@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.5

package/src/security/local-vault.js

@@ -120,7 +120,9 @@ function osStoreWriteDarwin(provider, secret) {
   try {
     const res = spawnSync('/usr/bin/security', ['add-generic-password', '-a', `agentsam:${provider}`, '-s', 'agentsam', '-w', secret, '-U'], {
       stdio: 'ignore',
+      timeout: 12_000,
     });
+    if (res.error?.code === 'ETIMEDOUT' || res.signal === 'SIGTERM') return false;
     return res.status === 0;
   } catch { return false; }
 }

package/src/security/scan.js

@@ -4,7 +4,7 @@ import { triageLog, resolveLogFindings } from './logs.js';
 import { scanTrustBoundary } from './trust-boundary.js';
 
 export async function scanProjectSecurity(options = {}) {
-  const inventory = collectNpmDependencies(options.projectRoot);
+  const inventory = collectNpmDependencies(options.projectRoot, { releaseCandidate: options.releaseCandidate });
   const results = options.offline
     ? inventory.dependencies.map(d => ({ ...d, checked: false, advisories: [] }))
     : await queryOsv(inventory.dependencies, options);

package/test/account-session.test.mjs

@@ -38,7 +38,7 @@ test('opaque browser login persists in machine-local storage and resolves indepe
   assert.equal(loaded.access_token, 'browser_session_machine_test');
   const browser = resolveBrowserSessionCredential({ env: {}, home });
   assert.equal(browser.source, 'agentsam_browser_oauth');
-  assert.equal(browser.kind, 'browser_oauth');
+  assert.equal(browser.kind, 'agentsam_browser_oauth');
   assert.equal(browser.value, 'browser_session_machine_test');
   assert.equal(resolveAccountApiKey({ env: {}, home }).value, '');
   assert.equal(resolveAccountAuth({ env: {}, home }).value, 'browser_session_machine_test');
@@ -70,7 +70,7 @@ test('invalid environment API key cannot shadow a valid browser login', t => {
   saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
   const resolved = resolveAccountAuth({ env: { AGENTSAM_API_KEY: 'not-an-aak' }, home });
   assert.equal(resolved.value, 'browser_session_machine_test');
-  assert.equal(resolved.kind, 'browser_oauth');
+  assert.equal(resolved.kind, 'agentsam_browser_oauth');
   assert.equal(resolved.fallback_error, 'invalid_api_key_prefix');
 });
 
@@ -79,7 +79,7 @@ test('async IAM authority also falls back from invalid environment key to browse
   saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
   const resolved = await resolveAccountAuthority({ env: { AGENTSAM_API_KEY: 'not-an-aak' }, home });
   assert.equal(resolved.value, 'browser_session_machine_test');
-  assert.equal(resolved.kind, 'browser_oauth');
+  assert.equal(resolved.kind, 'agentsam_browser_oauth');
   assert.equal(resolved.fallback_error, 'invalid_api_key_prefix');
 });
 

package/test/app-authority-context.test.mjs

@@ -0,0 +1,32 @@
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+import { resolveCurrentAppContext } from '../src/lib/app-authority.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(HERE, '..');
+
+test('generic repo root has no fabricated app identity', () => {
+  const context = resolveCurrentAppContext({ root: ROOT, cwd: ROOT });
+  assert.deepEqual(context, { app_id: null, host_origin: null, source: null });
+});
+
+test('Local Studio context resolves from nearest agentsam.app.json', () => {
+  const context = resolveCurrentAppContext({
+    root: ROOT,
+    cwd: path.join(ROOT, 'apps/local-studio/frontend'),
+  });
+  assert.equal(context.app_id, 'local-studio');
+  assert.equal(context.host_origin, null);
+  assert.match(context.source || '', /apps\/local-studio\/agentsam\.app\.json$/);
+});
+
+test('package app identity resolves from its own manifest without Local Studio leakage', () => {
+  const context = resolveCurrentAppContext({
+    root: ROOT,
+    cwd: path.join(ROOT, 'packages/agentsam-database-editor/src'),
+  });
+  assert.equal(context.app_id, 'database-editor');
+  assert.equal(context.host_origin, null);
+});

package/test/cli/codebaseindex-plan-ux.test.mjs

@@ -32,6 +32,6 @@ describe('inventory path categories', () => {
     assert.equal(classifyTopLevel('node_modules'), 'dependencies');
     assert.equal(classifyTopLevel('dist'), 'dependencies');
     assert.equal(classifyTopLevel('generated'), 'generated');
-    assert.equal(classifyTopLevel('.agentsam'), 'config');
+    assert.equal(classifyTopLevel('.agentsam'), 'operational');
   });
 });

package/test/cli/mcp-client.test.mjs

@@ -58,7 +58,7 @@ test('MCP authority store manages servers under ~/.agentsam/mcp with safe permis
   assert.equal(readMcpServer('inneranimalmedia', { home }), null);
 });
 
-test('MCP external client registry recognizes chatgpt, claude, cursor and respects is_active', async () => {
+test('MCP external client registry recognizes chatgpt, claude, cursor — not CF portals', async () => {
   const home = tempHome();
 
   // Baseline seed / cached client list
@@ -68,9 +68,11 @@ test('MCP external client registry recognizes chatgpt, claude, cursor and respec
   assert.ok(keys.includes('cursor'), 'Cursor is recognized in the external client registry');
   assert.ok(keys.includes('claude'), 'Claude is recognized in the external client registry');
   assert.ok(keys.includes('agentsam'), 'AgentSam is recognized in the external client registry');
+  assert.equal(keys.some((k) => k.startsWith('cf_')), false, 'CF MCP portals are servers, not clients');
 
   assert.equal(isClientRegistered('chatgpt', { home }), true);
   assert.equal(isClientRegistered('cursor', { home }), true);
+  assert.equal(isClientRegistered('cf_bindings_mcp', { home }), false);
   assert.equal(isClientRegistered('nonexistent_client_xyz', { home }), false);
 
   // Cache path is created upon writing
@@ -154,23 +156,25 @@ test('MCP client adapters materialize Cursor, Claude, and ChatGPT configurations
   assert.equal(fs.existsSync(chatgptConfigPath), false);
 });
 
-test('MCP server catalog resolves real registered servers with live health metrics', () => {
+test('MCP server catalog resolves CF portal bundles + IAM without fabricated health', () => {
   const home = tempHome();
   const catalog = listKnownServers({ home });
   assert.ok(catalog.length >= 8);
 
-  // Cloudflare API server from D1
   const cfApi = resolveServerPreset('cloudflare-api', { home });
   assert.ok(cfApi);
   assert.equal(cfApi.url, 'https://mcp.cloudflare.com/mcp');
-  assert.equal(cfApi.health_status, 'degraded');
-  assert.equal(cfApi.avg_latency_ms, 9);
+  assert.equal(cfApi.provider, 'cloudflare');
+  assert.equal(cfApi.kind, 'mcp_portal_bundle');
+  assert.ok(cfApi.portal_manage_scopes.includes('mcp-portals.read'));
+
+  const bindings = resolveServerPreset('cloudflare-bindings', { home });
+  assert.ok(bindings);
+  assert.ok(bindings.feature_packs.includes('data'));
 
-  // InnerAnimalMedia Main MCP from D1
   const iam = resolveServerPreset('inneranimalmedia', { home });
   assert.ok(iam);
-  assert.equal(iam.health_status, 'healthy');
-  assert.equal(iam.avg_latency_ms, 443);
+  assert.equal(iam.url, 'https://mcp.inneranimalmedia.com/mcp');
 });
 
 test('MCP telemetry logs tool receipts and computes accurate summaries', () => {
@@ -204,6 +208,7 @@ test('agentsam mcp CLI handles add, list, status, doctor, and remove end-to-end'
   const helpText = logs.join('\n');
   assert.ok(helpText.includes('chatgpt'), 'Help text displays ChatGPT as a recognized client');
   assert.ok(helpText.includes('cloudflare-api'), 'Help text displays cloudflare-api preset');
+  assert.ok(helpText.includes('bindings.mcp.cloudflare.com') || helpText.includes('cloudflare-bindings'), 'CF portal hostnames remain offerable');
   logs.length = 0;
 
   // Add inneranimalmedia preset for chatgpt client
@@ -230,11 +235,17 @@ test('agentsam mcp CLI handles add, list, status, doctor, and remove end-to-end'
   assert.equal(statusRes.name, 'inneranimalmedia');
   assert.equal(statusRes.hasAuth, true);
 
-  // Doctor includes catalog health data
+  // Doctor includes catalog / CF pack metadata
   const doctorRes = await runMcp(['doctor', 'inneranimalmedia', '--json'], { home, write });
   assert.equal(doctorRes.name, 'inneranimalmedia');
   assert.equal(doctorRes.authConfigured, true);
-  assert.equal(doctorRes.catalogHealth?.health_status, 'healthy');
+  assert.equal(doctorRes.catalog?.auth_type, 'bearer');
+
+  // Cloudflare bundle scopes are pack-scoped (includes mcp-portals.*)
+  const scopeRes = await runMcp(['scopes', 'cloudflare-bindings', '--json'], { home, write });
+  assert.ok(scopeRes.oauth_scopes.includes('mcp-portals.read'));
+  assert.ok(scopeRes.oauth_scopes.includes('mcp-portals.write'));
+  assert.ok(scopeRes.oauth_scopes.includes('d1.read'));
 
   // Remove
   const removeRes = await runMcp(['remove', 'inneranimalmedia', '--client', 'all', '--json'], { home, write });

package/test/cli/runtime-persist.test.mjs

@@ -0,0 +1,56 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  buildWindowsScheduledTaskXml,
+  buildLaunchAgentPlist,
+  writeWindowsScheduledTask,
+  WINDOWS_TASK_NAME,
+} from '../../src/lib/setup/runtime-persist.js';
+
+test('buildWindowsScheduledTaskXml includes binary, listen, logon trigger', () => {
+  const xml = buildWindowsScheduledTaskXml({
+    binary: 'C:\\Users\\sam\\.agentsam\\bin\\agentsamd.exe',
+    listen: '127.0.0.1:18765',
+    workingDirectory: 'C:\\Users\\sam\\.agentsam\\bin',
+  });
+  assert.match(xml, /agentsamd\.exe/);
+  assert.match(xml, /--listen 127\.0\.0\.1:18765/);
+  assert.match(xml, /LogonTrigger/);
+  assert.match(xml, /InteractiveToken/);
+  assert.match(xml, /RestartOnFailure/);
+});
+
+test('buildLaunchAgentPlist includes KeepAlive and listen', () => {
+  const plist = buildLaunchAgentPlist({
+    binary: '/Users/sam/.agentsam/bin/agentsamd',
+    listen: '127.0.0.1:18765',
+    stdoutLog: '/tmp/out.log',
+    stderrLog: '/tmp/err.log',
+  });
+  assert.match(plist, /com\.inneranimalmedia\.agentsamd/);
+  assert.match(plist, /KeepAlive/);
+  assert.match(plist, /127\.0\.0\.1:18765/);
+});
+
+test('writeWindowsScheduledTask writes XML without calling schtasks when skipRegister', async () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-runtime-'));
+  try {
+    const result = await writeWindowsScheduledTask(
+      home,
+      path.join(home, '.agentsam', 'bin', 'agentsamd.exe'),
+      '127.0.0.1:18765',
+      { forcePlatform: 'win32', skipRegister: true },
+    );
+    assert.equal(result.kind, 'scheduled_task');
+    assert.equal(result.taskName, WINDOWS_TASK_NAME);
+    assert.equal(result.registered, false);
+    assert.ok(fs.existsSync(result.xmlPath));
+    const xml = fs.readFileSync(result.xmlPath, 'utf8');
+    assert.match(xml, /agentsamd\.exe/);
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});

package/test/cli/rust-command.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getCliCommand } from '../../src/cli/command-catalog.js';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+
+test('rust/wasm command aliases resolve to one catalog authority', () => {
+  const rust = getCliCommand('rust');
+  assert.equal(rust?.id, 'rust');
+  assert.equal(getCliCommand('wasm')?.id, 'rust');
+  assert.equal(getCliCommand('rapid-rust')?.id, 'rust');
+});
+
+test('rapid rust root bin and native crate ship in source tree', () => {
+  assert.equal(fs.existsSync(path.join(root, 'bin/agentsam-rapid-rust')), true);
+  assert.equal(fs.existsSync(path.join(root, 'packages/agentsam-rapid-rust/Cargo.toml')), true);
+  assert.equal(fs.existsSync(path.join(root, 'scripts/build_rapid_rust_cli.py')), true);
+});

package/test/credentials-audit.test.mjs

@@ -0,0 +1,113 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  remediateGcloudEdgeServiceAccountKey,
+  remediateGcloudPermissionDenied,
+  remediateGithubTokenShadow,
+  remediateProviderFailure,
+  renderRemediationCard,
+  recommendedCommand,
+} from '../src/lib/provider-command-remediation.js';
+import { runCredentials } from '../src/commands/credentials.js';
+import { listCheatSheetGroups, renderCheatSheet } from '../src/commands/cheat-sheet.js';
+import { collectCredentialsAudit } from '../src/lib/credentials-audit.js';
+
+test('edge-cloud service-account key create remediates to IAM / compute intents', () => {
+  const card = remediateGcloudEdgeServiceAccountKey({
+    argv: ['gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
+    projectId: 'gen-lang-client-0684066529',
+    instance: 'iam-tunnel',
+    zone: 'us-central1-f',
+  });
+  assert.ok(card);
+  assert.equal(card.provider, 'google_cloud');
+  assert.equal(card.kind, 'command_incomplete_wrong_family');
+  assert.match(card.summary, /Distributed Cloud Edge/i);
+  assert.match(card.summary, /Compute Engine/i);
+  const commands = card.actions.map((row) => row.command).join('\n');
+  assert.match(commands, /gcloud compute instances describe iam-tunnel/);
+  assert.match(commands, /gcloud iam service-accounts list/);
+  assert.match(commands, /gcloud iam service-accounts keys create/);
+  assert.match(commands, /agentsam connections/);
+  const rendered = renderRemediationCard(card);
+  assert.match(rendered, /Command incomplete/);
+  assert.match(rendered, /\[enter\]/);
+  assert.equal(recommendedCommand(card), card.actions[0].command);
+});
+
+test('remediateProviderFailure matches edge-cloud argv fixture', () => {
+  const card = remediateProviderFailure({
+    argv: ['gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
+    stderr: 'ERROR: argument OUTPUT_FILE (--service-account : --location): Must be specified.',
+  });
+  assert.ok(card);
+  assert.equal(card.kind, 'command_incomplete_wrong_family');
+});
+
+test('permission denied remediation exposes reauth + IAM console actions', () => {
+  const card = remediateGcloudPermissionDenied({
+    operation: 'compute.instances.list',
+    projectId: 'gen-lang-client-0684066529',
+    connection: 'Google Cloud · InnerAnimalMedia',
+  });
+  assert.equal(card.kind, 'permission_denied');
+  assert.match(renderRemediationCard(card), /Permission missing/);
+  assert.match(renderRemediationCard(card), /Re-authorize Google Cloud/);
+  assert.ok(card.actions.some((row) => /console\.cloud\.google\.com\/iam-admin/i.test(row.docs_url || '')));
+});
+
+test('github token shadow remediation prefers unset + keyring status', () => {
+  const card = remediateGithubTokenShadow({
+    envTokenPresent: true,
+    keyringHealthy: true,
+    scopes: ['repo', 'read:org'],
+  });
+  assert.ok(card);
+  assert.equal(card.kind, 'credential_shadow');
+  assert.match(recommendedCommand(card), /unset GITHUB_TOKEN/);
+});
+
+test('credentials remediate CLI prints edge-cloud card without secrets', async () => {
+  const chunks = [];
+  const code = await runCredentials(
+    ['remediate', '--', 'gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
+    { write: (s) => chunks.push(s) },
+  );
+  assert.equal(code, 0);
+  const out = chunks.join('');
+  assert.match(out, /Google Cloud/);
+  assert.match(out, /gcloud iam service-accounts list/);
+  assert.doesNotMatch(out, /gho_/);
+  assert.doesNotMatch(out, /AIza/);
+});
+
+test('credentials audit --names-only never includes secret-looking values', async () => {
+  const report = await collectCredentialsAudit({
+    env: {
+      HOME: process.env.HOME,
+      AGENTSAM_API_KEY: 'aak_test_should_never_appear_in_output_fields_as_value',
+      GITHUB_TOKEN: 'ghp_should_never_be_echoed',
+      OPENAI_API_KEY: 'sk-should-never-be-echoed',
+    },
+    verify: false,
+    drift: true,
+    namesOnly: true,
+    noNetwork: true,
+  });
+  const blob = JSON.stringify(report);
+  assert.doesNotMatch(blob, /aak_test_should_never/);
+  assert.doesNotMatch(blob, /ghp_should_never/);
+  assert.doesNotMatch(blob, /sk-should-never/);
+  assert.equal(report.shell_presence.GITHUB_TOKEN, true);
+  assert.equal(report.shell_presence.AGENTSAM_API_KEY, true);
+  assert.ok(report.drift.some((row) => row.code === 'github_env_token_present'));
+});
+
+test('cheat-sheet exposes System + Providers groups', () => {
+  const groups = listCheatSheetGroups();
+  assert.ok(groups.some((g) => g.id === 'system'));
+  assert.ok(groups.some((g) => g.id === 'providers'));
+  const text = renderCheatSheet('2.6.4');
+  assert.match(text, /credentials audit/);
+  assert.match(text, /cheat-sheet/);
+});

package/test/deploy-health-scan.test.mjs

@@ -28,12 +28,18 @@ describe('deploy health', () => {
 
   it('reads hostname from wrangler.jsonc', () => {
     const origin = resolveHealthOrigin({
-      env: {},
       wranglerConfigText: '{"routes":[{"pattern":"agentsam.inneranimalmedia.com","custom_domain":true}]}',
     });
     assert.equal(origin, 'https://agentsam.inneranimalmedia.com');
   });
 
+  it('fails loud when wrangler routes pattern is missing', () => {
+    assert.throws(
+      () => resolveHealthOrigin({ wranglerConfigText: '{}' }),
+      (err) => err?.code === 'health_origin_required',
+    );
+  });
+
   it('treats /health ok:true with connector unconfigured as healthy', async () => {
     const fetchImpl = async (url) => {
       if (String(url).endsWith('/health')) {
@@ -48,6 +54,28 @@ describe('deploy health', () => {
     assert.equal(health.ok, true);
     assert.equal(health.results['/health'].appOk, true);
     assert.equal(health.results['/health'].cloudflareConfigured, false);
+    assert.equal(health.results['/privacy'].ok, true);
+    assert.equal(health.results['/terms'].ok, true);
+  });
+
+  it('fails deploy health when /privacy or /terms are not HTTP 200', async () => {
+    const fetchImpl = async (url) => {
+      const path = String(url).replace(/^https?:\/\/[^/]+/, '');
+      if (path === '/health') {
+        return {
+          status: 200,
+          json: async () => ({ ok: true, connections: { cloudflare: { configured: true } } }),
+        };
+      }
+      if (path === '/privacy' || path === '/terms') {
+        return { status: 404, json: async () => ({}) };
+      }
+      return { status: 200, json: async () => ({}) };
+    };
+    const health = await probeDeployHealth('https://agentsam.inneranimalmedia.com', { fetchImpl });
+    assert.equal(health.ok, false);
+    assert.equal(health.results['/privacy'].ok, false);
+    assert.equal(health.results['/terms'].ok, false);
   });
 
   it('sends a browser-safe User-Agent so WAF does not 403 the probe', async () => {

package/test/gcloud-auth.test.mjs

@@ -0,0 +1,111 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  resolveGoogleOauthStartUrl,
+  runAgentsamGoogleOauthLogin,
+  runGcloudAuth,
+} from '../src/commands/gcloud-auth.js';
+import {
+  GOOGLE_CLOUD_CONNECTION_SCOPES,
+  buildGoogleDesktopAuthUrl,
+  googleCloudPermissionChecklist,
+  resolveGoogleDesktopClientId,
+} from '../src/lib/google-desktop-oauth.js';
+
+const TEST_ENV = {
+  IAM_OAUTH_ISSUER: 'https://inneranimalmedia.com',
+  GOOGLE_CLIENT_ID: '246811022042-d8q1rc1oki4uv9qiqjah8lvkffb91crp.apps.googleusercontent.com',
+  GOOGLE_DESKTOP_CLIENT_ID: '246811022042-cckq00b5seekpkv0in358jhu42n0b6u9.apps.googleusercontent.com',
+};
+
+test('hosted --web login emits start URL in --json', async () => {
+  let out = '';
+  const code = await runAgentsamGoogleOauthLogin({
+    write: (s) => {
+      out += s;
+    },
+    json: true,
+    nonInteractive: true,
+    env: TEST_ENV,
+  });
+  assert.equal(code, 0);
+  const parsed = JSON.parse(out.slice(out.indexOf('{')));
+  assert.equal(parsed.mode, 'hosted_identity');
+  assert.equal(
+    parsed.start_url,
+    resolveGoogleOauthStartUrl(TEST_ENV),
+  );
+});
+
+test('gcloud auth login --web is hosted identity', async () => {
+  let out = '';
+  const code = await runGcloudAuth(['login', '--web', '--json'], {
+    write: (s) => {
+      out += s;
+    },
+    nonInteractive: true,
+    env: TEST_ENV,
+  });
+  assert.equal(code, 0);
+  assert.match(out, /hosted_identity|\/api\/oauth\/google\/start/);
+});
+
+test('gcloud auth help mentions studio broker default and --desktop/--web/--sdk', async () => {
+  let out = '';
+  await runGcloudAuth(['help'], {
+    write: (s) => {
+      out += s;
+    },
+  });
+  assert.match(out, /Studio Web OAuth broker|Worker holds/i);
+  assert.match(out, /--desktop/);
+  assert.match(out, /--web/);
+  assert.match(out, /--sdk/);
+});
+
+test('desktop auth URL requests cloud-platform + offline', () => {
+  const url = new URL(buildGoogleDesktopAuthUrl({
+    clientId: resolveGoogleDesktopClientId(TEST_ENV),
+    redirectUri: 'http://127.0.0.1:12345/callback',
+    state: 'abc',
+    codeChallenge: 'challenge',
+  }));
+  assert.match(url.searchParams.get('scope') || '', /cloud-platform/);
+  assert.equal(url.searchParams.get('access_type'), 'offline');
+  assert.equal(url.searchParams.get('code_challenge_method'), 'S256');
+  assert.match(GOOGLE_CLOUD_CONNECTION_SCOPES, /openid/);
+});
+
+test('permissions checklist separates OAuth scopes from IAM roles', async () => {
+  let out = '';
+  const code = await runGcloudAuth(['login', '--permissions'], {
+    write: (s) => {
+      out += s;
+    },
+  });
+  assert.equal(code, 0);
+  assert.match(out, /cloud-platform/);
+  assert.match(out, /mcp\.toolUser|roles\/mcp/);
+  const checklist = googleCloudPermissionChecklist();
+  assert.ok(checklist.oauth_scopes_requested.includes('https://www.googleapis.com/auth/cloud-platform'));
+});
+
+test('resolveGoogleDesktopClientId fails loud when unset', () => {
+  assert.throws(
+    () => resolveGoogleDesktopClientId({}),
+    (err) => err?.code === 'google_desktop_client_not_configured',
+  );
+});
+
+test('resolveGoogleDesktopClientIdAsync uses public-config when env unset', async () => {
+  const { resolveGoogleDesktopClientIdAsync } = await import('../src/lib/google-desktop-oauth.js');
+  const id = await resolveGoogleDesktopClientIdAsync({}, {
+    publicConfigUrl: 'https://example.test/api/public-config',
+    fetchImpl: async () =>
+      new Response(JSON.stringify({
+        ok: true,
+        google_desktop_client_id: 'from-public-config.apps.googleusercontent.com',
+      }), { status: 200 }),
+  });
+  assert.equal(id, 'from-public-config.apps.googleusercontent.com');
+});

package/test/google-cloud-connection.test.mjs

@@ -0,0 +1,83 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import {
+  diagnoseGoogleCloudAccountMismatch,
+  diagnoseInsufficientAccess,
+  readGoogleCloudConnection,
+  renderInsufficientAccessCard,
+  writeGoogleCloudConnection,
+} from '../src/lib/google-cloud-connection.js';
+import { describeAuthShadow, renderLoginResult } from '../src/commands/whoami.js';
+
+test('connection preference persists identity+project without secrets', () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-conn-'));
+  const saved = writeGoogleCloudConnection(
+    {
+      identity: 'meauxbility@gmail.com',
+      organization: 'inneranimals.com',
+      project: 'gen-lang-client-0684066529',
+      billing_account: '017E01-4426EF-21356F',
+    },
+    { home },
+  );
+  assert.equal(saved.identity, 'meauxbility@gmail.com');
+  assert.equal(saved.project, 'gen-lang-client-0684066529');
+  const again = readGoogleCloudConnection({ home });
+  assert.equal(again.organization, 'inneranimals.com');
+  assert.doesNotMatch(JSON.stringify(again), /private_key|BEGIN /);
+});
+
+test('identity mismatch diagnosis is deterministic', () => {
+  const d = diagnoseGoogleCloudAccountMismatch({
+    preferred: { identity: 'meauxbility@gmail.com', project: 't-pulsar-483701-q1' },
+    activeAccount: 'info@inneranimals.com',
+    activeProject: 't-pulsar-483701-q1',
+    accounts: [
+      { account: 'info@inneranimals.com', status: 'ACTIVE' },
+      { account: 'meauxbility@gmail.com', status: '' },
+    ],
+  });
+  assert.equal(d.ok, false);
+  assert.equal(d.kind, 'identity_mismatch');
+  assert.equal(d.alternate_authenticated, true);
+  assert.match(d.remediation.actions[0].command, /gcloud config set account meauxbility@gmail.com/);
+});
+
+test('insufficient access card matches product UX', () => {
+  const d = diagnoseInsufficientAccess({
+    currentAccount: 'info@inneranimals.com',
+    requiredRole: 'roles/owner',
+    project: 'gen-lang-client-0684066529',
+    accounts: [
+      { account: 'info@inneranimals.com', roles: ['roles/viewer'] },
+      { account: 'meauxbility@gmail.com', roles: ['roles/owner'] },
+    ],
+  });
+  assert.equal(d.kind, 'insufficient_access');
+  const text = renderInsufficientAccessCard(d);
+  assert.match(text, /This Google account does not have enough access/);
+  assert.match(text, /meauxbility@gmail\.com/);
+  assert.match(text, /✓ Owner/);
+  assert.match(text, /\[enter\]/);
+  assert.match(text, /\[a\]/);
+  assert.match(text, /\[c\]/);
+});
+
+test('login result explains API key shadowing OAuth', () => {
+  const status = {
+    active_auth: { kind: 'api_key', source: 'environment' },
+    api_key: { configured: true, source: 'environment' },
+    browser_session: { configured: true, expired: false, refreshable: true },
+  };
+  const text = renderLoginResult(status);
+  assert.match(text, /Browser OAuth login saved/);
+  assert.match(text, /not currently authoritative/);
+  assert.match(text, /AGENTSAM_API_KEY has higher precedence/);
+  assert.match(text, /\[enter\] keep API key/);
+  const shadow = describeAuthShadow(status);
+  assert.ok(shadow);
+  assert.match(shadow.join('\n'), /Authority lanes/);
+});