Security audit false positive: plugins.allow_phantom_entries flags bundled stock plugins as phantom in CLI context

Summary

openclaw security audit --deep can incorrectly warn that plugins.allow contains phantom entries even when those plugin IDs are valid bundled stock plugins and are visibly loaded in openclaw plugins list.

The root cause appears to be that the audit check uses listChannelPlugins() as the bundled-plugin inventory source. In CLI/audit context, listChannelPlugins() returns only runtime-loaded channel plugins, and can return an empty list. That makes legitimate bundled plugins look missing.

Exact code path

File:

• /opt/homebrew/lib/node_modules/openclaw/dist/audit-extra.async-zxtuaq1W.js

Relevant section:

const { extensionsDir, pluginDirs } = await listInstalledPluginDirs({ stateDir: params.stateDir });
if (pluginDirs.length > 0) {
  const allow = params.cfg.plugins?.allow;
  const allowConfigured = Array.isArray(allow) && allow.length > 0;
  if (allowConfigured) {
    const installedPluginIds = new Set(pluginDirs.map((dir) => path.basename(dir).toLowerCase()));
    const bundledPluginIds = new Set(listChannelPlugins().map((p) => p.id.toLowerCase()));
    const phantomEntries = allow.filter((entry) => {
      if (typeof entry !== "string" || entry === "group:plugins") return false;
      const lower = entry.toLowerCase();
      if (installedPluginIds.has(lower) || bundledPluginIds.has(lower)) return false;
      const canonicalId = normalizeOptionalLowercaseString(normalizePluginId(entry)) ?? "";
      return !canonicalId || !bundledPluginIds.has(canonicalId);
    });

Reproduction

1. Configure plugins.allow with bundled stock plugin IDs like:
   • telegram
   • discord
   • exa
   • firecrawl
   • browser
   • anthropic
   • google
   • xai
   • openai
   • brave
   • memory-core
   • moonshot
   • codex
   • voice-call
2. Run:
   • openclaw security audit --deep
3. Observe false-positive warning:
   • plugins.allow contains entries with no matching installed plugin

Evidence

1. Audit warns these bundled IDs are phantom

Example audit output on Fas's machine:

plugins.allow_phantom_entries plugins.allow contains entries with no matching installed plugin
The following plugins.allow entries do not correspond to any installed plugin: telegram, discord, exa, firecrawl, browser, anthropic, google, xai, openai, brave, memory-core, moonshot, codex, voice-call.

2. listChannelPlugins() is empty in CLI context

/opt/homebrew/lib/node_modules/openclaw/dist/registry-Delpa74L.js

function listChannelPlugins() {
  return listLoadedChannelPlugins();
}

Direct check in CLI context:

$ node --input-type=module <<'NODE'
import { r as listChannelPlugins } from '/opt/homebrew/lib/node_modules/openclaw/dist/registry-Delpa74L.js';
const ids=listChannelPlugins().map(p=>p.id);
console.log('count=', ids.length);
console.log(ids.join(','));
NODE
count= 0

3. The same supposedly phantom plugins are visibly loaded from stock

Example output from openclaw plugins list:

anthropic   ... loaded   stock:anthropic/index.js
brave       ... loaded   stock:brave/index.js
browser     ... loaded   stock:browser/index.js
codex       ... loaded   stock:codex/index.js
discord     ... loaded   stock:discord/index.js
exa         ... loaded   stock:exa/index.js
firecrawl   ... loaded   stock:firecrawl/index.js
google      ... loaded   stock:google/index.js
memory-core ... loaded   stock:memory-core/index.js
moonshot    ... loaded   stock:moonshot/index.js
openai      ... loaded   stock:openai/index.js
telegram    ... loaded   stock:telegram/index.js
voice-call  ... loaded   stock:voice-call/index.js
xai         ... loaded   stock:xai/index.js

Root cause

The audit compares plugins.allow against:

1. user-installed extension directories under ~/.openclaw/extensions
2. listChannelPlugins()

But listChannelPlugins() is not a full bundled-plugin inventory. It only returns runtime-loaded channel plugins, and in CLI audit context it can return zero. That makes valid bundled stock plugins appear missing.

Proposed fix

Use the full plugin manifest registry (bundled + installed manifests) as the inventory source instead of listChannelPlugins().

Something in the family of:

• loadPluginManifestRegistry(...)
• collect all plugin IDs from bundled and installed manifests
• compare plugins.allow against that complete set

In short:

• replace runtime-loaded-channel enumeration
• with full manifest-registry enumeration

Expected behavior

plugins.allow_phantom_entries should only warn for IDs that are truly absent from both:

• bundled plugin manifests
• installed extension manifests

It should not warn for valid stock bundled plugins that happen not to be runtime-loaded in the current audit context.