feat: add web tools config to configure

docs/gateway/configuration.md

@@ -1607,7 +1607,7 @@ Legacy: `tools.bash` is still accepted as an alias.
 
 `tools.web` configures web search + fetch tools:
 - `tools.web.search.enabled` (default: true when key is present)
-- `tools.web.search.apiKey` (or `BRAVE_API_KEY` env var)
+- `tools.web.search.apiKey` (recommended: set via `clawdbot configure --section web`, or use `BRAVE_API_KEY` env var)
 - `tools.web.search.maxResults` (1–10, default 5)
 - `tools.web.search.timeoutSeconds` (default 30)
 - `tools.web.search.cacheTtlMinutes` (default 15)

docs/start/faq.md

@@ -576,7 +576,9 @@ The Gateway watches the config and supports hot‑reload:
 ### How do I enable web search (and web fetch)?
 
 `web_fetch` works without an API key. `web_search` requires a Brave Search API
-key (`BRAVE_API_KEY` or `tools.web.search.apiKey`).
+key. **Recommended:** run `clawdbot configure --section web` to store it in
+`tools.web.search.apiKey`. Environment alternative: set `BRAVE_API_KEY` for the
+Gateway process.
 
 ```json5
 {
@@ -584,7 +586,7 @@ key (`BRAVE_API_KEY` or `tools.web.search.apiKey`).
     web: {
       search: {
         enabled: true,
-        apiKey: "BRAVE_API_KEY_HERE", // or set BRAVE_API_KEY
+        apiKey: "BRAVE_API_KEY_HERE",
         maxResults: 5
       },
       fetch: {
@@ -598,6 +600,7 @@ key (`BRAVE_API_KEY` or `tools.web.search.apiKey`).
 Notes:
 - If you use allowlists, add `web_search`/`web_fetch` or `group:web`.
 - In sandboxed sessions, `web_fetch` auto-enables unless explicitly disabled.
+- Daemons read env vars from `~/.clawdbot/.env` (or the service environment).
 
 Docs: [Web tools](/tools/web).
 

docs/start/getting-started.md

@@ -40,8 +40,9 @@ run on host, set an explicit per-agent override:
 
 - Node `>=22`
 - `pnpm` (optional; recommended if you build from source)
-- **Recommended:** Brave Search API key for web search. Set `BRAVE_API_KEY` or
-  `tools.web.search.apiKey`. See [Web tools](/tools/web).
+- **Recommended:** Brave Search API key for web search. Easiest path:
+  `clawdbot configure --section web` (stores `tools.web.search.apiKey`).
+  See [Web tools](/tools/web).
 
 macOS: if you plan to build the apps, install Xcode / CLT. For the CLI + gateway only, Node is enough.
 Windows: use **WSL2** (Ubuntu recommended). WSL2 is strongly recommended; native Windows is untested and more problematic. Install WSL2 first, then run the Linux steps inside WSL. See [Windows (WSL2)](/platforms/windows).

docs/start/wizard.md

@@ -25,8 +25,8 @@ clawdbot configure
 ```
 
 Recommended: set up a Brave Search API key so the agent can use `web_search`
-(`web_fetch` works without a key). Set `BRAVE_API_KEY` or
-`tools.web.search.apiKey`. Docs: [Web tools](/tools/web).
+(`web_fetch` works without a key). Easiest path: `clawdbot configure --section web`
+which stores `tools.web.search.apiKey`. Docs: [Web tools](/tools/web).
 
 ## QuickStart vs Advanced
 

docs/tools/index.md

@@ -197,7 +197,7 @@ Core parameters:
 - `count` (1–10; default from `tools.web.search.maxResults`)
 
 Notes:
-- Requires `BRAVE_API_KEY` or `tools.web.search.apiKey`.
+- Requires a Brave API key (recommended: `clawdbot configure --section web`, or set `BRAVE_API_KEY`).
 - Enable via `tools.web.search.enabled`.
 - Responses are cached (default 15 min).
 - See [Web tools](/tools/web) for setup.

docs/tools/web.md

@@ -28,11 +28,20 @@ These are **not** browser automation. For JS-heavy sites or logins, use the
 
 1) Create a Brave Search API account at https://brave.com/search/api/
 2) Generate an API key in the dashboard.
-3) Set `BRAVE_API_KEY` in your environment or paste it into `tools.web.search.apiKey`.
+3) Run `clawdbot configure --section web` to store the key in config (recommended), or set `BRAVE_API_KEY` in your environment.
 
 Brave provides a free tier plus paid plans; check the Brave API portal for the
 current limits and pricing.
 
+### Where to set the key (recommended)
+
+**Recommended:** run `clawdbot configure --section web`. It stores the key in
+`~/.clawdbot/clawdbot.json` under `tools.web.search.apiKey`.
+
+**Environment alternative:** set `BRAVE_API_KEY` in the Gateway process
+environment. For a daemon install, put it in `~/.clawdbot/.env` (or your
+service environment). See [Env vars](/start/faq#how-does-clawdbot-load-environment-variables).
+
 ## web_search
 
 Search the web with Brave’s API.
@@ -40,7 +49,7 @@ Search the web with Brave’s API.
 ### Requirements
 
 - `tools.web.search.enabled: true`
-- Brave API key via `BRAVE_API_KEY` **or** `tools.web.search.apiKey`
+- Brave API key (recommended: `clawdbot configure --section web`, or set `BRAVE_API_KEY`)
 
 ### Config