@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/src/lib/auth.js

@@ -1,9 +1,8 @@
 /**
  * RFC 8252 native-app OAuth for AgentSam CLI.
  *
- * The CLI is a public client: authorization code + PKCE over a loopback
- * redirect. Browser OAuth sessions are machine-local and remain separate from
- * reusable AGENTSAM_API_KEY (aak_*) credentials.
+ * The CLI is a public PKCE client of canonical IAM. It does not reuse the
+ * confidential hosted-web client or ship an IAM client secret.
  */
 import http from 'node:http';
 import { createHash, randomBytes } from 'node:crypto';
@@ -16,9 +15,10 @@ import {
   saveAccountSession,
 } from './account-session.js';
 
-export const AGENTSAM_NATIVE_OAUTH_CLIENT_ID = 'iam_cli_agentsam';
-export const AGENTSAM_NATIVE_OAUTH_SCOPE = 'openid profile email offline_access';
+export const AGENTSAM_OAUTH_SCOPE = 'openid profile email offline_access';
 export const AGENTSAM_OAUTH_CALLBACK_PATH = '/callback';
+/** First-party public OAuth client used by the AgentSam CLI. */
+export const DEFAULT_AGENTSAM_IAM_CLIENT_ID = 'iam_cli_agentsam';
 
 function clean(value) { return value == null ? '' : String(value).trim(); }
 function base64url(value) {
@@ -37,6 +37,22 @@ function oauthErrorMessage(body, status) {
   return code || description || `OAuth token HTTP ${status}`;
 }
 
+/**
+ * Resolve the public native IAM OAuth client for the CLI.
+ * IAM_CLIENT_ID belongs to hosted/confidential app surfaces and is intentionally ignored.
+ * @returns {{ clientId: string, error: null } | { clientId: string, error: string }}
+ */
+export function resolveIamClientId(options = {}) {
+  const env = options.env || process.env;
+  const clientId = clean(options.clientId)
+    || clean(env.AGENTSAM_NATIVE_OAUTH_CLIENT_ID)
+    || DEFAULT_AGENTSAM_IAM_CLIENT_ID;
+  if (!clientId) {
+    return { error: 'iam_oauth_not_configured', clientId: '' };
+  }
+  return { clientId, error: null };
+}
+
 export function createPkcePair(options = {}) {
   const verifier = randomUrlSafe(32, options.randomBytesImpl || randomBytes);
   const challenge = base64url(createHash('sha256').update(verifier, 'ascii').digest());
@@ -46,11 +62,17 @@ export function createPkcePair(options = {}) {
 export function buildNativeAuthorizationUrl(options = {}) {
   const env = options.env || process.env;
   const issuer = resolveIamIssuer(env, options.issuer || '');
-  const clientId = clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const resolved = resolveIamClientId(options);
+  if (resolved.error) {
+    const err = new Error(resolved.error);
+    err.code = resolved.error;
+    throw err;
+  }
+  const clientId = resolved.clientId;
   const redirectUri = clean(options.redirectUri);
   const state = clean(options.state);
   const codeChallenge = clean(options.codeChallenge);
-  const scope = clean(options.scope ?? AGENTSAM_NATIVE_OAUTH_SCOPE);
+  const scope = clean(options.scope ?? AGENTSAM_OAUTH_SCOPE);
   if (!redirectUri || !state || !codeChallenge) throw new Error('oauth_authorization_parameters_required');
 
   const url = new URL('/api/oauth/authorize', `${issuer}/`);
@@ -73,7 +95,6 @@ async function oauthTokenRequest(params, options = {}) {
     const normalized = clean(value);
     if (normalized) body.set(key, normalized);
   }
-
   const response = await fetchImpl(new URL('/api/oauth/token', `${issuer}/`).toString(), {
     method: 'POST',
     headers: {
@@ -99,9 +120,15 @@ export async function exchangeAuthorizationCode(options = {}) {
   const codeVerifier = clean(options.codeVerifier);
   const redirectUri = clean(options.redirectUri);
   if (!code || !codeVerifier || !redirectUri) throw new Error('oauth_authorization_code_exchange_parameters_required');
+  const resolved = resolveIamClientId(options);
+  if (resolved.error) {
+    const err = new Error(resolved.error);
+    err.code = resolved.error;
+    throw err;
+  }
   return oauthTokenRequest({
     grant_type: 'authorization_code',
-    client_id: clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID,
+    client_id: resolved.clientId,
     redirect_uri: redirectUri,
     code,
     code_verifier: codeVerifier,
@@ -111,17 +138,25 @@ export async function exchangeAuthorizationCode(options = {}) {
 export async function refreshAccountSession(options = {}) {
   const session = options.session || readAccountSession(options);
   if (!session?.refresh_token) throw new Error('browser_oauth_refresh_unavailable');
-  const clientId = clean(session.client_id) || clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const resolved = resolveIamClientId({
+    ...options,
+    clientId: clean(session.client_id) || clean(options.clientId),
+  });
+  if (resolved.error) {
+    const err = new Error(resolved.error);
+    err.code = resolved.error;
+    throw err;
+  }
   const refreshed = await oauthTokenRequest({
     grant_type: 'refresh_token',
-    client_id: clientId,
+    client_id: resolved.clientId,
     refresh_token: session.refresh_token,
   }, options);
 
   return saveAccountSession({
     ...refreshed,
     refresh_token: clean(refreshed.refresh_token) || session.refresh_token,
-    client_id: clientId,
+    client_id: resolved.clientId,
     user_id: session.user_id,
     account_id: session.account_id,
     email: session.email,
@@ -150,7 +185,7 @@ export async function resolveAccountAuthority(options = {}) {
       return {
         value: '',
         source: 'agentsam_browser_oauth',
-        kind: 'browser_oauth',
+        kind: 'agentsam_browser_oauth',
         session,
         error: 'browser_oauth_session_expired',
       };
@@ -162,7 +197,7 @@ export async function resolveAccountAuthority(options = {}) {
       return {
         value: '',
         source: 'agentsam_browser_oauth',
-        kind: 'browser_oauth',
+        kind: 'agentsam_browser_oauth',
         session,
         error: `browser_oauth_refresh_failed: ${error?.message || String(error)}`,
       };
@@ -172,7 +207,7 @@ export async function resolveAccountAuthority(options = {}) {
   return {
     value: session.access_token,
     source: 'agentsam_browser_oauth',
-    kind: 'browser_oauth',
+    kind: 'agentsam_browser_oauth',
     session,
     fallback_error: apiKey.error || null,
   };
@@ -201,6 +236,13 @@ export async function createLoopbackCallbackListener(options = {}) {
 
   const server = createServerImpl((req, res) => {
     try {
+      const method = String(req.method || 'GET').toUpperCase();
+      if (method !== 'GET' && method !== 'HEAD') {
+        res.writeHead(405, { 'Content-Type': 'text/plain; charset=utf-8', Allow: 'GET' });
+        res.end('Method not allowed');
+        return;
+      }
+
       const requestUrl = new URL(req.url || '/', `http://${host}`);
       if (requestUrl.pathname !== callbackPath) {
         res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
@@ -212,6 +254,7 @@ export async function createLoopbackCallbackListener(options = {}) {
       const oauthError = clean(requestUrl.searchParams.get('error'));
       const oauthDescription = clean(requestUrl.searchParams.get('error_description'));
       const code = clean(requestUrl.searchParams.get('code'));
+      const pickup = clean(requestUrl.searchParams.get('pickup'));
 
       if (!returnedState || returnedState !== expectedState) {
         res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
@@ -225,16 +268,25 @@ export async function createLoopbackCallbackListener(options = {}) {
         settle(new Error(oauthDescription ? `${oauthError}: ${oauthDescription}` : oauthError));
         return;
       }
+      // Studio Web-brokered CLI cloud login returns pickup= instead of Google code=.
+      if (pickup) {
+        settle(null, { pickup, state: returnedState, mode: 'studio_pickup' });
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end('<!doctype html><html><body style="font-family:system-ui"><h1>Agent Sam</h1><p>Authentication complete. You can close this tab and return to your terminal.</p></body></html>');
+        return;
+      }
       if (!code) {
+        // Ignore probe/prefetch hits with no code so a later real redirect can settle.
         res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
         res.end('Authorization code missing. Return to the terminal and retry.');
-        settle(new Error('oauth_authorization_code_missing'));
         return;
       }
 
+      // Settle before writing the body so the CLI continues even if the client
+      // disconnects mid-response (common with some browsers closing the tab).
+      settle(null, { code, state: returnedState, mode: 'google_code' });
       res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
       res.end('<!doctype html><html><body style="font-family:system-ui"><h1>Agent Sam</h1><p>Authentication complete. You can close this tab and return to your terminal.</p></body></html>');
-      settle(null, { code, state: returnedState });
     } catch (error) {
       try {
         res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
@@ -279,7 +331,21 @@ export async function createLoopbackCallbackListener(options = {}) {
 
 export async function authenticateViaBrowser(options = {}) {
   const env = options.env || process.env;
-  const clientId = clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const resolved = resolveIamClientId(options);
+  if (resolved.error) {
+    const err = new Error(
+      'IAM OAuth is not configured. AgentSam CLI uses the public PKCE client '
+      + `${DEFAULT_AGENTSAM_IAM_CLIENT_ID}. Set AGENTSAM_NATIVE_OAUTH_CLIENT_ID only to override that registered native client. `
+      + 'Do not use IAM_CLIENT_ID/IAM_CLIENT_SECRET for CLI authentication.',
+    );
+    err.code = 'iam_oauth_not_configured';
+    throw err;
+  }
+  const clientId = resolved.clientId;
+  // Native login always enters through the canonical IAM portal. Google or other
+  // login methods may be offered by IAM itself; provider grants are not CLI sessions.
+  const issuer = resolveIamIssuer(env, options.issuer || '');
+
   const state = randomUrlSafe(24, options.randomBytesImpl || randomBytes);
   const pkce = createPkcePair({ randomBytesImpl: options.randomBytesImpl });
   const listener = await createLoopbackCallbackListener({
@@ -302,10 +368,17 @@ export async function authenticateViaBrowser(options = {}) {
       scope: options.scope,
     });
 
+    // Gate through IAM /auth/login; authorize URL preserved in `next`.
+    const authorizePath = authorizationUrl.startsWith(issuer)
+      ? authorizationUrl.slice(issuer.length)
+      : authorizationUrl.replace(/^https?:\/\/[^/]+/, '');
+    const loginGateUrl = new URL('/auth/login', `${issuer}/`);
+    loginGateUrl.searchParams.set('next', authorizePath.startsWith('/') ? authorizePath : `/${authorizePath}`);
+
     const promptImpl = options.promptToOpenUrlImpl || promptToOpenUrl;
-    await promptImpl(authorizationUrl, {
-      heading: 'Authenticate your InnerAnimalMedia account at:',
-      prompt: 'Press ENTER to open InnerAnimalMedia sign-in in your browser.',
+    await promptImpl(loginGateUrl.toString(), {
+      heading: 'Authenticate your Inner Animal Media account at:',
+      prompt: 'Press ENTER to open Inner Animal Media sign-in in your browser.',
       input: options.input,
       output: options.output,
       openImpl: options.openImpl,

package/src/lib/core-client.js

@@ -1,15 +1,14 @@
-import { resolveIamOrigin } from '../../packages/identity/src/contracts/auth-config.js';
 import { resolveAccountAuthority } from './auth.js';
+import { resolvePlatformAccountIssuer } from './app-authority.js';
 
 /**
  * IAM CORE client — SDK is a delivery mechanism; intelligence lives server-side.
  *
- * IAM_OAUTH_ISSUER is the canonical platform authority/API origin. IAM_ORIGIN,
- * IAM_CORE_URL and AGENTSAM_CORE_URL remain compatibility fallbacks.
+ * PLATFORM namespace: IAM_OAUTH_ISSUER (account API). Falls back to platform default
+ * via resolvePlatformAccountIssuer — never aliases Local Studio APP HOST.
  */
 export function coreBaseUrl(env = process.env) {
-  const explicit = env?.IAM_OAUTH_ISSUER || env?.IAM_ORIGIN || env?.IAM_CORE_URL || env?.AGENTSAM_CORE_URL || '';
-  return resolveIamOrigin(env, explicit);
+  return resolvePlatformAccountIssuer(env);
 }
 
 function authOptions(options) {
@@ -49,7 +48,7 @@ async function authorizedFetch(url, init, options = {}) {
   const baseHeaders = init.headers || {};
   let resolved = await authorizedHeaders(baseHeaders, options);
   let response = await (options.fetchImpl || fetch)(url, { ...init, headers: resolved.headers });
-  if (response.status === 401 && resolved.authority?.kind === 'browser_oauth' && options.forceRefresh !== true) {
+  if (response.status === 401 && ['browser_oauth', 'agentsam_browser_oauth'].includes(resolved.authority?.kind) && options.forceRefresh !== true) {
     resolved = await authorizedHeaders(baseHeaders, { ...options, forceRefresh: true });
     response = await (options.fetchImpl || fetch)(url, { ...init, headers: resolved.headers });
   }