@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/test/cli/mcp-client.test.mjs

@@ -58,7 +58,7 @@ test('MCP authority store manages servers under ~/.agentsam/mcp with safe permis
   assert.equal(readMcpServer('inneranimalmedia', { home }), null);
 });
 
-test('MCP external client registry recognizes chatgpt, claude, cursor and respects is_active', async () => {
+test('MCP external client registry recognizes chatgpt, claude, cursor — not CF portals', async () => {
   const home = tempHome();
 
   // Baseline seed / cached client list
@@ -68,9 +68,11 @@ test('MCP external client registry recognizes chatgpt, claude, cursor and respec
   assert.ok(keys.includes('cursor'), 'Cursor is recognized in the external client registry');
   assert.ok(keys.includes('claude'), 'Claude is recognized in the external client registry');
   assert.ok(keys.includes('agentsam'), 'AgentSam is recognized in the external client registry');
+  assert.equal(keys.some((k) => k.startsWith('cf_')), false, 'CF MCP portals are servers, not clients');
 
   assert.equal(isClientRegistered('chatgpt', { home }), true);
   assert.equal(isClientRegistered('cursor', { home }), true);
+  assert.equal(isClientRegistered('cf_bindings_mcp', { home }), false);
   assert.equal(isClientRegistered('nonexistent_client_xyz', { home }), false);
 
   // Cache path is created upon writing
@@ -154,23 +156,25 @@ test('MCP client adapters materialize Cursor, Claude, and ChatGPT configurations
   assert.equal(fs.existsSync(chatgptConfigPath), false);
 });
 
-test('MCP server catalog resolves real registered servers with live health metrics', () => {
+test('MCP server catalog resolves CF portal bundles + IAM without fabricated health', () => {
   const home = tempHome();
   const catalog = listKnownServers({ home });
   assert.ok(catalog.length >= 8);
 
-  // Cloudflare API server from D1
   const cfApi = resolveServerPreset('cloudflare-api', { home });
   assert.ok(cfApi);
   assert.equal(cfApi.url, 'https://mcp.cloudflare.com/mcp');
-  assert.equal(cfApi.health_status, 'degraded');
-  assert.equal(cfApi.avg_latency_ms, 9);
+  assert.equal(cfApi.provider, 'cloudflare');
+  assert.equal(cfApi.kind, 'mcp_portal_bundle');
+  assert.ok(cfApi.portal_manage_scopes.includes('mcp-portals.read'));
+
+  const bindings = resolveServerPreset('cloudflare-bindings', { home });
+  assert.ok(bindings);
+  assert.ok(bindings.feature_packs.includes('data'));
 
-  // InnerAnimalMedia Main MCP from D1
   const iam = resolveServerPreset('inneranimalmedia', { home });
   assert.ok(iam);
-  assert.equal(iam.health_status, 'healthy');
-  assert.equal(iam.avg_latency_ms, 443);
+  assert.equal(iam.url, 'https://mcp.inneranimalmedia.com/mcp');
 });
 
 test('MCP telemetry logs tool receipts and computes accurate summaries', () => {
@@ -204,6 +208,7 @@ test('agentsam mcp CLI handles add, list, status, doctor, and remove end-to-end'
   const helpText = logs.join('\n');
   assert.ok(helpText.includes('chatgpt'), 'Help text displays ChatGPT as a recognized client');
   assert.ok(helpText.includes('cloudflare-api'), 'Help text displays cloudflare-api preset');
+  assert.ok(helpText.includes('bindings.mcp.cloudflare.com') || helpText.includes('cloudflare-bindings'), 'CF portal hostnames remain offerable');
   logs.length = 0;
 
   // Add inneranimalmedia preset for chatgpt client
@@ -230,11 +235,17 @@ test('agentsam mcp CLI handles add, list, status, doctor, and remove end-to-end'
   assert.equal(statusRes.name, 'inneranimalmedia');
   assert.equal(statusRes.hasAuth, true);
 
-  // Doctor includes catalog health data
+  // Doctor includes catalog / CF pack metadata
   const doctorRes = await runMcp(['doctor', 'inneranimalmedia', '--json'], { home, write });
   assert.equal(doctorRes.name, 'inneranimalmedia');
   assert.equal(doctorRes.authConfigured, true);
-  assert.equal(doctorRes.catalogHealth?.health_status, 'healthy');
+  assert.equal(doctorRes.catalog?.auth_type, 'bearer');
+
+  // Cloudflare bundle scopes are pack-scoped (includes mcp-portals.*)
+  const scopeRes = await runMcp(['scopes', 'cloudflare-bindings', '--json'], { home, write });
+  assert.ok(scopeRes.oauth_scopes.includes('mcp-portals.read'));
+  assert.ok(scopeRes.oauth_scopes.includes('mcp-portals.write'));
+  assert.ok(scopeRes.oauth_scopes.includes('d1.read'));
 
   // Remove
   const removeRes = await runMcp(['remove', 'inneranimalmedia', '--client', 'all', '--json'], { home, write });

package/test/cli/runtime-persist.test.mjs

@@ -0,0 +1,56 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  buildWindowsScheduledTaskXml,
+  buildLaunchAgentPlist,
+  writeWindowsScheduledTask,
+  WINDOWS_TASK_NAME,
+} from '../../src/lib/setup/runtime-persist.js';
+
+test('buildWindowsScheduledTaskXml includes binary, listen, logon trigger', () => {
+  const xml = buildWindowsScheduledTaskXml({
+    binary: 'C:\\Users\\sam\\.agentsam\\bin\\agentsamd.exe',
+    listen: '127.0.0.1:18765',
+    workingDirectory: 'C:\\Users\\sam\\.agentsam\\bin',
+  });
+  assert.match(xml, /agentsamd\.exe/);
+  assert.match(xml, /--listen 127\.0\.0\.1:18765/);
+  assert.match(xml, /LogonTrigger/);
+  assert.match(xml, /InteractiveToken/);
+  assert.match(xml, /RestartOnFailure/);
+});
+
+test('buildLaunchAgentPlist includes KeepAlive and listen', () => {
+  const plist = buildLaunchAgentPlist({
+    binary: '/Users/sam/.agentsam/bin/agentsamd',
+    listen: '127.0.0.1:18765',
+    stdoutLog: '/tmp/out.log',
+    stderrLog: '/tmp/err.log',
+  });
+  assert.match(plist, /com\.inneranimalmedia\.agentsamd/);
+  assert.match(plist, /KeepAlive/);
+  assert.match(plist, /127\.0\.0\.1:18765/);
+});
+
+test('writeWindowsScheduledTask writes XML without calling schtasks when skipRegister', async () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-runtime-'));
+  try {
+    const result = await writeWindowsScheduledTask(
+      home,
+      path.join(home, '.agentsam', 'bin', 'agentsamd.exe'),
+      '127.0.0.1:18765',
+      { forcePlatform: 'win32', skipRegister: true },
+    );
+    assert.equal(result.kind, 'scheduled_task');
+    assert.equal(result.taskName, WINDOWS_TASK_NAME);
+    assert.equal(result.registered, false);
+    assert.ok(fs.existsSync(result.xmlPath));
+    const xml = fs.readFileSync(result.xmlPath, 'utf8');
+    assert.match(xml, /agentsamd\.exe/);
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});

package/test/cli/rust-command.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getCliCommand } from '../../src/cli/command-catalog.js';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+
+test('rust/wasm command aliases resolve to one catalog authority', () => {
+  const rust = getCliCommand('rust');
+  assert.equal(rust?.id, 'rust');
+  assert.equal(getCliCommand('wasm')?.id, 'rust');
+  assert.equal(getCliCommand('rapid-rust')?.id, 'rust');
+});
+
+test('rapid rust root bin and native crate ship in source tree', () => {
+  assert.equal(fs.existsSync(path.join(root, 'bin/agentsam-rapid-rust')), true);
+  assert.equal(fs.existsSync(path.join(root, 'packages/agentsam-rapid-rust/Cargo.toml')), true);
+  assert.equal(fs.existsSync(path.join(root, 'scripts/build_rapid_rust_cli.py')), true);
+});

package/test/credentials-audit.test.mjs

@@ -0,0 +1,113 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  remediateGcloudEdgeServiceAccountKey,
+  remediateGcloudPermissionDenied,
+  remediateGithubTokenShadow,
+  remediateProviderFailure,
+  renderRemediationCard,
+  recommendedCommand,
+} from '../src/lib/provider-command-remediation.js';
+import { runCredentials } from '../src/commands/credentials.js';
+import { listCheatSheetGroups, renderCheatSheet } from '../src/commands/cheat-sheet.js';
+import { collectCredentialsAudit } from '../src/lib/credentials-audit.js';
+
+test('edge-cloud service-account key create remediates to IAM / compute intents', () => {
+  const card = remediateGcloudEdgeServiceAccountKey({
+    argv: ['gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
+    projectId: 'gen-lang-client-0684066529',
+    instance: 'iam-tunnel',
+    zone: 'us-central1-f',
+  });
+  assert.ok(card);
+  assert.equal(card.provider, 'google_cloud');
+  assert.equal(card.kind, 'command_incomplete_wrong_family');
+  assert.match(card.summary, /Distributed Cloud Edge/i);
+  assert.match(card.summary, /Compute Engine/i);
+  const commands = card.actions.map((row) => row.command).join('\n');
+  assert.match(commands, /gcloud compute instances describe iam-tunnel/);
+  assert.match(commands, /gcloud iam service-accounts list/);
+  assert.match(commands, /gcloud iam service-accounts keys create/);
+  assert.match(commands, /agentsam connections/);
+  const rendered = renderRemediationCard(card);
+  assert.match(rendered, /Command incomplete/);
+  assert.match(rendered, /\[enter\]/);
+  assert.equal(recommendedCommand(card), card.actions[0].command);
+});
+
+test('remediateProviderFailure matches edge-cloud argv fixture', () => {
+  const card = remediateProviderFailure({
+    argv: ['gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
+    stderr: 'ERROR: argument OUTPUT_FILE (--service-account : --location): Must be specified.',
+  });
+  assert.ok(card);
+  assert.equal(card.kind, 'command_incomplete_wrong_family');
+});
+
+test('permission denied remediation exposes reauth + IAM console actions', () => {
+  const card = remediateGcloudPermissionDenied({
+    operation: 'compute.instances.list',
+    projectId: 'gen-lang-client-0684066529',
+    connection: 'Google Cloud · InnerAnimalMedia',
+  });
+  assert.equal(card.kind, 'permission_denied');
+  assert.match(renderRemediationCard(card), /Permission missing/);
+  assert.match(renderRemediationCard(card), /Re-authorize Google Cloud/);
+  assert.ok(card.actions.some((row) => /console\.cloud\.google\.com\/iam-admin/i.test(row.docs_url || '')));
+});
+
+test('github token shadow remediation prefers unset + keyring status', () => {
+  const card = remediateGithubTokenShadow({
+    envTokenPresent: true,
+    keyringHealthy: true,
+    scopes: ['repo', 'read:org'],
+  });
+  assert.ok(card);
+  assert.equal(card.kind, 'credential_shadow');
+  assert.match(recommendedCommand(card), /unset GITHUB_TOKEN/);
+});
+
+test('credentials remediate CLI prints edge-cloud card without secrets', async () => {
+  const chunks = [];
+  const code = await runCredentials(
+    ['remediate', '--', 'gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
+    { write: (s) => chunks.push(s) },
+  );
+  assert.equal(code, 0);
+  const out = chunks.join('');
+  assert.match(out, /Google Cloud/);
+  assert.match(out, /gcloud iam service-accounts list/);
+  assert.doesNotMatch(out, /gho_/);
+  assert.doesNotMatch(out, /AIza/);
+});
+
+test('credentials audit --names-only never includes secret-looking values', async () => {
+  const report = await collectCredentialsAudit({
+    env: {
+      HOME: process.env.HOME,
+      AGENTSAM_API_KEY: 'aak_test_should_never_appear_in_output_fields_as_value',
+      GITHUB_TOKEN: 'ghp_should_never_be_echoed',
+      OPENAI_API_KEY: 'sk-should-never-be-echoed',
+    },
+    verify: false,
+    drift: true,
+    namesOnly: true,
+    noNetwork: true,
+  });
+  const blob = JSON.stringify(report);
+  assert.doesNotMatch(blob, /aak_test_should_never/);
+  assert.doesNotMatch(blob, /ghp_should_never/);
+  assert.doesNotMatch(blob, /sk-should-never/);
+  assert.equal(report.shell_presence.GITHUB_TOKEN, true);
+  assert.equal(report.shell_presence.AGENTSAM_API_KEY, true);
+  assert.ok(report.drift.some((row) => row.code === 'github_env_token_present'));
+});
+
+test('cheat-sheet exposes System + Providers groups', () => {
+  const groups = listCheatSheetGroups();
+  assert.ok(groups.some((g) => g.id === 'system'));
+  assert.ok(groups.some((g) => g.id === 'providers'));
+  const text = renderCheatSheet('2.6.4');
+  assert.match(text, /credentials audit/);
+  assert.match(text, /cheat-sheet/);
+});

package/test/deploy-health-scan.test.mjs

@@ -28,12 +28,18 @@ describe('deploy health', () => {
 
   it('reads hostname from wrangler.jsonc', () => {
     const origin = resolveHealthOrigin({
-      env: {},
       wranglerConfigText: '{"routes":[{"pattern":"agentsam.inneranimalmedia.com","custom_domain":true}]}',
     });
     assert.equal(origin, 'https://agentsam.inneranimalmedia.com');
   });
 
+  it('fails loud when wrangler routes pattern is missing', () => {
+    assert.throws(
+      () => resolveHealthOrigin({ wranglerConfigText: '{}' }),
+      (err) => err?.code === 'health_origin_required',
+    );
+  });
+
   it('treats /health ok:true with connector unconfigured as healthy', async () => {
     const fetchImpl = async (url) => {
       if (String(url).endsWith('/health')) {
@@ -48,6 +54,28 @@ describe('deploy health', () => {
     assert.equal(health.ok, true);
     assert.equal(health.results['/health'].appOk, true);
     assert.equal(health.results['/health'].cloudflareConfigured, false);
+    assert.equal(health.results['/privacy'].ok, true);
+    assert.equal(health.results['/terms'].ok, true);
+  });
+
+  it('fails deploy health when /privacy or /terms are not HTTP 200', async () => {
+    const fetchImpl = async (url) => {
+      const path = String(url).replace(/^https?:\/\/[^/]+/, '');
+      if (path === '/health') {
+        return {
+          status: 200,
+          json: async () => ({ ok: true, connections: { cloudflare: { configured: true } } }),
+        };
+      }
+      if (path === '/privacy' || path === '/terms') {
+        return { status: 404, json: async () => ({}) };
+      }
+      return { status: 200, json: async () => ({}) };
+    };
+    const health = await probeDeployHealth('https://agentsam.inneranimalmedia.com', { fetchImpl });
+    assert.equal(health.ok, false);
+    assert.equal(health.results['/privacy'].ok, false);
+    assert.equal(health.results['/terms'].ok, false);
   });
 
   it('sends a browser-safe User-Agent so WAF does not 403 the probe', async () => {

package/test/fixtures/project-authority/customer-app/.agentsam/app.json

@@ -0,0 +1,5 @@
+{
+  "schema": "agentsam.app-install.v1",
+  "app_id": "my-product",
+  "mount": "apps/my-product"
+}

package/test/fixtures/project-authority/customer-app/apps/my-product/index.ts

@@ -0,0 +1 @@
+export const productName = 'Generic Customer Product';

package/test/fixtures/project-authority/customer-app/wrangler.toml

@@ -0,0 +1,17 @@
+name = "customer-product-worker"
+
+[ai]
+binding = "MY_AI"
+
+[[vectorize]]
+binding = "MY_VECTORS"
+index_name = "customer-code-index"
+
+[[d1_databases]]
+binding = "DB"
+database_name = "customer-db"
+database_id = "00000000-0000-0000-0000-000000000001"
+
+[[r2_buckets]]
+binding = "CONTENT"
+bucket_name = "customer-assets"

package/test/gcloud-auth.test.mjs

@@ -0,0 +1,111 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  resolveGoogleOauthStartUrl,
+  runAgentsamGoogleOauthLogin,
+  runGcloudAuth,
+} from '../src/commands/gcloud-auth.js';
+import {
+  GOOGLE_CLOUD_CONNECTION_SCOPES,
+  buildGoogleDesktopAuthUrl,
+  googleCloudPermissionChecklist,
+  resolveGoogleDesktopClientId,
+} from '../src/lib/google-desktop-oauth.js';
+
+const TEST_ENV = {
+  IAM_OAUTH_ISSUER: 'https://inneranimalmedia.com',
+  GOOGLE_CLIENT_ID: '246811022042-d8q1rc1oki4uv9qiqjah8lvkffb91crp.apps.googleusercontent.com',
+  GOOGLE_DESKTOP_CLIENT_ID: '246811022042-cckq00b5seekpkv0in358jhu42n0b6u9.apps.googleusercontent.com',
+};
+
+test('hosted --web login emits start URL in --json', async () => {
+  let out = '';
+  const code = await runAgentsamGoogleOauthLogin({
+    write: (s) => {
+      out += s;
+    },
+    json: true,
+    nonInteractive: true,
+    env: TEST_ENV,
+  });
+  assert.equal(code, 0);
+  const parsed = JSON.parse(out.slice(out.indexOf('{')));
+  assert.equal(parsed.mode, 'hosted_identity');
+  assert.equal(
+    parsed.start_url,
+    resolveGoogleOauthStartUrl(TEST_ENV),
+  );
+});
+
+test('gcloud auth login --web is hosted identity', async () => {
+  let out = '';
+  const code = await runGcloudAuth(['login', '--web', '--json'], {
+    write: (s) => {
+      out += s;
+    },
+    nonInteractive: true,
+    env: TEST_ENV,
+  });
+  assert.equal(code, 0);
+  assert.match(out, /hosted_identity|\/api\/oauth\/google\/start/);
+});
+
+test('gcloud auth help mentions studio broker default and --desktop/--web/--sdk', async () => {
+  let out = '';
+  await runGcloudAuth(['help'], {
+    write: (s) => {
+      out += s;
+    },
+  });
+  assert.match(out, /Studio Web OAuth broker|Worker holds/i);
+  assert.match(out, /--desktop/);
+  assert.match(out, /--web/);
+  assert.match(out, /--sdk/);
+});
+
+test('desktop auth URL requests cloud-platform + offline', () => {
+  const url = new URL(buildGoogleDesktopAuthUrl({
+    clientId: resolveGoogleDesktopClientId(TEST_ENV),
+    redirectUri: 'http://127.0.0.1:12345/callback',
+    state: 'abc',
+    codeChallenge: 'challenge',
+  }));
+  assert.match(url.searchParams.get('scope') || '', /cloud-platform/);
+  assert.equal(url.searchParams.get('access_type'), 'offline');
+  assert.equal(url.searchParams.get('code_challenge_method'), 'S256');
+  assert.match(GOOGLE_CLOUD_CONNECTION_SCOPES, /openid/);
+});
+
+test('permissions checklist separates OAuth scopes from IAM roles', async () => {
+  let out = '';
+  const code = await runGcloudAuth(['login', '--permissions'], {
+    write: (s) => {
+      out += s;
+    },
+  });
+  assert.equal(code, 0);
+  assert.match(out, /cloud-platform/);
+  assert.match(out, /mcp\.toolUser|roles\/mcp/);
+  const checklist = googleCloudPermissionChecklist();
+  assert.ok(checklist.oauth_scopes_requested.includes('https://www.googleapis.com/auth/cloud-platform'));
+});
+
+test('resolveGoogleDesktopClientId fails loud when unset', () => {
+  assert.throws(
+    () => resolveGoogleDesktopClientId({}),
+    (err) => err?.code === 'google_desktop_client_not_configured',
+  );
+});
+
+test('resolveGoogleDesktopClientIdAsync uses public-config when env unset', async () => {
+  const { resolveGoogleDesktopClientIdAsync } = await import('../src/lib/google-desktop-oauth.js');
+  const id = await resolveGoogleDesktopClientIdAsync({}, {
+    publicConfigUrl: 'https://example.test/api/public-config',
+    fetchImpl: async () =>
+      new Response(JSON.stringify({
+        ok: true,
+        google_desktop_client_id: 'from-public-config.apps.googleusercontent.com',
+      }), { status: 200 }),
+  });
+  assert.equal(id, 'from-public-config.apps.googleusercontent.com');
+});

package/test/google-cloud-connection.test.mjs

@@ -0,0 +1,83 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import {
+  diagnoseGoogleCloudAccountMismatch,
+  diagnoseInsufficientAccess,
+  readGoogleCloudConnection,
+  renderInsufficientAccessCard,
+  writeGoogleCloudConnection,
+} from '../src/lib/google-cloud-connection.js';
+import { describeAuthShadow, renderLoginResult } from '../src/commands/whoami.js';
+
+test('connection preference persists identity+project without secrets', () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-conn-'));
+  const saved = writeGoogleCloudConnection(
+    {
+      identity: 'meauxbility@gmail.com',
+      organization: 'inneranimals.com',
+      project: 'gen-lang-client-0684066529',
+      billing_account: '017E01-4426EF-21356F',
+    },
+    { home },
+  );
+  assert.equal(saved.identity, 'meauxbility@gmail.com');
+  assert.equal(saved.project, 'gen-lang-client-0684066529');
+  const again = readGoogleCloudConnection({ home });
+  assert.equal(again.organization, 'inneranimals.com');
+  assert.doesNotMatch(JSON.stringify(again), /private_key|BEGIN /);
+});
+
+test('identity mismatch diagnosis is deterministic', () => {
+  const d = diagnoseGoogleCloudAccountMismatch({
+    preferred: { identity: 'meauxbility@gmail.com', project: 't-pulsar-483701-q1' },
+    activeAccount: 'info@inneranimals.com',
+    activeProject: 't-pulsar-483701-q1',
+    accounts: [
+      { account: 'info@inneranimals.com', status: 'ACTIVE' },
+      { account: 'meauxbility@gmail.com', status: '' },
+    ],
+  });
+  assert.equal(d.ok, false);
+  assert.equal(d.kind, 'identity_mismatch');
+  assert.equal(d.alternate_authenticated, true);
+  assert.match(d.remediation.actions[0].command, /gcloud config set account meauxbility@gmail.com/);
+});
+
+test('insufficient access card matches product UX', () => {
+  const d = diagnoseInsufficientAccess({
+    currentAccount: 'info@inneranimals.com',
+    requiredRole: 'roles/owner',
+    project: 'gen-lang-client-0684066529',
+    accounts: [
+      { account: 'info@inneranimals.com', roles: ['roles/viewer'] },
+      { account: 'meauxbility@gmail.com', roles: ['roles/owner'] },
+    ],
+  });
+  assert.equal(d.kind, 'insufficient_access');
+  const text = renderInsufficientAccessCard(d);
+  assert.match(text, /This Google account does not have enough access/);
+  assert.match(text, /meauxbility@gmail\.com/);
+  assert.match(text, /✓ Owner/);
+  assert.match(text, /\[enter\]/);
+  assert.match(text, /\[a\]/);
+  assert.match(text, /\[c\]/);
+});
+
+test('login result explains API key shadowing OAuth', () => {
+  const status = {
+    active_auth: { kind: 'api_key', source: 'environment' },
+    api_key: { configured: true, source: 'environment' },
+    browser_session: { configured: true, expired: false, refreshable: true },
+  };
+  const text = renderLoginResult(status);
+  assert.match(text, /Browser OAuth login saved/);
+  assert.match(text, /not currently authoritative/);
+  assert.match(text, /AGENTSAM_API_KEY has higher precedence/);
+  assert.match(text, /\[enter\] keep API key/);
+  const shadow = describeAuthShadow(status);
+  assert.ok(shadow);
+  assert.match(shadow.join('\n'), /Authority lanes/);
+});

package/test/google-cloud-inventory.test.mjs

@@ -0,0 +1,64 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { normalizeGoogleCloudArgv } from '../src/commands/google-cloud.js';
+import {
+  renderServiceAccountInspect,
+  renderServiceAccountTable,
+} from '../src/lib/google-cloud-inventory.js';
+
+test('normalizeGoogleCloudArgv maps compute instances into google-cloud compute', () => {
+  assert.deepEqual(normalizeGoogleCloudArgv(['instances', 'list']), ['compute', 'instances', 'list']);
+  assert.deepEqual(normalizeGoogleCloudArgv(['iam', 'service-accounts', 'list']), ['iam', 'service-accounts', 'list']);
+  assert.deepEqual(normalizeGoogleCloudArgv(['auth', 'login']), ['auth', 'login']);
+  assert.deepEqual(normalizeGoogleCloudArgv(['gcloud', 'auth', 'login']), ['auth', 'login']);
+});
+
+test('service account table render never invents INNERANIMALMEDIA as Google keyOrigin', () => {
+  const text = renderServiceAccountTable({
+    project_id: 'gen-lang-client-0684066529',
+    accounts: [
+      {
+        name: 'Agent Sam Vertex',
+        short_name: 'agent-sam-vertex',
+        email: 'agent-sam-vertex@gen-lang-client-0684066529.iam.gserviceaccount.com',
+        attached: [],
+        key_counts: { total: 3, user_managed: 1 },
+        status: 'ready',
+        disposition_hint: 'KEEP · ROTATE user-managed keys',
+        keys: [
+          { key_type: 'USER_MANAGED', key_origin: 'GOOGLE_PROVIDED', agentsam_origin_label: 'GOOGLE_PROVIDED' },
+        ],
+      },
+    ],
+  });
+  assert.match(text, /Agent Sam Vertex/);
+  assert.match(text, /GOOGLE_PROVIDED/);
+  assert.match(text, /INNERANIMALMEDIA_PROVIDED is only for AgentSam-issued/);
+});
+
+test('inspect render shows roles and key metadata only', () => {
+  const text = renderServiceAccountInspect({
+    ok: true,
+    project_id: 'gen-lang-client-0684066529',
+    account: {
+      short_name: 'agent-sam-vertex',
+      email: 'agent-sam-vertex@gen-lang-client-0684066529.iam.gserviceaccount.com',
+      bucket: 'agentsam',
+      roles: ['roles/aiplatform.user', 'roles/aiplatform.admin'],
+      keys: [
+        {
+          key_type: 'SYSTEM_MANAGED',
+          agentsam_origin_label: 'GOOGLE_PROVIDED',
+          created_at: '2026-06-02T17:17:25Z',
+          expires_at: '2027-06-02T17:17:25Z',
+          key_id: 'abc',
+        },
+      ],
+      attached: [],
+      disposition_hint: 'KEEP · ROTATE user-managed keys',
+    },
+  });
+  assert.match(text, /roles\/aiplatform\.admin/);
+  assert.match(text, /GOOGLE_PROVIDED/);
+  assert.doesNotMatch(text, /BEGIN PRIVATE KEY/);
+});

package/test/init-options.test.mjs

@@ -0,0 +1,35 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  guidanceForRunTarget,
+  listInitProjectTypeOptions,
+  parseProjectTypeChoice,
+  RUN_TARGET_OPTIONS,
+} from '../src/lib/init-options.js';
+
+test('init project types include presets, CF scaffolds, and ready apps', () => {
+  const options = listInitProjectTypeOptions();
+  const values = options.map((row) => row.value);
+  assert.ok(values.includes('preset:fullstack'));
+  assert.ok(values.includes('preset:cms'));
+  assert.ok(values.includes('scaffold:cms'));
+  assert.ok(values.includes('scaffold:worker-api'));
+  assert.ok(values.includes('product:agentsam-rapid-rust'));
+  assert.ok(values.includes('app:client-cms-editor'));
+  assert.ok(values.some((value) => value.startsWith('app:')));
+  assert.equal(parseProjectTypeChoice('scaffold:cms').kind, 'scaffold');
+  assert.equal(parseProjectTypeChoice('app:local-studio').id, 'local-studio');
+  assert.equal(parseProjectTypeChoice('product:agentsam-rapid-rust').kind, 'product');
+});
+
+test('run targets are operational paths, not aspirational later flags', () => {
+  const values = RUN_TARGET_OPTIONS.map((row) => row.value);
+  assert.deepEqual(values, ['local', 'cloudflare', 'tauri', 'gcp', 'docker']);
+  assert.match(RUN_TARGET_OPTIONS.find((row) => row.value === 'cloudflare').hint, /OAuth/);
+  assert.match(RUN_TARGET_OPTIONS.find((row) => row.value === 'tauri').hint, /SQLite/);
+  assert.match(guidanceForRunTarget('cloudflare').join('\n'), /connections setup/);
+  assert.match(guidanceForRunTarget('tauri', { projectName: 'demo' }).join('\n'), /Local Studio/);
+  assert.match(guidanceForRunTarget('gcp').join('\n'), /google-cloud/);
+  assert.match(guidanceForRunTarget('docker').join('\n'), /dockerize/);
+});