fix(plugins): preserve bundled allowlist edges

steipete · steipete · commit c6d811eb8f48 · 2026-05-04T23:35:20.000+01:00
diff --git a/docs/.generated/config-baseline.sha256 b/docs/.generated/config-baseline.sha256
@@ -1,4 +1,4 @@
-02987f4cecb64a98170b61c925fd7b16a22b276abfb261f9281b42f613ded923  config-baseline.json
-de5a6f65ef09dc23453a2e12512e41c133c941519e0ebef7f2946e4a24265d17  config-baseline.core.json
+2566cb33c48abf3884d44cc605e3fe23ee3dc3e998c29fe86dfe773faf58cb52  config-baseline.json
+eab2f8a9af31910e26874209330d10ca46afd910cba88beda8a48fe6b9831159  config-baseline.core.json
 cd7c0c7fb1435bc7e59099e9ac334462d5ad444016e9ab4512aae63a238f78dc  config-baseline.channel.json
 9832b30a696930a3da7efccf38073137571e1b66cae84e54d747b733fdafcc54  config-baseline.plugin.json
diff --git a/src/agents/models-config.providers.plugin-allowlist-compat.test.ts b/src/agents/models-config.providers.plugin-allowlist-compat.test.ts
@@ -132,6 +132,27 @@ describe("implicit provider plugin allowlist compatibility", () => {
     ).toEqual(["openrouter"]);
   });
 
+  it("does not re-enable plugins when allowlist mode rejects every compat plugin", () => {
+    const config = withBundledPluginEnablementCompat({
+      config: {
+        plugins: {
+          enabled: false,
+          allow: ["openrouter"],
+          bundledDiscovery: "allowlist",
+        },
+      },
+      pluginIds: ["kilocode", "moonshot"],
+    });
+
+    expect(config).toEqual({
+      plugins: {
+        enabled: false,
+        allow: ["openrouter"],
+        bundledDiscovery: "allowlist",
+      },
+    });
+  });
+
   it("still honors explicit plugin denies over compat allowlist injection", () => {
     const config = withBundledPluginEnablementCompat({
       config: withBundledPluginAllowlistCompat({
diff --git a/src/plugins/bundled-compat.ts b/src/plugins/bundled-compat.ts
@@ -46,22 +46,24 @@ export function withBundledPluginEnablementCompat(params: {
   const allow = params.config?.plugins?.allow;
   const allowSet =
     !useCompatDiscovery && Array.isArray(allow) && allow.length > 0 ? new Set(allow) : undefined;
+  let hasEligiblePlugin = false;
   let changed = false;
   const nextEntries: Record<string, PluginEntryConfig> = { ...existingEntries };
 
   for (const pluginId of params.pluginIds) {
-    if (existingEntries[pluginId] !== undefined) {
+    if (allowSet && !allowSet.has(pluginId)) {
       continue;
     }
-    if (allowSet && !allowSet.has(pluginId)) {
+    hasEligiblePlugin = true;
+    if (existingEntries[pluginId] !== undefined) {
       continue;
     }
     nextEntries[pluginId] = { enabled: true };
     changed = true;
   }
 
   if (!changed) {
-    if (!forcePluginsEnabled) {
+    if (!forcePluginsEnabled || !hasEligiblePlugin) {
       return params.config;
     }
   }
diff --git a/src/plugins/web-provider-public-artifacts.fallback.test.ts b/src/plugins/web-provider-public-artifacts.fallback.test.ts
@@ -152,4 +152,37 @@ describe("web provider public artifact manifest fallback", () => {
       pluginId: "fallback-fetch",
     });
   });
+
+  it("matches bundled web-search candidates through provider alias allowlist entries", () => {
+    mocks.resolveBundledExplicitWebSearchProvidersFromPublicArtifacts.mockReturnValueOnce(null);
+    mocks.loadPluginMetadataSnapshot.mockReturnValueOnce({
+      diagnostics: [],
+      plugins: [
+        {
+          id: "google",
+          origin: "bundled",
+          rootDir: "/tmp/google",
+          contracts: { webSearchProviders: ["gemini"] },
+        },
+      ],
+    });
+    mocks.loadBundledWebSearchProviderEntriesFromDir.mockReturnValueOnce([
+      { id: "gemini", pluginId: "google" },
+    ]);
+
+    const providers = resolveBundledWebSearchProvidersFromPublicArtifacts({
+      config: {
+        plugins: {
+          allow: ["google-gemini-cli"],
+          bundledDiscovery: "allowlist",
+        },
+      },
+    });
+
+    expect(providers).toEqual([{ id: "gemini", pluginId: "google" }]);
+    expect(mocks.loadBundledWebSearchProviderEntriesFromDir).toHaveBeenCalledWith({
+      dirName: "google",
+      pluginId: "google",
+    });
+  });
 });
diff --git a/src/plugins/web-provider-public-artifacts.ts b/src/plugins/web-provider-public-artifacts.ts
@@ -1,4 +1,5 @@
 import path from "node:path";
+import { normalizePluginId } from "./config-state.js";
 import type { PluginLoadOptions } from "./loader.js";
 import { loadManifestMetadataSnapshot } from "./manifest-contract-eligibility.js";
 import type { PluginManifestRecord } from "./manifest-registry.js";
@@ -38,7 +39,9 @@ function filterAllowlistedBundledPluginIds(
   ) {
     return [...pluginIds];
   }
-  const allowedPluginIds = new Set(allow.map((pluginId) => pluginId.trim()).filter(Boolean));
+  const allowedPluginIds = new Set(
+    allow.map((pluginId) => normalizePluginId(pluginId)).filter(Boolean),
+  );
   return pluginIds.filter((pluginId) => allowedPluginIds.has(pluginId));
 }
 

Original file line number	Diff line number	Diff line change
`@@ -46,22 +46,24 @@ export function withBundledPluginEnablementCompat(params: {`
`46`	`46`	`const allow = params.config?.plugins?.allow;`
`47`	`47`	`const allowSet =`
`48`	`48`	`!useCompatDiscovery && Array.isArray(allow) && allow.length > 0 ? new Set(allow) : undefined;`
	`49`	`+ let hasEligiblePlugin = false;`
`49`	`50`	`let changed = false;`
`50`	`51`	`const nextEntries: Record<string, PluginEntryConfig> = { ...existingEntries };`
`51`	`52`
`52`	`53`	`for (const pluginId of params.pluginIds) {`
`53`		`- if (existingEntries[pluginId] !== undefined) {`
	`54`	`+ if (allowSet && !allowSet.has(pluginId)) {`
`54`	`55`	`continue;`
`55`	`56`	`}`
`56`		`- if (allowSet && !allowSet.has(pluginId)) {`
	`57`	`+ hasEligiblePlugin = true;`
	`58`	`+ if (existingEntries[pluginId] !== undefined) {`
`57`	`59`	`continue;`
`58`	`60`	`}`
`59`	`61`	`nextEntries[pluginId] = { enabled: true };`
`60`	`62`	`changed = true;`
`61`	`63`	`}`
`62`	`64`
`63`	`65`	`if (!changed) {`
`64`		`- if (!forcePluginsEnabled) {`
	`66`	`+ if (!forcePluginsEnabled \|\| !hasEligiblePlugin) {`
`65`	`67`	`return params.config;`
`66`	`68`	`}`
`67`	`69`	`}`