@oxygen-agent/cli 1.894.0 → 1.917.5

package/dist/index.js

@@ -9,7 +9,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, CommanderError, Option } from "commander";
 import { applyOxygenHelp } from "./help.js";
 import { buildCommandManifest, getCommandManifestEntry, searchCommandManifest, suggestCommandNames, } from "./command-manifest.js";
-import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, KNOWLEDGE_BOOTSTRAP_MAX_CREDITS, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferUserCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TABLE_IMPORT_ROW_LIMIT, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
+import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatCopilotPlanDuration, formatCopilotPlanSeconds, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, KNOWLEDGE_BOOTSTRAP_MAX_CREDITS, MAX_MCP_TOOL_NAME_LENGTH, normalizeCopilotPlanStepStatus, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferUserCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TABLE_IMPORT_ROW_LIMIT, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { TAG_COLORS } from "@oxygen/shared/select-options";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, parseXlsxWorkbookBuffer, } from "@oxygen/shared/file-import";
 import { MAILBOX_IMPORT_FILE_MAX_BYTES as SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES, MAILBOX_IMPORT_ROW_LIMIT as SHARED_MAILBOX_IMPORT_ROW_LIMIT, normalizeMailboxImportFile as normalizeSharedMailboxImportFile, normalizeMailboxImportVendor as normalizeSharedMailboxImportVendor, normalizeMailboxWorkbookRows, parseMailboxImportText, summarizeMailboxImportValidation as summarizeSharedMailboxImportValidation, } from "@oxygen/shared/mailbox-import";
@@ -567,6 +567,72 @@ function writeObservabilityCapsNotice(data) {
         : Array.isArray(record.items) ? record.items.length : 0;
     process.stderr.write(`note: showing ${returned} item(s); some sources hit the per-source cap (${cappedSources.join(", ")}) — raise --limit (max 100) or filter --source to see more.\n`);
 }
+// Discovery lists are windowed by default (200 rows, max 1000) so the cost of
+// asking "what is in this workspace?" does not scale with how much the customer
+// has built. A window nobody can see is indistinguishable from a complete
+// answer, so say it on stderr — same treatment the observability console's
+// per-source cap already gets. Machine-read stdout carries `capped`, `returned`
+// and `limit` either way.
+function writeListCapNotice(data, noun) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const record = data;
+    if (record.capped !== true)
+        return;
+    const returned = typeof record.returned === "number" ? record.returned : null;
+    process.stderr.write(`note: showing ${returned === null ? "a window of" : returned} ${noun}; more exist — raise --limit (max 1000) or pass --all.\n`);
+}
+// The map is bounded twice over — a scan window per kind, then a character
+// budget across all of them — and both bounds are invisible in the rendered
+// output. Say them on stderr for the same reason every other cap here is said:
+// a window presented as a complete answer is a confident lie, and this one is
+// the first thing an agent or a person reads about a workspace. `degraded` gets
+// the same treatment: an empty kind that failed to read is not an empty kind.
+function writeWorkspaceMapNotices(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const record = data;
+    const degraded = Array.isArray(record.degraded) ? record.degraded : [];
+    if (degraded.length > 0) {
+        process.stderr.write(`note: could not read ${degraded.join(", ")} — those kinds are unknown, not empty.\n`);
+    }
+    const kinds = Array.isArray(record.kinds) ? record.kinds : [];
+    const capped = kinds
+        .filter((kind) => Boolean(kind) && typeof kind === "object" && !Array.isArray(kind) && kind.capped === true)
+        .map((kind) => String(kind.kind));
+    if (capped.length > 0) {
+        process.stderr.write(`note: ${capped.join(", ")} hold more than this scan saw; their counts are a floor. Narrow with --query or --tag.\n`);
+    }
+    const budget = record.budget;
+    if (budget && typeof budget === "object" && !Array.isArray(budget)) {
+        const trimmed = budget.trimmed;
+        if (Array.isArray(trimmed) && trimmed.length > 0) {
+            process.stderr.write(`note: the character budget trimmed ${trimmed.length} item(s) from ${[...new Set(trimmed.map(String))].join(", ")}.\n`);
+        }
+    }
+    const tagNote = record.tag_note;
+    if (typeof tagNote === "string" && tagNote)
+        process.stderr.write(`note: ${tagNote}\n`);
+}
+// The wiki index counts the whole wiki even when the page list is a window, so
+// name both numbers: "200 of 512 pages" is honest, "200 pages" is not.
+function writeKnowledgeIndexCapNotice(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const index = data.index;
+    if (!index || typeof index !== "object" || Array.isArray(index))
+        return;
+    const block = index;
+    if (block.capped !== true)
+        return;
+    const counts = block.counts;
+    const returned = typeof counts?.returned === "number" ? counts.returned : null;
+    const total = typeof counts?.total === "number" ? counts.total : null;
+    const shown = returned === null
+        ? "a window of this wiki's pages"
+        : `${returned}${total === null ? "" : ` of ${total}`} page(s)`;
+    process.stderr.write(`note: listing ${shown}, most recently updated first; counts cover the whole wiki — raise --limit (max 1000) or pass --all.\n`);
+}
 // Arming a cron commits recurring spend, so `workflows enable` mirrors its
 // `automation` block as stderr lines: what the schedule burns per day, what
 // share of the monthly allowance that is, and when it runs out. Observed burn
@@ -1466,6 +1532,7 @@ function buildCrmSearchBody(query, options) {
         query,
         ...(objects.length > 0 ? { objects } : {}),
         ...(limit !== undefined ? { limit } : {}),
+        ...(options.suggest === true ? { mode: "suggest" } : {}),
     };
 }
 function buildCrmMergeBody(object, survivorRowId, loserRowId, options) {
@@ -2647,6 +2714,38 @@ export function createProgram() {
         .action(async (options) => {
         await handleAsyncAction("home standup", options, readHomeStandup);
     });
+    // `oxygen workspace map` sits beside `oxygen home` on purpose: home answers
+    // "what needs me", the map answers "what is in here". Both are Control-surface
+    // compositions over reads the primitives already own — neither is a primitive.
+    program
+        .command("workspace")
+        .description("Read what this workspace contains, across every primitive.")
+        .addCommand(new Command("map")
+        .description("What this workspace actually contains: the newest tables, CRM objects, sequences, workflows, agents, wiki pages, posts and projects, each with its id, last activity, tags and link. Read-only, 0 credits. Capability search tells you what OXYGEN can do; this tells you what is here.")
+        .option("--kind <kinds>", "Comma-separated kinds to include: table, crm_object, sequence, workflow, agent, knowledge_page, post, project.")
+        .option("--tag <tag>", "Only objects carrying this workspace tag. Answered by the Tags footprint read, so it also covers kinds this map does not model.")
+        .option("--query <text>", "Match on name, slug, or tag.")
+        .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", "\nEach kind returns its newest few objects under a character budget the payload echoes back; `capped` says when a kind holds more than the scan saw. Hydrate one object with its own primitive's read (`oxygen tables describe`, `oxygen workflows get`, `oxygen knowledge page get`).\n\nRead-only means read-only: the map creates nothing in your workspace in order to answer, so an empty wiki reports zero pages rather than a starter set this command seeded. Use `oxygen knowledge index` when you do want the starter wiki created.\n")
+        .action(async (options) => {
+        await handleAsyncAction("workspace map", options, async () => {
+            const params = new URLSearchParams();
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
+            const tag = readOption(options.tag);
+            if (tag)
+                params.set("tag", tag);
+            const query = readOption(options.query);
+            if (query)
+                params.set("query", query);
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            const data = await requestOxygen(`/api/cli/workspace/map${qs}`);
+            if (!options.json)
+                writeWorkspaceMapNotices(data);
+            return data;
+        });
+    }));
     const ACTIVATION_DESCRIPTION = "Where this workspace stands in the prescribed activation play (inbound-led outbound) and the ONE thing to do next: each step's state, what blocks a blocked one, the exact CLI / MCP tool / API call for the next step, and an honest pacing note — LinkedIn is read on a metered drip and a sender's warm-up ramp, not the size of your list, sets how fast anyone is contacted. Read-only, 0 credits. Read the play itself with `oxygen recipes list --stage day-1 --json`.";
     // Bare `oxygen activation` is the spelling a founder guesses; `activation state`
     // is the exact name discovery routes to (it is a gatewayCommand of the
@@ -3519,6 +3618,17 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: { tags: splitCommaList(options.tags) },
         }));
+    }))
+        .addCommand(new Command("color")
+        .description("Set a project's colour in the Tables rail. `--color auto` restores the automatic colour.")
+        .argument("<project>", "Project slug or id.")
+        .requiredOption("--color <color>", "Colour name (gray, red, orange, amber, yellow, green, teal, blue, indigo, purple, pink) or `auto` to clear.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (project, options) => {
+        await handleAsyncAction("projects color", options, () => requestOxygen(`/api/cli/projects/${encodeURIComponent(project)}/color`, {
+            method: "POST",
+            body: { color: options.color?.trim().toLowerCase() ?? null },
+        }));
     }));
     program
         .command("notetaker")
@@ -4332,6 +4442,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--objects <objects>", "Comma-separated CRM object slugs to search. Defaults to all configured objects.")
         .option("--object <object>", "Alias for --objects; every sibling crm command spells it singular.")
         .option("--limit <limit>", "Maximum records to return.")
+        .option("--suggest", "Typeahead mode: ranked name/email/domain matches on a partial string, returning a compact suggestion per record instead of the full row. This is what the app's CRM search bar calls; use it when you have a fragment, and the default when you have an exact identity.")
         .option("--json", "Print a JSON envelope.")
         .action(async (query, options) => {
         await handleAsyncAction("crm search", options, () => requestOxygen("/api/cli/crm/records/search", {
@@ -5036,9 +5147,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--project <project>", "Project id or slug to filter by.")
         .option("--tag <tag>", "Only tables carrying this workspace tag (see `oxygen tags list`).")
         .option("--include-archived", "Also list archived and delete-scheduled tables (the restorable trash; each carries a lifecycle with purge_scheduled_at).")
+        .option("--limit <n>", "Maximum tables to list. Defaults to 200; hard cap is 1000.")
+        .option("--all", "List every table instead of the newest window.")
         .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", "\nLists the 200 newest tables by default; `capped` in the JSON envelope says when there are more.\n")
         .action(async (options) => {
-        await handleAsyncAction("tables list", options, () => {
+        await handleAsyncAction("tables list", options, async () => {
             const params = new URLSearchParams();
             const project = readOption(options.project);
             if (project)
@@ -5048,8 +5162,16 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 params.set("tag", tag);
             if (options.includeArchived)
                 params.set("include_archived", "true");
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            if (options.all)
+                params.set("all", "true");
             const qs = params.toString() ? `?${params.toString()}` : "";
-            return requestOxygen(`/api/cli/tables${qs}`);
+            const data = await requestOxygen(`/api/cli/tables${qs}`);
+            if (!options.json)
+                writeListCapNotice(data, "table(s)");
+            return data;
         });
     }))
         .addCommand(new Command("query")
@@ -6240,10 +6362,24 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("index")
-        .description("Compact wiki index: every page's slug, one-liner, tags, link degree, plus type/status counts.")
+        .description("Compact wiki index: each page's slug, one-liner, tags, link degree, plus type/status counts over the whole wiki. Lists the 200 most recently updated pages by default.")
+        .option("--limit <n>", "Maximum pages to list. Defaults to 200; hard cap is 1000. Counts always cover the whole wiki.")
+        .option("--all", "List every page instead of the most recently updated window.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("knowledge index", options, () => requestOxygen("/api/cli/knowledge/index"));
+        await handleAsyncAction("knowledge index", options, async () => {
+            const params = new URLSearchParams();
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            if (options.all)
+                params.set("all", "true");
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            const data = await requestOxygen(`/api/cli/knowledge/index${qs}`);
+            if (!options.json)
+                writeKnowledgeIndexCapNotice(data);
+            return data;
+        });
     }))
         .addCommand(new Command("graph")
         .description("Knowledge graph of pages and their [[wikilink]] edges. Pass --center to render one page's local neighborhood instead of the whole graph.")
@@ -8789,23 +8925,28 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }));
     program.addCommand(new Command("egress")
-        .description("Fly-native email egress: status, shared/dedicated IP inventory, the dedicated-IP add-on, and rotation.")
+        .description("Native email egress: status, shared/dedicated IP inventory, the dedicated-IP add-on, policy assignments, and a fail-closed retired rotation shim.")
         .addCommand(new Command("status")
-        .description("Show this workspace's actual Fly egress mode, active IP, health counts, and dedicated add-on. Read-only, 0 credits.")
+        .description("Show this workspace's actual native egress mode, active IP, health counts, dedicated add-on, and one bounded page of the inspectable mailbox policy ledger. Read-only, 0 credits.")
+        .option("--assignment-offset <number>", "Continue the policy ledger from open_assignments_next_offset.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("egress status", options, () => requestOxygen("/api/cli/egress"));
+        const assignmentOffset = readNonNegativeInt(options.assignmentOffset);
+        const query = assignmentOffset === undefined
+            ? ""
+            : `?assignment_offset=${encodeURIComponent(String(assignmentOffset))}`;
+        await handleAsyncAction("egress status", options, () => requestOxygen(`/api/cli/egress${query}`));
     }))
         .addCommand(new Command("ips")
-        .description("List the shared Fly worker IP and this workspace's dedicated Fly IP history. Read-only, 0 credits.")
+        .description("List the shared native worker IP and this workspace's dedicated IP history. Read-only, 0 credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("egress ips", options, () => requestOxygen("/api/cli/egress?view=ips"));
     }))
         .addCommand(new Command("dedicated")
-        .description("Dedicated Fly egress add-on (25,000 credits per 30-day period): workspace tenant isolation and account safety, not a deliverability or inbox-placement lever. Preview the quote, order with `request --approved`, cancel with `cancel --approve`, or check status.")
+        .description("Dedicated native egress add-on (25,000 credits per 30-day period): workspace tenant isolation and account safety, not a deliverability or inbox-placement lever. Preview the quote, order with `request --approved`, cancel with `cancel --approve`, or check status.")
         .addCommand(new Command("request")
-        .description("Preview the dedicated Fly egress add-on (25,000 credits per 30-day period, $25 face value). With --approved, ORDER it: OXYGEN provisions one minimal Fly send-drain app plus one static egress IP for the workspace, debits the first period immediately, and debits the next 30 days later — not on the 1st. After the guarded handoff, every current and future workspace send routes through that app automatically; the Google/Microsoft relay IP recipients see does not change. This is workspace tenant isolation and account safety, not a deliverability or inbox-placement lever. Without --approved nothing is ordered or charged. While the platform Fly account is unavailable, ordering fails closed and the preview says so.")
+        .description("Preview the dedicated native egress add-on (25,000 credits per 30-day period, $25 face value). With --approved, ORDER it: OXYGEN provisions one isolated send drain plus one static egress IP for the workspace, debits the first period immediately, and debits the next 30 days later — not on the 1st. Every current inbox is assigned to that IP, every future inbox joins it automatically, and after the guarded handoff every workspace send routes through the dedicated drain; the Google/Microsoft relay IP recipients see does not change. This is workspace tenant isolation and account safety, not a deliverability or inbox-placement lever. Without --approved nothing is ordered or charged. While native provisioning is unavailable, ordering fails closed and the preview says so.")
         // --approved (not --approve): the credit-spending approval flag,
         // which is also what derives spends_credits in the self-index.
         .option("--approved", "Execute the order (a real recurring credit charge). Omit for a no-side-effect preview.")
@@ -8813,12 +8954,15 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         // derives spends_credits from --approved/--max-credits/--budget-credits
         // appearing in a command's flag strings, so an approval-shaped name
         // here would mislabel every command that carries it.
-        .option("--move-existing", "Deprecated compatibility no-op. Fly dedication is workspace-scoped, so every current and future send routes through the dedicated drain automatically; old scripts may keep passing this flag safely.")
+        .option("--move-existing", "Deprecated compatibility flag. Existing inboxes now move to the dedicated IP automatically, so old scripts may keep passing this safely.")
         .option("--country <code>", "ISO 3166-1 alpha-2 country the dedicated IP should sit in (e.g. US, DE). Match it to where your mailboxes' owners plausibly sign in from — the IP's job is making the sign-in look ordinary, and an account that suddenly authenticates from another country is what gets it challenged. Omitted uses the default region. An unserviceable or out-of-stock country fails before anything is ordered or charged.")
+        .option("--idempotency-key <key>", "Stable key for safely retrying the same order after a timeout. Reuse the key shown in a timeout error; use a new key only for an intentionally new purchase.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
+        const idempotencyKey = readOption(options.idempotencyKey);
         await handleAsyncAction("egress dedicated request", options, () => requestOxygen("/api/cli/egress/dedicated", {
             method: "POST",
+            ...(idempotencyKey ? { idempotencyKey } : {}),
             body: {
                 ...(options.approved ? { approve: true } : {}),
                 ...(options.moveExisting ? { move_existing: true } : {}),
@@ -8827,7 +8971,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("cancel")
-        .description("Cancel the dedicated sending-IP add-on. Approval-gated: without --approve it previews. Cancellation takes effect at the END of the 30-day period already paid for: the IP keeps sending until then, and only at period end does it retire, the workspace returns to the shared Fly worker, and credit billing stops. No refund, no early cutoff.")
+        .description("Cancel the dedicated sending-IP add-on. Approval-gated: without --approve it previews. Cancellation takes effect at the END of the 30-day period already paid for: the IP keeps sending until then, and only at period end does it retire, the workspace returns to the shared native worker, and credit billing stops. No refund, no early cutoff.")
         .option("--approve", "Execute the cancellation. Omit for a no-side-effect preview.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -8843,10 +8987,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("egress dedicated status", options, () => requestOxygen("/api/cli/egress/dedicated"));
     })))
         .addCommand(new Command("rotate")
-        .description("Rotate a mailbox's sending IP. Approval-gated: without --approve it previews and makes no change.")
+        .description("RETIRED compatibility command. Native egress is workspace-scoped, so OXYGEN cannot rotate one mailbox without violating the workspace's shared-or-one-dedicated routing contract. The API always fails closed with no provider call or change.")
         .requiredOption("--mailbox <id>", "Mailbox id to rotate.")
-        .option("--vendor <vendor>", "Staff-only vendor override. Defaults to the current IP's vendor.")
-        .option("--approve", "Execute the rotation (paid vendor action). Omit for a no-side-effect preview.")
+        .option("--vendor <vendor>", "Retired compatibility input; never used for a provider call.")
+        .option("--approve", "Retired compatibility flag; no rotation is executed.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("egress rotate", options, () => requestOxygen("/api/cli/egress/rotate", {
@@ -8859,7 +9003,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("register")
-        .description("STAFF: register a manually-purchased sending IP into this environment's inventory. Secrets never pass here — --credential-ref names the Doppler family EGRESS_CRED_<REF>_USERNAME/_PASSWORD, set separately in Doppler. Register, then `egress assign`, then enable EGRESS_POOL_ENABLED (pool mode fails closed for unassigned mailboxes).")
+        .description("STAFF RECOVERY: register legacy/manual logical policy inventory for this environment. This does not configure native send transport; dedicated native drains are created only by `egress dedicated request`. Secrets never pass here — --credential-ref names the Doppler family EGRESS_CRED_<REF>_USERNAME/_PASSWORD, set separately in Doppler.")
         .requiredOption("--host <host>", "Proxy hostname or IP — bare, no scheme/port/credentials.")
         .requiredOption("--port <port>", "Proxy port (1-65535).")
         .requiredOption("--credential-ref <ref>", "Doppler credential-family name (A-Z, 0-9, _).")
@@ -8885,9 +9029,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("assign")
-        .description("Assign sending mailboxes to inventoried egress IPs — least-loaded across the active pool, or pinned with --ip. Existing open assignments are kept (stable for life; use rotate to re-home a burned IP). Admin/owner role; no spend, 0 credits.")
+        .description("Converge mailbox policy assignments: managed/shared by default, or the workspace's dedicated IP for every current and future inbox once that add-on is active. Existing pins stay stable within their tier; --ip cannot override an active dedicated tier. Admin/owner role; no spend, 0 credits.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to assign.")
-        .option("--all", "Assign every sending mailbox in the pool that lacks an open assignment.")
+        .option("--all", "Converge every sending mailbox to the workspace's current shared or dedicated tier.")
         .option("--ip <egressIpId>", "Pin the targeted mailboxes to this egress IP id (must be active and org-visible).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -9571,13 +9715,13 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }));
     program
         .command("copilot")
-        .description("Workspace Copilot: an interactive workspace agent you drive turn by turn from the terminal. Start a session with an explicit inference budget, send it messages and watch the reply stream, approve the actions it proposes, then cancel when done. Inference bills credits at 5x the actual model cost, always inside the session budget you approve up front. Web: /copilot.")
+        .description("Workspace Copilot: an attended workspace agent you drive turn by turn from the terminal. Start a session, send it messages and watch the reply stream, approve the actions it proposes, then cancel when done. Inference bills credits at 5x the actual model cost and is bounded by a 30,000-credit internal platform safety backstop; paid or external actions keep their own approval gates. Web: /copilot.")
         .addCommand(new Command("start")
-        .description("Start a Workspace Copilot session. --budget-credits is your explicit approval of the session's inference spend cap; inference bills at 5x the actual model cost within it.")
-        .requiredOption("--budget-credits <number>", "Required: the session inference budget in credits — your explicit approval of the maximum inference spend for the whole session.")
+        .description("Start an attended Workspace Copilot session. Starting is free; the next send starts inference. No inference budget is required; inference bills at 5x actual model cost under a 30,000-credit internal platform safety backstop. Legacy budget flags remain accepted for older clients but do not authorize or cap spend. Paid or external actions require separate approval.")
+        .option("--budget-credits <number>", "Legacy compatibility only: accepted and clamped, but does not authorize or cap attended Copilot inference.")
         .option("--tier <low|medium|high>", "Reasoning effort tier for the session's model.")
         .option("--model <id>", "Pin a specific model id instead of the journey/tier default.")
-        .option("--per-turn-ceiling <number>", "Optional per-turn credit ceiling that caps any single turn's inference spend.")
+        .option("--per-turn-ceiling <number>", "Legacy compatibility only: accepted and clamped, but does not cap an attended turn.")
         .option("--journey <slug>", "Optional journey slug to seed the session's goal and context.")
         .option("--title <text>", "Optional human title for the session.")
         .option("--auto-approve", "Start with auto-approve ON for paid, workspace-internal actions (cards are still created and decided automatically within each action's credit cap). External sends, enrollments, publishes, DNS, and external CRM pushes always stay human-gated.")
@@ -9586,15 +9730,20 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .action(async (options) => {
         await handleAsyncAction("copilot start", options, () => {
             const budgetCredits = readPositiveNumber(options.budgetCredits);
-            if (budgetCredits === undefined) {
-                throw new OxygenError("invalid_budget", "Pass --budget-credits as a positive number of credits to approve the session's inference spend.", { exitCode: 1 });
+            if (options.budgetCredits !== undefined && budgetCredits === undefined) {
+                throw new OxygenError("invalid_budget", "When supplied for legacy compatibility, --budget-credits must be a positive number.", { exitCode: 1 });
             }
             const perTurnCeiling = readPositiveNumber(options.perTurnCeiling);
+            if (options.perTurnCeiling !== undefined && perTurnCeiling === undefined) {
+                throw new OxygenError("invalid_budget", "When supplied for legacy compatibility, --per-turn-ceiling must be a positive number.", { exitCode: 1 });
+            }
             const tier = readOption(options.tier);
             const model = readOption(options.model);
             const journey = readOption(options.journey);
             const title = readOption(options.title);
-            const body = { budget_credits: budgetCredits };
+            const body = {};
+            if (budgetCredits !== undefined)
+                body.budget_credits = budgetCredits;
             if (tier)
                 body.tier = tier;
             if (model)
@@ -9615,7 +9764,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("list")
-        .description("List your Workspace Copilot sessions with their status, budget, and credits spent.")
+        .description("List your Workspace Copilot sessions and their current status.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("copilot list", options, () => requestOxygen("/api/cli/copilot/sessions"));
@@ -9638,6 +9787,24 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const suffix = query.toString() ? `?${query.toString()}` : "";
             return requestOxygen(`/api/cli/copilot/sessions/${encodeURIComponent(sessionId)}${suffix}`);
         });
+    }))
+        .addCommand(new Command("plan")
+        .description("Show how far along a Workspace Copilot session is: its plan's major steps, the substeps under each, what is done, and how much longer the rest is expected to take.")
+        .argument("<sessionId>", "Copilot session id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sessionId, options) => {
+        const result = await requestOxygen(`/api/cli/copilot/sessions/${encodeURIComponent(sessionId)}?event_limit=1`).catch((error) => {
+            emitCliFailure("copilot plan", error);
+            return null;
+        });
+        if (!result)
+            return;
+        const plan = isRecord(result) ? result.plan : null;
+        if (options.json) {
+            emitSuccess("copilot plan", { plan, web_url: isRecord(result) ? result.web_url : null }, options);
+            return;
+        }
+        writeCopilotPlan(plan, isRecord(result) ? result.web_url : null);
     }))
         .addCommand(new Command("follow")
         .description("Turn screen-follow ON (or, with --off, OFF) for an open Workspace Copilot session: while it is open in the browser, your screen opens onto whatever the copilot creates or changes, with the live session docked beside it. Same switch as the web composer's \"Show me\" toggle; changes nothing about what the session is allowed to do.")
@@ -9651,7 +9818,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("send")
-        .description("Send a message to a Workspace Copilot session and stream the reply to stderr. Waits for the turn to finish (or pause for an approval) unless --no-wait. Inference bills credits at 5x the actual model cost within the session budget.")
+        .description("Send a message to a Workspace Copilot session and stream the reply to stderr. Waits for the turn to finish (or pause for an approval) unless --no-wait. Inference bills credits at 5x the actual model cost under the attended platform safety backstop.")
         .argument("<sessionId>", "Copilot session id.")
         .argument("<message...>", "Message to send (all words joined with spaces).")
         .option("--no-wait", "Post the turn and return immediately without streaming the reply.")
@@ -11359,7 +11526,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("get")
-        .description("Get one WhatsApp account with limits, warm-up ramp state (account age + today's effective send floor), daily-reset timezone, and usage. <id> accepts an account id, connection id, or Unipile account id.")
+        .description("Get one WhatsApp account with limits, warm-up ramp state (account age + today's effective send ceiling), daily-reset timezone, and usage. Direct sends are warm-only; opted-in WhatsApp Sequences share these caps. <id> accepts an account id, connection id, or Unipile account id.")
         .argument("<id>", "WhatsApp account id, connection id, or Unipile account id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (id, options) => {
@@ -11386,18 +11553,18 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("whatsapp disconnect", options, () => requestOxygen(`/api/cli/whatsapp/accounts/${encodeURIComponent(id)}`, { method: "DELETE" }));
     }))
         .addCommand(new Command("limits")
-        .description("View and adjust per-account WhatsApp daily limits and the daily-reset timezone. The warm-up ramp is a non-bypassable floor on the message cap regardless of these values.")
+        .description("View and adjust per-account WhatsApp daily limits and the daily-reset timezone. The warm-up ramp is a non-bypassable ceiling on direct sends and opted-in Sequence actions.")
         .addCommand(new Command("get")
-        .description("Show current WhatsApp limits, the warm-up ramp state, daily-reset timezone, defaults, and safe maximums. <id> accepts an account id, connection id, or Unipile account id.")
+        .description("Show current WhatsApp limits, the warm-up ramp state, direct-versus-Sequence delivery policy, daily-reset timezone, defaults, and safe maximums. <id> accepts an account id, connection id, or Unipile account id.")
         .argument("<id>", "WhatsApp account id, connection id, or Unipile account id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (id, options) => {
         await handleAsyncAction("whatsapp limits get", options, () => requestOxygen(`/api/cli/whatsapp/accounts/${encodeURIComponent(id)}/limits`));
     }))
         .addCommand(new Command("set")
-        .description("Adjust per-account WhatsApp daily limits and the daily-reset timezone. Values are clamped to safe maximums; the warm-up ramp still floors the message cap. <id> accepts an account id, connection id, or Unipile account id.")
+        .description("Adjust per-account WhatsApp daily limits and the daily-reset timezone. Values are clamped to safe maximums; the warm-up ceiling still applies to direct and Sequence traffic. <id> accepts an account id, connection id, or Unipile account id.")
         .argument("<id>", "WhatsApp account id, connection id, or Unipile account id.")
-        .option("--messages-per-day <n>", "Daily WhatsApp messages cap (subject to the warm-up ramp floor).")
+        .option("--messages-per-day <n>", "Daily WhatsApp messages cap across direct and Sequence traffic (subject to the warm-up ceiling).")
         .option("--total-actions-per-day <n>", "Daily cap across all WhatsApp action types.")
         .option("--messages-reads-per-day <n>", "Daily cap on chat and message-history reads.")
         .option("--min-spacing-seconds <n>", "Minimum seconds between actions.")
@@ -12487,6 +12654,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--exclude-contacted", "Default every enroll into this sequence to cross-campaign exclusion — skip leads any OTHER active sequence is already contacting. A per-enroll `sequences enroll --exclude-contacted` / `--no-exclude-contacted` always overrides this default. Off by default.")
         .option("--no-exclude-contacted", "Turn the sequence-level exclude-contacted default back OFF (enrollments then exclude cross-campaign only when a call opts in).")
         .option("--stop-on-reply-scope <scope>", "Native-email reply stop: 'lead' (default) stops the replying enrollment; 'company_domain' also stops active enrollments at the same non-freemail company domain.")
+        .option("--include-unsubscribe-link", "Append OXYGEN's visible recipient-bound unsubscribe footer to first-touch cold emails. Explicit opt-in; off by default. Plain-text messages show the URL, while HTML messages show a linked Unsubscribe label.")
+        .option("--no-include-unsubscribe-link", "Do not append OXYGEN's visible unsubscribe footer (the default). Sends the authored body unchanged and never removes suppression from recipients who already opted out.")
         .option("--tracking-opens", "Turn open-pixel tracking ON for this sequence's native email sends (the default; injection still needs a verified tracking domain — see `oxygen domains tracking`).")
         .option("--no-tracking-opens", "Turn OFF the open pixel for this sequence's native email sends (a deliverability knob — a pixel is spam-filter surface).")
         .option("--tracking-clicks", "Turn click-link tracking ON for this sequence's native email sends (the default; same verified-tracking-domain gate as opens).")
@@ -12555,7 +12724,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }
     }))
         .addCommand(new Command("update")
-        .description("Update a sequence. Journey structure/channels/email binding are draft-only so revised scope receives a fresh launch approval; a started sequence may only re-time waits it already has (clear a delay by zeroing it, never by deleting the step — enrollments track position by index); sender pools can change while draft or paused; launch caps change through `sequences start` after first start. Name, throttles, tags, and open/click tracking toggles remain editable as allowed by the server. Pass only the fields you want to change.")
+        .description("Update a sequence. Journey structure/channels/email binding are draft-only so revised scope receives a fresh launch approval; a started sequence may only re-time waits it already has (clear a delay by zeroing it, never by deleting the step — enrollments track position by index); sender pools can change while draft or paused; launch caps change through `sequences start` after first start. Name, throttles, tags, the default-off visible unsubscribe footer, and open/click tracking toggles remain editable as allowed by the server. Pass only the fields you want to change.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--name <name>", "New human-readable sequence name.")
         .option("--steps-file <path>", "Draft only: path to a JSON file: { \"steps\": [...] } replacing the journey. Copy supports {{column}} interpolation; native email steps also expose {{sender_name}} / {{sender_first_name}} / {{sender_email}} from the sending mailbox (a same-named row column wins). A `branch` can also route on the lead's data with a data leaf { has_column: \"email\" } (true when that row_values column is non-empty; present:false for \"missing\").")
@@ -12587,6 +12756,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--exclude-contacted", "Default every enroll into this sequence to cross-campaign exclusion — skip leads any OTHER active sequence is already contacting. A per-enroll `sequences enroll --exclude-contacted` / `--no-exclude-contacted` always overrides this default. Off by default.")
         .option("--no-exclude-contacted", "Turn the sequence-level exclude-contacted default back OFF (enrollments then exclude cross-campaign only when a call opts in).")
         .option("--stop-on-reply-scope <scope>", "Native-email reply stop: 'lead' (default) stops the replying enrollment; 'company_domain' also stops active enrollments at the same non-freemail company domain.")
+        .option("--include-unsubscribe-link", "Append OXYGEN's visible recipient-bound unsubscribe footer to first-touch cold emails. Explicit opt-in; off by default. Plain-text messages show the URL, while HTML messages show a linked Unsubscribe label.")
+        .option("--no-include-unsubscribe-link", "Turn the visible unsubscribe footer OFF. Future first-touch emails send the authored body unchanged; existing suppression records remain enforced.")
         .option("--tracking-opens", "Turn open-pixel tracking ON for this sequence's native email sends (the default; injection still needs a verified tracking domain — see `oxygen domains tracking`).")
         .option("--no-tracking-opens", "Turn OFF the open pixel for this sequence's native email sends (a deliverability knob — a pixel is spam-filter surface).")
         .option("--tracking-clicks", "Turn click-link tracking ON for this sequence's native email sends (the default; same verified-tracking-domain gate as opens).")
@@ -12645,7 +12816,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     body.email = email;
             }
             if (Object.keys(body).length === 0) {
-                throw new Error("Provide at least one field to update (--name, --steps-file, --source-table, --channels, --senders, --tags, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, --send-window-file, --stop-on-reply-scope, --no-stop-on-bounce, --[no-]exclude-contacted, or --[no-]tracking-opens / --[no-]tracking-clicks).");
+                throw new Error("Provide at least one field to update (--name, --steps-file, --source-table, --channels, --senders, --tags, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, --send-window-file, --stop-on-reply-scope, --[no-]include-unsubscribe-link, --no-stop-on-bounce, --[no-]exclude-contacted, or --[no-]tracking-opens / --[no-]tracking-clicks).");
             }
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`, {
                 method: "PATCH",
@@ -12854,7 +13025,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("retry-deferred")
-        .description("Preview or re-ready pending outside-working-hours actions on a PAUSED sequence. Applying only resets the listed actions to now; it never sends, spends credits, resumes the sequence, or bypasses sender spacing/quotas.")
+        .description("Preview or re-ready pending actions deferred by LinkedIn working hours or an email send window on a PAUSED sequence. Email actions refresh their snapshotted window from the current campaign settings. Applying never sends, spends credits, resumes the sequence, or bypasses window/spacing/quota/cap checks.")
         .argument("<sequence>", "Paused sequence id or slug.")
         .option("--limit <n>", "Maximum actions to preview/retry (1-500, default 100).")
         .option("--approved", "Apply the bounded local retry. The sequence remains paused.")
@@ -12871,9 +13042,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("recover-capacity")
-        .description("Preview definitive no-effect terminal provider-capacity failures, or recover the exact signed scope on a PAUSED Sequence. Recovery only restores local action/enrollment state; it never sends, calls a provider, spends credits, or resumes dispatch.")
+        .description("Preview definitive no-effect terminal failures that Oxygen can replay safely: provider-capacity denials and exact allowlisted request-format defects. Recover the signed scope only on a PAUSED Sequence. Recovery restores local action/enrollment state; it never sends, calls a provider, spends credits, or resumes dispatch.")
         .argument("<sequence>", "Sequence id or slug. Preview may run while active; apply requires paused.")
-        .option("--limit <n>", "Maximum capacity-failure rows to inspect (1-5000, default 500). A truncated preview cannot be approved.")
+        .option("--limit <n>", "Maximum candidate failure rows to inspect (1-5000, default 500). A truncated preview cannot be approved.")
         .option("--approval-token <token>", "Exact unexpired token returned by the preview.")
         .option("--approved", "Apply the exact signed scope. Requires --approval-token; the Sequence remains paused.")
         .option("--json", "Print a JSON envelope.")
@@ -13194,7 +13365,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))));
     program.addCommand(new Command("suppressions")
-        .description("Unified do-not-contact controls for LinkedIn people, email addresses/domains, phones, and explicit company domain/LinkedIn identities. `import` preserves the legacy mixed-file contract; `import-identities` is the source-neutral typed endpoint; `hubspot lists|sync` arms additive list synchronization. Company DNC applies across Sequence channels and is never inferred from a person's email. Consumes 0 credits.")
+        .description("Unified do-not-contact controls for people and typed identities. `import-person` bundles one contact's email, LinkedIn, phone, and explicit company domain; `import` preserves the legacy mixed-file contract; `import-identities` is the integration-level typed endpoint; `hubspot lists|sync` arms additive synchronization. Company DNC applies across Sequence channels and is never inferred from a person's email. Consumes 0 credits.")
         .addCommand(new Command("list")
         .description("List the org's do-not-contact suppressions, newest first. Filter by --reason or by --search (case-insensitive substring of the lead provider id).")
         .option("--reason <reason>", "Filter by reason: manual, replied, unsubscribed, bounced, do_not_contact, friends.")
@@ -13350,6 +13521,47 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
+    }))
+        .addCommand(new Command("import-person")
+        .description("Import one person as one DNC subject with any combination of email, LinkedIn, E.164 phone, and an explicitly supplied company domain. The domain is company-wide and is never inferred from --email.")
+        .option("--name <name>", "Optional contact display name.")
+        .option("--email <address>", "Email address to suppress.")
+        .option("--linkedin <url_or_id>", "Public LinkedIn person URL or member id to suppress.")
+        .option("--phone <e164>", "Strict E.164 phone number to suppress.")
+        .option("--domain <domain>", "Explicit company-wide domain block. This affects every Sequence channel.")
+        .option("--reason <reason>", "Suppression reason; manual by default and valid for every bundled identifier.")
+        .option("--source <text>", "Optional provenance stored on every identifier.")
+        .option("--detail <text>", "Optional note stored on every identifier.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions import-person", options, () => {
+            const name = readOption(options.name);
+            const email = readOption(options.email);
+            const linkedin = readOption(options.linkedin);
+            const phone = readOption(options.phone);
+            const domain = readOption(options.domain);
+            if (!email && !linkedin && !phone && !domain) {
+                throw new Error("Provide at least one of --email, --linkedin, --phone, or --domain.");
+            }
+            const reason = readOption(options.reason);
+            const source = readOption(options.source);
+            const detail = readOption(options.detail);
+            return requestOxygen("/api/cli/suppressions/import", {
+                method: "POST",
+                body: {
+                    people: [{
+                            ...(name ? { name } : {}),
+                            ...(email ? { email } : {}),
+                            ...(linkedin ? { linkedin_url: linkedin } : {}),
+                            ...(phone ? { phone } : {}),
+                            ...(domain ? { company_domain: domain } : {}),
+                            ...(reason ? { reason } : {}),
+                            ...(source ? { source } : {}),
+                            ...(detail ? { detail } : {}),
+                        }],
+                },
+            });
+        });
     }))
         .addCommand(new Command("phones")
         .description("List phone suppressions (strict E.164) used by call, WhatsApp, and Sequence safety gates.")
@@ -15214,8 +15426,10 @@ Run completion:
         .option("--tag <tag>", "Only workflows carrying this workspace tag (see `oxygen tags list`).")
         .option("--node-testable", "Only canonical graph workflows, the ones `workflows call --node` can scope a test to. Legacy recipes and v1 step lists own their own execution order and are excluded.")
         .option("--search <text>", "Match on name, slug, trigger event, or an integration the workflow uses — so \"meeting\" or \"hubspot\" finds it without knowing what someone named it.")
+        .option("--limit <n>", "Maximum workflows to list. Defaults to 200; hard cap is 1000.")
+        .option("--all", "List every workflow instead of the most-recently-updated window.")
         .option("--json", "Print a JSON envelope.")
-        .addHelpText("after", "\nEach row carries `format` (graph, recipe or steps) and `nodeTestable`, so you can tell which workflows support single-step testing without opening them.\n")
+        .addHelpText("after", "\nEach row carries `format` (graph, recipe or steps) and `nodeTestable`, so you can tell which workflows support single-step testing without opening them.\nLists the 200 most recently updated workflows by default; `capped` in the JSON envelope says when there are more.\n")
         .action(async (options) => {
         await handleAsyncAction("workflows list", options, async () => {
             const params = new URLSearchParams();
@@ -15227,10 +15441,17 @@ Run completion:
             const search = readOption(options.search);
             if (search)
                 params.set("search", search);
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            if (options.all)
+                params.set("all", "true");
             const qs = params.toString() ? `?${params.toString()}` : "";
             const data = await requestOxygen(`/api/cli/workflows${qs}`);
-            if (!options.json)
+            if (!options.json) {
                 writeDisabledWorkflowNotices(data);
+                writeListCapNotice(data, "workflow(s)");
+            }
             return data;
         });
     }))
@@ -16625,6 +16846,69 @@ function writeCopilotTurnCreditsSummary(data, turnId) {
 // notice. billing_settled is intentionally silent (its spend lands in the
 // end-of-turn credits summary); tool_call_* surface as brief progress so a turn
 // that pauses on a slow capability does not look frozen.
+/**
+ * The plan as a person reads it.
+ *
+ * `copilot get` has no human renderer at all -- both its branches call writeJson,
+ * so --json only decides whether the payload is wrapped in an envelope. This leaf
+ * exists because "how far along is it" is a question a JSON dump answers badly,
+ * and because the same projection has to be legible on all three surfaces.
+ */
+function writeCopilotPlan(plan, webUrl) {
+    if (!isRecord(plan)) {
+        process.stdout.write("No plan yet. The copilot publishes one for multi-step work; a short answer finishes without planning.\n");
+        return;
+    }
+    const progress = isRecord(plan.progress) ? plan.progress : {};
+    const eta = isRecord(plan.eta) ? plan.eta : {};
+    const steps = Array.isArray(plan.steps) ? plan.steps : [];
+    const lines = [];
+    if (typeof plan.summary === "string" && plan.summary)
+        lines.push(plan.summary, "");
+    lines.push(`${progress.done ?? 0}/${progress.total ?? 0} steps done${formatPlanEta(eta, plan.turnActive !== false)}`, "");
+    for (const step of steps) {
+        if (!isRecord(step))
+            continue;
+        const status = String(step.status ?? "pending");
+        const mark = status === "done" ? "[x]" : status === "in_progress" ? "[>]" : status === "blocked" ? "[!]" : "[ ]";
+        const timing = status === "done"
+            ? formatPlanDuration(step.elapsedMs)
+            : typeof step.etaSeconds === "number" ? `~${formatCopilotPlanSeconds(step.etaSeconds)} left` : "";
+        lines.push(`${mark} ${String(step.title ?? "")}${timing ? `  (${timing})` : ""}`);
+        for (const sub of Array.isArray(step.substeps) ? step.substeps : []) {
+            if (!isRecord(sub))
+                continue;
+            const subStatus = String(sub.status ?? "pending");
+            const subMark = subStatus === "done" ? "-" : subStatus === "blocked" ? "!" : ">";
+            const subTiming = formatPlanDuration(sub.durationMs);
+            lines.push(`      ${subMark} ${String(sub.title ?? "")}${subTiming ? `  (${subTiming})` : ""}`);
+        }
+    }
+    if (typeof webUrl === "string" && webUrl)
+        lines.push("", webUrl);
+    process.stdout.write(`${lines.join("\n")}\n`);
+}
+/** Every estimate names its basis, so nobody reads a guess as a measurement. */
+function formatPlanEta(eta, turnActive) {
+    // Nothing is running, so nothing REMAINS. "estimating" on a session that stopped
+    // weeks ago describes work in flight that does not exist; the step marks still
+    // say where the copilot got to, which is the honest half of the answer.
+    if (!turnActive)
+        return "";
+    const remaining = typeof eta.remainingSeconds === "number" ? eta.remainingSeconds : null;
+    if (remaining === null)
+        return " · time remaining: estimating";
+    const measured = typeof eta.measuredSteps === "number" ? eta.measuredSteps : 0;
+    const basis = eta.basis === "calibrated" || eta.basis === "measured"
+        ? `measured from ${measured} completed step${measured === 1 ? "" : "s"}`
+        : eta.basis === "model" ? "estimated, nothing measured yet" : "no basis";
+    const bound = eta.deadlineBound === true ? ", capped by the turn deadline" : "";
+    return ` · ~${formatCopilotPlanSeconds(remaining)} left (${basis}${bound})`;
+}
+/** Narrows the untyped ledger value, then defers to the one shared formatter. */
+function formatPlanDuration(ms) {
+    return (typeof ms === "number" ? formatCopilotPlanDuration(ms) : null) ?? "";
+}
 function printCopilotEvent(event, sessionId) {
     if (!isRecord(event))
         return;
@@ -16658,6 +16942,19 @@ function printCopilotEvent(event, sessionId) {
                 + `Approve with: ${resolveCliBinaryName()} copilot approve ${sessionId} ${approvalId}\n`);
             return;
         }
+        case "plan_updated": {
+            // The plan is the one event that says how far along the turn is, and it was
+            // the only kind this printer dropped -- a `copilot send` streamed every tool
+            // call it made and never once said what it was working towards.
+            const steps = Array.isArray(payload.steps) ? payload.steps : [];
+            const done = steps.filter((step) => isRecord(step) && normalizeCopilotPlanStepStatus(step.status) === "done").length;
+            const current = steps.find((step) => isRecord(step) && normalizeCopilotPlanStepStatus(step.status) === "in_progress");
+            const title = isRecord(current)
+                ? String(current.title ?? current.description ?? "").trim()
+                : "";
+            process.stderr.write(`\n[plan] ${done}/${steps.length} done${title ? ` — now: ${title}` : ""}\n`);
+            return;
+        }
         case "fallback_engaged": {
             const from = typeof payload.from === "string" ? payload.from : "?";
             const to = typeof payload.to === "string" ? payload.to : "?";
@@ -23301,7 +23598,9 @@ options, orgOverride) {
         }
         // Generated summaries come from the server's own projections, not a client-side
         // recomputation. A real wiki page may own the `index`/`log` slug — page bytes win.
-        const index = await requestOxygen("/api/cli/knowledge/index", requestOrg);
+        // `all=true` on purpose: the generated index.md must list every page this
+        // mirror just cloned, and the route's default is a 200-page window.
+        const index = await requestOxygen("/api/cli/knowledge/index?all=true", requestOrg);
         const logPage = await requestOxygen("/api/cli/knowledge/log", {
             method: "POST",
             body: {},
@@ -23808,7 +24107,7 @@ function readNonNegativeInt(value) {
     if (!trimmed)
         return undefined;
     const parsed = Number(trimmed);
-    if (!Number.isInteger(parsed) || parsed < 0) {
+    if (!Number.isSafeInteger(parsed) || parsed < 0) {
         throw new OxygenError("invalid_number", "Expected a non-negative integer.", {
             details: { value },
             exitCode: 1,
@@ -23855,6 +24154,12 @@ function readSequenceSettings(options) {
     if (options.excludeContacted !== undefined) {
         settings.exclude_contacted = options.excludeContacted;
     }
+    // A visible footer mutates outbound copy, so it is opt-in and tri-state:
+    // absent leaves the stored value alone; either explicit flag persists the
+    // chosen boolean. Missing/false is interpreted as OFF by the dispatcher.
+    if (options.includeUnsubscribeLink !== undefined) {
+        settings.include_unsubscribe_link = options.includeUnsubscribeLink;
+    }
     const stopOnReplyScope = readOption(options.stopOnReplyScope);
     if (stopOnReplyScope)
         settings.stop_on_reply_scope = stopOnReplyScope;