fix(onboard): restrict messaging placeholder paths

Author: ericksoa

src/lib/onboard/managed-startup-profile.test.ts

@@ -759,6 +759,7 @@ describe("managed startup profile", () => {
                 lines: [
                   "SLACK_BOT_TOKEN=xoxb-OPENSHELL-RESOLVE-ENV-SLACK_BOT_TOKEN",
                   "DISCORD_BOT_TOKEN=openshell:resolve:env:DISCORD_BOT_TOKEN",
+                  "TELEGRAM_BOT_TOKEN=openshell:resolve:env:v1_TELEGRAM_BOT_TOKEN",
                 ],
                 templateRefs: ["credential.slackBotToken.placeholder"],
               },
@@ -776,6 +777,10 @@ describe("managed startup profile", () => {
       "a placeholder for a different environment key",
       "SLACK_BOT_TOKEN=openshell:resolve:env:DISCORD_BOT_TOKEN",
     ],
+    [
+      "a versioned placeholder for a different environment key",
+      "SLACK_BOT_TOKEN=openshell:resolve:env:v1_DISCORD_BOT_TOKEN",
+    ],
   ])("rejects %s in messaging environment lines (#9355)", (_label, line) => {
     expect(() =>
       validateManagedStartupProfile({
@@ -821,6 +826,13 @@ describe("managed startup profile", () => {
         note: "SLACK_BOT_TOKEN=openshell:resolve:env:SLACK_BOT_TOKEN",
       },
     ],
+    [
+      "a direct credential placeholder outside schema-owned fields",
+      {
+        ...OPENCLAW_PROFILE.messaging.plan,
+        note: "openshell:resolve:env:SLACK_BOT_TOKEN",
+      },
+    ],
   ])("rejects %s (#9355)", (_label, plan) => {
     expect(() =>
       validateManagedStartupProfile({

src/lib/onboard/managed-startup/profile.ts

@@ -994,13 +994,24 @@ function valueLooksLikeSecret(value: string): boolean {
 }
 
 function isMessagingCredentialPlaceholder(path: readonly string[], value: unknown): boolean {
-  return (
-    path.length >= 2 &&
+  if (typeof value !== "string" || !MESSAGING_CREDENTIAL_PLACEHOLDER_RE.test(value)) {
+    return false;
+  }
+  const isCredentialBindingPlaceholder =
+    path.length === 5 &&
     path[0] === "messaging" &&
     path[1] === "plan" &&
-    typeof value === "string" &&
-    MESSAGING_CREDENTIAL_PLACEHOLDER_RE.test(value)
-  );
+    path[2] === "credentialBindings" &&
+    JSON_ARRAY_INDEX_SEGMENT_RE.test(path[3] ?? "") &&
+    path[4] === "placeholder";
+  const isAgentRenderValuePlaceholder =
+    path.length >= 5 &&
+    path[0] === "messaging" &&
+    path[1] === "plan" &&
+    path[2] === "agentRender" &&
+    JSON_ARRAY_INDEX_SEGMENT_RE.test(path[3] ?? "") &&
+    path[4] === "value";
+  return isCredentialBindingPlaceholder || isAgentRenderValuePlaceholder;
 }
 
 function messagingCredentialPlaceholderEnvKey(value: string): string | null {
@@ -1503,7 +1514,7 @@ function assertPayloadStructureAndCredentialShapes(root: unknown): void {
         const child = descriptor.value;
         if (
           isCredentialShapedName(key) &&
-          !isMessagingCredentialPlaceholder(current.path, child) &&
+          !isMessagingCredentialPlaceholder([...current.path, key], child) &&
           !isMessagingPackagePin([...current.path, key], child)
         ) {
           invalid(