@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/src/ui/wireframes.js

@@ -0,0 +1,166 @@
+import pc from 'picocolors';
+
+const ANSI_RE = /\x1b\[[0-9;]*m/g;
+
+export function visibleLength(value) {
+  return String(value ?? '').replace(ANSI_RE, '').length;
+}
+
+export function padVisible(value, width, align = 'left') {
+  const text = String(value ?? '');
+  const len = visibleLength(text);
+  const pad = Math.max(0, width - len);
+  if (align === 'right') return `${' '.repeat(pad)}${text}`;
+  if (align === 'center') {
+    const left = Math.floor(pad / 2);
+    return `${' '.repeat(left)}${text}${' '.repeat(pad - left)}`;
+  }
+  return `${text}${' '.repeat(pad)}`;
+}
+
+export function drawBox(rows, { width = 64, title = '', color = pc.cyan } = {}) {
+  const inner = Math.max(24, width - 2);
+  const titleText = title ? ` ${title} ` : '';
+  const titlePad = Math.max(0, inner - visibleLength(titleText));
+  const lines = [
+    `${color('┌')}${color(titleText)}${color('─'.repeat(titlePad))}${color('┐')}`,
+  ];
+  for (const row of rows) {
+    if (row === '─') {
+      lines.push(`${color('├')}${color('─'.repeat(inner))}${color('┤')}`);
+      continue;
+    }
+    lines.push(`${color('│')}${padVisible(row, inner)}${color('│')}`);
+  }
+  lines.push(`${color('└')}${color('─'.repeat(inner))}${color('┘')}`);
+  return lines.join('\n');
+}
+
+/**
+ * Architecture explorer — reasoning wireframe, not pixels.
+ * Left: tree. Right: package ownership + dependency map.
+ */
+export function renderArchitectureExplorer(input = {}) {
+  const repo = input.repo || 'repository';
+  const git = input.git || { branch: 'main', dirty: false };
+  const tree = input.tree || ['apps/', 'packages/', 'protocol/', 'src/', 'tooling/'];
+  const focus = input.focus || {
+    package: 'protocol',
+    owns: 'wire contracts',
+    runtime: 'none / generated',
+    imported_by: 'client, server, runtime',
+    files: '.proto .ts .rs generated/...',
+  };
+  const deps = input.deps || ['protocol ── client ── app', '            ▲', '            └──── server'];
+  const tabs = input.tabs || ['contracts', 'runtime', 'persistence', 'commands', 'ownership'];
+  const leftW = 18;
+  const rightW = 40;
+  const width = leftW + rightW + 3;
+
+  const header = ` ${repo}  ${git.branch || 'main'} ${git.dirty ? 'dirty' : 'clean'} `;
+  const rows = ['─'];
+  const maxRows = Math.max(tree.length, 6 + deps.length);
+  for (let i = 0; i < maxRows; i += 1) {
+    const left = padVisible(tree[i] ? ` ${tree[i]}` : '', leftW);
+    let right = '';
+    if (i === 0) right = ` package: ${focus.package}`;
+    else if (i === 1) right = ` ${'─'.repeat(Math.min(37, rightW - 2))}`;
+    else if (i === 2) right = ` owns: ${focus.owns}`;
+    else if (i === 3) right = ` runtime: ${focus.runtime}`;
+    else if (i === 4) right = ` imported by: ${focus.imported_by}`;
+    else if (i === 5) right = ' DEPENDENCY MAP';
+    else if (i >= 6 && deps[i - 6]) right = ` ${deps[i - 6]}`;
+    rows.push(`${left}${pc.dim('│')}${padVisible(right, rightW)}`);
+  }
+  rows.push('─');
+  rows.push(` Files: ${focus.files || ''}`);
+  rows.push('─');
+  rows.push(` ${tabs.map((t) => `[${t}]`).join(' ')}`);
+
+  return drawBox(rows, { width, title: header.trim(), color: pc.cyan });
+}
+
+/**
+ * Operation inspector — intent → validate → execute → persist → notify.
+ */
+export function renderOperationInspector(input = {}) {
+  const op = input.operation || 'operation';
+  const opId = input.op_id || 'op_…';
+  const stages = input.stages || ['intent', 'validate', 'execute', 'persist', 'notify'];
+  const actors = input.actors || ['user/agent', 'policy', 'adapter', 'artifact', 'event bus'];
+  const active = Math.max(0, Math.min(stages.length - 1, Number(input.active_index) || 0));
+  const step = input.step || null;
+  const receipt = input.receipt || {};
+
+  const dots = stages.map((_, i) => (i <= active ? pc.green('●') : pc.dim('○'))).join(pc.dim('────────'));
+  const labels = stages.map((s) => padVisible(s, 10)).join(' ');
+  const actorLine = actors.map((a, i) => (i === active ? pc.bold(a) : pc.dim(a))).join(pc.dim('  │  '));
+
+  const rows = [
+    ` Operation: ${pc.bold(op)}  ${pc.dim(opId)}`,
+    '─',
+    ` ${labels}`,
+    ` ${dots}`,
+    ` ${actorLine}`,
+  ];
+  if (step) {
+    rows.push('─');
+    rows.push(` STEP · ${step.name || 'step'}`);
+    if (step.detail) rows.push(` ${pc.dim(step.detail)}`);
+    if (step.artifact) rows.push(` → ${step.artifact}`);
+  }
+  rows.push('─');
+  rows.push(' Receipt:');
+  for (const [key, value] of Object.entries(receipt)) {
+    rows.push(`  ${pc.dim(key + ':')} ${value}`);
+  }
+  return drawBox(rows, { width: 70, title: 'operation inspector', color: pc.magenta });
+}
+
+export function renderGoShipScenery({ product, discovery, deploy, build } = {}) {
+  const arch = renderArchitectureExplorer({
+    repo: 'agentsam-sdk',
+    git: discovery?.git || {},
+    tree: ['apps/', 'packages/', 'protocol/', 'src/go/', 'src/commands/', 'runtime/'],
+    focus: {
+      package: product || 'agentsam-go-worker',
+      owns: 'Go runtime + CF container edge',
+      runtime: 'go/native + worker',
+      imported_by: 'agentsam go, deploy adapter',
+      files: 'main.go wrangler.jsonc Dockerfile contracts/',
+    },
+    deps: [
+      'protocol/go ── src/go ── commands/go',
+      '                 ▲',
+      '                 └──── apps/agentsam-go-worker',
+    ],
+    tabs: ['contracts', 'runtime', 'persistence', 'commands', 'ownership'],
+  });
+
+  const stages = ['intent', 'validate', 'execute', 'persist', 'notify'];
+  let active = 1;
+  if (build?.receipt) active = 2;
+  if (deploy?.deployed || deploy?.skipped_deploy || deploy?.receipt) active = 3;
+  if (deploy?.probes?.ok || deploy?.productPath) active = 4;
+
+  const op = renderOperationInspector({
+    operation: 'go.cloudflare.ship',
+    op_id: product || 'agentsam-go-worker',
+    stages,
+    actors: ['CLI', 'go test', 'container', 'D1/R2 receipts', 'status'],
+    active_index: active,
+    step: {
+      name: 'native Go capability',
+      detail: 'hash + inspect over Worker → Container',
+      artifact: deploy?.url || 'local binary',
+    },
+    receipt: {
+      'source commit': build?.receipt?.source?.commit || discovery?.git?.commit || '—',
+      'build tests': build?.receipt?.tests?.go_test ? 'pass' : '—',
+      'live url': deploy?.url || '—',
+      health: deploy?.receipt?.health || (deploy?.probes?.ok ? 'healthy' : 'pending'),
+    },
+  });
+
+  return `${arch}\n\n${op}`;
+}

package/test/account-session.test.mjs

@@ -12,6 +12,7 @@ import {
   resolveBrowserSessionCredential,
   saveAccountSession,
 } from '../src/lib/account-session.js';
+import { resolveAccountAuthority } from '../src/lib/auth.js';
 
 function tempHome(t) {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-account-'));
@@ -64,6 +65,33 @@ test('explicit/environment aak_ API key outranks browser login while legacy SDK
   );
 });
 
+test('invalid environment API key cannot shadow a valid browser login', t => {
+  const home = tempHome(t);
+  saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
+  const resolved = resolveAccountAuth({ env: { AGENTSAM_API_KEY: 'not-an-aak' }, home });
+  assert.equal(resolved.value, 'browser_session_machine_test');
+  assert.equal(resolved.kind, 'browser_oauth');
+  assert.equal(resolved.fallback_error, 'invalid_api_key_prefix');
+});
+
+test('async IAM authority also falls back from invalid environment key to browser OAuth', async t => {
+  const home = tempHome(t);
+  saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
+  const resolved = await resolveAccountAuthority({ env: { AGENTSAM_API_KEY: 'not-an-aak' }, home });
+  assert.equal(resolved.value, 'browser_session_machine_test');
+  assert.equal(resolved.kind, 'browser_oauth');
+  assert.equal(resolved.fallback_error, 'invalid_api_key_prefix');
+});
+
+test('invalid explicitly supplied API key remains authoritative and fails visibly', t => {
+  const home = tempHome(t);
+  saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
+  const resolved = resolveAccountAuth({ env: {}, explicit: 'not-an-aak', home });
+  assert.equal(resolved.value, '');
+  assert.equal(resolved.error, 'invalid_api_key_prefix');
+  assert.equal(resolved.source, 'explicit');
+});
+
 test('browser session storage refuses reusable aak_ credentials', t => {
   const home = tempHome(t);
   assert.throws(

package/test/apps-scaffold-contract.test.mjs

@@ -81,8 +81,23 @@ test('CAD creator app package is curated for third-party installation', () => {
   assert.equal(manifest.runtime.cloudflare, 'scaffold');
 });
 
+test('client-cms-editor app manifest points to authoritative package name', () => {
+  const pkg = packageJson('apps', 'client-cms-editor');
+  const manifest = JSON.parse(read('apps', 'client-cms-editor', 'agentsam.app.json'));
+
+  assert.equal(pkg.name, '@inneranimalmedia/client-cms-editor');
+  assert.equal(manifest.schema, 'agentsam.app.v1');
+  assert.equal(manifest.id, 'client-cms-editor');
+  assert.equal(manifest.package, pkg.name);
+  assert.equal(manifest.runtime.local_preview, 'ready');
+  assert.equal(manifest.runtime.source_scaffold, 'ready');
+  assert.equal(manifest.runtime.cloudflare, 'ready');
+});
+
 test('CAD creator keeps the robotics runtime lazy and the perception key server-side', () => {
-  const app = read('apps', 'cad-creator', 'frontend', 'src', 'App.tsx');
+  const app = exists('apps', 'cad-creator', 'frontend', 'src', 'app', 'CadCreatorApp.tsx')
+    ? read('apps', 'cad-creator', 'frontend', 'src', 'app', 'CadCreatorApp.tsx')
+    : read('apps', 'cad-creator', 'frontend', 'src', 'App.tsx');
   const lazy = read('apps', 'cad-creator', 'frontend', 'src', 'workspaces', 'robotics', 'lazy.tsx');
   const httpProvider = read('apps', 'cad-creator', 'frontend', 'src', 'lib', 'robotics', 'perception', 'http-provider.ts');
   const perception = read('apps', 'cad-creator', 'backend', 'src', 'robotics', 'perception.ts');

package/test/capabilities.test.mjs

@@ -109,7 +109,7 @@ test('product UX creates a preset project, adds a feature, and inspects before f
   assert.equal(config.schema_version, 2);
   assert.equal(config.project.name, 'demo');
   assert.equal(config.product.preset, 'cms');
-  assert.deepEqual(config.product.features, ['cms', 'knowledge']);
+  assert.deepEqual(config.product.features, ['cms', 'knowledge', 'brand', 'theme']);
   assert.ok(config.product.capabilities.includes('repository.snapshot'));
   assert.match(config.repository.id, /^local:[0-9a-f-]{36}$/);
   assert.equal(config.defaults.runtime, 'local');

package/test/cli/api-key-env-whoami.test.mjs

@@ -0,0 +1,129 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { runEnv } from '../../src/commands/env.js';
+import { ensureAgentEnvLoader, renderEnvShellExports, setProviderCredential } from '../../src/lib/provider-credentials.js';
+import { runApiKey } from '../../src/commands/api-key.js';
+import { collectWhoami } from '../../src/commands/whoami.js';
+
+function tmpHome() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-env-api-'));
+}
+
+test('load-agent-env.sh delegates to agentsam env shell (no plaintext secrets)', () => {
+  const home = tmpHome();
+  const loader = ensureAgentEnvLoader({ home });
+  const source = fs.readFileSync(loader, 'utf8');
+  assert.match(source, /agentsam env shell --profile default/);
+  assert.doesNotMatch(source, /export AGENTSAM_API_KEY=/);
+  assert.doesNotMatch(source, /env\.d\//);
+});
+
+test('env boot-line prints source load-agent-env without provider args', async () => {
+  const home = tmpHome();
+  const result = await runEnv(['boot-line'], { home, write: () => {} });
+  assert.equal(result.command, 'source ~/.agentsam/load-agent-env.sh');
+});
+
+test('env shell emits exports from vault without requiring ambient AGENTSAM_API_KEY', async () => {
+  const home = tmpHome();
+  setProviderCredential('inneranimalmedia', 'aak_testsecretvalue1234567890abcdef', {
+    home,
+    disableOsStore: true,
+  });
+  const result = await runEnv(['shell', '--profile', 'default'], {
+    home,
+    env: {},
+    write: () => {},
+  });
+  assert.match(result.script, /export AGENTSAM_API_KEY=/);
+  assert.ok(result.providers.includes('inneranimalmedia'));
+});
+
+test('renderEnvShellExports prefers vault over empty ambient env', () => {
+  const home = tmpHome();
+  setProviderCredential('cursor', 'cursor_test_key_value_xxxxxxxx', {
+    home,
+    disableOsStore: true,
+  });
+  const result = renderEnvShellExports({ home, env: {}, profile: 'default' });
+  assert.ok(result.providers.includes('cursor'));
+  assert.match(result.script, /export CURSOR_API_KEY=/);
+});
+
+test('api-key create stores secret via host mint response', async () => {
+  const home = tmpHome();
+  const result = await runApiKey(['create', '--name', 'Test Mac', '--store', 'vault', '--activate'], {
+    home,
+    env: {},
+    disableOsStore: true,
+    authorityLoader: async () => ({ value: 'oauth_session_token', kind: 'browser_oauth', source: 'test' }),
+    postJsonImpl: async () => ({
+      ok: true,
+      credential: { id: 'aakcred_1', name: 'Test Mac', prefix: 'aak_abc…', scopes: ['account:read'] },
+      secret_once: 'aak_mintedsecretvalue1234567890abcd',
+    }),
+    write: () => {},
+  });
+  assert.equal(result.ok, true);
+  assert.equal(result.activated, true);
+  assert.equal(result.credential.prefix, 'aak_abc…');
+});
+
+test('whoami surfaces tokenPermissions and authType from context', async () => {
+  const home = tmpHome();
+  const status = await collectWhoami({
+    home,
+    env: {},
+    authorityLoader: async () => ({ value: 'aak_presented', kind: 'api_key', source: 'environment' }),
+    contextLoader: async () => ({
+      user_id: 'au_1',
+      account_id: 'acct_1',
+      email: 'dev@example.test',
+      auth_type: 'api_key',
+      tokenPermissions: ['account:read', 'repository:read', 'models:invoke'],
+      credential: {
+        id: 'aakcred_1',
+        name: 'Sams-iMac',
+        prefix: 'aak_7fm…',
+        environment: 'development',
+        status: 'active',
+      },
+      cloudflare: { ok: true },
+      byok: {},
+      terminal: { available: false, instances: [], connections: [] },
+    }),
+  });
+  assert.equal(status.loggedIn, true);
+  assert.equal(status.authType, 'api_key');
+  assert.deepEqual(status.tokenPermissions, ['account:read', 'repository:read', 'models:invoke']);
+  assert.equal(status.credential.name, 'Sams-iMac');
+  assert.doesNotMatch(JSON.stringify(status), /aak_presented/);
+});
+
+test('repository does not normalize AGENTSAM_DEFAULT_APP', () => {
+  const root = path.resolve(path.dirname(new URL(import.meta.url).pathname), '../..');
+  const hits = [];
+  function walk(dir) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'dist') continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (/\.(js|mjs|ts|tsx|sh|json|md)$/.test(entry.name)) {
+        const text = fs.readFileSync(full, 'utf8');
+        // Allow docs that explicitly forbid the variable.
+        if (/AGENTSAM_DEFAULT_APP/.test(text) && !/no AGENTSAM_DEFAULT_APP|not normalize AGENTSAM_DEFAULT_APP|Remove.*AGENTSAM_DEFAULT_APP|doesNotMatch.*AGENTSAM_DEFAULT_APP|APP_SELECTOR=/.test(text)) {
+          if (/process\.env\.AGENTSAM_DEFAULT_APP|AGENTSAM_DEFAULT_APP\s*\|\||\$\{AGENTSAM_DEFAULT_APP/.test(text)) {
+            hits.push(full);
+          }
+        }
+      }
+    }
+  }
+  walk(path.join(root, 'src'));
+  walk(path.join(root, 'scripts'));
+  walk(path.join(root, 'apps/local-studio/backend'));
+  assert.deepEqual(hits, []);
+});

package/test/cli/codebaseindex-plan-ux.test.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  createCodebaseindexJobGraph,
+  advanceJobGraph,
+  freezePlanJobGraph,
+  formatJobGraphHuman,
+} from '../../src/indexing/ingest/job-graph.js';
+import { classifyTopLevel } from '../../src/indexing/ingest/inventory.js';
+
+describe('codebaseindex job graph plan freeze', () => {
+  it('does not leave → run pointer after plan.dry_run', () => {
+    let g = createCodebaseindexJobGraph();
+    g = advanceJobGraph(g, 'plan.dry_run');
+    assert.equal(g.nodes.find((n) => n.status === 'run')?.id, 'ast.parse');
+    g = freezePlanJobGraph(g, { skipEmbedding: true });
+    assert.equal(g.status, 'planned');
+    assert.equal(g.nodes.filter((n) => n.status === 'run').length, 0);
+    assert.equal(g.nodes.find((n) => n.id === 'embedding.generate')?.status, 'skipped');
+    const text = formatJobGraphHuman(g, { planOnly: true });
+    assert.match(text, /PLANNED FOR RUN/);
+    assert.match(text, /○ ast\.parse/);
+    assert.doesNotMatch(text, /→/);
+  });
+});
+
+describe('inventory path categories', () => {
+  it('classifies source vs dependencies vs generated', () => {
+    assert.equal(classifyTopLevel('src'), 'source');
+    assert.equal(classifyTopLevel('apps'), 'source');
+    assert.equal(classifyTopLevel('docs'), 'docs');
+    assert.equal(classifyTopLevel('node_modules'), 'dependencies');
+    assert.equal(classifyTopLevel('dist'), 'dependencies');
+    assert.equal(classifyTopLevel('generated'), 'generated');
+    assert.equal(classifyTopLevel('.agentsam'), 'config');
+  });
+});

package/test/cli/eval-live.test.mjs

@@ -0,0 +1,219 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import {
+  finishLiveEvalRun,
+  getLiveEvalStatus,
+  startLiveEvalRun,
+} from '../../src/eval/index.js';
+import { recordToolReceipt } from '../../src/mcp/index.js';
+import { runEval } from '../../src/commands/eval.js';
+
+function tempHome() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-live-eval-test-'));
+}
+
+test('live eval lifecycle: start, track receipts, get status, finish', async () => {
+  const home = tempHome();
+
+  // Initially inactive
+  const initialStatus = getLiveEvalStatus({ home });
+  assert.equal(initialStatus.active, false);
+
+  // Start live eval run
+  const run = startLiveEvalRun(
+    {
+      suite: 'sdk-real-work-20260919',
+      case: 'cad-shell-unification',
+      model: 'Muse Spark 1.3',
+      provider: 'cursor',
+      client: 'cursor',
+      reasoning: 'high',
+    },
+    { home }
+  );
+
+  assert.ok(run.run_id.startsWith('evr_'));
+  assert.equal(run.suite_id, 'sdk-real-work-20260919');
+  assert.equal(run.case_id, 'cad-shell-unification');
+  assert.equal(run.model, 'Muse Spark 1.3');
+
+  // Verify starting again fails
+  assert.throws(() => startLiveEvalRun({}, { home }), /live_eval_run_already_active/);
+
+  // Record tool calls into the live session
+  recordToolReceipt({ tool_key: 'github_read', source_client: 'cursor', duration_ms: 50 }, { home });
+  recordToolReceipt({ tool_key: 'mcp:d1_query', source_client: 'cursor_mcp', duration_ms: 12 }, { home });
+  recordToolReceipt({ tool_key: 'terminal_exec', source_client: 'agentsam', duration_ms: 300 }, { home });
+
+  // Status check reflects active state and tool receipts
+  const activeStatus = getLiveEvalStatus({ home });
+  assert.equal(activeStatus.active, true);
+  assert.equal(activeStatus.receipts_summary.tool_call_count, 3);
+  assert.equal(activeStatus.receipts_summary.mcp_call_count, 1);
+
+  // Finish run
+  const result = await finishLiveEvalRun({ home, gate: 'PASS' });
+  assert.equal(result.evalRunRow.id, run.run_id);
+  assert.equal(result.evalRunRow.passed, 1);
+  assert.equal(result.evalRunRow.tool_calls_attempted, 3);
+  assert.equal(result.evalRunRow.tool_calls_succeeded, 3);
+  assert.equal(result.modelObservationRow.id, `obs_${run.run_id}`);
+  assert.equal(result.modelObservationRow.passed, 1);
+
+  // After finish, status is inactive again
+  const postStatus = getLiveEvalStatus({ home });
+  assert.equal(postStatus.active, false);
+});
+
+test('agentsam eval live CLI commands work end-to-end', async () => {
+  const home = tempHome();
+  const logs = [];
+  const write = (str) => logs.push(str);
+
+  // CLI start
+  const startResult = await runEval(
+    ['live', 'start', '--case', 'errors-v1-reconciliation', '--model', 'Muse Spark 1.3', '--json'],
+    { home, write }
+  );
+  assert.ok(startResult.run_id.startsWith('evr_'));
+
+  // Record receipt
+  recordToolReceipt({ tool_key: 'mcp:eval_query', source_client: 'cursor_mcp', duration_ms: 40 }, { home });
+
+  // CLI status
+  const statusResult = await runEval(['live', 'status', '--json'], { home, write });
+  assert.equal(statusResult.active, true);
+  assert.equal(statusResult.receipts_summary.tool_call_count, 1);
+
+  // CLI finish
+  const finishResult = await runEval(['live', 'finish', '--gate', 'PASS', '--json'], { home, write });
+  assert.equal(finishResult.evalRunRow.passed, 1);
+  assert.equal(finishResult.summary.gate_status, 'PASS');
+
+  // Verify non-JSON output formats cleanly
+  const emptyStatus = await runEval(['live', 'status'], { home, write });
+  assert.equal(emptyStatus.active, false);
+});
+
+test('finishLiveEvalRun archives run locally, generates SQL for both tables, and respects configurable tenant/database', async () => {
+  const home = tempHome();
+  const run = startLiveEvalRun(
+    {
+      case: 'cad-render-eval',
+      model: 'Muse Spark 1.3',
+      tenant: 'test-tenant',
+      workspace: 'cad-workspace',
+      user: 'test-user',
+      database: 'test-database',
+    },
+    { home }
+  );
+
+  assert.equal(run.tenant_id, 'test-tenant');
+  assert.equal(run.workspace_id, 'cad-workspace');
+  assert.equal(run.user_id, 'test-user');
+  assert.equal(run.database, 'test-database');
+
+  const result = await finishLiveEvalRun({ home, gate: 'PASS' });
+
+  // 1. Dual record construction
+  assert.equal(result.evalRunRow.tenant_id, 'test-tenant');
+  assert.equal(result.modelObservationRow.tenant_id, 'test-tenant');
+  assert.equal(result.modelObservationRow.workspace_id, 'cad-workspace');
+  assert.equal(result.modelObservationRow.user_id, 'test-user');
+  assert.equal(result.modelObservationRow.status, 'completed');
+  assert.equal(result.modelObservationRow.passed, 1);
+  assert.equal(result.modelObservationRow.expected_markers_total, 1);
+  assert.equal(typeof result.modelObservationRow.output_chars, 'number');
+
+  // 2. Both tables present in generated D1 SQL
+  assert.ok(result.summary.d1_sql.includes('INSERT OR REPLACE INTO agentsam_eval_runs'));
+  assert.ok(result.summary.d1_sql.includes('INSERT OR REPLACE INTO agentsam_model_eval_observations'));
+
+  // 3. Local archive created
+  const archivedRunPath = path.join(home, '.agentsam', 'eval', 'runs', `${run.run_id}.json`);
+  assert.ok(fs.existsSync(archivedRunPath), 'Archived run file must exist locally');
+  const archived = JSON.parse(fs.readFileSync(archivedRunPath, 'utf8'));
+  assert.equal(archived.evalRunRow.id, run.run_id);
+  assert.equal(archived.modelObservationRow.id, `obs_${run.run_id}`);
+});
+
+test('finishLiveEvalRun preserves active run state and receipts if remote persistence fails without --force', async () => {
+  const home = tempHome();
+  const run = startLiveEvalRun({ case: 'resilience-test' }, { home });
+
+  recordToolReceipt({ tool_key: 'git_status', duration_ms: 20 }, { home });
+
+  // Call finish with remote=true pointing to an unreachable endpoint and wrangler fallback disabled
+  const result = await finishLiveEvalRun({
+    home,
+    remote: true,
+    evalEndpoint: 'http://127.0.0.1:1/nonexistent',
+    wranglerFallback: false,
+    timeoutMs: 100,
+  });
+
+  // Verification: remote failure noted, evidence preserved, active run kept intact
+  assert.equal(result.summary.d1_executed, false);
+  assert.equal(result.summary.state_preserved, true);
+  assert.ok(result.summary.d1_error);
+
+  const activeStatus = getLiveEvalStatus({ home });
+  assert.equal(activeStatus.active, true, 'Active run state must be retained when remote persistence fails');
+  assert.equal(activeStatus.receipts_summary.tool_call_count, 1, 'Tool receipts must be preserved when remote persistence fails');
+
+  // Finish with force: true to finalize and clear active run
+  const forcedResult = await finishLiveEvalRun({
+    home,
+    remote: true,
+    evalEndpoint: 'http://127.0.0.1:1/nonexistent',
+    wranglerFallback: false,
+    timeoutMs: 100,
+    force: true,
+  });
+
+  assert.equal(forcedResult.summary.d1_executed, false);
+  const clearedStatus = getLiveEvalStatus({ home });
+  assert.equal(clearedStatus.active, false, 'Forced finish clears active run');
+});
+
+test('finishLiveEvalRun reuses the configured inneranimalmedia MCP bearer for remote persistence', { concurrency: false }, async () => {
+  const home = tempHome();
+  const mcpDir = path.join(home, '.agentsam', 'mcp');
+  fs.mkdirSync(mcpDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(mcpDir, 'inneranimalmedia.json'),
+    JSON.stringify({ auth: { type: 'bearer', token: 'fixture-eval-token' } }),
+  );
+
+  startLiveEvalRun({ case: 'authenticated-remote-eval' }, { home });
+
+  const originalFetch = globalThis.fetch;
+  let authorization = null;
+  try {
+    globalThis.fetch = async (_url, init = {}) => {
+      authorization = new Headers(init.headers).get('Authorization');
+      return new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      });
+    };
+
+    const result = await finishLiveEvalRun({
+      home,
+      remote: true,
+      evalEndpoint: 'https://example.test/api/eval/record',
+      wranglerFallback: false,
+    });
+
+    assert.equal(authorization, 'Bearer fixture-eval-token');
+    assert.equal(result.summary.d1_executed, true);
+    assert.equal(result.summary.persistence_method, 'http_endpoint');
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});