Josh Avant 36d2ae2a22 SecretRef: harden custom/provider secret persistence and reuse (#42554) ...

* Models: gate custom provider keys by usable secret semantics

* Config: project runtime writes onto source snapshot

* Models: prevent stale apiKey preservation for marker-managed providers

* Runner: strip SecretRef marker headers from resolved models

* Secrets: scan active agent models.json path in audit

* Config: guard runtime-source projection for unrelated configs

* Extensions: fix onboarding type errors in CI

* Tests: align setup helper account-enabled expectation

* Secrets audit: harden models.json file reads

* fix: harden SecretRef custom/provider secret persistence (#42554) (thanks @joshavant)

2026-03-10 23:55:10 +00:00

..

apply.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

apply.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

audit.test.ts

SecretRef: harden custom/provider secret persistence and reuse (#42554)

2026-03-10 23:55:10 +00:00

audit.ts

SecretRef: harden custom/provider secret persistence and reuse (#42554)

2026-03-10 23:55:10 +00:00

auth-profiles-scan.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

auth-store-paths.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

command-config.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

command-config.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

config-io.ts

feat(secrets): replace migrate flow with audit/configure/apply

2026-02-26 14:47:22 +00:00

configure-plan.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

configure-plan.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

configure.test.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

configure.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

credential-matrix.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

exec-secret-ref-id-parity.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

json-pointer.ts

Secrets: preserve runtime snapshot source refs on write

2026-02-26 14:47:22 +00:00

path-utils.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

path-utils.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

plan.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

plan.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

provider-env-vars.test.ts

fix(acp): strip provider auth env for child ACP processes (openclaw#42250)

2026-03-10 16:50:10 -05:00

provider-env-vars.ts

fix(acp): strip provider auth env for child ACP processes (openclaw#42250)

2026-03-10 16:50:10 -05:00

ref-contract.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

ref-contract.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

resolve-secret-input-string.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

resolve.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

resolve.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

runtime-auth-collectors.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

runtime-config-collectors-channels.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

runtime-config-collectors-core.ts

fix(secrets): resolve web tool SecretRefs atomically at runtime

2026-03-09 22:57:03 -05:00

runtime-config-collectors-tts.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

runtime-config-collectors.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

runtime-gateway-auth-surfaces.test.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

runtime-gateway-auth-surfaces.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

runtime-shared.ts

fix(secrets): resolve web tool SecretRefs atomically at runtime

2026-03-09 22:57:03 -05:00

runtime-web-tools.test.ts

fix(secrets): resolve web tool SecretRefs atomically at runtime

2026-03-09 22:57:03 -05:00

runtime-web-tools.ts

fix(secrets): resolve web tool SecretRefs atomically at runtime

2026-03-09 22:57:03 -05:00

runtime.coverage.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

runtime.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

runtime.ts

fix(secrets): resolve web tool SecretRefs atomically at runtime

2026-03-09 22:57:03 -05:00

secret-value.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

shared.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

storage-scan.ts

SecretRef: harden custom/provider secret persistence and reuse (#42554)

2026-03-10 23:55:10 +00:00

target-registry-data.ts

fix(secrets): resolve web tool SecretRefs atomically at runtime

2026-03-09 22:57:03 -05:00

target-registry-pattern.test.ts

Secrets: harden SecretRef-safe models.json persistence (#38955)

2026-03-07 11:28:39 -06:00

target-registry-pattern.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

target-registry-query.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

target-registry-types.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

target-registry.test.ts

docs: fix secretref marker rendering in credential surface

2026-03-03 15:08:41 -06:00

target-registry.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00