@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/test/integration/app-command.test.mjs

@@ -14,6 +14,36 @@ test('lists agentsam.app.json manifests for product apps', () => {
   assert.ok(ids.includes('ecommerce-cms-agentsam'));
 });
 
+test('agentsam app validate passes for all product apps', async () => {
+  const { validateApps } = await import('../../src/commands/app.js');
+  const report = validateApps();
+  assert.equal(report.ok, true, report.errors.join('\n'));
+  assert.ok(report.apps.length >= 4);
+});
+
+test('CMS app scaffold source is included in the SDK distribution contract', async () => {
+  const { validateApps } = await import('../../src/commands/app.js');
+  const report = validateApps({ appId: 'client-cms-editor' });
+  assert.equal(report.ok, true, report.errors.join('\n'));
+  assert.deepEqual(report.warnings, []);
+});
+
+test('CAD and CMS workers load APP identity from agentsam.app.json', () => {
+  const cad = fs.readFileSync(path.resolve('apps/cad-creator/backend/worker/index.js'), 'utf8');
+  const cms = fs.readFileSync(path.resolve('apps/client-cms-editor/backend/worker/index.js'), 'utf8');
+  assert.match(cad, /import appManifest from ['"]\.\.\/\.\.\/agentsam\.app\.json['"]/);
+  assert.match(cms, /import appManifest from ['"]\.\.\/\.\.\/agentsam\.app\.json['"]/);
+  assert.doesNotMatch(cad, /const\s+APP\s*=\s*["']/);
+  assert.doesNotMatch(cms, /const\s+APP\s*=\s*["']/);
+});
+
+test('desktop CMS shell app_id resolves to client-cms-editor', () => {
+  const manifest = JSON.parse(
+    fs.readFileSync(path.resolve('packages/agentsam-desktop-shell/manifests/cms-editor.json'), 'utf8'),
+  );
+  assert.equal(manifest.app_id, 'client-cms-editor');
+});
+
 
 test('Ecommerce CMS app bin exposes truthful runnable doctor state', () => {
   const bin = path.resolve('apps/ecommerce-cms-agentsam/bin/agentsam-ecommerce.mjs');

package/test/integration/autorag-project-authority.integration.test.mjs

@@ -0,0 +1,51 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = fileURLToPath(new URL('../..', import.meta.url));
+const bin = path.join(repoRoot, 'bin', 'agentsam');
+const fixture = path.join(repoRoot, 'test', 'fixtures', 'project-authority', 'customer-app');
+
+function runAutorag(root, ...args) {
+  const stdout = execFileSync(process.execPath, [bin, 'autorag', ...args, '--cwd', root], {
+    cwd: root,
+    encoding: 'utf8',
+    env: { ...process.env, CLOUDFLARE_API_TOKEN: '', CLOUDFLARE_ACCOUNT_ID: '' },
+  });
+  return JSON.parse(stdout);
+}
+
+test('generic customer fixture discovers existing project resources and adopts Vectorize', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-project-authority-fixture-'));
+  try {
+    fs.cpSync(fixture, root, { recursive: true });
+    const status = runAutorag(root, 'status');
+    assert.deepEqual(status.discovery.scopes, ['apps']);
+    assert.equal(status.project_context.schema, 'agentsam.project-context.v1');
+    assert.equal(status.project_context.project.host_install.app_id, 'my-product');
+    assert.equal(status.project_context.resources.workers_ai.binding, 'MY_AI');
+    assert.equal(status.project_context.resources.vectorize[0].binding, 'MY_VECTORS');
+    assert.equal(status.project_context.resources.vectorize[0].index, 'customer-code-index');
+    assert.equal(status.project_context.resources.d1[0].binding, 'DB');
+    assert.equal(status.project_context.resources.r2[0].binding, 'CONTENT');
+    assert.equal(status.project_context.resources.vectorize[0].locally_executable, false);
+    assert.equal(status.project_context.resources.vectorize[0].remotely_executable, true);
+
+    const setup = runAutorag(root, 'setup', '--yes');
+    assert.deepEqual(setup.recommendation.scope, ['apps']);
+    assert.equal(setup.config.lane.backend, 'cloudflare_vectorize');
+    assert.equal(setup.config.lane.binding, 'MY_VECTORS');
+    assert.equal(setup.config.lane.index, 'customer-code-index');
+    assert.equal(setup.config.embedding.provider, 'none');
+
+    const policy = JSON.parse(fs.readFileSync(path.join(root, '.agentsam', 'knowledge.json'), 'utf8'));
+    assert.equal(policy.lane.binding, 'MY_VECTORS');
+    assert.equal(policy.lane.index, 'customer-code-index');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

package/test/integration/autorag-runtime-discovery.test.mjs

@@ -0,0 +1,107 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { discoverKnowledgeRuntime } from '../../src/knowledge/runtime-discovery.js';
+
+test('AutoRAG runtime discovery sees local index and Cloudflare Vectorize without local knowledge config', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-autorag-runtime-'));
+  try {
+    fs.mkdirSync(path.join(root, '.agentsam', 'knowledge'), { recursive: true });
+    fs.writeFileSync(path.join(root, '.agentsam', 'knowledge', 'index.sqlite'), '');
+    fs.writeFileSync(
+      path.join(root, 'wrangler.toml'),
+      [
+        'name = "demo-worker"',
+        '',
+        '[ai]',
+        'binding = "AGENTSAM_WAI"',
+        '',
+        '[[vectorize]]',
+        'binding = "DEMO_VECTORIZE"',
+        'index_name = "demo-index-1024"',
+        '',
+      ].join('\n'),
+    );
+
+    const runtime = discoverKnowledgeRuntime(root);
+    assert.equal(runtime.local_index.exists, true);
+    assert.equal(runtime.cloudflare.configured, true);
+    assert.equal(runtime.cloudflare.worker_name, 'demo-worker');
+    assert.equal(runtime.cloudflare.ai_binding, 'AGENTSAM_WAI');
+    assert.deepEqual(runtime.cloudflare.vectorize, [{
+      binding: 'DEMO_VECTORIZE',
+      index: 'demo-index-1024',
+      source: 'wrangler_config',
+    }]);
+    assert.deepEqual(runtime.lanes.map((lane) => lane.backend), [
+      'local_exact',
+      'cloudflare_vectorize',
+    ]);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('project context receipt separates observed deployment resources from local executability', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-project-context-'));
+  try {
+    fs.mkdirSync(path.join(root, '.agentsam'), { recursive: true });
+    fs.writeFileSync(path.join(root, '.agentsam', 'app.json'), JSON.stringify({ schema: 'agentsam.app-install.v1', app_id: 'my-product' }));
+    fs.writeFileSync(path.join(root, 'wrangler.toml'), [
+      'name = "customer-worker"',
+      '[ai]',
+      'binding = "MY_AI"',
+      '[[vectorize]]',
+      'binding = "MY_VECTORS"',
+      'index_name = "customer-code-index"',
+      '[[d1_databases]]',
+      'binding = "DB"',
+      'database_name = "customer-db"',
+      'database_id = "00000000-0000-0000-0000-000000000001"',
+      '[[r2_buckets]]',
+      'binding = "CONTENT"',
+      'bucket_name = "customer-assets"',
+      '',
+    ].join('\n'));
+
+    const runtime = discoverKnowledgeRuntime(root, { env: {} });
+    assert.equal(runtime.schema, 'agentsam.project-context.v1');
+    assert.equal(runtime.project.host_install.app_id, 'my-product');
+    assert.equal(runtime.resources.workers_ai.binding, 'MY_AI');
+    assert.equal(runtime.resources.workers_ai.locally_executable, false);
+    assert.equal(runtime.resources.workers_ai.remotely_executable, true);
+    assert.equal(runtime.resources.vectorize[0].binding, 'MY_VECTORS');
+    assert.equal(runtime.resources.vectorize[0].index, 'customer-code-index');
+    assert.equal(runtime.resources.vectorize[0].locally_executable, false);
+    assert.equal(runtime.resources.vectorize[0].remotely_executable, true);
+    assert.equal(runtime.resources.d1[0].binding, 'DB');
+    assert.equal(runtime.resources.r2[0].binding, 'CONTENT');
+    assert.equal(runtime.knowledge.policy_configured, false);
+    assert.equal(runtime.knowledge.suggested_backend, 'cloudflare_vectorize');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('project context receipt surfaces knowledge policy versus Wrangler drift', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-project-context-drift-'));
+  try {
+    fs.writeFileSync(path.join(root, 'wrangler.toml'), [
+      'name = "customer-worker"',
+      '[[vectorize]]',
+      'binding = "MY_VECTORS"',
+      'index_name = "customer-code-index"',
+      '',
+    ].join('\n'));
+    const runtime = discoverKnowledgeRuntime(root, {
+      env: {},
+      knowledgeConfig: { lane: { backend: 'cloudflare_vectorize', binding: 'OTHER_VECTORS', index: 'other-index' } },
+    });
+    assert.equal(runtime.conflicts.length, 1);
+    assert.equal(runtime.conflicts[0].kind, 'knowledge_deployment_drift');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

package/test/integration/cad-project.test.mjs

@@ -51,12 +51,15 @@ test('agent and runtime share executable CAD handlers',async t=>{
 test('CAD registry projects the app into tools workflows and CLI graph relationships',()=>{
  const manifest=JSON.parse(fs.readFileSync(new URL('../../registry/cad-project/manifest.json',import.meta.url),'utf8'));
  const migration=fs.readFileSync(new URL('../../registry/cad-project/migration.sql',import.meta.url),'utf8');
- assert.equal(manifest.product.slug,'agentsam-cad-creator');
+ assert.equal(manifest.product.app_id,'cad-creator');
+ assert.equal(manifest.product.slug,'cad-creator');
  assert.deepEqual(manifest.product.capability_keys,['design.read','design.write','design.export']);
  assert.equal(manifest.product.cli_commands[0].id,'agentsam:cad:project');
  assert.equal(manifest.tools.length,9);
  assert.equal(manifest.workflows.length,2);
+ assert.match(migration,/WHERE slug='cad-creator'/);
  assert.match(migration,/WHERE slug='agentsam-cad-creator'/);
+ assert.match(migration,/legacy_slug','agentsam-cad-creator/);
  assert.equal((migration.match(/'exposes_tool'/g)||[]).length,9);
  assert.equal((migration.match(/'provides_workflow'/g)||[]).length,2);
  assert.equal((migration.match(/'exposes_command'/g)||[]).length,1);

package/test/integration/cms-app-scaffold.test.mjs

@@ -0,0 +1,77 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const cmsBin = path.join(root, 'apps/client-cms-editor/bin/agentsam-cms.mjs');
+
+function scaffold(persistence, extraArgs = []) {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cms-scaffold-'));
+  const target = path.join(temp, 'editor');
+  execFileSync(process.execPath, [
+    cmsBin,
+    'scaffold',
+    target,
+    '--persistence',
+    persistence,
+    ...extraArgs,
+  ], { cwd: root, stdio: 'pipe' });
+  return { temp, target };
+}
+
+test('CMS editor scaffold is self-contained and records SQLite authority', () => {
+  const { temp, target } = scaffold('sqlite');
+  try {
+    assert.equal(fs.existsSync(path.join(target, 'agentsam.app.json')), true);
+    assert.equal(fs.existsSync(path.join(target, 'cms.config.json')), true);
+    assert.equal(fs.existsSync(path.join(target, '.agentsam/cms.sqlite')), true);
+    assert.equal(fs.existsSync(path.join(target, '.agentsam/assets')), true);
+    assert.equal(fs.existsSync(path.join(target, 'public')), true);
+
+    const cfg = JSON.parse(fs.readFileSync(path.join(target, 'cms.config.json'), 'utf8'));
+    assert.equal(cfg.schema, 'agentsam.cms.project.v1');
+    assert.equal(cfg.persistence, 'sqlite');
+    assert.equal(cfg.dbPath, '.agentsam/cms.sqlite');
+    assert.equal(cfg.cmsBase, '/cms');
+    assert.equal(cfg.auth?.mode, 'local-dev-principal');
+
+    const app = JSON.parse(fs.readFileSync(path.join(target, 'agentsam.app.json'), 'utf8'));
+    assert.equal(app.schema, 'agentsam.app.v1');
+    assert.equal(app.product_id, 'cms');
+    assert.equal(app.package, '@inneranimalmedia/client-cms-editor');
+
+    // Lean project shell — no monorepo package vendoring / file: escapes.
+    assert.equal(fs.existsSync(path.join(target, 'packages')), false);
+    assert.equal(fs.existsSync(path.join(target, 'frontend/package.json')), false);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test('CMS editor rejects localStorage as persistence authority', () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cms-scaffold-'));
+  const target = path.join(temp, 'editor');
+  try {
+    assert.throws(
+      () => execFileSync(process.execPath, [
+        cmsBin,
+        'scaffold',
+        target,
+        '--persistence',
+        'localStorage',
+      ], { cwd: root, stdio: 'pipe', encoding: 'utf8' }),
+      (error) => {
+        const message = String(error?.stderr || error?.message || error);
+        return /unsupported persistence "localStorage"/i.test(message)
+          && /choose sqlite or d1/i.test(message);
+      },
+    );
+    assert.equal(fs.existsSync(target), false);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});

package/test/integration/cms-site-tenancy-contract.test.mjs

@@ -88,30 +88,41 @@ test('CMS D1 queries all enforce project-scoped tenancy without cross-tenant lea
   }
 });
 
-test('Local Studio package.json explicitly declares client-cms-editor dependencies', () => {
+test('Local Studio declares portable registry versions for client-cms-editor dependencies', () => {
   const pkgPath = at('apps', 'local-studio', 'frontend', 'package.json');
   const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-
-  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-frontend'], 'missing @inneranimalmedia/agentsam-cms-frontend');
-  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-backend'], 'missing @inneranimalmedia/agentsam-cms-backend');
-  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-shared'], 'missing @inneranimalmedia/agentsam-cms-shared');
-
-  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-frontend'], 'file:../../client-cms-editor/frontend');
-  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-backend'], 'file:../../client-cms-editor/backend');
-  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-shared'], 'file:../../client-cms-editor/shared/cms');
+  const rootPkg = JSON.parse(fs.readFileSync(at('package.json'), 'utf8'));
+
+  for (const name of [
+    '@inneranimalmedia/agentsam-cms-frontend',
+    '@inneranimalmedia/agentsam-cms-backend',
+    '@inneranimalmedia/agentsam-cms-shared',
+  ]) {
+    const declared = pkg.dependencies[name];
+    assert.ok(declared, 'missing ' + name);
+    assert.equal(declared, rootPkg.version, name + ' must track the lockstep SDK release');
+    assert.doesNotMatch(declared, /^(?:file:|link:|workspace:)/, name + ' must install from the registry');
+  }
 });
 
 test('Local Studio mounts CMS route with default site agentsam-sdk', () => {
-  assert.ok(fs.existsSync(at('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx')));
-  const routeContent = read('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx');
-
-  // Must default to agentsam-sdk
-  assert.match(routeContent, /"agentsam-sdk"/);
+  const liveRoute = at('apps', 'local-studio', 'frontend', 'src', 'routes', '(apps)', 'cms.tsx');
+  assert.ok(fs.existsSync(liveRoute), 'live CMS route must be routes/(apps)/cms.tsx');
+  const routeContent = read('apps', 'local-studio', 'frontend', 'src', 'routes', '(apps)', 'cms.tsx');
+
+  // Superseded donor must stay inert — do not revive obsolete _app/cms.tsx contracts.
+  const donor = read('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx');
+  assert.match(donor, /SUPERSEDED/);
+  assert.doesNotMatch(donor, /from ["']@inneranimalmedia\/agentsam-cms-frontend["']/);
+  assert.doesNotMatch(donor, /createFileRoute\(/);
+  assert.match(donor, /export\s*\{\s*\}\s*;/);
+
+  // Live route defaults to agentsam-sdk and uses HttpCmsAdapter + site catalog.
+  assert.match(routeContent, /createHttpCmsAdapter/);
+  assert.match(routeContent, /slug:\s*"agentsam-sdk"/);
+  assert.match(routeContent, /search\.site \|\| search\.project_slug \|\| search\.project \|\| "agentsam-sdk"/);
   assert.doesNotMatch(routeContent, /default\s*:\s*["']inneranimalmedia["']/);
 
-  // Must use same-origin relative basePath
-  assert.match(routeContent, /basePath="\/cms"/);
-
   // NavRail must include CMS entry
   const navRail = read('apps', 'local-studio', 'frontend', 'src', 'components', 'shell', 'nav-rail.tsx');
   assert.match(navRail, /to:\s*"\/cms"/);
@@ -124,8 +135,9 @@ test('Local Studio Worker dispatches /api/cms/* with strict tenant isolation', (
   assert.match(workerContent, /handleCmsWorkerRequest/);
 
   const cmsService = read('apps', 'local-studio', 'backend', 'worker', 'cms-service.js');
-  // Default fallback must be agentsam-sdk, never inneranimalmedia
-  assert.match(cmsService, /'agentsam-sdk'/);
+  // Worker requests must name their tenant explicitly; the UI may choose its own default.
+  assert.match(cmsService, /site_slug_required/);
+  assert.doesNotMatch(cmsService, /['"]agentsam-sdk['"]/);
   assert.match(cmsService, /createCmsDbClient\(env\.DB,\s*siteSlug\)/);
 });
 

package/test/integration/codebaseindex-ingest.test.mjs

@@ -15,6 +15,7 @@ import { ensureSeedOperations, getSamOperation, AgentSamClient } from '../../src
 import { getSkill, loadSkill } from '../../src/skills/index.js';
 import { resolveHelpTopic, renderHelpOverview } from '../../src/ui/cli/help.js';
 import { runCodebaseindexIngest } from '../../src/commands/codebaseindex.js';
+import { buildInventory } from '../../src/indexing/ingest/inventory.js';
 
 describe('CLI command catalog assist', () => {
   it('maps ingest alias to codebaseindex with skill tip', () => {
@@ -149,6 +150,47 @@ describe('codebaseindex real execution', () => {
     );
     assert.ok(result.search_smoke.sources_included >= 1);
   });
+  it('executes a declared Vectorize lane through the Worker binding before publish', async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-codebaseindex-vectorize-'));
+    fs.mkdirSync(path.join(root, 'src'), { recursive: true });
+    fs.writeFileSync(path.join(root, 'src', 'demo.js'), 'export const vectorized = true;\n');
+    fs.writeFileSync(path.join(root, 'wrangler.toml'), [
+      'name = \"customer-worker\"',
+      '[[vectorize]]',
+      'binding = \"MY_VECTORS\"',
+      'index_name = \"customer-code-index\"',
+      '',
+    ].join('\n'));
+    const upserts = [];
+    const workerBinding = {
+      async upsert(records) { upserts.push(records); return { mutationId: 'fixture' }; },
+      async query() { return { matches: [] }; },
+      async getByIds(ids) { return ids.map(id => ({ id })); },
+      async deleteByIds() { return { mutationId: 'fixture-delete' }; },
+    };
+
+    const result = await runCodebaseindexIngest({
+      root,
+      include: ['src'],
+      exclude: [],
+      embeddingChoice: 'fixture|deterministic|3',
+      embed: true,
+      vectors: 'vectorize',
+      workerBinding,
+      planOnly: false,
+    });
+
+    assert.equal(result.index.published, true);
+    assert.equal(result.index.vector_upsert?.transport, 'worker_binding');
+    assert.equal(result.storage_lanes.vectors, 'vectorize');
+    assert.equal(upserts.length, 1);
+    assert.ok(upserts[0].length >= 1);
+    assert.equal(upserts[0][0].values.length, 3);
+    const config = JSON.parse(fs.readFileSync(path.join(root, '.agentsam', 'knowledge.json'), 'utf8'));
+    assert.equal(config.lane.backend, 'cloudflare_vectorize');
+    assert.equal(config.lane.binding, 'MY_VECTORS');
+    assert.equal(config.lane.index, 'customer-code-index');
+  });
 });
 
 describe('catalog-driven help', () => {
@@ -164,3 +206,50 @@ describe('catalog-driven help', () => {
     assert.match(text, /command catalog/i);
   });
 });
+
+describe('Cargo workspace inventory', () => {
+  it('treats workspace members as source and keeps generated/operational state out of the starting scope', () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cargo-workspace-'));
+    try {
+      fs.writeFileSync(path.join(root, 'Cargo.toml'), `[workspace]
+members = [
+  "core",
+  "worker",
+]
+resolver = "2"
+`);
+      for (const crate of ['core', 'worker']) {
+        fs.mkdirSync(path.join(root, crate, 'src'), { recursive: true });
+        fs.writeFileSync(path.join(root, crate, 'Cargo.toml'), `[package]
+name = "${crate}"
+version = "0.1.0"
+edition = "2024"
+`);
+        fs.writeFileSync(path.join(root, crate, 'src', 'lib.rs'), `pub fn ${crate}_value() -> u32 { 1 }
+`);
+      }
+      fs.mkdirSync(path.join(root, 'docs'), { recursive: true });
+      fs.writeFileSync(path.join(root, 'docs', 'README.md'), '# docs\n');
+      fs.mkdirSync(path.join(root, 'target'), { recursive: true });
+      fs.writeFileSync(path.join(root, 'target', 'build.txt'), 'generated\n');
+      fs.mkdirSync(path.join(root, '.agentsam', 'machine'), { recursive: true });
+      fs.writeFileSync(path.join(root, '.agentsam', 'machine', 'state.sqlite'), '');
+
+      const inventory = buildInventory({ root });
+      assert.deepEqual(inventory.cargo_workspace_roots, ['core', 'worker']);
+      assert.ok(inventory.categories.source.includes('core'));
+      assert.ok(inventory.categories.source.includes('worker'));
+      assert.ok(inventory.categories.docs.includes('docs'));
+      assert.ok(inventory.categories.dependencies.includes('target'));
+      assert.ok(inventory.categories.operational.includes('.agentsam'));
+
+      assert.ok(inventory.suggested.include.includes('core'));
+      assert.ok(inventory.suggested.include.includes('worker'));
+      assert.ok(inventory.suggested.include.includes('docs'));
+      assert.ok(inventory.suggested.exclude.includes('target'));
+      assert.ok(inventory.suggested.exclude.includes('.agentsam'));
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+});

package/test/integration/database-hosted-honesty.test.mjs

@@ -0,0 +1,49 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+
+test("listSources prefers oauth catalog and annotates deployment bindings", () => {
+  const src = readFileSync(
+    path.join(root, "apps/local-studio/backend/worker/database-service.js"),
+    "utf8",
+  );
+  assert.match(src, /source_kind: 'oauth_resource'/);
+  assert.match(src, /source_kind: 'deployment_binding'/);
+  assert.match(src, /owner_scope: 'deployment'/);
+  assert.match(src, /\.\.\.oauthD1,\s*\n\s*\.\.\.deploymentSources/s);
+  assert.match(src, /isOpaqueBindingDatabaseId/);
+  assert.match(src, /Never treat env\.DB as a generic user's Cloudflare catalog/);
+});
+
+test("local sqlite bridge hard-fails on hosted Worker runtime", () => {
+  const src = readFileSync(
+    path.join(root, "apps/local-studio/frontend/src/routes/api/database.local.bridge.ts"),
+    "utf8",
+  );
+  assert.match(src, /requires_local_runtime/);
+  assert.match(src, /isHostedWorkerRuntime/);
+  assert.match(src, /WebSocketPair/);
+  assert.match(src, /status: 501/);
+});
+
+test("database editor preserves null metrics and uses host font tokens", () => {
+  const app = readFileSync(
+    path.join(root, "packages/agentsam-database-editor/src/ui/DatabaseEditorApp.tsx"),
+    "utf8",
+  );
+  const css = readFileSync(
+    path.join(root, "packages/agentsam-database-editor/src/ui/database-editor.css"),
+    "utf8",
+  );
+  assert.doesNotMatch(app, /Number\(point\.queries \|\| 0\)/);
+  assert.match(app, /numOrNull/);
+  assert.match(app, /data-metrics-wired/);
+  assert.match(css, /var\(--font-sans/);
+  assert.match(css, /var\(--font-mono/);
+  assert.match(css, /data-provider="cloudflare"/);
+  assert.match(css, /data-provider="supabase"/);
+});

package/test/integration/desktop-keychain-boundary.test.mjs

@@ -0,0 +1,45 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+
+const main = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/main.rs', import.meta.url), 'utf8');
+const keychain = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/commands/keychain.rs', import.meta.url), 'utf8');
+const tauriClient = readFileSync(new URL('../../apps/local-studio/frontend/src/lib/desktop/tauri.ts', import.meta.url), 'utf8');
+const identityBridge = readFileSync(new URL('../../packages/identity/src/frontend/auth-portal/shared/desktop-identity-bridge.js', import.meta.url), 'utf8');
+const localIdentity = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/commands/local_identity.rs', import.meta.url), 'utf8');
+const googleIdentity = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/commands/google_desktop_identity.rs', import.meta.url), 'utf8');
+
+test('desktop webview cannot invoke a generic secure-store read', () => {
+  for (const forbidden of [
+    'keychain::get_token',
+    'keychain::secure_store_get',
+    '"secure_store_get"',
+  ]) {
+    assert.equal(main.includes(forbidden), false, `main.rs must not register ${forbidden}`);
+    assert.equal(tauriClient.includes(forbidden), false, `frontend must not invoke ${forbidden}`);
+    assert.equal(identityBridge.includes(forbidden), false, `desktop identity bridge must not invoke ${forbidden}`);
+  }
+});
+
+test('provider key command surface never exposes get', () => {
+  assert.match(main, /keychain::provider_key_exists/);
+  assert.match(main, /keychain::provider_key_set/);
+  assert.match(main, /keychain::provider_key_delete/);
+  assert.doesNotMatch(main, /keychain::provider_key_get/);
+  assert.match(keychain, /pub\(crate\) fn provider_key_get_internal/);
+  assert.doesNotMatch(keychain, /#\[tauri::command\]\s*\npub\(crate\) fn provider_key_get_internal/);
+});
+
+test('keychain app namespace is derived natively', () => {
+  assert.match(keychain, /const KEYCHAIN_APP_ID: &str = "local-studio"/);
+  assert.doesNotMatch(keychain, /pub fn .*\(app_id:/);
+});
+
+test('desktop bearer sessions stay behind Rust', () => {
+  assert.doesNotMatch(tauriClient, /identity_store_get|identity_store_set|identity_store_delete/);
+  assert.doesNotMatch(identityBridge, /identity_store_get|identity_store_set|identity_store_delete/);
+  assert.match(localIdentity, /identity_session_get_internal/);
+  assert.match(localIdentity, /identity_session_set_internal/);
+  assert.match(googleIdentity, /#\[serde\(skip_serializing\)\]\s*pub session_id/);
+  assert.match(googleIdentity, /identity_session_set_internal/);
+});

package/test/integration/features-resolve.test.mjs

@@ -44,9 +44,11 @@ test('auth feature resolves real D1 resources, not a pretend iam-d1 profile', ()
   assert.deepEqual(resolved.resources.migration_sources, [
     'src/migrations/0001_identity_core.sql',
     'src/migrations/0002_company.sql',
+    'src/migrations/0003_accounts_ssot.sql',
   ]);
   const names = resolved.resources.tables.map((t) => t.name);
   assert.deepEqual(names, [
+    'accounts',
     'auth_users',
     'auth_sessions',
     'account_identities',
@@ -54,7 +56,7 @@ test('auth feature resolves real D1 resources, not a pretend iam-d1 profile', ()
     'password_reset_tokens',
     'company',
   ]);
-  assert.match(formatResourcesSummary(resolved.resources), /tables=auth_users,/);
+  assert.match(formatResourcesSummary(resolved.resources), /tables=accounts,auth_users,/);
   assert.doesNotMatch(formatResourcesSummary(resolved.resources), /iam-d1/);
 });
 
@@ -82,6 +84,7 @@ test('resources.json indexes D1 tables without owning DDL', () => {
   assert.deepEqual(resources.migration_sources, [
     'src/migrations/0001_identity_core.sql',
     'src/migrations/0002_company.sql',
+    'src/migrations/0003_accounts_ssot.sql',
   ]);
   const names = resources.tables.map((t) => t.name);
   assert.ok(names.includes('auth_users'));
@@ -115,14 +118,30 @@ test('writeFeatureSelections emits schema_version 2 and resolved snapshot', () =
   }
 });
 
-test('sdk project selections resolve against package packet', () => {
-  const { snapshot } = writeFeaturesResolved(SDK_ROOT);
-  assert.equal(snapshot.schema, 'agentsam.features.resolved.v1');
-  assert.equal(snapshot.features.auth.provider_template, 'inneranimalmedia');
-  assert.equal(snapshot.features.auth.feature.id, 'identity.oauth-login-portal');
-  assert.equal(snapshot.features.auth.resources.engine, 'd1');
-  assert.match(
-    formatResourcesSummary(snapshot.features.auth.resources),
-    /auth_users,auth_sessions,account_identities/,
-  );
+test('sdk-style project selections resolve against package packet without local machine state', () => {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-sdk-feature-select-'));
+  try {
+    const { snapshot } = writeFeaturesResolved(cwd, null, {
+      selections: {
+        schema_version: 2,
+        features: {
+          auth: {
+            selected: true,
+            capabilities: ['identity.init'],
+            provider_template: 'inneranimalmedia',
+          },
+        },
+      },
+    });
+    assert.equal(snapshot.schema, 'agentsam.features.resolved.v1');
+    assert.equal(snapshot.features.auth.provider_template, 'inneranimalmedia');
+    assert.equal(snapshot.features.auth.feature.id, 'identity.oauth-login-portal');
+    assert.equal(snapshot.features.auth.resources.engine, 'd1');
+    assert.match(
+      formatResourcesSummary(snapshot.features.auth.resources),
+      /auth_users,auth_sessions,account_identities/,
+    );
+  } finally {
+    fs.rmSync(cwd, { recursive: true, force: true });
+  }
 });