import { normalizeSecretInput } from "../../utils/normalize-secret-input.js";

import type { AuthProfileCredential } from "./types.js";

// Upsert paths normalize literal secret strings but preserve SecretRef-backed

// credentials for the secret resolver.

export function normalizeAuthProfileCredential(

credential: AuthProfileCredential,

): AuthProfileCredential {

if (credential.type === "api_key") {

if (typeof credential.key !== "string") {

return credential;

}

const { key: _key, ...rest } = credential;

const key = normalizeSecretInput(credential.key);

return {

...rest,

...(key ? { key } : {}),

};

}

if (credential.type === "token") {

if (typeof credential.token !== "string") {

return credential;

}

const { token: _token, ...rest } = credential;

const token = normalizeSecretInput(credential.token);

return { ...rest, ...(token ? { token } : {}) };

}

return credential;

}

normalizeProviderId,

} from "@openclaw/model-catalog-core/provider-id";

import { normalizeStringEntries } from "@openclaw/normalization-core/string-normalization";

import { normalizeSecretInput } from "../../utils/normalize-secret-input.js";

import { resolveProviderIdForAuth } from "../provider-auth-aliases.js";

import { normalizeAuthProfileCredential } from "./credential-normalize.js";

import { dedupeProfileIds, listProfilesForProvider } from "./profile-list.js";

import {

ensureAuthProfileStoreForLocalUpdate,

});

}

// Upsert paths normalize literal secret strings but preserve SecretRef-backed

// credentials for the secret resolver.

function normalizeAuthProfileCredential(credential: AuthProfileCredential): AuthProfileCredential {

if (credential.type === "api_key") {

if (typeof credential.key !== "string") {

return credential;

}

const { key: _key, ...rest } = credential;

const key = normalizeSecretInput(credential.key);

return {

...rest,

...(key ? { key } : {}),

};

}

if (credential.type === "token") {

if (typeof credential.token !== "string") {

return credential;

}

const { token: _token, ...rest } = credential;

const token = normalizeSecretInput(credential.token);

return { ...rest, ...(token ? { token } : {}) };

}

return credential;

}

/** Upserts an auth profile immediately into the local store. */

export function upsertAuthProfile(params: {

profileId: string;

* Normalizes literal secrets before persistence and routes all writes through

* the shared SQLite lock to avoid racing concurrent auth updates.

*/

import { normalizeSecretInput } from "../../utils/normalize-secret-input.js";

import { normalizeAuthProfileCredential } from "./credential-normalize.js";

import { updateAuthProfileStoreWithLock } from "./store.js";

import type { AuthProfileCredential, AuthProfileStore } from "./types.js";

// Upserts normalize literal secrets before persistence; SecretRef fields are

// preserved by leaving non-string key/token values untouched.

function normalizeAuthProfileCredential(credential: AuthProfileCredential): AuthProfileCredential {

if (credential.type === "api_key") {

if (typeof credential.key !== "string") {

return credential;

}

const { key: _key, ...rest } = credential;

const key = normalizeSecretInput(credential.key);

return {

...rest,

...(key ? { key } : {}),

};

}

if (credential.type === "token") {

if (typeof credential.token !== "string") {

return credential;

}

const { token: _token, ...rest } = credential;

const token = normalizeSecretInput(credential.token);

return { ...rest, ...(token ? { token } : {}) };

}

return credential;

}

/** Upserts an auth profile under the store lock, returning null on write failure. */

export async function upsertAuthProfileWithLock(params: {

profileId: string;

export function toCodeModeJsonSafe(value: unknown): unknown {

if (value === undefined) {

return null;

}

try {

const serialized = JSON.stringify(value);

return serialized === undefined ? null : (JSON.parse(serialized) as unknown);

} catch {

if (value instanceof Error) {

return { name: value.name, message: value.message };

}

if (value === null) {

return null;

}

switch (typeof value) {

case "string":

case "number":

case "boolean":

return value;

case "bigint":

case "symbol":

case "function":

return String(value);

default:

return Object.prototype.toString.call(value);

}

}

}

* files, and a guarded invocation runtime.

*/

import { isRecord } from "../../packages/normalization-core/src/record-coerce.js";

import { toCodeModeJsonSafe } from "./code-mode-json.js";

const FORBIDDEN_NAMESPACE_PATH_SEGMENTS = new Set(["__proto__", "constructor", "prototype"]);

const NAMESPACE_PATH_KEY_SEPARATOR = "\u0000";

return lines.join("\n");

}

function toJsonSafe(value: unknown): unknown {

if (value === undefined) {

return null;

}

try {

const serialized = JSON.stringify(value);

return serialized === undefined ? null : (JSON.parse(serialized) as unknown);

} catch {

if (value instanceof Error) {

return { name: value.name, message: value.message };

}

if (value === null) {

return null;

}

switch (typeof value) {

case "string":

case "number":

case "boolean":

return value;

case "bigint":

case "symbol":

case "function":

return String(value);

default:

return Object.prototype.toString.call(value);

}

}

}

function assertNamespacePathSegment(segment: string): void {

if (

!segment ||

);

}

if (value === null || typeof value !== "object") {

return { kind: "value", value: toJsonSafe(value) };

return { kind: "value", value: toCodeModeJsonSafe(value) };

}

if (stack.has(value)) {

throw new Error(`Circular code mode namespace scope at ${path.join(".") || "(root)"}.`);

}

const input = target.input ? await target.input(args) : (args[0] ?? {});

if (target.local) {

return toJsonSafe(input);

return toCodeModeJsonSafe(input);

}

if (!target.catalogId && !entry.registration.requiredToolNames.includes(target.toolName)) {

throw new Error(`Code mode namespace path targets undeclared tool: ${target.toolName}`);

}

return toJsonSafe(

return toCodeModeJsonSafe(

await executeTool({

pluginId: entry.registration.pluginId,

toolName: target.toolName,

isCodeModeControlTool,

markCodeModeControlTool,

} from "./code-mode-control-tools.js";

import { toCodeModeJsonSafe } from "./code-mode-json.js";

import {

createCodeModeApiVirtualFiles,

createCodeModeNamespaceRuntime,

};

}

function toJsonSafe(value: unknown): unknown {

if (value === undefined) {

return null;

}

try {

const serialized = JSON.stringify(value);

return serialized === undefined ? null : (JSON.parse(serialized) as unknown);

} catch {

if (value instanceof Error) {

return { name: value.name, message: value.message };

}

if (value === null) {

return null;

}

switch (typeof value) {

case "string":

case "number":

case "boolean":

return value;

case "bigint":

case "symbol":

case "function":

return String(value);

default:

return Object.prototype.toString.call(value);

}

}

}

function jsonByteLength(value: unknown): number {

return Buffer.byteLength(JSON.stringify(toJsonSafe(value)) ?? "null", "utf8");

return Buffer.byteLength(JSON.stringify(toCodeModeJsonSafe(value)) ?? "null", "utf8");

}

class CodeModeLimitError extends ToolInputError {

break;

}

}

return { id: params.request.id, ok: true, value: toJsonSafe(value) };

return { id: params.request.id, ok: true, value: toCodeModeJsonSafe(value) };

} catch (error) {

return { id: params.request.id, ok: false, error: errorMessage(error) };

}

// Plugin Lifecycle Probe tests cover QA Lab plugin lifecycle evidence.

import { spawn } from "node:child_process";

import { randomBytes } from "node:crypto";

import fs, { mkdirSync, writeFileSync } from "node:fs";

import fs from "node:fs";

import os from "node:os";

import path from "node:path";

import { readPluginInstallRecords } from "../../../../scripts/e2e/lib/plugin-index-sqlite.mjs";

import { createTempDirTracker } from "../../../helpers/temp-dir.js";

const tempDirs = createTempDirTracker();

function makeTempDir(): string {

return tempDirs.make("openclaw-plugin-lifecycle-probe-");

}

type ProbeEnv = Pick<NodeJS.ProcessEnv, "HOME" | "OPENCLAW_CONFIG_PATH" | "OPENCLAW_STATE_DIR">;

type MatrixEnv = NodeJS.ProcessEnv & ProbeEnv;