Tools: add xAI-backed code_execution

src/secrets/runtime-config-collectors-core.ts

@@ -292,6 +292,33 @@ function collectMessagesTtsAssignments(params: {
   });
 }
 
+function collectCodeExecutionAssignments(params: {
+  config: OpenClawConfig;
+  defaults: SecretDefaults | undefined;
+  context: ResolverContext;
+}): void {
+  const tools = params.config.tools as Record<string, unknown> | undefined;
+  if (!isRecord(tools)) {
+    return;
+  }
+  const codeExecution = isRecord(tools.code_execution) ? tools.code_execution : undefined;
+  if (!codeExecution) {
+    return;
+  }
+  collectSecretInputAssignment({
+    value: codeExecution.apiKey,
+    path: "tools.code_execution.apiKey",
+    expected: "string",
+    defaults: params.defaults,
+    context: params.context,
+    active: codeExecution.enabled !== false,
+    inactiveReason: "tools.code_execution is disabled.",
+    apply: (value) => {
+      codeExecution.apiKey = value;
+    },
+  });
+}
+
 function collectCronAssignments(params: {
   config: OpenClawConfig;
   defaults: SecretDefaults | undefined;
@@ -425,5 +452,6 @@ export function collectCoreConfigAssignments(params: {
   collectGatewayAssignments(params);
   collectSandboxSshAssignments(params);
   collectMessagesTtsAssignments(params);
+  collectCodeExecutionAssignments(params);
   collectCronAssignments(params);
 }

src/secrets/runtime.coverage.test.ts

@@ -208,6 +208,9 @@ function buildConfigForOpenClawTarget(entry: SecretRegistryEntry, envId: string)
   if (entry.id === "plugins.entries.tavily.config.webSearch.apiKey") {
     setPathCreateStrict(config, ["tools", "web", "search", "provider"], "tavily");
   }
+  if (entry.id === "tools.code_execution.apiKey") {
+    setPathCreateStrict(config, ["tools", "code_execution", "enabled"], true);
+  }
   if (entry.id === "tools.web.x_search.apiKey") {
     setPathCreateStrict(config, ["tools", "web", "x_search", "enabled"], true);
   }

src/secrets/target-registry-data.ts

@@ -703,6 +703,17 @@ const SECRET_TARGET_REGISTRY: SecretTargetRegistryEntry[] = [
     includeInConfigure: true,
     includeInAudit: true,
   },
+  {
+    id: "tools.code_execution.apiKey",
+    targetType: "tools.code_execution.apiKey",
+    configFile: "openclaw.json",
+    pathPattern: "tools.code_execution.apiKey",
+    secretShape: SECRET_INPUT_SHAPE,
+    expectedResolvedValue: "string",
+    includeInPlan: true,
+    includeInConfigure: true,
+    includeInAudit: true,
+  },
   {
     id: "tools.web.fetch.firecrawl.apiKey",
     targetType: "tools.web.fetch.firecrawl.apiKey",