@oxygen-agent/cli 1.906.0 → 1.922.12

package/dist/index.js

@@ -9,7 +9,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, CommanderError, Option } from "commander";
 import { applyOxygenHelp } from "./help.js";
 import { buildCommandManifest, getCommandManifestEntry, searchCommandManifest, suggestCommandNames, } from "./command-manifest.js";
-import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, KNOWLEDGE_BOOTSTRAP_MAX_CREDITS, MAX_MCP_TOOL_NAME_LENGTH, normalizeCopilotPlanStepStatus, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferUserCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TABLE_IMPORT_ROW_LIMIT, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
+import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatCopilotPlanDuration, formatCopilotPlanSeconds, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, KNOWLEDGE_BOOTSTRAP_MAX_CREDITS, MAX_MCP_TOOL_NAME_LENGTH, normalizeCopilotPlanStepStatus, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferUserCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TABLE_IMPORT_ROW_LIMIT, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { TAG_COLORS } from "@oxygen/shared/select-options";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, parseXlsxWorkbookBuffer, } from "@oxygen/shared/file-import";
 import { MAILBOX_IMPORT_FILE_MAX_BYTES as SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES, MAILBOX_IMPORT_ROW_LIMIT as SHARED_MAILBOX_IMPORT_ROW_LIMIT, normalizeMailboxImportFile as normalizeSharedMailboxImportFile, normalizeMailboxImportVendor as normalizeSharedMailboxImportVendor, normalizeMailboxWorkbookRows, parseMailboxImportText, summarizeMailboxImportValidation as summarizeSharedMailboxImportValidation, } from "@oxygen/shared/mailbox-import";
@@ -416,6 +416,11 @@ function emitSuccess(command, data, options) {
 async function handleAsyncAction(command, options, action) {
     try {
         const data = await action();
+        // BEFORE the envelope, deliberately: an unpaid renewal or a recurring shortfall is the
+        // reason the customer ran the command, and a warning printed after 150 lines of JSON
+        // has already scrolled away. stdout stays the clean machine-readable envelope — the
+        // same stdout/stderr split writeDryRunNotice and writeCreditsReceipt use.
+        writeBillingNotices(command, data);
         emitSuccess(command, data, options);
         writeDryRunNotice(data);
         writeAvatarWarning(data);
@@ -479,6 +484,57 @@ function writeAvatarWarning(data) {
     if (typeof warning === "string" && warning.trim())
         process.stderr.write(`${warning}\n`);
 }
+// The human half of the unpaid-renewal surfaces: `billing balance` warnings, the
+// `billing allowance` past_due segment, and the billing state of each managed domain in
+// `domains list`. All three are already in the JSON envelope (and stay there for --json);
+// these lines exist because none of them is legible at a glance in a payload, and the one
+// customer this shipped for could read every number in the product and still not learn
+// that 139,000 credits of renewals had failed.
+function writeBillingNotices(command, data) {
+    const payload = asPayloadRecord(data);
+    if (!payload)
+        return;
+    if (command === "billing balance") {
+        for (const warning of readWarningMessages(payload))
+            process.stderr.write(`! ${warning}\n`);
+        return;
+    }
+    if (command === "billing allowance") {
+        const unpaid = asPayloadRecord(payload.renewals_past_due);
+        if (!unpaid)
+            return;
+        const count = typeof unpaid.count === "number" ? unpaid.count : 0;
+        const credits = typeof unpaid.credits_required === "number" ? unpaid.credits_required : 0;
+        // Said explicitly because it is the one number in this command that is NOT part of the
+        // pool: it is money the biller could not take, so it is not in total_credits.
+        process.stderr.write(`! renewals unpaid: ${count} item${count === 1 ? "" : "s"}, ${credits.toLocaleString("en-US")} credits — not included in total_credits. Run \`oxygen billing balance\` for the top-up amount.\n`);
+        return;
+    }
+    if (command === "domains list") {
+        const managed = Array.isArray(payload.managed_domains) ? payload.managed_domains : [];
+        const unpaid = managed
+            .map((row) => asPayloadRecord(row))
+            .filter((row) => row?.internal_billing_status === "past_due")
+            .map((row) => (typeof row.domain === "string" ? row.domain : "unknown"));
+        if (unpaid.length === 0)
+            return;
+        // The vendor keeps these live, so their `status` still reads `active` — which is
+        // exactly why naming them is worth a line.
+        process.stderr.write(`! renewal unpaid on ${unpaid.length} managed domain${unpaid.length === 1 ? "" : "s"}: ${unpaid.join(", ")} (see internal_billing_status)\n`);
+    }
+}
+function readWarningMessages(payload) {
+    if (!Array.isArray(payload.warnings))
+        return [];
+    return payload.warnings
+        .map((warning) => asPayloadRecord(warning)?.message)
+        .filter((message) => typeof message === "string" && message.trim().length > 0);
+}
+function asPayloadRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
 // Paid envelopes (push 3 legibility) carry a `credits` block: quote on
 // dry_run, receipt on live, remaining balance on both. Mirror it as one
 // stderr line so spend stays visible in a terminal without polluting the
@@ -567,6 +623,72 @@ function writeObservabilityCapsNotice(data) {
         : Array.isArray(record.items) ? record.items.length : 0;
     process.stderr.write(`note: showing ${returned} item(s); some sources hit the per-source cap (${cappedSources.join(", ")}) — raise --limit (max 100) or filter --source to see more.\n`);
 }
+// Discovery lists are windowed by default (200 rows, max 1000) so the cost of
+// asking "what is in this workspace?" does not scale with how much the customer
+// has built. A window nobody can see is indistinguishable from a complete
+// answer, so say it on stderr — same treatment the observability console's
+// per-source cap already gets. Machine-read stdout carries `capped`, `returned`
+// and `limit` either way.
+function writeListCapNotice(data, noun) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const record = data;
+    if (record.capped !== true)
+        return;
+    const returned = typeof record.returned === "number" ? record.returned : null;
+    process.stderr.write(`note: showing ${returned === null ? "a window of" : returned} ${noun}; more exist — raise --limit (max 1000) or pass --all.\n`);
+}
+// The map is bounded twice over — a scan window per kind, then a character
+// budget across all of them — and both bounds are invisible in the rendered
+// output. Say them on stderr for the same reason every other cap here is said:
+// a window presented as a complete answer is a confident lie, and this one is
+// the first thing an agent or a person reads about a workspace. `degraded` gets
+// the same treatment: an empty kind that failed to read is not an empty kind.
+function writeWorkspaceMapNotices(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const record = data;
+    const degraded = Array.isArray(record.degraded) ? record.degraded : [];
+    if (degraded.length > 0) {
+        process.stderr.write(`note: could not read ${degraded.join(", ")} — those kinds are unknown, not empty.\n`);
+    }
+    const kinds = Array.isArray(record.kinds) ? record.kinds : [];
+    const capped = kinds
+        .filter((kind) => Boolean(kind) && typeof kind === "object" && !Array.isArray(kind) && kind.capped === true)
+        .map((kind) => String(kind.kind));
+    if (capped.length > 0) {
+        process.stderr.write(`note: ${capped.join(", ")} hold more than this scan saw; their counts are a floor. Narrow with --query or --tag.\n`);
+    }
+    const budget = record.budget;
+    if (budget && typeof budget === "object" && !Array.isArray(budget)) {
+        const trimmed = budget.trimmed;
+        if (Array.isArray(trimmed) && trimmed.length > 0) {
+            process.stderr.write(`note: the character budget trimmed ${trimmed.length} item(s) from ${[...new Set(trimmed.map(String))].join(", ")}.\n`);
+        }
+    }
+    const tagNote = record.tag_note;
+    if (typeof tagNote === "string" && tagNote)
+        process.stderr.write(`note: ${tagNote}\n`);
+}
+// The wiki index counts the whole wiki even when the page list is a window, so
+// name both numbers: "200 of 512 pages" is honest, "200 pages" is not.
+function writeKnowledgeIndexCapNotice(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const index = data.index;
+    if (!index || typeof index !== "object" || Array.isArray(index))
+        return;
+    const block = index;
+    if (block.capped !== true)
+        return;
+    const counts = block.counts;
+    const returned = typeof counts?.returned === "number" ? counts.returned : null;
+    const total = typeof counts?.total === "number" ? counts.total : null;
+    const shown = returned === null
+        ? "a window of this wiki's pages"
+        : `${returned}${total === null ? "" : ` of ${total}`} page(s)`;
+    process.stderr.write(`note: listing ${shown}, most recently updated first; counts cover the whole wiki — raise --limit (max 1000) or pass --all.\n`);
+}
 // Arming a cron commits recurring spend, so `workflows enable` mirrors its
 // `automation` block as stderr lines: what the schedule burns per day, what
 // share of the monthly allowance that is, and when it runs out. Observed burn
@@ -2648,6 +2770,38 @@ export function createProgram() {
         .action(async (options) => {
         await handleAsyncAction("home standup", options, readHomeStandup);
     });
+    // `oxygen workspace map` sits beside `oxygen home` on purpose: home answers
+    // "what needs me", the map answers "what is in here". Both are Control-surface
+    // compositions over reads the primitives already own — neither is a primitive.
+    program
+        .command("workspace")
+        .description("Read what this workspace contains, across every primitive.")
+        .addCommand(new Command("map")
+        .description("What this workspace actually contains: the newest tables, CRM objects, sequences, workflows, agents, wiki pages, posts and projects, each with its id, last activity, tags and link. Read-only, 0 credits. Capability search tells you what OXYGEN can do; this tells you what is here.")
+        .option("--kind <kinds>", "Comma-separated kinds to include: table, crm_object, sequence, workflow, agent, knowledge_page, post, project.")
+        .option("--tag <tag>", "Only objects carrying this workspace tag. Answered by the Tags footprint read, so it also covers kinds this map does not model.")
+        .option("--query <text>", "Match on name, slug, or tag.")
+        .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", "\nEach kind returns its newest few objects under a character budget the payload echoes back; `capped` says when a kind holds more than the scan saw. Hydrate one object with its own primitive's read (`oxygen tables describe`, `oxygen workflows get`, `oxygen knowledge page get`).\n\nRead-only means read-only: the map creates nothing in your workspace in order to answer, so an empty wiki reports zero pages rather than a starter set this command seeded. Use `oxygen knowledge index` when you do want the starter wiki created.\n")
+        .action(async (options) => {
+        await handleAsyncAction("workspace map", options, async () => {
+            const params = new URLSearchParams();
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
+            const tag = readOption(options.tag);
+            if (tag)
+                params.set("tag", tag);
+            const query = readOption(options.query);
+            if (query)
+                params.set("query", query);
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            const data = await requestOxygen(`/api/cli/workspace/map${qs}`);
+            if (!options.json)
+                writeWorkspaceMapNotices(data);
+            return data;
+        });
+    }));
     const ACTIVATION_DESCRIPTION = "Where this workspace stands in the prescribed activation play (inbound-led outbound) and the ONE thing to do next: each step's state, what blocks a blocked one, the exact CLI / MCP tool / API call for the next step, and an honest pacing note — LinkedIn is read on a metered drip and a sender's warm-up ramp, not the size of your list, sets how fast anyone is contacted. Read-only, 0 credits. Read the play itself with `oxygen recipes list --stage day-1 --json`.";
     // Bare `oxygen activation` is the spelling a founder guesses; `activation state`
     // is the exact name discovery routes to (it is a gatewayCommand of the
@@ -3520,6 +3674,17 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: { tags: splitCommaList(options.tags) },
         }));
+    }))
+        .addCommand(new Command("color")
+        .description("Set a project's colour in the Tables rail. `--color auto` restores the automatic colour.")
+        .argument("<project>", "Project slug or id.")
+        .requiredOption("--color <color>", "Colour name (gray, red, orange, amber, yellow, green, teal, blue, indigo, purple, pink) or `auto` to clear.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (project, options) => {
+        await handleAsyncAction("projects color", options, () => requestOxygen(`/api/cli/projects/${encodeURIComponent(project)}/color`, {
+            method: "POST",
+            body: { color: options.color?.trim().toLowerCase() ?? null },
+        }));
     }));
     program
         .command("notetaker")
@@ -5038,9 +5203,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--project <project>", "Project id or slug to filter by.")
         .option("--tag <tag>", "Only tables carrying this workspace tag (see `oxygen tags list`).")
         .option("--include-archived", "Also list archived and delete-scheduled tables (the restorable trash; each carries a lifecycle with purge_scheduled_at).")
+        .option("--limit <n>", "Maximum tables to list. Defaults to 200; hard cap is 1000.")
+        .option("--all", "List every table instead of the newest window.")
         .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", "\nLists the 200 newest tables by default; `capped` in the JSON envelope says when there are more.\n")
         .action(async (options) => {
-        await handleAsyncAction("tables list", options, () => {
+        await handleAsyncAction("tables list", options, async () => {
             const params = new URLSearchParams();
             const project = readOption(options.project);
             if (project)
@@ -5050,8 +5218,16 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 params.set("tag", tag);
             if (options.includeArchived)
                 params.set("include_archived", "true");
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            if (options.all)
+                params.set("all", "true");
             const qs = params.toString() ? `?${params.toString()}` : "";
-            return requestOxygen(`/api/cli/tables${qs}`);
+            const data = await requestOxygen(`/api/cli/tables${qs}`);
+            if (!options.json)
+                writeListCapNotice(data, "table(s)");
+            return data;
         });
     }))
         .addCommand(new Command("query")
@@ -5375,7 +5551,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--on <column>", "Pin one table's column by name or key. Oxygen must still find a compatible column on the other table: generic text needs a strongly similar label, while domains, emails, LinkedIn URLs, and external IDs pair by semantic role.")
         .option("--approved", "Queue the bulk link after inspecting the preview; then wait with `oxygen table-runs wait <run_id>`.")
         .option("--create-missing", "Also create target rows for unmatched source keys (CRM records when filling an existing CRM relationship). Free.")
-        .option("--max-concurrency <n>", "Maximum concurrent row items for the run. Defaults to 50; native --create-missing runs serialize target-row creation safely.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items for the run (1-250). Defaults to 250; native --create-missing runs serialize target-row creation safely.")
         .option("--undo <run_id>", "Undo a previous link run, archiving only the links that run created.")
         .option("--relation <slug>", "Row form: relation slug defined on the source table, such as client.")
         .option("--target-row-id <row_id>", "Row form: target row id in the related table.")
@@ -5462,7 +5638,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--row-id <id...>", "Promote only these row ids. Defaults to every bound row.")
         .option("--dry-run", "Preview per-field would_fill/would_overwrite/conflicts without writing (the default when --approved is absent).")
         .option("--approved", "Confirm the truth write onto CRM records after inspecting the preview.")
-        .option("--max-concurrency <n>", "Maximum concurrent row items for the run. Defaults to 50.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items for the run (1-250). Defaults to 50.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, options) => {
         if (options.dryRun && options.approved) {
@@ -6242,10 +6418,24 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("index")
-        .description("Compact wiki index: every page's slug, one-liner, tags, link degree, plus type/status counts.")
+        .description("Compact wiki index: each page's slug, one-liner, tags, link degree, plus type/status counts over the whole wiki. Lists the 200 most recently updated pages by default.")
+        .option("--limit <n>", "Maximum pages to list. Defaults to 200; hard cap is 1000. Counts always cover the whole wiki.")
+        .option("--all", "List every page instead of the most recently updated window.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("knowledge index", options, () => requestOxygen("/api/cli/knowledge/index"));
+        await handleAsyncAction("knowledge index", options, async () => {
+            const params = new URLSearchParams();
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            if (options.all)
+                params.set("all", "true");
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            const data = await requestOxygen(`/api/cli/knowledge/index${qs}`);
+            if (!options.json)
+                writeKnowledgeIndexCapNotice(data);
+            return data;
+        });
     }))
         .addCommand(new Command("graph")
         .description("Knowledge graph of pages and their [[wikilink]] edges. Pass --center to render one page's local neighborhood instead of the whole graph.")
@@ -7394,8 +7584,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--connection-id <connection_id>", "Optional provider integration connection id.")
         .option("--background", "Create a durable background run for a free deterministic column. Paid AI/tool/enrichment/custom-HTTP server runs are always backgrounded.")
         .option("--approved", "Confirm a paid durable run, or a bind create-mode run (onNoMatch=create), after inspecting a dry run or preview.")
+        .option("--approved-effect-unknown", "With --row-id, allow rerunning a cell whose previous external write was dispatched but never confirmed. Verify the destination first: this can apply the same external effect twice.")
         .option("--max-credits <n>", "Maximum managed model/provider/web-grounding credits to reserve. BYOK covers the model call only; managed grounding still needs this ceiling.")
-        .option("--max-concurrency <n>", "Maximum concurrent row items for a background run. Defaults to 250 for AI columns and 50 otherwise.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items for a background run (1-250). Defaults to 250 for AI columns and 50 otherwise (160 for Firecrawl scrape columns).")
         .option("--local", "Run a custom HTTP column in this CLI process so env-var secrets stay local.")
         .option("--local-concurrency <n>", "Maximum concurrent custom HTTP requests for --local. Defaults to 3.")
         .option("--dry-run", "Preview resolved model, credit estimate, run-condition posture, and — for an AI column — the prompt rendered with one real row's values, without spending any credits.")
@@ -7460,6 +7651,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
                 ...(options.background ? { background: true } : {}),
                 ...(options.approved ? { approved: true } : {}),
+                ...(options.approvedEffectUnknown ? { approved_effect_unknown: true } : {}),
                 ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
                 ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
                 ...(options.dryRun ? { dry_run: true } : {}),
@@ -7828,7 +8020,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .command("table-runs")
         .description("Durable background table action run commands.")
         .addCommand(new Command("create")
-        .description("Create a durable background run for table tool-column actions.")
+        .description("Create a durable background run for table tool-column actions. Large runs are accepted immediately and their rows are prepared in the background (execution_status 'planning'); follow with `table-runs wait <run_id>`.")
         .argument("<table>", "Table id or slug.")
         .option("--column <column>", "Column id or key for a single tool-column action.")
         .option("--actions-json <json>", "JSON array of actions, each with type tool_column and column.")
@@ -7841,7 +8033,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--connection-id <connection_id>", "Optional provider integration connection id.")
         .option("--approved", "Confirm the paid table action run after inspecting a dry run or preview.")
         .option("--max-credits <n>", "Maximum managed/provider credits to reserve for this run.")
-        .option("--max-concurrency <n>", "Maximum concurrent row items for this run.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items for this run (1-250). Defaults to 50 (160 for Firecrawl scrape columns).")
         .option("--metadata-json <json>", "Optional metadata object to attach to the run.")
         .option("--then-json <json>", "JSON array of sequential follow-up steps. Each step runs after the previous terminates with completed or completed_with_errors. Paid steps require selection and max_credits. Shape: [{actions:[{type:'tool_column',column}],selection,force,max_concurrency,max_credits,metadata,run_on_failure}].")
         .option("--json", "Print a JSON envelope.")
@@ -7946,6 +8138,24 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: {},
         }));
+    }))
+        .addCommand(new Command("effect-unknown")
+        .description("List the items of a run whose external write was dispatched but never confirmed. Oxygen will not retry them on its own: verify each destination, then record what you found with `oxygen cells resolve`.")
+        .argument("<run_id>", "Table action run UUID.")
+        .option("--include-resolved", "Also list items whose outcome a human has already recorded.")
+        .option("--limit <n>", "Maximum items to return. Defaults to 200.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-runs effect-unknown", options, () => {
+            const query = new URLSearchParams();
+            const limit = readPositiveInt(options.limit);
+            if (limit)
+                query.set("limit", String(limit));
+            if (options.includeResolved)
+                query.set("include_resolved", "true");
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}/effect-unknown${suffix}`);
+        });
     }))
         .addCommand(new Command("retry-failed")
         .description("Requeue failed items for a durable table action run. Items with an unconfirmed external effect stay blocked until their destination is verified and explicitly approved.")
@@ -8546,7 +8756,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("balance")
-        .description("Show the current plan, subscription entitlement, and managed credit balance: available and reserved credits, FIXED credits committed to recurring per-resource charges, and the FLEXIBLE free-to-spend remainder. After failed-payment grace expires, mutations stop while read/export and billing recovery remain available. Recovery: https://oxygen-agent.com/billing. Policy: https://oxygen-agent.com/docs/safety/billing.")
+        .description("Show the current plan, subscription entitlement, and managed credit balance: available and reserved credits, FIXED credits committed to recurring per-resource charges, and the FLEXIBLE free-to-spend remainder. `renewals_past_due` lists infrastructure renewals (managed-inbox domains, warm-ups) OXYGEN could NOT charge this month, what they cost, and the exact top-up that clears them — nothing is cancelled and billing retries automatically after a top-up. `warnings` also flags a recurring_shortfall when your connected infrastructure costs more per month than the plan grants. After failed-payment grace expires, mutations stop while read/export and billing recovery remain available. Recovery: https://oxygen-agent.com/billing. Policy: https://oxygen-agent.com/docs/safety/billing.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing balance", options, () => requestOxygen("/api/cli/billing/balance"));
@@ -8558,13 +8768,13 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("billing commitments", options, () => requestOxygen("/api/cli/billing/commitments"));
     }))
         .addCommand(new Command("seats")
-        .description("Show sending capacity per channel: how many seats are purchased, how many are grandfathered, how many senders are connected, and how many are left. Sending seats are what let you CONNECT a sender — a LinkedIn account, WhatsApp number, phone number, or email mailbox — and they are billed in dollars on their own subscription, separate from your plan and separate from credits. You do not need a plan to buy seats. A grandfathered value of null means unlimited for that channel. Email mailbox allocation is not counted here because mailboxes are tenant-scoped. Read-only, 0 Oxygen credits.")
+        .description("Show sending capacity per channel: how many seats are purchased, how many are grandfathered, how many senders are connected, and how many are left. Sending seats are what let you CONNECT a sender — a LinkedIn account, WhatsApp number, phone number, or email mailbox — and they are billed in dollars on their own subscription, separate from your plan and separate from credits. You do not need a plan to buy seats. A grandfathered value of null means unlimited for that channel. Email mailbox allocation is read from this workspace's own database; when it cannot be read, the email seat's allocated/available/can_connect read null and `email_sender_allocation` is `tenant_unavailable`. Read-only, 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing seats", options, () => requestOxygen("/api/cli/billing/seats"));
     })
         .addCommand(new Command("set")
-        .description("Set how many sending seats of one channel this workspace holds. The quantity is ABSOLUTE, not a delta: `--quantity 3` means you end up with three, so a retried command cannot buy extra. Increasing charges the card pro rata immediately; decreasing credits you pro rata. Reducing below the number of senders you have connected is REFUSED and names how many to disconnect first, because an orphaned sender is one you keep paying a provider for while Oxygen has stopped honouring it. Charges real money.")
+        .description("Set how many sending seats of one channel this workspace holds. The quantity is ABSOLUTE, not a delta: `--quantity 3` means you end up with three, so a retried command cannot buy extra. Increasing charges the card pro rata immediately; decreasing credits you pro rata. Reducing below the number of senders you have connected is REFUSED and names how many to disconnect first, because an orphaned sender is one you keep paying a provider for while Oxygen has stopped honouring it. An email_sender reduction is refused with `seat_allocation_unavailable` (503) while the workspace's mailbox count cannot be read; retry it in a moment. Charges real money.")
         .requiredOption("--seat-key <kind>", "linkedin, whatsapp, phone_number, or email_sender.")
         .requiredOption("--quantity <n>", "Total seats to hold for this channel, 0 or more.")
         .option("--json", "Print a JSON envelope.")
@@ -8584,7 +8794,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("billing invoices", options, () => requestOxygen("/api/cli/billing/invoices"));
     }))
         .addCommand(new Command("allowance")
-        .description("Show this billing cycle's credit pool as one breakdown: fixed spend, flexible spend, credits committed to the next renewal, and what is free to spend — the numbers behind the bar on the credit-usage page. The parts always sum to the total. fixed_spent_credits is what has ALREADY been charged this cycle, NOT your monthly run-rate — for the forward figure billed at the next renewal see `billing commitments`, which is normally much larger. reserved_credits is in-flight spend already carved out of free_to_spend_credits, so treat free_to_spend as the ceiling and free_to_spend minus reserved as what is genuinely uncommitted. Every segment carries region=fixed|flexible. Read-only, 0 Oxygen credits.")
+        .description("Show this billing cycle's credit pool as one breakdown: fixed spend, flexible spend, credits committed to the next renewal, and what is free to spend — the numbers behind the bar on the credit-usage page. The parts always sum to the total, with ONE deliberate exception: `renewals_past_due` (and its region=past_due segment) reports renewals that FAILED to charge, which is money not taken and therefore outside total_credits. fixed_spent_credits is what has ALREADY been charged this cycle, NOT your monthly run-rate — for the forward figure billed at the next renewal see `billing commitments`, which is normally much larger. reserved_credits is in-flight spend already carved out of free_to_spend_credits, so treat free_to_spend as the ceiling and free_to_spend minus reserved as what is genuinely uncommitted. Every segment carries region=fixed|flexible. Read-only, 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing allowance", options, () => requestOxygen("/api/cli/billing/allowance"));
@@ -9021,6 +9231,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const suffix = params.toString() ? `?${params.toString()}` : "";
             return requestOxygen(`/api/cli/admin/costs${suffix}`);
         });
+    }))
+        .addCommand(new Command("primary-providers")
+        .description("Board of the PRIMARY managed external data providers (enrichment, people/company search, web search, scraping, signals, AI-column web grounding, LLM inference): per provider health probe, 7d traffic, balance, 30d/7d COGS, rate policy, spend ceilings, breaker, and posture, plus the platform runaway guards. Read-only — never calls a provider. Staff only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("admin primary-providers", options, () => requestOxygen("/api/cli/admin/primary-providers"));
     }))
         .addCommand(new Command("spend")
         .description("Global managed-provider spend limiter: burn, ceilings, breakers. Staff only.")
@@ -9239,7 +9455,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         // the MCP tool enums. The API rejects any other value with
         // invalid_request so a typo fails loudly.
         .option("--type <type>", "Filter by operation or provider_request.")
-        .option("--source <source>", "Filter by cli, web, mcp, or provider.")
+        .option("--source <source>", "Filter by cli, web, mcp, workflow, or provider.")
         .option("--trace-id <trace_id>", "Filter by trace id.")
         .option("--run-id <run_id>", "Filter by workspace run id.")
         .option("--limit <n>", "Maximum events to return. Defaults to 50.")
@@ -9837,6 +10053,48 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
+    }))
+        .addCommand(new Command("resolve")
+        .description("Record what a human verified about a cell whose external write was dispatched but never confirmed. It records the outcome only; it never calls the provider again. Use not_applied when the write provably did not land (the cell becomes rerunnable) or applied when it did.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<row_id>", "Workspace row UUID.")
+        .argument("<column>", "Column id or key.")
+        .requiredOption("--outcome <outcome>", "applied (the external write landed) or not_applied (it never did).")
+        .option("--note <text>", "Short note about how the destination was verified.")
+        .option("--value <json>", "JSON value read off the destination, recorded into the cell. Only valid with --outcome applied.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, rowId, column, options) => {
+        const outcome = readOption(options.outcome);
+        if (outcome !== "applied" && outcome !== "not_applied") {
+            throw new OxygenError("invalid_effect_resolution_outcome", "--outcome must be applied or not_applied.", { exitCode: 1 });
+        }
+        const rawValue = readOption(options.value);
+        if (rawValue !== null && outcome !== "applied") {
+            throw new OxygenError("invalid_effect_resolution_value", "--value is only valid with --outcome applied; a not-applied effect wrote nothing.", { exitCode: 1 });
+        }
+        // Parsed locally so a malformed --value fails with a clear message
+        // instead of being posted as a JSON string the server would then
+        // faithfully write into the cell.
+        let value;
+        if (rawValue !== null) {
+            try {
+                value = JSON.parse(rawValue);
+            }
+            catch {
+                throw new OxygenError("invalid_json", `--value must be valid JSON. Quote a string as '"text"'.`, { exitCode: 1 });
+            }
+        }
+        await handleAsyncAction("cells resolve", options, () => requestOxygen("/api/cli/tables/cells/resolve", {
+            method: "POST",
+            body: {
+                table,
+                row_id: rowId,
+                column,
+                outcome,
+                ...(readOption(options.note) ? { note: readOption(options.note) } : {}),
+                ...(rawValue !== null ? { value } : {}),
+            },
+        }));
     }))
         .addCommand(new Command("history")
         .description("Show cell change history.")
@@ -10174,7 +10432,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--selection-json <json>", "Full row selection object for server-side row selection.")
         .option("--only-missing", "Queue rows missing the capability's normalized output when no explicit selection is passed.")
         .option("--force", "Re-run rows with an existing target enrichment value.")
-        .option("--max-concurrency <n>", "Maximum concurrent row items for this enrichment run. Defaults to 20.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items for this enrichment run (1-250). Defaults to 20.")
         .option("--json", "Print a JSON envelope.")
         .option("--approved", "Approve THIS run after inspecting `enrich-column preview` (free). Paid enrichment runs fail with approval_required (exit 7) without it.")
         .action(async (table, options) => {
@@ -12698,7 +12956,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("sequences get", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`));
     }))
         .addCommand(new Command("enroll")
-        .description("Enroll leads into a sequence. Enrolling spends no credits and sends nothing — dispatch only happens at `sequences start`. --from-table enrolls every not-yet-enrolled row of the sequence's bound source table (up to 500 per run; the response's from_table.has_more says whether to run again) — for a LinkedIn sequence the profile URL is read from the bound table's URL column, no pre-resolved provider ids needed. --leads-file enrolls an explicit JSON list { leads: [...] }: for an email/WhatsApp sequence a lead identified only by an email (row_values.email) or phone (row_values.phone) is auto-filed as a row in the sequence's leads table (auto-creating and binding one if there is none), deduped by email/phone, so no table has to exist first (the table is returned as leads_table with a web_url); a LinkedIn lead needs a lead_provider_id, a lead_profile_url, or a table_row_id whose row carries a LinkedIn URL. A CRM-only lead needs a stable table_row_id or lead_provider_id in addition to mapped row_values; a HubSpot contact id used in crm_task associations identifies the destination record, not the Oxygen enrollment. When the sequence is bound to a source table, a lead's table_row_id auto-snapshots that row's columns (incl. AI/tool outputs) into row_values for {{column}} copy — explicit row_values win. Idempotent per table row (and per email/phone for auto-filed leads). The org do-not-contact list is always enforced; --exclude-contacted and --suppress-list add further opt-in skips (reported under skipped_by_reason). Leads already owned by a sender account (from an earlier real send) are routed back to that same account; a lead owned by a sender NOT on this sequence is skipped (bound_to_other_sender) unless --ignore-sender-bindings.")
+        .description("Enroll leads into a sequence. Enrolling spends no credits and sends nothing — dispatch only happens at `sequences start`. --from-table enrolls every not-yet-enrolled row of the sequence's bound source table (up to 500 per run; the response's from_table.has_more says whether to run again) — for a LinkedIn sequence the profile is read from the bound table's URL column, where a full /in/ URL and a bare public handle carrying a hyphen or digit (ada-lovelace) both work, so no pre-resolved provider ids are needed; each handle Oxygen canonicalized is echoed in linkedin_handles_canonicalized (value + url) to check before start, and every row that still cannot be resolved is named in unresolved_linkedin_lead_details (row, value, reason) rather than only counted in unresolved_linkedin_leads. --leads-file enrolls an explicit JSON list { leads: [...] }: for an email/WhatsApp sequence a lead identified only by an email (row_values.email) or phone (row_values.phone) is auto-filed as a row in the sequence's leads table (auto-creating and binding one if there is none), deduped by email/phone, so no table has to exist first (the table is returned as leads_table with a web_url); a LinkedIn lead needs a lead_provider_id, a lead_profile_url (a /in/ URL or a bare public handle with a hyphen or digit), or a table_row_id whose row carries one of those. A CRM-only lead needs a stable table_row_id or lead_provider_id in addition to mapped row_values; a HubSpot contact id used in crm_task associations identifies the destination record, not the Oxygen enrollment. When the sequence is bound to a source table, a lead's table_row_id auto-snapshots that row's columns (incl. AI/tool outputs) into row_values for {{column}} copy — explicit row_values win. Idempotent per table row (and per email/phone for auto-filed leads). The org do-not-contact list is always enforced; --exclude-contacted and --suppress-list add further opt-in skips (reported under skipped_by_reason). Leads already owned by a sender account (from an earlier real send) are routed back to that same account; a lead owned by a sender NOT on this sequence is skipped (bound_to_other_sender) unless --ignore-sender-bindings.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--leads-file <path>", "Path to a JSON file: { \"leads\": [{ row_values: { email }, lead_name }] } for cold email; { lead_provider_id, lead_name, table_row_id, row_values } for LinkedIn/existing rows; CRM-only leads require table_row_id or a stable lead_provider_id alongside mapped row_values. A CRM association object id is not the enrollment identity. Exactly one of --leads-file or --from-table.")
         .option("--from-table", "Enroll every not-yet-enrolled row of the sequence's bound source table (up to 500 per run; re-run to continue). Exactly one of --leads-file or --from-table.")
@@ -13838,6 +14096,37 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
+    }))
+        .addCommand(new Command("exit")
+        .description("Leave OXYGEN with a managed domain INTACT: stop every OXYGEN renewal for it (inboxes, warm-up, inbox placement) at the end of the period already paid for, keep the domain, mailboxes, DNS, warm-up state and data exactly as they are, and record a handoff request. Nothing is cancelled, disconnected, or released — for that use `managed-inboxes cancel`. WITHOUT --approved prints the plan: each renewal line with the date it stops, what stays, and the vendor-carry note (OXYGEN keeps paying the inbox vendor for these mailboxes after that date until a human completes the handoff or you cancel). To record it, re-run with --approved AND --confirm <domain> echoing the domain exactly. The Google Workspace / registrar handoff itself is coordinated by a human with the vendor — this command records the request, it does not perform the transfer. --revoke resumes renewals on a domain whose exit was requested. Free, 0 Oxygen credits; re-running on an already-exited domain changes nothing (effect_outcome no_change).")
+        .argument("[domain]", "The managed domain to stop renewing. May also be passed as --domain.")
+        .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
+        .option("--contact <email>", "Who the human handoff should be coordinated with (recorded on the request).")
+        .option("--note <text>", "Free-text context for the handoff, e.g. where the mailboxes are moving.")
+        .option("--revoke", "Undo a recorded exit: renewals resume on the next cycle. Still needs --approved --confirm.")
+        .option("--approved", "Actually record the exit (or the revoke); otherwise the plan is printed.")
+        .option("--confirm <domain>", "Type the domain again to confirm. Required with --approved.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domainArg, options) => {
+        await handleAsyncAction("managed-inboxes exit", options, () => {
+            const domain = requireDomainArg(domainArg, options.domain);
+            const confirm = readOption(options.confirm);
+            const contact = readOption(options.contact);
+            const note = readOption(options.note);
+            return requestOxygen("/api/cli/managed-inboxes/exit", {
+                method: "POST",
+                body: {
+                    domain,
+                    ...(contact ? { contact } : {}),
+                    ...(note ? { note } : {}),
+                    ...(options.revoke ? { revoke: true } : {}),
+                    ...(options.approved ? { approved: true } : {}),
+                    // Sent verbatim, never defaulted to `domain` — same rule as cancel: the
+                    // echo only means something if a human (or an agent) typed it a second time.
+                    ...(confirm ? { confirm_domain: confirm } : {}),
+                },
+            });
+        });
     }))
         .addCommand(new Command("upload-avatar")
         .description("Host a one-off mailbox profile picture and print the URL to pass as profile_picture_url in --mailboxes JSON. For a reusable sender identity used by FUTURE --sender <id> orders, prefer `oxygen senders profiles set-photo <id> --file <path>` instead. The inbox vendor FETCHES the hosted URL when it provisions the mailbox, often long after the order, so it must be public and permanent. Uploads a PNG, JPEG, or WebP (max 8MB), then normalizes it to a metadata-free 400x400 PNG at a matching .png URL. This only hosts the image: it does not update a sender, place an order, call the inbox provider, or charge credits.")
@@ -14623,15 +14912,15 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     })));
     program.addCommand(new Command("deliverability")
-        .description("External email deliverability: fleet reputation health and DIRECTIONAL inbox-placement (spam) tests via EmailGuard or Zapmail. This group creates one-off placement probes; for continuous EmailGuard account monitoring use `oxygen mailboxes emailguard connect`. Placement tests are approval-gated paid runs (managed bills Oxygen credits; BYOK = 0 Oxygen credits — Zapmail BYOK bills your Zapmail wallet ~$2/test); fail closed with 409 when no health provider is connected.")
+        .description("External email deliverability: fleet reputation health and DIRECTIONAL inbox-placement (spam) tests via EmailGuard, Zapmail, or an explicitly configured SendKit dev canary. This group creates one-off placement probes; for continuous EmailGuard account monitoring use `oxygen mailboxes emailguard connect`. Placement tests are approval-gated paid runs (managed bills Oxygen credits; BYOK = 0 Oxygen credits — Zapmail BYOK bills your Zapmail wallet ~$2/test). SendKit is never auto-selected or generally available: it is a 0-credit, one-test canary for the configured eligible connected sender only.")
         .addCommand(new Command("placement-test")
         .description("Directional inbox-placement (spam) tests: create, separately approve EmailGuard's exact seed send, then poll results.")
         .addCommand(new Command("run")
-        .description("Create a placement test for one sending mailbox. Without --approved this returns a cost PREVIEW. EmailGuard creation returns exact seeds + phrase but sends nothing; next run `placement-test send <id>` to preview and approve that external email. Zapmail owns its probe delivery and completes async (2-24h).")
+        .description("Create a placement test for one sending mailbox. Without --approved this returns a cost PREVIEW. EmailGuard creation returns exact seeds + phrase but sends nothing; next run `placement-test send <id>` to preview and approve that external email. Zapmail owns its probe delivery and completes async (2-24h). SendKit requires explicit --provider sendkit plus --subject and --body, and is available only for the configured dev canary with an eligible connected sender. Its approval creates AND sends one probe with no separate send step: preview first, then re-run the same mailbox, provider, subject, and body with --approved --max-credits 0 --plan <plan_hash>.")
         .argument("<mailbox>", "Sending mailbox address to test (e.g. ada@send.acme.com).")
-        .option("--provider <provider>", "Health provider: emailguard or zapmail. Omit to auto-resolve — EmailGuard is the default for every mailbox; Zapmail is used only for Zapmail-hosted mailboxes when EmailGuard is not connected.")
-        .option("--subject <subject>", "Optional subject for the seed message (zapmail ignores it beyond labeling the test).")
-        .option("--body <text>", "Optional plain-text body for the seed message (ignored by zapmail).")
+        .addOption(new Option("--provider <provider>", "Health provider: emailguard, zapmail, or sendkit. Omit to auto-resolve EmailGuard/Zapmail. SendKit is never auto-selected and requires the configured dev canary sender.").choices(["emailguard", "zapmail", "sendkit"]))
+        .option("--subject <subject>", "Seed-message subject. Required with --provider sendkit; Zapmail ignores it beyond labeling the test.")
+        .option("--body <text>", "Plain-text seed-message body. Required with --provider sendkit; ignored by Zapmail.")
         .option("--approved", "Actually run the test (otherwise a preview is returned).")
         .option("--max-credits <n>", "Credit cap the caller accepts (must be >= credits_required for managed runs).")
         .option("--plan <hash>", "plan_hash from a fresh create preview (required with --approved).")
@@ -14699,7 +14988,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     program.addCommand(new Command("domains")
         .description("Cold-email domain management on the org's own Cloudflare account (BYOK): sync zones, inspect age/warmup/DNS health, check availability and pricing, and buy domains. Purchases bill your Cloudflare payment method, never Oxygen credits.")
         .addCommand(new Command("list")
-        .description("List the org's cached Cloudflare domains with cold-email metadata (age, mailboxes, warmup, sending volume, DNS health). Each row's `dns` object explains the status (ok, issues, not checked, check failed, partial check, no zone) with a reason and fix path; `managed_domains` lists InboxKit-managed bundle domains (vendor-registered + vendor-DNS'd — manage via `managed-inboxes`). Reads the cache only — run `domains sync` to refresh.")
+        .description("List the org's cached Cloudflare domains with cold-email metadata (age, mailboxes, warmup, sending volume, DNS health). Each row's `dns` object explains the status (ok, issues, not checked, check failed, partial check, no zone) with a reason and fix path; `managed_domains` lists InboxKit-managed bundle domains (vendor-registered + vendor-DNS'd — manage via `managed-inboxes`), each carrying `internal_billing_status` (ok|past_due) and `last_billed_cycle_key` — a domain the vendor keeps live can still be one OXYGEN could not renew. Reads the cache only — run `domains sync` to refresh.")
         .option("--status <status>", "Filter by zone status: unknown, initializing, pending, active, moved, or deleted.")
         .option("--registrar <registrar>", "Filter by registrar name.")
         .option("--q <text>", "Filter by domain substring.")
@@ -15292,8 +15581,10 @@ Run completion:
         .option("--tag <tag>", "Only workflows carrying this workspace tag (see `oxygen tags list`).")
         .option("--node-testable", "Only canonical graph workflows, the ones `workflows call --node` can scope a test to. Legacy recipes and v1 step lists own their own execution order and are excluded.")
         .option("--search <text>", "Match on name, slug, trigger event, or an integration the workflow uses — so \"meeting\" or \"hubspot\" finds it without knowing what someone named it.")
+        .option("--limit <n>", "Maximum workflows to list. Defaults to 200; hard cap is 1000.")
+        .option("--all", "List every workflow instead of the most-recently-updated window.")
         .option("--json", "Print a JSON envelope.")
-        .addHelpText("after", "\nEach row carries `format` (graph, recipe or steps) and `nodeTestable`, so you can tell which workflows support single-step testing without opening them.\n")
+        .addHelpText("after", "\nEach row carries `format` (graph, recipe or steps) and `nodeTestable`, so you can tell which workflows support single-step testing without opening them.\nLists the 200 most recently updated workflows by default; `capped` in the JSON envelope says when there are more.\n")
         .action(async (options) => {
         await handleAsyncAction("workflows list", options, async () => {
             const params = new URLSearchParams();
@@ -15305,10 +15596,17 @@ Run completion:
             const search = readOption(options.search);
             if (search)
                 params.set("search", search);
+            const limit = readPositiveInt(options.limit);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            if (options.all)
+                params.set("all", "true");
             const qs = params.toString() ? `?${params.toString()}` : "";
             const data = await requestOxygen(`/api/cli/workflows${qs}`);
-            if (!options.json)
+            if (!options.json) {
                 writeDisabledWorkflowNotices(data);
+                writeListCapNotice(data, "workflow(s)");
+            }
             return data;
         });
     }))
@@ -16722,7 +17020,7 @@ function writeCopilotPlan(plan, webUrl) {
     const lines = [];
     if (typeof plan.summary === "string" && plan.summary)
         lines.push(plan.summary, "");
-    lines.push(`${progress.done ?? 0}/${progress.total ?? 0} steps done${formatPlanEta(eta)}`, "");
+    lines.push(`${progress.done ?? 0}/${progress.total ?? 0} steps done${formatPlanEta(eta, plan.turnActive !== false)}`, "");
     for (const step of steps) {
         if (!isRecord(step))
             continue;
@@ -16730,7 +17028,7 @@ function writeCopilotPlan(plan, webUrl) {
         const mark = status === "done" ? "[x]" : status === "in_progress" ? "[>]" : status === "blocked" ? "[!]" : "[ ]";
         const timing = status === "done"
             ? formatPlanDuration(step.elapsedMs)
-            : typeof step.etaSeconds === "number" ? `~${formatPlanSeconds(step.etaSeconds)} left` : "";
+            : typeof step.etaSeconds === "number" ? `~${formatCopilotPlanSeconds(step.etaSeconds)} left` : "";
         lines.push(`${mark} ${String(step.title ?? "")}${timing ? `  (${timing})` : ""}`);
         for (const sub of Array.isArray(step.substeps) ? step.substeps : []) {
             if (!isRecord(sub))
@@ -16746,7 +17044,12 @@ function writeCopilotPlan(plan, webUrl) {
     process.stdout.write(`${lines.join("\n")}\n`);
 }
 /** Every estimate names its basis, so nobody reads a guess as a measurement. */
-function formatPlanEta(eta) {
+function formatPlanEta(eta, turnActive) {
+    // Nothing is running, so nothing REMAINS. "estimating" on a session that stopped
+    // weeks ago describes work in flight that does not exist; the step marks still
+    // say where the copilot got to, which is the honest half of the answer.
+    if (!turnActive)
+        return "";
     const remaining = typeof eta.remainingSeconds === "number" ? eta.remainingSeconds : null;
     if (remaining === null)
         return " · time remaining: estimating";
@@ -16755,19 +17058,11 @@ function formatPlanEta(eta) {
         ? `measured from ${measured} completed step${measured === 1 ? "" : "s"}`
         : eta.basis === "model" ? "estimated, nothing measured yet" : "no basis";
     const bound = eta.deadlineBound === true ? ", capped by the turn deadline" : "";
-    return ` · ~${formatPlanSeconds(remaining)} left (${basis}${bound})`;
-}
-function formatPlanSeconds(seconds) {
-    if (seconds < 60)
-        return `${Math.round(seconds)}s`;
-    const minutes = Math.floor(seconds / 60);
-    const rest = Math.round(seconds % 60);
-    return rest === 0 ? `${minutes}m` : `${minutes}m ${rest}s`;
+    return ` · ~${formatCopilotPlanSeconds(remaining)} left (${basis}${bound})`;
 }
+/** Narrows the untyped ledger value, then defers to the one shared formatter. */
 function formatPlanDuration(ms) {
-    if (typeof ms !== "number" || !Number.isFinite(ms) || ms <= 0)
-        return "";
-    return ms < 1000 ? `${Math.round(ms)}ms` : formatPlanSeconds(ms / 1000);
+    return (typeof ms === "number" ? formatCopilotPlanDuration(ms) : null) ?? "";
 }
 function printCopilotEvent(event, sessionId) {
     if (!isRecord(event))
@@ -23458,7 +23753,9 @@ options, orgOverride) {
         }
         // Generated summaries come from the server's own projections, not a client-side
         // recomputation. A real wiki page may own the `index`/`log` slug — page bytes win.
-        const index = await requestOxygen("/api/cli/knowledge/index", requestOrg);
+        // `all=true` on purpose: the generated index.md must list every page this
+        // mirror just cloned, and the route's default is a 200-page window.
+        const index = await requestOxygen("/api/cli/knowledge/index?all=true", requestOrg);
         const logPage = await requestOxygen("/api/cli/knowledge/log", {
             method: "POST",
             body: {},