@oxygen-agent/cli 1.987.20 → 1.1010.1

package/node_modules/@oxygen/shared/dist/otlp-log-sink.d.ts

@@ -0,0 +1,79 @@
+import { type LogLevel, type LogSink } from "./log.js";
+/**
+ * Ships `log()` records to an OTLP/HTTP logs receiver (the self-hosted SigNoz
+ * collector) instead of — or alongside — Axiom.
+ *
+ * WHY HAND-ROLLED. This is a few dozen lines of JSON against a stable, versioned
+ * wire format. `@opentelemetry/exporter-logs-otlp-http` would pull the OTel logs
+ * SDK, a LoggerProvider, a BatchLogRecordProcessor and their transitive protobuf
+ * machinery into a package that every workspace imports — including edge-safe
+ * ones — to serialize a shape this module states in full below. The exporter
+ * also owns its own batching, so the drop-oldest/never-block/never-throw
+ * contract the two existing shippers hold would become the SDK's opinion rather
+ * than ours. OTLP/JSON is chosen over protobuf for the same reason: no codegen,
+ * no dependency, and a body an operator can read with `curl` when a collector
+ * silently rejects a batch.
+ *
+ * DELIVERY IS BEST-EFFORT BY CONSTRUCTION, exactly like
+ * `apps/worker/src/log-shipper.ts`: the sink only enqueues (it is called from
+ * inside `log()`, so it must never await, throw, or block), the queue drops the
+ * OLDEST record on overflow because the newest lines describe the incident being
+ * debugged, and a collector outage is a dropped batch rather than a process
+ * failure. Failures and queue overflow are reported through `log()`, at most
+ * once per minute each whatever the flush interval (a dead collector behind a
+ * 2 s flush would otherwise write ~43k lines a day into Axiom), with the
+ * failures and drops a suppressed report would have carried accumulated into
+ * the next one, under the re-entrancy guard the Axiom shippers use
+ * (`emittingInternal`): this sink skips the records it emits itself, so a broken
+ * collector cannot feed its own failure line back into its queue, while every
+ * sink composed beside it (Axiom under `OXYGEN_LOG_SINK=both`) and stdout still
+ * receive the line. `log()` always writes stdout before it calls a sink, which
+ * is why the former direct stderr write is not kept as a fallback.
+ */
+export type OtlpLogSinkOptions = {
+    /** Full receiver URL, e.g. `http://collector.internal:4318/v1/logs`. */
+    endpoint: string;
+    /** Extra request headers (collector auth); see `parseOtlpHeaders`. */
+    headers?: Record<string, string> | undefined;
+    /** `service.name` resource attribute. */
+    serviceName: string;
+    /** Resource attributes merged after the defaults, so a caller can override them. */
+    resource?: Record<string, string | null | undefined> | undefined;
+    batchSize?: number | undefined;
+    /** `0` disables the interval timer, for runtimes that flush off a request lifecycle. */
+    flushIntervalMs?: number | undefined;
+    maxQueue?: number | undefined;
+    /** Clock for the report throttle; tests only. */
+    now?: (() => number) | undefined;
+    /**
+     * Lowest level this sink ships; records below it never enter the queue. Null
+     * or absent ships every level. Sinks composed beside this one (Axiom) and
+     * stdout are unaffected; see `resolveOtlpLogMinLevel`.
+     */
+    minLevel?: LogLevel | null | undefined;
+    fetch?: typeof globalThis.fetch | undefined;
+};
+export type OtlpLogSinkHandle = {
+    sink: LogSink;
+    flush: () => Promise<void>;
+    stop: () => Promise<void>;
+};
+/**
+ * Reads `OXYGEN_LOG_OTLP_MIN_LEVEL` (debug|info|warn|error, case-insensitive).
+ *
+ * The OTLP collector is the one transport a noisy tier can drown, so it alone
+ * gets a floor; Axiom and stdout keep every level. Unset ships everything, which
+ * is the behaviour before the variable existed. An unrecognised value is named
+ * through `log()` and treated as unset: dropping more than was asked is the
+ * failure an operator cannot see, so a typo errs toward shipping.
+ */
+export declare function resolveOtlpLogMinLevel(env?: NodeJS.ProcessEnv): LogLevel | null;
+/**
+ * `k=v,k=v` — the same shape as `OTEL_EXPORTER_OTLP_HEADERS`, so an operator who
+ * knows the OTel variable can set ours without learning a second syntax. A pair
+ * with no `=`, or an empty key, is skipped rather than throwing: this is parsed
+ * at process start, and a malformed telemetry header must not stop a boot. The
+ * value keeps every `=` after the first (tokens contain them).
+ */
+export declare function parseOtlpHeaders(raw: string | null | undefined): Record<string, string>;
+export declare function createOtlpLogSink(options: OtlpLogSinkOptions): OtlpLogSinkHandle;

package/node_modules/@oxygen/shared/dist/otlp-log-sink.js

@@ -0,0 +1,366 @@
+import { log } from "./log.js";
+import { resolveDeployEnv } from "./deploy-env.js";
+import { sanitizeLogFields } from "./redaction.js";
+import { trace } from "@opentelemetry/api";
+import { operationalLogSnapshot } from "./operational-telemetry.js";
+import { telemetryEndpointForLog } from "./telemetry-export-observer.js";
+const DEFAULT_BATCH_SIZE = 500;
+const DEFAULT_FLUSH_INTERVAL_MS = 2_000;
+const DEFAULT_MAX_QUEUE = 10_000;
+const EXPORT_TIMEOUT_MS = 10_000;
+const REPORT_WINDOW_MS = 60_000;
+const MAX_RESPONSE_BYTES = 65_536;
+async function rejectedRecords(response, batchLength) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        return 0;
+    const decoder = new TextDecoder();
+    let text = "";
+    let bytes = 0;
+    try {
+        for (;;) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            bytes += chunk.value.byteLength;
+            if (bytes > MAX_RESPONSE_BYTES)
+                throw new Error("invalid_response");
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+        text += decoder.decode();
+        if (!text.trim())
+            return 0;
+        const data = JSON.parse(text);
+        if (!data || typeof data !== "object" || Array.isArray(data))
+            throw new Error("invalid_response");
+        const partial = data.partialSuccess;
+        const rejected = Number(partial?.rejectedLogRecords ?? 0);
+        if (!Number.isSafeInteger(rejected) || rejected < 0 || rejected > batchLength)
+            throw new Error("invalid_response");
+        return rejected;
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+// OTLP severity numbers (logs data model): the base of each 4-value band.
+const SEVERITY_NUMBERS = { debug: 5, info: 9, warn: 13, error: 17 };
+// Set by log() on every record; they become the OTLP record's own fields rather
+// than attributes, so carrying them twice would just inflate every batch.
+const RECORD_FIELDS_NOT_ATTRIBUTES = new Set(["ts", "level", "msg", "trace_id", "span_id"]);
+/**
+ * Reads `OXYGEN_LOG_OTLP_MIN_LEVEL` (debug|info|warn|error, case-insensitive).
+ *
+ * The OTLP collector is the one transport a noisy tier can drown, so it alone
+ * gets a floor; Axiom and stdout keep every level. Unset ships everything, which
+ * is the behaviour before the variable existed. An unrecognised value is named
+ * through `log()` and treated as unset: dropping more than was asked is the
+ * failure an operator cannot see, so a typo errs toward shipping.
+ */
+export function resolveOtlpLogMinLevel(env = process.env) {
+    const raw = env.OXYGEN_LOG_OTLP_MIN_LEVEL?.trim().toLowerCase();
+    if (!raw)
+        return null;
+    if (Object.hasOwn(SEVERITY_NUMBERS, raw))
+        return raw;
+    log("warn", "otlp_log_sink.min_level_invalid", {
+        min_level: raw.slice(0, 32),
+        allowed: Object.keys(SEVERITY_NUMBERS).join("|"),
+    });
+    return null;
+}
+/**
+ * The `code` of a transport error's `cause` (undici puts ECONNREFUSED,
+ * UND_ERR_CONNECT_TIMEOUT and the like there), and nothing else: the message
+ * and the error itself can carry the request URL and, with it, collector
+ * tokens. Anything that is not a short identifier-shaped code is dropped.
+ */
+function sanitizedErrorCause(error) {
+    const cause = error && typeof error === "object" ? error.cause : undefined;
+    const code = cause && typeof cause === "object" ? cause.code : undefined;
+    return typeof code === "string" && /^[A-Z][A-Z0-9_]{1,63}$/.test(code) ? code : null;
+}
+/**
+ * `k=v,k=v` — the same shape as `OTEL_EXPORTER_OTLP_HEADERS`, so an operator who
+ * knows the OTel variable can set ours without learning a second syntax. A pair
+ * with no `=`, or an empty key, is skipped rather than throwing: this is parsed
+ * at process start, and a malformed telemetry header must not stop a boot. The
+ * value keeps every `=` after the first (tokens contain them).
+ */
+export function parseOtlpHeaders(raw) {
+    const headers = {};
+    if (!raw)
+        return headers;
+    for (const pair of raw.split(",")) {
+        const separator = pair.indexOf("=");
+        if (separator <= 0)
+            continue;
+        const key = pair.slice(0, separator).trim();
+        const value = pair.slice(separator + 1).trim();
+        if (!key)
+            continue;
+        headers[key] = value;
+    }
+    return headers;
+}
+function toAnyValue(value) {
+    if (typeof value === "string")
+        return { stringValue: value };
+    if (typeof value === "boolean")
+        return { boolValue: value };
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            return { stringValue: String(value) };
+        // OTLP/JSON encodes int64 as a STRING (proto3 JSON mapping); a bare number
+        // there is what makes a collector reject an otherwise valid record.
+        return Number.isInteger(value) ? { intValue: String(value) } : { doubleValue: value };
+    }
+    if (value === null || value === undefined)
+        return null;
+    try {
+        return { stringValue: JSON.stringify(value) ?? String(value) };
+    }
+    catch {
+        return { stringValue: "[unserializable]" };
+    }
+}
+function toAttributes(source, skip) {
+    const attributes = [];
+    for (const [key, value] of Object.entries(source)) {
+        if (skip?.has(key))
+            continue;
+        const anyValue = toAnyValue(value);
+        if (!anyValue)
+            continue;
+        attributes.push({ key, value: anyValue });
+    }
+    return attributes;
+}
+function timeUnixNano(ts) {
+    const parsed = typeof ts === "string" ? Date.parse(ts) : Number.NaN;
+    const millis = Number.isFinite(parsed) ? parsed : Date.now();
+    // Decimal string, not a number: nanoseconds since the epoch exceed 2^53.
+    return `${millis}000000`;
+}
+/**
+ * The identity contract's tier when `OXYGEN_DEPLOY_ENV` is set, else null. An
+ * invalid value is the boot guard's to refuse; a telemetry sink created before
+ * that guard must not throw on it and take the logger down with it.
+ */
+function deployTierOrNull() {
+    if (!process.env.OXYGEN_DEPLOY_ENV)
+        return null;
+    try {
+        return resolveDeployEnv().tier;
+    }
+    catch {
+        return null;
+    }
+}
+function recordLevel(record) {
+    return typeof record.level === "string" && Object.hasOwn(SEVERITY_NUMBERS, record.level)
+        ? record.level
+        : "info";
+}
+function toLogRecord(record) {
+    const level = recordLevel(record);
+    return {
+        timeUnixNano: timeUnixNano(record.ts),
+        severityNumber: SEVERITY_NUMBERS[level],
+        severityText: level.toUpperCase(),
+        body: { stringValue: typeof record.msg === "string" ? record.msg : String(record.msg ?? "") },
+        ...(typeof record.trace_id === "string" && /^[a-f\d]{32}$/i.test(record.trace_id)
+            && !/^0+$/.test(record.trace_id) ? { traceId: record.trace_id.toLowerCase() } : {}),
+        ...(typeof record.span_id === "string" && /^[a-f\d]{16}$/i.test(record.span_id)
+            && !/^0+$/.test(record.span_id) ? { spanId: record.span_id.toLowerCase() } : {}),
+        attributes: toAttributes(record, RECORD_FIELDS_NOT_ATTRIBUTES),
+    };
+}
+export function createOtlpLogSink(options) {
+    const batchSize = options.batchSize && options.batchSize > 0 ? options.batchSize : DEFAULT_BATCH_SIZE;
+    const maxQueue = options.maxQueue && options.maxQueue > 0 ? options.maxQueue : DEFAULT_MAX_QUEUE;
+    const flushIntervalMs = options.flushIntervalMs === undefined
+        ? DEFAULT_FLUSH_INTERVAL_MS
+        : options.flushIntervalMs;
+    const doFetch = options.fetch ?? globalThis.fetch;
+    const now = options.now ?? Date.now;
+    const minSeverity = options.minLevel ? SEVERITY_NUMBERS[options.minLevel] : null;
+    // A null/undefined override is dropped rather than applied, so a caller that
+    // resolves its own environment and comes back empty-handed falls back to the
+    // default here instead of shipping records with no `deployment.environment`.
+    const resourceOverrides = Object.fromEntries(Object.entries(options.resource ?? {}).filter(([, value]) => value !== null && value !== undefined));
+    const resourceAttributes = toAttributes({
+        "service.name": options.serviceName,
+        "deployment.environment": deployTierOrNull()
+            ?? process.env.VERCEL_ENV
+            ?? process.env.NODE_ENV
+            ?? null,
+        "deployment.sha": process.env.OXYGEN_GIT_SHA ?? process.env.VERCEL_GIT_COMMIT_SHA,
+        ...resourceOverrides,
+    });
+    const queue = [];
+    let inFlight = null;
+    let stopped = false;
+    let lastReportAt = Number.NEGATIVE_INFINITY;
+    let lastOverflowReportAt = Number.NEGATIVE_INFINITY;
+    // Failed exports a throttled report skipped, and the records they dropped;
+    // both ride on the next export_failed line, as telemetry.export_failed does.
+    let suppressedFailures = 0;
+    let pendingDropped = 0;
+    // Records the overflow path dropped that no report has carried yet.
+    let droppedOverflow = 0;
+    // Re-entrancy guard, as in apps/worker/src/log-shipper.ts. log() calls this
+    // sink synchronously, so while it is set the record on offer is this sink's
+    // own report: skipped here, so a failing flush never enqueues its own error
+    // line and re-fails on it forever.
+    let emittingInternal = false;
+    const endpointForLog = telemetryEndpointForLog(options.endpoint);
+    const emitInternal = (msg, fields) => {
+        emittingInternal = true;
+        try {
+            log("warn", msg, { endpoint: endpointForLog, ...fields });
+        }
+        catch {
+            // A telemetry failure that cannot even be reported is still not a fault
+            // of the code being observed.
+        }
+        finally {
+            emittingInternal = false;
+        }
+    };
+    const report = (droppedEvents, fields) => {
+        pendingDropped += droppedEvents;
+        const at = now();
+        if (at - lastReportAt < REPORT_WINDOW_MS) {
+            suppressedFailures += 1;
+            return;
+        }
+        lastReportAt = at;
+        const overflow = droppedOverflow;
+        const dropped = pendingDropped;
+        const suppressed = suppressedFailures;
+        droppedOverflow = 0;
+        pendingDropped = 0;
+        suppressedFailures = 0;
+        emitInternal("otlp_log_sink.export_failed", {
+            ...fields,
+            dropped_events: dropped,
+            dropped_overflow: overflow,
+            suppressed_failures: suppressed,
+        });
+    };
+    // Overflow is data loss even while every export succeeds (a burst faster than
+    // the collector drains), so it is reported on its own when no failure line
+    // has carried it.
+    const reportOverflow = () => {
+        if (droppedOverflow === 0)
+            return;
+        const at = now();
+        if (at - lastOverflowReportAt < REPORT_WINDOW_MS)
+            return;
+        lastOverflowReportAt = at;
+        const overflow = droppedOverflow;
+        droppedOverflow = 0;
+        emitInternal("otlp_log_sink.queue_overflow", { dropped_events: overflow });
+    };
+    const sink = (record) => {
+        if (stopped || emittingInternal)
+            return;
+        // An unknown level ships as INFO (see toLogRecord), so it filters as one.
+        if (minSeverity !== null && SEVERITY_NUMBERS[recordLevel(record)] < minSeverity)
+            return;
+        // Drop the OLDEST record and keep this one: under sustained backpressure the
+        // newest lines are the ones describing the incident being debugged.
+        while (queue.length >= maxQueue) {
+            queue.shift();
+            droppedOverflow += 1;
+        }
+        const activeSpan = trace.getActiveSpan()?.spanContext();
+        queue.push(operationalLogSnapshot(sanitizeLogFields({
+            ...record,
+            ...(activeSpan && (!record.trace_id || record.trace_id === activeSpan.traceId)
+                ? { trace_id: activeSpan.traceId, span_id: activeSpan.spanId }
+                : {}),
+        })));
+    };
+    const flush = async () => {
+        if (inFlight)
+            return inFlight;
+        if (queue.length === 0)
+            return undefined;
+        const batch = queue.splice(0, batchSize);
+        const payload = JSON.stringify({
+            resourceLogs: [
+                {
+                    resource: { attributes: resourceAttributes },
+                    scopeLogs: [
+                        {
+                            scope: { name: "oxygen" },
+                            logRecords: batch.map(toLogRecord),
+                        },
+                    ],
+                },
+            ],
+        });
+        const run = (async () => {
+            try {
+                const response = await doFetch(options.endpoint, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json", ...options.headers },
+                    body: payload,
+                    signal: AbortSignal.timeout(EXPORT_TIMEOUT_MS),
+                });
+                if (response.ok) {
+                    try {
+                        const rejected = await rejectedRecords(response, batch.length);
+                        if (rejected)
+                            report(rejected, { status: response.status, error_code: "partial_rejection" });
+                    }
+                    catch {
+                        report(batch.length, { status: response.status, error_code: "invalid_response" });
+                    }
+                    return;
+                }
+                // Receivers/proxies can echo rejected payloads or credentials. Never
+                // read arbitrary response text into operational diagnostics.
+                await response.body?.cancel().catch(() => undefined);
+                // The batch is gone deliberately: retrying into an unhealthy collector
+                // is how a telemetry path turns an ingest blip into memory pressure.
+                report(batch.length, { status: response.status, error_code: "receiver_rejected" });
+            }
+            catch (error) {
+                report(batch.length, {
+                    error_code: "transport_failed",
+                    error_cause: sanitizedErrorCause(error),
+                });
+            }
+            finally {
+                reportOverflow();
+            }
+        })();
+        inFlight = run.finally(() => {
+            inFlight = null;
+        });
+        return inFlight;
+    };
+    const timer = flushIntervalMs > 0
+        ? setInterval(() => {
+            void flush();
+        }, flushIntervalMs)
+        : null;
+    // Never hold the process open on the telemetry timer.
+    timer?.unref?.();
+    const stop = async () => {
+        stopped = true;
+        if (timer)
+            clearInterval(timer);
+        // Drain rather than flush once: a shutdown's final lines are usually the
+        // interesting ones, and one flush ships only the oldest `batchSize`.
+        while (queue.length > 0) {
+            await flush();
+        }
+        await inFlight;
+    };
+    return { sink, flush, stop };
+}

package/node_modules/@oxygen/shared/dist/plan-capabilities.js

@@ -50,6 +50,7 @@ export const PLAN_GATED_CAPABILITIES = [
  * `required_plan_tiers` in tool-access, which the resolver consults separately.
  */
 export const PLAN_GATE_QUALIFYING_TIERS = [
+    "oxygen",
     "starter",
     "pro",
     "team",

package/node_modules/@oxygen/shared/dist/plan-limits.d.ts

@@ -185,14 +185,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 2500;
-            readonly maxInferenceCredits: 1500;
+            readonly maxTotalCredits: 250;
+            readonly maxInferenceCredits: 150;
             readonly maxUpstreamCostUsd: 10;
             readonly maxUpstreamCostUsdByok: 10;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 5000;
-            readonly defaultPerTurnCreditCeiling: 1500;
+            readonly maxSessionBudgetCredits: 500;
+            readonly defaultPerTurnCreditCeiling: 150;
         };
         readonly signals: {
             readonly maxEvents: 100;
@@ -295,14 +295,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 10000;
-            readonly maxInferenceCredits: 5000;
+            readonly maxTotalCredits: 1000;
+            readonly maxInferenceCredits: 500;
             readonly maxUpstreamCostUsd: 10;
             readonly maxUpstreamCostUsdByok: 250;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 5000;
-            readonly defaultPerTurnCreditCeiling: 1500;
+            readonly maxSessionBudgetCredits: 500;
+            readonly defaultPerTurnCreditCeiling: 150;
         };
         readonly signals: {
             readonly maxEvents: 200;
@@ -405,14 +405,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 25000;
-            readonly maxInferenceCredits: 12500;
+            readonly maxTotalCredits: 2500;
+            readonly maxInferenceCredits: 1250;
             readonly maxUpstreamCostUsd: 25;
             readonly maxUpstreamCostUsdByok: 250;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 10000;
-            readonly defaultPerTurnCreditCeiling: 2500;
+            readonly maxSessionBudgetCredits: 1000;
+            readonly defaultPerTurnCreditCeiling: 250;
         };
         readonly signals: {
             readonly maxEvents: 200;
@@ -515,14 +515,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 50000;
-            readonly maxInferenceCredits: 25000;
+            readonly maxTotalCredits: 5000;
+            readonly maxInferenceCredits: 2500;
             readonly maxUpstreamCostUsd: 50;
             readonly maxUpstreamCostUsdByok: 250;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 20000;
-            readonly defaultPerTurnCreditCeiling: 5000;
+            readonly maxSessionBudgetCredits: 2000;
+            readonly defaultPerTurnCreditCeiling: 500;
         };
         readonly signals: {
             readonly maxEvents: 200;
@@ -625,14 +625,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 100000;
-            readonly maxInferenceCredits: 50000;
+            readonly maxTotalCredits: 10000;
+            readonly maxInferenceCredits: 5000;
             readonly maxUpstreamCostUsd: 100;
             readonly maxUpstreamCostUsdByok: 250;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 50000;
-            readonly defaultPerTurnCreditCeiling: 10000;
+            readonly maxSessionBudgetCredits: 5000;
+            readonly defaultPerTurnCreditCeiling: 1000;
         };
         readonly signals: {
             readonly maxEvents: 200;
@@ -645,8 +645,9 @@ export declare const PLAN_LIMITS: {
 };
 /**
  * Map a raw plan-tier string (subscription `tier`, metadata tier, legacy plan
- * key like `growth_250`) onto its enforcement rung. Unknown/absent tiers land
- * on the unentitled "free" rung; enterprise shares "scale".
+ * key like `growth_250`, or an Oxygen rung key like `oxygen_499`) onto its
+ * enforcement rung. Unknown/absent tiers land on the unentitled "free" rung;
+ * enterprise shares "scale".
  */
 export declare function limitsTierForPlanTier(tier: string | null | undefined): LimitsTier;
 export declare function planLimitsForTier(tier: LimitsTier): PlanLimits;