fix(secrets): keep gateway alive when web provider refs fail#109687
Conversation
openclaw-barnacle
Bot
added
gateway
4b9ee41 to
68f222d
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b9ee410e3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
68f222d to
d4354a0
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d4354a0d71
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
d4354a0 to
185238c
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 185238c07e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
|
|
||
| if (selectedProvider) { | ||
| if (selectedProvider && !unavailableProvider) { |
There was a problem hiding this comment.
Fresh evidence: this tree now suppresses selectedProvider, but when an explicit web_search provider is isolated this branch leaves providerSource: "configured" and providerConfigured in the metadata. hasUsableWebSearchProvider only checks selectedProvider before falling through to resolveWebSearchCandidates, and that path treats providerConfigured as a runtime-preferred explicit provider (src/web-search/runtime.ts:215-230,410-416), so cron/tools-allow preflight (src/cron/isolated-agent/run.ts:399-414) still reports web_search usable even though execution will immediately throw SECRET_SURFACE_UNAVAILABLE for that provider.
Useful? React with 👍 / 👎.
|
Land-ready proof for head 185238c:
Pure bug fix. No UI, config, environment, or feature surface change. |
|
Merged via squash.
|
…w#109687) * fix(secrets): isolate unavailable web providers * fix(secrets): keep web result type internal * fix(secrets): hide unavailable web selections
1 participant
Related: #108485
Related: #101265
Additional instructions
MUST: Keep Allow edits from maintainers enabled for this PR so maintainers
can help update the branch when needed.
What Problem This Solves
Fixes an issue where Gateway startup failed, or silently used provider environment credentials, when an explicitly configured active web-search or web-fetch SecretRef could not resolve.
Why This Change Was Made
Cold startup now isolates only the explicitly configured web provider as a degraded capability. The Gateway starts, unrelated providers remain available, and calls to the isolated provider return the canonical typed unavailable error. Strict reload and command resolution remain fail-closed. The legacy environment fallback after a failed explicit ref is removed; ordinary environment auto-detection remains unchanged.
AI-assisted implementation. I reviewed the owner boundary, runtime callers, command callers, web-tool execution paths, sibling search/fetch behavior, startup activation, tests, and current SecretRef degradation contract.
User Impact
Operators can start the Gateway when one web provider credential ref is temporarily broken. Only that exact provider stays cold, with degraded-owner visibility, instead of blocking the whole Gateway or silently switching credential sources.
Evidence
git patch-id --stable:69fc3d30ad67e44d56fe0b8df2cc6d6d2792e4e9).origin/main; generated branch and main baseline JSON/JSONL are byte-for-byte identical. No SDK surface change comes from this patch.