@oxygen-agent/cli 1.242.6 → 1.244.2

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.242.6
+Version: 1.244.2

package/dist/index.js

@@ -1796,7 +1796,7 @@ export function createProgram() {
         }));
     }))
         .addCommand(new Command("configure")
-        .description("Configure a standing bidirectional sync for one CRM object pair. Defaults to dry-run, which returns a real preview of the next cycle.")
+        .description("Configure a standing bidirectional sync for one CRM object pair. Defaults to dry-run, which returns a real preview of the next cycle; inbound and bidirectional previews perform bounded CRM provider reads and may use external API quota.")
         .requiredOption("--provider <provider>", "Connected CRM: hubspot or attio.")
         .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, or attio people|companies.")
         .option("--direction <direction>", "Sync direction: inbound, outbound, or bidirectional. Defaults to bidirectional.")
@@ -1805,7 +1805,7 @@ export function createProgram() {
         .option("--max-rows <n>", "Per-cycle row cap. The real volume brake on provider writes (BYOK writes cost 0 Oxygen credits).")
         .option("--max-credits <n>", "Managed-credit + external-quota cap per cycle.")
         .option("--approved", "Confirm a live configuration after inspecting a dry run.")
-        .option("--dry-run", "Preview the configuration and next cycle without writing. Default.")
+        .option("--dry-run", "Preview the configuration and next cycle without writing. Inbound/bidirectional previews perform bounded CRM reads and may use external API quota. Default.")
         .option("--live", "Write the configuration. Requires --approved and --max-credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {

package/node_modules/@oxygen/shared/dist/custom-http-safety.d.ts

@@ -13,6 +13,6 @@ export declare function assertCustomHttpPublicUrlSyntax(url: string | URL): URL;
 export declare function assertCustomHttpResolvedHostAllowed(input: {
     url: string | URL;
     resolveHostname?: CustomHttpResolveHostname;
-}): Promise<void>;
+}): Promise<CustomHttpResolvedAddress[]>;
 export declare function normalizeCustomHttpUrlHost(hostname: string): string;
 export declare function isBlockedCustomHttpHost(host: string): boolean;

package/node_modules/@oxygen/shared/dist/custom-http-safety.js

@@ -29,8 +29,10 @@ export function assertCustomHttpPublicUrlSyntax(url) {
 export async function assertCustomHttpResolvedHostAllowed(input) {
     const parsed = assertCustomHttpPublicUrlSyntax(input.url);
     const host = normalizeCustomHttpUrlHost(parsed.hostname);
+    // Literal IP hosts were already validated by assertCustomHttpPublicUrlSyntax and
+    // need no DNS resolution (nor connection pinning) — return an empty answer set.
     if (isIP(host))
-        return;
+        return [];
     const resolveHostname = input.resolveHostname ?? defaultResolveHostname;
     let addresses;
     try {
@@ -53,6 +55,9 @@ export async function assertCustomHttpResolvedHostAllowed(input) {
             throw new CustomHttpUrlSafetyError("blocked_resolved_address", "Custom HTTP URL host resolved to a non-public address.", { host, address: normalizedAddress, family: address.family ?? null });
         }
     }
+    // Return the validated addresses so callers can pin the connection to a checked
+    // IP and close the DNS-rebinding TOCTOU (fetch would otherwise re-resolve).
+    return addresses;
 }
 export function normalizeCustomHttpUrlHost(hostname) {
     const host = hostname.toLowerCase().replace(/\.+$/, "");
@@ -137,20 +142,47 @@ function splitCustomHttpIpv6Part(part) {
         return [];
     const groups = part.split(":");
     const values = [];
-    for (const group of groups) {
+    for (let index = 0; index < groups.length; index += 1) {
+        const group = groups[index] ?? "";
+        // A trailing dotted-decimal group (e.g. `8.8.8.8` in `::ffff:8.8.8.8`) is a
+        // valid IPv4-in-IPv6 literal; fold it into its two 16-bit words so mapped/
+        // compatible addresses parse instead of fail-closing as "blocked".
+        if (index === groups.length - 1 && group.includes(".")) {
+            const octets = customHttpDottedIpv4Octets(group);
+            if (!octets)
+                return null;
+            values.push((octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]);
+            continue;
+        }
         if (!/^[0-9a-f]{1,4}$/.test(group))
             return null;
         values.push(Number.parseInt(group, 16));
     }
     return values;
 }
+function customHttpDottedIpv4Octets(value) {
+    if (isIP(value) !== 4)
+        return null;
+    const octets = value.split(".").map((octet) => Number(octet));
+    return [octets[0] ?? 0, octets[1] ?? 0, octets[2] ?? 0, octets[3] ?? 0];
+}
 function customHttpIpv4FromIpv6(groups) {
     const mappedPrefix = groups.slice(0, 5).every((group) => group === 0) && groups[5] === 0xffff;
     const compatiblePrefix = groups.slice(0, 6).every((group) => group === 0);
-    if (!mappedPrefix && !compatiblePrefix)
-        return null;
-    const high = groups[6] ?? 0;
-    const low = groups[7] ?? 0;
+    // NAT64/DNS64 well-known prefix 64:ff9b::/96 embeds the IPv4 in the last 32 bits.
+    const nat64WellKnownPrefix = groups[0] === 0x0064
+        && groups[1] === 0xff9b
+        && groups.slice(2, 6).every((group) => group === 0);
+    if (mappedPrefix || compatiblePrefix || nat64WellKnownPrefix) {
+        return customHttpIpv4FromIpv6Pair(groups[6], groups[7]);
+    }
+    // 6to4 prefix 2002::/16 embeds the gateway IPv4 in the two groups after the prefix.
+    if (groups[0] === 0x2002) {
+        return customHttpIpv4FromIpv6Pair(groups[1], groups[2]);
+    }
+    return null;
+}
+function customHttpIpv4FromIpv6Pair(high = 0, low = 0) {
     if (high === 0 && low === 0)
         return null;
     return [

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const OXYGEN_VERSION = "1.242.6";
+export declare const OXYGEN_VERSION = "1.244.2";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.242.6";
+export const OXYGEN_VERSION = "1.244.2";
 // Bump this only when deployed CLI/API contracts require a newer CLI.
 // 1.181.0: paid table action runs and background columns run require
 // approved=true in addition to max_credits; older CLIs cannot send the flag.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.242.6",
+  "version": "1.244.2",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",