@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/test/integration/icon-registry.test.mjs

@@ -0,0 +1,67 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  AGENTSAM_ICON_KEYS,
+  normalizeIconKey,
+  isAgentsamIconKey,
+  resolveCliIconGlyph,
+  createIconRenderer,
+  ICON_ALIASES,
+} from '../../protocol/ui/icon-registry.mjs';
+import iconSchema from '../../protocol/ui/icon.v1.schema.json' with { type: 'json' };
+
+describe('agentsam.icon.v1', () => {
+  it('schema enum matches registry keys', () => {
+    assert.deepEqual([...(iconSchema.enum || [])].sort(), [...AGENTSAM_ICON_KEYS].sort());
+  });
+
+  it('includes generic fallback and first-class AgentSam concepts', () => {
+    for (const key of [
+      'generic',
+      'database',
+      'vector',
+      'identity',
+      'key',
+      'brand',
+      'theme',
+      'app',
+      'repository',
+      'connection',
+      'metrics',
+    ]) {
+      assert.equal(isAgentsamIconKey(key), true, key);
+    }
+  });
+
+  it('normalizes aliases and rejects lucide/emoji-like values to generic', () => {
+    assert.equal(normalizeIconKey('db'), 'database');
+    assert.equal(normalizeIconKey('repo'), 'repository');
+    assert.equal(normalizeIconKey('lucide-database'), 'database');
+    assert.equal(normalizeIconKey('🗄️'), 'generic');
+    assert.equal(normalizeIconKey(''), 'generic');
+    assert.equal(normalizeIconKey('unknown-future-key'), 'generic');
+  });
+
+  it('createIconRenderer falls back to generic without throwing', () => {
+    const render = createIconRenderer(
+      { database: 'DB', generic: 'G', identity: 'ID' },
+      'FALLBACK',
+    );
+    assert.equal(render('database'), 'DB');
+    assert.equal(render('db'), 'DB');
+    assert.equal(render('not-a-real-icon'), 'G');
+    assert.equal(render('identity'), 'ID');
+  });
+
+  it('CLI glyphs always resolve', () => {
+    assert.ok(resolveCliIconGlyph('database'));
+    assert.equal(resolveCliIconGlyph('totally-unknown'), resolveCliIconGlyph('generic'));
+  });
+
+  it('aliases only map to canonical vocabulary', () => {
+    for (const [from, to] of Object.entries(ICON_ALIASES)) {
+      assert.equal(isAgentsamIconKey(to), true, `${from} → ${to}`);
+      assert.equal(normalizeIconKey(from), to);
+    }
+  });
+});

package/test/integration/ingest-discover-models.test.mjs

@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  encodeEmbeddingChoice,
+  parseEmbeddingChoice,
+  looksLikeEmbedModel,
+} from '../../src/indexing/ingest/discover-models.js';
+
+describe('ingest model discovery helpers', () => {
+  it('encodes/decodes embedding choices without breaking model ids that contain colons', () => {
+    const value = encodeEmbeddingChoice('ollama', 'mxbai-embed-large:latest', 1024);
+    assert.equal(value, 'ollama|mxbai-embed-large:latest|1024');
+    const parsed = parseEmbeddingChoice(value);
+    assert.equal(parsed.provider, 'ollama');
+    assert.equal(parsed.model, 'mxbai-embed-large:latest');
+    assert.equal(parsed.dimensions, 1024);
+  });
+
+  it('treats none as disabled embedding', () => {
+    const parsed = parseEmbeddingChoice('none');
+    assert.equal(parsed.provider, 'none');
+    assert.equal(parsed.dimensions, 0);
+  });
+
+  it('classifies ollama embed vs chat tags', () => {
+    assert.equal(looksLikeEmbedModel('mxbai-embed-large:latest'), true);
+    assert.equal(looksLikeEmbedModel('nomic-embed-text'), true);
+    assert.equal(looksLikeEmbedModel('qwen2.5-coder:latest'), false);
+  });
+});

package/test/integration/install-script.test.mjs

@@ -0,0 +1,110 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const installScript = path.join(root, 'scripts/install.sh');
+
+test('install.sh is a bash npm bootstrap with platform detection', () => {
+  const source = fs.readFileSync(installScript, 'utf8');
+  assert.match(source, /AgentSam installer/);
+  assert.match(source, /npm install --global/);
+  assert.match(source, /Darwin-arm64/);
+  assert.match(source, /--version/);
+  assert.match(source, /--app-id/);
+  assert.match(source, /--app/);
+  assert.doesNotMatch(source, /APP_SELECTOR="\$\{AGENTSAM_DEFAULT_APP/);
+  assert.match(source, /standalone_ready/);
+  assert.match(source, /checksum_contract/);
+});
+
+test('install.sh passes bash syntax validation', () => {
+  const result = spawnSync('bash', ['-n', installScript], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+});
+
+test('install.sh maps --app-id and legacy --app aliases to executable launchers', () => {
+  const cases = [
+    ['cad', 'cad-creator', 'agentsam-cad-creator'],
+    ['cms', 'client-cms-editor', 'agentsam-cms'],
+    ['studio', 'local-studio', 'agentsam-studio'],
+    ['database-editor', 'database-editor', 'agentsam-database-editor'],
+  ];
+
+  for (const [alias, appId, executable] of cases) {
+    const temp = fs.mkdtempSync(path.join(os.tmpdir(), `agentsam-install-${alias}-`));
+    const fakeBin = path.join(temp, 'fake-bin');
+    const installRoot = path.join(temp, 'home');
+    const binDir = path.join(temp, 'bin');
+    fs.mkdirSync(fakeBin, { recursive: true });
+
+    fs.writeFileSync(
+      path.join(fakeBin, 'uname'),
+      '#!/usr/bin/env bash\ncase "$1" in -s) echo Darwin ;; -m) echo arm64 ;; esac\n',
+      { mode: 0o755 },
+    );
+    fs.writeFileSync(
+      path.join(fakeBin, 'node'),
+      '#!/usr/bin/env bash\ncase "$*" in *split*) echo 22 ;; *) echo 22.14.0 ;; esac\n',
+      { mode: 0o755 },
+    );
+    fs.writeFileSync(path.join(fakeBin, 'npm'), '#!/usr/bin/env bash\nexit 0\n', { mode: 0o755 });
+    fs.writeFileSync(
+      path.join(fakeBin, 'agentsam'),
+      '#!/usr/bin/env bash\necho "agentsam 2.6.2"\n',
+      { mode: 0o755 },
+    );
+
+    try {
+      const flag = alias === 'database-editor' ? '--app-id' : '--app';
+      const result = spawnSync('bash', [installScript, flag, alias, '--prefix', binDir], {
+        encoding: 'utf8',
+        env: {
+          ...process.env,
+          PATH: `${fakeBin}:${process.env.PATH}`,
+          HOME: temp,
+          AGENTSAM_HOME: installRoot,
+        },
+      });
+      assert.equal(result.status, 0, result.stderr);
+
+      const launcherPath = path.join(binDir, executable);
+      const launcher = fs.readFileSync(launcherPath, 'utf8');
+      assert.match(launcher, new RegExp(`app preview ${appId}`));
+      assert.ok((fs.statSync(launcherPath).mode & 0o111) !== 0);
+
+      const receipt = JSON.parse(fs.readFileSync(path.join(installRoot, 'install-receipt.json'), 'utf8'));
+      assert.equal(receipt.app_id, appId);
+      assert.equal(receipt.app, appId);
+    } finally {
+      fs.rmSync(temp, { recursive: true, force: true });
+    }
+  }
+});
+
+test('install.sh rejects unknown --app-id values before installation', () => {
+  const result = spawnSync('bash', [installScript, '--app-id', 'unknown'], { encoding: 'utf8' });
+  assert.equal(result.status, 2);
+  assert.match(result.stderr, /unknown app/);
+});
+
+test('Local Studio Worker serves installer without AGENTSAM_DEFAULT_APP mutation', () => {
+  const worker = fs.readFileSync(
+    path.join(root, 'apps/local-studio/backend/worker/index.js'),
+    'utf8',
+  );
+  const wrangler = fs.readFileSync(
+    path.join(root, 'apps/local-studio/backend/wrangler.jsonc'),
+    'utf8',
+  );
+
+  assert.match(worker, /import installScript from "\.\.\/\.\.\/\.\.\/\.\.\/scripts\/install\.sh"/);
+  assert.doesNotMatch(worker, /APP_SELECTOR="\\\$\{AGENTSAM_DEFAULT_APP/);
+  assert.match(worker, /text\/x-shellscript/);
+  assert.match(wrangler, /"type": "Text"/);
+  assert.match(wrangler, /"\*\*\/\*\.sh"/);
+});

package/test/integration/inventory-core.test.mjs

@@ -0,0 +1,53 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  assertModelAvailableForProvider,
+  collectCredentialScopedInventory,
+  filterWorkersAiCurated,
+  makeMapCredentialResolver,
+  sanitizeInventoryForClient,
+} from '../../src/models/inventory-core.js';
+
+test('assertModelAvailableForProvider fails closed on mismatch', () => {
+  assert.throws(
+    () => assertModelAvailableForProvider({ availableModels: [{ provider: 'openai', model_id: 'gpt-x' }] }, 'openai', 'other'),
+    /selected_model_not_available/,
+  );
+  const row = assertModelAvailableForProvider(
+    { availableModels: [{ provider: 'openai', model_id: 'gpt-x', provider_model_id: 'gpt-x' }] },
+    'openai',
+    'gpt-x',
+  );
+  assert.equal(row.model_id, 'gpt-x');
+});
+
+test('vault-scoped inventory sanitizes secrets and discovers only injected providers', async () => {
+  const status = await collectCredentialScopedInventory({
+    credentialPlane: 'studio_vault',
+    resolveCredential: makeMapCredentialResolver(new Map([
+      ['openai', { value: 'sk-secret-should-not-leak', source: 'user_vault' }],
+    ])),
+    fetchImpl: async (url) => {
+      if (String(url).includes('api.openai.com')) {
+        return { ok: true, status: 200, async json() { return { data: [{ id: 'gpt-test' }] }; } };
+      }
+      throw new Error('unexpected ' + url);
+    },
+  });
+  const safe = sanitizeInventoryForClient(status);
+  const text = JSON.stringify(safe);
+  assert.doesNotMatch(text, /sk-secret-should-not-leak/);
+  assert.doesNotMatch(text, /"value"/);
+  assert.equal(safe.credential_plane, 'studio_vault');
+  assert.equal(safe.providers.find((p) => p.id === 'openai')?.source, 'user_vault');
+  assert.deepEqual(safe.availableModels.map((m) => m.model_id), ['gpt-test']);
+  assert.equal(safe.providers.find((p) => p.id === 'gemini')?.configured, false);
+});
+
+test('Workers AI curated filter intersects', () => {
+  const rows = filterWorkersAiCurated([
+    { provider_model_id: '@cf/qwen/qwen2.5-coder-32b-instruct' },
+    { provider_model_id: '@cf/meta/llama-3.2-1b-instruct' },
+  ]);
+  assert.deepEqual(rows.map((r) => r.provider_model_id), ['@cf/qwen/qwen2.5-coder-32b-instruct']);
+});

package/test/integration/local-fs.test.mjs

@@ -0,0 +1,113 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { describe, it, before, after } from 'node:test';
+import {
+  createLocalFilesystem,
+  createTempWorkspaceRoot,
+  LOCAL_FS_ENGINE,
+} from '../../src/local-fs/index.js';
+import { resolveContainedPath } from '../../src/local-fs/paths.js';
+
+describe('local-fs path containment', () => {
+  /** @type {string} */
+  let root;
+  before(() => {
+    root = createTempWorkspaceRoot();
+    fs.writeFileSync(path.join(root, 'ok.txt'), 'hello\n');
+    fs.mkdirSync(path.join(root, 'sub'));
+  });
+  after(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it('resolves relative paths inside root', () => {
+    const r = resolveContainedPath(root, 'ok.txt');
+    assert.equal(r.ok, true);
+    assert.equal(r.rel, 'ok.txt');
+  });
+
+  it('rejects traversal', () => {
+    const r = resolveContainedPath(root, '../outside.txt');
+    assert.equal(r.ok, false);
+    assert.equal(r.code, 'path_escape');
+  });
+
+  it('rejects NUL', () => {
+    const r = resolveContainedPath(root, 'a\0b.txt');
+    assert.equal(r.ok, false);
+    assert.equal(r.code, 'invalid_path');
+  });
+
+  it('rejects symlink escape when possible', () => {
+    const outside = createTempWorkspaceRoot('agentsam-fs-out-');
+    try {
+      fs.writeFileSync(path.join(outside, 'secret.txt'), 'nope');
+      const link = path.join(root, 'escape-link');
+      try {
+        fs.symlinkSync(path.join(outside, 'secret.txt'), link);
+      } catch {
+        // Windows may lack symlink privilege — skip
+        return;
+      }
+      const r = resolveContainedPath(root, 'escape-link');
+      assert.equal(r.ok, false);
+      assert.equal(r.code, 'path_escape');
+    } finally {
+      fs.rmSync(outside, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('local-fs operations', () => {
+  /** @type {string} */
+  let root;
+  /** @type {ReturnType<typeof createLocalFilesystem>} */
+  let fsApi;
+
+  before(() => {
+    root = createTempWorkspaceRoot();
+    fsApi = createLocalFilesystem(root);
+  });
+  after(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it('create / read / write with version conflict detection', () => {
+    assert.equal(fsApi.engine, LOCAL_FS_ENGINE);
+    const created = fsApi.create('README.md', '# one\n');
+    assert.equal(created.ok, true);
+    const v1 = created.version;
+
+    const read1 = fsApi.read('README.md');
+    assert.equal(read1.ok, true);
+    assert.equal(read1.content, '# one\n');
+    assert.equal(read1.version, v1);
+
+    const conflict = fsApi.write('README.md', '# stale\n', { expectedVersion: 'sha256:dead' });
+    assert.equal(conflict.ok, false);
+    assert.equal(conflict.code, 'version_conflict');
+
+    const wrote = fsApi.write('README.md', '# two\n', { expectedVersion: v1 });
+    assert.equal(wrote.ok, true);
+    assert.notEqual(wrote.version, v1);
+    assert.equal(fs.readFileSync(path.join(root, 'README.md'), 'utf8'), '# two\n');
+  });
+
+  it('list / rename / remove', () => {
+    fsApi.create('a.txt', 'a');
+    fsApi.mkdir('dir');
+    const listed = fsApi.list('.');
+    assert.equal(listed.ok, true);
+    assert.ok(listed.entries.some((e) => e.path === 'a.txt'));
+
+    const renamed = fsApi.rename('a.txt', 'b.txt');
+    assert.equal(renamed.ok, true);
+    assert.ok(fs.existsSync(path.join(root, 'b.txt')));
+    assert.equal(fs.existsSync(path.join(root, 'a.txt')), false);
+
+    const removed = fsApi.remove('b.txt');
+    assert.equal(removed.ok, true);
+    assert.equal(fs.existsSync(path.join(root, 'b.txt')), false);
+  });
+});

package/test/integration/plugins-cloudflare.integration.test.mjs

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  AGENTSAM_MCP_PLUGIN_MANIFEST,
+  INNERANIMALMEDIA_CLOUDFLARE_OAUTH_PLUGIN_MANIFEST,
+} from '../../src/plugins/index.js';
+
+test('Cloudflare OAuth installations have distinct client and callback contracts', () => {
+  assert.equal(AGENTSAM_MCP_PLUGIN_MANIFEST.plugin_key, 'agentsam-mcp');
+  assert.equal(AGENTSAM_MCP_PLUGIN_MANIFEST.auth_type, 'oauth');
+  assert.equal(AGENTSAM_MCP_PLUGIN_MANIFEST.oauth_connect_url, '/api/connections/cloudflare/start');
+  assert.equal(
+    AGENTSAM_MCP_PLUGIN_MANIFEST.config.callback_url,
+    'https://agentsam.inneranimalmedia.com/api/connections/cloudflare/callback',
+  );
+  assert.equal(AGENTSAM_MCP_PLUGIN_MANIFEST.config.token_auth_method, 'none_pkce');
+
+  assert.equal(INNERANIMALMEDIA_CLOUDFLARE_OAUTH_PLUGIN_MANIFEST.plugin_key, 'inneranimalmedia-cf-oauth');
+  assert.equal(INNERANIMALMEDIA_CLOUDFLARE_OAUTH_PLUGIN_MANIFEST.auth_type, 'oauth_via_iam');
+  assert.equal(
+    INNERANIMALMEDIA_CLOUDFLARE_OAUTH_PLUGIN_MANIFEST.oauth_connect_url,
+    'https://inneranimalmedia.com/api/oauth/cloudflare/start',
+  );
+  assert.equal(
+    INNERANIMALMEDIA_CLOUDFLARE_OAUTH_PLUGIN_MANIFEST.config.callback_url,
+    'https://inneranimalmedia.com/api/oauth/cloudflare/callback',
+  );
+});

package/test/integration/provider-env-cli.test.mjs

@@ -13,7 +13,8 @@ test('agentsam env init creates provider profile and reusable source loader', {
   const env = { ...process.env, HOME: home };
   const result = spawnSync(process.execPath, ['src/cli.js', 'env', 'init', 'openai'], { cwd: repoRoot, env, encoding: 'utf8' });
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /source ~\/.agentsam\/load-agent-env\.sh openai/);
+  assert.match(result.stdout, /source ~\/.agentsam\/load-agent-env\.sh(?:\s|$)/);
+  assert.doesNotMatch(result.stdout, /source ~\/.agentsam\/load-agent-env\.sh openai/);
   assert.equal(fs.statSync(path.join(home, '.agentsam', 'env.d', 'openai.env')).mode & 0o777, 0o600);
   assert.equal(fs.statSync(path.join(home, '.agentsam', 'load-agent-env.sh')).mode & 0o777, 0o700);
 });
@@ -29,7 +30,7 @@ test('Cloudflare env init backfills exactly one Wrangler account without printin
     spawnSyncImpl: () => ({ status: 0, stdout: JSON.stringify({ accounts: [{ id: '11111111111111111111111111111111', name: 'Example' }] }), stderr: '' }),
   });
   const profile = fs.readFileSync(path.join(home, '.agentsam', 'env.d', 'cloudflare.env'), 'utf8');
-  assert.match(profile, /ACCOUNT_ID="11111111111111111111111111111111"/);
+  assert.match(profile, /CLOUDFLARE_ACCOUNT_ID="11111111111111111111111111111111"/);
   assert.match(profile, /CLOUDFLARE_API_TOKEN=""/);
   assert.match(output, /account  detected\/configured/);
   assert.doesNotMatch(output, /CLOUDFLARE_API_TOKEN=.*[^ ]/);

package/test/integration/runtime-migrations.test.mjs

@@ -6,13 +6,17 @@ import test from 'node:test';
 import { createLocalSqliteDatabase } from '../../src/local/sqlite.js';
 import { applyRuntimeMigrations } from '../../src/local/migrations.js';
 
+const repoRoot = path.resolve(new URL('../..', import.meta.url).pathname);
+
 test('portable runtime migration installs AgentSam CLI state tables idempotently', async (t) => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-runtime-migration-'));
   t.after(() => fs.rmSync(root, { recursive: true, force: true }));
   const db = await createLocalSqliteDatabase(path.join(root, 'agentsam.sqlite'));
   try {
     const first = await applyRuntimeMigrations(db);
-    assert.equal(first.applied, 1);
+    const migrationCount = fs.readdirSync(path.join(repoRoot, 'migrations', 'runtime'))
+      .filter((name) => /^\d+.*\.sql$/i.test(name)).length;
+    assert.equal(first.applied, migrationCount);
 
     const tables = await db.prepare(
       "SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'agentsam_%' ORDER BY name"
@@ -25,6 +29,7 @@ test('portable runtime migration installs AgentSam CLI state tables idempotently
       'agentsam_context_digest',
       'agentsam_cron_runs',
       'agentsam_plans',
+      'agentsam_project_sessions',
       'agentsam_schema_migrations',
       'agentsam_todo',
     ]) assert.equal(names.has(name), true, name);

package/test/integration/runtime-status.integration.test.mjs

@@ -0,0 +1,211 @@
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import test from 'node:test';
+import {
+  collectCloudflareDeploymentStatus,
+  readCloudflareDeploymentContract,
+  parseWranglerToml,
+  resolveProjectD1Database,
+} from '../../src/cloudflare/runtime-status.js';
+import { collectRuntimeStatus } from '../../src/commands/runtime-status.js';
+import { readProjectConfig } from '../../src/lib/project-config.js';
+import { runStatus } from '../../src/commands/status.js';
+import { renderRuntimeStatus } from '../../src/ui/ansi.js';
+
+const root = path.resolve(new URL('../..', import.meta.url).pathname);
+
+test('checked-in Cloudflare deployment contract resolves the real Worker and portable bindings', () => {
+  const contract = readCloudflareDeploymentContract(root, readProjectConfig(root));
+  assert.equal(contract.worker_name, 'agentsam-sdk');
+  assert.equal(contract.config, 'apps/local-studio/backend/wrangler.jsonc');
+  assert.deepEqual(contract.bindings.map((row) => row.name), [
+    'AGENTSAM_WAI', 'ASSETS', 'DB', 'EXECOS', 'HYPERDRIVE', 'IAM_CLIENT_ID',
+    'IAM_OAUTH_ISSUER', 'PTY_SERVICE', 'WEBSITE_ASSETS',
+  ]);
+});
+
+test('Cloudflare runtime status compares the active deployed version to the checked-in binding contract', async () => {
+  const projectConfig = readProjectConfig(root);
+  const contract = readCloudflareDeploymentContract(root, projectConfig);
+  const liveBindings = contract.bindings.map((row) => ({ name: row.name, type: row.type }));
+  liveBindings.push({ name: 'OPENAI_API_KEY', type: 'secret_text' });
+  const calls = [];
+  const result = await collectCloudflareDeploymentStatus({
+    root,
+    projectConfig,
+    runWrangler: async (command, input) => {
+      calls.push({ command, input });
+      if (command === 'whoami') return { data: { loggedIn: true } };
+      if (command === 'deployments.list') return { data: [{ id: 'dep_1', created_on: '2026-09-18T12:00:00Z', versions: [{ version_id: 'ver_1', percentage: 100 }] }] };
+      if (command === 'versions.list') return { data: [{ id: 'ver_1', metadata: { created_on: '2026-09-18T12:00:00Z' } }] };
+      if (command === 'versions.view') return { data: { id: 'ver_1', number: 37, metadata: { created_on: '2026-09-18T12:00:00Z', source: 'wrangler' }, resources: { bindings: liveBindings } } };
+      throw new Error(`unexpected:${command}`);
+    },
+    fetchImpl: async () => ({ ok: true, status: 200, async json() { return { ok: true, app: 'agentsam-sdk' }; } }),
+  });
+  assert.equal(result.connected, true);
+  assert.equal(result.bindings.match, true);
+  assert.equal(result.version.number, 37);
+  assert.equal(result.health.ok, true);
+  assert.equal(calls.find((row) => row.command === 'versions.view').input.version_id, 'ver_1');
+});
+
+test('unified status is ready only when account, model, terminal, deployment and health are real', async () => {
+  const local = {
+    root, project: 'agentsam-sdk', configured: true, git: { branch: 'main', revision: 'abc123', dirty: false },
+    pty: { online: false, url: 'http://127.0.0.1:3099/health' }, api: { online: false }, db: { ready: true, tables: [] },
+  };
+  const status = await collectRuntimeStatus({
+    cwd: root,
+    collectLocal: async () => local,
+    collectIdentity: async () => ({ authenticated: true, active_auth: { kind: 'browser_oauth' }, identity: { account_id: 'acct_1' }, api_key: {} }),
+    collectModels: async () => ({ providers: [{ id: 'openai', configured: true }], providerModels: { openai: [{ provider_model_id: 'gpt-test' }] }, local: { online: false, models: [] } }),
+    collectTerminal: async () => ({ connected: true, instances: [{ id: 'inst_1' }], connections: [{ id: 'conn_1', active: true, default: true, health: 'online' }], error: null }),
+    collectCloudflare: async () => ({ configured: true, connected: true, worker_name: 'agentsam-sdk', bindings: { match: true, live: [] }, health: { ok: true, status: 200 } }),
+  });
+  assert.equal(status.ready, true);
+  assert.equal(status.local_ready, true);
+  assert.equal(status.state_storage.actor_runtime, 'none');
+  assert.deepEqual(status.checks, { account: true, models: true, terminal: true, cloudflare: true });
+  assert.equal(status.model_summary.verified_provider_models, 1);
+});
+
+test('fresh local project can start before SQLite has been initialized', async () => {
+  const status = await collectRuntimeStatus({
+    cwd: root,
+    collectLocal: async () => ({ root, project: 'agentsam-sdk', configured: false, git: null, pty: { online: false }, api: {}, db: { exists: false, ready: false } }),
+    collectIdentity: async () => ({ authenticated: false, active_auth: {}, api_key: {} }),
+    collectModels: async () => ({ providers: [], providerModels: {}, local: { online: false, models: [] } }),
+    collectCloudflare: async () => ({ configured: false, bindings: { live: [] } }),
+  });
+  assert.equal(status.local_ready, true);
+  assert.equal(status.state_storage.migrated, false);
+  assert.equal(status.state_storage.runtime, 'sqlite');
+});
+
+test('unified status consumes the CLI-authorized terminal inventory returned by IAM context', async () => {
+  let legacyTerminalCalls = 0;
+  const status = await collectRuntimeStatus({
+    cwd: root,
+    collectLocal: async () => ({ root, project: 'agentsam-sdk', configured: true, git: null, pty: { online: false }, api: {}, db: {} }),
+    collectIdentity: async () => ({
+      authenticated: true,
+      active_auth: { kind: 'browser_oauth' },
+      api_key: {},
+      terminal: {
+        available: true,
+        instances: [{ id: 'inst_1', kind: 'local_device' }],
+        connections: [{ id: 'conn_1', instance_id: 'inst_1', is_active: true, is_default: true, health_status: 'online' }],
+      },
+    }),
+    collectModels: async () => ({ providers: [], providerModels: { openai: [{ provider_model_id: 'gpt-test' }] }, local: { online: false, models: [] } }),
+    collectTerminal: async () => { legacyTerminalCalls += 1; return { connected: false, instances: [], connections: [] }; },
+    collectCloudflare: async () => ({ configured: false }),
+  });
+  assert.equal(legacyTerminalCalls, 0);
+  assert.equal(status.terminal.active_connection_count, 1);
+  assert.equal(status.checks.terminal, true);
+});
+
+test('status command supports machine-readable injected runtime status', async () => {
+  const expected = { schema_version: 'agentsam-runtime-status-v1', ready: true };
+  let output = '';
+  const result = await runStatus(['--json'], { collectRuntime: async () => expected, write(value) { output += value; } });
+  assert.equal(result, expected);
+  const parsed = JSON.parse(output);
+  assert.equal(parsed.schema_version, expected.schema_version);
+  assert.equal(parsed.ready, expected.ready);
+  assert.ok(parsed.next?.actions?.length > 0);
+  assert.ok(parsed.next?.headline);
+});
+
+test('renderRuntimeStatus explicitly displays DB and other resource bindings', () => {
+  const status = {
+    local: { project: 'agentsam-sdk', root: '/path/to/project' },
+    ready: true,
+    local_ready: true,
+    checks: { account: true, models: true, terminal: true, cloudflare: true },
+    cloudflare: {
+      configured: true,
+      worker_name: 'agentsam-sdk',
+      version: { number: 43 },
+      bindings: {
+        match: true,
+        live: [
+          { name: 'DB', type: 'd1', database_name: 'inneranimalmedia-business' },
+          { name: 'WEBSITE_ASSETS', type: 'r2_bucket', bucket_name: 'agentsam-os-blueprint-content' },
+          { name: 'AGENTSAM_WAI', type: 'ai' },
+          { name: 'IAM_CLIENT_ID', type: 'plain_text' },
+          { name: 'OPENAI_API_KEY', type: 'secret_text' },
+        ],
+        declared: [
+          { name: 'DB', type: 'd1', database_name: 'inneranimalmedia-business' },
+          { name: 'WEBSITE_ASSETS', type: 'r2_bucket', bucket_name: 'agentsam-os-blueprint-content' },
+          { name: 'AGENTSAM_WAI', type: 'ai' },
+        ],
+        resources: [
+          { name: 'DB', type: 'd1', database_name: 'inneranimalmedia-business' },
+          { name: 'WEBSITE_ASSETS', type: 'r2_bucket', bucket_name: 'agentsam-os-blueprint-content' },
+          { name: 'AGENTSAM_WAI', type: 'ai' },
+        ],
+        runtime_variables: [{ name: 'IAM_CLIENT_ID', type: 'plain_text' }],
+        runtime_secrets: [{ name: 'OPENAI_API_KEY', type: 'secret_text' }],
+        missing: [],
+      },
+      health: { ok: true, status: 200 },
+    },
+  };
+
+  const stripAnsi = (text) => String(text || '').replace(/\x1B\[[0-9;]*[a-zA-Z]/g, '');
+  const rendered = stripAnsi(renderRuntimeStatus(status));
+  assert.match(rendered, /bindings\s+.*5 live/);
+  assert.match(rendered, /• DB · d1 \(inneranimalmedia-business\)/);
+  assert.match(rendered, /• WEBSITE_ASSETS · r2 \(agentsam-os-blueprint-content\)/);
+  assert.match(rendered, /• AGENTSAM_WAI · ai/);
+  assert.match(rendered, /1 vars · 1 secrets/);
+});
+
+test('parseWranglerToml parses worker name, d1 databases, r2, hyperdrive, and vars', () => {
+  const sample = `
+name = "my-sample-worker"
+main = "src/index.js"
+
+[vars]
+ENVIRONMENT = "production"
+PORT = 8080
+
+[[d1_databases]]
+binding = "DB"
+database_name = "sample-production-db"
+database_id = "d1-uuid-123"
+
+[[r2_buckets]]
+binding = "UPLOADS"
+bucket_name = "sample-bucket"
+
+[[hyperdrive]]
+binding = "HYPERDRIVE"
+id = "hd-uuid-456"
+
+[ai]
+binding = "AI"
+`;
+
+  const parsed = parseWranglerToml(sample);
+  assert.equal(parsed.name, 'my-sample-worker');
+  assert.equal(parsed.vars.ENVIRONMENT, 'production');
+  assert.equal(parsed.vars.PORT, 8080);
+  assert.equal(parsed.d1_databases.length, 1);
+  assert.equal(parsed.d1_databases[0].binding, 'DB');
+  assert.equal(parsed.d1_databases[0].database_name, 'sample-production-db');
+  assert.equal(parsed.r2_buckets.length, 1);
+  assert.equal(parsed.r2_buckets[0].binding, 'UPLOADS');
+  assert.equal(parsed.hyperdrive.length, 1);
+  assert.equal(parsed.hyperdrive[0].binding, 'HYPERDRIVE');
+  assert.equal(parsed.ai.binding, 'AI');
+});
+
+test('resolveProjectD1Database discovers project DB binding from checked-in config', () => {
+  const resolved = resolveProjectD1Database(root);
+  assert.equal(resolved, 'inneranimalmedia-business');
+});