From 51c7f544f34919b5f46dc4630345a090e9b43e5e Mon Sep 17 00:00:00 2001
From: Shakker <shakkerdroid@gmail.com>
Date: Mon, 27 Apr 2026 17:34:44 +0100
Subject: [PATCH] fix: reject unscoped workspace plugin metadata

---
 src/plugins/current-plugin-metadata-snapshot.test.ts | 10 +++++++++-
 src/plugins/current-plugin-metadata-snapshot.ts      |  3 +++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/plugins/current-plugin-metadata-snapshot.test.ts b/src/plugins/current-plugin-metadata-snapshot.test.ts
index 4a1a5bf2f0e..fef5bd902bf 100644
--- a/src/plugins/current-plugin-metadata-snapshot.test.ts
+++ b/src/plugins/current-plugin-metadata-snapshot.test.ts
@@ -67,7 +67,7 @@ describe("current plugin metadata snapshot", () => {
     expect(getCurrentPluginMetadataSnapshot({ config, workspaceDir: "/workspace/a" })).toBe(
       snapshot,
     );
-    expect(getCurrentPluginMetadataSnapshot({ config })).toBe(snapshot);
+    expect(getCurrentPluginMetadataSnapshot({ config })).toBeUndefined();
     expect(
       getCurrentPluginMetadataSnapshot({
         config: { plugins: { allow: ["other"] } },
@@ -79,6 +79,14 @@ describe("current plugin metadata snapshot", () => {
     ).toBeUndefined();
   });
 
+  it("rejects a workspace-scoped snapshot when the caller does not provide workspace scope", () => {
+    const config = { plugins: { allow: ["demo"] } };
+    const snapshot = createSnapshot({ config, workspaceDir: "/workspace/a" });
+    setCurrentPluginMetadataSnapshot(snapshot, { config });
+
+    expect(getCurrentPluginMetadataSnapshot({ config })).toBeUndefined();
+  });
+
   it("rejects a current snapshot when plugin load paths change", () => {
     const config = { plugins: { load: { paths: ["/plugins/one"] } } };
     const snapshot = createSnapshot({ config });
diff --git a/src/plugins/current-plugin-metadata-snapshot.ts b/src/plugins/current-plugin-metadata-snapshot.ts
index 63d6ac98306..1fd1ed61223 100644
--- a/src/plugins/current-plugin-metadata-snapshot.ts
+++ b/src/plugins/current-plugin-metadata-snapshot.ts
@@ -63,6 +63,9 @@ export function getCurrentPluginMetadataSnapshot(
   ) {
     return undefined;
   }
+  if (snapshot.workspaceDir !== undefined && params.workspaceDir === undefined) {
+    return undefined;
+  }
   if (
     params.workspaceDir !== undefined &&
     (snapshot.workspaceDir ?? "") !== (params.workspaceDir ?? "")