fix(web-search): honor late-bound disabled config

src/agents/tools/web-search.late-bind.test.ts

@@ -162,4 +162,20 @@ describe("web_search late-bound runtime fallback", () => {
       }),
     );
   });
+
+  it("honors late-bound disabled search config at execute time", async () => {
+    mocks.getActiveSecretsRuntimeSnapshot.mockReturnValue({
+      config: { tools: { web: { search: { enabled: false } } } },
+    });
+    const { createWebSearchTool } = await import("./web-search.js");
+    const tool = createWebSearchTool({
+      config: { tools: { web: { search: { provider: "brave" } } } },
+      lateBindRuntimeConfig: true,
+    });
+
+    await expect(tool?.execute("call-search", { query: "openclaw" }, undefined)).rejects.toThrow(
+      "web_search is disabled.",
+    );
+    expect(mocks.runWebSearch).not.toHaveBeenCalled();
+  });
 });

src/agents/tools/web-search.ts

@@ -91,6 +91,9 @@ export function createWebSearchTool(options?: {
           lateBindRuntimeConfig: options?.lateBindRuntimeConfig,
           runtimeWebSearch: options?.runtimeWebSearch,
         });
+      if (isWebSearchDisabled(config)) {
+        throw new Error("web_search is disabled.");
+      }
       const result = await runWebSearch({
         config,
         sandboxed: options?.sandboxed,