Summary

plugins.entries.firecrawl.config.webSearch.apiKey fails to resolve when configured as SecretRef (env:default:FIRECRAWL_API_KEY) even after openclaw secrets reload.

Environment

• OpenClaw: 2026.3.28 (f9b1079)
• Gateway: local/systemd
• Firecrawl plugin enabled

Repro

1. Configure Firecrawl with SecretRef:

plugins.entries.firecrawl.config.webSearch.apiKey = { source: "env", provider: "default", id: "FIRECRAWL_API_KEY" }

2. Configure secrets provider:

secrets.providers.default.source = "env"
secrets.defaults.env = "default"

3. Ensure gateway process env contains FIRECRAWL_API_KEY.
4. Run:

openclaw secrets reload --expect-final --json

5. Call firecrawl_search or firecrawl_scrape.

Actual

Error:
plugins.entries.firecrawl.config.webSearch.apiKey: unresolved SecretRef "env:default:FIRECRAWL_API_KEY"

Expected

Firecrawl key should resolve and calls should succeed after secrets reload.

Workaround

Set Firecrawl apiKey as plaintext string in config; then both firecrawl_search and firecrawl_scrape work.

Suspected area

SecretRef runtime snapshot propagation/caching for plugin path:
plugins.entries.firecrawl.config.webSearch.apiKey