test: pin shared application authentication cases

.agents/README.md

@@ -58,3 +58,5 @@ state. A local/runtime result is not cloud acceptance or package publication.
 - [Public runtime a4](notes/implemented/process/2026-10-25-public-runtime-a4.md) · [verification](evidence/verify/2026-10-25-public-runtime-a4.md).
 
 - [Coordinated public runtime a6](notes/proposed/process/2026-10-25-public-runtime-a6.md) · [verification](evidence/verify/2026-10-25-public-runtime-a6.md).
+
+- [Shared application authentication tests](notes/proposed/feature/2026-10-26-shared-application-auth-tests.md) · [verification](evidence/verify/2026-10-26-shared-application-auth-tests.md).

.agents/evidence/verify/2026-10-26-shared-application-auth-tests.md

@@ -0,0 +1,21 @@
+# Verification: shared application authentication tests
+
+- Date: 2026-10-26
+- Result: PASS for the unchanged runtime and shared test contract
+- Change: test fixture and ServerClient authHeaders regressions; runtime source unchanged.
+- Environment: Node 22.22.2, Python 3.13; source client/server 0.4.0a6 in an isolated virtual environment.
+
+## Commands run
+
+- `npm ci --ignore-scripts --no-audit --no-fund` — PASS.
+- `npm run typecheck` — PASS.
+- `npm test` without the Python runtime on PATH — FAIL: two existing agent-loop tests could not import the server; 27 other tests passed.
+- `npm test` with the isolated Python runtime on PATH — PASS: 29 tests including the real local server loop and all five common authentication vectors.
+
+## Cleanup
+
+Local server processes were stopped by their existing tests. No cloud resources created.
+
+## Not verified
+
+The canonical fixture is byte-identical to Python owner commit 98642ae6712a5017e187cae7952a2b3c819c1ece; CI checks that pinned copy. PR https://github.com/Alibaba-Agent-Sandbox/nodejs-sdk/pull/21 passed both required Node 20 and Node 22 jobs at f25a18ed41a30091f7029b864e621938f8b441db. Owner dependency https://github.com/Alibaba-Agent-Sandbox/python-sdk/pull/142 must land first; latest-head checks/review and merge are verified separately. This is not an npm publication or whole-template cloud claim.

.agents/notes/proposed/feature/2026-10-26-shared-application-auth-tests.md

@@ -0,0 +1,38 @@
+# Decision: Verify the common application authentication contract
+
+Status: proposed
+
+## Problem
+
+The Node HTTP client, Python client and CLI had separately maintained authentication examples. CLI onboarding improvements should not add commands or configuration responsibilities to this library.
+
+## Decision
+
+Consume the Python-owned authentication test vectors and run them against ServerClient.authHeaders. Keep runtime implementation and public exports unchanged. Retain independent SDK installation.
+
+## API Design
+
+N/A — additive test fixtures only; constructor-based authentication remains unchanged.
+
+## Alternatives considered
+
+- Import the CLI implementation: unnecessary package coupling.
+- Add interactive SDK configuration: outside the library's scope.
+
+## Dependencies
+
+Canonical source: https://github.com/Alibaba-Agent-Sandbox/python-sdk. Related CLI work: https://github.com/Alibaba-Agent-Sandbox/agent-sandbox/issues/189.
+
+## Test Strategy
+
+Run npm ci, typecheck, all Node tests and the real local Python server example. Verify fixture bytes against the pinned owner source in CI.
+
+## Acceptance criteria
+
+- Common authentication cases pass without changing gateway/application credential separation.
+- SDK setup remains noninteractive and no lifecycle capability is added.
+- Tests, source pin, owner evidence and required CI/review pass.
+
+## Evidence
+
+- [Verification](../../../evidence/verify/2026-10-26-shared-application-auth-tests.md).

.github/workflows/ci.yml

@@ -22,9 +22,11 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: Alibaba-Agent-Sandbox/python-sdk
-          ref: v0.4.0a6
+          ref: 98642ae6712a5017e187cae7952a2b3c819c1ece
           path: vendor/python-sdk
           persist-credentials: false
+      - name: Verify shared application authentication vectors
+        run: cmp test/fixtures/application-auth-vectors.json vendor/python-sdk/contracts/testing/application-auth-vectors.json
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+### Tests
+
+- Consume common application authentication vectors without adding SDK setup commands or changing public exports.
+
+
 ### Documentation
 
 - Select the verified public Python a4 runtime and matching configuration-source tag; preserve prior a3 verification as history. / 本地示例与配置对照统一公开 Python a4，保留原 a3 验证记录。

README.md

@@ -143,3 +143,6 @@ readEnv("sandbox_api_key", process.env);
 ## License
 
 Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+
+
+The application authentication regression cases are shared with the Python client and CLI from the Python SDK contract source. This library takes credentials through constructor options; it has no interactive setup command.

README.zh-CN.md

@@ -136,3 +136,6 @@ readEnv("sandbox_api_key", process.env);
 ## 许可
 
 Apache-2.0。见 [LICENSE](LICENSE) 和 [NOTICE](NOTICE)。
+
+
+应用认证回归数据与 Python 客户端、CLI 共用同一份 Python SDK 契约来源。本库通过构造参数接收凭证，没有交互式配置命令。

test/fixtures/application-auth-vectors.json

@@ -0,0 +1,52 @@
+{
+  "version": 1,
+  "cases": [
+    {
+      "id": "anonymous",
+      "headers": {},
+      "expected": {}
+    },
+    {
+      "id": "application",
+      "headers": {},
+      "token": "placeholder-application",
+      "expected": {
+        "authorization": "Bearer placeholder-application",
+        "x-access-token": "placeholder-application"
+      }
+    },
+    {
+      "id": "gateway",
+      "headers": {
+        "X-Gateway-Token": "placeholder-gateway"
+      },
+      "expected": {
+        "x-gateway-token": "placeholder-gateway"
+      }
+    },
+    {
+      "id": "separate-audiences",
+      "headers": {
+        "X-Access-Token": "placeholder-gateway"
+      },
+      "token": "placeholder-application",
+      "expected": {
+        "authorization": "Bearer placeholder-application",
+        "x-access-token": "placeholder-gateway"
+      }
+    },
+    {
+      "id": "case-insensitive-gateway",
+      "headers": {
+        "x-aCcEsS-tOkEn": "placeholder-gateway",
+        "X-Gateway-Token": "placeholder-extra"
+      },
+      "token": "placeholder-application",
+      "expected": {
+        "authorization": "Bearer placeholder-application",
+        "x-access-token": "placeholder-gateway",
+        "x-gateway-token": "placeholder-extra"
+      }
+    }
+  ]
+}

test/server-client.test.mjs

@@ -298,3 +298,13 @@ for (const mode of ["bearer-only", "authorization-stripped"]) {
     } finally {await client.close(); await server.close();}
   });
 }
+
+// Canonical source: python-sdk/contracts/testing/application-auth-vectors.json.
+const authVectors = JSON.parse((await import('node:fs')).readFileSync(new URL('./fixtures/application-auth-vectors.json', import.meta.url), 'utf8'));
+for (const vector of authVectors.cases) {
+  test(`shared application authentication: ${vector.id}`, async () => {
+    const client = new ServerClient('https://example.invalid/owned', {token: vector.token, gatewayHeaders: vector.headers});
+    assert.deepEqual(Object.fromEntries(Object.entries(client.authHeaders()).map(([key, value]) => [key.toLowerCase(), value])), vector.expected);
+    await client.close();
+  });
+}