From ae083f8a22b5dfa4425372865e2fe1e9d3fbab28 Mon Sep 17 00:00:00 2001
From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com>
Date: Mon, 5 Oct 2026 15:33:05 +0530
Subject: [PATCH] fix(line): read the standalone-send token through
 _credentials and pin both strips

_standalone_send still read the access token raw, so a blank or newline-padded token went out as the Bearer header; reuse the hardened _credentials. Pin the token half of the null/blank guard and the env presence strip (both reverted green before). Gate r4 Lows.
---
 plugins/platforms/line/adapter.py | 3 +--
 tests/gateway/test_line_plugin.py | 4 ++++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/plugins/platforms/line/adapter.py b/plugins/platforms/line/adapter.py
index 43b273a261..eebe3a7f0f 100644
--- a/plugins/platforms/line/adapter.py
+++ b/plugins/platforms/line/adapter.py
@@ -932,8 +932,7 @@ async def _standalone_send(
 ) -> Dict[str, Any]:
     """Out-of-process Push delivery for cron jobs detached from the gateway (no inbound event → no
     reply token). ``thread_id`` is ignored (no threads); ``media_files`` need the webhook server."""
-    extra = getattr(pconfig, "extra", {}) or {}
-    token = _get_scoped_secret("LINE_CHANNEL_ACCESS_TOKEN") or extra.get("channel_access_token", "")
+    token = _credentials(pconfig)[0]
     if not token or not chat_id:
         return send_error("LINE standalone send: missing token or chat_id")
     messages = _text_messages(message or "") or [_text_message("")]
diff --git a/tests/gateway/test_line_plugin.py b/tests/gateway/test_line_plugin.py
index 68bd6de597..05721dcd69 100644
--- a/tests/gateway/test_line_plugin.py
+++ b/tests/gateway/test_line_plugin.py
@@ -367,6 +367,8 @@ class TestCheckRequirements:
         monkeypatch.setenv("LINE_CHANNEL_ACCESS_TOKEN", "t")
         monkeypatch.delenv("LINE_CHANNEL_SECRET", raising=False)
         assert not check_requirements()
+        monkeypatch.setenv("LINE_CHANNEL_SECRET", "   ")
+        assert not check_requirements()
 
 
 class TestValidateConfig:
@@ -420,6 +422,8 @@ class TestAdapterInit:
         for blank in ("   ", None):
             assert LineAdapter(PlatformConfig(enabled=True, extra={"channel_access_token": "tok",
                                                                    "channel_secret": blank})).channel_secret == ""
+            assert LineAdapter(PlatformConfig(enabled=True, extra={"channel_access_token": blank,
+                                                                   "channel_secret": "sec"})).channel_access_token == ""
         assert ad.webhook_port == 7777
         assert ad.public_base_url == "https://x.example.com"
         assert ad.allowed_users == {"U1", "U2"}