Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

On 2026.4.23, the gateway's typed-hook block error instructs users to set plugins.entries.<plugin>.hooks.allowConversationAccess=true, but adding that exact key causes the config validator to reject it with Unrecognized key: "allowConversationAccess" and auto-restore the prior config; reproduced once on Ubuntu 24.04 with @openguardrails/[email protected].

Steps to reproduce

1. Upgrade OpenClaw to 2026.4.23.
2. Install a non-bundled plugin that registers typed hooks: openclaw plugins install @openguardrails/moltguard. Confirm plugins.entries.moltguard.enabled: true in ~/.openclaw/openclaw.json.
3. Reload openclaw-gateway. Gateway log shows typed hook "agent_end" blocked because non-bundled plugins must set plugins.entries.moltguard.hooks.allowConversationAccess=true (and the same for llm_input, llm_output).
4. Add "hooks": { "allowConversationAccess": true } under plugins.entries.moltguard in openclaw.json and save.
5. Gateway auto-reload emits Unrecognized key: "allowConversationAccess" and Config auto-restored from last-known-good: openclaw.json (reload-invalid-config). The file on disk is overwritten back to the prior state.

Expected behavior

NOT_ENOUGH_INFO

(No grounded reference to a prior version where this exact config path was accepted; only observed that the error message and the validator schema disagree on the same key in 2026.4.23.)

Actual behavior

Adding plugins.entries.moltguard.hooks.allowConversationAccess: true to ~/.openclaw/openclaw.json causes the gateway auto-reload to log Unrecognized key: "allowConversationAccess" followed by Config auto-restored from last-known-good: openclaw.json (reload-invalid-config). The file on disk is overwritten back to the prior state. With the key absent, the gateway repeatedly logs typed hook "agent_end" blocked because non-bundled plugins must set plugins.entries.moltguard.hooks.allowConversationAccess=true (and the same for llm_input, llm_output), and the plugin's hooks are not invoked.

OpenClaw version

2026.4.23 (commit a979721)

Operating system

Ubuntu 24.04

Install method

npm global

Model

Gemma 4 31B IT UD-Q4_K_XL via llama-server (b8870, ROCm). Model is not relevant to this bug; the failure is in plugin config validation, independent of the LLM in use.

Provider / routing chain

openclaw -> llama-server (local, http://127.0.0.1:11437, OpenAI-compatible)

Additional provider/model setup details

Local llama-server (b8870, ROCm) on the same host. No remote provider, no proxy, no router. Relevant config lives in ~/.openclaw/openclaw.json under models.providers.<localname>. Provider/model setup is not relevant to this bug; the failure is in plugin config validation.

Logs, screenshots, and evidence

Gateway log on enabling moltguard with `plugins.entries.moltguard.enabled: true` (no `hooks` key):

  [plugins] [moltguard] Platform: active (autonomous mode)
  [gateway] [plugins] typed hook "agent_end" blocked because non-bundled plugins must set
    plugins.entries.moltguard.hooks.allowConversationAccess=true
    (plugin=moltguard, source=/home/<user>/.openclaw/extensions/moltguard/dist/index.js)
  [gateway] [plugins] typed hook "llm_input" blocked  (same reason)
  [gateway] [plugins] typed hook "llm_output" blocked  (same reason)
  [gateway] ready (4 plugins: browser, claude-delegator, discord, moltguard; 1.0s)

Gateway log after adding `plugins.entries.moltguard.hooks.allowConversationAccess: true`:

  Unrecognized key: "allowConversationAccess"
  Config auto-restored from last-known-good: openclaw.json (reload-invalid-config)

SDK type definitions present in the installed package (paths shown to help locate the relevant code):

  dist/plugin-sdk/src/plugins/registry.d.ts:
    type PluginTypedHookPolicy = {
      allowPromptInjection?: boolean;
      allowConversationAccess?: boolean;
    };

  dist/plugin-sdk/src/plugins/status.d.ts:
    policy: {
      allowPromptInjection?: boolean;
      allowConversationAccess?: boolean;
      allowModelOverride?: boolean;
      allowedModels: string[];
      hasAllowedModelsConfig: boolean;
    };

In `dist/loader-<hash>.js` (hash varies per build), both literal forms `.allowConversationAccess` and `.hooks.allowConversationAccess` appear. The runtime hook-block error message generator references the `hooks.allowConversationAccess` path, but the user-facing config validator does not appear to expose that key in the accepted schema, suggesting the error message generator and the config validator schema are defined in separate modules and one was updated without the other.

Impact and severity

Affected users/systems/channels: Any deployment using non-bundled plugins that register typed hooks (agent_end, llm_input, llm_output) on 2026.4.23. Confirmed with @openguardrails/[email protected] (current npm latest). Severity: Blocks security guardrails. Operators who rely on MoltGuard or similar non-bundled hook plugins cannot run them on 2026.4.23 without disabling protection entirely. Frequency: Always (1/1 reproduction on a clean upgrade to 2026.4.23). Consequence: Forced to set plugins.entries.moltguard.enabled: false to silence the typed-hook block log spam, forfeiting all guardrail functionality until a fix is released.

Additional information

Workaround in use: plugins.entries.moltguard.enabled: false. Plugin remains in plugins.allow and on disk; only the runtime activation is gated.

Suggested resolution directions (rough priority):

1. Sync the config validator schema with the error message generator: add hooks.allowConversationAccess (and hooks.allowPromptInjection by symmetry) to accepted keys under plugins.entries.<plugin> so the documented remediation actually works.
2. Promote canonical guardrail plugins (e.g. MoltGuard) to bundled status so they bypass the non-bundled typed-hook restriction; the wording "non-bundled plugins must set..." implies bundled plugins are exempt.
3. At minimum, update the error message to match what the validator currently accepts, so users have an actionable path even if the underlying restriction is intentional.

Last-known-good for non-bundled hook plugins: NOT_ENOUGH_INFO (have not tested 4.22.x with @openguardrails/moltguard on this host).

Related: this report is independent of #63732 (heartbeat/cron daily reset regression in 4.x), but both surface in 2026.4.23 and together leave operators with reduced protection (no MoltGuard) and unbounded session growth.