Summary

tavily_search and tavily_extract fail at runtime with unresolved SecretRef "env:default:TAVILY_API_KEY" even when TAVILY_API_KEY is set in the gateway process environment.

The configured SecretRef points at an env-backed credential that the active runtime snapshot can't inline-resolve, but the plugin's resolveTavilyApiKey already has a process.env.TAVILY_API_KEY fallback. The throw from normalizeConfiguredSecret (strict mode) fires before that fallback is reached.

Reproduction

export TAVILY_API_KEY=***
openclaw config set plugins.entries.tavily.config.webSearch.apiKey \
  --ref-provider default --ref-source env --ref-id TAVILY_API_KEY
openclaw infer web search --provider tavily --query ping --limit 1 --json

Expected: tavily provider receives the key (or returns an auth error if the key is invalid).

Actual: SecretRef-resolution error; provider never reached.

The same call works fine when the configured apiKey is a plain string (no SecretRef). It also works for the brave and firecrawl web-search providers, which use the companion readConfiguredSecretString helper that catches the same strict-mode throw.

Root cause

extensions/tavily/src/config.ts — normalizeConfiguredSecret calls normalizeResolvedSecretInputString with the default mode: "strict", which throws UnresolvedSecretInputError when the snapshot cannot inline-resolve. The throw escapes the helper before the || normalizeSecretInput(process.env.TAVILY_API_KEY) fallback in resolveTavilyApiKey can rescue the key.

The companion readConfiguredSecretString in extensions/web-search-provider-common/src/web-search-provider-common.ts (used by brave, firecrawl, exa) wraps the same call in a function-local error path that returns undefined. That mismatch is why other web-search plugins work and tavily does not.

Related

• Vendored tavily/exa web-search runtimes fail to read process.env API keys despite keys being demonstrably present #76491 — closed as "implemented on current main", but the vendored tavily/exa helpers still throw in strict mode on the runtime plugin path.
• Bug: CLI web search does not resolve plugin-scoped webSearch SecretRefs #82621 / PR Fix infer SecretRef resolution for provider-backed commands #82798 — closed for the CLI infer web search path; this issue covers the runtime plugin path that Fix infer SecretRef resolution for provider-backed commands #82798 left open.
• PR fix(tavily): keep web_search contract executable #91110 / commit d6b3950734 — addressed the tavily web-search contract registration but not this SecretRef strict-mode throw.

Environment

• OpenClaw: v2026.6.8 (build 2026-06-16)
• Node: v24.16.0
• Plugin: bundled extensions/tavily (added in PR feat: add Tavily as a bundled web search plugin with search and extract tools #49200)
• Verified against main on 2026-06-19: bug still present in extensions/tavily/src/config.ts (last touched 2026-05-10).

Local reproduction

Local patch and SHA-baselined application in kzzalews/mikrus-gitops (prestart.sh step 7/7, commit ab70875) and documented in kzzalews/openclaw (commit e520657).