@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/packages/identity/src/contracts/route-projection.js

@@ -0,0 +1,218 @@
+/**
+ * Host/app HTTP projection of semantic identity route IDs.
+ * Identity core never hardcodes /auth/login, /agentsam, etc.
+ */
+
+import { IDENTITY_ROUTE_IDS, REQUIRED_AUTH_ROUTE_IDS } from './route-ids.js';
+import { IdentityRoutingError } from './identity-store.js';
+import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
+
+/**
+ * @typedef {{ path: string, auth?: 'required'|'optional'|'public', spa?: boolean, shell?: string, pattern?: string }} RouteProjection
+ * @typedef {Record<string, string|RouteProjection>} RouteProjectionMap
+ */
+
+/**
+ * @param {{ appId: string, routes: RouteProjectionMap }} input
+ */
+export function defineRouteProjection(input) {
+  const appId = String(input?.appId || '').trim();
+  if (!appId) throw new IdentityRoutingError('AUTH_APP_UNRESOLVED', 'defineRouteProjection requires appId');
+  /** @type {Map<string, RouteProjection>} */
+  const routes = new Map();
+  for (const [routeId, value] of Object.entries(input.routes || {})) {
+    const path = typeof value === 'string' ? value : value?.path;
+    if (!path || !String(path).startsWith('/')) {
+      throw new IdentityRoutingError('AUTH_ROUTE_PROJECTION_INVALID', `Invalid path for ${routeId}`, { appId, routeId });
+    }
+    routes.set(routeId, Object.freeze({
+      path: String(path),
+      auth: typeof value === 'object' ? value.auth : undefined,
+      spa: typeof value === 'object' ? value.spa : undefined,
+      shell: typeof value === 'object' ? value.shell : undefined,
+      pattern: typeof value === 'object' ? value.pattern : undefined,
+    }));
+  }
+  return Object.freeze({ appId, routes });
+}
+
+/**
+ * @param {ReturnType<typeof defineRouteProjection>[]} projections
+ */
+export function createRouteRegistry(projections = []) {
+  /** @type {Map<string, ReturnType<typeof defineRouteProjection>>} */
+  const byApp = new Map();
+  for (const p of projections) {
+    if (!p?.appId) continue;
+    byApp.set(p.appId, p);
+  }
+
+  return Object.freeze({
+    get(appId) {
+      return byApp.get(String(appId || '')) || null;
+    },
+
+    /**
+     * @param {string} appId
+     * @param {string} routeId
+     * @returns {string|null}
+     */
+    resolve(appId, routeId) {
+      const proj = byApp.get(String(appId || ''));
+      if (!proj) return null;
+      const entry = proj.routes.get(routeId);
+      return entry?.path || null;
+    },
+
+    /**
+     * Expand parameterized patterns, e.g. /api/oauth/:provider/callback
+     * @param {string} appId
+     * @param {string} routeId
+     * @param {Record<string, string>} params
+     */
+    resolvePath(appId, routeId, params = {}) {
+      const pattern = this.resolve(appId, routeId);
+      if (!pattern) return null;
+      return pattern.replace(/:([A-Za-z_][A-Za-z0-9_]*)/g, (_, key) => {
+        const v = params[key];
+        if (v == null || v === '') {
+          throw new IdentityRoutingError('AUTH_ROUTE_PARAM_MISSING', `Missing :${key} for ${routeId}`, { appId, routeId });
+        }
+        return encodeURIComponent(String(v));
+      });
+    },
+
+    /**
+     * return_to must be same-origin relative and owned by this app's projected mounts/paths.
+     * @param {{ appId: string, value?: string|null }} opts
+     */
+    resolveReturnTo({ appId, value }) {
+      const cleaned = sanitizeBrowserNextPath(value);
+      if (!cleaned) return null;
+      const pathname = cleaned.split('?')[0];
+      const proj = byApp.get(String(appId || ''));
+      if (!proj) return null;
+
+      const authenticated = proj.routes.get(IDENTITY_ROUTE_IDS.APP_AUTHENTICATED)?.path
+        || proj.routes.get(IDENTITY_ROUTE_IDS.APP_HOME)?.path;
+      if (authenticated && (pathname === authenticated || pathname.startsWith(`${authenticated}/`))) {
+        return cleaned;
+      }
+
+      for (const [routeId, entry] of proj.routes) {
+        if (routeId.startsWith('identity.')) continue;
+        const base = entry.path.replace(/:[^/]+/g, ''); // strip params for prefix mounts
+        const mount = base.replace(/\/$/, '') || entry.path;
+        if (pathname === mount || pathname.startsWith(`${mount}/`)) return cleaned;
+        // Explicit mount keys: app.mount./projects style — also accept path values with auth required
+        if (entry.auth === 'required' && (pathname === entry.path || pathname.startsWith(`${entry.path}/`))) {
+          return cleaned;
+        }
+      }
+      return null;
+    },
+
+    /**
+     * Fail closed if auth-capable app is missing required semantic projections.
+     * @param {string} appId
+     */
+    assertAuthCapable(appId) {
+      const proj = byApp.get(String(appId || ''));
+      if (!proj) {
+        throw new IdentityRoutingError('AUTH_APP_UNRESOLVED', `No route projection for app ${appId}`, { appId });
+      }
+      for (const routeId of REQUIRED_AUTH_ROUTE_IDS) {
+        if (!proj.routes.has(routeId)) {
+          throw new IdentityRoutingError(
+            'AUTH_ROUTE_MISSING',
+            `App ${appId} missing required route projection ${routeId}`,
+            { appId, routeId },
+          );
+        }
+      }
+      return proj;
+    },
+  });
+}
+
+/**
+ * Build a projection map from an agentsam.app.v1 auth+routes manifest section.
+ * @param {object} manifest
+ */
+export function projectionFromAppManifest(manifest) {
+  const appId = String(manifest?.id || '').trim();
+  if (!appId) throw new IdentityRoutingError('AUTH_APP_UNRESOLVED', 'manifest.id required');
+
+  /** @type {RouteProjectionMap} */
+  const routes = {};
+
+  const rawRoutes = manifest.routes || {};
+  for (const [routeId, value] of Object.entries(rawRoutes)) {
+    if (routeId === 'entry' || routeId === 'mounts' || routeId === 'paths') continue;
+    routes[routeId] = value;
+  }
+  for (const [routeId, value] of Object.entries(rawRoutes.paths || {})) {
+    routes[routeId] = value;
+  }
+
+  const auth = manifest.auth || {};
+  const entry = auth.entry || {};
+
+  function pathFor(ref, legacyPath) {
+    if (legacyPath) return legacyPath;
+    if (!ref) return null;
+    if (typeof ref === 'string' && ref.startsWith('/')) return ref;
+    if (typeof ref === 'string' && routes[ref]) {
+      const v = routes[ref];
+      return typeof v === 'string' ? v : v.path;
+    }
+    return null;
+  }
+
+  const authenticatedPath = pathFor(
+    entry.authenticated || IDENTITY_ROUTE_IDS.APP_AUTHENTICATED,
+    typeof rawRoutes.entry === 'string' ? rawRoutes.entry : null,
+  );
+  const loginPath = pathFor(entry.login || IDENTITY_ROUTE_IDS.LOGIN, null);
+  const failurePath = pathFor(
+    entry.failure || IDENTITY_ROUTE_IDS.RECOVERY || IDENTITY_ROUTE_IDS.LOGIN,
+    loginPath,
+  );
+
+  if (authenticatedPath) {
+    routes[IDENTITY_ROUTE_IDS.APP_AUTHENTICATED] = {
+      path: authenticatedPath,
+      auth: 'required',
+      spa: true,
+      shell: manifest.runtime?.shell
+        ? `${manifest.runtime.assetRoot || 'dist'}/${manifest.runtime.shell}`.replace(/\/{2,}/g, '/')
+        : undefined,
+    };
+    routes[IDENTITY_ROUTE_IDS.APP_HOME] = authenticatedPath;
+  }
+  if (loginPath) routes[IDENTITY_ROUTE_IDS.LOGIN] = loginPath;
+  if (failurePath) routes[IDENTITY_ROUTE_IDS.RECOVERY] = failurePath;
+
+  for (const mount of rawRoutes.mounts || []) {
+    if (!mount?.path) continue;
+    routes[`app.mount.${mount.path}`] = {
+      path: mount.path,
+      auth: mount.auth || 'required',
+      spa: mount.spa,
+      shell: mount.shell,
+    };
+  }
+
+  if (auth.oauth?.callbackPattern) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_CALLBACK] = auth.oauth.callbackPattern;
+  } else if (!routes[IDENTITY_ROUTE_IDS.OAUTH_CALLBACK]) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_CALLBACK] = '/api/oauth/:provider/callback';
+  }
+  if (auth.oauth?.startPattern) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_START] = auth.oauth.startPattern;
+  } else if (!routes[IDENTITY_ROUTE_IDS.OAUTH_START]) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_START] = '/api/oauth/:provider/start';
+  }
+
+  return defineRouteProjection({ appId, routes });
+}

package/packages/identity/src/contracts/routes.js

@@ -0,0 +1,11 @@
+/**
+ * Portable identity = semantic route IDs only.
+ * Concrete paths live in host defineRouteProjection / agentsam.app.json.
+ */
+
+export { IDENTITY_ROUTE_IDS, REQUIRED_AUTH_ROUTE_IDS } from './route-ids.js';
+export {
+  defineRouteProjection,
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from './route-projection.js';

package/packages/identity/src/core/browser-paths.js

@@ -1,4 +1,7 @@
-import { AUTH_LOGIN_PATH, AUTH_SIGNUP_PATH } from './constants.js';
+/**
+ * Same-origin relative path sanitizer — no product-path rewriting.
+ * Alias normalization (/login → identity.login projection) is a host concern.
+ */
 
 export function sanitizeBrowserNextPath(raw) {
   if (raw == null) return null;
@@ -13,10 +16,6 @@ export function sanitizeBrowserNextPath(raw) {
     pathname = s.slice(0, q);
     search = s.slice(q);
   }
-  const lower = pathname.toLowerCase();
-  if (lower === '/login' || lower === '/auth/signin') pathname = AUTH_LOGIN_PATH;
-  else if (lower === '/signup' || lower === '/auth/register') pathname = AUTH_SIGNUP_PATH;
-
   return pathname + search;
 }
 

package/packages/identity/src/core/constants.js

@@ -1,9 +1,14 @@
-/** SDK-portable session/auth path constants. */
+/**
+ * Cookie name + session policy re-exports.
+ * Route vocabulary → contracts/routes.js (identity endpoints only).
+ * Product homes / mounts → each app's agentsam.app.json (not this package).
+ */
+
+import { SESSION_POLICY } from './session-policy.js';
+
+export { SESSION_POLICY, clampAgentSessionTtl } from './session-policy.js';
+
 export const AUTH_COOKIE_NAME = 'session';
-export const AUTH_SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
-export const MIN_AGENT_SESSION_TTL_SECONDS = 60;
-export const MAX_AGENT_SESSION_TTL_SECONDS = 86400;
-export const DEFAULT_AGENT_SESSION_TTL_SECONDS = 900;
-export const AUTH_LOGIN_PATH = '/auth/login';
-export const AUTH_SIGNUP_PATH = '/auth/signup';
-export const DASHBOARD_AFTER_LOGIN_PATH = '/dashboard/cms';
+
+/** @deprecated Prefer SESSION_POLICY.browser.ttlSeconds */
+export const AUTH_SESSION_TTL_SECONDS = SESSION_POLICY.browser.ttlSeconds;

package/packages/identity/src/core/session-policy.js

@@ -0,0 +1,32 @@
+/**
+ * Session policy — three concerns stay separate:
+ *   browser  = normal logged-in account session (cookie / auth_sessions)
+ *   agent    = short-lived delegated/runtime grant (execution, terminal, sandbox)
+ *
+ * Product routing does not live here.
+ */
+
+export const SESSION_POLICY = Object.freeze({
+  browser: Object.freeze({
+    ttlSeconds: 30 * 24 * 60 * 60,
+  }),
+  /** Temporary execution authority — not the user's Local Studio login. */
+  agent: Object.freeze({
+    minTtlSeconds: 60,
+    defaultTtlSeconds: 15 * 60,
+    maxTtlSeconds: 24 * 60 * 60,
+  }),
+});
+
+/**
+ * Clamp a requested agent/runtime grant TTL into policy bounds.
+ * @param {number|null|undefined} requestedSeconds
+ */
+export function clampAgentSessionTtl(requestedSeconds) {
+  const n = Number(requestedSeconds);
+  if (!Number.isFinite(n) || n <= 0) return SESSION_POLICY.agent.defaultTtlSeconds;
+  return Math.min(
+    SESSION_POLICY.agent.maxTtlSeconds,
+    Math.max(SESSION_POLICY.agent.minTtlSeconds, Math.floor(n)),
+  );
+}

package/packages/identity/src/frontend/auth-portal/README.md

@@ -26,7 +26,8 @@ The CLI can now scaffold the reusable identity app surfaces directly with `agent
 - `POST /api/auth/login`
 - `POST /api/auth/signup` — create account (email/password); portal form must call this, not login
 - `GET /api/company` — public branding SSOT (loaded by `shared/company-branding.js`)
-- OAuth: `/api/oauth/google/start`, `/api/oauth/github/start`
+- OAuth: `/api/oauth/google/start`, `/api/oauth/github/start`, `/api/oauth/cloudflare/start`
+- Desktop PKCE broker: `POST /api/oauth/google/desktop-exchange` (`GOOGLE_DESKTOP_CLIENT_ID`)
 - GCP: per-client when demanded — scaffold only until requested
 
 Sensitive finalize stays server-side (`oauth/callback` → Identity Service).

package/packages/identity/src/frontend/auth-portal/pages/login.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Sign in | Inner Animal Media</title>
+    <title>Sign in | AgentSam</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -360,12 +360,12 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public"
-      alt="Inner Animal Media"
+      src="/shared/agentsam-mark.svg"
+      alt="AgentSam"
     />
 
     <h1 data-company-tagline>Instant Access</h1>
-    <p class="subtitle" data-company-subtitle="signin">Sign in to Inner Animal Media</p>
+    <p class="subtitle" data-company-subtitle="signin">Sign in to AgentSam</p>
     <p id="registeredMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Account created. Sign in below.</p>
     <p id="resetMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Password updated. Sign in with your new password.</p>
     <p id="oauthErrorMsg" class="subtitle" style="color: #FF3B30; display: none; margin-top: -16px; margin-bottom: 16px;"></p>
@@ -404,15 +404,15 @@
         <button type="submit" id="submitBtn" class="btn-primary">Connect</button>
 
         <div class="oauth-stack">
-            <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/dashboard/agent" class="btn-primary" style="background: #ffffff; color: #1E293B; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+            <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/" class="btn-primary" style="background: #ffffff; color: #1E293B; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
                 <svg width="18" height="18" viewBox="0 0 24 24"><path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/><path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/><path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/><path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/></svg>
                 Sign in with Google
             </a>
-            <a id="githubSignIn" href="/api/oauth/github/start?next=/dashboard/agent" class="btn-primary" style="background: rgba(255,255,255,0.1); color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+            <a id="githubSignIn" href="/api/oauth/github/start?next=/" class="btn-primary" style="background: rgba(255,255,255,0.1); color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
                 <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.43 9.8 8.2 11.38.6.11.82-.26.82-.58 0-.29-.01-1.06-.01-2.08-3.34.73-4.04-1.61-4.04-1.61-.55-1.39-1.34-1.76-1.34-1.76-1.09-.74.08-.73.08-.73 1.2.08 1.83 1.23 1.83 1.23 1.07 1.83 2.81 1.3 3.49.99.11-.78.42-1.3.76-1.6-2.67-.3-5.47-1.33-5.47-5.93 0-1.31.47-2.38 1.24-3.22-.12-.3-.54-1.52.12-3.18 0 0 1.01-.32 3.3 1.23a11.5 11.5 0 013-.41c1.02.01 2.05.14 3 .41 2.29-1.55 3.3-1.23 3.3-1.23.66 1.66.24 2.88.12 3.18.77.84 1.24 1.91 1.24 3.22 0 4.61-2.8 5.63-5.48 5.92.43.37.81 1.1.81 2.22 0 1.6-.01 2.89-.01 3.28 0 .32.21.69.83.57C20.57 21.79 24 17.3 24 12c0-6.63-5.37-12-12-12z"/></svg>
                 Sign in with GitHub
             </a>
-            <a id="cloudflareSignIn" href="/api/oauth/cloudflare/start?next=/dashboard/agent" class="btn-primary" style="background: #F6821F; color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+            <a id="cloudflareSignIn" href="/api/oauth/cloudflare/start" class="btn-primary" style="background: #F6821F; color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
                 Sign in with Cloudflare
             </a>
         </div>
@@ -451,7 +451,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>Inner Animal Media</span>
+    <span data-company-name>AgentSam</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
@@ -466,13 +466,13 @@
     var flow = qs.get('flow');
     var challenge = qs.get('challenge');
     var nextParam = qs.get('next');
-    var oauthDest = '/dashboard/agent';
+    // No product-home default here — host bounce supplies ?next=; otherwise
+    // the Worker resolves against the app manifest entry after auth.
+    var oauthDest = '/';
     if (flow === 'oauth' && challenge && challenge.indexOf('olc_') === 0) {
         oauthDest = '/api/oauth/login-challenge/resume?challenge=' + encodeURIComponent(challenge);
     } else if (nextParam && nextParam.startsWith('/') && !nextParam.startsWith('//')) {
-        if (nextParam.indexOf('/dashboard/settings/integrations') !== 0) {
-            oauthDest = nextParam;
-        }
+        oauthDest = nextParam;
     }
     var googleLink = document.getElementById('googleSignIn');
     if (googleLink) {
@@ -571,7 +571,7 @@
             if (res.ok && data.ok) {
                 btn.textContent = 'Success';
                 btn.style.background = '#10B981';
-                var redirectUrl = data.redirect || '/dashboard/agent';
+                var redirectUrl = data.redirect || '/';
                 if (typeof window.runGlobeExitTransition === 'function') {
                     window.runGlobeExitTransition(redirectUrl);
                 } else {
@@ -803,8 +803,8 @@
 (function() {
     var params = new URLSearchParams(window.location.search);
     if (params.get('globe_exit') !== '1') return;
-    var next = params.get('next') || '/dashboard/agent';
-    if (!next.startsWith('/') || next.startsWith('//')) next = '/dashboard/agent';
+    var next = params.get('next') || '/';
+    if (!next.startsWith('/') || next.startsWith('//')) next = '/';
     document.body.classList.add('oauth-globe-exit');
     var tries = 0;
     var maxFrames = 180;
@@ -824,6 +824,7 @@
     });
 })();
 </script>
+<script src="/shared/desktop-identity-bridge.js" defer></script>
 <script src="/shared/company-branding.js" defer></script>
 </body>
 </html>

package/packages/identity/src/frontend/auth-portal/pages/reset.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Reset password | Inner Animal Media</title>
+    <title>Reset password | AgentSam</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -280,8 +280,8 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public"
-      alt="Inner Animal Media"
+      src="/shared/agentsam-mark.svg"
+      alt="AgentSam"
       style="width:120px;height:120px;object-fit:contain;display:block;margin:0 auto 20px;"
     />
 
@@ -290,7 +290,7 @@
     <p class="subtitle">We'll send you a secure verification code.</p>
 
     <div class="email-note">
-        You'll receive an email from <strong data-company-support-email>hey@inneranimalmedia.com</strong>.<br>
+        You'll receive an email from <strong data-company-support-email>support@agentsam.dev</strong>.<br>
         Check your inbox and spam folder.
     </div>
 
@@ -346,11 +346,11 @@
     </form>
 
     <div style="margin: 20px 0 0; width: 100%; text-align: center; display: flex; flex-direction: column; gap: 12px;">
-        <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/dashboard/agent" class="oauth-btn oauth-google">
+        <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/" class="oauth-btn oauth-google">
             <svg width="18" height="18" viewBox="0 0 24 24"><path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/><path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/><path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/><path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/></svg>
             Sign in with Google
         </a>
-        <a id="githubSignIn" href="/api/oauth/github/start?next=/dashboard/agent" class="oauth-btn oauth-github">
+        <a id="githubSignIn" href="/api/oauth/github/start?next=/" class="oauth-btn oauth-github">
             <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.43 9.8 8.2 11.38.6.11.82-.26.82-.58 0-.29-.01-1.06-.01-2.08-3.34.73-4.04-1.61-4.04-1.61-.55-1.39-1.34-1.76-1.34-1.76-1.09-.74.08-.73.08-.73 1.2.08 1.83 1.23 1.83 1.23 1.07 1.83 2.81 1.3 3.49.99.11-.78.42-1.3.76-1.6-2.67-.3-5.47-1.33-5.47-5.93 0-1.31.47-2.38 1.24-3.22-.12-.3-.54-1.52.12-3.18 0 0 1.01-.32 3.3 1.23a11.5 11.5 0 013-.41c1.02.01 2.05.14 3 .41 2.29-1.55 3.3-1.23 3.3-1.23.66 1.66.24 2.88.12 3.18.77.84 1.24 1.91 1.24 3.22 0 4.61-2.8 5.63-5.48 5.92.43.37.81 1.1.81 2.22 0 1.6-.01 2.89-.01 3.28 0 .32.21.69.83.57C20.57 21.79 24 17.3 24 12c0-6.63-5.37-12-12-12z"/></svg>
             Sign in with GitHub
         </a>
@@ -365,7 +365,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>Inner Animal Media</span>
+    <span data-company-name>AgentSam</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
@@ -385,7 +385,7 @@
     var backLink = document.getElementById('backToLogin');
     if (backLink) backLink.href = loginHref;
 
-    var oauthDest = '/dashboard/agent';
+    var oauthDest = '/';
     if (nextParam && nextParam.startsWith('/') && !nextParam.startsWith('//')) {
         oauthDest = nextParam;
     }
@@ -579,6 +579,7 @@
     }
 })();
 </script>
+<script src="/shared/desktop-identity-bridge.js" defer></script>
 <script src="/shared/company-branding.js" defer></script>
 </body>
 </html>

package/packages/identity/src/frontend/auth-portal/pages/signup.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Sign up | Inner Animal Media</title>
+    <title>Sign up | AgentSam</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -398,12 +398,12 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public"
-      alt="Inner Animal Media"
+      src="/shared/agentsam-mark.svg"
+      alt="AgentSam"
     />
 
     <h1>Create account</h1>
-    <p class="subtitle" data-company-subtitle="signup">Join Inner Animal Media</p>
+    <p class="subtitle" data-company-subtitle="signup">Join AgentSam</p>
     <p id="registeredMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Account created. Sign in below.</p>
     <p id="oauthErrorMsg" class="subtitle" style="color: #FF3B30; display: none; margin-top: -16px; margin-bottom: 16px;"></p>
     <p id="cfConnectNotice" class="subtitle" style="color: #fdba74; display: none; margin-top: -12px; margin-bottom: 12px; font-size: 12px; line-height: 1.45; text-align: center; max-width: 320px;">Sign in with Google, GitHub, or Supabase first, then connect Cloudflare from Integrations.</p>
@@ -485,7 +485,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>Inner Animal Media</span>
+    <span data-company-name>AgentSam</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
@@ -582,7 +582,7 @@
                 }
                 btn.textContent = 'Success';
                 btn.style.background = '#10B981';
-                var redirectUrl = data.redirect || '/dashboard/overview';
+                var redirectUrl = data.redirect || '/';
                 if (typeof window.runGlobeExitTransition === 'function') {
                     window.runGlobeExitTransition(redirectUrl);
                 } else {
@@ -814,8 +814,8 @@
 (function() {
     var params = new URLSearchParams(window.location.search);
     if (params.get('globe_exit') !== '1') return;
-    var next = params.get('next') || '/dashboard/overview';
-    if (!next.startsWith('/') || next.startsWith('//')) next = '/dashboard/overview';
+    var next = params.get('next') || '/';
+    if (!next.startsWith('/') || next.startsWith('//')) next = '/';
     document.body.classList.add('oauth-globe-exit');
     var tries = 0;
     var maxFrames = 180;
@@ -835,6 +835,7 @@
     });
 })();
 </script>
+<script src="/shared/desktop-identity-bridge.js" defer></script>
 <script src="/shared/company-branding.js" defer></script>
 </body>
 </html>

package/packages/identity/src/frontend/auth-portal/preview/dashboard-stub.html

@@ -15,7 +15,7 @@
 <body>
   <main>
     <h1>Post-login (preview stub)</h1>
-    <p>In production you would land on <code>/dashboard/agent</code> (or your <code>next</code> URL) after OAuth or password sign-in.</p>
+    <p>In production you would land on <code>/</code> (or your <code>next</code> URL) after OAuth or password sign-in.</p>
     <p><a href="/auth/login">Back to sign in</a> · <a href="/">Preview hub</a></p>
   </main>
 </body>

package/packages/identity/src/frontend/auth-portal/shared/company-branding.js

@@ -1,6 +1,6 @@
 /**
  * Auth portal branding from D1 `company` via GET /api/company.
- * Static HTML keeps IAM defaults as fallback when API is unavailable.
+ * Static HTML keeps portable AgentSam defaults as fallback when host branding is unavailable.
  */
 (function () {
   var SUBTITLE_PREFIX = {