@inneranimalmedia/agentsam-sdk 2.6.1 → 2.6.2

package/src/lib/auth.js

@@ -1,71 +1,334 @@
 /**
- * Browser OAuth for SDK init — one click IAM login + Cloudflare connect.
+ * RFC 8252 native-app OAuth for AgentSam CLI.
+ *
+ * The CLI is a public client: authorization code + PKCE over a loopback
+ * redirect. Browser OAuth sessions are machine-local and remain separate from
+ * reusable AGENTSAM_API_KEY (aak_*) credentials.
  */
 import http from 'node:http';
-import { randomBytes } from 'node:crypto';
-import { postJson } from './core-client.js';
+import { createHash, randomBytes } from 'node:crypto';
+import { resolveIamIssuer } from '../../packages/identity/src/contracts/auth-config.js';
 import { promptToOpenUrl } from './open-url.js';
-import { saveAccountSession } from './account-session.js';
+import {
+  isBrowserSessionExpired,
+  readAccountSession,
+  resolveAccountApiKey,
+  saveAccountSession,
+} from './account-session.js';
 
-function randomState() {
-  return randomBytes(16).toString('hex');
+export const AGENTSAM_NATIVE_OAUTH_CLIENT_ID = 'iam_cli_agentsam';
+export const AGENTSAM_NATIVE_OAUTH_SCOPE = 'openid profile email offline_access';
+export const AGENTSAM_OAUTH_CALLBACK_PATH = '/callback';
+
+function clean(value) { return value == null ? '' : String(value).trim(); }
+function base64url(value) {
+  return Buffer.from(value).toString('base64')
+    .replace(/=/g, '')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_');
+}
+function randomUrlSafe(bytes = 32, randomBytesImpl = randomBytes) {
+  return base64url(randomBytesImpl(bytes));
+}
+function oauthErrorMessage(body, status) {
+  const code = clean(body?.error);
+  const description = clean(body?.error_description || body?.message);
+  if (code && description) return `${code}: ${description}`;
+  return code || description || `OAuth token HTTP ${status}`;
+}
+
+export function createPkcePair(options = {}) {
+  const verifier = randomUrlSafe(32, options.randomBytesImpl || randomBytes);
+  const challenge = base64url(createHash('sha256').update(verifier, 'ascii').digest());
+  return Object.freeze({ verifier, challenge, method: 'S256' });
+}
+
+export function buildNativeAuthorizationUrl(options = {}) {
+  const env = options.env || process.env;
+  const issuer = resolveIamIssuer(env, options.issuer || '');
+  const clientId = clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const redirectUri = clean(options.redirectUri);
+  const state = clean(options.state);
+  const codeChallenge = clean(options.codeChallenge);
+  const scope = clean(options.scope ?? AGENTSAM_NATIVE_OAUTH_SCOPE);
+  if (!redirectUri || !state || !codeChallenge) throw new Error('oauth_authorization_parameters_required');
+
+  const url = new URL('/api/oauth/authorize', `${issuer}/`);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('client_id', clientId);
+  url.searchParams.set('redirect_uri', redirectUri);
+  url.searchParams.set('code_challenge', codeChallenge);
+  url.searchParams.set('code_challenge_method', 'S256');
+  url.searchParams.set('state', state);
+  if (scope) url.searchParams.set('scope', scope);
+  return url.toString();
+}
+
+async function oauthTokenRequest(params, options = {}) {
+  const env = options.env || process.env;
+  const issuer = resolveIamIssuer(env, options.issuer || '');
+  const fetchImpl = options.fetchImpl || fetch;
+  const body = new URLSearchParams();
+  for (const [key, value] of Object.entries(params || {})) {
+    const normalized = clean(value);
+    if (normalized) body.set(key, normalized);
+  }
+
+  const response = await fetchImpl(new URL('/api/oauth/token', `${issuer}/`).toString(), {
+    method: 'POST',
+    headers: {
+      Accept: 'application/json',
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+    body: body.toString(),
+    signal: options.signal || (typeof AbortSignal?.timeout === 'function' ? AbortSignal.timeout(15_000) : undefined),
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const error = new Error(oauthErrorMessage(data, response.status));
+    error.status = response.status;
+    error.oauth_error = clean(data?.error) || null;
+    throw error;
+  }
+  if (!clean(data?.access_token)) throw new Error('oauth_token_response_missing_access_token');
+  return data;
+}
+
+export async function exchangeAuthorizationCode(options = {}) {
+  const code = clean(options.code);
+  const codeVerifier = clean(options.codeVerifier);
+  const redirectUri = clean(options.redirectUri);
+  if (!code || !codeVerifier || !redirectUri) throw new Error('oauth_authorization_code_exchange_parameters_required');
+  return oauthTokenRequest({
+    grant_type: 'authorization_code',
+    client_id: clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID,
+    redirect_uri: redirectUri,
+    code,
+    code_verifier: codeVerifier,
+  }, options);
+}
+
+export async function refreshAccountSession(options = {}) {
+  const session = options.session || readAccountSession(options);
+  if (!session?.refresh_token) throw new Error('browser_oauth_refresh_unavailable');
+  const clientId = clean(session.client_id) || clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const refreshed = await oauthTokenRequest({
+    grant_type: 'refresh_token',
+    client_id: clientId,
+    refresh_token: session.refresh_token,
+  }, options);
+
+  return saveAccountSession({
+    ...refreshed,
+    refresh_token: clean(refreshed.refresh_token) || session.refresh_token,
+    client_id: clientId,
+    user_id: session.user_id,
+    account_id: session.account_id,
+    email: session.email,
+  }, {
+    ...options,
+    preserveRefreshToken: true,
+  });
 }
 
 /**
- * @returns {Promise<{ access_token: string, user_id: string, workspace_id: string, tenant_id: string }>}
+ * Canonical SDK account authority resolution.
+ * explicit aak_* -> AGENTSAM_API_KEY -> stored browser OAuth -> OAuth refresh.
  */
-export async function authenticateViaBrowser() {
-  const state = randomState();
-  const port = 8791 + (randomBytes(1)[0] % 20);
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
+export async function resolveAccountAuthority(options = {}) {
+  const apiKey = resolveAccountApiKey(options);
+  if (apiKey.value || apiKey.error) return apiKey;
 
-  const { auth_url: authUrl } = await postJson('/api/sdk/auth/start', {
-    redirect_uri: redirectUri,
-    state,
+  let session = readAccountSession(options);
+  if (!session?.access_token) return { value: '', source: null, kind: null, session: null };
+
+  if (isBrowserSessionExpired(session, options)) {
+    if (!session.refresh_token) {
+      return {
+        value: '',
+        source: 'agentsam_browser_oauth',
+        kind: 'browser_oauth',
+        session,
+        error: 'browser_oauth_session_expired',
+      };
+    }
+    try {
+      const refreshImpl = options.refreshImpl || refreshAccountSession;
+      session = await refreshImpl({ ...options, session });
+    } catch (error) {
+      return {
+        value: '',
+        source: 'agentsam_browser_oauth',
+        kind: 'browser_oauth',
+        session,
+        error: `browser_oauth_refresh_failed: ${error?.message || String(error)}`,
+      };
+    }
+  }
+
+  return {
+    value: session.access_token,
+    source: 'agentsam_browser_oauth',
+    kind: 'browser_oauth',
+    session,
+  };
+}
+
+export async function createLoopbackCallbackListener(options = {}) {
+  const host = clean(options.host) || '127.0.0.1';
+  const callbackPath = clean(options.callbackPath) || AGENTSAM_OAUTH_CALLBACK_PATH;
+  const expectedState = clean(options.state);
+  if (!expectedState) throw new Error('oauth_state_required');
+  const timeoutMs = Number.isFinite(Number(options.timeoutMs)) ? Number(options.timeoutMs) : 180_000;
+  const createServerImpl = options.createServerImpl || http.createServer;
+
+  let settle;
+  let settled = false;
+  let timer = null;
+  const callbackPromise = new Promise((resolve, reject) => {
+    settle = (error, result) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      if (error) reject(error);
+      else resolve(result);
+    };
   });
 
-  if (!authUrl) throw new Error('IAM auth did not return an authorization URL');
+  const server = createServerImpl((req, res) => {
+    try {
+      const requestUrl = new URL(req.url || '/', `http://${host}`);
+      if (requestUrl.pathname !== callbackPath) {
+        res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Not found');
+        return;
+      }
 
-  const codePromise = new Promise((resolve, reject) => {
-    const server = http.createServer((req, res) => {
-      try {
-        const u = new URL(req.url || '/', `http://127.0.0.1:${port}`);
-        if (u.pathname !== '/callback') {
-          res.writeHead(404);
-          res.end('Not found');
-          return;
-        }
-        const code = u.searchParams.get('code');
-        const gotState = u.searchParams.get('state');
-        if (!code || gotState !== state) {
-          res.writeHead(400);
-          res.end('Invalid callback');
-          reject(new Error('auth callback invalid'));
-          server.close();
-          return;
-        }
-        res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end('<html><body style="font-family:system-ui"><h1>Agent Sam</h1><p>Authentication complete. You can close this tab and return to your terminal.</p></body></html>');
-        resolve(code);
-        server.close();
-      } catch (e) {
-        reject(e);
-        server.close();
+      const returnedState = clean(requestUrl.searchParams.get('state'));
+      const oauthError = clean(requestUrl.searchParams.get('error'));
+      const oauthDescription = clean(requestUrl.searchParams.get('error_description'));
+      const code = clean(requestUrl.searchParams.get('code'));
+
+      if (!returnedState || returnedState !== expectedState) {
+        res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Invalid OAuth state. Return to the terminal and retry.');
+        settle(new Error('oauth_state_mismatch'));
+        return;
       }
-    });
-    server.on('error', reject);
-    server.listen(port, '127.0.0.1');
+      if (oauthError) {
+        res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Authorization was not completed. Return to the terminal.');
+        settle(new Error(oauthDescription ? `${oauthError}: ${oauthDescription}` : oauthError));
+        return;
+      }
+      if (!code) {
+        res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Authorization code missing. Return to the terminal and retry.');
+        settle(new Error('oauth_authorization_code_missing'));
+        return;
+      }
+
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end('<!doctype html><html><body style="font-family:system-ui"><h1>Agent Sam</h1><p>Authentication complete. You can close this tab and return to your terminal.</p></body></html>');
+      settle(null, { code, state: returnedState });
+    } catch (error) {
+      try {
+        res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('OAuth callback failed. Return to the terminal.');
+      } catch { /* response may already be closed */ }
+      settle(error);
+    }
   });
 
-  await promptToOpenUrl(authUrl, {
-    heading: 'Authenticate your InnerAnimalMedia account at:',
-    prompt: 'Press ENTER to open InnerAnimalMedia sign-in in your browser.',
+  await new Promise((resolve, reject) => {
+    const onError = (error) => {
+      server.off('listening', onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.off('error', onError);
+      resolve();
+    };
+    server.once('error', onError);
+    server.once('listening', onListening);
+    server.listen({ host, port: Number(options.port) || 0, exclusive: true });
   });
 
-  const code = await codePromise;
-  const session = await postJson('/api/sdk/auth/exchange', { code, state });
-  if (String(session?.access_token || '').trim().startsWith('sdk_')) {
-    saveAccountSession(session);
+  const address = server.address();
+  if (!address || typeof address === 'string') {
+    server.close();
+    throw new Error('oauth_loopback_listener_address_unavailable');
+  }
+  const redirectUri = `http://${host}:${address.port}${callbackPath}`;
+  timer = setTimeout(() => settle(new Error('oauth_callback_timeout')), Math.max(1, timeoutMs));
+  timer.unref?.();
+
+  return {
+    redirectUri,
+    waitForCallback: () => callbackPromise,
+    close: () => new Promise((resolve) => {
+      if (!server.listening) return resolve();
+      server.close(() => resolve());
+    }),
+  };
+}
+
+export async function authenticateViaBrowser(options = {}) {
+  const env = options.env || process.env;
+  const clientId = clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const state = randomUrlSafe(24, options.randomBytesImpl || randomBytes);
+  const pkce = createPkcePair({ randomBytesImpl: options.randomBytesImpl });
+  const listener = await createLoopbackCallbackListener({
+    state,
+    host: options.host,
+    port: options.port,
+    callbackPath: options.callbackPath,
+    timeoutMs: options.timeoutMs,
+    createServerImpl: options.createServerImpl,
+  });
+
+  try {
+    const authorizationUrl = buildNativeAuthorizationUrl({
+      env,
+      issuer: options.issuer,
+      clientId,
+      redirectUri: listener.redirectUri,
+      state,
+      codeChallenge: pkce.challenge,
+      scope: options.scope,
+    });
+
+    const promptImpl = options.promptToOpenUrlImpl || promptToOpenUrl;
+    await promptImpl(authorizationUrl, {
+      heading: 'Authenticate your InnerAnimalMedia account at:',
+      prompt: 'Press ENTER to open InnerAnimalMedia sign-in in your browser.',
+      input: options.input,
+      output: options.output,
+      openImpl: options.openImpl,
+    });
+
+    const callback = await listener.waitForCallback();
+    const tokenSet = await exchangeAuthorizationCode({
+      env,
+      issuer: options.issuer,
+      clientId,
+      redirectUri: listener.redirectUri,
+      code: callback.code,
+      codeVerifier: pkce.verifier,
+      fetchImpl: options.fetchImpl,
+      signal: options.signal,
+    });
+
+    return saveAccountSession({
+      ...tokenSet,
+      client_id: clientId,
+    }, {
+      home: options.home,
+      env,
+      nowMs: options.nowMs,
+      preserveRefreshToken: false,
+    });
+  } finally {
+    await listener.close();
   }
-  return session;
 }

package/src/lib/core-client.js

@@ -1,27 +1,67 @@
 import { resolveIamOrigin } from '../../packages/identity/src/contracts/auth-config.js';
+import { resolveAccountAuthority } from './auth.js';
 
 /**
  * IAM CORE client — SDK is a delivery mechanism; intelligence lives server-side.
  *
- * IAM_ORIGIN is the canonical platform authority/API origin. During the
- * migration window IAM_CORE_URL / AGENTSAM_CORE_URL remain compatibility-only
- * fallbacks. Without a CORE backend, consumers get scaffold/local CLI only.
+ * IAM_OAUTH_ISSUER is the canonical platform authority/API origin. IAM_ORIGIN,
+ * IAM_CORE_URL and AGENTSAM_CORE_URL remain compatibility fallbacks.
  */
-
 export function coreBaseUrl(env = process.env) {
-  const explicit = env?.IAM_ORIGIN || env?.IAM_CORE_URL || env?.AGENTSAM_CORE_URL || '';
+  const explicit = env?.IAM_OAUTH_ISSUER || env?.IAM_ORIGIN || env?.IAM_CORE_URL || env?.AGENTSAM_CORE_URL || '';
   return resolveIamOrigin(env, explicit);
 }
 
-export async function postJson(path, body, token) {
-  const headers = { 'Content-Type': 'application/json', Accept: 'application/json' };
-  if (token) headers.Authorization = `Bearer ${token}`;
-  const res = await fetch(`${coreBaseUrl()}${path}`, {
+function authOptions(options) {
+  if (typeof options === 'string') return { explicit: options };
+  return options && typeof options === 'object' ? options : {};
+}
+
+export async function resolveCoreAuthority(options = {}) {
+  const resolvedOptions = authOptions(options);
+  const resolver = resolvedOptions.resolveAuthorityImpl || resolveAccountAuthority;
+  const authority = await resolver({
+    env: resolvedOptions.env || process.env,
+    home: resolvedOptions.home,
+    explicit: resolvedOptions.explicit || resolvedOptions.token || '',
+    fetchImpl: resolvedOptions.fetchImpl,
+    issuer: resolvedOptions.issuer,
+    signal: resolvedOptions.signal,
+    nowMs: resolvedOptions.nowMs,
+    skewMs: resolvedOptions.skewMs,
+    refreshImpl: resolvedOptions.refreshImpl,
+  });
+  if (authority?.error) throw new Error(authority.error);
+  if (!authority?.value) throw new Error('account_auth_required');
+  return authority;
+}
+
+async function authorizedHeaders(headers, options = {}) {
+  const authority = await resolveCoreAuthority(options);
+  return {
+    ...headers,
+    Authorization: `Bearer ${authority.value}`,
+  };
+}
+
+async function responseJson(res) {
+  return res.json().catch(() => ({}));
+}
+
+export async function postJson(path, body, options = {}) {
+  const resolvedOptions = authOptions(options);
+  const fetchImpl = resolvedOptions.fetchImpl || fetch;
+  const headers = await authorizedHeaders({
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  }, resolvedOptions);
+  const res = await fetchImpl(`${coreBaseUrl(resolvedOptions.env || process.env)}${path}`, {
     method: 'POST',
     headers,
     body: JSON.stringify(body ?? {}),
+    signal: resolvedOptions.signal,
   });
-  const data = await res.json().catch(() => ({}));
+  const data = await responseJson(res);
   if (!res.ok) {
     const msg = data?.error || data?.message || `HTTP ${res.status}`;
     throw new Error(String(msg));
@@ -29,11 +69,15 @@ export async function postJson(path, body, token) {
   return data;
 }
 
-export async function getJson(path, token) {
-  const headers = { Accept: 'application/json' };
-  if (token) headers.Authorization = `Bearer ${token}`;
-  const res = await fetch(`${coreBaseUrl()}${path}`, { headers });
-  const data = await res.json().catch(() => ({}));
+export async function getJson(path, options = {}) {
+  const resolvedOptions = authOptions(options);
+  const fetchImpl = resolvedOptions.fetchImpl || fetch;
+  const headers = await authorizedHeaders({ Accept: 'application/json' }, resolvedOptions);
+  const res = await fetchImpl(`${coreBaseUrl(resolvedOptions.env || process.env)}${path}`, {
+    headers,
+    signal: resolvedOptions.signal,
+  });
+  const data = await responseJson(res);
   if (!res.ok) {
     const msg = data?.error || data?.message || `HTTP ${res.status}`;
     throw new Error(String(msg));
@@ -44,18 +88,21 @@ export async function getJson(path, token) {
 /**
  * Stream NDJSON from POST /api/sdk/scaffold — calls onEvent for each line.
  */
-export async function streamScaffold(body, token, onEvent) {
-  const res = await fetch(`${coreBaseUrl()}/api/sdk/scaffold`, {
+export async function streamScaffold(body, onEvent, options = {}) {
+  const resolvedOptions = authOptions(options);
+  const fetchImpl = resolvedOptions.fetchImpl || fetch;
+  const headers = await authorizedHeaders({
+    'Content-Type': 'application/json',
+    Accept: 'application/x-ndjson',
+  }, resolvedOptions);
+  const res = await fetchImpl(`${coreBaseUrl(resolvedOptions.env || process.env)}/api/sdk/scaffold`, {
     method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      Accept: 'application/x-ndjson',
-      Authorization: `Bearer ${token}`,
-    },
+    headers,
     body: JSON.stringify(body),
+    signal: resolvedOptions.signal,
   });
   if (!res.ok) {
-    const data = await res.json().catch(() => ({}));
+    const data = await responseJson(res);
     throw new Error(data?.error || `scaffold HTTP ${res.status}`);
   }
   if (!res.body) throw new Error('scaffold stream missing');
@@ -71,15 +118,13 @@ export async function streamScaffold(body, token, onEvent) {
     const lines = buf.split('\n');
     buf = lines.pop() || '';
     for (const line of lines) {
-      const t = line.trim();
-      if (!t) continue;
-      let evt;
+      const text = line.trim();
+      if (!text) continue;
       try {
-        evt = JSON.parse(t);
+        await onEvent(JSON.parse(text));
       } catch {
-        continue;
+        /* ignore malformed stream lines */
       }
-      await onEvent(evt);
     }
   }
   const tail = buf.trim();
@@ -87,7 +132,7 @@ export async function streamScaffold(body, token, onEvent) {
     try {
       await onEvent(JSON.parse(tail));
     } catch {
-      /* ignore */
+      /* ignore malformed trailing line */
     }
   }
 }

package/src/lib/detect-context.js

@@ -5,7 +5,7 @@
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { coreBaseUrl } from './core-client.js';
-import { resolveAccountSdkKey } from './account-session.js';
+import { resolveAccountAuth } from './account-session.js';
 
 const execFileAsync = promisify(execFile);
 
@@ -167,11 +167,9 @@ async function detectCloudflare() {
   };
 }
 
-async function probeSdkBearer(token) {
+async function probeAccountBearer(token) {
   const t = String(token || '').trim();
-  if (!t || !t.startsWith('sdk_')) {
-    return { valid: false, error: 'not_sdk_bearer' };
-  }
+  if (!t) return { valid: false, error: 'account_auth_required' };
   try {
     const res = await fetch(`${coreBaseUrl()}/api/sdk/context`, {
       headers: { Accept: 'application/json', Authorization: `Bearer ${t}` },
@@ -197,7 +195,7 @@ function envPresent(name) {
   return v != null && String(v).trim() !== '';
 }
 
-/** IAM auth for SDK init — only verified sdk_* bearer counts as ready. */
+/** IAM auth for SDK init — accepts a verified account API key or browser session credential. */
 async function detectIam(explicitToken = '') {
   const aux = [];
 
@@ -210,9 +208,9 @@ async function detectIam(explicitToken = '') {
     });
   }
 
-  const workerKey = envPresent('IAM_API_KEY') || envPresent('AGENTSAM_API_KEY');
+  const workerKey = envPresent('IAM_API_KEY');
   if (workerKey) {
-    const name = envPresent('IAM_API_KEY') ? 'IAM_API_KEY' : 'AGENTSAM_API_KEY';
+    const name = 'IAM_API_KEY';
     aux.push({
       var: name,
       role: 'Worker runtime secret',
@@ -221,22 +219,22 @@ async function detectIam(explicitToken = '') {
     });
   }
 
-  const sdkToken = resolveAccountSdkKey({ env: process.env, explicit: explicitToken }).value;
-  if (sdkToken.trim()) {
-    const probe = await probeSdkBearer(sdkToken);
+  const accountAuth = resolveAccountAuth({ env: process.env, explicit: explicitToken });
+  if (accountAuth.value) {
+    const probe = await probeAccountBearer(accountAuth.value);
     if (probe.valid) {
       return {
-        source: 'sdk-key',
+        source: accountAuth.kind || 'account-auth',
         ready: true,
-        detail: `AGENTSAM_SDK_KEY · user ${probe.user_id || '?'}`,
+        detail: `${accountAuth.kind === 'api_key' ? 'AGENTSAM_API_KEY' : 'browser session'} · user ${probe.user_id || '?'}`,
         probe,
         aux,
       };
     }
     return {
-      source: 'sdk-key',
+      source: accountAuth.kind || 'account-auth',
       ready: false,
-      detail: `AGENTSAM_SDK_KEY invalid (${probe.error}) → will open browser`,
+      detail: `${accountAuth.kind === 'api_key' ? 'AGENTSAM_API_KEY' : 'browser session'} invalid (${probe.error}) → will open browser`,
       probe,
       aux,
     };
@@ -247,7 +245,7 @@ async function detectIam(explicitToken = '') {
     return {
       source: 'execos-env',
       ready: false,
-      detail: `IAM_PTY_USER_ID set (ExecOS identity — SDK bearer still needed)`,
+      detail: `IAM_PTY_USER_ID set (ExecOS identity — account auth still needed)`,
       aux,
     };
   }