@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/test/integration/tool-runtime.test.mjs

@@ -0,0 +1,124 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  createToolExecutor,
+  createToolRegistry,
+} from '../../src/tools/index.js';
+import {
+  COMPLETEFUL_TOOL_DEFINITIONS,
+  createCompletefulClient,
+  createCompletefulProviderAdapter,
+} from '../../packages/providers/completeful/src/index.js';
+
+test('tool runtime owns idempotency, redacts durable receipts, and emits safe events', async () => {
+  let captured = null;
+  const client = createCompletefulClient({
+    apiKey: 'capp_test_example',
+    fetchImpl: async (url, init) => {
+      captured = { url, init };
+      return new Response(
+        JSON.stringify({
+          id: 'ord_1',
+          email: 'customer@example.com',
+          shipping_address: { line1: 'private street' },
+          notes: 'private note',
+        }),
+        { status: 201, headers: { 'x-request-id': 'req_order_1' } },
+      );
+    },
+  });
+
+  const registry = createToolRegistry({
+    tools: COMPLETEFUL_TOOL_DEFINITIONS,
+    adapters: [createCompletefulProviderAdapter(client)],
+  });
+
+  const recorded = [];
+  const observed = [];
+  let sequence = 0;
+  const executor = createToolExecutor({
+    registry,
+    makeId: (prefix) => `${prefix}_test_${++sequence}`,
+    now: (() => {
+      let value = 1_800_000_000_000;
+      return () => ++value;
+    })(),
+    recordReceipt: (receipt) => recorded.push(receipt),
+    onEvent: (event) => observed.push(event),
+  });
+
+  const result = await executor.execute({
+    toolKey: 'completeful.order.create',
+    accountId: 'acct_1',
+    correlationId: 'corr_1',
+    input: {
+      shop_id: 'shop_1',
+      body: {
+        shipping_address: { line1: 'private street' },
+        email: 'customer@example.com',
+        notes: 'private note',
+        line_items: [{ product_id: 'prod_1', quantity: 1 }],
+      },
+    },
+  });
+
+  assert.equal(result.ok, true);
+  assert.equal(result.output.email, 'customer@example.com');
+  assert.equal(captured.init.headers.get('Idempotency-Key'), result.invocation.id);
+  assert.equal(result.receipt.input.body.email, '[REDACTED]');
+  assert.equal(result.receipt.input.body.shipping_address, '[REDACTED]');
+  assert.equal(result.receipt.output.email, '[REDACTED]');
+  assert.equal(result.receipt.output.shipping_address, '[REDACTED]');
+  assert.equal(recorded.length, 1);
+  assert.equal(observed.length, 1);
+  assert.equal(observed[0].eventKey, 'completeful.order.created');
+  assert.equal(observed[0].payload.output.email, '[REDACTED]');
+  assert.equal(observed[0].causationId, result.invocation.id);
+  assert.equal(observed[0].correlationId, 'corr_1');
+});
+
+test('tool runtime converts provider errors into the canonical AgentSam envelope', async () => {
+  const client = createCompletefulClient({
+    apiKey: 'capp_test_example',
+    fetchImpl: async () =>
+      new Response(
+        JSON.stringify({
+          error: 'too many requests',
+          code: 'rate_limited',
+          request_id: 'req_rate',
+        }),
+        { status: 429 },
+      ),
+  });
+
+  const registry = createToolRegistry({
+    tools: COMPLETEFUL_TOOL_DEFINITIONS,
+    adapters: [createCompletefulProviderAdapter(client)],
+  });
+  const executor = createToolExecutor({
+    registry,
+    makeId: (prefix) => `${prefix}_failure`,
+  });
+
+  const result = await executor.execute({
+    toolKey: 'completeful.catalog.list',
+    input: { limit: 1 },
+  });
+
+  assert.equal(result.ok, false);
+  assert.equal(result.error.reason, 'provider_rate_limited');
+  assert.equal(result.error.code, 'RESOURCE_EXHAUSTED');
+  assert.equal(result.error.provider, 'completeful');
+  assert.equal(result.error.provider_code, 'rate_limited');
+  assert.equal(result.error.request_id, 'req_rate');
+  assert.equal(result.receipt.status, 'failed');
+});
+
+test('registry rejects duplicate tool keys instead of silently shadowing definitions', () => {
+  const definition = COMPLETEFUL_TOOL_DEFINITIONS[0];
+  assert.throws(
+    () => createToolRegistry({ tools: [definition, definition] }),
+    /duplicate tool definition/,
+  );
+});

package/test/integration/tool-schema.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { compileToolSchema, restoreOptionalArguments } from '../../src/providers/tool-schema.js';
+import { createCapabilityAdapter } from '../../src/agent/capability-adapter.js';
+import { createOpenAIResponsesAdapter } from '../../src/providers/openai-responses.js';
+import { createGeminiGenerateContentAdapter } from '../../src/providers/gemini-generate-content.js';
+
+const canonical = { $schema: 'https://json-schema.org/draft/2020-12/schema', $id: 'sample', type: 'object', properties: {
+  text: { type: 'string' }, rows: { type: 'array', items: { type: 'object', properties: { label: { type: 'string', enum: ['x'] } } } },
+  additionalProperties: { type: 'string' },
+}, required: ['text'] };
+
+test('strict compiler recursively closes objects and makes omitted fields nullable without mutating canonical input', () => {
+  const original = structuredClone(canonical);
+  const { providerSchema: s } = compileToolSchema({ provider: 'openai', canonicalSchema: canonical });
+  assert.equal(s.additionalProperties, false);
+  assert.deepEqual(s.required, ['text', 'rows', 'additionalProperties']);
+  assert.equal(s.properties.rows.anyOf[0].items.additionalProperties, false);
+  assert.deepEqual(s.properties.rows.anyOf[0].items.required, ['label']);
+  assert.deepEqual(s.properties.rows.anyOf[0].items.properties.label.anyOf, [{ type: 'string', enum: ['x'] }, { type: 'null' }]);
+  assert.deepEqual(canonical, original);
+  assert.deepEqual(restoreOptionalArguments({ text: 'x', rows: [{ label: null }], additionalProperties: null }, canonical), { text: 'x', rows: [{}] });
+});
+
+test('all executable capability schemas compile for both providers, including actual knowledge.search arguments', () => {
+  for (const descriptor of createCapabilityAdapter().toolDescriptors()) {
+    for (const provider of ['openai', 'gemini']) assert.ok(compileToolSchema({ provider, canonicalSchema: descriptor.input_schema, strict: descriptor.strict !== false, name: descriptor.name }).hash);
+    if (descriptor.name === 'knowledge.search') assert.equal(descriptor.input_schema.properties.text.type, 'string');
+  }
+});
+
+test('bad schemas fail before provider fetch, with actionable paths', async () => {
+  for (const schema of [
+    { type: 'object', properties: {}, required: ['missing'] },
+    { type: 'object', properties: { x: { $ref: 'https://remote/schema' } } },
+    { type: 'object', properties: { x: { type: 'array' } } },
+    { type: 'object', properties: { x: { type: 'invalid' } } },
+  ]) {
+    let requests = 0;
+    const adapter = createOpenAIResponsesAdapter({ apiKey: 'test', fetchImpl: async () => { requests++; } });
+    await assert.rejects(adapter.create({ model: 'gpt-6-astra', input: 'test', tools: [{ type: 'function', name: 'broken', parameters: schema }] }), /tool_schema_invalid:openai:broken:/);
+    assert.equal(requests, 0);
+  }
+});
+
+test('Gemini uses JSON Schema declaration field and preserves canonical optionality', async () => {
+  let body;
+  const adapter = createGeminiGenerateContentAdapter({ apiKey: 'test', fetchImpl: async (_, init) => {
+    body = JSON.parse(init.body);
+    return { ok: true, json: async () => ({ candidates: [{ content: { role: 'model', parts: [{ text: 'ok' }] } }] }) };
+  } });
+  await adapter.create({ modelRecord: { provider: 'gemini', provider_model_id: 'fixture' }, input: 'test', tools: [{ name: 'sample', parameters: canonical }] });
+  const declaration = body.tools[0].functionDeclarations[0];
+  assert.equal(declaration.parameters, undefined);
+  assert.equal(declaration.parametersJsonSchema.$schema, undefined);
+  assert.equal(declaration.parametersJsonSchema.$id, undefined);
+  assert.deepEqual(declaration.parametersJsonSchema.required, ['text']);
+  assert.equal(declaration.parametersJsonSchema.properties.additionalProperties.type, 'string');
+});

package/test/knowledge-service.test.mjs

@@ -93,6 +93,10 @@ test('portable dockerize stages only SDK runtime, preserves identities/tokens, a
     assert.equal(fs.existsSync(path.join(context, 'src/rpc/generated/knowledge_grpc_pb.js')), true);
     assert.equal(fs.existsSync(path.join(context, 'src/rpc/generated/package.json')), true);
     assert.equal(fs.existsSync(path.join(context, 'src/errors/contract.js')), true);
+    assert.equal(fs.existsSync(path.join(context, 'packages/agentsam-errors/src/index.js')), true);
+    assert.equal(fs.existsSync(path.join(context, 'packages/agentsam-errors/package.json')), true);
+    assert.equal(fs.existsSync(path.join(context, 'packages/agentsam-repository/src/merkle/hash.js')), true);
+    assert.match(result.plan.files.dockerfile, /COPY packages \.\/packages/);
     assert.equal(fs.existsSync(path.join(context, 'package-lock.json')), true);
     const token = fs.readFileSync(result.tokenFile, 'utf8');
     assert.equal(fs.statSync(result.tokenFile).mode & 0o777, 0o600);

package/test/local-sessions.test.mjs

@@ -12,12 +12,14 @@ function tempHome(t) {
   return home;
 }
 
-test('local sessions persist provider-neutral continuation, usage, cost, and last-input title', t => {
+test('local sessions persist safe continuation, usage, cost, and an explicit title', t => {
   const home = tempHome(t);
   const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-session-project-'));
   t.after(() => fs.rmSync(cwd, { recursive: true, force: true }));
   let session = createLocalSession({ cwd, last_input: 'Run wrangler whoami' }, { home });
   assert.match(session.id, /^asess_[0-9a-f-]{36}$/i);
+  assert.equal(session.title, 'Agent Sam session');
+  assert.equal(session.last_input, null);
   session = saveLocalSession({
     ...session,
     title: sessionTitleFromInput('Run wrangler whoami'),
@@ -33,10 +35,17 @@ test('local sessions persist provider-neutral continuation, usage, cost, and las
     active_started_at: null,
   }, { home });
 
-  const loaded = loadLocalSession(session.id, { home });
+  const loaded = loadLocalSession(session.id, { home, cwd });
   assert.equal(loaded.provider_state.previous_response_id, 'resp_123');
   assert.equal(loaded.cumulative_usage.cached_input_tokens, 60_544);
   assert.equal(listLocalSessions({ home, cwd })[0].id, session.id);
+  assert.equal(loaded.project_root, cwd);
+  assert.equal(loaded.storage.runtime, 'sqlite');
+  assert.equal(loaded.storage.path, '.agentsam/data/agentsam.sqlite');
+  assert.equal(loaded.storage.remote, null);
+  assert.equal(loaded.storage.capabilities.local_only, true);
+  assert.equal(fs.existsSync(path.join(home, '.agentsam', 'sessions', `${session.id}.json`)), false);
+  assert.equal(fs.existsSync(path.join(cwd, '.agentsam', 'data', 'agentsam.sqlite')), true);
 
   const receipt = renderSessionReceipt(loaded);
   assert.match(receipt, /Token usage: total=21,463 input=21,244 \(\+ 60,544 cached\) output=219 reasoning=31/);

package/test/local-studio-deploy.test.mjs

@@ -25,7 +25,7 @@ describe('local-studio deploy resolver', () => {
     assert.deepEqual(target.wranglerArgs, ['deploy', '-c', 'backend/wrangler.jsonc']);
     assert.equal(isLocalStudioCheckout(root), true);
     const cmd = wranglerDeployCommand(target, { dryRun: true });
-    assert.equal(cmd.bin, 'npx');
+    assert.equal(cmd.bin, process.platform === 'win32' ? 'npx.cmd' : 'npx');
     assert.equal(cmd.cwd, target.appRoot);
     assert.deepEqual(cmd.args, ['wrangler', 'deploy', '-c', 'backend/wrangler.jsonc', '--dry-run']);
   });

package/test/model-catalog.test.mjs

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { calculateModelCost, getModelRecord } from '../src/models/index.js';
+import { calculateModelCost, getModelRecord, mergeModelReference } from '../src/models/index.js';
 
 test('Astra catalog separates technical window, reasoning controls, service tiers, and economics', () => {
   const model = getModelRecord('gpt-6-astra');
@@ -41,3 +41,30 @@ test('service tier and cache pricing stay explicit rather than hidden in prompts
   assert.equal(standard.rates_per_million.cached_input, 1);
   assert.equal(standard.rates_per_million.cache_write, 12.5);
 });
+
+
+test('GPT-6 Luna reference hydrates a stale provider-verified snapshot without changing availability authority', () => {
+  const merged = mergeModelReference({
+    model_key: 'openai:gpt-6-luna',
+    provider: 'openai',
+    provider_model_id: 'gpt-6-luna',
+    availability: 'available',
+    availability_source: 'provider_api',
+    context_window: null,
+    context_window_source: 'unknown',
+    max_output_tokens: null,
+    max_output_tokens_source: 'unknown',
+    reasoning_efforts: ['auto'],
+    service_tiers: ['default'],
+    capabilities: { responses: true },
+  });
+  assert.equal(merged.availability, 'available');
+  assert.equal(merged.availability_source, 'provider_api');
+  assert.equal(merged.context_window, 1_050_000);
+  assert.equal(merged.context_window_source, 'sdk_reference');
+  assert.equal(merged.max_output_tokens, 128_000);
+  assert.deepEqual(merged.reasoning_efforts, ['none', 'low', 'medium', 'high', 'xhigh', 'max']);
+  assert.equal(merged.default_reasoning_effort, 'medium');
+  assert.equal(merged.capabilities.responses, true);
+  assert.equal(merged.capabilities.function_calling, true);
+});

package/test/models.test.mjs

@@ -21,7 +21,7 @@ test('model inventory reports configured API providers without exposing credenti
     home,
     discoverRemote: false,
     env: {
-      OPENAI_API_KEY: 'secret-openai', GEMINI_API_KEY: '', XAI_API_KEY: 'secret-xai', ANTHROPIC_API_KEY: 'secret-anthropic', CLOUDFLARE_API_TOKEN: 'secret-cf', ACCOUNT_ID: '33333333333333333333333333333333',
+      OPENAI_API_KEY: 'secret-openai', GEMINI_API_KEY: '', XAI_API_KEY: 'secret-xai', ANTHROPIC_API_KEY: 'secret-anthropic', CLOUDFLARE_API_TOKEN: 'secret-cf', CLOUDFLARE_ACCOUNT_ID: '33333333333333333333333333333333',
       OLLAMA_BASE_URL: 'http://127.0.0.1:11434', OLLAMA_MODEL: 'qwen:test', OLLAMA_EMBED_MODEL: 'embed:test',
     },
     fetchImpl: async () => response({ models: [{ name: 'qwen:test' }, { name: 'embed:test' }] }),
@@ -39,8 +39,10 @@ test('model inventory reports configured API providers without exposing credenti
   assert.doesNotMatch(rendered, /secret-openai|secret-xai|secret-anthropic|secret-cf/);
 });
 
-test('static/reference metadata never invents hosted model availability', async () => {
+test('static/reference metadata never invents hosted model availability', async t => {
+  const home = tempHome(t);
   const status = await collectModelsStatus({
+    home,
     env: { OPENAI_API_KEY: 'secret-openai', OLLAMA_BASE_URL: 'http://127.0.0.1:11434' },
     fetchImpl: async () => response({ models: [] }),
     providerFetchImpl: async () => response({ data: [{ id: 'some-other-model' }] }),
@@ -52,8 +54,10 @@ test('static/reference metadata never invents hosted model availability', async
   assert.equal(referenceOnly?.availability_source, 'sdk_reference');
 });
 
-test('exact hosted model availability is verified against the provider inventory', async () => {
+test('exact hosted model availability is verified against the provider inventory', async t => {
+  const home = tempHome(t);
   const status = await collectModelsStatus({
+    home,
     env: { OPENAI_API_KEY: 'secret-openai', OLLAMA_BASE_URL: 'http://127.0.0.1:11434' },
     fetchImpl: async () => response({ models: [] }),
     providerFetchImpl: async () => response({ data: [{ id: 'gpt-6-astra' }, { id: 'some-other-model' }] }),
@@ -68,9 +72,11 @@ test('exact hosted model availability is verified against the provider inventory
 
 
 
-test('Gemini and xAI discovery keep per-key limits from provider metadata', async () => {
+test('Gemini and xAI discovery keep per-key limits from provider metadata', async t => {
+  const home = tempHome(t);
   const seen = [];
   const status = await collectModelsStatus({
+    home,
     env: {
       GEMINI_API_KEY: 'gem-key',
       XAI_API_KEY: 'xai-key',
@@ -119,12 +125,13 @@ test('Gemini and xAI discovery keep per-key limits from provider metadata', asyn
 });
 
 
-test('Cloudflare discovery is scoped to the loaded account and surfaces text-generation models only', async t => {
+test('Cloudflare discovery is scoped to the loaded account and surfaces text-generation + embeddings', async t => {
   const seen = [];
   const home = tempHome(t);
   const status = await collectModelsStatus({
     home,
-    env: { CLOUDFLARE_API_TOKEN: 'secret-cf', ACCOUNT_ID: '44444444444444444444444444444444', OLLAMA_BASE_URL: 'http://127.0.0.1:11434' },
+    curateWorkersAi: false,
+    env: { CLOUDFLARE_API_TOKEN: 'secret-cf', CLOUDFLARE_ACCOUNT_ID: '44444444444444444444444444444444', OLLAMA_BASE_URL: 'http://127.0.0.1:11434' },
     fetchImpl: async () => response({ models: [] }),
     providerFetchImpl: async (url, options) => {
       seen.push({ url, auth: options.headers.authorization });
@@ -137,12 +144,166 @@ test('Cloudflare discovery is scoped to the loaded account and surfaces text-gen
   assert.equal(seen.length, 1);
   assert.match(seen[0].url, /accounts\/44444444444444444444444444444444\/ai\/models\/search$/);
   assert.equal(status.discovery.cloudflare.ok, true);
-  assert.equal(status.discovery.cloudflare.returnedModelCount, 1);
-  assert.deepEqual(status.providerModels.cloudflare.map((row) => row.provider_model_id), ['@cf/qwen/code']);
-  assert.equal(status.providerModels.cloudflare[0].availability_source, 'provider_api');
-  assert.equal(status.providerModels.cloudflare[0].context_window_source, 'unknown');
+  assert.equal(status.discovery.cloudflare.returnedModelCount, 2);
+  assert.deepEqual(
+    status.providerModels.cloudflare.map((row) => row.provider_model_id).sort(),
+    ['@cf/baai/embed', '@cf/qwen/code'],
+  );
+  const embed = status.providerModels.cloudflare.find((row) => row.provider_model_id === '@cf/baai/embed');
+  const qwen = status.providerModels.cloudflare.find((row) => row.provider_model_id === '@cf/qwen/code');
+  assert.equal(qwen.availability_source, 'provider_api');
+  assert.equal(qwen.context_window_source, 'unknown');
   const rendered = renderModelsStatus(status);
   assert.match(rendered, /@cf\/qwen\/code/);
-  assert.doesNotMatch(rendered, /@cf\/baai\/embed/);
+  assert.match(rendered, /@cf\/baai\/embed/);
   assert.doesNotMatch(rendered, /secret-cf/);
 });
+
+test('Cursor participates in machine inventory when CURSOR_API_KEY is configured', async t => {
+  const home = tempHome(t);
+  const seen = [];
+  const status = await collectModelsStatus({
+    home,
+    env: {
+      CURSOR_API_KEY: 'cursor-secret-key',
+      OLLAMA_BASE_URL: 'http://127.0.0.1:11434',
+    },
+    fetchImpl: async () => response({ models: [] }),
+    providerFetchImpl: async (url, options) => {
+      seen.push({ url, auth: options?.headers?.authorization });
+      if (String(url).includes('api.cursor.com')) {
+        return response({
+          items: [
+            { id: 'composer-2.5', displayName: 'Composer 2.5', parameters: [] },
+            { id: 'gpt-5.6-sol', displayName: 'GPT-5.6 Sol', parameters: [{ id: 'reasoning', values: [{ value: 'high' }] }] },
+          ],
+        });
+      }
+      throw new Error('unexpected URL ' + url);
+    },
+  });
+
+  const cursor = status.providers.find((row) => row.id === 'cursor');
+  assert.equal(cursor?.configured, true);
+  assert.equal(status.discovery.cursor.ok, true);
+  assert.equal(status.discovery.cursor.returnedModelCount, 2);
+  assert.equal(seen.length, 1);
+  assert.match(seen[0].url, /api\.cursor\.com\/v1\/models/);
+  assert.match(seen[0].auth, /Bearer cursor-secret-key/);
+  assert.deepEqual(
+    status.availableModels.filter((row) => row.provider === 'cursor').map((row) => row.provider_model_id),
+    ['composer-2.5', 'gpt-5.6-sol'],
+  );
+  const rendered = renderModelsStatus(status);
+  assert.match(rendered, /Cursor/);
+  assert.match(rendered, /composer-2\.5/);
+  assert.doesNotMatch(rendered, /cursor-secret-key/);
+});
+
+test('missing Cursor credential skips discovery and does not fall back to another provider', async t => {
+  const home = tempHome(t);
+  const seen = [];
+  const status = await collectModelsStatus({
+    home,
+    env: {
+      OPENAI_API_KEY: 'secret-openai',
+      OLLAMA_BASE_URL: 'http://127.0.0.1:11434',
+    },
+    fetchImpl: async () => response({ models: [] }),
+    providerFetchImpl: async (url) => {
+      seen.push(url);
+      if (String(url).includes('api.openai.com')) return response({ data: [{ id: 'gpt-test' }] });
+      if (String(url).includes('api.cursor.com')) throw new Error('cursor must not be called');
+      return response({ data: [] });
+    },
+  });
+  assert.equal(status.providers.find((row) => row.id === 'cursor')?.configured, false);
+  assert.equal(status.discovery.cursor.attempted, false);
+  assert.equal(seen.some((url) => String(url).includes('api.cursor.com')), false);
+  assert.equal(status.availableModels.some((row) => row.provider === 'cursor'), false);
+  assert.equal(status.availableModels.some((row) => row.provider === 'openai'), true);
+});
+
+test('Cursor discovery failure stays attached to Cursor and does not invent OpenAI models', async t => {
+  const home = tempHome(t);
+  const status = await collectModelsStatus({
+    home,
+    env: {
+      CURSOR_API_KEY: 'bad-cursor-key',
+      OLLAMA_BASE_URL: 'http://127.0.0.1:11434',
+    },
+    fetchImpl: async () => response({ models: [] }),
+    providerFetchImpl: async (url) => {
+      if (String(url).includes('api.cursor.com')) {
+        return { ok: false, status: 401, async json() { return { error: 'unauthorized' }; } };
+      }
+      throw new Error('unexpected URL ' + url);
+    },
+  });
+  assert.equal(status.providers.find((row) => row.id === 'cursor')?.configured, true);
+  assert.equal(status.discovery.cursor.ok, false);
+  assert.ok(status.discovery.cursor.error);
+  assert.equal((status.providerModels.cursor || []).length, 0);
+  assert.equal(status.availableModels.some((row) => row.provider === 'openai'), false);
+});
+
+test('Workers AI curated allowlist intersects live Cloudflare discovery', async t => {
+  const home = tempHome(t);
+  const status = await collectModelsStatus({
+    home,
+    curateWorkersAi: true,
+    env: { CLOUDFLARE_API_TOKEN: 'secret-cf', CLOUDFLARE_ACCOUNT_ID: '44444444444444444444444444444444', OLLAMA_BASE_URL: 'http://127.0.0.1:11434' },
+    fetchImpl: async () => response({ models: [] }),
+    providerFetchImpl: async () => response({
+      success: true,
+      result: [
+        { name: '@cf/qwen/qwen2.5-coder-32b-instruct', task: { name: 'Text Generation' } },
+        { name: '@cf/meta/llama-3.2-1b-instruct', task: { name: 'Text Generation' } },
+        { name: '@cf/openai/gpt-oss-120b', task: { name: 'Text Generation' } },
+        { name: '@cf/baai/bge-base-en-v1.5', task: { name: 'Text Embeddings' } },
+      ],
+    }),
+  });
+  // Chat allowlist applies to Text Generation; Text Embeddings always pass (Vectorize lane).
+  assert.deepEqual(
+    status.providerModels.cloudflare.map((row) => row.provider_model_id).sort(),
+    ['@cf/baai/bge-base-en-v1.5', '@cf/openai/gpt-oss-120b', '@cf/qwen/qwen2.5-coder-32b-instruct'],
+  );
+  assert.equal(status.discovery.cloudflare.curation, 'agentsam_workers_ai_allowlist');
+});
+
+test('studio vault credential plane never reads machine env when resolver is injected', async t => {
+  const home = tempHome(t);
+  const status = await collectModelsStatus({
+    home,
+    credentialPlane: 'studio_vault',
+    includeLocal: false,
+    env: { OPENAI_API_KEY: 'machine-must-not-be-used', CURSOR_API_KEY: 'machine-cursor' },
+    resolveCredential: async (providerId) => {
+      if (providerId === 'gemini') {
+        return { configured: true, value: 'vault-gemini', source: 'user_vault', env: 'GEMINI_API_KEY' };
+      }
+      return { configured: false, value: '', source: null, error: null };
+    },
+    fetchImpl: async () => response({ models: [] }),
+    providerFetchImpl: async (url) => {
+      if (String(url).includes('generativelanguage.googleapis.com') && String(url).includes('vault-gemini')) {
+        return response({
+          models: [{
+            name: 'models/gemini-vault',
+            baseModelId: 'gemini-vault',
+            displayName: 'Vault Gemini',
+            inputTokenLimit: 1000,
+            supportedGenerationMethods: ['generateContent'],
+          }],
+        });
+      }
+      throw new Error('machine providers must not be discovered: ' + url);
+    },
+  });
+  assert.equal(status.credential_plane, 'studio_vault');
+  assert.equal(status.providers.find((row) => row.id === 'openai')?.configured, false);
+  assert.equal(status.providers.find((row) => row.id === 'gemini')?.configured, true);
+  assert.equal(status.providers.find((row) => row.id === 'gemini')?.source, 'user_vault');
+  assert.deepEqual(status.availableModels.map((row) => row.provider_model_id), ['gemini-vault']);
+});

package/test/openai-responses.test.mjs

@@ -41,6 +41,51 @@ test('Responses adapter sends reasoning/service tier without legacy sampling par
   assert.deepEqual(events.map(event => event.type), ['model.started', 'usage.snapshot', 'cost.snapshot', 'model.completed']);
 });
 
+test('Responses adapter carries hosted built-ins and function tools through /v1/responses with model capability checks', async () => {
+  let request = null;
+  const adapter = createOpenAIResponsesAdapter({
+    apiKey: 'test-key',
+    fetchImpl: async (url, options) => {
+      request = { url, body: JSON.parse(options.body) };
+      return jsonResponse({
+        id: 'resp_tools',
+        status: 'completed',
+        service_tier: 'default',
+        output: [{ type: 'message', content: [{ type: 'output_text', text: 'done' }] }],
+        usage: { input_tokens: 100, output_tokens: 10 },
+      });
+    },
+  });
+
+  await adapter.create({
+    model: 'gpt-6-luna',
+    input: 'research and summarize',
+    reasoningEffort: 'medium',
+    serviceTier: 'default',
+    tools: [
+      { type: 'web_search' },
+      { type: 'function', name: 'repository_snapshot', description: 'Snapshot repo', parameters: { type: 'object', properties: {} } },
+    ],
+  });
+
+  assert.equal(request.url, 'https://api.openai.com/v1/responses');
+  assert.equal(request.body.reasoning.effort, 'medium');
+  assert.deepEqual(request.body.tools[0], { type: 'web_search' });
+  assert.equal(request.body.tools[1].type, 'function');
+  assert.equal(request.body.tools[1].name, 'repository_snapshot');
+
+  await assert.rejects(
+    () => adapter.create({
+      model: 'gpt-5.3-codex',
+      input: 'search',
+      reasoningEffort: 'medium',
+      serviceTier: 'default',
+      tools: [{ type: 'web_search' }],
+    }),
+    /does not declare Responses tool support: web_search/,
+  );
+});
+
 test('Responses adapter preserves function call_id when returning tool output', async () => {
   const bodies = [];
   const adapter = createOpenAIResponsesAdapter({
@@ -93,3 +138,18 @@ test('compaction is an explicit provider operation and has no arbitrary default
   assert.equal(body.previous_response_id, 'resp_previous');
   assert.equal(compacted.compaction_id, 'cmp_1');
 });
+
+test('OpenAI server-side compaction uses canonical policy and honors disable with previous_response_id', async () => {
+  const { getModelRecord } = await import('../src/models/index.js');
+  const bodies = [];
+  const adapter = createOpenAIResponsesAdapter({ apiKey: 'test', fetchImpl: async (_, init) => {
+    bodies.push(JSON.parse(init.body));
+    return jsonResponse({ id: 'resp_1', output: [], usage: {} });
+  } });
+  await adapter.create({ model: 'gpt-6-astra', previousResponseId: 'resp_previous', input: 'new message' });
+  assert.deepEqual(bodies[0].context_management, [{ type: 'compaction', compact_threshold: getModelRecord('gpt-6-astra').context_policy.compact_at_tokens }]);
+  assert.equal(bodies[0].input, 'new message');
+  assert.equal(bodies[0].previous_response_id, 'resp_previous');
+  await adapter.create({ model: 'gpt-6-astra', input: 'test', autoCompact: false });
+  assert.equal(bodies[1].context_management, undefined);
+});

package/test/provider-credentials.test.mjs

@@ -63,14 +63,24 @@ test('provider env profiles create a secure reusable source loader without embed
 
   const cloudflare = ensureProviderEnvProfile('cloudflare', { home });
   const source = fs.readFileSync(cloudflare.file, 'utf8');
-  assert.match(source, /ACCOUNT_ID=""/);
+  assert.match(source, /CLOUDFLARE_ACCOUNT_ID=""/);
   assert.match(source, /CLOUDFLARE_API_TOKEN=""/);
 });
 
+test('Cloudflare credential identity never falls back to generic ACCOUNT_ID', t => {
+  const home = fixtureHome(t);
+  const resolved = resolveProviderCredential('cloudflare', {
+    env: { CLOUDFLARE_API_TOKEN: 'token-secret', ACCOUNT_ID: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' },
+    home,
+  });
+  assert.equal(resolved.configured, true);
+  assert.equal(resolved.account_id, null);
+});
+
 test('Cloudflare credential status carries non-secret account identity from the provider profile', t => {
   const home = fixtureHome(t);
   const profile = path.join(home, '.agentsam', 'env.d', 'cloudflare.env');
-  fs.writeFileSync(profile, 'export ACCOUNT_ID="0123456789abcdef0123456789abcdef"\nexport CLOUDFLARE_API_TOKEN="token-secret"\n', { mode: 0o600 });
+  fs.writeFileSync(profile, 'export CLOUDFLARE_ACCOUNT_ID="0123456789abcdef0123456789abcdef"\nexport CLOUDFLARE_API_TOKEN="token-secret"\n', { mode: 0o600 });
   if (process.platform !== 'win32') fs.chmodSync(profile, 0o600);
   const resolved = resolveProviderCredential('cloudflare', { env: {}, home });
   assert.equal(resolved.account_id, '0123456789abcdef0123456789abcdef');
@@ -83,14 +93,14 @@ test('Cloudflare credential status carries non-secret account identity from the
 test('Cloudflare profile account backfill never overwrites an existing token or account choice', t => {
   const home = fixtureHome(t);
   const profile = path.join(home, '.agentsam', 'env.d', 'cloudflare.env');
-  fs.writeFileSync(profile, 'export ACCOUNT_ID=""\nexport CLOUDFLARE_API_TOKEN="keep-me"\n', { mode: 0o600 });
+  fs.writeFileSync(profile, 'export CLOUDFLARE_ACCOUNT_ID=""\nexport CLOUDFLARE_API_TOKEN="keep-me"\n', { mode: 0o600 });
   ensureProviderEnvProfile('cloudflare', { home, accountId: '11111111111111111111111111111111' });
   let source = fs.readFileSync(profile, 'utf8');
-  assert.match(source, /ACCOUNT_ID="11111111111111111111111111111111"/);
+  assert.match(source, /CLOUDFLARE_ACCOUNT_ID="11111111111111111111111111111111"/);
   assert.match(source, /CLOUDFLARE_API_TOKEN="keep-me"/);
 
   ensureProviderEnvProfile('cloudflare', { home, accountId: '22222222222222222222222222222222' });
   source = fs.readFileSync(profile, 'utf8');
-  assert.match(source, /ACCOUNT_ID="11111111111111111111111111111111"/);
+  assert.match(source, /CLOUDFLARE_ACCOUNT_ID="11111111111111111111111111111111"/);
   assert.doesNotMatch(source, /22222222222222222222222222222222/);
 });