fix(web-search): honor late-bound disabled config

CHANGELOG.md

@@ -61,6 +61,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Web search: honor late-bound `tools.web.search.enabled: false` during tool execution so config reloads cannot leave an already-created `web_search` tool runnable. Thanks @vincentkoc.
 - Plugins/packages: reject inferred built runtime entries that exist but fail package-boundary checks instead of falling back to TypeScript source for installed packages. Thanks @vincentkoc.
 - Plugins/loader: do not retry native-loaded JavaScript plugin modules through the source transformer after native evaluation has already reached a missing dependency, avoiding duplicate top-level side effects. Thanks @vincentkoc.
 - Plugins/packages: reject blank `openclaw.runtimeExtensions` entries instead of silently ignoring them and falling back to inferred TypeScript runtime entries. Thanks @vincentkoc.

src/agents/tools/web-search.late-bind.test.ts

@@ -162,4 +162,20 @@ describe("web_search late-bound runtime fallback", () => {
       }),
     );
   });
+
+  it("honors late-bound disabled search config at execute time", async () => {
+    mocks.getActiveSecretsRuntimeSnapshot.mockReturnValue({
+      config: { tools: { web: { search: { enabled: false } } } },
+    });
+    const { createWebSearchTool } = await import("./web-search.js");
+    const tool = createWebSearchTool({
+      config: { tools: { web: { search: { provider: "brave" } } } },
+      lateBindRuntimeConfig: true,
+    });
+
+    await expect(tool?.execute("call-search", { query: "openclaw" }, undefined)).rejects.toThrow(
+      "web_search is disabled.",
+    );
+    expect(mocks.runWebSearch).not.toHaveBeenCalled();
+  });
 });

src/agents/tools/web-search.ts

@@ -91,6 +91,9 @@ export function createWebSearchTool(options?: {
           lateBindRuntimeConfig: options?.lateBindRuntimeConfig,
           runtimeWebSearch: options?.runtimeWebSearch,
         });
+      if (isWebSearchDisabled(config)) {
+        throw new Error("web_search is disabled.");
+      }
       const result = await runWebSearch({
         config,
         sandboxed: options?.sandboxed,