From 94f670b893373a7a037901658d09105ada344150 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Wed, 22 Apr 2026 05:44:09 +0100
Subject: [PATCH] refactor: use generic web search credential hooks

---
 src/commands/onboard-search.providers.test.ts | 36 +++++++++++++++++++
 src/flows/search-setup.ts                     |  5 +--
 ...hannel-contract-surface-guardrails.test.ts |  4 +++
 3 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/src/commands/onboard-search.providers.test.ts b/src/commands/onboard-search.providers.test.ts
index ba2e4377675..e692d8e6dbe 100644
--- a/src/commands/onboard-search.providers.test.ts
+++ b/src/commands/onboard-search.providers.test.ts
@@ -138,6 +138,42 @@ describe("onboard-search provider resolution", () => {
     ).toBe("next-key");
   });
 
+  it("uses provider-owned legacy search config readers generically", async () => {
+    const legacyEntry: PluginWebSearchProviderEntry = {
+      ...createCustomProviderEntry(),
+      id: "legacy-search" as never,
+      pluginId: "legacy-search-plugin",
+      credentialPath: "plugins.entries.legacy-search-plugin.config.webSearch.apiKey",
+      getCredentialValue: (searchConfig) =>
+        (searchConfig?.legacySearch &&
+        typeof searchConfig.legacySearch === "object" &&
+        !Array.isArray(searchConfig.legacySearch)
+          ? (searchConfig.legacySearch as Record<string, unknown>)
+          : undefined
+        )?.apiKey,
+      getConfiguredCredentialValue: () => undefined,
+    };
+    mocks.resolvePluginWebSearchProviders.mockImplementation((params) =>
+      params?.config ? [legacyEntry] : [],
+    );
+
+    const cfg: OpenClawConfig = {
+      tools: {
+        web: {
+          search: {
+            provider: "legacy-search" as never,
+            legacySearch: {
+              apiKey: "legacy-key",
+            },
+          } as never,
+        },
+      },
+    };
+
+    expect(mod.hasExistingKey(cfg, "legacy-search" as never)).toBe(true);
+    expect(mod.resolveExistingKey(cfg, "legacy-search" as never)).toBe("legacy-key");
+  });
+
   it("uses config-aware non-bundled providers when building secret refs", async () => {
     const customEntry = createCustomProviderEntry();
     mocks.resolvePluginWebSearchProviders.mockImplementation((params) =>
diff --git a/src/flows/search-setup.ts b/src/flows/search-setup.ts
index 7d7b778dd8d..b54f35dd9fb 100644
--- a/src/flows/search-setup.ts
+++ b/src/flows/search-setup.ts
@@ -132,10 +132,7 @@ function rawKeyValue(config: OpenClawConfig, provider: SearchProvider): unknown
   const entry = resolveSearchProviderEntry(config, provider);
   const configuredValue = entry?.getConfiguredCredentialValue?.(config);
   return (
-    configuredValue ??
-    (entry?.id === "brave"
-      ? entry.getCredentialValue(search as Record<string, unknown> | undefined)
-      : undefined)
+    configuredValue ?? entry?.getCredentialValue(search as Record<string, unknown> | undefined)
   );
 }
 
diff --git a/src/secrets/channel-contract-surface-guardrails.test.ts b/src/secrets/channel-contract-surface-guardrails.test.ts
index 638b6cb4a8f..eb9d5903a7c 100644
--- a/src/secrets/channel-contract-surface-guardrails.test.ts
+++ b/src/secrets/channel-contract-surface-guardrails.test.ts
@@ -66,6 +66,10 @@ const CORE_SECRET_SURFACE_GUARDS = [
     path: "src/channels/plugins/setup-promotion-helpers.ts",
     forbiddenPatterns: [/\btelegram\b/],
   },
+  {
+    path: "src/flows/search-setup.ts",
+    forbiddenPatterns: [/\bbrave\b/],
+  },
   {
     path: "src/media-understanding/defaults.ts",
     forbiddenPatterns: [