@jshookmcp/jshook 0.1.9 → 0.2.1

package/dist/tests/server/extensions/ExtensionManager.integrity.test.js

@@ -0,0 +1,83 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => {
+    const digest = vi.fn(() => 'abc123');
+    const update = vi.fn(() => ({ digest }));
+    const createHash = vi.fn(() => ({ update }));
+    return {
+        readFile: vi.fn(),
+        createHash,
+        update,
+        digest,
+        isCompatibleVersion: vi.fn(),
+    };
+});
+vi.mock('node:fs/promises', () => ({
+    readFile: state.readFile,
+}));
+vi.mock('node:crypto', () => ({
+    createHash: state.createHash,
+}));
+vi.mock('@server/extensions/ExtensionManager.version', () => ({
+    isCompatibleVersion: state.isCompatibleVersion,
+}));
+describe('ExtensionManager.integrity', () => {
+    const originalEnv = { ...process.env };
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+        state.readFile.mockReset();
+        state.createHash.mockClear();
+        state.update.mockClear();
+        state.digest.mockClear();
+        state.isCompatibleVersion.mockReset();
+    });
+    afterEach(() => {
+        process.env = { ...originalEnv };
+    });
+    it('hashes plugin file content as sha256 hex', async () => {
+        state.readFile.mockResolvedValue(Buffer.from('plugin'));
+        const { sha256Hex } = await import('../../../src/server/extensions/ExtensionManager.integrity.js');
+        await expect(sha256Hex('/tmp/plugin.js')).resolves.toBe('abc123');
+        expect(state.createHash).toHaveBeenCalledWith('sha256');
+        expect(state.update).toHaveBeenCalledWith(Buffer.from('plugin'));
+        expect(state.digest).toHaveBeenCalledWith('hex');
+    });
+    it('normalizes hex digests and parses allowlists', async () => {
+        const { normalizeHex, parseDigestAllowlist } = await import('../../../src/server/extensions/ExtensionManager.integrity.js');
+        expect(normalizeHex(' 0xABCDEF ')).toBe('abcdef');
+        expect(parseDigestAllowlist(' 0xABC , def ,, abc ')).toEqual(new Set(['abc', 'def']));
+        expect(parseDigestAllowlist('')).toEqual(new Set());
+    });
+    it('derives signature and strict-load flags from env and production defaults', async () => {
+        const { isPluginSignatureRequired, isPluginStrictLoad, } = await import('../../../src/server/extensions/ExtensionManager.integrity.js');
+        process.env.NODE_ENV = 'production';
+        delete process.env.MCP_PLUGIN_SIGNATURE_REQUIRED;
+        delete process.env.MCP_PLUGIN_STRICT_LOAD;
+        expect(isPluginSignatureRequired()).toBe(true);
+        expect(isPluginStrictLoad()).toBe(true);
+        process.env.MCP_PLUGIN_SIGNATURE_REQUIRED = 'false';
+        process.env.MCP_PLUGIN_STRICT_LOAD = '0';
+        expect(isPluginSignatureRequired()).toBe(false);
+        expect(isPluginStrictLoad()).toBe(false);
+        process.env.MCP_PLUGIN_SIGNATURE_REQUIRED = 'true';
+        process.env.MCP_PLUGIN_STRICT_LOAD = 'false';
+        expect(isPluginStrictLoad()).toBe(true);
+    });
+    it('reports plugin incompatibility from version checks', async () => {
+        state.isCompatibleVersion.mockReturnValueOnce(false).mockReturnValueOnce(true);
+        const { verifyPluginIntegrity } = await import('../../../src/server/extensions/ExtensionManager.integrity.js');
+        const plugin = {
+            id: 'sample-plugin',
+            getCompatibleCore: '^2.0.0',
+        };
+        await expect(verifyPluginIntegrity(plugin, '1.0.0')).resolves.toEqual({
+            ok: false,
+            errors: ['Plugin sample-plugin incompatible with core 1.0.0; requires ^2.0.0'],
+            warnings: [],
+        });
+        await expect(verifyPluginIntegrity(plugin, '2.1.0')).resolves.toEqual({
+            ok: true,
+            errors: [],
+            warnings: [],
+        });
+    });
+});

package/dist/tests/server/extensions/ExtensionManager.lifecycle.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/extensions/ExtensionManager.lifecycle.test.js

@@ -0,0 +1,140 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    logger: {
+        debug: vi.fn(),
+        warn: vi.fn(),
+    },
+    pathToFileURL: vi.fn((value) => ({ href: `file://${value.replace(/\\/g, '/')}` })),
+}));
+vi.mock('@utils/logger', () => ({
+    logger: state.logger,
+}));
+vi.mock('node:url', () => ({
+    pathToFileURL: state.pathToFileURL,
+}));
+describe('ExtensionManager.lifecycle', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('extracts nested config values and falls back safely', async () => {
+        const { extractConfigValue } = await import('../../../src/server/extensions/ExtensionManager.lifecycle.js');
+        const ctx = {
+            config: {
+                plugins: {
+                    sample: {
+                        enabled: true,
+                    },
+                },
+            },
+        };
+        expect(extractConfigValue(ctx, 'plugins.sample.enabled', false)).toBe(true);
+        expect(extractConfigValue(ctx, 'plugins.sample.missing', 'fallback')).toBe('fallback');
+        expect(extractConfigValue({ config: null }, 'plugins.sample.enabled', false)).toBe(false);
+    });
+    it('creates a fresh file URL with reloadTs and logs the load', async () => {
+        vi.spyOn(Date, 'now').mockReturnValue(12345);
+        const { createFreshImportUrl } = await import('../../../src/server/extensions/ExtensionManager.lifecycle.js');
+        const result = createFreshImportUrl('D:\\plugin\\manifest.ts', 'plugin');
+        expect(result).toContain('file:///D:/plugin/manifest.ts');
+        expect(result).toContain('reloadTs=12345');
+        expect(state.logger.debug).toHaveBeenCalledWith('[extensions] Loading fresh plugin module: D:\\plugin\\manifest.ts');
+    });
+    it('clears loaded extension tools and tolerates deactivation or removal failures', async () => {
+        const { clearLoadedExtensionTools } = await import('../../../src/server/extensions/ExtensionManager.lifecycle.js');
+        const deactivateOk = vi.fn(async () => undefined);
+        const deactivateFail = vi.fn(async () => {
+            throw new Error('deactivate failed');
+        });
+        const removeOk = vi.fn();
+        const removeFail = vi.fn(() => {
+            throw new Error('remove failed');
+        });
+        const ctx = {
+            extensionPluginRuntimeById: new Map([
+                [
+                    'ok-plugin',
+                    {
+                        plugin: { onDeactivateHandler: deactivateOk },
+                        lifecycleContext: { pluginId: 'ok-plugin' },
+                        state: 'activated',
+                    },
+                ],
+                [
+                    'fail-plugin',
+                    {
+                        plugin: { onDeactivateHandler: deactivateFail },
+                        lifecycleContext: { pluginId: 'fail-plugin' },
+                        state: 'activated',
+                    },
+                ],
+            ]),
+            extensionToolsByName: new Map([
+                [
+                    'tool-a',
+                    {
+                        name: 'tool-a',
+                        registeredTool: { remove: removeOk },
+                    },
+                ],
+                [
+                    'tool-b',
+                    {
+                        name: 'tool-b',
+                        registeredTool: { remove: removeFail },
+                    },
+                ],
+            ]),
+            extensionPluginsById: new Map([['plugin', {}]]),
+            extensionWorkflowsById: new Map([['workflow', {}]]),
+            extensionWorkflowRuntimeById: new Map([['workflow', {}]]),
+            activatedToolNames: new Set(['tool-a', 'tool-b']),
+            activatedRegisteredTools: new Map([
+                ['tool-a', {}],
+                ['tool-b', {}],
+            ]),
+            router: {
+                removeHandler: vi.fn(),
+            },
+        };
+        await expect(clearLoadedExtensionTools(ctx)).resolves.toBe(2);
+        expect(deactivateOk).toHaveBeenCalled();
+        expect(deactivateFail).toHaveBeenCalled();
+        expect(removeOk).toHaveBeenCalled();
+        expect(removeFail).toHaveBeenCalled();
+        expect(ctx.router.removeHandler).toHaveBeenCalledTimes(2);
+        expect(ctx.extensionToolsByName.size).toBe(0);
+        expect(ctx.extensionPluginRuntimeById.size).toBe(0);
+        expect(ctx.extensionPluginsById.size).toBe(0);
+        expect(ctx.extensionWorkflowsById.size).toBe(0);
+        expect(ctx.extensionWorkflowRuntimeById.size).toBe(0);
+        expect(ctx.activatedToolNames.size).toBe(0);
+        expect(ctx.activatedRegisteredTools.size).toBe(0);
+        expect(state.logger.warn).toHaveBeenCalled();
+    });
+    it('builds list results from current extension maps', async () => {
+        const { buildListResult } = await import('../../../src/server/extensions/ExtensionManager.lifecycle.js');
+        const ctx = {
+            extensionPluginsById: new Map([
+                ['plugin-a', { id: 'plugin-a', name: 'Plugin A' }],
+            ]),
+            extensionWorkflowsById: new Map([
+                ['workflow-a', { id: 'workflow-a', displayName: 'Workflow A' }],
+            ]),
+            extensionToolsByName: new Map([
+                ['tool-a', { name: 'tool-a', domain: 'browser', source: '/plugin/tool-a' }],
+            ]),
+            lastExtensionReloadAt: '2026-03-15T00:00:00.000Z',
+        };
+        expect(buildListResult(ctx, ['/plugins'], ['/workflows'])).toEqual({
+            pluginRoots: ['/plugins'],
+            workflowRoots: ['/workflows'],
+            pluginCount: 1,
+            workflowCount: 1,
+            toolCount: 1,
+            lastReloadAt: '2026-03-15T00:00:00.000Z',
+            plugins: [{ id: 'plugin-a', name: 'Plugin A' }],
+            workflows: [{ id: 'workflow-a', displayName: 'Workflow A' }],
+            tools: [{ name: 'tool-a', domain: 'browser', source: '/plugin/tool-a' }],
+        });
+    });
+});

package/dist/tests/server/extensions/ExtensionManager.roots.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/extensions/ExtensionManager.roots.test.js

@@ -0,0 +1,24 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { resolve, sep } from 'node:path';
+import { DEFAULT_PLUGIN_ROOTS, DEFAULT_WORKFLOW_ROOTS, parseRoots, resolveRoots, } from '../../../src/server/extensions/ExtensionManager.roots.js';
+describe('ExtensionManager.roots', () => {
+    beforeEach(() => {
+    });
+    it('exposes default plugin and workflow roots', () => {
+        expect(DEFAULT_PLUGIN_ROOTS.length).toBeGreaterThan(0);
+        expect(DEFAULT_PLUGIN_ROOTS.some((item) => item.includes('plugins'))).toBe(true);
+        expect(DEFAULT_WORKFLOW_ROOTS.some((item) => item.includes('workflows'))).toBe(true);
+    });
+    it('parses comma separated roots and removes duplicates', () => {
+        expect(parseRoots(undefined, ['fallback'])).toEqual(['fallback']);
+        expect(parseRoots(' alpha, beta ,alpha,, ', ['fallback'])).toEqual(['alpha', 'beta']);
+    });
+    it('resolves relative paths, preserves absolute ones, deduplicates, and sorts', () => {
+        const absolutePath = resolve('/absolute');
+        const resolved = resolveRoots(['b', 'a', 'b', absolutePath]);
+        expect(resolved).toContain(absolutePath);
+        expect(resolved.some((item) => item.endsWith(`${sep}a`))).toBe(true);
+        expect(resolved.some((item) => item.endsWith(`${sep}b`))).toBe(true);
+        expect(new Set(resolved).size).toBe(resolved.length);
+    });
+});

package/dist/tests/server/extensions/ExtensionManager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/extensions/ExtensionManager.test.js

@@ -0,0 +1,269 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    allTools: [{ name: 'allowed_tool' }, { name: 'other_tool' }],
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+    parseRoots: vi.fn((raw, fallback) => (raw ? [raw] : fallback)),
+    resolveRoots: vi.fn((roots) => roots.map((root) => `resolved:${root}`)),
+    sha256Hex: vi.fn(),
+    normalizeHex: vi.fn((value) => value.trim().toLowerCase()),
+    isPluginStrictLoad: vi.fn(),
+    parseDigestAllowlist: vi.fn(),
+    verifyPluginIntegrity: vi.fn(),
+    isExtensionBuilder: vi.fn(),
+    isWorkflowContract: vi.fn(),
+    discoverPluginFiles: vi.fn(),
+    discoverWorkflowFiles: vi.fn(),
+    extractConfigValue: vi.fn(),
+    createFreshImportUrl: vi.fn(),
+    clearLoadedExtensionTools: vi.fn(),
+    buildListResult: vi.fn(),
+}));
+vi.mock('@server/ToolCatalog', () => ({
+    allTools: state.allTools,
+}));
+vi.mock('@utils/logger', () => ({
+    logger: state.logger,
+}));
+vi.mock('@server/extensions/ExtensionManager.roots', () => ({
+    DEFAULT_PLUGIN_ROOTS: ['default-plugin-root'],
+    DEFAULT_WORKFLOW_ROOTS: ['default-workflow-root'],
+    parseRoots: state.parseRoots,
+    resolveRoots: state.resolveRoots,
+}));
+vi.mock('@server/extensions/ExtensionManager.integrity', () => ({
+    sha256Hex: state.sha256Hex,
+    normalizeHex: state.normalizeHex,
+    isPluginStrictLoad: state.isPluginStrictLoad,
+    parseDigestAllowlist: state.parseDigestAllowlist,
+    verifyPluginIntegrity: state.verifyPluginIntegrity,
+}));
+vi.mock('@server/extensions/ExtensionManager.guards', () => ({
+    isExtensionBuilder: state.isExtensionBuilder,
+    isWorkflowContract: state.isWorkflowContract,
+}));
+vi.mock('@server/extensions/ExtensionManager.discovery', () => ({
+    discoverPluginFiles: state.discoverPluginFiles,
+    discoverWorkflowFiles: state.discoverWorkflowFiles,
+}));
+vi.mock('@server/extensions/ExtensionManager.lifecycle', () => ({
+    extractConfigValue: state.extractConfigValue,
+    createFreshImportUrl: state.createFreshImportUrl,
+    clearLoadedExtensionTools: state.clearLoadedExtensionTools,
+    buildListResult: state.buildListResult,
+}));
+function makeDataModule(source) {
+    return `data:text/javascript,${encodeURIComponent(source)}`;
+}
+function createCtx(overrides = {}) {
+    return {
+        config: {
+            mcp: {
+                version: '1.2.3',
+            },
+        },
+        baseTier: 'workflow',
+        extensionToolsByName: new Map(),
+        extensionPluginsById: new Map(),
+        extensionPluginRuntimeById: new Map(),
+        extensionWorkflowsById: new Map(),
+        extensionWorkflowRuntimeById: new Map(),
+        activatedToolNames: new Set(),
+        activatedRegisteredTools: new Map(),
+        router: {
+            has: vi.fn(() => false),
+            removeHandler: vi.fn(),
+        },
+        executeToolWithTracking: vi.fn(async (name, args) => ({
+            content: [{ type: 'text', text: JSON.stringify({ success: true, name, args }) }],
+        })),
+        server: {
+            sendToolListChanged: vi.fn(async () => undefined),
+        },
+        ...overrides,
+    };
+}
+describe('ExtensionManager', () => {
+    const originalEnv = { ...process.env };
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+        delete globalThis.__pluginCtx;
+        delete globalThis.__rolledBack;
+        vi.resetModules();
+        vi.clearAllMocks();
+        state.parseDigestAllowlist.mockReturnValue(new Set());
+        state.isPluginStrictLoad.mockReturnValue(false);
+        state.clearLoadedExtensionTools.mockResolvedValue(0);
+        state.discoverPluginFiles.mockResolvedValue([]);
+        state.discoverWorkflowFiles.mockResolvedValue([]);
+        state.buildListResult.mockImplementation((ctx, pluginRoots, workflowRoots) => ({
+            pluginRoots,
+            workflowRoots,
+            pluginCount: ctx.extensionPluginsById.size,
+            workflowCount: ctx.extensionWorkflowsById.size,
+            toolCount: ctx.extensionToolsByName.size,
+            lastReloadAt: ctx.lastExtensionReloadAt,
+            plugins: [...ctx.extensionPluginsById.values()],
+            workflows: [...ctx.extensionWorkflowsById.values()],
+            tools: [...ctx.extensionToolsByName.values()],
+        }));
+        state.extractConfigValue.mockImplementation((ctx, path, fallback) => {
+            const segments = path.split('.');
+            let current = ctx.config;
+            for (const segment of segments) {
+                current =
+                    current && typeof current === 'object'
+                        ? current[segment]
+                        : undefined;
+            }
+            return current ?? fallback;
+        });
+        state.isExtensionBuilder.mockImplementation((value) => !!value &&
+            typeof value === 'object' &&
+            typeof value.id === 'string' &&
+            Array.isArray(value.tools));
+        state.isWorkflowContract.mockImplementation((value) => !!value &&
+            typeof value === 'object' &&
+            value.kind === 'workflow-contract' &&
+            typeof value.build === 'function');
+        state.sha256Hex.mockResolvedValue('digest-1');
+        state.verifyPluginIntegrity.mockResolvedValue({ ok: true, warnings: [], errors: [] });
+        state.createFreshImportUrl.mockImplementation((_modulePath, kind) => {
+            if (kind === 'workflow') {
+                return makeDataModule(`
+          export default {
+            kind: 'workflow-contract',
+            version: 1,
+            id: 'wf-1',
+            displayName: 'Workflow One',
+            build() {
+              return { kind: 'sequence', id: 'root', steps: [] };
+            },
+          };
+        `);
+            }
+            return makeDataModule(`
+        export default {
+          id: 'plugin-1',
+          version: '1.0.0',
+          getName: 'Plugin One',
+          getCompatibleCore: '^1.0.0',
+          allowTools: ['allowed_tool', 'missing_builtin'],
+          tools: [],
+          async onLoadHandler(ctx) {
+            globalThis.__pluginCtx = ctx;
+          },
+          async onActivateHandler() {},
+        };
+      `);
+        });
+    });
+    afterEach(() => {
+        process.env = { ...originalEnv };
+        vi.restoreAllMocks();
+    });
+    it('uses resolved roots and delegates list construction', async () => {
+        process.env.MCP_PLUGIN_ROOTS = 'custom-plugins';
+        process.env.MCP_WORKFLOW_ROOTS = 'custom-workflows';
+        const ctx = createCtx();
+        const { listExtensions } = await import('../../../src/server/extensions/ExtensionManager.js');
+        const result = listExtensions(ctx);
+        expect(state.parseRoots).toHaveBeenNthCalledWith(1, 'custom-plugins', ['default-plugin-root']);
+        expect(state.parseRoots).toHaveBeenNthCalledWith(2, 'custom-workflows', ['default-workflow-root']);
+        expect(state.resolveRoots).toHaveBeenNthCalledWith(1, ['custom-plugins']);
+        expect(state.resolveRoots).toHaveBeenNthCalledWith(2, ['custom-workflows']);
+        expect(state.buildListResult).toHaveBeenCalledWith(ctx, ['resolved:custom-plugins'], ['resolved:custom-workflows']);
+        expect(result.pluginRoots).toEqual(['resolved:custom-plugins']);
+        expect(result.workflowRoots).toEqual(['resolved:custom-workflows']);
+    });
+    it('blocks plugin loading in strict mode without an allowlist but still loads workflows', async () => {
+        state.isPluginStrictLoad.mockReturnValue(true);
+        state.discoverWorkflowFiles.mockResolvedValue(['/workflows/wf-1.ts']);
+        const ctx = createCtx();
+        const { reloadExtensions } = await import('../../../src/server/extensions/ExtensionManager.js');
+        const result = await reloadExtensions(ctx);
+        expect(result.addedTools).toBe(0);
+        expect(result.errors[0]).toContain('MCP_PLUGIN_ALLOWED_DIGESTS is required');
+        expect(result.workflowCount).toBe(1);
+        expect(ctx.extensionWorkflowsById.has('wf-1')).toBe(true);
+        expect(ctx.lastExtensionReloadAt).toBeDefined();
+        expect(state.logger.error).toHaveBeenCalled();
+        expect(state.discoverPluginFiles).not.toHaveBeenCalled();
+    });
+    it('warns when loading without an allowlist in non-strict mode', async () => {
+        const ctx = createCtx();
+        const { reloadExtensions } = await import('../../../src/server/extensions/ExtensionManager.js');
+        const result = await reloadExtensions(ctx);
+        expect(result.errors).toEqual([]);
+        expect(state.logger.warn).toHaveBeenCalledWith(expect.stringContaining('WITHOUT MCP_PLUGIN_ALLOWED_DIGESTS allowlist'));
+    });
+    it('builds plugin lifecycle context and enforces invokeTool restrictions', async () => {
+        state.discoverPluginFiles.mockResolvedValue(['/plugins/plugin-1.ts']);
+        const ctx = createCtx();
+        const { reloadExtensions } = await import('../../../src/server/extensions/ExtensionManager.js');
+        const result = await reloadExtensions(ctx);
+        const lifecycleContext = globalThis.__pluginCtx;
+        expect(result.pluginCount).toBe(1);
+        expect(ctx.extensionPluginsById.has('plugin-1')).toBe(true);
+        expect(lifecycleContext).toBeDefined();
+        await expect(lifecycleContext.invokeTool('')).rejects.toThrow('invokeTool requires a non-empty tool name');
+        await expect(lifecycleContext.invokeTool('denied_tool')).rejects.toThrow('Plugin "plugin-1" is not allowed to invoke "denied_tool".');
+        await expect(lifecycleContext.invokeTool('missing_builtin')).rejects.toThrow('can only invoke built-in tools');
+        ctx.router.has.mockReturnValueOnce(false).mockReturnValueOnce(true);
+        await expect(lifecycleContext.invokeTool('allowed_tool')).rejects.toThrow('Tool "allowed_tool" is not available in the current active profile.');
+        await expect(lifecycleContext.invokeTool('allowed_tool', { hello: 'world' })).resolves.toEqual({
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({ success: true, name: 'allowed_tool', args: { hello: 'world' } }),
+                },
+            ],
+        });
+        expect(lifecycleContext.getConfig('mcp.version', 'missing')).toBe('1.2.3');
+        lifecycleContext.setRuntimeData('flag', 42);
+        expect(lifecycleContext.getRuntimeData('flag')).toBe(42);
+    });
+    it('rolls back activated plugins when activation fails', async () => {
+        state.discoverPluginFiles.mockResolvedValue(['/plugins/plugin-bad.ts']);
+        state.createFreshImportUrl.mockImplementationOnce(() => makeDataModule(`
+        export default {
+          id: 'plugin-bad',
+          version: '1.0.0',
+          getName: 'Plugin Bad',
+          getCompatibleCore: '^1.0.0',
+          allowTools: ['*'],
+          tools: [],
+          async onActivateHandler() {
+            throw new Error('activate failed');
+          },
+          async onDeactivateHandler() {
+            globalThis.__rolledBack = true;
+          },
+        };
+      `));
+        const ctx = createCtx();
+        const { reloadExtensions } = await import('../../../src/server/extensions/ExtensionManager.js');
+        const result = await reloadExtensions(ctx);
+        expect(result.errors).toEqual([
+            expect.stringContaining('Plugin lifecycle failed for plugin-bad: Error: activate failed'),
+        ]);
+        expect(globalThis.__rolledBack).toBeUndefined();
+        expect(ctx.extensionPluginsById.size).toBe(0);
+    });
+    it('releases the reload mutex after a failure so later reloads can proceed', async () => {
+        state.clearLoadedExtensionTools
+            .mockRejectedValueOnce(new Error('cleanup failed'))
+            .mockResolvedValueOnce(0);
+        const ctx = createCtx();
+        const { reloadExtensions } = await import('../../../src/server/extensions/ExtensionManager.js');
+        await expect(reloadExtensions(ctx)).rejects.toThrow('cleanup failed');
+        await expect(reloadExtensions(ctx)).resolves.toMatchObject({
+            addedTools: 0,
+            removedTools: 0,
+        });
+    });
+});

package/dist/tests/server/extensions/ExtensionManager.version.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/extensions/ExtensionManager.version.test.js

@@ -0,0 +1,35 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { compareVersion, isCompatibleVersion, parseVersionParts, } from '../../../src/server/extensions/ExtensionManager.version.js';
+describe('ExtensionManager.version', () => {
+    beforeEach(() => {
+    });
+    it('parses normal and metadata versions', () => {
+        expect(parseVersionParts('1.2.3')).toEqual([1, 2, 3]);
+        expect(parseVersionParts('1.2.3-beta+build')).toEqual([1, 2, 3]);
+    });
+    it('rejects invalid version strings', () => {
+        expect(parseVersionParts('1.2')).toBeNull();
+        expect(parseVersionParts('v1.2.3')).toBeNull();
+        expect(parseVersionParts('')).toBeNull();
+    });
+    it('compares versions correctly', () => {
+        expect(compareVersion('1.2.3', '1.2.3')).toBe(0);
+        expect(compareVersion('1.3.0', '1.2.9')).toBe(1);
+        expect(compareVersion('1.2.2', '1.2.3')).toBe(-1);
+        expect(compareVersion('bad', '1.2.3')).toBeNull();
+    });
+    it('supports wildcard, exact, and >= ranges', () => {
+        expect(isCompatibleVersion('*', '9.9.9')).toBe(true);
+        expect(isCompatibleVersion('', '9.9.9')).toBe(true);
+        expect(isCompatibleVersion('1.2.3', '1.2.3')).toBe(true);
+        expect(isCompatibleVersion('>=1.2.3', '1.2.4')).toBe(true);
+        expect(isCompatibleVersion('>=1.2.3', '1.2.2')).toBe(false);
+    });
+    it('supports caret and tilde ranges', () => {
+        expect(isCompatibleVersion('^1.2.3', '1.9.0')).toBe(true);
+        expect(isCompatibleVersion('^1.2.3', '2.0.0')).toBe(false);
+        expect(isCompatibleVersion('~1.2.3', '1.2.9')).toBe(true);
+        expect(isCompatibleVersion('~1.2.3', '1.3.0')).toBe(false);
+        expect(isCompatibleVersion('^bad', '1.2.3')).toBe(false);
+    });
+});

package/dist/tests/server/extensions/plugin-config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/extensions/plugin-config.test.js

@@ -0,0 +1,40 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { getPluginBooleanConfig, getPluginBoostTier, } from '../../../src/server/extensions/plugin-config.js';
+describe('plugin-config', () => {
+    const originalEnv = { ...process.env };
+    const ctx = {
+        getConfig: vi.fn(),
+    };
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+        ctx.getConfig.mockReset();
+    });
+    afterEach(() => {
+        process.env = { ...originalEnv };
+    });
+    it('prefers plugin-scoped env booleans over config values', () => {
+        process.env.PLUGIN_IDA_BRIDGE_FEATURE_FLAG = 'yes';
+        ctx.getConfig.mockReturnValue(false);
+        expect(getPluginBooleanConfig(ctx, 'ida-bridge', 'feature flag', false)).toBe(true);
+        expect(ctx.getConfig).not.toHaveBeenCalled();
+    });
+    it('falls back to context config when env boolean is invalid', () => {
+        process.env.PLUGINS_IDA_BRIDGE_FEATURE_FLAG = 'maybe';
+        ctx.getConfig.mockReturnValue(true);
+        expect(getPluginBooleanConfig(ctx, 'ida-bridge', 'feature flag', false)).toBe(true);
+        expect(ctx.getConfig).toHaveBeenCalledWith('plugins.ida-bridge.feature flag', false);
+    });
+    it('supports false-like env boolean values', () => {
+        process.env.PLUGINS_IDA_BRIDGE_FEATURE_FLAG = 'off';
+        expect(getPluginBooleanConfig(ctx, 'ida-bridge', 'feature flag', true)).toBe(false);
+    });
+    it('resolves boost tier from plugin env, global env, or fallback', () => {
+        process.env.PLUGIN_IDA_BRIDGE_BOOST_DOMAIN = 'workflow';
+        expect(getPluginBoostTier('ida-bridge')).toBe('workflow');
+        delete process.env.PLUGIN_IDA_BRIDGE_BOOST_DOMAIN;
+        process.env.MCP_DEFAULT_PLUGIN_BOOST_TIER = 'search';
+        expect(getPluginBoostTier('ida-bridge')).toBe('search');
+        process.env.MCP_DEFAULT_PLUGIN_BOOST_TIER = 'invalid';
+        expect(getPluginBoostTier('ida-bridge')).toBe('full');
+    });
+});

package/dist/tests/server/extensions/plugin-env.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/extensions/plugin-env.test.js

@@ -0,0 +1,50 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    existsSync: vi.fn(),
+    config: vi.fn(),
+    dirname: vi.fn(() => '/plugins/sample'),
+    join: vi.fn((_dir, file) => `/plugins/sample/${file}`),
+    fileURLToPath: vi.fn(() => '/plugins/sample/manifest.ts'),
+}));
+vi.mock('node:fs', () => ({
+    existsSync: state.existsSync,
+}));
+vi.mock('node:path', () => ({
+    dirname: state.dirname,
+    join: state.join,
+}));
+vi.mock('node:url', () => ({
+    fileURLToPath: state.fileURLToPath,
+}));
+vi.mock('dotenv', () => ({
+    default: {
+        config: state.config,
+    },
+}));
+describe('plugin-env', () => {
+    beforeEach(() => {
+        vi.resetModules();
+        state.existsSync.mockReset();
+        state.config.mockReset();
+        state.dirname.mockClear();
+        state.join.mockClear();
+        state.fileURLToPath.mockClear();
+    });
+    it('loads a plugin-local .env file once', async () => {
+        state.existsSync.mockReturnValue(true);
+        const { loadPluginEnv } = await import('../../../src/server/extensions/plugin-env.js');
+        loadPluginEnv('file:///plugins/sample/manifest.ts');
+        loadPluginEnv('file:///plugins/sample/manifest.ts');
+        expect(state.config).toHaveBeenCalledTimes(1);
+        expect(state.config).toHaveBeenCalledWith({
+            path: '/plugins/sample/.env',
+            override: false,
+        });
+    });
+    it('skips dotenv when the .env file does not exist', async () => {
+        state.existsSync.mockReturnValue(false);
+        const { loadPluginEnv } = await import('../../../src/server/extensions/plugin-env.js');
+        loadPluginEnv('file:///plugins/sample/manifest.ts');
+        expect(state.config).not.toHaveBeenCalled();
+    });
+});

package/dist/tests/server/http/HttpMiddleware.ratelimit.test.d.ts

@@ -0,0 +1 @@
+export {};