@oxygen-agent/cli 1.906.0 → 1.922.12

package/node_modules/@oxygen/formula/dist/expression.d.ts

@@ -41,6 +41,27 @@ export type ParseOptions = {
 export declare function parseFormulaExpression(expression: string, options?: ParseOptions): FormulaAst;
 /** Validate supported functions and arity on an already-parsed tree. */
 export declare function validateFormulaAst(ast: FormulaAst): void;
+/**
+ * SAVE-TIME ONLY: reject a literal regex pattern that is too long to ever compile.
+ *
+ * Deliberately NOT part of validateFormulaAst. That runs on the READ path too
+ * (formula-column-runner prepares every batch through it) and
+ * prepareFormulaForRead swallows the throw and nulls the WHOLE column, so
+ * tightening it would silently blank already-stored columns rather than reject
+ * the edit. Keeping this save-only means a column that stores today keeps
+ * reading today, and only a NEW write is refused.
+ *
+ * Length is checked, not compilation. A pattern over the cap can never succeed in
+ * any branch, so flagging it costs the author nothing -- whereas rejecting an
+ * unparseable literal would break `if(cond, regex_match(x, "["), "n/a")`, which
+ * works today precisely because if/switch/and/or/coalesce are lazy and never
+ * evaluate the untaken side. That stricter semantic is a separate decision.
+ *
+ * Without this, an over-long pattern stored fine and then failed per row on every
+ * run forever -- the production shape was one column failing across dozens of rows
+ * for days with received_length 290 against the old 256 cap.
+ */
+export declare function validateFormulaRegexLiterals(ast: FormulaAst): void;
 /** Validate syntax, supported functions, and arity without evaluating any data. */
 export declare function validateFormulaExpression(expression: string, options?: ParseOptions): void;
 export declare function walkExpression(node: FormulaAst, visit: (node: FormulaAst) => void): void;

package/node_modules/@oxygen/formula/dist/expression.js

@@ -1,4 +1,4 @@
-import { FORMULA_FUNCTION_REGISTRY, checkFormulaFunctionArity, formulaExpressionError, } from "./formula-functions.js";
+import { FORMULA_FUNCTION_REGISTRY, MAX_FORMULA_REGEX_PATTERN_LENGTH, checkFormulaFunctionArity, formulaExpressionError, } from "./formula-functions.js";
 /**
  * Functions evaluated against the whole column rather than the current scope.
  * They are intercepted before registry dispatch (the registry entry carries
@@ -37,6 +37,47 @@ export function validateFormulaAst(ast) {
         checkFormulaFunctionArity(spec, node.args.length);
     });
 }
+/**
+ * SAVE-TIME ONLY: reject a literal regex pattern that is too long to ever compile.
+ *
+ * Deliberately NOT part of validateFormulaAst. That runs on the READ path too
+ * (formula-column-runner prepares every batch through it) and
+ * prepareFormulaForRead swallows the throw and nulls the WHOLE column, so
+ * tightening it would silently blank already-stored columns rather than reject
+ * the edit. Keeping this save-only means a column that stores today keeps
+ * reading today, and only a NEW write is refused.
+ *
+ * Length is checked, not compilation. A pattern over the cap can never succeed in
+ * any branch, so flagging it costs the author nothing -- whereas rejecting an
+ * unparseable literal would break `if(cond, regex_match(x, "["), "n/a")`, which
+ * works today precisely because if/switch/and/or/coalesce are lazy and never
+ * evaluate the untaken side. That stricter semantic is a separate decision.
+ *
+ * Without this, an over-long pattern stored fine and then failed per row on every
+ * run forever -- the production shape was one column failing across dozens of rows
+ * for days with received_length 290 against the old 256 cap.
+ */
+export function validateFormulaRegexLiterals(ast) {
+    walkExpression(ast, (node) => {
+        if (node.type !== "call")
+            return;
+        const normalized = node.name.toLowerCase();
+        if (normalized !== "regex_match" && normalized !== "regex_extract" && normalized !== "regex_replace") {
+            return;
+        }
+        // Every regex function takes its pattern as the second argument.
+        const pattern = node.args[1];
+        if (!pattern || pattern.type !== "literal" || typeof pattern.value !== "string")
+            return;
+        if (pattern.value.length <= MAX_FORMULA_REGEX_PATTERN_LENGTH)
+            return;
+        throw formulaExpressionError("Regular-expression pattern is too long.", {
+            function: node.name,
+            max_length: MAX_FORMULA_REGEX_PATTERN_LENGTH,
+            received_length: pattern.value.length,
+        });
+    });
+}
 /** Validate syntax, supported functions, and arity without evaluating any data. */
 export function validateFormulaExpression(expression, options = {}) {
     validateFormulaAst(parseFormulaExpression(expression, options));

package/node_modules/@oxygen/formula/dist/formula-functions.d.ts

@@ -37,7 +37,7 @@ export type FormulaFunctionSpec = FormulaFunctionMeta & {
     evaluate?: (args: unknown[]) => unknown;
     evaluateLazy?: (thunks: Array<() => unknown>) => unknown;
 };
-export declare const MAX_FORMULA_REGEX_PATTERN_LENGTH = 256;
+export declare const MAX_FORMULA_REGEX_PATTERN_LENGTH = 1000;
 export declare const MAX_FORMULA_REGEX_INPUT_LENGTH = 20000;
 export declare function formulaExpressionError(message: string, details: Record<string, unknown>): OxygenError;
 export declare function isBlankFormulaValue(value: unknown): boolean;

package/node_modules/@oxygen/formula/dist/formula-functions.js

@@ -1,7 +1,16 @@
 import { OxygenError } from "@oxygen/shared/cli-result";
 import { walkJsonPath } from "@oxygen/shared/json-path";
 import { normalizeDomain, normalizeEmail, normalizeLinkedinUrl, } from "./value-normalizers.js";
-export const MAX_FORMULA_REGEX_PATTERN_LENGTH = 256;
+// Pattern LENGTH is not a safety bound and never was -- catastrophic backtracking
+// is a function of pattern SHAPE, and `(a+)+$` hangs at 6 characters, so 256 already
+// permitted an unbounded hang while rejecting harmless long literals. The real bound
+// on scan cost is MAX_FORMULA_REGEX_INPUT_LENGTH below, which caps what a pattern is
+// run against. 256 rejected a customer's 290-character alternation on every row of
+// their table, continuously, for days (production 2026-08-28/31). Raised to a value
+// that still stops a pathological paste while leaving ordinary generated alternations
+// room. If real ReDoS protection is ever needed it belongs in the engine (a
+// backtracking budget or re2), not in a character count.
+export const MAX_FORMULA_REGEX_PATTERN_LENGTH = 1_000;
 export const MAX_FORMULA_REGEX_INPUT_LENGTH = 20_000;
 // ---------------------------------------------------------------------------
 // Shared coercion helpers (used by the registry AND the runner's operators)

package/node_modules/@oxygen/shared/dist/billing.d.ts

@@ -33,6 +33,23 @@ export declare const CREDIT_TOPUP_MAX_CREDITS = 1000000;
 export declare const CREDIT_TOPUP_STEP_CREDITS = 1000;
 export declare const CREDIT_TOPUP_DEFAULT_CREDITS = 20000;
 export declare function isValidCreditTopupCredits(credits: number): boolean;
+/**
+ * A shortfall expressed as an amount `oxygen billing topup` will actually SELL:
+ * rounded up onto the 1,000-credit step and clamped into the purchasable
+ * [8,000 .. 1,000,000] band. A next_action (or an alert email) naming a number the
+ * top-up route refuses with `invalid_topup_amount` is not a next action, it is a
+ * second dead end during the incident it exists to end.
+ *
+ * Both clamps are honest, not cosmetic: below the floor the customer buys the
+ * smallest pack (more than the debt — purchased credits never expire), and above
+ * the ceiling they buy the largest single checkout and top up again. Callers carry
+ * the raw shortfall alongside so either gap stays visible rather than implied.
+ *
+ * Shared rather than re-derived per surface: `billing balance` and the renewal
+ * failure alert quote this number to the same customer about the same debt, and a
+ * second rounding formula is how two customer-facing figures drift apart.
+ */
+export declare function creditTopupAmountForShortfall(credits: number): number;
 export declare function creditTopupUsdCents(credits: number): number | null;
 export declare const AUTOMATION_ACTION_CREDITS = 0.01;
 /** Kinds of resource that carry a fixed monthly credit commitment. */

package/node_modules/@oxygen/shared/dist/billing.js

@@ -35,6 +35,26 @@ export function isValidCreditTopupCredits(credits) {
         && credits <= CREDIT_TOPUP_MAX_CREDITS
         && credits % CREDIT_TOPUP_STEP_CREDITS === 0;
 }
+/**
+ * A shortfall expressed as an amount `oxygen billing topup` will actually SELL:
+ * rounded up onto the 1,000-credit step and clamped into the purchasable
+ * [8,000 .. 1,000,000] band. A next_action (or an alert email) naming a number the
+ * top-up route refuses with `invalid_topup_amount` is not a next action, it is a
+ * second dead end during the incident it exists to end.
+ *
+ * Both clamps are honest, not cosmetic: below the floor the customer buys the
+ * smallest pack (more than the debt — purchased credits never expire), and above
+ * the ceiling they buy the largest single checkout and top up again. Callers carry
+ * the raw shortfall alongside so either gap stays visible rather than implied.
+ *
+ * Shared rather than re-derived per surface: `billing balance` and the renewal
+ * failure alert quote this number to the same customer about the same debt, and a
+ * second rounding formula is how two customer-facing figures drift apart.
+ */
+export function creditTopupAmountForShortfall(credits) {
+    const stepped = Math.ceil(credits / CREDIT_TOPUP_STEP_CREDITS) * CREDIT_TOPUP_STEP_CREDITS;
+    return Math.min(CREDIT_TOPUP_MAX_CREDITS, Math.max(CREDIT_TOPUP_MIN_CREDITS, stepped));
+}
 export function creditTopupUsdCents(credits) {
     if (!isValidCreditTopupCredits(credits))
         return null;

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -21,15 +21,20 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         id: "discovery-and-skills",
         layer: "Control",
         primitive: null,
-        owns: "Bounded capability, command, provider-operation, Recipe, and product-skill discovery with exact hydration on demand.",
+        owns: "Bounded capability, command, provider-operation, Recipe, and product-skill discovery, plus INSTANCE discovery — what this workspace actually holds — with exact hydration on demand.",
         notFor: "Executing GTM work or loading full manifests and schemas before a capability is selected.",
-        execution: "Search by outcome, choose the owner, then hydrate one exact command, MCP schema, provider descriptor, or skill.",
+        execution: "Search by outcome, choose the owner, then hydrate one exact command, MCP schema, provider descriptor, or skill. For instance discovery, read the map and then the primitive that owns the row.",
         posture: "read_only",
-        gatewayTools: ["oxygen_capabilities_search", "oxygen_tools_search", "oxygen_recipes_list"],
-        gatewayCommands: ["capabilities search", "commands search", "skills search", "tools search", "recipes list"],
+        gatewayTools: ["oxygen_capabilities_search", "oxygen_tools_search", "oxygen_recipes_list", "oxygen_workspace_map"],
+        gatewayCommands: ["capabilities search", "commands search", "skills search", "tools search", "recipes list", "workspace map"],
         skills: ["oxygen-quickstart", "oxygen-gtm"],
-        endpointSections: ["skills"],
-        intentTerms: ["discover", "discovery", "capability", "capabilities", "command", "commands", "skill", "skills", "which tool", "how do i"],
+        // `workspace` (the map) belongs here rather than beside `home`: capability
+        // discovery answers what OXYGEN can do and instance discovery answers what THIS
+        // workspace holds, and they are the same act — bounded, read-only, hydrate one
+        // thing on demand. `home` stayed on the onboarding card because the standup is a
+        // first-run surface; the map is not.
+        endpointSections: ["skills", "workspace"],
+        intentTerms: ["discover", "discovery", "capability", "capabilities", "command", "commands", "skill", "skills", "which tool", "how do i", "what do i have", "what is in my workspace", "workspace map"],
     },
     {
         id: "onboarding-and-copilot",
@@ -196,7 +201,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         gatewayTools: ["oxygen_tables_create", "oxygen_columns_add", "oxygen_enrich_column_preview", "oxygen_tables_link_bulk"],
         gatewayCommands: ["tables create", "columns add", "enrich-column preview", "tables link"],
         skills: ["oxygen-gtm", "oxygen-table-tidy", "oxygen-diagnostics", "oxygen-clay-migration"],
-        endpointSections: ["action-columns", "callables", "columns", "company-enrichment", "enrich-column", "enrichment", "projects", "table-action-runs", "table-ingestion-runs", "tables"],
+        endpointSections: ["action-columns", "callables", "columns", "company-enrichment", "enrich-column", "enrichment", "projects", "table-action-items", "table-action-runs", "table-ingestion-runs", "tables"],
         // "link"/"join"/"connect"/"relate" route here for `tables link`. Added after a
         // blind user eval asked for exactly "link two tables" and was routed to
         // `tables create` / `columns add` / `enrich-column preview` — none of which

package/node_modules/@oxygen/shared/dist/copilot-errors.d.ts

@@ -1,5 +1,6 @@
 export declare const COPILOT_TURN_TIMEOUT_CODE = "copilot_turn_timeout";
 export declare const COPILOT_TURN_TIMEOUT_MESSAGE = "This Copilot request timed out and stopped. Any completed actions are still saved\u2014review this session before trying again.";
+export declare const COPILOT_TURN_DEADLINE_EXCEEDED_CODE = "copilot_turn_deadline_exceeded";
 export type CustomerFacingCopilotError = {
     code: string | null;
     message: string | null;

package/node_modules/@oxygen/shared/dist/copilot-errors.js

@@ -4,6 +4,14 @@
 // and already-persisted failures serialize identically across web, CLI, and MCP.
 export const COPILOT_TURN_TIMEOUT_CODE = "copilot_turn_timeout";
 export const COPILOT_TURN_TIMEOUT_MESSAGE = "This Copilot request timed out and stopped. Any completed actions are still saved—review this session before trying again.";
+// A turn the worker refused to start because it was ALREADY past its stamped
+// wall-clock deadline when it was reclaimed. Distinct in the durable row from
+// `copilot_turn_timeout` (a turn that ran and then ran out of clock) so an
+// operator can separate "we never started it" from "we could not finish it" in
+// SQL — but deliberately NOT distinct to the customer: the mapping below folds
+// it into the same timeout contract every Control surface already renders, per
+// this module's policy.
+export const COPILOT_TURN_DEADLINE_EXCEEDED_CODE = "copilot_turn_deadline_exceeded";
 const WORKER_STEP_TIMEOUT_MESSAGE = /\bWorker step '[^']+' exceeded \d+ms deadline\.?/i;
 /**
  * Replace an internal worker deadline with the stable Copilot timeout contract.
@@ -15,6 +23,7 @@ export function customerFacingCopilotError(input) {
     const message = input.message ?? null;
     const isTimeout = code === "worker_step_timeout" ||
         code === COPILOT_TURN_TIMEOUT_CODE ||
+        code === COPILOT_TURN_DEADLINE_EXCEEDED_CODE ||
         (message !== null && WORKER_STEP_TIMEOUT_MESSAGE.test(message));
     return isTimeout
         ? { code: COPILOT_TURN_TIMEOUT_CODE, message: COPILOT_TURN_TIMEOUT_MESSAGE }

package/node_modules/@oxygen/shared/dist/copilot-plan.d.ts

@@ -109,6 +109,8 @@ export type CopilotPlanProjection = {
         /** True when the turn's wall-clock deadline, not the plan, is the binding bound. */
         deadlineBound: boolean;
     };
+    /** False when no turn is executing: the plan is history, not work in flight. */
+    turnActive: boolean;
     /** Ledger position of the newest plan_updated, so a caller can tell staleness. */
     updatedAtSeq: number;
     updatedAt: string;
@@ -124,6 +126,20 @@ export type ProjectCopilotPlanInput = {
     events: CopilotPlanSourceEvent[];
     /** The active turn's wall-clock deadline, used only to clamp the total. */
     turnDeadlineAt?: string | Date | null;
+    /**
+     * Whether a turn is executing right now. Defaults to true.
+     *
+     * A plan OUTLIVES the turn that wrote it. The model routinely stops without
+     * marking its last step done, so the session rests in the ledger forever with a
+     * step still `in_progress`. Read against a running clock that step accrues
+     * elapsed time indefinitely -- production session fd259942 reached 37 DAYS --
+     * and the surface goes on offering "time remaining" for work that stopped weeks
+     * ago. Both are the same error: treating a historical record as work in flight.
+     *
+     * So the clock stops with the turn, and a plan nobody is working reports no
+     * estimate at all rather than a false one.
+     */
+    turnActive?: boolean;
     now?: Date;
 };
 /**
@@ -135,3 +151,26 @@ export type ProjectCopilotPlanInput = {
  * would be worse than one that stays away.
  */
 export declare function projectCopilotPlan(input: ProjectCopilotPlanInput): CopilotPlanProjection | null;
+/**
+ * "<capability>: <gist>" for a failed call. The gist is the summary cut at its
+ * first sentence or clause boundary and then hard-capped, so a schema dump or a
+ * multi-sentence explanation cannot become the title; a summary that is only
+ * the capability's own name, or empty, leaves the bare name.
+ */
+export declare function failedToolSubstepTitle(capability: string, summary: string): string;
+/**
+ * How long, in words. One owner, because there were three and all three were wrong.
+ *
+ * The rail, `oxygen copilot plan` and the MCP widget each carried their own copy
+ * of this, and every copy did `Math.floor(s / 60)` minutes with `Math.round(s % 60)`
+ * seconds -- which rounds the remainder INDEPENDENTLY of the minutes it was taken
+ * from. A 179.6s sub-agent therefore rendered as "2m 60s" on all three surfaces
+ * (observed live in session 34826105), and 59.6s rendered as "60s" rather than
+ * "1m". Rounding the total FIRST and splitting afterwards cannot produce either.
+ *
+ * The projection promised one implementation behind three surfaces; the numbers
+ * were shared and the words describing them were not, so this is where they meet.
+ */
+export declare function formatCopilotPlanSeconds(seconds: number): string;
+/** A duration in ms, or null when there is nothing worth showing. */
+export declare function formatCopilotPlanDuration(ms: number | null | undefined): string | null;

package/node_modules/@oxygen/shared/dist/copilot-plan.js

@@ -169,6 +169,13 @@ export function projectCopilotPlan(input) {
     const planEvents = events.filter((event) => event.kind === "plan_updated");
     if (planEvents.length === 0)
         return null;
+    // The plan's clock stops when the turn does -- see `turnActive` on the input.
+    // `Math.min` because a clock that runs BACKWARDS is worse than one that stops:
+    // the last event is normally in the past, but a clock skew must not make an
+    // elapsed time negative.
+    const turnActive = input.turnActive !== false;
+    const lastEvent = events[events.length - 1];
+    const clockMs = turnActive || !lastEvent ? nowMs : Math.min(nowMs, toMs(lastEvent.created_at));
     // -- Pass 1: fold the successive plans into one tracked set -----------------
     //
     // Identity is what makes timing possible. Match on `id` first, then on the
@@ -230,7 +237,7 @@ export function projectCopilotPlan(input) {
     if (tracked.length === 0)
         return null;
     // -- Pass 2: attribute observed tool calls to the step that was running -----
-    attributeToolCalls(events, planEvents, tracked, nowMs);
+    attributeToolCalls(events, planEvents, tracked, clockMs);
     // -- Pass 3: the ETA --------------------------------------------------------
     const samples = tracked
         .filter((t) => t.status === "done" && t.startedAtMs !== null && t.endedAtMs !== null)
@@ -250,10 +257,11 @@ export function projectCopilotPlan(input) {
         // Once a step has started it has an elapsed time: its own end if it finished,
         // otherwise the clock. A step that never started has none -- which is exactly
         // why it is also never a measurement sample.
-        const elapsedMs = entry.startedAtMs === null ? null : (entry.endedAtMs ?? nowMs) - entry.startedAtMs;
+        const elapsedMs = entry.startedAtMs === null ? null : (entry.endedAtMs ?? clockMs) - entry.startedAtMs;
         let etaSeconds = null;
         let etaBasis = "none";
-        if (entry.status === "pending" || entry.status === "in_progress") {
+        // A step only has time REMAINING while something is running to consume it.
+        if (turnActive && (entry.status === "pending" || entry.status === "in_progress")) {
             let budget = null;
             if (entry.estimateSeconds !== null && calibration !== null) {
                 budget = entry.estimateSeconds * calibration;
@@ -307,6 +315,7 @@ export function projectCopilotPlan(input) {
     }
     const done = steps.filter((step) => step.status === "done").length;
     return {
+        turnActive,
         summary: summary.length > 0 ? summary : null,
         steps,
         progress: { done, total: steps.length, ratio: steps.length === 0 ? 0 : done / steps.length },
@@ -327,7 +336,7 @@ export function projectCopilotPlan(input) {
  * Attribution uses the plan as of the call's own seq, not the final plan -- a call
  * made during step 2 belongs to step 2 even after step 4 becomes current.
  */
-function attributeToolCalls(events, planEvents, tracked, nowMs) {
+function attributeToolCalls(events, planEvents, tracked, clockMs) {
     const byId = new Map(tracked.map((t) => [t.id, t]));
     const byTitle = new Map(tracked.map((t) => [normalizeTitleKey(t.title), t]));
     /** Which tracked step was in progress at a given ledger position. */
@@ -387,13 +396,22 @@ function attributeToolCalls(events, planEvents, tracked, nowMs) {
         if (!target)
             continue;
         const rollup = rollups.get(callId);
+        const failed = payload.ok === false;
         target.toolSubsteps.push({
             id: callId,
             // `summary` is the tool_call_finished remap the Copilot host writes; it is a
             // line ("63 columns"), which is what a substep wants. Fall back to the
             // capability name rather than to a serialized result.
-            title: readText(payload.summary) || capability,
-            status: payload.ok === false ? "blocked" : "done",
+            //
+            // A FAILED call's summary is the error message, which is prose about the
+            // failure rather than a name for the step -- a sub-agent's "did not finish
+            // (FAILED): This sub-agent run reached its ceiling of 4 model calls."
+            // became the substep's whole title. The rail needs what failed and the
+            // gist of why, bounded, with the red mark carrying the status.
+            title: failed
+                ? failedToolSubstepTitle(capability, readText(payload.summary))
+                : readText(payload.summary) || capability,
+            status: failed ? "blocked" : "done",
             source: "tool",
             durationMs: started ? toMs(event.created_at) - started.startedMs : null,
             startedAt: started ? new Date(started.startedMs).toISOString() : null,
@@ -409,11 +427,30 @@ function attributeToolCalls(events, planEvents, tracked, nowMs) {
             title: entry.capability,
             status: "in_progress",
             source: "tool",
-            durationMs: nowMs - entry.startedMs,
+            durationMs: clockMs - entry.startedMs,
             startedAt: new Date(entry.startedMs).toISOString(),
         });
     }
 }
+/** How much of a failure's reason a substep title carries before it stops being a label. */
+const FAILED_SUBSTEP_REASON_CHARS = 90;
+/**
+ * "<capability>: <gist>" for a failed call. The gist is the summary cut at its
+ * first sentence or clause boundary and then hard-capped, so a schema dump or a
+ * multi-sentence explanation cannot become the title; a summary that is only
+ * the capability's own name, or empty, leaves the bare name.
+ */
+export function failedToolSubstepTitle(capability, summary) {
+    const trimmed = summary.trim();
+    if (!trimmed || trimmed === capability)
+        return capability;
+    const boundary = trimmed.search(/[.:;](\s|$)|\n/);
+    let gist = boundary > 0 ? trimmed.slice(0, boundary) : trimmed;
+    if (gist.length > FAILED_SUBSTEP_REASON_CHARS) {
+        gist = `${gist.slice(0, FAILED_SUBSTEP_REASON_CHARS - 1).trimEnd()}…`;
+    }
+    return `${capability}: ${gist}`;
+}
 /**
  * Model-declared substeps first, then the observed calls.
  *
@@ -433,3 +470,35 @@ function mergeSubsteps(entry) {
     }));
     return [...declared, ...entry.toolSubsteps];
 }
+// ---------------------------------------------------------------------------
+// Formatting
+// ---------------------------------------------------------------------------
+/**
+ * How long, in words. One owner, because there were three and all three were wrong.
+ *
+ * The rail, `oxygen copilot plan` and the MCP widget each carried their own copy
+ * of this, and every copy did `Math.floor(s / 60)` minutes with `Math.round(s % 60)`
+ * seconds -- which rounds the remainder INDEPENDENTLY of the minutes it was taken
+ * from. A 179.6s sub-agent therefore rendered as "2m 60s" on all three surfaces
+ * (observed live in session 34826105), and 59.6s rendered as "60s" rather than
+ * "1m". Rounding the total FIRST and splitting afterwards cannot produce either.
+ *
+ * The projection promised one implementation behind three surfaces; the numbers
+ * were shared and the words describing them were not, so this is where they meet.
+ */
+export function formatCopilotPlanSeconds(seconds) {
+    if (!Number.isFinite(seconds))
+        return "0s";
+    const total = Math.max(Math.round(seconds), 0);
+    if (total < 60)
+        return `${total}s`;
+    const minutes = Math.floor(total / 60);
+    const rest = total % 60;
+    return rest === 0 ? `${minutes}m` : `${minutes}m ${rest}s`;
+}
+/** A duration in ms, or null when there is nothing worth showing. */
+export function formatCopilotPlanDuration(ms) {
+    if (typeof ms !== "number" || !Number.isFinite(ms) || ms <= 0)
+        return null;
+    return ms < 1000 ? `${Math.round(ms)}ms` : formatCopilotPlanSeconds(ms / 1000);
+}

package/node_modules/@oxygen/shared/dist/langfuse.d.ts

@@ -54,11 +54,42 @@ export type LlmEventBody = {
     sessionId?: string | null;
     userId?: string | null;
 };
+/**
+ * An eval/annotation attached to a trace (ADR 0014 files these as exactly what
+ * the LLM store exists to enable). Narrower than the API's CreateScoreRequest on
+ * purpose: `traceId` is REQUIRED (a score orphaned from its trace is unreadable
+ * in the UI), `value` is numeric-only, and `dataType` drops "CATEGORICAL"
+ * because that variant requires a *string* value. Widening later stays additive.
+ */
+export type LlmScoreBody = {
+    /** Deterministic id upserts; omit for a new score each call. */
+    id?: string;
+    traceId: string;
+    name: string;
+    value: number;
+    dataType?: "BOOLEAN" | "NUMERIC";
+    comment?: string;
+};
 export type LlmTracingClient = {
     trace(body: LlmTraceBody): void;
     span(body: LlmSpanBody): void;
     generation(body: LlmGenerationBody): void;
     event(body: LlmEventBody): void;
+    /**
+     * Attach a score to an existing trace.
+     *
+     * ASYNC, unlike the four above, because it is not the same transport. Spans go
+     * through the OTel processor, which batches and is drained by `flush()`; a
+     * score has no span, so it is one HTTP call to the scores API. Awaiting it is
+     * what keeps it alive on a serverless function that freezes the moment the
+     * handler returns — there is nothing for `flush()` to drain on its behalf.
+     *
+     * Never rejects: resolves `true` when the score was accepted, `false` when it
+     * was not (transport down, tracing misconfigured, API refusal). Fail-open like
+     * every other path here — telemetry must not break the product write it
+     * describes.
+     */
+    score(body: LlmScoreBody): Promise<boolean>;
     /** Never rejects; bounded at ~5s. */
     flush(): Promise<void>;
     /** Flush + stop background timers. Never rejects; bounded at ~5s. */
@@ -108,6 +139,10 @@ export type LlmEmitter = {
     flush(): Promise<void>;
     shutdown(): Promise<void>;
 };
+export type LlmScorer = {
+    /** Resolves true when the score was accepted. Never rejects. */
+    score(body: LlmScoreBody): Promise<boolean>;
+};
 /**
  * Construct a fail-open Langfuse client, or `null` when tracing is disabled or
  * misconfigured. Prefer the process-wide `getLlmTracingClient` in app code;
@@ -115,6 +150,7 @@ export type LlmEmitter = {
  */
 export declare function createLlmTracingClient(env?: EnvMap, options?: {
     emitterImpl?: LlmEmitter;
+    scorerImpl?: LlmScorer;
 }): LlmTracingClient | null;
 export declare function getLlmTracingClient(env?: EnvMap): LlmTracingClient | null;
 /** Flush the singleton if it exists. Never rejects. Hang off request/cycle ends. */

package/node_modules/@oxygen/shared/dist/langfuse.js

@@ -126,6 +126,17 @@ function boundJsonField(value) {
         preview: serialized.slice(0, MAX_JSON_FIELD_CHARS),
     };
 }
+// A score's `comment` is free text (a thumbs-down reason is user-authored and
+// unbounded) and the API types it as a STRING, so it cannot take
+// boundJsonField's `{truncated, preview}` envelope. It gets the same
+// MAX_JSON_FIELD_CHARS ceiling and the same "explicit marker, never a silent
+// clip" rule, with the marker counted INSIDE the cap so the bound holds.
+const COMMENT_TRUNCATION_MARKER = "…[truncated]";
+function boundComment(comment) {
+    if (comment.length <= MAX_JSON_FIELD_CHARS)
+        return comment;
+    return comment.slice(0, MAX_JSON_FIELD_CHARS - COMMENT_TRUNCATION_MARKER.length) + COMMENT_TRUNCATION_MARKER;
+}
 function compact(body) {
     const out = {};
     for (const [key, value] of Object.entries(body)) {
@@ -223,6 +234,65 @@ function createOtelEmitter(env, warn) {
         shutdown: () => init().then((h) => h?.processor.shutdown() ?? Promise.resolve()),
     };
 }
+/**
+ * The real scorer: one authenticated POST to the Langfuse scores API.
+ *
+ * `@langfuse/core` is imported LAZILY on first score for the same reason the
+ * OTel tree is — a runtime with tracing disabled (the packed CLI, every test)
+ * never pays for it.
+ *
+ * The API client's `environment` option is its BASE URL, not the Langfuse
+ * environment tag; the tag is the `environment` FIELD on the score body, and it
+ * is resolved from the same helper the span processor uses so a score lands in
+ * the same Langfuse environment as the trace it scores. OXYGEN always sets
+ * LANGFUSE_BASE_URL (the project is US-region and the EU host 401s these keys);
+ * the fallback is the SDK's documented default, which `@langfuse/core` itself
+ * does not supply.
+ */
+function createApiScorer(env, warn) {
+    let handle = null;
+    const init = () => {
+        handle ??= (async () => {
+            try {
+                const { LangfuseAPIClient } = await import("@langfuse/core");
+                const client = new LangfuseAPIClient({
+                    environment: env.LANGFUSE_BASE_URL?.trim() || "https://cloud.langfuse.com",
+                    username: env.LANGFUSE_PUBLIC_KEY,
+                    password: env.LANGFUSE_SECRET_KEY,
+                });
+                return client.scores;
+            }
+            catch (error) {
+                warn(error, { stage: "score_init" });
+                return null;
+            }
+        })();
+        return handle;
+    };
+    return {
+        score: async (body) => {
+            try {
+                const api = await init();
+                if (!api)
+                    return false;
+                await api.create(compact({
+                    id: body.id,
+                    traceId: body.traceId,
+                    name: body.name,
+                    value: body.value,
+                    dataType: body.dataType,
+                    comment: typeof body.comment === "string" ? boundComment(body.comment) : undefined,
+                    environment: resolveLlmTracingEnvironment(env),
+                }));
+                return true;
+            }
+            catch (error) {
+                warn(error, { stage: "score" });
+                return false;
+            }
+        },
+    };
+}
 /**
  * Construct a fail-open Langfuse client, or `null` when tracing is disabled or
  * misconfigured. Prefer the process-wide `getLlmTracingClient` in app code;
@@ -244,6 +314,7 @@ export function createLlmTracingClient(env = process.env, options) {
         });
     };
     const emitter = options?.emitterImpl ?? createOtelEmitter(env, warn);
+    const scorer = options?.scorerImpl ?? createApiScorer(env, warn);
     const guarded = (fn, stage) => {
         try {
             fn();
@@ -351,6 +422,18 @@ export function createLlmTracingClient(env = process.env, options) {
                 endTime: startTime,
             });
         }, "event"),
+        // Already fail-open inside the scorer; the extra catch is here so that a
+        // scorer which throws SYNCHRONOUSLY (a substituted one in a test, a future
+        // implementation) still cannot escape into a product write.
+        score: async (body) => {
+            try {
+                return await scorer.score(body);
+            }
+            catch (error) {
+                warn(error, { stage: "score" });
+                return false;
+            }
+        },
         // The "never rejects, bounded at ~5s" contract is the CLIENT's, so it is
         // enforced here rather than inside one emitter — an emitter that throws
         // synchronously or rejects must still not escape into product code.

package/node_modules/@oxygen/shared/dist/linkedin-quota-denial.d.ts

@@ -1,5 +1,5 @@
 /**
- * How a LinkedIn quota denial is read by the background jobs that hit it.
+ * How a LinkedIn/WhatsApp quota denial is read by the background jobs that hit it.
  *
  * The denial itself is raised by the chokepoint in
  * packages/integrations/src/linkedin-quota.ts; this module is the consumer half,

package/node_modules/@oxygen/shared/dist/linkedin-quota-denial.js

@@ -1,5 +1,5 @@
 /**
- * How a LinkedIn quota denial is read by the background jobs that hit it.
+ * How a LinkedIn/WhatsApp quota denial is read by the background jobs that hit it.
  *
  * The denial itself is raised by the chokepoint in
  * packages/integrations/src/linkedin-quota.ts; this module is the consumer half,
@@ -16,10 +16,21 @@
  */
 import { OxygenError } from "./cli-result.js";
 import { isRecord } from "./type-guards.js";
-// The two codes a denial is raised with. Either is a "come back later" signal,
-// not a broken caller: a daily cap / closed active window that reopens on its own
-// clock, or an account the status webhook will reactivate.
-const QUOTA_DENIED_CODES = new Set(["linkedin_rate_limited", "linkedin_account_unavailable"]);
+// The codes a denial is raised with. Each is a "come back later" signal, not a
+// broken caller: a daily cap / closed active window that reopens on its own clock,
+// or an account the status webhook will reactivate.
+//
+// The WhatsApp mirrors are here because the inbox backstop is shared across
+// networks: a WhatsApp daily-limit denial was reaching it, missing this set, and
+// so was logged as a failure AND never parked -- the same hot re-deny loop the
+// LinkedIn codes were added to stop. Both WhatsApp denials carry `resets_at`, so
+// the park lands on the real reset rather than the fallback below.
+const QUOTA_DENIED_CODES = new Set([
+    "linkedin_rate_limited",
+    "linkedin_account_unavailable",
+    "whatsapp_rate_limited",
+    "whatsapp_account_unavailable",
+]);
 /** Park length when a denial carries no usable `resets_at` hint. */
 const QUOTA_FALLBACK_BACKOFF_MS = 60 * 60 * 1000;
 /** Was this thrown error the quota chokepoint refusing the call? */