`MarketplacePackagePage`'s third request — `listLocalInstalls` — is still ungated: it fires on a marketplace-off runtime and for a refused viewer

[os-sales]

Measured while implementing #5583, and deliberately left out of that PR: the card enumerated two requests and this is a third, gated on a different flag.

Observation

packages/app-shell/src/console/marketplace/MarketplacePackagePage.tsx has three fetch effects. After #5533 and #5583, two of them (getMarketplacePackage, getCloudInstallationInfo) are gated on marketplaceEnabled and on isAdmin. The third is gated on neither:

useEffect(() => {
 if (!getRuntimeConfig().features.installLocal) return;
 let cancelled = false;
 (async () => {
 const items = await listLocalInstalls();
 if (!cancelled) setLocalInstalls(items);
 })();
 return () => { cancelled = true; };
}, [packageId, localResult]);

listLocalInstalls is a real request — fetch(\${API_BASE}/install-local`)inmarketplaceApi.ts— and its only consumer islocalInstalls.find(...)in the **content** branch, which is unreachable whenever the page returnsMarketplaceDisabledorMarketplaceAccessDenied. So on any runtime with features.installLocal: true`:

• with features.marketplace: false, the request fires and the answer is discarded;
• for a non-admin, the same, now that the refusal is decided ahead of the load.

This is the same class #5533 closed for this page ("a request it knows it will not use should be skipped rather than fired and discarded") — one instance of it, on the flag that card was not about.

Not claimed

That it is an oversight rather than a decision. features.installLocal is a genuinely separate deployment axis from features.marketplace, and the local-kernel install list is not marketplace-proxy traffic, so there is a reading on which firing it unconditionally is intended. The correct shape is not pinned by anything currently in the tree, which is why this is filed rather than folded into #5583's PR as a bounded in-place fix.

Severity is low on its own terms: the request is try/catch-wrapped and returns [] on any failure, so the cost is one wasted round trip and one more line in an operator's network log, not a visible defect.

Refs

• MarketplacePackagePage decides "not an admin" only after the package load, so a non-admin sees a load-failure card instead of a refusal #5583 / its PR — gated the other two requests on isAdmin
• Marketplace package detail page still red-errors on a runtime with no marketplace — the disabled state stops at the catalog page #5533 — established the skip-the-request discipline on this page