@inneranimalmedia/agentsam-sdk 2.6.7 → 2.6.9

package/test/cloudflare-runtime.test.mjs

@@ -1,82 +0,0 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import { buildWranglerInvocation, listWranglerNativeCommands, runWranglerNative, summarizeCloudflareCpuProfile, summarizeCloudflareCpuProfileFile } from '../src/cloudflare/index.js';
-import { createCapabilityAdapter } from '../src/agent/capability-adapter.js';
-
-function tempRoot() { return fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-cf-')); }
-
-test('Cloudflare native command catalog exposes bounded read operations and never an auth-token secret read', () => {
-  const ids = listWranglerNativeCommands().map((row) => row.id);
-  assert.deepEqual(ids, ['whoami', 'deployments.list', 'versions.list', 'versions.view', 'types.check', 'queues.list', 'tunnel.list', 'tunnel.info']);
-  assert.ok(!ids.some((id) => id.includes('token') || id.includes('secret') || id === 'deploy'));
-});
-
-test('Wrangler version view requires an exact version and keeps secret values unavailable', () => {
-  const root = tempRoot();
-  const plan = buildWranglerInvocation('versions.view', { cwd: root, name: 'demo', version_id: 'ver_123' });
-  assert.deepEqual(plan.args, ['versions', 'view', 'ver_123', '--json', '--name', 'demo']);
-  assert.throws(() => buildWranglerInvocation('versions.view', { cwd: root, name: 'demo' }), /version_id_required/);
-});
-
-test('Wrangler native invocation is argv-based and cwd/config scoped', () => {
-  const root = tempRoot();
-  fs.writeFileSync(path.join(root, 'wrangler.jsonc'), '{}');
-  const plan = buildWranglerInvocation('deployments.list', { cwd: root, name: 'demo' });
-  assert.equal(plan.cwd, root);
-  assert.deepEqual(plan.args.slice(0, 4), ['deployments', 'list', '--json', '--name']);
-  assert.equal(plan.args[4], 'demo');
-  assert.ok(plan.args.includes('--config'));
-  assert.throws(() => buildWranglerInvocation('whoami', { cwd: root, config: '../outside.toml' }), /outside_cwd/);
-});
-
-test('Wrangler native result preserves JSON and real exit code on failure', async () => {
-  const root = tempRoot();
-  const success = await runWranglerNative('whoami', { cwd: root }, { run: async () => ({ code: 0, stdout: JSON.stringify({ email: 'dev@example.com' }), stderr: '' }) });
-  assert.equal(success.data.email, 'dev@example.com');
-  await assert.rejects(
-    runWranglerNative('versions.list', { cwd: root }, { run: async () => ({ code: 7, stdout: '', stderr: 'upstream failed' }) }),
-    (error) => error.diagnostic?.exit_code === 7 && error.diagnostic?.code === 'wrangler_exit_nonzero',
-  );
-  await assert.rejects(
-    runWranglerNative('deployments.list', { cwd: root }, { run: async () => ({ code: 1, stdout: '', stderr: 'Authentication error [code: 10000]\nRequest ID: req_cf_1\nCF-Ray: ray-123' }) }),
-    (error) => error.diagnostic?.code === '10000' && error.diagnostic?.request_id === 'req_cf_1' && error.diagnostic?.ray_id === 'ray-123',
-  );
-});
-
-test('CPU profile summary ranks self-time hotspots and explicitly rejects production timer inference', () => {
-  const profile = {
-    nodes: [
-      { id: 1, callFrame: { functionName: 'fetch', url: 'worker.js', lineNumber: 0, columnNumber: 0 } },
-      { id: 2, callFrame: { functionName: 'heavyLoop', url: 'worker.js', lineNumber: 10, columnNumber: 2 } },
-      { id: 3, callFrame: { functionName: '(garbage collector)', url: '', lineNumber: -1, columnNumber: -1 } },
-    ],
-    samples: [1, 2, 2, 3],
-    timeDeltas: [100, 1200, 800, 400],
-  };
-  const summary = summarizeCloudflareCpuProfile(profile);
-  assert.equal(summary.top_frames[0].function, 'heavyLoop');
-  assert.equal(summary.top_frames[0].self_us, 2000);
-  assert.equal(summary.garbage_collection_ms, 0.4);
-  assert.match(summary.timer_semantics, /do not advance during CPU-only execution/);
-});
-
-test('CPU profile file cannot escape runtime cwd', () => {
-  const root = tempRoot();
-  fs.writeFileSync(path.join(root, 'profile.cpuprofile'), JSON.stringify({ nodes: [], samples: [], timeDeltas: [] }));
-  assert.equal(summarizeCloudflareCpuProfileFile({ cwd: root, file: 'profile.cpuprofile' }).file, 'profile.cpuprofile');
-  assert.throws(() => summarizeCloudflareCpuProfileFile({ cwd: root, file: '../profile.cpuprofile' }), /outside_cwd/);
-});
-
-test('explicitly executable experimental Cloudflare capabilities enter cards-first discovery without exposing unavailable commands', () => {
-  const adapter = createCapabilityAdapter();
-  const rows = adapter.toolDescriptors();
-  const ids = rows.map((row) => row.name);
-  assert.ok(ids.includes('cloudflare.wrangler.native'));
-  assert.ok(ids.includes('cloudflare.cpu.profile'));
-  assert.ok(!ids.includes('cloudflare.cpu.audit'));
-  assert.ok(!ids.includes('blender.build'));
-  assert.equal(rows.find((row) => row.name === 'cloudflare.wrangler.native').risk, 'read');
-});

package/test/context.test.mjs

@@ -1,159 +0,0 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import {
-  DEFAULT_RESULT_POLICY,
-  assessContextUsage,
-  compileAgentInstructions,
-  createContextBudget,
-  normalizeResultPolicy,
-  resolveContext,
-  resolveProjectContext,
-} from '../src/context/index.js';
-
-test('default result policy is bounded and callers may request less', () => {
-  assert.deepEqual(DEFAULT_RESULT_POLICY, { max_items: 8, max_chars: 24_000, detail: 'excerpt' });
-  assert.deepEqual(normalizeResultPolicy({ max_items: 3, max_chars: 8_000, detail: 'card' }), { max_items: 3, max_chars: 8_000, detail: 'card' });
-  assert.throws(() => normalizeResultPolicy({ max_items: 9 }), /higher_detail_required:max_items/);
-  assert.throws(() => normalizeResultPolicy({ max_chars: 24_001 }), /higher_detail_required:max_chars/);
-  assert.throws(() => normalizeResultPolicy({ detail: 'full' }), /higher_detail_required:detail/);
-  assert.equal(normalizeResultPolicy({ detail: 'full', max_items: 20, max_chars: 100_000 }, { operation: 'higher-detail' }).detail, 'full');
-});
-
-test('legacy ratio context budget remains compatible for ordinary windows', () => {
-  const budget = createContextBudget({ windowTokens: 250_000 });
-  assert.equal(budget.targetInputTokens, 150_000);
-  assert.equal(budget.hardInputTokens, 212_500);
-  assert.equal(budget.windowChars, 1_000_000);
-  assert.equal(budget.maxSystemChars, 50_000);
-  assert.equal(budget.maxToolSchemaChars, 40_000);
-  assert.equal(budget.maxEvidenceChars, 100_000);
-  assert.equal(budget.maxFileCharsPerRead, 32_768);
-  assert.equal(budget.maxFileCharsPerTurn, 131_072);
-  assert.equal(budget.maxToolResultChars, 24_000);
-});
-
-test('large model capacity is independent from AgentSam working-set and pricing policy', () => {
-  const budget = createContextBudget({
-    windowTokens: 1_050_000,
-    targetInputTokens: 120_000,
-    compactAtTokens: 180_000,
-    interveneAtTokens: 220_000,
-    maxNormalInputTokens: 250_000,
-    pricingThresholdTokens: 272_000,
-    safetyMarginTokens: 22_000,
-  });
-  assert.equal(budget.windowTokens, 1_050_000);
-  assert.equal(budget.targetInputTokens, 120_000);
-  assert.equal(budget.compactAtTokens, 180_000);
-  assert.equal(budget.interveneAtTokens, 220_000);
-  assert.equal(budget.maxNormalInputTokens, 250_000);
-  assert.equal(budget.pricingThresholdTokens, 272_000);
-  assert.ok(budget.targetInputRatio < 0.12);
-
-  assert.equal(assessContextUsage(179_999, budget).shouldCompact, false);
-  assert.equal(assessContextUsage(180_000, budget).shouldCompact, true);
-  assert.equal(assessContextUsage(272_000, budget).pricingThresholdCrossed, false);
-  const crossed = assessContextUsage(272_001, budget);
-  assert.equal(crossed.pricingThresholdCrossed, true);
-  assert.equal(crossed.tokensUntilPricingThreshold, -1);
-});
-
-test('context.resolve separates composition classes and returns an economic receipt', () => {
-  const budget = createContextBudget({
-    windowTokens: 32_000,
-    maxEvidenceChars: 90,
-    maxFileCharsPerRead: 50,
-    maxFileCharsPerTurn: 60,
-    maxToolResultChars: 30,
-  });
-  const pack = resolveContext({
-    objective: 'fix terminal cwd persistence',
-    refs: ['repo:demo'],
-    budget,
-    instructionChars: 20,
-    toolSchemaChars: 12,
-    historyChars: 8,
-    items: [
-      { ref: 'file:low', kind: 'file', priority: 1, content: 'L'.repeat(50) },
-      { ref: 'tool:high', kind: 'tool_result', priority: 10, content: 'T'.repeat(50) },
-      { ref: 'file:high', kind: 'file', priority: 8, content: 'F'.repeat(80) },
-      { ref: 'memory:later', kind: 'memory', priority: 0, content: 'M'.repeat(40) },
-    ],
-  });
-
-  assert.deepEqual(pack.items.map((item) => item.ref), ['tool:high', 'file:high', 'file:low']);
-  assert.equal(pack.items[0].chars, 30);
-  assert.equal(pack.items[1].chars, 50);
-  assert.equal(pack.items[2].chars, 10);
-  assert.equal(pack.receipt.tool_result_chars, 30);
-  assert.equal(pack.receipt.evidence_chars, 60);
-  assert.equal(pack.receipt.instruction_chars, 20);
-  assert.equal(pack.receipt.tool_schema_chars, 12);
-  assert.equal(pack.receipt.history_chars, 8);
-  assert.equal(pack.receipt.chars, 130);
-  assert.equal(pack.receipt.estimate_kind, 'local');
-  assert.equal(pack.receipt.window_tokens, 32_000);
-  assert.equal(pack.receipt.sources_considered, 4);
-  assert.equal(pack.receipt.sources_included, 3);
-  assert.ok(pack.receipt.sources_deferred >= 3);
-  assert.ok(pack.receipt.deferred_refs.includes('memory:later'));
-  assert.deepEqual(pack.receipt.rehydratable_refs, ['tool:high', 'file:high', 'file:low']);
-});
-
-test('AgentSam instructions compile in stable then repository-specific precedence', t => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-instructions-'));
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  fs.mkdirSync(path.join(root, '.git'));
-  fs.writeFileSync(path.join(root, 'AGENTSAM.md'), '# Stable\nbase law\n');
-  fs.writeFileSync(path.join(root, '.agentsamrules'), '# Repo\nlocal law\n');
-  const compiled = compileAgentInstructions(root);
-  assert.deepEqual(compiled.precedence, ['AGENTSAM.md', '.agentsamrules']);
-  assert.equal(compiled.sources.length, 2);
-  assert.ok(compiled.content.indexOf('base law') < compiled.content.indexOf('local law'));
-});
-
-test('compatibility shims are not compiled into AgentSam instruction authority', t => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-instruction-shims-'));
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  fs.mkdirSync(path.join(root, '.git'));
-  fs.writeFileSync(path.join(root, 'AGENTSAM.md'), '# Stable\ncanonical only\n');
-  fs.writeFileSync(path.join(root, 'AGENTS.md'), 'shim should not become policy\n');
-  fs.writeFileSync(path.join(root, 'CLAUDE.md'), 'claude shim should not become policy\n');
-  const compiled = compileAgentInstructions(root);
-  assert.equal(compiled.sources.length, 1);
-  assert.equal(compiled.sources[0].filename, 'AGENTSAM.md');
-  assert.match(compiled.content, /canonical only/);
-  assert.doesNotMatch(compiled.content, /shim should not become policy/);
-  assert.doesNotMatch(compiled.content, /claude shim should not become policy/);
-});
-
-test('project context loads bounded compiled AgentSam instructions', t => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-context-rules-'));
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  fs.mkdirSync(path.join(root, '.git'));
-  fs.writeFileSync(path.join(root, 'AGENTSAM.md'), '# stable\n' + 'a'.repeat(300));
-  fs.writeFileSync(path.join(root, '.agentsamrules'), '# rules\n' + 'x'.repeat(5000) + '\n');
-  const pack = resolveProjectContext({
-    cwd: root,
-    objective: 'inspect repository',
-    budget: createContextBudget({ windowTokens: 8_000, maxSystemChars: 1_000, maxEvidenceChars: 1_000 }),
-    items: [],
-  });
-  assert.equal(pack.rules.found, true);
-  assert.equal(pack.rules.chars, 1_000);
-  assert.equal(pack.rules.truncated, true);
-  assert.equal(pack.receipt.system_chars, 1_000);
-});
-
-test('consumed tool results compact to 4k while preserving rehydration identity', async () => {
-  const { compactConsumedToolResult } = await import('../src/context/index.js');
-  const item = compactConsumedToolResult('x'.repeat(10_000), { ref: 'tool:call_123', hash: 'sha256:abc' });
-  assert.equal(item.ref, 'tool:call_123');
-  assert.equal(item.hash, 'sha256:abc');
-  assert.equal(item.chars, 4_000);
-  assert.equal(item.compacted, true);
-  assert.equal(item.source_chars, 10_000);
-});

package/test/credentials-audit.test.mjs

@@ -1,113 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import {
-  remediateGcloudEdgeServiceAccountKey,
-  remediateGcloudPermissionDenied,
-  remediateGithubTokenShadow,
-  remediateProviderFailure,
-  renderRemediationCard,
-  recommendedCommand,
-} from '../src/lib/provider-command-remediation.js';
-import { runCredentials } from '../src/commands/credentials.js';
-import { listCheatSheetGroups, renderCheatSheet } from '../src/commands/cheat-sheet.js';
-import { collectCredentialsAudit } from '../src/lib/credentials-audit.js';
-
-test('edge-cloud service-account key create remediates to IAM / compute intents', () => {
-  const card = remediateGcloudEdgeServiceAccountKey({
-    argv: ['gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
-    projectId: 'gen-lang-client-0684066529',
-    instance: 'iam-tunnel',
-    zone: 'us-central1-f',
-  });
-  assert.ok(card);
-  assert.equal(card.provider, 'google_cloud');
-  assert.equal(card.kind, 'command_incomplete_wrong_family');
-  assert.match(card.summary, /Distributed Cloud Edge/i);
-  assert.match(card.summary, /Compute Engine/i);
-  const commands = card.actions.map((row) => row.command).join('\n');
-  assert.match(commands, /gcloud compute instances describe iam-tunnel/);
-  assert.match(commands, /gcloud iam service-accounts list/);
-  assert.match(commands, /gcloud iam service-accounts keys create/);
-  assert.match(commands, /agentsam connections/);
-  const rendered = renderRemediationCard(card);
-  assert.match(rendered, /Command incomplete/);
-  assert.match(rendered, /\[enter\]/);
-  assert.equal(recommendedCommand(card), card.actions[0].command);
-});
-
-test('remediateProviderFailure matches edge-cloud argv fixture', () => {
-  const card = remediateProviderFailure({
-    argv: ['gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
-    stderr: 'ERROR: argument OUTPUT_FILE (--service-account : --location): Must be specified.',
-  });
-  assert.ok(card);
-  assert.equal(card.kind, 'command_incomplete_wrong_family');
-});
-
-test('permission denied remediation exposes reauth + IAM console actions', () => {
-  const card = remediateGcloudPermissionDenied({
-    operation: 'compute.instances.list',
-    projectId: 'gen-lang-client-0684066529',
-    connection: 'Google Cloud · InnerAnimalMedia',
-  });
-  assert.equal(card.kind, 'permission_denied');
-  assert.match(renderRemediationCard(card), /Permission missing/);
-  assert.match(renderRemediationCard(card), /Re-authorize Google Cloud/);
-  assert.ok(card.actions.some((row) => /console\.cloud\.google\.com\/iam-admin/i.test(row.docs_url || '')));
-});
-
-test('github token shadow remediation prefers unset + keyring status', () => {
-  const card = remediateGithubTokenShadow({
-    envTokenPresent: true,
-    keyringHealthy: true,
-    scopes: ['repo', 'read:org'],
-  });
-  assert.ok(card);
-  assert.equal(card.kind, 'credential_shadow');
-  assert.match(recommendedCommand(card), /unset GITHUB_TOKEN/);
-});
-
-test('credentials remediate CLI prints edge-cloud card without secrets', async () => {
-  const chunks = [];
-  const code = await runCredentials(
-    ['remediate', '--', 'gcloud', 'edge-cloud', 'service-accounts', 'keys', 'create'],
-    { write: (s) => chunks.push(s) },
-  );
-  assert.equal(code, 0);
-  const out = chunks.join('');
-  assert.match(out, /Google Cloud/);
-  assert.match(out, /gcloud iam service-accounts list/);
-  assert.doesNotMatch(out, /gho_/);
-  assert.doesNotMatch(out, /AIza/);
-});
-
-test('credentials audit --names-only never includes secret-looking values', async () => {
-  const report = await collectCredentialsAudit({
-    env: {
-      HOME: process.env.HOME,
-      AGENTSAM_API_KEY: 'aak_test_should_never_appear_in_output_fields_as_value',
-      GITHUB_TOKEN: 'ghp_should_never_be_echoed',
-      OPENAI_API_KEY: 'sk-should-never-be-echoed',
-    },
-    verify: false,
-    drift: true,
-    namesOnly: true,
-    noNetwork: true,
-  });
-  const blob = JSON.stringify(report);
-  assert.doesNotMatch(blob, /aak_test_should_never/);
-  assert.doesNotMatch(blob, /ghp_should_never/);
-  assert.doesNotMatch(blob, /sk-should-never/);
-  assert.equal(report.shell_presence.GITHUB_TOKEN, true);
-  assert.equal(report.shell_presence.AGENTSAM_API_KEY, true);
-  assert.ok(report.drift.some((row) => row.code === 'github_env_token_present'));
-});
-
-test('cheat-sheet exposes System + Providers groups', () => {
-  const groups = listCheatSheetGroups();
-  assert.ok(groups.some((g) => g.id === 'system'));
-  assert.ok(groups.some((g) => g.id === 'providers'));
-  const text = renderCheatSheet('2.6.4');
-  assert.match(text, /credentials audit/);
-  assert.match(text, /cheat-sheet/);
-});

package/test/deploy-health-scan.test.mjs

@@ -1,95 +0,0 @@
-import assert from 'node:assert/strict';
-import { describe, it } from 'node:test';
-import { scanTextForSecrets } from '../src/lib/deploy/secret-scan.js';
-import { HEALTH_USER_AGENT, parseWranglerVersionId, probeDeployHealth, resolveHealthOrigin } from '../src/lib/deploy/health.js';
-
-describe('deploy secret scan', () => {
-  it('allows fixture oauth values', () => {
-    const findings = scanTextForSecrets(
-      'CLOUDFLARE_OAUTH_CLIENT_ID=sillynotreal\nCLOUDFLARE_OAUTH_CLIENT_SECRET=sillynotreal-secret\n',
-      { filename: 'apps/local-studio/.env.cloudflare.example' },
-    );
-    assert.equal(findings.length, 0);
-  });
-
-  it('flags live openai-like keys', () => {
-    const findings = scanTextForSecrets('OPENAI_API_KEY=sk-abcdefghijklmnopqrstuvwxyz012345');
-    assert.equal(findings.some((f) => f.label === 'openai-like'), true);
-  });
-});
-
-describe('deploy health', () => {
-  it('parses wrangler version ids', () => {
-    assert.equal(
-      parseWranglerVersionId('Current Version ID: e9747d3a-4db6-4e02-b6fe-aa5a47f1588b'),
-      'e9747d3a-4db6-4e02-b6fe-aa5a47f1588b',
-    );
-  });
-
-  it('reads hostname from wrangler.jsonc', () => {
-    const origin = resolveHealthOrigin({
-      wranglerConfigText: '{"routes":[{"pattern":"agentsam.inneranimalmedia.com","custom_domain":true}]}',
-    });
-    assert.equal(origin, 'https://agentsam.inneranimalmedia.com');
-  });
-
-  it('fails loud when wrangler routes pattern is missing', () => {
-    assert.throws(
-      () => resolveHealthOrigin({ wranglerConfigText: '{}' }),
-      (err) => err?.code === 'health_origin_required',
-    );
-  });
-
-  it('treats /health ok:true with connector unconfigured as healthy', async () => {
-    const fetchImpl = async (url) => {
-      if (String(url).endsWith('/health')) {
-        return {
-          status: 200,
-          json: async () => ({ ok: true, connections: { cloudflare: { configured: false } } }),
-        };
-      }
-      return { status: 200, json: async () => ({}) };
-    };
-    const health = await probeDeployHealth('https://agentsam.inneranimalmedia.com', { fetchImpl });
-    assert.equal(health.ok, true);
-    assert.equal(health.results['/health'].appOk, true);
-    assert.equal(health.results['/health'].cloudflareConfigured, false);
-    assert.equal(health.results['/privacy'].ok, true);
-    assert.equal(health.results['/terms'].ok, true);
-  });
-
-  it('fails deploy health when /privacy or /terms are not HTTP 200', async () => {
-    const fetchImpl = async (url) => {
-      const path = String(url).replace(/^https?:\/\/[^/]+/, '');
-      if (path === '/health') {
-        return {
-          status: 200,
-          json: async () => ({ ok: true, connections: { cloudflare: { configured: true } } }),
-        };
-      }
-      if (path === '/privacy' || path === '/terms') {
-        return { status: 404, json: async () => ({}) };
-      }
-      return { status: 200, json: async () => ({}) };
-    };
-    const health = await probeDeployHealth('https://agentsam.inneranimalmedia.com', { fetchImpl });
-    assert.equal(health.ok, false);
-    assert.equal(health.results['/privacy'].ok, false);
-    assert.equal(health.results['/terms'].ok, false);
-  });
-
-  it('sends a browser-safe User-Agent so WAF does not 403 the probe', async () => {
-    const seen = [];
-    const fetchImpl = async (url, init = {}) => {
-      seen.push({ url, init });
-      return {
-        status: 200,
-        json: async () => ({ ok: true, connections: { cloudflare: { configured: false } } }),
-      };
-    };
-    await probeDeployHealth('https://agentsam.inneranimalmedia.com', { fetchImpl, paths: ['/health'] });
-    assert.equal(seen.length, 1);
-    assert.equal(seen[0].init.headers['User-Agent'], HEALTH_USER_AGENT);
-    assert.match(seen[0].init.headers.Accept, /application\/json/);
-  });
-});

package/test/deploy-receipt.test.mjs

@@ -1,91 +0,0 @@
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { execFileSync, spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import {
-  captureDeployReceipt,
-  finalizeDeployReceipt,
-  showLatestDeployReceipt,
-} from '../src/lib/deploy-receipt/index.js';
-
-const cli = fileURLToPath(new URL('../src/cli.js', import.meta.url));
-
-async function fixture(t) {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'agentsam-deploy-receipt-'));
-  t.after(() => fs.rm(root, { recursive: true, force: true }));
-  execFileSync('git', ['init', '-q', root]);
-  execFileSync('git', ['-C', root, 'config', 'user.email', 'receipt-test@example.invalid']);
-  execFileSync('git', ['-C', root, 'config', 'user.name', 'Receipt Test']);
-  await fs.mkdir(path.join(root, 'src'), { recursive: true });
-  await fs.writeFile(path.join(root, 'src/app.js'), 'export const value = 1;\n');
-  execFileSync('git', ['-C', root, 'add', '.']);
-  execFileSync('git', ['-C', root, 'commit', '-qm', 'fixture']);
-  return root;
-}
-
-function run(args, cwd) {
-  return spawnSync(process.execPath, [cli, 'deploy-receipt', ...args], { cwd, encoding: 'utf8', timeout: 15000 });
-}
-
-test('successful finalize advances baseline while failure preserves the last trusted tree', async (t) => {
-  const root = await fixture(t);
-  const first = await captureDeployReceipt({ root, project: 'fixture' });
-  assert.equal(first.receipt.has_baseline, false);
-  assert.equal(first.receipt.baseline_source, 'none');
-  assert.equal(first.receipt.working_tree_dirty, false);
-  assert.ok(!first.snapshot.entries.some((entry) => entry.path.startsWith('.agentsam/deploy-merkle')));
-
-  const promoted = await finalizeDeployReceipt({ root, status: 'success', deploymentId: 'dep_1' });
-  assert.equal(promoted.receipt.status, 'success');
-  assert.equal(promoted.receipt.deployment_id, 'dep_1');
-  assert.equal((await showLatestDeployReceipt({ root })).root_hash, first.receipt.root_hash);
-
-  const clean = await captureDeployReceipt({ root, project: 'fixture' });
-  assert.equal(clean.receipt.has_baseline, true);
-  assert.equal(clean.receipt.baseline_source, 'local');
-  assert.deepEqual(clean.receipt.diff_stats, { unchanged: 1, modified: 0, added: 0, removed: 0 });
-  assert.deepEqual(clean.receipt.changed_files, []);
-  assert.equal(clean.receipt.root_hash, first.receipt.root_hash);
-  assert.equal(clean.receipt.working_tree_dirty, false, 'runtime receipt state must not make the source tree dirty');
-
-  await fs.writeFile(path.join(root, 'src/app.js'), 'export const value = 2;\n');
-  const changed = await captureDeployReceipt({ root, project: 'fixture' });
-  assert.equal(changed.receipt.working_tree_dirty, true);
-  assert.deepEqual(changed.receipt.diff_stats, { unchanged: 0, modified: 1, added: 0, removed: 0 });
-  assert.deepEqual(changed.receipt.changed_files, ['src/app.js']);
-  assert.notEqual(changed.receipt.root_hash, first.receipt.root_hash);
-
-  await finalizeDeployReceipt({ root, status: 'failed', deploymentId: 'dep_2' });
-  assert.equal((await showLatestDeployReceipt({ root })).root_hash, first.receipt.root_hash, 'failed run must not advance baseline');
-
-  const retry = await captureDeployReceipt({ root, project: 'fixture' });
-  assert.deepEqual(retry.receipt.changed_files, ['src/app.js']);
-  await finalizeDeployReceipt({ root, status: 'success', deploymentId: 'dep_3' });
-  const settled = await captureDeployReceipt({ root, project: 'fixture' });
-  assert.deepEqual(settled.receipt.diff_stats, { unchanged: 1, modified: 0, added: 0, removed: 0 });
-  assert.deepEqual(settled.receipt.changed_files, []);
-});
-
-test('deploy-receipt CLI emits machine-readable capture/finalize/show receipts', async (t) => {
-  const root = await fixture(t);
-  const capture = run(['capture', '.', '--project', 'cli-fixture', '--json'], root);
-  assert.equal(capture.status, 0, capture.stderr);
-  const captured = JSON.parse(capture.stdout);
-  assert.equal(captured.format, 'agentsam-deploy-merkle');
-  assert.equal(captured.project, 'cli-fixture');
-  assert.equal(captured.status, 'captured');
-
-  const success = run(['success', '.', '--deployment-id', 'dep_cli', '--worker-version', 'worker_v1', '--json'], root);
-  assert.equal(success.status, 0, success.stderr);
-  const finalized = JSON.parse(success.stdout);
-  assert.equal(finalized.status, 'success');
-  assert.equal(finalized.deployment_id, 'dep_cli');
-  assert.equal(finalized.worker_version_id, 'worker_v1');
-
-  const show = run(['show', '.', '--json'], root);
-  assert.equal(show.status, 0, show.stderr);
-  assert.equal(JSON.parse(show.stdout).root_hash, finalized.root_hash);
-});

package/test/dockerize.test.mjs

@@ -1,93 +0,0 @@
-// Pure unit tests — no Docker daemon required, safe for CI/smoke.
-// Integration coverage (actual docker build/run) is manual: see docs/DOCKERIZE.md.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import {
-  DOCKER_APP_TYPES,
-  DOCKER_APP_TYPE_LABELS,
-  slugifyForDocker,
-  generateDockerFileSet,
-  computeFileSetHash,
-  buildDockerDeployPlan,
-  writeDockerFileSet,
-  readManifest,
-} from '../src/lib/dockerize.js';
-
-test('slugifyForDocker normalizes to a safe image/container name', () => {
-  assert.equal(slugifyForDocker('My Cool App!'), 'my-cool-app');
-  assert.equal(slugifyForDocker('  --leading-- '), 'leading');
-  assert.equal(slugifyForDocker(''), 'app');
-});
-
-test('every declared app type has a label and generates a valid file set', () => {
-  for (const type of DOCKER_APP_TYPES) {
-    assert.ok(DOCKER_APP_TYPE_LABELS[type]?.label, `missing label for ${type}`);
-    const files = generateDockerFileSet(type, { appSlug: 'test-app', port: 9999 });
-    assert.match(files.dockerfile, /^FROM /m, `${type} Dockerfile must start with FROM`);
-    assert.ok(files.dockerignore.includes('node_modules'), `${type} .dockerignore should ignore node_modules`);
-    assert.ok(files.compose.includes('services:'), `${type} compose file must define services`);
-  }
-});
-
-test('unknown app type throws a clear error instead of generating garbage', () => {
-  assert.throws(() => generateDockerFileSet('not_a_real_type', { appSlug: 'x' }), /Unknown Docker app type/);
-});
-
-test('buildDockerDeployPlan picks correct container port for static/vite (80) vs service types (host port)', () => {
-  const staticPlan = buildDockerDeployPlan('static', { appSlug: 'x', port: 8080 });
-  assert.equal(staticPlan.containerPort, 80);
-  assert.equal(staticPlan.hostPort, 8080);
-
-  const nodePlan = buildDockerDeployPlan('node_service', { appSlug: 'x', port: 4000 });
-  assert.equal(nodePlan.containerPort, 4000);
-  assert.equal(nodePlan.hostPort, 4000);
-});
-
-test('buildDockerDeployPlan falls back to sensible default ports when none given', () => {
-  const plan = buildDockerDeployPlan('wrangler_dev', { appSlug: 'x' });
-  assert.equal(plan.hostPort, 8787);
-  assert.equal(plan.imageTag, 'x:local'.replace('local', plan.hash));
-});
-
-test('computeFileSetHash is deterministic: identical content -> identical hash', () => {
-  const a = generateDockerFileSet('node_service', { appSlug: 'same', port: 3000 });
-  const b = generateDockerFileSet('node_service', { appSlug: 'same', port: 3000 });
-  assert.equal(computeFileSetHash(a), computeFileSetHash(b));
-});
-
-test('computeFileSetHash changes when content changes (different port -> different hash)', () => {
-  const a = generateDockerFileSet('node_service', { appSlug: 'same', port: 3000 });
-  const b = generateDockerFileSet('node_service', { appSlug: 'same', port: 4000 });
-  assert.notEqual(computeFileSetHash(a), computeFileSetHash(b));
-});
-
-test('buildDockerDeployPlan image tag and hashtag are hash-derived and match the slug', () => {
-  const plan = buildDockerDeployPlan('static', { appSlug: 'My App', port: 8080 });
-  assert.equal(plan.slug, 'my-app');
-  assert.equal(plan.imageTag, `my-app:${plan.hash}`);
-  assert.equal(plan.latestTag, 'my-app:latest');
-  assert.equal(plan.hashtag, `#docker-my-app-${plan.hash}`);
-});
-
-test('writeDockerFileSet writes into .agentsam/docker/<hash>/ and .dockerignore at root, and the manifest round-trips', () => {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-dockerize-test-'));
-  try {
-    const files = generateDockerFileSet('static', { appSlug: 'tmp-app', port: 9090 });
-    const hash = computeFileSetHash(files);
-    const written = writeDockerFileSet(tmp, files, hash);
-
-    assert.equal(written.dockerfilePath, path.join(tmp, '.agentsam', 'docker', hash, 'Dockerfile'));
-    assert.ok(fs.existsSync(written.dockerfilePath));
-    assert.ok(fs.existsSync(written.composePath));
-    assert.ok(fs.existsSync(path.join(tmp, '.dockerignore')));
-
-    // manifest is populated by dockerize()/writeManifestEntry, not writeDockerFileSet itself —
-    // confirm readManifest returns {} when nothing has written to it yet
-    assert.deepEqual(readManifest(tmp), {});
-  } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
-  }
-});