Summary

Currently, if we want to cover some Zod fields to mask them as secret ref object, it would need to change their schema definition accordingly, e.g. the following fields might need to be masked as secret ref object:

  - channels.wea.* credentials                                                                                                                     
  - skills.entries.*.env values                                                                                                                    
  - plugins.entries.*.config sensitive paths   

As a result, it may need to change the core schema fields frequently, which is not a good way. Instead, we could introduce an unified solution like K8s CNI did, just let the end users define their own secret ref provider and it could cover all of the schema fields, which is more complete solution.

Problem to solve

The end users don't need to submit PR to change the core code any more, just define their own plugin to mask the openclaw json config fields to secret ref objects.

Proposed solution

Use OpenClaw Plugin implementation.

Alternatives considered

No response

Impact

It would still change the core code to support to use plugin to render the configurations by using secret ref objects.

Evidence/examples

No response

Additional information

No response