@oxygen-agent/cli 1.686.3 → 1.692.5

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.686.3
+Version: 1.692.5

package/dist/command-manifest.js

@@ -46,6 +46,13 @@ const MUTATING_VERBS = new Set([
     "unbind", "unsubscribe", "update", "upload", "upsert", "use", "warm-send", "warmup",
     "withdraw", "write",
 ]);
+// `--approved` usually identifies a paid or externally mutating execution
+// mode, but a small number of destructive local operations are explicitly
+// zero-credit. Keep those exceptions exact so discovery never invents spend.
+const ZERO_CREDIT_APPROVAL_COMMANDS = new Set(["mailboxes delete"]);
+// These commands preview when the execution approval is omitted even though
+// their gate is named `--approved` rather than `--live`.
+const APPROVAL_PREVIEW_COMMANDS = new Set(["mailboxes delete"]);
 export function buildCommandManifest(program, binaryName) {
     const commands = [];
     for (const child of program.commands) {
@@ -172,8 +179,9 @@ function toManifestEntry(command, path) {
     const flagStrings = options.map((option) => option.flags);
     const leafVerb = path[path.length - 1] ?? "";
     const verbPrefix = leafVerb.split("-")[0] ?? leafVerb;
+    const commandName = path.join(" ");
     return {
-        name: path.join(" "),
+        name: commandName,
         group: path[0] ?? "",
         description: command.description(),
         arguments: command.registeredArguments.map((argument) => ({
@@ -186,20 +194,22 @@ function toManifestEntry(command, path) {
             description: option.description,
             required: option.mandatory,
         })),
-        spends_credits: flagStrings.some((flags) => flags.includes("--approved") ||
-            flags.includes("--max-credits") ||
-            // Copilot's explicit session inference-budget approval flag.
-            flags.includes("--budget-credits")) ||
-            // `copilot send` bills managed inference (5x actual model cost) inside the
-            // session budget approved at `copilot start`, and `copilot approve`
-            // dispatches the gated paid/external capability and requeues the paused
-            // turn (waking the worker for more 5x-billed inference) — no per-command
-            // cap flag exists for either, so the flag heuristic alone would misreport
-            // them as free.
-            (path[0] === "copilot" &&
-                (leafVerb === "send" || leafVerb === "approve")),
+        spends_credits: !ZERO_CREDIT_APPROVAL_COMMANDS.has(commandName) &&
+            (flagStrings.some((flags) => flags.includes("--approved") ||
+                flags.includes("--max-credits") ||
+                // Copilot's explicit session inference-budget approval flag.
+                flags.includes("--budget-credits")) ||
+                // `copilot send` bills managed inference (5x actual model cost) inside the
+                // session budget approved at `copilot start`, and `copilot approve`
+                // dispatches the gated paid/external capability and requeues the paused
+                // turn (waking the worker for more 5x-billed inference) — no per-command
+                // cap flag exists for either, so the flag heuristic alone would misreport
+                // them as free.
+                (path[0] === "copilot" &&
+                    (leafVerb === "send" || leafVerb === "approve"))),
         mutates: MUTATING_VERBS.has(leafVerb) || MUTATING_VERBS.has(verbPrefix),
-        preview_by_default: flagStrings.some((flags) => flags.includes("--live")),
+        preview_by_default: flagStrings.some((flags) => flags.includes("--live")) ||
+            APPROVAL_PREVIEW_COMMANDS.has(commandName),
         json_supported: flagStrings.some((flags) => flags.includes("--json")),
         hidden: isHiddenCommand(command),
     };

package/dist/index.js

@@ -1169,6 +1169,15 @@ function buildCrmPhotosBody(options) {
         ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
     };
 }
+function buildCrmFieldsBody(options) {
+    const object = readOption(options.object);
+    const limit = readOption(options.limit);
+    return {
+        mode: resolveLiveDryRunMode(options),
+        ...(object ? { objects: object } : {}),
+        ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
+    };
+}
 function buildCrmRollupBody(options) {
     const object = readOption(options.object);
     const row = readOption(options.row);
@@ -3758,6 +3767,19 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: buildCrmPhotosBody(options),
         }));
+    }))
+        .addCommand(new Command("fields")
+        .description("Fill the stored CRM fields (Industry, Employees, HQ, and their siblings) from enrichment data this workspace already holds. These are ordinary text/number fields you can edit \u2014 the fill only ever writes an EMPTY cell, so a value you typed is never overwritten. Free: no provider calls, no credits. Run this once on a workspace whose records were enriched before those fields became editable. Defaults to dry-run.")
+        .option("--object <object>", "Limit the fill to one CRM object (companies, people, deals). Defaults to all.")
+        .option("--limit <n>", "Maximum rows to scan per object. Defaults to 2000.")
+        .option("--dry-run", "Preview how many cells would be filled, without writing.")
+        .option("--live", "Write the extracted values onto the records.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm fields", options, () => requestOxygen("/api/cli/crm/fields", {
+            method: "POST",
+            body: buildCrmFieldsBody(options),
+        }));
     }))
         .addCommand(new Command("rollup")
         .description("Recompute the Open Deal column on companies (and the copy stamped on their people) from this workspace's deals. It normally converges on every deal write; run this to repair after a bulk import, or on a workspace whose deals predate the column. Free: no provider calls, no credits. Defaults to dry-run.")
@@ -11789,9 +11811,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("start")
-        .description("Preview or start a sequence. Preview reports exact per-kind scope, sender/mailbox capacity, CRM connection readiness, and safety caps. Live start requires --approved; --max-credits is optional. Email/WhatsApp/CRM-task journeys additionally require --max-live-sends because their external actions cost 0 Oxygen credits. Use --dry-run to simulate without any send, provider campaign, CRM task, or credits. The first live start also switches on the standing reply → CRM automation for the workspace.")
+        .description("Preview or start a sequence. Without --approved, preview scans pending LinkedIn copy and returns exact rendered recipient samples, character counts/limits, copy blockers, per-kind scope, sender/mailbox capacity, CRM readiness, and safety caps. Live start requires --approved; --max-credits is optional. Email/WhatsApp/CRM-task journeys additionally require --max-live-sends because their external actions cost 0 Oxygen credits. Use --dry-run to simulate without any send, provider campaign, CRM task, or credits. The first live start also switches on the standing reply → CRM automation for the workspace.")
         .argument("<sequence>", "Sequence id or slug.")
-        .option("--approved", "Approve and activate live. Without this flag, returns a preview only.")
+        .option("--approved", "Approve and activate live. Without this flag, returns a preview only, including copy_preview rendered samples and blockers.")
         .option("--max-credits <n>", "Optional credit ceiling for the LinkedIn track (omit for an unbounded run).")
         .option("--max-live-sends <n>", "Live external-action ceiling (positive integer). Required for email, WhatsApp, or crm_task steps.")
         .option("--dry-run", "Activate in dry-run mode: advance every step with simulated actions, no sends, CRM writes, provider calls, or credits.")
@@ -12682,6 +12704,35 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (mailbox, options) => {
         await handleAsyncAction("mailboxes get", options, () => requestOxygen(`/api/cli/mailboxes/${encodeURIComponent(mailbox)}`));
+    }))
+        .addCommand(new Command("delete")
+        .description("Preview or approve removal of exact mailboxes from Oxygen at 0 credits. Deletion immediately removes them from sending but never deletes the underlying Google Workspace or Microsoft 365 accounts. It preserves conversation/message/delivery history and stops the 1,000-credit mailbox commitment for future renewals; the current period is not refunded. Listed active/paused sequences keep their status but lose these senders and are not automatically paused. Managed mailboxes and live warmup/monitoring add-ons fail closed with their exact address-scoped teardown steps.")
+        .requiredOption("--mailboxes <list>", "Comma-separated mailbox ids or addresses (maximum 500).")
+        .option("--approved", "Execute the fresh preview. Requires --plan-hash and --confirmation.")
+        .option("--plan-hash <hash>", "Fresh preview plan_hash.")
+        .option("--confirmation <phrase>", "Exact confirmation_phrase returned by the fresh preview.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("mailboxes delete", options, () => {
+            const mailboxes = readCsvOption(options.mailboxes);
+            if (mailboxes.length === 0) {
+                throw new Error("--mailboxes must contain at least one mailbox id or address.");
+            }
+            const planHash = readOption(options.planHash);
+            const confirmation = readOption(options.confirmation);
+            if (options.approved === true && (!planHash || !confirmation)) {
+                throw new Error("--approved requires --plan-hash and --confirmation from a fresh deletion preview.");
+            }
+            return requestOxygen("/api/cli/mailboxes/delete", {
+                method: "POST",
+                body: {
+                    mailboxes,
+                    ...(options.approved === true ? { approved: true } : {}),
+                    ...(planHash ? { plan_hash: planHash } : {}),
+                    ...(confirmation ? { confirmation } : {}),
+                },
+            });
+        });
     }))
         .addCommand(new Command("health")
         .description("Fleet email-health: the sending pool rolled up by external deliverability reputation (healthy/degraded/critical/unknown), per-mailbox scores, connected health providers, and DIRECTIONAL recommendations. Pure read — 0 credits; never pauses a mailbox.")
@@ -12724,7 +12775,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         "Credential file contract:",
         '  JSON: {"mailboxes":[{"email_address":"ada@send-acme.com","provider":"google","app_password":"<Google mailbox app password>"}]}',
         "  Only Google app passwords enter the encrypted seven-day transfer vault. Microsoft rows remain identity-only. Generic SMTP passwords and OAuth/MFA/delegation secrets are rejected.",
-        "  Validation: add --validate-only to parse the complete real file and return safe aggregate counts without authentication, a network request, or a workspace write. Any parse, shape, provider, platform, tenant, secret-policy, or duplicate-conflict error rejects the entire file before the first mailbox write and names mailboxes[index]; validation-only never writes. A later import infrastructure failure may interrupt the upsert; re-run the same file because import is idempotent by address.",
+        "  Validation: add --validate-only to parse the complete real file and return safe aggregate counts plus the provider-specific exact-account OAuth review plan without authentication, a network request, or a workspace write. The plan groups only supplied addresses into reviews of at most 10; it never discovers a domain, and the later online preview may skip existing grants. Any parse, shape, provider, platform, tenant, secret-policy, or duplicate-conflict error rejects the entire file before the first mailbox write and names mailboxes[index]; validation-only never writes. A later import infrastructure failure may interrupt the upsert; re-run the same file because import is idempotent by address.",
         "  Docs: https://oxygen-agent.com/docs/providers/mailbox-compatibility",
         "  Skill: oxygen-email-infra (`oxygen skills install --skill oxygen-email-infra`).",
         "",

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -512,6 +512,12 @@ function normalizeIntent(query) {
     return query.toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
 }
 function explicitCapabilityIntent(query) {
+    if (isMailboxDeleteIntent(query)) {
+        return ROUTE_BY_ID.get("sending-infrastructure") ?? null;
+    }
+    if (isMailboxOnboardingIntent(query)) {
+        return ROUTE_BY_ID.get("sending-infrastructure") ?? null;
+    }
     if (isHostedWorkflowIntent(query))
         return ROUTE_BY_PRIMITIVE.get("workflows") ?? null;
     if (isOwnedPostCommentIntent(query))
@@ -603,6 +609,36 @@ function highestScoringRoute(query) {
     return best?.card ?? null;
 }
 function recommendationsFor(card, query) {
+    if (card.id === "sending-infrastructure" && isMailboxDeleteIntent(query)) {
+        return {
+            tools: [
+                "oxygen_mailboxes_delete",
+                "oxygen_mailboxes_compatibility",
+                "oxygen_mailboxes_list",
+            ],
+            commands: [
+                "mailboxes delete",
+                "mailboxes compatibility",
+                "mailboxes list",
+            ],
+        };
+    }
+    if (card.id === "sending-infrastructure" && isMailboxOnboardingIntent(query)) {
+        return {
+            tools: [
+                "oxygen_mailboxes_compatibility",
+                "oxygen_mailboxes_import",
+                "oxygen_mailboxes_connect_oauth",
+                "oxygen_mailboxes_oauth_health",
+            ],
+            commands: [
+                "mailboxes compatibility",
+                "mailboxes import",
+                "mailboxes connect-oauth",
+                "mailboxes oauth-health",
+            ],
+        };
+    }
     if (card.primitive === "posts" && isOwnedPostCommentIntent(query)) {
         return {
             tools: ["oxygen_publishing_comments", "oxygen_publishing_analytics"],
@@ -782,6 +818,18 @@ function recommendationsFor(card, query) {
     }
     return { tools: [...card.gatewayTools], commands: [...card.gatewayCommands] };
 }
+function isMailboxOnboardingIntent(query) {
+    const operation = /\b(import|migrat\w*|onboard|register|upload|bring|connect existing|add existing)\b/.test(query);
+    const mailboxScope = /\b(mailbox(?:es)?|inbox(?:es)?|sender accounts?|email accounts?|sending pool)\b/.test(query);
+    return operation && mailboxScope;
+}
+function isMailboxDeleteIntent(query) {
+    const mailboxScope = /\b(mailbox(?:es)?|inbox(?:es)?|sender accounts?|email accounts?)\b/.test(query);
+    const removal = /\b(delete|remove)\b/.test(query)
+        || /\bdisconnect\b.{0,24}\b(mailbox(?:es)?|inbox(?:es)?|sender accounts?|email accounts?)\b/.test(query);
+    const scopedDetach = /\b(remove|disconnect)\b.{0,48}\b(mailbox(?:es)?|inbox(?:es)?|sender accounts?|email accounts?)\b.{0,24}\b(?:from|in|on)\b.{0,24}\b(sequence|campaign|cadence|sender profile)\b/.test(query);
+    return mailboxScope && removal && !scopedDetach;
+}
 function isNetNewLinkedInInitiation(query) {
     const mentionsLinkedIn = /\blinkedin\b|\bdm\b/.test(query);
     const startsConversation = /\b(send|message|dm|contact|reach out|initiate|start)\b/.test(query)

package/node_modules/@oxygen/shared/dist/feature-gates.d.ts

@@ -0,0 +1,108 @@
+type FeatureGateEnv = Record<string, string | undefined>;
+/** Where the effective value came from. Precedence is env → remote → default. */
+export type FeatureGateSource = "env_override" | "remote" | "safe_default";
+export type FeatureGateDefinition = {
+    /** PostHog feature-flag key. Lowercase kebab-case by convention. */
+    key: string;
+    /**
+     * The value used whenever the provider has no answer. Pick the value that is
+     * safe to serve indefinitely, not the value you expect: this is what ships
+     * during a vendor outage, and on Vercel it is also what every cold
+     * invocation serves until flag definitions finish loading.
+     */
+    safeDefault: boolean;
+    /**
+     * Optional break-glass env var. Set it to force the gate on/off without
+     * touching the flag service — the only lever that still works when the flag
+     * service is the thing that is broken. Must not name a NEVER_FLAGGABLE key.
+     */
+    envOverride?: string;
+};
+export type FeatureGateResolution = {
+    enabled: boolean;
+    source: FeatureGateSource;
+};
+/**
+ * Env gates that must NEVER become remotely-flippable feature flags, and stay
+ * read directly from `process.env` (Doppler) at their call sites.
+ *
+ * Two disqualifying properties, each fatal on its own:
+ *
+ *   (a) CIRCULARITY — a kill switch for a telemetry vendor cannot be resolved
+ *       through a telemetry vendor. You reach for it precisely when that path is
+ *       misbehaving, so a switch that needs the vendor reachable to be read is
+ *       not a kill switch at all.
+ *   (b) AUTHORIZATION — spend enforcement and external-write enablement. A
+ *       remotely-flippable value means a vendor outage, a mis-click in someone
+ *       else's UI, or a compromised vendor account can uncap credit spend or
+ *       enable public side effects. Hard rules keep those in Doppler, where the
+ *       change is an auditable secret change.
+ *
+ * Per-key rationale (call sites read 2026-08, verified against this base):
+ *
+ * - OXYGEN_TELEMETRY_ENABLED — (a). The master telemetry kill switch, read by
+ *   `apps/web/src/lib/axiom-log-shipper.ts` and `apps/worker/src/telemetry.ts` /
+ *   `log-shipper.ts`. Resolving it remotely makes turning telemetry OFF depend
+ *   on a telemetry vendor being up.
+ * - OXYGEN_LOG_SHIPPING_ENABLED — (a). Same circularity, narrower blast radius
+ *   (log shipping only; `axiom-log-shipper.ts`, `apps/worker/src/log-shipper.ts`).
+ * - OXYGEN_LLM_TRACING_ENABLED — (a) + (b). `packages/shared/src/langfuse.ts`
+ *   fails CLOSED on it because it authorizes egress of full prompt/completion
+ *   payloads to Langfuse (ADR 0014). Where prompt payloads may travel is a data
+ *   boundary, not a rollout. It also lives in this transport-free package, so
+ *   remote resolution would drag a flag client into the published CLI.
+ * - OXYGEN_TRIGGER_DEFAULT_CAPS — (b). Selects log-only vs enforce for the
+ *   plan-tier default per-delivery ceiling on autonomous triggers
+ *   (`apps/worker/src/workflow-spend-cap.ts`). Remote control over spend
+ *   ENFORCEMENT means an outage can uncap autonomous credit spend everywhere.
+ * - OXYGEN_BYOK_DAILY_CAPS — (b). Same, for BYOK per-provider daily caps
+ *   (`packages/providers/src/provider-fetch.ts`) — external money on the
+ *   customer's own keys, and likewise in a package the CLI can reach.
+ * - OXYGEN_PUBLISHING_ENABLED — (b). Fail-closed production switch for posting
+ *   to real provider accounts (`apps/web/src/app/(app)/(dashboard)/publishing/
+ *   data.ts`). Wrong "on" = public posts from customer accounts.
+ * - OXYGEN_AGENTS_ENABLED — (b). Authorizes autonomous Agent run execution —
+ *   tool authority AND credit spend (`apps/web/src/lib/agent-runtime.ts`,
+ *   `apps/worker/src/agent-cycle.ts`). Same class as publishing.
+ *
+ * The list is a guard, not a to-do: none of these is migrated, and
+ * `findFeatureGateRegistryViolations` fails the build's tests if one ever is.
+ */
+export declare const NEVER_FLAGGABLE: readonly string[];
+/**
+ * Every server-side gate resolved through PostHog.
+ *
+ * Intentionally empty: introducing the mechanism is not a reason to move
+ * existing switches onto it. The seven env gates above stay in Doppler, and a
+ * new entry belongs here only when its worst wrong value is a cosmetic or
+ * reversible product difference — never spend, external writes, or telemetry
+ * egress.
+ */
+export declare const FEATURE_GATES: readonly FeatureGateDefinition[];
+/**
+ * Tri-state env parse: `true` / `false` / `null` for "unset or unparseable".
+ *
+ * The null case is load-bearing — an override that is merely absent has to fall
+ * through to the remote value, while an override explicitly set to `false` has
+ * to win over it. Collapsing the two into a boolean would make every gate
+ * without an override permanently forced off.
+ */
+export declare function parseFeatureGateBoolean(value: string | undefined): boolean | null;
+/**
+ * Resolve one gate. Pure: the caller supplies the provider's answer (or
+ * `undefined` when it had none) and the env to read.
+ *
+ * Env override wins over the remote value on purpose. It is the break-glass for
+ * "the flag service is serving the wrong answer", which is worthless if the
+ * flag service outranks it.
+ */
+export declare function resolveFeatureGate(definition: FeatureGateDefinition, remote?: boolean | undefined, env?: FeatureGateEnv): FeatureGateResolution;
+export declare function isNeverFlaggable(name: string): boolean;
+/**
+ * Registry lint, asserted by tests rather than thrown at import time (a gate
+ * registry must never be able to crash a boot). Returns one human-readable
+ * violation per problem; an empty array means the registry is clean.
+ */
+export declare function findFeatureGateRegistryViolations(gates?: readonly FeatureGateDefinition[]): string[];
+export declare function findFeatureGate(key: string): FeatureGateDefinition | undefined;
+export {};

package/node_modules/@oxygen/shared/dist/feature-gates.js

@@ -0,0 +1,153 @@
+// Server-side feature gates (ADR 0021: PostHog owns server-side feature flags).
+//
+// This module is the CONTRACT ONLY — gate definitions, the unflaggable list, and
+// the pure resolver. It is deliberately TRANSPORT-FREE: no `posthog-node`, no
+// fetch, no client, no I/O of any kind. `packages/cli` is published to npm as
+// `@oxygen-agent/cli` and depends on `@oxygen/shared` unbundled, so every import
+// added here becomes a runtime dependency of every customer's CLI install. The
+// evaluation transport lives in `apps/web/src/lib/feature-gate-provider.ts`,
+// which nothing outside the web app imports.
+//
+// The resolver's one invariant: an absent provider answer is not an answer. A
+// flag-service outage, a quota-limited project, a cold lambda whose definitions
+// have not loaded yet, and a flag that simply does not exist all arrive here as
+// `undefined`, and all of them resolve to the gate's `safeDefault`. A gate never
+// flips because a vendor is unreachable.
+/**
+ * Env gates that must NEVER become remotely-flippable feature flags, and stay
+ * read directly from `process.env` (Doppler) at their call sites.
+ *
+ * Two disqualifying properties, each fatal on its own:
+ *
+ *   (a) CIRCULARITY — a kill switch for a telemetry vendor cannot be resolved
+ *       through a telemetry vendor. You reach for it precisely when that path is
+ *       misbehaving, so a switch that needs the vendor reachable to be read is
+ *       not a kill switch at all.
+ *   (b) AUTHORIZATION — spend enforcement and external-write enablement. A
+ *       remotely-flippable value means a vendor outage, a mis-click in someone
+ *       else's UI, or a compromised vendor account can uncap credit spend or
+ *       enable public side effects. Hard rules keep those in Doppler, where the
+ *       change is an auditable secret change.
+ *
+ * Per-key rationale (call sites read 2026-08, verified against this base):
+ *
+ * - OXYGEN_TELEMETRY_ENABLED — (a). The master telemetry kill switch, read by
+ *   `apps/web/src/lib/axiom-log-shipper.ts` and `apps/worker/src/telemetry.ts` /
+ *   `log-shipper.ts`. Resolving it remotely makes turning telemetry OFF depend
+ *   on a telemetry vendor being up.
+ * - OXYGEN_LOG_SHIPPING_ENABLED — (a). Same circularity, narrower blast radius
+ *   (log shipping only; `axiom-log-shipper.ts`, `apps/worker/src/log-shipper.ts`).
+ * - OXYGEN_LLM_TRACING_ENABLED — (a) + (b). `packages/shared/src/langfuse.ts`
+ *   fails CLOSED on it because it authorizes egress of full prompt/completion
+ *   payloads to Langfuse (ADR 0014). Where prompt payloads may travel is a data
+ *   boundary, not a rollout. It also lives in this transport-free package, so
+ *   remote resolution would drag a flag client into the published CLI.
+ * - OXYGEN_TRIGGER_DEFAULT_CAPS — (b). Selects log-only vs enforce for the
+ *   plan-tier default per-delivery ceiling on autonomous triggers
+ *   (`apps/worker/src/workflow-spend-cap.ts`). Remote control over spend
+ *   ENFORCEMENT means an outage can uncap autonomous credit spend everywhere.
+ * - OXYGEN_BYOK_DAILY_CAPS — (b). Same, for BYOK per-provider daily caps
+ *   (`packages/providers/src/provider-fetch.ts`) — external money on the
+ *   customer's own keys, and likewise in a package the CLI can reach.
+ * - OXYGEN_PUBLISHING_ENABLED — (b). Fail-closed production switch for posting
+ *   to real provider accounts (`apps/web/src/app/(app)/(dashboard)/publishing/
+ *   data.ts`). Wrong "on" = public posts from customer accounts.
+ * - OXYGEN_AGENTS_ENABLED — (b). Authorizes autonomous Agent run execution —
+ *   tool authority AND credit spend (`apps/web/src/lib/agent-runtime.ts`,
+ *   `apps/worker/src/agent-cycle.ts`). Same class as publishing.
+ *
+ * The list is a guard, not a to-do: none of these is migrated, and
+ * `findFeatureGateRegistryViolations` fails the build's tests if one ever is.
+ */
+export const NEVER_FLAGGABLE = [
+    "OXYGEN_PUBLISHING_ENABLED",
+    "OXYGEN_AGENTS_ENABLED",
+    "OXYGEN_TELEMETRY_ENABLED",
+    "OXYGEN_LOG_SHIPPING_ENABLED",
+    "OXYGEN_LLM_TRACING_ENABLED",
+    "OXYGEN_TRIGGER_DEFAULT_CAPS",
+    "OXYGEN_BYOK_DAILY_CAPS",
+];
+/**
+ * Every server-side gate resolved through PostHog.
+ *
+ * Intentionally empty: introducing the mechanism is not a reason to move
+ * existing switches onto it. The seven env gates above stay in Doppler, and a
+ * new entry belongs here only when its worst wrong value is a cosmetic or
+ * reversible product difference — never spend, external writes, or telemetry
+ * egress.
+ */
+export const FEATURE_GATES = [];
+/**
+ * Tri-state env parse: `true` / `false` / `null` for "unset or unparseable".
+ *
+ * The null case is load-bearing — an override that is merely absent has to fall
+ * through to the remote value, while an override explicitly set to `false` has
+ * to win over it. Collapsing the two into a boolean would make every gate
+ * without an override permanently forced off.
+ */
+export function parseFeatureGateBoolean(value) {
+    const normalized = value?.trim().toLowerCase();
+    if (!normalized)
+        return null;
+    if (normalized === "true" || normalized === "1" || normalized === "yes")
+        return true;
+    if (normalized === "false" || normalized === "0" || normalized === "no")
+        return false;
+    return null;
+}
+/**
+ * Resolve one gate. Pure: the caller supplies the provider's answer (or
+ * `undefined` when it had none) and the env to read.
+ *
+ * Env override wins over the remote value on purpose. It is the break-glass for
+ * "the flag service is serving the wrong answer", which is worthless if the
+ * flag service outranks it.
+ */
+export function resolveFeatureGate(definition, remote, env = process.env) {
+    const override = definition.envOverride
+        ? parseFeatureGateBoolean(env[definition.envOverride])
+        : null;
+    if (override !== null)
+        return { enabled: override, source: "env_override" };
+    if (typeof remote === "boolean")
+        return { enabled: remote, source: "remote" };
+    return { enabled: definition.safeDefault, source: "safe_default" };
+}
+// Compare env-var names and flag keys in one space, so `oxygen-agents-enabled`
+// as a flag key is caught by a list written in SCREAMING_SNAKE env style.
+function normalizeGateName(name) {
+    return name.trim().toUpperCase().replace(/-/g, "_");
+}
+export function isNeverFlaggable(name) {
+    const normalized = normalizeGateName(name);
+    return NEVER_FLAGGABLE.some((entry) => normalizeGateName(entry) === normalized);
+}
+/**
+ * Registry lint, asserted by tests rather than thrown at import time (a gate
+ * registry must never be able to crash a boot). Returns one human-readable
+ * violation per problem; an empty array means the registry is clean.
+ */
+export function findFeatureGateRegistryViolations(gates = FEATURE_GATES) {
+    const violations = [];
+    const seen = new Set();
+    for (const gate of gates) {
+        if (!gate.key.trim()) {
+            violations.push("A feature gate has an empty key.");
+            continue;
+        }
+        if (seen.has(gate.key))
+            violations.push(`Duplicate feature gate key: ${gate.key}`);
+        seen.add(gate.key);
+        if (isNeverFlaggable(gate.key)) {
+            violations.push(`Feature gate "${gate.key}" names a NEVER_FLAGGABLE switch — it must stay an env gate.`);
+        }
+        if (gate.envOverride && isNeverFlaggable(gate.envOverride)) {
+            violations.push(`Feature gate "${gate.key}" uses NEVER_FLAGGABLE env var "${gate.envOverride}" as its override.`);
+        }
+    }
+    return violations;
+}
+export function findFeatureGate(key) {
+    return FEATURE_GATES.find((gate) => gate.key === key);
+}

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -22,6 +22,7 @@ export * from "./directory.js";
 export * from "./email-tracking-token.js";
 export * from "./email-unsubscribe-token.js";
 export * from "./error-redaction.js";
+export * from "./feature-gates.js";
 export * from "./hosted-ai.js";
 export * from "./identifiers.js";
 export * from "./knowledge-constants.js";

package/node_modules/@oxygen/shared/dist/index.js

@@ -22,6 +22,7 @@ export * from "./directory.js";
 export * from "./email-tracking-token.js";
 export * from "./email-unsubscribe-token.js";
 export * from "./error-redaction.js";
+export * from "./feature-gates.js";
 export * from "./hosted-ai.js";
 export * from "./identifiers.js";
 export * from "./knowledge-constants.js";

package/node_modules/@oxygen/shared/dist/mailbox-import.d.ts

@@ -21,6 +21,7 @@ export type MailboxImportValidationSummary = {
     infrastructure_platforms: Record<string, number>;
     credential_rows: number;
     identity_only_rows: number;
+    oauth_review_plan: MailboxOAuthReviewPlan;
     limits: {
         max_rows: number;
         max_file_bytes: number;
@@ -31,8 +32,26 @@ export type MailboxImportValidationSummary = {
     credits_used: 0;
     next_action: string;
 };
+export type MailboxOAuthProviderReviewPlan = {
+    mailboxes: number;
+    batches: number;
+    batch_sizes: number[];
+};
+export type MailboxOAuthReviewPlan = {
+    authorization: "exact_account_oauth";
+    scope: "validated_addresses";
+    directory_discovery: false;
+    existing_grants_checked: false;
+    batch_size: number;
+    total_batches: number;
+    providers: {
+        google: MailboxOAuthProviderReviewPlan;
+        microsoft: MailboxOAuthProviderReviewPlan;
+    };
+};
 export declare const MAILBOX_IMPORT_FILE_MAX_BYTES: number;
 export declare const MAILBOX_IMPORT_ROW_LIMIT = 500;
+export declare const MAILBOX_OAUTH_REVIEW_BATCH_SIZE = 10;
 /**
  * Infer the bounded mailbox-import format without node:path so browser and CLI
  * preflight use the same extension contract.
@@ -55,4 +74,11 @@ export declare function summarizeMailboxImportValidation(mailboxes: readonly Nor
     source: MailboxImportValidationSource;
     sourceProvider: string | null;
 }): MailboxImportValidationSummary;
+/**
+ * Build the deterministic, provider-specific review queue for exact-account
+ * OAuth. This is safe during local file validation: it uses only normalized
+ * provider counts, performs no directory discovery, and does not claim to know
+ * whether a workspace already holds a usable grant for an address.
+ */
+export declare function planMailboxOAuthReviews(mailboxes: readonly Pick<NormalizedMailboxImportRow, "provider">[]): MailboxOAuthReviewPlan;
 export declare function normalizeMailboxImportVendor(raw: string | null | undefined, from: string | null | undefined): string | null;

package/node_modules/@oxygen/shared/dist/mailbox-import.js

@@ -1,6 +1,7 @@
 import { OxygenError } from "./cli-result.js";
 export const MAILBOX_IMPORT_FILE_MAX_BYTES = 5 * 1024 * 1024;
 export const MAILBOX_IMPORT_ROW_LIMIT = 500;
+export const MAILBOX_OAUTH_REVIEW_BATCH_SIZE = 10;
 const MAILBOX_EMAIL_HEADERS = new Set([
     "address",
     "email",
@@ -194,6 +195,7 @@ export function summarizeMailboxImportValidation(mailboxes, input) {
         infrastructure_platforms: infrastructurePlatforms,
         credential_rows: credentialRows,
         identity_only_rows: mailboxes.length - credentialRows,
+        oauth_review_plan: planMailboxOAuthReviews(mailboxes),
         limits: {
             max_rows: MAILBOX_IMPORT_ROW_LIMIT,
             max_file_bytes: MAILBOX_IMPORT_FILE_MAX_BYTES,
@@ -205,6 +207,40 @@ export function summarizeMailboxImportValidation(mailboxes, input) {
         next_action: "Submit this reviewed file to register the mailboxes.",
     };
 }
+/**
+ * Build the deterministic, provider-specific review queue for exact-account
+ * OAuth. This is safe during local file validation: it uses only normalized
+ * provider counts, performs no directory discovery, and does not claim to know
+ * whether a workspace already holds a usable grant for an address.
+ */
+export function planMailboxOAuthReviews(mailboxes) {
+    const counts = { google: 0, microsoft: 0 };
+    for (const mailbox of mailboxes)
+        counts[mailbox.provider] += 1;
+    const google = planProviderOAuthReviews(counts.google);
+    const microsoft = planProviderOAuthReviews(counts.microsoft);
+    return {
+        authorization: "exact_account_oauth",
+        scope: "validated_addresses",
+        directory_discovery: false,
+        existing_grants_checked: false,
+        batch_size: MAILBOX_OAUTH_REVIEW_BATCH_SIZE,
+        total_batches: google.batches + microsoft.batches,
+        providers: { google, microsoft },
+    };
+}
+function planProviderOAuthReviews(mailboxes) {
+    const fullBatches = Math.floor(mailboxes / MAILBOX_OAUTH_REVIEW_BATCH_SIZE);
+    const remainder = mailboxes % MAILBOX_OAUTH_REVIEW_BATCH_SIZE;
+    const batchSizes = Array.from({ length: fullBatches }, () => MAILBOX_OAUTH_REVIEW_BATCH_SIZE);
+    if (remainder > 0)
+        batchSizes.push(remainder);
+    return {
+        mailboxes,
+        batches: batchSizes.length,
+        batch_sizes: batchSizes,
+    };
+}
 export function normalizeMailboxImportVendor(raw, from) {
     if (from === "hypertide") {
         if (raw && raw.trim().toLowerCase() !== "hypertide") {

package/node_modules/@oxygen/shared/dist/sequence-template.d.ts

@@ -66,6 +66,12 @@ export declare const MAX_SPINTAX_DEPTH = 10;
  * `{{column}}` placeholders render empty; a malformed placeholder is left literal.
  */
 export declare function renderTemplate(template: string, values: Record<string, unknown>, options?: RenderTemplateOptions): string;
+/**
+ * Bare variables that are blank in the branch this exact render selected.
+ * Untaken conditional/spintax branches are deliberately ignored; fallback-bearing
+ * tokens are optional, while bare tokens selected inside a fallback are checked.
+ */
+export declare function renderedTemplateMissingVariables(template: string, values: Record<string, unknown>, options?: RenderTemplateOptions): string[];
 /**
  * Every column key a template references — across bare `{{column}}` substitutions,
  * `{{column|fallback}}` fallbacks, `{{RANDOM|…}}` spintax options, and both the

package/node_modules/@oxygen/shared/dist/sql-error.d.ts

@@ -1,5 +1,5 @@
 /** Normalized failure category, derived from SQLSTATE first, then errno/message. */
-export type SqlErrorCause = "connect_timeout" | "connection" | "statement_timeout" | "admin_shutdown" | "too_many_connections" | "insufficient_resources" | "auth" | "schema_drift" | "data_exception" | "integrity_constraint" | "serialization" | "deadlock" | "transaction_rollback" | "syntax_or_access" | "internal" | "unknown";
+export type SqlErrorCause = "connect_timeout" | "connection" | "statement_timeout" | "admin_shutdown" | "too_many_connections" | "insufficient_resources" | "auth" | "schema_drift" | "data_exception" | "integrity_constraint" | "serialization" | "deadlock" | "transaction_rollback" | "read_only" | "syntax_or_access" | "internal" | "unknown";
 export type SqlErrorAttribution = {
     /** Postgres SQLSTATE (5 chars) when present; null for connection-level errnos. */
     pgCode: string | null;

package/node_modules/@oxygen/shared/dist/sql-error.js

@@ -62,6 +62,12 @@ const TRANSIENT_CAUSES = new Set([
     "serialization",
     "deadlock",
     "transaction_rollback",
+    // A Neon compute waking from autostop (or briefly in hot-standby/recovery)
+    // rejects writes with 25006 read_only_sql_transaction until the primary is
+    // writable again; the next poll tick succeeds. The dev worker's control-queue
+    // drain produced ~hourly 25006 bursts that self-healed within one wake cycle
+    // (OXY-5984).
+    "read_only",
 ]);
 /**
  * Classifies a pg/drizzle error into structured, non-secret attribution.
@@ -215,6 +221,13 @@ const EXACT_SQLSTATE_CAUSES = new Map([
     ["53300", "too_many_connections"],
     ["40001", "serialization"],
     ["40P01", "deadlock"],
+    // 25006 read_only_sql_transaction: a write hit a compute that is (still)
+    // read-only — a Neon dev branch mid-autostart or in hot-standby/recovery.
+    // Class 25 has no blanket mapping on purpose: its other members (25P02
+    // in_failed_sql_transaction, 25001 active_sql_transaction, ...) are
+    // transaction-protocol misuse, not a transient infra state. Only 25006 is
+    // the "retry on the next tick" case (OXY-5984).
+    ["25006", "read_only"],
 ]);
 // SQLSTATE class (first two chars) → cause, applied only after the exact and
 // schema-drift lookups above so the precise codes keep their dedicated cause.

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const OXYGEN_VERSION = "1.686.3";
+export declare const OXYGEN_VERSION = "1.692.5";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.686.3";
+export const OXYGEN_VERSION = "1.692.5";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.686.3",
+  "version": "1.692.5",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",