fix: prefer .js over .ts when loading plugins for npm compatibility (#10)

- Add resolvePluginSource() helper (prefers .ts in dev, .js under node_modules)
- Fix schema extraction to prefer .ts source for Rust parser
- Fix fast-path plugin enable to call loadSource() before enabling
- Root cause: schema extraction failed on compiled .js, config keys
  unrecognised, allowedDomains never set

Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>

Author: simongdavies

src/agent/slash-commands.ts

@@ -1207,6 +1207,17 @@ export async function handleSlashCommand(
               break;
             }
 
+            // Load source before enabling — syncPluginsToSandbox needs
+            // plugin.source for verifySourceHash(). Without this, the
+            // hash check fails and the plugin is silently disabled.
+            if (!pluginManager.loadSource(pluginName)) {
+              console.log(
+                `  ${C.err("❌ Failed to load source for")} "${pluginName}". Plugin will not be enabled.`,
+              );
+              console.log();
+              break;
+            }
+
             pluginManager.enable(pluginName);
             console.log(
               `  ✅ Plugin "${pluginName}" enabled (approved fast-path).`,

src/plugin-system/manager.ts

@@ -718,10 +718,27 @@ export function createPluginManager(pluginsDir: string) {
     const plugin = plugins.get(name);
     if (!plugin) return false;
 
-    // Load source if not already loaded
+    // For schema extraction, prefer .ts source — it's the canonical
+    // schema definition and the Rust parser handles it best. Under
+    // node_modules, only .js exists so we fall back gracefully.
+    // try/catch guards against TOCTOU (file deleted between exists check and read).
+    const tsPath = join(plugin.dir, "index.ts");
+    let extractionSource: string | null = null;
+    if (existsSync(tsPath)) {
+      try {
+        extractionSource = readFileSync(tsPath, "utf8");
+      } catch {
+        // Fall through to plugin.source / loadSource
+      }
+    }
+    if (!extractionSource) {
+      extractionSource = plugin.source ?? loadSource(name);
+    }
+    if (!extractionSource) return false;
+
+    // Also ensure plugin.source is loaded for hash verification
     if (!plugin.source) {
-      const source = loadSource(name);
-      if (!source) return false;
+      if (!loadSource(name)) return false;
     }
 
     // If analysis guest is not enabled, fall back to manifest.
@@ -735,7 +752,7 @@ export function createPluginManager(pluginsDir: string) {
     }
 
     try {
-      const metadata = await extractPluginMetadata(plugin.source!);
+      const metadata = await extractPluginMetadata(extractionSource);
 
       // Use extracted schema or fall back to manifest
       if (metadata.schema) {