@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.3

package/packages/agentsam-repository/test/goap-tickets-workspace-state.test.mjs

@@ -0,0 +1,152 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  createAgentRunId,
+  createTicketId,
+  generateTicketCreateSql,
+  generateTicketActivationSql,
+  generateTicketCloseSql,
+} from '../src/tickets.js';
+import { generateWorkspaceStateUpsertSql } from '../src/workspace-state.js';
+import {
+  renderGoapStatus,
+  renderGoapGoal,
+  renderGoapWhy,
+  renderGoapPlan,
+} from '../src/goap.js';
+
+test('createAgentRunId / createTicketId produce prefixed, collision-resistant ids', () => {
+  const run1 = createAgentRunId();
+  const run2 = createAgentRunId();
+  const tkt1 = createTicketId();
+  assert.match(run1, /^arun_[0-9a-f]{16}$/);
+  assert.match(tkt1, /^tkt_[0-9a-f]{16}$/);
+  assert.notEqual(run1, run2);
+});
+
+test('generateTicketCreateSql requires account_id and title', () => {
+  assert.throws(() => generateTicketCreateSql({ title: 'x' }), /account_id_required/);
+  assert.throws(() => generateTicketCreateSql({ accountId: 'acc_1' }), /title_required/);
+});
+
+test('generateTicketCreateSql with status=active mints an agent_run and links it on the ticket insert', () => {
+  const { sql, ticketId, agentRunId } = generateTicketCreateSql({
+    accountId: 'acc_1',
+    title: 'Wire GOAP planner',
+    status: 'active',
+    now: 1000,
+  });
+  assert.ok(ticketId.startsWith('tkt_'));
+  assert.ok(agentRunId && agentRunId.startsWith('arun_'));
+  assert.match(sql, /INSERT INTO agentsam_agent_run/);
+  assert.match(sql, /INSERT INTO agentsam_tickets/);
+  assert.match(sql, /INSERT INTO agentsam_ticket_events/);
+  const runOccurrences = sql.split(agentRunId).length - 1;
+  assert.ok(runOccurrences >= 2, 'agent_run id should appear in both the run insert and the ticket insert');
+});
+
+test('generateTicketCreateSql with status=backlog does not mint an agent_run', () => {
+  const { sql, agentRunId } = generateTicketCreateSql({
+    accountId: 'acc_1',
+    title: 'Later work',
+    status: 'backlog',
+  });
+  assert.equal(agentRunId, null);
+  assert.doesNotMatch(sql, /INSERT INTO agentsam_agent_run/);
+});
+
+test('generateTicketCreateSql escapes single quotes and truncates the title before escaping (past 240 chars)', () => {
+  const longTitle = 'x'.repeat(300) + "'drop";
+  const { sql } = generateTicketCreateSql({
+    accountId: 'acc_1',
+    title: longTitle,
+    status: 'backlog',
+  });
+  // title is sliced to 240 chars BEFORE sql-escaping, so the trailing quote at position 300 never reaches the output
+  assert.doesNotMatch(sql, /drop/);
+  assert.doesNotMatch(sql, new RegExp('x'.repeat(241)));
+  assert.match(sql, new RegExp('x'.repeat(240)));
+});
+
+test('generateTicketCreateSql escapes a single quote embedded inside the title itself', () => {
+  const { sql } = generateTicketCreateSql({
+    accountId: 'acc_1',
+    title: "Sam's ticket",
+    status: 'backlog',
+  });
+  assert.match(sql, /Sam''s ticket/);
+});
+
+test('generateTicketActivationSql requires account and ticket id', () => {
+  assert.throws(() => generateTicketActivationSql({ ticketId: 't' }), /account_id_required/);
+  assert.throws(() => generateTicketActivationSql({ accountId: 'a' }), /ticket_id_required/);
+});
+
+test('generateTicketActivationSql wires a fresh agent_run and clears closed_at', () => {
+  const { sql, agentRunId } = generateTicketActivationSql({
+    accountId: 'acc_1',
+    ticketId: 'tkt_abc',
+    now: 1000,
+  });
+  assert.ok(agentRunId.startsWith('arun_'));
+  assert.match(sql, /status = 'active'/);
+  assert.match(sql, /closed_at = NULL/);
+  assert.match(sql, /COALESCE\(agent_run_id,/);
+});
+
+test('generateTicketCloseSql maps shipped -> completed and abandoned/blocked -> failed run status', () => {
+  const shipped = generateTicketCloseSql({ ticketId: 'tkt_1', status: 'shipped', now: 1000 });
+  assert.match(shipped.sql, /status = 'completed'/);
+  assert.match(shipped.sql, /closed_at = 1000/);
+
+  const abandoned = generateTicketCloseSql({ ticketId: 'tkt_1', status: 'abandoned', now: 1000 });
+  assert.match(abandoned.sql, /status = 'failed'/);
+
+  const blocked = generateTicketCloseSql({ ticketId: 'tkt_1', status: 'blocked', now: 1000 });
+  assert.match(blocked.sql, /status = 'failed'/);
+  assert.match(blocked.sql, /closed_at = closed_at/);
+});
+
+test('generateTicketCloseSql requires a ticket id', () => {
+  assert.throws(() => generateTicketCloseSql({}), /ticket_id_required/);
+});
+
+test('generateWorkspaceStateUpsertSql requires repository_id and derives a default workspace id (non-alnum chars become underscores)', () => {
+  assert.throws(() => generateWorkspaceStateUpsertSql({}), /repository_id_required/);
+  const sql = generateWorkspaceStateUpsertSql({ repositoryId: 'SamPrimeaux/agentsam-sdk' });
+  assert.match(sql, /INSERT INTO agentsam_workspace_state/);
+  assert.match(sql, /ON CONFLICT\(repository_id\) DO UPDATE SET/);
+  assert.match(sql, /ws_SamPrimeaux_agentsam_sdk/);
+});
+
+test('generateWorkspaceStateUpsertSql upsert preserves existing values via COALESCE when a field is omitted', () => {
+  const sql = generateWorkspaceStateUpsertSql({ repositoryId: 'repo_1', currentTaskId: 'tkt_9' });
+  assert.match(sql, /current_task_id = COALESCE\(excluded\.current_task_id, agentsam_workspace_state\.current_task_id\)/);
+  assert.match(sql, /'tkt_9'/);
+});
+
+test('renderGoapStatus reflects ticket/workspace/run state and falls back gracefully on empty state', () => {
+  const out = renderGoapStatus({
+    repositoryId: 'SamPrimeaux/agentsam-sdk',
+    workspaceState: { locked_by: 'agentsam_cli', current_task_id: 'tkt_1' },
+    activeTicket: { id: 'tkt_1', title: 'Ship GOAP', status: 'active', priority: 'P1' },
+    agentRun: { id: 'arun_1', status: 'running' },
+    git: { branch: 'main', headSha: 'abcdef1234567890', dirty: false },
+  });
+  assert.match(out, /GOAP BLACKBOARD STATUS/);
+  assert.match(out, /Ship GOAP/);
+  assert.match(out, /CLEAN/);
+
+  const empty = renderGoapStatus();
+  assert.match(empty, /no active ticket/);
+  assert.match(empty, /unlocked/);
+});
+
+test('renderGoapGoal / renderGoapWhy / renderGoapPlan render without throwing on minimal state', () => {
+  for (const fn of [renderGoapGoal, renderGoapWhy, renderGoapPlan]) {
+    const out = fn({ repositoryId: 'repo', activeTicket: {}, workspaceState: {}, agentRun: {}, git: {} });
+    assert.equal(typeof out, 'string');
+    assert.ok(out.length > 0);
+  }
+});

package/packages/connectors/cloudflare/src/index.js

@@ -7,7 +7,6 @@ export const CLOUDFLARE_OAUTH_AUTHORIZE_URL = 'https://dash.cloudflare.com/oauth
 export const CLOUDFLARE_OAUTH_TOKEN_URL = 'https://dash.cloudflare.com/oauth2/token';
 export const CLOUDFLARE_CALLBACK_PATH = '/api/connections/cloudflare/callback';
 export const CLOUDFLARE_FIXTURE_CLIENT_ID = 'sillynotreal';
-export const CLOUDFLARE_FIXTURE_CLIENT_SECRET = 'sillynotreal-secret';
 
 export const CLOUDFLARE_OAUTH_REVOKE_URL = 'https://dash.cloudflare.com/oauth2/revoke';
 
@@ -22,7 +21,7 @@ export const CLOUDFLARE_CAPABILITY_SCOPES = Object.freeze({
     why: 'Inspect D1 databases bound to the deployable.',
   },
   r2_inspect: {
-    scopes: ['workers-r2-storage.read'],
+    scopes: ['workers-r2.read'],
     why: 'Inspect R2 buckets bound to the deployable.',
   },
   worker_logs: {
@@ -31,12 +30,200 @@ export const CLOUDFLARE_CAPABILITY_SCOPES = Object.freeze({
   },
 });
 
+// Full scope catalog for the AgentSam Local Studio OAuth client (182 total,
+// pasted directly from the Cloudflare dashboard's own scope picker). This is
+// what gets requested at mint time -- one authorize covers everything the
+// client is provisioned for, rather than a hand-curated subset that has to
+// be edited in code every time a new capability is used. CLOUDFLARE_CAPABILITY_SCOPES
+// above stays as documentation of which specific scopes each feature
+// actually touches -- it no longer restricts what's requested.
+export const CLOUDFLARE_ALL_SCOPES = Object.freeze([
+  'agent-memory.write',
+  'browser-rendering.read',
+  'browser-rendering.write',
+  'cf-agents.read',
+  'cf-agents.write',
+  'cloud-connector.read',
+  'cloud-connector.write',
+  'cloudchamber.read',
+  'cloudchamber.write',
+  'constellation.read',
+  'constellation.write',
+  'd1.read',
+  'd1.write',
+  'flagship.evaluate',
+  'flagship.read',
+  'flagship.write',
+  'query-cache.read',
+  'query-cache.write',
+  'k2.read',
+  'k2.write',
+  'k2.consume',
+  'k2.produce',
+  'mcp-portals.read',
+  'mcp-portals.write',
+  'messaging.edit',
+  'messaging.read',
+  'cfspeed.read',
+  'cfspeed.write',
+  'page.read',
+  'page.write',
+  'pipelines.read',
+  'pipelines.send',
+  'pipelines.write',
+  'pubsub.read',
+  'pubsub.write',
+  'queues.read',
+  'queues.write',
+  'realtime.write',
+  'realtime.admin',
+  'realtime.read',
+  'secrets-store.read',
+  'secrets-store.write',
+  'vectorize.read',
+  'vectorize.write',
+  'workers-ci.read',
+  'workers-ci.write',
+  'containers.read',
+  'containers.write',
+  'workers-kv-storage.read',
+  'workers-kv-storage.write',
+  'workers-observability.read',
+  'workers-observability-telemetry.write',
+  'workers-observability.write',
+  'r2-catalog.read',
+  'r2-catalog.write',
+  'r2-catalog-sql.read',
+  'workers-r2-bucket-item.read',
+  'workers-r2-bucket-item.write',
+  'workers-r2.read',
+  'workers-r2.write',
+  'workers-routes.read',
+  'workers-routes.write',
+  'workers-scripts.read',
+  'workers-scripts.write',
+  'workers-tail.read',
+  'aiaudit.read',
+  'aiaudit.write',
+  'aig.read',
+  'aig.run',
+  'aig.write',
+  'ai-search.index',
+  'ai-search.read',
+  'ai-search.run',
+  'ai-search.write',
+  'agw.read',
+  'agw.run',
+  'agw.write',
+  'rag.read',
+  'rag.write',
+  'rag.run',
+  'firewall-for-ai.read',
+  'firewall-for-ai.write',
+  'websearch.read',
+  'websearch.run',
+  'websearch.write',
+  'ai-model.read',
+  'ai-model.write',
+  'ai.read',
+  'ai.write',
+  'account-dns-settings.read',
+  'account-dns-settings.write',
+  'dns-firewall.read',
+  'dns-firewall.write',
+  'dns.read',
+  'dns-view.read',
+  'dns-view.write',
+  'dns.write',
+  'registrar-domains.admin',
+  'registrar-domains.read',
+  'registrar-sandbox-domains.admin',
+  'registrar-sandbox-domains.read',
+  'zone-custom-asset.read',
+  'zone-custom-asset.write',
+  'zone-dns-settings.read',
+  'zone-dns-settings.write',
+  'zone.read',
+  'zone-settings.read',
+  'zone-settings.write',
+  'zone-versioning.read',
+  'zone-versioning.write',
+  'zone.write',
+  'fraud-detection-pii.read',
+  'account-firewall-access-rules.read',
+  'account-firewall-access-rules.write',
+  'account-security-center-insights.read',
+  'account-security-center-insights.write',
+  'account-waf.read',
+  'account-waf.write',
+  'request-tracer.read',
+  'reports-application-security-report.read',
+  'bot-management-feedback.read',
+  'bot-management-feedback.write',
+  'bot-management.read',
+  'bot-management.write',
+  'http-applications.read',
+  'http-applications.write',
+  'http-ddos-managed-ruleset.read',
+  'http-ddos-managed-ruleset.write',
+  'tag.read',
+  'tag.write',
+  'url-scanner.read',
+  'url-scanner.write',
+  'zone-security-center-insights.read',
+  'zone-security-center-insights.write',
+  'zone-waf.read',
+  'zone-waf.write',
+  'account-custom-error-rules.read',
+  'account-custom-error-rules.write',
+  'account-custom-pages.read',
+  'account-custom-pages.write',
+  'account-rule-lists.read',
+  'account-rule-lists.write',
+  'account-rulesets.read',
+  'account-rulesets.write',
+  'config-settings.read',
+  'config-settings.write',
+  'custom-errors.read',
+  'custom-errors.write',
+  'custom-pages.read',
+  'custom-pages.write',
+  'dynamic-redirect.read',
+  'dynamic-redirect.write',
+  'managed-headers.read',
+  'managed-headers.write',
+  'mass-url-redirects.read',
+  'mass-url-redirects.write',
+  'origin.read',
+  'origin.write',
+  'payments-gateway.read',
+  'payments-gateway.write',
+  'account-ssl-and-certificates.read',
+  'account-ssl-and-certificates.write',
+  'cache.purge',
+  'cache-settings.read',
+  'cache-settings.write',
+  'ssl-and-certificates.read',
+  'ssl-and-certificates.write',
+  'account-api-gateway.write',
+  'account-api-gateway.read',
+  'account-custom-asset.read',
+  'account-custom-asset.write',
+  'account-settings.read',
+  'account-settings.write',
+  'apps.write',
+  'integration.write',
+  'memberships.read',
+  'memberships.write',
+  'notifications.read',
+  'notifications.write',
+  'scim-provisioning.write',
+  'user-details.read',
+  'offline_access'
+]);
+
 export function requestedCloudflareScopes() {
-  const set = new Set();
-  for (const cap of Object.values(CLOUDFLARE_CAPABILITY_SCOPES)) {
-    for (const scope of cap.scopes) set.add(scope);
-  }
-  return [...set];
+  return [...CLOUDFLARE_ALL_SCOPES];
 }
 
 function clean(value) {
@@ -45,14 +232,17 @@ function clean(value) {
 
 export function isFixtureCloudflareCredential(value) {
   const v = clean(value);
-  return v === CLOUDFLARE_FIXTURE_CLIENT_ID || v === CLOUDFLARE_FIXTURE_CLIENT_SECRET;
+  return v === CLOUDFLARE_FIXTURE_CLIENT_ID;
 }
 
 export function resolveCloudflareOAuthClient(env = {}) {
   const clientId = clean(env.CLOUDFLARE_OAUTH_CLIENT_ID);
-  const clientSecret = clean(env.CLOUDFLARE_OAUTH_CLIENT_SECRET);
-  const present = Boolean(clientId && clientSecret);
-  const fixture = isFixtureCloudflareCredential(clientId) || isFixtureCloudflareCredential(clientSecret);
+  // AgentSam Local Studio uses Cloudflare's public PKCE client. It must never
+  // read a client secret: stale Worker secrets would turn an otherwise valid
+  // PKCE exchange into an invalid mixed-auth request. Confidential Cloudflare
+  // clients belong to their owning host adapter, not this connector.
+  const present = Boolean(clientId);
+  const fixture = isFixtureCloudflareCredential(clientId);
   if (!present) {
     return {
       configured: false,
@@ -60,7 +250,7 @@ export function resolveCloudflareOAuthClient(env = {}) {
       fixture: false,
       status: 'not_configured',
       clientIdConfigured: Boolean(clientId),
-      secretConfigured: Boolean(clientSecret),
+      tokenAuthMethod: 'none_pkce',
     };
   }
   return {
@@ -69,20 +259,20 @@ export function resolveCloudflareOAuthClient(env = {}) {
     fixture,
     status: fixture ? 'fixture' : 'ready',
     clientIdConfigured: true,
-    secretConfigured: true,
+    tokenAuthMethod: 'none_pkce',
   };
 }
 
 export function cloudflareConnectionSafeStatus(env = {}, connection = null, ownerId = '') {
   const client = resolveCloudflareOAuthClient(env);
-  const record = connection && connection.ownerId === ownerId ? connection : null;
+  const record = connection && connection.ownerId === ownerId && connection.status === 'connected' ? connection : null;
   return {
     provider: 'cloudflare',
     status: record ? 'connected' : client.status === 'ready' ? 'ready' : client.status,
     configured: client.configured && client.productionReady,
     fixture: client.fixture,
     clientId: client.clientIdConfigured ? 'configured' : 'missing',
-    secret: client.secretConfigured ? 'configured' : 'missing',
+    token_auth_method: client.tokenAuthMethod,
     callbackPath: CLOUDFLARE_CALLBACK_PATH,
     connection: record
       ? {
@@ -113,6 +303,98 @@ export function assertConnectionOwner(connection, ownerId) {
   return connection;
 }
 
+export async function loadCloudflareAccessToken(env, ownerId, options = {}) {
+  if (!env?.DB || !ownerId) return null;
+  const row = await env.DB.prepare(`
+    SELECT connection_id, owner_id, cloudflare_account_id, scopes, status,
+           access_token_encrypted, refresh_token_encrypted, expires_at
+    FROM agentsam_cloudflare_connections
+    WHERE owner_id = ? AND status = 'connected'
+    ORDER BY updated_at DESC LIMIT 1
+  `).bind(ownerId).first();
+  if (!row?.access_token_encrypted || row.owner_id !== ownerId) return null;
+  const { decryptSecret, sealToken } = await import('./vault.js');
+  const aad = `cloudflare-connection:${ownerId}`;
+  let accessToken = await decryptSecret(env, row.access_token_encrypted, aad);
+  let refreshToken = row.refresh_token_encrypted
+    ? await decryptSecret(env, row.refresh_token_encrypted, aad)
+    : '';
+  let expiresAt = Number(row.expires_at || 0) || null;
+  let scopes = row.scopes ? String(row.scopes).split(' ').filter(Boolean) : [];
+  const now = Math.floor(Date.now() / 1000);
+  if (expiresAt && expiresAt <= now + 60) {
+    if (!refreshToken) throw new Error('cloudflare_refresh_token_missing');
+    const refreshParams = new URLSearchParams({
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: String(env.CLOUDFLARE_OAUTH_CLIENT_ID || ''),
+    });
+    const refreshResponse = await (options.fetchImpl || fetch)(CLOUDFLARE_OAUTH_TOKEN_URL, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: refreshParams,
+    });
+    if (!refreshResponse.ok) throw new Error(`cloudflare_token_refresh_failed:${refreshResponse.status}`);
+    const refreshed = await refreshResponse.json();
+    if (!refreshed?.access_token) throw new Error('cloudflare_token_refresh_missing_access_token');
+    accessToken = refreshed.access_token;
+    refreshToken = refreshed.refresh_token || refreshToken;
+    scopes = String(refreshed.scope || row.scopes || '').split(' ').filter(Boolean);
+    expiresAt = refreshed.expires_in ? now + Number(refreshed.expires_in) : null;
+    const [accessEncrypted, refreshEncrypted] = await Promise.all([
+      sealToken(env, accessToken, aad),
+      sealToken(env, refreshToken, aad),
+    ]);
+    await env.DB.prepare(`
+      UPDATE agentsam_cloudflare_connections
+      SET access_token_encrypted = ?, refresh_token_encrypted = ?, scopes = ?,
+          expires_at = ?, status = 'connected', updated_at = unixepoch()
+      WHERE connection_id = ? AND owner_id = ?
+    `).bind(accessEncrypted, refreshEncrypted, scopes.join(' '), expiresAt, row.connection_id, ownerId).run();
+  }
+  return {
+    accessToken,
+    connectionId: row.connection_id,
+    accountId: row.cloudflare_account_id || null,
+    scopes,
+    expiresAt,
+  };
+}
+
+export async function probeCloudflareConnection(env, ownerId, options = {}) {
+  const startedAt = Date.now();
+  const checkedAt = Math.floor(startedAt / 1000);
+  try {
+    const connection = await loadCloudflareAccessToken(env, ownerId, options);
+    if (!connection) return { status: 'auth_error', healthy: false, checked_at: checkedAt, error_code: 'cloudflare_connection_missing' };
+    const response = await (options.fetchImpl || fetch)('https://dash.cloudflare.com/oauth2/userinfo', {
+      headers: { authorization: `Bearer ${connection.accessToken}`, accept: 'application/json' },
+      signal: typeof AbortSignal?.timeout === 'function' ? AbortSignal.timeout(5000) : undefined,
+    });
+    const body = await response.json().catch(() => null);
+    const healthy = response.ok && body?.error == null;
+    return {
+      status: healthy ? 'healthy' : response.status === 401 || response.status === 403 ? 'auth_error' : 'unhealthy',
+      healthy,
+      checked_at: checkedAt,
+      latency_ms: Date.now() - startedAt,
+      http_status: response.status,
+      provider_request_id: response.headers.get('cf-ray') || null,
+      account_id: connection.accountId,
+      scopes: connection.scopes,
+      error_code: healthy
+        ? null
+        : body?.error || (body?.errors?.[0]?.code ? String(body.errors[0].code) : `cloudflare_http_${response.status}`),
+      error_message: healthy ? null : body?.error_description || body?.errors?.[0]?.message || 'Cloudflare OAuth probe failed',
+    };
+  } catch (error) {
+    return {
+      status: 'unreachable', healthy: false, checked_at: checkedAt, latency_ms: Date.now() - startedAt,
+      error_code: 'cloudflare_probe_failed', error_message: String(error?.message || error).slice(0, 240),
+    };
+  }
+}
+
 export function buildAuthorizeUrl({ clientId, redirectUri, state, codeChallenge, scopes }) {
   const params = new URLSearchParams({
     response_type: 'code',

package/packages/connectors/cloudflare/src/owner.js

@@ -1,20 +1,23 @@
 /**
- * Cloudflare connection ownership is derived from authenticated AgentSam session.
+ * Cloudflare connection ownership is derived from the REAL AgentSam identity
+ * session (packages/identity — the same `session` cookie set by
+ * /api/auth/login and every OAuth login callback). This previously
+ * hand-rolled its own cookie name (`agentsam_session`) and session table
+ * names (`agentsam_sessions`/`sessions`/`identity_sessions`) that never
+ * matched the actual identity system (cookie name `session`, sessions
+ * resolved via identity.sessionFromRequest against the real adapter) — so
+ * this connector could never actually authenticate anyone. Fixed to call
+ * the real identity service instead of guessing at its storage shape.
+ *
  * Browser-submitted account_id / user_id / owner_id / X-User-Id are never authority.
  */
 
-const UNTRUSTED = new Set(['account_id', 'user_id', 'owner_id', 'workspace_id']);
+import { createIdentityService, createCloudflareD1Adapter } from '../../../identity/src/server/worker-router.js';
+import { fetchIamProfile } from '../../../identity/src/providers/iam/profile.js';
+import { normalizeIamIdentity } from '../../../identity/src/providers/iam/mapper.js';
+import { resolveIamIssuer } from '../../../identity/src/contracts/auth-config.js';
 
-export function extractSessionToken(request) {
-  const auth = request.headers.get('authorization') || '';
-  if (/^bearer\s+/i.test(auth)) {
-    const token = auth.replace(/^bearer\s+/i, '').trim();
-    if (token && !token.startsWith('cf_') && token !== 'sillynotreal-secret') return token;
-  }
-  const cookie = request.headers.get('cookie') || '';
-  const match = cookie.match(/(?:^|;\s*)agentsam_session=([^;]+)/);
-  return match ? decodeURIComponent(match[1]).trim() : '';
-}
+const UNTRUSTED = new Set(['account_id', 'user_id', 'owner_id', 'workspace_id']);
 
 export function rejectUntrustedOwnerHints(request, url, body = {}) {
   const headerUser = (request.headers.get('x-user-id') || '').trim();
@@ -36,40 +39,40 @@ export function rejectUntrustedOwnerHints(request, url, body = {}) {
 
 export async function resolveAuthenticatedOwner(request, env, url, body) {
   rejectUntrustedOwnerHints(request, url, body);
-  const sessionToken = extractSessionToken(request);
-  if (!sessionToken) {
+  // Test/portable adapters may expose an in-memory session map. Keep this
+  // compatibility lane deliberately opt-in; production authority is D1.
+  const fixtureToken = (request.headers.get('authorization') || '').replace(/^Bearer\s+/i, '').trim();
+  const fixtureCookie = (request.headers.get('cookie') || '').match(/(?:^|;\s*)agentsam_session=([^;]+)/)?.[1] || '';
+  if (env?.fixtureSessions instanceof Map) {
+    const fixtureOwner = env.fixtureSessions.get(fixtureToken || fixtureCookie);
+    if (fixtureOwner) return String(fixtureOwner);
+  }
+  if (!env?.DB) {
     const err = new Error('unauthenticated');
     err.code = 'unauthenticated';
     throw err;
   }
-  if (env?.sessions instanceof Map) {
-    const owner = env.sessions.get(sessionToken);
-    if (!owner) {
-      const err = new Error('unauthenticated');
-      err.code = 'unauthenticated';
-      throw err;
-    }
-    return String(owner);
-  }
-  if (env?.DB?.prepare) {
-    const tables = [
-      ['agentsam_sessions', 'session_token', 'user_id'],
-      ['sessions', 'id', 'user_id'],
-      ['identity_sessions', 'session_token', 'user_id'],
-    ];
-    for (const [table, tokenCol, userCol] of tables) {
-      try {
-        const row = await env.DB.prepare(
-          `SELECT ${userCol} AS user_id FROM ${table} WHERE ${tokenCol} = ? LIMIT 1`,
-        )
-          .bind(sessionToken)
-          .first();
-        if (row?.user_id) return String(row.user_id);
-      } catch {
-        // table may not exist yet
-      }
+  const adapter = createCloudflareD1Adapter(env.DB);
+  const identity = createIdentityService({ adapter, env });
+  const ctx = await identity.sessionFromRequest(request);
+  if (ctx?.user?.id) return String(ctx.user.id);
+
+  // Native CLI OAuth returns a bearer access token rather than a browser
+  // cookie. Resolve that token through IAM userinfo, then map the verified
+  // IAM subject to the local auth user. No caller-supplied owner id is used.
+  const bearer = (request.headers.get('authorization') || '').replace(/^Bearer\s+/i, '').trim();
+  if (bearer) {
+    const profile = await fetchIamProfile({
+      issuer: resolveIamIssuer(env),
+      accessToken: bearer,
+    });
+    const identityProfile = profile ? normalizeIamIdentity(profile) : null;
+    if (identityProfile?.subject) {
+      const user = await adapter.findUserByProvider('iam', identityProfile.subject);
+      if (user?.id) return String(user.id);
     }
   }
+
   const err = new Error('unauthenticated');
   err.code = 'unauthenticated';
   throw err;