@app-vitals/agent-admin 0.0.1 → 0.1.0

package/src/agent-members.ts

@@ -0,0 +1,69 @@
+/**
+ * agent/src/agent-members.ts
+ * AgentMemberService — authorized human members per agent (access control).
+ *
+ * Membership rows are keyed by [agentId, email] (unique constraint) — an
+ * email can be a member of multiple agents, and an agent can have multiple
+ * member emails.
+ */
+
+import type { AgentMember, PrismaClient } from "../prisma/client/client.ts";
+import type { PrismaTransactionClient } from "./prisma-tx.ts";
+
+export type { AgentMember };
+
+export class AgentMemberService {
+  constructor(private prisma: PrismaClient) {}
+
+  /**
+   * List all memberships for a given agent.
+   */
+  async listByAgentId(agentId: string): Promise<AgentMember[]> {
+    return this.prisma.agentMember.findMany({ where: { agentId } });
+  }
+
+  /**
+   * List all memberships for a given email, case-sensitive as stored.
+   * Callers are expected to lowercase the email before calling.
+   */
+  async listByEmail(email: string): Promise<AgentMember[]> {
+    return this.prisma.agentMember.findMany({ where: { email } });
+  }
+
+  /**
+   * Returns whether a membership row exists for the given agentId+email pair.
+   */
+  async exists(agentId: string, email: string): Promise<boolean> {
+    const membership = await this.prisma.agentMember.findUnique({
+      where: { agentId_email: { agentId, email } },
+    });
+    return membership !== null;
+  }
+
+  /**
+   * Create a membership row for the given agentId and email.
+   * Throws (unique-constraint violation) if the membership already exists —
+   * callers are expected to catch and handle "already a member" as a no-op.
+   *
+   * @param client - defaults to `this.prisma`; pass the `tx` argument from a
+   *   caller's `prisma.$transaction(async (tx) => ...)` to make this write
+   *   participate in that transaction (see createAgent() in agents.ts).
+   */
+  async add(
+    agentId: string,
+    email: string,
+    client: PrismaTransactionClient = this.prisma,
+  ): Promise<AgentMember> {
+    return client.agentMember.create({ data: { agentId, email } });
+  }
+
+  /**
+   * Delete a membership by id, scoped to agentId. No-ops if the id doesn't
+   * exist or belongs to a different agent.
+   */
+  async remove(agentId: string, memberId: string): Promise<void> {
+    await this.prisma.agentMember.deleteMany({
+      where: { id: memberId, agentId },
+    });
+  }
+}

package/src/agent-members.unit.test.ts

@@ -0,0 +1,250 @@
+/**
+ * agent/src/agent-members.unit.test.ts
+ * Unit tests for AgentMemberService (admin/src/agent-members.ts) — pure logic
+ * against an injected prisma test double. No real DB — see docs/testing.md
+ * for the unit-layer contract.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { AgentMemberService } from "./agent-members.ts";
+
+// ─── In-memory prisma.agentMember test double ──────────────────────────────
+
+interface FakeAgentMemberRow {
+  id: string;
+  agentId: string;
+  email: string;
+  createdAt: Date;
+}
+
+function makeFakePrisma(seed: FakeAgentMemberRow[] = []) {
+  const rows = new Map<string, FakeAgentMemberRow>(seed.map((r) => [r.id, r]));
+  let nextId = 1;
+
+  const agentMember = {
+    async findMany({
+      where,
+    }: {
+      where?: { agentId?: string; email?: string };
+    } = {}): Promise<FakeAgentMemberRow[]> {
+      let all = Array.from(rows.values());
+      if (where?.agentId !== undefined) {
+        all = all.filter((r) => r.agentId === where.agentId);
+      }
+      if (where?.email !== undefined) {
+        all = all.filter((r) => r.email === where.email);
+      }
+      return all;
+    },
+    async findUnique({
+      where,
+    }: {
+      where: { agentId_email: { agentId: string; email: string } };
+    }): Promise<FakeAgentMemberRow | null> {
+      const { agentId, email } = where.agentId_email;
+      const row = Array.from(rows.values()).find(
+        (r) => r.agentId === agentId && r.email === email,
+      );
+      return row ?? null;
+    },
+    async create({
+      data,
+    }: {
+      data: { agentId: string; email: string };
+    }): Promise<FakeAgentMemberRow> {
+      const existing = Array.from(rows.values()).find(
+        (r) => r.agentId === data.agentId && r.email === data.email,
+      );
+      if (existing) {
+        throw new Error(
+          "Unique constraint failed on the fields: (`agentId`,`email`)",
+        );
+      }
+      const row: FakeAgentMemberRow = {
+        id: `member-${nextId++}`,
+        agentId: data.agentId,
+        email: data.email,
+        createdAt: new Date("2024-01-01"),
+      };
+      rows.set(row.id, row);
+      return row;
+    },
+    async deleteMany({
+      where,
+    }: {
+      where: { id: string; agentId: string };
+    }): Promise<{ count: number }> {
+      const row = rows.get(where.id);
+      if (row && row.agentId === where.agentId) {
+        rows.delete(where.id);
+        return { count: 1 };
+      }
+      return { count: 0 };
+    },
+  };
+
+  return { agentMember, __rows: rows };
+}
+
+type FakePrisma = ReturnType<typeof makeFakePrisma>;
+
+function seedRow(overrides: Partial<FakeAgentMemberRow> = {}): FakeAgentMemberRow {
+  return {
+    id: "member-existing",
+    agentId: "agent-1",
+    email: "person@example.com",
+    createdAt: new Date("2024-01-01"),
+    ...overrides,
+  };
+}
+
+// ─── listByAgentId ──────────────────────────────────────────────────────────
+
+describe("AgentMemberService.listByAgentId", () => {
+  it("returns all memberships for the given agentId", async () => {
+    const prisma = makeFakePrisma([
+      seedRow({ id: "m1", agentId: "agent-1", email: "a@example.com" }),
+      seedRow({ id: "m2", agentId: "agent-1", email: "b@example.com" }),
+      seedRow({ id: "m3", agentId: "agent-2", email: "c@example.com" }),
+    ]) as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    const result = await service.listByAgentId("agent-1");
+
+    expect(result.map((r) => r.email).sort()).toEqual([
+      "a@example.com",
+      "b@example.com",
+    ]);
+  });
+
+  it("returns an empty array when the agent has no memberships", async () => {
+    const prisma = makeFakePrisma() as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    expect(await service.listByAgentId("agent-1")).toEqual([]);
+  });
+});
+
+// ─── listByEmail ────────────────────────────────────────────────────────────
+
+describe("AgentMemberService.listByEmail", () => {
+  it("returns all memberships for the given email, case-sensitive as stored", async () => {
+    const prisma = makeFakePrisma([
+      seedRow({ id: "m1", agentId: "agent-1", email: "person@example.com" }),
+      seedRow({ id: "m2", agentId: "agent-2", email: "person@example.com" }),
+      seedRow({ id: "m3", agentId: "agent-3", email: "other@example.com" }),
+    ]) as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    const result = await service.listByEmail("person@example.com");
+
+    expect(result.map((r) => r.agentId).sort()).toEqual(["agent-1", "agent-2"]);
+  });
+
+  it("does not match on a differently-cased email", async () => {
+    const prisma = makeFakePrisma([
+      seedRow({ id: "m1", agentId: "agent-1", email: "person@example.com" }),
+    ]) as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    expect(await service.listByEmail("Person@example.com")).toEqual([]);
+  });
+
+  it("returns an empty array when no memberships match", async () => {
+    const prisma = makeFakePrisma() as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    expect(await service.listByEmail("nobody@example.com")).toEqual([]);
+  });
+});
+
+// ─── exists ─────────────────────────────────────────────────────────────────
+
+describe("AgentMemberService.exists", () => {
+  it("returns true when a membership row exists for the agentId+email pair", async () => {
+    const prisma = makeFakePrisma([
+      seedRow({ agentId: "agent-1", email: "person@example.com" }),
+    ]) as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    expect(await service.exists("agent-1", "person@example.com")).toBe(true);
+  });
+
+  it("returns false when no membership row exists for the pair", async () => {
+    const prisma = makeFakePrisma([
+      seedRow({ agentId: "agent-1", email: "person@example.com" }),
+    ]) as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    expect(await service.exists("agent-1", "someone-else@example.com")).toBe(
+      false,
+    );
+    expect(await service.exists("agent-2", "person@example.com")).toBe(false);
+  });
+
+  it("returns false when there are no memberships at all", async () => {
+    const prisma = makeFakePrisma() as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    expect(await service.exists("agent-1", "person@example.com")).toBe(false);
+  });
+});
+
+// ─── add ────────────────────────────────────────────────────────────────────
+
+describe("AgentMemberService.add", () => {
+  it("creates a membership row for the given agentId and email", async () => {
+    const prisma = makeFakePrisma() as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    const row = await service.add("agent-1", "person@example.com");
+
+    expect(row.agentId).toBe("agent-1");
+    expect(row.email).toBe("person@example.com");
+    expect(row.id).toBeDefined();
+  });
+
+  it("propagates a unique-constraint error when the membership already exists", async () => {
+    const prisma = makeFakePrisma([
+      seedRow({ agentId: "agent-1", email: "person@example.com" }),
+    ]) as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    await expect(
+      (async () => service.add("agent-1", "person@example.com"))(),
+    ).rejects.toThrow();
+  });
+});
+
+// ─── remove ─────────────────────────────────────────────────────────────────
+
+describe("AgentMemberService.remove", () => {
+  it("deletes a membership by id when scoped to the correct agentId", async () => {
+    const row = seedRow({ id: "m1", agentId: "agent-1" });
+    const prisma = makeFakePrisma([row]) as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    await service.remove("agent-1", "m1");
+
+    expect(await service.listByAgentId("agent-1")).toEqual([]);
+  });
+
+  it("no-ops when the memberId does not exist", async () => {
+    const prisma = makeFakePrisma() as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    await service.remove("agent-1", "missing");
+
+    expect(await service.listByAgentId("agent-1")).toEqual([]);
+  });
+
+  it("no-ops when the memberId exists but belongs to a different agentId", async () => {
+    const row = seedRow({ id: "m1", agentId: "agent-1" });
+    const prisma = makeFakePrisma([row]) as unknown as FakePrisma;
+    const service = new AgentMemberService(prisma as never);
+
+    await service.remove("agent-2", "m1");
+
+    expect(await service.listByAgentId("agent-1")).toEqual([row]);
+  });
+});

package/src/agent-patch-author-allowlist.integration.test.ts

@@ -0,0 +1,218 @@
+/**
+ * admin/src/agent-patch-author-allowlist.integration.test.ts
+ * Integration tests for the Agent.patchAuthorAllowlist column, against a
+ * real PostgreSQL DB.
+ *
+ * Requires DATABASE_URL_ADMIN_TEST to be set; skips otherwise.
+ *
+ * Mirrors agents-api.integration.test.ts's API round-trip pattern, but for
+ * the patchAuthorAllowlist column (DBR-1.1). Unlike the legacy
+ * authorAllowlist column (removed in DBR-2.4), this one was added fresh with
+ * NOT NULL DEFAULT ARRAY[]::TEXT[] from the start (one migration, no backfill
+ * needed) — so there is no NULL-row / NOT NULL-constraint scenario to replay
+ * here.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { sign } from "hono/jwt";
+import type { PrismaClient } from "../prisma/client/client.ts";
+import { AgentChatTokenService } from "./agent-chat-tokens.ts";
+import { AgentCronJobService } from "./agent-cron-jobs.ts";
+import { AgentCronRunStatsService } from "./agent-cron-run-stats.ts";
+import { AgentCronRunService } from "./agent-cron-runs.ts";
+import { AgentEnvService } from "./agent-envs.ts";
+import { AgentGitHubInstallationsService } from "./agent-github-installations.ts";
+import { AgentMemberService } from "./agent-members.ts";
+import { AgentPluginService } from "./agent-plugins.ts";
+import { NoopAgentProvisioner } from "./agent-provisioner.ts";
+import { AgentTokenService } from "./agent-tokens.ts";
+import { AgentToolService } from "./agent-tools.ts";
+import type { SpecialtyManifestResolver } from "./specialty-manifest-loader.ts";
+import type { SpecialtyManifest } from "./specialty-registry.ts";
+import { AgentService } from "./agents.ts";
+import type { AdminDeps } from "./agents-api.ts";
+import { createAdminApp } from "./agents-api.ts";
+import { NoopChatServiceProvisioningClient } from "./chat-service-provisioning-client.ts";
+import { createAdminPrismaClient } from "./prisma-client.ts";
+import { makeTokenCrypto } from "./token-crypto.ts";
+
+const TEST_DB = process.env.DATABASE_URL_ADMIN_TEST;
+const describeOrSkip = TEST_DB ? describe : describe.skip;
+
+const SESSION_SECRET = "test-admin-session-secret-32-bytes!";
+const REAL_KEY =
+  "0000000000000000000000000000000000000000000000000000000000000001";
+
+async function makeSessionCookie(): Promise<string> {
+  return sign(
+    {
+      isAdmin: true,
+      userId: "user-123",
+      email: "admin@example.com",
+      name: "Admin User",
+      iat: Math.floor(Date.now() / 1000),
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    },
+    SESSION_SECRET,
+    "HS256",
+  );
+}
+
+function makePrisma(): PrismaClient {
+  // TEST_DB is guaranteed set — the describe block is skipped otherwise.
+  return createAdminPrismaClient(TEST_DB as string);
+}
+
+const CODING_MANIFEST: SpecialtyManifest = {
+  apiVersion: "shipwright.dev/v1alpha1",
+  kind: "Specialty",
+  metadata: {
+    name: "coding",
+    displayName: "Coding Agent",
+    description: "test manifest",
+    version: "1.0.0",
+    skills: [],
+  },
+  identity: { templatesDir: "workspace/" },
+  crons: [],
+  plugins: ["shipwright"],
+  tools: ["Read", "Write", "Edit"],
+  env: { required: [], optional: [] },
+  members: [],
+  repos: [],
+  chat: true,
+  voice: true,
+};
+
+function fakeSpecialtyRegistry(): SpecialtyManifestResolver {
+  const byType: Record<string, SpecialtyManifest> = { coding: CODING_MANIFEST };
+  return {
+    getManifest(typeName: string): SpecialtyManifest {
+      return byType[typeName] ?? (byType.coding as SpecialtyManifest);
+    },
+    tryGetManifest(typeName: string): SpecialtyManifest | undefined {
+      return byType[typeName];
+    },
+    listTypes() {
+      return Object.entries(byType).map(([name, manifest]) => ({
+        name,
+        displayName: manifest.metadata.displayName,
+      }));
+    },
+  };
+}
+
+function makeDeps(prisma: PrismaClient): AdminDeps {
+  const savedKey = process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+  process.env.SHIPWRIGHT_ENCRYPTION_KEY = REAL_KEY;
+  const crypto = makeTokenCrypto();
+  if (savedKey === undefined) {
+    delete process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+  } else {
+    process.env.SHIPWRIGHT_ENCRYPTION_KEY = savedKey;
+  }
+
+  return {
+    agentService: new AgentService(prisma),
+    agentEnvService: new AgentEnvService(prisma, crypto),
+    agentCronJobService: new AgentCronJobService(prisma),
+    agentCronRunService: new AgentCronRunService(prisma),
+    agentCronRunStatsService: new AgentCronRunStatsService(prisma),
+    agentToolService: new AgentToolService(prisma),
+    agentTokenService: new AgentTokenService(prisma),
+    agentPluginService: new AgentPluginService(prisma),
+    agentMemberService: new AgentMemberService(prisma),
+    specialtyRegistry: fakeSpecialtyRegistry(),
+    agentChatTokenService: new AgentChatTokenService(prisma),
+    agentGitHubInstallationsService: new AgentGitHubInstallationsService(
+      prisma,
+    ),
+    prisma,
+    provisioner: new NoopAgentProvisioner(),
+    serviceIntegrations: [
+      {
+        name: "task-store",
+        listTokensForAgent: async () => [],
+        revokeToken: async () => {},
+      },
+    ],
+    chatService: new NoopChatServiceProvisioningClient(),
+    slack: {
+      deleteApp: async () => {},
+    },
+    decrypt: (value: string) => crypto.decrypt(value),
+    sessionSecret: SESSION_SECRET,
+  };
+}
+
+describeOrSkip("Agent.patchAuthorAllowlist (integration)", () => {
+  let prisma: PrismaClient;
+
+  beforeEach(async () => {
+    prisma = makePrisma();
+    await prisma.agentWorkQueueSnapshot.deleteMany();
+    await prisma.agentPlugin.deleteMany();
+    await prisma.agentToken.deleteMany();
+    await prisma.agentCronJob.deleteMany();
+    await prisma.agentTool.deleteMany();
+    await prisma.agentEnv.deleteMany();
+    await prisma.agentMember.deleteMany();
+    await prisma.agent.deleteMany();
+  });
+
+  afterEach(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("defaults to [] for a newly created row", async () => {
+    const agent = await prisma.agent.create({
+      data: { name: "Default Agent" },
+    });
+    expect(agent.patchAuthorAllowlist).toEqual([]);
+  });
+
+  it("round-trips via PATCH /agents/:id and GET /agents/:id, independent of reviewAuthorAllowlist", async () => {
+    const agentId = await prisma.agent
+      .create({ data: { name: "Round Trip Agent" } })
+      .then((a) => a.id);
+    const cookie = await makeSessionCookie();
+    const app = createAdminApp(makeDeps(prisma));
+
+    // PATCH sets patchAuthorAllowlist, leaving reviewAuthorAllowlist untouched
+    const patchRes = await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ patchAuthorAllowlist: ["octocat"] }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    expect(patchRes.status).toBe(200);
+    const patchBody = await patchRes.json();
+    expect(patchBody.patchAuthorAllowlist).toEqual(["octocat"]);
+    expect(patchBody.reviewAuthorAllowlist).toEqual([]);
+
+    // GET confirms persisted value
+    const getRes = await app.request(`/agents/${agentId}`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(getRes.status).toBe(200);
+    const getBody = await getRes.json();
+    expect(getBody.patchAuthorAllowlist).toEqual(["octocat"]);
+    expect(getBody.reviewAuthorAllowlist).toEqual([]);
+
+    // Setting reviewAuthorAllowlist afterwards must not disturb patchAuthorAllowlist
+    const secondPatchRes = await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ reviewAuthorAllowlist: ["hubot"] }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    expect(secondPatchRes.status).toBe(200);
+    const secondPatchBody = await secondPatchRes.json();
+    expect(secondPatchBody.reviewAuthorAllowlist).toEqual(["hubot"]);
+    expect(secondPatchBody.patchAuthorAllowlist).toEqual(["octocat"]);
+  });
+});

package/src/agent-plugins.integration.test.ts

@@ -0,0 +1,157 @@
+/**
+ * agent/src/agent-plugins.integration.test.ts
+ * Integration tests for AgentPluginService against a real PostgreSQL DB.
+ *
+ * Requires DATABASE_URL_ADMIN_TEST to be set; skips otherwise.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import type { PrismaClient } from "../prisma/client/client.ts";
+import { AgentPluginService } from "./agent-plugins.ts";
+import { NotFoundError } from "./errors.ts";
+import { createAdminPrismaClient } from "./prisma-client.ts";
+
+const TEST_DB = process.env.DATABASE_URL_ADMIN_TEST;
+
+const describeOrSkip = TEST_DB ? describe : describe.skip;
+
+function makePrisma(): PrismaClient {
+  // TEST_DB is guaranteed set — the describe block is skipped otherwise.
+  return createAdminPrismaClient(TEST_DB as string);
+}
+
+async function createAgent(
+  prisma: PrismaClient,
+  name = "Test Agent",
+): Promise<string> {
+  const agent = await prisma.agent.create({ data: { name } });
+  return agent.id;
+}
+
+describeOrSkip("AgentPluginService (integration)", () => {
+  let prisma: PrismaClient;
+  let service: AgentPluginService;
+
+  beforeEach(async () => {
+    prisma = makePrisma();
+    await prisma.agentPlugin.deleteMany();
+    await prisma.agentToken.deleteMany();
+    await prisma.agentCronJob.deleteMany();
+    await prisma.agentTool.deleteMany();
+    await prisma.agentEnv.deleteMany();
+    await prisma.agent.deleteMany();
+    service = new AgentPluginService(prisma);
+  });
+
+  afterEach(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("add() creates a new plugin", async () => {
+    const agentId = await createAgent(prisma);
+    const plugin = await service.add(agentId, "shipwright@shipwright");
+    expect(plugin.agentId).toBe(agentId);
+    expect(plugin.name).toBe("shipwright@shipwright");
+    expect(plugin.version).toBeNull();
+    expect(plugin.enabled).toBe(true);
+  });
+
+  it("add() accepts an optional version", async () => {
+    const agentId = await createAgent(prisma);
+    const plugin = await service.add(agentId, "shipwright@shipwright", "1.2.3");
+    expect(plugin.version).toBe("1.2.3");
+  });
+
+  it("add() creates a fresh row after the original was removed (unique constraint freed)", async () => {
+    const agentId = await createAgent(prisma);
+    const plugin = await service.add(agentId, "shipwright@shipwright", "1.0.0");
+    await service.remove(agentId, plugin.id);
+    // After remove, re-adding creates a fresh row (unique constraint no longer occupied)
+    const recreated = await service.add(
+      agentId,
+      "shipwright@shipwright",
+      "2.0.0",
+    );
+    expect(recreated.version).toBe("2.0.0");
+    expect(recreated.enabled).toBe(true);
+  });
+
+  it("add() upserts in place when called twice without removal", async () => {
+    const agentId = await createAgent(prisma);
+    const first = await service.add(agentId, "shipwright@shipwright", "1.0.0");
+    const second = await service.add(agentId, "shipwright@shipwright", "2.0.0");
+    expect(second.id).toBe(first.id);
+    expect(second.version).toBe("2.0.0");
+    expect(second.enabled).toBe(true);
+  });
+
+  it("list() returns all plugins for an agent ordered by createdAt", async () => {
+    const agentId = await createAgent(prisma);
+    await service.add(agentId, "plugin-a@shipwright");
+    await service.add(agentId, "plugin-b@shipwright");
+    await service.add(agentId, "plugin-c@shipwright");
+    const plugins = await service.list(agentId);
+    expect(plugins).toHaveLength(3);
+    expect(plugins.map((p) => p.name)).toEqual([
+      "plugin-a@shipwright",
+      "plugin-b@shipwright",
+      "plugin-c@shipwright",
+    ]);
+  });
+
+  it("list() does not return plugins from other agents", async () => {
+    const agentId1 = await createAgent(prisma, "Agent 1");
+    const agentId2 = await createAgent(prisma, "Agent 2");
+    await service.add(agentId1, "plugin-a@shipwright");
+    const plugins = await service.list(agentId2);
+    expect(plugins).toHaveLength(0);
+  });
+
+  it("remove() deletes a plugin by ID", async () => {
+    const agentId = await createAgent(prisma);
+    const plugin = await service.add(agentId, "shipwright@shipwright");
+    await service.remove(agentId, plugin.id);
+    const plugins = await service.list(agentId);
+    expect(plugins).toHaveLength(0);
+  });
+
+  it("remove() throws NotFoundError for unknown pluginId", async () => {
+    const agentId = await createAgent(prisma);
+    await expect(service.remove(agentId, "nonexistent")).rejects.toBeInstanceOf(
+      NotFoundError,
+    );
+  });
+
+  it("remove() throws NotFoundError when pluginId belongs to a different agent", async () => {
+    const agentId1 = await createAgent(prisma, "Agent 1");
+    const agentId2 = await createAgent(prisma, "Agent 2");
+    const plugin = await service.add(agentId1, "shipwright@shipwright");
+    await expect(service.remove(agentId2, plugin.id)).rejects.toBeInstanceOf(
+      NotFoundError,
+    );
+  });
+
+  it("removeByName() deletes a plugin by name", async () => {
+    const agentId = await createAgent(prisma);
+    await service.add(agentId, "shipwright@shipwright");
+    await service.removeByName(agentId, "shipwright@shipwright");
+    const plugins = await service.list(agentId);
+    expect(plugins).toHaveLength(0);
+  });
+
+  it("removeByName() throws NotFoundError for unknown name", async () => {
+    const agentId = await createAgent(prisma);
+    await expect(
+      service.removeByName(agentId, "nonexistent@shipwright"),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+
+  it("removeByName() throws NotFoundError when the name belongs to a different agent", async () => {
+    const agentId1 = await createAgent(prisma, "Agent 1");
+    const agentId2 = await createAgent(prisma, "Agent 2");
+    await service.add(agentId1, "shipwright@shipwright");
+    await expect(
+      service.removeByName(agentId2, "shipwright@shipwright"),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+});