@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/src/models/inventory-core.d.ts

@@ -0,0 +1,105 @@
+export type CredentialPlane = "machine" | "studio_vault" | "mixed" | "platform" | string;
+
+export interface ProviderCredentialResolution {
+  configured: boolean;
+  value?: string;
+  source?: string | null;
+  error?: string | null;
+  account_id?: string | null;
+}
+
+export interface DiscoveredModelRecord {
+  provider: string;
+  provider_model_id: string;
+  model_id?: string;
+  model_key: string;
+  label: string;
+  availability: string;
+  availability_source?: string | null;
+  context_window?: number | null;
+  max_output_tokens?: number | null;
+  reasoning_efforts?: string[];
+  service_tiers?: string[];
+  capabilities?: Record<string, unknown>;
+  metadata?: Record<string, unknown>;
+  source?: Record<string, unknown>;
+}
+
+export interface CredentialScopedInventory {
+  schemaVersion: string;
+  generatedAt: string;
+  authority: string;
+  credential_plane: CredentialPlane;
+  providers: Array<{
+    id: string;
+    label: string;
+    configured: boolean;
+    source: string | null;
+    credentialError: string | null;
+  }>;
+  discovery: Record<string, {
+    attempted: boolean;
+    ok: boolean;
+    error: string | null;
+    returnedModelCount: number;
+    curation?: string;
+  }>;
+  providerModels: Record<string, DiscoveredModelRecord[]>;
+  availableModels: DiscoveredModelRecord[];
+}
+
+export const INVENTORY_API_PROVIDERS: readonly Readonly<{
+  id: string;
+  label: string;
+  service: string;
+  env: string;
+  aliases?: readonly string[];
+}>[];
+
+export const WORKERS_AI_CURATED_MODEL_IDS: readonly string[];
+
+export function providerIdForService(serviceName: unknown): string | null;
+export function filterWorkersAiCurated(models?: DiscoveredModelRecord[], options?: { curated?: boolean }): DiscoveredModelRecord[];
+export function makeMapCredentialResolver(
+  credentialByProvider: Map<string, { value: string; source?: string; account_id?: string }>,
+): (providerId: string) => Promise<ProviderCredentialResolution>;
+export function collectCredentialScopedInventory(options: {
+  fetchImpl?: typeof fetch;
+  credentialPlane?: CredentialPlane;
+  curateWorkersAi?: boolean;
+  discoverRemote?: boolean;
+  resolveCredential: (providerId: string) => ProviderCredentialResolution | Promise<ProviderCredentialResolution>;
+}): Promise<CredentialScopedInventory>;
+export function sanitizeInventoryForClient(status?: Partial<CredentialScopedInventory>): {
+  schemaVersion?: string;
+  generatedAt?: string;
+  authority?: string;
+  credential_plane?: CredentialPlane;
+  providers: CredentialScopedInventory["providers"];
+  discovery: CredentialScopedInventory["discovery"];
+  availableModels: Array<{
+    provider: string;
+    model_id: string;
+    model_key: string | null;
+    label: string;
+    availability: string;
+    availability_source: string | null;
+    context_window: number | null;
+    reasoning_efforts: string[];
+    service_tiers: string[];
+    capabilities: Record<string, unknown>;
+    chat_eligible: boolean;
+    eligibility_reason: string | null;
+    eligibility_source: string;
+  }>;
+};
+export function modelChatEligibility(row?: DiscoveredModelRecord): {
+  chat_eligible: boolean;
+  eligibility_reason: string | null;
+  eligibility_source: string;
+};
+export function assertModelAvailableForProvider(
+  inventory: { availableModels?: Array<Record<string, unknown>> },
+  provider: string,
+  modelId: string,
+): Record<string, unknown>;

package/src/models/inventory-core.js

@@ -7,7 +7,7 @@ export const INVENTORY_API_PROVIDERS = Object.freeze([
   { id: 'openai', label: 'OpenAI', service: 'openai', env: 'OPENAI_API_KEY' },
   { id: 'anthropic', label: 'Anthropic', service: 'anthropic', env: 'ANTHROPIC_API_KEY' },
   { id: 'gemini', label: 'Gemini', service: 'gemini', env: 'GEMINI_API_KEY' },
-  { id: 'grok', label: 'Grok / xAI', service: 'xai', env: 'XAI_API_KEY', aliases: ['xai', 'grok'] },
+  { id: 'xai', label: 'Grok / xAI', service: 'xai', env: 'XAI_API_KEY', aliases: ['grok'] },
   { id: 'cursor', label: 'Cursor', service: 'cursor', env: 'CURSOR_API_KEY' },
   { id: 'cloudflare', label: 'Cloudflare', service: 'cloudflare', env: 'CLOUDFLARE_API_TOKEN' },
 ]);
@@ -29,8 +29,8 @@ const SERVICE_TO_PROVIDER = Object.freeze({
   openai: 'openai',
   anthropic: 'anthropic',
   gemini: 'gemini',
-  xai: 'grok',
-  grok: 'grok',
+  xai: 'xai',
+  grok: 'xai',
   cursor: 'cursor',
   cloudflare: 'cloudflare',
 });
@@ -70,6 +70,41 @@ export function makeMapCredentialResolver(credentialByProvider) {
   };
 }
 
+const CHAT_ADAPTER_PROVIDERS = new Set(['openai', 'anthropic', 'gemini', 'xai', 'cloudflare']);
+
+export function modelChatEligibility(row = {}) {
+  const rawProvider = String(row.provider || '').trim().toLowerCase();
+  const provider = rawProvider === 'grok' ? 'xai' : rawProvider;
+  const caps = row.capabilities && typeof row.capabilities === 'object' ? row.capabilities : {};
+  const metadata = row.metadata && typeof row.metadata === 'object' ? row.metadata : {};
+  const source = String(metadata.capability_source || (row.source?.fallback?.url ? 'provider_reference' : 'provider_api'));
+
+  if (!CHAT_ADAPTER_PROVIDERS.has(provider)) {
+    return { chat_eligible: false, eligibility_reason: 'provider_adapter_unavailable', eligibility_source: source };
+  }
+  if (caps.embeddings === true) {
+    return { chat_eligible: false, eligibility_reason: 'embedding_model', eligibility_source: source };
+  }
+  if (caps.agent_runtime === false) {
+    return { chat_eligible: false, eligibility_reason: 'capability_excludes_chat', eligibility_source: source };
+  }
+
+  const positive =
+    (provider === 'openai' && caps.responses === true && caps.agent_runtime === true)
+    || (provider === 'anthropic' && caps.messages === true)
+    || (provider === 'gemini' && caps.generate_content === true && caps.text_output === true)
+    || (provider === 'xai' && caps.responses === true && caps.text_output === true)
+    || (provider === 'cloudflare' && caps.workers_ai === true && caps.agent_runtime === true && caps.embeddings !== true);
+
+  if (positive) {
+    return { chat_eligible: true, eligibility_reason: null, eligibility_source: source };
+  }
+  if (metadata.specialized_output === true || caps.text_output === false) {
+    return { chat_eligible: false, eligibility_reason: 'specialized_output_model', eligibility_source: source };
+  }
+  return { chat_eligible: false, eligibility_reason: 'capability_unknown', eligibility_source: source };
+}
+
 /**
  * Merge vault credentials (preferred) with optional platform env credentials.
  * Never returns secret material in the inventory result.
@@ -131,6 +166,15 @@ export async function collectCredentialScopedInventory(options = {}) {
   };
 }
 
+function sanitizeDiscoveryError(error) {
+  const raw = String(error || '').trim();
+  if (!raw) return null;
+  if (/\b(?:401|403)\b|unauthoriz|forbidden|invalid[_ -]?(?:api[_ -]?)?key|credential.*reject/i.test(raw)) {
+    return 'provider_credential_rejected';
+  }
+  return 'provider_discovery_failed';
+}
+
 export function sanitizeInventoryForClient(status = {}) {
   const out = {
     schemaVersion: status.schemaVersion,
@@ -142,11 +186,14 @@ export function sanitizeInventoryForClient(status = {}) {
       label: row.label,
       configured: row.configured === true,
       source: row.source || null,
-      credentialError: row.credentialError || null,
+      credentialError: sanitizeDiscoveryError(row.credentialError),
     })),
-    discovery: status.discovery || {},
+    discovery: Object.fromEntries(Object.entries(status.discovery || {}).map(([provider, row]) => [provider, {
+      ...row,
+      error: sanitizeDiscoveryError(row?.error),
+    }])) ,
     availableModels: (status.availableModels || []).map((row) => ({
-      provider: row.provider,
+      provider: row.provider === 'grok' ? 'xai' : row.provider,
       model_id: row.provider_model_id || row.model_id,
       model_key: row.model_key || null,
       label: row.label || row.provider_model_id || row.model_id,
@@ -156,6 +203,7 @@ export function sanitizeInventoryForClient(status = {}) {
       reasoning_efforts: row.reasoning_efforts || [],
       service_tiers: row.service_tiers || [],
       capabilities: row.capabilities || {},
+      ...modelChatEligibility(row),
     })),
   };
   if (status.local) {

package/src/plugins/cloudflare.js

@@ -19,7 +19,7 @@ export const AGENTSAM_MCP_PLUGIN_MANIFEST = normalizePluginManifest({
     { capability_key: 'cloudflare.api.execute', domain: 'cloudflare', verb: 'execute', description: 'Execute a bounded Cloudflare API Code Mode program.', is_mutating: true },
   ],
   tool_lanes: ['typed', 'mcp', 'api', 'codemode'],
-  resource_scope: { owner: 'account', oauth_connection_table: 'agentsam_cloudflare_connections' },
+  resource_scope: { owner: 'account', oauth_connection_table: 'user_oauth_tokens' },
   config: {
     oauth_authority: 'cloudflare',
     oauth_client_id: 'c0704bd7a7aab7216b362603e1985499',

package/src/providers/ollama-chat.js

@@ -1,5 +1,6 @@
 import { createAgentEvent, createUsageSnapshot } from '../telemetry/index.js';
 import { diagnosticFromError } from '../errors/index.js';
+import { resolveOllamaEndpoint } from '../../packages/agentsam-knowledge/src/providers/ollama-endpoint.js';
 
 function clean(value) { return value == null ? '' : String(value).trim(); }
 function integer(value) { const n = Number(value ?? 0); return Number.isFinite(n) && n >= 0 ? Math.floor(n) : 0; }
@@ -28,7 +29,7 @@ function callsFromMessage(message = {}) {
 
 export function createOllamaChatAdapter(options = {}) {
   const fetchImpl = options.fetchImpl || fetch;
-  const endpoint = clean(options.endpoint || process.env.OLLAMA_BASE_URL || 'http://127.0.0.1:11434').replace(/\/$/, '');
+  const endpoint = resolveOllamaEndpoint({ endpoint: options.endpoint, env: options.env || process.env });
 
   async function send(messages, params = {}) {
     const record = params.modelRecord || options.modelRecord;

package/src/sam/types.js

@@ -6,13 +6,34 @@
 export const SAM_RESULT_SCHEMA = 'agentsam.result.v1';
 export const SAM_EXPANSION = 'Systematic Autonomous Machinery';
 
-/** @typedef {'local'|'remote'|'sandbox'|'platform'} SamLane */
+/** @typedef {'local'|'remote'|'sandbox'|'platform'|'mcp'} SamLane */
 /** @typedef {'never'|'optional'|'required'} SamModelPolicy */
 /** @typedef {'none'|'optional'|'required'} SamNetworkPolicy */
-/** @typedef {'none'|'local_write'|'remote_read'|'remote_write'|'deploy'|'billable'} SamSideEffects */
+/** @typedef {'none'|'local_write'|'remote_read'|'remote_write'|'deploy'|'billable'|'oauth'} SamSideEffects */
 /** @typedef {'read_only'|'write'|'privileged'} SamRisk */
 /** @typedef {'never'|'optional'|'required'} SamSpendPolicy */
 
+/**
+ * Provider capability / OAuth pack reference (Cloudflare, GitHub, …).
+ * Prefer pack- or capability-scoped consent — never wholesale scope catalogs.
+ * @typedef {object} SamCapabilityRef
+ * @property {string} id
+ * @property {string} [provider]
+ * @property {string[]} [oauth_scopes]
+ * @property {string[]} [feature_packs]
+ */
+
+/**
+ * MCP projection for an operation (server tool surface).
+ * @typedef {object} SamMcpProjection
+ * @property {string} [server_name]
+ * @property {string} [server_url]
+ * @property {string} [tool_name]
+ * @property {string[]} [required_scopes]
+ * @property {string[]} [feature_packs]
+ * @property {'streamable_http'|'sse'|'stdio'} [protocol]
+ */
+
 /**
  * @typedef {object} SamExecutionMeta
  * @property {SamLane[]} lanes
@@ -36,6 +57,8 @@ export const SAM_EXPANSION = 'Systematic Autonomous Machinery';
  * @property {string} [description]
  * @property {SamExecutionMeta} execution
  * @property {{ account?: boolean, provider?: string[] }} [auth]
+ * @property {SamCapabilityRef[]} [capability_refs]
+ * @property {SamMcpProjection} [mcp]
  * @property {SamRisk} risk
  * @property {string} [input_schema]
  * @property {string} [output_schema]
@@ -57,6 +80,7 @@ export const SAM_EXPANSION = 'Systematic Autonomous Machinery';
  * @property {Record<string, unknown>} [execution]
  * @property {string} [cwd]
  * @property {Record<string, string|undefined>} [env]
+ * @property {{ mcp?: SamMcpProjection, capability_refs?: SamCapabilityRef[] }} [projection]
  */
 
 /**
@@ -71,6 +95,7 @@ export const SAM_EXPANSION = 'Systematic Autonomous Machinery';
  * @property {string|null} [input_hash]
  * @property {string|null} [output_hash]
  * @property {'completed'|'failed'|'cancelled'} status
+ * @property {SamMcpProjection} [mcp]
  */
 
 /**

package/src/security/inventory.js

@@ -11,7 +11,7 @@ export function readJson(file) {
   if (!stat.isFile() || stat.size > 32 * 1024 * 1024) throw new Error('Manifest must be a regular JSON file under 32 MiB');
   return JSON.parse(fs.readFileSync(file, 'utf8'));
 }
-export function collectNpmDependencies(projectRoot = process.cwd()) {
+export function collectNpmDependencies(projectRoot = process.cwd(), options = {}) {
   const root = fs.realpathSync(projectRoot);
   const manifest = readJson(path.join(root, 'package.json'));
   const issues = [], dependencies = new Map(), skipped = [];
@@ -20,9 +20,19 @@ export function collectNpmDependencies(projectRoot = process.cwd()) {
   const unsupported = ['pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb'].filter(file => fs.existsSync(path.join(root, file)));
   if (manifest.packageManager && !manifest.packageManager.startsWith('npm@')) issues.push('Selected package manager is not npm; this adapter cannot prove its dependency graph.');
   else if (unsupported.length && !manifest.packageManager) issues.push('Multiple/unsupported package-manager lockfiles; select npm explicitly with packageManager or scan in the owning manager.');
+  const releaseCandidate = options.releaseCandidate || null;
   const add = (name, pkg, location, direct) => {
     if (pkg.link) { skipped.push({ path: location, reason: 'workspace/link (dependencies scanned from lock graph)' }); return; }
-    if (!packageName(name) || !exactVersion(pkg.version) || /^(?:file:|link:|git[+:]|https?:\/\/.*\.git)/i.test(pkg.resolved || '')) {
+    const resolved = String(pkg.resolved || '');
+    const isLocalTarball = /^file:/i.test(resolved);
+    const allowedReleaseCandidate = Boolean(
+      isLocalTarball
+      && releaseCandidate
+      && releaseCandidate.name === name
+      && releaseCandidate.version === pkg.version
+      && releaseCandidate.location === location
+    );
+    if (!packageName(name) || !exactVersion(pkg.version) || (/^(?:file:|link:|git[+:]|https?:\/\/.*\.git)/i.test(resolved) && !allowedReleaseCandidate)) {
       issues.push('Unresolved or non-registry dependency at ' + location);
       return;
     }

package/src/security/local-vault.js

@@ -120,7 +120,9 @@ function osStoreWriteDarwin(provider, secret) {
   try {
     const res = spawnSync('/usr/bin/security', ['add-generic-password', '-a', `agentsam:${provider}`, '-s', 'agentsam', '-w', secret, '-U'], {
       stdio: 'ignore',
+      timeout: 12_000,
     });
+    if (res.error?.code === 'ETIMEDOUT' || res.signal === 'SIGTERM') return false;
     return res.status === 0;
   } catch { return false; }
 }

package/src/security/logs.js

@@ -17,6 +17,9 @@ export function triageLog(text) {
     else if (/\b([1-9]\d*)\s+(?:(?:low|moderate|high|critical)\s+(?:severity\s+)?)?vulnerabilit/i.test(raw) || /npm audit fix/i.test(raw)) add('audit', line, 'rescan-current-lockfile');
     else if (/ExperimentalWarning/.test(raw)) add('experimental-runtime', line, 'informational', { blocking: false });
     else if (/new (?:release|(?:patch |minor |major )?version).*(?:pip|npm)|(?:pip|npm).*new (?:release|version)/i.test(raw)) add('tool-update', line, 'informational', { blocking: false });
+    // package.json allowScripts is the project authority; a user/global .npmrc allow-scripts clash is expected noise.
+    else if (/npm (?:warn|warning) allow-scripts.*declares its own allowScripts/i.test(raw)) add('configuration', line, 'informational', { blocking: false });
+    else if (/npm (?:warn|warning) allow-scripts/i.test(raw)) add('configuration', line, 'review-package-manager-config');
     else if (/npm (?:warn|warning).*config/i.test(raw)) add('configuration', line, 'review-package-manager-config');
     else if (/\b(?:warning|warn|npm ERR!|npm error)\b/i.test(raw)) add('unclassified-warning', line, 'review-log-at-source');
   }

package/src/security/scan.js

@@ -4,7 +4,7 @@ import { triageLog, resolveLogFindings } from './logs.js';
 import { scanTrustBoundary } from './trust-boundary.js';
 
 export async function scanProjectSecurity(options = {}) {
-  const inventory = collectNpmDependencies(options.projectRoot);
+  const inventory = collectNpmDependencies(options.projectRoot, { releaseCandidate: options.releaseCandidate });
   const results = options.offline
     ? inventory.dependencies.map(d => ({ ...d, checked: false, advisories: [] }))
     : await queryOsv(inventory.dependencies, options);

package/src/ui/cli/help.js

@@ -89,6 +89,42 @@ export function renderHelpOverview(version, options = {}) {
   return lines.join('\n');
 }
 
+export function renderCommandHelp(entryOrId, version = String(pkg.version || 'unknown')) {
+  const entry = typeof entryOrId === 'string' ? getCliCommand(entryOrId) : entryOrId;
+  if (!entry) return renderHelpOverview(version);
+
+  const usage = entry.usage?.length ? entry.usage : [`agentsam ${entry.id}`];
+  const lines = [
+    '',
+    '  ' + pc.bold('Agent Sam') + ' ' + pc.dim('v' + version) + ' ' + pc.dim('·') + ' ' + pc.bold(entry.id),
+    '  ' + pc.dim(entry.summary),
+    '',
+    '  ' + pc.bold('Usage'),
+    ...usage.map((row) => '    ' + pc.cyan(row)),
+  ];
+
+  if (entry.options?.length) {
+    const width = Math.min(32, Math.max(...entry.options.map((row) => row.flag.length), 0));
+    lines.push(
+      '',
+      '  ' + pc.bold('Options'),
+      ...entry.options.map((row) => '    ' + pc.cyan(row.flag.padEnd(width)) + '  ' + pc.dim(row.description)),
+    );
+  }
+
+  if (entry.aliases?.length) {
+    lines.push('', '  ' + pc.bold('Aliases'), '    ' + entry.aliases.map((alias) => pc.cyan(`agentsam ${alias}`)).join(' · '));
+  }
+  if (entry.skill) {
+    lines.push('', '  ' + pc.dim(`Skill: agentsam skills ${entry.skill}`));
+  }
+  if (entry.operation) {
+    lines.push('  ' + pc.dim(`Operation: ${entry.operation}`));
+  }
+  lines.push('');
+  return lines.join('\n');
+}
+
 export function renderHelpTopic(topic, version) {
   if (!topic) return renderHelpOverview(version);
   const skillHint = topic.rows?.[0]?.[1]?.includes('skill')
@@ -153,6 +189,11 @@ export async function runHelp(argv = [], options = {}) {
 
   const topicArg = args.find((arg) => !arg.startsWith('-'));
   if (topicArg) {
+    const command = getCliCommand(topicArg);
+    if (command) {
+      write(renderCommandHelp(command, version));
+      return;
+    }
     const topic = resolveHelpTopic(topicArg);
     if (!topic) {
       write(renderHelpOverview(version));

package/test/account-session.test.mjs

@@ -38,7 +38,7 @@ test('opaque browser login persists in machine-local storage and resolves indepe
   assert.equal(loaded.access_token, 'browser_session_machine_test');
   const browser = resolveBrowserSessionCredential({ env: {}, home });
   assert.equal(browser.source, 'agentsam_browser_oauth');
-  assert.equal(browser.kind, 'browser_oauth');
+  assert.equal(browser.kind, 'agentsam_browser_oauth');
   assert.equal(browser.value, 'browser_session_machine_test');
   assert.equal(resolveAccountApiKey({ env: {}, home }).value, '');
   assert.equal(resolveAccountAuth({ env: {}, home }).value, 'browser_session_machine_test');
@@ -70,7 +70,7 @@ test('invalid environment API key cannot shadow a valid browser login', t => {
   saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
   const resolved = resolveAccountAuth({ env: { AGENTSAM_API_KEY: 'not-an-aak' }, home });
   assert.equal(resolved.value, 'browser_session_machine_test');
-  assert.equal(resolved.kind, 'browser_oauth');
+  assert.equal(resolved.kind, 'agentsam_browser_oauth');
   assert.equal(resolved.fallback_error, 'invalid_api_key_prefix');
 });
 
@@ -79,7 +79,7 @@ test('async IAM authority also falls back from invalid environment key to browse
   saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
   const resolved = await resolveAccountAuthority({ env: { AGENTSAM_API_KEY: 'not-an-aak' }, home });
   assert.equal(resolved.value, 'browser_session_machine_test');
-  assert.equal(resolved.kind, 'browser_oauth');
+  assert.equal(resolved.kind, 'agentsam_browser_oauth');
   assert.equal(resolved.fallback_error, 'invalid_api_key_prefix');
 });
 

package/test/app-authority-context.test.mjs

@@ -0,0 +1,32 @@
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+import { resolveCurrentAppContext } from '../src/lib/app-authority.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(HERE, '..');
+
+test('generic repo root has no fabricated app identity', () => {
+  const context = resolveCurrentAppContext({ root: ROOT, cwd: ROOT });
+  assert.deepEqual(context, { app_id: null, host_origin: null, source: null });
+});
+
+test('Local Studio context resolves from nearest agentsam.app.json', () => {
+  const context = resolveCurrentAppContext({
+    root: ROOT,
+    cwd: path.join(ROOT, 'apps/local-studio/frontend'),
+  });
+  assert.equal(context.app_id, 'local-studio');
+  assert.equal(context.host_origin, null);
+  assert.match(context.source || '', /apps\/local-studio\/agentsam\.app\.json$/);
+});
+
+test('package app identity resolves from its own manifest without Local Studio leakage', () => {
+  const context = resolveCurrentAppContext({
+    root: ROOT,
+    cwd: path.join(ROOT, 'packages/agentsam-database-editor/src'),
+  });
+  assert.equal(context.app_id, 'database-editor');
+  assert.equal(context.host_origin, null);
+});

package/test/apps-scaffold-contract.test.mjs

@@ -63,7 +63,7 @@ test('CAD creator app package is curated for third-party installation', () => {
   const pkg = packageJson('apps', 'cad-creator');
   const manifest = JSON.parse(read('apps', 'cad-creator', 'agentsam.app.json'));
 
-  assert.equal(pkg.name, '@inneranimalmedia/agentsam-sdk-cad-creator');
+  assert.equal(pkg.name, '@inneranimalmedia/agentsam-cad-creator');
   assert.notEqual(pkg.private, true);
   assert.equal(pkg.bin['agentsam-cad-creator'], 'bin/agentsam-cad-creator.mjs');
   assert.equal(pkg.publishConfig.access, 'public');
@@ -91,7 +91,8 @@ test('client-cms-editor app manifest points to authoritative package name', () =
   assert.equal(manifest.package, pkg.name);
   assert.equal(manifest.runtime.local_preview, 'ready');
   assert.equal(manifest.runtime.source_scaffold, 'ready');
-  assert.equal(manifest.runtime.cloudflare, 'ready');
+  // Cloudflare path is adapter-ready until a graduated CF deploy receipt exists.
+  assert.equal(manifest.runtime.cloudflare, 'adapter-ready');
 });
 
 test('CAD creator keeps the robotics runtime lazy and the perception key server-side', () => {

package/test/cli/api-key-env-whoami.test.mjs

@@ -86,7 +86,7 @@ test('whoami surfaces tokenPermissions and authType from context', async () => {
       tokenPermissions: ['account:read', 'repository:read', 'models:invoke'],
       credential: {
         id: 'aakcred_1',
-        name: 'Sams-iMac',
+        name: 'dev-machine',
         prefix: 'aak_7fm…',
         environment: 'development',
         status: 'active',
@@ -99,7 +99,7 @@ test('whoami surfaces tokenPermissions and authType from context', async () => {
   assert.equal(status.loggedIn, true);
   assert.equal(status.authType, 'api_key');
   assert.deepEqual(status.tokenPermissions, ['account:read', 'repository:read', 'models:invoke']);
-  assert.equal(status.credential.name, 'Sams-iMac');
+  assert.equal(status.credential.name, 'dev-machine');
   assert.doesNotMatch(JSON.stringify(status), /aak_presented/);
 });
 

package/test/cli/catalog-authority.test.mjs

@@ -0,0 +1,64 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { getCliCommand } from '../../src/cli/command-catalog.js';
+import { runStatus } from '../../src/commands/status.js';
+import { setupNextCommands } from '../../src/commands/setup.js';
+import { renderRepositoryObservation } from '../../src/commands/knowledge.js';
+
+test('status --help is catalog-backed and does not collect runtime state', async () => {
+  let output = '';
+  let collected = false;
+  const result = await runStatus(['--help'], {
+    write(value) { output += value; },
+    async collectRuntime() {
+      collected = true;
+      throw new Error('status help must not collect runtime');
+    },
+  });
+
+  assert.equal(result, null);
+  assert.equal(collected, false);
+  assert.match(output, /Agent Sam.*status/);
+  assert.match(output, /--offline/);
+  assert.match(output, /--json/);
+});
+
+test('setup next-actions only reference catalogued top-level commands', () => {
+  const commands = setupNextCommands(['google.cloud', 'image.vectorize']);
+  assert.ok(commands.includes('agentsam status'));
+  assert.ok(commands.includes('agentsam capabilities'));
+  assert.ok(commands.includes('agentsam google-cloud doctor'));
+  assert.ok(!commands.some((command) => command === 'agentsam doctor'));
+  assert.ok(!commands.some((command) => command.startsWith('agentsam image ')));
+
+  for (const command of commands) {
+    const [, id] = command.split(/\s+/);
+    assert.ok(getCliCommand(id), `next action must be catalogued: ${command}`);
+  }
+});
+
+test('repository summary is human-sized while preserving important machine evidence', () => {
+  const output = renderRepositoryObservation({
+    data: {
+      repo_root: '/tmp/example',
+      repo_name: 'example',
+      git: { branch: 'main', head_sha: 'abcdef1234567890', dirty: true, changed_paths: 2 },
+      summary: { file_count: 2995, source_file_count: 2840, total_lines: 491023 },
+      top_level: [
+        { path: 'apps', files: 1351, lines: 289444 },
+        { path: 'packages', files: 757, lines: 77579 },
+      ],
+      pressure_points: [
+        { path: 'apps/local-studio', pressure_score: 89.5, stability_score: 10.2 },
+      ],
+    },
+  });
+
+  assert.match(output, /Agent Sam · repository/);
+  assert.match(output, /example/);
+  assert.match(output, /apps\/local-studio/);
+  assert.match(output, /not quality grades/);
+  assert.match(output, /agentsam repo --json/);
+  assert.doesNotMatch(output, /"pressure_points"/);
+});

package/test/cli/codebaseindex-plan-ux.test.mjs

@@ -32,6 +32,6 @@ describe('inventory path categories', () => {
     assert.equal(classifyTopLevel('node_modules'), 'dependencies');
     assert.equal(classifyTopLevel('dist'), 'dependencies');
     assert.equal(classifyTopLevel('generated'), 'generated');
-    assert.equal(classifyTopLevel('.agentsam'), 'config');
+    assert.equal(classifyTopLevel('.agentsam'), 'operational');
   });
 });

package/test/cli/machine-command.test.mjs

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getCliCommand } from '../../src/cli/command-catalog.js';
+import { resolveMachineBinary } from '../../src/commands/machine-binary.js';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+
+test('machine command is catalogued as machine.inspect', () => {
+  const entry = getCliCommand('machine');
+  assert.equal(entry?.id, 'machine');
+  assert.equal(entry?.operation, 'machine.inspect');
+  assert.equal(entry?.common, true);
+});
+
+test('machine crate + CLI sources exist for graduation', () => {
+  assert.equal(fs.existsSync(path.join(root, 'native/agentsam-machine/Cargo.toml')), true);
+  assert.equal(fs.existsSync(path.join(root, 'native/agentsam-machine/cli/src/main.rs')), true);
+  assert.equal(fs.existsSync(path.join(root, 'src/commands/machine.js')), true);
+  assert.equal(fs.existsSync(path.join(root, 'src/commands/machine-binary.js')), true);
+});
+
+test('resolveMachineBinary finds crate binary or cargo fallback in this repo', () => {
+  const resolution = resolveMachineBinary();
+  assert.notEqual(resolution.kind, 'missing');
+  if (resolution.kind === 'binary') {
+    assert.equal(fs.existsSync(resolution.path), true);
+  } else {
+    assert.equal(resolution.kind, 'cargo');
+    assert.equal(fs.existsSync(resolution.manifest), true);
+  }
+});