Bug Report: Config Auto-Restore Undoes Security Fix for plugins.allow Phantom Entries

Summary

When removing phantom entries from plugins.allow (as recommended by openclaw security audit), the Gateway's config auto-recovery mechanism treats the valid config as "invalid" and automatically restores the previous backup — re-adding the phantom entries. This creates an impossible situation where the security warning cannot be resolved.

Environment

Steps to Reproduce

1. Run openclaw security audit — observe warning:

   WARN plugins.allow contains entries with no matching installed plugin
   The following plugins.allow entries do not correspond to any installed plugin:
   ollama, xai, anthropic, active-memory, brave, memory-core, memory-wiki

2. Edit ~/.openclaw/openclaw.json to remove phantom entries from plugins.allow

3. Save the file — Gateway config watcher detects change

4. Wait 5-10 minutes for config watcher debounce cycle

5. Check openclaw.json — phantom entries have returned

6. Check logs for:

   Config auto-restored from last-known-good: openclaw.json (reload-invalid-config)
   config reload restored last-known-good config after invalid-config

Expected Behavior

According to official docs:

Bundled plugins (shipped with OpenClaw) do NOT need to be listed in plugins.allow:

• Model providers: ollama, xai, anthropic, etc. (enabled by default)
• Memory plugins: memory-core, memory-wiki, active-memory
• Web search: brave

Removing these phantom entries should:

• ✅ Be accepted as valid config
• ✅ Pass security audit without warnings
• ✅ Persist after Gateway restart

Actual Behavior

The Gateway's config validator incorrectly treats the removal of phantom entries as "invalid config" and triggers auto-restore from backup.

Timeline from logs:

12:12:38 - Config auto-restored from last-known-good (reload-invalid-config)
12:12:38 - config reload restored last-known-good config after invalid-config
12:16:24 - config change detected; evaluating reload (plugins.allow)
12:16:24 - config change requires gateway restart — deferring until tasks complete
12:21:24 - restart timeout after 300101ms; restarting anyway

Result: Phantom entries reappear, security warning persists.

Root Cause Analysis

Two OpenClaw subsystems are in conflict:

1. Security Audit (audit-extra.async-B8LP_fjX.js)

Correctly identifies phantom entries as a security risk:

checkId: "plugins.allow_phantom_entries",
severity: "warn",
title: "plugins.allow contains entries with no matching installed plugin",
remediation: "Remove unused entries from plugins.allow"

2. Config Validator/Reload (gateway/reload subsystem)

Incorrectly validates that all enabled plugins must be in plugins.allow:

This logic is incorrect for bundled plugins because:

• Bundled plugins are auto-enabled by default
• They do NOT require plugins.allow entries (per docs)
• The validator doesn't distinguish between bundled vs. external plugins

Impact

Affected Users: Anyone trying to clean up plugins.allow per security recommendations.

Workaround

None currently.

Suggested Fixes

Priority 1: Fix Config Validator Logic

Check if a plugin is bundled before requiring it in plugins.allow

Priority 2: Improve Auto-Restore Transparency

Log which specific validation failed when auto-restoring

Priority 3: Documentation Update

Clarify which plugins require plugins.allow entries (external only)

Evidence

Log Snippet

12:12:38 - Config auto-restored from last-known-good (reload-invalid-config)
12:12:38 - config reload restored last-known-good config after invalid-config

Reported by: Johannes Huijbregts (via Echo assistant)
Date: 2026-04-25