From 2438305a220055196f6091c78f2ed4f4e4f6baa0 Mon Sep 17 00:00:00 2001
From: Teknium <127238744+teknium1@users.noreply.github.com>
Date: Sun, 2 Aug 2026 00:56:31 -0700
Subject: [PATCH] fix(secrets): scope browser plugin credential reads
 (browser_use/browserbase/firecrawl)

---
 plugins/browser/browser_use/provider.py | 3 ++-
 plugins/browser/browserbase/provider.py | 5 +++--
 plugins/browser/firecrawl/provider.py   | 5 +++--
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/plugins/browser/browser_use/provider.py b/plugins/browser/browser_use/provider.py
index e098cf814a..a10d9a3613 100644
--- a/plugins/browser/browser_use/provider.py
+++ b/plugins/browser/browser_use/provider.py
@@ -37,6 +37,7 @@ from typing import Any, Dict, Optional
 import requests
 
 from agent.browser_provider import BrowserProvider
+from agent.secret_scope import get_secret
 
 logger = logging.getLogger(__name__)
 
@@ -137,7 +138,7 @@ class BrowserUseBrowserProvider(BrowserProvider):
 
         # Direct API key wins unless the user has explicitly opted into the
         # managed Nous gateway via ``tool_gateway.browser: gateway``.
-        api_key = os.environ.get("BROWSER_USE_API_KEY")
+        api_key = get_secret("BROWSER_USE_API_KEY")
         if api_key and not prefers_gateway("browser"):
             return {
                 "api_key": api_key,
diff --git a/plugins/browser/browserbase/provider.py b/plugins/browser/browserbase/provider.py
index c828ae29b2..04829f740f 100644
--- a/plugins/browser/browserbase/provider.py
+++ b/plugins/browser/browserbase/provider.py
@@ -39,6 +39,7 @@ from typing import Any, Dict, Optional
 import requests
 
 from agent.browser_provider import BrowserProvider
+from agent.secret_scope import get_secret
 
 logger = logging.getLogger(__name__)
 
@@ -66,8 +67,8 @@ class BrowserbaseBrowserProvider(BrowserProvider):
     # ------------------------------------------------------------------
 
     def _get_config_or_none(self) -> Optional[Dict[str, Any]]:
-        api_key = os.environ.get("BROWSERBASE_API_KEY")
-        project_id = os.environ.get("BROWSERBASE_PROJECT_ID")
+        api_key = get_secret("BROWSERBASE_API_KEY")
+        project_id = get_secret("BROWSERBASE_PROJECT_ID")
         if api_key and project_id:
             return {
                 "api_key": api_key,
diff --git a/plugins/browser/firecrawl/provider.py b/plugins/browser/firecrawl/provider.py
index 892cd6c1dc..2177cd96e2 100644
--- a/plugins/browser/firecrawl/provider.py
+++ b/plugins/browser/firecrawl/provider.py
@@ -34,6 +34,7 @@ from typing import Any, Dict
 import requests
 
 from agent.browser_provider import BrowserProvider
+from agent.secret_scope import get_secret
 
 logger = logging.getLogger(__name__)
 
@@ -56,7 +57,7 @@ class FirecrawlBrowserProvider(BrowserProvider):
         return "Firecrawl"
 
     def is_available(self) -> bool:
-        return bool(os.environ.get("FIRECRAWL_API_KEY"))
+        return bool(get_secret("FIRECRAWL_API_KEY"))
 
     # ------------------------------------------------------------------
     # Session lifecycle
@@ -66,7 +67,7 @@ class FirecrawlBrowserProvider(BrowserProvider):
         return os.environ.get("FIRECRAWL_API_URL", _BASE_URL)
 
     def _headers(self) -> Dict[str, str]:
-        api_key = os.environ.get("FIRECRAWL_API_KEY")
+        api_key = get_secret("FIRECRAWL_API_KEY")
         if not api_key:
             raise ValueError(
                 "FIRECRAWL_API_KEY environment variable is required. "