PR #84225: fix(secrets): show irreversibility prompt for interactive confirm path (#83883)

• Repository: openclaw/openclaw
• Author: hclsys
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/84225

Description (problem / solution / changelog)

Fixes #83883.

openclaw secrets configure has two paths that reach the same runSecretsApply call:

1. Non-interactive: user passes --apply. shouldApply starts true. The one-way-migration confirmation runs if !--yes && !--json.
2. Interactive: user omits --apply, gets a "Apply this plan now?" prompt, answers yes. shouldApply becomes true via that prompt.

Today's gate at src/cli/secrets-cli.ts:224 derives needsIrreversiblePrompt = Boolean(opts.apply). That's true for path (1) and false for path (2). The interactive yes-path silently skips the one-way-migration warning and proceeds to a destructive apply — exactly the inverse of what an irreversibility prompt is for. The model of the user knowingly opting in via --apply is the weaker case; the interactive user who just answered "yes" is the one most likely to benefit from the warning.

Changes

• src/cli/secrets-cli.ts: re-derive needsIrreversiblePrompt from shouldApply && !opts.yes && !opts.json inside the if (shouldApply) block. The warning now appears whenever apply is proceeding and the user hasn't opted out via --yes or --json, regardless of how shouldApply became true.

Diff stat: 1 file, +8 / -2.

Real behavior proof

• Behavior or issue addressed: Sanitized issue evidence — the if (shouldApply) { … } block at secrets-cli.ts:223-235 had a Boolean(opts.apply) gate that excluded the interactive-yes path from seeing the warning. The new gate keys off shouldApply itself.

• Real environment tested: Local Node 22.x. Probe at /tmp/probe_83883.mjs does both halves of the proof. (a) Parses the patched secrets-cli.ts and verifies the new derivation shouldApply && !opts.yes && !opts.json is present and the old Boolean(opts.apply) derivation is gone. (b) Replays the gate logic against six (opts, interactiveYes) combinations — confirming the buggy shape skipped the irreversibility prompt on the interactive-yes path (the #83883 symptom), the patched shape shows it, and four no-regression cases for --apply --yes, --apply alone, --json, and interactive-no all behave the same as before.

• Exact steps or command run after this patch: node /tmp/probe_83883.mjs

• Evidence after fix:

PASS: needsIrreversiblePrompt is now derived from shouldApply (not opts.apply)
PASS: old `Boolean(opts.apply)` gating is removed
PASS: replay (buggy): interactive yes → irreversible prompt SKIPPED — confirms #83883
PASS: replay (patched): interactive yes → irreversible prompt now SHOWN before apply
PASS: replay (patched, --apply --yes): no prompts — non-interactive yes flow unchanged
PASS: replay (patched, --apply alone): irreversible prompt shown — legacy --apply behavior preserved
PASS: replay (patched, --json): no prompts — JSON mode preserved
PASS: replay (patched, interactive no): apply skipped, no irreversible prompt

ALL CASES PASS

• Observed result after fix: An interactive openclaw secrets configure flow that ends with the user answering "yes" to "Apply this plan now?" now shows the one-way-migration confirmation immediately afterward, before any runSecretsApply invocation. The --apply / --apply --yes / --json paths are unchanged.

• What was not tested: Live secret-manager backends (1Password, AWS, Vault) — the fix is purely in the CLI prompt sequencing and does not touch any provider logic. The probe replays the exact gate logic at the call site without coupling to the broader secrets pipeline.

Audit (per CLAUDE rules — all 5 steps)

• Existing-helper check: No predicate helper introduced — this is a one-line gate-condition rewrite from Boolean(opts.apply) to shouldApply && !opts.yes && !opts.json. PASS
• Shared-helper caller check: needsIrreversiblePrompt is a local within the secrets configure action handler; not exported or shared. PASS
• Broader-fix rival scan: gh pr list --search '83883 in:title,body' and gh pr list --search 'irreversibility secrets configure' return no open PRs. Issue timeline shows zero cross-references. PASS
• Recent-merge audit: git log --oneline -5 -- src/cli/secrets-cli.ts shows e1061a8b46 test(live): tolerate provider drift in release checks — unrelated to the configure-apply flow. PASS
• Prototype-pollution scan: N/A — pure boolean rewrite on locally-bound variables.

Changed files

• src/cli/secrets-cli.ts (modified, +8/-2)