@oxygen-agent/cli 1.162.10 → 1.164.30

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.162.10
+Version: 1.164.30

package/dist/http-client.js

@@ -1,4 +1,4 @@
-import { OXYGEN_VERSION, OxygenError, isVersionGreater } from "@oxygen/shared";
+import { OXYGEN_VERSION, OxygenError, isCliResult, isVersionGreater, readEnvelopeCompatibility, vercelProtectionBypassHeaders, withRetryAfterDetails, } from "@oxygen/shared";
 import { randomUUID } from "node:crypto";
 import { defaultApiUrl, loadCredentials } from "./credentials.js";
 import { resolveCliUpdateGuidance } from "./runtime.js";
@@ -28,7 +28,7 @@ path, options = {}) {
         // even against clients that predate the client-side envelope gate.
         "X-Oxygen-Client-Version": OXYGEN_VERSION,
     };
-    addVercelProtectionBypassHeader(apiUrl, headers);
+    Object.assign(headers, vercelProtectionBypassHeaders(apiUrl));
     if (credentials?.token) {
         headers.Authorization = `Bearer ${credentials.token}`;
     }
@@ -188,56 +188,6 @@ function assertCliMeetsMinimumApiVersion(compatibility, options, apiUrl) {
         exitCode: 1,
     });
 }
-function readEnvelopeCompatibility(envelope) {
-    const meta = envelope.meta;
-    if (!meta || typeof meta !== "object" || Array.isArray(meta))
-        return {};
-    const record = meta;
-    const compatibility = {};
-    if (typeof record.version === "string")
-        compatibility.version = record.version;
-    if (typeof record.minimum_cli_version === "string") {
-        compatibility.minimumCliVersion = record.minimum_cli_version;
-    }
-    return compatibility;
-}
-// Surface the server's 429 backoff as a first-class `retry_after_seconds` detail
-// so loop-driving callers can wait the right amount of time instead of dead-
-// reckoning. Prefers a value the API already put in details; otherwise derives
-// it from the RFC 6585 Retry-After header (or reset_at). Non-429 responses and
-// unparseable values pass through untouched.
-function withRetryAfterDetails(details, response) {
-    if (response.status !== 429)
-        return details;
-    const record = details && typeof details === "object" && !Array.isArray(details)
-        ? details
-        : null;
-    if (record && typeof record.retry_after_seconds === "number")
-        return details;
-    const retryAfterSeconds = retryAfterSecondsFromResponse(response, record);
-    if (retryAfterSeconds === null)
-        return details;
-    if (record)
-        return { ...record, retry_after_seconds: retryAfterSeconds };
-    if (details === undefined)
-        return { retry_after_seconds: retryAfterSeconds };
-    return { details, retry_after_seconds: retryAfterSeconds };
-}
-function retryAfterSecondsFromResponse(response, details) {
-    const header = response.headers.get("retry-after");
-    if (header) {
-        const seconds = Number(header);
-        if (Number.isFinite(seconds) && seconds >= 0)
-            return Math.ceil(seconds);
-    }
-    const resetAt = details?.reset_at;
-    if (typeof resetAt === "string") {
-        const resetMs = Date.parse(resetAt);
-        if (!Number.isNaN(resetMs))
-            return Math.max(0, Math.ceil((resetMs - Date.now()) / 1000));
-    }
-    return null;
-}
 function withTraceDetails(details, traceId, compatibility, apiUrl) {
     const serverVersion = compatibility.version;
     const fields = {
@@ -266,21 +216,6 @@ function withTraceDetails(details, traceId, compatibility, apiUrl) {
         ...fields,
     };
 }
-function addVercelProtectionBypassHeader(apiUrl, headers) {
-    const secret = process.env.VERCEL_AUTOMATION_BYPASS_SECRET?.trim();
-    if (!secret)
-        return;
-    let hostname;
-    try {
-        hostname = new URL(apiUrl).hostname;
-    }
-    catch {
-        return;
-    }
-    if (hostname === "vercel.app" || hostname.endsWith(".vercel.app")) {
-        headers["x-vercel-protection-bypass"] = secret;
-    }
-}
 function resolveRequestTimeoutMs(value) {
     if (value === undefined)
         return DEFAULT_REQUEST_TIMEOUT_MS;
@@ -333,14 +268,3 @@ async function readEnvelope(response) {
         exitCode: 1,
     });
 }
-function isCliResult(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return false;
-    const ok = value.ok;
-    if (ok === true)
-        return "data" in value;
-    if (ok !== false)
-        return false;
-    const error = value.error;
-    return Boolean(error) && typeof error === "object" && !Array.isArray(error);
-}

package/dist/index.js

@@ -14,7 +14,7 @@ import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey,
 import { assertRecipeBundleSafe, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowManifest, } from "@oxygen/workflows";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
 import { createBrowserLoginSession, openBrowser } from "./browser-login.js";
-import { clearCredentials, defaultApiUrl, listCredentialProfiles, normalizeApiUrl, pickProfileNameForIdentity, pickProfileNameForUserSession, resolveActiveProfile, saveCredentials, switchCredentialProfile, updateActiveOrganizationForProfile, } from "./credentials.js";
+import { clearCredentials, defaultApiUrl, listCredentialProfiles, loadCredentials, normalizeApiUrl, pickProfileNameForIdentity, pickProfileNameForUserSession, resolveActiveProfile, saveCredentials, switchCredentialProfile, updateActiveOrganizationForProfile, } from "./credentials.js";
 import { ensureFreshCliForApiUrl, requestOxygen } from "./http-client.js";
 import { runLocalCustomHttpColumn } from "./local-custom-http-column.js";
 import { captureCurrentTranscript, collectFeedbackEnvironment, TranscriptCaptureError, } from "./transcript.js";
@@ -83,22 +83,47 @@ async function handleAsyncAction(command, options, action) {
         process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
     }
 }
-// Paid multi-row column runs require an explicit --max-credits spend cap; the
-// server rejects them with max_credits_required plus a recommended cap. Surface
-// that as a one-line stderr hint so users don't have to dig the value out of the
-// JSON envelope (stderr keeps --json stdout machine-clean).
+// Paid live runs are refused server-side with typed spend-gate errors
+// (max_credits_required, approval_required, spend_cap_required,
+// spend_cap_too_low). Surface each as a one-line stderr hint with the concrete
+// re-run flags so users don't have to dig values out of the JSON envelope
+// (stderr keeps --json stdout machine-clean).
 function writeMaxCreditsHint(error) {
-    if (!(error instanceof OxygenError) || error.code !== "max_credits_required")
+    if (!(error instanceof OxygenError))
         return;
-    const recommended = readRecommendedMaxCredits(error.details);
-    if (recommended === null)
-        return;
-    process.stderr.write(`hint: re-run with --max-credits ${recommended} to approve the spend cap\n`);
+    switch (error.code) {
+        case "max_credits_required": {
+            const recommended = readDetailsNumber(error.details, "recommended_max_credits");
+            if (recommended === null)
+                return;
+            process.stderr.write(`hint: re-run with --max-credits ${recommended} to approve the spend cap\n`);
+            return;
+        }
+        case "approval_required": {
+            const estimated = readDetailsNumber(error.details, "estimated_credits");
+            process.stderr.write(`hint: inspect the dry run, then re-run with --approved --max-credits <n>${estimated !== null ? ` (estimated ~${estimated} credits)` : ""}\n`);
+            return;
+        }
+        case "spend_cap_required": {
+            const estimated = readDetailsNumber(error.details, "estimated_credits");
+            process.stderr.write(`hint: re-run with --max-credits ${estimated !== null ? estimated : "<n>"} to cap the spend\n`);
+            return;
+        }
+        case "spend_cap_too_low": {
+            const estimated = readDetailsNumber(error.details, "estimated_credits")
+                ?? readDetailsNumber(error.details, "estimated_max_credits");
+            if (estimated === null)
+                return;
+            process.stderr.write(`hint: the estimate is ${estimated} credits; re-run with --max-credits ${estimated} or higher\n`);
+            return;
+        }
+        default:
+    }
 }
-function readRecommendedMaxCredits(details) {
+function readDetailsNumber(details, key) {
     if (!details || typeof details !== "object" || Array.isArray(details))
         return null;
-    const value = details.recommended_max_credits;
+    const value = details[key];
     return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
 function parseJsonObject(value) {
@@ -429,13 +454,26 @@ export function createProgram() {
     }));
     program
         .command("status")
-        .description("Compare the local Oxygen CLI version against what's deployed in prod.")
+        .description("Compare the local Oxygen CLI version against the active profile's deployed Oxygen API.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("status", options, async () => {
-            const server = await requestOxygen("/api/health", { requireAuth: false, enforceMinimumCliVersion: false });
+            // Resolve the API URL exactly like authenticated commands do: the
+            // active profile (honoring --profile / OXYGEN_PROFILE / OXYGEN_API_URL
+            // overrides), falling back to the default prod URL only when no
+            // credentials are stored. Without this, requestOxygen's
+            // requireAuth:false path skips loadCredentials() and always hits prod,
+            // so `status` reports a different deployment than every other command.
+            const credentials = await loadCredentials();
+            const apiUrl = credentials?.apiUrl ?? defaultApiUrl();
+            const server = await requestOxygen("/api/health", {
+                credentials: credentials ?? { token: "", apiUrl },
+                requireAuth: false,
+                enforceMinimumCliVersion: false,
+            });
             return {
                 client_version: OXYGEN_VERSION,
+                api_url: apiUrl,
                 server_version: server.server_version,
                 minimum_cli_version: server.minimum_cli_version ?? null,
                 sha: server.sha,
@@ -3062,8 +3100,11 @@ export function createProgram() {
         .option("--return <mode>", "Legacy response shape: raw, compact, or summary. Defaults to raw.")
         .option("--return-mode <mode>", "Response shape: raw, compact, or summary. Prefer summary for large search responses.")
         .option("--oxygen-cursor <cursor>", "Short Oxygen cursor returned as oxygen_next_cursor by a previous tool run.")
+        .option("--max-credits <n>", "Required credit ceiling for live runs of paid tools.")
+        .option("--approved", "Required for live runs of paid tools after inspecting dry-run output.")
         .option("--json", "Print a JSON envelope.")
         .action(async (toolId, options) => {
+        const maxCredits = readPositiveNumber(options.maxCredits);
         await handleAsyncAction("tools run", options, () => requestOxygen("/api/cli/tools/run", {
             method: "POST",
             body: {
@@ -3078,6 +3119,8 @@ export function createProgram() {
                 ...(readOption(options["return"]) ? { return: readOption(options["return"]) } : {}),
                 ...(readOption(options.returnMode) ? { return_mode: readOption(options.returnMode) } : {}),
                 ...(readOption(options.oxygenCursor) ? { oxygen_cursor: readOption(options.oxygenCursor) } : {}),
+                ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                ...(options.approved ? { approved: true } : {}),
             },
         }));
     }));
@@ -3460,10 +3503,11 @@ export function createProgram() {
         });
     }))));
     program.addCommand(new Command("inbox")
-        .description("LinkedIn unified inbox (unibox): scan conversations across all sender accounts, read threads, and reply.")
+        .description("Unified inbox (unibox): LinkedIn conversations and (--channel email) the fleet's email conversations synced from Zapmail Zapbox. Scan, read threads, and reply.")
         .addCommand(new Command("list")
-        .description("List LinkedIn conversations across all connected accounts, newest first.")
-        .option("--account <id>", "Filter to one sender account (sender id, connection id, or Unipile account id).")
+        .description("List conversations across all connected accounts, newest first. --channel email lists the Zapbox-synced email inbox.")
+        .option("--channel <channel>", "Inbox channel: linkedin (default) or email.")
+        .option("--account <id>", "LinkedIn only: filter to one sender account (sender id, connection id, or Unipile account id).")
         .option("--unread", "Only show conversations with unread messages.")
         .option("--search <text>", "Filter by attendee name or last-message text.")
         .option("--include-archived", "Include archived conversations.")
@@ -3472,6 +3516,9 @@ export function createProgram() {
         .action(async (options) => {
         await handleAsyncAction("inbox list", options, () => {
             const params = new URLSearchParams();
+            const channel = readOption(options.channel);
+            if (channel)
+                params.set("channel", channel);
             const account = readOption(options.account);
             if (account)
                 params.set("account", account);
@@ -3490,13 +3537,17 @@ export function createProgram() {
         });
     }))
         .addCommand(new Command("get")
-        .description("Get one conversation with its full message thread. <conversation> accepts a conversation id or Unipile chat id.")
-        .argument("<conversation>", "Conversation id or Unipile chat id.")
+        .description("Get one conversation with its full message thread. <conversation> accepts a conversation id, Unipile chat id, or (email) Zapbox thread id.")
+        .argument("<conversation>", "Conversation id, Unipile chat id, or Zapbox thread id.")
+        .option("--channel <channel>", "Inbox channel: linkedin (default) or email.")
         .option("--message-limit <n>", "Maximum messages to return (1-500). Defaults to 100.")
         .option("--json", "Print a JSON envelope.")
         .action(async (conversation, options) => {
         await handleAsyncAction("inbox get", options, () => {
             const params = new URLSearchParams();
+            const channel = readOption(options.channel);
+            if (channel)
+                params.set("channel", channel);
             const messageLimit = readOption(options.messageLimit);
             if (messageLimit)
                 params.set("message_limit", messageLimit);
@@ -3530,12 +3581,16 @@ export function createProgram() {
     }))
         .addCommand(new Command("sync")
         .description("Force a backstop inbox sync from Unipile for all active sender accounts (pulls recent chats + messages into the unibox).")
+        .option("--account <id>", "Force-sync one sender account (sender id, connection id, or Unipile account id).")
         .option("--chat-limit <n>", "Maximum chats to sync per account. Defaults to 30.")
         .option("--message-limit <n>", "Maximum messages to sync per chat. Defaults to 20.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("inbox sync", options, () => {
             const body = {};
+            const account = readOption(options.account);
+            if (account)
+                body.account = account;
             const chatLimit = readOption(options.chatLimit);
             if (chatLimit)
                 body.chat_limit = Number(chatLimit);
@@ -3774,6 +3829,35 @@ export function createProgram() {
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences stats", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/stats`));
     })));
+    program.addCommand(new Command("email")
+        .description("Ad-hoc email from the org's sending fleet: one-off sends with no sequence, enrollment, or contact sync. Zapbox-connected mailboxes send through Zapmail's API (no Google/Microsoft consent); BYOK — 0 Oxygen credits.")
+        .addCommand(new Command("send")
+        .description("Send ONE email right now. Without --approved, returns a preview naming the exact mailbox + transport. --from pins a mailbox; otherwise the pool's LRU rotation picks one.")
+        .requiredOption("--to <email>", "Recipient email address (exactly one).")
+        .requiredOption("--subject <text>", "Subject line.")
+        .option("--body <text>", "Plain-text body (sent verbatim, no templating).")
+        .option("--body-file <path>", "Read the body from a file instead of --body.")
+        .option("--from <mailbox>", "Sending mailbox (address or id). Defaults to the pool rotation.")
+        .option("--approved", "Approve and send. Without this flag, returns a preview only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("email send", options, async () => {
+            const bodyText = readOption(options.body) ?? (options.bodyFile ? readFileSync(resolve(options.bodyFile), "utf8") : undefined);
+            if (!bodyText || !bodyText.trim()) {
+                throw new Error("Provide --body or --body-file.");
+            }
+            return requestOxygen("/api/cli/email/send", {
+                method: "POST",
+                body: {
+                    to: readOption(options.to),
+                    subject: readOption(options.subject),
+                    body: bodyText,
+                    ...(readOption(options.from) ? { from: readOption(options.from) } : {}),
+                    ...(options.approved ? { approved: true } : {}),
+                },
+            });
+        });
+    })));
     program.addCommand(new Command("mailboxes")
         .description("Native email sending pool: register/refresh Google/Microsoft mailboxes a campaign rotates over, pause/disable inboxes, and delegate warmup to Instantly (BYOK — Instantly bills your account, 0 Oxygen credits).")
         .addCommand(new Command("list")
@@ -3795,18 +3879,26 @@ export function createProgram() {
         .option("--file <path>", "Path to a JSON file: { \"mailboxes\": [{ email_address, provider, workspace_external_id? }] }.")
         .option("--from <source>", "Import source: 'zapmail' to pull the connected Zapmail workspace's mailboxes.")
         .option("--connection <id>", "Zapmail connection id (--from zapmail). Defaults to the org's active Zapmail connection.")
+        .option("--provider <provider>", "Zapmail pool to pull (--from zapmail): google or microsoft. Zapmail's mailbox list is provider-scoped, so the Microsoft pool is only reachable with --provider microsoft; Microsoft mailboxes get their Entra tenant id stamped on import.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("mailboxes import", options, () => {
             const from = readOption(options.from);
             const filePath = readOption(options.file);
             const connection = readOption(options.connection);
+            const provider = readOption(options.provider);
             if (from === "zapmail") {
                 return requestOxygen("/api/cli/mailboxes", {
                     method: "POST",
-                    body: { source: "zapmail", ...(connection ? { connection_id: connection } : {}) },
+                    body: {
+                        source: "zapmail",
+                        ...(connection ? { connection_id: connection } : {}),
+                        ...(provider ? { service_provider: provider } : {}),
+                    },
                 });
             }
+            if (provider)
+                throw new Error("--provider only applies with --from zapmail (inline files carry a per-mailbox provider).");
             if (!filePath)
                 throw new Error("Provide --file <path> (a { \"mailboxes\": [...] } JSON file) or --from zapmail.");
             const parsed = JSON.parse(readFileSync(resolve(filePath), "utf8"));
@@ -4064,9 +4156,12 @@ export function createProgram() {
         .option("--input-json <json>", "Workflow input object. Defaults to {}.")
         .requiredOption("--mode <mode>", "Execution mode: live, dry-run, or smoke-test.")
         .option("--idempotency-key <key>", "Optional idempotency key.")
+        .option("--max-credits <n>", "Required credit ceiling for live calls.")
+        .option("--approved", "Required for live calls after inspecting a dry run.")
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
         .action(async (workflowArg, options) => {
+        const maxCredits = readPositiveNumber(options.maxCredits);
         await handleAsyncAction("workflows call", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/call", {
             method: "POST",
             body: {
@@ -4076,6 +4171,8 @@ export function createProgram() {
                 input: options.inputJson ? parseJsonObject(options.inputJson) : {},
                 ...(readOption(options.mode) ? { mode: readOption(options.mode) } : {}),
                 ...(readOption(options.idempotencyKey) ? { idempotency_key: readOption(options.idempotencyKey) } : {}),
+                ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                ...(options.approved ? { approved: true } : {}),
             },
         }), options));
     }))

package/node_modules/@oxygen/recipe-sdk/dist/index.d.ts

@@ -105,7 +105,6 @@ export type RecipeContext = {
 };
 export type DurableRecipeContext = RecipeContext;
 export type RecipeRunFunction = (ctx: RecipeContext) => unknown | Promise<unknown>;
-export type DurableRecipeRunFunction = RecipeRunFunction;
 export type RecipeVisualBaseStep = {
     id: string;
     label: string;
@@ -155,10 +154,6 @@ export type DefineRecipeInput = {
     visualPlan?: RecipeVisualPlan;
     run: RecipeRunFunction;
 };
-export type DurableRecipeDefinition = RecipeDefinition;
-export type DefineDurableRecipeInput = DefineRecipeInput & {
-    runtime: "durable";
-};
 export declare function defineRecipe(input: DefineRecipeInput): RecipeDefinition;
 export declare function isRecipeDefinition(value: unknown): value is RecipeDefinition;
 export declare function recipeVisualPlan(steps: RecipeVisualStep[]): RecipeVisualPlan;

package/node_modules/@oxygen/shared/dist/cli-envelope.d.ts

@@ -0,0 +1,27 @@
+import type { CliResult } from "./index.js";
+/** Server compatibility metadata extracted from a `CliResult.meta` envelope. */
+export type ServerCompatibility = {
+    version?: string;
+    minimumCliVersion?: string;
+};
+/**
+ * Type guard for the shared `CliResult` envelope. Accepts `{ ok: true, data }`
+ * and `{ ok: false, error: {...} }`; rejects anything else (non-objects,
+ * arrays, missing discriminant, malformed error).
+ */
+export declare function isCliResult<T>(value: unknown): value is CliResult<T>;
+/**
+ * Read the server version and minimum-CLI floor out of a `CliResult.meta`
+ * block. Missing or malformed metadata yields an empty object so callers can
+ * treat "no compatibility info" uniformly.
+ */
+export declare function readEnvelopeCompatibility(envelope: CliResult<unknown>): ServerCompatibility;
+export declare function withRetryAfterDetails(details: unknown, response: Response): unknown;
+/**
+ * Header fragment that lets automated clients reach a password-protected Vercel
+ * preview deployment. Returns `{ "x-vercel-protection-bypass": <secret> }` only
+ * when `VERCEL_AUTOMATION_BYPASS_SECRET` is set and the API URL targets a
+ * `*.vercel.app` host; otherwise an empty object. Callers spread the result
+ * into their request headers, so a non-preview URL is a no-op.
+ */
+export declare function vercelProtectionBypassHeaders(apiUrl: string): Record<string, string>;

package/node_modules/@oxygen/shared/dist/cli-envelope.js

@@ -0,0 +1,102 @@
+// Shared mechanics for the Oxygen CLI-result envelope that both the CLI HTTP
+// client (`packages/cli/src/http-client.ts`) and the MCP API client
+// (`packages/mcp-server/src/api-client.ts`) consume. These are pure functions —
+// no runtime imports from runtime-specific modules — so each client keeps its
+// own error class (`OxygenError` vs `OxygenApiError`) and surface-specific
+// guidance while sharing the parsing/extraction logic that previously drifted
+// after being copy-pasted between the two clients.
+/**
+ * Type guard for the shared `CliResult` envelope. Accepts `{ ok: true, data }`
+ * and `{ ok: false, error: {...} }`; rejects anything else (non-objects,
+ * arrays, missing discriminant, malformed error).
+ */
+export function isCliResult(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const ok = value.ok;
+    if (ok === true)
+        return "data" in value;
+    if (ok !== false)
+        return false;
+    const error = value.error;
+    return Boolean(error) && typeof error === "object" && !Array.isArray(error);
+}
+/**
+ * Read the server version and minimum-CLI floor out of a `CliResult.meta`
+ * block. Missing or malformed metadata yields an empty object so callers can
+ * treat "no compatibility info" uniformly.
+ */
+export function readEnvelopeCompatibility(envelope) {
+    const meta = envelope.meta;
+    if (!meta || typeof meta !== "object" || Array.isArray(meta))
+        return {};
+    const record = meta;
+    const compatibility = {};
+    if (typeof record.version === "string")
+        compatibility.version = record.version;
+    if (typeof record.minimum_cli_version === "string") {
+        compatibility.minimumCliVersion = record.minimum_cli_version;
+    }
+    return compatibility;
+}
+// Surface the server's 429 backoff as a first-class `retry_after_seconds` detail
+// so loop-driving callers can wait the right amount of time instead of dead-
+// reckoning. Prefers a value the API already put in details; otherwise derives
+// it from the RFC 6585 Retry-After header (or reset_at). Non-429 responses and
+// unparseable values pass through untouched.
+export function withRetryAfterDetails(details, response) {
+    if (response.status !== 429)
+        return details;
+    const record = details && typeof details === "object" && !Array.isArray(details)
+        ? details
+        : null;
+    if (record && typeof record.retry_after_seconds === "number")
+        return details;
+    const retryAfterSeconds = retryAfterSecondsFromResponse(response, record);
+    if (retryAfterSeconds === null)
+        return details;
+    if (record)
+        return { ...record, retry_after_seconds: retryAfterSeconds };
+    if (details === undefined)
+        return { retry_after_seconds: retryAfterSeconds };
+    return { details, retry_after_seconds: retryAfterSeconds };
+}
+function retryAfterSecondsFromResponse(response, details) {
+    const header = response.headers.get("retry-after");
+    if (header) {
+        const seconds = Number(header);
+        if (Number.isFinite(seconds) && seconds >= 0)
+            return Math.ceil(seconds);
+    }
+    const resetAt = details?.reset_at;
+    if (typeof resetAt === "string") {
+        const resetMs = Date.parse(resetAt);
+        if (!Number.isNaN(resetMs))
+            return Math.max(0, Math.ceil((resetMs - Date.now()) / 1000));
+    }
+    return null;
+}
+const VERCEL_PROTECTION_BYPASS_HEADER = "x-vercel-protection-bypass";
+/**
+ * Header fragment that lets automated clients reach a password-protected Vercel
+ * preview deployment. Returns `{ "x-vercel-protection-bypass": <secret> }` only
+ * when `VERCEL_AUTOMATION_BYPASS_SECRET` is set and the API URL targets a
+ * `*.vercel.app` host; otherwise an empty object. Callers spread the result
+ * into their request headers, so a non-preview URL is a no-op.
+ */
+export function vercelProtectionBypassHeaders(apiUrl) {
+    const secret = process.env.VERCEL_AUTOMATION_BYPASS_SECRET?.trim();
+    if (!secret)
+        return {};
+    let hostname;
+    try {
+        hostname = new URL(apiUrl).hostname;
+    }
+    catch {
+        return {};
+    }
+    if (hostname === "vercel.app" || hostname.endsWith(".vercel.app")) {
+        return { [VERCEL_PROTECTION_BYPASS_HEADER]: secret };
+    }
+    return {};
+}

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -2,6 +2,7 @@ export { OXYGEN_MINIMUM_CLI_VERSION, OXYGEN_VERSION } from "./version.js";
 export { WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS, clearWorkflowTriggerAutoPauseMetadata, } from "./workflow-trigger-metadata.js";
 export * from "./billing.js";
 export * from "./cell-format.js";
+export * from "./cli-envelope.js";
 export * from "./column-types.js";
 export * from "./credit-guidance.js";
 export * from "./linkedin-sequences.js";

package/node_modules/@oxygen/shared/dist/index.js

@@ -3,6 +3,7 @@ export { OXYGEN_MINIMUM_CLI_VERSION, OXYGEN_VERSION } from "./version.js";
 export { WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS, clearWorkflowTriggerAutoPauseMetadata, } from "./workflow-trigger-metadata.js";
 export * from "./billing.js";
 export * from "./cell-format.js";
+export * from "./cli-envelope.js";
 export * from "./column-types.js";
 export * from "./credit-guidance.js";
 export * from "./linkedin-sequences.js";

package/node_modules/@oxygen/shared/dist/redaction.js

@@ -1,5 +1,29 @@
 const SECRET_KEY_PATTERN = /(api[_-]?key|x[_-]?key|authorization|bearer|cookie|password|secret|token|ciphertext|connection[_-]?string|connection[_-]?uri|database[_-]?url|dsn)/i;
 const OMITTED_KEY_PATTERN = /^(body|payload|prompt|prompts|raw_prompt|raw_prompts|row|rows|input|inputs|output|outputs|request|response|provider_payload|provider_response|customer_data)$/i;
+// OXY-125: keyed redaction (SECRET_KEY_PATTERN) only catches whole fields named
+// like a secret. Credentials also leak as *substrings* of otherwise-ordinary
+// fields — most commonly an Authorization header dumped into error_message /
+// error_stack. This matches the HTTP bearer scheme followed by its token (JWT /
+// base64 / opaque, including our `oxy_live_`/`oxy_sess_` prefixes) anywhere in a
+// string.
+const BEARER_TOKEN_PATTERN = /\bBearer\s+[\w.~+/=-]+/gi;
+// OXY-139: the prod log-hygiene sweep also flags `sk-…` API keys and DB
+// connection URLs that ride along inside ordinary (non-secret-named) fields, so
+// keyed + Bearer redaction is not enough. We scrub the two shapes that carry real
+// secret *material* as substrings of any value:
+//   • DB URLs — the whole `postgres(ql)://…` (incl. scheme) so the marker cannot
+//     re-trip the sweep's `postgres://[^ ]+` clause.
+//   • `sk-…` keys — body allowed to contain `_`/`-` and no word boundary, matching
+//     the sweep regex byte-for-byte. This also neutralises the OXY-139 false
+//     positive: a Vercel `x-vercel-id` whose first segment ends in `sk`
+//     (e.g. `2g5sk-1781047899561-…`, logged as request_id on every cron summary
+//     line) is not a credential but is sweep-shaped, so it must be redacted to
+//     clear the signal; trace_id stays intact as the correlation key.
+// The bare `OPENAI_API_KEY` *name* is deliberately NOT scrubbed — it is a variable
+// name, not a secret, and hiding it would suppress legitimate "OPENAI_API_KEY is
+// missing" diagnostics (its actual value is an `sk-…` string, already covered).
+const DB_URL_PATTERN = /(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s"'<>()]+/gi;
+const SK_TOKEN_PATTERN = /sk-[A-Za-z0-9_-]{20,}/g;
 const MAX_LOG_STRING_LENGTH = 8_000;
 const MAX_TELEMETRY_STRING_LENGTH = 500;
 const MAX_ARRAY_LENGTH = 20;
@@ -36,7 +60,7 @@ function sanitizeValueForLog(value, key, depth) {
     if (value === null || value === undefined)
         return value;
     if (typeof value === "string")
-        return truncateString(value, MAX_LOG_STRING_LENGTH);
+        return truncateString(redactSecretsInString(value), MAX_LOG_STRING_LENGTH);
     if (typeof value === "number")
         return Number.isFinite(value) ? value : null;
     if (typeof value === "boolean")
@@ -67,7 +91,7 @@ function normalizeTelemetryValue(value, key) {
     if (OMITTED_KEY_PATTERN.test(key))
         return "[omitted]";
     if (typeof value === "string")
-        return truncateString(value, MAX_TELEMETRY_STRING_LENGTH);
+        return truncateString(redactSecretsInString(value), MAX_TELEMETRY_STRING_LENGTH);
     if (typeof value === "number")
         return Number.isFinite(value) ? value : undefined;
     if (typeof value === "boolean")
@@ -80,8 +104,12 @@ function normalizeTelemetryValue(value, key) {
             .filter((entry) => typeof entry === "string" || typeof entry === "number" || typeof entry === "boolean");
         if (primitive.length === 0)
             return undefined;
+        // Array elements need the same substring scrub as scalar strings: a string[]
+        // attribute (e.g. dumped header lines) carries the same Bearer/sk-/DB-URL
+        // material, and this branch was the one telemetry path that exported it
+        // verbatim. Redact before truncating so a cut cannot expose token material.
         if (primitive.every((entry) => typeof entry === "string")) {
-            return primitive.map((entry) => truncateString(String(entry), MAX_TELEMETRY_STRING_LENGTH));
+            return primitive.map((entry) => truncateString(redactSecretsInString(entry), MAX_TELEMETRY_STRING_LENGTH));
         }
         if (primitive.every((entry) => typeof entry === "number" && Number.isFinite(entry))) {
             return primitive;
@@ -89,7 +117,7 @@ function normalizeTelemetryValue(value, key) {
         if (primitive.every((entry) => typeof entry === "boolean")) {
             return primitive;
         }
-        return primitive.map((entry) => truncateString(String(entry), MAX_TELEMETRY_STRING_LENGTH));
+        return primitive.map((entry) => truncateString(redactSecretsInString(String(entry)), MAX_TELEMETRY_STRING_LENGTH));
     }
     if (typeof value === "object" && value) {
         return truncateString(JSON.stringify(sanitizeValueForLog(value, key, 0)), MAX_TELEMETRY_STRING_LENGTH);
@@ -100,6 +128,19 @@ function sanitizeAttributeKey(key) {
     const normalized = key.trim().replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 120);
     return normalized || null;
 }
+// Replaces credential-shaped substrings with token-free markers. Order matters:
+// Bearer first so an `Authorization: Bearer sk-…` header collapses to a single
+// `Bearer[REDACTED]` instead of leaving a stray `Bearer ` (the sweep matches
+// `Bearer ` with a trailing space). Each marker is chosen so a second pass — and
+// every prod-sweep regex (`Bearer `, `sk-…`, `postgres://…`) — finds nothing, so
+// redaction stays idempotent. Sharing the global regexes is safe because
+// String.replace resets their lastIndex between calls.
+function redactSecretsInString(value) {
+    return value
+        .replace(BEARER_TOKEN_PATTERN, "Bearer[REDACTED]")
+        .replace(DB_URL_PATTERN, "[REDACTED_DB_URL]")
+        .replace(SK_TOKEN_PATTERN, "[REDACTED_SK]");
+}
 function truncateString(value, maxLength) {
     return value.length > maxLength ? `${value.slice(0, maxLength)}...` : value;
 }

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const OXYGEN_VERSION = "1.162.10";
+export declare const OXYGEN_VERSION = "1.164.30";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.154.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.162.10";
+export const OXYGEN_VERSION = "1.164.30";
 // Bump this only when deployed CLI/API contracts require a newer CLI.
 // 1.154.0: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
 // (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -9,7 +9,6 @@ export declare const DEFAULT_WORKFLOW_CRON_TIMEZONE = "UTC";
 export type WorkflowMode = "dry_run" | "live" | "smoke_test";
 export type WorkflowTriggerType = "api" | "webhook" | "cron" | "event";
 export type WorkflowStatus = "active" | "disabled";
-export type WorkflowStepKind = "transform" | "tool" | "branch";
 export type WorkflowStepEffect = "none" | "external_read" | "external_write";
 export type RecipeRuntime = "durable";
 export type WorkflowEventFilterOp = "eq" | "neq" | "exists" | "not_exists";
@@ -211,16 +210,6 @@ export type Blueprint = {
     source_hash: string;
     compiler_version: typeof BLUEPRINT_COMPILER_VERSION;
 };
-export type WorkflowApplyInput = {
-    manifest: WorkflowManifest;
-};
-export type WorkflowCallInput = {
-    workflow_id?: string;
-    workflow_name?: string;
-    input?: Record<string, unknown>;
-    mode: WorkflowMode;
-    idempotency_key?: string;
-};
 type WorkflowFunction = (context: Record<string, unknown>) => unknown | Promise<unknown>;
 export type WorkflowDefinition = {
     readonly __oxygen_workflow_definition: true;
@@ -815,4 +804,16 @@ export declare function getWorkflowSchema(subject?: "apply" | "call" | "event" |
         };
     };
 };
+export declare const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
+export declare function readWorkflowRunMaxCredits(metadata: Record<string, unknown> | null | undefined): number | null;
+export declare function readManagedToolRunCredits(output: unknown): number;
+export type WorkflowSpendCapDecision = {
+    allowed: boolean;
+    projectedCredits: number;
+};
+export declare function evaluateWorkflowRunSpendCap(input: {
+    maxCredits: number;
+    creditsUsed: number;
+    estimatedCredits?: number | null;
+}): WorkflowSpendCapDecision;
 export {};

package/node_modules/@oxygen/workflows/dist/index.js

@@ -1393,6 +1393,64 @@ function isRecord(value) {
 function isNonEmptyString(value) {
     return typeof value === "string" && value.trim().length > 0;
 }
+// --- Workflow run spend cap (max_credits) -------------------------------
+// Live `workflows call` requests carry an approved max_credits spend cap in
+// the run's metadata (R-E.22(c)). These pure helpers are the single source of
+// truth for reading that cap and deciding whether the next paid tool step may
+// run; the worker's step loop and the durable-recipe runtime wrap the refusal
+// in an OxygenError with this code so the stop is visible as run/step state.
+export const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
+// Matches the soft-ceiling epsilon used by table action runs so float drift
+// never refuses a run that is exactly at its cap.
+const WORKFLOW_SPEND_CAP_EPSILON = 0.000001;
+export function readWorkflowRunMaxCredits(metadata) {
+    if (!isRecord(metadata))
+        return null;
+    const raw = metadata.max_credits ?? metadata.maxCredits;
+    const parsed = typeof raw === "number"
+        ? raw
+        : typeof raw === "string" && raw.trim()
+            ? Number(raw)
+            : Number.NaN;
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return null;
+    return parsed;
+}
+// Managed tool runs attach `meta.billing` with the credits the run charged
+// (`managed_credit_estimate` is reserved and captured in full). BYOK and
+// user-connection runs consume no OXYGEN credits, so they never count
+// against the cap.
+export function readManagedToolRunCredits(output) {
+    if (!isRecord(output))
+        return 0;
+    const meta = output.meta;
+    if (!isRecord(meta))
+        return 0;
+    const billing = meta.billing;
+    if (!isRecord(billing))
+        return 0;
+    if (billing.credential_mode !== "managed")
+        return 0;
+    const credits = billing.managed_credit_estimate;
+    if (typeof credits !== "number" || !Number.isFinite(credits) || credits <= 0)
+        return 0;
+    return credits;
+}
+// `estimatedCredits` is null when the next tool has no managed-credit price
+// (free, BYOK, or unknown catalog entry): such a step is only refused when
+// the cap is already breached, never pre-emptively.
+export function evaluateWorkflowRunSpendCap(input) {
+    const estimated = typeof input.estimatedCredits === "number"
+        && Number.isFinite(input.estimatedCredits)
+        && input.estimatedCredits > 0
+        ? input.estimatedCredits
+        : 0;
+    const projectedCredits = input.creditsUsed + estimated;
+    return {
+        allowed: projectedCredits <= input.maxCredits + WORKFLOW_SPEND_CAP_EPSILON,
+        projectedCredits,
+    };
+}
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.162.10",
+  "version": "1.164.30",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",