fix(plugins): centralize explicit plugin scope handling by vincentkoc · Pull Request #65298 · openclaw/openclaw

vincentkoc · 2026-04-12T10:31:59Z

Summary

Problem: explicit plugin scopes were still encoded ad hoc across loader/runtime/provider helpers, so [] vs undefined could drift back into the same behavior outside the first main-path fix.
Why it matters: when an explicitly empty scope widens to unscoped, OpenClaw can load far more plugin surface than the caller asked for.
What changed: added a shared plugin-scope helper and moved loader, provider, runtime metadata, and web-provider cache/scope handling onto it.
What did NOT change (scope boundary): no new activation behavior, no manifest contract changes, and no plugin API changes.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #
Related feat(plugins): narrow explicit provider loads from manifests #65259
This PR fixes a bug or regression

Root Cause (if applicable)

Root cause: explicit plugin scope semantics were duplicated in several helpers, and some call sites treated onlyPluginIds: [] the same as onlyPluginIds: undefined.
Missing detection / guardrail: we had coverage for one provider-path regression, but not for the shared loader/runtime/metadata/cache seams that still normalized empty scope away.
Contributing context (if known): provider narrowing landed incrementally, so the scope contract existed before the shared abstraction did.

Regression Test Plan (if applicable)

Coverage level that should have caught this:
- Unit test
- Seam / integration test
- End-to-end test
- Existing coverage already sufficient
Target test or file: src/plugins/runtime/runtime-registry-loader.test.ts, src/plugins/runtime/metadata-registry-loader.test.ts, src/plugins/providers.test.ts, src/plugins/web-provider-resolution-shared.test.ts
Scenario the test should lock in: explicit empty plugin scopes stay scoped-empty through loaders, metadata snapshots, provider helpers, and web-provider cache/mapping helpers.
Why this is the smallest reliable guardrail: the bug is in normalization and scope forwarding, not full plugin execution.
Existing test that already covers this (if any): src/plugins/loader.runtime-registry.test.ts covers adjacent loader/runtime registry behavior.
If no new test is added, why not: N/A

User-visible / Behavior Changes

None.

Diagram (if applicable)

Before:
[explicit empty scope] -> [helper normalizes to unscoped] -> [broader plugin load]

After:
[explicit empty scope] -> [shared scope helper preserves empty scope] -> [no widening]

Security Impact (required)

New permissions/capabilities? (Yes/No) No
Secrets/tokens handling changed? (Yes/No) No
New/changed network calls? (Yes/No) No
Command/tool execution surface changed? (Yes/No) No
Data access scope changed? (Yes/No) No
If any Yes, explain risk + mitigation:

Repro + Verification

Environment

OS: macOS
Runtime/container: Node 22 / pnpm
Model/provider: N/A
Integration/channel (if any): plugin loader/runtime
Relevant config (redacted): default local plugin test config

Steps

Request a provider/runtime/metadata load with onlyPluginIds: [].
Observe whether downstream helpers treat that as explicit empty scope or unscoped.
Run scoped regression tests and pnpm build.

Expected

Explicit empty scopes remain scoped-empty and do not widen plugin loading.

Actual

This PR preserves that behavior consistently across the touched helpers.

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios: explicit empty scope handling in runtime registry loading, metadata snapshots, provider helper filtering, web-provider cache keys, loader/runtime/provider regression suites.
Edge cases checked: undefined vs [], scoped-empty cache keys, helper set creation, explicit empty forwarding through metadata/runtime loaders.
What you did not verify: full repo pnpm test, remote CI, or third-party plugin ecosystems.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

Backward compatible? (Yes/No) Yes
Config/env changes? (Yes/No) No
Migration needed? (Yes/No) No
If yes, exact upgrade steps:

Risks and Mitigations

Risk:
- Scope helper could subtly change existing undefined handling in hot paths.
- Mitigation: kept undefined semantics intact, added explicit empty-scope regressions, and ran pnpm build because these are loader/runtime boundaries.

AI assistance

AI-assisted: yes
Local verification run: pnpm test:serial src/plugins/runtime/runtime-registry-loader.test.ts src/plugins/runtime/metadata-registry-loader.test.ts src/plugins/providers.test.ts src/plugins/web-provider-resolution-shared.test.ts
Additional local verification run: pnpm test:serial src/plugins/loader.test.ts src/plugins/loader.runtime-registry.test.ts src/plugins/provider-runtime.test.ts
Additional gates: pnpm lint -- src/plugins/plugin-scope.ts src/plugins/loader.ts src/plugins/providers.ts src/plugins/providers.runtime.ts src/plugins/runtime/runtime-registry-loader.ts src/plugins/runtime/metadata-registry-loader.ts src/plugins/provider-runtime.ts src/plugins/web-provider-resolution-shared.ts src/plugins/providers.test.ts src/plugins/runtime/runtime-registry-loader.test.ts src/plugins/runtime/metadata-registry-loader.test.ts src/plugins/web-provider-resolution-shared.test.ts, pnpm build

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a1c1a3efde

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-12T10:57:06Z

    return deps.mapRegistryProviders({
      registry: runtimeRegistry,
-      onlyPluginIds: params.onlyPluginIds,
+      onlyPluginIds: loadOptions?.onlyPluginIds,


Preserve onlyPluginIds when config is omitted

When resolveRuntimeWebProviders is called with config unset but an explicit onlyPluginIds scope, this path now drops the scope and returns providers from the full active runtime registry. loadOptions is intentionally undefined in that case, so onlyPluginIds: loadOptions?.onlyPluginIds becomes undefined and no filtering happens. This is a regression from the previous behavior (which filtered by params.onlyPluginIds) and can surface extra providers whenever callers rely on scoped runtime resolution without passing config.

Useful? React with 👍 / 👎.

greptile-apps · 2026-04-12T11:05:51Z

Greptile Summary

This PR centralizes explicit plugin scope handling into a new src/plugins/plugin-scope.ts helper and migrates loader, provider, runtime metadata, and web-provider cache/scope paths onto it. The core fix ensures that an explicitly empty onlyPluginIds: [] is preserved as a scoped-empty request rather than being widened to an unscoped load across all affected helpers.

Confidence Score: 5/5

Safe to merge — the scope helper is correctly designed, all changed paths preserve the undefined/[] distinction, and regression tests cover the key scenarios end-to-end.

No P0 or P1 findings. The normalizePluginIdScope / hasExplicitPluginIdScope / createPluginIdScopeSet helpers correctly distinguish undefined (unscoped) from [] (explicit empty). All callers — loader cache key, runtime-registry loader, metadata-registry loader, providers helpers, web-provider cache key, and mapRegistryProviders — consistently use these helpers. New tests lock in the explicit-empty behavior on every changed seam.

No files require special attention. The helper design and callsite usage are consistent throughout.

_{Reviews (1): Last reviewed commit: "Merge branch 'main' into feat/plugins-sc..." | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 86797cb2c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

* fix(plugins): centralize explicit plugin scope handling * fix(plugins): preserve explicit empty web scopes * fix(plugins): preserve runtime web provider scopes without config * fix(plugins): preserve web provider runtime filtering * fix(plugins): preserve scoped web runtime fallback * fix(plugins): harden plugin scope normalization

fix(plugins): centralize explicit plugin scope handling

f976453

vincentkoc self-assigned this Apr 12, 2026

openclaw-barnacle Bot added size: M maintainer Maintainer-authored PR labels Apr 12, 2026

fix(plugins): preserve explicit empty web scopes

f5fec5b

vincentkoc marked this pull request as ready for review April 12, 2026 10:52

Merge branch 'main' into feat/plugins-scope-semantics

a1c1a3e

chatgpt-codex-connector Bot reviewed Apr 12, 2026

View reviewed changes

vincentkoc added 3 commits April 12, 2026 14:21

Merge branch 'main' into feat/plugins-scope-semantics

e79fe1b

fix(plugins): preserve runtime web provider scopes without config

f1cf006

fix(plugins): preserve web provider runtime filtering

86797cb

chatgpt-codex-connector Bot reviewed Apr 12, 2026

View reviewed changes

Comment thread src/plugins/web-provider-resolution-shared.ts Outdated

vincentkoc added 2 commits April 12, 2026 16:12

fix(plugins): preserve scoped web runtime fallback

5c492df

fix(plugins): harden plugin scope normalization

0543274

openclaw-barnacle Bot added size: L and removed size: M labels Apr 12, 2026

vincentkoc merged commit 6a189ee into main Apr 12, 2026
10 checks passed

vincentkoc deleted the feat/plugins-scope-semantics branch April 12, 2026 15:16

github-actions Bot mentioned this pull request Apr 12, 2026

📡 Upstream Digest — 2026-04-12 16:29 UTC curtismercier/openclaw-mods#551

Open

ttomiczek mentioned this pull request Apr 14, 2026

memory-core: dreaming cron reports 'cron service unavailable' — regression from 4.12 plugin loading changes #66388

Closed

martingarramon mentioned this pull request Apr 14, 2026

[Bug]: memory-core dreaming cron reconciliation can report "cron service unavailable" even when gateway cron is running #65834

Closed

medns mentioned this pull request Apr 24, 2026

perf(plugins): add O(1) fast-path for empty plugin loads #71072

Merged

18 tasks

steipete mentioned this pull request Apr 25, 2026

fix(cli): skip full plugin preload for channels login/logout when --channel is explicit #59713

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(plugins): centralize explicit plugin scope handling#65298

fix(plugins): centralize explicit plugin scope handling#65298
vincentkoc merged 8 commits intomainfrom
feat/plugins-scope-semantics

vincentkoc commented Apr 12, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 12, 2026

Uh oh!

greptile-apps Bot commented Apr 12, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

vincentkoc commented Apr 12, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Root Cause (if applicable)

Regression Test Plan (if applicable)

User-visible / Behavior Changes

Diagram (if applicable)

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Risks and Mitigations

AI assistance

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Apr 12, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant