Title

False plugin provenance / allowlist warnings for npm-installed global plugin under ~/.openclaw/extensions

Summary

openclaw-weixin is installed via openclaw plugins install @tencent-weixin/openclaw-weixin@latest and has a valid plugins.installs record plus an explicit plugins.allow entry in ~/.openclaw/openclaw.json.

However, after restarting openclaw gateway, the runtime still logs:

• plugins.allow is empty; discovered non-bundled plugins may auto-load
• loaded without install/load-path provenance; treat as untracked local code

The plugin loads and works normally. This appears to be a false warning caused by a mismatch between plugin discovery/origin classification and provenance/allowlist checks.

Environment

• OpenClaw host version: 2026.4.5
• Host install path:
  • /Users/tedxiong/.local/share/fnm/node-versions/v24.14.1/installation/lib/node_modules/openclaw
• State dir:
  • /Users/tedxiong/.openclaw
• Plugin:
  • @tencent-weixin/[email protected]
• OS:
  • macOS

Config state

Relevant config excerpt from ~/.openclaw/openclaw.json:

"plugins": {
  "entries": {
    "openclaw-weixin": {
      "enabled": true
    }
  },
  "allow": [
    "minimax",
    "telegram",
    "openclaw-weixin"
  ],
  "installs": {
    "openclaw-weixin": {
      "source": "npm",
      "spec": "@tencent-weixin/openclaw-weixin@latest",
      "installPath": "/Users/tedxiong/.openclaw/extensions/openclaw-weixin",
      "version": "2.1.7",
      "resolvedName": "@tencent-weixin/openclaw-weixin",
      "resolvedVersion": "2.1.7",
      "resolvedSpec": "@tencent-weixin/[email protected]"
    }
  }
}

Observed behavior

After openclaw gateway restart, ~/.openclaw/logs/gateway.err.log contains:

2026-04-08T21:59:08.870+08:00 [plugins] plugins.allow is empty; discovered non-bundled plugins may auto-load: openclaw-weixin (/Users/tedxiong/.openclaw/extensions/openclaw-weixin/index.ts). Set plugins.allow to explicit trusted ids.
2026-04-08T21:59:08.948+08:00 [plugins] openclaw-weixin: loaded without install/load-path provenance; treat as untracked local code and pin trust via plugins.allow or install records (/Users/tedxiong/.openclaw/extensions/openclaw-weixin/index.ts)

But:

• openclaw gateway status reports the service as running
• the plugin loads successfully
• openclaw plugins inspect openclaw-weixin shows both:
  • Origin: global
  • Install: Source: npm, with the correct install record

Example inspect output:

Status: loaded
Source: ~/.openclaw/extensions/openclaw-weixin/index.ts
Origin: global

Install:
Source: npm
Spec: @tencent-weixin/openclaw-weixin@latest
Install path: ~/.openclaw/extensions/openclaw-weixin
Recorded version: 2.1.7

Why this looks wrong

The runtime appears to recognize the plugin install record in some code paths, but not in the warning path.

Manifest registry path appears correct

dist/manifest-registry-Cqdpf6fh.js:

function matchesInstalledPluginRecord(params) {
  if (params.candidate.origin !== "global") return false;
  const record = params.config?.plugins?.installs?.[params.pluginId];
  if (!record) return false;
  const candidateSource = resolveUserPath(params.candidate.source, params.env);
  const trackedPaths = [record.installPath, record.sourcePath]
    .filter(...)
    .map(...);
  if (trackedPaths.length === 0) return false;
  return trackedPaths.some((trackedPath) => {
    return candidateSource === trackedPath || isPathInside(trackedPath, candidateSource);
  });
}

For this plugin:

• candidate.source = /Users/tedxiong/.openclaw/extensions/openclaw-weixin/index.ts
• record.installPath = /Users/tedxiong/.openclaw/extensions/openclaw-weixin

So this should match.

Warning path also appears intended to honor install records

dist/loader-BkajlJCF.js:

function buildProvenanceIndex(params) {
  const installs = params.config.plugins?.installs ?? {};
  for (const [pluginId, install] of Object.entries(installs)) {
    const trackedPaths = [install.installPath, install.sourcePath]...
    ...
  }
}

function isTrackedByProvenance(params) {
  const installRule = params.index.installRules.get(params.pluginId);
  if (installRule) {
    if (installRule.trackedWithoutPaths) return true;
    if (matchesPathMatcher(installRule.matcher, sourcePath)) return true;
  }
  return matchesPathMatcher(params.index.loadPathMatcher, sourcePath);
}

And the warning only fires if provenance tracking fails:

if (allowSet.has(plugin.id)) continue;
if (isTrackedByProvenance(...)) continue;
logger.warn(`[plugins] ${plugin.id}: loaded without install/load-path provenance ...`);

Given the config above, this plugin should be tracked by provenance.

Suspected bug

One of these is happening during gateway load:

1. The warning phase is not receiving the same resolved config that includes plugins.allow and plugins.installs.
2. Plugin origin/discovery metadata is resolved correctly enough for inspect/manifests, but the allowlist/provenance warning path uses a stale or differently-normalized config snapshot.
3. There is a bug in how install rules are built or matched for global plugins installed into ~/.openclaw/extensions/<plugin-id> when the plugin entrypoint is index.ts.

Expected behavior

For an npm-installed plugin with:

• a valid plugins.installs.<id> record
• matching installPath
• explicit plugins.allow entry

gateway startup should not emit either of these warnings:

• plugins.allow is empty
• loaded without install/load-path provenance

Actual impact

• No functional outage
• Produces misleading security warnings in logs
• Makes it hard to distinguish genuine untracked local code from properly-installed plugins

Repro sketch

1. Install plugin with:
   • openclaw plugins install @tencent-weixin/openclaw-weixin@latest
2. Ensure config contains:
   • plugins.entries.openclaw-weixin.enabled = true
   • plugins.allow includes openclaw-weixin
   • plugins.installs.openclaw-weixin.installPath = ~/.openclaw/extensions/openclaw-weixin
3. Restart gateway
4. Observe false warnings in ~/.openclaw/logs/gateway.err.log
5. Run openclaw plugins inspect openclaw-weixin and observe that the same plugin is also recognized as installed from npm

Notes

I separately fixed an unrelated skills-path issue in this environment; after that fix, the only remaining gateway warnings were these plugin provenance warnings.