cue-ai 0.9.0 → 0.9.2

package/src/lib/plugin-discovery.ts

@@ -0,0 +1,126 @@
+/**
+ * Discover Claude Code plugins installed on this machine, independent of the
+ * active cue profile. Reads Claude Code's real plugin store:
+ *
+ *   <claude-home>/plugins/installed_plugins.json   — the install registry
+ *   <claude-home>/settings.json → enabledPlugins   — the on/off map
+ *
+ * and enriches each entry with its plugin.json description + bundled-skill
+ * count when the install path is present on disk.
+ *
+ * This backs the studio Plugins page's "all installed" view, which is a
+ * superset of the profile's declared `plugins:` (that list is a curated
+ * subset cue wires into one profile). claude-home defaults to ~/.claude;
+ * override with CUE_CLAUDE_HOME for tests or a non-standard install.
+ */
+
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export interface DiscoveredPlugin {
+  /** "name@marketplace" — the id Claude Code keys plugins by. */
+  id: string;
+  name: string;
+  marketplace: string;
+  version: string;
+  /** settings.enabledPlugins[id] === true */
+  enabled: boolean;
+  /** appears anywhere in the enabledPlugins map (known to Claude Code). */
+  known: boolean;
+  installedAt: string | null;
+  installPath: string | null;
+  /** From the plugin's .claude-plugin/plugin.json, capped. */
+  description: string;
+  /** Skills the plugin bundles (SKILL.md count under its install path). */
+  skills: number;
+}
+
+function claudeHome(): string {
+  return process.env.CUE_CLAUDE_HOME ?? join(homedir(), ".claude");
+}
+
+function readJson<T>(path: string): T | null {
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as T;
+  } catch {
+    return null;
+  }
+}
+
+/** Skills live at <installPath>/skills/<name>/SKILL.md in the plugin layout. */
+function countSkills(installPath: string): number {
+  const skillsDir = join(installPath, "skills");
+  if (!existsSync(skillsDir)) return 0;
+  try {
+    return readdirSync(skillsDir, { withFileTypes: true }).filter(
+      (d) => d.isDirectory() && existsSync(join(skillsDir, d.name, "SKILL.md")),
+    ).length;
+  } catch {
+    return 0;
+  }
+}
+
+function manifestDescription(installPath: string): string {
+  const m = readJson<{ description?: string }>(
+    join(installPath, ".claude-plugin", "plugin.json"),
+  );
+  return (m?.description ?? "").slice(0, 200);
+}
+
+interface InstalledEntry {
+  version?: string;
+  installPath?: string;
+  installedAt?: string;
+}
+
+/**
+ * Enumerate every plugin Claude Code knows about on this machine, enabled or
+ * not. Returns enabled-first, then alphabetical. Missing files degrade to an
+ * empty list rather than throwing — the dashboard must render even on a fresh
+ * machine with no plugins.
+ */
+export function discoverInstalledPlugins(): DiscoveredPlugin[] {
+  const home = claudeHome();
+  const installed = readJson<{ plugins: Record<string, InstalledEntry[]> }>(
+    join(home, "plugins", "installed_plugins.json"),
+  );
+  const settings = readJson<{ enabledPlugins?: Record<string, boolean> }>(
+    join(home, "settings.json"),
+  );
+  const enabledMap = settings?.enabledPlugins ?? {};
+  const installedMap = installed?.plugins ?? {};
+
+  // Union: a plugin can be installed-but-not-in-the-map, or in the map but
+  // its install cache pruned. Show both so nothing silently disappears.
+  const ids = new Set<string>([
+    ...Object.keys(installedMap),
+    ...Object.keys(enabledMap),
+  ]);
+
+  const out: DiscoveredPlugin[] = [];
+  for (const id of ids) {
+    const at = id.lastIndexOf("@");
+    const name = at > 0 ? id.slice(0, at) : id;
+    const marketplace = at > 0 ? id.slice(at + 1) : "";
+    const entry = installedMap[id]?.[0];
+    const installPath = entry?.installPath ?? null;
+    const onDisk = installPath != null && existsSync(installPath);
+    out.push({
+      id,
+      name,
+      marketplace,
+      version: entry?.version ?? "unknown",
+      enabled: enabledMap[id] === true,
+      known: id in enabledMap,
+      installedAt: entry?.installedAt ?? null,
+      installPath,
+      description: onDisk ? manifestDescription(installPath) : "",
+      skills: onDisk ? countSkills(installPath) : 0,
+    });
+  }
+
+  return out.sort(
+    (a, b) => Number(b.enabled) - Number(a.enabled) || a.id.localeCompare(b.id),
+  );
+}

package/src/lib/pr-poster.ts

@@ -23,7 +23,7 @@ import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { mkdtempSync, writeFileSync, readFileSync, rmSync, existsSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join, dirname } from "node:path";
+import { join, } from "node:path";
 
 /**
  * Build a deterministic branch name keyed by today's date + a hash of the

package/src/lib/pr-throttle.ts

@@ -14,13 +14,9 @@
 
 import { mkdirSync, readFileSync, writeFileSync, existsSync, renameSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { homedir } from "node:os";
+import { cacheDir } from "./config-paths";
 
-const DEFAULT_PATH = join(
-  process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache"),
-  "cue",
-  "pr-opened.json",
-);
+const DEFAULT_PATH = join(cacheDir(), "pr-opened.json");
 
 export const DEFAULT_COOLDOWN_DAYS = 90;
 export const DAILY_CAP = 25;

package/src/lib/profile-linter.test.ts

@@ -140,9 +140,38 @@ describe("lintProfile", () => {
     expect(result.checks.map((check) => check.name)).toContain("MCPs");
   });
 
+  test("demotes a local-only MCP (source dir present, absent from sanitized registry) to W9, not E3", async () => {
+    // An MCP with a source manifest dir but no sanitized-registry entry is a
+    // private/local-only server (wired into the user's own ~/.claude.json), not
+    // a dangling reference — warn (W9), like W5 demotes an uninstalled plugin.
+    await mkdir(join(root, "mcps", "mcps", "envoult"), { recursive: true });
+    await writeFile(join(root, "mcps", "mcps", "envoult", "skills.md"), "# envoult\n", "utf8");
+    await writeProfile(
+      "priv",
+      ["name: priv", "description: private mcp profile", "mcps: [envoult]", ""].join("\n"),
+    );
+
+    const result = await lintProfile("priv", opts());
+
+    expect(rules(result).filter((rule) => rule === "W9")).toHaveLength(1);
+    expect(rules(result).filter((rule) => rule === "E3")).toHaveLength(0);
+  });
+
+  test("still reports E3 for an MCP with neither a registry entry nor a source dir", async () => {
+    await writeProfile(
+      "dangling",
+      ["name: dangling", "description: dangling mcp ref", "mcps: [no-such-mcp]", ""].join("\n"),
+    );
+
+    const result = await lintProfile("dangling", opts());
+
+    expect(rules(result).filter((rule) => rule === "E3")).toHaveLength(1);
+    expect(rules(result).filter((rule) => rule === "W9")).toHaveLength(0);
+  });
+
   test("reports W1, W2, W3, and W4 warnings", async () => {
     const localRefs: string[] = [];
-    for (let i = 0; i < 41; i++) {
+    for (let i = 0; i < 121; i++) {
       const ref = `bulk/skill-${i}`;
       localRefs.push(ref);
       await writeLocalSkill(ref);
@@ -237,6 +266,43 @@ describe("lintProfile", () => {
     expect(messages).toContain("MCP");
     expect(hasLintErrors(result)).toBe(true);
   });
+
+  test("offline mode skips uncached npx skills instead of erroring", async () => {
+    await writeProfile(
+      "npxoffline",
+      [
+        "name: npxoffline",
+        "description: npx offline test",
+        "skills:",
+        "  npx:",
+        "    - repo: anthropics/skills",
+        "      skills: [ghost-uncached]",
+        "",
+      ].join("\n"),
+    );
+
+    let fetched = false;
+    const trackingFetch = async () => {
+      fetched = true;
+    };
+
+    // Offline (the validate default): an uncached npx skill is a benign skip,
+    // not an E3, and the network fetcher is never invoked.
+    const offline = await lintProfile(
+      "npxoffline",
+      opts({ npxOffline: true, npxFetch: trackingFetch }),
+    );
+    expect(fetched).toBe(false);
+    expect(rules(offline).filter((rule) => rule === "E3")).toHaveLength(0);
+    const npxCheck = offline.checks.find((check) => check.name === "npx skills");
+    expect(npxCheck?.message).toContain("not cached (offline");
+    expect(hasLintErrors(offline)).toBe(false);
+
+    // Online (--online): the fetcher IS invoked, preserving fetchability checks.
+    fetched = false;
+    await lintProfile("npxoffline", opts({ npxOffline: false, npxFetch: trackingFetch }));
+    expect(fetched).toBe(true);
+  });
 });
 
 describe("lintAllProfiles", () => {

package/src/lib/profile-linter.ts

@@ -4,7 +4,7 @@
  * The rules below are intentionally numbered and centralized so a later
  * suppression pass can key off stable ids such as `# lint: ignore W1`.
  *
- * W1: profile declares more than 40 skills.
+ * W1: profile declares more than 120 skills.
  * W2: profile declares more than 5 MCP servers.
  * W3: inheritance chain depth is greater than 2.
  * W4: a skill slug appears in both `skills.local` and `skills.npx`.
@@ -18,7 +18,7 @@
  */
 
 import { mkdir, mkdtemp, readdir, readFile, rm } from "node:fs/promises";
-import type { Dirent } from "node:fs";
+import { existsSync, type Dirent } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -36,7 +36,7 @@ import {
   SchemaViolation,
 } from "../../profiles/_types";
 import { listProfiles, loadProfile } from "./profile-loader";
-import { materializeMcp, type MaterializeOptions } from "./mcp-materializer";
+import { materializeMcp, McpNotFound, type MaterializeOptions } from "./mcp-materializer";
 import { resolveLocal } from "./resolver-local";
 import {
   NpxFetchFailed,
@@ -57,7 +57,7 @@ const DEFAULT_HOOKS_ROOT = join(REPO_ROOT, "resources", "hooks");
 const DEFAULT_SUBAGENTS_ROOT = join(REPO_ROOT, "resources", "subagents");
 
 export type LintRuleId =
-  | "W1" | "W2" | "W3" | "W4" | "W5" | "W6" | "W7" | "W8"
+  | "W1" | "W2" | "W3" | "W4" | "W5" | "W6" | "W7" | "W8" | "W9"
   | "E1" | "E2" | "E3";
 export type DiagnosticRuleId = LintRuleId | "SCHEMA" | "LOAD";
 export type LintSeverity = "warning" | "error";
@@ -72,7 +72,7 @@ export const PROFILE_LINT_RULES: Record<LintRuleId, RuleDoc> = {
   W1: {
     severity: "warning",
     title: "too many skills",
-    description: "Profile declares more than 40 skills; this can bloat prompt tokens.",
+    description: "Profile declares more than 120 skills; this can bloat prompt tokens.",
   },
   W2: {
     severity: "warning",
@@ -109,6 +109,11 @@ export const PROFILE_LINT_RULES: Record<LintRuleId, RuleDoc> = {
     title: "skill missing when_to_invoke",
     description: "Skill has a capability but no explicit `when_to_invoke:` frontmatter — proactive routing falls back to a single generic row. Add `when_to_invoke:` with task-shape bullets for richer routing.",
   },
+  W9: {
+    severity: "warning",
+    title: "local-only MCP",
+    description: "Profile references an MCP that has a source dir but isn't in the sanitized public registry — a private/local server the user wires into their own ~/.claude.json. Not a profile bug, so it's a warning, not E3.",
+  },
   E1: {
     severity: "error",
     title: "profile name collision",
@@ -498,7 +503,7 @@ function checkStaticRules(
   result: ProfileLintResult,
 ): void {
   const skillCount = declaredSkillCount(profile);
-  if (skillCount > 40) {
+  if (skillCount > 120) {
     addIssue(
       result,
       "W1",
@@ -614,19 +619,27 @@ async function checkNpxSkills(
   }
 
   let resolvedCount = 0;
+  let skippedOffline = 0;
   for (const entry of entries) {
     for (const skill of entry.skills) {
       try {
-        await resolveOneNpxSkill(entry, skill, opts);
-        resolvedCount += 1;
+        const status = await resolveOneNpxSkill(entry, skill, opts);
+        if (status === "skipped-offline") skippedOffline += 1;
+        else resolvedCount += 1;
       } catch (err) {
         addResolverIssue(result, "npx skill", `${entry.repo}:${skill}`, err);
       }
     }
   }
 
-  if (resolvedCount === total) {
-    addCheck(result, "npx skills", `${resolvedCount} resolved or fetchable`);
+  if (resolvedCount + skippedOffline === total) {
+    addCheck(
+      result,
+      "npx skills",
+      skippedOffline > 0
+        ? `${resolvedCount} resolved, ${skippedOffline} not cached (offline; run --online to fetch)`
+        : `${resolvedCount} resolved or fetchable`,
+    );
   }
 }
 
@@ -634,7 +647,7 @@ async function resolveOneNpxSkill(
   entry: NpxSkillRef,
   skill: string,
   opts: ProfileLinterOptions,
-): Promise<void> {
+): Promise<"resolved" | "skipped-offline"> {
   const single: Profile = {
     name: "lint-npx",
     description: "single npx resolver check",
@@ -649,9 +662,13 @@ async function resolveOneNpxSkill(
       fetch: opts.npxFetch,
       offline: true,
     });
-    return;
+    return "resolved";
   } catch (err) {
-    if (opts.npxOffline || (process.env.CUE_OFFLINE ?? process.env.SOUL_OFFLINE) === "1") {
+    const offline = opts.npxOffline || (process.env.CUE_OFFLINE ?? process.env.SOUL_OFFLINE) === "1";
+    if (offline) {
+      // Offline mode: a cache miss is a benign "not cached", not a lint error.
+      // Real problems (PinNotFound, schema, etc.) still propagate to E3.
+      if (err instanceof NpxFetchFailed) return "skipped-offline";
       throw err;
     }
     if (!(err instanceof NpxFetchFailed || err instanceof ProfileError)) {
@@ -670,6 +687,7 @@ async function resolveOneNpxSkill(
   } finally {
     await rm(tempRepo, { recursive: true, force: true });
   }
+  return "resolved";
 }
 
 async function checkPlugins(
@@ -719,7 +737,22 @@ async function checkMcps(
       });
       resolvedCount += 1;
     } catch (err) {
-      addResolverIssue(result, "MCP", ref.id, err);
+      // A ref to an MCP that has a source dir but is absent from the sanitized
+      // public registry is a private/local-only server (configured in the
+      // user's own ~/.claude.json), not a profile bug — demote to W9, the same
+      // way PluginNotInstalled demotes to W5. A ref with no source dir is a
+      // genuine dangling reference and still fails with E3.
+      if (err instanceof McpNotFound && mcpHasLocalSource(ref.id, opts)) {
+        addIssue(
+          result,
+          "W9",
+          "warning",
+          `MCP "${ref.id}" is local-only — it has a source dir but isn't in the sanitized public registry; configure it in ~/.claude.json`,
+          { subject: ref.id },
+        );
+      } else {
+        addResolverIssue(result, "MCP", ref.id, err);
+      }
     }
   }
 
@@ -778,6 +811,18 @@ function profileWithMcp(profile: ResolvedProfile, ref: ResolvedProfile["mcps"][n
   };
 }
 
+/**
+ * True when an MCP id has a source manifest dir under `resources/mcps/mcps/<id>`
+ * even though it's absent from the sanitized public registry — i.e. a private /
+ * local-only server, not a dangling reference. Keyed off the same registry root
+ * the resolver uses (configsRoot's parent) so test overrides stay consistent.
+ */
+function mcpHasLocalSource(id: string, opts: ProfileLinterOptions): boolean {
+  if (!/^[A-Za-z0-9._-]+$/.test(id)) return false;
+  const configsRoot = opts.configsRoot ?? DEFAULT_CONFIGS_ROOT;
+  return existsSync(join(dirname(configsRoot), "mcps", id));
+}
+
 function formatErrorMessage(err: unknown): string {
   if (err instanceof ProfileError) {
     return `${err.code}: ${err.message}`;

package/src/lib/profile-loader.test.ts

@@ -32,10 +32,15 @@ const EXAMPLES_DIR = join(REPO_ROOT, "profiles", "_examples");
 
 let scratchRoot: string;
 let priorEnv: string | undefined;
+// SOUL_PROFILES_DIR is a fallback the loader honors; one test below sets it.
+// Capture + restore it too so it never leaks into sibling test files (a dead
+// SOUL_PROFILES_DIR would make their loadProfile() calls fail).
+let priorSoulEnv: string | undefined;
 
 beforeEach(async () => {
   scratchRoot = await mkdtemp(join(tmpdir(), "cue-profile-loader-"));
   priorEnv = process.env.CUE_PROFILES_DIR;
+  priorSoulEnv = process.env.SOUL_PROFILES_DIR;
   process.env.CUE_PROFILES_DIR = scratchRoot;
 });
 
@@ -45,6 +50,11 @@ afterEach(() => {
   } else {
     process.env.CUE_PROFILES_DIR = priorEnv;
   }
+  if (priorSoulEnv === undefined) {
+    delete process.env.SOUL_PROFILES_DIR;
+  } else {
+    process.env.SOUL_PROFILES_DIR = priorSoulEnv;
+  }
 });
 
 /** Write a profile.yaml at `<scratchRoot>/<name>/profile.yaml`. */
@@ -413,6 +423,17 @@ describe("parseProfileSelector", () => {
     expect(() => parseProfileSelector("+++")).toThrow(/empty/i);
   });
 
+  test("duplicate parts collapse, first-occurrence order preserved", () => {
+    // A stale pin / Recent row can carry repeats — loading a profile twice
+    // bloats the materialized CLAUDE.md, so the parser de-dupes.
+    expect(parseProfileSelector("gstack+higgsfield+postizz+higgsfield+postizz+gstack")).toEqual([
+      "gstack",
+      "higgsfield",
+      "postizz",
+    ]);
+    expect(parseProfileSelector("a+a+a")).toEqual(["a"]);
+  });
+
   test("isCompositeSelector recognizes ≥2 parts", () => {
     expect(isCompositeSelector("postizz")).toBe(false);
     expect(isCompositeSelector("postizz+trendradar")).toBe(true);

package/src/lib/profile-loader.ts

@@ -33,7 +33,6 @@ import {
   type ResolvedPlugin,
   type ResolvedProfile,
   type ResolvedSkill,
-  type SkillCondition,
   type SkillRef,
   SchemaViolation,
 } from "../../profiles/_types";
@@ -480,6 +479,7 @@ function foldChain(chain: Profile[]): ResolvedProfile {
       qualityGates: dedupePrimitiveArray(acc.qualityGates, child.qualityGates),
       evals: dedupePrimitiveArray(acc.evals, child.evals),
       recommends: dedupePrimitiveArray(acc.recommends, child.recommends),
+      autoSelect: dedupePrimitiveArray(acc.autoSelect, child.autoSelect),
       conflicts: dedupePrimitiveArray(acc.conflicts, child.conflicts),
       // bundles is a display hint, leaf-wins: a child that declares its own
       // list overrides the parent; a child that omits it inherits the parent's.
@@ -523,6 +523,7 @@ function normalizeToResolved(p: Profile, chain: string[]): ResolvedProfile {
     qualityGates: [...(p.qualityGates ?? [])],
     evals: [...(p.evals ?? [])],
     recommends: [...(p.recommends ?? [])],
+    autoSelect: [...(p.autoSelect ?? [])],
     conflicts: [...(p.conflicts ?? [])],
     bundles: p.bundles && p.bundles.length > 0 ? [...p.bundles] : undefined,
     personaRouting: [...(p.persona_routing ?? [])],
@@ -549,7 +550,19 @@ export function parseProfileSelector(selector: string): string[] {
       `Profile selector "${selector}" is empty after parsing`,
     );
   }
-  return parts;
+  // Collapse duplicate parts, order preserved. A selector can accumulate
+  // repeats — a stale pin, a Recent/Featured row built from an already-duped
+  // selector, or a composite primary whose part is also offered as a companion.
+  // Loading the same profile twice bloats the materialized CLAUDE.md and the
+  // token count for no benefit (skills/mcps fold to a set anyway).
+  const seen = new Set<string>();
+  const unique: string[] = [];
+  for (const part of parts) {
+    if (seen.has(part)) continue;
+    seen.add(part);
+    unique.push(part);
+  }
+  return unique;
 }
 
 /** True when the selector names two or more profiles to merge. */
@@ -603,6 +616,7 @@ function foldComposite(selector: string, parts: ResolvedProfile[]): ResolvedProf
     qualityGates: [...head.qualityGates],
     evals: [...head.evals],
     recommends: [...head.recommends],
+    autoSelect: [...head.autoSelect],
     conflicts: [...head.conflicts],
     // persona_includes is additive across a composite too — policy snippets
     // (Integrity Protocol, voice rules) from every stacked profile survive.
@@ -639,6 +653,7 @@ function foldComposite(selector: string, parts: ResolvedProfile[]): ResolvedProf
       qualityGates: dedupePrimitiveArray(acc.qualityGates, next.qualityGates),
       evals: dedupePrimitiveArray(acc.evals, next.evals),
       recommends: dedupePrimitiveArray(acc.recommends, next.recommends),
+      autoSelect: dedupePrimitiveArray(acc.autoSelect, next.autoSelect),
       conflicts: dedupePrimitiveArray(acc.conflicts, next.conflicts),
       personaIncludes: dedupePrimitiveArray(acc.personaIncludes, next.personaIncludes),
       personaRouting: [...acc.personaRouting, ...next.personaRouting],
@@ -676,7 +691,11 @@ export async function loadProfile(name: string): Promise<ResolvedProfile> {
     const chain = await buildInheritanceChain(part);
     resolved.push(foldChain(chain));
   }
-  return foldComposite(name, resolved);
+  // Name the composite from the deduped parts, not the raw selector: a duped
+  // selector ("a+b+a") loads correct (once-each) resources but must not name
+  // a redundant runtime dir / CLAUDE.md path — that splits the materializer
+  // cache and resurrects the duplicated-profile display bug downstream.
+  return foldComposite(parts.join("+"), resolved);
 }
 
 /**

package/src/lib/profile-metrics.ts

@@ -20,10 +20,10 @@
  * `core+skill-writer` sessions count toward the same skill.
  */
 
-import { readFileSync, existsSync, statSync } from "node:fs";
-import { homedir } from "node:os";
+import { readFileSync, existsSync, } from "node:fs";
 import { join, resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { configDir } from "./config-paths";
 
 const REPO_ROOT = process.env.CUE_REPO_ROOT ?? process.env.SOUL_REPO_ROOT ?? resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 export const SKILLS_ROOT = join(REPO_ROOT, "resources", "skills", "skills");
@@ -32,10 +32,6 @@ export function estimateTokens(text: string): number {
   return Math.ceil(text.length / 4);
 }
 
-function configDir(): string {
-  const xdg = process.env.XDG_CONFIG_HOME;
-  return join(xdg && xdg.length > 0 ? xdg : join(homedir(), ".config"), "cue");
-}
 
 /** Split a SKILL.md into its YAML frontmatter and body. */
 function splitFrontmatter(text: string): { frontmatter: string; body: string } {

package/src/lib/profile-names.test.ts

@@ -0,0 +1,58 @@
+/**
+ * Guard: every profile name referenced by the auto-detect signals and the
+ * discover/ai keyword maps must correspond to a real profile directory under
+ * profiles/.
+ *
+ * Phantom names used to slip in and silently no-op: `launch.ts` filters
+ * detections down to known profile names (so a phantom suggestion is dropped
+ * with no feedback), and `cue discover install` skips writing skills into a
+ * profile.yaml that doesn't exist. This test fails fast if any suggestion ever
+ * points at a profile that isn't on disk — it caught `python-api`, `rust-cli`,
+ * `ecc`, and a bare `medusa` when it was written.
+ */
+import { describe, expect, test } from "bun:test";
+import { readdirSync, existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+import { SIGNALS } from "./auto-detect";
+import { STACK_PROFILES, PROFILE_KEYWORDS as DISCOVER_KEYWORDS } from "../commands/discover";
+import { PROFILE_KEYWORDS as AI_KEYWORDS } from "../commands/ai";
+
+const PROFILES_DIR = resolve(import.meta.dir, "../../profiles");
+
+function realProfiles(): Set<string> {
+  return new Set(
+    readdirSync(PROFILES_DIR, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && !e.name.startsWith("_"))
+      .map((e) => e.name)
+      .filter((name) => existsSync(join(PROFILES_DIR, name, "profile.yaml"))),
+  );
+}
+
+describe("profile-name references resolve to real profiles", () => {
+  const real = realProfiles();
+
+  test("profiles/ fixture is populated", () => {
+    expect(real.size).toBeGreaterThan(10);
+  });
+
+  test("auto-detect SIGNALS reference only real profiles", () => {
+    const missing = [...new Set(SIGNALS.map((s) => s.profile))].filter((p) => !real.has(p));
+    expect(missing).toEqual([]);
+  });
+
+  test("discover STACK_PROFILES reference only real profiles", () => {
+    const missing = [...STACK_PROFILES].filter((p) => !real.has(p));
+    expect(missing).toEqual([]);
+  });
+
+  test("discover PROFILE_KEYWORDS keys are real profiles", () => {
+    const missing = Object.keys(DISCOVER_KEYWORDS).filter((p) => !real.has(p));
+    expect(missing).toEqual([]);
+  });
+
+  test("ai PROFILE_KEYWORDS keys are real profiles", () => {
+    const missing = Object.keys(AI_KEYWORDS).filter((p) => !real.has(p));
+    expect(missing).toEqual([]);
+  });
+});

package/src/lib/repos.test.ts

@@ -0,0 +1,57 @@
+/**
+ * Tests for the repo provenance matcher — the pure logic behind the studio
+ * Profiles "Repos" tab. No network: only `reposForProfile` (the catalog filter)
+ * is exercised; the live star fetch is integration-tested via the live endpoint.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { reposForProfile, REPO_CATALOG } from "./repos";
+
+const slugs = (rs: { repo: string }[]) => rs.map((r) => r.repo).sort();
+
+describe("reposForProfile", () => {
+  test("matches a repo by a namespace the profile has", () => {
+    const got = reposForProfile({ namespaces: ["meta"], mcpIds: [], pluginIds: [] });
+    expect(slugs(got)).toContain("opencue/cuecards");
+  });
+
+  test("matches a repo by an MCP id the profile connects", () => {
+    const got = reposForProfile({ namespaces: [], mcpIds: ["lightpanda"], pluginIds: [] });
+    expect(slugs(got)).toEqual(["lightpanda-io/browser"]);
+  });
+
+  test("matches a plugin by its bare name, ignoring the @marketplace suffix", () => {
+    const got = reposForProfile({ namespaces: [], mcpIds: [], pluginIds: ["claude-mem@thedotmack"] });
+    expect(slugs(got)).toEqual(["thedotmack/claude-mem"]);
+  });
+
+  test("npx skills map to the anthropics/skills bundle", () => {
+    const got = reposForProfile({ namespaces: ["npx"], mcpIds: [], pluginIds: [] });
+    expect(slugs(got)).toContain("anthropics/skills");
+  });
+
+  test("profile-specific MCPs/plugins map to their upstream repos", () => {
+    // The coolify MCP → the real Coolify repo (the user's pointed-at case).
+    expect(slugs(reposForProfile({ namespaces: [], mcpIds: ["coolify"], pluginIds: [] }))).toEqual(["coollabsio/coolify"]);
+    expect(slugs(reposForProfile({ namespaces: [], mcpIds: ["supabase"], pluginIds: [] }))).toEqual(["supabase/supabase"]);
+    expect(slugs(reposForProfile({ namespaces: [], mcpIds: [], pluginIds: ["vercel@claude-plugins-official"] }))).toEqual(["vercel/vercel"]);
+  });
+
+  test("returns nothing for a profile that contains none of the catalog's sources", () => {
+    const got = reposForProfile({ namespaces: ["nonexistent-ns"], mcpIds: ["nope"], pluginIds: ["nope@x"] });
+    expect(got).toHaveLength(0);
+  });
+
+  test("dedupes — a repo matched by both ns and mcp appears once", () => {
+    const got = reposForProfile({ namespaces: ["browser"], mcpIds: ["lightpanda"], pluginIds: [] });
+    expect(got.filter((r) => r.repo === "lightpanda-io/browser")).toHaveLength(1);
+  });
+
+  test("every catalog repo is a real owner/name slug (no spaces, exactly one slash)", () => {
+    for (const r of REPO_CATALOG) {
+      expect(r.repo).toMatch(/^[^/\s]+\/[^/\s]+$/);
+      expect(r.kinds.length).toBeGreaterThan(0);
+    }
+  });
+});