Summary

• Problem: the 2026.5.2 release doctor repair skipped plugins.allow ids that had no material plugins.entries entry, then stale cleanup could remove official external plugins such as lobster.
• Why it matters: upgraded configs can silently lose allow-only official workflow/runtime plugins used by cron or ClawFlow jobs.
• What changed: the release configured-plugin repair now includes allow-only ids only when they resolve through the official external plugin catalog.
• What did NOT change: arbitrary/unofficial allow-only ids are still not treated as configured usage, and general allowlist semantics are unchanged.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes doctor --fix removes allow-only externalized plugins (lobster) during v2026.5.2 one-time migration #77155
• Related fix(doctor): include allow-only official plugin ids in release repair set #77193
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: collectReleaseConfiguredPluginIds collected material plugin entries and configured surfaces, but not allow-only official external plugin ids.
• Missing detection / guardrail: the existing release collector test covered allow-only exclusion generally, but not the migration exception for official external catalog entries.
• Contributing context: stale plugin cleanup can remove missing allow entries after the release install repair misses them.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/commands/doctor/shared/release-configured-plugin-installs.test.ts
• Scenario the test should lock in: allow-only official external plugin ids are repair candidates; unofficial allow-only ids are skipped; ids with material entries do not need the allow-only catalog path.
• Why this is the smallest reliable guardrail: it exercises the exact release collector before install repair and stale cleanup run.
• Existing test that already covers this (if any): existing allow-only exclusion test remains in place for unofficial ids.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

openclaw doctor --fix preserves configured allow-only official external plugins during the release repair path by installing them before stale cleanup can remove them.

Diagram (if applicable)

Before:
plugins.allow = ["lobster"] -> release repair ignores lobster -> stale cleanup may remove it

After:
plugins.allow = ["lobster"] -> official catalog match -> release repair installs lobster -> config survives

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? No
• If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

• OS: macOS local worktree; Blacksmith Testbox for changed gate
• Runtime/container: Node/pnpm via repo scripts
• Model/provider: N/A
• Integration/channel (if any): doctor plugin migration repair
• Relevant config (redacted): plugins.allow: ["lobster", "unofficial-custom"]

Steps

1. Configure an allow-only official external plugin id such as lobster.
2. Run the release configured-plugin repair collector.
3. Verify lobster is included only because it is in the official external plugin catalog.
4. Verify arbitrary allow-only ids are still excluded.

Expected

• Official external allow-only ids are sent to missing-install repair.
• Unofficial allow-only ids are not installed.
• Material plugin entries keep their existing path.

Actual

• Before this change, allow-only official external ids were skipped by the release collector.

Evidence

• pnpm exec oxfmt --check --threads=1 CHANGELOG.md src/commands/doctor/shared/release-configured-plugin-installs.ts src/commands/doctor/shared/release-configured-plugin-installs.test.ts
• pnpm test:serial src/commands/doctor/shared/release-configured-plugin-installs.test.ts — 12 passed
• pnpm test:serial src/commands/doctor/shared/release-configured-plugin-installs.test.ts src/commands/doctor/shared/missing-configured-plugin-install.test.ts src/commands/doctor/shared/stale-plugin-config.test.ts — 62 passed
• Testbox pnpm check:changed — passed on https://github.com/openclaw/openclaw/actions/runs/25348393861 before the final clean rebase; final rebase had no conflicts and the branch diff is materially unchanged
• git diff --check after final rebase

Human Verification (required)

• Confirmed the diff is limited to doctor release repair, its regression test, and changelog.
• Confirmed the fix preserves general allowlist behavior for unofficial allow-only ids.