@jshookmcp/jshook 0.1.9 → 0.2.1

package/dist/tests/server/http/HttpMiddleware.ratelimit.test.js

@@ -0,0 +1,139 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+function mockReq(overrides = {}) {
+    return {
+        headers: {},
+        socket: { remoteAddress: '10.0.0.1' },
+        ...overrides,
+    };
+}
+function mockRes() {
+    const res = {
+        _status: undefined,
+        _body: undefined,
+        _headers: {},
+        writeHead(status, headers) {
+            res._status = status;
+            if (headers)
+                res._headers = headers;
+            return res;
+        },
+        end(body, cb) {
+            res._body = body;
+            if (typeof cb === 'function')
+                cb();
+            return res;
+        },
+    };
+    return res;
+}
+describe('HttpMiddleware rate-limit and proxy tests', () => {
+    const originalEnv = { ...process.env };
+    beforeEach(() => {
+        vi.resetModules();
+        process.env = { ...originalEnv };
+        process.env.MCP_RATE_LIMIT_MAX = '3';
+        process.env.MCP_RATE_LIMIT_WINDOW_MS = '60000';
+        delete process.env.MCP_RATE_LIMIT_ENABLED;
+        delete process.env.MCP_TRUST_PROXY;
+        delete process.env.MCP_AUTH_TOKEN;
+        delete process.env.MCP_HOST;
+    });
+    afterEach(() => {
+        process.env = { ...originalEnv };
+    });
+    it('returns 429 when rate limit is exceeded', async () => {
+        const { checkRateLimit } = await import('../../../src/server/http/HttpMiddleware.js');
+        const ip = '192.168.1.100';
+        for (let i = 0; i < 3; i++) {
+            const req = mockReq({ socket: { remoteAddress: ip } });
+            const res = mockRes();
+            expect(checkRateLimit(req, res)).toBe(true);
+        }
+        const req = mockReq({ socket: { remoteAddress: ip } });
+        const res = mockRes();
+        expect(checkRateLimit(req, res)).toBe(false);
+        expect(res._status).toBe(429);
+        expect(res._body).toContain('Too Many Requests');
+        expect(res._headers?.['Retry-After']).toBeDefined();
+    });
+    it('authenticated users get 3x rate limit', async () => {
+        const { checkRateLimit } = await import('../../../src/server/http/HttpMiddleware.js');
+        const ip = '192.168.1.200';
+        for (let i = 0; i < 9; i++) {
+            const req = mockReq({ socket: { remoteAddress: ip } });
+            const res = mockRes();
+            expect(checkRateLimit(req, res, true)).toBe(true);
+        }
+        const req = mockReq({ socket: { remoteAddress: ip } });
+        const res = mockRes();
+        expect(checkRateLimit(req, res, true)).toBe(false);
+        expect(res._status).toBe(429);
+    });
+    it('uses X-Forwarded-For when MCP_TRUST_PROXY is set', async () => {
+        process.env.MCP_TRUST_PROXY = 'true';
+        const { checkRateLimit } = await import('../../../src/server/http/HttpMiddleware.js');
+        for (let i = 0; i < 3; i++) {
+            const req = mockReq({
+                headers: { 'x-forwarded-for': '1.2.3.4, 5.6.7.8' },
+                socket: { remoteAddress: '127.0.0.1' },
+            });
+            const res = mockRes();
+            expect(checkRateLimit(req, res)).toBe(true);
+        }
+        const req = mockReq({
+            headers: { 'x-forwarded-for': '1.2.3.4' },
+            socket: { remoteAddress: '127.0.0.1' },
+        });
+        const res = mockRes();
+        expect(checkRateLimit(req, res)).toBe(false);
+        expect(res._status).toBe(429);
+    });
+    it('ignores X-Forwarded-For when MCP_TRUST_PROXY is not set', async () => {
+        const { checkRateLimit } = await import('../../../src/server/http/HttpMiddleware.js');
+        const ip = '10.0.0.50';
+        for (let i = 0; i < 3; i++) {
+            const req = mockReq({
+                headers: { 'x-forwarded-for': 'different-ip-' + i },
+                socket: { remoteAddress: ip },
+            });
+            const res = mockRes();
+            expect(checkRateLimit(req, res)).toBe(true);
+        }
+        const req = mockReq({
+            headers: { 'x-forwarded-for': 'another-unique-ip' },
+            socket: { remoteAddress: ip },
+        });
+        const res = mockRes();
+        expect(checkRateLimit(req, res)).toBe(false);
+        expect(res._status).toBe(429);
+    });
+    it('uses X-Forwarded-For array format', async () => {
+        process.env.MCP_TRUST_PROXY = '1';
+        const { checkRateLimit } = await import('../../../src/server/http/HttpMiddleware.js');
+        const req = mockReq({
+            headers: { 'x-forwarded-for': ['9.9.9.9', '8.8.8.8'] },
+            socket: { remoteAddress: '127.0.0.1' },
+        });
+        const res = mockRes();
+        expect(checkRateLimit(req, res)).toBe(true);
+    });
+    it('falls back to socket.remoteAddress when unknown', async () => {
+        const { checkRateLimit } = await import('../../../src/server/http/HttpMiddleware.js');
+        const req = mockReq({
+            socket: { remoteAddress: undefined },
+        });
+        const res = mockRes();
+        expect(checkRateLimit(req, res)).toBe(true);
+    });
+    it('different IPs have independent rate limits', async () => {
+        const { checkRateLimit } = await import('../../../src/server/http/HttpMiddleware.js');
+        for (let i = 0; i < 3; i++) {
+            const req = mockReq({ socket: { remoteAddress: '10.0.0.1' } });
+            const res = mockRes();
+            checkRateLimit(req, res);
+        }
+        const req = mockReq({ socket: { remoteAddress: '10.0.0.2' } });
+        const res = mockRes();
+        expect(checkRateLimit(req, res)).toBe(true);
+    });
+});

package/dist/tests/server/http/HttpMiddleware.test.js

@@ -148,5 +148,119 @@ describe('HttpMiddleware', () => {
             await expect(readBodyWithLimit(req, res, 1024)).rejects.toThrow('body_too_large');
             expect(res._status).toBe(413);
         });
+        it('parses valid JSON body', async () => {
+            const handlers = {};
+            const req = mockReq({ headers: {} });
+            req.on = vi.fn((event, cb) => {
+                handlers[event] = cb;
+            });
+            req.destroy = vi.fn();
+            const res = mockRes();
+            const promise = readBodyWithLimit(req, res, 10240);
+            handlers['data'](Buffer.from('{"key":"value"}'));
+            handlers['end']();
+            const body = await promise;
+            expect(body).toEqual({ key: 'value' });
+        });
+        it('rejects invalid JSON body with 400', async () => {
+            const handlers = {};
+            const req = mockReq({ headers: {} });
+            req.on = vi.fn((event, cb) => {
+                handlers[event] = cb;
+            });
+            const res = mockRes();
+            const promise = readBodyWithLimit(req, res, 10240);
+            handlers['data'](Buffer.from('not-json'));
+            handlers['end']();
+            await expect(promise).rejects.toThrow('invalid_json');
+            expect(res._status).toBe(400);
+        });
+        it('rejects body exceeding limit during streaming', async () => {
+            const handlers = {};
+            const req = mockReq({ headers: {} });
+            req.on = vi.fn((event, cb) => {
+                handlers[event] = cb;
+            });
+            req.destroy = vi.fn();
+            const res = mockRes();
+            const promise = readBodyWithLimit(req, res, 10);
+            handlers['data'](Buffer.from('a'.repeat(20)));
+            await expect(promise).rejects.toThrow('body_too_large');
+            expect(res._status).toBe(413);
+        });
+        it('rejects on request error event', async () => {
+            const handlers = {};
+            const req = mockReq({ headers: {} });
+            req.on = vi.fn((event, cb) => {
+                handlers[event] = cb;
+            });
+            const res = mockRes();
+            const promise = readBodyWithLimit(req, res);
+            handlers['error'](new Error('connection reset'));
+            await expect(promise).rejects.toThrow('connection reset');
+        });
+        it('ignores data chunks after overflow', async () => {
+            const handlers = {};
+            const req = mockReq({ headers: {} });
+            req.on = vi.fn((event, cb) => {
+                handlers[event] = cb;
+            });
+            req.destroy = vi.fn();
+            const res = mockRes();
+            const promise = readBodyWithLimit(req, res, 5);
+            handlers['data'](Buffer.from('a'.repeat(10)));
+            handlers['data'](Buffer.from('b'.repeat(5)));
+            handlers['end']();
+            await expect(promise).rejects.toThrow('body_too_large');
+        });
+    });
+    describe('checkRateLimit additional', () => {
+        it('returns 429 when rate limit exceeded', () => {
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkRateLimit(req, res, true)).toBe(true);
+        });
+        it('allows with MCP_RATE_LIMIT_ENABLED=false', () => {
+            process.env.MCP_RATE_LIMIT_ENABLED = 'false';
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkRateLimit(req, res)).toBe(true);
+        });
+    });
+    describe('checkAuth additional', () => {
+        it('allows localhost binding', () => {
+            process.env.MCP_HOST = 'localhost';
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(true);
+        });
+        it('allows ::1 binding', () => {
+            process.env.MCP_HOST = '::1';
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(true);
+        });
+        it('allows non-local with MCP_ALLOW_INSECURE=true', () => {
+            process.env.MCP_HOST = '0.0.0.0';
+            process.env.MCP_ALLOW_INSECURE = 'true';
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(true);
+        });
+        it('defaults MCP_HOST to 127.0.0.1 when not set', () => {
+            delete process.env.MCP_HOST;
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(true);
+        });
+        it('rejects token of different length', () => {
+            process.env.MCP_AUTH_TOKEN = 'short';
+            const req = mockReq({
+                headers: { authorization: 'Bearer muchlongertoken' },
+            });
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(false);
+            expect(res._status).toBe(403);
+        });
     });
 });

package/dist/tests/server/observability/InstrumentationContract.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/observability/InstrumentationContract.test.js

@@ -0,0 +1,30 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { MetricNames, NoopInstrumentation, SpanNames, } from '../../../src/server/observability/InstrumentationContract.js';
+describe('observability/InstrumentationContract', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('exposes stable span and metric names', () => {
+        expect(SpanNames).toEqual({
+            toolExecute: 'tool.execute',
+            toolValidateInput: 'tool.validate_input',
+            registryDiscovery: 'registry.discovery',
+            pluginLifecycle: 'plugin.lifecycle',
+            workflowRun: 'workflow.run',
+            workflowStep: 'workflow.step',
+            bridgeRequest: 'bridge.request',
+            captchaSolve: 'captcha.solve',
+        });
+        expect(MetricNames.pluginActiveTotal).toBe('plugin_active_total');
+    });
+    it('returns a no-op span with the current timestamp', () => {
+        vi.spyOn(Date, 'now').mockReturnValue(12345);
+        const instrumentation = new NoopInstrumentation();
+        const span = instrumentation.startSpan('workflow.run', { id: 'wf-1' });
+        expect(span.name).toBe('workflow.run');
+        expect(span.startTime).toBe(12345);
+        expect(() => span.addEvent('started')).not.toThrow();
+        expect(() => span.end({ ok: true })).not.toThrow();
+        expect(() => instrumentation.emitMetric('workflow_runs_total', 1, 'counter')).not.toThrow();
+    });
+});

package/dist/tests/server/plugin-api.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/plugin-api.test.js

@@ -0,0 +1,29 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    getPluginBooleanConfig: vi.fn(() => true),
+    getPluginBoostTier: vi.fn(() => 'workflow'),
+    loadPluginEnv: vi.fn(),
+}));
+vi.mock('@server/extensions/plugin-config', () => ({
+    getPluginBooleanConfig: state.getPluginBooleanConfig,
+    getPluginBoostTier: state.getPluginBoostTier,
+}));
+vi.mock('@server/extensions/plugin-env', () => ({
+    loadPluginEnv: state.loadPluginEnv,
+}));
+describe('plugin-api', () => {
+    beforeEach(() => {
+        vi.resetModules();
+        vi.clearAllMocks();
+    });
+    it('re-exports the plugin runtime helpers', async () => {
+        const mod = await import('../../src/server/plugin-api.js');
+        expect(mod.getPluginBooleanConfig).toBe(state.getPluginBooleanConfig);
+        expect(mod.getPluginBoostTier).toBe(state.getPluginBoostTier);
+        expect(mod.loadPluginEnv).toBe(state.loadPluginEnv);
+        expect(mod.getPluginBooleanConfig({}, 'plugin', 'flag', false)).toBe(true);
+        expect(mod.getPluginBoostTier('plugin')).toBe('workflow');
+        mod.loadPluginEnv('file:///plugin/manifest.ts');
+        expect(state.loadPluginEnv).toHaveBeenCalledWith('file:///plugin/manifest.ts');
+    });
+});

package/dist/tests/server/plugins/PluginContract.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/plugins/PluginContract.test.js

@@ -0,0 +1,22 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    ExtensionBuilder: class ExtensionBuilder {
+    },
+    createExtension: vi.fn(() => ({ id: 'plugin' })),
+}));
+vi.mock('@jshookmcp/extension-sdk/plugin', () => ({
+    ExtensionBuilder: state.ExtensionBuilder,
+    createExtension: state.createExtension,
+}));
+describe('plugins/PluginContract', () => {
+    beforeEach(() => {
+        vi.resetModules();
+        vi.clearAllMocks();
+    });
+    it('re-exports runtime SDK symbols', async () => {
+        const mod = await import('../../../src/server/plugins/PluginContract.js');
+        expect(mod.ExtensionBuilder).toBe(state.ExtensionBuilder);
+        expect(mod.createExtension).toBe(state.createExtension);
+        expect(mod.createExtension('plugin', '1.0.0')).toEqual({ id: 'plugin' });
+    });
+});

package/dist/tests/server/registry/bind-helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/registry/bind-helpers.test.js

@@ -0,0 +1,27 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { bindByDepKey, getDep } from '../../../src/server/registry/bind-helpers.js';
+describe('registry/bind-helpers', () => {
+    beforeEach(() => {
+    });
+    it('returns an existing dependency by key', () => {
+        expect(getDep({ alpha: { run: true } }, 'alpha')).toEqual({ run: true });
+    });
+    it('treats falsy dependencies as missing and throws', () => {
+        expect(() => getDep({ zero: 0 }, 'zero')).toThrow('[registry] Missing dependency: "zero"');
+        expect(() => getDep({ empty: '' }, 'empty')).toThrow('[registry] Missing dependency: "empty"');
+        expect(() => getDep({}, 'missing')).toThrow('[registry] Missing dependency: "missing"');
+    });
+    it('binds a dependency lookup into an executable handler', async () => {
+        const invoke = vi.fn(async (handler, args) => ({
+            value: handler.run(),
+            args,
+        }));
+        const bound = bindByDepKey('alpha', invoke);
+        const handler = bound({ alpha: { run: () => 'ok' } });
+        await expect(handler({ id: 1 })).resolves.toEqual({
+            value: 'ok',
+            args: { id: 1 },
+        });
+        expect(invoke).toHaveBeenCalledWith({ run: expect.any(Function) }, { id: 1 });
+    });
+});

package/dist/tests/server/registry/contracts.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/registry/contracts.test.js

@@ -0,0 +1,9 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+describe('registry/contracts', () => {
+    beforeEach(() => {
+    });
+    it('has no runtime exports', async () => {
+        const mod = await import('../../../src/server/registry/contracts.js');
+        expect(Object.keys(mod)).toEqual([]);
+    });
+});

package/dist/tests/server/registry/discovery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/registry/discovery.test.js

@@ -0,0 +1,91 @@
+import { join } from 'node:path';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    readdir: vi.fn(),
+    stat: vi.fn(),
+    fileURLToPath: vi.fn(),
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+    },
+}));
+vi.mock('node:fs/promises', () => ({
+    readdir: state.readdir,
+    stat: state.stat,
+}));
+vi.mock('node:url', () => ({
+    fileURLToPath: state.fileURLToPath,
+}));
+vi.mock('@utils/logger', () => ({
+    logger: state.logger,
+}));
+const fixtureRoot = join(process.cwd(), 'tests', 'server', 'registry', 'fixtures');
+const registryFile = join(process.cwd(), 'src', 'server', 'registry', 'discovery.ts');
+function makeDir(name) {
+    return {
+        name,
+        isDirectory: () => true,
+    };
+}
+describe('registry/discovery', () => {
+    beforeEach(() => {
+        vi.resetModules();
+        vi.clearAllMocks();
+        delete process.env.DISCOVERY_STRICT;
+        state.fileURLToPath.mockImplementation((value) => {
+            const href = typeof value === 'string' ? value : value.href;
+            if (href.includes('/domains/')) {
+                return fixtureRoot;
+            }
+            return registryFile;
+        });
+    });
+    it('returns an empty list when the domains directory cannot be read', async () => {
+        state.readdir.mockRejectedValue(new Error('cannot read'));
+        const { discoverDomainManifests } = await import('../../../src/server/registry/discovery.js');
+        await expect(discoverDomainManifests()).resolves.toEqual([]);
+        expect(state.logger.error).toHaveBeenCalled();
+    });
+    it('loads valid manifests, skips invalid ones, and warns on duplicate domain or depKey', async () => {
+        state.readdir.mockResolvedValue([
+            makeDir('valid-default'),
+            makeDir('valid-named'),
+            makeDir('valid-alt'),
+            makeDir('invalid'),
+            makeDir('duplicate-domain'),
+            makeDir('duplicate-dep'),
+        ]);
+        state.stat.mockImplementation(async (filePath) => {
+            if (filePath === join(fixtureRoot, 'valid-default', 'manifest.ts') ||
+                filePath === join(fixtureRoot, 'valid-named', 'manifest.ts') ||
+                filePath === join(fixtureRoot, 'valid-alt', 'manifest.ts') ||
+                filePath === join(fixtureRoot, 'invalid', 'manifest.ts') ||
+                filePath === join(fixtureRoot, 'duplicate-domain', 'manifest.ts') ||
+                filePath === join(fixtureRoot, 'duplicate-dep', 'manifest.ts')) {
+                return { isFile: () => true };
+            }
+            throw new Error('missing');
+        });
+        const { discoverDomainManifests } = await import('../../../src/server/registry/discovery.js');
+        const manifests = await discoverDomainManifests();
+        expect(manifests.map((item) => item.domain)).toEqual(['alpha', 'beta', 'gamma']);
+        expect(state.logger.warn).toHaveBeenCalledWith(expect.stringContaining('no valid DomainManifest export'));
+        expect(state.logger.warn).toHaveBeenCalledWith(expect.stringContaining('Duplicate domain "alpha"'));
+        expect(state.logger.warn).toHaveBeenCalledWith(expect.stringContaining('Duplicate depKey "alphaDep"'));
+        expect(state.logger.info).toHaveBeenCalledWith('[discovery] Discovered 3 domains, 3 tools total');
+    });
+    it('prefers manifest.js before manifest.ts and rethrows import errors in strict mode', async () => {
+        state.readdir.mockResolvedValue([makeDir('js-first'), makeDir('throw-on-import')]);
+        state.stat.mockImplementation(async (filePath) => {
+            if (filePath === join(fixtureRoot, 'js-first', 'manifest.js') ||
+                filePath === join(fixtureRoot, 'throw-on-import', 'manifest.ts')) {
+                return { isFile: () => true };
+            }
+            throw new Error('missing');
+        });
+        process.env.DISCOVERY_STRICT = 'true';
+        const { discoverDomainManifests } = await import('../../../src/server/registry/discovery.js');
+        await expect(discoverDomainManifests()).rejects.toThrow('fixture import failed');
+    });
+});

package/dist/tests/server/registry/ensure-browser-core.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/registry/ensure-browser-core.test.js

@@ -0,0 +1,94 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    CodeCollector: vi.fn(function (config) {
+        this.kind = 'collector';
+        this.config = config;
+    }),
+    PageController: vi.fn(function (collector) {
+        this.kind = 'pageController';
+        this.collector = collector;
+    }),
+    DOMInspector: vi.fn(function (collector) {
+        this.kind = 'domInspector';
+        this.collector = collector;
+    }),
+    ScriptManager: vi.fn(function (collector) {
+        this.kind = 'scriptManager';
+        this.collector = collector;
+    }),
+    ConsoleMonitor: vi.fn(function (collector) {
+        this.kind = 'consoleMonitor';
+        this.collector = collector;
+    }),
+    LLMService: vi.fn(function (config) {
+        this.kind = 'llm';
+        this.config = config;
+    }),
+}));
+vi.mock('@modules/collector/CodeCollector', () => ({
+    CodeCollector: state.CodeCollector,
+}));
+vi.mock('@modules/collector/PageController', () => ({
+    PageController: state.PageController,
+}));
+vi.mock('@modules/collector/DOMInspector', () => ({
+    DOMInspector: state.DOMInspector,
+}));
+vi.mock('@modules/debugger/ScriptManager', () => ({
+    ScriptManager: state.ScriptManager,
+}));
+vi.mock('@modules/monitor/ConsoleMonitor', () => ({
+    ConsoleMonitor: state.ConsoleMonitor,
+}));
+vi.mock('@services/LLMService', () => ({
+    LLMService: state.LLMService,
+}));
+describe('registry/ensure-browser-core', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('initializes missing browser-core dependencies once', async () => {
+        const { ensureBrowserCore } = await import('../../../src/server/registry/ensure-browser-core.js');
+        const ctx = {
+            config: {
+                puppeteer: { headless: true },
+                llm: { model: 'gpt-test' },
+            },
+            registerCaches: vi.fn(async () => undefined),
+        };
+        ensureBrowserCore(ctx);
+        expect(state.CodeCollector).toHaveBeenCalledWith({ headless: true });
+        expect(state.PageController).toHaveBeenCalledTimes(1);
+        expect(state.DOMInspector).toHaveBeenCalledTimes(1);
+        expect(state.ScriptManager).toHaveBeenCalledTimes(1);
+        expect(state.ConsoleMonitor).toHaveBeenCalledTimes(1);
+        expect(state.LLMService).toHaveBeenCalledWith({ model: 'gpt-test' });
+        expect(ctx.registerCaches).toHaveBeenCalledTimes(1);
+    });
+    it('does not overwrite existing browser-core dependencies', async () => {
+        const { ensureBrowserCore } = await import('../../../src/server/registry/ensure-browser-core.js');
+        const collector = { existing: true };
+        const ctx = {
+            config: {
+                puppeteer: {},
+                llm: {},
+            },
+            collector,
+            pageController: { existing: 'page' },
+            domInspector: { existing: 'dom' },
+            scriptManager: { existing: 'script' },
+            consoleMonitor: { existing: 'console' },
+            llm: { existing: 'llm' },
+            registerCaches: vi.fn(),
+        };
+        ensureBrowserCore(ctx);
+        expect(state.CodeCollector).not.toHaveBeenCalled();
+        expect(state.PageController).not.toHaveBeenCalled();
+        expect(state.DOMInspector).not.toHaveBeenCalled();
+        expect(state.ScriptManager).not.toHaveBeenCalled();
+        expect(state.ConsoleMonitor).not.toHaveBeenCalled();
+        expect(state.LLMService).not.toHaveBeenCalled();
+        expect(ctx.registerCaches).not.toHaveBeenCalled();
+        expect(ctx.collector).toBe(collector);
+    });
+});

package/dist/tests/server/registry/fixtures/duplicate-dep/manifest.d.ts

@@ -0,0 +1,23 @@
+declare const _default: {
+    kind: string;
+    version: number;
+    domain: string;
+    depKey: string;
+    profiles: string[];
+    registrations: {
+        tool: {
+            name: string;
+            description: string;
+            inputSchema: {
+                type: string;
+                properties: {};
+            };
+        };
+        domain: string;
+        bind: () => () => Promise<{
+            ok: boolean;
+        }>;
+    }[];
+    ensure: () => {};
+};
+export default _default;

package/dist/tests/server/registry/fixtures/duplicate-dep/manifest.js

@@ -0,0 +1,20 @@
+const tool = {
+    name: 'delta_tool',
+    description: 'delta duplicate dep',
+    inputSchema: { type: 'object', properties: {} },
+};
+export default {
+    kind: 'domain-manifest',
+    version: 1,
+    domain: 'delta',
+    depKey: 'alphaDep',
+    profiles: ['full'],
+    registrations: [
+        {
+            tool,
+            domain: 'delta',
+            bind: () => async () => ({ ok: true }),
+        },
+    ],
+    ensure: () => ({}),
+};

package/dist/tests/server/registry/fixtures/duplicate-domain/manifest.d.ts

@@ -0,0 +1,23 @@
+declare const _default: {
+    kind: string;
+    version: number;
+    domain: string;
+    depKey: string;
+    profiles: string[];
+    registrations: {
+        tool: {
+            name: string;
+            description: string;
+            inputSchema: {
+                type: string;
+                properties: {};
+            };
+        };
+        domain: string;
+        bind: () => () => Promise<{
+            ok: boolean;
+        }>;
+    }[];
+    ensure: () => {};
+};
+export default _default;