@oxygen-agent/cli 1.638.1 → 1.677.10

package/dist/index.js

@@ -9,7 +9,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, CommanderError, Option } from "commander";
 import { applyOxygenHelp } from "./help.js";
 import { buildCommandManifest, getCommandManifestEntry, searchCommandManifest, suggestCommandNames, } from "./command-manifest.js";
-import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, exitCodeForOxygenError, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
+import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { TAG_COLORS } from "@oxygen/shared/select-options";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, } from "@oxygen/shared/file-import";
 import { assertRecipeBundleSafe, assertWorkflowGraphManifest, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowGraphManifest, isWorkflowManifest, } from "@oxygen/workflows";
@@ -58,6 +58,115 @@ function tagRegistryBody(options) {
         body.pinned = false;
     return body;
 }
+// --- Collaboration: comments + approvals (Control layer) ---------------------
+//
+// EVERY enumeration below is mapped over a shared total map in
+// @oxygen/shared/collab.ts — never typed out here. A blind-user eval found
+// `tags --help` advertising 7 of the 13 taggable kinds because the prose sat
+// beside a hand-maintained marker map and drifted; six kinds were invisible
+// from the one place a user looks. The collab maps are total over their key
+// type, so adding a subject kind or a gate is a compile error until it is
+// glossed, and the moment it compiles it is already in this help text.
+/** `--on` / `--path` help, shared by every command that addresses a subject. */
+const COLLAB_SUBJECT_REF_HELP = `Subject as "<kind>:<id>" — e.g. sequence:9f1c2b7e. Kinds: ${COLLAB_SUBJECT_KINDS.join(", ")}.`;
+/** What a thread on each kind is usually about, for the group descriptions. */
+const COLLAB_SUBJECT_GLOSS = COLLAB_SUBJECT_KINDS
+    .map((kind) => `${kind} (${COLLAB_SUBJECT_PROSE[kind]})`)
+    .join("; ");
+/** Every gate, what it means, and which kinds it can be required on. */
+const COLLAB_GATE_GLOSS = COLLAB_GATE_KINDS
+    .map((gate) => `${gate} — ${COLLAB_GATE_PROSE[gate]}; set it on ${GATE_KIND_SUBJECTS[gate]
+    .map((kind) => COLLAB_SUBJECT_LABELS[kind].many)
+    .join(" or ")}`)
+    .join(". ");
+const COLLAB_GATE_FLAG_HELP = `Which gate: ${COLLAB_GATE_KINDS.join(" | ")}. ${COLLAB_GATE_GLOSS}.`;
+const COLLAB_SUBJECT_PATH_HELP = `Narrow to a sub-object: ${SUBJECT_PATH_FORMS_PROSE}.`;
+/**
+ * Both group descriptions end with this, because a surface that is one release
+ * old should say so where a user meets it. Beta here means exactly what it means
+ * for Agents, the Knowledge Graph, and Recipes: WEB NAV VISIBILITY. Nothing
+ * about the gate, the client role, or credit rules is softened by the toggle,
+ * and this command group is reachable at either setting — which is what keeps a
+ * gate armed from the terminal answerable from the terminal.
+ */
+const COLLAB_BETA_NOTE = "BETA: the /collab entry appears in the web sidebar once a workspace enables Settings -> Beta features; "
+    + "these commands, the gate, and the client role behave identically either way.";
+/**
+ * Parse `--on <kind>:<id>`. Client-side so a typo costs no round trip and the
+ * error can list every legal kind — `parseSubjectRef` already throws a typed
+ * `invalid_subject_ref` (exit 2) carrying `details.valid_kinds`.
+ */
+function requireCollabSubject(value) {
+    const raw = readOption(value);
+    if (!raw) {
+        throw new OxygenError("invalid_subject_ref", `--on is required. ${COLLAB_SUBJECT_REF_HELP}`, {
+            details: { valid_kinds: [...COLLAB_SUBJECT_KINDS] },
+            exitCode: 2,
+        });
+    }
+    return parseSubjectRef(raw);
+}
+/** Validate and canonicalize `--path`; undefined when the flag was not passed. */
+function readCollabPath(value) {
+    const raw = readOption(value);
+    return raw ? formatSubjectPath(parseSubjectPath(raw)) : undefined;
+}
+function requireCollabGate(value) {
+    const raw = readOption(value);
+    const gate = COLLAB_GATE_KINDS.find((candidate) => candidate === raw);
+    if (!gate) {
+        throw new OxygenError("invalid_request", `--gate must be one of: ${COLLAB_GATE_KINDS.join(", ")}. ${COLLAB_GATE_GLOSS}.`, {
+            details: { gate: raw, valid_gate_kinds: [...COLLAB_GATE_KINDS] },
+            exitCode: 2,
+        });
+    }
+    return gate;
+}
+function requireCollabSubjectKind(value) {
+    const raw = readOption(value);
+    const kind = COLLAB_SUBJECT_KINDS.find((candidate) => candidate === raw);
+    if (!kind) {
+        throw new OxygenError("invalid_subject_ref", `--default must be one of: ${COLLAB_SUBJECT_KINDS.join(", ")}.`, {
+            details: { subject_kind: raw, valid_kinds: [...COLLAB_SUBJECT_KINDS] },
+            exitCode: 2,
+        });
+    }
+    return kind;
+}
+/**
+ * At least one assignee. Commander cannot enforce this (the repeatable
+ * collector's `[]` default satisfies its mandatory check), and a request with
+ * nobody on it is the exact failure the API refuses to create: it looks filed,
+ * blocks the gate, and is discovered the next morning.
+ */
+function requireCollabAssignees(values) {
+    const assignees = values.map((value) => value.trim()).filter(Boolean);
+    if (assignees.length === 0) {
+        throw new OxygenError("invalid_request", "--assignee <email> is required: name at least one workspace member who can decide.", { exitCode: 2 });
+    }
+    return assignees;
+}
+/**
+ * Exactly one of --approve / --reject / --changes-requested. Neither zero nor
+ * two is guessable: `changes_requested` is a real decision that does NOT open
+ * the gate, so silently defaulting either way would either stall a campaign or
+ * launch one the client never agreed to.
+ */
+function requireCollabDecision(options) {
+    const selected = [];
+    if (options.approve)
+        selected.push("approve");
+    if (options.reject)
+        selected.push("reject");
+    if (options.changesRequested)
+        selected.push("changes_requested");
+    if (selected.length !== 1) {
+        throw new OxygenError("invalid_request", selected.length === 0
+            ? "Pass exactly one decision: --approve, --reject, or --changes-requested (asks for edits; does NOT open the gate)."
+            : `Pass only one decision flag — got ${selected.length}: --approve, --reject, and --changes-requested are mutually exclusive.`, { details: { decisions_passed: selected }, exitCode: 2 });
+    }
+    return selected[0];
+}
 function buildFindBody(capability, options) {
     const body = { capability };
     const set = (key, value) => {
@@ -667,6 +776,28 @@ function writeMaxCreditsHint(error) {
             return;
         }
         case "approval_required": {
+            // A COLLABORATION gate reuses this code but is not a spend gate: no flag
+            // on this command can unblock it, because the whole point is that a
+            // second party decides. Printing the "--approved --max-credits" hint here
+            // would send the operator hunting for a flag that does not exist, so the
+            // gate branch runs first and prints the command the OTHER person runs.
+            const gateKind = readDetailsString(error.details, "gate_kind");
+            if (gateKind) {
+                const nextStep = readDetailsString(error.details, "next_step");
+                process.stderr.write(`hint: blocked by the ${gateKind} approval gate — ${nextStep ?? "ask an assignee to decide it"}\n`);
+                const lastDecision = isRecord(error.details) && isRecord(error.details.last_decision)
+                    ? error.details.last_decision
+                    : null;
+                if (lastDecision) {
+                    const note = readDetailsString(lastDecision, "note");
+                    process.stderr.write(`hint: the last answer was ${readDetailsString(lastDecision, "status") ?? "recorded"}${note ? ` — "${note}"` : ""}; revise, then ask again\n`);
+                }
+                const requestUrl = readDetailsString(error.details, "pending_request_web_url")
+                    ?? readDetailsString(error.details, "subject_web_url");
+                if (requestUrl)
+                    process.stderr.write(`hint: ${requestUrl}\n`);
+                return;
+            }
             if (error.message.startsWith("Public replies require --approved")) {
                 process.stderr.write("hint: inspect the exact preview, then re-run with its --content-hash <sha256> and --approved\n");
                 return;
@@ -705,6 +836,12 @@ function readDetailsNumber(details, key) {
     const value = details[key];
     return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
+function readDetailsString(details, key) {
+    if (!isRecord(details))
+        return null;
+    const value = details[key];
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}
 function parseJsonArray(value) {
     let parsed;
     try {
@@ -1435,6 +1572,17 @@ function buildCrmPhotosBody(options) {
         ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
     };
 }
+function buildCrmRollupBody(options) {
+    const object = readOption(options.object);
+    const row = readOption(options.row);
+    const limit = readOption(options.limit);
+    return {
+        mode: resolveLiveDryRunMode(options),
+        ...(object ? { object } : {}),
+        ...(row ? { row } : {}),
+        ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
+    };
+}
 function readCrmSetupObjects(value) {
     const objects = readCsvOption(value);
     return objects.length > 0 ? [...new Set(objects)] : DEFAULT_CRM_SETUP_OBJECTS;
@@ -3762,9 +3910,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     })))
         .addCommand(new Command("analytics")
-        .description("Engagement metrics the worker syncs back from the provider. Free reads. LinkedIn exposes reactions, comments, and reshares only — impressions, saves, and sends come back null, never zero.")
+        .description("Stored LinkedIn and X engagement snapshots synced in the background. LinkedIn includes owned posts discovered from the provider; X includes only posts published through OXYGEN. Reading analytics makes no provider call and uses 0 credits. A snapshotted post completed a sync pass; use per-metric coverage to see which values were populated. Null is unknown, never zero. Stale or pending snapshots retry automatically; no manual provider retry is available or needed.")
         .addCommand(new Command("summary")
-        .description("Workspace LinkedIn performance for posts published through OXYGEN. Uses each post's latest stored snapshot; unsupported metrics stay null. Read-only: no provider call, 0 credits.")
+        .description("Workspace LinkedIn or X analytics. LinkedIn includes owned posts discovered from the provider; X currently includes posts published through OXYGEN. Uses each post's latest stored snapshot; snapshotted_posts (legacy measured_posts) counts sync passes, while coverage counts non-null values. Read-only: no provider call, 0 credits.")
+        .option("--channel <channel>", "Channel to summarize: linkedin (default) or x.")
         .option("--range <range>", "Publication window: 7d, 30d (default), 90d, or 365d.")
         .option("--from <date>", "Custom inclusive UTC start date.")
         .option("--to <date>", "Custom inclusive UTC end date.")
@@ -3772,6 +3921,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("publishing analytics summary", options, () => requestOxygen(buildPublishingAnalyticsPath("/api/cli/publishing/analytics/summary", {
+            channel: readOption(options.channel),
             range: readOption(options.range),
             from: readOption(options.from),
             to: readOption(options.to),
@@ -3779,7 +3929,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         })));
     }))
         .addCommand(new Command("post")
-        .description("One post's stored daily metric series, totals, and earned-media value. EMV is impressions-derived, so on LinkedIn it returns null with an unavailable_reason instead of a made-up number. Read-only: no provider call, 0 credits.")
+        .description("One post's stored daily metric series, totals, and earned-media value. EMV is impressions-derived; absent impressions return a reason instead of a made-up number. Read-only: no provider call, 0 credits.")
         .argument("<post_id>", "Scheduled post id.")
         .option("--since <date>", "ISO date to start the series from.")
         .option("--json", "Print a JSON envelope.")
@@ -3806,7 +3956,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: { cpm: parseJsonObject(options.cpmJson ?? "") },
         }));
-    })))
+    }))
+        .addHelpText("after", "\nExample (stored X snapshots, 0 credits, no provider call):\n  oxygen publishing analytics summary --channel x --range 30d --json\n"))
         .addCommand(new Command("import")
         .description("Bulk-load scheduled posts from a .csv or .json file. Dry-run by DEFAULT: it parses, lints, and reports invalid rows while writing nothing. Pass --approved to actually write. Imported posts land as drafts that still need approval — import never approves and never publishes. A row whose idempotency_key was already used is skipped, so re-importing the same file cannot duplicate the queue.")
         .requiredOption("--file <path>", "Path to a .csv (header row) or .json file ([rows] or { rows: [...] }).")
@@ -3998,6 +4149,20 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: buildCrmPhotosBody(options),
         }));
+    }))
+        .addCommand(new Command("rollup")
+        .description("Recompute the Open Deal column on companies (and the copy stamped on their people) from this workspace's deals. It normally converges on every deal write; run this to repair after a bulk import, or on a workspace whose deals predate the column. Free: no provider calls, no credits. Defaults to dry-run.")
+        .option("--object <object>", "CRM object to recompute. Only companies today. Defaults to companies.")
+        .option("--row <id>", "Recompute one company record by row id instead of sweeping the object.")
+        .option("--limit <n>", "Maximum company rows to scan in one sweep. Defaults to 2000.")
+        .option("--dry-run", "Report how many companies disagree with their deals, without writing. A deal with no stage set is not an open deal and is excluded from the comparison, so a blank-stage deal is never reported as drift.")
+        .option("--live", "Write the recomputed Open Deal cells. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm rollup", options, () => requestOxygen("/api/cli/crm/rollup", {
+            method: "POST",
+            body: buildCrmRollupBody(options),
+        }));
     }))
         .addCommand(
     // `crm objects` lists (parent action runs when no subcommand matches);
@@ -5268,7 +5433,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         return requestOxygen(`/api/cli/tables/webhooks?${params.toString()}`);
     })))
         .addCommand(new Command("create")
-        .description("Create a direct webhook endpoint that writes inbound JSON into a table.")
+        .description("Create a direct webhook endpoint that writes inbound JSON into a table (600 requests/60s per endpoint and sender IP; 429 returns Retry-After).")
         .argument("<table>", "Table id or slug.")
         .option("--name <name>", "Display name for the webhook.")
         .option("--mode <mode>", "insert or upsert. Defaults to upsert when --upsert-key is set, otherwise insert.")
@@ -5278,6 +5443,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--event-id-path <path>", "Dot path to the event id. Defaults to event_id, eventId, id, or payload hash.")
         .option("--event-type-path <path>", "Dot path to the event type. Defaults to type or event.")
         .option("--occurred-at-path <path>", "Dot path to the event timestamp.")
+        .option("--source <source>", "http (default) writes inbound JSON anyone can POST. unipile subscribes the table to your connected LinkedIn/WhatsApp accounts' events instead — no endpoint URL, no secret to share, and 0 credits: rows appear as the events reach Oxygen.")
+        .option("--account <unipile_account_id>", "unipile source only. Listen to ONE connected account. Omit to listen to every connected account in the workspace.")
+        .option("--events <csv>", "unipile source only. Comma-separated event types, e.g. relation.new,message.new. Omit for every event the receiver handles. Post reactions, post comments, profile viewers and followers are NOT pushed by the provider — capture those with a scheduled feed (`oxygen feeds bind`).")
+        .option("--mapping <mapping>", "unipile source only. curated (default) flattens known events into stable named columns; passthrough lands the raw provider event so you can map any type yourself.")
         .option("--auto-run-columns <csv>", "Comma-separated enrichment, tool, AI, or formula columns to queue for webhook-written rows.")
         .option("--auto-run-max-credits <n>", "Credit ceiling per webhook-triggered auto-run batch; items beyond it are skipped with credit_limit_reached. Defaults to your plan's per-delivery ceiling when omitted.")
         .option("--auto-run-max-concurrency <n>", "Maximum concurrent row items for webhook-triggered auto-runs.")
@@ -5287,6 +5456,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action((table, options) => {
         const autoRun = readTableWebhookAutoRunOptions(options);
+        const unipile = readOption(options.source) === "unipile";
         return handleAsyncAction("tables webhook create", options, () => requestOxygen("/api/cli/tables/webhooks", {
             method: "POST",
             body: {
@@ -5299,6 +5469,14 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 ...(readOption(options.eventIdPath) ? { event_id_path: readOption(options.eventIdPath) } : {}),
                 ...(readOption(options.eventTypePath) ? { event_type_path: readOption(options.eventTypePath) } : {}),
                 ...(readOption(options.occurredAtPath) ? { occurred_at_path: readOption(options.occurredAtPath) } : {}),
+                ...(unipile
+                    ? {
+                        feed_kind: "unipile",
+                        ...(readOption(options.account) ? { unipile_account_id: readOption(options.account) } : {}),
+                        ...(readOption(options.events) ? { event_types: readOption(options.events) } : {}),
+                        ...(readOption(options.mapping) ? { mapping: readOption(options.mapping) } : {}),
+                    }
+                    : {}),
                 ...(autoRun ? { auto_run: autoRun } : {}),
             },
         }));
@@ -5340,7 +5518,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("List direct table webhook deliveries and auto-run enqueue status.")
         .argument("[endpoint_id]", "Optional webhook endpoint id, such as tw_...")
         .option("--table <table>", "Filter by table id or slug.")
-        .option("--status <status>", "Filter by received, completed, or failed.")
+        .option("--status <status>", "Filter by received, completed, failed, or rejected (rejected = arrived while the feed was paused and was turned away; no rows written).")
         .option("--auto-run-status <status>", "Filter by not_configured, queued, skipped, or failed_to_enqueue.")
         .option("--limit <n>", "Maximum deliveries to return. Defaults to 50.")
         .option("--json", "Print a JSON envelope.")
@@ -5623,7 +5801,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("List the shared table delivery ledger: pull-feed sync cycles and inbound webhook deliveries land in the same place. Filter by --table (the identifier `feeds list` gives you) or by a webhook endpoint id. Read-only.")
         .argument("[endpoint_id]", "Optional webhook endpoint id, such as tw_...")
         .option("--table <table>", "Table id or slug whose ledger to read.")
-        .option("--status <status>", "Filter by received, completed, or failed.")
+        .option("--status <status>", "Filter by received, completed, failed, or rejected (rejected = arrived while the feed was paused and was turned away; no rows written).")
         .option("--limit <n>", "Maximum deliveries to return. Defaults to 50.")
         .option("--json", "Print a JSON envelope.")
         .action((endpointId, options) => handleAsyncAction("feeds deliveries", options, () => requestOxygen(tableWebhookDeliveriesPath({
@@ -6133,7 +6311,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }));
     program
         .command("tags")
-        .description(`Workspace tags: one vocabulary across ${TAG_KINDS_PROSE}. Tags normalize to lowercase (trimmed, deduped, max 50 per item; any characters — nothing is slugified, so "Q3 Outbound" becomes "q3 outbound"). ATTACH tags on the owning surface — each of those groups has its own \`tag\` subcommand (e.g. \`oxygen inbox tag\`, \`oxygen tables tag\`, \`oxygen domains tag\`) — then \`tags get <tag>\` returns every carrier with deep-links. CURATE the vocabulary here: \`tags create\` declares a tag (with a description, color, and pin) before anything carries it, \`tags update\` re-annotates one, and \`tags rename\`/\`merge\`/\`delete\` reshape it everywhere at once.`)
+        .description(`Workspace tags: one vocabulary across ${TAG_KINDS_PROSE}. Tags normalize to lowercase (trimmed, deduped, max 50 per item; any characters — nothing is slugified, so "Q3 Outbound" becomes "q3 outbound"). ATTACH tags on the owning surface — each of those groups has its own \`tag\` subcommand (e.g. \`oxygen inbox tag\`, \`oxygen tables tag\`, \`oxygen domains tag\`) — then \`tags get <tag>\` returns every carrier with deep-links. CURATE the vocabulary here: \`tags create\` declares a tag (with a description, color, and pin) before anything carries it, \`tags update\` re-annotates one, and \`tags rename\`/\`merge\`/\`delete\` reshape it everywhere at once. Tags are free, inert metadata: attaching or removing one costs 0 credits, makes no provider call, and changes no sending, routing, or warm-up behaviour.`)
         .addCommand(new Command("list")
         .description("List every workspace tag with per-primitive counts, most-used first.")
         .option("--json", "Print a JSON envelope.")
@@ -6218,6 +6396,258 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             body: { action: "delete", tags, ...(options.apply ? { apply: true } : {}) },
         }));
     }));
+    program
+        .command("comments")
+        .description(`Threaded comments on any workspace object — ${COLLAB_SUBJECT_KINDS_PROSE} — so the client's go/no-go stops living in a Google Doc. A comment is state ABOUT a GTM artifact, never the artifact: resolving a thread changes no campaign. Address the subject with --on <kind>:<id>, and one row, cell, or column of a table with --path row:<rowId>[#<columnKey>] | column:<columnKey>. Threads are open until somebody resolves them; any member may resolve. The thing that actually BLOCKS work is an approval gate — see \`oxygen approvals\`. What a thread is usually about, per kind: ${COLLAB_SUBJECT_GLOSS}. ${COLLAB_BETA_NOTE}`)
+        .addCommand(new Command("add")
+        .description("Comment on a workspace object. Without --reply this opens a NEW thread with this comment as its first; with --reply it answers inside the existing one. @email tokens in the body are resolved to workspace members and notified, so --mention is only needed for someone you did not name in the text.")
+        .argument("<body...>", "What you want to say. Quote it, or let the shell pass it as words.")
+        .requiredOption("--on <kind:id>", COLLAB_SUBJECT_REF_HELP)
+        .option("--path <path>", COLLAB_SUBJECT_PATH_HELP)
+        .option("--reply <id>", "Answer inside an existing thread. Pass a comment id to nest under it, or a thread id to reply at that thread's top level.")
+        .option("--mention <email>", "Notify a workspace member. Repeatable.", collectRepeatable, [])
+        .option("--title <text>", "Title for a NEW thread. Ignored when replying.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (body, options) => {
+        await handleCommentsAddAction(body.join(" "), options);
+    }))
+        .addCommand(new Command("list")
+        .description("Every comment thread on one object, newest first, with its comments inline. Defaults to open threads only.")
+        .requiredOption("--on <kind:id>", COLLAB_SUBJECT_REF_HELP)
+        .option("--path <path>", `${COLLAB_SUBJECT_PATH_HELP} Omit to see every thread on the object.`)
+        .option("--status <status>", "open (default), resolved, or all.")
+        .option("--limit <n>", "Maximum threads to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("comments list", options, () => {
+            const subject = requireCollabSubject(options.on);
+            const path = readCollabPath(options.path);
+            const params = new URLSearchParams({ subject: `${subject.kind}:${subject.id}` });
+            if (path)
+                params.set("path", path);
+            const status = readOption(options.status);
+            if (status)
+                params.set("status", status);
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            return requestOxygen(`/api/cli/collab/threads?${params.toString()}`);
+        }, formatCollabThreads);
+    }))
+        .addCommand(new Command("show")
+        .description("One thread by its own id, with every comment. This is what to run when all you have is the id out of a notification email or a `/collab/threads/<id>` link — `list` needs the object the thread hangs off, which that link does not tell you.")
+        .argument("<threadId>", "Thread id (from a notification email, a deep-link, or `oxygen comments list`).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (threadId, options) => {
+        await handleCollabAction("comments show", options, () => requestOxygen(`/api/cli/collab/threads/${encodeURIComponent(threadId)}`), 
+        // Same payload shape `comments list` returns, one thread long, so the
+        // renderer is the same one.
+        formatCollabThreads);
+    }))
+        .addCommand(new Command("resolve")
+        .description("Mark a thread settled, or reopen it with --reopen. Idempotent both ways: re-resolving keeps the original resolver and timestamp. This is conversation state only — it never unblocks an approval gate.")
+        .argument("<threadId>", "Thread id (from `oxygen comments list`).")
+        .option("--reopen", "Reopen a resolved thread instead of resolving it.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (threadId, options) => {
+        await handleCollabAction("comments resolve", options, () => requestOxygen(`/api/cli/collab/threads/${encodeURIComponent(threadId)}/resolve`, {
+            method: "POST",
+            body: { resolved: !options.reopen },
+        }), formatCollabWriteResult);
+    }))
+        .addCommand(new Command("edit")
+        .description("Rewrite one of your own comments. AUTHOR ONLY. The edit stamps edited_at — a thread that decided a launch is evidence, and evidence that changes without a trace is not evidence.")
+        .argument("<commentId>", "Comment id (from `oxygen comments list`).")
+        .argument("<body...>", "The replacement text.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (commentId, body, options) => {
+        await handleCollabAction("comments edit", options, () => requestOxygen(`/api/cli/collab/comments/${encodeURIComponent(commentId)}`, {
+            method: "PATCH",
+            body: { body: body.join(" ") },
+        }), formatCollabWriteResult);
+    }))
+        .addCommand(new Command("delete")
+        .description("Retract one of your own comments. AUTHOR ONLY, idempotent. The row stays so the thread remains a complete audit trail; the text is redacted on every read path.")
+        .argument("<commentId>", "Comment id (from `oxygen comments list`).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (commentId, options) => {
+        await handleCollabAction("comments delete", options, () => requestOxygen(`/api/cli/collab/comments/${encodeURIComponent(commentId)}`, {
+            method: "DELETE",
+        }), formatCollabWriteResult);
+    }));
+    program
+        .command("approvals")
+        .description(`Second-party approvals: ask a named person to decide, and optionally make that decision a hard gate on the live action. Gates: ${COLLAB_GATE_GLOSS}. Asking never blocks anything by itself — a gate is separate, admin-set workspace policy (\`approvals gate set\`), and the owning primitive honors it (a gated sequence still previews and dry-runs; only the live start is refused). Only \`--approve\` opens a gate: \`--changes-requested\` is a real answer that asks for edits and leaves the gate shut. \`approvals client grant <email>\` hands a client a restricted login that can read the work, comment, and decide what is assigned to them — nothing else. ${COLLAB_BETA_NOTE}`)
+        .addCommand(new Command("request")
+        .description("Ask a named second party to decide. Assignees are workspace member EMAILS, and never your own: assigning yourself is refused, because a request you can answer yourself is not an approval. An address that is not a member is refused by name rather than silently dropped, because a request nobody can decide is only discovered the next morning.")
+        .requiredOption("--on <kind:id>", COLLAB_SUBJECT_REF_HELP)
+        .requiredOption("--gate <gate>", COLLAB_GATE_FLAG_HELP)
+        // requiredOption keeps `required: true` in the machine-readable manifest,
+        // but commander's mandatory check is satisfied by the collector's []
+        // default — so the action asserts non-empty itself (requireCollabAssignees).
+        .requiredOption("--assignee <email>", "Who decides — someone other than you. Repeatable: any one of them can answer. Required.", collectRepeatable, [])
+        .option("--path <path>", COLLAB_SUBJECT_PATH_HELP)
+        .option("--title <text>", "Short headline for the ask.")
+        .option("--body <text>", "What you want them to check.")
+        .option("--expires-hours <n>", "Deadline for the ANSWER: an undecided request lapses to expired after N hours, and an expired request never opens the gate. It does not put a clock on a yes — an approval given before the deadline keeps the gate open until the approved content changes.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals request", options, () => {
+            const subject = requireCollabSubject(options.on);
+            const gateKind = requireCollabGate(options.gate);
+            const assignees = requireCollabAssignees(options.assignee);
+            const path = readCollabPath(options.path);
+            const title = readOption(options.title);
+            const body = readOption(options.body);
+            const expiresInHours = readPositiveInt(options.expiresHours);
+            return requestOxygen("/api/cli/collab/requests", {
+                method: "POST",
+                body: {
+                    subject_kind: subject.kind,
+                    subject_id: subject.id,
+                    ...(path ? { subject_path: path } : {}),
+                    gate_kind: gateKind,
+                    ...(title ? { title } : {}),
+                    ...(body ? { body } : {}),
+                    assignees,
+                    ...(expiresInHours !== undefined ? { expires_in_hours: expiresInHours } : {}),
+                },
+            });
+        }, formatCollabRequestWrite);
+    }))
+        .addCommand(new Command("list")
+        .description("Approval requests in this workspace, newest first. Use --mine for the ones assigned to you, or `approvals inbox` for the daily view.")
+        .option("--status <status>", `Filter by status: ${["pending", "approved", "changes_requested", "rejected", "cancelled", "expired"].join(", ")}.`)
+        .option("--mine", "Only requests assigned to you.")
+        .option("--on <kind:id>", `Only requests on one subject. ${COLLAB_SUBJECT_REF_HELP}`)
+        .option("--limit <n>", "Maximum requests to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals list", options, () => {
+            const params = new URLSearchParams();
+            const status = readOption(options.status);
+            if (status)
+                params.set("status", status);
+            if (options.mine)
+                params.set("assigned_to_me", "true");
+            const on = readOption(options.on);
+            if (on) {
+                const subject = requireCollabSubject(on);
+                params.set("subject", `${subject.kind}:${subject.id}`);
+            }
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            const query = params.toString();
+            return requestOxygen(`/api/cli/collab/requests${query ? `?${query}` : ""}`);
+        }, formatCollabRequestList);
+    }))
+        .addCommand(new Command("inbox")
+        .description("What is waiting on YOU: pending approvals assigned to you plus open threads that name you, each with the command that answers it. This is the surface a client logs in to.")
+        .option("--limit <n>", "Maximum items per section.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals inbox", options, () => {
+            const limit = readPositiveInt(options.limit);
+            return requestOxygen(`/api/cli/collab/inbox${limit !== undefined ? `?limit=${limit}` : ""}`);
+        }, formatCollabInbox);
+    }))
+        .addCommand(new Command("show")
+        .description("One approval request by its own id: what is being asked, on what, by whom, who must decide, and whether it can still be decided at all. Run this on the id in a 'you have been asked to approve' email or a `/collab/approvals/<id>` link — `list` cannot find an id you have no subject for. An expired request is reported as such, with the command that clears it.")
+        .argument("<requestId>", "Request id (from a notification email, a deep-link, or `oxygen approvals inbox`).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (requestId, options) => {
+        await handleCollabAction("approvals show", options, () => requestOxygen(`/api/cli/collab/requests/${encodeURIComponent(requestId)}`), formatCollabRequestDetail);
+    }))
+        .addCommand(new Command("decide")
+        .description("Answer a pending request. Exactly one of --approve / --reject / --changes-requested. Assignees decide; a workspace admin may decide for the workspace; the requester may NOT decide their own request (that is the whole point) — withdraw it with `approvals cancel` instead. ONLY --approve opens a gate.")
+        .argument("<requestId>", "Request id (from `oxygen approvals inbox`).")
+        .option("--approve", "Approve it. This is the only decision that opens a gate.")
+        .option("--reject", "Refuse it. The gate stays shut.")
+        .option("--changes-requested", "Ask for edits. A real answer that does NOT open the gate — the requester revises and asks again.")
+        .option("--note <text>", "Why. Stored on the request and quoted back to whoever is blocked by it.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (requestId, options) => {
+        await handleCollabAction("approvals decide", options, () => {
+            const decision = requireCollabDecision(options);
+            const note = readOption(options.note);
+            return requestOxygen(`/api/cli/collab/requests/${encodeURIComponent(requestId)}/decide`, {
+                method: "POST",
+                body: { decision, ...(note ? { note } : {}) },
+            });
+        }, formatCollabDecision);
+    }))
+        .addCommand(new Command("cancel")
+        .description("Withdraw a pending request you filed (or, as an admin, clear a stale one). Replaying a cancel is a success flagged `already`; cancelling something already approved or rejected is refused, because a silent no-op would leave you believing a live action is still gated when it is not.")
+        .argument("<requestId>", "Request id.")
+        .option("--note <text>", "Why you are withdrawing it.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (requestId, options) => {
+        await handleCollabAction("approvals cancel", options, () => {
+            const note = readOption(options.note);
+            return requestOxygen(`/api/cli/collab/requests/${encodeURIComponent(requestId)}/cancel`, {
+                method: "POST",
+                body: note ? { note } : {},
+            });
+        }, formatCollabWriteResult);
+    }))
+        .addCommand(new Command("gate")
+        .description("The opt-in hard gate. Off everywhere until an admin turns it on, so shipping this changed nobody's workflow.")
+        .addCommand(new Command("set")
+        .description(`Require (or stop requiring) an approval before the live action. ADMIN ONLY — a member who can switch the gate off at will is not a gate. Scope it to one object with --on, or to every object of a kind with --default. ${COLLAB_GATE_GLOSS}.`)
+        .option("--on <kind:id>", `Gate one object. ${COLLAB_SUBJECT_REF_HELP}`)
+        .option("--default <kind>", `Gate every object of a kind (the workspace default). One of: ${COLLAB_SUBJECT_KINDS.join(", ")}.`)
+        .requiredOption("--gate <gate>", COLLAB_GATE_FLAG_HELP)
+        .option("--required", "Turn the gate ON.")
+        .option("--not-required", "Turn the gate OFF.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals gate set", options, () => requestOxygen("/api/cli/collab/gates", {
+            method: "POST",
+            body: collabGateSetBody(options),
+        }), formatCollabGateSet);
+    }))
+        .addCommand(new Command("list")
+        .description("Which gates this workspace requires. Pass --on to also get the EFFECTIVE answer for one object — its own policy, then the workspace default for its kind, then 'not required' — plus whether it is blocked right now.")
+        .option("--on <kind:id>", `Also resolve the effective gates for one object. ${COLLAB_SUBJECT_REF_HELP}`)
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals gate list", options, () => {
+            const on = readOption(options.on);
+            if (!on)
+                return requestOxygen("/api/cli/collab/gates");
+            const subject = requireCollabSubject(on);
+            return requestOxygen(`/api/cli/collab/gates?subject=${encodeURIComponent(`${subject.kind}:${subject.id}`)}`);
+        }, formatCollabGateList);
+    })))
+        .addCommand(new Command("client")
+        .description("The restricted login an agency hands its client: read the work, comment on it, decide the approvals assigned to them, nothing else. ADMIN ONLY. Invite them to the workspace first — this grants the overlay on an existing membership.")
+        .addCommand(new Command("grant")
+        .description("Restrict a member to the client role.")
+        .argument("<email>", "Workspace member's email.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (email, options) => {
+        await handleCollabAction("approvals client", options, () => requestOxygen("/api/cli/collab/members/role", {
+            method: "POST",
+            body: { email, role: "client" },
+        }), formatCollabWriteResult);
+    }))
+        .addCommand(new Command("revoke")
+        .description("Clear the client role and restore full workspace access.")
+        .argument("<email>", "Workspace member's email.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (email, options) => {
+        await handleCollabAction("approvals client", options, () => requestOxygen("/api/cli/collab/members/role", {
+            method: "POST",
+            body: { email, role: null },
+        }), formatCollabWriteResult);
+    }))
+        .addCommand(new Command("list")
+        .description("Every member of this workspace and what they may do — the workspace role plus the Oxygen client overlay. Run it after a grant to see the change: this is the same read the /collab/members page renders.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCollabAction("approvals client list", options, () => requestOxygen("/api/cli/collab/members"), formatCollabMembers);
+    })));
     program
         .command("blueprints")
         .description("Scaffolding bundles: a workflow + tables + columns + prompts as shareable JSON. For guided GTM plays see `oxygen recipes`.")
@@ -6939,6 +7369,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         // doesn't mention visibility leaves it untouched.
         .option("--always-show", "Keep this column visible even when it holds no values.")
         .option("--no-always-show", "Stop pinning this column, so it collapses again while empty.")
+        .option("--hidden-by-default", "Leave this column out of the grid on first open. It stays readable everywhere else, and anyone can reveal it from the column menu.")
+        .option("--no-hidden-by-default", "Show this column in the grid on first open. Read the current opening set with `oxygen tables describe <table>` — every column reports its hiddenByDefault state.")
         .option("--dry-run", "Return the would-be merged definition without writing.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, column, options) => {
@@ -6984,6 +7416,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     ...(definitionUnset.length > 0 ? { definition_unset: definitionUnset } : {}),
                     ...(readOption(options.dataType) ? { data_type: readOption(options.dataType) } : {}),
                     ...(typeof options.alwaysShow === "boolean" ? { always_show: options.alwaysShow } : {}),
+                    ...(typeof options.hiddenByDefault === "boolean"
+                        ? { hidden_by_default: options.hiddenByDefault }
+                        : {}),
                     ...(options.dryRun ? { dry_run: true } : {}),
                 },
             });
@@ -8106,6 +8541,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         // appearing in a command's flag strings, so an approval-shaped name
         // here would mislabel every command that carries it.
         .option("--move-existing", "Also re-home the mailboxes you already have onto the new dedicated IP. Off by default because moving an established mailbox throws away the sending warmup it accumulated on its current IP.")
+        .option("--country <code>", "ISO 3166-1 alpha-2 country the dedicated IP should sit in (e.g. US, DE). Match it to where your mailboxes' owners plausibly sign in from — the IP's job is making the sign-in look ordinary, and an account that suddenly authenticates from another country is what gets it challenged. Omitted uses the default region. An unserviceable or out-of-stock country fails before anything is ordered or charged.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("egress dedicated request", options, () => requestOxygen("/api/cli/egress/dedicated", {
@@ -8113,6 +8549,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             body: {
                 ...(options.approved ? { approve: true } : {}),
                 ...(options.moveExisting ? { move_existing: true } : {}),
+                ...(readOption(options.country) ? { country: readOption(options.country) } : {}),
             },
         }));
     }))
@@ -8523,11 +8960,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("approvals")
-        .description("List everything waiting for a human decision across workflows, publishing, message reviews, and inbox reply drafts — the cross-primitive approvals inbox. Read-only: each item includes the exact command to resolve it and a web link to decide.")
+        .description("List everything waiting for a human decision across workflows, publishing, message reviews, inbox reply drafts, and collaboration approval requests — the cross-primitive approvals inbox. Read-only: each item includes the exact command to resolve it and a web link to decide.")
         // Keep --source values in sync with OBSERVABILITY_APPROVAL_SOURCES in
         // apps/web/src/lib/observability-console.ts and the MCP tool enum. The API
         // rejects any other value with invalid_request so a typo fails loudly.
-        .option("--source <sources>", "Comma-separated sources: workflow, publishing, message_review, inbox_draft.")
+        .option("--source <sources>", "Comma-separated sources: workflow, publishing, message_review, inbox_draft, collab_request.")
         .option("--limit <n>", "Maximum items per source (default 25, max 100). Counts reflect the returned page only.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -9638,6 +10075,28 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const params = new URLSearchParams({ integration_id: integrationId });
             return requestOxygen(`/api/cli/integrations/composio/actions?${params.toString()}`);
         });
+    }))
+        .addCommand(new Command("destinations")
+        .description("List where a connected integration can send — for Microsoft Teams, your teams and your chats, plus one team's channels with --team-id. Free: these are read-only lookups, so no approval or credit cap is needed.")
+        .argument("<integration_id>", "Integration id. Supported: 'microsoft_teams'.")
+        .option("--team-id <id>", "List this team's channels as well.")
+        .option("--kind <kind>", "Narrow to one of: teams, channels, chats. Default lists teams and chats.")
+        .option("--connection-id <id>", "Use a specific connection when several are active.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (integrationId, options) => {
+        await handleAsyncAction("integrations destinations", options, () => {
+            const params = new URLSearchParams({ integration_id: integrationId });
+            const teamId = readOption(options.teamId);
+            if (teamId)
+                params.set("team_id", teamId);
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
+            const connectionId = readOption(options.connectionId);
+            if (connectionId)
+                params.set("connection_id", connectionId);
+            return requestOxygen(`/api/cli/integrations/destinations?${params.toString()}`);
+        });
     }))
         .addCommand(new Command("run")
         .description("Run an action for a connected integration — Composio toolkits and native providers alike.")
@@ -9676,6 +10135,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("List connected LinkedIn sender accounts with health status, rate limits, and today's usage.")
         .option("--status <status>", "Filter by sender status: active, paused, disconnected, restricted, or credentials_required.")
         .option("--no-usage", "Skip today's per-account usage counts for a faster, lighter response.")
+        .option("--tag <tags>", "Comma-separated workspace tags — matches sender accounts carrying ANY of these tags (see `oxygen tags list`).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("senders list", options, () => {
@@ -9685,6 +10145,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const status = readOption(options.status);
             if (status)
                 params.set("status", status);
+            const tags = splitCommaList(options.tag);
+            if (tags.length > 0)
+                params.set("tag", tags.join(","));
             const suffix = params.toString();
             return requestOxygen(`/api/cli/senders${suffix ? `?${suffix}` : ""}`);
         });
@@ -9860,6 +10323,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--total-reads-per-day <n>", "Daily cap across all read units.")
         .option("--min-spacing-seconds <n>", "Minimum seconds between actions.")
         .option("--spacing-jitter-seconds <n>", "Random jitter seconds added to action spacing.")
+        .option("--interactive-min-spacing-seconds <n>", "Minimum seconds between human-sent Unibox actions.")
+        .option("--interactive-spacing-jitter-seconds <n>", "Random jitter seconds added to human-sent Unibox action spacing.")
+        .option("--interactive-sends-per-hour <n>", "Hourly cap on human-sent Unibox actions.")
         .option("--timezone <tz>", "IANA timezone the daily action counters reset in, e.g. America/New_York.")
         .option("--warmup-restart", "Start (or restart) the warm-up ramp now — gradually raises this account's invite + message caps to full over ~2 weeks.")
         .option("--warmup-disable", "Turn off warm-up for this account (treat it as already warm and use its full configured caps).")
@@ -9882,12 +10348,31 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("list")
         .description("List sender profiles with their per-channel account counts (LinkedIn / WhatsApp / inboxes).")
         .option("--status <status>", "Filter by status: active, paused, or archived.")
+        .option("--tag <tags>", "Comma-separated workspace tags — matches sender profiles carrying ANY of these tags (see `oxygen tags list`).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("senders profiles list", options, () => {
+            const params = new URLSearchParams();
             const status = readOption(options.status);
-            return requestOxygen(`/api/cli/senders/profiles${status ? `?status=${encodeURIComponent(status)}` : ""}`);
+            if (status)
+                params.set("status", status);
+            const tags = splitCommaList(options.tag);
+            if (tags.length > 0)
+                params.set("tag", tags.join(","));
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/senders/profiles${suffix ? `?${suffix}` : ""}`);
         });
+    }))
+        .addCommand(new Command("tag")
+        .description("Replace a sender profile's workspace tags (whole set; `--tags \"\"` clears) — one edit pools the whole sending identity behind a campaign tag. Member accounts keep their own tags. See `oxygen tags list` for the vocabulary.")
+        .argument("<id>", "Sender profile id.")
+        .requiredOption("--tags <tags>", "Comma-separated workspace tags (replaces the whole set; empty clears).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (id, options) => {
+        await handleAsyncAction("senders profiles tag", options, () => requestOxygen(`/api/cli/senders/profiles/${encodeURIComponent(id)}/tags`, {
+            method: "POST",
+            body: { tags: splitCommaList(options.tags) },
+        }));
     }))
         .addCommand(new Command("get")
         .description("Get one sender profile with the LinkedIn/WhatsApp senders and inboxes attached to it.")
@@ -10176,7 +10661,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("engagement")
-        .description("Capture LinkedIn intent from one known post (harvest needs its public URL or the composite social_id from `oxygen posts get`) or from your connected account's viewers, followers, and connections. For recurring competitor-profile monitoring that discovers future posts, start with `oxygen recipes list competitor --json`. Harvests run as a slow, durable drip under a conservative read budget.")
+        .description("Capture LinkedIn intent from one known post (harvest needs its public URL or the composite social_id from `oxygen posts get`), and react or comment on it. Recurring capture — a post's engagers on a cadence, 'who viewed my profile', new followers, new connections — is a live table: arm it with `oxygen linkedin intent setup` and operate it with `oxygen feeds list|pause|resume|run`. For recurring competitor-profile monitoring that discovers future posts, start with `oxygen recipes list competitor --json`. Harvests run as a slow, durable drip under a conservative read budget.")
         .addCommand(new Command("harvest")
         .description("Start (or re-arm) a harvest of a post's engagers into a workspace table you can enroll into a sequence. Engagers drip into the table over many ticks; poll `engagement status` to watch it fill. No messages are sent. Cookieless harvests spend Oxygen credits per scraper page and require --max-credits.")
         .requiredOption("--post <social_id_or_url>", "Composite post social_id from `oxygen posts get` (NOT the activity URN), or the public LinkedIn post URL for cookieless.")
@@ -10289,112 +10774,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
-    }))
-        .addCommand(new Command("watch")
-        .description("Declarative engagement watches (the signals wedge): stand up a watch on a post's engagers, 'who viewed my profile', or the sender's inbound network (new followers / new connections) that harvests people into a table and, under a standing approval, auto-enrolls them into a sequence. The watch materializes the harvest drip and enrolls newly-harvested people each cycle — the sequence still gates its own sends.")
-        .addHelpText("after", "\nScope: this watches one known post or one connected-account signal. For daily discovery across one or more public profiles' recent posts, use `oxygen blueprints describe linkedin-profile-engager-monitor --json`.\n")
-        .addCommand(new Command("create")
-        .description("Arm an engagement watch. `--kind post` watches a post's reactors + commenters (needs --post social_id; a cookieless post also needs --post-url); `--kind profile_viewers` watches 'who viewed my profile' (source unipile); `--kind followers` / `--kind connections` watch the sender's inbound network — people NEW to the org's orbit stream into the watch table as they follow/connect (source unipile, no credits, reads metered against the account's daily ingest budget). With --auto-enroll it enrolls harvested people into --sequence, capped by --max-enrolls-per-day — the inbound-led-outbound loop. --max-credits-per-cycle is the standing per-cycle spend cap (required for --auto-enroll and cookieless). No messages are sent by the watch itself.")
-        .requiredOption("--kind <kind>", "post | profile_viewers | followers | connections.")
-        .requiredOption("--account <ref>", "Reading LinkedIn sender (sender id, connection id, or Unipile account id).")
-        .option("--post <social_id>", "Composite post social_id from `oxygen posts get` (required for --kind post).")
-        .option("--post-url <url>", "Public LinkedIn post URL (required for a cookieless post watch).")
-        .option("--source <source>", "cookieless | unipile. Defaults to cookieless for post; profile_viewers/followers/connections are always unipile.")
-        .option("--table <id_or_slug>", "Existing table to land harvested people into. Omit to create one.")
-        .option("--sequence <id_or_slug>", "Sequence to auto-enroll harvested people into (required with --auto-enroll).")
-        .option("--auto-enroll", "Auto-enroll newly harvested people into --sequence under the standing approval.")
-        .option("--max-credits-per-cycle <credits>", "Standing per-cycle managed-spend cap (required for --auto-enroll and cookieless).")
-        .option("--max-enrolls-per-day <n>", "Cap auto-enrollments per day.")
-        .option("--recurrence <recurrence>", "once | every_6h | daily | weekly (default once).")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (options) => {
-        await handleAsyncAction("engagement watch create", options, () => {
-            const kind = readOption(options.kind);
-            const account = readOption(options.account);
-            const post = readOption(options.post);
-            const postUrl = readOption(options.postUrl);
-            const source = readOption(options.source);
-            const table = readOption(options.table);
-            const sequence = readOption(options.sequence);
-            const maxCreditsPerCycle = readPositiveNumber(options.maxCreditsPerCycle);
-            const maxEnrollsPerDay = readPositiveNumber(options.maxEnrollsPerDay);
-            const recurrence = readOption(options.recurrence);
-            return requestOxygen("/api/cli/linkedin/engagement/watches", {
-                method: "POST",
-                body: {
-                    ...(kind ? { kind } : {}),
-                    ...(account ? { account } : {}),
-                    ...(post ? { post } : {}),
-                    ...(postUrl ? { post_url: postUrl } : {}),
-                    ...(source ? { source } : {}),
-                    ...(table ? { table } : {}),
-                    ...(sequence ? { sequence } : {}),
-                    ...(options.autoEnroll ? { auto_enroll: true } : {}),
-                    ...(maxCreditsPerCycle !== undefined ? { max_credits_per_cycle: maxCreditsPerCycle } : {}),
-                    ...(maxEnrollsPerDay !== undefined ? { max_enrolls_per_day: maxEnrollsPerDay } : {}),
-                    ...(recurrence ? { recurrence } : {}),
-                },
-            });
-        });
-    }))
-        .addCommand(new Command("list")
-        .description("List the org's engagement watches (status, kind, sender, sequence, per-day enroll count) with a table deep-link.")
-        .option("--status <status>", "Filter by status: active | paused | exhausted | completed.")
-        .option("--kind <kind>", "Filter by kind.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (options) => {
-        await handleAsyncAction("engagement watch list", options, () => {
-            const status = readOption(options.status);
-            const kind = readOption(options.kind);
-            const params = new URLSearchParams();
-            if (status)
-                params.set("status", status);
-            if (kind)
-                params.set("kind", kind);
-            const suffix = params.toString();
-            return requestOxygen(`/api/cli/linkedin/engagement/watches${suffix ? `?${suffix}` : ""}`);
-        });
-    }))
-        .addCommand(new Command("pause")
-        .description("Pause a watch (stop materializing its harvest + auto-enrolling).")
-        .argument("<watchId>", "Watch id.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (watchId, options) => {
-        await handleAsyncAction("engagement watch pause", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}`, {
-            method: "PATCH",
-            body: { action: "pause" },
-        }));
-    }))
-        .addCommand(new Command("resume")
-        .description("Resume a paused watch.")
-        .argument("<watchId>", "Watch id.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (watchId, options) => {
-        await handleAsyncAction("engagement watch resume", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}`, {
-            method: "PATCH",
-            body: { action: "resume" },
-        }));
-    }))
-        .addCommand(new Command("tag")
-        .description("Replace a watch's workspace tags (whole set; `--tags \"\"` clears) — groups a standing watch into the same campaign vocabulary as the sequence it feeds. See `oxygen tags list`.")
-        .argument("<watchId>", "Watch id.")
-        .requiredOption("--tags <tags>", "Comma-separated workspace tags (replaces the whole set; empty clears).")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (watchId, options) => {
-        await handleAsyncAction("engagement watch tag", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}/tags`, {
-            method: "POST",
-            body: { tags: splitCommaList(options.tags) },
-        }));
-    }))
-        .addCommand(new Command("delete")
-        .description("Delete a watch (its harvested table + rows are kept).")
-        .argument("<watchId>", "Watch id.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (watchId, options) => {
-        await handleAsyncAction("engagement watch delete", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}`, {
-            method: "DELETE",
-        }));
-    }))));
+    })));
     program.addCommand(new Command("linkedin")
         .description("LinkedIn read-into-workspace ingestion controls (Goal-3): the unified status of the connections / engagement / message-history drips and each account's remaining ingest read budget.")
         .addCommand(new Command("intent")
@@ -10421,7 +10801,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("status")
-        .description("Show the canonical intent tables, their linked-table deep-links, and the capture watches feeding them.")
+        .description("Show the canonical intent tables, their linked-table deep-links, and the capture feeds filling them.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("linkedin intent status", options, () => requestOxygen("/api/cli/linkedin/intent"));
@@ -10516,6 +10896,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("List connected WhatsApp accounts with health status, warm-up ramp state, limits, and today's usage.")
         .option("--status <status>", "Filter by account status: active, paused, disconnected, restricted, or credentials_required.")
         .option("--no-usage", "Skip today's per-account usage counts.")
+        .option("--tag <tags>", "Comma-separated workspace tags — matches WhatsApp accounts carrying ANY of these tags (see `oxygen tags list`).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("whatsapp accounts", options, () => {
@@ -10525,6 +10906,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const status = readOption(options.status);
             if (status)
                 params.set("status", status);
+            const tags = splitCommaList(options.tag);
+            if (tags.length > 0)
+                params.set("tag", tags.join(","));
             const suffix = params.toString();
             return requestOxygen(`/api/cli/whatsapp/accounts${suffix ? `?${suffix}` : ""}`);
         });
@@ -10740,6 +11124,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--channels <list>", "channel=all only: comma-separated channel groups to include (email,linkedin,whatsapp). Empty = all three.")
         .option("--account <id>", "LinkedIn only: filter to one sender account (sender id, connection id, or Unipile account id).")
         .option("--unread", "Only show conversations with unread messages.")
+        .option("--unanswered", "Only conversations awaiting YOUR reply — the last message in the thread is inbound. Cross-channel. Off by default: an unfiltered list still shows answered threads. (The web Unibox turns this on by default for its Primary tab.)")
         .option("--responses-only", "Email only: only conversations with an inbound reply (never sent-only threads).")
         .option("--bucket <bucket>", "Email only: primary or others (superseded by --segment).")
         .option("--segment <segment>", "Top tab: primary (everything but the negative status tier), all, or an email-only folder (others, sent, warmup, dmarc).")
@@ -10769,6 +11154,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 params.set("account", account);
             if (options.unread)
                 params.set("unread", "true");
+            if (options.unanswered)
+                params.set("unanswered", "true");
             if (options.responsesOnly)
                 params.set("responses_only", "true");
             for (const [flag, key] of [
@@ -10881,6 +11268,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--until <iso>", "Only conversations whose last message is on/before this ISO date/timestamp. Cross-channel.")
         .option("--search <text>", "Filter by attendee name or last-message text. Cross-channel.")
         .option("--include-archived", "Also mark archived conversations read.")
+        .option("--unanswered", "Only sweep conversations awaiting your reply (the last message is inbound) — the same filter as `inbox list --unanswered`, so the scope is exactly that list.")
         .option("--yes", "Apply the sweep. Without this flag, returns a preview of the unread count only.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -10913,6 +11301,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             }
             if (options.includeArchived)
                 params.set("include_archived", "true");
+            // Booleans need their own line: the tuple loop above only walks
+            // the string-valued options.
+            if (options.unanswered)
+                params.set("unanswered", "true");
             return requestOxygen(`/api/cli/inbox/read-all?${params.toString()}`, {
                 method: "POST",
                 // Approval rides in the body: a bodyless POST reads as
@@ -11144,6 +11536,16 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (key, options) => {
         await handleAsyncAction("inbox label archive", options, () => requestOxygen(`/api/cli/inbox/labels/${encodeURIComponent(key)}`, { method: "DELETE" }));
+    }))
+        .addCommand(new Command("restore")
+        .description("Restore an archived custom status label under its original key.")
+        .argument("<key>", "The archived custom label key.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (key, options) => {
+        await handleAsyncAction("inbox label restore", options, () => requestOxygen(`/api/cli/inbox/labels/${encodeURIComponent(key)}`, {
+            method: "PATCH",
+            body: { archived: false },
+        }));
     })))
         .addCommand(new Command("drafts")
         .description("The AI reply-agent draft queue (the approve-before-send review queue).")
@@ -12142,12 +12544,31 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })))
         .addCommand(new Command("numbers")
-        .description("The org's dialing pool: list | release. Buying is done from the web shop, which prices and previews the recurring order before it is placed.")
+        .description("The org's dialing pool: list | tag | release. Buying is done from the web shop, which prices and previews the recurring order before it is placed.")
         .addCommand(new Command("list")
-        .description("List the org's phone numbers with warm-up state, daily cap, and what each one costs per month.")
+        .description("List the org's phone numbers with warm-up state, daily cap, and what each one costs per month. Optional --tag narrows to one campaign's numbers.")
+        .option("--tag <tags>", "Comma-separated workspace tags — matches phone numbers carrying ANY of these tags (see `oxygen tags list`).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("voice numbers list", options, () => requestOxygen("/api/cli/voice/numbers"));
+        await handleAsyncAction("voice numbers list", options, () => {
+            const params = new URLSearchParams();
+            const tags = splitCommaList(options.tag);
+            if (tags.length > 0)
+                params.set("tag", tags.join(","));
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/voice/numbers${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("tag")
+        .description("Replace a phone number's workspace tags (whole set; `--tags \"\"` clears) — e.g. pool the numbers dialing one campaign behind its tag. See `oxygen tags list` for the vocabulary.")
+        .argument("<number>", "Phone number in E.164 (e.g. +14155550142) or its id.")
+        .requiredOption("--tags <tags>", "Comma-separated workspace tags (replaces the whole set; empty clears).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (number, options) => {
+        await handleAsyncAction("voice numbers tag", options, () => requestOxygen(`/api/cli/voice/numbers/${encodeURIComponent(number)}/tags`, {
+            method: "POST",
+            body: { tags: splitCommaList(options.tags) },
+        }));
     }))
         .addCommand(new Command("release")
         .description("Give a number back to the carrier and stop its monthly charge. IRREVERSIBLE — the number returns to the carrier's pool and can be taken by someone else within minutes; you cannot get it back. Previews by default; pass --approved to actually release.")
@@ -12618,10 +13039,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("mailboxes")
-        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local Hypertide transfer), pause/disable inboxes, connect EmailGuard monitoring, and run managed SendKit warmup with explicit plans and credit caps. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
+        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local Hypertide transfer), pause/disable inboxes, connect EmailGuard monitoring, and run managed SendKit warmup with explicit plans and credit caps. Managed InboxKit Google and Microsoft mailboxes use InboxKit's native Sequencer export during the approved warmup action; SendKit warms them but never owns campaign dispatch. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
         .addCommand(new Command("list")
         .description("List the org's sending mailboxes with provider, status, warmup state, source (managed = bought through Oxygen, byok = bring-your-own), and a pool overview (including counts by source).")
         .option("--status <status>", "Filter by status: active, paused, or disabled.")
+        .option("--tag <tags>", "Comma-separated workspace tags — matches mailboxes carrying ANY of these tags (see `oxygen tags list`).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("mailboxes list", options, () => {
@@ -12629,6 +13051,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const status = readOption(options.status);
             if (status)
                 params.set("status", status);
+            const tags = splitCommaList(options.tag);
+            if (tags.length > 0)
+                params.set("tag", tags.join(","));
             const suffix = params.toString();
             return requestOxygen(`/api/cli/mailboxes${suffix ? `?${suffix}` : ""}`);
         });
@@ -12669,7 +13094,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("import")
-        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>; --from hypertide remains a shortcut. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer: Microsoft warmup requires one Outlook OAuth authorization per mailbox (`mailboxes warmup microsoft`) and EmailGuard remains vendor_blocked for Microsoft. Google app passwords are sent only in the request body, encrypted server-side, and never returned.")
+        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>; --from hypertide remains a shortcut. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer: managed InboxKit Google/Microsoft warmup uses native InboxKit Sequencer export during `warmup enable`; eligible non-InboxKit Microsoft warmup uses the separate Outlook OAuth fallback (`mailboxes warmup microsoft`); EmailGuard remains vendor_blocked for Microsoft. Google app passwords are sent only in the request body, encrypted server-side, and never returned.")
         .addHelpText("after", [
         "",
         "Ordinary identity file contract (CSV / JSON / JSONL / XLSX):",
@@ -13014,9 +13439,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("warmup")
-        .description("Mailbox warmup for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. Oxygen's native warmup runs on ONE rail: SendKit, managed and credit-billed at 3,000 credits per warming inbox per month ($3). Oxygen enrolls the mailbox for you — preview first, then re-run with --approved to execute and bill. Google and Microsoft both warm here; a Microsoft inbox first needs one Outlook authorization of its own (`mailboxes warmup microsoft`). Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down here with `warmup disable`; they are never silently moved onto SendKit.")
+        .description("Mailbox warmup for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. Oxygen's native warmup runs on ONE rail: SendKit, managed and credit-billed at 3,000 credits per warming inbox per month ($3). Oxygen enrolls the mailbox for you — preview first, then re-run with --approved to execute and bill. Managed InboxKit Google and Microsoft mailboxes are exported through InboxKit's native Sequencer integration inside that approved action; InboxKit auto-export stays off, and any non-cancelled InboxKit warmup blocks the handoff so one mailbox cannot warm twice. SendKit is warmup-only: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down here with `warmup disable`; they are never silently moved onto SendKit.")
         .addCommand(new Command("enable")
-        .description("Enroll sending mailboxes in Oxygen's managed SendKit warmup and stamp each mailbox's warmup state. Targets the whole pool unless --mailboxes is given. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is enrolled or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Microsoft inboxes must finish `mailboxes warmup microsoft` (one Outlook authorization each) before they can enroll. New enrollments only ever land on SendKit — the retired TrulyInbox rail is refused here and only accepts teardown.")
+        .description("Enroll sending mailboxes in Oxygen's managed SendKit warmup and stamp each mailbox's warmup state. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is exported, enrolled, or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Managed InboxKit Google and Microsoft mailboxes use InboxKit's native Sequencer export here by default; auto-export remains off, and any non-cancelled InboxKit warmup must be cancelled before export (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. SendKit supplies warmup only — OXYGEN Sequences retain campaign enrollment and dispatch. New enrollments only ever land on SendKit; the retired TrulyInbox rail is refused here and only accepts teardown.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to warm. Omit to warm the whole pool.")
         .option("--approved", "Execute the PRICED enrollment. Without it the response is a priced preview and nothing is enrolled or billed.")
         .option("--plan <hash>", "Hash from the fresh preview (required with --approved).")
@@ -13060,8 +13485,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("microsoft")
-        .description("Authorize Microsoft/Outlook mailboxes for SendKit warmup — ONE browser consent PER MAILBOX, never a password or app password. There is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact mailboxes and how many consent links are still outstanding, at 0 credits. Approve that fresh hash with --max-credits 0 to mint the links, open every returned consent_url, then re-run with --status to see which mailboxes came back authorized. Warmup itself stays OFF until a separately approved `warmup enable`.")
-        .option("--mailboxes <list>", "Comma-separated Microsoft mailbox ids or addresses. Omit to select every Microsoft mailbox in the pool.")
+        .description("NON-INBOXKIT FALLBACK ONLY: authorize eligible Microsoft/Outlook mailboxes for SendKit warmup with ONE browser consent PER MAILBOX, never a password or app password. Do not run this for managed InboxKit mailboxes: both Google and Microsoft use InboxKit's native Sequencer export during the separately approved `warmup enable`. For the fallback there is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact fallback mailboxes and outstanding links at 0 credits. Approve that fresh hash with --max-credits 0, open every returned consent_url, then re-run with --status. Warmup itself stays OFF until `warmup enable`.")
+        .option("--mailboxes <list>", "Comma-separated eligible non-InboxKit Microsoft mailbox ids or addresses. Omit to select the pool; the command refuses a scope containing managed InboxKit rows and points to warmup enable.")
         .option("--tenant <id>", "Deprecated and ignored: SendKit consent is per mailbox, so there is no tenant-wide scope to bind. Still accepted so older scripts keep running.")
         .option("--approved", "Mint the per-mailbox consent links for the exact previewed mailbox scope. Still 0 credits — a human then has to open each link.")
         .option("--plan <hash>", "Fresh setup preview hash (required with --approved).")
@@ -13234,7 +13659,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("run")
         .description("Create a placement test for one sending mailbox. Without --approved this returns a cost PREVIEW. EmailGuard creation returns exact seeds + phrase but sends nothing; next run `placement-test send <id>` to preview and approve that external email. Zapmail owns its probe delivery and completes async (2-24h).")
         .argument("<mailbox>", "Sending mailbox address to test (e.g. ada@send.acme.com).")
-        .option("--provider <provider>", "Health provider: emailguard or zapmail. Omit to auto-resolve (Zapmail-hosted mailboxes route to zapmail, else emailguard).")
+        .option("--provider <provider>", "Health provider: emailguard or zapmail. Omit to auto-resolve — EmailGuard is the default for every mailbox; Zapmail is used only for Zapmail-hosted mailboxes when EmailGuard is not connected.")
         .option("--subject <subject>", "Optional subject for the seed message (zapmail ignores it beyond labeling the test).")
         .option("--body <text>", "Optional plain-text body for the seed message (ignored by zapmail).")
         .option("--approved", "Actually run the test (otherwise a preview is returned).")
@@ -13312,6 +13737,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--expiring", "Only non-deleted domains expiring within 60 days.")
         .option("--has-mailboxes <bool>", "true → only domains with sending mailboxes; false → only domains without.")
         .option("--include-archived", "Include archived domains (hidden by default).")
+        .option("--tag <tags>", "Comma-separated workspace tags — matches domains carrying ANY of these tags (see `oxygen tags list`).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("domains list", options, () => {
@@ -13335,6 +13761,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 params.set("has_mailboxes", hasMailboxes);
             if (options.includeArchived)
                 params.set("include_archived", "true");
+            const tags = splitCommaList(options.tag);
+            if (tags.length > 0)
+                params.set("tag", tags.join(","));
             const suffix = params.toString();
             return requestOxygen(`/api/cli/domains${suffix ? `?${suffix}` : ""}`);
         });
@@ -19247,7 +19676,8 @@ function formatReplyTypes(value) {
         .sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]));
     return entries.length > 0 ? entries.map(([key, count]) => `${key}:${count}`).join(", ") : "—";
 }
-function renderVariantTable(headers, rows) {
+/** Column-aligned plain-text table, two-space indented. Shared by the sequence-variant lenses and the collaboration lists. */
+function renderTextTable(headers, rows) {
     const widths = headers.map((header, columnIndex) => {
         let max = header.length;
         for (const row of rows) {
@@ -19282,7 +19712,7 @@ function formatSequenceVariants(data) {
             formatVariantCell(row.bounced),
             formatVariantCell(row.credits_used),
         ]);
-        lines.push(...renderVariantTable(headers, rows));
+        lines.push(...renderTextTable(headers, rows));
     }
     lines.push("", styles.bold("By mailbox"));
     if (byMailbox.length === 0) {
@@ -19301,7 +19731,7 @@ function formatSequenceVariants(data) {
             formatReplyTypes(row.reply_types ?? row.replyTypes),
             formatVariantCell(row.failed),
         ]);
-        lines.push(...renderVariantTable(headers, rows));
+        lines.push(...renderTextTable(headers, rows));
     }
     lines.push("", styles.bold("By sending domain"));
     if (byDomain.length === 0) {
@@ -19320,14 +19750,14 @@ function formatSequenceVariants(data) {
             formatRatePercent(row.bounce_rate ?? row.bounceRate),
             formatReplyTypes(row.reply_types ?? row.replyTypes),
         ]);
-        lines.push(...renderVariantTable(headers, rows));
+        lines.push(...renderTextTable(headers, rows));
     }
     const hasUnattributed = unattributed
         && [unattributed.sent, unattributed.replied, unattributed.bounced, unattributed.failed]
             .some((value) => typeof value === "number" && value > 0);
     if (hasUnattributed && unattributed) {
         lines.push("", styles.bold("Unattributed sending identity"));
-        lines.push(...renderVariantTable(["SENT", "REPLIED", "POSITIVE", "BOUNCED", "FAILED", "REPLY TYPES"], [[
+        lines.push(...renderTextTable(["SENT", "REPLIED", "POSITIVE", "BOUNCED", "FAILED", "REPLY TYPES"], [[
                 formatVariantCell(unattributed.sent),
                 formatVariantCell(unattributed.replied),
                 formatVariantCell(unattributed.positive_replies ?? unattributed.positiveReplies),
@@ -19340,6 +19770,471 @@ function formatSequenceVariants(data) {
     lines.push("");
     return lines.join("\n");
 }
+// --- Collaboration output ----------------------------------------------------
+//
+// Comments and approvals are read by two very different audiences: the agency's
+// operator in a terminal, and an agent parsing --json. So these commands render
+// a compact human view by default and the stable envelope under --json — the
+// same split `sequences variants` uses. Every renderer ends with the deep-link
+// the API returned, because the client who has to decide is usually the one
+// person NOT in the terminal.
+async function handleCollabAction(command, options, action, render) {
+    try {
+        const data = await action();
+        if (options.json) {
+            writeJson(success(command, data));
+            return;
+        }
+        process.stdout.write(isRecord(data) ? render(data) : `${JSON.stringify(data, null, 2)}\n`);
+    }
+    catch (error) {
+        emitCliFailure(command, error);
+    }
+}
+/**
+ * `comments add`. Without --reply this is one POST. With --reply the CLI first
+ * resolves which thread owns that id, because the reply endpoint is keyed by
+ * THREAD while the id a user has in hand (from `comments list`, or from the
+ * `next_step` the API prints) is a COMMENT. Passing a thread id works too and
+ * replies at its top level — both ids sit side by side in the list output, and
+ * refusing the wrong one would be pedantry, not safety.
+ */
+async function handleCommentsAddAction(body, options) {
+    await handleCollabAction("comments add", options, async () => {
+        const subject = requireCollabSubject(options.on);
+        const path = readCollabPath(options.path);
+        const mentions = options.mention.map((value) => value.trim()).filter(Boolean);
+        const replyTo = readOption(options.reply);
+        if (!replyTo) {
+            const title = readOption(options.title);
+            return requestOxygen("/api/cli/collab/threads", {
+                method: "POST",
+                body: {
+                    subject_kind: subject.kind,
+                    subject_id: subject.id,
+                    ...(path ? { subject_path: path } : {}),
+                    ...(title ? { title } : {}),
+                    body,
+                    ...(mentions.length > 0 ? { mentions } : {}),
+                },
+            });
+        }
+        const target = await resolveCollabReplyTarget(subject, replyTo);
+        return requestOxygen(`/api/cli/collab/threads/${encodeURIComponent(target.threadId)}/comments`, {
+            method: "POST",
+            body: {
+                body,
+                ...(target.parentCommentId ? { parent_comment_id: target.parentCommentId } : {}),
+                ...(mentions.length > 0 ? { mentions } : {}),
+            },
+        });
+    }, formatCollabWriteResult);
+}
+async function resolveCollabReplyTarget(subject, replyTo) {
+    const params = new URLSearchParams({
+        subject: `${subject.kind}:${subject.id}`,
+        // `all`, not `open`: replying to a resolved thread is how a client reopens
+        // a conversation, and scoping the lookup to open threads would report the
+        // id as missing instead.
+        status: "all",
+    });
+    const listed = await requestOxygen(`/api/cli/collab/threads?${params.toString()}`);
+    const threads = Array.isArray(listed.threads) ? listed.threads.filter(isRecord) : [];
+    for (const thread of threads) {
+        if (thread.id === replyTo)
+            return { threadId: replyTo, parentCommentId: null };
+        const comments = Array.isArray(thread.comments) ? thread.comments.filter(isRecord) : [];
+        if (comments.some((comment) => comment.id === replyTo) && typeof thread.id === "string") {
+            return { threadId: thread.id, parentCommentId: replyTo };
+        }
+    }
+    throw new OxygenError("comment_not_found", `No comment or thread "${replyTo}" on ${subject.kind}:${subject.id}. List them with \`oxygen comments list --on ${subject.kind}:${subject.id} --status all\`.`, { details: { reply: replyTo, subject: `${subject.kind}:${subject.id}` }, exitCode: 4 });
+}
+/** Exactly one scope (--on or --default) and exactly one requirement flag. */
+function collabGateSetBody(options) {
+    const on = readOption(options.on);
+    const asDefault = readOption(options.default);
+    if (Boolean(on) === Boolean(asDefault)) {
+        throw new OxygenError("invalid_request", "Pass exactly one scope: --on <kind>:<id> for one object, or --default <kind> for every object of that kind.", { details: { on, default: asDefault }, exitCode: 2 });
+    }
+    if (Boolean(options.required) === Boolean(options.notRequired)) {
+        throw new OxygenError("invalid_request", "Pass exactly one of --required or --not-required.", { exitCode: 2 });
+    }
+    const gateKind = requireCollabGate(options.gate);
+    const subject = on ? requireCollabSubject(on) : null;
+    const subjectKind = subject ? subject.kind : requireCollabSubjectKind(asDefault ?? undefined);
+    if (!GATE_KIND_SUBJECTS[gateKind].includes(subjectKind)) {
+        throw new OxygenError("invalid_request", `The ${gateKind} gate applies to ${GATE_KIND_SUBJECTS[gateKind].map((kind) => COLLAB_SUBJECT_LABELS[kind].many).join(" or ")}, not ${COLLAB_SUBJECT_LABELS[subjectKind].many}.`, { details: { gate_kind: gateKind, subject_kind: subjectKind, applies_to: [...GATE_KIND_SUBJECTS[gateKind]] }, exitCode: 2 });
+    }
+    return {
+        subject_kind: subjectKind,
+        // null is meaningful here: it is what makes the policy the workspace
+        // default for the kind rather than a row about one object.
+        subject_id: subject ? subject.id : null,
+        gate_kind: gateKind,
+        required: Boolean(options.required),
+    };
+}
+function collabStyles() {
+    return ansi(output.isTTY === true && !process.env.NO_COLOR);
+}
+function collabText(value, fallback = "—") {
+    return typeof value === "string" && value.trim() ? value.trim() : fallback;
+}
+function collabLink(data) {
+    if (typeof data.web_url === "string")
+        return data.web_url;
+    return typeof data.deepLink === "string" ? data.deepLink : null;
+}
+/** Coarse age for a list column: seconds, minutes, hours, then days. */
+function formatCollabAge(value) {
+    if (typeof value !== "string")
+        return "—";
+    const at = Date.parse(value);
+    if (!Number.isFinite(at))
+        return "—";
+    const seconds = Math.max(0, Math.round((Date.now() - at) / 1000));
+    if (seconds < 60)
+        return `${seconds}s`;
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60)
+        return `${minutes}m`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 48)
+        return `${hours}h`;
+    return `${Math.floor(hours / 24)}d`;
+}
+/** First line of a body, clipped — a thread's subject line in one cell. */
+function collabSnippet(value, width = 56) {
+    if (typeof value !== "string")
+        return "";
+    const firstLine = value.split("\n").find((line) => line.trim()) ?? "";
+    return clipCell(firstLine.trim(), width);
+}
+/** Trailer every collab render shares: what to do next, then the deep-link. */
+function collabTrailer(data) {
+    const styles = collabStyles();
+    const lines = [];
+    const nextStep = typeof data.next_step === "string" ? data.next_step.trim() : "";
+    if (nextStep)
+        lines.push("", `  ${styles.dim("Next")}   ${nextStep}`);
+    const link = collabLink(data);
+    if (link)
+        lines.push(`  ${styles.dim("Link")}   ${link}`);
+    return lines;
+}
+/**
+ * Generic confirmation for a write whose payload is one object. The API already
+ * writes a `next_step` sentence for each of these, so the renderer's only job is
+ * to say what changed and keep the deep-link visible.
+ */
+function formatCollabWriteResult(data) {
+    const styles = collabStyles();
+    const lines = [""];
+    const headline = collabWriteHeadline(data);
+    lines.push(`  ${styles.green("[OK]")} ${headline}`);
+    if (data.already === true) {
+        lines.push(`  ${styles.dim("Already in that state; nothing changed.")}`);
+    }
+    const notified = Array.isArray(data.notified_emails)
+        ? data.notified_emails.filter((value) => typeof value === "string")
+        : [];
+    if (notified.length > 0)
+        lines.push(`  ${styles.dim("Notified")}  ${notified.join(", ")}`);
+    const unresolved = Array.isArray(data.unresolved_mentions)
+        ? data.unresolved_mentions.filter((value) => typeof value === "string")
+        : [];
+    if (unresolved.length > 0) {
+        lines.push(`  ${styles.yellow("Not a workspace member, so not notified:")} ${unresolved.join(", ")}`);
+    }
+    const note = collabText(data.note, "");
+    if (note)
+        lines.push(`  ${styles.dim(note)}`);
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/** One line naming what changed, matched to each write endpoint's payload shape. */
+function collabWriteHeadline(data) {
+    // A thread write (`comments add`, `comments resolve`) serializes the thread
+    // itself at the top level.
+    if (typeof data.status === "string" && typeof data.subject === "string") {
+        return `${collabText(data.subject)} — thread ${collabText(data.id)} is ${data.status}.`;
+    }
+    if (isRecord(data.comment)) {
+        return data.comment.deleted === true ? "Comment retracted." : "Comment updated.";
+    }
+    if (isRecord(data.request)) {
+        return `Approval request ${collabText(data.request.id)} is ${collabText(data.request.status)}.`;
+    }
+    // The member-role write returns the membership fields flat, not nested.
+    if (typeof data.email === "string") {
+        return data.granted === true
+            ? `${data.email} is now a client-role member of this workspace.`
+            : `${data.email} is back to full workspace access.`;
+    }
+    return "Done.";
+}
+function formatCollabThreads(data) {
+    const styles = collabStyles();
+    const threads = Array.isArray(data.threads) ? data.threads.filter(isRecord) : [];
+    const subject = collabText(data.subject, "this object");
+    const lines = ["", styles.bold(`Comments on ${subject}`)];
+    if (threads.length === 0) {
+        lines.push(`  ${styles.dim(collabText(data.hint, "No comment threads here yet."))}`);
+    }
+    for (const thread of threads) {
+        const status = collabText(thread.status, "open");
+        const badge = status === "resolved" ? styles.dim("[resolved]") : styles.green("[open]");
+        const title = collabText(thread.title, "");
+        lines.push("", `  ${badge} ${collabText(thread.id)}  ${styles.dim(`${thread.comment_count ?? 0} comment(s) · ${formatCollabAge(thread.created_at)} old`)}`);
+        if (title)
+            lines.push(`    ${styles.bold(title)}`);
+        if (typeof thread.subject_path === "string" && thread.subject_path) {
+            lines.push(`    ${styles.dim(`on ${thread.subject_path}`)}`);
+        }
+        const comments = Array.isArray(thread.comments) ? thread.comments.filter(isRecord) : [];
+        for (const comment of comments) {
+            const author = collabText(comment.author_email, "someone");
+            const marker = comment.parent_comment_id ? "  ↳" : "  •";
+            const edited = comment.edited_at ? styles.dim(" (edited)") : "";
+            const text = comment.deleted === true
+                ? styles.dim("(retracted)")
+                : collabSnippet(comment.body, 72);
+            lines.push(`    ${marker} ${styles.dim(`${formatCollabAge(comment.created_at)} ${author}`)}  ${text}${edited}`);
+            lines.push(`      ${styles.dim(collabText(comment.id))}`);
+        }
+        const threadLink = collabLink(thread);
+        if (threadLink)
+            lines.push(`    ${styles.dim(threadLink)}`);
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+function collabRequestRow(request) {
+    return [
+        collabText(request.id),
+        collabText(request.subject),
+        collabText(request.gate_kind),
+        collabText(request.status),
+        collabText(request.requested_by_email, "—"),
+        formatCollabAge(request.created_at),
+    ];
+}
+const COLLAB_REQUEST_HEADERS = ["ID", "SUBJECT", "GATE", "STATUS", "REQUESTED BY", "AGE"];
+function formatCollabRequestList(data) {
+    const styles = collabStyles();
+    const requests = Array.isArray(data.requests) ? data.requests.filter(isRecord) : [];
+    const lines = ["", styles.bold(`Approval requests (${requests.length})`)];
+    if (requests.length === 0) {
+        lines.push(`  ${styles.dim(collabText(data.hint, "No approval requests match those filters."))}`);
+    }
+    else {
+        lines.push(...renderTextTable(COLLAB_REQUEST_HEADERS, requests.map(collabRequestRow)));
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * The daily surface. Two sections and nothing else: what needs a decision from
+ * this reader, and where they were named. An item the reader cannot act on has
+ * no business being here, so there is no "everything else" section.
+ */
+function formatCollabInbox(data) {
+    const styles = collabStyles();
+    const pending = Array.isArray(data.pending_approvals) ? data.pending_approvals.filter(isRecord) : [];
+    const mentions = Array.isArray(data.mentions) ? data.mentions.filter(isRecord) : [];
+    const lines = ["", styles.bold(`Waiting on you (${pending.length})`)];
+    if (pending.length === 0) {
+        lines.push(`  ${styles.dim("No approvals are assigned to you.")}`);
+    }
+    else {
+        lines.push(...renderTextTable(COLLAB_REQUEST_HEADERS, pending.map(collabRequestRow)));
+    }
+    lines.push("", styles.bold(`Threads that name you (${mentions.length})`));
+    if (mentions.length === 0) {
+        lines.push(`  ${styles.dim("Nobody has mentioned you in an open thread.")}`);
+    }
+    else {
+        lines.push(...renderTextTable(["THREAD", "SUBJECT", "LAST COMMENT", "AGE"], mentions.map((thread) => {
+            const comments = Array.isArray(thread.comments) ? thread.comments.filter(isRecord) : [];
+            const last = comments[comments.length - 1];
+            return [
+                collabText(thread.id),
+                collabText(thread.subject),
+                collabSnippet(last?.body, 44) || collabText(thread.title, "—"),
+                formatCollabAge(thread.updated_at ?? thread.created_at),
+            ];
+        })));
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * `approvals show`. The reader here usually arrived from a link in an email and
+ * knows nothing but the id, so this answers the four questions a table cell
+ * cannot: what is being asked, on what, who owes the answer, and whether the
+ * request can still be decided. An expired request says so in the headline —
+ * `approvals decide` on it is refused by the API.
+ */
+function formatCollabRequestDetail(data) {
+    const styles = collabStyles();
+    const request = isRecord(data.request) ? data.request : data;
+    const status = collabText(request.status);
+    const lapsed = request.lapsed === true;
+    const badge = lapsed
+        ? styles.yellow("[EXPIRED]")
+        : request.opens_gate === true
+            ? styles.green("[APPROVED]")
+            : status === "pending"
+                ? styles.dim("[PENDING]")
+                : styles.yellow(`[${status.toUpperCase()}]`);
+    const assignees = Array.isArray(request.assignee_emails)
+        ? request.assignee_emails.filter((value) => typeof value === "string")
+        : [];
+    const lines = [
+        "",
+        `  ${badge} ${collabText(request.title, "Approval request")}`,
+        `  ${styles.dim("Request")}  ${collabText(request.id)}`,
+        `  ${styles.dim("Subject")}  ${collabText(request.subject)}`,
+        `  ${styles.dim("Gate")}     ${collabText(request.gate_kind)} — ${collabText(request.gate_meaning, "")}`,
+        `  ${styles.dim("Asked by")} ${collabText(request.requested_by_email, "someone")}`,
+        `  ${styles.dim("Decides")}  ${assignees.length > 0 ? assignees.join(", ") : "—"}`,
+    ];
+    const body = collabSnippet(request.body, 72);
+    if (body)
+        lines.push(`  ${styles.dim("Asking")}   ${body}`);
+    if (typeof request.expires_at === "string") {
+        lines.push(`  ${styles.dim("Expires")}  ${request.expires_at}${lapsed ? styles.yellow(" — already passed") : ""}`);
+    }
+    const note = collabText(request.decision_note, "");
+    if (note)
+        lines.push(`  ${styles.dim("Note")}     ${note}`);
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * `approvals client list`. The column that matters is ACCESS: a blank role cell
+ * means FULL access, not a restricted one, and reading it the other way is how
+ * an agency convinces itself a client login is limited when it is not.
+ */
+function formatCollabMembers(data) {
+    const styles = collabStyles();
+    const members = Array.isArray(data.members) ? data.members.filter(isRecord) : [];
+    const lines = ["", styles.bold(`Workspace members (${members.length})`)];
+    if (members.length === 0) {
+        lines.push(`  ${styles.dim("No members resolved for this workspace.")}`);
+    }
+    else {
+        lines.push(...renderTextTable(["EMAIL", "WORKSPACE ROLE", "OXYGEN ROLE", "ACCESS"], members.map((member) => [
+            collabText(member.email, collabText(member.user_id)),
+            collabText(member.workspace_role),
+            member.oxygen_role === "client" ? "client" : "—",
+            collabText(member.access),
+        ])));
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+function formatCollabRequestWrite(data) {
+    const styles = collabStyles();
+    // The request is nested; the resolved assignee emails are not.
+    const request = isRecord(data.request) ? data.request : data;
+    const assignees = Array.isArray(data.assignee_emails)
+        ? data.assignee_emails.filter((value) => typeof value === "string")
+        : [];
+    const lines = [
+        "",
+        `  ${styles.green("[OK]")} Asked ${assignees.length > 0 ? assignees.join(", ") : "the assignees"} to decide.`,
+        `  ${styles.dim("Request")}  ${collabText(request.id)}`,
+        `  ${styles.dim("Subject")}  ${collabText(request.subject)}`,
+        `  ${styles.dim("Gate")}     ${collabText(request.gate_kind)} — ${collabText(request.gate_meaning, "")}`,
+    ];
+    if (typeof request.expires_at === "string") {
+        lines.push(`  ${styles.dim("Expires")}  ${request.expires_at} ${styles.dim("(an expired request does not open the gate)")}`);
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * A decision's headline is `opens_gate`, never the status alone: "the client
+ * replied" and "the client said yes" are the two states an agency must never
+ * confuse, and `changes_requested` is the one that reads like the second and
+ * behaves like the first.
+ */
+function formatCollabDecision(data) {
+    const styles = collabStyles();
+    const request = isRecord(data.request) ? data.request : data;
+    const status = collabText(request.status);
+    const opensGate = request.opens_gate === true || data.gate_opened === true;
+    const lines = [
+        "",
+        `  ${opensGate ? styles.green("[APPROVED]") : styles.yellow(`[${status.toUpperCase()}]`)} ${collabText(request.subject)} — request ${collabText(request.id)}`,
+        `  ${styles.dim("Gate")}     ${opensGate
+            ? `open — the ${collabText(request.gate_kind)} gate no longer blocks this.`
+            : `still shut — a ${collabText(request.gate_kind)} gate only opens on --approve.`}`,
+    ];
+    const note = collabText(request.decision_note, "");
+    if (note)
+        lines.push(`  ${styles.dim("Note")}     ${note}`);
+    if (data.already === true)
+        lines.push(`  ${styles.dim("Replay of the same decision; nothing changed.")}`);
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+function formatCollabGateSet(data) {
+    const styles = collabStyles();
+    const policy = isRecord(data.policy) ? data.policy : {};
+    const required = policy.required === true;
+    const scope = collabText(data.scope, "subject") === "workspace_default"
+        ? `every ${collabText(policy.subject_kind)}`
+        : `${collabText(policy.subject_kind)}:${collabText(policy.subject_id)}`;
+    const lines = [
+        "",
+        `  ${required ? styles.green("[GATE ON]") : styles.dim("[GATE OFF]")} ${collabText(policy.gate_kind)} on ${scope}`,
+        `  ${styles.dim("Means")}    ${collabText(policy.gate_meaning, "")}`,
+    ];
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
+function formatCollabGateList(data) {
+    const styles = collabStyles();
+    const policies = Array.isArray(data.policies) ? data.policies.filter(isRecord) : [];
+    const effective = Array.isArray(data.effective) ? data.effective.filter(isRecord) : [];
+    const lines = ["", styles.bold(`Gate policies (${policies.length})`)];
+    if (policies.length === 0) {
+        lines.push(`  ${styles.dim("No gate is required anywhere in this workspace.")}`);
+    }
+    else {
+        lines.push(...renderTextTable(["GATE", "SCOPE", "APPLIES TO", "REQUIRED"], policies.map((policy) => [
+            collabText(policy.gate_kind),
+            collabText(policy.scope),
+            collabText(policy.subject_id, `every ${collabText(policy.subject_kind)}`),
+            policy.required === true ? "yes" : "no",
+        ])));
+    }
+    if (effective.length > 0) {
+        lines.push("", styles.bold(`Effective for ${collabText(data.subject)}`));
+        lines.push(...renderTextTable(["GATE", "REQUIRED", "SOURCE", "BLOCKED NOW", "PENDING REQUEST"], effective.map((entry) => [
+            collabText(entry.gate_kind),
+            entry.required === true ? "yes" : "no",
+            collabText(entry.source),
+            entry.blocked === true ? "yes" : "no",
+            collabText(entry.pending_request_id, "—"),
+        ])));
+    }
+    lines.push(...collabTrailer(data));
+    lines.push("");
+    return lines.join("\n");
+}
 // `columns reorder` accepts either an absolute --position or a relative
 // --before/--after naming a sibling column. The relative form is resolved
 // client-side into an absolute index against the table's current column order
@@ -20899,6 +21794,9 @@ options) {
     setLimit("total_reads_per_day", options.totalReadsPerDay);
     setLimit("min_action_spacing_seconds", options.minSpacingSeconds);
     setLimit("action_spacing_jitter_seconds", options.spacingJitterSeconds);
+    setLimit("interactive_min_spacing_seconds", options.interactiveMinSpacingSeconds);
+    setLimit("interactive_spacing_jitter_seconds", options.interactiveSpacingJitterSeconds);
+    setLimit("interactive_sends_per_hour", options.interactiveSendsPerHour);
     // Send windows are campaign-scoped; the only per-account time setting is the
     // timezone the daily counters reset in.
     const workingHours = {};