Best possible solution:

Continue review on #95110, land one guarded Tavily-local inspect-mode resolver with exact-head proof, then close or retarget the sibling fallback PRs.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. Current main calls strict Tavily SecretRef normalization before the documented TAVILY_API_KEY fallback, and both Tavily search and extract use that resolver.

Is this the best way to solve the issue?

No. The Tavily resolver is the right boundary, but this branch is not the best implementation because it uses an unsupported mode and discards the SecretRef metadata needed to guard ambient fallback.

Security review:

Security review needs attention: The diff introduces a concrete credential-boundary concern by allowing ambient env fallback after explicit unavailable SecretRefs.

• [medium] Unavailable configured refs can use ambient env — extensions/tavily/src/config.ts:40
  The helper collapses all unavailable configured SecretRefs to undefined, so resolveTavilyApiKey can use process.env.TAVILY_API_KEY even when the configured credential source was file, exec, a different env id, or a provider outside the allowed env path.
  Confidence: 0.92

AGENTS.md: found and applied where relevant.

What I checked:

• PR diff uses invalid SDK mode: The branch passes mode: "configured_unavailable" to resolveSecretInputString, but that string is a result status, not a supported mode. (extensions/tavily/src/config.ts:38, 490e14aead04)
• PR diff drops SecretRef source metadata: The changed helper returns undefined for every non-available result, so resolveTavilyApiKey can later use ambient TAVILY_API_KEY even when the user configured a file, exec, wrong-env, or disallowed-provider ref. (extensions/tavily/src/config.ts:40, 490e14aead04)
• Current main still has the underlying bug: Current main still calls strict normalizeResolvedSecretInputString before reading process.env.TAVILY_API_KEY, so the linked issue remains open until a guarded fix lands. (extensions/tavily/src/config.ts:37, 78f7de01c1aa)
• SDK contract proof: SecretInputStringResolutionMode is "strict" | "inspect"; inspect mode returns configured_unavailable with the ref metadata that a safe fallback decision needs. (src/config/types.secrets.ts:33, 78f7de01c1aa)
• Canonical sibling has the guarded implementation: The open sibling uses mode: "inspect", checks env source, exact TAVILY_API_KEY id, provider allowlist, and blocks nonmatching configured refs before ambient fallback. (extensions/tavily/src/config.ts:53, 3a9963a2bf69)
• Canonical sibling has boundary tests: The sibling adds tests for env fallback, file and exec blocking, wrong env id blocking, whitespace trimming, allowlist blocking, and missing config. (extensions/tavily/src/config.test.ts:31, 3a9963a2bf69)

Likely related people:

• lakshyaag-tavily: Authored the bundled Tavily plugin PR that added extensions/tavily/src/config.ts and the client resolver path this PR changes. (role: introduced behavior; confidence: high; commits: b36e456b0916; files: extensions/tavily/src/config.ts, extensions/tavily/src/tavily-client.ts)
• gumadeiras: Live PR metadata shows this user merged the original bundled Tavily plugin PR that introduced the affected resolver surface. (role: merger and early Tavily reviewer; confidence: medium; commits: b36e456b0916; files: extensions/tavily/src/config.ts, extensions/tavily/src/tavily-client.ts)
• joshavant: Authored and merged the inspect/strict SecretRef contract and adjacent guarded Firecrawl pattern that define the safe repair shape here. (role: adjacent SecretRef contract owner; confidence: high; commits: 1769fb2aa1d6; files: src/config/types.secrets.ts, src/plugin-sdk/secret-input.ts, extensions/firecrawl/src/config.ts)
• lin-hongkuan: Current blame on the Tavily config helper points at a recent repository-wide carry-forward commit, useful for routing recent-main context but not original feature ownership. (role: recent area contributor; confidence: low; commits: bf2a8ecfdb89; files: extensions/tavily/src/config.ts)

Codex review notes: model internal, reasoning high; reviewed against 78f7de01c1aa.