refactor(messaging): clean up provider credential hashes from SandboxEntry (registry)

ci/test-file-size-budget.json

@@ -9,7 +9,7 @@
     "test/generate-openclaw-config.test.ts": 1989,
     "test/install-preflight.test.ts": 4207,
     "test/nemoclaw-start.test.ts": 5162,
-    "test/onboard-messaging.test.ts": 2063,
+    "test/onboard-messaging.test.ts": 2062,
     "test/onboard-selection.test.ts": 6888,
     "test/onboard.test.ts": 4774,
     "test/policies.test.ts": 2753

src/lib/actions/sandbox/rebuild.ts

@@ -1039,9 +1039,6 @@ export async function rebuildSandbox(
       ...(hasRebuildHermesToolGateways
         ? { hermesToolGateways: [...rebuildHermesToolGateways] }
         : {}),
-      ...(sb.providerCredentialHashes
-        ? { providerCredentialHashes: sb.providerCredentialHashes }
-        : {}),
     };
     if (Object.keys(preservedRegistryFields).length > 0) {
       registry.updateSandbox(sandboxName, preservedRegistryFields);

src/lib/onboard.ts

@@ -3153,13 +3153,6 @@ async function createSandbox(
   hermesDashboardForwarding.ensureForState(finalHermesDashboardState, sandboxName, true);
 
   // Register only after confirmed ready — prevents phantom entries
-  const providerCredentialHashes: Record<string, string> = {};
-  for (const { envKey, token } of messagingTokenDefs) {
-    const hash = token ? hashCredential(token) : null;
-    if (hash) {
-      providerCredentialHashes[envKey] = hash;
-    }
-  }
   // openshell tags images with seconds; buildId is ms. Parse actual tag from output. Fixes #2672.
   const resolvedImageTag = resolveSandboxImageTagFromCreateOutput(createResult.output, buildId);
 
@@ -3172,7 +3165,6 @@ async function createSandbox(
     agent,
     agentVersionKnown: !fromDockerfile,
     imageTag: resolvedImageTag,
-    providerCredentialHashes,
     appliedPolicies: initialSandboxPolicy.appliedPresets,
     plannedMessagingState,
     hermesToolGateways,

src/lib/onboard/sandbox-registration.test.ts

@@ -33,7 +33,6 @@ describe("buildCreatedSandboxRegistryEntry", () => {
       agent: null,
       agentVersionKnown: true,
       imageTag: "nemoclaw-demo:123",
-      providerCredentialHashes: { SLACK_BOT_TOKEN: "hash-slack-bot" },
       appliedPolicies: ["discord", "slack"],
       plannedMessagingState: plannedMessagingState as any,
       hermesToolGateways: ["filesystem"],
@@ -51,7 +50,6 @@ describe("buildCreatedSandboxRegistryEntry", () => {
       model: "llama",
       provider: "openai-compatible",
       imageTag: "nemoclaw-demo:123",
-      providerCredentialHashes: { SLACK_BOT_TOKEN: "hash-slack-bot" },
       policies: ["discord", "slack"],
       hermesToolGateways: ["filesystem"],
       hermesDashboardEnabled: true,
@@ -82,7 +80,6 @@ describe("buildCreatedSandboxRegistryEntry", () => {
       agent: null,
       agentVersionKnown: false,
       imageTag: null,
-      providerCredentialHashes: {},
       appliedPolicies: [],
       plannedMessagingState: {
         schemaVersion: 1 as const,
@@ -122,7 +119,6 @@ describe("registerCreatedSandbox", () => {
       agent: null,
       agentVersionKnown: true,
       imageTag: null,
-      providerCredentialHashes: {},
       appliedPolicies: [],
       plannedMessagingState: undefined,
       hermesToolGateways: [],

src/lib/onboard/sandbox-registration.ts

@@ -30,7 +30,6 @@ export interface CreatedSandboxRegistryEntryInput {
   agent: AgentDefinition | null | undefined;
   agentVersionKnown: boolean;
   imageTag: string | null;
-  providerCredentialHashes: Record<string, string>;
   appliedPolicies: string[];
   plannedMessagingState: SandboxMessagingState | undefined;
   hermesToolGateways: string[];
@@ -59,10 +58,6 @@ export function buildCreatedSandboxRegistryEntry(
     ...input.runtimeFields,
     ...getSandboxAgentRegistryFields(input.agent, input.agentVersionKnown),
     imageTag: input.imageTag,
-    providerCredentialHashes:
-      Object.keys(input.providerCredentialHashes).length > 0
-        ? input.providerCredentialHashes
-        : undefined,
     policies: input.appliedPolicies,
     messaging: messagingState,
     hermesToolGateways:

src/lib/state/registry.ts

@@ -81,7 +81,6 @@ export interface SandboxEntry {
   // are never auto-rebuilt onto the default image (#5026).
   nemoclawVersion?: string | null;
   imageTag?: string | null;
-  providerCredentialHashes?: Record<string, string>;
   messaging?: SandboxMessagingState;
   hermesToolGateways?: string[];
   hermesDashboardEnabled?: boolean;
@@ -412,7 +411,6 @@ export function registerSandbox(entry: SandboxEntry): void {
       agentVersion: entry.agentVersion || null,
       nemoclawVersion: entry.nemoclawVersion || null,
       imageTag: entry.imageTag || null,
-      providerCredentialHashes: entry.providerCredentialHashes || undefined,
       messaging: cloneSandboxMessagingState(entry.messaging),
       hermesToolGateways:
         Array.isArray(entry.hermesToolGateways) && entry.hermesToolGateways.length > 0

test/e2e/test-channels-stop-start.sh

@@ -298,7 +298,6 @@ channel_presence() {
 dump_channel_state() {
   info "registry.messaging.plan.channels: $(node -e 'const fs=require("fs"); const [p,n]=process.argv.slice(1); const r=fs.existsSync(p)?JSON.parse(fs.readFileSync(p,"utf8")):{}; const c=r.sandboxes?.[n]?.messaging?.plan?.channels; process.stdout.write(JSON.stringify(Array.isArray(c)?c.map((x)=>x?.channelId):null));' "$REGISTRY" "$ACTIVE_SANDBOX" 2>/dev/null || echo null)"
   info "registry.messaging.plan.disabledChannels: $(node -e 'const fs=require("fs"); const [p,n]=process.argv.slice(1); const r=fs.existsSync(p)?JSON.parse(fs.readFileSync(p,"utf8")):{}; process.stdout.write(JSON.stringify(r.sandboxes?.[n]?.messaging?.plan?.disabledChannels ?? null));' "$REGISTRY" "$ACTIVE_SANDBOX" 2>/dev/null || echo null)"
-  info "registry.providerCredentialHashes: $(registry_field providerCredentialHashes)"
   if [ "$ACTIVE_AGENT" = "openclaw" ]; then
     info "openclaw.json channels:"
     sandbox_exec "python3 -c 'import json; print(list(json.load(open(\"/sandbox/.openclaw/openclaw.json\")).get(\"channels\", {}).keys()))' 2>&1" | head -10 || true

test/e2e/test-rebuild-hermes.sh

@@ -307,10 +307,7 @@ reg = {'sandboxes': {'${SANDBOX_NAME}': {
     'policyTier': None,
     'agent': 'hermes',
     'agentVersion': '${OLD_HERMES_REGISTRY_VERSION}',
-    'messaging': {'schemaVersion': 1, 'plan': plan},
-    'providerCredentialHashes': {
-        'DISCORD_BOT_TOKEN': credential_hash
-    }
+    'messaging': {'schemaVersion': 1, 'plan': plan}
 }}, 'defaultSandbox': '${SANDBOX_NAME}'}
 with open('${REGISTRY_FILE}', 'w') as f:
     json.dump(reg, f, indent=2)

test/onboard-messaging.test.ts

@@ -652,7 +652,6 @@ const { createSandbox } = require(${onboardPath});
       ["discord", "slack"],
     );
     assert.equal(payload.registerCalls[0]?.messagingChannels, undefined);
-    assert.equal(payload.registerCalls[0]?.providerCredentialHashes, undefined);
   });
 
   it("preserves disabled channels in the registry after a recreate so `channels start` can re-enable them (#3381)", {