fix(secrets): avoid exec target gateway failures

wuqxuan · wuqxuan · commit 15d448772b01 · 2026-06-26T11:07:32.000+08:00
diff --git a/src/secrets/runtime-command-secrets.test.ts b/src/secrets/runtime-command-secrets.test.ts
@@ -60,11 +60,12 @@ discoverConfigSecretTargetsByIds(forcedFallbackConfig, new Set([firecrawlPath]))
 
 function activateMinimalSecretsRuntimeSnapshot(params: {
   config: OpenClawConfig;
+  resolvedConfig?: OpenClawConfig;
   env: Record<string, string | undefined>;
 }) {
   const snapshot = {
     sourceConfig: structuredClone(params.config),
-    config: structuredClone(params.config),
+    config: structuredClone(params.resolvedConfig ?? params.config),
     authStores: [],
     warnings: [],
     webTools: createEmptyRuntimeWebToolsMetadata(),
@@ -157,4 +158,58 @@ describe("runtime command secrets", () => {
     expect(resolved.diagnostics).toEqual([]);
     expect(resolved.inactiveRefPaths).toEqual([]);
   });
+
+  it("returns resolved snapshot assignments when exec targets remain unresolved", async () => {
+    const sourceConfig = {
+      models: {
+        providers: {
+          google: {
+            enabled: true,
+            apiKey: { source: "exec", provider: "default", id: "models/google/api-key" },
+          },
+          openai: {
+            enabled: true,
+            apiKey: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
+          },
+        },
+      },
+      secrets: {
+        providers: {
+          default: { source: "env" },
+        },
+      },
+    } as unknown as OpenClawConfig;
+    activateMinimalSecretsRuntimeSnapshot({
+      config: sourceConfig,
+      resolvedConfig: {
+        ...sourceConfig,
+        models: {
+          providers: {
+            ...sourceConfig.models?.providers,
+            openai: {
+              ...sourceConfig.models?.providers?.openai,
+              apiKey: "gateway-openai-key",
+            },
+          },
+        },
+      } as OpenClawConfig,
+      env: {
+        HOME: process.env.HOME,
+      },
+    });
+
+    const resolved = await resolveCommandSecretsFromActiveRuntimeSnapshot({
+      commandName: "reply",
+      targetIds: new Set(["models.providers.*.apiKey"]),
+    });
+
+    expect(resolved.assignments).toMatchObject([
+      {
+        path: "models.providers.openai.apiKey",
+        value: "gateway-openai-key",
+      },
+    ]);
+    expect(resolved.diagnostics).toEqual([]);
+    expect(resolved.inactiveRefPaths).toEqual([]);
+  });
 });
diff --git a/src/secrets/runtime-command-secrets.ts b/src/secrets/runtime-command-secrets.ts
@@ -344,6 +344,33 @@ function mirrorResolvedProviderCredentialToDirectPaths(params: {
   }
 }
 
+function collectUnresolvedExecSecretRefPaths(params: {
+  sourceConfig: OpenClawConfig;
+  targetIds: ReadonlySet<string>;
+  unresolvedPaths: ReadonlySet<string>;
+  allowedPaths?: ReadonlySet<string>;
+}): Set<string> {
+  const defaults = params.sourceConfig.secrets?.defaults;
+  const execPaths = new Set<string>();
+  for (const target of discoverConfigSecretTargetsByIds(params.sourceConfig, params.targetIds)) {
+    if (params.allowedPaths && !params.allowedPaths.has(target.path)) {
+      continue;
+    }
+    if (!params.unresolvedPaths.has(target.path)) {
+      continue;
+    }
+    const { ref } = resolveSecretInputRef({
+      value: target.value,
+      refValue: target.refValue,
+      defaults,
+    });
+    if (ref?.source === "exec") {
+      execPaths.add(target.path);
+    }
+  }
+  return execPaths;
+}
+
 async function resolveForcedActiveCommandSecretTargets(params: {
   sourceConfig: OpenClawConfig;
   resolvedConfig: OpenClawConfig;
@@ -575,6 +602,28 @@ async function resolveCommandSecretsFromSnapshot(params: {
       inactiveRefPaths,
     };
   }
+  const unresolvedPaths = new Set(analyzed.unresolved.map((entry) => entry.path));
+  const unresolvedExecPaths = collectUnresolvedExecSecretRefPaths({
+    sourceConfig,
+    targetIds: params.targetIds,
+    unresolvedPaths,
+    allowedPaths: params.allowedPaths,
+  });
+  if (unresolvedExecPaths.size > 0) {
+    const nonExecUnresolved = analyzed.unresolved.filter(
+      (entry) => !unresolvedExecPaths.has(entry.path),
+    );
+    if (nonExecUnresolved.length > 0) {
+      throw new Error(
+        `${params.commandName}: ${nonExecUnresolved[0]?.path ?? "target"} is unresolved in the active runtime snapshot.`,
+      );
+    }
+    return {
+      assignments: analyzed.assignments,
+      diagnostics: analyzed.diagnostics,
+      inactiveRefPaths,
+    };
+  }
   const resolved = collectCommandSecretAssignmentsFromSnapshot({
     sourceConfig,
     resolvedConfig,
