mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-09 15:59:30 +00:00
4bf70be01a
* feat(secrets): resolve SecretRef model credentials at egress via process-local sentinels SecretRef-managed model-provider credentials now travel as opaque oc-sent-v1 sentinels through auth storage, stream options, and SDK config; the guarded model fetch injects real values into headers and URLs immediately before the SSRF-guarded send and fails closed on unknown sentinels. packages/ai adapters converge on the host guarded fetch where the SDK supports custom fetch and unwrap at construction where it does not. Resolved values (and their percent-encoded forms) register for exact-value log redaction. Kill switch: OPENCLAW_SECRET_SENTINELS=off. Also fixes a pre-existing unhandled rejection race in capNonOkResponseBodyLazily (pipeThrough writer leak). * test(plugin-sdk): update public surface budget |
||
|---|---|---|
| .. | ||
| acp-core | ||
| agent-core | ||
| ai | ||
| gateway-client | ||
| gateway-protocol | ||
| llm-core | ||
| markdown-core | ||
| media-core | ||
| media-generation-core | ||
| media-understanding-common | ||
| memory-host-sdk | ||
| model-catalog-core | ||
| net-policy | ||
| normalization-core | ||
| plugin-package-contract | ||
| plugin-sdk | ||
| sdk | ||
| speech-core | ||
| terminal-core | ||
| tool-call-repair | ||
| web-content-core | ||