From 17edec75e4ededa0f5a26d7de37e65378d8c6896 Mon Sep 17 00:00:00 2001
From: FullerStackDev <263060202+fuller-stack-dev@users.noreply.github.com>
Date: Sat, 23 May 2026 12:20:45 -0600
Subject: [PATCH] honor migrate auth opt-out in plan

---
 docs/plugins/sdk-subpaths.md                    |  2 +-
 src/commands/migrate.test.ts                    | 17 +++++++++++++++++
 src/commands/migrate.ts                         | 12 ++++++++----
 .../contracts/plugin-sdk-subpaths.test.ts       |  1 +
 4 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/docs/plugins/sdk-subpaths.md b/docs/plugins/sdk-subpaths.md
index 226e810e4657..3c05e9ff9554 100644
--- a/docs/plugins/sdk-subpaths.md
+++ b/docs/plugins/sdk-subpaths.md
@@ -166,7 +166,7 @@ focused channel/runtime subpaths, `config-contracts`, `string-coerce-runtime`,
     | `plugin-sdk/provider-auth-api-key` | API-key onboarding/profile-write helpers such as `upsertApiKeyProfile` |
     | `plugin-sdk/provider-auth-result` | Standard OAuth auth-result builder |
     | `plugin-sdk/provider-env-vars` | Provider auth env-var lookup helpers |
-    | `plugin-sdk/provider-auth` | `createProviderApiKeyAuthMethod`, `ensureApiKeyFromOptionEnvOrPrompt`, `upsertAuthProfile`, `upsertApiKeyProfile`, `writeOAuthCredentials`, deprecated `resolveOpenClawAgentDir` compatibility export |
+    | `plugin-sdk/provider-auth` | `createProviderApiKeyAuthMethod`, `ensureApiKeyFromOptionEnvOrPrompt`, `applyProviderAuthConfigPatch`, `upsertAuthProfile`, `upsertApiKeyProfile`, `writeOAuthCredentials`, deprecated `resolveOpenClawAgentDir` compatibility export |
     | `plugin-sdk/provider-model-shared` | `ProviderReplayFamily`, `buildProviderReplayFamilyHooks`, `normalizeModelCompat`, shared replay-policy builders, provider-endpoint helpers, and shared model-id normalization helpers |
     | `plugin-sdk/provider-catalog-runtime` | Provider catalog augmentation runtime hook and plugin-provider registry seams for contract tests |
     | `plugin-sdk/provider-catalog-shared` | `findCatalogTemplate`, `buildSingleProviderApiKeyCatalog`, `buildManifestModelProviderConfig`, `supportsNativeStreamingUsageCompat`, `applyProviderNativeStreamingUsageCompat` |
diff --git a/src/commands/migrate.test.ts b/src/commands/migrate.test.ts
index da241cfc9b1f..bd4d1f787bb9 100644
--- a/src/commands/migrate.test.ts
+++ b/src/commands/migrate.test.ts
@@ -391,6 +391,23 @@ describe("migrateApplyCommand", () => {
     );
   });
 
+  it("lets --no-auth-credentials override explicit secret import in plan", async () => {
+    const planned = authPlan("skipped");
+    mocks.provider.plan.mockImplementation(async (ctx) => {
+      expect(ctx.includeSecrets).toBe(false);
+      return planned;
+    });
+
+    const result = await migratePlanCommand(runtime, {
+      provider: "hermes",
+      includeSecrets: true,
+      authCredentials: false,
+    });
+
+    expect(result).toBe(planned);
+    expect(mocks.provider.plan).toHaveBeenCalledTimes(1);
+  });
+
   it("does not wrap JSON planning in progress output", async () => {
     const planned = codexPluginPlan();
     mocks.provider.plan.mockResolvedValue(planned);
diff --git a/src/commands/migrate.ts b/src/commands/migrate.ts
index 6c4a9c5c5401..4f3f4d88b4de 100644
--- a/src/commands/migrate.ts
+++ b/src/commands/migrate.ts
@@ -369,11 +369,15 @@ export async function migratePlanCommand(
       `Migration provider is required. Run ${formatCliCommand("openclaw migrate list")} to choose one.`,
     );
   }
-  assertVerifyPluginAppsProvider(providerId, opts);
-  const plan = await createMigrationPlanWithProgress(runtime, { ...opts, provider: providerId });
-  if (opts.json) {
+  const resolvedOpts = resolveDefaultIncludeSecrets(opts);
+  assertVerifyPluginAppsProvider(providerId, resolvedOpts);
+  const plan = await createMigrationPlanWithProgress(runtime, {
+    ...resolvedOpts,
+    provider: providerId,
+  });
+  if (resolvedOpts.json) {
     writeRuntimeJson(runtime, redactMigrationPlan(plan));
-  } else if (opts.suppressPlanLog !== true) {
+  } else if (resolvedOpts.suppressPlanLog !== true) {
     log.message(formatMigrationPreview(plan).join("\n"));
   }
   return plan;
diff --git a/src/plugins/contracts/plugin-sdk-subpaths.test.ts b/src/plugins/contracts/plugin-sdk-subpaths.test.ts
index ec8f44c0424f..6ed823f1a0a8 100644
--- a/src/plugins/contracts/plugin-sdk-subpaths.test.ts
+++ b/src/plugins/contracts/plugin-sdk-subpaths.test.ts
@@ -1206,6 +1206,7 @@ describe("plugin-sdk subpath exports", () => {
     expectSourceOmitsImportPattern("provider-setup", "./vllm.js");
     expectSourceOmitsImportPattern("provider-setup", "./sglang.js");
     expectSourceMentions("provider-auth", [
+      "applyProviderAuthConfigPatch",
       "buildOauthProviderAuthResult",
       "generateHexPkceVerifierChallenge",
       "generatePkceVerifierChallenge",