chore(gateway): drop dead secrets.resolve method + reconcile stale talk.speak/secrets docs (#2724)#2728
Merged
Conversation
…lk.speak/secrets docs (#2724) secrets.resolve was advertised in BASE_METHODS + classified in method-scopes (ADMIN_SCOPE) but has no handler (server-methods/secrets.ts was gutted) and zero production callers (grep: only the two registry/scope sites). #2720 removed the sibling secrets.reload but deliberately KEPT secrets.resolve, deferring the call to a dedicated evaluation — this resolves that #2724 item: REMOVE. Advertising a handler-less method is strictly worse than honest non-advertisement: the requiredMethods pre-check (call.ts) would pass, then dispatch hard-errors "unknown method". SecretRef resolution in the fork is local (src/secrets/resolve.ts, gateway/resolve-configured-secret-input-string.ts), wholly independent of the RPC. Mirrors the talk.speak cleanup (#2727). Docs reconciled to the fork's actual behavior: - docs/nodes/talk.md + docs/gateway/protocol.md: Talk-mode playback is synthesized on-device by the native apps (ElevenLabs direct, with the platform's system TTS as fallback), not via the gutted talk.speak gateway RPC; the gateway is config/state only (talk.config, talk.mode). - docs/gateway/protocol.md: dropped the gutted secrets.reload + secrets.resolve bullets from the method-families reference and retitled the subsection. Validation: gateway method-scopes + call suites 80/80 (the method-list <-> scope-map consistency invariant holds); tsgo + format:check clean; no rebrand-gate trip. Deeper reconciliation tracked as follow-ups on #2724 (need subsystem-accurate rewrites, not mechanical edits): (A) secrets.md/qr.md command-path SecretRef- resolution docs still name secrets.resolve as the gateway snapshot RPC, but the fork resolves locally; (B) protocol.md method-families list still documents other #2720-gutted methods (models.list, skills.search/detail/bins, plugin.approval.*). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
alexey-pelykh
enabled auto-merge (squash)
June 17, 2026 19:25
Closed
19 tasks
alexey-pelykh
added a commit
that referenced
this pull request
Jun 18, 2026
) (#2740) The fork resolves SecretRefs locally and the gateway secrets.resolve snapshot RPC was dropped in #2728; protocol.md still advertised methods #2720 removed from BASE_METHODS. Reconcile the docs to the fork's actual surface (verified each line against the live code, not a mechanical edit). secrets.md + qr.md (local SecretRef resolution): - Command paths resolve SecretRefs locally and in-process (env/file/exec via src/secrets/resolve.ts + gateway/resolve-configured-secret-input-string.ts), not via a gateway `secrets.resolve` snapshot RPC (removed in #2728). `qr` resolves all refs locally (qr-cli.ts + setup-code.ts) with no gateway client. - Drop the obsolete qr `secrets.resolve` gateway-version-skew note. protocol.md (method families — verified vs BASE_METHODS/GATEWAY_EVENTS/handlers): - Remove methods #2720 dropped from BASE_METHODS: models.list, skills.search/detail/bins, the plugin.approval.* methods, and commands.list. - Remove orphaned sessions.usage* (only a method-scopes classification, no handler) and exec.approval.get/list (no BASE_METHODS entry, no handler). - KEEP the plugin.approval.requested/resolved EVENTS (in GATEWAY_EVENTS) — the methods were removed, the events survive. Verified the docs build (astro/starlight, 319 pages) and rebrand-gate pass. Part of #2724. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves two cleanup items tracked on #2724, both gateway method-surface hygiene:
Remove the dead
secrets.resolvegateway method. It was advertised inBASE_METHODS(server-methods-list.ts) and classified inmethod-scopes.ts(ADMIN_SCOPE), but has no handler (server-methods/secrets.tswas gutted) and zero production callers (grep finds only the two registry/scope sites). Gateway behavioral test suite is gated out of CI — recently-merged fixes have no behavioral coverage #2720 removed the siblingsecrets.reloadbut deliberately keptsecrets.resolve, deferring the decision to a dedicated evaluation — this is that evaluation, and the answer is remove.Advertising a handler-less method is strictly worse than honest non-advertisement: the
requiredMethodspre-check (call.ts) would pass, then dispatch hard-errorsunknown method. The fork's SecretRef resolution is local (src/secrets/resolve.ts,gateway/resolve-configured-secret-input-string.ts), wholly independent of this RPC. Mirrors thetalk.speakcleanup (chore(gateway): remove talk.speak orphan method declarations (#2724) #2727).Reconcile stale
talk.speakdocs to the fork's real Talk-mode playback story.docs/nodes/talk.mdanddocs/gateway/protocol.mddescribed the gateway resolving Talk playback through atalk.speakRPC — but that RPC was gutted (chore(gateway): remove talk.speak orphan method declarations (#2724) #2727), and the native apps (macOS / iOS / Android) all synthesize on-device: each calls the ElevenLabs API directly using the active Talk config, falling back to the platform's system TTS (AVSpeechSynthesizer / AndroidTextToSpeech) when no ElevenLabs key is configured. The gateway is config/state only (talk.config,talk.mode), never synthesis. Also dropped the guttedsecrets.reload+secrets.resolvebullets from protocol.md's method-families reference.Changes
src/gateway/server-methods-list.tssecrets.resolvefromBASE_METHODSsrc/gateway/method-scopes.tssecrets.resolvefromADMIN_SCOPEdocs/nodes/talk.mdtalk.speakrefs → on-device synthesis (ElevenLabs direct, system-TTS fallback)docs/gateway/protocol.mdtalk.speakbullet (→ client-side note); drop the guttedsecrets.reload/secrets.resolvebullets; retitle the subsectionValidation
method-scopes+call: 80/80 pass — the method-list ↔ scope-map consistency invariant holds withsecrets.resolveremoved.pnpm check(format + tsgo + lint + custom lints) clean (pre-commit hook).openclawrefs added).src/commands/message.test.tshas 3 pre-existing local failures unrelated to this change — identical on cleanmain, and the test only referencessecrets.resolveas fixture strings (never imports the method list). Thetestlane is green onmainin CI.Follow-ups (tracked on #2724)
These need subsystem-accurate rewrites, not mechanical edits, so they're deferred:
docs/gateway/secrets.md(Command-path resolution) +docs/cli/qr.mdstill namesecrets.resolveas the gateway snapshot RPC, but the fork resolves SecretRefs locally — needs an accurate rewrite of the command-path-resolution story.docs/gateway/protocol.md's "Common RPC method families" still documents other methods Gateway behavioral test suite is gated out of CI — recently-merged fixes have no behavioral coverage #2720 removed fromBASE_METHODS(models.list,skills.search/detail/bins,plugin.approval.*methods) — a full method-list reconciliation pass with per-method handler verification.🤖 Generated with Claude Code