@stigmer/react 3.34.0 → 3.36.0

package/src/plugin/__tests__/fixtures/hosted-marketplace.ts

@@ -1,172 +0,0 @@
-/**
- * A marketplace tree as a browser would receive it from a host: a flat
- * file map, and a `fetch` fake that answers the GitHub Trees API, raw
- * content, and jsdelivr's listing and CDN for it. Two plugins offered (one
- * with a skill, a sub-agent, an HTTP server declaring `${API_TOKEN}`, a
- * display name, an author and a logo, so a card has a face to show; one
- * MCP-only under a nested source directory with none of those), one entry
- * whose directory is missing, so a suite sees an offered list and a
- * dropped entry, the CLI's own fixture shape.
- */
-
-import type { FetchImpl } from "../../sources/types.js";
-
-/** The fixture names itself `acme-plugins`, a company's own catalogue: the shape Add source is for. */
-export const HOSTED_MARKETPLACE_NAME = "acme-plugins";
-export const HOSTED_REPO = "acme/plugins";
-export const HOSTED_COMMIT = "0123456789abcdef0123456789abcdef01234567";
-
-const encoder = new TextEncoder();
-
-function json(value: unknown): string {
-  return `${JSON.stringify(value, null, 2)}\n`;
-}
-
-/** The tree's files, path to content. */
-export function hostedMarketplaceFiles(): Map<string, string> {
-  return new Map<string, string>([
-    [
-      ".cursor-plugin/marketplace.json",
-      json({
-        name: HOSTED_MARKETPLACE_NAME,
-        metadata: { description: "A test catalogue" },
-        plugins: [
-          { name: "thermos", source: "thermos", description: "Keeps things warm." },
-          { name: "github", source: "third_party/github" },
-          { name: "ghost", source: "ghost", description: "Listed, not present." },
-        ],
-      }),
-    ],
-    [
-      "thermos/.cursor-plugin/plugin.json",
-      json({
-        name: "thermos",
-        displayName: "Thermos",
-        version: "1.0.0",
-        description: "The thermos plugin.",
-        author: { name: "Acme" },
-        logo: "assets/logo.png",
-        skills: "./skills/",
-        agents: "./agents/",
-        mcpServers: "./mcp.json",
-        variables: {
-          type: "object",
-          properties: { API_TOKEN: { type: "string", title: "API token" } },
-          required: ["API_TOKEN"],
-        },
-      }),
-    ],
-    [
-      "thermos/mcp.json",
-      json({
-        mcpServers: {
-          warmth: { type: "http", url: "https://warmth.example.com/mcp", headers: { Authorization: "Bearer ${API_TOKEN}" } },
-        },
-      }),
-    ],
-    ["thermos/skills/keep-warm/SKILL.md", "---\nname: keep-warm\ndescription: Keep it warm\n---\n# Keep warm\n\nInstructions.\n"],
-    ["thermos/agents/checker.md", "---\nname: checker\ndescription: Checks temperature\n---\nYou check the temperature carefully and report.\n"],
-    ["thermos/assets/logo.png", "not really a png, but listed and sized like one"],
-    ["thermos/.gitignore", "*.log\n"],
-    ["thermos/debug.log", "excluded by the tree's own .gitignore"],
-    [
-      "third_party/github/.cursor-plugin/plugin.json",
-      json({ name: "github", version: "2.0.0", description: "GitHub tools.", mcpServers: "./mcp.json" }),
-    ],
-    [
-      "third_party/github/mcp.json",
-      json({ mcpServers: { github: { type: "http", url: "https://api.githubcopilot.com/mcp/" } } }),
-    ],
-    ["README.md", "# Plugins\n"],
-  ]);
-}
-
-export interface HostedFetchOptions {
-  /** Report the GitHub listing as truncated. */
-  readonly truncated?: boolean;
-  /** Answer the listing with this status instead of 200. */
-  readonly listingStatus?: number;
-  /** Serve this many fewer bytes than declared for the named path. */
-  readonly shortRead?: string;
-  /** The published version jsdelivr knows; others answer 404. */
-  readonly publishedVersion?: string;
-}
-
-/** Every request the fake answered, in order, for assertions on budget and conditionality. */
-export interface RecordedRequest {
-  readonly url: string;
-  readonly ifNoneMatch: string | null;
-}
-
-/** A `fetch` for the hosted tree. */
-export function hostedFetch(
-  files: Map<string, string> = hostedMarketplaceFiles(),
-  options: HostedFetchOptions = {},
-): { fetchImpl: FetchImpl; requests: RecordedRequest[] } {
-  const requests: RecordedRequest[] = [];
-  const etag = `"tree-${HOSTED_COMMIT.slice(0, 8)}"`;
-
-  const fetchImpl: FetchImpl = async (input, init) => {
-    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-    const headers = new Headers(init?.headers);
-    requests.push({ url, ifNoneMatch: headers.get("if-none-match") });
-
-    // GitHub Trees API
-    const trees = /^https:\/\/api\.github\.com\/repos\/([^/]+\/[^/]+)\/git\/trees\/([^?]+)\?recursive=1$/.exec(url);
-    if (trees) {
-      if (options.listingStatus !== undefined) return new Response("{}", { status: options.listingStatus });
-      if (trees[1] !== HOSTED_REPO) return new Response("{}", { status: 404 });
-      if (headers.get("if-none-match") === etag) return new Response(null, { status: 304, headers: { etag } });
-      return new Response(
-        JSON.stringify({
-          sha: HOSTED_COMMIT,
-          truncated: options.truncated ?? false,
-          tree: [
-            { path: "thermos", type: "tree" },
-            ...[...files.entries()].map(([path, content]) => ({
-              path,
-              type: "blob",
-              size: encoder.encode(content).length,
-            })),
-          ],
-        }),
-        { status: 200, headers: { etag, "content-type": "application/json" } },
-      );
-    }
-
-    // GitHub raw
-    const raw = /^https:\/\/raw\.githubusercontent\.com\/([^/]+\/[^/]+)\/([0-9a-f]{40})\/(.+)$/.exec(url);
-    if (raw) {
-      const path = decodeURIComponent(raw[3] ?? "");
-      const content = files.get(path);
-      if (raw[2] !== HOSTED_COMMIT || content === undefined) return new Response("Not Found", { status: 404 });
-      const bytes = encoder.encode(content);
-      return new Response(options.shortRead === path ? bytes.slice(0, -1) : bytes, { status: 200 });
-    }
-
-    // jsdelivr listing
-    const listing = /^https:\/\/data\.jsdelivr\.com\/v1\/package\/npm\/@stigmer\/plugins@([^/]+)\/flat$/.exec(url);
-    if (listing) {
-      if (listing[1] !== options.publishedVersion) return new Response("{}", { status: 404 });
-      return new Response(
-        JSON.stringify({
-          files: [...files.entries()].map(([path, content]) => ({ name: `/${path}`, size: encoder.encode(content).length })),
-        }),
-        { status: 200 },
-      );
-    }
-
-    // jsdelivr CDN
-    const cdn = /^https:\/\/cdn\.jsdelivr\.net\/npm\/@stigmer\/plugins@([^/]+)\/(.+)$/.exec(url);
-    if (cdn) {
-      const path = decodeURIComponent(cdn[2] ?? "");
-      const content = files.get(path);
-      if (cdn[1] !== options.publishedVersion || content === undefined) return new Response("Not Found", { status: 404 });
-      return new Response(encoder.encode(content), { status: 200 });
-    }
-
-    return new Response("unexpected request", { status: 500 });
-  };
-
-  return { fetchImpl, requests };
-}

package/src/plugin/__tests__/local.test.ts

@@ -1,118 +0,0 @@
-/**
- * The upload path against the CLI's digest. Pins: a folder handed over as
- * browser `File`s prepares to the digest `stigmer push plugin` prints for
- * the same folder (the parity constant recorded in the library's own
- * tripwire); an `<input webkitdirectory>` pick is re-rooted under the picked
- * folder's name; a zip of a folder is re-rooted and says so in its origin;
- * directory entries and macOS resource forks inside a zip are not files; a
- * file that is not a zip, an empty pick and a folder the reader refuses each
- * get their own refusal; the origin an upload carries is `upload`.
- */
-
-import { readdirSync, readFileSync, statSync } from "node:fs";
-import { resolve } from "node:path";
-
-import { zipSync } from "fflate";
-import { describe, expect, it } from "vitest";
-
-import { LocalPluginError, folderPick, folderPickFromInput, prepareLocalPlugin, zipPick } from "../sources/local.js";
-import { PluginReadRefusal } from "../sources/read.js";
-
-// Resolved from the package root (vitest's cwd), not import.meta.url: happy-dom
-// rewrites module URLs to a non-file scheme.
-const THERMOS = `${resolve(process.cwd(), "../../backend/libs/ts/plugin-package/src/__tests__/fixtures/cursor-plugins/thermos")}/`;
-/** The CLI's digest for the thermos fixture (backend/libs/ts/plugin-package/src/__tests__/client-select-archive.test.ts). */
-const THERMOS_DIGEST = "51bc4e5450e24762bb8515765c76bfe262f65c57f9afeda015c5818038396d5a";
-
-/** Every file under `root` as `{ path, file }`, the shape a dropped folder is walked into. */
-function filesOf(root: string): { path: string; file: File }[] {
-  const out: { path: string; file: File }[] = [];
-  const walk = (dir: string, prefix: string): void => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const path = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
-      const full = `${dir}/${entry.name}`;
-      if (entry.isDirectory()) walk(full, path);
-      else if (entry.isFile() && statSync(full).isFile()) {
-        out.push({ path, file: new File([blobPart(readFileSync(full))], entry.name) });
-      }
-    }
-  };
-  walk(root, "");
-  return out;
-}
-
-/** `File` wants an ArrayBuffer-backed view; a Node `Buffer` slice may share a pool, so copy. */
-function blobPart(bytes: Uint8Array): Uint8Array<ArrayBuffer> {
-  return new Uint8Array(bytes);
-}
-
-/** A `File` as an `<input webkitdirectory>` yields it: named under the picked folder. */
-function inputFile(relativePath: string, bytes: Uint8Array): File {
-  const file = new File([blobPart(bytes)], relativePath.split("/").pop() ?? relativePath);
-  Object.defineProperty(file, "webkitRelativePath", { value: relativePath });
-  return file;
-}
-
-describe("a dropped folder", () => {
-  it("prepares to the CLI's digest and carries an upload origin", async () => {
-    const prepared = await prepareLocalPlugin(folderPick("thermos", filesOf(THERMOS)));
-    expect(prepared.digest).toBe(THERMOS_DIGEST);
-    expect(prepared.plugin.name).toBe("thermos");
-    expect(prepared.origin).toEqual({ kind: "upload", pick: "folder", name: "thermos" });
-  });
-
-  it("refuses an empty folder in its own words", () => {
-    expect(() => folderPick("empty", [])).toThrow(LocalPluginError);
-  });
-
-  it("returns the reader's refusal, every sentence, for a folder that is not a plugin", async () => {
-    const pick = folderPick("notes", [{ path: "README.md", file: new File(["hello"], "README.md") }]);
-    const refusal = await prepareLocalPlugin(pick).catch((e: unknown) => e);
-    expect(refusal).toBeInstanceOf(PluginReadRefusal);
-    expect((refusal as PluginReadRefusal).subject).toBe("'notes' cannot be installed");
-  });
-});
-
-describe("an <input webkitdirectory> pick", () => {
-  it("strips the picked folder's own name so the manifest is at the root", async () => {
-    const pick = folderPickFromInput(
-      filesOf(THERMOS).map(({ path }) => inputFile(`my-thermos/${path}`, new Uint8Array(readFileSync(`${THERMOS}${path}`)))),
-    );
-    expect(pick.name).toBe("my-thermos");
-    expect(pick.candidates.map((c) => c.path)).toContain(".cursor-plugin/plugin.json");
-    expect((await prepareLocalPlugin(pick)).digest).toBe(THERMOS_DIGEST);
-  });
-});
-
-describe("a zip", () => {
-  function zipOf(files: Record<string, Uint8Array>, name = "plugin.zip"): File {
-    return new File([blobPart(zipSync(files))], name);
-  }
-
-  function thermosEntries(prefix: string): Record<string, Uint8Array> {
-    return Object.fromEntries(
-      filesOf(THERMOS).map(({ path }) => [`${prefix}${path}`, new Uint8Array(readFileSync(`${THERMOS}${path}`))]),
-    );
-  }
-
-  it("of a folder is re-rooted, prepares to the CLI's digest, and its origin says so", async () => {
-    const pick = await zipPick(zipOf({ ...thermosEntries("thermos/"), "__MACOSX/thermos/._plugin.json": new Uint8Array(4) }));
-    expect(pick.rerooted).toBe("thermos");
-    const prepared = await prepareLocalPlugin(pick);
-    expect(prepared.digest).toBe(THERMOS_DIGEST);
-    expect(prepared.origin).toEqual({ kind: "upload", pick: "zip", name: "plugin.zip", rerooted: "thermos" });
-  });
-
-  it("already rooted is taken as it is", async () => {
-    const pick = await zipPick(zipOf(thermosEntries("")));
-    expect(pick.rerooted).toBeUndefined();
-    expect((await prepareLocalPlugin(pick)).digest).toBe(THERMOS_DIGEST);
-  });
-
-  it("that is not a zip, or holds no files, is refused in its own words", async () => {
-    await expect(zipPick(new File([blobPart(new TextEncoder().encode("plain text"))], "plugin.zip"))).rejects.toMatchObject({
-      reason: "not-a-zip",
-    });
-    await expect(zipPick(zipOf({ "only/": new Uint8Array(0) }))).rejects.toMatchObject({ reason: "empty" });
-  });
-});

package/src/plugin/__tests__/sources.test.ts

@@ -1,185 +0,0 @@
-/**
- * The marketplace sources a browser reads, against a fetch fake. Pins: a
- * GitHub tree is listed once and read at the resolved commit; a second
- * listing is conditional and a 304 reuses the cache; the marketplace file
- * is the only file fetched to read a catalogue; an entry is selected by
- * the tree's own `.gitignore` and only the selected files are fetched (an
- * ignored file's bytes never cross the wire); the prepared digest equals
- * the CLI's digest for the same files, now through the one preparation the
- * CLI runs (the parity the whole design rests on); a truncated listing, a private repository, a short
- * read and an over-budget entry are refused with their sentences; the
- * official catalogue refuses a development server and reads a published
- * version; a tree names a file by the URL a browser loads it from, and a
- * source's mark is its publisher's GitHub avatar under one rule.
- */
-
-import { afterEach, describe, expect, it } from "vitest";
-import { archivePlugin, digestArchive, selectPluginFiles } from "@stigmer/plugin-package/client";
-
-import { githubAvatarUrl, githubOwner, openGitHubTree, resetGitHubListingCache } from "../sources/github.js";
-import { OFFICIAL_PUBLISHER, openOfficialTree } from "../sources/official.js";
-import { PluginReadRefusal, findEntry, openMarketplace, prepareEntry } from "../sources/read.js";
-import { MARKETPLACE_TREE_LIMITS, MarketplaceSourceError } from "../sources/types.js";
-import { HOSTED_COMMIT, HOSTED_REPO, hostedFetch, hostedMarketplaceFiles } from "./fixtures/hosted-marketplace.js";
-
-const SOURCE = { type: "github", repo: HOSTED_REPO } as const;
-const encoder = new TextEncoder();
-
-afterEach(() => resetGitHubListingCache());
-
-describe("openGitHubTree", () => {
-  it("lists the tree once and describes it by the resolved commit", async () => {
-    const { fetchImpl, requests } = hostedFetch();
-    const tree = await openGitHubTree(SOURCE, fetchImpl);
-    expect(tree.describe).toBe(`github.com/${HOSTED_REPO} (${HOSTED_COMMIT.slice(0, 7)})`);
-    expect(tree.files.map((f) => f.path)).toContain("thermos/mcp.json");
-    expect(tree.files.map((f) => f.path)).not.toContain("thermos"); // directories are not files
-    expect(requests).toHaveLength(1);
-  });
-
-  it("re-asks conditionally and a 304 reuses the cached listing", async () => {
-    const { fetchImpl, requests } = hostedFetch();
-    await openGitHubTree(SOURCE, fetchImpl);
-    const again = await openGitHubTree(SOURCE, fetchImpl);
-    expect(requests[1]?.ifNoneMatch).toBe(`"tree-${HOSTED_COMMIT.slice(0, 8)}"`);
-    expect(again.files.length).toBeGreaterThan(0);
-  });
-
-  it("reads a file at the commit and refuses a body of another length", async () => {
-    const { fetchImpl } = hostedFetch(undefined, { shortRead: "README.md" });
-    const tree = await openGitHubTree(SOURCE, fetchImpl);
-    expect(new TextDecoder().decode(await tree.fetchFile("thermos/.gitignore"))).toBe("*.log\n");
-    await expect(tree.fetchFile("README.md")).rejects.toMatchObject({ reason: "refused" });
-  });
-
-  it("refuses a truncated listing and a repository GitHub does not have", async () => {
-    await expect(openGitHubTree(SOURCE, hostedFetch(undefined, { truncated: true }).fetchImpl)).rejects.toMatchObject({
-      reason: "too-large",
-    });
-    await expect(openGitHubTree({ type: "github", repo: "acme/private" }, hostedFetch().fetchImpl)).rejects.toMatchObject({
-      reason: "not-found",
-    });
-    const limited = await openGitHubTree(SOURCE, hostedFetch(undefined, { listingStatus: 403 }).fetchImpl).catch((e: unknown) => e);
-    expect(limited).toBeInstanceOf(MarketplaceSourceError);
-    expect((limited as Error).message).toContain("rate-limiting");
-  });
-});
-
-describe("openMarketplace", () => {
-  it("fetches only the marketplace file and reads the catalogue with its dropped entries", async () => {
-    const { fetchImpl, requests } = hostedFetch();
-    const opened = await openMarketplace(await openGitHubTree(SOURCE, fetchImpl));
-    expect(opened.marketplace.name).toBe("acme-plugins");
-    expect(opened.marketplace.plugins.map((p) => p.name)).toEqual(["thermos", "github"]);
-    expect(opened.warnings.map((w) => w.subject)).toEqual(["ghost"]);
-    const rawReads = requests.filter((r) => r.url.includes("raw.githubusercontent.com"));
-    expect(rawReads.map((r) => r.url.split(`${HOSTED_COMMIT}/`)[1])).toEqual([".cursor-plugin/marketplace.json"]);
-  });
-
-  it("refuses a tree with no marketplace file, quoting the library's sentence", async () => {
-    const files = hostedMarketplaceFiles();
-    files.delete(".cursor-plugin/marketplace.json");
-    const { fetchImpl } = hostedFetch(files);
-    const refusal = await openMarketplace(await openGitHubTree(SOURCE, fetchImpl)).catch((e: unknown) => e);
-    expect(refusal).toBeInstanceOf(PluginReadRefusal);
-    expect((refusal as PluginReadRefusal).errors.map((e) => e.kind)).toEqual(["marketplace-not-found"]);
-  });
-});
-
-describe("prepareEntry", () => {
-  it("fetches only the entry's selected files, applies its .gitignore, and arrives at the shared module's digest", async () => {
-    const files = hostedMarketplaceFiles();
-    const { fetchImpl, requests } = hostedFetch(files);
-    const opened = await openMarketplace(await openGitHubTree(SOURCE, fetchImpl));
-    const prepared = await prepareEntry(opened, findEntry(opened.marketplace, "thermos")!);
-
-    expect(prepared.plugin.name).toBe("thermos");
-    expect(prepared.plugin.skills.map((s) => s.name)).toEqual(["keep-warm"]);
-    expect(prepared.plugin.subAgents.map((a) => a.name)).toEqual(["checker"]);
-    expect(prepared.plugin.variables.map((v) => v.name)).toEqual(["API_TOKEN"]);
-    expect(prepared.stats.filesIgnored).toBe(1); // debug.log, by the tree's own .gitignore
-
-    // Only thermos/** was fetched for the install (plus the one marketplace file before it),
-    // and within it the .gitignore plus the selected files: the ignored debug.log never moved.
-    const fetched = requests
-      .filter((r) => r.url.includes("raw.githubusercontent.com"))
-      .map((r) => r.url.split(`${HOSTED_COMMIT}/`)[1] ?? "");
-    expect(fetched.filter((p) => !p.startsWith("thermos/"))).toEqual([".cursor-plugin/marketplace.json"]);
-    expect(fetched).not.toContain("thermos/debug.log");
-    expect(fetched).toContain("thermos/.gitignore");
-
-    // Parity: the same files through the client module directly yield the same digest.
-    const entryFiles = [...files.entries()]
-      .filter(([path]) => path.startsWith("thermos/"))
-      .map(([path, content]) => [path.slice("thermos/".length), encoder.encode(content)] as const);
-    const bytes = new Map(entryFiles);
-    const selection = selectPluginFiles(
-      entryFiles.map(([path, content]) => ({ path, size: content.length })),
-      (path) => bytes.get(path)!,
-      { respectGitignore: true },
-    );
-    expect(prepared.digest).toBe(await digestArchive(archivePlugin(selection.files)));
-  });
-
-  it("prepares an entry at the tree root when the marketplace names it", async () => {
-    const files = hostedMarketplaceFiles();
-    const { fetchImpl } = hostedFetch(files);
-    const opened = await openMarketplace(await openGitHubTree(SOURCE, fetchImpl));
-    const prepared = await prepareEntry(opened, findEntry(opened.marketplace, "github")!);
-    expect(prepared.plugin.mcpServers.map((s) => s.name)).toEqual(["github"]);
-    expect(prepared.plugin.skills).toEqual([]);
-  });
-
-  it("refuses an entry over the byte budget before fetching a file", async () => {
-    const files = hostedMarketplaceFiles();
-    const { fetchImpl, requests } = hostedFetch(files);
-    const opened = await openMarketplace(await openGitHubTree(SOURCE, fetchImpl));
-    const huge = { ...opened, tree: { ...opened.tree, files: opened.tree.files.map((f) => (f.path === "thermos/mcp.json" ? { ...f, size: MARKETPLACE_TREE_LIMITS.pluginBytes + 1 } : f)) } };
-    const before = requests.length;
-    await expect(prepareEntry(huge, findEntry(opened.marketplace, "thermos")!)).rejects.toMatchObject({ reason: "too-large" });
-    expect(requests.length).toBe(before);
-  });
-
-  it("refuses a plugin the library refuses, with every sentence", async () => {
-    const files = hostedMarketplaceFiles();
-    files.set("thermos/.cursor-plugin/plugin.json", JSON.stringify({ name: "Not Valid!" }));
-    const { fetchImpl } = hostedFetch(files);
-    const opened = await openMarketplace(await openGitHubTree(SOURCE, fetchImpl));
-    const refusal = await prepareEntry(opened, findEntry(opened.marketplace, "thermos")!).catch((e: unknown) => e);
-    expect(refusal).toBeInstanceOf(PluginReadRefusal);
-    expect((refusal as PluginReadRefusal).subject).toBe("'thermos' cannot be installed");
-    expect((refusal as PluginReadRefusal).errors.length).toBeGreaterThan(0);
-  });
-});
-
-describe("openOfficialTree", () => {
-  it("refuses a development server in one sentence and reads a published version", async () => {
-    const { fetchImpl } = hostedFetch(undefined, { publishedVersion: "3.17.0" });
-    await expect(openOfficialTree("0.0.0-dev", fetchImpl)).rejects.toMatchObject({ reason: "unavailable-on-dev-server" });
-    // The bare stamp an unbundled server reports (the cloud composition before it stated its release).
-    await expect(openOfficialTree("dev", fetchImpl)).rejects.toMatchObject({ reason: "unavailable-on-dev-server" });
-    // A pre-release IS published (under `next`); the old `X.Y.Z`-only test called it a dev build.
-    await expect(openOfficialTree("3.17.0-rc.1", fetchImpl)).rejects.toMatchObject({ reason: "not-found" });
-    await expect(openOfficialTree("3.16.0", fetchImpl)).rejects.toMatchObject({ reason: "not-found" });
-    const tree = await openOfficialTree("3.17.0", fetchImpl);
-    expect(tree.describe).toBe("@stigmer/plugins@3.17.0");
-    const opened = await openMarketplace(tree);
-    expect(opened.marketplace.plugins.map((p) => p.name)).toEqual(["thermos", "github"]);
-  });
-});
-
-describe("a tree names its files by URL, and a source by its publisher's avatar", () => {
-  it("a GitHub tree's URL is the raw file at the resolved commit; the official one the CDN file at the version", async () => {
-    const github = await openGitHubTree(SOURCE, hostedFetch().fetchImpl);
-    expect(github.fileUrl("thermos/assets/logo.png")).toBe(
-      `https://raw.githubusercontent.com/${HOSTED_REPO}/${HOSTED_COMMIT}/thermos/assets/logo.png`,
-    );
-    const official = await openOfficialTree("3.17.0", hostedFetch(undefined, { publishedVersion: "3.17.0" }).fetchImpl);
-    expect(official.fileUrl("assistant/icon.svg")).toBe("https://cdn.jsdelivr.net/npm/@stigmer/plugins@3.17.0/assistant/icon.svg");
-  });
-
-  it("every source's mark is its publishing account's GitHub avatar, the official catalogue's included", () => {
-    expect(githubAvatarUrl(githubOwner("cursor/plugins"))).toBe("https://github.com/cursor.png?size=64");
-    expect(githubAvatarUrl(OFFICIAL_PUBLISHER, 32)).toBe("https://github.com/stigmer.png?size=32");
-  });
-});

package/src/plugin/__tests__/useAddToolsToAgent.test.tsx

@@ -1,105 +0,0 @@
-/**
- * Adding a plugin's servers to an agent, against an in-memory Connect
- * backend. Pins: the pick is fetched and an agent a plugin installed is
- * refused before any update, in the `managed` phase, from its
- * `stigmer.ai/plugin` label; a plain agent is updated with the servers it
- * did not already list appended after the ones it had, and the count of
- * what was added is what the dialog says; a refused update returns the
- * flow to `ready` with the error held.
- */
-
-import { afterEach, describe, expect, it } from "vitest";
-import { act, cleanup, renderHook, waitFor } from "@testing-library/react";
-import type { ReactNode } from "react";
-import { create } from "@bufbuild/protobuf";
-import { Code, ConnectError, createRouterTransport } from "@connectrpc/connect";
-import { Stigmer } from "@stigmer/sdk";
-import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
-import { AgentQueryController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/query_pb";
-import { type Agent, AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentSpecSchema, McpServerUsageSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
-import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
-import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-
-import { StigmerContext } from "../../context.js";
-import { useAddToolsToAgent } from "../useAddToolsToAgent.js";
-
-afterEach(cleanup);
-
-const ORG = "acme";
-const SERVERS = [
-  { ref: { org: ORG, slug: "linear" }, name: "Linear" },
-  { ref: { org: ORG, slug: "notion" }, name: "Notion" },
-];
-
-function agent(slug: string, labels: Record<string, string>, listed: readonly string[]): Agent {
-  return create(AgentSchema, {
-    metadata: create(ApiResourceMetadataSchema, { id: `agt_${slug}`, org: ORG, slug, name: slug, labels }),
-    spec: create(AgentSpecSchema, {
-      instructions: "help",
-      mcpServerUsages: listed.map((s) => create(McpServerUsageSchema, { mcpServerRef: create(ApiResourceReferenceSchema, { org: ORG, slug: s }) })),
-    }),
-  });
-}
-
-function setup(agents: Record<string, Agent>, refuseUpdate = false) {
-  const updates: Agent[] = [];
-  const transport = createRouterTransport(({ service }) => {
-    service(AgentQueryController, {
-      getByReference: (ref) => {
-        const found = agents[ref.slug];
-        if (!found) throw new ConnectError("no agent", Code.NotFound);
-        return found;
-      },
-    });
-    service(AgentCommandController, {
-      update: (req) => {
-        if (refuseUpdate) throw new ConnectError("agent 'reviewer' is managed by plugin 'toolbox'", Code.FailedPrecondition);
-        updates.push(req);
-        return req;
-      },
-    });
-  });
-  const client = new Stigmer({ baseUrl: "/", getAccessToken: () => "t", customTransport: transport });
-  const wrapper = ({ children }: { children: ReactNode }) => <StigmerContext.Provider value={client}>{children}</StigmerContext.Provider>;
-  const hook = renderHook(() => useAddToolsToAgent(SERVERS), { wrapper });
-  return { hook, updates };
-}
-
-describe("useAddToolsToAgent", () => {
-  it("refuses an agent a plugin installed before any update, from its label", async () => {
-    const { hook, updates } = setup({ assistant: agent("assistant", { "stigmer.ai/plugin": "plg_1" }, []) });
-    act(() => hook.result.current.pick({ org: ORG, slug: "assistant" }));
-    await waitFor(() => expect(hook.result.current.phase.status).toBe("managed"));
-    expect(await hook.result.current.add()).toBe(0);
-    expect(updates).toEqual([]);
-  });
-
-  it("appends the servers the agent does not list, after the ones it has, and counts them", async () => {
-    const { hook, updates } = setup({ reviewer: agent("reviewer", {}, ["notion"]) });
-    act(() => hook.result.current.pick({ org: ORG, slug: "reviewer" }));
-    await waitFor(() => expect(hook.result.current.phase.status).toBe("ready"));
-    expect(hook.result.current.phase).toMatchObject({ alreadyListed: ["Notion"] });
-
-    let added = 0;
-    await act(async () => {
-      added = await hook.result.current.add();
-    });
-    expect(added).toBe(1);
-    expect(hook.result.current.phase).toMatchObject({ status: "added", addedCount: 1 });
-    expect(updates).toHaveLength(1);
-    expect(updates[0]?.spec?.mcpServerUsages.map((u) => u.mcpServerRef?.slug)).toEqual(["notion", "linear"]);
-    expect(updates[0]?.spec?.instructions).toBe("help");
-  });
-
-  it("holds a refused update as the error and returns to ready", async () => {
-    const { hook } = setup({ reviewer: agent("reviewer", {}, []) }, true);
-    act(() => hook.result.current.pick({ org: ORG, slug: "reviewer" }));
-    await waitFor(() => expect(hook.result.current.phase.status).toBe("ready"));
-    await act(async () => {
-      await expect(hook.result.current.add()).rejects.toThrow(/managed by plugin/);
-    });
-    expect(hook.result.current.phase.status).toBe("ready");
-    expect(hook.result.current.error?.message).toMatch(/managed by plugin/);
-  });
-});