godmode 0.0.2 → 0.0.3

package/dist/{chunk-2J2VDCQ4.js → chunk-KHFZI7IA.js}

@@ -1,7 +1,117 @@
 #!/usr/bin/env node
 import {
   parseMcp
-} from "./chunk-EXWYJU2I.js";
+} from "./chunk-3AQ2CZKC.js";
+import {
+  AuthStrategy
+} from "./chunk-YDXTIN53.js";
+
+// src/builtins.ts
+var BUILTINS = /* @__PURE__ */ new Map([
+  ["ext", {
+    description: "Install and manage godmode extensions",
+    run: async (rest) => (await import("./ext-K4XEAZGS.js")).runExt(rest)
+  }],
+  ["agent", {
+    description: "Coding-agent workflows",
+    run: async (rest) => {
+      const { runAgentCommand } = await import("./dist-I5CEQ4AC.js");
+      const code = await runAgentCommand(rest);
+      if (code !== 0) process.exit(code);
+    }
+  }],
+  ["permissions", {
+    description: "Inspect godmode permission policy",
+    run: async (rest) => (await import("./permissions-E4G66OUZ.js")).runPermissions(rest)
+  }]
+]);
+
+// src/config.ts
+import { resolve as resolve2, basename, dirname, extname, isAbsolute as isAbsolute2, parse as parsePath, relative } from "path";
+import { homedir } from "os";
+import { existsSync, readFileSync } from "fs";
+import { mkdir, readFile as readFile2, writeFile, readdir, unlink, access, rename, rm } from "fs/promises";
+import { execFileSync } from "child_process";
+import { parse as parseYaml2 } from "yaml";
+
+// ../../interfaces/api/src/index.ts
+import { parse as parseYaml } from "yaml";
+async function parseOpenApi(name, config) {
+  process.stderr.write(`Fetching ${config.spec}...
+`);
+  const res = await fetch(config.spec);
+  if (!res.ok) throw new Error(`Failed to fetch spec: ${res.status} ${res.statusText}`);
+  const text = await res.text();
+  const isJson = text.trimStart().startsWith("{");
+  const spec = isJson ? JSON.parse(text) : parseYaml(text);
+  if (!spec.paths) throw new Error("No paths found - is this a valid OpenAPI document?");
+  if (!config.url) {
+    if (spec.servers?.[0]?.url) {
+      config.url = spec.servers[0].url;
+    } else if (spec.host) {
+      const scheme = spec.schemes?.[0] || "https";
+      config.url = `${scheme}://${spec.host}${spec.basePath || ""}`;
+    }
+  }
+  const versions = resolveVersions(config, Object.keys(spec.paths));
+  const httpMethods = ["get", "post", "put", "patch", "delete", "head"];
+  const routes = [];
+  for (const [path, pathItem] of Object.entries(spec.paths)) {
+    for (const method of httpMethods) {
+      const op = pathItem[method];
+      if (!op) continue;
+      const ver = versions.find((v) => path.startsWith(v.prefix));
+      const version = ver?.name || "";
+      const stripped = ver ? path.slice(ver.prefix.length).replace(/^\//, "") : path.slice(1);
+      const rawSegments = stripped.split("/").filter(Boolean);
+      const segments = rawSegments.map((s) => {
+        const isParam = s.startsWith("{") && s.endsWith("}");
+        return { value: isParam ? s.slice(1, -1) : s, isParam };
+      });
+      const tag = op.tags?.[0] || "";
+      routes.push({ path, method, summary: op.summary || "", version, tag, segments });
+    }
+  }
+  routes.sort((a, b) => a.path.localeCompare(b.path) || a.method.localeCompare(b.method));
+  const resourceDescriptions = {};
+  if (spec.tags) {
+    const stripHtml = (s) => s.replace(/<[^>]+>/g, "").trim();
+    for (const t of spec.tags) {
+      if (t.name && t.description) {
+        const first = stripHtml(t.description).split(/\.\s/)[0];
+        resourceDescriptions[t.name] = first.endsWith(".") ? first : first + ".";
+      }
+    }
+  }
+  const description = config.description || spec.info?.description || "";
+  const specVersion = spec.info?.version || "";
+  const versionNames = versions.map((v) => v.name).join(", ");
+  process.stderr.write(`Parsed ${routes.length} routes (versions: ${versionNames || "none"})
+`);
+  return { name, description, specVersion, config, versions, resourceDescriptions, routes };
+}
+function resolveVersions(config, paths) {
+  if (config.versions?.length) {
+    return config.versions.map((v) => ({
+      prefix: v.prefix.endsWith("/") ? v.prefix.slice(0, -1) : v.prefix,
+      name: v.name || v.prefix.replace(/^\//, "")
+    }));
+  }
+  if (config.prefix) {
+    const prefix = config.prefix.endsWith("/") ? config.prefix.slice(0, -1) : config.prefix;
+    return [{ prefix, name: prefix.replace(/^\//, "") }];
+  }
+  const versionPattern = /^(\/(?:api\/)?v\d+)/;
+  const detected = /* @__PURE__ */ new Map();
+  for (const p of paths) {
+    const match = p.match(versionPattern);
+    if (match) detected.set(match[1], (detected.get(match[1]) || 0) + 1);
+  }
+  if (detected.size) {
+    return [...detected.entries()].sort((a, b) => b[1] - a[1]).map(([prefix]) => ({ prefix, name: prefix.replace(/^\//, "") }));
+  }
+  return [{ prefix: "", name: "" }];
+}
 
 // ../../interfaces/graphql/src/index.ts
 import { readFile } from "fs/promises";
@@ -74,9 +184,7 @@ async function parseGraphQL(name, config) {
     const headers = { ...config.headers };
     const token = config.auth?.env ? process.env[config.auth.env] : void 0;
     if (token) {
-      const authType = config.auth?.type || "bearer";
-      if (authType === "bearer") headers["Authorization"] = `Bearer ${token}`;
-      else if (authType === "api-key") headers[config.auth?.header || "X-API-Key"] = token;
+      AuthStrategy.for(config.auth).apply(headers, token);
     }
     types = await introspect(config.url, headers);
   }
@@ -117,92 +225,6 @@ function validateGraphQLFlags(method, query, body, apiName) {
   return null;
 }
 
-// src/config.ts
-import { resolve as resolve2, basename, dirname, extname } from "path";
-import { homedir } from "os";
-import { mkdir, readFile as readFile2, writeFile, readdir, unlink, access, rename } from "fs/promises";
-import { execSync } from "child_process";
-import { parse as parseYaml2 } from "yaml";
-
-// ../../interfaces/api/src/index.ts
-import { parse as parseYaml } from "yaml";
-async function parseOpenApi(name, config) {
-  process.stderr.write(`Fetching ${config.spec}...
-`);
-  const res = await fetch(config.spec);
-  if (!res.ok) throw new Error(`Failed to fetch spec: ${res.status} ${res.statusText}`);
-  const text = await res.text();
-  const isJson = text.trimStart().startsWith("{");
-  const spec = isJson ? JSON.parse(text) : parseYaml(text);
-  if (!spec.paths) throw new Error("No paths found - is this a valid OpenAPI document?");
-  if (!config.url) {
-    if (spec.servers?.[0]?.url) {
-      config.url = spec.servers[0].url;
-    } else if (spec.host) {
-      const scheme = spec.schemes?.[0] || "https";
-      config.url = `${scheme}://${spec.host}${spec.basePath || ""}`;
-    }
-  }
-  const versions = resolveVersions(config, Object.keys(spec.paths));
-  const httpMethods = ["get", "post", "put", "patch", "delete", "head"];
-  const routes = [];
-  for (const [path, pathItem] of Object.entries(spec.paths)) {
-    for (const method of httpMethods) {
-      const op = pathItem[method];
-      if (!op) continue;
-      const ver = versions.find((v) => path.startsWith(v.prefix));
-      const version = ver?.name || "";
-      const stripped = ver ? path.slice(ver.prefix.length).replace(/^\//, "") : path.slice(1);
-      const rawSegments = stripped.split("/").filter(Boolean);
-      const segments = rawSegments.map((s) => {
-        const isParam = s.startsWith("{") && s.endsWith("}");
-        return { value: isParam ? s.slice(1, -1) : s, isParam };
-      });
-      const tag = op.tags?.[0] || "";
-      routes.push({ path, method, summary: op.summary || "", version, tag, segments });
-    }
-  }
-  routes.sort((a, b) => a.path.localeCompare(b.path) || a.method.localeCompare(b.method));
-  const resourceDescriptions = {};
-  if (spec.tags) {
-    const stripHtml = (s) => s.replace(/<[^>]+>/g, "").trim();
-    for (const t of spec.tags) {
-      if (t.name && t.description) {
-        const first = stripHtml(t.description).split(/\.\s/)[0];
-        resourceDescriptions[t.name] = first.endsWith(".") ? first : first + ".";
-      }
-    }
-  }
-  const description = config.description || spec.info?.description || "";
-  const specVersion = spec.info?.version || "";
-  const versionNames = versions.map((v) => v.name).join(", ");
-  process.stderr.write(`Parsed ${routes.length} routes (versions: ${versionNames || "none"})
-`);
-  return { name, description, specVersion, config, versions, resourceDescriptions, routes };
-}
-function resolveVersions(config, paths) {
-  if (config.versions?.length) {
-    return config.versions.map((v) => ({
-      prefix: v.prefix.endsWith("/") ? v.prefix.slice(0, -1) : v.prefix,
-      name: v.name || v.prefix.replace(/^\//, "")
-    }));
-  }
-  if (config.prefix) {
-    const prefix = config.prefix.endsWith("/") ? config.prefix.slice(0, -1) : config.prefix;
-    return [{ prefix, name: prefix.replace(/^\//, "") }];
-  }
-  const versionPattern = /^(\/(?:api\/)?v\d+)/;
-  const detected = /* @__PURE__ */ new Map();
-  for (const p of paths) {
-    const match = p.match(versionPattern);
-    if (match) detected.set(match[1], (detected.get(match[1]) || 0) + 1);
-  }
-  if (detected.size) {
-    return [...detected.entries()].sort((a, b) => b[1] - a[1]).map(([prefix]) => ({ prefix, name: prefix.replace(/^\//, "") }));
-  }
-  return [{ prefix: "", name: "" }];
-}
-
 // src/spec.ts
 function projectManifest(multi, iface) {
   const data = multi.interfaces[iface];
@@ -293,18 +315,95 @@ async function compileInterface(iface, name, source) {
 }
 
 // src/config.ts
-var GODMODE_HOME = process.platform === "linux" && process.env.XDG_CONFIG_HOME ? resolve2(process.env.XDG_CONFIG_HOME, "godmode") : resolve2(homedir(), ".godmode");
-var GODMODE_EXTENSIONS_DIR = process.env.GODMODE_EXTENSIONS_DIR ? resolve2(process.env.GODMODE_EXTENSIONS_DIR) : resolve2(GODMODE_HOME, "extensions");
-var LEGACY_APIS_DIR = resolve2(GODMODE_HOME, "apis");
+var GODMODE_HOME = resolve2(homedir(), ".godmode");
 var INTERFACE_KEYS = ["api", "graphql", "mcp"];
-async function ensureDirs() {
-  if (await exists(LEGACY_APIS_DIR) && !await exists(GODMODE_EXTENSIONS_DIR)) {
-    await mkdir(dirname(GODMODE_EXTENSIONS_DIR), { recursive: true });
-    await rename(LEGACY_APIS_DIR, GODMODE_EXTENSIONS_DIR);
-    process.stderr.write(`Migrated ${LEGACY_APIS_DIR} -> ${GODMODE_EXTENSIONS_DIR}
-`);
+function assertSlugFree(slug, scope, packageName) {
+  if (BUILTINS.has(slug)) {
+    throw new Error(`'${slug}' is a built-in godmode extension; its slug is always in use.`);
+  }
+  const dir = scopeExtensionsDirSync(scope);
+  if (!dir) return;
+  const manifestPath = resolve2(dir, `${slug}.json`);
+  if (!existsSync(manifestPath)) return;
+  let existing;
+  try {
+    existing = JSON.parse(readFileSync(manifestPath, "utf-8"));
+  } catch {
+    return;
+  }
+  if (existing.packageName === packageName) return;
+  throw new Error(
+    `'${slug}' is already in use by ${existing.packageName || "an installed extension"}.
+Run 'godmode ext uninstall ${slug}' first.`
+  );
+}
+function isValidNpmPackageName(packageName) {
+  return /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(packageName);
+}
+function assertContained(parent, child, label) {
+  const root = resolve2(parent);
+  const target = resolve2(child);
+  const rel = relative(root, target);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute2(rel)) return target;
+  throw new Error(`${label} resolves outside ${root}`);
+}
+function packageInstallDir(scopeRoot, packageName) {
+  if (!isValidNpmPackageName(packageName)) {
+    throw new Error(`Invalid npm package name in installed manifest: ${packageName}`);
+  }
+  return assertContained(
+    resolve2(scopeRoot, "node_modules"),
+    resolve2(scopeRoot, "node_modules", packageName),
+    `Package path for ${packageName}`
+  );
+}
+var GITIGNORE_CONTENT = `# godmode \u2014 runtime artifacts, do not commit
+node_modules/
+coding-agents/
+package-lock.json
+`;
+function findProjectGodmode(start = process.cwd()) {
+  let dir = resolve2(start);
+  const root = parsePath(dir).root;
+  while (true) {
+    const candidate = resolve2(dir, ".godmode");
+    if (existsSync(candidate)) return candidate;
+    if (dir === root) return null;
+    dir = dirname(dir);
   }
-  await mkdir(GODMODE_EXTENSIONS_DIR, { recursive: true });
+}
+async function ensureScopeDir(scope) {
+  if (scope === "global") {
+    await mkdir(GODMODE_HOME, { recursive: true });
+    const legacy = resolve2(GODMODE_HOME, "apis");
+    const target2 = resolve2(GODMODE_HOME, "extensions");
+    if (await exists(legacy) && !await exists(target2)) {
+      await rename(legacy, target2);
+      process.stderr.write(`Migrated ${legacy} -> ${target2}
+`);
+    }
+    await mkdir(target2, { recursive: true });
+    return target2;
+  }
+  let projectRoot = findProjectGodmode();
+  if (!projectRoot) {
+    projectRoot = resolve2(process.cwd(), ".godmode");
+    await mkdir(projectRoot, { recursive: true });
+    await writeFile(resolve2(projectRoot, ".gitignore"), GITIGNORE_CONTENT);
+  }
+  const target = resolve2(projectRoot, "extensions");
+  await mkdir(target, { recursive: true });
+  return target;
+}
+function scopeExtensionsDirSync(scope) {
+  if (scope === "global") {
+    const d2 = resolve2(GODMODE_HOME, "extensions");
+    return existsSync(d2) ? d2 : null;
+  }
+  const project = findProjectGodmode();
+  if (!project) return null;
+  const d = resolve2(project, "extensions");
+  return existsSync(d) ? d : null;
 }
 async function exists(path) {
   try {
@@ -340,7 +439,7 @@ async function loadSourceFromDir(dir) {
     if (await exists(filePath)) {
       const text = await readFile2(filePath, "utf-8");
       const raw = ext === ".json" ? JSON.parse(text) : parseYaml2(text);
-      return validateSource(raw, filePath);
+      return absolutizeSource(validateSource(raw, filePath), dir);
     }
   }
   return null;
@@ -351,7 +450,40 @@ async function loadSourceFromFile(filePath) {
   if (![".yaml", ".yml", ".json"].includes(ext)) return null;
   const text = await readFile2(filePath, "utf-8");
   const raw = ext === ".json" ? JSON.parse(text) : parseYaml2(text);
-  return { source: validateSource(raw, filePath), dir: dirname(filePath) };
+  const dir = dirname(filePath);
+  return { source: absolutizeSource(validateSource(raw, filePath), dir), dir };
+}
+function absolutizeSource(source, dir) {
+  const interfaces = {};
+  if (source.interfaces.api) interfaces.api = { ...source.interfaces.api };
+  if (source.interfaces.graphql) interfaces.graphql = { ...source.interfaces.graphql };
+  if (source.interfaces.mcp) interfaces.mcp = { ...source.interfaces.mcp };
+  const next = {
+    ...source,
+    interfaces
+  };
+  for (const iface of ["api", "graphql"]) {
+    const spec = next.interfaces[iface]?.spec;
+    if (spec && !/^[a-z][a-z0-9+.-]*:/i.test(spec) && !isAbsolute2(spec)) {
+      next.interfaces[iface].spec = resolve2(dir, spec);
+    }
+  }
+  return next;
+}
+async function loadSourceFromPackageDir(pkgDir) {
+  const pkgPath = resolve2(pkgDir, "package.json");
+  if (!await exists(pkgPath)) return null;
+  const pkg = JSON.parse(await readFile2(pkgPath, "utf-8"));
+  const manifestExport = pkg.exports?.["./manifest"];
+  const manifestPath = typeof manifestExport === "string" ? manifestExport : manifestExport?.default;
+  if (!manifestPath) {
+    throw new Error(`${pkgPath}: missing exports["./manifest"]`);
+  }
+  const loaded = await loadSourceFromFile(assertContained(pkgDir, resolve2(pkgDir, manifestPath), "Manifest export"));
+  if (!loaded) {
+    throw new Error(`${pkgPath}: exports["./manifest"] does not point to a readable manifest`);
+  }
+  return loaded.source;
 }
 async function resolveSource(input) {
   const asPath = resolve2(process.cwd(), input);
@@ -378,11 +510,12 @@ async function resolveSource(input) {
     `No manifest found: ${input} (expected manifest file, folder containing manifest.yaml, or @godmode-cli/${input})`
   );
 }
-async function addApi(input) {
-  await ensureDirs();
+async function addApi(input, scope = "project") {
+  const extensionsDir = await ensureScopeDir(scope);
   const resolved = await resolveSource(input).catch(() => null);
   if (resolved) {
     const { name: name2, source } = resolved;
+    assertSlugFree(source.slug || name2, scope);
     const ifaceKeys = Object.keys(source.interfaces).filter(
       (k) => INTERFACE_KEYS.includes(k)
     );
@@ -391,6 +524,7 @@ async function addApi(input) {
         name: source.name,
         slug: source.slug || name2,
         description: source.description || "",
+        source: "local",
         auth: source.auth,
         headers: source.headers,
         interfaces: {}
@@ -399,29 +533,61 @@ async function addApi(input) {
         const data = await compileInterface(iface, name2, source);
         multi.interfaces[iface] = data;
       }
-      await writeFile(resolve2(GODMODE_EXTENSIONS_DIR, `${name2}.json`), JSON.stringify(multi, null, 2));
+      await writeFile(resolve2(extensionsDir, `${name2}.json`), JSON.stringify(multi, null, 2));
       const ifaceSummary = ifaceKeys.map((k) => {
         const d = multi.interfaces[k];
         return d ? `${k}=${d.routes.length}` : k;
       }).join(", ");
-      process.stderr.write(`Registered "${name2}" - interfaces: ${ifaceSummary}
+      process.stderr.write(`Registered "${name2}" [${scope}] - interfaces: ${ifaceSummary}
 `);
       return;
     }
   }
-  const name = resolved?.name || input;
-  const installTarget = resolved?.dir && await exists(resolve2(resolved.dir, "package.json")) ? resolved.dir : input.startsWith("@") ? input : `@godmode-cli/${input}`;
-  process.stderr.write(`Installing ${name}...
+  const scopeRoot = scope === "global" ? GODMODE_HOME : dirname(extensionsDir);
+  const asPath = resolve2(process.cwd(), input);
+  const inputPackageJson = await exists(resolve2(asPath, "package.json")) ? JSON.parse(await readFile2(resolve2(asPath, "package.json"), "utf-8")) : null;
+  const packageName = inputPackageJson?.name || (input.startsWith("@") ? input : `@godmode-cli/${input}`);
+  const name = resolved?.name || (input.startsWith("@") ? basename(input) : input);
+  assertSlugFree(name, scope, packageName);
+  const installTarget = resolved?.dir && await exists(resolve2(resolved.dir, "package.json")) ? resolved.dir : inputPackageJson ? asPath : packageName;
+  process.stderr.write(`Installing ${name} [${scope}]...
 `);
   try {
-    execSync(`npm install ${installTarget} --prefix ${GODMODE_HOME}`, { stdio: "pipe" });
+    execFileSync("npm", ["install", installTarget, "--prefix", scopeRoot], { stdio: "pipe" });
   } catch (e) {
     const err = e;
     throw new Error(`Failed to install ${name}: ${err.stderr?.toString().trim() || err.message}`);
   }
-  const pkgName = `@godmode-cli/${name}`;
-  const mcpConfigPath = resolve2(GODMODE_HOME, "node_modules", pkgName, ".mcp.json");
-  if (await exists(mcpConfigPath)) {
+  const pkgDir = packageInstallDir(scopeRoot, packageName);
+  const packageSource = await loadSourceFromPackageDir(pkgDir).catch((error) => {
+    const mcpConfigPath = resolve2(pkgDir, ".mcp.json");
+    if (existsSync(mcpConfigPath)) return null;
+    throw error;
+  });
+  if (packageSource) {
+    const slug = packageSource.slug || name;
+    if (slug !== name) assertSlugFree(slug, scope, packageName);
+    const ifaceKeys = Object.keys(packageSource.interfaces).filter(
+      (k) => INTERFACE_KEYS.includes(k)
+    );
+    const multi = {
+      name: packageSource.name,
+      slug,
+      description: packageSource.description || "",
+      source: "npm",
+      packageName,
+      auth: packageSource.auth,
+      headers: packageSource.headers,
+      interfaces: {}
+    };
+    for (const iface of ifaceKeys) {
+      const data = await compileInterface(iface, slug, packageSource);
+      multi.interfaces[iface] = data;
+    }
+    await writeFile(resolve2(extensionsDir, `${slug}.json`), JSON.stringify(multi, null, 2));
+    process.stderr.write(`Registered "${slug}" [${scope}] from ${packageName}
+`);
+  } else if (await exists(resolve2(pkgDir, ".mcp.json"))) {
     process.stderr.write(`Installed "${name}" (MCP server extension)
 `);
   } else {
@@ -429,45 +595,106 @@ async function addApi(input) {
 `);
   }
 }
-async function updateApi(name) {
-  await addApi(name);
+async function updateApi(name, scope) {
+  const resolvedScope = scope ?? findInstalledScope(name);
+  if (!resolvedScope) {
+    process.stderr.write(`Extension "${name}" not found
+`);
+    process.exit(1);
+  }
+  const existing = findInstalledManifestSync(name);
+  await addApi(existing?.packageName ?? name, resolvedScope);
 }
-async function removeApi(name) {
+async function removeApi(name, scope) {
+  const resolvedScope = scope ?? findInstalledScope(name);
+  if (!resolvedScope) {
+    process.stderr.write(`Extension "${name}" not found
+`);
+    process.exit(1);
+  }
+  const dir = scopeExtensionsDirSync(resolvedScope);
+  if (!dir) {
+    process.stderr.write(`Extension "${name}" not found
+`);
+    process.exit(1);
+  }
+  const manifestPath = resolve2(dir, `${name}.json`);
+  let manifestText;
   try {
-    await unlink(resolve2(GODMODE_EXTENSIONS_DIR, `${name}.json`));
-    process.stderr.write(`Removed "${name}"
+    manifestText = await readFile2(manifestPath, "utf-8");
+  } catch {
+    process.stderr.write(`Extension "${name}" not found
 `);
+    process.exit(1);
+  }
+  let packageName;
+  try {
+    const multi = JSON.parse(manifestText);
+    packageName = multi.packageName;
+  } catch {
+  }
+  const packageDir = packageName ? packageInstallDir(resolvedScope === "global" ? GODMODE_HOME : dirname(dir), packageName) : null;
+  try {
+    await unlink(manifestPath);
   } catch {
     process.stderr.write(`Extension "${name}" not found
 `);
     process.exit(1);
   }
+  if (packageDir) await rm(packageDir, { recursive: true, force: true });
+  process.stderr.write(`Removed "${name}" [${resolvedScope}]
+`);
+}
+function findInstalledScope(name) {
+  for (const scope of ["project", "global"]) {
+    const dir = scopeExtensionsDirSync(scope);
+    if (dir && existsSync(resolve2(dir, `${name}.json`))) return scope;
+  }
+  return null;
 }
 async function listApis() {
-  await ensureDirs();
-  const files = await readdir(GODMODE_EXTENSIONS_DIR);
-  const apis = files.filter((f) => f.endsWith(".json"));
-  if (!apis.length) {
-    console.log("No extensions registered. Create a manifest.yaml and run: godmode extension add <name>");
+  const rows = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const scope of ["project", "global"]) {
+    const dir = scopeExtensionsDirSync(scope);
+    if (!dir) continue;
+    const files = (await readdir(dir)).filter((f) => f.endsWith(".json"));
+    for (const file of files) {
+      const m = JSON.parse(await readFile2(resolve2(dir, file), "utf-8"));
+      const shadowed = scope === "global" && seen.has(m.slug);
+      seen.add(m.slug);
+      rows.push({
+        scope,
+        source: m.source || "local",
+        slug: m.slug,
+        ifaces: Object.keys(m.interfaces).join(", "),
+        routeTotal: Object.values(m.interfaces).reduce((n, d) => n + (d?.routes.length ?? 0), 0),
+        description: m.description || "",
+        shadowed
+      });
+    }
+  }
+  if (!rows.length) {
+    console.log("No extensions installed. Run: godmode ext install <name>");
     return;
   }
-  for (const file of apis) {
-    const m = JSON.parse(await readFile2(resolve2(GODMODE_EXTENSIONS_DIR, file), "utf-8"));
-    const ifaces = Object.keys(m.interfaces).join(", ");
-    const desc = m.description ? `  ${m.description}` : "";
-    const routeTotal = Object.values(m.interfaces).reduce((n, d) => n + (d?.routes.length ?? 0), 0);
-    console.log(`  ${m.slug}	[${ifaces}]	${routeTotal} routes${desc}`);
+  for (const r of rows) {
+    const tag = `[${r.scope}${r.shadowed ? ", shadowed" : ""}]`;
+    const desc = r.description ? `  ${r.description}` : "";
+    console.log(`  ${r.slug}	${tag}	${r.source}	[${r.ifaces}]	${r.routeTotal} routes${desc}`);
   }
 }
 async function loadMultiManifest(name) {
-  await ensureDirs();
-  try {
-    return JSON.parse(await readFile2(resolve2(GODMODE_EXTENSIONS_DIR, `${name}.json`), "utf-8"));
-  } catch {
-    process.stderr.write(`Extension "${name}" not found. Create ${name}.yaml and run: godmode extension add ${name}
+  for (const scope of ["project", "global"]) {
+    const dir = scopeExtensionsDirSync(scope);
+    if (!dir) continue;
+    const path = resolve2(dir, `${name}.json`);
+    if (!existsSync(path)) continue;
+    return JSON.parse(await readFile2(path, "utf-8"));
+  }
+  process.stderr.write(`Extension "${name}" not found. Run: godmode ext install ${name}
 `);
-    process.exit(1);
-  }
+  process.exit(1);
 }
 async function loadManifest(name, iface) {
   const multi = await loadMultiManifest(name);
@@ -489,15 +716,30 @@ async function loadManifest(name, iface) {
   }
   return projectManifest(multi, target);
 }
+function findInstalledManifestSync(name) {
+  for (const scope of ["project", "global"]) {
+    const dir = scopeExtensionsDirSync(scope);
+    if (!dir) continue;
+    const path = resolve2(dir, `${name}.json`);
+    if (!existsSync(path)) continue;
+    try {
+      return JSON.parse(readFileSync(path, "utf-8"));
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
 
 export {
   validateGraphQLFlags,
+  BUILTINS,
   GODMODE_HOME,
-  GODMODE_EXTENSIONS_DIR,
   addApi,
   updateApi,
   removeApi,
   listApis,
   loadMultiManifest,
-  loadManifest
+  loadManifest,
+  findInstalledManifestSync
 };