@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/test/cli/mcp-client.test.mjs

@@ -58,7 +58,7 @@ test('MCP authority store manages servers under ~/.agentsam/mcp with safe permis
   assert.equal(readMcpServer('inneranimalmedia', { home }), null);
 });
 
-test('MCP external client registry recognizes chatgpt, claude, cursor and respects is_active', async () => {
+test('MCP external client registry recognizes chatgpt, claude, cursor — not CF portals', async () => {
   const home = tempHome();
 
   // Baseline seed / cached client list
@@ -68,9 +68,11 @@ test('MCP external client registry recognizes chatgpt, claude, cursor and respec
   assert.ok(keys.includes('cursor'), 'Cursor is recognized in the external client registry');
   assert.ok(keys.includes('claude'), 'Claude is recognized in the external client registry');
   assert.ok(keys.includes('agentsam'), 'AgentSam is recognized in the external client registry');
+  assert.equal(keys.some((k) => k.startsWith('cf_')), false, 'CF MCP portals are servers, not clients');
 
   assert.equal(isClientRegistered('chatgpt', { home }), true);
   assert.equal(isClientRegistered('cursor', { home }), true);
+  assert.equal(isClientRegistered('cf_bindings_mcp', { home }), false);
   assert.equal(isClientRegistered('nonexistent_client_xyz', { home }), false);
 
   // Cache path is created upon writing
@@ -154,23 +156,25 @@ test('MCP client adapters materialize Cursor, Claude, and ChatGPT configurations
   assert.equal(fs.existsSync(chatgptConfigPath), false);
 });
 
-test('MCP server catalog resolves real registered servers with live health metrics', () => {
+test('MCP server catalog resolves CF portal bundles + IAM without fabricated health', () => {
   const home = tempHome();
   const catalog = listKnownServers({ home });
   assert.ok(catalog.length >= 8);
 
-  // Cloudflare API server from D1
   const cfApi = resolveServerPreset('cloudflare-api', { home });
   assert.ok(cfApi);
   assert.equal(cfApi.url, 'https://mcp.cloudflare.com/mcp');
-  assert.equal(cfApi.health_status, 'degraded');
-  assert.equal(cfApi.avg_latency_ms, 9);
+  assert.equal(cfApi.provider, 'cloudflare');
+  assert.equal(cfApi.kind, 'mcp_portal_bundle');
+  assert.ok(cfApi.portal_manage_scopes.includes('mcp-portals.read'));
+
+  const bindings = resolveServerPreset('cloudflare-bindings', { home });
+  assert.ok(bindings);
+  assert.ok(bindings.feature_packs.includes('data'));
 
-  // InnerAnimalMedia Main MCP from D1
   const iam = resolveServerPreset('inneranimalmedia', { home });
   assert.ok(iam);
-  assert.equal(iam.health_status, 'healthy');
-  assert.equal(iam.avg_latency_ms, 443);
+  assert.equal(iam.url, 'https://mcp.inneranimalmedia.com/mcp');
 });
 
 test('MCP telemetry logs tool receipts and computes accurate summaries', () => {
@@ -204,6 +208,7 @@ test('agentsam mcp CLI handles add, list, status, doctor, and remove end-to-end'
   const helpText = logs.join('\n');
   assert.ok(helpText.includes('chatgpt'), 'Help text displays ChatGPT as a recognized client');
   assert.ok(helpText.includes('cloudflare-api'), 'Help text displays cloudflare-api preset');
+  assert.ok(helpText.includes('bindings.mcp.cloudflare.com') || helpText.includes('cloudflare-bindings'), 'CF portal hostnames remain offerable');
   logs.length = 0;
 
   // Add inneranimalmedia preset for chatgpt client
@@ -230,11 +235,17 @@ test('agentsam mcp CLI handles add, list, status, doctor, and remove end-to-end'
   assert.equal(statusRes.name, 'inneranimalmedia');
   assert.equal(statusRes.hasAuth, true);
 
-  // Doctor includes catalog health data
+  // Doctor includes catalog / CF pack metadata
   const doctorRes = await runMcp(['doctor', 'inneranimalmedia', '--json'], { home, write });
   assert.equal(doctorRes.name, 'inneranimalmedia');
   assert.equal(doctorRes.authConfigured, true);
-  assert.equal(doctorRes.catalogHealth?.health_status, 'healthy');
+  assert.equal(doctorRes.catalog?.auth_type, 'bearer');
+
+  // Cloudflare bundle scopes are pack-scoped (includes mcp-portals.*)
+  const scopeRes = await runMcp(['scopes', 'cloudflare-bindings', '--json'], { home, write });
+  assert.ok(scopeRes.oauth_scopes.includes('mcp-portals.read'));
+  assert.ok(scopeRes.oauth_scopes.includes('mcp-portals.write'));
+  assert.ok(scopeRes.oauth_scopes.includes('d1.read'));
 
   // Remove
   const removeRes = await runMcp(['remove', 'inneranimalmedia', '--client', 'all', '--json'], { home, write });

package/test/cli/runtime-persist.test.mjs

@@ -0,0 +1,56 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  buildWindowsScheduledTaskXml,
+  buildLaunchAgentPlist,
+  writeWindowsScheduledTask,
+  WINDOWS_TASK_NAME,
+} from '../../src/lib/setup/runtime-persist.js';
+
+test('buildWindowsScheduledTaskXml includes binary, listen, logon trigger', () => {
+  const xml = buildWindowsScheduledTaskXml({
+    binary: 'C:\\Users\\sam\\.agentsam\\bin\\agentsamd.exe',
+    listen: '127.0.0.1:18765',
+    workingDirectory: 'C:\\Users\\sam\\.agentsam\\bin',
+  });
+  assert.match(xml, /agentsamd\.exe/);
+  assert.match(xml, /--listen 127\.0\.0\.1:18765/);
+  assert.match(xml, /LogonTrigger/);
+  assert.match(xml, /InteractiveToken/);
+  assert.match(xml, /RestartOnFailure/);
+});
+
+test('buildLaunchAgentPlist includes KeepAlive and listen', () => {
+  const plist = buildLaunchAgentPlist({
+    binary: '/Users/sam/.agentsam/bin/agentsamd',
+    listen: '127.0.0.1:18765',
+    stdoutLog: '/tmp/out.log',
+    stderrLog: '/tmp/err.log',
+  });
+  assert.match(plist, /com\.inneranimalmedia\.agentsamd/);
+  assert.match(plist, /KeepAlive/);
+  assert.match(plist, /127\.0\.0\.1:18765/);
+});
+
+test('writeWindowsScheduledTask writes XML without calling schtasks when skipRegister', async () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-runtime-'));
+  try {
+    const result = await writeWindowsScheduledTask(
+      home,
+      path.join(home, '.agentsam', 'bin', 'agentsamd.exe'),
+      '127.0.0.1:18765',
+      { forcePlatform: 'win32', skipRegister: true },
+    );
+    assert.equal(result.kind, 'scheduled_task');
+    assert.equal(result.taskName, WINDOWS_TASK_NAME);
+    assert.equal(result.registered, false);
+    assert.ok(fs.existsSync(result.xmlPath));
+    const xml = fs.readFileSync(result.xmlPath, 'utf8');
+    assert.match(xml, /agentsamd\.exe/);
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});

package/test/cli/rust-command.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getCliCommand } from '../../src/cli/command-catalog.js';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+
+test('rust/wasm command aliases resolve to one catalog authority', () => {
+  const rust = getCliCommand('rust');
+  assert.equal(rust?.id, 'rust');
+  assert.equal(getCliCommand('wasm')?.id, 'rust');
+  assert.equal(getCliCommand('rapid-rust')?.id, 'rust');
+});
+
+test('rapid rust root bin and native crate ship in source tree', () => {
+  assert.equal(fs.existsSync(path.join(root, 'bin/agentsam-rapid-rust')), true);
+  assert.equal(fs.existsSync(path.join(root, 'packages/agentsam-rapid-rust/Cargo.toml')), true);
+  assert.equal(fs.existsSync(path.join(root, 'scripts/build_rapid_rust_cli.py')), true);
+});

package/test/cli/skill-npm-and-env.test.mjs

@@ -0,0 +1,52 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import test from 'node:test';
+import { resolveNpmSkillPackage } from '../../src/commands/skill.js';
+import { installSkillFromPath } from '../../src/skills/index.js';
+import { runEnv } from '../../src/commands/env.js';
+
+function tmpHome() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-finish-'));
+}
+
+test('resolveNpmSkillPackage extracts agentsam.skill.json via npm pack', (t) => {
+  // Build a tiny local package and pack it by path (no registry).
+  const pkgRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-npm-skill-'));
+  fs.writeFileSync(
+    path.join(pkgRoot, 'package.json'),
+    JSON.stringify({ name: 'tmp-agentsam-skill-fixture', version: '0.0.0', private: true }),
+  );
+  fs.writeFileSync(
+    path.join(pkgRoot, 'agentsam.skill.json'),
+    JSON.stringify({
+      schema: 'agentsam.skill.v1',
+      id: 'npm-fixture',
+      name: 'NPM Fixture',
+      slash: { suggested: '/npm-fixture' },
+      instructions: { source: 'inline', inline: '# npm fixture' },
+      execution: { mode: 'turn' },
+    }),
+  );
+  const resolved = resolveNpmSkillPackage(pkgRoot, { spawnSyncImpl: spawnSync });
+  assert.ok(fs.existsSync(path.join(resolved, 'agentsam.skill.json')));
+
+  const home = tmpHome();
+  const installed = installSkillFromPath(resolved, { home });
+  assert.equal(installed.id, 'npm-fixture');
+  assert.equal(installed.trigger, '/npm-fixture');
+});
+
+test('env boot-line prints source load-agent-env command', async () => {
+  const home = tmpHome();
+  const lines = [];
+  const result = await runEnv(['boot-line', 'cursor', 'inneranimalmedia'], {
+    home,
+    write: (t) => lines.push(t),
+  });
+  assert.equal(result.command, 'source ~/.agentsam/load-agent-env.sh');
+  assert.ok(lines.join('').includes('load-agent-env.sh'));
+  assert.ok(lines.join('').includes('agentsam env shell'));
+});

package/test/cli/wireframes-go-registry.test.mjs

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 import { renderArchitectureExplorer, renderOperationInspector, drawBox } from '../../src/ui/wireframes.js';
-import { buildGoProductRegistrySql } from '../../src/go/registry.js';
+import { applyInnerAnimalMediaOfficialGoProductRegistry, buildGoProductRegistrySql } from '../../src/go/official-registry.js';
 
 test('architecture explorer is boxed reasoning scenery', () => {
   const view = renderArchitectureExplorer({
@@ -38,7 +38,7 @@ test('drawBox pads visible ANSI width', () => {
 test('buildGoProductRegistrySql upserts product + relationships without inventing tables', () => {
   const sql = buildGoProductRegistrySql({
     product: 'agentsam-go-worker',
-    status: 'wired',
+    status: 'deployed',
     url: 'https://agentsam-go-worker.example.workers.dev',
     commit: 'abc123',
     health: 'healthy',
@@ -52,3 +52,88 @@ test('buildGoProductRegistrySql upserts product + relationships without inventin
   assert.doesNotMatch(sql, /CREATE TABLE/);
   assert.doesNotMatch(sql, /account_id/);
 });
+
+
+test('InnerAnimalMedia remote registry requires the explicit official-release guard', () => {
+  const preferred = process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
+  const legacy = process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
+
+  delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
+  delete process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
+
+  try {
+    assert.throws(
+      () => applyInnerAnimalMediaOfficialGoProductRegistry({
+        productRoot: '/tmp/agentsam-test-state',
+        officialRelease: true,
+        skipRemote: true,
+      }),
+      /inneranimalmedia_registry_official_release_required/,
+    );
+  } finally {
+    if (preferred == null) {
+      delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
+    } else {
+      process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE = preferred;
+    }
+
+    if (legacy == null) {
+      delete process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
+    } else {
+      process.env.AGENTSAM_IAM_OFFICIAL_RELEASE = legacy;
+    }
+  }
+});
+
+test('InnerAnimalMedia official registry normalizes deployed lifecycle status to D1 production', () => {
+  const prior = process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
+  process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE = '1';
+  try {
+    const result = applyInnerAnimalMediaOfficialGoProductRegistry({
+      productRoot: null,
+      officialRelease: true,
+      status: 'deployed',
+      dryRun: true,
+      skipRemote: true,
+    });
+    assert.match(result.sql, /'production'/);
+    assert.doesNotMatch(result.sql, /'deployed',\n  'AgentSam Go runtime/);
+  } finally {
+    if (prior == null) delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
+    else process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE = prior;
+  }
+});
+
+
+test('legacy AGENTSAM_IAM_OFFICIAL_RELEASE guard remains backward compatible', () => {
+  const preferred = process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
+  const legacy = process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
+
+  delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
+  process.env.AGENTSAM_IAM_OFFICIAL_RELEASE = '1';
+
+  try {
+    const result = applyInnerAnimalMediaOfficialGoProductRegistry({
+      productRoot: null,
+      officialRelease: true,
+      status: 'deployed',
+      dryRun: true,
+      skipRemote: true,
+    });
+
+    assert.equal(result.ok, true);
+    assert.match(result.sql, /'production'/);
+  } finally {
+    if (preferred == null) {
+      delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
+    } else {
+      process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE = preferred;
+    }
+
+    if (legacy == null) {
+      delete process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
+    } else {
+      process.env.AGENTSAM_IAM_OFFICIAL_RELEASE = legacy;
+    }
+  }
+});

package/test/credentials-audit.test.mjs

@@ -0,0 +1,113 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  remediateGcloudEdgeServiceAccountKey,
+  remediateGcloudPermissionDenied,
+  remediateGithubTokenShadow,
+  remediateProviderFailure,
+  renderRemediationCard,
+  recommendedCommand,
+} from '../src/lib/provider-command-remediation.js';
+import { runCredentials } from '../src/commands/credentials.js';
+import { listCheatSheetGroups, renderCheatSheet } from '../src/commands/cheat-sheet.js';
+import { collectCredentialsAudit } from '../src/lib/credentials-audit.js';
+
+test('edge-cloud service-account key create remediates to IAM / compute intents', () => {
+  const card = remediateGcloudEdgeServiceAccountKey({
+    argv: ['gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
+    projectId: 'gen-lang-client-0684066529',
+    instance: 'iam-tunnel',
+    zone: 'us-central1-f',
+  });
+  assert.ok(card);
+  assert.equal(card.provider, 'google_cloud');
+  assert.equal(card.kind, 'command_incomplete_wrong_family');
+  assert.match(card.summary, /Distributed Cloud Edge/i);
+  assert.match(card.summary, /Compute Engine/i);
+  const commands = card.actions.map((row) => row.command).join('\n');
+  assert.match(commands, /gcloud compute instances describe iam-tunnel/);
+  assert.match(commands, /gcloud iam service-accounts list/);
+  assert.match(commands, /gcloud iam service-accounts keys create/);
+  assert.match(commands, /agentsam connections/);
+  const rendered = renderRemediationCard(card);
+  assert.match(rendered, /Command incomplete/);
+  assert.match(rendered, /\[enter\]/);
+  assert.equal(recommendedCommand(card), card.actions[0].command);
+});
+
+test('remediateProviderFailure matches edge-cloud argv fixture', () => {
+  const card = remediateProviderFailure({
+    argv: ['gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
+    stderr: 'ERROR: argument OUTPUT_FILE (--service-account : --location): Must be specified.',
+  });
+  assert.ok(card);
+  assert.equal(card.kind, 'command_incomplete_wrong_family');
+});
+
+test('permission denied remediation exposes reauth + IAM console actions', () => {
+  const card = remediateGcloudPermissionDenied({
+    operation: 'compute.instances.list',
+    projectId: 'gen-lang-client-0684066529',
+    connection: 'Google Cloud · InnerAnimalMedia',
+  });
+  assert.equal(card.kind, 'permission_denied');
+  assert.match(renderRemediationCard(card), /Permission missing/);
+  assert.match(renderRemediationCard(card), /Re-authorize Google Cloud/);
+  assert.ok(card.actions.some((row) => /console\.cloud\.google\.com\/iam-admin/i.test(row.docs_url || '')));
+});
+
+test('github token shadow remediation prefers unset + keyring status', () => {
+  const card = remediateGithubTokenShadow({
+    envTokenPresent: true,
+    keyringHealthy: true,
+    scopes: ['repo', 'read:org'],
+  });
+  assert.ok(card);
+  assert.equal(card.kind, 'credential_shadow');
+  assert.match(recommendedCommand(card), /unset GITHUB_TOKEN/);
+});
+
+test('credentials remediate CLI prints edge-cloud card without secrets', async () => {
+  const chunks = [];
+  const code = await runCredentials(
+    ['remediate', '--', 'gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
+    { write: (s) => chunks.push(s) },
+  );
+  assert.equal(code, 0);
+  const out = chunks.join('');
+  assert.match(out, /Google Cloud/);
+  assert.match(out, /gcloud iam service-accounts list/);
+  assert.doesNotMatch(out, /gho_/);
+  assert.doesNotMatch(out, /AIza/);
+});
+
+test('credentials audit --names-only never includes secret-looking values', async () => {
+  const report = await collectCredentialsAudit({
+    env: {
+      HOME: process.env.HOME,
+      AGENTSAM_API_KEY: 'aak_test_should_never_appear_in_output_fields_as_value',
+      GITHUB_TOKEN: 'ghp_should_never_be_echoed',
+      OPENAI_API_KEY: 'sk-should-never-be-echoed',
+    },
+    verify: false,
+    drift: true,
+    namesOnly: true,
+    noNetwork: true,
+  });
+  const blob = JSON.stringify(report);
+  assert.doesNotMatch(blob, /aak_test_should_never/);
+  assert.doesNotMatch(blob, /ghp_should_never/);
+  assert.doesNotMatch(blob, /sk-should-never/);
+  assert.equal(report.shell_presence.GITHUB_TOKEN, true);
+  assert.equal(report.shell_presence.AGENTSAM_API_KEY, true);
+  assert.ok(report.drift.some((row) => row.code === 'github_env_token_present'));
+});
+
+test('cheat-sheet exposes System + Providers groups', () => {
+  const groups = listCheatSheetGroups();
+  assert.ok(groups.some((g) => g.id === 'system'));
+  assert.ok(groups.some((g) => g.id === 'providers'));
+  const text = renderCheatSheet('2.6.4');
+  assert.match(text, /credentials audit/);
+  assert.match(text, /cheat-sheet/);
+});

package/test/deploy-health-scan.test.mjs

@@ -28,12 +28,18 @@ describe('deploy health', () => {
 
   it('reads hostname from wrangler.jsonc', () => {
     const origin = resolveHealthOrigin({
-      env: {},
       wranglerConfigText: '{"routes":[{"pattern":"agentsam.inneranimalmedia.com","custom_domain":true}]}',
     });
     assert.equal(origin, 'https://agentsam.inneranimalmedia.com');
   });
 
+  it('fails loud when wrangler routes pattern is missing', () => {
+    assert.throws(
+      () => resolveHealthOrigin({ wranglerConfigText: '{}' }),
+      (err) => err?.code === 'health_origin_required',
+    );
+  });
+
   it('treats /health ok:true with connector unconfigured as healthy', async () => {
     const fetchImpl = async (url) => {
       if (String(url).endsWith('/health')) {
@@ -48,6 +54,28 @@ describe('deploy health', () => {
     assert.equal(health.ok, true);
     assert.equal(health.results['/health'].appOk, true);
     assert.equal(health.results['/health'].cloudflareConfigured, false);
+    assert.equal(health.results['/privacy'].ok, true);
+    assert.equal(health.results['/terms'].ok, true);
+  });
+
+  it('fails deploy health when /privacy or /terms are not HTTP 200', async () => {
+    const fetchImpl = async (url) => {
+      const path = String(url).replace(/^https?:\/\/[^/]+/, '');
+      if (path === '/health') {
+        return {
+          status: 200,
+          json: async () => ({ ok: true, connections: { cloudflare: { configured: true } } }),
+        };
+      }
+      if (path === '/privacy' || path === '/terms') {
+        return { status: 404, json: async () => ({}) };
+      }
+      return { status: 200, json: async () => ({}) };
+    };
+    const health = await probeDeployHealth('https://agentsam.inneranimalmedia.com', { fetchImpl });
+    assert.equal(health.ok, false);
+    assert.equal(health.results['/privacy'].ok, false);
+    assert.equal(health.results['/terms'].ok, false);
   });
 
   it('sends a browser-safe User-Agent so WAF does not 403 the probe', async () => {

package/test/gcloud-auth.test.mjs

@@ -0,0 +1,111 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  resolveGoogleOauthStartUrl,
+  runAgentsamGoogleOauthLogin,
+  runGcloudAuth,
+} from '../src/commands/gcloud-auth.js';
+import {
+  GOOGLE_CLOUD_CONNECTION_SCOPES,
+  buildGoogleDesktopAuthUrl,
+  googleCloudPermissionChecklist,
+  resolveGoogleDesktopClientId,
+} from '../src/lib/google-desktop-oauth.js';
+
+const TEST_ENV = {
+  IAM_OAUTH_ISSUER: 'https://inneranimalmedia.com',
+  GOOGLE_CLIENT_ID: '246811022042-d8q1rc1oki4uv9qiqjah8lvkffb91crp.apps.googleusercontent.com',
+  GOOGLE_DESKTOP_CLIENT_ID: '246811022042-cckq00b5seekpkv0in358jhu42n0b6u9.apps.googleusercontent.com',
+};
+
+test('hosted --web login emits start URL in --json', async () => {
+  let out = '';
+  const code = await runAgentsamGoogleOauthLogin({
+    write: (s) => {
+      out += s;
+    },
+    json: true,
+    nonInteractive: true,
+    env: TEST_ENV,
+  });
+  assert.equal(code, 0);
+  const parsed = JSON.parse(out.slice(out.indexOf('{')));
+  assert.equal(parsed.mode, 'hosted_identity');
+  assert.equal(
+    parsed.start_url,
+    resolveGoogleOauthStartUrl(TEST_ENV),
+  );
+});
+
+test('gcloud auth login --web is hosted identity', async () => {
+  let out = '';
+  const code = await runGcloudAuth(['login', '--web', '--json'], {
+    write: (s) => {
+      out += s;
+    },
+    nonInteractive: true,
+    env: TEST_ENV,
+  });
+  assert.equal(code, 0);
+  assert.match(out, /hosted_identity|\/api\/oauth\/google\/start/);
+});
+
+test('gcloud auth help mentions studio broker default and --desktop/--web/--sdk', async () => {
+  let out = '';
+  await runGcloudAuth(['help'], {
+    write: (s) => {
+      out += s;
+    },
+  });
+  assert.match(out, /Studio Web OAuth broker|Worker holds/i);
+  assert.match(out, /--desktop/);
+  assert.match(out, /--web/);
+  assert.match(out, /--sdk/);
+});
+
+test('desktop auth URL requests cloud-platform + offline', () => {
+  const url = new URL(buildGoogleDesktopAuthUrl({
+    clientId: resolveGoogleDesktopClientId(TEST_ENV),
+    redirectUri: 'http://127.0.0.1:12345/callback',
+    state: 'abc',
+    codeChallenge: 'challenge',
+  }));
+  assert.match(url.searchParams.get('scope') || '', /cloud-platform/);
+  assert.equal(url.searchParams.get('access_type'), 'offline');
+  assert.equal(url.searchParams.get('code_challenge_method'), 'S256');
+  assert.match(GOOGLE_CLOUD_CONNECTION_SCOPES, /openid/);
+});
+
+test('permissions checklist separates OAuth scopes from IAM roles', async () => {
+  let out = '';
+  const code = await runGcloudAuth(['login', '--permissions'], {
+    write: (s) => {
+      out += s;
+    },
+  });
+  assert.equal(code, 0);
+  assert.match(out, /cloud-platform/);
+  assert.match(out, /mcp\.toolUser|roles\/mcp/);
+  const checklist = googleCloudPermissionChecklist();
+  assert.ok(checklist.oauth_scopes_requested.includes('https://www.googleapis.com/auth/cloud-platform'));
+});
+
+test('resolveGoogleDesktopClientId fails loud when unset', () => {
+  assert.throws(
+    () => resolveGoogleDesktopClientId({}),
+    (err) => err?.code === 'google_desktop_client_not_configured',
+  );
+});
+
+test('resolveGoogleDesktopClientIdAsync uses public-config when env unset', async () => {
+  const { resolveGoogleDesktopClientIdAsync } = await import('../src/lib/google-desktop-oauth.js');
+  const id = await resolveGoogleDesktopClientIdAsync({}, {
+    publicConfigUrl: 'https://example.test/api/public-config',
+    fetchImpl: async () =>
+      new Response(JSON.stringify({
+        ok: true,
+        google_desktop_client_id: 'from-public-config.apps.googleusercontent.com',
+      }), { status: 200 }),
+  });
+  assert.equal(id, 'from-public-config.apps.googleusercontent.com');
+});

package/test/go/build-source-identity.test.mjs

@@ -0,0 +1,31 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  repositoryIdFromGitContext,
+} from '../../src/go/build.js';
+
+test('Go build source canonicalizes GitHub repository identity', () => {
+  assert.equal(
+    repositoryIdFromGitContext({
+      remoteHost: 'github.com',
+      repoFullName: 'SamPrimeaux/agentsam-sdk',
+    }),
+    'github:samprimeaux/agentsam-sdk',
+  );
+});
+
+test('Go build source preserves provider-qualified non-GitHub identity', () => {
+  assert.equal(
+    repositoryIdFromGitContext({
+      remoteHost: 'gitlab.example.com',
+      repoFullName: 'Owner/Repo',
+    }),
+    'gitlab.example.com:Owner/Repo',
+  );
+});
+
+test('Go build source returns null when remote identity is unavailable', () => {
+  assert.equal(repositoryIdFromGitContext(null), null);
+  assert.equal(repositoryIdFromGitContext({}), null);
+});