@oxygen-agent/cli 1.1014.1600 → 1.1014.1763

package/dist/credential-storage/store.js

@@ -0,0 +1,282 @@
+import { execFile, spawn } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, chmodSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { OxygenError } from "@oxygen/shared/cli-result";
+const SERVICE_NAME = "oxygen-cli";
+const ACCOUNT_NAME = "default";
+const WINDOWS_CREDENTIAL_PAYLOAD_ENV = "OXYGEN_CLI_WINDOWS_CREDENTIAL_PAYLOAD";
+/** The CLI's per-user config directory; `OXYGEN_CONFIG_DIR` overrides it. */
+export function resolveConfigDir(env = process.env) {
+    return env.OXYGEN_CONFIG_DIR?.trim()
+        || (process.platform === "win32"
+            ? join(env.APPDATA || join(homedir(), "AppData", "Roaming"), "oxygen")
+            : join(homedir(), ".config", "oxygen"));
+}
+/** Own raw credential IO. The same live environment is read at every original
+ * operation boundary; the application still owns documents and profiles.
+ * Construct once at the application's original promisify initialization point. */
+export function createCredentialStorage() {
+    const execFileAsync = promisify(execFile);
+    async function readSystemCredentialPayload(env) {
+        const store = credentialStore(env);
+        if (store === "keychain")
+            return readMacOSKeychainPayload(env);
+        if (store === "credential-manager")
+            return readWindowsCredentialManagerPayload(env);
+        return readFileCredentialPayload(env);
+    }
+    async function writeSystemCredentialPayload(payload, env) {
+        const store = credentialStore(env);
+        if (store === "keychain") {
+            await writeMacOSKeychainPayload(payload, env);
+            return;
+        }
+        if (store === "credential-manager") {
+            await writeWindowsCredentialManagerPayload(payload, env);
+            return;
+        }
+        writeFileCredentialPayload(payload, env);
+    }
+    async function deleteSystemCredentialPayload(env) {
+        const store = credentialStore(env);
+        if (store === "keychain") {
+            await deleteMacOSKeychain(env);
+            return;
+        }
+        if (store === "credential-manager") {
+            await deleteWindowsCredentialManager(env);
+            return;
+        }
+        deleteFileCredentials(env);
+    }
+    function credentialStore(env) {
+        const forced = env.OXYGEN_CREDENTIAL_STORE?.trim().toLowerCase();
+        if (forced === "file")
+            return "file";
+        if (forced === "keychain")
+            return "keychain";
+        if (forced === "credential-manager")
+            return "credential-manager";
+        if (process.platform === "darwin")
+            return "keychain";
+        if (process.platform === "win32")
+            return "credential-manager";
+        return "file";
+    }
+    function credentialsPath(env) {
+        return join(resolveConfigDir(env), "credentials.json");
+    }
+    function readFileCredentialPayload(env) {
+        const path = credentialsPath(env);
+        if (!existsSync(path))
+            return null;
+        return readFileSync(path, "utf8");
+    }
+    function writeFileCredentialPayload(payload, env) {
+        const path = credentialsPath(env);
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        const tempPath = `${path}.${process.pid}.tmp`;
+        writeFileSync(tempPath, payload, { mode: 0o600 });
+        chmodSync(tempPath, 0o600);
+        renameSync(tempPath, path);
+        chmodSync(path, 0o600);
+    }
+    function deleteFileCredentials(env) {
+        const path = credentialsPath(env);
+        rmSync(path, { force: true });
+    }
+    async function readMacOSKeychainPayload(env) {
+        try {
+            const { stdout } = await execFileAsync(macOSSecurityCommand(env), [
+                "find-generic-password",
+                "-a",
+                ACCOUNT_NAME,
+                "-s",
+                SERVICE_NAME,
+                "-w",
+            ], { env });
+            return stdout;
+        }
+        catch {
+            return null;
+        }
+    }
+    // `security -i` reads commands with a line buffer that traditionally caps at
+    // 4096 bytes. Beyond that, the input is silently truncated, which would
+    // corrupt the stored credential and break re-auth. Reject early with a clear
+    // error so a user with too many profiles gets actionable feedback instead of
+    // a partial-write that only surfaces on the next CLI invocation.
+    const MACOS_SECURITY_LINE_LIMIT_BYTES = 4096;
+    async function writeMacOSKeychainPayload(payload, env) {
+        // `security add-generic-password -w PAYLOAD` would put the token in argv
+        // (visible to any same-UID `ps`). Use `security -i` instead: the subcommand
+        // is written on stdin, so the only argv `ps` ever sees is `security -i`.
+        const command = macOSSecurityCommand(env);
+        const escaped = payload.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+        const line = `add-generic-password -a "${ACCOUNT_NAME}" -s "${SERVICE_NAME}" -w "${escaped}" -U\n`;
+        const lineBytes = Buffer.byteLength(line, "utf8");
+        if (lineBytes >= MACOS_SECURITY_LINE_LIMIT_BYTES) {
+            throw credentialStoreError("write", "macOS Keychain", {
+                code: "payload_too_large",
+                stderr: `Credential document is ${lineBytes} bytes; \`security -i\` truncates lines at ${MACOS_SECURITY_LINE_LIMIT_BYTES} bytes. Reduce stored profiles (oxygen logout <profile>) and retry.`,
+            });
+        }
+        await new Promise((resolve, reject) => {
+            const child = spawn(command, ["-i"], { env, stdio: ["pipe", "pipe", "pipe"] });
+            let stderr = "";
+            child.stderr.on("data", (chunk) => {
+                stderr += chunk.toString("utf8");
+            });
+            child.once("error", (error) => {
+                reject(credentialStoreError("write", "macOS Keychain", error));
+            });
+            child.once("close", (code, signal) => {
+                const trimmedStderr = stderr.trim();
+                if (code === 0 && !trimmedStderr) {
+                    resolve();
+                    return;
+                }
+                reject(credentialStoreError("write", "macOS Keychain", { code, signal, stderr: trimmedStderr }));
+            });
+            child.stdin.end(line);
+        });
+    }
+    async function deleteMacOSKeychain(env) {
+        await execFileAsync(macOSSecurityCommand(env), [
+            "delete-generic-password",
+            "-a",
+            ACCOUNT_NAME,
+            "-s",
+            SERVICE_NAME,
+        ], { env }).catch(() => undefined);
+    }
+    async function readWindowsCredentialManagerPayload(env) {
+        try {
+            const { stdout } = await runPowerShell(`${windowsCredentialManagerScript()}
+$ptr = [IntPtr]::Zero
+try {
+  if (-not [OxygenCredMan]::CredRead("${SERVICE_NAME}", 1, 0, [ref]$ptr)) { exit 2 }
+  $cred = [Runtime.InteropServices.Marshal]::PtrToStructure($ptr, [type][OxygenCredMan+CREDENTIAL])
+  $secret = [Runtime.InteropServices.Marshal]::PtrToStringUni($cred.CredentialBlob, [int]($cred.CredentialBlobSize / 2))
+  [Console]::Out.Write($secret)
+} finally {
+  if ($ptr -ne [IntPtr]::Zero) { [OxygenCredMan]::CredFree($ptr) }
+}
+`, env);
+            return stdout;
+        }
+        catch {
+            return null;
+        }
+    }
+    async function writeWindowsCredentialManagerPayload(value, env) {
+        const payload = Buffer.from(value, "utf16le").toString("base64");
+        try {
+            await runPowerShell(`${windowsCredentialManagerScript()}
+$payload = $env:${WINDOWS_CREDENTIAL_PAYLOAD_ENV}
+if ([string]::IsNullOrWhiteSpace($payload)) { exit 1 }
+$secret = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($payload))
+$bytes = [Text.Encoding]::Unicode.GetBytes($secret)
+$blob = [Runtime.InteropServices.Marshal]::StringToCoTaskMemUni($secret)
+try {
+  $cred = New-Object OxygenCredMan+CREDENTIAL
+  $cred.Type = 1
+  $cred.TargetName = "${SERVICE_NAME}"
+  $cred.UserName = "${ACCOUNT_NAME}"
+  $cred.CredentialBlob = $blob
+  $cred.CredentialBlobSize = $bytes.Length
+  $cred.Persist = 2
+  if (-not [OxygenCredMan]::CredWrite([ref]$cred, 0)) { exit 1 }
+} finally {
+  [Runtime.InteropServices.Marshal]::FreeCoTaskMem($blob)
+}
+`, {
+                ...env,
+                [WINDOWS_CREDENTIAL_PAYLOAD_ENV]: payload,
+            });
+        }
+        catch (error) {
+            throw credentialStoreError("write", "Windows Credential Manager", error);
+        }
+    }
+    async function deleteWindowsCredentialManager(env) {
+        await runPowerShell(`${windowsCredentialManagerScript()}
+[void][OxygenCredMan]::CredDelete("${SERVICE_NAME}", 1, 0)
+`, env).catch(() => undefined);
+    }
+    function runPowerShell(script, env) {
+        const encodedCommand = Buffer.from(script, "utf16le").toString("base64");
+        return execFileAsync(windowsPowerShellCommand(env), [
+            "-NoProfile",
+            "-NonInteractive",
+            "-ExecutionPolicy",
+            "Bypass",
+            "-EncodedCommand",
+            encodedCommand,
+        ], { env });
+    }
+    function credentialStoreError(operation, store, error) {
+        const child = error;
+        const details = {
+            operation,
+            store,
+        };
+        if (typeof child.code === "number") {
+            details.exit_code = child.code;
+        }
+        else if (typeof child.code === "string") {
+            details.reason = child.code;
+        }
+        if (typeof child.signal === "string")
+            details.signal = child.signal;
+        if (typeof child.stderr === "string" && child.stderr.trim()) {
+            details.stderr = sanitizeCredentialErrorText(child.stderr.trim()).slice(0, 4000);
+        }
+        return new OxygenError("credential_store_failed", `Unable to ${operation} Oxygen CLI credentials in ${store}.`, { details, exitCode: 1 });
+    }
+    function sanitizeCredentialErrorText(value) {
+        return value.replace(/\boxy_(?:live|user)_[A-Za-z0-9_-]+\b/g, "[redacted_token]");
+    }
+    function macOSSecurityCommand(env) {
+        return env.OXYGEN_SECURITY_COMMAND?.trim() || "security";
+    }
+    function windowsPowerShellCommand(env) {
+        return env.OXYGEN_POWERSHELL_COMMAND?.trim() || "powershell.exe";
+    }
+    function windowsCredentialManagerScript() {
+        return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+public static class OxygenCredMan {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct CREDENTIAL {
+    public UInt32 Flags;
+    public UInt32 Type;
+    public string TargetName;
+    public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public UInt32 CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public UInt32 Persist;
+    public UInt32 AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  public static extern bool CredWrite([In] ref CREDENTIAL userCredential, UInt32 flags);
+  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  public static extern bool CredRead(string target, UInt32 type, UInt32 reservedFlag, out IntPtr credentialPtr);
+  [DllImport("advapi32.dll", SetLastError = true)]
+  public static extern bool CredDelete(string target, UInt32 type, UInt32 flags);
+  [DllImport("advapi32.dll", SetLastError = true)]
+  public static extern void CredFree([In] IntPtr cred);
+}
+"@
+`;
+    }
+    return { readSystemCredentialPayload, writeSystemCredentialPayload, deleteSystemCredentialPayload };
+}

package/dist/credentials.d.ts

@@ -1,3 +1,4 @@
+export { resolveConfigDir } from "./credential-storage/store.js";
 export type StoredProfileIdentity = {
     organization: StoredOrganization | null;
     user: {
@@ -77,7 +78,4 @@ export declare function pickProfileNameForUserSession(userId: string, candidateS
 export declare function switchCredentialProfile(profile: string, env?: NodeJS.ProcessEnv): Promise<CredentialProfile>;
 export declare function updateActiveOrganizationForProfile(profile: string, organization: StoredOrganization, env?: NodeJS.ProcessEnv): Promise<CredentialProfile>;
 export declare function normalizeApiUrl(value: string): string;
-/** The CLI's per-user config directory; `OXYGEN_CONFIG_DIR` overrides it. */
-export declare function resolveConfigDir(env?: NodeJS.ProcessEnv): string;
 export declare function readEnvToken(env?: NodeJS.ProcessEnv): string | null;
-export {};

package/dist/credentials.js

@@ -1,16 +1,10 @@
-import { execFile, spawn } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, chmodSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { promisify } from "node:util";
+import { createCredentialStorage } from "./credential-storage/store.js";
 import { OxygenError } from "@oxygen/shared/cli-result";
 import { sameApiOrigin } from "./runtime.js";
-const execFileAsync = promisify(execFile);
-const SERVICE_NAME = "oxygen-cli";
-const ACCOUNT_NAME = "default";
+export { resolveConfigDir } from "./credential-storage/store.js";
+const { readSystemCredentialPayload, writeSystemCredentialPayload, deleteSystemCredentialPayload } = createCredentialStorage();
 const DEFAULT_API_URL = "https://oxygen-agent.com";
 const DEFAULT_PROFILE_NAME = "default";
-const WINDOWS_CREDENTIAL_PAYLOAD_ENV = "OXYGEN_CLI_WINDOWS_CREDENTIAL_PAYLOAD";
 function readEnvApiUrl(env) {
     const apiUrl = env.OXYGEN_API_URL?.trim();
     return apiUrl ? normalizeApiUrl(apiUrl) : null;
@@ -347,38 +341,6 @@ async function readSystemCredentialDocument(env) {
         return null;
     return parseCredentialDocument(payload);
 }
-async function readSystemCredentialPayload(env) {
-    const store = credentialStore(env);
-    if (store === "keychain")
-        return readMacOSKeychainPayload(env);
-    if (store === "credential-manager")
-        return readWindowsCredentialManagerPayload(env);
-    return readFileCredentialPayload(env);
-}
-async function writeSystemCredentialPayload(payload, env) {
-    const store = credentialStore(env);
-    if (store === "keychain") {
-        await writeMacOSKeychainPayload(payload, env);
-        return;
-    }
-    if (store === "credential-manager") {
-        await writeWindowsCredentialManagerPayload(payload, env);
-        return;
-    }
-    writeFileCredentialPayload(payload, env);
-}
-async function deleteSystemCredentialPayload(env) {
-    const store = credentialStore(env);
-    if (store === "keychain") {
-        await deleteMacOSKeychain(env);
-        return;
-    }
-    if (store === "credential-manager") {
-        await deleteWindowsCredentialManager(env);
-        return;
-    }
-    deleteFileCredentials(env);
-}
 async function writeCredentialDocument(input, env) {
     const activeCredentials = input.profiles[input.activeProfile];
     if (!activeCredentials) {
@@ -397,240 +359,6 @@ async function writeCredentialDocument(input, env) {
         document.identity = activeCredentials.identity;
     await writeSystemCredentialPayload(serializeCredentialDocument(document), env);
 }
-function credentialStore(env) {
-    const forced = env.OXYGEN_CREDENTIAL_STORE?.trim().toLowerCase();
-    if (forced === "file")
-        return "file";
-    if (forced === "keychain")
-        return "keychain";
-    if (forced === "credential-manager")
-        return "credential-manager";
-    if (process.platform === "darwin")
-        return "keychain";
-    if (process.platform === "win32")
-        return "credential-manager";
-    return "file";
-}
-/** The CLI's per-user config directory; `OXYGEN_CONFIG_DIR` overrides it. */
-export function resolveConfigDir(env = process.env) {
-    return env.OXYGEN_CONFIG_DIR?.trim()
-        || (process.platform === "win32"
-            ? join(env.APPDATA || join(homedir(), "AppData", "Roaming"), "oxygen")
-            : join(homedir(), ".config", "oxygen"));
-}
-function credentialsPath(env) {
-    return join(resolveConfigDir(env), "credentials.json");
-}
-function readFileCredentialPayload(env) {
-    const path = credentialsPath(env);
-    if (!existsSync(path))
-        return null;
-    return readFileSync(path, "utf8");
-}
-function writeFileCredentialPayload(payload, env) {
-    const path = credentialsPath(env);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const tempPath = `${path}.${process.pid}.tmp`;
-    writeFileSync(tempPath, payload, { mode: 0o600 });
-    chmodSync(tempPath, 0o600);
-    renameSync(tempPath, path);
-    chmodSync(path, 0o600);
-}
-function deleteFileCredentials(env) {
-    const path = credentialsPath(env);
-    rmSync(path, { force: true });
-}
-async function readMacOSKeychainPayload(env) {
-    try {
-        const { stdout } = await execFileAsync(macOSSecurityCommand(env), [
-            "find-generic-password",
-            "-a",
-            ACCOUNT_NAME,
-            "-s",
-            SERVICE_NAME,
-            "-w",
-        ], { env });
-        return stdout;
-    }
-    catch {
-        return null;
-    }
-}
-// `security -i` reads commands with a line buffer that traditionally caps at
-// 4096 bytes. Beyond that, the input is silently truncated, which would
-// corrupt the stored credential and break re-auth. Reject early with a clear
-// error so a user with too many profiles gets actionable feedback instead of
-// a partial-write that only surfaces on the next CLI invocation.
-const MACOS_SECURITY_LINE_LIMIT_BYTES = 4096;
-async function writeMacOSKeychainPayload(payload, env) {
-    // `security add-generic-password -w PAYLOAD` would put the token in argv
-    // (visible to any same-UID `ps`). Use `security -i` instead: the subcommand
-    // is written on stdin, so the only argv `ps` ever sees is `security -i`.
-    const command = macOSSecurityCommand(env);
-    const escaped = payload.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-    const line = `add-generic-password -a "${ACCOUNT_NAME}" -s "${SERVICE_NAME}" -w "${escaped}" -U\n`;
-    const lineBytes = Buffer.byteLength(line, "utf8");
-    if (lineBytes >= MACOS_SECURITY_LINE_LIMIT_BYTES) {
-        throw credentialStoreError("write", "macOS Keychain", {
-            code: "payload_too_large",
-            stderr: `Credential document is ${lineBytes} bytes; \`security -i\` truncates lines at ${MACOS_SECURITY_LINE_LIMIT_BYTES} bytes. Reduce stored profiles (oxygen logout <profile>) and retry.`,
-        });
-    }
-    await new Promise((resolve, reject) => {
-        const child = spawn(command, ["-i"], { env, stdio: ["pipe", "pipe", "pipe"] });
-        let stderr = "";
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk.toString("utf8");
-        });
-        child.once("error", (error) => {
-            reject(credentialStoreError("write", "macOS Keychain", error));
-        });
-        child.once("close", (code, signal) => {
-            const trimmedStderr = stderr.trim();
-            if (code === 0 && !trimmedStderr) {
-                resolve();
-                return;
-            }
-            reject(credentialStoreError("write", "macOS Keychain", { code, signal, stderr: trimmedStderr }));
-        });
-        child.stdin.end(line);
-    });
-}
-async function deleteMacOSKeychain(env) {
-    await execFileAsync(macOSSecurityCommand(env), [
-        "delete-generic-password",
-        "-a",
-        ACCOUNT_NAME,
-        "-s",
-        SERVICE_NAME,
-    ], { env }).catch(() => undefined);
-}
-async function readWindowsCredentialManagerPayload(env) {
-    try {
-        const { stdout } = await runPowerShell(`${windowsCredentialManagerScript()}
-$ptr = [IntPtr]::Zero
-try {
-  if (-not [OxygenCredMan]::CredRead("${SERVICE_NAME}", 1, 0, [ref]$ptr)) { exit 2 }
-  $cred = [Runtime.InteropServices.Marshal]::PtrToStructure($ptr, [type][OxygenCredMan+CREDENTIAL])
-  $secret = [Runtime.InteropServices.Marshal]::PtrToStringUni($cred.CredentialBlob, [int]($cred.CredentialBlobSize / 2))
-  [Console]::Out.Write($secret)
-} finally {
-  if ($ptr -ne [IntPtr]::Zero) { [OxygenCredMan]::CredFree($ptr) }
-}
-`, env);
-        return stdout;
-    }
-    catch {
-        return null;
-    }
-}
-async function writeWindowsCredentialManagerPayload(value, env) {
-    const payload = Buffer.from(value, "utf16le").toString("base64");
-    try {
-        await runPowerShell(`${windowsCredentialManagerScript()}
-$payload = $env:${WINDOWS_CREDENTIAL_PAYLOAD_ENV}
-if ([string]::IsNullOrWhiteSpace($payload)) { exit 1 }
-$secret = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($payload))
-$bytes = [Text.Encoding]::Unicode.GetBytes($secret)
-$blob = [Runtime.InteropServices.Marshal]::StringToCoTaskMemUni($secret)
-try {
-  $cred = New-Object OxygenCredMan+CREDENTIAL
-  $cred.Type = 1
-  $cred.TargetName = "${SERVICE_NAME}"
-  $cred.UserName = "${ACCOUNT_NAME}"
-  $cred.CredentialBlob = $blob
-  $cred.CredentialBlobSize = $bytes.Length
-  $cred.Persist = 2
-  if (-not [OxygenCredMan]::CredWrite([ref]$cred, 0)) { exit 1 }
-} finally {
-  [Runtime.InteropServices.Marshal]::FreeCoTaskMem($blob)
-}
-`, {
-            ...env,
-            [WINDOWS_CREDENTIAL_PAYLOAD_ENV]: payload,
-        });
-    }
-    catch (error) {
-        throw credentialStoreError("write", "Windows Credential Manager", error);
-    }
-}
-async function deleteWindowsCredentialManager(env) {
-    await runPowerShell(`${windowsCredentialManagerScript()}
-[void][OxygenCredMan]::CredDelete("${SERVICE_NAME}", 1, 0)
-`, env).catch(() => undefined);
-}
-function runPowerShell(script, env) {
-    const encodedCommand = Buffer.from(script, "utf16le").toString("base64");
-    return execFileAsync(windowsPowerShellCommand(env), [
-        "-NoProfile",
-        "-NonInteractive",
-        "-ExecutionPolicy",
-        "Bypass",
-        "-EncodedCommand",
-        encodedCommand,
-    ], { env });
-}
-function credentialStoreError(operation, store, error) {
-    const child = error;
-    const details = {
-        operation,
-        store,
-    };
-    if (typeof child.code === "number") {
-        details.exit_code = child.code;
-    }
-    else if (typeof child.code === "string") {
-        details.reason = child.code;
-    }
-    if (typeof child.signal === "string")
-        details.signal = child.signal;
-    if (typeof child.stderr === "string" && child.stderr.trim()) {
-        details.stderr = sanitizeCredentialErrorText(child.stderr.trim()).slice(0, 4000);
-    }
-    return new OxygenError("credential_store_failed", `Unable to ${operation} Oxygen CLI credentials in ${store}.`, { details, exitCode: 1 });
-}
-function sanitizeCredentialErrorText(value) {
-    return value.replace(/\boxy_(?:live|user)_[A-Za-z0-9_-]+\b/g, "[redacted_token]");
-}
-function macOSSecurityCommand(env) {
-    return env.OXYGEN_SECURITY_COMMAND?.trim() || "security";
-}
-function windowsPowerShellCommand(env) {
-    return env.OXYGEN_POWERSHELL_COMMAND?.trim() || "powershell.exe";
-}
-function windowsCredentialManagerScript() {
-    return `
-Add-Type @"
-using System;
-using System.Runtime.InteropServices;
-public static class OxygenCredMan {
-  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
-  public struct CREDENTIAL {
-    public UInt32 Flags;
-    public UInt32 Type;
-    public string TargetName;
-    public string Comment;
-    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
-    public UInt32 CredentialBlobSize;
-    public IntPtr CredentialBlob;
-    public UInt32 Persist;
-    public UInt32 AttributeCount;
-    public IntPtr Attributes;
-    public string TargetAlias;
-    public string UserName;
-  }
-  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-  public static extern bool CredWrite([In] ref CREDENTIAL userCredential, UInt32 flags);
-  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-  public static extern bool CredRead(string target, UInt32 type, UInt32 reservedFlag, out IntPtr credentialPtr);
-  [DllImport("advapi32.dll", SetLastError = true)]
-  public static extern bool CredDelete(string target, UInt32 type, UInt32 flags);
-  [DllImport("advapi32.dll", SetLastError = true)]
-  public static extern void CredFree([In] IntPtr cred);
-}
-"@
-`;
-}
 function serializeCredentialDocument(document) {
     return JSON.stringify(document);
 }

package/dist/mailbox-fleet-output.js

@@ -29,9 +29,9 @@ export function formatMailboxFleetHealth(data) {
         `Warm-up stop causes: ${counts(warmup.byCause)}`,
         "Enrollment and next actions: oxygen mailboxes list --json (warmupTruth).",
         "",
-        "Domains (worst first):",
+        ...(Array.isArray(data.domain_context) ? ["Selected inbox domains (whole-domain totals):"] : ["Domains (worst first):"]),
     ];
-    const domains = Array.isArray(data.domains) ? data.domains.map(record) : [];
+    const domains = Array.isArray(data.domain_context) ? data.domain_context.map(record) : Array.isArray(data.domains) ? data.domains.map(record) : [];
     for (const domain of domains)
         lines.push(`  ${text(domain.domain)} · ${count(domain.mailboxes)} inboxes · provider rejections ${count(domain.providerRejections7d)} (Google ${count(domain.googleRejections7d)}) · hard bounces ${count(domain.hardBounces7d)} / ${count(domain.coldSends7d)} sequence sends · youngest warm-up day ${count(domain.warmupDayMin)}`);
     if (!domains.length)
@@ -50,11 +50,20 @@ export function formatMailboxFleetHealth(data) {
     }
     const mailboxes = Array.isArray(data.mailboxes) ? data.mailboxes.map(record) : null;
     if (mailboxes) {
+        const selection = record(data.mailbox_selection);
+        if (Object.keys(selection).length)
+            lines.push("", `Selected inbox details: ${count(selection.matched)} of ${count(selection.fleet_total)}; fleet totals remain unfiltered.`);
         lines.push("", `Inbox roster (${mailboxes.length}):`);
         for (const mailbox of mailboxes) {
             const mailboxWarmup = record(mailbox.warmup);
             const warnings = Array.isArray(mailbox.warnings) ? mailbox.warnings.join(", ") : "";
             lines.push(`  ${text(mailbox.emailAddress)} · ${text(mailbox.status)} · health ${text(mailbox.healthState)} (${text(mailbox.healthFreshness)}) · stored warm-up rail ${text(mailboxWarmup.state)}${typeof mailboxWarmup.pauseCode === "string" ? ` / ${mailboxWarmup.pauseCode}` : ""}${warnings ? ` · ${warnings}` : ""}`);
+            if (data.view === "full") {
+                const evidence = record(mailbox.signals);
+                lines.push(`    Last-known external score: ${count(mailbox.healthScore)} · ${text(mailbox.healthProvider)} · checked ${text(mailbox.healthCheckedAt)}`);
+                lines.push(`    ${text(evidence.window)} evidence: ${count(evidence.coldSends7d)} sequence sends · ${count(evidence.hardBounces7d)} hard bounces · ${count(evidence.googleRejections7d)} Google rejections (all send sources)`);
+                lines.push(`    Delivery notifications: ${counts(evidence.dsn7d)} · diagnostic codes: ${counts(evidence.dsnCodes7d)}`);
+            }
         }
     }
     else if (data.view === "fleet")

package/dist/sequence-start-at.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `sequences start --at`: an ISO 8601 timestamp with a timezone, or a relative
+ * "in 30m" / "in 2h" / "in 3d". Returns the canonical UTC timestamp the start
+ * route stores; the same future and 30-day bounds apply as on the server, so a
+ * bad value fails before any request.
+ */
+export declare function parseStartAtFlag(value: string, now?: Date): string;

package/dist/sequence-start-at.js

@@ -0,0 +1,21 @@
+import { OxygenError } from "@oxygen/shared/cli-result";
+import { parseSequenceStartAt } from "@oxygen/shared/sequence-lifecycle";
+const RELATIVE = /^in\s+(\d+)\s*(m|min|mins|minutes?|h|hr|hrs|hours?|d|days?)$/i;
+const UNIT_MS = { m: 60_000, h: 3_600_000, d: 86_400_000 };
+/**
+ * `sequences start --at`: an ISO 8601 timestamp with a timezone, or a relative
+ * "in 30m" / "in 2h" / "in 3d". Returns the canonical UTC timestamp the start
+ * route stores; the same future and 30-day bounds apply as on the server, so a
+ * bad value fails before any request.
+ */
+export function parseStartAtFlag(value, now = new Date()) {
+    const relative = RELATIVE.exec(value.trim());
+    const candidate = relative
+        ? new Date(now.getTime() + Number(relative[1]) * UNIT_MS[relative[2].charAt(0).toLowerCase()]).toISOString()
+        : value;
+    const parsed = parseSequenceStartAt(candidate, now);
+    if (!parsed.ok) {
+        throw new OxygenError("invalid_request", `--at: ${parsed.message} Relative times like "in 2h", "in 30m" or "in 3d" also work.`, { exitCode: 2 });
+    }
+    return parsed.startAt;
+}