From 2ba5e7ebf9cdeffb8acbd77ecc0284c3316feebe Mon Sep 17 00:00:00 2001
From: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
Date: Fri, 27 Mar 2026 22:42:22 -0500
Subject: [PATCH] fix(regression): align plugin inspect policy with
 auto-enabled config

---
 src/plugins/status.test.ts | 42 ++++++++++++++++++++++++++++++++++++++
 src/plugins/status.ts      | 21 +++++++++++++------
 2 files changed, 57 insertions(+), 6 deletions(-)

diff --git a/src/plugins/status.test.ts b/src/plugins/status.test.ts
index 53f12cd81fe..d5ef81df9c7 100644
--- a/src/plugins/status.test.ts
+++ b/src/plugins/status.test.ts
@@ -182,6 +182,48 @@ describe("buildPluginStatusReport", () => {
     );
   });
 
+  it("uses the auto-enabled config snapshot for inspect policy summaries", () => {
+    const rawConfig = {
+      plugins: {},
+      channels: { demo: { enabled: true } },
+    };
+    const autoEnabledConfig = {
+      ...rawConfig,
+      plugins: {
+        entries: {
+          demo: {
+            enabled: true,
+            subagent: {
+              allowModelOverride: true,
+              allowedModels: ["openai/gpt-5.4"],
+              hasAllowedModelsConfig: true,
+            },
+          },
+        },
+      },
+    };
+    applyPluginAutoEnableMock.mockReturnValue({ config: autoEnabledConfig, changes: [] });
+    setSinglePluginLoadResult(
+      createPluginRecord({
+        id: "demo",
+        name: "Demo",
+        description: "Auto-enabled plugin",
+        origin: "bundled",
+        providerIds: ["demo"],
+      }),
+    );
+
+    const inspect = buildPluginInspectReport({ id: "demo", config: rawConfig });
+
+    expect(inspect).not.toBeNull();
+    expect(inspect?.policy).toEqual({
+      allowPromptInjection: undefined,
+      allowModelOverride: true,
+      allowedModels: ["openai/gpt-5.4"],
+      hasAllowedModelsConfig: true,
+    });
+  });
+
   it("applies the full bundled provider compat chain before loading plugins", () => {
     const config = { plugins: { allow: ["telegram"] } };
     loadConfigMock.mockReturnValue(config);
diff --git a/src/plugins/status.ts b/src/plugins/status.ts
index 46dde5557ff..e9ee361c1da 100644
--- a/src/plugins/status.ts
+++ b/src/plugins/status.ts
@@ -123,6 +123,16 @@ function buildCompatibilityNoticesForInspect(
 
 const log = createSubsystemLogger("plugins");
 
+function resolveStatusConfig(
+  config: ReturnType<typeof loadConfig>,
+  env: NodeJS.ProcessEnv | undefined,
+) {
+  return applyPluginAutoEnable({
+    config,
+    env: env ?? process.env,
+  }).config;
+}
+
 function resolveReportedPluginVersion(
   plugin: PluginRegistry["plugins"][number],
   env: NodeJS.ProcessEnv | undefined,
@@ -144,10 +154,7 @@ export function buildPluginStatusReport(params?: {
   env?: NodeJS.ProcessEnv;
 }): PluginStatusReport {
   const rawConfig = params?.config ?? loadConfig();
-  const config = applyPluginAutoEnable({
-    config: rawConfig,
-    env: params?.env ?? process.env,
-  }).config;
+  const config = resolveStatusConfig(rawConfig, params?.env);
   const workspaceDir = params?.workspaceDir
     ? params.workspaceDir
     : (resolveAgentWorkspaceDir(config, resolveDefaultAgentId(config)) ??
@@ -240,7 +247,8 @@ export function buildPluginInspectReport(params: {
   env?: NodeJS.ProcessEnv;
   report?: PluginStatusReport;
 }): PluginInspectReport | null {
-  const config = params.config ?? loadConfig();
+  const rawConfig = params.config ?? loadConfig();
+  const config = resolveStatusConfig(rawConfig, params.env);
   const report =
     params.report ??
     buildPluginStatusReport({
@@ -373,7 +381,8 @@ export function buildAllPluginInspectReports(params?: {
   env?: NodeJS.ProcessEnv;
   report?: PluginStatusReport;
 }): PluginInspectReport[] {
-  const config = params?.config ?? loadConfig();
+  const rawConfig = params?.config ?? loadConfig();
+  const config = resolveStatusConfig(rawConfig, params?.env);
   const report =
     params?.report ??
     buildPluginStatusReport({