@oxygen-agent/cli 1.922.14 → 1.948.1

package/dist/visual-commands.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+type JsonOptions = {
+    json?: boolean;
+};
+export declare function registerVisualCommands(program: Command, handle: (command: string, options: JsonOptions, action: () => Promise<unknown>) => Promise<void>): void;
+export {};

package/dist/visual-commands.js

@@ -0,0 +1,57 @@
+import { createHash } from "node:crypto";
+import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { OxygenError } from "@oxygen/shared";
+import { requestOxygen } from "./http-client.js";
+import { waitForVisualRender } from "./visual-render-wait.js";
+export function registerVisualCommands(program, handle) {
+    const visuals = program.command("visuals").description("Author, render, inspect and download GTM infographics using tenant workspace files and governed render jobs.");
+    visuals.command("source-create").description("Save an immutable HTML/CSS/SVG source revision; no code executes.")
+        .requiredOption("--name <name>", "Workspace filename.")
+        .requiredOption("--file <path>", "Local HTML source file (max 1.5 MB).")
+        .option("--parent-file-id <id>", "Previous source revision UUID.").option("--json", "Print a JSON envelope.")
+        .action((options) => handle("visuals source create", options, async () => {
+        if (statSync(options.file).size > 1_500_000)
+            throw new OxygenError("visual_source_limit", "HTML source must fit within 1.5 MB.");
+        const bytes = readFileSync(options.file);
+        if (bytes.length > 1_500_000)
+            throw new OxygenError("visual_source_limit", "HTML source must fit within 1.5 MB.");
+        return requestOxygen("/api/cli/visuals/sources", { method: "POST", body: { name: options.name, html: bytes.toString("utf8"), ...(options.parentFileId ? { parent_file_id: options.parentFileId } : {}) } });
+    }));
+    visuals.command("file-get <file-id>").description("Read source, file metadata, provenance and web/download links.").option("--json", "Print a JSON envelope.")
+        .action((id, options) => handle("visuals file get", options, () => requestOxygen(`/api/cli/visuals/files/${encodeURIComponent(id)}`)));
+    visuals.command("download <file-id>").description("Download a file with SHA-256 verification; refuses to overwrite existing local files.")
+        .requiredOption("--out <path>", "New local destination filename.").option("--json", "Print a JSON envelope.")
+        .action((id, options) => handle("visuals download", options, async () => {
+        const path = `/api/cli/visuals/files/${encodeURIComponent(id)}`;
+        const data = await requestOxygen(path);
+        const bytes = await requestOxygen(`${path}/download`, { binaryMaxBytes: Math.max(1, data.file.size_bytes) });
+        if (bytes.length !== data.file.size_bytes || createHash("sha256").update(bytes).digest("hex") !== data.file.sha256)
+            throw new OxygenError("file_integrity", "Downloaded bytes do not match the workspace file hash.");
+        writeFileSync(options.out, bytes, { flag: "wx", mode: 0o600 });
+        return { path: resolve(options.out), ...data.file };
+    }));
+    visuals.command("render-preview").description("Preview rendering without starting paid compute.")
+        .requiredOption("--source-file-ids <ids>", "Comma-separated HTML file UUIDs in page order.")
+        .option("--width <pixels>", "CSS pixel width.", "1080").option("--height <pixels>", "CSS pixel height.", "1350")
+        .option("--scale <1|2>", "PNG scale.", "1").option("--formats <png,pdf>", "Output formats.", "png")
+        .option("--json", "Print a JSON envelope.")
+        .action((options) => handle("visuals render preview", options, () => requestOxygen("/api/cli/visuals/renders", { method: "POST", body: { source_file_ids: options.sourceFileIds.split(",").map((s) => s.trim()), width: Number(options.width), height: Number(options.height), scale: Number(options.scale), formats: options.formats.split(",") } })));
+    visuals.command("render-start <render-id>").description("Approve an exact preview and enqueue one idempotent render job.")
+        .requiredOption("--scope-hash <hash>", "Exact preview scope hash.").requiredOption("--max-credits <credits>", "Approved ceiling from preview.")
+        .requiredOption("--approved", "Authorize this exact render.").option("--json", "Print a JSON envelope.")
+        .action((id, options) => handle("visuals render start", options, () => requestOxygen(`/api/cli/visuals/renders/${encodeURIComponent(id)}`, { method: "POST", body: { scope_hash: options.scopeHash, max_credits: Number(options.maxCredits), approved: options.approved } })));
+    visuals.command("render-get <render-id>").description("Read render state and output downloads; optionally wait for a terminal state.")
+        .option("--wait", "Poll every 2 seconds until completed, failed, cancelled or effect_unknown; starts no render.")
+        .option("--timeout-seconds <n>", "Maximum wait with --wait, from 1 to 600 seconds. Defaults to 180.")
+        .option("--json", "Print a JSON envelope.")
+        .action((id, options) => handle("visuals render get", options, async () => {
+        if (options.wait)
+            return waitForVisualRender(id, options.timeoutSeconds);
+        if (options.timeoutSeconds !== undefined)
+            throw new OxygenError("invalid_request", "Pass --wait with --timeout-seconds.");
+        return requestOxygen(`/api/cli/visuals/renders/${encodeURIComponent(id)}`);
+    }));
+    visuals.command("render-cancel <render-id>").description("Request cancellation; read state to verify it stopped.")
+        .option("--json", "Print a JSON envelope.").action((id, options) => handle("visuals render cancel", options, () => requestOxygen(`/api/cli/visuals/renders/${encodeURIComponent(id)}`, { method: "DELETE" })));
+}

package/dist/visual-render-wait.d.ts

@@ -0,0 +1,3 @@
+/** Poll only the existing job. Neither terminal failure nor timeout authorizes
+ * a start, retry, cancellation, or a new credit reservation. */
+export declare function waitForVisualRender(id: string, requestedTimeoutSeconds?: string): Promise<Record<string, unknown>>;

package/dist/visual-render-wait.js

@@ -0,0 +1,56 @@
+import { OxygenError } from "@oxygen/shared";
+import { readPositiveInt, readRecordString } from "./cli-values.js";
+import { requestOxygen } from "./http-client.js";
+import { waitForCliRun } from "./run-wait.js";
+const TERMINAL = new Set(["completed", "failed", "cancelled", "effect_unknown"]);
+const DEFAULT_TIMEOUT_SECONDS = 180;
+const MAX_TIMEOUT_SECONDS = 600;
+/** Poll only the existing job. Neither terminal failure nor timeout authorizes
+ * a start, retry, cancellation, or a new credit reservation. */
+export async function waitForVisualRender(id, requestedTimeoutSeconds) {
+    const timeoutSeconds = readPositiveInt(requestedTimeoutSeconds) ?? DEFAULT_TIMEOUT_SECONDS;
+    if (timeoutSeconds > MAX_TIMEOUT_SECONDS)
+        throw new OxygenError("invalid_number", "Visual render wait timeout must be between 1 and 600 seconds.");
+    const deadline = Date.now() + timeoutSeconds * 1000;
+    const controller = new AbortController();
+    let polls = 0;
+    let latestStatus = null;
+    const timedOut = () => new OxygenError("visual_render_wait_timeout", "Timed out waiting for the visual render. Read the same render ID again to continue checking.", {
+        details: { render_id: id, status: latestStatus, timeout_seconds: timeoutSeconds, polls }, exitCode: 1,
+    });
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => { controller.abort(); reject(timedOut()); }, timeoutSeconds * 1000);
+    });
+    try {
+        return await Promise.race([waitForCliRun({
+                runId: id, requestedTimeoutSeconds: String(timeoutSeconds),
+                defaultTimeoutSeconds: DEFAULT_TIMEOUT_SECONDS, defaultIntervalSeconds: 2,
+                fetchRun: async () => {
+                    const remainingMs = deadline - Date.now();
+                    if (controller.signal.aborted || remainingMs <= 0)
+                        throw timedOut();
+                    polls += 1;
+                    const data = await requestOxygen(`/api/cli/visuals/renders/${encodeURIComponent(id)}`, {
+                        method: "GET", timeoutMs: remainingMs, signal: controller.signal,
+                    });
+                    latestStatus = readRecordString(data.render, "status");
+                    if (latestStatus === "preview")
+                        throw new OxygenError("visual_render_not_started", "This render is still a preview. Start the approved render before waiting.", {
+                            details: { render_id: id, status: latestStatus },
+                        });
+                    if (!latestStatus || !(TERMINAL.has(latestStatus) || latestStatus === "queued" || latestStatus === "running")) {
+                        throw new OxygenError("invalid_response", "The render returned an unrecognized status.", { details: { render_id: id, status: latestStatus } });
+                    }
+                    return { ...data, status: latestStatus };
+                },
+                isTerminal: (status) => status !== null && TERMINAL.has(status),
+                shapeTerminal: (data, status, count, elapsedMs) => ({ ...data, status, terminal: true, polls: count, elapsedMs }),
+                timeoutCode: "visual_render_wait_timeout", timeoutMessage: "Timed out waiting for the visual render.", timeoutDetailIdKey: "render_id",
+            }), timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+        controller.abort();
+    }
+}

package/node_modules/@oxygen/shared/dist/byok-connect.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Which providers `oxygen integrations connect <id> --api-key <key>` ACTUALLY
+ * connects for native execution.
+ *
+ * WHY THIS EXISTS. `native_provider.execution.supports_byok` says a TOOL can run on
+ * a customer's own key. It does not say the customer has any way to give us one.
+ * Those are two different facts, and 9 of the 42 byok-capable native providers
+ * have the first without the second:
+ *
+ *   apify builtwith dropleads lusha openwebninja peopledatalabs
+ *   rocketreach theirstack wiza
+ *
+ * For those, `oxygen integrations connect <id> --api-key` does not reach
+ * `connectViaApiKey` at all. With no native catalog definition,
+ * `shouldConnectIntegrationViaComposio` is true, so the key is stored WITH COMPOSIO
+ * and no `integration_secrets` row of kind `api_key` is written. On the run path the
+ * tool is native generic-REST and `shouldRouteStaticToolThroughComposio` is false, so
+ * `resolveOptionalApiKeyCredentials` finds nothing and the call falls back to the
+ * MANAGED key — the very key that was out of credits. The command appears to work,
+ * changes nothing, and the customer is back where they started with no error. The
+ * connect route now refuses each of those nine with a typed `byok_connect_unavailable`
+ * rather than a silent Composio "success"; they stay OFF this list until one gains a
+ * real native connect form.
+ *
+ * That is precisely the failure Plain T-104 hit: `parallel.search` was one of the
+ * refused tools, and a refusal message that told Mentcape to connect their own Parallel
+ * key would once have sent them down a path that silently does nothing. Parallel now has
+ * a native api-key connect (catalog.ts) and IS on this list, so that message is finally
+ * true for it — the nine above are the ones it must still never name.
+ *
+ * So a message may only offer BYOK when BOTH halves hold, and this list is the second
+ * half. It lives in @oxygen/shared because the two sides that need it cannot see each
+ * other: `packages/integrations` writes the message, the catalog it would have to
+ * consult lives in `apps/web/src/lib/integrations/catalog.ts`, and packages never
+ * import from apps. `catalog.byok-connect.test.ts` in apps/web binds the two together
+ * so this list cannot drift from the connect forms it claims exist.
+ *
+ * ALLOWLIST, NOT DENYLIST, on purpose. A new provider that arrives without a connect
+ * form gets the alternatives-only message until someone adds it here — quieter than
+ * correct. A denylist would fail the other way: silently promising a connect form
+ * nobody built, which is the bug this fixes.
+ */
+export declare const NATIVE_API_KEY_CONNECT_INTEGRATION_IDS: ReadonlySet<string>;
+/**
+ * True when a customer can hand Oxygen their own key for this provider AND the
+ * native runner will use it. Never infer this from `supports_byok` alone.
+ */
+export declare function hasNativeApiKeyConnect(integrationId: string | null | undefined): boolean;

package/node_modules/@oxygen/shared/dist/byok-connect.js

@@ -0,0 +1,92 @@
+/**
+ * Which providers `oxygen integrations connect <id> --api-key <key>` ACTUALLY
+ * connects for native execution.
+ *
+ * WHY THIS EXISTS. `native_provider.execution.supports_byok` says a TOOL can run on
+ * a customer's own key. It does not say the customer has any way to give us one.
+ * Those are two different facts, and 9 of the 42 byok-capable native providers
+ * have the first without the second:
+ *
+ *   apify builtwith dropleads lusha openwebninja peopledatalabs
+ *   rocketreach theirstack wiza
+ *
+ * For those, `oxygen integrations connect <id> --api-key` does not reach
+ * `connectViaApiKey` at all. With no native catalog definition,
+ * `shouldConnectIntegrationViaComposio` is true, so the key is stored WITH COMPOSIO
+ * and no `integration_secrets` row of kind `api_key` is written. On the run path the
+ * tool is native generic-REST and `shouldRouteStaticToolThroughComposio` is false, so
+ * `resolveOptionalApiKeyCredentials` finds nothing and the call falls back to the
+ * MANAGED key — the very key that was out of credits. The command appears to work,
+ * changes nothing, and the customer is back where they started with no error. The
+ * connect route now refuses each of those nine with a typed `byok_connect_unavailable`
+ * rather than a silent Composio "success"; they stay OFF this list until one gains a
+ * real native connect form.
+ *
+ * That is precisely the failure Plain T-104 hit: `parallel.search` was one of the
+ * refused tools, and a refusal message that told Mentcape to connect their own Parallel
+ * key would once have sent them down a path that silently does nothing. Parallel now has
+ * a native api-key connect (catalog.ts) and IS on this list, so that message is finally
+ * true for it — the nine above are the ones it must still never name.
+ *
+ * So a message may only offer BYOK when BOTH halves hold, and this list is the second
+ * half. It lives in @oxygen/shared because the two sides that need it cannot see each
+ * other: `packages/integrations` writes the message, the catalog it would have to
+ * consult lives in `apps/web/src/lib/integrations/catalog.ts`, and packages never
+ * import from apps. `catalog.byok-connect.test.ts` in apps/web binds the two together
+ * so this list cannot drift from the connect forms it claims exist.
+ *
+ * ALLOWLIST, NOT DENYLIST, on purpose. A new provider that arrives without a connect
+ * form gets the alternatives-only message until someone adds it here — quieter than
+ * correct. A denylist would fail the other way: silently promising a connect form
+ * nobody built, which is the bug this fixes.
+ */
+export const NATIVE_API_KEY_CONNECT_INTEGRATION_IDS = new Set([
+    "adyntel",
+    "ai_ark",
+    "apollo",
+    "bettercontact",
+    "blitzapi",
+    "bounceban",
+    "breakcold",
+    "brightdata",
+    "clearoutphone",
+    "contactout",
+    "crustdata",
+    "discolike",
+    "exa",
+    "findymail",
+    "firecrawl",
+    "forager",
+    "fullenrich",
+    "getsales",
+    "hunter",
+    "icypeas",
+    "leadmagic",
+    "linkup",
+    "millionverifier",
+    // Connects through saveMoltsetsConnection rather than the generic save, but that
+    // service calls saveApiKeyIntegrationConnection with secretKind "api_key" like the
+    // rest — so the native runner does find the key.
+    "moltsets",
+    "ocean",
+    // Native api-key connect added in catalog.ts (2026-09-10): connect writes an
+    // integration_secrets api_key row the native parallel.* runner reads. T-104.
+    "parallel",
+    "predictleads",
+    "prospeo",
+    "scalelist",
+    // scraper: dev v1.920.2 added the HarvestAPI workspace-key connect (native api-key form).
+    "scraper",
+    "serper",
+    "signalbase",
+    "zapmail",
+    "zerobounce",
+]);
+/**
+ * True when a customer can hand Oxygen their own key for this provider AND the
+ * native runner will use it. Never infer this from `supports_byok` alone.
+ */
+export function hasNativeApiKeyConnect(integrationId) {
+    return typeof integrationId === "string"
+        && NATIVE_API_KEY_CONNECT_INTEGRATION_IDS.has(integrationId);
+}

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -3,6 +3,20 @@ import { RECIPE_PRIMITIVES } from "./recipes.js";
 // It is navigation, never execution: live schemas, prices, readiness, and
 // approval enforcement remain on the exact command/tool selected from here.
 export const OXYGEN_CAPABILITY_ROUTES = [
+    {
+        id: "visual-rendering",
+        layer: "Action",
+        primitive: null,
+        owns: "Agent-authored GTM infographics and carousel pages: editable HTML/CSS/SVG sources, isolated PNG/PDF rendering, actual visual inspection, revisions and downloads.",
+        notFor: "A separate product primitive, arbitrary package execution, image generation providers, motion/video, or publishing.",
+        execution: "Save source in workspace files; preview exact rendering scope and price; approve, poll the durable job, inspect its PNG pixels, revise and export. Renderer availability is checked by preview.",
+        posture: "mixed",
+        gatewayTools: ["oxygen_visual_source_create", "oxygen_visual_render_preview", "oxygen_visual_render_get", "oxygen_visual_image_view"],
+        gatewayCommands: ["visuals source-create", "visuals render-preview", "visuals render-get", "visuals download"],
+        skills: ["oxygen-visual-design", "oxygen-knowledge"],
+        endpointSections: ["visuals"],
+        intentTerms: ["infographic", "gtm flow image", "render html", "visual design", "carousel pages", "svg", "png", "pdf export", "graphic designer"],
+    },
     {
         id: "workspace-access",
         layer: "Control",
@@ -194,20 +208,20 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         id: "tables",
         layer: "Data",
         primitive: "tables",
-        owns: "Typed working datasets, rows, formulas, AI/tool/waterfall columns, cell state, projects, and run provenance.",
+        owns: "Typed working datasets, rows, formulas, AI/tool/waterfall columns, reusable Functions with isolated drafts and published versions, cell state, projects, and run provenance.",
         notFor: "Canonical CRM truth, message cadence, or an off-platform spreadsheet runtime.",
-        execution: "Create and run work in hosted OXYGEN Tables; validate a small sample before bounded paid runs.",
+        execution: "Create and run work in hosted OXYGEN Tables; validate a small sample before bounded paid runs. For standard person or company enrichment, `columns add <table> --preset person_enrich|company_enrich` (MCP oxygen_columns_add with preset) adds the maintained bundle in one call before any hand-built tool column.",
         posture: "mixed",
-        gatewayTools: ["oxygen_tables_create", "oxygen_columns_add", "oxygen_enrich_column_preview", "oxygen_tables_link_bulk"],
-        gatewayCommands: ["tables create", "columns add", "enrich-column preview", "tables link"],
-        skills: ["oxygen-gtm", "oxygen-table-tidy", "oxygen-diagnostics", "oxygen-clay-migration"],
-        endpointSections: ["action-columns", "callables", "columns", "company-enrichment", "enrich-column", "enrichment", "projects", "table-action-items", "table-action-runs", "table-ingestion-runs", "tables"],
+        gatewayTools: ["oxygen_tables_create", "oxygen_columns_add", "oxygen_enrich_column_preview", "oxygen_tables_link_bulk", "oxygen_callables_manage"],
+        gatewayCommands: ["tables create", "columns add", "enrich-column preview", "tables link", "functions list", "functions draft"],
+        skills: ["oxygen-gtm", "oxygen-table-tidy", "oxygen-diagnostics", "oxygen-clay-migration", "oxygen-linkedin-marketing"],
+        endpointSections: ["action-columns", "callables", "functions", "columns", "company-enrichment", "enrich-column", "enrichment", "projects", "table-action-items", "table-action-runs", "table-ingestion-runs", "tables"],
         // "link"/"join"/"connect"/"relate" route here for `tables link`. Added after a
         // blind user eval asked for exactly "link two tables" and was routed to
         // `tables create` / `columns add` / `enrich-column preview` — none of which
         // do it. The agent only found the right command by grepping the raw 25k-line
         // command manifest, which is not a discovery path a customer has.
-        intentTerms: ["table", "rows", "column", "columns", "dataset", "csv", "import", "enrich", "enrichment", "waterfall", "score", "formula", "ai column", "lookup", "link", "link tables", "join", "connect", "relate", "relationship"],
+        intentTerms: ["table", "rows", "column", "columns", "dataset", "csv", "import", "enrich", "enrichment", "waterfall", "score", "formula", "ai column", "lookup", "link", "link tables", "join", "connect", "relate", "relationship", "function", "functions", "reusable function", "function draft", "function version", "callable"],
     },
     {
         id: "messages",
@@ -320,11 +334,14 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         notFor: "One-to-one messaging, outreach campaigns, or general automation.",
         execution: "Create and schedule on OXYGEN; explicit approval releases the hosted publisher.",
         posture: "external_write",
-        gatewayTools: ["oxygen_publishing_posts_create", "oxygen_publishing_posts_list", "oxygen_publishing_posts_approve"],
-        gatewayCommands: ["publishing posts create", "publishing posts list", "publishing posts approve"],
-        skills: ["oxygen-linkedin-marketing"],
-        endpointSections: ["publishing"],
-        intentTerms: ["publish", "publishing", "schedule post", "content calendar", "posting calendar", "approve post", "social publishing"],
+        gatewayTools: ["oxygen_publishing_posts_create", "oxygen_publishing_posts_list", "oxygen_publishing_posts_approve", "oxygen_ugc_get"],
+        gatewayCommands: ["publishing posts create", "publishing posts list", "publishing posts approve", "ugc programs list", "ugc programs duplicate", "ugc programs archive"],
+        skills: ["oxygen-linkedin-marketing", "oxygen-ugc"],
+        endpointSections: ["publishing", "ugc"],
+        // "remove program" / "delete program" landed on route: null in a blind eval
+        // (2026-09-10); a program is a UGC noun here, and its lifecycle verbs must
+        // resolve to the group that owns `ugc programs archive|delete|duplicate`.
+        intentTerms: ["publish", "publishing", "schedule post", "content calendar", "posting calendar", "approve post", "social publishing", "ugc", "creator program", "user generated content", "creator voice", "sponsored creator", "ugc program", "archive program", "delete program", "remove program", "duplicate program", "copy program"],
     },
     {
         id: "workflows",
@@ -541,7 +558,16 @@ export function serializeCapabilityRoute(route) {
 function normalizeIntent(query) {
     return query.toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
 }
+function isLinkedInProfileWatcherIntent(query) {
+    return /\blinkedin\b/.test(query)
+        && /\bprofiles?\b/.test(query)
+        && /\b(watcher|watch|watching|monitor|monitoring|daily|every day|recurring)\b/.test(query)
+        && (/\b(engagers?|engaging|engagement|reactions?|comments?|posts?)\b/.test(query) || /\bprofile watcher\b/.test(query))
+        && !isNetNewLinkedInInitiation(query);
+}
 function explicitCapabilityIntent(query) {
+    if (/\b(infographic|graphic designer|render html|carousel pages|visual design|gtm flow image)\b/.test(query))
+        return ROUTE_BY_ID.get("visual-rendering") ?? null;
     // A unified sender profile is an owned Sequence identity, even when the ask
     // names every attached channel (LinkedIn + WhatsApp + email). Resolve this
     // before public LinkedIn research, whose generic "profile" wording would
@@ -558,6 +584,8 @@ function explicitCapabilityIntent(query) {
     if (isMailboxOnboardingIntent(query)) {
         return ROUTE_BY_ID.get("sending-infrastructure") ?? null;
     }
+    if (isLinkedInProfileWatcherIntent(query))
+        return ROUTE_BY_PRIMITIVE.get("tables") ?? null;
     if (isHostedWorkflowIntent(query))
         return ROUTE_BY_PRIMITIVE.get("workflows") ?? null;
     if (isOwnedPostCommentIntent(query))
@@ -596,6 +624,17 @@ function explicitCapabilityIntent(query) {
     if (/\b(my|our|own)\b.{0,40}\blinkedin\b.{0,40}\b(post )?engagers?\b/.test(query)) {
         return ROUTE_BY_PRIMITIVE.get("signals") ?? null;
     }
+    // Grading addresses a row ALREADY holds — "verify these emails", "which are
+    // safe to send", "catch-all or valid" — is Tables work (the Email verification
+    // column: `columns add --capability verify_email`, previewed and run through
+    // `enrich-column`), with `verify email` as the one-shot twin. Without this
+    // rule the bare word "email" scored the Messages card, and a 2026-09-10 blind
+    // user asking "verify email deliverability safe to send" was routed to
+    // `email send`. Sits after the mailbox rules above so warm-up and sender
+    // deliverability keep their owner, and after the scheduling rule so "every
+    // Monday verify new signups" still lands on Workflows.
+    if (isEmailVerificationIntent(query))
+        return ROUTE_BY_PRIMITIVE.get("tables") ?? null;
     if (/\b(recipe|playbook|proven play|what should i do)\b/.test(query)) {
         return ROUTE_BY_PRIMITIVE.get("recipes") ?? null;
     }
@@ -736,12 +775,27 @@ function recommendationsFor(card, query) {
         };
     }
     if (card.primitive === "tables") {
+        if (isLinkedInProfileWatcherIntent(query)) {
+            return {
+                tools: ["oxygen_tables_watcher"],
+                commands: ["tables watcher preview", "tables watcher create", "tables watcher get", "tables watcher update", "tables watcher pause", "tables watcher resume"],
+            };
+        }
         if (/\b(table )?(action )?runs?\b/.test(query)) {
             return {
                 tools: ["oxygen_table_runs_get", "oxygen_table_runs_items", "oxygen_table_runs_wait", "oxygen_table_runs_retry_failed"],
                 commands: ["table-runs get", "table-runs items", "table-runs wait", "table-runs retry-failed"],
             };
         }
+        if (isEmailVerificationIntent(query)) {
+            // Define-without-running first (0 credits), then the free preview that
+            // prices it, then the approved run, then the one-shot for a handful of
+            // addresses that never needed a table.
+            return {
+                tools: ["oxygen_columns_add", "oxygen_enrich_column_preview", "oxygen_enrich_column_run", "oxygen_verify_email"],
+                commands: ["columns add", "enrich-column preview", "enrich-column run", "verify email"],
+            };
+        }
         if (/\b(waterfall|enrich|enrichment|work email|mobile phone)\b/.test(query)) {
             return {
                 tools: ["oxygen_enrich_column_preview", "oxygen_columns_add", "oxygen_enrich_column_run", "oxygen_table_runs_get"],
@@ -873,7 +927,7 @@ function recommendationsFor(card, query) {
     if (card.primitive === "signals" && /\blinkedin\b.{0,40}\bengagers?\b/.test(query)) {
         return {
             tools: ["oxygen_engagement_list_engagers", "oxygen_signals_list", "oxygen_signals_leads_today"],
-            commands: ["engagement list", "signals list", "signals leads-today"],
+            commands: ["engagement engagers", "signals list", "signals leads-today"],
         };
     }
     if (card.id === "connected-whatsapp" && /\b(account|connect|limits?|sync)\b/.test(query)) {
@@ -884,6 +938,16 @@ function recommendationsFor(card, query) {
     }
     return { tools: [...card.gatewayTools], commands: [...card.gatewayCommands] };
 }
+// An email-VERIFICATION ask names a grading verb next to the addresses, or the
+// addresses next to a grade. "check my emails" is deliberately not matched
+// (that is an inbox), and bare "deliverability" is left to the sending rail —
+// only "are these emails deliverable" counts. Bare "bounce" describes an
+// observed delivery failure too; require predictive wording or "bounce risk".
+function isEmailVerificationIntent(query) {
+    const gradeThenAddress = /\b(verif(?:y|ied|ication)|validat(?:e|ed|ion)|grade|scrub|clean)\b.{0,40}\b(e ?mails?|email addresses|addresses)\b/;
+    const addressThenGrade = /\b(e ?mails?|addresses)\b.{0,40}\b(verif(?:y|ied|ication)|validat(?:e|ed|ion)|valid|invalid|deliverable|(?:will|would|might) bounce|bounce risk|risky|safe to (?:send|email)|catch ?all|accept ?all)\b/;
+    return gradeThenAddress.test(query) || addressThenGrade.test(query);
+}
 function isInboxAvatarIntent(query) {
     return /\b(avatar|profile (?:picture|photo)|headshot|hosted (?:picture|image)|mailbox (?:picture|photo))\b/.test(query);
 }

package/node_modules/@oxygen/shared/dist/email-dsn.d.ts

@@ -0,0 +1,60 @@
+/**
+ * PURE classifier for delivery-status notifications (bounce NDRs / DSNs) that
+ * land back in a sending mailbox's own inbox.
+ *
+ * WHY this exists: a mailbox-provider reputation block is the loudest
+ * deliverability signal a workspace ever receives, and it arrives as an ordinary
+ * inbound email — "Message rejected", "support.google.com/mail/answer/69585" —
+ * that no OXYGEN surface reads. A warm-up vendor reporting 96% inbox placement
+ * cannot contradict it, because the vendor only measures its own seed network.
+ * Classifying the DSN turns the workspace's own inbox into first-party
+ * deliverability evidence: OXYGEN's send log said we sent, the DSN says the
+ * receiving provider refused it, and only the second one is the truth.
+ *
+ * Pure by design — no clock, no I/O, no provider call — so the same
+ * classification runs in the tenant rollup, a worker sweep, and a unit test.
+ * Output is stable machine data (kinds and codes), never prose.
+ */
+/** What the notification actually says happened. */
+export type DeliveryStatusNotificationKind = 
+/** The receiving provider refused the message on reputation/policy grounds. */
+"provider_rejected"
+/** The address does not exist (list hygiene, not reputation). */
+ | "no_such_user"
+/** The recipient mailbox is over quota. */
+ | "mailbox_full"
+/** Transient: retried, not dead. */
+ | "delayed"
+/**
+ * The envelope proves it is a DSN, but nothing classifiable was stored — the
+ * body was never synced, so only the subject survives. Kept distinct from
+ * "other" because counting these as "other" reads as "we looked and found
+ * nothing wrong", when the truth is that we could not look.
+ */
+ | "unclassified"
+/** A DSN with real content we can recognize but not attribute. */
+ | "other";
+/** Every kind, in one place, so callers can build a complete counts map. */
+export declare const DELIVERY_STATUS_NOTIFICATION_KINDS: readonly ["provider_rejected", "no_such_user", "mailbox_full", "delayed", "unclassified", "other"];
+/** Which mailbox provider generated the notification, when it is knowable. */
+export type DeliveryStatusNotificationProvider = "google" | "microsoft" | "unknown";
+export type DeliveryStatusNotification = {
+    kind: DeliveryStatusNotificationKind;
+    provider: DeliveryStatusNotificationProvider;
+    /** The address the original message was addressed to, when the DSN names it. */
+    recipient: string | null;
+    /** Enhanced status code (5.7.1) when present, else the bare SMTP reply (550). */
+    smtpCode: string | null;
+};
+/**
+ * Classify one stored inbound message as a delivery-status notification.
+ *
+ * Returns null when the message is not a DSN at all — the caller's SQL prefilter
+ * is intentionally wide, and a false positive here would invent a deliverability
+ * incident out of a customer reply.
+ */
+export declare function classifyDeliveryStatusNotification(input: {
+    fromAddress?: string | null;
+    subject?: string | null;
+    bodyText?: string | null;
+}): DeliveryStatusNotification | null;

package/node_modules/@oxygen/shared/dist/email-dsn.js

@@ -0,0 +1,120 @@
+/**
+ * PURE classifier for delivery-status notifications (bounce NDRs / DSNs) that
+ * land back in a sending mailbox's own inbox.
+ *
+ * WHY this exists: a mailbox-provider reputation block is the loudest
+ * deliverability signal a workspace ever receives, and it arrives as an ordinary
+ * inbound email — "Message rejected", "support.google.com/mail/answer/69585" —
+ * that no OXYGEN surface reads. A warm-up vendor reporting 96% inbox placement
+ * cannot contradict it, because the vendor only measures its own seed network.
+ * Classifying the DSN turns the workspace's own inbox into first-party
+ * deliverability evidence: OXYGEN's send log said we sent, the DSN says the
+ * receiving provider refused it, and only the second one is the truth.
+ *
+ * Pure by design — no clock, no I/O, no provider call — so the same
+ * classification runs in the tenant rollup, a worker sweep, and a unit test.
+ * Output is stable machine data (kinds and codes), never prose.
+ */
+/** Every kind, in one place, so callers can build a complete counts map. */
+export const DELIVERY_STATUS_NOTIFICATION_KINDS = [
+    "provider_rejected",
+    "no_such_user",
+    "mailbox_full",
+    "delayed",
+    "unclassified",
+    "other",
+];
+// A message only enters classification when its envelope looks like a DSN. The
+// SQL prefilter that feeds this is deliberately loose (ILIKE), so this gate is
+// what keeps an ordinary customer reply that happens to contain the word
+// "blocked" out of the deliverability evidence.
+const DSN_FROM_PATTERN = /(mailer-daemon|mail-daemon|postmaster|microsoftexchange)/i;
+const DSN_SUBJECT_PATTERN = /(undeliver|delivery status notification|mail delivery fail|delivery has failed|returned mail)/i;
+const GOOGLE_BLOCK_URL = /support\.google\.com\/mail\/answer\/69585/i;
+const GOOGLE_FROM = /@(?:[a-z0-9-]+\.)*(?:googlemail|google)\.com\b/i;
+const MICROSOFT_FROM = /(?:@(?:[a-z0-9-]+\.)*(?:outlook|office365|hotmail|microsoft)\.com\b|microsoftexchange|\bexchange\b)/i;
+const MICROSOFT_BODY = /(microsoft exchange|exchange server|office\s?365)/i;
+// Enhanced status code (RFC 3463): class.subject.detail, where subject/detail can
+// be multi-digit (Google emits 5.7.708). Kept separate from the bare 3-digit SMTP
+// reply so a caller can tell "550" from "5.7.1".
+const ENHANCED_CODE = /\b([2-5]\.\d{1,3}\.\d{1,3})\b/;
+const SMTP_REPLY_CODE = /\b([2-5]\d{2})\b/;
+const REPUTATION_BLOCK = /\b5\.7\.\d{1,3}\b/;
+const MAILBOX_FULL_CODE = /\b[45]\.2\.2\b/;
+const NO_SUCH_USER_CODE = /\b5\.1\.\d{1,3}\b/;
+const TRANSIENT_CODE = /(\b4\.\d{1,3}\.\d{1,3}\b|\b4\d{2}\b)/;
+const MAILBOX_FULL_TEXT = /(mailbox (?:is )?full|over quota|quota exceeded|insufficient storage)/i;
+const NO_SUCH_USER_TEXT = /(does ?n[o']?t exist|nosuchuser|no such user|user unknown|unknown user|address not found|recipient (?:address )?(?:not found|rejected)|invalid recipient)/i;
+const PROVIDER_REJECTED_TEXT = /(message rejected|has been blocked|\bblocked\b|\bbanned\b|\bspam\b|local policy violation|unsolicited|reputation)/i;
+const TRANSIENT_TEXT = /(temporar|will retry|try again later|rate ?limit|throttl)/i;
+// Greedy address capture: the character class already stops at whitespace and
+// angle brackets, so trailing sentence punctuation is stripped afterwards. A lazy
+// capture would stop at the dot inside "gmail.com".
+const ADDRESS = "([^\\s<>,;()]+@[^\\s<>,;()]+)";
+const RECIPIENT_PATTERNS = [
+    new RegExp(`your message to\\s+<?${ADDRESS}>?`, "i"),
+    new RegExp(`\\bto\\s+<?${ADDRESS}>?\\s+(?:was|were|could not|couldn't|has been|had been)`, "i"),
+    // Machine-readable half of a real RFC 3464 report, when the provider sends one.
+    new RegExp(`(?:final|original)-recipient:\\s*rfc822;\\s*<?${ADDRESS}>?`, "i"),
+];
+function readRecipient(haystack) {
+    for (const pattern of RECIPIENT_PATTERNS) {
+        const match = pattern.exec(haystack);
+        const value = match?.[1]?.replace(/[.,;:>]+$/, "").trim().toLowerCase();
+        if (value && value.includes("@"))
+            return value;
+    }
+    return null;
+}
+function readProvider(from, haystack) {
+    // The 69585 URL is decisive: only Google emits it, and it is the exact article
+    // a Gmail reputation block cites.
+    if (GOOGLE_BLOCK_URL.test(haystack) || GOOGLE_FROM.test(from))
+        return "google";
+    if (MICROSOFT_FROM.test(from) || MICROSOFT_BODY.test(haystack))
+        return "microsoft";
+    return "unknown";
+}
+function readKind(subject, haystack, hasBody) {
+    // Order is load-bearing. A Google "(Delay)" report can quote block-sounding
+    // prose while the message is still queued, so the transient marker wins first;
+    // an explicit enhanced code then beats keyword matching, because "blocked" and
+    // "spam" appear in boilerplate that a 5.1.1 no-such-user report also carries.
+    if (/\(delay\)/i.test(subject))
+        return "delayed";
+    if (REPUTATION_BLOCK.test(haystack))
+        return "provider_rejected";
+    if (MAILBOX_FULL_CODE.test(haystack) || MAILBOX_FULL_TEXT.test(haystack))
+        return "mailbox_full";
+    if (NO_SUCH_USER_CODE.test(haystack) || NO_SUCH_USER_TEXT.test(haystack))
+        return "no_such_user";
+    if (PROVIDER_REJECTED_TEXT.test(haystack))
+        return "provider_rejected";
+    if (TRANSIENT_CODE.test(haystack) || TRANSIENT_TEXT.test(haystack))
+        return "delayed";
+    // Nothing matched AND there was no body to match against: the sync stored the
+    // envelope only. Reporting that as "other" would be a false clean.
+    return hasBody ? "other" : "unclassified";
+}
+/**
+ * Classify one stored inbound message as a delivery-status notification.
+ *
+ * Returns null when the message is not a DSN at all — the caller's SQL prefilter
+ * is intentionally wide, and a false positive here would invent a deliverability
+ * incident out of a customer reply.
+ */
+export function classifyDeliveryStatusNotification(input) {
+    const from = typeof input.fromAddress === "string" ? input.fromAddress : "";
+    const subject = typeof input.subject === "string" ? input.subject : "";
+    const body = typeof input.bodyText === "string" ? input.bodyText : "";
+    if (!DSN_FROM_PATTERN.test(from) && !DSN_SUBJECT_PATTERN.test(subject))
+        return null;
+    const haystack = `${subject}\n${body}`;
+    const smtpCode = ENHANCED_CODE.exec(haystack)?.[1] ?? SMTP_REPLY_CODE.exec(haystack)?.[1] ?? null;
+    return {
+        kind: readKind(subject, haystack, body.trim().length > 0),
+        provider: readProvider(from, haystack),
+        recipient: readRecipient(haystack),
+        smtpCode,
+    };
+}