fix(ui): preserve empty plugin allowlists

Signed-off-by: samzong <samzong.lu@gmail.com>

ui/src/ui/controllers/config.test.ts

@@ -324,6 +324,48 @@ describe("updateConfigFormValue", () => {
     });
     expect(state.configFormDirty).toBe(true);
   });
+
+  it("preserves empty plugin allowlists when enabling a plugin", () => {
+    const state = createState();
+    applyConfigSnapshot(state, {
+      hash: "hash-plugins",
+      config: {
+        plugins: {
+          allow: [],
+          entries: {
+            deepseek: { enabled: false },
+          },
+        },
+      },
+      valid: true,
+      issues: [],
+      raw: "{}",
+    });
+
+    updateConfigFormValue(state, ["plugins", "entries", "deepseek", "enabled"], true);
+
+    expect(state.configForm).toEqual({
+      plugins: {
+        allow: [],
+        entries: {
+          deepseek: { enabled: true },
+        },
+      },
+    });
+    expect(state.configFormDirty).toBe(true);
+
+    updateConfigFormValue(state, ["plugins", "entries", "deepseek", "enabled"], false);
+
+    expect(state.configForm).toEqual({
+      plugins: {
+        allow: [],
+        entries: {
+          deepseek: { enabled: false },
+        },
+      },
+    });
+    expect(state.configFormDirty).toBe(false);
+  });
 });
 
 describe("stageConfigPreset", () => {

ui/src/ui/controllers/config.ts

@@ -332,6 +332,10 @@ function syncEnabledPluginAllowlist(
     if (allow.includes(pluginId)) {
       return;
     }
+    if (allow.length === 0) {
+      untrackAutoAllowlistedPluginId(state, pluginId);
+      return;
+    }
     setPathValue(draft, ["plugins", "allow"], [...allow, pluginId]);
     trackAutoAllowlistedPluginId(state, pluginId);
     return;