@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/test/cli/go.test.mjs

@@ -0,0 +1,128 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { discoverGoRuntime, resolveProductRoot, ensureProductContract, buildGoProduct } from '../../src/go/index.js';
+import { runGo } from '../../src/commands/go.js';
+
+const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+
+
+function tempStateRoot() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-go-test-state-'));
+}
+
+test('discoverGoRuntime finds agentsam-go-worker without inventing a sibling', () => {
+  const discovery = discoverGoRuntime(SDK_ROOT);
+  assert.equal(discovery.go.ok, true);
+  assert.ok(discovery.runtime, 'expected Go runtime');
+  assert.match(discovery.runtime.module, /agentsam-go-worker/);
+  assert.equal(path.basename(discovery.runtime.productRoot), 'agentsam-go-worker');
+  const productRoot = resolveProductRoot(discovery, 'agentsam-go-worker');
+  const contract = ensureProductContract(productRoot);
+  assert.equal(contract.product, 'agentsam-go-worker');
+  assert.equal(contract.existing, true);
+  assert.deepEqual(contract.created, []);
+});
+
+test('ensureProductContract refuses missing product roots instead of scaffolding siblings', () => {
+  const missing = path.join(os.tmpdir(), `agentsam-go-missing-${Date.now()}`);
+  assert.throws(() => ensureProductContract(missing), /product_root_missing/);
+});
+
+test('buildGoProduct emits build receipt after go test/vet/build', () => {
+  const discovery = discoverGoRuntime(SDK_ROOT);
+  const productRoot = resolveProductRoot(discovery);
+  const stateRoot = tempStateRoot();
+  const result = buildGoProduct({
+    productRoot,
+    runtimeRoot: discovery.runtime.runtimeRoot,
+    repositoryRoot: discovery.repository_root,
+    stateRoot,
+  });
+  assert.equal(result.receipt.schema, 'agentsam.go-build-receipt.v1');
+  assert.equal(result.tests.ok, true);
+  assert.equal(result.vet.ok, true);
+  assert.ok(result.build.binary);
+  assert.match(result.receipt.artifact.digest, /^sha256:[a-f0-9]{64}$/);
+  assert.equal(result.receipt.tests.runtime_probe, true);
+  assert.match(result.receipt.source.identity, /^git:[a-f0-9]{40}$/);
+  assert.equal(result.probe.checks.source_identity, true);
+  assert.equal(result.probe.checks.source_commit, true);
+  assert.equal(result.probe.checks.error_envelope, true);
+  assert.equal(result.probe.checks.clean_shutdown, true);
+  assert.ok(fs.existsSync(result.receiptPath));
+});
+
+test('agentsam go build --json exposes only portable build paths', async () => {
+  const stateRoot = tempStateRoot();
+  const chunks = [];
+
+  const result = await runGo(
+    ['build', '--json'],
+    {
+      write: (value) => chunks.push(String(value)),
+      stateRoot,
+    },
+  );
+
+  assert.ok(path.isAbsolute(result.receiptPath), 'internal execution keeps absolute receipt path');
+  assert.ok(path.isAbsolute(result.build.binary), 'internal execution keeps absolute binary path');
+
+  const output = chunks.join('');
+  const parsed = JSON.parse(output);
+
+  assert.equal(path.isAbsolute(parsed.receiptPath), false);
+  assert.equal(path.isAbsolute(parsed.build.binary), false);
+  assert.equal(path.isAbsolute(parsed.receipt.runtime.module_root), false);
+  assert.equal(Object.hasOwn(parsed.probe || {}, 'origin'), false);
+  assert.equal(Object.hasOwn(parsed.receipt?.probe || {}, 'origin'), false);
+  assert.equal(output.includes(SDK_ROOT), false);
+});
+
+test('agentsam go --cloudflare agentsam-go-worker --skip-deploy is idempotent', async () => {
+  const stateRoot = tempStateRoot();
+  const chunks = [];
+  const write = (v) => chunks.push(String(v));
+  const first = await runGo(
+    ['--cloudflare', 'agentsam-go-worker', '--skip-deploy', '--json'],
+    { write, stateRoot },
+  );
+  assert.equal(first.ok, true);
+  assert.equal(first.product, 'agentsam-go-worker');
+  assert.equal(first.scaffold_changes_required, false);
+  assert.equal(first.mode, 'self_host');
+  assert.equal(first.deploy.registry.reason, 'self_host_registry_isolated');
+
+  const chunks2 = [];
+  const second = await runGo(
+    ['--cloudflare', 'agentsam-go-worker', '--skip-deploy', '--json'],
+    {
+      write: (v) => chunks2.push(String(v)),
+      stateRoot,
+    },
+  );
+  assert.equal(second.ok, true);
+  assert.equal(second.existing_product, true);
+  assert.equal(second.scaffold_changes_required, false);
+  assert.ok(second.deploy.receiptPath);
+  assert.ok(fs.existsSync(second.deploy.productPath));
+});
+
+test('agentsam go status --json reports discovery', async () => {
+  const stateRoot = tempStateRoot();
+  const chunks = [];
+  const result = await runGo(
+    ['status', '--json'],
+    {
+      write: (v) => chunks.push(String(v)),
+      stateRoot,
+    },
+  );
+  assert.equal(result.ok, true);
+  assert.ok(result.discovery.go.ok);
+  const parsed = JSON.parse(chunks.join(''));
+  assert.equal(parsed.product, 'agentsam-go-worker');
+});

package/test/cli/local-vault-and-provider-setup.test.mjs

@@ -0,0 +1,268 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import {
+  getSecureProviderKey,
+  setSecureProviderKey,
+  deleteSecureProviderKey,
+  listSecureConfiguredProviders,
+  hydrateSecureCredentials,
+  localVaultPath,
+  localVaultSaltPath,
+} from '../../src/security/local-vault.js';
+import { resolveExecutableCommand } from '../../src/security/process.js';
+import {
+  resolveProviderCredential,
+  setProviderCredential,
+  removeProviderCredential,
+  exportProviderEnvProfile,
+} from '../../src/lib/provider-credentials.js';
+import {
+  validateAndSaveProviderCredential,
+  providerChoices,
+  runProviders,
+} from '../../src/commands/providers.js';
+import { renderModelsStatus } from '../../src/commands/models.js';
+
+// picocolors color-detection differs between local runs and CI runners (CI often
+// reports TTY-like support that enables ANSI output) - strip escape codes before
+// asserting on rendered text content so this test checks content, not incidental
+// terminal color state.
+// eslint-disable-next-line no-control-regex
+const ANSI_PATTERN = /\x1B\[[0-9;]*m/g;
+const stripAnsi = (s) => String(s).replace(ANSI_PATTERN, '');
+
+function createTempHome(t) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-vault-test-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  return home;
+}
+
+test('resolveExecutableCommand resolves Windows .cmd shims with shell: true on win32', () => {
+  const npxWin = resolveExecutableCommand('npx', 'win32');
+  assert.equal(npxWin.command, 'npx.cmd');
+  assert.equal(npxWin.shell, true);
+
+  const npmWin = resolveExecutableCommand('npm', 'win32');
+  assert.equal(npmWin.command, 'npm.cmd');
+  assert.equal(npmWin.shell, true);
+
+  const wranglerWin = resolveExecutableCommand('wrangler', 'win32');
+  assert.equal(wranglerWin.command, 'wrangler.cmd');
+  assert.equal(wranglerWin.shell, true);
+
+  const scriptWin = resolveExecutableCommand('build.bat', 'win32');
+  assert.equal(scriptWin.command, 'build.bat');
+  assert.equal(scriptWin.shell, true);
+
+  // Linux and macOS are untouched
+  const npxMac = resolveExecutableCommand('npx', 'darwin');
+  assert.equal(npxMac.command, 'npx');
+  assert.equal(npxMac.shell, false);
+
+  const npmLinux = resolveExecutableCommand('npm', 'linux');
+  assert.equal(npmLinux.command, 'npm');
+  assert.equal(npmLinux.shell, false);
+});
+
+test('local vault encrypts with AES-256-GCM and never writes plaintext secrets to disk', (t) => {
+  const home = createTempHome(t);
+  const opts = { home, disableOsStore: true };
+
+  const secret = 'sk-proj-testsecret1234567890abcdef';
+  setSecureProviderKey('openai', secret, opts);
+
+  const retrieved = getSecureProviderKey('openai', opts);
+  assert.equal(retrieved.value, secret);
+  assert.equal(retrieved.source, 'local_vault');
+
+  // Verify disk contents
+  const encFile = localVaultPath(opts);
+  assert.equal(fs.existsSync(encFile), true);
+  const rawText = fs.readFileSync(encFile, 'utf8');
+
+  // Plaintext MUST NOT appear anywhere in the file
+  assert.equal(rawText.includes(secret), false);
+
+  // Must have JSON with iv, tag, and data
+  const parsed = JSON.parse(rawText);
+  assert.ok(parsed.secrets.openai.iv);
+  assert.ok(parsed.secrets.openai.tag);
+  assert.ok(parsed.secrets.openai.data);
+
+  // Salt file must exist with restrictive permissions
+  const saltFile = localVaultSaltPath(opts);
+  assert.equal(fs.existsSync(saltFile), true);
+  if (process.platform !== 'win32') {
+    assert.equal(fs.statSync(saltFile).mode & 0o777, 0o600);
+    assert.equal(fs.statSync(encFile).mode & 0o777, 0o600);
+  }
+});
+
+test('local vault detects tampering of encrypted ciphertext', (t) => {
+  const home = createTempHome(t);
+  const opts = { home, disableOsStore: true };
+
+  setSecureProviderKey('anthropic', 'sk-ant-test-key-12345', opts);
+
+  // Tamper with the ciphertext
+  const encFile = localVaultPath(opts);
+  const parsed = JSON.parse(fs.readFileSync(encFile, 'utf8'));
+  const originalData = parsed.secrets.anthropic.data;
+  // Flip the last hex byte
+  const tamperedData = originalData.slice(0, -2) + (originalData.slice(-2) === 'aa' ? 'bb' : 'aa');
+  parsed.secrets.anthropic.data = tamperedData;
+  fs.writeFileSync(encFile, JSON.stringify(parsed));
+
+  // Decryption must fail and return null safely rather than corrupt data
+  const retrieved = getSecureProviderKey('anthropic', opts);
+  assert.equal(retrieved, null);
+});
+
+test('local vault stores and retrieves Cloudflare accountId alongside token', (t) => {
+  const home = createTempHome(t);
+  const opts = { home, disableOsStore: true };
+
+  setSecureProviderKey('cloudflare', { value: 'cf-token-123', accountId: 'abcdef0123456789abcdef0123456789' }, opts);
+  const retrieved = getSecureProviderKey('cloudflare', opts);
+
+  assert.equal(retrieved.value, 'cf-token-123');
+  assert.equal(retrieved.accountId, 'abcdef0123456789abcdef0123456789');
+});
+
+test('hydrateSecureCredentials populates process.env for unconfigured providers without overwriting', (t) => {
+  const home = createTempHome(t);
+  const opts = { home, disableOsStore: true };
+
+  setSecureProviderKey('gemini', 'gemini-key-val-789', opts);
+
+  const mockEnv = {
+    EXISTING_KEY: 'pre-existing',
+  };
+
+  const hydrated = hydrateSecureCredentials(mockEnv, opts);
+  assert.ok(hydrated.includes('gemini'));
+  assert.equal(mockEnv.GEMINI_API_KEY, 'gemini-key-val-789');
+
+  // Second run does not overwrite
+  mockEnv.GEMINI_API_KEY = 'user-override';
+  hydrateSecureCredentials(mockEnv, opts);
+  assert.equal(mockEnv.GEMINI_API_KEY, 'user-override');
+});
+
+test('resolveProviderCredential resolves keys from local secure vault across any directory', (t) => {
+  const home = createTempHome(t);
+  const opts = { home, disableOsStore: true };
+
+  setProviderCredential('cursor', 'cur-key-secret-456', opts);
+
+  const resolved = resolveProviderCredential('cursor', { env: {}, home, disableOsStore: true });
+  assert.equal(resolved.configured, true);
+  assert.equal(resolved.value, 'cur-key-secret-456');
+
+  // Deleting removes it
+  removeProviderCredential('cursor', opts);
+  const afterRemove = resolveProviderCredential('cursor', { env: {}, home, disableOsStore: true });
+  assert.equal(afterRemove.configured, false);
+});
+
+test('validateAndSaveProviderCredential rejects invalid key and does NOT persist it', async (t) => {
+  const home = createTempHome(t);
+  const opts = {
+    home,
+    disableOsStore: true,
+    fetchImpl: async () => ({
+      ok: false,
+      status: 401,
+      json: async () => ({ error: { message: 'Incorrect API key provided' } }),
+    }),
+  };
+
+  const result = await validateAndSaveProviderCredential('openai', 'sk-invalid-test-key', opts);
+  assert.equal(result.ok, false);
+  assert.equal(result.saved, false);
+  assert.match(result.error, /Incorrect API key/i);
+
+  // Verify it was NOT stored in the vault!
+  const retrieved = getSecureProviderKey('openai', opts);
+  assert.equal(retrieved, null);
+});
+
+test('validateAndSaveProviderCredential verifies valid key and saves ONLY to local vault without plaintext file', async (t) => {
+  const home = createTempHome(t);
+  const opts = {
+    home,
+    disableOsStore: true,
+    fetchImpl: async () => ({
+      ok: true,
+      status: 200,
+      json: async () => ({
+        data: [{ id: 'gpt-4o' }, { id: 'gpt-4o-mini' }],
+      }),
+    }),
+  };
+
+  const result = await validateAndSaveProviderCredential('openai', 'sk-valid-key-xyz', opts);
+  assert.equal(result.ok, true);
+  assert.equal(result.saved, true);
+  assert.equal(result.model_count, 2);
+
+  // Verify it was saved to local vault
+  const retrieved = getSecureProviderKey('openai', opts);
+  assert.equal(retrieved.value, 'sk-valid-key-xyz');
+
+  // CRITICAL: Plaintext .env profile file MUST NOT be created automatically!
+  const plaintextFile = path.join(home, '.agentsam', 'env.d', 'openai.env');
+  assert.equal(fs.existsSync(plaintextFile), false, 'Plaintext .env file must NOT exist after secure provider setup');
+});
+
+test('exportProviderEnvProfile and agentsam providers export create plaintext .env file ONLY on explicit opt-in', async (t) => {
+  const home = createTempHome(t);
+  const opts = { home, disableOsStore: true };
+
+  // Set up provider key in secure vault
+  setProviderCredential('anthropic', 'sk-ant-test-export-key', opts);
+
+  // Confirm NO plaintext file exists yet
+  const plaintextFile = path.join(home, '.agentsam', 'env.d', 'anthropic.env');
+  assert.equal(fs.existsSync(plaintextFile), false);
+
+  // Explicit opt-in export via CLI command
+  let output = '';
+  const exported = await runProviders(['export', 'anthropic'], {
+    ...opts,
+    write: (text) => { output += text; },
+  });
+
+  assert.equal(exported.provider, 'anthropic');
+  assert.equal(fs.existsSync(plaintextFile), true);
+  const content = fs.readFileSync(plaintextFile, 'utf8');
+  assert.match(content, /ANTHROPIC_API_KEY="sk-ant-test-export-key"/);
+  assert.match(output, /Exported anthropic profile/);
+});
+
+test('renderModelsStatus shows tip: Select your preferred provider when providers are unconfigured', () => {
+  const status = {
+    providers: [
+      { id: 'openai', label: 'OpenAI', configured: false, credential: 'OPENAI_API_KEY' },
+      { id: 'anthropic', label: 'Anthropic', configured: false, credential: 'ANTHROPIC_API_KEY' },
+    ],
+    discovery: {},
+    providerModels: {},
+    local: { online: false, models: [] },
+  };
+
+  const output = stripAnsi(renderModelsStatus(status));
+  assert.match(output, /Tip:\s*Select your preferred provider/i);
+});
+
+test('providerChoices returns valid choice list for select picker', () => {
+  const choices = providerChoices();
+  assert.ok(choices.length >= 6);
+  assert.ok(choices.some((c) => c.value === 'openai'));
+  assert.ok(choices.some((c) => c.value === 'anthropic'));
+  assert.ok(choices.some((c) => c.value === 'gemini'));
+});

package/test/cli/mcp-client.test.mjs

@@ -0,0 +1,245 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import {
+  MCP_PRESETS,
+  deleteMcpServer,
+  fetchExternalClientRegistry,
+  fetchMcpServerCatalog,
+  getClientConfigPath,
+  getClientRegistryCachePath,
+  getServerCatalogCachePath,
+  getSessionToolReceipts,
+  inspectClientAdapter,
+  isClientRegistered,
+  listKnownServers,
+  listMcpServers,
+  listRegisteredClients,
+  readMcpServer,
+  recordToolReceipt,
+  removeServerFromClient,
+  resolveServerPreset,
+  summarizeToolReceipts,
+  syncServerToClient,
+  writeMcpServer,
+} from '../../src/mcp/index.js';
+import { runMcp } from '../../src/commands/mcp.js';
+
+function tempHome() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-mcp-test-'));
+}
+
+test('MCP authority store manages servers under ~/.agentsam/mcp with safe permissions', () => {
+  const home = tempHome();
+  const config = {
+    url: 'https://mcp.inneranimalmedia.com/mcp',
+    auth: { type: 'bearer', token: 'iam_token_abc' },
+    clients: ['cursor', 'claude'],
+  };
+
+  const written = writeMcpServer('inneranimalmedia', config, { home });
+  assert.equal(written.name, 'inneranimalmedia');
+  assert.equal(written.url, 'https://mcp.inneranimalmedia.com/mcp');
+
+  const read = readMcpServer('inneranimalmedia', { home });
+  assert.equal(read.name, 'inneranimalmedia');
+  assert.equal(read.auth.token, 'iam_token_abc');
+  assert.deepEqual(read.clients, ['cursor', 'claude']);
+
+  const list = listMcpServers({ home });
+  assert.equal(list.length, 1);
+  assert.equal(list[0].name, 'inneranimalmedia');
+
+  const deleted = deleteMcpServer('inneranimalmedia', { home });
+  assert.equal(deleted, true);
+  assert.equal(readMcpServer('inneranimalmedia', { home }), null);
+});
+
+test('MCP external client registry recognizes chatgpt, claude, cursor and respects is_active', async () => {
+  const home = tempHome();
+
+  // Baseline seed / cached client list
+  const clients = listRegisteredClients({ home });
+  const keys = clients.map((c) => c.client_key);
+  assert.ok(keys.includes('chatgpt'), 'ChatGPT is recognized in the external client registry');
+  assert.ok(keys.includes('cursor'), 'Cursor is recognized in the external client registry');
+  assert.ok(keys.includes('claude'), 'Claude is recognized in the external client registry');
+  assert.ok(keys.includes('agentsam'), 'AgentSam is recognized in the external client registry');
+
+  assert.equal(isClientRegistered('chatgpt', { home }), true);
+  assert.equal(isClientRegistered('cursor', { home }), true);
+  assert.equal(isClientRegistered('nonexistent_client_xyz', { home }), false);
+
+  // Cache path is created upon writing
+  const cachePath = getClientRegistryCachePath({ home });
+  assert.equal(cachePath.endsWith('client-registry-cache.json'), true);
+});
+
+test('MCP client adapters materialize Cursor, Claude, and ChatGPT configurations cleanly', () => {
+  const home = tempHome();
+  const serverConfig = {
+    url: 'https://mcp.inneranimalmedia.com/mcp',
+    auth: { type: 'bearer', token: 'oauth_cursor_123' },
+  };
+
+  // Pre-seed an existing server in Cursor config to ensure no clobbering
+  const cursorConfigPath = getClientConfigPath('cursor', { home });
+  fs.mkdirSync(path.dirname(cursorConfigPath), { recursive: true });
+  fs.writeFileSync(
+    cursorConfigPath,
+    JSON.stringify({ mcpServers: { other_server: { url: 'http://localhost:8080' } } })
+  );
+
+  // Sync to Cursor
+  const cursorResult = syncServerToClient('cursor', 'inneranimalmedia', serverConfig, { home });
+  assert.equal(cursorResult.synced, true);
+
+  const cursorContent = JSON.parse(fs.readFileSync(cursorConfigPath, 'utf8'));
+  assert.ok(cursorContent.mcpServers.other_server, 'Preserved other server in Cursor config');
+  assert.equal(cursorContent.mcpServers.inneranimalmedia.url, 'https://mcp.inneranimalmedia.com/mcp');
+  assert.equal(cursorContent.mcpServers.inneranimalmedia.headers.Authorization, 'Bearer oauth_cursor_123');
+  assert.equal(cursorContent.mcpServers.inneranimalmedia.headers.Accept, 'application/json, text/event-stream');
+
+  // Inspect Cursor adapter
+  const inspection = inspectClientAdapter('cursor', 'inneranimalmedia', { home });
+  assert.equal(inspection.configured, true);
+  assert.equal(inspection.present, true);
+
+  // Sync to Claude
+  const claudeResult = syncServerToClient('claude', 'inneranimalmedia', serverConfig, { home });
+  assert.equal(claudeResult.synced, true);
+  const claudeConfigPath = getClientConfigPath('claude', { home });
+  const claudeContent = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
+  assert.equal(claudeContent.mcpServers.inneranimalmedia.url, 'https://mcp.inneranimalmedia.com/mcp');
+
+  // Sync to ChatGPT
+  const chatgptResult = syncServerToClient('chatgpt', 'inneranimalmedia', serverConfig, { home });
+  assert.equal(chatgptResult.synced, true);
+  const chatgptConfigPath = getClientConfigPath('chatgpt', { home });
+  assert.ok(fs.existsSync(chatgptConfigPath));
+  const chatgptContent = JSON.parse(fs.readFileSync(chatgptConfigPath, 'utf8'));
+  assert.equal(chatgptContent.name, 'inneranimalmedia');
+  assert.equal(chatgptContent.server_url, 'https://mcp.inneranimalmedia.com/mcp');
+  assert.equal(chatgptContent.schema, 'agentsam.mcp.client-adapter.chatgpt.v1');
+
+  // Sync to AgentSam family adapter (~/.agentsam/mcp.json)
+  const agentsamResult = syncServerToClient('agentsam', 'inneranimalmedia', serverConfig, { home });
+  assert.equal(agentsamResult.synced, true);
+  const agentsamConfigPath = getClientConfigPath('agentsam', { home });
+  assert.equal(agentsamConfigPath, path.join(home, '.agentsam', 'mcp.json'));
+  assert.ok(fs.existsSync(agentsamConfigPath));
+  const agentsamContent = JSON.parse(fs.readFileSync(agentsamConfigPath, 'utf8'));
+  assert.equal(agentsamContent.mcpServers.inneranimalmedia.url, 'https://mcp.inneranimalmedia.com/mcp');
+  assert.equal(agentsamContent.mcpServers.inneranimalmedia.headers.Authorization, 'Bearer oauth_cursor_123');
+
+  // Remove from Cursor
+  const removeResult = removeServerFromClient('cursor', 'inneranimalmedia', { home });
+  assert.equal(removeResult.removed, true);
+  const postRemove = JSON.parse(fs.readFileSync(cursorConfigPath, 'utf8'));
+  assert.equal(postRemove.mcpServers.inneranimalmedia, undefined);
+  assert.ok(postRemove.mcpServers.other_server, 'Still preserved other server');
+
+  // Remove from AgentSam family adapter
+  const removeAgentsam = removeServerFromClient('agentsam', 'inneranimalmedia', { home });
+  assert.equal(removeAgentsam.removed, true);
+  const postRemoveAgentsam = JSON.parse(fs.readFileSync(agentsamConfigPath, 'utf8'));
+  assert.equal(postRemoveAgentsam.mcpServers.inneranimalmedia, undefined);
+
+  // Remove from ChatGPT
+  const removeChatgpt = removeServerFromClient('chatgpt', 'inneranimalmedia', { home });
+  assert.equal(removeChatgpt.removed, true);
+  assert.equal(fs.existsSync(chatgptConfigPath), false);
+});
+
+test('MCP server catalog resolves real registered servers with live health metrics', () => {
+  const home = tempHome();
+  const catalog = listKnownServers({ home });
+  assert.ok(catalog.length >= 8);
+
+  // Cloudflare API server from D1
+  const cfApi = resolveServerPreset('cloudflare-api', { home });
+  assert.ok(cfApi);
+  assert.equal(cfApi.url, 'https://mcp.cloudflare.com/mcp');
+  assert.equal(cfApi.health_status, 'degraded');
+  assert.equal(cfApi.avg_latency_ms, 9);
+
+  // InnerAnimalMedia Main MCP from D1
+  const iam = resolveServerPreset('inneranimalmedia', { home });
+  assert.ok(iam);
+  assert.equal(iam.health_status, 'healthy');
+  assert.equal(iam.avg_latency_ms, 443);
+});
+
+test('MCP telemetry logs tool receipts and computes accurate summaries', () => {
+  const home = tempHome();
+
+  recordToolReceipt({ tool_key: 'github_read', source_client: 'cursor', duration_ms: 120 }, { home });
+  recordToolReceipt({ tool_key: 'mcp:d1_query', source_client: 'cursor_mcp', duration_ms: 45 }, { home });
+  recordToolReceipt({ tool_key: 'terminal_exec', source_client: 'agentsam', duration_ms: 800 }, { home });
+  recordToolReceipt({ tool_key: 'mcp:tool_broken', error_code: 'TIMEOUT', duration_ms: 5000 }, { home });
+
+  const receipts = getSessionToolReceipts({ home });
+  assert.equal(receipts.length, 4);
+
+  const summary = summarizeToolReceipts(receipts);
+  assert.equal(summary.tool_call_count, 4);
+  assert.equal(summary.mcp_call_count, 2);
+  assert.equal(summary.github_call_count, 1);
+  assert.equal(summary.d1_call_count, 1);
+  assert.equal(summary.terminal_call_count, 1);
+  assert.equal(summary.failure_count, 1);
+  assert.equal(summary.success_count, 3);
+});
+
+test('agentsam mcp CLI handles add, list, status, doctor, and remove end-to-end', async () => {
+  const home = tempHome();
+  const logs = [];
+  const write = (str) => logs.push(str);
+
+  // Test --help output surfaces chatgpt and known catalog servers
+  await runMcp(['--help'], { home, write });
+  const helpText = logs.join('\n');
+  assert.ok(helpText.includes('chatgpt'), 'Help text displays ChatGPT as a recognized client');
+  assert.ok(helpText.includes('cloudflare-api'), 'Help text displays cloudflare-api preset');
+  logs.length = 0;
+
+  // Add inneranimalmedia preset for chatgpt client
+  const addRes = await runMcp(
+    ['add', 'inneranimalmedia', '--client', 'chatgpt', '--token', 'test_tok_777', '--json'],
+    { home, write }
+  );
+  assert.equal(addRes.ok, true);
+  assert.equal(addRes.server.name, 'inneranimalmedia');
+  assert.equal(addRes.server.auth.token, 'test_tok_777');
+  assert.equal(addRes.syncedAdapters[0].client, 'chatgpt');
+
+  // List
+  const listRes = await runMcp(['list', '--json'], { home, write });
+  assert.equal(listRes.length, 1);
+  assert.equal(listRes[0].name, 'inneranimalmedia');
+
+  // List catalog
+  const catalogRes = await runMcp(['list', '--catalog', '--json'], { home, write });
+  assert.ok(catalogRes.length >= 8);
+
+  // Status
+  const statusRes = await runMcp(['status', 'inneranimalmedia', '--json'], { home, write });
+  assert.equal(statusRes.name, 'inneranimalmedia');
+  assert.equal(statusRes.hasAuth, true);
+
+  // Doctor includes catalog health data
+  const doctorRes = await runMcp(['doctor', 'inneranimalmedia', '--json'], { home, write });
+  assert.equal(doctorRes.name, 'inneranimalmedia');
+  assert.equal(doctorRes.authConfigured, true);
+  assert.equal(doctorRes.catalogHealth?.health_status, 'healthy');
+
+  // Remove
+  const removeRes = await runMcp(['remove', 'inneranimalmedia', '--client', 'all', '--json'], { home, write });
+  assert.equal(removeRes.deletedAuthority, true);
+
+  const emptyList = await runMcp(['list', '--json'], { home, write });
+  assert.equal(emptyList.length, 0);
+});