@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/src/modules/plugins/__tests__/plugin-provision.service.test.ts

@@ -1,4 +1,6 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NodeFs } from '../../kb-fs/node-fs.js';
+import { KbPluginSource } from '../discovery/kb-plugin-source.js';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -6,6 +8,7 @@ import { DEFAULT_BRANCH, personalPluginFolderName } from '@bevel-software/platfo
 import type { AuthUser } from '@bevel-software/platform-shared';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
+import { isPrivateAccessMd } from '../../access-model/access-grammar.js';
 import {
   PluginProvisionError,
   PluginProvisionService,
@@ -47,10 +50,24 @@ async function makeHarness() {
   const commits = { runPendingCommit: vi.fn(async () => undefined) };
   const accessControl = { invalidate: vi.fn() } as unknown as IAccessControl;
   const events = { emit: vi.fn() };
-  const svc = new PluginProvisionService(workspaceService, commits, accessControl, KB, events);
+  const svc = new PluginProvisionService(workspaceService, commits, accessControl, KB, events, new KbPluginSource(new NodeFs()), new NodeFs());
   return { svc, dir, commits, accessControl, events, writeFile };
 }
 
+/** Wait until a delete has parked `dir` (it is gone from its place) — the moment a racing creation may start. */
+async function untilParked(dir: string): Promise<void> {
+  for (let i = 0; i < 200; i++) {
+    if (await fs.stat(dir).then(() => false, () => true)) return;
+    await new Promise((r) => setTimeout(r, 5));
+  }
+  throw new Error(`${dir} was never parked`);
+}
+
+/** Let every pending microtask and short timer run — enough for a queued lock waiter to be queued. */
+async function settle(): Promise<void> {
+  for (let i = 0; i < 5; i++) await new Promise((r) => setTimeout(r, 5));
+}
+
 describe('PluginProvisionService.createPlugin', () => {
   let h: Awaited<ReturnType<typeof makeHarness>>;
   beforeEach(async () => {
@@ -59,13 +76,32 @@ describe('PluginProvisionService.createPlugin', () => {
 
   it('writes the discoverable template, commits it inline, and drops the access cache', async () => {
     const result = await h.svc.createPlugin(USER, 'GTM');
-    expect(result).toEqual({ folder: 'GTM', created: true });
+    // The folder is where it lives; the name is what it IS (the identity the
+    // page navigates to and the grants spell).
+    expect(result).toEqual({
+      folder: 'GTM',
+      path: 'Plugins/GTM',
+      skillsDir: 'Plugins/GTM/skills',
+      name: 'gtm',
+      // The name its creator typed, trimmed — persisted, and reported back
+      // exactly as persisted.
+      displayName: 'GTM',
+      created: true,
+    });
 
     const accessMd = await fs.readFile(path.join(h.dir, KB, 'Plugins/GTM/access.md'), 'utf-8');
     // Discoverable FILE (frontmatter read: everyone), creator-run FOLDER
-    // (body names the creator under all three verbs).
-    expect(accessMd.startsWith('---\nread:\n  - everyone\n---\n')).toBe(true);
-    const body = accessMd.slice(accessMd.indexOf('---\n', 4) + 4);
+    // (body names the creator under all three verbs) — each block saying,
+    // in its own comments, what it governs and how to admit people.
+    expect(accessMd.startsWith('---\n')).toBe(true);
+    const close = accessMd.indexOf('\n---\n', 4);
+    const frontmatter = accessMd.slice(4, close);
+    const body = accessMd.slice(close + 5);
+    expect(frontmatter).toMatch(/read:\n\s+- everyone/);
+    expect(frontmatter).not.toContain('Ali Vega');
+    expect(frontmatter).toMatch(/governs this access\.md FILE only/);
+    expect(body).toMatch(/governs the PLUGIN FOLDER/);
+    expect(body).toMatch(/To admit people/);
     for (const verb of ['read', 'write', 'owner']) {
       expect(body).toMatch(new RegExp(`${verb}:[\\s\\S]*Ali Vega <ali@example.com>`));
     }
@@ -87,7 +123,58 @@ describe('PluginProvisionService.createPlugin', () => {
     expect(h.accessControl.invalidate).toHaveBeenCalledWith('ws-main');
   });
 
-  it('writes a conformant plugin.json naming the folder in slug form', async () => {
+  it('makes a plugin INSIDE a grouping folder when one is named — the folder path is where it lives, the leaf is what it is', async () => {
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/Teams/EU'), { recursive: true });
+    const result = await h.svc.createPlugin(USER, 'Sales', 'Teams/EU');
+    expect(result).toEqual({
+      folder: 'Teams/EU/Sales',
+      path: 'Plugins/Teams/EU/Sales',
+      skillsDir: 'Plugins/Teams/EU/Sales/skills',
+      name: 'sales',
+      displayName: 'Sales',
+      created: true,
+    });
+    const manifest = JSON.parse(await fs.readFile(path.join(h.dir, KB, 'Plugins/Teams/EU/Sales/plugin.json'), 'utf-8'));
+    expect(manifest.name).toBe('sales');
+    expect(await fs.readFile(path.join(h.dir, KB, 'Plugins/Teams/EU/Sales/access.md'), 'utf-8')).toContain('Ali Vega');
+    // One folder-scoped commit, at the nested path.
+    expect(h.commits.runPendingCommit).toHaveBeenCalledWith('ws-main', DEFAULT_BRANCH, `${KB}/Plugins/Teams/EU/Sales`, USER, {
+      systemAuthorized: true,
+    });
+    // Taken is judged by IDENTITY, which is global: the slug a nested plugin
+    // publishes is the one a client keys it by, so the same name is taken in
+    // that folder and at the root alike.
+    await expect(h.svc.createPlugin(USER, 'sales', 'Teams/EU')).rejects.toMatchObject({ status: 409 });
+    await expect(h.svc.createPlugin(USER, 'sales')).rejects.toMatchObject({ status: 409 });
+  });
+
+  it('refuses a parent that is not there (404), not a folder name (422), a personal space, or a plugin — a plugin cannot hold another', async () => {
+    await expect(h.svc.createPlugin(USER, 'X', 'Nope')).rejects.toMatchObject({ status: 404 });
+    // The NAME is judged first: a name that can never be created is refused
+    // as such, whatever the parent — not as a missing folder.
+    await expect(h.svc.createPlugin(USER, 'a/b', 'Nope')).rejects.toMatchObject({ status: 422 });
+    await expect(h.svc.createPlugin(USER, 'X', 'a/../b')).rejects.toMatchObject({ status: 422 });
+    await expect(h.svc.createPlugin(USER, 'X', '.hidden')).rejects.toMatchObject({ status: 422 });
+    await expect(h.svc.createPlugin(USER, 'X', personalPluginFolderName(USER.id))).rejects.toMatchObject({ status: 422 });
+    // Discovery says GTM is a plugin: nothing may be made inside it, at any depth.
+    await h.svc.createPlugin(USER, 'GTM');
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/GTM/skills'), { recursive: true });
+    await expect(h.svc.createPlugin(USER, 'X', 'GTM')).rejects.toMatchObject({ status: 422 });
+    await expect(h.svc.createPlugin(USER, 'X', 'GTM/skills')).rejects.toMatchObject({ status: 422 });
+    // A TWIN of GTM — same slug, so discovery lists it under no catalog —
+    // still claims its subtree: a plugin made inside it would be invisible.
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/Teams/GTM/sub'), { recursive: true });
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/Teams/GTM/plugin.json'), '{"name":"gtm"}');
+    await expect(h.svc.createPlugin(USER, 'X', 'Teams/GTM')).rejects.toMatchObject({ status: 422 });
+    await expect(h.svc.createPlugin(USER, 'X', 'Teams/GTM/sub')).rejects.toMatchObject({ status: 422 });
+    // A padded spelling names no folder: refused, never trimmed into one.
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/Teams'), { recursive: true });
+    await expect(h.svc.createPlugin(USER, 'X', 'Teams ')).rejects.toMatchObject({ status: 422 });
+    // The root, spelled as absence or as the empty string, is still the root.
+    expect((await h.svc.createPlugin(USER, 'Root', '')).folder).toBe('Root');
+  });
+
+  it('writes a conformant plugin.json: the identifier in slug form, the typed name as the display name', async () => {
     await h.svc.createPlugin(USER, 'GTM');
     const manifest = JSON.parse(
       await fs.readFile(path.join(h.dir, KB, 'Plugins/GTM/plugin.json'), 'utf-8'),
@@ -95,6 +182,7 @@ describe('PluginProvisionService.createPlugin', () => {
     expect(manifest).toEqual({
       $schema: 'https://agent-plugins.org/schemas/1.0.0/plugin.schema.json',
       name: 'gtm',
+      displayName: 'GTM',
     });
     // The schema's `name` pattern is the thing a conformant client refuses on.
     expect(manifest.name).toMatch(/^(?!.*(?:--|\.\.))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/);
@@ -116,8 +204,9 @@ describe('PluginProvisionService.createPlugin', () => {
     // Only the first folder landed.
     expect(await fs.readdir(path.join(h.dir, KB, 'Plugins'))).toEqual(['Sales Team']);
     // A genuinely distinct slug still goes through.
-    await expect(h.svc.createPlugin(USER, 'Sales Ops')).resolves.toEqual({
+    await expect(h.svc.createPlugin(USER, 'Sales Ops')).resolves.toMatchObject({
       folder: 'Sales Ops',
+      name: 'sales-ops',
       created: true,
     });
   });
@@ -143,8 +232,9 @@ describe('PluginProvisionService.createPlugin', () => {
     // plugin FOLDER publishes a manifest identity.
     await fs.mkdir(path.join(h.dir, KB, 'Plugins'), { recursive: true });
     await fs.writeFile(path.join(h.dir, KB, 'Plugins', 'slack.tool'), 'id: slack\n', 'utf-8');
-    await expect(h.svc.createPlugin(USER, 'Slack Tool')).resolves.toEqual({
+    await expect(h.svc.createPlugin(USER, 'Slack Tool')).resolves.toMatchObject({
       folder: 'Slack Tool',
+      name: 'slack-tool',
       created: true,
     });
   });
@@ -180,7 +270,7 @@ describe('PluginProvisionService.createPlugin', () => {
     await expect(h.svc.createPlugin(USER, 'GTM')).rejects.toThrow('push refused');
     // The folder is gone again — the next attempt starts clean.
     await expect(fs.stat(path.join(h.dir, KB, 'Plugins/GTM'))).rejects.toThrow();
-    await expect(h.svc.createPlugin(USER, 'GTM')).resolves.toEqual({ folder: 'GTM', created: true });
+    await expect(h.svc.createPlugin(USER, 'GTM')).resolves.toMatchObject({ folder: 'GTM', name: 'gtm', created: true });
   });
 });
 
@@ -220,6 +310,116 @@ describe('PluginProvisionService.deletePlugin', () => {
     );
   });
 
+  it('refuses a folder path the filesystem cannot carry with 422 — control characters, a reserved name, a dot-prefix', async () => {
+    for (const bad of ['teams/Deep', 'a\tb', 'teams/NUL', '.deleting-x', 'teams/.hidden']) {
+      await expect(h.svc.deletePlugin(USER, bad)).rejects.toMatchObject({ status: 422 });
+    }
+  });
+
+  it('a bundle-shaped plugin locks on the SLUG of the name its bundle declares — the one a creation would take', async () => {
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/Ext'), { recursive: true });
+    // Declared as people write it, not as the marketplace publishes it.
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/Ext/plugin.bundle.json'), '{"name":"Ext Id"}');
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/Ext/access.md'), '---\n---\n');
+    let refuse: (err: Error) => void = () => {};
+    h.commits.runPendingCommit.mockImplementationOnce(
+      () => new Promise<undefined>((_resolve, reject) => { refuse = reject; }),
+    );
+    const deleting = h.svc.deletePlugin(USER, 'Ext');
+    await untilParked(path.join(h.dir, KB, 'Plugins/Ext'));
+    // Spelled differently, same identity: must wait for the delete, then see the twin.
+    const creating = h.svc.createPlugin(USER, 'Ext Id');
+    await settle();
+    refuse(new Error('push refused'));
+    await expect(deleting).rejects.toThrow('push refused');
+    await expect(creating).rejects.toMatchObject({ status: 409 });
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/Ext/plugin.bundle.json'))).resolves.toBeDefined();
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/Ext Id'))).rejects.toThrow();
+  });
+
+  it('validates the folder path AS GIVEN — a padded spelling is refused, never trimmed into a real folder', async () => {
+    await h.svc.createPlugin(USER, 'GTM');
+    for (const padded of [' GTM', 'GTM ', 'teams/ Deep']) {
+      await expect(h.svc.deletePlugin(USER, padded)).rejects.toMatchObject({ status: 422 });
+    }
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/GTM/plugin.json'))).resolves.toBeDefined();
+    expect(h.commits.runPendingCommit).toHaveBeenCalledTimes(1); // the create above only
+  });
+
+  it('a hole ANYWHERE in discovery stops a delete — even of a plugin whose own folder was read fine', async () => {
+    await h.svc.createPlugin(USER, 'GTM');
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/Other'), { recursive: true });
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/Other/plugin.json'), '{"name":"other"}');
+    const real = fs.readFile;
+    const spy = vi.spyOn(fs, 'readFile').mockImplementation(((file: string, opts: unknown) =>
+      String(file).endsWith(path.join('Other', 'plugin.json'))
+        ? Promise.reject(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' }))
+        : (real as (f: string, o: unknown) => Promise<unknown>).call(fs, file, opts)) as never);
+    try {
+      await expect(h.svc.deletePlugin(USER, 'GTM')).rejects.toMatchObject({ status: 503 });
+    } finally {
+      spy.mockRestore();
+    }
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/GTM/plugin.json'))).resolves.toBeDefined();
+    expect(h.commits.runPendingCommit).toHaveBeenCalledTimes(1); // the create above only
+  });
+
+  it('a manifest that is there but cannot be read stops the delete — never a guessed identity lock', async () => {
+    await h.svc.createPlugin(USER, 'GTM');
+    const real = fs.readFile;
+    const spy = vi.spyOn(fs, 'readFile').mockImplementation(((file: string, opts: unknown) =>
+      String(file).endsWith(path.join('GTM', 'plugin.json'))
+        ? Promise.reject(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' }))
+        : (real as (f: string, o: unknown) => Promise<unknown>).call(fs, file, opts)) as never);
+    try {
+      // Discovery reports the hole; the delete refuses the way a creation would.
+      await expect(h.svc.deletePlugin(USER, 'GTM')).rejects.toMatchObject({ status: 503 });
+    } finally {
+      spy.mockRestore();
+    }
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/GTM/plugin.json'))).resolves.toBeDefined();
+  });
+
+  it('a nested plugin holds its identity against a creation at the root — taken is discovery\'s answer', async () => {
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/teams/Deep'), { recursive: true });
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/plugin.json'), '{"name":"deep"}');
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/access.md'), '---\n---\n');
+    await expect(h.svc.createPlugin(USER, 'Deep')).rejects.toMatchObject({ status: 409 });
+    await expect(h.svc.createPlugin(USER, 'Deep')).rejects.toThrow('Plugins/teams/Deep');
+  });
+
+  it('a delete and a creation of one IDENTITY never overlap — even when the identity is not the folder path', async () => {
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/teams/Deep'), { recursive: true });
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/plugin.json'), '{"name":"deep"}');
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/access.md'), '---\n---\n');
+    // The delete's commit hangs, then is REFUSED — the folder comes back.
+    let refuse: (err: Error) => void = () => {};
+    h.commits.runPendingCommit.mockImplementationOnce(
+      () => new Promise<undefined>((_resolve, reject) => { refuse = reject; }),
+    );
+    const deleting = h.svc.deletePlugin(USER, 'teams/Deep');
+    await untilParked(path.join(h.dir, KB, 'Plugins/teams/Deep'));
+    // A creation of the same identity, started while the folder is parked
+    // and invisible: it must wait for the delete, not slip in beside it.
+    const creating = h.svc.createPlugin(USER, 'Deep');
+    await settle();
+    refuse(new Error('push refused'));
+    await expect(deleting).rejects.toThrow('push refused');
+    // The delete rolled back, so `deep` is still taken — and the creation sees it.
+    await expect(creating).rejects.toMatchObject({ status: 409 });
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/teams/Deep/plugin.json'))).resolves.toBeDefined();
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/Deep'))).rejects.toThrow();
+  });
+
+  it('deletes a plugin whose name sits at the filesystem component limit — the park adds nothing to the name', async () => {
+    // 240 characters: valid to create (≤ 255 bytes), and long enough that a
+    // park spelled `.<name>.deleting-<uuid>` would not be a legal component.
+    const long = 'a'.repeat(240);
+    await h.svc.createPlugin(USER, long);
+    await h.svc.deletePlugin(USER, long);
+    expect(await fs.readdir(path.join(h.dir, KB, 'Plugins'))).toEqual([]);
+  });
+
   it('refuses an unknown name — and a casing mismatch, which is the same thing — with 404', async () => {
     await h.svc.createPlugin(USER, 'GTM');
     for (const name of ['Nope', 'gtm']) {
@@ -228,6 +428,77 @@ describe('PluginProvisionService.deletePlugin', () => {
     expect(await fs.readdir(path.join(h.dir, KB, 'Plugins'))).toEqual(['GTM']);
   });
 
+  it('deletes a plugin nested below the root by its folder PATH, parking it beside itself', async () => {
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/teams/Deep'), { recursive: true });
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/plugin.json'), '{"name":"deep"}');
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/access.md'), '---\n---\n');
+
+    await h.svc.deletePlugin(USER, 'teams/Deep');
+
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/teams/Deep'))).rejects.toThrow();
+    expect(await fs.readdir(path.join(h.dir, KB, 'Plugins/teams'))).toEqual([]);
+    expect(h.commits.runPendingCommit).toHaveBeenCalledWith(
+      'ws-main',
+      DEFAULT_BRANCH,
+      `${KB}/Plugins/teams/Deep`,
+      USER,
+      { systemAuthorized: true },
+    );
+    // Segments only — nothing climbs out of the root, and no backslash (a
+    // second separator on Windows); a missing nested folder is unknown.
+    await expect(h.svc.deletePlugin(USER, '../etc')).rejects.toMatchObject({ status: 422 });
+    await expect(h.svc.deletePlugin(USER, 'teams\\Deep')).rejects.toMatchObject({ status: 422 });
+    await expect(h.svc.deletePlugin(USER, 'teams/Nope')).rejects.toMatchObject({ status: 404 });
+  });
+
+  it('removes nothing but the plugin it names — a sibling that happens to look like a park survives', async () => {
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/teams/Deep'), { recursive: true });
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/plugin.json'), '{"name":"deep"}');
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/access.md'), '---\n---\n');
+    // Whatever this is — a person's folder, the residue of a crashed run — it is not ours to delete.
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/teams/.Deep.deleting'), { recursive: true });
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/.Deep.deleting/keep.md'), 'mine');
+
+    await h.svc.deletePlugin(USER, 'teams/Deep');
+
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/teams/Deep'))).rejects.toThrow();
+    expect(await fs.readFile(path.join(h.dir, KB, 'Plugins/teams/.Deep.deleting/keep.md'), 'utf-8')).toBe('mine');
+    expect(await fs.readdir(path.join(h.dir, KB, 'Plugins/teams'))).toEqual(['.Deep.deleting']);
+  });
+
+  it('deletes only the exact spelling, at every depth — a stale casing must not park a replacement at the same place', async () => {
+    await fs.mkdir(path.join(h.dir, KB, 'Plugins/teams/Deep'), { recursive: true });
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/plugin.json'), '{"name":"deep"}');
+    await fs.writeFile(path.join(h.dir, KB, 'Plugins/teams/Deep/access.md'), '---\n---\n');
+
+    // On a case-insensitive filesystem both of these `stat` fine — and must still be refused.
+    await expect(h.svc.deletePlugin(USER, 'teams/deep')).rejects.toMatchObject({ status: 404 });
+    await expect(h.svc.deletePlugin(USER, 'Teams/Deep')).rejects.toMatchObject({ status: 404 });
+    expect(await fs.readdir(path.join(h.dir, KB, 'Plugins/teams'))).toEqual(['Deep']);
+    expect(h.commits.runPendingCommit).not.toHaveBeenCalled();
+  });
+
+  it('a folder that cannot be LISTED is an error, never "unknown plugin" — absence and failure are different answers', async () => {
+    await h.svc.createPlugin(USER, 'GTM');
+    const real = fs.readdir;
+    const spy = vi.spyOn(fs, 'readdir').mockImplementation(((dir: string, opts: unknown) => {
+      if (String(dir).endsWith('Plugins')) {
+        return Promise.reject(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' }));
+      }
+      return (real as (d: string, o: unknown) => Promise<unknown>).call(fs, dir, opts);
+    }) as never);
+    try {
+      // Discovery cannot list the root: a hole, refused as such — never "unknown plugin" (404).
+      await expect(h.svc.deletePlugin(USER, 'GTM')).rejects.toMatchObject({ status: 503 });
+      await expect(h.svc.createPlugin(USER, 'Ops')).rejects.toMatchObject({ status: 503 });
+    } finally {
+      spy.mockRestore();
+    }
+    // Nothing moved, nothing committed: the plugin is exactly where it was.
+    await expect(fs.stat(path.join(h.dir, KB, 'Plugins/GTM/plugin.json'))).resolves.toBeDefined();
+    expect(h.commits.runPendingCommit).toHaveBeenCalledTimes(1); // the create above only
+  });
+
   it('never deletes a personal folder through the plugin door', async () => {
     await h.svc.ensurePersonalPlugin(USER);
     const folder = personalPluginFolderName(USER.id);
@@ -260,20 +531,35 @@ describe('PluginProvisionService.ensurePersonalPlugin', () => {
     const folder = personalPluginFolderName(USER.id);
 
     const first = await h.svc.ensurePersonalPlugin(USER);
-    expect(first).toEqual({ folder, created: true });
+    expect(first).toEqual({
+      folder,
+      path: `Plugins/${folder}`,
+      skillsDir: `Plugins/${folder}/skills`,
+      name: folder,
+      displayName: folder,
+      created: true,
+    });
     const accessMd = await fs.readFile(
       path.join(h.dir, KB, 'Plugins', folder, 'access.md'),
       'utf-8',
     );
-    // PRIVATE: no `everyone` self-grant anywhere — the file follows the
-    // folder chain, and the rules close that chain to the owner alone.
-    expect(accessMd).not.toContain('everyone');
-    for (const verb of ['read', 'write', 'owner']) {
-      expect(accessMd).toMatch(new RegExp(`${verb}:[\\s\\S]*Ali Vega <ali@example.com>`));
+    // PRIVATE, in both blocks: the frontmatter denies `everyone` and names the
+    // owner (the space is listed for no one else, and the file says so), and
+    // the body denies `everyone` — so a root-level `read: everyone` an admin
+    // adds later cannot open it — naming the owner and nobody else, Admin
+    // included.
+    const close = accessMd.indexOf('\n---\n', 4);
+    const frontmatter = accessMd.slice(4, close);
+    const body = accessMd.slice(close + 5);
+    expect(frontmatter).toMatch(/read:\n(?:\s+#.*\n)*\s+- deny everyone\n\s+- Ali Vega <ali@example.com>$/);
+    expect(body).toMatch(/read:\n(?:\s+#.*\n)*\s+- deny everyone\n/);
+    expect(body).not.toMatch(/^\s+- Admin/m);
+    for (const verb of ['read', 'write', 'owner'] as const) {
+      expect(verbBlock(body, verb)).toContain('Ali Vega <ali@example.com>');
     }
 
     const second = await h.svc.ensurePersonalPlugin(USER);
-    expect(second).toEqual({ folder, created: false });
+    expect(second).toMatchObject({ folder, path: `Plugins/${folder}`, created: false });
     // Idempotent for real: one provision (access.md + plugin.json), one commit.
     expect(h.writeFile).toHaveBeenCalledTimes(2);
     expect(h.commits.runPendingCommit).toHaveBeenCalledTimes(1);
@@ -299,14 +585,38 @@ describe('PluginProvisionService.ensurePersonalPlugin', () => {
   });
 });
 
+/**
+ * One verb's block of an access.md region — from `<verb>:` up to the next
+ * verb key or the end — so an assertion about a grant under `write:` cannot
+ * be satisfied by the same line under `owner:`.
+ */
+function verbBlock(region: string, verb: 'read' | 'write' | 'owner'): string {
+  const match = region.match(new RegExp(`(?:^|\\n)${verb}:[\\s\\S]*?(?=\\n(?:read|write|download|owner):|$)`));
+  if (!match) throw new Error(`no ${verb}: block in\n${region}`);
+  return match[0];
+}
+
 describe('access.md templates', () => {
-  it('plugin template is discoverable, personal template is not — same creator grants in both', () => {
+  it('plugin template is discoverable, personal template denies everyone in both blocks — same creator grants in both bodies', () => {
     const plugin = pluginAccessMd(USER);
     const personal = personalAccessMd(USER);
-    expect(plugin).toContain('everyone');
-    expect(personal).not.toContain('everyone');
+    const split = (text: string) => {
+      const close = text.indexOf('\n---\n', 4);
+      return { frontmatter: text.slice(4, close), body: text.slice(close + 5) };
+    };
+    expect(split(plugin).frontmatter).toMatch(/read:\n\s+- everyone/);
+    expect(split(plugin).frontmatter).not.toContain('Ali Vega');
+    // The personal file's own block is the private shape the Library marks:
+    // the denial, then the owner, nobody else.
+    expect(split(personal).frontmatter).toMatch(/read:\n(?:\s+#.*\n)*\s+- deny everyone\n\s+- Ali Vega <ali@example.com>$/);
+    expect(isPrivateAccessMd(personal)).toBe(true);
+    expect(isPrivateAccessMd(plugin)).toBe(false);
+    expect(split(personal).body).toMatch(/- deny everyone\n/);
+    expect(split(personal).body).not.toMatch(/^\s+- Admin/m);
     for (const text of [plugin, personal]) {
-      expect(text).toContain('Ali Vega <ali@example.com>');
+      for (const verb of ['read', 'write', 'owner'] as const) {
+        expect(verbBlock(split(text).body, verb)).toContain('Ali Vega <ali@example.com>');
+      }
     }
   });
 });