@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/src/lib/terminal-local.js

@@ -0,0 +1,164 @@
+/**
+ * Local terminal surface discovery (ExecOS profiles + machine identity).
+ * Complements remote /api/sdk/context terminal projection — whoami must not
+ * claim terminal.available=false when paired devices exist on this machine.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { collectMachineIdentity } from './terminal/machine-identity.js';
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function homeDirectory(options = {}) {
+  return path.resolve(
+    clean(options.home)
+    || clean(options.env?.HOME)
+    || clean(options.env?.USERPROFILE)
+    || os.homedir(),
+  );
+}
+
+function parseEnvFile(filePath) {
+  const out = {};
+  try {
+    const text = fs.readFileSync(filePath, 'utf8');
+    for (const line of text.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith('#')) continue;
+      const eq = trimmed.indexOf('=');
+      if (eq <= 0) continue;
+      out[trimmed.slice(0, eq).trim()] = trimmed.slice(eq + 1).trim();
+    }
+  } catch {
+    /* ignore */
+  }
+  return out;
+}
+
+function listExecosProfiles(options = {}) {
+  const dir = path.join(homeDirectory(options), '.execos', 'profiles');
+  if (!fs.existsSync(dir)) return [];
+  const rows = [];
+  for (const name of fs.readdirSync(dir)) {
+    if (!name.endsWith('.env')) continue;
+    const full = path.join(dir, name);
+    const env = parseEnvFile(full);
+    const instanceId = clean(env.IAM_INSTANCE_ID) || path.basename(name, '.env');
+    rows.push({
+      id: instanceId,
+      instance_id: instanceId,
+      name: instanceId,
+      kind: 'local_device',
+      provider: 'execos',
+      compute_provider: 'execos',
+      status: clean(env.AGENTSAM_BRIDGE_KEY) || clean(env.IAM_CONNECTION_KEY) ? 'paired' : 'profile',
+      hostname: null,
+      platform: process.platform === 'darwin' ? 'macos' : process.platform,
+      arch: process.arch === 'arm64' ? 'arm64' : process.arch,
+      hw_model: null,
+      active_connection_count: clean(env.IAM_CONNECTION_ID) ? 1 : 0,
+      default_connection_id: clean(env.IAM_CONNECTION_ID) || null,
+      last_seen_at: null,
+      last_seen_at_iso: null,
+      source: 'execos_profile',
+      profile_path: full,
+      public_url: clean(env.TUNNEL_URL) || null,
+      endpoint_url: clean(env.TUNNEL_URL) || null,
+      connection_id: clean(env.IAM_CONNECTION_ID) || null,
+      account_id: clean(env.IAM_ACCOUNT_ID) || null,
+    });
+  }
+  return rows;
+}
+
+/**
+ * @returns {Promise<{ available: boolean, instances: object[], connections: object[], local: object }>}
+ */
+export async function collectLocalTerminalContext(options = {}) {
+  const identity = await (options.collectIdentity || collectMachineIdentity)();
+  const profiles = listExecosProfiles(options);
+  const instances = profiles.map((row) => ({
+    ...row,
+    hostname: row.hostname || identity.hostname || null,
+    hw_model: row.hw_model || identity.model || null,
+    arch: row.arch || identity.arch || null,
+    platform: row.platform || identity.platform || null,
+  }));
+
+  const connections = profiles
+    .filter((row) => row.connection_id)
+    .map((row) => ({
+      id: row.connection_id,
+      connection_id: row.connection_id,
+      instance_id: row.instance_id,
+      name: row.name,
+      kind: 'local_device',
+      provider: 'execos',
+      compute_provider: 'execos',
+      transport: 'tunnel',
+      transport_provider: 'cloudflare_tunnel',
+      endpoint_url: row.endpoint_url,
+      route_hostname: null,
+      public_url: row.public_url,
+      is_active: true,
+      is_default: true,
+      health_status: 'local_profile',
+      last_seen_at: null,
+      last_seen_at_iso: null,
+      source: 'execos_profile',
+    }));
+
+  return {
+    available: instances.length > 0 || Boolean(identity?.hostname),
+    instances,
+    connections,
+    local: {
+      hostname: identity.hostname || null,
+      platform: identity.platform || null,
+      arch: identity.arch || null,
+      hw_model: identity.model || null,
+      execos_profiles: profiles.length,
+    },
+  };
+}
+
+/**
+ * Merge remote SDK context terminal with local ExecOS/machine discovery.
+ * Local paired devices must remain visible even when remote context is empty.
+ */
+export function mergeTerminalContexts(remote = {}, local = {}) {
+  const byInstance = new Map();
+  for (const row of remote?.instances || []) {
+    const id = row?.id || row?.instance_id;
+    if (id) byInstance.set(id, { ...row, source: row.source || 'remote' });
+  }
+  for (const row of local?.instances || []) {
+    const id = row?.id || row?.instance_id;
+    if (!id) continue;
+    if (!byInstance.has(id)) byInstance.set(id, row);
+    else byInstance.set(id, { ...byInstance.get(id), ...row, source: 'merged' });
+  }
+
+  const byConnection = new Map();
+  for (const row of remote?.connections || []) {
+    const id = row?.id || row?.connection_id;
+    if (id) byConnection.set(id, { ...row, source: row.source || 'remote' });
+  }
+  for (const row of local?.connections || []) {
+    const id = row?.id || row?.connection_id;
+    if (!id) continue;
+    if (!byConnection.has(id)) byConnection.set(id, row);
+  }
+
+  const instances = [...byInstance.values()];
+  const connections = [...byConnection.values()];
+  return {
+    available: remote?.available === true || local?.available === true || instances.length > 0,
+    instances,
+    connections,
+    local: local?.local || null,
+  };
+}

package/src/lib/terminal-scopes.js

@@ -0,0 +1,52 @@
+/**
+ * AgentSam API credential terminal scopes (CLI/whoami).
+ * Keep in sync with IAM backend/auth/agentsam-terminal-scopes.js.
+ */
+
+export const TERMINAL_SCOPES = Object.freeze({
+  LOCAL: 'terminal:exec:local',
+  REMOTE: 'terminal:exec:remote',
+  SANDBOX: 'terminal:exec:sandbox',
+  ENROLL: 'terminal:enroll',
+  EXEC_ALL: 'terminal:exec:*',
+});
+
+export const ALL_TERMINAL_SCOPES = Object.freeze(Object.values(TERMINAL_SCOPES));
+
+export function normalizeScopeList(scopes) {
+  if (!Array.isArray(scopes)) return [];
+  return scopes.map((s) => String(s || '').trim()).filter(Boolean);
+}
+
+export function credentialHasScope(scopes, required) {
+  const need = String(required || '').trim();
+  if (!need) return false;
+  const set = new Set(normalizeScopeList(scopes));
+  if (set.has(need)) return true;
+  if (need.startsWith('terminal:exec:') && need !== TERMINAL_SCOPES.EXEC_ALL && set.has(TERMINAL_SCOPES.EXEC_ALL)) {
+    return true;
+  }
+  return false;
+}
+
+export function projectTerminalCapability(scopes = []) {
+  const list = normalizeScopeList(scopes);
+  const local = credentialHasScope(list, TERMINAL_SCOPES.LOCAL);
+  const remote = credentialHasScope(list, TERMINAL_SCOPES.REMOTE);
+  const sandbox = credentialHasScope(list, TERMINAL_SCOPES.SANDBOX);
+  const enroll = credentialHasScope(list, TERMINAL_SCOPES.ENROLL);
+  const available = local || remote || sandbox || enroll;
+  return {
+    available,
+    scopes: list.filter((s) => s.startsWith('terminal:')),
+    lanes: {
+      local,
+      remote,
+      sandbox,
+      enroll,
+    },
+    next: available
+      ? null
+      : 'agentsam api-key create --name terminal --scopes terminal:exec:local,terminal:exec:remote,terminal:exec:sandbox,terminal:enroll --store keychain --activate',
+  };
+}

package/src/lib/whoami-capabilities.js

@@ -0,0 +1,184 @@
+/**
+ * Honest whoami capability projection — driven by credentials + live discovery,
+ * not hardcoded "sqlite / local_exact / 5 providers" stubs.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { collectModelsStatus } from '../commands/models.js';
+import { listProviderCredentialStatus } from './provider-credentials.js';
+import {
+  listCloudflareFeaturePacks,
+  scopesForFeaturePacks,
+} from '../../packages/connectors/cloudflare/src/index.js';
+import { projectTerminalCapability } from './terminal-scopes.js';
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function detectLocalD1Bindings(cwd = process.cwd()) {
+  const names = [];
+  for (const file of ['wrangler.toml', 'wrangler.jsonc', 'wrangler.json']) {
+    const full = path.join(cwd, file);
+    if (!fs.existsSync(full)) continue;
+    try {
+      const text = fs.readFileSync(full, 'utf8');
+      for (const match of text.matchAll(/database_name\s*=\s*["']([^"']+)["']/g)) {
+        names.push(match[1]);
+      }
+      for (const match of text.matchAll(/"database_name"\s*:\s*"([^"]+)"/g)) {
+        names.push(match[1]);
+      }
+    } catch {
+      /* ignore */
+    }
+  }
+  return [...new Set(names)];
+}
+
+function detectHyperdriveHints(cwd = process.cwd()) {
+  const ids = [];
+  for (const file of ['wrangler.toml', 'wrangler.jsonc', 'wrangler.json']) {
+    const full = path.join(cwd, file);
+    if (!fs.existsSync(full)) continue;
+    try {
+      const text = fs.readFileSync(full, 'utf8');
+      if (/hyperdrive/i.test(text)) ids.push('hyperdrive_binding');
+      for (const match of text.matchAll(/id\s*=\s*["']([a-f0-9-]{20,})["']/gi)) {
+        if (/hyperdrive/i.test(text.slice(Math.max(0, match.index - 80), match.index + 20))) {
+          ids.push(match[1]);
+        }
+      }
+    } catch {
+      /* ignore */
+    }
+  }
+  return [...new Set(ids)];
+}
+
+/**
+ * @param {{ env?: NodeJS.ProcessEnv, home?: string, cwd?: string, discoverRemote?: boolean, tokenPermissions?: string[] }} [options]
+ */
+export async function projectWhoamiCapabilities(options = {}) {
+  const env = options.env || process.env;
+  const cwd = options.cwd || process.cwd();
+  const discoverRemote = options.discoverRemote !== false;
+  const tokenPermissions = Array.isArray(options.tokenPermissions) ? options.tokenPermissions : [];
+
+  const providerStatus = listProviderCredentialStatus({ env, home: options.home });
+  const configuredProviders = providerStatus.filter((row) => row.configured);
+
+  let modelsStatus = null;
+  try {
+    modelsStatus = await collectModelsStatus({
+      env,
+      home: options.home,
+      discoverRemote,
+      includeLocal: true,
+    });
+  } catch (error) {
+    modelsStatus = { error: error?.message || String(error), providers: [], models: [] };
+  }
+
+  const modelRows = Array.isArray(modelsStatus?.models) ? modelsStatus.models : [];
+  const byProvider = {};
+  for (const row of modelRows) {
+    const provider = row.provider || 'unknown';
+    byProvider[provider] = (byProvider[provider] || 0) + 1;
+  }
+
+  const d1Bindings = detectLocalD1Bindings(cwd);
+  const hyperdrive = detectHyperdriveHints(cwd);
+  const hasCfToken = Boolean(
+    clean(env.CLOUDFLARE_API_TOKEN)
+    || configuredProviders.some((row) => row.provider === 'cloudflare' && row.configured),
+  );
+  const hasOpenai = configuredProviders.some((row) => row.provider === 'openai');
+  const hasSupabase = Boolean(
+    clean(env.SUPABASE_URL) || clean(env.SUPABASE_DB_URL) || clean(env.DATABASE_URL),
+  );
+
+  const database = {
+    available: true,
+    drivers: [
+      { id: 'sqlite', mode: 'read_write', source: 'local_project' },
+      ...(d1Bindings.length
+        ? [{ id: 'd1', mode: hasCfToken ? 'read_write_delete' : 'bound_needs_cf_auth', source: 'wrangler', databases: d1Bindings }]
+        : []),
+      ...(hyperdrive.length
+        ? [{ id: 'hyperdrive', mode: hasCfToken ? 'read_write' : 'bound_needs_cf_auth', source: 'wrangler', bindings: hyperdrive }]
+        : []),
+      ...(hasSupabase
+        ? [{ id: 'supabase_postgres', mode: 'read_write', source: 'env' }]
+        : []),
+    ],
+    next: !hasCfToken && (d1Bindings.length || hyperdrive.length)
+      ? 'agentsam cloudflare login --pack data   # authorize D1/Hyperdrive/Vectorize'
+      : hasSupabase
+        ? null
+        : 'Optional: agentsam cloudflare login --pack data',
+  };
+
+  const vectors = {
+    available: true,
+    drivers: [
+      { id: 'local_exact', mode: 'read_write', source: 'sdk' },
+      ...(hasCfToken
+        ? [{ id: 'cloudflare_vectorize', mode: 'read_write', source: 'cloudflare', authorize: 'agentsam cloudflare login --pack data' }]
+        : [{ id: 'cloudflare_vectorize', mode: 'needs_authorization', source: 'cloudflare', authorize: 'agentsam cloudflare login --pack data' }]),
+    ],
+  };
+
+  const models = {
+    available: configuredProviders.length > 0 || modelRows.length > 0,
+    configuredProviders: configuredProviders.map((row) => row.provider),
+    discovered_model_counts: byProvider,
+    discovered_total: modelRows.length,
+    source: 'provider_api_when_key_present',
+    next: configuredProviders.length
+      ? 'agentsam models   # refresh live inventory from your stored provider keys'
+      : 'agentsam providers   # store OPENAI_API_KEY / etc, then agentsam models',
+    note: 'Allowed models = whatever each connected provider key returns (not a static SDK list).',
+  };
+
+  const cloudflare = {
+    available: hasCfToken,
+    packs: listCloudflareFeaturePacks().map((pack) => ({
+      id: pack.id,
+      label: pack.label,
+      description: pack.description,
+      capability_count: pack.capabilities.length,
+    })),
+    agentsam_pack_scopes: scopesForFeaturePacks(['agentsam']).length,
+    next: hasCfToken
+      ? 'agentsam cloudflare permissions --json'
+      : 'agentsam cloudflare login --pack agentsam',
+  };
+
+  const tools = {
+    agentsam_tools: {
+      hyperdrive: hyperdrive.length > 0 || hasCfToken,
+      supabase: hasSupabase,
+      d1: d1Bindings.length > 0,
+      next: 'Enable via CF pack data + provider vault — then agentsam tools / MCP',
+    },
+  };
+
+  return {
+    repository: { available: true },
+    database,
+    vectors,
+    models,
+    terminal: projectTerminalCapability(tokenPermissions),
+    deploy: { available: hasCfToken || Boolean(clean(env.CLOUDFLARE_ACCOUNT_ID)) },
+    cloudflare,
+    tools,
+    edit: {
+      providers: 'agentsam providers',
+      models: 'agentsam models',
+      cloudflare_packs: 'agentsam cloudflare login --pack <data|compute|ai|agentsam>',
+      capabilities: 'agentsam capabilities',
+      api_keys: 'agentsam api-key create --store keychain --activate',
+    },
+  };
+}

package/src/local-pty/server.js

@@ -1,11 +1,17 @@
 /**
- * Agent Sam local PTY + filesystem — localhost WebSocket shell + /v1/fs HTTP.
- * No tunnel, no IAM. Compatible with iam-pty wire format (raw bytes + JSON resize/slash).
+ * Agent Sam local PTY + filesystem — Studio workspace plane (loopback only).
+ *
+ * This is NOT ExecOS enroll (`AGENTSAM_BRIDGE_KEY` / terminal_connections).
+ * Studio binds a workspace capability on 127.0.0.1 and speaks the portable
+ * PTY wire format (raw bytes + JSON resize/slash) plus /v1/fs HTTP.
+ *
+ * Remote / paired terminals use ExecOS + control-plane enroll separately.
  */
 import fs from 'node:fs';
 import http from 'node:http';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 import { WebSocketServer } from 'ws';
 import { createLocalFilesystem } from '../local-fs/index.js';
 import { resolveContainedPath } from '../local-fs/paths.js';
@@ -19,7 +25,17 @@ import {
   WORKSPACE_CAPABILITY_HEADER,
 } from '../local-fs/capability.js';
 
+const require = createRequire(import.meta.url);
+const SDK_VERSION = (() => {
+  try {
+    return require('../../package.json').version || '0.0.0';
+  } catch {
+    return '0.0.0';
+  }
+})();
+
 const DEFAULT_PORT = 3099;
+const SERVICE_ID = 'agentsam.local.runtime';
 
 function parsePort(value, fallback) {
   const n = Number.parseInt(String(value || ''), 10);
@@ -28,7 +44,7 @@ function parsePort(value, fallback) {
 
 function shellForPlatform() {
   if (process.platform === 'win32') return process.env.COMSPEC || 'powershell.exe';
-  return process.env.SHELL || '/bin/zsh';
+  return process.env.AGENTSAM_SHELL || process.env.SHELL || '/bin/zsh';
 }
 
 function readJsonBody(req) {
@@ -134,7 +150,13 @@ export function attachLocalPtySession({ ws, pty, shell, cwd, cols = 80, rows = 2
     cols,
     rows,
     cwd,
-    env: { ...env, TERM: 'xterm-256color', AGENTSAM_LOCAL_PTY: '1' },
+    env: {
+      ...env,
+      TERM: 'xterm-256color',
+      AGENTSAM_LOCAL_PTY: '1',
+      AGENTSAM_PLANE: 'local',
+      AGENTSAM_WORKSPACE_ROOT: cwd,
+    },
   });
   const id = sessionId || `local_${Date.now().toString(36)}`;
   const openState = ws.OPEN ?? 1;
@@ -220,7 +242,10 @@ export async function startLocalPtyServer(opts = {}) {
     if (pathname === '/health') {
       sendJson(req, res, 200, {
         ok: true,
-        service: 'agentsam-local-pty',
+        service: SERVICE_ID,
+        service_legacy: 'agentsam-local-pty',
+        version: SDK_VERSION,
+        plane: 'local',
         cwd,
         root: cwd,
         port: Number(httpServer.address()?.port || requestedPort),
@@ -230,6 +255,10 @@ export async function startLocalPtyServer(opts = {}) {
         workspace_id: capability?.workspace_id || null,
         capability_required: true,
         binding: host,
+        tunnel: false,
+        execos: false,
+        terminal_scope: 'terminal:exec:local',
+        note: 'Studio workspace plane — ExecOS enroll uses AGENTSAM_BRIDGE_KEY separately',
       });
       return;
     }