@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/src/commands/connections.js

@@ -11,11 +11,15 @@ import {
 import { resolveIamIssuer } from '../../packages/identity/src/contracts/auth-config.js';
 import { collectRuntimeStatus } from './runtime-status.js';
 
-const PRODUCTION_CALLBACK = `https://agentsam.inneranimalmedia.com${CLOUDFLARE_CALLBACK_PATH}`;
-
 function doctor(env = process.env) {
   const iam = {
-    issuer: resolveIamIssuer(env),
+    issuer: (() => {
+      try {
+        return resolveIamIssuer(env);
+      } catch {
+        return null;
+      }
+    })(),
     clientId: Boolean(String(env.IAM_CLIENT_ID || '').trim()),
     serverSecret: Boolean(String(env.IAM_CLIENT_SECRET || '').trim()),
     originAlias: Boolean(String(env.IAM_ORIGIN || '').trim()),
@@ -29,7 +33,9 @@ function printSetup(env = process.env) {
   const client = resolveCloudflareOAuthClient(env);
   console.log('Cloudflare connector setup');
   console.log('');
-  console.log(`  callback: ${PRODUCTION_CALLBACK}`);
+  console.log(`  callback path: ${CLOUDFLARE_CALLBACK_PATH}`);
+  console.log('  Register full https://<local-studio-host>' + CLOUDFLARE_CALLBACK_PATH);
+  console.log('  on the Cloudflare OAuth client (CLOUDFLARE_OAUTH_CLIENT_ID).');
   console.log('  authorize: https://dash.cloudflare.com/oauth2/auth');
   console.log('  token:     https://dash.cloudflare.com/oauth2/token');
   console.log('  revoke:    https://dash.cloudflare.com/oauth2/revoke');
@@ -39,7 +45,7 @@ function printSetup(env = process.env) {
   if (client.fixture) {
     console.log('STOP: fixture credentials are loaded. OAuth start will return 503.');
   } else if (client.status === 'not_configured') {
-    console.log('status: not_configured — production may deploy; connector stays optional.');
+    console.log('status: not_configured — set CLOUDFLARE_OAUTH_CLIENT_ID on the Local Studio Worker.');
   } else {
     console.log(`status: ${client.status}`);
   }

package/src/commands/credentials.js

@@ -0,0 +1,116 @@
+import {
+  collectCredentialsAudit,
+  renderCredentialsAudit,
+} from '../lib/credentials-audit.js';
+import {
+  remediateProviderFailure,
+  renderRemediationCard,
+  recommendedCommand,
+} from '../lib/provider-command-remediation.js';
+
+function writeLine(write, value = '') {
+  write(`${value}\n`);
+}
+
+function parseArgs(argv = []) {
+  const out = {
+    action: 'audit',
+    json: false,
+    verify: false,
+    drift: true,
+    namesOnly: false,
+    noNetwork: false,
+    help: false,
+    remediateArgv: [],
+  };
+  const args = [...argv];
+  if (!args.length || args[0] === 'audit') {
+    if (args[0] === 'audit') args.shift();
+    out.action = 'audit';
+  } else if (args[0] === 'remediate') {
+    out.action = 'remediate';
+    args.shift();
+  } else if (args[0] === 'help' || args[0] === '--help' || args[0] === '-h') {
+    out.help = true;
+    return out;
+  }
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === '--json') out.json = true;
+    else if (arg === '--verify') out.verify = true;
+    else if (arg === '--drift') out.drift = true;
+    else if (arg === '--no-drift') out.drift = false;
+    else if (arg === '--names-only') out.namesOnly = true;
+    else if (arg === '--no-network') out.noNetwork = true;
+    else if (arg === '--help' || arg === '-h') out.help = true;
+    else if (arg === '--') continue;
+    else if (out.action === 'remediate') out.remediateArgv.push(arg);
+    else throw new Error(`unknown credentials option: ${arg}`);
+  }
+  return out;
+}
+
+function printHelp(write = (s) => process.stdout.write(s)) {
+  writeLine(write, '');
+  writeLine(write, '  agentsam credentials audit [--verify] [--drift] [--names-only] [--no-network] [--json]');
+  writeLine(write, '  agentsam credentials remediate -- <provider argv…>');
+  writeLine(write, '');
+  writeLine(write, '  Never prints secret values. Prefer --names-only for shareable receipts.');
+  writeLine(write, '  Example remediation fixture:');
+  writeLine(write, '    agentsam credentials remediate -- gcloud edge-cloud service-accounts keys create');
+  writeLine(write, '');
+}
+
+export async function runCredentials(argv = [], options = {}) {
+  const write = options.write || ((s) => process.stdout.write(s));
+  const parsed = parseArgs(argv);
+  if (parsed.help) {
+    printHelp(write);
+    return 0;
+  }
+
+  if (parsed.action === 'remediate') {
+    const card = remediateProviderFailure({
+      argv: parsed.remediateArgv,
+      env: options.env || process.env,
+      projectId: options.projectId,
+    });
+    if (!card) {
+      writeLine(write, '');
+      writeLine(write, '  No deterministic remediation matched that failure yet.');
+      writeLine(write, '  Tip: agentsam cheat-sheet · agentsam credentials audit --verify --drift');
+      writeLine(write, '');
+      return 1;
+    }
+    if (parsed.json) {
+      write(JSON.stringify({ ...card, recommended_command: recommendedCommand(card) }, null, 2) + '\n');
+    } else {
+      write(renderRemediationCard(card));
+      const cmd = recommendedCommand(card);
+      if (cmd) writeLine(write, `  Recommended copy:\n    ${cmd}\n`);
+    }
+    return 0;
+  }
+
+  const report = await collectCredentialsAudit({
+    env: options.env || process.env,
+    home: options.home,
+    verify: parsed.verify,
+    drift: parsed.drift,
+    namesOnly: parsed.namesOnly,
+    noNetwork: parsed.noNetwork || !parsed.verify,
+  });
+
+  if (parsed.json) {
+    write(JSON.stringify(report, null, 2) + '\n');
+  } else {
+    write(renderCredentialsAudit(report));
+    for (const card of report.remediations || []) {
+      write(renderRemediationCard(card));
+    }
+  }
+
+  const high = (report.drift || []).some((row) => row.severity === 'high');
+  return high ? 2 : 0;
+}

package/src/commands/env.js

@@ -1,9 +1,43 @@
 import { spawnSync } from 'node:child_process';
-import { describeProviderCredential, ensureProviderEnvProfile, providerCredentialSpec } from '../lib/provider-credentials.js';
+import {
+  describeProviderCredential,
+  ensureProviderEnvProfile,
+  exportProviderEnvProfile,
+  providerCredentialSpec,
+  listProviderCredentialStatus,
+  ensureAgentEnvLoader,
+  agentEnvLoaderPath,
+  renderEnvShellExports,
+} from '../lib/provider-credentials.js';
 
-const PROVIDERS = Object.freeze(['openai', 'anthropic', 'gemini', 'grok', 'cloudflare']);
+const PROVIDERS = Object.freeze([
+  'openai',
+  'anthropic',
+  'gemini',
+  'grok',
+  'xai',
+  'cursor',
+  'cloudflare',
+  'inneranimalmedia',
+]);
 
-function writeLine(write, value = '') { write(`${value}\n`); }
+const PROVIDER_ALIASES = Object.freeze({
+  grok: 'xai',
+  iam: 'inneranimalmedia',
+  agentsam: 'inneranimalmedia',
+  'agentsam-api': 'inneranimalmedia',
+});
+
+function writeLine(write, value = '') {
+  write(`${value}\n`);
+}
+
+function normalizeEnvProvider(raw) {
+  const id = String(raw || '')
+    .trim()
+    .toLowerCase();
+  return PROVIDER_ALIASES[id] || id;
+}
 
 export function detectCloudflareAccounts(options = {}) {
   const env = options.env || process.env;
@@ -11,14 +45,28 @@ export function detectCloudflareAccounts(options = {}) {
   if (explicit) return { accounts: [{ id: explicit, name: null }], source: 'environment' };
   const spawn = options.spawnSyncImpl || spawnSync;
   const npxBin = process.platform === 'win32' ? 'npx.cmd' : 'npx';
-  const result = spawn(npxBin, ['--no-install', 'wrangler', 'whoami', '--json'], { cwd: options.cwd || process.cwd(), env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], shell: process.platform === 'win32' });
-  if (result?.status !== 0) return { accounts: [], source: 'wrangler', error: String(result?.stderr || '').trim() || `wrangler exited ${result?.status ?? 'unknown'}` };
+  const result = spawn(npxBin, ['--no-install', 'wrangler', 'whoami', '--json'], {
+    cwd: options.cwd || process.cwd(),
+    env,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    shell: process.platform === 'win32',
+  });
+  if (result?.status !== 0) {
+    return {
+      accounts: [],
+      source: 'wrangler',
+      error: String(result?.stderr || '').trim() || `wrangler exited ${result?.status ?? 'unknown'}`,
+    };
+  }
   try {
     const parsed = JSON.parse(String(result.stdout || '{}'));
-    const accounts = (Array.isArray(parsed?.accounts) ? parsed.accounts : []).map((row) => ({
-      id: String(row?.id || row?.account_id || '').trim(),
-      name: String(row?.name || row?.account_name || '').trim() || null,
-    })).filter((row) => row.id);
+    const accounts = (Array.isArray(parsed?.accounts) ? parsed.accounts : [])
+      .map((row) => ({
+        id: String(row?.id || row?.account_id || '').trim(),
+        name: String(row?.name || row?.account_name || '').trim() || null,
+      }))
+      .filter((row) => row.id);
     return { accounts, source: 'wrangler', error: null };
   } catch (error) {
     return { accounts: [], source: 'wrangler', error: `invalid wrangler JSON: ${error?.message || error}` };
@@ -35,25 +83,90 @@ function cloudflareGuidance(write) {
   writeLine(write, '  D1 / R2 / KV      add direct product permissions only when AgentSam must read/write those resources directly');
 }
 
+function agentsamApiGuidance(write) {
+  writeLine(write, '');
+  writeLine(write, '  AGENTSAM_API_KEY (aak_*)');
+  writeLine(write, '  Preferred:');
+  writeLine(write, '    agentsam api-key create --name "$(hostname)" --store keychain --activate');
+  writeLine(write, '  Then:');
+  writeLine(write, '    source ~/.agentsam/load-agent-env.sh');
+  writeLine(write, '    agentsam whoami');
+}
+
+function cursorGuidance(write) {
+  writeLine(write, '');
+  writeLine(write, '  CURSOR_API_KEY roll');
+  writeLine(write, '  1. Create a new key in Cursor dashboard');
+  writeLine(write, '  2. printf \'%s\' "$NEW" | agentsam providers add cursor --from-stdin');
+  writeLine(write, '  3. source ~/.agentsam/load-agent-env.sh');
+  writeLine(write, '  4. If Local Studio Worker uses the secret: wrangler secret put CURSOR_API_KEY');
+  writeLine(write, '  Optional: agentsam providers remove cursor --yes  (before add, to force replace)');
+}
+
 export async function runEnv(argv = [], options = {}) {
   const write = options.write || ((text) => process.stdout.write(text));
-  const [command = 'status', providerArg] = argv;
+  const [command = 'status', ...args] = argv;
   let accountId = '';
-  for (let i = 2; i < argv.length; i += 1) {
-    if (argv[i] === '--account-id') accountId = String(argv[++i] || '').trim();
-    else throw new Error(`unexpected env argument: ${argv[i]}`);
+  let profile = 'default';
+  const positionals = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === '--account-id') accountId = String(args[++i] || '').trim();
+    else if (args[i] === '--profile') profile = String(args[++i] || 'default').trim() || 'default';
+    else if (String(args[i] || '').startsWith('-')) throw new Error(`unexpected env argument: ${args[i]}`);
+    else positionals.push(args[i]);
   }
+  const providerArg = positionals[0];
+
   if (command === '--help' || command === '-h' || command === 'help') {
-    writeLine(write, 'agentsam env init <openai|anthropic|gemini|grok|cloudflare> [--account-id <id>]');
+    writeLine(write, 'agentsam env shell [--profile default]   print export lines for eval (keychain/vault)');
+    writeLine(write, 'agentsam env init <openai|anthropic|gemini|grok|cursor|cloudflare|inneranimalmedia> [--account-id <id>]');
     writeLine(write, 'agentsam env status [provider]');
+    writeLine(write, 'agentsam env export <provider>     write ~/.agentsam/env.d from vault (compat fallback)');
+    writeLine(write, 'agentsam env boot-line             print: source ~/.agentsam/load-agent-env.sh');
     return;
   }
+
+  if (command === 'shell') {
+    ensureAgentEnvLoader(options);
+    const result = renderEnvShellExports({
+      ...options,
+      profile,
+      providers: positionals.map(normalizeEnvProvider).filter(Boolean),
+    });
+    write(result.script);
+    return result;
+  }
+
+  if (command === 'boot-line') {
+    ensureAgentEnvLoader(options);
+    writeLine(write, 'source ~/.agentsam/load-agent-env.sh');
+    writeLine(write, `# loader: ${agentEnvLoaderPath(options)}`);
+    writeLine(write, '# prefers: eval "$(agentsam env shell --profile default)"');
+    return { command: 'source ~/.agentsam/load-agent-env.sh' };
+  }
+
+  if (command === 'export') {
+    const provider = normalizeEnvProvider(providerArg);
+    if (!providerCredentialSpec(provider)) throw new Error(`unsupported_provider:${provider}`);
+    const result = exportProviderEnvProfile(provider, options);
+    writeLine(write, '');
+    writeLine(write, `  Exported ${provider}: ${result.file}`);
+    writeLine(write, '  source ~/.agentsam/load-agent-env.sh');
+    writeLine(write, '  (compat: plaintext env.d is opt-in; prefer keychain + env shell)');
+    writeLine(write, '');
+    return result;
+  }
+
   if (command === 'init') {
-    const provider = String(providerArg || '').trim().toLowerCase();
-    if (!PROVIDERS.includes(provider)) throw new Error(`env init requires one of: ${PROVIDERS.join(', ')}`);
+    const provider = normalizeEnvProvider(providerArg);
+    if (!PROVIDERS.includes(provider) && provider !== 'xai') {
+      throw new Error(`env init requires one of: ${PROVIDERS.join(', ')}`);
+    }
     let cloudflareAccounts = null;
     if (provider === 'cloudflare') {
-      if (accountId && !/^[a-f0-9]{32}$/i.test(accountId)) throw new Error('Cloudflare --account-id must be a 32-character hexadecimal account ID');
+      if (accountId && !/^[a-f0-9]{32}$/i.test(accountId)) {
+        throw new Error('Cloudflare --account-id must be a 32-character hexadecimal account ID');
+      }
       cloudflareAccounts = detectCloudflareAccounts({ ...options, accountId });
       if (!accountId && cloudflareAccounts.accounts.length === 1) accountId = cloudflareAccounts.accounts[0].id;
     }
@@ -63,29 +176,43 @@ export async function runEnv(argv = [], options = {}) {
     writeLine(write, `  profile  ${result.file}${result.created ? ' · created' : ' · existing'}`);
     writeLine(write, `  loader   ${result.loader}`);
     writeLine(write, '');
-    writeLine(write, '  Add the credential to the profile, then load it into this shell:');
-    writeLine(write, `    ${result.source_command}`);
+    writeLine(write, '  Prefer vault/keychain storage, then:');
+    writeLine(write, '    source ~/.agentsam/load-agent-env.sh');
     if (provider === 'cloudflare') {
       if (accountId) writeLine(write, `  account  detected/configured (${cloudflareAccounts?.source || 'explicit'})`);
-      else if ((cloudflareAccounts?.accounts || []).length > 1) writeLine(write, `  account  ${cloudflareAccounts.accounts.length} Wrangler accounts found · rerun with --account-id <id>`);
-      else writeLine(write, '  account  not detected · set CLOUDFLARE_ACCOUNT_ID in the profile or rerun with --account-id <id>');
+      else if ((cloudflareAccounts?.accounts || []).length > 1) {
+        writeLine(write, `  account  ${cloudflareAccounts.accounts.length} Wrangler accounts found · rerun with --account-id <id>`);
+      } else {
+        writeLine(write, '  account  not detected · set CLOUDFLARE_ACCOUNT_ID in the profile or rerun with --account-id <id>');
+      }
       cloudflareGuidance(write);
     }
+    if (provider === 'inneranimalmedia') agentsamApiGuidance(write);
+    if (provider === 'cursor') cursorGuidance(write);
     writeLine(write, '');
     return result;
   }
+
   if (command === 'status') {
-    const providers = providerArg ? [String(providerArg).trim().toLowerCase()] : PROVIDERS;
-    for (const provider of providers) if (!providerCredentialSpec(provider)) throw new Error(`unsupported_provider:${provider}`);
+    const providers = providerArg
+      ? [normalizeEnvProvider(providerArg)]
+      : PROVIDERS.filter((p) => p !== 'grok');
+    for (const provider of providers) {
+      if (!providerCredentialSpec(provider)) throw new Error(`unsupported_provider:${provider}`);
+    }
     writeLine(write, '');
     writeLine(write, '  AgentSam · provider environments');
     for (const provider of providers) {
       const row = describeProviderCredential(provider, options);
       const extra = row.account_id ? ` · account ${row.account_id}` : '';
-      writeLine(write, `  ${provider.padEnd(12)} ${row.configured ? 'configured' : row.error ? `blocked (${row.error})` : 'not configured'}${extra}`);
+      const state = row.configured ? `available · ${row.source || 'runtime'}${extra}` : row.error || 'not configured';
+      writeLine(write, `  ${String(row.label || provider).padEnd(22)} ${state}`);
     }
     writeLine(write, '');
-    return;
+    writeLine(write, '  Load: source ~/.agentsam/load-agent-env.sh');
+    writeLine(write, '');
+    return { providers: listProviderCredentialStatus(options) };
   }
+
   throw new Error(`unknown env command: ${command}`);
 }