Peter Steinberger 4bf70be01a feat(secrets): egress-time credential injection with process-local sentinels (#102009) ...

* feat(secrets): resolve SecretRef model credentials at egress via process-local sentinels

SecretRef-managed model-provider credentials now travel as opaque
oc-sent-v1 sentinels through auth storage, stream options, and SDK
config; the guarded model fetch injects real values into headers and
URLs immediately before the SSRF-guarded send and fails closed on
unknown sentinels. packages/ai adapters converge on the host guarded
fetch where the SDK supports custom fetch and unwrap at construction
where it does not. Resolved values (and their percent-encoded forms)
register for exact-value log redaction. Kill switch:
OPENCLAW_SECRET_SENTINELS=off. Also fixes a pre-existing unhandled
rejection race in capNonOkResponseBodyLazily (pipeThrough writer leak).

* test(plugin-sdk): update public surface budget

2026-07-08 12:56:41 +01:00

..

apply.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

apply.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

audit.test.ts

improve: keep isolated tests under one second (#100019)

2026-07-05 10:57:19 -07:00

audit.ts

fix(secrets): skip PLAINTEXT_FOUND for known non-secret apiKey markers (#97622)

2026-06-28 19:49:05 -07:00

auth-profiles-scan.ts

refactor(deadcode): localize core helpers (#101869)

2026-07-07 13:16:57 -07:00

auth-store-paths.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

channel-contract-api.external.test.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

channel-contract-api.fast-path.test.ts

refactor(channels): remove bundled contract fallbacks

2026-06-10 13:05:24 +05:30

channel-contract-api.ts

refactor(channels): remove bundled contract fallbacks

2026-06-10 13:05:24 +05:30

channel-contract-surface-guardrails.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

channel-env-var-names.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

channel-env-vars.dynamic.test.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

channel-env-vars.ts

refactor(deadcode): localize core helpers (#101869)

2026-07-07 13:16:57 -07:00

channel-secret-basic-runtime.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

channel-secret-collector-runtime.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

channel-secret-tts-runtime.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

command-config.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

command-config.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

config-io.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

configure-plan.test.ts

improve: keep isolated tests under one second (#100019)

2026-07-05 10:57:19 -07:00

configure-plan.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

configure.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

configure.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

credential-matrix.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

exec-resolution-policy.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

exec-secret-ref-id-parity.test.ts

fix(secrets): enforce canonical secret refs

2026-06-20 06:41:33 +02:00

json-pointer.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

json-pointer.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

legacy-secretref-env-marker.ts

refactor(deadcode): localize core helpers (#101869)

2026-07-07 13:16:57 -07:00

model-provider-header-policy.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

path-utils.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

path-utils.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

plan.test.ts

test: speed up and stabilize full suite

2026-07-05 08:00:23 -04:00

plan.ts

fix(secrets): validate refs consistently at runtime

2026-06-19 17:22:14 +02:00

provider-env-vars.dynamic.test.ts

feat: add Anthropic and OpenAI cost history (#100672)

2026-07-06 12:06:55 +01:00

provider-env-vars.test.ts

feat: add Anthropic and OpenAI cost history (#100672)

2026-07-06 12:06:55 +01:00

provider-env-vars.ts

refactor(deadcode): localize core helpers (#101869)

2026-07-07 13:16:57 -07:00

provider-integrations.test.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

provider-integrations.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

ref-contract.test.ts

fix(secrets): enforce canonical secret refs

2026-06-20 06:41:33 +02:00

ref-contract.ts

fix(secrets): enforce canonical secret refs

2026-06-20 06:41:33 +02:00

resolve-secret-input-string.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

resolve-types.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

resolve.manifest-registry.test.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

resolve.test.ts

fix(secrets): suppress unhandled stdout/stderr stream errors in exec resolver (#100521)

2026-07-06 00:52:22 -07:00

resolve.ts

refactor: localize internal implementation symbols (#101831)

2026-07-07 10:23:36 -07:00

runtime-auth-collectors.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-auth-profiles-oauth-policy.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-auth-refresh-failure.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-auth-store-inline-refs.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-auth.integration.test-helpers.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

runtime-channel-inactive-variants.test-support.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-channel-inactive-variants.test.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

runtime-command-secrets.test.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

runtime-command-secrets.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-config-collectors-channels.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-config-collectors-channels.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

runtime-config-collectors-core.ts

fix(talk): resolve realtime provider secret refs (#90914)

2026-06-06 15:47:13 +03:00

runtime-config-collectors-plugins.bundled.test.ts

feat(codex): support app-server secret refs (#94324)

2026-06-18 20:10:11 -07:00

runtime-config-collectors-plugins.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-config-collectors-plugins.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-config-collectors-tts.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-config-collectors.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-core-snapshots.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-discord-surface.test.ts

fix(discord): keep default account online when adding named accounts (#96401)

2026-07-06 16:51:04 +01:00

runtime-discord.test-support.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

runtime-external-channel-audit.test.ts

fix(feishu): keep top-level appSecret SecretRef active for the implicit default account (#96965)

2026-06-28 18:40:41 -07:00

runtime-external-channel-origin-discovery.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-fast-path.ts

refactor(deadcode): localize core helpers (#101869)

2026-07-07 13:16:57 -07:00

runtime-gateway-auth-surfaces.test.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

runtime-gateway-auth-surfaces.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-gateway-local-surfaces.test.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

runtime-inactive-core-surfaces.test.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

runtime-inactive-telegram-surfaces.test.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

runtime-legacy-x-search.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-manifest.runtime.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

runtime-matrix-shadowing.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-matrix-top-level.test.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

runtime-matrix.test-support.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-nextcloud-talk-file-precedence.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-nextcloud-talk.test-support.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

runtime-openai-file-fixture.test-helper.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

runtime-prepare.runtime.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

runtime-provider-and-media-surfaces.test.ts

fix(talk): resolve realtime provider secret refs (#90914)

2026-06-06 15:47:13 +03:00

runtime-request-secret-refs.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-secret-scan.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-shared.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime-state.test.ts

test: preserve secrets state env snapshot

2026-06-05 16:37:09 +01:00

runtime-state.ts

refactor(deadcode): localize core helpers (#101869)

2026-07-07 13:16:57 -07:00

runtime-telegram-token-inheritance.test.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

runtime-telegram.test-support.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

runtime-web-tools-fallback.runtime.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-web-tools-manifest.runtime.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

runtime-web-tools-public-artifacts.runtime.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

runtime-web-tools-state.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-web-tools-state.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-web-tools.shared.ts

feat(firecrawl): add keyless scrape support (#94551)

2026-06-19 00:23:41 +08:00

runtime-web-tools.test.ts

test: speed up and stabilize full suite

2026-07-05 08:00:23 -04:00

runtime-web-tools.ts

feat(plugins): externalize official provider batch

2026-06-19 01:05:52 +08:00

runtime-web-tools.types.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

runtime-zalo-token-activity.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime-zalo.test-support.ts

docs: document secrets surface helpers

2026-06-04 05:20:16 -04:00

runtime.auth.integration.test.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

runtime.coverage.test.ts

improve: keep isolated tests under one second (#100019)

2026-07-05 10:57:19 -07:00

runtime.fast-path.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime.gateway-auth.integration.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

runtime.integration.test-helpers.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime.loadable-plugin-origins.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

runtime.test-support.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

runtime.test.ts

feat(secrets): egress-time credential injection with process-local sentinels (#102009)

2026-07-08 12:56:41 +01:00

runtime.ts

feat(secrets): egress-time credential injection with process-local sentinels (#102009)

2026-07-08 12:56:41 +01:00

secret-value.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

sentinel.test.ts

feat(secrets): egress-time credential injection with process-local sentinels (#102009)

2026-07-08 12:56:41 +01:00

sentinel.ts

feat(secrets): egress-time credential injection with process-local sentinels (#102009)

2026-07-08 12:56:41 +01:00

shared.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

storage-scan.ts

refactor(plugins): remove unused helper accessors

2026-06-17 21:13:03 +08:00

target-registry-data.current-snapshot.test.ts

docs: document secrets runtime state

2026-06-04 05:09:51 -04:00

target-registry-data.ts

feat(codex): support app-server secret refs (#94324)

2026-06-18 20:10:11 -07:00

target-registry-pattern.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

target-registry-pattern.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

target-registry-query.ts

improve: keep isolated tests under one second (#100019)

2026-07-05 10:57:19 -07:00

target-registry-test-helpers.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

target-registry-types.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

target-registry.docs.test.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00

target-registry.fast-path.test.ts

improve: keep isolated tests under one second (#100019)

2026-07-05 10:57:19 -07:00

target-registry.test.ts

test: speed up and stabilize full suite

2026-07-05 08:00:23 -04:00

target-registry.ts

docs: document auth profile failure policy contract (#89613)

2026-06-03 15:20:39 -07:00

unsupported-surface-policy.test.ts

docs: document secrets resolution helpers

2026-06-04 05:17:28 -04:00

unsupported-surface-policy.ts

docs: document secrets target registry

2026-06-04 05:13:24 -04:00