Summary

Externally-installed diagnostics-otel plugins are silently denied access to internal diagnostics events because the grantsInternalDiagnostics capability is gated on origin === "bundled". Plugins installed via clawhub: or npm: get origin: "global" and the gate fails closed — the plugin loads but receives no events.

Environment

• OpenClaw 2026.5.3-1 (Homebrew install)
• macOS 25.2.0
• Node 25.6.0

Reproduction

# Install via clawhub or npm (not bundled):
openclaw plugins install clawhub:@openclaw/diagnostics-otel
openclaw plugins enable diagnostics-otel
openclaw config set diagnostics.otel.enabled true
# … set endpoint + auth …
openclaw gateway restart --wait 30s

# Run a turn:
openclaw agent --message 'hi' --agent main --to '+15555550100' --json

Observed

Plugin loads, registers, reports enabled: true, but no spans reach the configured OTLP endpoint. Gateway log shows nothing under the diagnostics-otel scope.

openclaw plugins inspect diagnostics-otel --runtime --json shows origin: "global", capability list empty.

Runtime source dist/services-DsZ94lnU.js checks:

if (origin === "bundled") { /* grants grantsInternalDiagnostics */ }

Nothing else flips that capability for non-bundled installs.

Expected

Either:

• (a) clawhub: and npm: installs of the same @openclaw/diagnostics-otel package receive grantsInternalDiagnostics (treat npm install of the canonical package as trusted); OR
• (b) The gate is documented and a clean opt-in path is provided (e.g. config flag, --trust install option) so operators can choose to enable it; OR
• (c) The paramsSummary broadcast stream is replaced with a public hook surface that any plugin can subscribe to without internal-diagnostics privilege (related to #N+1 below).

Local workaround

Manually copy plugin into dist/extensions/ so origin: "bundled" is computed. Fragile and undocumented — breaks on every OpenClaw upgrade.

Why this matters

Operators who want OTel observability cannot ship a third-party tracing plugin without resorting to runtime-source patching. This blocks production deployments that don't want to vendor the entire OpenClaw runtime.

Related

The bundled-only path also has a content-emission issue tracked separately as Issue #N+1.