@jshookmcp/jshook 0.2.2 → 0.2.5

package/dist/src/server/extensions/ExtensionManager.discovery.js

@@ -1,5 +1,8 @@
-import { basename, dirname } from 'node:path';
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { basename, dirname, relative, resolve } from 'node:path';
 import { glob } from 'tinyglobby';
+import { INSTALLED_EXTENSION_METADATA_FILENAME, } from '../extensions/types.js';
 async function collectMatchingFiles(roots, matcher) {
     const files = new Set();
     for (const root of roots) {
@@ -21,7 +24,7 @@ async function collectMatchingFiles(roots, matcher) {
             }
         }
     }
-    return [...files].sort((a, b) => a.localeCompare(b));
+    return [...files].toSorted((a, b) => a.localeCompare(b));
 }
 function normalizeExtensionCandidateKey(root, file) {
     const normalizedRoot = root
@@ -29,8 +32,7 @@ function normalizeExtensionCandidateKey(root, file) {
         .replace(/\/+/g, '/')
         .replace(/^\/+|\/+$/g, '')
         .toLowerCase();
-    const relDir = dirname(file)
-        .slice(root.length)
+    const relDir = relative(root, dirname(file))
         .replace(/^[/\\]+/, '')
         .replace(/\\/g, '/')
         .replace(/\/+/g, '/')
@@ -49,9 +51,62 @@ function extensionRank(candidate) {
         return 1;
     return 2;
 }
+function isInstalledExtensionMetadata(value, kind) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const record = value;
+    if (record.version !== 1 || record.kind !== kind)
+        return false;
+    if (typeof record.slug !== 'string' || typeof record.id !== 'string')
+        return false;
+    if (!record.source || typeof record.source !== 'object')
+        return false;
+    const source = record.source;
+    return (typeof source.type === 'string' &&
+        typeof source.repo === 'string' &&
+        typeof source.ref === 'string' &&
+        typeof source.commit === 'string' &&
+        typeof source.subpath === 'string' &&
+        typeof source.entry === 'string');
+}
+async function collectInstalledEntryCandidates(roots, kind) {
+    const candidates = [];
+    for (const [rootIndex, root] of roots.entries()) {
+        const metadataFiles = await collectMatchingFiles([root], (filename) => filename === INSTALLED_EXTENSION_METADATA_FILENAME);
+        for (const metadataFile of metadataFiles) {
+            let metadataRaw;
+            try {
+                metadataRaw = JSON.parse(await readFile(metadataFile, 'utf8'));
+            }
+            catch {
+                continue;
+            }
+            if (!isInstalledExtensionMetadata(metadataRaw, kind)) {
+                continue;
+            }
+            const entryPath = metadataRaw.source.entry.trim();
+            if (!entryPath) {
+                continue;
+            }
+            const file = resolve(dirname(metadataFile), entryPath);
+            if (!existsSync(file)) {
+                continue;
+            }
+            candidates.push({
+                file,
+                key: normalizeExtensionCandidateKey(root, file),
+                isJs: file.endsWith('.js'),
+                isTs: file.endsWith('.ts'),
+                rootIndex,
+                priority: 0,
+            });
+        }
+    }
+    return candidates;
+}
 function deduplicateCandidates(candidates) {
     const byKey = new Map();
-    for (const candidate of candidates.sort((a, b) => a.file.localeCompare(b.file))) {
+    for (const candidate of candidates.toSorted((a, b) => a.file.localeCompare(b.file))) {
         const existing = byKey.get(candidate.key);
         if (!existing) {
             byKey.set(candidate.key, candidate);
@@ -59,21 +114,27 @@ function deduplicateCandidates(candidates) {
         }
         const existingRoot = existing.rootIndex;
         const candidateRoot = candidate.rootIndex;
+        const existingPriority = existing.priority;
+        const candidatePriority = candidate.priority;
         const existingExtRank = extensionRank(existing);
         const candidateExtRank = extensionRank(candidate);
         const shouldReplace = candidateRoot < existingRoot ||
-            (candidateRoot === existingRoot && candidateExtRank < existingExtRank) ||
+            (candidateRoot === existingRoot && candidatePriority < existingPriority) ||
+            (candidateRoot === existingRoot &&
+                candidatePriority === existingPriority &&
+                candidateExtRank < existingExtRank) ||
             (candidateRoot === existingRoot &&
+                candidatePriority === existingPriority &&
                 candidateExtRank === existingExtRank &&
                 candidate.file.localeCompare(existing.file) < 0);
         if (shouldReplace) {
             byKey.set(candidate.key, candidate);
         }
     }
-    return [...byKey.values()].map((item) => item.file).sort((a, b) => a.localeCompare(b));
+    return [...byKey.values()].map((item) => item.file).toSorted((a, b) => a.localeCompare(b));
 }
 export async function discoverPluginFiles(pluginRoots) {
-    const candidates = [];
+    const candidates = await collectInstalledEntryCandidates(pluginRoots, 'plugin');
     for (const [rootIndex, root] of pluginRoots.entries()) {
         const files = await collectMatchingFiles([root], (filename) => filename === 'manifest.js' || filename === 'manifest.ts');
         for (const file of files) {
@@ -83,13 +144,14 @@ export async function discoverPluginFiles(pluginRoots) {
                 isJs: file.endsWith('.js'),
                 isTs: file.endsWith('.ts'),
                 rootIndex,
+                priority: 1,
             });
         }
     }
     return deduplicateCandidates(candidates);
 }
 export async function discoverWorkflowFiles(workflowRoots) {
-    const candidates = [];
+    const candidates = await collectInstalledEntryCandidates(workflowRoots, 'workflow');
     for (const [rootIndex, root] of workflowRoots.entries()) {
         const files = await collectMatchingFiles([root], (filename) => filename.endsWith('.workflow.js') ||
             filename.endsWith('.workflow.ts') ||
@@ -102,6 +164,7 @@ export async function discoverWorkflowFiles(workflowRoots) {
                 isJs: file.endsWith('.js'),
                 isTs: file.endsWith('.ts'),
                 rootIndex,
+                priority: 1,
             });
         }
     }

package/dist/src/server/extensions/ExtensionManager.integrity.js

@@ -9,7 +9,7 @@ export function normalizeHex(value) {
     return value.trim().toLowerCase().replace(/^0x/, '');
 }
 function isTruthyEnv(value) {
-    return ['1', 'true'].includes((value ?? '').toLowerCase());
+    return ['1', 'true'].includes(value.toLowerCase());
 }
 export function isPluginSignatureRequired() {
     const raw = process.env.MCP_PLUGIN_SIGNATURE_REQUIRED;

package/dist/src/server/extensions/ExtensionManager.js

@@ -1,7 +1,8 @@
-import { readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
 import { allTools } from '../ToolCatalog.js';
 import { logger } from '../../utils/logger.js';
+import { INSTALLED_EXTENSION_METADATA_FILENAME } from '../extensions/types.js';
 import { DEFAULT_PLUGIN_ROOTS, DEFAULT_WORKFLOW_ROOTS, parseRoots, resolveRoots, } from './ExtensionManager.roots.js';
 import { sha256Hex, normalizeHex, isPluginStrictLoad, parseDigestAllowlist, verifyPluginIntegrity, } from './ExtensionManager.integrity.js';
 import { isExtensionBuilder, isWorkflowContract } from './ExtensionManager.guards.js';
@@ -34,8 +35,39 @@ function parseSimpleYaml(filePath) {
         return {};
     }
 }
+function findInstalledMetadataRoot(startDir) {
+    let currentDir = startDir;
+    while (true) {
+        if (existsSync(join(currentDir, INSTALLED_EXTENSION_METADATA_FILENAME))) {
+            return currentDir;
+        }
+        const parentDir = dirname(currentDir);
+        if (parentDir === currentDir) {
+            return null;
+        }
+        currentDir = parentDir;
+    }
+}
+function resolvePluginProjectRoot(pluginFile) {
+    const entryDir = dirname(pluginFile);
+    const metadataRoot = findInstalledMetadataRoot(entryDir);
+    if (metadataRoot) {
+        return metadataRoot;
+    }
+    if (basename(entryDir).toLowerCase() === 'dist') {
+        return dirname(entryDir);
+    }
+    return entryDir;
+}
 let reloadMutex = Promise.resolve();
-export async function reloadExtensions(ctx) {
+const lazyWorkflowLoadAttempted = new WeakSet();
+const STRICT_PLUGIN_ALLOWLIST_ERROR = 'MCP_PLUGIN_ALLOWED_DIGESTS is required when MCP_PLUGIN_SIGNATURE_REQUIRED=true ' +
+    'or MCP_PLUGIN_STRICT_LOAD=true. The digest allowlist is the only pre-import trust boundary — ' +
+    'without it, plugin code executes before integrity verification. No plugins will be loaded.';
+const MISSING_PLUGIN_ALLOWLIST_WARNING = '[extensions] Loading plugins WITHOUT MCP_PLUGIN_ALLOWED_DIGESTS allowlist. ' +
+    'Plugin code will execute on import() before post-load integrity checks. ' +
+    'Set MCP_PLUGIN_STRICT_LOAD=true to enforce allowlist requirement.';
+async function withReloadMutex(operation) {
     const prev = reloadMutex;
     let resolve;
     reloadMutex = new Promise((r) => {
@@ -43,12 +75,39 @@ export async function reloadExtensions(ctx) {
     });
     await prev;
     try {
-        return await reloadExtensionsInner(ctx);
+        return await operation();
     }
     finally {
         resolve();
     }
 }
+export async function reloadExtensions(ctx) {
+    return withReloadMutex(() => reloadExtensionsInner(ctx));
+}
+export async function ensureWorkflowsLoaded(ctx) {
+    if (ctx.extensionWorkflowRuntimeById.size > 0 || lazyWorkflowLoadAttempted.has(ctx)) {
+        return;
+    }
+    await withReloadMutex(async () => {
+        if (ctx.extensionWorkflowRuntimeById.size > 0 || lazyWorkflowLoadAttempted.has(ctx)) {
+            return;
+        }
+        lazyWorkflowLoadAttempted.add(ctx);
+        const warnings = [];
+        const errors = [];
+        const pluginRoots = resolveRoots(parseRoots(process.env.MCP_PLUGIN_ROOTS, DEFAULT_PLUGIN_ROOTS));
+        const workflowRoots = resolveRoots(parseRoots(process.env.MCP_WORKFLOW_ROOTS, DEFAULT_WORKFLOW_ROOTS));
+        await loadPluginWorkflowContributions(ctx, pluginRoots, warnings, errors);
+        const workflowFiles = await discoverWorkflowFiles(workflowRoots);
+        await loadWorkflows(ctx, workflowFiles, warnings, errors);
+        for (const warning of warnings) {
+            logger.warn(`[extensions] ${warning}`);
+        }
+        for (const error of errors) {
+            logger.error(`[extensions] ${error}`);
+        }
+    });
+}
 async function loadWorkflows(ctx, workflowFiles, warnings, errors) {
     for (const workflowFile of workflowFiles) {
         try {
@@ -59,29 +118,124 @@ async function loadWorkflows(ctx, workflowFiles, warnings, errors) {
                 continue;
             }
             const workflow = candidate;
-            if (ctx.extensionWorkflowsById.has(workflow.id)) {
-                warnings.push(`Skip workflow "${workflow.id}" from ${workflowFile}: duplicate id`);
+            registerWorkflowContract(ctx, workflow, workflowFile, warnings);
+        }
+        catch (error) {
+            errors.push(`Failed to import workflow file ${workflowFile}: ${String(error)}`);
+        }
+    }
+}
+function registerWorkflowContract(ctx, workflow, source, warnings) {
+    if (ctx.extensionWorkflowsById.has(workflow.id)) {
+        warnings.push(`Skip workflow "${workflow.id}" from ${source}: duplicate id`);
+        return false;
+    }
+    const record = {
+        id: workflow.id,
+        displayName: workflow.displayName,
+        source,
+        description: workflow.description,
+        tags: workflow.tags,
+        timeoutMs: workflow.timeoutMs,
+        defaultMaxConcurrency: workflow.defaultMaxConcurrency,
+        route: workflow.route,
+    };
+    ctx.extensionWorkflowsById.set(record.id, record);
+    const runtimeRecord = {
+        workflow,
+        source,
+        route: workflow.route,
+    };
+    ctx.extensionWorkflowRuntimeById.set(record.id, runtimeRecord);
+    return true;
+}
+function buildPluginRecord(plugin, pluginFile, loadedTools, loadedWorkflows) {
+    return {
+        id: plugin.id,
+        name: plugin.pluginName,
+        source: pluginFile,
+        author: plugin.pluginAuthor || undefined,
+        sourceRepo: plugin.pluginSourceRepo || undefined,
+        domains: [],
+        workflows: loadedWorkflows,
+        tools: loadedTools,
+    };
+}
+async function loadPluginWorkflowContributions(ctx, pluginRoots, warnings, errors) {
+    const allowedDigests = parseDigestAllowlist(process.env.MCP_PLUGIN_ALLOWED_DIGESTS);
+    const strictLoad = isPluginStrictLoad();
+    if (strictLoad && allowedDigests.size === 0) {
+        errors.push(STRICT_PLUGIN_ALLOWLIST_ERROR);
+        logger.error('[extensions] ' + STRICT_PLUGIN_ALLOWLIST_ERROR);
+        return;
+    }
+    if (allowedDigests.size === 0) {
+        logger.warn(MISSING_PLUGIN_ALLOWLIST_WARNING);
+    }
+    const pluginFiles = await discoverPluginFiles(pluginRoots);
+    const coreVersion = ctx.config?.mcp?.version ?? '0.0.0';
+    for (const pluginFile of pluginFiles) {
+        let fileDigest;
+        try {
+            fileDigest = normalizeHex(await sha256Hex(pluginFile));
+            if (allowedDigests.size > 0 && !allowedDigests.has(fileDigest)) {
+                warnings.push(`Skip plugin file not in MCP_PLUGIN_ALLOWED_DIGESTS allowlist: ${pluginFile}`);
                 continue;
             }
-            const record = {
-                id: workflow.id,
-                displayName: workflow.displayName,
-                source: workflowFile,
-                description: workflow.description,
-                tags: workflow.tags,
-                timeoutMs: workflow.timeoutMs,
-                defaultMaxConcurrency: workflow.defaultMaxConcurrency,
-            };
-            ctx.extensionWorkflowsById.set(record.id, record);
-            const runtimeRecord = {
-                workflow,
-                source: workflowFile,
-            };
-            ctx.extensionWorkflowRuntimeById.set(record.id, runtimeRecord);
         }
         catch (error) {
-            errors.push(`Failed to import workflow file ${workflowFile}: ${String(error)}`);
+            errors.push(`Failed to hash plugin file ${pluginFile}: ${String(error)}`);
+            continue;
+        }
+        let plugin;
+        try {
+            const mod = await import(createFreshImportUrl(pluginFile, 'plugin'));
+            const candidate = mod.default ?? mod;
+            if (!isExtensionBuilder(candidate)) {
+                warnings.push(`Skip plugin file without valid ExtensionBuilder: ${pluginFile}`);
+                continue;
+            }
+            plugin = candidate;
+        }
+        catch (error) {
+            errors.push(`Failed to import plugin file ${pluginFile}: ${String(error)}`);
+            continue;
+        }
+        const pluginProjectRoot = resolvePluginProjectRoot(pluginFile);
+        const metaYamlPath = join(pluginProjectRoot, 'meta.yaml');
+        const meta = parseSimpleYaml(metaYamlPath);
+        plugin.mergeMetadata(meta);
+        if (ctx.extensionPluginsById.has(plugin.id)) {
+            warnings.push(`Skip plugin "${plugin.id}" from ${pluginFile}: duplicate plugin id`);
+            continue;
         }
+        try {
+            const verification = await verifyPluginIntegrity(plugin, coreVersion);
+            warnings.push(...verification.warnings);
+            if (!verification.ok) {
+                errors.push(...verification.errors);
+                continue;
+            }
+        }
+        catch (error) {
+            errors.push(`Failed to verify plugin ${plugin.id}: ${String(error)}`);
+            continue;
+        }
+        const loadedWorkflows = [];
+        for (const candidate of plugin.workflows) {
+            if (!isWorkflowContract(candidate)) {
+                warnings.push(`Skip invalid workflow contribution from plugin "${plugin.id}" in ${pluginFile}`);
+                continue;
+            }
+            const workflowSource = `${pluginFile}#workflow:${candidate.id}`;
+            if (registerWorkflowContract(ctx, candidate, workflowSource, warnings)) {
+                loadedWorkflows.push(candidate.id);
+            }
+        }
+        if (loadedWorkflows.length === 0) {
+            continue;
+        }
+        ctx.extensionPluginsById.set(plugin.id, buildPluginRecord(plugin, pluginFile, [], loadedWorkflows));
     }
 }
 async function reloadExtensionsInner(ctx) {
@@ -93,9 +247,7 @@ async function reloadExtensionsInner(ctx) {
     const allowedDigests = parseDigestAllowlist(process.env.MCP_PLUGIN_ALLOWED_DIGESTS);
     const strictLoad = isPluginStrictLoad();
     if (strictLoad && allowedDigests.size === 0) {
-        const msg = 'MCP_PLUGIN_ALLOWED_DIGESTS is required when MCP_PLUGIN_SIGNATURE_REQUIRED=true ' +
-            'or MCP_PLUGIN_STRICT_LOAD=true. The digest allowlist is the only pre-import trust boundary — ' +
-            'without it, plugin code executes before integrity verification. No plugins will be loaded.';
+        const msg = STRICT_PLUGIN_ALLOWLIST_ERROR;
         errors.push(msg);
         logger.error('[extensions] ' + msg);
         const workflowFiles = await discoverWorkflowFiles(workflowRoots);
@@ -105,9 +257,7 @@ async function reloadExtensionsInner(ctx) {
         return { ...list, addedTools: 0, removedTools, warnings, errors };
     }
     if (allowedDigests.size === 0) {
-        logger.warn('[extensions] Loading plugins WITHOUT MCP_PLUGIN_ALLOWED_DIGESTS allowlist. ' +
-            'Plugin code will execute on import() before post-load integrity checks. ' +
-            'Set MCP_PLUGIN_STRICT_LOAD=true to enforce allowlist requirement.');
+        logger.warn(MISSING_PLUGIN_ALLOWLIST_WARNING);
     }
     const baseToolNames = new Set(allTools.map((tool) => tool.name));
     const pluginFiles = await discoverPluginFiles(pluginRoots);
@@ -139,7 +289,8 @@ async function reloadExtensionsInner(ctx) {
             errors.push(`Failed to import plugin file ${pluginFile}: ${String(error)}`);
             continue;
         }
-        const metaYamlPath = join(dirname(pluginFile), 'meta.yaml');
+        const pluginProjectRoot = resolvePluginProjectRoot(pluginFile);
+        const metaYamlPath = join(pluginProjectRoot, 'meta.yaml');
         const meta = parseSimpleYaml(metaYamlPath);
         plugin.mergeMetadata(meta);
         if (ctx.extensionPluginsById.has(plugin.id)) {
@@ -164,7 +315,7 @@ async function reloadExtensionsInner(ctx) {
         const allowInvokeAll = plugin.allowedTools.includes('*');
         const lifecycleContext = {
             pluginId: plugin.id,
-            pluginRoot: pluginFile,
+            pluginRoot: pluginProjectRoot,
             config: ctx.config,
             get state() {
                 return pluginState;
@@ -244,16 +395,18 @@ async function reloadExtensionsInner(ctx) {
             continue;
         }
         const loadedTools = plugin.tools.map((t) => t.name);
-        const record = {
-            id: plugin.id,
-            name: plugin.pluginName,
-            source: pluginFile,
-            author: plugin.pluginAuthor || undefined,
-            sourceRepo: plugin.pluginSourceRepo || undefined,
-            domains: [],
-            workflows: [],
-            tools: loadedTools,
-        };
+        const loadedWorkflows = [];
+        for (const candidate of plugin.workflows) {
+            if (!isWorkflowContract(candidate)) {
+                warnings.push(`Skip invalid workflow contribution from plugin "${plugin.id}" in ${pluginFile}`);
+                continue;
+            }
+            const workflowSource = `${pluginFile}#workflow:${candidate.id}`;
+            if (registerWorkflowContract(ctx, candidate, workflowSource, warnings)) {
+                loadedWorkflows.push(candidate.id);
+            }
+        }
+        const record = buildPluginRecord(plugin, pluginFile, loadedTools, loadedWorkflows);
         ctx.extensionPluginsById.set(record.id, record);
     }
     const workflowFiles = await discoverWorkflowFiles(workflowRoots);

package/dist/src/server/extensions/ExtensionManager.roots.d.ts

@@ -1,4 +1,4 @@
 export declare const DEFAULT_PLUGIN_ROOTS: string[];
 export declare const DEFAULT_WORKFLOW_ROOTS: string[];
 export declare function parseRoots(raw: string | undefined, fallback: string[]): string[];
-export declare function resolveRoots(roots: string[]): string[];
+export declare function resolveRoots(roots: string[], baseDir?: string): string[];

package/dist/src/server/extensions/ExtensionManager.roots.js

@@ -1,11 +1,21 @@
 import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-const IS_TS_RUNTIME = import.meta.url.endsWith('.ts');
-const EXTENSION_MANAGER_DIR = dirname(fileURLToPath(import.meta.url));
-const EXTENSION_INSTALL_ROOT = resolve(EXTENSION_MANAGER_DIR, '..', '..', '..');
-export const DEFAULT_PLUGIN_ROOTS = IS_TS_RUNTIME
-    ? [join(EXTENSION_INSTALL_ROOT, 'plugins'), join(EXTENSION_INSTALL_ROOT, 'dist', 'plugins')]
-    : [join(EXTENSION_INSTALL_ROOT, 'dist', 'plugins'), join(EXTENSION_INSTALL_ROOT, 'plugins')];
+function findProjectRoot(startDir) {
+    let dir = startDir;
+    while (true) {
+        if (existsSync(join(dir, 'package.json')))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return resolve(startDir, '..', '..', '..', '..');
+}
+const EXTENSION_MANAGER_DIR = fileURLToPath(new URL('.', import.meta.url));
+const EXTENSION_INSTALL_ROOT = findProjectRoot(EXTENSION_MANAGER_DIR);
+export const DEFAULT_PLUGIN_ROOTS = [join(EXTENSION_INSTALL_ROOT, 'plugins')];
 export const DEFAULT_WORKFLOW_ROOTS = [join(EXTENSION_INSTALL_ROOT, 'workflows')];
 export function parseRoots(raw, fallback) {
     const value = raw?.trim();
@@ -17,7 +27,7 @@ export function parseRoots(raw, fallback) {
         .filter(Boolean);
     return roots.length > 0 ? [...new Set(roots)] : fallback;
 }
-export function resolveRoots(roots) {
-    const resolved = roots.map((root) => (isAbsolute(root) ? root : resolve(process.cwd(), root)));
-    return [...new Set(resolved)].sort((a, b) => a.localeCompare(b));
+export function resolveRoots(roots, baseDir = EXTENSION_INSTALL_ROOT) {
+    const resolved = roots.map((root) => (isAbsolute(root) ? root : resolve(baseDir, root)));
+    return [...new Set(resolved)].toSorted((a, b) => a.localeCompare(b));
 }

package/dist/src/server/extensions/plugin-config.js

@@ -11,7 +11,7 @@ function envCandidates(pluginId, key) {
     return [`PLUGIN_${pluginSegment}_${keySegment}`, `PLUGINS_${pluginSegment}_${keySegment}`];
 }
 function parseBoolean(raw) {
-    if (raw == null)
+    if (raw === undefined)
         return undefined;
     const value = raw.trim().toLowerCase();
     if (['1', 'true', 'yes', 'on'].includes(value))

package/dist/src/server/extensions/plugin-env.d.ts

@@ -1 +1 @@
-export declare function loadPluginEnv(manifestUrl: string): void;
+export declare function loadPluginEnv(manifestLocation: string): void;

package/dist/src/server/extensions/plugin-env.js

@@ -1,10 +1,16 @@
 import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import dotenv from 'dotenv';
 const loadedEnvPaths = new Set();
-export function loadPluginEnv(manifestUrl) {
-    const pluginDir = dirname(fileURLToPath(manifestUrl));
+function toManifestUrl(manifestLocation) {
+    return manifestLocation.startsWith('file:')
+        ? new URL(manifestLocation)
+        : pathToFileURL(manifestLocation);
+}
+export function loadPluginEnv(manifestLocation) {
+    const pluginDirUrl = new URL('.', toManifestUrl(manifestLocation));
+    const pluginDir = fileURLToPath(pluginDirUrl);
     const envPath = join(pluginDir, '.env');
     if (loadedEnvPaths.has(envPath))
         return;

package/dist/src/server/extensions/types.d.ts

@@ -2,6 +2,21 @@ import type { RegisteredTool } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
 import type { ExtensionBuilder, PluginLifecycleContext, PluginState } from '../plugins/PluginContract.js';
 import type { WorkflowContract } from '../workflows/WorkflowContract.js';
+export declare const INSTALLED_EXTENSION_METADATA_FILENAME = ".jshook-install.json";
+export interface InstalledExtensionMetadata {
+    version: 1;
+    kind: 'plugin' | 'workflow';
+    slug: string;
+    id: string;
+    source: {
+        type: string;
+        repo: string;
+        ref: string;
+        commit: string;
+        subpath: string;
+        entry: string;
+    };
+}
 export interface ExtensionToolRecord {
     name: string;
     domain: string;
@@ -30,6 +45,7 @@ export interface ExtensionPluginRuntimeRecord {
 export interface ExtensionWorkflowRuntimeRecord {
     workflow: WorkflowContract;
     source: string;
+    route?: WorkflowContract['route'];
 }
 export interface ExtensionWorkflowRecord {
     id: string;
@@ -39,6 +55,7 @@ export interface ExtensionWorkflowRecord {
     tags?: string[];
     timeoutMs?: number;
     defaultMaxConcurrency?: number;
+    route?: WorkflowContract['route'];
 }
 export interface ExtensionListResult {
     pluginRoots: string[];

package/dist/src/server/extensions/types.js

@@ -1 +1 @@
-export {};
+export const INSTALLED_EXTENSION_METADATA_FILENAME = '.jshook-install.json';

package/dist/src/server/http/HttpMiddleware.js

@@ -36,7 +36,7 @@ export function checkAuth(req, res) {
         return true;
     }
     const header = req.headers.authorization;
-    if (!header || !header.startsWith('Bearer ')) {
+    if (!header?.startsWith('Bearer ')) {
         res.writeHead(401, { 'Content-Type': 'text/plain' });
         res.end('Unauthorized – missing or malformed Authorization header');
         return false;

package/dist/src/server/instrumentation/EvidenceGraphBridge.d.ts

@@ -0,0 +1,13 @@
+import type { ReverseEvidenceGraph } from '../evidence/ReverseEvidenceGraph.js';
+import type { InstrumentationOperation, InstrumentationArtifact } from './types.js';
+export declare class EvidenceGraphBridge {
+    private readonly graph;
+    private readonly operationNodeMap;
+    private readonly requestNodeMap;
+    constructor(graph: ReverseEvidenceGraph);
+    private getString;
+    private getInitiatorLabel;
+    linkRequestToInitiator(requestNodeId: string, initiatorStackNodeId: string): void;
+    onOperation(op: InstrumentationOperation): string | null;
+    onArtifact(artifact: InstrumentationArtifact): void;
+}