feat(plugins): marketplace catalog backend — projection, download+verify install, revocation sync (#25)

The shared, headless-testable core behind the Plugin Manager's Catalog tab, so the
×3 shell UI stays thin:

- PluginCatalog.Build joins the verified feed index to installed manifests into
  Install / Update / Installed rows, flags feed-revoked builds, and offers search.
- PluginCatalogInstaller.InstallAsync downloads the .daxplugin, checks the bytes
  against the sha256 in the SIGNED index (binding trusted index to served bytes,
  size-capped), then delegates to PluginInstaller.InstallFromPackage so the whole
  package-integrity/manifest/SDK/trust/IL-scan gate chain applies unchanged.
- PluginRevocationSync.Apply merges the feed's revoked[] into the local
  revoked.json kill-list the loader already enforces on every start
  (PluginRevocationList.Merge; existing local entries preserved, deduped).

16 headless tests (real ECDSA-free path: real .daxplugin packages + stub HTTP):
install/update/up-to-date/revoked projection, search, checksum-match install,
mismatch/bad-url/404/curated-gate refusals, revocation merge + dedup.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dhruuvsharma

src/windows/Pipeline/TradingTerminal.Infrastructure/Plugins/Feed/PluginCatalog.cs

@@ -0,0 +1,139 @@
+using System.IO;
+
+namespace TradingTerminal.Infrastructure.Plugins.Feed;
+
+/// <summary>Where a feed-listed plugin stands relative to what's installed locally.</summary>
+public enum PluginInstallState
+{
+    /// <summary>Nothing with this plugin id is installed.</summary>
+    NotInstalled,
+
+    /// <summary>Installed at (or above) the feed's latest version.</summary>
+    UpToDate,
+
+    /// <summary>Installed at an older version than the feed offers.</summary>
+    UpdateAvailable,
+}
+
+/// <summary>
+/// One browsable catalog card: a verified feed entry joined to local install state and the feed's own
+/// revocation view. It's a pure projection — computed from (verified index + installed manifests), doing
+/// no I/O beyond reading the plugin folders. The UI binds directly to this.
+/// </summary>
+public sealed record PluginCatalogItem(
+    PluginFeedEntry Entry,
+    PluginInstallState State,
+    string? InstalledVersion,
+    bool Revoked,
+    string? RevokedReason)
+{
+    public string Id => Entry.Id;
+    public string Name => Entry.Name;
+    public string Publisher => Entry.Publisher;
+    public string Description => Entry.Description;
+    public string LatestVersion => Entry.Latest.Version;
+    public PluginFeedVersion Latest => Entry.Latest;
+    public IReadOnlyList<string> Tags => Entry.Tags ?? [];
+    public string? PaperUrl => Entry.PaperUrl;
+
+    /// <summary>A fresh install is offered only when nothing is installed and the build isn't revoked.</summary>
+    public bool CanInstall => State == PluginInstallState.NotInstalled && !Revoked;
+
+    /// <summary>An update is offered only when an older build is installed and the new one isn't revoked.</summary>
+    public bool CanUpdate => State == PluginInstallState.UpdateAvailable && !Revoked;
+}
+
+/// <summary>
+/// Builds the marketplace catalog: joins the verified feed index to what's installed on disk so the UI can
+/// show Install / Update / Installed and grey out revoked builds. Reading installed manifests never throws
+/// (a broken or absent manifest just means "unknown installed version"), and the whole thing is a pure
+/// function of its inputs — trivially testable and safe to call on any thread.
+/// </summary>
+public static class PluginCatalog
+{
+    /// <summary>Projects every feed entry into a catalog row carrying its local install state and whether
+    /// the feed has revoked it. A null / empty index yields an empty catalog (feed off / not yet fetched).</summary>
+    public static IReadOnlyList<PluginCatalogItem> Build(PluginIndex? index, string pluginsRoot)
+    {
+        if (index?.Plugins is not { Count: > 0 }) return [];
+
+        var installed = ReadInstalledVersions(pluginsRoot);
+        var revoked = index.Revoked ?? [];
+
+        var items = new List<PluginCatalogItem>(index.Plugins.Count);
+        foreach (var entry in index.Plugins)
+        {
+            installed.TryGetValue(entry.Id, out var installedVersion);
+            var state = installedVersion is null
+                ? PluginInstallState.NotInstalled
+                : IsOlder(installedVersion, entry.Latest.Version)
+                    ? PluginInstallState.UpdateAvailable
+                    : PluginInstallState.UpToDate;
+
+            var isRevoked = IsRevoked(revoked, entry, out var reason);
+            items.Add(new PluginCatalogItem(entry, state, installedVersion, isRevoked, reason));
+        }
+        return items;
+    }
+
+    /// <summary>Case-insensitive substring filter over name / id / publisher / description / tags. A blank
+    /// query returns the list unchanged.</summary>
+    public static IReadOnlyList<PluginCatalogItem> Search(IReadOnlyList<PluginCatalogItem> items, string? query)
+    {
+        if (string.IsNullOrWhiteSpace(query)) return items;
+        var q = query.Trim();
+        bool Has(string? s) => s is not null && s.Contains(q, StringComparison.OrdinalIgnoreCase);
+        return items
+            .Where(i => Has(i.Name) || Has(i.Id) || Has(i.Publisher) || Has(i.Description) || i.Tags.Any(Has))
+            .ToList();
+    }
+
+    /// <summary>All rows that currently offer an update — the source for "Update all".</summary>
+    public static IReadOnlyList<PluginCatalogItem> Updatable(IReadOnlyList<PluginCatalogItem> items) =>
+        items.Where(i => i.CanUpdate).ToList();
+
+    private static Dictionary<string, string> ReadInstalledVersions(string pluginsRoot)
+    {
+        var map = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        if (!Directory.Exists(pluginsRoot)) return map;
+
+        foreach (var dir in Directory.EnumerateDirectories(pluginsRoot))
+        {
+            PluginManifest? manifest;
+            try { manifest = PluginManifest.TryRead(dir); }
+            catch { continue; } // a broken manifest isn't the catalog's problem — the loader reports it
+            if (manifest is not null && !string.IsNullOrWhiteSpace(manifest.Id))
+                map[manifest.Id] = manifest.Version;
+        }
+        return map;
+    }
+
+    private static bool IsRevoked(IReadOnlyList<PluginFeedRevocation> revoked, PluginFeedEntry entry, out string? reason)
+    {
+        foreach (var r in revoked)
+        {
+            var idMatch = !string.IsNullOrWhiteSpace(r.Id)
+                && string.Equals(r.Id, entry.Id, StringComparison.OrdinalIgnoreCase);
+            var hashMatch = !string.IsNullOrWhiteSpace(r.Sha256)
+                && string.Equals(r.Sha256, entry.Latest.Sha256, StringComparison.OrdinalIgnoreCase);
+            if (idMatch || hashMatch)
+            {
+                reason = string.IsNullOrWhiteSpace(r.Reason) ? "This build has been revoked." : r.Reason;
+                return true;
+            }
+        }
+        reason = null;
+        return false;
+    }
+
+    /// <summary>True when <paramref name="installed"/> is a lower version than <paramref name="latest"/>,
+    /// comparing the release core (ignoring any prerelease/build tag) — the same semantics the installer
+    /// uses to describe an update vs a downgrade.</summary>
+    private static bool IsOlder(string installed, string latest)
+    {
+        static string Core(string v) => v.Split('-', '+')[0];
+        return Version.TryParse(Core(installed), out var iv)
+            && Version.TryParse(Core(latest), out var lv)
+            && iv < lv;
+    }
+}

src/windows/Pipeline/TradingTerminal.Infrastructure/Plugins/Feed/PluginCatalogInstaller.cs

@@ -0,0 +1,97 @@
+using System.IO;
+using System.Net.Http;
+using Microsoft.Extensions.Logging;
+
+namespace TradingTerminal.Infrastructure.Plugins.Feed;
+
+/// <summary>
+/// Installs a plugin chosen from the marketplace catalog. It downloads the <c>.daxplugin</c> from the
+/// feed's URL, checks the downloaded bytes against the sha256 the SIGNED index declared — binding the
+/// trusted index to the bytes actually served, so a swapped or corrupted download is refused — and then
+/// hands the verified package to <see cref="PluginInstaller.InstallFromPackage"/>. From there it runs the
+/// identical package-integrity / manifest / SDK / trust / IL-scan gate chain as a hand-picked file, and
+/// activates on the next restart like any other install. Never throws: every failure comes back as a
+/// <see cref="PluginInstallResult"/> with <c>Success = false</c>.
+/// </summary>
+public static class PluginCatalogInstaller
+{
+    /// <summary>Ceiling on a downloaded package. A strategy plugin is a DLL plus a few private deps, not a
+    /// bundle — anything past this is refused before it is committed to disk (guards a lying/absent
+    /// Content-Length too).</summary>
+    public const long MaxPackageBytes = 64L * 1024 * 1024;
+
+    private const int CopyBufferBytes = 81920;
+
+    /// <summary>Downloads, checksum-verifies, and installs <paramref name="version"/> into
+    /// <paramref name="pluginsRoot"/> through the standard install gates.</summary>
+    public static async Task<PluginInstallResult> InstallAsync(
+        HttpClient http,
+        PluginFeedVersion version,
+        string pluginsRoot,
+        PluginTrustPolicy policy,
+        IPluginSignatureInspector inspector,
+        PluginStateStore? state = null,
+        ILogger? logger = null,
+        CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(version.Url))
+            return new PluginInstallResult(false, "This plugin has no download URL in the feed.");
+        if (string.IsNullOrWhiteSpace(version.Sha256))
+            return new PluginInstallResult(false,
+                "This plugin has no checksum in the feed — refusing to install unverified bytes.");
+
+        var tempPath = Path.Combine(
+            Path.GetTempPath(), "daxalgo-dl-" + Guid.NewGuid().ToString("N") + DaxPluginPackage.Extension);
+        try
+        {
+            var downloaded = await DownloadAsync(http, version.Url, tempPath, ct).ConfigureAwait(false);
+            if (!downloaded.Success) return downloaded;
+
+            var actual = PluginIntegrity.Sha256(tempPath);
+            if (!string.Equals(actual, version.Sha256, StringComparison.OrdinalIgnoreCase))
+            {
+                logger?.LogWarning(
+                    "Feed download checksum mismatch for {Url}: index says {Expected}, downloaded {Actual}.",
+                    version.Url, version.Sha256, actual);
+                return new PluginInstallResult(false,
+                    "The downloaded package does not match the checksum in the signed feed — install refused.");
+            }
+
+            return PluginInstaller.InstallFromPackage(tempPath, pluginsRoot, policy, inspector, state);
+        }
+        catch (Exception ex) when (ex is HttpRequestException or TaskCanceledException or IOException)
+        {
+            return new PluginInstallResult(false, $"Download failed: {ex.Message}");
+        }
+        finally
+        {
+            try { if (File.Exists(tempPath)) File.Delete(tempPath); } catch { /* best effort */ }
+        }
+    }
+
+    private static async Task<PluginInstallResult> DownloadAsync(
+        HttpClient http, string url, string destPath, CancellationToken ct)
+    {
+        using var response = await http
+            .GetAsync(url, HttpCompletionOption.ResponseHeadersRead, ct).ConfigureAwait(false);
+        if (!response.IsSuccessStatusCode)
+            return new PluginInstallResult(false, $"Download returned HTTP {(int)response.StatusCode} for {url}.");
+        if (response.Content.Headers.ContentLength is > MaxPackageBytes)
+            return new PluginInstallResult(false, $"Package is larger than the {MaxPackageBytes / (1024 * 1024)} MB limit.");
+
+        await using var source = await response.Content.ReadAsStreamAsync(ct).ConfigureAwait(false);
+        await using var dest = File.Create(destPath);
+
+        var buffer = new byte[CopyBufferBytes];
+        long total = 0;
+        int read;
+        while ((read = await source.ReadAsync(buffer, ct).ConfigureAwait(false)) > 0)
+        {
+            total += read;
+            if (total > MaxPackageBytes)
+                return new PluginInstallResult(false, $"Package exceeds the {MaxPackageBytes / (1024 * 1024)} MB limit.");
+            await dest.WriteAsync(buffer.AsMemory(0, read), ct).ConfigureAwait(false);
+        }
+        return new PluginInstallResult(true, "Downloaded.");
+    }
+}

src/windows/Pipeline/TradingTerminal.Infrastructure/Plugins/Feed/PluginRevocationSync.cs

@@ -0,0 +1,23 @@
+namespace TradingTerminal.Infrastructure.Plugins.Feed;
+
+/// <summary>
+/// Syncs the verified marketplace feed's <c>revoked[]</c> into the host's local kill-list
+/// (<see cref="PluginRevocationList"/> / <c>revoked.json</c>) so the loader enforces distribution-channel
+/// revocations on the next start — before any plugin code runs. This is the one place the "a plugin found
+/// bad after the fact" signal crosses from the feed into the load path. Only call it with an index that has
+/// already passed signature verification; a null / revocation-free index is a no-op.
+/// </summary>
+public static class PluginRevocationSync
+{
+    /// <summary>Merges the feed's revocations into <c>revoked.json</c> under <paramref name="pluginsRoot"/>.
+    /// Returns the number of entries now on the local kill-list (0 when the feed had none). Best-effort —
+    /// never throws.</summary>
+    public static int Apply(string pluginsRoot, PluginIndex? index)
+    {
+        var feedRevocations = index?.Revoked;
+        if (feedRevocations is not { Count: > 0 }) return 0;
+
+        var mapped = feedRevocations.Select(r => new RevokedPlugin(r.Sha256, r.Id, r.Reason));
+        return PluginRevocationList.Merge(pluginsRoot, mapped);
+    }
+}

src/windows/Pipeline/TradingTerminal.Infrastructure/Plugins/PluginRevocationList.cs

@@ -24,6 +24,7 @@ public sealed class PluginRevocationList
     public const string FileName = "revoked.json";
 
     private static readonly JsonSerializerOptions JsonOptions = new() { PropertyNameCaseInsensitive = true };
+    private static readonly JsonSerializerOptions WriteOptions = new() { WriteIndented = true };
 
     private readonly List<RevokedPlugin> _revoked;
 
@@ -74,6 +75,37 @@ public bool IsRevoked(string sha256, string? pluginId, out string? reason)
         return false;
     }
 
+    /// <summary>Rewrites <see cref="FileName"/> to the union of what's already there and
+    /// <paramref name="additional"/> (deduped by sha256+id; a later entry's reason text wins). This is how
+    /// the marketplace feed's <c>revoked[]</c> is synced into the local kill-list — see
+    /// <c>Feed.PluginRevocationSync</c>. Returns the number of entries now revoked. Best-effort and never
+    /// throws: on an I/O or serialization failure the file is left untouched and the pre-existing count is
+    /// returned.</summary>
+    public static int Merge(string pluginsRoot, IEnumerable<RevokedPlugin> additional)
+    {
+        var existing = Load(pluginsRoot)._revoked;
+        try
+        {
+            var byKey = new Dictionary<string, RevokedPlugin>(StringComparer.OrdinalIgnoreCase);
+            foreach (var entry in existing.Concat(additional))
+            {
+                if (string.IsNullOrWhiteSpace(entry.Sha256) && string.IsNullOrWhiteSpace(entry.Id)) continue;
+                byKey[$"{entry.Sha256}|{entry.Id}"] = entry;
+            }
+
+            var merged = byKey.Values.ToList();
+            Directory.CreateDirectory(pluginsRoot);
+            File.WriteAllText(
+                Path.Combine(pluginsRoot, FileName),
+                JsonSerializer.Serialize(new RevokedDto { Revoked = merged }, WriteOptions));
+            return merged.Count;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or JsonException)
+        {
+            return existing.Count;
+        }
+    }
+
     private sealed class RevokedDto
     {
         [JsonPropertyName("revoked")] public List<RevokedPlugin>? Revoked { get; set; }