Summary

Fixes #79353.

• Pass trusted auth-profile provider helpers through plugin tool context so plugin factories can align with manifest auth availability.
• Teach the bundled xAI x_search and code_execution tools to register and execute with an xAI auth profile, while preserving existing plugin config/env precedence and blocked SecretRef behavior.
• Update xAI tool docs, missing-key guidance, and regression coverage for the auth-profile path.

Real behavior proof (required for external PRs)

• Behavior or issue addressed: xAI x_search and code_execution failed to register when the only xAI credential was an OpenClaw xAI auth profile rather than plugin config or XAI_API_KEY.
• Real environment tested: Windows 11 local OpenClaw checkout on this PR branch, using the real bundled xAI plugin registration path and xAI tool auth resolver. No valid live xAI API key is configured on this machine.
• Exact steps or command run after this patch:
  • corepack pnpm exec tsx - with a local script that imports ./extensions/xai/index.ts, registers the real xAI plugin through a minimal plugin API, supplies an xAI auth-profile provider helper, and calls resolveXaiToolApiKeyWithAuth.
  • corepack pnpm test extensions/xai/src/tool-auth-shared.test.ts extensions/xai/index.test.ts extensions/xai/x-search.test.ts extensions/xai/code-execution.test.ts src/plugins/tools.optional.test.ts src/secrets/runtime-web-tools.test.ts src/config/config.web-search-provider.test.ts src/agents/openclaw-tools.browser-plugin.integration.test.ts
• Evidence after fix: copied local console output from the real xAI plugin registration/auth-resolution path, run outside Vitest:

> corepack pnpm exec tsx -
{
  "registeredToolNames": [
    "code_execution",
    "x_search"
  ],
  "authProfileAvailable": true,
  "resolvedApiKeyFromAuthProfile": "<auth-profile-key>",
  "registeredFromEmptyPluginConfig": true
}

Supplemental note: an earlier local execution attempt with a deliberately fake xAI auth-profile key reached xAI and failed with xAI's expected invalid-key response, confirming the auth-profile credential flowed into the real request path; I did not include that full error output because no valid live xAI credential is available here.

• Observed result after fix: both optional xAI tools register from an empty plugin config when hasAuthForProvider("xai") is true, and the shared xAI tool auth resolver returns the auth-profile API key for execution.
• What was not tested: a live xAI Responses API call with a valid xAI key; this machine does not have a valid xAI API key configured. The request-building/execution path is covered by targeted tests with intercepted fetch.

Verification

• corepack pnpm test extensions/xai/src/tool-auth-shared.test.ts extensions/xai/index.test.ts extensions/xai/x-search.test.ts extensions/xai/code-execution.test.ts src/plugins/tools.optional.test.ts src/secrets/runtime-web-tools.test.ts src/config/config.web-search-provider.test.ts src/agents/openclaw-tools.browser-plugin.integration.test.ts
• corepack pnpm exec oxfmt --check --threads=1 extensions/xai/index.ts extensions/xai/src/tool-auth-shared.ts extensions/xai/x-search.ts extensions/xai/x-search-tool-shared.ts extensions/xai/code-execution.ts extensions/xai/src/web-search-provider.runtime.ts src/agents/openclaw-plugin-tools.ts src/plugins/tool-types.ts src/agents/openclaw-tools.browser-plugin.integration.test.ts extensions/xai/src/tool-auth-shared.test.ts extensions/xai/x-search.test.ts extensions/xai/code-execution.test.ts docs/providers/xai.md docs/tools/web.md docs/tools/code-execution.md docs/tools/grok-search.md CHANGELOG.md
• git diff --check origin/main...HEAD
• corepack pnpm check:changelog-attributions
• corepack pnpm check:changed
• corepack pnpm exec tsgo -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
• corepack pnpm exec tsgo -p tsconfig.extensions.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions.tsbuildinfo
• corepack pnpm exec tsgo -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo
• corepack pnpm exec tsgo -p test/tsconfig/tsconfig.extensions.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions-test.tsbuildinfo
• corepack pnpm exec tsgo -p tsconfig.plugin-sdk.dts.json --declaration true
• corepack pnpm docs:check-mdx
• corepack pnpm docs:check-i18n-glossary
• corepack pnpm docs:check-links

Notes: corepack pnpm build reached bundled plugin assets/postbuild, then hit the local Windows path-with-space wrapper issue in build:plugin-sdk:dts (New project split by the wrapper). The direct plugin SDK dts command above passed. Full check:docs is similarly blocked locally because its package script invokes bare pnpm; direct docs checks above passed, while markdownlint also reports an unrelated pre-existing docs/CLAUDE.md newline issue.