@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.5

package/test/google-cloud-inventory.test.mjs

@@ -0,0 +1,64 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { normalizeGoogleCloudArgv } from '../src/commands/google-cloud.js';
+import {
+  renderServiceAccountInspect,
+  renderServiceAccountTable,
+} from '../src/lib/google-cloud-inventory.js';
+
+test('normalizeGoogleCloudArgv maps compute instances into google-cloud compute', () => {
+  assert.deepEqual(normalizeGoogleCloudArgv(['instances', 'list']), ['compute', 'instances', 'list']);
+  assert.deepEqual(normalizeGoogleCloudArgv(['iam', 'service-accounts', 'list']), ['iam', 'service-accounts', 'list']);
+  assert.deepEqual(normalizeGoogleCloudArgv(['auth', 'login']), ['auth', 'login']);
+  assert.deepEqual(normalizeGoogleCloudArgv(['gcloud', 'auth', 'login']), ['auth', 'login']);
+});
+
+test('service account table render never invents INNERANIMALMEDIA as Google keyOrigin', () => {
+  const text = renderServiceAccountTable({
+    project_id: 'gen-lang-client-0684066529',
+    accounts: [
+      {
+        name: 'Agent Sam Vertex',
+        short_name: 'agent-sam-vertex',
+        email: 'agent-sam-vertex@gen-lang-client-0684066529.iam.gserviceaccount.com',
+        attached: [],
+        key_counts: { total: 3, user_managed: 1 },
+        status: 'ready',
+        disposition_hint: 'KEEP · ROTATE user-managed keys',
+        keys: [
+          { key_type: 'USER_MANAGED', key_origin: 'GOOGLE_PROVIDED', agentsam_origin_label: 'GOOGLE_PROVIDED' },
+        ],
+      },
+    ],
+  });
+  assert.match(text, /Agent Sam Vertex/);
+  assert.match(text, /GOOGLE_PROVIDED/);
+  assert.match(text, /INNERANIMALMEDIA_PROVIDED is only for AgentSam-issued/);
+});
+
+test('inspect render shows roles and key metadata only', () => {
+  const text = renderServiceAccountInspect({
+    ok: true,
+    project_id: 'gen-lang-client-0684066529',
+    account: {
+      short_name: 'agent-sam-vertex',
+      email: 'agent-sam-vertex@gen-lang-client-0684066529.iam.gserviceaccount.com',
+      bucket: 'agentsam',
+      roles: ['roles/aiplatform.user', 'roles/aiplatform.admin'],
+      keys: [
+        {
+          key_type: 'SYSTEM_MANAGED',
+          agentsam_origin_label: 'GOOGLE_PROVIDED',
+          created_at: '2026-06-02T17:17:25Z',
+          expires_at: '2027-06-02T17:17:25Z',
+          key_id: 'abc',
+        },
+      ],
+      attached: [],
+      disposition_hint: 'KEEP · ROTATE user-managed keys',
+    },
+  });
+  assert.match(text, /roles\/aiplatform\.admin/);
+  assert.match(text, /GOOGLE_PROVIDED/);
+  assert.doesNotMatch(text, /BEGIN PRIVATE KEY/);
+});

package/test/init-options.test.mjs

@@ -0,0 +1,35 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  guidanceForRunTarget,
+  listInitProjectTypeOptions,
+  parseProjectTypeChoice,
+  RUN_TARGET_OPTIONS,
+} from '../src/lib/init-options.js';
+
+test('init project types include presets, CF scaffolds, and ready apps', () => {
+  const options = listInitProjectTypeOptions();
+  const values = options.map((row) => row.value);
+  assert.ok(values.includes('preset:fullstack'));
+  assert.ok(values.includes('preset:cms'));
+  assert.ok(values.includes('scaffold:cms'));
+  assert.ok(values.includes('scaffold:worker-api'));
+  assert.ok(values.includes('product:agentsam-rapid-rust'));
+  assert.ok(values.includes('app:client-cms-editor'));
+  assert.ok(values.some((value) => value.startsWith('app:')));
+  assert.equal(parseProjectTypeChoice('scaffold:cms').kind, 'scaffold');
+  assert.equal(parseProjectTypeChoice('app:local-studio').id, 'local-studio');
+  assert.equal(parseProjectTypeChoice('product:agentsam-rapid-rust').kind, 'product');
+});
+
+test('run targets are operational paths, not aspirational later flags', () => {
+  const values = RUN_TARGET_OPTIONS.map((row) => row.value);
+  assert.deepEqual(values, ['local', 'cloudflare', 'tauri', 'gcp', 'docker']);
+  assert.match(RUN_TARGET_OPTIONS.find((row) => row.value === 'cloudflare').hint, /OAuth/);
+  assert.match(RUN_TARGET_OPTIONS.find((row) => row.value === 'tauri').hint, /SQLite/);
+  assert.match(guidanceForRunTarget('cloudflare').join('\n'), /connections setup/);
+  assert.match(guidanceForRunTarget('tauri', { projectName: 'demo' }).join('\n'), /Local Studio/);
+  assert.match(guidanceForRunTarget('gcp').join('\n'), /google-cloud/);
+  assert.match(guidanceForRunTarget('docker').join('\n'), /dockerize/);
+});

package/test/integration/app-command.test.mjs

@@ -14,6 +14,36 @@ test('lists agentsam.app.json manifests for product apps', () => {
   assert.ok(ids.includes('ecommerce-cms-agentsam'));
 });
 
+test('agentsam app validate passes for all product apps', async () => {
+  const { validateApps } = await import('../../src/commands/app.js');
+  const report = validateApps();
+  assert.equal(report.ok, true, report.errors.join('\n'));
+  assert.ok(report.apps.length >= 4);
+});
+
+test('CMS app scaffold source is included in the SDK distribution contract', async () => {
+  const { validateApps } = await import('../../src/commands/app.js');
+  const report = validateApps({ appId: 'client-cms-editor' });
+  assert.equal(report.ok, true, report.errors.join('\n'));
+  assert.deepEqual(report.warnings, []);
+});
+
+test('CAD and CMS workers load APP identity from agentsam.app.json', () => {
+  const cad = fs.readFileSync(path.resolve('apps/cad-creator/backend/worker/index.js'), 'utf8');
+  const cms = fs.readFileSync(path.resolve('apps/client-cms-editor/backend/worker/index.js'), 'utf8');
+  assert.match(cad, /import appManifest from ['"]\.\.\/\.\.\/agentsam\.app\.json['"]/);
+  assert.match(cms, /import appManifest from ['"]\.\.\/\.\.\/agentsam\.app\.json['"]/);
+  assert.doesNotMatch(cad, /const\s+APP\s*=\s*["']/);
+  assert.doesNotMatch(cms, /const\s+APP\s*=\s*["']/);
+});
+
+test('desktop CMS shell app_id resolves to client-cms-editor', () => {
+  const manifest = JSON.parse(
+    fs.readFileSync(path.resolve('packages/agentsam-desktop-shell/manifests/cms-editor.json'), 'utf8'),
+  );
+  assert.equal(manifest.app_id, 'client-cms-editor');
+});
+
 
 test('Ecommerce CMS app bin exposes truthful runnable doctor state', () => {
   const bin = path.resolve('apps/ecommerce-cms-agentsam/bin/agentsam-ecommerce.mjs');

package/test/integration/cad-project.test.mjs

@@ -51,12 +51,15 @@ test('agent and runtime share executable CAD handlers',async t=>{
 test('CAD registry projects the app into tools workflows and CLI graph relationships',()=>{
  const manifest=JSON.parse(fs.readFileSync(new URL('../../registry/cad-project/manifest.json',import.meta.url),'utf8'));
  const migration=fs.readFileSync(new URL('../../registry/cad-project/migration.sql',import.meta.url),'utf8');
- assert.equal(manifest.product.slug,'agentsam-cad-creator');
+ assert.equal(manifest.product.app_id,'cad-creator');
+ assert.equal(manifest.product.slug,'cad-creator');
  assert.deepEqual(manifest.product.capability_keys,['design.read','design.write','design.export']);
  assert.equal(manifest.product.cli_commands[0].id,'agentsam:cad:project');
  assert.equal(manifest.tools.length,9);
  assert.equal(manifest.workflows.length,2);
+ assert.match(migration,/WHERE slug='cad-creator'/);
  assert.match(migration,/WHERE slug='agentsam-cad-creator'/);
+ assert.match(migration,/legacy_slug','agentsam-cad-creator/);
  assert.equal((migration.match(/'exposes_tool'/g)||[]).length,9);
  assert.equal((migration.match(/'provides_workflow'/g)||[]).length,2);
  assert.equal((migration.match(/'exposes_command'/g)||[]).length,1);

package/test/integration/cms-app-scaffold.test.mjs

@@ -0,0 +1,71 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const cmsBin = path.join(root, 'apps/client-cms-editor/bin/agentsam-cms.mjs');
+
+function scaffold(persistence) {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cms-scaffold-'));
+  const target = path.join(temp, 'editor');
+  execFileSync(process.execPath, [
+    cmsBin,
+    'scaffold',
+    target,
+    '--persistence',
+    persistence,
+  ], { cwd: root, stdio: 'pipe' });
+  return { temp, target };
+}
+
+test('CMS editor scaffold is self-contained and records SQLite authority', () => {
+  const { temp, target } = scaffold('sqlite');
+  try {
+    assert.equal(fs.existsSync(path.join(target, 'bin/agentsam-cms.mjs')), true);
+    assert.equal(fs.existsSync(path.join(target, 'agentsam.app.json')), true);
+    assert.equal(fs.existsSync(path.join(target, 'packages/agentsam-contracts/package.json')), true);
+    assert.equal(fs.existsSync(path.join(target, 'packages/agentsam-workbench/package.json')), true);
+
+    const rootPkg = JSON.parse(fs.readFileSync(path.join(target, 'package.json'), 'utf8'));
+    assert.ok(rootPkg.workspaces.includes('packages/*'));
+
+    const frontendPkg = JSON.parse(fs.readFileSync(path.join(target, 'frontend/package.json'), 'utf8'));
+    assert.equal(frontendPkg.dependencies['@inneranimalmedia/agentsam-contracts'], '0.1.0');
+    assert.equal(frontendPkg.dependencies['@inneranimalmedia/agentsam-workbench'], '0.1.0');
+
+    const sharedPkg = JSON.parse(fs.readFileSync(path.join(target, 'shared/cms/package.json'), 'utf8'));
+    assert.equal(sharedPkg.dependencies['@inneranimalmedia/agentsam-contracts'], '0.1.0');
+
+    const escaped = [
+      ...Object.values(frontendPkg.dependencies || {}),
+      ...Object.values(sharedPkg.dependencies || {}),
+    ].filter((value) => String(value).startsWith('file:'));
+    assert.deepEqual(escaped, []);
+
+    const runtime = JSON.parse(fs.readFileSync(path.join(target, '.agentsam/cms-runtime.json'), 'utf8'));
+    assert.equal(runtime.schema, 'agentsam.cms.runtime.v1');
+    assert.equal(runtime.app_id, 'client-cms-editor');
+    assert.equal(runtime.authority, 'sqlite');
+    assert.equal(runtime.cache, 'localStorage');
+    assert.equal(runtime.cache_only, false);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test('CMS editor localStorage option is explicitly cache-only', () => {
+  const { temp, target } = scaffold('localStorage');
+  try {
+    const runtime = JSON.parse(fs.readFileSync(path.join(target, '.agentsam/cms-runtime.json'), 'utf8'));
+    assert.equal(runtime.authority, null);
+    assert.equal(runtime.cache, 'localStorage');
+    assert.equal(runtime.cache_only, true);
+    assert.match(runtime.note, /cache only/i);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});

package/test/integration/cms-site-tenancy-contract.test.mjs

@@ -124,8 +124,9 @@ test('Local Studio Worker dispatches /api/cms/* with strict tenant isolation', (
   assert.match(workerContent, /handleCmsWorkerRequest/);
 
   const cmsService = read('apps', 'local-studio', 'backend', 'worker', 'cms-service.js');
-  // Default fallback must be agentsam-sdk, never inneranimalmedia
-  assert.match(cmsService, /'agentsam-sdk'/);
+  // Worker requests must name their tenant explicitly; the UI may choose its own default.
+  assert.match(cmsService, /site_slug_required/);
+  assert.doesNotMatch(cmsService, /['"]agentsam-sdk['"]/);
   assert.match(cmsService, /createCmsDbClient\(env\.DB,\s*siteSlug\)/);
 });
 

package/test/integration/codebaseindex-ingest.test.mjs

@@ -15,6 +15,7 @@ import { ensureSeedOperations, getSamOperation, AgentSamClient } from '../../src
 import { getSkill, loadSkill } from '../../src/skills/index.js';
 import { resolveHelpTopic, renderHelpOverview } from '../../src/ui/cli/help.js';
 import { runCodebaseindexIngest } from '../../src/commands/codebaseindex.js';
+import { buildInventory } from '../../src/indexing/ingest/inventory.js';
 
 describe('CLI command catalog assist', () => {
   it('maps ingest alias to codebaseindex with skill tip', () => {
@@ -164,3 +165,50 @@ describe('catalog-driven help', () => {
     assert.match(text, /command catalog/i);
   });
 });
+
+describe('Cargo workspace inventory', () => {
+  it('treats workspace members as source and keeps generated/operational state out of the starting scope', () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cargo-workspace-'));
+    try {
+      fs.writeFileSync(path.join(root, 'Cargo.toml'), `[workspace]
+members = [
+  "core",
+  "worker",
+]
+resolver = "2"
+`);
+      for (const crate of ['core', 'worker']) {
+        fs.mkdirSync(path.join(root, crate, 'src'), { recursive: true });
+        fs.writeFileSync(path.join(root, crate, 'Cargo.toml'), `[package]
+name = "${crate}"
+version = "0.1.0"
+edition = "2024"
+`);
+        fs.writeFileSync(path.join(root, crate, 'src', 'lib.rs'), `pub fn ${crate}_value() -> u32 { 1 }
+`);
+      }
+      fs.mkdirSync(path.join(root, 'docs'), { recursive: true });
+      fs.writeFileSync(path.join(root, 'docs', 'README.md'), '# docs\n');
+      fs.mkdirSync(path.join(root, 'target'), { recursive: true });
+      fs.writeFileSync(path.join(root, 'target', 'build.txt'), 'generated\n');
+      fs.mkdirSync(path.join(root, '.agentsam', 'machine'), { recursive: true });
+      fs.writeFileSync(path.join(root, '.agentsam', 'machine', 'state.sqlite'), '');
+
+      const inventory = buildInventory({ root });
+      assert.deepEqual(inventory.cargo_workspace_roots, ['core', 'worker']);
+      assert.ok(inventory.categories.source.includes('core'));
+      assert.ok(inventory.categories.source.includes('worker'));
+      assert.ok(inventory.categories.docs.includes('docs'));
+      assert.ok(inventory.categories.dependencies.includes('target'));
+      assert.ok(inventory.categories.operational.includes('.agentsam'));
+
+      assert.ok(inventory.suggested.include.includes('core'));
+      assert.ok(inventory.suggested.include.includes('worker'));
+      assert.ok(inventory.suggested.include.includes('docs'));
+      assert.ok(inventory.suggested.exclude.includes('target'));
+      assert.ok(inventory.suggested.exclude.includes('.agentsam'));
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+});

package/test/integration/features-resolve.test.mjs

@@ -44,9 +44,11 @@ test('auth feature resolves real D1 resources, not a pretend iam-d1 profile', ()
   assert.deepEqual(resolved.resources.migration_sources, [
     'src/migrations/0001_identity_core.sql',
     'src/migrations/0002_company.sql',
+    'src/migrations/0003_accounts_ssot.sql',
   ]);
   const names = resolved.resources.tables.map((t) => t.name);
   assert.deepEqual(names, [
+    'accounts',
     'auth_users',
     'auth_sessions',
     'account_identities',
@@ -54,7 +56,7 @@ test('auth feature resolves real D1 resources, not a pretend iam-d1 profile', ()
     'password_reset_tokens',
     'company',
   ]);
-  assert.match(formatResourcesSummary(resolved.resources), /tables=auth_users,/);
+  assert.match(formatResourcesSummary(resolved.resources), /tables=accounts,auth_users,/);
   assert.doesNotMatch(formatResourcesSummary(resolved.resources), /iam-d1/);
 });
 
@@ -82,6 +84,7 @@ test('resources.json indexes D1 tables without owning DDL', () => {
   assert.deepEqual(resources.migration_sources, [
     'src/migrations/0001_identity_core.sql',
     'src/migrations/0002_company.sql',
+    'src/migrations/0003_accounts_ssot.sql',
   ]);
   const names = resources.tables.map((t) => t.name);
   assert.ok(names.includes('auth_users'));
@@ -115,14 +118,30 @@ test('writeFeatureSelections emits schema_version 2 and resolved snapshot', () =
   }
 });
 
-test('sdk project selections resolve against package packet', () => {
-  const { snapshot } = writeFeaturesResolved(SDK_ROOT);
-  assert.equal(snapshot.schema, 'agentsam.features.resolved.v1');
-  assert.equal(snapshot.features.auth.provider_template, 'inneranimalmedia');
-  assert.equal(snapshot.features.auth.feature.id, 'identity.oauth-login-portal');
-  assert.equal(snapshot.features.auth.resources.engine, 'd1');
-  assert.match(
-    formatResourcesSummary(snapshot.features.auth.resources),
-    /auth_users,auth_sessions,account_identities/,
-  );
+test('sdk-style project selections resolve against package packet without local machine state', () => {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-sdk-feature-select-'));
+  try {
+    const { snapshot } = writeFeaturesResolved(cwd, null, {
+      selections: {
+        schema_version: 2,
+        features: {
+          auth: {
+            selected: true,
+            capabilities: ['identity.init'],
+            provider_template: 'inneranimalmedia',
+          },
+        },
+      },
+    });
+    assert.equal(snapshot.schema, 'agentsam.features.resolved.v1');
+    assert.equal(snapshot.features.auth.provider_template, 'inneranimalmedia');
+    assert.equal(snapshot.features.auth.feature.id, 'identity.oauth-login-portal');
+    assert.equal(snapshot.features.auth.resources.engine, 'd1');
+    assert.match(
+      formatResourcesSummary(snapshot.features.auth.resources),
+      /auth_users,auth_sessions,account_identities/,
+    );
+  } finally {
+    fs.rmSync(cwd, { recursive: true, force: true });
+  }
 });

package/test/integration/inspect-path-cli.test.mjs

@@ -0,0 +1,46 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const CLI = path.join(ROOT, 'bin/agentsam');
+
+function run(args, cwd = ROOT) {
+  return spawnSync(process.execPath, [CLI, ...args], {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, NO_COLOR: '1' },
+  });
+}
+
+function jsonFrom(text) {
+  const start = text.indexOf('{');
+  assert.notEqual(start, -1, `expected JSON output, received: ${text}`);
+  return JSON.parse(text.slice(start));
+}
+
+test('agentsam inspect --help documents the positional path world-state contract', () => {
+  const result = run(['inspect', '--help']);
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /agentsam inspect \[path\]/);
+  assert.match(result.stdout, /deterministic repository world state/i);
+  assert.match(result.stdout, /No model, embeddings, network, provider spend/i);
+});
+
+test('agentsam inspect accepts a repository path as the first positional argument', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-inspect-path-'));
+  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'inspect-fixture', version: '1.0.0' }));
+  fs.mkdirSync(path.join(root, 'src'));
+  fs.writeFileSync(path.join(root, 'src/index.js'), 'export function fixture() { return 42; }\n');
+
+  const result = run(['inspect', root, '--json', '--index']);
+  assert.equal(result.status, 0, result.stderr || result.stdout);
+  const output = jsonFrom(result.stdout);
+  assert.ok(output.snapshot_id);
+  assert.ok(output.merkle_root || output.tree?.merkle_root);
+  assert.match(JSON.stringify(output), /inspect-fixture|src\/index\.js/);
+});

package/test/integration/inventory-evidence.test.mjs

@@ -0,0 +1,125 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { buildInventory } from '../../src/indexing/ingest/inventory.js';
+import {
+  extractStyleEvidence,
+  finalizeStyleEvidence,
+  mergeStyleEvidence,
+} from '../../src/indexing/ingest/style-evidence.js';
+import { inventory as knowledgeInventory } from '../../src/knowledge/source.js';
+
+function write(root, rel, text = '') {
+  const abs = path.join(root, rel);
+  fs.mkdirSync(path.dirname(abs), { recursive: true });
+  fs.writeFileSync(abs, text);
+}
+
+describe('inventory classifies by evidence', () => {
+  it('uses dominant evidence, root files, tooling LOC, and git ignore state', () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'inv-evidence-'));
+    try {
+      execFileSync('git', ['init', '-q'], { cwd: root });
+      write(root, '.gitignore', '.sites-runtime/\n');
+
+      write(root, 'app/page.tsx', Array.from({ length: 30 }, (_, i) => `export const x${i} = ${i};`).join('\n'));
+      write(root, 'db/schema.sql', 'create table t (id integer);\n');
+      write(root, 'drizzle/meta/_journal.json', '{"version":"1"}\n');
+      for (let i = 1; i <= 9; i += 1) write(root, `plans/p${i}.md`, `# plan ${i}\ntext\n`);
+      write(root, 'plans/schema.sql', 'create table plan (id integer);\n');
+      write(root, 'public/logo.png', 'x');
+      write(root, 'scripts/harvest.py', Array.from({ length: 80 }, (_, i) => `x_${i} = ${i}`).join('\n'));
+      write(root, '.sites-runtime/cache/blob.bin', 'x'.repeat(2048));
+
+      write(root, 'package.json', '{"name":"fixture"}\n');
+      write(root, 'wrangler.jsonc', '{}\n');
+      write(root, 'drizzle.config.ts', 'export default {};\n');
+      write(root, 'README.md', '# Fixture\n');
+      write(root, 'entry.ts', 'export const root = true;\n');
+      write(root, 'package-lock.json', '{"lockfileVersion":3}\n');
+      write(root, '.env', 'SECRET=do-not-index\n');
+      write(root, '.dev.vars', 'TOKEN=do-not-index\n');
+      write(root, 'tls.pem', 'private material\n');
+
+      execFileSync('git', ['add', '.'], { cwd: root });
+
+      const inventory = buildInventory({ root });
+      const categories = inventory.categories;
+
+      assert.ok(categories.source.includes('app'));
+      assert.ok(categories.source.includes('db'));
+      assert.ok(categories.docs.includes('plans'), '9 markdown + 1 SQL is dominantly docs');
+      assert.ok(categories.data.includes('drizzle'), 'JSON-only drizzle metadata is data');
+      assert.ok(categories.assets.includes('public'));
+      assert.ok(categories.operational.includes('.sites-runtime'));
+      assert.ok(categories.tooling.includes('scripts'));
+      assert.deepEqual(categories.unknown, []);
+
+      assert.ok(inventory.suggested.include.includes('scripts'), 'tracked top-2 language tooling is promoted');
+      assert.ok(inventory.top_level_details.scripts.loc >= 80);
+      assert.equal(inventory.top_level_details.scripts.dominant_language, 'Python');
+
+      assert.ok(inventory.root_files.manifest.includes('package.json'));
+      assert.ok(inventory.root_files.manifest.includes('wrangler.jsonc'));
+      assert.ok(inventory.root_files.manifest.includes('drizzle.config.ts'));
+      assert.ok(inventory.root_files.docs.includes('README.md'));
+      assert.ok(inventory.root_files.source.includes('entry.ts'));
+      assert.ok(inventory.root_files.lockfile.includes('package-lock.json'));
+      assert.ok(inventory.root_files.secret.includes('.env'));
+      assert.ok(inventory.root_files.secret.includes('.dev.vars'));
+      assert.ok(inventory.root_files.secret.includes('tls.pem'));
+
+      for (const wanted of ['package.json', 'wrangler.jsonc', 'drizzle.config.ts', 'README.md', 'entry.ts']) {
+        assert.ok(inventory.suggested.include_files.includes(wanted), wanted);
+      }
+      for (const forbidden of ['package-lock.json', '.env', '.dev.vars', 'tls.pem']) {
+        assert.ok(!inventory.suggested.include_files.includes(forbidden), forbidden);
+      }
+
+      const files = knowledgeInventory(root, { include: ['.'], exclude: [] });
+      assert.ok(files.includes('entry.ts'));
+      assert.ok(!files.includes('.env'));
+      assert.ok(!files.includes('.dev.vars'));
+      assert.ok(!files.includes('tls.pem'));
+      assert.ok(!files.includes('package-lock.json'));
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  it('detects coherent theme signatures from markup and CSS evidence', () => {
+    const evidence = extractStyleEvidence(`
+      <html data-theme-preset="fuel-free-time" data-header-preset="adaptive-bar">
+        <link rel="stylesheet" href="/css/heuristic-theme.css">
+        <body>
+          <header class="fnf-header fnf-header--adaptive-bar">
+            <a class="fnf-logo"></a>
+            <nav class="fnf-primary"></nav>
+          </header>
+        </body>
+      </html>
+      <style>
+        :root { --fnf-accent: #ff4d00; --fnf-logo-height: 58px; }
+        .fnf-header { color: var(--fnf-accent); }
+        .fnf-logo { height: var(--fnf-logo-height); }
+      </style>
+    `);
+
+    assert.equal(evidence.theme_presets['fuel-free-time'], 1);
+    assert.equal(evidence.header_presets['adaptive-bar'], 1);
+    assert.equal(evidence.stylesheets['/css/heuristic-theme.css'], 1);
+    const fnf = evidence.namespaces.find((row) => row.prefix === 'fnf');
+    assert.ok(fnf);
+    assert.ok(fnf.signal_kinds >= 2);
+    assert.ok(fnf.signals.class_tokens >= 3);
+    assert.ok(fnf.signals.custom_properties >= 2);
+
+    const final = finalizeStyleEvidence(mergeStyleEvidence(null, evidence));
+    const finalFnf = final.namespaces.find((row) => row.prefix === 'fnf');
+    assert.equal(final.theme_candidate, true);
+    assert.equal(finalFnf?.candidate, true);
+  });
+});

package/test/integration/runtime-status.integration.test.mjs

@@ -19,7 +19,8 @@ test('checked-in Cloudflare deployment contract resolves the real Worker and por
   assert.equal(contract.worker_name, 'agentsam-sdk');
   assert.equal(contract.config, 'apps/local-studio/backend/wrangler.jsonc');
   assert.deepEqual(contract.bindings.map((row) => row.name), [
-    'AGENTSAM_WAI', 'ASSETS', 'DB', 'EXECOS', 'HYPERDRIVE', 'IAM_CLIENT_ID',
+    'AGENTSAM_WAI', 'ASSETS', 'CLOUDFLARE_ACCOUNT_ID', 'DB', 'EXECOS',
+    'GOOGLE_CLIENT_ID', 'GOOGLE_DESKTOP_CLIENT_ID', 'HYPERDRIVE', 'IAM_CLIENT_ID',
     'IAM_OAUTH_ISSUER', 'PTY_SERVICE', 'WEBSITE_ASSETS',
   ]);
 });

package/test/knowledge.test.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { defaultConfig, initRepository, readConfig, scopeKey, embeddingProfileId, openSqliteStore, runIndex, planIndex, retrieve, createGeminiEmbedder, KnowledgeClient } from '../src/knowledge/index.js';
-import { parseSource } from '../src/knowledge/source.js';
+import { inventory, parseSource } from '../src/knowledge/source.js';
 
 const cli = fileURLToPath(new URL('../src/cli.js', import.meta.url));
 const write = (root, name, content) => { fs.mkdirSync(path.dirname(path.join(root, name)), { recursive: true }); fs.writeFileSync(path.join(root, name), content); };
@@ -34,6 +34,40 @@ test('AST parser observes real syntax, spans and unresolved edges; text is label
   assert.throws(() => parseSource('bad.ts', 'export function {'), /bad.ts/);
 });
 
+test('Rust sources survive knowledge inventory and persist in the active SQLite generation', async t => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-knowledge-rust-'));
+  execFileSync('git', ['init', '-q'], { cwd: root });
+  write(root, 'core/src/lib.rs', 'pub fn core_value() -> u32 { 7 }\n');
+  write(root, 'worker/src/lib.rs', 'pub fn worker_value() -> u32 { 8 }\n');
+  write(root, 'docs/MACHINE-PIPELINE.md', '# Machine pipeline\n');
+  write(root, 'target/generated.rs', 'pub fn generated() {}\n');
+
+  const config = defaultConfig({ include: ['core', 'worker', 'docs'], exclude: ['target'] });
+  const store = await openSqliteStore(path.join(root, '.agentsam/knowledge/index.sqlite'));
+  t.after(async () => {
+    await store.close();
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  const files = inventory(root, config.scope);
+  assert.ok(files.includes('core/src/lib.rs'));
+  assert.ok(files.includes('worker/src/lib.rs'));
+  assert.ok(files.includes('docs/MACHINE-PIPELINE.md'));
+  assert.equal(files.includes('target/generated.rs'), false);
+
+  const result = await runIndex({ root, config, store, embed: false });
+  assert.equal(result.published, true);
+  assert.ok(result.changes.added.includes('core/src/lib.rs'));
+  assert.ok(result.changes.added.includes('worker/src/lib.rs'));
+
+  const generation = await store.getGeneration(scopeKey(config), result.generation_id);
+  const persisted = generation.files.map(file => file.path);
+  assert.ok(persisted.includes('core/src/lib.rs'));
+  assert.ok(persisted.includes('worker/src/lib.rs'));
+  assert.ok(persisted.includes('docs/MACHINE-PIPELINE.md'));
+  assert.equal(generation.files.find(file => file.path === 'core/src/lib.rs')?.parser, 'text:1');
+});
+
 test('incremental indexing reuses unchanged functions, moves and deletions; old knowledge remains retrievable', async t => {
   const f = await fixture(t), args = { ...f, embed: true };
   const plan = await planIndex(args);

package/test/loopback-oauth.test.mjs

@@ -0,0 +1,53 @@
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { describe, it } from 'node:test';
+import { createLoopbackCallbackListener } from '../src/lib/auth.js';
+
+describe('loopback OAuth callback', () => {
+  it('settles waitForCallback when browser hits success page', async () => {
+    const state = 'test_state_abc';
+    const listener = await createLoopbackCallbackListener({
+      state,
+      host: '127.0.0.1',
+      timeoutMs: 5_000,
+    });
+    try {
+      const wait = listener.waitForCallback();
+      const port = new URL(listener.redirectUri).port;
+      const res = await fetch(
+        `http://127.0.0.1:${port}/callback?state=${state}&code=auth_code_xyz`,
+      );
+      assert.equal(res.status, 200);
+      const html = await res.text();
+      assert.match(html, /Authentication complete/);
+      const callback = await wait;
+      assert.equal(callback.code, 'auth_code_xyz');
+      assert.equal(callback.state, state);
+    } finally {
+      await listener.close();
+    }
+  });
+
+  it('does not settle on code-less probe so a later redirect can succeed', async () => {
+    const state = 'test_state_probe';
+    const listener = await createLoopbackCallbackListener({
+      state,
+      host: '127.0.0.1',
+      timeoutMs: 5_000,
+    });
+    try {
+      const wait = listener.waitForCallback();
+      const port = new URL(listener.redirectUri).port;
+      const probe = await fetch(`http://127.0.0.1:${port}/callback?state=${state}`);
+      assert.equal(probe.status, 400);
+      const res = await fetch(
+        `http://127.0.0.1:${port}/callback?state=${state}&code=real_code`,
+      );
+      assert.equal(res.status, 200);
+      const callback = await wait;
+      assert.equal(callback.code, 'real_code');
+    } finally {
+      await listener.close();
+    }
+  });
+});