@oxygen-agent/cli 1.987.20 → 1.1010.1

package/node_modules/@oxygen/shared/dist/error-message.d.ts

@@ -0,0 +1 @@
+export declare function errorMessage(error: unknown): string;

package/node_modules/@oxygen/shared/dist/error-message.js

@@ -0,0 +1,3 @@
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/node_modules/@oxygen/shared/dist/error-redaction.js

@@ -20,6 +20,7 @@
 // idempotent, never throws, and never widens a message.
 import { redactSecretsInString } from "./redaction.js";
 import { isRetryableConcurrencyError, redactSqlParameters } from "./sql-error.js";
+import { isRecord } from "./type-guards.js";
 // Whole fields whose NAME marks them secret. Unchanged from the operation-event
 // writer this was extracted from; substring credentials (Bearer/sk-/DB URLs) are
 // scrubbed separately by redactSecretsInString.
@@ -306,6 +307,3 @@ export function summarizeProviderBody(body) {
 function truncate(value, maxLength) {
     return value.length > maxLength ? `${value.slice(0, maxLength - 3)}...` : value;
 }
-function isRecord(value) {
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}

package/node_modules/@oxygen/shared/dist/external-write-policy.d.ts

@@ -0,0 +1,33 @@
+export type ExternalWritePolicy = "allow" | "deny";
+/** The error code every refusal carries, on every surface. */
+export declare const EXTERNAL_WRITES_DENIED_CODE = "external_writes_denied";
+export declare const EXTERNAL_WRITES_ENV_VAR = "OXYGEN_EXTERNAL_WRITES";
+type PolicyEnv = {
+    [key: string]: string | undefined;
+};
+/**
+ * `deny` when `OXYGEN_EXTERNAL_WRITES` is exactly `deny` (trimmed,
+ * case-insensitive), `allow` for anything else including unset.
+ *
+ * Read per call rather than memoized at module load: the value is read on paths
+ * a test needs to drive both ways, and a process-static snapshot would make the
+ * denial untestable in exactly the suite that has to prove it.
+ */
+export declare function resolveExternalWritePolicy(env?: PolicyEnv): ExternalWritePolicy;
+/** Convenience predicate for callers that only branch. */
+export declare function externalWritesDenied(env?: PolicyEnv): boolean;
+/**
+ * Refuse `action` when this environment denies external writes.
+ *
+ * Throws `OxygenError` with code `external_writes_denied` so the refusal travels
+ * the CLI/MCP envelope, the run record and the worker's job failure the same way
+ * every other refusal does — a shadow that swallows the denial into a generic
+ * failure teaches its operator nothing.
+ *
+ * Logged at `warn`, not `error`: a refusal here is the control WORKING, and the
+ * shadow's soak is expected to produce a stream of them. The message names both
+ * the action and the variable, because the person reading it in Axiom is usually
+ * asking "why did nothing send" and the answer is a configuration they set.
+ */
+export declare function assertExternalWritesAllowed(action: string, env?: PolicyEnv): void;
+export {};

package/node_modules/@oxygen/shared/dist/external-write-policy.js

@@ -0,0 +1,68 @@
+// The environment-level external-write denial, and the one place that reads
+// `OXYGEN_EXTERNAL_WRITES`.
+//
+// WHY THIS EXISTS AND WHY IT IS NOT A CLASSIFIER. A production *shadow* holds a
+// restored copy of production: real mailbox OAuth tokens, real provider
+// credentials, real customer records — while managed production is still live
+// and doing the same work. The restore script scrubs those columns, but a scrub
+// is data hygiene, not a guarantee: one un-nulled column is one real send, to a
+// real prospect, twice. So the shadow also fails closed at the platform
+// boundary (`.agents/skills/oxygen-self-host-cutover`, Part 1 Control 3).
+//
+// THE ORDERING IS THE SAFETY PROPERTY, and it is the same lesson
+// `EXTERNAL_REACH_CAPABILITY_NAMES` (packages/copilot/src/policy.ts) was written
+// to record: `capabilityLooksPaid` read ARGUMENT NAMES, so a write-capable tool
+// declaring `max_credits` classified `paid` and could never reach the
+// `external_write` branch — which made a real outbound launch waivable by an
+// approval-free spend budget on a declared ceiling of one credit. A denial that
+// runs anywhere except FIRST inherits exactly that defect. Every caller here
+// asks this before it classifies, before it evaluates an allowance, an approval
+// or a policy rule, and before it constructs a provider client.
+//
+// UNSET MEANS ALLOW, deliberately and permanently. Managed production must be
+// byte-identical to the day before this module landed; only a shadow sets the
+// variable. `deny` is the only recognised denial value — a typo (`denied`,
+// `true`, `1`) allows, which is the fail-OPEN direction and is the right one
+// here: a variable nobody set must never take production off the air, and the
+// shadow's operator proves the denial by ATTEMPTING a send and observing the
+// refusal rather than by trusting the configuration (same skill, "Proving it,
+// rather than believing it").
+import { OxygenError } from "./cli-result.js";
+import { log } from "./log.js";
+/** The error code every refusal carries, on every surface. */
+export const EXTERNAL_WRITES_DENIED_CODE = "external_writes_denied";
+export const EXTERNAL_WRITES_ENV_VAR = "OXYGEN_EXTERNAL_WRITES";
+/**
+ * `deny` when `OXYGEN_EXTERNAL_WRITES` is exactly `deny` (trimmed,
+ * case-insensitive), `allow` for anything else including unset.
+ *
+ * Read per call rather than memoized at module load: the value is read on paths
+ * a test needs to drive both ways, and a process-static snapshot would make the
+ * denial untestable in exactly the suite that has to prove it.
+ */
+export function resolveExternalWritePolicy(env = process.env) {
+    return env[EXTERNAL_WRITES_ENV_VAR]?.trim().toLowerCase() === "deny" ? "deny" : "allow";
+}
+/** Convenience predicate for callers that only branch. */
+export function externalWritesDenied(env = process.env) {
+    return resolveExternalWritePolicy(env) === "deny";
+}
+/**
+ * Refuse `action` when this environment denies external writes.
+ *
+ * Throws `OxygenError` with code `external_writes_denied` so the refusal travels
+ * the CLI/MCP envelope, the run record and the worker's job failure the same way
+ * every other refusal does — a shadow that swallows the denial into a generic
+ * failure teaches its operator nothing.
+ *
+ * Logged at `warn`, not `error`: a refusal here is the control WORKING, and the
+ * shadow's soak is expected to produce a stream of them. The message names both
+ * the action and the variable, because the person reading it in Axiom is usually
+ * asking "why did nothing send" and the answer is a configuration they set.
+ */
+export function assertExternalWritesAllowed(action, env = process.env) {
+    if (resolveExternalWritePolicy(env) !== "deny")
+        return;
+    log("warn", "external_writes.denied", { action });
+    throw new OxygenError(EXTERNAL_WRITES_DENIED_CODE, `External writes are denied in this environment (${EXTERNAL_WRITES_ENV_VAR}=deny), so "${action}" cannot run.`, { details: { action, env_var: EXTERNAL_WRITES_ENV_VAR } });
+}

package/node_modules/@oxygen/shared/dist/format-percent.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Canonical percentage formatting shared by the web app and MCP surfaces.
+ */
+/**
+ * Format a 0..1 ratio as an en-US percentage with at most one decimal; `null`
+ * renders as an em dash. The locale is pinned so web and MCP cannot drift.
+ */
+export declare function formatPercent(value: number | null): string;

package/node_modules/@oxygen/shared/dist/format-percent.js

@@ -0,0 +1,13 @@
+/**
+ * Canonical percentage formatting shared by the web app and MCP surfaces.
+ */
+/**
+ * Format a 0..1 ratio as an en-US percentage with at most one decimal; `null`
+ * renders as an em dash. The locale is pinned so web and MCP cannot drift.
+ */
+export function formatPercent(value) {
+    return value === null ? "—" : new Intl.NumberFormat("en-US", {
+        style: "percent",
+        maximumFractionDigits: 1,
+    }).format(value);
+}

package/node_modules/@oxygen/shared/dist/freemail-domains.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Consumer / freemail mail hosts — the ONE list, in two deliberate tiers.
+ *
+ * EIGHT call sites used to carry their own hand-typed copy of this concept — 101, 34, 34,
+ * 25, 22, 18, 13 and 12 entries — none importing another, none covered by a test
+ * asserting they agreed, and two of them byte-identical forks that nothing kept in sync.
+ * The same address resolved differently depending on which copy a code path happened to
+ * reach. This module is the single source of truth; `packages/shared` is the only leaf
+ * package all eight can reach without inverting a dependency edge.
+ *
+ * WHY TWO TIERS, and why they must not be collapsed into one:
+ *
+ * The callers are not asking the same question, and the cost of a wrong answer is
+ * asymmetric in opposite directions.
+ *
+ * - `FREEMAIL_DOMAINS` (core) answers "may I treat this domain as a shared EMPLOYER?"
+ *   Two consumers ride on that answer, and they fail in OPPOSITE directions, which is
+ *   why this tier is conservative rather than generous:
+ *
+ *     1. The company-scope reply stop (`settings.stop_on_reply_scope = "company_domain"`)
+ *        terminalizes an enrollment's colleagues by matching domain. A host wrongly IN
+ *        this tier is harmless here; a host wrongly OUT of it stops strangers who merely
+ *        share a mail host — real, customer-visible damage.
+ *     2. Company derivation from a person's email domain
+ *        (`deriveCompanyDomainFromEmail`, `packages/tenant-db/src/table-link-plan.ts`)
+ *        drops freemail before offering a domain as a company join key. Here the
+ *        polarity REVERSES: a host wrongly OUT of this tier makes OXYGEN mint a company
+ *        record for a mail provider, so every @<host> person collapses onto one fake
+ *        account. Where that derivation is wired into record creation, removing a host
+ *        from this tier silently starts creating accounts for it.
+ *
+ *   So a host must be in this tier to be safe for BOTH, and the safe direction for an
+ *   edit is to ADD, never to remove or relocate to the broad tier. Extend it only with
+ *   hosts that are unambiguously consumer mailboxes — and note the ORDER caveat in
+ *   `packages/tenant-db/src/freemail-domains.ts`, because a core-tier edit also changes
+ *   a formula string already persisted in every tenant's column definitions.
+ *
+ * - `PERSONAL_EMAIL_DOMAINS` (broad) answers "is this domain a poor stand-in for a
+ *   COMPANY identity?" — used to skip fetching a workspace icon, to reject a personal
+ *   host typed into the marketing hero form, to avoid picking a personal address as a
+ *   person's work email, and to avoid treating a meeting participant's mail host as their
+ *   employer. Here a false positive costs nothing (we simply decline to guess a company)
+ *   while a miss produces a junk company/icon. So this tier is the superset, including
+ *   regional and privacy-focused providers.
+ *
+ * The broad tier is a strict superset of the core tier by construction below, so a host
+ * can never be "freemail but not personal" — exactly the incoherence the forks had
+ * developed (the old core list carried `t-online.de`; several broad lists did not).
+ *
+ * The broad tier is the union of all eight former lists. Most of its bulk comes from the
+ * old `packages/formula` copy, which was by far the best maintained and is the only one
+ * that covered country-specific variants (`yahoo.co.uk`, `hotmail.fr`, `orange.fr`,
+ * `wp.pl`, `uol.com.br` …) and ISP mailboxes (`comcast.net`, `btinternet.com`). Every
+ * other caller was silently missing those.
+ */
+/** Tier 1 — see the module note. Small on purpose. */
+export declare const FREEMAIL_DOMAINS: ReadonlySet<string>;
+/** Tier 2 — a strict superset of {@link FREEMAIL_DOMAINS}. */
+export declare const PERSONAL_EMAIL_DOMAINS: ReadonlySet<string>;
+/**
+ * Reduce an address or a bare domain to a comparable mail host: lowercased, trimmed,
+ * everything before the last '@' dropped, and a trailing FQDN dot removed. Returns null
+ * for junk/empty/nullish input so callers can distinguish "not a host" from "not in the
+ * set". Previously each fork normalized differently — one did full address handling, two
+ * only lowercased a bare domain — so the same input could resolve differently depending
+ * on which copy you happened to call.
+ */
+export declare function normalizeMailHost(value: string | null | undefined): string | null;
+/**
+ * True when the host is a tier-1 consumer mailbox, i.e. it NEVER identifies a shared
+ * employer. Accepts a bare domain or a full address. Unknown input returns false: an
+ * unrecognized domain is treated as a company domain, which keeps the company-scope
+ * stop's safe default identical to lead-scope.
+ */
+export declare function isFreemailDomain(domain: string | null | undefined): boolean;
+/**
+ * True when the host is a personal mailbox of any kind (tier 2). Use this for "should I
+ * infer a company from this domain?"; use {@link isFreemailDomain} when a false positive
+ * would wrongly group unrelated people as colleagues.
+ */
+export declare function isPersonalEmailDomain(domain: string | null | undefined): boolean;

package/node_modules/@oxygen/shared/dist/freemail-domains.js

@@ -0,0 +1,157 @@
+/**
+ * Consumer / freemail mail hosts — the ONE list, in two deliberate tiers.
+ *
+ * EIGHT call sites used to carry their own hand-typed copy of this concept — 101, 34, 34,
+ * 25, 22, 18, 13 and 12 entries — none importing another, none covered by a test
+ * asserting they agreed, and two of them byte-identical forks that nothing kept in sync.
+ * The same address resolved differently depending on which copy a code path happened to
+ * reach. This module is the single source of truth; `packages/shared` is the only leaf
+ * package all eight can reach without inverting a dependency edge.
+ *
+ * WHY TWO TIERS, and why they must not be collapsed into one:
+ *
+ * The callers are not asking the same question, and the cost of a wrong answer is
+ * asymmetric in opposite directions.
+ *
+ * - `FREEMAIL_DOMAINS` (core) answers "may I treat this domain as a shared EMPLOYER?"
+ *   Two consumers ride on that answer, and they fail in OPPOSITE directions, which is
+ *   why this tier is conservative rather than generous:
+ *
+ *     1. The company-scope reply stop (`settings.stop_on_reply_scope = "company_domain"`)
+ *        terminalizes an enrollment's colleagues by matching domain. A host wrongly IN
+ *        this tier is harmless here; a host wrongly OUT of it stops strangers who merely
+ *        share a mail host — real, customer-visible damage.
+ *     2. Company derivation from a person's email domain
+ *        (`deriveCompanyDomainFromEmail`, `packages/tenant-db/src/table-link-plan.ts`)
+ *        drops freemail before offering a domain as a company join key. Here the
+ *        polarity REVERSES: a host wrongly OUT of this tier makes OXYGEN mint a company
+ *        record for a mail provider, so every @<host> person collapses onto one fake
+ *        account. Where that derivation is wired into record creation, removing a host
+ *        from this tier silently starts creating accounts for it.
+ *
+ *   So a host must be in this tier to be safe for BOTH, and the safe direction for an
+ *   edit is to ADD, never to remove or relocate to the broad tier. Extend it only with
+ *   hosts that are unambiguously consumer mailboxes — and note the ORDER caveat in
+ *   `packages/tenant-db/src/freemail-domains.ts`, because a core-tier edit also changes
+ *   a formula string already persisted in every tenant's column definitions.
+ *
+ * - `PERSONAL_EMAIL_DOMAINS` (broad) answers "is this domain a poor stand-in for a
+ *   COMPANY identity?" — used to skip fetching a workspace icon, to reject a personal
+ *   host typed into the marketing hero form, to avoid picking a personal address as a
+ *   person's work email, and to avoid treating a meeting participant's mail host as their
+ *   employer. Here a false positive costs nothing (we simply decline to guess a company)
+ *   while a miss produces a junk company/icon. So this tier is the superset, including
+ *   regional and privacy-focused providers.
+ *
+ * The broad tier is a strict superset of the core tier by construction below, so a host
+ * can never be "freemail but not personal" — exactly the incoherence the forks had
+ * developed (the old core list carried `t-online.de`; several broad lists did not).
+ *
+ * The broad tier is the union of all eight former lists. Most of its bulk comes from the
+ * old `packages/formula` copy, which was by far the best maintained and is the only one
+ * that covered country-specific variants (`yahoo.co.uk`, `hotmail.fr`, `orange.fr`,
+ * `wp.pl`, `uol.com.br` …) and ISP mailboxes (`comcast.net`, `btinternet.com`). Every
+ * other caller was silently missing those.
+ */
+// Tier 1. Unambiguous global consumer mailboxes. Load-bearing for the company-scope
+// reply stop — read the note above before adding anything here.
+const CORE_FREEMAIL_DOMAINS = [
+    "gmail.com",
+    "googlemail.com",
+    "outlook.com",
+    "hotmail.com",
+    "live.com",
+    "msn.com",
+    "yahoo.com",
+    "ymail.com",
+    "icloud.com",
+    "me.com",
+    "aol.com",
+    "gmx.com",
+    "gmx.net",
+    "gmx.de",
+    "web.de",
+    "proton.me",
+    "protonmail.com",
+    "mail.com",
+    "zoho.com",
+    "yandex.com",
+    "yandex.ru",
+    "t-online.de",
+];
+// Tier 2 additions: country variants of the global providers, regional hosts (qq.com,
+// naver.com, wp.pl, libero.it, uol.com.br), ISP mailboxes (comcast.net, btinternet.com,
+// telenet.be), privacy hosts (pm.me, tutanota.com, duck.com) and prosumer ones
+// (fastmail, hey.com, mac.com). Confident enough to refuse to call any of them a
+// company; NOT confident enough to let them drive a reply-stop decision — an ISP or
+// country-TLD host is exactly where a "shared employer" guess goes wrong.
+// Sorted, because this list is long enough that grouping by theme would rot.
+const ADDITIONAL_PERSONAL_EMAIL_DOMAINS = [
+    "126.com", "163.com", "att.net", "bellsouth.net",
+    "bigpond.com", "bluewin.ch", "blueyonder.co.uk", "bol.com.br",
+    "btinternet.com", "charter.net", "comcast.net", "cox.net",
+    "daum.net", "duck.com", "earthlink.net", "fastmail.com",
+    "fastmail.fm", "free.fr", "freenet.de", "gmx.at",
+    "gmx.ch", "hanmail.net", "hey.com", "home.nl",
+    "hotmail.co.uk", "hotmail.de", "hotmail.es", "hotmail.fr",
+    "hotmail.it", "interia.pl", "kpnmail.nl", "laposte.net",
+    "libero.it", "live.co.uk", "live.de", "live.fr",
+    "mac.com", "mail.ru", "naver.com", "o2.pl",
+    "onet.pl", "optusnet.com.au", "orange.fr", "outlook.co.uk",
+    "outlook.de", "outlook.es", "outlook.fr", "pm.me",
+    "qq.com", "rediffmail.com", "rocketmail.com", "rogers.com",
+    "sbcglobal.net", "seznam.cz", "sfr.fr", "shaw.ca",
+    "sina.com", "sky.com", "skynet.be", "sympatico.ca",
+    "talktalk.net", "telenet.be", "telus.net", "terra.com.br",
+    "tuta.io", "tutanota.com", "uol.com.br", "verizon.net",
+    "virgilio.it", "virginmedia.com", "wanadoo.fr", "wp.pl",
+    "yahoo.ca", "yahoo.co.jp", "yahoo.co.uk", "yahoo.com.au",
+    "yahoo.de", "yahoo.es", "yahoo.fr", "yahoo.it",
+    "ziggo.nl",
+];
+/** Tier 1 — see the module note. Small on purpose. */
+export const FREEMAIL_DOMAINS = new Set(CORE_FREEMAIL_DOMAINS);
+/** Tier 2 — a strict superset of {@link FREEMAIL_DOMAINS}. */
+export const PERSONAL_EMAIL_DOMAINS = new Set([
+    ...CORE_FREEMAIL_DOMAINS,
+    ...ADDITIONAL_PERSONAL_EMAIL_DOMAINS,
+]);
+/**
+ * Reduce an address or a bare domain to a comparable mail host: lowercased, trimmed,
+ * everything before the last '@' dropped, and a trailing FQDN dot removed. Returns null
+ * for junk/empty/nullish input so callers can distinguish "not a host" from "not in the
+ * set". Previously each fork normalized differently — one did full address handling, two
+ * only lowercased a bare domain — so the same input could resolve differently depending
+ * on which copy you happened to call.
+ */
+export function normalizeMailHost(value) {
+    if (typeof value !== "string")
+        return null;
+    let host = value.trim().toLowerCase();
+    if (!host)
+        return null;
+    const at = host.lastIndexOf("@");
+    if (at >= 0)
+        host = host.slice(at + 1);
+    host = host.replace(/\.+$/, "");
+    return host || null;
+}
+/**
+ * True when the host is a tier-1 consumer mailbox, i.e. it NEVER identifies a shared
+ * employer. Accepts a bare domain or a full address. Unknown input returns false: an
+ * unrecognized domain is treated as a company domain, which keeps the company-scope
+ * stop's safe default identical to lead-scope.
+ */
+export function isFreemailDomain(domain) {
+    const host = normalizeMailHost(domain);
+    return host !== null && FREEMAIL_DOMAINS.has(host);
+}
+/**
+ * True when the host is a personal mailbox of any kind (tier 2). Use this for "should I
+ * infer a company from this domain?"; use {@link isFreemailDomain} when a false positive
+ * would wrongly group unrelated people as colleagues.
+ */
+export function isPersonalEmailDomain(domain) {
+    const host = normalizeMailHost(domain);
+    return host !== null && PERSONAL_EMAIL_DOMAINS.has(host);
+}

package/node_modules/@oxygen/shared/dist/future-signup-lifecycle-projection.d.ts

@@ -423,3 +423,4 @@ export declare function normalizeFutureSignupLifecycleProjectionEnvelope(value:
 export declare function normalizeFutureSignupLifecycleProjectionV2Envelope(value: unknown): NormalizedFutureSignupLifecycleProjectionV2Envelope;
 export declare function normalizeFutureSignupLifecycleProjectionDestinationApplyOptions(value: unknown): NormalizedFutureSignupLifecycleProjectionDestinationApplyOptions;
 export declare function normalizeFutureSignupLifecycleProjectionV2DestinationApplyOptions(value: unknown): NormalizedFutureSignupLifecycleProjectionV2DestinationApplyOptions;
+export declare function codeUnitCompare(left: string, right: string): number;

package/node_modules/@oxygen/shared/dist/future-signup-lifecycle-projection.js

@@ -1336,7 +1336,7 @@ function canonicalize(value) {
     }
     return value;
 }
-function codeUnitCompare(left, right) {
+export function codeUnitCompare(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
 function invalid(path, rule) {

package/node_modules/@oxygen/shared/dist/hosted-ai.d.ts

@@ -22,6 +22,17 @@
  */
 export type HostedAiLevel = "low" | "medium" | "high";
 export type HostedAiUseCase = "ai_column" | "copilot" | "agent";
+/**
+ * The Copilot's own level set. `auto` is the only tier a customer can land on
+ * since 2026-09-21 ("Oxygen Auto"); low/medium/high survive because sessions
+ * created before that release carry them in `copilot_sessions.reasoning_level`
+ * and must keep resolving to the model they were priced against.
+ *
+ * Deliberately NOT folded into `HostedAiLevel`: that type is shared with
+ * `AiReasoningLevel` and with the ai_column/agent registries, neither of which
+ * has an `auto` entry, so widening it would force two fictional rows.
+ */
+export type CopilotAiLevel = HostedAiLevel | "auto";
 export type HostedAiModelSpec = {
     /** OpenRouter model id, e.g. "deepseek/deepseek-v4-flash". */
     model: string;
@@ -44,7 +55,11 @@ export type HostedAiModelSpec = {
     /** Upper bound on completion tokens requested for this tier. */
     maxOutputTokens: number;
 };
-export declare const HOSTED_AI_MODEL_REGISTRY: Record<HostedAiUseCase, Record<HostedAiLevel, HostedAiModelSpec>>;
+export declare const HOSTED_AI_MODEL_REGISTRY: {
+    ai_column: Record<HostedAiLevel, HostedAiModelSpec>;
+    copilot: Record<CopilotAiLevel, HostedAiModelSpec>;
+    agent: Record<HostedAiLevel, HostedAiModelSpec>;
+};
 /**
  * What a MANAGED AI column's reasoning tier is called in front of a customer.
  *
@@ -60,8 +75,49 @@ export declare const HOSTED_AI_MODEL_REGISTRY: Record<HostedAiUseCase, Record<Ho
  * their own key, so the real model id is the correct thing to show.
  */
 export declare const MANAGED_AI_TIER_LABELS: Record<HostedAiLevel, string>;
-/** The reasoning tier the hosted copilot runs at by default. */
-export declare const COPILOT_DEFAULT_LEVEL: HostedAiLevel;
+/**
+ * What the Copilot calls its tiers.
+ *
+ * Separate from MANAGED_AI_TIER_LABELS rather than folded into it because the
+ * Copilot's level set is not the AI column's: only the Copilot has `auto`, and
+ * only the Copilot has stopped offering a choice. AI columns and Agents still
+ * sell Fast/Balanced/Max and still mean it.
+ *
+ * Every current session reads "Oxygen Auto". The other three exist so a session
+ * created before 2026-09-21 still renders as the thing its owner picked, rather
+ * than being relabelled under them.
+ */
+export declare const COPILOT_TIER_LABELS: Record<CopilotAiLevel, string>;
+/**
+ * The tier every new Copilot session gets. There is no longer a picker: "Oxygen
+ * Auto" is the whole customer-facing choice (Philipp, 2026-09-21).
+ *
+ * It was `high` until then, which is why 83% of production sessions ran the most
+ * expensive tier -- 110 of 132 sessions across 69 of 81 tenants -- while the
+ * composer's own dropdown told the user that medium was "The default for most
+ * GTM work". Nobody chose that; we defaulted them into it.
+ */
+export declare const COPILOT_DEFAULT_LEVEL: CopilotAiLevel;
+/**
+ * The tier the Copilot's ERRANDS run at: sub-agent children, compaction
+ * summaries, and auto-titles.
+ *
+ * This is the only place a model may differ from the session's own, and it is
+ * safe for one reason: each of those builds a FRESH context rather than
+ * continuing the main transcript -- a child constructs its own Agent and
+ * messages (`packages/agent-runtime/src/subagents.ts`), and the summarizer sends
+ * a two-message prompt with no tools
+ * (`packages/agent-runtime/src/strands-runtime.ts` summarizeForCompaction). A
+ * cold context has no prompt cache to lose and no transcript to corrupt, so the
+ * switch costs nothing. Switching the main thread would cost both.
+ *
+ * It matters because delegation is habitual and currently doubles the price of a
+ * turn: measured over 30 days to 2026-09-21, the 26% of turns that fired
+ * `subagent_run` produced 45% of all Copilot credit burn (1,805 credits/turn
+ * against 786), because every child inherited the parent's model through the
+ * parent's own `callModel`.
+ */
+export declare const COPILOT_ERRAND_LEVEL: CopilotAiLevel;
 export declare const AGENT_DEFAULT_LEVEL: HostedAiLevel;
 /**
  * Resolve the model spec for a hosted-AI use case + reasoning level.
@@ -87,7 +143,7 @@ export declare const AGENT_DEFAULT_LEVEL: HostedAiLevel;
 export declare function findHostedAiModelSpec(model: string, preferredUseCase?: HostedAiUseCase): HostedAiModelSpec | null;
 export declare function resolveHostedAiModel(input: {
     useCase: HostedAiUseCase;
-    level: HostedAiLevel;
+    level: CopilotAiLevel;
     env?: Record<string, string | undefined>;
 }): HostedAiModelSpec;
 /**