[Bug] Custom chat provider and built-in DeepSeek web search overwrite each other's API key

[njxiaolei]

Environment

• @deepseek-ai/dsh: 0.1.2-rc.1
• Web UI profile
• Chat configured with a custom OpenAI-compatible gateway
• Built-in web-search-deepseek configured with the official DeepSeek Anthropic endpoint

Reproduction

1. Configure llm-deepseek to use a custom chat gateway and save its gateway API key.
2. Open Settings → Plugins → Web search.
3. Keep the official DeepSeek search endpoint and enter an official DeepSeek API key.
4. Send a normal chat message through the custom gateway.

Actual behavior

The Web Search settings save the official key under the default credential reference DEEPSEEK_API_KEY.

Both llm-deepseek and web-search-deepseek default to that same credential reference when apiKeyEnv is not explicitly configured. Therefore the official search key overwrites the custom chat gateway key.

The next normal chat request still targets the custom gateway but carries the official DeepSeek key. This causes authentication failure and may unintentionally send the official key to the custom gateway.

Expected behavior

Chat and web-search credentials should not silently share a mutable default reference when their endpoints differ.

Possible compatible fixes:

1. Let the Web Search settings choose a credential reference, defaulting to a dedicated value such as DEEPSEEK_SEARCH_API_KEY.
2. Detect that llm-deepseek.baseURL is custom and warn before writing the search key to the shared DEEPSEEK_API_KEY reference.
3. Preserve the existing shared-key behavior only when both chat and search use official DeepSeek endpoints.

Safe workaround

Use separate explicit references:

llm-deepseek:
  apiKeyEnv: SUB2API_API_KEY

web-search-deepseek:
  apiKeyEnv: DEEPSEEK_SEARCH_API_KEY

The credential values themselves remain in the credential store and should be re-entered through the UI.