merge: Campaign LA LA5 - plugin hosting review-closed

src/AcDream.Launcher.Core/Launching/SessionConfigComposer.cs

@@ -132,7 +132,9 @@ public static class SessionConfigComposer
             Character = selector,
             Policy = policy,
             Credential = new SessionCredentialDescriptor(),
-            Plugins = character.Plugins.Count > 0 ? [.. character.Plugins] : null,
+            // LA5 distinguishes an omitted allow-list (load all, preserving
+            // the developer flow) from an explicit empty list (load none).
+            Plugins = [.. character.Plugins],
             LoginCommands = character.LoginCommands.Count > 0
                 ? [.. character.LoginCommands]
                 : null,
@@ -165,9 +167,9 @@ public static class SessionConfigComposer
     /// §LA3 review finding F2): the session carries <c>mode: "probe"</c>,
     /// no <c>character</c> selector, and no <c>policy</c> — the host
     /// reports the account's character roster over the status stream and
-    /// exits without entering the world. <c>plugins</c>/<c>loginCommands</c>
-    /// don't apply to a probe and are always omitted, exactly like an
-    /// empty configured set on a normal session.
+    /// exits without entering the world. Probes carry an explicit empty
+    /// <c>plugins</c> allow-list so a plugin installed on the machine cannot
+    /// run merely because the probe has no character-level plugin settings.
     /// </summary>
     public static ComposedSessionConfig ComposeProbe(
         ServerProfile server,
@@ -197,7 +199,7 @@ public static class SessionConfigComposer
             Character = null,
             Policy = null,
             Credential = new SessionCredentialDescriptor(),
-            Plugins = null,
+            Plugins = [],
             LoginCommands = null,
             LoginCommandDelayMs = null,
             StatusFile = statusFilePath,

src/AcDream.Launcher.Core/Launching/SessionConfigDocument.cs

@@ -98,8 +98,10 @@ public sealed class SessionDescriptor
 
     public SessionCredentialDescriptor Credential { get; init; } = new();
 
-    /// <summary>Omitted (never an empty array) when the character has no
-    /// configured plugin set.</summary>
+    /// <summary>Plugin allow-list. Omitted or JSON <c>null</c> means load all
+    /// discovered plugins (the developer flow); an explicit empty array means
+    /// load none. Launcher-composed normal-empty and probe sessions therefore
+    /// emit <c>[]</c>.</summary>
     public List<string>? Plugins { get; init; }
 
     /// <summary>Omitted (never an empty array) when the character has no