@inneranimalmedia/agentsam-sdk 2.6.1 → 2.6.3

package/test/unit/website-assets-bindings.test.mjs

@@ -0,0 +1,60 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  resolveWebsiteAssets,
+  resolveWorkerStaticAssets,
+  resolveDb,
+  resolveSiteCacheKv,
+  suggestWebsiteAssetsBindingScaffold,
+  websitePublicKey,
+  websitePartialKey,
+  WEBSITE_ASSETS_ROLE,
+} from '../../apps/local-studio/backend/worker/bindings.js';
+
+function r2Stub() {
+  return {
+    get: async () => null,
+    put: async () => {},
+    list: async () => ({ objects: [] }),
+    head: async () => null,
+    createMultipartUpload: async () => ({}),
+  };
+}
+
+function kvStub() {
+  return {
+    get: async () => null,
+    put: async () => {},
+    getWithMetadata: async () => ({ value: null, metadata: null }),
+  };
+}
+
+test('resolveWebsiteAssets prefers canonical name then aliases', () => {
+  const bucket = r2Stub();
+  const a = resolveWebsiteAssets({ SITE_ASSETS: bucket });
+  assert.equal(a.name, 'SITE_ASSETS');
+  assert.equal(a.role, WEBSITE_ASSETS_ROLE);
+
+  const b = resolveWebsiteAssets({ WEBSITE_ASSETS: bucket, SITE_ASSETS: r2Stub() });
+  assert.equal(b.name, 'WEBSITE_ASSETS');
+});
+
+test('resolveWorkerStaticAssets only accepts fetch binding', () => {
+  assert.equal(resolveWorkerStaticAssets({ ASSETS: r2Stub() }), null);
+  const assets = { fetch: async () => new Response('ok') };
+  assert.equal(resolveWorkerStaticAssets({ ASSETS: assets }), assets);
+});
+
+test('resolveDb and site cache aliases', () => {
+  const db = { prepare: () => ({}) };
+  assert.equal(resolveDb({ DATABASE: db }).name, 'DATABASE');
+  assert.equal(resolveSiteCacheKv({ CMS_CACHE: kvStub() }).name, 'CMS_CACHE');
+});
+
+test('key helpers and scaffold', () => {
+  assert.equal(websitePublicKey('agentsam-sdk', 'home/index.html'), 'sites/agentsam-sdk/public/home/index.html');
+  assert.equal(websitePartialKey('agentsam-sdk', 'header'), 'sites/agentsam-sdk/partials/header.html');
+  const tip = suggestWebsiteAssetsBindingScaffold({ detectedBindingName: 'CONTENT' });
+  assert.equal(tip.binding, 'CONTENT');
+  assert.equal(tip.wrangler_snippet.r2_buckets[0].binding, 'CONTENT');
+});

package/test/whoami-resume.test.mjs

@@ -14,9 +14,9 @@ function tempHome(t) {
   return home;
 }
 
-test('whoami validates persisted IAM identity while never returning the SDK or provider secret', async t => {
+test('whoami validates persisted IAM browser identity while never returning account or provider secrets', async t => {
   const home = tempHome(t);
-  saveAccountSession({ access_token: 'sdk_do_not_print', user_id: 'au_local' }, { home });
+  saveAccountSession({ access_token: 'browser_session_do_not_print', user_id: 'au_local' }, { home });
   const envDir = path.join(home, '.agentsam', 'env.d');
   fs.mkdirSync(envDir, { recursive: true });
   const openaiFile = path.join(envDir, 'openai.env');
@@ -26,16 +26,96 @@ test('whoami validates persisted IAM identity while never returning the SDK or p
   const status = await collectWhoami({
     env: {}, home,
     contextLoader: async token => {
-      assert.equal(token, 'sdk_do_not_print');
-      return { user_id: 'au_server', account_id: 'acct_server', email: 'dev@example.test', cloudflare: { ok: true }, byok: { openai: { configured: true, masked: 'secret' } } };
+      assert.equal(token, 'browser_session_do_not_print');
+      return {
+        user_id: 'au_server', account_id: 'acct_server', email: 'dev@example.test',
+        cloudflare: { ok: true }, byok: { openai: { configured: true, masked: 'secret' } },
+        terminal: {
+          available: true,
+          instances: [{ id: 'inst_1', name: 'Mac', metadata_json: 'secret' }],
+          connections: [{ id: 'conn_1', instance_id: 'inst_1', name: 'Tunnel', is_active: true, endpoint_url: 'wss://secret' }],
+        },
+      };
     },
   });
   assert.equal(status.authenticated, true);
   assert.equal(status.identity.account_id, 'acct_server');
-  assert.equal(status.sdk_credential.source, 'agentsam_account_session');
+  assert.equal(status.active_auth.source, 'agentsam_browser_oauth');
+  assert.equal(status.active_auth.kind, 'browser_oauth');
   assert.equal(status.provider_credentials.find(row => row.provider === 'openai').configured, true);
+  assert.equal(status.terminal.connections[0].id, 'conn_1');
   const serialized = JSON.stringify(status);
-  assert.doesNotMatch(serialized, /sdk_do_not_print|sk-never-print-this|masked/);
+  assert.doesNotMatch(serialized, /browser_session_do_not_print|sk-never-print-this|masked|endpoint_url|metadata_json|wss:\/\/secret/);
+});
+
+test('whoami sends the exact authority returned by the resolver to the default context loader', async t => {
+  const home = tempHome(t);
+  let request = null;
+  const status = await collectWhoami({
+    env: { IAM_OAUTH_ISSUER: 'https://iam.example.test' },
+    home,
+    authorityLoader: async () => ({
+      value: 'resolved_authority_token',
+      kind: 'browser_oauth',
+      source: 'test_authority',
+    }),
+    fetchImpl: async (url, init) => {
+      request = { url, init };
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({ user_id: 'au_server', account_id: 'acct_server' }),
+      };
+    },
+  });
+  assert.equal(request.url, 'https://iam.example.test/api/sdk/context');
+  assert.equal(request.init.headers.Authorization, 'Bearer resolved_authority_token');
+  assert.equal(status.authenticated, true);
+  assert.equal(status.identity.account_id, 'acct_server');
+});
+
+test('whoami uses a valid browser session when a stale environment API key is invalid', async t => {
+  const home = tempHome(t);
+  saveAccountSession({ access_token: 'browser_session_do_not_print', user_id: 'au_local' }, { home });
+  const status = await collectWhoami({
+    env: { AGENTSAM_API_KEY: 'stale-invalid-key' },
+    home,
+    contextLoader: async token => {
+      assert.equal(token, 'browser_session_do_not_print');
+      return { user_id: 'au_server', account_id: 'acct_server' };
+    },
+  });
+  assert.equal(status.authenticated, true);
+  assert.equal(status.active_auth.kind, 'browser_oauth');
+  assert.equal(status.api_key.valid, false);
+  assert.equal(status.api_key.error, 'invalid_api_key_prefix');
+});
+
+test('whoami refreshes an expired browser session before validating IAM context', async t => {
+  const home = tempHome(t);
+  const nowMs = Date.now();
+  saveAccountSession({
+    access_token: 'expired_browser_token',
+    refresh_token: 'refresh_token',
+    expires_in: 1,
+  }, { home, nowMs: nowMs - 120_000 });
+  let refreshed = 0;
+  const status = await collectWhoami({
+    env: {},
+    home,
+    nowMs,
+    refreshImpl: async ({ session }) => {
+      refreshed += 1;
+      return { ...session, access_token: 'fresh_browser_token', expires_at: new Date(nowMs + 3_600_000).toISOString() };
+    },
+    contextLoader: async token => {
+      assert.equal(token, 'fresh_browser_token');
+      return { user_id: 'au_server', account_id: 'acct_server' };
+    },
+  });
+  assert.equal(refreshed, 1);
+  assert.equal(status.authenticated, true);
+  assert.equal(status.active_auth.kind, 'browser_oauth');
 });
 
 test('resume restores saved cwd and session through the canonical shell runtime', async t => {
@@ -45,7 +125,7 @@ test('resume restores saved cwd and session through the canonical shell runtime'
   const session = createLocalSession({ cwd, title: 'Run wrangler whoami', model_key: 'openai:gpt-6-astra' }, { home });
   let called = null;
   const restored = await runResume([session.id], {
-    home,
+    home, cwd,
     write() {},
     runShellImpl: async (argv, options) => { called = { argv, options }; },
   });

package/examples/gorilla-shell/README.md

@@ -1,15 +0,0 @@
-# Gorilla Shell example (superseded)
-
-**Canonical scaffold:** [`../../templates/gorilla-shell/`](../../templates/gorilla-shell/)
-
-This directory previously mirrored an older demo that hard-coded IAM D1/host
-literals. Run and customize from `templates/gorilla-shell` instead:
-
-```bash
-cd templates/gorilla-shell
-npm install
-npm run dev
-```
-
-Demo CLI strings there use `{{PROJECT_NAME}}`, `{{D1_DATABASE_ID}}`,
-`{{DASHBOARD_HOST}}`, and related placeholders — not live platform IDs.

package/src/lib/gorilla-template.js

@@ -1,54 +0,0 @@
-/**
- * Copy Gorilla Mode pixel UI into scaffolded projects (fully local).
- */
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const TEMPLATE_FILES = ['App.tsx', 'main.jsx', 'index.html'];
-const ROOT_FILES = ['vite.config.js'];
-
-export function resolveGorillaTemplateDir() {
-  const here = path.dirname(fileURLToPath(import.meta.url));
-  return path.resolve(here, '..', '..', 'templates', 'gorilla-shell');
-}
-
-/**
- * @param {string} projectRoot
- * @param {{ projectName: string, laneKey: string, agent: string, laneLabel: string }} meta
- */
-export function copyGorillaTemplate(projectRoot, meta) {
-  const srcDir = resolveGorillaTemplateDir();
-  if (!fs.existsSync(srcDir)) {
-    throw new Error(`Gorilla template not found at ${srcDir}`);
-  }
-
-  const destDir = path.join(path.resolve(projectRoot), 'gorilla');
-  fs.mkdirSync(destDir, { recursive: true });
-
-  const vars = {
-    '{{PROJECT_NAME}}': meta.projectName,
-    '{{LANE_KEY}}': meta.laneKey,
-    '{{LANE_LABEL}}': meta.laneLabel,
-    '{{AGENT}}': meta.agent,
-  };
-
-  for (const name of TEMPLATE_FILES) {
-    const src = path.join(srcDir, name);
-    if (!fs.existsSync(src)) continue;
-    let content = fs.readFileSync(src, 'utf8');
-    for (const [token, value] of Object.entries(vars)) {
-      content = content.split(token).join(value);
-    }
-    fs.writeFileSync(path.join(destDir, name), content, 'utf8');
-  }
-
-  const root = path.resolve(projectRoot);
-  for (const name of ROOT_FILES) {
-    const src = path.join(srcDir, name);
-    if (!fs.existsSync(src)) continue;
-    fs.copyFileSync(src, path.join(root, name));
-  }
-
-  return destDir;
-}

package/src/lib/prompt-byok.js

@@ -1,57 +0,0 @@
-/**
- * Optional BYOK key paste during SDK init → CORE user_api_keys.
- */
-import { getJson, postJson } from './core-client.js';
-
-const PROVIDERS = [
-  { id: 'openai', label: 'OpenAI' },
-  { id: 'anthropic', label: 'Anthropic' },
-];
-
-/**
- * @param {string} token SDK bearer
- * @param {{ ask: (q: string) => Promise<string> } | null} prompt
- */
-export async function promptOptionalByokKeys(token, prompt) {
-  if (!token || !prompt) return;
-
-  let ctx;
-  try {
-    ctx = await getJson('/api/sdk/context', token);
-  } catch {
-    console.log('\n  ⚠ Could not load BYOK status — skip key paste or add keys in Dashboard → Settings → Keys\n');
-    return;
-  }
-
-  const byok = ctx?.byok || {};
-  console.log('\n  Provider keys (BYOK — optional, stored in YOUR IAM account):\n');
-
-  for (const p of PROVIDERS) {
-    const slot = byok[p.id];
-    if (slot?.configured) {
-      console.log(`    ${p.label.padEnd(12)} ✓ connected ${slot.masked || ''}`);
-      continue;
-    }
-
-    const ans = await prompt.ask(`    ${p.label} API key (Enter to skip): `);
-    const key = ans.trim();
-    if (!key) continue;
-
-    try {
-      await postJson(
-        '/api/sdk/keys',
-        {
-          provider: p.id,
-          api_key: key,
-          label: `${p.label} (SDK init)`,
-          validate: true,
-        },
-        token,
-      );
-      console.log(`    ${p.label.padEnd(12)} ✓ saved to IAM BYOK`);
-    } catch (e) {
-      console.log(`    ${p.label.padEnd(12)} ✗ ${e?.message || 'save failed'}`);
-    }
-  }
-  console.log('');
-}

package/src/lib/save-sdk-token.js

@@ -1,19 +0,0 @@
-/**
- * Persist SDK session token locally for repeat inits (user's machine only).
- */
-import fs from 'fs';
-import path from 'path';
-
-export function saveSdkTokenHint(cwd, token) {
-  const t = String(token || '').trim();
-  if (!t || !t.startsWith('sdk_')) return null;
-  const dir = path.join(path.resolve(cwd), '.agentsam');
-  fs.mkdirSync(dir, { recursive: true });
-  const hintPath = path.join(dir, 'credentials.env.example');
-  const content = `# Agent Sam SDK — add to your shell profile (optional)
-export AGENTSAM_SDK_KEY=${t}
-export USER_GCP_PROJECT=YOUR_GCP_PROJECT_ID
-`;
-  fs.writeFileSync(hintPath, content, 'utf8');
-  return hintPath;
-}