Persistent "Loaded Without Provenance" Warnings for Plugins (v2026.2.21-2)
Dear OpenClaw Support Team,
I am writing to inquire about persistent warnings regarding locally loaded plugins in my OpenClaw v2026.2.21-2 installation. Despite following documentation for plugins.allow, the warnings persist.
The Warning:
My openclaw status output consistently shows warnings like:
"[plugins] clawrouter: loaded without install/load-path provenance; treat as untracked local code and pin trust via plugins.allow or install records (/home/user/.openclaw/extensions/clawrouter/dist/index.js)"
(Similar warning for webhook_receiver plugin).
Troubleshooting Steps Taken:
Verified that clawrouter and webhook_receiver are explicitly listed in plugins.allow within my openclaw.json configuration.
Executed openclaw plugins enable clawrouter and openclaw plugins enable webhook_receiver.
Restarted the OpenClaw gateway service after these configuration changes.
Problem: Even after adding these plugins to plugins.allow and explicitly enabling them via CLI, the "loaded without install/load-path provenance" warnings continue to appear in the openclaw status output. This suggests that plugins.allow or enable commands are not fully establishing the "install records" or "provenance tracking" required to clear this warning.
Question for Support:
What are the precise steps or configurations required to clear the "loaded without install/load-path provenance" warnings for locally installed (non-npm) plugins? Specifically, how do we correctly "pin trust via install records" for extensions residing in ~/.openclaw/extensions/?
Thank you for your assistance.
Sincerely,
beck99119911
I am writing to inquire about persistent warnings regarding locally loaded plugins in my OpenClaw v2026.2.21-2 installation. Despite following documentation for plugins.allow, the warnings persist.
The Warning:
My openclaw status output consistently shows warnings like:
"[plugins] clawrouter: loaded without install/load-path provenance; treat as untracked local code and pin trust via plugins.allow or install records (/home/user/.openclaw/extensions/clawrouter/dist/index.js)"
(Similar warning for webhook_receiver plugin).
Troubleshooting Steps Taken:
Verified that clawrouter and webhook_receiver are explicitly listed in plugins.allow within my openclaw.json configuration.
Executed openclaw plugins enable clawrouter and openclaw plugins enable webhook_receiver.
Restarted the OpenClaw gateway service after these configuration changes.
Problem: Even after adding these plugins to plugins.allow and explicitly enabling them via CLI, the "loaded without install/load-path provenance" warnings continue to appear in the openclaw status output. This suggests that plugins.allow or enable commands are not fully establishing the "install records" or "provenance tracking" required to clear this warning.
Question for Support:
What are the precise steps or configurations required to clear the "loaded without install/load-path provenance" warnings for locally installed (non-npm) plugins? Specifically, how do we correctly "pin trust via install records" for extensions residing in ~/.openclaw/extensions/?
Thank you for your assistance.
Sincerely,
beck99119911
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
130,529Members
Resources
Similar Threads
Was this page helpful?
