From 27ebfc7c4d65ef943dbd10092e56de543df359e1 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Tue, 16 Jun 2026 18:50:25 +0800
Subject: [PATCH] fix(plugins): simplify CLI backend policy ownership

---
 src/plugins/provider-public-artifacts.test.ts |  5 ++---
 src/plugins/provider-public-artifacts.ts      | 15 +++------------
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/src/plugins/provider-public-artifacts.test.ts b/src/plugins/provider-public-artifacts.test.ts
index 7aa2e3082ab8..2fb64976a0da 100644
--- a/src/plugins/provider-public-artifacts.test.ts
+++ b/src/plugins/provider-public-artifacts.test.ts
@@ -237,9 +237,8 @@ describe("provider public artifacts", () => {
       typeof import("./provider-public-artifacts.js")
     >(import.meta.url, "./provider-public-artifacts.js?scope=provider-cli-backend");
 
-    // The anthropic plugin owns the "claude-cli" provider via cliBackends (not `providers`),
-    // so its bundled policy surface must resolve for claude-cli — otherwise claude-cli
-    // subagents silently fall back to the base thinking profile (capped at "high").
+    // CLI backend ids use the same provider-policy owner boundary as provider ids.
+    // Without it, claude-cli subagents fall back to the base thinking profile.
     const surface = resolvePolicySurface("claude-cli", {
       manifestRegistry: {
         plugins: [
diff --git a/src/plugins/provider-public-artifacts.ts b/src/plugins/provider-public-artifacts.ts
index 96e72e1c2a8e..7cccb49952b8 100644
--- a/src/plugins/provider-public-artifacts.ts
+++ b/src/plugins/provider-public-artifacts.ts
@@ -106,23 +106,14 @@ function pluginOwnsProviderPolicyRef(
   normalizedProviderId: string,
 ): boolean {
   const ownedProviders = new Set(
-    plugin.providers.map((provider) => normalizeProviderId(provider)).filter(Boolean),
+    [...plugin.providers, ...plugin.cliBackends]
+      .map((provider) => normalizeProviderId(provider))
+      .filter(Boolean),
   );
   if (ownedProviders.has(normalizedProviderId)) {
     return true;
   }
 
-  // A plugin's policy surface also serves the CLI backends it declares (e.g. the anthropic
-  // plugin owns the "claude-cli" backend). Those backends are providers in their own right
-  // but have no standalone surface, so without this they resolve to no policy at all — which,
-  // in subagent sessions, silently caps their thinking profile at the base "high" ceiling.
-  const ownedCliBackends = new Set(
-    plugin.cliBackends.map((backend) => normalizeProviderId(backend)).filter(Boolean),
-  );
-  if (ownedCliBackends.has(normalizedProviderId)) {
-    return true;
-  }
-
   for (const [rawAlias, rawTarget] of Object.entries(plugin.providerAuthAliases ?? {})) {
     const alias = normalizeProviderId(rawAlias);
     const target = normalizeProviderId(rawTarget);