## 1. Platform Marketplace Contracts

- [x] 1.1 Add marketplace plugin summary/detail DTOs and domain projection contracts from registered plugin metadata.
- [x] 1.2 Add validators for marketplace filters, plugin IDs, bounded list responses, supported state actions, and response safety.
- [x] 1.3 Add service methods for marketplace list, detail, install-state projection, and enable/disable actions.

## 2. Platform Marketplace API

- [x] 2.1 Implement marketplace list and detail routes under the platform API surface.
- [x] 2.2 Implement safe install/enable/disable state action routes without package download or run execution.
- [x] 2.3 Update platform route/protocol documentation for marketplace APIs and deferred package/runtime behavior.
- [x] 2.4 Add platform service/API tests for filters, detail, state actions, missing plugins, unsupported actions, and no-secret responses.

## 3. Frontend Marketplace API Integration

- [x] 3.1 Add centralized `platform_web/api` marketplace types and `PlatformApiClient` methods.
- [x] 3.2 Update Plugin Marketplace page to load API data, support filters/search/detail, and render loading/error/empty/populated states.
- [x] 3.3 Wire install/enable/disable controls to API actions and update page state from API responses.
- [x] 3.4 Isolate any local fallback data to standalone development and keep production API flow authoritative.
- [x] 3.5 Add frontend tests for loading, errors, filters, detail selection, state actions, and no raw key/path rendering.

## 4. Verification

- [x] 4.1 Run `cd platform && go test ./...` and record evidence.
- [x] 4.2 Run `cd platform_web && npm run typecheck && npm test && npm run build` and record evidence.
- [x] 4.3 Run browser walkthrough for the Plugin Marketplace API-driven page and record evidence.
- [x] 4.4 Run `scripts/check-structure.sh` and record evidence.
- [x] 4.5 Run `openspec validate implement-plugin-marketplace-api-driven-ui --strict` and record evidence.

## Evidence

- 2026-07-06: `cd platform && go test ./domain ./dto ./validator ./service ./api` passed after adding marketplace contracts, validators, service methods, and routes.
- 2026-07-06: `cd platform && go test ./service ./api -run 'TestCoreServiceMarketplacePluginsAreFilteredSafeAndStateful|TestPluginMarketplaceAPIListsDetailsAndChangesStateSafely|TestGamePluginManifestRegistryAPI'` passed, covering filters, detail, install/enable/disable state actions, missing plugins, unsupported actions, unsafe filters, and no-secret API response assertions.
- 2026-07-06: `cd platform_web && npm run typecheck` passed after adding marketplace API types/client methods and the API-driven Plugins page.
- 2026-07-06: `cd platform_web && npm test -- --run api/client.test.ts pages/PluginsPage.test.tsx pages/ConsolePages.test.tsx` passed, covering marketplace client URLs/actions, loading/error/API-backed detail rendering, standalone fallback labeling, state controls, and no raw key/path fragments.
- 2026-07-06: `cd platform && go test ./...` passed.
- 2026-07-06: `cd platform_web && npm test` passed with 10 files / 36 tests.
- 2026-07-06: `cd platform_web && npm run typecheck` passed.
- 2026-07-06: `cd platform_web && npm run build` passed.
- 2026-07-06: Browser walkthrough against `http://127.0.0.1:5176/#/plugins` and platform API `127.0.0.1:18089` rendered API-backed `Example Server`, `logs.query`, `平台 API`, successfully applied the disable state action, and verified `/Users/`, `unix://`, `Bearer `, `sk-`, `password=`, `apiKeyRef`, `rawApiKey`, and `billing` were absent from visible text.
- 2026-07-06: `scripts/check-structure.sh` passed.
- 2026-07-06: `openspec validate implement-plugin-marketplace-api-driven-ui --strict` passed; PostHog telemetry flush logged a restricted-network DNS error after local validation succeeded.