@inneranimalmedia/agentsam-sdk 2.6.1 → 2.6.3

package/src/lib/auth.js

@@ -1,71 +1,338 @@
 /**
- * Browser OAuth for SDK init — one click IAM login + Cloudflare connect.
+ * RFC 8252 native-app OAuth for AgentSam CLI.
+ *
+ * The CLI is a public client: authorization code + PKCE over a loopback
+ * redirect. Browser OAuth sessions are machine-local and remain separate from
+ * reusable AGENTSAM_API_KEY (aak_*) credentials.
  */
 import http from 'node:http';
-import { randomBytes } from 'node:crypto';
-import { postJson } from './core-client.js';
+import { createHash, randomBytes } from 'node:crypto';
+import { resolveIamIssuer } from '../../packages/identity/src/contracts/auth-config.js';
 import { promptToOpenUrl } from './open-url.js';
-import { saveAccountSession } from './account-session.js';
+import {
+  isBrowserSessionExpired,
+  readAccountSession,
+  resolveAccountApiKey,
+  saveAccountSession,
+} from './account-session.js';
 
-function randomState() {
-  return randomBytes(16).toString('hex');
+export const AGENTSAM_NATIVE_OAUTH_CLIENT_ID = 'iam_cli_agentsam';
+export const AGENTSAM_NATIVE_OAUTH_SCOPE = 'openid profile email offline_access';
+export const AGENTSAM_OAUTH_CALLBACK_PATH = '/callback';
+
+function clean(value) { return value == null ? '' : String(value).trim(); }
+function base64url(value) {
+  return Buffer.from(value).toString('base64')
+    .replace(/=/g, '')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_');
+}
+function randomUrlSafe(bytes = 32, randomBytesImpl = randomBytes) {
+  return base64url(randomBytesImpl(bytes));
+}
+function oauthErrorMessage(body, status) {
+  const code = clean(body?.error);
+  const description = clean(body?.error_description || body?.message);
+  if (code && description) return `${code}: ${description}`;
+  return code || description || `OAuth token HTTP ${status}`;
+}
+
+export function createPkcePair(options = {}) {
+  const verifier = randomUrlSafe(32, options.randomBytesImpl || randomBytes);
+  const challenge = base64url(createHash('sha256').update(verifier, 'ascii').digest());
+  return Object.freeze({ verifier, challenge, method: 'S256' });
+}
+
+export function buildNativeAuthorizationUrl(options = {}) {
+  const env = options.env || process.env;
+  const issuer = resolveIamIssuer(env, options.issuer || '');
+  const clientId = clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const redirectUri = clean(options.redirectUri);
+  const state = clean(options.state);
+  const codeChallenge = clean(options.codeChallenge);
+  const scope = clean(options.scope ?? AGENTSAM_NATIVE_OAUTH_SCOPE);
+  if (!redirectUri || !state || !codeChallenge) throw new Error('oauth_authorization_parameters_required');
+
+  const url = new URL('/api/oauth/authorize', `${issuer}/`);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('client_id', clientId);
+  url.searchParams.set('redirect_uri', redirectUri);
+  url.searchParams.set('code_challenge', codeChallenge);
+  url.searchParams.set('code_challenge_method', 'S256');
+  url.searchParams.set('state', state);
+  if (scope) url.searchParams.set('scope', scope);
+  return url.toString();
+}
+
+async function oauthTokenRequest(params, options = {}) {
+  const env = options.env || process.env;
+  const issuer = resolveIamIssuer(env, options.issuer || '');
+  const fetchImpl = options.fetchImpl || fetch;
+  const body = new URLSearchParams();
+  for (const [key, value] of Object.entries(params || {})) {
+    const normalized = clean(value);
+    if (normalized) body.set(key, normalized);
+  }
+
+  const response = await fetchImpl(new URL('/api/oauth/token', `${issuer}/`).toString(), {
+    method: 'POST',
+    headers: {
+      Accept: 'application/json',
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+    body: body.toString(),
+    signal: options.signal || (typeof AbortSignal?.timeout === 'function' ? AbortSignal.timeout(15_000) : undefined),
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const error = new Error(oauthErrorMessage(data, response.status));
+    error.status = response.status;
+    error.oauth_error = clean(data?.error) || null;
+    throw error;
+  }
+  if (!clean(data?.access_token)) throw new Error('oauth_token_response_missing_access_token');
+  return data;
+}
+
+export async function exchangeAuthorizationCode(options = {}) {
+  const code = clean(options.code);
+  const codeVerifier = clean(options.codeVerifier);
+  const redirectUri = clean(options.redirectUri);
+  if (!code || !codeVerifier || !redirectUri) throw new Error('oauth_authorization_code_exchange_parameters_required');
+  return oauthTokenRequest({
+    grant_type: 'authorization_code',
+    client_id: clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID,
+    redirect_uri: redirectUri,
+    code,
+    code_verifier: codeVerifier,
+  }, options);
+}
+
+export async function refreshAccountSession(options = {}) {
+  const session = options.session || readAccountSession(options);
+  if (!session?.refresh_token) throw new Error('browser_oauth_refresh_unavailable');
+  const clientId = clean(session.client_id) || clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const refreshed = await oauthTokenRequest({
+    grant_type: 'refresh_token',
+    client_id: clientId,
+    refresh_token: session.refresh_token,
+  }, options);
+
+  return saveAccountSession({
+    ...refreshed,
+    refresh_token: clean(refreshed.refresh_token) || session.refresh_token,
+    client_id: clientId,
+    user_id: session.user_id,
+    account_id: session.account_id,
+    email: session.email,
+  }, {
+    ...options,
+    preserveRefreshToken: true,
+  });
 }
 
 /**
- * @returns {Promise<{ access_token: string, user_id: string, workspace_id: string, tenant_id: string }>}
+ * Canonical SDK account authority resolution.
+ * explicit aak_* -> AGENTSAM_API_KEY -> stored browser OAuth -> OAuth refresh.
  */
-export async function authenticateViaBrowser() {
-  const state = randomState();
-  const port = 8791 + (randomBytes(1)[0] % 20);
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
+export async function resolveAccountAuthority(options = {}) {
+  const apiKey = resolveAccountApiKey(options);
+  if (apiKey.value) return apiKey;
+  if (clean(options.explicit) && apiKey.error) return apiKey;
 
-  const { auth_url: authUrl } = await postJson('/api/sdk/auth/start', {
-    redirect_uri: redirectUri,
-    state,
+  let session = readAccountSession(options);
+  if (!session?.access_token) {
+    return apiKey.error ? apiKey : { value: '', source: null, kind: null, session: null };
+  }
+
+  if (options.forceRefresh === true || isBrowserSessionExpired(session, options)) {
+    if (!session.refresh_token) {
+      return {
+        value: '',
+        source: 'agentsam_browser_oauth',
+        kind: 'browser_oauth',
+        session,
+        error: 'browser_oauth_session_expired',
+      };
+    }
+    try {
+      const refreshImpl = options.refreshImpl || refreshAccountSession;
+      session = await refreshImpl({ ...options, session });
+    } catch (error) {
+      return {
+        value: '',
+        source: 'agentsam_browser_oauth',
+        kind: 'browser_oauth',
+        session,
+        error: `browser_oauth_refresh_failed: ${error?.message || String(error)}`,
+      };
+    }
+  }
+
+  return {
+    value: session.access_token,
+    source: 'agentsam_browser_oauth',
+    kind: 'browser_oauth',
+    session,
+    fallback_error: apiKey.error || null,
+  };
+}
+
+export async function createLoopbackCallbackListener(options = {}) {
+  const host = clean(options.host) || '127.0.0.1';
+  const callbackPath = clean(options.callbackPath) || AGENTSAM_OAUTH_CALLBACK_PATH;
+  const expectedState = clean(options.state);
+  if (!expectedState) throw new Error('oauth_state_required');
+  const timeoutMs = Number.isFinite(Number(options.timeoutMs)) ? Number(options.timeoutMs) : 180_000;
+  const createServerImpl = options.createServerImpl || http.createServer;
+
+  let settle;
+  let settled = false;
+  let timer = null;
+  const callbackPromise = new Promise((resolve, reject) => {
+    settle = (error, result) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      if (error) reject(error);
+      else resolve(result);
+    };
   });
 
-  if (!authUrl) throw new Error('IAM auth did not return an authorization URL');
+  const server = createServerImpl((req, res) => {
+    try {
+      const requestUrl = new URL(req.url || '/', `http://${host}`);
+      if (requestUrl.pathname !== callbackPath) {
+        res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Not found');
+        return;
+      }
 
-  const codePromise = new Promise((resolve, reject) => {
-    const server = http.createServer((req, res) => {
-      try {
-        const u = new URL(req.url || '/', `http://127.0.0.1:${port}`);
-        if (u.pathname !== '/callback') {
-          res.writeHead(404);
-          res.end('Not found');
-          return;
-        }
-        const code = u.searchParams.get('code');
-        const gotState = u.searchParams.get('state');
-        if (!code || gotState !== state) {
-          res.writeHead(400);
-          res.end('Invalid callback');
-          reject(new Error('auth callback invalid'));
-          server.close();
-          return;
-        }
-        res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end('<html><body style="font-family:system-ui"><h1>Agent Sam</h1><p>Authentication complete. You can close this tab and return to your terminal.</p></body></html>');
-        resolve(code);
-        server.close();
-      } catch (e) {
-        reject(e);
-        server.close();
+      const returnedState = clean(requestUrl.searchParams.get('state'));
+      const oauthError = clean(requestUrl.searchParams.get('error'));
+      const oauthDescription = clean(requestUrl.searchParams.get('error_description'));
+      const code = clean(requestUrl.searchParams.get('code'));
+
+      if (!returnedState || returnedState !== expectedState) {
+        res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Invalid OAuth state. Return to the terminal and retry.');
+        settle(new Error('oauth_state_mismatch'));
+        return;
       }
-    });
-    server.on('error', reject);
-    server.listen(port, '127.0.0.1');
+      if (oauthError) {
+        res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Authorization was not completed. Return to the terminal.');
+        settle(new Error(oauthDescription ? `${oauthError}: ${oauthDescription}` : oauthError));
+        return;
+      }
+      if (!code) {
+        res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Authorization code missing. Return to the terminal and retry.');
+        settle(new Error('oauth_authorization_code_missing'));
+        return;
+      }
+
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end('<!doctype html><html><body style="font-family:system-ui"><h1>Agent Sam</h1><p>Authentication complete. You can close this tab and return to your terminal.</p></body></html>');
+      settle(null, { code, state: returnedState });
+    } catch (error) {
+      try {
+        res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('OAuth callback failed. Return to the terminal.');
+      } catch { /* response may already be closed */ }
+      settle(error);
+    }
+  });
+
+  await new Promise((resolve, reject) => {
+    const onError = (error) => {
+      server.off('listening', onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.off('error', onError);
+      resolve();
+    };
+    server.once('error', onError);
+    server.once('listening', onListening);
+    server.listen({ host, port: Number(options.port) || 0, exclusive: true });
   });
 
-  await promptToOpenUrl(authUrl, {
-    heading: 'Authenticate your InnerAnimalMedia account at:',
-    prompt: 'Press ENTER to open InnerAnimalMedia sign-in in your browser.',
+  const address = server.address();
+  if (!address || typeof address === 'string') {
+    server.close();
+    throw new Error('oauth_loopback_listener_address_unavailable');
+  }
+  const redirectUri = `http://${host}:${address.port}${callbackPath}`;
+  timer = setTimeout(() => settle(new Error('oauth_callback_timeout')), Math.max(1, timeoutMs));
+  timer.unref?.();
+
+  return {
+    redirectUri,
+    waitForCallback: () => callbackPromise,
+    close: () => new Promise((resolve) => {
+      if (!server.listening) return resolve();
+      server.close(() => resolve());
+    }),
+  };
+}
+
+export async function authenticateViaBrowser(options = {}) {
+  const env = options.env || process.env;
+  const clientId = clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const state = randomUrlSafe(24, options.randomBytesImpl || randomBytes);
+  const pkce = createPkcePair({ randomBytesImpl: options.randomBytesImpl });
+  const listener = await createLoopbackCallbackListener({
+    state,
+    host: options.host,
+    port: options.port,
+    callbackPath: options.callbackPath,
+    timeoutMs: options.timeoutMs,
+    createServerImpl: options.createServerImpl,
   });
 
-  const code = await codePromise;
-  const session = await postJson('/api/sdk/auth/exchange', { code, state });
-  if (String(session?.access_token || '').trim().startsWith('sdk_')) {
-    saveAccountSession(session);
+  try {
+    const authorizationUrl = buildNativeAuthorizationUrl({
+      env,
+      issuer: options.issuer,
+      clientId,
+      redirectUri: listener.redirectUri,
+      state,
+      codeChallenge: pkce.challenge,
+      scope: options.scope,
+    });
+
+    const promptImpl = options.promptToOpenUrlImpl || promptToOpenUrl;
+    await promptImpl(authorizationUrl, {
+      heading: 'Authenticate your InnerAnimalMedia account at:',
+      prompt: 'Press ENTER to open InnerAnimalMedia sign-in in your browser.',
+      input: options.input,
+      output: options.output,
+      openImpl: options.openImpl,
+    });
+
+    const callback = await listener.waitForCallback();
+    const tokenSet = await exchangeAuthorizationCode({
+      env,
+      issuer: options.issuer,
+      clientId,
+      redirectUri: listener.redirectUri,
+      code: callback.code,
+      codeVerifier: pkce.verifier,
+      fetchImpl: options.fetchImpl,
+      signal: options.signal,
+    });
+
+    return saveAccountSession({
+      ...tokenSet,
+      client_id: clientId,
+    }, {
+      home: options.home,
+      env,
+      nowMs: options.nowMs,
+      preserveRefreshToken: false,
+    });
+  } finally {
+    await listener.close();
   }
-  return session;
 }

package/src/lib/cad/blender.js

@@ -4,9 +4,11 @@ import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { runProcess } from '../../security/process.js';
+import { probeDockerServiceHealth, executeBlenderDocker } from './docker-executor.js';
 
 const sdkRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../..');
-export const BLENDER_ADAPTER_PATH = path.join(sdkRoot, 'services/cad/blender/adapter.py');
+const packagedAdapter = path.join(path.dirname(fileURLToPath(import.meta.url)), 'cad/blender/adapter.py');
+export const BLENDER_ADAPTER_PATH = fs.existsSync(packagedAdapter) ? packagedAdapter : path.join(sdkRoot, 'services/cad/blender/adapter.py');
 export const BLENDER_RESULT_PREFIX = 'AGENTSAM_RESULT=';
 export const BLENDER_EXPORT_FORMATS = Object.freeze(['glb', 'stl', 'obj']);
 export const BLENDER_RECIPE_OPS = Object.freeze([
@@ -172,9 +174,46 @@ async function invokeBlender({
   runProcessImpl = runProcess,
 }) {
   const binary = discoverBlender({ blenderBin });
-  if (!binary) throw new Error('Blender is not installed or could not be discovered; use --blender-bin or AGENTSAM_BLENDER_BIN');
-  if (!fs.existsSync(BLENDER_ADAPTER_PATH)) throw new Error(`Bundled Blender adapter is missing: ${BLENDER_ADAPTER_PATH}`);
   const timeout = boundedInteger(timeoutSeconds, 120, 1, 600, 'timeout');
+
+  if (!binary || !fs.existsSync(BLENDER_ADAPTER_PATH)) {
+    try {
+      const dockerHealth = await probeDockerServiceHealth();
+      if (dockerHealth.available && dockerHealth.tools?.blender?.installed) {
+        // Forward the full operation request (recipe/scene/camera/width/height/
+        // format/objects/collection/apply_modifiers as applicable) — the
+        // docker service has no access to `request.output`'s local path, so
+        // strip it and let the container pick its own temp output path.
+        const { output: _localOutput, ...requestRest } = request || {};
+        const inputBase64 = input && fs.existsSync(input) ? fs.readFileSync(input).toString('base64') : null;
+
+        const dockerRes = await executeBlenderDocker({
+          operation,
+          request: requestRest,
+          inputBase64,
+          format: requestRest.format
+            || (operation === 'build' ? 'blend' : operation === 'render_preview' ? 'png' : 'glb'),
+          filename: request.output ? path.basename(request.output) : undefined,
+          timeoutMs: timeout * 1000,
+        });
+
+        if (request.output && dockerRes.artifactBase64) {
+          const outputPath = path.resolve(cwd, request.output);
+          fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+          fs.writeFileSync(outputPath, Buffer.from(dockerRes.artifactBase64, 'base64'));
+        }
+
+        return {
+          result: dockerRes.result || { ok: true, blender_version: dockerHealth.tools.blender.version },
+          binary: `docker://${dockerHealth.service || 'agentsam-cad'}/blender`,
+          duration_ms: dockerRes.durationMs,
+          execution_lane: 'docker_service',
+        };
+      }
+    } catch {}
+
+    throw new Error('Blender is not installed or could not be discovered; use --blender-bin, AGENTSAM_BLENDER_BIN, or launch AgentSam CAD Docker service');
+  }
   const requestDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-blender-'));
   const requestPath = path.join(requestDir, 'request.json');
   fs.writeFileSync(requestPath, JSON.stringify({ schema_version: 1, ...request }, null, 2), { mode: 0o600 });

package/src/lib/cad/d1-project-store.js

@@ -0,0 +1,43 @@
+import {randomUUID} from 'node:crypto';
+import {requireValidProject} from './project-contract.js';
+import {projectHash} from './project-store.js';
+// Reuses blueprint documents + immutable R2 scene snapshots. No new tables.
+// scope is supplied by the authenticated host, never by tool arguments.
+export class D1ProjectStore {
+ constructor({db,objects,bucket,scope}) {
+  if(!scope?.account_id||!scope?.workspace_id||!scope?.tenant_id||!bucket)throw new Error('authenticated_design_scope_required');
+  this.db=db;this.objects=objects;this.bucket=bucket;this.scope=scope;
+ }
+ async read(id,revision){
+  const s=this.scope;
+  const row=await this.db.prepare("SELECT * FROM designstudio_design_blueprints WHERE id=? AND tenant_id=? AND workspace_id=? AND json_extract(intent_json,'$.account_id')=?").bind(id,s.tenant_id,s.workspace_id,s.account_id).first();
+  if(!row)throw new Error('project_not_found');
+  const current=JSON.parse(row.generation_config_json||'{}').project_revision;
+  if(revision==null||revision===current){const p=JSON.parse(row.sketch_json);return {project:p,revision:current,content_hash:projectHash(p)};}
+  const snapshot=await this.db.prepare("SELECT r2_key FROM scene_snapshots WHERE project_id=? AND user_id=? AND workspace_id=? AND tenant_id=? AND version=? AND project_type='CAD_PROJECT'").bind(id,s.account_id,s.workspace_id,s.tenant_id,revision).first();
+  if(!snapshot)throw new Error('revision_not_found');
+  const object=await this.objects.get(snapshot.r2_key);if(!object)throw new Error('revision_object_missing');
+  const saved=JSON.parse(await object.text());requireValidProject(saved.project);if(saved.content_hash!==projectHash(saved.project))throw new Error('revision_digest_mismatch');return saved;
+ }
+ async save(project,expectedRevision,message='Saved project'){
+  requireValidProject(project);
+  if(!Number.isSafeInteger(expectedRevision)||expectedRevision<0)throw new Error('expected_revision_required');
+  const s=this.scope,revision=expectedRevision+1,now=Math.floor(Date.now()/1000),id='scene_'+randomUUID().replaceAll('-','');
+  const p={...structuredClone(project),version:revision,updatedAt:Date.now()};
+  const saved={project:p,revision,content_hash:projectHash(p),message,created_at:now};
+  const key='design-projects/'+encodeURIComponent(s.account_id)+'/'+encodeURIComponent(p.id)+'/'+revision+'/'+saved.content_hash+'.json';
+  await this.objects.put(key,JSON.stringify(saved),{httpMetadata:{contentType:'application/json'}});
+  const statements=[];
+  if(expectedRevision===0){
+   statements.push(this.db.prepare("INSERT INTO designstudio_design_blueprints (id,tenant_id,workspace_id,title,intent_json,sketch_json,generation_config_json,status) VALUES (?,?,?,?,?,?,?,'structured')").bind(p.id,s.tenant_id,s.workspace_id,p.name,JSON.stringify({account_id:s.account_id,contract:'cad.project.v1'}),JSON.stringify(p),JSON.stringify({project_revision:revision,content_hash:saved.content_hash})));
+  }else{
+   statements.push(this.db.prepare("UPDATE designstudio_design_blueprints SET title=?,sketch_json=?,generation_config_json=json_set(generation_config_json,'$.project_revision',?,'$.content_hash',?),updated_at=datetime('now') WHERE id=? AND tenant_id=? AND workspace_id=? AND json_extract(intent_json,'$.account_id')=? AND json_extract(generation_config_json,'$.project_revision')=?").bind(p.name,JSON.stringify(p),revision,saved.content_hash,p.id,s.tenant_id,s.workspace_id,s.account_id,expectedRevision));
+  }
+  // D1 batch is transactional; changes() guards the snapshot against a failed CAS.
+  statements.push(this.db.prepare("INSERT INTO scene_snapshots (id,workspace_id,user_id,tenant_id,name,project_type,entity_count,r2_key,r2_bucket,project_id,version,description,created_at,updated_at) SELECT ?,?,?,?,?,'CAD_PROJECT',?,?,?,?,?,?,?,? WHERE changes()=1").bind(id,s.workspace_id,s.account_id,s.tenant_id,p.name,p.walls.length+p.rooms.length+p.doors.length+p.windows.length,key,this.bucket,p.id,revision,message,now,now));
+  let results;try{results=await this.db.batch(statements);}catch(e){throw new Error('project_save_failed:'+e.message);}
+  if(results[0]?.meta?.changes!==1)throw new Error('revision_conflict');
+  return saved;
+ }
+ async restore(id,revision,expectedRevision){const row=await this.read(id,revision);return this.save(row.project,expectedRevision,'Restored revision '+revision);}
+}