From 0a0b7a919e0f5d3c330251a1d739d59104b0495a Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Sun, 12 Jul 2026 18:08:35 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=20Secret=20=E5=90=8C?=
 =?UTF-8?q?=E6=AD=A5=E6=88=90=E5=8A=9F=E8=BF=94=E5=9B=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/agentrun-secret-sync-output.test.ts    | 11 +++++++++++
 scripts/src/agentrun/trigger.ts                | 18 ++++++++++--------
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/scripts/src/agentrun-secret-sync-output.test.ts b/scripts/src/agentrun-secret-sync-output.test.ts
index d5abfc76..0f2679d5 100644
--- a/scripts/src/agentrun-secret-sync-output.test.ts
+++ b/scripts/src/agentrun-secret-sync-output.test.ts
@@ -3,6 +3,7 @@ import { describe, expect, test } from "bun:test";
 import { parseSecretSyncOptions } from "./agentrun/control-plane";
 import type { SecretSyncOptions } from "./agentrun/options";
 import { compactAgentRunSecretSyncPayload, renderAgentRunSecretSyncResult } from "./agentrun/secret-sync-output";
+import { confirmedSecretSyncPlan } from "./agentrun/trigger";
 
 const options = (output: SecretSyncOptions["output"], overrides: Partial<SecretSyncOptions> = {}): SecretSyncOptions => ({
   confirm: false,
@@ -124,6 +125,16 @@ function blockedFixture(): Record<string, unknown> {
 }
 
 describe("AgentRun secret-sync bounded output", () => {
+  test("confirmed sync reports all written secrets without stale provider classification", () => {
+    const items = [{ id: "provider-gpt-pika-auth-json" }, { id: "provider-gpt-pika-config" }];
+    expect(confirmedSecretSyncPlan(items, 2)).toEqual({
+      secretCount: 2,
+      items,
+      writableSecretCount: 2,
+      valuesPrinted: false,
+    });
+  });
+
   test("parses compact machine output and explicit disclosure options", () => {
     expect(parseSecretSyncOptions(["--node", "NC01", "--lane", "nc01-v02", "--dry-run", "-o", "yaml"])).toEqual({
       confirm: false,
diff --git a/scripts/src/agentrun/trigger.ts b/scripts/src/agentrun/trigger.ts
index 5da28c28..00b63d1e 100644
--- a/scripts/src/agentrun/trigger.ts
+++ b/scripts/src/agentrun/trigger.ts
@@ -288,14 +288,7 @@ export async function secretSync(config: UniDeskConfig, options: SecretSyncOptio
     configPath,
     target: compactAgentRunLaneStatusTarget(spec),
     filter: options.secretIds.length === 0 ? null : { secretIds: options.secretIds, selected: sources.map((source) => source.id) },
-    plan: {
-      secretCount: plan.length,
-      items: plan,
-      providerSecretWriteSkippedCount: providerValues.length,
-      providerSecretClassification: "exact-target-ref",
-      writableNonProviderSecretCount: syncValues.length,
-      valuesPrinted: false,
-    },
+    plan: confirmedSecretSyncPlan(plan, syncValues.length),
     result: payload,
     capture: compactCapture(result, { full: result.exitCode !== 0, stdoutTailChars: 3000, stderrTailChars: 3000 }),
     next: {
@@ -305,6 +298,15 @@ export async function secretSync(config: UniDeskConfig, options: SecretSyncOptio
   };
 }
 
+export function confirmedSecretSyncPlan(items: readonly Record<string, unknown>[], writableSecretCount: number): Record<string, unknown> {
+  return {
+    secretCount: items.length,
+    items,
+    writableSecretCount,
+    valuesPrinted: false,
+  };
+}
+
 export async function exposeAgentRun(_config: UniDeskConfig, options: ConfirmOptions): Promise<Record<string, unknown>> {
   const clientConfig = readAgentRunClientConfig();
   const exposure = clientConfig.publicExposure;