chore: remove unused remote plugin download and install codepath

[wyattwalter]

Description

Removes the Redis pub/sub plugin-install pipeline and the remote JAR download/hot-load mechanism (PluginServiceCEImpl.downloadAndStartPlugin, redisInstallPlugin, RedisListenerConfig, InstallPluginRedisDTO), plus the now-unused APPSMITH_REMOTE_API_KEY dummy env var in the ci-test workflows.

This path dates from the 2019 single-server model: it wrote to ephemeral container disk (../dist/plugins/), had no startup reconciliation, and relied on non-durable Redis pub/sub fan-out, so it cannot work in a multi-pod deployment. Nothing sets jarLocation anymore, so the download block was unreachable in practice.

Not affected:

• Bundled plugin loading at container startup via PF4J (separate path, untouched)
• Workspace plugin association (installPlugin) — still works, now writes the association directly instead of also publishing a no-op Redis event
• The scheduled remote-plugin metadata sync

Also removes the rest of the now-dead appsmith:queue channel: the unused ReactiveRedisTemplate/ChannelTopic constructor parameters on the plugin service, the /redisPub debug endpoint (it could only report zero subscribers with the listener gone), and the ChannelTopic bean.

Linear: https://linear.app/appsmith/issue/APP-15381

Automation

/ok-to-test tags="@tag.All"

🤖 Generated with Claude Code

Tip

🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/30131707848
Commit: 0ef40f9
Cypress dashboard.
Tags: @tag.All
Spec:

---

Fri, 24 Jul 2026 23:46:04 UTC

Summary by CodeRabbit

• New Features

  • Plugin installation now records workspace plugin information directly, improving installation reliability.
  • Runtime hostnames are recognized by SSRF protection for improved connectivity in deployed environments.

• Bug Fixes

  • Removed legacy Redis-based plugin installation and testing pathways.
  • Simplified plugin and application startup by eliminating unused Redis listener configuration.

[coderabbitai]

Walkthrough

Redis-based plugin installation and publishing are removed from the CE server path. Workspace plugin associations are persisted directly, Redis dependencies and listener wiring are deleted, and SSRF host registration includes the runtime HOSTNAME.

Changes

Redis plugin flow removal

Layer / File(s)	Summary
Direct workspace plugin persistence app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceCE.java, app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceCEImpl.java, app/server/appsmith-server/src/main/java/com/appsmith/server/dtos/InstallPluginRedisDTO.java	The Redis installation contract, DTO, download/start helper, and publication flow are removed; workspace plugin associations are appended and saved directly.
Redis dependency cleanup app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceImpl.java, app/server/appsmith-server/src/main/java/com/appsmith/server/controllers/IndexController.java, app/server/appsmith-server/src/test/java/com/appsmith/server/services/ce/PluginServiceCEImplTest.java	Redis constructor dependencies and test mocks are removed from plugin services and controllers.
Redis surface and listener removal app/server/appsmith-server/src/main/java/com/appsmith/server/controllers/ce/IndexControllerCE.java, app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/RedisListenerConfig.java	The /redisPub endpoint and Redis listener configuration are removed. The root controller retains the reactive greeting endpoint.

SSRF hostname registration

Layer / File(s)	Summary
Runtime hostname registration app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/RedisConfig.java	SSRF own-host registration now includes the HOSTNAME environment variable, and the appsmith:queue ChannelTopic bean is removed.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• appsmithorg/appsmith#41985: Updates the related SSRF own-host tracking and cache logic.

Poem

Redis waves fade from the shore,
Plugins save themselves once more.
A hostname joins the trusted band,
While queues drift off into the sand.
Direct paths now quietly bloom.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: removing the remote plugin download and install codepath.
Description check	✅ Passed	The description is mostly complete and includes scope, motivation, automation, and test results.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/remove-remote-plugin-install-path

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceCEImpl.java (1)

173-199: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Missing plugin-existence validation before persisting the association.

The removed Redis-publish path previously looked up the Plugin from the repository before saving the workspace association (per the old-flow description). The new flow drops that lookup and unconditionally appends a WorkspacePlugin for whatever pluginId is supplied in pluginDTO, without verifying the plugin actually exists in PluginRepository. installPlugin only checks for null/empty pluginId (Line 139), not existence. This lets an invalid/non-existent pluginId get durably persisted into workspace.getPlugins().

🛡️ Proposed fix to validate plugin existence before saving

     private Mono<Workspace> storeWorkspacePlugin(PluginWorkspaceDTO pluginDTO, WorkspacePluginStatus status) {
 
         Mono<Workspace> pluginInWorkspaceMono =
                 workspaceService.findByIdAndPluginsPluginId(pluginDTO.getWorkspaceId(), pluginDTO.getPluginId());
 
         // If plugin is already present for the workspace, just return the workspace, else install and return workspace
         return pluginInWorkspaceMono.switchIfEmpty(Mono.defer(() -> {
             log.debug("Plugin {} not already installed. Installing now", pluginDTO.getPluginId());
             // If the plugin is not found in the workspace, its not installed already. Install now.
-            return workspaceService.getById(pluginDTO.getWorkspaceId()).flatMap(workspace -> {
+            return repository
+                    .findById(pluginDTO.getPluginId())
+                    .switchIfEmpty(Mono.error(new AppsmithException(
+                            AppsmithError.NO_RESOURCE_FOUND, FieldName.PLUGIN_ID, pluginDTO.getPluginId())))
+                    .then(workspaceService.getById(pluginDTO.getWorkspaceId()))
+                    .flatMap(workspace -> {
                 Set<WorkspacePlugin> workspacePluginList = workspace.getPlugins();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceCEImpl.java`
around lines 173 - 199, Update storeWorkspacePlugin to validate
pluginDTO.getPluginId() through PluginRepository before adding the
WorkspacePlugin association or calling workspaceService.save. Preserve the
existing already-installed path, and ensure nonexistent plugin IDs terminate
without persisting the workspace association, using the repository’s established
missing-plugin behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In
`@app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceCEImpl.java`:
- Around line 173-199: Update storeWorkspacePlugin to validate
pluginDTO.getPluginId() through PluginRepository before adding the
WorkspacePlugin association or calling workspaceService.save. Preserve the
existing already-installed path, and ensure nonexistent plugin IDs terminate
without persisting the workspace association, using the repository’s established
missing-plugin behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 1ca376aa-21e3-467d-acf7-1a0c3c55ad53

📥 Commits

Reviewing files that changed from the base of the PR and between 583811d and 0ef40f9.

📒 Files selected for processing (9)

• app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/RedisConfig.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/RedisListenerConfig.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/controllers/IndexController.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/controllers/ce/IndexControllerCE.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/dtos/InstallPluginRedisDTO.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceCE.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceCEImpl.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceImpl.java
• app/server/appsmith-server/src/test/java/com/appsmith/server/services/ce/PluginServiceCEImplTest.java

💤 Files with no reviewable changes (7)

• app/server/appsmith-server/src/main/java/com/appsmith/server/dtos/InstallPluginRedisDTO.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceCE.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/RedisListenerConfig.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/plugins/base/PluginServiceImpl.java
• app/server/appsmith-server/src/test/java/com/appsmith/server/services/ce/PluginServiceCEImplTest.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/RedisConfig.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/controllers/ce/IndexControllerCE.java