UX: misleading plugin warnings when allowlist entries don't match discovered plugin IDs #68352

Problem

When a user configures plugins.allow with channel IDs (e.g. "feishu") instead of actual plugin IDs (e.g. "openclaw-lark"), two confusing warnings are emitted at startup:

[plugins] plugins.allow is empty; discovered non-bundled plugins may auto-load: openclaw-lark (C:\Users\...\extensions\feishu-openclaw-plugin\index.js), openclaw-weixin (C:\Users\...\extensions\openclaw-weixin\index.ts). Set plugins.allow to explicit trusted ids.
[plugins] openclaw-lark: loaded without install/load-path provenance; treat as untracked local code and pin trust via plugins.allow or install records
[plugins] openclaw-weixin: loaded without install/load-path provenance; treat as untracked local code and pin trust via plugins.allow or install records

There are three sub-issues here:

1. plugins.allow is empty is misleading

The warning says plugins.allow is empty when the allowlist is not empty — it simply contains entries that don't match any discovered plugin IDs. The message at src/plugins/loader.ts:1358 checks params.allow.length > 0, which is true, but the user still sees a message implying their allowlist is empty, which is confusing.

2. Plugin ID vs Channel ID mismatch

The feishu channel plugin declares its plugin ID as "openclaw-lark" (in both openclaw.plugin.json and the default export), but users naturally configure it as "feishu" because:

• The channel config key is channels.feishu
• The npm package name is feishu-openclaw-plugin
• There is no obvious mapping from channel ID → plugin ID

This mismatch is the root cause of the warnings above. Users have no clear way to discover the actual plugin ID without reading the plugin source code or openclaw.plugin.json.

3. Unwanted plugins auto-loaded from extensions directory

Plugins in ~/.openclaw/extensions/ are auto-discovered and loaded even when the user has never configured them. In my case, openclaw-weixin was auto-loaded despite having no channels.weixin configuration and no entry in plugins.entries. The only way to prevent this is to explicitly add it to plugins.deny.

Suggested improvements

1. Better warning messages: When plugins.allow has entries but none match discovered plugins, say something like "plugins.allow contains entries that don't match any discovered plugin IDs" instead of "plugins.allow is empty".

2. Plugin ID discovery: Provide a way for users to discover the actual plugin ID (e.g., openclaw plugins list should show the ID prominently, or the warning message should suggest how to find it).

3. Channel-to-plugin ID aliasing: Consider auto-resolving common channel IDs to their plugin IDs, or at least emit a more specific warning like "plugin 'openclaw-lark' was discovered but not found in plugins.allow (you may have configured 'feishu' — use the plugin ID, not the channel ID)".

4. Only auto-load configured channel plugins from extensions: Plugins in the extensions directory should only be loaded if their channel is configured or if they're explicitly in plugins.allow.

Reproduction steps

1. Install a channel plugin in ~/.openclaw/extensions/ (e.g., feishu-openclaw-plugin)
2. Configure channels.feishu but set plugins.allow to ["feishu"] (channel ID, not plugin ID)
3. Start gateway
4. Observe the misleading warnings

Environment

• OpenClaw version: latest
• Platform: Windows 10
• Node.js version: (as bundled)