openclaw - 💡(How to fix) Fix web_search direct capability CLI does not resolve exec SecretRef API keys

Bug description

openclaw capability web search reports missing_xai_api_key when plugins.entries.xai.config.webSearch.apiKey is configured as an exec SecretRef, even though the same configured credential works through the agent runtime path after openclaw secrets reload.

Plain-English version: the real agent path can search the web, but the direct capability CLI path does not resolve the same SecretRef and says the xAI key is missing.

Environment

• OpenClaw: 2026.5.12 (f066dd2)
• Provider: tools.web.search.provider = "grok"
• Credential path: plugins.entries.xai.config.webSearch.apiKey
• SecretRef type: source: "exec", provider: "onepassword"

Config shape

Secret value omitted.

{
  "tools": {
    "web": {
      "search": {
        "enabled": true,
        "provider": "grok"
      }
    }
  },
  "plugins": {
    "entries": {
      "xai": {
        "config": {
          "webSearch": {
            "apiKey": {
              "source": "exec",
              "provider": "onepassword",
              "id": "xai-api-key"
            }
          }
        }
      }
    }
  }
}

openclaw secrets audit --allow-exec --json reports zero unresolved refs, and openclaw secrets reload --json --timeout 60000 succeeds.

Steps to reproduce

HOME=/Users/k3rnel openclaw capability web providers --json

Observed provider state includes Grok selected/configured.

HOME=/Users/k3rnel openclaw capability web search \
  --query 'OpenClaw GitHub' \
  --limit 1 \
  --json

Observed output excerpt:

{
  "ok": true,
  "capability": "web.search",
  "transport": "local",
  "provider": "grok",
  "attempts": [],
  "outputs": [
    {
      "result": {
        "error": "missing_xai_api_key",
        "message": "web_search (grok) needs an xAI API key. Set XAI_API_KEY in the Gateway environment, or configure plugins.entries.xai.config.webSearch.apiKey."
      }
    }
  ]
}

Expected behavior

The direct capability CLI path should resolve supported SecretRef objects for plugins.entries.xai.config.webSearch.apiKey, including exec SecretRefs that pass openclaw secrets audit --allow-exec and work in the agent runtime path.

If direct capability commands intentionally do not support exec SecretRefs, the command should fail with an explicit unsupported-surface diagnostic rather than missing_xai_api_key.

Actual behavior

The direct capability CLI path sees the xAI/Grok provider as configured but does not resolve the exec SecretRef into the provider-owned web search API key value. It reports the same message it would report for an absent key.

Runtime proof that this is path-specific

Agent runtime smoke passed through the Gateway path using the same configured provider credential:

HOME=/Users/k3rnel openclaw agent \
  --agent k3rnel \
  --model openai/gpt-5.5 \
  --thinking off \
  --timeout 180 \
  --json \
  --message '<web_search smoke>'

Observed:

status: ok
reply marker: AGENT_WEBSEARCH_CANARY_OK ... llmbase.ai
provider: openai
model: gpt-5.5
agentHarnessId: codex

Suggested owner area

CLI capability web search path, xAI plugin config loading, and shared SecretRef resolution contract.

The fix should reuse the same resolver surface that the agent runtime path uses, or explicitly mark exec SecretRefs unsupported for direct local capability commands.