fix(web-search): load explicit provider from plugin discovery

goldmar · goldmar · commit 740459d393dd · 2026-06-26T20:42:53.000-07:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4703,7 +4703,6 @@ This audited record covers the complete v2026.5.28..v2026.5.31-beta.4 history: 4
 - Doctor/plugins: remove stale managed install records for bundled plugins even when the bundled plugin is not explicitly configured, so doctor cleanup cannot leave orphaned install metadata behind. Thanks @vincentkoc.
 - Web fetch: scope provider fallback cache entries by the selected fetch provider so config reloads cannot reuse another provider's cached fallback payload. Thanks @vincentkoc.
 - Web search: honor late-bound `tools.web.search.enabled: false` during tool execution so config reloads cannot leave an already-created `web_search` tool runnable. Thanks @vincentkoc.
-- Web search: honor explicit `tools.web.search.provider` and `web_search` provider routing even when stale runtime metadata points at another provider or the active runtime registry is missing the configured provider.
 - Plugins/packages: reject inferred built runtime entries that exist but fail package-boundary checks instead of falling back to TypeScript source for installed packages. Thanks @vincentkoc.
 - Plugins/loader: do not retry native-loaded JavaScript plugin modules through the source transformer after native evaluation has already reached a missing dependency, avoiding duplicate top-level side effects. Thanks @vincentkoc.
 - Plugins/packages: reject blank `openclaw.runtimeExtensions` entries instead of silently ignoring them and falling back to inferred TypeScript runtime entries. Thanks @vincentkoc.
diff --git a/src/agents/tools/web-tool-runtime-context.test.ts b/src/agents/tools/web-tool-runtime-context.test.ts
@@ -127,6 +127,23 @@ describe("web tool runtime context", () => {
     expect(mocks.resolveManifestContractOwnerPluginId).not.toHaveBeenCalled();
   });
 
+  it("keeps fetch provider ids aligned with runtime metadata precedence", () => {
+    resolveWebFetchToolRuntimeContext({
+      config: { tools: { web: { fetch: { provider: "firecrawl" } } } },
+      runtimeWebFetch: {
+        providerConfigured: "perplexity-fetch",
+        providerSource: "configured",
+        selectedProvider: "perplexity-fetch",
+        selectedProviderKeySource: "config",
+        diagnostics: [],
+      },
+    });
+
+    const ownerLookup = latestOwnerLookupParams();
+    expect(ownerLookup.contract).toBe("webFetchProviders");
+    expect(ownerLookup.value).toBe("perplexity-fetch");
+  });
+
   it("keeps runtime providers disabled for bundled fetch owners", async () => {
     mocks.resolveManifestContractOwnerPluginId.mockReturnValue("firecrawl");
 
diff --git a/src/agents/tools/web-tool-runtime-context.ts b/src/agents/tools/web-tool-runtime-context.ts
@@ -34,6 +34,18 @@ function resolveRuntimeWebProviderId(metadata: WebProviderRuntimeMetadata | unde
   return metadata?.selectedProvider ?? metadata?.providerConfigured ?? "";
 }
 
+function resolveWebProviderSelectionId(params: {
+  config: OpenClawConfig | undefined;
+  kind: WebProviderKind;
+  runtimeMetadata: WebProviderRuntimeMetadata | undefined;
+}): string {
+  const configuredProviderId = resolveConfiguredWebProviderId(params.config, params.kind);
+  const runtimeProviderId = resolveRuntimeWebProviderId(params.runtimeMetadata);
+  return params.kind === "search"
+    ? configuredProviderId || runtimeProviderId
+    : runtimeProviderId || configuredProviderId;
+}
+
 function shouldPreferRuntimeProviders(params: {
   config?: OpenClawConfig;
   kind: WebProviderKind;
@@ -69,9 +81,11 @@ function resolveWebToolRuntimeContext<TMetadata extends WebProviderRuntimeMetada
     params.lateBindRuntimeConfig === true
       ? (getActiveSecretsRuntimeConfigSnapshot()?.config ?? params.capturedConfig)
       : params.capturedConfig;
-  const providerSelectionId =
-    resolveConfiguredWebProviderId(config, params.kind) ||
-    resolveRuntimeWebProviderId(runtimeMetadata);
+  const providerSelectionId = resolveWebProviderSelectionId({
+    config,
+    kind: params.kind,
+    runtimeMetadata,
+  });
   return {
     config,
     preferRuntimeProviders: shouldPreferRuntimeProviders({
diff --git a/src/web-search/runtime.test.ts b/src/web-search/runtime.test.ts
@@ -718,7 +718,7 @@ describe("web search runtime", () => {
     ).rejects.toThrow("web_search is disabled or no provider is available.");
   });
 
-  it("ignores auto-detected runtime metadata after config names an unknown provider", async () => {
+  it("fails closed instead of using auto-detected runtime metadata after config names an unknown provider", async () => {
     const createTool = vi.fn(() => createCustomSearchTool());
     resolveRuntimeWebSearchProvidersMock.mockReturnValue([
       createGoogleSearchProvider({
@@ -759,7 +759,7 @@ describe("web search runtime", () => {
         config: structuredClone(config),
         args: { query: "runtime-config-typo" },
       }),
-    ).rejects.toThrow("web_search is disabled or no provider is available.");
+    ).rejects.toThrow('Unknown web_search provider "missing-id".');
     expect(createTool).not.toHaveBeenCalled();
   });
 
@@ -1083,7 +1083,6 @@ describe("web search runtime", () => {
             },
           },
         },
-        providerId: "custom",
         runtimeWebSearch: {
           providerConfigured: "stale",
           selectedProvider: "stale",
@@ -1157,7 +1156,7 @@ describe("web search runtime", () => {
         },
         args: { query: "config-typo" },
       }),
-    ).rejects.toThrow("web_search is disabled or no provider is available.");
+    ).rejects.toThrow('Unknown web_search provider "missing-id".');
   });
 
   it("honors preferRuntimeProviders during execution", async () => {
diff --git a/src/web-search/runtime.ts b/src/web-search/runtime.ts
@@ -4,6 +4,12 @@ import {
   normalizeOptionalLowercaseString,
 } from "@openclaw/normalization-core/string-coerce";
 import { uniqueStrings } from "@openclaw/normalization-core/string-normalization";
+import {
+  hasWebProviderEntryCredential,
+  providerRequiresCredential,
+  readWebProviderEnvValue,
+  resolveWebProviderConfig,
+} from "../../packages/web-content-core/src/provider-runtime-shared.js";
 import { resolveDefaultAgentDir } from "../agents/agent-scope-config.js";
 import { hasAuthProfileForProvider } from "../agents/tools/model-config.helpers.js";
 import {
@@ -22,12 +28,6 @@ import {
 import { sortWebSearchProvidersForAutoDetect } from "../plugins/web-search-providers.shared.js";
 import { getActiveRuntimeWebToolsMetadata } from "../secrets/runtime-web-tools-state.js";
 import type { RuntimeWebSearchMetadata } from "../secrets/runtime-web-tools.types.js";
-import {
-  hasWebProviderEntryCredential,
-  providerRequiresCredential,
-  readWebProviderEnvValue,
-  resolveWebProviderConfig,
-} from "../../packages/web-content-core/src/provider-runtime-shared.js";
 import type {
   ResolveWebSearchDefinitionParams,
   RunWebSearchParams,
@@ -324,24 +324,46 @@ function loadSortedWebSearchProviders(
     preferRuntimeProviders?: boolean;
   },
 ): PluginWebSearchProviderEntry[] {
+  const explicitProviderId = resolveExplicitWebSearchProviderId({
+    search: params.search,
+    providerId: params.providerId,
+  });
   const loadScope = resolveWebSearchProviderLoadScope({
     config: params.config,
     search: params.search,
     runtimeWebSearch: params.runtimeWebSearch,
     providerId: params.providerId,
     includeRuntimeSelection: Boolean(params.preferRuntimeProviders),
   });
-  return sortWebSearchProvidersForAutoDetect(
-    params.preferRuntimeProviders
-      ? resolveRuntimeWebSearchProviders({
-          config: params.config,
-          ...loadScope,
-        })
-      : resolvePluginWebSearchProviders({
-          config: params.config,
-          ...loadScope,
-        }),
-  );
+  if (!params.preferRuntimeProviders) {
+    return sortWebSearchProvidersForAutoDetect(
+      resolvePluginWebSearchProviders({
+        config: params.config,
+        ...loadScope,
+      }),
+    );
+  }
+  const runtimeProviders = resolveRuntimeWebSearchProviders({
+    config: params.config,
+    ...loadScope,
+  });
+  if (
+    !explicitProviderId ||
+    runtimeProviders.some((provider) => provider.id === explicitProviderId)
+  ) {
+    return sortWebSearchProvidersForAutoDetect(runtimeProviders);
+  }
+  const explicitLoadScope = resolveWebSearchProviderLoadScope({
+    config: params.config,
+    search: params.search,
+    providerId: params.providerId,
+    includeRuntimeSelection: false,
+  });
+  const pluginProviders = resolvePluginWebSearchProviders({
+    config: params.config,
+    ...explicitLoadScope,
+  });
+  return sortWebSearchProvidersForAutoDetect([...pluginProviders, ...runtimeProviders]);
 }
 
 function resolveWebSearchCandidates(
@@ -359,14 +381,17 @@ function resolveWebSearchCandidates(
     providerId: options?.providerId,
     preferRuntimeProviders: options?.preferRuntimeProviders,
   }).filter(Boolean);
-  const explicitProviderId = options?.providerId?.trim();
+  const explicitProviderId = resolveExplicitWebSearchProviderId({
+    search,
+    providerId: options?.providerId,
+  });
   if (providers.length === 0) {
     return [];
   }
 
   const preferredIds = uniqueStrings(
     [
-      options?.providerId,
+      explicitProviderId,
       resolveRuntimePreferredWebSearchProviderId({
         config,
         search,
@@ -421,7 +446,7 @@ function hasExplicitWebSearchSelection(params: {
     params.search && "provider" in params.search && typeof params.search.provider === "string"
       ? normalizeLowercaseStringOrEmpty(params.search.provider)
       : "";
-  if (configuredProviderId && availableProviderIds.has(configuredProviderId)) {
+  if (configuredProviderId) {
     return true;
   }
   const runtimeConfiguredId = normalizeOptionalLowercaseString(
