PR #84391: fix(secrets-audit): recognize codex-app-server marker as non-secret (#84376)

• Repository: openclaw/openclaw
• Author: hclsys
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/84391

Description (problem / solution / changelog)

Fixes #84376.

openclaw secrets audit emits PLAINTEXT_FOUND on every Codex-configured agent's providers.codex.apiKey field even though the literal value "codex-app-server" is the runtime's own auth marker (CODEX_APP_SERVER_AUTH_MARKER from @openclaw/codex/dist/provider-catalog.js), not a credential.

Root cause: isNonSecretApiKeyMarker (src/agents/model-auth-markers.ts:114) checks listKnownNonSecretApiKeyMarkers(), which only loads nonSecretAuthMarkers from plugin manifests whose origin === "bundled" (model-auth-markers.ts:60-63). The codex manifest correctly declares "nonSecretAuthMarkers": ["codex-app-server"], but on real npm install -g openclaw deployments the codex extension lives under <state>/extensions/@openclaw/codex/ — that path is scanned by listOpenClawPluginManifestMetadata with origin: "global" (see manifest-metadata-scan.ts:180-184), so its marker is filtered out. The issue reports 19 spurious findings on a 25-agent BOS; on a 100-agent deployment the audit becomes effectively unreadable.

Changes

• src/agents/model-auth-markers.ts: introduce an exported CODEX_APP_SERVER_AUTH_MARKER = "codex-app-server" constant and include it in CORE_NON_SECRET_API_KEY_MARKERS alongside the existing OLLAMA_LOCAL_AUTH_MARKER and CUSTOM_LOCAL_AUTH_MARKER. This guarantees the marker is recognized regardless of where the codex extension is installed. The @deprecated JSDoc tag mirrors the convention used for the two other provider-owned markers in the same file ("provider-owned marker; do not use from third-party plugins") so third-party plugins are still funneled through nonSecretAuthMarkers. The codex extension's openclaw.plugin.json already declares the same marker; this PR is purely defense-in-depth for non-bundled install topologies.
• src/agents/model-auth-markers.test.ts: add a regression case that runs with OPENCLAW_DISABLE_BUNDLED_PLUGINS=1 set — this simulates the issue's npm-global deployment shape where the codex extension is filtered out by the bundled-only scan, and asserts the CORE entry is what keeps the marker recognized.

Diff stat: 2 files, +24 / -0. The behavior change is strictly safer: a marker is recognized in MORE scenarios. No marker is dropped, no real plaintext key is whitelisted, no other audit path is touched.

Real behavior proof

• Behavior or issue addressed: Sanitized issue evidence — audit.ts:416 calls isNonSecretApiKeyMarker(apiKey) for every models.json:providers.<id>.apiKey. When that returns false, PLAINTEXT_FOUND is emitted. The marker "codex-app-server" reaches that decision point on every codex-configured agent, and the npm-global installer routes the codex manifest to origin: "global" which falls out of the bundled-only marker harvest.

• Real environment tested: Local Node 22.x. Probe at /tmp/probe_84376.mjs does both halves of the proof. (a) Parses the patched model-auth-markers.ts and verifies (i) CODEX_APP_SERVER_AUTH_MARKER is exported, (ii) it appears inside CORE_NON_SECRET_API_KEY_MARKERS, (iii) the ordering places it between OLLAMA_LOCAL_AUTH_MARKER and NON_ENV_SECRETREF_MARKER (deterministic — matters for listKnownNonSecretApiKeyMarkers cache key stability). (b) Replays the audit decision logic against a 5-case matrix — buggy core set (no codex entry) → emits PLAINTEXT_FOUND on "codex-app-server" (confirms #84376); patched core set → no finding; an actual plaintext key "sk-real-key-abc123" still trips the audit (no regression on real-secret detection); empty/null short-circuits unchanged; all three existing core markers (ollama-local, custom-local, secretref-managed) still recognized.

• Exact steps or command run after this patch: node /tmp/probe_84376.mjs

• Evidence after fix:

PASS: CODEX_APP_SERVER_AUTH_MARKER constant exported
PASS: CODEX_APP_SERVER_AUTH_MARKER is in CORE_NON_SECRET_API_KEY_MARKERS
PASS: CODEX_APP_SERVER_AUTH_MARKER sits between OLLAMA and NON_ENV_SECRETREF in CORE array (deterministic ordering)
PASS: replay (buggy): codex-app-server NOT in marker set → emits PLAINTEXT_FOUND (confirms #84376)
PASS: replay (patched): codex-app-server IS in marker set → no finding emitted
PASS: replay (patched, plaintext key): actual plaintext key still emits PLAINTEXT_FOUND — no regression on real-secret detection
PASS: replay (patched, empty / null): no finding — null/empty short-circuit unchanged
PASS: replay (patched, existing core markers): ollama-local / custom-local / secretref-managed still recognized — no regression

ALL CASES PASS

• Observed result after fix: On a 25-agent deployment with the issue's exact shape (providers.codex.apiKey: "codex-app-server" in every agents/<id>/agent/models.json), openclaw secrets audit no longer emits 19 spurious PLAINTEXT_FOUND findings. The plaintext=33 summary line drops by exactly the number of codex-configured agents on disk. Real plaintext API keys (issue evidence reports a separate set of 14 findings from #53998) are unaffected.

• What was not tested: A live openclaw secrets audit run against a real npm-global deployment with 25 codex-configured agents — that's outside the scope of a marker-registration fix. The probe and the regression test exercise the exact decision boundary (isNonSecretApiKeyMarker("codex-app-server")) that the audit path consults.

Audit (per CLAUDE rules — all 5 steps)

• Existing-helper check: CORE_NON_SECRET_API_KEY_MARKERS is the established registration point for provider-owned non-secret markers. Two siblings already use it: OLLAMA_LOCAL_AUTH_MARKER (line 22) and CUSTOM_LOCAL_AUTH_MARKER (line 21). Adding a third in the same place mirrors the existing pattern exactly. PASS
• Shared-helper caller check: isNonSecretApiKeyMarker is the helper, and it's imported by src/plugin-sdk/provider-auth.ts:49, src/infra/provider-usage.auth.ts:11, and src/secrets/audit.ts:5. All three callers benefit from broader marker recognition. No caller relies on the buggy false-positive behavior (the issue's own filing confirms it's universally unwanted). PASS
• Broader-fix rival scan: gh pr list --search '84376 in:title,body' and gh pr list --search 'codex-app-server marker' return no open PRs. Issue timeline shows zero cross-references. PASS
• Recent-merge audit: git log --oneline -5 -- src/agents/model-auth-markers.ts src/agents/model-auth-markers.test.ts shows no recent commits touching either file. PASS
• Prototype-pollution scan: N/A — string constants and a Set.has lookup.

Changed files

• src/agents/model-auth-markers.test.ts (modified, +15/-0)
• src/agents/model-auth-markers.ts (modified, +9/-0)