fix(onboarding): trust official web search installs

vincentkoc · vincentkoc · commit d89be34360ec · 2026-05-03T00:48:37.000-07:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -19,7 +19,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
-- Plugins/onboarding: trust optional official plugin installs selected from the official catalog so npm security scanning treats them like other source-linked official install paths. Thanks @vincentkoc.
+- Plugins/onboarding: trust optional official plugin and web-search installs selected from the official catalog so npm security scanning treats them like other source-linked official install paths. Thanks @vincentkoc.
 - CLI/plugins: keep `plugins enable` and `plugins disable` from creating unconfigured channel config sections, so channel plugins with required setup fields no longer fail validation during lifecycle probes. Thanks @vincentkoc.
 - Agents/sessions: keep delayed `sessions_send` A2A replies alive after soft wait-window timeouts, while preserving terminal run timeouts and avoiding stale target replies in requester sessions. Fixes #76443. Thanks @ryswork1993 and @vincentkoc.
 - CLI/sessions: keep intentional empty agent replies silent after tool-delivered channel output, instead of surfacing a misleading "No reply from agent." fallback. Thanks @vincentkoc.
diff --git a/src/flows/search-setup.test.ts b/src/flows/search-setup.test.ts
@@ -303,6 +303,7 @@ describe("runSearchSetupFlow", () => {
         entry: expect.objectContaining({
           pluginId: "brave",
           label: "Brave",
+          trustedSourceLinkedOfficialInstall: true,
           install: expect.objectContaining({
             npmSpec: "@openclaw/brave-plugin",
           }),
@@ -351,6 +352,7 @@ describe("runSearchSetupFlow", () => {
         entry: expect.objectContaining({
           pluginId: "brave",
           label: "Brave",
+          trustedSourceLinkedOfficialInstall: true,
           install: expect.objectContaining({
             npmSpec: "@openclaw/brave-plugin",
           }),
diff --git a/src/flows/search-setup.ts b/src/flows/search-setup.ts
@@ -353,6 +353,9 @@ async function finalizeSearchProviderSetup(params: {
         pluginId: installEntry.pluginId,
         label: installEntry.label,
         install: installEntry.install,
+        ...(installEntry.trustedSourceLinkedOfficialInstall
+          ? { trustedSourceLinkedOfficialInstall: true }
+          : {}),
       },
       prompter: params.prompter,
       runtime: params.runtime,
diff --git a/src/plugins/web-search-install-catalog.ts b/src/plugins/web-search-install-catalog.ts
@@ -16,6 +16,7 @@ export type WebSearchInstallCatalogEntry = {
   label: string;
   install: PluginPackageInstall;
   provider: PluginWebSearchProviderEntry;
+  trustedSourceLinkedOfficialInstall?: boolean;
 };
 
 function normalizeString(value: unknown): string | undefined {
@@ -144,6 +145,7 @@ export function resolveWebSearchInstallCatalogEntries(): WebSearchInstallCatalog
         label: resolveOfficialExternalPluginLabel(entry),
         install,
         provider: providerEntry,
+        trustedSourceLinkedOfficialInstall: true,
       });
     }
   }

Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,7 @@ export type WebSearchInstallCatalogEntry = {`
`16`	`16`	`label: string;`
`17`	`17`	`install: PluginPackageInstall;`
`18`	`18`	`provider: PluginWebSearchProviderEntry;`
	`19`	`+ trustedSourceLinkedOfficialInstall?: boolean;`
`19`	`20`	`};`
`20`	`21`
`21`	`22`	`function normalizeString(value: unknown): string \| undefined {`
`@@ -144,6 +145,7 @@ export function resolveWebSearchInstallCatalogEntries(): WebSearchInstallCatalog`
`144`	`145`	`label: resolveOfficialExternalPluginLabel(entry),`
`145`	`146`	`install,`
`146`	`147`	`provider: providerEntry,`
	`148`	`+ trustedSourceLinkedOfficialInstall: true,`
`147`	`149`	`});`
`148`	`150`	`}`
`149`	`151`	`}`