@stigmer/react 3.12.0 → 3.12.2

package/src/mcp-server/__tests__/mcpServerToInput.test.ts

@@ -0,0 +1,201 @@
+import { describe, expect, it } from "vitest";
+import { create, toJson } from "@bufbuild/protobuf";
+import type { DescMessage } from "@bufbuild/protobuf";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import {
+  HttpServerConfigSchema,
+  McpServerAuthSchema,
+  McpServerSpecSchema,
+  StdioServerConfigSchema,
+  ToolApprovalPolicySchema,
+} from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import { EnvVarDeclarationSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { buildMcpServerProto } from "@stigmer/sdk";
+import { mcpServerToInput } from "../internal/mcpServerToInput.js";
+
+/**
+ * `mcpServerToInput` powers every read-modify-write update in the SDK: the
+ * backend does FULL spec replacement, so any spec field the conversion
+ * fails to carry is silently ERASED by the very next inline edit. That is
+ * not hypothetical — `spec.tags` and `auth.oauth_only` were lost this way
+ * until the conversion (and the SDK input type) learned them.
+ *
+ * Two layers of protection:
+ *
+ * 1. A field-inventory fence: pins the exact field set of every proto
+ *    message the conversion traverses. Adding a field to the proto makes
+ *    this test fail with instructions, instead of shipping a new
+ *    silent-data-loss bug.
+ * 2. A round-trip proof: a fully-populated server survives
+ *    `mcpServerToInput` -> `buildMcpServerProto` with its spec intact.
+ */
+
+// ---------------------------------------------------------------------------
+// Layer 1 — field-inventory fence
+// ---------------------------------------------------------------------------
+
+/**
+ * Every message the conversion walks, with its complete expected field set
+ * (proto `localName`s; oneof members appear as individual fields).
+ *
+ * If this fails because a field was ADDED: map the new field in
+ * `mcpServerToInput`, populate it in `fullyPopulatedServer` below, and only
+ * then extend the expected list here.
+ */
+const EXPECTED_FIELD_INVENTORY: ReadonlyArray<
+  readonly [DescMessage, readonly string[]]
+> = [
+  [
+    McpServerSpecSchema,
+    [
+      "auth",
+      "defaultEnabledTools",
+      "description",
+      "env",
+      "githubStars",
+      "http",
+      "iconUrl",
+      "pinnedToolApprovals",
+      "repositoryUrl",
+      "stdio",
+      "tags",
+    ],
+  ],
+  [StdioServerConfigSchema, ["args", "command", "workingDir"]],
+  [HttpServerConfigSchema, ["headers", "queryParams", "timeoutSeconds", "url"]],
+  [EnvVarDeclarationSchema, ["description", "isSecret", "optional"]],
+  [ToolApprovalPolicySchema, ["fromDestructiveHint", "message", "toolName"]],
+  [
+    McpServerAuthSchema,
+    [
+      "discoveryUrl",
+      "oauthAppRef",
+      "oauthOnly",
+      "scopeHints",
+      "targetEnvVar",
+      "tokenLifetimeHint",
+    ],
+  ],
+];
+
+describe("mcpServerToInput field-inventory fence", () => {
+  it.each(
+    EXPECTED_FIELD_INVENTORY.map(
+      ([schema, fields]) => [schema.typeName, schema, fields] as const,
+    ),
+  )("%s has exactly the fields the conversion maps", (_name, schema, fields) => {
+    const actual = schema.fields.map((f) => f.localName).sort();
+    expect(
+      actual,
+      `${schema.typeName} changed shape. Map any new field in ` +
+        "mcpServerToInput (unmapped spec fields are ERASED on the next " +
+        "update), populate it in this file's fullyPopulatedServer fixture, " +
+        "then update EXPECTED_FIELD_INVENTORY.",
+    ).toEqual([...fields].sort());
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Layer 2 — round-trip proof
+// ---------------------------------------------------------------------------
+
+/**
+ * A server with EVERY spec field set to a non-default value, so any field
+ * the conversion drops shows up as a round-trip diff.
+ */
+function fullyPopulatedServer(transport: "stdio" | "http") {
+  const server = create(McpServerSchema, {
+    apiVersion: "agentic.stigmer.ai/v1",
+    kind: "McpServer",
+    metadata: create(ApiResourceMetadataSchema, {
+      name: "Monday",
+      org: "acme",
+      slug: "monday",
+      labels: { "stigmer.ai/category": "productivity" },
+    }),
+    spec: create(McpServerSpecSchema, {
+      description: "monday.com MCP server",
+      iconUrl: "https://example.com/monday.svg",
+      tags: ["monday", "project-management"],
+      defaultEnabledTools: ["boards_list", "items_create"],
+      env: {
+        MONDAY_ACCESS_TOKEN: create(EnvVarDeclarationSchema, {
+          isSecret: true,
+          description: "OAuth access token",
+          optional: true,
+        }),
+      },
+      pinnedToolApprovals: [
+        create(ToolApprovalPolicySchema, {
+          toolName: "items_delete",
+          message: "Deletes board items",
+          fromDestructiveHint: true,
+        }),
+      ],
+      repositoryUrl: "https://github.com/mondaycom/mcp",
+      githubStars: 387,
+      auth: create(McpServerAuthSchema, {
+        oauthAppRef: create(ApiResourceReferenceSchema, {
+          org: "stigmer",
+          slug: "monday-oauth",
+          kind: ApiResourceKind.oauth_app,
+        }),
+        targetEnvVar: "MONDAY_ACCESS_TOKEN",
+        tokenLifetimeHint: "1h",
+        scopeHints: ["boards:read", "boards:write"],
+        discoveryUrl: "https://auth.monday.com/.well-known/oauth",
+        oauthOnly: true,
+      }),
+    }),
+  });
+
+  if (transport === "stdio") {
+    server.spec!.serverType = {
+      case: "stdio",
+      value: create(StdioServerConfigSchema, {
+        command: "npx",
+        args: ["-y", "@mondaycom/mcp"],
+        workingDir: "/workspace",
+      }),
+    };
+  } else {
+    server.spec!.serverType = {
+      case: "http",
+      value: create(HttpServerConfigSchema, {
+        url: "https://mcp.monday.com/mcp",
+        headers: { Authorization: "Bearer ${MONDAY_ACCESS_TOKEN}" },
+        queryParams: { version: "2" },
+        timeoutSeconds: 45,
+      }),
+    };
+  }
+
+  return server;
+}
+
+describe("mcpServerToInput round-trip", () => {
+  it.each(["stdio", "http"] as const)(
+    "a fully-populated %s server survives toInput -> buildProto with spec intact",
+    (transport) => {
+      const original = fullyPopulatedServer(transport);
+      const rebuilt = buildMcpServerProto(mcpServerToInput(original));
+
+      expect(toJson(McpServerSpecSchema, rebuilt.spec!)).toEqual(
+        toJson(McpServerSpecSchema, original.spec!),
+      );
+
+      // Metadata identity fields the conversion is responsible for.
+      // (visibility is intentionally absent: the backend preserves it on
+      // update, and updateVisibility is its dedicated write path.)
+      expect(rebuilt.metadata?.name).toBe("Monday");
+      expect(rebuilt.metadata?.org).toBe("acme");
+      expect(rebuilt.metadata?.slug).toBe("monday");
+      expect(rebuilt.metadata?.labels).toEqual({
+        "stigmer.ai/category": "productivity",
+      });
+    },
+  );
+});

package/src/mcp-server/__tests__/useMcpServerCredentials.test.tsx

@@ -0,0 +1,306 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { renderHook, waitFor, cleanup } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { create } from "@bufbuild/protobuf";
+import { createRouterTransport, ConnectError, Code } from "@connectrpc/connect";
+import { Stigmer } from "@stigmer/sdk";
+import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
+import {
+  GetOAuthGrantStatusOutputSchema,
+  GetOrgOAuthAppOutputSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import { EnvironmentQueryController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/query_pb";
+import { EnvironmentListSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/io_pb";
+import {
+  McpServerSpecSchema,
+  McpServerAuthSchema,
+  HttpServerConfigSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import { OAuthAppSource } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/status_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { samples } from "../../test/samples";
+import { StigmerContext } from "../../context";
+import { useMcpServerCredentials } from "../useMcpServerCredentials";
+
+/**
+ * Pins the client-side derivation of the org-override signal
+ * (stigmer-cloud#401): `effectiveOAuthSource` / `isOrgOAuthApp` /
+ * `canBringOwnApp` are resolved from the `getOrgOAuthApp` RPC keyed on
+ * the hook's `org` parameter — NOT from `status.oauth_status` fields 3-4,
+ * which no backend populates (the caller's active org is client-side
+ * context the read RPCs never carry; see the OAuthStatus proto).
+ */
+
+afterEach(cleanup);
+
+const ORG = "acme";
+
+function buildServer(options: { withAuth: boolean; withAppRef: boolean }): McpServer {
+  const server = samples.mcpServer({ name: "Vendor CRM", org: ORG, slug: "vendor-crm" });
+  server.spec = create(McpServerSpecSchema, {
+    serverType: {
+      case: "http",
+      value: create(HttpServerConfigSchema, { url: "https://mcp.vendor.example.com" }),
+    },
+    ...(options.withAuth
+      ? {
+          auth: create(McpServerAuthSchema, {
+            targetEnvVar: "VENDOR_ACCESS_TOKEN",
+            ...(options.withAppRef
+              ? {
+                  oauthAppRef: {
+                    org: "stigmer",
+                    kind: ApiResourceKind.oauth_app,
+                    slug: "vendor-oauth",
+                  },
+                }
+              : {}),
+          }),
+        }
+      : {}),
+  });
+  return server;
+}
+
+/** Baseline handlers so personal-env and grant-status fetches stay healthy. */
+function baselineHandlers() {
+  return {
+    mcpServer: {
+      getOAuthGrantStatus: () =>
+        create(GetOAuthGrantStatusOutputSchema, { connected: false }),
+    },
+    environment: {
+      list: () => create(EnvironmentListSchema, { items: [] }),
+    },
+  };
+}
+
+function renderCredentials(
+  server: McpServer | null,
+  org: string | null,
+  register: Parameters<typeof createRouterTransport>[0],
+) {
+  const client = new Stigmer({
+    baseUrl: "/",
+    getAccessToken: () => "test-token",
+    customTransport: createRouterTransport(register),
+  });
+  const wrapper = ({ children }: { children: ReactNode }) => (
+    <StigmerContext.Provider value={client}>{children}</StigmerContext.Provider>
+  );
+  return renderHook(() => useMcpServerCredentials(org, server), { wrapper });
+}
+
+describe("useMcpServerCredentials — org-override derivation", () => {
+  it("reports ORG_OVERRIDE when the org has a BYOA override", async () => {
+    const base = baselineHandlers();
+    const { result } = renderCredentials(
+      buildServer({ withAuth: true, withAppRef: true }),
+      ORG,
+      (router) => {
+        router.service(McpServerQueryController, {
+          ...base.mcpServer,
+          getOrgOAuthApp: () =>
+            create(GetOrgOAuthAppOutputSchema, {
+              hasOverride: true,
+              oauthAppId: "oauthapp_01acme",
+              clientId: "acme-client-id",
+            }),
+        });
+        router.service(EnvironmentQueryController, base.environment);
+      },
+    );
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.isOrgOAuthApp).toBe(true);
+    expect(result.current.effectiveOAuthSource).toBe(
+      OAuthAppSource.OAUTH_APP_SOURCE_ORG_OVERRIDE,
+    );
+    expect(result.current.canBringOwnApp).toBe(false);
+    expect(result.current.error).toBeNull();
+  });
+
+  it("reports PLATFORM when no override exists for the org", async () => {
+    const base = baselineHandlers();
+    const { result } = renderCredentials(
+      buildServer({ withAuth: true, withAppRef: true }),
+      ORG,
+      (router) => {
+        router.service(McpServerQueryController, {
+          ...base.mcpServer,
+          getOrgOAuthApp: () =>
+            create(GetOrgOAuthAppOutputSchema, { hasOverride: false }),
+        });
+        router.service(EnvironmentQueryController, base.environment);
+      },
+    );
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.isOrgOAuthApp).toBe(false);
+    expect(result.current.effectiveOAuthSource).toBe(
+      OAuthAppSource.OAUTH_APP_SOURCE_PLATFORM,
+    );
+    expect(result.current.canBringOwnApp).toBe(true);
+  });
+
+  it("degrades to no-override with BYOA hidden when the backend does not implement the RPC (OSS)", async () => {
+    // getOrgOAuthApp deliberately NOT registered: the router transport
+    // answers UNIMPLEMENTED — exactly what the OSS server returns for the
+    // hosted-only org-override surface (stigmer/stigmer#558). No override
+    // can exist on that edition, so PLATFORM with no error is the truthful
+    // source — and canBringOwnApp stays false (the #558 capability gate:
+    // offering BYOA where the submit could only fail is a dead end).
+    const base = baselineHandlers();
+    const { result } = renderCredentials(
+      buildServer({ withAuth: true, withAppRef: true }),
+      ORG,
+      (router) => {
+        router.service(McpServerQueryController, base.mcpServer);
+        router.service(EnvironmentQueryController, base.environment);
+      },
+    );
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.isOrgOAuthApp).toBe(false);
+    expect(result.current.effectiveOAuthSource).toBe(
+      OAuthAppSource.OAUTH_APP_SOURCE_PLATFORM,
+    );
+    expect(result.current.canBringOwnApp).toBe(false);
+    expect(result.current.error).toBeNull();
+  });
+
+  it("reports NONE without firing the RPC when the server has no oauth_app_ref", async () => {
+    const base = baselineHandlers();
+    const getOrgOAuthApp = vi.fn(() =>
+      create(GetOrgOAuthAppOutputSchema, { hasOverride: true }),
+    );
+    const { result } = renderCredentials(
+      buildServer({ withAuth: true, withAppRef: false }),
+      ORG,
+      (router) => {
+        router.service(McpServerQueryController, {
+          ...base.mcpServer,
+          getOrgOAuthApp,
+        });
+        router.service(EnvironmentQueryController, base.environment);
+      },
+    );
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.effectiveOAuthSource).toBe(
+      OAuthAppSource.OAUTH_APP_SOURCE_NONE,
+    );
+    expect(result.current.isOrgOAuthApp).toBe(false);
+    expect(result.current.canBringOwnApp).toBe(false);
+    expect(getOrgOAuthApp).not.toHaveBeenCalled();
+  });
+
+  it("stays UNSPECIFIED without firing the RPC on a manual server", async () => {
+    const base = baselineHandlers();
+    const getOrgOAuthApp = vi.fn(() =>
+      create(GetOrgOAuthAppOutputSchema, { hasOverride: true }),
+    );
+    const { result } = renderCredentials(
+      buildServer({ withAuth: false, withAppRef: false }),
+      ORG,
+      (router) => {
+        router.service(McpServerQueryController, {
+          ...base.mcpServer,
+          getOrgOAuthApp,
+        });
+        router.service(EnvironmentQueryController, base.environment);
+      },
+    );
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.authMode).toBe("manual");
+    expect(result.current.effectiveOAuthSource).toBe(
+      OAuthAppSource.OAUTH_APP_SOURCE_UNSPECIFIED,
+    );
+    expect(getOrgOAuthApp).not.toHaveBeenCalled();
+  });
+
+  it("reports UNSPECIFIED and surfaces the error when the lookup genuinely fails", async () => {
+    const base = baselineHandlers();
+    const { result } = renderCredentials(
+      buildServer({ withAuth: true, withAppRef: true }),
+      ORG,
+      (router) => {
+        router.service(McpServerQueryController, {
+          ...base.mcpServer,
+          getOrgOAuthApp: () => {
+            throw new ConnectError("store unavailable", Code.Internal);
+          },
+        });
+        router.service(EnvironmentQueryController, base.environment);
+      },
+    );
+
+    await waitFor(() => expect(result.current.error).not.toBeNull());
+    // Unknown is not PLATFORM: guessing would hide a real override.
+    expect(result.current.effectiveOAuthSource).toBe(
+      OAuthAppSource.OAUTH_APP_SOURCE_UNSPECIFIED,
+    );
+    expect(result.current.isOrgOAuthApp).toBe(false);
+    // An errored probe never confirmed the surface exists — BYOA hides.
+    expect(result.current.canBringOwnApp).toBe(false);
+  });
+
+  it("reports UNSPECIFIED without firing the RPC when org is null", async () => {
+    const base = baselineHandlers();
+    const getOrgOAuthApp = vi.fn(() =>
+      create(GetOrgOAuthAppOutputSchema, { hasOverride: true }),
+    );
+    const { result } = renderCredentials(
+      buildServer({ withAuth: true, withAppRef: true }),
+      null,
+      (router) => {
+        router.service(McpServerQueryController, {
+          ...base.mcpServer,
+          getOrgOAuthApp,
+        });
+        router.service(EnvironmentQueryController, base.environment);
+      },
+    );
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.effectiveOAuthSource).toBe(
+      OAuthAppSource.OAUTH_APP_SOURCE_UNSPECIFIED,
+    );
+    expect(getOrgOAuthApp).not.toHaveBeenCalled();
+  });
+
+  it("refetch() re-resolves the override (BYOA set/remove flows update live)", async () => {
+    const base = baselineHandlers();
+    let hasOverride = false;
+    const { result } = renderCredentials(
+      buildServer({ withAuth: true, withAppRef: true }),
+      ORG,
+      (router) => {
+        router.service(McpServerQueryController, {
+          ...base.mcpServer,
+          getOrgOAuthApp: () =>
+            create(GetOrgOAuthAppOutputSchema, { hasOverride }),
+        });
+        router.service(EnvironmentQueryController, base.environment);
+      },
+    );
+
+    await waitFor(() =>
+      expect(result.current.effectiveOAuthSource).toBe(
+        OAuthAppSource.OAUTH_APP_SOURCE_PLATFORM,
+      ),
+    );
+
+    hasOverride = true;
+    result.current.refetch();
+
+    await waitFor(() =>
+      expect(result.current.effectiveOAuthSource).toBe(
+        OAuthAppSource.OAUTH_APP_SOURCE_ORG_OVERRIDE,
+      ),
+    );
+    expect(result.current.isOrgOAuthApp).toBe(true);
+  });
+});

package/src/mcp-server/__tests__/useMcpServerDefinitionDrift.test.tsx

@@ -0,0 +1,173 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { renderHook, waitFor, cleanup } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { create } from "@bufbuild/protobuf";
+import { createRouterTransport, ConnectError, Code } from "@connectrpc/connect";
+import { Stigmer } from "@stigmer/sdk";
+import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
+import { SearchService } from "@stigmer/protos/ai/stigmer/search/v1/query_pb";
+import {
+  SearchResponseSchema,
+  SearchResultSchema,
+} from "@stigmer/protos/ai/stigmer/search/v1/io_pb";
+import {
+  HttpServerConfigSchema,
+  McpServerSpecSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { samples } from "../../test/samples";
+import { StigmerContext } from "../../context";
+import { useMcpServerDefinitionDrift } from "../useMcpServerDefinitionDrift";
+
+/**
+ * Pins the template-resolution rules of the drift check
+ * (stigmer/stigmer#228): the marketplace counterpart is a cross-org
+ * PUBLIC row with the exact same slug — found through the search RPC's
+ * `crossOrgPublic` scope, the SDK's only client-side definition of
+ * "marketplace". Zero candidates, ambiguity, and transport failures all
+ * resolve to `null` (advisory affordance, never an error state).
+ */
+
+afterEach(cleanup);
+
+function serverWithHeaders(
+  org: string,
+  headers: Record<string, string>,
+): McpServer {
+  const server = samples.mcpServer({ name: "Monday", org, slug: "monday" });
+  server.spec = create(McpServerSpecSchema, {
+    serverType: {
+      case: "http",
+      value: create(HttpServerConfigSchema, {
+        url: "https://mcp.monday.com/mcp",
+        headers,
+      }),
+    },
+  });
+  return server;
+}
+
+function searchEntry(org: string) {
+  return create(SearchResultSchema, {
+    kind: ApiResourceKind.mcp_server,
+    id: `mcp-${org}`,
+    name: "Monday",
+    slug: "monday",
+    org,
+  });
+}
+
+function renderDrift(
+  server: McpServer | null,
+  register: Parameters<typeof createRouterTransport>[0],
+) {
+  const client = new Stigmer({
+    baseUrl: "/",
+    getAccessToken: () => "test-token",
+    customTransport: createRouterTransport(register),
+  });
+  const wrapper = ({ children }: { children: ReactNode }) => (
+    <StigmerContext.Provider value={client}>{children}</StigmerContext.Provider>
+  );
+  return renderHook(() => useMcpServerDefinitionDrift(server), { wrapper });
+}
+
+const STALE_HEADERS = { MONDAY_TOKEN: "${MONDAY_ACCESS_TOKEN}" };
+const FIXED_HEADERS = { Authorization: "Bearer ${MONDAY_ACCESS_TOKEN}" };
+
+describe("useMcpServerDefinitionDrift", () => {
+  it("reports drift against a single cross-org public row with the same slug", async () => {
+    const { result } = renderDrift(
+      serverWithHeaders("acme", STALE_HEADERS),
+      (router) => {
+        router.service(SearchService, {
+          search: () =>
+            create(SearchResponseSchema, {
+              entries: [searchEntry("acme"), searchEntry("stigmer")],
+            }),
+        });
+        router.service(McpServerQueryController, {
+          getByReference: () => serverWithHeaders("stigmer", FIXED_HEADERS),
+        });
+      },
+    );
+
+    await waitFor(() => expect(result.current.drift).not.toBeNull());
+    expect(result.current.drift?.changedFields).toEqual(["headers"]);
+    expect(result.current.drift?.template.metadata?.org).toBe("stigmer");
+  });
+
+  it("stays quiet when the configurations match", async () => {
+    const { result } = renderDrift(
+      serverWithHeaders("acme", FIXED_HEADERS),
+      (router) => {
+        router.service(SearchService, {
+          search: () =>
+            create(SearchResponseSchema, { entries: [searchEntry("stigmer")] }),
+        });
+        router.service(McpServerQueryController, {
+          getByReference: () => serverWithHeaders("stigmer", FIXED_HEADERS),
+        });
+      },
+    );
+
+    // Settle the async check, then confirm no drift was reported.
+    await new Promise((r) => setTimeout(r, 20));
+    await waitFor(() => expect(result.current.drift).toBeNull());
+  });
+
+  it("stays quiet when no foreign-org row shares the slug", async () => {
+    const { result } = renderDrift(
+      serverWithHeaders("acme", STALE_HEADERS),
+      (router) => {
+        router.service(SearchService, {
+          search: () =>
+            create(SearchResponseSchema, { entries: [searchEntry("acme")] }),
+        });
+      },
+    );
+
+    await new Promise((r) => setTimeout(r, 20));
+    expect(result.current.drift).toBeNull();
+  });
+
+  it("stays quiet when multiple foreign orgs share the slug (ambiguous template)", async () => {
+    const { result } = renderDrift(
+      serverWithHeaders("acme", STALE_HEADERS),
+      (router) => {
+        router.service(SearchService, {
+          search: () =>
+            create(SearchResponseSchema, {
+              entries: [searchEntry("stigmer"), searchEntry("other-org")],
+            }),
+        });
+      },
+    );
+
+    await new Promise((r) => setTimeout(r, 20));
+    expect(result.current.drift).toBeNull();
+  });
+
+  it("fails quiet when the search RPC errors", async () => {
+    const { result } = renderDrift(
+      serverWithHeaders("acme", STALE_HEADERS),
+      (router) => {
+        router.service(SearchService, {
+          search: () => {
+            throw new ConnectError("boom", Code.Unavailable);
+          },
+        });
+      },
+    );
+
+    await new Promise((r) => setTimeout(r, 20));
+    expect(result.current.drift).toBeNull();
+  });
+
+  it("skips entirely when passed null", async () => {
+    const { result } = renderDrift(null, () => {});
+    await new Promise((r) => setTimeout(r, 20));
+    expect(result.current.drift).toBeNull();
+  });
+});