@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.7

package/test/cli/machine-command.test.mjs

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getCliCommand } from '../../src/cli/command-catalog.js';
+import { resolveMachineBinary } from '../../src/commands/machine-binary.js';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+
+test('machine command is catalogued as machine.inspect', () => {
+  const entry = getCliCommand('machine');
+  assert.equal(entry?.id, 'machine');
+  assert.equal(entry?.operation, 'machine.inspect');
+  assert.equal(entry?.common, true);
+});
+
+test('machine crate + CLI sources exist for graduation', () => {
+  assert.equal(fs.existsSync(path.join(root, 'native/agentsam-machine/Cargo.toml')), true);
+  assert.equal(fs.existsSync(path.join(root, 'native/agentsam-machine/cli/src/main.rs')), true);
+  assert.equal(fs.existsSync(path.join(root, 'src/commands/machine.js')), true);
+  assert.equal(fs.existsSync(path.join(root, 'src/commands/machine-binary.js')), true);
+});
+
+test('resolveMachineBinary finds crate binary or cargo fallback in this repo', () => {
+  const resolution = resolveMachineBinary();
+  assert.notEqual(resolution.kind, 'missing');
+  if (resolution.kind === 'binary') {
+    assert.equal(fs.existsSync(resolution.path), true);
+  } else {
+    assert.equal(resolution.kind, 'cargo');
+    assert.equal(fs.existsSync(resolution.manifest), true);
+  }
+});

package/test/fixtures/project-authority/customer-app/.agentsam/app.json

@@ -0,0 +1,5 @@
+{
+  "schema": "agentsam.app-install.v1",
+  "app_id": "my-product",
+  "mount": "apps/my-product"
+}

package/test/fixtures/project-authority/customer-app/apps/my-product/index.ts

@@ -0,0 +1 @@
+export const productName = 'Generic Customer Product';

package/test/fixtures/project-authority/customer-app/wrangler.toml

@@ -0,0 +1,17 @@
+name = "customer-product-worker"
+
+[ai]
+binding = "MY_AI"
+
+[[vectorize]]
+binding = "MY_VECTORS"
+index_name = "customer-code-index"
+
+[[d1_databases]]
+binding = "DB"
+database_name = "customer-db"
+database_id = "00000000-0000-0000-0000-000000000001"
+
+[[r2_buckets]]
+binding = "CONTENT"
+bucket_name = "customer-assets"

package/test/integration/autorag-project-authority.integration.test.mjs

@@ -0,0 +1,51 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = fileURLToPath(new URL('../..', import.meta.url));
+const bin = path.join(repoRoot, 'bin', 'agentsam');
+const fixture = path.join(repoRoot, 'test', 'fixtures', 'project-authority', 'customer-app');
+
+function runAutorag(root, ...args) {
+  const stdout = execFileSync(process.execPath, [bin, 'autorag', ...args, '--cwd', root], {
+    cwd: root,
+    encoding: 'utf8',
+    env: { ...process.env, CLOUDFLARE_API_TOKEN: '', CLOUDFLARE_ACCOUNT_ID: '' },
+  });
+  return JSON.parse(stdout);
+}
+
+test('generic customer fixture discovers existing project resources and adopts Vectorize', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-project-authority-fixture-'));
+  try {
+    fs.cpSync(fixture, root, { recursive: true });
+    const status = runAutorag(root, 'status');
+    assert.deepEqual(status.discovery.scopes, ['apps']);
+    assert.equal(status.project_context.schema, 'agentsam.project-context.v1');
+    assert.equal(status.project_context.project.host_install.app_id, 'my-product');
+    assert.equal(status.project_context.resources.workers_ai.binding, 'MY_AI');
+    assert.equal(status.project_context.resources.vectorize[0].binding, 'MY_VECTORS');
+    assert.equal(status.project_context.resources.vectorize[0].index, 'customer-code-index');
+    assert.equal(status.project_context.resources.d1[0].binding, 'DB');
+    assert.equal(status.project_context.resources.r2[0].binding, 'CONTENT');
+    assert.equal(status.project_context.resources.vectorize[0].locally_executable, false);
+    assert.equal(status.project_context.resources.vectorize[0].remotely_executable, true);
+
+    const setup = runAutorag(root, 'setup', '--yes');
+    assert.deepEqual(setup.recommendation.scope, ['apps']);
+    assert.equal(setup.config.lane.backend, 'cloudflare_vectorize');
+    assert.equal(setup.config.lane.binding, 'MY_VECTORS');
+    assert.equal(setup.config.lane.index, 'customer-code-index');
+    assert.equal(setup.config.embedding.provider, 'none');
+
+    const policy = JSON.parse(fs.readFileSync(path.join(root, '.agentsam', 'knowledge.json'), 'utf8'));
+    assert.equal(policy.lane.binding, 'MY_VECTORS');
+    assert.equal(policy.lane.index, 'customer-code-index');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

package/test/integration/autorag-runtime-discovery.test.mjs

@@ -0,0 +1,107 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { discoverKnowledgeRuntime } from '../../src/knowledge/runtime-discovery.js';
+
+test('AutoRAG runtime discovery sees local index and Cloudflare Vectorize without local knowledge config', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-autorag-runtime-'));
+  try {
+    fs.mkdirSync(path.join(root, '.agentsam', 'knowledge'), { recursive: true });
+    fs.writeFileSync(path.join(root, '.agentsam', 'knowledge', 'index.sqlite'), '');
+    fs.writeFileSync(
+      path.join(root, 'wrangler.toml'),
+      [
+        'name = "demo-worker"',
+        '',
+        '[ai]',
+        'binding = "AGENTSAM_WAI"',
+        '',
+        '[[vectorize]]',
+        'binding = "DEMO_VECTORIZE"',
+        'index_name = "demo-index-1024"',
+        '',
+      ].join('\n'),
+    );
+
+    const runtime = discoverKnowledgeRuntime(root);
+    assert.equal(runtime.local_index.exists, true);
+    assert.equal(runtime.cloudflare.configured, true);
+    assert.equal(runtime.cloudflare.worker_name, 'demo-worker');
+    assert.equal(runtime.cloudflare.ai_binding, 'AGENTSAM_WAI');
+    assert.deepEqual(runtime.cloudflare.vectorize, [{
+      binding: 'DEMO_VECTORIZE',
+      index: 'demo-index-1024',
+      source: 'wrangler_config',
+    }]);
+    assert.deepEqual(runtime.lanes.map((lane) => lane.backend), [
+      'local_exact',
+      'cloudflare_vectorize',
+    ]);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('project context receipt separates observed deployment resources from local executability', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-project-context-'));
+  try {
+    fs.mkdirSync(path.join(root, '.agentsam'), { recursive: true });
+    fs.writeFileSync(path.join(root, '.agentsam', 'app.json'), JSON.stringify({ schema: 'agentsam.app-install.v1', app_id: 'my-product' }));
+    fs.writeFileSync(path.join(root, 'wrangler.toml'), [
+      'name = "customer-worker"',
+      '[ai]',
+      'binding = "MY_AI"',
+      '[[vectorize]]',
+      'binding = "MY_VECTORS"',
+      'index_name = "customer-code-index"',
+      '[[d1_databases]]',
+      'binding = "DB"',
+      'database_name = "customer-db"',
+      'database_id = "00000000-0000-0000-0000-000000000001"',
+      '[[r2_buckets]]',
+      'binding = "CONTENT"',
+      'bucket_name = "customer-assets"',
+      '',
+    ].join('\n'));
+
+    const runtime = discoverKnowledgeRuntime(root, { env: {} });
+    assert.equal(runtime.schema, 'agentsam.project-context.v1');
+    assert.equal(runtime.project.host_install.app_id, 'my-product');
+    assert.equal(runtime.resources.workers_ai.binding, 'MY_AI');
+    assert.equal(runtime.resources.workers_ai.locally_executable, false);
+    assert.equal(runtime.resources.workers_ai.remotely_executable, true);
+    assert.equal(runtime.resources.vectorize[0].binding, 'MY_VECTORS');
+    assert.equal(runtime.resources.vectorize[0].index, 'customer-code-index');
+    assert.equal(runtime.resources.vectorize[0].locally_executable, false);
+    assert.equal(runtime.resources.vectorize[0].remotely_executable, true);
+    assert.equal(runtime.resources.d1[0].binding, 'DB');
+    assert.equal(runtime.resources.r2[0].binding, 'CONTENT');
+    assert.equal(runtime.knowledge.policy_configured, false);
+    assert.equal(runtime.knowledge.suggested_backend, 'cloudflare_vectorize');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('project context receipt surfaces knowledge policy versus Wrangler drift', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-project-context-drift-'));
+  try {
+    fs.writeFileSync(path.join(root, 'wrangler.toml'), [
+      'name = "customer-worker"',
+      '[[vectorize]]',
+      'binding = "MY_VECTORS"',
+      'index_name = "customer-code-index"',
+      '',
+    ].join('\n'));
+    const runtime = discoverKnowledgeRuntime(root, {
+      env: {},
+      knowledgeConfig: { lane: { backend: 'cloudflare_vectorize', binding: 'OTHER_VECTORS', index: 'other-index' } },
+    });
+    assert.equal(runtime.conflicts.length, 1);
+    assert.equal(runtime.conflicts[0].kind, 'knowledge_deployment_drift');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

package/test/integration/cms-app-scaffold.test.mjs

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 const cmsBin = path.join(root, 'apps/client-cms-editor/bin/agentsam-cms.mjs');
 
-function scaffold(persistence) {
+function scaffold(persistence, extraArgs = []) {
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cms-scaffold-'));
   const target = path.join(temp, 'editor');
   execFileSync(process.execPath, [
@@ -18,6 +18,7 @@ function scaffold(persistence) {
     target,
     '--persistence',
     persistence,
+    ...extraArgs,
   ], { cwd: root, stdio: 'pipe' });
   return { temp, target };
 }
@@ -25,46 +26,51 @@ function scaffold(persistence) {
 test('CMS editor scaffold is self-contained and records SQLite authority', () => {
   const { temp, target } = scaffold('sqlite');
   try {
-    assert.equal(fs.existsSync(path.join(target, 'bin/agentsam-cms.mjs')), true);
     assert.equal(fs.existsSync(path.join(target, 'agentsam.app.json')), true);
-    assert.equal(fs.existsSync(path.join(target, 'packages/agentsam-contracts/package.json')), true);
-    assert.equal(fs.existsSync(path.join(target, 'packages/agentsam-workbench/package.json')), true);
+    assert.equal(fs.existsSync(path.join(target, 'cms.config.json')), true);
+    assert.equal(fs.existsSync(path.join(target, '.agentsam/cms.sqlite')), true);
+    assert.equal(fs.existsSync(path.join(target, '.agentsam/assets')), true);
+    assert.equal(fs.existsSync(path.join(target, 'public')), true);
 
-    const rootPkg = JSON.parse(fs.readFileSync(path.join(target, 'package.json'), 'utf8'));
-    assert.ok(rootPkg.workspaces.includes('packages/*'));
+    const cfg = JSON.parse(fs.readFileSync(path.join(target, 'cms.config.json'), 'utf8'));
+    assert.equal(cfg.schema, 'agentsam.cms.project.v1');
+    assert.equal(cfg.persistence, 'sqlite');
+    assert.equal(cfg.dbPath, '.agentsam/cms.sqlite');
+    assert.equal(cfg.cmsBase, '/cms');
+    assert.equal(cfg.auth?.mode, 'local-dev-principal');
 
-    const frontendPkg = JSON.parse(fs.readFileSync(path.join(target, 'frontend/package.json'), 'utf8'));
-    assert.equal(frontendPkg.dependencies['@inneranimalmedia/agentsam-contracts'], '0.1.0');
-    assert.equal(frontendPkg.dependencies['@inneranimalmedia/agentsam-workbench'], '0.1.0');
+    const app = JSON.parse(fs.readFileSync(path.join(target, 'agentsam.app.json'), 'utf8'));
+    assert.equal(app.schema, 'agentsam.app.v1');
+    assert.equal(app.product_id, 'cms');
+    assert.equal(app.package, '@inneranimalmedia/client-cms-editor');
 
-    const sharedPkg = JSON.parse(fs.readFileSync(path.join(target, 'shared/cms/package.json'), 'utf8'));
-    assert.equal(sharedPkg.dependencies['@inneranimalmedia/agentsam-contracts'], '0.1.0');
-
-    const escaped = [
-      ...Object.values(frontendPkg.dependencies || {}),
-      ...Object.values(sharedPkg.dependencies || {}),
-    ].filter((value) => String(value).startsWith('file:'));
-    assert.deepEqual(escaped, []);
-
-    const runtime = JSON.parse(fs.readFileSync(path.join(target, '.agentsam/cms-runtime.json'), 'utf8'));
-    assert.equal(runtime.schema, 'agentsam.cms.runtime.v1');
-    assert.equal(runtime.app_id, 'client-cms-editor');
-    assert.equal(runtime.authority, 'sqlite');
-    assert.equal(runtime.cache, 'localStorage');
-    assert.equal(runtime.cache_only, false);
+    // Lean project shell — no monorepo package vendoring / file: escapes.
+    assert.equal(fs.existsSync(path.join(target, 'packages')), false);
+    assert.equal(fs.existsSync(path.join(target, 'frontend/package.json')), false);
   } finally {
     fs.rmSync(temp, { recursive: true, force: true });
   }
 });
 
-test('CMS editor localStorage option is explicitly cache-only', () => {
-  const { temp, target } = scaffold('localStorage');
+test('CMS editor rejects localStorage as persistence authority', () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cms-scaffold-'));
+  const target = path.join(temp, 'editor');
   try {
-    const runtime = JSON.parse(fs.readFileSync(path.join(target, '.agentsam/cms-runtime.json'), 'utf8'));
-    assert.equal(runtime.authority, null);
-    assert.equal(runtime.cache, 'localStorage');
-    assert.equal(runtime.cache_only, true);
-    assert.match(runtime.note, /cache only/i);
+    assert.throws(
+      () => execFileSync(process.execPath, [
+        cmsBin,
+        'scaffold',
+        target,
+        '--persistence',
+        'localStorage',
+      ], { cwd: root, stdio: 'pipe', encoding: 'utf8' }),
+      (error) => {
+        const message = String(error?.stderr || error?.message || error);
+        return /unsupported persistence "localStorage"/i.test(message)
+          && /choose sqlite or d1/i.test(message);
+      },
+    );
+    assert.equal(fs.existsSync(target), false);
   } finally {
     fs.rmSync(temp, { recursive: true, force: true });
   }

package/test/integration/cms-site-tenancy-contract.test.mjs

@@ -88,30 +88,41 @@ test('CMS D1 queries all enforce project-scoped tenancy without cross-tenant lea
   }
 });
 
-test('Local Studio package.json explicitly declares client-cms-editor dependencies', () => {
+test('Local Studio declares portable registry versions for client-cms-editor dependencies', () => {
   const pkgPath = at('apps', 'local-studio', 'frontend', 'package.json');
   const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-
-  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-frontend'], 'missing @inneranimalmedia/agentsam-cms-frontend');
-  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-backend'], 'missing @inneranimalmedia/agentsam-cms-backend');
-  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-shared'], 'missing @inneranimalmedia/agentsam-cms-shared');
-
-  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-frontend'], 'file:../../client-cms-editor/frontend');
-  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-backend'], 'file:../../client-cms-editor/backend');
-  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-shared'], 'file:../../client-cms-editor/shared/cms');
+  const rootPkg = JSON.parse(fs.readFileSync(at('package.json'), 'utf8'));
+
+  for (const name of [
+    '@inneranimalmedia/agentsam-cms-frontend',
+    '@inneranimalmedia/agentsam-cms-backend',
+    '@inneranimalmedia/agentsam-cms-shared',
+  ]) {
+    const declared = pkg.dependencies[name];
+    assert.ok(declared, 'missing ' + name);
+    assert.equal(declared, rootPkg.version, name + ' must track the lockstep SDK release');
+    assert.doesNotMatch(declared, /^(?:file:|link:|workspace:)/, name + ' must install from the registry');
+  }
 });
 
 test('Local Studio mounts CMS route with default site agentsam-sdk', () => {
-  assert.ok(fs.existsSync(at('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx')));
-  const routeContent = read('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx');
-
-  // Must default to agentsam-sdk
-  assert.match(routeContent, /"agentsam-sdk"/);
+  const liveRoute = at('apps', 'local-studio', 'frontend', 'src', 'routes', '(apps)', 'cms.tsx');
+  assert.ok(fs.existsSync(liveRoute), 'live CMS route must be routes/(apps)/cms.tsx');
+  const routeContent = read('apps', 'local-studio', 'frontend', 'src', 'routes', '(apps)', 'cms.tsx');
+
+  // Superseded donor must stay inert — do not revive obsolete _app/cms.tsx contracts.
+  const donor = read('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx');
+  assert.match(donor, /SUPERSEDED/);
+  assert.doesNotMatch(donor, /from ["']@inneranimalmedia\/agentsam-cms-frontend["']/);
+  assert.doesNotMatch(donor, /createFileRoute\(/);
+  assert.match(donor, /export\s*\{\s*\}\s*;/);
+
+  // Live route defaults to agentsam-sdk and uses HttpCmsAdapter + site catalog.
+  assert.match(routeContent, /createHttpCmsAdapter/);
+  assert.match(routeContent, /slug:\s*"agentsam-sdk"/);
+  assert.match(routeContent, /search\.site \|\| search\.project_slug \|\| search\.project \|\| "agentsam-sdk"/);
   assert.doesNotMatch(routeContent, /default\s*:\s*["']inneranimalmedia["']/);
 
-  // Must use same-origin relative basePath
-  assert.match(routeContent, /basePath="\/cms"/);
-
   // NavRail must include CMS entry
   const navRail = read('apps', 'local-studio', 'frontend', 'src', 'components', 'shell', 'nav-rail.tsx');
   assert.match(navRail, /to:\s*"\/cms"/);

package/test/integration/codebaseindex-ingest.test.mjs

@@ -150,6 +150,47 @@ describe('codebaseindex real execution', () => {
     );
     assert.ok(result.search_smoke.sources_included >= 1);
   });
+  it('executes a declared Vectorize lane through the Worker binding before publish', async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-codebaseindex-vectorize-'));
+    fs.mkdirSync(path.join(root, 'src'), { recursive: true });
+    fs.writeFileSync(path.join(root, 'src', 'demo.js'), 'export const vectorized = true;\n');
+    fs.writeFileSync(path.join(root, 'wrangler.toml'), [
+      'name = \"customer-worker\"',
+      '[[vectorize]]',
+      'binding = \"MY_VECTORS\"',
+      'index_name = \"customer-code-index\"',
+      '',
+    ].join('\n'));
+    const upserts = [];
+    const workerBinding = {
+      async upsert(records) { upserts.push(records); return { mutationId: 'fixture' }; },
+      async query() { return { matches: [] }; },
+      async getByIds(ids) { return ids.map(id => ({ id })); },
+      async deleteByIds() { return { mutationId: 'fixture-delete' }; },
+    };
+
+    const result = await runCodebaseindexIngest({
+      root,
+      include: ['src'],
+      exclude: [],
+      embeddingChoice: 'fixture|deterministic|3',
+      embed: true,
+      vectors: 'vectorize',
+      workerBinding,
+      planOnly: false,
+    });
+
+    assert.equal(result.index.published, true);
+    assert.equal(result.index.vector_upsert?.transport, 'worker_binding');
+    assert.equal(result.storage_lanes.vectors, 'vectorize');
+    assert.equal(upserts.length, 1);
+    assert.ok(upserts[0].length >= 1);
+    assert.equal(upserts[0][0].values.length, 3);
+    const config = JSON.parse(fs.readFileSync(path.join(root, '.agentsam', 'knowledge.json'), 'utf8'));
+    assert.equal(config.lane.backend, 'cloudflare_vectorize');
+    assert.equal(config.lane.binding, 'MY_VECTORS');
+    assert.equal(config.lane.index, 'customer-code-index');
+  });
 });
 
 describe('catalog-driven help', () => {

package/test/integration/database-hosted-honesty.test.mjs

@@ -0,0 +1,49 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+
+test("listSources prefers oauth catalog and annotates deployment bindings", () => {
+  const src = readFileSync(
+    path.join(root, "apps/local-studio/backend/worker/database-service.js"),
+    "utf8",
+  );
+  assert.match(src, /source_kind: 'oauth_resource'/);
+  assert.match(src, /source_kind: 'deployment_binding'/);
+  assert.match(src, /owner_scope: 'deployment'/);
+  assert.match(src, /\.\.\.oauthD1,\s*\n\s*\.\.\.deploymentSources/s);
+  assert.match(src, /isOpaqueBindingDatabaseId/);
+  assert.match(src, /Never treat env\.DB as a generic user's Cloudflare catalog/);
+});
+
+test("local sqlite bridge hard-fails on hosted Worker runtime", () => {
+  const src = readFileSync(
+    path.join(root, "apps/local-studio/frontend/src/routes/api/database.local.bridge.ts"),
+    "utf8",
+  );
+  assert.match(src, /requires_local_runtime/);
+  assert.match(src, /isHostedWorkerRuntime/);
+  assert.match(src, /WebSocketPair/);
+  assert.match(src, /status: 501/);
+});
+
+test("database editor preserves null metrics and uses host font tokens", () => {
+  const app = readFileSync(
+    path.join(root, "packages/agentsam-database-editor/src/ui/DatabaseEditorApp.tsx"),
+    "utf8",
+  );
+  const css = readFileSync(
+    path.join(root, "packages/agentsam-database-editor/src/ui/database-editor.css"),
+    "utf8",
+  );
+  assert.doesNotMatch(app, /Number\(point\.queries \|\| 0\)/);
+  assert.match(app, /numOrNull/);
+  assert.match(app, /data-metrics-wired/);
+  assert.match(css, /var\(--font-sans/);
+  assert.match(css, /var\(--font-mono/);
+  assert.match(css, /data-provider="cloudflare"/);
+  assert.match(css, /data-provider="supabase"/);
+});

package/test/integration/desktop-keychain-boundary.test.mjs

@@ -0,0 +1,45 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+
+const main = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/main.rs', import.meta.url), 'utf8');
+const keychain = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/commands/keychain.rs', import.meta.url), 'utf8');
+const tauriClient = readFileSync(new URL('../../apps/local-studio/frontend/src/lib/desktop/tauri.ts', import.meta.url), 'utf8');
+const identityBridge = readFileSync(new URL('../../packages/identity/src/frontend/auth-portal/shared/desktop-identity-bridge.js', import.meta.url), 'utf8');
+const localIdentity = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/commands/local_identity.rs', import.meta.url), 'utf8');
+const googleIdentity = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/commands/google_desktop_identity.rs', import.meta.url), 'utf8');
+
+test('desktop webview cannot invoke a generic secure-store read', () => {
+  for (const forbidden of [
+    'keychain::get_token',
+    'keychain::secure_store_get',
+    '"secure_store_get"',
+  ]) {
+    assert.equal(main.includes(forbidden), false, `main.rs must not register ${forbidden}`);
+    assert.equal(tauriClient.includes(forbidden), false, `frontend must not invoke ${forbidden}`);
+    assert.equal(identityBridge.includes(forbidden), false, `desktop identity bridge must not invoke ${forbidden}`);
+  }
+});
+
+test('provider key command surface never exposes get', () => {
+  assert.match(main, /keychain::provider_key_exists/);
+  assert.match(main, /keychain::provider_key_set/);
+  assert.match(main, /keychain::provider_key_delete/);
+  assert.doesNotMatch(main, /keychain::provider_key_get/);
+  assert.match(keychain, /pub\(crate\) fn provider_key_get_internal/);
+  assert.doesNotMatch(keychain, /#\[tauri::command\]\s*\npub\(crate\) fn provider_key_get_internal/);
+});
+
+test('keychain app namespace is derived natively', () => {
+  assert.match(keychain, /const KEYCHAIN_APP_ID: &str = "local-studio"/);
+  assert.doesNotMatch(keychain, /pub fn .*\(app_id:/);
+});
+
+test('desktop bearer sessions stay behind Rust', () => {
+  assert.doesNotMatch(tauriClient, /identity_store_get|identity_store_set|identity_store_delete/);
+  assert.doesNotMatch(identityBridge, /identity_store_get|identity_store_set|identity_store_delete/);
+  assert.match(localIdentity, /identity_session_get_internal/);
+  assert.match(localIdentity, /identity_session_set_internal/);
+  assert.match(googleIdentity, /#\[serde\(skip_serializing\)\]\s*pub session_id/);
+  assert.match(googleIdentity, /identity_session_set_internal/);
+});

package/test/integration/hosted-work-host-authority.test.mjs

@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "../..");
+
+test("LocalStudioWorkPage defaults to HTTP WorkHost, not populated fixture", () => {
+  const source = readFileSync(
+    join(root, "apps/local-studio/frontend/src/components/work/LocalStudioWorkPage.tsx"),
+    "utf8",
+  );
+  assert.match(source, /createHttpWorkHost/);
+  assert.match(source, /resolveWorkHostMode/);
+  assert.match(source, /VITE_WORK_FIXTURE/);
+  // Fixture must be opt-in only
+  assert.match(source, /fixture === "populated"/);
+  assert.doesNotMatch(
+    source,
+    /createFixtureWorkHost\(populatedWorkFixture\)\s*,\s*\[\s*\]/,
+  );
+});
+
+test("agentsam-work theme does not hardcode Inter", () => {
+  const css = readFileSync(
+    join(root, "packages/agentsam-work/src/frontend/theme.css"),
+    "utf8",
+  );
+  assert.doesNotMatch(css, /font-family:\s*Inter/);
+  assert.match(css, /--font-sans/);
+});
+
+test("worker mounts /api/work/snapshot", () => {
+  const index = readFileSync(
+    join(root, "apps/local-studio/backend/worker/index.js"),
+    "utf8",
+  );
+  const service = readFileSync(
+    join(root, "apps/local-studio/backend/worker/work-service.js"),
+    "utf8",
+  );
+  assert.match(index, /handleWorkRequest/);
+  assert.match(service, /\/api\/work\/snapshot/);
+  assert.match(service, /fixtureName: 'live'/);
+  assert.doesNotMatch(service, /Companions of CPAS|AgentSamRemix|runtime-receipts\.md/);
+});

package/test/integration/inventory-eligibility.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { discoverOpenAIModels, discoverGeminiModels, discoverCursorModels } from '../../src/models/discovery.js';
+import { sanitizeInventoryForClient } from '../../src/models/inventory-core.js';
+
+function json(body) {
+  return new Response(JSON.stringify(body), { status: 200, headers: { 'content-type': 'application/json' } });
+}
+
+function sanitized(models) {
+  return sanitizeInventoryForClient({
+    providers: [],
+    discovery: {},
+    availableModels: models,
+  }).availableModels;
+}
+
+test('known OpenAI Responses reference is selectable while unknown live models stay visible', async () => {
+  const result = await discoverOpenAIModels('user-key', async () => json({
+    data: [{ id: 'gpt-5.6-sol' }, { id: 'brand-new-unclassified-model' }],
+  }));
+  const rows = sanitized(result.models);
+  assert.equal(rows.length, 2);
+  assert.equal(rows.find((row) => row.model_id === 'gpt-5.6-sol')?.chat_eligible, true);
+  const unknown = rows.find((row) => row.model_id === 'brand-new-unclassified-model');
+  assert.equal(unknown?.chat_eligible, false);
+  assert.equal(unknown?.eligibility_reason, 'capability_unknown');
+});
+
+test('Cursor inventory is preserved but reports adapter unavailability', async () => {
+  const result = await discoverCursorModels('cursor-key', async () => json({
+    items: [{ id: 'gpt-5.6-sol', displayName: 'GPT-5.6 Sol', parameters: [] }],
+  }));
+  const [row] = sanitized(result.models);
+  assert.equal(row.provider, 'cursor');
+  assert.equal(row.model_id, 'gpt-5.6-sol');
+  assert.equal(row.chat_eligible, false);
+  assert.equal(row.eligibility_reason, 'provider_adapter_unavailable');
+});
+
+test('Gemini provider description keeps TTS visible outside the chat picker', async () => {
+  const result = await discoverGeminiModels('gemini-key', async () => json({
+    models: [{
+      name: 'models/gemini-tts-fixture',
+      baseModelId: 'gemini-tts-fixture',
+      displayName: 'Voice fixture',
+      description: 'Preview Text-to-Speech model',
+      supportedGenerationMethods: ['generateContent'],
+      inputTokenLimit: 8192,
+      outputTokenLimit: 8192,
+    }],
+  }));
+  const [row] = sanitized(result.models);
+  assert.equal(row.model_id, 'gemini-tts-fixture');
+  assert.equal(row.chat_eligible, false);
+  assert.equal(row.eligibility_reason, 'specialized_output_model');
+  assert.equal(row.eligibility_source, 'provider_api');
+});