@oxygen-agent/cli 1.696.2 → 1.700.10

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.696.2
+Version: 1.700.10

package/dist/index.js

@@ -12766,7 +12766,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     program.addCommand(new Command("mailboxes")
         .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local credential-file transfer), pause/disable inboxes, connect EmailGuard monitoring, and inspect/control managed SendKit warmup. Fresh managed InboxKit Google/Microsoft/Azure orders activate exact native Sequencer exports automatically after provisioning under their approved default-on add-on. Standalone warmup plans and credit caps are for BYOK/imported mailboxes, managed opt-outs, or later separate enrollment. SendKit warms them but never owns campaign dispatch. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
         .addCommand(new Command("list")
-        .description("List the org's sending mailboxes with provider, status, warmup state, source (managed = bought through Oxygen, byok = bring-your-own), and a pool overview (including counts by source).")
+        .description("List the org's sending mailboxes with provider, status, warmup state, source (managed = bought through Oxygen, byok = bring-your-own), and a pool overview (including counts by source). To see only Google/Microsoft mailboxes that still need OAuth connection and the right remedy for each, use `oxygen mailboxes oauth-health --json`.")
         .option("--status <status>", "Filter by status: active, paused, or disabled.")
         .option("--tag <tags>", "Comma-separated workspace tags — matches mailboxes carrying ANY of these tags (see `oxygen tags list`).")
         .option("--json", "Print a JSON envelope.")
@@ -13059,7 +13059,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("connect-oauth")
-        .description("Connect Google/Microsoft mailboxes to OXYGEN native send with fresh destination-bound OAuth. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen handles imported, external, or manual mailboxes: it requires an exact address list (max 10 per command; no domain or directory discovery), returns one OXYGEN browser link per candidate, and stores a grant only after that exact mailbox completes provider consent/MFA. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. --vendor zapmail (default) hands a provisioned pool to Zapmail Custom OAuth; --vendor inboxkit requests domain-gated consent with one canary on unproven domains and a 10-write live cap. All paths cost 0 Oxygen credits. Poll --status <id>; connected means an encrypted refresh token actually landed, never merely that a request was accepted.")
+        .description("Connect Google/Microsoft mailboxes to OXYGEN native send with fresh destination-bound OAuth. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen handles imported, external, or manual mailboxes: it requires an exact address list (max 10 per reviewed command; no domain or directory discovery), returns one OXYGEN browser link per candidate, and stores a grant only after that exact mailbox completes provider sign-in/MFA. Microsoft also returns one tenant-admin fallback per resolved Entra tenant: try exact-account links first, and use setup only if Microsoft requests admin approval. Tenant approval covers app permissions but never imports or authorizes the directory. The 10-address boundary limits one human consent run, not the mailbox pool. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. --vendor zapmail (default) hands a provisioned pool to Zapmail Custom OAuth; --vendor inboxkit requests domain-gated consent with one canary on unproven domains and a 10-write live cap. All paths cost 0 Oxygen credits. Poll --status <id>; connected means an encrypted refresh token actually landed, never merely that a request was accepted.")
         .option("--provider <provider>", "Mailbox provider to provision: google or microsoft.")
         .option("--vendor <vendor>", "Authorization path: oxygen for imported/manual mailboxes, zapmail (default), or inboxkit.")
         .option("--mailboxes <list>", "Comma-separated mailbox addresses. Required for vendor=oxygen (max 10); omit for vendor-provisioned whole-pool flows.")
@@ -13112,7 +13112,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("oauth-health")
-        .description("Show every Google/Microsoft inbox with neither a per-mailbox OAuth token nor covered Google delegation. Remedies are connect_oauth for Zapmail, connect_oauth_inboxkit for InboxKit, and connect_oauth_oxygen for imported/manual mailboxes. Zapmail rows include their 3-per-7-day export budget; OXYGEN direct rows require exact browser consent and may invoke provider MFA. Read-only — 0 Oxygen credits.")
+        .description("Show every Google/Microsoft inbox with neither a per-mailbox OAuth token nor covered Google delegation. Remedies are connect_oauth for Zapmail, connect_oauth_inboxkit for InboxKit, and connect_oauth_oxygen for imported/manual mailboxes. Zapmail rows include their 3-per-7-day export budget; OXYGEN direct rows require exact browser authorization and may invoke provider MFA. For Microsoft, the connect-oauth remedy returns a per-tenant admin fallback to use only if exact authorization asks for approval. Read-only — 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("mailboxes oauth-health", options, () => requestOxygen("/api/cli/mailboxes/oauth-health"));

package/node_modules/@oxygen/shared/dist/microsoft-consent-url.js

@@ -1,5 +1,5 @@
 const MICROSOFT_LOGIN_HOST = "login.microsoftonline.com";
-const ADMIN_CONSENT_PATH = /^\/(?:[^/]+\/)?adminconsent\/?$/i;
+const ADMIN_CONSENT_PATH = /^\/(?:[^/]+\/)?(?:v2\.0\/)?adminconsent\/?$/i;
 /**
  * Normalize a Microsoft Entra admin-consent URL for an operator handoff.
  *

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const OXYGEN_VERSION = "1.696.2";
+export declare const OXYGEN_VERSION = "1.700.10";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.696.2";
+export const OXYGEN_VERSION = "1.700.10";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.696.2",
+  "version": "1.700.10",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",