[Piao-2024]

Saving plugin configuration currently ignores a failed reload result and can report success even when the plugin fails to initialize. Return an error explaining that the configuration was saved but the plugin reload failed, including a fallback for exceptions without a message.

Refs #10674. This PR addresses error reporting only; configuration value validation, rollback, and recovery UI remain outside its scope.

Modifications / 改动点

• Check the (success, error_message) result from PluginManager.reload() after saving plugin configuration.

• Report reload failures through the existing API error handling. Preserve exception logging and use a fallback when error details are empty.

• Add five HTTP regression cases covering successful reloads, failed results with and without details, and exceptions with and without messages. Verify that the submitted configuration is saved before reload and remains saved afterward.

• This is NOT a breaking change. Successful requests and response schemas are unchanged; failed reloads now correctly produce error responses.

Screenshots or Test Results / 运行截图或测试结果

Environment: macOS, Python 3.12.11.

Verification steps:

source .venv/bin/activate
python -m pytest -q --tb=short
ruff format --check .
ruff check .
git diff --check

Results:

4880 passed, 14 skipped, 75 warnings in 135.69s
524 files already formatted
All checks passed!
git diff --check: passed

The regression cases exercise the real API route, configuration service, and temporary configuration file, with plugin reload controlled by the test. No manual browser verification was performed; test results are provided as evidence for this backend change.

Checklist / 检查清单

• New features discussed with maintainers: not applicable; this is a bug fix related to [Feature] 增加配置保存前校验，或插件加载失败时修改配置的快捷入口 #10674.
• Changes are tested; verification steps and test results are provided above.
• Documentation impact checked: no navigation, page structure, or UI terminology changes, so no documentation update is needed.
• No new dependencies introduced.
• Changes do not introduce malicious code.

Summary by Sourcery

Report plugin reload failures after configuration saves instead of incorrectly returning success.

Bug Fixes:

• Report plugin configuration save requests as errors when the subsequent plugin reload fails or raises an exception, while clearly indicating that the configuration was saved and providing fallback error details.

Tests:

• Add HTTP regression coverage for successful reloads, reload failures with and without details, and reload exceptions with and without messages, including verification that configuration remains saved.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/dashboard/services/config_service.py" line_range="1144" />
<code_context>
+        try:
+            success, error_message = await self.core_lifecycle.plugin_manager.reload(
+                plugin_name
+            )
+        except Exception as exc:
+            logger.exception(
</code_context>
<issue_to_address>
**Plugin errors expose secrets**

When a caller with plugin-scoped API access submits configuration that causes an installed plugin to raise an error containing a secret or other sensitive internal detail, `save_plugin_configs` puts the reload result or exception text into a `ValueError`, and the API returns that message to the caller; secrets included in plugin-generated errors are exposed.

Return a generic reload-failure message to API callers and keep detailed exception information in protected server logs.

Also at `astrbot/dashboard/services/config_service.py:1146`.
</issue_to_address>

Sourcery assessment

Approval pending. 1 finding to address first.

Blocking findings: astrbot/dashboard/services/config_service.py:1144

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

🟡 Medium · Plugin errors expose secrets

When a caller with plugin-scoped API access submits configuration that causes an installed plugin to raise an error containing a secret or other sensitive internal detail, save_plugin_configs puts the reload result or exception text into a ValueError, and the API returns that message to the caller; secrets included in plugin-generated errors are exposed.

Return a generic reload-failure message to API callers and keep detailed exception information in protected server logs.

Also at astrbot/dashboard/services/config_service.py:1146.

Prompt for AI agents

In `astrbot/dashboard/services/config_service.py` at line 1144:

**Plugin errors expose secrets**

When a caller with plugin-scoped API access submits configuration that causes an installed plugin to raise an error containing a secret or other sensitive internal detail, `save_plugin_configs` puts the reload result or exception text into a `ValueError`, and the API returns that message to the caller; secrets included in plugin-generated errors are exposed.

Return a generic reload-failure message to API callers and keep detailed exception information in protected server logs.

Also at `astrbot/dashboard/services/config_service.py:1146`.