diff --git a/extension/tests/session.test.mjs b/extension/tests/session.test.mjs
new file mode 100644
index 0000000..2d69237
--- /dev/null
+++ b/extension/tests/session.test.mjs
@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {VaultSession} from '../vault-session.mjs';
+import {updateState} from '../version.mjs';
+
+test('vault session fails closed and honors bounded policies', () => {
+  let now = 1000;
+  const session = new VaultSession(() => now);
+  const key = {extractable:false};
+  session.set(key, 'owner-a', '5');
+  assert.equal(session.get('owner-a'), key);
+  assert.equal(session.get('owner-b'), null);
+  session.set(key, 'owner-a', '5');
+  now += 5 * 60000;
+  assert.equal(session.get('owner-a'), null);
+  session.set(key, 'owner-a', 'close');
+  session.closed();
+  assert.equal(session.get('owner-a'), null);
+});
+
+test('version UI only says something when an update is actually available', () => {
+  assert.equal(updateState('0.4.4','0.4.4'),'');
+  assert.equal(updateState('0.4.5','0.4.4'),'');
+  assert.equal(updateState('0.4.4','0.4.5'),'Update available');
+  assert.equal(updateState('0.4.4','0.4.4.0'),'');
+  assert.equal(updateState('bogus','0.4.5'),'');
+});