@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.8

package/src/commands/setup.js

@@ -18,11 +18,39 @@ import {
   RUNTIME_PROFILES,
 } from '../lib/setup/runtime.js';
 import { runRuntime } from './runtime.js';
+import { getCliCommand } from '../cli/command-catalog.js';
 
 function writeLine(write, value = '') {
   write(`${value}\n`);
 }
 
+function catalogCommand(id, args = '') {
+  const entry = getCliCommand(id);
+  if (!entry) throw new Error(`setup_next_command_not_catalogued: ${id}`);
+  return `agentsam ${entry.id}${args ? ` ${args}` : ''}`;
+}
+
+export function setupNextCommands(capabilityIds = []) {
+  const commands = [
+    catalogCommand('status'),
+    catalogCommand('capabilities'),
+    catalogCommand('google-cloud', 'doctor'),
+  ];
+  if (capabilityIds.includes('google.cloud')) {
+    commands.push(catalogCommand('setup', 'google.cloud --inventory'));
+  }
+  if (capabilityIds.includes('image.vectorize')) {
+    commands.push(catalogCommand('capabilities', 'image.vectorize'));
+  }
+  return [...new Set(commands)];
+}
+
+function writeSetupNext(write, capabilityIds = []) {
+  writeLine(write, '  Next');
+  for (const command of setupNextCommands(capabilityIds)) writeLine(write, `    ${command}`);
+  writeLine(write, '');
+}
+
 function printHelp(write) {
   writeLine(write, '');
   writeLine(write, '  Agent Sam · setup');
@@ -220,9 +248,9 @@ export async function runSetup(argv = [], options = {}) {
       }
       writeLine(write, '');
       writeLine(write, '  Next');
-      writeLine(write, '    agentsam gcloud auth login');
-      writeLine(write, '    agentsam google-cloud connection set --identity EMAIL --project PROJECT');
-      writeLine(write, '    agentsam google-cloud doctor');
+      writeLine(write, `    ${catalogCommand('google-cloud', 'auth login')}`);
+      writeLine(write, `    ${catalogCommand('google-cloud', 'connection set --identity EMAIL --project PROJECT')}`);
+      writeLine(write, `    ${catalogCommand('google-cloud', 'doctor')}`);
       writeLine(write, '');
     }
     return inv.errors?.length ? 2 : 0;
@@ -243,8 +271,7 @@ export async function runSetup(argv = [], options = {}) {
   if (dryRun || !plan.would_install.length) {
     if (!plan.would_install.length) {
       writeLine(write, '  ✓ setup complete — requested capabilities already satisfied');
-      writeLine(write, '  Next: agentsam doctor · agentsam capabilities · agentsam google-cloud doctor');
-      writeLine(write, '');
+      writeSetupNext(write, capabilityIds);
     }
     if (json) write(JSON.stringify({ environment, plan, executed: false }, null, 2) + '\n');
     return 0;
@@ -262,17 +289,7 @@ export async function runSetup(argv = [], options = {}) {
   writeLine(write, receipt.ok ? '  ✓ Agent Sam setup complete' : '  ✕ Setup finished with failures');
   writeLine(write, `  Receipt  ${receipt.path}`);
   writeLine(write, '');
-  writeLine(write, '  Next');
-  writeLine(write, '    agentsam doctor');
-  writeLine(write, '    agentsam capabilities');
-  if (capabilityIds.includes('google.cloud')) {
-    writeLine(write, '    agentsam setup google.cloud --inventory');
-    writeLine(write, '    agentsam gcloud auth login');
-  }
-  if (capabilityIds.includes('image.vectorize')) {
-    writeLine(write, '    agentsam image optimize ./logo.png   # when image command ships');
-  }
-  writeLine(write, '');
+  writeSetupNext(write, capabilityIds);
 
   if (json) write(JSON.stringify({ environment, plan, receipt }, null, 2) + '\n');
   return receipt.ok ? 0 : 2;

package/src/commands/skill.js

@@ -49,25 +49,86 @@ function looksLikeNpmPackage(source) {
  * Download an npm package tarball and return the extracted package root
  * that contains agentsam.skill.json (or package root for relative resolve).
  */
+
+function buildNpmPackEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+
+  // resolveNpmSkillPackage requires a physical tarball.
+  // Parent npm lifecycle flags such as `npm publish --dry-run`
+  // must not change the semantics of this nested npm invocation.
+  for (const key of Object.keys(env)) {
+    if (/^npm_config_dry[_-]?run$/i.test(key)) {
+      delete env[key];
+    }
+  }
+
+  return env;
+}
+
 export function resolveNpmSkillPackage(spec, options = {}) {
   const spawn = options.spawnSyncImpl || spawnSync;
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-skill-npm-'));
-  const pack = spawn('npm', ['pack', spec, '--pack-destination', tmp], {
-    encoding: 'utf8',
-    cwd: options.cwd || process.cwd(),
-    env: options.env || process.env,
-  });
-  if ((pack.status ?? 1) !== 0) {
-    throw new Error(`npm_pack_failed:${spec}:${String(pack.stderr || pack.stdout || '').trim() || 'unknown'}`);
-  }
-  const tgzName = String(pack.stdout || '')
-    .trim()
-    .split(/\r?\n/)
-    .filter(Boolean)
-    .pop();
-  if (!tgzName) throw new Error(`npm_pack_empty:${spec}`);
-  const tgzPath = path.join(tmp, path.basename(tgzName));
-  if (!fs.existsSync(tgzPath)) throw new Error(`npm_pack_missing:${tgzPath}`);
+  const maxPackAttempts = 2;
+
+  let tmp = null;
+  let tgzPath = null;
+  let lastExpectedPath = null;
+
+  for (let attempt = 1; attempt <= maxPackAttempts; attempt += 1) {
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-skill-npm-'));
+
+    const pack = spawn('npm', ['pack', spec, '--json', '--pack-destination', tmp], {
+      encoding: 'utf8',
+      cwd: options.cwd || process.cwd(),
+      env: buildNpmPackEnv(options.env || process.env),
+    });
+
+    if ((pack.status ?? 1) !== 0) {
+      throw new Error(
+        `npm_pack_failed:${spec}:${String(pack.stderr || pack.stdout || '').trim() || 'unknown'}`,
+      );
+    }
+
+    let tgzName = null;
+
+    try {
+      const payload = JSON.parse(String(pack.stdout || ''));
+      const entry = Array.isArray(payload) ? payload[0] : payload;
+      if (entry?.filename) tgzName = path.basename(String(entry.filename));
+    } catch {
+      // Fall through to filesystem discovery.
+    }
+
+    const packed = fs.readdirSync(tmp)
+      .filter((name) => name.endsWith('.tgz'))
+      .sort();
+
+    if (!tgzName && packed.length === 1) {
+      tgzName = packed[0];
+    }
+
+    if (tgzName) {
+      const expected = path.join(tmp, tgzName);
+      lastExpectedPath = expected;
+
+      if (fs.existsSync(expected)) {
+        tgzPath = expected;
+        break;
+      }
+    }
+
+    // npm occasionally reports success before producing no artifact.
+    // Treat only that narrow condition as transient and retry once.
+    if (attempt < maxPackAttempts) {
+      fs.rmSync(tmp, { recursive: true, force: true });
+      tmp = null;
+    }
+  }
+
+  if (!tmp || !tgzPath || !fs.existsSync(tgzPath)) {
+    throw new Error(
+      `npm_pack_missing:${lastExpectedPath || spec}:attempts=${maxPackAttempts}`,
+    );
+  }
 
   const extractDir = path.join(tmp, 'pkg');
   fs.mkdirSync(extractDir, { recursive: true });

package/src/commands/status.js

@@ -4,6 +4,7 @@ import { buildStatusActionPlan } from '../status/actions.js';
 import { openExternalUrl } from '../lib/open-url.js';
 import readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
+import { renderCommandHelp } from '../ui/cli/help.js';
 
 function parseStatusArgs(argv = []) {
   const opts = {
@@ -11,12 +12,14 @@ function parseStatusArgs(argv = []) {
     offline: false,
     discoverModels: true,
     interactive: false,
+    help: false,
   };
   for (const arg of argv) {
     if (arg === '--json') opts.json = true;
     else if (arg === '--offline') opts.offline = true;
     else if (arg === '--no-discover') opts.discoverModels = false;
     else if (arg === '--interactive' || arg === '-i') opts.interactive = true;
+    else if (arg === '--help' || arg === '-h') opts.help = true;
     else throw new Error(`unknown status option: ${arg}`);
   }
   return opts;
@@ -68,13 +71,17 @@ async function runInteractiveMenu(status, write) {
 
 export async function runStatus(argv = [], opts = {}) {
   const parsed = parseStatusArgs(argv);
+  const write = opts.write || ((value) => process.stdout.write(value));
+  if (parsed.help) {
+    write(renderCommandHelp('status'));
+    return null;
+  }
   const status = await (opts.collectRuntime || collectRuntimeStatus)({
     ...opts,
     cwd: opts.cwd || process.cwd(),
     offline: parsed.offline,
     discoverModels: parsed.discoverModels,
   });
-  const write = opts.write || ((value) => process.stdout.write(value));
   if (parsed.json) {
     const plan = buildStatusActionPlan(status);
     write(`${JSON.stringify({ ...status, next: plan }, null, 2)}\n`);

package/src/features/resolve.js

@@ -39,6 +39,7 @@ export function normalizeProviderTemplateId(id) {
   if (!key) return '';
   if (key === 'iam') return 'inneranimalmedia';
   if (key === 'google-desktop') return 'google_desktop';
+  if (key === 'openai' || key === 'chatgpt-hosted' || key === 'chatgpt_hosted') return 'chatgpt';
   return key;
 }
 

package/src/knowledge/engine.js

@@ -59,7 +59,7 @@ export async function planIndex({ root, config: input, store, embed = false, lim
       limits: Number.isFinite(maxFiles) || Number.isFinite(maxChunks) ? { max_files: maxFiles, max_chunks: maxChunks } : null } };
 }
 
-export async function runIndex({ root, config, store, embedder, embed = false, maxInputs = 100, maxCharacters = 200000, limits = null }) {
+export async function runIndex({ root, config, store, embedder, embed = false, vectorBackend = null, vectorContext = {}, maxInputs = 100, maxCharacters = 200000, limits = null }) {
   if (!store) throw new Error('A writable knowledge store is required.');
   if (!Number.isInteger(maxInputs) || maxInputs < 0 || !Number.isInteger(maxCharacters) || maxCharacters < 0) throw new Error('Embedding budgets must be nonnegative integers.');
   const plan = await planIndex({ root, config, store, embed, limits });
@@ -76,6 +76,25 @@ export async function runIndex({ root, config, store, embedder, embed = false, m
     // Completed work remains reusable even if a later request or publication fails.
     await store.cachePut(key, vector);
   }
+  let vectorUpsert = null;
+  if (embed && plan.config.lane?.backend === 'cloudflare_vectorize') {
+    if (!vectorBackend?.upsert) throw new Error('cloudflare_vectorize_backend_required');
+    const records = [];
+    for (const chunk of plan.chunks) {
+      const vector = validateVector(await store.cacheGet(chunk.embedding_key), plan.config.embedding.dimensions);
+      records.push({
+        id: chunk.id,
+        vector,
+        metadata: { path: chunk.path, ordinal: chunk.ordinal, content_hash: chunk.content_hash },
+      });
+    }
+    vectorUpsert = await vectorBackend.upsert(records, {
+      ...vectorContext,
+      binding: plan.config.lane.binding,
+      index: plan.config.lane.index,
+      profile: { ...plan.config.lane, dimensions: plan.config.embedding.dimensions },
+    });
+  }
   // A generation describes one coherent source snapshot. Never publish after a mid-run edit.
   const check = [];
   const checkFiles = inventory(root, plan.config.scope).slice(0, limits?.maxFiles == null ? Infinity : limits.maxFiles);
@@ -85,7 +104,7 @@ export async function runIndex({ root, config, store, embedder, embed = false, m
     source_hash: receipt.source_hash, config_hash: receipt.config_hash, config: plan.config, profile_id: receipt.profile_id,
     git: gitEvidence(root), files: plan.files, chunks: plan.chunks, symbols: plan.symbols, edges: plan.edges, receipt };
   await store.publish(generation, plan.previous?.id || null);
-  return { ...receipt, generation_id: generation.id, published: true };
+  return { ...receipt, generation_id: generation.id, published: true, vector_upsert: vectorUpsert };
 }
 
 export async function retrieve({ store, config: input, text, semantic = false, embedder, topK = 8, tokenBudget = 6000, generationId, resultPolicy: requestedResultPolicy }) {

package/src/knowledge/runtime-discovery.js

@@ -0,0 +1,127 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { readCloudflareDeploymentContract } from '../cloudflare/runtime-status.js';
+import { getRepositoryId, portableRepositoryIdFromGit, tryReadProjectConfig } from '../lib/project-config.js';
+import { resolveProviderCredential } from '../lib/provider-credentials.js';
+import { tryResolveGitContext } from '../../packages/agentsam-repository/src/git-context.js';
+
+export const PROJECT_CONTEXT_SCHEMA = 'agentsam.project-context.v1';
+const clean = value => value == null ? '' : String(value).trim();
+const localIndexPath = root => path.join(root, '.agentsam', 'knowledge', 'index.sqlite');
+function readJson(filename) { try { return JSON.parse(fs.readFileSync(filename, 'utf8')); } catch { return null; } }
+function executionState({ observed = false, selected = false, local = false, remote = false, conflicting = false, source = null, reason = null } = {}) {
+  return { observed: Boolean(observed), explicitly_selected: Boolean(selected), locally_executable: Boolean(local), remotely_executable: Boolean(remote), missing: !observed, conflicting: Boolean(conflicting), source: source || null, reason: reason || null };
+}
+function cloudflareCredentialState(env) {
+  try {
+    const credential = resolveProviderCredential('cloudflare', { env });
+    const configured = Boolean(credential?.configured);
+    const accountResolved = Boolean(clean(credential?.account_id));
+    return { configured, account_resolved: accountResolved, executable: configured && accountResolved, source: credential?.source || null, error: credential?.error || (!configured ? 'cloudflare_authorization_required' : !accountResolved ? 'cloudflare_account_id_required' : null) };
+  } catch (error) {
+    return { configured: false, account_resolved: false, executable: false, source: null, error: error?.message || String(error) };
+  }
+}
+function policyConflict(policy, vectorize) {
+  if (policy?.lane?.backend !== 'cloudflare_vectorize') return [];
+  const binding = clean(policy.lane.binding), index = clean(policy.lane.index);
+  if (vectorize.some(row => row.binding === binding && row.index === index)) return [];
+  return [{ kind: 'knowledge_deployment_drift', backend: 'cloudflare_vectorize', policy: { binding: binding || null, index: index || null }, observed: vectorize.map(row => ({ binding: row.binding, index: row.index })), detail: 'Knowledge policy selects a Vectorize binding/index that is not declared by the active Wrangler deployment contract.' }];
+}
+
+export function discoverProjectContext(root = process.cwd(), options = {}) {
+  const resolvedRoot = fs.realpathSync(path.resolve(root));
+  const env = options.env || process.env;
+  const policy = options.knowledgeConfig || null;
+  const projectConfig = options.projectConfig || tryReadProjectConfig(resolvedRoot);
+  const git = tryResolveGitContext({ cwd: resolvedRoot });
+  const repositoryId = getRepositoryId(projectConfig) || portableRepositoryIdFromGit(resolvedRoot) || `local:${path.basename(resolvedRoot)}`;
+  const hostInstallPath = path.join(resolvedRoot, '.agentsam', 'app.json');
+  const hostInstall = fs.existsSync(hostInstallPath) ? readJson(hostInstallPath) : null;
+  const productManifestPath = path.join(resolvedRoot, 'agentsam.app.json');
+  const productManifest = fs.existsSync(productManifestPath) ? readJson(productManifestPath) : null;
+  let contract = null, contractError = null;
+  try { contract = readCloudflareDeploymentContract(resolvedRoot, projectConfig || {}); } catch (error) { contractError = error?.message || String(error); }
+  const bindings = contract?.bindings || [];
+  const ai = bindings.find(row => row.type === 'ai') || null;
+  const vectorize = bindings.filter(row => row.type === 'vectorize').map(row => ({ binding: row.name, index: row.index_name || null, source: row.source || 'wrangler_config' }));
+  const d1 = bindings.filter(row => row.type === 'd1');
+  const r2 = bindings.filter(row => row.type === 'r2_bucket');
+  const credential = cloudflareCredentialState(env);
+  const remoteConfigured = Boolean(contract?.configured);
+  const conflicts = policyConflict(policy, vectorize);
+  const indexPath = localIndexPath(resolvedRoot);
+  const localIndex = { exists: fs.existsSync(indexPath), path: path.relative(resolvedRoot, indexPath) };
+  const policyBinding = clean(policy?.lane?.binding), policyIndex = clean(policy?.lane?.index);
+  const vectorizeResources = vectorize.map(row => {
+    const selected = policy?.lane?.backend === 'cloudflare_vectorize' && row.binding === policyBinding && row.index === policyIndex;
+    return {
+      ...row,
+      configured: Boolean(row.binding && row.index),
+      ...executionState({
+        observed: Boolean(row.binding && row.index), selected,
+        local: Boolean(row.binding && row.index && credential.executable),
+        remote: Boolean(row.binding && row.index && remoteConfigured),
+        conflicting: conflicts.length > 0 && !selected,
+        source: row.source,
+        reason: credential.executable ? null : 'Local CLI/Desktop Vectorize execution requires the current user Cloudflare authorization and account id.',
+      }),
+    };
+  });
+  const workersAi = ai ? {
+    binding: ai.name, configured: true, credential_state: credential,
+    ...executionState({ observed: true, selected: policy?.embedding?.provider === 'workers-ai', local: false, remote: remoteConfigured, source: ai.source || 'wrangler_config', reason: 'Workers AI binding is executable in the configured Worker runtime; a local Node process does not possess env.<AI_BINDING>.' }),
+  } : {
+    binding: null, configured: false, credential_state: credential,
+    ...executionState({ observed: false, source: contract?.config || null, reason: 'No Workers AI binding declared.' }),
+  };
+  const mapBoundResource = row => ({
+    binding: row.name,
+    name: row.database_name || row.bucket_name || null,
+    id: row.database_id || null,
+    ...executionState({ observed: true, local: false, remote: remoteConfigured, source: row.source || 'wrangler_config', reason: 'This receipt describes runtime binding execution; local provider API execution is a separate authorized transport.' }),
+  });
+  const lanes = [];
+  if (localIndex.exists) lanes.push({ id: 'local-index', backend: 'local_exact', source: 'local_index', configured: true, locally_executable: true, remotely_executable: false });
+  for (const row of vectorizeResources) lanes.push({ id: `cloudflare-vectorize:${row.binding}`, backend: 'cloudflare_vectorize', binding: row.binding, index: row.index, source: row.source, configured: row.configured, locally_executable: row.locally_executable, remotely_executable: row.remotely_executable, explicitly_selected: row.explicitly_selected, conflicting: row.conflicting });
+
+  return {
+    schema: PROJECT_CONTEXT_SCHEMA,
+    version: 1,
+    repository: { root: resolvedRoot, identity: repositoryId, branch: git?.branch || null, revision: git?.revisionSha || null, dirty: git?.dirty ?? null, source: git ? 'git' : projectConfig ? '.agentsam/config.json' : 'filesystem' },
+    project: {
+      config_present: Boolean(projectConfig), config_source: projectConfig ? '.agentsam/config.json' : null,
+      product_manifest: productManifest ? { id: clean(productManifest.id) || null, source: 'agentsam.app.json' } : null,
+      host_install: hostInstall ? { app_id: clean(hostInstall.app_id || hostInstall.id) || null, name: clean(hostInstall.name) || null, role: clean(hostInstall.role) || null, mounts: hostInstall.mounts || null, schema: clean(hostInstall.schema) || null, source: '.agentsam/app.json' } : null,
+    },
+    deployment: { configured: remoteConfigured, worker_name: contract?.worker_name || null, config: contract?.config || null, error: contractError },
+    knowledge: {
+      policy_configured: Boolean(policy), policy_source: policy ? '.agentsam/knowledge.json' : null,
+      selected_backend: policy?.lane?.backend || null,
+      suggested_backend: !policy && vectorizeResources.length === 1 ? 'cloudflare_vectorize' : (!policy ? 'local_exact' : null),
+      local_index: { ...localIndex, ...executionState({ observed: localIndex.exists, selected: policy?.lane?.backend === 'local_exact', local: localIndex.exists, remote: false, source: localIndex.exists ? localIndex.path : null, reason: localIndex.exists ? null : 'No local knowledge SQLite index exists.' }) },
+    },
+    authorization: { cloudflare: credential },
+    resources: {
+      workers_ai: workersAi,
+      vectorize: vectorizeResources,
+      d1: d1.map(mapBoundResource),
+      r2: r2.map(mapBoundResource),
+    },
+    conflicts,
+    local_index: localIndex,
+    cloudflare: {
+      configured: remoteConfigured,
+      worker_name: contract?.worker_name || null,
+      config: contract?.config || null,
+      ai_binding: ai?.name || null,
+      vectorize: vectorizeResources.map(row => ({ binding: row.binding, index: row.index, source: row.source })),
+      error: contractError,
+    },
+    lanes,
+  };
+}
+
+export function discoverKnowledgeRuntime(root = process.cwd(), options = {}) {
+  return discoverProjectContext(root, options);
+}

package/src/knowledge/source.js

@@ -7,7 +7,7 @@ import { isKnowledgeSourcePath } from '../../packages/agentsam-repository/src/so
 import { fingerprint } from './config.js';
 
 export const PARSER = `typescript:${ts.version}:agentsam-1`;
-const OMIT = /(^|\/)(?:\.git|\.agentsam|node_modules|dist|build|coverage|vendor|\.next|\.wrangler|\.venv|__pycache__)(\/|$)|(^|\/)(?:\.env[^/]*|\.dev\.vars[^/]*|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|Cargo\.lock|poetry\.lock|uv\.lock|[^/]*\.(?:pem|key|p12|pfx|min\.js|map))$/i;
+const OMIT = /(^|\/)(?:\.git|\.agentsam|node_modules|python_modules|dist|build|target|coverage|vendor|\.next|\.wrangler|\.venv|__pycache__)(\/|$)|(^|\/)(?:\.env[^/]*|\.dev\.vars[^/]*|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|Cargo\.lock|poetry\.lock|uv\.lock|[^/]*\.(?:pem|key|p12|pfx|min\.js|bundle\.js|map))$/i;
 const under = (file, scope) => scope === '.' || file === scope || file.startsWith(scope + '/');
 export function inventory(root, scope) {
   let files;

package/src/lib/identity-scaffold.js

@@ -5,9 +5,15 @@ import { fileURLToPath } from 'node:url';
 const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const IDENTITY_PKG = path.join(SDK_ROOT, 'packages', 'identity');
 const AUTH_PAGES_DIR = path.join(IDENTITY_PKG, 'src', 'frontend', 'auth-portal', 'pages');
-const MIGRATION_FILE = path.join(IDENTITY_PKG, 'src', 'migrations', '0001_identity_core.sql');
+const PORTABLE_SQL_DIR = path.join(IDENTITY_PKG, 'migrations', 'sqlite');
 const BRANDING_SCRIPT = path.join(IDENTITY_PKG, 'src', 'frontend', 'auth-portal', 'shared', 'company-branding.js');
 
+const PORTABLE_SCAFFOLD_FILES = [
+  '001_identity_core.sql',
+  '002_identity_oauth_client.sql',
+  '005_identity_company_native.sql',
+];
+
 /**
  * @param {{ projectName: string, brandName?: string, logoUrl?: string, sdkVersion?: string, provider?: string }} config
  * @returns {Record<string, string>}
@@ -19,7 +25,10 @@ export function buildIdentityAppScaffold(config) {
   const sdkVersion = config.sdkVersion || 'alpha';
   const provider = config.provider || 'email';
 
-  const migrationSql = `${fs.readFileSync(MIGRATION_FILE, 'utf8')}\n${buildCompanySeedSql({ brandName, logoUrl })}\n`;
+  const portableSql = PORTABLE_SCAFFOLD_FILES
+    .map((file) => fs.readFileSync(path.join(PORTABLE_SQL_DIR, file), 'utf8'))
+    .join('\n\n');
+  const migrationSql = `${portableSql}\n${buildCompanySeedSql({ brandName, logoUrl })}\n`;
   const loginHtml = injectBrandingScript(applyBrandTokens(fs.readFileSync(path.join(AUTH_PAGES_DIR, 'login.html'), 'utf8'), {
     brandName,
     logoUrl,
@@ -43,8 +52,8 @@ export function buildIdentityAppScaffold(config) {
     scripts: {
       dev: 'wrangler dev',
       deploy: 'wrangler deploy',
-      'db:migrate:local': `wrangler d1 execute ${projectName} --local --file=migrations/0001_identity_core.sql`,
-      'db:migrate': `wrangler d1 execute ${projectName} --remote --file=migrations/0001_identity_core.sql`,
+      'db:migrate:local': `wrangler d1 execute ${projectName} --local --file=migrations/0001_identity_portable.sql`,
+      'db:migrate': `wrangler d1 execute ${projectName} --remote --file=migrations/0001_identity_portable.sql`,
       preview: 'npx agentsam identity preview --open',
     },
     dependencies: {
@@ -61,6 +70,9 @@ export function buildIdentityAppScaffold(config) {
 main = "backend/src/index.js"
 compatibility_date = "2024-06-01"
 
+[vars]
+IDENTITY_ADAPTER_PROFILE = "portable"
+
 [assets]
 directory = "app/frontend"
 binding = "ASSETS"
@@ -76,7 +88,7 @@ migrations_dir = "migrations"
   files['.env.example'] = `# Minted at install/build — secrets via wrangler secret put (never commit)
 # IAM_CLIENT_ID=          # plaintext var (public by OAuth design)
 # IAM_CLIENT_SECRET=      # wrangler secret put only
-# IAM_ORIGIN=https://inneranimalmedia.com
+# IAM_ORIGIN=
 
 # Web browser OAuth (BYOK) — takes /api/oauth/{google|github}/start when set
 # GOOGLE_CLIENT_ID=
@@ -103,11 +115,12 @@ migrations_dir = "migrations"
 
   files['README.md'] = `# ${brandName} — identity app
 
-Boring scaffold: **app/frontend** (auth UI) + **backend** (Worker API) + **migrations** (D1).
+Boring scaffold: **app/frontend** (auth UI) + **backend** (Worker API) + **migrations** (portable \`identity_*\` D1).
 
 Provider template: \`${provider}\` (see \`agentsam identity plan --provider ${provider}\`).
 
-**Account SSOT:** \`accounts\` (row of record). \`account_identities\` is IdP linkage only.
+**Schema:** portable \`agentsam.identity\` pack (\`identity_users\`, \`identity_sessions\`, \`identity_companies\`, …).
+Not the hosted IAM \`accounts\` / \`auth_users\` / \`company\` shape.
 
 ## Quick start
 
@@ -135,13 +148,13 @@ npm run dev
 \`\`\`
 app/frontend/     Auth portal HTML + dashboard stub
 backend/src/      Cloudflare Worker (identity routes)
-migrations/       D1 schema (+ default \`company\` row)
+migrations/       Portable identity_* schema (+ default identity_companies row)
 
 Branding: \`GET /api/company\` (public). Update with \`PATCH /api/company\` when signed in.
 \`\`\`
 `;
 
-  files['migrations/0001_identity_core.sql'] = migrationSql;
+  files['migrations/0001_identity_portable.sql'] = migrationSql;
 
   files['app/frontend/auth/login.html'] = loginHtml;
   files['app/frontend/auth/signup.html'] = signupHtml;
@@ -190,10 +203,31 @@ Branding: \`GET /api/company\` (public). Update with \`PATCH /api/company\` when
 `;
 
   files['backend/src/index.js'] = `import { handleIdentityWorkerRequest } from '@inneranimalmedia/agentsam-sdk/identity/server/worker-router';
+import { IDENTITY_ROUTE_IDS } from '@inneranimalmedia/agentsam-sdk/identity';
+import { createRouteRegistry, defineRouteProjection } from '@inneranimalmedia/agentsam-sdk/identity';
+
+const app = { id: '${projectName}' };
+const routeRegistry = createRouteRegistry([
+  defineRouteProjection({
+    appId: app.id,
+    routes: {
+      [IDENTITY_ROUTE_IDS.LOGIN]: '/auth/login',
+      [IDENTITY_ROUTE_IDS.SIGNUP]: '/auth/signup',
+      [IDENTITY_ROUTE_IDS.RESET]: '/auth/reset',
+      [IDENTITY_ROUTE_IDS.RECOVERY]: '/auth/reset',
+      [IDENTITY_ROUTE_IDS.APP_AUTHENTICATED]: '/dashboard/',
+      [IDENTITY_ROUTE_IDS.OAUTH_CALLBACK]: '/api/oauth/:provider/callback',
+    },
+  }),
+]);
 
 export default {
   async fetch(request, env, ctx) {
-    return handleIdentityWorkerRequest(request, env);
+    return handleIdentityWorkerRequest(request, env, {
+      app,
+      routeRegistry,
+      identityProfile: 'portable',
+    });
   },
 };
 `;
@@ -202,10 +236,15 @@ export default {
 }
 
 function applyBrandTokens(html, { brandName, logoUrl }) {
+  // Package HTML ships neutral portable defaults; scaffold stamps the app brand.
   return html
     .replace(/Inner Animal Media/g, brandName)
     .replace(/AgentSam/g, brandName)
+    .replace(/<h1 data-company-tagline>Welcome<\/h1>/g, `<h1 data-company-tagline>${brandName}</h1>`)
+    .replace(/<span data-company-name>App<\/span>/g, `<span data-company-name>${brandName}</span>`)
+    .replace(/alt="Sign in"/g, `alt="${brandName}"`)
     .replace(/src="\/shared\/agentsam-mark\.svg"/g, `src="${logoUrl}"`)
+    .replace(/src="\/shared\/app-icon\.png"/g, `src="${logoUrl}"`)
     .replace(/src="\/brand\/[^"]*"/g, `src="${logoUrl}"`)
     .replace(/href="\/brand\/[^"]*"/g, `href="${logoUrl}"`);
 }
@@ -221,9 +260,9 @@ function sqlLiteral(value) {
 
 function buildCompanySeedSql({ brandName, logoUrl }) {
   const ts = Math.floor(Date.now() / 1000);
-  return `-- Default company row (branding SSOT for portal + dashboard)
-INSERT OR IGNORE INTO company (
-  id, slug, name, logo_url, auth_bg_color, primary_color, created_at, updated_at
+  return `-- Default company row (branding SSOT for portal + dashboard) — portable identity_companies
+INSERT OR IGNORE INTO identity_companies (
+  id, slug, name, logo_url, auth_bg_color, primary_color, support_email, created_at, updated_at
 ) VALUES (
   'co_default',
   'default',
@@ -231,6 +270,7 @@ INSERT OR IGNORE INTO company (
   ${sqlLiteral(logoUrl)},
   '#050508',
   '#007AFF',
+  ${sqlLiteral('support@example.test')},
   ${ts},
   ${ts}
 );`;

package/src/lib/setup/recipes.js

@@ -39,7 +39,7 @@ export const imageRasterTransformCapability = {
       provider: 'npm',
       packages: ['sharp'],
       notes: [
-        'Sharp is the portable default (declared dependency of @inneranimalmedia/agentsam-sdk-brand).',
+        'Sharp is the portable default (declared dependency of @inneranimalmedia/agentsam-brand).',
         'Optional enrichment: Homebrew imagemagick for ICNS / exotic formats.',
         'Brand packs: agentsam brand promote → pack → preview → optional publish',
         '  agentsam brand pack --brand acme --asset app-icon --source ./master.png --preset app-icon --out ./acme.zip',

package/src/lib/slash-commands.js

@@ -32,7 +32,7 @@ export const SLASH_COMMANDS = [
   { cmd: '/agent', description: 'Send a goal to the configured local Agent Sam runtime', lane: 'agent' },
   { cmd: '/goap', description: 'Inspect and manage GOAP blackboard: /goap [status|goal|why|plan|list|new|switch|close]', lane: 'agent' },
   { cmd: '/brand', description: 'Brand intelligence: /brand [scan|resolve|plan|inspect]', lane: 'product' },
-  { cmd: '/plan', description: 'Composable plans: /plan brand', lane: 'product' },
+  { cmd: '/plan', description: 'Durable local plans: /plan [new|list|show|add|start|done|block|complete|brand]', lane: 'product' },
   { cmd: '/next', description: 'Suggested next actions from session progression', lane: 'product' },
   { cmd: '/logs', description: 'Show local Agent Sam execution events', lane: 'observability' },
   { cmd: '/deploy', description: 'Add a cloud adapter and deploy intentionally', lane: 'deploy' },

package/src/local/runtime-store.js

@@ -43,14 +43,36 @@ export function createRuntimeRunId() {
 export async function startRuntimeRun(value = {}) {
   const id = clean(value.id) || createRuntimeRunId();
   await withStore(value.projectRoot || value.cwd, async (db) => {
+    const activeStep = (!clean(value.plan_id) || !clean(value.todo_id))
+      ? await db.prepare(`
+          SELECT t.id AS todo_id, t.plan_id
+          FROM agentsam_todo t
+          JOIN agentsam_plans p ON p.id = t.plan_id
+          WHERE t.status = 'running' AND p.status = 'active'
+          ORDER BY t.updated_at_unix DESC, t.created_at_unix DESC
+          LIMIT 1
+        `).first()
+      : null;
+    const activePlan = !clean(value.plan_id) && !activeStep?.plan_id
+      ? await db.prepare(`
+          SELECT id AS plan_id FROM agentsam_plans
+          WHERE status = 'active'
+          ORDER BY updated_at_unix DESC, created_at_unix DESC
+          LIMIT 1
+        `).first()
+      : null;
+    const planId = clean(value.plan_id) || clean(activeStep?.plan_id) || clean(activePlan?.plan_id) || null;
+    const todoId = clean(value.todo_id) || clean(activeStep?.todo_id) || null;
     await db.prepare(`
       INSERT INTO agentsam_agent_run (
-        id, account_id, source_client, surface, mode, model_key,
+        id, account_id, plan_id, todo_id, source_client, surface, mode, model_key,
         reasoning_effort, requested_service_tier, status, started_at_unix, updated_at_unix
-      ) VALUES (?, ?, 'agentsam-cli', 'cli', ?, ?, ?, ?, 'running', unixepoch(), unixepoch())
+      ) VALUES (?, ?, ?, ?, 'agentsam-cli', 'cli', ?, ?, ?, ?, 'running', unixepoch(), unixepoch())
     `).bind(
       id,
       clean(value.account_id) || null,
+      planId,
+      todoId,
       clean(value.mode) || 'agent',
       clean(value.model_key) || null,
       clean(value.reasoning_effort) || null,