@oxygen-agent/cli 1.717.11 → 1.739.0

package/dist/index.js

@@ -9,7 +9,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, CommanderError, Option } from "commander";
 import { applyOxygenHelp } from "./help.js";
 import { buildCommandManifest, getCommandManifestEntry, searchCommandManifest, suggestCommandNames, } from "./command-manifest.js";
-import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
+import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferUserCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { TAG_COLORS } from "@oxygen/shared/select-options";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, parseXlsxWorkbookBuffer, } from "@oxygen/shared/file-import";
 import { MAILBOX_IMPORT_FILE_MAX_BYTES as SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES, MAILBOX_IMPORT_ROW_LIMIT as SHARED_MAILBOX_IMPORT_ROW_LIMIT, normalizeMailboxImportFile as normalizeSharedMailboxImportFile, normalizeMailboxImportVendor as normalizeSharedMailboxImportVendor, normalizeMailboxWorkbookRows, parseMailboxImportText, summarizeMailboxImportValidation as summarizeSharedMailboxImportValidation, } from "@oxygen/shared/mailbox-import";
@@ -736,6 +736,17 @@ function formatWorkspaceEventsList(data) {
             lines.push(`  trigger: ${source}.${eventName} · ${workspaceEventFilterText(event)}`);
             if (typeof event.description === "string")
                 lines.push(`  ${event.description}`);
+            const readiness = isRecord(event.readiness) ? event.readiness : null;
+            if (readiness?.status === "needs_setup") {
+                const reason = typeof readiness.reason === "string" ? readiness.reason : "Setup is required before this event can fire.";
+                lines.push(`  readiness: setup required — ${reason}`);
+                const action = isRecord(readiness.action) ? readiness.action : null;
+                if (action && typeof action.command === "string")
+                    lines.push(`  next: ${action.command}`);
+            }
+            else if (readiness?.status === "ready") {
+                lines.push("  readiness: ready");
+            }
         }
     }
     if (events.length > WORKSPACE_EVENTS_HUMAN_LIMIT) {
@@ -760,6 +771,15 @@ function formatWorkspaceEventDetail(data) {
         lines.push(`Kind: ${event.kind}`);
     if (typeof event.description === "string")
         lines.push(`When it fires: ${event.description}`);
+    const readiness = isRecord(event.readiness) ? event.readiness : null;
+    if (readiness?.status === "ready")
+        lines.push("Readiness: ready");
+    if (readiness?.status === "needs_setup") {
+        lines.push(`Readiness: setup required${typeof readiness.reason === "string" ? ` — ${readiness.reason}` : ""}`);
+        const action = isRecord(readiness.action) ? readiness.action : null;
+        if (action && typeof action.command === "string")
+            lines.push(`Next: ${action.command}`);
+    }
     if (isRecord(data.trigger)) {
         lines.push("", "Trigger:", ...JSON.stringify(data.trigger, null, 2).split("\n").map((line) => `  ${line}`));
     }
@@ -939,7 +959,7 @@ async function readMailboxImportFile(path) {
         buffer = readFileSync(path);
     }
     catch {
-        throw new OxygenError("mailbox_import_file_unreadable", `Couldn't read --file '${basename(path)}'. Check that the path exists and is readable. CSV/JSON/JSONL/XLSX identity files are accepted; credential exports require --from credentials --vendor <source>. See https://oxygen-agent.com/docs/providers/mailbox-compatibility.`, { exitCode: 1 });
+        throw new OxygenError("mailbox_import_file_unreadable", `Couldn't read --file '${basename(path)}'. Check that the path exists and is readable. CSV/JSON/JSONL/XLSX identity files are accepted; credential exports require --from credentials --vendor <source>. See https://oxygen-agent.com/docs/providers/mailboxes.`, { exitCode: 1 });
     }
     if (buffer.byteLength > SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES) {
         throw new OxygenError("invalid_request", `Mailbox import files must be ${SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES / 1024 / 1024} MB or smaller.`, { exitCode: 1 });
@@ -2487,7 +2507,7 @@ export function createProgram() {
             const query = queryParts.join(" ");
             return {
                 query,
-                route: serializeCapabilityRoute(inferCapabilityRoute(query)),
+                route: serializeCapabilityRoute(inferUserCapabilityRoute(query)),
                 hint: "Hydrate one exact CLI command with `oxygen commands get <exact-command> --json`, or one MCP tool with `oxygen_capabilities_schema`.",
             };
         });
@@ -2635,9 +2655,9 @@ export function createProgram() {
     }));
     program
         .command("support")
-        .description("Open and track Plain support conversations for the active OXYGEN organization.")
+        .description("Open and track Plain support conversations for the active OXYGEN organization. Filing is a zero-credit write to the canonical Plain queue.")
         .addCommand(new Command("file")
-        .description("Create a Plain support Thread. Use when you're stuck on an OXYGEN operation.")
+        .description("Create a real, zero-credit Plain support Thread immediately. There is no preview: review the exact subject, body, category, and severity before running it. Use when you're stuck on an OXYGEN operation.")
         .requiredOption("--subject <subject>", "One-line summary of the problem.")
         .option("--body <body>", "What you were doing, what happened, and what you tried.")
         .option("--severity <severity>", "low | normal | high. Defaults to normal.")
@@ -2695,7 +2715,108 @@ export function createProgram() {
         }));
     }), { hidden: true })
         .addCommand(new Command("admin")
-        .description("Legacy commands; staff triage now uses Plain Inbox or Plain MCP.")
+        .description("Operate the live Plain support queue as OXYGEN staff. Public replies are previewed first and sent as the shared Oxygen Support identity.")
+        .addCommand(new Command("list")
+        .description("List live Plain Threads across customer Tenants (staff only).")
+        .option("--status <status>", "Filter by status.")
+        .option("--limit <n>", "Max tickets to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("support admin list", options, () => requestOxygen(withSupportListQuery("/api/cli/admin/support/tickets", options)));
+    }))
+        .addCommand(new Command("get")
+        .description("Show one live Plain Thread, its routing metadata, and customer-visible messages (staff only).")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleAsyncAction("support admin get", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}`));
+    }))
+        .addCommand(new Command("open")
+        .description("Return the exact Plain Inbox URL for one live Thread (staff only).")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleAsyncAction("support admin open", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}`)
+            .then((data) => supportAdminOpenResult(data)));
+    }))
+        .addCommand(new Command("claim")
+        .description("Claim a live Plain Thread and move it to In progress without overwriting another assignee (staff only).")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .option("--agent", "Claim as the authenticated Oxygen Support machine user instead of the signed-in human.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleAsyncAction("support admin claim", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/update`, {
+            method: "POST",
+            body: { action: "claim", as_machine_user: options.agent === true },
+        }));
+    }))
+        .addCommand(new Command("priority")
+        .description("Set the native Plain priority for a live Thread (staff only).")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .requiredOption("--priority <priority>", "urgent | high | normal | low")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleSupportAdminUpdateRequest("priority", ticketId, options, {
+            priority: readOption(options.priority),
+        });
+    }))
+        .addCommand(new Command("label-add")
+        .description("Add an active Plain label by external ID (staff only).")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .requiredOption("--label <externalId>", "Plain label external ID, for example oxygen_request_bug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleSupportAdminUpdateRequest("label_add", ticketId, options, {
+            label_external_id: readOption(options.label),
+        });
+    }))
+        .addCommand(new Command("label-remove")
+        .description("Remove a Plain label by external ID (staff only).")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .requiredOption("--label <externalId>", "Plain label external ID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleSupportAdminUpdateRequest("label_remove", ticketId, options, {
+            label_external_id: readOption(options.label),
+        });
+    }))
+        .addCommand(new Command("note")
+        .description("Add a team-only internal note to a live Plain Thread (staff only).")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .requiredOption("--body <body>", "Internal note body.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleSupportAdminUpdateRequest("note", ticketId, options, {
+            body: readOption(options.body),
+        });
+    }))
+        .addCommand(new Command("draft")
+        .description("Stage a reply as a team-only Plain note; this never sends to the customer (staff and agents).")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .requiredOption("--body <body>", "Proposed customer reply.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleSupportAdminUpdateRequest("draft", ticketId, options, {
+            body: readOption(options.body),
+        });
+    }))
+        .addCommand(new Command("reply")
+        .description("Preview or send a public reply on the Thread's native Plain channel (human staff only; sent as Oxygen Support).")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .requiredOption("--body <body>", "Customer-visible reply body.")
+        .option("--confirm-ref <ref>", "Send only when this exactly matches the previewed Plain ref (for example T-10). Omit to preview without sending.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleAsyncAction("support admin reply", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/messages`, {
+            method: "POST",
+            body: {
+                body: readOption(options.body),
+                ...(readOption(options.confirmRef)
+                    ? { confirm_ref: readOption(options.confirmRef) }
+                    : {}),
+            },
+        }));
+    }))
         .addCommand(new Command("file")
         .description("Retired legacy write; always returns the Plain-cutover error (staff only).")
         .requiredOption("--organization <organization>", "Target organization id or slug the ticket belongs to.")
@@ -2721,15 +2842,7 @@ export function createProgram() {
                 organization: readOption(options.organization),
             },
         }));
-    }))
-        .addCommand(new Command("list")
-        .description("Read the legacy OXYGEN ticket archive across organizations; Plain is the live queue (staff only).")
-        .option("--status <status>", "Filter by status.")
-        .option("--limit <n>", "Max tickets to return.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (options) => {
-        await handleAsyncAction("support admin list", options, () => requestOxygen(withSupportListQuery("/api/cli/admin/support/tickets", options)));
-    }))
+    }), { hidden: true })
         .addCommand(new Command("events")
         .description("Read-only poll of legacy OXYGEN archive events for cutover compatibility; never use it as the live queue (staff only).")
         .option("--after <cursor>", "If has_more=true, pass next_cursor to continue that scan. If false, persist the non-null watermark_cursor for later polls. A watermark poll intentionally replays the settled 24h window, not only unseen events; dedupe every page by (ticket_ref, version).")
@@ -2752,26 +2865,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
 `)
         .action(async (options) => {
         await handleAsyncAction("support admin events", options, () => requestOxygen(withSupportEventsQuery("/api/cli/admin/support/events", options)));
-    }))
-        .addCommand(new Command("get")
-        .description("Show one legacy archived ticket snapshot; Plain is authoritative for live cases (staff only).")
-        .argument("<ticketId>", "Ticket UUID.")
-        .option("--if-version <version>", "Require the exact decimal version returned by support admin events; stale versions return a conflict without exposing the thread.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (ticketId, options) => {
-        await handleAsyncAction("support admin get", options, () => requestOxygen(withSupportAdminGetQuery(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}`, options)));
-    }))
-        .addCommand(new Command("reply")
-        .description("Retired legacy write; always returns the Plain-cutover error.")
-        .argument("<ticketId>", "Ticket UUID.")
-        .requiredOption("--body <body>", "Reply body.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (ticketId, options) => {
-        await handleAsyncAction("support admin reply", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/messages`, {
-            method: "POST",
-            body: { body: readOption(options.body) },
-        }));
-    }))
+    }), { hidden: true })
         .addCommand(new Command("resolve")
         .description("Retired legacy write; always returns the Plain-cutover error (staff only).")
         .argument("<ticketId>", "Ticket UUID.")
@@ -2782,7 +2876,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: { resolution: readOption(options.resolution) },
         }));
-    }))
+    }), { hidden: true })
         .addCommand(new Command("workflow")
         .description("Retired legacy write; Plain notes and downstream engineering work own triage (staff only).")
         .argument("<ticketId>", "Ticket UUID.")
@@ -2795,7 +2889,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (ticketId, options) => {
         await handleSupportAdminWorkflowAction(ticketId, options);
-    }))
+    }), { hidden: true })
         .addCommand(new Command("update")
         .description("Retired legacy write; Plain owns status, assignee, and notes (staff only).")
         .argument("<ticketId>", "Ticket UUID.")
@@ -2806,10 +2900,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (ticketId, options) => {
         await handleSupportAdminUpdateAction(ticketId, options);
-    })), { hidden: true });
+    }), { hidden: true }));
     program
         .command("feedback")
-        .description("Send feedback or a bug report to the OXYGEN team. Creates the canonical Plain support Thread; transcripts are never attached unless explicitly requested.")
+        .description("Send feedback or a bug report to the OXYGEN team. This is the same immediate, zero-credit canonical Plain Thread write as `support file`; transcripts are never attached unless explicitly requested.")
         .option("-m, --message <message>", "Your feedback or bug report.")
         .option("--severity <severity>", "low | normal | high. Defaults to normal.")
         .option("--category <category>", "Optional category label. Defaults to 'feedback'.")
@@ -9577,7 +9671,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }));
     program
         .command("integrations")
-        .description("Integration connections and raw provider-webhook subscriptions. Trigger-ready workspace events live under `workflows events list`. Local mailbox exports use `mailboxes import`, not this group.")
+        .description("Connect third-party tools such as PostHog, Slack, and HubSpot, and manage raw provider-webhook subscriptions. Start with `integrations list` to confirm any provider is supported, see its auth mode, and distinguish free connection setup from per-action credit estimates. Trigger-ready workspace events live under `workflows events list`. Local mailbox exports use `mailboxes import`, not this group.")
         .addCommand(new Command("events")
         .description("Inspect raw provider event definitions and manage subscriptions that feed workflows; use `workflows events list` for the trigger-ready workspace catalog.")
         .addCommand(new Command("list")
@@ -9680,9 +9774,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("integrations list", options, () => requestOxygen("/api/cli/integrations/composio/list"));
     }))
         .addCommand(new Command("connect")
-        .description("Connect an integration. OAuth toolkits return a redirect URL; API-key integrations accept --api-key. Run without --api-key first to preview the provider's credential requirements (mode: needs_api_key) — e.g. Instantly keys must be created with all scopes enabled. LinkedIn and WhatsApp return a Unipile hosted-auth URL instead (`oxygen senders connect` / `oxygen whatsapp connect` are the canonical paths).")
+        .description("Connect an integration. OAuth toolkits return a redirect URL; API-key integrations accept --api-key. Run without credentials first for a 0-credit preview of the provider's exact fields (mode: needs_api_key): no credential is submitted, nothing is stored, and no provider call is made. Use repeatable --credential name=value when a provider also requires a host, subdomain, or other named value. To keep a secret out of shell history and process arguments, open the preview's web_url and submit it in Connections; --api-key is for controlled noninteractive use. Credential submission creates or replaces the connection immediately and needs no separate --approved flag. LinkedIn and WhatsApp return a Unipile hosted-auth URL instead (`oxygen senders connect` / `oxygen whatsapp connect` are the canonical paths).")
         .argument("<integration_id>", "Integration id, such as 'slack' or 'serpapi'.")
-        .option("--api-key <value>", "API key for Composio API-key toolkits (e.g. SerpAPI, Resend).")
+        .option("--api-key <value>", "API key for controlled noninteractive use. Literal values can appear in shell history and process arguments; prefer the preview web_url for manual entry.")
+        .option("--credential <name=value>", "Named provider credential field. Repeat for multi-field integrations (for example, PostHog: --credential subdomain=us).", collectRepeatable, [])
         .option("--account-id <id>", "Provider account id for integrations that span multiple accounts (e.g. Cloudflare when the token can access more than one account).")
         .option("--country <code>", "ISO 3166-1 alpha-2 country where the LinkedIn account owner normally signs in (required for `connect linkedin`; picks the egress proxy).")
         .option("--pairing-phone-number <e164>", "WhatsApp only: pair by code sent to this E.164 number instead of showing a QR.")
@@ -9690,6 +9785,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .action(async (integrationId, options) => {
         await handleAsyncAction("integrations connect", options, () => {
             const apiKey = readOption(options.apiKey)?.trim();
+            const credentials = readNamedCredentials(options.credential);
             const accountId = readOption(options.accountId);
             const country = readOption(options.country)?.trim();
             const pairingPhoneNumber = readOption(options.pairingPhoneNumber)?.trim();
@@ -9698,6 +9794,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 body: {
                     integration_id: integrationId,
                     ...(apiKey ? { api_key: apiKey } : {}),
+                    ...(credentials ? { credentials } : {}),
                     ...(accountId ? { account_id: accountId } : {}),
                     ...(country ? { country } : {}),
                     ...(pairingPhoneNumber ? { pairing_phone_number: pairingPhoneNumber } : {}),
@@ -12761,7 +12858,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("managed-inboxes")
-        .description("Managed sending inboxes bought through OXYGEN: subscribe a domain + N InboxKit mailboxes (google/microsoft/azure) as a recurring monthly Oxygen-credit purchase, add inboxes to a domain you already own, inspect/verify, and cancel. OXYGEN Warm-up defaults on when available: its quoted recurring credits and exact future addresses are part of the order approval, and the worker activates it after provisioning without a second warmup approval. Subscribe/add-inboxes/cancel are approval-gated (preview → re-run with --approved --quote). The inbox vendor is chosen for you; --vendor pins one.")
+        .description("Managed sending inboxes bought through OXYGEN: subscribe a domain + N InboxKit mailboxes (google/microsoft/azure) as a recurring monthly Oxygen-credit purchase, add inboxes to a domain you already own, inspect/verify, and cancel. OXYGEN Warm-up defaults on when available: its quoted recurring credits and exact future addresses are part of the order approval, and the worker activates it after provisioning without a second warmup approval. Warm-up does not prove native-send authorization: verify each exact address with `mailboxes oauth-health --json`. Subscribe/add-inboxes/cancel are approval-gated (preview → re-run with --approved --quote). The inbox vendor is chosen for you; --vendor pins one.")
         .addCommand(new Command("verify")
         .description("Check that OXYGEN, STRIPE, and the VENDOR agree about what this org is buying. The truth about a managed inbox lives in three systems — what the customer asked for, what they are charged, and what is actually running — and a 200 from any one of them proves nothing. Reports every disagreement with WHO IS LOSING MONEY while it stands (customer_overbilled first, then oxygen_pays). Read-only, no writes, 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
@@ -12775,7 +12872,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("managed-inboxes registrant", options, () => requestOxygen("/api/cli/managed-inboxes/registrant"));
     }))
         .addCommand(new Command("subscribe")
-        .description("Subscribe a NEW domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. OXYGEN Warm-up defaults on for Google, Microsoft, and Azure when available: preview and approved responses carry `warmup_activation` with the exact `mailboxes` and `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, that object also carries `transport=inboxkit_sequencer_export`, `mailbox_credentials_required=false`, and `native_send_oauth_separate=true`. Managed warm-up needs no Google/Microsoft OAuth or mailbox password. Native sending authorization is separate and may still be required before OXYGEN can send. This order authorizes automatic OXYGEN Warm-up activation after provisioning, so no second `mailboxes warmup enable` approval is needed. Prices come from the vendor's LIVE rate card and LIVE domain price, and are refused if they sit below vendor cost. To add mailboxes to a domain you ALREADY own use `managed-inboxes add-inboxes` — this command always registers a new domain and fails on one you own.")
+        .description("Subscribe a NEW domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. OXYGEN Warm-up defaults on for Google, Microsoft, and Azure when available: preview and approved responses carry `warmup_activation` with the exact `mailboxes` and `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, Google carries `transport=inboxkit_managed_google_handoff`; Microsoft/Azure carries `transport=inboxkit_sequencer_export`. Both carry `mailbox_credentials_required=false` and `native_send_oauth_separate=true`, so managed warm-up needs no customer-supplied OAuth or mailbox password. Google retrieves the existing managed credential only during activation and never persists or returns it; Microsoft/Azure uses native export. Native sending authorization is separate and may still be required before OXYGEN can send. Verify each exact address with `mailboxes oauth-health --json`; InboxKit's unattended Google domain approval usually lands within minutes and the worker keeps retrying, so a waiting row is not a reason to ask the customer to sign in. This order authorizes automatic OXYGEN Warm-up activation after provisioning, so no second `mailboxes warmup enable` approval is needed. Prices come from the vendor's LIVE rate card and LIVE domain price, and are refused if they sit below vendor cost. To add mailboxes to a domain you ALREADY own use `managed-inboxes add-inboxes` — this command always registers a new domain and fails on one you own.")
         .argument("[domain]", "Sending domain to register + host the mailboxes (e.g. send.acme.com). May also be passed as --domain.")
         .option("--domain <domain>", "Sending domain (alternative to the positional argument).")
         .requiredOption("--provider <provider>", "Mailbox PLATFORM: google, microsoft, or azure. (google/microsoft cap at 5 mailboxes per domain; azure allows 100.)")
@@ -12842,7 +12939,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("add-inboxes")
-        .description("Add mailboxes to a managed domain you ALREADY own — no new domain is registered and there is NO domain registration charge, only the extra inboxes' monthly rate (plus their add-ons). WITHOUT --approved this prints a priced PREVIEW with a quote_id and orders nothing; re-run with --approved --quote <id> to place the order. When the standing OXYGEN Warm-up add-on is enabled and available, preview and approved responses carry `warmup_activation` for only the exact newly added `mailboxes`, with `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, that object also carries `transport=inboxkit_sequencer_export`, `mailbox_credentials_required=false`, and `native_send_oauth_separate=true`. Managed warm-up needs no Google/Microsoft OAuth or mailbox password. Native sending authorization is separate and may still be required before OXYGEN can send. The quote authorizes automatic OXYGEN Warm-up activation after provisioning, so do not run a second warmup approval. Capped per domain by the platform the domain was bought on (5 google/microsoft, 100 azure) COUNTING the inboxes already on it. To register a NEW domain use `managed-inboxes subscribe` instead.")
+        .description("Add mailboxes to a managed domain you ALREADY own — no new domain is registered and there is NO domain registration charge, only the extra inboxes' monthly rate (plus their add-ons). WITHOUT --approved this prints a priced PREVIEW with a quote_id and orders nothing; re-run with --approved --quote <id> to place the order. When the standing OXYGEN Warm-up add-on is enabled and available, preview and approved responses carry `warmup_activation` for only the exact newly added `mailboxes`, with `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, Google carries `transport=inboxkit_managed_google_handoff`; Microsoft/Azure carries `transport=inboxkit_sequencer_export`. Both carry `mailbox_credentials_required=false` and `native_send_oauth_separate=true`, so managed warm-up needs no customer-supplied OAuth or mailbox password. Google retrieves the existing managed credential only during activation and never persists or returns it; Microsoft/Azure uses native export. Native sending authorization is separate and may still be required before OXYGEN can send. Verify each exact address with `mailboxes oauth-health --json`; InboxKit's unattended Google domain approval usually lands within minutes and the worker keeps retrying, so a waiting row is not a reason to ask the customer to sign in. The quote authorizes automatic OXYGEN Warm-up activation after provisioning, so do not run a second warmup approval. Capped per domain by the platform the domain was bought on (5 google/microsoft, 100 azure) COUNTING the inboxes already on it. To register a NEW domain use `managed-inboxes subscribe` instead.")
         .argument("[domain]", "A managed domain this workspace already owns (e.g. send.acme.com). May also be passed as --domain.")
         .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
         .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\",\"profile_picture_url\"}]. The vendor stamps the names on each mailbox, so real names belong here. profile_picture_url is optional and must be a PUBLIC, PERMANENT https URL the vendor can fetch at provisioning; `oxygen managed-inboxes upload-avatar <path>` returns one.")
@@ -13005,7 +13102,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("mailboxes")
-        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local credential-file transfer), pause/disable inboxes, connect EmailGuard monitoring, and inspect/control OXYGEN Warm-up. Fresh managed InboxKit Google/Microsoft/Azure orders activate exact native warm-up exports automatically after provisioning under their approved default-on add-on. Standalone warm-up plans and credit caps are for BYOK/imported mailboxes, managed opt-outs, or later separate enrollment. OXYGEN Warm-up never owns campaign dispatch. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
+        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local credential-file transfer), pause/disable inboxes, connect EmailGuard monitoring, and inspect/control OXYGEN Warm-up. Fresh managed InboxKit Google/Microsoft/Azure orders activate exact-scope warm-up automatically after provisioning under their approved default-on add-on. Google reuses the managed credential just in time; Microsoft/Azure uses native export. Standalone warm-up plans and credit caps are for BYOK/imported mailboxes, managed opt-outs, or later separate enrollment. OXYGEN Warm-up never owns campaign dispatch. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
         .addCommand(new Command("list")
         .description("List the org's sending mailboxes with provider, status, warmup state, source (managed = bought through Oxygen, byok = bring-your-own), and a pool overview (including counts by source). To see only Google/Microsoft mailboxes that still need OAuth connection and the right remedy for each, use `oxygen mailboxes oauth-health --json`.")
         .option("--status <status>", "Filter by status: active, paused, or disabled.")
@@ -13032,7 +13129,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("mailboxes get", options, () => requestOxygen(`/api/cli/mailboxes/${encodeURIComponent(mailbox)}`));
     }))
         .addCommand(new Command("delete")
-        .description("Preview or approve removal of exact mailboxes from Oxygen at 0 credits. Deletion immediately removes them from sending but never deletes the underlying Google Workspace or Microsoft 365 accounts. It preserves conversation/message/delivery history and stops the 1,000-credit mailbox commitment for future renewals; the current period is not refunded. Listed active/paused sequences keep their status but lose these senders and are not automatically paused. Managed mailboxes and live warmup/monitoring add-ons fail closed with their exact address-scoped teardown steps.")
+        .description("Preview or approve removal of exact mailboxes from Oxygen at 0 credits. Deletion immediately removes them from sending but never deletes the underlying Google Workspace or Microsoft 365 accounts. It preserves conversation/message/delivery history and stops any separately listed 1,000-credit connected-mailbox commitment for future renewals; that line is currently built but not charged, and it is not the 3,000-credit OXYGEN Warm-up subscription. The current period is not refunded. Listed active/paused sequences keep their status but lose these senders and are not automatically paused. Managed mailboxes and live warmup/monitoring add-ons fail closed with their exact address-scoped teardown steps.")
         .requiredOption("--mailboxes <list>", "Comma-separated mailbox ids or addresses (maximum 500).")
         .option("--approved", "Execute the fresh preview. Requires --plan-hash and --confirmation.")
         .option("--plan-hash <hash>", "Fresh preview plan_hash.")
@@ -13089,7 +13186,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("import")
-        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer: fresh managed InboxKit Google/Microsoft/Azure orders use automatic native InboxKit Sequencer export when their approved order includes warmup; opted-out/separate managed enrollment uses standalone `warmup enable`; eligible non-InboxKit Microsoft warmup uses the Outlook OAuth fallback (`mailboxes warmup microsoft`); EmailGuard remains vendor_blocked for Microsoft. Google app passwords are sent only in the request body, encrypted server-side, and never returned.")
+        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer from customer files: fresh managed InboxKit Google orders reuse the vendor-held credential just in time for automatic warmup, while fresh managed Microsoft/Azure orders use native InboxKit Sequencer export; opted-out/separate managed enrollment uses standalone `warmup enable`; eligible non-InboxKit Microsoft warmup uses the Outlook OAuth fallback (`mailboxes warmup microsoft`); EmailGuard remains vendor_blocked for Microsoft. Google app passwords supplied through an authorized credential import are sent only in the request body, encrypted server-side, and never returned.")
         .addHelpText("after", [
         "",
         "Ordinary identity file contract (CSV / JSON / JSONL / XLSX):",
@@ -13102,7 +13199,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         '  JSON: {"mailboxes":[{"email_address":"ada@send-acme.com","provider":"google","app_password":"<Google mailbox app password>"}]}',
         "  Only Google app passwords enter the encrypted seven-day transfer vault. Microsoft rows remain identity-only. Generic SMTP passwords and OAuth/MFA/delegation secrets are rejected.",
         "  Validation: add --validate-only to parse the complete real file and return safe aggregate counts plus the provider-specific exact-account OAuth review plan without authentication, a network request, or a workspace write. The plan groups only supplied addresses into reviews of at most 10; it never discovers a domain, and the later online preview may skip existing grants. Any parse, shape, provider, platform, tenant, secret-policy, or duplicate-conflict error rejects the entire file before the first mailbox write and names mailboxes[index]; validation-only never writes. A later import infrastructure failure may interrupt the upsert; re-run the same file because import is idempotent by address.",
-        "  Docs: https://oxygen-agent.com/docs/providers/mailbox-compatibility",
+        "  Docs: https://oxygen-agent.com/docs/providers/mailboxes",
         "  Skill: oxygen-email-infra (`oxygen skills install --skill oxygen-email-infra`).",
         "",
     ].join("\n"))
@@ -13300,8 +13397,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("connect-oauth")
-        .description("Connect Google/Microsoft mailboxes to OXYGEN native send. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options. All paths cost 0 Oxygen credits.")
-        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
+        .description("Connect Google/Microsoft mailboxes to OXYGEN native send. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). For Microsoft's built-in roles, tenant mode requires a Global Administrator or Privileged Role Administrator because it requests the Microsoft Graph application Mail.Send and Mail.Read permissions; Application Administrator and Cloud Application Administrator cannot consent to Microsoft Graph application roles. Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. For non-managed Microsoft mailboxes, native-send approval does not authorize OXYGEN Warm-up: every mailbox still needs its own `mailboxes warmup microsoft` Outlook consent before standalone enrollment. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options. All paths cost 0 Oxygen credits.")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--provider <provider>", "Mailbox provider to provision: google or microsoft.")
         .option("--vendor <vendor>", "Authorization path: oxygen for imported/manual mailboxes, zapmail (default), or inboxkit.")
         .option("--mailboxes <list>", "Comma-separated exact mailbox addresses. Required for vendor=oxygen (tenant mode max 500; individual mode max 10).")
@@ -13440,11 +13537,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("warmup")
-        .description("OXYGEN Warm-up for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. It is managed and credit-billed at 3,000 credits per warming inbox per month ($3). Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warm-up add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warm-up blocks the handoff so one mailbox cannot warm twice. OXYGEN Warm-up never owns campaign dispatch: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down there with `warmup disable`; they are never silently moved to the current managed rail.")
-        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
+        .description("OXYGEN Warm-up for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. It is managed and credit-billed at 3,000 credits per warming inbox per month ($3). Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warm-up add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Google reuses the InboxKit-held credential only during activation and never stores or returns it; Microsoft/Azure uses exact native export. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off for Microsoft/Azure because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warm-up blocks either handoff so one mailbox cannot warm twice. OXYGEN Warm-up never owns campaign dispatch: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down there with `warmup disable`; they are never silently moved to the current managed rail.")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .addCommand(new Command("enable")
-        .description("STANDALONE ENROLLMENT: enroll BYOK/imported mailboxes, a managed order that opted out, or mailboxes being added to warmup later. Fresh managed InboxKit Google/Microsoft/Azure orders whose approved quote included warmup activate automatically after provisioning and do not need this command. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is exported, enrolled, or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Eligible managed InboxKit targets still use InboxKit's native Sequencer export with exact UIDs; auto-export remains off, and any non-cancelled InboxKit warmup must be cancelled before export (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. OXYGEN Warm-up retains no campaign authority — OXYGEN Sequences own enrollment and dispatch. New enrollments only ever land on the managed OXYGEN rail; the retired TrulyInbox rail is refused here and only accepts teardown.")
-        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
+        .description("STANDALONE ENROLLMENT: enroll BYOK/imported mailboxes, a managed order that opted out, or mailboxes being added to warmup later. Fresh managed InboxKit Google/Microsoft/Azure orders whose approved quote included warmup activate automatically after provisioning and do not need this command. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is handed off, enrolled, or billed. The current public price is 3,000 credits per warming mailbox-month; the preview returns the exact first-cycle ceiling. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Eligible managed Google targets use the InboxKit-held credential just in time without storing or returning it; Microsoft/Azure targets use native InboxKit Sequencer export with exact UIDs and auto-export off. Any non-cancelled InboxKit warmup must be cancelled before either handoff (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. OXYGEN Warm-up retains no campaign authority — OXYGEN Sequences own enrollment and dispatch. New enrollments only ever land on the managed OXYGEN rail; the retired TrulyInbox rail is refused here and only accepts teardown.")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to warm. Omit to warm the whole pool.")
         .option("--approved", "Execute the PRICED enrollment. Without it the response is a priced preview and nothing is enrolled or billed.")
         .option("--plan <hash>", "Hash from the fresh preview (required with --approved).")
@@ -13489,7 +13586,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }))
         .addCommand(new Command("microsoft")
         .description("NON-INBOXKIT FALLBACK ONLY: authorize eligible Microsoft/Outlook mailboxes for OXYGEN Warm-up with ONE browser consent PER MAILBOX, never a password or app password. Do not run this for managed InboxKit mailboxes: fresh Microsoft/Azure orders activate native InboxKit warm-up exports automatically when the approved order includes warmup; opted-out or later separate managed enrollment uses standalone `warmup enable`. For the non-InboxKit fallback there is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact fallback mailboxes and outstanding links at 0 credits. Approve that fresh hash with --max-credits 0, open every returned consent_url, then re-run with --status. Warmup itself stays OFF until standalone `warmup enable`.")
-        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--mailboxes <list>", "Comma-separated eligible non-InboxKit Microsoft mailbox ids or addresses. Omit to select the pool; the command refuses a scope containing managed InboxKit rows and points to warmup enable.")
         .option("--tenant <id>", "Deprecated and ignored: OXYGEN Warm-up consent is per mailbox, so there is no tenant-wide scope to bind. Still accepted so older scripts keep running.")
         .option("--approved", "Mint the per-mailbox consent links for the exact previewed mailbox scope. Still 0 credits — a human then has to open each link.")
@@ -13831,7 +13928,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     })))
         .addCommand(new Command("sync")
-        .description("Refresh the domain cache from Cloudflare: zone pages, registrar metadata, RDAP age backfill, and DNS health. Partial (paginated) syncs auto-continue until complete.")
+        .description("Refresh Cloudflare-backed domains only: zone pages, registrar metadata, RDAP age backfill, and DNS health. Vendor-managed bundle domains are skipped here and read live with `domains get` / `domains dns`. Partial (paginated) syncs auto-continue until complete.")
         .option("--full", "Restart the sweep from the first zone page instead of resuming the cursor.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -14125,6 +14222,13 @@ Authoring guide:
   Install or refresh the focused product skill:
   oxygen skills install --skill oxygen-workflow-authoring
 
+Web creation chooser:
+  Open /workspaces/<workspace-id>/workflows and click Create workflow.
+  Choose Blank workflow, Workflow template (one workflow), Blueprint
+  (a multi-resource motion), or Import definition. The chooser opens on the
+  collection page; it has no separate public URL.
+  Guide: https://oxygen-agent.com/docs/execution/workflows
+
 Fastest editable graph:
   1. oxygen workflows events list --search "<outcome>" --kind builtin --json
   2. oxygen workflows init --id my-workflow
@@ -14244,7 +14348,7 @@ Run completion:
         });
     }))
         .addCommand(new Command("apply")
-        .description("Compile and publish a workflow definition. Apply costs 0 credits, calls no graph nodes, creates no run, and preserves disabled status; call or enable separately to execute.")
+        .description("Compile and save a workflow definition; --draft appends an editable revision without publishing it. Apply costs 0 credits, calls no graph nodes, creates no run, and preserves disabled status; call or enable separately to execute.")
         .requiredOption("--file <path>", "Workflow module or manifest JSON file.")
         .option("--approved", "Authorize autonomous tool calls for this revision.")
         .option("--max-credits <n>", "Optional explicit positive ceiling for each autonomous delivery; omit to use the plan-tier default.")
@@ -14387,19 +14491,20 @@ Run completion:
         }), options));
     }))
         .addCommand(new Command("call")
-        .description("Enqueue a workflow run asynchronously through its API trigger. Follow the returned run_id with `oxygen workflows tail <run_id>`.")
+        .description("Enqueue a workflow run asynchronously and directly without simulating its trigger. Follow the returned run_id with `oxygen workflows tail <run_id>`.")
         .argument("[workflow]", "Workflow id, slug, or name.")
         .option("--workflow <workflow>", "Workflow id, slug, or name.")
         .option("--workflow-id <workflow_id>", "Workflow id or slug.")
         .option("--workflow-name <workflow_name>", "Workflow name.")
         .option("--input-json <json>", "Workflow input object. Defaults to {}.")
-        .requiredOption("--mode <mode>", "Execution mode: live, dry-run (dry_run), or smoke-test (smoke_test).")
+        .requiredOption("--mode <mode>", "Execution mode. smoke-test/dry-run: 0 credits, no paid provider calls or external writes; internal reads still execute. live: may spend/write and requires approval + cap.")
         .option("--idempotency-key <key>", "Optional idempotency key.")
         .option("--max-credits <n>", "Required credit ceiling for live calls.")
         .option("--approved", "Required for live calls after inspecting a dry run.")
         .option("--revision <n>", "Run a specific saved version instead of the live one. Dry-run and smoke-test only: publish a version to run it live.")
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", "\nSafety: smoke_test and dry_run share one boundary: 0 credits, no paid provider calls, no external writes. Oxygen internal reads use current workspace data, and oxygen.http_json_request may make a real outbound GET. Every mode creates an inspectable Workflow run record.\n")
         .action(async (workflowArg, options) => {
         const maxCredits = readPositiveNumber(options.maxCredits);
         const revisionVersion = readPositiveNumber(options.revision);
@@ -14420,11 +14525,35 @@ Run completion:
     }))
         .addCommand(new Command("webhooks")
         .description("Workflow webhook trigger utilities.")
+        .addCommand(new Command("rotate")
+        .description("Replace a workflow webhook's shared secret. Previews by default; the old sender secret stops working immediately after approval.")
+        .argument("<workflow>", "Webhook workflow id, slug, or name.")
+        .option("--approved", "Confirm replacement after reviewing the preview. The new secret is shown once.")
+        .option("--json", "Print a JSON envelope.")
+        .action((workflow, options) => handleAsyncAction("workflows webhooks rotate", options, () => requestOxygen("/api/cli/workflows/webhooks/rotate", {
+        method: "POST",
+        body: {
+            workflow,
+            ...(options.approved ? { approved: true } : {}),
+        },
+    }))))
+        .addCommand(new Command("replay")
+        .description("Create a new dry run from one authenticated delivery's exact original revision and payload. Never resends the webhook; uses 0 credits, no paid provider calls, and no external writes. Internal reads and outbound HTTP GETs can still execute.")
+        .argument("<delivery_id>", "Delivery UUID from `oxygen workflows webhooks deliveries`.")
+        .option("--request-key <key>", "Stable key for safely retrying the same replay request.")
+        .option("--json", "Print a JSON envelope.")
+        .action((deliveryId, options) => handleAsyncAction("workflows webhooks replay", options, () => requestOxygen("/api/cli/workflows/webhooks/deliveries/replay", {
+        method: "POST",
+        body: {
+            delivery_id: deliveryId,
+            request_key: readOption(options.requestKey) ?? randomUUID(),
+        },
+    }))))
         .addCommand(new Command("deliveries")
         .description("List workflow webhook deliveries: what arrived, whether it verified, and the run it started.")
         .argument("[trigger_id]", "Optional webhook trigger name, such as lead-created.")
         .option("--workflow-id <id>", "Filter to deliveries that started a run of this workflow.")
-        .option("--outcome <outcome>", "Filter by rejected (bad signature), blocked (verified, no run), or ran.")
+        .option("--outcome <outcome>", "Filter by rejected (sender authentication failed), blocked (authenticated, no run), or ran.")
         .option("--limit <n>", "Maximum deliveries to return. Defaults to 50.")
         .option("--json", "Print a JSON envelope.")
         .action((triggerId, options) => handleAsyncAction("workflows webhooks deliveries", options, () => requestOxygen(workflowWebhookDeliveriesPath({
@@ -14478,7 +14607,7 @@ Run completion:
         .addCommand(new Command("events")
         .description("Workflow event trigger utilities.")
         .addCommand(new Command("list")
-        .description("Search and filter every app-native and connected event this workspace can use as a workflow trigger.")
+        .description("Search and filter every registered app-native and connected event this workspace can use as a workflow trigger, including setup-required events.")
         .option("--search <text>", "Match labels, catalog ids, descriptions, endpoints, filters, or payload fields.")
         .option("--source <source>", "Match one event source exactly, such as sequencer or crm.")
         .option("--kind <kind>", "Match builtin, integration, or existing events.")
@@ -14499,6 +14628,11 @@ Kinds:
   existing     Raw source/event retained from an existing workflow trigger;
                no preset filter is required.
 
+Readiness:
+  Events that need setup remain selectable and draft-saveable. Their readiness
+  reason and exact setup action are returned here; publish/enable stays blocked
+  until the prerequisite is ready.
+
 Example trigger:
   {"type":"event","source":"crm","event":"activity_created",
    "filters":[{"path":"activity_type","op":"eq","value":"meeting_booked"}]}
@@ -14622,8 +14756,8 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
         });
     }))
         .addCommand(new Command("run")
-        .description("Get one workflow run, including waiting and awaiting_approval pause state.")
-        .argument("<run_id>", "Workflow run UUID.")
+        .description("Read one workflow run, including waiting and awaiting_approval pause state. This command changes nothing.")
+        .argument("<run_id>", "Workflow run UUID returned as data.run.id by workflows call/tail; not the separate provenance run id.")
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
         .action(async (runId, options) => {
@@ -15532,7 +15666,7 @@ function waitForWorkflowRun(runId, options) {
                         parked: true,
                         ...(resumeAt ? { resumes_at: resumeAt } : {}),
                         message: resumeAt
-                            ? `Run is parked until ${resumeAt} (a provider quota or a retry backoff). It resumes automatically — no action needed.`
+                            ? `Run is parked until ${resumeAt} and resumes automatically — no action needed.`
                             : "Run is parked and resumes automatically — no action needed.",
                     }
                     : {}),
@@ -21001,6 +21135,30 @@ function ansi(enabled) {
 function collectRepeatable(value, previous) {
     return [...previous, value];
 }
+function readNamedCredentials(entries) {
+    if (!entries || entries.length === 0)
+        return undefined;
+    const credentials = {};
+    for (const entry of entries) {
+        const separator = entry.indexOf("=");
+        if (separator <= 0) {
+            throw new Error("--credential must use name=value (for example, --credential subdomain=us).");
+        }
+        const name = entry.slice(0, separator).trim();
+        const value = entry.slice(separator + 1).trim();
+        if (!/^[A-Za-z][A-Za-z0-9_.-]{0,99}$/.test(name)) {
+            throw new Error("--credential has an invalid field name.");
+        }
+        if (!value) {
+            throw new Error(`--credential ${name}= requires a non-empty value.`);
+        }
+        if (Object.hasOwn(credentials, name)) {
+            throw new Error(`--credential field '${name}' was provided more than once.`);
+        }
+        credentials[name] = value;
+    }
+    return credentials;
+}
 // Shared query string for `posts comments` / `posts reactions` (post social_id +
 // optional comment scope, pagination, sort, and account selection).
 function buildPostEngagementQuery(options) {
@@ -21127,13 +21285,6 @@ function withSupportEventsQuery(path, options) {
     const query = params.toString();
     return query ? `${path}?${query}` : path;
 }
-function withSupportAdminGetQuery(path, options) {
-    const ifVersion = readOption(options.ifVersion);
-    if (!ifVersion)
-        return path;
-    const params = new URLSearchParams({ if_version: ifVersion });
-    return `${path}?${params.toString()}`;
-}
 // Workflow text flags (--verify-notes/--plan/--draft) bypass readOption: an
 // explicitly-passed empty string clears the field server-side, while an absent
 // flag leaves it untouched, so "" must survive to the request body.
@@ -21182,6 +21333,26 @@ function buildSupportAdminUpdateBody(options) {
     }
     return body;
 }
+function supportAdminOpenResult(data) {
+    if (!isRecord(data) || !isRecord(data.ticket)) {
+        throw new OxygenError("invalid_response", "The support admin response did not include a Plain Thread.", { exitCode: 1 });
+    }
+    const plainUrl = data.ticket.plain_url;
+    if (typeof plainUrl !== "string" || !plainUrl.startsWith("https://app.plain.com/")) {
+        throw new OxygenError("invalid_response", "The support admin response did not include a valid Plain Inbox URL.", { exitCode: 1 });
+    }
+    return {
+        thread_id: data.ticket.id ?? null,
+        thread_ref: data.ticket.ref ?? null,
+        plain_url: plainUrl,
+    };
+}
+async function handleSupportAdminUpdateRequest(action, ticketId, options, fields) {
+    await handleAsyncAction(`support admin ${action}`, options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/update`, {
+        method: "POST",
+        body: { action, ...fields },
+    }));
+}
 async function handleSupportAdminWorkflowAction(ticketId, options) {
     try {
         const body = buildSupportAdminWorkflowBody(options);