fix(onboard): honour process.env BRAVE_API_KEY in createSandbox (#3626)

yimoj · claude · yimoj · commit 0113e8a746bb · 2026-05-26T07:55:18.000Z
The other messaging providers fall back to process.env when the
credential store hasn't been written yet, but the Brave token was
resolved only via getCredential(). For direct createSandbox() callers
(tests, custom wrappers) that pass webSearchConfig without first
running configureWebSearch() to persist the key, that dropped a valid
BRAVE_API_KEY env var and then tripped the later "not available in
this process" abort.

Resolve the token with the same env-or-store fallback used elsewhere
and reuse it in the pre-create guard so both call sites stay in sync.

Signed-off-by: Yimo Jiang &lt;yimoj@nvidia.com&gt;

Co-Authored-By: Claude Opus 4.7 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts
@@ -3103,14 +3103,10 @@ async function createSandbox(
     .filter(({ envKey }) => !enabledEnvKeys || enabledEnvKeys.has(envKey))
     .filter(({ envKey }) => !disabledEnvKeys.has(envKey));
 
+  // Honor process.env fallback so direct createSandbox() callers don't trip the abort.
+  const braveApiKey = webSearchConfig ? getCredential(webSearch.BRAVE_API_KEY_ENV) || normalizeCredentialValue(process.env[webSearch.BRAVE_API_KEY_ENV]) : null;
   if (webSearchConfig) {
-    // `brave` providerType wires X-Subscription-Token rewrite at egress (#3626).
-    messagingTokenDefs.push({
-      name: `${sandboxName}-brave-search`,
-      envKey: webSearch.BRAVE_API_KEY_ENV,
-      token: getCredential(webSearch.BRAVE_API_KEY_ENV),
-      providerType: braveProviderProfile.BRAVE_PROVIDER_PROFILE_ID,
-    });
+    messagingTokenDefs.push({ name: `${sandboxName}-brave-search`, envKey: webSearch.BRAVE_API_KEY_ENV, token: braveApiKey, providerType: braveProviderProfile.BRAVE_PROVIDER_PROFILE_ID });
   }
   const previousProviderCredentialHashes =
     registry.getSandbox(sandboxName)?.providerCredentialHashes ?? {};
@@ -3539,7 +3535,7 @@ async function createSandbox(
     "openclaw-sandbox.yaml",
   );
   const basePolicyPath = (agent && agentOnboard.getAgentPolicyPath(agent)) || defaultPolicyPath;
-  if (webSearchConfig && !getCredential(webSearch.BRAVE_API_KEY_ENV)) {
+  if (webSearchConfig && !braveApiKey) {
     console.error("  Brave Search is enabled, but BRAVE_API_KEY is not available in this process.");
     console.error(
       "  Re-run with BRAVE_API_KEY set, or disable Brave Search before recreating the sandbox.",
