Files
openclaw/src/plugins/provider-auth-choice-preference.ts
Pavan Kumar Gondhi 2d97eae53e fix(plugins): prevent untrusted workspace plugins from hijacking bundled provider auth choices [AI] (#62368)
* fix: address issue

* fix: address review feedback

* docs(changelog): add onboarding auth-choice guard entry

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
2026-04-08 23:08:14 +05:30

44 lines
1.4 KiB
TypeScript

import { normalizeLegacyOnboardAuthChoice } from "../commands/auth-choice-legacy.js";
import type { OpenClawConfig } from "../config/config.js";
import { resolveManifestProviderAuthChoice } from "./provider-auth-choices.js";
function normalizeLegacyAuthChoice(choice: string, env?: NodeJS.ProcessEnv): string {
return normalizeLegacyOnboardAuthChoice(choice, { env }) ?? choice;
}
export async function resolvePreferredProviderForAuthChoice(params: {
choice: string;
config?: OpenClawConfig;
workspaceDir?: string;
env?: NodeJS.ProcessEnv;
includeUntrustedWorkspacePlugins?: boolean;
}): Promise<string | undefined> {
const choice = normalizeLegacyAuthChoice(params.choice, params.env) ?? params.choice;
const manifestResolved = resolveManifestProviderAuthChoice(choice, params);
if (manifestResolved) {
return manifestResolved.providerId;
}
const { resolveProviderPluginChoice, resolvePluginProviders } =
await import("./provider-auth-choice.runtime.js");
const providers = resolvePluginProviders({
config: params.config,
workspaceDir: params.workspaceDir,
env: params.env,
mode: "setup",
includeUntrustedWorkspacePlugins: params.includeUntrustedWorkspacePlugins,
});
const pluginResolved = resolveProviderPluginChoice({
providers,
choice,
});
if (pluginResolved) {
return pluginResolved.provider.id;
}
if (choice === "custom-api-key") {
return "custom";
}
return undefined;
}