-- **Tavily plugin SecretRef fallback:** `resolveTavilyApiKey` now uses inspect-mode SecretRef resolution and treats file/exec SecretRefs and env SecretRefs whose id is not `TAVILY_API_KEY` as `blocked`, so a configured non-`TAVILY_API_KEY` credential cannot be silently rewritten to ambient `process.env.TAVILY_API_KEY`. ([PR #95110](https://github.com/openclaw/openclaw/pull/95110), [Issue #95109](https://github.com/openclaw/openclaw/issues/95109)). Thanks @kzzalews.
0 commit comments