From 3db407da40a0ad20bbee8845fcbf5d05e1409c07 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 27 Apr 2026 11:15:56 +0100
Subject: [PATCH] test(security): cover bundled plugin allowlist audit

---
 src/security/audit-plugins-trust.test.ts | 41 +++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/src/security/audit-plugins-trust.test.ts b/src/security/audit-plugins-trust.test.ts
index 8a0d6651edc..217114204f2 100644
--- a/src/security/audit-plugins-trust.test.ts
+++ b/src/security/audit-plugins-trust.test.ts
@@ -19,6 +19,16 @@ const mockChannelPlugins = vi.hoisted(() => [
     },
   },
 ]);
+const mockPluginRegistryIds = vi.hoisted(() => [
+  "active-memory",
+  "anthropic",
+  "brave",
+  "discord",
+  "google",
+  "lmstudio",
+  "memory-core",
+  "ollama",
+]);
 
 const readInstalledPackageVersionMock = vi.hoisted(() =>
   vi.fn(async (dir: string) => {
@@ -87,7 +97,7 @@ vi.mock("../plugins/plugin-registry.js", () => ({
   createPluginRegistryIdNormalizer: () => (id: string) => id,
   loadPluginRegistrySnapshot: () => ({
     diagnostics: [],
-    plugins: [{ pluginId: "discord" }],
+    plugins: mockPluginRegistryIds.map((pluginId) => ({ pluginId })),
   }),
 }));
 
@@ -349,6 +359,35 @@ describe("security audit install metadata findings", () => {
     expect(phantomFinding?.detail).toContain("ghost-plugin-xyz");
     expect(phantomFinding?.detail).not.toContain("installed-plugin");
   });
+
+  it("does not report bundled provider and utility plugins as phantom allowlist entries", async () => {
+    const stateDir = await makeTmpDir("phantom-bundled-providers");
+    await fs.mkdir(path.join(stateDir, "extensions", "installed-plugin"), {
+      recursive: true,
+    });
+
+    const findings = await runInstallMetadataAudit(
+      {
+        plugins: {
+          allow: [
+            "active-memory",
+            "anthropic",
+            "brave",
+            "google",
+            "lmstudio",
+            "memory-core",
+            "ollama",
+            "installed-plugin",
+          ],
+        },
+      },
+      stateDir,
+    );
+
+    expect(
+      findings.find((finding) => finding.checkId === "plugins.allow_phantom_entries"),
+    ).toBeUndefined();
+  });
 });
 
 describe("security audit extension tool reachability findings", () => {