Summary

• Problem: openclaw plugins doctor could print stale plugin config warnings and still end with No plugin issues detected.
• Why it matters: operators could read that final line as proof that plugin config was healthy, even when plugins.allow, plugins.entries, or plugins.slots.* still referenced a missing plugin.
• What changed: plugins doctor now reuses the shared stale-plugin-config scanner, reports those findings under Plugin configuration:, and prints No plugin install-tree issues detected; configuration warnings remain. when only config findings exist.
• What did NOT change (scope boundary): no plugin rollback, install/security scanner, cleanup, config mutation, JSON, or exit-code behavior changed.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes v2026.5.12-beta.5 plugin update disables lossless-claw after @beta fallback and leaves stale contextEngine config #81499
• This PR fixes a bug or regression

Real behavior proof (required for external PRs)

• Behavior or issue addressed: stale plugin config no longer ends with the plain success line from openclaw plugins doctor.
• Real environment tested: OpenClaw source checkout in the local OpenClaw PR container.
• Exact steps or command run after this patch:

OPENCLAW_CONFIG_PATH=/workspace/openclaw/.tmp/openclaw-81499-proof/openclaw.json \
OPENCLAW_STATE_DIR=/workspace/openclaw/.tmp/openclaw-81499-proof/state \
pnpm openclaw plugins doctor

• Evidence after fix:

Plugin configuration:
- plugins.allow: stale plugin reference "lossless-claw" was found.
- plugins.entries.lossless-claw: stale plugin reference "lossless-claw" was found.
- plugins.slots.contextEngine: slot references missing plugin "lossless-claw".
- Run "openclaw doctor --fix" to remove stale plugin ids and dangling channel references.

No plugin install-tree issues detected; configuration warnings remain.

• Observed result after fix: the command reports actionable stale-config findings and does not print No plugin issues detected. when warnings remain.
• What was not tested: plugin rollback, plugin install/update/uninstall paths, scanner policy changes, JSON output because plugins doctor has no JSON mode.
• Before evidence (optional but encouraged): the same command path previously printed config warnings followed by No plugin issues detected.

Root Cause (if applicable)

• Root cause: plugins doctor only counted runtime plugin load errors, manifest/discovery errors, source shadowing, and compatibility notices when deciding its final verdict.
• Missing detection / guardrail: stale plugin config warnings already existed in the shared doctor scanner, but plugins doctor did not include them.
• Contributing context (if known): the full CLI can warn from source config while runtime config has already normalized or ignored stale plugin references, so the scanner must inspect the config file source snapshot.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/cli/plugins-cli.list.test.ts
• Scenario the test should lock in: plugins.allow, plugins.entries.lossless-claw, and plugins.slots.contextEngine reference an unavailable lossless-claw plugin while runtime diagnostics are otherwise clean.
• Why this is the smallest reliable guardrail: it exercises the plugins doctor command path and the real shared stale-config scanner without touching plugin install or cleanup behavior.
• Existing test that already covers this (if any): src/commands/doctor/shared/stale-plugin-config.test.ts covers the scanner helper, but not the plugins doctor verdict.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

openclaw plugins doctor now reports stale plugin config references and distinguishes a healthy install tree from remaining config warnings.

Diagram (if applicable)

Before:
plugins doctor -> config warnings -> No plugin issues detected.

After:
plugins doctor -> plugin configuration findings -> install-tree-only summary

Security Impact (required)

• New permissions/capabilities? (Yes/No): No
• Secrets/tokens handling changed? (Yes/No): No
• New/changed network calls? (Yes/No): No
• Command/tool execution surface changed? (Yes/No): No
• Data access scope changed? (Yes/No): No
• If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

• OS: macOS host with OpenClaw PR container
• Runtime/container: OpenClaw PR container via openclaw-shell
• Model/provider: N/A
• Integration/channel (if any): N/A
• Relevant config (redacted):

{
  "plugins": {
    "allow": ["lossless-claw"],
    "entries": {
      "lossless-claw": {
        "enabled": true
      }
    },
    "slots": {
      "contextEngine": "lossless-claw"
    }
  }
}

Steps

1. Create the isolated config above.
2. Run pnpm openclaw plugins doctor with OPENCLAW_CONFIG_PATH and OPENCLAW_STATE_DIR pointed at the isolated temp paths.
3. Inspect the final doctor output.

Expected

• Stale plugin config is reported as plugin doctor findings.
• The command does not end with plain No plugin issues detected. while config warnings remain.

Actual

• Matches expected.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

• Verified scenarios: focused Vitest coverage for plugins doctor; real pnpm openclaw plugins doctor output with a stale lossless-claw config.
• Edge cases checked: healthy command output remains No plugin issues detected.; source-config scanner catches stale refs even when runtime config is sanitized.
• What you did not verify: plugin rollback, install/update/uninstall, security scanner behavior, config cleanup mutation, exit-code changes.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes/No): Yes
• Config/env changes? (Yes/No): No
• Migration needed? (Yes/No): No
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: plugins doctor now does one additional config snapshot read and stale-config scan.
  • Mitigation: reuses existing doctor scanner and keeps behavior read-only.

Validation

• pnpm run docs:list: pass
• pnpm test src/cli/plugins-cli.list.test.ts src/commands/doctor/shared/stale-plugin-config.test.ts: pass
• pnpm exec oxfmt --check src/cli/plugins-cli.ts src/cli/plugins-cli.list.test.ts docs/cli/plugins.md: pass
• pnpm exec oxlint src/cli/plugins-cli.ts src/cli/plugins-cli.list.test.ts: pass
• pnpm tsgo: pass
• git diff --check: pass
• pnpm check:changed: fails in unrelated all-project typecheck on src/plugins/registry.runtime-config.test.ts:45 and :46; those files are outside this PR diff.