Documentation / Design Issue

Version: 2026.3.24 / 2026.3.28-beta.1

Summary

The plugins.allow config field is documented (implicitly) as a trust allowlist for third-party/external plugins. However, it also gates bundled channel plugins (telegram, whatsapp, discord, etc.) when the list is non-empty. This is counterintuitive and undocumented.

The Problem

Users reasonably expect:

• plugins.allow = controls which third-party plugins are trusted
• Bundled channel plugins = always available if channels.telegram.enabled: true

The actual behavior:

• plugins.allow = controls ALL plugins including bundled channels
• If any value is in plugins.allow, ALL plugins not in the list are disabled
• A user managing third-party plugins who modifies plugins.allow will silently break their channels

Suggested Fix

Either:

1. Document this clearly — add to docs/config reference that bundled channel plugins must be included in plugins.allow when the list is non-empty
2. Change the semantics — bundled channel plugins with valid channel config should be exempt from the allowlist check, or auto-added when a channel is configured
3. Warn clearly — if a channel is configured but its plugin is not in plugins.allow, emit a prominent warning at startup

Related

This is the root cause behind issue #56714 (silent channel disable). Fixing the documentation would have reduced a 2.5-hour debugging session to a 5-minute config check.