Manage plugins from Setup > Plugins (#6420)

* Give built-in plugins an honest on/off state

Every built-in reported itself enabled no matter what. A bar widget said
"enabled" while sitting nowhere near the bar, and disabling a built-in service
silently did nothing, because enabled meant "listed in plugins[]" and a
built-in never is. Nothing surfaced that, since the only caller listing plugins
was the CLI.

For a widget, on and off is its place in the bar, so listPlugins reports layout
membership -- what enable/disable actually toggles. For everything else built
in, loading by default is the right behaviour to keep, so switching one off is
recorded the other way round, in disabledPlugins[]. shell.json still carries
only the deviation from the defaults: the key is dropped the moment nothing is
switched off, leaving a config that never disabled anything byte-identical.

isEnabled still answers a separate question -- whether the component loads at
all -- and deliberately does not follow a widget out of the bar. omarchy.menu
is both a widget and the menu itself, so tying the two together would let
taking its button off the bar lock the menu out of the shell, with no way back
that isn't the CLI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Manage plugins from Setup > Plugins

Plugins were CLI-only. Setup > Plugins now offers Enable, Disable, Add, and
Remove, each list living in the menu itself so picking a row acts on it.

Enable and Disable cover the built-ins as well as anything installed -- the bar
widgets you can put in the bar, the services and overlays you can switch off.
Remove is limited to plugins the user installed, since a built-in has no
checkout to delete, and stays hidden until there is one. Whole-bar
replacements are left out; those are chosen under Style.

Enabling a bar widget asks for a section first, because enabling alone drops it
on the right and the only way to move it was a follow-up bar plugin move. The
CLI asks the same question after its own add, so both paths place a widget the
same way. Add and Remove run in a terminal: one needs a git URL and shows the
trust warning before cloning, the other deletes a checkout and prints where it
backed it up.

Providers grew two hooks for this. placementFor turns a row into a submenu
instead of an action, and volatile re-runs the enumeration when its submenu is
entered -- picking from these lists is what changes them, and rows a provider
no longer returns now drop out instead of lingering forever.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Trim the plugin menu after review

Menu.qml carried its own shellQuote while already importing Util and calling
Util.shellQuote a few lines up; two copies of the same escaping is one place
for a future fix to miss. isDisabled walked the array by hand to compare values
it writes itself, and dropDisabled was an eight-line helper with one caller.

Two bugs came out of the same pass. A whole-bar replacement belongs under Style
rather than these lists, but the exclusion sat in the shared row builder, so a
third-party bar could be installed and never removed -- Remove would show an
empty list under a guard that said something was there. The exclusion now sits
on the two lists that mean it.

Rows are keyed by id, and distinct plugin ids can slugify alike: acme.foo,
acme_foo and acme-foo all give acme-foo. The merge keeps the first row per id,
so the rest simply vanished from the list with nothing to say why. Row ids are
now made distinct before merging.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Pick a plugin the way we pick a theme

Setup > Plugins listed plugins as menu rows, which needed three providers, a
placement submenu, a volatile-refresh hook and a row-swap in the merge. Only
Font and Apps are built that way. Theme, Background, Unlock, Timezone and
Keybindings all pipe a list into omarchy-menu-select instead, which is one
action string and a small script -- so that is what these use now.

The trade is search: a plugin name is no longer findable from the root prompt.
Neither is a theme name or a timezone, and Enable Plugin still is, so the loss
sits where the rest of the menu already puts it.

Two pieces of the row machinery stay, because they are worth having for the
lists that remain. A volatile provider re-runs when its submenu is entered, so
a font installed since the shell started now shows up without restarting it,
and rows a provider stops returning drop out. Row ids are still made distinct
before merging: Fira Code and Fira-Code both slug to fira-code, and a repeated
id was silently dropped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Let a picked option carry an icon

Moving the plugin lists onto omarchy-menu-select cost them their glyphs: the
select mode has always hardcoded an empty icon, which is why Timezone and
Keybindings have none either. An option may now lead with one, as
"<glyph><TAB><label>". The menu shows the glyph, filters on the label, and
hands the label back, so a caller never strips a glyph off its own selection
and a list of plain strings behaves exactly as before.

The plugin picker uses it for the puzzle glyph on each plugin and the align
glyphs on the sections, which also regain the capitals they lost when the
section names were passed through raw.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Switch bars by enabling one

A bar option was kept out of Enable and Disable on the grounds that picking
which bar to run belongs under Style -- but nothing under Style ever offered
it, so an installed bar could be added and removed and never actually put to
use. The menu was guarding a door to a room that was never built.

Enabling one is the switch. setEnabled already assigns bar.id for a bar
option, so a bar has always replaced the one before it; only the picker's
filter stood in the way. Dropping it costs nothing else, because enabled for a
bar option means active: the bar in use is the one row absent from Enable,
every other installed bar is one pick away, and the built-in is just another
entry, so going back to it is enabling Bar.

Disable keeps the exclusion. That is the one verb a bar cannot answer -- there
is no off, only a successor -- and offering it would have listed the built-in
bar on a stock system, where turning it off deletes a bar.id that was never
set and nothing happens.

A bar carries the bar glyph rather than the puzzle one, so a row that replaces
the whole bar does not read like one more widget to switch on, and enable now
says "Now using X as the bar" instead of "Enabled X", which understated a
whole-bar swap in both the enable and the freshly-added path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Refuse a plugin that declares a kind it cannot load

A kind is a promise to supply something to load, and the shell reads that
something from a fixed key: entryPoints.bar to draw a bar, entryPoints.menu to
open a menu. Nothing checked the promise. A manifest could claim kinds ["bar"]
with no bar entry point, pass validation, install, and enable -- and then the
bar would fall back to the built-in and the widget would be skipped, leaving a
plugin that does nothing, explained only by a console.warn nobody reads.

Our own plugins have been held to this table by plugins-test.sh all along.
This holds third-party ones to the same table, at add and update time, where
there is still someone to tell.

A kind outside the table is left alone rather than guessed at, so a shell that
learns a new kind does not need this list updated first. The cost is that a
misspelled kind still installs quietly.

omarchy-plugin-validate had no tests; it has some now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Act on the plugin whose row was picked

The picker showed a name and then looked that name up again across every
plugin, filtered set or not, taking the first match. Two plugins can share a
name: cloning one keeps the name it was cloned from, so the documented
`omarchy plugin clone omarchy.clock local.clock` leaves two plugins called
Clock. Enable listed the clone -- the built-in was already enabled, so only the
clone was eligible -- and then enabled omarchy.clock, moving the built-in
widget instead. Remove listed the clone and tried to delete a built-in that has
no checkout to delete.

A row now carries its id alongside its label, and the id is read back off the
row that was picked instead of being derived from the name a second time. Where
a name is not unique among the rows on offer, the label carries the id too, so
two rows that would both say Clock can be told apart at all -- which they could
not before, whichever one the pick resolved to.

The verb prompt only ever sees the first two fields, so the menu shows what it
always did.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Never ask a bar where to sit in the bar

A manifest may declare both bar and bar-widget, and validation accepts it. The
picker saw bar-widget, asked for a section, and passed it to enable. setEnabled
takes bar as the dominant kind: it writes bar.id and returns, adding nothing to
any layout, so the move that followed had no widget to find and failed -- after
the bar had already been switched. A partial success with an error on the way
out.

Bar wins ahead of bar-widget now, in the picker and in the placement prompt
`plugin add --enable` asks, so a bar is enabled without a placement it cannot
use. The CLI refuses a placement on a bar outright, before the bar is switched
rather than after, since `omarchy plugin enable <bar> --section left` could
reach the same half-applied state without going through either.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Only replacement, no off

* Add default placement for bar widgets

* Simplify plugin menu actions

* Document plugin placement behavior

* Allow dropping widgets in empty bar space

* Treat plugin dependencies as runtime invariants

* Reject duplicate plugin ids on add

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/shell.d/bar-test.sh

@@ -44,6 +44,53 @@ assert(
   'bar routes panels through the drawn-slot picker'
 )
 
+const clockSlot = { id: 'clock' }
+const traySlot = { id: 'tray' }
+const horizontalTargets = [
+  { slot: clockSlot, x: 100, y: 0, width: 100, height: 26 },
+  { slot: traySlot, x: 500, y: 0, width: 50, height: 26 }
+]
+assertDeepEqual(
+  bar.nearestDropTarget(horizontalTargets, { x: 240, y: 13 }, false),
+  { slot: clockSlot, after: true },
+  'bar resolves free space beside a widget to its nearest insertion edge'
+)
+assertDeepEqual(
+  bar.nearestDropTarget(horizontalTargets, { x: 460, y: 13 }, false),
+  { slot: traySlot, after: false },
+  'bar resolves free space before a widget to its nearest insertion edge'
+)
+assertDeepEqual(
+  bar.nearestDropTarget(horizontalTargets, { x: 125, y: 13 }, false),
+  { slot: clockSlot, after: false },
+  'bar resolves the first half of a widget before it'
+)
+assertDeepEqual(
+  bar.nearestDropTarget(horizontalTargets, { x: 175, y: 13 }, false),
+  { slot: clockSlot, after: true },
+  'bar resolves the second half of a widget after it'
+)
+assertDeepEqual(
+  bar.nearestDropTarget([
+    { slot: clockSlot, x: 0, y: 100, width: 26, height: 80 }
+  ], { x: 13, y: 220 }, true),
+  { slot: clockSlot, after: true },
+  'vertical bars resolve free space along their vertical axis'
+)
+assertEqual(bar.nearestDropTarget([], { x: 10, y: 10 }, false), null, 'bar reports no insertion edge without targets')
+assert(
+  /contentItem\.mapFromItem\(null, scenePoint\.x, scenePoint\.y\)[\s\S]*?return null/.test(barSource),
+  'bar rejects free-space drops after the pointer leaves the bar'
+)
+assert(
+  /BarModel\.nearestDropTarget\(candidates, scenePoint, root\.vertical\)/.test(barSource),
+  'bar uses nearest insertion targeting for widget and free-space drops'
+)
+assert(
+  /component DragGhostPanel:[\s\S]*?readonly property var targetRect: root\.barDragTargetGeometry[\s\S]*?color: Color\.accent/.test(barSource),
+  'bar draws the insertion marker above the bar in the drag overlay'
+)
+
 // The open-panel mark sits on the module's desktop-facing edge at every
 // position: under a top bar, over a bottom one, inward from left and right.
 const indicator = barSource.slice(barSource.indexOf('id: openPanelIndicator'), barSource.indexOf('id: openPanelIndicator') + 1600)

test/shell.d/config-test.sh

@@ -253,28 +253,44 @@ pass "shell config resets to built-in bar option"
 HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin add omarchy.tailscale
 jq -e '
   def ids: map(.id // .);
-  .bar.layout.right | ids == ["omarchy.tray", "omarchy.tailscale", "omarchy.bluetooth"]
+  .bar.layout.center | ids == ["omarchy.clock", "omarchy.weather", "omarchy.tailscale"]
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
-pass "shell config appends widgets to right by default"
+pass "shell config defaults widgets without a section to center"
 
-HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin add omarchy.active-window left
+HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin add omarchy.active-window
 jq -e '
   def ids: map(.id // .);
   .bar.layout.left | ids == ["omarchy.menu", "omarchy.workspaces", "omarchy.active-window"]
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
-pass "shell config appends left widgets after workspaces"
+pass "shell config uses a widget's default section"
+
+HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin add omarchy.media
+jq -e '
+  def ids: map(.id // .);
+  .bar.layout.center | ids == ["omarchy.clock", "omarchy.weather", "omarchy.media", "omarchy.tailscale"]
+' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
+HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin remove omarchy.media >/dev/null
+pass "shell config honors a center default section"
+
+HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin add omarchy.dropbox
+jq -e '
+  def ids: map(.id // .);
+  .bar.layout.right | ids == ["omarchy.tray", "omarchy.dropbox", "omarchy.bluetooth"]
+' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
+HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin remove omarchy.dropbox >/dev/null
+pass "shell config honors a right default section"
 
 HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin add omarchy.system-update center
 jq -e '
   def ids: map(.id // .);
-  .bar.layout.center | ids == ["omarchy.clock", "omarchy.weather", "omarchy.system-update"]
+  .bar.layout.center | ids == ["omarchy.clock", "omarchy.weather", "omarchy.system-update", "omarchy.tailscale"]
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
 pass "shell config appends center widgets after weather"
 
 HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin add omarchy.microphone right
 jq -e '
   def ids: map(.id // .);
-  .bar.layout.right | ids == ["omarchy.tray", "omarchy.microphone", "omarchy.tailscale", "omarchy.bluetooth"]
+  .bar.layout.right | ids == ["omarchy.tray", "omarchy.microphone", "omarchy.bluetooth"]
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
 pass "shell config moves existing widgets without duplicates"
 
@@ -282,7 +298,7 @@ HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin move omarchy.active-
 jq -e '
   def ids: map(.id // .);
   (.bar.layout.left | ids == ["omarchy.menu", "omarchy.workspaces"]) and
-  (.bar.layout.right | ids == ["omarchy.tray", "omarchy.active-window", "omarchy.microphone", "omarchy.tailscale", "omarchy.bluetooth"])
+  (.bar.layout.right | ids == ["omarchy.tray", "omarchy.active-window", "omarchy.microphone", "omarchy.bluetooth"])
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
 pass "bar plugin move accepts a positional target section"
 
@@ -290,7 +306,7 @@ HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin move omarchy.active-
 jq -e '
   def ids: map(.id // .);
   (.bar.layout.left | ids == ["omarchy.menu", "omarchy.workspaces", "omarchy.active-window"]) and
-  (.bar.layout.right | ids == ["omarchy.tray", "omarchy.microphone", "omarchy.tailscale", "omarchy.bluetooth"])
+  (.bar.layout.right | ids == ["omarchy.tray", "omarchy.microphone", "omarchy.bluetooth"])
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
 pass "bar plugin move can restore a widget with positional syntax"
 
@@ -327,15 +343,15 @@ HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin drop omarchy.active-
 jq -e '
   def ids: map(.id // .);
   (.bar.layout.left | ids == ["omarchy.menu", "omarchy.workspaces"]) and
-  (.bar.layout.center | ids == ["omarchy.clock", "omarchy.weather", "omarchy.system-update"]) and
-  (.bar.layout.right | ids == ["omarchy.tray", "omarchy.microphone", "omarchy.tailscale", "omarchy.bluetooth"])
+  (.bar.layout.center | ids == ["omarchy.clock", "omarchy.weather", "omarchy.system-update", "omarchy.tailscale"]) and
+  (.bar.layout.right | ids == ["omarchy.tray", "omarchy.microphone", "omarchy.bluetooth"])
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
 pass "shell config drops widgets from any section"
 
 HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" omarchy-bar-plugin remove omarchy.system-update
 jq -e '
   def ids: map(.id // .);
-  .bar.layout.center | ids == ["omarchy.clock", "omarchy.weather"]
+  .bar.layout.center | ids == ["omarchy.clock", "omarchy.weather", "omarchy.tailscale"]
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
 pass "shell config removes widgets with remove alias"
 
@@ -415,7 +431,7 @@ HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" PATH="$mock_path" OMARCHY_TEST_DROPBOX=
 jq -e '
   def ids: map(.id // .);
   (.bar.layout.right | ids | index("omarchy.dropbox") != null) and
-  (.bar.layout.right | ids | index("omarchy.tailscale") != null)
+  (.bar.layout.center | ids | index("omarchy.tailscale") != null)
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
 pass "bar defaults adds widgets for running optional services"
 
@@ -423,7 +439,7 @@ HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" PATH="$mock_path" OMARCHY_TEST_DROPBOX=
 jq -e '
   def ids: map(.id // .);
   (.bar.layout.right | ids | index("omarchy.dropbox") == null) and
-  (.bar.layout.right | ids | index("omarchy.tailscale") == null)
+  (.bar.layout.center | ids | index("omarchy.tailscale") == null)
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
 pass "shell refresh keeps optional service widgets absent when services are unavailable"
 
@@ -431,7 +447,7 @@ HOME="$TMPDIR/home" OMARCHY_PATH="$ROOT" PATH="$mock_path" OMARCHY_TEST_DROPBOX=
 jq -e '
   def ids: map(.id // .);
   (.bar.layout.right | ids | index("omarchy.dropbox") != null) and
-  (.bar.layout.right | ids | index("omarchy.tailscale") != null)
+  (.bar.layout.center | ids | index("omarchy.tailscale") != null)
 ' "$TMPDIR/home/.config/omarchy/shell.json" >/dev/null
 [[ -f $TMPDIR/home/.local/state/omarchy/restart-shell-called ]] || fail "shell refresh restarts shell"
 pass "shell refresh adds optional service widgets when services are available"

test/shell.d/fixtures/plugin-registry/shell.qml

@@ -50,8 +50,8 @@ ShellRoot {
     }
   }
 
-  function manifest(id, kinds, entryPoints) {
-    return {
+  function manifest(id, kinds, entryPoints, barWidget) {
+    var value = {
       schemaVersion: 1,
       id: id,
       name: id,
@@ -59,6 +59,8 @@ ShellRoot {
       kinds: kinds,
       entryPoints: entryPoints
     }
+    if (barWidget) value.barWidget = barWidget
+    return value
   }
 
   function block(kind, source, payload) {
@@ -81,12 +83,13 @@ ShellRoot {
     scan += block("firstparty", "/first/bar", manifest("omarchy.bar", ["bar"], { bar: "Bar.qml" }))
     scan += block("firstparty", "/first/panels/grouped", manifest("omarchy.grouped-panel", ["panel"], { panel: "Panel.qml" }))
     scan += block("thirdparty", "/third/panel", manifest("third.panel", ["panel"], { panel: "Panel.qml" }))
-    scan += block("thirdparty", "/third/widget", manifest("third.widget", ["bar-widget"], { barWidget: "Widget.qml" }))
+    scan += block("thirdparty", "/third/widget", manifest("third.widget", ["bar-widget"], { barWidget: "Widget.qml" }, { defaultSection: "left" }))
     scan += block("thirdparty", "/third/bar", manifest("third.bar", ["bar"], { bar: "Bar.qml" }))
     scan += block("thirdparty", "/third/shadow", manifest("omarchy.first-widget", ["panel"], { panel: "Panel.qml" }))
     scan += block("thirdparty", "/third/reserved", manifest("omarchy.reserved", ["panel"], { panel: "Panel.qml" }))
     scan += block("thirdparty", "/third/unsafe", manifest("third.unsafe", ["panel"], { panel: "../Panel.qml" }))
     scan += block("thirdparty", "/third/missing", { schemaVersion: 1, id: "third.missing", name: "missing", version: "1.0.0", kinds: ["panel"] })
+    scan += block("thirdparty", "/third/bad-section", manifest("third.bad-section", ["bar-widget"], { barWidget: "Widget.qml" }, { defaultSection: "bottom" }))
     scan += block("thirdparty", "/third/schema", { schemaVersion: 2, id: "third.schema", name: "schema", version: "1.0.0", kinds: ["panel"], entryPoints: { panel: "Panel.qml" } })
     scan += block("thirdparty", "/third/bad-json", "{")
 
@@ -110,6 +113,7 @@ ShellRoot {
     root.assertTrue(!has("omarchy.reserved"), "third-party omarchy namespace ids are rejected")
     root.assertTrue(!has("third.unsafe"), "unsafe entry points are rejected")
     root.assertTrue(!has("third.missing"), "incomplete manifests are rejected")
+    root.assertTrue(!has("third.bad-section"), "invalid default bar widget sections are rejected")
     root.assertTrue(!has("third.schema"), "unsupported schema versions are rejected")
 
     root.assertTrue(registry.isEnabled("omarchy.first-widget"), "first-party plugins are implicitly enabled")
@@ -132,10 +136,10 @@ ShellRoot {
     root.assertDeepEqual(root.config.plugins, [], "disabling third-party panels removes plugins array entry")
 
     registry.setEnabled("third.widget", true)
-    root.assertDeepEqual(root.config.bar.layout.right, [{ id: "third.widget" }], "enabling bar widgets appends to right layout")
+    root.assertDeepEqual(root.config.bar.layout.left, [{ id: "third.widget" }], "enabling bar widgets uses their default section")
     root.assertTrue(registry.isEnabled("third.widget"), "enabled bar widgets are found")
     registry.setEnabled("third.widget", false)
-    root.assertDeepEqual(root.config.bar.layout.right, [], "disabling bar widgets removes layout entry")
+    root.assertDeepEqual(root.config.bar.layout.left, [], "disabling bar widgets removes layout entry")
 
     root.config = {
       version: 1,
@@ -150,6 +154,35 @@ ShellRoot {
     registry.setEnabled("third.panel", true)
     root.assertDeepEqual(root.config.plugins, [{ id: "third.panel" }], "setEnabled repairs missing plugin config shape")
 
+    // A built-in loads by default, so switching one off is recorded the other
+    // way round and has to survive round-tripping back on.
+    root.config = { version: 1, bar: { layout: { left: [], center: [], right: [] } }, plugins: [] }
+    registry.setEnabled("omarchy.grouped-panel", false)
+    root.assertDeepEqual(root.config.disabledPlugins, ["omarchy.grouped-panel"], "disabling a first-party plugin records it")
+    root.assertTrue(!registry.isEnabled("omarchy.grouped-panel"), "a recorded first-party plugin is disabled")
+    root.assertDeepEqual(root.config.plugins, [], "disabling a first-party plugin leaves the plugins array alone")
+    registry.setEnabled("omarchy.grouped-panel", true)
+    root.assertTrue(root.config.disabledPlugins === undefined, "re-enabling drops the disabled record entirely")
+    root.assertTrue(registry.isEnabled("omarchy.grouped-panel"), "a first-party plugin returns to enabled")
+    root.assertDeepEqual(root.config.plugins, [], "re-enabling a first-party plugin adds no redundant entry")
+
+    // A widget's place in the bar is its on/off switch. Loadability must not
+    // follow it down, or a plugin that is both widget and menu (omarchy.menu)
+    // would be locked out of the shell by taking its button off the bar.
+    root.config = {
+      version: 1,
+      bar: { layout: { left: [], center: [], right: [{ id: "omarchy.first-widget" }] } },
+      plugins: []
+    }
+    root.assertTrue(registry.inBar("omarchy.first-widget"), "inBar sees a widget in the layout")
+    registry.setEnabled("omarchy.first-widget", false)
+    root.assertDeepEqual(root.config.bar.layout.right, [], "disabling a first-party widget removes its layout entry")
+    root.assertTrue(root.config.disabledPlugins === undefined, "disabling a first-party widget records nothing else")
+    root.assertTrue(!registry.inBar("omarchy.first-widget"), "inBar follows the widget out of the layout")
+    root.assertTrue(registry.isEnabled("omarchy.first-widget"), "a first-party widget stays loadable off the bar")
+    registry.setEnabled("omarchy.first-widget", true)
+    root.assertDeepEqual(root.config.bar.layout.center, [{ id: "omarchy.first-widget" }], "a widget without a default section falls back to center")
+
     root.assertTrue(changeCount > 0, "registry emits change notifications")
     writeResult()
   }

test/shell.d/menu-plugin-test.sh

@@ -0,0 +1,168 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+require_command jq
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+STUB_DIR="$TMPDIR/stub"
+mkdir -p "$STUB_DIR"
+
+# The picker reads the plugin list from omarchy-plugin and hands what it decided
+# back to it, so stubbing both ends shows which plugin a pick actually resolved
+# to -- the thing a source-level check cannot see.
+cat >"$STUB_DIR/omarchy-plugin" <<'STUB'
+#!/bin/bash
+[[ $1 == list ]] && { cat "$FAKE_PLUGINS"; exit 0; }
+printf 'omarchy-plugin %s\n' "$*" >>"$FAKE_CALLS"
+STUB
+
+# Records the rows it was offered, then answers with the pick under test.
+cat >"$STUB_DIR/omarchy-menu-select" <<'STUB'
+#!/bin/bash
+cat >"$FAKE_ROWS"
+printf '%s\n' "$FAKE_PICK"
+STUB
+
+cat >"$STUB_DIR/omarchy-notification-send" <<'STUB'
+#!/bin/bash
+printf 'notification: %s\n' "$*" >>"$FAKE_CALLS"
+STUB
+
+cat >"$STUB_DIR/omarchy-launch-floating-terminal-with-presentation" <<'STUB'
+#!/bin/bash
+printf 'terminal: %s\n' "$*" >>"$FAKE_CALLS"
+STUB
+
+chmod +x "$STUB_DIR"/*
+
+# Runs the picker against a plugin list, answering its prompt with $2. Leaves
+# the rows it offered in $ROWS and what it called in $CALLS.
+pick() {
+  local verb="$1" choice="$2"
+
+  : >"$TMPDIR/calls"
+  : >"$TMPDIR/rows"
+  PATH="$STUB_DIR:$PATH" \
+    FAKE_PLUGINS="$TMPDIR/plugins.json" \
+    FAKE_CALLS="$TMPDIR/calls" \
+    FAKE_ROWS="$TMPDIR/rows" \
+    FAKE_PICK="$choice" \
+    "$ROOT/bin/omarchy-menu-plugin" "$verb" >/dev/null 2>&1
+
+  ROWS=$(cat "$TMPDIR/rows")
+  CALLS=$(cat "$TMPDIR/calls")
+}
+
+# Cloning a plugin keeps the name it was cloned from, so two plugins really can
+# arrive at the picker calling themselves Clock. Both eligible for the same
+# verb: neither row can stand on the name alone.
+cat >"$TMPDIR/plugins.json" <<'JSON'
+[
+  {"id": "omarchy.clock", "name": "Clock", "kinds": ["bar-widget"], "enabled": false, "active": false, "canDisable": true, "firstParty": true},
+  {"id": "local.clock", "name": "Clock", "kinds": ["bar-widget"], "enabled": false, "active": false, "canDisable": true, "firstParty": false}
+]
+JSON
+
+pick enable "Clock (local.clock)"
+[[ $ROWS == *"Clock (omarchy.clock)"* && $ROWS == *"Clock (local.clock)"* ]] \
+  || fail "picker tells two plugins of the same name apart" "$ROWS"
+pass "picker tells two plugins of the same name apart"
+[[ $CALLS == *"omarchy-plugin enable local.clock"* ]] \
+  || fail "picker acts on the row that was picked, not the one that shares its name" "$CALLS"
+pass "picker acts on the row that was picked, not the one that shares its name"
+
+# Only one of them is eligible, so the row needs no id -- but resolving it by
+# name alone would still find the wrong plugin, since the other one exists.
+cat >"$TMPDIR/plugins.json" <<'JSON'
+[
+  {"id": "omarchy.clock", "name": "Clock", "kinds": ["bar-widget"], "enabled": true, "active": false, "canDisable": true, "firstParty": true},
+  {"id": "local.clock", "name": "Clock", "kinds": ["bar-widget"], "enabled": false, "active": false, "canDisable": true, "firstParty": false}
+]
+JSON
+
+pick enable "Clock"
+[[ $ROWS != *"("* ]] || fail "picker adorns a row only when its name is taken twice over" "$ROWS"
+pass "picker adorns a row only when its name is taken twice over"
+[[ $CALLS == *"omarchy-plugin enable local.clock"* ]] \
+  || fail "picker resolves a lone row to the plugin the verb offered, not a namesake it filtered out" "$CALLS"
+pass "picker resolves a lone row to the plugin the verb offered, not a namesake it filtered out"
+
+pick remove "Clock"
+[[ $CALLS == *"omarchy-plugin remove local.clock"* ]] \
+  || fail "picker removes the plugin whose row was picked" "$CALLS"
+pass "picker removes the plugin whose row was picked"
+
+# A name that stands alone is left alone: no id trailing a row that needs none.
+cat >"$TMPDIR/plugins.json" <<'JSON'
+[
+  {"id": "acme.weather", "name": "Weather", "kinds": ["bar-widget"], "enabled": false, "active": false, "canDisable": true, "firstParty": false}
+]
+JSON
+
+pick enable "Weather"
+[[ $ROWS == *"Weather"* && $ROWS != *"acme.weather)"* ]] \
+  || fail "picker leaves an unambiguous name unadorned" "$ROWS"
+pass "picker leaves an unambiguous name unadorned"
+[[ $CALLS == *"omarchy-plugin enable acme.weather"* ]] \
+  || fail "picker delegates plugin enablement to the plugin command" "$CALLS"
+pass "picker delegates plugin enablement to the plugin command"
+
+# The picker treats every plugin alike and leaves kind-specific behavior to the
+# plugin command.
+cat >"$TMPDIR/plugins.json" <<'JSON'
+[
+  {"id": "acme.fancy", "name": "Fancy", "kinds": ["bar", "bar-widget"], "enabled": false, "active": false, "canDisable": false, "firstParty": false}
+]
+JSON
+
+pick enable "Fancy"
+[[ $CALLS == *"omarchy-plugin enable acme.fancy"* && $CALLS != *"--section"* ]] \
+  || fail "picker delegates kind-specific enablement" "$CALLS"
+pass "picker delegates kind-specific enablement"
+
+# A bar has no off, so it is never offered under disable -- including this one,
+# which is a widget too.
+cat >"$TMPDIR/plugins.json" <<'JSON'
+[
+  {"id": "acme.fancy", "name": "Fancy", "kinds": ["bar", "bar-widget"], "enabled": true, "active": true, "canDisable": false, "firstParty": false},
+  {"id": "omarchy.clock", "name": "Clock", "kinds": ["bar-widget"], "enabled": true, "active": false, "canDisable": true, "firstParty": true}
+]
+JSON
+
+pick disable "Clock"
+[[ $ROWS == *"Clock"* && $ROWS != *"Fancy"* ]] \
+  || fail "picker keeps a bar out of disable" "$ROWS"
+pass "picker keeps a bar out of disable"
+
+# The bar in use is the row absent from enable; every other bar is one pick away.
+cat >"$TMPDIR/plugins.json" <<'JSON'
+[
+  {"id": "omarchy.bar", "name": "Bar", "kinds": ["bar"], "enabled": false, "active": false, "canDisable": false, "firstParty": true},
+  {"id": "local.neon-bar", "name": "Neon Bar", "kinds": ["bar"], "enabled": true, "active": true, "canDisable": false, "firstParty": false}
+]
+JSON
+
+pick enable "Bar"
+[[ $ROWS == *"Bar"* && $ROWS != *"Neon Bar"* ]] \
+  || fail "picker offers every bar except the one already running" "$ROWS"
+pass "picker offers every bar except the one already running"
+[[ $CALLS == *"omarchy-plugin enable omarchy.bar"* ]] \
+  || fail "picker returns to the built-in bar by enabling it" "$CALLS"
+pass "picker returns to the built-in bar by enabling it"
+
+# Nothing the verb can act on is said out loud, not opened as an empty list.
+cat >"$TMPDIR/plugins.json" <<'JSON'
+[
+  {"id": "omarchy.bar", "name": "Bar", "kinds": ["bar"], "enabled": true, "active": true, "canDisable": false, "firstParty": true}
+]
+JSON
+
+pick enable ""
+[[ $CALLS == *"notification: No plugin to enable"* ]] \
+  || fail "picker says when a verb has nothing to act on" "$CALLS"
+pass "picker says when a verb has nothing to act on"

test/shell.d/menu-test.sh

@@ -181,6 +181,91 @@ assertEqual(
   'omarchy-bar transparent toggle',
   'menu exposes Menu Bar transparency as a toggle'
 )
+assertDeepEqual(
+  defaultItems.filter(item => item.parent === 'setup.plugin').map(item => item.label),
+  ['Enable Plugin', 'Disable Plugin', 'Add Plugin', 'Remove Plugin'],
+  'menu manages plugins from Setup > Plugins'
+)
+assert(
+  ['enable', 'disable', 'remove'].every(
+    verb => defaultById[`setup.plugin.${verb}`].action === `omarchy-menu-plugin ${verb}`
+  ),
+  'menu picks a plugin the way it already picks a theme or a timezone'
+)
+assert(
+  !defaultById['setup.plugin.enable'].when && !defaultById['setup.plugin.disable'].when,
+  'menu always offers Enable and Disable, which cover the built-in plugins too'
+)
+assert(
+  defaultById['setup.plugin.remove'].when.includes('.config/omarchy/plugins'),
+  'menu hides Remove until a plugin the user installed exists to delete'
+)
+assert(
+  defaultById['setup.plugin.add'].action.includes('omarchy-plugin add'),
+  'menu adds a plugin through the CLI, where the trust warning and clone output are visible'
+)
+
+const pluginPicker = fs.readFileSync(path.join(root, 'bin/omarchy-menu-plugin'), 'utf8')
+assert(
+  /enable\).*\(\.enabled \| not\)/.test(pluginPicker) && /disable\).*\.canDisable and \.enabled/.test(pluginPicker),
+  'plugin picker offers what each verb can act on'
+)
+assert(
+  /remove\).*\(\.firstParty \| not\)/.test(pluginPicker)
+    && !/kinds|bar-widget|A_BAR_OPTION|NOT_A_BAR_OPTION|BAR_ICON/.test(pluginPicker),
+  'plugin picker leaves plugin-kind decisions to its data and the plugin command'
+)
+
+const pluginCli = fs.readFileSync(path.join(root, 'bin/omarchy-plugin'), 'utf8')
+assert(
+  /Now using \$id as the bar/.test(pluginCli)
+    && /enabled_message "\$id"[\s\S]*?place_bar_widget/.test(pluginCli),
+  'plugin enable reports a bar as replacing the one in use, whether enabled or freshly added'
+)
+assert(
+  /\.barWidget\.defaultSection \/\/ "center"/.test(pluginCli)
+    && /gum choose[\s\S]*?--selected "\$default_section"/.test(pluginCli),
+  'interactive plugin add selects the manifest placement or center fallback by default'
+)
+assert(
+  /omarchy-plugin "\$1" "\$id"/.test(pluginPicker),
+  'plugin picker delegates enable and disable without interpreting plugin kinds'
+)
+// Icons ride along as "<glyph>\tlabel"; the menu shows the glyph and hands
+// back the label, so nothing downstream has to strip one off. The id rides in
+// a third field, cut off before the menu is ever shown it. What the picker
+// then does with the row it gets back is checked in menu-plugin-test.sh.
+assert(
+  /\$label \+ \\"\\\\t\\" \+ \.id/.test(pluginPicker)
+    && /omarchy-menu-select "\$\{1\^\} plugin" < <\(cut -f1,2 <<<"\$rows"\)/.test(pluginPicker),
+  'plugin picker labels its rows with glyphs and keeps the id out of the label'
+)
+assert(
+  /var icon = parts\.length > 1 \? parts\.shift\(\) : ""\s*\n\s*var label = parts\.join\("\\t"\)/.test(menuQml),
+  'menu select mode reads a leading icon off an option and filters on the label alone'
+)
+assert(
+  /omarchy-launch-floating-terminal-with-presentation "omarchy-plugin remove/.test(pluginPicker),
+  'plugin picker removes where the confirmation and backup path are visible'
+)
+
+// A font installed since the shell started should show up without a restart.
+const providerBlock = menuQml.match(/readonly property var providers: \(\{[\s\S]*?\n  \}\)/)[0]
+assert(
+  /"fonts": \{[\s\S]*?volatile: true/.test(providerBlock),
+  'menu re-enumerates the font list every time it is opened'
+)
+assert(
+  /function setActiveMenu\([\s\S]*?root\.invalidateVolatileProvider\(id\)\s*\n\s*root\.loadProviderForMenu\(id\)/.test(menuQml)
+    && /function openExistingMenu\([\s\S]*?invalidateVolatileProvider\(activeMenu\)\s*\n\s*loadProviderForMenu\(activeMenu\)/.test(menuQml),
+  'menu invalidates volatile providers when entering a menu, not on every keystroke'
+)
+assert(
+  ['loadProviderForMenu', 'loadProvidersForSearch'].every(
+    name => !menuQml.match(new RegExp(`function ${name}\\([^)]*\\) \\{([\\s\\S]*?)\\n  \\}`))[1].includes('invalidateVolatileProvider')
+  ),
+  'menu search never restarts a volatile provider'
+)
 assertEqual(
   defaultById['trigger.hardware.laptop-display'].when,
   'omarchy-hw-laptop',
@@ -280,16 +365,40 @@ assert(
 )
 
 const providerRowsFor = values => values.map(value => ({ id: `style.font.${value}`, kind: 'action', parent: 'style.font', label: value }))
-const firstProviderMerge = menu.mergeRowsById(nonAppItems, nonAppOrder, providerRowsFor(['mono', 'serif']))
+const firstProviderMerge = menu.swapProviderRows(nonAppItems, nonAppOrder, 'style.font', providerRowsFor(['mono', 'serif']))
 assert(
   firstProviderMerge.itemOrder.join(',') === 'root,apps,style.font.mono,style.font.serif',
   'provider merge appends its rows'
 )
 assert(
-  menu.mergeRowsById(firstProviderMerge.items, firstProviderMerge.itemOrder, providerRowsFor(['mono', 'serif']))
+  menu.swapProviderRows(firstProviderMerge.items, firstProviderMerge.itemOrder, 'style.font', providerRowsFor(['mono', 'serif']))
     .itemOrder.join(',') === 'root,apps,style.font.mono,style.font.serif',
   'repeating a provider merge does not duplicate rows'
 )
+// A plugin drops out of the Enable list the moment it is enabled, so a
+// provider that runs again has to lose the rows it contributed last time.
+const rerunProviderMerge = menu.swapProviderRows(firstProviderMerge.items, firstProviderMerge.itemOrder, 'style.font', providerRowsFor(['serif']))
+assert(
+  rerunProviderMerge.itemOrder.join(',') === 'root,apps,style.font.serif',
+  'provider merge drops rows the provider no longer lists'
+)
+assert(
+  menu.swapProviderRows(firstProviderMerge.items, firstProviderMerge.itemOrder, 'style.other', providerRowsFor([]))
+    .itemOrder.join(',') === 'root,apps,style.font.mono,style.font.serif',
+  'provider merge leaves rows belonging to another provider alone'
+)
+// Rows are keyed by id, so a provider handing over two rows with the same id
+// would lose one. Distinct plugin ids can slugify alike, which is why the
+// menu makes each row id its own before merging.
+assertEqual(
+  ['acme.foo', 'acme_foo', 'acme-foo'].map(menu.slugify).join(','),
+  'acme-foo,acme-foo,acme-foo',
+  'menu slugs collide across plugin ids that differ only in separator'
+)
+assert(
+  /var rowId = menuId \+ "\." \+ root\.slugify\(value\)\s*\n\s*while \(takenIds\[rowId\]\) rowId \+= "-"/.test(menuQml),
+  'menu keeps colliding provider rows apart so none is dropped'
+)
 
 // The maps live in QML `var` properties, where an in-place write is
 // occasionally dropped by the engine, so both merges must hand back fresh
@@ -299,7 +408,7 @@ assert(
   'menu assigns the rebuilt app item map instead of mutating it in place'
 )
 assert(
-  /var merged = MenuModel\.mergeRowsById\(root\.items, root\.itemOrder, providerRows\)\s*\n\s*root\.items = merged\.items\s*\n\s*root\.itemOrder = merged\.itemOrder/.test(menuQml),
+  /var merged = MenuModel\.swapProviderRows\(root\.items, root\.itemOrder, menuId, providerRows\)\s*\n[\s\S]*?root\.items = merged\.items\s*\n\s*root\.itemOrder = merged\.itemOrder/.test(menuQml),
   'menu assigns the rebuilt provider item map instead of mutating it in place'
 )
 assert(

test/shell.d/plugin-add-test.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+write_plugin() {
+  local dir="$1"
+  local id="$2"
+  local name="$3"
+
+  mkdir -p "$dir"
+  cat >"$dir/manifest.json" <<JSON
+{
+  "schemaVersion": 1,
+  "id": "$id",
+  "name": "$name",
+  "version": "1.0.0",
+  "kinds": ["bar-widget"],
+  "entryPoints": { "barWidget": "Widget.qml" },
+  "barWidget": {
+    "displayName": "$name",
+    "category": "Test",
+    "allowMultiple": false
+  }
+}
+JSON
+  printf 'import QtQuick\nItem {}\n' >"$dir/Widget.qml"
+}
+
+stub_dir="$TMPDIR/stubs"
+mkdir -p "$stub_dir"
+cat >"$stub_dir/omarchy-shell" <<'STUB'
+#!/bin/bash
+exit 0
+STUB
+chmod +x "$stub_dir/omarchy-shell"
+
+test_home="$TMPDIR/home"
+write_plugin "$test_home/.config/omarchy/plugins/different-folder" "acme.same" "Installed"
+
+incoming="$TMPDIR/incoming"
+write_plugin "$incoming" "acme.same" "Incoming"
+git -C "$incoming" init -q
+git -C "$incoming" add .
+git -C "$incoming" -c user.name=Test -c user.email=test@example.com commit -qm "Initial"
+
+output=$(HOME="$test_home" OMARCHY_PATH="$ROOT" PATH="$stub_dir:$ROOT/bin:$PATH" \
+  omarchy-plugin add "$incoming" --yes 2>&1) &&
+  fail "plugin add accepts an id already installed under another directory" "$output"
+grep -qF "plugin id 'acme.same' is already used by" <<<"$output" ||
+  fail "plugin add explains the installed id collision" "$output"
+[[ ! -e $test_home/.config/omarchy/plugins/acme.same ]] ||
+  fail "plugin add leaves a target behind after refusing a duplicate id"
+pass "plugin add refuses an installed manifest id regardless of directory name"

test/shell.d/plugin-validate-test.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+require_command jq
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+# A plugin folder with whatever kinds and entry points the case needs. Every
+# entry point named gets a file, so a rejection is about the manifest and not a
+# missing QML file.
+write_plugin() {
+  local name="$1" kinds="$2" entry_points="$3" bar_widget="${4:-null}"
+  local dir="$TMPDIR/$name"
+  local entry
+
+  mkdir -p "$dir"
+  cat >"$dir/manifest.json" <<JSON
+{
+  "schemaVersion": 1,
+  "id": "acme.$name",
+  "name": "Acme $name",
+  "version": "1.0.0",
+  "kinds": $kinds,
+  "entryPoints": $entry_points,
+  "barWidget": $bar_widget
+}
+JSON
+
+  while IFS= read -r entry; do
+    [[ -n $entry ]] || continue
+    touch "$dir/$entry"
+  done < <(jq -r '.[]' <<<"$entry_points")
+
+  printf '%s\n' "$dir"
+}
+
+validate() {
+  OMARCHY_PATH="$ROOT" "$ROOT/bin/omarchy-plugin-validate" "$1" 2>&1
+}
+
+# Every kind the shell knows how to load names the entry point it loads from.
+# Declaring the kind without it installs a plugin that does nothing at all.
+while IFS=: read -r kind entry_point; do
+  dir=$(write_plugin "wants-$kind" "[\"$kind\"]" "{\"$entry_point\": \"Entry.qml\"}")
+  validate "$dir" >/dev/null || fail "validate accepts $kind with its $entry_point entry point"
+  pass "validate accepts $kind with its $entry_point entry point"
+
+  # Swap in an entry point the kind does not read, so the manifest is otherwise
+  # complete and only the promised one is missing.
+  other_key="service"
+  [[ $entry_point == "service" ]] && other_key="panel"
+  dir=$(write_plugin "missing-$kind" "[\"$kind\"]" "{\"$other_key\": \"Entry.qml\"}")
+  output=$(validate "$dir") && fail "validate refuses $kind without its $entry_point entry point" "$output"
+  grep -qF "kind '$kind' requires an 'entryPoints.$entry_point' to load" <<<"$output" \
+    || fail "validate names the entry point $kind is missing" "$output"
+  pass "validate refuses $kind without its $entry_point entry point"
+done <<'KINDS'
+bar:bar
+bar-widget:barWidget
+menu:menu
+overlay:overlay
+panel:panel
+service:service
+KINDS
+
+# A plugin that is both a bar and a widget owes an entry point for each.
+dir=$(write_plugin "both" '["bar","bar-widget"]' '{"bar": "Bar.qml", "barWidget": "Widget.qml"}')
+validate "$dir" >/dev/null || fail "validate accepts a plugin that satisfies every kind it declares"
+pass "validate accepts a plugin that satisfies every kind it declares"
+
+dir=$(write_plugin "half" '["bar","bar-widget"]' '{"bar": "Bar.qml"}')
+output=$(validate "$dir") && fail "validate refuses a plugin that satisfies only one of its kinds" "$output"
+grep -qF "kind 'bar-widget' requires" <<<"$output" \
+  || fail "validate names the unsatisfied kind" "$output"
+pass "validate refuses a plugin that satisfies only one of its kinds"
+
+# A widget can choose its default bar section, but no other section name.
+for section in left center right; do
+  dir=$(write_plugin "defaults-$section" '["bar-widget"]' '{"barWidget": "Widget.qml"}' "{\"defaultSection\": \"$section\"}")
+  validate "$dir" >/dev/null || fail "validate accepts $section as a default bar widget section"
+  pass "validate accepts $section as a default bar widget section"
+done
+
+dir=$(write_plugin "defaults-bottom" '["bar-widget"]' '{"barWidget": "Widget.qml"}' '{"defaultSection": "bottom"}')
+output=$(validate "$dir") && fail "validate refuses an invalid default bar widget section" "$output"
+grep -qF "'barWidget.defaultSection' must be left, center, or right" <<<"$output" \
+  || fail "validate explains the default bar widget section contract" "$output"
+pass "validate refuses an invalid default bar widget section"
+
+# A kind the table does not cover is left alone rather than guessed at, so an
+# unknown kind is not turned into a demand for an entry point nobody reads.
+dir=$(write_plugin "unknown" '["future-thing"]' '{"service": "Entry.qml"}')
+validate "$dir" >/dev/null || fail "validate leaves a kind it does not know alone"
+pass "validate leaves a kind it does not know alone"
+
+# The check reports the manifest, so a path that does not resolve still gets the
+# more specific complaint it had before.
+dir="$TMPDIR/ghost"
+mkdir -p "$dir"
+cat >"$dir/manifest.json" <<'JSON'
+{
+  "schemaVersion": 1,
+  "id": "acme.ghost",
+  "name": "Acme Ghost",
+  "version": "1.0.0",
+  "kinds": ["bar"],
+  "entryPoints": { "bar": "Missing.qml" }
+}
+JSON
+output=$(validate "$dir") && fail "validate refuses an entry point file that is not there" "$output"
+grep -qF "entry point file not found" <<<"$output" \
+  || fail "validate reports a missing file as a missing file" "$output"
+pass "validate refuses an entry point file that is not there"

test/shell.d/plugins-test.sh

@@ -145,6 +145,12 @@ for (const manifestPath of manifests) {
       )
     }
     check(manifest.barWidget && typeof manifest.barWidget.allowMultiple === 'boolean', `${manifest.id} barWidget allowMultiple must be boolean`)
+    if (manifest.barWidget && manifest.barWidget.defaultSection !== undefined) {
+      check(
+        ['left', 'center', 'right'].includes(manifest.barWidget.defaultSection),
+        `${manifest.id} barWidget defaultSection must be left, center, or right`
+      )
+    }
   }
 
   if (relativePath.endsWith('.manifest.json')) {
@@ -152,5 +158,17 @@ for (const manifestPath of manifests) {
   }
 }
 
+const byId = Object.fromEntries(manifests.map(manifestPath => {
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'))
+  return [manifest.id, manifest]
+}))
+for (const [id, section] of Object.entries({
+  'omarchy.active-window': 'left',
+  'omarchy.dropbox': 'right'
+})) {
+  check(byId[id]?.barWidget?.defaultSection === section, `${id} must default to the ${section} bar section`)
+}
+check(byId['omarchy.media']?.barWidget?.defaultSection === undefined, 'omarchy.media must use the center fallback')
+
 assert(errors.length === 0, 'plugin manifests match shell registry contract', errors.join('\n'))
 JS

test/shell.d/runtime-smoke-test.sh

@@ -108,7 +108,8 @@ done
 jq -e '
   map(.id) as $ids |
   all(["omarchy.menu", "omarchy.notifications", "omarchy.clock", "omarchy.osd"][]; $ids | index(.)) and
-  all(.[]; (.kinds | type == "array") and (.enabled | type == "boolean") and (.firstParty | type == "boolean"))
+  all(.[]; (.kinds | type == "array") and (.enabled | type == "boolean") and (.canDisable | type == "boolean") and (.firstParty | type == "boolean")) and
+  ([.[].name] == ([.[].name] | sort))
 ' <<<"$plugins" >/dev/null || {
   printf 'Plugins:\n%s\n' "$plugins" | jq . >&2
   fail_with_log "shell IPC lists plugin metadata"
@@ -275,4 +276,3 @@ jq -e 'all(.[]; .id != "omarchy.audio")' <<<"$geometry" >/dev/null || {
 }
 
 pass "bar remove reloads shell config and updates bar layout"
-