openclaw - ✅(Solved) Fix ensurePluginAllowlisted no-ops when plugins.allow is undefined [2 pull requests, 2 comments, 2 participants]

openclaw2026-04-03 23:54:41

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#60596•Fetched 2026-04-08 02:49:19

View on GitHub

Comments

Participants

Timeline

Reactions

Author

jgs-jeeves

Participants

jgs-jeeves

jingchang0623-crypto

Timeline (top)

cross-referenced ×4referenced ×3commented ×2closed ×1

Fix Action

Fix

Initialize the array when it doesn't exist instead of bailing:

export function ensurePluginAllowlisted(cfg: OpenClawConfig, pluginId: string): OpenClawConfig {
  const allow = cfg.plugins?.allow ?? [];
  if (allow.includes(pluginId)) {
    return cfg;
  }
  return {
    ...cfg,
    plugins: {
      ...cfg.plugins,
      allow: [...allow, pluginId],
    },
  };
}

This is a one-line change. The install path already calls this function — the wiring is correct, it just needs to bootstrap the array on first use.

PR fix notes

PR #60610: fix: initialize plugins.allow when undefined in ensurePluginAllowlisted

Repository: openclaw/openclaw
Author: kagura-agent
State: closed | merged: False
Link: https://github.com/openclaw/openclaw/pull/60610

Description (problem / solution / changelog)

Problem

When plugins.allow is undefined (not set at all in config), ensurePluginAllowlisted returns the config unchanged — newly installed plugins are never added to the allowlist.

Root cause: The guard !Array.isArray(allow) evaluates to true when allow is undefined, triggering the early return.

Fix

Change the guard to only early-return when the plugin is already present in an existing array. When allow is undefined, initialize it as a new array containing the plugin id.

Before:

if (!Array.isArray(allow) || allow.includes(pluginId)) {
  return cfg;
}
return { ...cfg, plugins: { ...cfg.plugins, allow: [...allow, pluginId] } };

After:

if (Array.isArray(allow) && allow.includes(pluginId)) {
  return cfg;
}
return { ...cfg, plugins: { ...cfg.plugins, allow: [...(Array.isArray(allow) ? allow : []), pluginId] } };

Tests

Added src/config/plugins-allowlist.test.ts covering:

plugins.allow undefined → initializes to [pluginId]
plugins undefined → initializes to [pluginId]
Existing allow array → appends
Already present → returns unchanged (reference equality)
Multiple existing items → preserved when appending

Fixes #60596

Changed files

src/config/plugins-allowlist.test.ts (added, +35/-0)
src/config/plugins-allowlist.ts (modified, +2/-2)

PR #60623: fix(config): initialize plugins.allow when undefined in ensurePluginAllowlisted

Repository: openclaw/openclaw
Author: hclsys
State: closed | merged: False
Link: https://github.com/openclaw/openclaw/pull/60623

Description (problem / solution / changelog)

Summary

Closes #60596

Root cause: ensurePluginAllowlisted() in src/config/plugins-allowlist.ts:5 returns early when plugins.allow is undefined instead of initializing it to []. The guard !Array.isArray(allow) evaluates to true for undefined, causing the function to no-op. Introduced in 183601c (Tak Hoffman, 2026-04-03).

Fix: Use nullish coalescing (cfg.plugins?.allow ?? []) to default allow to an empty array, then only skip when the plugin is already present. 1-line semantic change.

Single-site check: Grepped for !Array.isArray(allow) across the codebase — found 2 other sites (bundled-compat.ts:10, validation.ts:586) but those are intentional guards that bail from compat/validation logic when no allowlist exists. Only plugins-allowlist.ts needs the fix.

Call path: gateway/server.impl.ts:425 → applyPluginAutoEnable() → materializePluginAutoEnableCandidates() → ensurePluginAllowlisted(). Also called from plugins/enable.ts:22 → enablePluginInConfig(). Both paths are exercised on every gateway start and plugin install.

Test plan

Added test case "initializes plugins.allow when undefined" in src/plugins/enable.test.ts
Gateway starts without plugins.allow in config → no warning spam
Plugin allowlisting works correctly when plugins.allow is pre-configured (existing tests cover this)

🤖 Generated with Claude Code

Changed files

src/config/plugins-allowlist.ts (modified, +2/-2)
src/plugins/enable.test.ts (modified, +9/-0)

Code Example

const allow = cfg.plugins?.allow;
if (!Array.isArray(allow) || allow.includes(pluginId)) {
  return cfg;  // ← bails when allow is undefined
}

---

plugins.allow is empty; discovered non-bundled plugins may auto-load...
jeeves-meta-openclaw: loaded without install/load-path provenance; treat as untracked local code...

---

export function ensurePluginAllowlisted(cfg: OpenClawConfig, pluginId: string): OpenClawConfig {
  const allow = cfg.plugins?.allow ?? [];
  if (allow.includes(pluginId)) {
    return cfg;
  }
  return {
    ...cfg,
    plugins: {
      ...cfg.plugins,
      allow: [...allow, pluginId],
    },
  };
}

RAW_BUFFERClick to expand / collapse

Problem

ensurePluginAllowlisted in src/config/plugins-allowlist.ts silently no-ops when plugins.allow is undefined (not yet initialized):

const allow = cfg.plugins?.allow;
if (!Array.isArray(allow) || allow.includes(pluginId)) {
  return cfg;  // ← bails when allow is undefined
}

This means the install path (enablePluginInConfig → ensurePluginAllowlisted) never initializes the allowlist, so installed plugins remain "untracked" and produce warnings on every gateway start:

plugins.allow is empty; discovered non-bundled plugins may auto-load...
jeeves-meta-openclaw: loaded without install/load-path provenance; treat as untracked local code...

Fix

Initialize the array when it doesn't exist instead of bailing:

export function ensurePluginAllowlisted(cfg: OpenClawConfig, pluginId: string): OpenClawConfig {
  const allow = cfg.plugins?.allow ?? [];
  if (allow.includes(pluginId)) {
    return cfg;
  }
  return {
    ...cfg,
    plugins: {
      ...cfg.plugins,
      allow: [...allow, pluginId],
    },
  };
}

This is a one-line change. The install path already calls this function — the wiring is correct, it just needs to bootstrap the array on first use.

extent analysis

TL;DR

Initialize the plugins.allow array when it's undefined to prevent ensurePluginAllowlisted from silently no-opping and to correctly track installed plugins.

Guidance

Verify that the ensurePluginAllowlisted function is being called with the correct cfg and pluginId parameters to ensure the fix is applied correctly.
Check the type definitions for OpenClawConfig to confirm that plugins.allow is expected to be an array, and update the type if necessary.
Test the updated ensurePluginAllowlisted function with different input scenarios, including when plugins.allow is undefined, to ensure it behaves as expected.
Review the install path (enablePluginInConfig → ensurePluginAllowlisted) to confirm that it correctly initializes the allowlist and tracks installed plugins.

Example

The provided fix code snippet demonstrates the correct initialization of the plugins.allow array:

const allow = cfg.plugins?.allow ?? [];

This ensures that allow is always an array, even if cfg.plugins?.allow is undefined.

Notes

This fix assumes that the plugins.allow array is intended to be initialized when it's undefined. If this is not the case, further investigation may be necessary to determine the correct behavior.

Recommendation

Apply the provided workaround by initializing the plugins.allow array when it's undefined, as this fixes the silent no-op issue and allows installed plugins to be correctly tracked.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#installation #tensor shape #autograd error #model save/load #optimization

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

openclaw - ✅(Solved) Fix ensurePluginAllowlisted no-ops when plugins.allow is undefined [2 pull requests, 2 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Fix Action

Fix

PR fix notes

PR #60610: fix: initialize plugins.allow when undefined in ensurePluginAllowlisted

Description (problem / solution / changelog)

Problem

Fix

Tests

Changed files

PR #60623: fix(config): initialize plugins.allow when undefined in ensurePluginAllowlisted

Description (problem / solution / changelog)

Summary

Test plan

Changed files

Code Example

Problem

Fix

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

Still need to ship something?

TRENDING

openclaw - ✅(Solved) Fix ensurePluginAllowlisted no-ops when plugins.allow is undefined [2 pull requests, 2 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Fix Action

Fix

PR fix notes

PR #60610: fix: initialize plugins.allow when undefined in ensurePluginAllowlisted

Description (problem / solution / changelog)

Problem

Fix

Tests

Changed files

PR #60623: fix(config): initialize plugins.allow when undefined in ensurePluginAllowlisted

Description (problem / solution / changelog)

Summary

Test plan

Changed files

Code Example

Problem

Fix

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

Still need to ship something?

RELATED_DISCOVERY

TRENDING