test: speed up slow import-boundary tests

src/memory-host-sdk/host/embeddings-lmstudio.test.ts

@@ -1,17 +1,40 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import type { OpenClawConfig } from "../../config/config.js";
 
 const ensureLmstudioModelLoadedMock = vi.hoisted(() => vi.fn());
 const resolveLmstudioRuntimeApiKeyMock = vi.hoisted(() => vi.fn());
 
-vi.mock("../../plugin-sdk/lmstudio-runtime.js", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("../../plugin-sdk/lmstudio-runtime.js")>();
-  return {
-    ...actual,
-    ensureLmstudioModelLoaded: (...args: unknown[]) => ensureLmstudioModelLoadedMock(...args),
-    resolveLmstudioRuntimeApiKey: (...args: unknown[]) => resolveLmstudioRuntimeApiKeyMock(...args),
-  };
-});
+vi.mock("../../plugin-sdk/lmstudio-runtime.js", () => ({
+  buildLmstudioAuthHeaders: ({
+    apiKey,
+    json,
+    headers,
+  }: {
+    apiKey?: string;
+    json?: boolean;
+    headers?: Record<string, string>;
+  }) => ({
+    ...(json ? { "Content-Type": "application/json" } : {}),
+    ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+    ...headers,
+  }),
+  ensureLmstudioModelLoaded: (...args: unknown[]) => ensureLmstudioModelLoadedMock(...args),
+  LMSTUDIO_DEFAULT_EMBEDDING_MODEL: "text-embedding-nomic-embed-text-v1.5",
+  LMSTUDIO_PROVIDER_ID: "lmstudio",
+  resolveLmstudioInferenceBase: (baseUrl?: string) => {
+    const normalized = (baseUrl || "http://localhost:1234").replace(/\/+$/u, "");
+    if (normalized.endsWith("/api/v1")) {
+      return normalized.slice(0, -"/api/v1".length) + "/v1";
+    }
+    if (normalized.endsWith("/v1")) {
+      return normalized;
+    }
+    return `${normalized}/v1`;
+  },
+  resolveLmstudioProviderHeaders: ({ headers }: { headers?: Record<string, string> }) =>
+    headers ?? {},
+  resolveLmstudioRuntimeApiKey: (...args: unknown[]) => resolveLmstudioRuntimeApiKeyMock(...args),
+}));
 
 let createLmstudioEmbeddingProvider: typeof import("./embeddings-lmstudio.js").createLmstudioEmbeddingProvider;
 
@@ -35,9 +58,11 @@ describe("embeddings-lmstudio", () => {
     return fetchMock;
   }
 
-  beforeEach(async () => {
-    vi.resetModules();
+  beforeAll(async () => {
     ({ createLmstudioEmbeddingProvider } = await import("./embeddings-lmstudio.js"));
+  });
+
+  beforeEach(() => {
     ensureLmstudioModelLoadedMock.mockReset();
     resolveLmstudioRuntimeApiKeyMock.mockReset();
   });

src/plugin-sdk/native-command-config-runtime.ts

@@ -0,0 +1 @@
+export { resolveNativeCommandsEnabled, resolveNativeSkillsEnabled } from "../config/commands.js";

src/plugin-sdk/telegram.ts

@@ -1,5 +1,6 @@
 // Manual facade. Keep loader boundary explicit.
 type FacadeModule = typeof import("@openclaw/telegram/contract-api.js");
+type SecurityAuditFacadeModule = typeof import("@openclaw/telegram/security-audit-contract-api.js");
 import {
   createLazyFacadeArrayValue,
   loadBundledPluginPublicSurfaceModuleSync,
@@ -12,6 +13,13 @@ function loadFacadeModule(): FacadeModule {
   });
 }
 
+function loadSecurityAuditFacadeModule(): SecurityAuditFacadeModule {
+  return loadBundledPluginPublicSurfaceModuleSync<SecurityAuditFacadeModule>({
+    dirName: "telegram",
+    artifactBasename: "security-audit-contract-api.js",
+  });
+}
+
 export const parseTelegramTopicConversation: FacadeModule["parseTelegramTopicConversation"] = ((
   ...args
 ) =>
@@ -24,7 +32,7 @@ export const singleAccountKeysToMove: FacadeModule["singleAccountKeysToMove"] =
 
 export const collectTelegramSecurityAuditFindings: FacadeModule["collectTelegramSecurityAuditFindings"] =
   ((...args) =>
-    loadFacadeModule().collectTelegramSecurityAuditFindings(
+    loadSecurityAuditFacadeModule().collectTelegramSecurityAuditFindings(
       ...args,
     )) as FacadeModule["collectTelegramSecurityAuditFindings"];
 

src/plugins/web-search-credential-presence.test.ts

@@ -0,0 +1,56 @@
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import type { OpenClawConfig } from "../config/types.openclaw.js";
+
+const { resolvePluginWebSearchProvidersMock } = vi.hoisted(() => ({
+  resolvePluginWebSearchProvidersMock: vi.fn(() => [
+    {
+      id: "brave",
+      pluginId: "brave",
+      envVars: ["BRAVE_API_KEY"],
+      getCredentialValue: (searchConfig: Record<string, unknown> | undefined) =>
+        searchConfig?.apiKey,
+    },
+  ]),
+}));
+
+vi.mock("./web-search-providers.runtime.js", () => ({
+  resolvePluginWebSearchProviders: resolvePluginWebSearchProvidersMock,
+}));
+
+let hasConfiguredWebSearchCredential: typeof import("./web-search-credential-presence.js").hasConfiguredWebSearchCredential;
+
+beforeAll(async () => {
+  ({ hasConfiguredWebSearchCredential } = await import("./web-search-credential-presence.js"));
+});
+
+beforeEach(() => {
+  resolvePluginWebSearchProvidersMock.mockClear();
+});
+
+describe("hasConfiguredWebSearchCredential", () => {
+  it("keeps empty config and env on the manifest-only path", () => {
+    expect(
+      hasConfiguredWebSearchCredential({
+        config: {} as OpenClawConfig,
+        env: {},
+        origin: "bundled",
+        bundledAllowlistCompat: true,
+      }),
+    ).toBe(false);
+    expect(resolvePluginWebSearchProvidersMock).not.toHaveBeenCalled();
+  });
+
+  it("loads provider runtime only when a credential candidate exists", () => {
+    expect(
+      hasConfiguredWebSearchCredential({
+        config: {
+          tools: { web: { search: { apiKey: "brave-key" } } },
+        } as OpenClawConfig,
+        env: {},
+        origin: "bundled",
+        bundledAllowlistCompat: true,
+      }),
+    ).toBe(true);
+    expect(resolvePluginWebSearchProvidersMock).toHaveBeenCalledTimes(1);
+  });
+});

src/plugins/web-search-credential-presence.ts

@@ -1,4 +1,5 @@
 import type { OpenClawConfig } from "../config/types.openclaw.js";
+import { loadPluginManifestRegistry } from "./manifest-registry.js";
 import type { PluginManifestRecord } from "./manifest-registry.js";
 import { resolvePluginWebSearchProviders } from "./web-search-providers.runtime.js";
 
@@ -9,6 +10,59 @@ function hasConfiguredCredentialValue(value: unknown): boolean {
   return value !== undefined && value !== null;
 }
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function hasConfiguredSearchCredentialCandidate(searchConfig: unknown): boolean {
+  if (!isRecord(searchConfig)) {
+    return false;
+  }
+  return Object.entries(searchConfig).some(
+    ([key, value]) => key !== "enabled" && hasConfiguredCredentialValue(value),
+  );
+}
+
+function hasConfiguredPluginWebSearchCandidate(config: OpenClawConfig): boolean {
+  const entries = isRecord(config.plugins?.entries) ? config.plugins.entries : undefined;
+  if (!entries) {
+    return false;
+  }
+  return Object.values(entries).some((entry) => {
+    const pluginConfig = isRecord(entry) ? entry.config : undefined;
+    return isRecord(pluginConfig) && hasConfiguredSearchCredentialCandidate(pluginConfig.webSearch);
+  });
+}
+
+function hasManifestWebSearchEnvCredentialCandidate(params: {
+  config: OpenClawConfig;
+  env?: NodeJS.ProcessEnv;
+  origin?: PluginManifestRecord["origin"];
+}): boolean {
+  const env = params.env;
+  if (!env) {
+    return false;
+  }
+  return loadPluginManifestRegistry({
+    config: params.config,
+    env,
+  }).plugins.some((plugin) => {
+    if (params.origin && plugin.origin !== params.origin) {
+      return false;
+    }
+    if ((plugin.contracts?.webSearchProviders?.length ?? 0) === 0) {
+      return false;
+    }
+    const providerAuthEnvVars = plugin.providerAuthEnvVars;
+    if (!providerAuthEnvVars) {
+      return false;
+    }
+    return Object.values(providerAuthEnvVars)
+      .flat()
+      .some((envVar) => hasConfiguredCredentialValue(env[envVar]));
+  });
+}
+
 export function hasConfiguredWebSearchCredential(params: {
   config: OpenClawConfig;
   env?: NodeJS.ProcessEnv;
@@ -19,6 +73,17 @@ export function hasConfiguredWebSearchCredential(params: {
   const searchConfig =
     params.searchConfig ??
     (params.config.tools?.web?.search as Record<string, unknown> | undefined);
+  if (
+    !hasConfiguredSearchCredentialCandidate(searchConfig) &&
+    !hasConfiguredPluginWebSearchCandidate(params.config) &&
+    !hasManifestWebSearchEnvCredentialCandidate({
+      config: params.config,
+      env: params.env,
+      origin: params.origin,
+    })
+  ) {
+    return false;
+  }
   return resolvePluginWebSearchProviders({
     config: params.config,
     env: params.env,