@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.4

package/src/commands/whoami.js

@@ -39,6 +39,20 @@ function safeTerminalContext(value = {}) {
   };
 }
 
+function capabilityProbe(credentials = []) {
+  const has = (provider) => credentials.some((row) => row.provider === provider && row.configured);
+  return {
+    repository: { available: true },
+    database: { available: true, drivers: ['sqlite'] },
+    vectors: { available: true, drivers: ['local_exact'] },
+    models: {
+      available: has('openai') || has('anthropic') || has('gemini') || has('xai') || has('cursor') || has('cloudflare'),
+      configuredProviders: ['openai', 'anthropic', 'gemini', 'xai', 'cursor', 'cloudflare'].filter((p) => has(p)).length,
+    },
+    deploy: { available: has('cloudflare') },
+  };
+}
+
 export async function collectWhoami(options = {}) {
   const env = options.env || process.env;
   const apiKey = resolveAccountApiKey({ env, explicit: options.token || '', home: options.home });
@@ -57,10 +71,22 @@ export async function collectWhoami(options = {}) {
   const credentials = listProviderCredentialStatus({ env, home: options.home });
 
   const base = {
-    schema_version: 2,
+    schema_version: 3,
+    ok: false,
+    command_id: 'whoami',
+    risk: 'read',
+    exit_code: 1,
+    format: 'json',
+    loggedIn: false,
     authenticated: false,
+    authType: null,
+    authLabel: null,
     authority: 'inneranimalmedia',
     identity: null,
+    account: null,
+    credential: null,
+    tokenPermissions: [],
+    capabilities: capabilityProbe(credentials),
     active_auth: {
       configured: Boolean(active.value || active.error),
       kind: active.kind || null,
@@ -92,14 +118,52 @@ export async function collectWhoami(options = {}) {
       signal: options.signal,
     }));
     const context = await loader(active.value);
+    const authType = context?.auth_type || (active.kind === 'api_key' ? 'api_key' : 'oauth_session');
+    const tokenPermissions = Array.isArray(context?.tokenPermissions)
+      ? context.tokenPermissions
+      : Array.isArray(context?.credential?.scopes)
+        ? context.credential.scopes
+        : [];
+    const authLabel =
+      authType === 'api_key'
+        ? 'AgentSam API Key'
+        : authType === 'oauth_session'
+          ? 'OAuth Session'
+          : String(authType);
+
     return {
       ...base,
+      ok: true,
+      exit_code: 0,
+      loggedIn: true,
       authenticated: true,
+      authType,
+      authLabel,
       identity: {
         user_id: context?.user_id || null,
         account_id: context?.account_id || null,
         email: context?.email || context?.user?.email || null,
       },
+      account: {
+        id: context?.account_id || context?.user_id || null,
+        display_name: context?.email || context?.user?.email || context?.account_id || null,
+      },
+      credential: context?.credential
+        ? {
+            id: context.credential.id || null,
+            name: context.credential.name || null,
+            prefix: context.credential.prefix || null,
+            environment: context.credential.environment || null,
+            status: context.credential.status || 'active',
+            created_at: context.credential.created_at || null,
+            expires_at: context.credential.expires_at || null,
+            last_used_at: context.credential.last_used_at || null,
+          }
+        : active.kind === 'api_key'
+          ? { id: null, name: null, prefix: null, status: 'active' }
+          : null,
+      tokenPermissions,
+      capabilities: capabilityProbe(credentials),
       active_auth: { ...base.active_auth, valid: true, error: null },
       api_key: active.kind === 'api_key' ? { ...base.api_key, valid: true, error: null } : base.api_key,
       cloudflare_connected: context?.cloudflare?.ok === true,
@@ -110,10 +174,6 @@ export async function collectWhoami(options = {}) {
     };
   } catch (error) {
     const rawMessage = error?.message || String(error);
-    // error.status/endpoint come from getJson (src/lib/core-client.js) when
-    // the failure was an HTTP response -- previously discarded, now kept so
-    // "Unauthorized" tells you WHERE it came from instead of just that it
-    // happened.
     const message = error?.status
       ? `${rawMessage} (HTTP ${error.status} from ${error.endpoint || 'server'})`
       : rawMessage;
@@ -127,12 +187,21 @@ export async function collectWhoami(options = {}) {
 
 export function renderWhoami(status) {
   const lines = ['', '  Agent Sam · whoami', ''];
-  if (status.authenticated) {
+  if (status.authenticated || status.loggedIn) {
     lines.push('  authenticated  yes');
-    lines.push(`  authority      ${status.authority}`);
-    if (status.identity?.email) lines.push(`  email          ${status.identity.email}`);
-    if (status.identity?.account_id) lines.push(`  account        ${status.identity.account_id}`);
-    if (status.identity?.user_id) lines.push(`  user           ${status.identity.user_id}`);
+    lines.push(`  authType       ${status.authLabel || status.authType || status.active_auth?.kind || 'unknown'}`);
+    if (status.account?.display_name || status.identity?.email) {
+      lines.push(`  account        ${status.account?.display_name || status.identity?.email}`);
+    }
+    if (status.account?.id || status.identity?.account_id) {
+      lines.push(`  account id     ${status.account?.id || status.identity?.account_id}`);
+    }
+    if (status.credential?.name || status.credential?.prefix) {
+      lines.push(`  credential     ${[status.credential.name, status.credential.prefix].filter(Boolean).join(' · ')}`);
+    }
+    if (status.tokenPermissions?.length) {
+      lines.push(`  permissions    ${status.tokenPermissions.join(', ')}`);
+    }
     lines.push(`  active auth    ${status.active_auth?.kind || 'unknown'} · ${status.active_auth?.source || 'runtime'}`);
   } else {
     lines.push('  authenticated  no');
@@ -141,19 +210,22 @@ export function renderWhoami(status) {
     if (status.active_auth?.error) lines.push(`  error          ${status.active_auth.error}`);
     lines.push('');
     if (status.browser_session?.configured && status.active_auth?.error) {
-      // A session file exists locally but the server rejected it on this
-      // call -- that's not "not logged in", it's a rejected token. Say so
-      // plainly instead of leaving the person to guess why "stored" didn't
-      // mean "working".
       lines.push('  tip            A login session is saved locally, but the server rejected it on this');
-      lines.push('                 request (see error above). This is not the same as never having logged');
-      lines.push('                 in -- run `agentsam login` again for a fresh token, or `agentsam whoami --json`');
-      lines.push('                 for the full response.');
+      lines.push('                 request (see error above). Run `agentsam login` again, or');
+      lines.push('                 `agentsam whoami --json` for the full response.');
     } else if (!status.api_key?.configured) {
-      lines.push('  tip            Run `agentsam login` to authenticate interactively.');
+      lines.push('  tip            Run `agentsam login` then `agentsam api-key create --store keychain --activate`.');
     }
   }
   lines.push('');
+  lines.push('  Capabilities');
+  const caps = status.capabilities || {};
+  for (const [key, value] of Object.entries(caps)) {
+    const available = value?.available === true ? 'yes' : 'no';
+    const extra = value?.configuredProviders != null ? ` · providers ${value.configuredProviders}` : '';
+    lines.push(`  ${key.padEnd(14)} ${available}${extra}`);
+  }
+  lines.push('');
   lines.push('  Provider credentials');
   for (const row of status.provider_credentials || []) {
     const state = row.configured ? 'available' : row.error ? `blocked (${row.error})` : 'not configured';

package/src/go/build.js

@@ -1,34 +1,164 @@
+import { createHash, randomBytes } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { gitEvidence } from '../knowledge/config.js';
+import { tryResolveGitContext } from '../repository/index.js';
 import { writeGoBuildReceipt } from './receipts.js';
 
-export function runGoTests(runtimeRoot, { spawn = spawnSync } = {}) {
-  const res = spawn('go', ['test', './...'], { cwd: runtimeRoot, encoding: 'utf8' });
+const NATIVE_PROBE_RUNNER = fileURLToPath(new URL('./native-probe-runner.mjs', import.meta.url));
+
+function ldflags(commit, source, builtAt) {
+  return [
+    '-s',
+    '-w',
+    '-X github.com/inneranimalmedia/agentsam-go-worker/internal/health.BuildCommit=' + (commit || ''),
+    '-X github.com/inneranimalmedia/agentsam-go-worker/internal/health.BuildSource=' + (source || ''),
+    '-X github.com/inneranimalmedia/agentsam-go-worker/internal/health.BuildTime=' + (builtAt || ''),
+  ].join(' ');
+}
+
+function readPackage(productRoot) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(productRoot, 'package.json'), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function sourceTreeDigest(runtimeRoot) {
+  const files = [];
+  const walk = (dir) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (entry.name.startsWith('.agentsam-build') || entry.name === '.agentsam-built-at') continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.name === 'go.mod' || entry.name.endsWith('.go')) files.push(full);
+    }
+  };
+  walk(runtimeRoot);
+  files.sort();
+  const hash = createHash('sha256');
+  for (const file of files) {
+    hash.update(path.relative(runtimeRoot, file));
+    hash.update('\0');
+    hash.update(fs.readFileSync(file));
+    hash.update('\0');
+  }
+  return 'sha256:' + hash.digest('hex');
+}
+
+export function repositoryIdFromGitContext(context = null) {
+  if (!context?.repoFullName) return null;
+
+  const host = String(context.remoteHost || '').trim().toLowerCase();
+  const repoFullName = String(context.repoFullName).trim();
+
+  if (!repoFullName) return null;
+
+  // GitHub repository identity is canonical and case-insensitive.
+  if (host === 'github.com') {
+    return `github:${repoFullName.toLowerCase()}`;
+  }
+
+  // Preserve provider-qualified identity for non-GitHub remotes.
+  return host ? `${host}:${repoFullName}` : `git:${repoFullName}`;
+}
+
+export function resolveBuildSource({ productRoot, runtimeRoot, repositoryRoot } = {}) {
+  const git = gitEvidence(repositoryRoot || productRoot);
+  const pkg = readPackage(productRoot);
+  const treeDigest = sourceTreeDigest(runtimeRoot);
+  const repositoryContext = tryResolveGitContext({
+    cwd: repositoryRoot || productRoot,
+  });
+  let identity = null;
+  if (git.commit) identity = 'git:' + git.commit;
+  else if (pkg?.name && pkg?.version) identity = 'npm:' + pkg.name + '@' + pkg.version;
+  else identity = 'tree:' + treeDigest;
+
   return {
-    ok: res.status === 0,
-    status: res.status,
-    stdout: res.stdout || '',
-    stderr: res.stderr || '',
+    identity,
+    commit: git.commit || null,
+    branch: git.branch || null,
+    dirty: Boolean(git.dirty),
+    package_name: pkg?.name || null,
+    package_version: pkg?.version || null,
+    tree_digest: treeDigest,
+    repository_id: git.commit ? repositoryIdFromGitContext(repositoryContext) : null,
+  };
+}
+
+export function portableReceiptPath(value, {
+  repositoryRoot = null,
+  stateRoot = null,
+  productRoot = null,
+  packageName = null,
+} = {}) {
+  if (!value) return null;
+
+  const absolute = path.resolve(value);
+
+  const candidate = (root) => {
+    if (!root) return null;
+    const rel = path.relative(path.resolve(root), absolute);
+    if (!rel || rel === '.') return '.';
+    if (rel.startsWith('..' + path.sep) || rel === '..' || path.isAbsolute(rel)) {
+      return null;
+    }
+    return rel.split(path.sep).join('/');
   };
+
+  const repoRelative = candidate(repositoryRoot);
+  if (repoRelative) return repoRelative;
+
+  const stateRelative = candidate(stateRoot);
+  if (stateRelative) return stateRelative;
+
+  const productRelative = candidate(productRoot);
+  if (productRelative) {
+    const prefix = packageName
+      ? `package:${packageName}`
+      : 'package';
+    return `${prefix}/${productRelative}`;
+  }
+
+  // Never put an arbitrary absolute user path into a portable receipt.
+  return path.basename(absolute);
+}
+
+export function runGoTests(runtimeRoot, { spawn = spawnSync } = {}) {
+  const res = spawn('go', ['test', './...'], { cwd: runtimeRoot, encoding: 'utf8' });
+  return { ok: res.status === 0, status: res.status, stdout: res.stdout || '', stderr: res.stderr || '' };
 }
 
 export function runGoVet(runtimeRoot, { spawn = spawnSync } = {}) {
   const res = spawn('go', ['vet', './...'], { cwd: runtimeRoot, encoding: 'utf8' });
-  return {
-    ok: res.status === 0,
-    status: res.status,
-    stdout: res.stdout || '',
-    stderr: res.stderr || '',
-  };
+  return { ok: res.status === 0, status: res.status, stdout: res.stdout || '', stderr: res.stderr || '' };
 }
 
-export function runGoBuild(runtimeRoot, { outDir = null, spawn = spawnSync } = {}) {
+export function runGoBuild(runtimeRoot, {
+  outDir = null,
+  commit = '',
+  source = '',
+  builtAt = '',
+  spawn = spawnSync,
+} = {}) {
   const binDir = outDir || path.join(runtimeRoot, '..', '.agentsam', 'go-build');
   fs.mkdirSync(binDir, { recursive: true });
-  const out = path.join(binDir, 'agentsam-go-worker');
-  const res = spawn('go', ['build', '-o', out, './cmd/server'], { cwd: runtimeRoot, encoding: 'utf8' });
+  const identityHash = createHash('sha256').update(source || commit || 'dev').digest('hex').slice(0, 12);
+  const suffix = identityHash + '-' + process.pid + '-' + randomBytes(3).toString('hex');
+  const out = path.join(binDir, 'agentsam-go-worker-' + suffix);
+  const res = spawn('go', [
+    'build',
+    '-trimpath',
+    '-ldflags',
+    ldflags(commit, source, builtAt),
+    '-o',
+    out,
+    './cmd/server',
+  ], { cwd: runtimeRoot, encoding: 'utf8' });
   return {
     ok: res.status === 0,
     status: res.status,
@@ -38,39 +168,96 @@ export function runGoBuild(runtimeRoot, { outDir = null, spawn = spawnSync } = {
   };
 }
 
+export function sha256File(file) {
+  const hash = createHash('sha256');
+  hash.update(fs.readFileSync(file));
+  return 'sha256:' + hash.digest('hex');
+}
+
+export function runNativeRuntimeProbe(binary, {
+  expectedSource = '',
+  expectedCommit = '',
+  spawn = spawnSync,
+} = {}) {
+  if (!binary || !fs.existsSync(binary)) return { ok: false, error: 'binary_missing', results: {} };
+  const res = spawn(process.execPath, [NATIVE_PROBE_RUNNER, binary, expectedSource || '', expectedCommit || ''], {
+    encoding: 'utf8',
+    maxBuffer: 4 * 1024 * 1024,
+  });
+  let parsed = null;
+  try { parsed = JSON.parse(res.stdout || '{}'); } catch {}
+  return {
+    ok: res.status === 0 && parsed?.ok === true,
+    status: res.status,
+    ...(parsed || {}),
+    stdout: parsed ? '' : (res.stdout || ''),
+    stderr: ((parsed?.stderr || '') + (res.stderr || '')).trim(),
+  };
+}
+
 /**
- * Build + test the discovered Go runtime and emit a build receipt.
+ * Build + test + boot the discovered Go runtime and emit deployment-grade
+ * source/artifact evidence. Git is authoritative in a maintainer checkout;
+ * an immutable npm package name/version is authoritative in distribution mode.
  */
-export function buildGoProduct({ productRoot, runtimeRoot, repositoryRoot, dryRun = false } = {}) {
+export function buildGoProduct({
+  productRoot,
+  runtimeRoot,
+  repositoryRoot,
+  stateRoot = productRoot,
+  dryRun = false,
+} = {}) {
   if (!runtimeRoot || !fs.existsSync(path.join(runtimeRoot, 'go.mod'))) {
     throw new Error('go_runtime_missing');
   }
+
+  const source = resolveBuildSource({ productRoot, runtimeRoot, repositoryRoot });
+  const builtAt = new Date().toISOString();
+
   const tests = dryRun ? { ok: true, skipped: true } : runGoTests(runtimeRoot);
   if (!tests.ok) {
     const err = new Error('go_test_failed');
     err.detail = tests;
     throw err;
   }
+
   const vet = dryRun ? { ok: true, skipped: true } : runGoVet(runtimeRoot);
   if (!vet.ok) {
     const err = new Error('go_vet_failed');
     err.detail = vet;
     throw err;
   }
-  const build = dryRun ? { ok: true, skipped: true, binary: null } : runGoBuild(runtimeRoot);
+
+  const build = dryRun
+    ? { ok: true, skipped: true, binary: null }
+    : runGoBuild(runtimeRoot, {
+        outDir: path.join(stateRoot, '.agentsam', 'go-build'),
+        commit: source.commit,
+        source: source.identity,
+        builtAt,
+      });
   if (!build.ok) {
     const err = new Error('go_build_failed');
     err.detail = build;
     throw err;
   }
 
-  const git = gitEvidence(repositoryRoot || productRoot);
+  const probe = dryRun
+    ? { ok: true, skipped: true, results: {} }
+    : runNativeRuntimeProbe(build.binary, {
+        expectedSource: source.identity,
+        expectedCommit: source.commit,
+      });
+  if (!probe.ok) {
+    const err = new Error('go_runtime_probe_failed');
+    err.detail = probe;
+    throw err;
+  }
+
   let goVersion = null;
   try {
     goVersion = spawnSync('go', ['env', 'GOVERSION'], { encoding: 'utf8' }).stdout?.trim() || null;
-  } catch {
-    goVersion = null;
-  }
+  } catch {}
 
   const receipt = {
     schema: 'agentsam.go-build-receipt.v1',
@@ -78,31 +265,34 @@ export function buildGoProduct({ productRoot, runtimeRoot, repositoryRoot, dryRu
     runtime: {
       language: 'go',
       version: goVersion,
-      module_root: runtimeRoot,
-    },
-    source: {
-      repository_id: path.basename(repositoryRoot || productRoot),
-      commit: git.commit,
-      branch: git.branch,
-      dirty: git.dirty,
+      module_root: portableReceiptPath(runtimeRoot, {
+        repositoryRoot,
+        stateRoot,
+        productRoot,
+        packageName: source.package_name,
+      }),
     },
+    source,
     artifact: {
       type: build.binary ? 'binary' : 'none',
-      path: build.binary,
-      digest: null,
+      path: portableReceiptPath(build.binary, {
+        repositoryRoot,
+        stateRoot,
+        productRoot,
+        packageName: source.package_name,
+      }),
+      digest: build.binary ? sha256File(build.binary) : null,
     },
     tests: {
       go_test: Boolean(tests.ok),
       go_vet: Boolean(vet.ok),
-      runtime_probe: false,
-    },
-    target: {
-      provider: 'local',
-      kind: 'build',
+      runtime_probe: Boolean(probe.ok),
     },
-    built_at: new Date().toISOString(),
+    probe,
+    target: { provider: 'local', kind: 'build' },
+    built_at: builtAt,
   };
 
-  const receiptPath = writeGoBuildReceipt(productRoot, receipt);
-  return { receipt, receiptPath, tests, vet, build };
+  const receiptPath = writeGoBuildReceipt(stateRoot, receipt);
+  return { receipt, receiptPath, tests, vet, build, probe, source };
 }