Files
openclaw/src/config/defaults.ts
Josh Avant 806803b7ef feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)
* feat(secrets): expand secret target coverage and gateway tooling

* docs(secrets): align gateway and CLI secret docs

* chore(protocol): regenerate swift gateway models for secrets methods

* fix(config): restore talk apiKey fallback and stabilize runner test

* ci(windows): reduce test worker count for shard stability

* ci(windows): raise node heap for test shard stability

* test(feishu): make proxy env precedence assertion windows-safe

* fix(gateway): resolve auth password SecretInput refs for clients

* fix(gateway): resolve remote SecretInput credentials for clients

* fix(secrets): skip inactive refs in command snapshot assignments

* fix(secrets): scope gateway.remote refs to effective auth surfaces

* fix(secrets): ignore memory defaults when enabled agents disable search

* fix(secrets): honor Google Chat serviceAccountRef inheritance

* fix(secrets): address tsgo errors in command and gateway collectors

* fix(secrets): avoid auth-store load in providers-only configure

* fix(gateway): defer local password ref resolution by precedence

* fix(secrets): gate telegram webhook secret refs by webhook mode

* fix(secrets): gate slack signing secret refs to http mode

* fix(secrets): skip telegram botToken refs when tokenFile is set

* fix(secrets): gate discord pluralkit refs by enabled flag

* fix(secrets): gate discord voice tts refs by voice enabled

* test(secrets): make runtime fixture modes explicit

* fix(cli): resolve local qr password secret refs

* fix(cli): fail when gateway leaves command refs unresolved

* fix(gateway): fail when local password SecretRef is unresolved

* fix(gateway): fail when required remote SecretRefs are unresolved

* fix(gateway): resolve local password refs only when password can win

* fix(cli): skip local password SecretRef resolution on qr token override

* test(gateway): cast SecretRef fixtures to OpenClawConfig

* test(secrets): activate mode-gated targets in runtime coverage fixture

* fix(cron): support SecretInput webhook tokens safely

* fix(bluebubbles): support SecretInput passwords across config paths

* fix(msteams): make appPassword SecretInput-safe in onboarding/token paths

* fix(bluebubbles): align SecretInput schema helper typing

* fix(cli): clarify secrets.resolve version-skew errors

* refactor(secrets): return structured inactive paths from secrets.resolve

* refactor(gateway): type onboarding secret writes as SecretInput

* chore(protocol): regenerate swift models for secrets.resolve

* feat(secrets): expand extension credential secretref support

* fix(secrets): gate web-search refs by active provider

* fix(onboarding): detect SecretRef credentials in extension status

* fix(onboarding): allow keeping existing ref in secret prompt

* fix(onboarding): resolve gateway password SecretRefs for probe and tui

* fix(onboarding): honor secret-input-mode for local gateway auth

* fix(acp): resolve gateway SecretInput credentials

* fix(secrets): gate gateway.remote refs to remote surfaces

* test(secrets): cover pattern matching and inactive array refs

* docs(secrets): clarify secrets.resolve and remote active surfaces

* fix(bluebubbles): keep existing SecretRef during onboarding

* fix(tests): resolve CI type errors in new SecretRef coverage

* fix(extensions): replace raw fetch with SSRF-guarded fetch

* test(secrets): mark gateway remote targets active in runtime coverage

* test(infra): normalize home-prefix expectation across platforms

* fix(cli): only resolve local qr password refs in password mode

* test(cli): cover local qr token mode with unresolved password ref

* docs(cli): clarify local qr password ref resolution behavior

* refactor(extensions): reuse sdk SecretInput helpers

* fix(wizard): resolve onboarding env-template secrets before plaintext

* fix(cli): surface secrets.resolve diagnostics in memory and qr

* test(secrets): repair post-rebase runtime and fixtures

* fix(gateway): skip remote password ref resolution when token wins

* fix(secrets): treat tailscale remote gateway refs as active

* fix(gateway): allow remote password fallback when token ref is unresolved

* fix(gateway): ignore stale local password refs for none and trusted-proxy

* fix(gateway): skip remote secret ref resolution on local call paths

* test(cli): cover qr remote tailscale secret ref resolution

* fix(secrets): align gateway password active-surface with auth inference

* fix(cli): resolve inferred local gateway password refs in qr

* fix(gateway): prefer resolvable remote password over token ref pre-resolution

* test(gateway): cover none and trusted-proxy stale password refs

* docs(secrets): sync qr and gateway active-surface behavior

* fix: restore stability blockers from pre-release audit

* Secrets: fix collector/runtime precedence contradictions

* docs: align secrets and web credential docs

* fix(rebase): resolve integration regressions after main rebase

* fix(node-host): resolve gateway secret refs for auth

* fix(secrets): harden secretinput runtime readers

* gateway: skip inactive auth secretref resolution

* cli: avoid gateway preflight for inactive secret refs

* extensions: allow unresolved refs in onboarding status

* tests: fix qr-cli module mock hoist ordering

* Security: align audit checks with SecretInput resolution

* Gateway: resolve local-mode remote fallback secret refs

* Node host: avoid resolving inactive password secret refs

* Secrets runtime: mark Slack appToken inactive for HTTP mode

* secrets: keep inactive gateway remote refs non-blocking

* cli: include agent memory secret targets in runtime resolution

* docs(secrets): sync docs with active-surface and web search behavior

* fix(secrets): keep telegram top-level token refs active for blank account tokens

* fix(daemon): resolve gateway password secret refs for probe auth

* fix(secrets): skip IRC NickServ ref resolution when NickServ is disabled

* fix(secrets): align token inheritance and exec timeout defaults

* docs(secrets): clarify active-surface notes in cli docs

* cli: require secrets.resolve gateway capability

* gateway: log auth secret surface diagnostics

* secrets: remove dead provider resolver module

* fix(secrets): restore gateway auth precedence and fallback resolution

* fix(tests): align plugin runtime mock typings

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-03-03 02:58:20 +00:00

536 lines
14 KiB
TypeScript

import { DEFAULT_CONTEXT_TOKENS } from "../agents/defaults.js";
import { normalizeProviderId, parseModelRef } from "../agents/model-selection.js";
import { DEFAULT_AGENT_MAX_CONCURRENT, DEFAULT_SUBAGENT_MAX_CONCURRENT } from "./agent-limits.js";
import { resolveAgentModelPrimaryValue } from "./model-input.js";
import {
DEFAULT_TALK_PROVIDER,
normalizeTalkConfig,
resolveActiveTalkProviderConfig,
resolveTalkApiKey,
} from "./talk.js";
import type { OpenClawConfig } from "./types.js";
import type { ModelDefinitionConfig } from "./types.models.js";
import { hasConfiguredSecretInput } from "./types.secrets.js";
type WarnState = { warned: boolean };
let defaultWarnState: WarnState = { warned: false };
type AnthropicAuthDefaultsMode = "api_key" | "oauth";
const DEFAULT_MODEL_ALIASES: Readonly<Record<string, string>> = {
// Anthropic (pi-ai catalog uses "latest" ids without date suffix)
opus: "anthropic/claude-opus-4-6",
sonnet: "anthropic/claude-sonnet-4-6",
// OpenAI
gpt: "openai/gpt-5.2",
"gpt-mini": "openai/gpt-5-mini",
// Google Gemini (3.x are preview ids in the catalog)
gemini: "google/gemini-3-pro-preview",
"gemini-flash": "google/gemini-3-flash-preview",
};
const DEFAULT_MODEL_COST: ModelDefinitionConfig["cost"] = {
input: 0,
output: 0,
cacheRead: 0,
cacheWrite: 0,
};
const DEFAULT_MODEL_INPUT: ModelDefinitionConfig["input"] = ["text"];
const DEFAULT_MODEL_MAX_TOKENS = 8192;
type ModelDefinitionLike = Partial<ModelDefinitionConfig> &
Pick<ModelDefinitionConfig, "id" | "name">;
function resolveDefaultProviderApi(
providerId: string,
providerApi: ModelDefinitionConfig["api"] | undefined,
): ModelDefinitionConfig["api"] | undefined {
if (providerApi) {
return providerApi;
}
return normalizeProviderId(providerId) === "anthropic" ? "anthropic-messages" : undefined;
}
function isPositiveNumber(value: unknown): value is number {
return typeof value === "number" && Number.isFinite(value) && value > 0;
}
function resolveModelCost(
raw?: Partial<ModelDefinitionConfig["cost"]>,
): ModelDefinitionConfig["cost"] {
return {
input: typeof raw?.input === "number" ? raw.input : DEFAULT_MODEL_COST.input,
output: typeof raw?.output === "number" ? raw.output : DEFAULT_MODEL_COST.output,
cacheRead: typeof raw?.cacheRead === "number" ? raw.cacheRead : DEFAULT_MODEL_COST.cacheRead,
cacheWrite:
typeof raw?.cacheWrite === "number" ? raw.cacheWrite : DEFAULT_MODEL_COST.cacheWrite,
};
}
function resolveAnthropicDefaultAuthMode(cfg: OpenClawConfig): AnthropicAuthDefaultsMode | null {
const profiles = cfg.auth?.profiles ?? {};
const anthropicProfiles = Object.entries(profiles).filter(
([, profile]) => profile?.provider === "anthropic",
);
const order = cfg.auth?.order?.anthropic ?? [];
for (const profileId of order) {
const entry = profiles[profileId];
if (!entry || entry.provider !== "anthropic") {
continue;
}
if (entry.mode === "api_key") {
return "api_key";
}
if (entry.mode === "oauth" || entry.mode === "token") {
return "oauth";
}
}
const hasApiKey = anthropicProfiles.some(([, profile]) => profile?.mode === "api_key");
const hasOauth = anthropicProfiles.some(
([, profile]) => profile?.mode === "oauth" || profile?.mode === "token",
);
if (hasApiKey && !hasOauth) {
return "api_key";
}
if (hasOauth && !hasApiKey) {
return "oauth";
}
if (process.env.ANTHROPIC_OAUTH_TOKEN?.trim()) {
return "oauth";
}
if (process.env.ANTHROPIC_API_KEY?.trim()) {
return "api_key";
}
return null;
}
function resolvePrimaryModelRef(raw?: string): string | null {
if (!raw || typeof raw !== "string") {
return null;
}
const trimmed = raw.trim();
if (!trimmed) {
return null;
}
const aliasKey = trimmed.toLowerCase();
return DEFAULT_MODEL_ALIASES[aliasKey] ?? trimmed;
}
export type SessionDefaultsOptions = {
warn?: (message: string) => void;
warnState?: WarnState;
};
export function applyMessageDefaults(cfg: OpenClawConfig): OpenClawConfig {
const messages = cfg.messages;
const hasAckScope = messages?.ackReactionScope !== undefined;
if (hasAckScope) {
return cfg;
}
const nextMessages = messages ? { ...messages } : {};
nextMessages.ackReactionScope = "group-mentions";
return {
...cfg,
messages: nextMessages,
};
}
export function applySessionDefaults(
cfg: OpenClawConfig,
options: SessionDefaultsOptions = {},
): OpenClawConfig {
const session = cfg.session;
if (!session || session.mainKey === undefined) {
return cfg;
}
const trimmed = session.mainKey.trim();
const warn = options.warn ?? console.warn;
const warnState = options.warnState ?? defaultWarnState;
const next: OpenClawConfig = {
...cfg,
session: { ...session, mainKey: "main" },
};
if (trimmed && trimmed !== "main" && !warnState.warned) {
warnState.warned = true;
warn('session.mainKey is ignored; main session is always "main".');
}
return next;
}
export function applyTalkApiKey(config: OpenClawConfig): OpenClawConfig {
const normalized = normalizeTalkConfig(config);
const resolved = resolveTalkApiKey();
if (!resolved) {
return normalized;
}
const talk = normalized.talk;
const active = resolveActiveTalkProviderConfig(talk);
if (active.provider && active.provider !== DEFAULT_TALK_PROVIDER) {
return normalized;
}
const existingProviderApiKeyConfigured = hasConfiguredSecretInput(active.config?.apiKey);
const existingLegacyApiKeyConfigured = hasConfiguredSecretInput(talk?.apiKey);
if (existingProviderApiKeyConfigured || existingLegacyApiKeyConfigured) {
return normalized;
}
const providerId = active.provider ?? DEFAULT_TALK_PROVIDER;
const providers = { ...talk?.providers };
const providerConfig = { ...providers[providerId], apiKey: resolved };
providers[providerId] = providerConfig;
const nextTalk = {
...talk,
apiKey: resolved,
provider: talk?.provider ?? providerId,
providers,
};
return {
...normalized,
talk: nextTalk,
};
}
export function applyTalkConfigNormalization(config: OpenClawConfig): OpenClawConfig {
return normalizeTalkConfig(config);
}
export function applyModelDefaults(cfg: OpenClawConfig): OpenClawConfig {
let mutated = false;
let nextCfg = cfg;
const providerConfig = nextCfg.models?.providers;
if (providerConfig) {
const nextProviders = { ...providerConfig };
for (const [providerId, provider] of Object.entries(providerConfig)) {
const models = provider.models;
if (!Array.isArray(models) || models.length === 0) {
continue;
}
const providerApi = resolveDefaultProviderApi(providerId, provider.api);
let nextProvider = provider;
if (providerApi && provider.api !== providerApi) {
mutated = true;
nextProvider = { ...nextProvider, api: providerApi };
}
let providerMutated = false;
const nextModels = models.map((model) => {
const raw = model as ModelDefinitionLike;
let modelMutated = false;
const reasoning = typeof raw.reasoning === "boolean" ? raw.reasoning : false;
if (raw.reasoning !== reasoning) {
modelMutated = true;
}
const input = raw.input ?? [...DEFAULT_MODEL_INPUT];
if (raw.input === undefined) {
modelMutated = true;
}
const cost = resolveModelCost(raw.cost);
const costMutated =
!raw.cost ||
raw.cost.input !== cost.input ||
raw.cost.output !== cost.output ||
raw.cost.cacheRead !== cost.cacheRead ||
raw.cost.cacheWrite !== cost.cacheWrite;
if (costMutated) {
modelMutated = true;
}
const contextWindow = isPositiveNumber(raw.contextWindow)
? raw.contextWindow
: DEFAULT_CONTEXT_TOKENS;
if (raw.contextWindow !== contextWindow) {
modelMutated = true;
}
const defaultMaxTokens = Math.min(DEFAULT_MODEL_MAX_TOKENS, contextWindow);
const rawMaxTokens = isPositiveNumber(raw.maxTokens) ? raw.maxTokens : defaultMaxTokens;
const maxTokens = Math.min(rawMaxTokens, contextWindow);
if (raw.maxTokens !== maxTokens) {
modelMutated = true;
}
const api = raw.api ?? providerApi;
if (raw.api !== api) {
modelMutated = true;
}
if (!modelMutated) {
return model;
}
providerMutated = true;
return {
...raw,
reasoning,
input,
cost,
contextWindow,
maxTokens,
api,
} as ModelDefinitionConfig;
});
if (!providerMutated) {
if (nextProvider !== provider) {
nextProviders[providerId] = nextProvider;
}
continue;
}
nextProviders[providerId] = { ...nextProvider, models: nextModels };
mutated = true;
}
if (mutated) {
nextCfg = {
...nextCfg,
models: {
...nextCfg.models,
providers: nextProviders,
},
};
}
}
const existingAgent = nextCfg.agents?.defaults;
if (!existingAgent) {
return mutated ? nextCfg : cfg;
}
const existingModels = existingAgent.models ?? {};
if (Object.keys(existingModels).length === 0) {
return mutated ? nextCfg : cfg;
}
const nextModels: Record<string, { alias?: string }> = {
...existingModels,
};
for (const [alias, target] of Object.entries(DEFAULT_MODEL_ALIASES)) {
const entry = nextModels[target];
if (!entry) {
continue;
}
if (entry.alias !== undefined) {
continue;
}
nextModels[target] = { ...entry, alias };
mutated = true;
}
if (!mutated) {
return cfg;
}
return {
...nextCfg,
agents: {
...nextCfg.agents,
defaults: { ...existingAgent, models: nextModels },
},
};
}
export function applyAgentDefaults(cfg: OpenClawConfig): OpenClawConfig {
const agents = cfg.agents;
const defaults = agents?.defaults;
const hasMax =
typeof defaults?.maxConcurrent === "number" && Number.isFinite(defaults.maxConcurrent);
const hasSubMax =
typeof defaults?.subagents?.maxConcurrent === "number" &&
Number.isFinite(defaults.subagents.maxConcurrent);
if (hasMax && hasSubMax) {
return cfg;
}
let mutated = false;
const nextDefaults = defaults ? { ...defaults } : {};
if (!hasMax) {
nextDefaults.maxConcurrent = DEFAULT_AGENT_MAX_CONCURRENT;
mutated = true;
}
const nextSubagents = defaults?.subagents ? { ...defaults.subagents } : {};
if (!hasSubMax) {
nextSubagents.maxConcurrent = DEFAULT_SUBAGENT_MAX_CONCURRENT;
mutated = true;
}
if (!mutated) {
return cfg;
}
return {
...cfg,
agents: {
...agents,
defaults: {
...nextDefaults,
subagents: nextSubagents,
},
},
};
}
export function applyLoggingDefaults(cfg: OpenClawConfig): OpenClawConfig {
const logging = cfg.logging;
if (!logging) {
return cfg;
}
if (logging.redactSensitive) {
return cfg;
}
return {
...cfg,
logging: {
...logging,
redactSensitive: "tools",
},
};
}
export function applyContextPruningDefaults(cfg: OpenClawConfig): OpenClawConfig {
const defaults = cfg.agents?.defaults;
if (!defaults) {
return cfg;
}
const authMode = resolveAnthropicDefaultAuthMode(cfg);
if (!authMode) {
return cfg;
}
let mutated = false;
const nextDefaults = { ...defaults };
const contextPruning = defaults.contextPruning ?? {};
const heartbeat = defaults.heartbeat ?? {};
if (defaults.contextPruning?.mode === undefined) {
nextDefaults.contextPruning = {
...contextPruning,
mode: "cache-ttl",
ttl: defaults.contextPruning?.ttl ?? "1h",
};
mutated = true;
}
if (defaults.heartbeat?.every === undefined) {
nextDefaults.heartbeat = {
...heartbeat,
every: authMode === "oauth" ? "1h" : "30m",
};
mutated = true;
}
if (authMode === "api_key") {
const nextModels = defaults.models ? { ...defaults.models } : {};
let modelsMutated = false;
const isAnthropicCacheRetentionTarget = (
parsed: { provider: string; model: string } | null | undefined,
): parsed is { provider: string; model: string } =>
Boolean(
parsed &&
(parsed.provider === "anthropic" ||
(parsed.provider === "amazon-bedrock" &&
parsed.model.toLowerCase().includes("anthropic.claude"))),
);
for (const [key, entry] of Object.entries(nextModels)) {
const parsed = parseModelRef(key, "anthropic");
if (!isAnthropicCacheRetentionTarget(parsed)) {
continue;
}
const current = entry ?? {};
const params = (current as { params?: Record<string, unknown> }).params ?? {};
if (typeof params.cacheRetention === "string") {
continue;
}
nextModels[key] = {
...(current as Record<string, unknown>),
params: { ...params, cacheRetention: "short" },
};
modelsMutated = true;
}
const primary = resolvePrimaryModelRef(
resolveAgentModelPrimaryValue(defaults.model) ?? undefined,
);
if (primary) {
const parsedPrimary = parseModelRef(primary, "anthropic");
if (isAnthropicCacheRetentionTarget(parsedPrimary)) {
const key = `${parsedPrimary.provider}/${parsedPrimary.model}`;
const entry = nextModels[key];
const current = entry ?? {};
const params = (current as { params?: Record<string, unknown> }).params ?? {};
if (typeof params.cacheRetention !== "string") {
nextModels[key] = {
...(current as Record<string, unknown>),
params: { ...params, cacheRetention: "short" },
};
modelsMutated = true;
}
}
}
if (modelsMutated) {
nextDefaults.models = nextModels;
mutated = true;
}
}
if (!mutated) {
return cfg;
}
return {
...cfg,
agents: {
...cfg.agents,
defaults: nextDefaults,
},
};
}
export function applyCompactionDefaults(cfg: OpenClawConfig): OpenClawConfig {
const defaults = cfg.agents?.defaults;
if (!defaults) {
return cfg;
}
const compaction = defaults?.compaction;
if (compaction?.mode) {
return cfg;
}
return {
...cfg,
agents: {
...cfg.agents,
defaults: {
...defaults,
compaction: {
...compaction,
mode: "safeguard",
},
},
},
};
}
export function resetSessionDefaultsWarningForTests() {
defaultWarnState = { warned: false };
}