@oxygen-agent/cli 1.50.37 → 1.98.7

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation and support, visit https://oxygen-agent.com.
 
-Version: 1.50.37
+Version: 1.98.7

package/dist/browser-login.js

@@ -44,7 +44,7 @@ export async function createBrowserLoginSession(apiUrl) {
         cli_state: state,
         source: "oxygen_cli",
     });
-    const redirectPath = `/settings/api-keys?${redirectParams.toString()}`;
+    const redirectPath = `/settings/cli?${redirectParams.toString()}`;
     const verificationUrl = new URL("/auth/sign-in", apiUrl);
     verificationUrl.searchParams.set("redirect_url", redirectPath);
     verificationUrl.searchParams.set("source", "oxygen_cli");

package/dist/credentials.d.ts

@@ -1,6 +1,22 @@
+export type StoredProfileIdentity = {
+    organization: StoredOrganization | null;
+    user: {
+        id: string;
+        email: string | null;
+    };
+    capturedAt: string;
+};
+export type StoredOrganization = {
+    id: string;
+    slug: string | null;
+    name: string;
+};
 export type StoredCredentials = {
     token: string;
     apiUrl: string;
+    authKind?: "org_api_key" | "user_session";
+    activeOrganization?: StoredOrganization | null;
+    identity?: StoredProfileIdentity;
 };
 export type CredentialProfile = StoredCredentials & {
     name: string;
@@ -23,5 +39,22 @@ export declare function clearCredentials(env?: NodeJS.ProcessEnv, options?: {
     remainingProfiles: number;
 }>;
 export declare function listCredentialProfiles(env?: NodeJS.ProcessEnv): Promise<CredentialProfilesState>;
+export type ProfileResolution = {
+    name: string;
+    source: "env" | "file" | "default";
+    credentials: StoredCredentials | null;
+    exists: boolean;
+};
+export declare function resolveActiveProfile(env?: NodeJS.ProcessEnv): Promise<ProfileResolution>;
+export declare function findProfileNameByOrganizationId(organizationId: string, env?: NodeJS.ProcessEnv): Promise<string | null>;
+export declare function pickProfileNameForIdentity(organizationId: string, candidateSeed: string, env?: NodeJS.ProcessEnv): Promise<{
+    name: string;
+    renamed: boolean;
+}>;
+export declare function pickProfileNameForUserSession(userId: string, candidateSeed: string, env?: NodeJS.ProcessEnv): Promise<{
+    name: string;
+    renamed: boolean;
+}>;
 export declare function switchCredentialProfile(profile: string, env?: NodeJS.ProcessEnv): Promise<CredentialProfile>;
+export declare function updateActiveOrganizationForProfile(profile: string, organization: StoredOrganization, env?: NodeJS.ProcessEnv): Promise<CredentialProfile>;
 export declare function normalizeApiUrl(value: string): string;

package/dist/credentials.js

@@ -16,10 +16,14 @@ export function defaultApiUrl(env = process.env) {
 export async function loadCredentials(env = process.env) {
     const envToken = readEnvToken(env);
     if (envToken) {
-        return {
+        const credentials = {
             token: envToken,
             apiUrl: defaultApiUrl(env),
         };
+        const authKind = inferAuthKind(envToken);
+        if (authKind)
+            credentials.authKind = authKind;
+        return credentials;
     }
     const document = await readSystemCredentialDocument(env);
     if (!document)
@@ -43,9 +47,22 @@ export async function saveCredentials(credentials, env = process.env, options =
         token: credentials.token,
         apiUrl: normalizeApiUrl(credentials.apiUrl),
     };
+    if (credentials.authKind)
+        normalized.authKind = credentials.authKind;
+    if (credentials.activeOrganization !== undefined) {
+        normalized.activeOrganization = credentials.activeOrganization;
+    }
+    if (credentials.identity)
+        normalized.identity = credentials.identity;
     const existing = await readSystemCredentialDocument(env);
     const profile = normalizeProfileName(options.profile ?? readEnvProfile(env) ?? existing?.activeProfile ?? DEFAULT_PROFILE_NAME);
     const profiles = existing ? readProfiles(existing) : {};
+    if (!normalized.identity) {
+        const prior = profiles[profile];
+        if (prior?.identity && prior.token === normalized.token) {
+            normalized.identity = prior.identity;
+        }
+    }
     profiles[profile] = normalized;
     const activeProfile = options.activate === false
         ? readProfileName(existing?.activeProfile) ?? profile
@@ -88,12 +105,18 @@ export async function clearCredentials(env = process.env, options = {}) {
 export async function listCredentialProfiles(env = process.env) {
     const envToken = readEnvToken(env);
     if (envToken) {
+        const credentials = {
+            token: envToken,
+            apiUrl: defaultApiUrl(env),
+        };
+        const authKind = inferAuthKind(envToken);
+        if (authKind)
+            credentials.authKind = authKind;
         return {
             activeProfile: readEnvProfile(env) ?? "env",
             profiles: [{
                     name: readEnvProfile(env) ?? "env",
-                    token: envToken,
-                    apiUrl: defaultApiUrl(env),
+                    ...credentials,
                 }],
         };
     }
@@ -116,6 +139,73 @@ export async function listCredentialProfiles(env = process.env) {
         }),
     };
 }
+export async function resolveActiveProfile(env = process.env) {
+    const envProfile = readEnvProfile(env);
+    const document = await readSystemCredentialDocument(env);
+    const profiles = document ? readProfiles(document) : {};
+    const fileActive = readProfileName(document?.activeProfile);
+    const candidate = envProfile ?? fileActive ?? DEFAULT_PROFILE_NAME;
+    const credentials = profiles[candidate] ?? null;
+    const source = envProfile
+        ? "env"
+        : fileActive
+            ? "file"
+            : "default";
+    return { name: candidate, source, credentials, exists: Boolean(credentials) };
+}
+export async function findProfileNameByOrganizationId(organizationId, env = process.env) {
+    const document = await readSystemCredentialDocument(env);
+    if (!document)
+        return null;
+    const profiles = readProfiles(document);
+    for (const [name, credentials] of Object.entries(profiles)) {
+        if (credentials.identity?.organization?.id === organizationId)
+            return name;
+        if (credentials.activeOrganization?.id === organizationId)
+            return name;
+    }
+    return null;
+}
+export async function pickProfileNameForIdentity(organizationId, candidateSeed, env = process.env) {
+    const document = await readSystemCredentialDocument(env);
+    const profiles = document ? readProfiles(document) : {};
+    const existingForOrg = Object.entries(profiles).find(([, credentials]) => credentials.identity?.organization?.id === organizationId ||
+        credentials.activeOrganization?.id === organizationId);
+    if (existingForOrg)
+        return { name: existingForOrg[0], renamed: false };
+    const base = normalizeProfileName(candidateSeed);
+    if (!profiles[base])
+        return { name: base, renamed: false };
+    for (let suffix = 2; suffix < 1000; suffix++) {
+        const next = `${base}-${suffix}`;
+        if (!profiles[next])
+            return { name: next, renamed: true };
+    }
+    throw new OxygenError("profile_collision", "Unable to derive a unique CLI profile name.", {
+        details: { base },
+        exitCode: 1,
+    });
+}
+export async function pickProfileNameForUserSession(userId, candidateSeed, env = process.env) {
+    const document = await readSystemCredentialDocument(env);
+    const profiles = document ? readProfiles(document) : {};
+    const existingForUser = Object.entries(profiles).find(([, credentials]) => credentials.authKind === "user_session" &&
+        credentials.identity?.user.id === userId);
+    if (existingForUser)
+        return { name: existingForUser[0], renamed: false };
+    const base = normalizeProfileName(candidateSeed);
+    if (!profiles[base])
+        return { name: base, renamed: false };
+    for (let suffix = 2; suffix < 1000; suffix++) {
+        const next = `${base}-${suffix}`;
+        if (!profiles[next])
+            return { name: next, renamed: true };
+    }
+    throw new OxygenError("profile_collision", "Unable to derive a unique CLI profile name.", {
+        details: { base },
+        exitCode: 1,
+    });
+}
 export async function switchCredentialProfile(profile, env = process.env) {
     const document = await readSystemCredentialDocument(env);
     if (!document) {
@@ -135,6 +225,35 @@ export async function switchCredentialProfile(profile, env = process.env) {
     await writeCredentialDocument({ profiles, activeProfile: profileName }, env);
     return { name: profileName, ...credentials };
 }
+export async function updateActiveOrganizationForProfile(profile, organization, env = process.env) {
+    const document = await readSystemCredentialDocument(env);
+    if (!document) {
+        throw new OxygenError("not_logged_in", "Run `oxygen login` before selecting an organization.", {
+            exitCode: 1,
+        });
+    }
+    const profileName = normalizeProfileName(profile);
+    const profiles = readProfiles(document);
+    const credentials = profiles[profileName];
+    if (!credentials) {
+        throw new OxygenError("profile_not_found", `Oxygen CLI profile "${profileName}" is not stored.`, {
+            details: { profile: profileName },
+            exitCode: 1,
+        });
+    }
+    const updated = {
+        ...credentials,
+        activeOrganization: organization,
+    };
+    if (credentials.identity)
+        updated.identity = { ...credentials.identity, organization };
+    profiles[profileName] = updated;
+    await writeCredentialDocument({
+        profiles,
+        activeProfile: readProfileName(document.activeProfile) ?? profileName,
+    }, env);
+    return { name: profileName, ...updated };
+}
 export function normalizeApiUrl(value) {
     const trimmed = value.trim();
     if (!trimmed)
@@ -231,6 +350,8 @@ async function writeCredentialDocument(input, env) {
         activeProfile: input.activeProfile,
         profiles: input.profiles,
     };
+    if (activeCredentials.identity)
+        document.identity = activeCredentials.identity;
     await writeSystemCredentialPayload(serializeCredentialDocument(document), env);
 }
 function credentialStore(env) {
@@ -392,7 +513,7 @@ async function deleteWindowsCredentialManager(env) {
 [void][OxygenCredMan]::CredDelete("${SERVICE_NAME}", 1, 0)
 `, env).catch(() => undefined);
 }
-async function runPowerShell(script, env) {
+function runPowerShell(script, env) {
     const encodedCommand = Buffer.from(script, "utf16le").toString("base64");
     return execFileAsync(windowsPowerShellCommand(env), [
         "-NoProfile",
@@ -423,7 +544,7 @@ function credentialStoreError(operation, store, error) {
     return new OxygenError("credential_store_failed", `Unable to ${operation} Oxygen CLI credentials in ${store}.`, { details, exitCode: 1 });
 }
 function sanitizeCredentialErrorText(value) {
-    return value.replace(/\boxy_live_[A-Za-z0-9_-]+\b/g, "[redacted_token]");
+    return value.replace(/\boxy_(?:live|user)_[A-Za-z0-9_-]+\b/g, "[redacted_token]");
 }
 function macOSSecurityCommand(env) {
     return env.OXYGEN_SECURITY_COMMAND?.trim() || "security";
@@ -516,16 +637,81 @@ function parseStoredCredentialsObject(value) {
         return null;
     if (typeof apiUrl !== "string" || !apiUrl.trim())
         return null;
-    return { token: token.trim(), apiUrl: normalizeApiUrl(apiUrl) };
+    const credentials = {
+        token: token.trim(),
+        apiUrl: normalizeApiUrl(apiUrl),
+    };
+    const authKind = value.authKind;
+    if (authKind === "org_api_key" || authKind === "user_session") {
+        credentials.authKind = authKind;
+    }
+    else {
+        const inferredAuthKind = inferAuthKind(credentials.token);
+        if (inferredAuthKind)
+            credentials.authKind = inferredAuthKind;
+    }
+    const activeOrganization = parseStoredOrganization(value.activeOrganization);
+    if (activeOrganization)
+        credentials.activeOrganization = activeOrganization;
+    const identity = parseStoredProfileIdentity(value.identity);
+    if (identity)
+        credentials.identity = identity;
+    return credentials;
+}
+function parseStoredProfileIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    const org = record.organization;
+    const user = record.user;
+    if (!user || typeof user !== "object" || Array.isArray(user))
+        return null;
+    const userRecord = user;
+    const organization = parseStoredOrganization(org);
+    const userId = typeof userRecord.id === "string" ? userRecord.id.trim() : "";
+    if (!userId)
+        return null;
+    const userEmail = typeof userRecord.email === "string" && userRecord.email.trim()
+        ? userRecord.email.trim()
+        : null;
+    const capturedAt = typeof record.capturedAt === "string" && record.capturedAt.trim()
+        ? record.capturedAt.trim()
+        : new Date(0).toISOString();
+    return {
+        organization,
+        user: { id: userId, email: userEmail },
+        capturedAt,
+    };
+}
+function parseStoredOrganization(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    const id = typeof record.id === "string" ? record.id.trim() : "";
+    const name = typeof record.name === "string" ? record.name : "";
+    if (!id || !name)
+        return null;
+    const slug = typeof record.slug === "string" && record.slug.trim()
+        ? record.slug.trim()
+        : null;
+    return { id, slug, name };
 }
 function readProfiles(document) {
     const profiles = {};
     const rawProfiles = document.profiles ?? {};
     for (const [name, credentials] of Object.entries(rawProfiles)) {
-        profiles[normalizeProfileName(name)] = {
+        const normalized = {
             token: credentials.token,
             apiUrl: normalizeApiUrl(credentials.apiUrl),
         };
+        if (credentials.authKind)
+            normalized.authKind = credentials.authKind;
+        if (credentials.activeOrganization !== undefined) {
+            normalized.activeOrganization = credentials.activeOrganization;
+        }
+        if (credentials.identity)
+            normalized.identity = credentials.identity;
+        profiles[normalizeProfileName(name)] = normalized;
     }
     if (Object.keys(profiles).length === 0) {
         const defaultCredentials = parseStoredCredentialsObject(document);
@@ -538,3 +724,10 @@ function readEnvToken(env) {
     const token = env.OXYGEN_API_KEY ?? env.OXYGEN_TOKEN;
     return token?.trim() || null;
 }
+function inferAuthKind(token) {
+    if (token.startsWith("oxy_user_"))
+        return "user_session";
+    if (token.startsWith("oxy_live_"))
+        return "org_api_key";
+    return undefined;
+}

package/dist/http-client.d.ts

@@ -2,10 +2,14 @@ import { type StoredCredentials } from "./credentials.js";
 type RequestOptions = {
     method?: "GET" | "POST" | "DELETE";
     body?: Record<string, unknown>;
+    formData?: FormData;
     credentials?: StoredCredentials;
     requireAuth?: boolean;
     timeoutMs?: number;
+    traceId?: string;
     fetch?: typeof fetch;
+    selectedOrganization?: string;
 };
-export declare function requestOxygen<T>(path: string, options?: RequestOptions): Promise<T>;
+export declare function requestOxygen<T>(// skipcq: JS-R1005
+path: string, options?: RequestOptions): Promise<T>;
 export {};

package/dist/http-client.js

@@ -2,7 +2,8 @@ import { OXYGEN_VERSION, OxygenError } from "@oxygen/shared";
 import { randomUUID } from "node:crypto";
 import { defaultApiUrl, loadCredentials } from "./credentials.js";
 const DEFAULT_REQUEST_TIMEOUT_MS = 120_000;
-export async function requestOxygen(path, options = {}) {
+export async function requestOxygen(// skipcq: JS-R1005
+path, options = {}) {
     const credentials = options.credentials
         ?? (options.requireAuth === false ? null : await loadCredentials());
     if (!credentials && options.requireAuth !== false) {
@@ -11,7 +12,7 @@ export async function requestOxygen(path, options = {}) {
         });
     }
     const apiUrl = credentials?.apiUrl ?? defaultApiUrl();
-    const traceId = randomUUID();
+    const traceId = options.traceId ?? randomUUID();
     const headers = {
         Accept: "application/json",
         "X-Oxygen-Trace-Id": traceId,
@@ -20,6 +21,13 @@ export async function requestOxygen(path, options = {}) {
     if (credentials?.token) {
         headers.Authorization = `Bearer ${credentials.token}`;
     }
+    const selectedOrganization = resolveSelectedOrganization(credentials, options.selectedOrganization);
+    if (selectedOrganization) {
+        headers["X-Oxygen-Organization"] = selectedOrganization;
+    }
+    if (options.body && options.formData) {
+        throw new OxygenError("invalid_request", "Pass body or formData, not both.", { exitCode: 1 });
+    }
     if (options.body) {
         headers["Content-Type"] = "application/json";
     }
@@ -31,6 +39,7 @@ export async function requestOxygen(path, options = {}) {
         method: options.method ?? "GET",
         headers,
         ...(options.body ? { body: JSON.stringify(options.body) } : {}),
+        ...(options.formData ? { body: options.formData } : {}),
     };
     if (timeout.signal)
         requestInit.signal = timeout.signal;
@@ -44,6 +53,7 @@ export async function requestOxygen(path, options = {}) {
                     api_url: apiUrl,
                     path,
                     timeout_ms: timeoutMs,
+                    trace_id: traceId,
                 },
                 exitCode: 1,
             });
@@ -72,6 +82,17 @@ export async function requestOxygen(path, options = {}) {
     }
     return envelope.data;
 }
+function resolveSelectedOrganization(credentials, explicit) {
+    const fromOption = explicit?.trim();
+    if (fromOption)
+        return fromOption;
+    const fromEnv = process.env.OXYGEN_ORG?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return credentials?.activeOrganization?.slug
+        ?? credentials?.activeOrganization?.id
+        ?? null;
+}
 const staleCliWarningVersions = new Set();
 function warnIfCliIsOlderThanApi(serverVersion) {
     if (!serverVersion || staleCliWarningVersions.has(serverVersion))