- CLI/configure: let model-only section setup enter provider auth directly instead of first asking where the Gateway runs, unblocking OAuth/token setup in terminals where that unrelated prompt is unresponsive. Fixes #39223. Thanks @LevityLeads.

- Providers/Anthropic-messages: extract `reasoning_content` from `thinking` blocks during assistant replay so proxy providers that route through the Anthropic-messages transport preserve reasoning context across tool-call follow-up turns. Thanks @Sunnyone2three.

- Agents/GitHub Copilot: normalize replayed Responses tool-call IDs before dispatch so resumed sessions with historical overlong tool IDs continue instead of failing Copilot schema validation. (#82750) Thanks @galiniliev.

- CLI/web: resolve provider-scoped web search/fetch SecretRefs for `infer web ... --provider ...` while leaving unrelated plugin secrets untouched. Fixes #82621. Thanks @leno23.

- CLI/infer: resolve plugin-scoped web search and fetch SecretRefs on the exact command credential surface, keeping non-selected and unrelated plugin secrets inactive. Fixes #82621. (#82699) Thanks @leno23.

- Providers/Anthropic Vertex: resolve installed provider public surfaces from package-local `dist/`, restoring `anthropic-vertex/*` model calls after plugin externalization. Fixes #82781. Thanks @0L1v3DaD.

- Gateway/exec approvals: bind path-shaped allowlists, safe-bin trust, skill auto-allow, Allow Always persistence, and approval audit metadata to the executable realpath so symlinked binaries cannot keep approvals after retargeting. Fixes #45595. Thanks @jasonftl.

- Mac app: reorganize Settings around a grouped sidebar, with separate Connection and Exec Approvals pages so everyday permissions and app toggles are easier to scan.

- `plugins.entries.voice-call.config.streaming.providers.*.apiKey`

- `plugins.entries.voice-call.config.tts.providers.*.apiKey`

- `plugins.entries.voice-call.config.twilio.authToken`

- `tools.web.search.*.apiKey`

- `tools.web.search.apiKey`

- `gateway.auth.password`

- `gateway.auth.token`

"secretShape": "secret_input",

"optIn": true

},

{

"id": "tools.web.search.*.apiKey",

"configFile": "openclaw.json",

"path": "tools.web.search.*.apiKey",

"secretShape": "secret_input",

"optIn": true

},

{

"id": "tools.web.search.apiKey",

"configFile": "openclaw.json",

getConfiguredCredentialValue: (config) =>

(config?.plugins?.entries?.firecrawl?.config as { webFetch?: { apiKey?: unknown } } | undefined)

?.webFetch?.apiKey,

getConfiguredCredentialFallback: (config) => {

const apiKey = (

config?.plugins?.entries?.firecrawl?.config as

| { webSearch?: { apiKey?: unknown } }

| undefined

)?.webSearch?.apiKey;

return apiKey === undefined

? undefined

: {

path: "plugins.entries.firecrawl.config.webSearch.apiKey",

value: apiKey,

};

},

setConfiguredCredentialValue: (configTarget, value) => {

const plugins = ensureRecord(configTarget as unknown as Record<string, unknown>, "plugins");

const entries = ensureRecord(plugins, "entries");

} from "openclaw/plugin-sdk/provider-web-search-contract";

const FIRECRAWL_CREDENTIAL_PATH = "plugins.entries.firecrawl.config.webSearch.apiKey";

const FIRECRAWL_FETCH_CREDENTIAL_PATH = "plugins.entries.firecrawl.config.webFetch.apiKey";

type FirecrawlClientModule = typeof import("./firecrawl-client.js");

return firecrawlClientModulePromise;

}

function getConfiguredFetchCredentialFallback(config?: {

plugins?: { entries?: { firecrawl?: { config?: unknown } } };

}) {

const apiKey = (

config?.plugins?.entries?.firecrawl?.config as { webFetch?: { apiKey?: unknown } } | undefined

)?.webFetch?.apiKey;

return apiKey === undefined

? undefined

: {

path: FIRECRAWL_FETCH_CREDENTIAL_PATH,

value: apiKey,

};

}

const GenericFirecrawlSearchSchema = {

type: "object",

properties: {

configuredCredential: { pluginId: "firecrawl" },

selectionPluginId: "firecrawl",

}),

getConfiguredCredentialFallback: getConfiguredFetchCredentialFallback,

createTool: (ctx) => ({

description:

"Search the web using Firecrawl. Returns structured results with snippets from Firecrawl Search. Use firecrawl_search for Firecrawl-specific knobs like sources or categories.",

expect(provider.id).toBe("firecrawl");

expect(provider.credentialPath).toBe("plugins.entries.firecrawl.config.webSearch.apiKey");

expect(

provider.getConfiguredCredentialFallback?.({

plugins: {

entries: {

firecrawl: {

config: {

webFetch: {

apiKey: { source: "env", provider: "default", id: "FIRECRAWL_API_KEY" },

},

},

},

},

},

} as never),

).toEqual({

path: "plugins.entries.firecrawl.config.webFetch.apiKey",

value: { source: "env", provider: "default", id: "FIRECRAWL_API_KEY" },

});

const pluginEntry = applied.plugins?.entries?.firecrawl;

if (!pluginEntry) {

throw new Error("expected Firecrawl plugin entry");

export function createFirecrawlWebSearchProvider(): WebSearchProviderPlugin {

const credentialPath = "plugins.entries.firecrawl.config.webSearch.apiKey";

const fetchCredentialPath = "plugins.entries.firecrawl.config.webFetch.apiKey";

return {

id: "firecrawl",

configuredCredential: { pluginId: "firecrawl" },

selectionPluginId: "firecrawl",

}),

getConfiguredCredentialFallback: (config) => {

const apiKey = (

config?.plugins?.entries?.firecrawl?.config as

| { webFetch?: { apiKey?: unknown } }

| undefined

)?.webFetch?.apiKey;

return apiKey === undefined

? undefined

: {

path: fetchCredentialPath,

value: apiKey,

};

},

createTool: () => null,

};

}

* Run: TAVILY_API_KEY=resolved-live-proof pnpm exec tsx scripts/repro/cli-web-search-secret-refs-live-proof.mjs

*/

import { resolveCommandConfigWithSecrets } from "../../src/cli/command-config-resolution.js";

import { getWebSearchCommandSecretTargetIds } from "../../src/cli/command-secret-targets.js";

import { getCapabilityWebSearchCommandSecretTargetIds } from "../../src/cli/command-secret-targets.js";

const unresolvedConfig = {

tools: { web: { search: { provider: "tavily", enabled: true } } },

const { effectiveConfig, diagnostics } = await resolveCommandConfigWithSecrets({

config: unresolvedConfig,

commandName: "infer web search",

targetIds: getWebSearchCommandSecretTargetIds(),

targetIds: getCapabilityWebSearchCommandSecretTargetIds(),

autoEnable: true,

});

"resolveCommandConfigWithSecrets apiKey is string =",

typeof apiKey === "string" && apiKey.length > 0,

);

console.log("resolved apiKey remains redacted =", typeof apiKey === "string");

console.log(

"resolved apiKey prefix =",

typeof apiKey === "string" ? `${apiKey.slice(0, 8)}…` : apiKey,

);

console.log("diagnostics count =", diagnostics.length);