fix: harden plugin auto-enable empty config handling

src/cli/exec-approvals-cli.test.ts

@@ -436,7 +436,8 @@ describe("exec approvals CLI", () => {
                 effective: "always",
               }),
               askFallback: expect.objectContaining({
-                source: "OpenClaw default (deny)",
+                effective: "full",
+                source: "OpenClaw default (full)",
               }),
             }),
           ]),

src/config/plugin-auto-enable.test.ts

@@ -121,6 +121,17 @@ afterEach(() => {
 });
 
 describe("applyPluginAutoEnable", () => {
+  it("treats an undefined config as empty", () => {
+    const result = applyPluginAutoEnable({
+      config: undefined,
+      env: {},
+    });
+
+    expect(result.config).toEqual({});
+    expect(result.changes).toEqual([]);
+    expect(result.autoEnabledReasons).toEqual({});
+  });
+
   it("auto-enables built-in channels without appending to plugins.allow", () => {
     const result = applyWithSlackConfig({ plugins: { allow: ["telegram"] } });
 

src/config/plugin-auto-enable.ts

@@ -645,7 +645,7 @@ function formatAutoEnableChange(entry: PluginEnableChange): string {
 }
 
 export function applyPluginAutoEnable(params: {
-  config: OpenClawConfig;
+  config?: OpenClawConfig;
   env?: NodeJS.ProcessEnv;
   /** Pre-loaded manifest registry. When omitted, the registry is loaded from
    *  the installed plugins on disk. Pass an explicit registry in tests to

src/plugin-sdk/facade-runtime.ts

@@ -135,7 +135,8 @@ function getJiti(modulePath: string) {
 
 function readFacadeBoundaryConfigSafely(): OpenClawConfig {
   try {
-    return loadConfig();
+    const config = loadConfig();
+    return config && typeof config === "object" ? config : EMPTY_FACADE_BOUNDARY_CONFIG;
   } catch {
     return EMPTY_FACADE_BOUNDARY_CONFIG;
   }

src/plugins/providers.test.ts

@@ -200,7 +200,7 @@ describe("resolvePluginProviders", () => {
     applyPluginAutoEnableMock.mockReset();
     applyPluginAutoEnableMock.mockImplementation(
       (params): PluginAutoEnableResult => ({
-        config: params.config,
+        config: params.config ?? ({} as OpenClawConfig),
         changes: [],
         autoEnabledReasons: {},
       }),

src/plugins/web-search-providers.runtime.test.ts

@@ -306,9 +306,9 @@ describe("resolvePluginWebSearchProviders", () => {
     applyPluginAutoEnableSpy = vi
       .spyOn(pluginAutoEnableModule, "applyPluginAutoEnable")
       .mockImplementation(
-        (params: { config: unknown }) =>
+        (params) =>
           ({
-            config: params.config,
+            config: params.config ?? {},
             changes: [],
             autoEnabledReasons: {},
           }) as ReturnType<PluginAutoEnableModule["applyPluginAutoEnable"]>,