fix(secrets): narrow web search credential deferral

abnershang · abnershang · commit 6459b7b360ee · 2026-07-13T21:47:54.000+08:00
diff --git a/src/plugins/config-contracts.ts b/src/plugins/config-contracts.ts
@@ -12,7 +12,7 @@ export { collectPluginConfigContractMatches } from "./config-contract-matches.js
 type PluginConfigContractMetadata = {
   /** Runtime origin that supplied the contract metadata. */
   origin: PluginOrigin;
-  /** Capability contracts that determine runtime ownership of config subtrees. */
+  /** Capability contracts that determine runtime ownership of exact secret paths. */
   contracts?: PluginManifestContracts;
   /** Manifest-declared config contract paths used by secret/security/config scanners. */
   configContracts: PluginManifestConfigContracts;
diff --git a/src/secrets/runtime-config-collectors-plugins.test.ts b/src/secrets/runtime-config-collectors-plugins.test.ts
@@ -570,4 +570,54 @@ describe("collectPluginConfigAssignments", () => {
       "plugins.entries.other.config.service.tokens.secondary",
     ]);
   });
+
+  it("defers only the exact web-search credential path for active provider plugins", () => {
+    loadPluginManifestRegistryForPluginRegistryMock.mockReturnValue({
+      plugins: [
+        {
+          id: "custom-search",
+          origin: "config",
+          providers: [],
+          legacyPluginIds: [],
+          contracts: { webSearchProviders: ["custom"] },
+          configContracts: {
+            secretInputs: {
+              paths: [
+                { path: "webSearch.apiKey", expected: "string" },
+                { path: "webSearch.headers.authorization", expected: "string" },
+              ],
+            },
+          },
+        },
+      ],
+      diagnostics: [],
+    });
+    const config = asConfig({
+      plugins: {
+        entries: {
+          "custom-search": {
+            enabled: true,
+            config: {
+              webSearch: {
+                apiKey: envRef("A"),
+                headers: { authorization: envRef("B") },
+              },
+            },
+          },
+        },
+      },
+    });
+    const context = makeContext(config);
+
+    collectPluginConfigAssignments({
+      config,
+      defaults: undefined,
+      context,
+      loadablePluginOrigins: loadablePluginOrigins([["custom-search", "config"]]),
+    });
+
+    expect(context.assignments.map((assignment) => assignment.path)).toEqual([
+      "plugins.entries.custom-search.config.webSearch.headers.authorization",
+    ]);
+  });
 });
diff --git a/src/secrets/runtime-config-collectors-plugins.ts b/src/secrets/runtime-config-collectors-plugins.ts
@@ -15,6 +15,7 @@ import {
   type SecretDefaults,
 } from "./runtime-shared.js";
 import { isRecord } from "./shared.js";
+import { listWebProviderSecretConfigPaths } from "./web-provider-secret-configs.js";
 
 function parsePluginConfigArrayIndex(segment: string): number | undefined {
   return parseConfigPathArrayIndex(segment);
@@ -124,9 +125,10 @@ export function collectPluginConfigAssignments(params: {
       pluginConfig,
       secretPaths: secretInputs.paths,
       active: enableState.enabled,
-      runtimeOwnedPathPrefixes: secretInputs.contracts?.webSearchProviders?.length
-        ? ["webSearch."]
-        : [],
+      runtimeOwnedPaths: listWebProviderSecretConfigPaths({
+        contracts: secretInputs.contracts,
+        contract: "webSearchProviders",
+      }),
       inactiveReason: enableState.reason ?? "plugin is disabled.",
       defaults: params.defaults,
       context: params.context,
@@ -139,17 +141,14 @@ function collectConfiguredPluginSecretAssignments(params: {
   pluginConfig: Record<string, unknown>;
   secretPaths: ReadonlyArray<{ path: string; expected?: "string" }>;
   active: boolean;
-  runtimeOwnedPathPrefixes?: readonly string[];
+  runtimeOwnedPaths?: readonly string[];
   inactiveReason: string;
   defaults: SecretDefaults | undefined;
   context: ResolverContext;
 }): void {
   const seenPaths = new Set<string>();
   for (const secretPath of params.secretPaths) {
-    if (
-      params.active &&
-      params.runtimeOwnedPathPrefixes?.some((prefix) => secretPath.path.startsWith(prefix))
-    ) {
+    if (params.active && params.runtimeOwnedPaths?.includes(secretPath.path)) {
       // Web provider selection owns these credentials. Resolving them here would make an
       // inactive or non-selected provider block the whole runtime snapshot.
       continue;
diff --git a/src/secrets/target-registry-data.ts b/src/secrets/target-registry-data.ts
@@ -4,17 +4,14 @@ import type { PluginManifestRecord } from "../plugins/manifest-registry.js";
 import { resolvePluginMetadataSnapshot } from "../plugins/plugin-metadata-snapshot.js";
 import { loadChannelSecretContractApiForRecord } from "./channel-contract-api.js";
 import type { SecretTargetRegistryEntry } from "./target-registry-types.js";
+import {
+  WEB_PROVIDER_SECRET_CONFIGS,
+  type WebProviderSecretConfig,
+} from "./web-provider-secret-configs.js";
 
 const SECRET_INPUT_SHAPE = "secret_input"; // pragma: allowlist secret
 const SIBLING_REF_SHAPE = "sibling_ref"; // pragma: allowlist secret
 
-const WEB_PROVIDER_SECRET_CONFIGS = [
-  { contract: "webSearchProviders", configPath: "webSearch.apiKey" },
-  { contract: "webFetchProviders", configPath: "webFetch.apiKey" },
-] as const;
-
-type WebProviderSecretConfig = (typeof WEB_PROVIDER_SECRET_CONFIGS)[number];
-
 function createPluginOpenClawConfigSecretTargetEntry(
   pluginId: string,
   configPath: string,
diff --git a/src/secrets/web-provider-secret-configs.ts b/src/secrets/web-provider-secret-configs.ts
@@ -0,0 +1,21 @@
+import type { PluginManifestContracts } from "../plugins/manifest.js";
+
+export const WEB_PROVIDER_SECRET_CONFIGS = [
+  { contract: "webSearchProviders", configPath: "webSearch.apiKey" },
+  { contract: "webFetchProviders", configPath: "webFetch.apiKey" },
+] as const;
+
+export type WebProviderSecretConfig = (typeof WEB_PROVIDER_SECRET_CONFIGS)[number];
+
+/** Lists exact provider-owned config paths without loading provider runtime. */
+export function listWebProviderSecretConfigPaths(params: {
+  contracts: PluginManifestContracts | undefined;
+  contract: WebProviderSecretConfig["contract"];
+}): string[] {
+  if ((params.contracts?.[params.contract]?.length ?? 0) === 0) {
+    return [];
+  }
+  return WEB_PROVIDER_SECRET_CONFIGS.filter((config) => config.contract === params.contract).map(
+    (config) => config.configPath,
+  );
+}
