@inneranimalmedia/agentsam-sdk 2.4.1 → 2.6.0

package/src/ui/theme.js

@@ -1,15 +1,15 @@
 /**
  * @file src/ui/theme.js
- * @description IAM Terminal Theme System — single source of truth for
- * per-lane color identity. Used by:
- *   - xterm.js panels in XTermShell.tsx (pass theme object to Terminal constructor)
- *   - CLI ANSI output in agentsam-sdk (import ANSI constants)
- *   - Splash/HUD renders in both contexts
+ * @description Agent Sam terminal theme system — portable color and semantic
+ * status tokens for native ANSI output and browser/xterm consumers.
  *
- * Lane identity:
- *   LOCAL   → amber  (samsmac tunnel, darwin)
- *   CLOUD   → teal   (GCP platform_vm, iam-pty)
- *   SANDBOX → purple (CF container, isolated exec)
+ * Lane identity is intentionally provider-neutral:
+ *   LOCAL   → amber  (the user's current machine / real shell)
+ *   REMOTE  → teal   (a connected remote runtime, provider chosen by the host)
+ *   SANDBOX → purple (an isolated/disposable runtime, provider chosen by the host)
+ *
+ * Infrastructure names, domains, machine names, and account-specific routing
+ * never belong in this SDK theme. Hosts may supply their own runtime labels.
  *
  * No dependencies. ESM + CJS compatible (conditional exports in package.json).
  */
@@ -31,7 +31,7 @@ export const PALETTE = {
   ghost:       '#aaaaaa',
   white:       '#e8e8e8',
 
-  // LOCAL lane — amber/gold (samsmac, darwin_arm64)
+  // LOCAL lane — amber/gold (current machine / real shell)
   amber900:    '#0d0900',
   amber800:    '#1a1200',
   amber700:    '#2d1f00',
@@ -43,7 +43,7 @@ export const PALETTE = {
   amber100:    '#fde68a',
   amber050:    '#fef3c7',
 
-  // CLOUD lane — teal/cyan (GCP, iam-pty, platform_vm)
+  // REMOTE lane — teal/cyan (provider-neutral connected runtime)
   teal900:     '#000d0b',
   teal800:     '#001a17',
   teal700:     '#002e28',
@@ -55,7 +55,7 @@ export const PALETTE = {
   teal100:     '#99f6e4',
   teal050:     '#ccfbf1',
 
-  // SANDBOX lane — purple (CF container, isolated build exec)
+  // SANDBOX lane — purple (provider-neutral isolated runtime)
   purple900:   '#06020d',
   purple800:   '#0d0520',
   purple700:   '#1e0a3d',
@@ -130,26 +130,26 @@ const makeLane = ({ bg, bgSubtle, primary, secondary, dim, accent, name, label,
 });
 
 // ─────────────────────────────────────────────────────────────────────────────
-// THE THREE LANES
+// PORTABLE EXECUTION LANES
 // ─────────────────────────────────────────────────────────────────────────────
 
 export const LOCAL = makeLane({
   name: 'local', label: 'Local', icon: '◈',
-  tunnelHint: 'samsmac → localpty.inneranimalmedia.com',
+  tunnelHint: 'current machine · real shell',
   bg: '#0d0900', bgSubtle: '#1a1200',
   primary: '#f59e0b', secondary: '#fbbf24', dim: '#78450a', accent: '#22d3c8',
 });
 
 export const CLOUD = makeLane({
-  name: 'cloud', label: 'Cloud', icon: '●',
-  tunnelHint: 'inneranimalmedia → terminal.inneranimalmedia.com (GCP iam-tunnel)',
+  name: 'remote', label: 'Remote', icon: '●',
+  tunnelHint: 'connected remote runtime',
   bg: '#000d0b', bgSubtle: '#001a17',
   primary: '#22d3c8', secondary: '#5eead4', dim: '#065f52', accent: '#f59e0b',
 });
 
 export const SANDBOX = makeLane({
   name: 'sandbox', label: 'Sandbox', icon: '◌',
-  tunnelHint: 'CF Container → MY_CONTAINER DO (inneranimalmedia)',
+  tunnelHint: 'isolated disposable runtime',
   bg: '#06020d', bgSubtle: '#0d0520',
   primary: '#a78bfa', secondary: '#c4b5fd', dim: '#4c1d95', accent: '#22d3c8',
 });
@@ -173,11 +173,12 @@ export function getLaneTheme(targetType) {
 
 /**
  * Get lane theme by name string (for SDK CLI use).
- * @param {'local'|'cloud'|'sandbox'|string} name
+ * @param {'local'|'remote'|'cloud'|'sandbox'|string} name
  */
 export function getLaneThemeByName(name) {
   switch (name?.toLowerCase()) {
     case 'local':   return LOCAL;
+    case 'remote':
     case 'cloud':   return CLOUD;
     case 'sandbox': return SANDBOX;
     default:        return CLOUD;

package/test/account-session.test.mjs

@@ -0,0 +1,36 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { accountSessionPath, clearAccountSession, readAccountSession, resolveAccountSdkKey, saveAccountSession } from '../src/lib/account-session.js';
+
+function tempHome(t) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-account-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  return home;
+}
+
+test('browser-auth SDK bearer persists in machine-local storage, not project state', t => {
+  const home = tempHome(t);
+  const saved = saveAccountSession({ access_token: 'sdk_machine_session', user_id: 'au_test', account_id: 'acct_test', email: 'dev@example.test' }, { home });
+  assert.equal(saved.user_id, 'au_test');
+  const filename = accountSessionPath({ home });
+  assert.equal(fs.existsSync(filename), true);
+  if (process.platform !== 'win32') assert.equal(fs.statSync(filename).mode & 0o077, 0);
+
+  const loaded = readAccountSession({ home });
+  assert.equal(loaded.sdk_key, 'sdk_machine_session');
+  const resolved = resolveAccountSdkKey({ env: {}, home });
+  assert.equal(resolved.source, 'agentsam_account_session');
+  assert.equal(resolved.value, 'sdk_machine_session');
+  assert.equal(clearAccountSession({ home }), true);
+  assert.equal(readAccountSession({ home }), null);
+});
+
+test('explicit/environment SDK bearer remains higher authority than local session fallback', t => {
+  const home = tempHome(t);
+  saveAccountSession({ access_token: 'sdk_disk' }, { home });
+  assert.equal(resolveAccountSdkKey({ env: { AGENTSAM_SDK_KEY: 'sdk_env' }, home }).value, 'sdk_env');
+  assert.equal(resolveAccountSdkKey({ env: { AGENTSAM_SDK_KEY: 'sdk_env' }, explicit: 'sdk_explicit', home }).value, 'sdk_explicit');
+});

package/test/app-building-skills.test.mjs

@@ -0,0 +1,61 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { getSkill, listSkills, loadSkill } from '../src/skills/index.js';
+
+const root = path.resolve(import.meta.dirname, '..');
+const cli = path.join(root, 'src', 'cli.js');
+
+test('application fundamentals and progression guard are portable registered skills', () => {
+  const ids = new Set(listSkills().map((skill) => skill.id));
+  assert.ok(ids.has('agentsam-app-fundamentals'));
+  assert.ok(ids.has('agentsam-progression-guard'));
+  assert.equal(getSkill('quick-bytes')?.id, 'agentsam-app-fundamentals');
+  assert.equal(getSkill('no-regress')?.id, 'agentsam-progression-guard');
+
+  const fundamentals = loadSkill('quick-bytes', { references: true });
+  assert.equal(fundamentals.references.length, 2);
+  assert.match(fundamentals.instructions, /Credentialed-destination card/);
+  assert.match(fundamentals.instructions, /AST/);
+  assert.match(fundamentals.instructions, /Merkle/);
+  assert.match(fundamentals.instructions, /Firewall\/WAF/);
+  assert.match(fundamentals.references[0].content, /OAuth redirect mental model/);
+  assert.match(fundamentals.references[1].content, /The codebase is a graph/);
+
+  const guard = loadSkill('no-regress', { references: true });
+  assert.equal(guard.references.length, 2);
+  assert.match(guard.instructions, /failed candidate must not advance the last-known-good baseline/);
+  assert.match(guard.instructions, /agentsam deploy-receipt capture/);
+  assert.match(guard.references[0].content, /Gate 6 — postdeploy/);
+  assert.match(guard.references[1].content, /Ingress versus egress hooks/);
+});
+
+test('skills CLI lists compact cards and loads quick reminders by alias', () => {
+  const listed = spawnSync(process.execPath, [cli, 'skills', '--json'], { cwd: root, encoding: 'utf8' });
+  assert.equal(listed.status, 0, listed.stderr);
+  const catalog = JSON.parse(listed.stdout);
+  assert.ok(catalog.some((skill) => skill.id === 'agentsam-app-fundamentals'));
+  assert.ok(catalog.some((skill) => skill.id === 'agentsam-progression-guard'));
+
+  const loaded = spawnSync(process.execPath, [cli, 'skills', 'quick-bytes'], { cwd: root, encoding: 'utf8' });
+  assert.equal(loaded.status, 0, loaded.stderr);
+  assert.match(loaded.stdout, /# AgentSam Application Fundamentals/);
+  assert.doesNotMatch(loaded.stdout, /# Trust, Credentials, and Credentialed Destinations/);
+
+  const full = spawnSync(process.execPath, [cli, 'skills', 'no-regress', '--references'], { cwd: root, encoding: 'utf8' });
+  assert.equal(full.status, 0, full.stderr);
+  assert.match(full.stdout, /# AgentSam Progression Guard/);
+  assert.match(full.stdout, /# Checkpoint Chain/);
+  assert.match(full.stdout, /# Hooks and Operational I\/O/);
+});
+
+test('portable npm package still owns all skill files', () => {
+  const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+  assert.ok(pkg.files.includes('skills'));
+  for (const rel of [
+    'skills/agentsam-app-fundamentals/SKILL.md',
+    'skills/agentsam-progression-guard/SKILL.md',
+  ]) assert.equal(fs.existsSync(path.join(root, rel)), true, `${rel} must exist`);
+});

package/test/apps-scaffold-contract.test.mjs

@@ -0,0 +1,56 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const productApps = ['local-studio', 'cad-creator', 'client-cms-editor'];
+const at = (...parts) => path.join(root, ...parts);
+const exists = (...parts) => fs.existsSync(at(...parts));
+
+function packageJson(...parts) {
+  return JSON.parse(fs.readFileSync(at(...parts, 'package.json'), 'utf8'));
+}
+
+test('product apps are self-contained npm workspace roots with one lockfile', () => {
+  for (const app of productApps) {
+    const base = ['apps', app];
+    assert.ok(exists(...base, 'package.json'), `${app}: root package.json`);
+    assert.ok(exists(...base, 'package-lock.json'), `${app}: root package-lock.json`);
+    assert.ok(exists(...base, 'frontend', 'package.json'), `${app}: frontend package`);
+    assert.ok(exists(...base, 'backend', 'package.json'), `${app}: backend package`);
+    assert.equal(exists(...base, 'frontend', 'package-lock.json'), false, `${app}: no frontend lockfile`);
+    assert.equal(exists(...base, 'backend', 'package-lock.json'), false, `${app}: no backend lockfile`);
+
+    const pkg = packageJson(...base);
+    assert.deepEqual(pkg.workspaces, ['frontend', 'backend', 'shared/*'], `${app}: canonical workspace list`);
+  }
+});
+
+test('every product app owns its Cloudflare boundary under backend/', () => {
+  for (const app of productApps) {
+    const base = ['apps', app, 'backend'];
+    assert.ok(exists(...base, 'worker', 'index.js'), `${app}: backend/worker/index.js`);
+    assert.ok(exists(...base, 'wrangler.jsonc'), `${app}: backend/wrangler.jsonc`);
+    const wrangler = fs.readFileSync(at(...base, 'wrangler.jsonc'), 'utf8');
+    assert.match(wrangler, /"main"\s*:\s*"worker\/index\.js"/, `${app}: wrangler main`);
+  }
+});
+
+test('SDK root is package tooling only and does not own an app Worker', () => {
+  assert.equal(exists('wrangler.jsonc'), false);
+  assert.equal(exists('worker', 'index.js'), false);
+  assert.equal(exists('scripts', 'with-cloudflare-env.sh'), false);
+
+  const rootPkg = packageJson();
+  for (const workspace of rootPkg.workspaces || []) {
+    assert.equal(workspace.startsWith('apps/'), false, `root workspace must not absorb app workspace: ${workspace}`);
+  }
+});
+
+test('Local Studio retired donor-era duplicate deployment configs', () => {
+  for (const file of ['wrangler.ui.toml', 'wrangler.workmode.toml', 'wrangler.toml.example']) {
+    assert.equal(exists('apps', 'local-studio', 'backend', file), false, `retire ${file}`);
+  }
+});

package/test/capabilities.test.mjs

@@ -6,6 +6,7 @@ import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { getCapability, getCapabilityManifest, repositorySnapshot } from '../src/capabilities/index.js';
 import { getPreset, resolvePreset } from '../src/presets/index.js';
+import { scanTrustBoundary } from '../src/security/trust-boundary.js';
 
 const CLI = path.resolve('src/cli.js');
 
@@ -51,11 +52,51 @@ test('repository.snapshot composes deterministic evidence and content addressing
   assert.equal(one.snapshot_id, two.snapshot_id);
   assert.equal(one.repository.revision_sha, git(root, ['rev-parse', 'HEAD']));
   assert.ok(one.tree.merkle_root);
+  assert.match(one.tree.metadata_root, /^sha256:[a-f0-9]{64}$/);
+  assert.equal(one.tree.manifest.format, 'agentsam-merkle');
+  assert.equal(one.tree.manifest.version, 1);
+  assert.equal(one.tree.manifest.hash_algorithm, 'sha256');
+  assert.match(one.tree.manifest.policy_hash, /^sha256:[a-f0-9]{64}$/);
+  assert.equal(one.tree.classifier.format, 'agentsam-filemeta');
+  assert.equal(one.tree.classifier.version, 1);
+  const source = one.tree.files.find((entry) => entry.path === 'src/index.js');
+  assert.equal(source.mode, 420);
+  assert.equal(source.system, 'snapshot-fixture');
+  assert.equal(source.language, 'javascript');
+  assert.deepEqual(source.symbols, ['value']);
+  assert.equal(one.analysis.trust_boundary.analyzer, 'agentsam-execution-boundary');
+  assert.equal(one.analysis.trust_boundary.metadata_root, one.tree.metadata_root);
+  assert.equal(one.analysis.trust_boundary.complete, true);
+  assert.equal(one.analysis.trust_boundary.status, 'clean');
   assert.ok(one.intelligence.summary.file_count >= 2);
   assert.equal(one.packages[0].name, 'snapshot-fixture');
   assert.equal(one.knowledge.configured, false);
 });
 
+test('repository inspection and security scan share one Git-ignore/Merkle trust authority', async t => {
+  const root = fixture();
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  fs.mkdirSync(path.join(root, 'frontend'));
+  fs.mkdirSync(path.join(root, 'backend'));
+  fs.mkdirSync(path.join(root, 'ignored'));
+  fs.writeFileSync(path.join(root, 'frontend', 'client.ts'), "import { secretValue } from '../backend/secrets.ts';\nexport const value = secretValue;\n");
+  fs.writeFileSync(path.join(root, 'backend', 'secrets.ts'), "export const secretValue = process.env.API_KEY;\n");
+  fs.writeFileSync(path.join(root, 'ignored', 'noise.ts'), "import fs from 'node:fs'; export const x = process.env.PRIVATE_TOKEN + String(fs);\n");
+  fs.writeFileSync(path.join(root, '.gitignore'), 'ignored/\n');
+
+  const snapshot = await repositorySnapshot({ cwd: root, churnDays: 30 });
+  const boundary = await scanTrustBoundary(root);
+  assert.equal(snapshot.tree.metadata_root, boundary.metadata_root);
+  assert.equal(snapshot.tree.merkle_root, boundary.merkle_root);
+  assert.equal(snapshot.analysis.trust_boundary.status, 'action-required');
+  assert.deepEqual(
+    snapshot.analysis.trust_boundary.findings.map((item) => [item.kind, item.source, item.target]),
+    boundary.findings.map((item) => [item.kind, item.source, item.target]),
+  );
+  assert.equal(snapshot.tree.paths.some((value) => value.startsWith('ignored/')), false);
+  assert.equal(boundary.findings.some((item) => item.source.startsWith('ignored/')), false);
+});
+
 test('product UX creates a preset project, adds a feature, and inspects before first commit', t => {
   const parent = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-product-'));
   t.after(() => fs.rmSync(parent, { recursive: true, force: true }));
@@ -65,10 +106,15 @@ test('product UX creates a preset project, adds a feature, and inspects before f
   });
   const project = path.join(parent, 'demo');
   const config = JSON.parse(fs.readFileSync(path.join(project, '.agentsam', 'config.json'), 'utf8'));
-  assert.equal(config.preset, 'cms');
-  assert.equal(config.lane, 'cms');
-  assert.deepEqual(config.features, ['cms', 'knowledge']);
-  assert.ok(config.capabilities.includes('repository.snapshot'));
+  assert.equal(config.schema_version, 2);
+  assert.equal(config.project.name, 'demo');
+  assert.equal(config.product.preset, 'cms');
+  assert.deepEqual(config.product.features, ['cms', 'knowledge']);
+  assert.ok(config.product.capabilities.includes('repository.snapshot'));
+  assert.match(config.repository.id, /^local:[0-9a-f-]{36}$/);
+  assert.equal(config.defaults.runtime, 'local');
+  assert.equal(config.defaults.model, 'auto');
+  assert.equal(fs.existsSync(path.join(project, 'agentsam.config.js')), false);
 
   execFileSync(process.execPath, [CLI, 'add', 'knowledge', '--cwd', project, '--json'], { stdio: 'pipe' });
   const features = JSON.parse(fs.readFileSync(path.join(project, '.agentsam', 'features.json'), 'utf8'));
@@ -79,6 +125,9 @@ test('product UX creates a preset project, adds a feature, and inspects before f
     stdio: ['ignore', 'pipe', 'pipe'],
   }));
   assert.equal(snapshot.capability, 'repository.snapshot');
+  assert.equal(snapshot.repository.repository_id, config.repository.id);
+  assert.equal(snapshot.repository.identity_source, 'project-config');
   assert.equal(snapshot.repository.revision_sha, null);
   assert.ok(snapshot.tree.stats.files > 0);
+  assert.ok(snapshot.analysis?.trust_boundary);
 });

package/test/cli-preferences.test.mjs

@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { CLI_PREFERENCES_SCHEMA, detectCliProject, readCliPreferences, writeCliPreferences } from '../src/lib/cli-preferences.js';
+import { renderBootSummary } from '../src/ui/boot.js';
+
+test('CLI preferences persist local model/runtime controls without becoming routing authority', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cli-prefs-'));
+  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'demo-project' }));
+  const written = writeCliPreferences(root, {
+    trustedDirectory: true,
+    runtime: 'sandbox',
+    terminal: 'zsh',
+    modelPreference: 'openai:gpt-6-astra',
+    reasoningEffort: 'high',
+    serviceTier: 'fast',
+  });
+  assert.equal(written.schemaVersion, CLI_PREFERENCES_SCHEMA);
+  assert.equal(written.modelAuthority, 'preference-only');
+  assert.equal(written.trustedDirectory, true);
+  assert.deepEqual(readCliPreferences(root), written);
+  const identity = detectCliProject(root);
+  assert.equal(identity.project, 'demo-project');
+  assert.equal(identity.root, root);
+  const summary = renderBootSummary({ identity, preferences: written });
+  assert.match(summary, /Agent Sam/);
+  assert.match(summary, /demo-project/);
+  assert.match(summary, /openai:gpt-6-astra/);
+  assert.match(summary, /high/);
+  assert.match(summary, /fast/);
+});
+
+test('legacy v1 local preferences migrate in memory without inventing trust', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cli-legacy-'));
+  fs.mkdirSync(path.join(root, '.agentsam'));
+  fs.writeFileSync(path.join(root, '.agentsam', 'cli.json'), JSON.stringify({
+    schemaVersion: 'agentsam-cli-preferences-v1', runtime: 'local', terminal: 'zsh', modelPreference: 'auto', modelAuthority: 'preference-only',
+  }));
+  const read = readCliPreferences(root);
+  assert.equal(read.schemaVersion, CLI_PREFERENCES_SCHEMA);
+  assert.equal(read.trustedDirectory, false);
+  assert.equal(read.reasoningEffort, 'auto');
+  assert.equal(read.serviceTier, 'default');
+});

package/test/cloudflare-connector.test.mjs

@@ -0,0 +1,96 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { handleCloudflareConnectionRequest } from '../packages/connectors/cloudflare/src/routes.js';
+import { rejectUntrustedOwnerHints } from '../packages/connectors/cloudflare/src/owner.js';
+
+function req(url, { method = 'GET', headers = {}, body } = {}) {
+  return new Request(url, { method, headers, body });
+}
+
+describe('cloudflare connector routes', () => {
+  it('rejects unauthenticated status', async () => {
+    const res = await handleCloudflareConnectionRequest(
+      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare'),
+      {},
+    );
+    assert.equal(res.status, 401);
+    const json = await res.json();
+    assert.equal(json.error, 'unauthenticated');
+  });
+
+  it('rejects browser-submitted owner hints', () => {
+    const url = new URL('https://agentsam.inneranimalmedia.com/api/connections/cloudflare?account_id=evil');
+    assert.throws(
+      () => rejectUntrustedOwnerHints(req(url.toString()), url, {}),
+      /untrusted_owner_hint/,
+    );
+  });
+
+  it('returns 503 on start when only fixture credentials exist', async () => {
+    const env = {
+      CLOUDFLARE_OAUTH_CLIENT_ID: 'sillynotreal',
+      CLOUDFLARE_OAUTH_CLIENT_SECRET: 'sillynotreal-secret',
+      sessions: new Map([['sess_1', 'user-sam']]),
+    };
+    const res = await handleCloudflareConnectionRequest(
+      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare/start', {
+        headers: { cookie: 'agentsam_session=sess_1' },
+      }),
+      env,
+    );
+    assert.equal(res.status, 503);
+    const json = await res.json();
+    assert.equal(json.error, 'not_configured');
+    assert.equal(json.fixture, true);
+  });
+
+  it('status stays safe and does not treat fixture as production configured', async () => {
+    const env = {
+      CLOUDFLARE_OAUTH_CLIENT_ID: 'sillynotreal',
+      CLOUDFLARE_OAUTH_CLIENT_SECRET: 'sillynotreal-secret',
+      sessions: new Map([['sess_1', 'user-sam']]),
+    };
+    const res = await handleCloudflareConnectionRequest(
+      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare', {
+        headers: { authorization: 'Bearer sess_1' },
+      }),
+      env,
+    );
+    assert.equal(res.status, 200);
+    const json = await res.json();
+    assert.equal(json.ok, true);
+    assert.equal(json.configured, false);
+    assert.equal(json.fixture, true);
+    assert.equal(JSON.stringify(json).includes('sillynotreal-secret'), false);
+  });
+
+  it('rejects owner_id in the JSON body', async () => {
+    const env = { sessions: new Map([['sess_1', 'user-sam']]) };
+    const res = await handleCloudflareConnectionRequest(
+      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare/disconnect', {
+        method: 'POST',
+        headers: { cookie: 'agentsam_session=sess_1', 'content-type': 'application/json' },
+        body: JSON.stringify({ owner_id: 'evil' }),
+      }),
+      env,
+    );
+    assert.equal(res.status, 400);
+    const json = await res.json();
+    assert.equal(json.error, 'untrusted_owner_hint');
+  });
+
+  it('rejects callback without a stored oauth state', async () => {
+    const env = {
+      CLOUDFLARE_OAUTH_CLIENT_ID: 'real-client-id',
+      CLOUDFLARE_OAUTH_CLIENT_SECRET: 'real-client-secret-value',
+      oauthState: new Map(),
+    };
+    const res = await handleCloudflareConnectionRequest(
+      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare/callback?code=abc&state=missing'),
+      env,
+    );
+    assert.equal(res.status, 403);
+    const json = await res.json();
+    assert.equal(json.error, 'cloudflare_connection_forbidden');
+  });
+});

package/test/cloudflare-runtime.test.mjs

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { buildWranglerInvocation, listWranglerNativeCommands, runWranglerNative, summarizeCloudflareCpuProfile, summarizeCloudflareCpuProfileFile } from '../src/cloudflare/index.js';
+import { createCapabilityAdapter } from '../src/agent/capability-adapter.js';
+
+function tempRoot() { return fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cf-')); }
+
+test('Cloudflare native command catalog exposes bounded read operations and never an auth-token secret read', () => {
+  const ids = listWranglerNativeCommands().map((row) => row.id);
+  assert.deepEqual(ids, ['whoami', 'deployments.list', 'versions.list', 'types.check', 'queues.list']);
+  assert.ok(!ids.some((id) => id.includes('token') || id.includes('secret') || id === 'deploy'));
+});
+
+test('Wrangler native invocation is argv-based and cwd/config scoped', () => {
+  const root = tempRoot();
+  fs.writeFileSync(path.join(root, 'wrangler.jsonc'), '{}');
+  const plan = buildWranglerInvocation('deployments.list', { cwd: root, name: 'demo' });
+  assert.equal(plan.cwd, root);
+  assert.deepEqual(plan.args.slice(0, 4), ['deployments', 'list', '--json', '--name']);
+  assert.equal(plan.args[4], 'demo');
+  assert.ok(plan.args.includes('--config'));
+  assert.throws(() => buildWranglerInvocation('whoami', { cwd: root, config: '../outside.toml' }), /outside_cwd/);
+});
+
+test('Wrangler native result preserves JSON and real exit code on failure', async () => {
+  const root = tempRoot();
+  const success = await runWranglerNative('whoami', { cwd: root }, { run: async () => ({ code: 0, stdout: JSON.stringify({ email: 'dev@example.com' }), stderr: '' }) });
+  assert.equal(success.data.email, 'dev@example.com');
+  await assert.rejects(
+    runWranglerNative('versions.list', { cwd: root }, { run: async () => ({ code: 7, stdout: '', stderr: 'upstream failed' }) }),
+    (error) => error.diagnostic?.exit_code === 7 && error.diagnostic?.code === 'wrangler_exit_nonzero',
+  );
+  await assert.rejects(
+    runWranglerNative('deployments.list', { cwd: root }, { run: async () => ({ code: 1, stdout: '', stderr: 'Authentication error [code: 10000]\nRequest ID: req_cf_1\nCF-Ray: ray-123' }) }),
+    (error) => error.diagnostic?.code === '10000' && error.diagnostic?.request_id === 'req_cf_1' && error.diagnostic?.ray_id === 'ray-123',
+  );
+});
+
+test('CPU profile summary ranks self-time hotspots and explicitly rejects production timer inference', () => {
+  const profile = {
+    nodes: [
+      { id: 1, callFrame: { functionName: 'fetch', url: 'worker.js', lineNumber: 0, columnNumber: 0 } },
+      { id: 2, callFrame: { functionName: 'heavyLoop', url: 'worker.js', lineNumber: 10, columnNumber: 2 } },
+      { id: 3, callFrame: { functionName: '(garbage collector)', url: '', lineNumber: -1, columnNumber: -1 } },
+    ],
+    samples: [1, 2, 2, 3],
+    timeDeltas: [100, 1200, 800, 400],
+  };
+  const summary = summarizeCloudflareCpuProfile(profile);
+  assert.equal(summary.top_frames[0].function, 'heavyLoop');
+  assert.equal(summary.top_frames[0].self_us, 2000);
+  assert.equal(summary.garbage_collection_ms, 0.4);
+  assert.match(summary.timer_semantics, /do not advance during CPU-only execution/);
+});
+
+test('CPU profile file cannot escape runtime cwd', () => {
+  const root = tempRoot();
+  fs.writeFileSync(path.join(root, 'profile.cpuprofile'), JSON.stringify({ nodes: [], samples: [], timeDeltas: [] }));
+  assert.equal(summarizeCloudflareCpuProfileFile({ cwd: root, file: 'profile.cpuprofile' }).file, 'profile.cpuprofile');
+  assert.throws(() => summarizeCloudflareCpuProfileFile({ cwd: root, file: '../profile.cpuprofile' }), /outside_cwd/);
+});
+
+test('explicitly executable experimental Cloudflare capabilities enter cards-first discovery without exposing unavailable commands', () => {
+  const adapter = createCapabilityAdapter();
+  const rows = adapter.toolDescriptors();
+  const ids = rows.map((row) => row.name);
+  assert.ok(ids.includes('cloudflare.wrangler.native'));
+  assert.ok(ids.includes('cloudflare.cpu.profile'));
+  assert.ok(!ids.includes('cloudflare.cpu.audit'));
+  assert.ok(!ids.includes('blender.build'));
+  assert.equal(rows.find((row) => row.name === 'cloudflare.wrangler.native').risk, 'read');
+});