bug(web-search): custom auth:none is blocked by the Settings test key gate

UI-related note: this touches the Settings/UI path and may be lower priority during the ongoing frontend refactor.

Summary

Custom web search with customProvider.auth: none is valid at runtime and in the backend test route, but the Settings UI still requires a non-empty API key before enabling or running the Test action.

Why it matters

A user can reasonably configure an internal or public custom search endpoint with no authentication: provider: custom, auth: none, an endpoint, and an empty API key. The actual runtime accepts that configuration, but Settings disables the Test button and handleTest exits early. This makes a valid runtime configuration look broken from the UI.

Evidence

• src/tool/builtin/webSearch.ts:93 documents that an API key is not required when custom auth is none.
• src/tool/builtin/webSearch.ts:142 only throws setup-required when there is no key and the provider is not custom with auth === "none".
• src/tool/builtin/webSearch.ts:497 to src/tool/builtin/webSearch.ts:507 only inject authentication for bearer, queryApiKey, or bodyApiKey; none sends no auth header/key.
• ui/server/routes/config.js:313 defines /test-web-search.
• ui/server/routes/config.js:323 allows an empty key for selectedProvider === 'custom' && customAuth === 'none'.
• ui/src/components/settings/view/tabs/PilotDeckConfigTab.tsx:471 defines hasUsableSecret.
• ui/src/components/settings/view/tabs/PilotDeckConfigTab.tsx:2002 to ui/src/components/settings/view/tabs/PilotDeckConfigTab.tsx:2008 exits before testing whenever hasUsableSecret(apiKey) is false.
• ui/src/components/settings/view/tabs/PilotDeckConfigTab.tsx:2170 disables the Test button whenever !hasUsableSecret(apiKey).

Validation

Validation level: dynamic runtime reproduction plus frontend control-flow confirmation.

Reproduction method: executed createWebSearchTool({ provider: "custom", customProvider: { auth: "none" }, apiKey: "" }) with a mocked fetch implementation.

Key output:

{
  "organicCount": 1,
  "hasAuthorization": false,
  "requestBody": {
    "query": "pilotdeck"
  }
}

This confirms the runtime can execute custom/no-auth search without an API key and without adding an Authorization header.

Boundary: I did not run a full browser DOM click test. The UI failure is confirmed from the Settings control flow: the button is disabled and handleTest returns before reaching the backend route.

Expected behavior

Settings should allow Test for provider: custom when customProvider.auth === "none" and an endpoint is present, even if apiKey is empty. Providers and auth modes that require a key should continue to block empty keys.

Existing coverage checked

Checked existing coverage around test-web-search, customProvider auth none, hasUsableSecret webSearch, and web search apiKey custom.

PR #182 handles a friendly prompt for unconfigured web_search, but it does not change the Settings Test key gate for custom/auth:none, so it does not cover this root cause.

Suggested fix

Add a shared predicate such as requiresWebSearchApiKey(provider, customProvider).

• Return false only for provider === "custom" and customProvider.auth === "none".
• In handleTest, allow an empty key when the predicate says no key is required.
• Change the Test button disabled condition to something like testStatus === "testing" || (requiresKey && !hasUsableSecret(apiKey)).
• Keep endpoint validation separate, because custom/no-auth still needs a usable endpoint.

Suggested tests

• Settings UI: custom + auth:none + empty apiKey + endpoint keeps Test enabled and calls /test-web-search.
• Settings UI: custom + bearer/queryApiKey/bodyApiKey + empty apiKey still blocks Test.
• Settings UI: glm and tavily with empty keys still block Test.
• Server route regression: /test-web-search accepts custom/auth:none with an empty key.

---

Submitted with Codex.

Start in ui/src/components/settings/view/tabs/PilotDeckConfigTab.tsx at hasUsableSecret, handleTest, and the Test button condition, then compare the server behavior in ui/server/routes/config.js and runtime rules in src/tool/builtin/webSearch.ts. Add coverage for custom/auth:none with an empty key and endpoint, while confirming key-requiring providers remain blocked; done means the Settings Test action reaches /test-web-search only when its authentication and endpoint requirements are met.