@openvcs/sdk 0.4.0 → 0.4.1-edge.20260530.101

package/README.md

@@ -5,6 +5,8 @@
 
 OpenVCS SDK for npm-based plugin development.
 
+Requires Node.js 20 or newer.
+
 Install this package in plugin projects, scaffold a starter plugin, and build
 plugin runtime assets. The SDK also exports a Node-only JSON-RPC runtime
 layer and shared protocol/types so plugins do not have to hand-roll stdio
@@ -41,6 +43,16 @@ Run tests (builds first):
 npm test
 ```
 
+Generate a coverage report:
+
+```bash
+npm run coverage
+```
+
+This runs the full test flow, writes c8 output to `coverage/`, and fails if
+coverage drops below 95% lines, 95% functions, 85% branches, or 95%
+statements.
+
 Run the local CLI through npm scripts:
 
 ```bash

package/lib/build.d.ts

@@ -1,3 +1,4 @@
+export { npmExecutable } from "./npm-runner";
 /** CLI arguments for `openvcs build`. */
 export interface BuildArgs {
     pluginDir: string;
@@ -10,10 +11,6 @@ export interface ManifestInfo {
     entry: string | undefined;
     manifestPath: string;
 }
-/** Returns the npm executable name for the current platform. */
-export declare function npmExecutable(): string;
-/** Returns whether a command must be launched via the Windows shell. */
-export declare function shouldUseWindowsShell(program: string): boolean;
 /** Formats help text for the build command. */
 export declare function buildUsage(commandName?: string): string;
 /** Parses `openvcs build` arguments. */

package/lib/build.js

@@ -35,8 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.npmExecutable = npmExecutable;
-exports.shouldUseWindowsShell = shouldUseWindowsShell;
+exports.npmExecutable = void 0;
 exports.buildUsage = buildUsage;
 exports.parseBuildArgs = parseBuildArgs;
 exports.readManifest = readManifest;
@@ -52,19 +51,10 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_child_process_1 = require("node:child_process");
 const fs_utils_1 = require("./fs-utils");
+const npm_runner_1 = require("./npm-runner");
+var npm_runner_2 = require("./npm-runner");
+Object.defineProperty(exports, "npmExecutable", { enumerable: true, get: function () { return npm_runner_2.npmExecutable; } });
 const AUTHORED_PLUGIN_MODULE_BASENAME = "plugin.js";
-/** Returns the npm executable name for the current platform. */
-function npmExecutable() {
-    return "npm";
-}
-/** Returns whether a command must be launched via the Windows shell. */
-function shouldUseWindowsShell(program) {
-    if (process.platform !== "win32") {
-        return false;
-    }
-    const normalized = program.toLowerCase();
-    return normalized === "npm" || normalized.endsWith(".cmd") || normalized.endsWith(".bat");
-}
 /** Formats help text for the build command. */
 function buildUsage(commandName = "openvcs") {
     return `${commandName} build [args]\n\n  --plugin-dir <path>   Plugin repository root (contains package.json with openvcs metadata)\n  -V, --verbose         Enable verbose output\n`;
@@ -262,8 +252,8 @@ function runCommand(program, args, cwd, verbose) {
     }
     const result = (0, node_child_process_1.spawnSync)(program, args, {
         cwd,
-        shell: shouldUseWindowsShell(program),
         stdio: ["ignore", verbose ? "inherit" : "ignore", "inherit"],
+        windowsHide: true,
     });
     if (result.error) {
         throw new Error(`failed to spawn '${program}' in ${cwd}: ${result.error.message}`);
@@ -307,7 +297,7 @@ function buildPluginAssets(parsedArgs) {
     if (typeof buildScript !== "string" || buildScript.trim() === "") {
         throw new Error(`code plugins must define scripts[\"build:plugin\"] in ${path.join(parsedArgs.pluginDir, "package.json")}`);
     }
-    runCommand(npmExecutable(), ["run", "build:plugin"], parsedArgs.pluginDir, parsedArgs.verbose);
+    runCommand((0, npm_runner_1.npmExecutable)(), [...(0, npm_runner_1.npmArgsPrefix)(), "run", "build:plugin"], parsedArgs.pluginDir, parsedArgs.verbose);
     generateModuleBootstrap(parsedArgs.pluginDir, manifest.moduleExec);
     validateDeclaredModuleExec(parsedArgs.pluginDir, manifest.moduleExec);
     return manifest;

package/lib/init.d.ts

@@ -22,18 +22,22 @@ interface InitCommandError {
 export declare function initUsage(commandName?: string): string;
 declare function sanitizeIdToken(raw: string): string;
 declare function defaultPluginIdFromDir(targetDir: string): string;
+declare function defaultPluginNameFromId(pluginId: string): string;
 declare function validatePluginId(pluginId: string): string | undefined;
 declare function createReadlinePromptDriver(output?: NodeJS.WritableStream): PromptDriver;
 declare function collectAnswers({ forceTheme, targetHint }: CollectAnswersOptions, promptDriver?: PromptDriver, output?: NodeJS.WritableStream): Promise<InitAnswers>;
 declare function writeModuleTemplate(answers: InitAnswers): void;
+declare function writeThemeTemplate(answers: InitAnswers): void;
 export declare function runInitCommand(args: string[]): Promise<string>;
 export declare function isUsageError(error: unknown): error is InitCommandError;
 export declare const __private: {
     collectAnswers: typeof collectAnswers;
     createReadlinePromptDriver: typeof createReadlinePromptDriver;
+    defaultPluginNameFromId: typeof defaultPluginNameFromId;
     defaultPluginIdFromDir: typeof defaultPluginIdFromDir;
     sanitizeIdToken: typeof sanitizeIdToken;
     validatePluginId: typeof validatePluginId;
     writeModuleTemplate: typeof writeModuleTemplate;
+    writeThemeTemplate: typeof writeThemeTemplate;
 };
 export {};

package/lib/init.js

@@ -42,17 +42,8 @@ const path = __importStar(require("node:path"));
 const readline = __importStar(require("node:readline/promises"));
 const node_process_1 = require("node:process");
 const node_child_process_1 = require("node:child_process");
+const npm_runner_1 = require("./npm-runner");
 const packageJson = require("../package.json");
-function npmExecutable() {
-    return "npm";
-}
-function shouldUseWindowsShell(program) {
-    if (process.platform !== "win32") {
-        return false;
-    }
-    const normalized = program.toLowerCase();
-    return normalized === "npm" || normalized.endsWith(".cmd") || normalized.endsWith(".bat");
-}
 function initUsage(commandName = "openvcs") {
     return `Usage: ${commandName} init [--theme] [target-dir]\n\nOptions:\n  --theme                Start with a theme-only plugin template\n`;
 }
@@ -203,10 +194,10 @@ async function collectAnswers({ forceTheme, targetHint }, promptDriver = createR
     }
 }
 function runNpmInstall(targetDir) {
-    const result = (0, node_child_process_1.spawnSync)(npmExecutable(), ["install"], {
+    const result = (0, node_child_process_1.spawnSync)((0, npm_runner_1.npmExecutable)(), [...(0, npm_runner_1.npmArgsPrefix)(), "install"], {
         cwd: targetDir,
-        shell: shouldUseWindowsShell(npmExecutable()),
         stdio: "inherit",
+        windowsHide: true,
     });
     if (result.error) {
         throw new Error(`failed to spawn npm install in ${targetDir}: ${result.error.message}`);
@@ -228,7 +219,6 @@ function writeModuleTemplate(answers) {
         openvcs: {
             id: answers.pluginId,
             name: answers.pluginName,
-            version: answers.pluginVersion,
             default_enabled: answers.defaultEnabled,
             module: { exec: "openvcs-plugin.js" },
         },
@@ -269,7 +259,6 @@ function writeThemeTemplate(answers) {
         openvcs: {
             id: answers.pluginId,
             name: answers.pluginName,
-            version: answers.pluginVersion,
             default_enabled: answers.defaultEnabled,
         },
         scripts: {
@@ -350,8 +339,10 @@ function isUsageError(error) {
 exports.__private = {
     collectAnswers,
     createReadlinePromptDriver,
+    defaultPluginNameFromId,
     defaultPluginIdFromDir,
     sanitizeIdToken,
     validatePluginId,
     writeModuleTemplate,
+    writeThemeTemplate,
 };

package/lib/npm-runner.d.ts

@@ -0,0 +1,11 @@
+type ExistsFn = (path: string) => boolean;
+type ResolveFn = (specifier: string) => string;
+export interface NpmCommand {
+    program: string;
+    argsPrefix: string[];
+}
+export declare function resolveNpmCli(execPath?: string, exists?: ExistsFn, resolve?: ResolveFn): string;
+export declare function npmCommand(platform?: NodeJS.Platform, execPath?: string, exists?: ExistsFn, resolve?: ResolveFn): NpmCommand;
+export declare function npmExecutable(): string;
+export declare function npmArgsPrefix(): string[];
+export {};

package/lib/npm-runner.js

@@ -0,0 +1,62 @@
+"use strict";
+// Copyright © 2025-2026 OpenVCS Contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveNpmCli = resolveNpmCli;
+exports.npmCommand = npmCommand;
+exports.npmExecutable = npmExecutable;
+exports.npmArgsPrefix = npmArgsPrefix;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+function resolveNpmCli(execPath = process.execPath, exists = fs.existsSync, resolve = require.resolve) {
+    const localNodeModules = path.join(path.dirname(execPath), "node_modules", "npm", "bin", "npm-cli.js");
+    if (exists(localNodeModules)) {
+        return localNodeModules;
+    }
+    return resolve("npm/bin/npm-cli.js");
+}
+function npmCommand(platform = process.platform, execPath = process.execPath, exists = fs.existsSync, resolve = require.resolve) {
+    if (platform !== "win32") {
+        return { program: "npm", argsPrefix: [] };
+    }
+    return { program: execPath, argsPrefix: [resolveNpmCli(execPath, exists, resolve)] };
+}
+function npmExecutable() {
+    return npmCommand().program;
+}
+function npmArgsPrefix() {
+    return npmCommand().argsPrefix;
+}

package/lib/runtime/dispatcher.js

@@ -83,23 +83,31 @@ function createRuntimeDispatcher(options, host, writer) {
             }
             let result;
             if (timeout && timeout > 0) {
-                const controller = new AbortController();
-                const timeoutId = setTimeout(() => controller.abort(), timeout);
+                let timeoutId;
+                const timeoutPromise = new Promise((_resolve, reject) => {
+                    timeoutId = setTimeout(() => {
+                        reject((0, errors_1.pluginError)('request-timeout', `method '${method}' timed out after ${timeout}ms`));
+                    }, timeout);
+                });
                 try {
-                    result = await handler(params, {
-                        host,
-                        requestId: id,
-                        method,
-                    });
+                    result = await Promise.race([
+                        handler(params, {
+                            host,
+                            requestId: id,
+                            method,
+                        }),
+                        timeoutPromise,
+                    ]);
                 }
                 catch (error) {
-                    clearTimeout(timeoutId);
-                    if (error.name === 'AbortError') {
-                        throw (0, errors_1.pluginError)('request-timeout', `method '${method}' timed out after ${timeout}ms`);
+                    if (timeoutId !== undefined) {
+                        clearTimeout(timeoutId);
                     }
                     throw error;
                 }
-                clearTimeout(timeoutId);
+                if (timeoutId !== undefined) {
+                    clearTimeout(timeoutId);
+                }
             }
             else {
                 result = await handler(params, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvcs/sdk",
-  "version": "0.4.0",
+  "version": "0.4.1-edge.20260530.101",
   "description": "OpenVCS SDK CLI for plugin scaffolding and runtime asset builds",
   "license": "GPL-3.0-or-later",
   "homepage": "https://openvcs.app/",
@@ -12,7 +12,7 @@
     "url": "https://github.com/Open-VCS/OpenVCS-SDK/issues"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "bin": {
     "openvcs": "bin/openvcs.js"
@@ -32,7 +32,9 @@
   },
   "scripts": {
     "build": "node scripts/build-sdk.js",
-    "test": "npm run build && npm run test:types && node --test test/*.test.js",
+    "test": "npm run build && npm run test:types && node scripts/run-tests.js",
+    "coverage": "npm run build && npm run test:types && c8 --check-coverage --lines 95 --functions 95 --branches 85 --statements 95 --reporter=text --reporter=lcov node scripts/run-tests.js",
+    "test:coverage": "npm run coverage",
     "test:types": "node ./node_modules/typescript/bin/tsc -p test/tsconfig.json",
     "prepack": "npm run build",
     "preopenvcs": "npm run build",
@@ -40,6 +42,7 @@
   },
   "devDependencies": {
     "@types/node": "^25.3.3",
+    "c8": "^11.0.0",
     "typescript": "^6.0.3"
   },
   "files": [

package/src/lib/build.ts

@@ -6,6 +6,9 @@ import * as path from "node:path";
 import { spawnSync } from "node:child_process";
 
 import { isPathInside } from "./fs-utils";
+import { npmArgsPrefix, npmExecutable } from "./npm-runner";
+
+export { npmExecutable } from "./npm-runner";
 
 type UsageError = Error & { code?: string };
 
@@ -34,21 +37,6 @@ interface PackageScripts {
 
 const AUTHORED_PLUGIN_MODULE_BASENAME = "plugin.js";
 
-/** Returns the npm executable name for the current platform. */
-export function npmExecutable(): string {
-  return "npm";
-}
-
-/** Returns whether a command must be launched via the Windows shell. */
-export function shouldUseWindowsShell(program: string): boolean {
-  if (process.platform !== "win32") {
-    return false;
-  }
-
-  const normalized = program.toLowerCase();
-  return normalized === "npm" || normalized.endsWith(".cmd") || normalized.endsWith(".bat");
-}
-
 /** Formats help text for the build command. */
 export function buildUsage(commandName = "openvcs"): string {
   return `${commandName} build [args]\n\n  --plugin-dir <path>   Plugin repository root (contains package.json with openvcs metadata)\n  -V, --verbose         Enable verbose output\n`;
@@ -288,8 +276,8 @@ export function runCommand(program: string, args: string[], cwd: string, verbose
 
   const result = spawnSync(program, args, {
     cwd,
-    shell: shouldUseWindowsShell(program),
     stdio: ["ignore", verbose ? "inherit" : "ignore", "inherit"],
+    windowsHide: true,
   }) as CommandResult;
 
   if (result.error) {
@@ -342,7 +330,7 @@ export function buildPluginAssets(parsedArgs: BuildArgs): ManifestInfo {
     );
   }
 
-  runCommand(npmExecutable(), ["run", "build:plugin"], parsedArgs.pluginDir, parsedArgs.verbose);
+  runCommand(npmExecutable(), [...npmArgsPrefix(), "run", "build:plugin"], parsedArgs.pluginDir, parsedArgs.verbose);
   generateModuleBootstrap(parsedArgs.pluginDir, manifest.moduleExec);
   validateDeclaredModuleExec(parsedArgs.pluginDir, manifest.moduleExec);
   return manifest;

package/src/lib/init.ts

@@ -4,6 +4,8 @@ import * as readline from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { spawnSync } from "node:child_process";
 
+import { npmArgsPrefix, npmExecutable } from "./npm-runner";
+
 const packageJson: { version: string } = require("../package.json");
 
 type UsageError = Error & { code?: string };
@@ -33,19 +35,6 @@ interface InitCommandError {
   code?: string;
 }
 
-function npmExecutable(): string {
-  return "npm";
-}
-
-function shouldUseWindowsShell(program: string): boolean {
-  if (process.platform !== "win32") {
-    return false;
-  }
-
-  const normalized = program.toLowerCase();
-  return normalized === "npm" || normalized.endsWith(".cmd") || normalized.endsWith(".bat");
-}
-
 export function initUsage(commandName = "openvcs"): string {
   return `Usage: ${commandName} init [--theme] [target-dir]\n\nOptions:\n  --theme                Start with a theme-only plugin template\n`;
 }
@@ -214,10 +203,10 @@ async function collectAnswers(
 }
 
 function runNpmInstall(targetDir: string): void {
-  const result = spawnSync(npmExecutable(), ["install"], {
+  const result = spawnSync(npmExecutable(), [...npmArgsPrefix(), "install"], {
     cwd: targetDir,
-    shell: shouldUseWindowsShell(npmExecutable()),
     stdio: "inherit",
+    windowsHide: true,
   });
   if (result.error) {
     throw new Error(`failed to spawn npm install in ${targetDir}: ${result.error.message}`);
@@ -241,7 +230,6 @@ function writeModuleTemplate(answers: InitAnswers): void {
     openvcs: {
       id: answers.pluginId,
       name: answers.pluginName,
-      version: answers.pluginVersion,
       default_enabled: answers.defaultEnabled,
       module: { exec: "openvcs-plugin.js" },
     },
@@ -286,7 +274,6 @@ function writeThemeTemplate(answers: InitAnswers): void {
     openvcs: {
       id: answers.pluginId,
       name: answers.pluginName,
-      version: answers.pluginVersion,
       default_enabled: answers.defaultEnabled,
     },
     scripts: {
@@ -376,8 +363,10 @@ export function isUsageError(error: unknown): error is InitCommandError {
 export const __private = {
   collectAnswers,
   createReadlinePromptDriver,
+  defaultPluginNameFromId,
   defaultPluginIdFromDir,
   sanitizeIdToken,
   validatePluginId,
   writeModuleTemplate,
+  writeThemeTemplate,
 };

package/src/lib/npm-runner.ts

@@ -0,0 +1,47 @@
+// Copyright © 2025-2026 OpenVCS Contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+type ExistsFn = (path: string) => boolean;
+type ResolveFn = (specifier: string) => string;
+
+export interface NpmCommand {
+  program: string;
+  argsPrefix: string[];
+}
+
+export function resolveNpmCli(
+  execPath = process.execPath,
+  exists: ExistsFn = fs.existsSync,
+  resolve: ResolveFn = require.resolve,
+): string {
+  const localNodeModules = path.join(path.dirname(execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  if (exists(localNodeModules)) {
+    return localNodeModules;
+  }
+
+  return resolve("npm/bin/npm-cli.js");
+}
+
+export function npmCommand(
+  platform = process.platform,
+  execPath = process.execPath,
+  exists: ExistsFn = fs.existsSync,
+  resolve: ResolveFn = require.resolve,
+): NpmCommand {
+  if (platform !== "win32") {
+    return { program: "npm", argsPrefix: [] };
+  }
+
+  return { program: execPath, argsPrefix: [resolveNpmCli(execPath, exists, resolve)] };
+}
+
+export function npmExecutable(): string {
+  return npmCommand().program;
+}
+
+export function npmArgsPrefix(): string[] {
+  return npmCommand().argsPrefix;
+}

package/src/lib/runtime/dispatcher.ts

@@ -133,22 +133,30 @@ export function createRuntimeDispatcher(
 
       let result: unknown;
       if (timeout && timeout > 0) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeout);
+        let timeoutId: ReturnType<typeof setTimeout> | undefined;
+        const timeoutPromise = new Promise<never>((_resolve, reject) => {
+          timeoutId = setTimeout(() => {
+            reject(pluginError('request-timeout', `method '${method}' timed out after ${timeout}ms`));
+          }, timeout);
+        });
         try {
-          result = await handler(params, {
-            host,
-            requestId: id,
-            method,
-          });
+          result = await Promise.race([
+            handler(params, {
+              host,
+              requestId: id,
+              method,
+            }),
+            timeoutPromise,
+          ]);
         } catch (error) {
-          clearTimeout(timeoutId);
-          if ((error as Error).name === 'AbortError') {
-            throw pluginError('request-timeout', `method '${method}' timed out after ${timeout}ms`);
+          if (timeoutId !== undefined) {
+            clearTimeout(timeoutId);
           }
           throw error;
         }
-        clearTimeout(timeoutId);
+        if (timeoutId !== undefined) {
+          clearTimeout(timeoutId);
+        }
       } else {
         result = await handler(params, {
           host,

package/test/build.test.js

@@ -4,9 +4,13 @@ const path = require("node:path");
 const test = require("node:test");
 
 const {
+  authoredPluginModulePath,
   buildPluginAssets,
+  generateModuleBootstrap,
+  hasPackageJson,
   parseBuildArgs,
   readManifest,
+  runCommand,
   validateDeclaredModuleExec,
   validateGeneratedBootstrapTargets,
 } = require("../lib/build");
@@ -48,6 +52,10 @@ test("parseBuildArgs help returns usage error", () => {
   assert.throws(() => parseBuildArgs(["--help"]), /openvcs build \[args\]/);
 });
 
+test("parseBuildArgs rejects unknown flags", () => {
+  assert.throws(() => parseBuildArgs(["--wat"]), /unknown flag: --wat/);
+});
+
 test("buildPluginAssets no-ops for theme-only plugins", () => {
   const root = makeTempDir("openvcs-sdk-test");
   const pluginDir = path.join(root, "plugin");
@@ -136,6 +144,73 @@ test("readManifest and validateDeclaredModuleExec stay reusable", () => {
   cleanupTempDir(root);
 });
 
+test("readManifest reports missing and invalid package manifests", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const missingDir = path.join(root, "missing");
+  fs.mkdirSync(missingDir, { recursive: true });
+  assert.throws(() => readManifest(missingDir), /missing package\.json/);
+
+  const invalidDir = path.join(root, "invalid");
+  writeText(path.join(invalidDir, "package.json"), "{");
+  assert.throws(() => readManifest(invalidDir), /parse .*package\.json/);
+
+  const noOpenVcs = path.join(root, "no-openvcs");
+  writeJson(path.join(noOpenVcs, "package.json"), { name: "x" });
+  assert.throws(() => readManifest(noOpenVcs), /missing an 'openvcs' object/);
+
+  const badId = path.join(root, "bad-id");
+  writeJson(path.join(badId, "package.json"), { openvcs: { id: "bad/id" } });
+  assert.throws(() => readManifest(badId), /must not contain path separators/);
+
+  const missingId = path.join(root, "missing-id");
+  writeJson(path.join(missingId, "package.json"), { openvcs: {} });
+  assert.throws(() => readManifest(missingId), /missing openvcs\.id/);
+
+  cleanupTempDir(root);
+});
+
+test("validateDeclaredModuleExec rejects invalid module paths", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  fs.mkdirSync(path.join(pluginDir, "bin"), { recursive: true });
+
+  assert.doesNotThrow(() => validateDeclaredModuleExec(pluginDir, undefined));
+  assert.throws(() => validateDeclaredModuleExec(pluginDir, "native.node"), /must end with/);
+  assert.throws(() => validateDeclaredModuleExec(pluginDir, path.join(pluginDir, "bin", "x.js")), /must be a relative path/);
+  assert.throws(() => validateDeclaredModuleExec(pluginDir, "../escape.js"), /must point to a file under bin/);
+  assert.throws(() => validateDeclaredModuleExec(pluginDir, "missing.js"), /module entrypoint not found/);
+
+  cleanupTempDir(root);
+});
+
+test("renderGeneratedBootstrap rejects unsafe import paths", () => {
+  assert.throws(() => require("../lib/build").renderGeneratedBootstrap("./bad path.js", true), /unsafe module import path/);
+});
+
+test("build helpers handle no-op and package existence paths", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  fs.mkdirSync(pluginDir, { recursive: true });
+
+  assert.equal(hasPackageJson(pluginDir), false);
+  writeJson(path.join(pluginDir, "package.json"), { openvcs: { id: "x" } });
+  assert.equal(hasPackageJson(pluginDir), true);
+  assert.equal(authoredPluginModulePath(pluginDir), path.join(pluginDir, "bin", "plugin.js"));
+  assert.doesNotThrow(() => generateModuleBootstrap(pluginDir, undefined));
+
+  cleanupTempDir(root);
+});
+
+test("runCommand reports spawn failures and non-zero exits", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+
+  assert.doesNotThrow(() => runCommand(process.execPath, ["-e", "process.exit(0)"], root, true));
+  assert.throws(() => runCommand(process.execPath, ["-e", "process.exit(7)"], root, false), /exit code 7/);
+  assert.throws(() => runCommand(path.join(root, "missing-binary"), [], root, false), /failed to spawn/);
+
+  cleanupTempDir(root);
+});
+
 test("validateGeneratedBootstrapTargets rejects module.exec collisions", () => {
   const root = makeTempDir("openvcs-sdk-test");
   const pluginDir = path.join(root, "plugin");
@@ -168,6 +243,30 @@ test("validateGeneratedBootstrapTargets rejects case-insensitive collisions", ()
   cleanupTempDir(root);
 });
 
+test("validateGeneratedBootstrapTargets no-ops without module exec and rejects missing compiled module", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  fs.mkdirSync(path.join(pluginDir, "bin"), { recursive: true });
+
+  assert.doesNotThrow(() => validateGeneratedBootstrapTargets(pluginDir, undefined));
+  assert.throws(() => validateGeneratedBootstrapTargets(pluginDir, "openvcs-plugin.js"), /compiled plugin module not found/);
+
+  cleanupTempDir(root);
+});
+
+test("generateModuleBootstrap tolerates invalid package json and uses extension for ESM", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  writeText(path.join(pluginDir, "package.json"), "{");
+  writeText(path.join(pluginDir, "bin", "plugin.js"), "export {};\n");
+  writeText(path.join(pluginDir, "bin", "bootstrap.mjs"), "");
+
+  generateModuleBootstrap(pluginDir, "bootstrap.mjs");
+
+  assert.match(fs.readFileSync(path.join(pluginDir, "bin", "bootstrap.mjs"), "utf8"), /^import/m);
+  cleanupTempDir(root);
+});
+
 test("generateModuleBootstrap handles subdirectory module.exec paths", () => {
   const root = makeTempDir("openvcs-sdk-test");
   const pluginDir = path.join(root, "plugin");