chore: refresh deps and backfill changelog

src/secrets/exec-secret-ref-id-parity.test.ts

@@ -99,6 +99,9 @@ describe("exec SecretRef id parity", () => {
     if (id.startsWith("tools.web.fetch.")) {
       return "tools.web.fetch";
     }
+    if (id.startsWith("tools.web.x_search.")) {
+      return "tools.web.search";
+    }
     if (id.startsWith("plugins.entries.") && id.includes(".config.webFetch.apiKey")) {
       return "tools.web.fetch";
     }

src/secrets/runtime.coverage.test.ts

@@ -112,6 +112,12 @@ function resolveCoverageEnvId(entry: SecretRegistryEntry, fallbackEnvId: string)
     : fallbackEnvId;
 }
 
+function resolveCoverageResolvedPath(entry: SecretRegistryEntry): string {
+  return entry.id === "tools.web.x_search.apiKey"
+    ? "plugins.entries.xai.config.webSearch.apiKey"
+    : entry.pathPattern;
+}
+
 function buildConfigForOpenClawTarget(entry: SecretRegistryEntry, envId: string): OpenClawConfig {
   const config = {} as OpenClawConfig;
   const resolvedEnvId = resolveCoverageEnvId(entry, envId);
@@ -262,7 +268,10 @@ describe("secrets runtime target coverage", () => {
         agentDirs: ["/tmp/openclaw-agent-main"],
         loadAuthStore: () => ({ version: 1, profiles: {} }),
       });
-      const resolved = getPath(snapshot.config, toConcretePathSegments(entry.pathPattern));
+      const resolved = getPath(
+        snapshot.config,
+        toConcretePathSegments(resolveCoverageResolvedPath(entry)),
+      );
       if (entry.expectedResolvedValue === "string") {
         expect(resolved).toBe(expectedValue);
       } else {

src/web-fetch/runtime.test.ts

@@ -78,7 +78,7 @@ describe("web fetch runtime", () => {
     clearSecretsRuntimeSnapshot();
   });
 
-  it("does not auto-detect providers from env SecretRefs without runtime metadata", () => {
+  it("auto-detects providers from plugin-owned env SecretRefs without runtime metadata", () => {
     const provider = createProvider({
       pluginId: "firecrawl",
       id: "firecrawl",
@@ -112,7 +112,9 @@ describe("web fetch runtime", () => {
       },
     };
 
-    expect(resolveWebFetchDefinition({ config })).toBeNull();
+    const resolved = resolveWebFetchDefinition({ config });
+
+    expect(resolved?.provider.id).toBe("firecrawl");
   });
 
   it("prefers the runtime-selected provider when metadata is available", async () => {