@bevel-software/platform-core-backend 0.14.0 → 0.15.1

package/src/modules/plugins/__tests__/compile-marketplace.test.ts

@@ -0,0 +1,294 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
+
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import { AccessControlService } from '../../access/access-control.service.js';
+import { SkillService } from '../../skills/skills.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
+import { PluginLinkIndex } from '../plugin-links.js';
+import { MarketplaceCompilerService } from '../compile/marketplace-compiler.service.js';
+
+/**
+ * Source in, distribution out — for one caller. The real resolver decides
+ * what is readable, the real catalog and link index say what is where; the
+ * assertions are on the produced tree.
+ */
+
+const KB_DIR = 'knowledge-base';
+const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+
+describe('compileMarketplace', () => {
+  let root: string;
+  let repo: string;
+  let compiler: MarketplaceCompilerService;
+
+  const write = async (rel: string, text: string) => {
+    const abs = path.join(repo, rel);
+    await fs.mkdir(path.dirname(abs), { recursive: true });
+    await fs.writeFile(abs, text);
+  };
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-compile-'));
+    repo = path.join(root, wsId, KB_DIR);
+    const workspaceService = {
+      getOrCreateForBranch: async () => ({ id: wsId }),
+      getWorkspacePath: async (id: string) => path.join(root, id),
+      readFile: async (id: string, rel: string) => fs.readFile(path.join(root, id, rel), 'utf-8'),
+      ensureRemotesFetched: async () => undefined,
+    } as unknown as WorkspaceService;
+
+    await write('roles.yaml', 'roles:\n  Admin:\n    - admin@x.io\n');
+    await write('access.md', '---\nwrite:\n  - Admin\n---\n');
+    // GTM: Sam is a member. One inline skill, one MCP server with a vault header.
+    await write(
+      'Plugins/GTM/access.md',
+      '---\nread:\n  - everyone\n---\nread:\n  - Sam <sam@x.io>\nwrite:\n  - Mia <mia@x.io>\n',
+    );
+    await write(
+      'Plugins/GTM/plugin.json',
+      JSON.stringify({
+        name: 'gtm',
+        version: '2.1.0',
+        description: 'Go to market',
+        extensions: { 'software.bevel.hexis': { skills: ['Skills/Eng/deploy'] } },
+      }),
+    );
+    await write('Plugins/GTM/skills/outreach/SKILL.md', '---\ndescription: Reach out.\n---\nBody\n');
+    await write('Plugins/GTM/skills/outreach/scripts/run.py', 'print(1)\n');
+    await write('Plugins/GTM/software.bevel.hexis/tools/web.tool', 'not shipped');
+    await write(
+      'Plugins/GTM/mcp.json',
+      JSON.stringify({
+        mcpServers: {
+          notion: { type: 'streamable-http', url: 'https://mcp.notion.com', headers: { Authorization: 'Bearer ${NOTION_TOKEN}', 'X-Client': 'hexis' } },
+          local: { type: 'stdio', command: 'npx', args: ['-y', 'x'] },
+        },
+      }),
+    );
+    // Shared skills: Eng/deploy linked into GTM and readable by its members;
+    // Eng/secret readable by nobody but admins; Sales/pitch public.
+    await write('Skills/Eng/deploy/access.md', '---\n---\nread:\n  - plugin/GTM/read\n');
+    await write('Skills/Eng/deploy/SKILL.md', '---\ndescription: Ship it.\n---\n');
+    await write('Skills/Eng/deploy/references/notes.md', 'notes');
+    await write('Skills/Eng/secret/SKILL.md', '---\ndescription: Hush.\n---\n');
+    await write('Skills/Sales/access.md', '---\n---\nread:\n  - everyone\n');
+    await write('Skills/Sales/pitch/SKILL.md', '---\ndescription: Pitch.\n---\n');
+
+    const access = new AccessControlService(workspaceService, KB_DIR);
+    const skills = new SkillService(workspaceService, access, KB_DIR);
+    const links = new PluginLinkIndex(workspaceService, skills, access, KB_DIR);
+    compiler = new MarketplaceCompilerService(workspaceService, access, skills, links, KB_DIR, {
+      name: 'acme-hexis',
+      owner: 'Acme',
+      knowledgeBaseMcp: { name: 'hexis', url: 'https://kb.acme.com/api/mcp' },
+    });
+  });
+  afterEach(() => fs.rm(root, { recursive: true, force: true }));
+
+  const text = (tree: { files: Map<string, Buffer> }, rel: string) => tree.files.get(rel)?.toString('utf-8');
+  const json = (tree: { files: Map<string, Buffer> }, rel: string) => JSON.parse(text(tree, rel) ?? 'null');
+
+  it('compiles exactly what the caller may read, in the layouts the clients want', async () => {
+    const tree = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    const paths = [...tree.files.keys()].sort();
+
+    // GTM: inline + linked skills copied in, tools and access files left out.
+    expect(paths).toContain('plugins/gtm/skills/outreach/SKILL.md');
+    expect(paths).toContain('plugins/gtm/skills/outreach/scripts/run.py');
+    expect(paths).toContain('plugins/gtm/skills/deploy/SKILL.md');
+    expect(paths).toContain('plugins/gtm/skills/deploy/references/notes.md');
+    expect(paths.some((p) => p.includes('.tool') || p.endsWith('access.md'))).toBe(false);
+    // The unreadable skill is nowhere — not in a plugin, not in the flat copy.
+    expect(paths.some((p) => p.includes('secret'))).toBe(false);
+
+    // Three manifests per plugin, with the source manifest's identity.
+    expect(json(tree, 'plugins/gtm/plugin.json')).toMatchObject({ name: 'gtm', version: '2.1.0', description: 'Go to market' });
+    expect(json(tree, 'plugins/gtm/.claude-plugin/plugin.json')).toMatchObject({ name: 'gtm', version: '2.1.0' });
+    expect(json(tree, 'plugins/gtm/.codex-plugin/plugin.json')).toMatchObject({ name: 'gtm' });
+
+    // The portable half of mcp.json: the vault header is gone, the literal stays.
+    const mcp = json(tree, 'plugins/gtm/.mcp.json');
+    expect(mcp.mcpServers.notion).toEqual({ type: 'streamable-http', url: 'https://mcp.notion.com', headers: { 'X-Client': 'hexis' } });
+    expect(mcp.mcpServers.local).toEqual({ type: 'stdio', command: 'npx', args: ['-y', 'x'] });
+
+    // The leftovers plugin holds what no real plugin ships (pitch), never what
+    // one does (deploy is GTM's); the flat copy carries everything once.
+    expect(paths).toContain('plugins/skills-and-knowledge/skills/pitch/SKILL.md');
+    expect(paths).not.toContain('plugins/skills-and-knowledge/skills/deploy/SKILL.md');
+    // …and the knowledge base itself as an MCP server, URL only.
+    expect(json(tree, 'plugins/skills-and-knowledge/.mcp.json')).toEqual({
+      mcpServers: { hexis: { type: 'streamable-http', url: 'https://kb.acme.com/api/mcp' } },
+    });
+    expect(paths).toContain('skills/deploy/SKILL.md');
+    expect(paths).toContain('skills/pitch/SKILL.md');
+    expect(paths).toContain('skills/outreach/SKILL.md');
+
+    // The bundle depends on every other plugin; the catalogues list them all.
+    expect(json(tree, 'plugins/hexis-all/.claude-plugin/plugin.json').dependencies.sort()).toEqual(['gtm', 'skills-and-knowledge']);
+    const claude = json(tree, '.claude-plugin/marketplace.json');
+    expect(claude.name).toBe('acme-hexis');
+    expect(claude.plugins.map((p: { name: string; source: string }) => [p.name, p.source])).toEqual([
+      ['gtm', './plugins/gtm'],
+      ['skills-and-knowledge', './plugins/skills-and-knowledge'],
+      ['hexis-all', './plugins/hexis-all'],
+    ]);
+    const codex = json(tree, '.agents/plugins/marketplace.json');
+    expect(codex.plugins.every((p: { policy: { installation: string } }) => p.policy.installation === 'INSTALLED_BY_DEFAULT')).toBe(true);
+    expect(codex.plugins[0].source).toEqual({ source: 'local', path: './plugins/gtm' });
+    expect(text(tree, 'README.md')).toContain('Compiled from Acme');
+    expect(tree.warnings).toEqual([]);
+  });
+
+  it('ships only mcp servers a client could run, and names each one it leaves out', async () => {
+    // Written as text, not from an object literal: a literal `__proto__` key
+    // sets the prototype instead of an own property, and the point is a
+    // repository file that CARRIES that key.
+    await write(
+      'Plugins/GTM/mcp.json',
+      `{"mcpServers": {
+        "notion": { "type": "streamable-http", "url": "https://mcp.notion.com" },
+        "events": { "type": "sse", "url": "https://events.example" },
+        "Bad Name": { "type": "stdio", "command": "x" },
+        "empty": { "type": "stdio" },
+        "creds": { "type": "streamable-http", "url": "https://user:pw@mcp.example" },
+        "badenv": { "type": "stdio", "command": "x", "env": { "A": 1 } },
+        "badargs": { "type": "stdio", "command": "x", "args": [1, "b"] },
+        "badheaders": { "type": "streamable-http", "url": "https://x.example", "headers": { "A": 1 } },
+        "__proto__": { "type": "stdio", "command": "x" }
+      }}`,
+    );
+    const tree = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    const mcp = json(tree, 'plugins/gtm/mcp.json');
+    expect(Object.keys(mcp.mcpServers)).toEqual(['notion']);
+    const left = (name: string) => tree.warnings.find((w) => w.includes(`"${name}" not shipped`)) ?? '';
+    expect(left('events')).toContain('sse');
+    expect(left('Bad Name')).toContain('name');
+    expect(left('empty')).toContain('no command');
+    expect(left('creds')).toContain('credentials');
+    expect(left('badenv')).toContain('env');
+    expect(left('badargs')).toContain('args');
+    expect(left('badheaders')).toContain('headers');
+    expect(left('__proto__')).toContain('name');
+  });
+
+  it('the manifest name is the identity: a folder called something else publishes, and is granted, under the name', async () => {
+    await write(
+      'Plugins/GTM/plugin.json',
+      JSON.stringify({ name: 'go-to-market', version: '2.1.0', extensions: { 'software.bevel.hexis': { skills: ['Skills/Eng/deploy'] } } }),
+    );
+    // The linked skill's grant spelled by the name reaches Sam…
+    await write('Skills/Eng/deploy/access.md', '---\n---\nread:\n  - plugin/go-to-market/read\n');
+    const tree = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    expect(tree.plugins).toContain('go-to-market');
+    expect(tree.plugins).not.toContain('gtm');
+    expect([...tree.files.keys()]).toContain('plugins/go-to-market/skills/deploy/SKILL.md');
+    // …and a name that differs from the folder is nothing to warn about.
+    expect(tree.warnings).toEqual([]);
+  });
+
+  it('a grant spelled by the folder names no plugin once the manifest says otherwise', async () => {
+    await write('Plugins/GTM/plugin.json', JSON.stringify({ name: 'go-to-market', extensions: { 'software.bevel.hexis': { skills: ['Skills/Eng/deploy'] } } }));
+    // The fixture's grant on Skills/Eng/deploy still says plugin/GTM/read.
+    const tree = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    expect([...tree.files.keys()].some((p) => p.includes('deploy'))).toBe(false);
+  });
+
+  it('for a stranger the plugin keeps only its MCP servers, and the public scope is all that ships', async () => {
+    const tree = await compiler.compileFor({ userEmail: 'nobody@elsewhere.io' });
+    const paths = [...tree.files.keys()].sort();
+    expect(paths.some((p) => p.startsWith('plugins/gtm/skills/'))).toBe(false);
+    expect(paths).toContain('plugins/gtm/.mcp.json'); // portable servers are not access-gated content
+    expect(paths).toContain('plugins/skills-and-knowledge/skills/pitch/SKILL.md');
+    expect(paths.some((p) => p.includes('deploy'))).toBe(false);
+    expect(tree.plugins).toEqual(['gtm', 'skills-and-knowledge', 'hexis-all']);
+  });
+
+  it('the everyone audience carries the public subset only', async () => {
+    const tree = await compiler.compileFor({ everyone: true });
+    const paths = [...tree.files.keys()];
+    expect(paths).toContain('skills/pitch/SKILL.md');
+    expect(paths.some((p) => p.includes('deploy') || p.includes('outreach') || p.includes('secret'))).toBe(false);
+  });
+
+  it('with the endpoint configured, the skills plugin exists even for a caller with no leftover skill', async () => {
+    // Make the one public skill part of GTM, so nothing is left over.
+    await write(
+      'Plugins/GTM/plugin.json',
+      JSON.stringify({ name: 'gtm', extensions: { 'software.bevel.hexis': { skills: ['Skills/Eng/deploy', 'Skills/Sales'] } } }),
+    );
+    const tree = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    const paths = [...tree.files.keys()];
+    expect(paths.some((p) => p.startsWith('plugins/skills-and-knowledge/skills/'))).toBe(false);
+    expect(paths).toContain('plugins/skills-and-knowledge/.mcp.json');
+    expect(tree.plugins).toEqual(['gtm', 'skills-and-knowledge', 'hexis-all']);
+  });
+
+  it('a manifest name that is no identifier is ignored, with a warning — the folder names the plugin', async () => {
+    // A hostile or mistaken manifest name must never become a path segment
+    // that escapes the compiled tree, nor an identity grants could spell.
+    await write('Plugins/GTM/plugin.json', JSON.stringify({ name: '../../etc/passwd' }));
+    const tree = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    const paths = [...tree.files.keys()];
+    expect(paths.every((p) => !p.includes('..') && !p.startsWith('/'))).toBe(true);
+    expect(paths).toContain('plugins/gtm/skills/outreach/SKILL.md');
+    expect(tree.warnings.some((w) => w.includes('Plugins/GTM') && w.includes('not a plugin identifier'))).toBe(true);
+  });
+
+  it('two folders claiming one identity: the first by path keeps it, the second is skipped and named', async () => {
+    await write('Plugins/Twin/plugin.json', JSON.stringify({ name: 'gtm' }));
+    await write('Plugins/Twin/access.md', '---\nread:\n  - everyone\n---\nread:\n  - Sam <sam@x.io>\n');
+    await write('Plugins/Twin/skills/twin-skill/SKILL.md', '---\ndescription: t\n---\n');
+
+    const tree = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    const paths = [...tree.files.keys()];
+    expect(paths).toContain('plugins/gtm/skills/outreach/SKILL.md');
+    expect(paths).not.toContain('plugins/gtm/skills/twin-skill/SKILL.md');
+    expect(tree.warnings.some((w) => w.includes('Plugins/Twin') && w.includes('already used'))).toBe(true);
+  });
+
+  it('a compile reads the checkout as it is now, not the catalogs a moment ago', async () => {
+    // Warm every cache: the skill catalog, the link index, the access model.
+    const before = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    expect([...before.files.keys()]).not.toContain('skills/late/SKILL.md');
+    expect([...before.files.keys()].some((p) => p.includes('secret'))).toBe(false);
+
+    // Then the knowledge base moves under them, the way an MCP `write_files`
+    // moves it: a new public skill, linked into GTM by its manifest, and a
+    // grant that opens the secret skill — all within every cache's TTL.
+    await write('Skills/Sales/late/SKILL.md', '---\ndescription: Just landed.\n---\n');
+    await write(
+      'Plugins/GTM/plugin.json',
+      JSON.stringify({
+        name: 'gtm',
+        version: '2.1.0',
+        description: 'Go to market',
+        extensions: { 'software.bevel.hexis': { skills: ['Skills/Eng/deploy', 'Skills/Sales/late'] } },
+      }),
+    );
+    await write('Skills/Eng/secret/access.md', '---\n---\nread:\n  - everyone\n');
+
+    const after = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    const paths = [...after.files.keys()];
+    expect(paths).toContain('skills/late/SKILL.md');
+    expect(paths).toContain('plugins/gtm/skills/late/SKILL.md');
+    expect(paths).toContain('skills/secret/SKILL.md');
+  });
+
+  it('a name clash inside one plugin keeps the first by path and says so', async () => {
+    // A second `deploy` skill, linked from the same plugin via a folder root.
+    await write('Skills/Ops/deploy/SKILL.md', '---\ndescription: Ops deploy.\n---\n');
+    await write('Skills/Ops/access.md', '---\n---\nread:\n  - plugin/GTM/read\n');
+    await write(
+      'Plugins/GTM/plugin.json',
+      JSON.stringify({ name: 'gtm', extensions: { 'software.bevel.hexis': { skills: ['Skills/Eng/deploy', 'Skills/Ops'] } } }),
+    );
+    // Catalog-level dedup already keeps ONE `deploy` (Skills/Eng wins by path),
+    // so the compiled plugin has one and the tree stays coherent.
+    const tree = await compiler.compileFor({ userEmail: 'sam@x.io' });
+    expect(text(tree, 'plugins/gtm/skills/deploy/SKILL.md')).toContain('Ship it.');
+  });
+});

package/src/modules/plugins/__tests__/plugin-index.service.test.ts

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { PluginIndexService } from '../plugins.service.js';
+import type { PluginLinkIndex } from '../plugin-links.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
@@ -62,9 +63,14 @@ describe('PluginIndexService', () => {
 
   const kb = () => join(root, wsId, KB_DIR);
 
-  /** A REAL plugin: a folder carrying the access.md that makes it exist. */
+  /**
+   * A REAL plugin: a folder carrying the manifest discovery reads AND the
+   * access.md that makes it exist to the index (a legacy folder without a
+   * manifest gets one from the boot step before the index ever runs).
+   */
   const pluginDir = async (name: string) => {
     await mkdir(join(kb(), 'Plugins', name), { recursive: true });
+    await writeFile(join(kb(), 'Plugins', name, 'plugin.json'), `{"name":"${name.toLowerCase()}"}`);
     await writeFile(join(kb(), 'Plugins', name, 'access.md'), '---\nread:\n  - everyone\n---\n');
   };
 
@@ -79,8 +85,9 @@ describe('PluginIndexService', () => {
     await pluginDir('Engineering');
 
     const catalog = await svc().catalog();
-    expect(catalog.map((g) => g.name)).toEqual(['Engineering', 'GTM']);
-    expect(catalog[1].folders).toEqual(['Plugins/GTM']);
+    // The manifest name is the identity; the folder is what people see.
+    expect(catalog.map((g) => g.name)).toEqual(['engineering', 'gtm']);
+    expect(catalog[1]).toMatchObject({ displayName: 'GTM', folders: ['Plugins/GTM'] });
   });
 
   test('a folder without an access.md is not a plugin', async () => {
@@ -90,10 +97,14 @@ describe('PluginIndexService', () => {
     await mkdir(join(kb(), 'Plugins', 'Ghost'), { recursive: true });
     await mkdir(join(kb(), 'Plugins', 'Residue'), { recursive: true });
     await writeFile(join(kb(), 'Plugins', 'Residue', 'notes.md'), 'leftover');
+    // A manifest alone is a plugin to discovery but not to the index: the
+    // access.md is what a deleted plugin's residue lacks.
+    await mkdir(join(kb(), 'Plugins', 'Manifest-only'), { recursive: true });
+    await writeFile(join(kb(), 'Plugins', 'Manifest-only', 'plugin.json'), '{"name":"manifest-only"}');
     await pluginDir('Real');
 
     const catalog = await svc().catalog();
-    expect(catalog.map((g) => g.name)).toEqual(['Real']);
+    expect(catalog.map((g) => g.name)).toEqual(['real']);
   });
 
   test('the retired Skills/ and Tools/ roots are NOT plugin roots', async () => {
@@ -102,7 +113,7 @@ describe('PluginIndexService', () => {
     await pluginDir('Engineering');
 
     const catalog = await svc().catalog();
-    expect(catalog.map((g) => g.name)).toEqual(['Engineering']);
+    expect(catalog.map((g) => g.name)).toEqual(['engineering']);
   });
 
   test('ignores loose files and dot-dirs under the plugin root', async () => {
@@ -113,7 +124,7 @@ describe('PluginIndexService', () => {
     await writeFile(join(kb(), 'Plugins', 'slack.tool'), '{}');
 
     const catalog = await svc().catalog();
-    expect(catalog.map((g) => g.name)).toEqual(['GTM']);
+    expect(catalog.map((g) => g.name)).toEqual(['gtm']);
   });
 
   test('counts skills and tools from the global catalogs by pluginOfPath', async () => {
@@ -126,14 +137,47 @@ describe('PluginIndexService', () => {
       tools: tools('Plugins/GTM/heyreach.tool', 'Plugins/slack.tool'),
     }).catalog();
 
-    const gtm = catalog.find((g) => g.name === 'GTM')!;
+    const gtm = catalog.find((g) => g.name === 'gtm')!;
     expect(gtm.skillCount).toBe(2);
     expect(gtm.toolCount).toBe(1);
-    const product = catalog.find((g) => g.name === 'Product')!;
+    const product = catalog.find((g) => g.name === 'product')!;
     expect(product.skillCount).toBe(1);
     expect(product.toolCount).toBe(0);
   });
 
+  test("counts the linked skills a plugin's members cannot read, from the unfiltered link index", async () => {
+    await pluginDir('GTM');
+    await pluginDir('Product');
+    // The link index's view: GTM links two shared skills, one of which lost
+    // its grant; Product's inline skill is granted by definition.
+    const membership = vi.fn(async () => ({
+      bySkill: new Map([
+        ['Skills/Eng/deploy', [{ name: 'gtm', linked: true, granted: false }]],
+        ['Skills/Eng/rollback', [{ name: 'gtm', linked: true, granted: true }]],
+        ['Plugins/Product/roadmap', [{ name: 'product', linked: false, granted: true }]],
+      ]),
+      byPlugin: new Map(),
+    }));
+    const links = { membership } as unknown as PluginLinkIndex;
+    const catalog = await new PluginIndexService(
+      workspaceService,
+      principals,
+      skillService(skills('Skills/Eng/deploy', 'Skills/Eng/rollback', 'Plugins/Product/roadmap')),
+      toolService(),
+      KB_DIR,
+      Date.now,
+      links,
+    ).catalog();
+
+    expect(catalog.find((g) => g.name === 'gtm')).toMatchObject({ skillCount: 2, brokenLinks: 1 });
+    expect(catalog.find((g) => g.name === 'product')).toMatchObject({ skillCount: 1, brokenLinks: 0 });
+    // Both counts from ONE read of the index: its cache has no single-flight,
+    // so two concurrent reads of a cold catalog would build the tree twice.
+    expect(membership).toHaveBeenCalledTimes(1);
+    // Without a link index there are no links to be broken.
+    expect((await svc().catalog()).every((g) => g.brokenLinks === 0)).toBe(true);
+  });
+
   test('resolves principals on the plugin folder', async () => {
     await pluginDir('GTM');
 
@@ -190,7 +234,7 @@ describe('PluginIndexService', () => {
     await expect(service.catalog()).resolves.toEqual([]);
 
     fail = false;
-    expect((await service.catalog()).map((g) => g.name)).toEqual(['GTM']);
+    expect((await service.catalog()).map((g) => g.name)).toEqual(['gtm']);
     warn.mockRestore();
   });
 
@@ -214,12 +258,12 @@ describe('PluginIndexService', () => {
     await pluginDir('GTM');
     const service = svc();
 
-    expect((await service.catalog()).map((g) => g.name)).toEqual(['GTM']);
+    expect((await service.catalog()).map((g) => g.name)).toEqual(['gtm']);
     // A plugin added out of band is NOT seen while the cache holds…
     await pluginDir('Finance');
-    expect((await service.catalog()).map((g) => g.name)).toEqual(['GTM']);
+    expect((await service.catalog()).map((g) => g.name)).toEqual(['gtm']);
     // …and IS seen once the file-change subscriber drops it.
     service.invalidate();
-    expect((await service.catalog()).map((g) => g.name)).toEqual(['Finance', 'GTM']);
+    expect((await service.catalog()).map((g) => g.name)).toEqual(['finance', 'gtm']);
   });
 });