@inneranimalmedia/agentsam-sdk 2.4.0 → 2.5.0

package/test/project-rules.test.mjs

@@ -0,0 +1,44 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { defaultProjectRules, findProjectRules, loadProjectRules } from '../src/lib/project-rules.js';
+
+test('.agentsamrules behaves like a committed repo-level instruction file', t => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-rules-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const nested = path.join(root, 'src', 'nested');
+  fs.mkdirSync(nested, { recursive: true });
+  const content = defaultProjectRules('demo');
+  fs.writeFileSync(path.join(root, '.agentsamrules'), content);
+
+  assert.equal(findProjectRules(nested), path.join(root, '.agentsamrules'));
+  const loaded = loadProjectRules(nested);
+  assert.equal(loaded.found, true);
+  assert.equal(loaded.content, content);
+  assert.match(loaded.hash, /^sha256:[a-f0-9]{64}$/);
+  assert.equal(loaded.truncated, false);
+});
+
+test('project rules are deterministically bounded before entering context', t => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-rules-bound-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  fs.writeFileSync(path.join(root, '.agentsamrules'), 'x'.repeat(200));
+  const loaded = loadProjectRules(root, { maxChars: 40 });
+  assert.equal(loaded.chars, 40);
+  assert.equal(loaded.source_chars, 200);
+  assert.equal(loaded.truncated, true);
+});
+
+
+test('project rules discovery never leaks across the repository boundary', t => {
+  const parent = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-rules-boundary-'));
+  t.after(() => fs.rmSync(parent, { recursive: true, force: true }));
+  fs.writeFileSync(path.join(parent, '.agentsamrules'), 'parent rules\n');
+  const repo = path.join(parent, 'repo');
+  const nested = path.join(repo, 'src');
+  fs.mkdirSync(path.join(repo, '.git'), { recursive: true });
+  fs.mkdirSync(nested, { recursive: true });
+  assert.equal(findProjectRules(nested), null);
+});

package/test/release-hygiene.test.mjs

@@ -0,0 +1,34 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+
+const root = path.resolve(import.meta.dirname, '..');
+const read = (rel) => fs.readFileSync(path.join(root, rel), 'utf8');
+
+test('2.5 release metadata and public terminal vocabulary are aligned', () => {
+  const pkg = JSON.parse(read('package.json'));
+  const manifest = read('agentsam.yaml');
+  const readme = read('README.md');
+
+  assert.equal(pkg.version, '2.5.0');
+  assert.match(manifest, /target_version: "2\.5\.0"/);
+  assert.match(manifest, /state: release_candidate/);
+  assert.match(manifest, /current_latest: "2\.4\.1"/);
+  assert.doesNotMatch(manifest, /^\s*- tui\s*$/m);
+  assert.doesNotMatch(readme, /agentsam tui|CLI\/TUI/);
+});
+
+test('dead branded splash paths are gone and UI preview stays dev-only', () => {
+  for (const rel of ['src/ui/splash.js', 'src/ui/splash-xterm.js', 'src/commands/tui.js']) {
+    assert.equal(fs.existsSync(path.join(root, rel)), false, `${rel} should not ship`);
+  }
+  for (const rel of ['scripts/internal/ui-preview-runner.mjs', 'scripts/internal/ansi-ui-preview.mjs']) {
+    assert.equal(fs.existsSync(path.join(root, rel)), true, `${rel} should remain available to contributors`);
+  }
+  assert.equal(fs.existsSync(path.join(root, 'src/ui/runtime-activity.js')), true, 'automatic runtime activity must ship with the product CLI');
+
+  const pkg = JSON.parse(read('package.json'));
+  assert.ok(pkg.files.includes('skills'));
+  assert.equal(pkg.files.includes('scripts'), false, 'internal preview scripts must not be published');
+});

package/test/repository-snapshot-view.test.mjs

@@ -0,0 +1,112 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  buildRepositorySnapshotFacets,
+  projectRepositorySnapshot,
+  repositoryFileMatches,
+} from '../src/capabilities/repository-snapshot-view.js';
+
+function snapshot() {
+  return {
+    schema_version: 1,
+    capability: 'repository.snapshot',
+    snapshot_id: 'rsnap_0123456789abcdef01234567',
+    created_at: '2026-09-11T00:00:00.000Z',
+    content_hash: `sha256:${'1'.repeat(64)}`,
+    repository: { full_name: 'SamPrimeaux/agentsam-sdk', branch: 'main', revision_sha: 'abc123', dirty: false },
+    tree: {
+      merkle_root: `sha256:${'2'.repeat(64)}`,
+      metadata_root: `sha256:${'3'.repeat(64)}`,
+      manifest: { format: 'agentsam-merkle', version: 1, hash_algorithm: 'sha256', policy_hash: `sha256:${'4'.repeat(64)}` },
+      classifier: { format: 'agentsam-filemeta', version: 1, source: 'path+package+ast' },
+      stats: { files: 4, directories: 3, symlinks: 0, bytes: 1000 },
+      semantic_stats: { entries: 4, files: 4, packages: 2, ast_indexed: 4 },
+      paths: ['packages/identity/src/core/accounts.js', 'packages/identity/src/oauth/login.js', 'apps/cms/src/editor.tsx', 'apps/cms/src/assets.ts'],
+      files: [
+        {
+          path: 'packages/identity/src/core/accounts.js', type: 'file', size: 213, mode: 420, hash: `sha256:${'a'.repeat(64)}`,
+          package: '@inneranimalmedia/agentsam-sdk-identity', package_root: 'packages/identity', system: 'identity',
+          category: 'accounts', layer: 'core', kind: 'source', language: 'javascript', role: 'business-logic', execution_domain: 'unknown',
+          tags: ['account-scoped', 'authentication'], symbols: ['accountLinkingNotConfigured'], imports: [],
+        },
+        {
+          path: 'packages/identity/src/oauth/login.js', type: 'file', size: 300, mode: 420, hash: `sha256:${'b'.repeat(64)}`,
+          package: '@inneranimalmedia/agentsam-sdk-identity', package_root: 'packages/identity', system: 'identity',
+          category: 'login', layer: 'oauth', kind: 'source', language: 'javascript', role: 'business-logic', execution_domain: 'unknown',
+          tags: ['authentication'], symbols: ['login'], imports: ['./accounts.js'],
+        },
+        {
+          path: 'apps/cms/src/editor.tsx', type: 'file', size: 250, mode: 420, hash: `sha256:${'c'.repeat(64)}`,
+          package: '@inneranimalmedia/cms', package_root: 'apps/cms', system: 'cms-frontend', category: 'editor', layer: 'ui',
+          kind: 'source', language: 'typescript', role: 'ui', execution_domain: 'browser', tags: ['cms'], symbols: ['CmsEditor'], imports: ['react'],
+        },
+        {
+          path: 'apps/cms/src/assets.ts', type: 'file', size: 237, mode: 420, hash: `sha256:${'d'.repeat(64)}`,
+          package: '@inneranimalmedia/cms', package_root: 'apps/cms', system: 'cms-frontend', category: 'assets', layer: 'data',
+          kind: 'source', language: 'typescript', role: 'business-logic', execution_domain: 'browser', tags: ['cms', 'assets'], symbols: ['loadAsset'], imports: [],
+        },
+      ],
+    },
+    intelligence: { summary: { file_count: 4 } },
+    packages: [], knowledge: { configured: false },
+    analysis: {
+      trust_boundary: {
+        schema_version: 1, analyzer: 'agentsam-execution-boundary', metadata_root: `sha256:${'3'.repeat(64)}`,
+        complete: true, status: 'action-required', ok: false, browser_roots: 2, browser_reachable_files: 2, ast_files: 4,
+        findings: [{ kind: 'browser-server-import', severity: 'high', source: 'apps/cms/src/editor.tsx', target: 'server/secrets.ts', repair: { action: 'move-server-call-behind-api-boundary' } }],
+      },
+    },
+    deploy: null,
+  };
+}
+
+test('repository snapshot index is bounded and preserves the three canonical identities', () => {
+  const full = snapshot();
+  const view = projectRepositorySnapshot(full, { view: 'index' });
+  assert.equal(view.snapshot_id, full.snapshot_id);
+  assert.equal(view.content_hash, full.content_hash);
+  assert.equal(view.tree.merkle_root, full.tree.merkle_root);
+  assert.equal(view.tree.metadata_root, full.tree.metadata_root);
+  assert.equal(view.tree.manifest.policy_hash, full.tree.manifest.policy_hash);
+  assert.equal(view.files, undefined);
+  assert.equal(view.projection.matched, 4);
+  assert.match(view.projection.projection_hash, /^sha256:[a-f0-9]{64}$/);
+  assert.equal(view.tree.paths, undefined);
+  assert.equal(view.tree.files, undefined);
+  assert.equal(view.analysis.trust_boundary.status, 'action-required');
+  assert.equal(view.analysis.trust_boundary.finding_count, 1);
+  assert.equal(view.analysis.trust_boundary.findings[0].repair_action, 'move-server-call-behind-api-boundary');
+});
+
+test('repository snapshot files view filters semantics before bounding output', () => {
+  const full = snapshot();
+  const view = projectRepositorySnapshot(full, {
+    view: 'files',
+    filters: { system: ['identity'], tag: ['authentication'], category: ['accounts'], execution_domain: ['unknown'] },
+    limit: 1,
+  });
+  assert.equal(view.projection.matched, 1);
+  assert.equal(view.projection.returned, 1);
+  assert.equal(view.projection.truncated, false);
+  assert.deepEqual(view.files.map((entry) => entry.path), ['packages/identity/src/core/accounts.js']);
+  assert.equal(view.files[0].hash, undefined);
+  assert.equal(view.files[0].mode, undefined);
+});
+
+test('path globs, AST selectors, and facet counts are deterministic', () => {
+  const full = snapshot();
+  const files = full.tree.files;
+  assert.equal(repositoryFileMatches(files[2], { path: ['apps/cms/**'], symbol: ['CmsEditor'] }), true);
+  assert.equal(repositoryFileMatches(files[2], { import: ['react'], language: ['javascript'] }), false);
+  const facets = buildRepositorySnapshotFacets(files);
+  assert.deepEqual(facets.systems.slice(0, 2), [
+    { value: 'cms-frontend', count: 2 },
+    { value: 'identity', count: 2 },
+  ]);
+  assert.deepEqual(facets.tags.find((row) => row.value === 'authentication'), { value: 'authentication', count: 2 });
+  assert.deepEqual(facets.execution_domains, [
+    { value: 'browser', count: 2 },
+    { value: 'unknown', count: 2 },
+  ]);
+  assert.equal(repositoryFileMatches(files[2], { execution_domain: ['browser'] }), true);
+});

package/test/runtime-activity.test.mjs

@@ -0,0 +1,98 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  canAnimateTerminal,
+  createRuntimeActivity,
+  phaseForRuntimeEvent,
+  renderRuntimeActivityFrame,
+  renderRuntimeActivityPanel,
+  renderRuntimeActivityResult,
+} from '../src/ui/runtime-activity.js';
+import { runLocalAgent } from '../src/commands/shell.js';
+
+test('runtime activity is automatic only in a real interactive terminal', () => {
+  assert.equal(canAnimateTerminal({ stdout: { isTTY: true }, env: { TERM: 'xterm-256color' } }), true);
+  assert.equal(canAnimateTerminal({ stdout: { isTTY: false }, env: { TERM: 'xterm-256color' } }), false);
+  assert.equal(canAnimateTerminal({ stdout: { isTTY: true }, env: { TERM: 'dumb' } }), false);
+  assert.equal(canAnimateTerminal({ stdout: { isTTY: true }, env: { TERM: 'xterm-256color', CI: '1' } }), false);
+});
+
+test('runtime renderer exposes thinking, tool, and context phases without product renderer vocabulary', () => {
+  assert.match(renderRuntimeActivityFrame({ phase: 'thinking', tick: 1, elapsedMs: 1250 }), /Agent Sam/);
+  assert.match(renderRuntimeActivityFrame({ phase: 'thinking', tick: 1, elapsedMs: 1250 }), /thinking/);
+  const panel = renderRuntimeActivityPanel({ phase: 'thinking', tick: 2, elapsedMs: 1250 });
+  assert.match(panel, /Agent Sam/);
+  assert.match(panel, /thinking · working locally/);
+  assert.match(panel, /\(●\)/);
+  assert.equal(panel.split('\n').length, 5);
+  assert.match(renderRuntimeActivityResult({ phase: 'done', elapsedMs: 1250 }), /done/);
+  assert.equal(phaseForRuntimeEvent({ type: 'model.started' }), 'thinking');
+  assert.equal(phaseForRuntimeEvent({ type: 'tool.started', tool: 'git.status' }), 'using git.status');
+  assert.equal(phaseForRuntimeEvent({ type: 'context.compaction.started' }), 'tidying context');
+});
+
+test('runtime activity redraws automatically and restores the cursor', () => {
+  let output = '';
+  let clock = 0;
+  let intervalFn = null;
+  const activity = createRuntimeActivity({
+    write: (text) => { output += text; },
+    interactive: true,
+    now: () => clock,
+    setInterval: (fn) => { intervalFn = fn; return 7; },
+    clearInterval: () => {},
+  });
+
+  activity.start('thinking');
+  clock = 320;
+  intervalFn();
+  activity.update('using repository.snapshot');
+  clock = 840;
+  activity.succeed('done');
+
+  assert.match(output, /thinking/);
+  assert.match(output, /using repository\.snapshot/);
+  assert.match(output, /done/);
+  assert.match(output, /\x1b\[\?25l/);
+  assert.match(output, /\x1b\[\?25h/);
+});
+
+test('/agent starts and completes product activity around the real request', async () => {
+  const phases = [];
+  let output = '';
+  const activity = {
+    start: (phase) => phases.push(`start:${phase}`),
+    succeed: (phase) => phases.push(`success:${phase}`),
+    fail: (phase) => phases.push(`fail:${phase}`),
+  };
+  const fetchImpl = async () => ({
+    ok: true,
+    status: 200,
+    async text() { return JSON.stringify({ ok: true, answer: 'ready' }); },
+  });
+
+  await runLocalAgent('inspect this repo', (text) => { output += text; }, { fetchImpl, activity, interactive: true });
+  assert.deepEqual(phases, ['start:thinking', 'success:done']);
+  assert.match(output, /"answer": "ready"/);
+});
+
+
+test('/agent restores product activity when the response body fails', async () => {
+  const phases = [];
+  const activity = {
+    start: (phase) => phases.push(`start:${phase}`),
+    succeed: (phase) => phases.push(`success:${phase}`),
+    fail: (phase) => phases.push(`fail:${phase}`),
+  };
+  const fetchImpl = async () => ({
+    ok: true,
+    status: 200,
+    async text() { throw new Error('body interrupted'); },
+  });
+
+  await assert.rejects(
+    runLocalAgent('inspect this repo', () => {}, { fetchImpl, activity, interactive: true }),
+    /response could not be read: body interrupted/,
+  );
+  assert.deepEqual(phases, ['start:thinking', 'fail:response error']);
+});

package/test/sdk-worker-contract.test.mjs

@@ -0,0 +1,68 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import test from 'node:test';
+
+const read = (relative) => fs.readFileSync(new URL(`../${relative}`, import.meta.url), 'utf8');
+const exists = (relative) => fs.existsSync(new URL(`../${relative}`, import.meta.url));
+
+const wrangler = read('apps/local-studio/backend/wrangler.jsonc');
+const providers = read('apps/local-studio/shared/agentsam/src/model-providers.ts');
+const runtime = read('apps/local-studio/backend/server/lib/cloudflare-runtime.ts');
+const worker = read('apps/local-studio/backend/worker/index.js');
+
+test('Local Studio backend is the only agentsam-sdk Cloudflare application owner', () => {
+  assert.equal(exists('wrangler.jsonc'), false);
+  assert.equal(exists('worker/index.js'), false);
+  assert.equal(exists('scripts/with-cloudflare-env.sh'), false);
+  assert.ok(exists('apps/local-studio/backend/worker/index.js'));
+  assert.equal(exists('apps/local-studio/backend/wrangler.ui.toml'), false);
+  assert.equal(exists('apps/local-studio/backend/wrangler.workmode.toml'), false);
+  assert.ok(exists('apps/local-studio/backend/wrangler.jsonc'));
+});
+
+test('agentsam-sdk Worker uses the backend Worker entry, custom domain only, and canonical bindings', () => {
+  assert.match(wrangler, /"name"\s*:\s*"agentsam-sdk"/);
+  assert.match(wrangler, /"main"\s*:\s*"worker\/index\.js"/);
+  assert.match(wrangler, /"directory"\s*:\s*"\.\.\/\.output\/public"/);
+  assert.match(wrangler, /"workers_dev"\s*:\s*false/);
+  assert.match(wrangler, /"pattern"\s*:\s*"agentsam\.inneranimalmedia\.com"/);
+  assert.match(wrangler, /"binding"\s*:\s*"DB"/);
+  assert.match(wrangler, /"database_name"\s*:\s*"inneranimalmedia-business"/);
+  assert.match(wrangler, /"binding"\s*:\s*"WEBSITE_ASSETS"/);
+  assert.match(wrangler, /"bucket_name"\s*:\s*"agentsam-os-blueprint-content"/);
+  assert.match(wrangler, /"binding"\s*:\s*"AGENTSAM_WAI"/);
+  assert.match(wrangler, /"binding"\s*:\s*"EXECOS"/);
+  assert.match(wrangler, /"service"\s*:\s*"execos"/);
+  assert.match(wrangler, /"binding"\s*:\s*"PTY_SERVICE"/);
+  assert.match(wrangler, /"service_id"\s*:\s*"019db639-7c70-7071-8ef3-32ec0392a9ff"/);
+  assert.match(wrangler, /"IAM_ORIGIN"\s*:\s*"https:\/\/inneranimalmedia\.com"/);
+  assert.doesNotMatch(wrangler, /AGENTSAM_WORKER_ROLE/);
+  assert.doesNotMatch(wrangler, /"OLLAMA_BASE_URL"\s*:/);
+  assert.doesNotMatch(wrangler, /workers\.dev/);
+});
+
+test('canonical Worker preserves vault routes and delegates app traffic to Nitro', () => {
+  assert.match(worker, /url\.pathname\.startsWith\("\/api\/vault\/"\)/);
+  assert.match(worker, /\/api\/vault\/secrets/);
+  assert.match(worker, /\/api\/vault\/unwrap/);
+  assert.match(worker, /return nitroWorker\.fetch\(request, env, context\)/);
+});
+
+test('model providers include Grok independently from Grok gate authentication', () => {
+  for (const id of ['grok', 'openai', 'gemini', 'workers-ai', 'ollama']) {
+    assert.match(providers, new RegExp(`id: ["']${id}["']`));
+  }
+  assert.match(providers, /credential: "XAI_API_KEY"/);
+  assert.match(providers, /binding: "AGENTSAM_WAI"/);
+  assert.match(providers, /binding: "EXECOS"/);
+});
+
+test('Ollama uses local loopback behind ExecOS with a portable explicit cwd', () => {
+  assert.match(runtime, /baseUrl: "http:\/\/127\.0\.0\.1:11434"/);
+  assert.match(runtime, /target: "local"/);
+  assert.match(runtime, /x-bridge-key/);
+  assert.match(runtime, /return explicit \|\| "\/"/);
+  assert.match(runtime, /JSON\.stringify\(\{ command, target: "local", cwd \}\)/);
+  assert.match(runtime, /public_base_url: false/);
+  assert.doesNotMatch(runtime, /ollama\.inneranimalmedia\.com/);
+});

package/test/security.test.mjs

@@ -181,3 +181,49 @@ test('a missing transitive dependency cannot pass as complete coverage', async t
   assert.equal(report.complete,false);
   assert.ok(report.issues.some(issue=>issue.includes('Missing locked dependency edge')));
 });
+
+test('security scan includes AST/Merkle trust-boundary contradictions and mechanical repair evidence', async t => {
+  const f = fixture(t);
+  fs.mkdirSync(path.join(f.root, 'frontend'), { recursive: true });
+  fs.mkdirSync(path.join(f.root, 'backend'), { recursive: true });
+  fs.writeFileSync(path.join(f.root, 'frontend', 'client.ts'), [
+    "import { secretValue } from '../backend/secrets.ts';",
+    "export const value = secretValue;",
+  ].join('\n'));
+  fs.writeFileSync(path.join(f.root, 'backend', 'secrets.ts'), [
+    "export const secretValue = process.env.API_KEY;",
+  ].join('\n'));
+
+  const report = await scanProjectSecurity({ projectRoot: f.root, fetch: empty });
+  assert.equal(report.complete, true);
+  assert.equal(report.ok, false);
+  assert.equal(report.status, 'action-required');
+  assert.match(report.trust_boundary.merkle_root, /^sha256:/);
+  assert.match(report.trust_boundary.metadata_root, /^sha256:/);
+  const finding = report.trust_boundary.findings.find((item) => item.kind === 'browser-server-import');
+  assert.ok(finding);
+  assert.equal(finding.source, 'frontend/client.ts');
+  assert.equal(finding.target, 'backend/secrets.ts');
+  assert.equal(finding.repair.action, 'move-server-call-behind-api-boundary');
+  assert.equal(reportExitCode(report), 1);
+  const text = formatSecurityReport(report);
+  assert.match(text, /Trust boundary/);
+  assert.match(text, /frontend\/client\.ts/);
+  assert.match(text, /move-server-call-behind-api-boundary/);
+});
+
+test('browser env and server-runtime imports are derived from syntax rather than folder names alone', async t => {
+  const f = fixture(t);
+  fs.mkdirSync(path.join(f.root, 'frontend', 'src'), { recursive: true });
+  fs.writeFileSync(path.join(f.root, 'frontend', 'src', 'client.ts'), [
+    "import fs from 'node:fs';",
+    "export const leaked = import.meta.env.VITE_API_KEY;",
+    "export const privateValue = process.env.INTERNAL_TOKEN;",
+    "export const exists = Boolean(fs);",
+  ].join('\n'));
+  const report = await scanProjectSecurity({ projectRoot: f.root, fetch: empty });
+  const kinds = new Set(report.trust_boundary.findings.map((item) => item.kind));
+  assert.ok(kinds.has('browser-server-runtime-import'));
+  assert.ok(kinds.has('browser-public-secret-name'));
+  assert.ok(kinds.has('browser-private-env-access'));
+});

package/test/shell.test.mjs

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import test from 'node:test';
-import { dispatchShellLine, renderShellCatalog, tokenizeShellLine } from '../src/commands/shell.js';
+import { dispatchShellLine, renderShellCatalog, renderShellPrompt, tokenizeShellLine } from '../src/commands/shell.js';
 
 const repoRoot = path.resolve(new URL('..', import.meta.url).pathname);
 
@@ -14,6 +14,13 @@ test('shell tokenizer preserves Windows paths and quoted arguments', () => {
   assert.deepEqual(tokenizeShellLine('/agent "inspect this repo"'), ['/agent', 'inspect this repo']);
 });
 
+test('interactive prompt derives username and cwd instead of hardcoding Agent Sam identity', () => {
+  const env = { USER: 'alice', HOME: '/Users/alice' };
+  assert.equal(renderShellPrompt('/Users/alice/code/demo', env), 'alice ~/code/demo > ');
+  assert.equal(renderShellPrompt('/Users/alice', env), 'alice ~ > ');
+  assert.equal(renderShellPrompt('/tmp/demo', env), 'alice /tmp/demo > ');
+});
+
 test('shell catalog advertises commands that the REPL owns', () => {
   const catalog = renderShellCatalog();
   assert.match(catalog, /\/help\s+Show Agent Sam commands/);

package/test/skills.test.mjs

@@ -0,0 +1,22 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { getSkill, listSkills, loadSkill } from '../src/skills/index.js';
+
+test('portable skill registry exposes AgentSam Jr Dev by id and alias', () => {
+  const listed = listSkills();
+  assert.ok(listed.some((skill) => skill.id === 'agentsam-jr-dev'));
+
+  assert.equal(getSkill('agentsam_jr_dev')?.id, 'agentsam-jr-dev');
+  assert.equal(getSkill('jr-dev')?.id, 'agentsam-jr-dev');
+});
+
+test('AgentSam Jr Dev loads compact instructions and references on demand', () => {
+  const compact = loadSkill('agentsam-jr-dev');
+  assert.match(compact.instructions, /# AgentSam Jr Dev/);
+  assert.equal('references' in compact, false);
+
+  const full = loadSkill('agentsam_jr_dev', { references: true });
+  assert.equal(full.references.length, 2);
+  assert.match(full.references[0].content, /## HTTP/);
+  assert.match(full.references[1].content, /# Real Application Logic/);
+});

package/test/smoke.mjs

@@ -57,12 +57,12 @@ assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/db'));
 assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/agent'));
 assert.deepEqual(
   listSlashCommands({ lane: 'deploy' }).map(({ cmd }) => cmd),
-  ['/help', '/deploy', '/exit'],
+  ['/help', '/models', '/settings', '/deploy', '/exit'],
   'deploy lane keeps global shell controls and excludes commands from other lanes',
 );
 
 printContextSummary({
-  iam: { ready: true, source: 'sdk-token', detail: 'AGENTSAM_SDK_TOKEN' },
+  iam: { ready: true, source: 'sdk-key', detail: 'AGENTSAM_SDK_KEY' },
   gcp: { source: 'vm-metadata', email: 'execos@project.iam.gserviceaccount.com' },
   gcp_vm: true,
   github: { source: 'gh-cli', account: 'user@example.com' },

package/test/theme-portability.test.mjs

@@ -0,0 +1,14 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { CLOUD, LOCAL, SANDBOX, getLaneThemeByName } from '../src/ui/theme.js';
+
+test('SDK terminal lane metadata is provider and operator neutral', () => {
+  const serialized = JSON.stringify([LOCAL.meta, CLOUD.meta, SANDBOX.meta]);
+  assert.doesNotMatch(serialized, /sam(smac)?|inneranimalmedia|gcp|cloudflare|MY_CONTAINER/i);
+  assert.equal(LOCAL.meta.tunnelHint, 'current machine · real shell');
+  assert.equal(CLOUD.meta.label, 'Remote');
+  assert.equal(SANDBOX.meta.tunnelHint, 'isolated disposable runtime');
+  assert.equal(getLaneThemeByName('remote'), CLOUD);
+  assert.equal(getLaneThemeByName('cloud'), CLOUD);
+});

package/test/tools-search.test.mjs

@@ -0,0 +1,27 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { getToolCatalog } from '../src/lib/tools.js';
+import { searchToolCards } from '../src/tools/index.js';
+import { DEFAULT_RESULT_POLICY } from '../src/context/index.js';
+
+test('every built-in SDK tool inherits a bounded result policy', () => {
+  for (const lane of ['fullstack', 'cms', 'data', 'crm', 'creative']) {
+    for (const tool of getToolCatalog(lane)) assert.deepEqual(tool.result_policy, DEFAULT_RESULT_POLICY);
+  }
+});
+
+test('tools.search returns compact cards rather than full schemas', () => {
+  const catalog = Array.from({ length: 20 }, (_, index) => ({
+    name: index === 13 ? 'code.retrieve' : `tool.${index}`,
+    description: index === 13 ? 'Find symbols, callers, and semantic code matches.' : `Capability ${index}`,
+    category: index === 13 ? 'code' : 'misc',
+    risk: 'read',
+    input_schema: { type: 'object', required: ['query'], properties: { query: { type: 'string' }, giant: { description: 'x'.repeat(5000) } } },
+  }));
+  const result = searchToolCards(catalog, 'code symbols');
+  assert.ok(result.cards.length <= 8);
+  assert.equal(result.cards[0].tool, 'code.retrieve');
+  assert.deepEqual(result.cards[0].required, ['query']);
+  assert.equal('input_schema' in result.cards[0], false);
+  assert.ok(result.receipt.chars < 24_000);
+});