openclaw - 💡(How to fix) Fix Bug: Plugin checker prefers resolved runtime snapshot over source config snapshot [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#70141Fetched 2026-04-23 07:28:45
View on GitHub
Comments
1
Participants
2
Timeline
2
Reactions
0
Participants
Timeline (top)
closed ×1commented ×1

Root Cause

Root Cause readFacadeBoundaryConfigSafely() calls getRuntimeConfigSnapshot() first. The resolved runtime snapshot normalises plugins differently from the raw source config — plugins.allow ends up empty or missing in the resolved form. The function should prefer getRuntimeConfigSourceSnapshot() (the raw source config snapshot) which preserves the plugins.allow array as written in openclaw.json.

Fix Action

Fix / Workaround

Workaround Patch readFacadeBoundaryConfigSafely() to call getRuntimeConfigSourceSnapshot() before getRuntimeConfigSnapshot().

RAW_BUFFERClick to expand / collapse

Title: Bug: Plugin checker prefers resolved runtime snapshot over source config snapshot

Symptom

  • [plugins] plugins.allow is empty warning fires at startup even when openclaw.json contains a fully-populated plugins.allow list
  • Provenance warnings (loaded without install/load-path provenance) fire for all non-bundled plugins

Root Cause readFacadeBoundaryConfigSafely() calls getRuntimeConfigSnapshot() first. The resolved runtime snapshot normalises plugins differently from the raw source config — plugins.allow ends up empty or missing in the resolved form. The function should prefer getRuntimeConfigSourceSnapshot() (the raw source config snapshot) which preserves the plugins.allow array as written in openclaw.json.

Affected Paths All plugin activation boundary checks:

  • Doctor runs
  • Gateway startup plugin loading
  • OpenClaw install availability

Workaround Patch readFacadeBoundaryConfigSafely() to call getRuntimeConfigSourceSnapshot() before getRuntimeConfigSnapshot().

Suggested Fix In src/plugin-sdk/facade-activation-check.runtime.ts, swap the snapshot preference order so the source snapshot is checked first.

extent analysis

TL;DR

The issue can be fixed by modifying the readFacadeBoundaryConfigSafely() function to prefer the source config snapshot over the resolved runtime snapshot.

Guidance

  • Verify that the openclaw.json file contains a fully-populated plugins.allow list to ensure the issue is not due to a configuration error.
  • Patch the readFacadeBoundaryConfigSafely() function to call getRuntimeConfigSourceSnapshot() before getRuntimeConfigSnapshot() as a temporary workaround.
  • To permanently fix the issue, update the src/plugin-sdk/facade-activation-check.runtime.ts file to swap the snapshot preference order, checking the source snapshot first.
  • Test the fix by running Doctor, Gateway startup plugin loading, and OpenClaw install availability to ensure the plugin activation boundary checks are working correctly.

Example

// Before
function readFacadeBoundaryConfigSafely() {
  const runtimeSnapshot = getRuntimeConfigSnapshot();
  const sourceSnapshot = getRuntimeConfigSourceSnapshot();
  // ...
}

// After
function readFacadeBoundaryConfigSafely() {
  const sourceSnapshot = getRuntimeConfigSourceSnapshot();
  const runtimeSnapshot = getRuntimeConfigSnapshot();
  // ...
}

Notes

This fix assumes that the issue is solely due to the order of snapshot preference in the readFacadeBoundaryConfigSafely() function. If other factors are contributing to the issue, additional debugging may be necessary.

Recommendation

Apply the workaround by patching the readFacadeBoundaryConfigSafely() function, and then update the src/plugin-sdk/facade-activation-check.runtime.ts file to permanently fix the issue. This approach ensures that the plugin activation boundary checks are working correctly while minimizing potential disruptions.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix Bug: Plugin checker prefers resolved runtime snapshot over source config snapshot [1 comments, 2 participants]