@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/test/go/cloudflare-probe.test.mjs

@@ -1,53 +1,317 @@
 import assert from 'node:assert/strict';
+import path from 'node:path';
 import test from 'node:test';
-import { extractWorkersDevUrl, probeGoDeployment } from '../../src/go/cloudflare.js';
+import { fileURLToPath } from 'node:url';
+import {
+  deployGoCloudflare,
+  extractWorkersDevUrl,
+  probeGoDeployment,
+  readLatestWranglerDeployment,
+  resolveWranglerIdentity,
+  resolveConfiguredDeploymentUrl,
+} from '../../src/go/cloudflare.js';
 import { buildProductRow } from '../../src/go/receipts.js';
 
+const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const PRODUCT_ROOT = path.join(SDK_ROOT, 'apps/agentsam-go-worker');
+const EXPECTED_HASH = '2e60bba13dc2bc37d75dd2ce5deb25466f19cb2994e20889388948879875eae9';
+
+
+test('configured custom domain is canonical Go deployment URL', () => {
+  assert.equal(
+    resolveConfiguredDeploymentUrl(PRODUCT_ROOT),
+    'https://runtime.inneranimalmedia.com',
+  );
+});
+
 test('extractWorkersDevUrl parses wrangler output', () => {
   const url = extractWorkersDevUrl('Published agentsam-go-worker\n  https://agentsam-go-worker.example.workers.dev\n');
   assert.equal(url, 'https://agentsam-go-worker.example.workers.dev');
 });
 
-test('probeGoDeployment requires deterministic Go capabilities', async () => {
+test('probeGoDeployment requires edge, source identity, capabilities, deterministic functions and ErrorEnvelope', async () => {
   const responses = new Map([
-    ['/health', { status: 200, body: { ok: true, service: 'agentsam-go-worker', runtime: 'go' } }],
-    ['/v1/runtime', { status: 200, body: { schema: 'agentsam.go-runtime.v1', capabilities: ['hash'] } }],
-    ['/v1/hash', { status: 200, body: { hash: 'a'.repeat(64), algorithm: 'sha256' } }],
+    ['/', { status: 200, body: { ok: true, edge: 'worker', runtime: 'go/native-container', source: 'git:abc123' } }],
+    ['/edge/health', { status: 200, body: { ok: true, edge: 'worker', runtime: 'go/native-container', source: 'git:abc123' } }],
+    ['/health', {
+      status: 200,
+      body: {
+        ok: true,
+        service: 'agentsam-go-worker',
+        runtime: 'go',
+        target: 'cloudflare',
+        build: { source: 'git:abc123', commit: 'abc123' },
+      },
+    }],
+    ['/v1/runtime', {
+      status: 200,
+      body: { schema: 'agentsam.go-runtime.v1', os: 'linux', capabilities: ['hash', 'inspect', 'runtime', 'capabilities'] },
+    }],
+    ['/v1/capabilities', {
+      status: 200,
+      body: { schema: 'agentsam.go-capabilities.v1', capabilities: ['hash', 'inspect', 'runtime', 'capabilities'] },
+    }],
+    ['/v1/hash', { status: 200, body: { hash: EXPECTED_HASH, algorithm: 'sha256' } }],
     ['/v1/inspect', { status: 200, body: { findings: [{ kind: 'hardcoded_color', value: '#2563eb' }] } }],
   ]);
   let inspectCalls = 0;
-  const fetchImpl = async (url, init = {}) => {
+  const fetchImpl = async (url) => {
     const pathname = new URL(url).pathname;
     if (pathname === '/v1/inspect') {
       inspectCalls += 1;
       if (inspectCalls === 2) {
         return {
           status: 400,
-          async json() { return { ok: false, error: 'files_required' }; },
+          async json() {
+            return {
+              ok: false,
+              schema_version: 1,
+              code: 'INVALID_ARGUMENT',
+              reason: 'input_invalid',
+            };
+          },
         };
       }
     }
     const row = responses.get(pathname);
+    assert.ok(row, 'unexpected probe path: ' + pathname);
     return {
       status: row.status,
       async json() { return row.body; },
     };
   };
-  const result = await probeGoDeployment('https://example.workers.dev', { fetchImpl });
+
+  const result = await probeGoDeployment('https://example.workers.dev', {
+    fetchImpl,
+    expectedSource: 'git:abc123',
+    expectedSourceCommit: 'abc123',
+    expectedTarget: 'cloudflare',
+  });
   assert.equal(result.ok, true);
+  assert.equal(result.checks.edge_root, true);
+  assert.equal(result.checks.edge_health, true);
+  assert.equal(result.checks.source_identity, true);
+  assert.equal(result.checks.source_commit, true);
+  assert.equal(result.checks.capabilities, true);
+  assert.equal(result.results.deterministic_hash.ok, true);
   assert.equal(result.results.deterministic_inspect.ok, true);
   assert.equal(result.results.malformed_rejected.ok, true);
 });
 
-test('buildProductRow stays on agentsam_products projection', () => {
+test('readLatestWranglerDeployment normalizes authoritative deployment/version identity', () => {
+  const spawn = () => ({
+    status: 0,
+    stdout: JSON.stringify([
+      {
+        id: 'dep_old',
+        created_on: '2026-09-24T00:00:00Z',
+        versions: [{ version_id: 'ver_old', percentage: 100 }],
+      },
+      {
+        id: 'dep_new',
+        created_on: '2026-09-25T00:00:00Z',
+        versions: [{ version_id: 'ver_new', percentage: 100 }],
+      },
+    ]),
+    stderr: '',
+  });
+  const result = readLatestWranglerDeployment(PRODUCT_ROOT, 'agentsam-go-worker', { spawn });
+  assert.equal(result.ok, true);
+  assert.equal(result.deployment_id, 'dep_new');
+  assert.equal(result.version_id, 'ver_new');
+});
+
+test('resolveWranglerIdentity fails closed when authentication is unavailable', () => {
+  const spawn = () => ({ status: 1, stdout: '', stderr: 'not logged in' });
+  const result = resolveWranglerIdentity(PRODUCT_ROOT, { spawn });
+  assert.equal(result.ok, false);
+  assert.equal(result.authenticated, false);
+  assert.equal(result.error, 'cloudflare_not_authenticated');
+});
+
+test('resolveWranglerIdentity requires an explicit account when multiple are available', () => {
+  const spawn = () => ({
+    status: 0,
+    stdout: JSON.stringify({
+      loggedIn: true,
+      authType: 'OAuth Token',
+      accounts: [
+        { id: 'acc_a', name: 'Account A', type: 'standard' },
+        { id: 'acc_b', name: 'Account B', type: 'standard' },
+      ],
+    }),
+    stderr: '',
+  });
+  const ambiguous = resolveWranglerIdentity(PRODUCT_ROOT, { spawn });
+  assert.equal(ambiguous.ok, false);
+  assert.equal(ambiguous.error, 'cloudflare_account_ambiguous');
+
+  const selected = resolveWranglerIdentity(PRODUCT_ROOT, {
+    spawn,
+    requestedAccountId: 'acc_b',
+  });
+  assert.equal(selected.ok, true);
+  assert.equal(selected.account.id, 'acc_b');
+});
+
+test('Cloudflare self-host dry run binds the resolved account and never mutates InnerAnimalMedia D1', async () => {
+  const calls = [];
+  const cloudflareIdentity = {
+    ok: true,
+    authenticated: true,
+    auth_type: 'OAuth Token',
+    account: { id: 'acc_user', name: 'User Cloudflare', type: 'standard' },
+    accounts: [{ id: 'acc_user', name: 'User Cloudflare', type: 'standard' }],
+  };
+  const spawn = (command, args = [], options = {}) => {
+    calls.push({ command, args, env: options.env || {} });
+    if (command === 'docker' && args[0] === 'info') {
+      return { status: 0, stdout: 'ok', stderr: '' };
+    }
+    if (args.includes('deploy') && args.includes('--dry-run')) {
+      assert.equal(options.env.CLOUDFLARE_ACCOUNT_ID, 'acc_user');
+      assert.ok(args.includes('AGENTSAM_BUILD_SOURCE:npm:@inneranimalmedia/agentsam-go-worker@0.1.0'));
+      return { status: 0, stdout: 'Total Upload: 1 KiB', stderr: '' };
+    }
+    throw new Error('unexpected spawn: ' + [command, ...args].join(' '));
+  };
+
+  const result = await deployGoCloudflare({
+    productRoot: PRODUCT_ROOT,
+    product: 'agentsam-go-worker',
+    dryRun: true,
+    accountId: 'acc_user',
+    cloudflareIdentity,
+    source: {
+      identity: 'npm:@inneranimalmedia/agentsam-go-worker@0.1.0',
+      commit: null,
+      package_name: '@inneranimalmedia/agentsam-go-worker',
+      package_version: '0.1.0',
+    },
+    builtAt: '2026-09-25T00:00:00.000Z',
+    spawn,
+  });
+
+  assert.equal(result.deployed, false);
+  assert.equal(result.dryRunValidated, true);
+  assert.equal(result.receipt.dry_run, true);
+  assert.equal(result.receipt.skipped_deploy, false);
+  assert.equal(result.receipt.registry_mode, 'self_host_local');
+  assert.equal(result.receipt.cloudflare.account_id, 'acc_user');
+  assert.equal(result.registry.remote, false);
+  assert.equal(result.registry.reason, 'self_host_registry_isolated');
+  assert.ok(calls.some((call) => call.args.includes('deploy') && call.args.includes('--dry-run')));
+});
+
+
+test('buildProductRow stays on agentsam_products projection with deployment identity', () => {
   const row = buildProductRow({
     product: 'agentsam-go-worker',
-    repositoryId: 'agentsam-sdk',
+    repositoryId: 'github:samprimeaux/agentsam-sdk',
     commit: 'abc',
     url: 'https://x.workers.dev',
     health: 'healthy',
+    workerDeploymentId: 'dep_1',
+    workerVersionId: 'ver_1',
+    artifactDigest: 'sha256:binary',
+    containerDigest: 'sha256:image',
   });
   assert.equal(row.slug, 'agentsam-go-worker');
   assert.equal(row.kind, 'service');
+  assert.equal(row.status, 'deployed');
+  assert.equal(row.canonical_path, 'apps/agentsam-go-worker');
+  assert.equal(row.package_name, '@inneranimalmedia/agentsam-go-worker');
   assert.equal(row.metadata.runtime, 'go');
+  assert.equal(row.metadata.deployment.worker_deployment_id, 'dep_1');
+  assert.equal(row.metadata.deployment.worker_version_id, 'ver_1');
+});
+
+test('source identity produces a source-keyed Container instance', async () => {
+  const { runtimeInstanceKey } = await import('../../apps/agentsam-go-worker/worker/src/identity.js');
+  const first = runtimeInstanceKey('git:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+  const second = runtimeInstanceKey('git:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb');
+  assert.equal(first, 'runtime:git:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+  assert.equal(second, 'runtime:git:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb');
+  assert.notEqual(first, second);
+  assert.equal(runtimeInstanceKey('npm:@inneranimalmedia/agentsam-go-worker@0.1.0'), 'runtime:npm:@inneranimalmedia/agentsam-go-worker@0.1.0');
+});
+
+
+test('validation-only Cloudflare runs do not replace production receipts', async () => {
+  const fs = await import('node:fs');
+  const os = await import('node:os');
+
+  const stateRoot = fs.mkdtempSync(
+    path.join(os.tmpdir(), 'agentsam-go-receipt-isolation-'),
+  );
+
+  const goDir = path.join(stateRoot, '.agentsam', 'go');
+  fs.mkdirSync(goDir, { recursive: true });
+
+  const production = {
+    schema: 'agentsam.deployment-receipt.v1',
+    product: 'agentsam-go-worker',
+    provider: 'cloudflare',
+    url: 'https://runtime.inneranimalmedia.com',
+    health: 'healthy',
+    deployed_at: '2026-09-25T17:05:13.618296Z',
+    worker_deployment_id: 'dep_prod',
+    worker_version_id: 'ver_prod',
+    official_release: true,
+  };
+
+  fs.writeFileSync(
+    path.join(goDir, 'latest.deployment-receipt.json'),
+    JSON.stringify(production, null, 2) + '\n',
+  );
+
+  const cloudflareIdentity = {
+    ok: true,
+    authenticated: true,
+    auth_type: 'OAuth Token',
+    account: { id: 'acc_test', name: 'Test', type: 'standard' },
+    accounts: [{ id: 'acc_test', name: 'Test', type: 'standard' }],
+  };
+
+  const spawn = (command, args = []) => {
+    if (command === 'docker' && args[0] === 'info') {
+      return { status: 0, stdout: 'ok', stderr: '' };
+    }
+    if (args.includes('deploy') && args.includes('--dry-run')) {
+      return { status: 0, stdout: 'dry run', stderr: '' };
+    }
+    throw new Error('unexpected spawn: ' + [command, ...args].join(' '));
+  };
+
+  await deployGoCloudflare({
+    productRoot: PRODUCT_ROOT,
+    stateRoot,
+    product: 'agentsam-go-worker',
+    dryRun: true,
+    accountId: 'acc_test',
+    cloudflareIdentity,
+    source: {
+      identity: 'git:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+      commit: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+      package_name: '@inneranimalmedia/agentsam-go-worker',
+      package_version: '0.1.0',
+    },
+    artifactDigest: 'sha256:artifact',
+    containerDigest: 'sha256:container',
+    spawn,
+  });
+
+  const after = JSON.parse(
+    fs.readFileSync(
+      path.join(goDir, 'latest.deployment-receipt.json'),
+      'utf8',
+    ),
+  );
+
+  assert.deepEqual(after, production);
+  assert.ok(
+    fs.existsSync(
+      path.join(goDir, 'latest.deployment-validation-receipt.json'),
+    ),
+  );
 });

package/test/go/distribution.test.mjs

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+import {
+  GO_WORKER_PACKAGE,
+  discoverGoRuntime,
+  resolveProductRoot,
+} from '../../src/go/discover.js';
+
+const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const PRODUCT_ROOT = path.join(SDK_ROOT, 'apps', 'agentsam-go-worker');
+
+test('installed Go Worker package is discovered outside the monorepo', () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-go-distribution-'));
+  const packageRoot = path.join(temp, 'node_modules', ...GO_WORKER_PACKAGE.split('/'));
+  fs.mkdirSync(path.dirname(packageRoot), { recursive: true });
+  fs.symlinkSync(PRODUCT_ROOT, packageRoot, 'dir');
+
+  const discovery = discoverGoRuntime(temp);
+  assert.equal(discovery.schema, 'agentsam.go-discovery.v2');
+  assert.equal(discovery.runtime?.origin, 'installed_package');
+  assert.equal(discovery.distribution?.package_name, GO_WORKER_PACKAGE);
+  assert.equal(discovery.distribution?.package_version, '0.1.0');
+  assert.equal(fs.realpathSync(resolveProductRoot(discovery)), fs.realpathSync(PRODUCT_ROOT));
+});

package/test/google-cloud-connection.test.mjs

@@ -0,0 +1,83 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import {
+  diagnoseGoogleCloudAccountMismatch,
+  diagnoseInsufficientAccess,
+  readGoogleCloudConnection,
+  renderInsufficientAccessCard,
+  writeGoogleCloudConnection,
+} from '../src/lib/google-cloud-connection.js';
+import { describeAuthShadow, renderLoginResult } from '../src/commands/whoami.js';
+
+test('connection preference persists identity+project without secrets', () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-conn-'));
+  const saved = writeGoogleCloudConnection(
+    {
+      identity: 'meauxbility@gmail.com',
+      organization: 'inneranimals.com',
+      project: 'gen-lang-client-0684066529',
+      billing_account: '017E01-4426EF-21356F',
+    },
+    { home },
+  );
+  assert.equal(saved.identity, 'meauxbility@gmail.com');
+  assert.equal(saved.project, 'gen-lang-client-0684066529');
+  const again = readGoogleCloudConnection({ home });
+  assert.equal(again.organization, 'inneranimals.com');
+  assert.doesNotMatch(JSON.stringify(again), /private_key|BEGIN /);
+});
+
+test('identity mismatch diagnosis is deterministic', () => {
+  const d = diagnoseGoogleCloudAccountMismatch({
+    preferred: { identity: 'meauxbility@gmail.com', project: 't-pulsar-483701-q1' },
+    activeAccount: 'info@inneranimals.com',
+    activeProject: 't-pulsar-483701-q1',
+    accounts: [
+      { account: 'info@inneranimals.com', status: 'ACTIVE' },
+      { account: 'meauxbility@gmail.com', status: '' },
+    ],
+  });
+  assert.equal(d.ok, false);
+  assert.equal(d.kind, 'identity_mismatch');
+  assert.equal(d.alternate_authenticated, true);
+  assert.match(d.remediation.actions[0].command, /gcloud config set account meauxbility@gmail.com/);
+});
+
+test('insufficient access card matches product UX', () => {
+  const d = diagnoseInsufficientAccess({
+    currentAccount: 'info@inneranimals.com',
+    requiredRole: 'roles/owner',
+    project: 'gen-lang-client-0684066529',
+    accounts: [
+      { account: 'info@inneranimals.com', roles: ['roles/viewer'] },
+      { account: 'meauxbility@gmail.com', roles: ['roles/owner'] },
+    ],
+  });
+  assert.equal(d.kind, 'insufficient_access');
+  const text = renderInsufficientAccessCard(d);
+  assert.match(text, /This Google account does not have enough access/);
+  assert.match(text, /meauxbility@gmail\.com/);
+  assert.match(text, /✓ Owner/);
+  assert.match(text, /\[enter\]/);
+  assert.match(text, /\[a\]/);
+  assert.match(text, /\[c\]/);
+});
+
+test('login result explains API key shadowing OAuth', () => {
+  const status = {
+    active_auth: { kind: 'api_key', source: 'environment' },
+    api_key: { configured: true, source: 'environment' },
+    browser_session: { configured: true, expired: false, refreshable: true },
+  };
+  const text = renderLoginResult(status);
+  assert.match(text, /Browser OAuth login saved/);
+  assert.match(text, /not currently authoritative/);
+  assert.match(text, /AGENTSAM_API_KEY has higher precedence/);
+  assert.match(text, /\[enter\] keep API key/);
+  const shadow = describeAuthShadow(status);
+  assert.ok(shadow);
+  assert.match(shadow.join('\n'), /Authority lanes/);
+});

package/test/google-cloud-inventory.test.mjs

@@ -0,0 +1,64 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { normalizeGoogleCloudArgv } from '../src/commands/google-cloud.js';
+import {
+  renderServiceAccountInspect,
+  renderServiceAccountTable,
+} from '../src/lib/google-cloud-inventory.js';
+
+test('normalizeGoogleCloudArgv maps compute instances into google-cloud compute', () => {
+  assert.deepEqual(normalizeGoogleCloudArgv(['instances', 'list']), ['compute', 'instances', 'list']);
+  assert.deepEqual(normalizeGoogleCloudArgv(['iam', 'service-accounts', 'list']), ['iam', 'service-accounts', 'list']);
+  assert.deepEqual(normalizeGoogleCloudArgv(['auth', 'login']), ['auth', 'login']);
+  assert.deepEqual(normalizeGoogleCloudArgv(['gcloud', 'auth', 'login']), ['auth', 'login']);
+});
+
+test('service account table render never invents INNERANIMALMEDIA as Google keyOrigin', () => {
+  const text = renderServiceAccountTable({
+    project_id: 'gen-lang-client-0684066529',
+    accounts: [
+      {
+        name: 'Agent Sam Vertex',
+        short_name: 'agent-sam-vertex',
+        email: 'agent-sam-vertex@gen-lang-client-0684066529.iam.gserviceaccount.com',
+        attached: [],
+        key_counts: { total: 3, user_managed: 1 },
+        status: 'ready',
+        disposition_hint: 'KEEP · ROTATE user-managed keys',
+        keys: [
+          { key_type: 'USER_MANAGED', key_origin: 'GOOGLE_PROVIDED', agentsam_origin_label: 'GOOGLE_PROVIDED' },
+        ],
+      },
+    ],
+  });
+  assert.match(text, /Agent Sam Vertex/);
+  assert.match(text, /GOOGLE_PROVIDED/);
+  assert.match(text, /INNERANIMALMEDIA_PROVIDED is only for AgentSam-issued/);
+});
+
+test('inspect render shows roles and key metadata only', () => {
+  const text = renderServiceAccountInspect({
+    ok: true,
+    project_id: 'gen-lang-client-0684066529',
+    account: {
+      short_name: 'agent-sam-vertex',
+      email: 'agent-sam-vertex@gen-lang-client-0684066529.iam.gserviceaccount.com',
+      bucket: 'agentsam',
+      roles: ['roles/aiplatform.user', 'roles/aiplatform.admin'],
+      keys: [
+        {
+          key_type: 'SYSTEM_MANAGED',
+          agentsam_origin_label: 'GOOGLE_PROVIDED',
+          created_at: '2026-06-02T17:17:25Z',
+          expires_at: '2027-06-02T17:17:25Z',
+          key_id: 'abc',
+        },
+      ],
+      attached: [],
+      disposition_hint: 'KEEP · ROTATE user-managed keys',
+    },
+  });
+  assert.match(text, /roles\/aiplatform\.admin/);
+  assert.match(text, /GOOGLE_PROVIDED/);
+  assert.doesNotMatch(text, /BEGIN PRIVATE KEY/);
+});

package/test/init-options.test.mjs

@@ -0,0 +1,35 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  guidanceForRunTarget,
+  listInitProjectTypeOptions,
+  parseProjectTypeChoice,
+  RUN_TARGET_OPTIONS,
+} from '../src/lib/init-options.js';
+
+test('init project types include presets, CF scaffolds, and ready apps', () => {
+  const options = listInitProjectTypeOptions();
+  const values = options.map((row) => row.value);
+  assert.ok(values.includes('preset:fullstack'));
+  assert.ok(values.includes('preset:cms'));
+  assert.ok(values.includes('scaffold:cms'));
+  assert.ok(values.includes('scaffold:worker-api'));
+  assert.ok(values.includes('product:agentsam-rapid-rust'));
+  assert.ok(values.includes('app:client-cms-editor'));
+  assert.ok(values.some((value) => value.startsWith('app:')));
+  assert.equal(parseProjectTypeChoice('scaffold:cms').kind, 'scaffold');
+  assert.equal(parseProjectTypeChoice('app:local-studio').id, 'local-studio');
+  assert.equal(parseProjectTypeChoice('product:agentsam-rapid-rust').kind, 'product');
+});
+
+test('run targets are operational paths, not aspirational later flags', () => {
+  const values = RUN_TARGET_OPTIONS.map((row) => row.value);
+  assert.deepEqual(values, ['local', 'cloudflare', 'tauri', 'gcp', 'docker']);
+  assert.match(RUN_TARGET_OPTIONS.find((row) => row.value === 'cloudflare').hint, /OAuth/);
+  assert.match(RUN_TARGET_OPTIONS.find((row) => row.value === 'tauri').hint, /SQLite/);
+  assert.match(guidanceForRunTarget('cloudflare').join('\n'), /connections setup/);
+  assert.match(guidanceForRunTarget('tauri', { projectName: 'demo' }).join('\n'), /Local Studio/);
+  assert.match(guidanceForRunTarget('gcp').join('\n'), /google-cloud/);
+  assert.match(guidanceForRunTarget('docker').join('\n'), /dockerize/);
+});

package/test/integration/ai-access-onboarding.test.mjs

@@ -0,0 +1,47 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  assessAiAccess,
+  formatAiAccessOnboarding,
+  CF_OAUTH_REQUIRED_REDIRECTS,
+  LOCAL_STUDIO_LOGIN,
+} from '../../src/models/ai-access-onboarding.js';
+import { listModelCatalog } from '../../src/models/catalog.js';
+import { getModelRecord, mergeModelReference, listModelCatalog as listFromIndex } from '../../src/models/index.js';
+
+describe('listModelCatalog import surface', () => {
+  it('is defined from catalog and models/index', () => {
+    assert.equal(typeof listModelCatalog, 'function');
+    assert.equal(typeof listFromIndex, 'function');
+    assert.ok(listModelCatalog().length > 0);
+    assert.equal(typeof getModelRecord, 'function');
+    assert.equal(typeof mergeModelReference, 'function');
+  });
+});
+
+describe('ai access onboarding', () => {
+  it('marks ready when a provider credential is configured', () => {
+    const access = assessAiAccess({
+      inventory: { providers: [{ id: 'openai', configured: true }] },
+      ollama: { online: false, models: [] },
+      options: [{ value: 'none' }],
+    });
+    assert.equal(access.ready, true);
+    assert.equal(access.hasProviderKeys, true);
+  });
+
+  it('marks not ready and formats setup paths', () => {
+    const access = assessAiAccess({
+      inventory: { providers: [{ id: 'openai', configured: false }] },
+      ollama: { online: false, models: [] },
+      options: [{ value: 'none' }],
+    });
+    assert.equal(access.ready, false);
+    const text = formatAiAccessOnboarding(access, { wantCloudAi: true });
+    assert.match(text, /ollama\.com\/download/);
+    assert.match(text, /agentsam providers/);
+    assert.match(text, /api\/oauth\/cloudflare\/start/);
+    assert.ok(CF_OAUTH_REQUIRED_REDIRECTS.some((u) => u.includes('/api/oauth/cloudflare/callback')));
+    assert.match(LOCAL_STUDIO_LOGIN, /next=\/agentsam/);
+  });
+});

package/test/integration/app-command.test.mjs

@@ -14,6 +14,36 @@ test('lists agentsam.app.json manifests for product apps', () => {
   assert.ok(ids.includes('ecommerce-cms-agentsam'));
 });
 
+test('agentsam app validate passes for all product apps', async () => {
+  const { validateApps } = await import('../../src/commands/app.js');
+  const report = validateApps();
+  assert.equal(report.ok, true, report.errors.join('\n'));
+  assert.ok(report.apps.length >= 4);
+});
+
+test('CMS app scaffold source is included in the SDK distribution contract', async () => {
+  const { validateApps } = await import('../../src/commands/app.js');
+  const report = validateApps({ appId: 'client-cms-editor' });
+  assert.equal(report.ok, true, report.errors.join('\n'));
+  assert.deepEqual(report.warnings, []);
+});
+
+test('CAD and CMS workers load APP identity from agentsam.app.json', () => {
+  const cad = fs.readFileSync(path.resolve('apps/cad-creator/backend/worker/index.js'), 'utf8');
+  const cms = fs.readFileSync(path.resolve('apps/client-cms-editor/backend/worker/index.js'), 'utf8');
+  assert.match(cad, /import appManifest from ['"]\.\.\/\.\.\/agentsam\.app\.json['"]/);
+  assert.match(cms, /import appManifest from ['"]\.\.\/\.\.\/agentsam\.app\.json['"]/);
+  assert.doesNotMatch(cad, /const\s+APP\s*=\s*["']/);
+  assert.doesNotMatch(cms, /const\s+APP\s*=\s*["']/);
+});
+
+test('desktop CMS shell app_id resolves to client-cms-editor', () => {
+  const manifest = JSON.parse(
+    fs.readFileSync(path.resolve('packages/agentsam-desktop-shell/manifests/cms-editor.json'), 'utf8'),
+  );
+  assert.equal(manifest.app_id, 'client-cms-editor');
+});
+
 
 test('Ecommerce CMS app bin exposes truthful runnable doctor state', () => {
   const bin = path.resolve('apps/ecommerce-cms-agentsam/bin/agentsam-ecommerce.mjs');

package/test/integration/cad-project.test.mjs

@@ -51,12 +51,15 @@ test('agent and runtime share executable CAD handlers',async t=>{
 test('CAD registry projects the app into tools workflows and CLI graph relationships',()=>{
  const manifest=JSON.parse(fs.readFileSync(new URL('../../registry/cad-project/manifest.json',import.meta.url),'utf8'));
  const migration=fs.readFileSync(new URL('../../registry/cad-project/migration.sql',import.meta.url),'utf8');
- assert.equal(manifest.product.slug,'agentsam-cad-creator');
+ assert.equal(manifest.product.app_id,'cad-creator');
+ assert.equal(manifest.product.slug,'cad-creator');
  assert.deepEqual(manifest.product.capability_keys,['design.read','design.write','design.export']);
  assert.equal(manifest.product.cli_commands[0].id,'agentsam:cad:project');
  assert.equal(manifest.tools.length,9);
  assert.equal(manifest.workflows.length,2);
+ assert.match(migration,/WHERE slug='cad-creator'/);
  assert.match(migration,/WHERE slug='agentsam-cad-creator'/);
+ assert.match(migration,/legacy_slug','agentsam-cad-creator/);
  assert.equal((migration.match(/'exposes_tool'/g)||[]).length,9);
  assert.equal((migration.match(/'provides_workflow'/g)||[]).length,2);
  assert.equal((migration.match(/'exposes_command'/g)||[]).length,1);

package/test/integration/cli-help.test.mjs

@@ -14,7 +14,7 @@ test('agentsam help is concise, topic-aware, and deterministic outside a TTY', (
   assert.equal(help.status, 0, help.stderr);
   assert.doesNotMatch(help.stderr, /Unknown command/);
   assert.match(help.stdout, /Agent Sam/);
-  assert.match(help.stdout, /Type normally to work with Agent Sam/);
+  assert.match(help.stdout, /SAM = Systematic Autonomous Machinery/);
   assert.match(help.stdout, /agentsam help <topic>/);
   assert.match(help.stdout, /press \/ for the command picker/i);
   assert.doesNotMatch(help.stdout, /Inspect options:/);