fix: avoid clobbering sensitive config fields during configure

Reading the entire plugins tree via openclaw config get returns redacted
values for sensitive fields. Writing it back overwrites real secrets with
the __OPENCLAW_REDACTED__ sentinel. Changed to set individual leaf paths
only when missing.

ego-mgr/src/main.go

@@ -24,6 +24,7 @@ const (
 	ExitPermission      = 4
 	ExitLockFailed      = 5
 	ExitJSONError       = 6
+	ExitNotFound       = 7
 )
 
 // EgoData is the on-disk JSON structure
@@ -185,7 +186,7 @@ Examples:
   ego-mgr delete name`,
 	}
 
-	rootCmd.AddCommand(addCmd(), deleteCmd(), setCmd(), getCmd(), showCmd(), listCmd())
+	rootCmd.AddCommand(addCmd(), deleteCmd(), setCmd(), getCmd(), showCmd(), listCmd(), lookupCmd())
 
 	if err := rootCmd.Execute(); err != nil {
 		os.Exit(ExitUsageError)
@@ -480,3 +481,37 @@ func listColumnsCmd() *cobra.Command {
 	}
 	return cmd
 }
+
+func lookupCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "lookup <username>",
+		Short: "Look up an agent ID by default-username",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			username := args[0]
+
+			data, err := readEgoData()
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+				os.Exit(ExitJSONError)
+			}
+
+			// Verify default-username column exists
+			if !isAgentColumn(data, "default-username") {
+				fmt.Fprintf(os.Stderr, "Error: column 'default-username' does not exist\n")
+				os.Exit(ExitColumnNotFound)
+			}
+
+			for agentID, agentData := range data.AgentScope {
+				if agentData["default-username"] == username {
+					fmt.Print(agentID)
+					return
+				}
+			}
+
+			fmt.Fprintf(os.Stderr, "Error: no agent found with default-username '%s'\n", username)
+			os.Exit(ExitNotFound)
+		},
+	}
+	return cmd
+}

install.mjs

@@ -349,23 +349,21 @@ async function configure() {
     if (!allow.includes(PLUGIN_NAME)) { allow.push(PLUGIN_NAME); setOpenclawConfig('plugins.allow', allow); }
     logOk(`plugins.allow includes ${PLUGIN_NAME}`);
 
-    const plugins = getOpenclawConfig('plugins', {});
+    const entryPath = `plugins.entries.${PLUGIN_NAME}`;
-    plugins.entries = plugins.entries || {};
+    const existingEnabled = getOpenclawConfig(`${entryPath}.enabled`, undefined);
+    if (existingEnabled === undefined) setOpenclawConfig(`${entryPath}.enabled`, true);
 
-    const existingEntry = plugins.entries[PLUGIN_NAME] || {};
+    const cfgPath = `${entryPath}.config`;
-    const existingConfig = existingEntry.config || {};
+    const existingCfgEnabled = getOpenclawConfig(`${cfgPath}.enabled`, undefined);
-    const defaultConfig = { enabled: true, secretMgrPath, openclawProfilePath: openclawPath };
+    if (existingCfgEnabled === undefined) setOpenclawConfig(`${cfgPath}.enabled`, true);
 
-    plugins.entries[PLUGIN_NAME] = {
+    const existingSecretMgr = getOpenclawConfig(`${cfgPath}.secretMgrPath`, undefined);
-      ...existingEntry,
+    if (existingSecretMgr === undefined) setOpenclawConfig(`${cfgPath}.secretMgrPath`, secretMgrPath);
-      enabled: existingEntry.enabled ?? true,
+
-      config: {
+    const existingProfile = getOpenclawConfig(`${cfgPath}.openclawProfilePath`, undefined);
-        ...defaultConfig,
+    if (existingProfile === undefined) setOpenclawConfig(`${cfgPath}.openclawProfilePath`, openclawPath);
-        ...existingConfig,
+
-      },
+    logOk('Plugin entry configured (set missing defaults only)');
-    };
-    setOpenclawConfig('plugins', plugins);
-    logOk('Plugin entry configured (preserved existing config, added missing defaults)');
   } catch (err) {
     logWarn(`Config failed: ${err.message}`);
   }