fix: require env resolution for web provider refs (#96400)

* fix: require env resolution for web provider refs

* chore: retrigger PR checks

---------

Co-authored-by: lin-hongkuan <lin-hongkuan@users.noreply.github.com>

packages/web-content-core/src/provider-runtime-shared.test.ts

@@ -80,6 +80,43 @@ describe("hasWebProviderEntryCredential", () => {
     ).toBe(true);
   });
 
+  it("does not treat env secret refs as literal credentials when env resolution misses", () => {
+    expect(
+      hasWebProviderEntryCredential({
+        provider,
+        config: {},
+        toolConfig: undefined,
+        resolveRawValue: () => "${CUSTOM_API_KEY}",
+        resolveEnvValue: () => undefined,
+      }),
+    ).toBe(false);
+  });
+
+  it("does not treat fallback env secret refs as literal credentials", () => {
+    expect(
+      hasWebProviderEntryCredential({
+        provider,
+        config: {},
+        toolConfig: undefined,
+        resolveRawValue: () => undefined,
+        resolveFallbackRawValue: () => "$CUSTOM_API_KEY",
+        resolveEnvValue: () => undefined,
+      }),
+    ).toBe(false);
+  });
+
+  it("keeps non-reference config strings as literal credentials", () => {
+    expect(
+      hasWebProviderEntryCredential({
+        provider,
+        config: {},
+        toolConfig: undefined,
+        resolveRawValue: () => "literal-secret",
+        resolveEnvValue: () => undefined,
+      }),
+    ).toBe(true);
+  });
+
   it("falls back to provider auth before env probing", () => {
     expect(
       hasWebProviderEntryCredential({

packages/web-content-core/src/provider-runtime-shared.ts

@@ -190,7 +190,9 @@ export function hasWebProviderEntryCredential<
   if (configuredRef && configuredRef.source !== "env") {
     return true;
   }
-  const fromConfig = normalizeSecretInput(normalizeSecretInputString(rawValue));
+  const fromConfig = configuredRef
+    ? ""
+    : normalizeSecretInput(normalizeSecretInputString(rawValue));
   if (fromConfig) {
     return true;
   }
@@ -217,7 +219,9 @@ export function hasWebProviderEntryCredential<
   if (fallbackRef && fallbackRef.source !== "env") {
     return true;
   }
-  const fallbackConfig = normalizeSecretInput(normalizeSecretInputString(fallbackRawValue));
+  const fallbackConfig = fallbackRef
+    ? ""
+    : normalizeSecretInput(normalizeSecretInputString(fallbackRawValue));
   if (fallbackConfig) {
     return true;
   }