browser/openspec/changes/implement-plugin-marketplace-api-driven-ui/tasks.md

1. Platform Marketplace Contracts

• 1.1 Add marketplace plugin summary/detail DTOs and domain projection contracts from registered plugin metadata.
• 1.2 Add validators for marketplace filters, plugin IDs, bounded list responses, supported state actions, and response safety.
• 1.3 Add service methods for marketplace list, detail, install-state projection, and enable/disable actions.

2. Platform Marketplace API

• 2.1 Implement marketplace list and detail routes under the platform API surface.
• 2.2 Implement safe install/enable/disable state action routes without package download or run execution.
• 2.3 Update platform route/protocol documentation for marketplace APIs and deferred package/runtime behavior.
• 2.4 Add platform service/API tests for filters, detail, state actions, missing plugins, unsupported actions, and no-secret responses.

3. Frontend Marketplace API Integration

• 3.1 Add centralized platform_web/api marketplace types and PlatformApiClient methods.
• 3.2 Update Plugin Marketplace page to load API data, support filters/search/detail, and render loading/error/empty/populated states.
• 3.3 Wire install/enable/disable controls to API actions and update page state from API responses.
• 3.4 Isolate any local fallback data to standalone development and keep production API flow authoritative.
• 3.5 Add frontend tests for loading, errors, filters, detail selection, state actions, and no raw key/path rendering.

4. Verification

• 4.1 Run cd platform && go test ./... and record evidence.
• 4.2 Run cd platform_web && npm run typecheck && npm test && npm run build and record evidence.
• 4.3 Run browser walkthrough for the Plugin Marketplace API-driven page and record evidence.
• 4.4 Run scripts/check-structure.sh and record evidence.
• 4.5 Run openspec validate implement-plugin-marketplace-api-driven-ui --strict and record evidence.

Evidence

• 2026-07-06: cd platform && go test ./domain ./dto ./validator ./service ./api passed after adding marketplace contracts, validators, service methods, and routes.
• 2026-07-06: cd platform && go test ./service ./api -run 'TestCoreServiceMarketplacePluginsAreFilteredSafeAndStateful|TestPluginMarketplaceAPIListsDetailsAndChangesStateSafely|TestGamePluginManifestRegistryAPI' passed, covering filters, detail, install/enable/disable state actions, missing plugins, unsupported actions, unsafe filters, and no-secret API response assertions.
• 2026-07-06: cd platform_web && npm run typecheck passed after adding marketplace API types/client methods and the API-driven Plugins page.
• 2026-07-06: cd platform_web && npm test -- --run api/client.test.ts pages/PluginsPage.test.tsx pages/ConsolePages.test.tsx passed, covering marketplace client URLs/actions, loading/error/API-backed detail rendering, standalone fallback labeling, state controls, and no raw key/path fragments.
• 2026-07-06: cd platform && go test ./... passed.
• 2026-07-06: cd platform_web && npm test passed with 10 files / 36 tests.
• 2026-07-06: cd platform_web && npm run typecheck passed.
• 2026-07-06: cd platform_web && npm run build passed.
• 2026-07-06: Browser walkthrough against http://127.0.0.1:5176/#/plugins and platform API 127.0.0.1:18089 rendered API-backed Example Server, logs.query, 平台 API, successfully applied the disable state action, and verified /Users/, unix://, Bearer , sk-, password=, apiKeyRef, rawApiKey, and billing were absent from visible text.
• 2026-07-06: scripts/check-structure.sh passed.
• 2026-07-06: openspec validate implement-plugin-marketplace-api-driven-ui --strict passed; PostHog telemetry flush logged a restricted-network DNS error after local validation succeeded.