@oxygen-agent/cli 1.310.2 → 1.334.3

package/dist/runtime.js

@@ -22,6 +22,16 @@ export function resolveCliBinaryName(env = process.env, argv = process.argv) {
     const explicit = normalizeBinaryName(env.OXYGEN_CLI_BINARY ?? env.OXYGEN_CLI_NAME);
     if (explicit)
         return explicit;
+    // The dev install (`npm run install-dev-cli`) also ships a legacy shim literally
+    // named `oxygen` under ~/.oxygen-dev/. A basename check alone misreads it as the
+    // npm production binary, and every command then scolds the user about "pointing
+    // a production binary at a non-production API" — for a setup that is exactly as
+    // intended (live blind-user finding, 2026-07-13). The install PATH is the
+    // truthful channel signal, so check it before the basename.
+    const invokedPath = argv[1] ?? "";
+    if (invokedPath.includes("/.oxygen-dev/") || invokedPath.includes("\\.oxygen-dev\\")) {
+        return DEV_CLI_BINARY;
+    }
     const invoked = normalizeBinaryName(argv[1]);
     if (invoked)
         return invoked;
@@ -33,10 +43,10 @@ export function resolveCliUpdateGuidance(endpoint, env = process.env, argv = pro
         return {
             binaryName,
             channel: "dev",
-            warningInstruction: "Refresh the dev CLI (`oxygen-dev`) from the dev branch before using operational commands.",
-            failureInstruction: "Refresh the dev CLI (`oxygen-dev`) from the dev branch before using this command.",
+            warningInstruction: "Rebuild `oxygen-dev` from the latest dev branch (`npm run install-dev-cli`) before using operational commands.",
+            failureInstruction: "Rebuild `oxygen-dev` from the latest dev branch (`npm run install-dev-cli`) before using this command.",
             details: {
-                cli_update_instruction: "Refresh the dev CLI (`oxygen-dev`) from the dev branch.",
+                cli_update_instruction: "Rebuild `oxygen-dev` from the latest dev branch (`npm run install-dev-cli`).",
             },
         };
     }

package/dist/skills.js

@@ -1,7 +1,7 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
 import { OxygenError, toFailure } from "@oxygen/shared";
 import { defaultApiUrl, loadCredentials, normalizeApiUrl } from "./credentials.js";
 import { requestOxygen } from "./http-client.js";
@@ -118,35 +118,71 @@ options, runtime = {}) {
     const skill = readOption(options.skill) ?? "*";
     const env = runtime.env ?? process.env;
     const platform = runtime.platform ?? process.platform;
-    const args = installerAddArgs(source.install_url, agents, skill);
-    if (!options.project)
-        args.push("--global");
-    if (options.copy)
-        args.push("--copy");
-    const invocation = resolveCmdShimInvocation("npx", args, platform, env);
     const spawn = runtime.spawnSync ?? wrapExecFileSync(runtime.execFileSync) ?? spawnSync;
-    const result = spawn(invocation.executable, invocation.args, {
-        encoding: "utf8",
-        env,
-        stdio: ["ignore", "pipe", "pipe"],
-        windowsHide: true,
-        ...(platform === "win32" ? { windowsVerbatimArguments: true } : {}),
-    });
-    const stdout = typeof result.stdout === "string" ? result.stdout : "";
-    const stderr = typeof result.stderr === "string" ? result.stderr : "";
-    if (result.error || (typeof result.status === "number" && result.status !== 0)) {
-        const message = result.error instanceof Error ? result.error.message : null;
-        throw new OxygenError("skills_install_failed", "Unable to install Oxygen agent skills.", {
-            details: {
-                index_url: source.index_url,
-                authenticated: source.authenticated,
-                executable: invocation.label,
-                exit_code: typeof result.status === "number" ? result.status : null,
-                stdout: stdout.slice(0, 2000),
-                stderr: (stderr || message || "unknown").slice(0, 2000),
-            },
-            exitCode: 1,
-        });
+    // A specific shortcut skill can declare prerequisite skills that its SKILL.md
+    // invokes (e.g. oxygen-clay-migration → oxygen-gtm, whose recipes it lives in).
+    // Installing it alone would leave those missing, so pull them in too. Best-
+    // effort (an unreachable/unparseable index just installs the requested skill),
+    // and skipped for "*", which already installs everything.
+    const dependencySkills = skill === "*"
+        ? []
+        : await resolveSkillInstallDependencies(skill, source.index_url, runtime.fetch);
+    const targets = [skill, ...dependencySkills];
+    // The authenticated access URL is org-bound and secret, so it must never
+    // reach the installer's argv — any local process can read a child's
+    // arguments. Stage the requested skill content to a private temp dir (the
+    // tokenized URLs stay inside this process on the fetches) and hand the
+    // installer that local path instead. The public, non-secret index URL is
+    // passed straight through as before.
+    let stagingDir = null;
+    const outputs = [];
+    try {
+        let installSource = source.install_url;
+        if (source.authenticated) {
+            stagingDir = mkdtempSync(join(tmpdir(), "oxygen-skills-"));
+            await stageAuthenticatedSkills(stagingDir, source, targets, runtime.fetch ?? fetch);
+            installSource = stagingDir;
+        }
+        for (const target of targets) {
+            const args = installerAddArgs(installSource, agents, target);
+            if (!options.project)
+                args.push("--global");
+            if (options.copy)
+                args.push("--copy");
+            const invocation = resolveCmdShimInvocation("npx", args, platform, env);
+            const result = spawn(invocation.executable, invocation.args, {
+                encoding: "utf8",
+                env,
+                stdio: ["ignore", "pipe", "pipe"],
+                windowsHide: true,
+                ...(platform === "win32" ? { windowsVerbatimArguments: true } : {}),
+            });
+            const stdout = typeof result.stdout === "string" ? result.stdout : "";
+            const stderr = typeof result.stderr === "string" ? result.stderr : "";
+            if (result.error || (typeof result.status === "number" && result.status !== 0)) {
+                const message = result.error instanceof Error ? result.error.message : null;
+                throw new OxygenError("skills_install_failed", "Unable to install Oxygen agent skills.", {
+                    details: {
+                        index_url: source.index_url,
+                        authenticated: source.authenticated,
+                        skill: target,
+                        executable: invocation.label,
+                        exit_code: typeof result.status === "number" ? result.status : null,
+                        stdout: stdout.slice(0, 2000),
+                        stderr: (stderr || message || "unknown").slice(0, 2000),
+                    },
+                    exitCode: 1,
+                });
+            }
+            outputs.push(stdout);
+        }
+    }
+    finally {
+        if (stagingDir)
+            rmSync(stagingDir, { recursive: true, force: true });
+    }
+    if (dependencySkills.length > 0) {
+        process.stderr.write(`note: '${skill}' also installs its prerequisite skill(s): ${dependencySkills.join(", ")}.\n`);
     }
     return {
         indexUrl: source.index_url,
@@ -156,10 +192,129 @@ options, runtime = {}) {
         ...(source.fallback_reason ? { access_fallback: source.fallback_reason } : {}),
         agents,
         skill,
+        ...(dependencySkills.length > 0 ? { dependency_skills: dependencySkills } : {}),
         scope: options.project ? "project" : "global",
-        output: stdout,
+        output: outputs.join(""),
     };
 }
+/**
+ * Stages the requested skill(s) into `dir` so the installer receives a local
+ * filesystem path instead of the org-bound tokenized access URL. Keeping the URL
+ * out of the child's argv closes a local-process argv-inspection exposure; the
+ * token still travels over the network on these in-process fetches, which is the
+ * already-accepted part of the design. Layout matches what the installer walks
+ * for a local source: `<dir>/<skill>/<file>` (nested paths preserved).
+ *
+ * Any fetch/staging failure throws the same `skills_install_failed` error the
+ * installer path raises — we never fall back to passing the tokenized URL as a
+ * process argument.
+ */
+async function stageAuthenticatedSkills(dir, source, targets, fetchImpl) {
+    const entries = await fetchStagedSkillEntries(source.index_url, fetchImpl);
+    const wanted = targets.includes("*")
+        ? entries
+        : entries.filter((entry) => targets.includes(entry.name));
+    // `<base>/.well-known/skills/index.json` → `<base>/.well-known/skills`; the
+    // installer reads a skill's files from `<root>/<name>/<file>`.
+    const skillsRoot = source.index_url.replace(/\/index\.json$/i, "");
+    for (const entry of wanted) {
+        // allSettled, not all: on a failed fetch, Promise.all would reject while
+        // sibling fetches are still writing — the caller's finally rmSyncs the temp
+        // dir and a late mkdirSync would silently recreate it as orphan litter.
+        // Waiting for every settle guarantees no write is in flight when we throw.
+        const staged = await Promise.allSettled(entry.files.map(async (file) => {
+            const content = await fetchStagedSkillFile(`${skillsRoot}/${entry.name}/${file}`, fetchImpl);
+            const destination = join(dir, entry.name, ...file.split("/"));
+            mkdirSync(dirname(destination), { recursive: true });
+            writeFileSync(destination, content);
+        }));
+        const failed = staged.find((result) => result.status === "rejected");
+        if (failed)
+            throw failed.reason;
+    }
+}
+async function fetchStagedSkillEntries(indexUrl, fetchImpl) {
+    let response;
+    try {
+        response = await fetchImpl(indexUrl, { headers: { Accept: "application/json" } });
+    }
+    catch (error) {
+        throw stagingFailure("fetch_index", { index_url: indexUrl, message: errorMessage(error) });
+    }
+    if (!response.ok) {
+        throw stagingFailure("fetch_index", { index_url: indexUrl, status: response.status });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await response.text());
+    }
+    catch (error) {
+        throw stagingFailure("parse_index", { index_url: indexUrl, message: errorMessage(error) });
+    }
+    if (!isRecord(parsed) || !Array.isArray(parsed.skills)) {
+        throw stagingFailure("parse_index", { index_url: indexUrl, message: "skills array missing" });
+    }
+    const entries = [];
+    for (const entry of parsed.skills) {
+        if (!isRecord(entry) || typeof entry.name !== "string" || !entry.name.trim())
+            continue;
+        const files = Array.isArray(entry.files)
+            ? entry.files.filter((file) => typeof file === "string" && file.trim().length > 0)
+            : [];
+        entries.push({ name: entry.name.trim(), files });
+    }
+    return entries;
+}
+async function fetchStagedSkillFile(url, fetchImpl) {
+    let response;
+    try {
+        response = await fetchImpl(url);
+    }
+    catch (error) {
+        throw stagingFailure("fetch_file", { url, message: errorMessage(error) });
+    }
+    if (!response.ok) {
+        throw stagingFailure("fetch_file", { url, status: response.status });
+    }
+    return response.text();
+}
+// Mirror the installer-failure error so a staging failure surfaces identically
+// (code, message, exitCode) to the caller — never as a silent URL fallback.
+function stagingFailure(stage, details) {
+    return new OxygenError("skills_install_failed", "Unable to install Oxygen agent skills.", {
+        details: { stage, ...details },
+        exitCode: 1,
+    });
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+// Best-effort resolution of a skill's declared prerequisite skills from the
+// index. Any failure (unreachable index, parse error, unknown skill) yields no
+// dependencies so a dependency lookup can never block or fail an install.
+async function resolveSkillInstallDependencies(skill, indexUrl, fetchImpl) {
+    try {
+        const index = await inspectSkillIndex(indexUrl, fetchImpl ?? fetch);
+        if (!index.reachable)
+            return [];
+        const entry = index.skills.find((candidate) => candidate.name === skill);
+        if (!entry)
+            return [];
+        // Drop self-references and duplicates; preserve declared order.
+        const seen = new Set([skill]);
+        const resolved = [];
+        for (const dep of entry.dependencies) {
+            if (seen.has(dep))
+                continue;
+            seen.add(dep);
+            resolved.push(dep);
+        }
+        return resolved;
+    }
+    catch {
+        return [];
+    }
+}
 // Adapt the legacy `execFileSync` runtime hook into a spawnSync-shaped return so
 // existing test fixtures (update.test.ts) keep working without a coordinated
 // rewrite. New tests should inject `spawnSync` directly.
@@ -347,6 +502,11 @@ function parseSkillIndex(value) {
             title: typeof entry.title === "string" ? entry.title : null,
             description: typeof entry.description === "string" ? entry.description : null,
             entrypoint: typeof entry.entrypoint === "string" ? entry.entrypoint : null,
+            dependencies: Array.isArray(entry.dependencies)
+                ? entry.dependencies
+                    .filter((dep) => typeof dep === "string" && dep.trim().length > 0)
+                    .map((dep) => dep.trim())
+                : [],
         };
     })
         .filter((entry) => entry !== null);

package/node_modules/@oxygen/recipe-sdk/dist/index.d.ts

@@ -4,6 +4,7 @@ export type RecipeLogLevel = "debug" | "info" | "warn" | "error";
 export type RecipeRuntime = "durable";
 export type RecipeToolRunOptions = {
     key?: string;
+    optional?: boolean;
 };
 export type RecipeToolApi = {
     run: <T = unknown>(toolId: string, payload?: Record<string, unknown>, options?: RecipeToolRunOptions) => Promise<T>;
@@ -46,6 +47,7 @@ export type RecipeTablesApi = {
         includeProfile?: boolean;
         includeDataQuality?: boolean;
         key?: string;
+        optional?: boolean;
     }) => Promise<T>;
 };
 export type RecipeRowsApi = {

package/node_modules/@oxygen/shared/dist/billing.d.ts

@@ -26,86 +26,109 @@ export type PricingPlanDefinition = {
 };
 export type PricingPlanMetadata = Record<string, unknown> | null | undefined;
 export declare const CONTACT_SALES_URL = "https://cal.com/tim-scheuer-mxbib9/45";
+export declare const CREDITS_PER_USD = 1000;
+export declare const TOPUP_USD_CENTS_PER_1K_CREDITS = 125;
+export declare const AUTOMATION_ACTION_CREDITS = 0.01;
+export declare const CREDIT_TOPUP_PACKS: readonly [{
+    readonly id: "10";
+    readonly usdCents: 1000;
+    readonly credits: 8000;
+}, {
+    readonly id: "25";
+    readonly usdCents: 2500;
+    readonly credits: 20000;
+}, {
+    readonly id: "100";
+    readonly usdCents: 10000;
+    readonly credits: 80000;
+}, {
+    readonly id: "250";
+    readonly usdCents: 25000;
+    readonly credits: 200000;
+}];
+export type CreditTopupPack = (typeof CREDIT_TOPUP_PACKS)[number];
+export type CreditTopupPackId = CreditTopupPack["id"];
+export declare function resolveCreditTopupPack(id: string | null | undefined): CreditTopupPack | null;
 export declare const TRIAL_PERIOD_DAYS = 7;
-export declare const TRIAL_CREDIT_GRANT = 1000;
+export declare const TRIAL_CREDIT_GRANT = 20000;
 export declare const BASE_PRICING_PLANS: {
     readonly free: {
         readonly tier: "free";
         readonly name: "Free";
         readonly monthlyPriceCents: 0;
-        readonly monthlyCredits: 500;
-        readonly weeklyCreditsLimit: 500;
-        readonly rolloverCap: 500;
-        readonly monthlyAutomationActions: 10000;
+        readonly monthlyCredits: 10000;
+        readonly weeklyCreditsLimit: 10000;
+        readonly rolloverCap: 10000;
+        readonly monthlyAutomationActions: null;
         readonly automationOverageCentsPerMillion: null;
         readonly automationOverageEnabledDefault: false;
         readonly byokEnabled: false;
         readonly description: "Get $10 in credits on us every month — try OXYGEN with managed email, phone enrichment, and AI credits.";
         readonly ctaLabel: "Start free";
-        readonly features: readonly ["$10 in credits every month", "10,000 automation actions / month", "All integrations", "Workflows", "No card required"];
+        readonly features: readonly ["$10 in credits every month", "Automation actions at 0.01 credits each", "All integrations", "Workflows", "No card required"];
     };
     readonly starter: {
         readonly tier: "starter";
         readonly name: "Starter";
         readonly monthlyPriceCents: 9900;
-        readonly monthlyCredits: 5000;
-        readonly weeklyCreditsLimit: 2000;
-        readonly rolloverCap: 5000;
-        readonly monthlyAutomationActions: 250000;
-        readonly automationOverageCentsPerMillion: 1000;
+        readonly monthlyCredits: 99000;
+        readonly weeklyCreditsLimit: 40000;
+        readonly rolloverCap: 99000;
+        readonly monthlyAutomationActions: null;
+        readonly automationOverageCentsPerMillion: null;
         readonly automationOverageEnabledDefault: false;
         readonly byokEnabled: true;
         readonly description: "For founders running focused managed enrichment and AI columns.";
         readonly ctaLabel: "Choose Starter";
-        readonly features: readonly ["All integrations", "250,000 automation actions / month", "Bring your own keys", "Workflows", "Standard support"];
+        readonly features: readonly ["99,000 credits every month", "All integrations", "Workflows — automation actions at 0.01 credits each", "Bring your own keys", "Standard support"];
     };
     readonly pro: {
         readonly tier: "pro";
         readonly name: "Pro";
         readonly monthlyPriceCents: 24900;
-        readonly monthlyCredits: 12500;
-        readonly weeklyCreditsLimit: 5000;
-        readonly rolloverCap: 12500;
-        readonly monthlyAutomationActions: 2000000;
-        readonly automationOverageCentsPerMillion: 1000;
+        readonly monthlyCredits: 249000;
+        readonly weeklyCreditsLimit: 100000;
+        readonly rolloverCap: 249000;
+        readonly monthlyAutomationActions: null;
+        readonly automationOverageCentsPerMillion: null;
         readonly automationOverageEnabledDefault: false;
         readonly byokEnabled: true;
         readonly description: "For recurring GTM enrichment and AI-column workflows on managed credits.";
         readonly badge: "Most popular";
         readonly highlighted: true;
         readonly ctaLabel: "Choose Pro";
-        readonly features: readonly ["All integrations", "2,000,000 automation actions / month", "Bring your own keys", "Workflows", "Standard support"];
+        readonly features: readonly ["249,000 credits every month", "All integrations", "Workflows — automation actions at 0.01 credits each", "Bring your own keys", "Standard support"];
     };
     readonly team: {
         readonly tier: "team";
         readonly name: "Team";
         readonly monthlyPriceCents: 74900;
-        readonly monthlyCredits: 37500;
-        readonly weeklyCreditsLimit: 15000;
-        readonly rolloverCap: 37500;
-        readonly monthlyAutomationActions: 10000000;
-        readonly automationOverageCentsPerMillion: 500;
+        readonly monthlyCredits: 749000;
+        readonly weeklyCreditsLimit: 300000;
+        readonly rolloverCap: 749000;
+        readonly monthlyAutomationActions: null;
+        readonly automationOverageCentsPerMillion: null;
         readonly automationOverageEnabledDefault: false;
         readonly byokEnabled: true;
         readonly description: "For small GTM teams and agencies running shared workflows with their own AI keys.";
         readonly ctaLabel: "Choose Team";
-        readonly features: readonly ["All integrations", "10,000,000 automation actions / month", "Bring your own keys", "Workflows", "Premium support"];
+        readonly features: readonly ["749,000 credits every month", "All integrations", "Workflows — automation actions at 0.01 credits each", "Bring your own keys", "Premium support"];
     };
     readonly scale: {
         readonly tier: "scale";
         readonly name: "Scale";
         readonly monthlyPriceCents: null;
-        readonly monthlyCredits: 500000;
-        readonly weeklyCreditsLimit: 500000;
-        readonly rolloverCap: 500000;
-        readonly monthlyAutomationActions: 50000000;
+        readonly monthlyCredits: 10000000;
+        readonly weeklyCreditsLimit: 10000000;
+        readonly rolloverCap: 10000000;
+        readonly monthlyAutomationActions: null;
         readonly automationOverageCentsPerMillion: null;
         readonly automationOverageEnabledDefault: false;
         readonly byokEnabled: true;
         readonly description: "For high-volume GTM teams that need custom limits and rollout support.";
         readonly ctaLabel: "Contact sales";
         readonly contactHref: "https://cal.com/tim-scheuer-mxbib9/45";
-        readonly features: readonly ["500,000+ managed credits / month", "50,000,000+ automation actions / month", "Phone number enrichment on managed credits", "Custom provider routing and BYOK policies", "Dedicated onboarding"];
+        readonly features: readonly ["10,000,000+ managed credits / month", "Automation actions at 0.01 credits each", "Phone number enrichment on managed credits", "Custom provider routing and BYOK policies", "Dedicated onboarding"];
     };
     readonly enterprise: {
         readonly tier: "enterprise";