fix: address second round of review feedback

- push-web.ts: always honor OPENCLAW_VAPID_SUBJECT env var over persisted subject
- push-web.ts: also clean up 404 Not Found endpoints alongside 410 Gone
- app.ts: reconcileWebPushState checks PushManager directly (no race with initWebPushState)
- sw.js: exclude /plugins/ routes from service worker cache

src/infra/push-web.ts

@@ -110,7 +110,8 @@ export async function resolveVapidKeys(baseDir?: string): Promise<VapidKeyPair>
       return {
         publicKey: existing.publicKey,
         privateKey: existing.privateKey,
-        subject: existing.subject || resolveVapidSubjectFromEnv(),
+        // Env var always wins so operators can change subject without deleting vapid-keys.json.
+        subject: resolveVapidSubjectFromEnv(),
       };
     }
 
@@ -305,10 +306,10 @@ export async function broadcastWebPush(
         },
   );
 
-  // Clean up expired subscriptions (HTTP 410 Gone) per Web Push spec.
+  // Clean up expired subscriptions (HTTP 410 Gone or 404 Not Found) per Web Push spec.
   const expiredEndpoints = mapped
     .map((result, i) => ({ result, sub: subscriptions[i] }))
-    .filter(({ result }) => !result.ok && result.statusCode === 410)
+    .filter(({ result }) => !result.ok && (result.statusCode === 410 || result.statusCode === 404))
     .map(({ sub }) => sub.endpoint);
 
   if (expiredEndpoints.length > 0) {

ui/public/sw.js

@@ -30,8 +30,12 @@ self.addEventListener("fetch", (event) => {
     return;
   }
 
-  // Skip API requests — they should never be cached.
-  if (url.pathname.startsWith("/api/") || url.pathname.startsWith("/rpc")) {
+  // Skip non-UI routes — API, RPC, and plugin routes should never be cached.
+  if (
+    url.pathname.startsWith("/api/") ||
+    url.pathname.startsWith("/rpc") ||
+    url.pathname.startsWith("/plugins/")
+  ) {
     return;
   }
 

ui/src/ui/app.ts

@@ -972,15 +972,18 @@ export class OpenClawApp extends LitElement {
 
   /** Re-register local push subscription with the gateway after connect. */
   async reconcileWebPushState() {
-    if (!this.webPushSubscribed || !this.client) {
+    if (!this.client) {
       return;
     }
     try {
+      // Always check PushManager directly — initWebPushState may not have finished
+      // yet if gateway connected quickly.
       const { getExistingSubscription } = await import("./push-subscription.ts");
       const existing = await getExistingSubscription();
       if (!existing) {
         return;
       }
+      this.webPushSubscribed = true;
       const subJson = existing.toJSON();
       if (subJson.endpoint && subJson.keys?.p256dh && subJson.keys?.auth) {
         await this.client.request("push.web.subscribe", {