CLI: make read-only SecretRef status flows degrade safely (#37023)

* CLI: add read-only SecretRef inspection

* CLI: fix read-only SecretRef status regressions

* CLI: preserve read-only SecretRef status fallbacks

* Docs: document read-only channel inspection hook

* CLI: preserve audit coverage for read-only SecretRefs

* CLI: fix read-only status account selection

* CLI: fix targeted gateway fallback analysis

* CLI: fix Slack HTTP read-only inspection

* CLI: align audit credential status checks

* CLI: restore Telegram read-only fallback semantics
This commit is contained in:
Josh Avant
2026-03-05 23:07:13 -06:00
committed by GitHub
parent 8d4a2f2c59
commit 0e4245063f
58 changed files with 3422 additions and 215 deletions

View File

@@ -104,4 +104,33 @@ describe("discord audit", () => {
expect(collected.channelIds).toEqual([]);
expect(collected.unresolvedChannels).toBe(0);
});
it("collects audit channel ids without resolving SecretRef-backed Discord tokens", async () => {
const { collectDiscordAuditChannelIds } = await import("./audit.js");
const cfg = {
channels: {
discord: {
enabled: true,
token: {
source: "env",
provider: "default",
id: "DISCORD_BOT_TOKEN",
},
guilds: {
"123": {
channels: {
"111": { allow: true },
general: { allow: true },
},
},
},
},
},
} as unknown as import("../config/config.js").OpenClawConfig;
const collected = collectDiscordAuditChannelIds({ cfg, accountId: "default" });
expect(collected.channelIds).toEqual(["111"]);
expect(collected.unresolvedChannels).toBe(1);
});
});