@oxygen-agent/cli 1.242.6 → 1.246.0

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.242.6
+Version: 1.246.0

package/dist/index.js

@@ -323,6 +323,60 @@ function readCustomIntegrationManifest(options) {
     }
     return parseJsonObject(manifestJson ?? readFileSync(resolve(manifestPath ?? ""), "utf8"));
 }
+const CUSTOM_INTEGRATION_SECRET_KEYS = ["API_KEY", "TOKEN", "PASSWORD", "SECRET"];
+function readCustomIntegrationSecret(options) {
+    const apiKey = readOption(options.apiKey);
+    const secretsFile = readOption(options.secretsFile);
+    if (apiKey && secretsFile) {
+        throw new OxygenError("invalid_request", "Pass either --api-key or --secrets-file, not both.", {
+            exitCode: 1,
+        });
+    }
+    if (apiKey)
+        return apiKey;
+    if (!secretsFile) {
+        throw new OxygenError("invalid_request", "Pass --api-key or --secrets-file.", {
+            exitCode: 1,
+        });
+    }
+    const entries = parseEnvFile(readFileSync(resolve(secretsFile), "utf8"));
+    const keys = Object.keys(entries);
+    if (keys.length === 0) {
+        throw new OxygenError("invalid_request", "Secrets file has no KEY=VALUE entries.", {
+            details: { file: secretsFile },
+            exitCode: 1,
+        });
+    }
+    if (keys.length === 1)
+        return entries[keys[0]];
+    const preferred = CUSTOM_INTEGRATION_SECRET_KEYS.find((key) => entries[key] !== undefined);
+    if (preferred)
+        return entries[preferred];
+    throw new OxygenError("invalid_request", "Secrets file is ambiguous: use a single entry or name one API_KEY, TOKEN, PASSWORD, or SECRET.", {
+        details: { file: secretsFile, keys },
+        exitCode: 1,
+    });
+}
+function parseEnvFile(content) {
+    const entries = {};
+    for (const rawLine of content.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const separator = line.indexOf("=");
+        if (separator <= 0)
+            continue;
+        const key = line.slice(0, separator).trim().replace(/^export\s+/, "");
+        let value = line.slice(separator + 1).trim();
+        if ((value.startsWith("\"") && value.endsWith("\"") && value.length >= 2)
+            || (value.startsWith("'") && value.endsWith("'") && value.length >= 2)) {
+            value = value.slice(1, -1);
+        }
+        if (key && value)
+            entries[key] = value;
+    }
+    return entries;
+}
 function readFileIfPresent(value) {
     const candidate = resolve(value);
     try {
@@ -1796,7 +1850,7 @@ export function createProgram() {
         }));
     }))
         .addCommand(new Command("configure")
-        .description("Configure a standing bidirectional sync for one CRM object pair. Defaults to dry-run, which returns a real preview of the next cycle.")
+        .description("Configure a standing bidirectional sync for one CRM object pair. Defaults to dry-run, which returns a real preview of the next cycle; inbound and bidirectional previews perform bounded CRM provider reads and may use external API quota.")
         .requiredOption("--provider <provider>", "Connected CRM: hubspot or attio.")
         .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, or attio people|companies.")
         .option("--direction <direction>", "Sync direction: inbound, outbound, or bidirectional. Defaults to bidirectional.")
@@ -1805,7 +1859,7 @@ export function createProgram() {
         .option("--max-rows <n>", "Per-cycle row cap. The real volume brake on provider writes (BYOK writes cost 0 Oxygen credits).")
         .option("--max-credits <n>", "Managed-credit + external-quota cap per cycle.")
         .option("--approved", "Confirm a live configuration after inspecting a dry run.")
-        .option("--dry-run", "Preview the configuration and next cycle without writing. Default.")
+        .option("--dry-run", "Preview the configuration and next cycle without writing. Inbound/bidirectional previews perform bounded CRM reads and may use external API quota. Default.")
         .option("--live", "Write the configuration. Requires --approved and --max-credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -4205,7 +4259,7 @@ export function createProgram() {
         .command("custom-integrations")
         .description("Custom HTTP integration commands.")
         .addCommand(new Command("apply")
-        .description("Create or update a custom HTTP integration manifest. Store credentials from the web Connections page.")
+        .description("Create or update a custom HTTP integration manifest. Attach credentials with `custom-integrations connect`.")
         .option("--manifest <path>", "Path to a custom HTTP manifest JSON file.")
         .option("--manifest-json <json>", "Custom HTTP manifest as a JSON object.")
         .option("--json", "Print a JSON envelope.")
@@ -4217,6 +4271,21 @@ export function createProgram() {
                 body: { manifest },
             });
         });
+    }))
+        .addCommand(new Command("connect")
+        .description("Attach the credential (bearer token, API key, or basic password) for an applied custom HTTP integration.")
+        .argument("<slug>", "Custom integration slug from the applied manifest.")
+        .option("--api-key <value>", "Credential value. Prefer --secrets-file to keep it out of shell history.")
+        .option("--secrets-file <path>", "Path to a .env-style file holding the credential (a single entry, or one named API_KEY/TOKEN/PASSWORD/SECRET).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("custom-integrations connect", options, () => {
+            const apiKey = readCustomIntegrationSecret(options);
+            return requestOxygen("/api/cli/custom-integrations/connect", {
+                method: "POST",
+                body: { slug, api_key: apiKey },
+            });
+        });
     }))
         .addCommand(new Command("list")
         .description("List custom HTTP integrations for the active organization.")

package/node_modules/@oxygen/shared/dist/custom-http-safety.d.ts

@@ -13,6 +13,6 @@ export declare function assertCustomHttpPublicUrlSyntax(url: string | URL): URL;
 export declare function assertCustomHttpResolvedHostAllowed(input: {
     url: string | URL;
     resolveHostname?: CustomHttpResolveHostname;
-}): Promise<void>;
+}): Promise<CustomHttpResolvedAddress[]>;
 export declare function normalizeCustomHttpUrlHost(hostname: string): string;
 export declare function isBlockedCustomHttpHost(host: string): boolean;

package/node_modules/@oxygen/shared/dist/custom-http-safety.js

@@ -29,8 +29,10 @@ export function assertCustomHttpPublicUrlSyntax(url) {
 export async function assertCustomHttpResolvedHostAllowed(input) {
     const parsed = assertCustomHttpPublicUrlSyntax(input.url);
     const host = normalizeCustomHttpUrlHost(parsed.hostname);
+    // Literal IP hosts were already validated by assertCustomHttpPublicUrlSyntax and
+    // need no DNS resolution (nor connection pinning) — return an empty answer set.
     if (isIP(host))
-        return;
+        return [];
     const resolveHostname = input.resolveHostname ?? defaultResolveHostname;
     let addresses;
     try {
@@ -53,6 +55,9 @@ export async function assertCustomHttpResolvedHostAllowed(input) {
             throw new CustomHttpUrlSafetyError("blocked_resolved_address", "Custom HTTP URL host resolved to a non-public address.", { host, address: normalizedAddress, family: address.family ?? null });
         }
     }
+    // Return the validated addresses so callers can pin the connection to a checked
+    // IP and close the DNS-rebinding TOCTOU (fetch would otherwise re-resolve).
+    return addresses;
 }
 export function normalizeCustomHttpUrlHost(hostname) {
     const host = hostname.toLowerCase().replace(/\.+$/, "");
@@ -137,20 +142,47 @@ function splitCustomHttpIpv6Part(part) {
         return [];
     const groups = part.split(":");
     const values = [];
-    for (const group of groups) {
+    for (let index = 0; index < groups.length; index += 1) {
+        const group = groups[index] ?? "";
+        // A trailing dotted-decimal group (e.g. `8.8.8.8` in `::ffff:8.8.8.8`) is a
+        // valid IPv4-in-IPv6 literal; fold it into its two 16-bit words so mapped/
+        // compatible addresses parse instead of fail-closing as "blocked".
+        if (index === groups.length - 1 && group.includes(".")) {
+            const octets = customHttpDottedIpv4Octets(group);
+            if (!octets)
+                return null;
+            values.push((octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]);
+            continue;
+        }
         if (!/^[0-9a-f]{1,4}$/.test(group))
             return null;
         values.push(Number.parseInt(group, 16));
     }
     return values;
 }
+function customHttpDottedIpv4Octets(value) {
+    if (isIP(value) !== 4)
+        return null;
+    const octets = value.split(".").map((octet) => Number(octet));
+    return [octets[0] ?? 0, octets[1] ?? 0, octets[2] ?? 0, octets[3] ?? 0];
+}
 function customHttpIpv4FromIpv6(groups) {
     const mappedPrefix = groups.slice(0, 5).every((group) => group === 0) && groups[5] === 0xffff;
     const compatiblePrefix = groups.slice(0, 6).every((group) => group === 0);
-    if (!mappedPrefix && !compatiblePrefix)
-        return null;
-    const high = groups[6] ?? 0;
-    const low = groups[7] ?? 0;
+    // NAT64/DNS64 well-known prefix 64:ff9b::/96 embeds the IPv4 in the last 32 bits.
+    const nat64WellKnownPrefix = groups[0] === 0x0064
+        && groups[1] === 0xff9b
+        && groups.slice(2, 6).every((group) => group === 0);
+    if (mappedPrefix || compatiblePrefix || nat64WellKnownPrefix) {
+        return customHttpIpv4FromIpv6Pair(groups[6], groups[7]);
+    }
+    // 6to4 prefix 2002::/16 embeds the gateway IPv4 in the two groups after the prefix.
+    if (groups[0] === 0x2002) {
+        return customHttpIpv4FromIpv6Pair(groups[1], groups[2]);
+    }
+    return null;
+}
+function customHttpIpv4FromIpv6Pair(high = 0, low = 0) {
     if (high === 0 && low === 0)
         return null;
     return [

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const OXYGEN_VERSION = "1.242.6";
+export declare const OXYGEN_VERSION = "1.246.0";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.242.6";
+export const OXYGEN_VERSION = "1.246.0";
 // Bump this only when deployed CLI/API contracts require a newer CLI.
 // 1.181.0: paid table action runs and background columns run require
 // approved=true in addition to max_credits; older CLIs cannot send the flag.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.242.6",
+  "version": "1.246.0",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",