Josh Avant 81b777c768 fix(config): harden SecretRef round-trip handling in Control UI and RPC writes (#58044) ...

* Config: harden SecretRef round-trip handling

* Gateway: test SecretRef preflight on config writes

* Agents: align skill loader with upstream Skill type

* Docs: align SecretRef write semantics with Control UI and RPC behavior

* Config: add UI and gateway regression evidence for SecretRef hardening

* Config: add token SecretRef restore regression and skill sourceInfo compat

* UI: scope structured-value lockout to SecretRef fields

* Agents: remove out-of-scope skill loader compat edits

* UI: reduce app-render churn to rawAvailable-only changes

* Gateway: scope SecretRef preflight to submitted config

* Docs: clarify config write SecretRef preflight scope

* changelog

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

---------

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

2026-03-30 23:55:03 -05:00

..

apply.test.ts

Secrets: gate exec dry-run and preflight resolution behind --allow-exec (#49417)

2026-03-17 23:24:34 -05:00

apply.ts

Secrets: gate exec dry-run and preflight resolution behind --allow-exec (#49417)

2026-03-17 23:24:34 -05:00

audit.test.ts

test: eliminate remaining clone seams

2026-03-26 20:28:36 +00:00

audit.ts

Secrets: gate exec dry-run and preflight resolution behind --allow-exec (#49417)

2026-03-17 23:24:34 -05:00

auth-profiles-scan.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

auth-store-paths.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

command-config.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

command-config.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

config-io.ts

feat(secrets): replace migrate flow with audit/configure/apply

2026-02-26 14:47:22 +00:00

configure-plan.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

configure-plan.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

configure.test.ts

test: speed up core runtime suites

2026-03-31 02:25:02 +01:00

configure.ts

fix: harden image auth env lookups (#52552) (thanks @vincentkoc)

2026-03-22 18:42:18 -07:00

credential-matrix.ts

fix(matrix): resolve env SecretRef fallback in clean() for channel startup (#54980)

2026-03-28 00:21:57 -04:00

exec-resolution-policy.ts

Secrets: gate exec dry-run and preflight resolution behind --allow-exec (#49417)

2026-03-17 23:24:34 -05:00

exec-secret-ref-id-parity.test.ts

Tests: classify x_search secret target parity

2026-03-28 21:35:13 +00:00

json-pointer.ts

Secrets: preserve runtime snapshot source refs on write

2026-02-26 14:47:22 +00:00

path-utils.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

path-utils.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

plan.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

plan.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

provider-env-vars.test.ts

fix: harden image auth env lookups (#52552) (thanks @vincentkoc)

2026-03-22 18:42:18 -07:00

provider-env-vars.ts

fix: harden image auth env lookups (#52552) (thanks @vincentkoc)

2026-03-22 18:42:18 -07:00

ref-contract.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

ref-contract.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

resolve-secret-input-string.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

resolve.test.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

resolve.ts

Secrets: reject exec SecretRef traversal ids across schema/runtime/gateway (#42370)

2026-03-10 13:45:37 -05:00

runtime-auth-collectors.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

runtime-config-collectors-channels.ts

fix(perf): bypass matrix facade for core helpers

2026-03-30 12:43:55 +09:00

runtime-config-collectors-core.ts

refactor(xai): move code_execution into plugin

2026-03-28 21:35:13 +00:00

runtime-config-collectors-plugins.test.ts

fix: resolve acpx MCP secret inputs

2026-03-30 05:30:32 +09:00

runtime-config-collectors-plugins.ts

fix: resolve acpx MCP secret inputs

2026-03-30 05:30:32 +09:00

runtime-config-collectors-tts.ts

refactor: require legacy config migration on read

2026-03-26 23:23:47 +00:00

runtime-config-collectors.ts

fix: resolve acpx MCP secret inputs

2026-03-30 05:30:32 +09:00

runtime-gateway-auth-surfaces.test.ts

Gateway: fail closed unresolved local auth SecretRefs (#42672)

2026-03-10 21:41:56 -05:00

runtime-gateway-auth-surfaces.ts

refactor!: drop legacy CLAWDBOT env compatibility

2026-03-22 22:13:39 -07:00

runtime-shared.ts

Tools: add x_search via xAI Responses

2026-03-28 21:35:13 +00:00

runtime-web-tools.test.ts

test: speed up core runtime suites

2026-03-31 02:25:02 +01:00

runtime-web-tools.ts

Tools: add x_search via xAI Responses

2026-03-28 21:35:13 +00:00

runtime-web-tools.types.ts

Tools: add x_search via xAI Responses

2026-03-28 21:35:13 +00:00

runtime.coverage.test.ts

test: speed up core runtime suites

2026-03-31 02:25:02 +01:00

runtime.integration.test.ts

refactor(config): pin runtime snapshot and drop ttl cache

2026-03-29 22:57:31 +01:00

runtime.test.ts

fix(config): harden SecretRef round-trip handling in Control UI and RPC writes (#58044)

2026-03-30 23:55:03 -05:00

runtime.ts

fix(config): harden SecretRef round-trip handling in Control UI and RPC writes (#58044)

2026-03-30 23:55:03 -05:00

secret-value.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

shared.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

storage-scan.ts

SecretRef: harden custom/provider secret persistence and reuse (#42554)

2026-03-10 23:55:10 +00:00

target-registry-data.ts

refactor(xai): move code_execution into plugin

2026-03-28 21:35:13 +00:00

target-registry-pattern.test.ts

Secrets: harden SecretRef-safe models.json persistence (#38955)

2026-03-07 11:28:39 -06:00

target-registry-pattern.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

target-registry-query.ts

CLI: expand config set with SecretRef/provider builders and dry-run (#49296)

2026-03-17 18:15:49 -05:00

target-registry-types.ts

Secrets: add inline allowlist review set (#38314)

2026-03-06 19:35:26 -05:00

target-registry.test.ts

CLI: expand config set with SecretRef/provider builders and dry-run (#49296)

2026-03-17 18:15:49 -05:00

target-registry.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00