@agentuity/cli 0.1.8 → 0.1.10

package/src/cmd/cloud/storage/get.ts

@@ -1,10 +1,11 @@
 import { z } from 'zod';
-import { listResources } from '@agentuity/server';
+import { listOrgResources } from '@agentuity/server';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { getCatalystAPIClient } from '../../../config';
+import { getGlobalCatalystAPIClient } from '../../../config';
 import { getCommand } from '../../../command-prefix';
 import { ErrorCode } from '../../../errors';
+import { getResourceInfo, setResourceInfo } from '../../../cache';
 
 const StorageGetResponseSchema = z.object({
 	bucket_name: z.string().describe('Storage bucket name'),
@@ -19,7 +20,8 @@ export const getSubcommand = createSubcommand({
 	aliases: ['show'],
 	description: 'Show details about a specific storage bucket',
 	tags: ['read-only', 'fast', 'requires-auth'],
-	requires: { auth: true, org: true, region: true },
+	requires: { auth: true },
+	optional: { org: true },
 	idempotent: true,
 	examples: [
 		{
@@ -52,20 +54,43 @@ export const getSubcommand = createSubcommand({
 	webUrl: (ctx) => `/services/storage/${encodeURIComponent(ctx.args.name)}`,
 
 	async handler(ctx) {
-		const { logger, args, opts, options, orgId, region, auth } = ctx;
+		const { logger, args, opts, options, auth, config } = ctx;
 
-		const catalystClient = getCatalystAPIClient(logger, auth, region);
+		const profileName = config?.name ?? 'production';
+		const catalystClient = await getGlobalCatalystAPIClient(logger, auth, profileName);
+
+		// Check cache first for orgId
+		const cachedInfo = await getResourceInfo('bucket', profileName, args.name);
+		const orgId = ctx.orgId ?? cachedInfo?.orgId;
+
+		if (!orgId) {
+			tui.fatal(
+				`Organization not found for bucket '${args.name}'. Run 'agentuity cloud storage list' first or specify --org-id.`,
+				ErrorCode.INVALID_ARGUMENT
+			);
+		}
 
 		const resources = await tui.spinner({
 			message: `Fetching storage bucket ${args.name}`,
 			clearOnSuccess: true,
 			callback: async () => {
-				return listResources(catalystClient, orgId, region);
+				return listOrgResources(catalystClient, { type: 's3', orgId });
 			},
 		});
 
 		const bucket = resources.s3.find((s3) => s3.bucket_name === args.name);
 
+		// Cache the bucket info for future lookups
+		if (bucket?.cloud_region) {
+			await setResourceInfo(
+				'bucket',
+				profileName,
+				bucket.bucket_name,
+				bucket.cloud_region,
+				orgId
+			);
+		}
+
 		if (!bucket) {
 			tui.fatal(`Storage bucket '${args.name}' not found`, ErrorCode.RESOURCE_NOT_FOUND);
 		}

package/src/cmd/cloud/storage/list.ts

@@ -1,11 +1,12 @@
 import { z } from 'zod';
-import { listResources } from '@agentuity/server';
+import { listOrgResources } from '@agentuity/server';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { getCatalystAPIClient } from '../../../config';
+import { getGlobalCatalystAPIClient } from '../../../config';
 import { getCommand } from '../../../command-prefix';
 import { ErrorCode } from '../../../errors';
 import { createS3Client } from './utils';
+import { setResourceInfo } from '../../../cache';
 
 const StorageListResponseSchema = z.object({
 	buckets: z
@@ -16,6 +17,7 @@ const StorageListResponseSchema = z.object({
 				secret_key: z.string().optional().describe('S3 secret key'),
 				region: z.string().optional().describe('S3 region'),
 				endpoint: z.string().optional().describe('S3 endpoint URL'),
+				cloud_region: z.string().optional().describe('Cloud region where bucket is hosted'),
 			})
 		)
 		.optional()
@@ -37,7 +39,7 @@ export const listSubcommand = createSubcommand({
 	aliases: ['ls'],
 	description: 'List storage resources or files in a bucket',
 	tags: ['read-only', 'fast', 'requires-auth'],
-	requires: { auth: true, org: true, region: true },
+	requires: { auth: true, org: true },
 	idempotent: true,
 	examples: [
 		{ command: getCommand('cloud storage list'), description: 'List items' },
@@ -78,18 +80,26 @@ export const listSubcommand = createSubcommand({
 			: '/services/storage',
 
 	async handler(ctx) {
-		const { logger, args, opts, options, orgId, region, auth } = ctx;
+		const { logger, args, opts, options, orgId, auth, config } = ctx;
 
-		const catalystClient = getCatalystAPIClient(logger, auth, region);
+		const catalystClient = await getGlobalCatalystAPIClient(logger, auth, config?.name);
 
+		const profileName = config?.name ?? 'production';
 		const resources = await tui.spinner({
-			message: `Fetching storage for ${orgId} in ${region}`,
+			message: `Fetching storage for ${orgId}`,
 			clearOnSuccess: true,
 			callback: async () => {
-				return listResources(catalystClient, orgId, region);
+				return listOrgResources(catalystClient, { type: 's3', orgId });
 			},
 		});
 
+		// Cache each bucket with its region and orgId for future lookups
+		for (const s3 of resources.s3) {
+			if (s3.cloud_region) {
+				await setResourceInfo('bucket', profileName, s3.bucket_name, s3.cloud_region, orgId);
+			}
+		}
+
 		// If bucket name is provided, list files in the bucket
 		if (args.name) {
 			const bucket = resources.s3.find((s3) => s3.bucket_name === args.name);
@@ -219,6 +229,7 @@ export const listSubcommand = createSubcommand({
 				secret_key: s3.secret_key ?? undefined,
 				region: s3.region ?? undefined,
 				endpoint: s3.endpoint ?? undefined,
+				cloud_region: s3.cloud_region,
 			})),
 		};
 	},

package/src/cmd/cloud/storage/upload.ts

@@ -1,19 +1,21 @@
 import { z } from 'zod';
 import { basename } from 'path';
-import { listResources } from '@agentuity/server';
+import { listOrgResources } from '@agentuity/server';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { getCatalystAPIClient } from '../../../config';
+import { getGlobalCatalystAPIClient } from '../../../config';
 import { getCommand } from '../../../command-prefix';
 import { ErrorCode } from '../../../errors';
 import { createS3Client } from './utils';
+import { getResourceInfo, setResourceInfo } from '../../../cache';
 
 export const uploadSubcommand = createSubcommand({
 	name: 'upload',
 	aliases: ['put'],
 	description: 'Upload a file to storage bucket',
 	tags: ['write', 'requires-auth'],
-	requires: { auth: true, org: true, region: true },
+	requires: { auth: true },
+	optional: { org: true },
 	idempotent: false,
 	examples: [
 		{
@@ -61,21 +63,44 @@ export const uploadSubcommand = createSubcommand({
 	},
 
 	async handler(ctx) {
-		const { logger, args, opts, options, orgId, region, auth } = ctx;
+		const { logger, args, opts, options, auth, config } = ctx;
 
-		const catalystClient = getCatalystAPIClient(logger, auth, region);
+		const profileName = config?.name ?? 'production';
+		const catalystClient = await getGlobalCatalystAPIClient(logger, auth, profileName);
+
+		// Check cache first for orgId
+		const cachedInfo = await getResourceInfo('bucket', profileName, args.name);
+		const orgId = ctx.orgId ?? cachedInfo?.orgId;
+
+		if (!orgId) {
+			tui.fatal(
+				`Organization not found for bucket '${args.name}'. Run 'agentuity cloud storage list' first or specify --org-id.`,
+				ErrorCode.INVALID_ARGUMENT
+			);
+		}
 
 		// Fetch bucket credentials
 		const resources = await tui.spinner({
 			message: `Fetching credentials for ${args.name}`,
 			clearOnSuccess: true,
 			callback: async () => {
-				return listResources(catalystClient, orgId, region);
+				return listOrgResources(catalystClient, { type: 's3', orgId });
 			},
 		});
 
 		const bucket = resources.s3.find((s3) => s3.bucket_name === args.name);
 
+		// Cache the bucket info for future lookups
+		if (bucket?.cloud_region) {
+			await setResourceInfo(
+				'bucket',
+				profileName,
+				bucket.bucket_name,
+				bucket.cloud_region,
+				orgId
+			);
+		}
+
 		if (!bucket) {
 			tui.fatal(`Storage bucket '${args.name}' not found`, ErrorCode.RESOURCE_NOT_FOUND);
 		}

package/src/cmd/cloud/thread/delete.ts

@@ -4,7 +4,7 @@ import * as tui from '../../../tui';
 import { threadDelete, APIError } from '@agentuity/server';
 import { getCommand } from '../../../command-prefix';
 import { ErrorCode } from '../../../errors';
-import { getCatalystAPIClient } from '../../../config';
+import { getGlobalCatalystAPIClient } from '../../../config';
 
 export const deleteSubcommand = createSubcommand({
 	name: 'delete',
@@ -17,15 +17,15 @@ export const deleteSubcommand = createSubcommand({
 		},
 	],
 	aliases: ['rm'],
-	requires: { auth: true, region: true },
+	requires: { auth: true },
 	schema: {
 		args: z.object({
 			thread_id: z.string().describe('Thread ID'),
 		}),
 	},
 	async handler(ctx) {
-		const { logger, auth, args, region } = ctx;
-		const catalystClient = getCatalystAPIClient(logger, auth, region);
+		const { logger, auth, args, config } = ctx;
+		const catalystClient = await getGlobalCatalystAPIClient(logger, auth, config?.name);
 
 		try {
 			await threadDelete(catalystClient, { id: args.thread_id });

package/src/cmd/cloud/thread/get.ts

@@ -4,7 +4,7 @@ import * as tui from '../../../tui';
 import { threadGet, APIError } from '@agentuity/server';
 import { getCommand } from '../../../command-prefix';
 import { ErrorCode } from '../../../errors';
-import { getCatalystAPIClient } from '../../../config';
+import { getGlobalCatalystAPIClient } from '../../../config';
 
 const ThreadGetResponseSchema = z.object({
 	id: z.string().describe('Thread ID'),
@@ -28,7 +28,7 @@ export const getSubcommand = createSubcommand({
 			description: 'Get a thread by ID',
 		},
 	],
-	requires: { auth: true, region: true },
+	requires: { auth: true },
 	idempotent: true,
 	schema: {
 		args: z.object({
@@ -37,8 +37,8 @@ export const getSubcommand = createSubcommand({
 		response: ThreadGetResponseSchema,
 	},
 	async handler(ctx) {
-		const { logger, auth, args, options, region } = ctx;
-		const catalystClient = getCatalystAPIClient(logger, auth, region);
+		const { logger, auth, args, options, config } = ctx;
+		const catalystClient = await getGlobalCatalystAPIClient(logger, auth, config?.name);
 
 		try {
 			const thread = await threadGet(catalystClient, { id: args.thread_id });

package/src/cmd/cloud/thread/list.ts

@@ -4,7 +4,7 @@ import * as tui from '../../../tui';
 import { threadList, type Thread } from '@agentuity/server';
 import { getCommand } from '../../../command-prefix';
 import { ErrorCode } from '../../../errors';
-import { getCatalystAPIClient } from '../../../config';
+import { getGlobalCatalystAPIClient } from '../../../config';
 
 const ThreadListResponseSchema = z.array(
 	z.object({
@@ -36,7 +36,7 @@ export const listSubcommand = createSubcommand({
 		},
 	],
 	aliases: ['ls'],
-	requires: { auth: true, region: true },
+	requires: { auth: true },
 	optional: { project: true },
 	idempotent: true,
 	pagination: {
@@ -62,8 +62,8 @@ export const listSubcommand = createSubcommand({
 		response: ThreadListResponseSchema,
 	},
 	async handler(ctx) {
-		const { logger, auth, project, opts, options, region } = ctx;
-		const catalystClient = getCatalystAPIClient(logger, auth, region);
+		const { logger, auth, project, opts, options, config } = ctx;
+		const catalystClient = await getGlobalCatalystAPIClient(logger, auth, config?.name);
 
 		const projectId = opts.projectId || project?.projectId;
 		const orgId = opts.orgId;

package/src/cmd/project/auth/init.ts

@@ -20,7 +20,7 @@ export const initSubcommand = createSubcommand({
 	name: 'init',
 	description: 'Set up Agentuity Auth for your project',
 	tags: ['mutating', 'slow', 'requires-auth'],
-	requires: { auth: true, org: true, region: true },
+	requires: { auth: true, org: true },
 	idempotent: false,
 	examples: [
 		{
@@ -46,7 +46,7 @@ export const initSubcommand = createSubcommand({
 	},
 
 	async handler(ctx) {
-		const { logger, opts, auth, orgId, region } = ctx;
+		const { logger, opts, auth, orgId, config } = ctx;
 
 		tui.newline();
 		tui.info(tui.bold('Agentuity Auth Setup'));
@@ -86,10 +86,14 @@ export const initSubcommand = createSubcommand({
 			logger,
 			auth,
 			orgId,
-			region,
+			config,
 			existingUrl: databaseUrl,
+			projectDir,
 		});
 
+		// Get the region from the selected database
+		const region = dbInfo.region;
+
 		const databaseName = dbInfo.name;
 
 		// Update .env with database URL

package/src/cmd/project/auth/shared.ts

@@ -3,11 +3,17 @@
  */
 
 import * as path from 'node:path';
-import { listResources, createResources, dbQuery } from '@agentuity/server';
+import { listOrgResources, createResources, dbQuery } from '@agentuity/server';
 import * as tui from '../../../tui';
-import { getCatalystAPIClient } from '../../../config';
+import {
+	getCatalystAPIClient,
+	getGlobalCatalystAPIClient,
+	loadProjectConfig,
+	ProjectConfigNotFoundException,
+} from '../../../config';
 import type { Logger } from '../../../types';
 import type { AuthData } from '../../../types';
+import type { Config } from '../../../types';
 import enquirer from 'enquirer';
 
 /**
@@ -16,25 +22,29 @@ import enquirer from 'enquirer';
 export interface DatabaseInfo {
 	name: string;
 	url: string;
+	region: string;
 }
 
 /**
- * Select an existing database or create a new one
+ * Select an existing database or create a new one.
+ * When creating a new database, uses the project's region from agentuity.json if available.
  */
 export async function selectOrCreateDatabase(options: {
 	logger: Logger;
 	auth: AuthData;
 	orgId: string;
-	region: string;
+	config: Config | null;
 	existingUrl?: string;
+	projectDir?: string;
 }): Promise<DatabaseInfo> {
-	const { logger, auth, orgId, region, existingUrl } = options;
-	const catalystClient = getCatalystAPIClient(logger, auth, region);
+	const { logger, auth, orgId, config, existingUrl, projectDir } = options;
+	const profileName = config?.name;
+	const globalClient = await getGlobalCatalystAPIClient(logger, auth, profileName);
 
 	const resources = await tui.spinner({
-		message: `Fetching databases for ${orgId} in ${region}`,
+		message: `Fetching databases for ${orgId}`,
 		clearOnSuccess: true,
-		callback: async () => listResources(catalystClient, orgId, region),
+		callback: async () => listOrgResources(globalClient, { type: 'db', orgId }),
 	});
 
 	const databases = resources.db;
@@ -81,14 +91,42 @@ export async function selectOrCreateDatabase(options: {
 
 	// Handle "use existing" selection
 	if (response.database === '__existing__' && existingUrl && existingDbName) {
-		return { name: existingDbName, url: existingUrl };
+		// Find the database to get its region
+		const existingDb = databases.find((d) => d.name === existingDbName);
+		const region = existingDb?.cloud_region ?? 'usc';
+		return { name: existingDbName, url: existingUrl, region };
 	}
 
 	if (response.database === '__create__') {
+		// For creating a new database, determine the region:
+		// 1. Try to get from project's agentuity.json
+		// 2. Fall back to first existing database's region
+		// 3. Fall back to 'usc' as default
+		let region: string | undefined;
+
+		if (projectDir) {
+			try {
+				const projectConfig = await loadProjectConfig(projectDir, config);
+				region = projectConfig.region;
+				logger.trace(`[auth init] Using region from project config: ${region}`);
+			} catch (err) {
+				if (!(err instanceof ProjectConfigNotFoundException)) {
+					logger.trace(`[auth init] Error loading project config: ${err}`);
+				}
+			}
+		}
+
+		if (!region) {
+			region = databases.length > 0 ? databases[0].cloud_region : 'usc';
+			logger.trace(`[auth init] Using fallback region: ${region}`);
+		}
+
+		const regionalClient = getCatalystAPIClient(logger, auth, region);
+
 		const created = await tui.spinner({
 			message: `Creating database in ${region}`,
 			clearOnSuccess: true,
-			callback: async () => createResources(catalystClient, orgId, region, [{ type: 'db' }]),
+			callback: async () => createResources(regionalClient, orgId, region, [{ type: 'db' }]),
 		});
 
 		if (created.length === 0) {
@@ -98,14 +136,15 @@ export async function selectOrCreateDatabase(options: {
 		const newDb = created[0];
 		tui.success(`Created database: ${tui.bold(newDb.name)}`);
 
-		const updatedResources = await listResources(catalystClient, orgId, region);
+		// Fetch updated list to get the URL
+		const updatedResources = await listOrgResources(globalClient, { type: 'db', orgId });
 		const dbInfo = updatedResources.db.find((d) => d.name === newDb.name);
 
 		if (!dbInfo?.url) {
 			tui.fatal('Failed to retrieve database connection URL');
 		}
 
-		return { name: newDb.name, url: dbInfo.url };
+		return { name: newDb.name, url: dbInfo.url, region };
 	}
 
 	const selectedDb = databases.find((d) => d.name === response.database);
@@ -113,7 +152,7 @@ export async function selectOrCreateDatabase(options: {
 		tui.fatal('Failed to retrieve database connection URL');
 	}
 
-	return { name: selectedDb.name, url: selectedDb.url };
+	return { name: selectedDb.name, url: selectedDb.url, region: selectedDb.cloud_region };
 }
 
 /**

package/src/config.ts

@@ -21,6 +21,7 @@ import {
 	getAuthFromKeychain,
 	deleteAuthFromKeychain,
 } from './keychain';
+import { clearProfileCache } from './cache';
 
 export const defaultProfileName = 'production';
 
@@ -330,6 +331,9 @@ export async function clearAuth(): Promise<void> {
 		}
 	}
 
+	// Clear resource cache for this profile
+	await clearProfileCache(profileName);
+
 	// Also clear from config file (for backwards compatibility)
 	if (config.auth) {
 		delete config.auth;
@@ -381,6 +385,13 @@ export async function getAuth(): Promise<AuthData | null> {
 		try {
 			const keychainAuth = await getAuthFromKeychain(profileName);
 			if (keychainAuth) {
+				// If there's auth api_key in the config file, remove it since we have it in keychain
+				if (config?.auth?.api_key) {
+					const { api_key: _, ...authWithoutApiKey } = config.auth;
+					const configCopy = { ...config, auth: authWithoutApiKey };
+					cachedConfig = null; // Force cache refresh
+					await saveConfig(configCopy);
+				}
 				return {
 					apiKey: keychainAuth.api_key,
 					userId: keychainAuth.user_id,
@@ -499,13 +510,7 @@ export function generateYAMLTemplate(name: string): string {
 	return lines.join('\n');
 }
 
-class ProjectConfigNotFoundExpection extends Error {
-	public name: string;
-	constructor() {
-		super('project not found');
-		this.name = 'ProjectConfigNotFoundExpection';
-	}
-}
+export const ProjectConfigNotFoundException = StructuredError('ProjectConfigNotFoundException');
 
 type ProjectConfig = z.infer<typeof ProjectSchema>;
 
@@ -529,7 +534,7 @@ export async function loadProjectConfig(
 		// and then if so:
 		// 1. if authentication, offer to import the project
 		// 2. tell them that they need to login to use the command and import the project
-		throw new ProjectConfigNotFoundExpection();
+		throw new ProjectConfigNotFoundException({ message: 'project config not found' });
 	}
 	const text = await file.text();
 	const parsedConfig = JSON5.parse(text);
@@ -563,6 +568,16 @@ export async function createProjectConfig(dir: string, config: InitialProjectCon
 	const configData = {
 		$schema: 'https://agentuity.dev/schema/cli/v1/agentuity.json',
 		...sanitizedConfig,
+		deployment: {
+			...sanitizedConfig.deployment,
+			resources: {
+				memory: '500Mi',
+				cpu: '500m',
+				disk: '500Mi',
+				...sanitizedConfig.deployment?.resources,
+			},
+			domains: sanitizedConfig.deployment?.domains ?? [],
+		},
 	};
 	await Bun.write(configPath, JSON.stringify(configData, null, 2) + '\n');
 
@@ -697,6 +712,57 @@ export function getCatalystAPIClient(logger: Logger, auth: AuthData, region: str
 	return new ServerAPIClient(catalystUrl, logger, auth.apiKey);
 }
 
+interface RegionsCacheData {
+	timestamp: number;
+	regions: Array<{ region: string; description: string }>;
+}
+
+/**
+ * Get the default region using priority ordering:
+ * 1. AGENTUITY_REGION environment variable
+ * 2. First entry in region-{profile}.json (nearest region, sorted by distance)
+ * 3. 'local' for local profile, 'usc' otherwise
+ *
+ * Used for API calls that can hit any Catalyst instance (global database operations).
+ * Note: This is NOT called when --region flag is provided (handled at command level).
+ */
+export async function getDefaultRegion(profileName = 'production'): Promise<string> {
+	// 1. Check environment variable first
+	if (process.env.AGENTUITY_REGION) {
+		return process.env.AGENTUITY_REGION;
+	}
+
+	// 2. Check cached regions file (sorted by distance)
+	try {
+		const cachePath = join(getDefaultConfigDir(), `regions-${profileName}.json`);
+		const file = Bun.file(cachePath);
+		if (await file.exists()) {
+			const data: RegionsCacheData = await file.json();
+			if (data.regions && data.regions.length > 0) {
+				return data.regions[0].region;
+			}
+		}
+	} catch {
+		// Fall through to default
+	}
+
+	// 3. Final fallback - 'local' for local profile, 'usc' otherwise
+	return profileName === 'local' ? 'local' : 'usc';
+}
+
+/**
+ * Get a Catalyst API client for global database operations.
+ * Uses the default region since the admin DB is global.
+ */
+export async function getGlobalCatalystAPIClient(
+	logger: Logger,
+	auth: AuthData,
+	profileName = 'production'
+) {
+	const region = await getDefaultRegion(profileName);
+	return getCatalystAPIClient(logger, auth, region);
+}
+
 export function getIONHost(config: Config | null, region: string) {
 	if (config?.overrides?.ion_url) {
 		const url = new URL(config.overrides.ion_url);

package/src/env-util.ts

@@ -8,6 +8,42 @@ export interface EnvVars {
 	[key: string]: string;
 }
 
+/**
+ * Prefixes for public/frontend-exposed environment variables
+ */
+export const PUBLIC_VAR_PREFIXES = ['VITE_', 'AGENTUITY_PUBLIC_', 'PUBLIC_'] as const;
+
+/**
+ * Check if a key is a public variable (exposed to frontend)
+ */
+export function isPublicVarKey(key: string): boolean {
+	const upperKey = key.toUpperCase();
+	return PUBLIC_VAR_PREFIXES.some((prefix) => upperKey.startsWith(prefix));
+}
+
+/**
+ * Check if a key is a reserved AGENTUITY key (except AGENTUITY_PUBLIC_)
+ */
+export function isReservedAgentuityKey(key: string): boolean {
+	const upperKey = key.toUpperCase();
+	return upperKey.startsWith('AGENTUITY_') && !upperKey.startsWith('AGENTUITY_PUBLIC_');
+}
+
+/**
+ * Get public variable keys from secrets that should not be secrets
+ */
+export function getPublicSecretKeys(secrets: EnvVars): string[] {
+	return Object.keys(secrets).filter(isPublicVarKey);
+}
+
+/**
+ * Validate that no public variables are being added as secrets
+ * Returns the list of invalid keys, or empty array if valid
+ */
+export function validateNoPublicSecrets(secrets: EnvVars): string[] {
+	return getPublicSecretKeys(secrets);
+}
+
 /**
  * Find an existing .env file for reading.
  */
@@ -162,14 +198,16 @@ export function mergeEnvVars(
 }
 
 /**
- * Filter out AGENTUITY_ prefixed keys from env vars
+ * Filter out reserved AGENTUITY_ prefixed keys from env vars
  * This is used when pushing to the cloud to avoid sending SDK keys
+ * Note: AGENTUITY_PUBLIC_* keys are allowed (they are public env vars)
  */
-export function filterAgentuitySdkKeys(vars: EnvVars): EnvVars {
+export function filterAgentuitySdkKeys(vars?: EnvVars): EnvVars {
+	if (!vars) return {};
 	const filtered: EnvVars = {};
 
 	for (const [key, value] of Object.entries(vars)) {
-		if (!key.startsWith('AGENTUITY_')) {
+		if (!isReservedAgentuityKey(key)) {
 			filtered[key] = value;
 		}
 	}
@@ -186,6 +224,7 @@ const secretExactKeys = ['DATABASE_URL'];
  * Split env vars into env and secrets based on key names
  * Convention: Keys ending with _SECRET, _KEY, _TOKEN, _PASSWORD are secrets
  * Also treats DATABASE_URL as a secret since it contains credentials
+ * Note: Public vars (VITE_, AGENTUITY_PUBLIC_, PUBLIC_) always go to env, never secrets
  */
 export function splitEnvAndSecrets(vars: EnvVars): {
 	env: EnvVars;
@@ -197,8 +236,14 @@ export function splitEnvAndSecrets(vars: EnvVars): {
 	const secretSuffixes = ['_SECRET', '_KEY', '_TOKEN', '_PASSWORD', '_PRIVATE'];
 
 	for (const [key, value] of Object.entries(vars)) {
-		// Skip AGENTUITY_ prefixed keys
-		if (key.startsWith('AGENTUITY_')) {
+		// Skip reserved AGENTUITY_ prefixed keys (except AGENTUITY_PUBLIC_)
+		if (isReservedAgentuityKey(key)) {
+			continue;
+		}
+
+		// Public vars always go to env, never secrets
+		if (isPublicVarKey(key)) {
+			env[key] = value;
 			continue;
 		}