@stigmer/cli 3.1.8 → 3.1.9

package/src/resources/share.test.ts

@@ -1,13 +1,12 @@
 // Unit tests for the share-agent resource layer. The critical contract is
-// merge-preservation: `updateSharing` replaces `spec.sharing` wholesale, so a
-// CLI toggle must never wipe console-configured origins or visitor messages.
+// merge-preservation: `agentShare.apply` replaces the share's spec wholesale,
+// so a CLI toggle must never wipe console-configured origins, visitor
+// messages, credential bindings, or the audience.
 
-import { clone, create } from "@bufbuild/protobuf";
+import { create } from "@bufbuild/protobuf";
 import { AgentSchema, type Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/status_pb";
-import type { UpdateAgentSharingInput } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/io_pb";
-import { AgentSharingAudience } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
-import { buildEmbedSnippet, type Stigmer } from "@stigmer/sdk";
+import { AgentShareAudience } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/spec_pb";
+import { buildEmbedSnippet, type AgentShareInput, type Stigmer } from "@stigmer/sdk";
 import { describe, expect, it } from "vitest";
 import { classify, ExitCode, UsageError } from "../errors/index.js";
 import { shareAgent } from "./share.js";
@@ -15,32 +14,55 @@ import { shareAgent } from "./share.js";
 const CLOUD = { appOrigin: "https://app.stigmer.ai", isLocal: false };
 const LOCAL = { appOrigin: "http://localhost:8234", isLocal: true };
 
-function makeAgent(
-  sharing?: {
-    enabled?: boolean;
-    audience?: AgentSharingAudience;
-    allowedOrigins?: string[];
-    messages?: { rateLimited?: string; unavailable?: string; conversationEnded?: string };
-  },
-  shareLinkToken?: string,
-): Agent {
+function makeAgent(): Agent {
   return create(AgentSchema, {
     metadata: { id: "agt_01ARZ3NDEKTSV4RRFFQ69G5FAV", org: "acme", slug: "support-agent", name: "Support Agent" },
-    spec: sharing !== undefined ? { sharing } : {},
-    ...(shareLinkToken !== undefined ? { status: { shareLinkToken } } : {}),
+    spec: {},
   });
 }
 
-// A minimal fake of the SDK surface shareAgent touches: agent.getByReference /
-// agent.get + call-recording agent.updateSharing / agent.rotateShareLink
-// (skill.test.ts convention). Rotation answers with the agent re-stamped
-// with `rotatedToken`, mirroring the server's fresh-entropy response.
+interface ShareFixture {
+  slug?: string;
+  enabled?: boolean;
+  audience?: AgentShareAudience;
+  allowedOrigins?: string[];
+  messages?: { rateLimited?: string; unavailable?: string; conversationEnded?: string };
+  environmentRefs?: { org: string; slug: string }[];
+  shareLinkToken?: string;
+}
+
+// Plain-object AgentShare fixture: the CLI reads it structurally (metadata /
+// spec / status), so proto construction adds nothing here.
+function makeShare(fixture: ShareFixture = {}) {
+  const { shareLinkToken, slug, ...spec } = fixture;
+  return {
+    metadata: {
+      id: "ash_01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      org: "acme",
+      slug: slug ?? "support-agent",
+      name: "Support Agent",
+    },
+    spec: {
+      agentRef: { org: "acme", slug: "support-agent" },
+      ...spec,
+    },
+    ...(shareLinkToken !== undefined ? { status: { shareLinkToken } } : {}),
+  };
+}
+
+// A minimal fake of the SDK surface shareAgent touches: agent resolution +
+// call-recording agentShare getByAgent/apply/rotateShareLink (skill.test.ts
+// convention). Apply answers with the applied input merged over the existing
+// share (id assigned), mirroring the server's upsert. Rotation answers with
+// the share re-stamped with `rotatedToken`, mirroring fresh entropy.
 function fakeClient(
   agent: Agent,
+  share: ReturnType<typeof makeShare> | null,
   opts: { failWith?: Error; rotatedToken?: string } = {},
 ) {
-  const calls: UpdateAgentSharingInput[] = [];
+  const applies: AgentShareInput[] = [];
   let rotations = 0;
+  let currentShare = share;
   const client = {
     agent: {
       async get() {
@@ -49,99 +71,147 @@ function fakeClient(
       async getByReference() {
         return agent;
       },
-      async updateSharing(input: UpdateAgentSharingInput) {
+    },
+    agentShare: {
+      async getByAgent() {
+        return {
+          totalCount: currentShare ? 1 : 0,
+          items: currentShare ? [currentShare] : [],
+        };
+      },
+      async apply(input: AgentShareInput) {
         if (opts.failWith) throw opts.failWith;
-        calls.push(input);
-        return agent;
+        applies.push(input);
+        currentShare = {
+          metadata: {
+            id: currentShare?.metadata.id ?? "ash_01ARZ3NDEKTSV4RRFFQ69G5FAV",
+            org: input.org,
+            slug: input.slug ?? "",
+            name: input.name,
+          },
+          spec: {
+            agentRef: { org: input.agentRef.org, slug: input.agentRef.slug },
+            enabled: input.enabled ?? false,
+            audience: input.audience ?? AgentShareAudience.unspecified,
+            allowedOrigins: input.allowedOrigins ?? [],
+            messages: input.messages as never,
+            environmentRefs: input.environmentRefs ?? [],
+          },
+          ...(currentShare?.status ? { status: currentShare.status } : {}),
+        } as ReturnType<typeof makeShare>;
+        return currentShare;
       },
       async rotateShareLink() {
         rotations += 1;
-        const rotated = clone(AgentSchema, agent);
-        rotated.status = create(AgentStatusSchema, {
-          shareLinkToken: opts.rotatedToken ?? "fresh-token",
-        });
-        return rotated;
+        currentShare = {
+          ...(currentShare as ReturnType<typeof makeShare>),
+          status: { shareLinkToken: opts.rotatedToken ?? "fresh-token" },
+        };
+        return currentShare;
       },
     },
   } as unknown as Stigmer;
-  return { client, calls, rotationCount: () => rotations };
+  return { client, applies, rotationCount: () => rotations };
 }
 
 describe("shareAgent merge-preservation (fails closed)", () => {
-  it("enabling preserves console-configured origins and messages verbatim", async () => {
-    const agent = makeAgent({
+  it("enabling preserves console-configured origins, messages, and bindings verbatim", async () => {
+    const share = makeShare({
       enabled: false,
       allowedOrigins: ["https://example.com", "https://docs.example.com"],
       messages: { rateLimited: "Slow down!", unavailable: "Back soon.", conversationEnded: "Bye!" },
+      environmentRefs: [{ org: "acme", slug: "github-org-shared" }],
     });
-    const { client, calls } = fakeClient(agent);
+    const { client, applies } = fakeClient(makeAgent(), share);
 
     await shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...CLOUD });
 
-    expect(calls).toHaveLength(1);
-    expect(calls[0].resourceId).toBe("agt_01ARZ3NDEKTSV4RRFFQ69G5FAV");
-    expect(calls[0].sharing?.enabled).toBe(true);
-    expect(calls[0].sharing?.allowedOrigins).toEqual(["https://example.com", "https://docs.example.com"]);
-    expect(calls[0].sharing?.messages?.rateLimited).toBe("Slow down!");
-    expect(calls[0].sharing?.messages?.unavailable).toBe("Back soon.");
-    expect(calls[0].sharing?.messages?.conversationEnded).toBe("Bye!");
+    expect(applies).toHaveLength(1);
+    expect(applies[0].org).toBe("acme");
+    expect(applies[0].slug).toBe("support-agent");
+    expect(applies[0].agentRef).toEqual({ org: "acme", slug: "support-agent" });
+    expect(applies[0].enabled).toBe(true);
+    expect(applies[0].allowedOrigins).toEqual(["https://example.com", "https://docs.example.com"]);
+    expect(applies[0].messages?.rateLimited).toBe("Slow down!");
+    expect(applies[0].messages?.unavailable).toBe("Back soon.");
+    expect(applies[0].messages?.conversationEnded).toBe("Bye!");
+    expect(applies[0].environmentRefs).toEqual([{ org: "acme", slug: "github-org-shared" }]);
   });
 
   it("disabling preserves origins and messages, flipping only enabled", async () => {
-    const agent = makeAgent({
+    const share = makeShare({
       enabled: true,
       allowedOrigins: ["https://example.com"],
       messages: { rateLimited: "Slow down!" },
     });
-    const { client, calls } = fakeClient(agent);
+    const { client, applies } = fakeClient(makeAgent(), share);
 
     const result = await shareAgent(client, "acme/support-agent", "acme", { enabled: false, ...CLOUD });
 
-    expect(calls).toHaveLength(1);
-    expect(calls[0].sharing?.enabled).toBe(false);
-    expect(calls[0].sharing?.allowedOrigins).toEqual(["https://example.com"]);
-    expect(calls[0].sharing?.messages?.rateLimited).toBe("Slow down!");
+    expect(applies).toHaveLength(1);
+    expect(applies[0].enabled).toBe(false);
+    expect(applies[0].allowedOrigins).toEqual(["https://example.com"]);
+    expect(applies[0].messages?.rateLimited).toBe("Slow down!");
     expect(result.message).toContain("Sharing disabled");
     // No link/snippet on disable — the URL no longer works.
     expect(result.sections).toHaveLength(0);
   });
 
-  it("enables cleanly for an agent that has never been shared (no spec.sharing)", async () => {
-    const { client, calls } = fakeClient(makeAgent(undefined));
+  it("enabling a never-shared agent creates the canonical share", async () => {
+    const { client, applies } = fakeClient(makeAgent(), null);
 
     await shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...CLOUD });
 
-    expect(calls).toHaveLength(1);
-    expect(calls[0].sharing?.enabled).toBe(true);
-    expect(calls[0].sharing?.allowedOrigins).toEqual([]);
-    expect(calls[0].sharing?.messages?.rateLimited).toBe("");
+    expect(applies).toHaveLength(1);
+    // Create identity: the agent's own org/slug (the server's default,
+    // made explicit) with the agent reference and empty config.
+    expect(applies[0].slug).toBe("support-agent");
+    expect(applies[0].agentRef).toEqual({ org: "acme", slug: "support-agent" });
+    expect(applies[0].enabled).toBe(true);
+    expect(applies[0].allowedOrigins).toEqual([]);
+    expect(applies[0].messages?.rateLimited).toBe("");
+    expect(applies[0].environmentRefs).toEqual([]);
+  });
+
+  it("edits a renamed share under its own slug (never forks a second share)", async () => {
+    const share = makeShare({ slug: "help-desk", enabled: false });
+    const { client, applies } = fakeClient(makeAgent(), share);
+
+    const result = await shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...CLOUD });
+
+    expect(applies).toHaveLength(1);
+    // Applying with the agent's slug would CREATE a second share; the
+    // toggle must target the existing row's identity.
+    expect(applies[0].slug).toBe("help-desk");
+    const link = result.sections.find((s) => s.title === "Public chat link");
+    expect(link?.items).toEqual(["https://app.stigmer.ai/chat/acme/help-desk"]);
   });
 
   it("a plain toggle preserves an org-members-only audience (never reverts to public)", async () => {
-    const agent = makeAgent({
+    const share = makeShare({
       enabled: false,
-      audience: AgentSharingAudience.org,
+      audience: AgentShareAudience.org,
       allowedOrigins: [],
     });
-    const { client, calls } = fakeClient(agent);
+    const { client, applies } = fakeClient(makeAgent(), share);
 
     await shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...CLOUD });
 
-    expect(calls).toHaveLength(1);
+    expect(applies).toHaveLength(1);
     // A re-enable without --audience must keep the org restriction: writing
     // public here would silently expose an internal agent to the internet.
-    expect(calls[0].sharing?.audience).toBe(AgentSharingAudience.org);
+    expect(applies[0].audience).toBe(AgentShareAudience.org);
   });
 });
 
 describe("shareAgent audience", () => {
-  it("--audience org sets the audience and writes the full block", async () => {
-    const agent = makeAgent({
+  it("--audience org sets the audience and applies the full spec", async () => {
+    const share = makeShare({
       enabled: true,
       allowedOrigins: ["https://example.com"],
       messages: { rateLimited: "Slow down!" },
     });
-    const { client, calls } = fakeClient(agent);
+    const { client, applies } = fakeClient(makeAgent(), share);
 
     const result = await shareAgent(client, "acme/support-agent", "acme", {
       enabled: true,
@@ -149,11 +219,11 @@ describe("shareAgent audience", () => {
       ...CLOUD,
     });
 
-    expect(calls).toHaveLength(1);
-    expect(calls[0].sharing?.audience).toBe(AgentSharingAudience.org);
-    expect(calls[0].sharing?.enabled).toBe(true);
-    expect(calls[0].sharing?.allowedOrigins).toEqual(["https://example.com"]);
-    expect(calls[0].sharing?.messages?.rateLimited).toBe("Slow down!");
+    expect(applies).toHaveLength(1);
+    expect(applies[0].audience).toBe(AgentShareAudience.org);
+    expect(applies[0].enabled).toBe(true);
+    expect(applies[0].allowedOrigins).toEqual(["https://example.com"]);
+    expect(applies[0].messages?.rateLimited).toBe("Slow down!");
 
     // Org shares print the member link and NO embed snippet (embeds serve
     // anonymous guests, which org shares refuse).
@@ -165,8 +235,8 @@ describe("shareAgent audience", () => {
   });
 
   it("--audience public converts an org share back to an explicit public one", async () => {
-    const agent = makeAgent({ enabled: true, audience: AgentSharingAudience.org });
-    const { client, calls } = fakeClient(agent);
+    const share = makeShare({ enabled: true, audience: AgentShareAudience.org });
+    const { client, applies } = fakeClient(makeAgent(), share);
 
     await shareAgent(client, "acme/support-agent", "acme", {
       enabled: true,
@@ -174,14 +244,14 @@ describe("shareAgent audience", () => {
       ...CLOUD,
     });
 
-    expect(calls).toHaveLength(1);
+    expect(applies).toHaveLength(1);
     // Written as the explicit enum value, never left unspecified.
-    expect(calls[0].sharing?.audience).toBe(AgentSharingAudience.public);
+    expect(applies[0].audience).toBe(AgentShareAudience.public);
   });
 
   it("an audience change alone triggers a write even when enabled matches", async () => {
-    const agent = makeAgent({ enabled: true });
-    const { client, calls } = fakeClient(agent);
+    const share = makeShare({ enabled: true });
+    const { client, applies } = fakeClient(makeAgent(), share);
 
     const result = await shareAgent(client, "acme/support-agent", "acme", {
       enabled: true,
@@ -189,13 +259,13 @@ describe("shareAgent audience", () => {
       ...CLOUD,
     });
 
-    expect(calls).toHaveLength(1);
+    expect(applies).toHaveLength(1);
     expect(result.message).toContain("Sharing enabled");
   });
 
   it("matching enabled AND audience stays idempotent (no write)", async () => {
-    const agent = makeAgent({ enabled: true, audience: AgentSharingAudience.org });
-    const { client, calls } = fakeClient(agent);
+    const share = makeShare({ enabled: true, audience: AgentShareAudience.org });
+    const { client, applies } = fakeClient(makeAgent(), share);
 
     const result = await shareAgent(client, "acme/support-agent", "acme", {
       enabled: true,
@@ -203,36 +273,47 @@ describe("shareAgent audience", () => {
       ...CLOUD,
     });
 
-    expect(calls).toHaveLength(0);
+    expect(applies).toHaveLength(0);
     expect(result.message).toContain("already on");
   });
 });
 
 describe("shareAgent idempotency", () => {
   it("skips the write when sharing is already enabled, still reporting the link", async () => {
-    const { client, calls } = fakeClient(makeAgent({ enabled: true }));
+    const { client, applies } = fakeClient(makeAgent(), makeShare({ enabled: true }));
 
     const result = await shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...CLOUD });
 
-    expect(calls).toHaveLength(0);
+    expect(applies).toHaveLength(0);
     expect(result.message).toContain("already on");
     const link = result.sections.find((s) => s.title === "Public chat link");
     expect(link?.items).toEqual(["https://app.stigmer.ai/chat/acme/support-agent"]);
   });
 
   it("skips the write when sharing is already disabled", async () => {
-    const { client, calls } = fakeClient(makeAgent({ enabled: false }));
+    const { client, applies } = fakeClient(makeAgent(), makeShare({ enabled: false }));
+
+    const result = await shareAgent(client, "acme/support-agent", "acme", { enabled: false, ...CLOUD });
+
+    expect(applies).toHaveLength(0);
+    expect(result.message).toContain("already off");
+  });
+
+  it("disabling a never-shared agent creates nothing", async () => {
+    const { client, applies } = fakeClient(makeAgent(), null);
 
     const result = await shareAgent(client, "acme/support-agent", "acme", { enabled: false, ...CLOUD });
 
-    expect(calls).toHaveLength(0);
+    // Materializing a share row just to mark it disabled would create a
+    // resource the owner never asked for.
+    expect(applies).toHaveLength(0);
     expect(result.message).toContain("already off");
   });
 });
 
 describe("shareAgent output", () => {
-  it("builds the link and snippet from the RESOLVED agent's org/slug (ID refs included)", async () => {
-    const { client } = fakeClient(makeAgent({ enabled: false }));
+  it("builds the link and snippet from the RESOLVED share's org/slug (ID refs included)", async () => {
+    const { client } = fakeClient(makeAgent(), makeShare({ enabled: false }));
 
     const result = await shareAgent(client, "agt_01ARZ3NDEKTSV4RRFFQ69G5FAV", "", { enabled: true, ...CLOUD });
 
@@ -241,7 +322,7 @@ describe("shareAgent output", () => {
   });
 
   it("emits the exact embed snippet the web share dialog emits", async () => {
-    const { client } = fakeClient(makeAgent({ enabled: false }));
+    const { client } = fakeClient(makeAgent(), makeShare({ enabled: false }));
 
     const result = await shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...CLOUD });
 
@@ -250,7 +331,7 @@ describe("shareAgent output", () => {
   });
 
   it("includes the who-pays and indexability hints", async () => {
-    const { client } = fakeClient(makeAgent({ enabled: false }));
+    const { client } = fakeClient(makeAgent(), makeShare({ enabled: false }));
 
     const result = await shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...CLOUD });
 
@@ -259,7 +340,7 @@ describe("shareAgent output", () => {
   });
 
   it("warns that a local link won't serve visitors (guest chat is Cloud-only)", async () => {
-    const { client } = fakeClient(makeAgent({ enabled: false }));
+    const { client } = fakeClient(makeAgent(), makeShare({ enabled: false }));
 
     const result = await shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...LOCAL });
 
@@ -269,7 +350,7 @@ describe("shareAgent output", () => {
   });
 
   it("omits the local warning on a cloud backend", async () => {
-    const { client } = fakeClient(makeAgent({ enabled: false }));
+    const { client } = fakeClient(makeAgent(), makeShare({ enabled: false }));
 
     const result = await shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...CLOUD });
 
@@ -279,8 +360,9 @@ describe("shareAgent output", () => {
 
 describe("shareAgent --reset-link (rotatable share token)", () => {
   it("rotates and prints the fresh tokened link and snippet", async () => {
-    const { client, calls, rotationCount } = fakeClient(
-      makeAgent({ enabled: true }),
+    const { client, applies, rotationCount } = fakeClient(
+      makeAgent(),
+      makeShare({ enabled: true }),
       { rotatedToken: "fresh-token" },
     );
 
@@ -290,8 +372,8 @@ describe("shareAgent --reset-link (rotatable share token)", () => {
       ...CLOUD,
     });
 
-    // Already enabled: no sharing write, exactly one rotation.
-    expect(calls).toHaveLength(0);
+    // Already enabled: no spec write, exactly one rotation.
+    expect(applies).toHaveLength(0);
     expect(rotationCount()).toBe(1);
     expect(result.message).toContain("Share link reset");
 
@@ -306,9 +388,30 @@ describe("shareAgent --reset-link (rotatable share token)", () => {
     expect(result.hints.some((h) => h.includes("Re-share the new link"))).toBe(true);
   });
 
+  it("enable + reset on a never-shared agent creates the share, then rotates it", async () => {
+    const { client, applies, rotationCount } = fakeClient(makeAgent(), null, {
+      rotatedToken: "fresh-token",
+    });
+
+    const result = await shareAgent(client, "acme/support-agent", "acme", {
+      enabled: true,
+      resetLink: true,
+      ...CLOUD,
+    });
+
+    // The rotation needs a share id, which only exists after the create.
+    expect(applies).toHaveLength(1);
+    expect(rotationCount()).toBe(1);
+    const link = result.sections.find((s) => s.title === "Public chat link");
+    expect(link?.items).toEqual([
+      "https://app.stigmer.ai/chat/acme/support-agent?k=fresh-token",
+    ]);
+  });
+
   it("a plain toggle on a locked link keeps printing the existing tokened URL", async () => {
     const { client, rotationCount } = fakeClient(
-      makeAgent({ enabled: true }, "existing-token"),
+      makeAgent(),
+      makeShare({ enabled: true, shareLinkToken: "existing-token" }),
     );
 
     const result = await shareAgent(client, "acme/support-agent", "acme", {
@@ -327,7 +430,8 @@ describe("shareAgent --reset-link (rotatable share token)", () => {
 
   it("refuses --reset-link for an org-members-only share with actionable guidance", async () => {
     const { client, rotationCount } = fakeClient(
-      makeAgent({ enabled: true, audience: AgentSharingAudience.org }),
+      makeAgent(),
+      makeShare({ enabled: true, audience: AgentShareAudience.org }),
     );
 
     const err = await shareAgent(client, "acme/support-agent", "acme", {
@@ -345,7 +449,12 @@ describe("shareAgent --reset-link (rotatable share token)", () => {
 
   it("the member link never carries a token, even when one exists in status", async () => {
     const { client } = fakeClient(
-      makeAgent({ enabled: true, audience: AgentSharingAudience.org }, "existing-token"),
+      makeAgent(),
+      makeShare({
+        enabled: true,
+        audience: AgentShareAudience.org,
+        shareLinkToken: "existing-token",
+      }),
     );
 
     const result = await shareAgent(client, "acme/support-agent", "acme", {
@@ -360,27 +469,27 @@ describe("shareAgent --reset-link (rotatable share token)", () => {
 
 describe("shareAgent errors", () => {
   it("fails fast with org guidance for a bare slug and no org", async () => {
-    const { client, calls } = fakeClient(makeAgent());
+    const { client, applies } = fakeClient(makeAgent(), null);
 
     const err = await shareAgent(client, "support-agent", "", { enabled: true, ...CLOUD }).catch((e: unknown) => e);
 
     expect(err).toBeInstanceOf(UsageError);
     expect((err as Error).message).toContain("organization not set");
     expect(classify(err)?.exitCode).toBe(ExitCode.Usage);
-    expect(calls).toHaveLength(0);
+    expect(applies).toHaveLength(0);
   });
 
   it("does not apply the org guard to an ID reference", async () => {
-    const { client, calls } = fakeClient(makeAgent({ enabled: false }));
+    const { client, applies } = fakeClient(makeAgent(), makeShare({ enabled: false }));
 
     await shareAgent(client, "agt_01ARZ3NDEKTSV4RRFFQ69G5FAV", "", { enabled: true, ...CLOUD });
 
-    expect(calls).toHaveLength(1);
+    expect(applies).toHaveLength(1);
   });
 
   it("propagates server rejections (permission denied) unchanged", async () => {
     const denied = new Error("permission denied: can_edit required");
-    const { client } = fakeClient(makeAgent({ enabled: false }), { failWith: denied });
+    const { client } = fakeClient(makeAgent(), makeShare({ enabled: false }), { failWith: denied });
 
     await expect(shareAgent(client, "acme/support-agent", "acme", { enabled: true, ...CLOUD })).rejects.toThrow(
       /permission denied/,