fix(status): resolve gateway auth secrets for deep audit

ai-hpc · web-flow · commit 37169697d767 · 2026-05-31T21:02:11.000-04:00
Resolve gateway auth SecretRef targets in status deep audit. The static secret target coverage now includes gateway auth and remote token/password keys for both status and security audit scans. Focused status/secret-target tests passed, Auto Review reported no actionable findings, and CI is running on rebased head 41b052a. Fixes #87815
diff --git a/src/cli/command-secret-targets.import.test.ts b/src/cli/command-secret-targets.import.test.ts
@@ -165,6 +165,10 @@ describe("command secret targets module import", () => {
     expect(targets.has("channels.discord.token")).toBe(false);
     expect(targets.has("channels.telegram.gatewayToken")).toBe(false);
     expect(targets.has("channels.telegram.gatewayTokenRef")).toBe(false);
+    expect(targets.has("gateway.auth.token")).toBe(true);
+    expect(targets.has("gateway.auth.password")).toBe(true);
+    expect(targets.has("gateway.remote.token")).toBe(true);
+    expect(targets.has("gateway.remote.password")).toBe(true);
     expect(targets.has("agents.defaults.memorySearch.remote.apiKey")).toBe(true);
     const pluginCall = listReadOnlyChannelPluginsForConfig.mock.calls[0] as unknown as
       | [unknown, { includePersistedAuthState?: boolean }]
@@ -202,6 +206,10 @@ describe("command secret targets module import", () => {
     );
 
     expect(targets.has("agents.defaults.memorySearch.remote.apiKey")).toBe(true);
+    expect(targets.has("gateway.auth.token")).toBe(true);
+    expect(targets.has("gateway.auth.password")).toBe(true);
+    expect(targets.has("gateway.remote.token")).toBe(true);
+    expect(targets.has("gateway.remote.password")).toBe(true);
     expect(targets.has("channels.telegram.botToken")).toBe(false);
     expect(listReadOnlyChannelPluginsForConfig).not.toHaveBeenCalled();
     expect(listSecretTargetRegistryEntries).not.toHaveBeenCalled();
diff --git a/src/cli/command-secret-targets.test.ts b/src/cli/command-secret-targets.test.ts
@@ -249,6 +249,7 @@ import {
   getQrRemoteCommandSecretTargetIds,
   getScopedChannelsCommandSecretTargets,
   getSecurityAuditCommandSecretTargetIds,
+  getStatusCommandSecretTargetIds,
 } from "./command-secret-targets.js";
 
 describe("command secret target ids", () => {
@@ -273,6 +274,20 @@ describe("command secret target ids", () => {
     expect(ids.has("channels.discord.token")).toBe(false);
   });
 
+  it("includes gateway auth targets for status command scans", () => {
+    const ids = getStatusCommandSecretTargetIds(undefined, undefined, {
+      includeChannelTargets: false,
+    });
+
+    expect(ids.has("gateway.auth.token")).toBe(true);
+    expect(ids.has("gateway.auth.password")).toBe(true);
+    expect(ids.has("gateway.remote.token")).toBe(true);
+    expect(ids.has("gateway.remote.password")).toBe(true);
+    expect(ids.has("agents.defaults.memorySearch.remote.apiKey")).toBe(true);
+    expect(ids.has("agents.list[].memorySearch.remote.apiKey")).toBe(true);
+    expect(ids.has("channels.discord.token")).toBe(false);
+  });
+
   it("scopes capability web search commands to search credential surfaces only", () => {
     const ids = getCapabilityWebSearchCommandSecretTargetIds();
     expect(ids.has("tools.web.search.apiKey")).toBe(true);
diff --git a/src/cli/command-secret-targets.ts b/src/cli/command-secret-targets.ts
@@ -54,16 +54,18 @@ const STATIC_TTS_TARGET_IDS = [
   "agents.list[].tts.providers.*.apiKey",
   "messages.tts.providers.*.apiKey",
 ] as const;
-const STATIC_STATUS_TARGET_IDS = [
-  "agents.defaults.memorySearch.remote.apiKey",
-  "agents.list[].memorySearch.remote.apiKey",
-] as const;
-const STATIC_SECURITY_AUDIT_TARGET_IDS = [
+const STATIC_GATEWAY_AUTH_TARGET_IDS = [
   "gateway.auth.token",
   "gateway.auth.password",
   "gateway.remote.token",
   "gateway.remote.password",
 ] as const;
+const STATIC_STATUS_TARGET_IDS = [
+  ...STATIC_GATEWAY_AUTH_TARGET_IDS,
+  "agents.defaults.memorySearch.remote.apiKey",
+  "agents.list[].memorySearch.remote.apiKey",
+] as const;
+const STATIC_SECURITY_AUDIT_TARGET_IDS = [...STATIC_GATEWAY_AUTH_TARGET_IDS] as const;
 
 function idsByPrefix(prefixes: readonly string[]): string[] {
   return listSecretTargetRegistryEntries()
