openclaw - ✅(Solved) Fix lossless-claw plugin loads with provenance warning despite working correctly [1 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#43655Fetched 2026-04-08 00:16:17
View on GitHub
Comments
1
Participants
1
Timeline
5
Reactions
0
Participants
Timeline (top)
closed ×1commented ×1cross-referenced ×1locked ×1

Error Message

WARN lossless-claw: loaded without install/load-path provenance; treat as untracked local code and pin trust via plugins.allow or install records (/home/ubuntu/.openclaw/extensions/lossless-claw/index.ts)

Fix Action

Fixed

PR fix notes

PR #43723: fix(plugins): suppress provenance warning for plugins in plugins.allow

Description (problem / solution / changelog)

Summary

  • Suppress the "loaded without install/load-path provenance" warning for plugins that are explicitly listed in plugins.allow
  • When a user explicitly trusts a plugin via plugins.allow, the provenance warning is redundant and confusing

Closes #43655

Changes

  • src/plugins/loader.ts: Added allow parameter to warnAboutUntrackedLoadedPlugins() and skip warning for plugins in the allow list
  • src/plugins/loader.test.ts: Updated existing test to verify warning is suppressed for allowed plugins; added new test to verify warning still fires for non-allowed plugins

Test plan

  • Existing test updated: allowed plugin no longer triggers provenance warning
  • New test added: non-allowed plugin still triggers provenance warning
  • All 29 loader tests pass (pnpm vitest run src/plugins/loader.test.ts)

🤖 Generated with Claude Code

Changed files

  • src/plugins/loader.test.ts (modified, +36/-1)
  • src/plugins/loader.ts (modified, +6/-0)

Code Example

WARN lossless-claw: loaded without install/load-path provenance; treat as untracked local code and pin trust via plugins.allow or install records (/home/ubuntu/.openclaw/extensions/lossless-claw/index.ts)

---

"plugins": {
  "allow": ["lossless-claw", "discord"]
}
RAW_BUFFERClick to expand / collapse

Bug Description

The lossless-claw plugin loads and functions correctly but generates a warning about missing install/load-path provenance during startup.

Environment

  • OpenClaw: 2026.3.8 (3caab92)
  • OS: Ubuntu 24.04.4 LTS (ARM64)
  • Node: v22.22.0
  • Platform: AWS EC2 (Graviton 3)

Warning Message

WARN lossless-claw: loaded without install/load-path provenance; treat as untracked local code and pin trust via plugins.allow or install records (/home/ubuntu/.openclaw/extensions/lossless-claw/index.ts)

Plugin Status

  • Plugin: lossless-claw (version 0.2.5)
  • Status: loaded and enabled
  • Functionality: working correctly (LCM compression active)
  • Location: /home/ubuntu/.openclaw/extensions/lossless-claw/index.ts

Configuration

The plugin is explicitly allowed in configuration:

"plugins": {
  "allow": ["lossless-claw", "discord"]
}

Current Behavior

  • Plugin loads successfully
  • All LCM functionality works (compression, grep, expand, etc.)
  • Warning appears in doctor output and logs
  • No functional impact

Expected Behavior

No warning should appear for properly configured and allowed plugins

Additional Context

  • Plugin is in plugins.allow list
  • Located in standard extensions directory
  • May be related to how locally developed/installed plugins are tracked vs npm-installed ones
  • Similar pattern might affect other locally developed plugins

Suggested Fix

  • Improve plugin provenance detection for locally developed plugins
  • Or adjust warning logic to not trigger for plugins in plugins.allow
  • Or provide clearer guidance on how to properly register local plugin provenance

extent analysis

Fix Plan

To resolve the warning about missing install/load-path provenance, we can adjust the warning logic to not trigger for plugins in plugins.allow. Here are the concrete steps:

  • Update the plugins.allow configuration to include a provenance field for the lossless-claw plugin:
"plugins": {
  "allow": [
    {
      "name": "lossless-claw",
      "provenance": "local"
    },
    "discord"
  ]
}
  • Modify the plugin loading code to check for the provenance field in the plugins.allow configuration:
// In the plugin loading function
if (pluginAllowList.includes(pluginName) || pluginAllowList.some((allowedPlugin) => allowedPlugin.name === pluginName && allowedPlugin.provenance === 'local')) {
  // Load the plugin without warning
} else {
  // Load the plugin with warning
}
  • Alternatively, you can also provide clearer guidance on how to properly register local plugin provenance by adding a provenance field to the plugin's package.json file:
{
  "name": "lossless-claw",
  "version": "0.2.5",
  "provenance": "local"
}

Verification

To verify that the fix worked, restart the OpenClaw application and check the logs for the warning message. The warning should no longer appear.

Extra Tips

  • Make sure to update the plugins.allow configuration and the plugin loading code to handle the new provenance field.
  • Consider adding a provenance field to all locally developed plugins to ensure consistent behavior.
  • If you are using a similar pattern for other locally developed plugins, make sure to update their configurations and code accordingly.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING