perf(secrets): split explicit bundled web provider artifacts

2026-04-12 09:41:11 +00:00 · 2026-04-07 12:14:00 +01:00
parent 8ebd022377
commit 447ab8102a
6 changed files with 261 additions and 203 deletions
--- a/src/plugins/web-provider-public-artifacts.explicit-fast-path.test.ts
+++ b/src/plugins/web-provider-public-artifacts.explicit-fast-path.test.ts
@@ -15,9 +15,9 @@ vi.mock("./manifest-registry.js", async (importOriginal) => {
 });

 import {
-  resolveBundledWebFetchProvidersFromPublicArtifacts,
-  resolveBundledWebSearchProvidersFromPublicArtifacts,
-} from "./web-provider-public-artifacts.js";
+  resolveBundledExplicitWebFetchProvidersFromPublicArtifacts,
+  resolveBundledExplicitWebSearchProvidersFromPublicArtifacts,
+} from "./web-provider-public-artifacts.explicit.js";

 describe("web provider public artifacts explicit fast path", () => {
  beforeEach(() => {
@@ -25,8 +25,7 @@ describe("web provider public artifacts explicit fast path", () => {
  });

  it("resolves bundled web search providers by explicit plugin id without manifest scans", () => {
-    const provider = resolveBundledWebSearchProvidersFromPublicArtifacts({
-      bundledAllowlistCompat: true,
+    const provider = resolveBundledExplicitWebSearchProvidersFromPublicArtifacts({
      onlyPluginIds: ["brave"],
    })?.[0];

@@ -36,8 +35,7 @@ describe("web provider public artifacts explicit fast path", () => {
  });

  it("resolves bundled web fetch providers by explicit plugin id without manifest scans", () => {
-    const provider = resolveBundledWebFetchProvidersFromPublicArtifacts({
-      bundledAllowlistCompat: true,
+    const provider = resolveBundledExplicitWebFetchProvidersFromPublicArtifacts({
      onlyPluginIds: ["firecrawl"],
    })?.[0];

--- a/src/plugins/web-provider-public-artifacts.explicit.ts
+++ b/src/plugins/web-provider-public-artifacts.explicit.ts
@@ -0,0 +1,185 @@
+import { isRecord } from "../utils.js";
+import { loadBundledPluginPublicArtifactModuleSync } from "./public-surface-loader.js";
+import type {
+  PluginWebFetchProviderEntry,
+  PluginWebSearchProviderEntry,
+  WebFetchProviderPlugin,
+  WebSearchProviderPlugin,
+} from "./types.js";
+
+const WEB_SEARCH_ARTIFACT_CANDIDATES = [
+  "web-search-contract-api.js",
+  "web-search-provider.js",
+  "web-search.js",
+] as const;
+const WEB_FETCH_ARTIFACT_CANDIDATES = [
+  "web-fetch-contract-api.js",
+  "web-fetch-provider.js",
+  "web-fetch.js",
+] as const;
+
+function isStringArray(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+
+function isWebSearchProviderPlugin(value: unknown): value is WebSearchProviderPlugin {
+  return (
+    isRecord(value) &&
+    typeof value.id === "string" &&
+    typeof value.label === "string" &&
+    typeof value.hint === "string" &&
+    isStringArray(value.envVars) &&
+    typeof value.placeholder === "string" &&
+    typeof value.signupUrl === "string" &&
+    typeof value.credentialPath === "string" &&
+    typeof value.getCredentialValue === "function" &&
+    typeof value.setCredentialValue === "function" &&
+    typeof value.createTool === "function"
+  );
+}
+
+function isWebFetchProviderPlugin(value: unknown): value is WebFetchProviderPlugin {
+  return (
+    isRecord(value) &&
+    typeof value.id === "string" &&
+    typeof value.label === "string" &&
+    typeof value.hint === "string" &&
+    isStringArray(value.envVars) &&
+    typeof value.placeholder === "string" &&
+    typeof value.signupUrl === "string" &&
+    typeof value.credentialPath === "string" &&
+    typeof value.getCredentialValue === "function" &&
+    typeof value.setCredentialValue === "function" &&
+    typeof value.createTool === "function"
+  );
+}
+
+function collectProviderFactories<TProvider>(params: {
+  mod: Record<string, unknown>;
+  suffix: string;
+  isProvider: (value: unknown) => value is TProvider;
+}): TProvider[] {
+  const providers: TProvider[] = [];
+  for (const [name, exported] of Object.entries(params.mod).toSorted(([left], [right]) =>
+    left.localeCompare(right),
+  )) {
+    if (
+      typeof exported !== "function" ||
+      exported.length !== 0 ||
+      !name.startsWith("create") ||
+      !name.endsWith(params.suffix)
+    ) {
+      continue;
+    }
+    const candidate = exported();
+    if (params.isProvider(candidate)) {
+      providers.push(candidate);
+    }
+  }
+  return providers;
+}
+
+function tryLoadBundledPublicArtifactModule(params: {
+  dirName: string;
+  artifactCandidates: readonly string[];
+}): Record<string, unknown> | null {
+  for (const artifactBasename of params.artifactCandidates) {
+    try {
+      return loadBundledPluginPublicArtifactModuleSync<Record<string, unknown>>({
+        dirName: params.dirName,
+        artifactBasename,
+      });
+    } catch (error) {
+      if (
+        error instanceof Error &&
+        error.message.startsWith("Unable to resolve bundled plugin public surface ")
+      ) {
+        continue;
+      }
+      throw error;
+    }
+  }
+  return null;
+}
+
+function normalizeExplicitBundledPluginIds(pluginIds: readonly string[]): string[] {
+  return [...new Set(pluginIds)].toSorted((left, right) => left.localeCompare(right));
+}
+
+export function loadBundledWebSearchProviderEntriesFromDir(params: {
+  dirName: string;
+  pluginId: string;
+}): PluginWebSearchProviderEntry[] | null {
+  const mod = tryLoadBundledPublicArtifactModule({
+    dirName: params.dirName,
+    artifactCandidates: WEB_SEARCH_ARTIFACT_CANDIDATES,
+  });
+  if (!mod) {
+    return null;
+  }
+  const providers = collectProviderFactories({
+    mod,
+    suffix: "WebSearchProvider",
+    isProvider: isWebSearchProviderPlugin,
+  });
+  if (providers.length === 0) {
+    return null;
+  }
+  return providers.map((provider) => ({ ...provider, pluginId: params.pluginId }));
+}
+
+export function loadBundledWebFetchProviderEntriesFromDir(params: {
+  dirName: string;
+  pluginId: string;
+}): PluginWebFetchProviderEntry[] | null {
+  const mod = tryLoadBundledPublicArtifactModule({
+    dirName: params.dirName,
+    artifactCandidates: WEB_FETCH_ARTIFACT_CANDIDATES,
+  });
+  if (!mod) {
+    return null;
+  }
+  const providers = collectProviderFactories({
+    mod,
+    suffix: "WebFetchProvider",
+    isProvider: isWebFetchProviderPlugin,
+  });
+  if (providers.length === 0) {
+    return null;
+  }
+  return providers.map((provider) => ({ ...provider, pluginId: params.pluginId }));
+}
+
+export function resolveBundledExplicitWebSearchProvidersFromPublicArtifacts(params: {
+  onlyPluginIds: readonly string[];
+}): PluginWebSearchProviderEntry[] | null {
+  const providers: PluginWebSearchProviderEntry[] = [];
+  for (const pluginId of normalizeExplicitBundledPluginIds(params.onlyPluginIds)) {
+    const loadedProviders = loadBundledWebSearchProviderEntriesFromDir({
+      dirName: pluginId,
+      pluginId,
+    });
+    if (!loadedProviders) {
+      return null;
+    }
+    providers.push(...loadedProviders);
+  }
+  return providers;
+}
+
+export function resolveBundledExplicitWebFetchProvidersFromPublicArtifacts(params: {
+  onlyPluginIds: readonly string[];
+}): PluginWebFetchProviderEntry[] | null {
+  const providers: PluginWebFetchProviderEntry[] = [];
+  for (const pluginId of normalizeExplicitBundledPluginIds(params.onlyPluginIds)) {
+    const loadedProviders = loadBundledWebFetchProviderEntriesFromDir({
+      dirName: pluginId,
+      pluginId,
+    });
+    if (!loadedProviders) {
+      return null;
+    }
+    providers.push(...loadedProviders);
+  }
+  return providers;
+}
--- a/src/plugins/web-provider-public-artifacts.ts
+++ b/src/plugins/web-provider-public-artifacts.ts
@@ -1,29 +1,17 @@
 import path from "node:path";
-import { isRecord } from "../utils.js";
 import type { PluginLoadOptions } from "./loader.js";
 import { loadPluginManifestRegistry } from "./manifest-registry.js";
-import { loadBundledPluginPublicArtifactModuleSync } from "./public-surface-loader.js";
-import type {
-  PluginWebFetchProviderEntry,
-  PluginWebSearchProviderEntry,
-  WebFetchProviderPlugin,
-  WebSearchProviderPlugin,
-} from "./types.js";
+import type { PluginWebFetchProviderEntry, PluginWebSearchProviderEntry } from "./types.js";
 import { resolveBundledWebFetchResolutionConfig } from "./web-fetch-providers.shared.js";
+import {
+  loadBundledWebFetchProviderEntriesFromDir,
+  loadBundledWebSearchProviderEntriesFromDir,
+  resolveBundledExplicitWebFetchProvidersFromPublicArtifacts,
+  resolveBundledExplicitWebSearchProvidersFromPublicArtifacts,
+} from "./web-provider-public-artifacts.explicit.js";
 import { resolveManifestDeclaredWebProviderCandidatePluginIds } from "./web-provider-resolution-shared.js";
 import { resolveBundledWebSearchResolutionConfig } from "./web-search-providers.shared.js";

-const WEB_SEARCH_ARTIFACT_CANDIDATES = [
-  "web-search-contract-api.js",
-  "web-search-provider.js",
-  "web-search.js",
-] as const;
-const WEB_FETCH_ARTIFACT_CANDIDATES = [
-  "web-fetch-contract-api.js",
-  "web-fetch-provider.js",
-  "web-fetch.js",
-] as const;
-
 type BundledWebProviderPublicArtifactParams = {
  config?: PluginLoadOptions["config"];
  workspaceDir?: string;
@@ -32,118 +20,6 @@ type BundledWebProviderPublicArtifactParams = {
  onlyPluginIds?: readonly string[];
 };

-function isStringArray(value: unknown): value is string[] {
-  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
-}
-
-function isWebSearchProviderPlugin(value: unknown): value is WebSearchProviderPlugin {
-  return (
-    isRecord(value) &&
-    typeof value.id === "string" &&
-    typeof value.label === "string" &&
-    typeof value.hint === "string" &&
-    isStringArray(value.envVars) &&
-    typeof value.placeholder === "string" &&
-    typeof value.signupUrl === "string" &&
-    typeof value.credentialPath === "string" &&
-    typeof value.getCredentialValue === "function" &&
-    typeof value.setCredentialValue === "function" &&
-    typeof value.createTool === "function"
-  );
-}
-
-function isWebFetchProviderPlugin(value: unknown): value is WebFetchProviderPlugin {
-  return (
-    isRecord(value) &&
-    typeof value.id === "string" &&
-    typeof value.label === "string" &&
-    typeof value.hint === "string" &&
-    isStringArray(value.envVars) &&
-    typeof value.placeholder === "string" &&
-    typeof value.signupUrl === "string" &&
-    typeof value.credentialPath === "string" &&
-    typeof value.getCredentialValue === "function" &&
-    typeof value.setCredentialValue === "function" &&
-    typeof value.createTool === "function"
-  );
-}
-
-function collectProviderFactories<TProvider>(params: {
-  mod: Record<string, unknown>;
-  suffix: string;
-  isProvider: (value: unknown) => value is TProvider;
-}): TProvider[] {
-  const providers: TProvider[] = [];
-  for (const [name, exported] of Object.entries(params.mod).toSorted(([left], [right]) =>
-    left.localeCompare(right),
-  )) {
-    if (
-      typeof exported !== "function" ||
-      exported.length !== 0 ||
-      !name.startsWith("create") ||
-      !name.endsWith(params.suffix)
-    ) {
-      continue;
-    }
-    const candidate = exported();
-    if (params.isProvider(candidate)) {
-      providers.push(candidate);
-    }
-  }
-  return providers;
-}
-
-function tryLoadBundledPublicArtifactModule(params: {
-  dirName: string;
-  artifactCandidates: readonly string[];
-}): Record<string, unknown> | null {
-  for (const artifactBasename of params.artifactCandidates) {
-    try {
-      return loadBundledPluginPublicArtifactModuleSync<Record<string, unknown>>({
-        dirName: params.dirName,
-        artifactBasename,
-      });
-    } catch (error) {
-      if (
-        error instanceof Error &&
-        error.message.startsWith("Unable to resolve bundled plugin public surface ")
-      ) {
-        continue;
-      }
-      throw error;
-    }
-  }
-  return null;
-}
-
-function tryLoadBundledProviderEntriesDirect<TProvider>(params: {
-  pluginIds: readonly string[];
-  artifactCandidates: readonly string[];
-  suffix: string;
-  isProvider: (value: unknown) => value is TProvider;
-}): Array<TProvider & { pluginId: string }> | null {
-  const providers: Array<TProvider & { pluginId: string }> = [];
-  for (const pluginId of params.pluginIds) {
-    const mod = tryLoadBundledPublicArtifactModule({
-      dirName: pluginId,
-      artifactCandidates: params.artifactCandidates,
-    });
-    if (!mod) {
-      return null;
-    }
-    const loadedProviders = collectProviderFactories({
-      mod,
-      suffix: params.suffix,
-      isProvider: params.isProvider,
-    });
-    if (loadedProviders.length === 0) {
-      return null;
-    }
-    providers.push(...loadedProviders.map((provider) => ({ ...provider, pluginId })));
-  }
-  return providers;
-}
-
 function resolveBundledCandidatePluginIds(params: {
  contract: "webSearchProviders" | "webFetchProviders";
  configKey: "webSearch" | "webFetch";
@@ -206,11 +82,8 @@ export function resolveBundledWebSearchProvidersFromPublicArtifacts(
  if (pluginIds.length === 0) {
    return [];
  }
-  const directProviders = tryLoadBundledProviderEntriesDirect({
-    pluginIds,
-    artifactCandidates: WEB_SEARCH_ARTIFACT_CANDIDATES,
-    suffix: "WebSearchProvider",
-    isProvider: isWebSearchProviderPlugin,
+  const directProviders = resolveBundledExplicitWebSearchProvidersFromPublicArtifacts({
+    onlyPluginIds: pluginIds,
  });
  if (directProviders) {
    return directProviders;
@@ -227,22 +100,14 @@ export function resolveBundledWebSearchProvidersFromPublicArtifacts(
    if (!record) {
      return null;
    }
-    const mod = tryLoadBundledPublicArtifactModule({
+    const loadedProviders = loadBundledWebSearchProviderEntriesFromDir({
      dirName: path.basename(record.rootDir),
-      artifactCandidates: WEB_SEARCH_ARTIFACT_CANDIDATES,
+      pluginId,
    });
-    if (!mod) {
+    if (!loadedProviders) {
      return null;
    }
-    const loadedProviders = collectProviderFactories({
-      mod,
-      suffix: "WebSearchProvider",
-      isProvider: isWebSearchProviderPlugin,
-    });
-    if (loadedProviders.length === 0) {
-      return null;
-    }
-    providers.push(...loadedProviders.map((provider) => ({ ...provider, pluginId })));
+    providers.push(...loadedProviders);
  }
  return providers;
 }
@@ -262,11 +127,8 @@ export function resolveBundledWebFetchProvidersFromPublicArtifacts(
  if (pluginIds.length === 0) {
    return [];
  }
-  const directProviders = tryLoadBundledProviderEntriesDirect({
-    pluginIds,
-    artifactCandidates: WEB_FETCH_ARTIFACT_CANDIDATES,
-    suffix: "WebFetchProvider",
-    isProvider: isWebFetchProviderPlugin,
+  const directProviders = resolveBundledExplicitWebFetchProvidersFromPublicArtifacts({
+    onlyPluginIds: pluginIds,
  });
  if (directProviders) {
    return directProviders;
@@ -283,22 +145,14 @@ export function resolveBundledWebFetchProvidersFromPublicArtifacts(
    if (!record) {
      return null;
    }
-    const mod = tryLoadBundledPublicArtifactModule({
+    const loadedProviders = loadBundledWebFetchProviderEntriesFromDir({
      dirName: path.basename(record.rootDir),
-      artifactCandidates: WEB_FETCH_ARTIFACT_CANDIDATES,
+      pluginId,
    });
-    if (!mod) {
+    if (!loadedProviders) {
      return null;
    }
-    const loadedProviders = collectProviderFactories({
-      mod,
-      suffix: "WebFetchProvider",
-      isProvider: isWebFetchProviderPlugin,
-    });
-    if (loadedProviders.length === 0) {
-      return null;
-    }
-    providers.push(...loadedProviders.map((provider) => ({ ...provider, pluginId })));
+    providers.push(...loadedProviders);
  }
  return providers;
 }
--- a/src/secrets/runtime-web-tools-public-artifacts.runtime.ts
+++ b/src/secrets/runtime-web-tools-public-artifacts.runtime.ts
@@ -0,0 +1,4 @@
+export {
+  resolveBundledWebFetchProvidersFromPublicArtifacts,
+  resolveBundledWebSearchProvidersFromPublicArtifacts,
+} from "../plugins/web-provider-public-artifacts.js";
--- a/src/secrets/runtime-web-tools.test.ts
+++ b/src/secrets/runtime-web-tools.test.ts
@@ -14,6 +14,17 @@ const { resolvePluginWebSearchProvidersMock } = vi.hoisted(() => ({
 const { resolvePluginWebFetchProvidersMock } = vi.hoisted(() => ({
  resolvePluginWebFetchProvidersMock: vi.fn(() => buildTestWebFetchProviders()),
 }));
+const {
+  resolveBundledExplicitWebSearchProvidersFromPublicArtifactsMock,
+  resolveBundledExplicitWebFetchProvidersFromPublicArtifactsMock,
+} = vi.hoisted(() => ({
+  resolveBundledExplicitWebSearchProvidersFromPublicArtifactsMock: vi.fn(() =>
+    buildTestWebSearchProviders(),
+  ),
+  resolveBundledExplicitWebFetchProvidersFromPublicArtifactsMock: vi.fn(() =>
+    buildTestWebFetchProviders(),
+  ),
+}));
 const {
  resolveBundledWebSearchProvidersFromPublicArtifactsMock,
  resolveBundledWebFetchProvidersFromPublicArtifactsMock,
@@ -44,7 +55,14 @@ vi.mock("./runtime-web-tools-fallback.runtime.js", async () => {
  };
 });

-vi.mock("../plugins/web-provider-public-artifacts.js", () => ({
+vi.mock("../plugins/web-provider-public-artifacts.explicit.js", () => ({
+  resolveBundledExplicitWebSearchProvidersFromPublicArtifacts:
+    resolveBundledExplicitWebSearchProvidersFromPublicArtifactsMock,
+  resolveBundledExplicitWebFetchProvidersFromPublicArtifacts:
+    resolveBundledExplicitWebFetchProvidersFromPublicArtifactsMock,
+}));
+
+vi.mock("./runtime-web-tools-public-artifacts.runtime.js", () => ({
  resolveBundledWebSearchProvidersFromPublicArtifacts:
    resolveBundledWebSearchProvidersFromPublicArtifactsMock,
  resolveBundledWebFetchProvidersFromPublicArtifacts:
@@ -275,6 +293,8 @@ describe("runtime web tools resolution", () => {
  beforeEach(() => {
    resolvePluginWebSearchProvidersMock.mockClear();
    resolvePluginWebFetchProvidersMock.mockClear();
+    resolveBundledExplicitWebSearchProvidersFromPublicArtifactsMock.mockClear();
+    resolveBundledExplicitWebFetchProvidersFromPublicArtifactsMock.mockClear();
    resolveBundledWebSearchProvidersFromPublicArtifactsMock.mockClear();
    resolveBundledWebFetchProvidersFromPublicArtifactsMock.mockClear();
    resolveManifestContractPluginIdsByCompatibilityRuntimePathMock.mockClear();
@@ -315,6 +335,7 @@ describe("runtime web tools resolution", () => {
    expect(metadata.search.providerSource).toBe("none");
    expect(metadata.fetch.selectedProvider).toBe("firecrawl");
    expect(metadata.fetch.selectedProviderKeySource).toBe("env");
+    expect(resolveBundledExplicitWebSearchProvidersFromPublicArtifactsMock).not.toHaveBeenCalled();
    expect(resolveBundledWebSearchProvidersFromPublicArtifactsMock).not.toHaveBeenCalled();
    expect(resolvePluginWebSearchProvidersMock).not.toHaveBeenCalled();
  });
@@ -350,6 +371,7 @@ describe("runtime web tools resolution", () => {
    expect(metadata.search.selectedProviderKeySource).toBe("secretRef");
    expect(metadata.fetch.selectedProvider).toBeUndefined();
    expect(metadata.fetch.providerSource).toBe("none");
+    expect(resolveBundledExplicitWebFetchProvidersFromPublicArtifactsMock).not.toHaveBeenCalled();
    expect(resolveBundledWebFetchProvidersFromPublicArtifactsMock).not.toHaveBeenCalled();
    expect(resolvePluginWebFetchProvidersMock).not.toHaveBeenCalled();
  });
@@ -773,12 +795,10 @@ describe("runtime web tools resolution", () => {
    });

    expect(metadata.search.selectedProvider).toBe("gemini");
-    expect(resolveBundledWebSearchProvidersFromPublicArtifactsMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        bundledAllowlistCompat: true,
-        onlyPluginIds: ["google"],
-      }),
-    );
+    expect(resolveBundledExplicitWebSearchProvidersFromPublicArtifactsMock).toHaveBeenCalledWith({
+      onlyPluginIds: ["google"],
+    });
+    expect(resolveBundledWebSearchProvidersFromPublicArtifactsMock).not.toHaveBeenCalled();
    expect(resolvePluginWebSearchProvidersMock).not.toHaveBeenCalled();
  });

@@ -806,12 +826,10 @@ describe("runtime web tools resolution", () => {
        origin: "bundled",
      }),
    );
-    expect(resolveBundledWebSearchProvidersFromPublicArtifactsMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        bundledAllowlistCompat: true,
-        onlyPluginIds: ["brave"],
-      }),
-    );
+    expect(resolveBundledExplicitWebSearchProvidersFromPublicArtifactsMock).toHaveBeenCalledWith({
+      onlyPluginIds: ["brave"],
+    });
+    expect(resolveBundledWebSearchProvidersFromPublicArtifactsMock).not.toHaveBeenCalled();
    expect(resolvePluginWebSearchProvidersMock).not.toHaveBeenCalled();
  });

@@ -1215,11 +1233,10 @@ describe("runtime web tools resolution", () => {
    });

    expect(metadata.fetch.selectedProvider).toBe("firecrawl");
-    expect(resolveBundledWebFetchProvidersFromPublicArtifactsMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        bundledAllowlistCompat: true,
-      }),
-    );
+    expect(resolveBundledExplicitWebFetchProvidersFromPublicArtifactsMock).toHaveBeenCalledWith({
+      onlyPluginIds: ["firecrawl"],
+    });
+    expect(resolveBundledWebFetchProvidersFromPublicArtifactsMock).not.toHaveBeenCalled();
    expect(resolvePluginWebFetchProvidersMock).not.toHaveBeenCalled();
  });
 });
--- a/src/secrets/runtime-web-tools.ts
+++ b/src/secrets/runtime-web-tools.ts
@@ -12,9 +12,9 @@ import type {
 } from "../plugins/types.js";
 import { sortWebFetchProvidersForAutoDetect } from "../plugins/web-fetch-providers.shared.js";
 import {
-  resolveBundledWebFetchProvidersFromPublicArtifacts,
-  resolveBundledWebSearchProvidersFromPublicArtifacts,
-} from "../plugins/web-provider-public-artifacts.js";
+  resolveBundledExplicitWebFetchProvidersFromPublicArtifacts,
+  resolveBundledExplicitWebSearchProvidersFromPublicArtifacts,
+} from "../plugins/web-provider-public-artifacts.explicit.js";
 import { sortWebSearchProvidersForAutoDetect } from "../plugins/web-search-providers.shared.js";
 import { createLazyRuntimeSurface } from "../shared/lazy-runtime.js";
 import { normalizeSecretInput } from "../utils/normalize-secret-input.js";
@@ -49,6 +49,10 @@ const loadRuntimeWebToolsFallbackProviders = createLazyRuntimeSurface(
  () => import("./runtime-web-tools-fallback.runtime.js"),
  ({ runtimeWebToolsFallbackProviders }) => runtimeWebToolsFallbackProviders,
 );
+const loadRuntimeWebToolsPublicArtifacts = createLazyRuntimeSurface(
+  () => import("./runtime-web-tools-public-artifacts.runtime.js"),
+  (mod) => mod,
+);

 type FetchConfig = NonNullable<OpenClawConfig["tools"]>["web"] extends infer Web
  ? Web extends { fetch?: infer Fetch }
@@ -283,12 +287,7 @@ async function resolveBundledWebSearchProviders(params: {
        ? [...new Set(params.onlyPluginIds)].toSorted((left, right) => left.localeCompare(right))
        : undefined;
  if (onlyPluginIds && onlyPluginIds.length > 0) {
-    const bundled = resolveBundledWebSearchProvidersFromPublicArtifacts({
-      config: params.sourceConfig,
-      env,
-      bundledAllowlistCompat: true,
-      onlyPluginIds,
-    });
+    const bundled = resolveBundledExplicitWebSearchProvidersFromPublicArtifacts({ onlyPluginIds });
    if (bundled && bundled.length > 0) {
      return bundled;
    }
@@ -302,6 +301,8 @@ async function resolveBundledWebSearchProviders(params: {
    });
  }
  if (!params.hasCustomWebSearchPluginRisk) {
+    const { resolveBundledWebSearchProvidersFromPublicArtifacts } =
+      await loadRuntimeWebToolsPublicArtifacts();
    const bundled = resolveBundledWebSearchProvidersFromPublicArtifacts({
      config: params.sourceConfig,
      env,
@@ -333,10 +334,7 @@ async function resolveBundledWebFetchProviders(params: {
 }): Promise<PluginWebFetchProviderEntry[]> {
  const env = { ...process.env, ...params.context.env };
  if (params.configuredBundledPluginId) {
-    const bundled = resolveBundledWebFetchProvidersFromPublicArtifacts({
-      config: params.sourceConfig,
-      env,
-      bundledAllowlistCompat: true,
+    const bundled = resolveBundledExplicitWebFetchProvidersFromPublicArtifacts({
      onlyPluginIds: [params.configuredBundledPluginId],
    });
    if (bundled && bundled.length > 0) {
@@ -351,6 +349,8 @@ async function resolveBundledWebFetchProviders(params: {
      origin: "bundled",
    });
  }
+  const { resolveBundledWebFetchProvidersFromPublicArtifacts } =
+    await loadRuntimeWebToolsPublicArtifacts();
  const bundled = resolveBundledWebFetchProvidersFromPublicArtifacts({
    config: params.sourceConfig,
    env,