fix(secrets): skip PLAINTEXT_FOUND for known non-secret apiKey markers by xydigit-sj · Pull Request #97622 · openclaw/openclaw

xydigit-sj · 2026-06-29T02:07:59Z

What Problem This Solves

Fresh OpenClaw installs that enable the LM Studio provider ship with models.providers.lmstudio.apiKey: "lmstudio-local" as a placeholder. The local LM Studio server does not validate API keys, so this value is not a real secret, yet openclaw security audit (and openclaw secrets audit) emits a PLAINTEXT_FOUND warning for it. This trains users to ignore plaintext warnings, which can mask real credentials stored inline.

Closes #89233.

Why This Change Was Made

The same isNonSecretApiKeyMarker() helper already skips these known local-provider markers when auditing models.json provider apiKeys (see src/secrets/audit.ts:381). However, the openclaw.json config audit path in collectConfigSecrets() only skipped non-sensitive request headers; it did not apply the marker check to models.providers.*.apiKey.

This change reuses the existing marker helper so that lmstudio-local, ollama-local, and other known non-secret apiKey markers are treated consistently across both models.json and openclaw.json audit paths.

User Impact

Operators with keyless LM Studio / Ollama providers no longer see a false-positive plaintext warning for the bundled placeholder apiKey.
Real inline secrets (e.g., sk-...) continue to be flagged exactly as before.
No config migration or user action is required.

Evidence

Local validation run against this branch:

pnpm exec oxfmt src/secrets/audit.ts src/secrets/audit.test.ts
pnpm tsgo:core
pnpm exec vitest run src/secrets/audit.test.ts src/security/audit-config-basics.test.ts src/security/audit-model-hygiene.test.ts

Results:

Test Files  3 passed (3)
     Tests  32 passed (32)

The new regression test (src/secrets/audit.test.ts) asserts that:

models.providers.lmstudio.apiKey = "lmstudio-local" is not flagged.
models.providers.ollama.apiKey = "ollama-local" is not flagged.
models.providers.openai.apiKey = "sk-real-plaintext" is still flagged.

Files changed: src/secrets/audit.ts, src/secrets/audit.test.ts.

Exclude models.providers.*.apiKey values that match isNonSecretApiKeyMarker (e.g., lmstudio-local, ollama-local) from secrets audit plaintext warnings. Regression test covers marker bypass and real-key flagging. Closes openclaw#89233

clawsweeper · 2026-06-29T02:09:15Z

ClawSweeper review: did not complete due to Codex infrastructure failure. Reviewed June 28, 2026, 10:38 PM ET / 02:38 UTC.

Summary
Review failed before ClawSweeper could summarize the requested change.

PR surface: Source +7, Tests +61. Total +68 across 2 files.

Reproducibility: unclear. The review failed before ClawSweeper could establish a reproduction path.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: serialized state: src/secrets/audit.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Not assessed.
Failure reason: timeout.

This is a ClawSweeper/Codex infrastructure failure, not a PR readiness or patch-quality verdict.
Keep any merge decision on the normal maintainer review path until ClawSweeper can complete a fresh review.

Risk before merge

[P1] No close action taken because the review did not complete.

Maintainer options:

Decide the mitigation before merge
Retry the Codex review after fixing the execution failure.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

Review did not complete, so no work-lane recommendation was made.

Review details

Best possible solution:

Retry the Codex review after fixing the execution failure.

Do we have a high-confidence way to reproduce the issue?

Unclear. The review failed before ClawSweeper could establish a reproduction path.

Is this the best way to solve the issue?

Unclear. Retry the review first so ClawSweeper can evaluate the actual issue and fix direction.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against 15fc8812815e.

Label changes

Label changes:

remove P2: Current review triage priority is none.
remove rating: 🦐 gold shrimp: Current review failed before PR readiness was assessed, so no rating label should remain.
remove status: 📣 needs proof: Current PR status no longer selects a status label.

Evidence reviewed

PR surface:

Source +7, Tests +61. Total +68 across 2 files.

View PR surface stats

Area	Files	Added	Net
Source	1	7	+7
Tests	1	61	+61
Docs	0	0	0
Config	0	0	0
Generated	0	0	0
Other	0	0	0
Total	2	68	+68

What I checked:

failure reason: timeout.
codex failure detail: Codex review failed for this PR: Codex process timed out after 1199999ms.
codex stderr: No stderr captured.
codex stdout: view the surrounding code path, not just changed lines. Open the caller, callee, data contracts, adjacent tests, and owner module.\n- Before any verdict, read enough code to fill this map: changed surface, runtime entry point, owner boundary, one caller, one callee, sibling implementations sharing the invariant, adjacent tests, current main behavior, and shipped/dependency/Codex contracts when relevant.\n- For large-codebase PRs, sample enough related files to understand the runtime boundary before deciding. Default to more code reading when the change touches agents, gateway, plugins, auth, sessions, process, config, or provider/runtime seams.\n- Compare the PR against current origin/main behavior. Check whether recent main already changed the same surface.\n- Dependency-backed behavior: MUST read upstream docs/source/types before judging API use, defaults, output shapes, errors, timeouts, memory behavior, or compatibilit.
process error code: ETIMEDOUT.

Likely related people:

unknown: Codex failed before it could trace repository history. (role: review did not complete; confidence: low)

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

xydigit-sj · 2026-06-29T02:31:16Z

@clawsweeper re-review

I've added real CLI behavior proof to the PR body. The isolated `openclaw secrets audit --json` run now shows only `models.providers.openai.apiKey` flagged as plaintext, while `models.providers.lmstudio.apiKey = "lmstudio-local"` is no longer reported.

clawsweeper · 2026-06-29T02:31:19Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

openclaw#97622) Exclude models.providers.*.apiKey values that match isNonSecretApiKeyMarker (e.g., lmstudio-local, ollama-local) from secrets audit plaintext warnings. Regression test covers marker bypass and real-key flagging. Closes openclaw#89233

openclaw#97622) Exclude models.providers.*.apiKey values that match isNonSecretApiKeyMarker (e.g., lmstudio-local, ollama-local) from secrets audit plaintext warnings. Regression test covers marker bypass and real-key flagging. Closes openclaw#89233 (cherry picked from commit 00c9ac5)

openclaw#97622) Exclude models.providers.*.apiKey values that match isNonSecretApiKeyMarker (e.g., lmstudio-local, ollama-local) from secrets audit plaintext warnings. Regression test covers marker bypass and real-key flagging. Closes openclaw#89233

xydigit-sj requested a review from a team as a code owner June 29, 2026 02:08

openclaw-barnacle Bot added the size: S label Jun 29, 2026

clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. labels Jun 29, 2026

clawsweeper Bot removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 29, 2026

vincentkoc merged commit 00c9ac5 into openclaw:main Jun 29, 2026
127 of 135 checks passed

clawsweeper Bot mentioned this pull request Jun 29, 2026

fix(discord): bound gateway metadata response reads at 16 MiB #97721

Closed

github-actions Bot mentioned this pull request Jun 29, 2026

📡 Upstream Digest — 2026-06-29 08:51 UTC curtismercier/openclaw-mods#1172

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(secrets): skip PLAINTEXT_FOUND for known non-secret apiKey markers#97622

fix(secrets): skip PLAINTEXT_FOUND for known non-secret apiKey markers#97622
vincentkoc merged 1 commit into
openclaw:mainfrom
xydigit-sj:fix/lmstudio-config-audit-marker-89233

xydigit-sj commented Jun 29, 2026

Uh oh!

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

xydigit-sj commented Jun 29, 2026

Uh oh!

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

xydigit-sj commented Jun 29, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

xydigit-sj commented Jun 29, 2026

Uh oh!

clawsweeper Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading