aimeat 2.7.0 → 3.1.0

package/dist/src/mcp/extensions.js

@@ -9,6 +9,12 @@
  *   import { registerExtensionsTools } from './extensions.js';
  *   registerExtensionsTools(mcp, storage, config, getAgentGaii, emitResourceUpdated, emitResourceListChanged);
  * @version-history
+ *   v2.0.0 — 2026-08-11 — Install, activate, deactivate and delete go through
+ *     services/extension-lifecycle.ts instead of calling storage here. Four side effects the HTTP
+ *     door has always had were missing on this one: deleting removed the row and left the scheduled
+ *     jobs and the whole ext: namespace behind, activating never registered the manifest's schedules
+ *     or ran its @activate jobs, deactivating left the cron firing, and a redeploy of an identical
+ *     manifest re-ran the extension's initialisation instead of answering "unchanged".
  *   v1.0.0 — 2026-03-21 — Initial creation: 2 tools + 1 resource for extension management via MCP
  *   v1.1.0 — 2026-05-02 — Add 5 lifecycle tools: install, activate, deactivate, delete, get
  *   v1.2.0 -- 2026-05-29 -- Add tool annotations (title + read/destructive/idempotent/openWorld hints)
@@ -19,27 +25,59 @@
  *   v1.5.0 — 2026-07-19 — aimeat_extension_install gains update:true (in-place upsert preserving
  *     lifecycle + ext: memory, owner-gated) and activate:true (skip separate activate call);
  *     closes pitfall ext/extension-install-no-upsert
+ *   v1.9.0 — 2026-08-11 — The two money steps that ran after the paywall on the HTTP door only:
+ *     the refund when a paid script throws, and the accrual of the provider's beneficiary
+ *     designation. The same failure cost the buyer through one door and nothing through the
+ *     other, and a promised revenue share was credited for HTTP calls and not for agent calls.
+ *   v1.8.0 — 2026-08-11 — The install ceilings (node-wide and per-owner) that POST/PUT /v1/extensions
+ *     have always applied, the shared ownership rule instead of a local copy that read an empty
+ *     installedBy as permission, and sandboxLimits for the invoke path.
+ *   v1.7.0 — 2026-08-10 — The sandbox context comes from buildExtensionCtx, and the paywall runs
+ *                         here too. This door executed the script without asking, so a priced
+ *                         action was free through a tool call and metered over HTTP. The wallet is
+ *                         the shared one, so the per-call debit ceiling applies here as well.
+ *   v1.6.0 — 2026-08-05 — aimeat_extension_invoke ctx gains files (makeExtensionFiles, parity with
+ *     the REST door): file-storing actions (universe render/checkpoint) no longer answer
+ *     UNAVAILABLE over MCP
  */
 import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { z } from 'zod';
-import { randomUUID } from 'node:crypto';
 import { buildExtensionRecordFromManifest } from '../routes/extensions/manifest.js';
-import { reconcileAfterExtensionWrite } from '../services/exchange-projection.js';
-import { getExtSecretKeys, getInstanceSecretKeys, decryptSecretFields, maskSecretFields, prepareSecretConfigForWrite } from '../services/extension-secrets.js';
+import { getExtSecretKeys, getInstanceSecretKeys, decryptSecretFields, maskSecretFields } from '../services/extension-secrets.js';
 import { getEncryptionKey } from '../services/encryption.js';
 import { executeExtensionAction } from '../services/extension-runtime.js';
+import { buildExtensionCtx, buildExtensionWallet, buildExtensionNotify, unavailableEmail, sandboxLimits } from '../services/extension-ctx.js';
+import { enforcePaywall } from '../routes/extensions/paywall.js';
+import { createRefusalRecorder, refusalText } from '../routes/extensions/metered-response.js';
 import { takeDesignations } from '../commerce/beneficiary-designation.js';
 import { parseGAII } from '../utils/gaii.js';
+import { canManageExtensionAs } from '../routes/extensions/permissions.js';
+import { writeExtensionRecord, activateExtension, deactivateExtension, uninstallExtension, } from '../services/extension-lifecycle.js';
+import { getActiveScheduler } from '../services/scheduler.js';
 import { logger } from '../utils/logger.js';
-import { notify } from '../services/notify.js';
 import { generateUploadToken, buildUploadMeta } from '../services/upload-token.js';
-import { enforceExtensionMemoryLimits } from '../services/quota.js';
-import { safeFetch } from '../utils/url-validator.js';
+import { makeExtensionFiles } from '../services/extension-files.js';
 import { annotationsFor } from './annotations.js';
 import { descriptionFor } from './catalog/shape.js';
 import { defineAppIam } from '../services/iam/define-app-iam.js';
-export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emitResourceUpdated, _emitResourceListChanged) {
+export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emitResourceUpdated, _emitResourceListChanged, 
+/** The session's own scopes, for the ownership guard on activate/deactivate/delete. */
+sessionScopes = []) {
     const agentGaii = getAgentGaii();
+    /**
+     * The caller, in the shape canManageExtensionAs() and the install caps expect.
+     *
+     * The role stays 'agent' and nothing else. An MCP session is always an agent record
+     * (mcp/index.ts:346), and the current connect path — device authorization — issues a token
+     * carrying exactly ['agent'] (routes/agents/device-auth.ts:152). Reading the owner's roles here
+     * would hand an operator's agent an operator's reach on this door, which is a loosening no
+     * token in the modern flow asks for. Written once so the four call sites cannot drift apart.
+     */
+    function resolveCaller() {
+        const owner = parseGAII(getAgentGaii())?.owner
+            ?? (getAgentGaii().includes('@') ? getAgentGaii().split('@')[0] : 'mcp-agent');
+        return { owner, roles: ['agent'], scopes: sessionScopes };
+    }
     // ── Resource: extension details ──
     mcp.registerResource('extension-details', new ResourceTemplate('aimeat://extensions/{name}', {
         list: async () => {
@@ -154,189 +192,77 @@ export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emit
         const extMemoryOwner = instance_id
             ? `ext:${ext.name}.${instance_id}`
             : `ext:${ext.name}`;
-        // Build ExtensionCtx for execution
-        const ctx = {
-            memory: {
-                get: async (key) => {
-                    const record = await storage.getMemory(extMemoryOwner, key);
-                    return record ? record.value : null;
-                },
-                set: async (key, value) => {
-                    await enforceExtensionMemoryLimits(config, storage, extMemoryOwner, key, value);
-                    const existing = await storage.getMemory(extMemoryOwner, key);
-                    const now = new Date().toISOString();
-                    await storage.setMemory({
-                        key,
-                        ownerGaii: extMemoryOwner,
-                        value,
-                        visibility: 'public',
-                        tags: [],
-                        ttlHours: null,
-                        version: existing ? existing.version + 1 : 1,
-                        createdAt: existing ? existing.createdAt : now,
-                        updatedAt: now,
-                    });
-                },
-                search: async (prefix) => {
-                    const records = await storage.listMemory(extMemoryOwner, { prefix });
-                    return records.map(r => ({ key: r.key, value: r.value }));
-                },
-                delete: async (key) => storage.deleteMemory(extMemoryOwner, key),
-                getPublic: async (namespace, key) => {
-                    let record = await storage.getMemory(namespace, key);
-                    if (!record && !namespace.includes('@') && !namespace.includes('#') && !namespace.startsWith('ext:')) {
-                        const agents = await storage.getAgentsByOwner(namespace);
-                        // One IN query for `key` across the owner's agents (was getMemory per
-                        // agent). First agent (original order) with the key; visibility checked after.
-                        const rows = await storage.listMemoryForOwners(agents.map(a => a.gaii), { prefix: key });
-                        const byGaii = new Map(rows.filter(r => r.key === key).map(r => [r.ownerGaii, r]));
-                        for (const agent of agents) {
-                            const r = byGaii.get(agent.gaii);
-                            if (r) {
-                                record = r;
-                                break;
-                            }
-                        }
-                    }
-                    return (record && record.visibility === 'public') ? record.value : null;
-                },
-            },
-            fetch: async (url, opts) => {
-                // safeFetch validates the URL and re-validates every redirect hop (SSRF guard).
-                const resp = await safeFetch(url, {
-                    method: opts?.method || 'GET',
-                    headers: opts?.headers,
-                    body: opts?.body,
-                    signal: AbortSignal.timeout(30_000),
-                });
-                const buf = await resp.arrayBuffer();
-                const ct = resp.headers.get('content-type') || '';
-                const ctCharsetMatch = /charset=([^\s;]+)/i.exec(ct);
-                const charset = ctCharsetMatch ? ctCharsetMatch[1].toLowerCase() : 'utf-8';
-                const decoder = new TextDecoder(charset === 'utf8' ? 'utf-8' : charset);
-                const text = decoder.decode(buf);
-                const headers = {};
-                resp.headers.forEach((v, k) => { headers[k] = v; });
-                return { status: resp.status, ok: resp.ok, text, headers };
-            },
-            wallet: {
-                consume: async (amount, reason) => {
-                    // SECURITY: reject non-positive/non-finite amounts — a negative amount would mint morsels (CR-1).
-                    if (!Number.isFinite(amount) || amount <= 0) {
-                        return { success: false, error: 'INVALID_AMOUNT: consume amount must be a positive number' };
-                    }
-                    const debited = await storage.debitBalance(agentGaii, amount);
-                    if (!debited)
-                        return { success: false, error: 'Insufficient balance' };
-                    await storage.addTransaction({
-                        id: `ext-tx-${randomUUID()}`,
-                        gaii: agentGaii,
-                        type: 'extension_consume',
-                        amount: -amount,
-                        trackingCode: `ext:${ext.name}:${reason}`,
-                        timestamp: new Date().toISOString(),
-                    });
-                    return { success: true };
-                },
-                getBalance: async () => {
-                    const parsed = parseGAII(agentGaii);
-                    if (!parsed)
-                        return 0;
-                    const ghii = await storage.getGHIIByOwner(parsed.owner);
-                    return ghii?.morselBalance ?? 0;
-                },
-            },
-            consent: {
-                check: async (gaii, scope) => {
-                    const consents = await storage.listConsents(gaii, { status: 'active' });
-                    return consents.some(c => c.purpose === scope);
-                },
-                require: async (gaii, scope) => {
-                    const consents = await storage.listConsents(gaii, { status: 'active' });
-                    if (!consents.some(c => c.purpose === scope)) {
-                        throw new Error(`CONSENT_REQUIRED: ${scope}`);
-                    }
-                },
-            },
-            trust: {
-                getScore: async (gaii) => {
-                    const agent = await storage.getAgent(gaii);
-                    return agent?.trustScore ?? 0;
-                },
-            },
+        // The paywall, over MCP too. Cross-owner invocation is intended here (an extension is a
+        // sellable capability, and getExtension resolves by name across owners), so the paywall
+        // is what makes it safe: the owner and their own principals are free, everyone else
+        // pays or holds an entitlement. This tool executed the script without asking, so a
+        // priced action was free through a tool call and metered over HTTP.
+        const refusal = createRefusalRecorder();
+        const pay = await enforcePaywall({
+            config, storage, ext, action, callerGaii: agentGaii, res: refusal,
+            // An MCP session is an agent acting for its owner: no pay token, no internal pass,
+            // no named app tool, and no app grant that would need spend permission.
+            session: { roles: ['agent'], scopes: [], appGrantId: null },
+        });
+        if (!pay.ok) {
+            return { content: [{ type: 'text', text: refusal.refusal ? refusalText(refusal.refusal) : 'The call was refused.' }], isError: true };
+        }
+        // One builder for the sandbox context (services/extension-ctx.ts). Building it here by
+        // hand is how this door came to differ from the HTTP one in four ways at once: no
+        // charset detection beyond the header, a memory.set that ignored a request for a private
+        // value and wrote public regardless, no email, and no paywall above.
+        const ctx = buildExtensionCtx({
+            config, storage, extMemoryOwner,
             caller: {
                 gaii: agentGaii,
                 owner: parseGAII(agentGaii)?.owner ?? agentGaii,
                 roles: ['agent'],
             },
             // Decrypted for the VM as routes/extensions/actions.ts does; the { encrypted } wrapper would silently break the script.
-            config: decryptSecretFields(ext.config, getExtSecretKeys(ext), getEncryptionKey(config)),
-            ...(instance_id ? {
-                instance: {
-                    id: instance_id,
-                    config: decryptSecretFields((await storage.getExtensionInstance(extension_name, instance_id))?.config ?? {}, getInstanceSecretKeys(ext), getEncryptionKey(config)),
-                },
-            } : {}),
-            log: {
-                info: (msg, data) => logger.info(`[ext:${ext.name}${instance_id ? ':' + instance_id : ''}] ${msg}`, data),
-                warn: (msg, data) => logger.warn(`[ext:${ext.name}${instance_id ? ':' + instance_id : ''}] ${msg}`, data),
-                error: (msg, data) => logger.error(`[ext:${ext.name}${instance_id ? ':' + instance_id : ''}] ${msg}`, data),
-            },
-            notify: async (message, opts) => {
-                const parsed = parseGAII(agentGaii);
-                if (!parsed)
-                    return false;
-                const key = `notifications.${parsed.owner}`;
-                const existing = await storage.getMemory(agentGaii, key);
-                const list = Array.isArray(existing?.value) ? existing.value : [];
-                list.push({
-                    id: randomUUID(),
-                    message,
-                    title: opts?.title || ext.name,
-                    priority: opts?.priority || 'normal',
-                    channel: opts?.channel || 'extension',
-                    source: ext.name,
-                    read: false,
-                    createdAt: new Date().toISOString(),
-                });
-                const trimmed = list.slice(-100);
-                await storage.setMemory({
-                    key,
-                    ownerGaii: agentGaii,
-                    value: trimmed,
-                    visibility: 'private',
-                    tags: ['notifications'],
-                    ttlHours: null,
-                    version: (existing?.version || 0) + 1,
-                    createdAt: existing?.createdAt || new Date().toISOString(),
-                    updatedAt: new Date().toISOString(),
-                });
-                // Also surface it where the owner actually looks: the header bell + web push,
-                // deep-linked to the Extensions tab.
-                void notify(storage, `${parsed.owner}@${config.nodeId}`, {
-                    type: 'extension', title: opts?.title || ext.name, body: message, link: '/v1/profile?tab=extensions',
-                });
-                return true;
-            },
-            email: async (_to, _subject, _body) => {
-                logger.warn(`[ext:${ext.name}] Email not available via MCP`);
-                return false;
-            },
-        };
+            extConfig: decryptSecretFields(ext.config, getExtSecretKeys(ext), getEncryptionKey(config)),
+            instance: instance_id ? {
+                id: instance_id,
+                config: decryptSecretFields((await storage.getExtensionInstance(extension_name, instance_id))?.config ?? {}, getInstanceSecretKeys(ext), getEncryptionKey(config)),
+            } : undefined,
+            logPrefix: `[ext:${ext.name}${instance_id ? ':' + instance_id : ''}]`,
+            // Same ctx.files the REST door builds: reads are authorized as the caller, writes
+            // land in the caller's own storage under ext/{name}/. Without it, an action that
+            // stores a file works over REST and answers UNAVAILABLE over MCP.
+            files: makeExtensionFiles({
+                config, storage,
+                callerGaii: agentGaii,
+                callerOwner: parseGAII(agentGaii)?.owner,
+                extName: ext.name,
+            }),
+            // The shared wallet, so this door has the per-call debit ceiling too. Its own copy
+            // refused a negative amount but had no ceiling, which is the guard that bounds how
+            // much a single call can take from the caller's balance.
+            wallet: buildExtensionWallet({ config, storage, callerGaii: agentGaii, extName: ext.name }),
+            notify: buildExtensionNotify({
+                storage, config, extName: ext.name,
+                recipientGaii: agentGaii,
+                recipientOwner: parseGAII(agentGaii)?.owner ?? agentGaii,
+            }),
+            // No SMTP identity belongs to an MCP session. Refusing with a logged false is the
+            // behaviour every extension was written against; an absent capability would turn
+            // ctx.email(...) into a TypeError inside the guest.
+            email: unavailableEmail(ext.name, 'not available via MCP'),
+        });
         try {
-            const limits = {
-                memoryMb: Math.max(ext.limits.memoryMb, config.extensionMaxMemoryMb),
-                timeoutMs: Math.max(ext.limits.timeoutMs, config.extensionTimeoutMs),
-                maxApiCalls: Math.max(ext.limits.maxApiCalls, config.extensionMaxApiCalls),
-            };
+            const limits = sandboxLimits(ext.limits, config);
             const raw = await executeExtensionAction(action.scriptContent, ctx, input ?? {}, limits);
             emitResourceUpdated(agentGaii, `aimeat://extensions/${encodeURIComponent(extension_name)}`);
-            // This door does NOT settle, so it accrues nothing — but it must still strip the
-            // provider's beneficiary designation. The key is the seller's commercial business,
-            // not a fact about the answer, and the REST door has always removed it. Leaving it
-            // here would mean which door you came through decided whether you saw who the
-            // seller shares its margin with.
-            const { result } = takeDesignations(raw);
+            // The designation is stripped either way — the key is the seller's commercial
+            // business, not a fact about the answer, and the REST door has always removed it.
+            // What this door used to skip was ACCRUING it: a seller who promised a third party
+            // a share of their revenue got that share credited for calls that came over HTTP
+            // and nothing for calls that came through an agent, which is the same money and a
+            // different answer. An internal hop accrues nothing here, because the upstream door
+            // holds the settlement and is the only one that can.
+            const shared = pay.upstream ? { designations: [], result: raw } : takeDesignations(raw);
+            if (pay.accrue)
+                await pay.accrue(shared.designations);
+            const result = shared.result;
             return {
                 content: [{
                         type: 'text',
@@ -345,6 +271,11 @@ export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emit
             };
         }
         catch (err) {
+            // Never keep payment for a call that did not deliver. The HTTP door has refunded on
+            // a script throw since the paywall existed; this one charged and kept it, so the
+            // same failure cost the buyer money through one door and nothing through the other.
+            if (pay.refund)
+                await pay.refund();
             const message = err.message;
             logger.error(`MCP extension action failed: ${extension_name}/${action_id}`, { error: message, caller: agentGaii });
             return {
@@ -412,91 +343,70 @@ export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emit
         // and the ZIP upload path use. This tool used to carry its own thinner copy, which is how
         // ODPS descriptors, commercial plans, instances validation and manifest field type-checking
         // ended up applying on some install paths and not others.
-        const callerOwner = parseGAII(getAgentGaii())?.owner
-            ?? (getAgentGaii().includes('@') ? getAgentGaii().split('@')[0] : 'mcp-agent');
+        const caller = resolveCaller();
+        const callerOwner = caller.owner;
         const built = buildExtensionRecordFromManifest(manifestYaml, scripts, config, callerOwner, new Date().toISOString());
         if (!built.ok) {
             return { content: [{ type: 'text', text: `${built.code}: ${built.message}` }], isError: true };
         }
+        // The write permission, checked HERE and not only by the registration filter. That filter
+        // is warn-only when AIMEAT_MCP_ENFORCE_SCOPES=false, and in that mode this tool installed
+        // executable extension code with no permission check at all. routes/extensions/crud.ts
+        // checks it in the handler for the same reason.
+        if (!canManageExtensionAs(caller, config, callerOwner)) {
+            return { content: [{ type: 'text', text: 'Installing an extension needs the ext:write permission, which this session does not carry.' }], isError: true };
+        }
         const record = built.record;
         const name = record.name;
+        const scheduler = getActiveScheduler();
         const existingExt = await storage.getExtension(name);
         if (existingExt && !update) {
             return { content: [{ type: 'text', text: `Extension "${name}" is already installed — pass update: true to upsert it in place (activation status and its ext: memory are preserved), or delete + reinstall.` }], isError: true };
         }
         if (existingExt && update) {
-            // Only the installing owner may update their extension in place.
-            if (existingExt.installedBy && existingExt.installedBy !== callerOwner) {
-                return { content: [{ type: 'text', text: `Extension "${name}" was installed by "${existingExt.installedBy}" — only the installing owner may update it` }], isError: true };
+            // Only the installing owner may update their extension in place. The rule is the
+            // shared one, not a local retelling of it: the local version read an EMPTY
+            // installedBy as permission, so an imported or legacy record could be overwritten
+            // in place by any agent holding ext:write. canManageExtensionAs compares owners
+            // directly, which refuses an empty installer to everyone but an operator.
+            if (!canManageExtensionAs(caller, config, existingExt.installedBy)) {
+                return { content: [{ type: 'text', text: `Extension "${name}" was installed by "${existingExt.installedBy || 'an unknown installer'}" — only the installing owner may update it` }], isError: true };
             }
         }
-        // Encrypt secrets before any write, as POST/PUT /v1/extensions do. This path wrote config straight to storage, so a `type: secret` value was persisted in the clear and served unauthenticated.
-        const preparedConfig = prepareSecretConfigForWrite(record.config, existingExt?.config, getEncryptionKey(config));
-        if (preparedConfig === null) {
-            return {
-                content: [{ type: 'text', text: 'ENCRYPTION_NOT_CONFIGURED: this manifest declares a secret config field but the node has no encryption key. Set AIMEAT_ENCRYPTION_KEY or drop the secret field; a secret is never stored in plaintext.' }],
-                isError: true,
-            };
-        }
-        record.config = preparedConfig;
         try {
-            let result;
-            let action;
-            if (existingExt) {
-                // In-place upsert (mirrors PUT /v1/extensions/:name): swap code + metadata,
-                // preserve lifecycle fields (status, installedBy/At, activatedAt) and ext: memory.
-                const updated = await storage.updateExtension(name, {
-                    version: record.version,
-                    description: record.description,
-                    author: record.author,
-                    requiredApis: record.requiredApis,
-                    actions: record.actions,
-                    config: record.config,
-                    limits: record.limits,
-                    federation: record.federation,
-                    instances: record.instances,
-                });
-                // Never answer a write that did not apply with the record we WANTED to store.
-                // This line used to be `updated ?? { ...record, status }`, which reported the NEW
-                // version number while the database still held the old code — the most misleading
-                // answer available, because it looks like proof the deploy worked.
-                if (!updated) {
-                    logger.error(`Extension upsert wrote nothing via MCP: ${name}`, { by: record.installedBy });
-                    return {
-                        content: [{ type: 'text', text: `Extension "${name}" was NOT updated — the storage write did not apply, and the installed version is unchanged. Nothing was deployed.` }],
-                        isError: true,
-                    };
-                }
-                result = updated;
-                action = 'updated';
-                logger.info(`Extension updated via MCP: ${name}`, { version: record.version, by: record.installedBy });
-            }
-            else {
-                result = await storage.createExtension(record);
-                action = 'installed';
-                logger.info(`Extension installed via MCP: ${result.name}`, { version: result.version, by: record.installedBy });
+            // The whole write is services/extension-lifecycle.ts: the node-wide and per-owner
+            // install ceilings, the secret encryption (this path once wrote config straight to
+            // storage, so a `type: secret` value was persisted in the clear), the no-op shortcut
+            // for an identical manifest, the in-place swap with its schedule re-registration, and
+            // the EXCHANGE re-projection. Writing any of that out here is how the two doors came
+            // to disagree in the first place.
+            const written = await writeExtensionRecord({ storage, config, scheduler }, record, {
+                existing: existingExt ?? null,
+                ownerName: callerOwner,
+                actor: agentGaii,
+                isOperator: caller.roles.includes('operator'),
+            });
+            if (!written.ok) {
+                return { content: [{ type: 'text', text: `${written.code}: ${written.message}` }], isError: true };
             }
-            // Optional immediate activation (skips the separate activate call).
+            const result = written.record;
+            logger.info(`Extension ${written.action} via MCP: ${result.name}`, {
+                version: result.version, by: record.installedBy, reinitialized: written.reinitialized,
+            });
+            // Optional immediate activation (skips the separate activate call). The shared
+            // activation registers the manifest's schedules and runs its @activate jobs, which
+            // the status write here never did.
             let status = result.status;
             if (activate && status !== 'active') {
-                await storage.updateExtension(name, { status: 'active', activatedAt: new Date().toISOString() });
-                status = 'active';
+                const activated = await activateExtension({ storage, config, scheduler }, result, agentGaii);
+                status = activated?.status ?? 'active';
             }
-            // Re-project any EXCHANGE listings the actions declare (price/flag may have changed) —
-            // parity with POST/PUT /v1/extensions, which have always done this.
-            await reconcileAfterExtensionWrite(storage, record.installedBy, config.nodeId, name);
             // Actions may have changed (or just went live) — refresh aggregated capabilities.
             if (status === 'active') {
                 import('../services/capability-aggregator.js')
                     .then(m => m.runCapabilityAggregation(config, storage))
                     .catch(err => logger.error('Capability aggregation after MCP extension install failed', { error: String(err) }));
             }
-            // An ACTIVE extension whose manifest declares schedules needs a schedule
-            // re-registration this tool cannot perform — point at the REST upsert.
-            const manifestSchedules = record.config.__schedules;
-            const scheduleNote = (action === 'updated' && status === 'active' && Array.isArray(manifestSchedules) && manifestSchedules.length > 0)
-                ? 'schedules in the manifest are NOT re-registered by this tool — use PUT /v1/extensions/{name} (REST upsert) or deactivate + activate to refresh them'
-                : undefined;
             return {
                 content: [{
                         type: 'text',
@@ -504,9 +414,12 @@ export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emit
                             name: result.name,
                             version: result.version,
                             status,
-                            action,
-                            ...(scheduleNote ? { note: scheduleNote } : {}),
+                            action: written.action,
                             actions: result.actions.map(a => ({ id: a.id, method: a.method, path: a.path })),
+                            // What the manifest lost or what the sandbox cannot do. The HTTP door has
+                            // always returned these; an author installing through an agent learned
+                            // nothing, so a stripped emailPolicy or a Math.random() went unmentioned.
+                            ...(built.warnings?.length ? { warnings: built.warnings } : {}),
                         }, null, 2),
                     }],
             };
@@ -523,11 +436,21 @@ export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emit
         if (!ext) {
             return { content: [{ type: 'text', text: `Extension "${name}" not found` }], isError: true };
         }
+        // Only the installer may activate their extension. This tool had no ownership check at
+        // all, so any agent holding ext:write reached every extension on the node — including
+        // another owner's. routes/extensions/crud.ts has refused that since it was written, via
+        // canManageInstalledExt; that function needed an Express request, so the surface without
+        // one never called it. Same rule, same wording: not found rather than not yours.
+        if (!canManageExtensionAs(resolveCaller(), config, ext.installedBy)) {
+            return { content: [{ type: 'text', text: `Extension "${name}" not found` }], isError: true };
+        }
         try {
-            await storage.updateExtension(name, {
-                status: 'active',
-                activatedAt: new Date().toISOString(),
-            });
+            // Activating is three things: the status, the schedules the manifest declares, and
+            // the @activate jobs that do the extension's first run. This tool wrote the status
+            // and stopped, so an extension switched on by an agent never started its clock —
+            // it looked installed, active and idle. One implementation, in
+            // services/extension-lifecycle.ts.
+            const updated = await activateExtension({ storage, config, scheduler: getActiveScheduler() }, ext, getAgentGaii());
             // Trigger capability aggregation so the extension appears immediately
             import('../services/capability-aggregator.js')
                 .then(m => m.runCapabilityAggregation(config, storage))
@@ -536,7 +459,11 @@ export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emit
             return {
                 content: [{
                         type: 'text',
-                        text: JSON.stringify({ name, status: 'active', activated_at: new Date().toISOString() }, null, 2),
+                        text: JSON.stringify({
+                            name,
+                            status: updated?.status ?? 'active',
+                            activated_at: updated?.activatedAt ?? null,
+                        }, null, 2),
                     }],
             };
         }
@@ -552,8 +479,19 @@ export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emit
         if (!ext) {
             return { content: [{ type: 'text', text: `Extension "${name}" not found` }], isError: true };
         }
+        // Only the installer may deactivate their extension. This tool had no ownership check at
+        // all, so any agent holding ext:write reached every extension on the node — including
+        // another owner's. routes/extensions/crud.ts has refused that since it was written, via
+        // canManageInstalledExt; that function needed an Express request, so the surface without
+        // one never called it. Same rule, same wording: not found rather than not yours.
+        if (!canManageExtensionAs(resolveCaller(), config, ext.installedBy)) {
+            return { content: [{ type: 'text', text: `Extension "${name}" not found` }], isError: true };
+        }
         try {
-            await storage.updateExtension(name, { status: 'inactive' });
+            // The status and the scheduled jobs together. This tool wrote only the status, so a
+            // deactivated extension kept firing on its cron until somebody deactivated it again
+            // over HTTP.
+            await deactivateExtension({ storage, config, scheduler: getActiveScheduler() }, name);
             logger.info(`Extension deactivated via MCP: ${name}`, { by: getAgentGaii() });
             return {
                 content: [{
@@ -574,12 +512,21 @@ export function registerExtensionsTools(mcp, storage, config, getAgentGaii, emit
         if (!ext) {
             return { content: [{ type: 'text', text: `Extension "${name}" not found` }], isError: true };
         }
+        // Only the installer may delete their extension. This tool had no ownership check at
+        // all, so any agent holding ext:write reached every extension on the node — including
+        // another owner's. routes/extensions/crud.ts has refused that since it was written, via
+        // canManageInstalledExt; that function needed an Express request, so the surface without
+        // one never called it. Same rule, same wording: not found rather than not yours.
+        if (!canManageExtensionAs(resolveCaller(), config, ext.installedBy)) {
+            return { content: [{ type: 'text', text: `Extension "${name}" not found` }], isError: true };
+        }
         try {
-            // Deactivate first if active
-            if (ext.status === 'active') {
-                await storage.updateExtension(name, { status: 'inactive' });
-            }
-            await storage.deleteExtension(name);
+            // The row is not the extension. Its scheduled jobs, its `ext:{name}` memory and each
+            // instance's `ext:{name}.{id}` memory go with it — which this tool did not do, so an
+            // extension uninstalled by an agent left cron jobs firing against a name that no
+            // longer resolved and left its data unreachable. DELETE /v1/extensions/:name has
+            // cleaned all three since it was written; both doors now call the same function.
+            await uninstallExtension({ storage, config, scheduler: getActiveScheduler() }, name);
             logger.info(`Extension deleted via MCP: ${name}`, { by: getAgentGaii() });
             return {
                 content: [{