@jshookmcp/jshook 0.1.8 → 0.2.0

package/dist/tests/server/ExtensionManagementHandlers.test.js

@@ -0,0 +1,238 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+const { execFileMock, existsSyncMock, mkdirMock, readFileMock } = vi.hoisted(() => ({
+    execFileMock: vi.fn((_file, _args, options, callback) => {
+        const done = typeof options === 'function' ? options : callback;
+        done?.(null, '', '');
+    }),
+    existsSyncMock: vi.fn(() => false),
+    mkdirMock: vi.fn(async () => undefined),
+    readFileMock: vi.fn(async () => JSON.stringify({ packageManager: 'pnpm@10.28.2' })),
+}));
+vi.mock('node:child_process', () => ({
+    execFile: execFileMock,
+}));
+vi.mock('node:fs', () => ({
+    existsSync: existsSyncMock,
+}));
+vi.mock('node:fs/promises', () => ({
+    mkdir: mkdirMock,
+    readFile: readFileMock,
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+import { ExtensionManagementHandlers } from '../../src/server/domains/maintenance/handlers.extensions.js';
+describe('ExtensionManagementHandlers', () => {
+    const originalEnv = { ...process.env };
+    const originalFetch = global.fetch;
+    beforeEach(() => {
+        execFileMock.mockClear();
+        existsSyncMock.mockClear();
+        existsSyncMock.mockReturnValue(false);
+        process.env = { ...originalEnv };
+        global.fetch = vi.fn(async (url) => ({
+            ok: true,
+            status: 200,
+            statusText: 'OK',
+            json: async () => ({ plugins: [], workflows: [] }),
+            url: String(url),
+        }));
+    });
+    afterEach(() => {
+        process.env = { ...originalEnv };
+        global.fetch = originalFetch;
+    });
+    it('reads EXTENSION_REGISTRY_BASE_URL at call time instead of import time', async () => {
+        delete process.env.EXTENSION_REGISTRY_BASE_URL;
+        const handlers = new ExtensionManagementHandlers({});
+        process.env.EXTENSION_REGISTRY_BASE_URL = 'https://vmoranv.github.io/jshookmcp/registry';
+        const response = await handlers.handleBrowseExtensionRegistry('plugin');
+        expect(global.fetch).toHaveBeenCalledWith('https://vmoranv.github.io/jshookmcp/registry/plugins.index.json', expect.objectContaining({ signal: expect.any(AbortSignal) }));
+        expect(response.content[0].type).toBe('text');
+        expect(response.content[0].text).toContain('"success": true');
+    });
+    it('installs workflow extension when workflow slug is found during concurrent registry lookup', async () => {
+        process.env.EXTENSION_REGISTRY_BASE_URL = 'https://vmoranv.github.io/jshookmcp/registry';
+        const ctx = {
+            reloadExtensions: vi.fn(async () => ({
+                addedTools: 0,
+                pluginCount: 0,
+                workflowCount: 1,
+                errors: [],
+                warnings: [],
+            })),
+        };
+        const handlers = new ExtensionManagementHandlers(ctx);
+        global.fetch = vi.fn(async (url) => {
+            const textUrl = String(url);
+            if (textUrl.endsWith('/workflows.index.json')) {
+                return {
+                    ok: true,
+                    status: 200,
+                    statusText: 'OK',
+                    json: async () => ({
+                        workflows: [{
+                                slug: 'web-api-capture-session',
+                                id: 'workflow.web-api-capture-session.v1',
+                                source: {
+                                    type: 'git',
+                                    repo: 'https://github.com/vmoranv/jshook_workflow_web_api_capture_session',
+                                    ref: 'main',
+                                    commit: 'abc123',
+                                    subpath: '.',
+                                    entry: 'dist/index.js',
+                                },
+                                meta: {
+                                    name: 'Web API Capture Session',
+                                    description: 'workflow',
+                                    author: 'tester',
+                                    source_repo: 'https://github.com/vmoranv/jshook_workflow_web_api_capture_session',
+                                },
+                            }],
+                    }),
+                };
+            }
+            throw new Error(`Unexpected fetch: ${textUrl}`);
+        });
+        const response = await handlers.handleInstallExtension('web-api-capture-session');
+        const body = JSON.parse(response.content[0].text);
+        expect(body.success).toBe(true);
+        expect(global.fetch).toHaveBeenCalledTimes(2);
+        expect(global.fetch).toHaveBeenCalledWith('https://vmoranv.github.io/jshookmcp/registry/workflows.index.json', expect.objectContaining({ signal: expect.any(AbortSignal) }));
+        expect(global.fetch).toHaveBeenCalledWith('https://vmoranv.github.io/jshookmcp/registry/plugins.index.json', expect.objectContaining({ signal: expect.any(AbortSignal) }));
+        expect(execFileMock).toHaveBeenNthCalledWith(1, 'git', ['clone', 'https://github.com/vmoranv/jshook_workflow_web_api_capture_session', expect.stringContaining('workflows')], expect.objectContaining({ timeout: expect.any(Number) }), expect.any(Function));
+        expect(ctx.reloadExtensions).toHaveBeenCalledOnce();
+    });
+    it('falls back to plugin registry when workflow lookup fails during concurrent registry lookup', async () => {
+        process.env.EXTENSION_REGISTRY_BASE_URL = 'https://vmoranv.github.io/jshookmcp/registry';
+        const ctx = {
+            reloadExtensions: vi.fn(async () => ({
+                addedTools: 0,
+                pluginCount: 1,
+                workflowCount: 0,
+                errors: [],
+                warnings: [],
+            })),
+        };
+        const handlers = new ExtensionManagementHandlers(ctx);
+        global.fetch = vi.fn(async (url) => {
+            const textUrl = String(url);
+            if (textUrl.endsWith('/workflows.index.json')) {
+                throw new Error('workflow registry unavailable');
+            }
+            if (textUrl.endsWith('/plugins.index.json')) {
+                return {
+                    ok: true,
+                    status: 200,
+                    statusText: 'OK',
+                    json: async () => ({
+                        plugins: [{
+                                slug: 'ida-bridge',
+                                id: 'plugin.ida-bridge.v1',
+                                source: {
+                                    type: 'git',
+                                    repo: 'https://github.com/vmoranv/jshook_plugin_ida_bridge',
+                                    ref: 'main',
+                                    commit: 'def456',
+                                    subpath: '.',
+                                    entry: 'dist/index.js',
+                                },
+                                meta: {
+                                    name: 'IDA Bridge',
+                                    description: 'plugin',
+                                    author: 'tester',
+                                    source_repo: 'https://github.com/vmoranv/jshook_plugin_ida_bridge',
+                                },
+                            }],
+                    }),
+                };
+            }
+            throw new Error(`Unexpected fetch: ${textUrl}`);
+        });
+        const response = await handlers.handleInstallExtension('ida-bridge');
+        const body = JSON.parse(response.content[0].text);
+        expect(body.success).toBe(true);
+        expect(global.fetch).toHaveBeenCalledTimes(2);
+        expect(execFileMock).toHaveBeenNthCalledWith(1, 'git', ['clone', 'https://github.com/vmoranv/jshook_plugin_ida_bridge', expect.stringContaining('plugins')], expect.objectContaining({ timeout: expect.any(Number) }), expect.any(Function));
+    });
+    it('uses powershell wrapper for package manager commands on Windows', async () => {
+        process.env.EXTENSION_REGISTRY_BASE_URL = 'https://vmoranv.github.io/jshookmcp/registry';
+        const ctx = {
+            reloadExtensions: vi.fn(async () => ({
+                addedTools: 0,
+                pluginCount: 0,
+                workflowCount: 1,
+                errors: [],
+                warnings: [],
+            })),
+        };
+        const handlers = new ExtensionManagementHandlers(ctx);
+        existsSyncMock.mockImplementation((value) => {
+            const path = String(value);
+            return path.endsWith('package.json');
+        });
+        global.fetch = vi.fn(async () => ({
+            ok: true,
+            status: 200,
+            statusText: 'OK',
+            json: async () => ({
+                workflows: [{
+                        slug: 'batch-register',
+                        id: 'workflow.batch-register.v1',
+                        source: {
+                            type: 'git',
+                            repo: 'https://github.com/vmoranv/jshook_workflow_batch_register',
+                            ref: 'main',
+                            commit: 'abc123',
+                            subpath: '.',
+                            entry: 'workflow.ts',
+                        },
+                        meta: {
+                            name: 'Batch Register',
+                            description: 'workflow',
+                            author: 'tester',
+                            source_repo: 'https://github.com/vmoranv/jshook_workflow_batch_register',
+                        },
+                    }],
+            }),
+        }));
+        const response = await handlers.handleInstallExtension('batch-register');
+        const body = JSON.parse(response.content[0].text);
+        expect(body.success).toBe(true);
+        const thirdCall = execFileMock.mock.calls[2];
+        const fourthCall = execFileMock.mock.calls[3];
+        if (process.platform === 'win32') {
+            expect(thirdCall).toEqual([
+                'powershell.exe',
+                ['-NoProfile', '-NonInteractive', '-Command', 'pnpm --ignore-workspace install --no-frozen-lockfile'],
+                expect.objectContaining({ cwd: expect.stringContaining('workflows'), env: expect.objectContaining({ CI: 'true' }) }),
+                expect.any(Function),
+            ]);
+            expect(fourthCall).toEqual([
+                'powershell.exe',
+                ['-NoProfile', '-NonInteractive', '-Command', 'pnpm --ignore-workspace run --if-present build'],
+                expect.objectContaining({ cwd: expect.stringContaining('workflows'), env: expect.objectContaining({ CI: 'true' }) }),
+                expect.any(Function),
+            ]);
+        }
+        else {
+            expect(thirdCall).toEqual([
+                'pnpm',
+                ['--ignore-workspace', 'install', '--no-frozen-lockfile'],
+                expect.objectContaining({ cwd: expect.stringContaining('workflows'), env: expect.objectContaining({ CI: 'true' }) }),
+                expect.any(Function),
+            ]);
+            expect(fourthCall).toEqual([
+                'pnpm',
+                ['--ignore-workspace', 'run', '--if-present', 'build'],
+                expect.objectContaining({ cwd: expect.stringContaining('workflows'), env: expect.objectContaining({ CI: 'true' }) }),
+                expect.any(Function),
+            ]);
+        }
+    });
+});

package/dist/tests/server/ExtensionManager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/ExtensionManager.test.js

@@ -0,0 +1,133 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { join } from 'node:path';
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+vi.mock('@src/server/ToolCatalog', () => ({
+    allTools: [{ name: 'builtin_tool_a' }, { name: 'builtin_tool_b' }],
+    getTierIndex: vi.fn((tier) => {
+        const order = ['search', 'workflow', 'full'];
+        return order.indexOf(tier);
+    }),
+}));
+vi.mock('@src/server/extensions/plugin-config', () => ({
+    getPluginBoostTier: vi.fn(() => 'full'),
+}));
+const { reloadExtensions } = await import('../../src/server/extensions/ExtensionManager.js');
+function createMockCtx(overrides = {}) {
+    return {
+        config: { mcp: { version: '0.1.0' } },
+        currentTier: 'full',
+        extensionToolsByName: new Map(),
+        extensionPluginsById: new Map(),
+        extensionPluginRuntimeById: new Map(),
+        extensionWorkflowsById: new Map(),
+        extensionWorkflowRuntimeById: new Map(),
+        lastExtensionReloadAt: undefined,
+        activatedToolNames: new Set(),
+        activatedRegisteredTools: new Map(),
+        boostedExtensionToolNames: new Set(),
+        handlerDeps: {},
+        router: {
+            addHandlers: vi.fn(),
+            removeHandler: vi.fn(),
+            has: vi.fn(() => false),
+        },
+        registerSingleTool: vi.fn(() => ({ remove: vi.fn() })),
+        executeToolWithTracking: vi.fn(),
+        ...overrides,
+    };
+}
+describe('ExtensionManager', () => {
+    const originalEnv = { ...process.env };
+    beforeEach(() => {
+        process.env.MCP_PLUGIN_ROOTS = join(__dirname, '__fixtures_nonexistent__');
+        process.env.MCP_WORKFLOW_ROOTS = join(__dirname, '__fixtures_nonexistent__');
+        delete process.env.MCP_PLUGIN_ALLOWED_DIGESTS;
+        delete process.env.MCP_PLUGIN_SIGNATURE_REQUIRED;
+        delete process.env.MCP_PLUGIN_STRICT_LOAD;
+        delete process.env.MCP_PLUGIN_SIGNATURE_SECRET;
+        delete process.env.NODE_ENV;
+    });
+    afterEach(() => {
+        process.env = { ...originalEnv };
+    });
+    describe('strictLoad security gate', () => {
+        it('blocks all plugin loading when strictLoad=true and no allowlist', async () => {
+            process.env.MCP_PLUGIN_STRICT_LOAD = 'true';
+            const ctx = createMockCtx();
+            const result = await reloadExtensions(ctx);
+            expect(result.errors.length).toBeGreaterThan(0);
+            expect(result.errors[0]).toContain('MCP_PLUGIN_ALLOWED_DIGESTS is required');
+            expect(result.addedTools).toBe(0);
+        });
+        it('blocks all plugin loading when signature required and no allowlist', async () => {
+            process.env.MCP_PLUGIN_SIGNATURE_REQUIRED = 'true';
+            const ctx = createMockCtx();
+            const result = await reloadExtensions(ctx);
+            expect(result.errors.length).toBeGreaterThan(0);
+            expect(result.errors[0]).toContain('MCP_PLUGIN_ALLOWED_DIGESTS is required');
+        });
+        it('defaults to strict signature enforcement in production', async () => {
+            process.env.NODE_ENV = 'production';
+            const ctx = createMockCtx();
+            const result = await reloadExtensions(ctx);
+            expect(result.errors.length).toBeGreaterThan(0);
+            expect(result.errors[0]).toContain('MCP_PLUGIN_ALLOWED_DIGESTS is required');
+        });
+        it('allows opting out of production signature enforcement explicitly', async () => {
+            process.env.NODE_ENV = 'production';
+            process.env.MCP_PLUGIN_SIGNATURE_REQUIRED = 'false';
+            process.env.MCP_PLUGIN_STRICT_LOAD = 'false';
+            const ctx = createMockCtx();
+            const result = await reloadExtensions(ctx);
+            const strictErrors = result.errors.filter((e) => e.includes('MCP_PLUGIN_ALLOWED_DIGESTS is required'));
+            expect(strictErrors).toHaveLength(0);
+        });
+        it('proceeds when allowlist is provided with strictLoad', async () => {
+            process.env.MCP_PLUGIN_STRICT_LOAD = 'true';
+            process.env.MCP_PLUGIN_ALLOWED_DIGESTS = 'abc123';
+            const ctx = createMockCtx();
+            const result = await reloadExtensions(ctx);
+            const strictErrors = result.errors.filter((e) => e.includes('MCP_PLUGIN_ALLOWED_DIGESTS is required'));
+            expect(strictErrors).toHaveLength(0);
+        });
+    });
+    describe('empty plugin roots', () => {
+        it('returns zero tools when no plugins are found', async () => {
+            const ctx = createMockCtx();
+            const result = await reloadExtensions(ctx);
+            expect(result.addedTools).toBe(0);
+            expect(result.errors).toHaveLength(0);
+        });
+        it('sets lastExtensionReloadAt timestamp', async () => {
+            const ctx = createMockCtx();
+            await reloadExtensions(ctx);
+            expect(ctx.lastExtensionReloadAt).toBeDefined();
+            expect(typeof ctx.lastExtensionReloadAt).toBe('string');
+        });
+    });
+    describe('concurrent reload mutex', () => {
+        it('serializes concurrent reload calls', async () => {
+            const ctx = createMockCtx();
+            const callOrder = [];
+            const p1 = reloadExtensions(ctx).then((r) => {
+                callOrder.push(1);
+                return r;
+            });
+            const p2 = reloadExtensions(ctx).then((r) => {
+                callOrder.push(2);
+                return r;
+            });
+            const [r1, r2] = await Promise.all([p1, p2]);
+            expect(r1.errors).toHaveLength(0);
+            expect(r2.errors).toHaveLength(0);
+            expect(callOrder).toHaveLength(2);
+        });
+    });
+});

package/dist/tests/server/MCPServer.boost.test.d.ts

@@ -0,0 +1 @@
+export {};