@stigmer/cli 3.35.0 → 3.36.0

package/src/resources/apply/apply.integration.test.ts

@@ -1,353 +0,0 @@
-// In-process integration test for file-mode apply.
-//
-// The keystone assertion (the reason this wave drives the raw command
-// controllers instead of the high-level SDK `apply(input)`): a resource carrying
-// fields the SDK's lossy `*Input` would drop — notably `metadata.id`, which
-// distinguishes an update from a create — must reach the backend intact. We
-// apply an Agent YAML with an id set plus spec fields and assert the server
-// received every one. Also covers dependency ordering, org injection, dry-run,
-// and the created-vs-updated signal.
-
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { createServer as createHttp2Server, type Http2Server, type ServerHttp2Session } from "node:http2";
-import type { AddressInfo } from "node:net";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { type ConnectRouter, createClient } from "@connectrpc/connect";
-import { connectNodeAdapter } from "@connectrpc/connect-node";
-import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
-import type { ChannelApp } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
-import { ChannelAppCommandController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/command_pb";
-import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
-import { createNodeTransport, normalizeEndpoint } from "@stigmer/sdk/node";
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { applyItem, requiresOrgContext, resolveApplyItems } from "./apply.js";
-import type { ControllerFn } from "./handlers.js";
-
-let backend: Http2Server;
-let controllerFn: ControllerFn;
-const openSessions = new Set<ServerHttp2Session>();
-
-let appliedAgents: Agent[] = [];
-let appliedMcps: McpServer[] = [];
-let appliedChannelApps: ChannelApp[] = [];
-
-beforeEach(() => {
-  appliedAgents = [];
-  appliedMcps = [];
-  appliedChannelApps = [];
-});
-
-function writeYaml(dir: string, name: string, body: string): string {
-  const path = join(dir, name);
-  writeFileSync(path, body);
-  return path;
-}
-
-beforeAll(async () => {
-  const routes = (router: ConnectRouter) => {
-    router.service(AgentCommandController, {
-      apply: (req) => {
-        appliedAgents.push(req);
-        return req; // echo back the full proto the server received
-      },
-    });
-    router.service(McpServerCommandController, {
-      apply: (req) => {
-        appliedMcps.push(req);
-        return req;
-      },
-    });
-    router.service(ChannelAppCommandController, {
-      apply: (req) => {
-        appliedChannelApps.push(req);
-        return req;
-      },
-    });
-  };
-
-  backend = createHttp2Server(connectNodeAdapter({ routes }));
-  backend.on("session", (session) => {
-    openSessions.add(session);
-    session.on("close", () => openSessions.delete(session));
-  });
-  await new Promise<void>((resolve) => backend.listen(0, "127.0.0.1", resolve));
-  const port = (backend.address() as AddressInfo).port;
-  const transport = createNodeTransport({ baseUrl: normalizeEndpoint(`127.0.0.1:${port}`) });
-  controllerFn = (service) => createClient(service, transport);
-});
-
-afterAll(async () => {
-  for (const session of openSessions) session.destroy();
-  await new Promise<void>((resolve) => backend.close(() => resolve()));
-});
-
-const AGENT_WITH_ID = [
-  "apiVersion: agentic.stigmer.ai/v1",
-  "kind: Agent",
-  "metadata:",
-  "  id: agt_existing",
-  "  name: Reviewer",
-  "  slug: reviewer",
-  "  org: acme",
-  "spec:",
-  "  description: A code reviewer",
-  "  instructions: Review pull requests carefully",
-  "",
-].join("\n");
-
-describe("file-mode apply — fidelity (raw controller preserves full proto)", () => {
-  it("preserves metadata.id and spec fields the SDK input would drop", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(dir, "agent.yaml", AGENT_WITH_ID);
-      const items = resolveApplyItems(dir);
-      expect(items).toHaveLength(1);
-
-      const outcome = await applyItem(controllerFn, items[0], "acme", false);
-
-      // The keystone: id (lossy in AgentInput) and spec round-trip intact.
-      expect(appliedAgents).toHaveLength(1);
-      expect(appliedAgents[0].metadata?.id).toBe("agt_existing");
-      expect(appliedAgents[0].metadata?.slug).toBe("reviewer");
-      expect(appliedAgents[0].spec?.description).toBe("A code reviewer");
-      expect(appliedAgents[0].spec?.instructions).toBe("Review pull requests carefully");
-
-      // id present → treated as an update.
-      expect(outcome.result.status).toBe("success");
-      expect(outcome.result.message).toBe("Agent updated successfully");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("treats a resource without metadata.id as a create", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(
-        dir,
-        "agent.yaml",
-        ["kind: Agent", "metadata:", "  name: New", "  slug: new", "spec:", "  description: d", ""].join("\n"),
-      );
-      const items = resolveApplyItems(dir);
-      const outcome = await applyItem(controllerFn, items[0], "acme", false);
-      expect(outcome.result.message).toBe("Agent created successfully");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("injects the resolved org when the document omits it", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(
-        dir,
-        "agent.yaml",
-        ["kind: Agent", "metadata:", "  name: NoOrg", "  slug: no-org", "spec:", "  description: d", ""].join("\n"),
-      );
-      const items = resolveApplyItems(dir);
-      await applyItem(controllerFn, items[0], "acme", false);
-      expect(appliedAgents[0].metadata?.org).toBe("acme");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-
-
-// The stigmer/stigmer#353 regression block: ChannelApp apply used to fail
-// with "apply not implemented for Channel App" because the CLI's handler
-// table was a drifted copy of the SDK manifest registry. The handlers now
-// COME FROM that registry, so this suite pins the whole class: the kind
-// applies, secrets round-trip verbatim, and the ordering the registry
-// encodes (app before the channel that references it) is honored.
-const CHANNEL_APP_YAML = [
-  "apiVersion: agentic.stigmer.ai/v1",
-  "kind: ChannelApp",
-  "metadata:",
-  "  name: demo-whatsapp",
-  "  slug: demo-whatsapp",
-  "spec:",
-  "  whatsapp:",
-  "    app_id: '108954'",
-  "    app_secret: '***REDACTED***'",
-  "    access_token: '***REDACTED***'",
-  "    verify_token: '***REDACTED***'",
-  "",
-].join("\n");
-
-const AGENT_CHANNEL_YAML = [
-  "apiVersion: agentic.stigmer.ai/v1",
-  "kind: AgentChannel",
-  "metadata:",
-  "  name: isc-whatsapp",
-  "  slug: isc-whatsapp",
-  "spec:",
-  "  enabled: true",
-  "  agent_ref: { kind: 40, org: acme, slug: clinic-assistant }",
-  "  whatsapp: { phone_number_id: '106540352242922' }",
-  "",
-].join("\n");
-
-const SCHEDULE_YAML = [
-  "apiVersion: agentic.stigmer.ai/v1",
-  "kind: Schedule",
-  "metadata:",
-  "  name: daily-fee-reminders",
-  "  slug: daily-fee-reminders",
-  "spec:",
-  "  cron: '0 9 * * *'",
-  "  time_zone: Asia/Kolkata",
-  "  enabled: false",
-  "  agent:",
-  "    agent_ref: { kind: 40, org: acme, slug: clinic-assistant }",
-  "    message: run the reminders",
-  "",
-].join("\n");
-
-describe("file-mode apply — channel app (#353)", () => {
-  it("applies a ChannelApp through the raw controller with the redaction markers intact", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(dir, "chapp.yaml", CHANNEL_APP_YAML);
-      const items = resolveApplyItems(dir);
-      expect(items).toHaveLength(1);
-
-      const outcome = await applyItem(controllerFn, items[0], "acme", false);
-      expect(outcome.result.message).toBe("Channel App created successfully");
-
-      expect(appliedChannelApps).toHaveLength(1);
-      const spec = appliedChannelApps[0].spec;
-      expect(spec?.providerConfig.case).toBe("whatsapp");
-      if (spec?.providerConfig.case !== "whatsapp") throw new Error("unreachable");
-      expect(spec.providerConfig.value.appId).toBe("108954");
-      // The redaction markers must reach the server verbatim — that is the
-      // convention by which applying a fetched manifest preserves stored
-      // secrets (verb-support's OAuthApp marker note).
-      expect(spec.providerConfig.value.appSecret).toBe("***REDACTED***");
-      expect(spec.providerConfig.value.accessToken).toBe("***REDACTED***");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("treats a ChannelApp carrying metadata.id as an update", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(
-        dir,
-        "chapp.yaml",
-        CHANNEL_APP_YAML.replace("metadata:", "metadata:\n  id: chapp_existing"),
-      );
-      const items = resolveApplyItems(dir);
-      const outcome = await applyItem(controllerFn, items[0], "acme", false);
-      expect(outcome.result.message).toBe("Channel App updated successfully");
-      expect(appliedChannelApps[0].metadata?.id).toBe("chapp_existing");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("orders one bundle app → channel → schedule regardless of file order", () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      // File names chosen so lexical file order is exactly WRONG — before
-      // the registry unification all three kinds fell to a shared default
-      // priority and applied in this (broken) file order.
-      writeYaml(dir, "a-schedule.yaml", SCHEDULE_YAML);
-      writeYaml(dir, "b-channel.yaml", AGENT_CHANNEL_YAML);
-      writeYaml(dir, "c-chapp.yaml", CHANNEL_APP_YAML);
-      const items = resolveApplyItems(dir);
-      expect(items.map((i) => i.handler.displayName)).toEqual(["Channel App", "Agent Channel", "Schedule"]);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-describe("file-mode apply — kinds the registry does not know", () => {
-  it("refuses a retired kind with what happened and what to run instead", () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(dir, "project.yaml", ["kind: Project", "metadata:", "  name: Demo", "  slug: demo", ""].join("\n"));
-      expect(() => resolveApplyItems(dir)).toThrow(
-        /kind 'Project' in .*project\.yaml is no longer a Stigmer resource.*stigmer push plugin <dir>/,
-      );
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("refuses a kind that never existed with the plain unknown-kind sentence", () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(dir, "thing.yaml", ["kind: Widget", "metadata:", "  name: Demo", ""].join("\n"));
-      expect(() => resolveApplyItems(dir)).toThrow(/^unknown resource kind 'Widget' in .*thing\.yaml$/);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-describe("file-mode apply — orchestration", () => {
-  it("sorts items into dependency order (mcp_server before agent)", () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(dir, "agent.yaml", AGENT_WITH_ID);
-      writeYaml(
-        dir,
-        "mcp.yaml",
-        ["kind: McpServer", "metadata:", "  name: fs", "  slug: fs", "spec:", "  stdio:", "    command: node", ""].join(
-          "\n",
-        ),
-      );
-      const items = resolveApplyItems(dir);
-      expect(items.map((i) => i.handler.displayName)).toEqual(["MCP Server", "Agent"]);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("requiresOrgContext is false for an Organization-only set", () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(dir, "org.yaml", ["kind: Organization", "metadata:", "  name: Acme", "  slug: acme", ""].join("\n"));
-      const items = resolveApplyItems(dir);
-      expect(requiresOrgContext(items)).toBe(false);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("dry-run previews without touching the backend", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(dir, "agent.yaml", AGENT_WITH_ID);
-      const items = resolveApplyItems(dir);
-      const before = appliedAgents.length;
-      const outcome = await applyItem(controllerFn, items[0], "acme", true);
-      expect(outcome.result.message).toBe("Dry run: Reviewer is valid");
-      expect(appliedAgents.length).toBe(before);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("rejects unknown YAML fields under strict marshalling", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
-    try {
-      writeYaml(
-        dir,
-        "agent.yaml",
-        ["kind: Agent", "metadata:", "  name: Bad", "spec:", "  bogus_field: nope", ""].join("\n"),
-      );
-      const items = resolveApplyItems(dir);
-      await expect(applyItem(controllerFn, items[0], "acme", false)).rejects.toThrow(/invalid Agent/);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});

package/src/resources/apply/apply.test.ts

@@ -1,134 +0,0 @@
-// Unit tests for the shared apply core's declared-visibility follow-up
-// (oss#573). Plain updates preserve stored visibility on both editions, so
-// the apply RPC's response carries the STORED level; when a manifest
-// declares a different one, the core must land it through the guarded
-// updateVisibility RPC — or warn when the kind has no such door.
-
-import { create, type Message } from "@bufbuild/protobuf";
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import type { UpdateVisibilityInput } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { describe, expect, it } from "vitest";
-import { applyMessage } from "./apply.js";
-import type { ApplyHandler, ControllerFn } from "./handlers.js";
-
-// The controller accessor is only ever forwarded to handler methods, which
-// these tests stub out — a throwing dummy proves nothing else touches it.
-const controller: ControllerFn = () => {
-  throw new Error("unexpected controller access");
-};
-
-function agent(visibility: ApiResourceVisibility, id = "agent-1") {
-  return create(AgentSchema, {
-    metadata: { id, name: "a", org: "acme", visibility },
-    spec: { instructions: "i" },
-  });
-}
-
-interface HandlerOptions {
-  applyReturns: Message;
-  updateVisibility?: (input: UpdateVisibilityInput) => Promise<Message>;
-}
-
-function handlerWith(opts: HandlerOptions): { handler: ApplyHandler; calls: UpdateVisibilityInput[] } {
-  const calls: UpdateVisibilityInput[] = [];
-  const handler: ApplyHandler = {
-    kind: ApiResourceKind.agent,
-    displayName: "Agent",
-    schema: AgentSchema,
-    applyOrder: 3,
-    apply: () => Promise.resolve(opts.applyReturns),
-    ...(opts.updateVisibility !== undefined && {
-      updateVisibility: (_c: ControllerFn, input: UpdateVisibilityInput) => {
-        calls.push(input);
-        return opts.updateVisibility!(input);
-      },
-    }),
-  };
-  return { handler, calls };
-}
-
-describe("applyMessage declared-visibility follow-up", () => {
-  it("lands a declared level the update preserved away, and reflects it on the outcome", async () => {
-    // Server preserved stored org; manifest declares platform.
-    const { handler, calls } = handlerWith({
-      applyReturns: agent(ApiResourceVisibility.visibility_org),
-      updateVisibility: () => Promise.resolve(agent(ApiResourceVisibility.visibility_platform)),
-    });
-
-    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", false);
-
-    expect(calls).toHaveLength(1);
-    expect(calls[0].resourceId).toBe("agent-1");
-    expect(calls[0].visibility).toBe(ApiResourceVisibility.visibility_platform);
-    expect(outcome.warning).toBeUndefined();
-    const appliedMeta = (outcome.applied as { metadata?: { visibility?: ApiResourceVisibility } })?.metadata;
-    expect(appliedMeta?.visibility).toBe(ApiResourceVisibility.visibility_platform);
-  });
-
-  it("skips the follow-up when the manifest omits visibility", async () => {
-    const { handler, calls } = handlerWith({
-      applyReturns: agent(ApiResourceVisibility.visibility_org),
-      updateVisibility: () => Promise.reject(new Error("must not be called")),
-    });
-
-    const outcome = await applyMessage(
-      controller,
-      handler,
-      agent(ApiResourceVisibility.api_resource_visibility_unspecified),
-      "acme",
-      false,
-    );
-
-    expect(calls).toHaveLength(0);
-    expect(outcome.warning).toBeUndefined();
-  });
-
-  it("skips the follow-up when the server already matches (idempotent re-apply)", async () => {
-    const { handler, calls } = handlerWith({
-      applyReturns: agent(ApiResourceVisibility.visibility_platform),
-      updateVisibility: () => Promise.reject(new Error("must not be called")),
-    });
-
-    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", false);
-
-    expect(calls).toHaveLength(0);
-    expect(outcome.warning).toBeUndefined();
-  });
-
-  it("warns instead of silently swallowing a diff on kinds without the RPC", async () => {
-    const { handler } = handlerWith({
-      applyReturns: agent(ApiResourceVisibility.visibility_private),
-    });
-
-    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", false);
-
-    expect(outcome.warning).toMatch(/visibility cannot be changed declaratively/);
-    expect(outcome.warning).toMatch(/stored value is kept/);
-  });
-
-  it("fails loudly when the guarded door rejects, naming the partial state", async () => {
-    // e.g. the default-instance FAILED_PRECONDITION or an unsupported level.
-    const { handler } = handlerWith({
-      applyReturns: agent(ApiResourceVisibility.visibility_org),
-      updateVisibility: () => Promise.reject(new Error("default instances do not have their own visibility")),
-    });
-
-    await expect(
-      applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", false),
-    ).rejects.toThrow(/spec applied, but the manifest's visibility change was rejected/);
-  });
-
-  it("does not follow up in dry-run mode", async () => {
-    const { handler, calls } = handlerWith({
-      applyReturns: agent(ApiResourceVisibility.visibility_org),
-      updateVisibility: () => Promise.reject(new Error("must not be called")),
-    });
-
-    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", true);
-
-    expect(calls).toHaveLength(0);
-    expect(outcome.applied).toBeUndefined();
-  });
-});

package/src/resources/apply/discovery.integration.test.ts

@@ -1,99 +0,0 @@
-// In-process integration test for post-apply MCP discovery.
-//
-// Stands up a Connect backend serving McpServerCommandController.connect, points
-// an SDK node client at it, and drives discoverAppliedMcpServers. The mock
-// mirrors the backend's protovalidate rule (org min_len=1) by rejecting an empty
-// org, so a regression that drops org from ConnectInput is caught here rather
-// than silently passing (issue #140: the CLI used to omit org entirely).
-
-import { create } from "@bufbuild/protobuf";
-import { Code, ConnectError, type ConnectRouter } from "@connectrpc/connect";
-import { connectNodeAdapter } from "@connectrpc/connect-node";
-import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
-import type { ConnectInput } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
-import type { Stigmer } from "@stigmer/sdk";
-import { createNodeClient, normalizeEndpoint } from "@stigmer/sdk/node";
-import { createServer as createHttp2Server, type Http2Server, type ServerHttp2Session } from "node:http2";
-import type { AddressInfo } from "node:net";
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { discoverAppliedMcpServers } from "./discovery.js";
-
-let backend: Http2Server;
-let client: Stigmer;
-const openSessions = new Set<ServerHttp2Session>();
-
-let connectCalls: ConnectInput[] = [];
-
-beforeEach(() => {
-  connectCalls = [];
-});
-
-// A stdio MCP server with no env declarations, so discovery does not skip it and
-// buildRuntimeEnv stays empty (no local process needed — connect is mocked).
-function stdioServer(id: string, org: string) {
-  return create(McpServerSchema, {
-    metadata: { id, name: id, slug: id, org },
-    spec: { serverType: { case: "stdio", value: { command: "noop" } } },
-  });
-}
-
-beforeAll(async () => {
-  const routes = (router: ConnectRouter) => {
-    router.service(McpServerCommandController, {
-      connect: (req) => {
-        if (req.org === "") {
-          throw new ConnectError("org – value length must be at least 1 characters", Code.InvalidArgument);
-        }
-        connectCalls.push(req);
-        return create(McpServerSchema, { metadata: { id: req.mcpServerId } });
-      },
-    });
-  };
-
-  backend = createHttp2Server(connectNodeAdapter({ routes }));
-  backend.on("session", (session) => {
-    openSessions.add(session);
-    session.on("close", () => openSessions.delete(session));
-  });
-  await new Promise<void>((resolve) => backend.listen(0, "127.0.0.1", resolve));
-  const port = (backend.address() as AddressInfo).port;
-  client = createNodeClient({ baseUrl: normalizeEndpoint(`127.0.0.1:${port}`) });
-});
-
-afterAll(async () => {
-  for (const session of openSessions) session.destroy();
-  await new Promise<void>((resolve) => backend.close(() => resolve()));
-});
-
-describe("discoverAppliedMcpServers", () => {
-  it("forwards the resolved org on ConnectInput for each applied stdio server", async () => {
-    const lines: string[] = [];
-    await discoverAppliedMcpServers(client, [stdioServer("mcp_1", "acme")], "acme", (l) => lines.push(l));
-
-    expect(connectCalls).toHaveLength(1);
-    expect(connectCalls[0].mcpServerId).toBe("mcp_1");
-    expect(connectCalls[0].org).toBe("acme");
-    expect(lines.join("\n")).toContain("Discovered capabilities for mcp_1");
-  });
-
-  it("surfaces the backend's org validation as a per-server warning when org is empty (regression guard)", async () => {
-    const lines: string[] = [];
-    await discoverAppliedMcpServers(client, [stdioServer("mcp_1", "acme")], "", (l) => lines.push(l));
-
-    // Best-effort: an empty org must never crash the apply — it degrades to a
-    // warning. This proves the mock (and thus the backend) rejects empty org, so
-    // the happy-path org assertion above is a real guard, not a tautology.
-    expect(connectCalls).toHaveLength(0);
-    expect(lines.join("\n")).toContain("Discovery failed for mcp_1");
-  });
-
-  it("skips non-stdio servers without calling connect", async () => {
-    const httpServer = create(McpServerSchema, {
-      metadata: { id: "mcp_http", name: "http", slug: "http", org: "acme" },
-      spec: { serverType: { case: "http", value: { url: "https://example.com/mcp" } } },
-    });
-    await discoverAppliedMcpServers(client, [httpServer], "acme");
-    expect(connectCalls).toHaveLength(0);
-  });
-});

package/src/resources/connect/__fixtures__/stdio-crash.mjs

@@ -1,6 +0,0 @@
-// A stdio command that fails to start an MCP server: it writes a diagnostic to
-// stderr and exits non-zero. Used to assert connect --dry-run surfaces a clear
-// connection error (and the subprocess stderr) rather than hanging.
-
-process.stderr.write("fixture boom: missing CONFIG\n");
-process.exit(1);

package/src/resources/connect/__fixtures__/stdio-server.mjs

@@ -1,48 +0,0 @@
-// Minimal stdio MCP server fixture for `connect --dry-run` discovery tests.
-//
-// Spawned as a subprocess by discover.ts via StdioClientTransport. Advertises a
-// single tool and a single resource template using the low-level Server API
-// (the most version-stable surface of @modelcontextprotocol/sdk). It also echoes
-// an --env-provided value AND the CLI args it received (process.argv beyond the
-// script path) through the tool description, so tests can assert env propagation
-// and ${VAR} argument expansion.
-
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import {
-  ListResourceTemplatesRequestSchema,
-  ListToolsRequestSchema,
-} from "@modelcontextprotocol/sdk/types.js";
-
-const server = new Server(
-  { name: "fixture-mcp", version: "0.0.1" },
-  { capabilities: { tools: {}, resources: {} } },
-);
-
-const receivedArgs = process.argv.slice(2);
-
-server.setRequestHandler(ListToolsRequestSchema, async () => ({
-  tools: [
-    {
-      name: "echo",
-      description:
-        `echo a message (token=${process.env.FIXTURE_TOKEN ?? "unset"}) ` +
-        `(args=${JSON.stringify(receivedArgs)})`,
-      inputSchema: { type: "object", properties: { text: { type: "string" } } },
-    },
-    { name: "noop", description: "", inputSchema: { type: "object" } },
-  ],
-}));
-
-server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
-  resourceTemplates: [
-    {
-      uriTemplate: "file:///{path}",
-      name: "local-file",
-      description: "a local file",
-      mimeType: "text/plain",
-    },
-  ],
-}));
-
-await server.connect(new StdioServerTransport());