@oxygen-agent/cli 1.739.1 → 1.766.0

package/dist/index.js

@@ -416,6 +416,7 @@ async function handleAsyncAction(command, options, action) {
         const data = await action();
         emitSuccess(command, data, options);
         writeDryRunNotice(data);
+        writeAvatarWarning(data);
         writeCreditsReceipt(data);
     }
     catch (error) {
@@ -449,6 +450,19 @@ function writeDryRunNotice(data) {
     if (typeof block.next_step === "string")
         process.stderr.write(`${block.next_step}\n`);
 }
+// A sender-profile write that could not durably host the photo still succeeds —
+// the profile is saved, just with a picture no inbox vendor will ever be able to
+// fetch. That is the one failure mode nobody notices until the mailboxes ship
+// faceless and the vendor refuses to change them, so the server's
+// `avatar_warning` gets its own stderr line instead of living only inside the
+// stdout envelope a human never reads.
+function writeAvatarWarning(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const warning = data.avatar_warning;
+    if (typeof warning === "string" && warning.trim())
+        process.stderr.write(`${warning}\n`);
+}
 // Paid envelopes (push 3 legibility) carry a `credits` block: quote on
 // dry_run, receipt on live, remaining balance on both. Mirror it as one
 // stderr line so spend stays visible in a terminal without polluting the
@@ -801,6 +815,23 @@ function writeMaxCreditsHint(error) {
     if (!(error instanceof OxygenError))
         return;
     switch (error.code) {
+        // The plan wall. Unlike every other case in this switch, no flag on the
+        // command can unblock it — so the hint names the capability in the
+        // customer's own words, says what still works without upgrading, and gives
+        // the URL. A raw `upgrade_required` code with a JSON blob is the worst
+        // possible version of the single most important refusal in the product.
+        case "upgrade_required": {
+            const label = readDetailsString(error.details, "capability_label")
+                ?? "This capability";
+            const upgradeUrl = readDetailsString(error.details, "upgrade_url");
+            const nextStep = readDetailsString(error.details, "next_step");
+            process.stderr.write(`hint: ${label} needs a paid plan.\n`);
+            if (nextStep)
+                process.stderr.write(`hint: ${nextStep}\n`);
+            if (upgradeUrl)
+                process.stderr.write(`hint: upgrade at ${upgradeUrl}\n`);
+            return;
+        }
         case "effect_unknown_approval_required": {
             process.stderr.write("hint: verify every affected external destination in error.details, then re-run with --approved-effect-unknown only if another execution is safe\n");
             return;
@@ -1687,6 +1718,55 @@ function buildPublishingPostsDraftBody(options) {
         body.source_url = sourceUrl;
     return body;
 }
+// `linkedin intent autoenroll` request body. The route reads `captures` (the wire
+// name of the capture kinds) plus `post_id`/`post`, so the CSV `--kinds` flag maps
+// onto `captures` here rather than inventing a second server field.
+//
+// An omitted `--kinds` sends NO captures key at all: the server then defaults to the
+// captures `linkedin intent setup` already provisioned for this sender, and a
+// client-side default list would instead CREATE captures the user never agreed to.
+// Same reasoning for the caps — omitted means "inherit the plan-tier ceiling and the
+// sender's ramped daily cap", which only the server can resolve.
+function buildLinkedinIntentAutoenrollBody(options) {
+    const account = readOption(options.account);
+    if (!account)
+        throw new Error("--account is required.");
+    if (options.disable && options.approved) {
+        throw new OxygenError("conflicting_flags", "Pass either --disable (revoke the standing grant) or --approved (arm it), not both.", { exitCode: 1 });
+    }
+    // Revoking only ever narrows authority, so it carries the scope and nothing else —
+    // forwarding caps or a sequence on a disable would imply they still bind something.
+    const kinds = readCsvOption(options.kinds);
+    const post = readOption(options.post);
+    if (options.disable) {
+        return {
+            account,
+            disable: true,
+            ...(kinds.length > 0 ? { captures: kinds } : {}),
+            ...(post ? { post } : {}),
+        };
+    }
+    const sequence = readOption(options.sequence);
+    const postUrl = readOption(options.postUrl);
+    // Both readers THROW on a typed-but-unusable cap (0, negative, non-numeric) rather
+    // than returning undefined, which matters here: undefined means "inherit the server
+    // default", so coercing a typed `--max-enrolls-per-day 0` to absent would answer a
+    // request to enrol NOBODY by granting the sender's full ramped daily cap. Narrowing
+    // must never widen. Pinned by the cap tests in index.test.ts.
+    const maxCreditsPerCycle = readPositiveNumber(options.maxCreditsPerCycle);
+    const maxEnrollsPerDay = readPositiveInt(options.maxEnrollsPerDay);
+    return {
+        account,
+        ...(sequence ? { sequence } : {}),
+        ...(kinds.length > 0 ? { captures: kinds } : {}),
+        ...(maxCreditsPerCycle !== undefined ? { max_credits_per_cycle: maxCreditsPerCycle } : {}),
+        ...(maxEnrollsPerDay !== undefined ? { max_enrolls_per_day: maxEnrollsPerDay } : {}),
+        ...(options.includeExistingNetwork ? { include_existing_network: true } : {}),
+        ...(post ? { post } : {}),
+        ...(postUrl ? { post_url: postUrl } : {}),
+        ...(options.approved ? { approved: true } : {}),
+    };
+}
 function buildSequenceDraftBody(options) {
     const goal = readOption(options.goal);
     if (!goal)
@@ -2230,6 +2310,87 @@ function requireDomainArg(positional, option) {
     }
     return domain;
 }
+/**
+ * Build the `mailboxes[]` an order route receives, from whichever input form the
+ * caller used, plus the optional `--sender` stamp.
+ *
+ * Shared by `managed-inboxes subscribe` and `add-inboxes` because the two used to
+ * drift: only one of them accepted the `--count/--prefix` shorthand, and each
+ * assembled its own body, so a fix to one silently missed the other. `forms`
+ * parameterises which spellings the calling command accepts instead.
+ *
+ * The `--sender` stamp is the reason this is one function. The inbox vendor has no
+ * post-provisioning update, so whatever first/last name reaches it is permanent —
+ * which is why a sender-backed item must not also carry a typed name. The server
+ * ignores those keys when `sender_profile_id` is present, but a request body that
+ * still lists `first_name: "Ada"` reads like Ada is what ships. Strip them here so
+ * the body says exactly what the vendor will stamp.
+ */
+function buildManagedInboxMailboxes(options, forms) {
+    const senderProfileId = readOption(options.sender);
+    const mailboxesJson = readOption(options.mailboxes);
+    const filePath = readOption(options.file);
+    const locals = splitCommaList(options.locals);
+    const prefix = readOption(options.prefix);
+    const count = readPositiveInt(options.count);
+    let mailboxes;
+    if (mailboxesJson) {
+        mailboxes = JSON.parse(mailboxesJson);
+    }
+    else if (filePath) {
+        const parsed = readJsonFileValue(resolve(filePath), "--file");
+        mailboxes = parsed.mailboxes ?? [];
+    }
+    else if (locals.length > 0) {
+        if (!senderProfileId) {
+            // Without a sender there is no identity to attach to a bare local part, and
+            // the vendor stamps a name on every mailbox permanently. Refusing is the
+            // only honest answer: inventing "Talia Rosen" from `talia.rosen` would bake
+            // a guess into a mailbox nobody can rename later.
+            throw new OxygenError("invalid_request", "--locals needs --sender <sender profile id>: the local parts carry no name, and the inbox vendor stamps a permanent one. Pass --mailboxes/--file with real first_name/last_name instead, or `oxygen senders profiles list` to pick a sender.", { exitCode: 2 });
+        }
+        mailboxes = locals.map((username) => ({ username }));
+    }
+    else if (forms.countPrefix && (count !== undefined || prefix)) {
+        if (count === undefined || !prefix) {
+            throw new Error("--count and --prefix must be passed together (e.g. --count 3 --prefix ada).");
+        }
+        const base = prefix.toLowerCase();
+        if (senderProfileId) {
+            // With a sender the shorthand finally has a real identity behind it, so it
+            // generates usernames only — the placeholder names below are exactly what
+            // this flag exists to stop shipping.
+            mailboxes = Array.from({ length: count }, (_entry, index) => ({ username: `${base}${index + 1}` }));
+        }
+        else {
+            // The vendor stamps a first/last name on every mailbox, so there is no
+            // name-less order shape to fall back on — the shorthand invents
+            // placeholders rather than pretending names are optional. Anyone who
+            // wants real human identities on the inboxes passes --sender (best),
+            // or --mailboxes/--file.
+            const label = `${base.charAt(0).toUpperCase()}${base.slice(1)}`;
+            mailboxes = Array.from({ length: count }, (_entry, index) => ({
+                username: `${base}${index + 1}`,
+                first_name: label,
+                last_name: String(index + 1),
+            }));
+        }
+    }
+    else {
+        const spellings = ["--mailboxes <json>", "--file <path>", "--locals <list> --sender <id>"];
+        if (forms.countPrefix)
+            spellings.push("--count <n> --prefix <base>");
+        throw new Error(`Provide ${spellings.join(", ")}.`);
+    }
+    if (!senderProfileId || !Array.isArray(mailboxes))
+        return mailboxes;
+    return mailboxes.map((entry) => {
+        if (!isRecord(entry))
+            return entry;
+        const { first_name: _firstName, last_name: _lastName, profile_picture_url: _profilePictureUrl, ...rest } = entry;
+        return { ...rest, sender_profile_id: senderProfileId };
+    });
+}
 function buildPromptTemplatesCommand(surface, description) {
     return new Command(surface)
         .description(description)
@@ -2451,11 +2612,29 @@ export function createProgram() {
     });
     program
         .command("home")
-        .description("Your workspace standup: what happened since you last looked, what needs you, and a year of workspace activity. Read-only, 0 credits. The same composition the web Home renders, so a terminal-first operator is not sent to the browser for a status check.")
+        .description("Your workspace standup: what happened since you last looked, what needs you, a year of workspace activity, and — under `activation` — the one prescribed step to take next. Read-only, 0 credits. The same composition the web Home renders, so a terminal-first operator is not sent to the browser for a status check.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("home standup", options, readHomeStandup);
+    });
+    const ACTIVATION_DESCRIPTION = "Where this workspace stands in the prescribed activation play (inbound-led outbound) and the ONE thing to do next: each step's state, what blocks a blocked one, the exact CLI / MCP tool / API call for the next step, and an honest pacing note — LinkedIn is read on a metered drip and a sender's warm-up ramp, not the size of your list, sets how fast anyone is contacted. Read-only, 0 credits. Read the play itself with `oxygen recipes list --stage day-1 --json`.";
+    // Bare `oxygen activation` is the spelling a founder guesses; `activation state`
+    // is the exact name discovery routes to (it is a gatewayCommand of the
+    // onboarding-and-copilot capability route). Both call the one read.
+    const activationCommand = program
+        .command("activation")
+        .description(ACTIVATION_DESCRIPTION)
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("home standup", options, () => requestOxygen("/api/cli/home/standup"));
+        await handleAsyncAction("activation state", options, () => requestOxygen("/api/cli/activation/state"));
     });
+    activationCommand.addCommand(new Command("state")
+        .description(ACTIVATION_DESCRIPTION)
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        const outputOptions = { ...options, json: options.json || Boolean(activationCommand.opts().json) };
+        await handleAsyncAction("activation state", outputOptions, () => requestOxygen("/api/cli/activation/state"));
+    }));
     const commandsCommand = program
         .command("commands")
         .description("Discover CLI commands. With no subcommand, print the backwards-compatible full manifest.")
@@ -2655,9 +2834,9 @@ export function createProgram() {
     }));
     program
         .command("support")
-        .description("Open and track Plain support conversations for the active OXYGEN organization. Filing is a zero-credit write to the canonical Plain queue.")
+        .description("Open and track Plain support conversations for the active OXYGEN organization. In the app, use Settings → Support → Open support chat. Retry is the only recovery control; it returns after each failed connection attempt and never creates a Thread. CLI filing is a zero-credit write to the canonical Plain queue. Guide: https://oxygen-agent.com/docs/surfaces/support.")
         .addCommand(new Command("file")
-        .description("Create a real, zero-credit Plain support Thread immediately. There is no preview: review the exact subject, body, category, and severity before running it. Use when you're stuck on an OXYGEN operation.")
+        .description("Create a real, zero-credit Plain support Thread immediately. This is a separate filing action, not the in-app Retry, and can create a second Thread: check `support list --status open` first and reply to the existing Thread for the same issue. There is no preview: review the exact subject, body, category, and severity before running it. Use when you're stuck on an OXYGEN operation.")
         .requiredOption("--subject <subject>", "One-line summary of the problem.")
         .option("--body <body>", "What you were doing, what happened, and what you tried.")
         .option("--severity <severity>", "low | normal | high. Defaults to normal.")
@@ -2801,19 +2980,54 @@ export function createProgram() {
         });
     }))
         .addCommand(new Command("reply")
-        .description("Preview or send a public reply on the Thread's native Plain channel (human staff only; sent as Oxygen Support).")
+        .description("Preview or send a guarded public reply on the Thread's native Plain channel as Oxygen Support (staff only). CLI delivery is agent-only; named humans use Plain Inbox or Plain MCP.")
         .argument("<ticketId>", "Plain Thread ID (th_...).")
         .requiredOption("--body <body>", "Customer-visible reply body.")
+        .requiredOption("--agent", "Required safety declaration: reply as the authenticated Oxygen Support machine user after it owns the Thread.")
         .option("--confirm-ref <ref>", "Send only when this exactly matches the previewed Plain ref (for example T-10). Omit to preview without sending.")
+        .option("--confirm-message <messageId>", "Agent send only: confirm the latest customer message ID returned by preview.")
+        .option("--confirm-token <token>", "Agent send only: use the exact server-authenticated preview token bound to the Thread, latest message, reply body, and actor mode; never calculate it locally.")
         .option("--json", "Print a JSON envelope.")
         .action(async (ticketId, options) => {
         await handleAsyncAction("support admin reply", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/messages`, {
             method: "POST",
             body: {
                 body: readOption(options.body),
+                as_agent: true,
                 ...(readOption(options.confirmRef)
                     ? { confirm_ref: readOption(options.confirmRef) }
                     : {}),
+                ...(readOption(options.confirmMessage)
+                    ? { confirm_message_id: readOption(options.confirmMessage) }
+                    : {}),
+                ...(readOption(options.confirmToken)
+                    ? { confirm_token: readOption(options.confirmToken) }
+                    : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("done")
+        .description("Preview or mark a Plain Thread Done after the exact verified agent reply; new customer activity reopens it to Todo (staff only). CLI completion is agent-only.")
+        .argument("<ticketId>", "Plain Thread ID (th_...).")
+        .requiredOption("--agent", "Required safety declaration: mark Done as the authenticated Oxygen Support machine user while it still owns the Thread.")
+        .requiredOption("--reply-token <token>", "Use the exact agent_done_token returned by the preceding live `support admin reply --agent`; previews and errors never mint or reveal one.")
+        .option("--confirm-ref <ref>", "Complete only when this exactly matches the previewed Plain ref.")
+        .option("--confirm-message <messageId>", "Complete only when this exactly matches the latest verified staff reply ID from preview.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleAsyncAction("support admin done", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/resolve`, {
+            method: "POST",
+            body: {
+                as_agent: true,
+                ...(readOption(options.replyToken)
+                    ? { agent_reply_token: readOption(options.replyToken) }
+                    : {}),
+                ...(readOption(options.confirmRef)
+                    ? { confirm_ref: readOption(options.confirmRef) }
+                    : {}),
+                ...(readOption(options.confirmMessage)
+                    ? { confirm_message_id: readOption(options.confirmMessage) }
+                    : {}),
             },
         }));
     }))
@@ -2865,17 +3079,6 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
 `)
         .action(async (options) => {
         await handleAsyncAction("support admin events", options, () => requestOxygen(withSupportEventsQuery("/api/cli/admin/support/events", options)));
-    }), { hidden: true })
-        .addCommand(new Command("resolve")
-        .description("Retired legacy write; always returns the Plain-cutover error (staff only).")
-        .argument("<ticketId>", "Ticket UUID.")
-        .requiredOption("--resolution <text>", "Resolution message sent to the opener.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (ticketId, options) => {
-        await handleAsyncAction("support admin resolve", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/resolve`, {
-            method: "POST",
-            body: { resolution: readOption(options.resolution) },
-        }));
     }), { hidden: true })
         .addCommand(new Command("workflow")
         .description("Retired legacy write; Plain notes and downstream engineering work own triage (staff only).")
@@ -8290,9 +8493,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("egress ips", options, () => requestOxygen("/api/cli/egress?view=ips"));
     }))
         .addCommand(new Command("dedicated")
-        .description("Dedicated sending-IP add-on (15,000 credits per 30-day period): preview the quote, order with `request --approved`, cancel with `cancel --approve`, or check the add-on status.")
+        .description("Dedicated sending-IP add-on (25,000 credits per 30-day period): preview the quote, order with `request --approved`, cancel with `cancel --approve`, or check the add-on status.")
         .addCommand(new Command("request")
-        .description("Preview the dedicated sending-IP add-on (15,000 credits per 30-day period, $15 face value; the org's mailboxes share the one dedicated IP). With --approved, ORDER it: the IP is provisioned automatically, the first period's credits are debited immediately, and the next debit falls 30 days after the order — not on the 1st of the month. Every mailbox you add from then on is pinned to the IP automatically; the mailboxes you already have stay on their current IP unless you pass --move-existing. Without --approved nothing is ordered or charged. While the platform vendor account is not provisioned yet, ordering fails closed and the preview says so.")
+        .description("Preview the dedicated sending-IP add-on (25,000 credits per 30-day period, $25 face value; the org's mailboxes share the one dedicated IP). With --approved, ORDER it: the IP is provisioned automatically, the first period's credits are debited immediately, and the next debit falls 30 days after the order — not on the 1st of the month. Every mailbox you add from then on is pinned to the IP automatically; the mailboxes you already have stay on their current IP unless you pass --move-existing. Without --approved nothing is ordered or charged. While the platform vendor account is not provisioned yet, ordering fails closed and the preview says so.")
         // --approved (not --approve): the credit-spending approval flag,
         // which is also what derives spends_credits in the self-index.
         .option("--approved", "Execute the order (a real recurring credit charge). Omit for a no-side-effect preview.")
@@ -8604,6 +8807,56 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: { organization },
         }));
+    })))
+        .addCommand(new Command("automation-usage")
+        .description("Automation-actions meter integrity: the windows whose counter disagrees with their event ledger, and the audited adjustment that closes one. Staff only.")
+        .addCommand(new Command("divergences")
+        .description("List every automation-usage window whose counter and event ledger disagree, including windows that have outlived the detector's lookback and can only be cleared by a repair. Writes no state — but the scan IS the detector, so each call re-emits its aged-out divergence log event once per window that has outlived the lookback (tagged surface=cli, so operator reads stay separable from the 2-hourly cron's own emissions); the envelope reports what it emitted. Bounds default to the cron's; narrow them if the scan approaches its budget on a large estate.")
+        .option("--lookback-days <days>", "Narrow the recent-window scan to this many days back. Defaults to the detector's own lookback. The aged-out scan has no time floor either way, so no divergence can hide behind a shorter lookback.")
+        .option("--limit <windows>", "Cap the recent-window scan. Defaults to the detector's own cap. Truncation is reported as `truncated`, never silent.")
+        .option("--aged-out-limit <windows>", "Cap the aged-out scan, which is ordered oldest-first so a cap only ever drops the newest rows. Reported as `aged_out_truncated`.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("admin automation-usage divergences", options, () => {
+            const params = new URLSearchParams();
+            const lookbackDays = readPositiveInteger(options.lookbackDays);
+            const limit = readPositiveInteger(options.limit);
+            const agedOutLimit = readPositiveInteger(options.agedOutLimit);
+            if (lookbackDays !== undefined)
+                params.set("lookback_days", String(lookbackDays));
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            if (agedOutLimit !== undefined)
+                params.set("aged_out_limit", String(agedOutLimit));
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/admin/automation-usage${qs}`);
+        });
+    }))
+        .addCommand(new Command("reconcile")
+        .description("Write the one audited adjustment that closes a window's counter/ledger divergence. Deliberate by construction: it needs an actor (your staff identity), a reason, and the divergence you observed — the repair refuses if the live numbers have moved since, derives the delta itself, and replays a retry into the same single ledger row. The raise-only counter is never touched; the ledger is brought to meet it, which for a counter reading BELOW its ledger means appending a negative adjustment that writes those actions off the meter of record. The ledger is append-only: the entry cannot be removed afterwards, only offset by a further adjustment. Run `admin automation-usage divergences` first — that listing's `divergence` is the exact quantity this will append.")
+        .requiredOption("--organization <id>", "Organization id the divergence was reported for.")
+        .requiredOption("--window-start <iso>", "Exact period start of the divergent window, e.g. 2026-07-01T00:00:00Z. A rounded value matches no window rather than repairing a neighbouring one.")
+        .requiredOption("--expected-divergence <actions>", "The divergence you are repairing (counter - ledger), signed, straight from `admin automation-usage divergences`. Required so a repair computed off a stale alert aborts instead of writing the wrong delta.")
+        .requiredOption("--reason <text>", "Why this correction is being made. Recorded on the ledger event — no adjustment enters the books anonymously.")
+        .option("--incident-ref <ref>", "Incident this repairs, e.g. OXY-4100.")
+        .option("--idempotency-key <key>", "Pin the replay key. Defaults to (billing owner, window, divergence), which already makes a retry safe.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("admin automation-usage reconcile", options, () => {
+            const incidentRef = readOption(options.incidentRef);
+            const idempotencyKey = readOption(options.idempotencyKey);
+            return requestOxygen("/api/cli/admin/automation-usage", {
+                method: "POST",
+                body: {
+                    organization: readOption(options.organization),
+                    window_start: readOption(options.windowStart),
+                    expected_divergence: readSignedNumber(options.expectedDivergence),
+                    reason: readOption(options.reason),
+                    ...(incidentRef ? { incident_ref: incidentRef } : {}),
+                    ...(idempotencyKey ? { idempotency_key: idempotencyKey } : {}),
+                },
+            });
+        });
     })));
     program
         .command("signup-leads")
@@ -10110,7 +10363,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })))
         .addCommand(new Command("profiles")
-        .description("Sender profiles: group a person's LinkedIn + WhatsApp senders and email inboxes into one sending identity. A sequence can then send every channel from the same persona. Manage: list, get, create, update, attach/detach accounts, delete.")
+        .description("Sender profiles: group a person's LinkedIn + WhatsApp senders and email inboxes into one sending identity — one name, one first/last name, one photo. A sequence can then send every channel from the same persona, and `oxygen managed-inboxes subscribe/add-inboxes --sender <id>` orders new mailboxes under that identity instead of making you retype it per mailbox. Manage: list, get, create, update, set-photo, attach/detach accounts, delete.")
         .addCommand(new Command("list")
         .description("List sender profiles with their per-channel account counts (LinkedIn / WhatsApp / inboxes).")
         .option("--status <status>", "Filter by status: active, paused, or archived.")
@@ -10148,10 +10401,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("senders profiles get", options, () => requestOxygen(`/api/cli/senders/profiles/${encodeURIComponent(id)}`));
     }))
         .addCommand(new Command("create")
-        .description("Create a sender profile. --from-linkedin seeds the name + avatar from a LinkedIn account and attaches it (the person's identity); then assign inboxes and WhatsApp with --mailboxes / --senders. Without --from-linkedin, --name is required.")
+        .description("Create a sender profile: one person's sending identity — their LinkedIn/WhatsApp senders and email inboxes under one name and photo. --from-linkedin seeds the name + avatar from a LinkedIn account and attaches it; then assign inboxes and WhatsApp with --mailboxes / --senders. Without --from-linkedin, --name is required. Give the profile --first-name and --last-name too: those are the exact names the inbox vendor stamps when you order mailboxes with `oxygen managed-inboxes subscribe --sender <id>`, and the vendor has no way to change a name after provisioning.")
         .option("--name <name>", "Display name for the profile. Optional when --from-linkedin is given (derived from the LinkedIn account).")
-        .option("--from-linkedin <senderId>", "Seed the profile from this LinkedIn/WhatsApp sender account id: derives name + avatar and attaches it.")
-        .option("--avatar-url <url>", "Avatar image URL (overrides the one derived from --from-linkedin).")
+        .option("--first-name <name>", "The person's first name, as it should appear on mailboxes ordered for this sender. Defaults to splitting --name / the LinkedIn name on the first space.")
+        .option("--last-name <name>", "The person's last name, as it should appear on mailboxes ordered for this sender. Ordering managed inboxes for this sender needs both names; a one-word name leaves it blank and the order is refused rather than guessed.")
+        .option("--from-linkedin <senderId>", "Seed the profile from this LinkedIn/WhatsApp sender account id: derives the name and MIRRORS the LinkedIn photo into Oxygen storage (LinkedIn's own URL expires, so a mirrored copy is what an inbox vendor can still fetch hours later) and attaches the account.")
+        .option("--avatar-url <url>", "Use this image URL as the profile photo instead of the LinkedIn one. Must be a public https URL. An expiring link (e.g. media.licdn.com with e=<epoch>) is stored but marked non-durable and is NOT sent to an inbox vendor — use `set-photo --file` to host a permanent copy.")
         .option("--status <status>", "Initial status: active (default), paused, or archived.")
         .option("--senders <ids>", "Comma-separated sender account ids (LinkedIn/WhatsApp) to attach.")
         .option("--mailboxes <ids>", "Comma-separated email mailbox ids to attach.")
@@ -10161,6 +10416,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: {
                 ...(readOption(options.name) ? { name: readOption(options.name) } : {}),
+                ...(readOption(options.firstName) ? { first_name: readOption(options.firstName) } : {}),
+                ...(readOption(options.lastName) ? { last_name: readOption(options.lastName) } : {}),
                 ...(readOption(options.fromLinkedin) ? { from_sender_account_id: readOption(options.fromLinkedin) } : {}),
                 ...(readOption(options.avatarUrl) ? { avatar_url: readOption(options.avatarUrl) } : {}),
                 ...(readOption(options.status) ? { status: readOption(options.status) } : {}),
@@ -10170,10 +10427,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("update")
-        .description("Update a sender profile's own fields (name, avatar, status). Use `attach`/`detach` to change its accounts.")
+        .description("Update a sender profile's own fields (display name, first/last name, avatar, status). Use `attach`/`detach` to change its accounts, and `set-photo` for the full photo menu (upload a file, mirror LinkedIn again, or clear).")
         .argument("<id>", "Sender profile id.")
         .option("--name <name>", "New display name.")
-        .option("--avatar-url <url>", "New avatar image URL (empty string clears it).")
+        .option("--first-name <name>", "New first name — the exact one an inbox vendor stamps on mailboxes ordered for this sender.")
+        .option("--last-name <name>", "New last name — the exact one an inbox vendor stamps on mailboxes ordered for this sender. Fix it BEFORE ordering: the vendor cannot rename a mailbox afterwards.")
+        .option("--avatar-url <url>", "New avatar image URL (empty string clears it). Must be a public https URL; an expiring link is stored but marked non-durable and is NOT sent to an inbox vendor.")
         .option("--status <status>", "New status: active, paused, or archived.")
         .option("--json", "Print a JSON envelope.")
         .action(async (id, options) => {
@@ -10181,10 +10440,57 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "PATCH",
             body: {
                 ...(readOption(options.name) ? { name: readOption(options.name) } : {}),
+                ...(readOption(options.firstName) ? { first_name: readOption(options.firstName) } : {}),
+                ...(readOption(options.lastName) ? { last_name: readOption(options.lastName) } : {}),
                 ...(options.avatarUrl !== undefined ? { avatar_url: readOption(options.avatarUrl) ?? "" } : {}),
                 ...(readOption(options.status) ? { status: readOption(options.status) } : {}),
             },
         }));
+    }))
+        .addCommand(new Command("set-photo")
+        .description("Set the sender's profile picture — the face that goes on every mailbox you order for this person. Pick exactly one source: --file (upload your own image; Oxygen hosts it permanently), --url (a public https image), --from-linkedin (re-mirror the photo from the attached LinkedIn account), or --clear. Hosting matters: an inbox vendor fetches the photo from its own servers HOURS after the order, so a LinkedIn CDN link (media.licdn.com, e=<epoch>) has already expired by then and the mailbox ships faceless. --file and --from-linkedin both end up Oxygen-hosted, which is why they are the safe choices. Free — no credits.")
+        .argument("<id>", "Sender profile id (from `oxygen senders profiles list`).")
+        .option("--file <path>", "Upload a PNG, JPEG, or WebP from disk (max 8MB) and use it. Oxygen hosts the image permanently, so an inbox vendor can still fetch it at provisioning time.")
+        .option("--url <url>", "Use an image already published at a public https URL. If the link expires (e.g. media.licdn.com with e=<epoch>) the photo is kept for Oxygen's own UI but marked non-durable and NEVER sent to an inbox vendor.")
+        .option("--from-linkedin", "Re-mirror the photo from this profile's attached LinkedIn account into Oxygen storage. Use it when the person changed their LinkedIn picture.")
+        .option("--clear", "Remove the photo. Mailboxes ordered afterwards ship without one.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (id, options) => {
+        await handleAsyncAction("senders profiles set-photo", options, async () => {
+            const filePath = readOption(options.file);
+            const url = readOption(options.url);
+            const chosen = [
+                filePath ? "--file" : null,
+                url ? "--url" : null,
+                options.fromLinkedin ? "--from-linkedin" : null,
+                options.clear ? "--clear" : null,
+            ].filter((flag) => flag !== null);
+            // Refuse locally rather than letting the server pick a winner: the
+            // photo is what an inbox vendor stamps permanently, so "which source
+            // won" is never a question a caller should have to reverse-engineer
+            // from the response.
+            if (chosen.length === 0) {
+                throw new OxygenError("invalid_request", "Pass one photo source: --file <path>, --url <https url>, --from-linkedin, or --clear.", { exitCode: 2 });
+            }
+            if (chosen.length > 1) {
+                throw new OxygenError("conflicting_flags", `Pass exactly one photo source, not ${chosen.join(" + ")}.`, { exitCode: 2 });
+            }
+            // --file stages the bytes first, then finishes on the profile write
+            // like every other source: one response, carrying the profile and its
+            // deep-link, instead of leaving the caller holding a storage key and
+            // an unfinished profile.
+            const body = filePath
+                ? { avatar_upload_key: await putAvatarBytesToStorage(filePath) }
+                : url
+                    ? { avatar_url: url }
+                    : options.fromLinkedin
+                        ? { avatar_from_linkedin: true }
+                        : { avatar_url: "" };
+            return await requestOxygen(`/api/cli/senders/profiles/${encodeURIComponent(id)}`, {
+                method: "PATCH",
+                body,
+            });
+        });
     }))
         .addCommand(new Command("attach")
         .description("Attach senders and/or inboxes to a profile. An account belongs to one profile at a time — attaching moves it.")
@@ -10571,6 +10877,30 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("linkedin intent status", options, () => requestOxygen("/api/cli/linkedin/intent"));
+    }))
+        // A sibling of `setup`, not a flag on it: setup is free, idempotent and
+        // needs no approval ("make sure these captures and tables exist"), while
+        // this is a STANDING authorization to contact people on every future
+        // cycle. One verb carrying both postures would make the safe default
+        // ambiguous on the surface a founder reads first.
+        .addCommand(new Command("autoenroll")
+        .description("Authorize the captures armed by `linkedin intent setup` to enroll the people they capture into a sequence — the step that turns captured rows into outreach. PREVIEWS BY DEFAULT and writes nothing: it prints the resolved sender and its effective daily caps, the sequence, per-capture create-vs-patch, the live audience split (already 1st-degree / needs an invite / suppressed / already owned by another sender), the resolved spend + enroll caps and where each came from, and a 7-day send forecast. Re-run with --approved to arm a STANDING grant: every later cycle enrolls newly captured people under those caps without asking again, including people you have never seen. This play is a drip, not a blast — a connections import walks LinkedIn on a metered budget (15 relations reads a day by default, ~50 people a read), so a real network lands over days, and a sender on the warm-up ramp is floored at 5 invites and 5 messages a day for its first three days no matter what caps you set. Revoke at any time with `--disable`.")
+        .requiredOption("--account <ref>", "Connected LinkedIn sender whose captures are authorized (sender id, connection id, or Unipile account id).")
+        .option("--sequence <ref>", "Sequence (id or slug) the captured people are enrolled into. Required to arm: a standing grant has to name the journey it puts people in.")
+        .option("--kinds <csv>", "Captures to authorize: connections, followers, profile_viewers, own_posts, post. Defaults to every capture `linkedin intent setup` already provisioned for this sender; naming a kind it never provisioned creates that capture.")
+        .option("--max-credits-per-cycle <n>", "Hard credit ceiling for one cycle of this grant. Omit to inherit your plan tier's per-delivery default (the preview prints which applied). Capturing through a connected account costs 0 credits; a cookieless harvest does not.")
+        .option("--max-enrolls-per-day <n>", "Cap on new people enrolled per UTC day. Omit to inherit the sender's effective — warm-up-ramped — daily message cap.")
+        .option("--include-existing-network", "Also reach the connections you ALREADY have. Without this flag the first cycle records everyone already captured as a silent baseline and only enrolls people who connect, follow, view, or engage from now on.")
+        .option("--post <social_id>", "Composite post social_id from `oxygen posts get`. Required when the `post` capture is authorized.")
+        .option("--post-url <url>", "Public LinkedIn post URL retained with the post capture.")
+        .option("--approved", "Arm the standing grant. Without it nothing is written and nobody is contacted.")
+        .option("--disable", "Revoke the standing grant for this sender. Needs no approval — it only narrows authority. The captures and their tables keep filling; only the permission to contact people is cleared.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("linkedin intent autoenroll", options, () => requestOxygen("/api/cli/linkedin/intent/autoenroll", {
+            method: "POST",
+            body: buildLinkedinIntentAutoenrollBody(options),
+        }));
     })))
         .addCommand(new Command("ingestion")
         .description("Inspect the LinkedIn ingestion drips that read your network, post engagers, and message history into the workspace.")
@@ -12877,7 +13207,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--domain <domain>", "Sending domain (alternative to the positional argument).")
         .requiredOption("--provider <provider>", "Mailbox PLATFORM: google, microsoft, or azure. (google/microsoft cap at 5 mailboxes per domain; azure allows 100.)")
         .option("--vendor <vendor>", "Pin the vendor: inboxkit or cmr. Omit to let OXYGEN choose. A named vendor with no credential FAILS rather than falling back to another.")
-        .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\",\"profile_picture_url\"}]. profile_picture_url is optional and must be a PUBLIC, PERMANENT https URL — the vendor fetches it server-side at provisioning, so an expiring CDN link (e.g. a media.licdn.com URL with e=<epoch>) ships the mailbox faceless. Use `oxygen managed-inboxes upload-avatar <path>` to host one.")
+        .option("--sender <id>", "Sender profile id (from `oxygen senders profiles list`) that OWNS every mailbox in this order: its first name, last name, and profile picture are stamped on each one, so you never retype them. A sender profile is one person's sending identity — their LinkedIn/WhatsApp accounts and email inboxes under one name and photo. One sender can own several addresses on the same domain (see --locals). Any first_name/last_name/profile_picture_url in --mailboxes/--file is dropped for the sender's own values.")
+        .option("--locals <list>", "Comma-separated local parts to create for --sender, e.g. `--locals talia,talia.rosen,t.rosen` on send.acme.com orders talia@, talia.rosen@, and t.rosen@ — all owned by that one person. Requires --sender, because a bare local part carries no name and the vendor's stamp is permanent.")
+        .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\",\"profile_picture_url\"}], or [{\"username\",\"sender_profile_id\"}] to take the identity from a sender profile per item (mix freely). profile_picture_url is optional and must be a PUBLIC, PERMANENT https URL — the vendor fetches it server-side at provisioning, so an expiring CDN link (e.g. a media.licdn.com URL with e=<epoch>) ships the mailbox faceless. Use `oxygen managed-inboxes upload-avatar <path>` to host one, or --sender / sender_profile_id, whose photo Oxygen already mirrors.")
         .option("--file <path>", "Path to a JSON file { \"mailboxes\": [...] } (alternative to --mailboxes).")
         .option("--years <n>", "Years to register the domain for (1-10). Defaults to 1.")
         .option("--redirect-url <url>", "Where the domain's web root redirects. Defaults to your workspace's company website; editable later with `oxygen domains forwarding set`.")
@@ -12898,19 +13230,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 throw new Error("--domain is required.");
             if (!provider)
                 throw new Error("--provider is required (google, microsoft, or azure).");
-            let mailboxes;
-            const mailboxesJson = readOption(options.mailboxes);
-            const filePath = readOption(options.file);
-            if (mailboxesJson) {
-                mailboxes = JSON.parse(mailboxesJson);
-            }
-            else if (filePath) {
-                const parsed = readJsonFileValue(resolve(filePath), "--file");
-                mailboxes = parsed.mailboxes ?? [];
-            }
-            else {
-                throw new Error("Provide --mailboxes <json> or --file <path>.");
-            }
+            // No --count/--prefix here, deliberately: that shorthand can only
+            // reach the vendor by inventing names, and a new domain's first
+            // order is exactly where a placeholder becomes permanent.
+            const mailboxes = buildManagedInboxMailboxes(options, { countPrefix: false });
             const years = readOption(options.years);
             const vendor = readOption(options.vendor);
             const redirectUrl = readOption(options.redirectUrl);
@@ -12942,47 +13265,19 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("Add mailboxes to a managed domain you ALREADY own — no new domain is registered and there is NO domain registration charge, only the extra inboxes' monthly rate (plus their add-ons). WITHOUT --approved this prints a priced PREVIEW with a quote_id and orders nothing; re-run with --approved --quote <id> to place the order. When the standing OXYGEN Warm-up add-on is enabled and available, preview and approved responses carry `warmup_activation` for only the exact newly added `mailboxes`, with `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, Google carries `transport=inboxkit_managed_google_handoff`; Microsoft/Azure carries `transport=inboxkit_sequencer_export`. Both carry `mailbox_credentials_required=false` and `native_send_oauth_separate=true`, so managed warm-up needs no customer-supplied OAuth or mailbox password. Google retrieves the existing managed credential only during activation and never persists or returns it; Microsoft/Azure uses native export. Native sending authorization is separate and may still be required before OXYGEN can send. Verify each exact address with `mailboxes oauth-health --json`; InboxKit's unattended Google domain approval usually lands within minutes and the worker keeps retrying, so a waiting row is not a reason to ask the customer to sign in. The quote authorizes automatic OXYGEN Warm-up activation after provisioning, so do not run a second warmup approval. Capped per domain by the platform the domain was bought on (5 google/microsoft, 100 azure) COUNTING the inboxes already on it. To register a NEW domain use `managed-inboxes subscribe` instead.")
         .argument("[domain]", "A managed domain this workspace already owns (e.g. send.acme.com). May also be passed as --domain.")
         .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
-        .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\",\"profile_picture_url\"}]. The vendor stamps the names on each mailbox, so real names belong here. profile_picture_url is optional and must be a PUBLIC, PERMANENT https URL the vendor can fetch at provisioning; `oxygen managed-inboxes upload-avatar <path>` returns one.")
+        .option("--sender <id>", "Sender profile id (from `oxygen senders profiles list`) that OWNS every mailbox in this order: its first name, last name, and profile picture are stamped on each one, so you never retype them. A sender profile is one person's sending identity — their LinkedIn/WhatsApp accounts and email inboxes under one name and photo. One sender can own several addresses on the same domain (see --locals). Any first_name/last_name/profile_picture_url in --mailboxes/--file is dropped for the sender's own values.")
+        .option("--locals <list>", "Comma-separated local parts to add for --sender, e.g. `--locals talia,talia.rosen,t.rosen` adds talia@, talia.rosen@, and t.rosen@ on this domain — all owned by that one person. Requires --sender, because a bare local part carries no name and the vendor's stamp is permanent.")
+        .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\",\"profile_picture_url\"}], or [{\"username\",\"sender_profile_id\"}] to take the identity from a sender profile per item (mix freely). The vendor stamps the names on each mailbox permanently, so real names belong here. profile_picture_url is optional and must be a PUBLIC, PERMANENT https URL the vendor can fetch at provisioning; `oxygen managed-inboxes upload-avatar <path>` returns one, and a sender profile's mirrored photo already is one.")
         .option("--file <path>", "Path to a JSON file { \"mailboxes\": [...] } (alternative to --mailboxes).")
         .option("--count <n>", "Shorthand for --mailboxes: how many inboxes to add. Requires --prefix.")
-        .option("--prefix <base>", "Shorthand username base for --count: `--count 3 --prefix ada` adds ada1, ada2, ada3 with placeholder names (Ada 1, Ada 2, Ada 3). Pass --mailboxes/--file instead when the inboxes need real human names.")
+        .option("--prefix <base>", "Shorthand username base for --count: `--count 3 --prefix ada` adds ada1, ada2, ada3. WITH --sender all three belong to that person, named and pictured as them; WITHOUT --sender they get placeholder names (Ada 1, Ada 2, Ada 3) the vendor can never change. Pass --sender, or --mailboxes/--file with real names.")
         .option("--approved", "Place the order (requires --quote). Without it, a priced preview is returned.")
         .option("--quote <id>", "The quote_id from a fresh preview. Required with --approved.")
         .option("--json", "Print a JSON envelope.")
         .action(async (domainArg, options) => {
         await handleAsyncAction("managed-inboxes add-inboxes", options, () => {
             const domain = requireDomainArg(domainArg, options.domain);
-            let mailboxes;
-            const mailboxesJson = readOption(options.mailboxes);
-            const filePath = readOption(options.file);
-            const prefix = readOption(options.prefix);
-            const count = readPositiveInt(options.count);
-            if (mailboxesJson) {
-                mailboxes = JSON.parse(mailboxesJson);
-            }
-            else if (filePath) {
-                const parsed = readJsonFileValue(resolve(filePath), "--file");
-                mailboxes = parsed.mailboxes ?? [];
-            }
-            else if (count !== undefined || prefix) {
-                if (count === undefined || !prefix) {
-                    throw new Error("--count and --prefix must be passed together (e.g. --count 3 --prefix ada).");
-                }
-                // The vendor stamps a first/last name on every mailbox, so there is no
-                // name-less order shape to fall back on — the shorthand invents
-                // placeholders rather than pretending names are optional. Anyone who
-                // wants real human identities on the inboxes passes --mailboxes/--file.
-                const base = prefix.toLowerCase();
-                const label = `${base.charAt(0).toUpperCase()}${base.slice(1)}`;
-                mailboxes = Array.from({ length: count }, (_entry, index) => ({
-                    username: `${base}${index + 1}`,
-                    first_name: label,
-                    last_name: String(index + 1),
-                }));
-            }
-            else {
-                throw new Error("Provide --mailboxes <json>, --file <path>, or --count <n> --prefix <base>.");
-            }
+            const mailboxes = buildManagedInboxMailboxes(options, { countPrefix: true });
             const quote = readOption(options.quote);
             // Refuse locally rather than spending a round trip on a PAID path: the
             // route requires the quote that priced this exact expansion, so
@@ -13062,39 +13357,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (path, options) => {
         await handleAsyncAction("managed-inboxes upload-avatar", options, async () => {
-            const resolved = resolve(path);
-            const bytes = readFileSync(resolved);
-            const contentType = imageContentTypeForPath(resolved);
-            // Same three hops the web wizard uses: presign, PUT the bytes
-            // straight to object storage, then confirm — the confirm step is
-            // where the server sniffs the real bytes.
-            const ticket = await requestOxygen("/api/cli/managed-inboxes/avatars", {
-                method: "POST",
-                body: { content_type: contentType, content_length: bytes.byteLength },
-            });
-            const upload = readRecord(ticket, "upload");
-            const uploadUrl = readRecordString(upload, "url");
-            const storageKey = readRecordString(ticket, "storage_key");
-            if (!uploadUrl || !storageKey) {
-                throw new OxygenError("invalid_response", "Oxygen API response is missing the avatar upload URL.", { exitCode: 1 });
-            }
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), 120_000);
-            let putResponse;
-            try {
-                putResponse = await fetch(uploadUrl, {
-                    method: "PUT",
-                    body: new Uint8Array(bytes),
-                    headers: { "content-type": contentType },
-                    signal: controller.signal,
-                });
-            }
-            finally {
-                clearTimeout(timer);
-            }
-            if (!putResponse.ok) {
-                throw new OxygenError("avatar_upload_failed", `Uploading the photo to object storage failed (HTTP ${putResponse.status}).`, { details: { status: putResponse.status }, exitCode: 1 });
-            }
+            const storageKey = await putAvatarBytesToStorage(path);
+            // Confirming against the avatars route is what turns the staged
+            // bytes into a public URL — the server sniffs the real bytes here,
+            // so a .png that is actually a PDF is caught before an order.
             return await requestOxygen("/api/cli/managed-inboxes/avatars", {
                 method: "PATCH",
                 body: { storage_key: storageKey },
@@ -13105,7 +13371,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local credential-file transfer), pause/disable inboxes, connect EmailGuard monitoring, and inspect/control OXYGEN Warm-up. Fresh managed InboxKit Google/Microsoft/Azure orders activate exact-scope warm-up automatically after provisioning under their approved default-on add-on. Google reuses the managed credential just in time; Microsoft/Azure uses native export. Standalone warm-up plans and credit caps are for BYOK/imported mailboxes, managed opt-outs, or later separate enrollment. OXYGEN Warm-up never owns campaign dispatch. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
         .addCommand(new Command("list")
         .description("List the org's sending mailboxes with provider, status, warmup state, source (managed = bought through Oxygen, byok = bring-your-own), and a pool overview (including counts by source). To see only Google/Microsoft mailboxes that still need OAuth connection and the right remedy for each, use `oxygen mailboxes oauth-health --json`.")
-        .option("--status <status>", "Filter by status: active, paused, or disabled.")
+        .option("--status <status>", "Filter by status: active, paused, disabled, or provisioning (ordered, still being set up).")
         .option("--tag <tags>", "Comma-separated workspace tags — matches mailboxes carrying ANY of these tags (see `oxygen tags list`).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13697,9 +13963,24 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 body: { ...(mailboxes.length > 0 ? { mailboxes } : {}) },
             });
         });
+    }))
+        .addCommand(new Command("reconnect")
+        .description("Push the mailbox's CURRENT credential to its warmup provider, for an inbox that is already enrolled. This is how you recover a warmup enrollment whose app password was rotated or revoked (the provider reporting 'Username and Password not accepted'): re-import the new credential with `mailboxes import`, then run this. It costs 0 credits and leaves your warmup subscription and its renewal date exactly as they are — you do NOT need to disable and re-enable warmup, which would charge a second month. The provider cannot change a stored password in place, so the inbox's warmup history restarts from day 1. Targets the whole pool unless --mailboxes is given.")
+        .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("mailboxes warmup reconnect", options, () => {
+            const mailboxes = readCsvOption(options.mailboxes);
+            return requestOxygen("/api/cli/mailboxes/warmup/reconnect", {
+                method: "POST",
+                body: {
+                    ...(mailboxes.length > 0 ? { mailboxes } : {}),
+                },
+            });
+        });
     }))
         .addCommand(new Command("disable")
-        .description("Disable warmup and unenroll each mailbox from the rail that actually enrolled it. On a managed rail — OXYGEN Warm-up today, TrulyInbox for older enrollments — this also cancels that mailbox's warmup subscription, so billing stops with the provider removal. This is how you wind an inbox off the retired TrulyInbox rail. Targets the whole pool unless --mailboxes is given.")
+        .description("Disable warmup and unenroll each mailbox from the rail that actually enrolled it. On a managed rail — OXYGEN Warm-up today, TrulyInbox for older enrollments — this also cancels that mailbox's warmup subscription, so billing stops with the provider removal. This is how you wind an inbox off the retired TrulyInbox rail. NOT the way to fix a rotated app password — use `mailboxes warmup reconnect` for that, which costs 0 credits instead of a new 3,000-credit month. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13712,7 +13993,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("status")
-        .description("Read warmup analytics back from the rail each mailbox is enrolled on and update its state in the pool. Read-only at the vendor, 0 Oxygen credits. Targets the whole pool unless --mailboxes is given.")
+        .description("Read warmup analytics back from the rail each mailbox is enrolled on and update its state in the pool. 0 Oxygen credits and no campaign sends, but it pauses a mailbox whose warmup has run away. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to sync. Omit to sync the whole pool.")
         .option("--provider <name>", "Optional machine routing filter. Omit it for OXYGEN Warm-up; pass trulyinbox only to read inboxes still warming on the retired rail.")
         .option("--dry-run", "Skip the provider call (mailboxes marked pending).")
@@ -14233,12 +14514,14 @@ Fastest editable graph:
   1. oxygen workflows events list --search "<outcome>" --kind builtin --json
   2. oxygen workflows init --id my-workflow
   3. oxygen workflows schema --subject graph --json
-  4. oxygen workflows lint --file my-workflow.workflow.json --json
-  5. oxygen workflows apply --file my-workflow.workflow.json --json
+  4. oxygen workflows lint --file my-workflow.workflow.json --phase draft --json
+  5. oxygen workflows apply --file my-workflow.workflow.json --draft --json
+  6. oxygen workflows lint --file my-workflow.workflow.json --phase publish --json
 
-Applying saves the definition only: it costs 0 credits, calls no graph nodes,
-and creates no run. A disabled workflow stays disabled. Calling or enabling it
-is the separate execution/authorization step.
+Draft apply saves an inert editable revision: it costs 0 credits, calls no graph
+nodes, creates no run, and publishes nothing. After publish lint is clean, apply
+without --draft publishes the revision; calling or enabling it remains a separate
+execution/authorization step.
 
 Run completion:
   Calls enqueue asynchronously. Follow the returned run_id with:
@@ -14335,15 +14618,24 @@ Run completion:
         await handleAsyncAction("workflows init", options, async () => scaffoldWorkflowProject(options));
     }))
         .addCommand(new Command("lint")
-        .description("Compile and lint a workflow file without saving it.")
+        .description("Compile and validate an authored workflow file against the same draft/publish readiness contract as the web editor and apply. Saves nothing, runs nothing, calls no provider, and spends no credits. Portable exports use `workflows import --preflight` because their destination connection bindings are part of validation.")
         .requiredOption("--file <path>", "Workflow module or manifest JSON file.")
+        .addOption(new Option("--phase <phase>", "Validation phase: publish (default) or draft.").choices(["draft", "publish"]).default("publish"))
+        .option("--approved", "Validate that revision-bound autonomous authority is present; grants nothing because lint is read-only.")
+        .option("--max-credits <n>", "Candidate positive per-delivery ceiling; omit to validate the plan default.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("workflows lint", options, async () => {
             const manifest = await compileWorkflowFile(options.file);
+            const maxCredits = readPositiveNumber(options.maxCredits);
             return requestOxygen("/api/cli/workflows/lint", {
                 method: "POST",
-                body: { manifest },
+                body: {
+                    manifest,
+                    phase: options.phase ?? "publish",
+                    ...(options.approved ? { approved: true } : {}),
+                    ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                },
             });
         });
     }))
@@ -14502,9 +14794,10 @@ Run completion:
         .option("--max-credits <n>", "Required credit ceiling for live calls.")
         .option("--approved", "Required for live calls after inspecting a dry run.")
         .option("--revision <n>", "Run a specific saved version instead of the live one. Dry-run and smoke-test only: publish a version to run it live.")
+        .option("--node <node_id>", "Test one node: runs that node plus only the predecessors it needs, from the same saved graph. Dry-run and smoke-test only.")
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
-        .addHelpText("after", "\nSafety: smoke_test and dry_run share one boundary: 0 credits, no paid provider calls, no external writes. Oxygen internal reads use current workspace data, and oxygen.http_json_request may make a real outbound GET. Every mode creates an inspectable Workflow run record.\n")
+        .addHelpText("after", "\nSafety: smoke_test and dry_run share one boundary: 0 credits, no paid provider calls, no external writes. Oxygen internal reads use current workspace data, and oxygen.http_json_request may make a real outbound GET. Every mode creates an inspectable Workflow run record.\n\n--node scopes a test to one step. Oxygen plans the slice on the server from the exact saved version and records it on the run, so the run shows precisely which nodes were allowed to execute; you never submit a node list. Selecting the trigger, a disabled node, or a node unreachable from the trigger is refused with the reason. Only canonical graph workflows support it.\n")
         .action(async (workflowArg, options) => {
         const maxCredits = readPositiveNumber(options.maxCredits);
         const revisionVersion = readPositiveNumber(options.revision);
@@ -14520,6 +14813,7 @@ Run completion:
                 ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
                 ...(options.approved ? { approved: true } : {}),
                 ...(revisionVersion !== undefined ? { revision_version: revisionVersion } : {}),
+                ...(readOption(options.node) ? { test_node_id: readOption(options.node) } : {}),
             },
         }), options));
     }))
@@ -14538,9 +14832,9 @@ Run completion:
         },
     }))))
         .addCommand(new Command("replay")
-        .description("Create a new dry run from one authenticated delivery's exact original revision and payload. Never resends the webhook; uses 0 credits, no paid provider calls, and no external writes. Internal reads and outbound HTTP GETs can still execute.")
-        .argument("<delivery_id>", "Delivery UUID from `oxygen workflows webhooks deliveries`.")
-        .option("--request-key <key>", "Stable key for safely retrying the same replay request.")
+        .description("Create a durable, inspectable run in dry_run mode from one verified outcome=ran delivery's exact original revision and payload. Never resends the webhook or adds an inbound delivery-history row; uses 0 credits, no paid provider calls, and no external writes. Internal reads and outbound HTTP GETs can still execute.")
+        .argument("<delivery_id>", "Verified outcome=ran delivery UUID from `oxygen workflows webhooks deliveries`.")
+        .option("--request-key <key>", "Idempotency key. Reusing the same delivery/key returns the existing replay run; it never creates a second run.")
         .option("--json", "Print a JSON envelope.")
         .action((deliveryId, options) => handleAsyncAction("workflows webhooks replay", options, () => requestOxygen("/api/cli/workflows/webhooks/deliveries/replay", {
         method: "POST",
@@ -14550,7 +14844,7 @@ Run completion:
         },
     }))))
         .addCommand(new Command("deliveries")
-        .description("List workflow webhook deliveries: what arrived, whether it verified, and the run it started.")
+        .description("List inbound workflow webhook deliveries: what arrived, whether it verified, and the run it started. Replays never append here; only a verified outcome=ran delivery can be replayed.")
         .argument("[trigger_id]", "Optional webhook trigger name, such as lead-created.")
         .option("--workflow-id <id>", "Filter to deliveries that started a run of this workflow.")
         .option("--outcome <outcome>", "Filter by rejected (sender authentication failed), blocked (authenticated, no run), or ran.")
@@ -14563,7 +14857,7 @@ Run completion:
         limit: options.limit,
     }))))))
         .addCommand(new Command("revisions")
-        .description("Published version history for one workflow, newest first — every save cuts a revision, and this is how you find the one to go back to.")
+        .description("Saved revision history for one workflow, newest first — includes unpublished drafts and published versions; use --include-manifest to inspect either.")
         .argument("[workflow]", "Workflow id, slug, or name.")
         .option("--workflow <workflow>", "Workflow id, slug, or name.")
         .option("--limit <n>", "Maximum revisions to return. Defaults to 50.")
@@ -14760,6 +15054,7 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
         .argument("<run_id>", "Workflow run UUID returned as data.run.id by workflows call/tail; not the separate provenance run id.")
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", "\nWebhook replay: for a webhook-origin run, find its verified delivery with `oxygen workflows webhooks deliveries --workflow-id <workflow-uuid> --outcome ran`, then use `oxygen workflows webhooks replay <delivery-id>`. The replay response and run metadata retain the source delivery/run lineage.\n")
         .action(async (runId, options) => {
         await handleAsyncAction("workflows run", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/run", {
             method: "POST",
@@ -15182,9 +15477,10 @@ function scaffoldGraphProject(options) {
         files_written: filesWritten,
         files_skipped: filesSkipped,
         next_steps: [
-            `Edit ${workflowFileName}, then validate it: oxygen workflows lint --file ./${workflowFileName}`,
-            `Install it disabled: oxygen workflows apply --file ./${workflowFileName}`,
-            `Open it: oxygen workflows get ${workflowId} --json`,
+            `Edit ${workflowFileName}, then validate the draft: oxygen workflows lint --file ./${workflowFileName} --phase draft --json`,
+            `Save it without publishing: oxygen workflows apply --file ./${workflowFileName} --draft --json`,
+            `Inspect the saved draft: oxygen workflows revisions ${workflowId} --include-manifest --json`,
+            `Before publishing, validate readiness: oxygen workflows lint --file ./${workflowFileName} --phase publish --json`,
         ],
     };
 }
@@ -15356,8 +15652,21 @@ async function loadWorkflowManifestFromFile(filePath) {
                 ? parsed.manifest
                 : null;
         if (!manifest) {
-            throw new OxygenError("invalid_workflow_manifest", "Workflow JSON must be a manifest or { manifest } object.", {
-                details: { file: filePath },
+            const portable = parsed.kind === "oxygen-workflow-definition"
+                && parsed.definition_version === 1
+                && isRecord(parsed.graph);
+            throw new OxygenError("invalid_workflow_manifest", portable
+                ? `Detected a portable workflow export. Validate it without saving or running anything: oxygen workflows import --file ${filePath} --preflight --json. Workflows lint accepts authored manifests, not import envelopes.`
+                : "Workflow JSON must be a manifest or { manifest } object.", {
+                details: {
+                    file: filePath,
+                    ...(portable
+                        ? {
+                            detected_format: "oxygen-workflow-definition",
+                            next_command: `oxygen workflows import --file ${filePath} --preflight --json`,
+                        }
+                        : {}),
+                },
                 exitCode: 1,
             });
         }
@@ -18696,6 +19005,51 @@ function imageContentTypeForPath(path) {
         return "image/png";
     throw new OxygenError("unsupported_image", "Profile pictures must be a .png, .jpg, or .webp file.", { details: { path }, exitCode: 2 });
 }
+/**
+ * Hops one and two of the avatar upload: presign, then PUT the raw bytes straight
+ * to Oxygen object storage. Returns the storage key the caller confirms with.
+ *
+ * Shared because two commands stage the same bytes in the same bucket and then
+ * diverge: `managed-inboxes upload-avatar` confirms against the avatars route to
+ * get a public URL to paste into an order, while `senders profiles set-photo`
+ * hands the key to the profile writer as `avatar_upload_key`, which re-checks org
+ * ownership and re-sniffs the bytes itself. Copying the two hops into the second
+ * caller would have duplicated the abort timeout and the failure taxonomy, and
+ * the copy is exactly where they drift.
+ */
+async function putAvatarBytesToStorage(path) {
+    const resolved = resolve(path);
+    const bytes = readFileSync(resolved);
+    const contentType = imageContentTypeForPath(resolved);
+    const ticket = await requestOxygen("/api/cli/managed-inboxes/avatars", {
+        method: "POST",
+        body: { content_type: contentType, content_length: bytes.byteLength },
+    });
+    const upload = readRecord(ticket, "upload");
+    const uploadUrl = readRecordString(upload, "url");
+    const storageKey = readRecordString(ticket, "storage_key");
+    if (!uploadUrl || !storageKey) {
+        throw new OxygenError("invalid_response", "Oxygen API response is missing the avatar upload URL.", { exitCode: 1 });
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 120_000);
+    let putResponse;
+    try {
+        putResponse = await fetch(uploadUrl, {
+            method: "PUT",
+            body: new Uint8Array(bytes),
+            headers: { "content-type": contentType },
+            signal: controller.signal,
+        });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!putResponse.ok) {
+        throw new OxygenError("avatar_upload_failed", `Uploading the photo to object storage failed (HTTP ${putResponse.status}).`, { details: { status: putResponse.status }, exitCode: 1 });
+    }
+    return storageKey;
+}
 function readRecord(value, key) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return null;
@@ -19166,6 +19520,51 @@ async function handleUpdateAction(options) {
         emitCliFailure("update", error);
     }
 }
+/**
+ * `oxygen home`: the standup PLUS the prescribed play's next step.
+ *
+ * Two reads, because the web Home already composes exactly these two — its RSC calls
+ * the standup composition and `readActivationState` side by side (apps/web/src/lib/
+ * activation/state.ts) — and a terminal-first operator must not be the one surface
+ * shown a standup with no next move. Both legs are existing read-only `/api/cli/*`
+ * contracts, so neither surface knows anything the other cannot ask for.
+ *
+ * The activation leg is allSettled and never fatal: a standup that read fine must not
+ * be thrown away because the play read failed. When it does fail the leg is NAMED in
+ * `degraded` rather than dropped silently — an absent next step has to read as "we
+ * could not tell", never as "there is nothing to do".
+ */
+async function readHomeStandup() {
+    const [standup, activation] = await Promise.allSettled([
+        requestOxygen("/api/cli/home/standup"),
+        requestOxygen("/api/cli/activation/state"),
+    ]);
+    if (standup.status === "rejected")
+        throw standup.reason;
+    const data = standup.value;
+    if (activation.status === "fulfilled") {
+        return {
+            ...data,
+            // The play's progress and its single next step; `oxygen activation` prints the
+            // per-step detail this deliberately leaves out.
+            activation: {
+                play: activation.value.play ?? null,
+                next_step: activation.value.next_step ?? null,
+                safety: activation.value.safety ?? null,
+                degraded: activation.value.degraded ?? [],
+                full_state: "oxygen activation --json",
+            },
+        };
+    }
+    return {
+        ...data,
+        activation: null,
+        degraded: [
+            ...(Array.isArray(data.degraded) ? data.degraded : []),
+            "activation",
+        ],
+    };
+}
 function buildApiKeyCreateBody(options) {
     const body = {};
     const name = readOption(options.name);
@@ -22379,6 +22778,44 @@ function readPositiveNumber(value) {
     }
     return parsed;
 }
+/**
+ * A whole count (days, rows, windows). Its positive-number sibling accepts 2.5,
+ * which for a scan bound is always a typo — rejected here so it costs no round trip,
+ * and rejected rather than rounded so a bound nobody asked for is never scanned.
+ */
+function readPositiveInteger(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = Number(trimmed);
+    if (!Number.isInteger(parsed) || parsed < 1) {
+        throw new OxygenError("invalid_number", "Expected a positive whole number.", {
+            details: { value },
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
+/**
+ * A signed, finite number (`--expected-divergence`). Unlike its positive and
+ * non-negative siblings the sign is the payload here — a negative divergence is
+ * the meter counter under-reading its own ledger — so only a non-finite value is
+ * rejected. Parsed client-side so a typo fails before a request that would
+ * otherwise reach a billing ledger is sent at all.
+ */
+function readSignedNumber(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = Number(trimmed);
+    if (!Number.isFinite(parsed)) {
+        throw new OxygenError("invalid_number", "Expected a finite number.", {
+            details: { value },
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
 function readNonNegativeNumber(value) {
     const trimmed = value?.trim();
     if (!trimmed)