Josh Avant 1769fb2aa1 fix(secrets): align SecretRef inspect/strict behavior across preload/runtime paths (#66818) ...

* Config: add inspect/strict SecretRef string resolver

* CLI: pass resolved/source config snapshots to plugin preload

* Slack: keep HTTP route registration config-only

* Providers: normalize SecretRef handling for auth and web tools

* Secrets: add Exa web search target to registry and docs

* Telegram: resolve env SecretRef tokens at runtime

* Agents: resolve custom provider env SecretRef ids

* Providers: fail closed on blocked SecretRef fallback

* Telegram: enforce env SecretRef policy for runtime token refs

* Status/Providers/Telegram: tighten SecretRef preload and fallback handling

* Providers: enforce env SecretRef policy checks in fallback auth paths

* fix: add SecretRef lifecycle changelog entry (#66818) (thanks @joshavant)

2026-04-14 17:59:28 -05:00

..

apply.test.ts

test: project secrets apply path mutations without runtime preflight

2026-04-09 05:03:14 +01:00

apply.ts

refactor: reduce unsafe assertions in secrets

2026-04-11 01:50:19 +01:00

audit.test.ts

test: eliminate remaining clone seams

2026-03-26 20:28:36 +00:00

audit.ts

refactor: dedupe lowercase helper readers

2026-04-07 15:12:32 +01:00

auth-profiles-scan.ts

refactor: simplify runtime conversions

2026-04-11 01:23:34 +01:00

auth-store-paths.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

channel-contract-api.fast-path.test.ts

perf: narrow plugin config test surfaces

2026-04-11 13:55:08 +01:00

channel-contract-api.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

channel-contract-surface-guardrails.test.ts

test: move bundled channel config runtime into test helpers

2026-04-06 18:30:09 +01:00

channel-env-vars.dynamic.test.ts

refactor: resolve channel env vars from plugin manifests

2026-04-06 19:53:27 +01:00

channel-env-vars.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

channel-secret-basic-runtime.ts

perf(plugin-sdk): split channel secret runtime helpers

2026-04-07 13:09:12 +01:00

channel-secret-collector-runtime.ts

perf(plugin-sdk): split channel secret runtime helpers

2026-04-07 13:09:12 +01:00

channel-secret-tts-runtime.ts

perf(plugin-sdk): split channel secret runtime helpers

2026-04-07 13:09:12 +01:00

command-config.test.ts

test: genericize talk provider fixtures

2026-04-05 18:52:18 +01:00

command-config.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

config-io.ts

…

configure-plan.test.ts

test: genericize talk provider fixtures

2026-04-05 18:52:18 +01:00

configure-plan.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

configure.test.ts

refactor(auth): extract persisted auth store helpers

2026-04-06 14:25:06 +01:00

configure.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

credential-matrix.ts

fix: unblock cli startup metadata

2026-04-04 02:35:36 +01:00

exec-resolution-policy.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

exec-secret-ref-id-parity.test.ts

test: genericize talk provider fixtures

2026-04-05 18:52:18 +01:00

json-pointer.ts

refactor: reduce unsafe assertions in secrets

2026-04-11 01:50:19 +01:00

path-utils.test.ts

fix: widen path utils root contract

2026-04-05 08:59:12 +05:30

path-utils.ts

fix: widen path utils root contract

2026-04-05 08:59:12 +05:30

plan.test.ts

test: genericize talk provider fixtures

2026-04-05 18:52:18 +01:00

plan.ts

perf: narrow plugin config test surfaces

2026-04-11 13:55:08 +01:00

provider-env-vars.dynamic.test.ts

perf(secrets): lazy-load provider env var exports

2026-04-13 19:52:02 +01:00

provider-env-vars.test.ts

fix(video): queue fal provider jobs

2026-04-06 00:12:47 +01:00

provider-env-vars.ts

perf(secrets): lazy-load provider env var exports

2026-04-13 19:52:02 +01:00

ref-contract.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

ref-contract.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

resolve-secret-input-string.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

resolve-types.ts

refactor: remove type-only import cycles

2026-04-10 15:14:27 +01:00

resolve.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

resolve.ts

refactor: reduce unsafe assertions in secrets

2026-04-11 01:50:19 +01:00

runtime-auth-collectors.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

runtime-auth-profiles-oauth-policy.test.ts

test(secrets): reuse auth runtime fixtures

2026-04-12 03:54:26 +01:00

runtime-auth-refresh-failure.test.ts

perf(secrets): split runtime snapshot coverage

2026-04-06 08:18:40 +01:00

runtime-auth-store-inline-refs.test.ts

test(secrets): reuse auth runtime fixtures

2026-04-12 03:54:26 +01:00

runtime-auth.integration.test-helpers.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

runtime-channel-inactive-variants.test-support.ts

fix(secrets): narrow inactive variant test helper types

2026-04-12 04:11:11 +01:00

runtime-channel-inactive-variants.test.ts

test(secrets): share inactive channel fixtures

2026-04-12 04:03:57 +01:00

runtime-command-secrets.ts

perf(secrets): trim runtime import walls

2026-04-06 07:32:12 +01:00

runtime-config-collectors-channels.test.ts

fix(secrets): restore source-mode contract loading

2026-04-06 17:59:53 +01:00

runtime-config-collectors-channels.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

runtime-config-collectors-core.ts

fix(media): decouple capability registry from runtime loaders

2026-04-12 12:01:39 +01:00

runtime-config-collectors-plugins.test.ts

perf: narrow plugin config test surfaces

2026-04-11 13:55:08 +01:00

runtime-config-collectors-plugins.ts

perf: narrow plugin config test surfaces

2026-04-11 13:55:08 +01:00

runtime-config-collectors-tts.ts

refactor: require legacy config migration on read

2026-03-26 23:23:47 +00:00

runtime-config-collectors.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

runtime-core-snapshots.test.ts

fix(tsgo): align cron contract and secrets test helper

2026-04-12 03:58:32 +01:00

runtime-discord-surface.test.ts

test(secrets): share channel snapshot fixtures

2026-04-12 03:59:11 +01:00

runtime-discord.test-support.ts

fix(secrets): cache guarded channel assignment helpers

2026-04-12 04:17:39 +01:00

runtime-gateway-auth-surfaces.test.ts

Gateway: fail closed unresolved local auth SecretRefs (#42672)

2026-03-10 21:41:56 -05:00

runtime-gateway-auth-surfaces.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

runtime-gateway-local-surfaces.test.ts

test(secrets): reuse runtime fixtures across surfaces

2026-04-12 03:45:48 +01:00

runtime-inactive-core-surfaces.test.ts

test(secrets): reuse inactive snapshot fixtures

2026-04-12 03:56:37 +01:00

runtime-inactive-telegram-surfaces.test.ts

test(secrets): share channel snapshot fixtures

2026-04-12 03:59:11 +01:00

runtime-legacy-x-search.test.ts

test(secrets): reuse snapshot hooks in web state tests

2026-04-12 04:27:34 +01:00

runtime-manifest.runtime.ts

perf(test): trim secrets runtime coverage

2026-04-06 06:45:05 +01:00

runtime-matrix-shadowing.test.ts

test(secrets): share runtime snapshot fixtures

2026-04-12 03:37:08 +01:00

runtime-matrix-top-level.test.ts

test(secrets): share runtime snapshot fixtures

2026-04-12 03:37:08 +01:00

runtime-matrix.test-support.ts

fix(secrets): cache guarded channel assignment helpers

2026-04-12 04:17:39 +01:00

runtime-nextcloud-talk-file-precedence.test.ts

test(secrets): reuse channel token fixtures

2026-04-12 04:01:20 +01:00

runtime-nextcloud-talk.test-support.ts

fix(secrets): cache guarded channel assignment helpers

2026-04-12 04:17:39 +01:00

runtime-prepare.runtime.ts

perf(test): trim secrets runtime coverage

2026-04-06 06:45:05 +01:00

runtime-provider-and-media-surfaces.test.ts

test(secrets): reuse runtime fixtures across surfaces

2026-04-12 03:45:48 +01:00

runtime-request-secret-refs.test.ts

test(secrets): share runtime snapshot fixtures

2026-04-12 03:37:08 +01:00

runtime-shared.ts

refactor: remove type-only import cycles

2026-04-10 15:14:27 +01:00

runtime-telegram-token-inheritance.test.ts

test(secrets): reuse channel token fixtures

2026-04-12 04:01:20 +01:00

runtime-telegram.test-support.ts

fix(secrets): cache guarded channel assignment helpers

2026-04-12 04:17:39 +01:00

runtime-web-tools-fallback.runtime.ts

perf(secrets): lazy-load web provider fallbacks

2026-04-06 23:39:10 +01:00

runtime-web-tools-manifest.runtime.ts

perf(secrets): lazy-load runtime web-tools manifest lookups

2026-04-12 09:35:40 +01:00

runtime-web-tools-public-artifacts.runtime.ts

perf(secrets): split explicit bundled web provider artifacts

2026-04-07 12:14:13 +01:00

runtime-web-tools-state.test.ts

test(secrets): reuse snapshot hooks in web state tests

2026-04-12 04:27:34 +01:00

runtime-web-tools-state.ts

fix(runtime): guard import-time side effects

2026-04-05 13:20:06 +01:00

runtime-web-tools.shared.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

runtime-web-tools.test.ts

perf(secrets): lazy-load runtime web-tools manifest lookups

2026-04-12 09:35:40 +01:00

runtime-web-tools.ts

perf(secrets): lazy-load runtime web-tools manifest lookups

2026-04-12 09:35:40 +01:00

runtime-web-tools.types.ts

!refactor(xai): move x_search config behind plugin boundary (#59674)

2026-04-02 22:08:59 +09:00

runtime-zalo-token-activity.test.ts

test(secrets): reuse channel token fixtures

2026-04-12 04:01:20 +01:00

runtime-zalo.test-support.ts

fix(secrets): cache guarded channel assignment helpers

2026-04-12 04:17:39 +01:00

runtime.auth.integration.test.ts

perf(runtime): trim config, media, and secrets tests

2026-04-08 01:49:23 +01:00

runtime.coverage.test.ts

perf(secrets): move plugin-owned coverage out of core matrix

2026-04-07 08:35:27 +01:00

runtime.gateway-auth.integration.test.ts

test: restore secrets suite isolation cleanup

2026-04-03 17:38:05 +01:00

runtime.integration.test-helpers.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

runtime.loadable-plugin-origins.test.ts

test(secrets): reuse inactive snapshot fixtures

2026-04-12 03:56:37 +01:00

runtime.test-support.ts

fix(ci): restore extension boundary guards

2026-04-12 09:50:20 +01:00

runtime.test.ts

test(secrets): reuse auth runtime fixtures

2026-04-12 03:54:26 +01:00

runtime.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

secret-value.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

shared.ts

refactor: dedupe core error formatting call sites

2026-04-07 05:06:54 +01:00

storage-scan.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

target-registry-data.ts

fix(secrets): align SecretRef inspect/strict behavior across preload/runtime paths (#66818)

2026-04-14 17:59:28 -05:00

target-registry-pattern.test.ts

Secrets: harden SecretRef-safe models.json persistence (#38955)

2026-03-07 11:28:39 -06:00

target-registry-pattern.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

target-registry-query.ts

perf(secrets): fast-path explicit channel target lookup

2026-04-13 15:49:23 +01:00

target-registry-test-helpers.ts

perf(test): lazy-load bundled channel secrets

2026-04-06 16:40:41 +01:00

target-registry-types.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

target-registry.docs.test.ts

perf(tests): trim hot wizard and infra setup work

2026-04-14 22:42:32 +01:00

target-registry.fast-path.test.ts

perf(secrets): fast-path explicit channel target lookup

2026-04-13 15:49:23 +01:00

target-registry.test.ts

fix(secrets): align SecretRef inspect/strict behavior across preload/runtime paths (#66818)

2026-04-14 17:59:28 -05:00

target-registry.ts

…

unsupported-surface-policy.test.ts

perf(config): use generated SecretRef policy metadata

2026-04-13 20:19:04 +01:00

unsupported-surface-policy.ts

perf(config): use generated SecretRef policy metadata

2026-04-13 20:19:04 +01:00