@oxygen-agent/cli 1.717.9 → 1.720.7

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.717.9
+Version: 1.720.7

package/dist/index.js

@@ -939,7 +939,7 @@ async function readMailboxImportFile(path) {
         buffer = readFileSync(path);
     }
     catch {
-        throw new OxygenError("mailbox_import_file_unreadable", `Couldn't read --file '${basename(path)}'. Check that the path exists and is readable. CSV/JSON/JSONL/XLSX identity files are accepted; credential exports require --from credentials --vendor <source>. See https://oxygen-agent.com/docs/providers/mailbox-compatibility.`, { exitCode: 1 });
+        throw new OxygenError("mailbox_import_file_unreadable", `Couldn't read --file '${basename(path)}'. Check that the path exists and is readable. CSV/JSON/JSONL/XLSX identity files are accepted; credential exports require --from credentials --vendor <source>. See https://oxygen-agent.com/docs/providers/mailboxes.`, { exitCode: 1 });
     }
     if (buffer.byteLength > SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES) {
         throw new OxygenError("invalid_request", `Mailbox import files must be ${SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES / 1024 / 1024} MB or smaller.`, { exitCode: 1 });
@@ -2635,9 +2635,9 @@ export function createProgram() {
     }));
     program
         .command("support")
-        .description("Open and track Plain support conversations for the active OXYGEN organization.")
+        .description("Open and track Plain support conversations for the active OXYGEN organization. Filing is a zero-credit write to the canonical Plain queue.")
         .addCommand(new Command("file")
-        .description("Create a Plain support Thread. Use when you're stuck on an OXYGEN operation.")
+        .description("Create a real, zero-credit Plain support Thread immediately. There is no preview: review the exact subject, body, category, and severity before running it. Use when you're stuck on an OXYGEN operation.")
         .requiredOption("--subject <subject>", "One-line summary of the problem.")
         .option("--body <body>", "What you were doing, what happened, and what you tried.")
         .option("--severity <severity>", "low | normal | high. Defaults to normal.")
@@ -2809,7 +2809,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     })), { hidden: true });
     program
         .command("feedback")
-        .description("Send feedback or a bug report to the OXYGEN team. Creates the canonical Plain support Thread; transcripts are never attached unless explicitly requested.")
+        .description("Send feedback or a bug report to the OXYGEN team. This is the same immediate, zero-credit canonical Plain Thread write as `support file`; transcripts are never attached unless explicitly requested.")
         .option("-m, --message <message>", "Your feedback or bug report.")
         .option("--severity <severity>", "low | normal | high. Defaults to normal.")
         .option("--category <category>", "Optional category label. Defaults to 'feedback'.")
@@ -13102,7 +13102,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         '  JSON: {"mailboxes":[{"email_address":"ada@send-acme.com","provider":"google","app_password":"<Google mailbox app password>"}]}',
         "  Only Google app passwords enter the encrypted seven-day transfer vault. Microsoft rows remain identity-only. Generic SMTP passwords and OAuth/MFA/delegation secrets are rejected.",
         "  Validation: add --validate-only to parse the complete real file and return safe aggregate counts plus the provider-specific exact-account OAuth review plan without authentication, a network request, or a workspace write. The plan groups only supplied addresses into reviews of at most 10; it never discovers a domain, and the later online preview may skip existing grants. Any parse, shape, provider, platform, tenant, secret-policy, or duplicate-conflict error rejects the entire file before the first mailbox write and names mailboxes[index]; validation-only never writes. A later import infrastructure failure may interrupt the upsert; re-run the same file because import is idempotent by address.",
-        "  Docs: https://oxygen-agent.com/docs/providers/mailbox-compatibility",
+        "  Docs: https://oxygen-agent.com/docs/providers/mailboxes",
         "  Skill: oxygen-email-infra (`oxygen skills install --skill oxygen-email-infra`).",
         "",
     ].join("\n"))
@@ -13301,7 +13301,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }))
         .addCommand(new Command("connect-oauth")
         .description("Connect Google/Microsoft mailboxes to OXYGEN native send. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options. All paths cost 0 Oxygen credits.")
-        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--provider <provider>", "Mailbox provider to provision: google or microsoft.")
         .option("--vendor <vendor>", "Authorization path: oxygen for imported/manual mailboxes, zapmail (default), or inboxkit.")
         .option("--mailboxes <list>", "Comma-separated exact mailbox addresses. Required for vendor=oxygen (tenant mode max 500; individual mode max 10).")
@@ -13441,10 +13441,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }))
         .addCommand(new Command("warmup")
         .description("OXYGEN Warm-up for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. It is managed and credit-billed at 3,000 credits per warming inbox per month ($3). Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warm-up add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warm-up blocks the handoff so one mailbox cannot warm twice. OXYGEN Warm-up never owns campaign dispatch: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down there with `warmup disable`; they are never silently moved to the current managed rail.")
-        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .addCommand(new Command("enable")
         .description("STANDALONE ENROLLMENT: enroll BYOK/imported mailboxes, a managed order that opted out, or mailboxes being added to warmup later. Fresh managed InboxKit Google/Microsoft/Azure orders whose approved quote included warmup activate automatically after provisioning and do not need this command. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is exported, enrolled, or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Eligible managed InboxKit targets still use InboxKit's native Sequencer export with exact UIDs; auto-export remains off, and any non-cancelled InboxKit warmup must be cancelled before export (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. OXYGEN Warm-up retains no campaign authority — OXYGEN Sequences own enrollment and dispatch. New enrollments only ever land on the managed OXYGEN rail; the retired TrulyInbox rail is refused here and only accepts teardown.")
-        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to warm. Omit to warm the whole pool.")
         .option("--approved", "Execute the PRICED enrollment. Without it the response is a priced preview and nothing is enrolled or billed.")
         .option("--plan <hash>", "Hash from the fresh preview (required with --approved).")
@@ -13489,7 +13489,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }))
         .addCommand(new Command("microsoft")
         .description("NON-INBOXKIT FALLBACK ONLY: authorize eligible Microsoft/Outlook mailboxes for OXYGEN Warm-up with ONE browser consent PER MAILBOX, never a password or app password. Do not run this for managed InboxKit mailboxes: fresh Microsoft/Azure orders activate native InboxKit warm-up exports automatically when the approved order includes warmup; opted-out or later separate managed enrollment uses standalone `warmup enable`. For the non-InboxKit fallback there is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact fallback mailboxes and outstanding links at 0 credits. Approve that fresh hash with --max-credits 0, open every returned consent_url, then re-run with --status. Warmup itself stays OFF until standalone `warmup enable`.")
-        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--mailboxes <list>", "Comma-separated eligible non-InboxKit Microsoft mailbox ids or addresses. Omit to select the pool; the command refuses a scope containing managed InboxKit rows and points to warmup enable.")
         .option("--tenant <id>", "Deprecated and ignored: OXYGEN Warm-up consent is per mailbox, so there is no tenant-wide scope to bind. Still accepted so older scripts keep running.")
         .option("--approved", "Mint the per-mailbox consent links for the exact previewed mailbox scope. Still 0 credits — a human then has to open each link.")
@@ -14125,6 +14125,13 @@ Authoring guide:
   Install or refresh the focused product skill:
   oxygen skills install --skill oxygen-workflow-authoring
 
+Web creation chooser:
+  Open /workspaces/<workspace-id>/workflows and click Create workflow.
+  Choose Blank workflow, Workflow template (one workflow), Blueprint
+  (a multi-resource motion), or Import definition. The chooser opens on the
+  collection page; it has no separate public URL.
+  Guide: https://oxygen-agent.com/docs/execution/workflows
+
 Fastest editable graph:
   1. oxygen workflows events list --search "<outcome>" --kind builtin --json
   2. oxygen workflows init --id my-workflow

package/node_modules/@oxygen/shared/dist/axiom-field-budget.d.ts

@@ -19,6 +19,13 @@
  * under `worker_fields`. New instrumentation can then be added freely without
  * anyone having to remember that a new key can take down log shipping globally.
  *
+ * WITH ONE HOLE, found the hard way on 2026-08-15. Packing protects the dataset
+ * from the CONTENTS, not from the CONTAINER: `worker_fields` is itself a column,
+ * and a dataset with no free column cannot have it. Registering the map field on
+ * the already-full `oxygen-logs` therefore turned a slow leak into a total ingest
+ * outage — 41,372 records/day, ~60x worse than the leak it replaced. `AxiomOverflowMode`
+ * below is the escape hatch; freeing a column slot is the actual fix.
+ *
  * THE ALLOWLIST IS A LOAD-BEARING CONTRACT IN BOTH DIRECTIONS.
  *
  * - A field that a monitor, dashboard, or checked-in query reads **flat** must be
@@ -34,6 +41,39 @@
  * Both directions are asserted by `scripts/ci/log-field-budget.mjs` against the
  * real seed and dashboard JSON, so a change to either side fails loudly instead
  * of quietly blinding a monitor.
+ *
+ * THERE IS A THIRD DIRECTION, and it is the one that took production down: a
+ * name in this set that the DATASET has no column for. Allowlisted means flat by
+ * definition, so such a name cannot fall back into the map — it demands a
+ * brand-new column, and a dataset with no slot to allocate one rejects the whole
+ * ingest batch with HTTP 400. So membership here is not "a field we read flat";
+ * it is "a field we read flat AND the dataset can actually hold". The live half
+ * of `scripts/ci/log-field-budget.mjs` checks that second half against Axiom.
+ *
+ * REMOVED 2026-08-15 — `chunk_id`, `item_id`, `digest`. Prod `oxygen-logs` had no
+ * column for any of the three and no slot left to create one, so every record
+ * carrying one was rejected 400 and DROPPED. That was still ~116 ship failures
+ * per 25 minutes after the `worker_fields` map field itself had been repaired on
+ * the Axiom side, and it hit the Next.js server-error path hardest, through
+ * `digest`.
+ *
+ * The warning above — that dropping a name silently moves it into the overflow
+ * and can zero a query that reads it flat — applies to exactly this removal, so
+ * it was CHECKED rather than assumed, in both directions:
+ *
+ * - Nothing reads them FLAT. Every `aplQuery` in docs/observability/monitors.json
+ *   was parsed and all dashboard JSON grepped: zero matches for the three as flat
+ *   fields (the apparent hits are the English word "digest" in description prose).
+ * - Nothing reads them out of `worker_fields` either, so the move breaks no query
+ *   in the opposite direction.
+ *
+ * Packed, they stay queryable as `['worker_fields']['digest']` — a longer access
+ * path, the same value, still typed. `digest` matters most: it is the only join
+ * key from a browser error report back to its `next.request_error` row (see the
+ * error-shape group below), and that correlation still works through the map
+ * field. The trade is explicit and worth stating plainly: keeping them flat meant
+ * the ENTIRE record was dropped, which loses the digest anyway plus everything
+ * travelling with it. Packed is strictly better than dropped.
  */
 /**
  * Fields that stay top-level in `oxygen-logs`.
@@ -64,8 +104,67 @@ export declare const AXIOM_STABLE_FIELDS: ReadonlySet<string>;
  * ordinary flat fields and the budget is defeated silently. Create it with:
  *   POST /v2/datasets/{dataset}/mapfields  {"name": "worker_fields"}
  * `scripts/ops/axiom-mapfields.mjs` does this idempotently for every log dataset.
+ *
+ * AND IT MUST BE ABLE TO EXIST — see `AxiomOverflowMode` below. A map field still
+ * occupies ONE column slot, so registering it on an already-full dataset does not
+ * create it; Axiom rejects every ingest that carries it instead.
  */
 export declare const AXIOM_OVERFLOW_MAP_FIELD = "worker_fields";
+/**
+ * How overflow is attached to a record.
+ *
+ * `map` is correct and is the default. `message` exists because of a failure mode
+ * the map-field design did not anticipate, measured in production 2026-08-15:
+ *
+ *   {"code":400,"message":"adding 'worker_fields' to dataset fields would
+ *    exceed the column limit of 1025"}
+ *
+ * `oxygen-logs` was at 1,026 columns. A map field's CONTENTS are free, but the map
+ * field itself is still a column, and there was no slot for it. So Axiom refused to
+ * create it and rejected every batch carrying it — 19,029 rejected batches and
+ * 41,372 lost records in 24h, roughly 60x the 412-batches-per-7-days leak the map
+ * field was introduced to fix. Registering the map field on a full dataset had
+ * converted "silently absorb overflow as new columns" into "drop everything".
+ *
+ * The degraded mode restores the shape this module shipped BEFORE the map field:
+ * a JSON string in `message` under the same `worker_fields` key, so
+ * `parse_json(tostring(message)).worker_fields.x` — the access path every
+ * pre-2026-08-08 row and every legacy query already uses — keeps working.
+ *
+ * Deliberately process-level and one-way. A shipper flips it on the first
+ * column-limit rejection and every later record in that process packs the same
+ * way; nothing flips it back, because a dataset does not grow a free column while
+ * the process is running. Fresh processes start in `map` again, so the moment the
+ * dataset has headroom the next deploy silently returns to the better shape with
+ * no code change.
+ *
+ * IT IS A LAST RESORT, NOT A HOME. While degraded, every monitor reading
+ * `['worker_fields']['x']` resolves to null — the silent-blinding failure this
+ * module's header warns about. Readers that must survive both shapes coalesce
+ * them; see `docs/observability/queries.apl.md`. Losing the flat shape beats
+ * losing the record.
+ */
+export type AxiomOverflowMode = "map" | "message";
+/** The mode the next `packAxiomLogRecord` call will use. */
+export declare function getAxiomOverflowMode(): AxiomOverflowMode;
+/**
+ * Does this Axiom 400 body mean "the map field will not fit"?
+ *
+ * Matched on the stable half of Axiom's message rather than the whole string: the
+ * field name and the limit number both vary, and a shipper that only recognised
+ * `worker_fields`/`1025` verbatim would go back to dropping everything the day
+ * either changed.
+ */
+export declare function isColumnLimitRejection(body: string | null | undefined): boolean;
+/**
+ * Switches this process to `message` packing.
+ *
+ * Returns true only on the transition, so a caller can retry the rejected batch
+ * and log the degradation exactly once instead of once per batch forever.
+ */
+export declare function degradeAxiomOverflowToMessage(): boolean;
+/** Test-only: restores the default so cases cannot leak mode into each other. */
+export declare function resetAxiomOverflowMode(): void;
 /**
  * Bound on the serialized overflow, so one pathological record cannot push a whole
  * batch past Axiom's request limits. 64 KB is far above any real log line and far

package/node_modules/@oxygen/shared/dist/axiom-field-budget.js

@@ -19,6 +19,13 @@
  * under `worker_fields`. New instrumentation can then be added freely without
  * anyone having to remember that a new key can take down log shipping globally.
  *
+ * WITH ONE HOLE, found the hard way on 2026-08-15. Packing protects the dataset
+ * from the CONTENTS, not from the CONTAINER: `worker_fields` is itself a column,
+ * and a dataset with no free column cannot have it. Registering the map field on
+ * the already-full `oxygen-logs` therefore turned a slow leak into a total ingest
+ * outage — 41,372 records/day, ~60x worse than the leak it replaced. `AxiomOverflowMode`
+ * below is the escape hatch; freeing a column slot is the actual fix.
+ *
  * THE ALLOWLIST IS A LOAD-BEARING CONTRACT IN BOTH DIRECTIONS.
  *
  * - A field that a monitor, dashboard, or checked-in query reads **flat** must be
@@ -34,6 +41,39 @@
  * Both directions are asserted by `scripts/ci/log-field-budget.mjs` against the
  * real seed and dashboard JSON, so a change to either side fails loudly instead
  * of quietly blinding a monitor.
+ *
+ * THERE IS A THIRD DIRECTION, and it is the one that took production down: a
+ * name in this set that the DATASET has no column for. Allowlisted means flat by
+ * definition, so such a name cannot fall back into the map — it demands a
+ * brand-new column, and a dataset with no slot to allocate one rejects the whole
+ * ingest batch with HTTP 400. So membership here is not "a field we read flat";
+ * it is "a field we read flat AND the dataset can actually hold". The live half
+ * of `scripts/ci/log-field-budget.mjs` checks that second half against Axiom.
+ *
+ * REMOVED 2026-08-15 — `chunk_id`, `item_id`, `digest`. Prod `oxygen-logs` had no
+ * column for any of the three and no slot left to create one, so every record
+ * carrying one was rejected 400 and DROPPED. That was still ~116 ship failures
+ * per 25 minutes after the `worker_fields` map field itself had been repaired on
+ * the Axiom side, and it hit the Next.js server-error path hardest, through
+ * `digest`.
+ *
+ * The warning above — that dropping a name silently moves it into the overflow
+ * and can zero a query that reads it flat — applies to exactly this removal, so
+ * it was CHECKED rather than assumed, in both directions:
+ *
+ * - Nothing reads them FLAT. Every `aplQuery` in docs/observability/monitors.json
+ *   was parsed and all dashboard JSON grepped: zero matches for the three as flat
+ *   fields (the apparent hits are the English word "digest" in description prose).
+ * - Nothing reads them out of `worker_fields` either, so the move breaks no query
+ *   in the opposite direction.
+ *
+ * Packed, they stay queryable as `['worker_fields']['digest']` — a longer access
+ * path, the same value, still typed. `digest` matters most: it is the only join
+ * key from a browser error report back to its `next.request_error` row (see the
+ * error-shape group below), and that correlation still works through the map
+ * field. The trade is explicit and worth stating plainly: keeping them flat meant
+ * the ENTIRE record was dropped, which loses the digest anyway plus everything
+ * travelling with it. Packed is strictly better than dropped.
  */
 /**
  * Fields that stay top-level in `oxygen-logs`.
@@ -66,8 +106,9 @@ export const AXIOM_STABLE_FIELDS = new Set([
     "operation",
     "tenant_database_id",
     "run_id",
-    "chunk_id",
-    "item_id",
+    // `chunk_id` and `item_id` used to sit here. Removed 2026-08-15 because prod
+    // had no column for either and no slot to make one — see the header. They now
+    // ride in `worker_fields`, where they cost no column at all.
     "worker_id",
     "conversation_id",
     // --- Error shape (errorFields) -------------------------------------------
@@ -75,9 +116,11 @@ export const AXIOM_STABLE_FIELDS = new Set([
     "error_name",
     "error_message",
     "error_code",
-    // Next.js stamps `digest` on a serialized server error; it is the only value
-    // that joins a browser error report back to its `next.request_error` row.
-    "digest",
+    // `digest` used to sit here. Next.js stamps it on a serialized server error and
+    // it is still the only value that joins a browser error report back to its
+    // `next.request_error` row — but prod could not allocate a column for it, so a
+    // flat `digest` meant the whole record died and the join key with it. Removed
+    // 2026-08-15; the join now reads `tostring(['worker_fields']['digest'])`.
     // --- Primitive identity --------------------------------------------------
     "workflow_id",
     "workflow_run_id",
@@ -195,8 +238,51 @@ export const AXIOM_STABLE_FIELDS = new Set([
  * ordinary flat fields and the budget is defeated silently. Create it with:
  *   POST /v2/datasets/{dataset}/mapfields  {"name": "worker_fields"}
  * `scripts/ops/axiom-mapfields.mjs` does this idempotently for every log dataset.
+ *
+ * AND IT MUST BE ABLE TO EXIST — see `AxiomOverflowMode` below. A map field still
+ * occupies ONE column slot, so registering it on an already-full dataset does not
+ * create it; Axiom rejects every ingest that carries it instead.
  */
 export const AXIOM_OVERFLOW_MAP_FIELD = "worker_fields";
+/**
+ * The pre-existing column the overflow degrades into when the map field cannot be
+ * created. Owned by the Vercel drain (it is where Lane B parks the whole app JSON),
+ * which is exactly why it is safe here: it already exists on every log dataset, so
+ * writing it costs no new column on a dataset that has none left to give.
+ */
+const AXIOM_OVERFLOW_MESSAGE_FIELD = "message";
+let overflowMode = "map";
+/** The mode the next `packAxiomLogRecord` call will use. */
+export function getAxiomOverflowMode() {
+    return overflowMode;
+}
+/**
+ * Does this Axiom 400 body mean "the map field will not fit"?
+ *
+ * Matched on the stable half of Axiom's message rather than the whole string: the
+ * field name and the limit number both vary, and a shipper that only recognised
+ * `worker_fields`/`1025` verbatim would go back to dropping everything the day
+ * either changed.
+ */
+export function isColumnLimitRejection(body) {
+    return typeof body === "string" && /would exceed the column limit/i.test(body);
+}
+/**
+ * Switches this process to `message` packing.
+ *
+ * Returns true only on the transition, so a caller can retry the rejected batch
+ * and log the degradation exactly once instead of once per batch forever.
+ */
+export function degradeAxiomOverflowToMessage() {
+    if (overflowMode === "message")
+        return false;
+    overflowMode = "message";
+    return true;
+}
+/** Test-only: restores the default so cases cannot leak mode into each other. */
+export function resetAxiomOverflowMode() {
+    overflowMode = "map";
+}
 /**
  * Bound on the serialized overflow, so one pathological record cannot push a whole
  * batch past Axiom's request limits. 64 KB is far above any real log line and far
@@ -246,17 +332,26 @@ export function packAxiomLogRecord(record) {
     }
     if (Object.keys(overflow).length === 0)
         return stable;
-    // Nested under the map field as a real object — NOT stringified. Axiom stores
-    // map contents without allocating a column per key, and keeps them queryable
-    // and typed.
-    stable[AXIOM_OVERFLOW_MAP_FIELD] =
-        JSON.stringify(overflow).length <= MAX_PACKED_MESSAGE_LENGTH
-            ? overflow
-            : {
-                // Never silently truncate to nothing: the key NAMES alone are usually
-                // enough to identify which call site produced the oversized record.
-                _truncated: true,
-                _keys: Object.keys(overflow),
-            };
+    const bounded = JSON.stringify(overflow).length <= MAX_PACKED_MESSAGE_LENGTH
+        ? overflow
+        : {
+            // Never silently truncate to nothing: the key NAMES alone are usually
+            // enough to identify which call site produced the oversized record.
+            _truncated: true,
+            _keys: Object.keys(overflow),
+        };
+    if (overflowMode === "map") {
+        // Nested under the map field as a real object — NOT stringified. Axiom stores
+        // map contents without allocating a column per key, and keeps them queryable
+        // and typed.
+        stable[AXIOM_OVERFLOW_MAP_FIELD] = bounded;
+        return stable;
+    }
+    // Degraded: the map field has no column to live in. Same payload, same inner
+    // key, stringified into a column that already exists. A caller's own `message`
+    // field is not lost — it is non-allowlisted, so it is inside `bounded` already.
+    stable[AXIOM_OVERFLOW_MESSAGE_FIELD] = JSON.stringify({
+        [AXIOM_OVERFLOW_MAP_FIELD]: bounded,
+    });
     return stable;
 }

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -51,7 +51,7 @@ export * from "./dnc-identities.js";
 export * from "./table-limits.js";
 export * from "./log.js";
 export * from "./axiom-field-budget.js";
-export { sanitizeLogFields } from "./redaction.js";
+export { redactSecretsInString, sanitizeLogFields } from "./redaction.js";
 export * from "./provider-request-outcomes.js";
 export * from "./schedule-label.js";
 export * from "./social-capabilities.js";

package/node_modules/@oxygen/shared/dist/index.js

@@ -55,7 +55,14 @@ export * from "./axiom-field-budget.js";
 // their field names against the REAL log sanitizer — the unanchored
 // SECRET_KEY_PATTERN redacts any name containing "token", which mocked loggers
 // cannot catch. Not a license to pre-sanitize outside log().
-export { sanitizeLogFields } from "./redaction.js";
+// `redactSecretsInString` joins it for the MCP `$mcp_parameters`/`$mcp_response`
+// capture (apps/web/src/lib/analytics/mcp-analytics.ts): that path must scrub
+// credential SUBSTRINGS out of tool arguments while KEEPING the business
+// payload, so it cannot reuse sanitizeLogFields — whose OMITTED_KEY_PATTERN
+// blanks `rows`/`input`/`body` wholesale. There is exactly one implementation of
+// the Bearer / sk- / DB-URL scrub and this keeps it that way; duplicating those
+// three regexes in apps/web is what this export exists to prevent.
+export { redactSecretsInString, sanitizeLogFields } from "./redaction.js";
 export * from "./provider-request-outcomes.js";
 export * from "./schedule-label.js";
 export * from "./social-capabilities.js";

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const OXYGEN_VERSION = "1.717.9";
+export declare const OXYGEN_VERSION = "1.720.7";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.717.9";
+export const OXYGEN_VERSION = "1.720.7";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.717.9",
+  "version": "1.720.7",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",