Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Plugin ownership policy disagreement between CLI parser and gateway loader [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#71419•Fetched 2026-04-26 05:12:58
View on GitHub
Comments
1
Participants
2
Timeline
2
Reactions
0
Author
mayank6136mayank6136
Participants
mayank6136mayank6136steipetesteipete
Timeline (top)
closed ×1commented ×1

The CLI's pre-flight config parser and the gateway's plugin loader disagree on plugin-directory ownership policy. The CLI emits warnings like:

Config warnings:
- plugins: plugin: blocked plugin candidate: suspicious ownership (/data/.openclaw/extensions/mycelium, uid=1000, expected uid=0 or root)
- plugins: plugin: blocked plugin candidate: suspicious ownership (/data/plugins/openclaw-deep-observability/observability-plugin, uid=1000, expected uid=0 or root)

…but the gateway's startup logs show those exact plugins loaded:

[gateway] ready (3 plugins: browser, mycelium, openclaw-deep-observability; 64.0s)

Spans subsequently appear in ClickHouse confirming the deep-observability plugin is functional despite the "blocked" warning.

Root Cause

The CLI's pre-flight config parser and the gateway's plugin loader disagree on plugin-directory ownership policy. The CLI emits warnings like:

Config warnings:
- plugins: plugin: blocked plugin candidate: suspicious ownership (/data/.openclaw/extensions/mycelium, uid=1000, expected uid=0 or root)
- plugins: plugin: blocked plugin candidate: suspicious ownership (/data/plugins/openclaw-deep-observability/observability-plugin, uid=1000, expected uid=0 or root)

…but the gateway's startup logs show those exact plugins loaded:

[gateway] ready (3 plugins: browser, mycelium, openclaw-deep-observability; 64.0s)

Spans subsequently appear in ClickHouse confirming the deep-observability plugin is functional despite the "blocked" warning.

Code Example

Config warnings:
- plugins: plugin: blocked plugin candidate: suspicious ownership (/data/.openclaw/extensions/mycelium, uid=1000, expected uid=0 or root)
- plugins: plugin: blocked plugin candidate: suspicious ownership (/data/plugins/openclaw-deep-observability/observability-plugin, uid=1000, expected uid=0 or root)

---

[gateway] ready (3 plugins: browser, mycelium, openclaw-deep-observability; 64.0s)
RAW_BUFFERClick to expand / collapse

Summary

The CLI's pre-flight config parser and the gateway's plugin loader disagree on plugin-directory ownership policy. The CLI emits warnings like:

Config warnings:
- plugins: plugin: blocked plugin candidate: suspicious ownership (/data/.openclaw/extensions/mycelium, uid=1000, expected uid=0 or root)
- plugins: plugin: blocked plugin candidate: suspicious ownership (/data/plugins/openclaw-deep-observability/observability-plugin, uid=1000, expected uid=0 or root)

…but the gateway's startup logs show those exact plugins loaded:

[gateway] ready (3 plugins: browser, mycelium, openclaw-deep-observability; 64.0s)

Spans subsequently appear in ClickHouse confirming the deep-observability plugin is functional despite the "blocked" warning.

Observed behaviour

CLI warns "blocked" → gateway loads anyway. Inconsistent policy across two code paths in the same process tree.

Expected behaviour

One source of truth. Either:

  • Tighten the gateway loader to honour the same ownership policy (and refuse to load), or
  • Relax the CLI parser to match the gateway (and stop printing warnings the gateway will ignore).

Why it matters

The "blocked" wording is alarming and looks like a real failure. We spent investigation time confirming the plugin actually loaded by querying ClickHouse for spans. A clearer message ("CLI parser would not have loaded this; gateway loaded it anyway") would save effort, but consistent behaviour is better.

Note: in our environment the openclaw container's /entrypoint.sh runs chown -R node:node /data on every start, so any host-side chown to root is reverted — meaning the "expected uid=0 or root" check is effectively unsatisfiable for any plugin under /data/.

Environment

OpenClaw 2026.4.12 (1c0672b).

extent analysis

TL;DR

Relax the CLI parser's ownership policy to match the gateway's behavior, as the current "blocked" warnings are misleading and inconsistent with the actual plugin loading behavior.

Guidance

  • Investigate the possibility of updating the CLI parser to ignore the ownership check for plugins under /data/, given that the chown command in the container's entrypoint script renders the "expected uid=0 or root" check unsatisfiable.
  • Consider adding a clearer message in the CLI parser to indicate when a plugin would not have been loaded due to ownership issues, but is loaded by the gateway anyway.
  • Review the gateway's plugin loader to ensure it is correctly handling plugins with non-root ownership, and consider tightening its policy to match the CLI parser's expectations if necessary.
  • Verify that the desired behavior is achieved by testing the plugin loading process with different ownership scenarios.

Example

No code snippet is provided, as the issue is more related to configuration and policy consistency rather than a specific code fix.

Notes

The current behavior is inconsistent and may cause unnecessary investigation time due to misleading warnings. Relaxing the CLI parser's ownership policy or updating its messaging can help alleviate this issue. However, it is essential to ensure that the desired behavior is achieved and that plugin loading is handled correctly by both the CLI parser and the gateway.

Recommendation

Apply a workaround by relaxing the CLI parser's ownership policy to match the gateway's behavior, as this is the most straightforward way to address the inconsistent warnings and behavior.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#installation#tensor shape#autograd error#model save/load#optimization

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING