@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.3

package/test/integration/cms-site-tenancy-contract.test.mjs

@@ -0,0 +1,256 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { assertProjectSlug, createCmsDbClient } from '../../apps/local-studio/backend/worker/cms-db.js';
+import { injectSitePartials, fetchSitePartial, putSitePartial } from '../../apps/local-studio/backend/worker/site-partials.js';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const at = (...parts) => path.join(root, ...parts);
+const read = (...parts) => fs.readFileSync(at(...parts), 'utf8');
+
+test('CMS D1 query helper strictly enforces projectSlug tenancy invariant', () => {
+  // Empty or invalid projectSlug must throw immediately
+  assert.throws(() => assertProjectSlug(''), /CMS Tenancy Invariant Violation/);
+  assert.throws(() => assertProjectSlug('   '), /CMS Tenancy Invariant Violation/);
+  assert.throws(() => assertProjectSlug(null), /CMS Tenancy Invariant Violation/);
+  assert.throws(() => assertProjectSlug(undefined), /CMS Tenancy Invariant Violation/);
+  assert.throws(() => createCmsDbClient({}, ''), /CMS Tenancy Invariant Violation/);
+
+  assert.equal(assertProjectSlug('agentsam-sdk'), 'agentsam-sdk');
+});
+
+test('CMS D1 queries all enforce project-scoped tenancy without cross-tenant leaks', async () => {
+  const capturedQueries = [];
+  const mockDb = {
+    prepare(query) {
+      return {
+        bind(...args) {
+          capturedQueries.push({ query, args });
+          return {
+            async all() {
+              if (query.includes('FROM cms_pages WHERE project_slug = ?')) {
+                return { results: [{ id: 'page_test', project_slug: 'agentsam-sdk', title: 'Test' }] };
+              }
+              if (query.includes('FROM cms_pages WHERE id = ? AND project_slug = ?')) {
+                return { results: [{ id: args[0], project_slug: 'agentsam-sdk', title: 'Test' }] };
+              }
+              if (query.includes('SELECT s.id FROM cms_page_sections s')) {
+                return { results: [{ id: 'sec_test' }] };
+              }
+              if (query.includes('SELECT b.* FROM cms_section_components b')) {
+                return { results: [{ id: 'blk_test', component_type: 'card', component_data: '{}' }] };
+              }
+              if (query.includes('SELECT s.* FROM cms_page_sections s')) {
+                return { results: [{ id: 'sec_test', section_name: 'Test', section_data: '{}' }] };
+              }
+              return { results: [] };
+            },
+            async run() {
+              return { success: true };
+            },
+          };
+        },
+      };
+    },
+  };
+
+  const client = createCmsDbClient(mockDb, 'agentsam-sdk');
+
+  await client.getProject();
+  await client.getPages();
+  await client.getPageById('page_123');
+  await client.getSectionsForPage('page_123');
+  await client.getAllSectionsForSite();
+  await client.getAllBlocksForSite();
+  await client.getBlocksForSection('sec_123');
+  await client.getThemeOverrides();
+  await client.getLiquidImports();
+  await client.getActivity();
+  await client.getTemplates();
+
+  // Audit every captured query
+  for (const { query, args } of capturedQueries) {
+    const hasProjectSlugConstraint =
+      query.includes('project_slug') ||
+      query.includes('iam_project_slug') ||
+      query.includes('project_id') ||
+      query.includes('projects WHERE id = ?');
+    assert.ok(
+      hasProjectSlugConstraint,
+      `Query must enforce project scoping: ${query}`,
+    );
+    assert.ok(
+      args.some((arg) => typeof arg === 'string' && (arg.includes('agentsam-sdk') || arg.includes('agentsam_sdk'))),
+      `Args must bind project slug: ${JSON.stringify(args)} for ${query}`,
+    );
+  }
+});
+
+test('Local Studio package.json explicitly declares client-cms-editor dependencies', () => {
+  const pkgPath = at('apps', 'local-studio', 'frontend', 'package.json');
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+
+  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-frontend'], 'missing @inneranimalmedia/agentsam-cms-frontend');
+  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-backend'], 'missing @inneranimalmedia/agentsam-cms-backend');
+  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-shared'], 'missing @inneranimalmedia/agentsam-cms-shared');
+
+  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-frontend'], 'file:../../client-cms-editor/frontend');
+  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-backend'], 'file:../../client-cms-editor/backend');
+  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-shared'], 'file:../../client-cms-editor/shared/cms');
+});
+
+test('Local Studio mounts CMS route with default site agentsam-sdk', () => {
+  assert.ok(fs.existsSync(at('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx')));
+  const routeContent = read('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx');
+
+  // Must default to agentsam-sdk
+  assert.match(routeContent, /"agentsam-sdk"/);
+  assert.doesNotMatch(routeContent, /default\s*:\s*["']inneranimalmedia["']/);
+
+  // Must use same-origin relative basePath
+  assert.match(routeContent, /basePath="\/cms"/);
+
+  // NavRail must include CMS entry
+  const navRail = read('apps', 'local-studio', 'frontend', 'src', 'components', 'shell', 'nav-rail.tsx');
+  assert.match(navRail, /to:\s*"\/cms"/);
+  assert.match(navRail, /label:\s*"CMS"/);
+});
+
+test('Local Studio Worker dispatches /api/cms/* with strict tenant isolation', () => {
+  const workerContent = read('apps', 'local-studio', 'backend', 'worker', 'index.js');
+  assert.match(workerContent, /url\.pathname\.startsWith\("\/api\/cms\/"\)/);
+  assert.match(workerContent, /handleCmsWorkerRequest/);
+
+  const cmsService = read('apps', 'local-studio', 'backend', 'worker', 'cms-service.js');
+  // Default fallback must be agentsam-sdk, never inneranimalmedia
+  assert.match(cmsService, /'agentsam-sdk'/);
+  assert.match(cmsService, /createCmsDbClient\(env\.DB,\s*siteSlug\)/);
+});
+
+test('homepage.html is decomposed into reusable site partials with relative links and edge injection markers', () => {
+  assert.ok(fs.existsSync(at('sites', 'agentsam-sdk', 'partials', 'header.html')));
+  assert.ok(fs.existsSync(at('sites', 'agentsam-sdk', 'partials', 'footer.html')));
+  assert.ok(fs.existsSync(at('apps', 'frontend', 'public', 'site', 'global', 'asbd-header.html')));
+  assert.ok(fs.existsSync(at('apps', 'frontend', 'public', 'site', 'global', 'asbd-footer.html')));
+
+  const header = read('sites', 'agentsam-sdk', 'partials', 'header.html');
+  const footer = read('sites', 'agentsam-sdk', 'partials', 'footer.html');
+  const homepage = read('apps', 'frontend', 'public', 'site', 'homepage.html');
+
+  // Header and footer are non-empty
+  assert.ok(header.length > 500, 'header.html must contain full header content');
+  assert.ok(footer.length > 500, 'footer.html must contain full footer content');
+
+  // Relative navigation links (R2 partial SSOT)
+  assert.match(header, /href="\/work"/);
+  assert.match(header, /href="\/about"/);
+  assert.match(header, /href="\/services"/);
+  assert.match(header, /href="\/contact"/);
+  assert.match(header, /href="\/auth\/login\?next=\/agentsam"/);
+  assert.doesNotMatch(header, /href="https:\/\/inneranimalmedia\.com\/(work|about|services|contact)"/);
+
+  assert.match(footer, /href="\/work"/);
+  assert.match(footer, /href="\/about"/);
+  assert.match(footer, /href="\/services"/);
+  assert.match(footer, /href="\/contact"/);
+  assert.match(footer, /href="\/privacy"/);
+  assert.match(footer, /href="\/terms"/);
+  assert.match(footer, /href="\/sitemap"/);
+  assert.doesNotMatch(footer, /href="https:\/\/inneranimalmedia\.com\/(work|about|services|contact|privacy|terms|sitemap)"/);
+
+  // Public homepage shell uses ASBD mounts + client inject of global partials
+  // (R2 sites/{site}/partials remain the publish/edge SSOT via publish-website-assets).
+  assert.match(homepage, /id="asbd-header-mount"/);
+  assert.match(homepage, /id="asbd-footer-mount"/);
+  assert.match(homepage, /inject\('asbd-header-mount',\s*'\/site\/global\/asbd-header\.html'\)/);
+  assert.match(homepage, /inject\('asbd-footer-mount',\s*'\/site\/global\/asbd-footer\.html'\)/);
+  assert.doesNotMatch(homepage, /<nav class="iam-sidenav" id="iamSidenav"/, 'inline sidenav should be in partials');
+});
+
+function r2Stub(store = new Map()) {
+  return {
+    async get(key) {
+      if (!store.has(key)) return null;
+      return { text: async () => store.get(key) };
+    },
+    async put(key, content) {
+      store.set(key, typeof content === 'string' ? content : String(content));
+      return { key };
+    },
+    async head() {
+      return null;
+    },
+    async list() {
+      return { objects: [] };
+    },
+  };
+}
+
+test('site-partials service injects header and footer from R2 into HTML response', async () => {
+  const store = new Map();
+  store.set('sites/agentsam-sdk/partials/header.html', '<header id="injected-header">Header Content</header>');
+  store.set('sites/agentsam-sdk/partials/footer.html', '<footer id="injected-footer">Footer Content</footer>');
+
+  const env = { WEBSITE_ASSETS: r2Stub(store) };
+
+  // Fetch and put partials
+  const fetchedHeader = await fetchSitePartial(env, 'agentsam-sdk', 'header');
+  assert.equal(fetchedHeader, '<header id="injected-header">Header Content</header>');
+
+  await putSitePartial(env, 'agentsam-sdk', 'header', '<header id="updated">Updated</header>');
+  const updatedHeader = await fetchSitePartial(env, 'agentsam-sdk', 'header');
+  assert.equal(updatedHeader, '<header id="updated">Updated</header>');
+
+  // Test HTML injection
+  const baseHtml = '<!DOCTYPE html><html><head><title>Test</title></head><body><main>Main Content</main></body></html>';
+  const initialResponse = new Response(baseHtml, {
+    headers: { 'content-type': 'text/html; charset=utf-8' },
+  });
+
+  const injectedResponse = await injectSitePartials(initialResponse, env, 'agentsam-sdk');
+  const transformedText = await injectedResponse.text();
+
+  assert.ok(transformedText.includes('<header id="updated">Updated</header>'), 'Response must contain injected header');
+  assert.ok(transformedText.includes('<footer id="injected-footer">Footer Content</footer>'), 'Response must contain injected footer');
+  assert.ok(transformedText.includes('<main>Main Content</main>'), 'Response must preserve main content');
+
+  // Verify non-text/html responses are guarded and untouched
+  const jsonResponse = new Response(JSON.stringify({ ok: true }), {
+    headers: { 'content-type': 'application/json' },
+  });
+  const unedited = await injectSitePartials(jsonResponse, env, 'agentsam-sdk');
+  assert.equal(await unedited.text(), JSON.stringify({ ok: true }));
+});
+
+test('Local Studio canonical homepage serves with edge HTMLRewriter partial injection and text/html', async () => {
+  const { serveCanonicalHomepage } = await import('../../apps/local-studio/backend/worker/canonical-homepage.js');
+
+  const store = new Map([
+    ['sites/agentsam-sdk/partials/header.html', '<header id="live-header">SDK Header</header>'],
+    ['sites/agentsam-sdk/partials/footer.html', '<footer id="live-footer">SDK Footer</footer>'],
+  ]);
+  const env = { WEBSITE_ASSETS: r2Stub(store) };
+
+  const rootReq = new Request('https://agentsam.inneranimalmedia.com/', { method: 'GET' });
+  const rootRes = await serveCanonicalHomepage(rootReq, env, 'agentsam-sdk');
+  assert.equal(rootRes.status, 200);
+  assert.ok(rootRes.headers.get('content-type')?.includes('text/html'), 'Content type must be text/html');
+  const rootText = await rootRes.text();
+  assert.ok(rootText.includes('<header id="live-header">SDK Header</header>'), 'Edge injection must inject header at /');
+  assert.ok(rootText.includes('<footer id="live-footer">SDK Footer</footer>'), 'Edge injection must inject footer at /');
+  assert.ok(rootText.includes('@inneranimalmedia/agentsam-sdk'), 'Canonical homepage content must be present');
+
+  // Verify index.js routes / and /index.html to serveCanonicalHomepage
+  const indexJsContent = fs.readFileSync(at('apps/local-studio/backend/worker/index.js'), 'utf8');
+  assert.ok(
+    indexJsContent.includes('serveCanonicalHomepage(request, env)'),
+    'index.js must call serveCanonicalHomepage for root route'
+  );
+  assert.ok(
+    indexJsContent.includes('url.pathname === "/" || url.pathname === "/index.html"'),
+    'index.js must match both / and /index.html'
+  );
+});
+

package/test/integration/core-client.integration.test.mjs

@@ -0,0 +1,55 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { getJson } from '../../src/lib/core-client.js';
+import { saveAccountSession } from '../../src/lib/account-session.js';
+
+test('core client accepts an already-resolved browser OAuth bearer without reclassifying it as an API key', async () => {
+  let authorization = '';
+  const result = await getJson('/api/sdk/context', {
+    bearer: 'browser_oauth_access_token',
+    env: { IAM_OAUTH_ISSUER: 'https://iam.example.test' },
+    fetchImpl: async (_url, options) => {
+      authorization = options.headers.Authorization;
+      return { ok: true, async json() { return { ok: true }; } };
+    },
+  });
+  assert.equal(result.ok, true);
+  assert.equal(authorization, 'Bearer browser_oauth_access_token');
+});
+
+test('legacy string credential form is treated as a resolved bearer for both API keys and OAuth tokens', async () => {
+  const original = globalThis.fetch;
+  let authorization = '';
+  globalThis.fetch = async (_url, options) => {
+    authorization = options.headers.Authorization;
+    return { ok: true, async json() { return { ok: true }; } };
+  };
+  try {
+    await getJson('/api/sdk/context', 'browser_oauth_access_token');
+    assert.equal(authorization, 'Bearer browser_oauth_access_token');
+  } finally {
+    globalThis.fetch = original;
+  }
+});
+
+test('core client refreshes browser OAuth once when IAM returns 401 before local expiry', async t => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-core-client-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  saveAccountSession({ access_token: 'stale_browser_token', refresh_token: 'refresh_token', expires_in: 3600 }, { home });
+  const seen = [];
+  const result = await getJson('/api/sdk/context', {
+    home,
+    env: { IAM_OAUTH_ISSUER: 'https://iam.example.test' },
+    refreshImpl: async () => ({ access_token: 'fresh_browser_token', refresh_token: 'refresh_token' }),
+    fetchImpl: async (_url, options) => {
+      seen.push(options.headers.Authorization);
+      const ok = seen.length > 1;
+      return { ok, status: ok ? 200 : 401, async json() { return ok ? { ok: true } : { error: 'Unauthorized' }; } };
+    },
+  });
+  assert.equal(result.ok, true);
+  assert.deepEqual(seen, ['Bearer stale_browser_token', 'Bearer fresh_browser_token']);
+});

package/test/integration/error-runtime-rpc.test.mjs

@@ -0,0 +1,71 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  AgentSamError,
+  createErrorEnvelope,
+} from '../../packages/agentsam-errors/src/index.js';
+import {
+  decodeErrorDetail,
+  decodeJob,
+  encodeErrorDetail,
+  encodeJob,
+  fromGrpcError,
+  toGrpcError,
+} from '../../src/knowledge/service/grpc-codec.js';
+
+function sampleEnvelope() {
+  return createErrorEnvelope({
+    reason: 'provider_budget_exhausted',
+    message: 'Provider account budget is exhausted.',
+    source: { kind: 'provider', name: 'openai', service: 'responses' },
+    resolution_owner: 'agentsam',
+    severity: 'blocking_internal',
+    remediation: { action: 'inspect_platform', message: 'AgentSam must inspect its platform-owned OpenAI account.' },
+    domain: 'provider',
+    tool: 'openai',
+    stage: 'request',
+    provider: 'openai',
+    provider_code: 'project_spend_limit_exceeded',
+    request_id: 'req_123',
+    trace_id: 'trace_123',
+    transport: 'grpc',
+    resource: { type: 'provider_account', id: 'platform', name: 'OpenAI' },
+    native: { code: 'project_spend_limit_exceeded', exception_type: 'insufficient_quota' },
+    environment: { component: 'responses', runtime: 'node', platform: 'linux' },
+    details: { tier: 'default' },
+  });
+}
+
+test('protobuf ErrorDetail preserves the canonical AgentSam envelope', () => {
+  const source = sampleEnvelope();
+  const roundTrip = decodeErrorDetail(encodeErrorDetail(source));
+  assert.deepEqual(roundTrip, source);
+});
+
+test('gRPC exception metadata round-trips one canonical AgentSamError', () => {
+  const source = sampleEnvelope();
+  const wireError = toGrpcError(new AgentSamError(source));
+  const decoded = fromGrpcError(wireError);
+  assert.ok(decoded instanceof AgentSamError);
+  assert.deepEqual(decoded.envelope, source);
+  assert.equal(decoded.grpcCode, 8);
+  assert.equal(decoded.rpcCode, 'RESOURCE_EXHAUSTED');
+});
+
+test('durable job protobuf retains structured failure and compatibility message', () => {
+  const failure = sampleEnvelope();
+  const message = encodeJob({
+    id: '11111111-1111-1111-1111-111111111111',
+    status: 'failed',
+    attempts: 2,
+    created_at: '2026-09-17T00:00:00.000Z',
+    updated_at: '2026-09-17T00:01:00.000Z',
+    result: null,
+    failure,
+  });
+  const decoded = decodeJob(message);
+  assert.equal(decoded.status, 'failed');
+  assert.deepEqual(decoded.failure, failure);
+  assert.equal(decoded.error, failure.message);
+});

package/test/integration/features-resolve.test.mjs

@@ -0,0 +1,128 @@
+/**
+ * Feature-packet resolver tests — package-local oauth-login-portal compartment.
+ */
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import {
+  formatResourcesSummary,
+  getIdentityProviderTemplate,
+  loadIdentityResources,
+  loadOAuthLoginPortalFeature,
+  resolveAuthFeature,
+  writeFeatureSelections,
+  writeFeaturesResolved,
+} from '../../src/features/resolve.js';
+
+const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+
+test('oauth-login-portal feature packet loads with artifacts', () => {
+  const feature = loadOAuthLoginPortalFeature();
+  assert.equal(feature.id, 'identity.oauth-login-portal');
+  assert.ok(Array.isArray(feature.artifacts));
+  assert.ok(feature.artifacts.some((a) => a.kind === 'provider-catalog'));
+  assert.ok(!fs.existsSync(path.join(SDK_ROOT, 'protocol/identity')));
+  assert.ok(!fs.existsSync(path.join(SDK_ROOT, 'protocol/features/auth.json')));
+});
+
+test('auth feature resolves real D1 resources, not a pretend iam-d1 profile', () => {
+  const resolved = resolveAuthFeature({
+    selected: true,
+    capabilities: ['identity.init'],
+    provider_template: 'google',
+    selected_at: '2026-09-24T04:25:12.860Z',
+  });
+  assert.equal(resolved.provider_template, 'google');
+  assert.equal(resolved.provider.id, 'google');
+  assert.equal(resolved.provider.status, 'ready');
+  assert.equal(resolved.schema_profile, undefined);
+  assert.equal(resolved.resources.engine, 'd1');
+  assert.deepEqual(resolved.resources.migration_sources, [
+    'src/migrations/0001_identity_core.sql',
+    'src/migrations/0002_company.sql',
+  ]);
+  const names = resolved.resources.tables.map((t) => t.name);
+  assert.deepEqual(names, [
+    'auth_users',
+    'auth_sessions',
+    'account_identities',
+    'oauth_states',
+    'password_reset_tokens',
+    'company',
+  ]);
+  assert.match(formatResourcesSummary(resolved.resources), /tables=auth_users,/);
+  assert.doesNotMatch(formatResourcesSummary(resolved.resources), /iam-d1/);
+});
+
+test('legacy iam provider_template normalizes to inneranimalmedia', () => {
+  const resolved = resolveAuthFeature({
+    selected: true,
+    capabilities: ['identity.init'],
+    provider_template: 'iam',
+  });
+  assert.equal(resolved.provider_template, 'inneranimalmedia');
+  assert.equal(resolved.provider.id, 'inneranimalmedia');
+  assert.equal(resolved.provider.oauth_provider_key, 'iam');
+  assert.equal(resolved.provider.status, 'ready');
+});
+
+test('cloudflare is registered ready in provider catalog', () => {
+  const provider = getIdentityProviderTemplate('cloudflare');
+  assert.equal(provider?.status, 'ready');
+  assert.equal(provider?.registered, true);
+});
+
+test('resources.json indexes D1 tables without owning DDL', () => {
+  const resources = loadIdentityResources();
+  assert.equal(resources.engine, 'd1');
+  assert.deepEqual(resources.migration_sources, [
+    'src/migrations/0001_identity_core.sql',
+    'src/migrations/0002_company.sql',
+  ]);
+  const names = resources.tables.map((t) => t.name);
+  assert.ok(names.includes('auth_users'));
+  assert.ok(names.includes('company'));
+});
+
+test('writeFeatureSelections emits schema_version 2 and resolved snapshot', () => {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-features-'));
+  try {
+    fs.mkdirSync(path.join(cwd, '.agentsam'), { recursive: true });
+    const { state_path, resolved_path, snapshot } = writeFeatureSelections(cwd, {
+      schema_version: 2,
+      features: {
+        auth: {
+          selected: true,
+          capabilities: ['identity.init'],
+          provider_template: 'inneranimalmedia',
+          selected_at: '2026-09-24T04:25:12.860Z',
+        },
+      },
+    });
+    const state = JSON.parse(fs.readFileSync(state_path, 'utf8'));
+    assert.equal(state.schema_version, 2);
+    assert.equal(state.features.auth.provider_template, 'inneranimalmedia');
+    assert.equal(snapshot.features.auth.resources.engine, 'd1');
+    assert.ok(snapshot.features.auth.resources.tables.some((t) => t.name === 'auth_users'));
+    assert.equal(snapshot.features.auth.schema_profile, undefined);
+    assert.ok(fs.existsSync(resolved_path));
+  } finally {
+    fs.rmSync(cwd, { recursive: true, force: true });
+  }
+});
+
+test('sdk project selections resolve against package packet', () => {
+  const { snapshot } = writeFeaturesResolved(SDK_ROOT);
+  assert.equal(snapshot.schema, 'agentsam.features.resolved.v1');
+  assert.equal(snapshot.features.auth.provider_template, 'inneranimalmedia');
+  assert.equal(snapshot.features.auth.feature.id, 'identity.oauth-login-portal');
+  assert.equal(snapshot.features.auth.resources.engine, 'd1');
+  assert.match(
+    formatResourcesSummary(snapshot.features.auth.resources),
+    /auth_users,auth_sessions,account_identities/,
+  );
+});

package/test/integration/install-script.test.mjs

@@ -0,0 +1,107 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const installScript = path.join(root, 'scripts/install.sh');
+
+test('install.sh is a bash npm bootstrap with platform detection', () => {
+  const source = fs.readFileSync(installScript, 'utf8');
+  assert.match(source, /AgentSam installer/);
+  assert.match(source, /npm install --global/);
+  assert.match(source, /Darwin-arm64/);
+  assert.match(source, /--version/);
+  assert.match(source, /--app/);
+  assert.match(source, /standalone_ready/);
+  assert.match(source, /checksum_contract/);
+});
+
+test('install.sh passes bash syntax validation', () => {
+  const result = spawnSync('bash', ['-n', installScript], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+});
+
+test('install.sh maps --app aliases to executable launchers', () => {
+  const cases = [
+    ['cad', 'cad-creator', 'agentsam-cad-creator'],
+    ['cms', 'client-cms-editor', 'agentsam-cms'],
+    ['studio', 'local-studio', 'agentsam-studio'],
+  ];
+
+  for (const [alias, appId, executable] of cases) {
+    const temp = fs.mkdtempSync(path.join(os.tmpdir(), `agentsam-install-${alias}-`));
+    const fakeBin = path.join(temp, 'fake-bin');
+    const installRoot = path.join(temp, 'home');
+    const binDir = path.join(temp, 'bin');
+    fs.mkdirSync(fakeBin, { recursive: true });
+
+    fs.writeFileSync(
+      path.join(fakeBin, 'uname'),
+      '#!/usr/bin/env bash\ncase "$1" in -s) echo Darwin ;; -m) echo arm64 ;; esac\n',
+      { mode: 0o755 },
+    );
+    fs.writeFileSync(
+      path.join(fakeBin, 'node'),
+      '#!/usr/bin/env bash\ncase "$*" in *split*) echo 22 ;; *) echo 22.14.0 ;; esac\n',
+      { mode: 0o755 },
+    );
+    fs.writeFileSync(path.join(fakeBin, 'npm'), '#!/usr/bin/env bash\nexit 0\n', { mode: 0o755 });
+    fs.writeFileSync(
+      path.join(fakeBin, 'agentsam'),
+      '#!/usr/bin/env bash\necho "agentsam 2.6.2"\n',
+      { mode: 0o755 },
+    );
+
+    try {
+      const result = spawnSync('bash', [installScript, '--app', alias, '--prefix', binDir], {
+        encoding: 'utf8',
+        env: {
+          ...process.env,
+          PATH: `${fakeBin}:${process.env.PATH}`,
+          HOME: temp,
+          AGENTSAM_HOME: installRoot,
+        },
+      });
+      assert.equal(result.status, 0, result.stderr);
+
+      const launcherPath = path.join(binDir, executable);
+      const launcher = fs.readFileSync(launcherPath, 'utf8');
+      assert.match(launcher, new RegExp(`app preview ${appId}`));
+      assert.ok((fs.statSync(launcherPath).mode & 0o111) !== 0);
+
+      const receipt = JSON.parse(fs.readFileSync(path.join(installRoot, 'install-receipt.json'), 'utf8'));
+      assert.equal(receipt.app, appId);
+    } finally {
+      fs.rmSync(temp, { recursive: true, force: true });
+    }
+  }
+});
+
+test('install.sh rejects unknown --app values before installation', () => {
+  const result = spawnSync('bash', [installScript, '--app', 'unknown'], { encoding: 'utf8' });
+  assert.equal(result.status, 2);
+  assert.match(result.stderr, /expected cad, cms, or studio/);
+});
+
+test('Local Studio Worker serves standalone installer routes', () => {
+  const worker = fs.readFileSync(
+    path.join(root, 'apps/local-studio/backend/worker/index.js'),
+    'utf8',
+  );
+  const wrangler = fs.readFileSync(
+    path.join(root, 'apps/local-studio/backend/wrangler.jsonc'),
+    'utf8',
+  );
+
+  assert.match(worker, /import installScript from "\.\.\/\.\.\/\.\.\/\.\.\/scripts\/install\.sh"/);
+  assert.match(worker, /"\/install\/cad": "cad-creator"/);
+  assert.match(worker, /"\/install\/cms": "client-cms-editor"/);
+  assert.match(worker, /"\/install\/studio": "local-studio"/);
+  assert.match(worker, /text\/x-shellscript/);
+  assert.match(wrangler, /"type": "Text"/);
+  assert.match(wrangler, /"\*\*\/\*\.sh"/);
+});

package/test/integration/inventory-core.test.mjs

@@ -0,0 +1,53 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  assertModelAvailableForProvider,
+  collectCredentialScopedInventory,
+  filterWorkersAiCurated,
+  makeMapCredentialResolver,
+  sanitizeInventoryForClient,
+} from '../../src/models/inventory-core.js';
+
+test('assertModelAvailableForProvider fails closed on mismatch', () => {
+  assert.throws(
+    () => assertModelAvailableForProvider({ availableModels: [{ provider: 'openai', model_id: 'gpt-x' }] }, 'openai', 'other'),
+    /selected_model_not_available/,
+  );
+  const row = assertModelAvailableForProvider(
+    { availableModels: [{ provider: 'openai', model_id: 'gpt-x', provider_model_id: 'gpt-x' }] },
+    'openai',
+    'gpt-x',
+  );
+  assert.equal(row.model_id, 'gpt-x');
+});
+
+test('vault-scoped inventory sanitizes secrets and discovers only injected providers', async () => {
+  const status = await collectCredentialScopedInventory({
+    credentialPlane: 'studio_vault',
+    resolveCredential: makeMapCredentialResolver(new Map([
+      ['openai', { value: 'sk-secret-should-not-leak', source: 'user_vault' }],
+    ])),
+    fetchImpl: async (url) => {
+      if (String(url).includes('api.openai.com')) {
+        return { ok: true, status: 200, async json() { return { data: [{ id: 'gpt-test' }] }; } };
+      }
+      throw new Error('unexpected ' + url);
+    },
+  });
+  const safe = sanitizeInventoryForClient(status);
+  const text = JSON.stringify(safe);
+  assert.doesNotMatch(text, /sk-secret-should-not-leak/);
+  assert.doesNotMatch(text, /"value"/);
+  assert.equal(safe.credential_plane, 'studio_vault');
+  assert.equal(safe.providers.find((p) => p.id === 'openai')?.source, 'user_vault');
+  assert.deepEqual(safe.availableModels.map((m) => m.model_id), ['gpt-test']);
+  assert.equal(safe.providers.find((p) => p.id === 'gemini')?.configured, false);
+});
+
+test('Workers AI curated filter intersects', () => {
+  const rows = filterWorkersAiCurated([
+    { provider_model_id: '@cf/qwen/qwen2.5-coder-32b-instruct' },
+    { provider_model_id: '@cf/meta/llama-3.2-1b-instruct' },
+  ]);
+  assert.deepEqual(rows.map((r) => r.provider_model_id), ['@cf/qwen/qwen2.5-coder-32b-instruct']);
+});