PR #77859: fix(runtime): prevent fast-path snapshot refresh from clobbering active web tool metadata

• Repository: openclaw/openclaw
• Author: openperf
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/77859

Description (problem / solution / changelog)

Summary

• Problem: After any config write (doctor --fix, plugins registry --refresh, or any concurrent agent config write), web_search, web_fetch, image_generate, memory_*, and other plugin-provided tools silently disappear from every subsequent tool list. The bug fires reliably on first config write post-startup and persists until gateway restart.

• Root Cause: prepareSecretsRuntimeSnapshot in src/secrets/runtime.ts has a fast path (canUseSecretsRuntimeFastPath) that returns webTools: createEmptyRuntimeWebToolsMetadata() when the source config has no web surface and no SecretRef candidates. finalizeRuntimeSnapshotWrite in src/config/runtime-snapshot.ts passes nextSourceConfig — a potentially stripped or partial slice from the config writer — to the refresh handler registered by activateSecretsRuntimeSnapshot. If that slice lacks a web surface, the fast path fires, and activateSecretsRuntimeSnapshot previously called setActiveRuntimeWebToolsMetadata(next.webTools) unconditionally, treating "fast-path unknown" the same as "resolver-confirmed absent." A naïve guard keying off activeSnapshot.sourceConfig is insufficient: that field is overwritten on every activation including fast-path ones, so after the first stripped-config refresh it no longer reflects the web surface from the last full-resolver run, and a second consecutive partial refresh bypasses the guard and clobbers the metadata anyway.

• Fix: Introduce a module-level lastFullResolverSourceConfig variable that is only updated when the full resolver actually runs (!next.webToolsFromFastPath), and reset alongside other runtime state in clearActiveSecretsRuntimeState. In activateSecretsRuntimeSnapshot, compute shouldPreserveWebTools = next.webToolsFromFastPath && lastFullResolverSourceConfig !== null && hasRuntimeWebToolConfigSurface(lastFullResolverSourceConfig) before any state mutations, then skip setActiveRuntimeWebToolsMetadata when shouldPreserveWebTools is true. Because lastFullResolverSourceConfig is never overwritten by fast-path activations, the preservation signal is durable across any number of successive partial refreshes. A full-resolver run always updates the variable and unconditionally overwrites the metadata, so authoritative no-web configs are still cleared correctly.

• What changed:

  • src/secrets/runtime.ts: added webToolsFromFastPath: boolean to PreparedSecretsRuntimeSnapshot type and cloneSnapshot; set the field in both branches of prepareSecretsRuntimeSnapshot; added lastFullResolverSourceConfig module-level variable and its reset in clearActiveSecretsRuntimeState; replaced the unconditional setActiveRuntimeWebToolsMetadata call in activateSecretsRuntimeSnapshot with a shouldPreserveWebTools guard backed by lastFullResolverSourceConfig.
  • src/secrets/runtime-web-tools-state.test.ts: three new integration tests — single fast-path refresh preserves metadata; full-resolver run with no web surface clears metadata; two successive fast-path refreshes both preserve metadata (regression for the durability fix).
  • src/secrets/runtime.fast-path.test.ts: two new unit tests asserting webToolsFromFastPath is true on the fast path and false when the full resolver runs.
  • CHANGELOG.md: entry added under ## Unreleased.

• What did NOT change (scope boundary): canUseSecretsRuntimeFastPath and hasRuntimeWebToolConfigSurface logic are untouched. runtime-web-tools-state.ts, runtime-snapshot.ts, io.ts, and mutate.ts are untouched. The public contract of getActiveRuntimeWebToolsMetadata and all its consumers are unchanged. The fast path continues to skip the heavy resolver import for clean startup paths.

---

Reproduction

1. Configure the gateway with tools.web.search.provider: gemini and a valid API key under plugins.entries.google.config.webSearch.apiKey.
2. Start the gateway. Open a chat session and confirm web_search appears in the tool list.
3. Trigger any config write — e.g. openclaw plugins registry --refresh, openclaw doctor --fix, or write any unrelated config key via the API.
4. Open a new chat session and inspect the tool list.

Before fix: web_search, web_fetch, image_generate, memory_*, lobster all absent after step 3. After fix: tool list is identical to step 2 regardless of how many config writes occur.

---

Risk / Mitigation

• Risk: If a user intentionally removes all web configuration via a full-resolver-triggering write (one that includes a SecretRef or a web surface entry), lastFullResolverSourceConfig is updated and metadata is cleared correctly. If the removal is done via a write that produces no SecretRefs and no web surface (fast-path path), the metadata is preserved until a full-resolver run occurs (e.g. gateway restart). This is the same tradeoff identified in the linked issue under option (a).
• Mitigation: The three new integration tests directly exercise the preservation path (single and double fast-path refresh) and the authoritative-clear path (full resolver, no web surface). The lastFullResolverSourceConfig variable is module-scoped, reset with the rest of runtime state, and not exposed externally, limiting the blast radius of the change.

---

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

---

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

---

Linked Issue/PR

Fixes #77826

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/secrets/runtime-web-tools-state.test.ts (modified, +152/-0)
• src/secrets/runtime.fast-path.test.ts (modified, +39/-0)
• src/secrets/runtime.ts (modified, +28/-1)

---

PR #78067: fix: preserve web tool metadata across config refresh

• Repository: openclaw/openclaw
• Author: bryce-d-greybeard
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/78067

Description (problem / solution / changelog)

Summary

Prevents stripped config-write refreshes from dropping active runtime web tool metadata. When a refresh source config omits web tool surface paths that were present in the active source snapshot, the secrets runtime now preserves those previous web surface paths before preparing the refreshed snapshot, so the fast path cannot overwrite populated web metadata with an empty struct just because a writer had a partial source view.

Changes

• Preserves omitted tools.web.search, tools.web.x_search, and tools.web.fetch paths from the active source snapshot during runtime refresh.
• Preserves omitted plugin config.webSearch / config.webFetch paths for plugin-provided web tools.
• Adds regression coverage for a stripped refresh source preserving an active Brave web search provider instead of taking the empty fast path.

Testing

• PATH="/tmp/openclaw-pnpm-shim:$PATH" pnpm vitest run src/secrets/runtime.fast-path.test.ts — passed, 6 tests.
• git diff --check — passed.
• PATH="/tmp/openclaw-pnpm-shim:$PATH" node scripts/check-changed.mjs — all gates passed through the final pairing-account guard; process was SIGKILLed at final exit as observed on this host. Standalone PATH="/tmp/openclaw-pnpm-shim:$PATH" node scripts/check-pairing-account-scope.mjs passed.

Fixes #77826

Changed files

• src/secrets/runtime.fast-path.test.ts (modified, +63/-1)
• src/secrets/runtime.ts (modified, +72/-2)

---

PR #78268: fix(secrets): preserve web tools on stripped refresh

• Repository: openclaw/openclaw
• Author: clawsweeper[bot]
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/78268

Description (problem / solution / changelog)

Summary

• preserve active resolved runtime web-tool metadata when a config refresh receives a stripped source view with no web/plugin containers
• keep explicit empty web/plugin containers authoritative so deliberate removals still clear web tools
• add regression coverage for stripped refresh preservation and explicit empty web config clearing
• update model fallback test fixture for the current plugin metadata snapshot env requirement

Fixes #77826.

Verification

• pnpm test src/secrets/runtime.fast-path.test.ts src/secrets/runtime-web-tools-state.test.ts src/config/runtime-snapshot.test.ts
• pnpm check:changed

Changed files

• src/agents/model-fallback.test.ts (modified, +3/-1)
• src/secrets/runtime.fast-path.test.ts (modified, +114/-5)
• src/secrets/runtime.ts (modified, +54/-1)