@inneranimalmedia/agentsam-sdk 2.6.1 → 2.6.3

package/src/lib/local-status.js

@@ -1,29 +1,37 @@
-import fs from 'node:fs';
 import path from 'node:path';
 import { tryResolveGitContext } from '../../packages/agentsam-repository/src/git-context.js';
 import { inspectLocalSqlite } from '../local/sqlite.js';
-import { getCreatedWithVersion, getDefaultProfile, getDeployTarget, getLocalDatabasePath, getProjectName, getProjectPreset, getRepositoryId, tryReadProjectConfig } from './project-config.js';
+import {
+  getCreatedWithVersion,
+  getDefaultProfile,
+  getDeployTarget,
+  getLocalDatabasePath,
+  getProjectName,
+  getProjectPreset,
+  getRepositoryId,
+  tryReadProjectConfig,
+} from './project-config.js';
+import { findCliProjectRoot } from './cli-preferences.js';
 
 export function findAgentSamProjectRoot(startDir = process.cwd()) {
-  let dir = path.resolve(startDir);
-  for (let i = 0; i < 16; i += 1) {
-    if (fs.existsSync(path.join(dir, '.agentsam', 'config.json'))) return dir;
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return path.resolve(startDir);
+  return findCliProjectRoot(startDir);
 }
 
 async function probe(url) {
   try {
-    const response = await fetch(url, { signal: AbortSignal.timeout(500) });
+    const response = await fetch(url, { signal: AbortSignal.timeout(1500) });
     return { online: response.ok, status: response.status, url };
   } catch {
     return { online: false, status: null, url };
   }
 }
 
+function resolveLiveHealthUrl(config) {
+  const fromDeploy = config?.deployment?.cloudflare?.health_url;
+  if (fromDeploy != null && String(fromDeploy).trim()) return String(fromDeploy).trim();
+  return null;
+}
+
 export async function collectLocalStatus(cwd = process.cwd()) {
   const root = findAgentSamProjectRoot(cwd);
   const config = tryReadProjectConfig(root);
@@ -36,10 +44,16 @@ export async function collectLocalStatus(cwd = process.cwd()) {
 
   const devPort = config?.dev_port ?? 8787;
   const ptyPort = config?.pty_port ?? 3099;
-  const [api, pty] = await Promise.all([
+  const liveUrl = resolveLiveHealthUrl(config);
+  const probes = [
     probe(`http://127.0.0.1:${devPort}/api/health`),
     probe(`http://127.0.0.1:${ptyPort}/health`),
-  ]);
+  ];
+  if (liveUrl) probes.push(probe(liveUrl));
+  const results = await Promise.all(probes);
+  const api = results[0];
+  const pty = results[1];
+  const live = liveUrl ? results[2] : null;
 
   return {
     schemaVersion: 'agentsam-local-status-v1',
@@ -60,12 +74,19 @@ export async function collectLocalStatus(cwd = process.cwd()) {
         }
       : null,
     db: {
-      ready: Boolean(db.exists),
+      ready: Boolean(
+        db.exists &&
+          db.tables?.includes('agentsam_schema_migrations') &&
+          db.tables?.includes('agentsam_project_sessions'),
+      ),
       path: db.dbPath || path.join(root, '.agentsam/data/agentsam.sqlite'),
       tables: db.tables || [],
       sizeBytes: db.sizeBytes || 0,
     },
     api,
     pty,
+    live: liveUrl
+      ? live || { online: false, status: null, url: liveUrl }
+      : { online: false, status: null, url: null },
   };
 }

package/src/lib/project-config.js

@@ -76,6 +76,9 @@ export function createProjectManifest({
     knowledge: {
       config: '.agentsam/knowledge.json',
     },
+    // Project-owned plugin/resource declarations. Bindings, indexes, models,
+    // and dimensions belong here rather than in a global SDK default.
+    plugins: {},
     local: {
       database: '.agentsam/data/agentsam.sqlite',
       schema: 'db/schema.sql',
@@ -151,6 +154,12 @@ export function getKnowledgeConfigPath(config) {
   return clean(config?.knowledge?.config) || '.agentsam/knowledge.json';
 }
 
+export function getProjectPluginConfig(config, pluginKey) {
+  const key = clean(pluginKey).replace(/^@/, '');
+  const plugins = config?.plugins || config?.integrations || {};
+  return plugins[key] || plugins[`@${key}`] || null;
+}
+
 export function getLocalDatabasePath(config) {
   return clean(config?.local?.database || config?.db_path) || '.agentsam/data/agentsam.sqlite';
 }

package/src/lib/provider-credentials.js

@@ -1,16 +1,50 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import {
+  getSecureProviderKey,
+  setSecureProviderKey,
+  deleteSecureProviderKey,
+  hydrateSecureCredentials,
+} from '../security/local-vault.js';
 
-const PROVIDER_CREDENTIALS = Object.freeze({
-  openai: Object.freeze({ env: 'OPENAI_API_KEY', files: ['openai.env'] }),
-  gemini: Object.freeze({ env: 'GEMINI_API_KEY', files: ['gemini.env'] }),
-  anthropic: Object.freeze({ env: 'ANTHROPIC_API_KEY', files: ['anthropic.env'] }),
-  grok: Object.freeze({ env: 'XAI_API_KEY', files: ['grok.env', 'xai.env'] }),
-  cloudflare: Object.freeze({ env: 'CLOUDFLARE_API_TOKEN', files: ['cloudflare.env'], accountEnv: ['ACCOUNT_ID', 'CLOUDFLARE_ACCOUNT_ID'] }),
+export { hydrateSecureCredentials };
+
+export const PROVIDER_CREDENTIALS = Object.freeze({
+  openai: Object.freeze({ label: 'OpenAI', env: 'OPENAI_API_KEY', files: ['openai.env'], modelProvider: 'openai' }),
+  anthropic: Object.freeze({ label: 'Anthropic', env: 'ANTHROPIC_API_KEY', files: ['anthropic.env'], modelProvider: 'anthropic' }),
+  gemini: Object.freeze({ label: 'Gemini', env: 'GEMINI_API_KEY', files: ['gemini.env'], modelProvider: 'gemini' }),
+  cursor: Object.freeze({ label: 'Cursor', env: 'CURSOR_API_KEY', files: ['cursor.env'], modelProvider: 'cursor' }),
+  xai: Object.freeze({ label: 'xAI', env: 'XAI_API_KEY', files: ['xai.env', 'grok.env'], modelProvider: 'xai' }),
+  cloudflare: Object.freeze({
+    label: 'Cloudflare',
+    env: 'CLOUDFLARE_API_TOKEN',
+    files: ['cloudflare.env'],
+    modelProvider: 'cloudflare',
+    accountEnv: ['CLOUDFLARE_ACCOUNT_ID'],
+  }),
+  inneranimalmedia: Object.freeze({
+    label: 'InnerAnimalMedia',
+    env: 'AGENTSAM_API_KEY',
+    files: ['inneranimalmedia.env'],
+    tokenPrefix: 'aak_',
+    platformCredential: true,
+  }),
+});
+
+const PROVIDER_ALIASES = Object.freeze({
+  grok: 'xai',
+  iam: 'inneranimalmedia',
+  inneranimal: 'inneranimalmedia',
 });
 
 function clean(value) { return value == null ? '' : String(value).trim(); }
+
+export function normalizeProviderId(provider) {
+  const id = clean(provider).toLowerCase();
+  return PROVIDER_ALIASES[id] || id;
+}
+
 function normalizeCloudflareAccountId(value) {
   const id = clean(value);
   if (!id) return '';
@@ -18,6 +52,16 @@ function normalizeCloudflareAccountId(value) {
   return id;
 }
 
+function validateCredentialValue(spec, value) {
+  const secret = clean(value);
+  if (!secret) throw new Error('credential_required');
+  if (/[\r\n\0]/.test(secret)) throw new Error('credential_must_be_single_line');
+  if (spec.tokenPrefix && !secret.startsWith(spec.tokenPrefix)) {
+    throw new Error(`credential_prefix_required:${spec.tokenPrefix}`);
+  }
+  return secret;
+}
+
 function homeDirectory(options = {}) {
   return path.resolve(clean(options.home) || clean(options.env?.HOME) || clean(options.env?.USERPROFILE) || os.homedir());
 }
@@ -58,6 +102,23 @@ function firstRuntimeValue(env, names = []) {
   return '';
 }
 
+function atomicWrite(filename, source, mode = 0o600) {
+  const dir = path.dirname(filename);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') fs.chmodSync(dir, 0o700);
+  const temp = `${filename}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temp, source, { mode });
+  if (process.platform !== 'win32') fs.chmodSync(temp, mode);
+  fs.renameSync(temp, filename);
+  if (process.platform !== 'win32') fs.chmodSync(filename, mode);
+}
+
+function envLiteral(value) {
+  const text = String(value ?? '');
+  if (/['"\r\n\0]/.test(text)) throw new Error('credential_contains_unsupported_profile_character');
+  return `"${text}"`;
+}
+
 export function agentEnvDirectory(options = {}) {
   return path.join(homeDirectory(options), '.agentsam', 'env.d');
 }
@@ -68,83 +129,197 @@ export function agentEnvLoaderPath(options = {}) {
 
 export function ensureAgentEnvLoader(options = {}) {
   const filename = agentEnvLoaderPath(options);
-  fs.mkdirSync(path.dirname(filename), { recursive: true, mode: 0o700 });
+  const supported = Object.keys(PROVIDER_CREDENTIALS).join('|');
   const source = `# AgentSam provider environment loader. Source this file; do not execute it.
-_agentsam_profile=\"\${1:-}\"
-case \"\$_agentsam_profile\" in
-  openai|anthropic|gemini|grok|cloudflare) ;;
-  *) echo \"usage: source ~/.agentsam/load-agent-env.sh <openai|anthropic|gemini|grok|cloudflare>\" >&2; return 2 2>/dev/null || exit 2 ;;
-esac
-_agentsam_file=\"\${HOME}/.agentsam/env.d/\${_agentsam_profile}.env\"
-if [ ! -f \"\$_agentsam_file\" ]; then
-  echo \"AgentSam provider profile not found: \$_agentsam_file\" >&2
-  return 1 2>/dev/null || exit 1
-fi
-set -a
-. \"\$_agentsam_file\"
-set +a
-if [ \"\$_agentsam_profile\" = cloudflare ]; then
-  if [ -z \"\${ACCOUNT_ID:-}\" ] && [ -n \"\${CLOUDFLARE_ACCOUNT_ID:-}\" ]; then export ACCOUNT_ID=\"\$CLOUDFLARE_ACCOUNT_ID\"; fi
-  if [ -z \"\${CLOUDFLARE_ACCOUNT_ID:-}\" ] && [ -n \"\${ACCOUNT_ID:-}\" ]; then export CLOUDFLARE_ACCOUNT_ID=\"\$ACCOUNT_ID\"; fi
+if [ "$#" -eq 0 ]; then
+  echo "usage: source ~/.agentsam/load-agent-env.sh <profile> [profile ...]" >&2
+  return 2 2>/dev/null || exit 2
 fi
+for _agentsam_profile in "$@"; do
+  case "$_agentsam_profile" in
+    grok) _agentsam_profile="xai" ;;
+    ${supported}) ;;
+    *) echo "unknown AgentSam provider profile: $_agentsam_profile" >&2; return 2 2>/dev/null || exit 2 ;;
+  esac
+  _agentsam_file="\${HOME}/.agentsam/env.d/\${_agentsam_profile}.env"
+  if [ ! -f "$_agentsam_file" ]; then
+    echo "AgentSam provider profile not found: $_agentsam_file" >&2
+    return 1 2>/dev/null || exit 1
+  fi
+  set -a
+  . "$_agentsam_file"
+  set +a
+done
 unset _agentsam_file _agentsam_profile
 `;
-  fs.writeFileSync(filename, source, { mode: 0o700 });
-  if (process.platform !== 'win32') fs.chmodSync(filename, 0o700);
+  atomicWrite(filename, source, 0o700);
   return filename;
 }
 
-function profileTemplate(provider, options = {}) {
-  if (provider === 'cloudflare') {
-    const accountId = normalizeCloudflareAccountId(options.accountId);
-    return `# AgentSam Cloudflare profile\n# ACCOUNT_ID is your Cloudflare account identifier; it is not a secret.\nexport ACCOUNT_ID=\"${accountId}\"\nexport CLOUDFLARE_API_TOKEN=\"\"\n`;
+function profileSource(provider, credential = '', options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const lines = [`# AgentSam ${spec.label} provider profile`];
+  if (spec.provider === 'cloudflare') {
+    lines.push('# CLOUDFLARE_ACCOUNT_ID is your Cloudflare account identifier; it is not a secret.');
+    lines.push(`export CLOUDFLARE_ACCOUNT_ID=${envLiteral(normalizeCloudflareAccountId(options.accountId))}`);
   }
-  const spec = PROVIDER_CREDENTIALS[provider];
-  if (!spec) throw new Error(`unsupported_provider:${provider}`);
-  return `# AgentSam ${provider} provider profile\nexport ${spec.env}=\"\"\n`;
+  lines.push(`export ${spec.env}=${envLiteral(credential)}`);
+  return `${lines.join('\n')}\n`;
+}
+
+export function providerCredentialSpec(provider) {
+  const id = normalizeProviderId(provider);
+  const spec = PROVIDER_CREDENTIALS[id];
+  return spec ? Object.freeze({ provider: id, ...spec }) : null;
 }
 
 export function ensureProviderEnvProfile(provider, options = {}) {
   const spec = providerCredentialSpec(provider);
-  if (!spec) throw new Error(`unsupported_provider:${clean(provider).toLowerCase()}`);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
   const dir = agentEnvDirectory(options);
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   if (process.platform !== 'win32') fs.chmodSync(dir, 0o700);
   const filename = path.join(dir, spec.files[0]);
   let created = false;
   if (!fs.existsSync(filename)) {
-    fs.writeFileSync(filename, profileTemplate(spec.provider, options), { mode: 0o600 });
+    atomicWrite(filename, profileSource(spec.provider, '', options), 0o600);
     created = true;
-  } else if (spec.provider === 'cloudflare' && clean(options.accountId)) {
-    const source = fs.readFileSync(filename, 'utf8');
-    const current = firstEnvValue(source, spec.accountEnv || []);
-    if (!current) {
-      const accountId = normalizeCloudflareAccountId(options.accountId);
-      const line = `export ACCOUNT_ID=\"${accountId}\"`;
-      const next = /^(?:export\s+)?ACCOUNT_ID=.*$/m.test(source)
-        ? source.replace(/^(?:export\s+)?ACCOUNT_ID=.*$/m, line)
-        : `${line}\n${source}`;
-      fs.writeFileSync(filename, next, { mode: 0o600 });
+  } else {
+    const safety = secureFile(filename);
+    if (!safety.ok) throw new Error(safety.error);
+    if (process.platform !== 'win32') fs.chmodSync(filename, 0o600);
+    if (spec.provider === 'cloudflare' && clean(options.accountId)) {
+      const source = fs.readFileSync(filename, 'utf8');
+      const current = firstEnvValue(source, spec.accountEnv || []);
+      if (!current) {
+        const accountId = normalizeCloudflareAccountId(options.accountId);
+        const line = `export CLOUDFLARE_ACCOUNT_ID=${envLiteral(accountId)}`;
+        const next = /^(?:export\s+)?CLOUDFLARE_ACCOUNT_ID=.*$/m.test(source)
+          ? source.replace(/^(?:export\s+)?CLOUDFLARE_ACCOUNT_ID=.*$/m, line)
+          : `${line}\n${source}`;
+        atomicWrite(filename, next, 0o600);
+      }
     }
   }
-  if (process.platform !== 'win32') fs.chmodSync(filename, 0o600);
   const loader = ensureAgentEnvLoader(options);
-  return Object.freeze({ provider: spec.provider, file: filename, loader, created, source_command: `source ~/.agentsam/load-agent-env.sh ${spec.provider}` });
+  return Object.freeze({
+    provider: spec.provider,
+    file: filename,
+    loader,
+    created,
+    source_command: `source ~/.agentsam/load-agent-env.sh ${spec.provider}`,
+  });
 }
 
-export function providerCredentialSpec(provider) {
-  const id = clean(provider).toLowerCase();
-  const spec = PROVIDER_CREDENTIALS[id];
-  return spec ? Object.freeze({ provider: id, ...spec }) : null;
+export function setProviderCredential(provider, credential, options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const value = validateCredentialValue(spec, credential);
+  setSecureProviderKey(spec.provider, { value, accountId: options.accountId }, options);
+  if (typeof process !== 'undefined' && process.env) {
+    process.env[spec.env] = value;
+    if (spec.provider === 'cloudflare' && options.accountId) {
+      process.env.CLOUDFLARE_ACCOUNT_ID = options.accountId;
+    }
+  }
+  let file = null;
+  let loader = null;
+  let sourceCommand = null;
+  if (options.exportProfile === true || options.writeEnvProfile === true) {
+    const filename = path.join(agentEnvDirectory(options), spec.files[0]);
+    atomicWrite(filename, profileSource(spec.provider, value, options), 0o600);
+    loader = ensureAgentEnvLoader(options);
+    file = filename;
+    sourceCommand = `source ~/.agentsam/load-agent-env.sh ${spec.provider}`;
+  }
+  return Object.freeze({
+    provider: spec.provider,
+    file,
+    loader,
+    source_command: sourceCommand,
+  });
+}
+
+/**
+ * Exports a configured provider credential from the secure vault to a plaintext .env file.
+ * This is an explicit opt-in action for operators who need to source credentials into external shells.
+ * The standard AgentSam setup flows (interactive picker, models --setup, providers add)
+ * intentionally do NOT invoke this, keeping the credential strictly inside the encrypted vault.
+ */
+export function exportProviderEnvProfile(provider, options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  const resolved = resolveProviderCredential(spec.provider, options);
+  if (!resolved.configured || !resolved.value) {
+    throw new Error(`provider_not_configured:${spec.provider}`);
+  }
+  const filename = path.join(agentEnvDirectory(options), spec.files[0]);
+  atomicWrite(filename, profileSource(spec.provider, resolved.value, { ...options, accountId: resolved.account_id }), 0o600);
+  const loader = ensureAgentEnvLoader(options);
+  return Object.freeze({
+    provider: spec.provider,
+    file: filename,
+    loader,
+    source_command: `source ~/.agentsam/load-agent-env.sh ${spec.provider}`,
+  });
+}
+
+export function removeProviderCredential(provider, options = {}) {
+  const spec = providerCredentialSpec(provider);
+  if (!spec) throw new Error(`unsupported_provider:${normalizeProviderId(provider)}`);
+  deleteSecureProviderKey(spec.provider, options);
+  const dir = agentEnvDirectory(options);
+  let removed = false;
+  for (const basename of spec.files) {
+    const filename = path.join(dir, basename);
+    if (!fs.existsSync(filename)) continue;
+    const safety = secureFile(filename);
+    if (!safety.ok) throw new Error(safety.error);
+    fs.rmSync(filename, { force: true });
+    removed = true;
+  }
+  if (typeof process !== 'undefined' && process.env) {
+    delete process.env[spec.env];
+  }
+  return Object.freeze({ provider: spec.provider, removed });
 }
 
 export function resolveProviderCredential(provider, options = {}) {
   const spec = providerCredentialSpec(provider);
-  if (!spec) return Object.freeze({ provider: clean(provider).toLowerCase(), configured: false, source: null, error: 'unsupported_provider', value: '' });
+  if (!spec) return Object.freeze({ provider: normalizeProviderId(provider), configured: false, source: null, error: 'unsupported_provider', value: '' });
   const env = options.env || process.env;
   const accountIdFromEnv = firstRuntimeValue(env, spec.accountEnv || []);
   const fromEnv = clean(env?.[spec.env]);
-  if (fromEnv) return Object.freeze({ provider: spec.provider, configured: true, source: 'environment', env: spec.env, file: null, error: null, value: fromEnv, account_id: accountIdFromEnv || null });
+  if (fromEnv) {
+    const prefixError = spec.tokenPrefix && !fromEnv.startsWith(spec.tokenPrefix) ? `credential_prefix_required:${spec.tokenPrefix}` : null;
+    return Object.freeze({
+      provider: spec.provider,
+      configured: !prefixError,
+      source: 'environment',
+      env: spec.env,
+      file: null,
+      error: prefixError,
+      value: prefixError ? '' : fromEnv,
+      account_id: accountIdFromEnv || null,
+    });
+  }
+
+  const secure = getSecureProviderKey(spec.provider, options);
+  if (secure && clean(secure.value)) {
+    const val = clean(secure.value);
+    const prefixError = spec.tokenPrefix && !val.startsWith(spec.tokenPrefix) ? `credential_prefix_required:${spec.tokenPrefix}` : null;
+    return Object.freeze({
+      provider: spec.provider,
+      configured: !prefixError,
+      source: secure.source || 'local_vault',
+      env: spec.env,
+      file: null,
+      error: prefixError,
+      value: prefixError ? '' : val,
+      account_id: accountIdFromEnv || secure.accountId || null,
+    });
+  }
 
   const dir = agentEnvDirectory({ ...options, env });
   for (const basename of spec.files) {
@@ -156,19 +331,22 @@ export function resolveProviderCredential(provider, options = {}) {
       const source = fs.readFileSync(filename, 'utf8');
       const value = clean(parseEnvValue(source, spec.env));
       const accountId = accountIdFromEnv || firstEnvValue(source, spec.accountEnv || []);
-      if (value) return Object.freeze({ provider: spec.provider, configured: true, source: 'agentsam_env_file', env: spec.env, file: filename, error: null, value, account_id: accountId || null });
-      return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: 'credential_variable_missing', value: '' });
+      const prefixError = spec.tokenPrefix && value && !value.startsWith(spec.tokenPrefix) ? `credential_prefix_required:${spec.tokenPrefix}` : null;
+      if (value && !prefixError) return Object.freeze({ provider: spec.provider, configured: true, source: 'agentsam_env_file', env: spec.env, file: filename, error: null, value, account_id: accountId || null });
+      return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: prefixError || 'credential_variable_missing', value: '' });
     } catch (error) {
       return Object.freeze({ provider: spec.provider, configured: false, source: 'agentsam_env_file', env: spec.env, file: filename, error: error?.message || String(error), value: '' });
     }
   }
-  return Object.freeze({ provider: spec.provider, configured: false, source: null, env: spec.env, file: null, error: null, value: '' });
+  return Object.freeze({ provider: spec.provider, configured: false, source: null, env: spec.env, file: null, error: null, value: '', account_id: accountIdFromEnv || null });
 }
 
 export function describeProviderCredential(provider, options = {}) {
   const resolved = resolveProviderCredential(provider, options);
+  const spec = providerCredentialSpec(provider);
   return Object.freeze({
     provider: resolved.provider,
+    label: spec?.label || resolved.provider,
     configured: resolved.configured,
     source: resolved.source,
     env: resolved.env || null,

package/src/lib/scaffold/resolve-cloudflare-account.js

@@ -0,0 +1,37 @@
+/**
+ * Shared Cloudflare account resolution for scaffold wizards.
+ * Reuses the same detection the CLI's `agentsam env init cloudflare` flow
+ * already relies on — never ask the user to hand-paste an account ID that
+ * `wrangler whoami` (or an existing env override) can already answer.
+ */
+import { detectCloudflareAccounts } from '../../commands/env.js';
+
+export async function resolveCloudflareAccountId({ text, select, isCancel, cancel, note, pc, detectAccounts = detectCloudflareAccounts }) {
+  const detected = detectAccounts();
+
+  if (detected.accounts.length === 1) {
+    const acct = detected.accounts[0];
+    note(`Detected Cloudflare account: ${pc.cyan(acct.name || acct.id)}`, 'Cloudflare account');
+    return acct.id;
+  }
+
+  if (detected.accounts.length > 1) {
+    const choice = await select({
+      message: 'Which Cloudflare account?',
+      options: detected.accounts.map((a) => ({ value: a.id, label: a.name || a.id, hint: a.id })),
+    });
+    if (isCancel(choice)) { cancel('Cancelled.'); process.exit(0); }
+    return choice;
+  }
+
+  note('Could not auto-detect a Cloudflare account (run `agentsam cloudflare` to check login status).', 'Cloudflare account');
+  const cfAccountId = await text({
+    message: 'Cloudflare account ID? (from dash.cloudflare.com → right sidebar)',
+    placeholder: 'abc123...',
+    validate(val) {
+      if (!val || val.trim().length === 0) return 'Required.';
+    },
+  });
+  if (isCancel(cfAccountId)) { cancel('Cancelled.'); process.exit(0); }
+  return cfAccountId.trim();
+}

package/src/lib/scaffold/wizards/cms.js

@@ -22,6 +22,7 @@ import {
 import pc from 'picocolors';
 import { writeFileTree } from '../writer.js';
 import { cmsTemplates } from '../templates/cms/index.js';
+import { resolveCloudflareAccountId } from '../resolve-cloudflare-account.js';
 
 export async function runCmsWizard() {
   note('A Cloudflare Worker + D1 + R2 CMS site with reusable page templates.', 'CMS Site');
@@ -111,14 +112,7 @@ export async function runCmsWizard() {
   }
 
   // ── Step 7: Cloudflare account details ────────────────────────────────────
-  const cfAccountId = await text({
-    message: 'Cloudflare account ID? (from dash.cloudflare.com → right sidebar)',
-    placeholder: 'abc123...',
-    validate(val) {
-      if (!val || val.trim().length === 0) return 'Required for wrangler.toml.';
-    },
-  });
-  if (isCancel(cfAccountId)) { cancel('Cancelled.'); process.exit(0); }
+  const cfAccountId = await resolveCloudflareAccountId({ text, select, isCancel, cancel, note, pc });
 
   // ── Step 8: Confirm before writing ───────────────────────────────────────
   const summary = [

package/src/lib/scaffold/wizards/worker-api.js

@@ -16,6 +16,7 @@ import {
 import pc from 'picocolors';
 import { writeFileTree } from '../writer.js';
 import { workerApiTemplates } from '../templates/worker-api/index.js';
+import { resolveCloudflareAccountId } from '../resolve-cloudflare-account.js';
 
 export async function runWorkerApiWizard() {
   note('A typed Cloudflare Worker with route handlers, D1 binding, and CORS ready.', 'Worker API');
@@ -52,14 +53,7 @@ export async function runWorkerApiWizard() {
   });
   if (isCancel(dbKind)) { cancel('Cancelled.'); process.exit(0); }
 
-  const cfAccountId = await text({
-    message: 'Cloudflare account ID?',
-    placeholder: 'abc123...',
-    validate(val) {
-      if (!val || val.trim().length === 0) return 'Required.';
-    },
-  });
-  if (isCancel(cfAccountId)) { cancel('Cancelled.'); process.exit(0); }
+  const cfAccountId = await resolveCloudflareAccountId({ text, select, isCancel, cancel, note, pc });
 
   const confirmed = await confirm({ message: `Write files to ./${projectName.trim()}/?` });
   if (isCancel(confirmed) || !confirmed) { cancel('Cancelled.'); process.exit(0); }

package/src/lib/slash-commands.js

@@ -8,22 +8,30 @@ export const SLASH_COMMANDS = [
   { cmd: '/fast', description: 'Use provider Fast processing when the selected model supports it', lane: 'model' },
   { cmd: '/flex', description: 'Use provider Flex processing when the selected model supports it', lane: 'model' },
   { cmd: '/standard', description: 'Return to Standard provider processing', lane: 'model' },
+  { cmd: '/compact', description: 'Compact active provider context; status shows support, threshold, and receipt', lane: 'context' },
   { cmd: '/context', description: 'Show model context economics; add repo for Git bridge context', lane: 'context' },
-  { cmd: '/status', description: 'Local project, DB, Git, and PTY health', lane: 'local' },
+  { cmd: '/status', description: 'Honest project awareness: account, models, terminal, live deploy', lane: 'local' },
   { cmd: '/models', description: 'Probe providers and provider-verified known models', lane: 'model' },
+  { cmd: '/providers', description: 'Configure and verify machine provider credentials', lane: 'model' },
   { cmd: '/login', description: 'Sign in to Inner Animal Media and save the machine-local Agent Sam session', lane: 'identity' },
   { cmd: '/logout', description: 'Sign out locally without deleting provider credentials', lane: 'identity' },
   { cmd: '/whoami', description: 'Show authenticated account identity and safe credential status', lane: 'identity' },
   { cmd: '/session', description: 'Show current session usage, cost, and resume receipt', lane: 'observability' },
   { cmd: '/usage', description: 'Show token usage, spend breakdown, and resume command', lane: 'observability' },
   { cmd: '/cf', description: 'Cloudflare native reads, Wrangler status, and CPU profile analysis', lane: 'cloudflare' },
+  { cmd: '/connections', description: 'Inspect live account, terminal, Worker, and Cloudflare connection evidence', lane: 'cloudflare' },
+  { cmd: '/tunnel', description: 'Choose and run a real Cloudflare Tunnel through Wrangler', lane: 'cloudflare' },
   { cmd: '/settings', description: 'Choose project, runtime, terminal, and model policy' },
   { cmd: '/pwd', description: 'Print working directory', lane: 'terminal' },
   { cmd: '/cd', description: 'Change working directory', lane: 'terminal' },
   { cmd: '/git', description: 'Run an explicit Git subcommand', lane: 'git' },
   { cmd: '/diff', description: 'Show the current Git diff', lane: 'git' },
-  { cmd: '/db', description: 'Local SQLite status and query helpers', lane: 'data' },
+  { cmd: '/db', description: 'SQLite status; sources discovers stores; select knowledge sqlite|postgres [ENV]', lane: 'data' },
   { cmd: '/agent', description: 'Send a goal to the configured local Agent Sam runtime', lane: 'agent' },
+  { cmd: '/goap', description: 'Inspect and manage GOAP blackboard: /goap [status|goal|why|plan|list|new|switch|close]', lane: 'agent' },
+  { cmd: '/brand', description: 'Brand intelligence: /brand [scan|resolve|plan|inspect]', lane: 'product' },
+  { cmd: '/plan', description: 'Composable plans: /plan brand', lane: 'product' },
+  { cmd: '/next', description: 'Suggested next actions from session progression', lane: 'product' },
   { cmd: '/logs', description: 'Show local Agent Sam execution events', lane: 'observability' },
   { cmd: '/deploy', description: 'Add a cloud adapter and deploy intentionally', lane: 'deploy' },
   { cmd: '/clear', description: 'Clear the terminal display', lane: 'terminal' },