@bevel-software/platform-core-backend 0.7.4 → 0.8.0

package/src/modules/{groups/groups.service.ts → plugins/plugins.service.ts}

@@ -3,9 +3,9 @@ import fs from 'node:fs/promises';
 import type { Dirent } from 'node:fs';
 import {
   DEFAULT_BRANCH,
-  GROUPS_DIR,
-  groupOfPath,
-  isPersonalGroupFolder,
+  PLUGINS_DIR,
+  pluginOfPath,
+  isPersonalPluginFolder,
 } from '@bevel-software/platform-shared';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
 import { workspaceIdForBranch } from '../workspace/workspace.service.js';
@@ -13,37 +13,37 @@ import type { IAccessControl } from '../access/access-control.interface.js';
 import type { ISkillService } from '../skills/skills.contract.js';
 import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
 import { TtlCache } from '../../shared/ttl-cache.js';
-import type { GroupCatalogEntry, IGroupIndexService } from './groups.contract.js';
+import type { PluginCatalogEntry, IPluginIndexService } from './plugins.contract.js';
 
 const CACHE_TTL_MS = 60_000;
 
 /**
- * The group index: every group folder in the default-branch KB, with its
+ * The plugin index: every plugin folder in the default-branch KB, with its
  * caller-independent totals and access principals.
  *
  * Two decisions worth keeping straight:
  *
- *  - **Existence is an `access.md`, counting is not.** A group EXISTS because
+ *  - **Existence is an `access.md`, counting is not.** A plugin EXISTS because
  *    its folder carries an `access.md` — the file the provisioning endpoint
  *    seeds and the one every per-caller verdict (member / manager /
- *    discoverable) resolves against. A bare directory under `Groups/` is NOT
- *    a group: git cannot record an empty folder, so deleting a group's files
+ *    discoverable) resolves against. A bare directory under `Plugins/` is NOT
+ *    a plugin: git cannot record an empty folder, so deleting a plugin's files
  *    leaves its directory behind on live checkouts, and enumerating by
  *    directory would resurrect every such ghost. Counts come from the
  *    already-cached global catalogs — `skillService.listSkills(undefined)` and
- *    `toolManualService.listAllSummaries()` — bucketed by `groupOfPath`. A
+ *    `toolManualService.listAllSummaries()` — bucketed by `pluginOfPath`. A
  *    second `walkFiles` pass would re-read the same tree and could disagree
  *    with the catalogs about what counts as a skill.
- *  - **Loose files are not groups.** `Groups/slack.tool` sits directly under
+ *  - **Loose files are not plugins.** `Plugins/slack.tool` sits directly under
  *    the root, so it is a file, not a directory — the same ≥3-segment rule
- *    `groupOfPath` applies, arrived at from the other side.
+ *    `pluginOfPath` applies, arrived at from the other side.
  *
  * Cached for {@link CACHE_TTL_MS} and dropped by `invalidate()` from the
  * file-change subscriber, so a grant committed on the default branch is
  * reflected within one round-trip rather than one TTL.
  */
-export class GroupIndexService implements IGroupIndexService {
-  private readonly cache: TtlCache<GroupCatalogEntry[]>;
+export class PluginIndexService implements IPluginIndexService {
+  private readonly cache: TtlCache<PluginCatalogEntry[]>;
 
   constructor(
     private readonly workspaceService: WorkspaceService,
@@ -60,13 +60,13 @@ export class GroupIndexService implements IGroupIndexService {
     this.cache.invalidate();
   }
 
-  async catalog(): Promise<GroupCatalogEntry[]> {
+  async catalog(): Promise<PluginCatalogEntry[]> {
     const cached = this.cache.get();
     if (cached) return cached;
     const entries = await this.build();
-    // A failed scan and a KB with genuinely no group folders both serve `[]`,
+    // A failed scan and a KB with genuinely no plugin folders both serve `[]`,
     // but only the second is a fact worth holding for the TTL. Caching the
-    // failure would hide every group from every user for the full 60s AFTER
+    // failure would hide every plugin from every user for the full 60s AFTER
     // the cause is gone — a clone mid-creation, a readdir that raced a
     // checkout — and `invalidate()` only fires on a file-change event that may
     // never arrive in that window. So a degraded read is served, not stored,
@@ -80,16 +80,16 @@ export class GroupIndexService implements IGroupIndexService {
 
    /**
    * Degrades on ANY failure rather than throwing. The Library must never break
-   * because a group folder can't be read — same philosophy as the skill and
+   * because a plugin folder can't be read — same philosophy as the skill and
    * tool-manual scanners, and the reason the route's 500 is reserved for the
    * per-caller half.
    *
    * `null` is that degraded case and is deliberately NOT the same value as an
-   * empty array: a KB with no group folders returns `[]`, which is true and
+   * empty array: a KB with no plugin folders returns `[]`, which is true and
    * cacheable, while a failure returns `null`, which `catalog()` serves as `[]`
    * without storing it.
    */
-  private async build(): Promise<GroupCatalogEntry[] | null> {
+  private async build(): Promise<PluginCatalogEntry[] | null> {
     try {
       const wsId = (await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH)).id;
       const kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
@@ -102,10 +102,10 @@ export class GroupIndexService implements IGroupIndexService {
         this.countTools(),
       ]);
 
-      const entries: GroupCatalogEntry[] = [];
-      for (const [name, groupFolders] of folders) {
-        // One folder, one access boundary — the folder IS the group.
-        const [primary] = groupFolders;
+      const entries: PluginCatalogEntry[] = [];
+      for (const [name, pluginFolders] of folders) {
+        // One folder, one access boundary — the folder IS the plugin.
+        const [primary] = pluginFolders;
         const [owners, writers, readers] = await Promise.all([
           this.accessControl.eligibleOwners(wsId, primary),
           this.accessControl.eligibleWriters(wsId, primary),
@@ -113,7 +113,7 @@ export class GroupIndexService implements IGroupIndexService {
         ]);
         entries.push({
           name,
-          folders: groupFolders,
+          folders: pluginFolders,
           skillCount: skillCounts.get(name) ?? 0,
           toolCount: toolCounts.get(name) ?? 0,
           owners,
@@ -124,70 +124,70 @@ export class GroupIndexService implements IGroupIndexService {
       return entries.sort((a, b) => a.name.localeCompare(b.name));
     } catch (err) {
       console.warn(
-        `[groups] group index unavailable: ${err instanceof Error ? err.message : String(err)}`,
+        `[plugins] plugin index unavailable: ${err instanceof Error ? err.message : String(err)}`,
       );
       return null;
     }
   }
 
-  /** name → repo-relative group folder (always a single-element list). */
+  /** name → repo-relative plugin folder (always a single-element list). */
   private async scanFolders(kbRoot: string): Promise<Map<string, string[]>> {
     const byName = new Map<string, string[]>();
     let children: Dirent[];
     try {
-      children = await fs.readdir(path.join(kbRoot, GROUPS_DIR), { withFileTypes: true });
+      children = await fs.readdir(path.join(kbRoot, PLUGINS_DIR), { withFileTypes: true });
     } catch {
-      return byName; // a KB without a `Groups/` root simply has no groups
+      return byName; // a KB without a `Plugins/` root simply has no plugins
     }
     const candidates = children.filter(
       (child) =>
         child.isDirectory() &&
         !child.name.startsWith('.') &&
-        // Personal folders live under Groups/ but are not groups: one exists
+        // Personal folders live under Plugins/ but are not plugins: one exists
         // per person, private by construction, and listing them would put a
         // locked row per employee in everyone's index.
-        !isPersonalGroupFolder(child.name),
+        !isPersonalPluginFolder(child.name),
     );
-    // A group exists exactly when its folder carries an `access.md` (see the
+    // A plugin exists exactly when its folder carries an `access.md` (see the
     // class doc) — stat that file, don't trust the directory.
     const verdicts = await Promise.all(
       candidates.map(async (child) => {
         try {
-          return (await fs.stat(path.join(kbRoot, GROUPS_DIR, child.name, 'access.md'))).isFile();
+          return (await fs.stat(path.join(kbRoot, PLUGINS_DIR, child.name, 'access.md'))).isFile();
         } catch {
           return false;
         }
       }),
     );
     candidates.forEach((child, i) => {
-      if (verdicts[i]) byName.set(child.name, [`${GROUPS_DIR}/${child.name}`]);
+      if (verdicts[i]) byName.set(child.name, [`${PLUGINS_DIR}/${child.name}`]);
     });
     return byName;
   }
 
   private async countSkills(): Promise<Map<string, number>> {
     // `undefined` is the documented GLOBAL, unfiltered mode — counts are a
-    // property of the group, not of who is asking.
-    return bucketByGroup(await this.skillService.listSkills(undefined));
+    // property of the plugin, not of who is asking.
+    return bucketByPlugin(await this.skillService.listSkills(undefined));
   }
 
   private async countTools(): Promise<Map<string, number>> {
-    return bucketByGroup(await this.toolManualService.listAllSummaries());
+    return bucketByPlugin(await this.toolManualService.listAllSummaries());
   }
 }
 
-/** Count items per group folder name; ungrouped items (`null`) count nowhere. */
-function bucketByGroup(items: { path: string }[]): Map<string, number> {
+/** Count items per plugin folder name; ungrouped items (`null`) count nowhere. */
+function bucketByPlugin(items: { path: string }[]): Map<string, number> {
   const counts = new Map<string, number>();
   for (const item of items) {
-    const group = groupOfPath(item.path);
-    if (group === null) continue;
-    counts.set(group, (counts.get(group) ?? 0) + 1);
+    const plugin = pluginOfPath(item.path);
+    if (plugin === null) continue;
+    counts.set(plugin, (counts.get(plugin) ?? 0) + 1);
   }
   return counts;
 }
 
-/** The default-branch workspace id every group resolution runs against. */
-export function groupsWorkspaceId(): string {
+/** The default-branch workspace id every plugin resolution runs against. */
+export function pluginsWorkspaceId(): string {
   return workspaceIdForBranch(DEFAULT_BRANCH);
 }

package/src/modules/secrets-vault/__tests__/tool-owner-gate.route.test.ts

@@ -1,143 +1,143 @@
-import type { Server as HttpServer } from 'node:http';
-import express from 'express';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { createSecretsVaultRoutes } from '../secrets-vault.routes.js';
-
-/**
- * THE OWNER GATE: a tool's shared (admin) secrets — plain values and OAuth
- * client secrets — are settable by whoever can WRITE that `.tool` FILE (its
- * frontmatter `write:`/`owner:` verbs + the access.md chain), and by no one
- * else. There is deliberately NO platform-role check here: a non-Admin who
- * manages a `.tool` configures it; an Admin who can't write the file doesn't.
- * The per-file resolution itself (frontmatter verbs on `.tool` files) is
- * covered in access-control.service.test.ts — this locks the route gate to
- * `canWrite(path)` so no role-based shortcut regresses it.
- */
-
-const TOOL_PATH = 'Tools/weather.tool';
-const WRITER = 'writer@x.com';
-const READER = 'reader@x.com';
-
-const toolManualService = {
-  listAccessible: async () => [
-    {
-      slug: 'weather',
-      name: 'weather',
-      path: TOOL_PATH,
-      type: 'mcp' as const,
-      variables: [
-        { name: 'SHARED_KEY', scope: 'admin' as const, label: 'Org key' },
-        {
-          name: 'SIGNIN',
-          scope: 'user' as const,
-          label: 'Weather sign-in',
-          oauth: {
-            authorizationUrl: 'https://auth.example.com/authorize',
-            tokenUrl: 'https://auth.example.com/token',
-            clientId: 'client-1',
-          },
-        },
-      ],
-    },
-  ],
-} as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['toolManualService'];
-
-const putSharedStatic = vi.fn(async () => ({ id: 's1' }));
-const putSharedOAuthClientSecret = vi.fn(async () => {});
-const secretsVault = {
-  putSharedStatic,
-  putSharedOAuthClientSecret,
-} as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['secretsVault'];
-
-// Per-FILE write: only WRITER may write THIS tool's path. No role concept at all.
-const accessControl = {
-  canRead: async () => true,
-  canWrite: async (_ws: string, email: string, path: string) => email === WRITER && path === TOOL_PATH,
-} as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['accessControl'];
-
-let httpServer: HttpServer | undefined;
-
-async function baseUrlAs(email: string): Promise<string> {
-  const app = express();
-  app.use(express.json());
-  app.use((req, _res, next) => {
-    req.userId = `id-${email}`;
-    req.userEmail = email;
-    next();
-  });
-  app.use(
-    '/api',
-    createSecretsVaultRoutes({
-      secretsVault,
-      toolManualService,
-      accessControl,
-      stateSecret: 'test-secret',
-      publicBackendUrl: 'http://localhost:3000',
-      publicFrontendUrl: 'http://localhost:5173',
-    }),
-  );
-  httpServer = await new Promise<HttpServer>((resolve) => {
-    const s = app.listen(0, () => resolve(s));
-  });
-  const port = (httpServer.address() as { port: number }).port;
-  return `http://127.0.0.1:${port}`;
-}
-
-afterEach(async () => {
-  if (httpServer) await new Promise<void>((r) => httpServer!.close(() => r()));
-  httpServer = undefined;
-  putSharedStatic.mockClear();
-  putSharedOAuthClientSecret.mockClear();
-});
-
-describe('tool owner gate — shared config requires WRITE on the `.tool` file', () => {
-  it('a writer of the file sets the shared admin value', async () => {
-    const base = await baseUrlAs(WRITER);
-    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SHARED_KEY/admin`, {
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ value: 'k-123' }),
-    });
-    expect(res.status).toBe(201);
-    expect(putSharedStatic).toHaveBeenCalledWith(expect.objectContaining({ key: 'weather_SHARED_KEY' }));
-  });
-
-  it('a non-writer is refused (403), even though they can READ the tool', async () => {
-    const base = await baseUrlAs(READER);
-    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SHARED_KEY/admin`, {
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ value: 'k-123' }),
-    });
-    expect(res.status).toBe(403);
-    expect(putSharedStatic).not.toHaveBeenCalled();
-  });
-
-  it('a writer of the file sets the OAuth client secret, pinned to the declared provider', async () => {
-    const base = await baseUrlAs(WRITER);
-    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SIGNIN/oauth/admin`, {
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ clientSecret: 'cs-123' }),
-    });
-    expect(res.status).toBe(201);
-    expect(putSharedOAuthClientSecret).toHaveBeenCalledWith(
-      expect.objectContaining({
-        key: 'weather_SIGNIN',
-        clientSecret: 'cs-123',
-        provider: expect.objectContaining({ clientId: 'client-1' }),
-      }),
-    );
-  });
-
-  it('a non-writer cannot set the client secret (403)', async () => {
-    const base = await baseUrlAs(READER);
-    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SIGNIN/oauth/admin`, {
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ clientSecret: 'cs-123' }),
-    });
-    expect(res.status).toBe(403);
-    expect(putSharedOAuthClientSecret).not.toHaveBeenCalled();
-  });
-});
+import type { Server as HttpServer } from 'node:http';
+import express from 'express';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createSecretsVaultRoutes } from '../secrets-vault.routes.js';
+
+/**
+ * THE OWNER GATE: a tool's shared (admin) secrets — plain values and OAuth
+ * client secrets — are settable by whoever can WRITE that `.tool` FILE (its
+ * frontmatter `write:`/`owner:` verbs + the access.md chain), and by no one
+ * else. There is deliberately NO platform-role check here: a non-Admin who
+ * manages a `.tool` configures it; an Admin who can't write the file doesn't.
+ * The per-file resolution itself (frontmatter verbs on `.tool` files) is
+ * covered in access-control.service.test.ts — this locks the route gate to
+ * `canWrite(path)` so no role-based shortcut regresses it.
+ */
+
+const TOOL_PATH = 'Tools/weather.tool';
+const WRITER = 'writer@x.com';
+const READER = 'reader@x.com';
+
+const toolManualService = {
+  listAccessible: async () => [
+    {
+      slug: 'weather',
+      name: 'weather',
+      path: TOOL_PATH,
+      type: 'mcp' as const,
+      variables: [
+        { name: 'SHARED_KEY', scope: 'admin' as const, label: 'Org key' },
+        {
+          name: 'SIGNIN',
+          scope: 'user' as const,
+          label: 'Weather sign-in',
+          oauth: {
+            authorizationUrl: 'https://auth.example.com/authorize',
+            tokenUrl: 'https://auth.example.com/token',
+            clientId: 'client-1',
+          },
+        },
+      ],
+    },
+  ],
+} as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['toolManualService'];
+
+const putSharedStatic = vi.fn(async () => ({ id: 's1' }));
+const putSharedOAuthClientSecret = vi.fn(async () => {});
+const secretsVault = {
+  putSharedStatic,
+  putSharedOAuthClientSecret,
+} as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['secretsVault'];
+
+// Per-FILE write: only WRITER may write THIS tool's path. No role concept at all.
+const accessControl = {
+  canRead: async () => true,
+  canWrite: async (_ws: string, email: string, path: string) => email === WRITER && path === TOOL_PATH,
+} as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['accessControl'];
+
+let httpServer: HttpServer | undefined;
+
+async function baseUrlAs(email: string): Promise<string> {
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.userId = `id-${email}`;
+    req.userEmail = email;
+    next();
+  });
+  app.use(
+    '/api',
+    createSecretsVaultRoutes({
+      secretsVault,
+      toolManualService,
+      accessControl,
+      stateSecret: 'test-secret',
+      publicBackendUrl: 'http://localhost:3000',
+      publicFrontendUrl: 'http://localhost:5173',
+    }),
+  );
+  httpServer = await new Promise<HttpServer>((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  const port = (httpServer.address() as { port: number }).port;
+  return `http://127.0.0.1:${port}`;
+}
+
+afterEach(async () => {
+  if (httpServer) await new Promise<void>((r) => httpServer!.close(() => r()));
+  httpServer = undefined;
+  putSharedStatic.mockClear();
+  putSharedOAuthClientSecret.mockClear();
+});
+
+describe('tool owner gate — shared config requires WRITE on the `.tool` file', () => {
+  it('a writer of the file sets the shared admin value', async () => {
+    const base = await baseUrlAs(WRITER);
+    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SHARED_KEY/admin`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ value: 'k-123' }),
+    });
+    expect(res.status).toBe(201);
+    expect(putSharedStatic).toHaveBeenCalledWith(expect.objectContaining({ key: 'weather_SHARED_KEY' }));
+  });
+
+  it('a non-writer is refused (403), even though they can READ the tool', async () => {
+    const base = await baseUrlAs(READER);
+    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SHARED_KEY/admin`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ value: 'k-123' }),
+    });
+    expect(res.status).toBe(403);
+    expect(putSharedStatic).not.toHaveBeenCalled();
+  });
+
+  it('a writer of the file sets the OAuth client secret, pinned to the declared provider', async () => {
+    const base = await baseUrlAs(WRITER);
+    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SIGNIN/oauth/admin`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ clientSecret: 'cs-123' }),
+    });
+    expect(res.status).toBe(201);
+    expect(putSharedOAuthClientSecret).toHaveBeenCalledWith(
+      expect.objectContaining({
+        key: 'weather_SIGNIN',
+        clientSecret: 'cs-123',
+        provider: expect.objectContaining({ clientId: 'client-1' }),
+      }),
+    );
+  });
+
+  it('a non-writer cannot set the client secret (403)', async () => {
+    const base = await baseUrlAs(READER);
+    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SIGNIN/oauth/admin`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ clientSecret: 'cs-123' }),
+    });
+    expect(res.status).toBe(403);
+    expect(putSharedOAuthClientSecret).not.toHaveBeenCalled();
+  });
+});

package/src/modules/skills/__tests__/pending-skills.service.test.ts

@@ -40,7 +40,7 @@ function cr(over: Partial<ChangeRequest> = {}): ChangeRequest {
     base: 'main',
     state: 'open',
     createdAt: '2026-08-06T09:00:00.000Z',
-    touchedNodePaths: ['Groups/Engineering/weekly-newsletter/SKILL.md'],
+    touchedNodePaths: ['Plugins/Engineering/weekly-newsletter/SKILL.md'],
     review: { approvals: 0, changesRequested: 0, pendingLogins: [] },
     url: '/change-requests/7',
     ...over,
@@ -56,7 +56,7 @@ function harness(opts: {
   writers?: Record<string, string[]>;
 }) {
   const branchFiles = opts.branchFiles ?? {
-    'agent/weekly-newsletter:Groups/Engineering/weekly-newsletter/SKILL.md': SKILL_MD,
+    'agent/weekly-newsletter:Plugins/Engineering/weekly-newsletter/SKILL.md': SKILL_MD,
   };
   const workspaceService = {
     ensureRemotesFetched: async () => undefined,
@@ -81,7 +81,7 @@ function harness(opts: {
 }
 
 const ADMIN_WRITES = {
-  'Groups/Engineering/weekly-newsletter/SKILL.md': [ADMIN],
+  'Plugins/Engineering/weekly-newsletter/SKILL.md': [ADMIN],
 };
 
 describe('PendingSkillsService', () => {
@@ -93,7 +93,7 @@ describe('PendingSkillsService', () => {
         name: 'weekly-newsletter',
         description: 'Drafts the Friday newsletter.',
         version: '0.1.0',
-        path: 'Groups/Engineering/weekly-newsletter',
+        path: 'Plugins/Engineering/weekly-newsletter',
         changeRequestNumber: 7,
         branch: 'agent/weekly-newsletter',
         authorName: 'Ali Raza',
@@ -110,7 +110,7 @@ describe('PendingSkillsService', () => {
 
   /**
    * The decision that shapes this surface: a proposal is between its author and
-   * the people who can approve it, and nobody else. A member of the group who
+   * the people who can approve it, and nobody else. A member of the plugin who
    * cannot write the folder is not one of those people.
    */
   test('hides it from everyone else', async () => {
@@ -143,7 +143,7 @@ describe('PendingSkillsService', () => {
         {
           name: 'weekly-newsletter',
           description: 'Drafts the Friday newsletter.',
-          path: 'Groups/Engineering/weekly-newsletter',
+          path: 'Plugins/Engineering/weekly-newsletter',
         },
       ],
       writers: ADMIN_WRITES,
@@ -156,9 +156,9 @@ describe('PendingSkillsService', () => {
       crs: [
         cr({
           touchedNodePaths: [
-            'Groups/Engineering/access.md',
-            'Groups/Engineering/SKILL.md', // a group folder is not a skill
-            'Groups/Engineering/weekly-newsletter/reference.md',
+            'Plugins/Engineering/access.md',
+            'Plugins/Engineering/SKILL.md', // a plugin folder is not a skill
+            'Plugins/Engineering/weekly-newsletter/reference.md',
           ],
         }),
       ],
@@ -185,7 +185,7 @@ describe('PendingSkillsService', () => {
     const svc = harness({
       crs: [cr()],
       branchFiles: {
-        'agent/weekly-newsletter:Groups/Engineering/weekly-newsletter/SKILL.md':
+        'agent/weekly-newsletter:Plugins/Engineering/weekly-newsletter/SKILL.md':
           '---\ndescription: No name declared.\n---\n\n# Body\n',
       },
       writers: ADMIN_WRITES,
@@ -222,17 +222,17 @@ describe('PendingSkillsService', () => {
           number: 3,
           createdAt: '2026-08-01T12:00:00.000Z',
           branch: 'agent/older',
-          touchedNodePaths: ['Groups/Engineering/older/SKILL.md'],
+          touchedNodePaths: ['Plugins/Engineering/older/SKILL.md'],
         }),
       ],
       branchFiles: {
-        'agent/weekly-newsletter:Groups/Engineering/weekly-newsletter/SKILL.md': SKILL_MD,
-        'agent/older:Groups/Engineering/older/SKILL.md':
+        'agent/weekly-newsletter:Plugins/Engineering/weekly-newsletter/SKILL.md': SKILL_MD,
+        'agent/older:Plugins/Engineering/older/SKILL.md':
           '---\nname: older\ndescription: Older.\n---\n',
       },
       writers: {
         ...ADMIN_WRITES,
-        'Groups/Engineering/older/SKILL.md': [ADMIN],
+        'Plugins/Engineering/older/SKILL.md': [ADMIN],
       },
     });
     expect((await svc.listPendingSkills(ADMIN)).map((p) => p.changeRequestNumber)).toEqual([3, 9]);