@trydreamstate/cli 1.3.6 → 1.3.7

package/README.md

@@ -78,7 +78,7 @@ A live write gets a random key for one attempt. CLI persists that key by request
 
 ## Sequences and workflows
 
-`sequences <verb>` and `workflows <verb>` run through the same gate as `tools run`: same `--dry-run`/`--live`/`--mode`, `--approved`, `--approval-id`, `--quote-hash`, `--max-credits`, `--max-live-sends`, `--approved-effect-unknown`, `--turn-token`, `--idempotency-key`, turn cache, quote retry. `--max-live-sends` becomes `params.max_live_sends`. Verb sends no mode unless given one; server answers `mode_required` with its repair classification. Flag values convert to capability live-input-schema types, so `--max-new-enrollments-per-day 40` sends number `40`. `commands search <term>` returns real CLI commands (and capability each runs) from CLI tables, plus matching catalog capabilities when signed in. `tools run` refuses capability contract does not publish for CLI (`unsupported_capability`, exit 9). CLI has no `--agent-session-id`: field selects in-app Architect surface; request body carrying `agent_session_id` rejected locally (exit 2).
+`sequences <verb>` and `workflows <verb>` run through the same gate as `tools run`: same `--dry-run`/`--live`/`--mode`, `--approved`, `--approval-id`, `--quote-hash`, `--max-credits`, `--max-live-sends`, `--approved-effect-unknown`, `--turn-token`, `--idempotency-key`, turn cache, quote retry. `--max-live-sends` becomes `params.max_live_sends` only for capabilities that declare it, such as one-contact workflow execution. Sequence lifecycle and enrollment calls do not accept this flag or impose a lifetime send ceiling. Verb sends no mode unless given one; server answers `mode_required` with its repair classification. Flag values convert to capability live-input-schema types, so `--max-new-enrollments-per-day 40` sends number `40`. `commands search <term>` returns real CLI commands (and capability each runs) from CLI tables, plus matching catalog capabilities when signed in. `tools run` refuses capability contract does not publish for CLI (`unsupported_capability`, exit 9). CLI has no `--agent-session-id`: field selects in-app Architect surface; request body carrying `agent_session_id` rejected locally (exit 2).
 
 ## Tables import
 

package/agent-plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dreamstate",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "description": "Dreamstate for AI agents: build workbooks of companies and people, run LinkedIn and email sequences, answer replies, post to LinkedIn and X, and manage your CRM from your coding agent.",
   "author": {
     "name": "Dreamstate",

package/agent-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dreamstate",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "description": "Dreamstate for AI agents: build workbooks of companies and people, run LinkedIn and email sequences, answer replies, post to LinkedIn and X, and manage your CRM from your coding agent.",
   "author": {
     "name": "Dreamstate",

package/agent-plugin/skills/crm/SKILL.md

@@ -3,7 +3,7 @@ name: crm
 description: "Maintain trustworthy customer and company records by separating stable facts, judgement, and time-bound activity; deduplicating only from strong identity evidence; and keeping pipeline tied to recent, evidenced work. Use it when the user needs to create, review, clean up, merge, enrich, or progress relationship records and deals. It does not rebuild source worksheets (list-building does), run outreach (outreach does), or replace a workflow with record cleanup (workflows does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # CRM
 
@@ -53,7 +53,7 @@ Merging records, changing consequential pipeline state, bulk edits, or any actio
 
 ## Guardrails
 
-- When user says delete, delete permanently after showing impact and getting explicit approval through delete flow. Archive only when user says archive. Never say permanent deletion is unavailable.
+- When user says delete, delete permanently after reviewing impact and setting the commit field through delete flow. Archive only when user says archive. Never say permanent deletion is unavailable.
 - Never overwrite a human-entered field from an enrichment guess.
 - Never merge on a shared public email domain.
 - Never use a timeline activity as substitute for stable field, or a field as substitute for event history.

package/agent-plugin/skills/diagnostics/SKILL.md

@@ -3,7 +3,7 @@ name: diagnostics
 description: "Answer one operational question with evidence, such as where a cell value came from or why it is empty, which runs failed and which are safe to retry, why a sequence has not sent, or where credits went and how to spend less. Use it when something in a worksheet, sequence or workflow looks wrong, stuck, missing or expensive. It reads before it changes anything. It does not redesign lists, sequences or workflows, or tidy worksheet structure (worksheet-tidy does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Diagnostics
 

package/agent-plugin/skills/dreamstate/SKILL.md

@@ -12,15 +12,15 @@ Prefer the narrower `dreamstate:*` skill for the job when one fits; `skills_get`
 1. `whoami` names the user and the active workspace. If it lists several workspaces, confirm the right one before writing anything.
 2. `packs_route` maps a goal to a domain; `packs_get` returns that domain's capabilities and skills.
 3. `tools_search` finds the capability for the goal; `tools_get` returns its exact input schema. Read the schema every time, never guess params from memory.
-4. `tools_run` runs it with `capability_id` and `params`. The gating inputs (`mode`, `max_credits`, `idempotency_key`, `quote_hash`, `approved`) go on the run call itself, never inside `params`. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`.
+4. `tools_run` runs it with `capability_id` and `params`. The gating inputs (`mode`, `max_credits`, `idempotency_key`, `quote_hash`, `approved`) go on the run call itself, never inside `params`. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling.
 5. `runs_get` follows long work; `runs_events` and `runs_list` read more of it and `runs_cancel` stops a run.
 
 Lists, finds, enrichments and signals happen only inside a workbook worksheet. Report only what tools returned.
 
 ## Paid and outward-facing runs
 
-Anything that writes, spends credits or reaches a real person: run mode dry_run first, show the user the preview, the row count and the credit estimate, then run live with the quote_hash that dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A live paid run states max_rows; an external send states max_live_sends of at least the dry_run recipient_count. A quote returned by a refused live call is only a price, never a confirmation.
+For writes, credit spend or external effects: dry_run first, review the row count and credit estimate, then run live with the quote_hash that dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. Supply max_rows or max_live_sends only when the fetched capability schema declares them; when an external send accepts max_live_sends, cover at least the dry_run recipient_count. Sequence lifecycle and enrollment calls have no lifetime send ceiling. A quote returned by a refused live call is only a price, never a confirmation.
 
-A paid run above the server's row or provider-spend limit, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs the user's yes. Ask them, and only then send approved: true with the same quote_hash. You are asserting that you asked a person; never send it on your own.
+A paid run above the server's row or provider-spend limit, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply.
 
-`max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices.
+`max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices.

package/agent-plugin/skills/first-win/SKILL.md

@@ -3,7 +3,7 @@ name: first-win
 description: "Run a short first session in a new workspace that confirms the user and workspace, builds or reads Company Context, creates one small sampled worksheet from the ideal customer, and suggests three next plays. Use it on a fresh workspace, when the user says \"get me started\", or when nothing has been built yet. It does not launch outreach, publish content or run anything at scale."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # First Win
 
@@ -28,11 +28,11 @@ Build real things, keep the first spend small, and send nothing. The session end
 1. **First-win bundle.** Search for the first-win bundle first, with limit 10 and a 30-day window. It concurrently reads workspace context, warm evidence and blueprint state. It merges open CRM deal contacts, interested/question/objection unanswered inbound replies, and recent stored LinkedIn post engagers; it removes suppressed people and returns ranked evidence. Read individual sources only to inspect a returned row. Rank evidence by rung: active relationship, interested unanswered reply, recent CRM evidence, LinkedIn engagement, then existing qualified row. Never claim a warm rung without returned evidence.
 2. **Confirm identity.** Use whoami only when bundle workspace identity conflicts with user request. With more than one workspace, confirm which before writing anything.
 3. **Company Context.** Load knowledge skill. If bundle has missing offer or ICP, build Product Information, Ideal Customer, Competitor Analysis and Tone of Voice by reading company website now and searching competitors, read them back, show Ideal Customer. Ask one question only if ICP has two readings that land different people.
-5. **First leads.** After warmth reads, install the list blueprint the bundle recommends (it creates the worksheet, its source and the Qualified view), configure its source inputs, or reuse an existing worksheet. Land about ten people, ranking warm people before fallback matches. Every row needs warmth rung, one evidence reason, one Ideal Customer fit reason, and drafted first message. Drafts stay internal. Do not look up contact data, send, enroll, or start a sequence.
-6. **Cold fallback only when needed.** Load list-building skill only when warmth ladder cannot fill set. Search source cards for people or companies matching scarcest Ideal Customer criterion. Start with free preview, state zero-credit result and ten-row ceiling, then run at most about ten fallback rows. For every required filter, inspect coverage before ranking: applied can support fit, unverified or unsupported cannot. Do not run paid search before dry run.
-7. **Rank and draft.** Add Required criteria, score, evidence and first-message draft columns. Price any scoring or draft run. Keep session at zero credits when warm rows suffice; otherwise use only one dry-run-approved sample ceiling. Read ranked rows back, show about ten with reason and draft, and report credits charged.
-8. **Adjust once.** If fewer than half fallback rows look right, change source filter and repeat dry run before another bounded sample. Do not add columns to hide poor source fit.
-9. **Suggest three plays.** After first-leads readback, search for the read that recommends three blueprints this workspace can run now. Present returned top three, including `why_now`, unmet prerequisites, credit posture and exact describe call. Load plays skill for operating guidance, then recommend one returned blueprint and say why. Never substitute static catalog order for this workspace-state read.
+4. **First leads.** After warmth reads, install the list blueprint the bundle recommends (it creates the worksheet, its source and the Qualified view), configure its source inputs, or reuse an existing worksheet. Land about ten people, ranking warm people before fallback matches. Every row needs warmth rung, one evidence reason, one Ideal Customer fit reason, and drafted first message. Drafts stay internal. Do not look up contact data, send, enroll, or start a sequence.
+5. **Cold fallback only when needed.** Load list-building skill only when warmth ladder cannot fill set. Search source cards for people or companies matching scarcest Ideal Customer criterion. Start with free preview, state zero-credit result and ten-row ceiling, then run at most about ten fallback rows. For every required filter, inspect coverage before ranking: applied can support fit, unverified or unsupported cannot. Do not run paid search before dry run.
+6. **Rank and draft.** Add Required criteria, score, evidence and first-message draft columns. Price any scoring or draft run. Keep session at zero credits when warm rows suffice; otherwise use only one dry-run-approved sample ceiling. Read ranked rows back, show about ten with reason and draft, and report credits charged.
+7. **Adjust once.** If fewer than half fallback rows look right, change source filter and repeat dry run before another bounded sample. Do not add columns to hide poor source fit.
+8. **Suggest three plays.** After first-leads readback, search for the read that recommends three blueprints this workspace can run now. Present returned top three, including `why_now`, unmet prerequisites, credit posture and exact describe call. Load plays skill for operating guidance, then recommend one returned blueprint and say why. Never substitute static catalog order for this workspace-state read.
 
 Search the tool for each task. The search returns runnable schemas for its top hits; read any other ids together in one tools_get, then run.
 

package/agent-plugin/skills/inbox-replies/SKILL.md

@@ -3,7 +3,7 @@ name: inbox-replies
 description: "Triage and answer existing LinkedIn and email conversations, classify the latest inbound message, confirm the sequence stopped, and draft a reply grounded in the real thread and Company Context. Use it when someone replied, when the user wants to work through unanswered threads, or when a positive reply should move toward a meeting. It does not start new conversations with people who have not been contacted (the outreach skill does) or build automated reply handling (the workflows skill does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Inbox Replies
 

package/agent-plugin/skills/knowledge/SKILL.md

@@ -3,7 +3,7 @@ name: knowledge
 description: "Read and update what the workspace knows, across the knowledge digest, the workspace wiki, cited claims, and conflict-aware revisions."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Knowledge
 

package/agent-plugin/skills/linkedin-posts/SKILL.md

@@ -3,7 +3,7 @@ name: linkedin-posts
 description: "Write and revise LinkedIn posts that earn the click and the reply: the 210 character hook, structure and formatting, length by post type (story, list, case study, belief disruption, short, paragraph), specificity, the CTA close, and phrases to avoid. Use it for the copy of any post going to LinkedIn. It does not cover scheduling, publishing or automations (social does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # LinkedIn posts
 

package/agent-plugin/skills/linkedin-warm-signals/SKILL.md

@@ -3,7 +3,7 @@ name: linkedin-warm-signals
 description: "Warm people come from worksheet sources such as post engagers, followers, profile viewers and website visits. Judge worksheet rows against Required criteria, then build a capped warm sequence while protecting sender account. Use when user wants leads from LinkedIn presence or network-first motion. Does not cover cold lists from search (list-building does), writing posts (social does) or replying in existing threads (inbox-replies does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # LinkedIn Warm Signals
 

package/agent-plugin/skills/list-building/SKILL.md

@@ -3,7 +3,7 @@ name: list-building
 description: "Build a workbook of companies or people: as few sources as possible, people at companies through the employees enrichment fanned out to a second worksheet, one column per criterion marked Required or Nice to have, run conditions that skip rows already failing, an optional score, sample then scale, and honest coverage."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Workbook building
 
@@ -15,7 +15,7 @@ Owns: sources, columns, criteria, and building qualified lists.
 - Durable customer and company records: [`crm`].
 - Warm sources: [`linkedin-warm-signals`].
 - Explaining cell values and failed runs: [`diagnostics`].
-The `tables` pack lists the tools and their exact inputs. When user says delete, permanently delete named workbook, worksheet, template, automation, contact, row, or column after showing removal impact and receiving explicit approval. When user says archive, archive only. Never say permanent deletion is unavailable.
+The `tables` pack lists the tools and their exact inputs. When user says delete, permanently delete named workbook, worksheet, template, automation, contact, row, or column after reviewing removal impact and setting the commit field. When user says archive, archive only. Never say permanent deletion is unavailable.
 
 A list is worth contacting when every row would recognise itself in the reason you contact it. Find the smallest set where that is true, prove it on each row, and stop.
 

package/agent-plugin/skills/list-building/sourcing.md

@@ -26,6 +26,6 @@
 
 - Use the request's target. When none is given, free-preview first, then run the attached source with `max_rows` in the params of `tables.table_sources.run` (not on `tools_run`) and matching `max_credits`. When no target is given, start at `max_rows:25` and ask how far to grow after reading those 25 rows.
 - Over-provision about 1.4 times the target when later criteria drop rows.
-- `tables.sourcing.preview` is a free read. Use `live` or `smoke_test`, not `dry_run`. It accepts source definition plus filters directly. For LinkedIn people search, it returns up to ten named provider rows free, with no workbook, source attachment, or credits. Use it before a paid sample. Preview maximum is ceiling; what was charged is read from the finished run. Counts before the run finishes are unknown, not zero.
+- `tables.sourcing.preview` is a free read. Door modes `dry_run` and `live` both execute this read. Pass definition_id and its source binding values inside source_inputs; keep execution mode at the door. Resolve the selected source input contract, including schema references. Flattened source fields and params.dry_run are rejected. For LinkedIn people search, it returns up to ten named provider rows free, with no workbook, source attachment, or credits. Use it before a paid sample. Preview maximum is ceiling; what was charged is read from the finished run. Counts before the run finishes are unknown, not zero.
 - Run an enrichment on a few rows, read them, then continue the remaining rows instead of rerunning the sample.
 - A cell blocked by a daily limit is the workspace's pacing cap, not a defect.

package/agent-plugin/skills/outreach/SKILL.md

@@ -3,7 +3,7 @@ name: outreach
 description: "Build a multi-channel sequence and enroll a workbook into it: preview one real message first, fixed scaffold with small personalized slots, channel steps with the wait inside each step, column filters decide who enrolls, paced sends."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Sequence building
 

package/agent-plugin/skills/outreach/channels.md

@@ -1,5 +1,7 @@
 # Channels
 
-LinkedIn messages and emails for the same people belong in one sequence, one view and one launch. All channels share one contact history, so a reply, bounce or unsubscribe on one channel stops the others.
+LinkedIn messages, emails, WhatsApp and Instagram for the same people belong in one sequence, one view and one launch. All channels share one contact history, so a reply, bounce or unsubscribe on one channel stops the others.
+
+WhatsApp and Instagram use connected own Unipile accounts. Ramp sends and honor account caps. Ban risk exists. WhatsApp needs a phone column in E.164 format. Instagram needs an Instagram handle. Use WhatsApp only for warm or opted-in contacts. Use Instagram for creators or contacts with handles. A reply on either channel stops enrollment.
 
 Never use one channel to route around a stop, a suppression, a blocked sender or a decline on another. An existing conversation is answered in that conversation, not by adding a sequence step.

package/agent-plugin/skills/outreach/replies.md

@@ -2,4 +2,6 @@
 
 A reply, bounce, unsubscribe, suppression or decline ends the sequence for that person. Read the whole current thread before drafting an answer, and answer what they said instead of restarting the pitch.
 
+WhatsApp and Instagram replies stop enrollment and appear in Unibox. Read that thread there before replying.
+
 A conversation status is not proof a message was delivered. After an unclear send result, check the conversation before sending again.

package/agent-plugin/skills/outreach/steps-and-timing.md

@@ -1,9 +1,13 @@
 # Steps and timing
 
-Authorable steps are the ids `sequence.sequences.step_options` returns. That list is `canonicalSequencePaletteOptionIds()` in `packages/types/src/canonicalSequences.ts` (`CANONICAL_SEQUENCE_STEP_KINDS`, `CANONICAL_SEQUENCE_ACTIONS`, `CANONICAL_SEQUENCE_LINKEDIN_ACTIONS`, user-pickable nodes only). Read the schema for the exact shape, including whether a delay is its own step (`canonicalSequenceStepDelaySecondsSchema`). Do not invent a step the palette does not list. A LinkedIn message never sends an invite. To reach someone who is not connected, put a connection request step first when the palette offers one, then the message steps; a message waits until the request is accepted. Leave the connection request note empty by default: a blank invitation is accepted more often and the message after acceptance does the talking. Write a note only when the user asks for one. Skip the connection request only when the audience is already connected (first-degree) or an earlier step waits for the person to connect.
+Authorable steps are the ids `sequence.sequences.step_options` returns, and only those. Read each step's schema from that response for the exact shape, including the delay, which is an input on the step rather than a step of its own. Do not invent a step the palette does not list. A LinkedIn message never sends an invite. To reach someone who is not connected, put a connection request step first when the palette offers one, then the message steps; a message waits until the request is accepted. Leave the connection request note empty by default: a blank invitation is accepted more often and the message after acceptance does the talking. Write a note only when the user asks for one. Skip the connection request only when the audience is already connected (first-degree) or an earlier step waits for the person to connect.
 
 Typical cadence: three to five touches over two to three weeks, two to five days apart, mixing channels when both are available. An email follow-up reads best as a reply in the same thread. Put the strongest message first, and make the last touch an easy way to close the loop.
 
+Use one send node per channel. Put delay_seconds inside that step, never in a separate wait for its send. Suggested order: LinkedIn or email first, WhatsApp only for warm or opted-in contacts, Instagram for creators or contacts with handles. WhatsApp needs an E.164 phone column; Instagram needs a handle. For AI copy or row variables, set fallback_template.
+
+A Slack sequence step is an internal team notification, not prospect reachability. Inspect its real schema and field options, choose a public channel from its live channel list, and provide fallback text in fallback_template for AI or row-variable copy.
+
 A reply, an unsubscribe or a failed send ends a lead's run on its own, so do not add a condition that only checks reply state. Sequence conditions may branch on worksheet-row variables, such as `fit_score`, `title`, or `first_name`, using `expression` plus both `true_step_id` and `false_step_id`. Keep reply as stop. Never refuse whole build over one step.
 
 Build the whole sequence in one pass when you know every step. Add, edit, remove or reorder a single step when the user asks for a narrow change, and leave the rest alone. Read the real step settings before writing them rather than guessing field names or time units.

package/agent-plugin/skills/plays/SKILL.md

@@ -3,7 +3,7 @@ name: plays
 description: "Recommend and run one named, proven go-to-market play when the user asks what to do next, picking by stage and what the workspace already has, and stating prerequisites, credit estimate and checkpoints before starting. Use it for \"what should I do\", \"how do I get leads\", \"help me start outbound or content\", or a weekly review. It does not replace the skills each step uses (knowledge, list-building, outreach, social, writing, visibility, workflows)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Plays
 

package/agent-plugin/skills/reddit-posts/SKILL.md

@@ -3,7 +3,7 @@ name: reddit-posts
 description: "Draft Reddit posts the user posts themselves: subreddit choice and rules, the title, a value first body, disclosure, post types (success story, guide, resource list, problem solving, behind the scenes, question), and what gets posts removed. Use it for the copy of any Reddit draft. It does not cover scheduling or automations (social does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Reddit posts
 

package/agent-plugin/skills/skill-authoring/SKILL.md

@@ -3,7 +3,7 @@ name: skill-authoring
 description: "Read, edit and create this workspace's skills, the editable Markdown playbooks agents and people follow, keeping each one short, revision safe and in the workspace's own words. Use it when the user wants to change how a skill works, capture a repeatable practice as a new skill, or fix a skill that reports issues. It does not change what an agent is allowed to do (a skill grants nothing) and does not edit Company Context pages (knowledge does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Skill Authoring
 
@@ -28,17 +28,17 @@ Every change lands on the current revision and is reported back. Never overwrite
 ## Edit
 
 1. Read the skill with skills_get immediately before writing.
-2. Follow its `edit` descriptor: read the named tool's schema with tools_get, then run it with tools_run, passing the document, the revision from that read and the complete new Markdown in the named content field. The save replaces the whole page, so send the full text, frontmatter included.
+2. Search the document write capability with tools_search, read its exact schema with tools_get, then run it with tools_run. Supply the document identity, current revision and complete new Markdown in the fields that schema declares. A whole-page save includes frontmatter and unchanged sections.
 3. Change only what the user asked for. Keep the frontmatter name equal to the folder name.
 4. On a revision conflict, someone else saved first. Re-read, merge your change into their text and save again on the new revision. Never resend the old text over theirs.
-5. When `edit` is null an existing starter skill is still a repo default for this workspace. Read skills_list again shortly; the workspace copy appears once seeding finishes. This applies only to starter skills, never to a skill you just created.
+5. If the skill has no writable workspace document yet, read skills_list again after starter seeding finishes. Never invent a document identity or overwrite a different skill.
 
 ## Create
 
 1. Check skills_list query first; if a skill already covers the need, add a section to it instead.
-2. Follow the `create` descriptor from skills_list, step by step, with tools_get then tools_run for each step. Send every param the descriptor fills in exactly as given. The first step names `parent_folder_id` explicitly and returns the new folder id that the second step needs.
+2. Search folder and document creation capabilities with tools_search. Read each schema with tools_get before using tools_run. Resolve the workspace skills root from skills_list, create the skill folder there, then use its returned identity to create SKILL.md.
 3. Use a kebab-case id such as `pricing-objections` for the folder, and write SKILL.md with frontmatter `name` (the same id) and `description` (one sentence: what it does, when to use it, what it does not cover). A skill is plain Markdown and grants no tools, so it needs no tool list.
-4. Run the descriptor's `verify` read: skills_get with the new id. The skill is created only when that read returns it. Fix every issue it reports.
+4. Read skills_get with the new id. The skill is created only when that read returns it. Fix every issue it reports.
 5. Skills are read live, so there is no indexing delay. If skills_get says not found, the skill does not exist yet: never report it created or verified.
 
 ## Shape of a good skill
@@ -50,7 +50,7 @@ Every change lands on the current revision and is reported back. Never overwrite
 ## Guardrails
 
 - Never delete or rewrite a starter skill unless the user asked for that. Prefer adding a new skill or a new section.
-- Remove a skill only on an explicit request, following its `remove` descriptor; say that it can be restored from trash.
+- Remove a skill only on an explicit request. Search the document trash capability, read its schema and use the document identity from a fresh read; say that it can be restored from trash.
 - A skill cannot widen what an agent may do. Do not write one that claims to approve spend, sends or permissions.
 - Do not copy secrets, credentials or customer personal data into a skill.
 

package/agent-plugin/skills/social/SKILL.md

@@ -3,7 +3,7 @@ name: social
 description: "Own a short-form social post for its whole life across connected channels. Read the channel registry and learned brand voice, draft and revise, submit for review, approve, schedule or reschedule, publish now, unschedule, and archive."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Social
 

package/agent-plugin/skills/visibility/SKILL.md

@@ -3,7 +3,7 @@ name: visibility
 description: "Get found by search engines and answer engines. Pick the query set, gather crawl, index, mention and citation evidence, fix pages, then measure the change."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Visibility
 

package/agent-plugin/skills/workflows/SKILL.md

@@ -3,7 +3,7 @@ name: workflows
 description: "Best practices for building and running automations that are not outreach sequences: frame the job, smallest graph, validate after every change, runtime inputs, safe recovery of failed runs."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Workflows
 

package/agent-plugin/skills/worksheet-tidy/SKILL.md

@@ -3,7 +3,7 @@ name: worksheet-tidy
 description: "Review a workbook worksheet's structure and values, including duplicate or overlapping columns, column order, types and formatting, columns to hide, criteria and run conditions that never vary, and suspicious values, then apply reversible fixes. Use it when a worksheet has grown messy, before sharing it, or before enrolling it into a sequence. It does not merge CRM records across the workspace, rebuild the list's source (list-building does) or explain failed runs (diagnostics does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Worksheet Tidy
 
@@ -12,7 +12,7 @@ Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabiliti
 - Owns: reversible worksheet structure and value fixes.
 - Sources, columns, criteria, and building lists: [`list-building`].
 - Explaining failed runs and spend: [`diagnostics`].
-- The `tables` pack lists the tools and their exact inputs. When user says delete, permanently delete named workbook, worksheet, view, row, or column after showing removal impact and receiving explicit approval. When user says archive, archive only. Never say permanent deletion is unavailable.
+- The `tables` pack lists the tools and their exact inputs. When user says delete, permanently delete named workbook, worksheet, view, row, or column after reviewing removal impact and setting the commit field. When user says archive, archive only. Never say permanent deletion is unavailable.
 
 A tidy worksheet reads left to right like the reasoning behind the list: who the row is, what proves they fit, how well they fit, and how to reach them. Tidying makes that visible without destroying evidence.
 

package/agent-plugin/skills/writing/SKILL.md

@@ -3,7 +3,7 @@ name: writing
 description: "Draft, revise and publish articles and landing copy grounded in workspace context and a target query."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Writing
 

package/agent-plugin/skills/writing/publishing.md

@@ -12,7 +12,7 @@ Article creation, article updates, and native-article deliveries accept linkedin
 
 ## The state machine
 
-1. Search the article surface for the operation that creates an article with its initial schedule. It creates the article, linked artifact, first version, and delivery scaffolding in one transaction. There is no separate bare-draft article creation path.
+1. Search the article surface for the operation that creates an article with its initial schedule. It creates the article, linked artifact, first version, and delivery scaffolding in one transaction. When the user only wants an empty draft to fill in later, search for the operation that creates an empty article draft instead; it schedules nothing.
 2. A scheduled drafting job may create or revise reviewable drafts, but it never delivers content. For outward delivery, show the exact final revision and destination, then act when the user asked or confirms.
 3. Revise through the article update operation using the current expected revision from an exact article read. On revision conflict, re-read and deliberately reapply. An in-flight delivery or slug collision is a state conflict to inspect, not a reason for blind retry. Treat prior review records as historical after any edit.
 4. Editorial submission moves the linked artifact into review. It does not schedule or deliver.

package/agent-plugin/skills/writing/revision-and-voice.md

@@ -24,7 +24,7 @@ Before writing a first sentence, read 3-5 recently published pieces by searching
 
 ## Saved library outputs
 
-A saved output is a reusable library copy of generated post text, not a live calendar artifact and not a published post. Create, revise, list, and archive it through its own dedicated capabilities, discovered at runtime; archiving marks it inactive rather than hard-deleting it. Revising it can touch any of its editable fields on an active row, but it never schedules, publishes, enrolls, or sends anything. After updating, the library row is the source of truth; do not call a scheduling or publish capability just to "save" a library edit.
+A saved output is a reusable library copy of generated post text, not a live calendar artifact and not a published post. Create, revise, list, and delete it through its own dedicated capabilities, discovered at runtime. Deleting removes the library copy for good and nothing restores it, so confirm with the user before deleting one they did not ask to remove. Revising it can touch any of its editable fields on an active row, but it never schedules, publishes, enrolls, or sends anything. After updating, the library row is the source of truth; do not call a scheduling or publish capability just to "save" a library edit.
 
 ## Landing copy specifics
 

package/agent-plugin/skills/x-posts/SKILL.md

@@ -3,7 +3,7 @@ name: x-posts
 description: "Write and revise X posts and threads: the first line, single post versus thread, weighted length and Premium limits, thread structure, post types, replies and links, and phrases to avoid. Use it for the copy of any post going to X. It does not cover scheduling, publishing or automations (social does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # X posts
 

package/dist/agentGuidance.generated.json

@@ -1,9 +1,9 @@
 {
     "generated_by": "packages/cli/scripts/build-agent-plugin.mjs from apps/backend/src/services/mcp/consentRule.json; do not edit by hand",
     "consent": {
-        "summary": "Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own.",
-        "paid_run": "Anything that writes, spends credits or reaches a real person: run mode dry_run first, show the user the preview, the row count and the credit estimate, then run live with the quote_hash that dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A live paid run states max_rows; an external send states max_live_sends of at least the dry_run recipient_count. A quote returned by a refused live call is only a price, never a confirmation.",
-        "human_approval": "A paid run above the server's row or provider-spend limit, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs the user's yes. Ask them, and only then send approved: true with the same quote_hash. You are asserting that you asked a person; never send it on your own."
+        "summary": "Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply.",
+        "paid_run": "For writes, credit spend or external effects: dry_run first, review the row count and credit estimate, then run live with the quote_hash that dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. Supply max_rows or max_live_sends only when the fetched capability schema declares them; when an external send accepts max_live_sends, cover at least the dry_run recipient_count. Sequence lifecycle and enrollment calls have no lifetime send ceiling. A quote returned by a refused live call is only a price, never a confirmation.",
+        "human_approval": "A paid run above the server's row or provider-spend limit, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs approved: true with the same quote_hash, after reviewing the preview. Free formulas need no paid-run approval; row execution caps still apply."
     },
     "router_steps": [
         {
@@ -24,7 +24,7 @@
         {
             "mcp": "tools_run",
             "cli": "dreamstate tools run <capability_id> --params '{...}' --mode <dry_run|live> --json",
-            "text": "runs it with `capability_id` and `params`. The gating inputs (`mode`, `max_credits`, `idempotency_key`, `quote_hash`, `approved`) go on the run call itself, never inside `params`. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`."
+            "text": "runs it with `capability_id` and `params`. The gating inputs (`mode`, `max_credits`, `idempotency_key`, `quote_hash`, `approved`) go on the run call itself, never inside `params`. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` goes inside `params` only when the fetched capability schema declares it (for example, a one-contact workflow run). Sequence start, resume, launch and enrollment do not accept it; they have no lifetime send ceiling."
         },
         {
             "mcp": "runs_get",

package/dist/gatedRun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gatedRun.d.ts","sourceRoot":"","sources":["../src/gatedRun.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAA0B,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEnF,OAAO,EAA4F,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAoBnJ,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIvD;AAUD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAKjF;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAKrI;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAKzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAazF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAMrE;AA0HD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzH;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qGAAqG;IACrG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AASD,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAmMvG;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAEpE;AAED,mGAAmG;AACnG,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAGlB"}
+{"version":3,"file":"gatedRun.d.ts","sourceRoot":"","sources":["../src/gatedRun.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAA0B,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEnF,OAAO,EAA4F,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAoBnJ,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIvD;AAUD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAKjF;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAKrI;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAKzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAazF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAMrE;AA6JD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzH;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qGAAqG;IACrG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AASD,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAyLvG;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAEpE;AAED,mGAAmG;AACnG,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAGlB"}

package/dist/gatedRun.js

@@ -154,14 +154,6 @@ function quotePriced(capabilityId, body, quote) {
     const credits = quote.maximum_credits === null ? 'credits not stated' : `up to ${quote.maximum_credits} credits`;
     return `Dry run of ${capabilityId} priced: ${rows}, ${credits}.`;
 }
-/** A known price of 0 spends nothing. An unknown price or a positive price is sent only after the caller passes the approval flag. */
-function spendNeedsApproval(maximum, approved) {
-    if (approved)
-        return false;
-    if (maximum === 0)
-        return false;
-    return true;
-}
 const CREDENTIALS_REQUIRED_SENTENCE = 'A connected credential is required before this run can continue.';
 function readinessRecord(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
@@ -246,6 +238,41 @@ function readinessRefusal(value) {
     const code = credentials ? 'credentials_required' : codes[0] ?? 'not_ready';
     return new client_1.CliError(sentence, code, 409, { retryable: false });
 }
+const UNSUCCESSFUL_TERMINAL_RUN_STATUSES = new Set(['failed', 'completed_with_errors', 'partially_completed']);
+/**
+ * A runs.get HTTP 200 says read succeeded, not that durable work succeeded.
+ * Keep the terminal receipt in error details so callers can inspect or resume
+ * without treating a failed run as a successful CLI command.
+ */
+function terminalRunOutcomeRefusal(value) {
+    const root = readinessRecord(value);
+    const data = readinessRecord(root?.data) ?? root;
+    const run = readinessRecord(data?.run);
+    const status = typeof run?.status === 'string' ? run.status : null;
+    if (!run || !status || !UNSUCCESSFUL_TERMINAL_RUN_STATUSES.has(status))
+        return null;
+    const runId = typeof run.run_id === 'string' ? run.run_id : typeof run.id === 'string' ? run.id : null;
+    const stepErrors = Array.isArray(run.steps)
+        ? run.steps.flatMap((step) => {
+            const record = readinessRecord(step);
+            return [readinessRecord(record?.error), readinessRecord(record?.user_error)];
+        })
+        : [];
+    const typedError = [readinessRecord(run.error), readinessRecord(run.user_error), ...stepErrors]
+        .find((error) => typeof error?.code === 'string' && typeof error.message === 'string');
+    const typedDetails = readinessRecord(typedError?.details);
+    const details = {
+        ...(typedDetails ?? {}),
+        ...(typedError?.details !== undefined && !typedDetails ? { run_error_details: typedError.details } : {}),
+        ...(runId ? { run_id: runId } : {}),
+        status,
+    };
+    return new client_1.CliError(typeof typedError?.message === 'string' ? typedError.message : `Run${runId ? ` ${runId}` : ''} ended with status ${status}.`, typeof typedError?.code === 'string' ? typedError.code : 'run_failed', typeof typedError?.http_status === 'number' ? typedError.http_status : 409, {
+        details,
+        retryable: typeof typedError?.retryable === 'boolean' ? typedError.retryable : false,
+        ...(typedError?.repair !== undefined ? { repair: typedError.repair } : {}),
+    });
+}
 /** Adds the idempotency key to the printed meta, so a user can see which key to re-run with. */
 function withIdempotencyMeta(value, key) {
     const envelope = record(value);
@@ -323,7 +350,6 @@ async function runGated(context, input) {
     let quotedMaximum = !explicitQuote && cached?.quote_hash ? cached.maximum_credits : undefined;
     let ranDryRun = false;
     let sentKey = null;
-    const approvalRequired = () => new client_1.CliError('This run spends credits. Rerun the same command with --approved.', 'approval_required', 409, { retryable: false, repair: { kind: 'ask_user', hint: 'Rerun the same command with --approved.' } });
     const requestBody = () => ({
         ...body,
         ...(turnToken ? { tool_turn_token: turnToken } : {}),
@@ -358,13 +384,10 @@ async function runGated(context, input) {
         try {
             if (live && quoteHash) {
                 const maximum = explicitQuote ? null : quotedMaximum ?? null;
-                if (spendNeedsApproval(maximum, body.approved === true)) {
-                    stderr.write(`${quotePriced(capabilityId, body, { quote_hash: quoteHash, maximum_credits: maximum })}\n`);
-                    throw approvalRequired();
-                }
-                if (body.approved === true || maximum === 0) {
-                    stderr.write(`${quotePriced(capabilityId, body, { quote_hash: quoteHash, maximum_credits: maximum })}\nRunning live on that quote.\n`);
-                }
+                // The shared gateway owns per-call paid, external-effect and recurring
+                // consent. A positive quote alone does not require human approval.
+                // Forward only caller-supplied approval; preserve every server refusal.
+                stderr.write(`${quotePriced(capabilityId, body, { quote_hash: quoteHash, maximum_credits: maximum })}\nRunning live on that quote.\n`);
             }
             result = await run();
         }
@@ -404,8 +427,6 @@ async function runGated(context, input) {
                 quotedMaximum = quote.maximum_credits;
                 stderr.write(`${quotePriced(capabilityId, body, quote)}\n`);
                 await (0, turnCache_1.rememberTurnToken)(context.turnsPath, context.baseUrl, context.turnKey, capabilityId, turnToken, Date.now(), warnTurnCache, { quote_hash: quote.quote_hash, fingerprint, maximum_credits: quote.maximum_credits });
-                if (spendNeedsApproval(quote.maximum_credits, body.approved === true))
-                    throw approvalRequired();
                 stderr.write('Running live on that quote.\n');
                 result = await run();
             }
@@ -451,14 +472,14 @@ async function runGated(context, input) {
     // the read-back/retry rule. A terminal response completes this attempt.
     if (attemptIdentity && !timedOut)
         await (0, idempotency_1.finishIdempotencyAttempt)(idempotencyPath, attemptIdentity);
-    const blocked = readinessRefusal(result);
-    if (blocked)
-        throw blocked;
+    const outcomeRefusal = refusalFromRunResult(result);
+    if (outcomeRefusal)
+        throw outcomeRefusal;
     return { value: withIdempotencyMeta(result, explicitKey ? null : sentKey), timedOut, idempotencyKey: sentKey, turnToken: turnToken ?? null };
 }
 /** Blocker refusal for a run envelope that did not go through runGated (runs wait). */
 function refusalFromRunResult(value) {
-    return readinessRefusal(value);
+    return readinessRefusal(value) ?? terminalRunOutcomeRefusal(value);
 }
 /** A read the CLI needs before it can form a write, run through the same gate as any other run. */
 async function readCapability(context, capabilityId, params, waitTimeout) {

package/dist/generated/packVerbs.generated.json

@@ -1,6 +1,6 @@
 {
     "generated_by": "packages/cli/scripts/generate-pack-verbs.mjs from apps/backend/src/services/v1/capabilityRegistry/catalog.snapshot.json; do not edit by hand",
-    "registry_hash": "0919f010ebbbf4a46e5c0e68f9f8f3026abc6420aa325716911cd528c59568ea",
+    "registry_hash": "cc2942a6cb32d0b729425cddbac041ca120ec2841e496506874d5204158a62fc",
     "verbs": [
         {
             "command": "sequences analytics",

package/dist/tablesImport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tablesImport.d.ts","sourceRoot":"","sources":["../src/tablesImport.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlE;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,gBAAgB,OAAQ,CAAC;AACtC,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAC3C,wEAAwE;AACxE,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,SAAU,CAAC;AAY3C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAQD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoB1E;AAMD,6HAA6H;AAC7H,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAC5B,MAAM,GAAG,IAAI,CAMf;AAkCD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiJ1H"}
+{"version":3,"file":"tablesImport.d.ts","sourceRoot":"","sources":["../src/tablesImport.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlE;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,gBAAgB,OAAQ,CAAC;AACtC,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAC3C,wEAAwE;AACxE,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,SAAU,CAAC;AAY3C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAuBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoB1E;AAMD,6HAA6H;AAC7H,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAC5B,MAAM,GAAG,IAAI,CAMf;AAkCD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiJ1H"}

package/dist/tablesImport.js

@@ -46,6 +46,20 @@ const IDENTITY_PREFERENCE = {
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
+function durableRunSteps(run) {
+    const partialResults = record(run.partial_results);
+    const attachOutputs = (step) => {
+        const entry = record(step) ?? {};
+        const stepId = entry.step_id;
+        return entry.outputs === undefined && typeof stepId === 'string' && partialResults && stepId in partialResults
+            ? { ...entry, outputs: partialResults[stepId] }
+            : entry;
+    };
+    return [
+        ...(Array.isArray(run.completed) ? run.completed.map(attachOutputs) : []),
+        ...(Array.isArray(run.incomplete) ? run.incomplete.map(attachOutputs) : []),
+    ];
+}
 const FAILED_STATUSES = new Set(['failed', 'cancelled', 'canceled', 'timed_out', 'rejected']);
 /**
  * The outputs of a capability run, whichever envelope nesting the door used. A
@@ -56,7 +70,7 @@ function capabilityOutputs(result) {
     const data = record(record(result)?.data);
     const run = record(data?.run);
     if (run) {
-        const steps = Array.isArray(run.steps) ? run.steps : Array.isArray(run.completed) ? run.completed : [];
+        const steps = Array.isArray(run.steps) ? run.steps : durableRunSteps(run);
         const stepError = steps.map((step) => record(record(step)?.user_error)).find(Boolean) ?? record(run.user_error);
         if (typeof run.status === 'string' && FAILED_STATUSES.has(run.status)) {
             throw new client_1.CliError(typeof stepError?.message === 'string' ? stepError.message : `The run ${run.status}.`, typeof stepError?.code === 'string' ? stepError.code : 'run_failed', 0, { details: stepError ? { user_error: stepError } : undefined, retryable: false });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trydreamstate/cli",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "description": "Live command-line client for the Dreamstate v1 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -19,7 +19,8 @@
     "README.md"
   ],
   "scripts": {
-    "build": "node scripts/generate-pack-verbs.mjs --check && node scripts/generate-run-contract.mjs --check && node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc && node scripts/build-agent-plugin.mjs",
+    "build": "node scripts/generate-pack-verbs.mjs --check && node scripts/generate-run-contract.mjs --check && node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && node scripts/build-agent-plugin.mjs && tsc",
+    "pretest": "npm run build --workspace=@dreamstate/types",
     "test": "node scripts/build-agent-plugin.mjs --check && npm run build && jest --config jest.config.cjs --runInBand",
     "type-check": "tsc --noEmit",
     "pack:check": "npm pack --dry-run",