@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.8

package/test/cli/runtime-ui.test.mjs

@@ -1,141 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { createInlineActivity, INTERRUPT_HINT, renderShimmer } from '../../src/ui/cli/activity.js';
-import { renderCliFooter, renderDiffPreview } from '../../src/ui/cli/footer.js';
-import { createCliRuntimePresenter, normalizeRuntimeEventEnvelope, RUNTIME_EVENT_ENVELOPE_SCHEMA } from '../../src/ui/cli/runtime-events.js';
-import { renderWaitingInput } from '../../src/ui/cli/waiting.js';
-
-const stripAnsi = (text) => String(text || '').replace(/\x1B\[[0-9;]*[a-zA-Z]/g, '');
-
-test('CLI footer reports unknown context honestly', () => {
-  const text = renderCliFooter({
-    model: 'claude-test',
-    usageSnapshot: {
-      current_context: { input_tokens: 1234, window_tokens: 0 },
-      cumulative: { input_tokens: 5000, output_tokens: 600, cached_input_tokens: 2000 },
-    },
-  });
-  assert.match(text, /claude-test/);
-  assert.match(text, /ctx 1\.2k \/ unknown/);
-  assert.match(text, /↑5k ↓600/);
-  assert.match(text, /cache 2k/);
-});
-
-test('CLI footer shows project identity, branch, and shortcut hints', () => {
-  const text = stripAnsi(renderCliFooter({
-    project: 'agentsam-sdk',
-    cwd: '/Users/sam/agentsam-sdk',
-    branch: 'feat/cli-interactive-presence',
-    model: 'claude-test',
-  }));
-  assert.match(text, /agentsam-sdk/);
-  assert.match(text, /feat\/cli-interactive-presence/);
-  assert.match(text, /ctrl-c to cancel/);
-  assert.match(text, /\/ commands/);
-});
-
-test('diff preview colors hunks and keeps NO_COLOR output readable', () => {
-  const diff = [
-    'diff --git a/src/ui/cli/footer.js b/src/ui/cli/footer.js',
-    '--- a/src/ui/cli/footer.js',
-    '+++ b/src/ui/cli/footer.js',
-    '@@ -1,3 +1,4 @@',
-    ' import pc from \'picocolors\';',
-    '-const old = 1;',
-    '+const next = 2;',
-    ' keep',
-  ].join('\n');
-  const colored = renderDiffPreview(diff, { color: true });
-  assert.match(colored, /\x1b\[/);
-  assert.match(stripAnsi(colored), /\+const next = 2;/);
-  const plain = renderDiffPreview(diff, { color: false });
-  assert.doesNotMatch(plain, /\x1b\[/);
-  assert.match(plain, /-const old = 1;/);
-  assert.equal(stripAnsi(renderDiffPreview('', { color: false })).trim(), 'no changes');
-});
-
-test('inline activity shows elapsed time and ctrl-c cancel hint', () => {
-  let output = '';
-  let now = 0;
-  let tick = null;
-  const activity = createInlineActivity({
-    write: (value) => { output += value; },
-    interactive: true,
-    env: { NO_COLOR: '1' },
-    now: () => now,
-    setInterval: (fn) => { tick = fn; return 1; },
-    clearInterval() {},
-  });
-  activity.start('Working');
-  now = 1500;
-  tick();
-  const clean = stripAnsi(output);
-  assert.match(clean, /Working/);
-  assert.match(clean, /1\.5s/);
-  assert.match(clean, new RegExp(INTERRUPT_HINT.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
-  activity.clear();
-});
-
-test('shimmer uses color when allowed and stays plain under NO_COLOR', () => {
-  const colored = renderShimmer('Working', 4, { env: { COLORTERM: 'truecolor' } });
-  assert.match(colored, /\x1b\[38;2;/);
-  assert.match(stripAnsi(colored), /Working/);
-  const fallback = renderShimmer('Working', 4, { env: { TERM: 'xterm-256color' } });
-  assert.match(fallback, /\x1b\[38;5;/);
-  const plain = renderShimmer('Working', 4, { env: { NO_COLOR: '1', COLORTERM: 'truecolor' } });
-  assert.equal(plain, 'Working');
-});
-
-test('runtime event envelope is the single standalone/platform producer contract', () => {
-  const envelope = normalizeRuntimeEventEnvelope({
-    schema_version: 1,
-    type: 'tool.started',
-    timestamp: '2026-09-18T00:00:00.000Z',
-    run_id: 'run_1',
-    sequence: 3,
-    payload: { capability_id: 'repo.inspect' },
-  });
-  assert.equal(envelope.schema, RUNTIME_EVENT_ENVELOPE_SCHEMA);
-  assert.equal(envelope.schema_version, 1);
-  assert.equal(envelope.type, 'tool.started');
-  assert.equal(envelope.run_id, 'run_1');
-  assert.equal(envelope.sequence, 3);
-  assert.deepEqual(envelope.payload, { capability_id: 'repo.inspect' });
-  assert.throws(() => normalizeRuntimeEventEnvelope({ payload: {} }), /type is required/);
-});
-
-test('runtime presenter turns events into one-line activity and waiting handoff', () => {
-  let output = '';
-  let now = 1_000;
-  const timers = [];
-  const activity = createInlineActivity({
-    write: (value) => { output += value; },
-    interactive: false,
-    now: () => now,
-    setInterval: (fn) => { timers.push(fn); return timers.length; },
-    clearInterval() {},
-  });
-  const state = {};
-  const presenter = createCliRuntimePresenter({ activity, write: (value) => { output += value; }, state });
-  activity.start('Thinking');
-  presenter.handle({ type: 'tool.started', payload: { capability_id: 'repo.inspect' } });
-  presenter.handle({ type: 'usage.snapshot', payload: { current_context: { input_tokens: 10, window_tokens: 100 }, cumulative: {} } });
-  presenter.handle({ type: 'context.compaction.started', payload: { provider: 'test' } });
-  now += 500;
-  presenter.handle({ type: 'context.compaction.completed', payload: { provider: 'test', tokens_before: 80, tokens_after: 20, summary_text: 'kept state' } });
-  presenter.handle({ type: 'runtime.waiting_input', payload: { reason: 'authentication', auth_url: 'https://example.test/auth', user_code: 'ABCD' } });
-  assert.equal(state.usageSnapshot.current_context.input_tokens, 10);
-  assert.equal(state.lastCompaction.tokens_before, 80);
-  assert.match(output, /Waiting for you/);
-  assert.match(output, /https:\/\/example\.test\/auth/);
-  assert.match(output, /ABCD/);
-  assert.match(presenter.compactionReceipt(), /80 → 20/);
-});
-
-test('waiting renderer gives CLI-native auth instructions', () => {
-  const text = renderWaitingInput({ awaiting_input_reason: 'otp', auth_url: 'https://example.test/login', user_code: '123456' });
-  assert.match(text, /Waiting for you/);
-  assert.match(text, /otp/);
-  assert.match(text, /Open/);
-  assert.match(text, /123456/);
-});

package/test/cli/rust-command.test.mjs

@@ -1,21 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { getCliCommand } from '../../src/cli/command-catalog.js';
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
-
-test('rust/wasm command aliases resolve to one catalog authority', () => {
-  const rust = getCliCommand('rust');
-  assert.equal(rust?.id, 'rust');
-  assert.equal(getCliCommand('wasm')?.id, 'rust');
-  assert.equal(getCliCommand('rapid-rust')?.id, 'rust');
-});
-
-test('rapid rust root bin and native crate ship in source tree', () => {
-  assert.equal(fs.existsSync(path.join(root, 'bin/agentsam-rapid-rust')), true);
-  assert.equal(fs.existsSync(path.join(root, 'packages/agentsam-rapid-rust/Cargo.toml')), true);
-  assert.equal(fs.existsSync(path.join(root, 'scripts/build_rapid_rust_cli.py')), true);
-});

package/test/cli/skill-npm-and-env.test.mjs

@@ -1,52 +0,0 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import test from 'node:test';
-import { resolveNpmSkillPackage } from '../../src/commands/skill.js';
-import { installSkillFromPath } from '../../src/skills/index.js';
-import { runEnv } from '../../src/commands/env.js';
-
-function tmpHome() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-finish-'));
-}
-
-test('resolveNpmSkillPackage extracts agentsam.skill.json via npm pack', (t) => {
-  // Build a tiny local package and pack it by path (no registry).
-  const pkgRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-npm-skill-'));
-  fs.writeFileSync(
-    path.join(pkgRoot, 'package.json'),
-    JSON.stringify({ name: 'tmp-agentsam-skill-fixture', version: '0.0.0', private: true }),
-  );
-  fs.writeFileSync(
-    path.join(pkgRoot, 'agentsam.skill.json'),
-    JSON.stringify({
-      schema: 'agentsam.skill.v1',
-      id: 'npm-fixture',
-      name: 'NPM Fixture',
-      slash: { suggested: '/npm-fixture' },
-      instructions: { source: 'inline', inline: '# npm fixture' },
-      execution: { mode: 'turn' },
-    }),
-  );
-  const resolved = resolveNpmSkillPackage(pkgRoot, { spawnSyncImpl: spawnSync });
-  assert.ok(fs.existsSync(path.join(resolved, 'agentsam.skill.json')));
-
-  const home = tmpHome();
-  const installed = installSkillFromPath(resolved, { home });
-  assert.equal(installed.id, 'npm-fixture');
-  assert.equal(installed.trigger, '/npm-fixture');
-});
-
-test('env boot-line prints source load-agent-env command', async () => {
-  const home = tmpHome();
-  const lines = [];
-  const result = await runEnv(['boot-line', 'cursor', 'inneranimalmedia'], {
-    home,
-    write: (t) => lines.push(t),
-  });
-  assert.equal(result.command, 'source ~/.agentsam/load-agent-env.sh');
-  assert.ok(lines.join('').includes('load-agent-env.sh'));
-  assert.ok(lines.join('').includes('agentsam env shell'));
-});

package/test/cli/status-actions.test.mjs

@@ -1,88 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import {
-  buildStatusActionPlan,
-  formatStatusNextSteps,
-} from '../../src/status/actions.js';
-import { renderLocalStatus } from '../../src/ui/ansi.js';
-
-test('healthy Cloudflare deployment wins over localhost', () => {
-  const runtime = {
-    ready: true,
-    checks: {
-      account: true,
-      models: true,
-      terminal: true,
-      cloudflare: true,
-    },
-    local: {
-      deployTarget: 'cloudflare',
-      api: {
-        online: false,
-        url: 'http://127.0.0.1:8787/api/health',
-      },
-      db: {
-        ready: true,
-        exists: true,
-      },
-    },
-    cloudflare: {
-      configured: true,
-      worker_name: 'agentsam-sdk',
-      health: {
-        ok: true,
-        status: 200,
-        url: 'https://agentsam.inneranimalmedia.com/health',
-      },
-    },
-  };
-
-  const plan = buildStatusActionPlan(runtime);
-  const text = formatStatusNextSteps(plan);
-
-  assert.match(plan.headline, /Live project healthy/);
-  assert.ok(plan.actions.some((action) =>
-    action.command === 'https://agentsam.inneranimalmedia.com'
-  ));
-  assert.ok(plan.actions.some((action) =>
-    action.command === 'agentsam cloudflare status'
-  ));
-  assert.doesNotMatch(text, /npm run dev/);
-  assert.match(text, /open https:\/\/agentsam\.inneranimalmedia\.com/);
-});
-
-test('compact local card prefers live deployment', () => {
-  const text = renderLocalStatus({
-    configured: true,
-    project: 'agentsam-sdk',
-    lane: 'custom',
-    agent: 'default',
-    git: {
-      branch: 'main',
-      revision: 'abcdef123456',
-      dirty: false,
-    },
-    db: {
-      ready: true,
-      tables: [],
-    },
-    api: {
-      online: false,
-      url: 'http://127.0.0.1:8787/api/health',
-    },
-    pty: {
-      online: true,
-      url: 'http://127.0.0.1:3099/health',
-    },
-    deployTarget: 'cloudflare',
-    live: {
-      online: true,
-      url: 'https://agentsam.inneranimalmedia.com/health',
-    },
-  });
-
-  assert.match(text, /● live/);
-  assert.match(text, /open https:\/\/agentsam\.inneranimalmedia\.com/);
-  assert.match(text, /agentsam cloudflare status/);
-  assert.doesNotMatch(text, /npm run dev/);
-});

package/test/cli/wireframes-go-registry.test.mjs

@@ -1,139 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { renderArchitectureExplorer, renderOperationInspector, drawBox } from '../../src/ui/wireframes.js';
-import { applyInnerAnimalMediaOfficialGoProductRegistry, buildGoProductRegistrySql } from '../../src/go/official-registry.js';
-
-test('architecture explorer is boxed reasoning scenery', () => {
-  const view = renderArchitectureExplorer({
-    repo: 'agentsam-sdk',
-    focus: { package: 'protocol', owns: 'wire contracts', runtime: 'none', imported_by: 'client', files: '.proto' },
-  });
-  assert.match(view, /┌/);
-  assert.match(view, /package: protocol/);
-  assert.match(view, /DEPENDENCY MAP/);
-  assert.match(view, /\[contracts\]/);
-});
-
-test('operation inspector shows intent timeline', () => {
-  const view = renderOperationInspector({
-    operation: 'model.export',
-    op_id: 'op_01H',
-    active_index: 2,
-    step: { name: 'converter', artifact: 'GLB' },
-    receipt: { 'input document revision': 84, 'output artifact hash': 'abc' },
-  });
-  assert.match(view, /model\.export/);
-  assert.match(view, /intent/);
-  assert.match(view, /converter/);
-  assert.match(view, /GLB/);
-  assert.match(view, /input document revision/);
-});
-
-test('drawBox pads visible ANSI width', () => {
-  const box = drawBox(['hello'], { width: 20, title: 't' });
-  assert.match(box, /┌/);
-  assert.match(box, /└/);
-});
-
-test('buildGoProductRegistrySql upserts product + relationships without inventing tables', () => {
-  const sql = buildGoProductRegistrySql({
-    product: 'agentsam-go-worker',
-    status: 'deployed',
-    url: 'https://agentsam-go-worker.example.workers.dev',
-    commit: 'abc123',
-    health: 'healthy',
-  });
-  assert.match(sql, /INSERT INTO agentsam_products/);
-  assert.match(sql, /ON CONFLICT\(slug\) DO UPDATE/);
-  assert.match(sql, /INSERT INTO asset_relationships/);
-  assert.match(sql, /sourced_from/);
-  assert.match(sql, /runs_on/);
-  assert.match(sql, /deployed_as/);
-  assert.doesNotMatch(sql, /CREATE TABLE/);
-  assert.doesNotMatch(sql, /account_id/);
-});
-
-
-test('InnerAnimalMedia remote registry requires the explicit official-release guard', () => {
-  const preferred = process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
-  const legacy = process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
-
-  delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
-  delete process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
-
-  try {
-    assert.throws(
-      () => applyInnerAnimalMediaOfficialGoProductRegistry({
-        productRoot: '/tmp/agentsam-test-state',
-        officialRelease: true,
-        skipRemote: true,
-      }),
-      /inneranimalmedia_registry_official_release_required/,
-    );
-  } finally {
-    if (preferred == null) {
-      delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
-    } else {
-      process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE = preferred;
-    }
-
-    if (legacy == null) {
-      delete process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
-    } else {
-      process.env.AGENTSAM_IAM_OFFICIAL_RELEASE = legacy;
-    }
-  }
-});
-
-test('InnerAnimalMedia official registry normalizes deployed lifecycle status to D1 production', () => {
-  const prior = process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
-  process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE = '1';
-  try {
-    const result = applyInnerAnimalMediaOfficialGoProductRegistry({
-      productRoot: null,
-      officialRelease: true,
-      status: 'deployed',
-      dryRun: true,
-      skipRemote: true,
-    });
-    assert.match(result.sql, /'production'/);
-    assert.doesNotMatch(result.sql, /'deployed',\n  'AgentSam Go runtime/);
-  } finally {
-    if (prior == null) delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
-    else process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE = prior;
-  }
-});
-
-
-test('legacy AGENTSAM_IAM_OFFICIAL_RELEASE guard remains backward compatible', () => {
-  const preferred = process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
-  const legacy = process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
-
-  delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
-  process.env.AGENTSAM_IAM_OFFICIAL_RELEASE = '1';
-
-  try {
-    const result = applyInnerAnimalMediaOfficialGoProductRegistry({
-      productRoot: null,
-      officialRelease: true,
-      status: 'deployed',
-      dryRun: true,
-      skipRemote: true,
-    });
-
-    assert.equal(result.ok, true);
-    assert.match(result.sql, /'production'/);
-  } finally {
-    if (preferred == null) {
-      delete process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE;
-    } else {
-      process.env.AGENTSAM_INNERANIMALMEDIA_OFFICIAL_RELEASE = preferred;
-    }
-
-    if (legacy == null) {
-      delete process.env.AGENTSAM_IAM_OFFICIAL_RELEASE;
-    } else {
-      process.env.AGENTSAM_IAM_OFFICIAL_RELEASE = legacy;
-    }
-  }
-});

package/test/cli-preferences.test.mjs

@@ -1,46 +0,0 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import { CLI_PREFERENCES_SCHEMA, detectCliProject, readCliPreferences, writeCliPreferences } from '../src/lib/cli-preferences.js';
-import { renderBootSummary } from '../src/ui/boot.js';
-
-test('CLI preferences persist local model/runtime controls without becoming routing authority', () => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cli-prefs-'));
-  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'demo-project' }));
-  const written = writeCliPreferences(root, {
-    trustedDirectory: true,
-    runtime: 'sandbox',
-    terminal: 'zsh',
-    modelPreference: 'openai:gpt-6-astra',
-    reasoningEffort: 'high',
-    serviceTier: 'fast',
-  });
-  assert.equal(written.schemaVersion, CLI_PREFERENCES_SCHEMA);
-  assert.equal(written.modelAuthority, 'preference-only');
-  assert.equal(written.trustedDirectory, true);
-  assert.deepEqual(readCliPreferences(root), written);
-  const identity = detectCliProject(root);
-  assert.equal(identity.project, 'demo-project');
-  assert.equal(identity.root, root);
-  const summary = renderBootSummary({ identity, preferences: written });
-  assert.match(summary, /Agent Sam/);
-  assert.match(summary, /demo-project/);
-  assert.match(summary, /openai:gpt-6-astra/);
-  assert.match(summary, /high/);
-  assert.match(summary, /fast/);
-});
-
-test('legacy v1 local preferences migrate in memory without inventing trust', () => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cli-legacy-'));
-  fs.mkdirSync(path.join(root, '.agentsam'));
-  fs.writeFileSync(path.join(root, '.agentsam', 'cli.json'), JSON.stringify({
-    schemaVersion: 'agentsam-cli-preferences-v1', runtime: 'local', terminal: 'zsh', modelPreference: 'auto', modelAuthority: 'preference-only',
-  }));
-  const read = readCliPreferences(root);
-  assert.equal(read.schemaVersion, CLI_PREFERENCES_SCHEMA);
-  assert.equal(read.trustedDirectory, false);
-  assert.equal(read.reasoningEffort, 'auto');
-  assert.equal(read.serviceTier, 'default');
-});

package/test/cloudflare-connector.test.mjs

@@ -1,93 +0,0 @@
-import assert from 'node:assert/strict';
-import { describe, it } from 'node:test';
-import { handleCloudflareConnectionRequest } from '../packages/connectors/cloudflare/src/routes.js';
-import { rejectUntrustedOwnerHints } from '../packages/connectors/cloudflare/src/owner.js';
-
-function req(url, { method = 'GET', headers = {}, body } = {}) {
-  return new Request(url, { method, headers, body });
-}
-
-describe('cloudflare connector routes', () => {
-  it('rejects unauthenticated status', async () => {
-    const res = await handleCloudflareConnectionRequest(
-      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare'),
-      {},
-    );
-    assert.equal(res.status, 401);
-    const json = await res.json();
-    assert.equal(json.error, 'unauthenticated');
-  });
-
-  it('rejects browser-submitted owner hints', () => {
-    const url = new URL('https://agentsam.inneranimalmedia.com/api/connections/cloudflare?account_id=evil');
-    assert.throws(
-      () => rejectUntrustedOwnerHints(req(url.toString()), url, {}),
-      /untrusted_owner_hint/,
-    );
-  });
-
-  it('returns 503 on start when only fixture credentials exist', async () => {
-    const env = {
-      CLOUDFLARE_OAUTH_CLIENT_ID: 'sillynotreal',
-      fixtureSessions: new Map([['sess_1', 'user-sam']]),
-    };
-    const res = await handleCloudflareConnectionRequest(
-      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare/start', {
-        headers: { cookie: 'agentsam_session=sess_1' },
-      }),
-      env,
-    );
-    assert.equal(res.status, 503);
-    const json = await res.json();
-    assert.equal(json.error, 'not_configured');
-    assert.equal(json.fixture, true);
-  });
-
-  it('status stays safe and does not treat fixture as production configured', async () => {
-    const env = {
-      CLOUDFLARE_OAUTH_CLIENT_ID: 'sillynotreal',
-      fixtureSessions: new Map([['sess_1', 'user-sam']]),
-    };
-    const res = await handleCloudflareConnectionRequest(
-      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare', {
-        headers: { authorization: 'Bearer sess_1' },
-      }),
-      env,
-    );
-    assert.equal(res.status, 200);
-    const json = await res.json();
-    assert.equal(json.ok, true);
-    assert.equal(json.configured, false);
-    assert.equal(json.fixture, true);
-    assert.equal(JSON.stringify(json).includes('sillynotreal-secret'), false);
-  });
-
-  it('rejects owner_id in the JSON body', async () => {
-    const env = { fixtureSessions: new Map([['sess_1', 'user-sam']]) };
-    const res = await handleCloudflareConnectionRequest(
-      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare/disconnect', {
-        method: 'POST',
-        headers: { cookie: 'agentsam_session=sess_1', 'content-type': 'application/json' },
-        body: JSON.stringify({ owner_id: 'evil' }),
-      }),
-      env,
-    );
-    assert.equal(res.status, 400);
-    const json = await res.json();
-    assert.equal(json.error, 'untrusted_owner_hint');
-  });
-
-  it('rejects callback without a stored oauth state', async () => {
-    const env = {
-      CLOUDFLARE_OAUTH_CLIENT_ID: 'real-client-id',
-      oauthState: new Map(),
-    };
-    const res = await handleCloudflareConnectionRequest(
-      req('https://agentsam.inneranimalmedia.com/api/connections/cloudflare/callback?code=abc&state=missing'),
-      env,
-    );
-    assert.equal(res.status, 403);
-    const json = await res.json();
-    assert.equal(json.error, 'cloudflare_connection_forbidden');
-  });
-});

package/test/cloudflare-runtime.test.mjs

@@ -1,82 +0,0 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import { buildWranglerInvocation, listWranglerNativeCommands, runWranglerNative, summarizeCloudflareCpuProfile, summarizeCloudflareCpuProfileFile } from '../src/cloudflare/index.js';
-import { createCapabilityAdapter } from '../src/agent/capability-adapter.js';
-
-function tempRoot() { return fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cf-')); }
-
-test('Cloudflare native command catalog exposes bounded read operations and never an auth-token secret read', () => {
-  const ids = listWranglerNativeCommands().map((row) => row.id);
-  assert.deepEqual(ids, ['whoami', 'deployments.list', 'versions.list', 'versions.view', 'types.check', 'queues.list', 'tunnel.list', 'tunnel.info']);
-  assert.ok(!ids.some((id) => id.includes('token') || id.includes('secret') || id === 'deploy'));
-});
-
-test('Wrangler version view requires an exact version and keeps secret values unavailable', () => {
-  const root = tempRoot();
-  const plan = buildWranglerInvocation('versions.view', { cwd: root, name: 'demo', version_id: 'ver_123' });
-  assert.deepEqual(plan.args, ['versions', 'view', 'ver_123', '--json', '--name', 'demo']);
-  assert.throws(() => buildWranglerInvocation('versions.view', { cwd: root, name: 'demo' }), /version_id_required/);
-});
-
-test('Wrangler native invocation is argv-based and cwd/config scoped', () => {
-  const root = tempRoot();
-  fs.writeFileSync(path.join(root, 'wrangler.jsonc'), '{}');
-  const plan = buildWranglerInvocation('deployments.list', { cwd: root, name: 'demo' });
-  assert.equal(plan.cwd, root);
-  assert.deepEqual(plan.args.slice(0, 4), ['deployments', 'list', '--json', '--name']);
-  assert.equal(plan.args[4], 'demo');
-  assert.ok(plan.args.includes('--config'));
-  assert.throws(() => buildWranglerInvocation('whoami', { cwd: root, config: '../outside.toml' }), /outside_cwd/);
-});
-
-test('Wrangler native result preserves JSON and real exit code on failure', async () => {
-  const root = tempRoot();
-  const success = await runWranglerNative('whoami', { cwd: root }, { run: async () => ({ code: 0, stdout: JSON.stringify({ email: 'dev@example.com' }), stderr: '' }) });
-  assert.equal(success.data.email, 'dev@example.com');
-  await assert.rejects(
-    runWranglerNative('versions.list', { cwd: root }, { run: async () => ({ code: 7, stdout: '', stderr: 'upstream failed' }) }),
-    (error) => error.diagnostic?.exit_code === 7 && error.diagnostic?.code === 'wrangler_exit_nonzero',
-  );
-  await assert.rejects(
-    runWranglerNative('deployments.list', { cwd: root }, { run: async () => ({ code: 1, stdout: '', stderr: 'Authentication error [code: 10000]\nRequest ID: req_cf_1\nCF-Ray: ray-123' }) }),
-    (error) => error.diagnostic?.code === '10000' && error.diagnostic?.request_id === 'req_cf_1' && error.diagnostic?.ray_id === 'ray-123',
-  );
-});
-
-test('CPU profile summary ranks self-time hotspots and explicitly rejects production timer inference', () => {
-  const profile = {
-    nodes: [
-      { id: 1, callFrame: { functionName: 'fetch', url: 'worker.js', lineNumber: 0, columnNumber: 0 } },
-      { id: 2, callFrame: { functionName: 'heavyLoop', url: 'worker.js', lineNumber: 10, columnNumber: 2 } },
-      { id: 3, callFrame: { functionName: '(garbage collector)', url: '', lineNumber: -1, columnNumber: -1 } },
-    ],
-    samples: [1, 2, 2, 3],
-    timeDeltas: [100, 1200, 800, 400],
-  };
-  const summary = summarizeCloudflareCpuProfile(profile);
-  assert.equal(summary.top_frames[0].function, 'heavyLoop');
-  assert.equal(summary.top_frames[0].self_us, 2000);
-  assert.equal(summary.garbage_collection_ms, 0.4);
-  assert.match(summary.timer_semantics, /do not advance during CPU-only execution/);
-});
-
-test('CPU profile file cannot escape runtime cwd', () => {
-  const root = tempRoot();
-  fs.writeFileSync(path.join(root, 'profile.cpuprofile'), JSON.stringify({ nodes: [], samples: [], timeDeltas: [] }));
-  assert.equal(summarizeCloudflareCpuProfileFile({ cwd: root, file: 'profile.cpuprofile' }).file, 'profile.cpuprofile');
-  assert.throws(() => summarizeCloudflareCpuProfileFile({ cwd: root, file: '../profile.cpuprofile' }), /outside_cwd/);
-});
-
-test('explicitly executable experimental Cloudflare capabilities enter cards-first discovery without exposing unavailable commands', () => {
-  const adapter = createCapabilityAdapter();
-  const rows = adapter.toolDescriptors();
-  const ids = rows.map((row) => row.name);
-  assert.ok(ids.includes('cloudflare.wrangler.native'));
-  assert.ok(ids.includes('cloudflare.cpu.profile'));
-  assert.ok(!ids.includes('cloudflare.cpu.audit'));
-  assert.ok(!ids.includes('blender.build'));
-  assert.equal(rows.find((row) => row.name === 'cloudflare.wrangler.native').risk, 'read');
-});