test(marketplace): prove packaged client contract

scripts/lib/pi-product-artifact.mjs

@@ -33,6 +33,29 @@ const EXTENSION_CONTRACT_MARKERS = Object.freeze([
   'makelore.write-lease',
   'MAKELORE_PI_BRIDGE_URL',
 ]);
+const MARKETPLACE_ARTIFACT_MARKERS = Object.freeze({
+  packageTrust: Object.freeze([
+    'makelore-plugin-release.v1',
+    'skill_only',
+    'plugin_signature_invalid',
+    'signing key is not trusted',
+  ]),
+  mainRoutes: Object.freeze([
+    '/api/coding/plugin-marketplace',
+    'plugin-marketplace\\/install\\/',
+    'plugin-marketplace\\/update\\/',
+  ]),
+  effectiveSnapshot: Object.freeze([
+    'effectiveSkillIds',
+    'pluginReleaseIds',
+  ]),
+  renderer: Object.freeze([
+    '/api/coding/plugin-marketplace/catalog',
+    '/api/coding/plugin-marketplace/library',
+    '免费获取',
+    '我的插件',
+  ]),
+});
 const PI_AI_PROVIDER_PREFIX = 'pi-runtime/node_modules/@earendil-works/pi-ai/dist/providers/';
 const PI_AI_PROVIDER_ASAR_PREFIX = 'app.asar/node_modules/@earendil-works/pi-ai/dist/providers/';
 export const BUNDLED_CODING_PLUGIN_RESOURCE_ROOT = 'resources/coding-plugins';
@@ -264,6 +287,33 @@ export function collectForbiddenAsarPaths(appAsar, pattern = /opencode/i) {
   };
 }
 
+export function verifyMarketplaceClientArtifact(appAsarContents, productionTrustSource) {
+  const missing = Object.entries(MARKETPLACE_ARTIFACT_MARKERS).flatMap(([group, markers]) => (
+    markers
+      .filter((marker) => !appAsarContents.includes(Buffer.from(marker)))
+      .map((marker) => `${group}:${marker}`)
+  ));
+  if (missing.length > 0) {
+    throw new Error(`Packaged app.asar does not contain Marketplace contract markers: ${missing.join(', ')}`);
+  }
+  if (!/CODE_OWNED_PLUGIN_SIGNING_KEYS\s*=\s*Object\.freeze\(\s*\{\}\s+as/u.test(productionTrustSource)
+    || productionTrustSource.includes('process.env')
+    || productionTrustSource.includes('-----BEGIN PRIVATE KEY-----')
+    || productionTrustSource.includes('-----BEGIN ED25519 PRIVATE KEY-----')) {
+    throw new Error('Marketplace production trust source is not an empty code-owned fail-closed store');
+  }
+  return {
+    schema2SkillOnly: true,
+    productionTrust: 'official-key-absent-fail-closed',
+    libraryInstallAndEffectiveRoutes: true,
+    rendererAssets: true,
+    productionKeyIds: [],
+    privateKeyMaterialInTrustSource: false,
+    markers: MARKETPLACE_ARTIFACT_MARKERS,
+    result: 'pass',
+  };
+}
+
 async function filesContainingNeedles(root, needles) {
   const matches = [];
   const visit = async (path) => {
@@ -514,6 +564,10 @@ export async function verifyPiProductArtifact({ projectRoot, executable }) {
     throw new Error(`Pi runtime manifest contains absolute paths: ${JSON.stringify(absoluteManifestValues)}`);
   }
   const appAsarContents = await readFile(appAsar);
+  const marketplaceTrustSource = await readFile(
+    join(root, 'electron', 'coding-plugins', 'trusted-keys.ts'),
+    'utf8',
+  );
   const physicalOpenCodePaths = await collectForbiddenResourcePaths(resourcesDirectory);
   const asarOpenCodePaths = collectForbiddenAsarPaths(appAsar);
   const openCodeResourcePaths = classifyOpenCodeResourcePaths([
@@ -531,6 +585,7 @@ export async function verifyPiProductArtifact({ projectRoot, executable }) {
     resourcesDirectory,
     appAsarContents,
   });
+  const marketplace = verifyMarketplaceClientArtifact(appAsarContents, marketplaceTrustSource);
   const actualSkills = bundledPluginResources.coreResources.skills;
   const missingExtensionMarkers = EXTENSION_CONTRACT_MARKERS.filter(
     (marker) => !appAsarContents.includes(Buffer.from(marker)),
@@ -582,6 +637,7 @@ export async function verifyPiProductArtifact({ projectRoot, executable }) {
     },
     packagedClosure,
     bundledPlugins: bundledPluginResources,
+    marketplace,
     extension: {
       contractMarkers: EXTENSION_CONTRACT_MARKERS,
       packaged: true,