Summary

A few config paths are currently not working with SecretRef in the current build.

Affected config keys

• messages.tts.providers.minimax.apiKey
• hooks.token
• channels.matrix.accessToken
• plugins.entries.brave.config.webSearch.apiKey
• plugins.entries.voice-call.config.twilio.authToken
• plugins.entries.voice-call.config.tts.providers.openai.apiKey
• plugins.entries.voice-call.config.tts.providers.elevenlabs.apiKey

Current status by key

Currently not working in live testing

• messages.tts.providers.minimax.apiKey
  • SecretRef migration applies in config, but the TTS convert/runtime path does not currently resolve the exec: SecretRef correctly.
  • Observed effect: MiniMax TTS does not run and the system falls back to Microsoft TTS.

Currently not supported

• hooks.token

Currently not working in runtime flows

• channels.matrix.accessToken

  • Live SecretRef migration failed at runtime with:
    • TypeError: hasConfiguredSecretInput is not a function

• plugins.entries.brave.config.webSearch.apiKey

  • Live Brave-only search failed after migration with:
    • tools.web.search.apiKey: unresolved SecretRef "exec:brave_plugin_1password:value"

Currently not working due to missing plugin SecretRef support

• plugins.entries.voice-call.config.twilio.authToken
• plugins.entries.voice-call.config.tts.providers.openai.apiKey
• plugins.entries.voice-call.config.tts.providers.elevenlabs.apiKey

These voice-call paths exist in config, but are not currently working with SecretRef in the plugin’s present support surface.

Expected outcome

These paths should either:

1. work end-to-end with SecretRef, or
2. be clearly documented as unsupported until that support is added.

Notes

This issue includes full config keys only.
No credentials are included.

CC @joshavant