fix(plugins): constrain workspace discovery to .openclaw/extensions

src/plugins/discovery.test.ts

@@ -279,6 +279,36 @@ describe("discoverOpenClawPlugins", () => {
     expectCandidateIds(candidates, { includes: ["alpha", "beta"] });
   });
 
+  it("does not recurse arbitrary workspace directories for plugin auto-discovery", () => {
+    const stateDir = makeTempDir();
+    const workspaceDir = path.join(stateDir, "workspace");
+    const workspaceExt = path.join(workspaceDir, ".openclaw", "extensions");
+
+    const expectedWorkspacePluginDir = path.join(workspaceExt, "workspace-plugin");
+    createPackagePluginWithEntry({
+      packageDir: expectedWorkspacePluginDir,
+      packageName: "@openclaw/workspace-plugin",
+      pluginId: "workspace-plugin",
+    });
+
+    const unrelatedWorkspaceDir = path.join(workspaceDir, "lobster-integrations", "bin");
+    createPackagePluginWithEntry({
+      packageDir: unrelatedWorkspaceDir,
+      packageName: "@openclaw/stray-workspace-plugin",
+    });
+
+    const result = discoverOpenClawPlugins({
+      workspaceDir,
+      env: buildDiscoveryEnv(stateDir),
+    });
+
+    expectCandidatePresence(result, {
+      present: ["workspace-plugin"],
+      absent: ["stray-workspace-plugin"],
+    });
+    expect(result.diagnostics).toEqual([]);
+  });
+
   it("resolves tilde workspace dirs against the provided env", () => {
     const stateDir = makeTempDir();
     const homeDir = makeTempDir();

src/plugins/discovery.ts

@@ -925,18 +925,9 @@ export function discoverOpenClawPlugins(params: {
   const workspaceMatchesBundledRoot = resolvesToSameDirectory(workspaceRoot, roots.stock);
 
   if (roots.workspace && workspaceRoot && !workspaceMatchesBundledRoot) {
-    discoverInDirectory({
-      dir: workspaceRoot,
-      origin: "workspace",
-      ownershipUid: params.ownershipUid,
-      workspaceDir: workspaceRoot,
-      candidates,
-      diagnostics,
-      seen,
-      recurseDirectories: true,
-      skipDirectories: new Set([".openclaw"]),
-      visitedDirectories: new Set<string>(),
-    });
+    // Keep workspace auto-discovery constrained to the OpenClaw extensions root.
+    // Recursively scanning the full workspace treats arbitrary project folders as
+    // plugin candidates and causes noisy "plugin manifest not found" validation failures.
     discoverInDirectory({
       dir: roots.workspace,
       origin: "workspace",