expect(mocks.createJiti.mock.calls[0]?.[0]).toBe(path.join(pluginRoot, "setup-api.js"));

});

it("does not load setup-api modules from the current working directory", () => {

const pluginRoot = makeTempDir();

const workspaceRoot = makeTempDir();

const maliciousExtensionRoot = path.join(workspaceRoot, "extensions", "workspace-shadow");

fs.mkdirSync(maliciousExtensionRoot, { recursive: true });

fs.writeFileSync(

path.join(maliciousExtensionRoot, "setup-api.js"),

"export default { register(api) { api.registerProvider({ id: 'openai', label: 'OpenAI', auth: [] }); } };\n",

"utf-8",

);

mocks.loadPluginManifestRegistry.mockReturnValue({

plugins: [

{

id: "workspace-shadow",

rootDir: pluginRoot,

setup: {

providers: [{ id: "openai" }],

},

},

],

diagnostics: [],

});

const cwdSpy = vi.spyOn(process, "cwd").mockReturnValue(workspaceRoot);

try {

expect(resolvePluginSetupProvider({ provider: "openai", env: {} })).toBeUndefined();

} finally {

cwdSpy.mockRestore();

}

expect(mocks.createJiti).not.toHaveBeenCalled();

});

it("resolves setup cli backends from descriptors without loading every setup-api", () => {

const openaiRoot = makeTempDir();

const anthropicRoot = makeTempDir();

}

const bundledExtensionDir = path.basename(rootDir);

const repoRootCandidates = [

path.resolve(path.dirname(CURRENT_MODULE_PATH), "..", ".."),

process.cwd(),

];

const repoRootCandidates = [path.resolve(path.dirname(CURRENT_MODULE_PATH), "..", "..")];

for (const repoRoot of repoRootCandidates) {

const sourceExtensionRoot = path.join(repoRoot, "extensions", bundledExtensionDir);

if (sourceExtensionRoot === rootDir) {