@app-vitals/agent-admin 1.11.0 → 1.12.0

package/e2e/marketplaces-section.e2e.ts

@@ -0,0 +1,158 @@
+/**
+ * admin/e2e/marketplaces-section.e2e.ts
+ * Admin UI — Marketplaces section on the agent page (PMK-1.5)
+ *
+ * Covers: remote rows listed, add and remove of a remote row, and baked rows
+ * (reported by the runtime) rendered read-only with no controls.
+ *
+ * Spawns admin/e2e/test-server.ts on its own port; the server's marketplace
+ * rows are in memory, so tests run serially against one server.
+ */
+
+import { type ChildProcess, spawn } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { type BrowserContext, type Page, expect, test } from "@playwright/test";
+import { sign } from "hono/jwt";
+
+const PORT = 3496;
+const BASE_URL = `http://localhost:${PORT}`;
+const SESSION_SECRET = "e2e-admin-test-secret-32chars!!!";
+const AGENT_ID = "agent-e2e-1";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+test.describe.configure({ mode: "serial" });
+
+let serverProcess: ChildProcess | null = null;
+
+async function waitForServer(url: string, maxWaitMs: number): Promise<void> {
+  const start = Date.now();
+  while (Date.now() - start < maxWaitMs) {
+    try {
+      const res = await fetch(url);
+      if (res.status < 500) return;
+    } catch {
+      // Not ready yet
+    }
+    await new Promise((r) => setTimeout(r, 300));
+  }
+  throw new Error(`Server at ${url} did not start within ${maxWaitMs}ms`);
+}
+
+test.beforeAll(async () => {
+  serverProcess = spawn("bun", ["run", resolve(__dirname, "test-server.ts")], {
+    env: {
+      ...process.env,
+      ADMIN_E2E_PORT: String(PORT),
+      ADMIN_E2E_SESSION_SECRET: SESSION_SECRET,
+    },
+    stdio: "pipe",
+    cwd: resolve(__dirname, "../.."),
+  });
+  serverProcess.stderr?.on("data", (d: Buffer) => {
+    if (d.toString().trim())
+      console.error("[admin-e2e-marketplaces-server]", d.toString().trim());
+  });
+  await waitForServer(`${BASE_URL}/health`, 15_000);
+});
+
+test.afterAll(() => {
+  serverProcess?.kill("SIGTERM");
+  serverProcess = null;
+});
+
+const table = (page: Page) => page.locator("#marketplaces-table");
+
+async function loadAgentPage(page: Page, context: BrowserContext) {
+  const nowSec = Math.floor(Date.now() / 1000);
+  const token = await sign(
+    {
+      userId: "google-sub-e2e",
+      email: "admin@example.com",
+      isAdmin: true,
+      iat: nowSec,
+      exp: nowSec + 3600,
+    },
+    SESSION_SECRET,
+    "HS256",
+  );
+  await context.addCookies([
+    {
+      name: "admin_session",
+      value: token,
+      domain: "localhost",
+      path: "/",
+      httpOnly: true,
+      sameSite: "Lax",
+    },
+  ]);
+  await page.goto(`${BASE_URL}/admin/agents/${AGENT_ID}`);
+  await openGroup(page);
+}
+
+// The section lives in the "Plugins & Tools" accordion group, collapsed on
+// every page load (including the redirect after each add/remove).
+async function openGroup(page: Page) {
+  // Set `open` rather than clicking the summary, so a still-old (already
+  // open) page can't be toggled shut; the table locator retries across the
+  // navigation.
+  await expect(async () => {
+    await page
+      .locator("details", { has: page.locator("#marketplaces-table") })
+      .evaluate((el) => {
+        (el as HTMLDetailsElement).open = true;
+      });
+    await expect(table(page)).toBeVisible({ timeout: 1000 });
+  }).toPass();
+}
+
+test("lists the remote row with source and ref, and the baked row", async ({
+  page,
+  context,
+}) => {
+  await loadAgentPage(page, context);
+  const remote = table(page).locator("tbody tr", { hasText: "seeded-remote" });
+  await expect(remote).toContainText("app-vitals/seeded");
+  await expect(remote).toContainText("v1.2.3");
+  await expect(remote).toContainText("remote");
+  await expect(
+    table(page).locator('tr[data-baked-marketplace="baked-e2e"]'),
+  ).toContainText("from image");
+});
+
+test("baked rows have no controls", async ({ page, context }) => {
+  await loadAgentPage(page, context);
+  const baked = table(page).locator('tr[data-baked-marketplace="baked-e2e"]');
+  await expect(baked).toHaveCount(1);
+  await expect(baked.locator("form, button, input, a")).toHaveCount(0);
+});
+
+test("adds a remote row and then removes it", async ({ page, context }) => {
+  await loadAgentPage(page, context);
+  const form = page.locator("#add-marketplace-form");
+  await form.locator('input[name="name"]').fill("added-remote");
+  await form.locator('input[name="source"]').fill("owner/added");
+  await form.locator('input[name="ref"]').fill("main");
+  await form.getByRole("button", { name: "Add marketplace" }).click();
+  await page.waitForURL(`${BASE_URL}/admin/agents/${AGENT_ID}`);
+  await openGroup(page);
+
+  const added = table(page).locator("tbody tr", { hasText: "added-remote" });
+  await expect(added).toContainText("owner/added");
+  await expect(added).toContainText("main");
+
+  await added.getByRole("button", { name: "Remove" }).click();
+  await page.waitForURL(`${BASE_URL}/admin/agents/${AGENT_ID}`);
+  await openGroup(page);
+  await expect(
+    table(page).locator("tbody tr", { hasText: "added-remote" }),
+  ).toHaveCount(0);
+  // The seeded row and the baked row are untouched.
+  await expect(
+    table(page).locator("tbody tr", { hasText: "seeded-remote" }),
+  ).toHaveCount(1);
+  await expect(table(page).locator("tr[data-baked-marketplace]")).toHaveCount(
+    1,
+  );
+});

package/e2e/test-server.ts

@@ -84,6 +84,29 @@ const MOCK_TOKEN = {
   revokedAt: null,
 };
 
+// In-memory AgentMarketplace rows (PMK-1.5): one seeded remote row, mutated by
+// the add/remove routes so marketplaces-section.e2e.ts sees real round trips.
+// Each spec file spawns its own server process, so state never leaks across files.
+const marketplaceRows: Array<{
+  id: string;
+  agentId: string;
+  name: string;
+  source: string;
+  ref: string | null;
+  createdAt: Date;
+  updatedAt: Date;
+}> = [
+  {
+    id: "mk-e2e-1",
+    agentId: ADMIN_E2E_AGENT.id,
+    name: "seeded-remote",
+    source: "app-vitals/seeded",
+    ref: "v1.2.3",
+    createdAt: new Date("2024-01-01"),
+    updatedAt: new Date("2024-01-01"),
+  },
+];
+
 // ─── Chat fixtures (CFB-1.3 — chat thread page e2e) ──────────────────────────
 
 const MOCK_CHAT_THREAD: ChatThread = {
@@ -306,6 +329,35 @@ function buildMockDeps(chatClient: ChatClient | undefined): AdminUIDeps {
         updatedAt: new Date("2024-01-01"),
       }),
     },
+    agentMarketplaceService: {
+      list: async () => [...marketplaceRows],
+      upsert: async (
+        agentId: string,
+        input: { name: string; source: string; ref?: string | null },
+      ) => {
+        const existing = marketplaceRows.find((m) => m.name === input.name);
+        if (existing) {
+          existing.source = input.source;
+          existing.ref = input.ref ?? null;
+          return existing;
+        }
+        const row = {
+          id: `mk-e2e-${marketplaceRows.length + 1}-${input.name}`,
+          agentId,
+          name: input.name,
+          source: input.source,
+          ref: input.ref ?? null,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        };
+        marketplaceRows.push(row);
+        return row;
+      },
+      remove: async (_agentId: string, marketplaceId: string) => {
+        const i = marketplaceRows.findIndex((m) => m.id === marketplaceId);
+        if (i >= 0) marketplaceRows.splice(i, 1);
+      },
+    },
     agentMemberService: {
       listByEmail: async () => [],
       exists: async () => false,
@@ -355,6 +407,7 @@ function buildMockDeps(chatClient: ChatClient | undefined): AdminUIDeps {
         repos: [],
         reviewAuthorAllowlist: [],
         missingRequiredEnv: [],
+        bakedMarketplaces: ["baked-e2e"],
       }),
       updateFields: async () => ({
         id: ADMIN_E2E_AGENT.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@app-vitals/agent-admin",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/app-vitals/agent.git",
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "0.135.0",
-    "@app-vitals/agent-lib": "1.11.0",
+    "@app-vitals/agent-lib": "1.12.0",
     "@hono/zod-openapi": "^1.0.0",
     "@prisma/adapter-pg": "^7.10.0",
     "@prisma/client": "^7.10.0",

package/src/admin-boot.ts

@@ -555,6 +555,7 @@ export async function startAdmin(
     agentToolService,
     agentTokenService,
     agentPluginService,
+    agentMarketplaceService,
     agentMemberService,
     callerScopeResolver,
     agentService,

package/src/admin-ui-pages.ts

@@ -111,6 +111,12 @@ export interface AgentDetail {
   anthropicIdentityName?: string | null;
   anthropicServiceAccountId?: string | null;
   anthropicFederationRuleId?: string | null;
+  /**
+   * PMK-1.5: marketplace names baked into the agent's image, as reported by
+   * the runtime at boot. Rendered read-only. Absent or empty shows the empty
+   * state.
+   */
+  bakedMarketplaces?: string[];
 }
 
 export interface CronJobItem {
@@ -180,6 +186,14 @@ export interface PluginItem {
   createdAt: Date;
 }
 
+export interface MarketplaceItem {
+  id: string;
+  name: string;
+  source: string;
+  ref: string | null;
+  createdAt: Date;
+}
+
 export interface MemberItem {
   id: string;
   email: string;
@@ -957,6 +971,8 @@ export function renderAgentDetailPage(
      * /admin/agents/:id/queue-activity; absent/false omits the link.
      */
     queueActivityLinks?: boolean;
+    /** PMK-1.5: remote AgentMarketplace rows for the Marketplaces card. */
+    marketplaces?: MarketplaceItem[];
   },
 ): string {
   // Reference time for relative timestamps — injected by tests for determinism,
@@ -1271,6 +1287,39 @@ export function renderAgentDetailPage(
           )
           .join("\n");
 
+  const marketplaces = opts?.marketplaces ?? [];
+  const bakedMarketplaces = agent.bakedMarketplaces ?? [];
+  const marketplaceRows = marketplaces
+    .map(
+      (m) => `<tr>
+      <td class="mono">${escapeHtml(m.name)}</td>
+      <td class="mono">${escapeHtml(m.source)}</td>
+      <td class="mono">${m.ref ? escapeHtml(m.ref) : "default"}</td>
+      <td><span class="badge badge-green">remote</span></td>
+      <td>
+        <form method="POST" action="/admin/agents/${escapeHtml(agent.id)}/marketplaces/delete" style="display:inline">
+          <input type="hidden" name="marketplaceId" value="${escapeHtml(m.id)}" />
+          <button type="submit" class="btn btn-danger" style="font-size:11px;padding:3px 8px">Remove</button>
+        </form>
+      </td>
+    </tr>`,
+    )
+    .join("\n");
+  const bakedMarketplaceRows = bakedMarketplaces
+    .map(
+      (name) => `<tr data-baked-marketplace="${escapeHtml(name)}">
+      <td class="mono">${escapeHtml(name)}</td>
+      <td class="mono" style="color:#6b7280">—</td>
+      <td class="mono" style="color:#6b7280">—</td>
+      <td><span class="badge badge-gray" title="Comes from the agent image; only an image update changes it">from image</span></td>
+      <td></td>
+    </tr>`,
+    )
+    .join("\n");
+  const marketplaceTableRows =
+    marketplaceRows + bakedMarketplaceRows ||
+    `<tr><td colspan="5" class="empty-state">No marketplaces.</td></tr>`;
+
   const memberRows =
     members.length === 0
       ? `<tr><td colspan="3" class="empty-state">No members yet.</td></tr>`
@@ -1683,6 +1732,33 @@ export function renderAgentDetailPage(
       </div>
     </div>`;
 
+  const marketplacesSection = `<div class="card">
+      <div class="card-title">Marketplaces</div>
+      <div class="data-table-wrapper">
+        <table class="data-table" id="marketplaces-table">
+          <thead>
+            <tr>
+              <th>Name</th>
+              <th>Source</th>
+              <th>Ref</th>
+              <th>Origin</th>
+              <th></th>
+            </tr>
+          </thead>
+          <tbody>
+            ${marketplaceTableRows}
+          </tbody>
+        </table>
+      </div>
+      <form method="POST" action="/admin/agents/${escapeHtml(agent.id)}/marketplaces" id="add-marketplace-form" style="display:flex;gap:8px;flex-wrap:wrap;margin-top:12px">
+        <input name="name" type="text" class="form-input mono" placeholder="name (e.g. shipwright)" required />
+        <input name="source" type="text" class="form-input mono" placeholder="owner/repo or https git URL" required />
+        <input name="ref" type="text" class="form-input mono" placeholder="ref (optional)" />
+        <button type="submit" class="btn btn-primary">Add marketplace</button>
+      </form>
+      <p style="color:#6b7280;font-size:12px;margin-top:8px">Rows marked "from image" are baked into the agent's image and can't be edited here.</p>
+    </div>`;
+
   // PAI-2.5: read-only trace from this agent to its Anthropic identity. Values
   // are user data (owner email) or provider IDs, so every one is escaped.
   const identityPlaceholder = '<span style="color:#9ca3af">—</span>';
@@ -1874,7 +1950,7 @@ export function renderAgentDetailPage(
   const pluginsToolsGroup = renderGroup(
     "Plugins &amp; Tools",
     pluginsToolsStat,
-    `${toolsSection}${pluginsSection}`,
+    `${toolsSection}${pluginsSection}${marketplacesSection}`,
   );
 
   const expandCollapseControls = `

package/src/admin-ui-pages.unit.test.ts

@@ -4527,3 +4527,62 @@ describe("renderAgentDetailPage — signed commits toggle", () => {
     expect(checkbox).toContain("checked");
   });
 });
+
+describe("renderAgentDetailPage — marketplaces section (PMK-1.5)", () => {
+  const render = (
+    marketplaces: Array<{
+      id: string;
+      name: string;
+      source: string;
+      ref: string | null;
+      createdAt: Date;
+    }>,
+    bakedMarketplaces?: string[],
+  ) =>
+    renderAgentDetailPage(
+      { ...AGENT, bakedMarketplaces },
+      {},
+      [],
+      [],
+      [],
+      [],
+      [],
+      USER_NAME,
+      true,
+      { timezone: "UTC", marketplaces },
+    );
+  const remote = {
+    id: "mk1",
+    name: "shipwright",
+    source: "app-vitals/shipwright",
+    ref: "v1",
+    createdAt: new Date("2024-01-01"),
+  };
+
+  test("remote rows carry a remove form; the add form is present", () => {
+    const html = render([remote]);
+    expect(html).toContain("app-vitals/shipwright");
+    expect(html).toContain(`/admin/agents/${AGENT.id}/marketplaces/delete`);
+    expect(html).toContain('name="marketplaceId" value="mk1"');
+    expect(html).toContain(`/admin/agents/${AGENT.id}/marketplaces"`);
+  });
+
+  test("baked rows are labelled from image and have no form or button", () => {
+    const html = render([], ["baked-one"]);
+    const row = html.match(
+      /<tr data-baked-marketplace="baked-one">.*?<\/tr>/s,
+    )?.[0];
+    expect(row).toContain("from image");
+    expect(row).not.toMatch(/<form|<button|<input/);
+  });
+
+  test("shows the empty state with no remote or baked rows", () => {
+    expect(render([])).toContain("No marketplaces.");
+  });
+
+  test("escapes marketplace values", () => {
+    const html = render([{ ...remote, name: "<b>x</b>" }]);
+    expect(html).not.toContain("<b>x</b>");
+    expect(html).toContain("&lt;b&gt;x&lt;/b&gt;");
+  });
+});

package/src/admin-ui.smoke.test.ts

@@ -34,6 +34,7 @@ import {
   SPECIALIST_TYPE,
   SpecialtyTypes,
 } from "./specialty-types.ts";
+import { UnprocessableEntityError } from "./errors.ts";
 
 // The specialty the create-agent flows use: the configured default type (the
 // platform test run points it at the fixture specialty; the monorepo falls
@@ -3717,6 +3718,128 @@ describe("admin UI — member management routes", () => {
   });
 });
 
+describe("admin UI — marketplaces (PMK-1.5)", () => {
+  const MEMBER = "member@example.com";
+  const form = (fields: Record<string, string>, cookie: string) => ({
+    method: "POST",
+    body: new URLSearchParams(fields).toString(),
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Cookie: `admin_session=${cookie}`,
+    },
+  });
+  const memberDeps = () => ({
+    agentMemberService: {
+      listByEmail: async (email: string) =>
+        email === MEMBER
+          ? [{ id: "m1", agentId: AGENT_ID, email, createdAt: new Date() }]
+          : [],
+      exists: async (_agentId: string, email: string) => email === MEMBER,
+      add: async () => ({
+        id: "m1",
+        agentId: AGENT_ID,
+        email: MEMBER,
+        createdAt: new Date(),
+      }),
+      remove: async () => {},
+      listByAgentId: async () => [],
+    },
+  });
+
+  it("admin add upserts the row with the trimmed ref and redirects", async () => {
+    const calls: unknown[] = [];
+    const app = createAdminUIApp(
+      makeMockDeps({
+        agentMarketplaceService: {
+          list: async () => [],
+          upsert: async (_id: string, input: unknown) => {
+            calls.push(input);
+            return {} as never;
+          },
+          remove: async () => {},
+        },
+      }),
+    );
+    const res = await app.request(
+      `/admin/agents/${AGENT_ID}/marketplaces`,
+      form(
+        { name: "shipwright", source: "app-vitals/shipwright", ref: " v1 " },
+        await makeSessionCookie(),
+      ),
+    );
+    expect(res.status).toBe(302);
+    expect(calls).toEqual([
+      { name: "shipwright", source: "app-vitals/shipwright", ref: "v1" },
+    ]);
+  });
+
+  it("add with an invalid source redirects with the validation message", async () => {
+    const app = createAdminUIApp(
+      makeMockDeps({
+        agentMarketplaceService: {
+          list: async () => [],
+          upsert: async () => {
+            throw new UnprocessableEntityError("source must be bad");
+          },
+          remove: async () => {},
+        },
+      }),
+    );
+    const res = await app.request(
+      `/admin/agents/${AGENT_ID}/marketplaces`,
+      form({ name: "x", source: "/etc" }, await makeSessionCookie()),
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain("error=source%20must%20be");
+  });
+
+  it("an agent member can add and remove; a non-member gets 403", async () => {
+    let removed: string | null = null;
+    const service = {
+      list: async () => [],
+      upsert: async () => ({}) as never,
+      remove: async (_id: string, mid: string) => {
+        removed = mid;
+      },
+    };
+    const memberCookie = await makeSessionCookie(
+      SESSION_SECRET,
+      "google-sub-member",
+      MEMBER,
+      false,
+    );
+    const outsiderCookie = await makeSessionCookie(
+      SESSION_SECRET,
+      "google-sub-outsider",
+      "outsider@example.com",
+      false,
+    );
+    const app = createAdminUIApp(
+      makeMockDeps({ ...memberDeps(), agentMarketplaceService: service }),
+    );
+    const add = await app.request(
+      `/admin/agents/${AGENT_ID}/marketplaces`,
+      form({ name: "x", source: "a/b" }, memberCookie),
+    );
+    const del = await app.request(
+      `/admin/agents/${AGENT_ID}/marketplaces/delete`,
+      form({ marketplaceId: "mk1" }, memberCookie),
+    );
+    expect([add.status, del.status]).toEqual([302, 302]);
+    expect(removed as string | null).toBe("mk1");
+    for (const path of ["marketplaces", "marketplaces/delete"]) {
+      const res = await app.request(
+        `/admin/agents/${AGENT_ID}/${path}`,
+        form(
+          { name: "x", source: "a/b", marketplaceId: "mk1" },
+          outsiderCookie,
+        ),
+      );
+      expect(res.status).toBe(403);
+    }
+  });
+});
+
 describe("admin UI — manifest sync route", () => {
   let adminCookie: string;
 

package/src/admin-ui.ts

@@ -70,6 +70,7 @@ import { deleteAgentFully } from "./agent-deletion.ts";
 import type { ManualStep } from "./agent-deletion-checklist.ts";
 import type { AgentEnvService } from "./agent-envs.ts";
 import type { AgentMemberService } from "./agent-members.ts";
+import type { AgentMarketplaceService } from "./agent-marketplaces.ts";
 import type { AgentPluginService } from "./agent-plugins.ts";
 import type { AgentProvisioner } from "./agent-provisioner.ts";
 import type { AgentTokenService } from "./agent-tokens.ts";
@@ -304,6 +305,15 @@ export interface AdminUIDeps {
     "listForAgent" | "create" | "revoke"
   >;
   agentPluginService: Pick<AgentPluginService, "list" | "add">;
+  /**
+   * PMK-1.5: remote marketplaces for the agent page. Optional (additive to the
+   * exported AdminUIDeps); absent hides the add/remove routes' effect and
+   * lists no remote rows.
+   */
+  agentMarketplaceService?: Pick<
+    AgentMarketplaceService,
+    "list" | "upsert" | "remove"
+  >;
   agentMemberService: Pick<
     AgentMemberService,
     "listByEmail" | "exists" | "add" | "remove" | "listByAgentId"
@@ -776,6 +786,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
     agentToolService,
     agentTokenService,
     agentPluginService,
+    agentMarketplaceService,
     agentMemberService,
     agentService,
     provisioner,
@@ -1753,6 +1764,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
       anthropicIdentityName: agent.anthropicIdentityName ?? null,
       anthropicServiceAccountId: agent.anthropicServiceAccountId ?? null,
       anthropicFederationRuleId: agent.anthropicFederationRuleId ?? null,
+      bakedMarketplaces: agent.bakedMarketplaces ?? [],
     };
 
     if (!(await assertAgentAccess(agentId, c.var.userEmail, c.var.isAdmin))) {
@@ -1778,7 +1790,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
           // verbatim rather than mapped to a fixed key.
           (warningParam ?? undefined);
 
-    const [envResult, crons, tools, tokens, plugins, members] =
+    const [envResult, crons, tools, tokens, plugins, members, marketplaces] =
       await Promise.all([
         agentEnvService
           .getByAgentId(agentId)
@@ -1790,6 +1802,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
         canManageAgents(c.var.isAdmin)
           ? agentMemberService.listByAgentId(agentId)
           : Promise.resolve([]),
+        agentMarketplaceService?.list(agentId) ?? Promise.resolve([]),
       ]);
 
     // Extension card slots (AEP-2.1/AEP-3.2), grouped by placement; a failing
@@ -1826,6 +1839,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
           extensionCardsHtml: cards.header,
           configurationCardsHtml: cards.configuration,
           queueActivityLinks: deps.queueActivityLinks,
+          marketplaces,
         },
       ),
     );
@@ -2401,6 +2415,65 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
     return c.redirect(`/admin/agents/${agentId}`, 302);
   });
 
+  // ─── Marketplace mutations (PMK-1.5) ──────────────────────────────────────
+  // Same access rule as the tool routes (and the /agents/:id/marketplaces API):
+  // an admin or a member of the agent. The baked list has no route here.
+
+  app.post("/admin/agents/:id/marketplaces", requireAuth, async (c) => {
+    const agentId = c.req.param("id");
+    if (!(await assertAgentAccess(agentId, c.var.userEmail, c.var.isAdmin))) {
+      return new Response("Forbidden", { status: 403 });
+    }
+    let name: string | undefined;
+    let source: string | undefined;
+    let ref: string | undefined;
+    try {
+      const formData = await c.req.formData();
+      name = formData.get("name")?.toString().trim();
+      source = formData.get("source")?.toString().trim();
+      ref = formData.get("ref")?.toString().trim() || undefined;
+    } catch {
+      return c.redirect(`/admin/agents/${agentId}`, 302);
+    }
+    if (!name || !source) {
+      return c.redirect(`/admin/agents/${agentId}?error=missing_fields`, 302);
+    }
+    try {
+      await agentMarketplaceService?.upsert(agentId, { name, source, ref });
+    } catch (err) {
+      if (err instanceof UnprocessableEntityError) {
+        return c.redirect(
+          `/admin/agents/${agentId}?error=${encodeURIComponent(err.message)}`,
+          302,
+        );
+      }
+      // other errors — redirect back silently, like the tool routes
+    }
+    return c.redirect(`/admin/agents/${agentId}`, 302);
+  });
+
+  app.post("/admin/agents/:id/marketplaces/delete", requireAuth, async (c) => {
+    const agentId = c.req.param("id");
+    if (!(await assertAgentAccess(agentId, c.var.userEmail, c.var.isAdmin))) {
+      return new Response("Forbidden", { status: 403 });
+    }
+    let marketplaceId: string | undefined;
+    try {
+      const formData = await c.req.formData();
+      marketplaceId = formData.get("marketplaceId")?.toString();
+    } catch {
+      return c.redirect(`/admin/agents/${agentId}`, 302);
+    }
+    if (marketplaceId) {
+      try {
+        await agentMarketplaceService?.remove(agentId, marketplaceId);
+      } catch {
+        // already gone, ignore
+      }
+    }
+    return c.redirect(`/admin/agents/${agentId}`, 302);
+  });
+
   // ─── Token mutations ──────────────────────────────────────────────────────
 
   app.post("/admin/agents/:id/tokens", requireAuth, async (c) => {
@@ -2442,12 +2515,13 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
       anthropicIdentityName: agent.anthropicIdentityName ?? null,
       anthropicServiceAccountId: agent.anthropicServiceAccountId ?? null,
       anthropicFederationRuleId: agent.anthropicFederationRuleId ?? null,
+      bakedMarketplaces: agent.bakedMarketplaces ?? [],
     };
     try {
       const { rawToken } = await agentTokenService.create(agentId, label);
       // Render the page directly (200) rather than redirecting with the token in the URL.
       // A redirect would expose the raw token in server access logs and browser history.
-      const [envResult, crons, tools, tokens, plugins, members] =
+      const [envResult, crons, tools, tokens, plugins, members, marketplaces] =
         await Promise.all([
           agentEnvService
             .getByAgentId(agentId)
@@ -2459,6 +2533,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
           canManageAgents(c.var.isAdmin)
             ? agentMemberService.listByAgentId(agentId)
             : Promise.resolve([]),
+          agentMarketplaceService?.list(agentId) ?? Promise.resolve([]),
         ]);
       // The token page renders only the Configuration-group extension cards;
       // header cards keep their place empty, as before the slot split.
@@ -2491,6 +2566,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
             extensionCardsHtml: cards.header,
             configurationCardsHtml: cards.configuration,
             queueActivityLinks: deps.queueActivityLinks,
+            marketplaces,
           },
         ),
       );

package/src/agents.baked-marketplaces.integration.test.ts

@@ -111,8 +111,12 @@ describeOrSkip("baked marketplaces store (integration)", () => {
       )
       .sort();
     // agents.ts: writer + read select; agents-api.ts: report route + read
-    // serialization; openapi-schemas.ts: response/read schemas only.
+    // serialization; openapi-schemas.ts: response/read schemas only;
+    // admin-ui.ts / admin-ui-pages.ts: read-only display on the agent page
+    // (PMK-1.5), no write path.
     expect(writers).toEqual([
+      "admin-ui-pages.ts",
+      "admin-ui.ts",
       "agents-api.ts",
       "agents.ts",
       "openapi-schemas.ts",