4. Plugin install is a 40-slug allowlist, fail-closed

Status: Accepted
Date: 2026-08-15

Context

wordpress.org is not a reviewed-safe catalog. A malicious plugin looks fine in preview and only phones home after deploy. The agent will eventually install plugins, but must not be able to in the MVP either (R2).

Decision

The agent may install only from a written ~40-slug allowlist (spikes/plugin-catalog.md), and only via wp plugin install <slug>. No URLs, no zips, no premium marketplaces. Unknown slug → refuse. A detect-only list (Wordfence, Jetpack, cache suites) is never installed.

Options considered

Open wordpress.org search.
Written allowlist now; reputation/egress gate later (Sprint 9).
No wall until the install playbook exists.

Rejected

Open search — reintroduces R2.
No wall until later — the MVP agent could still wp plugin install <url> unless the tool schema forbids it from day one.

Consequences

Sprint 3 tool-schemas.ts must forbid wp plugin install http and unknown slugs even though no install playbook ships in MVP.
Reputation gate, zip SHA, and egress watch on first activate are Sprint 9 scope, already specced.
Catalog changes are PRs, not prompt edits.

1.2 KiB Raw Permalink Blame History