openclaw - 💡(How to fix) Fix [Bug]: 4.23 silently breaks agent_end hooks for non-bundled plugins (openclaw-mem0 auto-capture) [1 participants]

Bug Description

After upgrading to OpenClaw 2026.4.23, the openclaw-mem0 plugin's agent_end hook is silently blocked with:

[gateway] typed hook "agent_end" blocked because non-bundled plugins must set plugins.entries.openclaw-mem0.hooks.allowConversationAccess=true

This means auto-capture stops working entirely after upgrading to 4.23. Auto-recall still works (via before_prompt_build, which isn't gated), so the system appears healthy — memories are injected into context, but no new memories are ever saved.

Impact

• Every openclaw-mem0 user who upgrades to 4.23 has broken auto-capture
• The failure is completely silent — no error in openclaw status, no user-visible warning
• Recall working normally masks the issue — users won't notice until they realize no new memories have been captured
• The only evidence is a single INFO-level log line in gateway logs

Root Cause

4.23 introduced a security gate requiring plugins.entries.<id>.hooks.allowConversationAccess=true for non-bundled plugins to use typed hooks (agent_end, llm_input, llm_output). The default is false (deny).

This is a reasonable security feature, but it's a silent breaking change for existing installations.

Additional Problem: Config Schema Rejects the Fix

Attempting to set the required config via CLI fails:

$ openclaw config set plugins.entries.openclaw-mem0.hooks.allowConversationAccess true
Error: Config validation failed: plugins.entries.openclaw-mem0.hooks: Unrecognized key: "allowConversationAccess"

The gateway code reads hooks.allowConversationAccess, but the config validation schema doesn't include it. So the documented fix cannot be applied through normal config tooling.

Workaround

Patch the loader to change the default from deny to allow:

In dist/loader-*.js, find the allowConversationAccess check and change:

// Before (deny by default):
if (explicitConversationAccess !== true) {
// After (allow by default, respect explicit false):
if (explicitConversationAccess === false) {

Suggested Fixes

1. Config schema: Add hooks.allowConversationAccess to the plugin entries schema so openclaw config set works
2. Default behavior: Plugins listed in plugins.allow are explicitly trusted — consider defaulting allowConversationAccess=true for allowed plugins
3. Migration warning: openclaw doctor or openclaw status should warn when non-bundled plugins have registered agent_end hooks but allowConversationAccess is not set
4. Changelog: Document this as a breaking change in 4.23 release notes

Environment

• OpenClaw: 2026.4.23
• openclaw-mem0: 1.0.4 (open-source mode)
• OS: macOS (arm64)
• Previous version: 2026.4.12 (working)