From 148ec3282f071a9f63b4ae8d4dd9332bb37d3ba2 Mon Sep 17 00:00:00 2001
From: lin-hongkuan <linhk8@mail2.sysu.edu.cn>
Date: Fri, 10 Jul 2026 00:10:22 +0800
Subject: [PATCH] fix: require env resolution for web provider refs (#96400)

* fix: require env resolution for web provider refs

* chore: retrigger PR checks

---------

Co-authored-by: lin-hongkuan <lin-hongkuan@users.noreply.github.com>
---
 .../src/provider-runtime-shared.test.ts       | 37 +++++++++++++++++++
 .../src/provider-runtime-shared.ts            |  8 +++-
 2 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/packages/web-content-core/src/provider-runtime-shared.test.ts b/packages/web-content-core/src/provider-runtime-shared.test.ts
index c57d5a0aa7b0..5311709165af 100644
--- a/packages/web-content-core/src/provider-runtime-shared.test.ts
+++ b/packages/web-content-core/src/provider-runtime-shared.test.ts
@@ -80,6 +80,43 @@ describe("hasWebProviderEntryCredential", () => {
     ).toBe(true);
   });
 
+  it("does not treat env secret refs as literal credentials when env resolution misses", () => {
+    expect(
+      hasWebProviderEntryCredential({
+        provider,
+        config: {},
+        toolConfig: undefined,
+        resolveRawValue: () => "${CUSTOM_API_KEY}",
+        resolveEnvValue: () => undefined,
+      }),
+    ).toBe(false);
+  });
+
+  it("does not treat fallback env secret refs as literal credentials", () => {
+    expect(
+      hasWebProviderEntryCredential({
+        provider,
+        config: {},
+        toolConfig: undefined,
+        resolveRawValue: () => undefined,
+        resolveFallbackRawValue: () => "$CUSTOM_API_KEY",
+        resolveEnvValue: () => undefined,
+      }),
+    ).toBe(false);
+  });
+
+  it("keeps non-reference config strings as literal credentials", () => {
+    expect(
+      hasWebProviderEntryCredential({
+        provider,
+        config: {},
+        toolConfig: undefined,
+        resolveRawValue: () => "literal-secret",
+        resolveEnvValue: () => undefined,
+      }),
+    ).toBe(true);
+  });
+
   it("falls back to provider auth before env probing", () => {
     expect(
       hasWebProviderEntryCredential({
diff --git a/packages/web-content-core/src/provider-runtime-shared.ts b/packages/web-content-core/src/provider-runtime-shared.ts
index 450821321ec2..b48adc454431 100644
--- a/packages/web-content-core/src/provider-runtime-shared.ts
+++ b/packages/web-content-core/src/provider-runtime-shared.ts
@@ -190,7 +190,9 @@ export function hasWebProviderEntryCredential<
   if (configuredRef && configuredRef.source !== "env") {
     return true;
   }
-  const fromConfig = normalizeSecretInput(normalizeSecretInputString(rawValue));
+  const fromConfig = configuredRef
+    ? ""
+    : normalizeSecretInput(normalizeSecretInputString(rawValue));
   if (fromConfig) {
     return true;
   }
@@ -217,7 +219,9 @@ export function hasWebProviderEntryCredential<
   if (fallbackRef && fallbackRef.source !== "env") {
     return true;
   }
-  const fallbackConfig = normalizeSecretInput(normalizeSecretInputString(fallbackRawValue));
+  const fallbackConfig = fallbackRef
+    ? ""
+    : normalizeSecretInput(normalizeSecretInputString(fallbackRawValue));
   if (fallbackConfig) {
     return true;
   }