SecretRef: harden custom/provider secret persistence and reuse by joshavant · Pull Request #42554 · openclaw/openclaw

joshavant · 2026-03-10T22:53:59Z

Summary

This PR hardens SecretRef handling for custom/provider model credentials so secrets are not persisted or reused unsafely across runtime, models.json generation, merge behavior, and audit scans.

It preserves the project goals of:

startup/reload capture semantics for SecretRef resolution,
fail-fast on unresolved active refs at startup,
reload fallback to last-known-good runtime snapshot,
no regressions for existing valid configurations.

Problem Surface Addressed

This directly addresses the cluster: custom/provider secrets are persisted or reused unsafely (plaintext or marker leakage).

Main risks covered:

marker values treated as usable credentials in some paths,
resolved runtime secrets re-projected into persisted config by non-identical config objects,
stale plaintext apiKeys preserved during merge when next config is marker/ref-managed,
SecretRef marker headers leaking into runtime model request headers,
incomplete audit coverage when active agent dir models.json lives outside default state paths.

What Changed

1) Usable custom-key semantics centralized and propagated

Added runtime helper APIs to separate configured marker vs usable secret behavior.
Replaced direct custom-key checks in auth/selection/status flows with usable-key checks.
Preserved visibility of configured marker values in status output while ensuring they are only treated as effective auth when actually resolvable.

2) Runtime-to-source snapshot projection for models.json writes

Added projection from runtime snapshot onto source snapshot for config inputs.
This prevents resolved runtime plaintext values from being persisted when callers pass cloned runtime config objects.

3) Merge/provenance hardening for provider apiKey preservation

Strengthened provenance tracking for marker-managed providers during normalization.
Updated merge preservation rules to avoid keeping stale plaintext existing.apiKey when the next entry is marker-managed.

4) Runtime marker firewall for headers

Stripped SecretRef marker headers (secretref-managed / secretref-env:*) in inline/provider/fallback model header resolution paths before runtime use.

5) Audit coverage hardening

Extended models.json scan discovery to include active OPENCLAW_AGENT_DIR / PI_CODING_AGENT_DIR override paths.
Ensures plaintext leakage in active agent models.json is caught even when it sits outside state-dir discovered paths.

Validation

Full suite: pnpm test passed (886 test files, 7241 passed, 2 skipped).
Build/type/lint gate: pnpm build and pnpm check passed.
Runtime guarantee spot-checks:
- startup fail-fast test passed: fails fast at startup when selected web search provider ref is unresolved
- reload fallback test passed: keeps last-known-good runtime snapshot active when refresh fails after a write
- web reload fallback test passed: keeps last-known-good web runtime snapshot when reload introduces unresolved active web refs

Linked Issues / PRs

Fixes #39823
Fixes #42355

Related prior work and superseded proposals:

aisle-research-bot · 2026-03-10T22:54:06Z

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

#	Severity	Title
1	🟠 High	models.json env-var marker allows exfiltration of host environment tokens to arbitrary provider baseUrl (confused deputy)

1. 🟠 models.json env-var marker allows exfiltration of host environment tokens to arbitrary provider baseUrl (confused deputy)

Property	Value
Severity	High
CWE	CWE-200
Location	`src/agents/model-auth.ts:72-99`

Description

The new resolveUsableCustomProviderApiKey logic treats certain models.json apiKey strings as environment-variable names and then loads the secret value from process.env.

If an attacker can influence models.json (e.g., via a checked-in/templated config, compromised agent directory, or other untrusted config source), they can:

Set a provider’s apiKey field to an allowlisted env var name (e.g., GITHUB_TOKEN, GH_TOKEN, HF_TOKEN, etc.)
Set baseUrl to an attacker-controlled endpoint
Cause OpenClaw to read the host env secret and use it as the provider API key, resulting in the token being sent to the attacker in outbound requests

The protection is only an allowlist (KNOWN_ENV_API_KEY_MARKERS) and it excludes AWS SDK markers, but it still includes broadly-scoped tokens such as GitHub tokens (GITHUB_TOKEN, GH_TOKEN) and other non-provider-specific secrets, which are high-value in CI/dev environments.

Vulnerable code:

if (!isKnownEnvApiKeyMarker(customKey)) {
  return null;
}
const envValue = normalizeOptionalSecretInput((params.env ?? process.env)[customKey]);
...
return { apiKey: envValue, ... };

Recommendation

Do not allow models.json to implicitly select sensitive env vars by bare name.

Mitigations (pick one or combine):

Require an explicit, namespaced syntax to opt into env resolution (and disallow bare env var names):

// models.json
// apiKey: "env:OPENAI_API_KEY"

function parseEnvMarker(value: string): string | null {
  const trimmed = value.trim();
  if (!trimmed.startsWith("env:")) return null;
  return trimmed.slice("env:".length).trim();
}

Restrict which env vars can be used for a given provider (provider-scoped allowlist), and never allow “generic” tokens (e.g., GITHUB_TOKEN) to be repurposed for unrelated/custom base URLs.
If custom providers are supported, require a separate opt-in flag (e.g., allowEnvApiKeyMarkers: true) or require the env var name to be under an OPENCLAW_... namespace.

These changes prevent a config-only attacker from turning an existing environment secret into an outbound credential for an attacker-controlled endpoint.

Analyzed PR: #42554 at commit d6520b2

_{Last updated on: 2026-03-11T00:20:25Z}

greptile-apps · 2026-03-10T22:59:01Z

Greptile Summary

This PR hardens SecretRef handling across custom/provider model credentials by centralising "usable credential" vs. "configured marker" semantics, projecting runtime configs onto the source snapshot before writes, preventing stale plaintext preservation during merges, stripping SecretRef marker headers before runtime use, and extending audit scan coverage to env-var-overridden agent directories. The changes are well-structured and backed by comprehensive test coverage.

Key changes and observations:

New resolveUsableCustomProviderApiKey / hasUsableCustomProviderApiKey APIs cleanly gate whether a custom provider key is actually actionable (literal key, or known env-var marker with the env var currently set), replacing ad-hoc getCustomProviderApiKey + isNonSecretApiKeyMarker patterns across auth, picker, probe, and status flows.
projectConfigOntoRuntimeSourceSnapshot in io.ts applies a JSON Merge Patch delta (runtimeConfigSnapshot → config) onto runtimeConfigSourceSnapshot. This is correct for cloned/modified runtime configs but broadens the previous config === runtimeResolved identity guard in resolveModelsConfigInput; structurally-divergent configs passed during a live runtime session could silently re-introduce resolved secrets or null-out source-snapshot fields via the patch mechanism.
Merge hardening in shouldPreserveExistingApiKey correctly blocks stale plaintext preservation when the incoming entry carries a marker value, with appropriate asymmetry between existing and next checks.
SecretRef marker header firewall adds stripSecretRefMarkers: true to all sanitizeModelHeaders calls in inline/provider/fallback model paths.
Audit scan now resolves OPENCLAW_AGENT_DIR / PI_CODING_AGENT_DIR overrides so externally-located agent models.json files are always scanned.

Confidence Score: 4/5

Safe to merge with minor caveats — no critical runtime failures expected, though a subtle edge case exists with the broadened projection scope in resolveModelsConfigInput.
The PR is well-tested (886 test files, 7241 passing) and addresses genuine security risks with correct logic. The one substantive concern is that resolveModelsConfigInput now runs projectConfigOntoRuntimeSourceSnapshot for any config when a runtime source snapshot is active, replacing the previous strict identity guard. For structurally-divergent configs this could produce unexpected output (re-projected secrets or deleted fields), but in practice all realistic callers pass runtime-derived configs, and the test suite covers the intended scenarios.
Pay close attention to src/config/io.ts (projectConfigOntoRuntimeSourceSnapshot) and src/agents/models-config.ts (resolveModelsConfigInput) for the broadened projection scope.

_{Last reviewed commit: bb04ed0}

src/config/io.ts

src/infra/provider-usage.auth.ts

joshavant · 2026-03-10T23:32:17Z

Addressed from the Aisle feedback:

Fixed item 2 (audit read hardening): readJsonObjectIfExists now supports optional file guards, and secrets audit applies them for models.json scans (requireRegularFile + 5 MiB max). This preserves the existing scan surface (including OPENCLAW_AGENT_DIR overrides) while preventing non-regular/oversized-file hangs in that path.
Added regression tests for both non-regular models.json and oversized models.json handling.

For item 1 (custom-provider env marker exfil path): I did not change marker resolution behavior in this PR. That path currently relies on trusted-operator config semantics and existing compatibility (custom endpoints/proxies that intentionally use env markers). Tightening it here would break existing valid configs and is broader than this regression-hardening scope.

@joshavant

…anks @joshavant)

joshavant · 2026-03-10T23:47:09Z

Landed via temp rebase onto main.

Gate: pnpm lint && pnpm build && pnpm test
Land commit: d6520b2
Merge commit: fbc6632

Thanks @joshavant!

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d6520b20c5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-10T23:54:55Z

src/secrets/storage-scan.ts

+    const stats = fs.statSync(filePath);
+    if (options.requireRegularFile && !stats.isFile()) {


Use lstat for requireRegularFile checks

When requireRegularFile is enabled, this guard uses fs.statSync, which follows symlinks. A symlinked models.json can therefore satisfy stats.isFile() and still be read, even though the caller explicitly asked to reject non-regular files. In writable state/agent directories this bypasses the hardening added in this commit and can make the audit scan arbitrary link targets; use lstatSync (or an O_NOFOLLOW open) for this check.

Useful? React with 👍 / 👎.

@joshavant

* Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

- Diamond-merge variant of PR openclaw#42554 (fbc6632 = 36d2ae2 variant) - SecretRef custom/provider secret persistence hardening: resolveUsableCustomProviderApiKey(), shouldPreserveExistingApiKey(), readJsonObjectIfExists() size/type guards (5MB cap + requireRegularFile), projectConfigOntoRuntimeSourceSnapshot() shape guard, sanitizeModelHeaders() marker stripping, active agent dir scanning - Audit 1 Claims 1+5 partial + 3 new defense-in-depth controls; 3 gaps unchanged

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant) (cherry picked from commit 36d2ae2)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant) (cherry picked from commit 36d2ae2)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant) (cherry picked from commit fbc6632)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant) (cherry picked from commit fbc6632)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant) (cherry picked from commit fbc6632) # Conflicts: # CHANGELOG.md # extensions/googlechat/src/onboarding.ts # extensions/nextcloud-talk/src/onboarding.ts # src/agents/model-auth-label.test.ts # src/agents/model-auth-label.ts # src/agents/model-auth-markers.test.ts # src/agents/model-auth-markers.ts # src/agents/model-auth.test.ts # src/agents/model-auth.ts # src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts # src/agents/models-config.merge.test.ts # src/agents/models-config.merge.ts # src/agents/models-config.providers.normalize-keys.test.ts # src/agents/models-config.providers.ts # src/agents/models-config.runtime-source-snapshot.test.ts # src/agents/models-config.ts # src/agents/pi-embedded-runner/model.test.ts # src/agents/pi-embedded-runner/model.ts # src/auto-reply/reply/directive-handling.auth.test.ts # src/auto-reply/reply/directive-handling.auth.ts # src/commands/auth-choice.model-check.ts # src/commands/model-picker.test.ts # src/commands/model-picker.ts # src/commands/models.list.e2e.test.ts # src/commands/models/list.auth-overview.test.ts # src/commands/models/list.auth-overview.ts # src/commands/models/list.probe.ts # src/commands/models/list.registry.ts # src/commands/models/list.status.test.ts # src/config/config.ts # src/config/io.runtime-snapshot-write.test.ts # src/config/io.ts # src/infra/provider-usage.auth.ts # src/secrets/audit.test.ts # src/secrets/audit.ts # src/secrets/storage-scan.ts

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant) (cherry picked from commit fbc6632) # Conflicts: # src/agents/model-auth-label.test.ts # src/agents/model-auth-label.ts # src/agents/model-auth-markers.test.ts # src/agents/model-auth-markers.ts # src/agents/model-auth.test.ts # src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts # src/agents/models-config.merge.test.ts # src/agents/models-config.merge.ts # src/agents/models-config.providers.normalize-keys.test.ts # src/agents/models-config.providers.ts # src/agents/models-config.runtime-source-snapshot.test.ts # src/agents/models-config.ts # src/agents/pi-embedded-runner/model.test.ts # src/agents/pi-embedded-runner/model.ts # src/auto-reply/reply/directive-handling.auth.test.ts # src/auto-reply/reply/directive-handling.auth.ts # src/commands/auth-choice.model-check.ts # src/commands/model-picker.ts # src/commands/models.list.e2e.test.ts # src/commands/models/list.auth-overview.test.ts # src/commands/models/list.auth-overview.ts # src/commands/models/list.probe.ts # src/commands/models/list.registry.ts # src/commands/models/list.status.test.ts # src/config/io.runtime-snapshot-write.test.ts # src/secrets/audit.test.ts # src/secrets/audit.ts # src/secrets/storage-scan.ts

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

@joshavant

…law#42554) * Models: gate custom provider keys by usable secret semantics * Config: project runtime writes onto source snapshot * Models: prevent stale apiKey preservation for marker-managed providers * Runner: strip SecretRef marker headers from resolved models * Secrets: scan active agent models.json path in audit * Config: guard runtime-source projection for unrelated configs * Extensions: fix onboarding type errors in CI * Tests: align setup helper account-enabled expectation * Secrets audit: harden models.json file reads * fix: harden SecretRef custom/provider secret persistence (openclaw#42554) (thanks @joshavant)

openclaw-barnacle bot added commands Command implementations agents Agent runtime and tooling size: L maintainer Maintainer-authored PR labels Mar 10, 2026

greptile-apps bot reviewed Mar 10, 2026

View reviewed changes

src/config/io.ts Show resolved Hide resolved

src/infra/provider-usage.auth.ts Show resolved Hide resolved

openclaw-barnacle bot added channel: bluebubbles Channel integration: bluebubbles channel: googlechat Channel integration: googlechat channel: nextcloud-talk Channel integration: nextcloud-talk channel: zalouser Channel integration: zalouser labels Mar 10, 2026

joshavant self-assigned this Mar 10, 2026

joshavant added 10 commits March 10, 2026 18:41

Models: gate custom provider keys by usable secret semantics

c8c7dce

Config: project runtime writes onto source snapshot

6521a9e

Models: prevent stale apiKey preservation for marker-managed providers

017dfb4

Runner: strip SecretRef marker headers from resolved models

d8d98f1

Secrets: scan active agent models.json path in audit

9398f34

Config: guard runtime-source projection for unrelated configs

80ead65

Extensions: fix onboarding type errors in CI

2654df4

Tests: align setup helper account-enabled expectation

fabd7dd

Secrets audit: harden models.json file reads

801d64b

fix: harden SecretRef custom/provider secret persistence (#42554) (th…

d6520b2

…anks @joshavant)

joshavant force-pushed the feature/secretref-regression-hardening branch from 703b91c to d6520b2 Compare March 10, 2026 23:46

joshavant merged commit fbc6632 into main Mar 10, 2026
9 checks passed

joshavant deleted the feature/secretref-regression-hardening branch March 10, 2026 23:46

joshavant mentioned this pull request Mar 10, 2026

fix: mark env-ref providers as SecretRef-managed to prevent plaintext persistence (#42355) #42426

Closed

chatgpt-codex-connector bot reviewed Mar 10, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 11, 2026

📡 Upstream Digest — 2026-03-11 01:16 UTC curtismercier/openclaw-mods#231

Open

Moshiii mentioned this pull request Mar 11, 2026

fix(ssrf): strip blocked addresses from pinned pool in dual-stack DNS responses #42230

Closed

5 tasks

alexey-pelykh mentioned this pull request Mar 22, 2026

Cherry-pick: SecretRef hardening chain (5 commits) remoteclaw/remoteclaw#1827

Closed

alexey-pelykh mentioned this pull request Mar 23, 2026

Cherry-pick batch: SecretRef hardening chain (5 commits) remoteclaw/remoteclaw#1850

Merged

alexey-pelykh mentioned this pull request Mar 23, 2026

Cherry-pick (blocked): BlueBubbles adapter (13 commits) remoteclaw/remoteclaw#1925

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

SecretRef: harden custom/provider secret persistence and reuse#42554

SecretRef: harden custom/provider secret persistence and reuse#42554
joshavant merged 10 commits intomainfrom
feature/secretref-regression-hardening

joshavant commented Mar 10, 2026

Uh oh!

aisle-research-bot bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 10, 2026

Uh oh!

Uh oh!

Uh oh!

joshavant commented Mar 10, 2026

Uh oh!

Uh oh!

joshavant commented Mar 10, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		const stats = fs.statSync(filePath);
		if (options.requireRegularFile && !stats.isFile()) {

Uh oh!

Conversation

joshavant commented Mar 10, 2026

Summary

Problem Surface Addressed

What Changed

1) Usable custom-key semantics centralized and propagated

2) Runtime-to-source snapshot projection for models.json writes

3) Merge/provenance hardening for provider apiKey preservation

4) Runtime marker firewall for headers

5) Audit coverage hardening

Validation

Linked Issues / PRs

Uh oh!

aisle-research-bot bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Aisle Security Analysis

1. 🟠 models.json env-var marker allows exfiltration of host environment tokens to arbitrary provider baseUrl (confused deputy)

Description

Recommendation

Uh oh!

greptile-apps bot commented Mar 10, 2026

Greptile Summary

Confidence Score: 4/5

Uh oh!

Uh oh!

Uh oh!

joshavant commented Mar 10, 2026

Uh oh!

Uh oh!

joshavant commented Mar 10, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

aisle-research-bot bot commented Mar 10, 2026 •

edited

Loading