dsh-eda-mcp 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.1.1 — 2026-10-21
+
+### 设置卡片：下载仍是本地那份，但**能校验服务器副本**
+
+- 事实澄清（改前就是如此）：设置卡片的「下载 JLCEDA 扩展包」是 `<a href="/api/dsh-eda-mcp/extension.zip">`，由插件读**包内自带**的 zip 直接回传，**不经过服务器**。这是有意的：离线也能装、不会被限流、不依赖服务器可用性。
+- 现在响应头带 `x-extension-version`、`x-extension-sha256`、`content-length`，下载到的文件可自行核对。
+- 新增路由 `GET /api/dsh-eda-mcp/extension/verify`：从下载服务器取回同一文件并逐字节比对，返回 `verified: match | mismatch | unverified`（429 会带 `httpStatus` 与"是限流不是不一致"的说明）。卡片上多一个「校验服务器副本」按钮直接显示结果。
+- 新增第 **11** 套单测 `extension-routes`：用真实本地 HTTP 服务模拟三种服务器响应（同字节 / 不同字节 / 429），断言 `match`、`mismatch`、`unverified + 429`，并断言下载响应的 sha256 头与实际发出的字节一致。
+
+
 ## 1.1.0 — 2026-10-21
 
 ### `/eda/` 下载限流（服务器侧，5 次/分钟/IP）

package/README.md

@@ -58,6 +58,14 @@ produce the same sha256.
 The download server throttles `/eda/` to 5 requests/minute per IP (burst 5, loopback exempt), so
 a `429` shows up as `verified: 'unverified'` with `httpStatus: 429` — that is throttling, not a
 checksum mismatch; wait a minute and retry.
+The settings card serves the **bundled** copy (works offline, never throttled) and stamps
+`x-extension-version` / `x-extension-sha256` on the response; its "Verify server copy" button calls
+`/api/dsh-eda-mcp/extension/verify` and reports match / mismatch / why verification was impossible
+(429 throttling included).
+The settings card serves the **bundled** copy (works offline, never throttled) and stamps
+`x-extension-version` / `x-extension-sha256` on the response; its "Verify server copy" button calls
+`/api/dsh-eda-mcp/extension/verify` and reports match / mismatch / why verification was impossible
+(429 throttling included).
 
 ### 1. Install into the DSH web profile
 

package/README.zh.md

@@ -61,6 +61,10 @@ pnpm add dsh-eda-mcp            # 或用 Web GUI 的插件管理器安装
 
 下载服务器对 `/eda/` 限流 **5 次/分钟/IP**（burst 5，回环地址豁免）：被限流时工具返回 `verified: unverified` 且 `httpStatus: 429` —— 这是限流，不是校验不一致，等一分钟重试即可。
 
+设置卡片的下载按钮给的是**插件自带的那份**（离线可用、不被限流），响应头带 `x-extension-version` 与 `x-extension-sha256`；旁边的「校验服务器副本」按钮调用 `/api/dsh-eda-mcp/extension/verify`，逐字节比对后给出 `match / mismatch / 无法校验（含 429 限流原因）`。
+
+设置卡片的下载按钮给的是**插件自带的那份**（离线可用、不被限流），响应头带 `x-extension-version` 与 `x-extension-sha256`；旁边的「校验服务器副本」按钮调用 `/api/dsh-eda-mcp/extension/verify`，逐字节比对后直接给出 `match / mismatch / 无法校验（含 429 限流原因）`。
+
 ### 1. 安装到 DSH Web profile
 
 ```sh

package/lib/client.js

@@ -1135,6 +1135,30 @@ function EdaMcpSettingsCard(props) {
   const [testing, setTesting] = (0, import_react.useState)(false);
   const [reconnecting, setReconnecting] = (0, import_react.useState)(false);
   const [notice, setNotice] = (0, import_react.useState)();
+  const [verifyingExtension, setVerifyingExtension] = (0, import_react.useState)(false);
+  const [extensionVerdict, setExtensionVerdict] = (0, import_react.useState)();
+  const verifyExtension = async () => {
+    if (verifyingExtension) return;
+    setVerifyingExtension(true);
+    try {
+      const response = await fetch("/api/dsh-eda-mcp/extension/verify");
+      const body = await response.json();
+      if (body.verified === "match") {
+        const short = String(body.local?.sha256 ?? "").slice(0, 16) + "\u2026";
+        setExtensionVerdict({ kind: "ok", text: t("settings.verifyMatch").replace("{hash}", short) });
+      } else if (body.verified === "mismatch") {
+        setExtensionVerdict({ kind: "error", text: t("settings.verifyMismatch").replace("{hash}", String(body.file ?? "")) });
+      } else {
+        const reason = String(body.error ?? "unknown");
+        setExtensionVerdict({ kind: "error", text: t("settings.verifyUnverified").replace("{reason}", reason) });
+      }
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      setExtensionVerdict({ kind: "error", text: t("settings.verifyUnverified").replace("{reason}", reason) });
+    } finally {
+      setVerifyingExtension(false);
+    }
+  };
   (0, import_react.useEffect)(() => {
     if (!seeded && state.status === "ready") {
       setDraft(state.config ?? {});
@@ -1292,14 +1316,29 @@ function EdaMcpSettingsCard(props) {
         }
       ),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: { ...hintStyle, margin: "8px 0 0" }, children: t("settings.portLabel") }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { label: t("settings.downloadExtension"), hint: t("settings.installHint"), children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-        "a",
-        {
-          href: "/api/dsh-eda-mcp/extension.zip",
-          style: { ...secondaryButtonStyle, textDecoration: "none", display: "inline-flex", width: "fit-content" },
-          children: t("settings.downloadExtension")
-        }
-      ) })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Field, { label: t("settings.downloadExtension"), hint: t("settings.installHint"), children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "a",
+          {
+            href: "/api/dsh-eda-mcp/extension.zip",
+            style: { ...secondaryButtonStyle, textDecoration: "none", display: "inline-flex", width: "fit-content" },
+            children: t("settings.downloadExtension")
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "button",
+          {
+            type: "button",
+            onClick: () => {
+              void verifyExtension();
+            },
+            disabled: verifyingExtension,
+            style: verifyingExtension ? { ...secondaryButtonStyle, ...disabledButtonStyle, marginLeft: 8 } : { ...secondaryButtonStyle, marginLeft: 8 },
+            children: verifyingExtension ? t("settings.verifyBusy") : t("settings.verifyExtension")
+          }
+        ),
+        extensionVerdict !== void 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", style: { ...hintStyle, margin: "6px 0 0", color: extensionVerdict.kind === "ok" ? void 0 : "#c0392b" }, children: extensionVerdict.text }) : null
+      ] })
     ] }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("footer", { style: footerStyle, children: [
       notice !== void 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: noticeStyle, role: "status", children: notice.text }) : null,
@@ -1478,6 +1517,11 @@ var zh = {
   "settings.reconnectFailed": "\u91CD\u8FDE\u5931\u8D25",
   "settings.portLabel": "\u6865\u63A5 WebSocket \u7AEF\u53E3\uFF1A39009\uFF08\u56FA\u5B9A\uFF09",
   "settings.downloadExtension": "\u4E0B\u8F7D JLCEDA \u6269\u5C55\u5305",
+  "settings.verifyExtension": "\u6821\u9A8C\u670D\u52A1\u5668\u526F\u672C",
+  "settings.verifyBusy": "\u6821\u9A8C\u4E2D\u2026",
+  "settings.verifyMatch": "\u4E00\u81F4\uFF1A\u670D\u52A1\u5668\u4E0A\u7684 zip \u4E0E\u672C\u5730\u8FD9\u4EFD\u9010\u5B57\u8282\u76F8\u540C\uFF08sha256 {hash}\uFF09",
+  "settings.verifyMismatch": "\u4E0D\u4E00\u81F4\uFF1A\u670D\u52A1\u5668\u90A3\u4EFD\u4E0E\u672C\u5730\u4E0D\u540C\uFF0C\u8BF7\u91CD\u65B0\u4E0A\u4F20 {hash}",
+  "settings.verifyUnverified": "\u65E0\u6CD5\u6821\u9A8C\uFF1A{reason}",
   "settings.installHint": "\u5728\u5609\u7ACB\u521BEDA\u4E13\u4E1A\u7248\u4E2D\uFF1A\u6269\u5C55 \u2192 \u5BFC\u5165 \u2192 \u9009\u62E9\u4E0B\u8F7D\u7684 zip \u2192 \u5728\u6269\u5C55\u5217\u8868\u5F00\u542F\u672C\u6269\u5C55\u7684\u300C\u5141\u8BB8\u5916\u90E8\u4EA4\u4E92\u300D\u3002"
 };
 var en = {
@@ -1510,6 +1554,11 @@ var en = {
   "settings.reconnectFailed": "Reconnect failed",
   "settings.portLabel": "Bridge WebSocket port: 39009 (fixed)",
   "settings.downloadExtension": "Download JLCEDA extension zip",
+  "settings.verifyExtension": "Verify server copy",
+  "settings.verifyBusy": "Verifying\u2026",
+  "settings.verifyMatch": "Match: the served zip is byte-identical to the local one (sha256 {hash})",
+  "settings.verifyMismatch": "Mismatch: the served zip differs \u2014 re-upload {hash}",
+  "settings.verifyUnverified": "Could not verify: {reason}",
   "settings.installHint": 'In JLCEDA Pro: Extensions \u2192 Import \u2192 select the downloaded zip \u2192 enable "Allow external interactions" for this extension.'
 };
 

package/lib/index.js

@@ -434,7 +434,7 @@ function createEdaSkillProvider() {
 }
 
 // src/routes.ts
-import { createReadStream } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { basename } from "node:path";
 import { SettingsConflictError } from "@deepseek-ai/dsh-settings";
 
@@ -475,11 +475,32 @@ function isLoopbackRequest(request) {
   }
 }
 
+// src/bridge/extension-package.ts
+import { createHash } from "node:crypto";
+function sha256Of(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function extensionZipName(version) {
+  return "dsh-eda-bridge-extension-" + version + ".zip";
+}
+function extensionDownloadUrl(base, version) {
+  const normalised = base.endsWith("/") ? base : base + "/";
+  return new URL(extensionZipName(version), normalised).toString();
+}
+function compareDigest(expected, actual) {
+  if (typeof expected !== "string" || typeof actual !== "string") return "unverified";
+  const left = expected.trim().toLowerCase();
+  const right = actual.trim().toLowerCase();
+  if (left === "" || right === "") return "unverified";
+  return left === right ? "match" : "mismatch";
+}
+
 // src/routes.ts
 var EDA_MCP_API = {
   test: "/api/dsh-eda-mcp/test",
   reconnect: "/api/dsh-eda-mcp/reconnect",
   extensionZip: "/api/dsh-eda-mcp/extension.zip",
+  extensionVerify: "/api/dsh-eda-mcp/extension/verify",
   diagnostics: "/api/dsh-eda-mcp/diagnostics",
   selfTest: "/api/dsh-eda-mcp/self-test",
   settingsDescribe: "/api/dsh-eda-mcp/settings/describe",
@@ -607,20 +628,68 @@ function makeEdaMcpRoutes(deps) {
     handler: async (req, res) => {
       if (req.method !== "GET") return json(res, 405, { ok: false, error: "method-not-allowed" });
       if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: "forbidden" });
+      let bytes;
+      try {
+        bytes = await readFile(deps.extensionZipPath);
+      } catch {
+        return json(res, 404, { ok: false, error: "extension zip missing next to the plugin" });
+      }
       res.writeHead(200, {
         "content-type": "application/zip",
         // Keep the versioned file name the browser saves it as.
         "content-disposition": 'attachment; filename="' + basename(deps.extensionZipPath) + '"',
-        "cache-control": "no-store"
+        "cache-control": "no-store",
+        "x-extension-version": deps.extensionVersion,
+        "x-extension-sha256": sha256Of(bytes),
+        "content-length": String(bytes.byteLength)
       });
-      const stream = createReadStream(deps.extensionZipPath);
-      stream.on("error", () => {
-        res.destroy();
+      res.end(bytes);
+    }
+  };
+  const extensionVerify = {
+    kind: "exact",
+    path: EDA_MCP_API.extensionVerify,
+    handler: async (req, res) => {
+      if (req.method !== "GET") return json(res, 405, { ok: false, error: "method-not-allowed" });
+      if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: "forbidden" });
+      let localBytes;
+      try {
+        localBytes = await readFile(deps.extensionZipPath);
+      } catch {
+        return json(res, 404, { ok: false, error: "extension zip missing next to the plugin" });
+      }
+      const localSha256 = sha256Of(localBytes);
+      const url = extensionDownloadUrl(deps.extensionDownloadBase, deps.extensionVersion);
+      const report = {
+        version: deps.extensionVersion,
+        file: basename(deps.extensionZipPath),
+        local: { bytes: localBytes.byteLength, sha256: localSha256 },
+        url
+      };
+      let response;
+      try {
+        response = await fetch(url, { signal: AbortSignal.timeout(2e4) });
+      } catch (error) {
+        return json(res, 200, { ...report, verified: "unverified", error: "download failed: " + (error instanceof Error ? error.message : String(error)) });
+      }
+      if (!response.ok) {
+        return json(res, 200, {
+          ...report,
+          verified: "unverified",
+          httpStatus: response.status,
+          error: response.status === 429 ? "the download server throttled this IP (HTTP 429, 5 downloads/min). Wait about a minute and verify again." : "download failed: HTTP " + response.status
+        });
+      }
+      const remoteBytes = new Uint8Array(await response.arrayBuffer());
+      const remoteSha256 = sha256Of(remoteBytes);
+      return json(res, 200, {
+        ...report,
+        remote: { bytes: remoteBytes.byteLength, sha256: remoteSha256 },
+        verified: compareDigest(localSha256, remoteSha256)
       });
-      stream.pipe(res);
     }
   };
-  return [test, reconnect, extensionZip, diagnostics, selfTest];
+  return [test, reconnect, extensionZip, extensionVerify, diagnostics, selfTest];
 }
 function makeEdaMcpSettingsRoutes(settings) {
   const ns = "eda-mcp";
@@ -951,6 +1020,14 @@ function installSettingsSection(ctx, scoped, ns, schema, entry, hooks) {
 }
 var inject = ["webServer", "systemPrompt"];
 var BRIDGE_URL = new URL("../lib/bridge.mjs", import.meta.url);
+function resolveExtensionVersion() {
+  try {
+    const manifest = JSON.parse(readFileSync(fileURLToPath(new URL("../jlc-extension/extension.json", import.meta.url)), "utf8"));
+    return typeof manifest.version === "string" ? manifest.version : "";
+  } catch {
+    return "";
+  }
+}
 function resolveExtensionZipPath() {
   const plain = fileURLToPath(new URL("../dsh-eda-bridge-extension.zip", import.meta.url));
   try {
@@ -1054,6 +1131,8 @@ function apply(ctx, config) {
     const disposers = makeEdaMcpRoutes({
       getConfig: () => current(),
       extensionZipPath: resolveExtensionZipPath(),
+      extensionVersion: resolveExtensionVersion(),
+      extensionDownloadBase: process.env.DSH_EDA_EXTENSION_BASE ?? "http://159.75.130.207/eda/",
       reconnect: remountClient,
       bridgeLaunch: describeBridgeLaunch,
       // Surface the skill registration so "did it register?" is answerable from

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-eda-mcp",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "DeepSeek Harness (DSH) plugin — connects DSH to JLCEDA Pro (EasyEDA Pro) via a local MCP bridge and draws schematics through the JLCEDA extension API.",
   "license": "Apache-2.0",
   "author": {
@@ -72,7 +72,7 @@
   "scripts": {
     "build": "node build.mjs",
     "typecheck": "tsc --noEmit",
-    "test": "node --experimental-strip-types test/node-runtime.test.ts && node --experimental-strip-types test/config-values.test.ts && node --experimental-strip-types test/design-rules.test.ts && node --experimental-strip-types test/seams.test.ts && node --experimental-strip-types test/eda-launch.test.ts && node --experimental-strip-types test/schematic-audit.test.ts && node --experimental-strip-types test/design-intake.test.ts && node --experimental-strip-types test/extension-package.test.ts && node --experimental-strip-types test/netlist-erc.test.ts && node --experimental-strip-types test/skills.test.ts",
+    "test": "node --experimental-strip-types test/node-runtime.test.ts && node --experimental-strip-types test/config-values.test.ts && node --experimental-strip-types test/design-rules.test.ts && node --experimental-strip-types test/seams.test.ts && node --experimental-strip-types test/eda-launch.test.ts && node --experimental-strip-types test/schematic-audit.test.ts && node --experimental-strip-types test/design-intake.test.ts && node --experimental-strip-types test/extension-package.test.ts && node --experimental-strip-types test/extension-routes.test.ts && node --experimental-strip-types test/netlist-erc.test.ts && node --experimental-strip-types test/skills.test.ts",
     "seam-check": "node scripts/seam-check.mjs",
     "contract-check": "node scripts/contract-check.mjs",
     "guard:bundle": "node scripts/guard-bundle-paths.mjs",

package/src/client/EdaMcpSettingsCard.tsx

@@ -327,6 +327,36 @@ export function EdaMcpSettingsCard(props: EdaMcpSettingsCardProps) {
   const [testing, setTesting] = useState(false)
   const [reconnecting, setReconnecting] = useState(false)
   const [notice, setNotice] = useState<{ kind: 'ok' | 'error'; text: string } | undefined>()
+  const [verifyingExtension, setVerifyingExtension] = useState(false)
+  const [extensionVerdict, setExtensionVerdict] = useState<{ kind: 'ok' | 'error'; text: string } | undefined>()
+
+  const verifyExtension = async (): Promise<void> => {
+    if (verifyingExtension) return
+    setVerifyingExtension(true)
+    try {
+      const response = await fetch('/api/dsh-eda-mcp/extension/verify')
+      const body = await response.json() as {
+        verified?: 'match' | 'mismatch' | 'unverified'
+        file?: string
+        local?: { sha256?: string }
+        error?: string
+      }
+      if (body.verified === 'match') {
+        const short = String(body.local?.sha256 ?? '').slice(0, 16) + '…'
+        setExtensionVerdict({ kind: 'ok', text: t('settings.verifyMatch').replace('{hash}', short) })
+      } else if (body.verified === 'mismatch') {
+        setExtensionVerdict({ kind: 'error', text: t('settings.verifyMismatch').replace('{hash}', String(body.file ?? '')) })
+      } else {
+        const reason = String(body.error ?? 'unknown')
+        setExtensionVerdict({ kind: 'error', text: t('settings.verifyUnverified').replace('{reason}', reason) })
+      }
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error)
+      setExtensionVerdict({ kind: 'error', text: t('settings.verifyUnverified').replace('{reason}', reason) })
+    } finally {
+      setVerifyingExtension(false)
+    }
+  }
 
   useEffect(() => {
     if (!seeded && state.status === 'ready') {
@@ -470,6 +500,17 @@ export function EdaMcpSettingsCard(props: EdaMcpSettingsCardProps) {
           >
             {t('settings.downloadExtension')}
           </a>
+          <button
+            type="button"
+            onClick={() => { void verifyExtension() }}
+            disabled={verifyingExtension}
+            style={verifyingExtension ? { ...secondaryButtonStyle, ...disabledButtonStyle, marginLeft: 8 } : { ...secondaryButtonStyle, marginLeft: 8 }}
+          >
+            {verifyingExtension ? t('settings.verifyBusy') : t('settings.verifyExtension')}
+          </button>
+          {extensionVerdict !== undefined
+            ? <p role="status" style={{ ...hintStyle, margin: '6px 0 0', color: extensionVerdict.kind === 'ok' ? undefined : '#c0392b' }}>{extensionVerdict.text}</p>
+            : null}
         </Field>
       </div>
 

package/src/client/locales.ts

@@ -28,6 +28,11 @@ export const zh = {
   'settings.reconnectFailed': '重连失败',
   'settings.portLabel': '桥接 WebSocket 端口：39009（固定）',
   'settings.downloadExtension': '下载 JLCEDA 扩展包',
+  'settings.verifyExtension': '校验服务器副本',
+  'settings.verifyBusy': '校验中…',
+  'settings.verifyMatch': '一致：服务器上的 zip 与本地这份逐字节相同（sha256 {hash}）',
+  'settings.verifyMismatch': '不一致：服务器那份与本地不同，请重新上传 {hash}',
+  'settings.verifyUnverified': '无法校验：{reason}',
   'settings.installHint': '在嘉立创EDA专业版中：扩展 → 导入 → 选择下载的 zip → 在扩展列表开启本扩展的「允许外部交互」。',
 } as const
 
@@ -61,6 +66,11 @@ export const en = {
   'settings.reconnectFailed': 'Reconnect failed',
   'settings.portLabel': 'Bridge WebSocket port: 39009 (fixed)',
   'settings.downloadExtension': 'Download JLCEDA extension zip',
+  'settings.verifyExtension': 'Verify server copy',
+  'settings.verifyBusy': 'Verifying…',
+  'settings.verifyMatch': 'Match: the served zip is byte-identical to the local one (sha256 {hash})',
+  'settings.verifyMismatch': 'Mismatch: the served zip differs — re-upload {hash}',
+  'settings.verifyUnverified': 'Could not verify: {reason}',
   'settings.installHint': 'In JLCEDA Pro: Extensions → Import → select the downloaded zip → enable "Allow external interactions" for this extension.',
 } as const
 

package/src/index.ts

@@ -157,6 +157,15 @@ const BRIDGE_URL = new URL('../lib/bridge.mjs', import.meta.url)
  * that manifest instead of hard-coding a file name; older layouts without a
  * versioned file keep working through the plain-name fallback.
  */
+function resolveExtensionVersion(): string {
+  try {
+    const manifest = JSON.parse(readFileSync(fileURLToPath(new URL('../jlc-extension/extension.json', import.meta.url)), 'utf8')) as { version?: string }
+    return typeof manifest.version === 'string' ? manifest.version : ''
+  } catch {
+    return ''
+  }
+}
+
 function resolveExtensionZipPath(): string {
   const plain = fileURLToPath(new URL('../dsh-eda-bridge-extension.zip', import.meta.url))
   try {
@@ -292,6 +301,8 @@ let current: () => EdaMcpConfig = () => unwrapConfig(config ?? {})
     const disposers = makeEdaMcpRoutes({
       getConfig: () => current(),
       extensionZipPath: resolveExtensionZipPath(),
+      extensionVersion: resolveExtensionVersion(),
+      extensionDownloadBase: process.env.DSH_EDA_EXTENSION_BASE ?? 'http://159.75.130.207/eda/',
       reconnect: remountClient,
       bridgeLaunch: describeBridgeLaunch,
       // Surface the skill registration so "did it register?" is answerable from

package/src/routes.ts

@@ -1,4 +1,4 @@
-import { createReadStream } from 'node:fs'
+import { readFile } from 'node:fs/promises'
 import { basename } from 'node:path'
 import type { ServerResponse } from 'node:http'
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
@@ -27,11 +27,13 @@ export interface SettingsBridge {
 }
 import type { EdaMcpConfig } from './index.ts'
 import { isLoopbackRequest } from './loopback.ts'
+import { compareDigest, extensionDownloadUrl, sha256Of } from './bridge/extension-package.ts'
 
 export const EDA_MCP_API = {
   test: '/api/dsh-eda-mcp/test',
   reconnect: '/api/dsh-eda-mcp/reconnect',
   extensionZip: '/api/dsh-eda-mcp/extension.zip',
+  extensionVerify: '/api/dsh-eda-mcp/extension/verify',
   diagnostics: '/api/dsh-eda-mcp/diagnostics',
   selfTest: '/api/dsh-eda-mcp/self-test',
   settingsDescribe: '/api/dsh-eda-mcp/settings/describe',
@@ -87,6 +89,10 @@ function toView(descriptor: SettingsBridgeView): unknown {
 export interface EdaMcpRouteDeps {
   getConfig: () => EdaMcpConfig
   extensionZipPath: string
+  /** Wire version of the bundled extension zip (from jlc-extension/extension.json). */
+  extensionVersion: string
+  /** Base URL of the download server; override with DSH_EDA_EXTENSION_BASE. */
+  extensionDownloadBase: string
   /** Dispose and recreate the MCP bridge child, then return immediately. */
   reconnect: () => void
   /** Which executable and script the bridge child is started with (diagnostics). */
@@ -179,25 +185,82 @@ export function makeEdaMcpRoutes(deps: EdaMcpRouteDeps): WebRoute[] {
     },
   }
 
+  // The card serves the LOCAL copy on purpose: it works offline and cannot be throttled.
+  // The digest travels with it, and a separate verify route compares it with the served copy
+  // so "is this the same artifact?" has an answer without downloading twice by hand.
   const extensionZip: WebRoute = {
     kind: 'exact',
     path: EDA_MCP_API.extensionZip,
     handler: async (req, res): Promise<void> => {
       if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
       if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: 'forbidden' })
+      let bytes: Buffer
+      try {
+        bytes = await readFile(deps.extensionZipPath)
+      } catch {
+        return json(res, 404, { ok: false, error: 'extension zip missing next to the plugin' })
+      }
       res.writeHead(200, {
         'content-type': 'application/zip',
         // Keep the versioned file name the browser saves it as.
         'content-disposition': 'attachment; filename="' + basename(deps.extensionZipPath) + '"',
         'cache-control': 'no-store',
+        'x-extension-version': deps.extensionVersion,
+        'x-extension-sha256': sha256Of(bytes),
+        'content-length': String(bytes.byteLength),
+      })
+      res.end(bytes)
+    },
+  }
+
+  const extensionVerify: WebRoute = {
+    kind: 'exact',
+    path: EDA_MCP_API.extensionVerify,
+    handler: async (req, res): Promise<void> => {
+      if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+      if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: 'forbidden' })
+      let localBytes: Buffer
+      try {
+        localBytes = await readFile(deps.extensionZipPath)
+      } catch {
+        return json(res, 404, { ok: false, error: 'extension zip missing next to the plugin' })
+      }
+      const localSha256 = sha256Of(localBytes)
+      const url = extensionDownloadUrl(deps.extensionDownloadBase, deps.extensionVersion)
+      const report: Record<string, unknown> = {
+        version: deps.extensionVersion,
+        file: basename(deps.extensionZipPath),
+        local: { bytes: localBytes.byteLength, sha256: localSha256 },
+        url,
+      }
+      let response: Response
+      try {
+        response = await fetch(url, { signal: AbortSignal.timeout(20000) })
+      } catch (error) {
+        return json(res, 200, { ...report, verified: 'unverified', error: 'download failed: ' + (error instanceof Error ? error.message : String(error)) })
+      }
+      if (!response.ok) {
+        // 429 = the server throttles an IP to 5 downloads/min; that is not a checksum problem.
+        return json(res, 200, {
+          ...report,
+          verified: 'unverified',
+          httpStatus: response.status,
+          error: response.status === 429
+            ? 'the download server throttled this IP (HTTP 429, 5 downloads/min). Wait about a minute and verify again.'
+            : 'download failed: HTTP ' + response.status,
+        })
+      }
+      const remoteBytes = new Uint8Array(await response.arrayBuffer())
+      const remoteSha256 = sha256Of(remoteBytes)
+      return json(res, 200, {
+        ...report,
+        remote: { bytes: remoteBytes.byteLength, sha256: remoteSha256 },
+        verified: compareDigest(localSha256, remoteSha256),
       })
-      const stream = createReadStream(deps.extensionZipPath)
-      stream.on('error', () => { res.destroy() })
-      stream.pipe(res)
     },
   }
 
-  return [test, reconnect, extensionZip, diagnostics, selfTest]
+  return [test, reconnect, extensionZip, extensionVerify, diagnostics, selfTest]
 }
 
 export function makeEdaMcpSettingsRoutes(settings: SettingsBridge): WebRoute[] {

package/test/extension-routes.test.ts

@@ -0,0 +1,95 @@
+import { strict as assert } from 'node:assert'
+import { createServer } from 'node:http'
+import { readFileSync } from 'node:fs'
+import { makeEdaMcpRoutes, EDA_MCP_API } from '../src/routes.ts'
+import { sha256Of } from '../src/bridge/extension-package.ts'
+
+const zipPath = 'dsh-eda-bridge-extension-0.4.9.zip'
+const localBytes = readFileSync(zipPath)
+const localSha = sha256Of(localBytes)
+
+// Minimal IncomingMessage/ServerResponse doubles: the handlers only use method, socket,
+// url, writeHead, end and (for errors) destroy.
+function fakeReq(method: string) {
+  return { method, url: '/', socket: { remoteAddress: '127.0.0.1' }, headers: { host: '127.0.0.1' } }
+}
+function fakeRes() {
+  const captured: { status?: number; headers?: Record<string, string>; body?: unknown; bytes?: Buffer } = {}
+  const res = {
+    writeHead(status: number, headers: Record<string, string>) { captured.status = status; captured.headers = headers; return res },
+    end(payload?: unknown) { if (Buffer.isBuffer(payload)) captured.bytes = payload; else if (typeof payload === 'string') captured.body = payload; return res },
+    destroy() { return res },
+    getHeader() { return undefined },
+    setHeader() { return res },
+  }
+  return { res, captured }
+}
+
+function deps(base: string) {
+  return {
+    getConfig: () => ({}),
+    extensionZipPath: zipPath,
+    extensionVersion: '0.4.9',
+    extensionDownloadBase: base,
+    reconnect: () => {},
+    bridgeLaunch: () => ({ command: 'node', args: [], source: 'test' }),
+    diagnostics: () => ({}),
+    launchConfig: () => ({}),
+    selfTest: async () => ({}),
+  }
+}
+
+function routeOf(routes: ReturnType<typeof makeEdaMcpRoutes>, path: string) {
+  const route = routes.find(r => r.path === path)
+  assert.ok(route, 'route ' + path + ' must exist')
+  return route
+}
+
+async function withServer(handler: Parameters<typeof createServer>[1], run: (base: string) => Promise<void>) {
+  const server = createServer(handler)
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+  const port = (server.address() as { port: number }).port
+  try { await run('http://127.0.0.1:' + port + '/eda/') } finally { await new Promise<void>(resolve => server.close(() => resolve())) }
+}
+
+// 1. the zip route stamps the digest it is handing out
+{
+  const routes = makeEdaMcpRoutes(deps('http://127.0.0.1:1/eda/'))
+  const { res, captured } = fakeRes()
+  await routeOf(routes, EDA_MCP_API.extensionZip).handler(fakeReq('GET') as never, res as never)
+  assert.equal(captured.status, 200)
+  assert.equal(captured.headers?.['x-extension-sha256'], localSha, 'digest header must describe the bytes served')
+  assert.equal(captured.headers?.['content-length'], String(localBytes.byteLength))
+  assert.equal(captured.headers?.['content-disposition']?.includes(zipPath), true, 'versioned file name is kept')
+  assert.equal(sha256Of(captured.bytes as Buffer), localSha, 'served bytes are the local zip')
+}
+
+// 2. identical remote copy -> match
+await withServer((_req, res) => { res.writeHead(200, { 'content-type': 'application/zip' }); res.end(localBytes) }, async (base) => {
+  const { res, captured } = fakeRes()
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
+  const body = JSON.parse(String(captured.body))
+  assert.equal(body.verified, 'match', 'identical bytes verify')
+  assert.equal(body.local.sha256, localSha)
+  assert.equal(body.remote.sha256, localSha)
+})
+
+// 3. different remote copy -> mismatch (never silently equal)
+await withServer((_req, res) => { res.writeHead(200); res.end(Buffer.from('different bytes')) }, async (base) => {
+  const { res, captured } = fakeRes()
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
+  const body = JSON.parse(String(captured.body))
+  assert.equal(body.verified, 'mismatch')
+})
+
+// 4. throttled remote copy -> unverified + status, not a mismatch
+await withServer((_req, res) => { res.writeHead(429, { 'content-type': 'text/plain' }); res.end('slow down') }, async (base) => {
+  const { res, captured } = fakeRes()
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
+  const body = JSON.parse(String(captured.body))
+  assert.equal(body.verified, 'unverified', '429 is throttling, not a checksum mismatch')
+  assert.equal(body.httpStatus, 429)
+  assert.equal(String(body.error).includes('429'), true)
+})
+
+console.log('ALL PASS extension-routes')