@oxygen-agent/cli 1.310.2 → 1.334.3

package/node_modules/@oxygen/shared/dist/workflow-status-change.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The audit record behind every workflow enable/disable (OXY-4124).
+ *
+ * Disabling a workflow is the highest-consequence write in the Action layer — it
+ * takes a customer's revenue automation to zero — and it used to record nothing
+ * but a bumped `updated_at`: no actor, no source surface, no reason. Answering
+ * "who turned this off?" meant a forensic pass across the control DB, the tenant
+ * shard, and the request log; the customer saw nothing at all (a design partner's
+ * only automation was silently off for 64h).
+ *
+ * The record lives in `workflow_definitions.metadata.last_status_change` — the
+ * column is untyped JSONB, so this needs no migration. It is the *definition*-level
+ * peer of the trigger-level auto-pause metadata (`auto_paused_at` /
+ * `auto_pause_reason`, written by `workflow-trigger-health.ts`), which already got
+ * this right; this module closes the asymmetry for the human disable path.
+ *
+ * Every surface (web, CLI, MCP) renders the same sentence from
+ * `describeWorkflowStatusChange` so "Disabled by X on Y" reads identically
+ * wherever a customer meets it.
+ */
+export declare const WORKFLOW_STATUS_CHANGE_METADATA_KEY = "last_status_change";
+/** The surface the transition came through. `auto_pause` is the worker health sweep. */
+export type WorkflowStatusChangeSource = "web" | "cli" | "mcp" | "api" | "auto_pause" | "system";
+export type WorkflowStatusChangeActor = {
+    type: "user" | "api_key" | "system";
+    /** Control-DB user id. Absent for system/auto-pause actors. */
+    user_id?: string;
+    /** Set when the call authenticated with an org API key rather than a user session. */
+    api_key_id?: string;
+    /** What the product shows the customer, e.g. "dana@acme.com" or "Oxygen (auto-pause)". */
+    label: string;
+};
+export type WorkflowStatusChange = {
+    status: "active" | "disabled";
+    /** ISO-8601 UTC. */
+    at: string;
+    source: WorkflowStatusChangeSource;
+    actor: WorkflowStatusChangeActor;
+    /** Customer-visible. Auto-pause supplies its own; humans may pass one. */
+    reason?: string;
+};
+/**
+ * Defensive read: the column is untyped JSONB and every row written before this
+ * shipped has no record at all, so a missing/garbage value must read as "unknown",
+ * never throw. An unparseable record is indistinguishable from no record.
+ */
+export declare function readWorkflowStatusChange(metadata: Record<string, unknown> | null | undefined): WorkflowStatusChange | null;
+/**
+ * Same defensive parse, one level in: for callers holding the already-projected
+ * `statusChange` object rather than the raw metadata bag (the CLI reads it off
+ * the API's JSON envelope, where it arrives as `unknown`).
+ */
+export declare function parseWorkflowStatusChange(raw: unknown): WorkflowStatusChange | null;
+/** Deterministic UTC stamp ("10 Jul 2026 15:40 UTC") — no locale dependence. */
+export declare function formatWorkflowStatusChangeTimestamp(at: string): string;
+/**
+ * The single sentence every surface shows. Web banner, `oxygen workflows
+ * list/get`, and the MCP payload all render this string, so the answer to
+ * "who turned this off?" is identical wherever the customer looks.
+ */
+export declare function describeWorkflowStatusChange(change: WorkflowStatusChange): string;

package/node_modules/@oxygen/shared/dist/workflow-status-change.js

@@ -0,0 +1,124 @@
+/**
+ * The audit record behind every workflow enable/disable (OXY-4124).
+ *
+ * Disabling a workflow is the highest-consequence write in the Action layer — it
+ * takes a customer's revenue automation to zero — and it used to record nothing
+ * but a bumped `updated_at`: no actor, no source surface, no reason. Answering
+ * "who turned this off?" meant a forensic pass across the control DB, the tenant
+ * shard, and the request log; the customer saw nothing at all (a design partner's
+ * only automation was silently off for 64h).
+ *
+ * The record lives in `workflow_definitions.metadata.last_status_change` — the
+ * column is untyped JSONB, so this needs no migration. It is the *definition*-level
+ * peer of the trigger-level auto-pause metadata (`auto_paused_at` /
+ * `auto_pause_reason`, written by `workflow-trigger-health.ts`), which already got
+ * this right; this module closes the asymmetry for the human disable path.
+ *
+ * Every surface (web, CLI, MCP) renders the same sentence from
+ * `describeWorkflowStatusChange` so "Disabled by X on Y" reads identically
+ * wherever a customer meets it.
+ */
+export const WORKFLOW_STATUS_CHANGE_METADATA_KEY = "last_status_change";
+const SOURCES = new Set([
+    "web",
+    "cli",
+    "mcp",
+    "api",
+    "auto_pause",
+    "system",
+]);
+const ACTOR_TYPES = new Set([
+    "user",
+    "api_key",
+    "system",
+]);
+const SOURCE_LABELS = {
+    web: "the web app",
+    cli: "the CLI",
+    mcp: "MCP",
+    api: "the API",
+    auto_pause: "auto-pause",
+    system: "Oxygen",
+};
+const MONTHS = [
+    "Jan", "Feb", "Mar", "Apr", "May", "Jun",
+    "Jul", "Aug", "Sep", "Oct", "Nov", "Dec",
+];
+/**
+ * Defensive read: the column is untyped JSONB and every row written before this
+ * shipped has no record at all, so a missing/garbage value must read as "unknown",
+ * never throw. An unparseable record is indistinguishable from no record.
+ */
+export function readWorkflowStatusChange(metadata) {
+    return parseWorkflowStatusChange(metadata?.[WORKFLOW_STATUS_CHANGE_METADATA_KEY]);
+}
+/**
+ * Same defensive parse, one level in: for callers holding the already-projected
+ * `statusChange` object rather than the raw metadata bag (the CLI reads it off
+ * the API's JSON envelope, where it arrives as `unknown`).
+ */
+export function parseWorkflowStatusChange(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const record = raw;
+    const status = record.status;
+    if (status !== "active" && status !== "disabled")
+        return null;
+    const at = record.at;
+    if (typeof at !== "string" || Number.isNaN(Date.parse(at)))
+        return null;
+    const source = typeof record.source === "string" && SOURCES.has(record.source)
+        ? record.source
+        : "system";
+    const actorRaw = record.actor;
+    const actorRecord = actorRaw && typeof actorRaw === "object" && !Array.isArray(actorRaw)
+        ? actorRaw
+        : {};
+    const actorType = typeof actorRecord.type === "string" && ACTOR_TYPES.has(actorRecord.type)
+        ? actorRecord.type
+        : "system";
+    const label = typeof actorRecord.label === "string" && actorRecord.label.trim() !== ""
+        ? actorRecord.label.trim()
+        : "an unknown actor";
+    const actor = { type: actorType, label };
+    if (typeof actorRecord.user_id === "string" && actorRecord.user_id !== "") {
+        actor.user_id = actorRecord.user_id;
+    }
+    if (typeof actorRecord.api_key_id === "string" && actorRecord.api_key_id !== "") {
+        actor.api_key_id = actorRecord.api_key_id;
+    }
+    const change = { status, at, source, actor };
+    if (typeof record.reason === "string" && record.reason.trim() !== "") {
+        change.reason = record.reason.trim();
+    }
+    return change;
+}
+/** Deterministic UTC stamp ("10 Jul 2026 15:40 UTC") — no locale dependence. */
+export function formatWorkflowStatusChangeTimestamp(at) {
+    const date = new Date(at);
+    if (Number.isNaN(date.getTime()))
+        return at;
+    const day = String(date.getUTCDate()).padStart(2, "0");
+    const month = MONTHS[date.getUTCMonth()];
+    const hours = String(date.getUTCHours()).padStart(2, "0");
+    const minutes = String(date.getUTCMinutes()).padStart(2, "0");
+    return `${day} ${month} ${date.getUTCFullYear()} ${hours}:${minutes} UTC`;
+}
+/**
+ * The single sentence every surface shows. Web banner, `oxygen workflows
+ * list/get`, and the MCP payload all render this string, so the answer to
+ * "who turned this off?" is identical wherever the customer looks.
+ */
+export function describeWorkflowStatusChange(change) {
+    const verb = change.status === "disabled" ? "Disabled" : "Enabled";
+    const when = formatWorkflowStatusChangeTimestamp(change.at);
+    // Auto-pause is not a "who" — Oxygen paused it, and the reason carries the why.
+    const by = change.source === "auto_pause"
+        ? "Auto-paused by Oxygen"
+        : `${verb} by ${change.actor.label}`;
+    const via = change.source === "auto_pause" || change.source === "system"
+        ? ""
+        : ` via ${SOURCE_LABELS[change.source]}`;
+    const base = `${by}${via} on ${when}`;
+    return change.reason ? `${base} — ${change.reason}` : base;
+}

package/node_modules/@oxygen/shared/dist/workspace-agents.d.ts

@@ -0,0 +1,65 @@
+/** The three implemented Workspace Agent specialists, by stable slug. */
+export type WorkspaceAgentSlug = "inbox-reply-drafts" | "meeting-notetaker" | "knowledge-synthesis";
+/**
+ * How the web layer builds a specialist's deep-link. A pure hint on the
+ * descriptor (shared can't import the web URL helpers) that agent-registry
+ * switches on to produce the actual `https://oxygen-agent.com/...` URL.
+ */
+export type WorkspaceAgentDeepLinkKind = "inbox_reply_agent" | "notetaker" | "knowledge_agent";
+/** A pure, serializable descriptor for one Workspace Agent specialist. */
+export type WorkspaceAgentDescriptor = {
+    /** Stable identifier used across CLI/MCP/API. */
+    slug: WorkspaceAgentSlug;
+    /** Human title for roster rows and widgets. */
+    title: string;
+    /** One outcome-framed sentence: what the specialist produces for the user. */
+    description: string;
+    /** The OXYGEN OS primitive this specialist writes into. */
+    owningPrimitive: string;
+    /** The CLI command that configures this specialist. */
+    configCommand: string;
+    /** The `/api/cli/*` route that configures this specialist. */
+    configApiPath: string;
+    /** The MCP tools that read/write this specialist's config. */
+    mcpConfigTools: readonly string[];
+    /** One plain sentence stating the specialist's write/approval boundary. */
+    approvalPosture: string;
+    /** How the web layer resolves this specialist's deep-link. */
+    deepLinkKind: WorkspaceAgentDeepLinkKind;
+};
+/**
+ * A single run this specialist produced. Field names are aligned with the
+ * observability run vocabulary so the cross-primitive runs console can consume
+ * these without a parallel shape. Nulls are explicit (never omitted) so every
+ * consumer reads the same keys regardless of specialist.
+ */
+export type WorkspaceAgentRunItem = {
+    /** The specialist that produced this run. */
+    slug: WorkspaceAgentSlug;
+    /** The run's stable id (draft id / session id / knowledge-log id). */
+    id: string;
+    /** The kind of artifact this run produced. */
+    kind: string;
+    /** The run's current status, in the producing surface's own vocabulary. */
+    status: string;
+    /** A short human summary of the run, or null when none is available. */
+    summary: string | null;
+    /** When the run was created (ISO 8601), or null when unknown. */
+    createdAt: string | null;
+    /** Managed credits this run consumed, or null when it spent none / is unknown. */
+    creditsUsed: number | null;
+    /** Deep-link to inspect this run, or null when the specialist has no per-run page. */
+    webUrl: string | null;
+};
+/**
+ * The roster. Exactly three entries — one per implemented specialist. Order is
+ * stable (it drives the default CLI/widget ordering). Adding a fourth entry is a
+ * deliberate product decision that requires the specialist to actually ship first.
+ */
+export declare const WORKSPACE_AGENT_ROSTER: readonly WorkspaceAgentDescriptor[];
+/** True when `value` is one of the three implemented specialist slugs. */
+export declare function isWorkspaceAgentSlug(value: unknown): value is WorkspaceAgentSlug;
+/** The descriptor for `slug`, or `undefined` when it is not a known specialist. */
+export declare function getWorkspaceAgentDescriptor(slug: string): WorkspaceAgentDescriptor | undefined;
+/** Every specialist slug, in roster order. */
+export declare function workspaceAgentSlugs(): WorkspaceAgentSlug[];

package/node_modules/@oxygen/shared/dist/workspace-agents.js

@@ -0,0 +1,67 @@
+// The Workspace Agent roster: the single governed lens over OXYGEN's built-in
+// specialist agents. This is deliberately a *computed* registry, not a table and
+// not a runtime — the "Workspace Agent" is ONE Control-layer surface, and each
+// entry here is a product-defined specialist that already ships as an
+// approval-gated, workflow-owned behavior elsewhere in the product. It is NOT a
+// generic build-your-own-agent runtime (ADR 0006), so there is no create/define
+// verb and there are no placeholder rows: the roster lists only specialists that
+// are actually implemented today. CRM-hygiene, deliverability, and any other
+// roadmap specialist stay OUT until they ship — the no-placeholder-surface rule.
+//
+// This module is a dependency-free leaf (pure descriptors + types) so it can live
+// in @oxygen/shared without importing tenant-db: the actual per-specialist wiring
+// (config read/write, run history, deep-links) lives in the web layer's
+// agent-registry, which composes these descriptors with the existing helpers.
+/**
+ * The roster. Exactly three entries — one per implemented specialist. Order is
+ * stable (it drives the default CLI/widget ordering). Adding a fourth entry is a
+ * deliberate product decision that requires the specialist to actually ship first.
+ */
+export const WORKSPACE_AGENT_ROSTER = [
+    {
+        slug: "inbox-reply-drafts",
+        title: "Inbox reply drafts",
+        description: "Drafts replies to inbound prospect and customer messages so you can review, edit, and approve them before anything sends.",
+        owningPrimitive: "Messages",
+        configCommand: "oxygen inbox reply-agent",
+        configApiPath: "/api/cli/inbox/reply-agent",
+        mcpConfigTools: ["oxygen_inbox_reply_agent_get", "oxygen_inbox_reply_agent_set"],
+        approvalPosture: "Drafts replies only — nothing sends without your approval in the reply queue.",
+        deepLinkKind: "inbox_reply_agent",
+    },
+    {
+        slug: "meeting-notetaker",
+        title: "Meeting notetaker",
+        description: "Auto-joins meetings in its configured scope to record, transcribe, and file meeting notes onto the matching CRM records.",
+        owningPrimitive: "Records",
+        configCommand: "oxygen notetaker setup",
+        configApiPath: "/api/cli/notetaker/setup",
+        mcpConfigTools: ["oxygen_notetaker_setup", "oxygen_notetaker_status"],
+        approvalPosture: "Auto-records only meetings within its configured scope; each session is credit-capped and carries your consent disclosure.",
+        deepLinkKind: "notetaker",
+    },
+    {
+        slug: "knowledge-synthesis",
+        title: "Knowledge synthesis",
+        description: "Distills captured outreach and meeting learnings into workspace knowledge pages on the schedule and daily credit cap you set.",
+        owningPrimitive: "Knowledge Graph",
+        configCommand: "oxygen knowledge agent",
+        configApiPath: "/api/cli/knowledge/agent",
+        mcpConfigTools: ["oxygen_knowledge_agent_get", "oxygen_knowledge_agent_set"],
+        approvalPosture: "Writes working knowledge pages as logged revisions; canonical and pinned pages still require proposal approval.",
+        deepLinkKind: "knowledge_agent",
+    },
+];
+/** True when `value` is one of the three implemented specialist slugs. */
+export function isWorkspaceAgentSlug(value) {
+    return (typeof value === "string" &&
+        WORKSPACE_AGENT_ROSTER.some((descriptor) => descriptor.slug === value));
+}
+/** The descriptor for `slug`, or `undefined` when it is not a known specialist. */
+export function getWorkspaceAgentDescriptor(slug) {
+    return WORKSPACE_AGENT_ROSTER.find((descriptor) => descriptor.slug === slug);
+}
+/** Every specialist slug, in roster order. */
+export function workspaceAgentSlugs() {
+    return WORKSPACE_AGENT_ROSTER.map((descriptor) => descriptor.slug);
+}

package/node_modules/@oxygen/workflows/dist/index.js

@@ -1293,13 +1293,94 @@ function validatePureFunctionSource(source, path, add) {
         }
     }
 }
+// Blank out comment bodies and string/template-literal *text* so the unsafe-token
+// scan matches only real code identifiers — not a bundle comment ("closed-loop
+// eval") or a string ("retrieval"), which the raw \b-boundary scan flagged as
+// false positives. A real eval(...) or new Function(...) — including inside a
+// `${ ... }` template interpolation, which stays code — is still caught.
+// @oxygen/workflows ships no AST parser, so this is a small hand-rolled lexer;
+// the vm sandbox + runtime global guards remain the actual security boundary.
+function stripCommentsAndStrings(source) {
+    const out = [];
+    const stack = [{ mode: "code", braces: 0 }];
+    let i = 0;
+    const n = source.length;
+    while (i < n) {
+        const top = stack[stack.length - 1];
+        const ch = source[i];
+        const next = i + 1 < n ? source[i + 1] : "";
+        if (top.mode === "template") {
+            if (ch === "\\") {
+                i += 2;
+                continue;
+            }
+            if (ch === "`") {
+                stack.pop();
+                i += 1;
+                continue;
+            }
+            if (ch === "$" && next === "{") {
+                stack.push({ mode: "code", braces: 0 });
+                out.push(" ");
+                i += 2;
+                continue;
+            }
+            i += 1; // drop template text
+            continue;
+        }
+        if (ch === "/" && next === "/") {
+            i += 2;
+            while (i < n && source[i] !== "\n")
+                i += 1;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            i += 2;
+            while (i < n && !(source[i] === "*" && source[i + 1] === "/"))
+                i += 1;
+            i = Math.min(i + 2, n);
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            const quote = ch;
+            i += 1;
+            while (i < n && source[i] !== quote)
+                i += source[i] === "\\" ? 2 : 1;
+            i += 1;
+            out.push('""');
+            continue;
+        }
+        if (ch === "`") {
+            stack.push({ mode: "template" });
+            i += 1;
+            continue;
+        }
+        if (ch === "}" && top.braces === 0 && stack.length > 1) {
+            stack.pop();
+            out.push(" ");
+            i += 1;
+            continue;
+        }
+        if (ch === "{")
+            top.braces += 1;
+        else if (ch === "}")
+            top.braces = Math.max(0, top.braces - 1);
+        out.push(ch);
+        i += 1;
+    }
+    return out.join("");
+}
 function validateRecipeBundleSafety(source, path, add) {
     if (!source.trim()) {
         add(path, "empty_recipe_bundle", "Recipe bundle cannot be empty.");
         return;
     }
+    // Scan only real code: comments and string literals are blanked first so a
+    // token that merely appears in prose or data (e.g. "eval" in a comment) does
+    // not trip the lint, while genuine calls survive.
+    const scannable = stripCommentsAndStrings(source);
     for (const entry of UNSAFE_RECIPE_BUNDLE_PATTERNS) {
-        if (entry.pattern.test(source)) {
+        if (entry.pattern.test(scannable)) {
             add(path, "unsafe_recipe_bundle", `Durable recipe bundle cannot reference '${entry.token}'. Use ctx.tools.run(), ctx.step(), ctx.now(), or ctx.uuid() instead.`);
             return;
         }
@@ -1547,7 +1628,10 @@ function isRecord(value) {
 function isNonEmptyString(value) {
     return typeof value === "string" && value.trim().length > 0;
 }
-// --- Workflow run spend cap (max_credits) -------------------------------
+// The canonical list of internal workflow tool ids lives in @oxygen/tools
+// (OXYGEN_INTERNAL_WORKFLOW_TOOL_IDS). Both the worker's runtime registry and the
+// web's lint allowlist derive from it, so re-declaring it here would recreate
+// exactly the drift that broke crm-sync.
 // Live `workflows call` requests carry an approved max_credits spend cap in
 // the run's metadata (R-E.22(c)). These pure helpers are the single source of
 // truth for reading that cap and deciding whether the next paid tool step may

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.310.2",
+  "version": "1.334.3",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",