openclaw - 💡(How to fix) Fix agents_list shows orphaned allowlist entries as spawnable agents; sessions_spawn accepts them without validation

Bug Summary

When an agent configuration is deleted but its ID remains in agents.main.subagents.allowAgents, the agents_list tool continues to display it as a spawnable agent, and sessions_spawn successfully creates a fully functional session for it — with no warning or validation that the agent has no actual configuration.

Steps to Reproduce

1. Configure a sub-agent with a specific ID (e.g., my-worker) in agents.list[]
2. Add my-worker to agents.main.subagents.allowAgents (the spawn allowlist)
3. Verify agents_list shows my-worker — ✅ correct
4. Delete the agent configuration from agents.list[]
5. Do not remove my-worker from allowAgents (easy to forget)
6. Call agents_list → my-worker still appears with "configured": false
7. Call sessions_spawn with agentId: "my-worker" → accepted and runs successfully

Observed Behavior

• agents_list returns the orphaned ID as if it is a valid, available agent
• sessions_spawn creates a live session using only defaults (implicit runtime, default model)
• The spawned agent has full host filesystem access — no sandbox restrictions are applied
• The "configured": false field is ambiguous and does not clearly indicate "this agent has no configuration"

Expected Behavior

At minimum:

• sessions_spawn should reject agent IDs that have no corresponding configuration in agents.list[]
• agents_list should either exclude orphaned entries or clearly mark them as "unconfigured — spawn will use defaults"

Ideally:

• When an agent config is removed from agents.list[], its entry should be auto-removed from allowAgents
• Or: agents_list should distinguish between "configured agent" and "allowlist-only entry"

Security Impact

An agent that was intentionally removed (e.g., due to permission issues, decommissioning, or misconfiguration) can be respawned by any session with spawn access, inheriting default permissions with no explicit sandbox or tool restrictions. This is a privilege boundary bypass — the operator believes the agent is gone, but it persists as a ghost in the allowlist.

Environment

• OpenClaw 2026.5.12
• Node.js v22.22.0
• Ubuntu 22.04

Workaround

Manually audit agents.main.subagents.allowAgents and remove any IDs that no longer have a corresponding entry in agents.list[].