@oxygen-agent/cli 1.365.3 → 1.575.19

package/node_modules/@oxygen/shared/dist/log.js

@@ -57,9 +57,50 @@ function reserveSurfaceDimension(merged, ctx) {
         surface: ctx.surface,
     };
 }
-let logSink = null;
+// The sink registration must live on globalThis, not in a module-local variable:
+// Next.js compiles instrumentation.ts and each route handler into separate
+// bundles, each with its OWN instance of this module. A module-local set by the
+// web log shipper (which starts in instrumentation) is invisible to route
+// handlers — exactly why only startup-context lines (the shipper beacon, the
+// framework console filter) ever shipped flat while 4k+ route-emitted
+// error/warn lines/day stayed drain-only (2026-07-21). globalThis is the one
+// object all bundle copies share; Symbol.for gives every copy the same slot.
+// Same trap + same fix as linkedin-quota's enforcer registration.
+const LOG_SINK_SLOT = Symbol.for("oxygen.log.sink");
 export function setLogSink(sink) {
-    logSink = sink;
+    globalThis[LOG_SINK_SLOT] = sink;
+}
+function getLogSink() {
+    return globalThis[LOG_SINK_SLOT] ?? null;
+}
+const LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };
+/**
+ * Minimum level that reaches the Axiom SINK. stdout is deliberately untouched —
+ * `flyctl logs`, `vercel logs`, and local runs keep every line, so nothing becomes
+ * un-debuggable; this only decides what we pay to store and query.
+ *
+ * Default `info`, i.e. debug never ships. Until 2026-07-31 `log()` had no level gate
+ * at all, so debug lines were shipped exactly like info — which contradicted the code
+ * that chose debug specifically to stay quiet (see the `work_queue.wake.failed` call
+ * in packages/work-queue/src/wake-client.ts: "Log at debug level so this doesn't
+ * generate noise during deploys" — it generated 10k rows/week regardless). Measured
+ * the day this landed: debug was 97,704 rows/day of `oxygen-logs`, 24% of all
+ * in-process rows, and 98% of that was a single `crm_person_photo_cycle_skipped`
+ * line reporting that nothing happened.
+ *
+ * Set `OXYGEN_LOG_SHIP_MIN_LEVEL=debug` to restore the old behaviour (e.g. while
+ * debugging a specific incident), or raise it to `warn` to ship only actionable lines.
+ */
+function shipMinRank() {
+    const configured = process.env.OXYGEN_LOG_SHIP_MIN_LEVEL?.trim().toLowerCase();
+    if (configured
+        && Object.prototype.hasOwnProperty.call(LEVEL_RANK, configured)) {
+        return LEVEL_RANK[configured];
+    }
+    return LEVEL_RANK.info;
+}
+function shouldShip(level) {
+    return LEVEL_RANK[level] >= shipMinRank();
 }
 export function log(level, msg, fields) {
     const context = getLogContext();
@@ -89,6 +130,9 @@ export function log(level, msg, fields) {
     else {
         console.log(line);
     }
+    if (!shouldShip(level))
+        return;
+    const logSink = getLogSink();
     if (!logSink)
         return;
     try {
@@ -118,8 +162,16 @@ function hashErrorKey(input) {
 export function errorId(err) {
     if (!(err instanceof Error))
         return "non_error";
-    const firstFrame = (err.stack ?? "").split("\n").slice(1, 2).join("");
-    return hashErrorKey(`${err.name}:${err.message}:${firstFrame}`);
+    // A drizzle DrizzleQueryError carries the bound parameter values inside its
+    // own message (`Failed query: <sql>\nparams: <values>`), which also makes
+    // stack line 1 the `params:` continuation instead of a frame. Hashing either
+    // raw gave every repetition of one DB failure its own id — 101 identical
+    // oxygen_lead_db_cache.write_failed events grouped as 101 buckets of one, and
+    // the hash input was derived from customer row values (OXY-46). Redact the
+    // params tail and hash the first real frame so DB errors group again.
+    const message = redactSqlParameters(err.message);
+    const firstFrame = (err.stack ?? "").split("\n").find((line) => /^\s+at\s/.test(line)) ?? "";
+    return hashErrorKey(`${err.name}:${message}:${firstFrame}`);
 }
 export function errorFields(err) {
     if (err instanceof Error) {

package/node_modules/@oxygen/shared/dist/microsoft-consent-url.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Normalize a Microsoft Entra admin-consent URL for an operator handoff.
+ *
+ * Provider responses are external input. Only Microsoft's documented HTTPS
+ * login host and either provider-supported admin-consent path may become clickable.
+ */
+export declare function normalizeMicrosoftAdminConsentUrl(value: unknown): string | null;

package/node_modules/@oxygen/shared/dist/microsoft-consent-url.js

@@ -0,0 +1,29 @@
+const MICROSOFT_LOGIN_HOST = "login.microsoftonline.com";
+const ADMIN_CONSENT_PATH = /^\/(?:[^/]+\/)?adminconsent\/?$/i;
+/**
+ * Normalize a Microsoft Entra admin-consent URL for an operator handoff.
+ *
+ * Provider responses are external input. Only Microsoft's documented HTTPS
+ * login host and either provider-supported admin-consent path may become clickable.
+ */
+export function normalizeMicrosoftAdminConsentUrl(value) {
+    if (typeof value !== "string" || value.trim() === "")
+        return null;
+    let url;
+    try {
+        url = new URL(value.trim());
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:" ||
+        url.hostname.toLowerCase() !== MICROSOFT_LOGIN_HOST ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.port !== "" ||
+        url.hash !== "" ||
+        !ADMIN_CONSENT_PATH.test(url.pathname)) {
+        return null;
+    }
+    return url.toString();
+}

package/node_modules/@oxygen/shared/dist/object-storage.d.ts

@@ -7,7 +7,12 @@ export declare function buildPublishingMediaObjectKey(input: {
     organizationId: string;
     fileName?: string | null;
 }): string;
+export declare function buildCopilotAttachmentObjectKey(input: {
+    organizationId: string;
+    fileName?: string | null;
+}): string;
 export declare function isImportObjectKeyForOrganization(key: string, organizationId: string): boolean;
+export declare function isCopilotAttachmentObjectKeyForOrganization(key: string, organizationId: string): boolean;
 export declare function isPublishingMediaObjectKeyForOrganization(key: string, organizationId: string): boolean;
 export type PresignedImportUpload = {
     uploadUrl: string;
@@ -30,6 +35,32 @@ export declare function presignPublishingMediaUpload(input: {
     contentType?: string | null;
     contentLength: number;
 }): Promise<PresignedPublishingMediaUpload>;
+export declare function presignCopilotAttachmentUpload(input: {
+    organizationId: string;
+    fileName?: string | null;
+    contentType?: string | null;
+    contentLength: number;
+}): Promise<PresignedImportUpload>;
+/**
+ * Read an uploaded attachment back into memory. Bounded by `maxBytes` because
+ * the callers are a CSV header sniff and a text extraction, neither of which
+ * needs the whole object — and a 400MB upload must not become a 400MB buffer in
+ * a Vercel handler.
+ */
+export declare function readCopilotAttachmentObject(input: {
+    storageKey: string;
+    maxBytes: number;
+}): Promise<{
+    body: Uint8Array;
+    contentType: string | null;
+    truncated: boolean;
+}>;
+export declare function getCopilotAttachmentObjectMetadata(input: {
+    storageKey: string;
+}): Promise<{
+    contentLength: number | null;
+    contentType: string | null;
+}>;
 export declare function getImportObjectMetadata(input: {
     storageKey: string;
 }): Promise<{

package/node_modules/@oxygen/shared/dist/object-storage.js

@@ -65,9 +65,16 @@ export function buildPublishingMediaObjectKey(input) {
     const safeName = sanitizeFileName(input.fileName) || "media";
     return `publishing-media/${input.organizationId}/${randomUUID()}/${safeName}`;
 }
+export function buildCopilotAttachmentObjectKey(input) {
+    const safeName = sanitizeFileName(input.fileName) || "attachment";
+    return `copilot/${input.organizationId}/${randomUUID()}/${safeName}`;
+}
 export function isImportObjectKeyForOrganization(key, organizationId) {
     return key.startsWith(`imports/${organizationId}/`);
 }
+export function isCopilotAttachmentObjectKeyForOrganization(key, organizationId) {
+    return key.startsWith(`copilot/${organizationId}/`);
+}
 export function isPublishingMediaObjectKeyForOrganization(key, organizationId) {
     return key.startsWith(`publishing-media/${organizationId}/`);
 }
@@ -115,6 +122,60 @@ export async function presignPublishingMediaUpload(input) {
         expiresInSeconds: PRESIGN_EXPIRY_SECONDS,
     };
 }
+export async function presignCopilotAttachmentUpload(input) {
+    const { client, config } = resolveClient();
+    const storageKey = buildCopilotAttachmentObjectKey({
+        organizationId: input.organizationId,
+        fileName: input.fileName ?? null,
+    });
+    const command = new PutObjectCommand({
+        Bucket: config.bucket,
+        Key: storageKey,
+        ContentLength: input.contentLength,
+        ...(input.contentType ? { ContentType: input.contentType } : {}),
+    });
+    const uploadUrl = await getSignedUrl(client, command, { expiresIn: PRESIGN_EXPIRY_SECONDS });
+    return {
+        uploadUrl,
+        bucket: config.bucket,
+        storageKey,
+        contentLength: input.contentLength,
+        provider: "s3",
+        expiresInSeconds: PRESIGN_EXPIRY_SECONDS,
+    };
+}
+/**
+ * Read an uploaded attachment back into memory. Bounded by `maxBytes` because
+ * the callers are a CSV header sniff and a text extraction, neither of which
+ * needs the whole object — and a 400MB upload must not become a 400MB buffer in
+ * a Vercel handler.
+ */
+export async function readCopilotAttachmentObject(input) {
+    const { client, config } = resolveClient();
+    const result = await client.send(new GetObjectCommand({
+        Bucket: config.bucket,
+        Key: input.storageKey,
+        // Ask for one byte past the cap so a full read is distinguishable from a
+        // file that happens to be exactly maxBytes long.
+        Range: `bytes=0-${input.maxBytes}`,
+    }));
+    const raw = await result.Body?.transformToByteArray();
+    const body = raw ?? new Uint8Array();
+    const truncated = body.byteLength > input.maxBytes;
+    return {
+        body: truncated ? body.subarray(0, input.maxBytes) : body,
+        contentType: typeof result.ContentType === "string" ? result.ContentType : null,
+        truncated,
+    };
+}
+export async function getCopilotAttachmentObjectMetadata(input) {
+    const { client, config } = resolveClient();
+    const result = await client.send(new HeadObjectCommand({ Bucket: config.bucket, Key: input.storageKey }));
+    return {
+        contentLength: typeof result.ContentLength === "number" ? result.ContentLength : null,
+        contentType: typeof result.ContentType === "string" ? result.ContentType : null,
+    };
+}
 export async function getImportObjectMetadata(input) {
     const { client, config } = resolveClient();
     const result = await client.send(new HeadObjectCommand({ Bucket: config.bucket, Key: input.storageKey }));