Installing a plugin from a library bypasses the upgrader modules

Installing a plugin from a plugin library adds the tiddler straight to the store:

} else if(event.data.cookies.type === "save-tiddler") {
	var tiddler = $tw.utils.parseJSONSafe(event.data.body);
	$tw.wiki.addTiddler(new $tw.Tiddler(tiddler));
}

core/modules/startup/browser-messaging.js L171-173, the tm-load-plugin-from-library handler.

The import path instead calls wiki.invokeUpgraders() (core/modules/widgets/navigator.js L528). So dragging a plugin file into the wiki is checked, and installing the same plugin from a library is not.

What the library path skips:

• BLOCKED_PLUGINS in core/modules/upgraders/plugins.js. $:/themes/tiddlywiki/stickytitles and $:/plugins/tiddlywiki/fullscreen are suppressed on import at every version, and install normally from a library.
• The version check in the same module, which suppresses an incoming plugin older than the installed one.
• core/modules/upgraders/system.js, which suppresses $:/Import and $:/build, and warns when a shadow $:/core/modules/ tiddler would be overwritten.
• The th-importing-tiddler hook, so a plugin cannot inspect or reject an incoming library tiddler.