mailboxes (google/microsoft/azure) as a recurring MONTHLY subscription billed in USD to your Oxygen Email Infrastructure subscription, list/get your subscriptions, verify that Oxygen/Stripe/the vendor agree, and cancel. Subscribe/cancel are approval-gated (preview → re-run with --approved --quote). The vendor is chosen for you; --vendor pins one.")
+        .description("Whitelabel sending inboxes bought through OXYGEN: subscribe a domain + N mailboxes (google/microsoft/azure) as a recurring MONTHLY subscription billed in USD to your Oxygen Email Infrastructure subscription, add-inboxes to a domain you already own, list/get your subscriptions, verify that Oxygen/Stripe/the vendor agree, and cancel. Subscribe/add-inboxes/cancel are approval-gated (preview → re-run with --approved --quote). The vendor is chosen for you; --vendor pins one.")
         .addCommand(new Command("verify")
         .description("Check that OXYGEN, STRIPE, and the VENDOR agree about what this org is buying. The truth about a managed inbox lives in three systems — what the customer asked for, what they are charged, and what is actually running — and a 200 from any one of them proves nothing. Reports every disagreement with WHO IS LOSING MONEY while it stands (customer_overbilled first, then oxygen_pays). Read-only, no writes, 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
@@ -11864,7 +12011,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("managed-inboxes registrant", options, () => requestOxygen("/api/cli/managed-inboxes/registrant"));
     }))
         .addCommand(new Command("subscribe")
-        .description("Subscribe a domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. Prices come from the vendor's LIVE rate card and LIVE domain price, and are refused if they sit below vendor cost. Fails closed until the vendor key + founder-signed per-platform pricing are configured.")
+        .description("Subscribe a NEW domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. Prices come from the vendor's LIVE rate card and LIVE domain price, and are refused if they sit below vendor cost. Fails closed until the vendor key + founder-signed per-platform pricing are configured. To add mailboxes to a domain you ALREADY own use `managed-inboxes add-inboxes` — this command always registers a new domain and fails on one you own.")
         .argument("[domain]", "Sending domain to register + host the mailboxes (e.g. send.acme.com). May also be passed as --domain.")
         .option("--domain <domain>", "Sending domain (alternative to the positional argument).")
         .requiredOption("--provider <provider>", "Mailbox PLATFORM: google, microsoft, or azure. (google/microsoft cap at 5 mailboxes per domain; azure allows 100.)")
@@ -11929,6 +12076,75 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
+    }))
+        .addCommand(new Command("add-inboxes")
+        .description("Add mailboxes to a managed domain you ALREADY own — no new domain is registered and there is NO domain registration charge, only the extra inboxes' monthly rate (plus their add-ons). WITHOUT --approved this prints a priced PREVIEW with a quote_id and orders nothing; re-run with --approved --quote <id> to place the order. Capped per domain by the platform the domain was bought on (5 google/microsoft, 100 azure) COUNTING the inboxes already on it. To register a NEW domain use `managed-inboxes subscribe` instead.")
+        .argument("[domain]", "A managed domain this workspace already owns (e.g. send.acme.com). May also be passed as --domain.")
+        .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
+        .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\"}]. The vendor stamps the names on each mailbox, so real names belong here.")
+        .option("--file <path>", "Path to a JSON file { \"mailboxes\": [...] } (alternative to --mailboxes).")
+        .option("--count <n>", "Shorthand for --mailboxes: how many inboxes to add. Requires --prefix.")
+        .option("--prefix <base>", "Shorthand username base for --count: `--count 3 --prefix ada` adds ada1, ada2, ada3 with placeholder names (Ada 1, Ada 2, Ada 3). Pass --mailboxes/--file instead when the inboxes need real human names.")
+        .option("--approved", "Place the order (requires --quote). Without it, a priced preview is returned.")
+        .option("--quote <id>", "The quote_id from a fresh preview. Required with --approved.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domainArg, options) => {
+        await handleAsyncAction("managed-inboxes add-inboxes", options, () => {
+            const domain = requireDomainArg(domainArg, options.domain);
+            let mailboxes;
+            const mailboxesJson = readOption(options.mailboxes);
+            const filePath = readOption(options.file);
+            const prefix = readOption(options.prefix);
+            const count = readPositiveInt(options.count);
+            if (mailboxesJson) {
+                mailboxes = JSON.parse(mailboxesJson);
+            }
+            else if (filePath) {
+                const parsed = readJsonFileValue(resolve(filePath), "--file");
+                mailboxes = parsed.mailboxes ?? [];
+            }
+            else if (count !== undefined || prefix) {
+                if (count === undefined || !prefix) {
+                    throw new Error("--count and --prefix must be passed together (e.g. --count 3 --prefix ada).");
+                }
+                // The vendor stamps a first/last name on every mailbox, so there is no
+                // name-less order shape to fall back on — the shorthand invents
+                // placeholders rather than pretending names are optional. Anyone who
+                // wants real human identities on the inboxes passes --mailboxes/--file.
+                const base = prefix.toLowerCase();
+                const label = `${base.charAt(0).toUpperCase()}${base.slice(1)}`;
+                mailboxes = Array.from({ length: count }, (_entry, index) => ({
+                    username: `${base}${index + 1}`,
+                    first_name: label,
+                    last_name: String(index + 1),
+                }));
+            }
+            else {
+                throw new Error("Provide --mailboxes <json>, --file <path>, or --count <n> --prefix <base>.");
+            }
+            const quote = readOption(options.quote);
+            // Refuse locally rather than spending a round trip on a PAID path: the
+            // route requires the quote that priced this exact expansion, so
+            // `--approved` alone can only ever come back as a 400.
+            if (options.approved && !quote) {
+                // Typed, not a bare Error: a bare throw surfaces as
+                // `unexpected_error`, which an agent cannot tell apart from a
+                // real failure on a PAID command. Refusing to order is an
+                // ordinary, expected outcome and must say so in its code.
+                throw new OxygenError("invalid_request", "--approved requires --quote <id> from a fresh preview. Re-run without --approved to get one.", { exitCode: 2 });
+            }
+            return requestOxygen(`/api/cli/managed-inboxes/${encodeURIComponent(domain)}/mailboxes`, {
+                method: "POST",
+                body: {
+                    // Always an explicit mailboxes[]: --count/--prefix is client-side
+                    // sugar, so the server sees exactly one shape and the preview it
+                    // prices is the list that gets ordered.
+                    mailboxes,
+                    ...(options.approved ? { approved: true } : {}),
+                    ...(quote ? { quote_id: quote } : {}),
+                },
+            });
+        });
     }))
         .addCommand(new Command("list")
         .description("List the org's managed inbox orders: vendor, platform, live inbox count, lifecycle status, internal billing posture, and each order's FULL monthly cost — the inbox line plus the warm-up and inbox-placement add-ons billing per inbox on top of it (`orders[].total_monthly_credits`, `total_monthly_credits` across the workspace). Read-only, 0 Oxygen credits.")
@@ -11982,7 +12198,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     program.addCommand(new Command("mailboxes")
         .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local Hypertide transfer), pause/disable inboxes, connect EmailGuard monitoring, and run managed TrulyInbox warmup with explicit plans and credit caps. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
         .addCommand(new Command("list")
-        .description("List the org's sending mailboxes with provider, status, warmup state, and a pool overview.")
+        .description("List the org's sending mailboxes with provider, status, warmup state, source (managed = bought through Oxygen, byok = bring-your-own), and a pool overview (including counts by source).")
         .option("--status <status>", "Filter by status: active, paused, or disabled.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -11996,7 +12212,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("get")
-        .description("Get one sending mailbox's detail (provider, status, daily cap, warmup state, auth mode) plus a one-row pool summary. An ineligible native-send transport includes transport_reason + transport_hint; it does not by itself block TrulyInbox warmup or EmailGuard monitoring. <mailbox> accepts a mailbox id or email address.")
+        .description("Get one sending mailbox's detail (provider, status, daily cap, warmup state, auth mode, and source — managed vs bring-your-own) plus a one-row pool summary. An ineligible native-send transport includes transport_reason + transport_hint; it does not by itself block TrulyInbox warmup or EmailGuard monitoring. <mailbox> accepts a mailbox id or email address.")
         .argument("<mailbox>", "Mailbox id or email address.")
         .option("--json", "Print a JSON envelope.")
         .action(async (mailbox, options) => {
@@ -12009,7 +12225,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("mailboxes health", options, () => requestOxygen("/api/cli/mailboxes/health"));
     }))
         .addCommand(new Command("compatibility")
-        .description("Read-only compatibility report for every selected mailbox: origin vendor, real infrastructure tier (including InboxKit Azure), mailbox auth, TrulyInbox warmup path, EmailGuard monitoring path, and the exact next action. Use --catalog-only for the compact, workspace-independent import contract with no mailbox rows. JSON data.compatibility contains checked mailbox rows; data.provider_matrix always contains the complete current 18-pair product matrix even when mailboxes are filtered; data.import_methods and data.import_fields describe every supported ingestion path; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. States distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
+        .description("Read-only compatibility report for every selected mailbox: origin vendor, real infrastructure tier (including InboxKit Azure), OXYGEN native-send connection quality, TrulyInbox warmup path, EmailGuard monitoring path, and exact next actions. Native send distinguishes destination-bound OAuth, provider-managed API transport, admin delegation, and authorization_required. Use --catalog-only for the compact workspace-independent import contract. JSON data.compatibility contains checked rows; data.import_methods and data.import_fields describe accepted transfer inputs; data.provider_matrix is the complete current 18-pair product matrix; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. Downstream states distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--catalog-only", "Return only the bounded import-method, field, auth-boundary, and 18-pair provider catalogs; do not read or return workspace mailbox rows.")
         .option("--json", "Print a JSON envelope.")
@@ -12242,16 +12458,16 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("connect-oauth")
-        .description("Zapmail- or InboxKit-provisioned pools — not Hypertide imports. Preview native OAuth provisioning by default; pass --approved after reviewing the mailbox/domain scope to start external vendor writes. A successful preview describes the requested scope and safety envelope; it can still contain zero eligible mailboxes or only already-authorized no-ops. For InboxKit, first confirm mailboxes oauth-health returns remedy connect_oauth_inboxkit, then use mailboxes compatibility --mailboxes <list> to verify origin and auth state. --vendor zapmail (default) hands the pool to Zapmail's Custom OAuth export; --vendor inboxkit requests Workspace-admin consent per mailbox, but only for domains where Oxygen's OAuth client id is already approved — an unapproved domain sends no mailbox consent, and a domain that has never connected a mailbox fires one canary until it lands (--no-canary to fan out immediately). Manual InboxKit live requests are capped at 10 potential mailbox consent writes; use --mailboxes to split wider proven-domain or no-canary scopes. Newly provisioned InboxKit mailboxes are retried by the durable worker. This authorization action uses 0 Oxygen credits; existing vendor or subscription billing is unchanged. Pass --status <id> to poll.")
+        .description("Connect Google/Microsoft mailboxes to OXYGEN native send with fresh destination-bound OAuth. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen handles imported, Hypertide, external, or manual mailboxes: it requires an exact list (max 10), returns one OXYGEN browser link per candidate, and stores a grant only after that exact mailbox completes provider consent/MFA. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. --vendor zapmail (default) hands a provisioned pool to Zapmail Custom OAuth; --vendor inboxkit requests domain-gated consent with one canary on unproven domains and a 10-write live cap. All paths cost 0 Oxygen credits. Poll --status <id>; connected means an encrypted refresh token actually landed, never merely that a request was accepted.")
         .option("--provider <provider>", "Mailbox provider to provision: google or microsoft.")
-        .option("--vendor <vendor>", "Which provisioning path to use: zapmail (default) or inboxkit.")
-        .option("--mailboxes <list>", "Comma-separated mailbox addresses to provision. Omit for the whole pool; manual InboxKit live runs must resolve to at most 10 potential consent writes.")
+        .option("--vendor <vendor>", "Authorization path: oxygen for imported/manual mailboxes, zapmail (default), or inboxkit.")
+        .option("--mailboxes <list>", "Comma-separated mailbox addresses. Required for vendor=oxygen (max 10); omit for vendor-provisioned whole-pool flows.")
         .option("--domains <list>", "Comma-separated sending domains to limit an inboxkit run to. Omit to cover every domain in the pool.")
         .option("--no-canary", "inboxkit only: fan out to every eligible mailbox on a domain that has never connected one, instead of firing a single canary first.")
         .option("--connection <id>", "Zapmail connection id. Defaults to the org's active Zapmail connection.")
-        .option("--status <id>", "Poll a previously started run (Zapmail export id or InboxKit run id) instead of starting a new one.")
+        .option("--status <id>", "Poll a previously started Zapmail, InboxKit, or OXYGEN direct-consent run.")
         .option("--dry-run", "Preview the requested mailbox/domain scope and external writes without changing vendor or ledger state. This is the default for starts; a successful preview can still have zero eligible mailboxes, so check InboxKit candidates with oauth-health before approval.")
-        .option("--approved", "Start live vendor OAuth provisioning after inspecting the dry-run preview.")
+        .option("--approved", "Start the reviewed authorization run. For vendor=oxygen this records expiring browser steps; provider consent still occurs only when the user opens each link.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("mailboxes connect-oauth", options, () => {
@@ -12295,7 +12511,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("oauth-health")
-        .description("Show the delegation-stuck sending mailboxes across both transports (google and microsoft): every inbox still on auth_mode=delegation with no OAuth grant, each naming the remedy that applies (connect_oauth for Zapmail-linked rows, connect_oauth_inboxkit for InboxKit-provisioned ones, domain_delegation for the rest) and, for Zapmail rows, its Custom OAuth budget (attempts in the last 7 days, remaining re-export posts before Zapmail's 3-per-mailbox-per-7-day cap, last error, and next safe retry time). Read-only — 0 Oxygen credits.")
+        .description("Show every Google/Microsoft inbox with neither a per-mailbox OAuth token nor covered Google delegation. Remedies are connect_oauth for Zapmail, connect_oauth_inboxkit for InboxKit, and connect_oauth_oxygen for imported/manual mailboxes. Zapmail rows include their 3-per-7-day export budget; OXYGEN direct rows require exact browser consent and may invoke provider MFA. Read-only — 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("mailboxes oauth-health", options, () => requestOxygen("/api/cli/mailboxes/oauth-health"));
@@ -13225,7 +13441,8 @@ Run completion:
                 params.set("tag", tag);
             const qs = params.toString() ? `?${params.toString()}` : "";
             const data = await requestOxygen(`/api/cli/workflows${qs}`);
-            writeDisabledWorkflowNotices(data);
+            if (!options.json)
+                writeDisabledWorkflowNotices(data);
             return data;
         });
     }))
@@ -13240,7 +13457,8 @@ Run completion:
                 method: "POST",
                 body: { workflow },
             });
-            writeDisabledWorkflowNotices(data);
+            if (!options.json)
+                writeDisabledWorkflowNotices(data);
             return prepareWorkflowCliOutput(data, options);
         });
     }))
@@ -13735,11 +13953,28 @@ Run completion:
         .command("skills")
         .description("Agent skill discovery and installation commands.")
         .addCommand(new Command("list")
-        .description("List Oxygen agent skills available from the public skill index.")
+        .description("List Oxygen agent skills available from the hosted skill index.")
         .option("--api-url <url>", "Oxygen app URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("skills list", options, () => listAgentSkills(options));
+    }))
+        .addCommand(new Command("search")
+        .description("Find a bounded set of Oxygen skills and matching documents from an outcome.")
+        .argument("<query...>", "Outcome, primitive, provider, or operating task.")
+        .option("--limit <n>", "Maximum results (default 5, max 10).")
+        .option("--api-url <url>", "Oxygen app URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (queryParts, options) => {
+        await handleAsyncAction("skills search", options, () => searchAgentSkills(queryParts.join(" "), options));
+    }))
+        .addCommand(new Command("get")
+        .description("Hydrate one exact Oxygen skill entrypoint and its document index.")
+        .argument("<skill-name>", "Exact name returned by skills search.")
+        .option("--api-url <url>", "Oxygen app URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (skillName, options) => {
+        await handleAsyncAction("skills get", options, () => getAgentSkill(skillName, options));
     }))
         .addCommand(new Command("doctor")
         .description("Check Oxygen skill index reachability and local installer prerequisites.")

package/dist/skills.d.ts

@@ -14,6 +14,10 @@ export type SkillsListOptions = {
     json?: boolean;
     apiUrl?: string;
 };
+export type SkillsSearchOptions = SkillsListOptions & {
+    limit?: string;
+};
+export type SkillsGetOptions = SkillsListOptions;
 export type SkillsDoctorOptions = {
     json?: boolean;
     apiUrl?: string;
@@ -58,6 +62,8 @@ export declare function resolveSkillsInstallSource(options: {
     apiUrl: string;
 } & SkillsSourceRuntime): Promise<SkillsInstallSource>;
 export declare function listAgentSkills(options: SkillsListOptions, runtime?: SkillsSourceRuntime): Promise<Record<string, unknown>>;
+export declare function searchAgentSkills(query: string, options: SkillsSearchOptions, runtime?: SkillsSourceRuntime): Promise<Record<string, unknown>>;
+export declare function getAgentSkill(skillName: string, options: SkillsGetOptions, runtime?: SkillsSourceRuntime): Promise<Record<string, unknown>>;
 export declare function doctorAgentSkills(options: SkillsDoctorOptions, runtime?: SkillsSourceRuntime): Promise<Record<string, unknown>>;
 export declare function installAgentSkills(// skipcq: JS-R1005
 options: SkillsInstallOptions, runtime?: {