fix: complete marketplace client remediation

tests/unit/pi-product-artifact.test.ts

@@ -236,6 +236,7 @@ describe('final Pi product artifact verification', () => {
     roots.push(root);
     const source = path.join(root, 'source');
     await mkdir(path.join(source, 'dist-electron'), { recursive: true });
+    await writeFile(path.join(source, 'package.json'), JSON.stringify({ main: 'dist-electron/main.js' }));
     await writeFile(path.join(source, 'dist-electron', 'main.js'), [
       'const CODE_OWNED_PLUGIN_SIGNING_KEYS = Object.freeze({});',
       'const unrelatedConfiguration = process.env.NIANCODE_E2E;',
@@ -253,6 +254,7 @@ describe('final Pi product artifact verification', () => {
     roots.push(root);
     const source = path.join(root, 'source');
     await mkdir(path.join(source, 'dist-electron'), { recursive: true });
+    await writeFile(path.join(source, 'package.json'), JSON.stringify({ main: 'dist-electron/main.js' }));
     await writeFile(path.join(source, 'dist-electron', 'main.js'), [
       'const dC = Object.freeze({});',
       'function createTrust() { return Object.freeze({ get: load, sourceMarker: "makelore.plugin-trust.code-owned.v1" }); }',
@@ -275,6 +277,22 @@ describe('final Pi product artifact verification', () => {
     )).toMatchObject({ productionTrust: 'official-key-absent-fail-closed' });
   });
 
+  it('does not accept a stale unreachable trust marker outside package.json.main reachability', async () => {
+    const root = await mkdtemp(path.join(tmpdir(), 'makelore-marketplace-stale-trust-asar-'));
+    roots.push(root);
+    const source = path.join(root, 'source');
+    await mkdir(path.join(source, 'dist-electron'), { recursive: true });
+    await writeFile(path.join(source, 'package.json'), JSON.stringify({ main: 'dist-electron/main.js' }));
+    await writeFile(path.join(source, 'dist-electron', 'main.js'), 'export const app = true;');
+    await writeFile(path.join(source, 'dist-electron', 'stale-trusted-keys.js'), [
+      'const CODE_OWNED_PLUGIN_SIGNING_KEYS = Object.freeze({});',
+      'export const sourceMarker = "makelore.plugin-trust.code-owned.v1";',
+    ].join('\n'));
+    const appAsar = path.join(root, 'app.asar');
+    await createPackage(source, appAsar);
+    await expect(readPackagedMarketplaceTrustSource(appAsar)).rejects.toThrow('trust source');
+  });
+
   it('rejects a packaged plugin tree that drops an SDK asset or catalog marker', async () => {
     const fixture = await bundledResourceFixture();
     await rm(path.join(