}

let listKnownProviderEnvApiKeyNames: typeof import("./model-auth-env-vars.js").listKnownProviderEnvApiKeyNames;

let CODEX_APP_SERVER_AUTH_MARKER: typeof import("./model-auth-markers.js").CODEX_APP_SERVER_AUTH_MARKER;

let GCP_VERTEX_CREDENTIALS_MARKER: typeof import("./model-auth-markers.js").GCP_VERTEX_CREDENTIALS_MARKER;

let NON_ENV_SECRETREF_MARKER: typeof import("./model-auth-markers.js").NON_ENV_SECRETREF_MARKER;

let isKnownEnvApiKeyMarker: typeof import("./model-auth-markers.js").isKnownEnvApiKeyMarker;

import("./model-auth-markers.js"),

]);

listKnownProviderEnvApiKeyNames = envVarsModule.listKnownProviderEnvApiKeyNames;

CODEX_APP_SERVER_AUTH_MARKER = markersModule.CODEX_APP_SERVER_AUTH_MARKER;

GCP_VERTEX_CREDENTIALS_MARKER = markersModule.GCP_VERTEX_CREDENTIALS_MARKER;

NON_ENV_SECRETREF_MARKER = markersModule.NON_ENV_SECRETREF_MARKER;

isKnownEnvApiKeyMarker = markersModule.isKnownEnvApiKeyMarker;

expect(isNonSecretApiKeyMarker(resolveOAuthApiKeyMarker("chutes"))).toBe(true);

expect(isNonSecretApiKeyMarker("ollama-local")).toBe(true);

expect(isNonSecretApiKeyMarker("lmstudio-local")).toBe(true);

expect(isNonSecretApiKeyMarker("codex-app-server")).toBe(true);

expect(isNonSecretApiKeyMarker(CODEX_APP_SERVER_AUTH_MARKER)).toBe(true);

expect(isNonSecretApiKeyMarker(GCP_VERTEX_CREDENTIALS_MARKER)).toBe(true);

});

it("recognizes the Codex app-server marker without bundled plugin discovery", async () => {

await withEnvAsync({ OPENCLAW_DISABLE_BUNDLED_PLUGINS: "1" }, async () => {

await loadMarkerModules();

expect(isNonSecretApiKeyMarker(CODEX_APP_SERVER_AUTH_MARKER)).toBe(true);

});

await withEnvAsync(cleanPluginManifestEnv(), loadMarkerModules);

});

it("reads bundled plugin-owned non-secret markers from manifests", () => {

const markers = new Set(listKnownNonSecretApiKeyMarkers());

expect(markers.has("codex-app-server")).toBe(true);

export const OLLAMA_LOCAL_AUTH_MARKER = "ollama-local";

/** @deprecated Bundled local-provider marker; do not use from third-party plugins. */

export const CUSTOM_LOCAL_AUTH_MARKER = "custom-local";

/** @deprecated Codex provider-owned marker; do not use from third-party plugins. */

export const CODEX_APP_SERVER_AUTH_MARKER = "codex-app-server";

export const GCP_VERTEX_CREDENTIALS_MARKER = "gcp-vertex-credentials";

export const NON_ENV_SECRETREF_MARKER = "secretref-managed"; // pragma: allowlist secret

export const SECRETREF_ENV_HEADER_MARKER_PREFIX = "secretref-env:"; // pragma: allowlist secret

]);

const CORE_NON_SECRET_API_KEY_MARKERS = [

CUSTOM_LOCAL_AUTH_MARKER,

CODEX_APP_SERVER_AUTH_MARKER,

OLLAMA_LOCAL_AUTH_MARKER,

NON_ENV_SECRETREF_MARKER,

] as const;