fix(config): allowlist auto-enabled built-in channels when restricted

Co-authored-by: 4rev <4rev@users.noreply.github.com>

src/config/plugin-auto-enable.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import { applyPluginAutoEnable } from "./plugin-auto-enable.js";
 
 describe("applyPluginAutoEnable", () => {
-  it("auto-enables built-in channels without touching plugins allowlist", () => {
+  it("auto-enables built-in channels and appends to existing allowlist", () => {
     const result = applyPluginAutoEnable({
       config: {
         channels: { slack: { botToken: "x" } },
@@ -13,10 +13,22 @@ describe("applyPluginAutoEnable", () => {
 
     expect(result.config.channels?.slack?.enabled).toBe(true);
     expect(result.config.plugins?.entries?.slack).toBeUndefined();
-    expect(result.config.plugins?.allow).toEqual(["telegram"]);
+    expect(result.config.plugins?.allow).toEqual(["telegram", "slack"]);
     expect(result.changes.join("\n")).toContain("Slack configured, enabled automatically.");
   });
 
+  it("does not create plugins.allow when allowlist is unset", () => {
+    const result = applyPluginAutoEnable({
+      config: {
+        channels: { slack: { botToken: "x" } },
+      },
+      env: {},
+    });
+
+    expect(result.config.channels?.slack?.enabled).toBe(true);
+    expect(result.config.plugins?.allow).toBeUndefined();
+  });
+
   it("ignores channels.modelByChannel for plugin auto-enable", () => {
     const result = applyPluginAutoEnable({
       config: {

src/config/plugin-auto-enable.ts

@@ -477,8 +477,7 @@ export function applyPluginAutoEnable(params: {
       continue;
     }
     const allow = next.plugins?.allow;
-    const allowMissing =
-      !builtInChannelId && Array.isArray(allow) && !allow.includes(entry.pluginId);
+    const allowMissing = Array.isArray(allow) && !allow.includes(entry.pluginId);
     const alreadyEnabled =
       builtInChannelId != null
         ? (() => {
@@ -498,7 +497,7 @@ export function applyPluginAutoEnable(params: {
       continue;
     }
     next = registerPluginEntry(next, entry.pluginId);
-    if (!builtInChannelId) {
+    if (allowMissing || !builtInChannelId) {
       next = ensurePluginAllowlisted(next, entry.pluginId);
     }
     changes.push(formatAutoEnableChange(entry));

src/plugins/enable.test.ts

@@ -39,4 +39,16 @@ describe("enablePluginInConfig", () => {
     expect(result.config.channels?.telegram?.enabled).toBe(true);
     expect(result.config.plugins?.entries?.telegram).toBeUndefined();
   });
+
+  it("adds built-in channel id to allowlist when allowlist is configured", () => {
+    const cfg: OpenClawConfig = {
+      plugins: {
+        allow: ["memory-core"],
+      },
+    };
+    const result = enablePluginInConfig(cfg, "telegram");
+    expect(result.enabled).toBe(true);
+    expect(result.config.channels?.telegram?.enabled).toBe(true);
+    expect(result.config.plugins?.allow).toEqual(["memory-core", "telegram"]);
+  });
 });

src/plugins/enable.ts

@@ -24,19 +24,18 @@ export function enablePluginInConfig(cfg: OpenClawConfig, pluginId: string): Plu
       existing && typeof existing === "object" && !Array.isArray(existing)
         ? (existing as Record<string, unknown>)
         : {};
-    return {
-      config: {
-        ...cfg,
-        channels: {
-          ...cfg.channels,
-          [builtInChannelId]: {
-            ...existingRecord,
-            enabled: true,
-          },
+    let next: OpenClawConfig = {
+      ...cfg,
+      channels: {
+        ...cfg.channels,
+        [builtInChannelId]: {
+          ...existingRecord,
+          enabled: true,
         },
       },
-      enabled: true,
     };
+    next = ensurePluginAllowlisted(next, resolvedId);
+    return { config: next, enabled: true };
   }
 
   const entries = {