Load settings-sourced marketplace plugins

Author: SqlRush

docs/cc-100-roadmap.md

@@ -273,7 +273,7 @@ M8 补充：headless `/plugin list|status` 现在会按 `enabledPlugins` 的 tru
 
 M8 补充：`enabledPlugins` 的 disabled 状态现在会过滤本地 plugin manifest 产生的 slash command、Skill tool prompt、agent/MCP/output-style/status/stream-init metadata，`/plugin disable <name>` 写入配置后不再只影响展示层；marketplace 下载/安装、版本解析、动态 refresh lifecycle 和完整 UI 管理仍待补齐。
 
-M8 补充：`internal/plugins` 新增 marketplace policy resolver，会根据 `blockedMarketplaces` 优先拒绝来源，并在 `strictKnownMarketplaces` 非空时只允许 strict allowlist 内的 marketplace；`/plugin marketplaces` 现在展示每个 extra/strict/blocked marketplace 的 allow/block decision；本地 plugin manifest 可声明 `marketplace`/`marketplaceName`/`marketplace_name`/`source.name`，带 settings 的 plugin loader 会按 marketplace policy 过滤 command/skill/agent/MCP/output-style/hook 激活路径，`/plugin show/search` 会标注 blocked reason。真实 marketplace 下载/安装/cache lifecycle 仍待补齐。
+M8 补充：`internal/plugins` 新增 marketplace policy resolver，会根据 `blockedMarketplaces` 优先拒绝来源，并在 `strictKnownMarketplaces` 非空时只允许 strict allowlist 内的 marketplace；`/plugin marketplaces` 现在展示每个 extra/strict/blocked marketplace 的 allow/block decision；本地 plugin manifest 可声明 `marketplace`/`marketplaceName`/`marketplace_name`/`source.name`，带 settings 的 plugin loader 会按 marketplace policy 过滤 command/skill/agent/MCP/output-style/hook 激活路径；`extraKnownMarketplaces.<name>.source.source=settings` 的 `plugins` 本地 root 也会进入 plugin load path 并继承 marketplace 名称；`/plugin show/search` 会标注 blocked reason。真实 marketplace 下载/安装/cache lifecycle 仍待补齐。
 
 M8 补充：headless `/config output-style <name>` 现在会校验可用 output style、写入用户 `settings.json` 的 `outputStyle`，并同步当前 runner settings；完整 TUI picker 和状态栏附件仍待补齐。
 
@@ -733,7 +733,7 @@ M7 补充：prompt history `LogEntry` 读取现在接受 `sessionID`/`session`/`
 本轮补充：`cmd/claude --help` 现在沿用 Go flag usage 输出并成功退出；`cmd/claude --cwd` 现在会设置 bootstrap working directory，影响 scaffold 输出、project settings、tool cwd 和 transcript path；`cmd/claude --print/-p` 现在接入真实 `conversation.Runner.RunTurn` 单轮 headless 路径，可从参数或 stdin 读取 prompt，读取 `ANTHROPIC_API_KEY`/`ANTHROPIC_BASE_URL`/`ANTHROPIC_MODEL`/`CLAUDE_MODEL`/settings model，解析模型别名，装配 builtin tools、settings-derived permission engine、settings-derived MCP config，并把最终 assistant text 写到 stdout；`--mcp-config`/`--mcpConfig` 现在会把指定 JSON 文件中的 `mcpServers` 合入 headless MCP local settings；`--input-format`/`--inputFormat` text/json/stream-json 现在有基础输入解析，支持 JSON prompt/user message 和 NDJSON user event；`--max-turns`/`--maxTurns` 现在会限制 headless tool-use loop 轮数，`--max-tokens`/`--maxTokens` 和 `--max-turns`/`--maxTurns` 都会拒绝负值；`--output-format`/`--outputFormat` json 现在会输出基础 result envelope，`stream-json` 会先输出基础 `system/init` 事件，再输出 NDJSON event stream 并以 result 行收尾，包含 result text、session id、assistant message、stop reason、model、usage 和 tool results；headless setup/resume/RunTurn 错误现在会在 JSON 模式输出 `subtype:error` result，在 stream-json 模式输出 `type:error` event；`--permission-mode`/`--permissionMode`、`--dangerously-skip-permissions`/`--dangerouslySkipPermissions`、`--system-prompt`/`--systemPrompt` 和 `--append-system-prompt`/`--appendSystemPrompt` 现在也有 CLI 接线或 camelCase alias；`--stream --output-format stream-json` 现在还会透出 raw Anthropic streaming events，包括 text delta；headless `--resume <session-id-or-jsonl>` 和 `--continue` 现在会加载当前项目 transcript chain 作为 history，并把新回合追加回同一个 transcript；`--allowedTools`/`--allowed-tools` 和 `--disallowedTools`/`--disallowed-tools` 现在会作为 CLI permission rules 合入 headless permission engine；`--add-dir`/`--addDir` 现在会作为 CLI additional working directory 合入 headless permission context。
 本轮补充：settings 文件读取现在有 path-keyed cache，按 size/mode/mtime 指纹复用内容并提供 cache reset；新增 settings change detector，可对 settings 文件快照区分 created/modified/deleted，并在检测到变化时清空 settings 文件缓存。
 
-当前状态：bootstrap/config/auth/model 基础已完成；settings 已有 merge、managed policy（含本地 file/drop-in、MDM/registry、可选 remote GET source、turn-start remote refresh/app-state propagation 和 daemon heartbeat remote refresh）、settings file cache/change detector、turn-start local settings reload/app-state propagation、JSON Schema generation、marketplace source union 基础 validation、marketplace policy resolver/visibility/local manifest load enforcement 和 `strictPluginOnlyCustomization` 基础 enforcement；CLI 已有 `--version`、`--help` 成功退出、`--cwd` working directory override、scaffold settings 校验、基础 `--print` headless 单轮执行路径、基础 `--mcp-config`、基础 input-format text/json/stream-json、`--max-turns` tool loop 限制、基础 JSON result/error 输出、基础 stream-json init/event/error 输出、raw streaming event 透传、headless resume/continue transcript 接线、system prompt flags、dangerously-skip-permissions、常见 camelCase flag aliases、CLI allow/deny tool rules 和 CLI add-dir additional working directory context，但完整参数矩阵、交互 TUI 主循环、resume picker/UI、官方 SDK NDJSON/control protocol、settings background watcher/continuous app-state sync、remote managed 非 daemon 后台 refresh 和官方 stdout/stderr/exit-code parity 仍未完整兼容 CC。
+当前状态：bootstrap/config/auth/model 基础已完成；settings 已有 merge、managed policy（含本地 file/drop-in、MDM/registry、可选 remote GET source、turn-start remote refresh/app-state propagation 和 daemon heartbeat remote refresh）、settings file cache/change detector、turn-start local settings reload/app-state propagation、JSON Schema generation、marketplace source union 基础 validation、marketplace policy resolver/visibility/local+settings-sourced manifest load enforcement 和 `strictPluginOnlyCustomization` 基础 enforcement；CLI 已有 `--version`、`--help` 成功退出、`--cwd` working directory override、scaffold settings 校验、基础 `--print` headless 单轮执行路径、基础 `--mcp-config`、基础 input-format text/json/stream-json、`--max-turns` tool loop 限制、基础 JSON result/error 输出、基础 stream-json init/event/error 输出、raw streaming event 透传、headless resume/continue transcript 接线、system prompt flags、dangerously-skip-permissions、常见 camelCase flag aliases、CLI allow/deny tool rules 和 CLI add-dir additional working directory context，但完整参数矩阵、交互 TUI 主循环、resume picker/UI、官方 SDK NDJSON/control protocol、settings background watcher/continuous app-state sync、remote managed 非 daemon 后台 refresh 和官方 stdout/stderr/exit-code parity 仍未完整兼容 CC。
 
 ### M3: API Client And Conversation Loop
 

docs/claude-code-go-rewrite-plan.md

@@ -143,7 +143,7 @@ test/parity/                 # golden tests against TS/official behavior
 - 本轮补充：`strictPluginOnlyCustomization` 已开始按 policy settings 生效，当前覆盖已实现的 `skills`、`mcp`、`hooks` 和 agent-metadata surfaces：锁定后 user/project/local skills 与 legacy commands 不加载，manual MCP server sources 不加载但 plugin/admin policy 仍保留，settings hooks 只保留 policy hooks 且 plugin hooks 继续运行；`agents` 锁定时非 plugin/bundled/admin prompt command 的 `agent`、`context: fork` 和 `effort` frontmatter metadata 会被清除。完整 forked agent runtime/UI edge cases 仍按缺口追踪。
 - 本轮补充：settings 文件读取现在有 path-keyed cache，按 size/mode/mtime 指纹复用内容并提供 `ResetSettingsCache`；新增 settings change detector，可对 settings 文件快照区分 created/modified/deleted，并在检测到变化时清空 settings 文件缓存；Runner turn-start 会在检测到 user/project/local settings 文件变化时重载 merged settings 并同步刷新 plugin MCP server app-state。完整后台 watcher 和 remote managed 非 daemon 后台 refresh 生命周期仍按缺口追踪。
 - 本轮补充：新增 settings JSON Schema generation，`SettingsJSONSchema()` 会从 `contracts.Settings` 反射生成 draft 2020-12 schema，补强 `$schema` const、permission mode enum、`strictPluginOnlyCustomization` union 和 login method enum；`/config show schema` 现在可展示 schema ID、draft、字段数和生成大小，完整 Zod message parity 仍按缺口追踪。
-- 本轮补充：settings validation 现在覆盖官方 marketplace source union 的基础语义，适用于 `extraKnownMarketplaces[].source`、`strictKnownMarketplaces[]` 和 `blockedMarketplaces[]`：校验 source discriminator、各 source 类型必填字段、URL source 绝对 URL、headers string record、github/git sparsePaths string array、settings-source plugins array、settings-source name 安全/保留名，并继续覆盖 inline marketplace key/name 一致性；`internal/plugins` 新增 marketplace policy resolver，blocked settings 优先、strict allowlist 非空时拒绝未列入来源，`/plugin marketplaces` 会展示 allow/block decision；本地 plugin manifest 可声明 `marketplace`/`marketplaceName`/`marketplace_name`/`source.name`，带 settings 的 plugin loader 会对这些来源执行 marketplace policy，`/plugin show/search` 会标注 blocked reason。真实 marketplace download/install/cache enforcement 仍按缺口追踪。
+- 本轮补充：settings validation 现在覆盖官方 marketplace source union 的基础语义，适用于 `extraKnownMarketplaces[].source`、`strictKnownMarketplaces[]` 和 `blockedMarketplaces[]`：校验 source discriminator、各 source 类型必填字段、URL source 绝对 URL、headers string record、github/git sparsePaths string array、settings-source plugins array、settings-source name 安全/保留名，并继续覆盖 inline marketplace key/name 一致性；`internal/plugins` 新增 marketplace policy resolver，blocked settings 优先、strict allowlist 非空时拒绝未列入来源，`/plugin marketplaces` 会展示 allow/block decision；本地 plugin manifest 可声明 `marketplace`/`marketplaceName`/`marketplace_name`/`source.name`，带 settings 的 plugin loader 会对这些来源执行 marketplace policy，`extraKnownMarketplaces.<name>.source.source=settings` 的 `plugins` 本地 root 也会进入 plugin load path 并继承 marketplace 名称，`/plugin show/search` 会标注 blocked reason。真实 marketplace download/install/cache enforcement 仍按缺口追踪。
 
 ### M4: Tool framework、permissions、sandbox
 

docs/first-second-parity-audit.md

@@ -108,7 +108,7 @@ The following items remain incomplete and must not be treated as done:
 - Full tool execution parity gaps that remain: complete hook runtime policy beyond the current settings command hook path, MCP elicitation, complete SDK control event surface beyond current progress NDJSON, mid-call cancellation for concrete tools, background task behavior, telemetry, schema-not-sent hints, and concrete tool-specific semantics.
 - Complete Anthropic API parity gaps that remain: dynamic beta-header latching for any remaining provider-specific feature gates beyond prompt-cache/cache-editing/strict-output/1M-context requests, ant-only dump gating and remote `/issue` submission integration beyond the current local context summary, full official cost tracker/session restore lifecycle beyond current transcript usage restore, post-handshake streaming failure semantics, deeper gateway/proxy auth and routing behavior beyond static custom headers, first-party/Bedrock/Vertex/Foundry client setup, deeper OAuth account/profile lifecycle beyond request-time refresh retry, fast-mode retry/cooldown semantics, persistent unattended retry heartbeats, full prompt-cache editing lifecycle, and provider-specific cache behavior.
 - Full conversation/query loop: stop hooks, compact/auto-compact, token budget escalation, resume, SDK JSON/NDJSON control events, status updates, rate-limit handling, model switch breadcrumbs, side questions.
-- Full settings parity gaps that remain: complete Zod-equivalent validation messages, full remote managed-settings watcher/non-daemon background refresh lifecycle beyond current turn-start and daemon-heartbeat refresh, remaining forked agent/frontmatter execution and UI edge cases beyond current policy metadata filtering, marketplace download/install/cache enforcement beyond current local manifest load enforcement, and background watcher/continuous app-state sync beyond current turn-start local settings reload.
+- Full settings parity gaps that remain: complete Zod-equivalent validation messages, full remote managed-settings watcher/non-daemon background refresh lifecycle beyond current turn-start and daemon-heartbeat refresh, remaining forked agent/frontmatter execution and UI edge cases beyond current policy metadata filtering, marketplace download/install/cache enforcement beyond current local and settings-sourced manifest load enforcement, and background watcher/continuous app-state sync beyond current turn-start local settings reload.
 - Full session/history parity gaps that remain: large-file optimized transcript loading, preserved-segment edge cases beyond current relink/prune support, content-replacement feature-flag/runtime override and inherited subagent gap-fill details, complete async prompt-history lifecycle parity beyond current lock/buffer/undo paths, full pasted-image processing/runtime integration beyond current prompt image-cache/image-block/metadata path, remaining remote-history edge cases, sidechain/subagent transcript layout, and all session metadata entry types.
 
 ## Current Verification

internal/conversation/run_test.go

@@ -4716,6 +4716,61 @@ func TestRunnerPluginShowReportsLocalPluginDetails(t *testing.T) {
 	}
 }
 
+func TestRunnerPluginListIncludesSettingsMarketplacePlugins(t *testing.T) {
+	client := &fakeClient{}
+	root := t.TempDir()
+	cwd := filepath.Join(root, "project")
+	pluginDir := filepath.Join(root, "marketplace-plugin")
+	if err := os.MkdirAll(cwd, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.json"), []byte(`{
+		"name": "market-demo",
+		"commands": [{"name": "market:deploy", "description": "Deploy marketplace plugin", "prompt": "Deploy."}]
+	}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runner := Runner{
+		Client:           client,
+		SessionID:        "sess_plugin_settings_marketplace",
+		WorkingDirectory: cwd,
+		MCP: &MCPConfig{UserSettings: contracts.Settings{
+			ExtraKnownMarketplaces: map[string]any{
+				"team": map[string]any{"source": map[string]any{
+					"source":  "settings",
+					"name":    "team",
+					"plugins": []any{pluginDir},
+				}},
+			},
+			StrictKnownMarketplaces: []any{"team"},
+		}},
+	}
+
+	result, err := runner.RunTurn(context.Background(), nil, messages.UserText("/plugin list"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(client.requests) != 0 {
+		t.Fatalf("model should not be queried, requests = %#v", client.requests)
+	}
+	text := result.Messages[1].Content[0].Text
+	for _, want := range []string{
+		"Local plugin manifests: 1",
+		"Registered plugin commands: 1",
+		"Local plugins:",
+		"- market-demo",
+		"Plugin commands:",
+		"- /market:deploy",
+	} {
+		if !strings.Contains(text, want) {
+			t.Fatalf("plugin list missing %q: %q", want, text)
+		}
+	}
+}
+
 func TestRunnerPluginShowReportsDisabledLocalPlugin(t *testing.T) {
 	repo := filepath.Join(t.TempDir(), "repo")
 	cwd := filepath.Join(repo, "pkg")

internal/plugins/loader.go

@@ -108,11 +108,20 @@ type skillManifest struct {
 	Description string `json:"description"`
 }
 
+type pluginRootEntry struct {
+	Root        string
+	Marketplace string
+}
+
 func LoadPluginDirs(roots []string) []LoadedPlugin {
+	return loadPluginRootEntries(pluginRootEntriesFromRoots(roots))
+}
+
+func loadPluginRootEntries(roots []pluginRootEntry) []LoadedPlugin {
 	out := make([]LoadedPlugin, 0, len(roots))
 	seen := map[string]struct{}{}
-	for _, root := range roots {
-		root = cleanAbs(root)
+	for _, entry := range roots {
+		root := cleanAbs(entry.Root)
 		key := normalizePath(root)
 		if _, ok := seen[key]; ok {
 			continue
@@ -122,13 +131,18 @@ func LoadPluginDirs(roots []string) []LoadedPlugin {
 		if err != nil {
 			continue
 		}
+		if strings.TrimSpace(entry.Marketplace) != "" {
+			plugin.Marketplace = strings.TrimSpace(entry.Marketplace)
+		}
 		out = append(out, plugin)
 	}
 	return out
 }
 
 func LoadPluginDirsWithSettings(roots []string, settings contracts.Settings) []LoadedPlugin {
-	return FilterPluginsWithSettings(LoadPluginDirs(roots), settings)
+	entries := pluginRootEntriesFromRoots(roots)
+	entries = append(entries, marketplacePluginRootEntries(settings)...)
+	return FilterPluginsWithSettings(loadPluginRootEntries(entries), settings)
 }
 
 func FilterPluginsWithSettings(plugins []LoadedPlugin, settings contracts.Settings) []LoadedPlugin {
@@ -267,6 +281,86 @@ func pluginMarketplaceName(parsed manifest) string {
 	return firstNonEmpty(parsed.Marketplace, parsed.MarketplaceName, parsed.MarketplaceSnake, marketplaceNameFromAny(parsed.Source))
 }
 
+func pluginRootEntriesFromRoots(roots []string) []pluginRootEntry {
+	entries := make([]pluginRootEntry, 0, len(roots))
+	for _, root := range roots {
+		if strings.TrimSpace(root) == "" {
+			continue
+		}
+		entries = append(entries, pluginRootEntry{Root: root})
+	}
+	return entries
+}
+
+func marketplacePluginRootEntries(settings contracts.Settings) []pluginRootEntry {
+	if len(settings.ExtraKnownMarketplaces) == 0 {
+		return nil
+	}
+	names := sortedMarketplaceMapKeys(settings.ExtraKnownMarketplaces)
+	var entries []pluginRootEntry
+	for _, name := range names {
+		source, ok := settingsMarketplaceSource(settings.ExtraKnownMarketplaces[name])
+		if !ok {
+			continue
+		}
+		if sourceType, _ := source["source"].(string); strings.TrimSpace(sourceType) != "settings" {
+			continue
+		}
+		marketplace := firstNonEmpty(stringFromAnyMap(source, "name"), name)
+		plugins, _ := source["plugins"].([]any)
+		for _, rawPlugin := range plugins {
+			root := settingsMarketplacePluginRoot(rawPlugin)
+			if root == "" {
+				continue
+			}
+			entries = append(entries, pluginRootEntry{Root: root, Marketplace: marketplace})
+		}
+	}
+	return entries
+}
+
+func settingsMarketplaceSource(raw any) (map[string]any, bool) {
+	entry, ok := raw.(map[string]any)
+	if !ok {
+		return nil, false
+	}
+	source, ok := entry["source"].(map[string]any)
+	return source, ok
+}
+
+func settingsMarketplacePluginRoot(raw any) string {
+	if text, ok := raw.(string); ok {
+		return strings.TrimSpace(text)
+	}
+	item, ok := raw.(map[string]any)
+	if !ok {
+		return ""
+	}
+	for _, key := range []string{"path", "root", "dir", "directory"} {
+		if value := stringFromAnyMap(item, key); value != "" {
+			return value
+		}
+	}
+	return ""
+}
+
+func stringFromAnyMap(values map[string]any, key string) string {
+	value, _ := values[key].(string)
+	return strings.TrimSpace(value)
+}
+
+func sortedMarketplaceMapKeys(values map[string]any) []string {
+	keys := make([]string, 0, len(values))
+	for key := range values {
+		key = strings.TrimSpace(key)
+		if key != "" {
+			keys = append(keys, key)
+		}
+	}
+	sort.Strings(keys)
+	return keys
+}
+
 func LoadMCPServers(roots []string) map[string]contracts.MCPServer {
 	return LoadMCPServersWithSettings(roots, contracts.Settings{})
 }