@opentabs-dev/mcp-server 0.0.19

package/dist/reload.js

@@ -0,0 +1,326 @@
+/**
+ * Hot reload orchestration module.
+ *
+ * Encapsulates the entire reload sequence: config loading, plugin discovery,
+ * state swap, stale entry pruning, MCP handler re-registration, file watcher
+ * restart, extension re-sync, client notification, and version check.
+ *
+ * Called on every module evaluation (both first load and hot reload). This
+ * separation keeps index.ts as a thin frozen shell (Bun.serve() delegate,
+ * HotState management, handler definitions) that rarely needs to change,
+ * while all reload logic lives here and is freely editable.
+ */
+import { browserTools } from './browser-tools/index.js';
+import { loadConfig, getConfigDir } from './config.js';
+import { isDev } from './dev-mode.js';
+import { discoverPlugins } from './discovery.js';
+import { ensureExtensionInstalled } from './extension-install.js';
+import { sendSyncFull, sendPluginUpdate, sendExtensionReload, cleanupStaleExecFiles } from './extension-protocol.js';
+import { startConfigWatching, startFileWatching, stopFileWatching } from './file-watcher.js';
+import { sweepStaleSessions } from './http-routes.js';
+import { log } from './logger.js';
+import { registerMcpHandlers, rebuildCachedBrowserTools, notifyToolListChanged, notifyResourceListChanged, notifyPromptListChanged, } from './mcp-setup.js';
+import { buildRegistry } from './registry.js';
+import { isCliSkipConfirmation } from './skip-confirmation.js';
+import { prefixedToolName } from './state.js';
+import { checkForUpdates } from './version-check.js';
+/**
+ * globalThis key for the concurrent reload guard promise.
+ * Stored on globalThis so it survives across bun --hot re-evaluations.
+ * If a reload is in progress when bun --hot triggers, the new module
+ * evaluation waits for the previous reload to finish before starting.
+ */
+const RELOAD_GUARD_KEY = '__opentabs_reload_guard__';
+const getReloadGuard = () => globalThis[RELOAD_GUARD_KEY];
+const setReloadGuard = (promise) => {
+    globalThis[RELOAD_GUARD_KEY] = promise;
+};
+/**
+ * Remove stale entries from state maps after a registry swap.
+ * Prunes tabMapping, activeDispatches, toolConfig, and outdatedPlugins
+ * for plugins/tools that no longer exist in the current registry.
+ */
+const pruneStaleState = (state) => {
+    for (const pluginName of state.tabMapping.keys()) {
+        if (!state.registry.plugins.has(pluginName)) {
+            state.tabMapping.delete(pluginName);
+        }
+    }
+    for (const pluginName of state.activeDispatches.keys()) {
+        if (!state.registry.plugins.has(pluginName)) {
+            state.activeDispatches.delete(pluginName);
+        }
+    }
+    // Prune stale toolConfig entries for removed plugins/tools
+    const validToolNames = new Set();
+    for (const plugin of state.registry.plugins.values()) {
+        for (const tool of plugin.tools) {
+            validToolNames.add(prefixedToolName(plugin.name, tool.name));
+        }
+    }
+    let prunedToolConfigCount = 0;
+    for (const key of Object.keys(state.toolConfig)) {
+        if (!validToolNames.has(key)) {
+            Reflect.deleteProperty(state.toolConfig, key);
+            prunedToolConfigCount++;
+        }
+    }
+    if (prunedToolConfigCount > 0) {
+        log.info(`Pruned ${prunedToolConfigCount} stale tool config entry/entries`);
+    }
+    // Keep only outdatedPlugins entries for still-present plugins
+    state.outdatedPlugins = state.outdatedPlugins.filter(o => Array.from(state.registry.plugins.values()).some(p => p.npmPackageName === o.name));
+};
+/**
+ * Build file watcher callbacks that close over the current state and sessions.
+ * Extracted from reloadCore so the core function stays focused on the
+ * config → discover → swap → prune pipeline.
+ */
+const createFileWatcherCallbacks = (state, sessionServers, transports) => {
+    const notifyAllClients = () => {
+        for (const srv of sessionServers) {
+            notifyToolListChanged(srv);
+            notifyResourceListChanged(srv);
+            notifyPromptListChanged(srv);
+        }
+    };
+    return {
+        onManifestChanged: (pluginName) => {
+            state.registry = buildRegistry(Array.from(state.registry.plugins.values()), [...state.registry.failures]);
+            notifyAllClients();
+            const plugin = state.registry.plugins.get(pluginName);
+            if (plugin) {
+                void sendPluginUpdate(state, pluginName, plugin.iife, plugin.iifeSourceMap).catch((err) => {
+                    log.error(`Failed to write adapter file for ${pluginName}:`, err);
+                });
+            }
+        },
+        onIifeChanged: (pluginName, iife, sourceMap) => {
+            void sendPluginUpdate(state, pluginName, iife, sourceMap).catch((err) => {
+                log.error(`Failed to write adapter file for ${pluginName}:`, err);
+            });
+        },
+        onConfigChanged: () => {
+            void performConfigReload(state, sessionServers, transports).catch((err) => {
+                log.error('Config watcher reload failed:', err);
+            });
+        },
+        onPluginDiscovered: (pluginName) => {
+            log.info(`Plugin "${pluginName}" discovered by file watcher — rebuilding tools and syncing extension`);
+            state.registry = buildRegistry(Array.from(state.registry.plugins.values()), [...state.registry.failures]);
+            notifyAllClients();
+            if (state.extensionWs) {
+                void sendSyncFull(state).catch((err) => {
+                    log.error('Failed to sync extension after plugin discovery:', err);
+                });
+            }
+        },
+    };
+};
+/**
+ * Shared reload core: discovery, state swap, pruning, and extension sync.
+ * Callers notify MCP clients of tool list changes after this returns.
+ * In dev mode, file watchers and config watching are started after discovery.
+ * In production mode, no watchers are created — restart to reload.
+ */
+const reloadCore = async ({ state, sessionServers, transports }) => {
+    // Always stop existing watchers (cleans up handles from previous hot reload iteration)
+    stopFileWatching(state);
+    sweepStaleSessions(state, transports, sessionServers);
+    try {
+        const config = await loadConfig();
+        const configDir = getConfigDir();
+        const { registry, errors } = await discoverPlugins(config.localPlugins, configDir);
+        state.registry = registry;
+        state.toolConfig = { ...config.tools };
+        state.browserToolPolicy = { ...config.browserToolPolicy };
+        state.pluginPaths = [...config.localPlugins];
+        state.wsSecret = config.secret ?? null;
+        state.discoveryErrors = errors;
+        state.permissions = config.permissions;
+        state.skipConfirmation = isCliSkipConfirmation() || config.skipConfirmation === true;
+        if (errors.length > 0) {
+            log.warn(`${errors.length} plugin(s) failed to load:`);
+            for (const e of errors) {
+                log.warn(`  "${e.specifier}": ${e.error}`);
+            }
+        }
+        log.info(`Config loaded: ${config.localPlugins.length} local plugin path(s), ${Object.keys(config.tools).length} tool setting(s)`);
+        rebuildCachedBrowserTools(state);
+        pruneStaleState(state);
+    }
+    catch (err) {
+        log.error('Reload failed, keeping previous state:', err);
+    }
+    // File watchers, config watching, and mtime polling are dev-only features.
+    // Production mode discovers plugins once at startup; restart to reload.
+    if (isDev()) {
+        const callbacks = createFileWatcherCallbacks(state, sessionServers, transports);
+        const failedPaths = state.registry.failures.map(f => f.path);
+        startFileWatching(state, callbacks, failedPaths);
+        startConfigWatching(state, callbacks);
+    }
+    if (state.extensionWs) {
+        await sendSyncFull(state);
+    }
+};
+/**
+ * Clear and restart the periodic sweep timer for stale MCP sessions.
+ * Both reload paths call this to ensure the timer is always fresh.
+ */
+const restartSweepTimer = (state, transports, sessionServers) => {
+    if (state.sweepTimerId !== null) {
+        clearInterval(state.sweepTimerId);
+        state.sweepTimerId = null;
+    }
+    state.sweepTimerId = setInterval(() => {
+        sweepStaleSessions(state, transports, sessionServers);
+    }, 60_000);
+};
+/**
+ * Run the full reload sequence.
+ *
+ * On first load: discovers plugins, kicks off version check. In dev mode,
+ * also starts file watchers for local plugins and config.json.
+ * On hot reload: additionally re-registers MCP handlers on existing sessions,
+ * refreshes browser tools, installs/updates the managed extension, and notifies
+ * all MCP clients.
+ *
+ * If discovery fails, the server continues with whatever plugins were in state
+ * before the reload attempt.
+ *
+ * A globalThis-based guard prevents concurrent reloads: if a previous reload
+ * is still running (e.g., bun --hot fires twice in quick succession), this
+ * call waits for it to finish before proceeding.
+ */
+const performReload = async (state, sessionServers, transports, isHotReload) => {
+    // Wait for any in-flight reload to complete before starting a new one
+    const existingGuard = getReloadGuard();
+    if (existingGuard) {
+        log.info('Waiting for in-flight reload to complete before starting new reload...');
+        await existingGuard;
+    }
+    // Create a deferred promise that other callers can await
+    let resolveGuard;
+    const guard = new Promise(resolve => {
+        resolveGuard = resolve;
+    });
+    setReloadGuard(guard);
+    const startTs = Date.now();
+    try {
+        // Clear the previous periodic sweep timer — it closes over stale references
+        // from the previous module evaluation. A fresh timer is started below.
+        restartSweepTimer(state, transports, sessionServers);
+        // Ensure the managed extension in ~/.opentabs/extension/ is up to date.
+        // Isolated from the rest of reload so a transient filesystem error
+        // (cpSync, mkdirSync, Bun.write) does not block plugin discovery.
+        try {
+            const installResult = await ensureExtensionInstalled();
+            if (installResult.versionChanged) {
+                if (state.extensionWs) {
+                    // Extension is connected — send reload after a short delay to let
+                    // sync.full flush first (the extension handles extension.reload by
+                    // calling chrome.runtime.reload() after its own flush delay).
+                    log.info('Extension version changed — sending reload signal to connected extension');
+                    setTimeout(() => sendExtensionReload(state), 500);
+                }
+                else {
+                    // Extension not connected — flag for reload on next connect
+                    log.info('Extension version changed — reload will be sent on next extension connect');
+                    state.pendingExtensionReload = true;
+                }
+            }
+        }
+        catch (err) {
+            log.warn('Extension install failed (continuing with plugin discovery):', err);
+        }
+        // Remove leftover __exec-*.js files from previous sessions/crashes
+        try {
+            await cleanupStaleExecFiles();
+        }
+        catch (err) {
+            log.warn('Exec file cleanup failed:', err);
+        }
+        // Update browser tools from the fresh module import (bun --hot re-evaluates
+        // the import chain so browserTools contains the latest definitions)
+        state.browserTools = browserTools;
+        await reloadCore({ state, sessionServers, transports });
+        // Re-register MCP handlers on ALL existing sessions so they invoke the
+        // latest handler logic (dispatchToExtension, browser tools, etc.).
+        // Each session is wrapped individually so one failing session doesn't
+        // block the rest. On first load, sessionServers is empty so this is skipped.
+        if (isHotReload) {
+            let reregistered = 0;
+            for (const srv of sessionServers) {
+                try {
+                    registerMcpHandlers(srv, state);
+                    reregistered++;
+                }
+                catch (err) {
+                    log.warn('Failed to re-register handlers on a session:', err);
+                }
+            }
+            log.info(`Hot reload: re-registered ${reregistered}/${sessionServers.length} session(s), notifying of list changes`);
+            for (const srv of sessionServers) {
+                notifyToolListChanged(srv);
+                notifyResourceListChanged(srv);
+                notifyPromptListChanged(srv);
+            }
+        }
+        // Version check: non-blocking, best-effort on every reload
+        void checkForUpdates(state).catch(() => {
+            // Update check is best-effort — failures are not actionable
+        });
+        const durationMs = Date.now() - startTs;
+        return {
+            lastReloadTimestamp: Date.now(),
+            lastReloadDurationMs: durationMs,
+        };
+    }
+    finally {
+        // Clear the guard so subsequent reloads can proceed immediately
+        resolveGuard();
+        setReloadGuard(undefined);
+    }
+};
+/**
+ * Reload config and rediscover plugins at runtime without bun --hot.
+ * Called from the POST /reload HTTP endpoint. Performs the same config/plugin
+ * rediscovery as performReload but without the bun --hot-specific module
+ * re-evaluation aspects (browser tools refresh, session handler re-registration).
+ *
+ * Returns the number of plugins discovered and the duration in milliseconds.
+ */
+const performConfigReload = async (state, sessionServers, transports) => {
+    const existingGuard = getReloadGuard();
+    if (existingGuard) {
+        await existingGuard;
+    }
+    let resolveGuard;
+    const guard = new Promise(resolve => {
+        resolveGuard = resolve;
+    });
+    setReloadGuard(guard);
+    const startTs = Date.now();
+    try {
+        // Clear and restart the sweep timer so it uses fresh references
+        restartSweepTimer(state, transports, sessionServers);
+        await reloadCore({ state, sessionServers, transports });
+        // Notify all MCP clients that tool/resource/prompt lists changed after config reload.
+        // (performReload handles its own notification after handler re-registration,
+        // so reloadCore itself does not notify — each caller is responsible.)
+        for (const srv of sessionServers) {
+            notifyToolListChanged(srv);
+            notifyResourceListChanged(srv);
+            notifyPromptListChanged(srv);
+        }
+        log.info(`Config reload complete: ${state.registry.plugins.size} plugin(s) in ${Date.now() - startTs}ms`);
+        return { plugins: state.registry.plugins.size, durationMs: Date.now() - startTs };
+    }
+    finally {
+        resolveGuard();
+        setReloadGuard(undefined);
+    }
+};
+export { performReload, performConfigReload };
+//# sourceMappingURL=reload.js.map

package/dist/reload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reload.js","sourceRoot":"","sources":["../src/reload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAWrD;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,2BAAoC,CAAC;AAE9D,MAAM,cAAc,GAAG,GAA8B,EAAE,CACpD,UAAsC,CAAC,gBAAgB,CAA8B,CAAC;AAEzF,MAAM,cAAc,GAAG,CAAC,OAAkC,EAAQ,EAAE;IACjE,UAAsC,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC;AACtE,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,KAAkB,EAAQ,EAAE;IACnD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC9C,qBAAqB,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,UAAU,qBAAqB,kCAAkC,CAAC,CAAC;IAC9E,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACvD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,IAAI,CAAC,CACnF,CAAC;AACJ,CAAC,CAAC;AASF;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,CACjC,KAAkB,EAClB,cAAmC,EACnC,UAAiE,EACjE,EAAE;IACF,MAAM,gBAAgB,GAAG,GAAS,EAAE;QAClC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,yBAAyB,CAAC,GAAG,CAAC,CAAC;YAC/B,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE;YACxC,KAAK,CAAC,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1G,gBAAgB,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACjG,GAAG,CAAC,KAAK,CAAC,oCAAoC,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;gBACpE,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,aAAa,EAAE,CAAC,UAAkB,EAAE,IAAY,EAAE,SAAkB,EAAE,EAAE;YACtE,KAAK,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC/E,GAAG,CAAC,KAAK,CAAC,oCAAoC,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,eAAe,EAAE,GAAG,EAAE;YACpB,KAAK,mBAAmB,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACjF,GAAG,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,kBAAkB,EAAE,CAAC,UAAkB,EAAE,EAAE;YACzC,GAAG,CAAC,IAAI,CAAC,WAAW,UAAU,uEAAuE,CAAC,CAAC;YACvG,KAAK,CAAC,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1G,gBAAgB,EAAE,CAAC;YACnB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBAC9C,GAAG,CAAC,KAAK,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;gBACrE,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,GAAG,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAkB,EAAiB,EAAE;IAChG,uFAAuF;IACvF,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAEnF,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QACvC,KAAK,CAAC,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC1D,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7C,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;QACvC,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC;QAC/B,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,KAAK,CAAC,gBAAgB,GAAG,qBAAqB,EAAE,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;QAErF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,4BAA4B,CAAC,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,GAAG,CAAC,IAAI,CACN,kBAAkB,MAAM,CAAC,YAAY,CAAC,MAAM,0BAA0B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,kBAAkB,CACzH,CAAC;QAEF,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACjC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,KAAK,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,0BAA0B,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACjD,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CACxB,KAAkB,EAClB,UAAiE,EACjE,cAAmC,EAC7B,EAAE;IACR,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAChC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,aAAa,GAAG,KAAK,EACzB,KAAkB,EAClB,cAAmC,EACnC,UAAiE,EACjE,WAAoB,EACG,EAAE;IACzB,sEAAsE;IACtE,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC;IACvC,IAAI,aAAa,EAAE,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QACnF,MAAM,aAAa,CAAC;IACtB,CAAC;IAED,yDAAyD;IACzD,IAAI,YAAyB,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;QACxC,YAAY,GAAG,OAAO,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,CAAC;QACH,4EAA4E;QAC5E,uEAAuE;QACvE,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QAErD,wEAAwE;QACxE,mEAAmE;QACnE,kEAAkE;QAClE,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,wBAAwB,EAAE,CAAC;YACvD,IAAI,aAAa,CAAC,cAAc,EAAE,CAAC;gBACjC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;oBACtB,kEAAkE;oBAClE,mEAAmE;oBACnE,8DAA8D;oBAC9D,GAAG,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;oBACrF,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,4DAA4D;oBAC5D,GAAG,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;oBACtF,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,4EAA4E;QAC5E,oEAAoE;QACpE,KAAK,CAAC,YAAY,GAAG,YAAY,CAAC;QAElC,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;QAExD,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAChC,YAAY,EAAE,CAAC;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CACN,6BAA6B,YAAY,IAAI,cAAc,CAAC,MAAM,wCAAwC,CAC3G,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBAC3B,yBAAyB,CAAC,GAAG,CAAC,CAAC;gBAC/B,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACrC,4DAA4D;QAC9D,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,OAAO;YACL,mBAAmB,EAAE,IAAI,CAAC,GAAG,EAAE;YAC/B,oBAAoB,EAAE,UAAU;SACjC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,gEAAgE;QAChE,YAAY,EAAE,CAAC;QACf,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,KAAK,EAC/B,KAAkB,EAClB,cAAmC,EACnC,UAAiE,EACf,EAAE;IACpD,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC;IACvC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,aAAa,CAAC;IACtB,CAAC;IAED,IAAI,YAAyB,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;QACxC,YAAY,GAAG,OAAO,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,CAAC;QACH,gEAAgE;QAChE,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;QAExD,sFAAsF;QACtF,6EAA6E;QAC7E,sEAAsE;QACtE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,yBAAyB,CAAC,GAAG,CAAC,CAAC;YAC/B,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,2BAA2B,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,iBAAiB,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,CAAC,CAAC;QAE1G,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,YAAY,EAAE,CAAC;QACf,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAGF,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/resolver.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Plugin resolver module.
+ *
+ * Resolves plugin specifiers (npm package names or filesystem paths) into
+ * absolute directory paths containing a plugin's package.json. Decouples
+ * path resolution from plugin loading so each phase can be tested independently.
+ *
+ * Also provides global npm plugin auto-discovery: scans global node_modules
+ * directories (from both npm and bun) for packages matching the opentabs-plugin-*
+ * naming convention.
+ */
+import type { Result } from '@opentabs-dev/shared';
+/**
+ * Validate that a resolved plugin path is under an allowed root directory.
+ * Uses realpath on both the plugin path and the allowed roots to resolve
+ * symlinks (e.g., macOS /var → /private/var), preventing traversal attacks.
+ * Checks against both raw and resolved roots to handle non-existent paths
+ * where realpath falls back to the unresolved input.
+ */
+declare const isAllowedPluginPath: (resolvedPath: string) => Promise<boolean>;
+/**
+ * Resolve a plugin specifier to an absolute directory path.
+ *
+ * Specifiers can be:
+ * - Local paths: './my-plugin', '../plugins/foo', '/absolute/path', '~/plugins/foo'
+ * - npm package names: 'opentabs-plugin-slack', '@org/opentabs-plugin-foo'
+ *
+ * For local paths, resolves relative to configDir and validates the path is
+ * under an allowed root directory (homedir or tmpdir).
+ *
+ * For npm packages, uses Bun.resolveSync to locate the package directory.
+ *
+ * Returns the directory path containing the plugin's package.json.
+ */
+declare const resolvePluginPath: (specifier: string, configDir: string) => Promise<Result<string, string>>;
+/**
+ * Discover globally installed npm plugin packages.
+ *
+ * Scans global node_modules directories (from both npm and bun) for packages
+ * matching the opentabs-plugin-* naming convention. Each match is validated
+ * by checking for a package.json with an `opentabs` field.
+ *
+ * Returns an array of absolute directory paths for discovered plugins,
+ * plus any non-fatal errors encountered during scanning.
+ */
+declare const discoverGlobalNpmPlugins: () => Promise<{
+    dirs: string[];
+    errors: string[];
+}>;
+/** Reset the cached global paths (for testing). */
+declare const resetGlobalPathsCache: () => void;
+export { discoverGlobalNpmPlugins, isAllowedPluginPath, resetGlobalPathsCache, resolvePluginPath };
+//# sourceMappingURL=resolver.d.ts.map

package/dist/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAqBnD;;;;;;GAMG;AACH,QAAA,MAAM,mBAAmB,GAAU,cAAc,MAAM,KAAG,OAAO,CAAC,OAAO,CAQxE,CAAC;AA4CF;;;;;;;;;;;;;GAaG;AACH,QAAA,MAAM,iBAAiB,GAAU,WAAW,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBrG,CAAC;AAmHF;;;;;;;;;GASG;AACH,QAAA,MAAM,wBAAwB,QAAa,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAgCtF,CAAC;AAEF,mDAAmD;AACnD,QAAA,MAAM,qBAAqB,QAAO,IAEjC,CAAC;AAEF,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/resolver.js

@@ -0,0 +1,272 @@
+/**
+ * Plugin resolver module.
+ *
+ * Resolves plugin specifiers (npm package names or filesystem paths) into
+ * absolute directory paths containing a plugin's package.json. Decouples
+ * path resolution from plugin loading so each phase can be tested independently.
+ *
+ * Also provides global npm plugin auto-discovery: scans global node_modules
+ * directories (from both npm and bun) for packages matching the opentabs-plugin-*
+ * naming convention.
+ */
+import { log } from './logger.js';
+import { ok, err } from '@opentabs-dev/shared';
+import { readdir, realpath, stat } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+/**
+ * Allowed root directories for local plugin paths.
+ * Plugins must reside under the user's home directory or the system temp directory.
+ * The temp directory allowance supports E2E tests and development workflows.
+ */
+const getAllowedRoots = () => [homedir(), tmpdir()];
+/**
+ * Resolve a path to its canonical form, following symlinks.
+ * Falls back to the input path if realpath fails (e.g., non-existent target).
+ */
+const safeRealpath = async (path) => {
+    try {
+        return await realpath(path);
+    }
+    catch {
+        return path;
+    }
+};
+/**
+ * Validate that a resolved plugin path is under an allowed root directory.
+ * Uses realpath on both the plugin path and the allowed roots to resolve
+ * symlinks (e.g., macOS /var → /private/var), preventing traversal attacks.
+ * Checks against both raw and resolved roots to handle non-existent paths
+ * where realpath falls back to the unresolved input.
+ */
+const isAllowedPluginPath = async (resolvedPath) => {
+    const realPath = await safeRealpath(resolvedPath);
+    const rawRoots = getAllowedRoots();
+    const realRoots = await Promise.all(rawRoots.map(safeRealpath));
+    // Deduplicate: on macOS, raw /var/... and resolved /private/var/... differ
+    const allRoots = [...new Set([...rawRoots, ...realRoots])];
+    return allRoots.some(root => realPath.startsWith(root + '/') || realPath === root);
+};
+/**
+ * Check if a specifier is a local filesystem path.
+ * Local paths start with './', '.\\', '../', '..\\', '/', '~/', '~\\',
+ * or a Windows drive letter (e.g., 'C:\') — everything else is treated
+ * as an npm package name.
+ */
+const isLocalPath = (specifier) => specifier.startsWith('./') ||
+    specifier.startsWith('.\\') ||
+    specifier.startsWith('../') ||
+    specifier.startsWith('..\\') ||
+    specifier.startsWith('/') ||
+    specifier.startsWith('~/') ||
+    specifier.startsWith('~\\') ||
+    /^[A-Za-z]:[/\\]/.test(specifier);
+/**
+ * Resolve a local filesystem path specifier to an absolute directory path.
+ * Paths starting with '~/' or '~\' are expanded to the user's home directory.
+ * Other relative paths are resolved against configDir.
+ */
+const resolveLocalPath = (specifier, configDir) => {
+    if (specifier.startsWith('~/') || specifier.startsWith('~\\')) {
+        return resolve(homedir(), specifier.slice(2));
+    }
+    return resolve(configDir, specifier);
+};
+/**
+ * Resolve an npm package specifier to the directory containing its package.json.
+ * Uses Bun.resolveSync to locate the package's package.json, then returns
+ * the containing directory.
+ */
+const resolveNpmPackage = (specifier) => {
+    try {
+        const resolved = Bun.resolveSync(`${specifier}/package.json`, process.cwd());
+        return ok(dirname(resolved));
+    }
+    catch {
+        return err(`Package not found: ${specifier}`);
+    }
+};
+/**
+ * Resolve a plugin specifier to an absolute directory path.
+ *
+ * Specifiers can be:
+ * - Local paths: './my-plugin', '../plugins/foo', '/absolute/path', '~/plugins/foo'
+ * - npm package names: 'opentabs-plugin-slack', '@org/opentabs-plugin-foo'
+ *
+ * For local paths, resolves relative to configDir and validates the path is
+ * under an allowed root directory (homedir or tmpdir).
+ *
+ * For npm packages, uses Bun.resolveSync to locate the package directory.
+ *
+ * Returns the directory path containing the plugin's package.json.
+ */
+const resolvePluginPath = async (specifier, configDir) => {
+    if (isLocalPath(specifier)) {
+        const resolvedPath = resolveLocalPath(specifier, configDir);
+        if (!(await isAllowedPluginPath(resolvedPath))) {
+            return err(`Path outside allowed directories: ${resolvedPath}`);
+        }
+        // Verify the directory exists before passing to the loader
+        try {
+            const stats = await stat(resolvedPath);
+            if (!stats.isDirectory()) {
+                return err(`Path is not a directory: ${resolvedPath}`);
+            }
+        }
+        catch {
+            return err(`Path not found: ${resolvedPath} — check that the directory exists in your config`);
+        }
+        return ok(resolvedPath);
+    }
+    return resolveNpmPackage(specifier);
+};
+/** Cached global node_modules paths (computed once at startup). */
+let cachedGlobalPaths = null;
+/**
+ * Get global node_modules directories from both npm and bun.
+ * Results are cached in a module-level variable so the shell commands
+ * run at most once per process lifetime.
+ */
+const getGlobalNodeModulesPaths = () => {
+    if (cachedGlobalPaths !== null)
+        return cachedGlobalPaths;
+    const paths = [];
+    // npm global node_modules
+    try {
+        const result = Bun.spawnSync(['npm', 'root', '-g']);
+        if (result.exitCode === 0) {
+            const npmPath = result.stdout.toString().trim();
+            if (npmPath.length > 0)
+                paths.push(npmPath);
+        }
+    }
+    catch {
+        // npm not installed or not in PATH
+    }
+    // bun global node_modules (derive from bin path: .../bin → .../node_modules)
+    try {
+        const result = Bun.spawnSync(['bun', 'pm', '-g', 'bin']);
+        if (result.exitCode === 0) {
+            const bunBinPath = result.stdout.toString().trim();
+            if (bunBinPath.length > 0) {
+                const bunNodeModules = join(dirname(bunBinPath), 'node_modules');
+                // Avoid duplicates if npm and bun share the same global directory
+                if (!paths.includes(bunNodeModules))
+                    paths.push(bunNodeModules);
+            }
+        }
+    }
+    catch {
+        // bun not installed or not in PATH
+    }
+    cachedGlobalPaths = paths;
+    return paths;
+};
+/**
+ * Check if a directory contains a valid opentabs plugin package.json
+ * (has an `opentabs` field that is an object).
+ */
+const hasOpentabsField = async (dir) => {
+    try {
+        const raw = (await Bun.file(join(dir, 'package.json')).json());
+        return typeof raw.opentabs === 'object' && raw.opentabs !== null && !Array.isArray(raw.opentabs);
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Scan a single global node_modules directory for opentabs plugin packages.
+ * Matches unscoped opentabs-plugin-* and scoped @scope/opentabs-plugin-* entries.
+ * Returns absolute paths of directories that contain a valid plugin package.json.
+ */
+const scanGlobalDir = async (globalDir) => {
+    const found = [];
+    let entries;
+    try {
+        entries = await readdir(globalDir);
+    }
+    catch {
+        return found;
+    }
+    // Collect unscoped matches and scoped directories to inspect
+    const unscopedChecks = [];
+    const scopeDirScans = [];
+    for (const entry of entries) {
+        if (entry.startsWith('opentabs-plugin-')) {
+            const fullPath = join(globalDir, entry);
+            unscopedChecks.push(hasOpentabsField(fullPath).then(valid => {
+                if (valid)
+                    found.push(fullPath);
+            }));
+        }
+        else if (entry.startsWith('@')) {
+            // Scoped package directory — scan for opentabs-plugin-* within it
+            const scopeDir = join(globalDir, entry);
+            scopeDirScans.push(readdir(scopeDir)
+                .then(async (scopeEntries) => {
+                const scopeChecks = [];
+                for (const scopeEntry of scopeEntries) {
+                    if (scopeEntry.startsWith('opentabs-plugin-')) {
+                        const fullPath = join(scopeDir, scopeEntry);
+                        scopeChecks.push(hasOpentabsField(fullPath).then(valid => {
+                            if (valid)
+                                found.push(fullPath);
+                        }));
+                    }
+                }
+                await Promise.all(scopeChecks);
+            })
+                .catch(() => {
+                // Scope directory unreadable — skip it
+            }));
+        }
+    }
+    await Promise.all([...unscopedChecks, ...scopeDirScans]);
+    return found;
+};
+/**
+ * Discover globally installed npm plugin packages.
+ *
+ * Scans global node_modules directories (from both npm and bun) for packages
+ * matching the opentabs-plugin-* naming convention. Each match is validated
+ * by checking for a package.json with an `opentabs` field.
+ *
+ * Returns an array of absolute directory paths for discovered plugins,
+ * plus any non-fatal errors encountered during scanning.
+ */
+const discoverGlobalNpmPlugins = async () => {
+    const globalPaths = getGlobalNodeModulesPaths();
+    const errors = [];
+    if (globalPaths.length === 0) {
+        log.info('No global node_modules paths found — skipping npm auto-discovery');
+        return { dirs: [], errors };
+    }
+    log.info(`Scanning global node_modules for plugins: ${globalPaths.join(', ')}`);
+    const allDirs = [];
+    const seen = new Set();
+    for (const globalDir of globalPaths) {
+        try {
+            const dirs = await scanGlobalDir(globalDir);
+            for (const dir of dirs) {
+                // Deduplicate across npm/bun global paths (same package may appear in both)
+                if (!seen.has(dir)) {
+                    seen.add(dir);
+                    allDirs.push(dir);
+                }
+            }
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            errors.push(`Error scanning ${globalDir}: ${msg}`);
+        }
+    }
+    log.info(`Auto-discovered ${allDirs.length} npm plugin(s) globally`);
+    return { dirs: allDirs, errors };
+};
+/** Reset the cached global paths (for testing). */
+const resetGlobalPathsCache = () => {
+    cachedGlobalPaths = null;
+};
+export { discoverGlobalNpmPlugins, isAllowedPluginPath, resetGlobalPathsCache, resolvePluginPath };
+//# sourceMappingURL=resolver.js.map