@pi-harness/pi-harness 0.1.2 → 0.1.4

package/packages/api-gateway/test/index.test.ts

@@ -1,4 +1,4 @@
-import { mkdtemp, writeFile } from "node:fs/promises";
+import { mkdtemp, readFile, writeFile } from "node:fs/promises";
 import { execFile as execFileCallback } from "node:child_process";
 import { promisify } from "node:util";
 import { tmpdir } from "node:os";
@@ -6,6 +6,7 @@ import { join } from "node:path";
 import { Context } from "@deepseek-ai/cordis";
 import { afterEach, describe, expect, test } from "vitest";
 import webServerPlugin from "@pi-harness/host-webserver";
+import { PiPluginUiRegistry } from "@pi-harness/core";
 import apiPlugin from "../src/index.js";
 
 const contexts: Context[] = [];
@@ -16,6 +17,26 @@ afterEach(async () => {
 });
 
 describe("API gateway plugin", () => {
+  test("lists plugin UI panels through the web API", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "plugin-ui-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    const registry = new PiPluginUiRegistry();
+    registry.register({ id: "example-panel", pluginId: "example-plugin", title: "Example", read: () => ({ ready: true }) });
+    context.reflect.provide("piPluginUi", registry);
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/plugin-ui");
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({
+      items: [{ id: "example-panel", pluginId: "example-plugin", title: "Example", data: { ready: true } }],
+    });
+  });
+
   test("serializes concurrent prompts and validates input", async () => {
     const context = new Context();
     contexts.push(context);
@@ -27,7 +48,9 @@ describe("API gateway plugin", () => {
       session,
       prompt: () => {
         promptStarted = true;
-        return new Promise<void>((resolve) => { releasePrompt = resolve; });
+        return new Promise<void>((resolve) => {
+          releasePrompt = resolve;
+        });
       },
     };
     context.provide("piRuntime", runtime as never);
@@ -35,12 +58,28 @@ describe("API gateway plugin", () => {
     context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
     await context.plugin(apiPlugin);
 
-    const first = fetch(context.webServer.url + "/api/prompt", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ prompt: "first" }) });
+    const first = fetch(context.webServer.url + "/api/prompt", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ prompt: "first" }),
+    });
     while (!promptStarted) await new Promise((resolve) => setTimeout(resolve, 1));
-    await expect(fetch(context.webServer.url + "/api/prompt", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ prompt: "second" }) })).resolves.toMatchObject({ status: 409 });
+    await expect(
+      fetch(context.webServer.url + "/api/prompt", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ prompt: "second" }),
+      }),
+    ).resolves.toMatchObject({ status: 409 });
     releasePrompt?.();
     await expect(first).resolves.toMatchObject({ status: 200 });
-    await expect(fetch(context.webServer.url + "/api/prompt", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ prompt: "   " }) })).resolves.toMatchObject({ status: 400 });
+    await expect(
+      fetch(context.webServer.url + "/api/prompt", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ prompt: "   " }),
+      }),
+    ).resolves.toMatchObject({ status: 400 });
   });
 
   test("returns the live session messages and trajectory events", async () => {
@@ -58,16 +97,23 @@ describe("API gateway plugin", () => {
         return () => listeners.delete(listener);
       },
     };
-    const runtime = { session, prompt: () => {
-      listeners.forEach((listener) => listener({ type: "tool_execution_start", toolName: "read", toolCallId: "call-1", args: { path: "README.md" } }));
-      session.messages.push({ role: "assistant", content: [{ type: "text", text: "done" }], timestamp: 2 });
-    } };
+    const runtime = {
+      session,
+      prompt: () => {
+        listeners.forEach((listener) => listener({ type: "tool_execution_start", toolName: "read", toolCallId: "call-1", args: { path: "README.md" } }));
+        session.messages.push({ role: "assistant", content: [{ type: "text", text: "done" }], timestamp: 2 });
+      },
+    };
     context.provide("piRuntime", runtime as never);
     context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
     context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
     await context.plugin(apiPlugin);
 
-    await fetch(context.webServer.url + "/api/prompt", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ prompt: "hello" }) });
+    await fetch(context.webServer.url + "/api/prompt", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ prompt: "hello" }),
+    });
     const response = await fetch(context.webServer.url + "/api/session");
     expect(response.status).toBe(200);
     await expect(response.json()).resolves.toMatchObject({
@@ -118,11 +164,19 @@ describe("API gateway plugin", () => {
     let sessionId = "old-session";
     let resetCount = 0;
     const session = {
-      get sessionId() { return sessionId; },
+      get sessionId() {
+        return sessionId;
+      },
       sessionFile: undefined,
       messages: [{ role: "user", content: "old" }],
       isStreaming: false,
-      sessionManager: { newSession() { sessionId = "new-session"; resetCount += 1; }, getEntries: () => [] },
+      sessionManager: {
+        newSession() {
+          sessionId = "new-session";
+          resetCount += 1;
+        },
+        getEntries: () => [],
+      },
       agent: { state: { messages: [{ role: "user", content: "old" }] } },
       subscribe: () => () => {},
     };
@@ -133,7 +187,7 @@ describe("API gateway plugin", () => {
 
     const sessions = await fetch(context.webServer.url + "/api/sessions");
     expect(sessions.status).toBe(200);
-    await expect(sessions.json()).resolves.toEqual({ items: [] });
+    await expect(sessions.json()).resolves.toEqual({ items: [], total: 0, page: 0, pageSize: 50, hasNext: false });
     const response = await fetch(context.webServer.url + "/api/session/new", { method: "POST" });
     expect(response.status).toBe(200);
     await expect(response.json()).resolves.toMatchObject({ sessionId: "new-session", messages: [] });
@@ -146,14 +200,26 @@ describe("API gateway plugin", () => {
     await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
     const directory = await mkdtemp(join(tmpdir(), "pi-harness-api-sessions-"));
     const path = join(directory, "2026-08-30T00-00-00-000Z_target.jsonl");
-    await writeFile(path, `${JSON.stringify({ type: "session", version: 3, id: "target-session", timestamp: new Date().toISOString(), cwd: "/tmp" })}\n${JSON.stringify({ type: "message", id: "message-1", parentId: null, timestamp: new Date().toISOString(), message: { role: "assistant", content: [{ type: "text", text: "saved" }], provider: "test", model: "model", usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } }, stopReason: "stop", timestamp: Date.now() } })}\n`, "utf8");
+    await writeFile(
+      path,
+      `${JSON.stringify({ type: "session", version: 3, id: "target-session", timestamp: new Date().toISOString(), cwd: "/tmp" })}\n${JSON.stringify({ type: "message", id: "message-1", parentId: null, timestamp: new Date().toISOString(), message: { role: "assistant", content: [{ type: "text", text: "saved" }], provider: "test", model: "model", usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } }, stopReason: "stop", timestamp: Date.now() } })}\n`,
+      "utf8",
+    );
     let openedPath = "";
     const session = {
       sessionId: "active-session",
       sessionFile: "/tmp/active.jsonl",
       messages: [],
       isStreaming: false,
-      sessionManager: { setSessionFile(nextPath: string) { openedPath = nextPath; }, getEntries: () => [], isPersisted: () => true, getSessionDir: () => directory, buildSessionContext: () => ({ messages: [] }) },
+      sessionManager: {
+        setSessionFile(nextPath: string) {
+          openedPath = nextPath;
+        },
+        getEntries: () => [],
+        isPersisted: () => true,
+        getSessionDir: () => directory,
+        buildSessionContext: () => ({ messages: [] }),
+      },
       agent: { state: { messages: [] } },
       subscribe: () => () => {},
     };
@@ -162,7 +228,11 @@ describe("API gateway plugin", () => {
     context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
     await context.plugin(apiPlugin);
 
-    const response = await fetch(context.webServer.url + "/api/session/open", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ path }) });
+    const response = await fetch(context.webServer.url + "/api/session/open", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ path }),
+    });
     expect(response.status).toBe(200);
     expect(openedPath).toBe(path);
   });
@@ -179,11 +249,19 @@ describe("API gateway plugin", () => {
       sessionFile: undefined,
       messages: [],
       isStreaming: false,
-      get model() { return selected === "one" ? first : second; },
-      setModel(model: { id: string }) { selected = model.id; return Promise.resolve(); },
+      get model() {
+        return selected === "one" ? first : second;
+      },
+      setModel(model: { id: string }) {
+        selected = model.id;
+        return Promise.resolve();
+      },
       subscribe: () => () => {},
     };
-    const modelRuntime = { getModels: () => [first, second], getModel: (_provider: string, id: string) => id === "two" ? second : id === "one" ? first : undefined };
+    const modelRuntime = {
+      getModels: () => [first, second],
+      getModel: (_provider: string, id: string) => (id === "two" ? second : id === "one" ? first : undefined),
+    };
     context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
     context.provide("piModels", { model: first, runtime: modelRuntime } as never);
     context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
@@ -191,10 +269,19 @@ describe("API gateway plugin", () => {
 
     await expect(fetch(context.webServer.url + "/api/models")).resolves.toMatchObject({ status: 200 });
     const list = await fetch(context.webServer.url + "/api/models");
-    await expect(list.json()).resolves.toMatchObject({ items: [{ id: "one", active: true }, { id: "two", active: false }] });
+    await expect(list.json()).resolves.toMatchObject({
+      items: [
+        { id: "one", active: true },
+        { id: "two", active: false },
+      ],
+    });
     const providers = await fetch(context.webServer.url + "/api/providers");
     await expect(providers.json()).resolves.toMatchObject({ items: [{ provider: "test", activeModel: { id: "one", active: true } }] });
-    const response = await fetch(context.webServer.url + "/api/model", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ provider: "test", model: "two" }) });
+    const response = await fetch(context.webServer.url + "/api/model", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ provider: "test", model: "two" }),
+    });
     expect(response.status).toBe(200);
     await expect(response.json()).resolves.toMatchObject({ model: { id: "two", active: true } });
     expect(selected).toBe("two");
@@ -207,8 +294,24 @@ describe("API gateway plugin", () => {
     const active = { provider: "active", id: "one", name: "Active", reasoning: false, contextWindow: 8_000 };
     const configured = { provider: "configured", id: "one", name: "Configured", reasoning: false, contextWindow: 8_000 };
     const hidden = { provider: "hidden", id: "one", name: "Hidden", reasoning: false, contextWindow: 8_000 };
-    const session = { sessionId: "provider-filter-session", sessionFile: undefined, messages: [], isStreaming: false, model: active, subscribe: () => () => {} };
-    const modelRuntime = { getProviders: () => [{ id: "active", name: "Active" }, { id: "configured", name: "Configured" }, { id: "hidden", name: "Hidden" }], getModels: (provider?: string) => provider === "configured" ? [configured] : provider === "hidden" ? [hidden] : [active], getProviderAuthStatus: (provider: string) => provider === "configured" ? { configured: true, source: "environment" } : { configured: false }, getModel: () => active };
+    const session = {
+      sessionId: "provider-filter-session",
+      sessionFile: undefined,
+      messages: [],
+      isStreaming: false,
+      model: active,
+      subscribe: () => () => {},
+    };
+    const modelRuntime = {
+      getProviders: () => [
+        { id: "active", name: "Active" },
+        { id: "configured", name: "Configured" },
+        { id: "hidden", name: "Hidden" },
+      ],
+      getModels: (provider?: string) => (provider === "configured" ? [configured] : provider === "hidden" ? [hidden] : [active]),
+      getProviderAuthStatus: (provider: string) => (provider === "configured" ? { configured: true, source: "environment" } : { configured: false }),
+      getModel: () => active,
+    };
     context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
     context.provide("piModels", { model: active, runtime: modelRuntime } as never);
     context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
@@ -219,6 +322,51 @@ describe("API gateway plugin", () => {
     await expect(response.json()).resolves.toMatchObject({ items: [{ provider: "active" }, { provider: "configured" }] });
   });
 
+  test("explains when EveryAPI CLI auth is not injected into the process", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const previousCliPath = process.env.EVERYAPI_CLI_PATH;
+    const previousRelayKey = process.env.EVERYAPI_RELAY_KEY;
+    process.env.EVERYAPI_CLI_PATH = "/usr/bin/false";
+    delete process.env.EVERYAPI_RELAY_KEY;
+    try {
+      const session = {
+        model: { provider: "everyapi", id: "deepseek-v4-flash" },
+        messages: [],
+        isStreaming: false,
+        subscribe: () => () => {},
+      };
+      const modelRuntime = {
+        getProviders: () => [{ id: "everyapi", name: "EveryAPI" }],
+        getModels: () => [{ provider: "everyapi", id: "deepseek-v4-flash", name: "deepseek-v4-flash" }],
+        checkAuth: () => Promise.resolve(undefined),
+        getProviderAuthStatus: () => ({ configured: false }),
+        getModel: () => session.model,
+      };
+      context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
+      context.provide("piModels", { model: session.model, runtime: modelRuntime } as never);
+      context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+      await context.plugin(apiPlugin);
+
+      const response = await fetch(context.webServer.url + "/api/providers/test", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ provider: "everyapi" }),
+      });
+      await expect(response.json()).resolves.toEqual({
+        provider: "everyapi",
+        reachable: false,
+        auth: { configured: false, source: "everyapi-cli", label: "未检测到 EveryAPI CLI 登录" },
+      });
+    } finally {
+      if (previousCliPath === undefined) delete process.env.EVERYAPI_CLI_PATH;
+      else process.env.EVERYAPI_CLI_PATH = previousCliPath;
+      if (previousRelayKey === undefined) delete process.env.EVERYAPI_RELAY_KEY;
+      else process.env.EVERYAPI_RELAY_KEY = previousRelayKey;
+    }
+  });
+
   test("lists commands from the live extension registry", async () => {
     const context = new Context();
     contexts.push(context);
@@ -228,7 +376,9 @@ describe("API gateway plugin", () => {
       sessionFile: undefined,
       messages: [],
       isStreaming: false,
-      extensionRunner: { getRegisteredCommands: () => [{ name: "review", invocationName: "review", description: "Review changes", sourceInfo: { path: "/tmp/review.ts" } }] },
+      extensionRunner: {
+        getRegisteredCommands: () => [{ name: "review", invocationName: "review", description: "Review changes", sourceInfo: { path: "/tmp/review.ts" } }],
+      },
       subscribe: () => () => {},
     };
     context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
@@ -238,7 +388,9 @@ describe("API gateway plugin", () => {
 
     const response = await fetch(context.webServer.url + "/api/commands");
     expect(response.status).toBe(200);
-    await expect(response.json()).resolves.toEqual({ items: [{ name: "review", invocationName: "review", description: "Review changes", source: "/tmp/review.ts" }] });
+    await expect(response.json()).resolves.toEqual({
+      items: [{ name: "review", invocationName: "review", description: "Review changes", source: "/tmp/review.ts" }],
+    });
   });
 
   test("aborts a running prompt through the web API", async () => {
@@ -247,7 +399,16 @@ describe("API gateway plugin", () => {
     await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
     let aborted = false;
     const session = { sessionId: "abort-session", sessionFile: undefined, messages: [], isStreaming: true, subscribe: () => () => {} };
-    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => { aborted = true; session.isStreaming = false; return Promise.resolve(); }, dispose: () => Promise.resolve() } as never);
+    context.provide("piRuntime", {
+      session,
+      prompt: () => Promise.resolve(),
+      abort: () => {
+        aborted = true;
+        session.isStreaming = false;
+        return Promise.resolve();
+      },
+      dispose: () => Promise.resolve(),
+    } as never);
     context.provide("piModels", { model: { provider: "test", id: "model" }, runtime: { getModels: () => [], getModel: () => undefined } } as never);
     context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
     await context.plugin(apiPlugin);
@@ -270,12 +431,12 @@ describe("API gateway plugin", () => {
 
     const response = await fetch(context.webServer.url + "/api/files");
     expect(response.status).toBe(200);
-    const payload = await response.json() as { items?: unknown };
+    const payload = (await response.json()) as { items?: unknown };
     expect(Array.isArray(payload.items)).toBe(true);
 
     const diff = await fetch(context.webServer.url + "/api/files/diff?path=README.md");
     expect(diff.status).toBe(200);
-    const diffPayload = await diff.json() as { path?: unknown; diff?: unknown };
+    const diffPayload = (await diff.json()) as { path?: unknown; diff?: unknown };
     expect(diffPayload.path).toBe("README.md");
     expect(typeof diffPayload.diff).toBe("string");
     const invalid = await fetch(context.webServer.url + "/api/files/diff?path=../secrets.txt");
@@ -292,14 +453,291 @@ describe("API gateway plugin", () => {
     context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
     await context.plugin(apiPlugin);
 
-    const response = await fetch(context.webServer.url + "/api/marketplace?q=timer&capability=scheduling");
+    const response = await fetch(context.webServer.url + "/api/marketplace?q=timer&capability=scheduling&category=runtime&page=0&pageSize=1");
     expect(response.status).toBe(200);
-    const payload = await response.json() as { items?: readonly { packageName?: unknown; status?: unknown }[]; capabilities?: readonly unknown[] };
+    const payload = (await response.json()) as {
+      items?: readonly { packageName?: unknown; status?: unknown }[];
+      capabilities?: readonly unknown[];
+      categories?: readonly { id?: unknown; label?: unknown; count?: unknown }[];
+      total?: number;
+      page?: number;
+      pageSize?: number;
+      hasNext?: boolean;
+    };
     expect(payload.items).toHaveLength(1);
     expect(payload.items?.[0]).toMatchObject({ packageName: "@deepseek-ai/cordis-plugin-timer", status: "verified" });
+    expect(payload).toMatchObject({ total: 1, page: 0, pageSize: 1, hasNext: false });
     expect(payload.capabilities).toContain("scheduling");
+    expect(payload.categories).toEqual(expect.arrayContaining([expect.objectContaining({ id: "runtime", label: "运行时", count: 1 })]));
     const tooLong = await fetch(context.webServer.url + "/api/marketplace?q=" + "x".repeat(121));
     expect(tooLong.status).toBe(400);
+    const invalidPage = await fetch(context.webServer.url + "/api/marketplace?page=-1");
+    expect(invalidPage.status).toBe(400);
+    const invalidSort = await fetch(context.webServer.url + "/api/marketplace?sort=popular");
+    expect(invalidSort.status).toBe(400);
+  });
+
+  test("writes bundled official plugin entries without invoking npm", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "pi-harness-api-plugin-install-"));
+    const configPath = join(cwd, "pi.toml");
+    await writeFile(configPath, '- id: runtime\n  name: "@pi-harness/core/plugins/runtime"\n  config: {}\n', "utf8");
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "marketplace-install-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd, agentDir: cwd, configPath, args: [], requestExit() {} });
+    let createCalled = false;
+    context.reflect.provide("loader", {
+      entries() {
+        return [];
+      },
+      create: () => {
+        createCalled = true;
+        return Promise.reject(new Error("bundled plugin must not be dynamically created"));
+      },
+    });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/marketplace/install", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: "skill-guard" }),
+    });
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({ installed: false, restartRequired: true, plugin: { id: "skill-guard" } });
+    expect(createCalled).toBe(false);
+    await expect(readFile(configPath, "utf8")).resolves.toContain('name: "@pi-harness/core/plugins/skill-guard"');
+  });
+
+  test("locks marketplace installation before reading a request body", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "pi-harness-api-plugin-install-lock-"));
+    const configPath = join(cwd, "pi.toml");
+    await writeFile(configPath, '- id: runtime\n  name: "@pi-harness/core/plugins/runtime"\n  config: {}\n', "utf8");
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "marketplace-install-lock-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd, agentDir: cwd, configPath, args: [], requestExit() {} });
+    context.reflect.provide("loader", { entries: () => [] });
+    await context.plugin(apiPlugin);
+
+    let finishBody: (() => void) | undefined;
+    const body = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode('{"id":"skill'));
+        finishBody = () => {
+          controller.enqueue(new TextEncoder().encode('-guard"}'));
+          controller.close();
+        };
+      },
+    });
+    const first = fetch(context.webServer.url + "/api/marketplace/install", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body,
+      duplex: "half",
+    } as RequestInit & { duplex: "half" });
+    await new Promise((resolveDelay) => setTimeout(resolveDelay, 25));
+
+    const competing = await fetch(context.webServer.url + "/api/marketplace/install", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: "cost-meter" }),
+    });
+    expect(competing.status).toBe(409);
+
+    finishBody?.();
+    expect((await first).status).toBe(200);
+  });
+
+  test("marks legacy random-id marketplace entries as removable", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "legacy-plugin-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    const loaderEntries = [
+      { options: { id: "769990d2", name: "@deepseek-ai/cordis-plugin-logger-console" } },
+      { options: { id: "marketplace-session-bridge", name: "@pi-harness/core/plugins/session-bridge" } },
+    ];
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    context.reflect.provide("loader", {
+      *entries() {
+        yield* loaderEntries;
+      },
+    });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/plugins");
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({
+      items: [
+        {
+          id: "769990d2",
+          name: "@deepseek-ai/cordis-plugin-logger-console",
+          enabled: true,
+          state: "unloaded",
+          removable: true,
+          category: { id: "observability", label: "可观测性" },
+        },
+        {
+          id: "marketplace-session-bridge",
+          name: "@pi-harness/core/plugins/session-bridge",
+          enabled: true,
+          state: "unloaded",
+          removable: true,
+          category: { id: "workflow", label: "工作流" },
+        },
+      ],
+    });
+  });
+
+  test("toggles a legacy marketplace entry using its existing profile id", async () => {
+    const context = new Context();
+    contexts.push(context);
+    const directory = await mkdtemp(join(tmpdir(), "pi-harness-api-plugin-toggle-"));
+    const configPath = join(directory, "profile.yml");
+    const entryId = "769990d2";
+    let disabled = false;
+    const loaderEntry = {
+      id: `profile:${entryId}`,
+      options: { id: entryId, name: "@deepseek-ai/cordis-plugin-logger-console", config: {} },
+      update(options: { disabled?: boolean }): Promise<void> {
+        disabled = options.disabled === true;
+        return Promise.resolve();
+      },
+    };
+    await writeFile(
+      configPath,
+      `- id: agent\n  name: cordis:group\n  group: true\n  config:\n    - id: ${entryId}\n      name: ${JSON.stringify(loaderEntry.options.name)}\n      config: {}\n    - id: sibling\n      name: "@pi-harness/core/plugins/runtime"\n      config: {}\n`,
+      "utf8",
+    );
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "legacy-plugin-toggle-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" }, runtime: { getModels: () => [], getModel: () => undefined } } as never);
+    context.provide("piHarnessLaunch", { cwd: directory, agentDir: directory, configPath, args: [], requestExit() {} });
+    context.reflect.provide("loader", {
+      *entries() {
+        yield loaderEntry;
+      },
+    });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/plugins/toggle", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: entryId, enabled: false }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(disabled).toBe(true);
+    await expect(readFile(configPath, "utf8")).resolves.toContain("disabled: true");
+    await expect(readFile(configPath, "utf8")).resolves.toContain("- id: sibling");
+  });
+
+  test("uninstalls a nested marketplace entry using its resolvable loader id", async () => {
+    const context = new Context();
+    contexts.push(context);
+    const directory = await mkdtemp(join(tmpdir(), "pi-harness-api-plugin-uninstall-"));
+    const configPath = join(directory, "profile.yml");
+    const entryId = "marketplace-cordis-logger-console";
+    const loaderEntry = {
+      id: `profile:${entryId}`,
+      options: { id: entryId, name: "@deepseek-ai/cordis-plugin-logger-console", config: {} },
+      parent: {
+        tree: { write() {} },
+        remove(id: string): Promise<void> {
+          if (id !== entryId) throw new Error(`cannot resolve entry ${id}`);
+          active = false;
+          return Promise.resolve();
+        },
+      },
+    };
+    let active = true;
+    const loader = {
+      *entries() {
+        if (active) yield loaderEntry;
+      },
+    };
+    await writeFile(
+      configPath,
+      `- id: agent\n  name: cordis:group\n  group: true\n  config:\n    - id: ${entryId}\n      name: ${JSON.stringify(loaderEntry.options.name)}\n      config: {}\n    - id: sibling\n      name: "@pi-harness/core/plugins/runtime"\n      config: {}\n`,
+      "utf8",
+    );
+    await writeFile(join(directory, "package.json"), JSON.stringify({ private: true, dependencies: { [loaderEntry.options.name]: "1.0.1" } }), "utf8");
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "plugin-uninstall-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" }, runtime: { getModels: () => [], getModel: () => undefined } } as never);
+    context.provide("piHarnessLaunch", { cwd: directory, agentDir: "/tmp/agent", configPath, args: [], requestExit() {} });
+    context.reflect.provide("loader", loader);
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/plugins/uninstall", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: entryId }),
+    });
+    expect(response.status).toBe(200);
+    const plugins = await fetch(context.webServer.url + "/api/plugins");
+    expect(plugins.status).toBe(200);
+    const pluginsPayload = (await plugins.json()) as { items?: unknown };
+    expect(pluginsPayload.items).not.toEqual(expect.arrayContaining([expect.objectContaining({ id: entryId })]));
+    await expect(readFile(configPath, "utf8")).resolves.toContain("- id: sibling");
+  });
+
+  test("uninstalls bundled marketplace plugins from their existing profile row without invoking npm", async () => {
+    const context = new Context();
+    contexts.push(context);
+    const directory = await mkdtemp(join(tmpdir(), "pi-harness-api-bundled-uninstall-"));
+    const configPath = join(directory, "profile.yml");
+    const entryId = "skill-guard";
+    let active = true;
+    const loaderEntry = {
+      id: `profile:${entryId}`,
+      options: { id: entryId, name: "@pi-harness/core/plugins/skill-guard", config: {} },
+      parent: {
+        tree: { write() {} },
+        remove(id: string): Promise<void> {
+          if (id !== entryId) throw new Error(`cannot resolve entry ${id}`);
+          active = false;
+          return Promise.resolve();
+        },
+      },
+    };
+    await writeFile(
+      configPath,
+      `- id: agent\n  name: cordis:group\n  group: true\n  config:\n    - id: ${entryId}\n      name: ${JSON.stringify(loaderEntry.options.name)}\n      config: {}\n    - id: sibling\n      name: "@pi-harness/core/plugins/runtime"\n      config: {}\n`,
+      "utf8",
+    );
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "bundled-uninstall-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" }, runtime: { getModels: () => [], getModel: () => undefined } } as never);
+    context.provide("piHarnessLaunch", { cwd: directory, agentDir: directory, configPath, args: [], requestExit() {} });
+    context.reflect.provide("loader", {
+      *entries() {
+        if (active) yield loaderEntry;
+      },
+    });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/plugins/uninstall", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: entryId }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(active).toBe(false);
+    await expect(readFile(configPath, "utf8")).resolves.not.toContain(entryId);
+    await expect(readFile(configPath, "utf8")).resolves.toContain("- id: sibling");
   });
 
   test("commits selected workspace files only after an explicit message", async () => {
@@ -320,9 +758,17 @@ describe("API gateway plugin", () => {
     context.provide("piHarnessLaunch", { cwd: directory, agentDir: "/tmp/agent", args: [], requestExit() {} });
     await context.plugin(apiPlugin);
 
-    const missingMessage = await fetch(context.webServer.url + "/api/files/commit", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ paths: ["README.md"] }) });
+    const missingMessage = await fetch(context.webServer.url + "/api/files/commit", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ paths: ["README.md"] }),
+    });
     expect(missingMessage.status).toBe(400);
-    const response = await fetch(context.webServer.url + "/api/files/commit", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ paths: ["README.md"], message: "Update README" }) });
+    const response = await fetch(context.webServer.url + "/api/files/commit", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ paths: ["README.md"], message: "Update README" }),
+    });
     expect(response.status).toBe(200);
     await expect(response.json()).resolves.toMatchObject({ committed: true, message: "Update README" });
     await expect(execFile("git", ["status", "--porcelain"], { cwd: directory })).resolves.toMatchObject({ stdout: "" });
@@ -341,7 +787,11 @@ describe("API gateway plugin", () => {
     context.provide("piHarnessLaunch", { cwd: directory, agentDir: "/tmp/agent", args: [], requestExit() {} });
     await context.plugin(apiPlugin);
 
-    const response = await fetch(context.webServer.url + "/api/files/revert", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ paths: ["scratch.txt"] }) });
+    const response = await fetch(context.webServer.url + "/api/files/revert", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ paths: ["scratch.txt"] }),
+    });
     expect(response.status).toBe(400);
   });
 });