honor migrate auth opt-out in plan

docs/plugins/sdk-subpaths.md

@@ -166,7 +166,7 @@ focused channel/runtime subpaths, `config-contracts`, `string-coerce-runtime`,
     | `plugin-sdk/provider-auth-api-key` | API-key onboarding/profile-write helpers such as `upsertApiKeyProfile` |
     | `plugin-sdk/provider-auth-result` | Standard OAuth auth-result builder |
     | `plugin-sdk/provider-env-vars` | Provider auth env-var lookup helpers |
-    | `plugin-sdk/provider-auth` | `createProviderApiKeyAuthMethod`, `ensureApiKeyFromOptionEnvOrPrompt`, `upsertAuthProfile`, `upsertApiKeyProfile`, `writeOAuthCredentials`, deprecated `resolveOpenClawAgentDir` compatibility export |
+    | `plugin-sdk/provider-auth` | `createProviderApiKeyAuthMethod`, `ensureApiKeyFromOptionEnvOrPrompt`, `applyProviderAuthConfigPatch`, `upsertAuthProfile`, `upsertApiKeyProfile`, `writeOAuthCredentials`, deprecated `resolveOpenClawAgentDir` compatibility export |
     | `plugin-sdk/provider-model-shared` | `ProviderReplayFamily`, `buildProviderReplayFamilyHooks`, `normalizeModelCompat`, shared replay-policy builders, provider-endpoint helpers, and shared model-id normalization helpers |
     | `plugin-sdk/provider-catalog-runtime` | Provider catalog augmentation runtime hook and plugin-provider registry seams for contract tests |
     | `plugin-sdk/provider-catalog-shared` | `findCatalogTemplate`, `buildSingleProviderApiKeyCatalog`, `buildManifestModelProviderConfig`, `supportsNativeStreamingUsageCompat`, `applyProviderNativeStreamingUsageCompat` |

src/commands/migrate.test.ts

@@ -391,6 +391,23 @@ describe("migrateApplyCommand", () => {
     );
   });
 
+  it("lets --no-auth-credentials override explicit secret import in plan", async () => {
+    const planned = authPlan("skipped");
+    mocks.provider.plan.mockImplementation(async (ctx) => {
+      expect(ctx.includeSecrets).toBe(false);
+      return planned;
+    });
+
+    const result = await migratePlanCommand(runtime, {
+      provider: "hermes",
+      includeSecrets: true,
+      authCredentials: false,
+    });
+
+    expect(result).toBe(planned);
+    expect(mocks.provider.plan).toHaveBeenCalledTimes(1);
+  });
+
   it("does not wrap JSON planning in progress output", async () => {
     const planned = codexPluginPlan();
     mocks.provider.plan.mockResolvedValue(planned);

src/commands/migrate.ts

@@ -369,11 +369,15 @@ export async function migratePlanCommand(
       `Migration provider is required. Run ${formatCliCommand("openclaw migrate list")} to choose one.`,
     );
   }
-  assertVerifyPluginAppsProvider(providerId, opts);
-  const plan = await createMigrationPlanWithProgress(runtime, { ...opts, provider: providerId });
-  if (opts.json) {
+  const resolvedOpts = resolveDefaultIncludeSecrets(opts);
+  assertVerifyPluginAppsProvider(providerId, resolvedOpts);
+  const plan = await createMigrationPlanWithProgress(runtime, {
+    ...resolvedOpts,
+    provider: providerId,
+  });
+  if (resolvedOpts.json) {
     writeRuntimeJson(runtime, redactMigrationPlan(plan));
-  } else if (opts.suppressPlanLog !== true) {
+  } else if (resolvedOpts.suppressPlanLog !== true) {
     log.message(formatMigrationPreview(plan).join("\n"));
   }
   return plan;

src/plugins/contracts/plugin-sdk-subpaths.test.ts

@@ -1206,6 +1206,7 @@ describe("plugin-sdk subpath exports", () => {
     expectSourceOmitsImportPattern("provider-setup", "./vllm.js");
     expectSourceOmitsImportPattern("provider-setup", "./sglang.js");
     expectSourceMentions("provider-auth", [
+      "applyProviderAuthConfigPatch",
       "buildOauthProviderAuthResult",
       "generateHexPkceVerifierChallenge",
       "generatePkceVerifierChallenge",