@inneranimalmedia/agentsam-sdk 2.4.1 → 2.5.0

package/test/release-hygiene.test.mjs

@@ -0,0 +1,34 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+
+const root = path.resolve(import.meta.dirname, '..');
+const read = (rel) => fs.readFileSync(path.join(root, rel), 'utf8');
+
+test('2.5 release metadata and public terminal vocabulary are aligned', () => {
+  const pkg = JSON.parse(read('package.json'));
+  const manifest = read('agentsam.yaml');
+  const readme = read('README.md');
+
+  assert.equal(pkg.version, '2.5.0');
+  assert.match(manifest, /target_version: "2\.5\.0"/);
+  assert.match(manifest, /state: release_candidate/);
+  assert.match(manifest, /current_latest: "2\.4\.1"/);
+  assert.doesNotMatch(manifest, /^\s*- tui\s*$/m);
+  assert.doesNotMatch(readme, /agentsam tui|CLI\/TUI/);
+});
+
+test('dead branded splash paths are gone and UI preview stays dev-only', () => {
+  for (const rel of ['src/ui/splash.js', 'src/ui/splash-xterm.js', 'src/commands/tui.js']) {
+    assert.equal(fs.existsSync(path.join(root, rel)), false, `${rel} should not ship`);
+  }
+  for (const rel of ['scripts/internal/ui-preview-runner.mjs', 'scripts/internal/ansi-ui-preview.mjs']) {
+    assert.equal(fs.existsSync(path.join(root, rel)), true, `${rel} should remain available to contributors`);
+  }
+  assert.equal(fs.existsSync(path.join(root, 'src/ui/runtime-activity.js')), true, 'automatic runtime activity must ship with the product CLI');
+
+  const pkg = JSON.parse(read('package.json'));
+  assert.ok(pkg.files.includes('skills'));
+  assert.equal(pkg.files.includes('scripts'), false, 'internal preview scripts must not be published');
+});

package/test/repository-snapshot-view.test.mjs

@@ -0,0 +1,112 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  buildRepositorySnapshotFacets,
+  projectRepositorySnapshot,
+  repositoryFileMatches,
+} from '../src/capabilities/repository-snapshot-view.js';
+
+function snapshot() {
+  return {
+    schema_version: 1,
+    capability: 'repository.snapshot',
+    snapshot_id: 'rsnap_0123456789abcdef01234567',
+    created_at: '2026-09-11T00:00:00.000Z',
+    content_hash: `sha256:${'1'.repeat(64)}`,
+    repository: { full_name: 'SamPrimeaux/agentsam-sdk', branch: 'main', revision_sha: 'abc123', dirty: false },
+    tree: {
+      merkle_root: `sha256:${'2'.repeat(64)}`,
+      metadata_root: `sha256:${'3'.repeat(64)}`,
+      manifest: { format: 'agentsam-merkle', version: 1, hash_algorithm: 'sha256', policy_hash: `sha256:${'4'.repeat(64)}` },
+      classifier: { format: 'agentsam-filemeta', version: 1, source: 'path+package+ast' },
+      stats: { files: 4, directories: 3, symlinks: 0, bytes: 1000 },
+      semantic_stats: { entries: 4, files: 4, packages: 2, ast_indexed: 4 },
+      paths: ['packages/identity/src/core/accounts.js', 'packages/identity/src/oauth/login.js', 'apps/cms/src/editor.tsx', 'apps/cms/src/assets.ts'],
+      files: [
+        {
+          path: 'packages/identity/src/core/accounts.js', type: 'file', size: 213, mode: 420, hash: `sha256:${'a'.repeat(64)}`,
+          package: '@inneranimalmedia/agentsam-sdk-identity', package_root: 'packages/identity', system: 'identity',
+          category: 'accounts', layer: 'core', kind: 'source', language: 'javascript', role: 'business-logic', execution_domain: 'unknown',
+          tags: ['account-scoped', 'authentication'], symbols: ['accountLinkingNotConfigured'], imports: [],
+        },
+        {
+          path: 'packages/identity/src/oauth/login.js', type: 'file', size: 300, mode: 420, hash: `sha256:${'b'.repeat(64)}`,
+          package: '@inneranimalmedia/agentsam-sdk-identity', package_root: 'packages/identity', system: 'identity',
+          category: 'login', layer: 'oauth', kind: 'source', language: 'javascript', role: 'business-logic', execution_domain: 'unknown',
+          tags: ['authentication'], symbols: ['login'], imports: ['./accounts.js'],
+        },
+        {
+          path: 'apps/cms/src/editor.tsx', type: 'file', size: 250, mode: 420, hash: `sha256:${'c'.repeat(64)}`,
+          package: '@inneranimalmedia/cms', package_root: 'apps/cms', system: 'cms-frontend', category: 'editor', layer: 'ui',
+          kind: 'source', language: 'typescript', role: 'ui', execution_domain: 'browser', tags: ['cms'], symbols: ['CmsEditor'], imports: ['react'],
+        },
+        {
+          path: 'apps/cms/src/assets.ts', type: 'file', size: 237, mode: 420, hash: `sha256:${'d'.repeat(64)}`,
+          package: '@inneranimalmedia/cms', package_root: 'apps/cms', system: 'cms-frontend', category: 'assets', layer: 'data',
+          kind: 'source', language: 'typescript', role: 'business-logic', execution_domain: 'browser', tags: ['cms', 'assets'], symbols: ['loadAsset'], imports: [],
+        },
+      ],
+    },
+    intelligence: { summary: { file_count: 4 } },
+    packages: [], knowledge: { configured: false },
+    analysis: {
+      trust_boundary: {
+        schema_version: 1, analyzer: 'agentsam-execution-boundary', metadata_root: `sha256:${'3'.repeat(64)}`,
+        complete: true, status: 'action-required', ok: false, browser_roots: 2, browser_reachable_files: 2, ast_files: 4,
+        findings: [{ kind: 'browser-server-import', severity: 'high', source: 'apps/cms/src/editor.tsx', target: 'server/secrets.ts', repair: { action: 'move-server-call-behind-api-boundary' } }],
+      },
+    },
+    deploy: null,
+  };
+}
+
+test('repository snapshot index is bounded and preserves the three canonical identities', () => {
+  const full = snapshot();
+  const view = projectRepositorySnapshot(full, { view: 'index' });
+  assert.equal(view.snapshot_id, full.snapshot_id);
+  assert.equal(view.content_hash, full.content_hash);
+  assert.equal(view.tree.merkle_root, full.tree.merkle_root);
+  assert.equal(view.tree.metadata_root, full.tree.metadata_root);
+  assert.equal(view.tree.manifest.policy_hash, full.tree.manifest.policy_hash);
+  assert.equal(view.files, undefined);
+  assert.equal(view.projection.matched, 4);
+  assert.match(view.projection.projection_hash, /^sha256:[a-f0-9]{64}$/);
+  assert.equal(view.tree.paths, undefined);
+  assert.equal(view.tree.files, undefined);
+  assert.equal(view.analysis.trust_boundary.status, 'action-required');
+  assert.equal(view.analysis.trust_boundary.finding_count, 1);
+  assert.equal(view.analysis.trust_boundary.findings[0].repair_action, 'move-server-call-behind-api-boundary');
+});
+
+test('repository snapshot files view filters semantics before bounding output', () => {
+  const full = snapshot();
+  const view = projectRepositorySnapshot(full, {
+    view: 'files',
+    filters: { system: ['identity'], tag: ['authentication'], category: ['accounts'], execution_domain: ['unknown'] },
+    limit: 1,
+  });
+  assert.equal(view.projection.matched, 1);
+  assert.equal(view.projection.returned, 1);
+  assert.equal(view.projection.truncated, false);
+  assert.deepEqual(view.files.map((entry) => entry.path), ['packages/identity/src/core/accounts.js']);
+  assert.equal(view.files[0].hash, undefined);
+  assert.equal(view.files[0].mode, undefined);
+});
+
+test('path globs, AST selectors, and facet counts are deterministic', () => {
+  const full = snapshot();
+  const files = full.tree.files;
+  assert.equal(repositoryFileMatches(files[2], { path: ['apps/cms/**'], symbol: ['CmsEditor'] }), true);
+  assert.equal(repositoryFileMatches(files[2], { import: ['react'], language: ['javascript'] }), false);
+  const facets = buildRepositorySnapshotFacets(files);
+  assert.deepEqual(facets.systems.slice(0, 2), [
+    { value: 'cms-frontend', count: 2 },
+    { value: 'identity', count: 2 },
+  ]);
+  assert.deepEqual(facets.tags.find((row) => row.value === 'authentication'), { value: 'authentication', count: 2 });
+  assert.deepEqual(facets.execution_domains, [
+    { value: 'browser', count: 2 },
+    { value: 'unknown', count: 2 },
+  ]);
+  assert.equal(repositoryFileMatches(files[2], { execution_domain: ['browser'] }), true);
+});

package/test/runtime-activity.test.mjs

@@ -0,0 +1,98 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  canAnimateTerminal,
+  createRuntimeActivity,
+  phaseForRuntimeEvent,
+  renderRuntimeActivityFrame,
+  renderRuntimeActivityPanel,
+  renderRuntimeActivityResult,
+} from '../src/ui/runtime-activity.js';
+import { runLocalAgent } from '../src/commands/shell.js';
+
+test('runtime activity is automatic only in a real interactive terminal', () => {
+  assert.equal(canAnimateTerminal({ stdout: { isTTY: true }, env: { TERM: 'xterm-256color' } }), true);
+  assert.equal(canAnimateTerminal({ stdout: { isTTY: false }, env: { TERM: 'xterm-256color' } }), false);
+  assert.equal(canAnimateTerminal({ stdout: { isTTY: true }, env: { TERM: 'dumb' } }), false);
+  assert.equal(canAnimateTerminal({ stdout: { isTTY: true }, env: { TERM: 'xterm-256color', CI: '1' } }), false);
+});
+
+test('runtime renderer exposes thinking, tool, and context phases without product renderer vocabulary', () => {
+  assert.match(renderRuntimeActivityFrame({ phase: 'thinking', tick: 1, elapsedMs: 1250 }), /Agent Sam/);
+  assert.match(renderRuntimeActivityFrame({ phase: 'thinking', tick: 1, elapsedMs: 1250 }), /thinking/);
+  const panel = renderRuntimeActivityPanel({ phase: 'thinking', tick: 2, elapsedMs: 1250 });
+  assert.match(panel, /Agent Sam/);
+  assert.match(panel, /thinking · working locally/);
+  assert.match(panel, /\(●\)/);
+  assert.equal(panel.split('\n').length, 5);
+  assert.match(renderRuntimeActivityResult({ phase: 'done', elapsedMs: 1250 }), /done/);
+  assert.equal(phaseForRuntimeEvent({ type: 'model.started' }), 'thinking');
+  assert.equal(phaseForRuntimeEvent({ type: 'tool.started', tool: 'git.status' }), 'using git.status');
+  assert.equal(phaseForRuntimeEvent({ type: 'context.compaction.started' }), 'tidying context');
+});
+
+test('runtime activity redraws automatically and restores the cursor', () => {
+  let output = '';
+  let clock = 0;
+  let intervalFn = null;
+  const activity = createRuntimeActivity({
+    write: (text) => { output += text; },
+    interactive: true,
+    now: () => clock,
+    setInterval: (fn) => { intervalFn = fn; return 7; },
+    clearInterval: () => {},
+  });
+
+  activity.start('thinking');
+  clock = 320;
+  intervalFn();
+  activity.update('using repository.snapshot');
+  clock = 840;
+  activity.succeed('done');
+
+  assert.match(output, /thinking/);
+  assert.match(output, /using repository\.snapshot/);
+  assert.match(output, /done/);
+  assert.match(output, /\x1b\[\?25l/);
+  assert.match(output, /\x1b\[\?25h/);
+});
+
+test('/agent starts and completes product activity around the real request', async () => {
+  const phases = [];
+  let output = '';
+  const activity = {
+    start: (phase) => phases.push(`start:${phase}`),
+    succeed: (phase) => phases.push(`success:${phase}`),
+    fail: (phase) => phases.push(`fail:${phase}`),
+  };
+  const fetchImpl = async () => ({
+    ok: true,
+    status: 200,
+    async text() { return JSON.stringify({ ok: true, answer: 'ready' }); },
+  });
+
+  await runLocalAgent('inspect this repo', (text) => { output += text; }, { fetchImpl, activity, interactive: true });
+  assert.deepEqual(phases, ['start:thinking', 'success:done']);
+  assert.match(output, /"answer": "ready"/);
+});
+
+
+test('/agent restores product activity when the response body fails', async () => {
+  const phases = [];
+  const activity = {
+    start: (phase) => phases.push(`start:${phase}`),
+    succeed: (phase) => phases.push(`success:${phase}`),
+    fail: (phase) => phases.push(`fail:${phase}`),
+  };
+  const fetchImpl = async () => ({
+    ok: true,
+    status: 200,
+    async text() { throw new Error('body interrupted'); },
+  });
+
+  await assert.rejects(
+    runLocalAgent('inspect this repo', () => {}, { fetchImpl, activity, interactive: true }),
+    /response could not be read: body interrupted/,
+  );
+  assert.deepEqual(phases, ['start:thinking', 'fail:response error']);
+});

package/test/sdk-worker-contract.test.mjs

@@ -0,0 +1,68 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import test from 'node:test';
+
+const read = (relative) => fs.readFileSync(new URL(`../${relative}`, import.meta.url), 'utf8');
+const exists = (relative) => fs.existsSync(new URL(`../${relative}`, import.meta.url));
+
+const wrangler = read('apps/local-studio/backend/wrangler.jsonc');
+const providers = read('apps/local-studio/shared/agentsam/src/model-providers.ts');
+const runtime = read('apps/local-studio/backend/server/lib/cloudflare-runtime.ts');
+const worker = read('apps/local-studio/backend/worker/index.js');
+
+test('Local Studio backend is the only agentsam-sdk Cloudflare application owner', () => {
+  assert.equal(exists('wrangler.jsonc'), false);
+  assert.equal(exists('worker/index.js'), false);
+  assert.equal(exists('scripts/with-cloudflare-env.sh'), false);
+  assert.ok(exists('apps/local-studio/backend/worker/index.js'));
+  assert.equal(exists('apps/local-studio/backend/wrangler.ui.toml'), false);
+  assert.equal(exists('apps/local-studio/backend/wrangler.workmode.toml'), false);
+  assert.ok(exists('apps/local-studio/backend/wrangler.jsonc'));
+});
+
+test('agentsam-sdk Worker uses the backend Worker entry, custom domain only, and canonical bindings', () => {
+  assert.match(wrangler, /"name"\s*:\s*"agentsam-sdk"/);
+  assert.match(wrangler, /"main"\s*:\s*"worker\/index\.js"/);
+  assert.match(wrangler, /"directory"\s*:\s*"\.\.\/\.output\/public"/);
+  assert.match(wrangler, /"workers_dev"\s*:\s*false/);
+  assert.match(wrangler, /"pattern"\s*:\s*"agentsam\.inneranimalmedia\.com"/);
+  assert.match(wrangler, /"binding"\s*:\s*"DB"/);
+  assert.match(wrangler, /"database_name"\s*:\s*"inneranimalmedia-business"/);
+  assert.match(wrangler, /"binding"\s*:\s*"WEBSITE_ASSETS"/);
+  assert.match(wrangler, /"bucket_name"\s*:\s*"agentsam-os-blueprint-content"/);
+  assert.match(wrangler, /"binding"\s*:\s*"AGENTSAM_WAI"/);
+  assert.match(wrangler, /"binding"\s*:\s*"EXECOS"/);
+  assert.match(wrangler, /"service"\s*:\s*"execos"/);
+  assert.match(wrangler, /"binding"\s*:\s*"PTY_SERVICE"/);
+  assert.match(wrangler, /"service_id"\s*:\s*"019db639-7c70-7071-8ef3-32ec0392a9ff"/);
+  assert.match(wrangler, /"IAM_ORIGIN"\s*:\s*"https:\/\/inneranimalmedia\.com"/);
+  assert.doesNotMatch(wrangler, /AGENTSAM_WORKER_ROLE/);
+  assert.doesNotMatch(wrangler, /"OLLAMA_BASE_URL"\s*:/);
+  assert.doesNotMatch(wrangler, /workers\.dev/);
+});
+
+test('canonical Worker preserves vault routes and delegates app traffic to Nitro', () => {
+  assert.match(worker, /url\.pathname\.startsWith\("\/api\/vault\/"\)/);
+  assert.match(worker, /\/api\/vault\/secrets/);
+  assert.match(worker, /\/api\/vault\/unwrap/);
+  assert.match(worker, /return nitroWorker\.fetch\(request, env, context\)/);
+});
+
+test('model providers include Grok independently from Grok gate authentication', () => {
+  for (const id of ['grok', 'openai', 'gemini', 'workers-ai', 'ollama']) {
+    assert.match(providers, new RegExp(`id: ["']${id}["']`));
+  }
+  assert.match(providers, /credential: "XAI_API_KEY"/);
+  assert.match(providers, /binding: "AGENTSAM_WAI"/);
+  assert.match(providers, /binding: "EXECOS"/);
+});
+
+test('Ollama uses local loopback behind ExecOS with a portable explicit cwd', () => {
+  assert.match(runtime, /baseUrl: "http:\/\/127\.0\.0\.1:11434"/);
+  assert.match(runtime, /target: "local"/);
+  assert.match(runtime, /x-bridge-key/);
+  assert.match(runtime, /return explicit \|\| "\/"/);
+  assert.match(runtime, /JSON\.stringify\(\{ command, target: "local", cwd \}\)/);
+  assert.match(runtime, /public_base_url: false/);
+  assert.doesNotMatch(runtime, /ollama\.inneranimalmedia\.com/);
+});

package/test/security.test.mjs

@@ -181,3 +181,49 @@ test('a missing transitive dependency cannot pass as complete coverage', async t
   assert.equal(report.complete,false);
   assert.ok(report.issues.some(issue=>issue.includes('Missing locked dependency edge')));
 });
+
+test('security scan includes AST/Merkle trust-boundary contradictions and mechanical repair evidence', async t => {
+  const f = fixture(t);
+  fs.mkdirSync(path.join(f.root, 'frontend'), { recursive: true });
+  fs.mkdirSync(path.join(f.root, 'backend'), { recursive: true });
+  fs.writeFileSync(path.join(f.root, 'frontend', 'client.ts'), [
+    "import { secretValue } from '../backend/secrets.ts';",
+    "export const value = secretValue;",
+  ].join('\n'));
+  fs.writeFileSync(path.join(f.root, 'backend', 'secrets.ts'), [
+    "export const secretValue = process.env.API_KEY;",
+  ].join('\n'));
+
+  const report = await scanProjectSecurity({ projectRoot: f.root, fetch: empty });
+  assert.equal(report.complete, true);
+  assert.equal(report.ok, false);
+  assert.equal(report.status, 'action-required');
+  assert.match(report.trust_boundary.merkle_root, /^sha256:/);
+  assert.match(report.trust_boundary.metadata_root, /^sha256:/);
+  const finding = report.trust_boundary.findings.find((item) => item.kind === 'browser-server-import');
+  assert.ok(finding);
+  assert.equal(finding.source, 'frontend/client.ts');
+  assert.equal(finding.target, 'backend/secrets.ts');
+  assert.equal(finding.repair.action, 'move-server-call-behind-api-boundary');
+  assert.equal(reportExitCode(report), 1);
+  const text = formatSecurityReport(report);
+  assert.match(text, /Trust boundary/);
+  assert.match(text, /frontend\/client\.ts/);
+  assert.match(text, /move-server-call-behind-api-boundary/);
+});
+
+test('browser env and server-runtime imports are derived from syntax rather than folder names alone', async t => {
+  const f = fixture(t);
+  fs.mkdirSync(path.join(f.root, 'frontend', 'src'), { recursive: true });
+  fs.writeFileSync(path.join(f.root, 'frontend', 'src', 'client.ts'), [
+    "import fs from 'node:fs';",
+    "export const leaked = import.meta.env.VITE_API_KEY;",
+    "export const privateValue = process.env.INTERNAL_TOKEN;",
+    "export const exists = Boolean(fs);",
+  ].join('\n'));
+  const report = await scanProjectSecurity({ projectRoot: f.root, fetch: empty });
+  const kinds = new Set(report.trust_boundary.findings.map((item) => item.kind));
+  assert.ok(kinds.has('browser-server-runtime-import'));
+  assert.ok(kinds.has('browser-public-secret-name'));
+  assert.ok(kinds.has('browser-private-env-access'));
+});

package/test/shell.test.mjs

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import test from 'node:test';
-import { dispatchShellLine, renderShellCatalog, tokenizeShellLine } from '../src/commands/shell.js';
+import { dispatchShellLine, renderShellCatalog, renderShellPrompt, tokenizeShellLine } from '../src/commands/shell.js';
 
 const repoRoot = path.resolve(new URL('..', import.meta.url).pathname);
 
@@ -14,6 +14,13 @@ test('shell tokenizer preserves Windows paths and quoted arguments', () => {
   assert.deepEqual(tokenizeShellLine('/agent "inspect this repo"'), ['/agent', 'inspect this repo']);
 });
 
+test('interactive prompt derives username and cwd instead of hardcoding Agent Sam identity', () => {
+  const env = { USER: 'alice', HOME: '/Users/alice' };
+  assert.equal(renderShellPrompt('/Users/alice/code/demo', env), 'alice ~/code/demo > ');
+  assert.equal(renderShellPrompt('/Users/alice', env), 'alice ~ > ');
+  assert.equal(renderShellPrompt('/tmp/demo', env), 'alice /tmp/demo > ');
+});
+
 test('shell catalog advertises commands that the REPL owns', () => {
   const catalog = renderShellCatalog();
   assert.match(catalog, /\/help\s+Show Agent Sam commands/);

package/test/skills.test.mjs

@@ -0,0 +1,22 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { getSkill, listSkills, loadSkill } from '../src/skills/index.js';
+
+test('portable skill registry exposes AgentSam Jr Dev by id and alias', () => {
+  const listed = listSkills();
+  assert.ok(listed.some((skill) => skill.id === 'agentsam-jr-dev'));
+
+  assert.equal(getSkill('agentsam_jr_dev')?.id, 'agentsam-jr-dev');
+  assert.equal(getSkill('jr-dev')?.id, 'agentsam-jr-dev');
+});
+
+test('AgentSam Jr Dev loads compact instructions and references on demand', () => {
+  const compact = loadSkill('agentsam-jr-dev');
+  assert.match(compact.instructions, /# AgentSam Jr Dev/);
+  assert.equal('references' in compact, false);
+
+  const full = loadSkill('agentsam_jr_dev', { references: true });
+  assert.equal(full.references.length, 2);
+  assert.match(full.references[0].content, /## HTTP/);
+  assert.match(full.references[1].content, /# Real Application Logic/);
+});

package/test/smoke.mjs

@@ -57,12 +57,12 @@ assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/db'));
 assert.ok(SLASH_COMMANDS.some((c) => c.cmd === '/agent'));
 assert.deepEqual(
   listSlashCommands({ lane: 'deploy' }).map(({ cmd }) => cmd),
-  ['/help', '/deploy', '/exit'],
+  ['/help', '/models', '/settings', '/deploy', '/exit'],
   'deploy lane keeps global shell controls and excludes commands from other lanes',
 );
 
 printContextSummary({
-  iam: { ready: true, source: 'sdk-token', detail: 'AGENTSAM_SDK_TOKEN' },
+  iam: { ready: true, source: 'sdk-key', detail: 'AGENTSAM_SDK_KEY' },
   gcp: { source: 'vm-metadata', email: 'execos@project.iam.gserviceaccount.com' },
   gcp_vm: true,
   github: { source: 'gh-cli', account: 'user@example.com' },

package/test/theme-portability.test.mjs

@@ -0,0 +1,14 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { CLOUD, LOCAL, SANDBOX, getLaneThemeByName } from '../src/ui/theme.js';
+
+test('SDK terminal lane metadata is provider and operator neutral', () => {
+  const serialized = JSON.stringify([LOCAL.meta, CLOUD.meta, SANDBOX.meta]);
+  assert.doesNotMatch(serialized, /sam(smac)?|inneranimalmedia|gcp|cloudflare|MY_CONTAINER/i);
+  assert.equal(LOCAL.meta.tunnelHint, 'current machine · real shell');
+  assert.equal(CLOUD.meta.label, 'Remote');
+  assert.equal(SANDBOX.meta.tunnelHint, 'isolated disposable runtime');
+  assert.equal(getLaneThemeByName('remote'), CLOUD);
+  assert.equal(getLaneThemeByName('cloud'), CLOUD);
+});

package/test/tools-search.test.mjs

@@ -0,0 +1,27 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { getToolCatalog } from '../src/lib/tools.js';
+import { searchToolCards } from '../src/tools/index.js';
+import { DEFAULT_RESULT_POLICY } from '../src/context/index.js';
+
+test('every built-in SDK tool inherits a bounded result policy', () => {
+  for (const lane of ['fullstack', 'cms', 'data', 'crm', 'creative']) {
+    for (const tool of getToolCatalog(lane)) assert.deepEqual(tool.result_policy, DEFAULT_RESULT_POLICY);
+  }
+});
+
+test('tools.search returns compact cards rather than full schemas', () => {
+  const catalog = Array.from({ length: 20 }, (_, index) => ({
+    name: index === 13 ? 'code.retrieve' : `tool.${index}`,
+    description: index === 13 ? 'Find symbols, callers, and semantic code matches.' : `Capability ${index}`,
+    category: index === 13 ? 'code' : 'misc',
+    risk: 'read',
+    input_schema: { type: 'object', required: ['query'], properties: { query: { type: 'string' }, giant: { description: 'x'.repeat(5000) } } },
+  }));
+  const result = searchToolCards(catalog, 'code symbols');
+  assert.ok(result.cards.length <= 8);
+  assert.equal(result.cards[0].tool, 'code.retrieve');
+  assert.deepEqual(result.cards[0].required, ['query']);
+  assert.equal('input_schema' in result.cards[0], false);
+  assert.ok(result.receipt.chars < 24_000);
+});

package/examples/agentsam-tui-ansi.mjs

@@ -1,149 +0,0 @@
-#!/usr/bin/env node
-/**
- * Zero-dependency ANSI companion to the Agent Sam SDK TUI.
- * Use this from Agent Sam PTY / Node scripts when you do not want Python+Rich.
- *
- *   node scripts/demo_agentsam_ansi.mjs
- *   node scripts/demo_agentsam_ansi.mjs --scene sprite
- *   node scripts/demo_agentsam_ansi.mjs --check
- */
-
-const HIDE = "\x1b[?25l";
-const SHOW = "\x1b[?25h";
-const CLEAR_LINE = "\x1b[2K";
-const MAGENTA = "\x1b[38;2;211;54;130m";
-const CYAN = "\x1b[38;2;45;212;191m";
-const MUTED = "\x1b[38;2;122;154;170m";
-const GREEN = "\x1b[38;2;163;184;0m";
-const RESET = "\x1b[0m";
-const BOLD = "\x1b[1m";
-const DIM = "\x1b[2m";
-
-const WALKER = [
-  ["  ·     ", "  ○     ", "  │╲    ", "  │ ○   ", "  ○ ░   ", "  ░     "],
-  ["   ·    ", "   ○    ", "   │╲   ", "  ○  ○  ", "   ░    ", "  ░     "],
-  ["    ·   ", "    ○   ", "    │╲  ", "   ○ │  ", "    ○   ", "   ░    "],
-  ["     ·  ", "    ○   ", "    ╱│  ", "   ○ │  ", "    ○   ", "    ░   "],
-  ["    ·   ", "   ○    ", "   ╱│   ", "  ○  │  ", "   ○ ░  ", "    ░   "],
-  ["   ·    ", "  ○     ", "  ╱│    ", " ○  │   ", "  ○ ░   ", "  ░     "],
-  ["  ·     ", "  ○     ", "  │╲    ", " ○  ○   ", "  ○ ░   ", "  ░     "],
-  [" ·      ", "  ○     ", "  │╲    ", "  │ ○   ", "  ○ ░   ", " ░      "],
-];
-
-const BRAILLE = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-function paint(lines) {
-  const payload = lines.map((line) => `${CLEAR_LINE}${line}`).join("\n");
-  process.stdout.write(`${payload}\n`);
-  return lines.length;
-}
-
-function moveUp(n) {
-  if (n > 0) process.stdout.write(`\x1b[${n}A`);
-}
-
-function box(title, bodyLines, width = 42) {
-  const inner = width - 2;
-  const top = `${MAGENTA}╭${"─".repeat(inner)}╮${RESET}`;
-  const label = ` ${title} `;
-  const titled = `${MAGENTA}╭${RESET}${BOLD}${CYAN}${label}${RESET}${MAGENTA}${"─".repeat(Math.max(0, inner - label.length))}╮${RESET}`;
-  const mid = bodyLines.map((line) => {
-    const visible = line.replace(/\x1b\[[0-9;]*m/g, "");
-    const pad = Math.max(0, inner - 2 - visible.length);
-    return `${MAGENTA}│${RESET} ${line}${" ".repeat(pad)} ${MAGENTA}│${RESET}`;
-  });
-  const bot = `${MAGENTA}╰${"─".repeat(inner)}╯${RESET}`;
-  return [titled.length ? titled : top, ...mid, bot];
-}
-
-async function sceneSprite({ ticks, delay }) {
-  let used = 0;
-  for (let i = 0; i < ticks; i += 1) {
-    const frame = WALKER[i % WALKER.length];
-    const caption = `${MUTED}Agent Sam is walking · frame ${String(i + 1).padStart(2, "0")}${RESET}`;
-    const lines = box("agent activity", [...frame.map((row) => `${CYAN}${BOLD}${row}${RESET}`), "", caption], 34);
-    if (used) moveUp(used);
-    used = paint(lines);
-    await sleep(delay);
-  }
-  return used;
-}
-
-async function sceneDashboard({ ticks, delay }) {
-  const total = 2320;
-  let used = 0;
-  const started = Date.now();
-  for (let i = 0; i < ticks; i += 1) {
-    const done = Math.min(total, Math.round(((i + 1) / ticks) * total));
-    const symbols = Math.round(done * 2.76);
-    const elapsed = Math.round((Date.now() - started) / 1000);
-    const spin = BRAILLE[i % BRAILLE.length];
-    const walker = WALKER[i % WALKER.length];
-    const pct = Math.round((done / total) * 100);
-    const barFilled = Math.round(pct / 5);
-    const bar = `${CYAN}${"█".repeat(barFilled)}${MUTED}${"░".repeat(20 - barFilled)}${RESET}`;
-    const body = [
-      `${MUTED}stage${RESET}     ${CYAN}${BOLD}parse_chunks${RESET}  ${spin}`,
-      `${MUTED}files${RESET}     ${done.toLocaleString()} / ${total.toLocaleString()}`,
-      `${MUTED}symbols${RESET}   ${symbols.toLocaleString()}`,
-      `${MUTED}errors${RESET}    ${GREEN}0${RESET}`,
-      `${MUTED}elapsed${RESET}   ${elapsed}s`,
-      `${bar} ${pct}%`,
-      "",
-      ...walker.map((row) => `${CYAN}${row}${RESET}`),
-    ];
-    const lines = box("◉  Code Index", body, 46);
-    if (used) moveUp(used);
-    used = paint(lines);
-    await sleep(delay);
-  }
-  return used;
-}
-
-async function sceneLogs({ delay }) {
-  const rows = [
-    ["INFO", "Connected to Hyperdrive", "471 ms"],
-    ["WORK", "Parsing batch", "24 files"],
-    ["OK", "Checkpoint committed", "durable"],
-  ];
-  const styles = { INFO: "\x1b[38;2;58;159;232m", WORK: "\x1b[38;2;230;172;0m", OK: GREEN };
-  for (const [level, message, detail] of rows) {
-    const now = new Date().toISOString().slice(11, 19);
-    process.stdout.write(
-      `${DIM}${now}${RESET} ${styles[level]}${level.padStart(4)}${RESET} ${message} ${DIM}· ${detail}${RESET}\n`,
-    );
-    await sleep(delay);
-  }
-  return 0;
-}
-
-async function main() {
-  const args = new Set(process.argv.slice(2));
-  const check = args.has("--check");
-  const scene = [...args].find((a) => !a.startsWith("--")) || (args.has("--scene") ? null : "all");
-  const sceneFlagIdx = process.argv.indexOf("--scene");
-  const named = sceneFlagIdx >= 0 ? process.argv[sceneFlagIdx + 1] : scene;
-  const which = named && named !== "all" && !named.startsWith("--") ? named : "all";
-  const delay = check ? 0 : 90;
-  const ticks = check ? 4 : 32;
-
-  process.stdout.write(HIDE);
-  try {
-    if (which === "sprite" || which === "all") await sceneSprite({ ticks, delay });
-    if (which === "dashboard" || which === "all") await sceneDashboard({ ticks, delay });
-    if (which === "logs" || which === "all") await sceneLogs({ delay: check ? 0 : 120 });
-    process.stdout.write(`\n${GREEN}${BOLD}Done.${RESET}  Use the Python agentsam tui command for Rich layouts.\n`);
-  } finally {
-    process.stdout.write(SHOW);
-  }
-}
-
-main().catch((err) => {
-  process.stdout.write(SHOW);
-  console.error(err);
-  process.exit(1);
-});