@oxygen-agent/cli 1.632.3 → 1.662.0

package/dist/index.js

@@ -9,7 +9,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, CommanderError, Option } from "commander";
 import { applyOxygenHelp } from "./help.js";
 import { buildCommandManifest, getCommandManifestEntry, searchCommandManifest, suggestCommandNames, } from "./command-manifest.js";
-import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, exitCodeForOxygenError, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
+import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { TAG_COLORS } from "@oxygen/shared/select-options";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, } from "@oxygen/shared/file-import";
 import { assertRecipeBundleSafe, assertWorkflowGraphManifest, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowGraphManifest, isWorkflowManifest, } from "@oxygen/workflows";
@@ -58,6 +58,115 @@ function tagRegistryBody(options) {
         body.pinned = false;
     return body;
 }
+// --- Collaboration: comments + approvals (Control layer) ---------------------
+//
+// EVERY enumeration below is mapped over a shared total map in
+// @oxygen/shared/collab.ts — never typed out here. A blind-user eval found
+// `tags --help` advertising 7 of the 13 taggable kinds because the prose sat
+// beside a hand-maintained marker map and drifted; six kinds were invisible
+// from the one place a user looks. The collab maps are total over their key
+// type, so adding a subject kind or a gate is a compile error until it is
+// glossed, and the moment it compiles it is already in this help text.
+/** `--on` / `--path` help, shared by every command that addresses a subject. */
+const COLLAB_SUBJECT_REF_HELP = `Subject as "<kind>:<id>" — e.g. sequence:9f1c2b7e. Kinds: ${COLLAB_SUBJECT_KINDS.join(", ")}.`;
+/** What a thread on each kind is usually about, for the group descriptions. */
+const COLLAB_SUBJECT_GLOSS = COLLAB_SUBJECT_KINDS
+    .map((kind) => `${kind} (${COLLAB_SUBJECT_PROSE[kind]})`)
+    .join("; ");
+/** Every gate, what it means, and which kinds it can be required on. */
+const COLLAB_GATE_GLOSS = COLLAB_GATE_KINDS
+    .map((gate) => `${gate} — ${COLLAB_GATE_PROSE[gate]}; set it on ${GATE_KIND_SUBJECTS[gate]
+    .map((kind) => COLLAB_SUBJECT_LABELS[kind].many)
+    .join(" or ")}`)
+    .join(". ");
+const COLLAB_GATE_FLAG_HELP = `Which gate: ${COLLAB_GATE_KINDS.join(" | ")}. ${COLLAB_GATE_GLOSS}.`;
+const COLLAB_SUBJECT_PATH_HELP = `Narrow to a sub-object: ${SUBJECT_PATH_FORMS_PROSE}.`;
+/**
+ * Both group descriptions end with this, because a surface that is one release
+ * old should say so where a user meets it. Beta here means exactly what it means
+ * for Agents, the Knowledge Graph, and Recipes: WEB NAV VISIBILITY. Nothing
+ * about the gate, the client role, or credit rules is softened by the toggle,
+ * and this command group is reachable at either setting — which is what keeps a
+ * gate armed from the terminal answerable from the terminal.
+ */
+const COLLAB_BETA_NOTE = "BETA: the /collab entry appears in the web sidebar once a workspace enables Settings -> Beta features; "
+    + "these commands, the gate, and the client role behave identically either way.";
+/**
+ * Parse `--on <kind>:<id>`. Client-side so a typo costs no round trip and the
+ * error can list every legal kind — `parseSubjectRef` already throws a typed
+ * `invalid_subject_ref` (exit 2) carrying `details.valid_kinds`.
+ */
+function requireCollabSubject(value) {
+    const raw = readOption(value);
+    if (!raw) {
+        throw new OxygenError("invalid_subject_ref", `--on is required. ${COLLAB_SUBJECT_REF_HELP}`, {
+            details: { valid_kinds: [...COLLAB_SUBJECT_KINDS] },
+            exitCode: 2,
+        });
+    }
+    return parseSubjectRef(raw);
+}
+/** Validate and canonicalize `--path`; undefined when the flag was not passed. */
+function readCollabPath(value) {
+    const raw = readOption(value);
+    return raw ? formatSubjectPath(parseSubjectPath(raw)) : undefined;
+}
+function requireCollabGate(value) {
+    const raw = readOption(value);
+    const gate = COLLAB_GATE_KINDS.find((candidate) => candidate === raw);
+    if (!gate) {
+        throw new OxygenError("invalid_request", `--gate must be one of: ${COLLAB_GATE_KINDS.join(", ")}. ${COLLAB_GATE_GLOSS}.`, {
+            details: { gate: raw, valid_gate_kinds: [...COLLAB_GATE_KINDS] },
+            exitCode: 2,
+        });
+    }
+    return gate;
+}
+function requireCollabSubjectKind(value) {
+    const raw = readOption(value);
+    const kind = COLLAB_SUBJECT_KINDS.find((candidate) => candidate === raw);
+    if (!kind) {
+        throw new OxygenError("invalid_subject_ref", `--default must be one of: ${COLLAB_SUBJECT_KINDS.join(", ")}.`, {
+            details: { subject_kind: raw, valid_kinds: [...COLLAB_SUBJECT_KINDS] },
+            exitCode: 2,
+        });
+    }
+    return kind;
+}
+/**
+ * At least one assignee. Commander cannot enforce this (the repeatable
+ * collector's `[]` default satisfies its mandatory check), and a request with
+ * nobody on it is the exact failure the API refuses to create: it looks filed,
+ * blocks the gate, and is discovered the next morning.
+ */
+function requireCollabAssignees(values) {
+    const assignees = values.map((value) => value.trim()).filter(Boolean);
+    if (assignees.length === 0) {
+        throw new OxygenError("invalid_request", "--assignee <email> is required: name at least one workspace member who can decide.", { exitCode: 2 });
+    }
+    return assignees;
+}
+/**
+ * Exactly one of --approve / --reject / --changes-requested. Neither zero nor
+ * two is guessable: `changes_requested` is a real decision that does NOT open
+ * the gate, so silently defaulting either way would either stall a campaign or
+ * launch one the client never agreed to.
+ */
+function requireCollabDecision(options) {
+    const selected = [];
+    if (options.approve)
+        selected.push("approve");
+    if (options.reject)
+        selected.push("reject");
+    if (options.changesRequested)
+        selected.push("changes_requested");
+    if (selected.length !== 1) {
+        throw new OxygenError("invalid_request", selected.length === 0
+            ? "Pass exactly one decision: --approve, --reject, or --changes-requested (asks for edits; does NOT open the gate)."
+            : `Pass only one decision flag — got ${selected.length}: --approve, --reject, and --changes-requested are mutually exclusive.`, { details: { decisions_passed: selected }, exitCode: 2 });
+    }
+    return selected[0];
+}
 function buildFindBody(capability, options) {
     const body = { capability };
     const set = (key, value) => {
@@ -667,6 +776,28 @@ function writeMaxCreditsHint(error) {
             return;
         }
         case "approval_required": {
+            // A COLLABORATION gate reuses this code but is not a spend gate: no flag
+            // on this command can unblock it, because the whole point is that a
+            // second party decides. Printing the "--approved --max-credits" hint here
+            // would send the operator hunting for a flag that does not exist, so the
+            // gate branch runs first and prints the command the OTHER person runs.
+            const gateKind = readDetailsString(error.details, "gate_kind");
+            if (gateKind) {
+                const nextStep = readDetailsString(error.details, "next_step");
+                process.stderr.write(`hint: blocked by the ${gateKind} approval gate — ${nextStep ?? "ask an assignee to decide it"}\n`);
+                const lastDecision = isRecord(error.details) && isRecord(error.details.last_decision)
+                    ? error.details.last_decision
+                    : null;
+                if (lastDecision) {
+                    const note = readDetailsString(lastDecision, "note");
+                    process.stderr.write(`hint: the last answer was ${readDetailsString(lastDecision, "status") ?? "recorded"}${note ? ` — "${note}"` : ""}; revise, then ask again\n`);
+                }
+                const requestUrl = readDetailsString(error.details, "pending_request_web_url")
+                    ?? readDetailsString(error.details, "subject_web_url");
+                if (requestUrl)
+                    process.stderr.write(`hint: ${requestUrl}\n`);
+                return;
+            }
             if (error.message.startsWith("Public replies require --approved")) {
                 process.stderr.write("hint: inspect the exact preview, then re-run with its --content-hash <sha256> and --approved\n");
                 return;
@@ -705,6 +836,12 @@ function readDetailsNumber(details, key) {
     const value = details[key];
     return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
+function readDetailsString(details, key) {
+    if (!isRecord(details))
+        return null;
+    const value = details[key];
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}
 function parseJsonArray(value) {
     let parsed;
     try {
@@ -888,9 +1025,9 @@ const MAILBOX_IMPORT_ROW_LIMIT = 500;
  * Normalize common mailbox-vendor export labels locally, then send only
  * Oxygen's canonical fields. Passwords are accepted only in credential mode
  * and only become Google app passwords; Microsoft passwords are dropped because
- * tenant consent is its only warmup path. OAuth grants, MFA/TOTP seeds, and
- * delegation keys are rejected in every mode. Host columns may prove the
- * provider but never cross the request boundary.
+ * one Outlook OAuth consent per mailbox is its only warmup path. OAuth grants,
+ * MFA/TOTP seeds, and delegation keys are rejected in every mode. Host columns
+ * may prove the provider but never cross the request boundary.
  */
 function normalizeMailboxExportRow(row, index, mode) {
     const byHeader = new Map();
@@ -1435,6 +1572,17 @@ function buildCrmPhotosBody(options) {
         ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
     };
 }
+function buildCrmRollupBody(options) {
+    const object = readOption(options.object);
+    const row = readOption(options.row);
+    const limit = readOption(options.limit);
+    return {
+        mode: resolveLiveDryRunMode(options),
+        ...(object ? { object } : {}),
+        ...(row ? { row } : {}),
+        ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
+    };
+}
 function readCrmSetupObjects(value) {
     const objects = readCsvOption(value);
     return objects.length > 0 ? [...new Set(objects)] : DEFAULT_CRM_SETUP_OBJECTS;
@@ -2040,8 +2188,14 @@ function buildPublishingAnalyticsPath(base, params) {
     return suffix ? `${base}?${suffix}` : base;
 }
 function buildPublishingCommentsListPath(options) {
+    const view = readOption(options.view);
+    const status = readOption(options.status);
+    if (view && status) {
+        throw new OxygenError("conflicting_flags", "Pass either --view or --status, not both.", { exitCode: 1 });
+    }
     return buildPublishingAnalyticsPath("/api/cli/publishing/comments", {
-        status: readOption(options.status),
+        view,
+        status,
         post_id: readOption(options.post),
         assignee: readOption(options.assignee),
         channel: readOption(options.channel),
@@ -2511,6 +2665,7 @@ function buildPromptTemplatesCommand(surface, description) {
 export function createProgram() {
     const program = new Command();
     const binaryName = resolveCliBinaryName();
+    const directoryDocsUrl = `${defaultApiUrl()}/docs/agencies`;
     program
         .name(binaryName)
         .description("Revenue infrastructure for B2B startups — agent-operated GTM: tables, enrichment, sequences, workflows, CRM, knowledge. MCP + CLI first; every state-changing action returns a web_url deep-link.")
@@ -2774,7 +2929,7 @@ export function createProgram() {
     });
     program
         .command("orgs")
-        .description("Organization selection commands.")
+        .description("Switch between the organizations (workspaces) you belong to, and share one paid plan across them. If this workspace has no plan of its own, `orgs billing-link` puts it on a plan you already pay for somewhere else instead of buying a second subscription.")
         .addCommand(new Command("list")
         .description("List organizations available to the current CLI identity.")
         .option("--json", "Print a JSON envelope.")
@@ -2794,30 +2949,43 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (organization, options) => {
         await handleOrgUseAction(organization, options, "orgs select");
+    }))
+        .addCommand(new Command("billing-owners")
+        .description("List the organizations that could pay for this workspace: which of the organizations you belong to can cover another workspace's credits, and for each of the rest, why it cannot. Read-only, 0 Oxygen credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("orgs billing-owners", options, () => requestOxygen("/api/cli/orgs/billing-owners"));
     }))
         .addCommand(new Command("billing-link")
-        .description("Bill a workspace through another organization you administer.")
-        .requiredOption("--owner <organization>", "Billing owner organization id, Clerk org id, or slug.")
+        .description("Cover a workspace with a plan you already pay for in another organization (one plan, many workspaces) instead of buying a second subscription. Omit --owner when exactly one of your organizations can pay and Oxygen will use it; `orgs billing-owners` lists them all. Credit billing moves, workspace data access does not.")
+        .option("--owner <organization>", "Billing owner organization id, Clerk org id, or slug. Optional — when omitted, Oxygen uses your one eligible organization, and refuses to pick if there is more than one.")
         .option("--organization <organization>", "Workspace organization to link. Defaults to the active organization.")
         .option("--organization-id <id>", "Alias for --organization.")
-        .option("--monthly-credit-cap <credits>", "Optional monthly credit cap for this workspace.")
+        .option("--monthly-credit-cap <credits>", "Optional monthly credit cap for this workspace. Omit it to leave any existing cap untouched.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("orgs billing-link", options, () => requestOxygen("/api/cli/orgs/billing-link", {
-            method: "POST",
-            body: {
-                billing_owner_organization_id: readOption(options.owner),
-                ...(readOption(options.organization) || readOption(options.organizationId)
-                    ? { organization_id: readOption(options.organization) ?? readOption(options.organizationId) }
-                    : {}),
-                ...(readOption(options.monthlyCreditCap)
-                    ? { monthly_credit_cap: readPositiveNumber(options.monthlyCreditCap) }
-                    : {}),
-            },
-        }));
+        await handleAsyncAction("orgs billing-link", options, async () => {
+            const billingOwner = readOption(options.owner) ?? await resolveSoleBillingOwnerRef();
+            return requestOxygen("/api/cli/orgs/billing-link", {
+                method: "POST",
+                body: {
+                    billing_owner_organization_id: billingOwner,
+                    ...(readOption(options.organization) || readOption(options.organizationId)
+                        ? { organization_id: readOption(options.organization) ?? readOption(options.organizationId) }
+                        : {}),
+                    // The key is omitted, never sent as null, when the flag is
+                    // absent: the server treats a present key as an explicit write,
+                    // so sending it unconditionally would wipe an agency's
+                    // per-client cap on every re-link.
+                    ...(readOption(options.monthlyCreditCap)
+                        ? { monthly_credit_cap: readPositiveNumber(options.monthlyCreditCap) }
+                        : {}),
+                },
+            });
+        });
     }))
         .addCommand(new Command("billing-unlink")
-        .description("Return a workspace to owning its own billing.")
+        .description("Return a workspace to owning its own billing: it stops being covered by another organization's plan and needs a subscription of its own again.")
         .option("--organization <organization>", "Workspace organization to unlink. Defaults to the active organization.")
         .option("--organization-id <id>", "Alias for --organization.")
         .option("--json", "Print a JSON envelope.")
@@ -3316,7 +3484,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }));
     program
         .command("publishing")
-        .description("Social publishing, performance, and public-comment operations.")
+        .description("Social publishing, performance, and public-comment operations. Start Community triage with `oxygen publishing comments list --view unanswered --json`.")
         .addCommand(new Command("mentions")
         .description("Resolve LinkedIn identities for a publish-faithful post preview.")
         .addCommand(new Command("resolve")
@@ -3644,10 +3812,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     })))
         .addCommand(new Command("comments")
-        .description("Public comments on posts published through OXYGEN. These are network conversations, not workspace review notes. The local queue targets a six-hour background poll; provider quota/backoff can delay it, and list reports the exact freshness plus empty_queue_is_current. If that field is false, do not conclude there are no comments: wait for next_sync_at. The worker retries automatically; there is no manual retry by design because it could loop against LinkedIn quota. Queue reads use 0 credits and make no provider call; only explicit approval can post a public reply.")
+        .description("Publishing Community for public comments on every recent post owned by a connected LinkedIn account, including posts created directly on LinkedIn. Start with `oxygen publishing comments list --view unanswered --json`. These are network conversations, not workspace review notes. The local queue targets a six-hour background discovery + comment poll; provider quota/backoff can delay it, and list reports the exact freshness plus empty_queue_is_current. If that field is false, do not conclude there are no comments: wait for next_sync_at. The worker retries automatically; there is no manual retry by design because it could loop against LinkedIn quota. Queue reads use 0 credits and make no provider call; only explicit approval can post a public reply.")
         .addCommand(new Command("list")
-        .description("List the local public-comment work queue, oldest first, with polling freshness/backoff even when empty. Defaults to LinkedIn comments needing a reply. Read-only: no provider call, 0 credits.")
-        .option("--status <status>", "Filter by needs_reply, draft, awaiting_approval, replied, resolved, ignored, spam, or action_unavailable.")
+        .description("List the Publishing Community work queue, oldest first, with polling freshness/backoff even when empty. Defaults to the Unanswered view: needs_reply, draft, awaiting_approval, and action_unavailable. All means every lifecycle state inside the rolling 30-day recent-owned-post scope, not lifetime LinkedIn history. Read-only: no provider call, 0 credits.")
+        .option("--view <view>", "Community view: unanswered (default) or all; all is bounded to recent owned posts.")
+        .option("--status <status>", "Advanced exact-state filter: needs_reply, draft, awaiting_approval, replied, resolved, ignored, spam, or action_unavailable. Cannot be combined with --view.")
         .option("--post <post_id>", "Only comments on one scheduled Publishing post.")
         .option("--assignee <actor>", "Only one actor id; pass me for your own assignments.")
         .option("--channel <channel>", "Social channel. Defaults to linkedin.")
@@ -3741,9 +3910,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     })))
         .addCommand(new Command("analytics")
-        .description("Engagement metrics the worker syncs back from the provider. Free reads. LinkedIn exposes reactions, comments, and reshares only — impressions, saves, and sends come back null, never zero.")
+        .description("Stored LinkedIn and X engagement snapshots synced in the background. LinkedIn includes owned posts discovered from the provider; X includes only posts published through OXYGEN. Reading analytics makes no provider call and uses 0 credits. A snapshotted post completed a sync pass; use per-metric coverage to see which values were populated. Null is unknown, never zero. Stale or pending snapshots retry automatically; no manual provider retry is available or needed.")
         .addCommand(new Command("summary")
-        .description("Workspace LinkedIn performance for posts published through OXYGEN. Uses each post's latest stored snapshot; unsupported metrics stay null. Read-only: no provider call, 0 credits.")
+        .description("Workspace LinkedIn or X analytics. LinkedIn includes owned posts discovered from the provider; X currently includes posts published through OXYGEN. Uses each post's latest stored snapshot; snapshotted_posts (legacy measured_posts) counts sync passes, while coverage counts non-null values. Read-only: no provider call, 0 credits.")
+        .option("--channel <channel>", "Channel to summarize: linkedin (default) or x.")
         .option("--range <range>", "Publication window: 7d, 30d (default), 90d, or 365d.")
         .option("--from <date>", "Custom inclusive UTC start date.")
         .option("--to <date>", "Custom inclusive UTC end date.")
@@ -3751,6 +3921,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("publishing analytics summary", options, () => requestOxygen(buildPublishingAnalyticsPath("/api/cli/publishing/analytics/summary", {
+            channel: readOption(options.channel),
             range: readOption(options.range),
             from: readOption(options.from),
             to: readOption(options.to),
@@ -3758,7 +3929,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         })));
     }))
         .addCommand(new Command("post")
-        .description("One post's stored daily metric series, totals, and earned-media value. EMV is impressions-derived, so on LinkedIn it returns null with an unavailable_reason instead of a made-up number. Read-only: no provider call, 0 credits.")
+        .description("One post's stored daily metric series, totals, and earned-media value. EMV is impressions-derived; absent impressions return a reason instead of a made-up number. Read-only: no provider call, 0 credits.")
         .argument("<post_id>", "Scheduled post id.")
         .option("--since <date>", "ISO date to start the series from.")
         .option("--json", "Print a JSON envelope.")
@@ -3785,7 +3956,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: { cpm: parseJsonObject(options.cpmJson ?? "") },
         }));
-    })))
+    }))
+        .addHelpText("after", "\nExample (stored X snapshots, 0 credits, no provider call):\n  oxygen publishing analytics summary --channel x --range 30d --json\n"))
         .addCommand(new Command("import")
         .description("Bulk-load scheduled posts from a .csv or .json file. Dry-run by DEFAULT: it parses, lints, and reports invalid rows while writing nothing. Pass --approved to actually write. Imported posts land as drafts that still need approval — import never approves and never publishes. A row whose idempotency_key was already used is skipped, so re-importing the same file cannot duplicate the queue.")
         .requiredOption("--file <path>", "Path to a .csv (header row) or .json file ([rows] or { rows: [...] }).")
@@ -3977,6 +4149,20 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: buildCrmPhotosBody(options),
         }));
+    }))
+        .addCommand(new Command("rollup")
+        .description("Recompute the Open Deal column on companies (and the copy stamped on their people) from this workspace's deals. It normally converges on every deal write; run this to repair after a bulk import, or on a workspace whose deals predate the column. Free: no provider calls, no credits. Defaults to dry-run.")
+        .option("--object <object>", "CRM object to recompute. Only companies today. Defaults to companies.")
+        .option("--row <id>", "Recompute one company record by row id instead of sweeping the object.")
+        .option("--limit <n>", "Maximum company rows to scan in one sweep. Defaults to 2000.")
+        .option("--dry-run", "Report how many companies disagree with their deals, without writing. A deal with no stage set is not an open deal and is excluded from the comparison, so a blank-stage deal is never reported as drift.")
+        .option("--live", "Write the recomputed Open Deal cells. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm rollup", options, () => requestOxygen("/api/cli/crm/rollup", {
+            method: "POST",
+            body: buildCrmRollupBody(options),
+        }));
     }))
         .addCommand(
     // `crm objects` lists (parent action runs when no subcommand matches);
@@ -5247,7 +5433,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         return requestOxygen(`/api/cli/tables/webhooks?${params.toString()}`);
     })))
         .addCommand(new Command("create")
-        .description("Create a direct webhook endpoint that writes inbound JSON into a table.")
+        .description("Create a direct webhook endpoint that writes inbound JSON into a table (600 requests/60s per endpoint and sender IP; 429 returns Retry-After).")
         .argument("<table>", "Table id or slug.")
         .option("--name <name>", "Display name for the webhook.")
         .option("--mode <mode>", "insert or upsert. Defaults to upsert when --upsert-key is set, otherwise insert.")
@@ -5257,6 +5443,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--event-id-path <path>", "Dot path to the event id. Defaults to event_id, eventId, id, or payload hash.")
         .option("--event-type-path <path>", "Dot path to the event type. Defaults to type or event.")
         .option("--occurred-at-path <path>", "Dot path to the event timestamp.")
+        .option("--source <source>", "http (default) writes inbound JSON anyone can POST. unipile subscribes the table to your connected LinkedIn/WhatsApp accounts' events instead — no endpoint URL, no secret to share, and 0 credits: rows appear as the events reach Oxygen.")
+        .option("--account <unipile_account_id>", "unipile source only. Listen to ONE connected account. Omit to listen to every connected account in the workspace.")
+        .option("--events <csv>", "unipile source only. Comma-separated event types, e.g. relation.new,message.new. Omit for every event the receiver handles. Post reactions, post comments, profile viewers and followers are NOT pushed by the provider — capture those with a scheduled feed (`oxygen feeds bind`).")
+        .option("--mapping <mapping>", "unipile source only. curated (default) flattens known events into stable named columns; passthrough lands the raw provider event so you can map any type yourself.")
         .option("--auto-run-columns <csv>", "Comma-separated enrichment, tool, AI, or formula columns to queue for webhook-written rows.")
         .option("--auto-run-max-credits <n>", "Credit ceiling per webhook-triggered auto-run batch; items beyond it are skipped with credit_limit_reached. Defaults to your plan's per-delivery ceiling when omitted.")
         .option("--auto-run-max-concurrency <n>", "Maximum concurrent row items for webhook-triggered auto-runs.")
@@ -5266,6 +5456,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action((table, options) => {
         const autoRun = readTableWebhookAutoRunOptions(options);
+        const unipile = readOption(options.source) === "unipile";
         return handleAsyncAction("tables webhook create", options, () => requestOxygen("/api/cli/tables/webhooks", {
             method: "POST",
             body: {
@@ -5278,6 +5469,14 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 ...(readOption(options.eventIdPath) ? { event_id_path: readOption(options.eventIdPath) } : {}),
                 ...(readOption(options.eventTypePath) ? { event_type_path: readOption(options.eventTypePath) } : {}),
                 ...(readOption(options.occurredAtPath) ? { occurred_at_path: readOption(options.occurredAtPath) } : {}),
+                ...(unipile
+                    ? {
+                        feed_kind: "unipile",
+                        ...(readOption(options.account) ? { unipile_account_id: readOption(options.account) } : {}),
+                        ...(readOption(options.events) ? { event_types: readOption(options.events) } : {}),
+                        ...(readOption(options.mapping) ? { mapping: readOption(options.mapping) } : {}),
+                    }
+                    : {}),
                 ...(autoRun ? { auto_run: autoRun } : {}),
             },
         }));
@@ -5319,7 +5518,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("List direct table webhook deliveries and auto-run enqueue status.")
         .argument("[endpoint_id]", "Optional webhook endpoint id, such as tw_...")
         .option("--table <table>", "Filter by table id or slug.")
-        .option("--status <status>", "Filter by received, completed, or failed.")
+        .option("--status <status>", "Filter by received, completed, failed, or rejected (rejected = arrived while the feed was paused and was turned away; no rows written).")
         .option("--auto-run-status <status>", "Filter by not_configured, queued, skipped, or failed_to_enqueue.")
         .option("--limit <n>", "Maximum deliveries to return. Defaults to 50.")
         .option("--json", "Print a JSON envelope.")
@@ -5602,7 +5801,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("List the shared table delivery ledger: pull-feed sync cycles and inbound webhook deliveries land in the same place. Filter by --table (the identifier `feeds list` gives you) or by a webhook endpoint id. Read-only.")
         .argument("[endpoint_id]", "Optional webhook endpoint id, such as tw_...")
         .option("--table <table>", "Table id or slug whose ledger to read.")
-        .option("--status <status>", "Filter by received, completed, or failed.")
+        .option("--status <status>", "Filter by received, completed, failed, or rejected (rejected = arrived while the feed was paused and was turned away; no rows written).")
         .option("--limit <n>", "Maximum deliveries to return. Defaults to 50.")
         .option("--json", "Print a JSON envelope.")
         .action((endpointId, options) => handleAsyncAction("feeds deliveries", options, () => requestOxygen(tableWebhookDeliveriesPath({
@@ -6197,6 +6396,258 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             body: { action: "delete", tags, ...(options.apply ? { apply: true } : {}) },
         }));
     }));
+    program
+        .command("comments")
+        .description(`Threaded comments on any workspace object — ${COLLAB_SUBJECT_KINDS_PROSE} — so the client's go/no-go stops living in a Google Doc. A comment is state ABOUT a GTM artifact, never the artifact: resolving a thread changes no campaign. Address the subject with --on <kind>:<id>, and one row, cell, or column of a table with --path row:<rowId>[#<columnKey>] | column:<columnKey>. Threads are open until somebody resolves them; any member may resolve. The thing that actually BLOCKS work is an approval gate — see \`oxygen approvals\`. What a thread is usually about, per kind: ${COLLAB_SUBJECT_GLOSS}. ${COLLAB_BETA_NOTE}`)
+        .addCommand(new Command("add")
+        .description("Comment on a workspace object. Without --reply this opens a NEW thread with this comment as its first; with --reply it answers inside the existing one. @email tokens in the body are resolved to workspace members and notified, so --mention is only needed for someone you did not name in the text.")
+        .argument("<body...>", "What you want to say. Quote it, or let the shell pass it as words.")
+        .requiredOption("--on <kind:id>", COLLAB_SUBJECT_REF_HELP)
+        .option("--path <path>", COLLAB_SUBJECT_PATH_HELP)
+        .option("--reply <id>", "Answer inside an existing thread. Pass a comment id to nest under it, or a thread id to reply at that thread's top level.")
+        .option("--mention <email>", "Notify a workspace member. Repeatable.", collectRepeatable, [])
+        .option("--title <text>", "Title for a NEW thread. Ignored when replying.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (body, options) => {
+        await handleCommentsAddAction(body.join(" "), options);
+    }))
+        .addCommand(new Command("list")
+        .description("Every comment thread on one object, newest first, with its comments inline. Defaults to open threads only.")
+        .requiredOption("--on <kind:id>", COLLAB_SUBJECT_REF_HELP)
+        .option("--path <path>", `${COLLAB_SUBJECT_PATH_HELP} Omit to see every thread on the object.`)
+        .option("--status <status>", "open (default), resolved, or all.")
+        .option("--limit <n>", "Maximum threads to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("comments list", options, () => {
+            const subject = requireCollabSubject(options.on);
+            const path = readCollabPath(options.path);
+            const params = new URLSearchParams({ subject: `${subject.kind}:${subject.id}` });
+            if (path)
+                params.set("path", path);
+            const status = readOption(options.status);
+            if (status)
+                params.set("status", status);
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            return requestOxygen(`/api/cli/collab/threads?${params.toString()}`);
+        }, formatCollabThreads);
+    }))
+        .addCommand(new Command("show")
+        .description("One thread by its own id, with every comment. This is what to run when all you have is the id out of a notification email or a `/collab/threads/<id>` link — `list` needs the object the thread hangs off, which that link does not tell you.")
+        .argument("<threadId>", "Thread id (from a notification email, a deep-link, or `oxygen comments list`).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (threadId, options) => {
+        await handleCollabAction("comments show", options, () => requestOxygen(`/api/cli/collab/threads/${encodeURIComponent(threadId)}`), 
+        // Same payload shape `comments list` returns, one thread long, so the
+        // renderer is the same one.
+        formatCollabThreads);
+    }))
+        .addCommand(new Command("resolve")
+        .description("Mark a thread settled, or reopen it with --reopen. Idempotent both ways: re-resolving keeps the original resolver and timestamp. This is conversation state only — it never unblocks an approval gate.")
+        .argument("<threadId>", "Thread id (from `oxygen comments list`).")
+        .option("--reopen", "Reopen a resolved thread instead of resolving it.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (threadId, options) => {
+        await handleCollabAction("comments resolve", options, () => requestOxygen(`/api/cli/collab/threads/${encodeURIComponent(threadId)}/resolve`, {
+            method: "POST",
+            body: { resolved: !options.reopen },
+        }), formatCollabWriteResult);
+    }))
+        .addCommand(new Command("edit")
+        .description("Rewrite one of your own comments. AUTHOR ONLY. The edit stamps edited_at — a thread that decided a launch is evidence, and evidence that changes without a trace is not evidence.")
+        .argument("<commentId>", "Comment id (from `oxygen comments list`).")
+        .argument("<body...>", "The replacement text.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (commentId, body, options) => {
+        await handleCollabAction("comments edit", options, () => requestOxygen(`/api/cli/collab/comments/${encodeURIComponent(commentId)}`, {
+            method: "PATCH",
+            body: { body: body.join(" ") },
+        }), formatCollabWriteResult);
+    }))
+        .addCommand(new Command("delete")
+        .description("Retract one of your own comments. AUTHOR ONLY, idempotent. The row stays so the thread remains a complete audit trail; the text is redacted on every read path.")
+        .argument("<commentId>", "Comment id (from `oxygen comments list`).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (commentId, options) => {
+        await handleCollabAction("comments delete", options, () => requestOxygen(`/api/cli/collab/comments/${encodeURIComponent(commentId)}`, {
+            method: "DELETE",
+        }), formatCollabWriteResult);
+    }));
+    program
+        .command("approvals")
+        .description(`Second-party approvals: ask a named person to decide, and optionally make that decision a hard gate on the live action. Gates: ${COLLAB_GATE_GLOSS}. Asking never blocks anything by itself — a gate is separate, admin-set workspace policy (\`approvals gate set\`), and the owning primitive honors it (a gated sequence still previews and dry-runs; only the live start is refused). Only \`--approve\` opens a gate: \`--changes-requested\` is a real answer that asks for edits and leaves the gate shut. \`approvals client grant <email>\` hands a client a restricted login that can read the work, comment, and decide what is assigned to them — nothing else. ${COLLAB_BETA_NOTE}`)
+        .addCommand(new Command("request")
+        .description("Ask a named second party to decide. Assignees are workspace member EMAILS, and never your own: assigning yourself is refused, because a request you can answer yourself is not an approval. An address that is not a member is refused by name rather than silently dropped, because a request nobody can decide is only discovered the next morning.")
+        .requiredOption("--on <kind:id>", COLLAB_SUBJECT_REF_HELP)
+        .requiredOption("--gate <gate>", COLLAB_GATE_FLAG_HELP)
+        // requiredOption keeps `required: true` in the machine-readable manifest,
+        // but commander's mandatory check is satisfied by the collector's []
+        // default — so the action asserts non-empty itself (requireCollabAssignees).
+        .requiredOption("--assignee <email>", "Who decides — someone other than you. Repeatable: any one of them can answer. Required.", collectRepeatable, [])
+        .option("--path <path>", COLLAB_SUBJECT_PATH_HELP)
+        .option("--title <text>", "Short headline for the ask.")
+        .option("--body <text>", "What you want them to check.")
+        .option("--expires-hours <n>", "Deadline for the ANSWER: an undecided request lapses to expired after N hours, and an expired request never opens the gate. It does not put a clock on a yes — an approval given before the deadline keeps the gate open until the approved content changes.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals request", options, () => {
+            const subject = requireCollabSubject(options.on);
+            const gateKind = requireCollabGate(options.gate);
+            const assignees = requireCollabAssignees(options.assignee);
+            const path = readCollabPath(options.path);
+            const title = readOption(options.title);
+            const body = readOption(options.body);
+            const expiresInHours = readPositiveInt(options.expiresHours);
+            return requestOxygen("/api/cli/collab/requests", {
+                method: "POST",
+                body: {
+                    subject_kind: subject.kind,
+                    subject_id: subject.id,
+                    ...(path ? { subject_path: path } : {}),
+                    gate_kind: gateKind,
+                    ...(title ? { title } : {}),
+                    ...(body ? { body } : {}),
+                    assignees,
+                    ...(expiresInHours !== undefined ? { expires_in_hours: expiresInHours } : {}),
+                },
+            });
+        }, formatCollabRequestWrite);
+    }))
+        .addCommand(new Command("list")
+        .description("Approval requests in this workspace, newest first. Use --mine for the ones assigned to you, or `approvals inbox` for the daily view.")
+        .option("--status <status>", `Filter by status: ${["pending", "approved", "changes_requested", "rejected", "cancelled", "expired"].join(", ")}.`)
+        .option("--mine", "Only requests assigned to you.")
+        .option("--on <kind:id>", `Only requests on one subject. ${COLLAB_SUBJECT_REF_HELP}`)
+        .option("--limit <n>", "Maximum requests to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals list", options, () => {
+            const params = new URLSearchParams();
+            const status = readOption(options.status);
+            if (status)
+                params.set("status", status);
+            if (options.mine)
+                params.set("assigned_to_me", "true");
+            const on = readOption(options.on);
+            if (on) {
+                const subject = requireCollabSubject(on);
+                params.set("subject", `${subject.kind}:${subject.id}`);
+            }
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            const query = params.toString();
+            return requestOxygen(`/api/cli/collab/requests${query ? `?${query}` : ""}`);
+        }, formatCollabRequestList);
+    }))
+        .addCommand(new Command("inbox")
+        .description("What is waiting on YOU: pending approvals assigned to you plus open threads that name you, each with the command that answers it. This is the surface a client logs in to.")
+        .option("--limit <n>", "Maximum items per section.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals inbox", options, () => {
+            const limit = readPositiveInt(options.limit);
+            return requestOxygen(`/api/cli/collab/inbox${limit !== undefined ? `?limit=${limit}` : ""}`);
+        }, formatCollabInbox);
+    }))
+        .addCommand(new Command("show")
+        .description("One approval request by its own id: what is being asked, on what, by whom, who must decide, and whether it can still be decided at all. Run this on the id in a 'you have been asked to approve' email or a `/collab/approvals/<id>` link — `list` cannot find an id you have no subject for. An expired request is reported as such, with the command that clears it.")
+        .argument("<requestId>", "Request id (from a notification email, a deep-link, or `oxygen approvals inbox`).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (requestId, options) => {
+        await handleCollabAction("approvals show", options, () => requestOxygen(`/api/cli/collab/requests/${encodeURIComponent(requestId)}`), formatCollabRequestDetail);
+    }))
+        .addCommand(new Command("decide")
+        .description("Answer a pending request. Exactly one of --approve / --reject / --changes-requested. Assignees decide; a workspace admin may decide for the workspace; the requester may NOT decide their own request (that is the whole point) — withdraw it with `approvals cancel` instead. ONLY --approve opens a gate.")
+        .argument("<requestId>", "Request id (from `oxygen approvals inbox`).")
+        .option("--approve", "Approve it. This is the only decision that opens a gate.")
+        .option("--reject", "Refuse it. The gate stays shut.")
+        .option("--changes-requested", "Ask for edits. A real answer that does NOT open the gate — the requester revises and asks again.")
+        .option("--note <text>", "Why. Stored on the request and quoted back to whoever is blocked by it.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (requestId, options) => {
+        await handleCollabAction("approvals decide", options, () => {
+            const decision = requireCollabDecision(options);
+            const note = readOption(options.note);
+            return requestOxygen(`/api/cli/collab/requests/${encodeURIComponent(requestId)}/decide`, {
+                method: "POST",
+                body: { decision, ...(note ? { note } : {}) },
+            });
+        }, formatCollabDecision);
+    }))
+        .addCommand(new Command("cancel")
+        .description("Withdraw a pending request you filed (or, as an admin, clear a stale one). Replaying a cancel is a success flagged `already`; cancelling something already approved or rejected is refused, because a silent no-op would leave you believing a live action is still gated when it is not.")
+        .argument("<requestId>", "Request id.")
+        .option("--note <text>", "Why you are withdrawing it.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (requestId, options) => {
+        await handleCollabAction("approvals cancel", options, () => {
+            const note = readOption(options.note);
+            return requestOxygen(`/api/cli/collab/requests/${encodeURIComponent(requestId)}/cancel`, {
+                method: "POST",
+                body: note ? { note } : {},
+            });
+        }, formatCollabWriteResult);
+    }))
+        .addCommand(new Command("gate")
+        .description("The opt-in hard gate. Off everywhere until an admin turns it on, so shipping this changed nobody's workflow.")
+        .addCommand(new Command("set")
+        .description(`Require (or stop requiring) an approval before the live action. ADMIN ONLY — a member who can switch the gate off at will is not a gate. Scope it to one object with --on, or to every object of a kind with --default. ${COLLAB_GATE_GLOSS}.`)
+        .option("--on <kind:id>", `Gate one object. ${COLLAB_SUBJECT_REF_HELP}`)
+        .option("--default <kind>", `Gate every object of a kind (the workspace default). One of: ${COLLAB_SUBJECT_KINDS.join(", ")}.`)
+        .requiredOption("--gate <gate>", COLLAB_GATE_FLAG_HELP)
+        .option("--required", "Turn the gate ON.")
+        .option("--not-required", "Turn the gate OFF.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals gate set", options, () => requestOxygen("/api/cli/collab/gates", {
+            method: "POST",
+            body: collabGateSetBody(options),
+        }), formatCollabGateSet);
+    }))
+        .addCommand(new Command("list")
+        .description("Which gates this workspace requires. Pass --on to also get the EFFECTIVE answer for one object — its own policy, then the workspace default for its kind, then 'not required' — plus whether it is blocked right now.")
+        .option("--on <kind:id>", `Also resolve the effective gates for one object. ${COLLAB_SUBJECT_REF_HELP}`)
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals gate list", options, () => {
+            const on = readOption(options.on);
+            if (!on)
+                return requestOxygen("/api/cli/collab/gates");
+            const subject = requireCollabSubject(on);
+            return requestOxygen(`/api/cli/collab/gates?subject=${encodeURIComponent(`${subject.kind}:${subject.id}`)}`);
+        }, formatCollabGateList);
+    })))
+        .addCommand(new Command("client")
+        .description("The restricted login an agency hands its client: read the work, comment on it, decide the approvals assigned to them, nothing else. ADMIN ONLY. Invite them to the workspace first — this grants the overlay on an existing membership.")
+        .addCommand(new Command("grant")
+        .description("Restrict a member to the client role.")
+        .argument("<email>", "Workspace member's email.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (email, options) => {
+        await handleCollabAction("approvals client", options, () => requestOxygen("/api/cli/collab/members/role", {
+            method: "POST",
+            body: { email, role: "client" },
+        }), formatCollabWriteResult);
+    }))
+        .addCommand(new Command("revoke")
+        .description("Clear the client role and restore full workspace access.")
+        .argument("<email>", "Workspace member's email.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (email, options) => {
+        await handleCollabAction("approvals client", options, () => requestOxygen("/api/cli/collab/members/role", {
+            method: "POST",
+            body: { email, role: null },
+        }), formatCollabWriteResult);
+    }))
+        .addCommand(new Command("list")
+        .description("Every member of this workspace and what they may do — the workspace role plus the Oxygen client overlay. Run it after a grant to see the change: this is the same read the /collab/members page renders.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals client list", options, () => requestOxygen("/api/cli/collab/members"), formatCollabMembers);
+    })));
     program
         .command("blueprints")
         .description("Scaffolding bundles: a workflow + tables + columns + prompts as shareable JSON. For guided GTM plays see `oxygen recipes`.")
@@ -6918,6 +7369,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         // doesn't mention visibility leaves it untouched.
         .option("--always-show", "Keep this column visible even when it holds no values.")
         .option("--no-always-show", "Stop pinning this column, so it collapses again while empty.")
+        .option("--hidden-by-default", "Leave this column out of the grid on first open. It stays readable everywhere else, and anyone can reveal it from the column menu.")
+        .option("--no-hidden-by-default", "Show this column in the grid on first open. Read the current opening set with `oxygen tables describe <table>` — every column reports its hiddenByDefault state.")
         .option("--dry-run", "Return the would-be merged definition without writing.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, column, options) => {
@@ -6963,6 +7416,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     ...(definitionUnset.length > 0 ? { definition_unset: definitionUnset } : {}),
                     ...(readOption(options.dataType) ? { data_type: readOption(options.dataType) } : {}),
                     ...(typeof options.alwaysShow === "boolean" ? { always_show: options.alwaysShow } : {}),
+                    ...(typeof options.hiddenByDefault === "boolean"
+                        ? { hidden_by_default: options.hiddenByDefault }
+                        : {}),
                     ...(options.dryRun ? { dry_run: true } : {}),
                 },
             });
@@ -8176,14 +8632,15 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     program
         .command("directory")
         .description("Manage this organization's public OXYGEN agency directory listing.")
+        .addHelpText("after", `\nDocs: ${directoryDocsUrl}\n`)
         .addCommand(new Command("get")
-        .description("Read the listing, its publish state, and its public/settings deep-links.")
+        .description("Read-only, 0 credits. Read the listing, publish state, and public/settings deep-links.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("directory get", options, () => requestOxygen("/api/cli/directory/listing"));
     }))
         .addCommand(new Command("update")
-        .description("Update listing profile fields. Only invited organizations can edit.")
+        .description("Update listing fields. Changes to a published listing are public immediately. Only invited organizations can edit.")
         .option("--name <text>", "Agency display name.")
         .option("--slug <slug>", "Public URL slug (lowercase letters, digits, dashes).")
         .option("--logo-url <url>", "Logo image URL.")
@@ -8214,7 +8671,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("publish")
-        .description("Publish the listing to the public directory at https://oxygen-agent.com/agencies.")
+        .description("Publish at https://oxygen-agent.com/agencies. Requires a tagline, description, and at least one contact method (website, booking link, email, or LinkedIn).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("directory publish", options, () => requestOxygen("/api/cli/directory/listing/publish", { method: "POST", body: {} }));
@@ -8501,11 +8958,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("approvals")
-        .description("List everything waiting for a human decision across workflows, publishing, message reviews, and inbox reply drafts — the cross-primitive approvals inbox. Read-only: each item includes the exact command to resolve it and a web link to decide.")
+        .description("List everything waiting for a human decision across workflows, publishing, message reviews, inbox reply drafts, and collaboration approval requests — the cross-primitive approvals inbox. Read-only: each item includes the exact command to resolve it and a web link to decide.")
         // Keep --source values in sync with OBSERVABILITY_APPROVAL_SOURCES in
         // apps/web/src/lib/observability-console.ts and the MCP tool enum. The API
         // rejects any other value with invalid_request so a typo fails loudly.
-        .option("--source <sources>", "Comma-separated sources: workflow, publishing, message_review, inbox_draft.")
+        .option("--source <sources>", "Comma-separated sources: workflow, publishing, message_review, inbox_draft, collab_request.")
         .option("--limit <n>", "Maximum items per source (default 25, max 100). Counts reflect the returned page only.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -9616,6 +10073,24 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const params = new URLSearchParams({ integration_id: integrationId });
             return requestOxygen(`/api/cli/integrations/composio/actions?${params.toString()}`);
         });
+    }))
+        .addCommand(new Command("destinations")
+        .description("List where a connected integration can send — for Microsoft Teams, the teams you belong to, and one team's channels with --team-id. Free: these are read-only lookups, so no approval or credit cap is needed.")
+        .argument("<integration_id>", "Integration id. Supported: 'microsoft_teams'.")
+        .option("--team-id <id>", "List this team's channels as well as your teams.")
+        .option("--connection-id <id>", "Use a specific connection when several are active.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (integrationId, options) => {
+        await handleAsyncAction("integrations destinations", options, () => {
+            const params = new URLSearchParams({ integration_id: integrationId });
+            const teamId = readOption(options.teamId);
+            if (teamId)
+                params.set("team_id", teamId);
+            const connectionId = readOption(options.connectionId);
+            if (connectionId)
+                params.set("connection_id", connectionId);
+            return requestOxygen(`/api/cli/integrations/destinations?${params.toString()}`);
+        });
     }))
         .addCommand(new Command("run")
         .description("Run an action for a connected integration — Composio toolkits and native providers alike.")
@@ -9819,7 +10294,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("senders limits get", options, () => requestOxygen(`/api/cli/senders/${encodeURIComponent(id)}/limits`));
     }))
         .addCommand(new Command("set")
-        .description("Adjust per-account daily action limits and the daily-reset timezone. Values are clamped to safe maximums (e.g. max 80 invites/day). Send windows (time of day) are set per sequence in the campaign schedule, not per account. <id> accepts a sender account id, connection id, or Unipile account id.")
+        .description("Adjust per-account daily action limits and the daily-reset timezone. Values are clamped to safe maximums (30 invites/day and 40 messages/day). Send windows (time of day) are set per sequence in the campaign schedule, not per account. <id> accepts a sender account id, connection id, or Unipile account id.")
         .argument("<id>", "Sender account id, connection id, or Unipile account id.")
         .option("--invites-per-day <n>", "Daily LinkedIn connection invites cap.")
         .option("--invites-per-week <n>", "Weekly LinkedIn connection invites cap.")
@@ -10053,10 +10528,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("posts")
-        .description("Read and publish LinkedIn posts through a connected account. `get`, `comments`, and `reactions` are LIVE provider reads: they use 0 Oxygen credits but consume the sender's daily account-read allowance. Do not use them when a task forbids provider calls; use `publishing comments list` for the local cross-post queue. `create` publishes a real post (approval-gated). Every command here addresses ONE post you already have an id for — Oxygen cannot enumerate an account's own LinkedIn history, so analytics only cover posts Oxygen itself published (`oxygen publishing ...`).")
+        .description("Read and publish LinkedIn posts through a connected account. `get`, `comments`, and `reactions` are LIVE provider reads: they use 0 Oxygen credits but consume the sender's daily account-read allowance. Do not use them when a task forbids provider calls; use `publishing comments list` for the local Community queue, which discovers recent posts owned by connected accounts in the background. `create` publishes a real post (approval-gated). The direct commands here address ONE post you already have an id for; aggregate analytics still cover posts Oxygen itself published (`oxygen publishing ...`).")
         .addCommand(new Command("get")
         .description("LIVE provider read of one LinkedIn post. Uses 0 Oxygen credits but consumes the sender's metered account-read allowance; do not run it when the task forbids provider calls. Returns the post and its composite social_id (reuse that social_id for `posts comments`, `posts reactions`, and `engagement harvest --source unipile` — NOT the raw activity URN). This does not populate or refresh the durable `publishing comments` queue.")
-        .requiredOption("--post <id>", "Numeric activity id, activity URL, or composite social_id. There is no way to LIST your own posts: take the id from the post's LinkedIn URL, or from a post you scheduled (`oxygen publishing posts get <post_id>` → provider_post_id).")
+        .requiredOption("--post <id>", "Numeric activity id, activity URL, or composite social_id. For a direct live read, take the id from the post's LinkedIn URL or a scheduled post (`oxygen publishing posts get <post_id>` → provider_post_id); Community discovers recent owned posts separately in the background.")
         .option("--account <ref>", "Sender account to read through (sender id, connection id, or Unipile account id). Omit for the org default.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -10154,7 +10629,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("engagement")
-        .description("Capture LinkedIn intent from one known post (harvest needs its public URL or the composite social_id from `oxygen posts get`) or from your connected account's viewers, followers, and connections. For recurring competitor-profile monitoring that discovers future posts, start with `oxygen recipes list competitor --json`. Harvests run as a slow, durable drip under a conservative read budget.")
+        .description("Capture LinkedIn intent from one known post (harvest needs its public URL or the composite social_id from `oxygen posts get`), and react or comment on it. Recurring capture — a post's engagers on a cadence, 'who viewed my profile', new followers, new connections — is a live table: arm it with `oxygen linkedin intent setup` and operate it with `oxygen feeds list|pause|resume|run`. For recurring competitor-profile monitoring that discovers future posts, start with `oxygen recipes list competitor --json`. Harvests run as a slow, durable drip under a conservative read budget.")
         .addCommand(new Command("harvest")
         .description("Start (or re-arm) a harvest of a post's engagers into a workspace table you can enroll into a sequence. Engagers drip into the table over many ticks; poll `engagement status` to watch it fill. No messages are sent. Cookieless harvests spend Oxygen credits per scraper page and require --max-credits.")
         .requiredOption("--post <social_id_or_url>", "Composite post social_id from `oxygen posts get` (NOT the activity URN), or the public LinkedIn post URL for cookieless.")
@@ -10267,112 +10742,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
-    }))
-        .addCommand(new Command("watch")
-        .description("Declarative engagement watches (the signals wedge): stand up a watch on a post's engagers, 'who viewed my profile', or the sender's inbound network (new followers / new connections) that harvests people into a table and, under a standing approval, auto-enrolls them into a sequence. The watch materializes the harvest drip and enrolls newly-harvested people each cycle — the sequence still gates its own sends.")
-        .addHelpText("after", "\nScope: this watches one known post or one connected-account signal. For daily discovery across one or more public profiles' recent posts, use `oxygen blueprints describe linkedin-profile-engager-monitor --json`.\n")
-        .addCommand(new Command("create")
-        .description("Arm an engagement watch. `--kind post` watches a post's reactors + commenters (needs --post social_id; a cookieless post also needs --post-url); `--kind profile_viewers` watches 'who viewed my profile' (source unipile); `--kind followers` / `--kind connections` watch the sender's inbound network — people NEW to the org's orbit stream into the watch table as they follow/connect (source unipile, no credits, reads metered against the account's daily ingest budget). With --auto-enroll it enrolls harvested people into --sequence, capped by --max-enrolls-per-day — the inbound-led-outbound loop. --max-credits-per-cycle is the standing per-cycle spend cap (required for --auto-enroll and cookieless). No messages are sent by the watch itself.")
-        .requiredOption("--kind <kind>", "post | profile_viewers | followers | connections.")
-        .requiredOption("--account <ref>", "Reading LinkedIn sender (sender id, connection id, or Unipile account id).")
-        .option("--post <social_id>", "Composite post social_id from `oxygen posts get` (required for --kind post).")
-        .option("--post-url <url>", "Public LinkedIn post URL (required for a cookieless post watch).")
-        .option("--source <source>", "cookieless | unipile. Defaults to cookieless for post; profile_viewers/followers/connections are always unipile.")
-        .option("--table <id_or_slug>", "Existing table to land harvested people into. Omit to create one.")
-        .option("--sequence <id_or_slug>", "Sequence to auto-enroll harvested people into (required with --auto-enroll).")
-        .option("--auto-enroll", "Auto-enroll newly harvested people into --sequence under the standing approval.")
-        .option("--max-credits-per-cycle <credits>", "Standing per-cycle managed-spend cap (required for --auto-enroll and cookieless).")
-        .option("--max-enrolls-per-day <n>", "Cap auto-enrollments per day.")
-        .option("--recurrence <recurrence>", "once | every_6h | daily | weekly (default once).")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (options) => {
-        await handleAsyncAction("engagement watch create", options, () => {
-            const kind = readOption(options.kind);
-            const account = readOption(options.account);
-            const post = readOption(options.post);
-            const postUrl = readOption(options.postUrl);
-            const source = readOption(options.source);
-            const table = readOption(options.table);
-            const sequence = readOption(options.sequence);
-            const maxCreditsPerCycle = readPositiveNumber(options.maxCreditsPerCycle);
-            const maxEnrollsPerDay = readPositiveNumber(options.maxEnrollsPerDay);
-            const recurrence = readOption(options.recurrence);
-            return requestOxygen("/api/cli/linkedin/engagement/watches", {
-                method: "POST",
-                body: {
-                    ...(kind ? { kind } : {}),
-                    ...(account ? { account } : {}),
-                    ...(post ? { post } : {}),
-                    ...(postUrl ? { post_url: postUrl } : {}),
-                    ...(source ? { source } : {}),
-                    ...(table ? { table } : {}),
-                    ...(sequence ? { sequence } : {}),
-                    ...(options.autoEnroll ? { auto_enroll: true } : {}),
-                    ...(maxCreditsPerCycle !== undefined ? { max_credits_per_cycle: maxCreditsPerCycle } : {}),
-                    ...(maxEnrollsPerDay !== undefined ? { max_enrolls_per_day: maxEnrollsPerDay } : {}),
-                    ...(recurrence ? { recurrence } : {}),
-                },
-            });
-        });
-    }))
-        .addCommand(new Command("list")
-        .description("List the org's engagement watches (status, kind, sender, sequence, per-day enroll count) with a table deep-link.")
-        .option("--status <status>", "Filter by status: active | paused | exhausted | completed.")
-        .option("--kind <kind>", "Filter by kind.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (options) => {
-        await handleAsyncAction("engagement watch list", options, () => {
-            const status = readOption(options.status);
-            const kind = readOption(options.kind);
-            const params = new URLSearchParams();
-            if (status)
-                params.set("status", status);
-            if (kind)
-                params.set("kind", kind);
-            const suffix = params.toString();
-            return requestOxygen(`/api/cli/linkedin/engagement/watches${suffix ? `?${suffix}` : ""}`);
-        });
-    }))
-        .addCommand(new Command("pause")
-        .description("Pause a watch (stop materializing its harvest + auto-enrolling).")
-        .argument("<watchId>", "Watch id.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (watchId, options) => {
-        await handleAsyncAction("engagement watch pause", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}`, {
-            method: "PATCH",
-            body: { action: "pause" },
-        }));
-    }))
-        .addCommand(new Command("resume")
-        .description("Resume a paused watch.")
-        .argument("<watchId>", "Watch id.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (watchId, options) => {
-        await handleAsyncAction("engagement watch resume", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}`, {
-            method: "PATCH",
-            body: { action: "resume" },
-        }));
-    }))
-        .addCommand(new Command("tag")
-        .description("Replace a watch's workspace tags (whole set; `--tags \"\"` clears) — groups a standing watch into the same campaign vocabulary as the sequence it feeds. See `oxygen tags list`.")
-        .argument("<watchId>", "Watch id.")
-        .requiredOption("--tags <tags>", "Comma-separated workspace tags (replaces the whole set; empty clears).")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (watchId, options) => {
-        await handleAsyncAction("engagement watch tag", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}/tags`, {
-            method: "POST",
-            body: { tags: splitCommaList(options.tags) },
-        }));
-    }))
-        .addCommand(new Command("delete")
-        .description("Delete a watch (its harvested table + rows are kept).")
-        .argument("<watchId>", "Watch id.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (watchId, options) => {
-        await handleAsyncAction("engagement watch delete", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}`, {
-            method: "DELETE",
-        }));
-    }))));
+    })));
     program.addCommand(new Command("linkedin")
         .description("LinkedIn read-into-workspace ingestion controls (Goal-3): the unified status of the connections / engagement / message-history drips and each account's remaining ingest read budget.")
         .addCommand(new Command("intent")
@@ -10399,7 +10769,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("status")
-        .description("Show the canonical intent tables, their linked-table deep-links, and the capture watches feeding them.")
+        .description("Show the canonical intent tables, their linked-table deep-links, and the capture feeds filling them.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("linkedin intent status", options, () => requestOxygen("/api/cli/linkedin/intent"));
@@ -10711,13 +11081,14 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("inbox")
-        .description("Unified inbox (unibox): private email + LinkedIn DM + WhatsApp conversations in one stream (--channel all), or a single channel. Public comments on OXYGEN-published posts are not inbox messages; use `publishing comments`. Scan, read threads, and reply.")
+        .description("Unified inbox (unibox): private email + LinkedIn DM + WhatsApp conversations in one stream (--channel all), or a single channel. Public comments on owned LinkedIn posts are not inbox messages; use `publishing comments`. Scan, read threads, and reply.")
         .addCommand(new Command("list")
         .description("List conversations newest first. --channel all merges email + LinkedIn + WhatsApp into one stream (narrow it with --channels); --channel email/linkedin/whatsapp lists a single channel. Primary excludes the negative tier (not_now, not_interested, lost, bounced); All includes every ordinary conversation.")
         .option("--channel <channel>", "Inbox channel: all (merged), linkedin (default), whatsapp, or email.")
         .option("--channels <list>", "channel=all only: comma-separated channel groups to include (email,linkedin,whatsapp). Empty = all three.")
         .option("--account <id>", "LinkedIn only: filter to one sender account (sender id, connection id, or Unipile account id).")
         .option("--unread", "Only show conversations with unread messages.")
+        .option("--unanswered", "Only conversations awaiting YOUR reply — the last message in the thread is inbound. Cross-channel. Off by default: an unfiltered list still shows answered threads. (The web Unibox turns this on by default for its Primary tab.)")
         .option("--responses-only", "Email only: only conversations with an inbound reply (never sent-only threads).")
         .option("--bucket <bucket>", "Email only: primary or others (superseded by --segment).")
         .option("--segment <segment>", "Top tab: primary (everything but the negative status tier), all, or an email-only folder (others, sent, warmup, dmarc).")
@@ -10747,6 +11118,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 params.set("account", account);
             if (options.unread)
                 params.set("unread", "true");
+            if (options.unanswered)
+                params.set("unanswered", "true");
             if (options.responsesOnly)
                 params.set("responses_only", "true");
             for (const [flag, key] of [
@@ -10859,6 +11232,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--until <iso>", "Only conversations whose last message is on/before this ISO date/timestamp. Cross-channel.")
         .option("--search <text>", "Filter by attendee name or last-message text. Cross-channel.")
         .option("--include-archived", "Also mark archived conversations read.")
+        .option("--unanswered", "Only sweep conversations awaiting your reply (the last message is inbound) — the same filter as `inbox list --unanswered`, so the scope is exactly that list.")
         .option("--yes", "Apply the sweep. Without this flag, returns a preview of the unread count only.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -10891,6 +11265,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             }
             if (options.includeArchived)
                 params.set("include_archived", "true");
+            // Booleans need their own line: the tuple loop above only walks
+            // the string-valued options.
+            if (options.unanswered)
+                params.set("unanswered", "true");
             return requestOxygen(`/api/cli/inbox/read-all?${params.toString()}`, {
                 method: "POST",
                 // Approval rides in the body: a bodyless POST reads as
@@ -11122,6 +11500,16 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (key, options) => {
         await handleAsyncAction("inbox label archive", options, () => requestOxygen(`/api/cli/inbox/labels/${encodeURIComponent(key)}`, { method: "DELETE" }));
+    }))
+        .addCommand(new Command("restore")
+        .description("Restore an archived custom status label under its original key.")
+        .argument("<key>", "The archived custom label key.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (key, options) => {
+        await handleAsyncAction("inbox label restore", options, () => requestOxygen(`/api/cli/inbox/labels/${encodeURIComponent(key)}`, {
+            method: "PATCH",
+            body: { archived: false },
+        }));
     })))
         .addCommand(new Command("drafts")
         .description("The AI reply-agent draft queue (the approve-before-send review queue).")
@@ -12596,7 +12984,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("mailboxes")
-        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local Hypertide transfer), pause/disable inboxes, connect EmailGuard monitoring, and run managed TrulyInbox warmup with explicit plans and credit caps. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
+        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local Hypertide transfer), pause/disable inboxes, connect EmailGuard monitoring, and run managed SendKit warmup with explicit plans and credit caps. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
         .addCommand(new Command("list")
         .description("List the org's sending mailboxes with provider, status, warmup state, source (managed = bought through Oxygen, byok = bring-your-own), and a pool overview (including counts by source).")
         .option("--status <status>", "Filter by status: active, paused, or disabled.")
@@ -12612,7 +13000,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("get")
-        .description("Get one sending mailbox's configuration/readiness detail (provider, status, daily cap, warmup state, auth mode, and source — managed vs bring-your-own) plus a one-row pool summary. This is not sent/replied/bounced performance; use `oxygen sequences analytics` for native Sequence attribution by mailbox/domain. An ineligible native-send transport includes transport_reason + transport_hint; it does not by itself block TrulyInbox warmup or EmailGuard monitoring. <mailbox> accepts a mailbox id or email address.")
+        .description("Get one sending mailbox's configuration/readiness detail (provider, status, daily cap, warmup state, auth mode, and source — managed vs bring-your-own) plus a one-row pool summary. This is not sent/replied/bounced performance; use `oxygen sequences analytics` for native Sequence attribution by mailbox/domain. An ineligible native-send transport includes transport_reason + transport_hint; it does not by itself block SendKit warmup or EmailGuard monitoring. <mailbox> accepts a mailbox id or email address.")
         .argument("<mailbox>", "Mailbox id or email address.")
         .option("--json", "Print a JSON envelope.")
         .action(async (mailbox, options) => {
@@ -12625,7 +13013,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("mailboxes health", options, () => requestOxygen("/api/cli/mailboxes/health"));
     }))
         .addCommand(new Command("compatibility")
-        .description("Read-only compatibility report for every selected mailbox: origin vendor, real infrastructure tier (including InboxKit Azure), OXYGEN native-send connection quality, TrulyInbox warmup path, EmailGuard monitoring path, and exact next actions. Native send distinguishes destination-bound OAuth, provider-managed API transport, admin delegation, and authorization_required. Use --catalog-only for the compact workspace-independent import contract. JSON data.compatibility contains checked rows; data.import_methods and data.import_fields describe accepted transfer inputs; data.provider_matrix is the complete current 18-pair product matrix; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. Downstream states distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
+        .description("Read-only compatibility report for every selected mailbox: origin vendor, real infrastructure tier (including InboxKit Azure), OXYGEN native-send connection quality, SendKit warmup path, EmailGuard monitoring path, and exact next actions. Native send distinguishes destination-bound OAuth, provider-managed API transport, admin delegation, and authorization_required. Use --catalog-only for the compact workspace-independent import contract. JSON data.compatibility contains checked rows; data.import_methods and data.import_fields describe accepted transfer inputs; data.provider_matrix is the complete current 18-pair product matrix; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. Downstream states distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--catalog-only", "Return only the bounded import-method, field, auth-boundary, and 18-pair provider catalogs; do not read or return workspace mailbox rows.")
         .option("--json", "Print a JSON envelope.")
@@ -12647,7 +13035,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("import")
-        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>; --from hypertide remains a shortcut. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer: Microsoft warmup requires Entra tenant-admin consent and EmailGuard remains vendor_blocked for Microsoft. Google app passwords are sent only in the request body, encrypted server-side, and never returned.")
+        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>; --from hypertide remains a shortcut. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer: Microsoft warmup requires one Outlook OAuth authorization per mailbox (`mailboxes warmup microsoft`) and EmailGuard remains vendor_blocked for Microsoft. Google app passwords are sent only in the request body, encrypted server-side, and never returned.")
         .addHelpText("after", [
         "",
         "Ordinary identity file contract (CSV / JSON / JSONL / XLSX):",
@@ -12975,7 +13363,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })))
         .addCommand(new Command("delegation")
-        .description("Google sending-domain delegation only — not Microsoft OAuth and not a Hypertide handoff to TrulyInbox or EmailGuard. Reports covered domains plus the exact client id/scopes; --probe mints a real token per mailbox. Read-only, sends no mail, 0 Oxygen credits.")
+        .description("Google sending-domain delegation only — not Microsoft OAuth and not a Hypertide handoff to SendKit warmup or EmailGuard. Reports covered domains plus the exact client id/scopes; --probe mints a real token per mailbox. Read-only, sends no mail, 0 Oxygen credits.")
         .option("--domain <domain>", "Only report this sending domain.")
         .option("--probe", "Verify each delegated domain by minting a real delegated token per mailbox. Makes one Google token call per mailbox; still 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
@@ -12992,9 +13380,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("warmup")
-        .description("Mailbox warmup for the sending pool. Oxygen's native warmup runs on ONE rail: TrulyInbox, managed and credit-billed per warming-inbox-month. Oxygen enrolls the mailbox for you — preview first, then re-run with --approved to execute and bill. (Instantly and Warmforge remain BYOK integrations elsewhere in Oxygen; they are no longer warmup rails.)")
+        .description("Mailbox warmup for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. Oxygen's native warmup runs on ONE rail: SendKit, managed and credit-billed at 3,000 credits per warming inbox per month ($3). Oxygen enrolls the mailbox for you — preview first, then re-run with --approved to execute and bill. Google and Microsoft both warm here; a Microsoft inbox first needs one Outlook authorization of its own (`mailboxes warmup microsoft`). Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down here with `warmup disable`; they are never silently moved onto SendKit.")
         .addCommand(new Command("enable")
-        .description("Enable warmup for sending mailboxes and stamp each mailbox's warmup state. Targets the whole pool unless --mailboxes is given. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is enrolled or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved.")
+        .description("Enroll sending mailboxes in Oxygen's managed SendKit warmup and stamp each mailbox's warmup state. Targets the whole pool unless --mailboxes is given. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is enrolled or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Microsoft inboxes must finish `mailboxes warmup microsoft` (one Outlook authorization each) before they can enroll. New enrollments only ever land on SendKit — the retired TrulyInbox rail is refused here and only accepts teardown.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to warm. Omit to warm the whole pool.")
         .option("--approved", "Execute the PRICED enrollment. Without it the response is a priced preview and nothing is enrolled or billed.")
         .option("--plan <hash>", "Hash from the fresh preview (required with --approved).")
@@ -13038,13 +13426,13 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("microsoft")
-        .description("Set up Microsoft/Entra mailboxes for TrulyInbox through tenant-admin consent — never through a mailbox password. Preview returns the consent URL and exact 0-credit sync plan. If it is not executable yet, open consent and re-preview with --tenant <directory-guid>; approve only that fresh hash with --max-credits 0. Warmup remains OFF until a separately approved `warmup enable`.")
+        .description("Authorize Microsoft/Outlook mailboxes for SendKit warmup — ONE browser consent PER MAILBOX, never a password or app password. There is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact mailboxes and how many consent links are still outstanding, at 0 credits. Approve that fresh hash with --max-credits 0 to mint the links, open every returned consent_url, then re-run with --status to see which mailboxes came back authorized. Warmup itself stays OFF until a separately approved `warmup enable`.")
         .option("--mailboxes <list>", "Comma-separated Microsoft mailbox ids or addresses. Omit to select every Microsoft mailbox in the pool.")
-        .option("--tenant <id>", "Entra directory/tenant GUID. Usually inferred from mailbox metadata or the consent response.")
-        .option("--approved", "Register/sync the exact previewed tenant scope after the admin opened the consent URL.")
+        .option("--tenant <id>", "Deprecated and ignored: SendKit consent is per mailbox, so there is no tenant-wide scope to bind. Still accepted so older scripts keep running.")
+        .option("--approved", "Mint the per-mailbox consent links for the exact previewed mailbox scope. Still 0 credits — a human then has to open each link.")
         .option("--plan <hash>", "Fresh setup preview hash (required with --approved).")
         .option("--max-credits <n>", "Hard Oxygen credit cap; this setup requires exactly 0 (required with --approved).")
-        .option("--status", "Poll the persisted TrulyInbox workspace sync instead of creating a new setup preview.")
+        .option("--status", "Poll the per-mailbox consents instead of creating a new setup preview: reports which mailboxes are authorized and which are still waiting for someone to open their link.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("mailboxes warmup microsoft", options, () => {
@@ -13125,7 +13513,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("pause")
-        .description("Pause warmup for TrulyInbox-enrolled mailboxes. Rows left on a retired rail report unsupported rather than being retargeted. Targets the whole pool unless --mailboxes is given.")
+        .description("Pause warmup at the rail that actually enrolled each mailbox — SendKit for current enrollments, TrulyInbox for inboxes still warming there. A mailbox left on a rail Oxygen no longer drives reports unsupported instead of being retargeted, so the reply never claims a pause that did not happen. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13138,7 +13526,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("resume")
-        .description("Resume paused warmup at each mailbox's recorded provider. Targets the whole pool unless --mailboxes is given.")
+        .description("Resume paused warmup at each mailbox's recorded rail (SendKit, or TrulyInbox for inboxes still warming there). A mailbox on a rail Oxygen no longer drives reports unsupported instead of being retargeted. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13151,7 +13539,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("disable")
-        .description("Disable warmup and unenroll each mailbox from its recorded provider. On the managed trulyinbox rail this also cancels the warmup subscription — billing stops with the vendor removal. Targets the whole pool unless --mailboxes is given.")
+        .description("Disable warmup and unenroll each mailbox from the rail that actually enrolled it. On a managed rail — SendKit today, TrulyInbox for older enrollments — this also cancels that mailbox's warmup subscription, so billing stops with the vendor removal. This is how you wind an inbox off the retired TrulyInbox rail. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13164,9 +13552,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("status")
-        .description("Sync TrulyInbox warmup analytics into the pool, updating each mailbox's state. Targets the whole pool unless --mailboxes is given.")
+        .description("Read warmup analytics back from the rail each mailbox is enrolled on and update its state in the pool. Read-only at the vendor, 0 Oxygen credits. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to sync. Omit to sync the whole pool.")
-        .option("--provider <name>", "Optional; trulyinbox is the only native warmup rail.")
+        .option("--provider <name>", "Optional. sendkit is the rail every current enrollment uses; pass trulyinbox only to read inboxes still warming on the retired rail. Omit it to read each mailbox on the rail it is recorded against.")
         .option("--dry-run", "Skip the provider call (mailboxes marked pending).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13189,28 +13577,6 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const suffix = params.toString();
             return requestOxygen(`/api/cli/mailboxes/warmup/status${suffix ? `?${suffix}` : ""}`);
         });
-    }))
-        .addCommand(new Command("provision")
-        .description("Legacy Zapmail-to-Instantly export for fleets already provisioned on that retired rail. It is not required for native TrulyInbox warmup; new Hypertide/Zapmail/InboxKit mailboxes use `mailboxes warmup enable`.")
-        .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to provision. Omit for the whole pool.")
-        .option("--connection <id>", "Zapmail connection id. Defaults to the org's active Zapmail connection (or the managed wallet).")
-        .option("--force", "Re-export mailboxes already exporting/warming/active (default skips them).")
-        .option("--dry-run", "Simulate without calling Zapmail (reports the mailboxes that would be exported).")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (options) => {
-        await handleAsyncAction("mailboxes warmup provision", options, () => {
-            const mailboxes = readCsvOption(options.mailboxes);
-            const connection = readOption(options.connection);
-            return requestOxygen("/api/cli/mailboxes/warmup/provision", {
-                method: "POST",
-                body: {
-                    ...(mailboxes.length > 0 ? { mailboxes } : {}),
-                    ...(connection ? { connection_id: connection } : {}),
-                    ...(options.force ? { force: true } : {}),
-                    ...(options.dryRun ? { dry_run: true } : {}),
-                },
-            });
-        });
     })))
         .addCommand(new Command("order")
         .description("RETIRED — managed mailboxes are now purchased as monthly subscriptions via `oxygen managed-inboxes subscribe` (InboxKit-backed). This legacy Zapmail order path was never enabled anywhere and now always fails with code `gone`.")
@@ -13234,7 +13600,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("run")
         .description("Create a placement test for one sending mailbox. Without --approved this returns a cost PREVIEW. EmailGuard creation returns exact seeds + phrase but sends nothing; next run `placement-test send <id>` to preview and approve that external email. Zapmail owns its probe delivery and completes async (2-24h).")
         .argument("<mailbox>", "Sending mailbox address to test (e.g. ada@send.acme.com).")
-        .option("--provider <provider>", "Health provider: emailguard or zapmail. Omit to auto-resolve (Zapmail-hosted mailboxes route to zapmail, else emailguard).")
+        .option("--provider <provider>", "Health provider: emailguard or zapmail. Omit to auto-resolve — EmailGuard is the default for every mailbox; Zapmail is used only for Zapmail-hosted mailboxes when EmailGuard is not connected.")
         .option("--subject <subject>", "Optional subject for the seed message (zapmail ignores it beyond labeling the test).")
         .option("--body <text>", "Optional plain-text body for the seed message (ignored by zapmail).")
         .option("--approved", "Actually run the test (otherwise a preview is returned).")
@@ -16041,11 +16407,24 @@ async function requestColumnsRun(body, table, options) {
     // Inline (formula) results carry no action_run_id and pass through as-is.
     if (!options.background && typeof body.row_id === "string" && isRecord(result)) {
         const actionRunId = readRecordString(result, "action_run_id");
-        if (actionRunId)
+        if (actionRunId) {
+            writeSingleRowColumnRunReceipt(result, actionRunId);
             return resolveSingleRowColumnRun(result, actionRunId);
+        }
     }
     return result;
 }
+// The durable run exists before the convenience auto-wait begins. Emit its
+// receipt on stderr immediately so strict JSON stdout remains one envelope while
+// a shell/agent timeout can still recover the charged run instead of reporting
+// a silent failure with no inspectable id.
+function writeSingleRowColumnRunReceipt(envelope, actionRunId) {
+    const webUrl = readRecordString(envelope, "web_url")
+        ?? readRecordString(envelope, "run_web_url");
+    const inspection = webUrl ? ` (${webUrl})` : "";
+    process.stderr.write(`queued: column run ${actionRunId}${inspection}\n`);
+    process.stderr.write(`hint: if this process stops, continue with oxygen table-runs wait ${actionRunId}\n`);
+}
 /**
  * Wait for an auto-backgrounded single-row column run to finish and return the
  * terminal run merged with its item output (the cell value). On wait timeout
@@ -18204,6 +18583,72 @@ async function handleOrgUseAction(organization, options, command) {
         emitCliFailure(command, error);
     }
 }
+// Why each organization cannot pay for another workspace, in the user's words.
+// The codes are the server's; the sentences exist so a blocked `billing-link`
+// says what to fix instead of printing an enum.
+const BILLING_OWNER_INELIGIBLE_REASONS = {
+    not_admin: "You are not an admin of that organization.",
+    no_plan: "It has no active paid plan.",
+    trialing: "It is on a trial, and a trial only covers the workspace it started in.",
+    already_linked: "Its own billing is already covered by another organization.",
+};
+// `--owner` is optional because the case that matters is the plainest one: the
+// user pays for exactly one organization and wants this workspace on it. The
+// eligibility rules (admin seat, active paid plan, no trial) stay on the server
+// — the CLI only picks when the answer is unambiguous, and turns "which one?"
+// into a typed failure rather than a guess.
+async function resolveSoleBillingOwnerRef() {
+    const candidates = readBillingOwnerCandidates(await requestOxygen("/api/cli/orgs/billing-owners"));
+    const eligible = candidates.filter((candidate) => candidate.eligible);
+    if (eligible.length === 1)
+        return eligible[0].id;
+    if (eligible.length > 1) {
+        throw new OxygenError("missing_billing_owner", `${eligible.length} of your organizations can pay for this workspace, so Oxygen will not choose for you. Re-run with --owner <organization>.`, {
+            details: {
+                eligible_billing_owners: eligible.map((candidate) => ({
+                    organization_id: candidate.id,
+                    name: candidate.name,
+                })),
+                next_step: `oxygen orgs billing-link --owner ${eligible[0].id}`,
+            },
+        });
+    }
+    throw new OxygenError("no_eligible_billing_owner", candidates.length === 0
+        ? "You do not belong to another organization, so there is no existing plan to put this workspace on. Start one at https://oxygen-agent.com/billing."
+        : "None of your other organizations can pay for this workspace. Only an organization you administer that is on an active paid plan can cover another workspace — a trial cannot.", {
+        details: {
+            candidates: candidates.map((candidate) => ({
+                organization_id: candidate.id,
+                name: candidate.name,
+                ineligible_reason: candidate.ineligible_reason,
+                reason: candidate.ineligible_reason
+                    ? BILLING_OWNER_INELIGIBLE_REASONS[candidate.ineligible_reason] ?? null
+                    : null,
+            })),
+            next_step: "Start a plan on the organization that should pay at https://oxygen-agent.com/billing, then re-run `oxygen orgs billing-link`.",
+        },
+    });
+}
+// Both spellings of the reason field are read, the same way the billing-link
+// route accepts either spelling of its body keys: the rows come straight out of
+// the billing-ownership library, and a casing change there must not silently
+// downgrade "we picked your plan" into "you have no eligible plan".
+function readBillingOwnerCandidates(payload) {
+    const rows = isRecord(payload) && Array.isArray(payload.candidates) ? payload.candidates : [];
+    const candidates = [];
+    for (const row of rows) {
+        if (!isRecord(row) || typeof row.id !== "string" || !row.id)
+            continue;
+        const reason = row.ineligible_reason ?? row.ineligibleReason;
+        candidates.push({
+            id: row.id,
+            name: typeof row.name === "string" ? row.name : row.id,
+            eligible: row.eligible === true,
+            ineligible_reason: typeof reason === "string" ? reason : null,
+        });
+    }
+    return candidates;
+}
 async function handleProfilesListAction(options) {
     try {
         const state = await listCredentialProfiles();
@@ -19168,7 +19613,8 @@ function formatReplyTypes(value) {
         .sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]));
     return entries.length > 0 ? entries.map(([key, count]) => `${key}:${count}`).join(", ") : "—";
 }
-function renderVariantTable(headers, rows) {
+/** Column-aligned plain-text table, two-space indented. Shared by the sequence-variant lenses and the collaboration lists. */
+function renderTextTable(headers, rows) {
     const widths = headers.map((header, columnIndex) => {
         let max = header.length;
         for (const row of rows) {
@@ -19203,7 +19649,7 @@ function formatSequenceVariants(data) {
             formatVariantCell(row.bounced),
             formatVariantCell(row.credits_used),
         ]);
-        lines.push(...renderVariantTable(headers, rows));
+        lines.push(...renderTextTable(headers, rows));
     }
     lines.push("", styles.bold("By mailbox"));
     if (byMailbox.length === 0) {
@@ -19222,7 +19668,7 @@ function formatSequenceVariants(data) {
             formatReplyTypes(row.reply_types ?? row.replyTypes),
             formatVariantCell(row.failed),
         ]);
-        lines.push(...renderVariantTable(headers, rows));
+        lines.push(...renderTextTable(headers, rows));
     }
     lines.push("", styles.bold("By sending domain"));
     if (byDomain.length === 0) {
@@ -19241,14 +19687,14 @@ function formatSequenceVariants(data) {
             formatRatePercent(row.bounce_rate ?? row.bounceRate),
             formatReplyTypes(row.reply_types ?? row.replyTypes),
         ]);
-        lines.push(...renderVariantTable(headers, rows));
+        lines.push(...renderTextTable(headers, rows));
     }
     const hasUnattributed = unattributed
         && [unattributed.sent, unattributed.replied, unattributed.bounced, unattributed.failed]
             .some((value) => typeof value === "number" && value > 0);
     if (hasUnattributed && unattributed) {
         lines.push("", styles.bold("Unattributed sending identity"));
-        lines.push(...renderVariantTable(["SENT", "REPLIED", "POSITIVE", "BOUNCED", "FAILED", "REPLY TYPES"], [[
+        lines.push(...renderTextTable(["SENT", "REPLIED", "POSITIVE", "BOUNCED", "FAILED", "REPLY TYPES"], [[
                 formatVariantCell(unattributed.sent),
                 formatVariantCell(unattributed.replied),
                 formatVariantCell(unattributed.positive_replies ?? unattributed.positiveReplies),
@@ -19261,6 +19707,471 @@ function formatSequenceVariants(data) {
     lines.push("");
     return lines.join("\n");
 }
+// --- Collaboration output ----------------------------------------------------
+//
+// Comments and approvals are read by two very different audiences: the agency's
+// operator in a terminal, and an agent parsing --json. So these commands render
+// a compact human view by default and the stable envelope under --json — the
+// same split `sequences variants` uses. Every renderer ends with the deep-link
+// the API returned, because the client who has to decide is usually the one
+// person NOT in the terminal.
+async function handleCollabAction(command, options, action, render) {
+    try {
+        const data = await action();
+        if (options.json) {
+            writeJson(success(command, data));
+            return;
+        }
+        process.stdout.write(isRecord(data) ? render(data) : `${JSON.stringify(data, null, 2)}\n`);
+    }
+    catch (error) {
+        emitCliFailure(command, error);
+    }
+}
+/**
+ * `comments add`. Without --reply this is one POST. With --reply the CLI first
+ * resolves which thread owns that id, because the reply endpoint is keyed by
+ * THREAD while the id a user has in hand (from `comments list`, or from the
+ * `next_step` the API prints) is a COMMENT. Passing a thread id works too and
+ * replies at its top level — both ids sit side by side in the list output, and
+ * refusing the wrong one would be pedantry, not safety.
+ */
+async function handleCommentsAddAction(body, options) {
+    await handleCollabAction("comments add", options, async () => {
+        const subject = requireCollabSubject(options.on);
+        const path = readCollabPath(options.path);
+        const mentions = options.mention.map((value) => value.trim()).filter(Boolean);
+        const replyTo = readOption(options.reply);
+        if (!replyTo) {
+            const title = readOption(options.title);
+            return requestOxygen("/api/cli/collab/threads", {
+                method: "POST",
+                body: {
+                    subject_kind: subject.kind,
+                    subject_id: subject.id,
+                    ...(path ? { subject_path: path } : {}),
+                    ...(title ? { title } : {}),
+                    body,
+                    ...(mentions.length > 0 ? { mentions } : {}),
+                },
+            });
+        }
+        const target = await resolveCollabReplyTarget(subject, replyTo);
+        return requestOxygen(`/api/cli/collab/threads/${encodeURIComponent(target.threadId)}/comments`, {
+            method: "POST",
+            body: {
+                body,
+                ...(target.parentCommentId ? { parent_comment_id: target.parentCommentId } : {}),
+                ...(mentions.length > 0 ? { mentions } : {}),
+            },
+        });
+    }, formatCollabWriteResult);
+}
+async function resolveCollabReplyTarget(subject, replyTo) {
+    const params = new URLSearchParams({
+        subject: `${subject.kind}:${subject.id}`,
+        // `all`, not `open`: replying to a resolved thread is how a client reopens
+        // a conversation, and scoping the lookup to open threads would report the
+        // id as missing instead.
+        status: "all",
+    });
+    const listed = await requestOxygen(`/api/cli/collab/threads?${params.toString()}`);
+    const threads = Array.isArray(listed.threads) ? listed.threads.filter(isRecord) : [];
+    for (const thread of threads) {
+        if (thread.id === replyTo)
+            return { threadId: replyTo, parentCommentId: null };
+        const comments = Array.isArray(thread.comments) ? thread.comments.filter(isRecord) : [];
+        if (comments.some((comment) => comment.id === replyTo) && typeof thread.id === "string") {
+            return { threadId: thread.id, parentCommentId: replyTo };
+        }
+    }
+    throw new OxygenError("comment_not_found", `No comment or thread "${replyTo}" on ${subject.kind}:${subject.id}. List them with \`oxygen comments list --on ${subject.kind}:${subject.id} --status all\`.`, { details: { reply: replyTo, subject: `${subject.kind}:${subject.id}` }, exitCode: 4 });
+}
+/** Exactly one scope (--on or --default) and exactly one requirement flag. */
+function collabGateSetBody(options) {
+    const on = readOption(options.on);
+    const asDefault = readOption(options.default);
+    if (Boolean(on) === Boolean(asDefault)) {
+        throw new OxygenError("invalid_request", "Pass exactly one scope: --on <kind>:<id> for one object, or --default <kind> for every object of that kind.", { details: { on, default: asDefault }, exitCode: 2 });
+    }
+    if (Boolean(options.required) === Boolean(options.notRequired)) {
+        throw new OxygenError("invalid_request", "Pass exactly one of --required or --not-required.", { exitCode: 2 });
+    }
+    const gateKind = requireCollabGate(options.gate);
+    const subject = on ? requireCollabSubject(on) : null;
+    const subjectKind = subject ? subject.kind : requireCollabSubjectKind(asDefault ?? undefined);
+    if (!GATE_KIND_SUBJECTS[gateKind].includes(subjectKind)) {
+        throw new OxygenError("invalid_request", `The ${gateKind} gate applies to ${GATE_KIND_SUBJECTS[gateKind].map((kind) => COLLAB_SUBJECT_LABELS[kind].many).join(" or ")}, not ${COLLAB_SUBJECT_LABELS[subjectKind].many}.`, { details: { gate_kind: gateKind, subject_kind: subjectKind, applies_to: [...GATE_KIND_SUBJECTS[gateKind]] }, exitCode: 2 });
+    }
+    return {
+        subject_kind: subjectKind,
+        // null is meaningful here: it is what makes the policy the workspace
+        // default for the kind rather than a row about one object.
+        subject_id: subject ? subject.id : null,
+        gate_kind: gateKind,
+        required: Boolean(options.required),
+    };
+}
+function collabStyles() {
+    return ansi(output.isTTY === true && !process.env.NO_COLOR);
+}
+function collabText(value, fallback = "—") {
+    return typeof value === "string" && value.trim() ? value.trim() : fallback;
+}
+function collabLink(data) {
+    if (typeof data.web_url === "string")
+        return data.web_url;
+    return typeof data.deepLink === "string" ? data.deepLink : null;
+}
+/** Coarse age for a list column: seconds, minutes, hours, then days. */
+function formatCollabAge(value) {
+    if (typeof value !== "string")
+        return "—";
+    const at = Date.parse(value);
+    if (!Number.isFinite(at))
+        return "—";
+    const seconds = Math.max(0, Math.round((Date.now() - at) / 1000));
+    if (seconds < 60)
+        return `${seconds}s`;
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60)
+        return `${minutes}m`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 48)
+        return `${hours}h`;
+    return `${Math.floor(hours / 24)}d`;
+}
+/** First line of a body, clipped — a thread's subject line in one cell. */
+function collabSnippet(value, width = 56) {
+    if (typeof value !== "string")
+        return "";
+    const firstLine = value.split("\n").find((line) => line.trim()) ?? "";
+    return clipCell(firstLine.trim(), width);
+}
+/** Trailer every collab render shares: what to do next, then the deep-link. */
+function collabTrailer(data) {
+    const styles = collabStyles();
+    const lines = [];
+    const nextStep = typeof data.next_step === "string" ? data.next_step.trim() : "";
+    if (nextStep)
+        lines.push("", `  ${styles.dim("Next")}   ${nextStep}`);
+    const link = collabLink(data);
+    if (link)
+        lines.push(`  ${styles.dim("Link")}   ${link}`);
+    return lines;
+}
+/**
+ * Generic confirmation for a write whose payload is one object. The API already
+ * writes a `next_step` sentence for each of these, so the renderer's only job is
+ * to say what changed and keep the deep-link visible.
+ */
+function formatCollabWriteResult(data) {
+    const styles = collabStyles();
+    const lines = [""];
+    const headline = collabWriteHeadline(data);
+    lines.push(`  ${styles.green("[OK]")} ${headline}`);
+    if (data.already === true) {
+        lines.push(`  ${styles.dim("Already in that state; nothing changed.")}`);
+    }
+    const notified = Array.isArray(data.notified_emails)
+        ? data.notified_emails.filter((value) => typeof value === "string")
+        : [];
+    if (notified.length > 0)
+        lines.push(`  ${styles.dim("Notified")}  ${notified.join(", ")}`);
+    const unresolved = Array.isArray(data.unresolved_mentions)
+        ? data.unresolved_mentions.filter((value) => typeof value === "string")
+        : [];
+    if (unresolved.length > 0) {
+        lines.push(`  ${styles.yellow("Not a workspace member, so not notified:")} ${unresolved.join(", ")}`);
+    }
+    const note = collabText(data.note, "");
+    if (note)
+        lines.push(`  ${styles.dim(note)}`);
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/** One line naming what changed, matched to each write endpoint's payload shape. */
+function collabWriteHeadline(data) {
+    // A thread write (`comments add`, `comments resolve`) serializes the thread
+    // itself at the top level.
+    if (typeof data.status === "string" && typeof data.subject === "string") {
+        return `${collabText(data.subject)} — thread ${collabText(data.id)} is ${data.status}.`;
+    }
+    if (isRecord(data.comment)) {
+        return data.comment.deleted === true ? "Comment retracted." : "Comment updated.";
+    }
+    if (isRecord(data.request)) {
+        return `Approval request ${collabText(data.request.id)} is ${collabText(data.request.status)}.`;
+    }
+    // The member-role write returns the membership fields flat, not nested.
+    if (typeof data.email === "string") {
+        return data.granted === true
+            ? `${data.email} is now a client-role member of this workspace.`
+            : `${data.email} is back to full workspace access.`;
+    }
+    return "Done.";
+}
+function formatCollabThreads(data) {
+    const styles = collabStyles();
+    const threads = Array.isArray(data.threads) ? data.threads.filter(isRecord) : [];
+    const subject = collabText(data.subject, "this object");
+    const lines = ["", styles.bold(`Comments on ${subject}`)];
+    if (threads.length === 0) {
+        lines.push(`  ${styles.dim(collabText(data.hint, "No comment threads here yet."))}`);
+    }
+    for (const thread of threads) {
+        const status = collabText(thread.status, "open");
+        const badge = status === "resolved" ? styles.dim("[resolved]") : styles.green("[open]");
+        const title = collabText(thread.title, "");
+        lines.push("", `  ${badge} ${collabText(thread.id)}  ${styles.dim(`${thread.comment_count ?? 0} comment(s) · ${formatCollabAge(thread.created_at)} old`)}`);
+        if (title)
+            lines.push(`    ${styles.bold(title)}`);
+        if (typeof thread.subject_path === "string" && thread.subject_path) {
+            lines.push(`    ${styles.dim(`on ${thread.subject_path}`)}`);
+        }
+        const comments = Array.isArray(thread.comments) ? thread.comments.filter(isRecord) : [];
+        for (const comment of comments) {
+            const author = collabText(comment.author_email, "someone");
+            const marker = comment.parent_comment_id ? "  ↳" : "  •";
+            const edited = comment.edited_at ? styles.dim(" (edited)") : "";
+            const text = comment.deleted === true
+                ? styles.dim("(retracted)")
+                : collabSnippet(comment.body, 72);
+            lines.push(`    ${marker} ${styles.dim(`${formatCollabAge(comment.created_at)} ${author}`)}  ${text}${edited}`);
+            lines.push(`      ${styles.dim(collabText(comment.id))}`);
+        }
+        const threadLink = collabLink(thread);
+        if (threadLink)
+            lines.push(`    ${styles.dim(threadLink)}`);
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+function collabRequestRow(request) {
+    return [
+        collabText(request.id),
+        collabText(request.subject),
+        collabText(request.gate_kind),
+        collabText(request.status),
+        collabText(request.requested_by_email, "—"),
+        formatCollabAge(request.created_at),
+    ];
+}
+const COLLAB_REQUEST_HEADERS = ["ID", "SUBJECT", "GATE", "STATUS", "REQUESTED BY", "AGE"];
+function formatCollabRequestList(data) {
+    const styles = collabStyles();
+    const requests = Array.isArray(data.requests) ? data.requests.filter(isRecord) : [];
+    const lines = ["", styles.bold(`Approval requests (${requests.length})`)];
+    if (requests.length === 0) {
+        lines.push(`  ${styles.dim(collabText(data.hint, "No approval requests match those filters."))}`);
+    }
+    else {
+        lines.push(...renderTextTable(COLLAB_REQUEST_HEADERS, requests.map(collabRequestRow)));
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * The daily surface. Two sections and nothing else: what needs a decision from
+ * this reader, and where they were named. An item the reader cannot act on has
+ * no business being here, so there is no "everything else" section.
+ */
+function formatCollabInbox(data) {
+    const styles = collabStyles();
+    const pending = Array.isArray(data.pending_approvals) ? data.pending_approvals.filter(isRecord) : [];
+    const mentions = Array.isArray(data.mentions) ? data.mentions.filter(isRecord) : [];
+    const lines = ["", styles.bold(`Waiting on you (${pending.length})`)];
+    if (pending.length === 0) {
+        lines.push(`  ${styles.dim("No approvals are assigned to you.")}`);
+    }
+    else {
+        lines.push(...renderTextTable(COLLAB_REQUEST_HEADERS, pending.map(collabRequestRow)));
+    }
+    lines.push("", styles.bold(`Threads that name you (${mentions.length})`));
+    if (mentions.length === 0) {
+        lines.push(`  ${styles.dim("Nobody has mentioned you in an open thread.")}`);
+    }
+    else {
+        lines.push(...renderTextTable(["THREAD", "SUBJECT", "LAST COMMENT", "AGE"], mentions.map((thread) => {
+            const comments = Array.isArray(thread.comments) ? thread.comments.filter(isRecord) : [];
+            const last = comments[comments.length - 1];
+            return [
+                collabText(thread.id),
+                collabText(thread.subject),
+                collabSnippet(last?.body, 44) || collabText(thread.title, "—"),
+                formatCollabAge(thread.updated_at ?? thread.created_at),
+            ];
+        })));
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * `approvals show`. The reader here usually arrived from a link in an email and
+ * knows nothing but the id, so this answers the four questions a table cell
+ * cannot: what is being asked, on what, who owes the answer, and whether the
+ * request can still be decided. An expired request says so in the headline —
+ * `approvals decide` on it is refused by the API.
+ */
+function formatCollabRequestDetail(data) {
+    const styles = collabStyles();
+    const request = isRecord(data.request) ? data.request : data;
+    const status = collabText(request.status);
+    const lapsed = request.lapsed === true;
+    const badge = lapsed
+        ? styles.yellow("[EXPIRED]")
+        : request.opens_gate === true
+            ? styles.green("[APPROVED]")
+            : status === "pending"
+                ? styles.dim("[PENDING]")
+                : styles.yellow(`[${status.toUpperCase()}]`);
+    const assignees = Array.isArray(request.assignee_emails)
+        ? request.assignee_emails.filter((value) => typeof value === "string")
+        : [];
+    const lines = [
+        "",
+        `  ${badge} ${collabText(request.title, "Approval request")}`,
+        `  ${styles.dim("Request")}  ${collabText(request.id)}`,
+        `  ${styles.dim("Subject")}  ${collabText(request.subject)}`,
+        `  ${styles.dim("Gate")}     ${collabText(request.gate_kind)} — ${collabText(request.gate_meaning, "")}`,
+        `  ${styles.dim("Asked by")} ${collabText(request.requested_by_email, "someone")}`,
+        `  ${styles.dim("Decides")}  ${assignees.length > 0 ? assignees.join(", ") : "—"}`,
+    ];
+    const body = collabSnippet(request.body, 72);
+    if (body)
+        lines.push(`  ${styles.dim("Asking")}   ${body}`);
+    if (typeof request.expires_at === "string") {
+        lines.push(`  ${styles.dim("Expires")}  ${request.expires_at}${lapsed ? styles.yellow(" — already passed") : ""}`);
+    }
+    const note = collabText(request.decision_note, "");
+    if (note)
+        lines.push(`  ${styles.dim("Note")}     ${note}`);
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * `approvals client list`. The column that matters is ACCESS: a blank role cell
+ * means FULL access, not a restricted one, and reading it the other way is how
+ * an agency convinces itself a client login is limited when it is not.
+ */
+function formatCollabMembers(data) {
+    const styles = collabStyles();
+    const members = Array.isArray(data.members) ? data.members.filter(isRecord) : [];
+    const lines = ["", styles.bold(`Workspace members (${members.length})`)];
+    if (members.length === 0) {
+        lines.push(`  ${styles.dim("No members resolved for this workspace.")}`);
+    }
+    else {
+        lines.push(...renderTextTable(["EMAIL", "WORKSPACE ROLE", "OXYGEN ROLE", "ACCESS"], members.map((member) => [
+            collabText(member.email, collabText(member.user_id)),
+            collabText(member.workspace_role),
+            member.oxygen_role === "client" ? "client" : "—",
+            collabText(member.access),
+        ])));
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+function formatCollabRequestWrite(data) {
+    const styles = collabStyles();
+    // The request is nested; the resolved assignee emails are not.
+    const request = isRecord(data.request) ? data.request : data;
+    const assignees = Array.isArray(data.assignee_emails)
+        ? data.assignee_emails.filter((value) => typeof value === "string")
+        : [];
+    const lines = [
+        "",
+        `  ${styles.green("[OK]")} Asked ${assignees.length > 0 ? assignees.join(", ") : "the assignees"} to decide.`,
+        `  ${styles.dim("Request")}  ${collabText(request.id)}`,
+        `  ${styles.dim("Subject")}  ${collabText(request.subject)}`,
+        `  ${styles.dim("Gate")}     ${collabText(request.gate_kind)} — ${collabText(request.gate_meaning, "")}`,
+    ];
+    if (typeof request.expires_at === "string") {
+        lines.push(`  ${styles.dim("Expires")}  ${request.expires_at} ${styles.dim("(an expired request does not open the gate)")}`);
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * A decision's headline is `opens_gate`, never the status alone: "the client
+ * replied" and "the client said yes" are the two states an agency must never
+ * confuse, and `changes_requested` is the one that reads like the second and
+ * behaves like the first.
+ */
+function formatCollabDecision(data) {
+    const styles = collabStyles();
+    const request = isRecord(data.request) ? data.request : data;
+    const status = collabText(request.status);
+    const opensGate = request.opens_gate === true || data.gate_opened === true;
+    const lines = [
+        "",
+        `  ${opensGate ? styles.green("[APPROVED]") : styles.yellow(`[${status.toUpperCase()}]`)} ${collabText(request.subject)} — request ${collabText(request.id)}`,
+        `  ${styles.dim("Gate")}     ${opensGate
+            ? `open — the ${collabText(request.gate_kind)} gate no longer blocks this.`
+            : `still shut — a ${collabText(request.gate_kind)} gate only opens on --approve.`}`,
+    ];
+    const note = collabText(request.decision_note, "");
+    if (note)
+        lines.push(`  ${styles.dim("Note")}     ${note}`);
+    if (data.already === true)
+        lines.push(`  ${styles.dim("Replay of the same decision; nothing changed.")}`);
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+function formatCollabGateSet(data) {
+    const styles = collabStyles();
+    const policy = isRecord(data.policy) ? data.policy : {};
+    const required = policy.required === true;
+    const scope = collabText(data.scope, "subject") === "workspace_default"
+        ? `every ${collabText(policy.subject_kind)}`
+        : `${collabText(policy.subject_kind)}:${collabText(policy.subject_id)}`;
+    const lines = [
+        "",
+        `  ${required ? styles.green("[GATE ON]") : styles.dim("[GATE OFF]")} ${collabText(policy.gate_kind)} on ${scope}`,
+        `  ${styles.dim("Means")}    ${collabText(policy.gate_meaning, "")}`,
+    ];
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+function formatCollabGateList(data) {
+    const styles = collabStyles();
+    const policies = Array.isArray(data.policies) ? data.policies.filter(isRecord) : [];
+    const effective = Array.isArray(data.effective) ? data.effective.filter(isRecord) : [];
+    const lines = ["", styles.bold(`Gate policies (${policies.length})`)];
+    if (policies.length === 0) {
+        lines.push(`  ${styles.dim("No gate is required anywhere in this workspace.")}`);
+    }
+    else {
+        lines.push(...renderTextTable(["GATE", "SCOPE", "APPLIES TO", "REQUIRED"], policies.map((policy) => [
+            collabText(policy.gate_kind),
+            collabText(policy.scope),
+            collabText(policy.subject_id, `every ${collabText(policy.subject_kind)}`),
+            policy.required === true ? "yes" : "no",
+        ])));
+    }
+    if (effective.length > 0) {
+        lines.push("", styles.bold(`Effective for ${collabText(data.subject)}`));
+        lines.push(...renderTextTable(["GATE", "REQUIRED", "SOURCE", "BLOCKED NOW", "PENDING REQUEST"], effective.map((entry) => [
+            collabText(entry.gate_kind),
+            entry.required === true ? "yes" : "no",
+            collabText(entry.source),
+            entry.blocked === true ? "yes" : "no",
+            collabText(entry.pending_request_id, "—"),
+        ])));
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
 // `columns reorder` accepts either an absolute --position or a relative
 // --before/--after naming a sibling column. The relative form is resolved
 // client-side into an absolute index against the table's current column order