[Angnuo (angnuoli)]

Summary

• Silently remove saved RO/RW folder grants confirmed missing with ENOENT at startup and before a new MXC generation's policy fingerprint is minted; clean stale folder drafts before validation. Permission errors, files, reparse points, protected roots, and explicitly requested missing CWDs retain strict rejection behavior.
• Fix Full-containment readiness to recognize the bundled node's structured protected-CWD rejection, instead of treating successful RPC transport as successful command execution. Accept omitted or null exitCode only with the exact selected node/command and explicit rejectedBeforeExecution result; retain negative coverage for executed commands, unrelated failures, malformed payloads, and mismatched identities.
• Restrict the internal GitHub Copilot flag to desktop setup/sign-in. Preserve existing OpenClaw-configured Copilot models in setup detection, chat, default/session model selection, catalog reads, and model settings without the flag.
• Preserve the bundled Copilot model-provider plugin when configured or explicitly enabled under both locked and active MXC policies. Cover default/fallback/per-agent model references, source-config immutability, exact backup restoration, and continued rejection of unreviewed plugins.
• Update documentation and regression coverage for these startup/configuration failures.

Security boundaries and follow-up

This intentionally packages the current fixes, not the proposed approval-system redesign. Copilot preservation remains an explicit reviewed provider exception, not generic plugin permission admission. A future change should replace provider-name exceptions with verified plugin admission and separate user intent, authorization records, and effective runtime policy.

This PR does not introduce a new consent flow, auto-grant folders, change credentials, enable arbitrary plugins, relax the locked/active tool lists or selected-node routing, remove MXC chat readiness checks, or add host execution fallback. Directory pruning removes authorization records only; it does not delete/create filesystem entries or mutate live-generation grants.

Unrelated performance, runtime-archive, dependency, packaging, and startup-order work from the original workspace is excluded.

Validation

• Full desktop/main Vitest suite: 1,790 passed, 39 skipped (110 files passed, 6 skipped).
• Focused renderer regression suite: 73 passed across ChatModelPicker and model settings.
• Desktop TypeScript and renderer Vue/TypeScript checks: passed.
• ESLint for changed main/renderer files: no errors; existing warning categories remain.
• git diff --check: passed.

Prepared in an isolated worktree and rebased onto the current main. The original workspace and its unrelated uncommitted changes are untouched.