From f8244ea0c3edf034b599589aee8c38a165b00f25 Mon Sep 17 00:00:00 2001
From: Simon Kim <seojoonkim@gmail.com>
Date: Fri, 20 Mar 2026 15:21:20 +0900
Subject: [PATCH] tests: cover tavily web search secret surfaces

---
 ...secretref-user-supplied-credentials-matrix.json | 14 +++++++-------
 src/secrets/runtime-web-tools.test.ts              |  3 ++-
 src/secrets/runtime.coverage.test.ts               |  6 +++++-
 src/secrets/runtime.test.ts                        | 13 +++++++++++--
 4 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/docs/reference/secretref-user-supplied-credentials-matrix.json b/docs/reference/secretref-user-supplied-credentials-matrix.json
index cca7bb38c4b..6fce90f4f58 100644
--- a/docs/reference/secretref-user-supplied-credentials-matrix.json
+++ b/docs/reference/secretref-user-supplied-credentials-matrix.json
@@ -482,6 +482,13 @@
       "secretShape": "secret_input",
       "optIn": true
     },
+    {
+      "id": "plugins.entries.tavily.config.webSearch.apiKey",
+      "configFile": "openclaw.json",
+      "path": "plugins.entries.tavily.config.webSearch.apiKey",
+      "secretShape": "secret_input",
+      "optIn": true
+    },
     {
       "id": "plugins.entries.xai.config.webSearch.apiKey",
       "configFile": "openclaw.json",
@@ -551,13 +558,6 @@
       "path": "tools.web.search.perplexity.apiKey",
       "secretShape": "secret_input",
       "optIn": true
-    },
-    {
-      "id": "plugins.entries.tavily.config.webSearch.apiKey",
-      "configFile": "openclaw.json",
-      "path": "plugins.entries.tavily.config.webSearch.apiKey",
-      "secretShape": "secret_input",
-      "optIn": true
     }
   ]
 }
diff --git a/src/secrets/runtime-web-tools.test.ts b/src/secrets/runtime-web-tools.test.ts
index e0a78fc05cc..1c20a4e2cb8 100644
--- a/src/secrets/runtime-web-tools.test.ts
+++ b/src/secrets/runtime-web-tools.test.ts
@@ -6,7 +6,7 @@ import * as secretResolve from "./resolve.js";
 import { createResolverContext } from "./runtime-shared.js";
 import { resolveRuntimeWebTools } from "./runtime-web-tools.js";
 
-type ProviderUnderTest = "brave" | "gemini" | "grok" | "kimi" | "perplexity";
+type ProviderUnderTest = "brave" | "gemini" | "grok" | "kimi" | "perplexity" | "tavily";
 
 const { resolvePluginWebSearchProvidersMock } = vi.hoisted(() => ({
   resolvePluginWebSearchProvidersMock: vi.fn(() => buildTestWebSearchProviders()),
@@ -108,6 +108,7 @@ function buildTestWebSearchProviders(): PluginWebSearchProviderEntry[] {
     createTestProvider({ provider: "grok", pluginId: "xai", order: 30 }),
     createTestProvider({ provider: "kimi", pluginId: "moonshot", order: 40 }),
     createTestProvider({ provider: "perplexity", pluginId: "perplexity", order: 50 }),
+    createTestProvider({ provider: "tavily", pluginId: "tavily", order: 70 }),
   ];
 }
 
diff --git a/src/secrets/runtime.coverage.test.ts b/src/secrets/runtime.coverage.test.ts
index 5c7ca6d71ae..03576f946da 100644
--- a/src/secrets/runtime.coverage.test.ts
+++ b/src/secrets/runtime.coverage.test.ts
@@ -20,7 +20,7 @@ vi.mock("../plugins/web-search-providers.js", () => ({
 }));
 
 function createTestProvider(params: {
-  id: "brave" | "gemini" | "grok" | "kimi" | "perplexity" | "firecrawl";
+  id: "brave" | "gemini" | "grok" | "kimi" | "perplexity" | "firecrawl" | "tavily";
   pluginId: string;
   order: number;
 }): PluginWebSearchProviderEntry {
@@ -80,6 +80,7 @@ function buildTestWebSearchProviders(): PluginWebSearchProviderEntry[] {
     createTestProvider({ id: "kimi", pluginId: "moonshot", order: 40 }),
     createTestProvider({ id: "perplexity", pluginId: "perplexity", order: 50 }),
     createTestProvider({ id: "firecrawl", pluginId: "firecrawl", order: 60 }),
+    createTestProvider({ id: "tavily", pluginId: "tavily", order: 70 }),
   ];
 }
 
@@ -194,6 +195,9 @@ function buildConfigForOpenClawTarget(entry: SecretRegistryEntry, envId: string)
   if (entry.id === "plugins.entries.firecrawl.config.webSearch.apiKey") {
     setPathCreateStrict(config, ["tools", "web", "search", "provider"], "firecrawl");
   }
+  if (entry.id === "plugins.entries.tavily.config.webSearch.apiKey") {
+    setPathCreateStrict(config, ["tools", "web", "search", "provider"], "tavily");
+  }
   return config;
 }
 
diff --git a/src/secrets/runtime.test.ts b/src/secrets/runtime.test.ts
index 12792f7c2f1..68764495ded 100644
--- a/src/secrets/runtime.test.ts
+++ b/src/secrets/runtime.test.ts
@@ -12,7 +12,14 @@ import {
   prepareSecretsRuntimeSnapshot,
 } from "./runtime.js";
 
-type WebProviderUnderTest = "brave" | "gemini" | "grok" | "kimi" | "perplexity" | "firecrawl";
+type WebProviderUnderTest =
+  | "brave"
+  | "gemini"
+  | "grok"
+  | "kimi"
+  | "perplexity"
+  | "firecrawl"
+  | "tavily";
 
 const { resolveBundledPluginWebSearchProvidersMock, resolvePluginWebSearchProvidersMock } =
   vi.hoisted(() => ({
@@ -90,6 +97,7 @@ function buildTestWebSearchProviders(): PluginWebSearchProviderEntry[] {
     createTestProvider({ id: "kimi", pluginId: "moonshot", order: 40 }),
     createTestProvider({ id: "perplexity", pluginId: "perplexity", order: 50 }),
     createTestProvider({ id: "firecrawl", pluginId: "firecrawl", order: 60 }),
+    createTestProvider({ id: "tavily", pluginId: "tavily", order: 70 }),
   ];
 }
 
@@ -794,7 +802,7 @@ describe("secrets runtime snapshot", () => {
       snapshot.warnings.filter(
         (warning) => warning.code === "SECRETS_REF_IGNORED_INACTIVE_SURFACE",
       ),
-    ).toHaveLength(10);
+    ).toHaveLength(11);
     expect(snapshot.warnings.map((warning) => warning.path)).toEqual(
       expect.arrayContaining([
         "agents.defaults.memorySearch.remote.apiKey",
@@ -803,6 +811,7 @@ describe("secrets runtime snapshot", () => {
         "channels.telegram.accounts.disabled.botToken",
         "plugins.entries.brave.config.webSearch.apiKey",
         "plugins.entries.google.config.webSearch.apiKey",
+        "plugins.entries.tavily.config.webSearch.apiKey",
       ]),
     );
   });