@oxygen-agent/cli 1.233.8 → 1.244.2

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -58,6 +58,19 @@ export const SEQUENCE_SIGNALS = [
     "web_visit",
     "intent",
 ];
+/**
+ * Email engagement signals that ONLY arrive via the Instantly webhook
+ * (email_opened/email_clicked). Native email sends (Gmail API / Microsoft Graph)
+ * produce no open/click tracking, so a sequence that sends email natively can
+ * never accumulate these — gating a wait_for_signal or signal-branch on them
+ * silently always times out / always takes the else arm. validateSequenceDefinition
+ * rejects that misconfiguration. (email_replied/email_bounced DO arrive natively
+ * via the inbound-message + bounce paths, so they are not listed here.)
+ */
+export const SEQUENCE_NATIVE_UNTRACKED_SIGNALS = ["email_opened", "email_clicked"];
+function isNativeUntrackedSignal(value) {
+    return SEQUENCE_NATIVE_UNTRACKED_SIGNALS.includes(value);
+}
 /** External GTM signals (the non-engagement subset of SEQUENCE_SIGNALS). */
 export const SEQUENCE_EXTERNAL_SIGNALS = [
     "company_hiring",
@@ -228,6 +241,14 @@ export function validateSequenceDefinition(input, options = {}) {
             }
         }
     });
+    // Pass 3: native-email engagement-gate guard. Native email sends produce no
+    // open/click signals (email_opened/email_clicked arrive only from the Instantly
+    // webhook). A sequence that sends email natively — has native email steps
+    // (email_send/email_reply) and is NOT delegated to an Instantly campaign (no
+    // email_enroll/email_move/email_stop steps) — that gates a wait_for_signal or
+    // signal-branch on those signals would silently always time out / always take
+    // the else arm. Reject it at write time so create/update report the dead gate.
+    reportNativeEngagementGates(normalized, issues);
     if (issues.length > 0) {
         throw new OxygenError("invalid_sequence", `Sequence definition is invalid: ${issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`, { details: { issues }, exitCode: 1 });
     }
@@ -248,6 +269,52 @@ export function lintSequenceDefinition(input, options = {}) {
         return [{ path: "steps", message: error instanceof Error ? error.message : "Invalid sequence." }];
     }
 }
+/**
+ * Push an issue for every wait_for_signal / signal-branch that gates on a
+ * natively-untracked engagement signal (email_opened/email_clicked) inside a
+ * sequence that sends email natively. "Native email" = at least one
+ * email_send/email_reply step and NO Instantly-delegated email step
+ * (email_enroll/email_move/email_stop); an Instantly-bound sequence DOES receive
+ * those webhook signals, so it is left alone. Mutates `issues` in place.
+ */
+function reportNativeEngagementGates(steps, issues) {
+    const hasNativeEmail = steps.some((s) => s.kind === "email_send" || s.kind === "email_reply");
+    const hasInstantlyEmail = steps.some((s) => s.kind === "email_enroll" || s.kind === "email_move" || s.kind === "email_stop");
+    if (!hasNativeEmail || hasInstantlyEmail)
+        return;
+    steps.forEach((step, index) => {
+        if (step.kind === "wait_for_signal" && isNativeUntrackedSignal(step.signal)) {
+            issues.push({
+                path: `steps[${index}].signal`,
+                message: `step '${step.id}' waits for '${step.signal}', but this sequence sends email natively (no Instantly binding), which produces no open/click signals — the gate would always time out. Use email_replied/email_bounced, or bind an Instantly campaign to track opens/clicks.`,
+            });
+            return;
+        }
+        if (step.kind === "branch" && typeof step.condition !== "string") {
+            const referenced = new Set();
+            collectConditionSignals(step.condition, referenced);
+            for (const signal of SEQUENCE_NATIVE_UNTRACKED_SIGNALS) {
+                if (referenced.has(signal)) {
+                    issues.push({
+                        path: `steps[${index}].condition`,
+                        message: `step '${step.id}' branches on '${signal}', but this sequence sends email natively (no Instantly binding), which produces no open/click signals — the branch would always take the else arm. Use email_replied/email_bounced, or bind an Instantly campaign to track opens/clicks.`,
+                    });
+                }
+            }
+        }
+    });
+}
+/** Collect every signal name referenced anywhere in a signal-branch condition. */
+function collectConditionSignals(condition, out) {
+    if ("signal" in condition)
+        out.add(condition.signal);
+    else if ("all" in condition)
+        condition.all.forEach((c) => collectConditionSignals(c, out));
+    else if ("any" in condition)
+        condition.any.forEach((c) => collectConditionSignals(c, out));
+    else
+        collectConditionSignals(condition.not, out);
+}
 function collectSteps(input, issues) {
     const record = isRecord(input) ? input : null;
     const steps = record?.steps;
@@ -774,18 +841,13 @@ function normalizeVariants(raw, path, fields, issues) {
     });
     return out.length > 0 ? out : undefined;
 }
-function normalizeSendWindow(raw, path, issues) {
-    if (raw === undefined || raw === null)
-        return undefined;
-    if (!isRecord(raw)) {
-        issues.push({ path, message: "send_window must be an object." });
-        return undefined;
-    }
+function normalizeSendWindowConfiguredTimezone(raw, path, issues) {
     const timezone = typeof raw.timezone === "string" && raw.timezone.trim() ? raw.timezone.trim() : undefined;
     if (!timezone)
         issues.push({ path: `${path}.timezone`, message: "timezone (IANA, e.g. America/New_York) is required." });
-    const start = normalizeHhmm(raw.start, `${path}.start`, issues);
-    const end = normalizeHhmm(raw.end, `${path}.end`, issues);
+    return timezone ?? "UTC";
+}
+function validateSendWindowBounds(start, end, path, issues) {
     // A zero-width window (start === end) is never open — isWithinSendWindow
     // returns false for every instant — so a step carrying it defers
     // (outside_send_window) on every dispatch and the enrollment silently stalls
@@ -794,7 +856,8 @@ function normalizeSendWindow(raw, path, issues) {
     if (start !== undefined && end !== undefined && hhmmToMinutes(start) === hhmmToMinutes(end)) {
         issues.push({ path: `${path}.end`, message: "must differ from start — a zero-width send_window never sends." });
     }
-    const days = normalizeWeekdays(raw.days, `${path}.days`, issues);
+}
+function normalizeSendWindowTimezoneMode(raw, path, issues) {
     const mode = raw.timezone_mode === "recipient" ? "recipient" : "fixed";
     const column = mode === "recipient"
         ? optionalString(raw.recipient_timezone_column, `${path}.recipient_timezone_column`, issues)
@@ -802,8 +865,23 @@ function normalizeSendWindow(raw, path, issues) {
     if (mode === "recipient" && !column) {
         issues.push({ path: `${path}.recipient_timezone_column`, message: 'recipient_timezone_column is required when timezone_mode is "recipient".' });
     }
+    return { mode, column };
+}
+function normalizeSendWindow(raw, path, issues) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (!isRecord(raw)) {
+        issues.push({ path, message: "send_window must be an object." });
+        return undefined;
+    }
+    const timezone = normalizeSendWindowConfiguredTimezone(raw, path, issues);
+    const start = normalizeHhmm(raw.start, `${path}.start`, issues);
+    const end = normalizeHhmm(raw.end, `${path}.end`, issues);
+    validateSendWindowBounds(start, end, path, issues);
+    const days = normalizeWeekdays(raw.days, `${path}.days`, issues);
+    const { mode, column } = normalizeSendWindowTimezoneMode(raw, path, issues);
     return {
-        timezone: timezone ?? "UTC",
+        timezone,
         ...(days ? { days } : {}),
         start: start ?? "09:00",
         end: end ?? "17:00",

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const OXYGEN_VERSION = "1.233.8";
+export declare const OXYGEN_VERSION = "1.244.2";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.233.8";
+export const OXYGEN_VERSION = "1.244.2";
 // Bump this only when deployed CLI/API contracts require a newer CLI.
 // 1.181.0: paid table action runs and background columns run require
 // approved=true in addition to max_credits; older CLIs cannot send the flag.

package/node_modules/@oxygen/shared/package.json

@@ -15,6 +15,11 @@
       "types": "./dist/file-import.d.ts",
       "import": "./dist/file-import.js",
       "default": "./dist/file-import.js"
+    },
+    "./custom-http-safety": {
+      "types": "./dist/custom-http-safety.d.ts",
+      "import": "./dist/custom-http-safety.js",
+      "default": "./dist/custom-http-safety.js"
     }
   },
   "dependencies": {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.233.8",
+  "version": "1.244.2",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",