@inneranimalmedia/agentsam-sdk 2.6.1 → 2.6.2

package/src/lib/provider-credentials.js

@@ -2,15 +2,41 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-const PROVIDER_CREDENTIALS = Object.freeze({
-  openai: Object.freeze({ env: 'OPENAI_API_KEY', files: ['openai.env'] }),
-  gemini: Object.freeze({ env: 'GEMINI_API_KEY', files: ['gemini.env'] }),
-  anthropic: Object.freeze({ env: 'ANTHROPIC_API_KEY', files: ['anthropic.env'] }),
-  grok: Object.freeze({ env: 'XAI_API_KEY', files: ['grok.env', 'xai.env'] }),
-  cloudflare: Object.freeze({ env: 'CLOUDFLARE_API_TOKEN', files: ['cloudflare.env'], accountEnv: ['ACCOUNT_ID', 'CLOUDFLARE_ACCOUNT_ID'] }),
+export const PROVIDER_CREDENTIALS = Object.freeze({
+  openai: Object.freeze({ label: 'OpenAI', env: 'OPENAI_API_KEY', files: ['openai.env'], modelProvider: 'openai' }),
+  anthropic: Object.freeze({ label: 'Anthropic', env: 'ANTHROPIC_API_KEY', files: ['anthropic.env'], modelProvider: 'anthropic' }),
+  gemini: Object.freeze({ label: 'Gemini', env: 'GEMINI_API_KEY', files: ['gemini.env'], modelProvider: 'gemini' }),
+  cursor: Object.freeze({ label: 'Cursor', env: 'CURSOR_API_KEY', files: ['cursor.env'], modelProvider: 'cursor' }),
+  xai: Object.freeze({ label: 'xAI', env: 'XAI_API_KEY', files: ['xai.env', 'grok.env'], modelProvider: 'xai' }),
+  cloudflare: Object.freeze({
+    label: 'Cloudflare',
+    env: 'CLOUDFLARE_API_TOKEN',
+    files: ['cloudflare.env'],
+    modelProvider: 'cloudflare',
+    accountEnv: ['ACCOUNT_ID', 'CLOUDFLARE_ACCOUNT_ID'],
+  }),
+  inneranimalmedia: Object.freeze({
+    label: 'InnerAnimalMedia',
+    env: 'AGENTSAM_API_KEY',
+    files: ['inneranimalmedia.env'],
+    tokenPrefix: 'aak_',
+    platformCredential: true,
+  }),
+});
+
+const PROVIDER_ALIASES = Object.freeze({
+  grok: 'xai',
+  iam: 'inneranimalmedia',
+  inneranimal: 'inneranimalmedia',
 });
 
 function clean(value) { return value == null ? '' : String(value).trim(); }
+
+export function normalizeProviderId(provider) {
+  const id = clean(provider).toLowerCase();
+  return PROVIDER_ALIASES[id] || id;
+}
+
 function normalizeCloudflareAccountId(value) {
   const id = clean(value);
   if (!id) return '';
@@ -18,6 +44,16 @@ function normalizeCloudflareAccountId(value) {
   return id;
 }
 
+function validateCredentialValue(spec, value) {
+  const secret = clean(value);
+  if (!secret) throw new Error('credential_required');
+  if (/[\r\n\0]/.test(secret)) throw new Error('credential_must_be_single_line');
+  if (spec.tokenPrefix && !secret.startsWith(spec.tokenPrefix)) {
+    throw new Error(`credential_prefix_required:${spec.tokenPrefix}`);
+  }
+  return secret;
+}
+
 function homeDirectory(options = {}) {
   return path.resolve(clean(options.home) || clean(options.env?.HOME) || clean(options.env?.USERPROFILE) || os.homedir());
 }
@@ -58,6 +94,23 @@ function firstRuntimeValue(env, names = []) {
   return '';
 }
 
+function atomicWrite(filename, source, mode = 0o600) {
+  const dir = path.dirname(filename);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') fs.chmodSync(dir, 0o700);
+  const temp = `${filename}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temp, source, { mode });
+  if (process.platform !== 'win32') fs.chmodSync(temp, mode);
+  fs.renameSync(temp, filename);
+  if (process.platform !== 'win32') fs.chmodSync(filename, mode);
+}
+
+function envLiteral(value) {
+  const text = String(value ?? '');
+  if (/['"\r\n\0]/.test(text)) throw new Error('credential_contains_unsupported_profile_character');
+  return `"${text}"`;
+}
+
 export function agentEnvDirectory(options = {}) {
   return path.join(homeDirectory(options), '.agentsam', 'env.d');
 }
@@ -68,83 +121,143 @@ export function agentEnvLoaderPath(options = {}) {
 
 export function ensureAgentEnvLoader(options = {}) {
   const filename = agentEnvLoaderPath(options);
-  fs.mkdirSync(path.dirname(filename), { recursive: true, mode: 0o700 });
+  const supported = Object.keys(PROVIDER_CREDENTIALS).join('|');
   const source = `# AgentSam provider environment loader. Source this file; do not execute it.
-_agentsam_profile=\"\${1:-}\"
-case \"\$_agentsam_profile\" in
-  openai|anthropic|gemini|grok|cloudflare) ;;
-  *) echo \"usage: source ~/.agentsam/load-agent-env.sh <openai|anthropic|gemini|grok|cloudflare>\" >&2; return 2 2>/dev/null || exit 2 ;;
-esac
-_agentsam_file=\"\${HOME}/.agentsam/env.d/\${_agentsam_profile}.env\"
-if [ ! -f \"\$_agentsam_file\" ]; then
-  echo \"AgentSam provider profile not found: \$_agentsam_file\" >&2
-  return 1 2>/dev/null || exit 1
-fi
-set -a
-. \"\$_agentsam_file\"
-set +a
-if [ \"\$_agentsam_profile\" = cloudflare ]; then
-  if [ -z \"\${ACCOUNT_ID:-}\" ] && [ -n \"\${CLOUDFLARE_ACCOUNT_ID:-}\" ]; then export ACCOUNT_ID=\"\$CLOUDFLARE_ACCOUNT_ID\"; fi
-  if [ -z \"\${CLOUDFLARE_ACCOUNT_ID:-}\" ] && [ -n \"\${ACCOUNT_ID:-}\" ]; then export CLOUDFLARE_ACCOUNT_ID=\"\$ACCOUNT_ID\"; fi
+if [ "$#" -eq 0 ]; then
+  echo "usage: source ~/.agentsam/load-agent-env.sh <profile> [profile ...]" >&2
+  return 2 2>/dev/null || exit 2
 fi
+for _agentsam_profile in "$@"; do
+  case "$_agentsam_profile" in
+    grok) _agentsam_profile="xai" ;;
+    ${supported}) ;;
+    *) echo "unknown AgentSam provider profile: $_agentsam_profile" >&2; return 2 2>/dev/null || exit 2 ;;
+  esac
+  _agentsam_file="\${HOME}/.agentsam/env.d/\${_agentsam_profile}.env"
+  if [ ! -f "$_agentsam_file" ]; then
+    echo "AgentSam provider profile not found: $_agentsam_file" >&2
+    return 1 2>/dev/null || exit 1
+  fi
+  set -a
+  . "$_agentsam_file"
+  set +a
+  if [ "$_agentsam_profile" = cloudflare ]; then
+    if [ -z "\${ACCOUNT_ID:-}" ] && [ -n "\${CLOUDFLARE_ACCOUNT_ID:-}" ]; then export ACCOUNT_ID="$CLOUDFLARE_ACCOUNT_ID"; fi
+    if [ -z "\${CLOUDFLARE_ACCOUNT_ID:-}" ] && [ -n "\${ACCOUNT_ID:-}" ]; then export CLOUDFLARE_ACCOUNT_ID="$ACCOUNT_ID"; fi
+  fi
+done
 unset _agentsam_file _agentsam_profile
 `;
-  fs.writeFileSync(filename, source, { mode: 0o700 });
-  if (process.platform !== 'win32') fs.chmodSync(filename, 0o700);
+  atomicWrite(filename, source, 0o700);
   return filename;
 }
 
-function profileTemplate(provider, options = {}) {
-  if (provider === 'cloudflare') {
-    const accountId = normalizeCloudflareAccountId(options.accountId);
-    return `# AgentSam Cloudflare profile\n# ACCOUNT_ID is your Cloudflare account identifier; it is not a secret.\nexport ACCOUNT_ID=\"${accountId}\"\nexport CLOUDFLARE_API_TOKEN=\"\"\n`;
+function profileSource(provider, credential = '', options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const lines = [`# AgentSam ${spec.label} provider profile`];
+  if (spec.provider === 'cloudflare') {
+    lines.push('# ACCOUNT_ID is your Cloudflare account identifier; it is not a secret.');
+    lines.push(`export ACCOUNT_ID=${envLiteral(normalizeCloudflareAccountId(options.accountId))}`);
   }
-  const spec = PROVIDER_CREDENTIALS[provider];
-  if (!spec) throw new Error(`unsupported_provider:${provider}`);
-  return `# AgentSam ${provider} provider profile\nexport ${spec.env}=\"\"\n`;
+  lines.push(`export ${spec.env}=${envLiteral(credential)}`);
+  return `${lines.join('\n')}\n`;
+}
+
+export function providerCredentialSpec(provider) {
+  const id = normalizeProviderId(provider);
+  const spec = PROVIDER_CREDENTIALS[id];
+  return spec ? Object.freeze({ provider: id, ...spec }) : null;
 }
 
 export function ensureProviderEnvProfile(provider, options = {}) {
   const spec = providerCredentialSpec(provider);
-  if (!spec) throw new Error(`unsupported_provider:${clean(provider).toLowerCase()}`);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
   const dir = agentEnvDirectory(options);
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   if (process.platform !== 'win32') fs.chmodSync(dir, 0o700);
   const filename = path.join(dir, spec.files[0]);
   let created = false;
   if (!fs.existsSync(filename)) {
-    fs.writeFileSync(filename, profileTemplate(spec.provider, options), { mode: 0o600 });
+    atomicWrite(filename, profileSource(spec.provider, '', options), 0o600);
     created = true;
-  } else if (spec.provider === 'cloudflare' && clean(options.accountId)) {
-    const source = fs.readFileSync(filename, 'utf8');
-    const current = firstEnvValue(source, spec.accountEnv || []);
-    if (!current) {
-      const accountId = normalizeCloudflareAccountId(options.accountId);
-      const line = `export ACCOUNT_ID=\"${accountId}\"`;
-      const next = /^(?:export\s+)?ACCOUNT_ID=.*$/m.test(source)
-        ? source.replace(/^(?:export\s+)?ACCOUNT_ID=.*$/m, line)
-        : `${line}\n${source}`;
-      fs.writeFileSync(filename, next, { mode: 0o600 });
+  } else {
+    const safety = secureFile(filename);
+    if (!safety.ok) throw new Error(safety.error);
+    if (process.platform !== 'win32') fs.chmodSync(filename, 0o600);
+    if (spec.provider === 'cloudflare' && clean(options.accountId)) {
+      const source = fs.readFileSync(filename, 'utf8');
+      const current = firstEnvValue(source, spec.accountEnv || []);
+      if (!current) {
+        const accountId = normalizeCloudflareAccountId(options.accountId);
+        const line = `export ACCOUNT_ID=${envLiteral(accountId)}`;
+        const next = /^(?:export\s+)?ACCOUNT_ID=.*$/m.test(source)
+          ? source.replace(/^(?:export\s+)?ACCOUNT_ID=.*$/m, line)
+          : `${line}\n${source}`;
+        atomicWrite(filename, next, 0o600);
+      }
     }
   }
-  if (process.platform !== 'win32') fs.chmodSync(filename, 0o600);
   const loader = ensureAgentEnvLoader(options);
-  return Object.freeze({ provider: spec.provider, file: filename, loader, created, source_command: `source ~/.agentsam/load-agent-env.sh ${spec.provider}` });
+  return Object.freeze({
+    provider: spec.provider,
+    file: filename,
+    loader,
+    created,
+    source_command: `source ~/.agentsam/load-agent-env.sh ${spec.provider}`,
+  });
 }
 
-export function providerCredentialSpec(provider) {
-  const id = clean(provider).toLowerCase();
-  const spec = PROVIDER_CREDENTIALS[id];
-  return spec ? Object.freeze({ provider: id, ...spec }) : null;
+export function setProviderCredential(provider, credential, options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const value = validateCredentialValue(spec, credential);
+  const filename = path.join(agentEnvDirectory(options), spec.files[0]);
+  atomicWrite(filename, profileSource(spec.provider, value, options), 0o600);
+  const loader = ensureAgentEnvLoader(options);
+  return Object.freeze({
+    provider: spec.provider,
+    file: filename,
+    loader,
+    source_command: `source ~/.agentsam/load-agent-env.sh ${spec.provider}`,
+  });
+}
+
+export function removeProviderCredential(provider, options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const dir = agentEnvDirectory(options);
+  let removed = false;
+  for (const basename of spec.files) {
+    const filename = path.join(dir, basename);
+    if (!fs.existsSync(filename)) continue;
+    const safety = secureFile(filename);
+    if (!safety.ok) throw new Error(safety.error);
+    fs.rmSync(filename, { force: true });
+    removed = true;
+  }
+  return Object.freeze({ provider: spec.provider, removed });
 }
 
 export function resolveProviderCredential(provider, options = {}) {
   const spec = providerCredentialSpec(provider);
-  if (!spec) return Object.freeze({ provider: clean(provider).toLowerCase(), configured: false, source: null, error: 'unsupported_provider', value: '' });
+  if (!spec) return Object.freeze({ provider: normalizeProviderId(provider), configured: false, source: null, error: 'unsupported_provider', value: '' });
   const env = options.env || process.env;
   const accountIdFromEnv = firstRuntimeValue(env, spec.accountEnv || []);
   const fromEnv = clean(env?.[spec.env]);
-  if (fromEnv) return Object.freeze({ provider: spec.provider, configured: true, source: 'environment', env: spec.env, file: null, error: null, value: fromEnv, account_id: accountIdFromEnv || null });
+  if (fromEnv) {
+    const prefixError = spec.tokenPrefix && !fromEnv.startsWith(spec.tokenPrefix) ? `credential_prefix_required:${spec.tokenPrefix}` : null;
+    return Object.freeze({
+      provider: spec.provider,
+      configured: !prefixError,
+      source: 'environment',
+      env: spec.env,
+      file: null,
+      error: prefixError,
+      value: prefixError ? '' : fromEnv,
+      account_id: accountIdFromEnv || null,
+    });
+  }
 
   const dir = agentEnvDirectory({ ...options, env });
   for (const basename of spec.files) {
@@ -156,19 +269,22 @@ export function resolveProviderCredential(provider, options = {}) {
       const source = fs.readFileSync(filename, 'utf8');
       const value = clean(parseEnvValue(source, spec.env));
       const accountId = accountIdFromEnv || firstEnvValue(source, spec.accountEnv || []);
-      if (value) return Object.freeze({ provider: spec.provider, configured: true, source: 'agentsam_env_file', env: spec.env, file: filename, error: null, value, account_id: accountId || null });
-      return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: 'credential_variable_missing', value: '' });
+      const prefixError = spec.tokenPrefix && value && !value.startsWith(spec.tokenPrefix) ? `credential_prefix_required:${spec.tokenPrefix}` : null;
+      if (value && !prefixError) return Object.freeze({ provider: spec.provider, configured: true, source: 'agentsam_env_file', env: spec.env, file: filename, error: null, value, account_id: accountId || null });
+      return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: prefixError || 'credential_variable_missing', value: '' });
     } catch (error) {
       return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: error?.message || String(error), value: '' });
     }
   }
-  return Object.freeze({ provider: spec.provider, configured: false, source: null, env: spec.env, file: null, error: null, value: '' });
+  return Object.freeze({ provider: spec.provider, configured: false, source: null, env: spec.env, file: null, error: null, value: '', account_id: accountIdFromEnv || null });
 }
 
 export function describeProviderCredential(provider, options = {}) {
   const resolved = resolveProviderCredential(provider, options);
+  const spec = providerCredentialSpec(provider);
   return Object.freeze({
     provider: resolved.provider,
+    label: spec?.label || resolved.provider,
     configured: resolved.configured,
     source: resolved.source,
     env: resolved.env || null,

package/src/lib/slash-commands.js

@@ -11,6 +11,7 @@ export const SLASH_COMMANDS = [
   { cmd: '/context', description: 'Show model context economics; add repo for Git bridge context', lane: 'context' },
   { cmd: '/status', description: 'Local project, DB, Git, and PTY health', lane: 'local' },
   { cmd: '/models', description: 'Probe providers and provider-verified known models', lane: 'model' },
+  { cmd: '/providers', description: 'Configure and verify machine provider credentials', lane: 'model' },
   { cmd: '/login', description: 'Sign in to Inner Animal Media and save the machine-local Agent Sam session', lane: 'identity' },
   { cmd: '/logout', description: 'Sign out locally without deleting provider credentials', lane: 'identity' },
   { cmd: '/whoami', description: 'Show authenticated account identity and safe credential status', lane: 'identity' },

package/src/models/discovery.js

@@ -242,6 +242,40 @@ export async function discoverXaiModels(apiKey, fetchImpl = fetch) {
   } catch (error) { return failure(error); }
 }
 
+
+export async function discoverCursorModels(apiKey, fetchImpl = fetch) {
+  if (!clean(apiKey)) return failure('credential unavailable', false);
+  try {
+    const body = await fetchJson(fetchImpl, 'https://api.cursor.com/v1/models', {
+      headers: { authorization: `Bearer ${clean(apiKey)}` },
+    });
+    const models = (Array.isArray(body?.items) ? body.items : [])
+      .map((row) => {
+        const id = clean(row?.id);
+        if (!id) return null;
+        const params = Array.isArray(row?.parameters) ? row.parameters : [];
+        const reasoning = params.find((param) => /reason|thinking/i.test(clean(param?.id)));
+        const reasoningEfforts = Array.isArray(reasoning?.values)
+          ? reasoning.values.map((entry) => clean(entry?.value)).filter(Boolean)
+          : [];
+        return baseRecord('cursor', id, {
+          label: clean(row?.displayName) || id,
+          reasoning_efforts: reasoningEfforts.length ? reasoningEfforts : ['auto'],
+          source_url: 'https://api.cursor.com/v1/models',
+          capabilities: { cursor_cloud_agent: true, agent_workflow: true },
+          metadata: {
+            description: clean(row?.description) || null,
+            aliases: Array.isArray(row?.aliases) ? row.aliases : [],
+            parameters: params,
+            variants: Array.isArray(row?.variants) ? row.variants : [],
+          },
+        });
+      })
+      .filter(Boolean);
+    return { attempted: true, ok: true, models, error: null };
+  } catch (error) { return failure(error); }
+}
+
 function cloudflareTaskName(task) {
   if (typeof task === 'string') return clean(task);
   if (task && typeof task === 'object') return clean(task.name || task.id);
@@ -286,6 +320,7 @@ export async function discoverProviderModels(provider, credential, options = {})
     case 'gemini': return discoverGeminiModels(credential?.value, fetchImpl);
     case 'grok':
     case 'xai': return discoverXaiModels(credential?.value, fetchImpl);
+    case 'cursor': return discoverCursorModels(credential?.value, fetchImpl);
     case 'cloudflare': return discoverCloudflareModels(credential?.value, credential?.account_id, fetchImpl);
     default: return failure(`unsupported provider: ${provider}`, false);
   }

package/src/ui/cli/help.js

@@ -12,7 +12,8 @@ const HELP_TOPICS = Object.freeze([
       ['agentsam resume [session]', 'Resume a saved Agent Sam session'],
       ['agentsam whoami', 'Show authenticated account and credential status'],
       ['agentsam models', 'Probe account-visible hosted/local models'],
-      ['agentsam env init <provider>', 'Create a secure local provider profile'],
+      ['agentsam providers', 'Configure and verify machine provider credentials'],
+      ['agentsam env init <provider>', 'Low-level provider profile compatibility command'],
     ],
   },
   {
@@ -48,6 +49,7 @@ const HELP_TOPICS = Object.freeze([
     rows: [
       ['/', 'Open the keyboard command picker'],
       ['/model', 'Choose model, reasoning, and processing tier'],
+      ['/providers', 'Configure and verify machine provider credentials'],
       ['/context', 'Show live context economics'],
       ['/usage', 'Show token/cost/session receipt'],
       ['/settings', 'Change runtime, terminal, and model policy'],

package/test/account-session.test.mjs

@@ -3,7 +3,15 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
-import { accountSessionPath, clearAccountSession, readAccountSession, resolveAccountSdkKey, saveAccountSession } from '../src/lib/account-session.js';
+import {
+  accountSessionPath,
+  clearAccountSession,
+  readAccountSession,
+  resolveAccountApiKey,
+  resolveAccountAuth,
+  resolveBrowserSessionCredential,
+  saveAccountSession,
+} from '../src/lib/account-session.js';
 
 function tempHome(t) {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-account-'));
@@ -11,26 +19,55 @@ function tempHome(t) {
   return home;
 }
 
-test('browser-auth SDK bearer persists in machine-local storage, not project state', t => {
+test('opaque browser login persists in machine-local storage and resolves independently from API keys', t => {
   const home = tempHome(t);
-  const saved = saveAccountSession({ access_token: 'sdk_machine_session', user_id: 'au_test', account_id: 'acct_test', email: 'dev@example.test' }, { home });
+  const saved = saveAccountSession({
+    access_token: 'browser_session_machine_test',
+    user_id: 'au_test',
+    account_id: 'acct_test',
+    email: 'dev@example.test',
+  }, { home });
   assert.equal(saved.user_id, 'au_test');
+
   const filename = accountSessionPath({ home });
   assert.equal(fs.existsSync(filename), true);
   if (process.platform !== 'win32') assert.equal(fs.statSync(filename).mode & 0o077, 0);
 
   const loaded = readAccountSession({ home });
-  assert.equal(loaded.sdk_key, 'sdk_machine_session');
-  const resolved = resolveAccountSdkKey({ env: {}, home });
-  assert.equal(resolved.source, 'agentsam_account_session');
-  assert.equal(resolved.value, 'sdk_machine_session');
+  assert.equal(loaded.access_token, 'browser_session_machine_test');
+  const browser = resolveBrowserSessionCredential({ env: {}, home });
+  assert.equal(browser.source, 'agentsam_browser_oauth');
+  assert.equal(browser.kind, 'browser_oauth');
+  assert.equal(browser.value, 'browser_session_machine_test');
+  assert.equal(resolveAccountApiKey({ env: {}, home }).value, '');
+  assert.equal(resolveAccountAuth({ env: {}, home }).value, 'browser_session_machine_test');
+
   assert.equal(clearAccountSession({ home }), true);
   assert.equal(readAccountSession({ home }), null);
 });
 
-test('explicit/environment SDK bearer remains higher authority than local session fallback', t => {
+test('explicit/environment aak_ API key outranks browser login while legacy SDK env names are ignored', t => {
+  const home = tempHome(t);
+  saveAccountSession({ access_token: 'browser_session_disk' }, { home });
+
+  assert.equal(
+    resolveAccountAuth({ env: { AGENTSAM_API_KEY: 'aak_env_test' }, home }).value,
+    'aak_env_test',
+  );
+  assert.equal(
+    resolveAccountAuth({ env: { AGENTSAM_API_KEY: 'aak_env_test' }, explicit: 'aak_explicit_test', home }).value,
+    'aak_explicit_test',
+  );
+  assert.equal(
+    resolveAccountAuth({ env: { AGENTSAM_SDK_KEY: 'legacy_ignored' }, home }).value,
+    'browser_session_disk',
+  );
+});
+
+test('browser session storage refuses reusable aak_ credentials', t => {
   const home = tempHome(t);
-  saveAccountSession({ access_token: 'sdk_disk' }, { home });
-  assert.equal(resolveAccountSdkKey({ env: { AGENTSAM_SDK_KEY: 'sdk_env' }, home }).value, 'sdk_env');
-  assert.equal(resolveAccountSdkKey({ env: { AGENTSAM_SDK_KEY: 'sdk_env' }, explicit: 'sdk_explicit', home }).value, 'sdk_explicit');
+  assert.throws(
+    () => saveAccountSession({ access_token: 'aak_should_not_be_browser_session' }, { home }),
+    /account_browser_oauth_session_required/,
+  );
 });

package/test/apps-scaffold-contract.test.mjs

@@ -13,6 +13,10 @@ function packageJson(...parts) {
   return JSON.parse(fs.readFileSync(at(...parts, 'package.json'), 'utf8'));
 }
 
+function read(...parts) {
+  return fs.readFileSync(at(...parts), 'utf8');
+}
+
 test('product apps are self-contained npm workspace roots with one lockfile', () => {
   for (const app of productApps) {
     const base = ['apps', app];
@@ -54,3 +58,42 @@ test('Local Studio retired donor-era duplicate deployment configs', () => {
     assert.equal(exists('apps', 'local-studio', 'backend', file), false, `retire ${file}`);
   }
 });
+
+test('CAD creator app package is curated for third-party installation', () => {
+  const pkg = packageJson('apps', 'cad-creator');
+  const manifest = JSON.parse(read('apps', 'cad-creator', 'agentsam.app.json'));
+
+  assert.equal(pkg.name, '@inneranimalmedia/agentsam-sdk-cad-creator');
+  assert.notEqual(pkg.private, true);
+  assert.equal(pkg.bin['agentsam-cad-creator'], 'bin/agentsam-cad-creator.mjs');
+  assert.equal(pkg.publishConfig.access, 'public');
+  assert.ok(pkg.files.includes('frontend/dist/'));
+  assert.ok(pkg.files.includes('backend/dist/'));
+  assert.ok(pkg.files.includes('backend/worker/'));
+  assert.equal(pkg.files.some((entry) => entry.startsWith('reference')), false);
+  assert.equal(pkg.files.some((entry) => entry.includes('.wrangler/state')), false);
+
+  assert.equal(manifest.schema, 'agentsam.app.v1');
+  assert.equal(manifest.id, 'cad-creator');
+  assert.equal(manifest.package, pkg.name);
+  assert.equal(manifest.runtime.local_preview, 'ready');
+  assert.equal(manifest.runtime.source_scaffold, 'ready');
+  assert.equal(manifest.runtime.cloudflare, 'scaffold');
+});
+
+test('CAD creator keeps the robotics runtime lazy and the perception key server-side', () => {
+  const app = read('apps', 'cad-creator', 'frontend', 'src', 'App.tsx');
+  const lazy = read('apps', 'cad-creator', 'frontend', 'src', 'workspaces', 'robotics', 'lazy.tsx');
+  const httpProvider = read('apps', 'cad-creator', 'frontend', 'src', 'lib', 'robotics', 'perception', 'http-provider.ts');
+  const perception = read('apps', 'cad-creator', 'backend', 'src', 'robotics', 'perception.ts');
+  const worker = read('apps', 'cad-creator', 'backend', 'worker', 'index.js');
+
+  assert.doesNotMatch(app, /from ['\"]\.\/workspaces\/robotics\/RoboticsWorkspace['\"]/);
+  assert.doesNotMatch(app, /MujocoSimulationProvider/);
+  assert.match(app, /LazyRoboticsWorkspace/);
+  assert.match(lazy, /import\(['\"]\.\/RoboticsWorkspace['\"]\)/);
+  assert.match(httpProvider, /\/api\/robotics\/perception\/detect/);
+  assert.doesNotMatch(httpProvider, /GEMINI_API_KEY|GOOGLE_API_KEY/);
+  assert.match(perception, /env\.GEMINI_API_KEY/);
+  assert.match(worker, /\/api\/robotics\/perception\/detect/);
+});

package/test/sdk-worker-contract.test.mjs

@@ -35,9 +35,13 @@ test('agentsam-sdk Worker uses the backend Worker entry, custom domain only, and
   assert.match(wrangler, /"service"\s*:\s*"execos"/);
   assert.match(wrangler, /"binding"\s*:\s*"PTY_SERVICE"/);
   assert.match(wrangler, /"service_id"\s*:\s*"019db639-7c70-7071-8ef3-32ec0392a9ff"/);
-  assert.match(wrangler, /"IAM_ORIGIN"\s*:\s*"https:\/\/inneranimalmedia\.com"/);
+  assert.match(wrangler, /"IAM_OAUTH_ISSUER"\s*:\s*"https:\/\/inneranimalmedia\.com"/);
+  assert.match(wrangler, /"IAM_CLIENT_ID"\s*:\s*"iam_agentsam_sdk_web"/);
+  assert.doesNotMatch(wrangler, /"IAM_ORIGIN"\s*:/);
   assert.doesNotMatch(wrangler, /AGENTSAM_WORKER_ROLE/);
   assert.doesNotMatch(wrangler, /"OLLAMA_BASE_URL"\s*:/);
+  assert.doesNotMatch(wrangler, /"OLLAMA_MODEL"\s*:/);
+  assert.doesNotMatch(wrangler, /"OLLAMA_EMBED_MODEL"\s*:/);
   assert.doesNotMatch(wrangler, /workers\.dev/);
 });
 

package/test/smoke.mjs

@@ -56,6 +56,7 @@ assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/deploy'));
 assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/db'));
 assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/agent'));
 assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/model'));
+assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/providers'));
 assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/reasoning'));
 assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/fast'));
 assert.deepEqual(
@@ -65,7 +66,7 @@ assert.deepEqual(
 );
 
 printContextSummary({
-  iam: { ready: true, source: 'sdk-key', detail: 'AGENTSAM_SDK_KEY' },
+  iam: { ready: true, source: 'api_key', detail: 'AGENTSAM_API_KEY' },
   gcp: { source: 'vm-metadata', email: 'execos@project.iam.gserviceaccount.com' },
   gcp_vm: true,
   github: { source: 'gh-cli', account: 'user@example.com' },

package/test/whoami-resume.test.mjs

@@ -14,9 +14,9 @@ function tempHome(t) {
   return home;
 }
 
-test('whoami validates persisted IAM identity while never returning the SDK or provider secret', async t => {
+test('whoami validates persisted IAM browser identity while never returning account or provider secrets', async t => {
   const home = tempHome(t);
-  saveAccountSession({ access_token: 'sdk_do_not_print', user_id: 'au_local' }, { home });
+  saveAccountSession({ access_token: 'browser_session_do_not_print', user_id: 'au_local' }, { home });
   const envDir = path.join(home, '.agentsam', 'env.d');
   fs.mkdirSync(envDir, { recursive: true });
   const openaiFile = path.join(envDir, 'openai.env');
@@ -26,16 +26,17 @@ test('whoami validates persisted IAM identity while never returning the SDK or p
   const status = await collectWhoami({
     env: {}, home,
     contextLoader: async token => {
-      assert.equal(token, 'sdk_do_not_print');
+      assert.equal(token, 'browser_session_do_not_print');
       return { user_id: 'au_server', account_id: 'acct_server', email: 'dev@example.test', cloudflare: { ok: true }, byok: { openai: { configured: true, masked: 'secret' } } };
     },
   });
   assert.equal(status.authenticated, true);
   assert.equal(status.identity.account_id, 'acct_server');
-  assert.equal(status.sdk_credential.source, 'agentsam_account_session');
+  assert.equal(status.active_auth.source, 'agentsam_browser_oauth');
+  assert.equal(status.active_auth.kind, 'browser_oauth');
   assert.equal(status.provider_credentials.find(row => row.provider === 'openai').configured, true);
   const serialized = JSON.stringify(status);
-  assert.doesNotMatch(serialized, /sdk_do_not_print|sk-never-print-this|masked/);
+  assert.doesNotMatch(serialized, /browser_session_do_not_print|sk-never-print-this|masked/);
 });
 
 test('resume restores saved cwd and session through the canonical shell runtime', async t => {

package/src/lib/prompt-byok.js

@@ -1,57 +0,0 @@
-/**
- * Optional BYOK key paste during SDK init → CORE user_api_keys.
- */
-import { getJson, postJson } from './core-client.js';
-
-const PROVIDERS = [
-  { id: 'openai', label: 'OpenAI' },
-  { id: 'anthropic', label: 'Anthropic' },
-];
-
-/**
- * @param {string} token SDK bearer
- * @param {{ ask: (q: string) => Promise<string> } | null} prompt
- */
-export async function promptOptionalByokKeys(token, prompt) {
-  if (!token || !prompt) return;
-
-  let ctx;
-  try {
-    ctx = await getJson('/api/sdk/context', token);
-  } catch {
-    console.log('\n  ⚠ Could not load BYOK status — skip key paste or add keys in Dashboard → Settings → Keys\n');
-    return;
-  }
-
-  const byok = ctx?.byok || {};
-  console.log('\n  Provider keys (BYOK — optional, stored in YOUR IAM account):\n');
-
-  for (const p of PROVIDERS) {
-    const slot = byok[p.id];
-    if (slot?.configured) {
-      console.log(`    ${p.label.padEnd(12)} ✓ connected ${slot.masked || ''}`);
-      continue;
-    }
-
-    const ans = await prompt.ask(`    ${p.label} API key (Enter to skip): `);
-    const key = ans.trim();
-    if (!key) continue;
-
-    try {
-      await postJson(
-        '/api/sdk/keys',
-        {
-          provider: p.id,
-          api_key: key,
-          label: `${p.label} (SDK init)`,
-          validate: true,
-        },
-        token,
-      );
-      console.log(`    ${p.label.padEnd(12)} ✓ saved to IAM BYOK`);
-    } catch (e) {
-      console.log(`    ${p.label.padEnd(12)} ✗ ${e?.message || 'save failed'}`);
-    }
-  }
-  console.log('');
-}