feat: disable plugins by default, require admin approval

lib/plugin-loader.ts

@@ -8,7 +8,7 @@ import React from 'react';
 import ReactDOM from 'react-dom';
 import * as ReactJSX from 'react/jsx-runtime';
 
-// ─── Shared React (window.__PLUGIN_EXTERNALS__) ─────────────
+// --- Shared React (window.__PLUGIN_EXTERNALS__) -------------
 
 export function exposePluginExternals(): void {
   if (typeof window === 'undefined') return;
@@ -20,7 +20,7 @@ export function exposePluginExternals(): void {
   };
 }
 
-// ─── Active plugin tracking ──────────────────────────────────
+// --- Active plugin tracking ----------------------------------
 
 interface ActivePlugin {
   id: string;
@@ -31,7 +31,7 @@ interface ActivePlugin {
 
 const activePlugins = new Map<string, ActivePlugin>();
 
-// ─── Load a single plugin ────────────────────────────────────
+// --- Load a single plugin ------------------------------------
 
 type PluginStoreAccessor = {
   setPluginStatus: (id: string, status: InstalledPlugin['status'], error?: string) => void;
@@ -101,7 +101,7 @@ export async function loadPlugin(plugin: InstalledPlugin): Promise<void> {
   }
 }
 
-// ─── Deactivate a single plugin ──────────────────────────────
+// --- Deactivate a single plugin ------------------------------
 
 export function deactivatePlugin(pluginId: string): void {
   const active = activePlugins.get(pluginId);
@@ -127,7 +127,7 @@ export function deactivatePlugin(pluginId: string): void {
   console.info(`[plugin-loader] Plugin "${pluginId}" deactivated`);
 }
 
-// ─── Activate all enabled plugins ────────────────────────────
+// --- Activate all enabled plugins ----------------------------
 
 export async function activateAllPlugins(plugins: InstalledPlugin[]): Promise<void> {
   // Ensure externals are exposed
@@ -139,7 +139,7 @@ export async function activateAllPlugins(plugins: InstalledPlugin[]): Promise<vo
   }
 }
 
-// ─── Deactivate all plugins ─────────────────────────────────
+// --- Deactivate all plugins ---------------------------------
 
 export function deactivateAllPlugins(): void {
   for (const pluginId of [...activePlugins.keys()]) {
@@ -147,13 +147,13 @@ export function deactivateAllPlugins(): void {
   }
 }
 
-// ─── Check if a plugin is active ─────────────────────────────
+// --- Check if a plugin is active -----------------------------
 
 export function isPluginActive(pluginId: string): boolean {
   return activePlugins.has(pluginId);
 }
 
-// ─── Setup auto-disable callback ─────────────────────────────
+// --- Setup auto-disable callback -----------------------------
 
 export function setupAutoDisable(): void {
   pluginErrorTracker.setAutoDisableCallback((pluginId) => {