fix: auto-clean stale plugins.allow entries during reinstall/update

AI agents sometimes add bare plugin names like "wallet" to plugins.allow
(e.g. trying to enable an OpenClaw built-in), causing:
  - "plugin not found: wallet" warning on every gateway start
  - ClawRouter not loading if "clawrouter" gets overwritten

Both reinstall.sh and update.sh now strip any bare single-word entries that
aren't in the known bundled OpenClaw plugin list, preserving scoped packages
(@scope/name) and slash-prefixed IDs. "clawrouter" is always removed here
and re-added cleanly later in the script.

Author: 1bcMax

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/clawrouter",
-  "version": "0.12.117",
+  "version": "0.12.118",
   "description": "Smart LLM router — save 85% on inference costs. 55+ models (11 free), one wallet, x402 micropayments.",
   "type": "module",
   "main": "dist/index.js",

scripts/reinstall.sh

@@ -172,10 +172,31 @@ try {
 // Clean plugin entries
 if (c.plugins?.entries?.clawrouter) delete c.plugins.entries.clawrouter;
 if (c.plugins?.installs?.clawrouter) delete c.plugins.installs.clawrouter;
-// Clean plugins.allow (removes stale clawrouter reference)
+
+// Clean plugins.allow — remove clawrouter (will be re-added after install)
+// and strip any non-bundled plugin names that don't exist (e.g. "wallet" added
+// by an AI agent trying to fix a different problem — causes a warning on every start).
 if (Array.isArray(c.plugins?.allow)) {
-  c.plugins.allow = c.plugins.allow.filter(p => p !== 'clawrouter' && p !== '@blockrun/clawrouter');
+  const BUNDLED_OPENCLAW_PLUGINS = [
+    // OpenClaw v2026.x bundled plugin IDs (safe to keep in allow list)
+    'http', 'mcp', 'computer-use', 'browser', 'code', 'image', 'voice',
+    'search', 'memory', 'calendar', 'email', 'slack', 'discord', 'telegram',
+    'whatsapp', 'matrix', 'teams', 'notion', 'github', 'jira', 'linear',
+    'comfyui', 'crossmint',
+  ];
+  const before = c.plugins.allow.length;
+  c.plugins.allow = c.plugins.allow.filter(p => {
+    if (p === 'clawrouter' || p === '@blockrun/clawrouter') return false; // re-added later
+    if (BUNDLED_OPENCLAW_PLUGINS.includes(p)) return true; // known-good bundled plugins
+    // Keep entries that look like npm package names (scoped or plain)
+    if (p.startsWith('@') || p.includes('/')) return true;
+    // Drop bare single-word entries that aren't bundled (e.g. "wallet" added by mistake)
+    return false;
+  });
+  const removed = before - c.plugins.allow.length;
+  if (removed > 0) console.log('  Removed ' + removed + ' stale plugins.allow entry(ies)');
 }
+
 atomicWrite(f, JSON.stringify(c, null, 2));
 console.log('  Config cleaned');
 "

scripts/update.sh

@@ -172,13 +172,41 @@ const configPath = '$CONFIG_PATH';
 if (!fs.existsSync(configPath)) process.exit(0);
 try {
   const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+  let changed = false;
+
+  // Remove stale plugin entry
   const entries = config?.plugins?.entries;
   if (entries && entries.clawrouter) {
     delete entries.clawrouter;
+    changed = true;
+    console.log('  Removed stale plugin entry');
+  }
+
+  // Clean plugins.allow — remove clawrouter (re-added later) and any stale bare
+  // single-word entries that aren't bundled OpenClaw plugins (e.g. "wallet" added
+  // by an AI agent — shows a warning on every gateway start).
+  if (Array.isArray(config?.plugins?.allow)) {
+    const BUNDLED = [
+      'http','mcp','computer-use','browser','code','image','voice',
+      'search','memory','calendar','email','slack','discord','telegram',
+      'whatsapp','matrix','teams','notion','github','jira','linear',
+      'comfyui','crossmint',
+    ];
+    const before = config.plugins.allow.length;
+    config.plugins.allow = config.plugins.allow.filter(p => {
+      if (p === 'clawrouter' || p === '@blockrun/clawrouter') return false;
+      if (BUNDLED.includes(p)) return true;
+      if (p.startsWith('@') || p.includes('/')) return true;
+      return false;
+    });
+    const removed = before - config.plugins.allow.length;
+    if (removed > 0) { changed = true; console.log('  Removed ' + removed + ' stale plugins.allow entry(ies)'); }
+  }
+
+  if (changed) {
     const tmp = configPath + '.tmp.' + process.pid;
     fs.writeFileSync(tmp, JSON.stringify(config, null, 2));
     fs.renameSync(tmp, configPath);
-    console.log('  Removed stale plugin entry');
   } else {
     console.log('  Config clean');
   }