fix: unblock cli startup metadata

src/secrets/credential-matrix.ts

@@ -1,5 +1,5 @@
 import { listSecretTargetRegistryEntries } from "./target-registry.js";
-import { UNSUPPORTED_SECRETREF_SURFACE_PATTERNS } from "./unsupported-surface-policy.js";
+import { getUnsupportedSecretRefSurfacePatterns } from "./unsupported-surface-policy.js";
 
 type CredentialMatrixEntry = {
   id: string;
@@ -54,7 +54,7 @@ export function buildSecretRefCredentialMatrix(): SecretRefCredentialMatrixDocum
     pathSyntax: 'Dot path with "*" for map keys and "[]" for arrays.',
     scope:
       "Credentials that are strictly user-supplied and not minted/rotated by OpenClaw runtime.",
-    excludedMutableOrRuntimeManaged: [...UNSUPPORTED_SECRETREF_SURFACE_PATTERNS],
+    excludedMutableOrRuntimeManaged: getUnsupportedSecretRefSurfacePatterns(),
     entries,
   };
 }

src/secrets/unsupported-surface-policy.test.ts

@@ -1,12 +1,12 @@
 import { describe, expect, it } from "vitest";
 import {
   collectUnsupportedSecretRefConfigCandidates,
-  UNSUPPORTED_SECRETREF_SURFACE_PATTERNS,
+  getUnsupportedSecretRefSurfacePatterns,
 } from "./unsupported-surface-policy.js";
 
 describe("unsupported SecretRef surface policy metadata", () => {
   it("exposes the canonical unsupported surface patterns", () => {
-    expect(UNSUPPORTED_SECRETREF_SURFACE_PATTERNS).toEqual([
+    expect(getUnsupportedSecretRefSurfacePatterns()).toEqual([
       "commands.ownerDisplaySecret",
       "hooks.token",
       "hooks.gmail.pushToken",

src/secrets/unsupported-surface-policy.ts

@@ -26,10 +26,15 @@ function collectChannelUnsupportedSecretRefSurfacePatterns(): string[] {
   );
 }
 
-export const UNSUPPORTED_SECRETREF_SURFACE_PATTERNS = [
-  ...CORE_UNSUPPORTED_SECRETREF_SURFACE_PATTERNS,
-  ...collectChannelUnsupportedSecretRefSurfacePatterns(),
-] as const;
+let cachedUnsupportedSecretRefSurfacePatterns: string[] | null = null;
+
+export function getUnsupportedSecretRefSurfacePatterns(): string[] {
+  cachedUnsupportedSecretRefSurfacePatterns ??= [
+    ...CORE_UNSUPPORTED_SECRETREF_SURFACE_PATTERNS,
+    ...collectChannelUnsupportedSecretRefSurfacePatterns(),
+  ];
+  return cachedUnsupportedSecretRefSurfacePatterns;
+}
 
 export type UnsupportedSecretRefConfigCandidate = {
   path: string;