@oxygen-agent/cli 1.839.8 → 1.844.6

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.839.8
+Version: 1.844.6

package/dist/index.js

@@ -8797,6 +8797,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const suffix = range && range !== "30d" ? `?range=${encodeURIComponent(range)}` : "";
             return requestOxygen(`/api/cli/admin/kpis${suffix}`);
         });
+    }))
+        .addCommand(new Command("egress")
+        .description("Read-only Fly email-egress overview: shared IP, dedicated workspace apps and IPs, liveness, image drift, billing, and stuck orders. OXYGEN staff only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("admin egress", options, () => requestOxygen("/api/cli/admin/egress"));
     }))
         .addCommand(new Command("costs")
         .description("Show provider costs (COGS) per workspace. Staff only.")

package/node_modules/@oxygen/shared/dist/billing.d.ts

@@ -239,7 +239,7 @@ export declare const BASE_PRICING_PLANS: {
         readonly description: "Custom procurement, invoicing, limits, and rollout support.";
         readonly ctaLabel: "Talk to us";
         readonly contactHref: "mailto:support@oxygen-agent.com";
-        readonly features: readonly ["Everything in Team", "Custom usage limits", "Volume pricing", "Custom invoicing and billing", "Dedicated support"];
+        readonly features: readonly ["Everything in Team", "Custom usage limits", "Volume pricing", "Dedicated support"];
         readonly monthlyPriceCents: number | null;
         readonly monthlyCredits: number | null;
         readonly weeklyCreditsLimit: number | null;

package/node_modules/@oxygen/shared/dist/billing.js

@@ -360,7 +360,6 @@ export const BASE_PRICING_PLANS = {
             "Everything in Team",
             "Custom usage limits",
             "Volume pricing",
-            "Custom invoicing and billing",
             "Dedicated support",
         ],
     },

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -67,6 +67,7 @@ export * from "./schedule-label.js";
 export * from "./social-capabilities.js";
 export * from "./signup-lead-deliveries.js";
 export * from "./sql-error.js";
+export * from "./postgres-text.js";
 export * from "./tags.js";
 export * from "./telemetry.js";
 export * from "./tenant-database-secret.js";

package/node_modules/@oxygen/shared/dist/index.js

@@ -78,6 +78,7 @@ export * from "./schedule-label.js";
 export * from "./social-capabilities.js";
 export * from "./signup-lead-deliveries.js";
 export * from "./sql-error.js";
+export * from "./postgres-text.js";
 export * from "./tags.js";
 export * from "./telemetry.js";
 export * from "./tenant-database-secret.js";

package/node_modules/@oxygen/shared/dist/postgres-text.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Remove Unicode code units PostgreSQL cannot store in text/jsonb.
+ *
+ * JavaScript strings may contain U+0000 and unpaired UTF-16 surrogates. JSON.stringify
+ * accepts both (escaping them), but PostgreSQL rejects U+0000 and malformed surrogate
+ * escapes with SQLSTATE 22P05/22P02. Provider payloads are untrusted text, so sanitize
+ * at the persistence boundary while preserving every valid Unicode scalar value.
+ */
+export declare function sanitizePostgresText(value: string): string;

package/node_modules/@oxygen/shared/dist/postgres-text.js

@@ -0,0 +1,37 @@
+/**
+ * Remove Unicode code units PostgreSQL cannot store in text/jsonb.
+ *
+ * JavaScript strings may contain U+0000 and unpaired UTF-16 surrogates. JSON.stringify
+ * accepts both (escaping them), but PostgreSQL rejects U+0000 and malformed surrogate
+ * escapes with SQLSTATE 22P05/22P02. Provider payloads are untrusted text, so sanitize
+ * at the persistence boundary while preserving every valid Unicode scalar value.
+ */
+export function sanitizePostgresText(value) {
+    let sanitized = "";
+    let changed = false;
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code === 0) {
+            changed = true;
+            continue;
+        }
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (next >= 0xdc00 && next <= 0xdfff) {
+                sanitized += value[index] ?? "";
+                sanitized += value[index + 1] ?? "";
+                index += 1;
+            }
+            else {
+                changed = true;
+            }
+            continue;
+        }
+        if (code >= 0xdc00 && code <= 0xdfff) {
+            changed = true;
+            continue;
+        }
+        sanitized += value[index] ?? "";
+    }
+    return changed ? sanitized : value;
+}

package/node_modules/@oxygen/shared/dist/sql-error.js

@@ -263,20 +263,27 @@ function categoryFromSqlstate(code) {
         return "schema_drift";
     return SQLSTATE_CLASS_CAUSES.get(code.slice(0, 2)) ?? null;
 }
-// Walk the Error.cause chain (bounded) and return the first non-null value the
-// reader extracts. drizzle wraps the pg error on `.cause`, and custom wrappers
-// can nest deeper, so a single-level read misses the actionable DB fields when
-// the chain is two or more deep (OXY-38).
-const MAX_CAUSE_DEPTH = 5;
+// Walk the bounded error graph and return the first non-null value the reader
+// extracts. drizzle wraps the driver error on `.cause`; Neon's HTTP driver then
+// stores its transport error on `.sourceError`, and AggregateError uses
+// `.errors`. Following only `cause` mislabeled Neon fetch/socket failures as
+// deterministic `unknown` SQL errors (tenant_due_work, 2026-08-24).
+const MAX_ERROR_GRAPH_NODES = 12;
 function readCauseChain(error, read) {
-    let current = error;
-    for (let depth = 0; depth < MAX_CAUSE_DEPTH; depth++) {
-        if (!current || typeof current !== "object")
-            return null;
-        const value = read(current);
+    const pending = [error];
+    const seen = new Set();
+    for (let visited = 0; pending.length > 0 && visited < MAX_ERROR_GRAPH_NODES; visited += 1) {
+        const current = pending.shift();
+        if (!current || typeof current !== "object" || seen.has(current))
+            continue;
+        seen.add(current);
+        const record = current;
+        const value = read(record);
         if (value !== null)
             return value;
-        current = current.cause;
+        pending.push(record.cause, record.sourceError);
+        if (Array.isArray(record.errors))
+            pending.push(...record.errors);
     }
     return null;
 }

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,4 +1,4 @@
-export declare const OXYGEN_VERSION = "1.839.8";
+export declare const OXYGEN_VERSION = "1.844.6";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
 export declare const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.839.8";
+export const OXYGEN_VERSION = "1.844.6";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/node_modules/@oxygen/shared/package.json

@@ -91,6 +91,11 @@
       "import": "./dist/custom-http-safety.js",
       "default": "./dist/custom-http-safety.js"
     },
+    "./redaction": {
+      "types": "./dist/redaction.d.ts",
+      "import": "./dist/redaction.js",
+      "default": "./dist/redaction.js"
+    },
     "./search-vocab": {
       "types": "./dist/search-vocab.d.ts",
       "import": "./dist/search-vocab.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.839.8",
+  "version": "1.844.6",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",