Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

The bundled x_search tool accepts handle-filter payloads that xAI rejects: both allow and exclude lists together, or either list with more than 20 handles.

Steps to reproduce

1. Resolve the bundled xAI x_search tool on current main.
2. Execute it with both allowed_x_handles and excluded_x_handles, or with 21 values in either list.
3. Observe that OpenClaw forwards the invalid payload to the xAI Responses API instead of rejecting it at the plugin-owned input boundary.

Current regression coverage demonstrates the first case directly: extensions/xai/x-search.test.ts expects both filter lists in one outbound request.

Expected behavior

OpenClaw should reject mutually exclusive allow/exclude filters before network I/O and enforce xAI's documented maximum of 20 handles per list.

Official contract:

• https://docs.x.ai/developers/tools/x-search
• https://github.com/xai-org/xai-sdk-python/blob/da2bb3cfcdddb36d3da31f0f1f4b8043b104a0fe/src/xai_sdk/tools.py#L85-L112
• https://github.com/xai-org/xai-proto/blob/af1be87b733dc177c0857fbd624f1ff12128fbd2/proto/xai/api/v1/chat.proto#L734-L765

Actual behavior

x-search-tool-shared.ts declares both arrays without a maximum, x-search.ts forwards both together, and the existing request-shape test locks that invalid combination in as expected behavior.

OpenClaw version

Current main at d7d210f7e0b990478f290be49b0fb27d622d422e; xAI surface audited at 5ebe040eaa039c47ff1330b950a0e912a54baf66.

Operating system

Platform-independent provider request construction.

Install method

Source checkout / packaged runtime.

Model

xai/grok-4.3

Provider / routing chain

OpenClaw bundled xAI plugin -> xAI Responses API

Additional provider/model setup details

The defect is deterministic before authentication or transport: tool argument validation permits an upstream-invalid request shape.

Logs

No paid live request was made. Current unit coverage serializes both
allowed_x_handles and excluded_x_handles into one x_search request.

Screenshots, recordings, and evidence

• extensions/xai/x-search-tool-shared.ts: no maxItems contract on either handle list.
• extensions/xai/x-search.ts: no mutual-exclusion guard before request construction.
• extensions/xai/x-search.test.ts: existing test expects both lists in the outbound payload.

Impact and severity

Affected: users of x_search structured handle filters.

Severity: moderate, bounded to advanced filter inputs.

Frequency: deterministic for both forbidden combinations and over-limit lists.

Consequence: avoidable provider-side request failure and billed-tool workflow interruption instead of a clear local input error.

Additional information

The clean fix belongs in the xAI plugin input boundary: make the schema advertise the 20-item cap, validate mutual exclusion before network I/O, and replace the invalid request-shape fixture with boundary regressions. No core or provider-routing change is needed.