superacli 1.1.5 → 1.1.7

package/__tests__/openhands-plugin.test.js

@@ -0,0 +1,106 @@
+const fs = require("fs")
+const os = require("os")
+const path = require("path")
+const { execSync } = require("child_process")
+
+const CLI = path.join(__dirname, "..", "cli", "supercli.js")
+
+function runNoServer(args, options = {}) {
+  try {
+    const env = { ...process.env }
+    delete env.SUPERCLI_SERVER
+    const out = execSync(`node ${CLI} ${args}`, {
+      encoding: "utf-8",
+      timeout: 15000,
+      env: { ...env, ...(options.env || {}) }
+    })
+    return { ok: true, output: out.trim(), code: 0 }
+  } catch (err) {
+    return {
+      ok: false,
+      output: (err.stdout || "").trim(),
+      stderr: (err.stderr || "").trim(),
+      code: err.status
+    }
+  }
+}
+
+function writeFakeOpenHandsBinary(dir) {
+  const bin = path.join(dir, "openhands")
+  fs.writeFileSync(bin, [
+    "#!/usr/bin/env node",
+    "const args = process.argv.slice(2);",
+    "if (args[0] === '--version') { console.log('openhands 0.42.0-test'); process.exit(0); }",
+    "if (args.includes('--headless') && args.includes('--json')) {",
+    "  console.log(JSON.stringify({ type: 'action', action: 'write' }));",
+    "  console.log(JSON.stringify({ type: 'observation', content: 'ok' }));",
+    "  process.exit(0);",
+    "}",
+    "if (args.includes('--headless') && args.includes('-t')) {",
+    "  const i = args.indexOf('-t');",
+    "  console.log(`ran:${args[i + 1] || ''}`);",
+    "  process.exit(0);",
+    "}",
+    "if (args.includes('--headless') && args.includes('-f')) {",
+    "  const i = args.indexOf('-f');",
+    "  console.log(`file:${args[i + 1] || ''}`);",
+    "  process.exit(0);",
+    "}",
+    "console.log(JSON.stringify({ ok: true, args }));"
+  ].join("\n"), "utf-8")
+  fs.chmodSync(bin, 0o755)
+  return bin
+}
+
+describe("openhands plugin", () => {
+  const fakeDir = fs.mkdtempSync(path.join(os.tmpdir(), "dcli-openhands-"))
+  const tempHome = fs.mkdtempSync(path.join(os.tmpdir(), "dcli-home-openhands-"))
+  writeFakeOpenHandsBinary(fakeDir)
+  const env = { ...process.env, PATH: `${fakeDir}:${process.env.PATH || ""}`, SUPERCLI_HOME: tempHome }
+
+  beforeAll(() => {
+    runNoServer("plugins install ./plugins/openhands --on-conflict replace --json", { env })
+  })
+
+  afterAll(() => {
+    runNoServer("plugins remove openhands --json", { env })
+    fs.rmSync(fakeDir, { recursive: true, force: true })
+    fs.rmSync(tempHome, { recursive: true, force: true })
+  })
+
+  test("routes version command", () => {
+    const r = runNoServer("openhands self version --json", { env })
+    expect(r.ok).toBe(true)
+    const data = JSON.parse(r.output)
+    expect(data.command).toBe("openhands.self.version")
+    expect(data.data.raw).toBe("openhands 0.42.0-test")
+  })
+
+  test("streams jsonl events for task json", () => {
+    const r = runNoServer("openhands task json --task \"Add tests\" --json", { env })
+    expect(r.ok).toBe(true)
+    const lines = r.output.split("\n").filter(Boolean).map(line => JSON.parse(line))
+    expect(lines[0].command).toBe("openhands.task.json")
+    expect(lines[0].data.type).toBe("action")
+    expect(lines[1].data.type).toBe("observation")
+    expect(lines[2].data.streamed).toBe(true)
+    expect(lines[2].data.event_count).toBe(2)
+  })
+
+  test("supports passthrough", () => {
+    const r = runNoServer("openhands --help --json", { env })
+    expect(r.ok).toBe(true)
+    const data = JSON.parse(r.output)
+    expect(data.command).toBe("openhands.passthrough")
+    const payload = JSON.parse(data.data.raw)
+    expect(payload.args).toContain("--help")
+  })
+
+  test("doctor reports openhands dependency as healthy", () => {
+    const r = runNoServer("plugins doctor openhands --json", { env })
+    expect(r.ok).toBe(true)
+    const data = JSON.parse(r.output)
+    expect(data.ok).toBe(true)
+    expect(data.checks.some(c => c.type === "binary" && c.binary === "openhands" && c.ok === true)).toBe(true)
+  })
+})

package/__tests__/plugin-cocoindex-code-uninstall.test.js

@@ -0,0 +1,19 @@
+const { removeProvider, syncCatalog } = require("../cli/skills-catalog")
+const { run } = require("../plugins/cocoindex-code/scripts/post-uninstall")
+
+jest.mock("../cli/skills-catalog")
+
+describe("plugin-cocoindex-code post-uninstall", () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    removeProvider.mockReturnValue(true)
+    syncCatalog.mockReturnValue({ skills: [1] })
+  })
+
+  test("removes provider and keeps MCP cleanup manual", async () => {
+    const result = await run()
+    expect(removeProvider).toHaveBeenCalledWith("cocoindex-code")
+    expect(result.removed_provider).toBe(true)
+    expect(result.note).toContain("supercli mcp remove cocoindex-code")
+  })
+})

package/__tests__/plugin-cocoindex-code.test.js

@@ -0,0 +1,37 @@
+const { addProvider, syncCatalog } = require("../cli/skills-catalog")
+const { setMcpServer, listMcpServers } = require("../cli/config")
+const { run, DEFAULT_SERVER } = require("../plugins/cocoindex-code/scripts/post-install")
+
+jest.mock("../cli/skills-catalog")
+jest.mock("../cli/config")
+
+describe("plugin-cocoindex-code", () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    listMcpServers.mockResolvedValue([])
+    setMcpServer.mockResolvedValue({})
+    syncCatalog.mockReturnValue({ skills: [1, 2, 3] })
+  })
+
+  test("run registers MCP server and adds local skill provider", async () => {
+    const result = await run()
+
+    expect(setMcpServer).toHaveBeenCalledWith("cocoindex-code", DEFAULT_SERVER)
+    expect(addProvider).toHaveBeenCalledWith(expect.objectContaining({
+      name: "cocoindex-code",
+      type: "local_fs",
+      roots: expect.any(Array),
+    }))
+    expect(result.server_created).toBe(true)
+    expect(result.bound_capabilities).toEqual(["cocoindex.code.search", "cocoindex.mcp.search", "cocoindex.index.build"])
+  })
+
+  test("run does not overwrite existing MCP server", async () => {
+    listMcpServers.mockResolvedValue([{ name: "cocoindex-code", command: "cocoindex-code" }])
+
+    const result = await run()
+
+    expect(setMcpServer).not.toHaveBeenCalled()
+    expect(result.server_created).toBe(false)
+  })
+})

package/__tests__/plugin-install-guidance.test.js

@@ -0,0 +1,81 @@
+const fs = require("fs")
+
+jest.mock("fs")
+jest.mock("../cli/plugins-store", () => ({
+  readPluginsLock: jest.fn(() => ({ installed: {} })),
+}))
+jest.mock("../cli/plugins-registry", () => ({
+  getRegistryPlugin: jest.fn(() => null),
+}))
+
+const { readPluginsLock } = require("../cli/plugins-store")
+const { getRegistryPlugin } = require("../cli/plugins-registry")
+const { getPluginInstallGuidance, normalizeInstallGuidance } = require("../cli/plugin-install-guidance")
+
+describe("plugin-install-guidance", () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    readPluginsLock.mockReturnValue({ installed: {} })
+    getRegistryPlugin.mockReturnValue(null)
+    fs.existsSync.mockReturnValue(false)
+  })
+
+  test("normalizes valid guidance object", () => {
+    const normalized = normalizeInstallGuidance({
+      binary: "docker",
+      check: "docker --version",
+      install_steps: ["docker --version"],
+      note: "ok",
+    }, "demo")
+    expect(normalized).toEqual({
+      plugin: "demo",
+      binary: "docker",
+      check: "docker --version",
+      install_steps: ["docker --version"],
+      note: "ok",
+    })
+  })
+
+  test("returns stored install guidance from installed lock", () => {
+    readPluginsLock.mockReturnValue({
+      installed: {
+        demo: {
+          name: "demo",
+          install_guidance: {
+            plugin: "demo",
+            binary: "demo",
+            check: "demo --version",
+            install_steps: ["demo --version"],
+            note: "stored",
+          }
+        }
+      }
+    })
+
+    const guidance = getPluginInstallGuidance("demo")
+    expect(guidance.note).toBe("stored")
+  })
+
+  test("reads guidance from bundled manifest when available", () => {
+    fs.existsSync.mockImplementation((p) => String(p).endsWith("plugins/shellx/plugin.json"))
+    fs.readFileSync.mockReturnValue(JSON.stringify({
+      name: "shellx",
+      commands: [],
+      install_guidance: {
+        binary: "shellx",
+        check: "shellx --version",
+        install_steps: ["shellx --version"],
+      }
+    }))
+
+    const guidance = getPluginInstallGuidance("shellx")
+    expect(guidance.binary).toBe("shellx")
+    expect(guidance.check).toBe("shellx --version")
+  })
+
+  test("falls back to legacy static guidance", () => {
+    const guidance = getPluginInstallGuidance("beads")
+    expect(guidance).not.toBeNull()
+    expect(guidance.plugin).toBe("beads")
+  })
+})

package/__tests__/plugins-registry.test.js

@@ -52,6 +52,7 @@ describe("plugins-registry", () => {
     beforeEach(() => {
       fs.existsSync.mockReturnValue(true)
       fs.readFileSync.mockReturnValue(JSON.stringify(mockRegistry))
+      fs.readdirSync.mockReturnValue([])
     })
 
     test("returns all plugins normalized", () => {
@@ -90,6 +91,49 @@ describe("plugins-registry", () => {
       const list = listRegistryPlugins({ name: "nomatch" })
       expect(list).toHaveLength(0)
     })
+
+    test("includes auto-discovered bundled plugin not in registry file", () => {
+      fs.readdirSync.mockReturnValue([
+        { name: "autop", isDirectory: () => true }
+      ])
+      fs.existsSync.mockImplementation((p) => (
+        String(p).includes("plugins/autop/plugin.json") ||
+        String(p).endsWith("plugins.json") ||
+        /[\\/]plugins$/.test(String(p))
+      ))
+      fs.readFileSync.mockImplementation((p) => {
+        if (String(p).endsWith("plugins.json")) return JSON.stringify({ version: 1, plugins: [] })
+        return JSON.stringify({ name: "autop", description: "auto", commands: [], learn: { file: "skills/quickstart/SKILL.md" } })
+      })
+
+      const list = listRegistryPlugins({ name: "autop" })
+      expect(list).toHaveLength(1)
+      expect(list[0].name).toBe("autop")
+      expect(list[0].has_learn).toBe(true)
+      expect(list[0].source).toEqual({ type: "bundled", manifest_path: "plugins/autop/plugin.json" })
+    })
+
+    test("registry entry overrides discovered metadata by name", () => {
+      fs.readdirSync.mockReturnValue([{ name: "p1", isDirectory: () => true }])
+      fs.existsSync.mockImplementation((p) => (
+        String(p).includes("plugins/p1/plugin.json") ||
+        String(p).endsWith("plugins.json") ||
+        /[\\/]plugins$/.test(String(p))
+      ))
+      fs.readFileSync.mockImplementation((p) => {
+        if (String(p).endsWith("plugins.json")) {
+          return JSON.stringify({
+            version: 1,
+            plugins: [{ name: "p1", description: "registry-desc", tags: ["registry"] }],
+          })
+        }
+        return JSON.stringify({ name: "p1", description: "discovered-desc", commands: [] })
+      })
+
+      const plugin = getRegistryPlugin("p1")
+      expect(plugin.description).toBe("registry-desc")
+      expect(plugin.tags).toEqual(["registry"])
+    })
   })
 
   describe("getRegistryPlugin", () => {

package/__tests__/plugins-store.test.js

@@ -7,17 +7,21 @@ jest.mock("os", () => ({
 }))
 
 const {
+  SUPERCLI_PLUGINS_DIR,
+  SUPERCLI_LOCAL_LOCK_FILE,
+  LEGACY_PLUGINS_FILE,
   readPluginsLock,
   writePluginsLock,
   listInstalledPlugins,
-  getInstalledPluginCommands
+  getInstalledPluginCommands,
+  getEffectivePluginCommands,
 } = require("../cli/plugins-store")
 const path = require("path")
 
 describe("plugins-store", () => {
   const mockHomedir = "/home/user"
-  const dcliDir = path.join(mockHomedir, ".dcli")
-  const pluginsFile = path.join(dcliDir, "plugins.lock.json")
+  const pluginsDir = path.join(mockHomedir, ".supercli", "plugins")
+  const pluginsFile = path.join(pluginsDir, "plugins.lock.json")
 
   beforeEach(() => {
     jest.clearAllMocks()
@@ -32,13 +36,27 @@ describe("plugins-store", () => {
     })
 
     test("returns parsed lock if file exists", () => {
-      fs.existsSync.mockReturnValue(true)
+      fs.existsSync.mockImplementation((target) => target === pluginsFile)
       const mockLock = { version: 1, installed: { p1: { name: "p1" } } }
       fs.readFileSync.mockReturnValue(JSON.stringify(mockLock))
       const lock = readPluginsLock()
       expect(lock).toEqual(mockLock)
     })
 
+    test("migrates legacy lock when new lock missing", () => {
+      fs.existsSync.mockImplementation((target) => target === LEGACY_PLUGINS_FILE)
+      const mockLock = { version: 1, installed: { p1: { name: "p1" } } }
+      fs.readFileSync.mockReturnValue(JSON.stringify(mockLock))
+
+      const lock = readPluginsLock()
+
+      expect(lock).toEqual(mockLock)
+      expect(fs.writeFileSync).toHaveBeenCalledWith(
+        SUPERCLI_LOCAL_LOCK_FILE,
+        expect.stringContaining('"version": 1'),
+      )
+    })
+
     test("returns empty lock if file is invalid JSON", () => {
       fs.existsSync.mockReturnValue(true)
       fs.readFileSync.mockReturnValue("invalid-json")
@@ -66,7 +84,7 @@ describe("plugins-store", () => {
       fs.existsSync.mockReturnValue(false)
       const lock = { version: 1, installed: {} }
       writePluginsLock(lock)
-      expect(fs.mkdirSync).toHaveBeenCalledWith(dcliDir, { recursive: true })
+      expect(fs.mkdirSync).toHaveBeenCalledWith(SUPERCLI_PLUGINS_DIR, { recursive: true })
       expect(fs.writeFileSync).toHaveBeenCalledWith(
         pluginsFile,
         expect.stringContaining('"version": 1')
@@ -112,4 +130,21 @@ describe("plugins-store", () => {
       expect(commands).toEqual([])
     })
   })
+
+  describe("getEffectivePluginCommands", () => {
+    test("local plugins shadow server plugins by name", () => {
+      fs.existsSync.mockImplementation((target) =>
+        target === SUPERCLI_LOCAL_LOCK_FILE || target.endsWith("server.lock.json"),
+      )
+      fs.readFileSync.mockImplementation((target) => {
+        if (target.endsWith("plugins.lock.json")) {
+          return JSON.stringify({ installed: { alpha: { name: "alpha", commands: [{ id: "local" }] } } })
+        }
+        return JSON.stringify({ installed: { alpha: { name: "alpha", commands: [{ id: "server-shadowed" }] }, beta: { name: "beta", commands: [{ id: "server" }] } } })
+      })
+
+      const commands = getEffectivePluginCommands()
+      expect(commands).toEqual([{ id: "local" }, { id: "server" }])
+    })
+  })
 })

package/__tests__/process-adapter.test.js

@@ -71,7 +71,36 @@ describe("process adapter", () => {
     const promise = execute({ adapterConfig: { command: "node" } }, {})
     mockChild.stderr.emit("data", "error")
     mockChild.emit("close", 1)
-    await expect(promise).rejects.toThrow("Process adapter failed")
+    await expect(promise).rejects.toThrow("error")
+  })
+
+  test("rewrites matched integration errors with friendlier guidance", async () => {
+    const promise = execute({
+      adapterConfig: {
+        command: "node",
+        errorMatchers: [
+          {
+            match: "No provider configured",
+            message: "Goose is installed but not configured with a provider. Escalate to a human to run `goose configure`.",
+            suggestions: [
+              "Ask a human to run `goose configure` and set a provider.",
+              "Retry after Goose provider setup is complete."
+            ],
+            recoverable: true
+          }
+        ]
+      }
+    }, {})
+    mockChild.stderr.emit("data", JSON.stringify({ error: { message: "No provider configured. Run 'goose configure' first" } }))
+    mockChild.emit("close", 1)
+    await expect(promise).rejects.toMatchObject({
+      message: "Goose is installed but not configured with a provider. Escalate to a human to run `goose configure`.",
+      suggestions: [
+        "Ask a human to run `goose configure` and set a provider.",
+        "Retry after Goose provider setup is complete."
+      ],
+      recoverable: true
+    })
   })
   
   test("handles passthroughInteractive", async () => {
@@ -114,6 +143,26 @@ describe("process adapter", () => {
     expect(result.raw).toBe("text")
   })
 
+  test("uses invoke cwd when configured", async () => {
+    const promise = execute({
+      adapterConfig: { command: "node", cwd: "invoke_cwd" },
+      plugin_dir: "/tmp/plugin-dir"
+    }, {})
+    mockChild.emit("close", 0)
+    await promise
+    expect(spawn).toHaveBeenCalledWith("node", [], expect.objectContaining({ cwd: process.cwd() }))
+  })
+
+  test("defaults cwd to plugin dir when not configured", async () => {
+    const promise = execute({
+      adapterConfig: { command: "node" },
+      plugin_dir: "/tmp/plugin-dir"
+    }, {})
+    mockChild.emit("close", 0)
+    await promise
+    expect(spawn).toHaveBeenCalledWith("node", [], expect.objectContaining({ cwd: "/tmp/plugin-dir" }))
+  })
+
   test("streams jsonl events incrementally", async () => {
     const onStreamEvent = jest.fn()
     const promise = execute({ adapterConfig: { command: "node", stream: "jsonl" } }, {}, { onStreamEvent })

package/__tests__/resend-plugin.test.js

@@ -4,6 +4,7 @@ const path = require("path")
 const { execSync } = require("child_process")
 
 const CLI = path.join(__dirname, "..", "cli", "supercli.js")
+const nodeDir = path.dirname(process.execPath)
 
 function runNoServer(args, options = {}) {
   try {
@@ -83,13 +84,33 @@ describe("resend hybrid plugin", () => {
   })
 
   test("fails with helpful message when resend binary is missing", () => {
-    const r = runNoServer("resend cli doctor --json", { env })
+    // Ensure 'resend' is not found, but keep 'node' available
+    const r = runNoServer("resend cli doctor --json", { 
+        env: { ...env, PATH: `${fakeBinDir}:${nodeDir}` } 
+    })
     expect(r.ok).toBe(false)
     const data = JSON.parse(r.output || r.stderr)
     expect(data.error.message).toContain("Missing dependency 'resend'")
     expect(data.error.message).toContain("Please run 'dcli resend cli setup'")
   })
 
+  test("exposes expanded structured commands", () => {
+    const help = runNoServer("help resend --json", { env })
+    expect(help.ok).toBe(true)
+    const data = JSON.parse(help.output)
+    
+    const resendNamespace = data.namespaces.find(n => n.name === "resend")
+    expect(resendNamespace).toBeDefined()
+
+    const resources = new Set(resendNamespace.resources.map(r => r.name))
+    
+    expect(resources.has("domains")).toBe(true)
+    expect(resources.has("api-keys")).toBe(true)
+    expect(resources.has("webhooks")).toBe(true)
+    expect(resources.has("contacts")).toBe(true)
+    expect(resources.has("auth")).toBe(true)
+  })
+
   test("doctor reports node and npm dependencies as healthy", () => {
     const r = runNoServer("plugins doctor resend --json", { env })
     expect(r.ok).toBe(true)

package/__tests__/server-app.test.js

@@ -29,6 +29,7 @@ jest.mock("express", () => {
   mExpress.Router = jest.fn(() => ({
     get: jest.fn(),
     post: jest.fn(),
+    patch: jest.fn(),
     put: jest.fn(),
     delete: jest.fn(),
     use: jest.fn(),

package/__tests__/server-routes-commands.test.js

@@ -39,12 +39,30 @@ describe("server routes - commands", () => {
   })
 
   test("POST / success", async () => {
-    await getHandler(commandsRouter, "post", "/")({ body: { namespace: "n", resource: "r", action: "a" }, headers: {} }, res)
+    await getHandler(commandsRouter, "post", "/")({
+      body: {
+        namespace: "n",
+        resource: "r",
+        action: "a",
+        adapter: "http",
+        adapterConfig: { url: "https://example.com" },
+      },
+      headers: {},
+    }, res)
     expect(res.status).toHaveBeenCalledWith(201)
   })
 
   test("PUT / success", async () => {
-    await getHandler(commandsRouter, "put", "/:id")({ params: { id: "old" }, body: { namespace: "n", resource: "r", action: "a" } }, res)
+    await getHandler(commandsRouter, "put", "/:id")({
+      params: { id: "old" },
+      body: {
+        namespace: "n",
+        resource: "r",
+        action: "a",
+        adapter: "http",
+        adapterConfig: { url: "https://example.com" },
+      },
+    }, res)
     expect(res.json).toHaveBeenCalledWith({ ok: true })
   })
 

package/__tests__/server-routes-plugins.test.js

@@ -0,0 +1,130 @@
+const { EventEmitter } = require("events")
+const pluginsRouter = require("../server/routes/plugins")
+const pluginsService = require("../server/services/pluginsService")
+
+jest.mock("../server/services/pluginsService")
+
+function getHandler(router, method, path) {
+  const route = router.stack.find(s => s.route && s.route.path === path && s.route.methods[method])
+  return route ? route.route.stack[0].handle : null
+}
+
+function multipartReq(fields, file) {
+  const boundary = "----supercli-boundary"
+  const chunks = []
+
+  for (const [name, value] of Object.entries(fields)) {
+    chunks.push(Buffer.from(`--${boundary}\r\n`))
+    chunks.push(Buffer.from(`Content-Disposition: form-data; name="${name}"\r\n\r\n`))
+    chunks.push(Buffer.from(String(value)))
+    chunks.push(Buffer.from("\r\n"))
+  }
+
+  chunks.push(Buffer.from(`--${boundary}\r\n`))
+  chunks.push(Buffer.from("Content-Disposition: form-data; name=\"archive\"; filename=\"plugin.zip\"\r\n"))
+  chunks.push(Buffer.from("Content-Type: application/zip\r\n\r\n"))
+  chunks.push(file)
+  chunks.push(Buffer.from("\r\n"))
+  chunks.push(Buffer.from(`--${boundary}--\r\n`))
+
+  const req = new EventEmitter()
+  req.headers = {
+    "content-type": `multipart/form-data; boundary=${boundary}`,
+  }
+  req.body = undefined
+  req._bodyBuffer = Buffer.concat(chunks)
+  return req
+}
+
+describe("server routes - plugins", () => {
+  let res
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    res = {
+      json: jest.fn().mockReturnThis(),
+      status: jest.fn().mockReturnThis(),
+      render: jest.fn().mockReturnThis(),
+      setHeader: jest.fn().mockReturnThis(),
+      send: jest.fn().mockReturnThis(),
+    }
+  })
+
+  test("GET / returns plugins and settings", async () => {
+    pluginsService.listServerPlugins.mockResolvedValue([{ name: "resend" }])
+    pluginsService.getSettings.mockResolvedValue({ max_zip_mb: 10, default_hooks_policy: "deny" })
+
+    await getHandler(pluginsRouter, "get", "/")({ query: { format: "json" }, headers: {} }, res)
+
+    expect(res.json).toHaveBeenCalledWith(expect.objectContaining({
+      plugins: [{ name: "resend" }],
+      settings: expect.any(Object),
+    }))
+  })
+
+  test("POST / uses JSON plugin upsert by default", async () => {
+    pluginsService.upsertJsonPlugin.mockResolvedValue({ name: "demo" })
+
+    await getHandler(pluginsRouter, "post", "/")({ body: { name: "demo", manifest: { name: "demo", commands: [] } } }, res)
+
+    expect(pluginsService.upsertJsonPlugin).toHaveBeenCalled()
+    expect(res.status).toHaveBeenCalledWith(201)
+  })
+
+  test("POST /upload parses multipart payload and calls zip upsert", async () => {
+    pluginsService.upsertZipPlugin.mockResolvedValue({ name: "zip-demo" })
+
+    const req = multipartReq(
+      {
+        name: "zip-demo",
+        version: "1.0.0",
+        enabled: "true",
+        hooks_policy: "inherit",
+        manifest: JSON.stringify({ name: "zip-demo", commands: [] }),
+      },
+      Buffer.from([0x50, 0x4b, 0x03, 0x04, 0x00]),
+    )
+
+    const run = getHandler(pluginsRouter, "post", "/upload")(req, res)
+    req.emit("data", req._bodyBuffer)
+    req.emit("end")
+    await run
+
+    expect(pluginsService.upsertZipPlugin).toHaveBeenCalledWith(expect.objectContaining({
+      name: "zip-demo",
+      source_type: "zip",
+      archive_buffer: expect.any(Buffer),
+      manifest: expect.objectContaining({ name: "zip-demo" }),
+    }))
+    expect(res.status).toHaveBeenCalledWith(201)
+  })
+
+  test("PATCH /:name updates metadata", async () => {
+    pluginsService.updatePluginMetadata.mockResolvedValue({ name: "demo", enabled: false })
+
+    await getHandler(pluginsRouter, "patch", "/:name")({ params: { name: "demo" }, body: { enabled: false } }, res)
+
+    expect(pluginsService.updatePluginMetadata).toHaveBeenCalledWith("demo", { enabled: false })
+    expect(res.json).toHaveBeenCalledWith({ ok: true, plugin: { name: "demo", enabled: false } })
+  })
+
+  test("GET /:name/archive sends zip buffer", async () => {
+    pluginsService.getPluginArchiveBuffer.mockResolvedValue(Buffer.from([0x50, 0x4b]))
+
+    await getHandler(pluginsRouter, "get", "/:name/archive")({ params: { name: "demo" } }, res)
+
+    expect(res.setHeader).toHaveBeenCalledWith("Content-Type", "application/zip")
+    expect(res.send).toHaveBeenCalledWith(expect.any(Buffer))
+  })
+
+  test("returns 400 for invalid service input errors", async () => {
+    pluginsService.upsertJsonPlugin.mockRejectedValue(
+      Object.assign(new Error("bad payload"), { code: 85, type: "invalid_argument" }),
+    )
+
+    await getHandler(pluginsRouter, "post", "/")({ body: { source_type: "json" } }, res)
+
+    expect(res.status).toHaveBeenCalledWith(400)
+    expect(res.json).toHaveBeenCalledWith(expect.objectContaining({ error: "bad payload" }))
+  })
+})