@bevel-software/platform-core-backend 0.15.1 → 0.20.0

package/src/modules/mcp/oauth/bevel-oauth-provider.ts

@@ -1,5 +1,8 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { and, eq, gt, isNull, lt, or } from 'drizzle-orm';
+import { logger } from '../../../shared/logging.js';
+
+const log = logger('mcp-oauth');
+import { and, count, eq, gt, isNull, lt, or, sql } from 'drizzle-orm';
 import type { Response } from 'express';
 import type {
   AuthorizationParams,
@@ -18,7 +21,7 @@ import type {
   OAuthTokens,
 } from '@modelcontextprotocol/sdk/shared/auth.js';
 import type { Database } from '../../database/connection.js';
-import { oauthAuthCodes, oauthClients, oauthTokens, users } from '../../database/schema.js';
+import { agentConnections, oauthAuthCodes, oauthClients, oauthTokens, users } from '../../database/schema.js';
 import type { TokenCrypto } from '../../../shared/token-crypto.js';
 import { signAuthRequest, type McpAuthRequestState } from './oauth-state.js';
 
@@ -31,6 +34,13 @@ const TOKEN_BYTES = 32;
 const ACCESS_TTL_MS = 60 * 60_000; // 1 hour
 const REFRESH_TTL_MS = 30 * 24 * 60 * 60_000; // 30 days, rotated on use
 const CODE_TTL_MS = 60_000; // exchanged within seconds of Finish
+/**
+ * How often, at most, one process stamps an agent connection's `last_used_at`.
+ * The Audit log shows the instant relatively ("4 minutes ago"), so a minute's
+ * staleness is invisible, while a write per request on a chain-heavy session
+ * would serialise hundreds of requests a minute on one row.
+ */
+const CONNECTION_TOUCH_INTERVAL_MS = 60_000;
 
 export interface BevelOAuthProviderDeps {
   db: Database;
@@ -63,6 +73,8 @@ export interface BevelOAuthProviderDeps {
  */
 export class BevelOAuthProvider implements OAuthServerProvider {
   private readonly store: OAuthRegisteredClientsStore;
+  /** When this process last stamped each connection's use — see {@link noteConnectionUse}. */
+  private readonly connectionTouchedAt = new Map<string, number>();
 
   constructor(private readonly deps: BevelOAuthProviderDeps) {
     this.store = {
@@ -273,15 +285,36 @@ export class BevelOAuthProvider implements OAuthServerProvider {
       }
       scope = scopes.join(' ');
     }
-    return this.mintTokens(row.userId, row.clientId, scope, row.resource);
+    // A refresh STAYS on its token's agent connection and is refused once
+    // that connection is revoked. The connection is the authority on whether
+    // the agent may hold tokens at all: were a refresh to look the connection
+    // up afresh, one racing a revoke would find none live, make a new one and
+    // mint an unrevoked pair — the revoke undone by a millisecond. A token
+    // from before connections existed has none to stay on and is placed
+    // under one as a first mint would be.
+    if (row.connectionId) {
+      if (!(await this.isConnectionLive(row.connectionId))) {
+        throw new InvalidGrantError('Access for this agent was revoked');
+      }
+      this.noteConnectionUse(row.connectionId);
+    }
+    return this.mintTokens(row.userId, row.clientId, scope, row.resource, row.connectionId ?? undefined);
   }
 
   async verifyAccessToken(token: string): Promise<AuthInfo> {
     const now = new Date();
+    // The agent connection is joined so a token of a REVOKED connection fails
+    // here whatever its own row says: revoking an agent marks its tokens too,
+    // but the connection is the authority, and a token minted a moment after
+    // the revoke (a refresh that raced it) is dead on arrival rather than
+    // live until its own expiry. A token from before connections existed
+    // (null `connection_id`) has no connection to be revoked and verifies on
+    // its own row alone.
     const [row] = await this.deps.db
       .select({
         id: oauthTokens.id,
         clientId: oauthTokens.clientId,
+        connectionId: oauthTokens.connectionId,
         scope: oauthTokens.scope,
         resource: oauthTokens.resource,
         expiresAt: oauthTokens.expiresAt,
@@ -290,11 +323,13 @@ export class BevelOAuthProvider implements OAuthServerProvider {
       })
       .from(oauthTokens)
       .innerJoin(users, eq(oauthTokens.userId, users.id))
+      .leftJoin(agentConnections, eq(oauthTokens.connectionId, agentConnections.id))
       .where(
         and(
           eq(oauthTokens.accessTokenHash, hashToken(token)),
           isNull(oauthTokens.revokedAt),
           gt(oauthTokens.expiresAt, now),
+          or(isNull(oauthTokens.connectionId), isNull(agentConnections.revokedAt)),
         ),
       )
       .limit(1);
@@ -307,14 +342,23 @@ export class BevelOAuthProvider implements OAuthServerProvider {
       .update(oauthTokens)
       .set({ lastUsedAt: now })
       .where(eq(oauthTokens.id, row.id))
-      .then(undefined, (err) => console.warn('[mcp-oauth] touch lastUsedAt failed:', err));
+      .then(undefined, (err) => log.warn('touch lastUsedAt failed:', { err }));
+    // The agent connection's own "last used" — what the Audit log shows for
+    // the agent, across every token it has held. Throttled, never awaited.
+    if (row.connectionId) this.noteConnectionUse(row.connectionId);
     return {
       token,
       clientId: row.clientId,
       scopes: (row.scope ?? '').split(' ').filter(Boolean),
       expiresAt: Math.floor(row.expiresAt.getTime() / 1000),
       resource: row.resource ? new URL(row.resource) : undefined,
-      extra: { userId: row.userId, userEmail: row.userEmail },
+      extra: {
+        userId: row.userId,
+        userEmail: row.userEmail,
+        // Null on a token minted before connections existed; the auth
+        // middleware then binds no agent and the call goes unrecorded.
+        connectionId: row.connectionId,
+      },
     };
   }
 
@@ -340,7 +384,7 @@ export class BevelOAuthProvider implements OAuthServerProvider {
     // RFC 7009: revoking an unknown/foreign/already-revoked token is a no-op.
     // The token may be either half of a pair — one UPDATE matching either hash.
     const hash = hashToken(request.token);
-    await this.deps.db
+    const revoked = await this.deps.db
       .update(oauthTokens)
       .set({ revokedAt: new Date() })
       .where(
@@ -349,14 +393,39 @@ export class BevelOAuthProvider implements OAuthServerProvider {
           isNull(oauthTokens.revokedAt),
           or(eq(oauthTokens.accessTokenHash, hash), eq(oauthTokens.refreshTokenHash, hash)),
         ),
-      );
+      )
+      .returning({ connectionId: oauthTokens.connectionId });
+    // A client revoking its own token is signing out. When that leaves the
+    // agent connection with no live token at all, the connection is over
+    // too — disconnected by its owner, as the Audit log then says — rather
+    // than listed as live forever with nothing behind it. (The proxy's own
+    // reset of a broken sign-in goes through `revokeByAccessToken`, not
+    // here, and must NOT close the connection: that agent is being sent
+    // back to re-authorise into the same one.)
+    const connectionId = revoked.find((r) => r.connectionId)?.connectionId;
+    if (!connectionId) return;
+    const [{ live }] = await this.deps.db
+      .select({ live: count() })
+      .from(oauthTokens)
+      .where(and(eq(oauthTokens.connectionId, connectionId), isNull(oauthTokens.revokedAt)));
+    if (Number(live) > 0) return;
+    await this.deps.db
+      .update(agentConnections)
+      .set({ revokedAt: new Date(), revokedBy: 'owner' })
+      .where(and(eq(agentConnections.id, connectionId), isNull(agentConnections.revokedAt)));
   }
 
+  /**
+   * @param connectionId The agent connection the pair belongs to, when the
+   *   caller already holds one (a refresh: the consumed token's). Absent on a
+   *   first mint, which finds or makes the live connection for (user, client).
+   */
   private async mintTokens(
     userId: string,
     clientId: string,
     scope: string | null,
     resource: string | null,
+    connectionId?: string,
   ): Promise<OAuthTokens> {
     const accessToken = this.deps.tokenPrefix + randomBytes(TOKEN_BYTES).toString('base64url');
     const refreshToken = this.refreshPrefix + randomBytes(TOKEN_BYTES).toString('base64url');
@@ -377,13 +446,15 @@ export class BevelOAuthProvider implements OAuthServerProvider {
       );
       await this.deps.db.delete(oauthAuthCodes).where(lt(oauthAuthCodes.expiresAt, cutoff));
     } catch (err) {
-      console.warn('[mcp-oauth] token-table prune failed (non-fatal):', err instanceof Error ? err.message : err);
+      log.warn('token-table prune failed (non-fatal):', { err });
     }
+    const boundTo = connectionId ?? (await this.ensureConnection(userId, clientId));
     await this.deps.db.insert(oauthTokens).values({
       accessTokenHash: hashToken(accessToken),
       refreshTokenHash: hashToken(refreshToken),
       clientId,
       userId,
+      connectionId: boundTo,
       scope,
       resource,
       expiresAt: new Date(now + ACCESS_TTL_MS),
@@ -397,6 +468,116 @@ export class BevelOAuthProvider implements OAuthServerProvider {
       ...(scope ? { scope } : {}),
     };
   }
+
+  /**
+   * The live `agent_connections` row for (user, client) — found, or made on
+   * the first mint for the pair. A refresh finds the row the sign-in made, so
+   * one connection spans every token the agent ever holds; a mint after a
+   * revoke finds nothing live and makes a fresh row, which is what keeps the
+   * revoked one's history intact.
+   *
+   * Two concurrent first mints (a client racing its own token exchange) both
+   * miss the select; the partial unique index lets exactly one insert land,
+   * the other's `ON CONFLICT DO NOTHING` returns no row, and it re-reads the
+   * winner's. The client's display name is snapshotted from its registration
+   * at that moment.
+   */
+  /**
+   * Whether an agent connection still admits requests: it exists and nobody
+   * has revoked it. Asked on every refresh, and by the MCP auth middleware on
+   * every request through the local server's exchanged grant — the one path
+   * where a token verifies statelessly and would otherwise outlive the
+   * revoke. A read, not a write: the use is stamped separately, throttled.
+   */
+  async isConnectionLive(connectionId: string): Promise<boolean> {
+    const [row] = await this.deps.db
+      .select({ id: agentConnections.id })
+      .from(agentConnections)
+      .where(and(eq(agentConnections.id, connectionId), isNull(agentConnections.revokedAt)))
+      .limit(1);
+    return row !== undefined;
+  }
+
+  /**
+   * Record that an agent connection is in use — its `last_used_at` on the
+   * Audit log — at most once a minute per connection per process, and never
+   * on the caller's critical path. The stamp is what the page shows; the
+   * liveness decision above never depends on it.
+   */
+  noteConnectionUse(connectionId: string): void {
+    const now = Date.now();
+    const last = this.connectionTouchedAt.get(connectionId);
+    if (last !== undefined && now - last < CONNECTION_TOUCH_INTERVAL_MS) return;
+    this.connectionTouchedAt.set(connectionId, now);
+    this.deps.db
+      .update(agentConnections)
+      .set({ lastUsedAt: new Date(now) })
+      .where(eq(agentConnections.id, connectionId))
+      .then(undefined, (err) => log.warn('touch connection lastUsedAt failed:', { err }));
+  }
+
+  /**
+   * The live `agent_connections` row for (user, agent) — found, or made on
+   * the first mint for the pair. The AGENT is the registered client's name,
+   * folded (see the schema): a client that registers itself afresh on every
+   * re-authorisation, as Claude does, lands every registration on the one
+   * row rather than a row per client id. A refresh finds the row the sign-in
+   * made, so one connection spans every token the agent ever holds; a mint
+   * after a revoke finds nothing live and makes a fresh row, which is what
+   * keeps the revoked one's history intact.
+   *
+   * Two concurrent first mints (a client racing its own token exchange) both
+   * miss the select; the partial unique index lets exactly one insert land,
+   * the other's `ON CONFLICT DO NOTHING` returns no row, and it re-reads the
+   * winner's. The client's display name is snapshotted from its registration
+   * at that moment.
+   */
+  private async ensureConnection(userId: string, clientId: string): Promise<string> {
+    const [client] = await this.deps.db
+      .select({ clientName: oauthClients.clientName })
+      .from(oauthClients)
+      .where(eq(oauthClients.clientId, clientId))
+      .limit(1);
+    const clientName = client?.clientName ?? null;
+    const agentKey = agentKeyFor(clientName, clientId);
+    const live = () =>
+      this.deps.db
+        .select({ id: agentConnections.id })
+        .from(agentConnections)
+        .where(
+          and(
+            eq(agentConnections.userId, userId),
+            eq(agentConnections.agentKey, agentKey),
+            isNull(agentConnections.revokedAt),
+          ),
+        )
+        .limit(1);
+    const [existing] = await live();
+    if (existing) return existing.id;
+    const [inserted] = await this.deps.db
+      .insert(agentConnections)
+      .values({ userId, clientId, clientName, agentKey })
+      .onConflictDoNothing({
+        target: [agentConnections.userId, agentConnections.agentKey],
+        where: sql`${agentConnections.revokedAt} is null`,
+      })
+      .returning({ id: agentConnections.id });
+    if (inserted) return inserted.id;
+    const [winner] = await live();
+    if (!winner) throw new Error('agent connection vanished between insert and re-read');
+    return winner.id;
+  }
+}
+
+/**
+ * What an agent connection is keyed by: the registered client name, folded
+ * (case and surrounding whitespace are not identity), or the client id for
+ * a registration that carried no name. The SAME fold the migration applied
+ * to the rows that existed before the key did.
+ */
+export function agentKeyFor(clientName: string | null, clientId: string): string {
+  const folded = (clientName ?? '').trim().toLowerCase();
+  return folded || clientId;
 }
 
 function hashToken(plaintext: string): string {

package/src/modules/mcp/oauth/oauth-consent.routes.ts

@@ -1,4 +1,7 @@
 import express from 'express';
+import { logger } from '../../../shared/logging.js';
+
+const log = logger('mcp-oauth');
 import type { BevelOAuthProvider } from './bevel-oauth-provider.js';
 import { verifyAuthRequest, type McpAuthRequestState } from './oauth-state.js';
 import '../../auth/auth.middleware.js'; // Express Request augmentation (req.userId / req.userEmail)
@@ -70,10 +73,7 @@ export function createOAuthConsentRoutes(deps: OAuthConsentRoutesDeps): express.
     } catch (err) {
       // Message only — the raw error object can carry sensitive context
       // (redirect URIs with tokens, DB details) that must not hit stdout.
-      console.error(
-        `[mcp-oauth] complete failed for client=${st.c}:`,
-        err instanceof Error ? err.message : String(err),
-      );
+      log.error(`complete failed for client=${st.c}:`, { detail: err instanceof Error ? err.message : String(err) });
       res.status(500).json({ error: 'Internal error' });
     }
   });

package/src/modules/mcp/surface-log-throttle.ts

@@ -0,0 +1,120 @@
+/**
+ * Decides whether a request's surface-build line is worth a log entry.
+ *
+ * The stateless endpoint rebuilds the tool surface on EVERY request, and the
+ * line that reports how long that took is the measurement the design's
+ * per-request overhead is judged by — it has to keep appearing. It must not
+ * appear per request: at the measured ~100 ms a request, an active client
+ * produces thousands of identical lines a minute, and the log stops carrying
+ * the one signal it exists for (a surface that changed, or got slow).
+ *
+ * So a line is logged for a user when its SHAPE changed since the last
+ * logged line (tool or manual count — a manual that appeared, failed, or
+ * was fixed), or when a quiet interval has passed since that line, whichever
+ * comes first. In between, identical rebuilds are counted, and the next
+ * logged line carries the count so nothing is hidden, only compressed.
+ *
+ * Bounded: an entry per user, dropped once they have been quiet for the
+ * interval, so a long-running process never accumulates departed users. The
+ * pruning is one sweep per interval, not one per request — a request must
+ * not pay for every other active user — which puts the bound at TWO
+ * intervals, not one: a user who goes quiet just after a sweep is not yet
+ * quiet enough at the next one and goes at the one after. Departed users
+ * therefore cost at most the number who were active in the last two
+ * intervals, which is the price of the O(1) request.
+ */
+
+export const DEFAULT_SURFACE_LOG_INTERVAL_MS = 60_000;
+
+export interface SurfaceShape {
+  tools: number;
+  manuals: number;
+}
+
+export interface SurfaceLogDecision {
+  log: boolean;
+  /** Rebuilds with the same shape suppressed since the last logged line for this user. */
+  suppressed: number;
+}
+
+interface LastLogged {
+  /** When this user's line was last LOGGED — the interval counts from here. */
+  at: number;
+  /**
+   * When this user last rebuilt at all, logged or suppressed — what pruning
+   * counts from. A user rebuilding every second inside the interval is
+   * active, and forgetting them on a sweep would discard the suppressed count
+   * their next logged line owes.
+   */
+  seenAt: number;
+  shape: string;
+  suppressed: number;
+}
+
+export class SurfaceLogThrottle {
+  private readonly last = new Map<string, LastLogged>();
+  /** When the last sweep ran; a sweep is owed once per interval, not per request. */
+  private lastPruneAt = Number.NEGATIVE_INFINITY;
+
+  constructor(
+    private readonly intervalMs: number = DEFAULT_SURFACE_LOG_INTERVAL_MS,
+    private readonly now: () => number = Date.now,
+  ) {}
+
+  /** Record a rebuild for `userId` and say whether to log it. */
+  decide(userId: string, shape: SurfaceShape): SurfaceLogDecision {
+    const now = this.now();
+    // One sweep per interval, amortized over every request in it: a request
+    // costs O(1), not a walk of every active user, and an entry that goes
+    // quiet is gone by the second sweep after (see the class doc). The sweep
+    // skips THIS user: its entry is about to be read, and at exactly the
+    // interval it still carries the suppressed count the next line owes.
+    //
+    // `now` is the wall clock, which can step backwards (an NTP correction, a
+    // VM restored from suspend). Waiting for it to climb back past the last
+    // sweep would stall pruning for as long as the step was; a clock that
+    // went backwards instead resets the cadence, and pruning resumes in the
+    // clock's new domain on the next request.
+    const clockSteppedBack = now < this.lastPruneAt;
+    if (clockSteppedBack || now - this.lastPruneAt >= this.intervalMs) {
+      this.prune(now, userId);
+      this.lastPruneAt = now;
+    }
+    const key = `${shape.tools}/${shape.manuals}`;
+    const prev = this.last.get(userId);
+    if (prev && prev.shape === key && now - prev.at < this.intervalMs) {
+      prev.suppressed += 1;
+      prev.seenAt = now;
+      return { log: false, suppressed: prev.suppressed };
+    }
+    const suppressed = prev?.suppressed ?? 0;
+    this.last.set(userId, { at: now, seenAt: now, shape: key, suppressed: 0 });
+    return { log: true, suppressed };
+  }
+
+  /** Users currently remembered; diagnostics and tests. */
+  size(): number {
+    return this.last.size;
+  }
+
+  /**
+   * Entries for users quiet for the interval or longer carry no information;
+   * drop them. Quiet means no rebuild at all, logged or suppressed (`seenAt`):
+   * a user whose every rebuild in the interval was suppressed is not quiet,
+   * and dropping them would lose the count their next line reports. An entry
+   * stamped LATER than now was written before the clock stepped backwards:
+   * its age is unknowable across the step, so it is restamped as seen now and
+   * ages from here — otherwise a large step would keep every pre-step user
+   * for as long as the step, past the stated bound.
+   */
+  private prune(now: number, except: string): void {
+    for (const [userId, entry] of this.last) {
+      if (entry.seenAt > now) {
+        entry.seenAt = now;
+        if (entry.at > now) entry.at = now;
+      } else if (userId !== except && now - entry.seenAt >= this.intervalMs) {
+        this.last.delete(userId);
+      }
+    }
+  }
+}

package/src/modules/plugins/__tests__/bundle-dialect.e2e.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { NodeFs } from '../../kb-fs/node-fs.js';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -14,6 +15,7 @@ import { PluginLinkIndex } from '../plugin-links.js';
 import { PluginLinksService } from '../plugin-links.service.js';
 import { KbPluginSource } from '../discovery/kb-plugin-source.js';
 import { MarketplaceCompilerService } from '../compile/marketplace-compiler.service.js';
+import { NodeGitRunner } from '../../workflow/git/node-git-runner.js';
 
 /**
  * A customer's repository, read as-is: lowercase `skills/` and `plugins/`
@@ -91,13 +93,14 @@ describe('bundle dialect, end to end', () => {
       JSON.stringify({ name: 'finance-kit', sourceSkillRoots: ['skills/departments/business/finance'] }),
     );
 
-    const source = new KbPluginSource();
-    access = new AccessControlService(workspaceService, KB_DIR);
-    skills = new SkillService(workspaceService, access, KB_DIR);
-    tools = new ToolManualService(workspaceService, access, KB_DIR, Date.now, source);
-    links = new PluginLinkIndex(workspaceService, skills, access, KB_DIR, Date.now, source);
-    index = new PluginIndexService(workspaceService, access, skills, tools, KB_DIR, Date.now, links, source);
-    compiler = new MarketplaceCompilerService(workspaceService, access, skills, links, KB_DIR, { name: 'acme', owner: 'Acme' }, source);
+    const disk = new NodeFs();
+    const source = new KbPluginSource(disk);
+    access = new AccessControlService(workspaceService, KB_DIR, disk);
+    skills = new SkillService(workspaceService, access, KB_DIR, disk);
+    tools = new ToolManualService(workspaceService, access, KB_DIR, disk, source);
+    links = new PluginLinkIndex(workspaceService, skills, access, KB_DIR, source);
+    index = new PluginIndexService(workspaceService, access, skills, tools, KB_DIR, source, Date.now, links);
+    compiler = new MarketplaceCompilerService(workspaceService, access, skills, links, KB_DIR, { name: 'acme', owner: 'Acme' }, source, disk, new NodeGitRunner());
     linkService = new PluginLinksService(workspaceService, { runPendingCommit: async () => undefined }, access, skills, links, KB_DIR);
   });
   afterEach(async () => {

package/src/modules/plugins/__tests__/bundle-dialect.test.ts

@@ -0,0 +1,165 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { expandProfile, parseRegistry } from '../discovery/bundle-dialect/registry.js';
+import { readBundlePlugin } from '../discovery/bundle-dialect/bundle.source.js';
+
+/**
+ * The customer's registry and bundle, read as they mean them: a server is
+ * CALLED by its `name` (the `mcp__<name>__*` namespace skills are written
+ * against) and selected by its `id`; every field of a server the platform
+ * does not know rides along; a server the registry could not keep is named
+ * with the reason wherever a profile asks for it; and what a bundle says
+ * about itself beyond name, version and description survives to the
+ * compiled plugin. Driven through the two public readers, on crafted input.
+ */
+
+const registryText = (extra: Record<string, unknown> = {}) =>
+  JSON.stringify({
+    version: 1,
+    servers: [
+      { id: 'ado', name: 'ado', config: { command: 'npx', args: ['-y', '@azure-devops/mcp', 'acme'], startup_timeout_sec: 120 } },
+      { id: 'figma-stdio', name: 'figma', config: { command: 'npx', args: ['-y', 'figma-mcp'] } },
+      { id: 'figma-remote', name: 'figma', config: { type: 'http', url: 'https://mcp.figma.com/mcp' } },
+      { id: 'docs', name: 'acme-docs', config: { command: 'node', args: ['server.js', { $fromFile: 'x.json' }] } },
+    ],
+    profiles: [
+      { id: 'global', servers: ['ado', 'figma-stdio', 'docs'] },
+      { id: 'remote', extends: 'global', servers: ['figma-remote'] },
+    ],
+    ...extra,
+  });
+
+describe('registry: servers are called by name, selected by id', () => {
+  it('keys an expanded profile by the running name, with the id as the name when none is given', () => {
+    const registry = parseRegistry(
+      JSON.stringify({
+        servers: [
+          { id: 'figma-stdio', name: 'figma', config: { command: 'npx', args: ['-y', 'figma-mcp'] } },
+          { id: 'jira', config: { command: 'npx', args: ['-y', 'jira-mcp'] } },
+        ],
+        profiles: [{ id: 'global', servers: ['figma-stdio', 'jira'] }],
+      }),
+    );
+    const { mcpServers, warnings } = expandProfile(registry, 'global');
+    expect(Object.keys(mcpServers).sort()).toEqual(['figma', 'jira']);
+    expect(warnings).toEqual([]);
+  });
+
+  it('carries every field it does not read — the customer\'s startup_timeout_sec survives', () => {
+    const registry = parseRegistry(registryText());
+    const { mcpServers } = expandProfile(registry, 'global');
+    expect(mcpServers.ado).toEqual({
+      type: 'stdio',
+      command: 'npx',
+      args: ['-y', '@azure-devops/mcp', 'acme'],
+      startup_timeout_sec: 120,
+    });
+  });
+
+  it('two transports of one server: a profile picks one, and picking both is a reported conflict the nearer profile wins', () => {
+    const registry = parseRegistry(registryText());
+    // `remote` extends `global`: its own figma-remote is nearer than global's figma-stdio.
+    const remote = expandProfile(registry, 'remote');
+    expect(remote.mcpServers.figma).toMatchObject({ type: 'streamable-http', url: 'https://mcp.figma.com/mcp' });
+    expect(remote.warnings).toContainEqual(
+      expect.stringContaining('selects both "figma-remote" and "figma-stdio", which are both named "figma" — "figma-stdio" left out'),
+    );
+    const global = expandProfile(registry, 'global');
+    expect(global.mcpServers.figma).toMatchObject({ type: 'stdio', command: 'npx' });
+  });
+
+  it('names a selected server the registry could not keep, with the reason, where the profile asks for it', () => {
+    const registry = parseRegistry(registryText());
+    expect(registry.rejected.get('docs')).toBe('args must be a list of strings');
+    const { mcpServers, warnings } = expandProfile(registry, 'global');
+    expect(mcpServers['acme-docs']).toBeUndefined();
+    expect(warnings).toContainEqual(
+      'registry.json: profile "global" selects server "docs", which was left out — args must be a list of strings',
+    );
+  });
+
+  it('a name a client cannot key on does not lose the server: it runs under its id, and the author is told', () => {
+    const registry = parseRegistry(
+      JSON.stringify({
+        servers: [{ id: 'ok-id', name: 'Not A Name', config: { command: 'x' } }],
+        profiles: [{ id: 'p', servers: ['ok-id'] }],
+      }),
+    );
+    expect(registry.warnings).toEqual([
+      'registry.json: server "ok-id" is named "Not A Name", which cannot be a server name (lowercase alphanumeric with `_`/`-`) — it runs as "ok-id"',
+    ]);
+    expect(Object.keys(expandProfile(registry, 'p').mcpServers)).toEqual(['ok-id']);
+  });
+
+  it('a name that is present but blank, or not a string, is said too — the server runs under its id', () => {
+    const registry = parseRegistry(
+      JSON.stringify({
+        servers: [
+          { id: 'a', name: '   ', config: { command: 'x' } },
+          { id: 'b', name: 42, config: { command: 'x' } },
+          { id: 'c', name: 'c', config: { command: 'x' } },
+        ],
+      }),
+    );
+    expect(registry.warnings).toEqual([
+      'registry.json: server "a" has a name that is blank or not a string — it runs as "a"',
+      'registry.json: server "b" has a name that is blank or not a string — it runs as "b"',
+    ]);
+    expect([...registry.servers.values()].map((s) => s.name)).toEqual(['a', 'b', 'c']);
+  });
+
+  it('carries a field spelled __proto__ as a field, not as a prototype', () => {
+    // Raw text on purpose: in a JavaScript literal `__proto__` sets the
+    // prototype and never reaches JSON; from a file it is an ordinary key.
+    const registry = parseRegistry('{"servers":[{"id":"odd","config":{"command":"x","__proto__":{"polluted":true}}}]}');
+    const entry = registry.servers.get('odd')!.entry as Record<string, unknown>;
+    expect(Object.prototype.hasOwnProperty.call(entry, '__proto__')).toBe(true);
+    expect((entry as { polluted?: unknown }).polluted).toBeUndefined();
+  });
+
+  it('a rejected server carries the reason the entry failed, not its name', () => {
+    const registry = parseRegistry(
+      JSON.stringify({ servers: [{ id: 'docs', name: 'acme-docs', config: { command: 'node', args: [{ x: 1 }] } }] }),
+    );
+    expect(registry.rejected.get('docs')).toBe('args must be a list of strings');
+  });
+});
+
+describe('bundle: what it says about itself survives', () => {
+  it('carries author, keywords and the interface block into the manifest, beside name, version and description', async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-bundle-'));
+    try {
+      const dir = path.join(root, 'plugins', 'ado');
+      await fs.mkdir(dir, { recursive: true });
+      await fs.writeFile(
+        path.join(dir, 'plugin.bundle.json'),
+        JSON.stringify({
+          name: 'ado',
+          version: '1.3.5',
+          description: 'Azure DevOps skills.',
+          author: { name: 'acme' },
+          keywords: ['ado', 'mcp'],
+          interface: { displayName: 'Azure DevOps', category: 'Productivity', brandColor: '#2563EB', defaultPrompt: ['Show my work.'] },
+          sourceSkillRoots: ['skills/ado'],
+        }),
+      );
+      const warnings: string[] = [];
+      const plugin = await readBundlePlugin(dir, 'plugins/ado', 'ado', null, warnings, []);
+      expect(plugin?.manifest).toEqual({
+        name: 'ado',
+        version: '1.3.5',
+        description: 'Azure DevOps skills.',
+        displayName: 'Azure DevOps',
+        author: { name: 'acme' },
+        keywords: ['ado', 'mcp'],
+        interface: { displayName: 'Azure DevOps', category: 'Productivity', brandColor: '#2563EB', defaultPrompt: ['Show my work.'] },
+      });
+      expect(plugin?.displayName).toBe('Azure DevOps');
+    } finally {
+      await fs.rm(root, { recursive: true, force: true });
+    }
+  });
+});