@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/src/lib/terminal-scopes.js

@@ -0,0 +1,52 @@
+/**
+ * AgentSam API credential terminal scopes (CLI/whoami).
+ * Keep in sync with IAM backend/auth/agentsam-terminal-scopes.js.
+ */
+
+export const TERMINAL_SCOPES = Object.freeze({
+  LOCAL: 'terminal:exec:local',
+  REMOTE: 'terminal:exec:remote',
+  SANDBOX: 'terminal:exec:sandbox',
+  ENROLL: 'terminal:enroll',
+  EXEC_ALL: 'terminal:exec:*',
+});
+
+export const ALL_TERMINAL_SCOPES = Object.freeze(Object.values(TERMINAL_SCOPES));
+
+export function normalizeScopeList(scopes) {
+  if (!Array.isArray(scopes)) return [];
+  return scopes.map((s) => String(s || '').trim()).filter(Boolean);
+}
+
+export function credentialHasScope(scopes, required) {
+  const need = String(required || '').trim();
+  if (!need) return false;
+  const set = new Set(normalizeScopeList(scopes));
+  if (set.has(need)) return true;
+  if (need.startsWith('terminal:exec:') && need !== TERMINAL_SCOPES.EXEC_ALL && set.has(TERMINAL_SCOPES.EXEC_ALL)) {
+    return true;
+  }
+  return false;
+}
+
+export function projectTerminalCapability(scopes = []) {
+  const list = normalizeScopeList(scopes);
+  const local = credentialHasScope(list, TERMINAL_SCOPES.LOCAL);
+  const remote = credentialHasScope(list, TERMINAL_SCOPES.REMOTE);
+  const sandbox = credentialHasScope(list, TERMINAL_SCOPES.SANDBOX);
+  const enroll = credentialHasScope(list, TERMINAL_SCOPES.ENROLL);
+  const available = local || remote || sandbox || enroll;
+  return {
+    available,
+    scopes: list.filter((s) => s.startsWith('terminal:')),
+    lanes: {
+      local,
+      remote,
+      sandbox,
+      enroll,
+    },
+    next: available
+      ? null
+      : 'agentsam api-key create --name terminal --scopes terminal:exec:local,terminal:exec:remote,terminal:exec:sandbox,terminal:enroll --store keychain --activate',
+  };
+}

package/src/lib/whoami-capabilities.js

@@ -0,0 +1,184 @@
+/**
+ * Honest whoami capability projection — driven by credentials + live discovery,
+ * not hardcoded "sqlite / local_exact / 5 providers" stubs.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { collectModelsStatus } from '../commands/models.js';
+import { listProviderCredentialStatus } from './provider-credentials.js';
+import {
+  listCloudflareFeaturePacks,
+  scopesForFeaturePacks,
+} from '../../packages/connectors/cloudflare/src/index.js';
+import { projectTerminalCapability } from './terminal-scopes.js';
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function detectLocalD1Bindings(cwd = process.cwd()) {
+  const names = [];
+  for (const file of ['wrangler.toml', 'wrangler.jsonc', 'wrangler.json']) {
+    const full = path.join(cwd, file);
+    if (!fs.existsSync(full)) continue;
+    try {
+      const text = fs.readFileSync(full, 'utf8');
+      for (const match of text.matchAll(/database_name\s*=\s*["']([^"']+)["']/g)) {
+        names.push(match[1]);
+      }
+      for (const match of text.matchAll(/"database_name"\s*:\s*"([^"]+)"/g)) {
+        names.push(match[1]);
+      }
+    } catch {
+      /* ignore */
+    }
+  }
+  return [...new Set(names)];
+}
+
+function detectHyperdriveHints(cwd = process.cwd()) {
+  const ids = [];
+  for (const file of ['wrangler.toml', 'wrangler.jsonc', 'wrangler.json']) {
+    const full = path.join(cwd, file);
+    if (!fs.existsSync(full)) continue;
+    try {
+      const text = fs.readFileSync(full, 'utf8');
+      if (/hyperdrive/i.test(text)) ids.push('hyperdrive_binding');
+      for (const match of text.matchAll(/id\s*=\s*["']([a-f0-9-]{20,})["']/gi)) {
+        if (/hyperdrive/i.test(text.slice(Math.max(0, match.index - 80), match.index + 20))) {
+          ids.push(match[1]);
+        }
+      }
+    } catch {
+      /* ignore */
+    }
+  }
+  return [...new Set(ids)];
+}
+
+/**
+ * @param {{ env?: NodeJS.ProcessEnv, home?: string, cwd?: string, discoverRemote?: boolean, tokenPermissions?: string[] }} [options]
+ */
+export async function projectWhoamiCapabilities(options = {}) {
+  const env = options.env || process.env;
+  const cwd = options.cwd || process.cwd();
+  const discoverRemote = options.discoverRemote !== false;
+  const tokenPermissions = Array.isArray(options.tokenPermissions) ? options.tokenPermissions : [];
+
+  const providerStatus = listProviderCredentialStatus({ env, home: options.home });
+  const configuredProviders = providerStatus.filter((row) => row.configured);
+
+  let modelsStatus = null;
+  try {
+    modelsStatus = await collectModelsStatus({
+      env,
+      home: options.home,
+      discoverRemote,
+      includeLocal: true,
+    });
+  } catch (error) {
+    modelsStatus = { error: error?.message || String(error), providers: [], models: [] };
+  }
+
+  const modelRows = Array.isArray(modelsStatus?.models) ? modelsStatus.models : [];
+  const byProvider = {};
+  for (const row of modelRows) {
+    const provider = row.provider || 'unknown';
+    byProvider[provider] = (byProvider[provider] || 0) + 1;
+  }
+
+  const d1Bindings = detectLocalD1Bindings(cwd);
+  const hyperdrive = detectHyperdriveHints(cwd);
+  const hasCfToken = Boolean(
+    clean(env.CLOUDFLARE_API_TOKEN)
+    || configuredProviders.some((row) => row.provider === 'cloudflare' && row.configured),
+  );
+  const hasOpenai = configuredProviders.some((row) => row.provider === 'openai');
+  const hasSupabase = Boolean(
+    clean(env.SUPABASE_URL) || clean(env.SUPABASE_DB_URL) || clean(env.DATABASE_URL),
+  );
+
+  const database = {
+    available: true,
+    drivers: [
+      { id: 'sqlite', mode: 'read_write', source: 'local_project' },
+      ...(d1Bindings.length
+        ? [{ id: 'd1', mode: hasCfToken ? 'read_write_delete' : 'bound_needs_cf_auth', source: 'wrangler', databases: d1Bindings }]
+        : []),
+      ...(hyperdrive.length
+        ? [{ id: 'hyperdrive', mode: hasCfToken ? 'read_write' : 'bound_needs_cf_auth', source: 'wrangler', bindings: hyperdrive }]
+        : []),
+      ...(hasSupabase
+        ? [{ id: 'supabase_postgres', mode: 'read_write', source: 'env' }]
+        : []),
+    ],
+    next: !hasCfToken && (d1Bindings.length || hyperdrive.length)
+      ? 'agentsam cloudflare login --pack data   # authorize D1/Hyperdrive/Vectorize'
+      : hasSupabase
+        ? null
+        : 'Optional: agentsam cloudflare login --pack data',
+  };
+
+  const vectors = {
+    available: true,
+    drivers: [
+      { id: 'local_exact', mode: 'read_write', source: 'sdk' },
+      ...(hasCfToken
+        ? [{ id: 'cloudflare_vectorize', mode: 'read_write', source: 'cloudflare', authorize: 'agentsam cloudflare login --pack data' }]
+        : [{ id: 'cloudflare_vectorize', mode: 'needs_authorization', source: 'cloudflare', authorize: 'agentsam cloudflare login --pack data' }]),
+    ],
+  };
+
+  const models = {
+    available: configuredProviders.length > 0 || modelRows.length > 0,
+    configuredProviders: configuredProviders.map((row) => row.provider),
+    discovered_model_counts: byProvider,
+    discovered_total: modelRows.length,
+    source: 'provider_api_when_key_present',
+    next: configuredProviders.length
+      ? 'agentsam models   # refresh live inventory from your stored provider keys'
+      : 'agentsam providers   # store OPENAI_API_KEY / etc, then agentsam models',
+    note: 'Allowed models = whatever each connected provider key returns (not a static SDK list).',
+  };
+
+  const cloudflare = {
+    available: hasCfToken,
+    packs: listCloudflareFeaturePacks().map((pack) => ({
+      id: pack.id,
+      label: pack.label,
+      description: pack.description,
+      capability_count: pack.capabilities.length,
+    })),
+    agentsam_pack_scopes: scopesForFeaturePacks(['agentsam']).length,
+    next: hasCfToken
+      ? 'agentsam cloudflare permissions --json'
+      : 'agentsam cloudflare login --pack agentsam',
+  };
+
+  const tools = {
+    agentsam_tools: {
+      hyperdrive: hyperdrive.length > 0 || hasCfToken,
+      supabase: hasSupabase,
+      d1: d1Bindings.length > 0,
+      next: 'Enable via CF pack data + provider vault — then agentsam tools / MCP',
+    },
+  };
+
+  return {
+    repository: { available: true },
+    database,
+    vectors,
+    models,
+    terminal: projectTerminalCapability(tokenPermissions),
+    deploy: { available: hasCfToken || Boolean(clean(env.CLOUDFLARE_ACCOUNT_ID)) },
+    cloudflare,
+    tools,
+    edit: {
+      providers: 'agentsam providers',
+      models: 'agentsam models',
+      cloudflare_packs: 'agentsam cloudflare login --pack <data|compute|ai|agentsam>',
+      capabilities: 'agentsam capabilities',
+      api_keys: 'agentsam api-key create --store keychain --activate',
+    },
+  };
+}

package/src/local-fs/capability.js

@@ -0,0 +1,121 @@
+/**
+ * Local runtime workspace capability — short-lived FS/PTY authority for one root.
+ *
+ * Compatible with later:
+ *   account → terminal connection → enrolled instance → approved workspace root
+ *
+ * Local today:
+ *   start-local binds one root + mints one capability.
+ *   Browser cannot invent an absolute root to gain authority.
+ */
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const WORKSPACE_CAPABILITY_HEADER = 'x-agentsam-workspace-capability';
+export const LOCAL_RUNTIME_FILE = 'local-runtime.json';
+
+/**
+ * @param {{ root: string, port: number, host?: string }} opts
+ */
+export function mintWorkspaceCapability(opts) {
+  const root = path.resolve(opts.root);
+  const workspace_id = `ws_${crypto.randomBytes(10).toString('hex')}`;
+  const capability = `awc_${crypto.randomBytes(24).toString('hex')}`;
+  const expires_at = new Date(Date.now() + 12 * 60 * 60 * 1000).toISOString();
+  return Object.freeze({
+    schema: 'agentsam.local-workspace-capability.v1',
+    workspace_id,
+    capability,
+    root,
+    host: opts.host || '127.0.0.1',
+    port: opts.port,
+    runtimeBaseUrl: `http://${opts.host || '127.0.0.1'}:${opts.port}`,
+    fsBaseUrl: `http://${opts.host || '127.0.0.1'}:${opts.port}/v1/fs`,
+    expires_at,
+    purpose: 'local.filesystem+pty',
+  });
+}
+
+/**
+ * Persist capability beside the authorized root (machine-local; not file content authority).
+ * @param {object} record
+ */
+export function writeLocalRuntimeRecord(record) {
+  const dir = path.join(record.root, '.agentsam');
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, LOCAL_RUNTIME_FILE);
+  fs.writeFileSync(file, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+  return file;
+}
+
+/**
+ * @param {string} root
+ */
+export function readLocalRuntimeRecord(root) {
+  const file = path.join(path.resolve(root), '.agentsam', LOCAL_RUNTIME_FILE);
+  if (!fs.existsSync(file)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {string} expected
+ */
+export function extractCapability(req, expected) {
+  const header = req.headers[WORKSPACE_CAPABILITY_HEADER]
+    || req.headers.authorization
+    || '';
+  let token = '';
+  if (typeof header === 'string') {
+    if (header.toLowerCase().startsWith('bearer ')) token = header.slice(7).trim();
+    else token = header.trim();
+  }
+  if (!token && req.url) {
+    try {
+      const u = new URL(req.url, 'http://127.0.0.1');
+      token = u.searchParams.get('capability') || '';
+    } catch {
+      /* ignore */
+    }
+  }
+  return {
+    ok: Boolean(expected && token && token === expected),
+    token,
+  };
+}
+
+/**
+ * Loopback + Studio origin allowlist. Never `*`.
+ * @param {string|undefined} origin
+ * @param {string[]} [extra]
+ */
+export function isAllowedStudioOrigin(origin, extra = []) {
+  if (!origin || origin === 'null') return true; // non-browser / same-origin tooling
+  const allow = [
+    'http://127.0.0.1:8080',
+    'http://localhost:8080',
+    'http://127.0.0.1:5173',
+    'http://localhost:5173',
+    'http://127.0.0.1:3000',
+    'http://localhost:3000',
+    ...extra,
+  ];
+  return allow.includes(origin);
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ */
+export function isLoopbackRemote(req) {
+  const raw = req.socket?.remoteAddress || '';
+  return raw === '127.0.0.1'
+    || raw === '::1'
+    || raw === '::ffff:127.0.0.1'
+    || raw.endsWith('127.0.0.1');
+}

package/src/local-fs/freshness.js

@@ -0,0 +1,75 @@
+/**
+ * Minimal repository/index freshness bridge.
+ * Filesystem writes mark generation stale — do not re-index on every keystroke.
+ */
+
+/** @type {Map<string, { generation: number, stale_paths: Set<string>, updated_at: string }>} */
+const roots = new Map();
+
+/**
+ * @param {string} root
+ * @param {{ paths?: string[], reason?: string }} [opts]
+ */
+export function markRepositoryStale(root, opts = {}) {
+  const key = String(root);
+  const prev = roots.get(key) || {
+    generation: 0,
+    stale_paths: new Set(),
+    updated_at: null,
+  };
+  const nextGen = prev.generation + 1;
+  const stale_paths = new Set(prev.stale_paths);
+  for (const p of opts.paths || []) stale_paths.add(String(p));
+  const record = {
+    generation: nextGen,
+    stale_paths,
+    updated_at: new Date().toISOString(),
+    reason: opts.reason || 'filesystem_write',
+  };
+  roots.set(key, record);
+  return {
+    ok: true,
+    schema: 'agentsam.repository-freshness.v1',
+    root: key,
+    generation: record.generation,
+    stale_paths: [...stale_paths].slice(0, 200),
+    updated_at: record.updated_at,
+    reason: record.reason,
+  };
+}
+
+/**
+ * @param {string} root
+ */
+export function getRepositoryFreshness(root) {
+  const key = String(root);
+  const record = roots.get(key);
+  if (!record) {
+    return {
+      ok: true,
+      schema: 'agentsam.repository-freshness.v1',
+      root: key,
+      generation: 0,
+      stale: false,
+      stale_paths: [],
+    };
+  }
+  return {
+    ok: true,
+    schema: 'agentsam.repository-freshness.v1',
+    root: key,
+    generation: record.generation,
+    stale: record.stale_paths.size > 0 || record.generation > 0,
+    stale_paths: [...record.stale_paths].slice(0, 200),
+    updated_at: record.updated_at,
+    reason: record.reason,
+  };
+}
+
+/**
+ * @param {string} root
+ */
+export function clearRepositoryFreshness(root) {
+  roots.delete(String(root));
+  return { ok: true };
+}