fix: avoid false hardcoded API key warning for env interpolation

src/index.ts

@@ -28,6 +28,9 @@ import type { OpenClawPluginApi } from "openclaw/plugin-sdk";
 import { mkdirSync, existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 
+// Module-level flag: emit hardcoded-key warning only once per process lifetime
+let _apiKeyWarningEmitted = false;
+
 // Dynamic require for node:sqlite (available in Node 22+, avoids TS import issues)
 let NodeDatabaseSync: any;
 try {
@@ -87,6 +90,10 @@ function resolveEnv(value: string): string {
   return value.replace(/\$\{([^}]+)\}/g, (_, key) => process.env[key] ?? "");
 }
 
+function isEnvInterpolation(value: unknown): value is string {
+  return typeof value === "string" && /^\$\{[^}]+\}$/.test(value.trim());
+}
+
 function parseConfig(raw: unknown): EvaMemoryConfig {
   const defaults: EvaMemoryConfig = {
     cortexUrl: "http://localhost:8000",
@@ -1012,9 +1019,13 @@ const cortexPlugin = {
   },
 
   register(api: OpenClawPluginApi) {
+    const rawConfig = api.pluginConfig && typeof api.pluginConfig === "object" && !Array.isArray(api.pluginConfig)
+      ? api.pluginConfig as Record<string, unknown>
+      : null;
     const cfg = parseConfig(api.pluginConfig);
-
-    if (cfg.apiKey && !cfg.apiKey.startsWith("${")) {
+
+    if (cfg.apiKey && !isEnvInterpolation(rawConfig?.apiKey) && !_apiKeyWarningEmitted) {
+      _apiKeyWarningEmitted = true;
       api.logger.warn("cortex: API key appears to be hardcoded in config. Consider using environment variable: apiKey: '${CORTEX_API_KEY}'");
     }
 
@@ -1040,11 +1051,6 @@ const cortexPlugin = {
       api.logger.info("cortex: node:sqlite not available — local cache disabled");
     }
 
-    // Security: warn if API key is hardcoded in config instead of env var
-    if (cfg.apiKey && !cfg.apiKey.startsWith("${")) {
-      api.logger.warn("cortex: API key appears to be hardcoded in config. Consider using environment variable: apiKey: '${CORTEX_API_KEY}'");
-    }
-
     api.logger.info(
       `cortex: registered (cortex=${cfg.cortexUrl}, owner=${cfg.ownerId}, recall=${cfg.autoRecall}, capture=${cfg.autoCapture}, shadow=${cfg.shadowMode})`,
     );

tests/api-key-warning.test.mjs

@@ -0,0 +1,43 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { pathToFileURL } from 'node:url';
+
+async function loadPlugin() {
+  const url = pathToFileURL(new URL('../dist/index.js', import.meta.url).pathname);
+  url.searchParams.set('t', `${Date.now()}-${Math.random()}`);
+  const mod = await import(url.href);
+  return mod.default?.default ?? mod.default ?? mod;
+}
+
+function makeApi(pluginConfig, logger) {
+  const base = { pluginConfig, logger };
+  return new Proxy(base, {
+    get(target, prop) {
+      if (prop in target) return target[prop];
+      return () => {};
+    },
+  });
+}
+
+test('does not warn when apiKey is provided via ${ENV_VAR} interpolation', async () => {
+  process.env.CORTEX_API_KEY = 'secret-from-env';
+  const warnings = [];
+  const plugin = await loadPlugin();
+  plugin.register(makeApi(
+    { apiKey: '${CORTEX_API_KEY}', cortexUrl: 'http://localhost:8000' },
+    { warn: (msg) => warnings.push(msg), info() {} },
+  ));
+
+  assert.equal(warnings.some((msg) => msg.includes('hardcoded in config')), false);
+});
+
+test('warns when apiKey is hardcoded directly in plugin config', async () => {
+  const warnings = [];
+  const plugin = await loadPlugin();
+  plugin.register(makeApi(
+    { apiKey: 'plain-secret', cortexUrl: 'http://localhost:8000' },
+    { warn: (msg) => warnings.push(msg), info() {} },
+  ));
+
+  assert.equal(warnings.some((msg) => msg.includes('hardcoded in config')), true);
+});