@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.7

package/src/lib/identity-scaffold.js

@@ -5,9 +5,15 @@ import { fileURLToPath } from 'node:url';
 const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const IDENTITY_PKG = path.join(SDK_ROOT, 'packages', 'identity');
 const AUTH_PAGES_DIR = path.join(IDENTITY_PKG, 'src', 'frontend', 'auth-portal', 'pages');
-const MIGRATION_FILE = path.join(IDENTITY_PKG, 'src', 'migrations', '0001_identity_core.sql');
+const PORTABLE_SQL_DIR = path.join(IDENTITY_PKG, 'migrations', 'sqlite');
 const BRANDING_SCRIPT = path.join(IDENTITY_PKG, 'src', 'frontend', 'auth-portal', 'shared', 'company-branding.js');
 
+const PORTABLE_SCAFFOLD_FILES = [
+  '001_identity_core.sql',
+  '002_identity_oauth_client.sql',
+  '005_identity_company_native.sql',
+];
+
 /**
  * @param {{ projectName: string, brandName?: string, logoUrl?: string, sdkVersion?: string, provider?: string }} config
  * @returns {Record<string, string>}
@@ -19,7 +25,10 @@ export function buildIdentityAppScaffold(config) {
   const sdkVersion = config.sdkVersion || 'alpha';
   const provider = config.provider || 'email';
 
-  const migrationSql = `${fs.readFileSync(MIGRATION_FILE, 'utf8')}\n${buildCompanySeedSql({ brandName, logoUrl })}\n`;
+  const portableSql = PORTABLE_SCAFFOLD_FILES
+    .map((file) => fs.readFileSync(path.join(PORTABLE_SQL_DIR, file), 'utf8'))
+    .join('\n\n');
+  const migrationSql = `${portableSql}\n${buildCompanySeedSql({ brandName, logoUrl })}\n`;
   const loginHtml = injectBrandingScript(applyBrandTokens(fs.readFileSync(path.join(AUTH_PAGES_DIR, 'login.html'), 'utf8'), {
     brandName,
     logoUrl,
@@ -43,8 +52,8 @@ export function buildIdentityAppScaffold(config) {
     scripts: {
       dev: 'wrangler dev',
       deploy: 'wrangler deploy',
-      'db:migrate:local': `wrangler d1 execute ${projectName} --local --file=migrations/0001_identity_core.sql`,
-      'db:migrate': `wrangler d1 execute ${projectName} --remote --file=migrations/0001_identity_core.sql`,
+      'db:migrate:local': `wrangler d1 execute ${projectName} --local --file=migrations/0001_identity_portable.sql`,
+      'db:migrate': `wrangler d1 execute ${projectName} --remote --file=migrations/0001_identity_portable.sql`,
       preview: 'npx agentsam identity preview --open',
     },
     dependencies: {
@@ -61,6 +70,9 @@ export function buildIdentityAppScaffold(config) {
 main = "backend/src/index.js"
 compatibility_date = "2024-06-01"
 
+[vars]
+IDENTITY_ADAPTER_PROFILE = "portable"
+
 [assets]
 directory = "app/frontend"
 binding = "ASSETS"
@@ -76,7 +88,7 @@ migrations_dir = "migrations"
   files['.env.example'] = `# Minted at install/build — secrets via wrangler secret put (never commit)
 # IAM_CLIENT_ID=          # plaintext var (public by OAuth design)
 # IAM_CLIENT_SECRET=      # wrangler secret put only
-# IAM_ORIGIN=https://inneranimalmedia.com
+# IAM_ORIGIN=
 
 # Web browser OAuth (BYOK) — takes /api/oauth/{google|github}/start when set
 # GOOGLE_CLIENT_ID=
@@ -103,11 +115,12 @@ migrations_dir = "migrations"
 
   files['README.md'] = `# ${brandName} — identity app
 
-Boring scaffold: **app/frontend** (auth UI) + **backend** (Worker API) + **migrations** (D1).
+Boring scaffold: **app/frontend** (auth UI) + **backend** (Worker API) + **migrations** (portable \`identity_*\` D1).
 
 Provider template: \`${provider}\` (see \`agentsam identity plan --provider ${provider}\`).
 
-**Account SSOT:** \`accounts\` (row of record). \`account_identities\` is IdP linkage only.
+**Schema:** portable \`agentsam.identity\` pack (\`identity_users\`, \`identity_sessions\`, \`identity_companies\`, …).
+Not the hosted IAM \`accounts\` / \`auth_users\` / \`company\` shape.
 
 ## Quick start
 
@@ -135,13 +148,13 @@ npm run dev
 \`\`\`
 app/frontend/     Auth portal HTML + dashboard stub
 backend/src/      Cloudflare Worker (identity routes)
-migrations/       D1 schema (+ default \`company\` row)
+migrations/       Portable identity_* schema (+ default identity_companies row)
 
 Branding: \`GET /api/company\` (public). Update with \`PATCH /api/company\` when signed in.
 \`\`\`
 `;
 
-  files['migrations/0001_identity_core.sql'] = migrationSql;
+  files['migrations/0001_identity_portable.sql'] = migrationSql;
 
   files['app/frontend/auth/login.html'] = loginHtml;
   files['app/frontend/auth/signup.html'] = signupHtml;
@@ -190,10 +203,31 @@ Branding: \`GET /api/company\` (public). Update with \`PATCH /api/company\` when
 `;
 
   files['backend/src/index.js'] = `import { handleIdentityWorkerRequest } from '@inneranimalmedia/agentsam-sdk/identity/server/worker-router';
+import { IDENTITY_ROUTE_IDS } from '@inneranimalmedia/agentsam-sdk/identity';
+import { createRouteRegistry, defineRouteProjection } from '@inneranimalmedia/agentsam-sdk/identity';
+
+const app = { id: '${projectName}' };
+const routeRegistry = createRouteRegistry([
+  defineRouteProjection({
+    appId: app.id,
+    routes: {
+      [IDENTITY_ROUTE_IDS.LOGIN]: '/auth/login',
+      [IDENTITY_ROUTE_IDS.SIGNUP]: '/auth/signup',
+      [IDENTITY_ROUTE_IDS.RESET]: '/auth/reset',
+      [IDENTITY_ROUTE_IDS.RECOVERY]: '/auth/reset',
+      [IDENTITY_ROUTE_IDS.APP_AUTHENTICATED]: '/dashboard/',
+      [IDENTITY_ROUTE_IDS.OAUTH_CALLBACK]: '/api/oauth/:provider/callback',
+    },
+  }),
+]);
 
 export default {
   async fetch(request, env, ctx) {
-    return handleIdentityWorkerRequest(request, env);
+    return handleIdentityWorkerRequest(request, env, {
+      app,
+      routeRegistry,
+      identityProfile: 'portable',
+    });
   },
 };
 `;
@@ -202,10 +236,15 @@ export default {
 }
 
 function applyBrandTokens(html, { brandName, logoUrl }) {
+  // Package HTML ships neutral portable defaults; scaffold stamps the app brand.
   return html
     .replace(/Inner Animal Media/g, brandName)
     .replace(/AgentSam/g, brandName)
+    .replace(/<h1 data-company-tagline>Welcome<\/h1>/g, `<h1 data-company-tagline>${brandName}</h1>`)
+    .replace(/<span data-company-name>App<\/span>/g, `<span data-company-name>${brandName}</span>`)
+    .replace(/alt="Sign in"/g, `alt="${brandName}"`)
     .replace(/src="\/shared\/agentsam-mark\.svg"/g, `src="${logoUrl}"`)
+    .replace(/src="\/shared\/app-icon\.png"/g, `src="${logoUrl}"`)
     .replace(/src="\/brand\/[^"]*"/g, `src="${logoUrl}"`)
     .replace(/href="\/brand\/[^"]*"/g, `href="${logoUrl}"`);
 }
@@ -221,9 +260,9 @@ function sqlLiteral(value) {
 
 function buildCompanySeedSql({ brandName, logoUrl }) {
   const ts = Math.floor(Date.now() / 1000);
-  return `-- Default company row (branding SSOT for portal + dashboard)
-INSERT OR IGNORE INTO company (
-  id, slug, name, logo_url, auth_bg_color, primary_color, created_at, updated_at
+  return `-- Default company row (branding SSOT for portal + dashboard) — portable identity_companies
+INSERT OR IGNORE INTO identity_companies (
+  id, slug, name, logo_url, auth_bg_color, primary_color, support_email, created_at, updated_at
 ) VALUES (
   'co_default',
   'default',
@@ -231,6 +270,7 @@ INSERT OR IGNORE INTO company (
   ${sqlLiteral(logoUrl)},
   '#050508',
   '#007AFF',
+  ${sqlLiteral('support@example.test')},
   ${ts},
   ${ts}
 );`;

package/src/lib/setup/recipes.js

@@ -39,7 +39,7 @@ export const imageRasterTransformCapability = {
       provider: 'npm',
       packages: ['sharp'],
       notes: [
-        'Sharp is the portable default (declared dependency of @inneranimalmedia/agentsam-sdk-brand).',
+        'Sharp is the portable default (declared dependency of @inneranimalmedia/agentsam-brand).',
         'Optional enrichment: Homebrew imagemagick for ICNS / exotic formats.',
         'Brand packs: agentsam brand promote → pack → preview → optional publish',
         '  agentsam brand pack --brand acme --asset app-icon --source ./master.png --preset app-icon --out ./acme.zip',

package/src/models/discovery.js

@@ -100,15 +100,9 @@ function baseRecord(provider, id, values = {}) {
 
 function openAIModelCapabilities(id) {
   const fallback = fallbackRecord('openai', id);
-  if (fallback?.capabilities) return {};
-  if (/^text-embedding-/i.test(id)) return { agent_runtime: false, embeddings: true };
-  if (/^(?:gpt-image|chatgpt-image|gpt-audio|gpt-realtime|sora|tts|whisper|omni-moderation)/i.test(id)) {
-    return { agent_runtime: false };
-  }
-  if (/^(?:gpt-(?:4o|4\.1|5|6)|o[1-9])/i.test(id)) {
-    return { agent_runtime: true, responses: true };
-  }
-  return { agent_runtime: false };
+  // /v1/models proves credential-scoped availability but does not expose
+  // per-model modality / Responses compatibility. Never guess from names.
+  return fallback?.capabilities ? {} : {};
 }
 
 async function fetchJson(fetchImpl, url, init) {
@@ -157,8 +151,8 @@ export async function discoverAnthropicModels(apiKey, fetchImpl = fetch) {
         return baseRecord('anthropic', id, {
           label: clean(row?.display_name) || id,
           source_url: 'https://api.anthropic.com/v1/models',
-          capabilities: { messages: true, function_calling: true, prompt_caching: true },
-          metadata: { created_at: row?.created_at || null, type: row?.type || null },
+          capabilities: { messages: true },
+          metadata: { created_at: row?.created_at || null, type: row?.type || null, capability_source: 'provider_endpoint_contract' },
         });
       })
       .filter(Boolean);
@@ -179,6 +173,8 @@ export async function discoverGeminiModels(apiKey, fetchImpl = fetch) {
       .map((row) => {
         const id = clean(row?.baseModelId || row?.name).replace(/^models\//, '');
         if (!id) return null;
+        const providerDescription = clean(row?.description);
+        const specializedOutput = /(?:text[- ]to[- ]speech|\btts\b|image generation|generate images?|transcription|transcribe|audio generation)/i.test(providerDescription);
         return baseRecord('gemini', id, {
           label: clean(row?.displayName) || id,
           context_window: positiveInt(row?.inputTokenLimit),
@@ -187,12 +183,15 @@ export async function discoverGeminiModels(apiKey, fetchImpl = fetch) {
           source_url: 'https://generativelanguage.googleapis.com/v1beta/models',
           capabilities: {
             generate_content: true,
-            function_calling: true,
+            text_output: !specializedOutput,
             thinking: row?.thinking === true,
           },
           metadata: {
             version: row?.version || null,
+            description: providerDescription || null,
             supported_generation_methods: row?.supportedGenerationMethods || [],
+            capability_source: 'provider_api',
+            specialized_output: specializedOutput,
           },
         });
       })
@@ -238,22 +237,39 @@ function xaiPricing(row) {
 export async function discoverXaiModels(apiKey, fetchImpl = fetch) {
   if (!clean(apiKey)) return failure('credential unavailable', false);
   try {
-    const body = await fetchJson(fetchImpl, 'https://api.x.ai/v1/models', {
-      headers: { authorization: `Bearer ${clean(apiKey)}` },
-    });
+    const auth = { authorization: 'Bearer ' + clean(apiKey) };
+    const body = await fetchJson(fetchImpl, 'https://api.x.ai/v1/models', { headers: auth });
+    let languageRows = [];
+    try {
+      const languageBody = await fetchJson(fetchImpl, 'https://api.x.ai/v1/language-models', { headers: auth });
+      languageRows = Array.isArray(languageBody?.models) ? languageBody.models : [];
+    } catch {
+      // Keep full availability even if capability discovery is temporarily unavailable.
+    }
+    const languageById = new Map(languageRows.map((row) => [clean(row?.id), row]).filter(([id]) => id));
     const models = (Array.isArray(body?.data) ? body.data : [])
       .map((row) => {
         const id = clean(row?.id);
-        if (!id || /image|video|voice|embedding/i.test(id)) return null;
-        return baseRecord('grok', id, {
-          context_window: positiveInt(row?.context_length),
+        if (!id) return null;
+        const language = languageById.get(id) || null;
+        const outputModalities = Array.isArray(language?.output_modalities)
+          ? language.output_modalities.map(clean).filter(Boolean)
+          : [];
+        return baseRecord('xai', id, {
+          context_window: positiveInt(language?.context_length ?? row?.context_length),
           pricing: xaiPricing(row),
           source_url: 'https://api.x.ai/v1/models',
-          capabilities: { responses: true, function_calling: true, prompt_caching: true },
+          capabilities: {
+            responses: Boolean(language),
+            text_output: Boolean(language) && outputModalities.includes('text'),
+          },
           metadata: {
-            aliases: row?.aliases || [],
-            created: row?.created || null,
-            owned_by: row?.owned_by || null,
+            aliases: row?.aliases || language?.aliases || [],
+            created: row?.created || language?.created || null,
+            owned_by: row?.owned_by || language?.owned_by || null,
+            input_modalities: Array.isArray(language?.input_modalities) ? language.input_modalities : [],
+            output_modalities: outputModalities,
+            capability_source: language ? 'provider_api_language_models' : 'provider_api_models_only',
           },
         });
       })
@@ -288,6 +304,7 @@ export async function discoverCursorModels(apiKey, fetchImpl = fetch) {
             aliases: Array.isArray(row?.aliases) ? row.aliases : [],
             parameters: params,
             variants: Array.isArray(row?.variants) ? row.variants : [],
+            capability_source: 'provider_api',
           },
         });
       })
@@ -332,6 +349,7 @@ export async function discoverCloudflareModels(apiToken, accountId, fetchImpl =
             task,
             author: clean(row?.author) || null,
             description: clean(row?.description) || null,
+            capability_source: 'provider_api_task',
           },
         });
       })

package/src/models/inventory-core.d.ts

@@ -0,0 +1,105 @@
+export type CredentialPlane = "machine" | "studio_vault" | "mixed" | "platform" | string;
+
+export interface ProviderCredentialResolution {
+  configured: boolean;
+  value?: string;
+  source?: string | null;
+  error?: string | null;
+  account_id?: string | null;
+}
+
+export interface DiscoveredModelRecord {
+  provider: string;
+  provider_model_id: string;
+  model_id?: string;
+  model_key: string;
+  label: string;
+  availability: string;
+  availability_source?: string | null;
+  context_window?: number | null;
+  max_output_tokens?: number | null;
+  reasoning_efforts?: string[];
+  service_tiers?: string[];
+  capabilities?: Record<string, unknown>;
+  metadata?: Record<string, unknown>;
+  source?: Record<string, unknown>;
+}
+
+export interface CredentialScopedInventory {
+  schemaVersion: string;
+  generatedAt: string;
+  authority: string;
+  credential_plane: CredentialPlane;
+  providers: Array<{
+    id: string;
+    label: string;
+    configured: boolean;
+    source: string | null;
+    credentialError: string | null;
+  }>;
+  discovery: Record<string, {
+    attempted: boolean;
+    ok: boolean;
+    error: string | null;
+    returnedModelCount: number;
+    curation?: string;
+  }>;
+  providerModels: Record<string, DiscoveredModelRecord[]>;
+  availableModels: DiscoveredModelRecord[];
+}
+
+export const INVENTORY_API_PROVIDERS: readonly Readonly<{
+  id: string;
+  label: string;
+  service: string;
+  env: string;
+  aliases?: readonly string[];
+}>[];
+
+export const WORKERS_AI_CURATED_MODEL_IDS: readonly string[];
+
+export function providerIdForService(serviceName: unknown): string | null;
+export function filterWorkersAiCurated(models?: DiscoveredModelRecord[], options?: { curated?: boolean }): DiscoveredModelRecord[];
+export function makeMapCredentialResolver(
+  credentialByProvider: Map<string, { value: string; source?: string; account_id?: string }>,
+): (providerId: string) => Promise<ProviderCredentialResolution>;
+export function collectCredentialScopedInventory(options: {
+  fetchImpl?: typeof fetch;
+  credentialPlane?: CredentialPlane;
+  curateWorkersAi?: boolean;
+  discoverRemote?: boolean;
+  resolveCredential: (providerId: string) => ProviderCredentialResolution | Promise<ProviderCredentialResolution>;
+}): Promise<CredentialScopedInventory>;
+export function sanitizeInventoryForClient(status?: Partial<CredentialScopedInventory>): {
+  schemaVersion?: string;
+  generatedAt?: string;
+  authority?: string;
+  credential_plane?: CredentialPlane;
+  providers: CredentialScopedInventory["providers"];
+  discovery: CredentialScopedInventory["discovery"];
+  availableModels: Array<{
+    provider: string;
+    model_id: string;
+    model_key: string | null;
+    label: string;
+    availability: string;
+    availability_source: string | null;
+    context_window: number | null;
+    reasoning_efforts: string[];
+    service_tiers: string[];
+    capabilities: Record<string, unknown>;
+    chat_eligible: boolean;
+    eligibility_reason: string | null;
+    eligibility_source: string;
+  }>;
+};
+export function modelChatEligibility(row?: DiscoveredModelRecord): {
+  chat_eligible: boolean;
+  eligibility_reason: string | null;
+  eligibility_source: string;
+};
+export function assertModelAvailableForProvider(
+  inventory: { availableModels?: Array<Record<string, unknown>> },
+  provider: string,
+  modelId: string,
+): Record<string, unknown>;

package/src/models/inventory-core.js

@@ -7,7 +7,7 @@ export const INVENTORY_API_PROVIDERS = Object.freeze([
   { id: 'openai', label: 'OpenAI', service: 'openai', env: 'OPENAI_API_KEY' },
   { id: 'anthropic', label: 'Anthropic', service: 'anthropic', env: 'ANTHROPIC_API_KEY' },
   { id: 'gemini', label: 'Gemini', service: 'gemini', env: 'GEMINI_API_KEY' },
-  { id: 'grok', label: 'Grok / xAI', service: 'xai', env: 'XAI_API_KEY', aliases: ['xai', 'grok'] },
+  { id: 'xai', label: 'Grok / xAI', service: 'xai', env: 'XAI_API_KEY', aliases: ['grok'] },
   { id: 'cursor', label: 'Cursor', service: 'cursor', env: 'CURSOR_API_KEY' },
   { id: 'cloudflare', label: 'Cloudflare', service: 'cloudflare', env: 'CLOUDFLARE_API_TOKEN' },
 ]);
@@ -29,8 +29,8 @@ const SERVICE_TO_PROVIDER = Object.freeze({
   openai: 'openai',
   anthropic: 'anthropic',
   gemini: 'gemini',
-  xai: 'grok',
-  grok: 'grok',
+  xai: 'xai',
+  grok: 'xai',
   cursor: 'cursor',
   cloudflare: 'cloudflare',
 });
@@ -70,6 +70,41 @@ export function makeMapCredentialResolver(credentialByProvider) {
   };
 }
 
+const CHAT_ADAPTER_PROVIDERS = new Set(['openai', 'anthropic', 'gemini', 'xai', 'cloudflare']);
+
+export function modelChatEligibility(row = {}) {
+  const rawProvider = String(row.provider || '').trim().toLowerCase();
+  const provider = rawProvider === 'grok' ? 'xai' : rawProvider;
+  const caps = row.capabilities && typeof row.capabilities === 'object' ? row.capabilities : {};
+  const metadata = row.metadata && typeof row.metadata === 'object' ? row.metadata : {};
+  const source = String(metadata.capability_source || (row.source?.fallback?.url ? 'provider_reference' : 'provider_api'));
+
+  if (!CHAT_ADAPTER_PROVIDERS.has(provider)) {
+    return { chat_eligible: false, eligibility_reason: 'provider_adapter_unavailable', eligibility_source: source };
+  }
+  if (caps.embeddings === true) {
+    return { chat_eligible: false, eligibility_reason: 'embedding_model', eligibility_source: source };
+  }
+  if (caps.agent_runtime === false) {
+    return { chat_eligible: false, eligibility_reason: 'capability_excludes_chat', eligibility_source: source };
+  }
+
+  const positive =
+    (provider === 'openai' && caps.responses === true && caps.agent_runtime === true)
+    || (provider === 'anthropic' && caps.messages === true)
+    || (provider === 'gemini' && caps.generate_content === true && caps.text_output === true)
+    || (provider === 'xai' && caps.responses === true && caps.text_output === true)
+    || (provider === 'cloudflare' && caps.workers_ai === true && caps.agent_runtime === true && caps.embeddings !== true);
+
+  if (positive) {
+    return { chat_eligible: true, eligibility_reason: null, eligibility_source: source };
+  }
+  if (metadata.specialized_output === true || caps.text_output === false) {
+    return { chat_eligible: false, eligibility_reason: 'specialized_output_model', eligibility_source: source };
+  }
+  return { chat_eligible: false, eligibility_reason: 'capability_unknown', eligibility_source: source };
+}
+
 /**
  * Merge vault credentials (preferred) with optional platform env credentials.
  * Never returns secret material in the inventory result.
@@ -131,6 +166,15 @@ export async function collectCredentialScopedInventory(options = {}) {
   };
 }
 
+function sanitizeDiscoveryError(error) {
+  const raw = String(error || '').trim();
+  if (!raw) return null;
+  if (/\b(?:401|403)\b|unauthoriz|forbidden|invalid[_ -]?(?:api[_ -]?)?key|credential.*reject/i.test(raw)) {
+    return 'provider_credential_rejected';
+  }
+  return 'provider_discovery_failed';
+}
+
 export function sanitizeInventoryForClient(status = {}) {
   const out = {
     schemaVersion: status.schemaVersion,
@@ -142,11 +186,14 @@ export function sanitizeInventoryForClient(status = {}) {
       label: row.label,
       configured: row.configured === true,
       source: row.source || null,
-      credentialError: row.credentialError || null,
+      credentialError: sanitizeDiscoveryError(row.credentialError),
     })),
-    discovery: status.discovery || {},
+    discovery: Object.fromEntries(Object.entries(status.discovery || {}).map(([provider, row]) => [provider, {
+      ...row,
+      error: sanitizeDiscoveryError(row?.error),
+    }])) ,
     availableModels: (status.availableModels || []).map((row) => ({
-      provider: row.provider,
+      provider: row.provider === 'grok' ? 'xai' : row.provider,
       model_id: row.provider_model_id || row.model_id,
       model_key: row.model_key || null,
       label: row.label || row.provider_model_id || row.model_id,
@@ -156,6 +203,7 @@ export function sanitizeInventoryForClient(status = {}) {
       reasoning_efforts: row.reasoning_efforts || [],
       service_tiers: row.service_tiers || [],
       capabilities: row.capabilities || {},
+      ...modelChatEligibility(row),
     })),
   };
   if (status.local) {

package/src/security/logs.js

@@ -17,6 +17,9 @@ export function triageLog(text) {
     else if (/\b([1-9]\d*)\s+(?:(?:low|moderate|high|critical)\s+(?:severity\s+)?)?vulnerabilit/i.test(raw) || /npm audit fix/i.test(raw)) add('audit', line, 'rescan-current-lockfile');
     else if (/ExperimentalWarning/.test(raw)) add('experimental-runtime', line, 'informational', { blocking: false });
     else if (/new (?:release|(?:patch |minor |major )?version).*(?:pip|npm)|(?:pip|npm).*new (?:release|version)/i.test(raw)) add('tool-update', line, 'informational', { blocking: false });
+    // package.json allowScripts is the project authority; a user/global .npmrc allow-scripts clash is expected noise.
+    else if (/npm (?:warn|warning) allow-scripts.*declares its own allowScripts/i.test(raw)) add('configuration', line, 'informational', { blocking: false });
+    else if (/npm (?:warn|warning) allow-scripts/i.test(raw)) add('configuration', line, 'review-package-manager-config');
     else if (/npm (?:warn|warning).*config/i.test(raw)) add('configuration', line, 'review-package-manager-config');
     else if (/\b(?:warning|warn|npm ERR!|npm error)\b/i.test(raw)) add('unclassified-warning', line, 'review-log-at-source');
   }

package/src/ui/cli/help.js

@@ -89,6 +89,42 @@ export function renderHelpOverview(version, options = {}) {
   return lines.join('\n');
 }
 
+export function renderCommandHelp(entryOrId, version = String(pkg.version || 'unknown')) {
+  const entry = typeof entryOrId === 'string' ? getCliCommand(entryOrId) : entryOrId;
+  if (!entry) return renderHelpOverview(version);
+
+  const usage = entry.usage?.length ? entry.usage : [`agentsam ${entry.id}`];
+  const lines = [
+    '',
+    '  ' + pc.bold('Agent Sam') + ' ' + pc.dim('v' + version) + ' ' + pc.dim('·') + ' ' + pc.bold(entry.id),
+    '  ' + pc.dim(entry.summary),
+    '',
+    '  ' + pc.bold('Usage'),
+    ...usage.map((row) => '    ' + pc.cyan(row)),
+  ];
+
+  if (entry.options?.length) {
+    const width = Math.min(32, Math.max(...entry.options.map((row) => row.flag.length), 0));
+    lines.push(
+      '',
+      '  ' + pc.bold('Options'),
+      ...entry.options.map((row) => '    ' + pc.cyan(row.flag.padEnd(width)) + '  ' + pc.dim(row.description)),
+    );
+  }
+
+  if (entry.aliases?.length) {
+    lines.push('', '  ' + pc.bold('Aliases'), '    ' + entry.aliases.map((alias) => pc.cyan(`agentsam ${alias}`)).join(' · '));
+  }
+  if (entry.skill) {
+    lines.push('', '  ' + pc.dim(`Skill: agentsam skills ${entry.skill}`));
+  }
+  if (entry.operation) {
+    lines.push('  ' + pc.dim(`Operation: ${entry.operation}`));
+  }
+  lines.push('');
+  return lines.join('\n');
+}
+
 export function renderHelpTopic(topic, version) {
   if (!topic) return renderHelpOverview(version);
   const skillHint = topic.rows?.[0]?.[1]?.includes('skill')
@@ -153,6 +189,11 @@ export async function runHelp(argv = [], options = {}) {
 
   const topicArg = args.find((arg) => !arg.startsWith('-'));
   if (topicArg) {
+    const command = getCliCommand(topicArg);
+    if (command) {
+      write(renderCommandHelp(command, version));
+      return;
+    }
     const topic = resolveHelpTopic(topicArg);
     if (!topic) {
       write(renderHelpOverview(version));

package/test/apps-scaffold-contract.test.mjs

@@ -63,7 +63,7 @@ test('CAD creator app package is curated for third-party installation', () => {
   const pkg = packageJson('apps', 'cad-creator');
   const manifest = JSON.parse(read('apps', 'cad-creator', 'agentsam.app.json'));
 
-  assert.equal(pkg.name, '@inneranimalmedia/agentsam-sdk-cad-creator');
+  assert.equal(pkg.name, '@inneranimalmedia/agentsam-cad-creator');
   assert.notEqual(pkg.private, true);
   assert.equal(pkg.bin['agentsam-cad-creator'], 'bin/agentsam-cad-creator.mjs');
   assert.equal(pkg.publishConfig.access, 'public');
@@ -91,7 +91,8 @@ test('client-cms-editor app manifest points to authoritative package name', () =
   assert.equal(manifest.package, pkg.name);
   assert.equal(manifest.runtime.local_preview, 'ready');
   assert.equal(manifest.runtime.source_scaffold, 'ready');
-  assert.equal(manifest.runtime.cloudflare, 'ready');
+  // Cloudflare path is adapter-ready until a graduated CF deploy receipt exists.
+  assert.equal(manifest.runtime.cloudflare, 'adapter-ready');
 });
 
 test('CAD creator keeps the robotics runtime lazy and the perception key server-side', () => {

package/test/cli/api-key-env-whoami.test.mjs

@@ -86,7 +86,7 @@ test('whoami surfaces tokenPermissions and authType from context', async () => {
       tokenPermissions: ['account:read', 'repository:read', 'models:invoke'],
       credential: {
         id: 'aakcred_1',
-        name: 'Sams-iMac',
+        name: 'dev-machine',
         prefix: 'aak_7fm…',
         environment: 'development',
         status: 'active',
@@ -99,7 +99,7 @@ test('whoami surfaces tokenPermissions and authType from context', async () => {
   assert.equal(status.loggedIn, true);
   assert.equal(status.authType, 'api_key');
   assert.deepEqual(status.tokenPermissions, ['account:read', 'repository:read', 'models:invoke']);
-  assert.equal(status.credential.name, 'Sams-iMac');
+  assert.equal(status.credential.name, 'dev-machine');
   assert.doesNotMatch(JSON.stringify(status), /aak_presented/);
 });
 

package/test/cli/catalog-authority.test.mjs

@@ -0,0 +1,64 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { getCliCommand } from '../../src/cli/command-catalog.js';
+import { runStatus } from '../../src/commands/status.js';
+import { setupNextCommands } from '../../src/commands/setup.js';
+import { renderRepositoryObservation } from '../../src/commands/knowledge.js';
+
+test('status --help is catalog-backed and does not collect runtime state', async () => {
+  let output = '';
+  let collected = false;
+  const result = await runStatus(['--help'], {
+    write(value) { output += value; },
+    async collectRuntime() {
+      collected = true;
+      throw new Error('status help must not collect runtime');
+    },
+  });
+
+  assert.equal(result, null);
+  assert.equal(collected, false);
+  assert.match(output, /Agent Sam.*status/);
+  assert.match(output, /--offline/);
+  assert.match(output, /--json/);
+});
+
+test('setup next-actions only reference catalogued top-level commands', () => {
+  const commands = setupNextCommands(['google.cloud', 'image.vectorize']);
+  assert.ok(commands.includes('agentsam status'));
+  assert.ok(commands.includes('agentsam capabilities'));
+  assert.ok(commands.includes('agentsam google-cloud doctor'));
+  assert.ok(!commands.some((command) => command === 'agentsam doctor'));
+  assert.ok(!commands.some((command) => command.startsWith('agentsam image ')));
+
+  for (const command of commands) {
+    const [, id] = command.split(/\s+/);
+    assert.ok(getCliCommand(id), `next action must be catalogued: ${command}`);
+  }
+});
+
+test('repository summary is human-sized while preserving important machine evidence', () => {
+  const output = renderRepositoryObservation({
+    data: {
+      repo_root: '/tmp/example',
+      repo_name: 'example',
+      git: { branch: 'main', head_sha: 'abcdef1234567890', dirty: true, changed_paths: 2 },
+      summary: { file_count: 2995, source_file_count: 2840, total_lines: 491023 },
+      top_level: [
+        { path: 'apps', files: 1351, lines: 289444 },
+        { path: 'packages', files: 757, lines: 77579 },
+      ],
+      pressure_points: [
+        { path: 'apps/local-studio', pressure_score: 89.5, stability_score: 10.2 },
+      ],
+    },
+  });
+
+  assert.match(output, /Agent Sam · repository/);
+  assert.match(output, /example/);
+  assert.match(output, /apps\/local-studio/);
+  assert.match(output, /not quality grades/);
+  assert.match(output, /agentsam repo --json/);
+  assert.doesNotMatch(output, /"pressure_points"/);
+});