Plugins: allowlist compat for capability provider fallback (#62205) by neeravmakwana · Pull Request #62234 · openclaw/openclaw

neeravmakwana · 2026-04-07T01:52:16Z

Summary

Problem: With a non-empty plugins.allow list that omitted bundled capability plugins (for example openai), capability fallback only added plugins.entries, so the loader still treated those plugins as blocked and media-understanding providers (including OpenAI-compatible STT) never registered.
Why it matters: Voice and other STT flows that use tools.media.audio with provider: "openai" could pass raw audio to the model instead of a transcript when an allowlist was used to scope plugins.
What changed: resolveCapabilityProviderConfig now applies withBundledPluginAllowlistCompat before withBundledPluginEnablementCompat, matching the order in applyPluginCompatibilityOverrides (allowlist, then enablement, then vitest compat).
What did NOT change: plugins.deny remains authoritative; denylisted plugins are not enabled by this path.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes v2026.4.5: Telegram voice messages no longer transcribed (STT regression) #62205
Related v2026.4.5: Telegram voice messages no longer transcribed (STT regression) #62205
This PR fixes a bug or regression

Root Cause (if applicable)

Root cause: Enablement-only compat did not merge bundled capability plugin ids into plugins.allow, so resolvePluginActivationState returned not-in-allowlist and the bundled plugin did not load.
Missing detection / guardrail: Allowlist fallback tests mocked enablement without exercising the allowlist layer.
Contributing context: Same layering as withBundledPluginAllowlistCompat + withBundledPluginEnablementCompat in provider resolution tests.

Regression Test Plan (if applicable)

Coverage level that should have caught this: Unit test
Target test or file: src/plugins/capability-provider-runtime.test.ts, src/media-understanding/provider-registry.allowlist.test.ts, src/image-generation/provider-registry.allowlist.test.ts
Scenario the test should lock in: Enablement compat receives config after allowlist compat merges capability plugin ids into plugins.allow when plugins.allow is non-empty.
Why this is the smallest reliable guardrail: Asserts the compat chain order and expected config shape without requiring a full Telegram or gateway run.

User-visible / Behavior Changes

With plugins.allow set, bundled capability plugins needed for capability fallback (media understanding, image generation, speech, and other keys using the same path) are merged into the allowlist so providers such as STT load without manually listing every capability plugin id.

Diagram (if applicable)

N/A

Security Impact (required)

New permissions/capabilities? No
Trust boundary changes? No
Notes: plugins.deny still blocks plugins before allowlist evaluation.

Verification

pnpm test (scoped): src/plugins/capability-provider-runtime.test.ts, src/media-understanding/provider-registry.allowlist.test.ts, src/image-generation/provider-registry.allowlist.test.ts
pnpm check / pnpm build: local pnpm check fails on unrelated acpx extension TypeScript resolution (acpx/dist/runtime.js); scoped lint on touched files is clean.

Made with Cursor

greptile-apps · 2026-04-07T01:54:55Z

Greptile Summary

Fixes allowlist-gated capability provider fallback by inserting withBundledPluginAllowlistCompat before withBundledPluginEnablementCompat in resolveCapabilityProviderConfig, matching the ordering already used in applyPluginCompatibilityOverrides. New parametrized tests in capability-provider-runtime.test.ts verify the chain order directly, and two new allowlist integration test files cover media-understanding and image-generation registry behavior. One minor gap: videoGenerationProviders and musicGenerationProviders are omitted from the it.each table in capability-provider-runtime.test.ts, but the production fix applies generically to all eight capability keys so there is no correctness impact.

Confidence Score: 5/5

Safe to merge — targeted one-liner fix with correct test coverage of the compat chain ordering.

All findings are P2 or lower. The production change is a minimal, well-understood reordering that matches the established pattern in applyPluginCompatibilityOverrides. Tests directly assert chain order and the two new allowlist files confirm downstream registry behavior.

No files require special attention; the minor test coverage gap for videoGenerationProviders and musicGenerationProviders in capability-provider-runtime.test.ts does not affect correctness.

_{Reviews (1): Last reviewed commit: "Plugins: allowlist compat for capability..." | Re-trigger Greptile}

…62205)

obviyus

Reviewed latest changes; landing now.

obviyus · 2026-04-07T07:16:19Z

Landed on main.

Landed source commit: 92bbbe5
Merge commit: 9a9dc1d

Thanks @neeravmakwana.

@neeravmakwana

… (thanks @neeravmakwana) * Plugins: allowlist compat for capability provider fallback (openclaw#62205) * test: cover all capability fallback keys --------- Co-authored-by: Ayaan Zaidi <[email protected]>

@neeravmakwana

… (thanks @neeravmakwana) * Plugins: allowlist compat for capability provider fallback (openclaw#62205) * test: cover all capability fallback keys --------- Co-authored-by: Ayaan Zaidi <[email protected]>

@neeravmakwana

… (thanks @neeravmakwana) * Plugins: allowlist compat for capability provider fallback (openclaw#62205) * test: cover all capability fallback keys --------- Co-authored-by: Ayaan Zaidi <[email protected]>

@neeravmakwana

… (thanks @neeravmakwana) * Plugins: allowlist compat for capability provider fallback (openclaw#62205) * test: cover all capability fallback keys --------- Co-authored-by: Ayaan Zaidi <[email protected]>

neeravmakwana mentioned this pull request Apr 7, 2026

v2026.4.5: Telegram voice messages no longer transcribed (STT regression) #62205

Closed

openclaw-barnacle Bot added the size: S label Apr 7, 2026

obviyus force-pushed the fix/plugins-capability-allowlist-stt-62205 branch from 6c77ee3 to 4bfccf5 Compare April 7, 2026 07:10

obviyus self-assigned this Apr 7, 2026

neeravmakwana and others added 2 commits April 7, 2026 12:43

Plugins: allowlist compat for capability provider fallback (openclaw#…

4c58233

…62205)

test: cover all capability fallback keys

92bbbe5

obviyus force-pushed the fix/plugins-capability-allowlist-stt-62205 branch from 4bfccf5 to 92bbbe5 Compare April 7, 2026 07:13

obviyus approved these changes Apr 7, 2026

View reviewed changes

obviyus merged commit 9a9dc1d into openclaw:main Apr 7, 2026
17 of 31 checks passed

jhsmith409 mentioned this pull request Apr 8, 2026

STT: Audio transcription provider requests blocked by SSRF guard for private/LAN IPs (regression in v2026.4.7) #63132

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Plugins: allowlist compat for capability provider fallback (#62205)#62234

Plugins: allowlist compat for capability provider fallback (#62205)#62234
obviyus merged 2 commits into
openclaw:mainfrom
neeravmakwana:fix/plugins-capability-allowlist-stt-62205

neeravmakwana commented Apr 7, 2026

Uh oh!

greptile-apps Bot commented Apr 7, 2026

Uh oh!

obviyus left a comment

Uh oh!

Uh oh!

obviyus commented Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

neeravmakwana commented Apr 7, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Root Cause (if applicable)

Regression Test Plan (if applicable)

User-visible / Behavior Changes

Diagram (if applicable)

Security Impact (required)

Verification

Uh oh!

greptile-apps Bot commented Apr 7, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

obviyus left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

obviyus commented Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants