@oxygen-agent/cli 1.685.12 → 1.691.5

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.685.12
+Version: 1.691.5

package/dist/index.js

@@ -1169,6 +1169,15 @@ function buildCrmPhotosBody(options) {
         ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
     };
 }
+function buildCrmFieldsBody(options) {
+    const object = readOption(options.object);
+    const limit = readOption(options.limit);
+    return {
+        mode: resolveLiveDryRunMode(options),
+        ...(object ? { objects: object } : {}),
+        ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
+    };
+}
 function buildCrmRollupBody(options) {
     const object = readOption(options.object);
     const row = readOption(options.row);
@@ -3758,6 +3767,19 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: buildCrmPhotosBody(options),
         }));
+    }))
+        .addCommand(new Command("fields")
+        .description("Fill the stored CRM fields (Industry, Employees, HQ, and their siblings) from enrichment data this workspace already holds. These are ordinary text/number fields you can edit \u2014 the fill only ever writes an EMPTY cell, so a value you typed is never overwritten. Free: no provider calls, no credits. Run this once on a workspace whose records were enriched before those fields became editable. Defaults to dry-run.")
+        .option("--object <object>", "Limit the fill to one CRM object (companies, people, deals). Defaults to all.")
+        .option("--limit <n>", "Maximum rows to scan per object. Defaults to 2000.")
+        .option("--dry-run", "Preview how many cells would be filled, without writing.")
+        .option("--live", "Write the extracted values onto the records.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm fields", options, () => requestOxygen("/api/cli/crm/fields", {
+            method: "POST",
+            body: buildCrmFieldsBody(options),
+        }));
     }))
         .addCommand(new Command("rollup")
         .description("Recompute the Open Deal column on companies (and the copy stamped on their people) from this workspace's deals. It normally converges on every deal write; run this to repair after a bulk import, or on a workspace whose deals predate the column. Free: no provider calls, no credits. Defaults to dry-run.")
@@ -11789,9 +11811,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("start")
-        .description("Preview or start a sequence. Preview reports exact per-kind scope, sender/mailbox capacity, CRM connection readiness, and safety caps. Live start requires --approved; --max-credits is optional. Email/WhatsApp/CRM-task journeys additionally require --max-live-sends because their external actions cost 0 Oxygen credits. Use --dry-run to simulate without any send, provider campaign, CRM task, or credits. The first live start also switches on the standing reply → CRM automation for the workspace.")
+        .description("Preview or start a sequence. Without --approved, preview scans pending LinkedIn copy and returns exact rendered recipient samples, character counts/limits, copy blockers, per-kind scope, sender/mailbox capacity, CRM readiness, and safety caps. Live start requires --approved; --max-credits is optional. Email/WhatsApp/CRM-task journeys additionally require --max-live-sends because their external actions cost 0 Oxygen credits. Use --dry-run to simulate without any send, provider campaign, CRM task, or credits. The first live start also switches on the standing reply → CRM automation for the workspace.")
         .argument("<sequence>", "Sequence id or slug.")
-        .option("--approved", "Approve and activate live. Without this flag, returns a preview only.")
+        .option("--approved", "Approve and activate live. Without this flag, returns a preview only, including copy_preview rendered samples and blockers.")
         .option("--max-credits <n>", "Optional credit ceiling for the LinkedIn track (omit for an unbounded run).")
         .option("--max-live-sends <n>", "Live external-action ceiling (positive integer). Required for email, WhatsApp, or crm_task steps.")
         .option("--dry-run", "Activate in dry-run mode: advance every step with simulated actions, no sends, CRM writes, provider calls, or credits.")

package/node_modules/@oxygen/shared/dist/feature-gates.d.ts

@@ -0,0 +1,108 @@
+type FeatureGateEnv = Record<string, string | undefined>;
+/** Where the effective value came from. Precedence is env → remote → default. */
+export type FeatureGateSource = "env_override" | "remote" | "safe_default";
+export type FeatureGateDefinition = {
+    /** PostHog feature-flag key. Lowercase kebab-case by convention. */
+    key: string;
+    /**
+     * The value used whenever the provider has no answer. Pick the value that is
+     * safe to serve indefinitely, not the value you expect: this is what ships
+     * during a vendor outage, and on Vercel it is also what every cold
+     * invocation serves until flag definitions finish loading.
+     */
+    safeDefault: boolean;
+    /**
+     * Optional break-glass env var. Set it to force the gate on/off without
+     * touching the flag service — the only lever that still works when the flag
+     * service is the thing that is broken. Must not name a NEVER_FLAGGABLE key.
+     */
+    envOverride?: string;
+};
+export type FeatureGateResolution = {
+    enabled: boolean;
+    source: FeatureGateSource;
+};
+/**
+ * Env gates that must NEVER become remotely-flippable feature flags, and stay
+ * read directly from `process.env` (Doppler) at their call sites.
+ *
+ * Two disqualifying properties, each fatal on its own:
+ *
+ *   (a) CIRCULARITY — a kill switch for a telemetry vendor cannot be resolved
+ *       through a telemetry vendor. You reach for it precisely when that path is
+ *       misbehaving, so a switch that needs the vendor reachable to be read is
+ *       not a kill switch at all.
+ *   (b) AUTHORIZATION — spend enforcement and external-write enablement. A
+ *       remotely-flippable value means a vendor outage, a mis-click in someone
+ *       else's UI, or a compromised vendor account can uncap credit spend or
+ *       enable public side effects. Hard rules keep those in Doppler, where the
+ *       change is an auditable secret change.
+ *
+ * Per-key rationale (call sites read 2026-08, verified against this base):
+ *
+ * - OXYGEN_TELEMETRY_ENABLED — (a). The master telemetry kill switch, read by
+ *   `apps/web/src/lib/axiom-log-shipper.ts` and `apps/worker/src/telemetry.ts` /
+ *   `log-shipper.ts`. Resolving it remotely makes turning telemetry OFF depend
+ *   on a telemetry vendor being up.
+ * - OXYGEN_LOG_SHIPPING_ENABLED — (a). Same circularity, narrower blast radius
+ *   (log shipping only; `axiom-log-shipper.ts`, `apps/worker/src/log-shipper.ts`).
+ * - OXYGEN_LLM_TRACING_ENABLED — (a) + (b). `packages/shared/src/langfuse.ts`
+ *   fails CLOSED on it because it authorizes egress of full prompt/completion
+ *   payloads to Langfuse (ADR 0014). Where prompt payloads may travel is a data
+ *   boundary, not a rollout. It also lives in this transport-free package, so
+ *   remote resolution would drag a flag client into the published CLI.
+ * - OXYGEN_TRIGGER_DEFAULT_CAPS — (b). Selects log-only vs enforce for the
+ *   plan-tier default per-delivery ceiling on autonomous triggers
+ *   (`apps/worker/src/workflow-spend-cap.ts`). Remote control over spend
+ *   ENFORCEMENT means an outage can uncap autonomous credit spend everywhere.
+ * - OXYGEN_BYOK_DAILY_CAPS — (b). Same, for BYOK per-provider daily caps
+ *   (`packages/providers/src/provider-fetch.ts`) — external money on the
+ *   customer's own keys, and likewise in a package the CLI can reach.
+ * - OXYGEN_PUBLISHING_ENABLED — (b). Fail-closed production switch for posting
+ *   to real provider accounts (`apps/web/src/app/(app)/(dashboard)/publishing/
+ *   data.ts`). Wrong "on" = public posts from customer accounts.
+ * - OXYGEN_AGENTS_ENABLED — (b). Authorizes autonomous Agent run execution —
+ *   tool authority AND credit spend (`apps/web/src/lib/agent-runtime.ts`,
+ *   `apps/worker/src/agent-cycle.ts`). Same class as publishing.
+ *
+ * The list is a guard, not a to-do: none of these is migrated, and
+ * `findFeatureGateRegistryViolations` fails the build's tests if one ever is.
+ */
+export declare const NEVER_FLAGGABLE: readonly string[];
+/**
+ * Every server-side gate resolved through PostHog.
+ *
+ * Intentionally empty: introducing the mechanism is not a reason to move
+ * existing switches onto it. The seven env gates above stay in Doppler, and a
+ * new entry belongs here only when its worst wrong value is a cosmetic or
+ * reversible product difference — never spend, external writes, or telemetry
+ * egress.
+ */
+export declare const FEATURE_GATES: readonly FeatureGateDefinition[];
+/**
+ * Tri-state env parse: `true` / `false` / `null` for "unset or unparseable".
+ *
+ * The null case is load-bearing — an override that is merely absent has to fall
+ * through to the remote value, while an override explicitly set to `false` has
+ * to win over it. Collapsing the two into a boolean would make every gate
+ * without an override permanently forced off.
+ */
+export declare function parseFeatureGateBoolean(value: string | undefined): boolean | null;
+/**
+ * Resolve one gate. Pure: the caller supplies the provider's answer (or
+ * `undefined` when it had none) and the env to read.
+ *
+ * Env override wins over the remote value on purpose. It is the break-glass for
+ * "the flag service is serving the wrong answer", which is worthless if the
+ * flag service outranks it.
+ */
+export declare function resolveFeatureGate(definition: FeatureGateDefinition, remote?: boolean | undefined, env?: FeatureGateEnv): FeatureGateResolution;
+export declare function isNeverFlaggable(name: string): boolean;
+/**
+ * Registry lint, asserted by tests rather than thrown at import time (a gate
+ * registry must never be able to crash a boot). Returns one human-readable
+ * violation per problem; an empty array means the registry is clean.
+ */
+export declare function findFeatureGateRegistryViolations(gates?: readonly FeatureGateDefinition[]): string[];
+export declare function findFeatureGate(key: string): FeatureGateDefinition | undefined;
+export {};

package/node_modules/@oxygen/shared/dist/feature-gates.js

@@ -0,0 +1,153 @@
+// Server-side feature gates (ADR 0021: PostHog owns server-side feature flags).
+//
+// This module is the CONTRACT ONLY — gate definitions, the unflaggable list, and
+// the pure resolver. It is deliberately TRANSPORT-FREE: no `posthog-node`, no
+// fetch, no client, no I/O of any kind. `packages/cli` is published to npm as
+// `@oxygen-agent/cli` and depends on `@oxygen/shared` unbundled, so every import
+// added here becomes a runtime dependency of every customer's CLI install. The
+// evaluation transport lives in `apps/web/src/lib/feature-gate-provider.ts`,
+// which nothing outside the web app imports.
+//
+// The resolver's one invariant: an absent provider answer is not an answer. A
+// flag-service outage, a quota-limited project, a cold lambda whose definitions
+// have not loaded yet, and a flag that simply does not exist all arrive here as
+// `undefined`, and all of them resolve to the gate's `safeDefault`. A gate never
+// flips because a vendor is unreachable.
+/**
+ * Env gates that must NEVER become remotely-flippable feature flags, and stay
+ * read directly from `process.env` (Doppler) at their call sites.
+ *
+ * Two disqualifying properties, each fatal on its own:
+ *
+ *   (a) CIRCULARITY — a kill switch for a telemetry vendor cannot be resolved
+ *       through a telemetry vendor. You reach for it precisely when that path is
+ *       misbehaving, so a switch that needs the vendor reachable to be read is
+ *       not a kill switch at all.
+ *   (b) AUTHORIZATION — spend enforcement and external-write enablement. A
+ *       remotely-flippable value means a vendor outage, a mis-click in someone
+ *       else's UI, or a compromised vendor account can uncap credit spend or
+ *       enable public side effects. Hard rules keep those in Doppler, where the
+ *       change is an auditable secret change.
+ *
+ * Per-key rationale (call sites read 2026-08, verified against this base):
+ *
+ * - OXYGEN_TELEMETRY_ENABLED — (a). The master telemetry kill switch, read by
+ *   `apps/web/src/lib/axiom-log-shipper.ts` and `apps/worker/src/telemetry.ts` /
+ *   `log-shipper.ts`. Resolving it remotely makes turning telemetry OFF depend
+ *   on a telemetry vendor being up.
+ * - OXYGEN_LOG_SHIPPING_ENABLED — (a). Same circularity, narrower blast radius
+ *   (log shipping only; `axiom-log-shipper.ts`, `apps/worker/src/log-shipper.ts`).
+ * - OXYGEN_LLM_TRACING_ENABLED — (a) + (b). `packages/shared/src/langfuse.ts`
+ *   fails CLOSED on it because it authorizes egress of full prompt/completion
+ *   payloads to Langfuse (ADR 0014). Where prompt payloads may travel is a data
+ *   boundary, not a rollout. It also lives in this transport-free package, so
+ *   remote resolution would drag a flag client into the published CLI.
+ * - OXYGEN_TRIGGER_DEFAULT_CAPS — (b). Selects log-only vs enforce for the
+ *   plan-tier default per-delivery ceiling on autonomous triggers
+ *   (`apps/worker/src/workflow-spend-cap.ts`). Remote control over spend
+ *   ENFORCEMENT means an outage can uncap autonomous credit spend everywhere.
+ * - OXYGEN_BYOK_DAILY_CAPS — (b). Same, for BYOK per-provider daily caps
+ *   (`packages/providers/src/provider-fetch.ts`) — external money on the
+ *   customer's own keys, and likewise in a package the CLI can reach.
+ * - OXYGEN_PUBLISHING_ENABLED — (b). Fail-closed production switch for posting
+ *   to real provider accounts (`apps/web/src/app/(app)/(dashboard)/publishing/
+ *   data.ts`). Wrong "on" = public posts from customer accounts.
+ * - OXYGEN_AGENTS_ENABLED — (b). Authorizes autonomous Agent run execution —
+ *   tool authority AND credit spend (`apps/web/src/lib/agent-runtime.ts`,
+ *   `apps/worker/src/agent-cycle.ts`). Same class as publishing.
+ *
+ * The list is a guard, not a to-do: none of these is migrated, and
+ * `findFeatureGateRegistryViolations` fails the build's tests if one ever is.
+ */
+export const NEVER_FLAGGABLE = [
+    "OXYGEN_PUBLISHING_ENABLED",
+    "OXYGEN_AGENTS_ENABLED",
+    "OXYGEN_TELEMETRY_ENABLED",
+    "OXYGEN_LOG_SHIPPING_ENABLED",
+    "OXYGEN_LLM_TRACING_ENABLED",
+    "OXYGEN_TRIGGER_DEFAULT_CAPS",
+    "OXYGEN_BYOK_DAILY_CAPS",
+];
+/**
+ * Every server-side gate resolved through PostHog.
+ *
+ * Intentionally empty: introducing the mechanism is not a reason to move
+ * existing switches onto it. The seven env gates above stay in Doppler, and a
+ * new entry belongs here only when its worst wrong value is a cosmetic or
+ * reversible product difference — never spend, external writes, or telemetry
+ * egress.
+ */
+export const FEATURE_GATES = [];
+/**
+ * Tri-state env parse: `true` / `false` / `null` for "unset or unparseable".
+ *
+ * The null case is load-bearing — an override that is merely absent has to fall
+ * through to the remote value, while an override explicitly set to `false` has
+ * to win over it. Collapsing the two into a boolean would make every gate
+ * without an override permanently forced off.
+ */
+export function parseFeatureGateBoolean(value) {
+    const normalized = value?.trim().toLowerCase();
+    if (!normalized)
+        return null;
+    if (normalized === "true" || normalized === "1" || normalized === "yes")
+        return true;
+    if (normalized === "false" || normalized === "0" || normalized === "no")
+        return false;
+    return null;
+}
+/**
+ * Resolve one gate. Pure: the caller supplies the provider's answer (or
+ * `undefined` when it had none) and the env to read.
+ *
+ * Env override wins over the remote value on purpose. It is the break-glass for
+ * "the flag service is serving the wrong answer", which is worthless if the
+ * flag service outranks it.
+ */
+export function resolveFeatureGate(definition, remote, env = process.env) {
+    const override = definition.envOverride
+        ? parseFeatureGateBoolean(env[definition.envOverride])
+        : null;
+    if (override !== null)
+        return { enabled: override, source: "env_override" };
+    if (typeof remote === "boolean")
+        return { enabled: remote, source: "remote" };
+    return { enabled: definition.safeDefault, source: "safe_default" };
+}
+// Compare env-var names and flag keys in one space, so `oxygen-agents-enabled`
+// as a flag key is caught by a list written in SCREAMING_SNAKE env style.
+function normalizeGateName(name) {
+    return name.trim().toUpperCase().replace(/-/g, "_");
+}
+export function isNeverFlaggable(name) {
+    const normalized = normalizeGateName(name);
+    return NEVER_FLAGGABLE.some((entry) => normalizeGateName(entry) === normalized);
+}
+/**
+ * Registry lint, asserted by tests rather than thrown at import time (a gate
+ * registry must never be able to crash a boot). Returns one human-readable
+ * violation per problem; an empty array means the registry is clean.
+ */
+export function findFeatureGateRegistryViolations(gates = FEATURE_GATES) {
+    const violations = [];
+    const seen = new Set();
+    for (const gate of gates) {
+        if (!gate.key.trim()) {
+            violations.push("A feature gate has an empty key.");
+            continue;
+        }
+        if (seen.has(gate.key))
+            violations.push(`Duplicate feature gate key: ${gate.key}`);
+        seen.add(gate.key);
+        if (isNeverFlaggable(gate.key)) {
+            violations.push(`Feature gate "${gate.key}" names a NEVER_FLAGGABLE switch — it must stay an env gate.`);
+        }
+        if (gate.envOverride && isNeverFlaggable(gate.envOverride)) {
+            violations.push(`Feature gate "${gate.key}" uses NEVER_FLAGGABLE env var "${gate.envOverride}" as its override.`);
+        }
+    }
+    return violations;
+}
+export function findFeatureGate(key) {
+    return FEATURE_GATES.find((gate) => gate.key === key);
+}

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -22,6 +22,7 @@ export * from "./directory.js";
 export * from "./email-tracking-token.js";
 export * from "./email-unsubscribe-token.js";
 export * from "./error-redaction.js";
+export * from "./feature-gates.js";
 export * from "./hosted-ai.js";
 export * from "./identifiers.js";
 export * from "./knowledge-constants.js";

package/node_modules/@oxygen/shared/dist/index.js

@@ -22,6 +22,7 @@ export * from "./directory.js";
 export * from "./email-tracking-token.js";
 export * from "./email-unsubscribe-token.js";
 export * from "./error-redaction.js";
+export * from "./feature-gates.js";
 export * from "./hosted-ai.js";
 export * from "./identifiers.js";
 export * from "./knowledge-constants.js";

package/node_modules/@oxygen/shared/dist/sequence-template.d.ts

@@ -66,6 +66,12 @@ export declare const MAX_SPINTAX_DEPTH = 10;
  * `{{column}}` placeholders render empty; a malformed placeholder is left literal.
  */
 export declare function renderTemplate(template: string, values: Record<string, unknown>, options?: RenderTemplateOptions): string;
+/**
+ * Bare variables that are blank in the branch this exact render selected.
+ * Untaken conditional/spintax branches are deliberately ignored; fallback-bearing
+ * tokens are optional, while bare tokens selected inside a fallback are checked.
+ */
+export declare function renderedTemplateMissingVariables(template: string, values: Record<string, unknown>, options?: RenderTemplateOptions): string[];
 /**
  * Every column key a template references — across bare `{{column}}` substitutions,
  * `{{column|fallback}}` fallbacks, `{{RANDOM|…}}` spintax options, and both the

package/node_modules/@oxygen/shared/dist/sql-error.d.ts

@@ -1,5 +1,5 @@
 /** Normalized failure category, derived from SQLSTATE first, then errno/message. */
-export type SqlErrorCause = "connect_timeout" | "connection" | "statement_timeout" | "admin_shutdown" | "too_many_connections" | "insufficient_resources" | "auth" | "schema_drift" | "data_exception" | "integrity_constraint" | "serialization" | "deadlock" | "transaction_rollback" | "syntax_or_access" | "internal" | "unknown";
+export type SqlErrorCause = "connect_timeout" | "connection" | "statement_timeout" | "admin_shutdown" | "too_many_connections" | "insufficient_resources" | "auth" | "schema_drift" | "data_exception" | "integrity_constraint" | "serialization" | "deadlock" | "transaction_rollback" | "read_only" | "syntax_or_access" | "internal" | "unknown";
 export type SqlErrorAttribution = {
     /** Postgres SQLSTATE (5 chars) when present; null for connection-level errnos. */
     pgCode: string | null;

package/node_modules/@oxygen/shared/dist/sql-error.js

@@ -62,6 +62,12 @@ const TRANSIENT_CAUSES = new Set([
     "serialization",
     "deadlock",
     "transaction_rollback",
+    // A Neon compute waking from autostop (or briefly in hot-standby/recovery)
+    // rejects writes with 25006 read_only_sql_transaction until the primary is
+    // writable again; the next poll tick succeeds. The dev worker's control-queue
+    // drain produced ~hourly 25006 bursts that self-healed within one wake cycle
+    // (OXY-5984).
+    "read_only",
 ]);
 /**
  * Classifies a pg/drizzle error into structured, non-secret attribution.
@@ -215,6 +221,13 @@ const EXACT_SQLSTATE_CAUSES = new Map([
     ["53300", "too_many_connections"],
     ["40001", "serialization"],
     ["40P01", "deadlock"],
+    // 25006 read_only_sql_transaction: a write hit a compute that is (still)
+    // read-only — a Neon dev branch mid-autostart or in hot-standby/recovery.
+    // Class 25 has no blanket mapping on purpose: its other members (25P02
+    // in_failed_sql_transaction, 25001 active_sql_transaction, ...) are
+    // transaction-protocol misuse, not a transient infra state. Only 25006 is
+    // the "retry on the next tick" case (OXY-5984).
+    ["25006", "read_only"],
 ]);
 // SQLSTATE class (first two chars) → cause, applied only after the exact and
 // schema-drift lookups above so the precise codes keep their dedicated cause.

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const OXYGEN_VERSION = "1.685.12";
+export declare const OXYGEN_VERSION = "1.691.5";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.685.12";
+export const OXYGEN_VERSION = "1.691.5";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.685.12",
+  "version": "1.691.5",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",