vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-06-04 10:54:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(secrets): treat Codex app-server marker as non-secret

Browse Source 
Treat the synthetic Codex app-server auth marker as a core non-secret marker so secrets audit does not flag it when bundled plugin discovery is disabled.\n\nVerified with focused model-auth marker tests, isolated secrets-audit CLI proof, autoreview, and green CI.\n\nThanks @vortexopenclaw.
This commit is contained in:
vortexopenclaw
2026-05-31 09:35:13 -07:00
committed by GitHub
parent dd79c8836a
commit fa0a323ebd
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/agents/model-auth-markers.test.ts
View File

@@ -22,6 +22,7 @@ function cleanPluginManifestEnv(): Record<(typeof PLUGIN_MANIFEST_ENV_KEYS)[numb
}
let listKnownProviderEnvApiKeyNames: typeof import("./model-auth-env-vars.js").listKnownProviderEnvApiKeyNames;
let CODEX_APP_SERVER_AUTH_MARKER: typeof import("./model-auth-markers.js").CODEX_APP_SERVER_AUTH_MARKER;
let GCP_VERTEX_CREDENTIALS_MARKER: typeof import("./model-auth-markers.js").GCP_VERTEX_CREDENTIALS_MARKER;
let NON_ENV_SECRETREF_MARKER: typeof import("./model-auth-markers.js").NON_ENV_SECRETREF_MARKER;
let isKnownEnvApiKeyMarker: typeof import("./model-auth-markers.js").isKnownEnvApiKeyMarker;
@@ -39,6 +40,7 @@ async function loadMarkerModules() {
import("./model-auth-markers.js"),
]);
listKnownProviderEnvApiKeyNames = envVarsModule.listKnownProviderEnvApiKeyNames;
CODEX_APP_SERVER_AUTH_MARKER = markersModule.CODEX_APP_SERVER_AUTH_MARKER;
GCP_VERTEX_CREDENTIALS_MARKER = markersModule.GCP_VERTEX_CREDENTIALS_MARKER;
NON_ENV_SECRETREF_MARKER = markersModule.NON_ENV_SECRETREF_MARKER;
isKnownEnvApiKeyMarker = markersModule.isKnownEnvApiKeyMarker;
@@ -69,10 +71,18 @@ describe("model auth markers", () => {
expect(isNonSecretApiKeyMarker(resolveOAuthApiKeyMarker("chutes"))).toBe(true);
expect(isNonSecretApiKeyMarker("ollama-local")).toBe(true);
expect(isNonSecretApiKeyMarker("lmstudio-local")).toBe(true);
expect(isNonSecretApiKeyMarker("codex-app-server")).toBe(true);
expect(isNonSecretApiKeyMarker(CODEX_APP_SERVER_AUTH_MARKER)).toBe(true);
expect(isNonSecretApiKeyMarker(GCP_VERTEX_CREDENTIALS_MARKER)).toBe(true);
});
it("recognizes the Codex app-server marker without bundled plugin discovery", async () => {
await withEnvAsync({ OPENCLAW_DISABLE_BUNDLED_PLUGINS: "1" }, async () => {
await loadMarkerModules();
expect(isNonSecretApiKeyMarker(CODEX_APP_SERVER_AUTH_MARKER)).toBe(true);
});
await withEnvAsync(cleanPluginManifestEnv(), loadMarkerModules);
});
it("reads bundled plugin-owned non-secret markers from manifests", () => {
const markers = new Set(listKnownNonSecretApiKeyMarkers());
expect(markers.has("codex-app-server")).toBe(true);

3
src/agents/model-auth-markers.ts
View File

@@ -12,6 +12,8 @@ export const OAUTH_API_KEY_MARKER_PREFIX = "oauth:";
export const OLLAMA_LOCAL_AUTH_MARKER = "ollama-local";
/** @deprecated Bundled local-provider marker; do not use from third-party plugins. */
export const CUSTOM_LOCAL_AUTH_MARKER = "custom-local";
/** @deprecated Codex provider-owned marker; do not use from third-party plugins. */
export const CODEX_APP_SERVER_AUTH_MARKER = "codex-app-server";
export const GCP_VERTEX_CREDENTIALS_MARKER = "gcp-vertex-credentials";
export const NON_ENV_SECRETREF_MARKER = "secretref-managed"; // pragma: allowlist secret
export const SECRETREF_ENV_HEADER_MARKER_PREFIX = "secretref-env:"; // pragma: allowlist secret
@@ -23,6 +25,7 @@ const AWS_SDK_ENV_MARKERS = new Set([
]);
const CORE_NON_SECRET_API_KEY_MARKERS = [
CUSTOM_LOCAL_AUTH_MARKER,
CODEX_APP_SERVER_AUTH_MARKER,
OLLAMA_LOCAL_AUTH_MARKER,
NON_ENV_SECRETREF_MARKER,
] as const;