@oxygen-agent/cli 1.162.10 → 1.177.0

package/node_modules/@oxygen/shared/dist/telemetry.js

@@ -5,6 +5,8 @@ import { redactSqlParameters, sqlErrorTelemetryAttributes } from "./sql-error.js
 import { OXYGEN_VERSION } from "./version.js";
 const counterCache = new Map();
 const histogramCache = new Map();
+// skipcq: JS-0116 — `async` keeps synchronous setup throws (getTracer / attribute
+// normalization) as rejections so the Promise<T> contract holds for all callers.
 export async function withTelemetrySpan(tracerName, name, attributes, fn, options) {
     const tracer = trace.getTracer(tracerName, OXYGEN_VERSION);
     return tracer.startActiveSpan(name, { attributes: normalizeTelemetryAttributes(commonTelemetryAttributes(attributes)) }, async (span) => {
@@ -51,12 +53,6 @@ export function markActiveTelemetryError(message, attributes) {
         span.setAttributes(normalizeTelemetryAttributes(attributes));
     }
 }
-export function addTelemetryEvent(name, attributes) {
-    const span = trace.getActiveSpan();
-    if (!span)
-        return;
-    span.addEvent(name, normalizeTelemetryAttributes(attributes));
-}
 export function recordTelemetryCounter(name, value = 1, attributes) {
     if (!Number.isFinite(value))
         return;
@@ -71,28 +67,37 @@ export function recordTelemetryHistogram(name, value, attributes) {
 }
 export function commonTelemetryAttributes(attributes) {
     const workerProcess = isWorkerProcess();
+    // Each attribute reads an ordered env-var fallback chain that differs by
+    // surface: the worker prefers its Fly vars first, the web its Vercel vars.
+    // pickEnvBySurface picks the surface's list, then the first defined value.
+    const pick = (workerKeys, webKeys) => pickEnvBySurface(workerProcess, workerKeys, webKeys);
     return {
         "oxygen.version": OXYGEN_VERSION,
-        "deployment.environment": workerProcess
-            ? process.env.FLY_ENVIRONMENT ?? process.env.NODE_ENV ?? null
-            : process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? null,
+        "deployment.environment": pick(["FLY_ENVIRONMENT", "NODE_ENV"], ["VERCEL_ENV", "NODE_ENV"]),
         // deployment.sha stays the deploy artifact id: the Fly registry image ref on
         // the worker (release cross-reference), VERCEL_GIT_COMMIT_SHA on the web. The
         // worker's image ref is NOT a git commit, so deployment.git_sha carries the
         // resolved commit separately and is the single field that means "the commit"
         // on both surfaces (OXY-61). On the web both happen to equal the Vercel SHA.
-        "deployment.sha": workerProcess
-            ? process.env.FLY_IMAGE_REF ?? process.env.VERCEL_GIT_COMMIT_SHA ?? null
-            : process.env.VERCEL_GIT_COMMIT_SHA ?? process.env.FLY_IMAGE_REF ?? null,
-        "deployment.git_sha": workerProcess
-            ? process.env.OXYGEN_GIT_SHA ?? process.env.VERCEL_GIT_COMMIT_SHA ?? null
-            : process.env.VERCEL_GIT_COMMIT_SHA ?? process.env.OXYGEN_GIT_SHA ?? null,
-        "cloud.region": workerProcess
-            ? process.env.FLY_REGION ?? process.env.VERCEL_REGION ?? null
-            : process.env.VERCEL_REGION ?? process.env.FLY_REGION ?? null,
+        "deployment.sha": pick(["FLY_IMAGE_REF", "VERCEL_GIT_COMMIT_SHA"], ["VERCEL_GIT_COMMIT_SHA", "FLY_IMAGE_REF"]),
+        "deployment.git_sha": pick(["OXYGEN_GIT_SHA", "VERCEL_GIT_COMMIT_SHA"], ["VERCEL_GIT_COMMIT_SHA", "OXYGEN_GIT_SHA"]),
+        "cloud.region": pick(["FLY_REGION", "VERCEL_REGION"], ["VERCEL_REGION", "FLY_REGION"]),
         ...attributes,
     };
 }
+// Picks the env-var fallback list for the active surface (worker vs web), then
+// returns the first env var in that list that is set, else null. Preserves the
+// original `a ?? b ?? null` semantics exactly: only an unset (`undefined`) env
+// var falls through to the next key — an explicit empty string is kept.
+function pickEnvBySurface(workerProcess, workerKeys, webKeys) {
+    const keys = workerProcess ? workerKeys : webKeys;
+    for (const key of keys) {
+        const value = process.env[key];
+        if (value !== undefined)
+            return value;
+    }
+    return null;
+}
 function isWorkerProcess() {
     if (process.env.OXYGEN_PROCESS_ROLE === "worker")
         return true;

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const OXYGEN_VERSION = "1.162.10";
+export declare const OXYGEN_VERSION = "1.177.0";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.154.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.162.10";
+export const OXYGEN_VERSION = "1.177.0";
 // Bump this only when deployed CLI/API contracts require a newer CLI.
 // 1.154.0: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
 // (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and

package/node_modules/@oxygen/shared/dist/worker-failures-queue.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Canonical queue selector for the worker-failures surface, shared by:
+ *  - CLI `oxygen worker failures --queue <queue>` (free-text, passed through),
+ *  - MCP `oxygen_worker_failures({ queue })` (enum-constrained), and
+ *  - the `/api/cli/worker/failures` route that actually parses the value.
+ *
+ * Single-sourced so a token documented by one surface can never silently fall
+ * back to the `all` aggregate on another — the exact drift OXY-337 fixed, where
+ * the CLI documented `postgres_jobs` but the route only accepted `postgres_queue`.
+ */
+/**
+ * Public, documented queue tokens in display order. `postgres_queue` is the
+ * canonical name for the Postgres-backed background job queue. The MCP enum is
+ * built from this list so the constraint can never drift from the parser.
+ */
+export declare const WORKER_FAILURES_QUEUE_VALUES: readonly ["all", "actions", "ingestions", "postgres_queue"];
+export type WorkerFailuresQueue = (typeof WORKER_FAILURES_QUEUE_VALUES)[number];
+/**
+ * Normalize a raw `--queue` / `queue` value to its canonical token. Empty,
+ * missing, or unrecognized values resolve to `all` (the aggregate default).
+ */
+export declare function normalizeWorkerFailuresQueue(value: string | null | undefined): WorkerFailuresQueue;

package/node_modules/@oxygen/shared/dist/worker-failures-queue.js

@@ -0,0 +1,56 @@
+/**
+ * Canonical queue selector for the worker-failures surface, shared by:
+ *  - CLI `oxygen worker failures --queue <queue>` (free-text, passed through),
+ *  - MCP `oxygen_worker_failures({ queue })` (enum-constrained), and
+ *  - the `/api/cli/worker/failures` route that actually parses the value.
+ *
+ * Single-sourced so a token documented by one surface can never silently fall
+ * back to the `all` aggregate on another — the exact drift OXY-337 fixed, where
+ * the CLI documented `postgres_jobs` but the route only accepted `postgres_queue`.
+ */
+/**
+ * Public, documented queue tokens in display order. `postgres_queue` is the
+ * canonical name for the Postgres-backed background job queue. The MCP enum is
+ * built from this list so the constraint can never drift from the parser.
+ */
+export const WORKER_FAILURES_QUEUE_VALUES = [
+    "all",
+    "actions",
+    "ingestions",
+    "postgres_queue",
+];
+/**
+ * Every accepted token mapped to its canonical value. Covers the canonical
+ * tokens themselves plus legacy/compat aliases:
+ *  - `postgres_jobs` was the CLI-documented token before this unification.
+ *  - `bullmq` / `redis` / `jobs` predate the Postgres-queue migration.
+ *  - `postgres` / `pg` and the singular `action` / `ingestion` are shorthands.
+ */
+const QUEUE_TOKEN_TO_CANONICAL = {
+    all: "all",
+    action: "actions",
+    actions: "actions",
+    table_actions: "actions",
+    ingestion: "ingestions",
+    ingestions: "ingestions",
+    table_ingestions: "ingestions",
+    postgres: "postgres_queue",
+    postgres_queue: "postgres_queue",
+    postgres_jobs: "postgres_queue",
+    pg: "postgres_queue",
+    bullmq: "postgres_queue",
+    redis: "postgres_queue",
+    jobs: "postgres_queue",
+};
+/**
+ * Normalize a raw `--queue` / `queue` value to its canonical token. Empty,
+ * missing, or unrecognized values resolve to `all` (the aggregate default).
+ */
+export function normalizeWorkerFailuresQueue(value) {
+    if (!value)
+        return "all";
+    const normalized = value.trim().toLowerCase();
+    if (!normalized)
+        return "all";
+    return QUEUE_TOKEN_TO_CANONICAL[normalized] ?? "all";
+}

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -9,7 +9,6 @@ export declare const DEFAULT_WORKFLOW_CRON_TIMEZONE = "UTC";
 export type WorkflowMode = "dry_run" | "live" | "smoke_test";
 export type WorkflowTriggerType = "api" | "webhook" | "cron" | "event";
 export type WorkflowStatus = "active" | "disabled";
-export type WorkflowStepKind = "transform" | "tool" | "branch";
 export type WorkflowStepEffect = "none" | "external_read" | "external_write";
 export type RecipeRuntime = "durable";
 export type WorkflowEventFilterOp = "eq" | "neq" | "exists" | "not_exists";
@@ -211,16 +210,6 @@ export type Blueprint = {
     source_hash: string;
     compiler_version: typeof BLUEPRINT_COMPILER_VERSION;
 };
-export type WorkflowApplyInput = {
-    manifest: WorkflowManifest;
-};
-export type WorkflowCallInput = {
-    workflow_id?: string;
-    workflow_name?: string;
-    input?: Record<string, unknown>;
-    mode: WorkflowMode;
-    idempotency_key?: string;
-};
 type WorkflowFunction = (context: Record<string, unknown>) => unknown | Promise<unknown>;
 export type WorkflowDefinition = {
     readonly __oxygen_workflow_definition: true;
@@ -815,4 +804,16 @@ export declare function getWorkflowSchema(subject?: "apply" | "call" | "event" |
         };
     };
 };
+export declare const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
+export declare function readWorkflowRunMaxCredits(metadata: Record<string, unknown> | null | undefined): number | null;
+export declare function readManagedToolRunCredits(output: unknown): number;
+export type WorkflowSpendCapDecision = {
+    allowed: boolean;
+    projectedCredits: number;
+};
+export declare function evaluateWorkflowRunSpendCap(input: {
+    maxCredits: number;
+    creditsUsed: number;
+    estimatedCredits?: number | null;
+}): WorkflowSpendCapDecision;
 export {};

package/node_modules/@oxygen/workflows/dist/index.js

@@ -1393,6 +1393,64 @@ function isRecord(value) {
 function isNonEmptyString(value) {
     return typeof value === "string" && value.trim().length > 0;
 }
+// --- Workflow run spend cap (max_credits) -------------------------------
+// Live `workflows call` requests carry an approved max_credits spend cap in
+// the run's metadata (R-E.22(c)). These pure helpers are the single source of
+// truth for reading that cap and deciding whether the next paid tool step may
+// run; the worker's step loop and the durable-recipe runtime wrap the refusal
+// in an OxygenError with this code so the stop is visible as run/step state.
+export const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
+// Matches the soft-ceiling epsilon used by table action runs so float drift
+// never refuses a run that is exactly at its cap.
+const WORKFLOW_SPEND_CAP_EPSILON = 0.000001;
+export function readWorkflowRunMaxCredits(metadata) {
+    if (!isRecord(metadata))
+        return null;
+    const raw = metadata.max_credits ?? metadata.maxCredits;
+    const parsed = typeof raw === "number"
+        ? raw
+        : typeof raw === "string" && raw.trim()
+            ? Number(raw)
+            : Number.NaN;
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return null;
+    return parsed;
+}
+// Managed tool runs attach `meta.billing` with the credits the run charged
+// (`managed_credit_estimate` is reserved and captured in full). BYOK and
+// user-connection runs consume no OXYGEN credits, so they never count
+// against the cap.
+export function readManagedToolRunCredits(output) {
+    if (!isRecord(output))
+        return 0;
+    const meta = output.meta;
+    if (!isRecord(meta))
+        return 0;
+    const billing = meta.billing;
+    if (!isRecord(billing))
+        return 0;
+    if (billing.credential_mode !== "managed")
+        return 0;
+    const credits = billing.managed_credit_estimate;
+    if (typeof credits !== "number" || !Number.isFinite(credits) || credits <= 0)
+        return 0;
+    return credits;
+}
+// `estimatedCredits` is null when the next tool has no managed-credit price
+// (free, BYOK, or unknown catalog entry): such a step is only refused when
+// the cap is already breached, never pre-emptively.
+export function evaluateWorkflowRunSpendCap(input) {
+    const estimated = typeof input.estimatedCredits === "number"
+        && Number.isFinite(input.estimatedCredits)
+        && input.estimatedCredits > 0
+        ? input.estimatedCredits
+        : 0;
+    const projectedCredits = input.creditsUsed + estimated;
+    return {
+        allowed: projectedCredits <= input.maxCredits + WORKFLOW_SPEND_CAP_EPSILON,
+        projectedCredits,
+    };
+}
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.162.10",
+  "version": "1.177.0",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",