@inneranimalmedia/agentsam-sdk 2.4.0 → 2.5.0

package/test/context.test.mjs

@@ -0,0 +1,95 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import {
+  DEFAULT_RESULT_POLICY,
+  createContextBudget,
+  normalizeResultPolicy,
+  resolveContext,
+  resolveProjectContext,
+} from '../src/context/index.js';
+
+test('default result policy is bounded and callers may request less', () => {
+  assert.deepEqual(DEFAULT_RESULT_POLICY, { max_items: 8, max_chars: 24_000, detail: 'excerpt' });
+  assert.deepEqual(normalizeResultPolicy({ max_items: 3, max_chars: 8_000, detail: 'card' }), {
+    max_items: 3,
+    max_chars: 8_000,
+    detail: 'card',
+  });
+  assert.throws(() => normalizeResultPolicy({ max_items: 9 }), /higher_detail_required:max_items/);
+  assert.throws(() => normalizeResultPolicy({ max_chars: 24_001 }), /higher_detail_required:max_chars/);
+  assert.throws(() => normalizeResultPolicy({ detail: 'full' }), /higher_detail_required:detail/);
+  assert.equal(normalizeResultPolicy({ detail: 'full', max_items: 20, max_chars: 100_000 }, { operation: 'higher-detail' }).detail, 'full');
+});
+
+test('context budget reserves headroom and caps each ownership class', () => {
+  const budget = createContextBudget({ windowTokens: 250_000 });
+  assert.equal(budget.targetInputTokens, 150_000);
+  assert.equal(budget.hardInputTokens, 212_500);
+  assert.equal(budget.windowChars, 1_000_000);
+  assert.equal(budget.maxSystemChars, 50_000);
+  assert.equal(budget.maxToolSchemaChars, 40_000);
+  assert.equal(budget.maxEvidenceChars, 100_000);
+  assert.equal(budget.maxFileCharsPerRead, 32_768);
+  assert.equal(budget.maxFileCharsPerTurn, 131_072);
+  assert.equal(budget.maxToolResultChars, 24_000);
+});
+
+test('context.resolve selects high-priority evidence and returns a receipt', () => {
+  const budget = createContextBudget({
+    windowTokens: 32_000,
+    maxEvidenceChars: 90,
+    maxFileCharsPerRead: 50,
+    maxFileCharsPerTurn: 60,
+    maxToolResultChars: 30,
+  });
+  const pack = resolveContext({
+    objective: 'fix terminal cwd persistence',
+    refs: ['repo:demo'],
+    budget,
+    items: [
+      { ref: 'file:low', kind: 'file', priority: 1, content: 'L'.repeat(50) },
+      { ref: 'tool:high', kind: 'tool_result', priority: 10, content: 'T'.repeat(50) },
+      { ref: 'file:high', kind: 'file', priority: 8, content: 'F'.repeat(80) },
+      { ref: 'memory:later', kind: 'memory', priority: 0, content: 'M'.repeat(40) },
+    ],
+  });
+
+  assert.deepEqual(pack.items.map((item) => item.ref), ['tool:high', 'file:high', 'file:low']);
+  assert.equal(pack.items[0].chars, 30);
+  assert.equal(pack.items[1].chars, 50);
+  assert.equal(pack.items[2].chars, 10);
+  assert.equal(pack.receipt.evidence_chars, 90);
+  assert.equal(pack.receipt.sources_considered, 4);
+  assert.equal(pack.receipt.sources_included, 3);
+  assert.ok(pack.receipt.sources_deferred >= 3); // truncated remainders + one deferred source
+  assert.ok(pack.receipt.deferred_refs.includes('memory:later'));
+});
+
+test('project context automatically loads bounded .agentsamrules as system context', t => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-context-rules-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  fs.writeFileSync(path.join(root, '.agentsamrules'), `# rules\n${'x'.repeat(5000)}\n`);
+  const pack = resolveProjectContext({
+    cwd: root,
+    objective: 'inspect repository',
+    budget: createContextBudget({ windowTokens: 8_000, maxSystemChars: 1_000, maxEvidenceChars: 1_000 }),
+    items: [],
+  });
+  assert.equal(pack.rules.found, true);
+  assert.equal(pack.rules.chars, 1_000);
+  assert.equal(pack.rules.truncated, true);
+  assert.equal(pack.receipt.system_chars, 1_000);
+});
+
+test('consumed tool results compact to 4k while preserving the evidence ref', async () => {
+  const { compactConsumedToolResult } = await import('../src/context/index.js');
+  const item = compactConsumedToolResult('x'.repeat(10_000), { ref: 'tool:call_123', hash: 'sha256:abc' });
+  assert.equal(item.ref, 'tool:call_123');
+  assert.equal(item.hash, 'sha256:abc');
+  assert.equal(item.chars, 4_000);
+  assert.equal(item.compacted, true);
+  assert.equal(item.source_chars, 10_000);
+});

package/test/indexing-provider.test.mjs

@@ -0,0 +1,29 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  REPOSITORY_KNOWLEDGE_PROVIDER_METHODS,
+  assertRepositoryKnowledgeProvider,
+  createRepositoryKnowledgeClient,
+  describeRepositoryKnowledgeProvider,
+} from '../src/indexing/index.js';
+
+function provider() {
+  return Object.fromEntries(REPOSITORY_KNOWLEDGE_PROVIDER_METHODS.map((method) => [method, async (input) => ({ method, input })]));
+}
+
+test('repository knowledge provider is a contract, not a bundled platform implementation', async () => {
+  const impl = provider();
+  assert.equal(assertRepositoryKnowledgeProvider(impl), impl);
+  const client = createRepositoryKnowledgeClient(impl);
+  assert.deepEqual(await client.findSymbol({ name: 'resolveModel' }), { method: 'findSymbol', input: { name: 'resolveModel' } });
+  assert.deepEqual(await client.retrieve({ query: 'session recovery' }), { method: 'retrieve', input: { query: 'session recovery' } });
+  assert.throws(() => assertRepositoryKnowledgeProvider({ status() {} }), /refresh\(\) is required/);
+});
+
+test('provider capabilities describe implementation truth without prescribing storage', () => {
+  assert.deepEqual(describeRepositoryKnowledgeProvider({
+    provider: 'inneranimal-platform', structure: 'tree-sitter', lexical: true, semantic: true, graph: true, history: true, evidence: 'merkle',
+  }), {
+    provider: 'inneranimal-platform', structure: 'tree-sitter', lexical: true, semantic: true, graph: true, history: true, evidence: 'merkle',
+  });
+});

package/test/jr-dev-skill.test.mjs

@@ -0,0 +1,26 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+
+const root = path.resolve(import.meta.dirname, '..');
+const skill = path.join(root, 'skills', 'agentsam-jr-dev', 'SKILL.md');
+const fundamentals = path.join(root, 'skills', 'agentsam-jr-dev', 'references', 'web-application-fundamentals.md');
+const logic = path.join(root, 'skills', 'agentsam-jr-dev', 'references', 'real-application-logic.md');
+
+test('agentsam-jr-dev ships as a portable skill with depth references', () => {
+  for (const file of [skill, fundamentals, logic]) {
+    assert.equal(fs.existsSync(file), true, `${file} must exist`);
+  }
+
+  const text = fs.readFileSync(skill, 'utf8');
+  assert.match(text, /name: agentsam-jr-dev/);
+  assert.match(text, /Inspect before teaching repo-specific facts/);
+  assert.match(text, /Real application logic is the standard/);
+  assert.match(text, /Never invent a repo architecture/);
+  assert.match(text, /frontend owns presentation/);
+  assert.match(text, /backend owns trusted execution/);
+
+  const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+  assert.ok(pkg.files.includes('skills'), 'root npm package must include portable skills');
+});

package/test/knowledge-context-pack.test.mjs

@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createContextPack } from '../src/knowledge/context-pack.js';
+
+test('knowledge ContextPack includes a measurable selection receipt', () => {
+  const pack = createContextPack({
+    queryId: 'q1',
+    query: { text: 'where is auth?', top_k: 2, token_budget: 2000 },
+    hits: [{ ref: 'file:a', content: 'abcd' }, { ref: 'file:b', content: '12345678' }],
+    diagnostics: { sources_considered: 7, sources_deferred: 5 },
+  });
+  assert.deepEqual(pack.receipt, {
+    chars: 12,
+    estimated_tokens: 3,
+    sources_considered: 7,
+    sources_included: 2,
+    sources_deferred: 5,
+  });
+});

package/test/knowledge.test.mjs

@@ -152,5 +152,5 @@ test('recovered KnowledgeClient contracts remain usable with injected transports
   const client = new KnowledgeClient({ transport: { async request(op, payload) { operations.push([op, payload]); return { query_id: 'test', hits: [] }; } } });
   await client.retrieve({ text: 'find parser', workspace_id: 'customer' });
   await client.index('repository');
-  assert.equal(operations[0][1].top_k, 12); assert.equal(operations[1][0], 'knowledge.index');
+  assert.equal(operations[0][1].top_k, 8); assert.equal(operations[0][1].token_budget, 6000); assert.equal(operations[0][1].result_policy.max_items, 8); assert.equal(operations[1][0], 'knowledge.index');
 });

package/test/merkle-persistence.test.mjs

@@ -0,0 +1,91 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  MERKLE_SNAPSHOT_SCHEMA_SQL,
+  MERKLE_SNAPSHOT_STORAGE_PREFIX,
+  MERKLE_SNAPSHOT_TABLE,
+  MERKLE_WEBSITE_ASSETS_BINDING,
+  buildMerklePersistencePlan,
+  merklePersistenceUpsertSql,
+  merkleSnapshotStorageKey,
+  resolveWranglerMerklePersistence,
+} from '../src/lib/merkle/index.js';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+test('portable Merkle persistence names one table, prefix, and logical asset role', () => {
+  assert.equal(MERKLE_SNAPSHOT_TABLE, 'agentsam_fs_merkle_snapshots');
+  assert.equal(MERKLE_SNAPSHOT_STORAGE_PREFIX, 'agentsam_fs_merkle_snapshots');
+  assert.equal(MERKLE_WEBSITE_ASSETS_BINDING, 'WEBSITE_ASSETS');
+  assert.match(MERKLE_SNAPSHOT_SCHEMA_SQL, /metadata_root TEXT/);
+  assert.match(MERKLE_SNAPSHOT_SCHEMA_SQL, /classifier_format TEXT/);
+  assert.match(MERKLE_SNAPSHOT_SCHEMA_SQL, /storage_bucket TEXT/);
+});
+
+test('snapshot storage keys stay beneath the canonical prefix and encode repo identity', () => {
+  const key = merkleSnapshotStorageKey({
+    ownerUserId: 'au_example',
+    repoId: 'github:owner/repo',
+    snapshotId: 'mrs_example',
+  });
+  assert.equal(key, 'agentsam_fs_merkle_snapshots/au_example/github%3Aowner%2Frepo/mrs_example.json');
+  const escaped = merkleSnapshotStorageKey({ ownerUserId: '../oops', repoId: 'repo', snapshotId: 'snap' });
+  assert.ok(!escaped.includes('/../'));
+  assert.ok(escaped.includes('..%2Foops'));
+});
+
+test('Wrangler persistence resolves logical WEBSITE_ASSETS and DB bindings', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-wrangler-'));
+  const config = path.join(dir, 'wrangler.toml');
+  fs.writeFileSync(config, `name = "fixture"\n\n[[d1_databases]]\nbinding = "DB"\ndatabase_name = "fixture-db"\ndatabase_id = "db-id"\n\n[[r2_buckets]]\nbinding = "WEBSITE_ASSETS"\nbucket_name = "fixture-assets"\n`);
+  try {
+    const resolved = resolveWranglerMerklePersistence({ configPath: config });
+    assert.equal(resolved.r2_binding, 'WEBSITE_ASSETS');
+    assert.equal(resolved.storage_bucket, 'fixture-assets');
+    assert.equal(resolved.d1_binding, 'DB');
+    assert.equal(resolved.database_name, 'fixture-db');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('persistence plan keeps content, policy, and metadata identities separate', () => {
+  const snapshot = {
+    format: 'agentsam-merkle', version: 1, algorithm: 'sha256',
+    rootHash: `sha256:${'1'.repeat(64)}`,
+    policyHash: `sha256:${'2'.repeat(64)}`,
+    entries: [{ path: 'src/a.js', type: 'file', size: 10, hash: `sha256:${'4'.repeat(64)}` }],
+    stats: { files: 1, directories: 1, symlinks: 0, bytes: 10 },
+    semantic: {
+      format: 'agentsam-filemeta', version: 1, rootHash: `sha256:${'3'.repeat(64)}`,
+      classifier: { format: 'agentsam-filemeta', version: 1, source: 'path+package+ast' }, entries: [],
+    },
+  };
+  const plan = buildMerklePersistencePlan({
+    snapshot, root: process.cwd(), ownerUserId: 'au_test', repoId: 'github:owner/repo', source: 'github',
+    captureKind: 'agent', connectionId: 'conn_test',
+    wrangler: { storage_bucket: 'customer-assets', r2_binding: 'WEBSITE_ASSETS', database_name: 'customer-db', d1_binding: 'DB' },
+  });
+  assert.equal(plan.row.root_hash, snapshot.rootHash);
+  assert.equal(plan.row.policy_hash, snapshot.policyHash);
+  assert.equal(plan.row.metadata_root, snapshot.semantic.rootHash);
+  assert.equal(plan.row.classifier_format, 'agentsam-filemeta');
+  assert.equal(plan.row.storage_bucket, 'customer-assets');
+  assert.match(plan.row.storage_key, /^agentsam_fs_merkle_snapshots\//);
+  const sql = merklePersistenceUpsertSql(plan.row);
+  assert.match(sql, /INSERT INTO agentsam_fs_merkle_snapshots/);
+  assert.match(sql, /metadata_root/);
+  assert.match(sql, /classifier_source/);
+});
+
+test('non-deploy persistence requires execution provenance', () => {
+  const snapshot = {
+    format: 'agentsam-merkle', version: 1, algorithm: 'sha256', rootHash: `sha256:${'1'.repeat(64)}`,
+    policyHash: `sha256:${'2'.repeat(64)}`, entries: [], stats: { files: 0, directories: 0, symlinks: 0, bytes: 0 },
+  };
+  assert.throws(() => buildMerklePersistencePlan({
+    snapshot, root: process.cwd(), ownerUserId: 'au_test', repoId: 'github:owner/repo', captureKind: 'agent',
+    wrangler: { storage_bucket: 'customer-assets', r2_binding: 'WEBSITE_ASSETS', database_name: 'customer-db', d1_binding: 'DB' },
+  }), /execution_provenance_required/);
+});

package/test/merkle.test.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { buildMerkleTree, saveSnapshot, readSnapshot, validateSnapshot, diffTrees } from '../src/lib/merkle/index.js';
+import { buildMerkleTree, saveSnapshot, readSnapshot, validateSnapshot, diffTrees, metadataRoot } from '../src/lib/merkle/index.js';
 
 const cli = fileURLToPath(new URL('../src/cli.js', import.meta.url));
 async function fixture(t) {
@@ -60,6 +60,55 @@ test('default ignores, explicit dist inclusion, literal exclusions, and empty-di
   assert.equal(excluded.stats.files, 0);
 });
 
+test('semantic metadata adds package/system/category/mode and AST evidence without changing the content root', async (t) => {
+  const root = await fixture(t);
+  await write(root, 'package.json', JSON.stringify({ name: 'fixture-root', version: '1.0.0' }));
+  await write(root, 'packages/identity/package.json', JSON.stringify({
+    name: '@example/identity',
+    version: '1.0.0',
+    agentsam: { system: 'identity', kind: 'library', tags: ['authentication'] },
+  }));
+  await write(root, 'packages/identity/src/core/accounts.js', "import { helper } from '../shared/helper.js';\nexport function resolveAccount() { return helper; }\n");
+  await write(root, 'packages/identity/src/shared/helper.js', 'export const helper = 1;\n');
+  await fs.chmod(path.join(root, 'packages/identity/src/core/accounts.js'), 0o644);
+
+  const plain = await buildMerkleTree(root);
+  const enriched = await buildMerkleTree(root, { semantic: true });
+  assert.equal(enriched.rootHash, plain.rootHash);
+  assert.match(enriched.policyHash, /^sha256:[a-f0-9]{64}$/);
+  assert.equal(enriched.policyHash, plain.policyHash);
+  assert.equal(enriched.version, 1);
+  assert.match(enriched.semantic.rootHash, /^sha256:[a-f0-9]{64}$/);
+  assert.equal(enriched.semantic.classifier.format, 'agentsam-filemeta');
+  assert.equal(enriched.semantic.classifier.version, 1);
+
+  const accounts = enriched.semantic.entries.find((entry) => entry.path === 'packages/identity/src/core/accounts.js');
+  assert.equal(accounts.mode, 420);
+  assert.equal(accounts.package, '@example/identity');
+  assert.equal(accounts.package_root, 'packages/identity');
+  assert.equal(accounts.package_kind, 'library');
+  assert.equal(accounts.system, 'identity');
+  assert.equal(accounts.category, 'accounts');
+  assert.equal(accounts.layer, 'core');
+  assert.equal(accounts.kind, 'source');
+  assert.equal(accounts.language, 'javascript');
+  assert.equal(accounts.role, 'business-logic');
+  assert.deepEqual(accounts.tags, ['authentication']);
+  assert.deepEqual(accounts.symbols, ['resolveAccount']);
+  assert.deepEqual(accounts.imports, ['../shared/helper.js']);
+  assert.equal(accounts.ast.indexed, true);
+
+  const changedClassifier = { ...enriched.semantic.classifier, version: 2 };
+  assert.notEqual(metadataRoot(enriched.semantic.entries, changedClassifier), enriched.semantic.rootHash);
+
+  await fs.chmod(path.join(root, 'packages/identity/src/core/accounts.js'), 0o755);
+  const permissionOnly = await buildMerkleTree(root, { semantic: true });
+  const permissionRecord = permissionOnly.semantic.entries.find((entry) => entry.path === 'packages/identity/src/core/accounts.js');
+  assert.equal(permissionOnly.rootHash, plain.rootHash);
+  assert.equal(permissionRecord.mode, 493);
+  assert.notEqual(permissionOnly.semantic.rootHash, enriched.semantic.rootHash);
+});
+
 test('symlinks hash their literal target, including cycles, without reading the target', { skip: process.platform === 'win32' }, async (t) => {
   const root = await fixture(t), outside = await fixture(t);
   await write(outside, 'secret.txt', 'not read');
@@ -78,10 +127,14 @@ test('default and custom snapshots exclude themselves and preserve baseline unti
   const root = await fixture(t);
   await write(root, 'file.txt', 'baseline');
   const initial = await buildMerkleTree(root);
-  const { snapshot, output } = await saveSnapshot(root);
+  const { snapshot, output } = await saveSnapshot(root, { semantic: true });
   assert.equal(initial.rootHash, snapshot.rootHash);
+  assert.match(snapshot.semantic.rootHash, /^sha256:[a-f0-9]{64}$/);
   assert.ok(diffTrees(snapshot, await buildMerkleTree(root, { policy: snapshot.policy })).equal);
-  assert.equal((await readSnapshot(output)).rootHash, snapshot.rootHash);
+  const reloaded = await readSnapshot(output);
+  assert.equal(reloaded.rootHash, snapshot.rootHash);
+  assert.equal(reloaded.policyHash, snapshot.policyHash);
+  assert.equal(reloaded.semantic.rootHash, snapshot.semantic.rootHash);
   await assert.rejects(saveSnapshot(root), /exists/);
   await write(root, 'file.txt', 'edited');
   assert.equal(diffTrees(snapshot, await buildMerkleTree(root, { policy: snapshot.policy })).stats.modified, 1);
@@ -142,3 +195,24 @@ test('CLI snapshot/verify/diff supports JSON, moved roots, and distinct mismatch
   assert.equal(piped.status, 0, piped.stderr);
   assert.ok(!piped.stdout.includes('\x1b'));
 });
+
+test('semantic index records execution domains, environment access, and resolved local imports as Merkle-bound evidence', async (t) => {
+  const root = await fixture(t);
+  await write(root, 'package.json', JSON.stringify({ name: 'boundary-fixture', version: '1.0.0' }));
+  await write(root, 'frontend/client.ts', "import { contract } from '../shared/contract.ts';\nexport const api = import.meta.env.VITE_API_URL + contract;\n");
+  await write(root, 'shared/contract.ts', "export const contract = 'v1';\n");
+  await write(root, 'backend/private.ts', "export const key = process.env.API_KEY;\n");
+  const tree = await buildMerkleTree(root, { semantic: true });
+  const client = tree.semantic.entries.find((entry) => entry.path === 'frontend/client.ts');
+  const shared = tree.semantic.entries.find((entry) => entry.path === 'shared/contract.ts');
+  const backend = tree.semantic.entries.find((entry) => entry.path === 'backend/private.ts');
+  assert.equal(client.execution_domain, 'browser');
+  assert.equal(shared.execution_domain, 'shared');
+  assert.equal(backend.execution_domain, 'server');
+  assert.deepEqual(client.env_accesses, [{ source: 'import.meta.env', name: 'VITE_API_URL' }]);
+  assert.deepEqual(client.resolved_imports, [{ specifier: '../shared/contract.ts', target: 'shared/contract.ts' }]);
+  assert.deepEqual(backend.env_accesses, [{ source: 'process.env', name: 'API_KEY' }]);
+  assert.equal(tree.semantic.stats.by_execution_domain.browser, 1);
+  assert.equal(tree.semantic.stats.by_execution_domain.server, 1);
+  assert.equal(tree.semantic.classifier.trust_boundary, 'execution-domain-v1');
+});

package/test/models.test.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { collectModelsStatus, renderModelsStatus } from '../src/commands/models.js';
+
+function response(body, status = 200) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    async json() { return body; },
+  };
+}
+
+test('model inventory reports configured API providers without exposing credentials', async () => {
+  const status = await collectModelsStatus({
+    env: {
+      OPENAI_API_KEY: 'secret-openai',
+      GEMINI_API_KEY: '',
+      XAI_API_KEY: 'secret-xai',
+      OLLAMA_BASE_URL: 'http://127.0.0.1:11434',
+      OLLAMA_MODEL: 'qwen:test',
+      OLLAMA_EMBED_MODEL: 'embed:test',
+    },
+    fetchImpl: async () => response({ models: [{ name: 'qwen:test' }, { name: 'embed:test' }] }),
+  });
+
+  assert.equal(status.providers.find((row) => row.id === 'openai').configured, true);
+  assert.equal(status.providers.find((row) => row.id === 'gemini').configured, false);
+  assert.equal(status.providers.find((row) => row.id === 'grok').configured, true);
+  assert.equal(status.local.online, true);
+  assert.deepEqual(status.local.models.map((row) => row.name), ['qwen:test', 'embed:test']);
+
+  const rendered = renderModelsStatus(status);
+  assert.match(rendered, /OpenAI/);
+  assert.match(rendered, /qwen:test/);
+  assert.doesNotMatch(rendered, /secret-openai|secret-xai/);
+});

package/test/ollama.test.mjs

@@ -0,0 +1,94 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import {
+  OLLAMA_DEFAULTS,
+  ollamaInstallPlan,
+  parseOllamaArgs,
+  probeOllama,
+  resolveOllamaConfig,
+  updateProjectOllamaConfig,
+  upsertOllamaEnvFile,
+} from '../src/commands/ollama.js';
+import { createProjectManifest } from '../src/lib/project-config.js';
+
+test('Ollama defaults are local-only and match the SDK local-dev contract', () => {
+  assert.deepEqual(OLLAMA_DEFAULTS, {
+    baseUrl: 'http://127.0.0.1:11434',
+    model: 'qwen2.5-coder',
+    embedModel: 'mxbai-embed-large',
+  });
+  assert.deepEqual(resolveOllamaConfig({}, {}), OLLAMA_DEFAULTS);
+});
+
+test('Ollama setup args require explicit install/pull/start opt-ins', () => {
+  assert.deepEqual(parseOllamaArgs(['setup']), {
+    command: 'setup',
+    cwd: process.cwd(),
+    envFile: '',
+    baseUrl: '',
+    model: '',
+    embedModel: '',
+    install: false,
+    start: false,
+    pull: false,
+    json: false,
+  });
+  const opted = parseOllamaArgs(['setup', '--install', '--start', '--pull', '--json']);
+  assert.equal(opted.install, true);
+  assert.equal(opted.start, true);
+  assert.equal(opted.pull, true);
+  assert.equal(opted.json, true);
+});
+
+test('setup env writer updates only canonical OLLAMA keys and preserves other config', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-ollama-'));
+  const envFile = path.join(root, '.env');
+  fs.writeFileSync(envFile, 'EXISTING=value\nOLLAMA_MODEL=old\n');
+  upsertOllamaEnvFile(envFile, OLLAMA_DEFAULTS);
+  const text = fs.readFileSync(envFile, 'utf8');
+  assert.match(text, /^EXISTING=value$/m);
+  assert.match(text, /^OLLAMA_BASE_URL=http:\/\/127\.0\.0\.1:11434$/m);
+  assert.match(text, /^OLLAMA_MODEL=qwen2\.5-coder$/m);
+  assert.match(text, /^OLLAMA_EMBED_MODEL=mxbai-embed-large$/m);
+  assert.equal((text.match(/^OLLAMA_MODEL=/gm) || []).length, 1);
+});
+
+test('project config records only portable Ollama capability metadata', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-ollama-config-'));
+  fs.mkdirSync(path.join(root, '.agentsam'));
+  fs.writeFileSync(path.join(root, '.agentsam', 'config.json'), `${JSON.stringify(createProjectManifest({ projectName: 'demo', repositoryId: 'local:demo' }), null, 2)}\n`);
+  const filename = updateProjectOllamaConfig(root, OLLAMA_DEFAULTS);
+  const config = JSON.parse(fs.readFileSync(filename, 'utf8'));
+  assert.equal(config.models.local.provider, 'ollama');
+  assert.equal(config.models.local.base_url_env, 'OLLAMA_BASE_URL');
+  assert.equal(config.models.local.model_env, 'OLLAMA_MODEL');
+  assert.equal(config.models.local.embed_model_env, 'OLLAMA_EMBED_MODEL');
+  assert.equal(JSON.stringify(config).includes('127.0.0.1'), false);
+  assert.equal(JSON.stringify(config).includes('qwen2.5-coder'), false);
+  assert.equal(JSON.stringify(config).includes('token'), false);
+});
+
+test('status probe recognizes configured chat and embedding models', async () => {
+  const fakeFetch = async () => new Response(JSON.stringify({ models: [
+    { name: 'qwen2.5-coder:latest' },
+    { name: 'mxbai-embed-large:latest' },
+  ] }), { status: 200, headers: { 'content-type': 'application/json' } });
+  const status = await probeOllama(OLLAMA_DEFAULTS, fakeFetch);
+  assert.equal(status.online, true);
+  assert.equal(status.chat_ready, true);
+  assert.equal(status.embed_ready, true);
+});
+
+test('automatic install plans use local package managers, never a remote shell script', () => {
+  assert.deepEqual(ollamaInstallPlan('darwin', { brew: true }), {
+    command: 'brew', args: ['install', 'ollama'], manager: 'homebrew',
+  });
+  assert.equal(ollamaInstallPlan('linux', { brew: false }), null);
+  assert.equal(ollamaInstallPlan('darwin', { brew: false }), null);
+  const win = ollamaInstallPlan('win32', { winget: true });
+  assert.equal(win.command, 'winget');
+  assert.equal(win.args.includes('Ollama.Ollama'), true);
+});

package/test/open-url.test.mjs

@@ -0,0 +1,64 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { PassThrough } from 'node:stream';
+import { browserCommand, promptToOpenUrl } from '../src/lib/open-url.js';
+
+test('browserCommand uses argv-safe platform launchers', () => {
+  assert.deepEqual(browserCommand('https://inneranimalmedia.com/auth', 'darwin'), {
+    command: 'open',
+    args: ['https://inneranimalmedia.com/auth'],
+  });
+  assert.deepEqual(browserCommand('https://inneranimalmedia.com/auth', 'linux'), {
+    command: 'xdg-open',
+    args: ['https://inneranimalmedia.com/auth'],
+  });
+  assert.deepEqual(browserCommand('https://inneranimalmedia.com/auth', 'win32'), {
+    command: 'cmd',
+    args: ['/c', 'start', '', 'https://inneranimalmedia.com/auth'],
+  });
+});
+
+test('browserCommand rejects non-http protocols', () => {
+  assert.throws(() => browserCommand('file:///tmp/example', 'darwin'), /Unsupported URL protocol/);
+  assert.throws(() => browserCommand('javascript:alert(1)', 'darwin'), /Unsupported URL protocol/);
+});
+
+test('promptToOpenUrl stays non-interactive when stdin is not a TTY', async () => {
+  const input = new PassThrough();
+  const output = new PassThrough();
+  let text = '';
+  output.on('data', chunk => { text += chunk.toString(); });
+  let opened = false;
+  const result = await promptToOpenUrl('https://www.blender.org/download/', {
+    input,
+    output,
+    openImpl: () => { opened = true; },
+  });
+  assert.equal(result.interactive, false);
+  assert.equal(result.opened, false);
+  assert.equal(opened, false);
+  assert.match(text, /https:\/\/www\.blender\.org\/download\//);
+  assert.match(text, /Open the URL above in a browser/);
+});
+
+test('promptToOpenUrl waits for Enter before opening in a TTY', async () => {
+  const input = new PassThrough();
+  const output = new PassThrough();
+  input.isTTY = true;
+  output.isTTY = true;
+  let text = '';
+  output.on('data', chunk => { text += chunk.toString(); });
+  let openedUrl = null;
+  const pending = promptToOpenUrl('https://inneranimalmedia.com/dashboard', {
+    input,
+    output,
+    openImpl: url => { openedUrl = url; },
+  });
+  input.write('\n');
+  const result = await pending;
+  assert.equal(result.interactive, true);
+  assert.equal(result.opened, true);
+  assert.equal(openedUrl, 'https://inneranimalmedia.com/dashboard');
+  assert.match(text, /Press ENTER to open/);
+  assert.match(text, /Browser opened/);
+});

package/test/project-config.test.mjs

@@ -0,0 +1,81 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import test from 'node:test';
+import {
+  createProjectManifest,
+  getDefaultProfile,
+  getDefaultRuntime,
+  getDeployTarget,
+  getLocalDatabasePath,
+  getProjectName,
+  getProjectPreset,
+  getProjectRulesPath,
+  getRepositoryId,
+  portableRepositoryIdFromGit,
+} from '../src/lib/project-config.js';
+
+function git(cwd, args) {
+  return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+}
+
+test('portable project manifest is small and excludes runtime/account history', () => {
+  const config = createProjectManifest({
+    projectName: 'demo',
+    preset: 'cms',
+    profile: 'cms',
+    runTarget: 'local',
+    sdkVersion: '2.5.0',
+    repositoryId: 'github:owner/demo',
+  });
+
+  assert.equal(config.schema_version, 2);
+  assert.deepEqual(config.project, { name: 'demo' });
+  assert.equal(config.repository.id, 'github:owner/demo');
+  assert.equal(config.product.preset, 'cms');
+  assert.equal(config.defaults.profile, 'cms');
+  assert.equal(config.defaults.runtime, 'local');
+  assert.equal(config.defaults.model, 'auto');
+  assert.deepEqual(config.merkle, { enabled: true, semantic: true, persistence: 'auto' });
+  assert.equal(config.rules.file, '.agentsamrules');
+  assert.equal(getProjectRulesPath(config), '.agentsamrules');
+  assert.equal(config.knowledge.config, '.agentsam/knowledge.json');
+  assert.equal(config.local.database, '.agentsam/data/agentsam.sqlite');
+
+  const forbidden = [
+    'account_id', 'user_id', 'tenant_id', 'workspace_id', 'current_run_id', 'plan_id', 'task_id',
+    'connection_id', 'runtime_lease_id', 'latest_merkle_root', 'root_hash', 'model_history',
+    'subagent_runs', 'pty_port', 'dev_port', 'deployed_at', 'cloudflare',
+  ];
+  const serialized = JSON.stringify(config);
+  for (const field of forbidden) assert.equal(serialized.includes(`"${field}"`), false, field);
+});
+
+test('project config accessors keep legacy flat projects readable during migration', () => {
+  const legacy = {
+    project: 'legacy-demo',
+    lane: 'data',
+    agent: 'data',
+    run_target: 'local',
+    deploy_target: 'gcp',
+    db_path: '.agentsam/old.sqlite',
+  };
+  assert.equal(getProjectName(legacy), 'legacy-demo');
+  assert.equal(getProjectPreset(legacy), 'data');
+  assert.equal(getDefaultProfile(legacy), 'data');
+  assert.equal(getDefaultRuntime(legacy), 'local');
+  assert.equal(getDeployTarget(legacy), 'gcp');
+  assert.equal(getLocalDatabasePath(legacy), '.agentsam/old.sqlite');
+  assert.equal(getRepositoryId(legacy), null);
+  assert.equal(getProjectRulesPath(legacy), '.agentsamrules');
+});
+
+test('GitHub remote becomes portable repository identity when adopting an existing repo', t => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-project-config-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  git(root, ['init', '-q']);
+  git(root, ['remote', 'add', 'origin', 'git@github.com:ExampleOrg/DemoRepo.git']);
+  assert.equal(portableRepositoryIdFromGit(root), 'github:exampleorg/demorepo');
+});