Stripe Billing, Verified Queries, Builder Improvements, and Unified Settings

Documentation Index

Fetch the complete documentation index at: https://oxy.tech/docs/llms.txt

Use this file to discover all available pages before exploring further.

​

New Features

​

Stripe Billing

​

Verified Queries

• Trusted results — When a user’s question matches a .sql file in the workspace, the file’s contents are executed as-is and the result is marked as verified. No LLM-generated SQL is involved, giving teams full control over the exact query that runs.
• Seamless discovery — The agent automatically discovers .sql files alongside procedures and workflows. No extra configuration is needed — place a .sql file in your workspace and the agent will consider it when selecting the best way to answer a question.
• Verified badge — Results from verified queries are flagged in the analytics pipeline so downstream consumers and the UI can distinguish them from LLM-generated answers.

​

Builder Improvements

• run_app tool — Builder can now execute a Data App by path and feed structured results back as context for the next step, enabling end-to-end build → test → refine loops on dashboards.
• Sequential per-file confirmations — When a single Builder response edits multiple files, you now get one confirm/reject prompt per file in order, instead of a single batched prompt for the whole change set. Rejecting one file no longer blocks the others.
• Stable file preview after re-edits — Opening the preview panel after Builder edits the same file a second time now shows the latest content. A stale-reference bug where re-edits surfaced the old content is fixed; the preview now reliably stays in sync with the most recently accepted change.
• Cleaner read_file output — Builder’s read_file tool returns raw file content without line-number prefixes and is capped at 100k characters, so the LLM sees files exactly as they exist on disk and very large files no longer overflow context.
• Improved dbt and SQL guidance — System prompt expanded with dbt/SQL modeling guidance, and the init_dbt_project tool description was clarified for better LLM behavior when scaffolding dbt projects.
• Full conversation history in interpreting phase — Builder’s interpreting phase now receives the complete native message history, fixing cases where the final response missed earlier context.

​

Unified Settings Dialog

• One place for everything — Organization-level settings (members, billing, security) and workspace-level settings (data sources, secrets, observability, repo linking) now live under one roof, grouped by scope in the sidebar.
• Consistent terminology — The previously inconsistent “Members” labeling between organization and workspace scopes is resolved; both groups now use the same label and the parent group disambiguates scope.
• Focused local-mode sidebar — In local mode, the dialog hides organization-only sections (members, billing, repo linking) so the sidebar shows only what actually applies to a single-workspace deployment.
• Reachable from where you need it — Entry points are wired up across the app sidebar footer, IDE Settings tab, database sidebar’s “Add database” links, and home-page setup gaps.

​

Refined @Mention Experience

• Consistent highlighting everywhere — A shared highlight component now renders mention tokens with the same orange highlight in every input, including ChatPanel’s Build mode where highlighting was previously missing.
• Atomic mention deletion — Backspace now removes a whole @mention token in one keystroke across all input surfaces, instead of deleting one character at a time.
• Escape actually closes the popup — Pressing Escape now reliably dismisses the mention suggestion popup without swallowing the keystroke or re-opening on the next character typed.
• Mentions in agent clarifying questions — When an agentic agent suspends to ask a clarifying question, you can now @mention files, agents, or other entities directly in your answer. Navigating between multiple suspended questions no longer carries a stale cursor that triggered false-positive mention popups.
• Smoother long-line scrolling — On long lines, the highlight overlay now stays aligned with the textarea content during horizontal scrolling instead of drifting out of position.

​

SQL Artifacts in Slack Messages

• Inline rich-text blocks — Each execute_sql artifact from an agent run appears as a formatted code block directly in the Slack message thread, using Slack’s native rich-text rendering.
• Smart truncation — Long queries are truncated with a link to the full thread in Oxy, keeping messages readable while preserving access to the complete query.
• Only on success — SQL blocks are shown only when the agent run completes successfully, avoiding noise from failed or cancelled runs.

​

Cleaner oxy init Template

• Single oxymart story — The shipped template includes one classic agent, one agentic agent, the oxymart sales semantics, three example SQL queries, two procedures, and one Data App — all centered on a single coherent example.
• Internal showcase moved out — The full multi-domain demo (training/fitness, airhouse astronauts, v0/builder) is now a separate internal showcase package used only for the deployed capability demo. New oxy init users start from a clean slate.

​

Platform Improvements

​

Builder Stability

• DuckDB initialization race fixed — A SIGSEGV caused by two concurrent duckdb_database handles opening the same file is resolved. The DuckDB pool now serializes initialization to prevent the race, eliminating crashes during concurrent queries.
• HITL events emitted for every batched write — FileChangePending events now fire for every file in a batched write operation; previously only the first file in a batch triggered the event, so multi-file changes could silently skip approvals.
• Suspension-state gating — FileChangePending is now emitted only when the pipeline is actually paused, preventing spurious events when no human approval is required.
• Stable change IDs across re-edits — Builder change objects use stable IDs across re-edits of the same file, so the frontend no longer holds stale references after the builder writes a file a second time.

​

Workflow and DuckDB Performance

• DuckDB connection pool — DuckDB now maintains a process-wide connection pool keyed by dataset directory and file modification times. Previously, every SQL execution opened a fresh in-memory connection and re-loaded all CSV/Parquet files from scratch. On large datasets this caused severe slowdowns — a 50 MB CSV workspace saw per-query overhead of ~9 s. The pool eliminates that overhead and delivers a measured 3.18× wall-clock speedup (490 s → 154 s) on a real multi-step workflow benchmark.
• Incremental workflow state writes — Workflow step results are now written to the database as small JSONB deltas instead of rewriting the full results map on every decision. This reduces database write volume from O(steps²) to O(steps), cutting CPU and I/O proportionally on long-running workflows with many steps.
• Async SQL file loading — SQL files are now read asynchronously, preventing blocking on the async executor when loading queries during workflow execution.

​

LLM Reliability

• OpenAI and Azure OpenAI connection retries — Transient connection failures (TCP/TLS connect timeouts, dropped streams, generic API errors) when calling OpenAI or Azure OpenAI deployments are now retried automatically with exponential backoff, up to a 2-minute budget. Previously, a single connect timeout would kill an entire ReAct loop, most visibly on Azure-hosted deployments whose model name routes through the OSS execution path. Permanent errors such as insufficient_quota, context_length_exceeded, and oversize-input errors continue to fail fast without retry.

​

Admin Billing Tools

• Resync subscription from Stripe — Admins can now manually resync an organization’s Stripe subscription from the admin billing queue, recovering from missed webhook events without waiting for the next Stripe event.
• Tiered pricing in subscription provisioning — The admin billing API now supports Stripe graduated tiered pricing alongside per-unit prices. Price details and subscription items expose tiers_mode and a full tiers breakdown (including unlimited tiers via up_to: inf), so the admin UI can render complete tier tables. Unsupported pricing modes now return a clear UnsupportedPricingMode error.

​

Workspace Management

• Instant redirect after deleting current workspace — Deleting the workspace you’re currently in now redirects right away instead of waiting several seconds for the DELETE call to return. The dialog optimistically removes the deleted workspace from the cache and clears the persisted last-workspace ID before navigating, so the dispatcher picks a different workspace (or routes to onboarding when none remain) on the next render.

​

Workspace Onboarding

• All generated dashboards now show in the completion summary — Multi-topic onboarding produces two Data Apps (an overview plus a topic-specific or cross-topic dashboard), but the “Workspace ready” summary previously reported 1 dashboard and only offered an EXPLORE button for the overview. The summary now correctly reflects every generated app file, with one EXPLORE button per dashboard.
• Picker icon overflow fixed — The table icon next to each row in the onboarding table picker no longer overflows its container when the table name is long.

​

Airhouse Integration

• Local-mode provisioning — Airhouse provisioning now works in local development. A startup seed creates the local-mode organization, workspace, and user membership idempotently so the provisioning flow has the rows it needs without a real organization picker.
• Reliable DDL/DML execution — The Airhouse connector now distinguishes between DDL/DML statements (CREATE, INSERT, UPDATE) and SELECT-family queries: DDL/DML executes directly while only SELECTs are wrapped in subqueries, fixing errors when running non-SELECT statements.
• Stricter configuration checks — Server startup now validates that all required Airhouse environment variables are set together and fails fast if only a subset is provided, surfacing misconfiguration up front instead of at first use.

​

Home Page Reliability

• False “LLM key not set” warning resolved — In local mode, API keys set via environment variables (e.g. OPENAI_API_KEY in .env) were invisible to the home page readiness check, causing a warning that disabled the chat panel even though agents could run fine. The check now correctly reads environment-variable secrets in local mode, so the chat panel stays enabled when a key is present. Cloud mode behaviour is unchanged: keys set only as server environment variables still prompt operators to configure them through the Secrets UI.
• Infinite spinner on home page fixed — A routing mismatch caused the local-mode home page to spin indefinitely instead of loading. The workspace match check now correctly short-circuits in local mode, matching the pattern used elsewhere in the app.

​

Developer Portal

• Confusing “Local mode” banner removed — The Developer Portal git actions area no longer renders a stray “Local mode” label when git capabilities are unavailable. The relevant controls are simply hidden, matching the rest of the IDE.

​

Bug Fixes

• App switching now shows correct data — Navigating between two apps in the same workspace no longer shows “No data found” on every chart and table. Previously, the AppPreview component retained the previous app’s task results when navigating, causing all display blocks in the new app to resolve against the wrong data. Charts and tables now populate correctly without requiring a manual page refresh.

​

Security

• SQL injection hardening in DuckDB configuration — User-provided string values embedded in DuckDB configuration SQL (S3 secrets, catalog schema names, storage paths) are now properly escaped to prevent injection via single-quote characters.
• Slack block injection hardening — The Slack webhook handler that re-posts original messages now passes blocks through a strict allowlist (section, context, divider, header, image). Interactive block types such as actions, input, rich_text, and video are silently dropped, preventing attackers from injecting arbitrary interactive elements (buttons, inputs, etc.) into channels via crafted source messages.