test: isolate bundled plugin coverage from unit

src/infra/matrix.test-helpers.ts

@@ -12,6 +12,7 @@ export const MATRIX_OPS_DEVICE_ID = "DEVICEOPS";
 
 export const matrixHelperEnv = {
   OPENCLAW_BUNDLED_PLUGINS_DIR: (home: string) => path.join(home, "bundled"),
+  OPENCLAW_DISABLE_BUNDLED_PLUGINS: undefined,
   OPENCLAW_DISABLE_PLUGIN_DISCOVERY_CACHE: "1",
   OPENCLAW_VERSION: undefined,
   VITEST: "true",

src/plugins/bundled-dir.test.ts

@@ -6,6 +6,7 @@ import { resolveBundledPluginsDir } from "./bundled-dir.js";
 
 const tempDirs: string[] = [];
 const originalBundledDir = process.env.OPENCLAW_BUNDLED_PLUGINS_DIR;
+const originalDisableBundledPlugins = process.env.OPENCLAW_DISABLE_BUNDLED_PLUGINS;
 const originalVitest = process.env.VITEST;
 const originalArgv1 = process.argv[1];
 
@@ -52,6 +53,7 @@ function expectResolvedBundledDir(params: {
   expectedDir: string;
   argv1?: string;
   bundledDirOverride?: string;
+  disableBundledPlugins?: string;
   vitest?: string;
 }) {
   vi.spyOn(process, "cwd").mockReturnValue(params.cwd);
@@ -66,6 +68,11 @@ function expectResolvedBundledDir(params: {
   } else {
     process.env.OPENCLAW_BUNDLED_PLUGINS_DIR = params.bundledDirOverride;
   }
+  if (params.disableBundledPlugins === undefined) {
+    delete process.env.OPENCLAW_DISABLE_BUNDLED_PLUGINS;
+  } else {
+    process.env.OPENCLAW_DISABLE_BUNDLED_PLUGINS = params.disableBundledPlugins;
+  }
 
   expect(fs.realpathSync(resolveBundledPluginsDir() ?? "")).toBe(
     fs.realpathSync(params.expectedDir),
@@ -122,6 +129,11 @@ afterEach(() => {
   } else {
     process.env.OPENCLAW_BUNDLED_PLUGINS_DIR = originalBundledDir;
   }
+  if (originalDisableBundledPlugins === undefined) {
+    delete process.env.OPENCLAW_DISABLE_BUNDLED_PLUGINS;
+  } else {
+    process.env.OPENCLAW_DISABLE_BUNDLED_PLUGINS = originalDisableBundledPlugins;
+  }
   if (originalVitest === undefined) {
     delete process.env.VITEST;
   } else {
@@ -192,6 +204,25 @@ describe("resolveBundledPluginsDir", () => {
     });
   });
 
+  it("returns a stable empty bundled plugin directory when bundled plugins are disabled", () => {
+    const repoRoot = createOpenClawRoot({
+      prefix: "openclaw-bundled-dir-disabled-",
+      hasExtensions: true,
+      hasSrc: true,
+      hasGitCheckout: true,
+    });
+    vi.spyOn(process, "cwd").mockReturnValue(repoRoot);
+    process.argv[1] = "/usr/bin/env";
+    process.env.OPENCLAW_DISABLE_BUNDLED_PLUGINS = "1";
+    delete process.env.OPENCLAW_BUNDLED_PLUGINS_DIR;
+
+    const bundledDir = resolveBundledPluginsDir();
+
+    expect(bundledDir).toBeTruthy();
+    expect(fs.existsSync(bundledDir ?? "")).toBe(true);
+    expect(fs.readdirSync(bundledDir ?? "")).toEqual([]);
+  });
+
   it.each([
     {
       name: "prefers the running CLI package root over an unrelated cwd checkout",

src/plugins/bundled-dir.ts

@@ -1,9 +1,22 @@
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveOpenClawPackageRootSync } from "../infra/openclaw-root.js";
 import { resolveUserPath } from "../utils.js";
 
+const DISABLED_BUNDLED_PLUGINS_DIR = path.join(os.tmpdir(), "openclaw-empty-bundled-plugins");
+
+function bundledPluginsDisabled(env: NodeJS.ProcessEnv): boolean {
+  const raw = env.OPENCLAW_DISABLE_BUNDLED_PLUGINS?.trim().toLowerCase();
+  return raw === "1" || raw === "true";
+}
+
+function resolveDisabledBundledPluginsDir(): string {
+  fs.mkdirSync(DISABLED_BUNDLED_PLUGINS_DIR, { recursive: true });
+  return DISABLED_BUNDLED_PLUGINS_DIR;
+}
+
 function isSourceCheckoutRoot(packageRoot: string): boolean {
   return (
     fs.existsSync(path.join(packageRoot, ".git")) &&
@@ -38,6 +51,10 @@ function resolveBundledDirFromPackageRoot(
 }
 
 export function resolveBundledPluginsDir(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  if (bundledPluginsDisabled(env)) {
+    return resolveDisabledBundledPluginsDir();
+  }
+
   const override = env.OPENCLAW_BUNDLED_PLUGINS_DIR?.trim();
   if (override) {
     const resolvedOverride = resolveUserPath(override, env);

src/plugins/bundled-web-search.test.ts

@@ -1,58 +1,137 @@
-import { beforeAll, describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import type { OpenClawConfig } from "../config/config.js";
+import { loadBundledCapabilityRuntimeRegistry } from "./bundled-capability-runtime.js";
 import { BUNDLED_WEB_SEARCH_PLUGIN_IDS } from "./bundled-web-search-ids.js";
+import { hasBundledWebSearchCredential } from "./bundled-web-search-registry.js";
+import {
+  listBundledWebSearchPluginIds,
+  listBundledWebSearchProviders,
+  resolveBundledWebSearchPluginId,
+  resolveBundledWebSearchPluginIds,
+} from "./bundled-web-search.js";
 import { loadPluginManifestRegistry } from "./manifest-registry.js";
 
-let hasBundledWebSearchCredential: typeof import("./bundled-web-search-registry.js").hasBundledWebSearchCredential;
-let listBundledWebSearchProviders: typeof import("./bundled-web-search.js").listBundledWebSearchProviders;
-let resolveBundledWebSearchPluginIds: typeof import("./bundled-web-search.js").resolveBundledWebSearchPluginIds;
+vi.mock("./manifest-registry.js", () => ({
+  loadPluginManifestRegistry: vi.fn(),
+}));
 
-function resolveManifestBundledWebSearchPluginIds() {
-  return loadPluginManifestRegistry({})
-    .plugins.filter(
-      (plugin) =>
-        plugin.origin === "bundled" && (plugin.contracts?.webSearchProviders?.length ?? 0) > 0,
-    )
-    .map((plugin) => plugin.id)
-    .toSorted((left, right) => left.localeCompare(right));
-}
+vi.mock("./bundled-capability-runtime.js", () => ({
+  loadBundledCapabilityRuntimeRegistry: vi.fn(),
+}));
 
-async function resolveRegistryBundledWebSearchPluginIds() {
-  return listBundledWebSearchProviders()
-    .map(({ pluginId }) => pluginId)
-    .filter((value, index, values) => values.indexOf(value) === index)
-    .toSorted((left, right) => left.localeCompare(right));
-}
+const resolveBundledPluginWebSearchProvidersMock = vi.hoisted(() => vi.fn());
 
-beforeAll(async () => {
-  ({ listBundledWebSearchProviders, resolveBundledWebSearchPluginIds } =
-    await import("./bundled-web-search.js"));
-  ({ hasBundledWebSearchCredential } = await import("./bundled-web-search-registry.js"));
-});
+vi.mock("./web-search-providers.js", () => ({
+  resolveBundledPluginWebSearchProviders: resolveBundledPluginWebSearchProvidersMock,
+}));
 
-function expectBundledWebSearchIds(actual: readonly string[], expected: readonly string[]) {
-  expect(actual).toEqual(expected);
-}
-
-function expectBundledWebSearchAlignment(params: {
-  actual: readonly string[];
-  expected: readonly string[];
+function createMockedBundledWebSearchProvider(params: {
+  pluginId: string;
+  providerId: string;
+  configuredCredential?: unknown;
+  scopedCredential?: unknown;
+  envVars?: string[];
 }) {
-  expectBundledWebSearchIds(params.actual, params.expected);
+  return {
+    pluginId: params.pluginId,
+    id: params.providerId,
+    label: params.providerId,
+    hint: `${params.providerId} provider`,
+    envVars: params.envVars ?? [],
+    placeholder: `${params.providerId}-key`,
+    signupUrl: `https://example.com/${params.providerId}`,
+    autoDetectOrder: 10,
+    credentialPath: `plugins.entries.${params.pluginId}.config.webSearch.apiKey`,
+    getCredentialValue: () => params.scopedCredential,
+    getConfiguredCredentialValue: () => params.configuredCredential,
+    setCredentialValue: () => {},
+    createTool: () => ({
+      description: params.providerId,
+      parameters: {},
+      execute: async () => ({}),
+    }),
+  };
 }
 
-describe("bundled web search metadata", () => {
-  it("keeps bundled web search compat ids aligned with bundled manifests", async () => {
-    expectBundledWebSearchAlignment({
-      actual: resolveBundledWebSearchPluginIds({}),
-      expected: resolveManifestBundledWebSearchPluginIds(),
+describe("bundled web search helpers", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(loadPluginManifestRegistry).mockReturnValue({
+      plugins: [
+        { id: "xai", origin: "bundled" },
+        { id: "google", origin: "bundled" },
+        { id: "noise", origin: "bundled" },
+        { id: "external-google", origin: "workspace" },
+      ] as never[],
+      diagnostics: [],
+    });
+    vi.mocked(loadBundledCapabilityRuntimeRegistry).mockReturnValue({
+      webSearchProviders: [
+        {
+          pluginId: "xai",
+          provider: createMockedBundledWebSearchProvider({
+            pluginId: "xai",
+            providerId: "grok",
+          }),
+        },
+        {
+          pluginId: "google",
+          provider: createMockedBundledWebSearchProvider({
+            pluginId: "google",
+            providerId: "gemini",
+          }),
+        },
+      ],
+    } as never);
+  });
+
+  it("filters bundled manifest entries down to known bundled web search plugins", () => {
+    expect(
+      resolveBundledWebSearchPluginIds({
+        config: {
+          plugins: {
+            allow: ["google", "xai"],
+          },
+        },
+        workspaceDir: "/tmp/workspace",
+        env: { OPENCLAW_HOME: "/tmp/openclaw-home" },
+      }),
+    ).toEqual(["google", "xai"]);
+    expect(loadPluginManifestRegistry).toHaveBeenCalledWith({
+      config: {
+        plugins: {
+          allow: ["google", "xai"],
+        },
+      },
+      workspaceDir: "/tmp/workspace",
+      env: { OPENCLAW_HOME: "/tmp/openclaw-home" },
     });
   });
 
-  it("keeps bundled web search fast-path ids aligned with the registry", async () => {
-    expectBundledWebSearchAlignment({
-      actual: [...BUNDLED_WEB_SEARCH_PLUGIN_IDS],
-      expected: await resolveRegistryBundledWebSearchPluginIds(),
+  it("returns a copy of the bundled plugin id fast-path list", () => {
+    const listed = listBundledWebSearchPluginIds();
+    expect(listed).toEqual([...BUNDLED_WEB_SEARCH_PLUGIN_IDS]);
+    expect(listed).not.toBe(BUNDLED_WEB_SEARCH_PLUGIN_IDS);
+  });
+
+  it("maps bundled provider ids back to their owning plugins", () => {
+    expect(resolveBundledWebSearchPluginId(" gemini ")).toBe("google");
+    expect(resolveBundledWebSearchPluginId("missing")).toBeUndefined();
+  });
+
+  it("loads bundled provider entries through the capability runtime registry once", () => {
+    expect(listBundledWebSearchProviders()).toEqual([
+      expect.objectContaining({ pluginId: "xai", id: "grok" }),
+      expect.objectContaining({ pluginId: "google", id: "gemini" }),
+    ]);
+    expect(listBundledWebSearchProviders()).toEqual([
+      expect.objectContaining({ pluginId: "xai", id: "grok" }),
+      expect.objectContaining({ pluginId: "google", id: "gemini" }),
+    ]);
+    expect(loadBundledCapabilityRuntimeRegistry).toHaveBeenCalledTimes(1);
+    expect(loadBundledCapabilityRuntimeRegistry).toHaveBeenCalledWith({
+      pluginIds: BUNDLED_WEB_SEARCH_PLUGIN_IDS,
+      pluginSdkResolution: "dist",
     });
   });
 });
@@ -64,45 +143,68 @@ describe("hasBundledWebSearchCredential", () => {
     tools: { web: { fetch: { enabled: false } } },
   } satisfies OpenClawConfig;
 
+  beforeEach(() => {
+    resolveBundledPluginWebSearchProvidersMock.mockReset();
+  });
+
   it.each([
     {
-      name: "detects google plugin web search credentials",
-      config: {
-        ...baseCfg,
-        plugins: {
-          entries: {
-            google: { enabled: true, config: { webSearch: { apiKey: "AIza-test" } } },
-          },
-        },
-      } satisfies OpenClawConfig,
+      name: "detects configured plugin credentials",
+      providers: [
+        createMockedBundledWebSearchProvider({
+          pluginId: "google",
+          providerId: "gemini",
+          configuredCredential: "AIza-test",
+        }),
+      ],
+      config: baseCfg,
       env: {},
     },
     {
-      name: "detects gemini env credentials",
+      name: "detects scoped tool credentials",
+      providers: [
+        createMockedBundledWebSearchProvider({
+          pluginId: "google",
+          providerId: "gemini",
+          scopedCredential: "AIza-test",
+        }),
+      ],
       config: baseCfg,
-      env: { GEMINI_API_KEY: "AIza-test" },
+      env: {},
+      searchConfig: { provider: "gemini" },
     },
     {
-      name: "detects xai env credentials",
+      name: "detects env credentials",
+      providers: [
+        createMockedBundledWebSearchProvider({
+          pluginId: "xai",
+          providerId: "grok",
+          envVars: ["XAI_API_KEY"],
+        }),
+      ],
       config: baseCfg,
       env: { XAI_API_KEY: "xai-test" },
     },
-    {
-      name: "detects kimi env credentials",
-      config: baseCfg,
-      env: { KIMI_API_KEY: "sk-kimi-test" },
-    },
-    {
-      name: "detects moonshot env credentials",
-      config: baseCfg,
-      env: { MOONSHOT_API_KEY: "sk-moonshot-test" },
-    },
-    {
-      name: "detects openrouter env credentials through bundled web search providers",
-      config: baseCfg,
-      env: { OPENROUTER_API_KEY: "sk-or-v1-test" },
-    },
-  ] as const)("$name", async ({ config, env }) => {
-    expect(hasBundledWebSearchCredential({ config, env })).toBe(true);
+  ] as const)("$name", ({ providers, config, env, searchConfig }) => {
+    resolveBundledPluginWebSearchProvidersMock.mockReturnValue(providers);
+
+    expect(hasBundledWebSearchCredential({ config, env, searchConfig })).toBe(true);
+    expect(resolveBundledPluginWebSearchProvidersMock).toHaveBeenCalledWith({
+      config,
+      env,
+      bundledAllowlistCompat: true,
+    });
+  });
+
+  it("returns false when no bundled provider exposes a configured credential", () => {
+    resolveBundledPluginWebSearchProvidersMock.mockReturnValue([
+      createMockedBundledWebSearchProvider({
+        pluginId: "google",
+        providerId: "gemini",
+        envVars: ["GEMINI_API_KEY"],
+      }),
+    ]);
+
+    expect(hasBundledWebSearchCredential({ config: baseCfg, env: {} })).toBe(false);
   });
 });

src/plugins/cli.browser-plugin.integration.test.ts

@@ -40,6 +40,7 @@ describe("registerPluginCliCommands browser plugin integration", () => {
       cache: false,
       env: {
         ...process.env,
+        OPENCLAW_DISABLE_BUNDLED_PLUGINS: undefined,
         OPENCLAW_BUNDLED_PLUGINS_DIR:
           bundledFixture?.rootDir ?? path.join(process.cwd(), "extensions"),
       } as NodeJS.ProcessEnv,
@@ -61,6 +62,12 @@ describe("registerPluginCliCommands browser plugin integration", () => {
         },
       } as OpenClawConfig,
       cache: false,
+      env: {
+        ...process.env,
+        OPENCLAW_DISABLE_BUNDLED_PLUGINS: undefined,
+        OPENCLAW_BUNDLED_PLUGINS_DIR:
+          bundledFixture?.rootDir ?? path.join(process.cwd(), "extensions"),
+      } as NodeJS.ProcessEnv,
     });
 
     expect(registry.cliRegistrars.flatMap((entry) => entry.commands)).not.toContain("browser");

src/plugins/discovery.test.ts

@@ -699,6 +699,7 @@ describe("discoverOpenClawPlugins", () => {
       const result = discoverOpenClawPlugins({
         env: {
           ...process.env,
+          OPENCLAW_DISABLE_BUNDLED_PLUGINS: undefined,
           OPENCLAW_STATE_DIR: stateDir,
           OPENCLAW_BUNDLED_PLUGINS_DIR: bundledDir,
         },

src/plugins/stage-bundled-plugin-runtime.test.ts

@@ -338,6 +338,7 @@ describe("stageBundledPluginRuntime", () => {
 
     const env = {
       ...process.env,
+      OPENCLAW_DISABLE_BUNDLED_PLUGINS: undefined,
       OPENCLAW_BUNDLED_PLUGINS_DIR: runtimeExtensionsDir,
     };
     const discovery = discoverOpenClawPlugins({

src/plugins/web-search-providers.test.ts

@@ -1,7 +1,15 @@
-import { describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { PluginWebSearchProviderEntry } from "./types.js";
 import { resolveBundledPluginWebSearchProviders } from "./web-search-providers.js";
 
-const WEB_SEARCH_PROVIDER_TEST_TIMEOUT_MS = 300_000;
+const listBundledWebSearchProvidersMock = vi.hoisted(() => vi.fn());
+const resolveBundledWebSearchPluginIdsMock = vi.hoisted(() => vi.fn());
+
+vi.mock("./bundled-web-search.js", () => ({
+  listBundledWebSearchProviders: listBundledWebSearchProvidersMock,
+  resolveBundledWebSearchPluginIds: resolveBundledWebSearchPluginIdsMock,
+}));
+
 const EXPECTED_BUNDLED_WEB_SEARCH_PROVIDER_KEYS = [
   "brave:brave",
   "duckduckgo:duckduckgo",
@@ -39,6 +47,119 @@ const EXPECTED_BUNDLED_WEB_SEARCH_CREDENTIAL_PATHS = [
   "plugins.entries.tavily.config.webSearch.apiKey",
 ] as const;
 
+function createBundledWebSearchProviderEntry(params: {
+  pluginId: string;
+  providerId: string;
+  credentialPath: string;
+  order: number;
+  withApplySelectionConfig?: boolean;
+  withResolveRuntimeMetadata?: boolean;
+}): PluginWebSearchProviderEntry {
+  return {
+    pluginId: params.pluginId,
+    id: params.providerId,
+    label: params.providerId,
+    hint: `${params.providerId} provider`,
+    envVars: [],
+    placeholder: `${params.providerId}-key`,
+    signupUrl: `https://example.com/${params.providerId}`,
+    autoDetectOrder: params.order,
+    credentialPath: params.credentialPath,
+    getCredentialValue: () => undefined,
+    setCredentialValue: () => {},
+    ...(params.withApplySelectionConfig
+      ? {
+          applySelectionConfig: () => ({
+            plugins: {
+              entries: {
+                [params.pluginId]: {
+                  enabled: true,
+                },
+              },
+            },
+          }),
+        }
+      : {}),
+    ...(params.withResolveRuntimeMetadata
+      ? {
+          resolveRuntimeMetadata: () => ({
+            selectedProvider: params.providerId,
+          }),
+        }
+      : {}),
+    createTool: () => ({
+      description: params.providerId,
+      parameters: {},
+      execute: async () => ({}),
+    }),
+  };
+}
+
+const BUNDLED_WEB_SEARCH_PROVIDERS: PluginWebSearchProviderEntry[] = [
+  createBundledWebSearchProviderEntry({
+    pluginId: "duckduckgo",
+    providerId: "duckduckgo",
+    credentialPath: "",
+    order: 100,
+  }),
+  createBundledWebSearchProviderEntry({
+    pluginId: "moonshot",
+    providerId: "kimi",
+    credentialPath: "plugins.entries.moonshot.config.webSearch.apiKey",
+    order: 40,
+  }),
+  createBundledWebSearchProviderEntry({
+    pluginId: "brave",
+    providerId: "brave",
+    credentialPath: "plugins.entries.brave.config.webSearch.apiKey",
+    order: 10,
+  }),
+  createBundledWebSearchProviderEntry({
+    pluginId: "perplexity",
+    providerId: "perplexity",
+    credentialPath: "plugins.entries.perplexity.config.webSearch.apiKey",
+    order: 50,
+    withResolveRuntimeMetadata: true,
+  }),
+  createBundledWebSearchProviderEntry({
+    pluginId: "firecrawl",
+    providerId: "firecrawl",
+    credentialPath: "plugins.entries.firecrawl.config.webSearch.apiKey",
+    order: 60,
+    withApplySelectionConfig: true,
+  }),
+  createBundledWebSearchProviderEntry({
+    pluginId: "google",
+    providerId: "gemini",
+    credentialPath: "plugins.entries.google.config.webSearch.apiKey",
+    order: 20,
+  }),
+  createBundledWebSearchProviderEntry({
+    pluginId: "tavily",
+    providerId: "tavily",
+    credentialPath: "plugins.entries.tavily.config.webSearch.apiKey",
+    order: 80,
+  }),
+  createBundledWebSearchProviderEntry({
+    pluginId: "exa",
+    providerId: "exa",
+    credentialPath: "plugins.entries.exa.config.webSearch.apiKey",
+    order: 55,
+  }),
+  createBundledWebSearchProviderEntry({
+    pluginId: "searxng",
+    providerId: "searxng",
+    credentialPath: "plugins.entries.searxng.config.webSearch.baseUrl",
+    order: 70,
+  }),
+  createBundledWebSearchProviderEntry({
+    pluginId: "xai",
+    providerId: "grok",
+    credentialPath: "plugins.entries.xai.config.webSearch.apiKey",
+    order: 30,
+  }),
+];
+
 function toProviderKeys(
   providers: ReturnType<typeof resolveBundledPluginWebSearchProviders>,
 ): string[] {
@@ -91,6 +212,15 @@ function expectBundledWebSearchResolution(params: {
 }
 
 describe("resolveBundledPluginWebSearchProviders", () => {
+  beforeEach(() => {
+    listBundledWebSearchProvidersMock.mockReset();
+    listBundledWebSearchProvidersMock.mockReturnValue(BUNDLED_WEB_SEARCH_PROVIDERS);
+    resolveBundledWebSearchPluginIdsMock.mockReset();
+    resolveBundledWebSearchPluginIdsMock.mockReturnValue([
+      ...EXPECTED_BUNDLED_WEB_SEARCH_PROVIDER_PLUGIN_IDS,
+    ]);
+  });
+
   it.each([
     {
       title: "returns bundled providers in alphabetical order",
@@ -102,7 +232,7 @@ describe("resolveBundledPluginWebSearchProviders", () => {
         bundledAllowlistCompat: true,
       },
     },
-  ] as const)("$title", { timeout: WEB_SEARCH_PROVIDER_TEST_TIMEOUT_MS }, ({ options }) => {
+  ] as const)("$title", ({ options }) => {
     const providers = resolveBundledPluginWebSearchProviders(options);
 
     expectBundledWebSearchProviders(providers);

src/secrets/runtime.coverage.test.ts

@@ -1,7 +1,10 @@
 import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import type { AuthProfileStore } from "../agents/auth-profiles.js";
 import type { OpenClawConfig } from "../config/config.js";
-import type { PluginWebSearchProviderEntry } from "../plugins/types.js";
+import type {
+  PluginWebFetchProviderEntry,
+  PluginWebSearchProviderEntry,
+} from "../plugins/types.js";
 import { getPath, setPathCreateStrict } from "./path-utils.js";
 import { canonicalizeSecretTargetCoverageId } from "./target-registry-test-helpers.js";
 import { listSecretTargetRegistryEntries } from "./target-registry.js";
@@ -13,6 +16,11 @@ const { resolveBundledPluginWebSearchProvidersMock, resolvePluginWebSearchProvid
     resolveBundledPluginWebSearchProvidersMock: vi.fn(() => buildTestWebSearchProviders()),
     resolvePluginWebSearchProvidersMock: vi.fn(() => buildTestWebSearchProviders()),
   }));
+const { resolveBundledPluginWebFetchProvidersMock, resolvePluginWebFetchProvidersMock } =
+  vi.hoisted(() => ({
+    resolveBundledPluginWebFetchProvidersMock: vi.fn(() => buildTestWebFetchProviders()),
+    resolvePluginWebFetchProvidersMock: vi.fn(() => buildTestWebFetchProviders()),
+  }));
 
 let clearSecretsRuntimeSnapshot: typeof import("./runtime.js").clearSecretsRuntimeSnapshot;
 let prepareSecretsRuntimeSnapshot: typeof import("./runtime.js").prepareSecretsRuntimeSnapshot;
@@ -25,6 +33,14 @@ vi.mock("../plugins/web-search-providers.runtime.js", () => ({
   resolvePluginWebSearchProviders: resolvePluginWebSearchProvidersMock,
 }));
 
+vi.mock("../plugins/web-fetch-providers.js", () => ({
+  resolveBundledPluginWebFetchProviders: resolveBundledPluginWebFetchProvidersMock,
+}));
+
+vi.mock("../plugins/web-fetch-providers.runtime.js", () => ({
+  resolvePluginWebFetchProviders: resolvePluginWebFetchProvidersMock,
+}));
+
 function createTestProvider(params: {
   id: "brave" | "gemini" | "grok" | "kimi" | "perplexity" | "firecrawl" | "tavily";
   pluginId: string;
@@ -90,6 +106,42 @@ function buildTestWebSearchProviders(): PluginWebSearchProviderEntry[] {
   ];
 }
 
+function buildTestWebFetchProviders(): PluginWebFetchProviderEntry[] {
+  return [
+    {
+      pluginId: "firecrawl",
+      id: "firecrawl",
+      label: "firecrawl",
+      hint: "firecrawl test provider",
+      envVars: ["FIRECRAWL_API_KEY"],
+      placeholder: "fc-...",
+      signupUrl: "https://example.com/firecrawl",
+      autoDetectOrder: 50,
+      credentialPath: "plugins.entries.firecrawl.config.webFetch.apiKey",
+      inactiveSecretPaths: ["plugins.entries.firecrawl.config.webFetch.apiKey"],
+      getCredentialValue: (fetchConfig) => fetchConfig?.apiKey,
+      setCredentialValue: (fetchConfigTarget, value) => {
+        fetchConfigTarget.apiKey = value;
+      },
+      getConfiguredCredentialValue: (config) => {
+        const entryConfig = config?.plugins?.entries?.firecrawl?.config;
+        return entryConfig && typeof entryConfig === "object"
+          ? (entryConfig as { webFetch?: { apiKey?: unknown } }).webFetch?.apiKey
+          : undefined;
+      },
+      setConfiguredCredentialValue: (configTarget, value) => {
+        const plugins = (configTarget.plugins ??= {}) as { entries?: Record<string, unknown> };
+        const entries = (plugins.entries ??= {});
+        const entry = (entries.firecrawl ??= {}) as { config?: Record<string, unknown> };
+        const config = (entry.config ??= {});
+        const webFetch = (config.webFetch ??= {}) as { apiKey?: unknown };
+        webFetch.apiKey = value;
+      },
+      createTool: () => null,
+    },
+  ];
+}
+
 function toConcretePathSegments(pathPattern: string): string[] {
   const segments = pathPattern.split(".").filter(Boolean);
   const out: string[] = [];
@@ -250,6 +302,8 @@ describe("secrets runtime target coverage", () => {
     clearSecretsRuntimeSnapshot();
     resolveBundledPluginWebSearchProvidersMock.mockReset();
     resolvePluginWebSearchProvidersMock.mockReset();
+    resolveBundledPluginWebFetchProvidersMock.mockReset();
+    resolvePluginWebFetchProvidersMock.mockReset();
   });
 
   beforeEach(() => {

src/test-utils/env.ts

@@ -37,6 +37,7 @@ const PATH_RESOLUTION_ENV_KEYS = [
   "OPENCLAW_HOME",
   "OPENCLAW_STATE_DIR",
   "OPENCLAW_BUNDLED_PLUGINS_DIR",
+  "OPENCLAW_DISABLE_BUNDLED_PLUGINS",
 ] as const;
 
 function resolveWindowsHomeParts(homeDir: string): { homeDrive?: string; homePath?: string } {
@@ -65,6 +66,7 @@ export function createPathResolutionEnv(
     OPENCLAW_HOME: undefined,
     OPENCLAW_STATE_DIR: undefined,
     OPENCLAW_BUNDLED_PLUGINS_DIR: undefined,
+    OPENCLAW_DISABLE_BUNDLED_PLUGINS: undefined,
   };
 
   const windowsHome = resolveWindowsHomeParts(resolvedHome);

src/tts/provider-registry.test.ts

@@ -4,12 +4,24 @@ import { createEmptyPluginRegistry } from "../plugins/registry-empty.js";
 import type { SpeechProviderPlugin } from "../plugins/types.js";
 
 const resolveRuntimePluginRegistryMock = vi.fn();
+const loadPluginManifestRegistryMock = vi.fn(() => ({
+  plugins: [
+    { id: "elevenlabs", origin: "bundled", contracts: { speechProviders: [{}] } },
+    { id: "microsoft", origin: "bundled", contracts: { speechProviders: [{}] } },
+    { id: "openai", origin: "bundled", contracts: { speechProviders: [{}] } },
+  ],
+}));
 
 vi.mock("../plugins/loader.js", () => ({
   resolveRuntimePluginRegistry: (...args: Parameters<typeof resolveRuntimePluginRegistryMock>) =>
     resolveRuntimePluginRegistryMock(...args),
 }));
 
+vi.mock("../plugins/manifest-registry.js", () => ({
+  loadPluginManifestRegistry: (...args: Parameters<typeof loadPluginManifestRegistryMock>) =>
+    loadPluginManifestRegistryMock(...args),
+}));
+
 let getSpeechProvider: typeof import("./provider-registry.js").getSpeechProvider;
 let listSpeechProviders: typeof import("./provider-registry.js").listSpeechProviders;
 let canonicalizeSpeechProviderId: typeof import("./provider-registry.js").canonicalizeSpeechProviderId;
@@ -43,6 +55,7 @@ describe("speech provider registry", () => {
   beforeEach(() => {
     resolveRuntimePluginRegistryMock.mockReset();
     resolveRuntimePluginRegistryMock.mockReturnValue(undefined);
+    loadPluginManifestRegistryMock.mockClear();
   });
   it("uses active plugin speech providers without reloading plugins", () => {
     resolveRuntimePluginRegistryMock.mockReturnValue({