@agentmessier/openclaw-agent-messier 0.3.4 → 0.3.5

package/openclaw.plugin.json

@@ -1,5 +1,5 @@
 {
-  "id": "agent-messier",
+  "id": "openclaw-agent-messier",
   "kind": "tool",
   "uiHints": {
     "serverUrl": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentmessier/openclaw-agent-messier",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Agent Messier multi-venue client for OpenClaw \u2014 play games and work tasks on the AgentNet platform (soccer today; venues discovered from the marketplace registry)",
   "type": "module",
   "license": "MIT",

package/src/tools.test.ts

@@ -16,10 +16,12 @@ describe("soccer extension join auth", () => {
   });
   afterEach(() => vi.unstubAllGlobals());
 
-  it("apiKeyOf prefers config, falls back to AGENTNET_API_KEY", () => {
+  it("apiKeyOf comes from config only — never from the environment", () => {
     expect(apiKeyOf(cfg({ apiKey: "from-cfg" }))).toBe("from-cfg");
+    // a stray env var must NOT be picked up (config-only; avoids the env+network
+    // 'credential harvesting' scanner flag and keeps config the single channel).
     vi.stubEnv("AGENTNET_API_KEY", "from-env");
-    expect(apiKeyOf(cfg())).toBe("from-env");
+    expect(apiKeyOf(cfg())).toBeUndefined();
     vi.unstubAllEnvs();
   });
 

package/src/tools.ts

@@ -123,7 +123,11 @@ function idKey(cfg: PluginCfg): string {
 
 /** AgentNet API key for join-time verification (config, then env fallback). */
 export function apiKeyOf(cfg: PluginCfg): string | undefined {
-  return cfg.apiKey ?? process.env.AGENTNET_API_KEY ?? undefined;
+  // Config-only — the key comes from the plugin config (openclaw config set
+  // plugins.entries.<id>.config.apiKey). We deliberately do NOT read it from the
+  // OS environment: an env read + network send in one module trips OpenClaw's
+  // "credential harvesting" scanner, and config is the portable channel anyway.
+  return cfg.apiKey ?? undefined;
 }
 
 /** The agentId the server seats us under. Once the server has verified us and
@@ -305,9 +309,13 @@ export const err = (msg: string) => ({ content: [{ type: "text" as const, text:
 // ── venue-URL resolution (origin → base URL); kept — generate.ts imports it. ──
 const VENUE_DEFAULTS: Record<string, string> = { taskmarket: "http://localhost:3030" };
 export function venueUrl(origin: string, cfg: PluginCfg): string {
+  // A registry origin is normally a full URL (used as-is) or "pitch" (the
+  // configured serverUrl). Short names fall back to a baked default. No OS
+  // environment read here — keeps this network module config-only, so
+  // OpenClaw's env+network scanner stays quiet.
   if (origin.startsWith("http://") || origin.startsWith("https://")) return origin;
   if (origin === "pitch") return (cfg.serverUrl ?? "http://localhost:3010").replace(/\/$/, "");
-  return process.env[`AGENTNET_${origin.toUpperCase()}_URL`] ?? VENUE_DEFAULTS[origin] ?? (cfg.serverUrl ?? "http://localhost:3010");
+  return VENUE_DEFAULTS[origin] ?? (cfg.serverUrl ?? "http://localhost:3010");
 }
 
 // ── Member / account tools — soccer cosmetic + ownership, NOT lifecycle, so