feat: disable plugins by default, require admin approval

stores/plugin-store.ts

@@ -94,6 +94,7 @@ export const usePluginStore = create<PluginStoreState>()(
           status: 'installed',
           managed: false,
           forceEnabled: false,
+          adminApproved: false, // Requires admin approval before it can be enabled
           settings: existing?.settings ?? {},
           settingsSchema: manifest.settingsSchema,
         };
@@ -144,6 +145,11 @@ export const usePluginStore = create<PluginStoreState>()(
         const plugin = plugins.find(p => p.id === id);
         if (!plugin) return;
 
+        // Block enabling if plugin requires admin approval and hasn't been approved
+        const requireApproval = usePolicyStore.getState().isFeatureEnabled('requirePluginApproval');
+        const isApproved = plugin.adminApproved || plugin.managed || usePolicyStore.getState().isPluginApproved(id);
+        if (requireApproval && !isApproved) return;
+
         // Ensure bridges are wired before loading (may not have run initializePlugins yet)
         setPluginStoreAccessor({ setPluginStatus: get().setPluginStatus });
         setSlotRegistrationBridge(get().registerSlot);
@@ -393,6 +399,7 @@ async function syncServerPlugins(
           status: sp.forceEnabled ? 'enabled' : 'installed',
           managed: true,
           forceEnabled: sp.forceEnabled,
+          adminApproved: true, // Server-managed plugins are always approved
           settings: {},
         };
 

stores/policy-store.ts

@@ -15,6 +15,7 @@ interface PolicyState {
   getForcedThemeId: (availableThemeIds?: string[]) => string | null;
   isThemeDisabled: (themeId: string, isBuiltIn: boolean) => boolean;
   isPluginForceEnabled: (pluginId: string) => boolean;
+  isPluginApproved: (pluginId: string) => boolean;
   isThemeForceEnabled: (themeId: string) => boolean;
 }
 
@@ -84,6 +85,10 @@ export const usePolicyStore = create<PolicyState>()((set, get) => ({
     return (get().policy.forceEnabledPlugins || []).includes(pluginId);
   },
 
+  isPluginApproved: (pluginId) => {
+    return (get().policy.approvedPlugins || []).includes(pluginId);
+  },
+
   isThemeForceEnabled: (themeId) => {
     return (get().policy.forceEnabledThemes || []).includes(themeId);
   },