refactor: use generic web search credential hooks

src/commands/onboard-search.providers.test.ts

@@ -138,6 +138,42 @@ describe("onboard-search provider resolution", () => {
     ).toBe("next-key");
   });
 
+  it("uses provider-owned legacy search config readers generically", async () => {
+    const legacyEntry: PluginWebSearchProviderEntry = {
+      ...createCustomProviderEntry(),
+      id: "legacy-search" as never,
+      pluginId: "legacy-search-plugin",
+      credentialPath: "plugins.entries.legacy-search-plugin.config.webSearch.apiKey",
+      getCredentialValue: (searchConfig) =>
+        (searchConfig?.legacySearch &&
+        typeof searchConfig.legacySearch === "object" &&
+        !Array.isArray(searchConfig.legacySearch)
+          ? (searchConfig.legacySearch as Record<string, unknown>)
+          : undefined
+        )?.apiKey,
+      getConfiguredCredentialValue: () => undefined,
+    };
+    mocks.resolvePluginWebSearchProviders.mockImplementation((params) =>
+      params?.config ? [legacyEntry] : [],
+    );
+
+    const cfg: OpenClawConfig = {
+      tools: {
+        web: {
+          search: {
+            provider: "legacy-search" as never,
+            legacySearch: {
+              apiKey: "legacy-key",
+            },
+          } as never,
+        },
+      },
+    };
+
+    expect(mod.hasExistingKey(cfg, "legacy-search" as never)).toBe(true);
+    expect(mod.resolveExistingKey(cfg, "legacy-search" as never)).toBe("legacy-key");
+  });
+
   it("uses config-aware non-bundled providers when building secret refs", async () => {
     const customEntry = createCustomProviderEntry();
     mocks.resolvePluginWebSearchProviders.mockImplementation((params) =>

src/flows/search-setup.ts

@@ -132,10 +132,7 @@ function rawKeyValue(config: OpenClawConfig, provider: SearchProvider): unknown
   const entry = resolveSearchProviderEntry(config, provider);
   const configuredValue = entry?.getConfiguredCredentialValue?.(config);
   return (
-    configuredValue ??
-    (entry?.id === "brave"
-      ? entry.getCredentialValue(search as Record<string, unknown> | undefined)
-      : undefined)
+    configuredValue ?? entry?.getCredentialValue(search as Record<string, unknown> | undefined)
   );
 }
 

src/secrets/channel-contract-surface-guardrails.test.ts

@@ -66,6 +66,10 @@ const CORE_SECRET_SURFACE_GUARDS = [
     path: "src/channels/plugins/setup-promotion-helpers.ts",
     forbiddenPatterns: [/\btelegram\b/],
   },
+  {
+    path: "src/flows/search-setup.ts",
+    forbiddenPatterns: [/\bbrave\b/],
+  },
   {
     path: "src/media-understanding/defaults.ts",
     forbiddenPatterns: [