@adea-ai/plugins 3.0.10 → 4.0.1

package/src/site-icon-fallback.test.ts

@@ -1,3 +1,6 @@
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { describe, expect, test } from 'bun:test'
 import {
   buildCatalog,
@@ -12,7 +15,7 @@ import {
 } from './index.js'
 import { buildConsumerIndex } from './consumer-index.js'
 import { resolveIconSources, stageIconAssets } from './icon-mirror.js'
-import { selectIconPath } from './icons.js'
+import { iconAssetName, selectIconPath } from './icons.js'
 
 /**
  * End-to-end cover for the brand-mark fallback: a plugin that ships no mark of
@@ -23,8 +26,8 @@ import { selectIconPath } from './icons.js'
 const PNG = new Uint8Array([
   0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44, 0x52,
 ])
-const HOME = 'https://vendor.example/'
-const APPLE_ICON = 'https://vendor.example/apple-icon.png'
+const HOME = 'https://fc-vendor.example/'
+const APPLE_ICON = 'https://fd-cdn.example/apple-icon.png'
 
 const policy: CatalogPolicy = {
   allowedRepositoryHosts: ['github.com'],
@@ -98,10 +101,14 @@ function stubFetch(handler: (url: string) => Response) {
   return { calls, restore: () => void (globalThis.fetch = original) }
 }
 
-async function build(entryName: string, homepage?: string, options: { live?: boolean } = {}) {
+async function build(
+  entryName: string,
+  homepage?: string,
+  options: { live?: boolean; iconAssetsDirectory?: string } = {}
+) {
   const stub = stubFetch((url) => {
     if (url === HOME)
-      return new Response(`<head><link rel="apple-touch-icon" href="/apple-icon.png"></head>`, {
+      return new Response(`<head><link rel="apple-touch-icon" href="${APPLE_ICON}"></head>`, {
         status: 200,
       })
     if (url === APPLE_ICON) return new Response(PNG, { status: 200 })
@@ -116,6 +123,7 @@ async function build(entryName: string, homepage?: string, options: { live?: boo
       metadataOnly: false,
       snapshotLoader: loader({ 'README.md': new TextEncoder().encode('no mark here') }),
       resolveExternalRefs: options.live ?? true,
+      ...(options.iconAssetsDirectory ? { iconAssetsDirectory: options.iconAssetsDirectory } : {}),
     })
     return { catalog, calls: stub.calls }
   } finally {
@@ -124,18 +132,26 @@ async function build(entryName: string, homepage?: string, options: { live?: boo
 }
 
 describe('product site icon fallback', () => {
-  test('records the site icon for a plugin that ships no mark', async () => {
-    const { catalog, calls } = await build('connector', HOME)
-    const release = catalog.plugins[0]!.availableReleases[0]!
-    expect(release.icon).toEqual({
-      kind: 'favicon',
-      url: APPLE_ICON,
-      homepage: HOME,
-      contentType: 'image/png',
-      digest: byteDigest(PNG),
-      bytes: PNG.byteLength,
-    })
-    expect(calls).toEqual([HOME, APPLE_ICON])
+  test('records and stages the site icon for a plugin that ships no mark', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'catalog-icons-'))
+    try {
+      const { catalog, calls } = await build('connector', HOME, { iconAssetsDirectory: directory })
+      const release = catalog.plugins[0]!.availableReleases[0]!
+      expect(release.icon).toEqual({
+        kind: 'favicon',
+        url: APPLE_ICON,
+        homepage: HOME,
+        contentType: 'image/png',
+        digest: byteDigest(PNG),
+        bytes: PNG.byteLength,
+      })
+      expect(calls).toEqual([HOME, APPLE_ICON])
+      expect(await readFile(join(directory, iconAssetName(byteDigest(PNG), 'image/png')))).toEqual(
+        Buffer.from(PNG)
+      )
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
   })
 
   test('prefers the plugin content and never contacts the site when a mark exists', async () => {
@@ -148,15 +164,16 @@ describe('product site icon fallback', () => {
         policy,
         metadataOnly: false,
         snapshotLoader: loader({
-          'assets/logo.svg': new TextEncoder().encode(
+          'assets/brand.svg': new TextEncoder().encode(
             '<svg xmlns="http://www.w3.org/2000/svg"><rect width="8" height="8"/></svg>'
           ),
+          'assets/icon.png': PNG,
         }),
         resolveExternalRefs: true,
       })
       expect(catalog.plugins[0]!.availableReleases[0]!.icon).toMatchObject({
         kind: 'content',
-        path: 'assets/logo.svg',
+        path: 'assets/icon.png',
       })
       expect(stub.calls).toEqual([])
     } finally {

package/src/site-icons.test.ts

@@ -71,6 +71,10 @@ describe('vendor homepage eligibility', () => {
     expect(isPublicHostname('bare-hostname')).toBe(false)
     expect(isPublicHostname('::1')).toBe(false)
     expect(isPublicHostname('fd00::1')).toBe(false)
+    expect(isPublicHostname('[fc00::1]')).toBe(false)
+    expect(isPublicHostname('fe80::1')).toBe(false)
+    expect(isPublicHostname('fc-vendor.example')).toBe(true)
+    expect(isPublicHostname('fd-cdn.example')).toBe(true)
   })
 })
 
@@ -92,6 +96,68 @@ describe('site icon discovery', () => {
     ])
   })
 
+  test('resolves relative icon links against the first document base URL', () => {
+    const baseHtml = `<!-- <base href="https://ignored.example/"> <script> -->
+      <script>const sample = '<!-- <base href="https://script.example/">'</script>
+      <meta content="<base href='https://attribute.example/'>">
+      <base target="_blank"><base href="/assets/icons/">
+      <base href="https://later.example/">
+      <link rel="icon" href="mark.png">`
+    expect(discoverSiteIcons(baseHtml, 'https://vendor.example/docs/page')).toEqual([
+      'https://vendor.example/assets/icons/mark.png',
+      'https://vendor.example/favicon.ico',
+    ])
+  })
+
+  test('ignores bases and links inside text and template content', () => {
+    for (const inert of [
+      '<title><base href="https://title.example/"></title>',
+      '<textarea><base href="https://textarea.example/"></textarea>',
+      `<template><template><base href="https://nested.example/"></template>
+        <link rel="icon" href="https://template.example/icon.png"></template>`,
+    ]) {
+      expect(
+        discoverSiteIcons(
+          `${inert}<base href="/real/"><link rel="icon" href="mark.png">`,
+          'https://vendor.example/'
+        )
+      ).toEqual(['https://vendor.example/real/mark.png', 'https://vendor.example/favicon.ico'])
+    }
+  })
+
+  test('decodes HTML character references in URLs', () => {
+    expect(
+      discoverSiteIcons(
+        '<base href="/icons/?a=1&amp;b=2"><link rel="icon" href="mark.png?x=1&amp;y=2">',
+        'https://vendor.example/'
+      )
+    ).toEqual([
+      'https://vendor.example/icons/mark.png?x=1&y=2',
+      'https://vendor.example/favicon.ico',
+    ])
+  })
+
+  test('retains the homepage fallback and URL policy with a document base', () => {
+    expect(
+      discoverSiteIcons(
+        '<base href="https://cdn.example/icons/"><link rel="icon" href="mark.png">',
+        'https://vendor.example/docs/page'
+      )
+    ).toEqual(['https://cdn.example/icons/mark.png', 'https://vendor.example/favicon.ico'])
+    expect(
+      discoverSiteIcons(
+        '<base href="http://vendor.example/assets/"><link rel="icon" href="mark.png">',
+        'https://vendor.example/docs/page'
+      )
+    ).toEqual(['https://vendor.example/favicon.ico'])
+    expect(
+      discoverSiteIcons(
+        '<base href="http://["><base href="/later/"><link rel="icon" href="mark.png">',
+        'https://vendor.example/docs/page'
+      )
+    ).toEqual(['https://vendor.example/docs/mark.png', 'https://vendor.example/favicon.ico'])
+  })
+
   test('prefers the larger declared size within a group', () => {
     const sizes = `<link rel="icon" sizes="32x32" href="/small.png">
       <link rel="icon" sizes="512x512" href="/large.png">`
@@ -100,6 +166,33 @@ describe('site icon discovery', () => {
     )
   })
 
+  test('accepts unquoted HTML attributes without reading the next attribute as rel', () => {
+    expect(
+      discoverSiteIcons('<link rel=icon href=/mark.svg sizes=32x32>', 'https://vendor.example/')
+    ).toEqual(['https://vendor.example/mark.svg', 'https://vendor.example/favicon.ico'])
+  })
+
+  test('only reads actual link attributes and complete relation tokens', () => {
+    const attributesHtml = `<link data-rel="icon" href="/data-rel.png">
+      <link rel="not-icon" href="/not-icon.png">
+      <link rel="stylesheet" title="rel=icon" href="/style.css">
+      <link-preview rel="icon" href="/custom.png">
+      <link rel="icon" data-href="/data-href.png" href="/real.png">`
+    expect(discoverSiteIcons(attributesHtml, 'https://vendor.example/')).toEqual([
+      'https://vendor.example/real.png',
+      'https://vendor.example/favicon.ico',
+    ])
+  })
+
+  test('does not end a link tag at a greater-than character inside a quoted attribute', () => {
+    expect(
+      discoverSiteIcons(
+        '<link title="a > b" rel="icon" href="/mark.svg">',
+        'https://vendor.example/'
+      )
+    ).toEqual(['https://vendor.example/mark.svg', 'https://vendor.example/favicon.ico'])
+  })
+
   test('falls back to /favicon.ico and refuses unsafe candidates', () => {
     expect(discoverSiteIcons('<html><head></head></html>', 'https://vendor.example/page')).toEqual([
       'https://vendor.example/favicon.ico',
@@ -132,6 +225,17 @@ describe('site icon resolution', () => {
     expect(io.byteCalls).toEqual(['https://vendor.example/apple-icon.png'])
   })
 
+  test('fetches a relative icon from the document base', async () => {
+    const page = 'https://vendor.example/docs/page'
+    const baseHtml = '<head><base href="/assets/"><link rel="icon" href="mark.png"></head>'
+    const io = fetcher({ [page]: baseHtml, 'https://vendor.example/assets/mark.png': PNG })
+    expect(await resolveSiteIcon(page, io)).toMatchObject({
+      url: 'https://vendor.example/assets/mark.png',
+      homepage: page,
+    })
+    expect(io.byteCalls).toEqual(['https://vendor.example/assets/mark.png'])
+  })
+
   test('accepts an icon container and skips a candidate that fails inspection', async () => {
     const ico = fetcher({ [homepage]: html, 'https://vendor.example/apple-icon.png': ICO })
     expect(await resolveSiteIcon(homepage, ico)).toMatchObject({ contentType: 'image/x-icon' })

package/src/site-icons.ts

@@ -1,3 +1,4 @@
+import { parseFragment, type DefaultTreeAdapterTypes } from 'parse5'
 import { inspectIconBytes, MAX_ICON_BYTES, type IconContentType } from './icons.js'
 
 /**
@@ -52,7 +53,10 @@ export function isPublicHostname(hostname: string): boolean {
   const host = hostname.toLowerCase().replace(/^\[|\]$/g, '')
   if (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.local')) return false
   if (host.endsWith('.internal') || host.endsWith('.home.arpa')) return false
-  if (host === '::1' || host.startsWith('fe80:') || host.startsWith('fc') || host.startsWith('fd'))
+  if (
+    host.includes(':') &&
+    (host === '::1' || host.startsWith('fe80:') || host.startsWith('fc') || host.startsWith('fd'))
+  )
     return false
   const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host)
   if (ipv4) {
@@ -73,25 +77,59 @@ export function isPublicHostname(hostname: string): boolean {
  * `apple-touch-icon` is preferred because it is a square PNG sized for a home
  * screen; declared `icon` links follow in declared order; `/favicon.ico` is the
  * conventional last resort when nothing is declared.
+ * Relative links use the document's first base href when present; the fallback
+ * stays on the homepage origin.
  */
 export function discoverSiteIcons(html: string, baseUrl: string): readonly string[] {
   const candidates: { href: string; rank: number }[] = []
-  const linkTags = html.match(/<link\b[^>]*>/gi) ?? []
-  for (const tag of linkTags) {
-    const rel = /\brel\s*=\s*["']?([^"'>]+)/i.exec(tag)?.[1]?.toLowerCase() ?? ''
-    if (!/\b(apple-touch-icon|icon|shortcut|mask-icon)\b/.test(rel)) continue
-    const href = /\bhref\s*=\s*["']([^"']+)["']/i.exec(tag)?.[1]
+  const elements: DefaultTreeAdapterTypes.Element[] = []
+  const nodes: DefaultTreeAdapterTypes.ChildNode[] = parseFragment(html).childNodes.toReversed()
+  while (nodes.length > 0) {
+    const node = nodes.pop()!
+    if (!('tagName' in node)) continue
+    if (node.namespaceURI === 'http://www.w3.org/1999/xhtml') elements.push(node)
+    // Template contents are a separate, inert document fragment.
+    if (node.tagName !== 'template') nodes.push(...node.childNodes.toReversed())
+  }
+  let resolutionBase = baseUrl
+  for (const element of elements) {
+    if (element.tagName !== 'base') continue
+    const attributes = new Map(element.attrs.map(({ name, value }) => [name, value]))
+    if (!attributes.has('href')) continue
+    try {
+      resolutionBase = new URL(attributes.get('href')!, baseUrl).toString()
+    } catch {
+      // An invalid first base falls back to the document URL.
+    }
+    break
+  }
+  for (const element of elements) {
+    if (element.tagName !== 'link') continue
+    const attributes = new Map(element.attrs.map(({ name, value }) => [name, value]))
+    const rel = new Set((attributes.get('rel') ?? '').toLowerCase().split(/\s+/))
+    if (
+      !['apple-touch-icon', 'apple-touch-icon-precomposed', 'icon', 'mask-icon'].some((name) =>
+        rel.has(name)
+      )
+    )
+      continue
+    const href = attributes.get('href')
     if (!href) continue
-    const sizes = /\bsizes\s*=\s*["']?([0-9]+x[0-9]+)/i.exec(tag)?.[1]
+    const sizes = /^(\d+x\d+)(?:\s|$)/i.exec(attributes.get('sizes') ?? '')?.[1]
     const edge = sizes ? Number.parseInt(sizes, 10) : 180
     // Apple touch icons lead; larger declared sizes lead within a group.
-    const rank = rel.includes('apple-touch-icon') ? 0 : rel.includes('mask-icon') ? 2 : 1
+    const rank =
+      rel.has('apple-touch-icon') || rel.has('apple-touch-icon-precomposed')
+        ? 0
+        : rel.has('mask-icon')
+          ? 2
+          : 1
     candidates.push({ href, rank: rank * 1000 + Math.max(0, 512 - (edge || 180)) })
   }
   const resolved: { url: string; rank: number }[] = []
   for (const candidate of candidates.toSorted((left, right) => left.rank - right.rank)) {
     try {
-      const url = new URL(candidate.href, baseUrl)
+      const url = new URL(candidate.href, resolutionBase)
       if (url.protocol !== 'https:' || !isPublicHostname(url.hostname)) continue
       resolved.push({ url: url.toString(), rank: candidate.rank })
     } catch {

package/src/source-config-sync.test.ts

@@ -0,0 +1,84 @@
+import { copyFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { expect, test } from 'bun:test'
+import { synchronizePortable } from './portable-catalog.js'
+import { withPortableFixture } from '../test-support/portable-fixture.js'
+
+test('rebuilds and reports source metadata changes when source commits stay fixed', () =>
+  withPortableFixture(async (input, root) => {
+    const first = await synchronizePortable(input)
+    const old = input.sources[0]!
+    await copyFile(
+      join(root, 'fixtures/source/marketplace.json'),
+      join(root, 'fixtures/source/alternate.json')
+    )
+    const cases = [
+      { ...old, displayName: 'Renamed source' },
+      { ...old, defaultBranch: 'stable' },
+      { ...old, manifestPath: 'alternate.json' },
+      { ...old, marketplaceDialect: 'openai' as const },
+    ]
+    for (const source of cases) {
+      const result = await synchronizePortable({
+        ...input,
+        sources: [source],
+        existingLock: first.lock!,
+        existingCatalog: first.catalog!,
+      })
+      expect(result.changed).toBe(true)
+      expect(result.changeReport.changedSources).toContain(source.sourceId)
+      expect(result.catalog?.sources[0]?.displayName).toBe(source.displayName)
+      expect(result.lock?.sources[0]?.defaultBranch).toBe(source.defaultBranch)
+      expect(result.lock?.sources[0]?.manifestPath).toBe(source.manifestPath)
+      expect(result.lock?.sources[0]?.marketplaceDialect).toBe(source.marketplaceDialect)
+      const repeated = await synchronizePortable({
+        ...input,
+        sources: [source],
+        existingLock: result.lock!,
+        existingCatalog: result.catalog!,
+      })
+      expect(repeated.changed).toBe(false)
+    }
+    const equivalent = await synchronizePortable({
+      ...input,
+      sources: [{ ...old, repositoryUrl: `${old.repositoryUrl}.git` }],
+      existingLock: first.lock!,
+      existingCatalog: first.catalog!,
+    })
+    expect(equivalent.changed).toBe(false)
+  }))
+
+test('rebuilds if the marketplace repository changes while external plugin pins stay equal', () =>
+  withPortableFixture(async (input, root) => {
+    const { writeFile } = await import('node:fs/promises')
+    await writeFile(
+      join(root, 'fixtures/source/marketplace.json'),
+      JSON.stringify({
+        plugins: [
+          { name: 'remote', source: { source: 'git', url: 'https://github.com/example/external' } },
+        ],
+      })
+    )
+    const snapshotLoader = {
+      load: async () => ({
+        files: new Map([['plugin.json', new TextEncoder().encode('{"name":"Remote"}')]]),
+        symlinks: [],
+      }),
+    }
+    const options = { ...input, snapshotLoader }
+    const first = await synchronizePortable(options)
+    const source = {
+      ...input.sources[0]!,
+      repositoryUrl: 'https://github.com/example/moved-marketplace',
+    }
+    const result = await synchronizePortable({
+      ...options,
+      sources: [source],
+      existingLock: first.lock!,
+    })
+    expect(result.changed).toBe(true)
+    expect(result.lock?.sources[0]?.repositoryUrl).toBe(source.repositoryUrl)
+    expect(result.catalog?.sources[0]?.repositoryUrl).toBe(source.repositoryUrl)
+    expect(result.changeReport.changedSources).toEqual([source.sourceId])
+    expect(result.lock?.sources[0]?.pluginPins).toEqual(first.lock?.sources[0]?.pluginPins)
+  }))

package/src/source-digest.test.ts

@@ -0,0 +1,101 @@
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { pathToFileURL } from 'node:url'
+import { expect, test } from 'bun:test'
+
+// Exercise the public source identity functions as a Node consumer, where the
+// default ICU locale follows the machine rather than Bun's fixed default.
+test('source digests agree across consumer locales and equivalent Unicode path order', async () => {
+  const directory = await mkdtemp(join(import.meta.dirname, '.source-digest-'))
+  try {
+    const entry = join(directory, 'entry.ts')
+    const output = join(directory, 'consumer.mjs')
+    await writeFile(
+      entry,
+      `export { bytesDigest } from '../index.ts'\nexport { sourceDigest } from '../agent-plugins-catalog.ts'\n`
+    )
+    const build = await Bun.build({ entrypoints: [entry], target: 'node', packages: 'external' })
+    expect(build.success).toBe(true)
+    await Bun.write(output, build.outputs[0]!)
+    const script = `
+      import { bytesDigest, sourceDigest } from ${JSON.stringify(pathToFileURL(output).href)};
+      const paths = ['z.txt', 'ä.txt', 'é.txt', 'e\\u0301.txt'];
+      const entries = paths.map((path) => [path, new TextEncoder().encode(path)]);
+      const forward = new Map(entries), reverse = new Map([...entries].reverse());
+      console.log(JSON.stringify([
+        bytesDigest(forward), bytesDigest(reverse), sourceDigest(forward), sourceDigest(reverse)
+      ]));
+    `
+    const results = ['en_US.UTF-8', 'sv_SE.UTF-8'].map((locale) => {
+      const result = spawnSync('node', ['--input-type=module', '-e', script], {
+        encoding: 'utf8',
+        env: { ...process.env, LANG: locale, LC_ALL: locale },
+      })
+      if (result.error) throw result.error
+      if (result.status !== 0) throw new Error(result.stderr)
+      expect(result.status).toBe(0)
+      return JSON.parse(result.stdout) as string[]
+    })
+    expect(new Set(results.flat()).size).toBe(1)
+  } finally {
+    await rm(directory, { recursive: true, force: true })
+  }
+})
+
+test('source lock identity is independent of the consumer locale', async () => {
+  const directory = await mkdtemp(join(import.meta.dirname, '.source-lock-'))
+  try {
+    const source = join(directory, 'fixture', 'source')
+    await mkdir(source, { recursive: true })
+    await writeFile(
+      join(source, 'marketplace.json'),
+      JSON.stringify({
+        plugins: [
+          { name: 'a-plugin', source: './a' },
+          { name: 'ä-plugin', source: './u' },
+          { name: 'z-plugin', source: './z' },
+        ],
+      })
+    )
+    const entry = join(directory, 'entry.ts')
+    const output = join(directory, 'consumer.mjs')
+    await writeFile(entry, "export { synchronize } from '../index.ts'\n")
+    const build = await Bun.build({ entrypoints: [entry], target: 'node', packages: 'external' })
+    expect(build.success).toBe(true)
+    await Bun.write(output, build.outputs[0]!)
+    const script = `
+      import { synchronize } from ${JSON.stringify(pathToFileURL(output).href)};
+      const result = await synchronize({
+        mode: 'offline', fixtureRoot: ${JSON.stringify(join(directory, 'fixture'))},
+        sources: [{sourceId:'test-source',displayName:'Test',marketplaceDialect:'claude',
+          repositoryUrl:'https://github.com/example/plugins',manifestPath:'marketplace.json',
+          defaultBranch:'main',trustClassification:'official',fixturePath:'source',
+          fixtureCommitSha:'a'.repeat(40)}],
+        categoryMap:{aliases:{},fallback:'other'},productAliases:{aliases:{}},
+        policy:{allowedRepositoryProtocols:['https:'],allowedRepositoryHosts:['github.com'],
+          maxFilesPerPlugin:100,maxBytesPerPlugin:100000,maxFileBytes:20000,
+          maxMarketplacePlugins:100,denyExecutableLifecycleScripts:true,
+          publishRequiresCompleteContent:false,sensitiveCapabilityTypes:[]},metadataOnly:true
+      });
+      console.log(JSON.stringify({lockId:result.lock.lockId,pins:result.lock.sources[0].pluginPins}));
+    `
+    const results = ['en_US.UTF-8', 'sv_SE.UTF-8'].map((locale) => {
+      const result = spawnSync('node', ['--input-type=module', '-e', script], {
+        encoding: 'utf8',
+        env: { ...process.env, LANG: locale, LC_ALL: locale },
+      })
+      if (result.error) throw result.error
+      if (result.status !== 0) throw new Error(result.stderr)
+      return JSON.parse(result.stdout) as { lockId: string; pins: { pluginName: string }[] }
+    })
+    expect(results[0]).toEqual(results[1])
+    expect(results[0]!.pins.map((pin) => pin.pluginName)).toEqual([
+      'a-plugin',
+      'z-plugin',
+      'ä-plugin',
+    ])
+  } finally {
+    await rm(directory, { recursive: true, force: true })
+  }
+})

package/src/source-digest.ts

@@ -0,0 +1,14 @@
+import { createHash } from 'node:crypto'
+
+/** Shared source-byte identity for catalog provenance and canonical package recipes. */
+export function sourceDigest(files: ReadonlyMap<string, Uint8Array>): string {
+  const hash = createHash('sha256')
+  // English matches the compiler runtime; ordinal ties distinguish equivalent Unicode names.
+  for (const [path, bytes] of [...files].toSorted(
+    ([a], [b]) => a.localeCompare(b, 'en') || (a < b ? -1 : a > b ? 1 : 0)
+  )) {
+    hash.update(`${path.length}:${path}:${bytes.byteLength}:`)
+    hash.update(bytes)
+  }
+  return `sha256:${hash.digest('hex')}`
+}

package/src/sources-json.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, test } from 'bun:test'
+import { parseJsonDocument, parseMarketplaceManifest, type SourceConfig } from './sources.js'
+
+describe('JSON document whitespace', () => {
+  test('accepts the four JSON whitespace characters around nested values', () => {
+    const text = ' \t\r\n{ "plugins"\t:\r[\ntrue, false, null, 1, "text", {} ] }\r\n'
+    expect(parseJsonDocument(text)).toEqual(JSON.parse(text))
+  })
+
+  test.each(['\u000b', '\u000c', '\u00a0', '\u1680', '\u2028', '\u2029', '\ufeff'])(
+    'rejects non-JSON whitespace %j outside strings',
+    (space) => {
+      for (const text of [
+        `${space}{}`,
+        `{}${space}`,
+        `{${space}"plugins":[]}`,
+        `{"plugins"${space}:[]}`,
+        `{"plugins":${space}[]}`,
+        `[1${space},2]`,
+        `[1,${space}2]`,
+      ]) {
+        expect(() => JSON.parse(text)).toThrow()
+        expect(() => parseJsonDocument(text)).toThrow('JSON_MALFORMED')
+      }
+    }
+  )
+
+  test('preserves Unicode whitespace inside JSON strings', () => {
+    const text = JSON.stringify({ value: '\u00a0\u1680\u2028\u2029\ufeff' })
+    expect(parseJsonDocument(text)).toEqual(JSON.parse(text))
+  })
+
+  test('continues rejecting escaped duplicate keys', () => {
+    expect(() => parseJsonDocument('{"name":1,"na\\u006de":2}')).toThrow('JSON_DUPLICATE_KEY')
+  })
+})
+
+test('sorts marketplace metadata independently of the host locale', () => {
+  const source: SourceConfig = {
+    sourceId: 'test',
+    displayName: 'Test',
+    repositoryUrl: 'https://github.com/example/plugins',
+    marketplaceDialect: 'openai',
+    manifestPath: 'marketplace.json',
+    defaultBranch: 'main',
+    trustClassification: 'official',
+  }
+  const parsed = parseMarketplaceManifest(
+    { plugins: [{ name: 'test', source: './test', keywords: ['ä', 'z', 'a', 'ä'] }] },
+    source
+  )
+  expect(parsed.entries[0]?.keywords).toEqual(['a', 'z', 'ä'])
+})

package/src/sources.ts

@@ -82,7 +82,7 @@ export function parseMarketplaceManifest(input: unknown, source: SourceConfig):
 export function parseJsonDocument(text: string): unknown {
   let index = 0
   const skip = () => {
-    while (/\s/.test(text[index] ?? '')) index += 1
+    while (/[ \t\r\n]/.test(text[index] ?? '')) index += 1
   }
   const string = (): string => {
     const start = index
@@ -158,7 +158,7 @@ export function parseJsonDocument(text: string): unknown {
     }
     if (character === '"') return string()
     const start = index
-    while (index < text.length && !/[\s,\]}]/.test(text[index] ?? '')) index += 1
+    while (index < text.length && !/[ \t\r\n,\]}]/.test(text[index] ?? '')) index += 1
     const token = text.slice(start, index)
     try {
       return JSON.parse(token) as unknown
@@ -312,7 +312,7 @@ function isString(input: unknown): input is string {
 
 function uniqueStrings(input: readonly string[]): string[] {
   return [...new Set(input.map((value) => value.trim()).filter(Boolean))].toSorted((a, b) =>
-    a.localeCompare(b)
+    a < b ? -1 : a > b ? 1 : 0
   )
 }
 

package/src/upstream-headers.test.ts

@@ -132,17 +132,41 @@ describe('site-icon fetcher bounds', () => {
     }
   })
 
-  test('honours a caller deadline that has already passed', async () => {
-    const mock = captureFetch()
+  test('honours a caller deadline that has already passed or expires during backoff', async () => {
+    const mock = captureFetch(() => {
+      throw new DOMException('Aborted', 'AbortError')
+    })
     try {
       const fetcher = createSiteIconFetcher(AbortSignal.abort())
-      await fetcher.fetchBytes(VENDOR_ICON)
+      await expect(fetcher.fetchBytes(VENDOR_ICON)).rejects.toThrow()
+      expect(mock.inits).toHaveLength(1)
     } finally {
       mock.restore()
     }
-    // The request still goes out carrying the spent deadline, so the platform
-    // aborts it; a real fetch rejects rather than returning a page.
-    expect(mock.inits).toHaveLength(1)
-    expect(mock.inits[0]?.signal?.aborted).toBe(true)
+
+    const controller = new AbortController()
+    let cancelled = false
+    const retry = captureFetch(
+      () =>
+        new Response(
+          new ReadableStream({
+            cancel() {
+              cancelled = true
+            },
+          }),
+          { status: 503, headers: { 'retry-after': '0.05' } }
+        )
+    )
+    const timer = setTimeout(() => controller.abort(), 5)
+    try {
+      await expect(
+        createSiteIconFetcher(controller.signal).fetchBytes(VENDOR_ICON)
+      ).rejects.toThrow()
+      expect(retry.inits).toHaveLength(1)
+      expect(cancelled).toBe(true)
+    } finally {
+      clearTimeout(timer)
+      retry.restore()
+    }
   })
 })