fix: harden plugin feature gating (#15020)

1. Use requirement-resolved config.features as the plugin gate.
2. Guard plugin/list, plugin/read, and related flows behind that gate.
3. Skip bad marketplace.json files instead of failing the whole list.
4. Simplify plugin state and caching.
This commit is contained in:
xl-openai
2026-03-18 10:11:43 -07:00
committed by GitHub
parent 606d85055f
commit 580f32ad2a
40 changed files with 926 additions and 52 deletions

View File

@@ -2385,11 +2385,12 @@ impl Session {
&per_turn_config,
)
.await;
let skills_outcome = Arc::new(
let skills_outcome = Arc::new(crate::skills::filter_skill_load_outcome_for_session_source(
self.services
.skills_manager
.skills_for_config(&per_turn_config),
);
&session_configuration.session_source,
));
let mut turn_context: TurnContext = Self::make_turn_context(
Some(Arc::clone(&self.services.auth_manager)),
&self.services.session_telemetry,
@@ -4773,17 +4774,24 @@ mod handlers {
cwds: Vec<PathBuf>,
force_reload: bool,
) {
let cwds = if cwds.is_empty() {
let (cwds, session_source) = if cwds.is_empty() {
let state = sess.state.lock().await;
vec![state.session_configuration.cwd.clone()]
(
vec![state.session_configuration.cwd.clone()],
state.session_configuration.session_source.clone(),
)
} else {
cwds
let state = sess.state.lock().await;
(cwds, state.session_configuration.session_source.clone())
};
let skills_manager = &sess.services.skills_manager;
let mut skills = Vec::new();
for cwd in cwds {
let outcome = skills_manager.skills_for_cwd(&cwd, force_reload).await;
let outcome = crate::skills::filter_skill_load_outcome_for_session_source(
skills_manager.skills_for_cwd(&cwd, force_reload).await,
&session_source,
);
let errors = super::errors_to_info(&outcome.errors);
let skills_metadata = super::skills_to_info(&outcome.skills, &outcome.disabled_paths);
skills.push(SkillsListEntry {