@oxygen-agent/cli 1.1013.93 → 1.1014.18

package/node_modules/@oxygen/shared/dist/langfuse.js

@@ -51,7 +51,7 @@ const LANGFUSE_EXPORT_TIMEOUT_SECONDS = 10;
 const MAX_JSON_FIELD_CHARS = 400_000;
 /**
  * FAIL CLOSED: LLM tracing is on only when OXYGEN_LLM_TRACING_ENABLED is exactly
- * "1"/"true" (trimmed, case-insensitive) AND both Langfuse keys are present.
+ * "1"/"true" (trimmed, case-insensitive), both keys and an explicit self-hosted URL.
  */
 export function isLlmTracingEnabled(env = process.env) {
     const raw = env.OXYGEN_LLM_TRACING_ENABLED;
@@ -61,7 +61,22 @@ export function isLlmTracingEnabled(env = process.env) {
     if (normalized !== "1" && normalized !== "true")
         return false;
     return ((env.LANGFUSE_PUBLIC_KEY?.trim() ?? "") !== "" &&
-        (env.LANGFUSE_SECRET_KEY?.trim() ?? "") !== "");
+        (env.LANGFUSE_SECRET_KEY?.trim() ?? "") !== "" &&
+        langfuseEndpoint(env) !== undefined);
+}
+// Never let the SDK's managed default receive protected prompt payloads.
+function langfuseEndpoint(env) {
+    try {
+        const url = new URL(env.LANGFUSE_BASE_URL?.trim() ?? "");
+        const hostname = url.hostname.replace(/\.$/, "");
+        if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash ||
+            hostname === "langfuse.com" || hostname.endsWith(".langfuse.com"))
+            return undefined;
+        return url.toString().replace(/\/+$/, "");
+    }
+    catch {
+        return undefined;
+    }
 }
 // The Langfuse "environment" dimension separates dev/prod traces inside one
 // project. Explicit LANGFUSE_TRACING_ENVIRONMENT (Doppler, per config) wins.
@@ -234,7 +249,10 @@ function createOtelEmitter(env, warn, summary) {
                     import("@langfuse/tracing"), import("@opentelemetry/api"), import("@langfuse/core"),
                     import("@opentelemetry/otlp-transformer"),
                 ]);
-                const exportUrl = `${(env.LANGFUSE_BASE_URL?.trim() || "https://cloud.langfuse.com").replace(/\/+$/, "")}/api/public/otel/v1/traces`;
+                const endpoint = langfuseEndpoint(env);
+                if (!endpoint)
+                    throw new Error("langfuse_endpoint_invalid");
+                const exportUrl = `${endpoint}/api/public/otel/v1/traces`;
                 const exportHeaders = {
                     "Content-Type": "application/json",
                     Authorization: `Basic ${Buffer.from(`${env.LANGFUSE_PUBLIC_KEY}:${env.LANGFUSE_SECRET_KEY}`).toString("base64")}`,
@@ -473,9 +491,7 @@ function createOtelEmitter(env, warn, summary) {
  * environment tag; the tag is the `environment` FIELD on the score body, and it
  * is resolved from the same helper the span processor uses so a score lands in
  * the same Langfuse environment as the trace it scores. OXYGEN always sets
- * LANGFUSE_BASE_URL (the project is US-region and the EU host 401s these keys);
- * the fallback is the SDK's documented default, which `@langfuse/core` itself
- * does not supply.
+ * LANGFUSE_BASE_URL explicitly; no managed endpoint is a fallback.
  */
 function createApiScorer(env, warn) {
     let handle = null;
@@ -483,8 +499,11 @@ function createApiScorer(env, warn) {
         handle ??= (async () => {
             try {
                 const { LangfuseAPIClient } = await import("@langfuse/core");
+                const endpoint = langfuseEndpoint(env);
+                if (!endpoint)
+                    throw new Error("langfuse_endpoint_invalid");
                 const client = new LangfuseAPIClient({
-                    environment: env.LANGFUSE_BASE_URL?.trim() || "https://cloud.langfuse.com",
+                    environment: endpoint,
                     username: env.LANGFUSE_PUBLIC_KEY,
                     password: env.LANGFUSE_SECRET_KEY,
                 });
@@ -570,7 +589,11 @@ function mayPublishMissingPrompts(env, baseUrl) {
     return host !== "langfuse.com" && !host.endsWith(".langfuse.com");
 }
 export function createApiPromptResolver(env, warn, fetchImpl = fetch, now = Date.now) {
-    const baseUrl = (env.LANGFUSE_BASE_URL?.trim() || "https://cloud.langfuse.com").replace(/\/+$/, "");
+    const baseUrl = langfuseEndpoint(env);
+    if (!baseUrl) {
+        warn(new Error("langfuse_endpoint_invalid"), { stage: "prompt_link" });
+        return { versionFor: () => undefined };
+    }
     const authorization = `Basic ${Buffer.from(`${env.LANGFUSE_PUBLIC_KEY}:${env.LANGFUSE_SECRET_KEY}`).toString("base64")}`;
     const cache = new Map();
     const inflight = new Set();
@@ -663,8 +686,13 @@ export function createApiPromptResolver(env, warn, fetchImpl = fetch, now = Date
  * this direct factory exists for tests (inject `emitterImpl`).
  */
 export function createLlmTracingClient(env = process.env, options) {
-    if (!options?.emitterImpl && !isLlmTracingEnabled(env))
+    if (!options?.emitterImpl && !isLlmTracingEnabled(env)) {
+        if (["1", "true"].includes(env.OXYGEN_LLM_TRACING_ENABLED?.trim().toLowerCase() ?? "") &&
+            env.LANGFUSE_PUBLIC_KEY?.trim() && env.LANGFUSE_SECRET_KEY?.trim() && !langfuseEndpoint(env)) {
+            log("warn", "llm_tracing.ingest_failed", { provider: "langfuse", error_code: "langfuse_endpoint_invalid", stage: "configuration" });
+        }
         return null;
+    }
     const lastWarnAtMs = new Map();
     const warn = (error, context) => {
         const nowMs = Date.now();

package/node_modules/@oxygen/shared/dist/object-storage.js

@@ -1,3 +1,4 @@
+import { assertAppStorageWriteAllowed } from "./app-storage-maintenance.js";
 import { randomUUID } from "node:crypto";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client, } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
@@ -152,6 +153,7 @@ export function isPublishingMediaObjectKeyForOrganization(key, organizationId) {
  * asks, plus the single-PUT maximum below, which no plan exceeds.
  */
 export async function presignImportUpload(input) {
+    assertAppStorageWriteAllowed();
     if (!Number.isSafeInteger(input.contentLength) || input.contentLength < 1
         || input.contentLength > IMPORT_OBJECT_SINGLE_PUT_MAX_BYTES) {
         throw new OxygenError("request_too_large", "Import file is too large to stage in one upload.", {
@@ -181,6 +183,7 @@ export async function presignImportUpload(input) {
     };
 }
 export async function presignPublishingMediaUpload(input) {
+    assertAppStorageWriteAllowed();
     const { client, config } = resolveClient();
     const storageKey = buildPublishingMediaObjectKey({
         organizationId: input.organizationId,
@@ -203,6 +206,7 @@ export async function presignPublishingMediaUpload(input) {
     };
 }
 export async function presignCopilotAttachmentUpload(input) {
+    assertAppStorageWriteAllowed();
     const { client, config } = resolveClient();
     const storageKey = buildCopilotAttachmentObjectKey({
         organizationId: input.organizationId,
@@ -331,6 +335,7 @@ export async function presignPublishingMediaDownload(input) {
     });
 }
 export async function presignInboxAvatarUpload(input) {
+    assertAppStorageWriteAllowed();
     const { client, config } = resolveClient();
     const storageKey = buildInboxAvatarObjectKey({
         organizationId: input.organizationId,
@@ -363,6 +368,7 @@ export async function presignInboxAvatarUpload(input) {
  * re-sniffs: the public route serves this back from our own origin.
  */
 export async function putInboxAvatarObject(input) {
+    assertAppStorageWriteAllowed();
     const { client, config } = resolveClient();
     const storageKey = buildInboxAvatarObjectKey({
         organizationId: input.organizationId,
@@ -385,6 +391,7 @@ export async function putInboxAvatarObject(input) {
  * in a bucket shared by every tenant and several non-avatar namespaces.
  */
 export async function replaceInboxAvatarObject(input) {
+    assertAppStorageWriteAllowed();
     if (!isInboxAvatarObjectKeyForOrganization(input.storageKey, input.organizationId)) {
         throw new OxygenError("invalid_object_key", "Refusing to replace an avatar that belongs to another organization.", { exitCode: 1 });
     }
@@ -441,6 +448,7 @@ export async function getInboxAvatarObjectMetadata(input) {
  * only proves "some org's avatar".
  */
 export async function deleteInboxAvatarObject(input) {
+    assertAppStorageWriteAllowed();
     if (!input.storageKey.startsWith("inbox-avatars/")) {
         throw new OxygenError("invalid_object_key", "Refusing to delete an object outside the inbox-avatars prefix.", { details: { prefix: input.storageKey.split("/")[0] ?? "" }, exitCode: 1 });
     }
@@ -452,6 +460,7 @@ export async function deleteInboxAvatarObject(input) {
     await client.send(new DeleteObjectCommand({ Bucket: config.bucket, Key: input.storageKey }));
 }
 export async function deleteImportObject(input) {
+    assertAppStorageWriteAllowed();
     const { client, config } = resolveClient();
     await client.send(new DeleteObjectCommand({ Bucket: config.bucket, Key: input.storageKey }));
 }

package/node_modules/@oxygen/shared/dist/sequences.d.ts

@@ -955,10 +955,14 @@ export type SequenceLintIssue = {
  *  - `sequence_step_sender_ignored`: a sender field on a step kind that does not
  *    take it is not stored. A blind CLI run put `sender_profile_id` on an email
  *    step before email took one; it was dropped without a word (2026-09-30).
+ *  - `sequence_step_field_ignored`: any other field a step kind (or one of its
+ *    A/B variants) does not take, e.g. `variants` on an invite or `subject_template`
+ *    on a variant of a threaded email. Steps are rebuilt from known fields, so
+ *    these read back missing with nothing to say why (2026-10-10).
  */
 export type SequenceDefinitionNotice = {
     path: string;
-    code: "email_reply_rewritten" | "sequence_linkedin_owner_conflict" | "sequence_step_sender_ignored";
+    code: "email_reply_rewritten" | "sequence_linkedin_owner_conflict" | "sequence_step_sender_ignored" | "sequence_step_field_ignored";
     message: string;
 };
 export type ValidateSequenceOptions = {

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -1220,6 +1220,8 @@ export function validateSequenceDefinition(input, options = {}) {
         const step = normalizeStep(rawStep, index, options, issues);
         if (!step)
             return;
+        if (options.notices)
+            options.notices.push(...ignoredStepFieldNotices(rawStep, step, index));
         if (usedIds.has(step.id)) {
             issues.push({ path: `steps[${index}].id`, message: `Duplicate step id '${step.id}'.` });
         }
@@ -1755,6 +1757,95 @@ raw, index, options, issues) {
             return null;
     }
 }
+// The fields each step kind stores beyond id/kind/channel and the sender
+// fields (which carry their own notice). Anything else is dropped on save.
+const STEP_KIND_FIELDS = {
+    visit_profile: [],
+    invite: ["note_template"],
+    wait_for_connection: ["timeout_days", "on_timeout"],
+    message: ["template", "variants", "auto_optimize", "attachments"],
+    inmail: ["subject_template", "template", "variants", "auto_optimize"],
+    follow: [],
+    like_post: ["reaction", "post_recency_days", "on_no_post"],
+    comment_post: ["text_template", "ai_prompt", "post_recency_days", "on_no_post"],
+    withdraw_invite: [],
+    email_send: ["subject_template", "body_template", "body_html_template", "cc", "bcc", "send_window", "variants", "auto_optimize"],
+    email_reply: ["body_template", "body_html_template", "cc", "bcc", "send_window", "variants", "auto_optimize"],
+    email_enroll: ["subsequence_id"],
+    email_move: ["subsequence_id"],
+    email_stop: [],
+    whatsapp_message: ["template", "variants", "auto_optimize"],
+    call_task: ["note", "priority", "timeout_days", "on_timeout"],
+    crm_task: ["provider", "connection_id", "property_mappings", "record_mappings", "record_links", "associations"],
+    wait: ["days", "hours", "jitter_hours"],
+    wait_for_signal: ["signal", "timeout_days", "on_timeout"],
+    branch: ["condition", "then", "else", "then_id", "else_id", "timeout_days"],
+    stop: [],
+};
+const STEP_COMMON_FIELDS = new Set(["id", "kind", "channel", "sender_profile_id", "sender_mailbox_id"]);
+const A_B_STEP_KINDS = "message, inmail, email_send and whatsapp_message";
+function meaningfulField(value) {
+    if (value === undefined || value === null || value === "")
+        return false;
+    return !(Array.isArray(value) && value.length === 0);
+}
+/** Copy fields an A/B variant of this (normalized) step may vary. */
+function variantFieldsFor(step) {
+    switch (step.kind) {
+        case "message":
+        case "whatsapp_message":
+            return ["template"];
+        case "inmail":
+            return ["subject_template", "template"];
+        case "email_send":
+            return sequenceEmailStepThreads(step) ? ["body_template", "body_html_template"] : ["subject_template", "body_template", "body_html_template"];
+        default:
+            return [];
+    }
+}
+/** Notices for every field of a raw step, or of its variants, that was not stored. */
+function ignoredStepFieldNotices(raw, step, index) {
+    if (!isRecord(raw) || typeof raw.kind !== "string")
+        return [];
+    const kind = raw.kind;
+    const takes = STEP_KIND_FIELDS[kind] ?? [];
+    const notices = [];
+    for (const [field, value] of Object.entries(raw)) {
+        if (STEP_COMMON_FIELDS.has(field) || takes.includes(field) || !meaningfulField(value))
+            continue;
+        const hint = field === "variants" || field === "auto_optimize"
+            ? ` A/B variants go on ${A_B_STEP_KINDS} steps.`
+            : field === "attachments"
+                ? " Only LinkedIn message steps take attachments."
+                : takes.length > 0 ? ` ${kind} steps take ${takes.join(", ")}.` : "";
+        notices.push({
+            path: `steps[${index}].${field}`,
+            code: "sequence_step_field_ignored",
+            message: `step '${step.id}': ${kind} steps do not take ${field}, so it was not saved.${hint}`,
+        });
+    }
+    const variants = raw.variants;
+    const variantFields = variantFieldsFor(step);
+    if (Array.isArray(variants) && variantFields.length > 0) {
+        variants.forEach((variant, variantIndex) => {
+            if (!isRecord(variant))
+                return;
+            for (const [field, value] of Object.entries(variant)) {
+                if (variantFields.includes(field) || !meaningfulField(value))
+                    continue;
+                const threaded = step.kind === "email_send" && field === "subject_template";
+                notices.push({
+                    path: `steps[${index}].variants[${variantIndex}].${field}`,
+                    code: "sequence_step_field_ignored",
+                    message: threaded
+                        ? `step '${step.id}': variant ${sequenceVariantLabel(variantIndex + 1)} sets subject_template, but this email has no subject (it continues the thread), so its variants vary only the body. Give the step a subject_template to test subjects.`
+                        : `step '${step.id}': variant ${sequenceVariantLabel(variantIndex + 1)} sets ${field}, which a ${step.kind} variant does not vary, so it was not saved. Its variants vary ${variantFields.join(", ")}.`,
+                });
+            }
+        });
+    }
+    return notices;
+}
 const LINKEDIN_POST_REACTION_SET = new Set(["like", "celebrate", "support", "funny", "love", "insightful"]);
 /** Max attachments per LinkedIn message (kept small — LinkedIn is not a file host). */
 const MAX_LINKEDIN_ATTACHMENTS = 5;

package/node_modules/@oxygen/shared/dist/tool-call-markup.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Removes tool-call markup from text that arrives in chunks. A chunk boundary
+ * can fall inside a token, so a suffix that could still become one is held until
+ * the next chunk decides it: never more than {@link MAX_HELD_CHARS} characters,
+ * and only when it starts with `<`, `[` or `]`.
+ */
+export declare function createToolCallMarkupFilter(): {
+    push: (chunk: string) => string;
+    flush: () => string;
+    /** True once anything has been removed from this stream. */
+    removedAny: () => boolean;
+};
+/**
+ * The text with every tool-call block and stray template token removed. Text
+ * that held none comes back unchanged, byte for byte; where something was cut,
+ * the blank lines it leaves collapse and the ends are trimmed.
+ */
+export declare function stripToolCallMarkup(text: string): string;
+/**
+ * Did the model try to CALL something in its text? Only a call block counts: a
+ * stray end-of-turn token is leakage worth stripping, not an attempted call.
+ */
+export declare function containsToolCallMarkup(text: string): boolean;

package/node_modules/@oxygen/shared/dist/tool-call-markup.js

@@ -0,0 +1,213 @@
+// Tool calls a model wrote as TEXT instead of making them.
+//
+// Every model behind an OpenAI-compatible endpoint has a native tool-call format
+// that the serving provider is supposed to parse out of the completion and hand
+// back as structured `tool_calls`. When that parse fails -- a template the
+// provider does not know, a spelling the parser does not expect, a block split
+// or left unclosed -- the raw markup arrives in `content` and streams straight
+// to the person reading the reply. Seen in a staff Copilot session on 2026-10-10:
+//
+//   I'll check Oxygen's signal sources and the play, then build a morning queue.
+//   <｜DSML｜tool_calls> <｜DSML｜invoke name="oxygen_knowledge_index"> …
+//
+// Nothing ran: the call never reached the runtime as a call. This module finds
+// that markup and removes it from user-visible text. It is deliberately a closed
+// list of known template tokens rather than a heuristic for "looks like a call":
+// prose that merely mentions a tool, or a JSON example in a code fence, passes
+// through untouched. The DeepSeek family is matched by shape, because its
+// parsers have met spaced (`<｜DSML｜ invoke`), doubled (`<||DSML||tool_calls>`)
+// and slash-less closing spellings in the wild; the others by their literals.
+//
+// Pure and browser-safe: the worker strips the live stream, the runtime strips a
+// final answer, and the web strips rows written before either did.
+function literalMarker(open, close) {
+    return {
+        find: (text) => {
+            const index = text.indexOf(open);
+            return index < 0 ? null : { index, match: open };
+        },
+        ...(close === undefined ? {} : { close: close === null ? null : () => new RegExp(escapeRegExp(close)) }),
+        couldStart: (tail) => open.startsWith(tail),
+    };
+}
+function patternMarker(pattern, partial, close) {
+    return {
+        find: (text) => {
+            const found = pattern.exec(text);
+            return found ? { index: found.index, match: found[0] } : null;
+        },
+        ...(close === undefined ? {} : { close }),
+        couldStart: (tail) => partial.test(tail),
+    };
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+// DeepSeek V3.2 and later: `<｜DSML｜tool_calls>`, `<｜DSML｜invoke name="…">`,
+// `<｜DSML｜parameter …>`, closed by the same tag with a slash (or, seen in the
+// wild, without one). One or two bars of either width, spaces anywhere.
+const DSML = String.raw `<\s*\/?\s*[|｜]{1,2}\s*DSML\s*[|｜]{1,2}\s*`;
+const DSML_PARTIAL = /^<\s*\/?\s*(?:[|｜]{1,2}\s*(?:D(?:S(?:M(?:L\s*[|｜]{0,2}\s*[A-Za-z_]*)?)?)?)?)?$/i;
+const BLOCK_MARKERS = [
+    patternMarker(
+    // A lookahead rather than `\b`, so `<｜DSML｜tool` at the end of a chunk
+    // waits for the rest of `tool_calls` instead of opening the wrong block.
+    /<\s*[|｜]{1,2}\s*DSML\s*[|｜]{1,2}\s*(?:tool_calls|tool_call|function_calls|function_call|toolcalls|calls|tool|invoke|parameter)(?=[^A-Za-z0-9_])/i, DSML_PARTIAL, (opened) => {
+        const kind = /([A-Za-z_]+)$/.exec(opened)?.[1] ?? "";
+        return new RegExp(`${DSML}${escapeRegExp(kind)}\\s*>`, "i");
+    }),
+    // DeepSeek V3 and R1.
+    literalMarker("<｜tool▁calls▁begin｜>", "<｜tool▁calls▁end｜>"),
+    literalMarker("<｜tool▁call▁begin｜>", "<｜tool▁call▁end｜>"),
+    // Kimi K2; K3 opens a call with `<|open|>call` and ends the message with it.
+    literalMarker("<|tool_calls_section_begin|>", "<|tool_calls_section_end|>"),
+    literalMarker("<|tool_call_begin|>", "<|tool_call_end|>"),
+    literalMarker("<|open|>call", null),
+    // Hermes, Qwen and GLM; Gemma 4.
+    literalMarker("<tool_call>", "</tool_call>"),
+    literalMarker("<|tool_call>", "<tool_call|>"),
+    // MiniMax.
+    literalMarker("<minimax:tool_call>", "</minimax:tool_call>"),
+    // Anthropic-style XML, which several open models imitate, with and without
+    // its namespace prefix.
+    literalMarker("<function_calls>", "</function_calls>"),
+    literalMarker("<antml:function_calls>", "</antml:function_calls>"),
+    // gpt-oss's harmony format.
+    literalMarker("<|channel|>commentary to=", "<|call|>"),
+    // Llama and Mistral put the call after a marker and end the message there.
+    literalMarker("<|python_tag|>", null),
+    literalMarker("[TOOL_CALLS]", null),
+];
+/**
+ * Lone template tokens with nothing around them to strip: `<|im_end|>`,
+ * `<｜end▁of▁sentence｜>`, `<｜Assistant｜>`, a DSML tag whose block was already
+ * cut, MiniMax M3's call prefix. Never prose.
+ */
+const TOKEN_MARKERS = [
+    patternMarker(new RegExp(`${DSML}[^<>\\n]{0,200}>`, "i"), DSML_PARTIAL),
+    patternMarker(/<\|[A-Za-z][A-Za-z0-9_]{0,47}\|>/, /^<(?:\|[A-Za-z0-9_]{0,48}\|?)?$/),
+    patternMarker(/<｜[^｜<>\n]{1,48}｜>/, /^<(?:｜[^｜<>\n]{0,48}｜?)?$/),
+    literalMarker("]<]minimax[>["),
+];
+/** Long enough to hold back any opener or token still arriving. */
+const MAX_HELD_CHARS = 64;
+/** A held tail this long that never completed is a cut-off marker, not prose. */
+const MIN_RESIDUE_CHARS = 3;
+function earliestHit(text) {
+    let best = null;
+    // Blocks first, and a later marker must start strictly earlier to win: an
+    // opener such as `<|tool_call_begin|>` is also a well-formed lone token.
+    for (const marker of [...BLOCK_MARKERS, ...TOKEN_MARKERS]) {
+        const found = marker.find(text);
+        if (!found || (best !== null && found.index >= best.index))
+            continue;
+        best = {
+            index: found.index,
+            length: found.match.length,
+            close: marker.close === undefined ? undefined : marker.close === null ? null : marker.close(found.match),
+        };
+    }
+    return best;
+}
+/** Where text stops being safe to emit: a suffix that may still become markup. */
+function heldFrom(text) {
+    for (let index = Math.max(0, text.length - MAX_HELD_CHARS); index < text.length; index += 1) {
+        const char = text[index];
+        if (char !== "<" && char !== "[" && char !== "]")
+            continue;
+        const tail = text.slice(index);
+        if ([...BLOCK_MARKERS, ...TOKEN_MARKERS].some((marker) => marker.couldStart(tail)))
+            return index;
+    }
+    return text.length;
+}
+/** `<|open|>` is a whole token and also the start of Kimi's `<|open|>call` block. */
+function couldBecomeBlock(tail) {
+    return BLOCK_MARKERS.some((marker) => marker.couldStart(tail));
+}
+/**
+ * Removes tool-call markup from text that arrives in chunks. A chunk boundary
+ * can fall inside a token, so a suffix that could still become one is held until
+ * the next chunk decides it: never more than {@link MAX_HELD_CHARS} characters,
+ * and only when it starts with `<`, `[` or `]`.
+ */
+export function createToolCallMarkupFilter() {
+    let pending = "";
+    // undefined: outside any block. null: inside a block that runs to the end.
+    let closing;
+    let removed = false;
+    const drain = (final) => {
+        let out = "";
+        for (;;) {
+            if (closing !== undefined) {
+                const end = closing === null ? null : closing.exec(pending);
+                if (!end) {
+                    // Keep only what could still be the start of the closing tag.
+                    pending = closing === null || final ? "" : pending.slice(-MAX_HELD_CHARS);
+                    return out;
+                }
+                pending = pending.slice(end.index + end[0].length);
+                closing = undefined;
+                continue;
+            }
+            const hit = earliestHit(pending);
+            if (hit && !final && hit.close === undefined && couldBecomeBlock(pending.slice(hit.index))) {
+                // A lone token that the next chunk may yet turn into a block opener.
+                out += pending.slice(0, hit.index);
+                pending = pending.slice(hit.index);
+                return out;
+            }
+            if (hit) {
+                out += pending.slice(0, hit.index);
+                pending = pending.slice(hit.index + hit.length);
+                closing = hit.close;
+                removed = true;
+                continue;
+            }
+            const held = heldFrom(pending);
+            if (final) {
+                // The stream ended inside a marker: what arrived of it is residue.
+                const residue = pending.length - held >= MIN_RESIDUE_CHARS;
+                out += residue ? pending.slice(0, held) : pending;
+                removed ||= residue;
+                pending = "";
+                return out;
+            }
+            out += pending.slice(0, held);
+            pending = pending.slice(held);
+            return out;
+        }
+    };
+    return {
+        push: (chunk) => {
+            pending += chunk;
+            return drain(false);
+        },
+        flush: () => {
+            const out = drain(true);
+            pending = "";
+            closing = undefined;
+            return out;
+        },
+        removedAny: () => removed,
+    };
+}
+/**
+ * The text with every tool-call block and stray template token removed. Text
+ * that held none comes back unchanged, byte for byte; where something was cut,
+ * the blank lines it leaves collapse and the ends are trimmed.
+ */
+export function stripToolCallMarkup(text) {
+    const filter = createToolCallMarkupFilter();
+    const out = filter.push(text) + filter.flush();
+    if (!filter.removedAny())
+        return text;
+    return out.replace(/\n[ \t]*\n(?:[ \t]*\n)+/g, "\n\n").trim();
+}
+/**
+ * Did the model try to CALL something in its text? Only a call block counts: a
+ * stray end-of-turn token is leakage worth stripping, not an attempted call.
+ */
+export function containsToolCallMarkup(text) {
+    return BLOCK_MARKERS.some((marker) => marker.find(text) !== null);
+}

package/node_modules/@oxygen/shared/dist/user-capability-routing.js

@@ -5,6 +5,11 @@ import { getCapabilityRoute, getCapabilityRouteMatch, inferCapabilityRoute, } fr
 // the user-facing boundary while preserving table joins and channel-specific
 // connection routes.
 export function inferUserCapabilityRoute(query) {
+    if (/\b(ongoing worker|ongoing session|long horizon agent|campaign monitor|watch (?:a |one |this |the |specific )?campaign)\b/i.test(query)) {
+        const route = getCapabilityRouteMatch("agents");
+        if (route)
+            return { ...route, recommendedTools: ["oxygen_agent_session_templates", "oxygen_agent_session_create", "oxygen_agent_session_get", ...route.recommendedTools], recommendedCommands: ["agent session templates", "agent session create", "agent session get", ...route.recommendedCommands], exactCommand: "oxygen agent session templates --slug workspace --json", exactMcpCall: { tool: "oxygen_agent_session_templates", arguments: { slug: "workspace" } } };
+    }
     if (isProviderCredentialSetupIntent(query.toLowerCase())) {
         const setup = getCapabilityRouteMatch("connected-integrations");
         if (setup)

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const OXYGEN_VERSION: string;
-export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.922.14";
+export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.948.1";
 export declare const GEO_EXPORT_MINIMUM_CLI_VERSION = "1.1013.0";

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1013.93";
+export declare const OXYGEN_BUILD_VERSION = "1.1014.18";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1013.93";
+export const OXYGEN_BUILD_VERSION = "1.1014.18";

package/node_modules/@oxygen/shared/dist/version.js

@@ -49,7 +49,7 @@ export const OXYGEN_VERSION = OXYGEN_BUILD_VERSION;
 // Since 2026-09-28 the release-preparation step advances this literal to the
 // highest CLI version published on npm for at least 30 days. It never lowers
 // the floor. The source change lands on dev before the next production release.
-export const OXYGEN_MINIMUM_CLI_VERSION = "1.922.14";
+export const OXYGEN_MINIMUM_CLI_VERSION = "1.948.1";
 // The internal GEO export first gains required pagination in this dev version.
 // Earlier pilot clients would save a partial file without its continuation.
 export const GEO_EXPORT_MINIMUM_CLI_VERSION = "1.1013.0";

package/node_modules/@oxygen/shared/dist/workspace-file-storage.js

@@ -1,3 +1,4 @@
+import { assertAppStorageWriteAllowed } from "./app-storage-maintenance.js";
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3";
@@ -163,6 +164,7 @@ export const WORKSPACE_FILE_UPLOAD_PRESIGN_SECONDS = 900;
  * is signed by the presigner from ContentLength.
  */
 export async function presignWorkspaceFileUpload(input) {
+    assertAppStorageWriteAllowed();
     if (!Number.isSafeInteger(input.sizeBytes) || input.sizeBytes < 0 || input.sizeBytes > WORKSPACE_OPAQUE_FILE_MAX_BYTES) {
         throw new OxygenError("workspace_file_too_large", "File exceeds 100 MiB.");
     }
@@ -176,6 +178,7 @@ export async function presignWorkspaceFileUpload(input) {
 }
 /** Immutable PUT followed by bounded readback. A matching existing object is a safe retry. */
 export async function putWorkspaceFileObject(input) {
+    assertAppStorageWriteAllowed();
     input.signal?.throwIfAborted();
     assertWorkspaceStoredFile(input.bytes, input.mimeType);
     const storageKey = buildWorkspaceFileObjectKey(input);
@@ -199,6 +202,7 @@ export async function putWorkspaceFileObject(input) {
 }
 /** Delete only an object key already proven to belong to this workspace file. */
 export async function deleteWorkspaceFileObject(input) {
+    assertAppStorageWriteAllowed();
     assertWorkspaceFileObjectKey(input);
     const { client, bucket } = resolveObjectStorageClient();
     await client.send(new DeleteObjectCommand({ Bucket: bucket, Key: input.storageKey }), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1013.93",
+  "version": "1.1014.18",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",