fix(plugins): preserve bundled allowlist edges

src/agents/models-config.providers.plugin-allowlist-compat.test.ts

@@ -132,6 +132,27 @@ describe("implicit provider plugin allowlist compatibility", () => {
     ).toEqual(["openrouter"]);
   });
 
+  it("does not re-enable plugins when allowlist mode rejects every compat plugin", () => {
+    const config = withBundledPluginEnablementCompat({
+      config: {
+        plugins: {
+          enabled: false,
+          allow: ["openrouter"],
+          bundledDiscovery: "allowlist",
+        },
+      },
+      pluginIds: ["kilocode", "moonshot"],
+    });
+
+    expect(config).toEqual({
+      plugins: {
+        enabled: false,
+        allow: ["openrouter"],
+        bundledDiscovery: "allowlist",
+      },
+    });
+  });
+
   it("still honors explicit plugin denies over compat allowlist injection", () => {
     const config = withBundledPluginEnablementCompat({
       config: withBundledPluginAllowlistCompat({

src/plugins/bundled-compat.ts

@@ -46,14 +46,16 @@ export function withBundledPluginEnablementCompat(params: {
   const allow = params.config?.plugins?.allow;
   const allowSet =
     !useCompatDiscovery && Array.isArray(allow) && allow.length > 0 ? new Set(allow) : undefined;
+  let hasEligiblePlugin = false;
   let changed = false;
   const nextEntries: Record<string, PluginEntryConfig> = { ...existingEntries };
 
   for (const pluginId of params.pluginIds) {
-    if (existingEntries[pluginId] !== undefined) {
+    if (allowSet && !allowSet.has(pluginId)) {
       continue;
     }
-    if (allowSet && !allowSet.has(pluginId)) {
+    hasEligiblePlugin = true;
+    if (existingEntries[pluginId] !== undefined) {
       continue;
     }
     nextEntries[pluginId] = { enabled: true };
@@ -61,7 +63,7 @@ export function withBundledPluginEnablementCompat(params: {
   }
 
   if (!changed) {
-    if (!forcePluginsEnabled) {
+    if (!forcePluginsEnabled || !hasEligiblePlugin) {
       return params.config;
     }
   }

src/plugins/web-provider-public-artifacts.fallback.test.ts

@@ -152,4 +152,37 @@ describe("web provider public artifact manifest fallback", () => {
       pluginId: "fallback-fetch",
     });
   });
+
+  it("matches bundled web-search candidates through provider alias allowlist entries", () => {
+    mocks.resolveBundledExplicitWebSearchProvidersFromPublicArtifacts.mockReturnValueOnce(null);
+    mocks.loadPluginMetadataSnapshot.mockReturnValueOnce({
+      diagnostics: [],
+      plugins: [
+        {
+          id: "google",
+          origin: "bundled",
+          rootDir: "/tmp/google",
+          contracts: { webSearchProviders: ["gemini"] },
+        },
+      ],
+    });
+    mocks.loadBundledWebSearchProviderEntriesFromDir.mockReturnValueOnce([
+      { id: "gemini", pluginId: "google" },
+    ]);
+
+    const providers = resolveBundledWebSearchProvidersFromPublicArtifacts({
+      config: {
+        plugins: {
+          allow: ["google-gemini-cli"],
+          bundledDiscovery: "allowlist",
+        },
+      },
+    });
+
+    expect(providers).toEqual([{ id: "gemini", pluginId: "google" }]);
+    expect(mocks.loadBundledWebSearchProviderEntriesFromDir).toHaveBeenCalledWith({
+      dirName: "google",
+      pluginId: "google",
+    });
+  });
 });

src/plugins/web-provider-public-artifacts.ts

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { normalizePluginId } from "./config-state.js";
 import type { PluginLoadOptions } from "./loader.js";
 import { loadManifestMetadataSnapshot } from "./manifest-contract-eligibility.js";
 import type { PluginManifestRecord } from "./manifest-registry.js";
@@ -38,7 +39,9 @@ function filterAllowlistedBundledPluginIds(
   ) {
     return [...pluginIds];
   }
-  const allowedPluginIds = new Set(allow.map((pluginId) => pluginId.trim()).filter(Boolean));
+  const allowedPluginIds = new Set(
+    allow.map((pluginId) => normalizePluginId(pluginId)).filter(Boolean),
+  );
   return pluginIds.filter((pluginId) => allowedPluginIds.has(pluginId));
 }