Task: Review updated local plugin integration

Identity

Inspect the locally merged Marketplace client, Package Store, effective Plugin resolver, Pi Agent Server, extension host, and Provider projection.
Reassess whether the existing plugin-management lifecycle can carry pi-web-search without adding a second management subsystem.
Make no product-source or dependency changes.

Treat the current main source as authoritative over the earlier isolated network/search assessments, whose base predates the local Marketplace and shared-Agent-Server merge.
Preserve Electron Main ownership of package trust, Provider credentials, proxy behavior, runtime authorization, and packaged closure.
Distinguish a Marketplace Skill package from executable Pi extension code.

Confirmed that the local merge now has an end-to-end Main-owned Marketplace lifecycle: catalog/library client, signed immutable Package Store, project enablement, Agent Skill assignment, effective snapshot, and worker resource materialization. A second plugin-management subsystem is unnecessary.
Confirmed that Release A artifact installation is deliberately limited to skill_only: installed records and trusted metadata force that runtime kind, archives accept only manifests plus static Skill text/image assets, and executable/script components are rejected.
Confirmed that the shared Pi Agent Server disables ambient extension discovery and requires exactly one code-owned Makelore extension factory per logical thread. Therefore pi install npm:pi-web-search or an unchanged Marketplace artifact cannot currently activate pi-web-search.
Confirmed that pi-web-search 1.3.1 is a third-party executable TypeScript Pi extension listed on pi.dev. It supports Google Generative AI, OpenAI Responses, OpenAI Codex Responses, and Anthropic Messages; the default Works-imported account remains projected as openai-completions, so that default path would be rejected by the extension even after loading.
Recommended reusing the existing lifecycle while treating Web Search as a reviewed, pinned, system-included capability (or adapting it behind the Main-owned tool bridge), rather than opening Release A to arbitrary executable Marketplace packages for a single integration.

Read current source across electron/coding-plugins, electron/coding-runtime/pi, resources/pi-agent-server.mjs, Provider routes, and the local AI proxy.
Checked upstream pi-web-search 1.3.1 package metadata and source from pi.dev, GitHub, and npm.
Focused Vitest run passed: 5 files / 62 tests covering manifest parsing, effective resolution, Marketplace client, composition, and the real shared Agent Server process.
The workspace fallback pnpm is 11.19.0 rather than the repository-pinned 10.33.4 and aborted before changing dependencies; focused tests were therefore run directly with the bundled Node executable and existing Vitest install.

If implementation is requested, choose the trusted bundled-capability route and define how a logical thread exposes its selected Provider/model to the Main-owned search adapter. Do not add an executable Marketplace runtime kind without a separate architecture/security decision.