@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.5

package/src/lib/app-authority.js

@@ -0,0 +1,172 @@
+/**
+ * APP / HOST / PLATFORM authority resolution.
+ *
+ * One canonical identifier per namespace — no alias env vars.
+ *   APP.id     → agentsam.app.json
+ *   HOST       → agentsam.app.json hosts[] (host_id + origin)
+ *   PLATFORM   → IAM_OAUTH_ISSUER (account API / OAuth issuer)
+ *
+ * Relationships are explicit pointers, never collapsed aliases like
+ * AGENTSAM_STUDIO_ORIGIN ≈ AGENTSAM_LOCAL_STUDIO_ORIGIN ≈ IAM_OAUTH_ISSUER.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  PLATFORM_ACCOUNT_ISSUER,
+  resolveIamIssuer,
+} from '../../packages/identity/src/contracts/auth-config.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(HERE, '../..');
+
+/** PLATFORM account-authority issuer — re-export from identity contract. */
+export { PLATFORM_ACCOUNT_ISSUER };
+
+/** APP.id for the Local Studio host product. */
+export const LOCAL_STUDIO_APP_ID = 'local-studio';
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function normalizeOrigin(value) {
+  return clean(value).replace(/\/+$/, '');
+}
+
+function readManifestFile(manifestPath) {
+  if (!fs.existsSync(manifestPath)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function readAppManifest(appId, root = REPO_ROOT) {
+  const id = clean(appId);
+  if (!id) return null;
+  for (const parent of ['apps', 'packages']) {
+    const manifestPath = path.join(root, parent, id, 'agentsam.app.json');
+    const manifest = readManifestFile(manifestPath);
+    if (manifest) return manifest;
+  }
+  return null;
+}
+
+/**
+ * HOST namespace entries declared on an APP manifest.
+ * @returns {Array<{ host_id: string, origin: string, role?: string }>}
+ */
+export function listAppHosts(appId, options = {}) {
+  const manifest = readAppManifest(appId, options.root || REPO_ROOT);
+  const hosts = manifest?.hosts;
+  if (!Array.isArray(hosts)) return [];
+  return hosts
+    .map((row) => ({
+      host_id: clean(row?.host_id || row?.id),
+      origin: normalizeOrigin(row?.origin),
+      role: clean(row?.role) || null,
+    }))
+    .filter((row) => row.host_id && row.origin);
+}
+
+/**
+ * Resolve one HOST origin for an APP.
+ * Prefers role=production, then first declared host.
+ */
+export function resolveAppHostOrigin(appId, options = {}) {
+  const hosts = listAppHosts(appId, options);
+  if (!hosts.length) return '';
+  if (options.hostId) {
+    const hit = hosts.find((h) => h.host_id === options.hostId);
+    return hit?.origin || '';
+  }
+  const role = clean(options.role) || 'production';
+  const byRole = hosts.find((h) => h.role === role);
+  return (byRole || hosts[0]).origin;
+}
+
+
+/**
+ * Resolve APP/HOST context from the actual execution directory.
+ * Generic repo-root commands intentionally return null APP/HOST values.
+ * The nearest agentsam.app.json is authoritative when inside an app/package.
+ */
+export function resolveCurrentAppContext(options = {}) {
+  const root = path.resolve(options.root || REPO_ROOT);
+  const explicitAppId = clean(options.appId);
+  if (explicitAppId) {
+    const manifest = readAppManifest(explicitAppId, root);
+    if (!manifest) {
+      return { app_id: null, host_origin: null, source: null };
+    }
+    const appId = clean(manifest.id) || explicitAppId;
+    return {
+      app_id: appId,
+      host_origin: resolveAppHostOrigin(explicitAppId, {
+        root,
+        role: options.role || 'production',
+        hostId: options.hostId,
+      }) || null,
+      source: 'explicit-app-id',
+    };
+  }
+
+  let current = path.resolve(options.cwd || process.cwd());
+  const relative = path.relative(root, current);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    return { app_id: null, host_origin: null, source: null };
+  }
+
+  while (current === root || current.startsWith(root + path.sep)) {
+    const manifestPath = path.join(current, 'agentsam.app.json');
+    const manifest = readManifestFile(manifestPath);
+    if (manifest) {
+      const appId = clean(manifest.id);
+      const hosts = Array.isArray(manifest.hosts) ? manifest.hosts : [];
+      const hostRows = hosts
+        .map((row) => ({
+          host_id: clean(row?.host_id || row?.id),
+          origin: normalizeOrigin(row?.origin),
+          role: clean(row?.role) || null,
+        }))
+        .filter((row) => row.host_id && row.origin);
+      const role = clean(options.role) || 'production';
+      const host = options.hostId
+        ? hostRows.find((row) => row.host_id === options.hostId)
+        : (hostRows.find((row) => row.role === role) || hostRows[0]);
+      return {
+        app_id: appId || null,
+        host_origin: host?.origin || null,
+        source: manifestPath,
+      };
+    }
+    if (current === root) break;
+    current = path.dirname(current);
+  }
+
+  return { app_id: null, host_origin: null, source: null };
+}
+
+/**
+ * PLATFORM issuer for account API / whoami / aak_* calls.
+ * Delegates to identity resolveIamIssuer (never APP host).
+ */
+export function resolvePlatformAccountIssuer(env = process.env, explicit = '') {
+  return resolveIamIssuer(env, explicit);
+}
+
+/**
+ * Origin for Google / Cloudflare identity + CF connection OAuth owned by local-studio.
+ * HOST namespace from APP.hosts — never aliased to IAM_OAUTH_ISSUER.
+ */
+export function resolveLocalStudioHostOrigin(options = {}) {
+  const fromManifest = resolveAppHostOrigin(LOCAL_STUDIO_APP_ID, {
+    root: options.root,
+    role: options.role || 'production',
+    hostId: options.hostId,
+  });
+  if (fromManifest) return fromManifest;
+  return 'https://agentsam.inneranimalmedia.com';
+}

package/src/lib/auth.js

@@ -1,9 +1,8 @@
 /**
  * RFC 8252 native-app OAuth for AgentSam CLI.
  *
- * The CLI is a public client: authorization code + PKCE over a loopback
- * redirect. Browser OAuth sessions are machine-local and remain separate from
- * reusable AGENTSAM_API_KEY (aak_*) credentials.
+ * The CLI is a public PKCE client of canonical IAM. It does not reuse the
+ * confidential hosted-web client or ship an IAM client secret.
  */
 import http from 'node:http';
 import { createHash, randomBytes } from 'node:crypto';
@@ -16,9 +15,10 @@ import {
   saveAccountSession,
 } from './account-session.js';
 
-export const AGENTSAM_NATIVE_OAUTH_CLIENT_ID = 'iam_cli_agentsam';
-export const AGENTSAM_NATIVE_OAUTH_SCOPE = 'openid profile email offline_access';
+export const AGENTSAM_OAUTH_SCOPE = 'openid profile email offline_access';
 export const AGENTSAM_OAUTH_CALLBACK_PATH = '/callback';
+/** First-party public OAuth client used by the AgentSam CLI. */
+export const DEFAULT_AGENTSAM_IAM_CLIENT_ID = 'iam_cli_agentsam';
 
 function clean(value) { return value == null ? '' : String(value).trim(); }
 function base64url(value) {
@@ -37,6 +37,22 @@ function oauthErrorMessage(body, status) {
   return code || description || `OAuth token HTTP ${status}`;
 }
 
+/**
+ * Resolve the public native IAM OAuth client for the CLI.
+ * IAM_CLIENT_ID belongs to hosted/confidential app surfaces and is intentionally ignored.
+ * @returns {{ clientId: string, error: null } | { clientId: string, error: string }}
+ */
+export function resolveIamClientId(options = {}) {
+  const env = options.env || process.env;
+  const clientId = clean(options.clientId)
+    || clean(env.AGENTSAM_NATIVE_OAUTH_CLIENT_ID)
+    || DEFAULT_AGENTSAM_IAM_CLIENT_ID;
+  if (!clientId) {
+    return { error: 'iam_oauth_not_configured', clientId: '' };
+  }
+  return { clientId, error: null };
+}
+
 export function createPkcePair(options = {}) {
   const verifier = randomUrlSafe(32, options.randomBytesImpl || randomBytes);
   const challenge = base64url(createHash('sha256').update(verifier, 'ascii').digest());
@@ -46,11 +62,17 @@ export function createPkcePair(options = {}) {
 export function buildNativeAuthorizationUrl(options = {}) {
   const env = options.env || process.env;
   const issuer = resolveIamIssuer(env, options.issuer || '');
-  const clientId = clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const resolved = resolveIamClientId(options);
+  if (resolved.error) {
+    const err = new Error(resolved.error);
+    err.code = resolved.error;
+    throw err;
+  }
+  const clientId = resolved.clientId;
   const redirectUri = clean(options.redirectUri);
   const state = clean(options.state);
   const codeChallenge = clean(options.codeChallenge);
-  const scope = clean(options.scope ?? AGENTSAM_NATIVE_OAUTH_SCOPE);
+  const scope = clean(options.scope ?? AGENTSAM_OAUTH_SCOPE);
   if (!redirectUri || !state || !codeChallenge) throw new Error('oauth_authorization_parameters_required');
 
   const url = new URL('/api/oauth/authorize', `${issuer}/`);
@@ -73,7 +95,6 @@ async function oauthTokenRequest(params, options = {}) {
     const normalized = clean(value);
     if (normalized) body.set(key, normalized);
   }
-
   const response = await fetchImpl(new URL('/api/oauth/token', `${issuer}/`).toString(), {
     method: 'POST',
     headers: {
@@ -99,9 +120,15 @@ export async function exchangeAuthorizationCode(options = {}) {
   const codeVerifier = clean(options.codeVerifier);
   const redirectUri = clean(options.redirectUri);
   if (!code || !codeVerifier || !redirectUri) throw new Error('oauth_authorization_code_exchange_parameters_required');
+  const resolved = resolveIamClientId(options);
+  if (resolved.error) {
+    const err = new Error(resolved.error);
+    err.code = resolved.error;
+    throw err;
+  }
   return oauthTokenRequest({
     grant_type: 'authorization_code',
-    client_id: clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID,
+    client_id: resolved.clientId,
     redirect_uri: redirectUri,
     code,
     code_verifier: codeVerifier,
@@ -111,17 +138,25 @@ export async function exchangeAuthorizationCode(options = {}) {
 export async function refreshAccountSession(options = {}) {
   const session = options.session || readAccountSession(options);
   if (!session?.refresh_token) throw new Error('browser_oauth_refresh_unavailable');
-  const clientId = clean(session.client_id) || clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const resolved = resolveIamClientId({
+    ...options,
+    clientId: clean(session.client_id) || clean(options.clientId),
+  });
+  if (resolved.error) {
+    const err = new Error(resolved.error);
+    err.code = resolved.error;
+    throw err;
+  }
   const refreshed = await oauthTokenRequest({
     grant_type: 'refresh_token',
-    client_id: clientId,
+    client_id: resolved.clientId,
     refresh_token: session.refresh_token,
   }, options);
 
   return saveAccountSession({
     ...refreshed,
     refresh_token: clean(refreshed.refresh_token) || session.refresh_token,
-    client_id: clientId,
+    client_id: resolved.clientId,
     user_id: session.user_id,
     account_id: session.account_id,
     email: session.email,
@@ -150,7 +185,7 @@ export async function resolveAccountAuthority(options = {}) {
       return {
         value: '',
         source: 'agentsam_browser_oauth',
-        kind: 'browser_oauth',
+        kind: 'agentsam_browser_oauth',
         session,
         error: 'browser_oauth_session_expired',
       };
@@ -162,7 +197,7 @@ export async function resolveAccountAuthority(options = {}) {
       return {
         value: '',
         source: 'agentsam_browser_oauth',
-        kind: 'browser_oauth',
+        kind: 'agentsam_browser_oauth',
         session,
         error: `browser_oauth_refresh_failed: ${error?.message || String(error)}`,
       };
@@ -172,7 +207,7 @@ export async function resolveAccountAuthority(options = {}) {
   return {
     value: session.access_token,
     source: 'agentsam_browser_oauth',
-    kind: 'browser_oauth',
+    kind: 'agentsam_browser_oauth',
     session,
     fallback_error: apiKey.error || null,
   };
@@ -201,6 +236,13 @@ export async function createLoopbackCallbackListener(options = {}) {
 
   const server = createServerImpl((req, res) => {
     try {
+      const method = String(req.method || 'GET').toUpperCase();
+      if (method !== 'GET' && method !== 'HEAD') {
+        res.writeHead(405, { 'Content-Type': 'text/plain; charset=utf-8', Allow: 'GET' });
+        res.end('Method not allowed');
+        return;
+      }
+
       const requestUrl = new URL(req.url || '/', `http://${host}`);
       if (requestUrl.pathname !== callbackPath) {
         res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
@@ -212,6 +254,7 @@ export async function createLoopbackCallbackListener(options = {}) {
       const oauthError = clean(requestUrl.searchParams.get('error'));
       const oauthDescription = clean(requestUrl.searchParams.get('error_description'));
       const code = clean(requestUrl.searchParams.get('code'));
+      const pickup = clean(requestUrl.searchParams.get('pickup'));
 
       if (!returnedState || returnedState !== expectedState) {
         res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
@@ -225,16 +268,25 @@ export async function createLoopbackCallbackListener(options = {}) {
         settle(new Error(oauthDescription ? `${oauthError}: ${oauthDescription}` : oauthError));
         return;
       }
+      // Studio Web-brokered CLI cloud login returns pickup= instead of Google code=.
+      if (pickup) {
+        settle(null, { pickup, state: returnedState, mode: 'studio_pickup' });
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end('<!doctype html><html><body style="font-family:system-ui"><h1>Agent Sam</h1><p>Authentication complete. You can close this tab and return to your terminal.</p></body></html>');
+        return;
+      }
       if (!code) {
+        // Ignore probe/prefetch hits with no code so a later real redirect can settle.
         res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
         res.end('Authorization code missing. Return to the terminal and retry.');
-        settle(new Error('oauth_authorization_code_missing'));
         return;
       }
 
+      // Settle before writing the body so the CLI continues even if the client
+      // disconnects mid-response (common with some browsers closing the tab).
+      settle(null, { code, state: returnedState, mode: 'google_code' });
       res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
       res.end('<!doctype html><html><body style="font-family:system-ui"><h1>Agent Sam</h1><p>Authentication complete. You can close this tab and return to your terminal.</p></body></html>');
-      settle(null, { code, state: returnedState });
     } catch (error) {
       try {
         res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
@@ -279,7 +331,21 @@ export async function createLoopbackCallbackListener(options = {}) {
 
 export async function authenticateViaBrowser(options = {}) {
   const env = options.env || process.env;
-  const clientId = clean(options.clientId) || AGENTSAM_NATIVE_OAUTH_CLIENT_ID;
+  const resolved = resolveIamClientId(options);
+  if (resolved.error) {
+    const err = new Error(
+      'IAM OAuth is not configured. AgentSam CLI uses the public PKCE client '
+      + `${DEFAULT_AGENTSAM_IAM_CLIENT_ID}. Set AGENTSAM_NATIVE_OAUTH_CLIENT_ID only to override that registered native client. `
+      + 'Do not use IAM_CLIENT_ID/IAM_CLIENT_SECRET for CLI authentication.',
+    );
+    err.code = 'iam_oauth_not_configured';
+    throw err;
+  }
+  const clientId = resolved.clientId;
+  // Native login always enters through the canonical IAM portal. Google or other
+  // login methods may be offered by IAM itself; provider grants are not CLI sessions.
+  const issuer = resolveIamIssuer(env, options.issuer || '');
+
   const state = randomUrlSafe(24, options.randomBytesImpl || randomBytes);
   const pkce = createPkcePair({ randomBytesImpl: options.randomBytesImpl });
   const listener = await createLoopbackCallbackListener({
@@ -302,10 +368,17 @@ export async function authenticateViaBrowser(options = {}) {
       scope: options.scope,
     });
 
+    // Gate through IAM /auth/login; authorize URL preserved in `next`.
+    const authorizePath = authorizationUrl.startsWith(issuer)
+      ? authorizationUrl.slice(issuer.length)
+      : authorizationUrl.replace(/^https?:\/\/[^/]+/, '');
+    const loginGateUrl = new URL('/auth/login', `${issuer}/`);
+    loginGateUrl.searchParams.set('next', authorizePath.startsWith('/') ? authorizePath : `/${authorizePath}`);
+
     const promptImpl = options.promptToOpenUrlImpl || promptToOpenUrl;
-    await promptImpl(authorizationUrl, {
-      heading: 'Authenticate your InnerAnimalMedia account at:',
-      prompt: 'Press ENTER to open InnerAnimalMedia sign-in in your browser.',
+    await promptImpl(loginGateUrl.toString(), {
+      heading: 'Authenticate your Inner Animal Media account at:',
+      prompt: 'Press ENTER to open Inner Animal Media sign-in in your browser.',
       input: options.input,
       output: options.output,
       openImpl: options.openImpl,

package/src/lib/core-client.js

@@ -1,15 +1,14 @@
-import { resolveIamOrigin } from '../../packages/identity/src/contracts/auth-config.js';
 import { resolveAccountAuthority } from './auth.js';
+import { resolvePlatformAccountIssuer } from './app-authority.js';
 
 /**
  * IAM CORE client — SDK is a delivery mechanism; intelligence lives server-side.
  *
- * IAM_OAUTH_ISSUER is the canonical platform authority/API origin. IAM_ORIGIN,
- * IAM_CORE_URL and AGENTSAM_CORE_URL remain compatibility fallbacks.
+ * PLATFORM namespace: IAM_OAUTH_ISSUER (account API). Falls back to platform default
+ * via resolvePlatformAccountIssuer — never aliases Local Studio APP HOST.
  */
 export function coreBaseUrl(env = process.env) {
-  const explicit = env?.IAM_OAUTH_ISSUER || env?.IAM_ORIGIN || env?.IAM_CORE_URL || env?.AGENTSAM_CORE_URL || '';
-  return resolveIamOrigin(env, explicit);
+  return resolvePlatformAccountIssuer(env);
 }
 
 function authOptions(options) {
@@ -49,7 +48,7 @@ async function authorizedFetch(url, init, options = {}) {
   const baseHeaders = init.headers || {};
   let resolved = await authorizedHeaders(baseHeaders, options);
   let response = await (options.fetchImpl || fetch)(url, { ...init, headers: resolved.headers });
-  if (response.status === 401 && resolved.authority?.kind === 'browser_oauth' && options.forceRefresh !== true) {
+  if (response.status === 401 && ['browser_oauth', 'agentsam_browser_oauth'].includes(resolved.authority?.kind) && options.forceRefresh !== true) {
     resolved = await authorizedHeaders(baseHeaders, { ...options, forceRefresh: true });
     response = await (options.fetchImpl || fetch)(url, { ...init, headers: resolved.headers });
   }