@oxygen-agent/cli 1.1014.19 → 1.1014.69

package/node_modules/@oxygen/shared/dist/contracts/workspace-skills.js

@@ -0,0 +1,62 @@
+import { arr, int, obj, str } from "./schema.js";
+const name = str({
+    minLength: 1,
+    maxLength: 100,
+    description: "Exact workspace skill name returned by list or import (workspace-…).",
+});
+const file = str({
+    minLength: 1,
+    maxLength: 240,
+    description: "Relative file path; defaults to SKILL.md.",
+});
+const source_url = str({
+    maxLength: 2_000,
+    description: "Optional HTTPS origin for provenance. Content must be supplied; this does not fetch the URL.",
+});
+export const WORKSPACE_SKILL_FILE_CONTRACT = obj({ path: file, content: str({ maxLength: 120_000 }) }, { required: ["path", "content"] });
+const operation = (verb, method, contract, summary, manualCli = false) => ({
+    id: `workspace_skills.${verb}`,
+    route: `/api/cli/skills/workspace/${verb}`,
+    method,
+    contract,
+    cli: { path: ["skills", "workspace", verb], summary },
+    mcp: {
+        name: `oxygen_workspace_skills_${verb}`,
+        title: `Workspace skills: ${verb}`,
+        description: summary,
+        pack: "workspace",
+        ...(verb === "import" ? { annotations: { openWorldHint: true } } : {}),
+    },
+    mutates: method !== "GET",
+    spends: false,
+    ...(manualCli ? { generated: { cli: false, mcp: true } } : {}),
+});
+export const WORKSPACE_SKILL_OPERATIONS = [
+    operation("list", "GET", obj({
+        query: str(),
+        cursor: str(),
+        limit: int({ minimum: 1, maximum: 100 }),
+    }), "Find private workspace-authored or imported skills by name or description. Read-only, 0 credits; next_cursor continues the list."),
+    operation("get", "GET", obj({ name, file }, { required: ["name"] }), "Read a workspace skill's SKILL.md or one supporting text file, with exact content, revision and the document index. Skills are task guidance; they grant no tool, spend or approval authority."),
+    operation("create", "POST", obj({
+        name: str({ minLength: 1, maxLength: 64 }),
+        description: str({ minLength: 1, maxLength: 1_024 }),
+        instructions: str({ minLength: 1, maxLength: 120_000 }),
+    }, { required: ["name", "description", "instructions"] }), "Author a reusable private workspace skill in Knowledge from a lowercase-hyphen name, description and instructions. Creates SKILL.md; no inference, provider call or credit charge.", true),
+    operation("import", "POST", obj({
+        name: str({ maxLength: 64 }),
+        files: arr(WORKSPACE_SKILL_FILE_CONTRACT, { minItems: 1, maxItems: 50 }),
+        url: str({
+            maxLength: 2_000,
+            description: "Public HTTPS SKILL.md URL (raw text or GitHub file). Choose url or files. A URL imports the entrypoint only; supply files for a complete folder.",
+        }),
+        source_url,
+    }), "Import a private workspace skill: supply root SKILL.md plus supporting text files, or a public HTTPS SKILL.md URL. Preserves content and source. Create-only, atomic, at most 50 text files/1 MB. Scripts stay inert. CLI accepts --file, --directory or --url. 0 credits.", true),
+    operation("update", "POST", obj({
+        name,
+        file,
+        content: str({ maxLength: 120_000 }),
+        expected_revision: int({ minimum: 1 }),
+    }, { required: ["name", "content", "expected_revision"] }), "Edit one workspace skill file at its exact expected revision, preserving Knowledge history. Read it first; stale revisions refuse. Defaults to SKILL.md. 0 credits."),
+    operation("archive", "POST", obj({ name, expected_revision: int({ minimum: 1 }) }, { required: ["name", "expected_revision"] }), "Archive a workspace skill's SKILL.md at its expected revision, removing the skill from discovery while preserving files and history in Knowledge. 0 credits."),
+];

package/node_modules/@oxygen/shared/dist/diagnostic-storage-lock.js

@@ -21,7 +21,11 @@ export async function acquireDiagnosticStorageLock(path, waitMs = 0) {
             database?.close();
             database = undefined;
             const busy = error && typeof error === "object" && "errcode" in error && (error.errcode === 5 || error.errcode === 6);
-            if (!busy || performance.now() >= deadline)
+            // Only contention is skippable. Preserve permission, capacity and runtime
+            // failures for the caller's safe classification rather than calling them busy.
+            if (!busy)
+                throw error;
+            if (performance.now() >= deadline)
                 return null;
             // A synchronous SQLite busy timeout would block the same-process owner
             // from finishing its asynchronous fsync and releasing this lock.

package/node_modules/@oxygen/shared/dist/diagnostic-storage.js

@@ -12,6 +12,125 @@ let warned = false;
 let flushing = null;
 let timer;
 let onStored;
+const admissions = new Map();
+class StorageFailure extends Error {
+    stage;
+    failure;
+    constructor(stage, failure) {
+        super("Diagnostic storage failed");
+        this.stage = stage;
+        this.failure = failure;
+    }
+}
+async function storageStage(stage, action) {
+    try {
+        return await action();
+    }
+    catch (error) {
+        throw error instanceof StorageFailure ? error : new StorageFailure(stage, error);
+    }
+}
+function storageFailureFields(error) {
+    const stage = error instanceof StorageFailure ? error.stage : "encode";
+    const failure = error instanceof StorageFailure ? error.failure : error;
+    const value = failure && typeof failure === "object" ? failure : {};
+    const code = typeof value.code === "string" && /^(?:E[A-Z0-9_]{1,30}|SQLITE_[A-Z_]{1,30}|spool_full|lock_timeout)$/.test(value.code) ? value.code : null;
+    const sqlite = typeof value.errcode === "number" ? value.errcode : null;
+    const cause = code === "lock_timeout" ? "lock_timeout" : code === "spool_full" ? "spool_limit"
+        : ["EACCES", "EPERM", "EROFS"].includes(code ?? "") || (sqlite !== null && [3, 8, 23].includes(sqlite & 255)) ? "permission"
+            : ["ENOSPC", "EDQUOT"].includes(code ?? "") || (sqlite !== null && (sqlite & 255) === 13) ? "filesystem_capacity" : "other";
+    const status = value.$metadata?.httpStatusCode;
+    return { cause, stage, error_code: code, sqlite_code: sqlite, errno: typeof value.errno === "number" ? value.errno : null,
+        http_status: typeof status === "number" && status >= 100 && status <= 599 ? status : null, queue_role: diagnosticRole() };
+}
+function diagnosticRole() {
+    const role = process.env.OXYGEN_WORKER_QUEUE_ROLE;
+    return role && ["relay", "bulk", "maintenance", "interactive", "provider", "outbound"].includes(role) ? role
+        : process.env.OXYGEN_PROCESS_ROLE === "worker" ? "legacy" : "web";
+}
+/** Coalesce local contenders; the kernel mutex still owns cross-process admission. */
+function admitDiagnostic(directory, record, encoded) {
+    return new Promise((resolve, reject) => {
+        const pending = admissions.get(directory);
+        const admission = { record, encoded, deadline: performance.now() + 5_000, resolve, reject };
+        if (pending)
+            pending.pending.push(admission);
+        else {
+            const queue = { pending: [admission] };
+            admissions.set(directory, queue);
+            queueMicrotask(() => { void drainAdmissions(directory, queue); });
+        }
+    });
+}
+async function drainAdmissions(directory, queue) {
+    try {
+        while (queue.pending.length) {
+            const batch = queue.pending.splice(0, 32);
+            let release = null;
+            try {
+                release = await storageStage("lock", () => acquireDiagnosticStorageLock(join(directory, ".admission.lock"), Math.max(0, batch[0].deadline - performance.now())));
+                if (!release)
+                    throw new StorageFailure("lock", { code: "lock_timeout" });
+                const started = performance.now();
+                let { used, files } = await storageStage("inspect", () => inspectDiagnosticSpool(directory));
+                queue.files = files;
+                const scanMs = performance.now() - started;
+                for (const admission of batch) {
+                    try {
+                        if (performance.now() >= admission.deadline)
+                            throw new StorageFailure("lock", { code: "lock_timeout" });
+                        if (used + admission.encoded.compressed.length > DIAGNOSTIC_MAX_BYTES)
+                            throw new StorageFailure("capacity", { code: "spool_full" });
+                        // Reserve conservatively even if cleanup of a failed partial write fails.
+                        used += admission.encoded.compressed.length;
+                        admission.resolve(await writeDiagnosticSpool(directory, admission.record.id, admission.encoded.compressed));
+                    }
+                    catch (error) {
+                        admission.reject(error);
+                    }
+                }
+                log("info", "diagnostics.spool_admitted", { queue_role: diagnosticRole(), batch_records: batch.length, spool_files: files.length,
+                    spool_bytes: used, scan_ms: scanMs, admission_wait_ms: performance.now() - (batch[0].deadline - 5_000) });
+            }
+            catch (error) {
+                for (const admission of batch)
+                    admission.reject(error);
+            }
+            finally {
+                await release?.();
+            }
+        }
+    }
+    catch (error) {
+        for (const admission of queue.pending.splice(0))
+            admission.reject(error);
+    }
+    finally {
+        admissions.delete(directory);
+    }
+}
+async function writeDiagnosticSpool(directory, id, compressed) {
+    const path = join(directory, `${id}.json.gz`);
+    const temporary = join(directory, `${id}.${randomUUID()}.tmp`);
+    let handle;
+    try {
+        handle = await storageStage("open", () => open(temporary, "wx", 0o600));
+        await storageStage("write", () => handle.writeFile(compressed));
+        await storageStage("sync", () => handle.sync());
+        await handle.close();
+        handle = undefined;
+        await storageStage("rename", () => rename(temporary, path));
+        return path;
+    }
+    finally {
+        try {
+            await handle?.close();
+        }
+        finally {
+            await unlink(temporary).catch(() => undefined);
+        }
+    }
+}
 export function observeDiagnosticStorage(observer) {
     onStored = observer;
     startDiagnosticRetry();
@@ -102,40 +221,18 @@ export async function storeDiagnostic(record) {
             encoded = encodeDiagnostic(record);
         }
         record = parseDiagnosticRecord(JSON.parse(encoded.bytes.toString("utf8")));
-        await mkdir(directory, { recursive: true, mode: 0o700 });
-        // Admission and expiry share one lock across web/worker processes on a host.
-        const lockPath = join(directory, ".admission.lock");
-        const release = await acquireDiagnosticStorageLock(lockPath, 5_000);
-        if (!release)
-            throw new Error("Diagnostic spool admission busy");
-        try {
-            const { used } = await inspectDiagnosticSpool(directory);
-            if (used + encoded.compressed.length > DIAGNOSTIC_MAX_BYTES)
-                throw new Error("Diagnostic spool is full");
-            path = join(directory, `${record.id}.json.gz`);
-            const temporary = join(directory, `${record.id}.${randomUUID()}.tmp`);
-            const handle = await open(temporary, "wx", 0o600);
-            try {
-                await handle.writeFile(encoded.compressed);
-                await handle.sync();
-            }
-            finally {
-                await handle.close();
-            }
-            await rename(temporary, path);
-        }
-        finally {
-            await release();
-        }
+        await storageStage("mkdir", () => mkdir(directory, { recursive: true, mode: 0o700 }));
+        path = await admitDiagnostic(directory, record, encoded);
         startDiagnosticRetry();
-        const receipt = await uploadEncodedDiagnostic(record, encoded);
+        const receipt = await storageStage("upload", () => uploadEncodedDiagnostic(record, encoded));
         await unlink(path).catch(() => undefined);
         return receipt;
     }
-    catch {
+    catch (error) {
         // Neither storage credentials nor upstream exception text belong in logs.
-        log("warn", path ? "diagnostics.capture_deferred" : "diagnostics.capture_lost", { diagnostic_id: record.id, reason: path ? "upload_failed" : "spool_admission_failed" });
-        recordTelemetryCounter(path ? "oxygen.diagnostics.deferred" : "oxygen.diagnostics.lost", 1, { source: record.surface });
+        const fields = storageFailureFields(error);
+        log("warn", path ? "diagnostics.capture_deferred" : "diagnostics.capture_lost", { diagnostic_id: record.id, reason: path ? "upload_failed" : "spool_admission_failed", ...fields });
+        recordTelemetryCounter(path ? "oxygen.diagnostics.deferred" : "oxygen.diagnostics.lost", 1, { source: record.surface, cause: fields.cause, queue_role: diagnosticRole() });
         return null;
     }
 }
@@ -155,11 +252,11 @@ async function uploadEncodedDiagnostic(record, encoded) {
         Metadata: { sha256: encoded.sha256, bytes: String(encoded.bytes.length), expires_at: new Date(Date.parse(record.started_at) + DIAGNOSTIC_RETENTION_MS).toISOString() },
     }), { abortSignal: AbortSignal.timeout(15_000) });
     log("info", "diagnostics.capture_stored", { ...diagnosticSummary(record), org_id: record.organization_id, user_id: record.user_id,
-        diagnostic_key: key, bytes: encoded.bytes.length, compressed_bytes: encoded.compressed.length, sha256: encoded.sha256 });
+        diagnostic_key: key, bytes: encoded.bytes.length, compressed_bytes: encoded.compressed.length, sha256: encoded.sha256, queue_role: diagnosticRole() });
     recordTelemetryCounter("oxygen.diagnostics.stored", 1, { source: record.surface, layer: record.layer });
     const receipt = { key, sha256: encoded.sha256, bytes: encoded.bytes.length, compressed_bytes: encoded.compressed.length, record };
     if (onStored)
-        await onStored(receipt);
+        await storageStage("observer", () => onStored(receipt));
     return receipt;
 }
 export function flushDiagnosticSpool() {
@@ -169,63 +266,81 @@ export function flushDiagnosticSpool() {
         if (!diagnosticsConfigured())
             return;
         const directory = process.env.OXYGEN_DIAGNOSTICS_SPOOL_DIR;
-        const release = await acquireDiagnosticStorageLock(join(directory, ".upload.lock"));
+        const release = await storageStage("lock", () => acquireDiagnosticStorageLock(join(directory, ".upload.lock")));
         if (!release)
             return;
         try {
             // Idle workers enforce the same expiry as new admissions. The admission
             // lock protects cleanup against a writer replacing an old record path.
-            const admission = await acquireDiagnosticStorageLock(join(directory, ".admission.lock"));
-            if (!admission)
-                return;
             let files;
-            try {
-                files = (await inspectDiagnosticSpool(directory)).files.slice(0, 20);
+            const local = admissions.get(directory);
+            if (local) {
+                // Reuse the active writer's protected inspection. Waiting for local idle
+                // can starve retained evidence indefinitely under sustained capture.
+                files = local.files?.slice(0, 20) ?? [];
             }
-            finally {
-                await admission();
+            else {
+                const admission = await storageStage("lock", () => acquireDiagnosticStorageLock(join(directory, ".admission.lock")));
+                if (!admission)
+                    return;
+                try {
+                    files = (await storageStage("inspect", () => inspectDiagnosticSpool(directory))).files.slice(0, 20);
+                }
+                finally {
+                    await admission();
+                }
             }
             for (const name of files) {
                 const path = join(directory, name);
                 try {
-                    const compressed = await readFile(path);
-                    const record = decodeDiagnostic(compressed);
-                    await uploadEncodedDiagnostic(record, encodeDiagnostic(record));
+                    const compressed = await storageStage("read", () => readFile(path));
+                    const record = await storageStage("decode", async () => decodeDiagnostic(compressed));
+                    await storageStage("upload", () => uploadEncodedDiagnostic(record, encodeDiagnostic(record)));
                     await unlink(path).catch(() => undefined);
                 }
-                catch { /* retain failed uploads; admission expires them visibly */ }
+                catch (error) {
+                    log("warn", "diagnostics.spool_upload_deferred", { diagnostic_id: name.slice(0, -8), ...storageFailureFields(error) });
+                }
             }
         }
         finally {
             await release();
         }
-    })().catch(() => undefined).finally(() => { flushing = null; });
+    })().catch(error => { log("warn", "diagnostics.spool_retry_failed", storageFailureFields(error)); }).finally(() => { flushing = null; });
     return flushing;
 }
 /** Caller holds admission lock; count retained bytes and expire actual filenames. */
 async function inspectDiagnosticSpool(directory) {
     let used = 0;
-    const files = [];
-    for (const name of await readdir(directory)) {
-        const record = /^[0-9a-f-]+\.json\.gz$/.test(name);
-        if (!record && !/^[0-9a-f-]+(?:\.[0-9a-f-]+)?\.tmp$/.test(name))
-            continue;
-        const path = join(directory, name);
-        const info = await stat(path).catch(() => null);
-        if (!info)
-            continue;
-        if (Date.now() - info.mtimeMs >= 72 * 60 * 60 * 1000) {
-            await unlink(path);
-            log("warn", "diagnostics.capture_lost", { reason: "spool_expired", bytes: info.size });
-            recordTelemetryCounter("oxygen.diagnostics.lost", 1, { reason: "spool_expired" });
-        }
-        else {
-            used += info.size;
-            if (record)
-                files.push(name);
+    const retained = [];
+    const names = (await readdir(directory)).filter(name => /^[0-9a-f-]+\.json\.gz$/.test(name) || /^[0-9a-f-]+(?:\.[0-9a-f-]+)?\.tmp$/.test(name));
+    for (let offset = 0; offset < names.length; offset += 64) {
+        const inspected = await Promise.all(names.slice(offset, offset + 64).map(async (name) => {
+            const path = join(directory, name);
+            const info = await stat(path).catch(error => { if (error?.code === "ENOENT")
+                return null; throw error; });
+            return { name, path, info };
+        }));
+        for (const { name, path, info } of inspected) {
+            const record = /^[0-9a-f-]+\.json\.gz$/.test(name);
+            if (!info)
+                continue;
+            if (Date.now() - info.mtimeMs >= 72 * 60 * 60 * 1000) {
+                const removed = await unlink(path).then(() => true).catch(error => { if (error?.code === "ENOENT")
+                    return false; throw error; });
+                if (removed) {
+                    log("warn", "diagnostics.capture_lost", { reason: "spool_expired", bytes: info.size, queue_role: diagnosticRole() });
+                    recordTelemetryCounter("oxygen.diagnostics.lost", 1, { reason: "spool_expired" });
+                }
+            }
+            else {
+                used += info.size;
+                if (record)
+                    retained.push({ name, mtimeMs: info.mtimeMs });
+            }
         }
     }
-    return { used, files };
+    return { used, files: retained.sort((a, b) => a.mtimeMs - b.mtimeMs || a.name.localeCompare(b.name)).map(file => file.name) };
 }
 /** A metadata-only fallback for an unsupported value never claims full capture. */
 export function partialDiagnostic(record, reason) {

package/node_modules/@oxygen/shared/dist/email-health-status.d.ts

@@ -0,0 +1,11 @@
+/** Health polling and measured evidence are independent clocks. Legacy checked_at
+ * values also advanced on empty polls and cannot establish measurement freshness. */
+export type EmailHealthSyncStatus = "unknown" | "ok" | "blocked" | "failed";
+export type EmailHealthSyncReason = "byok_requires_paid_plan" | "provider_read_failed";
+export type EmailHealthFreshness = "current" | "stale" | "unmeasured";
+export declare function readEmailHealthStatus(metadata: Record<string, unknown> | null | undefined, now?: number): {
+    evidenceAt: Date | null;
+    freshness: EmailHealthFreshness;
+    syncStatus: EmailHealthSyncStatus;
+    syncReason: EmailHealthSyncReason | null;
+};

package/node_modules/@oxygen/shared/dist/email-health-status.js

@@ -0,0 +1,16 @@
+export function readEmailHealthStatus(metadata, now = Date.now()) {
+    const evidence = metadata?.health_evidence_at;
+    const timestamp = typeof evidence === "string" && /^\d{4}-\d{2}-\d{2}T/.test(evidence)
+        ? Date.parse(evidence) : NaN;
+    const evidenceAt = Number.isFinite(timestamp) && timestamp <= now ? new Date(timestamp) : null;
+    const status = metadata?.health_sync_status;
+    const syncStatus = status === "ok" || status === "blocked" || status === "failed" ? status : "unknown";
+    const reason = metadata?.health_sync_reason;
+    const syncReason = reason === "byok_requires_paid_plan" || reason === "provider_read_failed" ? reason : null;
+    return {
+        evidenceAt,
+        freshness: evidenceAt ? now - timestamp <= 24 * 60 * 60 * 1000 ? "current" : "stale" : "unmeasured",
+        syncStatus,
+        syncReason,
+    };
+}

package/node_modules/@oxygen/shared/dist/hosted-ai.d.ts

@@ -184,8 +184,9 @@ export declare function resolveHostedAiModel(input: {
 export declare function managedModelLabel(model: string, preferredUseCase?: HostedAiUseCase): string | null;
 /**
  * What an AI-column run's provenance records as its model: the tier label for
- * a managed run, and the model itself only when the customer pinned it on
- * their own key. A BYOK run on the tier default is still OXYGEN's pick.
+ * a managed generative run, System One for classification, and the model itself
+ * only when the customer pinned it on their own key. A BYOK run on the tier
+ * default is still OXYGEN's pick.
  */
 export declare function customerFacingAiColumnModel(input: {
     model: string;

package/node_modules/@oxygen/shared/dist/hosted-ai.js

@@ -481,11 +481,11 @@ export function resolveHostedAiModel(input) {
 const BACKUP_MODEL_LABEL = "Oxygen backup model";
 // TypeSafe's System One classifier (`SYSTEM_ONE_MODEL` in @oxygen/integrations,
 // pinned as `jev-<version>`) is OXYGEN's choice too. It answers classification
-// columns and inbox triage at the managed Fast price, so provenance written with
-// its id (before the write-time fix, or by a later version bump) reads as that
-// tier. Matched by shape so a version bump stays covered.
+// columns and inbox triage without text generation. Its flat classification
+// price and inference class differ from the generative tiers. Keep a distinct
+// label while hiding the managed vendor id, including after a version bump.
 const SYSTEM_ONE_MODEL_ID = /^jev-(?:\d+(?:\.\d+)*|latest)$/;
-const SYSTEM_ONE_MODEL_LABEL = MANAGED_AI_TIER_LABELS.low;
+const SYSTEM_ONE_MODEL_LABEL = "System One";
 // Doppler can swap any tier's model without a deploy; the swapped-in id is still
 // OXYGEN's choice, so it is redacted like the registry default it replaces.
 const MODEL_OVERRIDE_ENV_PREFIXES = ["OXYGEN_OPENROUTER_MODEL_", "OXYGEN_COPILOT_MODEL_", "OXYGEN_AGENT_MODEL_"];
@@ -566,10 +566,13 @@ function labelForManagedModel(labels, model) {
 }
 /**
  * What an AI-column run's provenance records as its model: the tier label for
- * a managed run, and the model itself only when the customer pinned it on
- * their own key. A BYOK run on the tier default is still OXYGEN's pick.
+ * a managed generative run, System One for classification, and the model itself
+ * only when the customer pinned it on their own key. A BYOK run on the tier
+ * default is still OXYGEN's pick.
  */
 export function customerFacingAiColumnModel(input) {
+    if (SYSTEM_ONE_MODEL_ID.test(input.model))
+        return SYSTEM_ONE_MODEL_LABEL;
     if (input.credentialMode === "byok" && managedModelLabel(input.model, "ai_column") === null)
         return input.model;
     return MANAGED_AI_TIER_LABELS[input.reasoningLevel];

package/node_modules/@oxygen/shared/dist/langfuse.d.ts

@@ -105,7 +105,7 @@ export type LlmTracingClient = {
     score(body: LlmScoreBody): Promise<boolean>;
     /** Never rejects; bounded at 5s on workers, 15s in serverless after(). */
     flush(): Promise<void>;
-    /** Flush + stop timers. Same worker/serverless bound as flush(). */
+    /** Flush + stop timers. Never rejects; bounded at 30s to drain active retries. */
     shutdown(): Promise<void>;
 };
 /**
@@ -178,12 +178,14 @@ export type LlmExportSummary = {
      * spans, so exported:dropped is not a like-for-like ratio.
      */
     dropped(count: number): void;
+    retried(): void;
+    recovered(count: number): void;
     /** Logs the window when it is at least a minute old; otherwise no-op. */
     maybeReport(): void;
     /** Logs whatever is pending regardless of age (process shutdown). */
     reportNow(): void;
 };
-export declare function createLlmExportSummary(now?: () => number): LlmExportSummary;
+export declare function createLlmExportSummary(now?: () => number, context?: Record<string, unknown>): LlmExportSummary;
 /**
  * Resolves a registered code prompt (name + content hash) to the native
  * Langfuse prompt version the deploy-time sync created for it. Synchronous