@easynet-run/node 0.27.14 → 0.39.29

package/src/presets/remote_control/kit.test.js

@@ -1,15 +1,50 @@
+// EasyNet Axon for AgentNet
+// =========================
+//
+// File: sdk/node/src/presets/remote_control/kit.test.js
+// Description: Node remote-control preset regression tests for tool dispatch, streaming cleanup, and lifecycle behavior.
+//
+// Protocol Responsibility:
+// - Exercises public runtime behavior for the corresponding service surface under success and failure scenarios.
+// - Guards regressions in tenant isolation, terminal states, and typed error shaping.
+//
+// Implementation Approach:
+// - Builds in-memory runtimes and drives tonic service methods directly for deterministic assertions.
+// - Uses focused fixtures instead of full external environments so protocol invariants stay easy to localize.
+//
+// Usage Contract:
+// - Add new assertions here before changing runtime behavior for the covered service area.
+// - Prefer explicit value checks over timing-sensitive or order-fragile expectations.
+//
+// Architectural Position:
+// - Runtime verification boundary protecting public contract stability.
+//
+// Author: Silan.Hu
+// Email: silan.hu@u.nus.edu
+// Copyright (c) 2026-2027 easynet. All rights reserved.
+
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 
 import { RemoteControlCaseKit } from "./kit.js";
+import { buildDescriptor, sanitizeId } from "./descriptor.js";
 import { remoteControlToolSpecs } from "./specs.js";
+import { consumeStream } from "../../mcp/server.js";
+import { DEFAULT_MCP_TOOL_STREAM_TIMEOUT_MS } from "./config.js";
 
 function makeOrchestrator() {
   return {
     listNodes: () => [],
     listMcpTools: () => [],
     callMcpTool: () => ({ ok: true, state: 5, is_error: false }),
+    callMcpToolStream: () => ({
+      close: () => {},
+      async *[Symbol.asyncIterator]() {
+        yield Buffer.from("chunk");
+      },
+    }),
     disconnectDevice: (nodeId, reason) => ({ node_id: nodeId, reason }),
+    drainNode: (nodeId, reason) => ({ node_id: nodeId, status: "drained", reason }),
     uninstallAbility: (nodeId, installId, reason) => ({
       node_id: nodeId,
       install_id: installId,
@@ -26,6 +61,9 @@ describe("RemoteControlCaseKit", () => {
     const names = remoteControlToolSpecs().map((spec) => String(spec.name));
     assert.ok(names.includes("disconnect_device"));
     assert.ok(names.includes("uninstall_ability"));
+    assert.ok(names.includes("call_remote_tool_stream"));
+    assert.ok(names.includes("build_ability_descriptor"));
+    assert.ok(names.includes("redeploy_ability"));
   });
 
   it("dispatches disconnect_device", () => {
@@ -84,4 +122,960 @@ describe("RemoteControlCaseKit", () => {
       },
     });
   });
+
+  it("rejects forget_all without confirm when dry_run is false", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("forget_all", { node_id: "node-a" });
+
+    assert.equal(result.isError, true);
+    assert.equal(result.payload.error, "forget_all requires confirm: true (destructive operation)");
+  });
+
+  it("rejects build_ability_descriptor when name is empty", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("build_ability_descriptor", {
+      command_template: "echo hi",
+    });
+
+    assert.equal(result.isError, true);
+    assert.equal(result.payload.error, "name is required");
+  });
+
+  it("rejects redeploy_ability when tool_name is missing", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("redeploy_ability", {
+      node_id: "node-a",
+      command_template: "echo hi",
+    });
+
+    assert.equal(result.isError, true);
+    assert.equal(result.payload.error, "tool_name is required");
+  });
+
+  it("filters list_abilities to entries with install_id", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        listMcpTools: () => [
+          { tool_name: "keep-me", description: "ok", capability_name: "cap.keep", install_id: "install-1" },
+          { tool_name: "skip-me", description: "synthetic", capability_name: "cap.skip", install_id: "" },
+        ],
+      }),
+    );
+
+    const result = kit.handleToolCall("list_abilities", { node_id: "node-a" });
+
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.count, 1);
+    assert.deepEqual(result.payload.abilities, [
+      {
+        tool_name: "keep-me",
+        description: "ok",
+        capability_name: "cap.keep",
+        install_id: "install-1",
+      },
+    ]);
+  });
+
+  it("closes the orchestrator when a streaming handle is closed", () => {
+    let streamClosed = 0;
+    let orchestratorClosed = 0;
+    const stream = {
+      close: () => {
+        streamClosed += 1;
+      },
+      async *[Symbol.asyncIterator]() {
+        yield Buffer.from("chunk");
+      },
+    };
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        callMcpToolStream: () => stream,
+        close: () => {
+          orchestratorClosed += 1;
+        },
+      }),
+    );
+
+    const handle = kit.handleToolCallStream("call_remote_tool_stream", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+
+    assert.ok(handle);
+    handle.close();
+    handle.close();
+    assert.equal(streamClosed, 1);
+    assert.equal(orchestratorClosed, 1);
+  });
+
+  it("closes the orchestrator after streaming iteration completes", async () => {
+    let streamClosed = 0;
+    let orchestratorClosed = 0;
+    const stream = {
+      close: () => {
+        streamClosed += 1;
+      },
+      async *[Symbol.asyncIterator]() {
+        yield Buffer.from("chunk-1");
+        yield Buffer.from("chunk-2");
+      },
+    };
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        callMcpToolStream: () => stream,
+        close: () => {
+          orchestratorClosed += 1;
+        },
+      }),
+    );
+
+    const handle = kit.handleToolCallStream("call_remote_tool_stream", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+
+    assert.ok(handle);
+    const chunks = [];
+    for await (const chunk of handle.stream) {
+      chunks.push(Buffer.from(chunk).toString("utf8"));
+    }
+
+    assert.deepEqual(chunks, ["chunk-1", "chunk-2"]);
+    assert.equal(streamClosed, 1);
+    assert.equal(orchestratorClosed, 1);
+  });
+
+  it("closes the orchestrator after an empty stream completes", async () => {
+    let streamClosed = 0;
+    let orchestratorClosed = 0;
+    const stream = {
+      close: () => {
+        streamClosed += 1;
+      },
+      async *[Symbol.asyncIterator]() {
+        // empty stream
+      },
+    };
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        callMcpToolStream: () => stream,
+        close: () => {
+          orchestratorClosed += 1;
+        },
+      }),
+    );
+
+    const handle = kit.handleToolCallStream("call_remote_tool_stream", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+
+    assert.ok(handle);
+    const chunks = [];
+    for await (const chunk of handle.stream) {
+      chunks.push(Buffer.from(chunk).toString("utf8"));
+    }
+
+    assert.deepEqual(chunks, []);
+    assert.equal(streamClosed, 1);
+    assert.equal(orchestratorClosed, 1);
+  });
+
+  it("closes the orchestrator when streaming iteration fails", async () => {
+    let streamClosed = 0;
+    let orchestratorClosed = 0;
+    const stream = {
+      close: () => {
+        streamClosed += 1;
+      },
+      async *[Symbol.asyncIterator]() {
+        yield Buffer.from("chunk-1");
+        throw new Error("stream chunk timeout");
+      },
+    };
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        callMcpToolStream: () => stream,
+        close: () => {
+          orchestratorClosed += 1;
+        },
+      }),
+    );
+
+    const handle = kit.handleToolCallStream("call_remote_tool_stream", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+
+    assert.ok(handle);
+    const chunks = [];
+    await assert.rejects(async () => {
+      for await (const chunk of handle.stream) {
+        chunks.push(Buffer.from(chunk).toString("utf8"));
+      }
+    }, /stream chunk timeout/);
+
+    assert.deepEqual(chunks, ["chunk-1"]);
+    assert.equal(streamClosed, 1);
+    assert.equal(orchestratorClosed, 1);
+  });
+
+  it("passes timeout_ms through to the orchestrator", () => {
+    let capturedOptions = null;
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        callMcpToolStream: (_toolName, _nodeId, _args, opts) => {
+          capturedOptions = opts;
+          return {
+            close: () => {},
+            async *[Symbol.asyncIterator]() {},
+          };
+        },
+        close: () => {},
+      }),
+    );
+
+    const handle = kit.handleToolCallStream("call_remote_tool_stream", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+      timeout_ms: 42000,
+    });
+    assert.ok(handle);
+    handle.close();
+    assert.ok(capturedOptions);
+    assert.equal(capturedOptions.timeoutMs, 42000);
+  });
+
+  it("returns null for unknown tool in handleToolCallStream", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const handle = kit.handleToolCallStream("nonexistent_tool", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+    assert.equal(handle, null);
+  });
+
+  it("buffers call_remote_tool_stream via unary handleToolCall", async () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = await kit.handleToolCall("call_remote_tool_stream", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.ok, true);
+    assert.equal(result.payload.chunk_count, 1);
+    assert.deepEqual(result.payload.chunks, ["chunk"]);
+  });
+
+  it("keeps unary and buffered-stream payload shapes distinct", async () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const unaryResult = await kit.handleToolCall("call_remote_tool", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+    const bufferedStreamResult = await kit.handleToolCall("call_remote_tool_stream", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+
+    assert.equal(unaryResult.isError, false);
+    assert.equal(unaryResult.payload.ok, true);
+    assert.ok("call" in unaryResult.payload);
+    assert.equal("chunks" in unaryResult.payload, false);
+
+    assert.equal(bufferedStreamResult.isError, false);
+    assert.equal(bufferedStreamResult.payload.ok, true);
+    assert.equal(bufferedStreamResult.payload.chunk_count, 1);
+    assert.deepEqual(bufferedStreamResult.payload.chunks, ["chunk"]);
+    assert.equal("call" in bufferedStreamResult.payload, false);
+  });
+
+  it("returns an error payload when unary stream buffering cannot open the stream", async () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        callMcpToolStream: () => {
+          throw new Error("stream open failed");
+        },
+        close: () => {},
+      }),
+    );
+
+    const result = await kit.handleToolCall("call_remote_tool_stream", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+
+    assert.equal(result.isError, true);
+    assert.equal(result.payload.ok, false);
+    assert.match(String(result.payload.error), /stream open failed/);
+  });
+
+  it("consumeStream enforces 64 MiB buffer limit", async () => {
+    // Each chunk is 1 MiB; yield 65 chunks to exceed the 64 MiB limit.
+    const oneMiB = Buffer.alloc(1024 * 1024, 0x41); // 'A'
+    let closeCalled = 0;
+    const handle = {
+      close: () => {
+        closeCalled += 1;
+      },
+      stream: {
+        async *[Symbol.asyncIterator]() {
+          for (let i = 0; i < 65; i++) {
+            yield oneMiB;
+          }
+        },
+      },
+    };
+
+    const result = await consumeStream(handle);
+
+    assert.equal(result.isError, true);
+    assert.equal(result.payload.ok, false);
+    assert.match(String(result.payload.error), /64 MiB/);
+    assert.equal(closeCalled, 1);
+  });
+
+  it("consumeStream detects lossy UTF-8 in binary chunks", async () => {
+    let closeCalled = 0;
+    const handle = {
+      close: () => {
+        closeCalled += 1;
+      },
+      stream: {
+        async *[Symbol.asyncIterator]() {
+          yield Buffer.from([0xff, 0xfe, 0x41]);
+        },
+      },
+    };
+
+    const result = await consumeStream(handle);
+
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.ok, true);
+    assert.equal(result.payload.contains_invalid_utf8, true);
+    assert.equal(closeCalled, 1);
+  });
+
+  it("StdioMcpServer tries stream handler before unary", async () => {
+    const { StdioMcpServer } = await import("../../mcp/server.js");
+
+    let streamCalled = false;
+    let unaryCalled = false;
+
+    const provider = {
+      toolSpecs() {
+        return [
+          {
+            name: "my_tool",
+            description: "A test tool",
+            inputSchema: { type: "object", properties: {} },
+          },
+        ];
+      },
+      handleToolCall(_name, _args) {
+        unaryCalled = true;
+        return { payload: { ok: true, source: "unary" }, isError: false };
+      },
+      handleToolCallStream(_name, _args) {
+        streamCalled = true;
+        return {
+          stream: {
+            async *[Symbol.asyncIterator]() {
+              yield Buffer.from("stream-chunk-1");
+              yield Buffer.from("stream-chunk-2");
+            },
+          },
+          close() {},
+        };
+      },
+    };
+
+    const server = new StdioMcpServer(provider);
+    const request = JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "tools/call",
+      params: { name: "my_tool", arguments: { foo: "bar" } },
+    });
+
+    const response = await server.handleRawLine(request);
+
+    assert.equal(streamCalled, true, "handleToolCallStream should have been called");
+    assert.equal(unaryCalled, false, "handleToolCall should NOT have been called");
+
+    // The server buffers the stream into a JSON-RPC success response
+    assert.equal(response.jsonrpc, "2.0");
+    assert.equal(response.id, 1);
+    assert.ok(response.result);
+    assert.ok(response.result.content);
+    const text = response.result.content[0].text;
+    const payload = JSON.parse(text);
+    assert.equal(payload.ok, true);
+    assert.equal(payload.chunk_count, 2);
+    assert.deepEqual(payload.chunks, ["stream-chunk-1", "stream-chunk-2"]);
+  });
+
+  // -----------------------------------------------------------------
+  // drain_device tests
+  // -----------------------------------------------------------------
+  it("dispatches drain_device happy path", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("drain_device", {
+      node_id: "node-a",
+      reason: "maintenance window",
+    });
+
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.ok, true);
+    assert.equal(result.payload.tenant_id, "tenant-a");
+    assert.equal(result.payload.node_id, "node-a");
+    assert.equal(result.payload.status, "draining");
+    assert.equal(result.payload.response.node_id, "node-a");
+    assert.equal(result.payload.response.reason, "maintenance window");
+  });
+
+  it("rejects drain_device with missing node_id", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("drain_device", { node_id: "" });
+
+    assert.equal(result.isError, true);
+    assert.equal(result.payload.error, "node_id is required");
+  });
+
+  // -----------------------------------------------------------------
+  // build_ability_descriptor tests
+  // -----------------------------------------------------------------
+  it("dispatches build_ability_descriptor happy path", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("build_ability_descriptor", {
+      name: "screenshot",
+      command_template: "screencapture -x /tmp/shot.png",
+      description: "Capture a screenshot",
+    });
+
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.ok, true);
+    const descriptor = result.payload.descriptor;
+    assert.ok(descriptor);
+    assert.equal(descriptor.name, "screenshot");
+    assert.match(descriptor.toolName, /^ability_screenshot$/);
+    assert.equal(descriptor.description, "Capture a screenshot");
+    assert.equal(descriptor.commandTemplate, "screencapture -x /tmp/shot.png");
+  });
+
+  it("dispatches build_ability_descriptor with agent extensions", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("build_ability_descriptor", {
+      name: "gpu-info",
+      command_template: "nvidia-smi --query-gpu=name --format=csv",
+      instructions: "Use this to query GPU status on the device.",
+      input_examples: [{ query: "temperature" }],
+      prerequisites: ["GPU driver installed"],
+      context_bindings: { "env.CUDA_HOME": "/usr/local/cuda" },
+      category: "system",
+    });
+
+    assert.equal(result.isError, false);
+    const d = result.payload.descriptor;
+    assert.equal(d.instructions, "Use this to query GPU status on the device.");
+    assert.deepEqual(d.inputExamples, [{ query: "temperature" }]);
+    assert.deepEqual(d.prerequisites, ["GPU driver installed"]);
+    assert.deepEqual(d.contextBindings, { "env.CUDA_HOME": "/usr/local/cuda" });
+    assert.equal(d.category, "system");
+  });
+
+  it("buildDescriptor stores prerequisites as a JSON array", () => {
+    const descriptor = buildDescriptor({
+      ability_name: "gpu-info",
+      command_template: "nvidia-smi --query-gpu=name --format=csv",
+      prerequisites: ["GPU, driver installed", "session_start"],
+    }, "sig");
+
+    assert.equal(
+      descriptor.metadata["mcp.prerequisites"],
+      JSON.stringify(["GPU, driver installed", "session_start"]),
+    );
+  });
+
+  it("sanitizeId rejects names that normalize to empty", () => {
+    assert.throws(() => sanitizeId("数据分析"), /identifier contains no valid characters/);
+  });
+
+  // -----------------------------------------------------------------
+  // export_ability_skill tests
+  // -----------------------------------------------------------------
+  it("dispatches export_ability_skill and generates SKILL.md", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("export_ability_skill", {
+      name: "disk-usage",
+      command_template: "df -h",
+      target: "claude",
+    });
+
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.ok, true);
+    assert.ok(typeof result.payload.ability_md === "string");
+    assert.ok(typeof result.payload.invoke_script === "string");
+    assert.ok(result.payload.ability_md.length > 0);
+    assert.ok(result.payload.invoke_script.length > 0);
+    // Claude target should include allowed-tools
+    assert.ok(result.payload.ability_md.includes("allowed-tools"));
+    // Invoke script should be a bash script
+    assert.ok(result.payload.invoke_script.includes("#!/usr/bin/env bash"));
+  });
+
+  it("rejects export_ability_skill with shell-unsafe endpoint", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("export_ability_skill", {
+      name: "probe",
+      command_template: "echo hello",
+      axon_endpoint: "http://evil.com`rm -rf /`",
+    });
+
+    assert.equal(result.isError, true);
+    assert.ok(result.payload.error);
+    assert.match(result.payload.error, /disallowed shell characters/);
+  });
+
+  it("rejects export_ability_skill with carriage-return endpoint", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("export_ability_skill", {
+      name: "probe",
+      command_template: "echo hello",
+      axon_endpoint: "http://evil.com/\rprobe",
+    });
+
+    assert.equal(result.isError, true);
+    assert.ok(result.payload.error);
+    assert.match(result.payload.error, /disallowed shell characters/);
+  });
+
+  // -----------------------------------------------------------------
+  // forget_all tests
+  // -----------------------------------------------------------------
+  it("dispatches forget_all dry_run and returns would-remove list", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        listMcpTools: () => [
+          { tool_name: "tool-with-id", description: "ok", capability_name: "cap.a", install_id: "inst-1" },
+          { tool_name: "tool-without-id", description: "synthetic", capability_name: "cap.b", install_id: "" },
+        ],
+      }),
+    );
+
+    const result = kit.handleToolCall("forget_all", {
+      node_id: "node-a",
+      dry_run: true,
+    });
+
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.ok, true);
+    assert.equal(result.payload.dry_run, true);
+    assert.deepEqual(result.payload.removed, ["tool-with-id"]);
+    assert.equal(result.payload.removed_count, 1);
+    assert.equal(result.payload.failed_count, 1);
+    assert.equal(result.payload.failed[0].tool_name, "tool-without-id");
+  });
+
+  it("dispatches forget_all with confirm and removes abilities", () => {
+    let uninstallCalls = [];
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        listMcpTools: () => [
+          { tool_name: "my-tool", description: "test", capability_name: "cap.x", install_id: "inst-7" },
+        ],
+        uninstallAbility: (nodeId, installId, reason) => {
+          uninstallCalls.push({ nodeId, installId, reason });
+          return { node_id: nodeId, install_id: installId, reason };
+        },
+      }),
+    );
+
+    const result = kit.handleToolCall("forget_all", {
+      node_id: "node-a",
+      confirm: true,
+    });
+
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.ok, true);
+    assert.equal(result.payload.dry_run, false);
+    assert.deepEqual(result.payload.removed, ["my-tool"]);
+    assert.equal(result.payload.removed_count, 1);
+    assert.equal(result.payload.failed_count, 0);
+    assert.equal(uninstallCalls.length, 1);
+    assert.equal(uninstallCalls[0].installId, "inst-7");
+  });
+
+  // -----------------------------------------------------------------
+  // redeploy_ability tests
+  // -----------------------------------------------------------------
+  it("dispatches redeploy_ability happy path", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        deployAbilityPackage: () => ({ install_id: "inst-99", tool_name: "my-tool" }),
+      }),
+    );
+
+    const result = kit.handleToolCall("redeploy_ability", {
+      node_id: "node-a",
+      tool_name: "my-tool",
+      command_template: "echo updated",
+    });
+
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.ok, true);
+    assert.equal(result.payload.status, "redeployed");
+    assert.equal(result.payload.node_id, "node-a");
+    assert.equal(result.payload.tool_name, "my-tool");
+    assert.equal(result.payload.install_id, "inst-99");
+  });
+
+  // -----------------------------------------------------------------
+  // export_ability_skill verifies SKILL.md structure
+  // -----------------------------------------------------------------
+  it("export_ability_skill verifies SKILL.md structure", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("export_ability_skill", {
+      name: "my-skill",
+      command_template: "echo hello",
+      target: "claude",
+    });
+
+    assert.equal(result.isError, false);
+    assert.ok(result.payload.ability_md.includes("---\nname:"), "ability_md should contain frontmatter start");
+    assert.ok(result.payload.ability_md.includes("## Parameters"), "ability_md should contain Parameters section");
+    assert.ok(result.payload.ability_md.includes("| Name |"), "ability_md should contain parameter table header");
+    assert.ok(result.payload.invoke_script.includes("curl -sS -X POST"), "invoke_script should contain curl POST");
+  });
+
+  // -----------------------------------------------------------------
+  // build_ability_descriptor with Unicode name
+  // -----------------------------------------------------------------
+  it("build_ability_descriptor with Unicode name", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("build_ability_descriptor", {
+      name: "数据分析",
+      command_template: "python3 analyze.py",
+    });
+
+    // Unicode-only names are rejected by sanitizeId (ASCII identifiers only).
+    assert.equal(result.isError, true);
+    assert.ok(result.payload.error);
+  });
+
+  // -----------------------------------------------------------------
+  // forget_all confirmed removes and reports failures
+  // -----------------------------------------------------------------
+  it("forget_all confirmed removes and reports failures", () => {
+    let uninstallCalls = [];
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        listMcpTools: () => [
+          { tool_name: "tool-a", description: "ok", capability_name: "cap.a", install_id: "inst-1" },
+          { tool_name: "tool-b", description: "no id", capability_name: "cap.b", install_id: "" },
+          { tool_name: "tool-c", description: "whitespace id", capability_name: "cap.c", install_id: "   " },
+        ],
+        uninstallAbility: (nodeId, installId, reason) => {
+          uninstallCalls.push({ nodeId, installId, reason });
+          return { node_id: nodeId, install_id: installId, reason };
+        },
+      }),
+    );
+
+    const result = kit.handleToolCall("forget_all", {
+      node_id: "node-a",
+      confirm: true,
+    });
+
+    assert.equal(result.isError, false);
+    assert.equal(result.payload.ok, true);
+    assert.equal(result.payload.removed.length, 1);
+    assert.equal(result.payload.failed.length, 2);
+    assert.equal(uninstallCalls.length, 1);
+    assert.equal(uninstallCalls[0].installId, "inst-1");
+  });
+
+  // -----------------------------------------------------------------
+  // build_ability_descriptor rejects empty command_template
+  // -----------------------------------------------------------------
+  it("build_ability_descriptor rejects empty command_template", () => {
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => makeOrchestrator(),
+    );
+
+    const result = kit.handleToolCall("build_ability_descriptor", {
+      name: "test",
+    });
+
+    assert.equal(result.isError, true);
+    assert.ok(result.payload.error);
+  });
+
+  // -----------------------------------------------------------------
+  // Spec validation tests
+  // -----------------------------------------------------------------
+  it("all tool specs have unique names", () => {
+    const specs = remoteControlToolSpecs();
+    const names = specs.map((s) => s.name);
+    const unique = new Set(names);
+    assert.equal(names.length, unique.size, `Duplicate spec names found: ${names.filter((n, i) => names.indexOf(n) !== i)}`);
+  });
+
+  it("all specs have required inputSchema fields", () => {
+    const specs = remoteControlToolSpecs();
+    for (const spec of specs) {
+      assert.ok(spec.inputSchema, `spec ${spec.name} is missing inputSchema`);
+      assert.equal(spec.inputSchema.type, "object", `spec ${spec.name} inputSchema.type should be "object"`);
+    }
+  });
+
+  it("uses default timeout when timeout_ms is missing", () => {
+    let capturedOptions = null;
+    const kit = new RemoteControlCaseKit(
+      {
+        endpoint: "http://127.0.0.1:50051",
+        tenant: "tenant-a",
+        connectTimeoutMs: 5000,
+        signatureBase64: "sig",
+      },
+      () => ({
+        ...makeOrchestrator(),
+        callMcpToolStream: (_toolName, _nodeId, _args, opts) => {
+          capturedOptions = opts;
+          return {
+            close: () => {},
+            async *[Symbol.asyncIterator]() {},
+          };
+        },
+        close: () => {},
+      }),
+    );
+
+    const handle = kit.handleToolCallStream("call_remote_tool_stream", {
+      node_id: "node-a",
+      tool_name: "tool-a",
+    });
+    assert.ok(handle);
+    handle.close();
+    assert.ok(capturedOptions);
+    assert.equal(capturedOptions.timeoutMs, DEFAULT_MCP_TOOL_STREAM_TIMEOUT_MS);
+  });
 });