fix: enforce strict config validation

src/plugins/loader.ts

@@ -30,6 +30,7 @@ export type PluginLoadOptions = {
   logger?: PluginLogger;
   coreGatewayHandlers?: Record<string, GatewayRequestHandler>;
   cache?: boolean;
+  mode?: "full" | "validate";
 };
 
 type NormalizedPluginsConfig = {
@@ -297,6 +298,7 @@ function pushDiagnostics(diagnostics: PluginDiagnostic[], append: PluginDiagnost
 export function loadClawdbotPlugins(options: PluginLoadOptions = {}): PluginRegistry {
   const cfg = options.config ?? {};
   const logger = options.logger ?? defaultLogger();
+  const validateOnly = options.mode === "validate";
   const normalized = normalizePluginsConfig(cfg.plugins);
   const cacheKey = buildCacheKey({
     workspaceDir: options.workspaceDir,
@@ -437,6 +439,21 @@ export function loadClawdbotPlugins(options: PluginLoadOptions = {}): PluginRegi
           >)
         : undefined;
 
+    if (!definition?.configSchema) {
+      logger.error(`[plugins] ${record.id} missing config schema`);
+      record.status = "error";
+      record.error = "missing config schema";
+      registry.plugins.push(record);
+      seenIds.set(candidate.idHint, candidate.origin);
+      registry.diagnostics.push({
+        level: "error",
+        pluginId: record.id,
+        source: record.source,
+        message: record.error,
+      });
+      continue;
+    }
+
     if (record.kind === "memory" && memorySlot === record.id) {
       memorySlotMatched = true;
     }
@@ -481,6 +498,12 @@ export function loadClawdbotPlugins(options: PluginLoadOptions = {}): PluginRegi
       continue;
     }
 
+    if (validateOnly) {
+      registry.plugins.push(record);
+      seenIds.set(candidate.idHint, candidate.origin);
+      continue;
+    }
+
     if (typeof register !== "function") {
       logger.error(`[plugins] ${record.id} missing register/activate export`);
       record.status = "error";