@inneranimalmedia/agentsam-sdk 2.6.7 → 2.6.8

package/test/integration/desktop-keychain-boundary.test.mjs

@@ -1,45 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-
-const main = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/main.rs', import.meta.url), 'utf8');
-const keychain = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/commands/keychain.rs', import.meta.url), 'utf8');
-const tauriClient = readFileSync(new URL('../../apps/local-studio/frontend/src/lib/desktop/tauri.ts', import.meta.url), 'utf8');
-const identityBridge = readFileSync(new URL('../../packages/identity/src/frontend/auth-portal/shared/desktop-identity-bridge.js', import.meta.url), 'utf8');
-const localIdentity = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/commands/local_identity.rs', import.meta.url), 'utf8');
-const googleIdentity = readFileSync(new URL('../../packages/agentsam-desktop-shell/src-tauri/src/commands/google_desktop_identity.rs', import.meta.url), 'utf8');
-
-test('desktop webview cannot invoke a generic secure-store read', () => {
-  for (const forbidden of [
-    'keychain::get_token',
-    'keychain::secure_store_get',
-    '"secure_store_get"',
-  ]) {
-    assert.equal(main.includes(forbidden), false, `main.rs must not register ${forbidden}`);
-    assert.equal(tauriClient.includes(forbidden), false, `frontend must not invoke ${forbidden}`);
-    assert.equal(identityBridge.includes(forbidden), false, `desktop identity bridge must not invoke ${forbidden}`);
-  }
-});
-
-test('provider key command surface never exposes get', () => {
-  assert.match(main, /keychain::provider_key_exists/);
-  assert.match(main, /keychain::provider_key_set/);
-  assert.match(main, /keychain::provider_key_delete/);
-  assert.doesNotMatch(main, /keychain::provider_key_get/);
-  assert.match(keychain, /pub\(crate\) fn provider_key_get_internal/);
-  assert.doesNotMatch(keychain, /#\[tauri::command\]\s*\npub\(crate\) fn provider_key_get_internal/);
-});
-
-test('keychain app namespace is derived natively', () => {
-  assert.match(keychain, /const KEYCHAIN_APP_ID: &str = "local-studio"/);
-  assert.doesNotMatch(keychain, /pub fn .*\(app_id:/);
-});
-
-test('desktop bearer sessions stay behind Rust', () => {
-  assert.doesNotMatch(tauriClient, /identity_store_get|identity_store_set|identity_store_delete/);
-  assert.doesNotMatch(identityBridge, /identity_store_get|identity_store_set|identity_store_delete/);
-  assert.match(localIdentity, /identity_session_get_internal/);
-  assert.match(localIdentity, /identity_session_set_internal/);
-  assert.match(googleIdentity, /#\[serde\(skip_serializing\)\]\s*pub session_id/);
-  assert.match(googleIdentity, /identity_session_set_internal/);
-});

package/test/integration/error-runtime-rpc.test.mjs

@@ -1,71 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-
-import {
-  AgentSamError,
-  createErrorEnvelope,
-} from '../../packages/agentsam-errors/src/index.js';
-import {
-  decodeErrorDetail,
-  decodeJob,
-  encodeErrorDetail,
-  encodeJob,
-  fromGrpcError,
-  toGrpcError,
-} from '../../src/knowledge/service/grpc-codec.js';
-
-function sampleEnvelope() {
-  return createErrorEnvelope({
-    reason: 'provider_budget_exhausted',
-    message: 'Provider account budget is exhausted.',
-    source: { kind: 'provider', name: 'openai', service: 'responses' },
-    resolution_owner: 'agentsam',
-    severity: 'blocking_internal',
-    remediation: { action: 'inspect_platform', message: 'AgentSam must inspect its platform-owned OpenAI account.' },
-    domain: 'provider',
-    tool: 'openai',
-    stage: 'request',
-    provider: 'openai',
-    provider_code: 'project_spend_limit_exceeded',
-    request_id: 'req_123',
-    trace_id: 'trace_123',
-    transport: 'grpc',
-    resource: { type: 'provider_account', id: 'platform', name: 'OpenAI' },
-    native: { code: 'project_spend_limit_exceeded', exception_type: 'insufficient_quota' },
-    environment: { component: 'responses', runtime: 'node', platform: 'linux' },
-    details: { tier: 'default' },
-  });
-}
-
-test('protobuf ErrorDetail preserves the canonical AgentSam envelope', () => {
-  const source = sampleEnvelope();
-  const roundTrip = decodeErrorDetail(encodeErrorDetail(source));
-  assert.deepEqual(roundTrip, source);
-});
-
-test('gRPC exception metadata round-trips one canonical AgentSamError', () => {
-  const source = sampleEnvelope();
-  const wireError = toGrpcError(new AgentSamError(source));
-  const decoded = fromGrpcError(wireError);
-  assert.ok(decoded instanceof AgentSamError);
-  assert.deepEqual(decoded.envelope, source);
-  assert.equal(decoded.grpcCode, 8);
-  assert.equal(decoded.rpcCode, 'RESOURCE_EXHAUSTED');
-});
-
-test('durable job protobuf retains structured failure and compatibility message', () => {
-  const failure = sampleEnvelope();
-  const message = encodeJob({
-    id: '11111111-1111-1111-1111-111111111111',
-    status: 'failed',
-    attempts: 2,
-    created_at: '2026-09-17T00:00:00.000Z',
-    updated_at: '2026-09-17T00:01:00.000Z',
-    result: null,
-    failure,
-  });
-  const decoded = decodeJob(message);
-  assert.equal(decoded.status, 'failed');
-  assert.deepEqual(decoded.failure, failure);
-  assert.equal(decoded.error, failure.message);
-});

package/test/integration/features-resolve.test.mjs

@@ -1,147 +0,0 @@
-/**
- * Feature-packet resolver tests — package-local oauth-login-portal compartment.
- */
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-import {
-  formatResourcesSummary,
-  getIdentityProviderTemplate,
-  loadIdentityResources,
-  loadOAuthLoginPortalFeature,
-  resolveAuthFeature,
-  writeFeatureSelections,
-  writeFeaturesResolved,
-} from '../../src/features/resolve.js';
-
-const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
-
-test('oauth-login-portal feature packet loads with artifacts', () => {
-  const feature = loadOAuthLoginPortalFeature();
-  assert.equal(feature.id, 'identity.oauth-login-portal');
-  assert.ok(Array.isArray(feature.artifacts));
-  assert.ok(feature.artifacts.some((a) => a.kind === 'provider-catalog'));
-  assert.ok(!fs.existsSync(path.join(SDK_ROOT, 'protocol/identity')));
-  assert.ok(!fs.existsSync(path.join(SDK_ROOT, 'protocol/features/auth.json')));
-});
-
-test('auth feature resolves real D1 resources, not a pretend iam-d1 profile', () => {
-  const resolved = resolveAuthFeature({
-    selected: true,
-    capabilities: ['identity.init'],
-    provider_template: 'google',
-    selected_at: '2026-09-24T04:25:12.860Z',
-  });
-  assert.equal(resolved.provider_template, 'google');
-  assert.equal(resolved.provider.id, 'google');
-  assert.equal(resolved.provider.status, 'ready');
-  assert.equal(resolved.schema_profile, undefined);
-  assert.equal(resolved.resources.engine, 'd1');
-  assert.deepEqual(resolved.resources.migration_sources, [
-    'src/migrations/0001_identity_core.sql',
-    'src/migrations/0002_company.sql',
-    'src/migrations/0003_accounts_ssot.sql',
-  ]);
-  const names = resolved.resources.tables.map((t) => t.name);
-  assert.deepEqual(names, [
-    'accounts',
-    'auth_users',
-    'auth_sessions',
-    'account_identities',
-    'oauth_states',
-    'password_reset_tokens',
-    'company',
-  ]);
-  assert.match(formatResourcesSummary(resolved.resources), /tables=accounts,auth_users,/);
-  assert.doesNotMatch(formatResourcesSummary(resolved.resources), /iam-d1/);
-});
-
-test('legacy iam provider_template normalizes to inneranimalmedia', () => {
-  const resolved = resolveAuthFeature({
-    selected: true,
-    capabilities: ['identity.init'],
-    provider_template: 'iam',
-  });
-  assert.equal(resolved.provider_template, 'inneranimalmedia');
-  assert.equal(resolved.provider.id, 'inneranimalmedia');
-  assert.equal(resolved.provider.oauth_provider_key, 'iam');
-  assert.equal(resolved.provider.status, 'ready');
-});
-
-test('cloudflare is registered ready in provider catalog', () => {
-  const provider = getIdentityProviderTemplate('cloudflare');
-  assert.equal(provider?.status, 'ready');
-  assert.equal(provider?.registered, true);
-});
-
-test('resources.json indexes D1 tables without owning DDL', () => {
-  const resources = loadIdentityResources();
-  assert.equal(resources.engine, 'd1');
-  assert.deepEqual(resources.migration_sources, [
-    'src/migrations/0001_identity_core.sql',
-    'src/migrations/0002_company.sql',
-    'src/migrations/0003_accounts_ssot.sql',
-  ]);
-  const names = resources.tables.map((t) => t.name);
-  assert.ok(names.includes('auth_users'));
-  assert.ok(names.includes('company'));
-});
-
-test('writeFeatureSelections emits schema_version 2 and resolved snapshot', () => {
-  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-features-'));
-  try {
-    fs.mkdirSync(path.join(cwd, '.agentsam'), { recursive: true });
-    const { state_path, resolved_path, snapshot } = writeFeatureSelections(cwd, {
-      schema_version: 2,
-      features: {
-        auth: {
-          selected: true,
-          capabilities: ['identity.init'],
-          provider_template: 'inneranimalmedia',
-          selected_at: '2026-09-24T04:25:12.860Z',
-        },
-      },
-    });
-    const state = JSON.parse(fs.readFileSync(state_path, 'utf8'));
-    assert.equal(state.schema_version, 2);
-    assert.equal(state.features.auth.provider_template, 'inneranimalmedia');
-    assert.equal(snapshot.features.auth.resources.engine, 'd1');
-    assert.ok(snapshot.features.auth.resources.tables.some((t) => t.name === 'auth_users'));
-    assert.equal(snapshot.features.auth.schema_profile, undefined);
-    assert.ok(fs.existsSync(resolved_path));
-  } finally {
-    fs.rmSync(cwd, { recursive: true, force: true });
-  }
-});
-
-test('sdk-style project selections resolve against package packet without local machine state', () => {
-  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-sdk-feature-select-'));
-  try {
-    const { snapshot } = writeFeaturesResolved(cwd, null, {
-      selections: {
-        schema_version: 2,
-        features: {
-          auth: {
-            selected: true,
-            capabilities: ['identity.init'],
-            provider_template: 'inneranimalmedia',
-          },
-        },
-      },
-    });
-    assert.equal(snapshot.schema, 'agentsam.features.resolved.v1');
-    assert.equal(snapshot.features.auth.provider_template, 'inneranimalmedia');
-    assert.equal(snapshot.features.auth.feature.id, 'identity.oauth-login-portal');
-    assert.equal(snapshot.features.auth.resources.engine, 'd1');
-    assert.match(
-      formatResourcesSummary(snapshot.features.auth.resources),
-      /auth_users,auth_sessions,account_identities/,
-    );
-  } finally {
-    fs.rmSync(cwd, { recursive: true, force: true });
-  }
-});

package/test/integration/hosted-work-host-authority.test.mjs

@@ -1,47 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
-
-const root = join(dirname(fileURLToPath(import.meta.url)), "../..");
-
-test("LocalStudioWorkPage defaults to HTTP WorkHost, not populated fixture", () => {
-  const source = readFileSync(
-    join(root, "apps/local-studio/frontend/src/components/work/LocalStudioWorkPage.tsx"),
-    "utf8",
-  );
-  assert.match(source, /createHttpWorkHost/);
-  assert.match(source, /resolveWorkHostMode/);
-  assert.match(source, /VITE_WORK_FIXTURE/);
-  // Fixture must be opt-in only
-  assert.match(source, /fixture === "populated"/);
-  assert.doesNotMatch(
-    source,
-    /createFixtureWorkHost\(populatedWorkFixture\)\s*,\s*\[\s*\]/,
-  );
-});
-
-test("agentsam-work theme does not hardcode Inter", () => {
-  const css = readFileSync(
-    join(root, "packages/agentsam-work/src/frontend/theme.css"),
-    "utf8",
-  );
-  assert.doesNotMatch(css, /font-family:\s*Inter/);
-  assert.match(css, /--font-sans/);
-});
-
-test("worker mounts /api/work/snapshot", () => {
-  const index = readFileSync(
-    join(root, "apps/local-studio/backend/worker/index.js"),
-    "utf8",
-  );
-  const service = readFileSync(
-    join(root, "apps/local-studio/backend/worker/work-service.js"),
-    "utf8",
-  );
-  assert.match(index, /handleWorkRequest/);
-  assert.match(service, /\/api\/work\/snapshot/);
-  assert.match(service, /fixtureName: 'live'/);
-  assert.doesNotMatch(service, /Companions of CPAS|AgentSamRemix|runtime-receipts\.md/);
-});

package/test/integration/icon-registry.test.mjs

@@ -1,67 +0,0 @@
-import assert from 'node:assert/strict';
-import { describe, it } from 'node:test';
-import {
-  AGENTSAM_ICON_KEYS,
-  normalizeIconKey,
-  isAgentsamIconKey,
-  resolveCliIconGlyph,
-  createIconRenderer,
-  ICON_ALIASES,
-} from '../../protocol/ui/icon-registry.mjs';
-import iconSchema from '../../protocol/ui/icon.v1.schema.json' with { type: 'json' };
-
-describe('agentsam.icon.v1', () => {
-  it('schema enum matches registry keys', () => {
-    assert.deepEqual([...(iconSchema.enum || [])].sort(), [...AGENTSAM_ICON_KEYS].sort());
-  });
-
-  it('includes generic fallback and first-class AgentSam concepts', () => {
-    for (const key of [
-      'generic',
-      'database',
-      'vector',
-      'identity',
-      'key',
-      'brand',
-      'theme',
-      'app',
-      'repository',
-      'connection',
-      'metrics',
-    ]) {
-      assert.equal(isAgentsamIconKey(key), true, key);
-    }
-  });
-
-  it('normalizes aliases and rejects lucide/emoji-like values to generic', () => {
-    assert.equal(normalizeIconKey('db'), 'database');
-    assert.equal(normalizeIconKey('repo'), 'repository');
-    assert.equal(normalizeIconKey('lucide-database'), 'database');
-    assert.equal(normalizeIconKey('🗄️'), 'generic');
-    assert.equal(normalizeIconKey(''), 'generic');
-    assert.equal(normalizeIconKey('unknown-future-key'), 'generic');
-  });
-
-  it('createIconRenderer falls back to generic without throwing', () => {
-    const render = createIconRenderer(
-      { database: 'DB', generic: 'G', identity: 'ID' },
-      'FALLBACK',
-    );
-    assert.equal(render('database'), 'DB');
-    assert.equal(render('db'), 'DB');
-    assert.equal(render('not-a-real-icon'), 'G');
-    assert.equal(render('identity'), 'ID');
-  });
-
-  it('CLI glyphs always resolve', () => {
-    assert.ok(resolveCliIconGlyph('database'));
-    assert.equal(resolveCliIconGlyph('totally-unknown'), resolveCliIconGlyph('generic'));
-  });
-
-  it('aliases only map to canonical vocabulary', () => {
-    for (const [from, to] of Object.entries(ICON_ALIASES)) {
-      assert.equal(isAgentsamIconKey(to), true, `${from} → ${to}`);
-      assert.equal(normalizeIconKey(from), to);
-    }
-  });
-});

package/test/integration/ingest-discover-models.test.mjs

@@ -1,30 +0,0 @@
-import assert from 'node:assert/strict';
-import { describe, it } from 'node:test';
-import {
-  encodeEmbeddingChoice,
-  parseEmbeddingChoice,
-  looksLikeEmbedModel,
-} from '../../src/indexing/ingest/discover-models.js';
-
-describe('ingest model discovery helpers', () => {
-  it('encodes/decodes embedding choices without breaking model ids that contain colons', () => {
-    const value = encodeEmbeddingChoice('ollama', 'mxbai-embed-large:latest', 1024);
-    assert.equal(value, 'ollama|mxbai-embed-large:latest|1024');
-    const parsed = parseEmbeddingChoice(value);
-    assert.equal(parsed.provider, 'ollama');
-    assert.equal(parsed.model, 'mxbai-embed-large:latest');
-    assert.equal(parsed.dimensions, 1024);
-  });
-
-  it('treats none as disabled embedding', () => {
-    const parsed = parseEmbeddingChoice('none');
-    assert.equal(parsed.provider, 'none');
-    assert.equal(parsed.dimensions, 0);
-  });
-
-  it('classifies ollama embed vs chat tags', () => {
-    assert.equal(looksLikeEmbedModel('mxbai-embed-large:latest'), true);
-    assert.equal(looksLikeEmbedModel('nomic-embed-text'), true);
-    assert.equal(looksLikeEmbedModel('qwen2.5-coder:latest'), false);
-  });
-});

package/test/integration/inspect-path-cli.test.mjs

@@ -1,46 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
-const CLI = path.join(ROOT, 'bin/agentsam');
-
-function run(args, cwd = ROOT) {
-  return spawnSync(process.execPath, [CLI, ...args], {
-    cwd,
-    encoding: 'utf8',
-    env: { ...process.env, NO_COLOR: '1' },
-  });
-}
-
-function jsonFrom(text) {
-  const start = text.indexOf('{');
-  assert.notEqual(start, -1, `expected JSON output, received: ${text}`);
-  return JSON.parse(text.slice(start));
-}
-
-test('agentsam inspect --help documents the positional path world-state contract', () => {
-  const result = run(['inspect', '--help']);
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /agentsam inspect \[path\]/);
-  assert.match(result.stdout, /deterministic repository world state/i);
-  assert.match(result.stdout, /No model, embeddings, network, provider spend/i);
-});
-
-test('agentsam inspect accepts a repository path as the first positional argument', () => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-inspect-path-'));
-  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'inspect-fixture', version: '1.0.0' }));
-  fs.mkdirSync(path.join(root, 'src'));
-  fs.writeFileSync(path.join(root, 'src/index.js'), 'export function fixture() { return 42; }\n');
-
-  const result = run(['inspect', root, '--json', '--index']);
-  assert.equal(result.status, 0, result.stderr || result.stdout);
-  const output = jsonFrom(result.stdout);
-  assert.ok(output.snapshot_id);
-  assert.ok(output.merkle_root || output.tree?.merkle_root);
-  assert.match(JSON.stringify(output), /inspect-fixture|src\/index\.js/);
-});

package/test/integration/install-script.test.mjs

@@ -1,110 +0,0 @@
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
-const installScript = path.join(root, 'scripts/install.sh');
-
-test('install.sh is a bash npm bootstrap with platform detection', () => {
-  const source = fs.readFileSync(installScript, 'utf8');
-  assert.match(source, /AgentSam installer/);
-  assert.match(source, /npm install --global/);
-  assert.match(source, /Darwin-arm64/);
-  assert.match(source, /--version/);
-  assert.match(source, /--app-id/);
-  assert.match(source, /--app/);
-  assert.doesNotMatch(source, /APP_SELECTOR="\$\{AGENTSAM_DEFAULT_APP/);
-  assert.match(source, /standalone_ready/);
-  assert.match(source, /checksum_contract/);
-});
-
-test('install.sh passes bash syntax validation', () => {
-  const result = spawnSync('bash', ['-n', installScript], { encoding: 'utf8' });
-  assert.equal(result.status, 0, result.stderr);
-});
-
-test('install.sh maps --app-id and legacy --app aliases to executable launchers', () => {
-  const cases = [
-    ['cad', 'cad-creator', 'agentsam-cad-creator'],
-    ['cms', 'client-cms-editor', 'agentsam-cms'],
-    ['studio', 'local-studio', 'agentsam-studio'],
-    ['database-editor', 'database-editor', 'agentsam-database-editor'],
-  ];
-
-  for (const [alias, appId, executable] of cases) {
-    const temp = fs.mkdtempSync(path.join(os.tmpdir(), `agentsam-install-${alias}-`));
-    const fakeBin = path.join(temp, 'fake-bin');
-    const installRoot = path.join(temp, 'home');
-    const binDir = path.join(temp, 'bin');
-    fs.mkdirSync(fakeBin, { recursive: true });
-
-    fs.writeFileSync(
-      path.join(fakeBin, 'uname'),
-      '#!/usr/bin/env bash\ncase "$1" in -s) echo Darwin ;; -m) echo arm64 ;; esac\n',
-      { mode: 0o755 },
-    );
-    fs.writeFileSync(
-      path.join(fakeBin, 'node'),
-      '#!/usr/bin/env bash\ncase "$*" in *split*) echo 22 ;; *) echo 22.14.0 ;; esac\n',
-      { mode: 0o755 },
-    );
-    fs.writeFileSync(path.join(fakeBin, 'npm'), '#!/usr/bin/env bash\nexit 0\n', { mode: 0o755 });
-    fs.writeFileSync(
-      path.join(fakeBin, 'agentsam'),
-      '#!/usr/bin/env bash\necho "agentsam 2.6.2"\n',
-      { mode: 0o755 },
-    );
-
-    try {
-      const flag = alias === 'database-editor' ? '--app-id' : '--app';
-      const result = spawnSync('bash', [installScript, flag, alias, '--prefix', binDir], {
-        encoding: 'utf8',
-        env: {
-          ...process.env,
-          PATH: `${fakeBin}:${process.env.PATH}`,
-          HOME: temp,
-          AGENTSAM_HOME: installRoot,
-        },
-      });
-      assert.equal(result.status, 0, result.stderr);
-
-      const launcherPath = path.join(binDir, executable);
-      const launcher = fs.readFileSync(launcherPath, 'utf8');
-      assert.match(launcher, new RegExp(`app preview ${appId}`));
-      assert.ok((fs.statSync(launcherPath).mode & 0o111) !== 0);
-
-      const receipt = JSON.parse(fs.readFileSync(path.join(installRoot, 'install-receipt.json'), 'utf8'));
-      assert.equal(receipt.app_id, appId);
-      assert.equal(receipt.app, appId);
-    } finally {
-      fs.rmSync(temp, { recursive: true, force: true });
-    }
-  }
-});
-
-test('install.sh rejects unknown --app-id values before installation', () => {
-  const result = spawnSync('bash', [installScript, '--app-id', 'unknown'], { encoding: 'utf8' });
-  assert.equal(result.status, 2);
-  assert.match(result.stderr, /unknown app/);
-});
-
-test('Local Studio Worker serves installer without AGENTSAM_DEFAULT_APP mutation', () => {
-  const worker = fs.readFileSync(
-    path.join(root, 'apps/local-studio/backend/worker/index.js'),
-    'utf8',
-  );
-  const wrangler = fs.readFileSync(
-    path.join(root, 'apps/local-studio/backend/wrangler.jsonc'),
-    'utf8',
-  );
-
-  assert.match(worker, /import installScript from "\.\.\/\.\.\/\.\.\/\.\.\/scripts\/install\.sh"/);
-  assert.doesNotMatch(worker, /APP_SELECTOR="\\\$\{AGENTSAM_DEFAULT_APP/);
-  assert.match(worker, /text\/x-shellscript/);
-  assert.match(wrangler, /"type": "Text"/);
-  assert.match(wrangler, /"\*\*\/\*\.sh"/);
-});

package/test/integration/inventory-core.test.mjs

@@ -1,53 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import {
-  assertModelAvailableForProvider,
-  collectCredentialScopedInventory,
-  filterWorkersAiCurated,
-  makeMapCredentialResolver,
-  sanitizeInventoryForClient,
-} from '../../src/models/inventory-core.js';
-
-test('assertModelAvailableForProvider fails closed on mismatch', () => {
-  assert.throws(
-    () => assertModelAvailableForProvider({ availableModels: [{ provider: 'openai', model_id: 'gpt-x' }] }, 'openai', 'other'),
-    /selected_model_not_available/,
-  );
-  const row = assertModelAvailableForProvider(
-    { availableModels: [{ provider: 'openai', model_id: 'gpt-x', provider_model_id: 'gpt-x' }] },
-    'openai',
-    'gpt-x',
-  );
-  assert.equal(row.model_id, 'gpt-x');
-});
-
-test('vault-scoped inventory sanitizes secrets and discovers only injected providers', async () => {
-  const status = await collectCredentialScopedInventory({
-    credentialPlane: 'studio_vault',
-    resolveCredential: makeMapCredentialResolver(new Map([
-      ['openai', { value: 'sk-secret-should-not-leak', source: 'user_vault' }],
-    ])),
-    fetchImpl: async (url) => {
-      if (String(url).includes('api.openai.com')) {
-        return { ok: true, status: 200, async json() { return { data: [{ id: 'gpt-test' }] }; } };
-      }
-      throw new Error('unexpected ' + url);
-    },
-  });
-  const safe = sanitizeInventoryForClient(status);
-  const text = JSON.stringify(safe);
-  assert.doesNotMatch(text, /sk-secret-should-not-leak/);
-  assert.doesNotMatch(text, /"value"/);
-  assert.equal(safe.credential_plane, 'studio_vault');
-  assert.equal(safe.providers.find((p) => p.id === 'openai')?.source, 'user_vault');
-  assert.deepEqual(safe.availableModels.map((m) => m.model_id), ['gpt-test']);
-  assert.equal(safe.providers.find((p) => p.id === 'gemini')?.configured, false);
-});
-
-test('Workers AI curated filter intersects', () => {
-  const rows = filterWorkersAiCurated([
-    { provider_model_id: '@cf/qwen/qwen2.5-coder-32b-instruct' },
-    { provider_model_id: '@cf/meta/llama-3.2-1b-instruct' },
-  ]);
-  assert.deepEqual(rows.map((r) => r.provider_model_id), ['@cf/qwen/qwen2.5-coder-32b-instruct']);
-});