diff --git a/scripts/src/agentrun-secret-sync-output.test.ts b/scripts/src/agentrun-secret-sync-output.test.ts
index d5abfc76..0f2679d5 100644
--- a/scripts/src/agentrun-secret-sync-output.test.ts
+++ b/scripts/src/agentrun-secret-sync-output.test.ts
@@ -3,6 +3,7 @@ import { describe, expect, test } from "bun:test";
 import { parseSecretSyncOptions } from "./agentrun/control-plane";
 import type { SecretSyncOptions } from "./agentrun/options";
 import { compactAgentRunSecretSyncPayload, renderAgentRunSecretSyncResult } from "./agentrun/secret-sync-output";
+import { confirmedSecretSyncPlan } from "./agentrun/trigger";
 
 const options = (output: SecretSyncOptions["output"], overrides: Partial<SecretSyncOptions> = {}): SecretSyncOptions => ({
   confirm: false,
@@ -124,6 +125,16 @@ function blockedFixture(): Record<string, unknown> {
 }
 
 describe("AgentRun secret-sync bounded output", () => {
+  test("confirmed sync reports all written secrets without stale provider classification", () => {
+    const items = [{ id: "provider-gpt-pika-auth-json" }, { id: "provider-gpt-pika-config" }];
+    expect(confirmedSecretSyncPlan(items, 2)).toEqual({
+      secretCount: 2,
+      items,
+      writableSecretCount: 2,
+      valuesPrinted: false,
+    });
+  });
+
   test("parses compact machine output and explicit disclosure options", () => {
     expect(parseSecretSyncOptions(["--node", "NC01", "--lane", "nc01-v02", "--dry-run", "-o", "yaml"])).toEqual({
       confirm: false,
diff --git a/scripts/src/agentrun/trigger.ts b/scripts/src/agentrun/trigger.ts
index 5da28c28..00b63d1e 100644
--- a/scripts/src/agentrun/trigger.ts
+++ b/scripts/src/agentrun/trigger.ts
@@ -288,14 +288,7 @@ export async function secretSync(config: UniDeskConfig, options: SecretSyncOptio
     configPath,
     target: compactAgentRunLaneStatusTarget(spec),
     filter: options.secretIds.length === 0 ? null : { secretIds: options.secretIds, selected: sources.map((source) => source.id) },
-    plan: {
-      secretCount: plan.length,
-      items: plan,
-      providerSecretWriteSkippedCount: providerValues.length,
-      providerSecretClassification: "exact-target-ref",
-      writableNonProviderSecretCount: syncValues.length,
-      valuesPrinted: false,
-    },
+    plan: confirmedSecretSyncPlan(plan, syncValues.length),
     result: payload,
     capture: compactCapture(result, { full: result.exitCode !== 0, stdoutTailChars: 3000, stderrTailChars: 3000 }),
     next: {
@@ -305,6 +298,15 @@ export async function secretSync(config: UniDeskConfig, options: SecretSyncOptio
   };
 }
 
+export function confirmedSecretSyncPlan(items: readonly Record<string, unknown>[], writableSecretCount: number): Record<string, unknown> {
+  return {
+    secretCount: items.length,
+    items,
+    writableSecretCount,
+    valuesPrinted: false,
+  };
+}
+
 export async function exposeAgentRun(_config: UniDeskConfig, options: ConfirmOptions): Promise<Record<string, unknown>> {
   const clientConfig = readAgentRunClientConfig();
   const exposure = clientConfig.publicExposure;