pal-explorer-cli 0.4.12 → 0.4.13

package/lib/commands/extension.js

@@ -1,970 +1,1060 @@
-import chalk from 'chalk';
-import crypto from 'crypto';
-import { execSync, spawnSync } from 'child_process';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import readline from 'readline';
-import config from '../utils/config.js';
-
-async function getApiKey() {
-  if (process.env.PAL_API_KEY) return process.env.PAL_API_KEY;
-  try {
-    const keytar = (await import('keytar')).default;
-    const key = await keytar.getPassword('palexplorer', 'apiKey');
-    if (key) return key;
-  } catch {}
-  return config.get('apiKey');
-}
-
-function confirm(question) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise(resolve => {
-    rl.question(question, answer => {
-      rl.close();
-      resolve(answer.toLowerCase().startsWith('y'));
-    });
-  });
-}
-
-export default function extensionCommand(program) {
-  const cmdName = process.argv[2] === 'extension' ? 'extension' : 'ext';
-  const cmd = program
-    .command(cmdName)
-    .description('manage extensions (install, remove, enable, disable)')
-    .addHelpText('after', `
-Examples:
-  $ pe ext list                          List installed extensions
-  $ pe ext install ./my-extension        Install from local path
-  $ pe ext install https://github.com/user/pe-ext-slack.git
-  $ pe ext remove slack-notify           Uninstall an extension
-  $ pe ext enable slack-notify           Enable a disabled extension
-  $ pe ext disable slack-notify          Disable without uninstalling
-  $ pe ext info slack-notify             Show extension details
-  $ pe ext config slack-notify webhookUrl https://hooks.slack.com/...
-  $ pe ext create my-extension           Scaffold a new extension
-  $ pe ext audit                         Security audit all extensions
-`)
-      .action(async () => {
-        await listExtensions();
-      });
-
-    cmd
-      .command('list')
-      .description('list installed extensions')
-      .action(async () => { await listExtensions(); });
-
-    cmd
-      .command('install <source>')
-      .description('install extension from path or git URL')
-      .option('-y, --yes', 'Skip confirmation prompt')
-      .action(async (source, opts) => {
-        try {
-          const { installExtension, HIGH_RISK_PERMISSIONS } = await import('../core/extensions.js');
-          console.log(chalk.cyan(`Installing extension from ${source}...`));
-          const result = await installExtension(source);
-
-          // Show security info
-          const riskColor = result.risk === 'high' ? chalk.red : result.risk === 'medium' ? chalk.yellow : chalk.green;
-          console.log('');
-          console.log(`  Name: ${chalk.white(result.name)} v${result.version}`);
-          console.log(`  Risk: ${riskColor(result.risk.toUpperCase())}`);
-          console.log(`  Signed: ${result.signature?.verified ? chalk.green('verified ✔') : chalk.yellow('not signed')}`);
-
-          if (result.permissions?.length) {
-            console.log(`  Permissions:`);
-            for (const p of result.permissions) {
-              const isHigh = HIGH_RISK_PERMISSIONS.has(p) || p.startsWith('exec:');
-              console.log(`    ${isHigh ? chalk.red('⚠') : chalk.gray('·')} ${isHigh ? chalk.red(p) : p}`);
-            }
-          }
-
-          // Require confirmation for unsigned or high-risk extensions
-          if (!opts.yes && (result.risk !== 'low' || !result.signature?.verified)) {
-            console.log('');
-            if (!result.signature?.verified) {
-              console.log(chalk.yellow('  ⚠ This extension is NOT signed. It has not been reviewed by the Palexplorer team.'));
-            }
-            if (result.risk === 'high') {
-              console.log(chalk.red('  ⚠ HIGH RISK: This extension requests dangerous permissions.'));
-            }
-            const ok = await confirm(chalk.white('\n  Proceed with installation? (y/N) '));
-            if (!ok) {
-              // Remove the already-copied files
-              const { removeExtension } = await import('../core/extensions.js');
-              try { removeExtension(result.name); } catch {}
-              console.log(chalk.gray('  Installation cancelled.'));
-              return;
-            }
-          }
-
-          console.log(chalk.green(`\n✔ Installed "${result.name}" v${result.version}`));
-        } catch (err) {
-          console.error(chalk.red(`Install failed: ${err.message}`));
-          process.exitCode = 1;
-        }
-      });
-
-    cmd
-      .command('remove <name>')
-      .description('uninstall an extension')
-      .action(async (extName) => {
-        try {
-          const { removeExtension } = await import('../core/extensions.js');
-          removeExtension(extName);
-          console.log(chalk.green(`✔ Removed "${extName}"`));
-        } catch (err) {
-          console.error(chalk.red(`Remove failed: ${err.message}`));
-          process.exitCode = 1;
-        }
-      });
-
-    cmd
-      .command('enable <name>')
-      .description('enable a disabled extension')
-      .action(async (extName) => {
-        const { enableExtension } = await import('../core/extensions.js');
-        enableExtension(extName);
-        console.log(chalk.green(`✔ Enabled "${extName}"`));
-      });
-
-    cmd
-      .command('disable <name>')
-      .description('disable an extension without uninstalling')
-      .action(async (extName) => {
-        const { disableExtension } = await import('../core/extensions.js');
-        disableExtension(extName);
-        console.log(chalk.green(`✔ Disabled "${extName}"`));
-      });
-
-    cmd
-      .command('info <name>')
-      .description('show extension details')
-      .action(async (extName) => {
-        const { getInstalledExtensions, getExtensionConfig } = await import('../core/extensions.js');
-        const extensions = getInstalledExtensions();
-        const ext = extensions.find(e => e.name === extName || `@palexplorer/${e.name}` === extName);
-        if (!ext) {
-          console.log(chalk.red(`Extension "${extName}" not found.`));
-          process.exitCode = 1;
-          return;
-        }
-        console.log('');
-        console.log(chalk.cyan(ext.bundled ? `@palexplorer/${ext.name}` : ext.name));
-        console.log(`  Version: ${chalk.white(ext.version)}`);
-        console.log(`  Description: ${chalk.gray(ext.description || 'N/A')}`);
-        console.log(`  Author: ${chalk.gray(ext.author || 'N/A')}`);
-        console.log(`  Status: ${ext.enabled ? chalk.green('enabled') : chalk.red('disabled')}`);
-        console.log(`  Bundled: ${ext.bundled ? chalk.blue('yes') : 'no'}`);
-        const tier = ext.tier || (ext.pro ? 'pro' : 'free');
-        const tierColor = tier === 'enterprise' ? chalk.magenta : tier === 'pro' ? chalk.yellow : chalk.green;
-        console.log(`  Tier: ${tierColor(tier.toUpperCase())}${ext.price ? ` (${ext.price})` : ''}`);
-        if (ext.hooks?.length) {
-          console.log(`  Hooks: ${chalk.gray(ext.hooks.join(', '))}`);
-        }
-        if (ext.permissions?.length) {
-          console.log(`  Permissions:`);
-          for (const p of ext.permissions) {
-            console.log(`    - ${p}`);
-          }
-        }
-        const cfg = getExtensionConfig(extName);
-        if (Object.keys(cfg).length) {
-          console.log(`  Config:`);
-          for (const [k, v] of Object.entries(cfg)) {
-            console.log(`    ${k}: ${chalk.white(JSON.stringify(v))}`);
-          }
-        }
-      });
-
-    cmd
-      .command('config <name> <key> [value]')
-      .description('get or set extension config value')
-      .action(async (extName, key, value) => {
-        const { getExtensionConfig, setExtensionConfig } = await import('../core/extensions.js');
-        if (value === undefined) {
-          const cfg = getExtensionConfig(extName);
-          console.log(cfg[key] !== undefined ? JSON.stringify(cfg[key]) : chalk.gray('(not set)'));
-        } else {
-          // Try to parse as JSON, fallback to string
-          let parsed = value;
-          try { parsed = JSON.parse(value); } catch {}
-          setExtensionConfig(extName, key, parsed);
-          console.log(chalk.green(`✔ ${extName}.${key} = ${JSON.stringify(parsed)}`));
-        }
-      });
-
-    cmd
-      .command('audit')
-      .description('security audit all installed extensions')
-      .action(async () => {
-        const {
-          getInstalledExtensions, verifySignature, computeIntegrityHash,
-          getSecurityRisk, hasBlockedImports, scanDangerousPatterns, BLOCKED_MODULES,
-        } = await import('../core/extensions.js');
-        const config = (await import('../utils/config.js')).default;
-        const extensions = getInstalledExtensions();
-
-        if (extensions.length === 0) {
-          console.log(chalk.gray('No extensions installed.'));
-          return;
-        }
-
-        console.log('');
-        console.log(chalk.cyan.bold('Extension Security Audit'));
-        console.log(chalk.gray('─'.repeat(60)));
-        let issues = 0;
-
-        for (const ext of extensions) {
-          const fullName = ext.bundled ? `@palexplorer/${ext.name}` : ext.name;
-          const sig = verifySignature(ext.path, ext);
-          const risk = getSecurityRisk(ext);
-          const mainPath = path.join(ext.path, ext.main || 'index.js');
-          const blocked = hasBlockedImports(mainPath);
-          const storedHash = config.get(`ext_integrity.${ext.name}`);
-          const currentHash = computeIntegrityHash(ext.path, ext);
-          const tampered = storedHash && storedHash !== currentHash;
-
-          const riskColor = risk === 'high' ? chalk.red : risk === 'medium' ? chalk.yellow : chalk.green;
-          console.log('');
-          console.log(`  ${ext.bundled ? chalk.blue(fullName) : chalk.white(fullName)} v${ext.version}`);
-          console.log(`    Status:    ${ext.enabled ? chalk.green('enabled') : chalk.red('disabled')}`);
-          console.log(`    Risk:      ${riskColor(risk)}`);
-          console.log(`    Signed:    ${sig.verified ? chalk.green('verified ✔') : sig.signed ? chalk.red('INVALID ✖') : chalk.yellow('unsigned')}`);
-          console.log(`    Integrity: ${tampered ? chalk.red('TAMPERED ✖') : storedHash ? chalk.green('OK ✔') : chalk.gray('no baseline')}`);
-
-          const dangerous = !ext.bundled ? scanDangerousPatterns(mainPath) : [];
-
-          if (blocked) {
-            console.log(`    ${chalk.red(`⚠ BLOCKED: imports '${blocked}'`)}`);
-            issues++;
-          }
-          if (dangerous.length > 0) {
-            console.log(`    ${chalk.yellow(`⚠ Dangerous patterns: ${dangerous.join(', ')}`)}`);
-            issues++;
-          }
-          if (tampered) {
-            console.log(`    ${chalk.red('⚠ Files modified since installation!')}`);
-            issues++;
-          }
-          if (!ext.bundled && !sig.verified) {
-            console.log(`    ${chalk.yellow('⚠ Not signed — not reviewed by Palexplorer team')}`);
-            issues++;
-          }
-          if (risk === 'high') {
-            const highPerms = (ext.permissions || []).filter(p =>
-              ['fs:write', 'fs:delete', 'net:http', 'net:ws', 'messages:send', 'shares:write'].includes(p) || p.startsWith('exec:')
-            );
-            console.log(`    ${chalk.red(`⚠ High-risk permissions: ${highPerms.join(', ')}`)}`);
-            issues++;
-          }
-        }
-
-        console.log('');
-        console.log(chalk.gray('─'.repeat(60)));
-        if (issues === 0) {
-          console.log(chalk.green(`✔ No security issues found across ${extensions.length} extension(s).`));
-        } else {
-          console.log(chalk.yellow(`⚠ ${issues} issue(s) found across ${extensions.length} extension(s).`));
-        }
-        console.log('');
-      });
-
-    cmd
-      .command('sign <extPath>')
-      .description('sign an extension with your identity key')
-      .action(async (extPath) => {
-        try {
-          const { readManifest } = await import('../core/extensions.js');
-          const { getIdentity } = await import('../core/identity.js');
-          const sodium = (await import('sodium-native')).default;
-
-          const resolvedPath = path.resolve(extPath);
-          const manifest = readManifest(resolvedPath);
-          if (!manifest) {
-            console.error(chalk.red('No valid extension.json found at path'));
-            process.exitCode = 1;
-            return;
-          }
-
-          const identity = await getIdentity();
-          if (!identity || !identity.privateKey) {
-            console.error(chalk.red('No identity found. Run "pe init" first.'));
-            process.exitCode = 1;
-            return;
-          }
-
-          manifest.signerPublicKey = identity.publicKey;
-          const manifestJson = JSON.stringify(manifest, null, 2) + '\n';
-          fs.writeFileSync(path.join(resolvedPath, 'extension.json'), manifestJson);
-
-          const manifestData = Buffer.from(manifestJson);
-          const mainData = fs.readFileSync(path.join(resolvedPath, manifest.main || 'index.js'));
-          const content = Buffer.concat([manifestData, mainData]);
-
-          const secretKey = Buffer.from(identity.privateKey, 'hex');
-          const sig = Buffer.alloc(sodium.crypto_sign_BYTES);
-          sodium.crypto_sign_detached(sig, content, secretKey);
-
-          fs.writeFileSync(path.join(resolvedPath, 'extension.sig'), sig);
-
-          console.log(chalk.green(`\nSigned "${manifest.name}" with your identity key`));
-          console.log(`  Signer: ${chalk.gray(identity.publicKey)}`);
-          console.log(`  Signature: ${chalk.gray(path.join(resolvedPath, 'extension.sig'))}`);
-        } catch (err) {
-          console.error(chalk.red(`Sign failed: ${err.message}`));
-          process.exitCode = 1;
-        }
-      });
-
-    cmd
-      .command('search [query]')
-      .description('search the extension marketplace')
-      .option('-s, --sort <sort>', 'Sort by: downloads, rating, newest', 'downloads')
-      .option('-l, --limit <n>', 'Results per page', '10')
-      .action(async (query, opts) => {
-        const { fetchFirst } = await import('../core/discoveryClient.js');
-        const params = new URLSearchParams();
-        if (query) params.set('q', query);
-        params.set('sort', opts.sort);
-        params.set('limit', opts.limit);
-
-        try {
-          const res = await fetchFirst(`/api/v1/marketplace?${params}`);
-          if (!res) {
-            console.error(chalk.red('Failed to connect to marketplace.'));
-            process.exitCode = 1;
-            return;
-          }
-          const data = await res.json();
-          if (!data?.results?.length) {
-            console.log(chalk.gray('No extensions found.'));
-            return;
-          }
-          console.log('');
-          console.log(chalk.cyan(`Marketplace (${data.total} results):`));
-          for (const ext of data.results) {
-            const verified = ext.verified ? chalk.green(' [Verified]') : '';
-            const pro = ext.pro ? chalk.yellow(' [Pro]') : '';
-            const stars = '\u2605'.repeat(Math.round(ext.rating || 0)) + '\u2606'.repeat(5 - Math.round(ext.rating || 0));
-            console.log(`  ${chalk.white(ext.name)} v${ext.version}${verified}${pro}`);
-            console.log(`    ${chalk.gray(ext.description || '')}`);
-            console.log(`    ${chalk.yellow(stars)} (${ext.reviewCount || 0}) \u00b7 ${chalk.cyan(ext.downloads || 0)} downloads \u00b7 by ${chalk.blue('@' + (ext.authorHandle || 'unknown'))}`);
-            console.log('');
-          }
-          console.log(chalk.gray('Install: pe ext install-remote <name>'));
-        } catch (err) {
-          console.error(chalk.red(`Search failed: ${err.message}`));
-          process.exitCode = 1;
-        }
-      });
-
-    cmd
-      .command('install-remote <name>')
-      .description('install extension from marketplace')
-      .action(async (name) => {
-        const { fetchFirst } = await import('../core/discoveryClient.js');
-        try {
-          const searchRes = await fetchFirst(`/api/v1/marketplace?q=${encodeURIComponent(name)}&limit=1`);
-          if (!searchRes) {
-            console.error(chalk.red('Failed to connect to marketplace.'));
-            process.exitCode = 1;
-            return;
-          }
-          const data = await searchRes.json();
-          const ext = data?.results?.find(e => e.name === name);
-          if (!ext) {
-            console.error(chalk.red(`Extension "${name}" not found in marketplace.`));
-            process.exitCode = 1;
-            return;
-          }
-
-          const dlRes = await fetchFirst(`/api/v1/marketplace/${ext.id}/download`);
-          if (!dlRes) {
-            console.error(chalk.red('Failed to get download URL.'));
-            process.exitCode = 1;
-            return;
-          }
-          const dlInfo = await dlRes.json();
-          if (!dlInfo?.bundleUrl) {
-            console.error(chalk.red('Failed to get download URL.'));
-            process.exitCode = 1;
-            return;
-          }
-
-          console.log(chalk.cyan(`Installing ${name} v${ext.version} from marketplace...`));
-
-          // Download bundle (with SSRF protection)
-          const { getPrimaryServer } = await import('../core/discoveryClient.js');
-          const bundleUrl = dlInfo.bundleUrl.startsWith('http') ? dlInfo.bundleUrl : `${getPrimaryServer()}${dlInfo.bundleUrl}`;
-          try {
-            const parsed = new URL(bundleUrl);
-            if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') throw new Error('Invalid URL scheme');
-            const host = parsed.hostname;
-            if (host === 'localhost' || host.startsWith('127.') || host.startsWith('10.') ||
-                host.startsWith('192.168.') || host.startsWith('169.254.') || host === '0.0.0.0' ||
-                /^172\.(1[6-9]|2\d|3[01])\./.test(host)) {
-              throw new Error('Bundle URL points to private network');
-            }
-          } catch (e) { if (e.message.includes('private') || e.message.includes('scheme')) throw e; }
-          const bundleRes = await fetch(bundleUrl, { signal: AbortSignal.timeout(30000) });
-          if (!bundleRes.ok) throw new Error(`Failed to download bundle: ${bundleRes.status}`);
-          const bundleData = Buffer.from(await bundleRes.arrayBuffer());
-
-          // Verify hash
-          if (dlInfo.bundleHash) {
-            const hash = crypto.createHash('sha256').update(bundleData).digest('hex');
-            if (hash !== dlInfo.bundleHash) throw new Error('Bundle hash mismatch — file may be corrupted');
-          }
-
-          // Extract to temp dir with zip-slip protection
-          const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pe-ext-dl-'));
-          const tarPath = path.join(tmpDir, `${name}.tar.gz`);
-          fs.writeFileSync(tarPath, bundleData);
-          spawnSync('tar', ['xzf', tarPath, '-C', tmpDir], { stdio: 'pipe' });
-
-          // Zip-slip protection: verify all extracted files are within tmpDir
-          const realTmpDir = fs.realpathSync(tmpDir);
-          function validateExtractedPaths(dir) {
-            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-              const fullPath = path.join(dir, entry.name);
-              const realPath = fs.realpathSync(fullPath);
-              if (!realPath.startsWith(realTmpDir)) {
-                fs.rmSync(tmpDir, { recursive: true, force: true });
-                throw new Error(`Zip-slip detected: ${entry.name} escapes extraction directory`);
-              }
-              if (entry.isDirectory()) validateExtractedPaths(fullPath);
-            }
-          }
-          validateExtractedPaths(tmpDir);
-
-          // Find the extracted extension directory
-          const entries = fs.readdirSync(tmpDir).filter(e => e !== path.basename(tarPath));
-          const extDir = entries.length === 1 ? path.join(tmpDir, entries[0]) : tmpDir;
-
-          const { installExtension } = await import('../core/extensions.js');
-          const result = await installExtension(extDir);
-          fs.rmSync(tmpDir, { recursive: true, force: true });
-          console.log(chalk.green(`\u2714 Installed "${result.name}" v${result.version || ext.version}`));
-        } catch (err) {
-          console.error(chalk.red(`Install failed: ${err.message}`));
-          process.exitCode = 1;
-        }
-      });
-
-    cmd
-      .command('publish <path>')
-      .description('publish extension to marketplace')
-      .action(async (extPath) => {
-        const { readManifest, validateManifest } = await import('../core/extensions.js');
-        const { getIdentity } = await import('../core/identity.js');
-        const { fetchFirst, getPrimaryServer } = await import('../core/discoveryClient.js');
-        const sodium = (await import('sodium-native')).default;
-
-        const resolvedPath = path.resolve(extPath);
-        const manifest = readManifest(resolvedPath);
-        if (!manifest) {
-          console.error(chalk.red('No valid extension.json found.'));
-          process.exitCode = 1;
-          return;
-        }
-
-        const validationError = validateManifest(manifest);
-        if (validationError) {
-          console.error(chalk.red(`Invalid manifest: ${validationError}`));
-          process.exitCode = 1;
-          return;
-        }
-
-        const identity = await getIdentity();
-        if (!identity?.publicKey) {
-          console.error(chalk.red('No identity. Run pe init first.'));
-          process.exitCode = 1;
-          return;
-        }
-        if (!identity.privateKey) {
-          console.error(chalk.red('No private key available. Cannot sign bundle.'));
-          process.exitCode = 1;
-          return;
-        }
-
-        const apiKey = await getApiKey();
-        if (!apiKey) {
-          console.error(chalk.red('No API key. Create one: pe api-keys create'));
-          process.exitCode = 1;
-          return;
-        }
-
-        // Create .tar.gz bundle
-        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pe-ext-'));
-        const bundlePath = path.join(tmpDir, `${manifest.name}-${manifest.version}.tar.gz`);
-        try {
-          spawnSync('tar', ['czf', bundlePath, '-C', path.dirname(resolvedPath), path.basename(resolvedPath)], {
-            stdio: 'pipe',
-          });
-        } catch (err) {
-          console.error(chalk.red(`Failed to create bundle: ${err.message}`));
-          fs.rmSync(tmpDir, { recursive: true, force: true });
-          process.exitCode = 1;
-          return;
-        }
-
-        // Compute SHA-256 hash of the bundle
-        const bundleData = fs.readFileSync(bundlePath);
-        const bundleHash = crypto.createHash('sha256').update(bundleData).digest('hex');
-
-        // Sign the hash with Ed25519
-        const secretKey = Buffer.from(identity.privateKey, 'hex');
-        const sig = Buffer.alloc(sodium.crypto_sign_BYTES);
-        sodium.crypto_sign_detached(sig, Buffer.from(bundleHash), secretKey);
-        const signature = sig.toString('hex');
-
-        // Read README if present
-        let readme = '';
-        for (const name of ['README.md', 'readme.md', 'README', 'readme.txt']) {
-          const readmePath = path.join(resolvedPath, name);
-          if (fs.existsSync(readmePath)) {
-            readme = fs.readFileSync(readmePath, 'utf-8');
-            break;
-          }
-        }
-
-        console.log(chalk.cyan(`Publishing ${manifest.name} v${manifest.version}...`));
-        console.log(chalk.gray(`  Bundle: ${(bundleData.length / 1024).toFixed(1)} KB`));
-        console.log(chalk.gray(`  Hash: ${bundleHash.slice(0, 16)}...`));
-
-        try {
-          const baseUrl = getPrimaryServer();
-          const form = new FormData();
-          form.append('bundle', new Blob([bundleData]), path.basename(bundlePath));
-          form.append('name', manifest.name);
-          form.append('version', manifest.version);
-          form.append('description', manifest.description || '');
-          form.append('author', manifest.author || '');
-          form.append('permissions', JSON.stringify(manifest.permissions || []));
-          form.append('hooks', JSON.stringify(manifest.hooks || []));
-          form.append('pro', String(manifest.pro || false));
-          form.append('license', manifest.license || 'MIT');
-          form.append('readme', readme);
-          form.append('bundleHash', bundleHash);
-          form.append('signerPublicKey', manifest.signerPublicKey || identity.publicKey);
-          form.append('signature', signature);
-          if (manifest.pricing) form.append('pricing', manifest.pricing);
-          if (manifest.price != null) form.append('price', String(manifest.price));
-
-          const res = await fetch(`${baseUrl}/api/v1/marketplace/publish`, {
-            method: 'POST',
-            headers: { 'x-api-key': apiKey },
-            body: form,
-            signal: AbortSignal.timeout(30000),
-          });
-
-          const result = await res.json();
-          if (res.ok && result?.success) {
-            console.log(chalk.green(`\u2714 Published ${manifest.name} v${manifest.version}`));
-            if (result.url) console.log(chalk.gray(`  ${result.url}`));
-          } else {
-            console.error(chalk.red(`Publish failed: ${result?.error || 'Unknown error'}`));
-            process.exitCode = 1;
-          }
-        } catch (err) {
-          console.error(chalk.red(`Publish failed: ${err.message}`));
-          process.exitCode = 1;
-        } finally {
-          fs.rmSync(tmpDir, { recursive: true, force: true });
-        }
-      });
-
-    cmd
-      .command('buy <name>')
-      .description('purchase a paid extension from the marketplace')
-      .action(async (name) => {
-        const { fetchFirst, getPrimaryServer } = await import('../core/discoveryClient.js');
-        const { getIdentity } = await import('../core/identity.js');
-        try {
-          const searchRes = await fetchFirst(`/api/v1/marketplace?q=${encodeURIComponent(name)}&limit=1`);
-          if (!searchRes) {
-            console.error(chalk.red('Failed to connect to marketplace.'));
-            process.exitCode = 1;
-            return;
-          }
-          const data = await searchRes.json();
-          const ext = data?.results?.find(e => e.name === name);
-          if (!ext) {
-            console.error(chalk.red(`Extension "${name}" not found in marketplace.`));
-            process.exitCode = 1;
-            return;
-          }
-
-          if (!ext.price || ext.price === 0) {
-            console.log(chalk.gray(`"${name}" is free. Use: pe ext install-remote ${name}`));
-            return;
-          }
-
-          console.log('');
-          console.log(`  ${chalk.white(ext.name)} v${ext.version}`);
-          console.log(`  ${chalk.gray(ext.description || '')}`);
-          console.log(`  Price: ${chalk.yellow('$' + ext.price.toFixed(2))}`);
-          console.log('');
-
-          const ok = await confirm(chalk.white(`  Purchase ${ext.name} for $${ext.price.toFixed(2)}? (y/N) `));
-          if (!ok) {
-            console.log(chalk.gray('  Cancelled.'));
-            return;
-          }
-
-          const identity = await getIdentity();
-          if (!identity?.publicKey) {
-            console.error(chalk.red('No identity. Run pe init first.'));
-            process.exitCode = 1;
-            return;
-          }
-
-          const apiKey = await getApiKey();
-          if (!apiKey) {
-            console.error(chalk.red('No API key. Create one: pe api-keys create'));
-            process.exitCode = 1;
-            return;
-          }
-
-          const baseUrl = getPrimaryServer();
-          const checkoutRes = await fetch(`${baseUrl}/api/v1/marketplace/${ext.id}/checkout`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey },
-            signal: AbortSignal.timeout(10000),
-          });
-          if (!checkoutRes.ok) {
-            console.error(chalk.red('Failed to get checkout URL.'));
-            process.exitCode = 1;
-            return;
-          }
-          const checkout = await checkoutRes.json();
-          if (checkout.checkoutUrl) {
-            console.log(chalk.cyan(`\n  Opening checkout: ${checkout.checkoutUrl}\n`));
-            try {
-              const parsed = new URL(checkout.checkoutUrl);
-              if (parsed.protocol === 'https:') {
-                const { exec } = await import('child_process');
-                exec(`start "" "${parsed.href}"`);
-              }
-            } catch {}
-          }
-
-          const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-          const token = await new Promise(resolve => {
-            rl.question(chalk.white('  Paste your purchase token: '), answer => {
-              rl.close();
-              resolve(answer.trim());
-            });
-          });
-
-          if (!token) {
-            console.log(chalk.gray('  No token provided. Cancelled.'));
-            return;
-          }
-
-          const purchaseRes = await fetch(`${baseUrl}/api/v1/marketplace/${ext.id}/purchase`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey },
-            body: JSON.stringify({ paymentToken: token }),
-            signal: AbortSignal.timeout(10000),
-          });
-          if (!purchaseRes.ok) {
-            const err = await purchaseRes.json().catch(() => ({}));
-            console.error(chalk.red(`Purchase failed: ${err.error || 'Unknown error'}`));
-            process.exitCode = 1;
-            return;
-          }
-          const purchaseData = await purchaseRes.json();
-          if (purchaseData.success && purchaseData.bundleUrl) {
-            console.log(chalk.cyan(`Installing ${name}...`));
-            const { installExtension } = await import('../core/extensions.js');
-            const result = await installExtension(purchaseData.bundleUrl);
-            console.log(chalk.green(`\u2714 Purchased and installed "${result.name}" v${result.version || ext.version}`));
-          } else if (purchaseData.success) {
-            console.log(chalk.green(`\u2714 Purchase confirmed. Install: pe ext install-remote ${name}`));
-          } else {
-            console.error(chalk.red(`Purchase failed: ${purchaseData.error || 'Unknown error'}`));
-            process.exitCode = 1;
-          }
-        } catch (err) {
-          console.error(chalk.red(`Buy failed: ${err.message}`));
-          process.exitCode = 1;
-        }
-      });
-
-    cmd
-      .command('earnings')
-      .description('show developer earnings from published extensions')
-      .action(async () => {
-        const { fetchFirst, getPrimaryServer } = await import('../core/discoveryClient.js');
-        const { getIdentity } = await import('../core/identity.js');
-        try {
-          const identity = await getIdentity();
-          if (!identity?.publicKey) {
-            console.error(chalk.red('No identity. Run pe init first.'));
-            process.exitCode = 1;
-            return;
-          }
-          const apiKey = await getApiKey();
-          if (!apiKey) {
-            console.error(chalk.red('No API key. Create one: pe api-keys create'));
-            process.exitCode = 1;
-            return;
-          }
-          const baseUrl = getPrimaryServer();
-          const res = await fetch(`${baseUrl}/api/v1/marketplace/earnings`, {
-            headers: { 'x-api-key': apiKey },
-            signal: AbortSignal.timeout(10000),
-          });
-          if (!res.ok) {
-            console.error(chalk.red('Failed to fetch earnings.'));
-            process.exitCode = 1;
-            return;
-          }
-          const data = await res.json();
-          console.log('');
-          console.log(chalk.cyan.bold('Developer Earnings'));
-          console.log(chalk.gray('\u2500'.repeat(40)));
-          console.log(`  Total Revenue:  ${chalk.white('$' + (data.totalRevenue || 0).toFixed(2))}`);
-          console.log(`  Available:      ${chalk.green('$' + (data.available || 0).toFixed(2))}`);
-          console.log(`  Paid Out:       ${chalk.gray('$' + (data.paidOut || 0).toFixed(2))}`);
-
-          if (data.recentSales?.length) {
-            console.log('');
-            console.log(chalk.cyan('Recent Sales:'));
-            for (const sale of data.recentSales) {
-              console.log(`  ${chalk.gray(new Date(sale.date).toLocaleDateString())} ${chalk.white(sale.extName)} $${sale.amount.toFixed(2)}`);
-            }
-          }
-
-          if (data.payouts?.length) {
-            console.log('');
-            console.log(chalk.cyan('Payout History:'));
-            for (const p of data.payouts) {
-              const statusColor = p.status === 'paid' ? chalk.green : p.status === 'pending' ? chalk.yellow : chalk.gray;
-              console.log(`  ${chalk.gray(new Date(p.date).toLocaleDateString())} $${p.amount.toFixed(2)} ${statusColor(p.status)} ${chalk.gray(p.email)}`);
-            }
-          }
-          console.log('');
-        } catch (err) {
-          console.error(chalk.red(`Earnings failed: ${err.message}`));
-          process.exitCode = 1;
-        }
-      });
-
-    cmd
-      .command('my-extensions')
-      .description('list your published extensions with stats')
-      .action(async () => {
-        const { fetchFirst, getPrimaryServer } = await import('../core/discoveryClient.js');
-        const { getIdentity } = await import('../core/identity.js');
-        try {
-          const identity = await getIdentity();
-          if (!identity?.publicKey) {
-            console.error(chalk.red('No identity. Run pe init first.'));
-            process.exitCode = 1;
-            return;
-          }
-          const apiKey = await getApiKey();
-          if (!apiKey) {
-            console.error(chalk.red('No API key. Create one: pe api-keys create'));
-            process.exitCode = 1;
-            return;
-          }
-          const baseUrl = getPrimaryServer();
-          const res = await fetch(`${baseUrl}/api/v1/marketplace/my-extensions`, {
-            headers: { 'x-api-key': apiKey },
-            signal: AbortSignal.timeout(10000),
-          });
-          if (!res.ok) {
-            console.error(chalk.red('Failed to fetch extensions.'));
-            process.exitCode = 1;
-            return;
-          }
-          const data = await res.json();
-          if (!data.extensions?.length) {
-            console.log(chalk.gray('No published extensions.'));
-            console.log(chalk.gray('  pe ext publish <path>'));
-            return;
-          }
-          console.log('');
-          console.log(chalk.cyan('My Published Extensions:'));
-          console.log(chalk.gray('\u2500'.repeat(60)));
-          for (const ext of data.extensions) {
-            const price = ext.price ? chalk.yellow(`$${ext.price.toFixed(2)}`) : chalk.green('Free');
-            const stars = '\u2605'.repeat(Math.round(ext.rating || 0)) + '\u2606'.repeat(5 - Math.round(ext.rating || 0));
-            console.log(`  ${chalk.white(ext.name)} v${ext.version} ${price}`);
-            console.log(`    ${chalk.yellow(stars)} (${ext.reviewCount || 0}) \u00b7 ${chalk.cyan(ext.downloads || 0)} downloads \u00b7 ${chalk.green(ext.purchases || 0)} purchases`);
-            console.log(`    Revenue: ${chalk.green('$' + (ext.revenue || 0).toFixed(2))}`);
-            console.log('');
-          }
-        } catch (err) {
-          console.error(chalk.red(`Failed: ${err.message}`));
-          process.exitCode = 1;
-        }
-      });
-
-    cmd
-      .command('create <name>')
-      .description('scaffold a new extension')
-      .action(async (extName) => {
-        const dir = path.resolve(extName);
-        const baseName = path.basename(dir);
-        if (fs.existsSync(dir)) {
-          console.log(chalk.red(`Directory "${extName}" already exists.`));
-          process.exitCode = 1;
-          return;
-        }
-
-        fs.mkdirSync(path.join(dir, 'docs'), { recursive: true });
-        fs.mkdirSync(path.join(dir, 'test'), { recursive: true });
-
-        const manifest = {
-          name: baseName,
-          version: '1.0.0',
-          description: `${baseName} extension for Palexplorer`,
-          author: '',
-          license: 'MIT',
-          main: 'index.js',
-          hooks: ['on:app:ready'],
-          permissions: ['config:read'],
-          config: {
-            enabled: { type: 'boolean', default: true, description: 'Enable this extension' },
-          },
-          pro: false,
-          minAppVersion: '0.5.0',
-        };
-
-        fs.writeFileSync(
-          path.join(dir, 'extension.json'),
-          JSON.stringify(manifest, null, 2) + '\n'
-        );
-
-        fs.writeFileSync(path.join(dir, 'index.js'), `let ctx = null;
-
-export function activate(context) {
-  ctx = context;
-
-  context.hooks.on('on:app:ready', async () => {
-    context.logger.info('${baseName} ready');
-  });
-}
-
-export function deactivate() {
-  ctx = null;
-}
-`);
-
-        fs.writeFileSync(path.join(dir, 'test', `${baseName}.test.js`), `import { describe, it, beforeEach, mock } from 'node:test';
-import assert from 'node:assert/strict';
-
-function createMockContext(overrides = {}) {
-  return {
-    hooks: { on: mock.fn() },
-    config: { get: mock.fn(), set: mock.fn() },
-    store: { get: mock.fn(), set: mock.fn(), delete: mock.fn() },
-    logger: { info: mock.fn(), warn: mock.fn(), error: mock.fn() },
-    app: { version: '0.5.0', platform: 'linux', dataDir: '/tmp/test' },
-    ...overrides,
-  };
-}
-
-describe('${baseName}', () => {
-  let ext;
-  let ctx;
-
-  beforeEach(async () => {
-    ext = await import('../index.js');
-    ctx = createMockContext();
-  });
-
-  it('should activate and register hooks', () => {
-    ext.activate(ctx);
-    assert.ok(ctx.hooks.on.mock.calls.length > 0);
-  });
-
-  it('should deactivate cleanly', () => {
-    ext.activate(ctx);
-    ext.deactivate();
-  });
-});
-`);
-
-        fs.writeFileSync(path.join(dir, 'README.md'), `# ${baseName}
-
-Brief description of what this extension does.
-
-## Configuration
-
-| Key | Type | Default | Description |
-|-----|------|---------|-------------|
-| \`enabled\` | boolean | \`true\` | Enable this extension |
-
-\`\`\`bash
-pe ext config ${baseName} enabled true
-\`\`\`
-`);
-
-        fs.writeFileSync(path.join(dir, 'docs', 'PLAN.md'), `# ${baseName} — Plan
-
-## Goal
-
-What problem does this extension solve?
-
-## Design
-
-- How it hooks into core
-- Key decisions and trade-offs
-`);
-
-        fs.writeFileSync(path.join(dir, 'docs', 'MONETIZATION.md'), `# ${baseName} — Monetization
-
-## Tier
-
-- [ ] Free
-- [ ] Pro
-- [ ] Enterprise
-
-## Rationale
-
-Why this tier?
-`);
-
-        console.log(chalk.green(`✔ Scaffolded extension at ./${baseName}/`));
-        console.log(chalk.gray('  Files created:'));
-        console.log(chalk.gray('    extension.json'));
-        console.log(chalk.gray('    index.js'));
-        console.log(chalk.gray('    README.md'));
-        console.log(chalk.gray('    docs/PLAN.md'));
-        console.log(chalk.gray('    docs/MONETIZATION.md'));
-        console.log(chalk.gray(`    test/${baseName}.test.js`));
-        console.log('');
-        console.log(chalk.cyan('  Install it:'));
-        console.log(chalk.white(`    pe ext install ./${baseName}`));
-      });
-}
-
-async function listExtensions() {
-  const { getInstalledExtensions } = await import('../core/extensions.js');
-  const extensions = getInstalledExtensions();
-  if (extensions.length === 0) {
-    console.log(chalk.gray('No extensions installed.'));
-    console.log(chalk.gray('  pe ext install <path|git-url>'));
-    console.log(chalk.gray('  pe ext create <name>'));
-    return;
-  }
-
-  console.log('');
-  console.log(chalk.cyan('Extensions:'));
-  for (const ext of extensions) {
-    const name = ext.bundled ? chalk.blue(`@palexplorer/${ext.name}`) : chalk.white(ext.name);
-    const status = ext.enabled ? chalk.green('●') : chalk.red('○');
-    const version = chalk.gray(`v${ext.version}`);
-    const tier = ext.tier || (ext.pro ? 'pro' : 'free');
-    const tierBadge = tier === 'enterprise' ? chalk.magenta(' [Enterprise]')
-      : tier === 'pro' ? chalk.yellow(' [Pro]') : '';
-    console.log(`  ${status} ${name} ${version}${tierBadge}`);
-    if (ext.description) console.log(`    ${chalk.gray(ext.description)}`);
-  }
-}
+import chalk from 'chalk';
+import crypto from 'crypto';
+import { execSync, spawnSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import readline from 'readline';
+import config from '../utils/config.js';
+
+async function getApiKey() {
+  if (process.env.PAL_API_KEY) return process.env.PAL_API_KEY;
+  try {
+    const keytar = (await import('keytar')).default;
+    const key = await keytar.getPassword('palexplorer', 'apiKey');
+    if (key) return key;
+  } catch {}
+  return config.get('apiKey');
+}
+
+function confirm(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise(resolve => {
+    rl.question(question, answer => {
+      rl.close();
+      resolve(answer.toLowerCase().startsWith('y'));
+    });
+  });
+}
+
+export default function extensionCommand(program) {
+  const cmdName = process.argv[2] === 'extension' ? 'extension' : 'ext';
+  const cmd = program
+    .command(cmdName)
+    .description('manage extensions (install, remove, enable, disable)')
+    .addHelpText('after', `
+Examples:
+  $ pal ext list                          List installed extensions
+  $ pal ext install ./my-extension        Install from local path
+  $ pal ext install https://github.com/user/pe-ext-slack.git
+  $ pal ext remove slack-notify           Uninstall an extension
+  $ pal ext enable slack-notify           Enable a disabled extension
+  $ pal ext disable slack-notify          Disable without uninstalling
+  $ pal ext info slack-notify             Show extension details
+  $ pal ext config slack-notify webhookUrl https://hooks.slack.com/...
+  $ pal ext create my-extension           Scaffold a new extension
+  $ pal ext audit                         Security audit all extensions
+`)
+      .action(async () => {
+        await listExtensions();
+      });
+
+    cmd
+      .command('list')
+      .description('list installed extensions')
+      .action(async () => { await listExtensions(); });
+
+    cmd
+      .command('install <source>')
+      .description('install extension from path or git URL')
+      .option('-y, --yes', 'Skip confirmation prompt')
+      .action(async (source, opts) => {
+        try {
+          const { installExtension, HIGH_RISK_PERMISSIONS } = await import('../core/extensions.js');
+          console.log(chalk.cyan(`Installing extension from ${source}...`));
+          const result = await installExtension(source);
+
+          // Show security info
+          const riskColor = result.risk === 'high' ? chalk.red : result.risk === 'medium' ? chalk.yellow : chalk.green;
+          console.log('');
+          console.log(`  Name: ${chalk.white(result.name)} v${result.version}`);
+          console.log(`  Risk: ${riskColor(result.risk.toUpperCase())}`);
+          console.log(`  Signed: ${result.signature?.verified ? chalk.green('verified ✔') : chalk.yellow('not signed')}`);
+
+          if (result.permissions?.length) {
+            console.log(`  Permissions:`);
+            for (const p of result.permissions) {
+              const isHigh = HIGH_RISK_PERMISSIONS.has(p) || p.startsWith('exec:');
+              console.log(`    ${isHigh ? chalk.red('⚠') : chalk.gray('·')} ${isHigh ? chalk.red(p) : p}`);
+            }
+          }
+
+          // Require confirmation for unsigned or high-risk extensions
+          if (!opts.yes && (result.risk !== 'low' || !result.signature?.verified)) {
+            console.log('');
+            if (!result.signature?.verified) {
+              console.log(chalk.yellow('  ⚠ This extension is NOT signed. It has not been reviewed by the Palexplorer team.'));
+            }
+            if (result.risk === 'high') {
+              console.log(chalk.red('  ⚠ HIGH RISK: This extension requests dangerous permissions.'));
+            }
+            const ok = await confirm(chalk.white('\n  Proceed with installation? (y/N) '));
+            if (!ok) {
+              // Remove the already-copied files
+              const { removeExtension } = await import('../core/extensions.js');
+              try { removeExtension(result.name); } catch {}
+              console.log(chalk.gray('  Installation cancelled.'));
+              return;
+            }
+          }
+
+          console.log(chalk.green(`\n✔ Installed "${result.name}" v${result.version}`));
+        } catch (err) {
+          console.error(chalk.red(`Install failed: ${err.message}`));
+          process.exitCode = 1;
+        }
+      });
+
+    cmd
+      .command('remove <name>')
+      .description('uninstall an extension')
+      .action(async (extName) => {
+        try {
+          const { removeExtension } = await import('../core/extensions.js');
+          removeExtension(extName);
+          console.log(chalk.green(`✔ Removed "${extName}"`));
+        } catch (err) {
+          console.error(chalk.red(`Remove failed: ${err.message}`));
+          process.exitCode = 1;
+        }
+      });
+
+    cmd
+      .command('enable <name>')
+      .description('enable a disabled extension')
+      .action(async (extName) => {
+        const { enableExtension } = await import('../core/extensions.js');
+        enableExtension(extName);
+        console.log(chalk.green(`✔ Enabled "${extName}"`));
+      });
+
+    cmd
+      .command('disable <name>')
+      .description('disable an extension without uninstalling')
+      .action(async (extName) => {
+        const { disableExtension } = await import('../core/extensions.js');
+        disableExtension(extName);
+        console.log(chalk.green(`✔ Disabled "${extName}"`));
+      });
+
+    cmd
+      .command('info <name>')
+      .description('show extension details')
+      .action(async (extName) => {
+        const { getInstalledExtensions, getExtensionConfig } = await import('../core/extensions.js');
+        const extensions = getInstalledExtensions();
+        const ext = extensions.find(e => e.name === extName || `@palexplorer/${e.name}` === extName);
+        if (!ext) {
+          console.log(chalk.red(`Extension "${extName}" not found.`));
+          process.exitCode = 1;
+          return;
+        }
+        console.log('');
+        console.log(chalk.cyan(ext.bundled ? `@palexplorer/${ext.name}` : ext.name));
+        console.log(`  Version: ${chalk.white(ext.version)}`);
+        console.log(`  Description: ${chalk.gray(ext.description || 'N/A')}`);
+        console.log(`  Author: ${chalk.gray(ext.author || 'N/A')}`);
+        console.log(`  Status: ${ext.enabled ? chalk.green('enabled') : chalk.red('disabled')}`);
+        console.log(`  Bundled: ${ext.bundled ? chalk.blue('yes') : 'no'}`);
+        const tier = ext.tier || (ext.pro ? 'pro' : 'free');
+        const tierColor = tier === 'enterprise' ? chalk.magenta : tier === 'pro' ? chalk.yellow : chalk.green;
+        console.log(`  Tier: ${tierColor(tier.toUpperCase())}${ext.price ? ` (${ext.price})` : ''}`);
+        if (ext.hooks?.length) {
+          console.log(`  Hooks: ${chalk.gray(ext.hooks.join(', '))}`);
+        }
+        if (ext.permissions?.length) {
+          console.log(`  Permissions:`);
+          for (const p of ext.permissions) {
+            console.log(`    - ${p}`);
+          }
+        }
+        const cfg = getExtensionConfig(extName);
+        if (Object.keys(cfg).length) {
+          console.log(`  Config:`);
+          for (const [k, v] of Object.entries(cfg)) {
+            console.log(`    ${k}: ${chalk.white(JSON.stringify(v))}`);
+          }
+        }
+      });
+
+    cmd
+      .command('help <name>')
+      .description('show extension help and usage')
+      .action(async (extName) => {
+        const { getInstalledExtensions, getExtensionConfig, readManifest } = await import('../core/extensions.js');
+        const extensions = getInstalledExtensions();
+        const ext = extensions.find(e => e.name === extName || `@palexplorer/${e.name}` === extName);
+        if (!ext) {
+          console.log(chalk.red(`Extension "${extName}" not found.`));
+          process.exitCode = 1;
+          return;
+        }
+
+        const manifest = readManifest(ext.path);
+        const help = manifest?.help;
+        const fullName = ext.bundled ? `@palexplorer/${ext.name}` : ext.name;
+
+        console.log('');
+        console.log(chalk.cyan.bold(fullName) + chalk.gray(` v${ext.version}`));
+        console.log(chalk.gray('─'.repeat(50)));
+
+        // Summary / description
+        console.log(chalk.white(help?.summary || ext.description || 'No description.'));
+        console.log('');
+
+        // Usage
+        if (help?.usage) {
+          console.log(chalk.yellow.bold('Usage'));
+          console.log(`  ${help.usage}`);
+          console.log('');
+        }
+
+        // Examples
+        if (help?.examples?.length) {
+          console.log(chalk.yellow.bold('Examples'));
+          for (const ex of help.examples) {
+            console.log(`  ${chalk.green('$')} ${ex}`);
+          }
+          console.log('');
+        }
+
+        // Config reference
+        const configSchema = manifest?.config;
+        if (help?.configReference && Object.keys(help.configReference).length) {
+          console.log(chalk.yellow.bold('Configuration'));
+          for (const [key, desc] of Object.entries(help.configReference)) {
+            const def = configSchema?.[key]?.default;
+            const defStr = def !== undefined ? chalk.gray(` (default: ${JSON.stringify(def)})`) : '';
+            console.log(`  ${chalk.white(key)}${defStr}`);
+            console.log(`    ${chalk.gray(desc)}`);
+          }
+          console.log('');
+        } else if (configSchema && Object.keys(configSchema).length) {
+          console.log(chalk.yellow.bold('Configuration'));
+          for (const [key, schema] of Object.entries(configSchema)) {
+            const def = schema.default !== undefined ? chalk.gray(` (default: ${JSON.stringify(schema.default)})`) : '';
+            console.log(`  ${chalk.white(key)}${def}`);
+            if (schema.description) console.log(`    ${chalk.gray(schema.description)}`);
+          }
+          console.log('');
+        }
+
+        // Links
+        if (help?.links && Object.keys(help.links).length) {
+          console.log(chalk.yellow.bold('Links'));
+          for (const [label, url] of Object.entries(help.links)) {
+            console.log(`  ${chalk.white(label)}: ${chalk.blue(url)}`);
+          }
+          console.log('');
+        }
+
+        // Quick commands
+        console.log(chalk.gray(`  pal ext info ${ext.name}         Show metadata`));
+        console.log(chalk.gray(`  pal ext config ${ext.name} <k> <v>  Set config`));
+        console.log(chalk.gray(`  pal ext disable ${ext.name}      Disable`));
+      });
+
+    cmd
+      .command('config <name> <key> [value]')
+      .description('get or set extension config value')
+      .action(async (extName, key, value) => {
+        const { getExtensionConfig, setExtensionConfig } = await import('../core/extensions.js');
+        if (value === undefined) {
+          const cfg = getExtensionConfig(extName);
+          console.log(cfg[key] !== undefined ? JSON.stringify(cfg[key]) : chalk.gray('(not set)'));
+        } else {
+          // Try to parse as JSON, fallback to string
+          let parsed = value;
+          try { parsed = JSON.parse(value); } catch {}
+          setExtensionConfig(extName, key, parsed);
+          console.log(chalk.green(`✔ ${extName}.${key} = ${JSON.stringify(parsed)}`));
+        }
+      });
+
+    cmd
+      .command('audit')
+      .description('security audit all installed extensions')
+      .action(async () => {
+        const {
+          getInstalledExtensions, verifySignature, computeIntegrityHash,
+          getSecurityRisk, hasBlockedImports, scanDangerousPatterns, BLOCKED_MODULES,
+        } = await import('../core/extensions.js');
+        const config = (await import('../utils/config.js')).default;
+        const extensions = getInstalledExtensions();
+
+        if (extensions.length === 0) {
+          console.log(chalk.gray('No extensions installed.'));
+          return;
+        }
+
+        console.log('');
+        console.log(chalk.cyan.bold('Extension Security Audit'));
+        console.log(chalk.gray('─'.repeat(60)));
+        let issues = 0;
+
+        for (const ext of extensions) {
+          const fullName = ext.bundled ? `@palexplorer/${ext.name}` : ext.name;
+          const sig = verifySignature(ext.path, ext);
+          const risk = getSecurityRisk(ext);
+          const mainPath = path.join(ext.path, ext.main || 'index.js');
+          const blocked = hasBlockedImports(mainPath);
+          const storedHash = config.get(`ext_integrity.${ext.name}`);
+          const currentHash = computeIntegrityHash(ext.path, ext);
+          const tampered = storedHash && storedHash !== currentHash;
+
+          const riskColor = risk === 'high' ? chalk.red : risk === 'medium' ? chalk.yellow : chalk.green;
+          console.log('');
+          console.log(`  ${ext.bundled ? chalk.blue(fullName) : chalk.white(fullName)} v${ext.version}`);
+          console.log(`    Status:    ${ext.enabled ? chalk.green('enabled') : chalk.red('disabled')}`);
+          console.log(`    Risk:      ${riskColor(risk)}`);
+          console.log(`    Signed:    ${sig.verified ? chalk.green('verified ✔') : sig.signed ? chalk.red('INVALID ✖') : chalk.yellow('unsigned')}`);
+          console.log(`    Integrity: ${tampered ? chalk.red('TAMPERED ✖') : storedHash ? chalk.green('OK ✔') : chalk.gray('no baseline')}`);
+
+          const dangerous = !ext.bundled ? scanDangerousPatterns(mainPath) : [];
+
+          if (blocked) {
+            console.log(`    ${chalk.red(`⚠ BLOCKED: imports '${blocked}'`)}`);
+            issues++;
+          }
+          if (dangerous.length > 0) {
+            console.log(`    ${chalk.yellow(`⚠ Dangerous patterns: ${dangerous.join(', ')}`)}`);
+            issues++;
+          }
+          if (tampered) {
+            console.log(`    ${chalk.red('⚠ Files modified since installation!')}`);
+            issues++;
+          }
+          if (!ext.bundled && !sig.verified) {
+            console.log(`    ${chalk.yellow('⚠ Not signed — not reviewed by Palexplorer team')}`);
+            issues++;
+          }
+          if (risk === 'high') {
+            const highPerms = (ext.permissions || []).filter(p =>
+              ['fs:write', 'fs:delete', 'net:http', 'net:ws', 'messages:send', 'shares:write'].includes(p) || p.startsWith('exec:')
+            );
+            console.log(`    ${chalk.red(`⚠ High-risk permissions: ${highPerms.join(', ')}`)}`);
+            issues++;
+          }
+        }
+
+        console.log('');
+        console.log(chalk.gray('─'.repeat(60)));
+        if (issues === 0) {
+          console.log(chalk.green(`✔ No security issues found across ${extensions.length} extension(s).`));
+        } else {
+          console.log(chalk.yellow(`⚠ ${issues} issue(s) found across ${extensions.length} extension(s).`));
+        }
+        console.log('');
+      });
+
+    cmd
+      .command('sign <extPath>')
+      .description('sign an extension with your identity key')
+      .action(async (extPath) => {
+        try {
+          const { readManifest } = await import('../core/extensions.js');
+          const { getIdentity } = await import('../core/identity.js');
+          const sodium = (await import('sodium-native')).default;
+
+          const resolvedPath = path.resolve(extPath);
+          const manifest = readManifest(resolvedPath);
+          if (!manifest) {
+            console.error(chalk.red('No valid extension.json found at path'));
+            process.exitCode = 1;
+            return;
+          }
+
+          const identity = await getIdentity();
+          if (!identity || !identity.privateKey) {
+            console.error(chalk.red('No identity found. Run "pal init" first.'));
+            process.exitCode = 1;
+            return;
+          }
+
+          manifest.signerPublicKey = identity.publicKey;
+          const manifestJson = JSON.stringify(manifest, null, 2) + '\n';
+          fs.writeFileSync(path.join(resolvedPath, 'extension.json'), manifestJson);
+
+          const manifestData = Buffer.from(manifestJson);
+          const mainData = fs.readFileSync(path.join(resolvedPath, manifest.main || 'index.js'));
+          const content = Buffer.concat([manifestData, mainData]);
+
+          const secretKey = Buffer.from(identity.privateKey, 'hex');
+          const sig = Buffer.alloc(sodium.crypto_sign_BYTES);
+          sodium.crypto_sign_detached(sig, content, secretKey);
+
+          fs.writeFileSync(path.join(resolvedPath, 'extension.sig'), sig);
+
+          console.log(chalk.green(`\nSigned "${manifest.name}" with your identity key`));
+          console.log(`  Signer: ${chalk.gray(identity.publicKey)}`);
+          console.log(`  Signature: ${chalk.gray(path.join(resolvedPath, 'extension.sig'))}`);
+        } catch (err) {
+          console.error(chalk.red(`Sign failed: ${err.message}`));
+          process.exitCode = 1;
+        }
+      });
+
+    cmd
+      .command('search [query]')
+      .description('search the extension marketplace')
+      .option('-s, --sort <sort>', 'Sort by: downloads, rating, newest', 'downloads')
+      .option('-l, --limit <n>', 'Results per page', '10')
+      .action(async (query, opts) => {
+        const { fetchFirst } = await import('../core/discoveryClient.js');
+        const params = new URLSearchParams();
+        if (query) params.set('q', query);
+        params.set('sort', opts.sort);
+        params.set('limit', opts.limit);
+
+        try {
+          const res = await fetchFirst(`/api/v1/marketplace?${params}`);
+          if (!res) {
+            console.error(chalk.red('Failed to connect to marketplace.'));
+            process.exitCode = 1;
+            return;
+          }
+          const data = await res.json();
+          if (!data?.results?.length) {
+            console.log(chalk.gray('No extensions found.'));
+            return;
+          }
+          console.log('');
+          console.log(chalk.cyan(`Marketplace (${data.total} results):`));
+          for (const ext of data.results) {
+            const verified = ext.verified ? chalk.green(' [Verified]') : '';
+            const pro = ext.pro ? chalk.yellow(' [Pro]') : '';
+            const stars = '\u2605'.repeat(Math.round(ext.rating || 0)) + '\u2606'.repeat(5 - Math.round(ext.rating || 0));
+            console.log(`  ${chalk.white(ext.name)} v${ext.version}${verified}${pro}`);
+            console.log(`    ${chalk.gray(ext.description || '')}`);
+            console.log(`    ${chalk.yellow(stars)} (${ext.reviewCount || 0}) \u00b7 ${chalk.cyan(ext.downloads || 0)} downloads \u00b7 by ${chalk.blue('@' + (ext.authorHandle || 'unknown'))}`);
+            console.log('');
+          }
+          console.log(chalk.gray('Install: pal ext install-remote <name>'));
+        } catch (err) {
+          console.error(chalk.red(`Search failed: ${err.message}`));
+          process.exitCode = 1;
+        }
+      });
+
+    cmd
+      .command('install-remote <name>')
+      .description('install extension from marketplace')
+      .action(async (name) => {
+        const { fetchFirst } = await import('../core/discoveryClient.js');
+        try {
+          const searchRes = await fetchFirst(`/api/v1/marketplace?q=${encodeURIComponent(name)}&limit=1`);
+          if (!searchRes) {
+            console.error(chalk.red('Failed to connect to marketplace.'));
+            process.exitCode = 1;
+            return;
+          }
+          const data = await searchRes.json();
+          const ext = data?.results?.find(e => e.name === name);
+          if (!ext) {
+            console.error(chalk.red(`Extension "${name}" not found in marketplace.`));
+            process.exitCode = 1;
+            return;
+          }
+
+          const dlRes = await fetchFirst(`/api/v1/marketplace/${ext.id}/download`);
+          if (!dlRes) {
+            console.error(chalk.red('Failed to get download URL.'));
+            process.exitCode = 1;
+            return;
+          }
+          const dlInfo = await dlRes.json();
+          if (!dlInfo?.bundleUrl) {
+            console.error(chalk.red('Failed to get download URL.'));
+            process.exitCode = 1;
+            return;
+          }
+
+          console.log(chalk.cyan(`Installing ${name} v${ext.version} from marketplace...`));
+
+          // Download bundle (with SSRF protection)
+          const { getPrimaryServer } = await import('../core/discoveryClient.js');
+          const bundleUrl = dlInfo.bundleUrl.startsWith('http') ? dlInfo.bundleUrl : `${getPrimaryServer()}${dlInfo.bundleUrl}`;
+          try {
+            const parsed = new URL(bundleUrl);
+            if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') throw new Error('Invalid URL scheme');
+            const host = parsed.hostname;
+            if (host === 'localhost' || host.startsWith('127.') || host.startsWith('10.') ||
+                host.startsWith('192.168.') || host.startsWith('169.254.') || host === '0.0.0.0' ||
+                /^172\.(1[6-9]|2\d|3[01])\./.test(host)) {
+              throw new Error('Bundle URL points to private network');
+            }
+          } catch (e) { if (e.message.includes('private') || e.message.includes('scheme')) throw e; }
+          const bundleRes = await fetch(bundleUrl, { signal: AbortSignal.timeout(30000) });
+          if (!bundleRes.ok) throw new Error(`Failed to download bundle: ${bundleRes.status}`);
+          const bundleData = Buffer.from(await bundleRes.arrayBuffer());
+
+          // Verify hash
+          if (dlInfo.bundleHash) {
+            const hash = crypto.createHash('sha256').update(bundleData).digest('hex');
+            if (hash !== dlInfo.bundleHash) throw new Error('Bundle hash mismatch — file may be corrupted');
+          }
+
+          // Extract to temp dir with zip-slip protection
+          const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pe-ext-dl-'));
+          const tarPath = path.join(tmpDir, `${name}.tar.gz`);
+          fs.writeFileSync(tarPath, bundleData);
+          spawnSync('tar', ['xzf', tarPath, '-C', tmpDir], { stdio: 'pipe' });
+
+          // Zip-slip protection: verify all extracted files are within tmpDir
+          const realTmpDir = fs.realpathSync(tmpDir);
+          function validateExtractedPaths(dir) {
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+              const fullPath = path.join(dir, entry.name);
+              const realPath = fs.realpathSync(fullPath);
+              if (!realPath.startsWith(realTmpDir)) {
+                fs.rmSync(tmpDir, { recursive: true, force: true });
+                throw new Error(`Zip-slip detected: ${entry.name} escapes extraction directory`);
+              }
+              if (entry.isDirectory()) validateExtractedPaths(fullPath);
+            }
+          }
+          validateExtractedPaths(tmpDir);
+
+          // Find the extracted extension directory
+          const entries = fs.readdirSync(tmpDir).filter(e => e !== path.basename(tarPath));
+          const extDir = entries.length === 1 ? path.join(tmpDir, entries[0]) : tmpDir;
+
+          const { installExtension } = await import('../core/extensions.js');
+          const result = await installExtension(extDir);
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+          console.log(chalk.green(`\u2714 Installed "${result.name}" v${result.version || ext.version}`));
+        } catch (err) {
+          console.error(chalk.red(`Install failed: ${err.message}`));
+          process.exitCode = 1;
+        }
+      });
+
+    cmd
+      .command('publish <path>')
+      .description('publish extension to marketplace')
+      .action(async (extPath) => {
+        const { readManifest, validateManifest } = await import('../core/extensions.js');
+        const { getIdentity } = await import('../core/identity.js');
+        const { fetchFirst, getPrimaryServer } = await import('../core/discoveryClient.js');
+        const sodium = (await import('sodium-native')).default;
+
+        const resolvedPath = path.resolve(extPath);
+        const manifest = readManifest(resolvedPath);
+        if (!manifest) {
+          console.error(chalk.red('No valid extension.json found.'));
+          process.exitCode = 1;
+          return;
+        }
+
+        const validationError = validateManifest(manifest);
+        if (validationError) {
+          console.error(chalk.red(`Invalid manifest: ${validationError}`));
+          process.exitCode = 1;
+          return;
+        }
+
+        const identity = await getIdentity();
+        if (!identity?.publicKey) {
+          console.error(chalk.red('No identity. Run pal init first.'));
+          process.exitCode = 1;
+          return;
+        }
+        if (!identity.privateKey) {
+          console.error(chalk.red('No private key available. Cannot sign bundle.'));
+          process.exitCode = 1;
+          return;
+        }
+
+        const apiKey = await getApiKey();
+        if (!apiKey) {
+          console.error(chalk.red('No API key. Create one: pal api-keys create'));
+          process.exitCode = 1;
+          return;
+        }
+
+        // Create .tar.gz bundle
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pe-ext-'));
+        const bundlePath = path.join(tmpDir, `${manifest.name}-${manifest.version}.tar.gz`);
+        try {
+          spawnSync('tar', ['czf', bundlePath, '-C', path.dirname(resolvedPath), path.basename(resolvedPath)], {
+            stdio: 'pipe',
+          });
+        } catch (err) {
+          console.error(chalk.red(`Failed to create bundle: ${err.message}`));
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+          process.exitCode = 1;
+          return;
+        }
+
+        // Compute SHA-256 hash of the bundle
+        const bundleData = fs.readFileSync(bundlePath);
+        const bundleHash = crypto.createHash('sha256').update(bundleData).digest('hex');
+
+        // Sign the hash with Ed25519
+        const secretKey = Buffer.from(identity.privateKey, 'hex');
+        const sig = Buffer.alloc(sodium.crypto_sign_BYTES);
+        sodium.crypto_sign_detached(sig, Buffer.from(bundleHash), secretKey);
+        const signature = sig.toString('hex');
+
+        // Read README if present
+        let readme = '';
+        for (const name of ['README.md', 'readme.md', 'README', 'readme.txt']) {
+          const readmePath = path.join(resolvedPath, name);
+          if (fs.existsSync(readmePath)) {
+            readme = fs.readFileSync(readmePath, 'utf-8');
+            break;
+          }
+        }
+
+        console.log(chalk.cyan(`Publishing ${manifest.name} v${manifest.version}...`));
+        console.log(chalk.gray(`  Bundle: ${(bundleData.length / 1024).toFixed(1)} KB`));
+        console.log(chalk.gray(`  Hash: ${bundleHash.slice(0, 16)}...`));
+
+        try {
+          const baseUrl = getPrimaryServer();
+          const form = new FormData();
+          form.append('bundle', new Blob([bundleData]), path.basename(bundlePath));
+          form.append('name', manifest.name);
+          form.append('version', manifest.version);
+          form.append('description', manifest.description || '');
+          form.append('author', manifest.author || '');
+          form.append('permissions', JSON.stringify(manifest.permissions || []));
+          form.append('hooks', JSON.stringify(manifest.hooks || []));
+          form.append('pro', String(manifest.pro || false));
+          form.append('license', manifest.license || 'MIT');
+          form.append('readme', readme);
+          form.append('bundleHash', bundleHash);
+          form.append('signerPublicKey', manifest.signerPublicKey || identity.publicKey);
+          form.append('signature', signature);
+          if (manifest.pricing) form.append('pricing', manifest.pricing);
+          if (manifest.price != null) form.append('price', String(manifest.price));
+
+          const res = await fetch(`${baseUrl}/api/v1/marketplace/publish`, {
+            method: 'POST',
+            headers: { 'x-api-key': apiKey },
+            body: form,
+            signal: AbortSignal.timeout(30000),
+          });
+
+          const result = await res.json();
+          if (res.ok && result?.success) {
+            console.log(chalk.green(`\u2714 Published ${manifest.name} v${manifest.version}`));
+            if (result.url) console.log(chalk.gray(`  ${result.url}`));
+          } else {
+            console.error(chalk.red(`Publish failed: ${result?.error || 'Unknown error'}`));
+            process.exitCode = 1;
+          }
+        } catch (err) {
+          console.error(chalk.red(`Publish failed: ${err.message}`));
+          process.exitCode = 1;
+        } finally {
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+      });
+
+    cmd
+      .command('buy <name>')
+      .description('purchase a paid extension from the marketplace')
+      .action(async (name) => {
+        const { fetchFirst, getPrimaryServer } = await import('../core/discoveryClient.js');
+        const { getIdentity } = await import('../core/identity.js');
+        try {
+          const searchRes = await fetchFirst(`/api/v1/marketplace?q=${encodeURIComponent(name)}&limit=1`);
+          if (!searchRes) {
+            console.error(chalk.red('Failed to connect to marketplace.'));
+            process.exitCode = 1;
+            return;
+          }
+          const data = await searchRes.json();
+          const ext = data?.results?.find(e => e.name === name);
+          if (!ext) {
+            console.error(chalk.red(`Extension "${name}" not found in marketplace.`));
+            process.exitCode = 1;
+            return;
+          }
+
+          if (!ext.price || ext.price === 0) {
+            console.log(chalk.gray(`"${name}" is free. Use: pal ext install-remote ${name}`));
+            return;
+          }
+
+          console.log('');
+          console.log(`  ${chalk.white(ext.name)} v${ext.version}`);
+          console.log(`  ${chalk.gray(ext.description || '')}`);
+          console.log(`  Price: ${chalk.yellow('$' + ext.price.toFixed(2))}`);
+          console.log('');
+
+          const ok = await confirm(chalk.white(`  Purchase ${ext.name} for $${ext.price.toFixed(2)}? (y/N) `));
+          if (!ok) {
+            console.log(chalk.gray('  Cancelled.'));
+            return;
+          }
+
+          const identity = await getIdentity();
+          if (!identity?.publicKey) {
+            console.error(chalk.red('No identity. Run pal init first.'));
+            process.exitCode = 1;
+            return;
+          }
+
+          const apiKey = await getApiKey();
+          if (!apiKey) {
+            console.error(chalk.red('No API key. Create one: pal api-keys create'));
+            process.exitCode = 1;
+            return;
+          }
+
+          const baseUrl = getPrimaryServer();
+          const checkoutRes = await fetch(`${baseUrl}/api/v1/marketplace/${ext.id}/checkout`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey },
+            signal: AbortSignal.timeout(10000),
+          });
+          if (!checkoutRes.ok) {
+            console.error(chalk.red('Failed to get checkout URL.'));
+            process.exitCode = 1;
+            return;
+          }
+          const checkout = await checkoutRes.json();
+          if (checkout.checkoutUrl) {
+            console.log(chalk.cyan(`\n  Opening checkout: ${checkout.checkoutUrl}\n`));
+            try {
+              const parsed = new URL(checkout.checkoutUrl);
+              if (parsed.protocol === 'https:') {
+                const { exec } = await import('child_process');
+                exec(`start "" "${parsed.href}"`);
+              }
+            } catch {}
+          }
+
+          const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+          const token = await new Promise(resolve => {
+            rl.question(chalk.white('  Paste your purchase token: '), answer => {
+              rl.close();
+              resolve(answer.trim());
+            });
+          });
+
+          if (!token) {
+            console.log(chalk.gray('  No token provided. Cancelled.'));
+            return;
+          }
+
+          const purchaseRes = await fetch(`${baseUrl}/api/v1/marketplace/${ext.id}/purchase`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey },
+            body: JSON.stringify({ paymentToken: token }),
+            signal: AbortSignal.timeout(10000),
+          });
+          if (!purchaseRes.ok) {
+            const err = await purchaseRes.json().catch(() => ({}));
+            console.error(chalk.red(`Purchase failed: ${err.error || 'Unknown error'}`));
+            process.exitCode = 1;
+            return;
+          }
+          const purchaseData = await purchaseRes.json();
+          if (purchaseData.success && purchaseData.bundleUrl) {
+            console.log(chalk.cyan(`Installing ${name}...`));
+            const { installExtension } = await import('../core/extensions.js');
+            const result = await installExtension(purchaseData.bundleUrl);
+            console.log(chalk.green(`\u2714 Purchased and installed "${result.name}" v${result.version || ext.version}`));
+          } else if (purchaseData.success) {
+            console.log(chalk.green(`\u2714 Purchase confirmed. Install: pal ext install-remote ${name}`));
+          } else {
+            console.error(chalk.red(`Purchase failed: ${purchaseData.error || 'Unknown error'}`));
+            process.exitCode = 1;
+          }
+        } catch (err) {
+          console.error(chalk.red(`Buy failed: ${err.message}`));
+          process.exitCode = 1;
+        }
+      });
+
+    cmd
+      .command('earnings')
+      .description('show developer earnings from published extensions')
+      .action(async () => {
+        const { fetchFirst, getPrimaryServer } = await import('../core/discoveryClient.js');
+        const { getIdentity } = await import('../core/identity.js');
+        try {
+          const identity = await getIdentity();
+          if (!identity?.publicKey) {
+            console.error(chalk.red('No identity. Run pal init first.'));
+            process.exitCode = 1;
+            return;
+          }
+          const apiKey = await getApiKey();
+          if (!apiKey) {
+            console.error(chalk.red('No API key. Create one: pal api-keys create'));
+            process.exitCode = 1;
+            return;
+          }
+          const baseUrl = getPrimaryServer();
+          const res = await fetch(`${baseUrl}/api/v1/marketplace/earnings`, {
+            headers: { 'x-api-key': apiKey },
+            signal: AbortSignal.timeout(10000),
+          });
+          if (!res.ok) {
+            console.error(chalk.red('Failed to fetch earnings.'));
+            process.exitCode = 1;
+            return;
+          }
+          const data = await res.json();
+          console.log('');
+          console.log(chalk.cyan.bold('Developer Earnings'));
+          console.log(chalk.gray('\u2500'.repeat(40)));
+          console.log(`  Total Revenue:  ${chalk.white('$' + (data.totalRevenue || 0).toFixed(2))}`);
+          console.log(`  Available:      ${chalk.green('$' + (data.available || 0).toFixed(2))}`);
+          console.log(`  Paid Out:       ${chalk.gray('$' + (data.paidOut || 0).toFixed(2))}`);
+
+          if (data.recentSales?.length) {
+            console.log('');
+            console.log(chalk.cyan('Recent Sales:'));
+            for (const sale of data.recentSales) {
+              console.log(`  ${chalk.gray(new Date(sale.date).toLocaleDateString())} ${chalk.white(sale.extName)} $${sale.amount.toFixed(2)}`);
+            }
+          }
+
+          if (data.payouts?.length) {
+            console.log('');
+            console.log(chalk.cyan('Payout History:'));
+            for (const p of data.payouts) {
+              const statusColor = p.status === 'paid' ? chalk.green : p.status === 'pending' ? chalk.yellow : chalk.gray;
+              console.log(`  ${chalk.gray(new Date(p.date).toLocaleDateString())} $${p.amount.toFixed(2)} ${statusColor(p.status)} ${chalk.gray(p.email)}`);
+            }
+          }
+          console.log('');
+        } catch (err) {
+          console.error(chalk.red(`Earnings failed: ${err.message}`));
+          process.exitCode = 1;
+        }
+      });
+
+    cmd
+      .command('my-extensions')
+      .description('list your published extensions with stats')
+      .action(async () => {
+        const { fetchFirst, getPrimaryServer } = await import('../core/discoveryClient.js');
+        const { getIdentity } = await import('../core/identity.js');
+        try {
+          const identity = await getIdentity();
+          if (!identity?.publicKey) {
+            console.error(chalk.red('No identity. Run pal init first.'));
+            process.exitCode = 1;
+            return;
+          }
+          const apiKey = await getApiKey();
+          if (!apiKey) {
+            console.error(chalk.red('No API key. Create one: pal api-keys create'));
+            process.exitCode = 1;
+            return;
+          }
+          const baseUrl = getPrimaryServer();
+          const res = await fetch(`${baseUrl}/api/v1/marketplace/my-extensions`, {
+            headers: { 'x-api-key': apiKey },
+            signal: AbortSignal.timeout(10000),
+          });
+          if (!res.ok) {
+            console.error(chalk.red('Failed to fetch extensions.'));
+            process.exitCode = 1;
+            return;
+          }
+          const data = await res.json();
+          if (!data.extensions?.length) {
+            console.log(chalk.gray('No published extensions.'));
+            console.log(chalk.gray('  pal ext publish <path>'));
+            return;
+          }
+          console.log('');
+          console.log(chalk.cyan('My Published Extensions:'));
+          console.log(chalk.gray('\u2500'.repeat(60)));
+          for (const ext of data.extensions) {
+            const price = ext.price ? chalk.yellow(`$${ext.price.toFixed(2)}`) : chalk.green('Free');
+            const stars = '\u2605'.repeat(Math.round(ext.rating || 0)) + '\u2606'.repeat(5 - Math.round(ext.rating || 0));
+            console.log(`  ${chalk.white(ext.name)} v${ext.version} ${price}`);
+            console.log(`    ${chalk.yellow(stars)} (${ext.reviewCount || 0}) \u00b7 ${chalk.cyan(ext.downloads || 0)} downloads \u00b7 ${chalk.green(ext.purchases || 0)} purchases`);
+            console.log(`    Revenue: ${chalk.green('$' + (ext.revenue || 0).toFixed(2))}`);
+            console.log('');
+          }
+        } catch (err) {
+          console.error(chalk.red(`Failed: ${err.message}`));
+          process.exitCode = 1;
+        }
+      });
+
+    cmd
+      .command('create <name>')
+      .description('scaffold a new extension')
+      .action(async (extName) => {
+        const dir = path.resolve(extName);
+        const baseName = path.basename(dir);
+        if (fs.existsSync(dir)) {
+          console.log(chalk.red(`Directory "${extName}" already exists.`));
+          process.exitCode = 1;
+          return;
+        }
+
+        fs.mkdirSync(path.join(dir, 'docs'), { recursive: true });
+        fs.mkdirSync(path.join(dir, 'test'), { recursive: true });
+
+        const manifest = {
+          name: baseName,
+          version: '1.0.0',
+          description: `${baseName} extension for Palexplorer`,
+          author: '',
+          license: 'MIT',
+          main: 'index.js',
+          hooks: ['on:app:ready'],
+          permissions: ['config:read'],
+          config: {
+            enabled: { type: 'boolean', default: true, description: 'Enable this extension' },
+          },
+          help: {
+            summary: `${baseName} — brief description of what this extension does.`,
+            usage: `Enable: pal ext config ${baseName} enabled true`,
+            examples: [
+              `pal ext help ${baseName}`,
+              `pal ext config ${baseName} enabled true`,
+              `pal ext info ${baseName}`,
+            ],
+            configReference: {
+              enabled: 'Enable or disable this extension (true/false)',
+            },
+            links: {},
+          },
+          pro: false,
+          minAppVersion: '0.5.0',
+        };
+
+        fs.writeFileSync(
+          path.join(dir, 'extension.json'),
+          JSON.stringify(manifest, null, 2) + '\n'
+        );
+
+        fs.writeFileSync(path.join(dir, 'index.js'), `let ctx = null;
+
+export function activate(context) {
+  ctx = context;
+
+  context.hooks.on('on:app:ready', async () => {
+    context.logger.info('${baseName} ready');
+  });
+}
+
+export function deactivate() {
+  ctx = null;
+}
+`);
+
+        fs.writeFileSync(path.join(dir, 'test', `${baseName}.test.js`), `import { describe, it, beforeEach, mock } from 'node:test';
+import assert from 'node:assert/strict';
+
+function createMockContext(overrides = {}) {
+  return {
+    hooks: { on: mock.fn() },
+    config: { get: mock.fn(), set: mock.fn() },
+    store: { get: mock.fn(), set: mock.fn(), delete: mock.fn() },
+    logger: { info: mock.fn(), warn: mock.fn(), error: mock.fn() },
+    app: { version: '0.5.0', platform: 'linux', dataDir: '/tmp/test' },
+    ...overrides,
+  };
+}
+
+describe('${baseName}', () => {
+  let ext;
+  let ctx;
+
+  beforeEach(async () => {
+    ext = await import('../index.js');
+    ctx = createMockContext();
+  });
+
+  it('should activate and register hooks', () => {
+    ext.activate(ctx);
+    assert.ok(ctx.hooks.on.mock.calls.length > 0);
+  });
+
+  it('should deactivate cleanly', () => {
+    ext.activate(ctx);
+    ext.deactivate();
+  });
+});
+`);
+
+        fs.writeFileSync(path.join(dir, 'README.md'), `# ${baseName}
+
+Brief description of what this extension does.
+
+## Configuration
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| \`enabled\` | boolean | \`true\` | Enable this extension |
+
+\`\`\`bash
+pal ext config ${baseName} enabled true
+\`\`\`
+`);
+
+        fs.writeFileSync(path.join(dir, 'docs', 'PLAN.md'), `# ${baseName} — Plan
+
+## Goal
+
+What problem does this extension solve?
+
+## Design
+
+- How it hooks into core
+- Key decisions and trade-offs
+`);
+
+        fs.writeFileSync(path.join(dir, 'docs', 'MONETIZATION.md'), `# ${baseName} — Monetization
+
+## Tier
+
+- [ ] Free
+- [ ] Pro
+- [ ] Enterprise
+
+## Rationale
+
+Why this tier?
+`);
+
+        console.log(chalk.green(`✔ Scaffolded extension at ./${baseName}/`));
+        console.log(chalk.gray('  Files created:'));
+        console.log(chalk.gray('    extension.json'));
+        console.log(chalk.gray('    index.js'));
+        console.log(chalk.gray('    README.md'));
+        console.log(chalk.gray('    docs/PLAN.md'));
+        console.log(chalk.gray('    docs/MONETIZATION.md'));
+        console.log(chalk.gray(`    test/${baseName}.test.js`));
+        console.log('');
+        console.log(chalk.cyan('  Install it:'));
+        console.log(chalk.white(`    pal ext install ./${baseName}`));
+      });
+}
+
+async function listExtensions() {
+  const { getInstalledExtensions } = await import('../core/extensions.js');
+  const extensions = getInstalledExtensions();
+  if (extensions.length === 0) {
+    console.log(chalk.gray('No extensions installed.'));
+    console.log(chalk.gray('  pal ext install <path|git-url>'));
+    console.log(chalk.gray('  pal ext create <name>'));
+    return;
+  }
+
+  console.log('');
+  console.log(chalk.cyan('Extensions:'));
+  for (const ext of extensions) {
+    const name = ext.bundled ? chalk.blue(`@palexplorer/${ext.name}`) : chalk.white(ext.name);
+    const status = ext.enabled ? chalk.green('●') : chalk.red('○');
+    const version = chalk.gray(`v${ext.version}`);
+    const tier = ext.tier || (ext.pro ? 'pro' : 'free');
+    const tierBadge = tier === 'enterprise' ? chalk.magenta(' [Enterprise]')
+      : tier === 'pro' ? chalk.yellow(' [Pro]') : '';
+    console.log(`  ${status} ${name} ${version}${tierBadge}`);
+    if (ext.description) console.log(`    ${chalk.gray(ext.description)}`);
+  }
+}