@inneranimalmedia/agentsam-sdk 2.5.0 → 2.6.1

package/test/integration/merkle-cli.test.mjs

@@ -0,0 +1,61 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const cli = fileURLToPath(new URL('../../src/cli.js', import.meta.url));
+
+async function fixture(t) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'agentsam-merkle-cli-test-'));
+  t.after(() => fs.rm(root, { recursive: true, force: true }));
+  return root;
+}
+
+async function write(root, name, content = name) {
+  await fs.mkdir(path.dirname(path.join(root, name)), { recursive: true });
+  await fs.writeFile(path.join(root, name), content);
+}
+
+function run(args, cwd) {
+  return spawnSync(process.execPath, [cli, 'merkle', ...args], {
+    cwd,
+    encoding: 'utf8',
+    timeout: 15000,
+  });
+}
+
+test('CLI snapshot/verify/diff supports JSON, moved roots, and distinct mismatch/error exit codes', async (t) => {
+  const root = await fixture(t), moved = await fixture(t);
+  await write(root, 'a.txt', 'hello');
+  await write(moved, 'a.txt', 'hello');
+
+  const saved = run(['snapshot', '.', '--json'], root);
+  assert.equal(saved.status, 0, saved.stderr);
+  const manifest = JSON.parse(saved.stdout);
+  assert.ok(manifest.output.endsWith('merkle.json'));
+
+  const matching = run(['verify', manifest.output, '--root', moved, '--json'], root);
+  assert.equal(matching.status, 0, matching.stderr);
+  assert.equal(JSON.parse(matching.stdout).equal, true);
+
+  await write(moved, 'a.txt', 'changed');
+  await write(moved, 'b.txt', 'new');
+  const changed = run(['verify', manifest.output, '--root', moved, '--json'], root);
+  assert.equal(changed.status, 1, changed.stderr);
+  assert.deepEqual(JSON.parse(changed.stdout).stats, { unchanged: 0, modified: 1, added: 1, removed: 0 });
+
+  const diff = run(['diff', root, moved, '--json'], root);
+  assert.equal(diff.status, 1, diff.stderr);
+
+  const invalid = run(['root', '.', '--typo', '--json'], root);
+  assert.equal(invalid.status, 2);
+  assert.equal(invalid.stdout, '');
+  assert.match(JSON.parse(invalid.stderr).error, /Unknown option/);
+
+  const piped = run(['inspect', '.', '--tui'], root);
+  assert.equal(piped.status, 0, piped.stderr);
+  assert.ok(!piped.stdout.includes('\x1b'));
+});

package/test/integration/merkle-persistence-identity.test.mjs

@@ -0,0 +1,48 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { test } from 'node:test';
+import { resolveMerklePersistenceIdentity } from '../../src/commands/merkle-persist.js';
+
+async function gitFixture(t, remote = null) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'agentsam-merkle-identity-'));
+  t.after(() => fs.rm(root, { recursive: true, force: true }));
+  execFileSync('git', ['init', '-q', root]);
+  if (remote) execFileSync('git', ['-C', root, 'remote', 'add', 'origin', remote]);
+  return root;
+}
+
+test('Merkle persistence identity uses authenticated session + Git provider identity', async (t) => {
+  const root = await gitFixture(t, 'git@github.com:SamPrimeaux/agentsam-sdk.git');
+  const identity = resolveMerklePersistenceIdentity(root, {
+    session: { account_id: 'au_test' },
+    projectConfig: { repository: { id: 'local:should-not-win' } },
+  });
+  assert.deepEqual(identity, {
+    accountId: 'au_test',
+    repositoryId: 'github:samprimeaux/agentsam-sdk',
+    repositoryIdentitySource: 'git',
+  });
+});
+
+test('local repositories fall back to committed project identity', async (t) => {
+  const root = await gitFixture(t);
+  const identity = resolveMerklePersistenceIdentity(root, {
+    session: { account_id: 'au_test' },
+    projectConfig: { repository: { id: 'local:fixture-repository' } },
+  });
+  assert.equal(identity.repositoryId, 'local:fixture-repository');
+  assert.equal(identity.repositoryIdentitySource, 'project_manifest');
+});
+
+test('Merkle persistence refuses unauthenticated ownership', async (t) => {
+  const root = await gitFixture(t, 'https://github.com/SamPrimeaux/agentsam-sdk.git');
+  assert.throws(() => resolveMerklePersistenceIdentity(root, { session: null }), /agentsam_login_required_for_merkle_persistence/);
+});
+
+test('Merkle persistence CLI has no account/repository ownership env shortcuts', async () => {
+  const source = await fs.readFile(new URL('../../src/commands/merkle-persist.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(source, /AGENTSAM_ACCOUNT_ID|AGENTSAM_REPOSITORY_ID|--account-id|--repository-id/);
+});

package/test/integration/provider-env-cli.test.mjs

@@ -0,0 +1,49 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import test from 'node:test';
+
+const repoRoot = path.resolve(new URL('../..', import.meta.url).pathname);
+
+test('agentsam env init creates provider profile and reusable source loader', { skip: process.platform === 'win32' }, t => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-env-cli-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  const env = { ...process.env, HOME: home };
+  const result = spawnSync(process.execPath, ['src/cli.js', 'env', 'init', 'openai'], { cwd: repoRoot, env, encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /source ~\/.agentsam\/load-agent-env\.sh openai/);
+  assert.equal(fs.statSync(path.join(home, '.agentsam', 'env.d', 'openai.env')).mode & 0o777, 0o600);
+  assert.equal(fs.statSync(path.join(home, '.agentsam', 'load-agent-env.sh')).mode & 0o777, 0o700);
+});
+
+
+test('Cloudflare env init backfills exactly one Wrangler account without printing credentials', async t => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-env-cf-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  const { runEnv } = await import('../../src/commands/env.js');
+  let output = '';
+  await runEnv(['init', 'cloudflare'], {
+    home, env: { HOME: home }, write: text => { output += text; },
+    spawnSyncImpl: () => ({ status: 0, stdout: JSON.stringify({ accounts: [{ id: '11111111111111111111111111111111', name: 'Example' }] }), stderr: '' }),
+  });
+  const profile = fs.readFileSync(path.join(home, '.agentsam', 'env.d', 'cloudflare.env'), 'utf8');
+  assert.match(profile, /ACCOUNT_ID="11111111111111111111111111111111"/);
+  assert.match(profile, /CLOUDFLARE_API_TOKEN=""/);
+  assert.match(output, /account  detected\/configured/);
+  assert.doesNotMatch(output, /CLOUDFLARE_API_TOKEN=.*[^ ]/);
+});
+
+
+test('generated loader exports the selected provider profile into the caller shell', { skip: process.platform === 'win32' }, t => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-env-source-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  const env = { ...process.env, HOME: home };
+  let result = spawnSync(process.execPath, ['src/cli.js', 'env', 'init', 'openai'], { cwd: repoRoot, env, encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  fs.writeFileSync(path.join(home, '.agentsam', 'env.d', 'openai.env'), 'export OPENAI_API_KEY="sentinel-provider-key"\
+', { mode: 0o600 });
+  result = spawnSync('bash', ['-lc', 'source "$HOME/.agentsam/load-agent-env.sh" openai && test "$OPENAI_API_KEY" = "sentinel-provider-key"'], { env, encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+});

package/test/integration/provider-factory.test.mjs

@@ -0,0 +1,197 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createProviderAdapter } from '../../src/providers/index.js';
+
+function response(body, status = 200, headers = {}) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: { get(name) { return headers[String(name).toLowerCase()] || null; } },
+    async json() { return body; },
+    async text() { return JSON.stringify(body); },
+  };
+}
+
+test('OpenAI-compatible adapter accepts provider-discovered records and preserves cache key', async () => {
+  let body;
+  const record = {
+    model_key: 'openai:account-model',
+    provider: 'openai',
+    provider_model_id: 'account-model',
+    context_window: 128000,
+    max_output_tokens: 8192,
+    reasoning_efforts: ['auto'],
+    service_tiers: ['default'],
+    capabilities: { responses: true },
+    pricing: null,
+  };
+  const provider = createProviderAdapter({
+    modelRecord: record,
+    credential: { value: 'key' },
+    fetchImpl: async (url, init) => {
+      assert.match(url, /\/v1\/responses$/);
+      body = JSON.parse(init.body);
+      return response({
+        id: 'resp_1',
+        status: 'completed',
+        output_text: 'hello',
+        output: [],
+        usage: { input_tokens: 12, output_tokens: 3, input_tokens_details: { cached_tokens: 5 } },
+      });
+    },
+  });
+  const result = await provider.create({
+    model: record.provider_model_id,
+    modelRecord: record,
+    input: 'hi',
+    reasoningEffort: 'auto',
+    serviceTier: 'default',
+    promptCacheKey: 'session-1',
+  });
+  assert.equal(body.prompt_cache_key, 'session-1');
+  assert.equal(body.reasoning, undefined);
+  assert.equal(result.output_text, 'hello');
+  assert.equal(result.provider_state.previous_response_id, 'resp_1');
+  assert.equal(result.usage_snapshot.current_context.window_tokens, 128000);
+});
+
+
+
+test('xAI adapter supports native compaction without requiring a live API key in tests', async () => {
+  const requests = [];
+  const record = {
+    model_key: 'grok:grok-test',
+    provider: 'grok',
+    provider_model_id: 'grok-test',
+    context_window: 256000,
+    max_output_tokens: 8192,
+    reasoning_efforts: ['auto'],
+    service_tiers: ['default'],
+    capabilities: { responses: true, compaction: true, prompt_caching: true },
+    pricing: null,
+  };
+  const provider = createProviderAdapter({
+    modelRecord: record,
+    credential: { value: 'xai-key' },
+    fetchImpl: async (url, init) => {
+      const body = JSON.parse(init.body);
+      requests.push({ url, body });
+      if (url.endsWith('/responses/compact')) {
+        return response({
+          id: 'cmp_1',
+          object: 'response.compaction',
+          output: [{ type: 'compaction', id: 'cmp_1', encrypted_content: 'opaque' }],
+          usage: { input_tokens: 1000, output_tokens: 120, input_tokens_details: { cached_tokens: 0 } },
+        });
+      }
+      return response({
+        id: 'resp_xai_1',
+        status: 'completed',
+        output_text: 'first answer',
+        output: [{ type: 'message', role: 'assistant', content: [{ type: 'output_text', text: 'first answer' }] }],
+        usage: { input_tokens: 50, output_tokens: 10, input_tokens_details: { cached_tokens: 20 } },
+      });
+    },
+  });
+
+  const first = await provider.create({
+    modelRecord: record,
+    input: 'hello',
+    instructions: 'stable system prefix',
+    promptCacheKey: 'session-xai',
+  });
+  assert.equal(first.provider_state.previous_response_id, 'resp_xai_1');
+  assert.equal(Array.isArray(first.provider_state.compaction_input), true);
+  assert.equal(first.provider_state.compaction_input[0].role, 'system');
+
+  const compacted = await provider.compact({
+    modelRecord: record,
+    providerState: first.provider_state,
+    tokensBefore: 1000,
+  });
+  assert.match(requests.at(-1).url, /\/v1\/responses\/compact$/);
+  assert.equal(Array.isArray(requests.at(-1).body.input), true);
+  assert.equal(requests.at(-1).body.previous_response_id, undefined);
+  assert.deepEqual(compacted.provider_state.compaction_input, [
+    { type: 'compaction', id: 'cmp_1', encrypted_content: 'opaque' },
+  ]);
+  assert.equal(compacted.provider_state.previous_response_id, null);
+
+  await provider.create({
+    modelRecord: record,
+    providerState: compacted.provider_state,
+    input: 'continue after compaction',
+    promptCacheKey: 'session-xai',
+  });
+  assert.deepEqual(requests.at(-1).body.input, [
+    { type: 'compaction', id: 'cmp_1', encrypted_content: 'opaque' },
+    { role: 'user', content: 'continue after compaction' },
+  ]);
+});
+
+
+test('Anthropic adapter keeps append-only provider state and tool calls', async () => {
+  const record = {
+    model_key: 'anthropic:claude-test', provider: 'anthropic', provider_model_id: 'claude-test',
+    context_window: 200000, max_output_tokens: 4096, reasoning_efforts: ['auto'], service_tiers: ['default'], pricing: null,
+  };
+  const provider = createProviderAdapter({
+    modelRecord: record,
+    credential: { value: 'key' },
+    fetchImpl: async () => response({
+      id: 'msg_1', stop_reason: 'tool_use',
+      content: [{ type: 'tool_use', id: 'toolu_1', name: 'as_test', input: { a: 1 } }],
+      usage: { input_tokens: 20, output_tokens: 5, cache_read_input_tokens: 7 },
+    }),
+  });
+  const result = await provider.create({
+    modelRecord: record,
+    input: 'do it',
+    instructions: 'stable prefix',
+    tools: [{ type: 'function', name: 'as_test', description: 'test', parameters: { type: 'object', properties: {} } }],
+  });
+  assert.equal(result.tool_calls[0].call_id, 'toolu_1');
+  assert.equal(result.provider_state.messages.at(-1).role, 'assistant');
+  assert.equal(result.usage_snapshot.cumulative.cached_input_tokens, 7);
+});
+
+test('Gemini adapter maps provider token limits and function calls into AgentSam shape', async () => {
+  const record = {
+    model_key: 'gemini:gemini-test', provider: 'gemini', provider_model_id: 'gemini-test',
+    context_window: 1000000, max_output_tokens: 8192, reasoning_efforts: ['auto'], service_tiers: ['default'], pricing: null,
+  };
+  const provider = createProviderAdapter({
+    modelRecord: record,
+    credential: { value: 'key' },
+    fetchImpl: async () => response({
+      responseId: 'gem_1',
+      candidates: [{ finishReason: 'STOP', content: { role: 'model', parts: [{ functionCall: { name: 'as_test', args: { x: 2 } } }] } }],
+      usageMetadata: { promptTokenCount: 30, candidatesTokenCount: 8, cachedContentTokenCount: 10, thoughtsTokenCount: 2 },
+    }),
+  });
+  const result = await provider.create({ modelRecord: record, input: 'go', tools: [{ type: 'function', name: 'as_test', parameters: { type: 'object' } }] });
+  assert.equal(result.tool_calls[0].name, 'as_test');
+  assert.equal(result.usage_snapshot.current_context.window_tokens, 1000000);
+  assert.equal(result.usage_snapshot.cumulative.reasoning_tokens, 2);
+});
+
+test('Cloudflare adapter executes account-scoped Workers AI through the connected account', async () => {
+  let seen;
+  const record = {
+    model_key: 'cloudflare:@cf/test/model', provider: 'cloudflare', provider_model_id: '@cf/test/model',
+    context_window: null, max_output_tokens: null, reasoning_efforts: ['auto'], service_tiers: ['default'], pricing: null,
+  };
+  const provider = createProviderAdapter({
+    modelRecord: record,
+    credential: { value: 'cf-token', account_id: '1234567890abcdef1234567890abcdef' },
+    fetchImpl: async (url, init) => {
+      seen = { url, headers: init.headers, body: JSON.parse(init.body) };
+      return response({ id: 'cf_1', choices: [{ finish_reason: 'stop', message: { role: 'assistant', content: 'done' } }], usage: { prompt_tokens: 9, completion_tokens: 2 } });
+    },
+  });
+  const result = await provider.create({ modelRecord: record, input: 'go' });
+  assert.match(seen.url, /accounts\/1234567890abcdef1234567890abcdef\/ai\/v1\/chat\/completions$/);
+  assert.equal(seen.headers['cf-aig-gateway-id'], 'default');
+  assert.equal(seen.body.model, '@cf/test/model');
+  assert.equal(result.output_text, 'done');
+});

package/test/integration/repository-company-graph.test.mjs

@@ -0,0 +1,90 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { test } from 'node:test';
+import {
+  COMPANY_REPOSITORY_GRAPH_SCHEMA_VERSION,
+  createRepositoryContract,
+  createRepositoryDependency,
+  createRepositoryIdentity,
+} from '../../packages/agentsam-repository/src/contracts.js';
+
+const root = path.resolve(import.meta.dirname, '../..');
+
+function schema(relative) {
+  return JSON.parse(fs.readFileSync(path.join(root, relative), 'utf8'));
+}
+
+test('portable repository identity is account-independent', () => {
+  const identity = createRepositoryIdentity({
+    repository_id: 'repo_agentsam_sdk',
+    full_name: 'SamPrimeaux/agentsam-sdk',
+    role: 'contract/runtime SDK',
+    default_branch: 'main',
+  });
+  assert.equal(identity.schema_version, COMPANY_REPOSITORY_GRAPH_SCHEMA_VERSION);
+  assert.equal(identity.repository_id, 'repo_agentsam_sdk');
+  assert.equal(Object.hasOwn(identity, 'account_id'), false);
+  assert.throws(() => createRepositoryIdentity({
+    repository_id: 'repo_x', full_name: 'owner/repo', role: 'test', account_id: 'au_test',
+  }), /must not embed account_id/);
+});
+
+test('repository contracts use account and repository SSOT only', () => {
+  const record = createRepositoryContract({
+    id: 'rct_runtime_receipts_v2',
+    account_id: 'au_test',
+    repository_id: 'repo_agentsam_sdk',
+    contract_key: 'runtime-receipts',
+    contract_version: '2',
+    contract_type: 'schema',
+    name: 'Runtime receipts',
+    manifest_path: 'protocol/telemetry',
+    contract_hash: `sha256:${'1'.repeat(64)}`,
+  });
+  assert.equal(record.account_id, 'au_test');
+  assert.equal(record.contract_type, 'schema');
+  assert.equal(record.status, 'active');
+  assert.throws(() => createRepositoryContract({
+    ...record, id: 'bad', workspace_id: 'ws_old',
+  }), /legacy ownership field/);
+});
+
+test('repository dependencies encode cross-repo criticality and failure policy', () => {
+  const edge = createRepositoryDependency({
+    id: 'rdep_iam_execos',
+    account_id: 'au_test',
+    source_repository_id: 'repo_inneranimalmedia',
+    target_repository_id: 'repo_execos',
+    dependency_type: 'runtime',
+    criticality: 'critical',
+    required_version: '1',
+    required_contract_hash: `sha256:${'2'.repeat(64)}`,
+    failure_policy: 'block_deploy',
+  });
+  assert.equal(edge.dependency_type, 'runtime');
+  assert.equal(edge.criticality, 'critical');
+  assert.equal(edge.failure_policy, 'block_deploy');
+  assert.throws(() => createRepositoryDependency({ ...edge, criticality: 'whatever' }), /unsupported criticality/);
+  assert.throws(() => createRepositoryDependency({ ...edge, owner_user_id: 'usr_old' }), /legacy ownership field/);
+});
+
+test('published JSON schemas expose the same ownership boundary', () => {
+  const identity = schema('protocol/repository/repository-identity.schema.json');
+  const contract = schema('protocol/repository/repository-contract.schema.json');
+  const dependency = schema('protocol/repository/repository-dependency.schema.json');
+
+  assert.equal(identity.additionalProperties, false);
+  assert.equal(Object.hasOwn(identity.properties, 'account_id'), false);
+  assert.ok(contract.required.includes('account_id'));
+  assert.ok(contract.required.includes('repository_id'));
+  assert.ok(dependency.required.includes('account_id'));
+  assert.ok(dependency.required.includes('source_repository_id'));
+  assert.ok(dependency.required.includes('target_repository_id'));
+
+  for (const item of [identity, contract, dependency]) {
+    for (const legacy of ['tenant_id', 'workspace_id', 'user_id', 'owner_user_id']) {
+      assert.equal(Object.hasOwn(item.properties, legacy), false, `${legacy} must not be part of ${item.title}`);
+    }
+  }
+});

package/test/integration/runtime-migrations.test.mjs

@@ -0,0 +1,82 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { createLocalSqliteDatabase } from '../../src/local/sqlite.js';
+import { applyRuntimeMigrations } from '../../src/local/migrations.js';
+
+test('portable runtime migration installs AgentSam CLI state tables idempotently', async (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-runtime-migration-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const db = await createLocalSqliteDatabase(path.join(root, 'agentsam.sqlite'));
+  try {
+    const first = await applyRuntimeMigrations(db);
+    assert.equal(first.applied, 1);
+
+    const tables = await db.prepare(
+      "SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'agentsam_%' ORDER BY name"
+    ).all();
+    const names = new Set(tables.results.map((row) => row.name));
+    for (const name of [
+      'agentsam_agent_run',
+      'agentsam_approval_queue',
+      'agentsam_compaction_events',
+      'agentsam_context_digest',
+      'agentsam_cron_runs',
+      'agentsam_plans',
+      'agentsam_schema_migrations',
+      'agentsam_todo',
+    ]) assert.equal(names.has(name), true, name);
+
+    const timers = await db.prepare(
+      "SELECT name FROM sqlite_master WHERE type='table' AND name='active_timers'"
+    ).first();
+    assert.equal(timers.name, 'active_timers');
+
+    const second = await applyRuntimeMigrations(db);
+    assert.equal(second.applied, 0);
+    assert.equal(second.results[0].status, 'already_applied');
+  } finally {
+    db.close();
+  }
+});
+
+test('ephemeral context digests expire and refresh while durable digests stay durable', async (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-digest-migration-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const db = await createLocalSqliteDatabase(path.join(root, 'agentsam.sqlite'));
+  try {
+    await applyRuntimeMigrations(db);
+
+    await db.prepare(
+      "INSERT INTO agentsam_context_digest (id,digest_type,source_hash,digest_hash,digest_text) VALUES (?,?,?,?,?)"
+    ).bind('repo_1', 'repo', 's1', 'h1', 'durable').run();
+    const durable = await db.prepare(
+      'SELECT expires_at_unix FROM agentsam_context_digest WHERE id=?'
+    ).bind('repo_1').first();
+    assert.equal(durable.expires_at_unix, null);
+
+    await db.prepare(
+      "INSERT INTO agentsam_context_digest (id,digest_type,source_hash,digest_hash,digest_text) VALUES (?,?,?,?,?)"
+    ).bind('session_1', 'session', 's2', 'h2', 'ephemeral').run();
+    const initial = await db.prepare(
+      'SELECT expires_at_unix FROM agentsam_context_digest WHERE id=?'
+    ).bind('session_1').first();
+    assert.equal(Number(initial.expires_at_unix) > 0, true);
+
+    await db.prepare(
+      'UPDATE agentsam_context_digest SET expires_at_unix = unixepoch() + 60 WHERE id=?'
+    ).bind('session_1').run();
+    await db.prepare(
+      'UPDATE agentsam_context_digest SET hit_count = hit_count + 1 WHERE id=?'
+    ).bind('session_1').run();
+    const refreshed = await db.prepare(
+      'SELECT expires_at_unix, hit_count FROM agentsam_context_digest WHERE id=?'
+    ).bind('session_1').first();
+    assert.equal(refreshed.hit_count, 1);
+    assert.equal(Number(refreshed.expires_at_unix) > Math.floor(Date.now() / 1000) + 2_500_000, true);
+  } finally {
+    db.close();
+  }
+});

package/test/knowledge-service.test.mjs

@@ -88,6 +88,11 @@ test('portable dockerize stages only SDK runtime, preserves identities/tokens, a
     const context = path.join(result.written.versionDir, 'context');
     assert.equal(fs.existsSync(path.join(context, 'customer-secret.js')), false);
     assert.equal(fs.existsSync(path.join(context, 'src/knowledge/service/server.js')), true);
+    assert.equal(fs.existsSync(path.join(context, 'src/knowledge/service/grpc-server.js')), true);
+    assert.equal(fs.existsSync(path.join(context, 'src/rpc/generated/knowledge_pb.js')), true);
+    assert.equal(fs.existsSync(path.join(context, 'src/rpc/generated/knowledge_grpc_pb.js')), true);
+    assert.equal(fs.existsSync(path.join(context, 'src/rpc/generated/package.json')), true);
+    assert.equal(fs.existsSync(path.join(context, 'src/errors/contract.js')), true);
     assert.equal(fs.existsSync(path.join(context, 'package-lock.json')), true);
     const token = fs.readFileSync(result.tokenFile, 'utf8');
     assert.equal(fs.statSync(result.tokenFile).mode & 0o777, 0o600);

package/test/knowledge.test.mjs

@@ -114,6 +114,22 @@ test('source safety and setup preserve repository files; read-only plan creates
   assert.ok(!paths.includes('.env.js')); assert.ok(!paths.includes('ignored/hidden.ts'));
 });
 
+test('index and search derive safe local defaults when knowledge.json is absent', async t => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-configless-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  execFileSync('git', ['init', '-q'], { cwd: root });
+  execFileSync('git', ['remote', 'add', 'origin', 'git@github.com:ExampleOrg/ConfiglessRepo.git'], { cwd: root });
+  write(root, 'src/real.ts', 'export function configlessSymbol() { return 7; }\n');
+  const run = args => JSON.parse(execFileSync(process.execPath, [cli, ...args], { cwd: root, encoding: 'utf8' }));
+  assert.equal(fs.existsSync(path.join(root, '.agentsam/knowledge.json')), false);
+  const plan = run(['index', 'plan']);
+  assert.ok(plan.files >= 1); assert.equal(plan.embedding_inputs, 0);
+  assert.equal(fs.existsSync(path.join(root, '.agentsam/knowledge.json')), false);
+  assert.equal(run(['index', 'run']).published, true);
+  assert.equal(fs.existsSync(path.join(root, '.agentsam/knowledge.json')), false);
+  assert.equal(run(['search', 'configlessSymbol']).hits[0].path, 'src/real.ts');
+});
+
 test('two independent repositories work through the same CLI and exported package', async t => {
   for (const name of ['customer-a', 'customer-b']) {
     const root = fs.mkdtempSync(path.join(os.tmpdir(), name));

package/test/live/terminal-transport.live.test.mjs

@@ -0,0 +1,24 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { WebSocket } from 'ws';
+
+const liveUrl = String(process.env.AGENTSAM_LIVE_TERMINAL_WS_URL || '').trim();
+
+test('live terminal transport accepts a websocket connection', { skip: !liveUrl }, async (t) => {
+  const ws = new WebSocket(liveUrl, {
+    headers: process.env.AGENTSAM_LIVE_TERMINAL_AUTH
+      ? { authorization: process.env.AGENTSAM_LIVE_TERMINAL_AUTH }
+      : undefined,
+  });
+  t.after(() => { try { ws.close(); } catch {} });
+
+  await Promise.race([
+    new Promise((resolve, reject) => {
+      ws.once('open', resolve);
+      ws.once('error', reject);
+    }),
+    new Promise((_, reject) => setTimeout(() => reject(new Error('live terminal websocket open timed out')), 8000)),
+  ]);
+
+  assert.equal(ws.readyState, WebSocket.OPEN);
+});

package/test/local-sessions.test.mjs

@@ -0,0 +1,48 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { createLocalSession, listLocalSessions, loadLocalSession, saveLocalSession, sessionTitleFromInput } from '../src/lib/local-sessions.js';
+import { renderSessionReceipt } from '../src/commands/shell.js';
+
+function tempHome(t) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-session-home-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  return home;
+}
+
+test('local sessions persist provider-neutral continuation, usage, cost, and last-input title', t => {
+  const home = tempHome(t);
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-session-project-'));
+  t.after(() => fs.rmSync(cwd, { recursive: true, force: true }));
+  let session = createLocalSession({ cwd, last_input: 'Run wrangler whoami' }, { home });
+  assert.match(session.id, /^asess_[0-9a-f-]{36}$/i);
+  session = saveLocalSession({
+    ...session,
+    title: sessionTitleFromInput('Run wrangler whoami'),
+    model_key: 'openai:gpt-6-astra',
+    actual_service_tier: 'fast',
+    provider_state: { provider: 'openai', previous_response_id: 'resp_123' },
+    usage_snapshot: { current_context: { input_tokens: 21_244, window_tokens: 1_050_000 } },
+    cumulative_usage: { input_tokens: 21_244, cached_input_tokens: 60_544, output_tokens: 219, reasoning_tokens: 31 },
+    total_cost_usd: 0.123456,
+    cost_breakdown_usd: { input: 0.08, cached_input: 0.01, cache_write: 0.003456, output: 0.03 },
+    status: 'paused',
+    active_elapsed_ms: 90_000,
+    active_started_at: null,
+  }, { home });
+
+  const loaded = loadLocalSession(session.id, { home });
+  assert.equal(loaded.provider_state.previous_response_id, 'resp_123');
+  assert.equal(loaded.cumulative_usage.cached_input_tokens, 60_544);
+  assert.equal(listLocalSessions({ home, cwd })[0].id, session.id);
+
+  const receipt = renderSessionReceipt(loaded);
+  assert.match(receipt, /Token usage: total=21,463 input=21,244 \(\+ 60,544 cached\) output=219 reasoning=31/);
+  assert.match(receipt, /Spent: \$0\.1235/);
+  assert.match(receipt, /Elapsed: 1m 30s/);
+  assert.match(receipt, /Cost breakdown: input \$0\.0800 · cached \$0\.0100 · cache write \$0\.003456 · output \$0\.0300/);
+  assert.match(receipt, new RegExp(`agentsam resume ${session.id}`));
+  assert.match(receipt, /Run wrangler whoami/);
+});