From 2cc8bb40fd18bb625d5ed847f2a5fe38f2eea79a Mon Sep 17 00:00:00 2001
From: Peter Steinberger <peter@steipete.me>
Date: Fri, 10 Jul 2026 19:53:03 -0700
Subject: [PATCH] fix(plugins): quiet trusted discovery warning (#104097)

---
 src/plugins/loader-provenance.ts |  5 ++++-
 src/plugins/loader.test.ts       | 22 ++++++++++++++++++++++
 src/plugins/loader.ts            | 10 ++++++++++
 3 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/src/plugins/loader-provenance.ts b/src/plugins/loader-provenance.ts
index fe533ff54fcd..159f2e25bdd7 100644
--- a/src/plugins/loader-provenance.ts
+++ b/src/plugins/loader-provenance.ts
@@ -220,6 +220,7 @@ export function warnWhenAllowlistIsOpen(params: {
   allow: string[];
   warningCacheKey: string;
   warningCache: OpenAllowlistWarningCache;
+  explicitlyEnabledPluginIds?: ReadonlySet<string>;
   discoverablePlugins: Array<{ id: string; source: string; origin: PluginRecord["origin"] }>;
 }) {
   if (!params.emitWarning) {
@@ -229,7 +230,9 @@ export function warnWhenAllowlistIsOpen(params: {
     return;
   }
   const autoDiscoverable = params.discoverablePlugins.filter(
-    (entry) => entry.origin === "workspace" || entry.origin === "global",
+    (entry) =>
+      (entry.origin === "workspace" || entry.origin === "global") &&
+      !params.explicitlyEnabledPluginIds?.has(entry.id),
   );
   if (autoDiscoverable.length === 0) {
     return;
diff --git a/src/plugins/loader.test.ts b/src/plugins/loader.test.ts
index bbbae76f5128..535eb23e4827 100644
--- a/src/plugins/loader.test.ts
+++ b/src/plugins/loader.test.ts
@@ -8794,6 +8794,28 @@ module.exports = {
     });
   });
 
+  it("stays quiet when every non-bundled plugin is explicitly enabled", () => {
+    useNoBundledPlugins();
+    clearPluginLoaderCache();
+    const { workspaceDir } = writeWorkspacePlugin({
+      id: "warn-explicitly-enabled-plugin",
+    });
+    const warnings: string[] = [];
+    loadOpenClawPlugins({
+      cache: false,
+      workspaceDir,
+      logger: createWarningLogger(warnings),
+      config: {
+        plugins: {
+          enabled: true,
+          entries: { "warn-explicitly-enabled-plugin": { enabled: true } },
+        },
+      },
+    });
+
+    expect(warnings.join("\n")).not.toContain("plugins.allow is empty");
+  });
+
   it("warns when plugins.allow entries do not match any discovered plugin ids", () => {
     useNoBundledPlugins();
     clearPluginLoaderCache();
diff --git a/src/plugins/loader.ts b/src/plugins/loader.ts
index 75fd226daabf..776900cac92e 100644
--- a/src/plugins/loader.ts
+++ b/src/plugins/loader.ts
@@ -2049,6 +2049,11 @@ export function loadOpenClawPlugins(options: PluginLoadOptions = {}): PluginRegi
       allow: normalized.allow,
       warningCacheKey: cacheKey,
       warningCache: pluginLoaderCacheState,
+      explicitlyEnabledPluginIds: new Set(
+        Object.entries(normalized.entries)
+          .filter(([, entry]) => entry.enabled === true)
+          .map(([pluginId]) => pluginId),
+      ),
       // Keep warning input scoped as well so partial snapshot loads only mention the
       // plugins that were intentionally requested for this registry.
       discoverablePlugins: manifestRegistry.plugins
@@ -3039,6 +3044,11 @@ export async function loadOpenClawPluginCliRegistry(
     allow: normalized.allow,
     warningCacheKey: `${cacheKey}::cli-metadata`,
     warningCache: pluginLoaderCacheState,
+    explicitlyEnabledPluginIds: new Set(
+      Object.entries(normalized.entries)
+        .filter(([, entry]) => entry.enabled === true)
+        .map(([pluginId]) => pluginId),
+    ),
     discoverablePlugins: manifestRegistry.plugins
       .filter((plugin) => !onlyPluginIdSet || onlyPluginIdSet.has(plugin.id))
       .map((plugin) => ({