Problem

SecretRefs (docs: https://docs.openclaw.ai/gateway/secrets) keep provider credentials out of openclaw.json, but after eager resolution the plaintext value travels through the entire model-call chain:

• resolveApiKeyForProvider returns the resolved plaintext (src/agents/model-auth.ts)
• it lands in runtime auth storage (src/agents/embedded-agent-runner/run/auth-controller.ts)
• flows into stream options (src/agents/embedded-agent-runner/stream-resolution.ts, packages/agent-core/src/agent-loop.ts)
• and into SDK client construction (packages/ai/src/providers/*)

Any log line, error dump, capture file, or introspection surface along that chain can leak the real credential. Several packages/ai adapters (Anthropic, OpenAI responses) also construct SDK clients without the host guarded fetch, so the SDK builds auth headers from the raw key with no in-repo interception point.

The secrets docs currently punt the remaining risk to "OS isolation, container isolation, or an external credential proxy."

Proposal

Egress-time credential injection inside the runtime:

1. Mint an opaque per-process sentinel (oc-sent-v1-<hex>) for SecretRef-managed model credentials at auth resolution; everything downstream holds the sentinel.
2. Swap sentinels for real values in the guarded model fetch (headers + URL), immediately before the SSRF-guarded send; fail closed on unknown sentinel-shaped values.
3. Converge packages/ai adapters onto the host guarded fetch where the SDK supports custom fetch; unwrap at client construction (host port) where it does not.
4. Register every resolved secret value (and its percent-encoded form) in an exact-value redaction registry consumed by redactSensitiveText / redactSecrets.

Kill switch: OPENCLAW_SECRET_SENTINELS=off. Plugin SDK auth surface stays plaintext (shipped contract).

Out of scope (follow-ups): channel tokens, MCP env/headers, skills env, sandbox egress proxying for tool traffic.