@inneranimalmedia/agentsam-sdk 2.6.7 → 2.6.8

package/test/account-session.test.mjs

@@ -1,101 +0,0 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import {
-  accountSessionPath,
-  clearAccountSession,
-  readAccountSession,
-  resolveAccountApiKey,
-  resolveAccountAuth,
-  resolveBrowserSessionCredential,
-  saveAccountSession,
-} from '../src/lib/account-session.js';
-import { resolveAccountAuthority } from '../src/lib/auth.js';
-
-function tempHome(t) {
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-account-'));
-  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
-  return home;
-}
-
-test('opaque browser login persists in machine-local storage and resolves independently from API keys', t => {
-  const home = tempHome(t);
-  const saved = saveAccountSession({
-    access_token: 'browser_session_machine_test',
-    user_id: 'au_test',
-    account_id: 'acct_test',
-    email: 'dev@example.test',
-  }, { home });
-  assert.equal(saved.user_id, 'au_test');
-
-  const filename = accountSessionPath({ home });
-  assert.equal(fs.existsSync(filename), true);
-  if (process.platform !== 'win32') assert.equal(fs.statSync(filename).mode & 0o077, 0);
-
-  const loaded = readAccountSession({ home });
-  assert.equal(loaded.access_token, 'browser_session_machine_test');
-  const browser = resolveBrowserSessionCredential({ env: {}, home });
-  assert.equal(browser.source, 'agentsam_browser_oauth');
-  assert.equal(browser.kind, 'agentsam_browser_oauth');
-  assert.equal(browser.value, 'browser_session_machine_test');
-  assert.equal(resolveAccountApiKey({ env: {}, home }).value, '');
-  assert.equal(resolveAccountAuth({ env: {}, home }).value, 'browser_session_machine_test');
-
-  assert.equal(clearAccountSession({ home }), true);
-  assert.equal(readAccountSession({ home }), null);
-});
-
-test('explicit/environment aak_ API key outranks browser login while legacy SDK env names are ignored', t => {
-  const home = tempHome(t);
-  saveAccountSession({ access_token: 'browser_session_disk' }, { home });
-
-  assert.equal(
-    resolveAccountAuth({ env: { AGENTSAM_API_KEY: 'aak_env_test' }, home }).value,
-    'aak_env_test',
-  );
-  assert.equal(
-    resolveAccountAuth({ env: { AGENTSAM_API_KEY: 'aak_env_test' }, explicit: 'aak_explicit_test', home }).value,
-    'aak_explicit_test',
-  );
-  assert.equal(
-    resolveAccountAuth({ env: { AGENTSAM_SDK_KEY: 'legacy_ignored' }, home }).value,
-    'browser_session_disk',
-  );
-});
-
-test('invalid environment API key cannot shadow a valid browser login', t => {
-  const home = tempHome(t);
-  saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
-  const resolved = resolveAccountAuth({ env: { AGENTSAM_API_KEY: 'not-an-aak' }, home });
-  assert.equal(resolved.value, 'browser_session_machine_test');
-  assert.equal(resolved.kind, 'agentsam_browser_oauth');
-  assert.equal(resolved.fallback_error, 'invalid_api_key_prefix');
-});
-
-test('async IAM authority also falls back from invalid environment key to browser OAuth', async t => {
-  const home = tempHome(t);
-  saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
-  const resolved = await resolveAccountAuthority({ env: { AGENTSAM_API_KEY: 'not-an-aak' }, home });
-  assert.equal(resolved.value, 'browser_session_machine_test');
-  assert.equal(resolved.kind, 'agentsam_browser_oauth');
-  assert.equal(resolved.fallback_error, 'invalid_api_key_prefix');
-});
-
-test('invalid explicitly supplied API key remains authoritative and fails visibly', t => {
-  const home = tempHome(t);
-  saveAccountSession({ access_token: 'browser_session_machine_test' }, { home });
-  const resolved = resolveAccountAuth({ env: {}, explicit: 'not-an-aak', home });
-  assert.equal(resolved.value, '');
-  assert.equal(resolved.error, 'invalid_api_key_prefix');
-  assert.equal(resolved.source, 'explicit');
-});
-
-test('browser session storage refuses reusable aak_ credentials', t => {
-  const home = tempHome(t);
-  assert.throws(
-    () => saveAccountSession({ access_token: 'aak_should_not_be_browser_session' }, { home }),
-    /account_browser_oauth_session_required/,
-  );
-});

package/test/agent-capabilities.test.mjs

@@ -1,67 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { createCapabilityAdapter } from '../src/agent/index.js';
-import { buildRepositoryAuditPacket, runRepositoryAudit } from '../src/agent/repository-audit.js';
-
-const snapshot = {
-  schema_version: 1,
-  capability: 'repository.snapshot',
-  snapshot_id: 'rsnap_0123456789abcdef01234567',
-  content_hash: `sha256:${'a'.repeat(64)}`,
-  repository: { repository_id: 'github:owner/repo', provider: 'github', full_name: 'owner/repo', branch: 'main', revision_sha: 'b'.repeat(40), dirty: false },
-  tree: { merkle_root: `sha256:${'c'.repeat(64)}`, stats: { files: 10 } },
-  intelligence: {
-    summary: { file_count: 10, total_lines: 500 },
-    languages: [{ language: 'JavaScript', files: 7 }],
-    manifests: [{ path: 'package.json', kind: 'node' }],
-    top_level: [{ path: 'src', files: 7 }],
-    pressure_points: [{ path: 'src', pressure_score: 70 }],
-  },
-  packages: [{ path: 'package.json', name: 'demo', version: '1.0.0' }],
-  knowledge: { configured: false },
-  deploy: null,
-};
-
-test('repository audit packet is bounded read-only evidence', () => {
-  const packet = buildRepositoryAuditPacket({ snapshot, focus: ['packages'], evidenceBudget: 1000 });
-  assert.equal(packet.primitive, 'repository.audit');
-  assert.equal(packet.rules.read_only, true);
-  assert.equal(packet.rules.may_edit, false);
-  assert.equal(packet.snapshot_id, snapshot.snapshot_id);
-  assert.ok(JSON.stringify(packet.evidence).length <= 4000);
-});
-
-test('repository audit uses injected reasoning and validates read-only output', async () => {
-  const audit = await runRepositoryAudit({
-    snapshot,
-    reasoner: async packet => ({
-      summary: `Audited ${packet.evidence.repository.full_name}`,
-      packages: packet.evidence.packages,
-      notable_combinations: ['snapshot + audit'],
-      findings: [{ severity: 'low', finding: 'example' }],
-      recommended_routes: ['inspect capability registry'],
-      evidence_refs: [packet.evidence_index.packages],
-    }),
-  });
-  assert.equal(audit.primitive, 'repository.audit');
-  assert.equal(audit.summary, 'Audited owner/repo');
-  assert.equal(audit.packages.length, 1);
-  assert.deepEqual(audit.commands, []);
-
-  await assert.rejects(() => runRepositoryAudit({ snapshot, reasoner: async () => ({ summary: 'bad', jobs: [] }) }), /mutation field: jobs/);
-});
-
-test('agent capability adapter exposes only executable tools by default', async () => {
-  const adapter = createCapabilityAdapter({
-    reasoner: async packet => ({ summary: 'ok', evidence_refs: [packet.evidence_index.summary] }),
-    handlers: { 'knowledge.search': async input => ({ query: input.text, hits: [] }) },
-  });
-  const names = adapter.toolDescriptors().map(row => row.name);
-  assert.ok(names.includes('repository.snapshot'));
-  assert.ok(names.includes('repository.audit'));
-  assert.ok(names.includes('knowledge.search'));
-  assert.equal(names.includes('knowledge.index'), false);
-  const result = await adapter.invoke('knowledge.search', { text: 'hello' });
-  assert.equal(result.capability_id, 'knowledge.search');
-  assert.deepEqual(result.result.hits, []);
-});

package/test/app-authority-context.test.mjs

@@ -1,32 +0,0 @@
-import assert from 'node:assert/strict';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import test from 'node:test';
-import { resolveCurrentAppContext } from '../src/lib/app-authority.js';
-
-const HERE = path.dirname(fileURLToPath(import.meta.url));
-const ROOT = path.resolve(HERE, '..');
-
-test('generic repo root has no fabricated app identity', () => {
-  const context = resolveCurrentAppContext({ root: ROOT, cwd: ROOT });
-  assert.deepEqual(context, { app_id: null, host_origin: null, source: null });
-});
-
-test('Local Studio context resolves from nearest agentsam.app.json', () => {
-  const context = resolveCurrentAppContext({
-    root: ROOT,
-    cwd: path.join(ROOT, 'apps/local-studio/frontend'),
-  });
-  assert.equal(context.app_id, 'local-studio');
-  assert.equal(context.host_origin, null);
-  assert.match(context.source || '', /apps\/local-studio\/agentsam\.app\.json$/);
-});
-
-test('package app identity resolves from its own manifest without Local Studio leakage', () => {
-  const context = resolveCurrentAppContext({
-    root: ROOT,
-    cwd: path.join(ROOT, 'packages/agentsam-database-editor/src'),
-  });
-  assert.equal(context.app_id, 'database-editor');
-  assert.equal(context.host_origin, null);
-});

package/test/app-building-skills.test.mjs

@@ -1,61 +0,0 @@
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import test from 'node:test';
-import { getSkill, listSkills, loadSkill } from '../src/skills/index.js';
-
-const root = path.resolve(import.meta.dirname, '..');
-const cli = path.join(root, 'src', 'cli.js');
-
-test('application fundamentals and progression guard are portable registered skills', () => {
-  const ids = new Set(listSkills().map((skill) => skill.id));
-  assert.ok(ids.has('agentsam-app-fundamentals'));
-  assert.ok(ids.has('agentsam-progression-guard'));
-  assert.equal(getSkill('quick-bytes')?.id, 'agentsam-app-fundamentals');
-  assert.equal(getSkill('no-regress')?.id, 'agentsam-progression-guard');
-
-  const fundamentals = loadSkill('quick-bytes', { references: true });
-  assert.equal(fundamentals.references.length, 2);
-  assert.match(fundamentals.instructions, /Credentialed-destination card/);
-  assert.match(fundamentals.instructions, /AST/);
-  assert.match(fundamentals.instructions, /Merkle/);
-  assert.match(fundamentals.instructions, /Firewall\/WAF/);
-  assert.match(fundamentals.references[0].content, /OAuth redirect mental model/);
-  assert.match(fundamentals.references[1].content, /The codebase is a graph/);
-
-  const guard = loadSkill('no-regress', { references: true });
-  assert.equal(guard.references.length, 2);
-  assert.match(guard.instructions, /failed candidate must not advance the last-known-good baseline/);
-  assert.match(guard.instructions, /agentsam deploy-receipt capture/);
-  assert.match(guard.references[0].content, /Gate 6 — postdeploy/);
-  assert.match(guard.references[1].content, /Ingress versus egress hooks/);
-});
-
-test('skills CLI lists compact cards and loads quick reminders by alias', () => {
-  const listed = spawnSync(process.execPath, [cli, 'skills', '--json'], { cwd: root, encoding: 'utf8' });
-  assert.equal(listed.status, 0, listed.stderr);
-  const catalog = JSON.parse(listed.stdout);
-  assert.ok(catalog.some((skill) => skill.id === 'agentsam-app-fundamentals'));
-  assert.ok(catalog.some((skill) => skill.id === 'agentsam-progression-guard'));
-
-  const loaded = spawnSync(process.execPath, [cli, 'skills', 'quick-bytes'], { cwd: root, encoding: 'utf8' });
-  assert.equal(loaded.status, 0, loaded.stderr);
-  assert.match(loaded.stdout, /# AgentSam Application Fundamentals/);
-  assert.doesNotMatch(loaded.stdout, /# Trust, Credentials, and Credentialed Destinations/);
-
-  const full = spawnSync(process.execPath, [cli, 'skills', 'no-regress', '--references'], { cwd: root, encoding: 'utf8' });
-  assert.equal(full.status, 0, full.stderr);
-  assert.match(full.stdout, /# AgentSam Progression Guard/);
-  assert.match(full.stdout, /# Checkpoint Chain/);
-  assert.match(full.stdout, /# Hooks and Operational I\/O/);
-});
-
-test('portable npm package still owns all skill files', () => {
-  const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
-  assert.ok(pkg.files.includes('skills'));
-  for (const rel of [
-    'skills/agentsam-app-fundamentals/SKILL.md',
-    'skills/agentsam-progression-guard/SKILL.md',
-  ]) assert.equal(fs.existsSync(path.join(root, rel)), true, `${rel} must exist`);
-});

package/test/apps-scaffold-contract.test.mjs

@@ -1,115 +0,0 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import path from 'node:path';
-import test from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const productApps = ['local-studio', 'cad-creator', 'client-cms-editor'];
-const at = (...parts) => path.join(root, ...parts);
-const exists = (...parts) => fs.existsSync(at(...parts));
-
-function packageJson(...parts) {
-  return JSON.parse(fs.readFileSync(at(...parts, 'package.json'), 'utf8'));
-}
-
-function read(...parts) {
-  return fs.readFileSync(at(...parts), 'utf8');
-}
-
-test('product apps are self-contained npm workspace roots with one lockfile', () => {
-  for (const app of productApps) {
-    const base = ['apps', app];
-    assert.ok(exists(...base, 'package.json'), `${app}: root package.json`);
-    assert.ok(exists(...base, 'package-lock.json'), `${app}: root package-lock.json`);
-    assert.ok(exists(...base, 'frontend', 'package.json'), `${app}: frontend package`);
-    assert.ok(exists(...base, 'backend', 'package.json'), `${app}: backend package`);
-    assert.equal(exists(...base, 'frontend', 'package-lock.json'), false, `${app}: no frontend lockfile`);
-    assert.equal(exists(...base, 'backend', 'package-lock.json'), false, `${app}: no backend lockfile`);
-
-    const pkg = packageJson(...base);
-    assert.deepEqual(pkg.workspaces, ['frontend', 'backend', 'shared/*'], `${app}: canonical workspace list`);
-  }
-});
-
-test('every product app owns its Cloudflare boundary under backend/', () => {
-  for (const app of productApps) {
-    const base = ['apps', app, 'backend'];
-    assert.ok(exists(...base, 'worker', 'index.js'), `${app}: backend/worker/index.js`);
-    assert.ok(exists(...base, 'wrangler.jsonc'), `${app}: backend/wrangler.jsonc`);
-    const wrangler = fs.readFileSync(at(...base, 'wrangler.jsonc'), 'utf8');
-    assert.match(wrangler, /"main"\s*:\s*"worker\/index\.js"/, `${app}: wrangler main`);
-  }
-});
-
-test('SDK root is package tooling only and does not own an app Worker', () => {
-  assert.equal(exists('wrangler.jsonc'), false);
-  assert.equal(exists('worker', 'index.js'), false);
-  assert.equal(exists('scripts', 'with-cloudflare-env.sh'), false);
-
-  const rootPkg = packageJson();
-  for (const workspace of rootPkg.workspaces || []) {
-    assert.equal(workspace.startsWith('apps/'), false, `root workspace must not absorb app workspace: ${workspace}`);
-  }
-});
-
-test('Local Studio retired donor-era duplicate deployment configs', () => {
-  for (const file of ['wrangler.ui.toml', 'wrangler.workmode.toml', 'wrangler.toml.example']) {
-    assert.equal(exists('apps', 'local-studio', 'backend', file), false, `retire ${file}`);
-  }
-});
-
-test('CAD creator app package is curated for third-party installation', () => {
-  const pkg = packageJson('apps', 'cad-creator');
-  const manifest = JSON.parse(read('apps', 'cad-creator', 'agentsam.app.json'));
-
-  assert.equal(pkg.name, '@inneranimalmedia/agentsam-cad-creator');
-  assert.notEqual(pkg.private, true);
-  assert.equal(pkg.bin['agentsam-cad-creator'], 'bin/agentsam-cad-creator.mjs');
-  assert.equal(pkg.publishConfig.access, 'public');
-  assert.ok(pkg.files.includes('frontend/dist/'));
-  assert.ok(pkg.files.includes('backend/dist/'));
-  assert.ok(pkg.files.includes('backend/worker/'));
-  assert.equal(pkg.files.some((entry) => entry.startsWith('reference')), false);
-  assert.equal(pkg.files.some((entry) => entry.includes('.wrangler/state')), false);
-
-  assert.equal(manifest.schema, 'agentsam.app.v1');
-  assert.equal(manifest.id, 'cad-creator');
-  assert.equal(manifest.package, pkg.name);
-  assert.equal(manifest.runtime.local_preview, 'ready');
-  assert.equal(manifest.runtime.source_scaffold, 'ready');
-  assert.equal(manifest.runtime.cloudflare, 'scaffold');
-});
-
-test('client-cms-editor app manifest points to authoritative package name', () => {
-  const pkg = packageJson('apps', 'client-cms-editor');
-  const manifest = JSON.parse(read('apps', 'client-cms-editor', 'agentsam.app.json'));
-
-  assert.equal(pkg.name, '@inneranimalmedia/client-cms-editor');
-  assert.equal(manifest.schema, 'agentsam.app.v1');
-  assert.equal(manifest.id, 'client-cms-editor');
-  assert.equal(manifest.package, pkg.name);
-  assert.equal(manifest.runtime.local_preview, 'ready');
-  assert.equal(manifest.runtime.source_scaffold, 'ready');
-  // Cloudflare path is adapter-ready until a graduated CF deploy receipt exists.
-  assert.equal(manifest.runtime.cloudflare, 'adapter-ready');
-});
-
-test('CAD creator keeps the robotics runtime lazy and the perception key server-side', () => {
-  const app = exists('apps', 'cad-creator', 'frontend', 'src', 'app', 'CadCreatorApp.tsx')
-    ? read('apps', 'cad-creator', 'frontend', 'src', 'app', 'CadCreatorApp.tsx')
-    : read('apps', 'cad-creator', 'frontend', 'src', 'App.tsx');
-  const lazy = read('apps', 'cad-creator', 'frontend', 'src', 'workspaces', 'robotics', 'lazy.tsx');
-  const httpProvider = read('apps', 'cad-creator', 'frontend', 'src', 'lib', 'robotics', 'perception', 'http-provider.ts');
-  const perception = read('apps', 'cad-creator', 'backend', 'src', 'robotics', 'perception.ts');
-  const worker = read('apps', 'cad-creator', 'backend', 'worker', 'index.js');
-
-  assert.doesNotMatch(app, /from ['\"]\.\/workspaces\/robotics\/RoboticsWorkspace['\"]/);
-  assert.doesNotMatch(app, /MujocoSimulationProvider/);
-  assert.match(app, /LazyRoboticsWorkspace/);
-  assert.match(lazy, /import\(['\"]\.\/RoboticsWorkspace['\"]\)/);
-  assert.match(httpProvider, /\/api\/robotics\/perception\/detect/);
-  assert.doesNotMatch(httpProvider, /GEMINI_API_KEY|GOOGLE_API_KEY/);
-  assert.match(perception, /env\.GEMINI_API_KEY/);
-  assert.match(worker, /\/api\/robotics\/perception\/detect/);
-});

package/test/blender-cad.test.mjs

@@ -1,146 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import {
-  BLENDER_ADAPTER_PATH,
-  blenderBuild,
-  blenderInspect,
-  blenderStatus,
-  createBlenderInvocation,
-  discoverBlender,
-  parseBlenderResult,
-  validateBlenderRecipe,
-} from '../src/lib/cad/index.js';
-
-function fixture(t) {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-blender-test-'));
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  const binary = path.join(root, process.platform === 'win32' ? 'blender.exe' : 'blender');
-  fs.writeFileSync(binary, 'fake blender\n');
-  const blend = path.join(root, 'source.blend');
-  fs.writeFileSync(blend, 'blend fixture\n');
-  return { root, binary, blend };
-}
-
-function resultEnvelope(value) {
-  return { code: 0, stdout: `Blender startup noise\nAGENTSAM_RESULT=${JSON.stringify(value)}\n`, stderr: '' };
-}
-
-test('Blender adapter is packaged at the SDK-owned fixed path', () => {
-  assert.equal(path.basename(BLENDER_ADAPTER_PATH), 'adapter.py');
-  assert.ok(fs.existsSync(BLENDER_ADAPTER_PATH));
-});
-
-test('discoverBlender honors explicit binary before environment discovery', t => {
-  const { binary } = fixture(t);
-  assert.equal(discoverBlender({ blenderBin: binary, env: { AGENTSAM_BLENDER_BIN: '/wrong' } }), fs.realpathSync(binary));
-  assert.throws(() => discoverBlender({ blenderBin: path.join(path.dirname(binary), 'missing') }), /not found/);
-});
-
-test('Blender status uses argv execution and returns version without shell parsing', async t => {
-  const { binary } = fixture(t);
-  const calls = [];
-  const result = await blenderStatus({
-    blenderBin: binary,
-    runProcessImpl: async (command, args) => {
-      calls.push({ command, args });
-      return { code: 0, stdout: 'Blender 4.5.3 LTS\n', stderr: '' };
-    },
-  });
-  assert.equal(result.available, true);
-  assert.equal(result.version, 'Blender 4.5.3 LTS');
-  assert.deepEqual(calls, [{ command: fs.realpathSync(binary), args: ['--version'] }]);
-});
-
-test('typed Blender recipe rejects arbitrary or unknown operations', () => {
-  const valid = validateBlenderRecipe({
-    schema_version: 1,
-    operations: [
-      { op: 'add', primitive: 'cube', name: 'Body', size: 20 },
-      { op: 'bevel', object: 'Body', width: 1, segments: 3 },
-    ],
-  });
-  assert.equal(valid.operations.length, 2);
-  assert.throws(() => validateBlenderRecipe({ schema_version: 1, operations: [{ op: 'python', code: 'import bpy' }] }), /unsupported Blender recipe operation/);
-});
-
-test('Blender invocation is background + fixed adapter + typed request, never shell code', t => {
-  const { binary, blend, root } = fixture(t);
-  const requestPath = path.join(root, 'request.json');
-  const value = createBlenderInvocation({ operation: 'inspect', input: blend, requestPath, blenderBin: binary });
-  assert.equal(value.command, binary);
-  assert.deepEqual(value.args.slice(0, 2), ['--background', blend]);
-  assert.ok(value.args.includes('--python'));
-  assert.ok(value.args.includes(BLENDER_ADAPTER_PATH));
-  assert.deepEqual(value.args.slice(-4), ['--operation', 'inspect', '--request', requestPath]);
-});
-
-test('parseBlenderResult ignores Blender logs and reads the machine envelope', () => {
-  assert.deepEqual(parseBlenderResult('noise\nAGENTSAM_RESULT={"ok":true,"value":7}\n'), { ok: true, value: 7 });
-  assert.throws(() => parseBlenderResult('noise only'), /did not return/);
-});
-
-test('blenderInspect returns source hash and scene evidence without writing source', async t => {
-  const { binary, blend } = fixture(t);
-  const before = fs.readFileSync(blend, 'utf8');
-  const result = await blenderInspect({
-    input: blend,
-    blenderBin: binary,
-    runProcessImpl: async () => resultEnvelope({
-      ok: true,
-      blender_version: '4.5.3',
-      scene: { active: 'Scene', objects: [{ name: 'Body', type: 'MESH' }] },
-      warnings: [],
-    }),
-  });
-  assert.equal(result.capability, 'blender.inspect');
-  assert.equal(result.scene.objects[0].name, 'Body');
-  assert.match(result.input.sha256, /^[a-f0-9]{64}$/);
-  assert.equal(fs.readFileSync(blend, 'utf8'), before);
-});
-
-test('blenderBuild executes a bounded recipe and produces a hashed .blend artifact', async t => {
-  const { binary, root } = fixture(t);
-  const output = path.join(root, 'built.blend');
-  const recipe = {
-    schema_version: 1,
-    units: { system: 'METRIC', scale_length: 0.001, length_unit: 'MILLIMETERS' },
-    operations: [
-      { op: 'clear_scene' },
-      { op: 'add', primitive: 'cube', name: 'Body', size: 20 },
-      { op: 'add', primitive: 'cylinder', name: 'Hole', radius: 3, depth: 30 },
-      { op: 'boolean', object: 'Body', with: 'Hole', operation: 'DIFFERENCE', delete_operand: true },
-    ],
-  };
-  let seenRequest;
-  const result = await blenderBuild({
-    output,
-    recipe,
-    blenderBin: binary,
-    runProcessImpl: async (_command, args) => {
-      const requestPath = args[args.indexOf('--request') + 1];
-      seenRequest = JSON.parse(fs.readFileSync(requestPath, 'utf8'));
-      fs.writeFileSync(seenRequest.output, 'generated blend artifact\n');
-      return resultEnvelope({ ok: true, blender_version: '4.5.3', operations_applied: recipe.operations.length, objects: ['Body'], warnings: [] });
-    },
-  });
-  assert.equal(seenRequest.recipe.operations[3].operation, 'DIFFERENCE');
-  assert.equal(result.capability, 'blender.build');
-  assert.equal(result.artifact.path, output);
-  assert.equal(result.artifact.format, 'blend');
-  assert.match(result.artifact.sha256, /^[a-f0-9]{64}$/);
-  assert.deepEqual(result.objects, ['Body']);
-});
-
-test('Blender build refuses to overwrite an input source .blend', async t => {
-  const { binary, blend } = fixture(t);
-  await assert.rejects(() => blenderBuild({
-    input: blend,
-    output: blend,
-    blenderBin: binary,
-    recipe: { schema_version: 1, operations: [{ op: 'clear_scene' }] },
-    runProcessImpl: async () => { throw new Error('runner should not execute'); },
-  }), /never overwrite/);
-});

package/test/cad-docker.test.mjs

@@ -1,96 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { parseDockerizeArgs } from '../src/commands/dockerize.js';
-import {
-  CAD_TOOLS,
-  normalizeCadTools,
-  cadDefaultResources,
-  generateCadDocker,
-  prepareCadDeployment,
-  stageCadContext,
-  cadRunArguments,
-} from '../src/lib/cad-docker.js';
-import { buildDockerDeployPlan, generateDockerFileSet } from '../src/lib/dockerize.js';
-
-test('dockerize cad positional shortcut selects cad_service', () => {
-  const opts = parseDockerizeArgs(['cad', '--tools', 'openscad,freecad', '--port', '9911']);
-  assert.equal(opts.type, 'cad_service');
-  assert.equal(opts.tools, 'openscad,freecad');
-  assert.equal(opts.port, 9911);
-});
-
-test('CAD tools are allowlisted, deterministic, and all expands safely', () => {
-  assert.deepEqual(normalizeCadTools(), ['openscad']);
-  assert.deepEqual(normalizeCadTools('freecad,openscad,freecad'), ['openscad', 'freecad']);
-  assert.deepEqual(normalizeCadTools('all'), [...CAD_TOOLS]);
-  assert.throws(() => normalizeCadTools('openscad,evil-package;rm -rf /'), /Unknown CAD tool/);
-});
-
-test('CAD resource defaults scale only when heavier tools are selected', () => {
-  assert.deepEqual(cadDefaultResources('openscad'), { memory: '1g', cpus: '1' });
-  assert.deepEqual(cadDefaultResources('openscad,freecad'), { memory: '2g', cpus: '2' });
-  assert.deepEqual(cadDefaultResources('all'), { memory: '4g', cpus: '2' });
-});
-
-test('CAD Docker generator is localhost-only, non-root, read-only and tool-selective', () => {
-  const files = generateCadDocker({ appSlug: 'agentsam-cad', port: 8793, tools: 'openscad' });
-  assert.match(files.dockerfile, /FROM debian:bookworm-slim/);
-  assert.match(files.dockerfile, /apt-get install[^\n]*openscad/);
-  assert.doesNotMatch(files.dockerfile, /apt-get install[^\n]*\bfreecad\b/);
-  assert.doesNotMatch(files.dockerfile, /apt-get install[^\n]*\bblender\b/);
-  assert.match(files.dockerfile, /USER cad/);
-  assert.match(files.compose, /127\.0\.0\.1:8793:8793/);
-  assert.match(files.compose, /read_only: true/);
-  assert.match(files.compose, /cap_drop: \[ALL\]/);
-  assert.match(files.compose, /no-new-privileges:true/);
-  assert.match(files.compose, /\/work:rw,noexec,nosuid,size=512m,mode=1777/);
-  assert.deepEqual(files.tools, ['openscad']);
-});
-
-test('CAD all-tools image includes OpenSCAD, FreeCAD and Blender packages', () => {
-  const files = generateDockerFileSet('cad_service', { appSlug: 'cad-all', tools: 'all' });
-  assert.match(files.dockerfile, /\bopenscad\b/);
-  assert.match(files.dockerfile, /\bfreecad\b/);
-  assert.match(files.dockerfile, /\bblender\b/);
-});
-
-test('CAD deploy plan uses 8793 and hash changes with selected toolchain', () => {
-  const core = buildDockerDeployPlan('cad_service', { appSlug: 'agentsam-cad', tools: 'openscad' });
-  const heavy = buildDockerDeployPlan('cad_service', { appSlug: 'agentsam-cad', tools: 'all' });
-  assert.equal(core.hostPort, 8793);
-  assert.equal(core.containerPort, 8793);
-  assert.notEqual(core.hash, heavy.hash);
-});
-
-test('CAD deployment creates private token config and isolated build context', () => {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cad-docker-test-'));
-  try {
-    const prepared = prepareCadDeployment(tmp, { appSlug: 'agentsam-cad', tools: 'openscad' });
-    assert.ok(fs.existsSync(prepared.tokenFile));
-    assert.equal(fs.readFileSync(prepared.tokenFile, 'utf8').trim().length, 64);
-    assert.deepEqual(prepared.tools, ['openscad']);
-
-    const versionDir = path.join(tmp, '.agentsam', 'docker', 'fakehash');
-    fs.mkdirSync(versionDir, { recursive: true });
-    const context = stageCadContext(versionDir);
-    assert.ok(fs.existsSync(path.join(context, 'server.py')));
-    assert.deepEqual(fs.readdirSync(context).sort(), ['server.py']);
-
-    const args = cadRunArguments(prepared);
-    assert.ok(args.includes('--read-only'));
-    assert.ok(args.includes('--cap-drop=ALL'));
-    assert.ok(args.some(value => value.includes('dst=/config,readonly')));
-  } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
-  }
-});
-
-test('CAD service type is represented in generic dockerize registry', () => {
-  const plan = buildDockerDeployPlan('cad_service', { appSlug: 'agentsam-cad' });
-  assert.equal(plan.slug, 'agentsam-cad');
-  assert.equal(plan.hostPort, 8793);
-  assert.match(plan.files.compose, /agentsam\.type: cad_service/);
-});