fix: harden telegram and loader contracts

Author: steipete

extensions/telegram/src/bot.create-telegram-bot.test-harness.ts

@@ -214,8 +214,12 @@ vi.mock("grammy", () => ({
 }));
 
 const runnerHoisted = vi.hoisted(() => ({
-  sequentializeMiddleware: vi.fn(),
-  sequentializeSpy: vi.fn(),
+  sequentializeMiddleware: vi.fn(async (_ctx: unknown, next?: () => Promise<void>) => {
+    if (typeof next === "function") {
+      await next();
+    }
+  }),
+  sequentializeSpy: vi.fn(() => runnerHoisted.sequentializeMiddleware),
   throttlerSpy: vi.fn(() => "throttler"),
 }));
 export const sequentializeSpy: AnyMock = runnerHoisted.sequentializeSpy;
@@ -355,7 +359,14 @@ beforeEach(() => {
   listSkillCommandsForAgents.mockReset();
   listSkillCommandsForAgents.mockReturnValue([]);
   middlewareUseSpy.mockReset();
+  runnerHoisted.sequentializeMiddleware.mockReset();
+  runnerHoisted.sequentializeMiddleware.mockImplementation(async (_ctx, next) => {
+    if (typeof next === "function") {
+      await next();
+    }
+  });
   sequentializeSpy.mockReset();
+  sequentializeSpy.mockImplementation(() => runnerHoisted.sequentializeMiddleware);
   botCtorSpy.mockReset();
   sequentializeKey = undefined;
 });

src/plugins/contracts/loader.contract.test.ts

@@ -1,17 +1,27 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { withBundledPluginAllowlistCompat } from "../bundled-compat.js";
+import { loadPluginManifestRegistry } from "../manifest-registry.js";
 import { __testing as providerTesting } from "../providers.js";
 import { resolvePluginWebSearchProviders } from "../web-search-providers.js";
 import { providerContractCompatPluginIds, webSearchProviderContractRegistry } from "./registry.js";
 import { uniqueSortedStrings } from "./testkit.js";
 
+function resolveBundledManifestProviderPluginIds() {
+  return uniqueSortedStrings(
+    loadPluginManifestRegistry({})
+      .plugins.filter((plugin) => plugin.origin === "bundled" && plugin.providers.length > 0)
+      .map((plugin) => plugin.id),
+  );
+}
+
 describe("plugin loader contract", () => {
   beforeEach(() => {
     vi.restoreAllMocks();
   });
 
   it("keeps bundled provider compatibility wired to the provider registry", () => {
     const providerPluginIds = uniqueSortedStrings(providerContractCompatPluginIds);
+    const manifestProviderPluginIds = resolveBundledManifestProviderPluginIds();
     const compatPluginIds = providerTesting.resolveBundledProviderCompatPluginIds({
       config: {
         plugins: {
@@ -29,18 +39,22 @@ describe("plugin loader contract", () => {
       pluginIds: compatPluginIds,
     });
 
+    expect(providerPluginIds).toEqual(manifestProviderPluginIds);
+    expect(uniqueSortedStrings(compatPluginIds)).toEqual(manifestProviderPluginIds);
     expect(uniqueSortedStrings(compatPluginIds)).toEqual(expect.arrayContaining(providerPluginIds));
     expect(compatConfig?.plugins?.allow).toEqual(expect.arrayContaining(providerPluginIds));
   });
 
   it("keeps vitest bundled provider enablement wired to the provider registry", () => {
     const providerPluginIds = uniqueSortedStrings(providerContractCompatPluginIds);
+    const manifestProviderPluginIds = resolveBundledManifestProviderPluginIds();
     const compatConfig = providerTesting.withBundledProviderVitestCompat({
       config: undefined,
       pluginIds: providerPluginIds,
       env: { VITEST: "1" } as NodeJS.ProcessEnv,
     });
 
+    expect(providerPluginIds).toEqual(manifestProviderPluginIds);
     expect(compatConfig?.plugins).toMatchObject({
       enabled: true,
       allow: expect.arrayContaining(providerPluginIds),