# Task: Review updated local plugin integration

## Identity

- Task ID: 20260831-review-local-update-5b8c21
- Mode: Feature
- Branch: main
- Worktree: /Users/inmanx/Documents/makelore
- Base commit: 38f85f6b5e4dc4e2c5e5b9f8f4506554cfd578f5
- Owner: codex
- Status: Ready for Integration

## Scope

- Inspect the locally merged Marketplace client, Package Store, effective Plugin
  resolver, Pi Agent Server, extension host, and Provider projection.
- Reassess whether the existing plugin-management lifecycle can carry
  `pi-web-search` without adding a second management subsystem.
- Make no product-source or dependency changes.

## Intent And Constraints

- Treat the current `main` source as authoritative over the earlier isolated
  network/search assessments, whose base predates the local Marketplace and
  shared-Agent-Server merge.
- Preserve Electron Main ownership of package trust, Provider credentials,
  proxy behavior, runtime authorization, and packaged closure.
- Distinguish a Marketplace Skill package from executable Pi extension code.

## Outcome

- Confirmed that the local merge now has an end-to-end Main-owned Marketplace
  lifecycle: catalog/library client, signed immutable Package Store, project
  enablement, Agent Skill assignment, effective snapshot, and worker resource
  materialization. A second plugin-management subsystem is unnecessary.
- Confirmed that Release A artifact installation is deliberately limited to
  `skill_only`: installed records and trusted metadata force that runtime kind,
  archives accept only manifests plus static Skill text/image assets, and
  executable/script components are rejected.
- Confirmed that the shared Pi Agent Server disables ambient extension discovery
  and requires exactly one code-owned Makelore extension factory per logical
  thread. Therefore `pi install npm:pi-web-search` or an unchanged Marketplace
  artifact cannot currently activate `pi-web-search`.
- Confirmed that `pi-web-search` 1.3.1 is a third-party executable TypeScript Pi
  extension listed on pi.dev. It supports Google Generative AI, OpenAI Responses,
  OpenAI Codex Responses, and Anthropic Messages; the default Works-imported
  account remains projected as `openai-completions`, so that default path would
  be rejected by the extension even after loading.
- Recommended reusing the existing lifecycle while treating Web Search as a
  reviewed, pinned, system-included capability (or adapting it behind the
  Main-owned tool bridge), rather than opening Release A to arbitrary executable
  Marketplace packages for a single integration.

## Verification

- Read current source across `electron/coding-plugins`,
  `electron/coding-runtime/pi`, `resources/pi-agent-server.mjs`, Provider routes,
  and the local AI proxy.
- Checked upstream `pi-web-search` 1.3.1 package metadata and source from pi.dev,
  GitHub, and npm.
- Focused Vitest run passed: 5 files / 62 tests covering manifest parsing,
  effective resolution, Marketplace client, composition, and the real shared
  Agent Server process.
- The workspace fallback `pnpm` is 11.19.0 rather than the repository-pinned
  10.33.4 and aborted before changing dependencies; focused tests were therefore
  run directly with the bundled Node executable and existing Vitest install.

## Follow-ups

- If implementation is requested, choose the trusted bundled-capability route
  and define how a logical thread exposes its selected Provider/model to the
  Main-owned search adapter. Do not add an executable Marketplace runtime kind
  without a separate architecture/security decision.

## Promotion Candidates

- None recorded.