@oxygen-agent/cli 1.310.3 → 1.336.1

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.310.3
+Version: 1.336.1

package/dist/browser-login.d.ts

@@ -3,5 +3,21 @@ export type BrowserLoginSession = {
     waitForToken: () => Promise<string>;
     close: () => Promise<void>;
 };
+export type RelayLoginSession = BrowserLoginSession & {
+    confirmationCode: string;
+};
+/**
+ * Relay browser login (device-flow style): register a login request
+ * server-side, send the user to /settings/cli to approve it, and poll the
+ * claim endpoint until the session token is released. No loopback server is
+ * involved, so it works where the browser→localhost POST cannot: browsers
+ * enforcing the Local Network Access permission, SSH/WSL/remote terminals,
+ * containers. Any failure to CREATE the request (old server without the
+ * endpoint, network policy) is the caller's cue to fall back to the legacy
+ * loopback flow.
+ */
+export declare function createRelayLoginSession(apiUrl: string, options?: {
+    fetch?: typeof fetch;
+}): Promise<RelayLoginSession>;
 export declare function createBrowserLoginSession(apiUrl: string): Promise<BrowserLoginSession>;
 export declare function openBrowser(url: string): boolean;

package/dist/browser-login.js

@@ -1,11 +1,141 @@
 import { execFileSync } from "node:child_process";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
-import { OxygenError } from "@oxygen/shared";
+import { hostname } from "node:os";
+import { OXYGEN_VERSION, OxygenError, deriveCliLoginConfirmationCode } from "@oxygen/shared";
+import { requestOxygen } from "./http-client.js";
 import { readErrorMessage } from "./util.js";
 const CALLBACK_HOST = "127.0.0.1";
 const CALLBACK_PATH = "/cli/login/callback";
 const MAX_CALLBACK_BODY_BYTES = 32_000;
+const RELAY_CREATE_TIMEOUT_MS = 10_000;
+const RELAY_CLAIM_TIMEOUT_MS = 15_000;
+const DEFAULT_RELAY_POLL_INTERVAL_SECONDS = 2;
+const MAX_RELAY_POLL_INTERVAL_SECONDS = 10;
+const MAX_CONSECUTIVE_TRANSIENT_CLAIM_ERRORS = 5;
+// Claim-poll errors that read as infrastructure hiccups rather than a verdict
+// about the login request itself — tolerated a few times before giving up.
+const TRANSIENT_CLAIM_ERROR_CODES = new Set([
+    "network_error",
+    "network_timeout",
+    "invalid_response",
+    "unexpected_error",
+]);
+/**
+ * Relay browser login (device-flow style): register a login request
+ * server-side, send the user to /settings/cli to approve it, and poll the
+ * claim endpoint until the session token is released. No loopback server is
+ * involved, so it works where the browser→localhost POST cannot: browsers
+ * enforcing the Local Network Access permission, SSH/WSL/remote terminals,
+ * containers. Any failure to CREATE the request (old server without the
+ * endpoint, network policy) is the caller's cue to fall back to the legacy
+ * loopback flow.
+ */
+export async function createRelayLoginSession(apiUrl, options = {}) {
+    const state = randomBytes(32).toString("base64url");
+    // Empty token: pins the host to --api-url/profile resolution while sending no
+    // Authorization header — these endpoints are pre-auth by design.
+    const credentials = { token: "", apiUrl };
+    const requestOptions = options.fetch ? { fetch: options.fetch } : {};
+    const created = await requestOxygen("/api/cli/login-requests", {
+        method: "POST",
+        credentials,
+        body: {
+            state,
+            client: {
+                os: process.platform,
+                hostname: safeHostname(),
+                cli_version: OXYGEN_VERSION,
+            },
+        },
+        timeoutMs: RELAY_CREATE_TIMEOUT_MS,
+        ...requestOptions,
+    });
+    const pollIntervalMs = normalizePollIntervalSeconds(created.interval_seconds) * 1000;
+    const redirectParams = new URLSearchParams({
+        cli_state: state,
+        cli_login_request: "1",
+        source: "oxygen_cli",
+    });
+    const verificationUrl = new URL("/auth/sign-in", apiUrl);
+    verificationUrl.searchParams.set("redirect_url", `/settings/cli?${redirectParams.toString()}`);
+    verificationUrl.searchParams.set("source", "oxygen_cli");
+    let closed = false;
+    async function waitForToken() {
+        let transientErrors = 0;
+        while (!closed) {
+            await sleep(pollIntervalMs);
+            if (closed)
+                break;
+            let claim;
+            try {
+                claim = await requestOxygen("/api/cli/login-requests/claim", {
+                    method: "POST",
+                    credentials,
+                    body: { state },
+                    timeoutMs: RELAY_CLAIM_TIMEOUT_MS,
+                    ...requestOptions,
+                });
+            }
+            catch (error) {
+                if (error instanceof OxygenError && error.code === "rate_limit_exceeded") {
+                    await sleep(Math.max(readRetryAfterMs(error), pollIntervalMs));
+                    continue;
+                }
+                if (error instanceof OxygenError && TRANSIENT_CLAIM_ERROR_CODES.has(error.code)) {
+                    transientErrors += 1;
+                    if (transientErrors >= MAX_CONSECUTIVE_TRANSIENT_CLAIM_ERRORS)
+                        throw error;
+                    continue;
+                }
+                // Typed verdicts (login_request_expired / _not_found / _already_claimed)
+                // and anything else surface immediately.
+                throw error;
+            }
+            transientErrors = 0;
+            if (claim.status === "ready" && typeof claim.token === "string" && claim.token) {
+                return claim.token;
+            }
+        }
+        throw new OxygenError("browser_login_closed", "Browser login closed.", { exitCode: 1 });
+    }
+    return {
+        verificationUrl: verificationUrl.toString(),
+        confirmationCode: deriveCliLoginConfirmationCode(state),
+        waitForToken,
+        close: () => {
+            closed = true;
+            return Promise.resolve();
+        },
+    };
+}
+function normalizePollIntervalSeconds(value) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        return DEFAULT_RELAY_POLL_INTERVAL_SECONDS;
+    }
+    return Math.min(MAX_RELAY_POLL_INTERVAL_SECONDS, Math.max(1, Math.trunc(value)));
+}
+function readRetryAfterMs(error) {
+    const details = error.details;
+    if (details && typeof details === "object" && !Array.isArray(details)) {
+        const seconds = details.retry_after_seconds;
+        if (typeof seconds === "number" && Number.isFinite(seconds) && seconds > 0) {
+            return Math.min(seconds, 60) * 1000;
+        }
+    }
+    return DEFAULT_RELAY_POLL_INTERVAL_SECONDS * 1000;
+}
+function safeHostname() {
+    try {
+        return hostname();
+    }
+    catch {
+        return undefined;
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 export async function createBrowserLoginSession(apiUrl) {
     const state = randomBytes(32).toString("base64url");
     let settled = false;

package/dist/command-manifest.js

@@ -1,15 +1,31 @@
 import { CLI_EXIT_CODE_TABLE, OXYGEN_VERSION } from "@oxygen/shared";
+// Leaf verbs (or their hyphen-prefix) that name a state mutation, external
+// write, or paid side effect. `mutates` is derived from this set (see
+// toManifestEntry). It is hand-curated and cross-checked against the real leaf
+// commands in `oxygen commands --json`: a verb belongs here only if every leaf
+// command it matches is a genuine write. Verbs that also front a read are
+// deliberately excluded so a read is never mislabeled — e.g. `repair`
+// (→ `db repair-preview`) and `request` (→ `egress dedicated request`, a
+// PREVIEW). Object nouns that front paid *reads* (`find company`, `find email`)
+// stay out too: those are flagged by spends_credits, not mutates. When you add
+// a leaf command, verify its verb here against the self-index before trusting
+// the default.
 const MUTATING_VERBS = new Set([
-    "add", "apply", "approve", "archive", "assign", "buy", "cancel", "clear",
-    "configure", "connect", "create", "delete", "disable", "dispatch", "draft",
-    "emit", "enable", "enroll", "grant", "import", "insert", "invite", "launch",
-    "login", "logout", "materialize", "merge", "migrate", "order", "pause",
-    "publish", "purchase", "push", "record", "register", "remove", "rename",
-    "reorder", "reply", "rerun", "reset", "resolve", "restore", "resume",
-    "retry", "retype", "revoke", "rotate", "run", "save", "schedule", "select",
-    "send", "set", "share", "start", "stop", "subscribe", "sync", "unpublish",
-    "unshare", "unsubscribe", "update", "upload", "upsert", "use", "withdraw",
-    "write",
+    "accept", "ack", "add", "adopt", "apply", "approve", "archive",
+    "assign", "attach", "backfill", "buy", "call", "cancel", "clear",
+    "comment", "configure", "connect", "create", "delete", "delist", "disable",
+    "disconnect", "dispatch", "draft", "edit", "emit", "enable", "enroll",
+    "file", "grant", "harvest", "import", "insert", "invite", "launch",
+    "log", "login", "logout", "mark-read", "materialize", "merge", "migrate",
+    "move", "note", "onboard", "order", "pause", "pin", "provision",
+    "publish", "purchase", "purge", "push", "react", "record", "recover-pending",
+    "register", "reject", "relink", "remove", "rename", "reorder", "reply",
+    "rerun", "rescan", "resend", "reset", "resolve", "restore", "resume",
+    "retry", "retype", "revoke", "rotate", "run", "save", "schedule",
+    "seed", "select", "send", "set", "setup", "share", "solve",
+    "start", "stop", "subscribe", "sync", "synthesize", "unpublish", "unshare",
+    "unsubscribe", "update", "upload", "upsert", "use", "warm-send", "warmup",
+    "withdraw", "write",
 ]);
 export function buildCommandManifest(program, binaryName) {
     const commands = [];

package/dist/help.js

@@ -40,6 +40,13 @@ const HELP_GROUPS = [
             "reviews",
         ],
     },
+    {
+        // The built-in specialist agents (Control-layer Workspace Agent), grouped on
+        // their own so a fresh agent finds the roster surface next to the runs/approvals
+        // lenses it governs.
+        heading: "Workspace Agent:",
+        commands: ["agent"],
+    },
     {
         heading: "Automation, billing & admin:",
         commands: [

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 import { Command } from "commander";
+export declare function formatDisabledWorkflowNotices(data: unknown): string[];
 export declare function createProgram(): Command;