@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/test/terminal/local-pty.mock.test.mjs

@@ -139,7 +139,9 @@ test('local PTY server health check uses an ephemeral local port and no ExecOS t
     assert.equal(health.status, 200);
     const body = await health.json();
     assert.equal(body.ok, true);
-    assert.equal(body.service, 'agentsam-local-pty');
+    assert.equal(body.service, 'agentsam.local.runtime');
+    assert.equal(body.plane, 'local');
+    assert.equal(body.service_legacy, 'agentsam-local-pty');
     assert.equal(body.port, server.port);
     assert.equal(server.port > 0, true);
   } finally {

package/test/terminal-machine-identity.test.mjs

@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { runTerminal } from '../src/commands/terminal.js';
+import { normalizeTerminalArch, normalizeTerminalPlatform } from '../src/lib/terminal/machine-identity.js';
+
+test('identity command prints this host vocabulary without calling the network', async () => {
+  const lines = [];
+  const result = await runTerminal(['identity'], {
+    write: (line) => lines.push(line),
+    collectIdentity: async () => ({
+      hostname: 'Sams-iMac',
+      platform: 'macos',
+      arch: 'arm64',
+      model: 'Mac16,2',
+    }),
+    postJson: async () => {
+      throw new Error('identity must not post');
+    },
+  });
+  assert.equal(result.ok, true);
+  assert.equal(result.arch, 'arm64');
+  assert.match(lines.join('\n'), /arch:\s+arm64/);
+  assert.match(lines.join('\n'), /hw_model:\s+Mac16,2/);
+});
+
+test('enroll without a target does not mint a token', async () => {
+  let posted = false;
+  const result = await runTerminal(['enroll', '--json'], {
+    write: () => {},
+    collectIdentity: async () => ({ hostname: 'box', platform: 'linux', arch: 'x86_64', model: 'container' }),
+    postJson: async () => { posted = true; return {}; },
+  });
+  assert.equal(posted, false);
+  assert.equal(result.enrolled, false);
+  assert.equal(result.arch, 'x86_64');
+});
+
+test('enroll posts canonical identity for the instance the caller named', async () => {
+  let body = null;
+  const result = await runTerminal(['enroll', '--instance', 'tinst_sams_imac', '--json'], {
+    write: () => {},
+    collectIdentity: async () => ({
+      hostname: 'Sams-iMac',
+      platform: 'macos',
+      arch: 'arm64',
+      model: 'Mac16,2',
+    }),
+    postJson: async (_path, posted) => {
+      body = posted;
+      return { instance_id: 'tinst_sams_imac', connection_id: 'conn_mac_local', enrollment_token_id: 'tenr_test', enrollment_token: 'tok_test' };
+    },
+  });
+  assert.equal(result.enrolled, true);
+  assert.equal(body.instance_id, 'tinst_sams_imac');
+  assert.equal(body.platform, 'macos');
+  assert.equal(body.arch, 'arm64');
+  assert.equal(body.hw_model, 'Mac16,2');
+  assert.equal(body.kind, 'local_device');
+});
+
+test('enroll --pair consumes the token via ExecOS enroll (writes AGENTSAM_BRIDGE_KEY)', async () => {
+  let pairedToken = null;
+  const result = await runTerminal(['enroll', '--instance', 'tinst_sams_imac', '--pair', '--json'], {
+    write: () => {},
+    collectIdentity: async () => ({ hostname: 'box', platform: 'macos', arch: 'arm64', model: 'Mac16,2' }),
+    postJson: async () => ({
+      instance_id: 'tinst_sams_imac',
+      connection_id: 'conn_mac_local',
+      enrollment_token: 'tok_pair',
+      endpoint_url: 'https://localpty.inneranimalmedia.com',
+    }),
+    pairImpl: async (token) => {
+      pairedToken = token;
+      return { ok: true };
+    },
+  });
+  assert.equal(pairedToken, 'tok_pair');
+  assert.equal(result.paired, true);
+  assert.equal(result.auth_mode, 'connection_token');
+});
+
+test('normalizer matches the worker vocabulary', () => {
+  assert.equal(normalizeTerminalPlatform('darwin'), 'macos');
+  assert.equal(normalizeTerminalPlatform('win32'), 'windows');
+  assert.equal(normalizeTerminalArch('x64'), 'x86_64');
+  assert.equal(normalizeTerminalArch('aarch64'), 'arm64');
+});

package/test/whoami-resume.test.mjs

@@ -32,8 +32,23 @@ test('whoami validates persisted IAM browser identity while never returning acco
         cloudflare: { ok: true }, byok: { openai: { configured: true, masked: 'secret' } },
         terminal: {
           available: true,
-          instances: [{ id: 'inst_1', name: 'Mac', metadata_json: 'secret' }],
-          connections: [{ id: 'conn_1', instance_id: 'inst_1', name: 'Tunnel', is_active: true, endpoint_url: 'wss://secret' }],
+          instances: [{
+            id: 'inst_1',
+            name: 'Mac',
+            provider: 'local',
+            last_seen_at: 1789716970,
+            metadata_json: 'secret',
+          }],
+          connections: [{
+            id: 'conn_1',
+            instance_id: 'inst_1',
+            name: 'Tunnel',
+            is_active: true,
+            is_default: true,
+            transport_provider: 'cloudflare_tunnel',
+            endpoint_url: 'wss://localpty.example.test/terminal',
+            last_seen_at: 1789716970,
+          }],
         },
       };
     },
@@ -41,11 +56,17 @@ test('whoami validates persisted IAM browser identity while never returning acco
   assert.equal(status.authenticated, true);
   assert.equal(status.identity.account_id, 'acct_server');
   assert.equal(status.active_auth.source, 'agentsam_browser_oauth');
-  assert.equal(status.active_auth.kind, 'browser_oauth');
+  assert.equal(status.active_auth.kind, 'agentsam_browser_oauth');
   assert.equal(status.provider_credentials.find(row => row.provider === 'openai').configured, true);
+  assert.equal(status.provider_credentials.find(row => row.provider === 'openai').owner_account_id, 'acct_server');
+  assert.equal(status.provider_credentials.find(row => row.provider === 'openai').account_id, 'acct_server');
+  assert.equal(status.identity.email, 'dev@example.test');
   assert.equal(status.terminal.connections[0].id, 'conn_1');
+  assert.equal(status.terminal.connections[0].connection_id, 'conn_1');
+  assert.equal(status.terminal.connections[0].public_url, 'wss://localpty.example.test/terminal');
+  assert.match(status.terminal.connections[0].last_seen_at_iso || '', /^2026-/);
   const serialized = JSON.stringify(status);
-  assert.doesNotMatch(serialized, /browser_session_do_not_print|sk-never-print-this|masked|endpoint_url|metadata_json|wss:\/\/secret/);
+  assert.doesNotMatch(serialized, /browser_session_do_not_print|sk-never-print-this|masked|metadata_json/);
 });
 
 test('whoami sends the exact authority returned by the resolver to the default context loader', async t => {
@@ -86,7 +107,7 @@ test('whoami uses a valid browser session when a stale environment API key is in
     },
   });
   assert.equal(status.authenticated, true);
-  assert.equal(status.active_auth.kind, 'browser_oauth');
+  assert.equal(status.active_auth.kind, 'agentsam_browser_oauth');
   assert.equal(status.api_key.valid, false);
   assert.equal(status.api_key.error, 'invalid_api_key_prefix');
 });
@@ -115,7 +136,7 @@ test('whoami refreshes an expired browser session before validating IAM context'
   });
   assert.equal(refreshed, 1);
   assert.equal(status.authenticated, true);
-  assert.equal(status.active_auth.kind, 'browser_oauth');
+  assert.equal(status.active_auth.kind, 'agentsam_browser_oauth');
 });
 
 test('resume restores saved cwd and session through the canonical shell runtime', async t => {

package/packages/agentsam-brand/test/brand-scan.test.mjs

@@ -1,106 +0,0 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import { execFileSync } from 'node:child_process';
-import { brandScan, brandResolve } from '../src/index.js';
-import { repositorySnapshot } from '../../../src/capabilities/index.js';
-import { scanTrustBoundary } from '../../../src/security/trust-boundary.js';
-import { suggestNextActions, routeDeterministicIntent } from '../../../src/progression/index.js';
-
-function fixtureRepo() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-brand-'));
-  execFileSync('git', ['init'], { cwd: root, stdio: 'ignore' });
-  execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: root, stdio: 'ignore' });
-  execFileSync('git', ['config', 'user.name', 'Test'], { cwd: root, stdio: 'ignore' });
-  fs.writeFileSync(path.join(root, '.gitignore'), 'ignored/\nnode_modules/\n');
-  fs.mkdirSync(path.join(root, 'src/styles'), { recursive: true });
-  fs.mkdirSync(path.join(root, 'src/components'), { recursive: true });
-  fs.mkdirSync(path.join(root, 'ignored'), { recursive: true });
-  fs.writeFileSync(
-    path.join(root, 'src/styles/theme.css'),
-    `:root {\n  --color-slate-950: #0f172a;\n  --black: #111111;\n  color: #101010;\n  background: rgb(17, 17, 17);\n  font-family: "Inter", system-ui;\n  font-size: 16px;\n  border-radius: 8px;\n}\n`,
-  );
-  fs.writeFileSync(
-    path.join(root, 'src/components/Button.tsx'),
-    `export function Button() { return <button className="bg-neutral-950 text-white">Go</button>; }\n`,
-  );
-  fs.writeFileSync(
-    path.join(root, 'src/components/Header.tsx'),
-    `export function Header() { return <header style={{ background: '#0f172a' }}>Nav</header>; }\n`,
-  );
-  fs.writeFileSync(path.join(root, 'ignored/secret.css'), `:root { --should-not-see: #ff0000; }\n`);
-  execFileSync('git', ['add', '.'], { cwd: root, stdio: 'ignore' });
-  execFileSync('git', ['commit', '-m', 'init'], { cwd: root, stdio: 'ignore' });
-  return root;
-}
-
-test('brand.scan derives stable brand evidence from repository snapshot', async (t) => {
-  const root = fixtureRepo();
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-
-  const snapshot = await repositorySnapshot({ cwd: root, churnDays: 30 });
-  const one = await brandScan({ cwd: root, snapshot });
-  const two = await brandScan({ cwd: root, snapshot });
-
-  assert.equal(one.capability, 'brand.scan');
-  assert.equal(one.deterministic, true);
-  assert.equal(one.model_required, false);
-  assert.equal(one.repository.snapshot_id, snapshot.snapshot_id);
-  assert.equal(one.repository.snapshot_id, two.repository.snapshot_id);
-  assert.match(one.content_hash, /^sha256:[a-f0-9]{64}$/);
-  assert.equal(one.content_hash, two.content_hash);
-  assert.deepEqual(one.tokens.colors.map((c) => c.normalized_value), two.tokens.colors.map((c) => c.normalized_value));
-  assert.ok(one.tokens.colors.length >= 2);
-  assert.equal(one.sources.css >= 1, true);
-});
-
-test('brand scan and repository inspection share one file authority', async (t) => {
-  const root = fixtureRepo();
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-
-  const snapshot = await repositorySnapshot({ cwd: root, churnDays: 30 });
-  const boundary = await scanTrustBoundary(root);
-  const brand = await brandScan({ cwd: root, snapshot });
-
-  assert.equal(snapshot.tree.merkle_root, boundary.merkle_root);
-  assert.equal(snapshot.tree.metadata_root, boundary.metadata_root);
-  assert.equal(brand.repository.merkle_root, snapshot.tree.merkle_root);
-  assert.equal(brand.repository.path_count, snapshot.tree.paths.length);
-  assert.equal(snapshot.tree.paths.some((p) => p.startsWith('ignored/')), false);
-  assert.equal(
-    JSON.stringify(brand).includes('should-not-see') || JSON.stringify(brand).includes('#ff0000'),
-    false,
-  );
-});
-
-test('brand.resolve keeps observed/inferred/declared/resolved separated', async (t) => {
-  const root = fixtureRepo();
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  const snapshot = await repositorySnapshot({ cwd: root, churnDays: 30 });
-  const scan = await brandScan({ cwd: root, snapshot });
-  const resolved = brandResolve(scan);
-  assert.equal(resolved.capability, 'brand.resolve');
-  assert.ok(Array.isArray(resolved.observed.colors));
-  assert.equal(typeof resolved.inferred.colors, 'object');
-  assert.deepEqual(resolved.declared, {});
-  assert.equal(typeof resolved.resolved.colors, 'object');
-});
-
-test('progression engine suggests brand next actions without a model', () => {
-  const { next_actions } = suggestNextActions({
-    capability: 'brand.scan',
-    result: { conflicts: [{ kind: 'near_duplicate_color' }], complete: true },
-  });
-  assert.ok(next_actions.some((a) => a.id === 'brand.inspect.conflicts'));
-  assert.ok(next_actions.some((a) => a.command?.includes('plan brand')));
-  assert.equal(next_actions.every((a) => a.requires_model === false), true);
-});
-
-test('deterministic intent router handles what next without a model', () => {
-  const hit = routeDeterministicIntent('what should I do next?');
-  assert.equal(hit.intent, 'next');
-  assert.equal(hit.use_progression, true);
-  assert.equal(routeDeterministicIntent('show brand').command, 'agentsam brand');
-});

package/packages/work-graph/prototype/README.md

@@ -1,32 +0,0 @@
-# AgentSam Timeline Prototype
-
-`prototype-gnantt.html` renders from the WorkGraph demo — bars, board, list, and drawer are projections, not hardcoded markup.
-
-Flow:
-
-```
-demo-workgraph.js
-        |
-        v
-workgraph-runtime.js / timeline-model.js
-        |
-        v
-prototype-gnantt.html (ES module bootstrap)
-```
-
-The timeline is a projection of the graph, not the source of truth.
-
-Supported projections:
-
-- task timeline bars (status-colored)
-- agent / human owner lanes in the sidebar
-- evidence / artifact drawer data
-- timeline event markers
-- board + list views from the same work items
-
-Open locally (module imports need a static server):
-
-```bash
-npx --yes serve -l 4173 .
-# then http://localhost:4173/prototype-gnantt.html
-```

package/packages/work-graph/prototype/data/demo-workgraph.js

@@ -1,47 +0,0 @@
-export const demoWorkGraph = {
-  id: "mission_indexer_refactor",
-  title: "AgentSam Repository Intelligence Upgrade",
-  actors: [
-    { id: "sam", type: "human", name: "Sam" },
-    { id: "agent-a1", type: "agent", name: "Indexer Agent", model: "gpt-5-codex" },
-    { id: "agent-a2", type: "agent", name: "Embedding Agent", model: "gpt-5-mini" }
-  ],
-  workItems: [
-    {
-      id: "repo-discovery",
-      title: "Repository discovery",
-      owner: "agent-a1",
-      status: "complete",
-      start: "2026-08-01",
-      end: "2026-08-03",
-      dependencies: [],
-      artifacts: ["repository-manifest.json"],
-      evidence: ["run_18291"]
-    },
-    {
-      id: "ast-indexing",
-      title: "AST indexing",
-      owner: "agent-a1",
-      status: "running",
-      start: "2026-08-03",
-      end: "2026-08-08",
-      dependencies: ["repo-discovery"],
-      artifacts: ["index-report.json"],
-      evidence: ["run_18292"]
-    },
-    {
-      id: "embedding-pipeline",
-      title: "Embedding pipeline",
-      owner: "agent-a2",
-      status: "queued",
-      start: "2026-08-07",
-      end: "2026-08-12",
-      dependencies: ["ast-indexing"]
-    }
-  ],
-  timelineEvents: [
-    { type: "commit", label: "Manifest commit created", timestamp: "2026-08-03T14:20" },
-    { type: "test", label: "Compatibility suite passed", timestamp: "2026-08-05T09:00" },
-    { type: "deploy", label: "Preview deployed", timestamp: "2026-08-08T15:30" }
-  ]
-};

package/packages/work-graph/prototype/renderers/timeline-model.js

@@ -1,21 +0,0 @@
-export function buildTimelineModel(workGraph) {
-  return {
-    title: workGraph.title,
-    lanes: workGraph.actors.map(actor => ({
-      id: actor.id,
-      name: actor.name,
-      type: actor.type,
-      items: workGraph.workItems.filter(item => item.owner === actor.id)
-    })),
-    events: workGraph.timelineEvents ?? []
-  };
-}
-
-export function getStatusClass(status) {
-  return {
-    complete: "green",
-    running: "blue",
-    blocked: "red",
-    queued: "gray"
-  }[status] ?? "gray";
-}

package/packages/work-graph/prototype/renderers/workgraph-runtime.js

@@ -1,38 +0,0 @@
-// WorkGraph -> Timeline runtime helpers
-// Keeps the UI renderer independent from mission data shape.
-
-export function buildAgentLanes(graph) {
-  return (graph.actors || [])
-    .filter(actor => actor.type === 'agent' || actor.type === 'human')
-    .map(actor => ({
-      id: actor.id,
-      name: actor.name,
-      items: (graph.workItems || []).filter(item => item.owner === actor.id),
-    }));
-}
-
-export function buildTimelineBars(graph) {
-  return (graph.workItems || []).map(item => ({
-    id: item.id,
-    label: item.title,
-    owner: item.owner,
-    status: item.status,
-    start: item.start,
-    end: item.end,
-    artifacts: item.artifacts || [],
-    evidence: item.evidence || [],
-  }));
-}
-
-export function buildEventMarkers(graph) {
-  return (graph.timelineEvents || []).map(event => ({
-    id: event.id || `${event.type}-${event.timestamp}`,
-    type: event.type,
-    label: event.label,
-    timestamp: event.timestamp,
-  }));
-}
-
-export function getWorkItemDetails(graph, id) {
-  return (graph.workItems || []).find(item => item.id === id) || null;
-}