Keep a placeholder apiKey instead of removing it

Removing apiKey outright for any non-env-var value can break profile-authenticated providers during model discovery. resolveImplicitProviders() and normalizeProviders() intentionally populate apiKey from auth profiles because providers that define models need that field for pi model registration (src/agents/models-config.providers.ts), but this redaction deletes those profile-derived values before models.json is consumed by ModelRegistry in resolveModel() (src/agents/pi-embedded-runner/model.ts). In environments using auth profiles (and no provider env var), this can cause provider models to disappear and surface as Unknown model errors.

Useful? React with 👍 / 👎.

Consider adding unit tests for this security-critical function to verify:

• Env var names preserved (e.g., OPENAI_API_KEY)
• Resolved secrets stripped (e.g., sk-proj-..., hf_...)
• Edge cases handled (empty strings, whitespace, single char)
• Other provider fields preserved (baseUrl, models, etc.)

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

This is a comment left during a code review.
Path: src/agents/models-config.ts
Line: 116-138

Comment:
Consider adding unit tests for this security-critical function to verify:
- Env var names preserved (e.g., `OPENAI_API_KEY`)
- Resolved secrets stripped (e.g., `sk-proj-...`, `hf_...`)
- Edge cases handled (empty strings, whitespace, single char)
- Other provider fields preserved (`baseUrl`, `models`, etc.)

<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>

How can I resolve this? If you propose a fix, please make it concise.

Redact uppercase API secrets before persisting models.json

The redaction guard treats any all-caps token matching ^[A-Z][A-Z0-9_]{1,127}$ as an env-var reference, so literal API keys in that shape are written to disk unchanged. This means users with uppercase-only credentials (for example custom proxy tokens) still leak plaintext secrets into models.json, which defeats the security fix for that input class.

Useful? React with 👍 / 👎.

Redact uppercase API key literals before persisting

redactApiKeysForPersistence() currently treats any all-caps token matching ^[A-Z][A-Z0-9_]{1,127}$ as an environment-variable reference and keeps it in models.json. If a resolved/profile API key itself is uppercase (for example proxy or enterprise tokens), it will be written to disk in plaintext, so the at-rest secret redaction introduced in this commit is bypassed for that credential shape.

Useful? React with 👍 / 👎.

Preserve env-var API key refs even when unset

isEnvVarReference() now requires the token to exist in process.env, so a valid configured reference like apiKey: "OPENAI_API_KEY" is treated as a secret and rewritten to REDACTED whenever ensureOpenClawModelsJson() runs in an environment where that var is not currently exported (common for different launch contexts). Because merge mode preserves any non-empty existing apiKey, that redacted value then keeps winning on later writes, so the original reference cannot recover even after the env var is restored; this can break workflows that rely on persisted env-var references rather than profile keys.

Useful? React with 👍 / 👎.

Redact uppercase API key literals before writing models.json

Treating any token that matches ^[A-Z][A-Z0-9_]{1,127}$ as an env-var reference allows real API keys with uppercase/underscore formats to be persisted in plaintext. In configurations where a resolved/profile key happens to use that shape (for example enterprise proxy tokens), redactApiKeysForPersistence() skips replacement and writes the secret to models.json, which bypasses the at-rest redaction this change is intended to enforce.

Useful? React with 👍 / 👎.