Title: plugins install fails for local plugins when plugins.allow already exists

Summary

On Windows with OpenClaw 2026.3.8 (3caab92), plugins install <local-path> succeeds in a clean profile with no plugins.allow, but fails in an otherwise clean profile if plugins.allow already contains any entry such as telegram.

The failing install aborts with:

Error: Config validation failed: plugins.allow: plugin not found: repro-openclaw-plugin

Even though the command fails, the plugin files have already been copied into the profile's extensions directory.

Environment

• OS: Windows
• Node.js: v24.14.0
• OpenClaw: 2026.3.8 (3caab92)
• CLI: C:\Users\luck\AppData\Roaming\npm\openclaw.cmd

Minimal repro plugin

package.json

{
  "name": "repro-openclaw-plugin",
  "version": "1.0.0",
  "private": true,
  "main": "index.ts",
  "openclaw": {
    "extensions": [
      "./index.ts"
    ]
  }
}

openclaw.plugin.json

{
  "id": "repro-openclaw-plugin",
  "name": "Repro OpenClaw Plugin",
  "description": "Minimal plugin used to reproduce local plugin install behavior.",
  "configSchema": {
    "type": "object",
    "additionalProperties": false,
    "properties": {}
  }
}

index.ts

import type { OpenClawPluginApi } from "openclaw/plugin-sdk";

export default function register(_api: OpenClawPluginApi) {
  return;
}

Repro

Case A: no existing plugins.allow

cmd /c "%APPDATA%\npm\openclaw.cmd --profile ocrepro-20260309b plugins install D:\fen\openclaw\repro-openclaw-plugin"

Observed output:

Installing to C:\Users\luck\.openclaw-ocrepro-20260309b\extensions\repro-openclaw-plugin...
Installed plugin: repro-openclaw-plugin
Restart the gateway to load plugins.
Config warnings:
- plugins.entries.repro-openclaw-plugin: plugin not found: repro-openclaw-plugin (stale config entry ignored; remove it from plugins config)

Result:

• install succeeds
• plugins.installs.repro-openclaw-plugin is written
• config validate succeeds

Case B: existing plugins.allow

Seed profile:

cmd /c "%APPDATA%\npm\openclaw.cmd --profile ocrepro-20260309c config set plugins.allow[0] telegram"

Then install the same plugin:

cmd /c "%APPDATA%\npm\openclaw.cmd --profile ocrepro-20260309c plugins install D:\fen\openclaw\repro-openclaw-plugin"

Observed output:

Installing to C:\Users\luck\.openclaw-ocrepro-20260309c\extensions\repro-openclaw-plugin...
[openclaw] Failed to start CLI: Error: Config validation failed: plugins.allow: plugin not found: repro-openclaw-plugin
    at Object.writeConfigFile (file:///C:/Users/luck/AppData/Roaming/npm/node_modules/openclaw/dist/auth-profiles-UpqQjKB-.js:14944:10)
    at async writeConfigFile (file:///C:/Users/luck/AppData/Roaming/npm/node_modules/openclaw/dist/auth-profiles-UpqQjKB-.js:15163:2)
    at async runPluginInstallCommand (file:///C:/Users/luck/AppData/Roaming/npm/node_modules/openclaw/dist/plugins-cli-gto3Etji.js:477:3)
    at async Command.<anonymous> (file:///C:/Users/luck/AppData/Roaming/npm/node_modules/openclaw/dist/plugins-cli-gto3Etji.js:764:3)
    at async Command.parseAsync (C:\Users\luck\AppData\Roaming\npm\node_modules\openclaw\node_modules\commander\lib\command.js:1122:5)
    at async runCli (file:///C:/Users/luck/AppData/Roaming/npm/node_modules/openclaw/dist/run-main-BcgwOk2p.js:430:2)

Result:

• install command fails
• config remains unchanged
• plugin files are still copied to C:\Users\luck\.openclaw-ocrepro-20260309c\extensions\repro-openclaw-plugin

Expected

plugins install <local-path> should succeed regardless of whether plugins.allow already exists, as long as the existing allowlist is valid.

Actual

If plugins.allow already exists, plugins install <local-path> fails during config validation with plugins.allow: plugin not found: <plugin-id>.

Notes

• plugins doctor after the failed install reports No plugin issues detected.
• This looks like an ordering bug in the install flow: the config is validated after adding the new plugin id to plugins.allow, but before the new plugin is considered discoverable.