@inneranimalmedia/agentsam-sdk 2.6.0 → 2.6.2

package/src/lib/core-client.js

@@ -1,27 +1,67 @@
 import { resolveIamOrigin } from '../../packages/identity/src/contracts/auth-config.js';
+import { resolveAccountAuthority } from './auth.js';
 
 /**
  * IAM CORE client — SDK is a delivery mechanism; intelligence lives server-side.
  *
- * IAM_ORIGIN is the canonical platform authority/API origin. During the
- * migration window IAM_CORE_URL / AGENTSAM_CORE_URL remain compatibility-only
- * fallbacks. Without a CORE backend, consumers get scaffold/local CLI only.
+ * IAM_OAUTH_ISSUER is the canonical platform authority/API origin. IAM_ORIGIN,
+ * IAM_CORE_URL and AGENTSAM_CORE_URL remain compatibility fallbacks.
  */
-
 export function coreBaseUrl(env = process.env) {
-  const explicit = env?.IAM_ORIGIN || env?.IAM_CORE_URL || env?.AGENTSAM_CORE_URL || '';
+  const explicit = env?.IAM_OAUTH_ISSUER || env?.IAM_ORIGIN || env?.IAM_CORE_URL || env?.AGENTSAM_CORE_URL || '';
   return resolveIamOrigin(env, explicit);
 }
 
-export async function postJson(path, body, token) {
-  const headers = { 'Content-Type': 'application/json', Accept: 'application/json' };
-  if (token) headers.Authorization = `Bearer ${token}`;
-  const res = await fetch(`${coreBaseUrl()}${path}`, {
+function authOptions(options) {
+  if (typeof options === 'string') return { explicit: options };
+  return options && typeof options === 'object' ? options : {};
+}
+
+export async function resolveCoreAuthority(options = {}) {
+  const resolvedOptions = authOptions(options);
+  const resolver = resolvedOptions.resolveAuthorityImpl || resolveAccountAuthority;
+  const authority = await resolver({
+    env: resolvedOptions.env || process.env,
+    home: resolvedOptions.home,
+    explicit: resolvedOptions.explicit || resolvedOptions.token || '',
+    fetchImpl: resolvedOptions.fetchImpl,
+    issuer: resolvedOptions.issuer,
+    signal: resolvedOptions.signal,
+    nowMs: resolvedOptions.nowMs,
+    skewMs: resolvedOptions.skewMs,
+    refreshImpl: resolvedOptions.refreshImpl,
+  });
+  if (authority?.error) throw new Error(authority.error);
+  if (!authority?.value) throw new Error('account_auth_required');
+  return authority;
+}
+
+async function authorizedHeaders(headers, options = {}) {
+  const authority = await resolveCoreAuthority(options);
+  return {
+    ...headers,
+    Authorization: `Bearer ${authority.value}`,
+  };
+}
+
+async function responseJson(res) {
+  return res.json().catch(() => ({}));
+}
+
+export async function postJson(path, body, options = {}) {
+  const resolvedOptions = authOptions(options);
+  const fetchImpl = resolvedOptions.fetchImpl || fetch;
+  const headers = await authorizedHeaders({
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  }, resolvedOptions);
+  const res = await fetchImpl(`${coreBaseUrl(resolvedOptions.env || process.env)}${path}`, {
     method: 'POST',
     headers,
     body: JSON.stringify(body ?? {}),
+    signal: resolvedOptions.signal,
   });
-  const data = await res.json().catch(() => ({}));
+  const data = await responseJson(res);
   if (!res.ok) {
     const msg = data?.error || data?.message || `HTTP ${res.status}`;
     throw new Error(String(msg));
@@ -29,11 +69,15 @@ export async function postJson(path, body, token) {
   return data;
 }
 
-export async function getJson(path, token) {
-  const headers = { Accept: 'application/json' };
-  if (token) headers.Authorization = `Bearer ${token}`;
-  const res = await fetch(`${coreBaseUrl()}${path}`, { headers });
-  const data = await res.json().catch(() => ({}));
+export async function getJson(path, options = {}) {
+  const resolvedOptions = authOptions(options);
+  const fetchImpl = resolvedOptions.fetchImpl || fetch;
+  const headers = await authorizedHeaders({ Accept: 'application/json' }, resolvedOptions);
+  const res = await fetchImpl(`${coreBaseUrl(resolvedOptions.env || process.env)}${path}`, {
+    headers,
+    signal: resolvedOptions.signal,
+  });
+  const data = await responseJson(res);
   if (!res.ok) {
     const msg = data?.error || data?.message || `HTTP ${res.status}`;
     throw new Error(String(msg));
@@ -44,18 +88,21 @@ export async function getJson(path, token) {
 /**
  * Stream NDJSON from POST /api/sdk/scaffold — calls onEvent for each line.
  */
-export async function streamScaffold(body, token, onEvent) {
-  const res = await fetch(`${coreBaseUrl()}/api/sdk/scaffold`, {
+export async function streamScaffold(body, onEvent, options = {}) {
+  const resolvedOptions = authOptions(options);
+  const fetchImpl = resolvedOptions.fetchImpl || fetch;
+  const headers = await authorizedHeaders({
+    'Content-Type': 'application/json',
+    Accept: 'application/x-ndjson',
+  }, resolvedOptions);
+  const res = await fetchImpl(`${coreBaseUrl(resolvedOptions.env || process.env)}/api/sdk/scaffold`, {
     method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      Accept: 'application/x-ndjson',
-      Authorization: `Bearer ${token}`,
-    },
+    headers,
     body: JSON.stringify(body),
+    signal: resolvedOptions.signal,
   });
   if (!res.ok) {
-    const data = await res.json().catch(() => ({}));
+    const data = await responseJson(res);
     throw new Error(data?.error || `scaffold HTTP ${res.status}`);
   }
   if (!res.body) throw new Error('scaffold stream missing');
@@ -71,15 +118,13 @@ export async function streamScaffold(body, token, onEvent) {
     const lines = buf.split('\n');
     buf = lines.pop() || '';
     for (const line of lines) {
-      const t = line.trim();
-      if (!t) continue;
-      let evt;
+      const text = line.trim();
+      if (!text) continue;
       try {
-        evt = JSON.parse(t);
+        await onEvent(JSON.parse(text));
       } catch {
-        continue;
+        /* ignore malformed stream lines */
       }
-      await onEvent(evt);
     }
   }
   const tail = buf.trim();
@@ -87,7 +132,7 @@ export async function streamScaffold(body, token, onEvent) {
     try {
       await onEvent(JSON.parse(tail));
     } catch {
-      /* ignore */
+      /* ignore malformed trailing line */
     }
   }
 }

package/src/lib/deploy-receipt/index.js

@@ -2,8 +2,8 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
-import { buildMerkleTree, diffTrees, readSnapshot, validateSnapshot } from '../merkle/index.js';
-import { normalizePolicy } from '../merkle/policy.js';
+import { buildMerkleTree, diffTrees, readSnapshot, validateSnapshot } from '../../../packages/agentsam-repository/src/merkle/index.js';
+import { normalizePolicy } from '../../../packages/agentsam-repository/src/merkle/policy.js';
 
 export const DEFAULT_DEPLOY_EXCLUDES = Object.freeze([
   '.agentsam/deploy-merkle',

package/src/lib/detect-context.js

@@ -5,7 +5,7 @@
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { coreBaseUrl } from './core-client.js';
-import { resolveAccountSdkKey } from './account-session.js';
+import { resolveAccountAuth } from './account-session.js';
 
 const execFileAsync = promisify(execFile);
 
@@ -167,11 +167,9 @@ async function detectCloudflare() {
   };
 }
 
-async function probeSdkBearer(token) {
+async function probeAccountBearer(token) {
   const t = String(token || '').trim();
-  if (!t || !t.startsWith('sdk_')) {
-    return { valid: false, error: 'not_sdk_bearer' };
-  }
+  if (!t) return { valid: false, error: 'account_auth_required' };
   try {
     const res = await fetch(`${coreBaseUrl()}/api/sdk/context`, {
       headers: { Accept: 'application/json', Authorization: `Bearer ${t}` },
@@ -197,7 +195,7 @@ function envPresent(name) {
   return v != null && String(v).trim() !== '';
 }
 
-/** IAM auth for SDK init — only verified sdk_* bearer counts as ready. */
+/** IAM auth for SDK init — accepts a verified account API key or browser session credential. */
 async function detectIam(explicitToken = '') {
   const aux = [];
 
@@ -210,9 +208,9 @@ async function detectIam(explicitToken = '') {
     });
   }
 
-  const workerKey = envPresent('IAM_API_KEY') || envPresent('AGENTSAM_API_KEY');
+  const workerKey = envPresent('IAM_API_KEY');
   if (workerKey) {
-    const name = envPresent('IAM_API_KEY') ? 'IAM_API_KEY' : 'AGENTSAM_API_KEY';
+    const name = 'IAM_API_KEY';
     aux.push({
       var: name,
       role: 'Worker runtime secret',
@@ -221,22 +219,22 @@ async function detectIam(explicitToken = '') {
     });
   }
 
-  const sdkToken = resolveAccountSdkKey({ env: process.env, explicit: explicitToken }).value;
-  if (sdkToken.trim()) {
-    const probe = await probeSdkBearer(sdkToken);
+  const accountAuth = resolveAccountAuth({ env: process.env, explicit: explicitToken });
+  if (accountAuth.value) {
+    const probe = await probeAccountBearer(accountAuth.value);
     if (probe.valid) {
       return {
-        source: 'sdk-key',
+        source: accountAuth.kind || 'account-auth',
         ready: true,
-        detail: `AGENTSAM_SDK_KEY · user ${probe.user_id || '?'}`,
+        detail: `${accountAuth.kind === 'api_key' ? 'AGENTSAM_API_KEY' : 'browser session'} · user ${probe.user_id || '?'}`,
         probe,
         aux,
       };
     }
     return {
-      source: 'sdk-key',
+      source: accountAuth.kind || 'account-auth',
       ready: false,
-      detail: `AGENTSAM_SDK_KEY invalid (${probe.error}) → will open browser`,
+      detail: `${accountAuth.kind === 'api_key' ? 'AGENTSAM_API_KEY' : 'browser session'} invalid (${probe.error}) → will open browser`,
       probe,
       aux,
     };
@@ -247,7 +245,7 @@ async function detectIam(explicitToken = '') {
     return {
       source: 'execos-env',
       ready: false,
-      detail: `IAM_PTY_USER_ID set (ExecOS identity — SDK bearer still needed)`,
+      detail: `IAM_PTY_USER_ID set (ExecOS identity — account auth still needed)`,
       aux,
     };
   }

package/src/lib/knowledge-docker.js

@@ -7,12 +7,15 @@ import { CONFIG_PATH, defaultConfig, readConfig } from '../knowledge/config.js';
 
 const sdkRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 const runtimeFiles = () => {
-  const files = ['services/knowledge/package.json', 'services/knowledge/package-lock.json', 'src/lib/merkle/hash.js'];
+  const files = ['services/knowledge/package.json', 'services/knowledge/package-lock.json', 'packages/agentsam-repository/src/merkle/hash.js', 'src/errors/contract.js'];
   const walk = dir => { for (const entry of fs.readdirSync(path.join(sdkRoot, dir), { withFileTypes: true })) {
     const file = `${dir}/${entry.name}`;
-    if (entry.isDirectory()) walk(file); else if (entry.isFile() && /\.(js|sql)$/.test(entry.name)) files.push(file);
+    if (entry.isDirectory()) walk(file);
+    else if (entry.isFile() && (/\.(js|sql)$/.test(entry.name) || file === 'src/rpc/generated/package.json')) files.push(file);
   } };
-  walk('src/knowledge'); return files.sort();
+  walk('src/knowledge');
+  walk('src/rpc/generated');
+  return files.sort();
 };
 
 export function generateKnowledgeDocker(opts = {}) {

package/src/lib/local-sessions.js

@@ -52,17 +52,37 @@ function normalizeUsage(value = {}) {
   };
 }
 
+function normalizeCostBreakdown(value = {}) {
+  return {
+    input: Number(value.input || 0),
+    cached_input: Number(value.cached_input || 0),
+    cache_write: Number(value.cache_write || 0),
+    output: Number(value.output || 0),
+  };
+}
+
+export function localSessionElapsedMs(session = {}, at = Date.now()) {
+  const accumulated = Math.max(0, Number(session.active_elapsed_ms || 0));
+  const startedAt = Date.parse(clean(session.active_started_at));
+  if (clean(session.status) !== 'active' || !Number.isFinite(startedAt)) return accumulated;
+  return accumulated + Math.max(0, Number(at) - startedAt);
+}
+
 export function normalizeLocalSession(value = {}) {
   const createdAt = clean(value.created_at) || now();
+  const status = clean(value.status) || 'active';
+  const updatedAt = clean(value.updated_at) || createdAt;
   return {
     schema_version: LOCAL_SESSION_SCHEMA,
     id: validateSessionId(value.id || createLocalSessionId()),
-    status: clean(value.status) || 'active',
+    status,
     cwd: path.resolve(clean(value.cwd) || process.cwd()),
     title: clean(value.title) || sessionTitleFromInput(value.last_input),
     last_input: clean(value.last_input) || null,
     created_at: createdAt,
-    updated_at: clean(value.updated_at) || createdAt,
+    updated_at: updatedAt,
+    active_elapsed_ms: Math.max(0, Number(value.active_elapsed_ms || 0)),
+    active_started_at: clean(value.active_started_at) || (status === 'active' ? updatedAt : null),
     model_key: clean(value.model_key) || null,
     provider_model_id: clean(value.provider_model_id) || null,
     reasoning_effort: clean(value.reasoning_effort) || null,
@@ -72,6 +92,7 @@ export function normalizeLocalSession(value = {}) {
     usage_snapshot: value.usage_snapshot && typeof value.usage_snapshot === 'object' ? structuredClone(value.usage_snapshot) : null,
     cumulative_usage: normalizeUsage(value.cumulative_usage || {}),
     total_cost_usd: Number(value.total_cost_usd || 0),
+    cost_breakdown_usd: normalizeCostBreakdown(value.cost_breakdown_usd || {}),
     approved_projected_call_cost_usd: Number(value.approved_projected_call_cost_usd || 0),
     last_error: value.last_error && typeof value.last_error === 'object' ? structuredClone(value.last_error) : null,
   };

package/src/lib/local-status.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { tryResolveGitContext } from './git-context.js';
+import { tryResolveGitContext } from '../../packages/agentsam-repository/src/git-context.js';
 import { inspectLocalSqlite } from '../local/sqlite.js';
 import { getCreatedWithVersion, getDefaultProfile, getDeployTarget, getLocalDatabasePath, getProjectName, getProjectPreset, getRepositoryId, tryReadProjectConfig } from './project-config.js';
 

package/src/lib/project-config.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { tryResolveGitContext } from './git-context.js';
+import { tryResolveGitContext } from '../../packages/agentsam-repository/src/git-context.js';
 
 export const PROJECT_CONFIG_PATH = '.agentsam/config.json';
 export const PROJECT_CONFIG_SCHEMA_VERSION = 2;

package/src/lib/provider-credentials.js

@@ -2,16 +2,58 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-const PROVIDER_CREDENTIALS = Object.freeze({
-  openai: Object.freeze({ env: 'OPENAI_API_KEY', files: ['openai.env'] }),
-  gemini: Object.freeze({ env: 'GEMINI_API_KEY', files: ['gemini.env'] }),
-  anthropic: Object.freeze({ env: 'ANTHROPIC_API_KEY', files: ['anthropic.env'] }),
-  grok: Object.freeze({ env: 'XAI_API_KEY', files: ['grok.env', 'xai.env'] }),
-  cloudflare: Object.freeze({ env: 'CLOUDFLARE_API_TOKEN', files: ['cloudflare.env'] }),
+export const PROVIDER_CREDENTIALS = Object.freeze({
+  openai: Object.freeze({ label: 'OpenAI', env: 'OPENAI_API_KEY', files: ['openai.env'], modelProvider: 'openai' }),
+  anthropic: Object.freeze({ label: 'Anthropic', env: 'ANTHROPIC_API_KEY', files: ['anthropic.env'], modelProvider: 'anthropic' }),
+  gemini: Object.freeze({ label: 'Gemini', env: 'GEMINI_API_KEY', files: ['gemini.env'], modelProvider: 'gemini' }),
+  cursor: Object.freeze({ label: 'Cursor', env: 'CURSOR_API_KEY', files: ['cursor.env'], modelProvider: 'cursor' }),
+  xai: Object.freeze({ label: 'xAI', env: 'XAI_API_KEY', files: ['xai.env', 'grok.env'], modelProvider: 'xai' }),
+  cloudflare: Object.freeze({
+    label: 'Cloudflare',
+    env: 'CLOUDFLARE_API_TOKEN',
+    files: ['cloudflare.env'],
+    modelProvider: 'cloudflare',
+    accountEnv: ['ACCOUNT_ID', 'CLOUDFLARE_ACCOUNT_ID'],
+  }),
+  inneranimalmedia: Object.freeze({
+    label: 'InnerAnimalMedia',
+    env: 'AGENTSAM_API_KEY',
+    files: ['inneranimalmedia.env'],
+    tokenPrefix: 'aak_',
+    platformCredential: true,
+  }),
+});
+
+const PROVIDER_ALIASES = Object.freeze({
+  grok: 'xai',
+  iam: 'inneranimalmedia',
+  inneranimal: 'inneranimalmedia',
 });
 
 function clean(value) { return value == null ? '' : String(value).trim(); }
 
+export function normalizeProviderId(provider) {
+  const id = clean(provider).toLowerCase();
+  return PROVIDER_ALIASES[id] || id;
+}
+
+function normalizeCloudflareAccountId(value) {
+  const id = clean(value);
+  if (!id) return '';
+  if (!/^[a-f0-9]{32}$/i.test(id)) throw new Error('invalid_cloudflare_account_id');
+  return id;
+}
+
+function validateCredentialValue(spec, value) {
+  const secret = clean(value);
+  if (!secret) throw new Error('credential_required');
+  if (/[\r\n\0]/.test(secret)) throw new Error('credential_must_be_single_line');
+  if (spec.tokenPrefix && !secret.startsWith(spec.tokenPrefix)) {
+    throw new Error(`credential_prefix_required:${spec.tokenPrefix}`);
+  }
+  return secret;
+}
+
 function homeDirectory(options = {}) {
   return path.resolve(clean(options.home) || clean(options.env?.HOME) || clean(options.env?.USERPROFILE) || os.homedir());
 }
@@ -36,45 +78,219 @@ function secureFile(filename) {
   return { ok: true, mode: stat.mode & 0o777 };
 }
 
+function firstEnvValue(source, names = []) {
+  for (const name of names) {
+    const value = clean(parseEnvValue(source, name));
+    if (value) return value;
+  }
+  return '';
+}
+
+function firstRuntimeValue(env, names = []) {
+  for (const name of names) {
+    const value = clean(env?.[name]);
+    if (value) return value;
+  }
+  return '';
+}
+
+function atomicWrite(filename, source, mode = 0o600) {
+  const dir = path.dirname(filename);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') fs.chmodSync(dir, 0o700);
+  const temp = `${filename}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temp, source, { mode });
+  if (process.platform !== 'win32') fs.chmodSync(temp, mode);
+  fs.renameSync(temp, filename);
+  if (process.platform !== 'win32') fs.chmodSync(filename, mode);
+}
+
+function envLiteral(value) {
+  const text = String(value ?? '');
+  if (/['"\r\n\0]/.test(text)) throw new Error('credential_contains_unsupported_profile_character');
+  return `"${text}"`;
+}
+
+export function agentEnvDirectory(options = {}) {
+  return path.join(homeDirectory(options), '.agentsam', 'env.d');
+}
+
+export function agentEnvLoaderPath(options = {}) {
+  return path.join(homeDirectory(options), '.agentsam', 'load-agent-env.sh');
+}
+
+export function ensureAgentEnvLoader(options = {}) {
+  const filename = agentEnvLoaderPath(options);
+  const supported = Object.keys(PROVIDER_CREDENTIALS).join('|');
+  const source = `# AgentSam provider environment loader. Source this file; do not execute it.
+if [ "$#" -eq 0 ]; then
+  echo "usage: source ~/.agentsam/load-agent-env.sh <profile> [profile ...]" >&2
+  return 2 2>/dev/null || exit 2
+fi
+for _agentsam_profile in "$@"; do
+  case "$_agentsam_profile" in
+    grok) _agentsam_profile="xai" ;;
+    ${supported}) ;;
+    *) echo "unknown AgentSam provider profile: $_agentsam_profile" >&2; return 2 2>/dev/null || exit 2 ;;
+  esac
+  _agentsam_file="\${HOME}/.agentsam/env.d/\${_agentsam_profile}.env"
+  if [ ! -f "$_agentsam_file" ]; then
+    echo "AgentSam provider profile not found: $_agentsam_file" >&2
+    return 1 2>/dev/null || exit 1
+  fi
+  set -a
+  . "$_agentsam_file"
+  set +a
+  if [ "$_agentsam_profile" = cloudflare ]; then
+    if [ -z "\${ACCOUNT_ID:-}" ] && [ -n "\${CLOUDFLARE_ACCOUNT_ID:-}" ]; then export ACCOUNT_ID="$CLOUDFLARE_ACCOUNT_ID"; fi
+    if [ -z "\${CLOUDFLARE_ACCOUNT_ID:-}" ] && [ -n "\${ACCOUNT_ID:-}" ]; then export CLOUDFLARE_ACCOUNT_ID="$ACCOUNT_ID"; fi
+  fi
+done
+unset _agentsam_file _agentsam_profile
+`;
+  atomicWrite(filename, source, 0o700);
+  return filename;
+}
+
+function profileSource(provider, credential = '', options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const lines = [`# AgentSam ${spec.label} provider profile`];
+  if (spec.provider === 'cloudflare') {
+    lines.push('# ACCOUNT_ID is your Cloudflare account identifier; it is not a secret.');
+    lines.push(`export ACCOUNT_ID=${envLiteral(normalizeCloudflareAccountId(options.accountId))}`);
+  }
+  lines.push(`export ${spec.env}=${envLiteral(credential)}`);
+  return `${lines.join('\n')}\n`;
+}
+
 export function providerCredentialSpec(provider) {
-  const id = clean(provider).toLowerCase();
+  const id = normalizeProviderId(provider);
   const spec = PROVIDER_CREDENTIALS[id];
   return spec ? Object.freeze({ provider: id, ...spec }) : null;
 }
 
+export function ensureProviderEnvProfile(provider, options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const dir = agentEnvDirectory(options);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') fs.chmodSync(dir, 0o700);
+  const filename = path.join(dir, spec.files[0]);
+  let created = false;
+  if (!fs.existsSync(filename)) {
+    atomicWrite(filename, profileSource(spec.provider, '', options), 0o600);
+    created = true;
+  } else {
+    const safety = secureFile(filename);
+    if (!safety.ok) throw new Error(safety.error);
+    if (process.platform !== 'win32') fs.chmodSync(filename, 0o600);
+    if (spec.provider === 'cloudflare' && clean(options.accountId)) {
+      const source = fs.readFileSync(filename, 'utf8');
+      const current = firstEnvValue(source, spec.accountEnv || []);
+      if (!current) {
+        const accountId = normalizeCloudflareAccountId(options.accountId);
+        const line = `export ACCOUNT_ID=${envLiteral(accountId)}`;
+        const next = /^(?:export\s+)?ACCOUNT_ID=.*$/m.test(source)
+          ? source.replace(/^(?:export\s+)?ACCOUNT_ID=.*$/m, line)
+          : `${line}\n${source}`;
+        atomicWrite(filename, next, 0o600);
+      }
+    }
+  }
+  const loader = ensureAgentEnvLoader(options);
+  return Object.freeze({
+    provider: spec.provider,
+    file: filename,
+    loader,
+    created,
+    source_command: `source ~/.agentsam/load-agent-env.sh ${spec.provider}`,
+  });
+}
+
+export function setProviderCredential(provider, credential, options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const value = validateCredentialValue(spec, credential);
+  const filename = path.join(agentEnvDirectory(options), spec.files[0]);
+  atomicWrite(filename, profileSource(spec.provider, value, options), 0o600);
+  const loader = ensureAgentEnvLoader(options);
+  return Object.freeze({
+    provider: spec.provider,
+    file: filename,
+    loader,
+    source_command: `source ~/.agentsam/load-agent-env.sh ${spec.provider}`,
+  });
+}
+
+export function removeProviderCredential(provider, options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const dir = agentEnvDirectory(options);
+  let removed = false;
+  for (const basename of spec.files) {
+    const filename = path.join(dir, basename);
+    if (!fs.existsSync(filename)) continue;
+    const safety = secureFile(filename);
+    if (!safety.ok) throw new Error(safety.error);
+    fs.rmSync(filename, { force: true });
+    removed = true;
+  }
+  return Object.freeze({ provider: spec.provider, removed });
+}
+
 export function resolveProviderCredential(provider, options = {}) {
   const spec = providerCredentialSpec(provider);
-  if (!spec) return Object.freeze({ provider: clean(provider).toLowerCase(), configured: false, source: null, error: 'unsupported_provider', value: '' });
+  if (!spec) return Object.freeze({ provider: normalizeProviderId(provider), configured: false, source: null, error: 'unsupported_provider', value: '' });
   const env = options.env || process.env;
+  const accountIdFromEnv = firstRuntimeValue(env, spec.accountEnv || []);
   const fromEnv = clean(env?.[spec.env]);
-  if (fromEnv) return Object.freeze({ provider: spec.provider, configured: true, source: 'environment', env: spec.env, file: null, error: null, value: fromEnv });
+  if (fromEnv) {
+    const prefixError = spec.tokenPrefix && !fromEnv.startsWith(spec.tokenPrefix) ? `credential_prefix_required:${spec.tokenPrefix}` : null;
+    return Object.freeze({
+      provider: spec.provider,
+      configured: !prefixError,
+      source: 'environment',
+      env: spec.env,
+      file: null,
+      error: prefixError,
+      value: prefixError ? '' : fromEnv,
+      account_id: accountIdFromEnv || null,
+    });
+  }
 
-  const dir = path.join(homeDirectory({ ...options, env }), '.agentsam', 'env.d');
+  const dir = agentEnvDirectory({ ...options, env });
   for (const basename of spec.files) {
     const filename = path.join(dir, basename);
     if (!fs.existsSync(filename)) continue;
     try {
       const safety = secureFile(filename);
       if (!safety.ok) return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: safety.error, value: '' });
-      const value = clean(parseEnvValue(fs.readFileSync(filename, 'utf8'), spec.env));
-      if (value) return Object.freeze({ provider: spec.provider, configured: true, source: 'agentsam_env_file', env: spec.env, file: filename, error: null, value });
-      return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: 'credential_variable_missing', value: '' });
+      const source = fs.readFileSync(filename, 'utf8');
+      const value = clean(parseEnvValue(source, spec.env));
+      const accountId = accountIdFromEnv || firstEnvValue(source, spec.accountEnv || []);
+      const prefixError = spec.tokenPrefix && value && !value.startsWith(spec.tokenPrefix) ? `credential_prefix_required:${spec.tokenPrefix}` : null;
+      if (value && !prefixError) return Object.freeze({ provider: spec.provider, configured: true, source: 'agentsam_env_file', env: spec.env, file: filename, error: null, value, account_id: accountId || null });
+      return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: prefixError || 'credential_variable_missing', value: '' });
     } catch (error) {
       return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: error?.message || String(error), value: '' });
     }
   }
-  return Object.freeze({ provider: spec.provider, configured: false, source: null, env: spec.env, file: null, error: null, value: '' });
+  return Object.freeze({ provider: spec.provider, configured: false, source: null, env: spec.env, file: null, error: null, value: '', account_id: accountIdFromEnv || null });
 }
 
 export function describeProviderCredential(provider, options = {}) {
   const resolved = resolveProviderCredential(provider, options);
+  const spec = providerCredentialSpec(provider);
   return Object.freeze({
     provider: resolved.provider,
+    label: spec?.label || resolved.provider,
     configured: resolved.configured,
     source: resolved.source,
     env: resolved.env || null,
     file: resolved.file || null,
     error: resolved.error || null,
+    account_id: resolved.account_id || null,
   });
 }
 

package/src/lib/slash-commands.js

@@ -11,10 +11,12 @@ export const SLASH_COMMANDS = [
   { cmd: '/context', description: 'Show model context economics; add repo for Git bridge context', lane: 'context' },
   { cmd: '/status', description: 'Local project, DB, Git, and PTY health', lane: 'local' },
   { cmd: '/models', description: 'Probe providers and provider-verified known models', lane: 'model' },
-  { cmd: '/login', description: 'Authenticate IAM and save the machine-local Agent Sam session', lane: 'identity' },
-  { cmd: '/logout', description: 'Remove the local IAM session without deleting provider keys', lane: 'identity' },
-  { cmd: '/whoami', description: 'Show authenticated IAM identity and safe credential status', lane: 'identity' },
+  { cmd: '/providers', description: 'Configure and verify machine provider credentials', lane: 'model' },
+  { cmd: '/login', description: 'Sign in to Inner Animal Media and save the machine-local Agent Sam session', lane: 'identity' },
+  { cmd: '/logout', description: 'Sign out locally without deleting provider credentials', lane: 'identity' },
+  { cmd: '/whoami', description: 'Show authenticated account identity and safe credential status', lane: 'identity' },
   { cmd: '/session', description: 'Show current session usage, cost, and resume receipt', lane: 'observability' },
+  { cmd: '/usage', description: 'Show token usage, spend breakdown, and resume command', lane: 'observability' },
   { cmd: '/cf', description: 'Cloudflare native reads, Wrangler status, and CPU profile analysis', lane: 'cloudflare' },
   { cmd: '/settings', description: 'Choose project, runtime, terminal, and model policy' },
   { cmd: '/pwd', description: 'Print working directory', lane: 'terminal' },