openclaw - 💡(How to fix) Fix Secret broker plugin: first-class `secret.get`/`secret.has` over Bitwarden / Keychain / 1Password / Vault [2 comments, 2 participants]

Summary

Add a generic "secret broker" plugin so agents can resolve named secrets at call time without copy-pasting them into chat or env files.

Why

OpenClaw runs as a 24/7 personal agent. Side projects (Slack bots, GitHub PR runners, fast-flights scraper, etc.) all need credentials, and the user shouldn't have to paste them. Today the workflow is:

• User stashes credentials in Bitwarden (or 1Password, or macOS Keychain) once.
• A local broker script (~/bin/bw-get.sh in this setup) fetches them on demand: ~/bin/bw-get.sh <item> [field].
• Every project that needs a secret has to call that shell script — which works, but isn't a first-class OpenClaw concept and isn't portable across hosts.

Proposed surface

A pluggable resolver under mcp__openclaw__secret_*:

secret.get({ name, field? })            // returns value (never stored in transcript)
secret.has({ name })                    // existence check
secret.list({ prefix? })                // names only, never values

With a config block selecting the backend:

{
  "secrets": {
    "backend": "bitwarden",  // or "1password" | "keychain" | "vault"
    "bitwarden": { "broker": "~/bin/bw-get.sh" },
    "keychain":  { "service": "openclaw" }
  }
}

Backends start with the two that already work in practice on this machine:

1. Bitwarden (wraps an existing broker script — bw-get.sh-style)
2. macOS Keychain (security find-generic-password -s <name> -w)

Important constraints

• Never write secrets to disk beyond what the backend itself does.
• Redact in transcripts — values returned from secret.get should be tagged so transcript dumps replace them with [REDACTED:<name>].
• Scope guard — refuse to return secrets when the active session is a group chat or has untrusted participants (configurable allowlist of session kinds).

Related

Filed alongside #74757 and #74758 — same root motivation (let the agent do real host work without bouncing back to the user for every small step).