From 71d49012fcc835cc47d84dbe62d9ca2c39de4520 Mon Sep 17 00:00:00 2001
From: Shakker <shakkerdroid@gmail.com>
Date: Thu, 2 Apr 2026 12:44:51 +0100
Subject: [PATCH] fix: align secretref web-fetch matrix

---
 src/secrets/credential-matrix.ts              | 35 ++++++++++++-------
 src/secrets/exec-secret-ref-id-parity.test.ts |  3 ++
 2 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/src/secrets/credential-matrix.ts b/src/secrets/credential-matrix.ts
index abc06dcc246..54d51c63c0d 100644
--- a/src/secrets/credential-matrix.ts
+++ b/src/secrets/credential-matrix.ts
@@ -23,18 +23,29 @@ export type SecretRefCredentialMatrixDocument = {
 
 export function buildSecretRefCredentialMatrix(): SecretRefCredentialMatrixDocument {
   const entries: CredentialMatrixEntry[] = listSecretTargetRegistryEntries()
-    .map((entry) => ({
-      id: entry.id,
-      configFile: entry.configFile,
-      path: entry.pathPattern,
-      ...(entry.refPathPattern ? { refPath: entry.refPathPattern } : {}),
-      ...(entry.authProfileType ? { when: { type: entry.authProfileType } } : {}),
-      secretShape: entry.secretShape,
-      optIn: true as const,
-      ...(entry.id.startsWith("channels.googlechat.")
-        ? { notes: "Google Chat compatibility exception: sibling ref field remains canonical." }
-        : {}),
-    }))
+    .map((entry) => {
+      const isCanonicalFirecrawlWebFetchEntry =
+        entry.id === "plugins.entries.firecrawl.config.webFetch.apiKey";
+      const canonicalId = isCanonicalFirecrawlWebFetchEntry
+        ? "tools.web.fetch.firecrawl.apiKey"
+        : entry.id;
+      const canonicalPath = isCanonicalFirecrawlWebFetchEntry
+        ? "tools.web.fetch.firecrawl.apiKey"
+        : entry.pathPattern;
+
+      return {
+        id: canonicalId,
+        configFile: entry.configFile,
+        path: canonicalPath,
+        ...(entry.refPathPattern ? { refPath: entry.refPathPattern } : {}),
+        ...(entry.authProfileType ? { when: { type: entry.authProfileType } } : {}),
+        secretShape: entry.secretShape,
+        optIn: true as const,
+        ...(entry.id.startsWith("channels.googlechat.")
+          ? { notes: "Google Chat compatibility exception: sibling ref field remains canonical." }
+          : {}),
+      };
+    })
     .toSorted((a, b) => a.id.localeCompare(b.id));
 
   return {
diff --git a/src/secrets/exec-secret-ref-id-parity.test.ts b/src/secrets/exec-secret-ref-id-parity.test.ts
index 844657706d4..13d96423f05 100644
--- a/src/secrets/exec-secret-ref-id-parity.test.ts
+++ b/src/secrets/exec-secret-ref-id-parity.test.ts
@@ -99,6 +99,9 @@ describe("exec SecretRef id parity", () => {
     if (id.startsWith("tools.web.fetch.")) {
       return "tools.web.fetch";
     }
+    if (id.startsWith("plugins.entries.") && id.includes(".config.webFetch.apiKey")) {
+      return "tools.web.fetch";
+    }
     if (id.startsWith("tools.web.x_search.")) {
       return "tools.web.x_search";
     }