@oxygen-agent/cli 1.1003.12 → 1.1010.1

package/node_modules/@oxygen/shared/dist/hosted-ai.js

@@ -48,11 +48,68 @@ export const HOSTED_AI_MODEL_REGISTRY = {
         },
     },
     copilot: {
+        /**
+         * "Oxygen Auto" -- the only tier a new session gets, and the one the main
+         * conversation thread runs on for its whole life. It is NOT a router: the
+         * model never changes mid-session, because an OpenRouter prompt cache is
+         * model-scoped and a mid-turn switch would turn a ~66% cache HIT rate into a
+         * cache WRITE on a fresh model, ten times a turn. Models only change below
+         * this thread, where the context is fresh -- see COPILOT_ERRAND_LEVEL.
+         *
+         * `reasoningEffort: "medium"` is the change that made this tier worth
+         * shipping. Until 2026-09-21 this model was sent with NO `reasoning` field at
+         * all, on a registry comment asserting K3 was max-reasoning-only. Measured
+         * against the live API on the same prompt and tool schema, that claim was
+         * false and the omission was the expensive case:
+         *
+         *   omitted -> 412 reasoning tokens, $0.00779, 10.0s
+         *   low     -> 206,                  $0.00566,  9.2s
+         *   medium  -> 124,                  $0.00342,  4.8s   <- 56% cheaper, 2.1x faster
+         *   high    -> 528,                  $0.01075, 14.8s
+         *
+         * All four returned the same answer. Reasoning was 38% of output tokens on a
+         * surface where output is ~61% of the bill.
+         */
+        auto: {
+            model: "moonshotai/kimi-k3",
+            displayName: "Oxygen Auto",
+            // z-ai/glm-5.3 rather than the old moonshotai/kimi-k2.6: k2.6 advertises
+            // `reasoning` but NOT `reasoning_effort`, and caps at 262k context, so
+            // falling back to it silently dropped both the dial above and three
+            // quarters of the window. GLM-5.3 keeps both and caches automatically.
+            fallbackModels: ["z-ai/glm-5.3"],
+            reasoningEffort: "medium",
+            estPromptUsdPerM: 1.7,
+            estCompletionUsdPerM: 8.5,
+            maxOutputTokens: 8192,
+        },
         low: {
+            // The errand model: sub-agents, compaction summaries and auto-titles. A
+            // child builds its own Agent with its own messages, so it starts cold on
+            // any model -- which is why a switch is free HERE and nowhere above it.
+            //
+            // This was deepseek/deepseek-v4.1-flash for about an hour, chosen for
+            // being newer and measured correct on a one-tool arithmetic probe. Probed
+            // again against the REAL runtime tool schemas from tools.ts
+            // (capability_search + capability_run, nested `args`, optional approval
+            // fields) under the same provider.require_parameters=true the transport
+            // always sends, it returned `finish_reason: "error"` with zero tool calls
+            // on 1 of 5 attempts, every one served by the Relace endpoint. v4-flash
+            // went 5/5 clean on StreamLake, is CHEAPER on both axes, and is already
+            // what auto-titles run on -- so the newer model was worse on reliability
+            // and on price, and the only thing recommending it was its version number.
+            //
+            // A child that emits no tool call returns nothing for what it spent, and
+            // the transport does not retry `finish_reason: "error"` on the primary
+            // (classifyModelError sends it straight to the next model), so a 20%
+            // error rate here is a 20% double round trip on every delegation.
             model: "deepseek/deepseek-v4-flash",
             displayName: "DeepSeek V4 Flash",
-            fallbackModels: [],
-            reasoningEffort: "medium",
+            // v4.1-flash earns its place HERE: it works 4 times in 5 and it is a
+            // genuinely different endpoint on a different provider, which is the one
+            // thing a fallback has to be.
+            fallbackModels: ["deepseek/deepseek-v4.1-flash"],
+            reasoningEffort: "low",
             estPromptUsdPerM: 0.09,
             estCompletionUsdPerM: 0.18,
             maxOutputTokens: 8192,
@@ -66,14 +123,20 @@ export const HOSTED_AI_MODEL_REGISTRY = {
             estCompletionUsdPerM: 0.87,
             maxOutputTokens: 8192,
         },
+        /**
+         * Retained only for sessions created before "Oxygen Auto" shipped, whose
+         * `reasoning_level` is already 'high' on the row. Same model as `auto`, and
+         * it now carries the same effort dial -- the old "K3 is max-only" comment
+         * here was measured false (see `auto`), and an existing session should not
+         * keep paying for the omission just because it started earlier.
+         */
         high: {
             model: "moonshotai/kimi-k3",
             displayName: "Kimi K3",
-            fallbackModels: ["moonshotai/kimi-k2.6"],
-            // No reasoningEffort: Kimi K3 is max-only; the request builder omits the
-            // reasoning param for this tier.
-            estPromptUsdPerM: 3,
-            estCompletionUsdPerM: 15,
+            fallbackModels: ["z-ai/glm-5.3"],
+            reasoningEffort: "medium",
+            estPromptUsdPerM: 1.7,
+            estCompletionUsdPerM: 8.5,
             maxOutputTokens: 8192,
         },
     },
@@ -125,13 +188,58 @@ export const MANAGED_AI_TIER_LABELS = {
     medium: "Oxygen Balanced",
     high: "Oxygen Max",
 };
-/** The reasoning tier the hosted copilot runs at by default. */
-export const COPILOT_DEFAULT_LEVEL = "high";
+/**
+ * What the Copilot calls its tiers.
+ *
+ * Separate from MANAGED_AI_TIER_LABELS rather than folded into it because the
+ * Copilot's level set is not the AI column's: only the Copilot has `auto`, and
+ * only the Copilot has stopped offering a choice. AI columns and Agents still
+ * sell Fast/Balanced/Max and still mean it.
+ *
+ * Every current session reads "Oxygen Auto". The other three exist so a session
+ * created before 2026-09-21 still renders as the thing its owner picked, rather
+ * than being relabelled under them.
+ */
+export const COPILOT_TIER_LABELS = {
+    ...MANAGED_AI_TIER_LABELS,
+    auto: "Oxygen Auto",
+};
+/**
+ * The tier every new Copilot session gets. There is no longer a picker: "Oxygen
+ * Auto" is the whole customer-facing choice (Philipp, 2026-09-21).
+ *
+ * It was `high` until then, which is why 83% of production sessions ran the most
+ * expensive tier -- 110 of 132 sessions across 69 of 81 tenants -- while the
+ * composer's own dropdown told the user that medium was "The default for most
+ * GTM work". Nobody chose that; we defaulted them into it.
+ */
+export const COPILOT_DEFAULT_LEVEL = "auto";
+/**
+ * The tier the Copilot's ERRANDS run at: sub-agent children, compaction
+ * summaries, and auto-titles.
+ *
+ * This is the only place a model may differ from the session's own, and it is
+ * safe for one reason: each of those builds a FRESH context rather than
+ * continuing the main transcript -- a child constructs its own Agent and
+ * messages (`packages/agent-runtime/src/subagents.ts`), and the summarizer sends
+ * a two-message prompt with no tools
+ * (`packages/agent-runtime/src/strands-runtime.ts` summarizeForCompaction). A
+ * cold context has no prompt cache to lose and no transcript to corrupt, so the
+ * switch costs nothing. Switching the main thread would cost both.
+ *
+ * It matters because delegation is habitual and currently doubles the price of a
+ * turn: measured over 30 days to 2026-09-21, the 26% of turns that fired
+ * `subagent_run` produced 45% of all Copilot credit burn (1,805 credits/turn
+ * against 786), because every child inherited the parent's model through the
+ * parent's own `callModel`.
+ */
+export const COPILOT_ERRAND_LEVEL = "low";
 export const AGENT_DEFAULT_LEVEL = "medium";
 const LEVEL_ENV_SUFFIX = {
     low: "LOW",
     medium: "MEDIUM",
     high: "HIGH",
+    auto: "AUTO",
 };
 function readTrimmedEnv(env, key) {
     const raw = env[key];
@@ -181,7 +289,14 @@ export function findHostedAiModelSpec(model, preferredUseCase) {
     return null;
 }
 export function resolveHostedAiModel(input) {
-    const base = HOSTED_AI_MODEL_REGISTRY[input.useCase][input.level];
+    // `auto` exists only on the copilot registry. Asking ai_column or agent for it
+    // is a caller bug, and resolving `undefined` here would hand the request
+    // builder a spec with no model id at all -- so it falls back to that use
+    // case's own default rather than reaching the provider with nothing.
+    const levels = HOSTED_AI_MODEL_REGISTRY[input.useCase];
+    const base = levels[input.level]
+        ?? levels[input.useCase === "copilot" ? COPILOT_DEFAULT_LEVEL : AGENT_DEFAULT_LEVEL]
+        ?? HOSTED_AI_MODEL_REGISTRY[input.useCase].medium;
     if (input.useCase === "ai_column")
         return base;
     const env = input.env ?? process.env;

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -95,6 +95,7 @@ export * from "./tags.js";
 export * from "./telemetry.js";
 export * from "./tenant-database-secret.js";
 export * from "./egress-transport-readiness.js";
+export * from "./mailbox-egress-ownership.js";
 export * from "./rate-window.js";
 export * from "./timing.js";
 export * from "./type-guards.js";
@@ -135,5 +136,6 @@ export * from "./ugc-amplification-identity.js";
 export * from "./knowledge-repository.js";
 export * from "./knowledge-bases.js";
 export * from "./external-write-policy.js";
+export * from "./cutover-freeze.js";
 export * from "./log-sink-selector.js";
 export * from "./otlp-log-sink.js";

package/node_modules/@oxygen/shared/dist/index.js

@@ -106,6 +106,7 @@ export * from "./tags.js";
 export * from "./telemetry.js";
 export * from "./tenant-database-secret.js";
 export * from "./egress-transport-readiness.js";
+export * from "./mailbox-egress-ownership.js";
 export * from "./rate-window.js";
 export * from "./timing.js";
 export * from "./type-guards.js";
@@ -171,5 +172,6 @@ export * from "./ugc-amplification-identity.js";
 export * from "./knowledge-repository.js";
 export * from "./knowledge-bases.js";
 export * from "./external-write-policy.js";
+export * from "./cutover-freeze.js";
 export * from "./log-sink-selector.js";
 export * from "./otlp-log-sink.js";

package/node_modules/@oxygen/shared/dist/langfuse.d.ts

@@ -1,3 +1,4 @@
+import { type LlmPromptRef } from "./llm-prompts.js";
 type EnvMap = Record<string, string | undefined>;
 export type LlmObservationLevel = "DEBUG" | "DEFAULT" | "WARNING" | "ERROR";
 export type LlmTraceBody = {
@@ -45,6 +46,12 @@ export type LlmGenerationBody = LlmSpanBody & {
     completionStartTime?: Date | null;
     usageDetails?: Record<string, number>;
     costDetails?: Record<string, number>;
+    /**
+     * The template this call rendered from (`@oxygen/shared/llm-prompts`).
+     * Always recorded as metadata; a registered code prompt also links to its
+     * native Langfuse prompt version once that version has been resolved.
+     */
+    prompt?: LlmPromptRef | null;
 };
 export type LlmEventBody = {
     id: string;
@@ -137,7 +144,7 @@ export type LlmCorrelation = {
 };
 export type LlmEmission = {
     kind: LlmEmissionKind;
-    observationId?: string;
+    observationId?: string | undefined;
     parentObservationId?: string;
     isRoot?: boolean;
     /** External seed (turn/run id) — hashed into the W3C trace id. */
@@ -159,6 +166,41 @@ export type LlmScorer = {
     /** Resolves true when the score was accepted. Never rejects. */
     score(body: LlmScoreBody): Promise<boolean>;
 };
+type WarnFn = (error: unknown, context?: Record<string, unknown>) => void;
+export type LlmExportSummary = {
+    /** OTLP spans Langfuse acknowledged (synthetic roots, slices and payload chunks each count). */
+    exported(count: number): void;
+    /** OTLP spans in a batch the exporter gave up on (same unit as exported). */
+    failed(count: number): void;
+    /**
+     * Client observations discarded before export (build error, transport
+     * unavailable), one per call even when it would have fanned out to several
+     * spans, so exported:dropped is not a like-for-like ratio.
+     */
+    dropped(count: number): void;
+    /** Logs the window when it is at least a minute old; otherwise no-op. */
+    maybeReport(): void;
+    /** Logs whatever is pending regardless of age (process shutdown). */
+    reportNow(): void;
+};
+export declare function createLlmExportSummary(now?: () => number): LlmExportSummary;
+/**
+ * Resolves a registered code prompt (name + content hash) to the native
+ * Langfuse prompt version the deploy-time sync created for it. Synchronous
+ * and non-blocking: an unknown mapping returns undefined and starts one
+ * background lookup, so the first generation of a template in a process
+ * carries metadata only and later ones carry the native link.
+ *
+ * A deployed development process on the self-hosted instance also publishes a
+ * missing template itself (label `oxygen-<hash>` only; `latest` stays owned by
+ * the sync): every template change used to leave dev unlinked until someone ran
+ * the sync by hand. Production, Langfuse Cloud and local processes never
+ * publish; syncing those stays a human step.
+ */
+export type LlmPromptVersionResolver = {
+    versionFor(prompt: LlmPromptRef): number | undefined;
+};
+export declare function createApiPromptResolver(env: EnvMap, warn: WarnFn, fetchImpl?: typeof fetch, now?: () => number): LlmPromptVersionResolver;
 /**
  * Construct a fail-open Langfuse client, or `null` when tracing is disabled or
  * misconfigured. Prefer the process-wide `getLlmTracingClient` in app code;
@@ -167,6 +209,7 @@ export type LlmScorer = {
 export declare function createLlmTracingClient(env?: EnvMap, options?: {
     emitterImpl?: LlmEmitter;
     scorerImpl?: LlmScorer;
+    promptResolverImpl?: LlmPromptVersionResolver;
 }): LlmTracingClient | null;
 export declare function getLlmTracingClient(env?: EnvMap): LlmTracingClient | null;
 /** Flush the singleton if it exists. Never rejects. Hang off request/cycle ends. */