Skip to content

Track all four Entire-shipped plugins, not just ci - #2541

Open
Soph wants to merge 2 commits into
mainfrom
soph/official-plugins-allowlist
Open

Soph wants to merge 2 commits into
mainfrom
soph/official-plugins-allowlist

Conversation

@Soph

@Soph Soph commented Sep 21, 2026

Copy link
Copy Markdown
Collaborator

https://entire.io/gh/entireio/cli/trails/1386

Follow-up to #2515. officialPlugins gates plugin telemetry — an invocation emits cli_plugin_executed only if its name is listed, and everything else runs silently. It was introduced with the note "currently empty — populate as Entire ships its own plugins", and external-commands.md documents appending to it as step 1 of publishing an Entire-owned command.

Only ci was ever added. graph, run and upgrade have all shipped and been invisible since; investigate joins them as it moves out of this repo.

 var officialPlugins = []string{
-	"ci", // entire-ci: customer-facing CI-integration management (entireio/entire-ci)
+	"ci",          // entireio/entire-ci: customer-facing CI-integration management
+	"graph",       // entireio/entire-graph: local code graph for symbol search and impact analysis
+	"investigate", // entireio/entire-investigate: multi-agent investigation
+	"run",         // entireio/entire-run: launch an Entire-enabled agent
+	"upgrade",     // entireio/entire-upgrade: upgrade the installed Entire binary
 }

Why investigate is the case that shows the cost

A built-in emits cli_command_executed from the root's PersistentPostRun, so entire investigate was tracked for as long as it lived here. As a plugin it emits nothing unless listed — so extracting it ends the measurement rather than preserving it. That matters for a command whose usage data was the evidence used to decide how to extract it in the first place, and it is now installable by name, so usage may well change.

What is and isn't sent

Unchanged and deliberately thin: plugin, command, cli_version, os, arch, isEntireEnabled. No args, no flags. Only on exit 0, only when settings.Telemetry is true and ENTIRE_TELEMETRY_OPTOUT is unset.

The allowlist exists because third-party plugin names can carry project or vendor identifiers. These four are Entire-owned names and carry none.

Two constants come along

investigate as a literal would have been its third occurrence in the package and tripped goconst. The fix follows what review already does rather than inventing a shape — it has both cmdReview and sessionKindLabelReview:

  • cmdInvestigate in names.go, for the command a user types (labs.go's CommandPath)
  • sessionKindLabelInvestigate beside sessionKindLabelReview, for the label in a log line (lifecycle.go's kindLabel)

Separate constants because those two are free to diverge. The names.go diff is mostly gofmt realigning the const block. The allowlist itself stays plain literals, consistent with its siblings — once the other two occurrences became constants, the literal here is no longer the third.

A guard on the shipped list

TestIsOfficialPlugin snapshots the allowlist away so it stays independent of shipped plugins, which means nothing checked the real contents. A malformed entry fails silently: IsOfficialPlugin never matches, the plugin runs untracked, and the only symptom is telemetry that never arrives.

The new test validates the shipped list against the dispatcher's own validatePluginName rules, rejects duplicates, and pins the alphabetical order. I verified it actually fires rather than assuming — it catches a reserved agent- prefix, a leading -, and a repeated name.

Note it cannot catch a plain misspelling (investigateX is a perfectly valid plugin name), and deliberately does not cross-check the remote index: this list is hardcoded on purpose.

Notes

🤖 Generated with Claude Code


Note

Low Risk
Changes are limited to telemetry gating, shared command-name constants, and tests; no auth, data handling, or dispatch behavior beyond recording usage for allowlisted plugins.

Overview
Expands the official plugin telemetry allowlist so Entire-shipped external commands (graph, investigate, run, upgrade) emit cli_plugin_executed on success, not only ci. That matters especially for investigate as it moves to entire-investigate: built-in commands were tracked via cli_command_executed, but plugin invocations were silent unless listed here.

Introduces cmdInvestigate in names.go (used in labs experimental paths) and sessionKindLabelInvestigate in lifecycle env adoption, matching the existing review / sessionKindLabelReview split so command names and log labels can diverge without tripping goconst.

Adds TestOfficialPlugins_ShippedListIsWellFormed to validate the real shipped list: each name passes validatePluginName, no duplicates, and alphabetical order—catching silent telemetry gaps from malformed allowlist entries.

Reviewed by Cursor Bugbot for commit b041912. Configure here.

officialPlugins gates plugin telemetry: an invocation emits
cli_plugin_executed only if its name is listed, and everything else runs
silently. The list was introduced with the note "currently empty — populate
as Entire ships its own plugins", and external-commands.md documents
appending to it as step 1 of publishing an Entire-owned command. Only `ci`
was ever added, so `graph`, `run` and `upgrade` have shipped and been
invisible; `investigate` joins them as it moves out of this repo.

That last one is the case that shows the cost. A built-in emits
cli_command_executed from the root's PersistentPostRun, so `entire
investigate` was tracked for as long as it lived here. As a plugin it emits
nothing unless listed — so extracting it silently ends the measurement
rather than preserving it, which matters for a command whose usage was the
evidence for how to extract it.

The payload is unchanged and deliberately thin: plugin name, command,
cli_version, os, arch, isEntireEnabled, no args or flags, only on exit 0 and
only under the existing opt-in. These four names are Entire-owned and carry
none of the project or vendor identifiers the allowlist exists to keep out.

`investigate` is inert here until #2515 lands, since a built-in wins
dispatch and the plugin path never runs.

Two constants come with it. `investigate` as a literal would have been its
third occurrence in the package and tripped goconst, and the fix follows
what `review` already does rather than inventing a shape: cmdInvestigate in
names.go for the command a user types, sessionKindLabelInvestigate beside
sessionKindLabelReview for the label in a log line. They are separate
because those two are free to diverge.

TestIsOfficialPlugin snapshots the list away, so nothing checked the shipped
contents. A malformed entry fails silently — IsOfficialPlugin simply never
matches and the telemetry never arrives — so the new test validates the real
list against the dispatcher's own name rules, rejects duplicates, and pins
the alphabetical order. Verified it catches a reserved `agent-` prefix, a
leading `-`, and a repeated name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M31P9G5NA6GWQDQTCZYFF4MM
@Soph
Soph requested a review from a team as a code owner September 21, 2026 09:56
Copilot AI lite review requested due to automatic review settings September 21, 2026 09:56

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

No unresolved review issues remain.

Review effort: Lite
Findings: None

What changed in this PR

Expands telemetry tracking to all Entire-shipped plugins and centralizes investigate naming constants.

Changes:

  • Adds graph, investigate, run, and upgrade to the official plugin allowlist.
  • Validates plugin names, duplicates, and ordering.
  • Reuses shared investigate constants.
File Summary
cmd/​entire/​cli/​plugin_official.go Expands the telemetry allowlist.
cmd/​entire/​cli/​plugin_official_test.go Validates shipped plugin entries.
cmd/​entire/​cli/​names.go Adds the investigate command constant.
cmd/​entire/​cli/​lifecycle.go Adds the investigate session-label constant.
cmd/​entire/​cli/​labs.go Uses the shared investigate constant.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

#2515 landed on main and removed the investigate entry from labs.go, which
this branch had edited to use a constant — the one conflict, resolved by
taking main's deletion.

That merge also moved the goconst pressure rather than removing it. The
three occurrences of the `investigate` literal are now lifecycle.go's
kindLabel, plugin.go's onDemandInstallPluginNames (which arrived with
#2515), and the allowlist entry this branch adds. So the constants this
branch introduced before the merge are the wrong ones: cmdInvestigate and
sessionKindLabelInvestigate are both reverted, and a single
investigatePluginName in plugin.go — beside selfUpdatePluginName, whose
single use makes that the established shape there — takes the dispatcher's
occurrence out of the count.

That leaves two literals, below the threshold, and keeps officialPlugins a
uniform table of plain strings rather than one symbol among four literals.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M31QY4ZDYWFPBD8R0YH9CDRS
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants