@oxygen-agent/cli 1.662.0 → 1.681.2

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -294,7 +294,12 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         gatewayCommands: ["sequences send", "sequences create", "sequences enroll", "sequences start", "sequences list"],
         skills: ["oxygen-sequencer"],
         endpointSections: ["senders", "sequencer", "sequences", "spintax", "suppressions", "voice"],
-        intentTerms: ["sequence", "campaign", "cadence", "enroll", "outreach", "linkedin message", "linkedin dm", "nurture", "follow up", "sender rotation", "stop on reply"],
+        // "sender identity", "sender profile" and "phone number" are here because a
+        // blind-user eval (2026-08-09) asked for "our sender identity" and got routed
+        // to workspace-access — "identity" matched the AUTH sense. The nouns a user
+        // reaches for when naming a sending identity or the dialing pool have to land
+        // on the group that actually owns `senders profiles` and `voice numbers`.
+        intentTerms: ["sequence", "campaign", "cadence", "enroll", "outreach", "linkedin message", "linkedin dm", "nurture", "follow up", "sender rotation", "stop on reply", "sender identity", "sending identity", "sender profile", "phone number", "dialing", "dialer"],
     },
     {
         id: "publishing",

package/node_modules/@oxygen/shared/dist/collab.d.ts

@@ -4,14 +4,15 @@ import { type TagKind } from "./tags.js";
  *
  * Seeded from {@link TAG_KINDS}: anything worth labelling for a campaign is
  * worth discussing with the client who signs that campaign off. The list is
- * RESTATED rather than aliased because it is also a stored value — the
- * `ox_collab` CHECK constraint and existing rows pin it — so widening the tag
- * vocabulary must be a deliberate decision here, not a silent side effect that
- * lets the API accept a kind the database rejects. The alignment is enforced
+ * RESTATED rather than aliased because it is also a stored value — existing
+ * `ox_collab` rows pin it — so widening the tag vocabulary must be a deliberate
+ * decision here, not a silent side effect. (`subject_kind` deliberately carries
+ * no enum CHECK; 0182_collab.sql explains why, so adding a kind here needs no
+ * tenant migration.) The alignment is enforced
  * both ways: {@link EveryTagKindIsCommentable} fails the build if a taggable
  * kind is missing, and the paired test pins today's list exactly.
  */
-export declare const COLLAB_SUBJECT_KINDS: readonly ["knowledge_page", "publishing_post", "sequence", "table", "workflow", "recipe", "conversation", "mailbox", "sender", "record", "domain", "project"];
+export declare const COLLAB_SUBJECT_KINDS: readonly ["knowledge_page", "publishing_post", "sequence", "table", "workflow", "recipe", "conversation", "mailbox", "sender", "record", "domain", "project", "sender_profile", "voice_number"];
 export type CollabSubjectKind = (typeof COLLAB_SUBJECT_KINDS)[number];
 /** Compile-time assertion helper: instantiating with `false` is a type error. */
 type AssertTrue<T extends true> = T;

package/node_modules/@oxygen/shared/dist/collab.js

@@ -22,10 +22,11 @@ import { OxygenError } from "./cli-result.js";
  *
  * Seeded from {@link TAG_KINDS}: anything worth labelling for a campaign is
  * worth discussing with the client who signs that campaign off. The list is
- * RESTATED rather than aliased because it is also a stored value — the
- * `ox_collab` CHECK constraint and existing rows pin it — so widening the tag
- * vocabulary must be a deliberate decision here, not a silent side effect that
- * lets the API accept a kind the database rejects. The alignment is enforced
+ * RESTATED rather than aliased because it is also a stored value — existing
+ * `ox_collab` rows pin it — so widening the tag vocabulary must be a deliberate
+ * decision here, not a silent side effect. (`subject_kind` deliberately carries
+ * no enum CHECK; 0182_collab.sql explains why, so adding a kind here needs no
+ * tenant migration.) The alignment is enforced
  * both ways: {@link EveryTagKindIsCommentable} fails the build if a taggable
  * kind is missing, and the paired test pins today's list exactly.
  */
@@ -42,6 +43,8 @@ export const COLLAB_SUBJECT_KINDS = [
     "record",
     "domain",
     "project",
+    "sender_profile",
+    "voice_number",
 ];
 export function isCollabSubjectKind(value) {
     return typeof value === "string" && COLLAB_SUBJECT_KINDS.includes(value);
@@ -69,6 +72,8 @@ export const COLLAB_SUBJECT_LABELS = {
     record: { one: "CRM record", many: "CRM records" },
     domain: { one: "sending domain", many: "sending domains" },
     project: { one: "project", many: "projects" },
+    sender_profile: { one: "sender profile", many: "sender profiles" },
+    voice_number: { one: "phone number", many: "phone numbers" },
 };
 /**
  * What a thread on each kind is usually about, for `--help` and MCP tool
@@ -93,6 +98,8 @@ export const COLLAB_SUBJECT_PROSE = {
     record: "a CRM record's truth",
     domain: "a sending domain's DNS and warmup",
     project: "a project's scope",
+    sender_profile: "a sending identity's accounts and inboxes",
+    voice_number: "a dialing number's caps and warmup",
 };
 /** Oxford-comma list: ["a"] -> "a"; ["a","b"] -> "a and b"; ["a","b","c"] -> "a, b, and c". */
 function formatProseList(items) {

package/node_modules/@oxygen/shared/dist/credit-guidance.d.ts

@@ -5,9 +5,18 @@ export type CreditGuidance = {
     available_credits: number | null;
     credit_posture: CreditPosture;
     credit_guidance: string;
+    /** Present only when the caller supplied an expected (average) figure. */
+    expected_credits?: number;
 };
 export declare function buildCreditGuidance(input: {
     estimatedCredits: number | null | undefined;
     availableCredits: number | null | undefined;
     headroomMultiplier?: number;
+    /** The average a run actually costs. When given, the ceiling is sized from this. */
+    expectedCredits?: number | null | undefined;
+    /** Dearest single lane a row can reach — the tail the band covers. */
+    worstCaseCreditsPerRow?: number | null | undefined;
+    rowCount?: number | null | undefined;
+    /** True when estimatedCredits is a genuine per-row bound (bill-on-hit lanes). */
+    worstCaseIsHardBound?: boolean;
 }): CreditGuidance;

package/node_modules/@oxygen/shared/dist/credit-guidance.js

@@ -1,10 +1,66 @@
 const DEFAULT_HEADROOM_MULTIPLIER = 1.25;
+/**
+ * Size a ceiling from the EXPECTED cost plus a variance band, rather than from
+ * the worst case.
+ *
+ * A waterfall lane bills only on a hit and a row stops at the first lane that
+ * resolves it, so the worst case is the dearest lane on EVERY row — a tail event,
+ * not a price. Quoting it made a 4.8k job read as 31.6k and told workspaces with
+ * ample balance they were "tight".
+ *
+ * The band is `expected + worst_row x tailRows`, where `tailRows` scales like
+ * sqrt(n): unlucky rows are a sample of the tail, and their count grows with the
+ * square root of the run, not linearly. `+1` guarantees a run can always afford at
+ * least one row above the mean, and `min(n, ...)` collapses the whole thing to the
+ * true worst case on tiny runs, where it is cheap to just cover everything.
+ *
+ * `expected x 1.25` remains the floor, so a flat/cheap chain with no meaningful
+ * tail keeps exactly the old headroom.
+ */
+function expectedCreditCeiling(input) {
+    const floor = input.expectedCredits * input.headroomMultiplier;
+    let ceiling = floor;
+    if (input.worstCaseCreditsPerRow !== null && input.rowCount !== null && input.rowCount > 0) {
+        const tailRows = Math.min(input.rowCount, Math.ceil(Math.sqrt(input.rowCount)) + 1);
+        ceiling = Math.max(floor, input.expectedCredits + input.worstCaseCreditsPerRow * tailRows);
+    }
+    // Only clamp where the worst case is a REAL per-row bound — bill-on-hit lanes,
+    // where one lane is the most a row can cost. An AI/tool column's "estimate" is a
+    // token guess that real usage can exceed, so clamping there would reintroduce
+    // mid-run truncation on exactly the columns that have no ceiling of their own.
+    //
+    // Clamp to the worst case WITH its headroom, not to the bare figure: the row
+    // count is itself an estimate for a filtered selection, and the multiplier is
+    // what absorbs an undercount. Clamping to the bare total would make a small run
+    // strictly tighter than before this change, which is the opposite of the point.
+    if (input.worstCaseIsHardBound && input.worstCaseTotal !== null) {
+        ceiling = Math.min(ceiling, input.worstCaseTotal * input.headroomMultiplier);
+    }
+    return Math.max(1, Math.ceil(ceiling));
+}
 export function buildCreditGuidance(input) {
     const estimatedCredits = normalizeCreditValue(input.estimatedCredits);
     const availableCredits = normalizeCreditValue(input.availableCredits);
-    const recommendedMaxCredits = recommendedCreditCeiling(estimatedCredits, input.headroomMultiplier ?? DEFAULT_HEADROOM_MULTIPLIER);
+    const expectedCredits = normalizeCreditValue(input.expectedCredits);
+    const headroomMultiplier = normalizeMultiplier(input.headroomMultiplier);
+    // No expected figure supplied => byte-identical to the pre-existing behaviour,
+    // so publishing / sequences / AI callers are untouched by this change.
+    const recommendedMaxCredits = expectedCredits === null
+        ? recommendedCreditCeiling(estimatedCredits, headroomMultiplier)
+        : expectedCreditCeiling({
+            expectedCredits,
+            worstCaseCreditsPerRow: normalizeCreditValue(input.worstCaseCreditsPerRow),
+            worstCaseTotal: estimatedCredits,
+            rowCount: typeof input.rowCount === "number" && Number.isFinite(input.rowCount)
+                ? Math.max(0, Math.floor(input.rowCount))
+                : null,
+            headroomMultiplier,
+            worstCaseIsHardBound: input.worstCaseIsHardBound === true,
+        });
+    const expectedFields = expectedCredits === null ? {} : { expected_credits: expectedCredits };
     if (estimatedCredits === null) {
         return {
+            ...expectedFields,
             estimated_credits: null,
             recommended_max_credits: null,
             available_credits: availableCredits,
@@ -14,6 +70,7 @@ export function buildCreditGuidance(input) {
     }
     if (availableCredits === null) {
         return {
+            ...expectedFields,
             estimated_credits: estimatedCredits,
             recommended_max_credits: recommendedMaxCredits,
             available_credits: null,
@@ -22,7 +79,30 @@ export function buildCreditGuidance(input) {
         };
     }
     if (recommendedMaxCredits !== null && recommendedMaxCredits <= availableCredits) {
+        // When an expected figure drove the ceiling, the copy has to describe THAT,
+        // not "the estimate plus 25% headroom" — the old sentence would misstate how
+        // the number was derived. The tail warning is added only when a full
+        // fall-through really could outrun the balance; saying it otherwise invents
+        // a risk that does not exist.
+        if (expectedCredits !== null) {
+            const tailWarning = estimatedCredits > availableCredits
+                ? " Only a run where nearly every row falls through to the dearest provider could exceed your"
+                    + " balance — the run keeps going and stops when the balance runs out, keeping every row it"
+                    + " has already completed."
+                : "";
+            return {
+                ...expectedFields,
+                estimated_credits: estimatedCredits,
+                recommended_max_credits: recommendedMaxCredits,
+                available_credits: availableCredits,
+                credit_posture: "sufficient",
+                credit_guidance: `Credits cover the expected cost (≈${formatCreditsForCopy(expectedCredits)} credits) with `
+                    + "headroom for the rows that fall through to a pricier provider."
+                    + `${tailWarning} Unused credits are not spent.`,
+            };
+        }
         return {
+            ...expectedFields,
             estimated_credits: estimatedCredits,
             recommended_max_credits: recommendedMaxCredits,
             available_credits: availableCredits,
@@ -33,6 +113,7 @@ export function buildCreditGuidance(input) {
         };
     }
     return {
+        ...expectedFields,
         estimated_credits: estimatedCredits,
         recommended_max_credits: availableCredits > 0 ? roundCreditValue(availableCredits) : null,
         available_credits: availableCredits,
@@ -51,6 +132,14 @@ function recommendedCreditCeiling(estimatedCredits, headroomMultiplier = DEFAULT
         : DEFAULT_HEADROOM_MULTIPLIER;
     return Math.max(1, Math.ceil(normalized * multiplier));
 }
+function normalizeMultiplier(value) {
+    return Number.isFinite(value) && (value ?? 0) > 0
+        ? value
+        : DEFAULT_HEADROOM_MULTIPLIER;
+}
+function formatCreditsForCopy(value) {
+    return Math.round(value).toLocaleString("en-US");
+}
 function normalizeCreditValue(value) {
     if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
         return null;

package/node_modules/@oxygen/shared/dist/file-import.d.ts

@@ -1,3 +1,4 @@
+import { type Row } from "read-excel-file/node";
 import { type ImportColumnDataType } from "./column-types.js";
 export type RowsFileFormat = "json" | "jsonl" | "csv" | "xlsx";
 export type ImportTableColumn = {
@@ -16,6 +17,10 @@ export declare function normalizeRowsFormat(value: string | undefined, fallback:
 export declare function parseRowsFileBuffer(buffer: Buffer, format: RowsFileFormat, options?: {
     sheet?: string;
 }): Promise<Record<string, unknown>[]>;
+/** Read raw workbook cells for consumers with stricter, domain-specific headers. */
+export declare function parseXlsxWorkbookBuffer(buffer: Buffer, options?: {
+    sheet?: string;
+}): Promise<Row[]>;
 export declare function iterateRowsFileBufferBatches(buffer: Buffer, format: RowsFileFormat, options?: {
     sheet?: string;
     batchSize?: number;

package/node_modules/@oxygen/shared/dist/file-import.js

@@ -32,6 +32,21 @@ export async function parseRowsFileBuffer(buffer, format, options = {}) {
         return await parseXlsxRows(buffer, options);
     return parseRowsText(buffer.toString("utf8"), format);
 }
+/** Read raw workbook cells for consumers with stricter, domain-specific headers. */
+export async function parseXlsxWorkbookBuffer(buffer, options = {}) {
+    try {
+        return await readXlsxFile(buffer, options.sheet ? { sheet: options.sheet } : {});
+    }
+    catch (error) {
+        throw new OxygenError("invalid_rows", "XLSX sheet was not found.", {
+            details: {
+                sheet: options.sheet ?? null,
+                reason: error instanceof Error ? error.message : String(error),
+            },
+            exitCode: 1,
+        });
+    }
+}
 export async function* iterateRowsFileBufferBatches(buffer, format, options = {}) {
     const batchSize = normalizeBatchSize(options.batchSize);
     if (format === "csv") {
@@ -127,19 +142,7 @@ export function normalizeImportColumnKey(value) {
     return toSnakeIdentifier(value, "column");
 }
 async function parseXlsxRows(buffer, options) {
-    let rows;
-    try {
-        rows = await readXlsxFile(buffer, options.sheet ? { sheet: options.sheet } : {});
-    }
-    catch (error) {
-        throw new OxygenError("invalid_rows", "XLSX sheet was not found.", {
-            details: {
-                sheet: options.sheet ?? null,
-                reason: error instanceof Error ? error.message : String(error),
-            },
-            exitCode: 1,
-        });
-    }
+    const rows = await parseXlsxWorkbookBuffer(buffer, options);
     const [header, ...body] = rows;
     if (!header || header.length === 0)
         return [];

package/node_modules/@oxygen/shared/dist/mailbox-import.d.ts

@@ -0,0 +1,58 @@
+export type MailboxImportMode = "identity" | "credential";
+export type MailboxImportFileFormat = "json" | "jsonl" | "csv" | "xlsx";
+export type MailboxImportValidationSource = "identity_file" | "credential_file" | "hypertide_file";
+export type NormalizedMailboxImportRow = {
+    email_address: string;
+    provider: "google" | "microsoft";
+    workspace_external_id?: string;
+    infrastructure_platform?: "google_workspace" | "microsoft_365" | "microsoft_azure";
+    tenant_id?: string;
+    app_password?: string;
+};
+export type MailboxImportValidationSummary = {
+    valid: true;
+    source: MailboxImportValidationSource;
+    source_provider?: string;
+    rows: number;
+    providers: {
+        google: number;
+        microsoft: number;
+    };
+    infrastructure_platforms: Record<string, number>;
+    credential_rows: number;
+    identity_only_rows: number;
+    limits: {
+        max_rows: number;
+        max_file_bytes: number;
+    };
+    mutation: false;
+    network_request: false;
+    provider_call: false;
+    credits_used: 0;
+    next_action: string;
+};
+export declare const MAILBOX_IMPORT_FILE_MAX_BYTES: number;
+export declare const MAILBOX_IMPORT_ROW_LIMIT = 500;
+/**
+ * Infer the bounded mailbox-import format without node:path so browser and CLI
+ * preflight use the same extension contract.
+ */
+export declare function inferMailboxImportFileFormat(name: string): MailboxImportFileFormat;
+/**
+ * Parse credential-sensitive text without ever echoing file contents. JSON may
+ * be either a bare array or the common `{ mailboxes: [...] }` export wrapper.
+ */
+export declare function parseMailboxImportText(text: string, format: Exclude<MailboxImportFileFormat, "xlsx">): unknown[];
+/** Convert read-excel-file's browser rows to the same object rows as CSV. */
+export declare function normalizeMailboxWorkbookRows(rows: readonly (readonly unknown[])[]): unknown[];
+/**
+ * Whitelist mailbox fields before a local file crosses the network. The same
+ * function runs in the CLI and first-party web app, so accepted aliases and
+ * non-transferable-secret rejection cannot drift by surface.
+ */
+export declare function normalizeMailboxImportFile(value: unknown, mode: MailboxImportMode): NormalizedMailboxImportRow[];
+export declare function summarizeMailboxImportValidation(mailboxes: readonly NormalizedMailboxImportRow[], input: {
+    source: MailboxImportValidationSource;
+    sourceProvider: string | null;
+}): MailboxImportValidationSummary;
+export declare function normalizeMailboxImportVendor(raw: string | null | undefined, from: string | null | undefined): string | null;