includes/API/Extensions.php (1)

44-54: Consider adding a schema definition for discoverability.

For completeness with WP REST API standards, you may want to add get_item_schema() and include 'schema' => array( $this, 'get_public_item_schema' ) in the route registration. This enables clients to discover the response structure via OPTIONS requests.

packages/settings/src/screens/plugins/extension-card.tsx (1)

62-73: Consider using extension.requires_pro to conditionally show the tooltip.

The current implementation always shows "Requires Pro to install" for non-installed extensions. Per the Extension interface, there's a requires_pro boolean field. You may want to differentiate the UX for extensions that don't require Pro (if any exist in the catalog).

💡 Suggested enhancement

 		case 'not_installed':
 		default:
+			if (extension.requires_pro) {
+				return (
+					<Tooltip text={t('extensions.requires_pro', 'Requires Pro to install')}>
+						<span>
+							<Button variant="secondary" disabled>
+								{t('extensions.install', 'Install')}
+							</Button>
+						</span>
+					</Tooltip>
+				);
+			}
 			return (
-				<Tooltip text={t('extensions.requires_pro', 'Requires Pro to install')}>
-					<span>
-						<Button variant="secondary" disabled>
-							{t('extensions.install', 'Install')}
-						</Button>
-					</span>
-				</Tooltip>
+				<Button variant="secondary" disabled>
+					{t('extensions.install', 'Install')}
+				</Button>
 			);
 	}

tests/includes/Services/Test_Extensions_Service.php (1)

118-166: Consider adding URL validation to the mock filter.

The current check strpos($url, 'catalog.json') is loose and could match unintended URLs. For more precise test isolation, consider matching the full expected URL or using a more specific pattern.

💡 Suggested improvement

 	public function mock_catalog_response( $response, $parsed_args, $url ) {
-		if ( false === strpos( $url, 'catalog.json' ) ) {
+		// Match the specific catalog URL to avoid false positives
+		if ( ! preg_match( '#wcpos/extensions/.*/catalog\.json$#', $url ) ) {
 			return $response;
 		}

includes/Services/Extensions.php (1)

90-101: Cache failed fetches briefly to avoid repeated remote calls.
Right now a remote outage can trigger a fetch on every request. Consider caching an empty result for a short TTL to reduce load while still honoring the “empty array on failure” behavior.

♻️ Suggested tweak

-		if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
-			return array();
-		}
+		if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
+			// Avoid hammering the remote catalog during outages.
+			set_transient( self::TRANSIENT_KEY, array(), 5 * MINUTE_IN_SECONDS );
+			return array();
+		}

packages/settings/src/screens/plugins/index.tsx (1)

79-103: Add accessible labeling/state for search and category tabs.
Inputs and toggle buttons need explicit accessible labels and pressed state.

♿ Suggested a11y tweaks

 				<input
 					type="text"
 					placeholder={t('extensions.search_placeholder', 'Search extensions...')}
+					aria-label={t('extensions.search_label', 'Search extensions')}
 					value={search}
 					onChange={(e) => setSearch(e.target.value)}
 					className="wcpos:block wcpos:w-full wcpos:rounded-md wcpos:border wcpos:border-gray-300 wcpos:px-3 wcpos:py-2 wcpos:text-sm focus:wcpos:outline-none focus:wcpos:ring-2 focus:wcpos:ring-wp-admin-theme-color"
 				/>

 					<button
 						key={cat}
+						type="button"
 						onClick={() => setCategory(cat)}
+						aria-pressed={category === cat}
 						className={`wcpos:px-3 wcpos:py-1 wcpos:rounded-full wcpos:text-sm wcpos:font-medium wcpos:transition-colors ${

tests/includes/API/Test_Extensions_Controller.php (2)

53-82: Ensure HTTP filters are removed even if assertions fail.
If an assertion fails before remove_filter, the mock can leak into subsequent tests. A try/finally (or teardown cleanup) keeps isolation intact.

♻️ Suggested pattern

-		add_filter( 'pre_http_request', array( $this, 'mock_catalog_response' ), 10, 3 );
-
-		$request  = $this->wp_rest_get_request( '/wcpos/v1/extensions' );
-		$response = $this->server->dispatch( $request );
-
-		$this->assertEquals( 200, $response->get_status() );
-
-		$data = $response->get_data();
-		$this->assertIsArray( $data );
-		$this->assertCount( 2, $data );
-		$this->assertEquals( 'wcpos-stripe-terminal', $data[0]['slug'] );
-		$this->assertArrayHasKey( 'status', $data[0] );
-
-		remove_filter( 'pre_http_request', array( $this, 'mock_catalog_response' ) );
+		add_filter( 'pre_http_request', array( $this, 'mock_catalog_response' ), 10, 3 );
+		try {
+			$request  = $this->wp_rest_get_request( '/wcpos/v1/extensions' );
+			$response = $this->server->dispatch( $request );
+
+			$this->assertEquals( 200, $response->get_status() );
+
+			$data = $response->get_data();
+			$this->assertIsArray( $data );
+			$this->assertCount( 2, $data );
+			$this->assertEquals( 'wcpos-stripe-terminal', $data[0]['slug'] );
+			$this->assertArrayHasKey( 'status', $data[0] );
+		} finally {
+			remove_filter( 'pre_http_request', array( $this, 'mock_catalog_response' ) );
+		}

---

123-126: Silence PHPMD unused-parameter warnings in mock callbacks.
PHPMD flags $parsed_args as unused; add suppressions to keep lint clean.

🔧 Suggested suppression

-	public function mock_catalog_response( $response, $parsed_args, $url ) {
+	/**
+	 * `@SuppressWarnings`(PHPMD.UnusedFormalParameter)
+	 */
+	public function mock_catalog_response( $response, $parsed_args, $url ) {

-	public function mock_catalog_failure( $response, $parsed_args, $url ) {
+	/**
+	 * `@SuppressWarnings`(PHPMD.UnusedFormalParameter)
+	 */
+	public function mock_catalog_failure( $response, $parsed_args, $url ) {

Also applies to: 182-185