fix(onboarding): trust official web search installs

CHANGELOG.md

@@ -19,7 +19,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
-- Plugins/onboarding: trust optional official plugin installs selected from the official catalog so npm security scanning treats them like other source-linked official install paths. Thanks @vincentkoc.
+- Plugins/onboarding: trust optional official plugin and web-search installs selected from the official catalog so npm security scanning treats them like other source-linked official install paths. Thanks @vincentkoc.
 - CLI/plugins: keep `plugins enable` and `plugins disable` from creating unconfigured channel config sections, so channel plugins with required setup fields no longer fail validation during lifecycle probes. Thanks @vincentkoc.
 - Agents/sessions: keep delayed `sessions_send` A2A replies alive after soft wait-window timeouts, while preserving terminal run timeouts and avoiding stale target replies in requester sessions. Fixes #76443. Thanks @ryswork1993 and @vincentkoc.
 - CLI/sessions: keep intentional empty agent replies silent after tool-delivered channel output, instead of surfacing a misleading "No reply from agent." fallback. Thanks @vincentkoc.

src/flows/search-setup.test.ts

@@ -303,6 +303,7 @@ describe("runSearchSetupFlow", () => {
         entry: expect.objectContaining({
           pluginId: "brave",
           label: "Brave",
+          trustedSourceLinkedOfficialInstall: true,
           install: expect.objectContaining({
             npmSpec: "@openclaw/brave-plugin",
           }),
@@ -351,6 +352,7 @@ describe("runSearchSetupFlow", () => {
         entry: expect.objectContaining({
           pluginId: "brave",
           label: "Brave",
+          trustedSourceLinkedOfficialInstall: true,
           install: expect.objectContaining({
             npmSpec: "@openclaw/brave-plugin",
           }),

src/flows/search-setup.ts

@@ -353,6 +353,9 @@ async function finalizeSearchProviderSetup(params: {
         pluginId: installEntry.pluginId,
         label: installEntry.label,
         install: installEntry.install,
+        ...(installEntry.trustedSourceLinkedOfficialInstall
+          ? { trustedSourceLinkedOfficialInstall: true }
+          : {}),
       },
       prompter: params.prompter,
       runtime: params.runtime,

src/plugins/web-search-install-catalog.ts

@@ -16,6 +16,7 @@ export type WebSearchInstallCatalogEntry = {
   label: string;
   install: PluginPackageInstall;
   provider: PluginWebSearchProviderEntry;
+  trustedSourceLinkedOfficialInstall?: boolean;
 };
 
 function normalizeString(value: unknown): string | undefined {
@@ -144,6 +145,7 @@ export function resolveWebSearchInstallCatalogEntries(): WebSearchInstallCatalog
         label: resolveOfficialExternalPluginLabel(entry),
         install,
         provider: providerEntry,
+        trustedSourceLinkedOfficialInstall: true,
       });
     }
   }