diff --git a/src/secrets/runtime-web-tools.shared.ts b/src/secrets/runtime-web-tools.shared.ts
index 779acf2698c..da308303c5a 100644
--- a/src/secrets/runtime-web-tools.shared.ts
+++ b/src/secrets/runtime-web-tools.shared.ts
@@ -84,6 +84,38 @@ export type RuntimeWebProviderSelectionParams<
   }) => Promise<void>;
 };
 
+function pushInactiveProviderCredentialWarnings<
+  TProvider extends { id: string; requiresCredential?: boolean },
+  TToolConfig extends Record<string, unknown> | undefined,
+  TSource extends string,
+  TMetadata extends RuntimeWebProviderMetadataBase<TSource>,
+>(params: {
+  selection: RuntimeWebProviderSelectionParams<TProvider, TToolConfig, TSource, TMetadata>;
+  skipProviderId?: string;
+  details: string;
+}): void {
+  for (const provider of params.selection.providers) {
+    if (provider.id === params.skipProviderId) {
+      continue;
+    }
+    const value = params.selection.readConfiguredCredential({
+      provider,
+      config: params.selection.sourceConfig,
+      toolConfig: params.selection.toolConfig,
+    });
+    if (!params.selection.hasConfiguredSecretRef(value, params.selection.defaults)) {
+      continue;
+    }
+    for (const path of params.selection.inactivePathsForProvider(provider)) {
+      pushInactiveSurfaceWarning({
+        context: params.selection.context,
+        path,
+        details: params.details,
+      });
+    }
+  }
+}
+
 export function ensureObject(
   target: Record<string, unknown>,
   key: string,
@@ -430,66 +462,23 @@ export async function resolveRuntimeWebProviderSelection<
   }
 
   if (params.enabled && !params.configuredProvider && params.metadata.selectedProvider) {
-    for (const provider of params.providers) {
-      if (provider.id === params.metadata.selectedProvider) {
-        continue;
-      }
-      const value = params.readConfiguredCredential({
-        provider,
-        config: params.sourceConfig,
-        toolConfig: params.toolConfig,
-      });
-      if (!params.hasConfiguredSecretRef(value, params.defaults)) {
-        continue;
-      }
-      for (const path of params.inactivePathsForProvider(provider)) {
-        pushInactiveSurfaceWarning({
-          context: params.context,
-          path,
-          details: `${params.scopePath} auto-detected provider is "${params.metadata.selectedProvider}".`,
-        });
-      }
-    }
+    pushInactiveProviderCredentialWarnings({
+      selection: params,
+      skipProviderId: params.metadata.selectedProvider,
+      details: `${params.scopePath} auto-detected provider is "${params.metadata.selectedProvider}".`,
+    });
   } else if (params.toolConfig && !params.enabled) {
-    for (const provider of params.providers) {
-      const value = params.readConfiguredCredential({
-        provider,
-        config: params.sourceConfig,
-        toolConfig: params.toolConfig,
-      });
-      if (!params.hasConfiguredSecretRef(value, params.defaults)) {
-        continue;
-      }
-      for (const path of params.inactivePathsForProvider(provider)) {
-        pushInactiveSurfaceWarning({
-          context: params.context,
-          path,
-          details: `${params.scopePath} is disabled.`,
-        });
-      }
-    }
+    pushInactiveProviderCredentialWarnings({
+      selection: params,
+      details: `${params.scopePath} is disabled.`,
+    });
   }
 
   if (params.enabled && params.toolConfig && params.configuredProvider) {
-    for (const provider of params.providers) {
-      if (provider.id === params.configuredProvider) {
-        continue;
-      }
-      const value = params.readConfiguredCredential({
-        provider,
-        config: params.sourceConfig,
-        toolConfig: params.toolConfig,
-      });
-      if (!params.hasConfiguredSecretRef(value, params.defaults)) {
-        continue;
-      }
-      for (const path of params.inactivePathsForProvider(provider)) {
-        pushInactiveSurfaceWarning({
-          context: params.context,
-          path,
-          details: `${params.scopePath}.provider is "${params.configuredProvider}".`,
-        });
-      }
-    }
+    pushInactiveProviderCredentialWarnings({
+      selection: params,
+      skipProviderId: params.configuredProvider,
+      details: `${params.scopePath}.provider is "${params.configuredProvider}".`,
+    });
   }
 }