Peter Steinberger 9e67f53b91 fix(cli): resolve web command SecretRefs ...

Fix CLI web search/fetch command SecretRef resolution for provider-scoped plugin credentials.

- Carry command provider overrides through gateway and local secret resolution.
- Mark the selected web provider targets active and unrelated plugin refs inactive.
- Cover Tavily, DuckDuckGo, legacy Firecrawl fetch, protocol overrides, and runtime command-secret behavior.
- Add public plugin-sdk test mock exports needed by existing plugin tests after CI boundary enforcement.

Fixes #82621.
Replacement for #82699.

Co-authored-by: 吴杨帆 <39647285+leno23@users.noreply.github.com>

2026-05-17 03:00:39 +01:00

..

apply.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

apply.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

audit.test.ts

fix(secrets): treat env refs as audit-safe auth values

2026-05-17 00:05:10 +01:00

audit.ts

fix(secrets): treat env refs as audit-safe auth values

2026-05-17 00:05:10 +01:00

auth-profiles-scan.ts

…

auth-store-paths.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

channel-contract-api.external.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

channel-contract-api.fast-path.test.ts

test: tighten secrets configure assertions

2026-05-09 23:59:29 +01:00

channel-contract-api.ts

fix: allow Nix store plugin hardlinks (#79344)

2026-05-08 16:59:53 +02:00

channel-contract-surface-guardrails.test.ts

chore(channels): remove bluebubbles bundled surface

2026-05-07 12:52:48 -07:00

channel-env-var-names.ts

…

channel-env-vars.dynamic.test.ts

test: tighten secret env var assertions

2026-05-09 22:56:14 +01:00

channel-env-vars.ts

refactor: route plugin metadata consumers through snapshots

2026-05-02 08:18:52 +01:00

channel-secret-basic-runtime.ts

…

channel-secret-collector-runtime.ts

…

channel-secret-tts-runtime.ts

…

command-config.test.ts

test: tighten security empty array assertions

2026-05-09 05:09:12 +01:00

command-config.ts

…

config-io.ts

…

configure-plan.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

configure-plan.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

configure.test.ts

…

configure.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

credential-matrix.ts

fix(cli): resolve web command SecretRefs

2026-05-17 03:00:39 +01:00

exec-resolution-policy.ts

…

exec-secret-ref-id-parity.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

json-pointer.ts

refactor: hide utility helper internals

2026-05-02 07:33:06 +01:00

legacy-secretref-env-marker.ts

refactor: keep legacy secretref migration in doctor

2026-05-03 13:10:00 +01:00

path-utils.test.ts

…

path-utils.ts

…

plan.test.ts

test: tighten core helper assertions

2026-05-08 20:41:57 +01:00

plan.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

provider-env-vars.dynamic.test.ts

test: dedupe provider env mock read

2026-05-13 05:16:18 +01:00

provider-env-vars.test.ts

test: tighten secret env var assertions

2026-05-09 22:56:14 +01:00

provider-env-vars.ts

fix: guard provider env metadata reuse

2026-05-07 06:48:13 +01:00

ref-contract.test.ts

fix(security): harden CodeQL secret ref validation

2026-04-27 13:53:27 -07:00

ref-contract.ts

fix(security): harden CodeQL secret ref validation

2026-04-27 13:53:27 -07:00

resolve-secret-input-string.ts

…

resolve-types.ts

…

resolve.test.ts

test: share Windows platform spy helpers

2026-05-17 08:56:56 +08:00

resolve.ts

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

runtime-auth-collectors.ts

…

runtime-auth-profiles-oauth-policy.test.ts

test: tighten secret registry assertions

2026-05-09 23:02:14 +01:00

runtime-auth-refresh-failure.test.ts

test: require active secrets snapshot

2026-05-08 17:42:21 +01:00

runtime-auth-store-inline-refs.test.ts

…

runtime-auth.integration.test-helpers.ts

refactor(plugins): simplify plugin cache boundaries

2026-04-29 03:52:22 +01:00

runtime-channel-inactive-variants.test-support.ts

…

runtime-channel-inactive-variants.test.ts

test: tighten inactive channel warning assertions

2026-05-09 23:16:21 +01:00

runtime-command-secrets.test.ts

fix(cli): resolve web command SecretRefs

2026-05-17 03:00:39 +01:00

runtime-command-secrets.ts

fix(cli): resolve web command SecretRefs

2026-05-17 03:00:39 +01:00

runtime-config-collectors-channels.test.ts

test: guard secrets channel collector calls

2026-05-11 22:32:29 +01:00

runtime-config-collectors-channels.ts

fix(secretrefs): resolve external channel contracts (#76449)

2026-05-02 23:48:11 -05:00

runtime-config-collectors-core.ts

…

runtime-config-collectors-plugins.bundled.test.ts

perf: speed up bundled metadata test paths

2026-05-02 01:22:52 +01:00

runtime-config-collectors-plugins.test.ts

test: tighten core capture assertions

2026-05-08 20:44:46 +01:00

runtime-config-collectors-plugins.ts

refactor: simplify plugin cache boundaries

2026-04-29 04:33:15 +01:00

runtime-config-collectors-tts.ts

…

runtime-config-collectors.ts

fix(secretrefs): resolve external channel contracts (#76449)

2026-05-02 23:48:11 -05:00

runtime-core-snapshots.test.ts

test: tighten secrets snapshot assertions

2026-05-10 00:23:29 +01:00

runtime-discord-surface.test.ts

fix(discord): report unresolved token refs at startup (#82009)

2026-05-15 08:22:47 +01:00

runtime-discord.test-support.ts

…

runtime-external-channel-audit.test.ts

test: tighten secret audit status assertions

2026-05-09 23:08:01 +01:00

runtime-external-channel-origin-discovery.test.ts

test: guard secrets channel collector calls

2026-05-11 22:32:29 +01:00

runtime-gateway-auth-surfaces.test.ts

test: tighten gateway auth surface assertions

2026-05-09 22:58:55 +01:00

runtime-gateway-auth-surfaces.ts

…

runtime-gateway-local-surfaces.test.ts

test: tighten secrets warning assertions

2026-05-09 13:16:49 +01:00

runtime-inactive-core-surfaces.test.ts

test: tighten secrets warning assertions

2026-05-09 13:16:49 +01:00

runtime-inactive-telegram-surfaces.test.ts

test: tighten secrets warning assertions

2026-05-09 13:16:49 +01:00

runtime-legacy-x-search.test.ts

…

runtime-manifest.runtime.ts

refactor: reuse plugin metadata snapshots

2026-05-02 07:13:17 +01:00

runtime-matrix-shadowing.test.ts

test: tighten matrix shadowing assertions

2026-05-09 23:19:20 +01:00

runtime-matrix-top-level.test.ts

…

runtime-matrix.test-support.ts

…

runtime-nextcloud-talk-file-precedence.test.ts

…

runtime-nextcloud-talk.test-support.ts

…

runtime-openai-file-fixture.test-helper.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

runtime-prepare.runtime.ts

…

runtime-provider-and-media-surfaces.test.ts

…

runtime-request-secret-refs.test.ts

test: tighten security empty array assertions

2026-05-09 05:09:12 +01:00

runtime-shared.ts

…

runtime-telegram-token-inheritance.test.ts

…

runtime-telegram.test-support.ts

…

runtime-web-tools-fallback.runtime.ts

…

runtime-web-tools-manifest.runtime.ts

…

runtime-web-tools-public-artifacts.runtime.ts

…

runtime-web-tools-state.test.ts

test: tighten runtime web tools assertions

2026-05-08 19:40:30 +01:00

runtime-web-tools-state.ts

…

runtime-web-tools.shared.ts

fix(web_search): skip redundant provider re-resolution for external Brave plugin

2026-05-06 17:45:20 +08:00

runtime-web-tools.test.ts

fix(web): keep legacy Brave search fallback provider-owned

2026-05-14 10:32:55 +01:00

runtime-web-tools.ts

fix(cli): resolve web command SecretRefs

2026-05-17 03:00:39 +01:00

runtime-web-tools.types.ts

…

runtime-zalo-token-activity.test.ts

test: tighten core capture assertions

2026-05-08 20:44:46 +01:00

runtime-zalo.test-support.ts

…

runtime.auth.integration.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

runtime.coverage.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

runtime.fast-path.test.ts

test: tighten core capture assertions

2026-05-08 20:44:46 +01:00

runtime.gateway-auth.integration.test.ts

test: tighten gateway auth snapshot assertion

2026-05-08 17:11:33 +01:00

runtime.integration.test-helpers.ts

refactor: simplify plugin cache boundaries

2026-04-29 04:33:15 +01:00

runtime.loadable-plugin-origins.test.ts

test: tighten runtime plugin origin assertions

2026-05-10 00:02:18 +01:00

runtime.test-support.ts

fix(gemini): reuse google provider config for web search

2026-05-02 05:15:02 +01:00

runtime.test.ts

test: guard config diagnostics assertions

2026-05-11 20:02:10 +01:00

runtime.ts

fix(cli): resolve web command SecretRefs

2026-05-17 03:00:39 +01:00

secret-value.ts

…

shared.ts

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

storage-scan.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

target-registry-data.current-snapshot.test.ts

test: tighten secret registry assertions

2026-05-09 23:02:14 +01:00

target-registry-data.ts

fix(cli): resolve web command SecretRefs

2026-05-17 03:00:39 +01:00

target-registry-pattern.test.ts

…

target-registry-pattern.ts

…

target-registry-query.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

target-registry-test-helpers.ts

…

target-registry-types.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

target-registry.docs.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

target-registry.fast-path.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

target-registry.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

target-registry.ts

…

unsupported-surface-policy.test.ts

…

unsupported-surface-policy.ts

…