@oxygen-agent/cli 1.1014.619 → 1.1014.771

package/node_modules/@oxygen/workflows/dist/refactor-internals/condition-comparison.js

@@ -0,0 +1,222 @@
+export function compareWorkflowConditionValues(left, op, right) {
+    switch (op) {
+        case "eq":
+            return valuesEqual(left, right);
+        case "neq":
+            return !valuesEqual(left, right);
+        case "gt":
+            return orderingOf(left, right) > 0;
+        case "gte":
+            return orderingOf(left, right) >= 0;
+        case "lt":
+            return orderingOf(left, right) < 0;
+        case "lte":
+            return orderingOf(left, right) <= 0;
+        case "contains":
+            return containsValue(left, right);
+        case "not_contains":
+            return !containsValue(left, right);
+        case "starts_with":
+            return textOf(left).startsWith(textOf(right));
+        case "ends_with":
+            return textOf(left).endsWith(textOf(right));
+        case "is_empty":
+            return isEmptyValue(left);
+        case "is_not_empty":
+            return !isEmptyValue(left);
+        case "in":
+            return containsValue(right, left);
+        case "not_in":
+            return !containsValue(right, left);
+        case "matches":
+            return matchesPattern(left, right);
+    }
+}
+/**
+ * Numeric when both sides read as numbers, otherwise strict identity with
+ * null/undefined treated as one blank. Deliberately NOT the formula language's
+ * `formulaValuesEqual`, which throws on non-numeric input: a condition gates
+ * routing, and a run must not fail because a provider returned an object where
+ * the author expected a string.
+ */
+function valuesEqual(left, right) {
+    if (left === right)
+        return true;
+    if (left === null || left === undefined)
+        return right === null || right === undefined;
+    if (right === null || right === undefined)
+        return false;
+    const leftNumber = numberOf(left);
+    const rightNumber = numberOf(right);
+    if (leftNumber !== null && rightNumber !== null)
+        return leftNumber === rightNumber;
+    if (Array.isArray(left) && Array.isArray(right)) {
+        return left.length === right.length
+            && left.every((entry, index) => valuesEqual(entry, right[index]));
+    }
+    return false;
+}
+/**
+ * Ordering for the relational operators. Incomparable operands sort as 0, so
+ * `gt`/`lt` are false and `gte`/`lte` are true — the same shape JavaScript gives
+ * for equal values, and never an exception.
+ */
+function orderingOf(left, right) {
+    const leftNumber = numberOf(left);
+    const rightNumber = numberOf(right);
+    if (leftNumber !== null && rightNumber !== null) {
+        if (leftNumber === rightNumber)
+            return 0;
+        return leftNumber < rightNumber ? -1 : 1;
+    }
+    if (typeof left === "string" && typeof right === "string") {
+        return left.localeCompare(right);
+    }
+    return 0;
+}
+function numberOf(value) {
+    if (typeof value === "number")
+        return Number.isFinite(value) ? value : null;
+    if (typeof value === "string" && value.trim()) {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : null;
+    }
+    return null;
+}
+/** Membership for arrays, case-sensitive substring for text. */
+function containsValue(haystack, needle) {
+    if (Array.isArray(haystack))
+        return haystack.some((entry) => valuesEqual(entry, needle));
+    if (haystack === null || haystack === undefined)
+        return false;
+    if (needle === null || needle === undefined)
+        return false;
+    return textOf(haystack).includes(textOf(needle));
+}
+function isEmptyValue(value) {
+    if (value === null || value === undefined)
+        return true;
+    if (typeof value === "string")
+        return value.trim().length === 0;
+    if (Array.isArray(value))
+        return value.length === 0;
+    // 0 and false are values an author chose, not emptiness.
+    if (typeof value === "object")
+        return Object.keys(value).length === 0;
+    return false;
+}
+function textOf(value) {
+    if (value === null || value === undefined)
+        return "";
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    try {
+        return JSON.stringify(value) ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+// ---------------------------------------------------------------------------
+// `matches`
+// ---------------------------------------------------------------------------
+const MAX_CONDITION_PATTERN_LENGTH = 200;
+/**
+ * Compile a `matches` pattern, or return null when it is unsafe or invalid.
+ *
+ * Choice: conservative STATIC REJECTION rather than a linear (Thompson NFA)
+ * matcher. A linear engine would be several hundred lines of new, security-load-
+ * bearing code in a module the browser also bundles, whereas the patterns real
+ * GTM authors write (domain suffixes, job-title keywords, ID formats) never need
+ * the constructs rejected here. Rejected: sources over 200 characters,
+ * lookaround, backreferences, and a quantified group whose body itself contains
+ * an unbounded quantifier — the `(a+)+` family that drives catastrophic
+ * backtracking. Everything else compiles as a normal RegExp.
+ *
+ * The linter calls this at authoring time and reports `invalid_condition`, so a
+ * rejected pattern is a lint error the author sees, not a silent run-time false.
+ */
+export function compileConditionPattern(pattern) {
+    if (!isSafeRegExpSource(pattern))
+        return null;
+    try {
+        return new RegExp(pattern);
+    }
+    catch {
+        return null;
+    }
+}
+function isSafeRegExpSource(source) {
+    if (!source || source.length > MAX_CONDITION_PATTERN_LENGTH)
+        return false;
+    if (/\(\?<?[=!]/.test(source))
+        return false; // lookahead / lookbehind
+    if (/\\[1-9]/.test(source))
+        return false; // backreference
+    return !hasNestedQuantifier(source);
+}
+function isUnboundedQuantifier(char) {
+    // `?` alone is bounded and cannot blow up; `*`, `+` and `{n,m}` can.
+    return char === "*" || char === "+" || char === "{";
+}
+function hasNestedQuantifier(source) {
+    // One frame per open group, plus a base frame for the top level. A frame is
+    // "quantified" once anything inside it repeats.
+    const stack = [{ quantified: false }];
+    let inCharacterClass = false;
+    let index = 0;
+    while (index < source.length) {
+        const char = source[index] ?? "";
+        if (char === "\\") {
+            index += 2;
+            continue;
+        }
+        if (inCharacterClass) {
+            if (char === "]")
+                inCharacterClass = false;
+            index += 1;
+            continue;
+        }
+        if (char === "[") {
+            inCharacterClass = true;
+            index += 1;
+            continue;
+        }
+        if (char === "(") {
+            stack.push({ quantified: false });
+            index += 1;
+            continue;
+        }
+        if (char === ")") {
+            index += 1;
+            // Unbalanced ")" — leave it to RegExp construction to reject.
+            if (stack.length === 1)
+                continue;
+            const frame = stack.pop();
+            const repeated = isUnboundedQuantifier(source[index] ?? "");
+            if (repeated && frame?.quantified === true)
+                return true;
+            const parent = stack[stack.length - 1];
+            if (parent && (repeated || frame?.quantified === true))
+                parent.quantified = true;
+            continue;
+        }
+        if (isUnboundedQuantifier(char)) {
+            const top = stack[stack.length - 1];
+            if (top)
+                top.quantified = true;
+        }
+        index += 1;
+    }
+    return false;
+}
+function matchesPattern(value, pattern) {
+    if (typeof pattern !== "string")
+        return false;
+    const regex = compileConditionPattern(pattern);
+    if (!regex)
+        return false;
+    return regex.test(textOf(value));
+}

package/node_modules/@oxygen/workflows/dist/refactor-internals/execution-policy.d.ts

@@ -0,0 +1,64 @@
+export declare const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
+export declare function readWorkflowRunMaxCredits(metadata: Record<string, unknown> | null | undefined): number | null;
+export declare const WORKFLOW_STANDING_AUTHORIZATION_METADATA_KEY = "standing_authorization";
+export declare const WORKFLOW_STANDING_AUTHORIZATION_POLICY_METADATA_KEY = "standing_authorization_policy";
+export declare const WORKFLOW_STANDING_AUTHORIZATION_POLICY_REVISION_BOUND_V1 = "revision_bound_v1";
+export declare const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_ERROR_CODE = "workflow_standing_authorization_required";
+export declare const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_MESSAGE = "This autonomous workflow can call tools and needs standing authorization for its current revision. Re-enable it with approved=true; pass a positive max_credits per delivery or omit it to use the plan default.";
+type WorkflowStandingAuthorizationBase = {
+    approved: true;
+    revisionId: string;
+    authorizedByActorId: string;
+    authorizedAt: string;
+};
+export type WorkflowStandingAuthorization = WorkflowStandingAuthorizationBase & ({
+    capPolicy: "explicit";
+    maxCredits: number;
+} | {
+    capPolicy: "plan_default";
+    maxCredits: null;
+});
+export declare function isAutonomousWorkflowTriggerType(value: unknown): value is "cron" | "webhook" | "event";
+/**
+ * Whether this manifest can cross into a tool at runtime. Hosted workflows are
+ * explicit in `steps`; oxygen-workflows-v2 graphs are explicit in `nodes`;
+ * durable recipes declare the complete allowlist in `tools_used`. Keeping this
+ * predicate structural means legacy revisions can be checked before execution
+ * without trusting trigger metadata.
+ *
+ * The v2 branch is load-bearing, not cosmetic: this predicate is the ONLY input
+ * to workflowRequiresStandingAuthorization, so a graph it does not recognise arms
+ * a cron / webhook / event trigger with no standing authorization and therefore
+ * no per-delivery credit ceiling. A `workflow` (sub-graph) node counts as well —
+ * a child run can invoke tools of its own, and the gate must fail closed.
+ */
+export declare function workflowManifestCanInvokeTool(manifest: unknown): boolean;
+/** The single apply/enable/runtime gate for standing autonomous authority. */
+export declare function workflowRequiresStandingAuthorization(manifest: unknown, triggerType?: unknown): boolean;
+/**
+ * Runtime enforcement marker for triggers created or explicitly re-armed after
+ * revision-bound standing authority shipped. Legacy active triggers have no
+ * marker and stay runnable during the default-ceiling compatibility rollout;
+ * every new/re-armed tool trigger carries this marker and fails closed if its
+ * matching authorization is missing or stale.
+ */
+export declare function workflowStandingAuthorizationPolicyIsEnforced(metadata: Record<string, unknown> | null | undefined, triggerDefaultCapsMode?: unknown): boolean;
+/**
+ * Read the standing authority for one autonomous trigger revision. A null
+ * result is fail-closed for policy-marked triggers. Legacy active rows
+ * are distinguished by the separate policy marker so they can continue under
+ * the fire-time default-ceiling compatibility rollout.
+ */
+export declare function readWorkflowStandingAuthorization(metadata: Record<string, unknown> | null | undefined, revisionId: string): WorkflowStandingAuthorization | null;
+export declare function readWorkflowRunPreApprovedLabels(metadata: Record<string, unknown> | null | undefined): string[];
+export declare function readManagedToolRunCredits(output: unknown): number;
+export type WorkflowSpendCapDecision = {
+    allowed: boolean;
+    projectedCredits: number;
+};
+export declare function evaluateWorkflowRunSpendCap(input: {
+    maxCredits: number;
+    creditsUsed: number;
+    estimatedCredits?: number | null;
+}): WorkflowSpendCapDecision;
+export {};

package/node_modules/@oxygen/workflows/dist/refactor-internals/execution-policy.js

@@ -0,0 +1,204 @@
+// Pure run authority and spend policy. Hosts supply trusted persisted metadata;
+// the compiler and worker keep their own VM, database and execution ownership.
+// Deliberately local: importing the formula aggregate for this predicate loads
+// its evaluator and function catalog into callers that only need authority.
+// Match the existing loose record contract, including class instances.
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+// Live `workflows call` requests carry an approved max_credits spend cap in
+// the run's metadata (R-E.22(c)). These pure helpers are the single source of
+// truth for reading that cap and deciding whether the next paid tool step may
+// run; the worker's step loop and the durable-recipe runtime wrap the refusal
+// in an OxygenError with this code so the stop is visible as run/step state.
+export const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
+// Matches the soft-ceiling epsilon used by table action runs so float drift
+// never refuses a run that is exactly at its cap.
+const WORKFLOW_SPEND_CAP_EPSILON = 0.000001;
+export function readWorkflowRunMaxCredits(metadata) {
+    if (!isRecord(metadata))
+        return null;
+    const raw = metadata.max_credits ?? metadata.maxCredits;
+    const parsed = typeof raw === "number"
+        ? raw
+        : typeof raw === "string" && raw.trim()
+            ? Number(raw)
+            : Number.NaN;
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return null;
+    return parsed;
+}
+export const WORKFLOW_STANDING_AUTHORIZATION_METADATA_KEY = "standing_authorization";
+export const WORKFLOW_STANDING_AUTHORIZATION_POLICY_METADATA_KEY = "standing_authorization_policy";
+export const WORKFLOW_STANDING_AUTHORIZATION_POLICY_REVISION_BOUND_V1 = "revision_bound_v1";
+export const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_ERROR_CODE = "workflow_standing_authorization_required";
+export const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_MESSAGE = "This autonomous workflow can call tools and needs standing authorization for its current revision. Re-enable it with approved=true; pass a positive max_credits per delivery or omit it to use the plan default.";
+export function isAutonomousWorkflowTriggerType(value) {
+    return value === "cron" || value === "webhook" || value === "event";
+}
+/**
+ * Whether this manifest can cross into a tool at runtime. Hosted workflows are
+ * explicit in `steps`; oxygen-workflows-v2 graphs are explicit in `nodes`;
+ * durable recipes declare the complete allowlist in `tools_used`. Keeping this
+ * predicate structural means legacy revisions can be checked before execution
+ * without trusting trigger metadata.
+ *
+ * The v2 branch is load-bearing, not cosmetic: this predicate is the ONLY input
+ * to workflowRequiresStandingAuthorization, so a graph it does not recognise arms
+ * a cron / webhook / event trigger with no standing authorization and therefore
+ * no per-delivery credit ceiling. A `workflow` (sub-graph) node counts as well —
+ * a child run can invoke tools of its own, and the gate must fail closed.
+ */
+export function workflowManifestCanInvokeTool(manifest) {
+    if (!isRecord(manifest))
+        return false;
+    // EVERY shape is checked and the results OR'd — deliberately not a chain of
+    // early returns dispatching on which field is present.
+    //
+    // The chain was a bypass: `tools_used` was tested first and returned from that
+    // branch, so a v2 graph manifest carrying an extra `tools_used: []` never
+    // reached the `nodes` check and reported "cannot invoke a tool". That is this
+    // predicate's ONLY input, so apply then skipped the standing-authorization gate
+    // for a cron-triggered graph full of tool nodes, left the trigger unmarked so
+    // the fire-time check was fooled too, and resolved a delivery cap of null — no
+    // ceiling at all. The graph linter accepts the extra key, so nothing else
+    // objected either.
+    //
+    // A manifest that carries a tool node CAN invoke a tool no matter what other
+    // fields it also carries, so the honest form is a union that fails closed.
+    const viaRecipe = Array.isArray(manifest.tools_used)
+        && manifest.tools_used.some((toolId) => isNonEmptyString(toolId));
+    const viaGraph = Array.isArray(manifest.nodes)
+        && manifest.nodes.some((node) => isRecord(node) && (node.kind === "tool"
+            || (isRecord(node.recipe)
+                && Array.isArray(node.recipe.tools_used)
+                && node.recipe.tools_used.some((toolId) => isNonEmptyString(toolId)))));
+    const viaSteps = Array.isArray(manifest.steps)
+        && manifest.steps.some((step) => isRecord(step) && step.kind === "tool");
+    return viaRecipe || viaGraph || viaSteps;
+}
+/** The single apply/enable/runtime gate for standing autonomous authority. */
+export function workflowRequiresStandingAuthorization(manifest, triggerType) {
+    const manifestTriggerType = isRecord(manifest)
+        && isRecord(manifest.trigger)
+        ? manifest.trigger.type
+        : "api";
+    return isAutonomousWorkflowTriggerType(triggerType ?? manifestTriggerType)
+        && workflowManifestCanInvokeTool(manifest);
+}
+/**
+ * Runtime enforcement marker for triggers created or explicitly re-armed after
+ * revision-bound standing authority shipped. Legacy active triggers have no
+ * marker and stay runnable during the default-ceiling compatibility rollout;
+ * every new/re-armed tool trigger carries this marker and fails closed if its
+ * matching authorization is missing or stale.
+ */
+export function workflowStandingAuthorizationPolicyIsEnforced(metadata, triggerDefaultCapsMode) {
+    return triggerDefaultCapsMode === "enforce"
+        || (isRecord(metadata)
+            && metadata[WORKFLOW_STANDING_AUTHORIZATION_POLICY_METADATA_KEY]
+                === WORKFLOW_STANDING_AUTHORIZATION_POLICY_REVISION_BOUND_V1);
+}
+/**
+ * Read the standing authority for one autonomous trigger revision. A null
+ * result is fail-closed for policy-marked triggers. Legacy active rows
+ * are distinguished by the separate policy marker so they can continue under
+ * the fire-time default-ceiling compatibility rollout.
+ */
+export function readWorkflowStandingAuthorization(metadata, revisionId) {
+    if (!isRecord(metadata))
+        return null;
+    const raw = metadata[WORKFLOW_STANDING_AUTHORIZATION_METADATA_KEY];
+    if (!isRecord(raw) || raw.approved !== true)
+        return null;
+    const maxCredits = typeof raw.max_credits === "number"
+        ? raw.max_credits
+        : Number(raw.max_credits);
+    const capPolicy = raw.cap_policy === "plan_default"
+        ? "plan_default"
+        : raw.cap_policy === "explicit" || raw.cap_policy === undefined
+            ? "explicit"
+            : null;
+    const authorizedAt = typeof raw.authorized_at === "string" ? raw.authorized_at.trim() : "";
+    const authorizedByActorId = typeof raw.authorized_by_actor_id === "string"
+        ? raw.authorized_by_actor_id.trim()
+        : "";
+    if (!capPolicy
+        || (capPolicy === "explicit" && (!Number.isFinite(maxCredits) || maxCredits <= 0))
+        || raw.revision_id !== revisionId
+        || !authorizedByActorId
+        || !authorizedAt
+        || Number.isNaN(Date.parse(authorizedAt))) {
+        return null;
+    }
+    const base = {
+        approved: true,
+        revisionId,
+        authorizedByActorId,
+        authorizedAt,
+    };
+    return capPolicy === "explicit"
+        ? { ...base, capPolicy, maxCredits }
+        : { ...base, capPolicy, maxCredits: null };
+}
+// Approval labels the run's enqueue route already collected SYNCHRONOUS human
+// approval for (a CLI/MCP `approved=true` gate before the run was created), and
+// recorded in run metadata as `preapproved_labels`. A live ctx.approvals.require()
+// call whose `label` is in this set is honored immediately by both recipe
+// executors instead of creating and parking on a durable decision row. Every
+// other label goes through the same host-mediated durable gate under both local
+// and sandbox executors, and the max_credits spend cap is
+// enforced separately per paid tool step, so a pre-approved label never widens
+// spend. Only trusted server code (the enqueue route) sets this — it is read
+// from run metadata, never from user-suppliable workflow input.
+export function readWorkflowRunPreApprovedLabels(metadata) {
+    if (!isRecord(metadata))
+        return [];
+    const raw = metadata.preapproved_labels ?? metadata.preApprovedLabels;
+    if (!Array.isArray(raw))
+        return [];
+    const labels = raw
+        .filter((entry) => typeof entry === "string")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    return Array.from(new Set(labels));
+}
+// Completed tool runs attach their captured OXYGEN charge in `meta.billing`.
+// Managed provider credits and own-key platform fees both count toward an
+// approved workflow ceiling; user OAuth calls carry neither charge.
+export function readManagedToolRunCredits(output) {
+    if (!isRecord(output))
+        return 0;
+    const meta = output.meta;
+    if (!isRecord(meta))
+        return 0;
+    const billing = meta.billing;
+    if (!isRecord(billing))
+        return 0;
+    const credits = billing.credential_mode === "managed"
+        ? billing.managed_credit_estimate
+        : billing.credential_mode === "byok"
+            ? billing.byok_platform_fee_credits
+            : null;
+    if (typeof credits !== "number" || !Number.isFinite(credits) || credits <= 0)
+        return 0;
+    return credits;
+}
+// `estimatedCredits` is null when the next tool has no managed-credit price
+// (free, BYOK, or unknown catalog entry): such a step is only refused when
+// the cap is already breached, never pre-emptively.
+export function evaluateWorkflowRunSpendCap(input) {
+    const estimated = typeof input.estimatedCredits === "number"
+        && Number.isFinite(input.estimatedCredits)
+        && input.estimatedCredits > 0
+        ? input.estimatedCredits
+        : 0;
+    const projectedCredits = input.creditsUsed + estimated;
+    return {
+        allowed: projectedCredits <= input.maxCredits + WORKFLOW_SPEND_CAP_EPSILON,
+        projectedCredits,
+    };
+}

package/node_modules/@oxygen/workflows/package.json

@@ -13,6 +13,10 @@
     "./graph": {
       "types": "./dist/graph/index.d.ts",
       "import": "./dist/graph/index.js"
+    },
+    "./policy": {
+      "types": "./dist/refactor-internals/execution-policy.d.ts",
+      "import": "./dist/refactor-internals/execution-policy.js"
     }
   },
   "dependencies": {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1014.619",
+  "version": "1.1014.771",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",