@dharma-ai-labs/agent-fabric 0.2.131 → 0.2.133

package/dist/index.test.js

@@ -1104,7 +1104,9 @@ test('repository onboarding skill records scoped API metadata without local path
     assert.ok(skill.includes((await loadAgentFabricOnboardingContract()).markdown));
     assert.match(skill, /bounded, task-related question/);
     assert.match(skill, /dharma skills verify --provider <provider> --workspace <bound-workspace-path>/);
-    assert.doesNotMatch(skill, /--grant|bootstrapGrant|organizationApiToken/);
+    assert.doesNotMatch(skill, /--grant\s+['"]?dhab_|dhab_[A-Za-z0-9_-]+|bootstrapGrant|organizationApiToken/);
+    assert.match(skill, /recipient runs the portal's exact generated `--grant-prompt` bootstrap command/);
+    assert.match(skill, /not part of the agent prompt/);
     assert.match(connection, /workspace-northstar/);
     assert.equal(connection.includes(workspace), false);
     assert.equal(/token|secret/i.test(connection), false);
@@ -2025,7 +2027,7 @@ test('Hermes bootstrap trusts the repository and verifies native discovery', asy
     });
     assert.equal(installed.verified, true);
     const installedSkill = await readFile(installed.skillPath, 'utf8');
-    assert.match(installedSkill, /supports both connecting a new source repository and joining an existing organization repository agent/);
+    assert.match(installedSkill, /supports connecting a new source repository and joining an existing organization repository agent/);
     assert.match(installedSkill, /native action-time approval/);
     assert.doesNotMatch(installedSkill, /Use this skill only inside a repository containing/);
     assert.deepEqual(calls[0], {
@@ -2307,7 +2309,8 @@ test('native skill persists the complete hash-pinned onboarding contract', async
     assert.match(skill, /# Agent Fabric: repository onboarding and team operation/);
     assert.ok(skill.includes(contract.markdown));
     assert.equal(marker.operatingContractSha256, contract.sha256);
-    assert.doesNotMatch(contract.markdown, /--grant|bootstrapGrant|organizationApiToken/);
+    assert.doesNotMatch(contract.markdown, /--grant\s+['"]?dhab_|dhab_[A-Za-z0-9_-]+|bootstrapGrant|organizationApiToken/);
+    assert.match(contract.markdown, /private terminal grant entry nor browser device approval may be performed or impersonated by an agent/);
 });
 test('Agy skill verification requires the native plugin to be discoverable by the provider', async () => {
     const root = await mkdtemp(join(tmpdir(), 'dharma-agy-skill-verification-'));