From e865b500021403b62a54be537a1888435e1591e7 Mon Sep 17 00:00:00 2001 From: San Dang Date: Sun, 14 Jun 2026 02:52:54 +0700 Subject: [PATCH] fix(cli): remove provider credential hashes from sandbox entries --- ci/test-file-size-budget.json | 2 +- src/lib/actions/sandbox/rebuild.ts | 3 --- src/lib/onboard.ts | 8 -------- src/lib/onboard/sandbox-registration.test.ts | 4 ---- src/lib/onboard/sandbox-registration.ts | 5 ----- src/lib/state/registry.ts | 2 -- test/e2e/test-channels-stop-start.sh | 1 - test/e2e/test-rebuild-hermes.sh | 5 +---- test/onboard-messaging.test.ts | 1 - 9 files changed, 2 insertions(+), 29 deletions(-) diff --git a/ci/test-file-size-budget.json b/ci/test-file-size-budget.json index f38b59a16e7..9808b338d7a 100644 --- a/ci/test-file-size-budget.json +++ b/ci/test-file-size-budget.json @@ -9,7 +9,7 @@ "test/generate-openclaw-config.test.ts": 1989, "test/install-preflight.test.ts": 4207, "test/nemoclaw-start.test.ts": 5231, - "test/onboard-messaging.test.ts": 2063, + "test/onboard-messaging.test.ts": 2062, "test/onboard-selection.test.ts": 6891, "test/onboard.test.ts": 4774, "test/policies.test.ts": 2753 diff --git a/src/lib/actions/sandbox/rebuild.ts b/src/lib/actions/sandbox/rebuild.ts index 27ef48a8ceb..545184cd4af 100644 --- a/src/lib/actions/sandbox/rebuild.ts +++ b/src/lib/actions/sandbox/rebuild.ts @@ -1049,9 +1049,6 @@ export async function rebuildSandbox( ...(hasRebuildHermesToolGateways ? { hermesToolGateways: [...rebuildHermesToolGateways] } : {}), - ...(sb.providerCredentialHashes - ? { providerCredentialHashes: sb.providerCredentialHashes } - : {}), }; if (Object.keys(preservedRegistryFields).length > 0) { registry.updateSandbox(sandboxName, preservedRegistryFields); diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts index 3ad2da4e3a1..c352b0b6620 100644 --- a/src/lib/onboard.ts +++ b/src/lib/onboard.ts @@ -3159,13 +3159,6 @@ async function createSandbox( hermesDashboardForwarding.ensureForState(finalHermesDashboardState, sandboxName, true); // Register only after confirmed ready — prevents phantom entries - const providerCredentialHashes: Record = {}; - for (const { envKey, token } of messagingTokenDefs) { - const hash = token ? hashCredential(token) : null; - if (hash) { - providerCredentialHashes[envKey] = hash; - } - } // openshell tags images with seconds; buildId is ms. Parse actual tag from output. Fixes #2672. const resolvedImageTag = resolveSandboxImageTagFromCreateOutput(createResult.output, buildId); @@ -3178,7 +3171,6 @@ async function createSandbox( agent, agentVersionKnown: !fromDockerfile, imageTag: resolvedImageTag, - providerCredentialHashes, appliedPolicies: initialSandboxPolicy.appliedPresets, plannedMessagingState, hermesToolGateways, diff --git a/src/lib/onboard/sandbox-registration.test.ts b/src/lib/onboard/sandbox-registration.test.ts index a901882bc2d..ac8cf79a0e9 100644 --- a/src/lib/onboard/sandbox-registration.test.ts +++ b/src/lib/onboard/sandbox-registration.test.ts @@ -33,7 +33,6 @@ describe("buildCreatedSandboxRegistryEntry", () => { agent: null, agentVersionKnown: true, imageTag: "nemoclaw-demo:123", - providerCredentialHashes: { SLACK_BOT_TOKEN: "hash-slack-bot" }, appliedPolicies: ["discord", "slack"], plannedMessagingState: plannedMessagingState as any, hermesToolGateways: ["filesystem"], @@ -51,7 +50,6 @@ describe("buildCreatedSandboxRegistryEntry", () => { model: "llama", provider: "openai-compatible", imageTag: "nemoclaw-demo:123", - providerCredentialHashes: { SLACK_BOT_TOKEN: "hash-slack-bot" }, policies: ["discord", "slack"], hermesToolGateways: ["filesystem"], hermesDashboardEnabled: true, @@ -82,7 +80,6 @@ describe("buildCreatedSandboxRegistryEntry", () => { agent: null, agentVersionKnown: false, imageTag: null, - providerCredentialHashes: {}, appliedPolicies: [], plannedMessagingState: { schemaVersion: 1 as const, @@ -122,7 +119,6 @@ describe("registerCreatedSandbox", () => { agent: null, agentVersionKnown: true, imageTag: null, - providerCredentialHashes: {}, appliedPolicies: [], plannedMessagingState: undefined, hermesToolGateways: [], diff --git a/src/lib/onboard/sandbox-registration.ts b/src/lib/onboard/sandbox-registration.ts index 860d01a21c3..7cd7409c6d0 100644 --- a/src/lib/onboard/sandbox-registration.ts +++ b/src/lib/onboard/sandbox-registration.ts @@ -30,7 +30,6 @@ export interface CreatedSandboxRegistryEntryInput { agent: AgentDefinition | null | undefined; agentVersionKnown: boolean; imageTag: string | null; - providerCredentialHashes: Record; appliedPolicies: string[]; plannedMessagingState: SandboxMessagingState | undefined; hermesToolGateways: string[]; @@ -59,10 +58,6 @@ export function buildCreatedSandboxRegistryEntry( ...input.runtimeFields, ...getSandboxAgentRegistryFields(input.agent, input.agentVersionKnown), imageTag: input.imageTag, - providerCredentialHashes: - Object.keys(input.providerCredentialHashes).length > 0 - ? input.providerCredentialHashes - : undefined, policies: input.appliedPolicies, messaging: messagingState, hermesToolGateways: diff --git a/src/lib/state/registry.ts b/src/lib/state/registry.ts index 43e64e2c6c7..a46f9228d3a 100644 --- a/src/lib/state/registry.ts +++ b/src/lib/state/registry.ts @@ -81,7 +81,6 @@ export interface SandboxEntry { // are never auto-rebuilt onto the default image (#5026). nemoclawVersion?: string | null; imageTag?: string | null; - providerCredentialHashes?: Record; messaging?: SandboxMessagingState; hermesToolGateways?: string[]; hermesDashboardEnabled?: boolean; @@ -412,7 +411,6 @@ export function registerSandbox(entry: SandboxEntry): void { agentVersion: entry.agentVersion || null, nemoclawVersion: entry.nemoclawVersion || null, imageTag: entry.imageTag || null, - providerCredentialHashes: entry.providerCredentialHashes || undefined, messaging: cloneSandboxMessagingState(entry.messaging), hermesToolGateways: Array.isArray(entry.hermesToolGateways) && entry.hermesToolGateways.length > 0 diff --git a/test/e2e/test-channels-stop-start.sh b/test/e2e/test-channels-stop-start.sh index c788d224ceb..0a78339d4c6 100755 --- a/test/e2e/test-channels-stop-start.sh +++ b/test/e2e/test-channels-stop-start.sh @@ -298,7 +298,6 @@ channel_presence() { dump_channel_state() { info "registry.messaging.plan.channels: $(node -e 'const fs=require("fs"); const [p,n]=process.argv.slice(1); const r=fs.existsSync(p)?JSON.parse(fs.readFileSync(p,"utf8")):{}; const c=r.sandboxes?.[n]?.messaging?.plan?.channels; process.stdout.write(JSON.stringify(Array.isArray(c)?c.map((x)=>x?.channelId):null));' "$REGISTRY" "$ACTIVE_SANDBOX" 2>/dev/null || echo null)" info "registry.messaging.plan.disabledChannels: $(node -e 'const fs=require("fs"); const [p,n]=process.argv.slice(1); const r=fs.existsSync(p)?JSON.parse(fs.readFileSync(p,"utf8")):{}; process.stdout.write(JSON.stringify(r.sandboxes?.[n]?.messaging?.plan?.disabledChannels ?? null));' "$REGISTRY" "$ACTIVE_SANDBOX" 2>/dev/null || echo null)" - info "registry.providerCredentialHashes: $(registry_field providerCredentialHashes)" if [ "$ACTIVE_AGENT" = "openclaw" ]; then info "openclaw.json channels:" sandbox_exec "python3 -c 'import json; print(list(json.load(open(\"/sandbox/.openclaw/openclaw.json\")).get(\"channels\", {}).keys()))' 2>&1" | head -10 || true diff --git a/test/e2e/test-rebuild-hermes.sh b/test/e2e/test-rebuild-hermes.sh index f9de6f7e04d..1264b7e3c73 100755 --- a/test/e2e/test-rebuild-hermes.sh +++ b/test/e2e/test-rebuild-hermes.sh @@ -291,10 +291,7 @@ reg = {'sandboxes': {'${SANDBOX_NAME}': { 'policyTier': None, 'agent': 'hermes', 'agentVersion': '${OLD_HERMES_REGISTRY_VERSION}', - 'messaging': {'schemaVersion': 1, 'plan': plan}, - 'providerCredentialHashes': { - 'DISCORD_BOT_TOKEN': credential_hash - } + 'messaging': {'schemaVersion': 1, 'plan': plan} }}, 'defaultSandbox': '${SANDBOX_NAME}'} with open('${REGISTRY_FILE}', 'w') as f: json.dump(reg, f, indent=2) diff --git a/test/onboard-messaging.test.ts b/test/onboard-messaging.test.ts index c008c1b85d9..3c44bbac31e 100644 --- a/test/onboard-messaging.test.ts +++ b/test/onboard-messaging.test.ts @@ -652,7 +652,6 @@ const { createSandbox } = require(${onboardPath}); ["discord", "slack"], ); assert.equal(payload.registerCalls[0]?.messagingChannels, undefined); - assert.equal(payload.registerCalls[0]?.providerCredentialHashes, undefined); }); it("preserves disabled channels in the registry after a recreate so `channels start` can re-enable them (#3381)", {