@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/src/commands/plugins.js

@@ -0,0 +1,175 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { AGENTSAM_MCP_PLUGIN_MANIFEST, normalizePluginKey } from '../plugins/index.js';
+import { authenticateViaBrowser } from '../lib/auth.js';
+import { promptToOpenUrl } from '../lib/open-url.js';
+import { readAccountSession, resolveAccountApiKey, saveAccountSession } from '../lib/account-session.js';
+
+const CATALOG = Object.freeze({ 'agentsam-mcp': AGENTSAM_MCP_PLUGIN_MANIFEST });
+const PLUGIN_MIGRATION = '0001_agentsam_plugin_runtime.sql';
+
+function statePath(cwd) { return path.join(path.resolve(cwd), '.agentsam', 'plugins.json'); }
+function readState(cwd) {
+  const filename = statePath(cwd);
+  if (!fs.existsSync(filename)) return { schema_version: 1, plugins: {} };
+  const parsed = JSON.parse(fs.readFileSync(filename, 'utf8'));
+  return { schema_version: 1, plugins: parsed?.plugins || {} };
+}
+
+function installMigration(cwd) {
+  const source = new URL(`../../migrations/d1/${PLUGIN_MIGRATION}`, import.meta.url);
+  const migrationsDir = path.join(path.resolve(cwd), 'migrations', 'd1');
+  const destination = path.join(migrationsDir, PLUGIN_MIGRATION);
+  fs.mkdirSync(migrationsDir, { recursive: true });
+  if (!fs.existsSync(destination)) fs.copyFileSync(source, destination);
+  return path.relative(path.resolve(cwd), destination);
+}
+function parse(argv) {
+  const out = {
+    action: argv[0] || 'list', key: '', cwd: process.cwd(), json: false,
+    origin: process.env.AGENTSAM_ORIGIN || process.env.AGENTSAM_API_ORIGIN || 'https://agentsam.inneranimalmedia.com',
+    timeoutMs: 180_000, noOpen: false,
+  };
+  for (let i = 1; i < argv.length; i += 1) {
+    if (argv[i] === '--cwd') out.cwd = argv[++i] || out.cwd;
+    else if (argv[i] === '--json') out.json = true;
+    else if (argv[i] === '--origin') out.origin = argv[++i] || out.origin;
+    else if (argv[i] === '--timeout') out.timeoutMs = Math.max(1_000, Number(argv[++i]) || out.timeoutMs);
+    else if (argv[i] === '--no-open') out.noOpen = true;
+    else if (!out.key) out.key = argv[i];
+    else throw new Error(`unknown plugins option:${argv[i]}`);
+  }
+  return out;
+}
+
+function writeJson(value) { process.stdout.write(`${JSON.stringify(value, null, 2)}\n`); }
+
+async function resolveCliBearer(opts) {
+  const apiKey = resolveAccountApiKey();
+  if (apiKey.value) return { token: apiKey.value, source: apiKey.source };
+  let session = readAccountSession();
+  if (!session?.access_token) {
+    if (opts.json) writeJson({ ok: false, step: 'account_login_required' });
+    else console.log('\n  No AgentSam account session found. Opening account sign-in first.\n');
+    session = await authenticateViaBrowser();
+    if (!readAccountSession()) saveAccountSession(session);
+  }
+  if (!session?.access_token) throw new Error('account_login_did_not_return_access_token');
+  return { token: session.access_token, source: 'agentsam_browser_oauth' };
+}
+
+async function fetchConnector(opts, token, pathname, init = {}) {
+  const origin = String(opts.origin).replace(/\/$/, '');
+  const headers = new Headers(init.headers || {});
+  headers.set('accept', 'application/json');
+  headers.set('authorization', `Bearer ${token}`);
+  return fetch(`${origin}${pathname}`, { ...init, headers });
+}
+
+async function connectPlugin(opts, key) {
+  if (key !== 'agentsam-mcp') throw new Error(`plugin_connect_not_supported:${key}`);
+  const state = readState(opts.cwd);
+  if (!state.plugins[key]) {
+    state.plugins[key] = { plugin_key: key, installed_at: new Date().toISOString(), manifest: CATALOG[key] };
+    fs.mkdirSync(path.dirname(statePath(opts.cwd)), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(statePath(opts.cwd), `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+    installMigration(opts.cwd);
+    if (!opts.json) console.log(`\n  Installed @${key}.`);
+  }
+
+  const { token } = await resolveCliBearer(opts);
+  const start = await fetchConnector(opts, token, '/api/connections/cloudflare/start');
+  const startBody = await start.json().catch(() => ({}));
+  if (!start.ok || !startBody.authorize_url) {
+    throw new Error(`plugin_connect_start_failed:${startBody.error || start.status}`);
+  }
+
+  if (!opts.json) {
+    console.log('\n  Connect @agentsam-mcp to Cloudflare');
+    console.log('  Your browser will ask you to approve the requested Cloudflare access.');
+  }
+  if (opts.noOpen) {
+    process.stdout.write(`${startBody.authorize_url}\n`);
+  } else {
+    await promptToOpenUrl(startBody.authorize_url, {
+      heading: 'Open Cloudflare authorization:',
+      prompt: 'Press ENTER to open Cloudflare in your browser, or copy the URL above.',
+    });
+  }
+
+  const started = Date.now();
+  let statusBody = {};
+  while (Date.now() - started < opts.timeoutMs) {
+    const status = await fetchConnector(opts, token, '/api/connections/cloudflare');
+    statusBody = await status.json().catch(() => ({}));
+    if (statusBody?.status === 'connected' || statusBody?.connection?.status === 'connected') break;
+    if (!opts.json) process.stdout.write('.');
+    await new Promise((resolve) => setTimeout(resolve, 2_000));
+  }
+  const connected = statusBody?.status === 'connected' || statusBody?.connection?.status === 'connected';
+  const result = {
+    ok: connected,
+    action: 'connect',
+    plugin_key: key,
+    provider: 'cloudflare',
+    status: connected ? 'connected' : (statusBody?.status || 'pending'),
+    cloudflare_account_id: statusBody?.cloudflareAccountId
+      || statusBody?.connection?.cloudflareAccountId
+      || statusBody?.connection?.cloudflare_account_id
+      || null,
+    scopes: statusBody?.scopes || statusBody?.connection?.scopes || [],
+  };
+  if (opts.json) writeJson(result);
+  else console.log(connected ? `\n\n  ✓ Connected @${key}\n` : `\n\n  Authorization is still pending. Run \'agentsam plugins status @${key}\' to check again.\n`);
+  return result;
+}
+
+async function statusPlugin(opts, key) {
+  if (key !== 'agentsam-mcp') throw new Error(`unknown_plugin:${key}`);
+  const { token } = await resolveCliBearer(opts);
+  const response = await fetchConnector(opts, token, '/api/connections/cloudflare');
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(`plugin_status_failed:${body.error || response.status}`);
+  const result = { ok: true, plugin_key: key, provider: 'cloudflare', ...body };
+  if (opts.json) writeJson(result);
+  else console.log(`\n  ${result.status === 'connected' ? '✓' : '○'} @${key}  ${result.status || 'not_configured'}\n`);
+  return result;
+}
+
+export async function runPlugins(argv = []) {
+  const opts = parse(argv);
+  if (opts.action === 'list') {
+    const state = readState(opts.cwd);
+    const rows = Object.values(CATALOG).map((manifest) => ({
+      plugin_key: manifest.plugin_key,
+      display_name: manifest.display_name,
+      description: manifest.description,
+      installed: Boolean(state.plugins[manifest.plugin_key]),
+      tools: manifest.tools.map((tool) => tool.tool_key),
+    }));
+    if (opts.json) process.stdout.write(`${JSON.stringify(rows, null, 2)}\n`);
+    else for (const row of rows) console.log(`  ${row.installed ? '✓' : '○'} @${row.plugin_key.padEnd(16)} ${row.description}`);
+    return rows;
+  }
+  const key = normalizePluginKey(opts.key || 'agentsam-mcp');
+  const manifest = CATALOG[key];
+  if (!manifest) throw new Error(`unknown_plugin:${key}`);
+  if (opts.action === 'connect') return connectPlugin(opts, key);
+  if (opts.action === 'status') return statusPlugin(opts, key);
+  if (opts.action !== 'install' && opts.action !== 'remove') throw new Error(`unknown plugins action:${opts.action}`);
+  const state = readState(opts.cwd);
+  let migration = null;
+  if (opts.action === 'install') {
+    state.plugins[key] = { plugin_key: key, installed_at: new Date().toISOString(), manifest };
+    migration = installMigration(opts.cwd);
+  } else {
+    delete state.plugins[key];
+  }
+  const filename = statePath(opts.cwd);
+  fs.mkdirSync(path.dirname(filename), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(filename, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+  const result = { ok: true, action: opts.action, plugin_key: key, state_file: '.agentsam/plugins.json', migration };
+  if (opts.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  else console.log(`\n${opts.action === 'install' ? 'Installed' : 'Removed'} @${key}\n  state: ${result.state_file}${migration ? `\n  migration: ${migration}` : ''}\n`);
+  return result;
+}

package/src/commands/preferences.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { cancel, confirm, intro, isCancel, outro, select, text } from '@clack/prompts';
 import { collectModelsStatus } from './models.js';
-import { getModelRecord } from '../models/index.js';
+import { getModelRecord, mergeModelReference } from '../models/index.js';
 import { detectCliProject, readCliPreferences, writeCliPreferences } from '../lib/cli-preferences.js';
 import { readAccountSession } from '../lib/account-session.js';
 
@@ -42,6 +42,7 @@ export function availableShells(env = process.env) {
 export function modelOptions(status) {
   const options = [{ value: 'auto', label: 'Automatic', hint: 'runtime chooses from this credential\'s verified inventory', model: null }];
   for (const model of status.availableModels || []) {
+    if (model.provider === 'openai' && model.capabilities?.agent_runtime !== true) continue;
     const context = Number(model.context_window) > 0 ? ` · ctx ${Math.round(Number(model.context_window) / 1000)}k` : ' · ctx unknown';
     options.push({
       value: model.model_key,
@@ -62,22 +63,36 @@ export function modelOptions(status) {
       },
     });
   }
+  options.push({
+    value: '__configure_provider__',
+    label: '+ Configure an AI Provider',
+    hint: 'Add OpenAI, Anthropic, Gemini, Cursor, or Grok API key',
+    model: null,
+  });
   return options;
 }
 
 function resolvedModel(modelPreference, modelSnapshot) {
-  if (modelSnapshot?.model_key === modelPreference) return modelSnapshot;
+  if (modelSnapshot?.model_key === modelPreference) return mergeModelReference(modelSnapshot);
   return getModelRecord(modelPreference);
 }
 
 function reasoningOptions(modelPreference, modelSnapshot) {
   const record = resolvedModel(modelPreference, modelSnapshot);
   if (!record) return [{ value: 'auto', label: 'Automatic', hint: 'runtime/provider default' }];
-  return record.reasoning_efforts.map((value) => ({
-    value,
-    label: value === 'xhigh' ? 'Extra high' : value === 'max' ? 'Max' : value[0].toUpperCase() + value.slice(1),
-    hint: value === 'low' ? 'lighter reasoning' : value === 'max' ? 'highest supported reasoning depth' : undefined,
-  }));
+  const providerDefault = record.default_reasoning_effort || 'provider default';
+  return [
+    { value: 'auto', label: 'Automatic', hint: 'omit reasoning.effort · provider default ' + providerDefault },
+    ...record.reasoning_efforts.map((value) => ({
+      value,
+      label: value === 'xhigh' ? 'Extra high' : value === 'max' ? 'Max' : value[0].toUpperCase() + value.slice(1),
+      hint: value === record.default_reasoning_effort
+        ? 'provider default'
+        : value === 'low' ? 'lighter reasoning'
+        : value === 'max' ? 'highest supported reasoning depth'
+        : undefined,
+    })),
+  ];
 }
 
 function serviceTierOptions(modelPreference, modelSnapshot) {
@@ -96,8 +111,13 @@ async function promptModelPreferences(identity, existing, options = {}) {
   const models = modelOptions(status);
   const initialModel = models.some((row) => row.value === existing.modelPreference) ? existing.modelPreference : 'auto';
   const modelPreference = stopIfCancelled(await select({ message: 'Model', initialValue: initialModel, options: models.map(({ model, ...row }) => row) }));
+  if (modelPreference === '__configure_provider__') {
+    const { runProviders } = await import('./providers.js');
+    await runProviders([], { interactive: true, ...(options.modelStatusOptions || {}) });
+    return promptModelPreferences(identity, existing, options);
+  }
   const selected = models.find((row) => row.value === modelPreference)?.model || null;
-  const modelSnapshot = selected || (existing.modelSnapshot?.model_key === modelPreference ? existing.modelSnapshot : null);
+  const modelSnapshot = selected || (existing.modelSnapshot?.model_key === modelPreference ? mergeModelReference(existing.modelSnapshot) : null);
 
   const reasoning = reasoningOptions(modelPreference, modelSnapshot);
   const initialReasoning = reasoning.some((row) => row.value === existing.reasoningEffort) ? existing.reasoningEffort : reasoning[0].value;

package/src/commands/product.js

@@ -126,6 +126,18 @@ export async function runCapabilities(argv = []) {
 
 function featureStatePath(cwd) { return path.join(cwd, '.agentsam', 'features.json'); }
 
+function parseAddArgs(argv = []) {
+  const opts = parseCommon(argv);
+  opts.provider = '';
+  opts.schemaProfile = '';
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === '--provider') opts.provider = argv[++i] || '';
+    else if (arg === '--schema' || arg === '--schema-profile') opts.schemaProfile = argv[++i] || '';
+  }
+  return opts;
+}
+
 export function applyPresetSelection(cwd, preset) {
   const filename = projectConfigPath(cwd);
   if (!fs.existsSync(filename)) throw new Error('not_agentsam_project');
@@ -136,31 +148,62 @@ export function applyPresetSelection(cwd, preset) {
 }
 
 export async function runAdd(argv = []) {
-  const opts = parseCommon(argv);
+  const opts = parseAddArgs(argv);
   const id = opts.positionals[0];
   if (!id || id === '--help') {
     const rows = listAddons();
-    console.log(`agentsam add <${rows.map(x => x.id).join('|')}> [--cwd PATH] [--json]`);
+    console.log(`agentsam add <${rows.map(x => x.id).join('|')}> [--cwd PATH] [--provider <id>] [--schema <profile>] [--json]`);
     return null;
   }
   const addon = getAddon(id);
   if (!addon) throw new Error(`unknown_addon:${id}`);
   const cwd = path.resolve(opts.cwd);
   if (!fs.existsSync(projectConfigPath(cwd))) throw new Error('not_agentsam_project');
-  fs.mkdirSync(path.dirname(featureStatePath(cwd)), { recursive: true });
-  let state = { schema_version: 1, features: {} };
-  if (fs.existsSync(featureStatePath(cwd))) state = JSON.parse(fs.readFileSync(featureStatePath(cwd), 'utf8'));
-  state.features ||= {};
-  state.features[addon.id] = { selected: true, capabilities: addon.capabilities, selected_at: new Date().toISOString() };
-  fs.writeFileSync(featureStatePath(cwd), `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+
+  const { writeFeatureSelections } = await import('../features/resolve.js');
+  let state = { schema_version: 2, features: {} };
+  if (fs.existsSync(featureStatePath(cwd))) {
+    state = JSON.parse(fs.readFileSync(featureStatePath(cwd), 'utf8'));
+    state.schema_version = 2;
+    state.features ||= {};
+  }
+
+  /** @type {Record<string, unknown>} */
+  const entry = {
+    selected: true,
+    capabilities: addon.capabilities,
+    selected_at: new Date().toISOString(),
+  };
+  if (addon.id === 'auth') {
+    const { normalizeProviderTemplateId } = await import('../features/resolve.js');
+    entry.provider_template = normalizeProviderTemplateId(opts.provider) || 'inneranimalmedia';
+    if (opts.schemaProfile) entry.schema_profile = opts.schemaProfile;
+  }
+  state.features[addon.id] = entry;
+
+  const written = writeFeatureSelections(cwd, state);
   if (addon.id === 'deploy-cloudflare') {
     const config = readProjectConfig(cwd);
     setDeployTarget(config, 'cloudflare');
     writeProjectConfig(cwd, config);
   }
-  const result = { ok: true, feature: addon.id, capabilities: addon.capabilities, description: addon.description, state_file: '.agentsam/features.json' };
+  const result = {
+    ok: true,
+    feature: addon.id,
+    capabilities: addon.capabilities,
+    description: addon.description,
+    state_file: '.agentsam/features.json',
+    resolved_file: 'generated/.agentsam/features-resolved.json',
+    provider_template: entry.provider_template || null,
+    schema_profile: entry.schema_profile || null,
+    resources: written.snapshot?.features?.[addon.id]?.resources || null,
+  };
   if (opts.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-  else console.log(`\nAdded ${addon.id}\n  ${addon.description}\n  state: ${result.state_file}\n`);
+  else {
+    console.log(`\nAdded ${addon.id}\n  ${addon.description}\n  state: ${result.state_file}`);
+    if (entry.provider_template) console.log(`  provider: ${entry.provider_template}`);
+    console.log(`  resolved: ${result.resolved_file}\n`);
+  }
   return result;
 }
 

package/src/commands/providers.js

@@ -6,6 +6,7 @@ import {
   multiselect,
   outro,
   password,
+  select,
   spinner,
   text,
 } from '@clack/prompts';
@@ -13,6 +14,7 @@ import { getJson } from '../lib/core-client.js';
 import {
   PROVIDER_CREDENTIALS,
   describeProviderCredential,
+  exportProviderEnvProfile,
   listProviderCredentialStatus,
   normalizeProviderId,
   providerCredentialSpec,
@@ -117,15 +119,74 @@ export function renderProviderStatus(rows = []) {
     lines.push(`  ${String(row.label || row.provider).padEnd(18)} ${state}${verification}`);
   }
   lines.push('');
-  lines.push('  Profiles: ~/.agentsam/env.d/<provider>.env · mode 0600');
-  lines.push('  Load one or many: source ~/.agentsam/load-agent-env.sh openai gemini cursor');
+  lines.push('  Storage: Encrypted local vault (AES-256-GCM / OS keychain) — no plaintext on disk.');
+  lines.push('  Optional export for non-AgentSam shells: agentsam providers export <provider>');
   lines.push('');
   return lines.join('\n');
 }
 
-async function promptProviderCredential(provider, options = {}) {
-  const spec = providerCredentialSpec(provider);
-  if (!spec) throw new Error(`unsupported_provider:${provider}`);
+export async function validateAndSaveProviderCredential(provider, secret, options = {}) {
+  const id = normalizeProviderId(provider);
+  const spec = providerCredentialSpec(id);
+  if (!spec) throw new Error(`unsupported_provider:${id}`);
+  const cleanSecret = clean(secret);
+  if (!cleanSecret) return { attempted: false, ok: false, error: 'Credential is required', models: [] };
+  if (spec.tokenPrefix && !cleanSecret.startsWith(spec.tokenPrefix)) {
+    return { attempted: false, ok: false, error: `Expected ${spec.tokenPrefix}…`, models: [] };
+  }
+
+  const accountId = clean(options.accountId);
+  if (id === 'cloudflare' && !accountId) {
+    return { attempted: false, ok: false, error: 'Cloudflare account ID is required', models: [] };
+  }
+
+  const tempCredential = {
+    provider: id,
+    configured: true,
+    value: cleanSecret,
+    account_id: accountId || null,
+  };
+
+  let verification;
+  if (id === 'inneranimalmedia') {
+    verification = await verifyInnerAnimalMedia(tempCredential, options);
+  } else {
+    verification = await discoverProviderModels(id, tempCredential, { fetchImpl: options.fetchImpl || fetch });
+  }
+
+  if (!verification.ok) {
+    return {
+      attempted: true,
+      ok: false,
+      error: verification.error || 'Provider verification failed',
+      models: [],
+      saved: false,
+    };
+  }
+
+  // Key is verified. Persist securely to the OS store + AES-256-GCM vault.
+  // Plaintext shell profiles remain explicit opt-in only.
+  setProviderCredential(id, cleanSecret, {
+    ...options,
+    accountId,
+    writeEnvProfile: options.writeEnvProfile === true,
+  });
+
+  return {
+    attempted: true,
+    ok: true,
+    error: null,
+    models: verification.models || [],
+    model_count: verification.models?.length || 0,
+    identity: verification.identity || null,
+    saved: true,
+  };
+}
+
+export async function promptAndConfigureProvider(provider, options = {}) {
+  const id = normalizeProviderId(provider);
+  const spec = providerCredentialSpec(id);
+  if (!spec) throw new Error(`unsupported_provider:${id}`);
   const promptPassword = options.passwordImpl || password;
   const promptText = options.textImpl || text;
   const secret = await promptPassword({
@@ -140,59 +201,82 @@ async function promptProviderCredential(provider, options = {}) {
   if (isCancel(secret)) return null;
 
   let accountId = '';
-  if (provider === 'cloudflare') {
+  if (id === 'cloudflare') {
     const answer = await promptText({
       message: 'Cloudflare account ID',
       placeholder: '32-character account ID',
       validate(value) {
-        const id = clean(value);
-        if (!id) return 'Cloudflare account ID is required';
-        if (!/^[a-f0-9]{32}$/i.test(id)) return 'Expected a 32-character hexadecimal account ID';
+        const val = clean(value);
+        if (!val) return 'Cloudflare account ID is required';
+        if (!/^[a-f0-9]{32}$/i.test(val)) return 'Expected a 32-character hexadecimal account ID';
       },
     });
     if (isCancel(answer)) return null;
     accountId = clean(answer);
   }
 
-  setProviderCredential(provider, String(secret), { ...options, accountId });
-  return verifyProviderCredential(provider, options);
-}
+  const spin = options.spinnerImpl ? options.spinnerImpl() : spinner();
+  spin.start(`Verifying ${spec.label} API credential`);
 
-async function runInteractiveProviders(options = {}) {
-  const promptMultiselect = options.multiselectImpl || multiselect;
-  const selected = await promptMultiselect({
-    message: 'Providers to configure',
-    required: false,
-    options: providerChoices(options),
+  const result = await validateAndSaveProviderCredential(id, String(secret), {
+    ...options,
+    accountId,
+    writeEnvProfile: options.writeEnvProfile === true,
   });
-  if (isCancel(selected)) {
-    cancel('Provider setup cancelled.');
-    return collectProviderStatus(options);
+
+  if (!result.ok) {
+    spin.stop(`Verification failed: ${result.error || 'invalid key'} · Key was NOT saved`, 1);
+    return { ...result, saved: false };
   }
-  if (!selected.length) return collectProviderStatus(options);
+
+  const count = result.models?.length || 0;
+  const suffix = count ? ` · ${count} models visible` : '';
+  spin.stop(`Verified${suffix} · saved securely to local vault`);
+
+  return { ...result, saved: true };
+}
+
+async function runInteractiveProviders(options = {}) {
+  const promptSelect = options.selectImpl || select;
 
   intro('Agent Sam provider setup');
-  const spin = options.spinnerImpl ? options.spinnerImpl() : spinner();
-  for (const provider of selected) {
-    const result = await promptProviderCredential(provider, options);
-    if (!result) continue;
-    spin.start(`Verifying ${providerCredentialSpec(provider)?.label || provider}`);
-    if (result.ok) {
-      const suffix = result.models?.length ? ` · ${result.models.length} models` : '';
-      spin.stop(`Verified${suffix}`);
-    } else {
-      spin.stop(`Saved · verification failed: ${result.error || 'unknown'}`, 1);
+
+  while (true) {
+    const choices = [
+      ...providerChoices(options),
+      { value: '__done__', label: 'Done / Return to shell', hint: 'finish provider setup' },
+    ];
+
+    const choice = await promptSelect({
+      message: 'Select your preferred provider to continue',
+      options: choices,
+    });
+
+    if (isCancel(choice) || choice === '__done__') {
+      break;
     }
+
+    await promptAndConfigureProvider(choice, options);
   }
+
   outro('Provider setup complete');
   return collectProviderStatus(options);
 }
 
 function parseArgs(argv = []) {
-  const out = { command: 'interactive', provider: '', json: false, verify: false, yes: false, fromEnv: '' };
+  const out = {
+    command: 'interactive',
+    provider: '',
+    json: false,
+    verify: false,
+    yes: false,
+    fromEnv: '',
+    fromStdin: false,
+    exportProfile: true,
+  };
   const args = [...argv];
   if (args[0] && !args[0].startsWith('-')) out.command = args.shift();
-  if (['add', 'set', 'remove', 'verify', 'status'].includes(out.command) && args[0] && !args[0].startsWith('-')) {
+  if (['add', 'set', 'remove', 'verify', 'status', 'export', 'roll'].includes(out.command) && args[0] && !args[0].startsWith('-')) {
     out.provider = normalizeProviderId(args.shift());
   }
   while (args.length) {
@@ -201,6 +285,9 @@ function parseArgs(argv = []) {
     else if (arg === '--verify') out.verify = true;
     else if (arg === '--yes' || arg === '-y') out.yes = true;
     else if (arg === '--from-env') out.fromEnv = clean(args.shift());
+    else if (arg === '--from-stdin') out.fromStdin = true;
+    else if (arg === '--no-export') out.exportProfile = false;
+    else if (arg === '--export') out.exportProfile = true;
     else if (arg === '--help' || arg === '-h') out.command = 'help';
     else throw new Error(`unknown providers option: ${arg}`);
   }
@@ -215,12 +302,17 @@ export async function runProviders(argv = [], options = {}) {
     write([
       'agentsam providers',
       'agentsam providers status [provider] [--verify] [--json]',
-      'agentsam providers add <provider> [--from-env NAME]',
+      'agentsam providers add <provider> [--from-env NAME|--from-stdin] [--no-export]',
+      'agentsam providers roll <provider> [--from-env NAME|--from-stdin]   replace + export env.d',
+      'agentsam providers export <provider>',
       'agentsam providers verify [provider] [--json]',
       'agentsam providers remove <provider> [--yes]',
       '',
       `Providers: ${PROVIDER_ORDER.join(', ')}`,
       '',
+      'Boot load: source ~/.agentsam/load-agent-env.sh <provider…>',
+      '           agentsam env boot-line',
+      '',
     ].join('\n'));
     return;
   }
@@ -271,20 +363,57 @@ export async function runProviders(argv = [], options = {}) {
     return results;
   }
 
-  if (parsed.command === 'add' || parsed.command === 'set') {
+  if (parsed.command === 'add' || parsed.command === 'set' || parsed.command === 'roll') {
     if (!parsed.provider) throw new Error('providers add requires a provider');
-    if (parsed.fromEnv) {
-      const value = clean((options.env || process.env)[parsed.fromEnv]);
-      if (!value) throw new Error(`environment credential missing: ${parsed.fromEnv}`);
-      setProviderCredential(parsed.provider, value, options);
-      return verifyProviderCredential(parsed.provider, options);
+    if (parsed.command === 'roll') {
+      removeProviderCredential(parsed.provider, options);
+    }
+    let secretValue = '';
+    if (parsed.fromStdin) {
+      const chunks = [];
+      for await (const chunk of options.stdin || process.stdin) chunks.push(chunk);
+      secretValue = Buffer.concat(chunks.map((c) => (Buffer.isBuffer(c) ? c : Buffer.from(c)))).toString('utf8').trim();
+      if (!secretValue) throw new Error('stdin credential missing');
+    } else if (parsed.fromEnv) {
+      secretValue = clean((options.env || process.env)[parsed.fromEnv]);
+      if (!secretValue) throw new Error(`environment credential missing: ${parsed.fromEnv}`);
+    }
+    if (secretValue) {
+      const verified = await validateAndSaveProviderCredential(parsed.provider, secretValue, {
+        ...options,
+        writeEnvProfile: parsed.exportProfile,
+      });
+      if (!verified.ok) {
+        throw new Error(`Provider verification failed: ${verified.error}. Credential was not saved.`);
+      }
+      writeLine(write, `  ${parsed.provider} verified · saved${parsed.exportProfile ? ' · env.d exported' : ''}`);
+      if (parsed.exportProfile) {
+        writeLine(write, `  source ~/.agentsam/load-agent-env.sh ${parsed.provider}`);
+      }
+      return verified;
     }
     if (options.interactive === false || !(options.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY))) {
-      throw new Error('providers add requires an interactive terminal or --from-env NAME');
+      throw new Error('providers add requires an interactive terminal, --from-env NAME, or --from-stdin');
     }
-    const result = await promptProviderCredential(parsed.provider, options);
+    const result = await promptAndConfigureProvider(parsed.provider, {
+      ...options,
+      writeEnvProfile: parsed.exportProfile,
+    });
     if (!result) return null;
-    writeLine(write, result.ok ? `  ${parsed.provider} verified` : `  ${parsed.provider} saved · verification failed: ${result.error}`);
+    writeLine(write, result.ok ? `  ${parsed.provider} verified` : `  ${parsed.provider} verification failed: ${result.error}`);
+    if (result.ok && parsed.exportProfile) {
+      writeLine(write, `  source ~/.agentsam/load-agent-env.sh ${parsed.provider}`);
+    }
+    return result;
+  }
+
+  if (parsed.command === 'export') {
+    if (!parsed.provider) throw new Error('providers export requires a provider');
+    const result = exportProviderEnvProfile(parsed.provider, options);
+    writeLine(write, '');
+    writeLine(write, `  Exported ${parsed.provider} profile: ${result.file} (mode 0600)`);
+    writeLine(write, `  Load into external shell: ${result.source_command}`);
+    writeLine(write, '');
     return result;
   }