@jshookmcp/jshook 0.1.4 → 0.1.6

package/dist/server/domains/hooks/preset-definitions.security.js

@@ -139,4 +139,3 @@ export const SECURITY_PRESETS = {
   }`, cs, lc),
     },
 };
-//# sourceMappingURL=preset-definitions.security.js.map

package/dist/server/domains/hooks/preset-handlers.d.ts

@@ -14,6 +14,6 @@ export declare class HookPresetToolHandlers {
             text: string;
         }[];
     }>;
+    private buildCustomPresetMap;
 }
 export {};
-//# sourceMappingURL=preset-handlers.d.ts.map

package/dist/server/domains/hooks/preset-handlers.js

@@ -1,5 +1,6 @@
 import { logger } from '../../../utils/logger.js';
 import { PRESETS, PRESET_LIST } from '../../domains/hooks/preset-definitions.js';
+import { buildHookCode } from '../../domains/hooks/preset-builder.js';
 export class HookPresetToolHandlers {
     pageController;
     constructor(pageController) {
@@ -7,6 +8,18 @@ export class HookPresetToolHandlers {
     }
     async handleHookPreset(args) {
         try {
+            const customPresetMap = this.buildCustomPresetMap(args);
+            const availablePresets = {
+                ...PRESETS,
+                ...customPresetMap,
+            };
+            const availablePresetList = [
+                ...PRESET_LIST,
+                ...Object.entries(customPresetMap).map(([id, preset]) => ({
+                    id,
+                    description: `${preset.description} (custom)`,
+                })),
+            ];
             if (args.listPresets === true) {
                 return {
                     content: [
@@ -14,8 +27,8 @@ export class HookPresetToolHandlers {
                             type: 'text',
                             text: JSON.stringify({
                                 success: true,
-                                totalPresets: PRESET_LIST.length,
-                                presets: PRESET_LIST,
+                                totalPresets: availablePresetList.length,
+                                presets: availablePresetList,
                             }, null, 2),
                         },
                     ],
@@ -44,7 +57,7 @@ export class HookPresetToolHandlers {
                     ],
                 };
             }
-            const invalid = targets.filter((t) => !PRESETS[t]);
+            const invalid = targets.filter((t) => !availablePresets[t]);
             if (invalid.length > 0) {
                 return {
                     content: [
@@ -53,7 +66,7 @@ export class HookPresetToolHandlers {
                             text: JSON.stringify({
                                 success: false,
                                 error: `: ${invalid.join(', ')}`,
-                                availablePresets: PRESET_LIST.map((p) => p.id),
+                                availablePresets: availablePresetList.map((p) => p.id),
                             }, null, 2),
                         },
                     ],
@@ -64,7 +77,7 @@ export class HookPresetToolHandlers {
             const errors = [];
             for (const presetId of targets) {
                 try {
-                    const code = PRESETS[presetId].buildCode(captureStack, logToConsole);
+                    const code = availablePresets[presetId].buildCode(captureStack, logToConsole);
                     if (method === 'evaluateOnNewDocument') {
                         await page.evaluateOnNewDocument(code);
                     }
@@ -112,5 +125,29 @@ export class HookPresetToolHandlers {
             };
         }
     }
+    buildCustomPresetMap(args) {
+        const rawTemplates = [];
+        if (args.customTemplate && typeof args.customTemplate === 'object') {
+            rawTemplates.push(args.customTemplate);
+        }
+        if (Array.isArray(args.customTemplates)) {
+            rawTemplates.push(...args.customTemplates);
+        }
+        const customPresets = {};
+        for (const template of rawTemplates) {
+            const id = template.id?.trim();
+            const body = template.body?.trim();
+            if (!id || !body) {
+                throw new Error('Each custom template requires non-empty id and body');
+            }
+            if (PRESETS[id]) {
+                throw new Error(`Custom template id conflicts with built-in preset: ${id}`);
+            }
+            customPresets[id] = {
+                description: template.description?.trim() || `Custom inline preset: ${id}`,
+                buildCode: (captureStack, logToConsole) => buildHookCode(id, body, captureStack, logToConsole),
+            };
+        }
+        return customPresets;
+    }
 }
-//# sourceMappingURL=preset-handlers.js.map

package/dist/server/domains/maintenance/definitions.d.ts

@@ -2,4 +2,4 @@ import type { Tool } from '@modelcontextprotocol/sdk/types.js';
 export declare const tokenBudgetTools: Tool[];
 export declare const extensionTools: Tool[];
 export declare const cacheTools: Tool[];
-//# sourceMappingURL=definitions.d.ts.map
+export declare const artifactTools: Tool[];

package/dist/server/domains/maintenance/definitions.js

@@ -134,8 +134,8 @@ list_extensions()
 
 Actions performed:
 - Unloads all currently loaded extension tools
-- Re-scans plugin roots (MCP_PLUGIN_ROOTS or ./plugins)
-- Re-scans workflow roots (MCP_WORKFLOW_ROOTS or ./workflows)
+- Re-scans plugin roots (MCP_PLUGIN_ROOTS or <jshook-install>/plugins)
+- Re-scans workflow roots (MCP_WORKFLOW_ROOTS or <jshook-install>/workflows)
 - Validates, loads, and activates discovered plugins
 - Registers contributed tools and workflows
 
@@ -196,13 +196,15 @@ browse_extension_registry({ kind: "plugin" })
     },
     {
         name: 'install_extension',
-        description: `Install an extension from the remote registry into the local plugins directory.
+        description: `Install an extension from the remote registry into the jshook installation extension directories.
 
 Clones the extension repository and checks out the pinned commit from the registry.
 
 Parameters:
 - slug: Extension slug from the registry (e.g. "ida-bridge", "frida-bridge")
-- targetDir: Target directory (optional, defaults to ./plugins/<slug>)
+- targetDir: Target directory override (optional). By default:
+  - plugin -> <jshook-install>/plugins/<slug>
+  - workflow -> <jshook-install>/workflows/<slug>
 
 Actions performed:
 1. Fetches the registry index to resolve the extension
@@ -230,7 +232,7 @@ install_extension({ slug: "ida-bridge" })
                 },
                 targetDir: {
                     type: 'string',
-                    description: 'Target directory (optional, defaults to ./plugins/<slug>)',
+                    description: 'Target directory override (optional, defaults to jshook install plugins/workflows root + slug)',
                 },
             },
             required: ['slug'],
@@ -384,4 +386,76 @@ clear_all_caches()
         },
     },
 ];
-//# sourceMappingURL=definitions.js.map
+export const artifactTools = [
+    {
+        name: 'cleanup_artifacts',
+        description: `Clean generated artifacts, screenshots, and debugger sessions using retention rules.
+
+Supports:
+- Age-based removal via retentionDays
+- Size-based trimming via maxTotalBytes
+- Dry-run mode for safe preview
+
+Default directories:
+- artifacts/
+- screenshots/
+- debugger-sessions/
+
+Environment defaults:
+- MCP_ARTIFACT_RETENTION_DAYS
+- MCP_ARTIFACT_MAX_TOTAL_MB
+- MCP_ARTIFACT_CLEANUP_ON_START
+- MCP_ARTIFACT_CLEANUP_INTERVAL_MINUTES
+
+Example:
+\`\`\`typescript
+cleanup_artifacts({ retentionDays: 7, dryRun: true })
+\`\`\``,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                retentionDays: {
+                    type: 'number',
+                    description: 'Override retention window in days for this cleanup run.',
+                },
+                maxTotalBytes: {
+                    type: 'number',
+                    description: 'Override maximum retained bytes across managed artifact directories.',
+                },
+                dryRun: {
+                    type: 'boolean',
+                    description: 'Preview removals without deleting files.',
+                    default: false,
+                },
+            },
+        },
+    },
+    {
+        name: 'doctor_environment',
+        description: `Run an environment doctor for optional dependencies, bridge endpoints, and platform limitations.
+
+Checks:
+- Installed optional packages (camoufox-js, playwright-core)
+- External toolchain availability (wabt, binaryen, jadx, etc.)
+- Native bridge health (Ghidra / IDA / Burp)
+- Active security and artifact-retention configuration
+- Platform limitations for Windows-only memory tooling
+
+Use this before debugging dependency issues or after installing external integrations.
+
+Example:
+\`\`\`typescript
+doctor_environment({ includeBridgeHealth: true })
+\`\`\``,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                includeBridgeHealth: {
+                    type: 'boolean',
+                    description: 'When true, probe local native-bridge / Burp endpoints as part of the report.',
+                    default: true,
+                },
+            },
+        },
+    },
+];

package/dist/server/domains/maintenance/handlers.d.ts

@@ -1,13 +1,19 @@
 import { TokenBudgetManager } from '../../../utils/TokenBudgetManager.js';
 import { UnifiedCacheManager } from '../../../utils/UnifiedCacheManager.js';
 import type { ToolResponse } from '../../types.js';
+import { cleanupArtifacts } from '../../../utils/artifactRetention.js';
+import { runEnvironmentDoctor } from '../../../utils/environmentDoctor.js';
 interface CoreMaintenanceHandlerDeps {
     tokenBudget: TokenBudgetManager;
     unifiedCache: UnifiedCacheManager;
+    artifactCleanup?: typeof cleanupArtifacts;
+    environmentDoctor?: typeof runEnvironmentDoctor;
 }
 export declare class CoreMaintenanceHandlers {
     private readonly tokenBudget;
     private readonly unifiedCache;
+    private readonly artifactCleanup;
+    private readonly environmentDoctor;
     constructor(deps: CoreMaintenanceHandlerDeps);
     handleGetTokenBudgetStats(): Promise<ToolResponse>;
     handleManualTokenCleanup(): Promise<ToolResponse>;
@@ -15,6 +21,13 @@ export declare class CoreMaintenanceHandlers {
     handleGetCacheStats(): Promise<ToolResponse>;
     handleSmartCacheCleanup(targetSize?: number): Promise<ToolResponse>;
     handleClearAllCaches(): Promise<ToolResponse>;
+    handleCleanupArtifacts(args: {
+        retentionDays?: number;
+        maxTotalBytes?: number;
+        dryRun?: boolean;
+    }): Promise<ToolResponse>;
+    handleEnvironmentDoctor(args: {
+        includeBridgeHealth?: boolean;
+    }): Promise<ToolResponse>;
 }
 export {};
-//# sourceMappingURL=handlers.d.ts.map

package/dist/server/domains/maintenance/handlers.extensions.d.ts

@@ -8,4 +8,3 @@ export declare class ExtensionManagementHandlers {
     handleBrowseExtensionRegistry(kind: string): Promise<ToolResponse>;
     handleInstallExtension(slug: string, targetDir?: string): Promise<ToolResponse>;
 }
-//# sourceMappingURL=handlers.extensions.d.ts.map

package/dist/server/domains/maintenance/handlers.extensions.js

@@ -1,12 +1,36 @@
 import { execFile } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { readFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
 import { logger } from '../../../utils/logger.js';
 import { EXTENSION_GIT_CLONE_TIMEOUT_MS, EXTENSION_GIT_CHECKOUT_TIMEOUT_MS, } from '../../../constants.js';
 import { asJsonResponse, serializeError } from '../../domains/shared/response.js';
 const execFileAsync = promisify(execFile);
+function getJshookInstallRoot() {
+    const currentFile = fileURLToPath(import.meta.url);
+    return resolve(dirname(currentFile), '..', '..', '..', '..');
+}
+function parseFirstRoot(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return undefined;
+    return value
+        .split(',')
+        .map((item) => item.trim())
+        .find((item) => item.length > 0);
+}
+function resolveDefaultExtensionRoot(kind) {
+    const envKey = kind === 'workflow' ? 'MCP_WORKFLOW_ROOTS' : 'MCP_PLUGIN_ROOTS';
+    const configured = parseFirstRoot(process.env[envKey]);
+    if (configured) {
+        return resolve(configured);
+    }
+    const installRoot = getJshookInstallRoot();
+    return resolve(installRoot, kind === 'workflow' ? 'workflows' : 'plugins');
+}
 function getRegistryBaseUrl() {
     const baseUrl = (process.env.EXTENSION_REGISTRY_BASE_URL ?? '').trim().replace(/\/+$/, '');
     if (!baseUrl) {
@@ -14,6 +38,24 @@ function getRegistryBaseUrl() {
     }
     return baseUrl;
 }
+const LOCAL_EXTENSION_SDK_PACKAGE = '@jshookmcp/extension-sdk';
+const LOCAL_EXTENSION_SDK_ROOT = resolve(getJshookInstallRoot(), 'packages', 'extension-sdk');
+const REGISTRY_FETCH_TIMEOUT_MS = 10_000;
+const REGISTRY_CACHE_DIR = resolve(homedir(), '.jshookmcp', 'cache');
+class RegistryFetchError extends Error {
+    code;
+    url;
+    cachePath;
+    status;
+    constructor(code, url, message, cachePath, status) {
+        super(message);
+        this.code = code;
+        this.url = url;
+        this.cachePath = cachePath;
+        this.status = status;
+        this.name = 'RegistryFetchError';
+    }
+}
 function resolvePackageManagerInvocation(packageManager, args) {
     if (process.platform === 'win32') {
         return {
@@ -42,9 +84,10 @@ async function resolvePackageManager(installDir) {
         try {
             const raw = await readFile(packageJsonPath, 'utf8');
             const pkg = JSON.parse(raw);
-            if (pkg.packageManager?.startsWith('pnpm@'))
+            const packageManager = pkg.packageManager?.trim().toLowerCase().split('@')[0];
+            if (packageManager === 'pnpm')
                 return 'pnpm';
-            if (pkg.packageManager?.startsWith('npm@'))
+            if (packageManager === 'npm')
                 return 'npm';
         }
         catch {
@@ -56,36 +99,172 @@ async function resolvePackageManager(installDir) {
         return 'npm';
     return 'pnpm';
 }
-async function fetchJson(url) {
-    const res = await fetch(url);
-    if (!res.ok) {
-        throw new Error(`Failed to fetch ${url}: ${res.status} ${res.statusText}`);
+function getRegistryCachePath(kind) {
+    return resolve(REGISTRY_CACHE_DIR, `registry-${kind}.json`);
+}
+async function readRegistryCache(kind) {
+    const cachePath = getRegistryCachePath(kind);
+    try {
+        const raw = await readFile(cachePath, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
     }
-    return res.json();
 }
-async function findRegistryEntryBySlug(registryBase, slug) {
-    let workflowFetchError;
+async function writeRegistryCache(kind, payload) {
+    const cachePath = getRegistryCachePath(kind);
+    await mkdir(dirname(cachePath), { recursive: true });
+    await writeFile(cachePath, JSON.stringify(payload, null, 2), 'utf8');
+}
+function classifyRegistryFetchError(url, error, cachePath) {
+    if (error instanceof RegistryFetchError) {
+        return error;
+    }
+    if (error instanceof DOMException && error.name === 'AbortError') {
+        return new RegistryFetchError('timeout', url, `Registry fetch timed out after ${REGISTRY_FETCH_TIMEOUT_MS}ms: ${url}`, cachePath);
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes('ENOTFOUND') || message.includes('getaddrinfo')) {
+        return new RegistryFetchError('dns_failure', url, `DNS resolution failed for registry URL: ${url}`, cachePath);
+    }
+    if (message.includes('ECONNREFUSED')) {
+        return new RegistryFetchError('connection_refused', url, `Connection refused by registry server: ${url}`, cachePath);
+    }
+    if (message.includes('CERT_') || message.includes('certificate') || message.includes('SSL')) {
+        return new RegistryFetchError('tls_error', url, `TLS/certificate error when connecting to registry: ${url}`, cachePath);
+    }
+    const httpMatch = message.match(/HTTP\s+(\d+)/i);
+    if (httpMatch) {
+        const status = Number(httpMatch[1]);
+        return new RegistryFetchError('http_error', url, message, cachePath, status);
+    }
+    return new RegistryFetchError('fetch_failed', url, message, cachePath);
+}
+function serializeRegistryFetchError(error) {
+    return {
+        success: false,
+        error: error.code,
+        message: error.message,
+        url: error.url,
+        ...(typeof error.status === 'number' ? { status: error.status } : {}),
+        ...(error.cachePath ? { cachePath: error.cachePath } : {}),
+    };
+}
+async function fetchJson(url, options) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REGISTRY_FETCH_TIMEOUT_MS);
+    const cachePath = options?.cacheKey ? getRegistryCachePath(options.cacheKey) : undefined;
     try {
-        const workflowIndex = await fetchJson(`${registryBase}/workflows.index.json`);
-        const workflowEntry = workflowIndex.workflows.find((item) => item.slug === slug);
-        if (workflowEntry) {
-            return { entry: workflowEntry, kind: 'workflow' };
+        const res = await fetch(url, { signal: controller.signal });
+        if (!res.ok) {
+            throw new RegistryFetchError('http_error', url, `HTTP ${res.status} ${res.statusText} from ${url}`, cachePath, res.status);
+        }
+        const data = await res.json();
+        if (options?.cacheKey) {
+            try {
+                await writeRegistryCache(options.cacheKey, data);
+            }
+            catch (cacheError) {
+                logger.warn(`[extensions] Failed to persist ${options.cacheKey} registry cache for ${url}:`, cacheError);
+            }
         }
+        return {
+            data,
+            stale: false,
+            source: 'network',
+            cachePath,
+        };
     }
     catch (error) {
-        workflowFetchError = error instanceof Error ? error : new Error(String(error));
+        const classified = classifyRegistryFetchError(url, error, cachePath);
+        if (options?.cacheKey) {
+            const cached = await readRegistryCache(options.cacheKey);
+            if (cached) {
+                logger.warn(`[extensions] Using stale ${options.cacheKey} registry cache after ${classified.code}: ${url}`);
+                return {
+                    data: cached,
+                    stale: true,
+                    source: 'cache',
+                    cachePath,
+                };
+            }
+        }
+        throw classified;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function rewriteLocalExtensionSdkDependency(installDir) {
+    const packageJsonPath = resolve(installDir, 'package.json');
+    if (!existsSync(packageJsonPath)) {
+        return false;
     }
-    let pluginFetchError;
     try {
-        const pluginIndex = await fetchJson(`${registryBase}/plugins.index.json`);
-        const pluginEntry = pluginIndex.plugins.find((item) => item.slug === slug);
-        if (pluginEntry) {
-            return { entry: pluginEntry, kind: 'plugin' };
+        const raw = await readFile(packageJsonPath, 'utf8');
+        const pkg = JSON.parse(raw);
+        const sections = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+        const relativeSdkPath = relative(installDir, LOCAL_EXTENSION_SDK_ROOT).replace(/\\/g, '/');
+        const localSdkSpec = `file:${relativeSdkPath || '.'}`;
+        let changed = false;
+        for (const sectionName of sections) {
+            const section = pkg[sectionName];
+            if (!section || typeof section !== 'object') {
+                continue;
+            }
+            const dependencyMap = section;
+            const currentValue = dependencyMap[LOCAL_EXTENSION_SDK_PACKAGE];
+            if (typeof currentValue === 'string' && currentValue.startsWith('workspace:')) {
+                dependencyMap[LOCAL_EXTENSION_SDK_PACKAGE] = localSdkSpec;
+                changed = true;
+            }
+        }
+        if (!changed) {
+            return false;
         }
+        await writeFile(packageJsonPath, `${JSON.stringify(pkg, null, 2)}\n`, 'utf8');
+        logger.info(`[extensions] Rewrote ${LOCAL_EXTENSION_SDK_PACKAGE} dependency to local file path for ${installDir}`);
+        return true;
     }
     catch (error) {
-        pluginFetchError = error instanceof Error ? error : new Error(String(error));
+        logger.warn(`[extensions] Failed to rewrite ${LOCAL_EXTENSION_SDK_PACKAGE} dependency for ${installDir}:`, error);
+        return false;
     }
+}
+async function findRegistryEntryBySlug(registryBase, slug) {
+    const [workflowResult, pluginResult] = await Promise.allSettled([
+        fetchJson(`${registryBase}/workflows.index.json`, { cacheKey: 'workflows' }),
+        fetchJson(`${registryBase}/plugins.index.json`, { cacheKey: 'plugins' }),
+    ]);
+    if (workflowResult.status === 'fulfilled') {
+        const workflows = Array.isArray(workflowResult.value.data.workflows)
+            ? workflowResult.value.data.workflows
+            : [];
+        const workflowEntry = workflows.find((item) => item.slug === slug);
+        if (workflowEntry) {
+            return { entry: workflowEntry, kind: 'workflow' };
+        }
+    }
+    if (pluginResult.status === 'fulfilled') {
+        const plugins = Array.isArray(pluginResult.value.data.plugins)
+            ? pluginResult.value.data.plugins
+            : [];
+        const pluginEntry = plugins.find((item) => item.slug === slug);
+        if (pluginEntry) {
+            return { entry: pluginEntry, kind: 'plugin' };
+        }
+    }
+    const workflowFetchError = workflowResult.status === 'rejected'
+        ? workflowResult.reason instanceof Error
+            ? workflowResult.reason
+            : new Error(String(workflowResult.reason))
+        : undefined;
+    const pluginFetchError = pluginResult.status === 'rejected'
+        ? pluginResult.reason instanceof Error
+            ? pluginResult.reason
+            : new Error(String(pluginResult.reason))
+        : undefined;
     if (workflowFetchError && pluginFetchError) {
         throw new Error(`Failed to resolve extension slug "${slug}": workflow registry error: ${workflowFetchError.message}; plugin registry error: ${pluginFetchError.message}`);
     }
@@ -128,9 +307,20 @@ export class ExtensionManagementHandlers {
             const showPlugins = kind === 'all' || kind === 'plugin';
             const showWorkflows = kind === 'all' || kind === 'workflow';
             const result = { success: true };
-            if (showPlugins) {
-                const index = await fetchJson(`${registryBase}/plugins.index.json`);
-                result.plugins = index.plugins.map((p) => ({
+            let stale = false;
+            const pluginPromise = showPlugins
+                ? fetchJson(`${registryBase}/plugins.index.json`, { cacheKey: 'plugins' })
+                : undefined;
+            const workflowPromise = showWorkflows
+                ? fetchJson(`${registryBase}/workflows.index.json`, { cacheKey: 'workflows' })
+                : undefined;
+            const [pluginIndex, workflowIndex] = await Promise.all([
+                pluginPromise ?? Promise.resolve(undefined),
+                workflowPromise ?? Promise.resolve(undefined),
+            ]);
+            if (pluginIndex) {
+                const plugins = Array.isArray(pluginIndex.data.plugins) ? pluginIndex.data.plugins : [];
+                result.plugins = plugins.map((p) => ({
                     slug: p.slug,
                     id: p.id,
                     name: p.meta.name,
@@ -140,11 +330,13 @@ export class ExtensionManagementHandlers {
                     commit: p.source.commit,
                     entry: p.source.entry,
                 }));
-                result.pluginCount = index.plugins.length;
+                result.pluginCount = plugins.length;
+                result.pluginSource = pluginIndex.source;
+                stale = stale || pluginIndex.stale;
             }
-            if (showWorkflows) {
-                const index = await fetchJson(`${registryBase}/workflows.index.json`);
-                result.workflows = index.workflows.map((w) => ({
+            if (workflowIndex) {
+                const workflows = Array.isArray(workflowIndex.data.workflows) ? workflowIndex.data.workflows : [];
+                result.workflows = workflows.map((w) => ({
                     slug: w.slug,
                     id: w.id,
                     name: w.meta.name,
@@ -154,12 +346,20 @@ export class ExtensionManagementHandlers {
                     commit: w.source.commit,
                     entry: w.source.entry,
                 }));
-                result.workflowCount = index.workflows.length;
+                result.workflowCount = workflows.length;
+                result.workflowSource = workflowIndex.source;
+                stale = stale || workflowIndex.stale;
+            }
+            if (stale) {
+                result.stale = true;
             }
             return asJsonResponse(result);
         }
         catch (error) {
             logger.error('Failed to browse extension registry:', error);
+            if (error instanceof RegistryFetchError) {
+                return asJsonResponse(serializeRegistryFetchError(error));
+            }
             return asJsonResponse(serializeError(error));
         }
     }
@@ -168,10 +368,10 @@ export class ExtensionManagementHandlers {
             const registryBase = getRegistryBaseUrl();
             const { entry, kind } = await findRegistryEntryBySlug(registryBase, slug);
             const isWorkflow = kind === 'workflow';
-            const defaultRoot = isWorkflow ? './workflows' : './plugins';
+            const defaultRoot = resolveDefaultExtensionRoot(isWorkflow ? 'workflow' : 'plugin');
             const installDir = targetDir
                 ? resolve(targetDir)
-                : resolve(process.cwd(), defaultRoot, slug);
+                : resolve(defaultRoot, slug);
             if (existsSync(installDir)) {
                 return asJsonResponse({
                     success: false,
@@ -179,6 +379,7 @@ export class ExtensionManagementHandlers {
                     hint: 'Remove the existing directory first, or specify a different targetDir',
                 });
             }
+            await mkdir(dirname(installDir), { recursive: true });
             await execFileAsync('git', ['clone', entry.source.repo, installDir], {
                 timeout: EXTENSION_GIT_CLONE_TIMEOUT_MS,
             });
@@ -187,6 +388,7 @@ export class ExtensionManagementHandlers {
             });
             const packageJsonPath = resolve(installDir, 'package.json');
             if (existsSync(packageJsonPath)) {
+                await rewriteLocalExtensionSdkDependency(installDir);
                 const packageManager = await resolvePackageManager(installDir);
                 const installArgs = packageManager === 'pnpm'
                     ? ['--ignore-workspace', 'install', '--no-frozen-lockfile']
@@ -225,8 +427,10 @@ export class ExtensionManagementHandlers {
         }
         catch (error) {
             logger.error('Failed to install extension:', error);
+            if (error instanceof RegistryFetchError) {
+                return asJsonResponse(serializeRegistryFetchError(error));
+            }
             return asJsonResponse(serializeError(error));
         }
     }
 }
-//# sourceMappingURL=handlers.extensions.js.map