@oxygen-agent/cli 1.837.5 → 1.837.9

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.837.5
+Version: 1.837.9

package/dist/index.js

@@ -10552,7 +10552,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("set-photo")
-        .description("Set the sender's profile picture — the face that goes on every mailbox you order for this person. Pick exactly one source: --file (upload your own image; Oxygen hosts it permanently), --url (a public https image), --from-linkedin (re-mirror the photo from the attached LinkedIn account), or --clear. Hosting matters: an inbox vendor fetches the photo from its own servers HOURS after the order, so a LinkedIn CDN link (media.licdn.com, e=<epoch>) has already expired by then and the mailbox ships faceless. --file and --from-linkedin both end up Oxygen-hosted, which is why they are the safe choices. Free — no credits.")
+        .description("Set the reusable sender identity's profile picture for FUTURE managed-inbox orders made with --sender <id>. Pick exactly one source: --file (upload your own image; Oxygen hosts it permanently), --url (a public https image), --from-linkedin (re-mirror the photo from the attached LinkedIn account), or --clear. Hosting matters: an inbox vendor fetches the photo HOURS after an order, so an expiring LinkedIn CDN URL can ship the mailbox faceless. This updates Oxygen's sender profile only: it does not change already-provisioned mailbox photos or call the inbox provider. For a one-off typed-name order using profile_picture_url in --mailboxes JSON, use `oxygen managed-inboxes upload-avatar <path>` instead. Free — no credits.")
         .argument("<id>", "Sender profile id (from `oxygen senders profiles list`).")
         .option("--file <path>", "Upload a PNG, JPEG, or WebP from disk (max 8MB) and use it. Oxygen hosts the image permanently, so an inbox vendor can still fetch it at provisioning time.")
         .option("--url <url>", "Use an image already published at a public https URL. If the link expires (e.g. media.licdn.com with e=<epoch>) the photo is kept for Oxygen's own UI but marked non-durable and NEVER sent to an inbox vendor.")
@@ -13456,7 +13456,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("upload-avatar")
-        .description("Host a mailbox profile picture and print the URL to pass as profile_picture_url. The inbox vendor FETCHES that URL from its own servers when it provisions the mailbox — often long after the order — so it must be public and permanent. A LinkedIn photo URL is neither: media.licdn.com links carry an e=<epoch> expiry and the mailbox ends up faceless. Uploads a PNG, JPEG, or WebP (max 8MB); nothing is charged.")
+        .description("Host a one-off mailbox profile picture and print the URL to pass as profile_picture_url in --mailboxes JSON. For a reusable sender identity used by FUTURE --sender <id> orders, prefer `oxygen senders profiles set-photo <id> --file <path>` instead. The inbox vendor FETCHES the hosted URL when it provisions the mailbox, often long after the order, so it must be public and permanent. Uploads a PNG, JPEG, or WebP (max 8MB), then normalizes it to a metadata-free 400x400 PNG at a matching .png URL. This only hosts the image: it does not update a sender, place an order, call the inbox provider, or charge credits.")
         .argument("<path>", "Path to a PNG, JPEG, or WebP image.")
         .option("--json", "Print a JSON envelope.")
         .action(async (path, options) => {

package/node_modules/@oxygen/shared/dist/object-storage.d.ts

@@ -144,6 +144,22 @@ export declare function putInboxAvatarObject(input: {
     storageKey: string;
     contentLength: number;
 }>;
+/**
+ * Replace one staged avatar with provider-compatible bytes while preserving its
+ * public URL. The upload presign exposes that URL before confirmation, so moving
+ * the object to a new key during normalization would break an existing API
+ * promise. The org-bound key check is load-bearing: this is a bare S3 overwrite
+ * in a bucket shared by every tenant and several non-avatar namespaces.
+ */
+export declare function replaceInboxAvatarObject(input: {
+    organizationId: string;
+    storageKey: string;
+    body: Uint8Array;
+    contentType: string;
+}): Promise<{
+    storageKey: string;
+    contentLength: number;
+}>;
 /**
  * Read an avatar back, bounded. `maxBytes` is a hard stop rather than a hint:
  * this is called from an unauthenticated route, so an object that somehow grew

package/node_modules/@oxygen/shared/dist/object-storage.js

@@ -334,6 +334,27 @@ export async function putInboxAvatarObject(input) {
     }));
     return { storageKey, contentLength: input.body.byteLength };
 }
+/**
+ * Replace one staged avatar with provider-compatible bytes while preserving its
+ * public URL. The upload presign exposes that URL before confirmation, so moving
+ * the object to a new key during normalization would break an existing API
+ * promise. The org-bound key check is load-bearing: this is a bare S3 overwrite
+ * in a bucket shared by every tenant and several non-avatar namespaces.
+ */
+export async function replaceInboxAvatarObject(input) {
+    if (!isInboxAvatarObjectKeyForOrganization(input.storageKey, input.organizationId)) {
+        throw new OxygenError("invalid_object_key", "Refusing to replace an avatar that belongs to another organization.", { exitCode: 1 });
+    }
+    const { client, config } = resolveClient();
+    await client.send(new PutObjectCommand({
+        Bucket: config.bucket,
+        Key: input.storageKey,
+        Body: input.body,
+        ContentLength: input.body.byteLength,
+        ContentType: input.contentType,
+    }));
+    return { storageKey: input.storageKey, contentLength: input.body.byteLength };
+}
 /**
  * Read an avatar back, bounded. `maxBytes` is a hard stop rather than a hint:
  * this is called from an unauthenticated route, so an object that somehow grew

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,4 +1,4 @@
-export declare const OXYGEN_VERSION = "1.837.5";
+export declare const OXYGEN_VERSION = "1.837.9";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
 export declare const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.837.5";
+export const OXYGEN_VERSION = "1.837.9";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.837.5",
+  "version": "1.837.9",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",