Secrets: gate exec dry-run and preflight resolution behind --allow-exec (#49417)

* Secrets: gate exec dry-run resolution behind --allow-exec

* Secrets: fix dry-run completeness and skipped exec audit semantics

* Secrets: require --allow-exec for exec-containing apply writes

* Docs: align secrets exec consent behavior

* Changelog: note secrets exec consent gating

src/cli/secrets-cli.test.ts

@@ -1,3 +1,6 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import { Command } from "commander";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { createCliRuntimeCapture } from "./test-runtime-capture.js";
@@ -23,7 +26,7 @@ vi.mock("../runtime.js", () => ({
 }));
 
 vi.mock("../secrets/audit.js", () => ({
-  runSecretsAudit: () => runSecretsAudit(),
+  runSecretsAudit: (options: unknown) => runSecretsAudit(options),
   resolveSecretsAuditExitCode: (report: unknown, check: boolean) =>
     resolveSecretsAuditExitCode(report, check),
 }));
@@ -90,6 +93,11 @@ describe("secrets CLI", () => {
         shadowedRefCount: 0,
         legacyResidueCount: 0,
       },
+      resolution: {
+        refsChecked: 0,
+        skippedExecRefs: 0,
+        resolvabilityComplete: true,
+      },
       findings: [],
     });
     resolveSecretsAuditExitCode.mockReturnValue(1);
@@ -97,10 +105,42 @@ describe("secrets CLI", () => {
     await expect(
       createProgram().parseAsync(["secrets", "audit", "--check"], { from: "user" }),
     ).rejects.toBeTruthy();
-    expect(runSecretsAudit).toHaveBeenCalled();
+    expect(runSecretsAudit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        allowExec: false,
+      }),
+    );
     expect(resolveSecretsAuditExitCode).toHaveBeenCalledWith(expect.anything(), true);
   });
 
+  it("forwards --allow-exec to secrets audit", async () => {
+    runSecretsAudit.mockResolvedValue({
+      version: 1,
+      status: "clean",
+      filesScanned: [],
+      summary: {
+        plaintextCount: 0,
+        unresolvedRefCount: 0,
+        shadowedRefCount: 0,
+        legacyResidueCount: 0,
+      },
+      resolution: {
+        refsChecked: 1,
+        skippedExecRefs: 0,
+        resolvabilityComplete: true,
+      },
+      findings: [],
+    });
+    resolveSecretsAuditExitCode.mockReturnValue(0);
+
+    await createProgram().parseAsync(["secrets", "audit", "--allow-exec"], { from: "user" });
+    expect(runSecretsAudit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        allowExec: true,
+      }),
+    );
+  });
+
   it("runs secrets configure then apply when confirmed", async () => {
     runSecretsConfigureInteractive.mockResolvedValue({
       plan: {
@@ -125,6 +165,12 @@ describe("secrets CLI", () => {
         mode: "dry-run",
         changed: true,
         changedFiles: ["/tmp/openclaw.json"],
+        checks: {
+          resolvability: true,
+          resolvabilityComplete: true,
+        },
+        refsChecked: 1,
+        skippedExecRefs: 0,
         warningCount: 0,
         warnings: [],
       },
@@ -134,6 +180,12 @@ describe("secrets CLI", () => {
       mode: "write",
       changed: true,
       changedFiles: ["/tmp/openclaw.json"],
+      checks: {
+        resolvability: true,
+        resolvabilityComplete: true,
+      },
+      refsChecked: 1,
+      skippedExecRefs: 0,
       warningCount: 0,
       warnings: [],
     });
@@ -169,6 +221,12 @@ describe("secrets CLI", () => {
         mode: "dry-run",
         changed: false,
         changedFiles: [],
+        checks: {
+          resolvability: true,
+          resolvabilityComplete: true,
+        },
+        refsChecked: 0,
+        skippedExecRefs: 0,
         warningCount: 0,
         warnings: [],
       },
@@ -179,6 +237,215 @@ describe("secrets CLI", () => {
     expect(runSecretsConfigureInteractive).toHaveBeenCalledWith(
       expect.objectContaining({
         agentId: "ops",
+        allowExecInPreflight: false,
+      }),
+    );
+  });
+
+  it("forwards --allow-exec to secrets apply dry-run", async () => {
+    const planPath = path.join(
+      os.tmpdir(),
+      `openclaw-secrets-cli-test-${Date.now()}-${Math.random().toString(16).slice(2)}.json`,
+    );
+    await fs.writeFile(
+      planPath,
+      `${JSON.stringify({
+        version: 1,
+        protocolVersion: 1,
+        generatedAt: new Date().toISOString(),
+        generatedBy: "manual",
+        targets: [],
+      })}\n`,
+      "utf8",
+    );
+    runSecretsApply.mockResolvedValue({
+      mode: "dry-run",
+      changed: false,
+      changedFiles: [],
+      checks: {
+        resolvability: true,
+        resolvabilityComplete: true,
+      },
+      refsChecked: 0,
+      skippedExecRefs: 0,
+      warningCount: 0,
+      warnings: [],
+    });
+
+    await createProgram().parseAsync(
+      ["secrets", "apply", "--from", planPath, "--dry-run", "--allow-exec"],
+      {
+        from: "user",
+      },
+    );
+    expect(runSecretsApply).toHaveBeenCalledWith(
+      expect.objectContaining({
+        write: false,
+        allowExec: true,
+      }),
+    );
+    await fs.rm(planPath, { force: true });
+  });
+
+  it("forwards --allow-exec to secrets apply write mode", async () => {
+    const planPath = path.join(
+      os.tmpdir(),
+      `openclaw-secrets-cli-test-${Date.now()}-${Math.random().toString(16).slice(2)}.json`,
+    );
+    await fs.writeFile(
+      planPath,
+      `${JSON.stringify({
+        version: 1,
+        protocolVersion: 1,
+        generatedAt: new Date().toISOString(),
+        generatedBy: "manual",
+        targets: [],
+      })}\n`,
+      "utf8",
+    );
+    runSecretsApply.mockResolvedValue({
+      mode: "write",
+      changed: false,
+      changedFiles: [],
+      checks: {
+        resolvability: true,
+        resolvabilityComplete: true,
+      },
+      refsChecked: 0,
+      skippedExecRefs: 0,
+      warningCount: 0,
+      warnings: [],
+    });
+
+    await createProgram().parseAsync(["secrets", "apply", "--from", planPath, "--allow-exec"], {
+      from: "user",
+    });
+    expect(runSecretsApply).toHaveBeenCalledWith(
+      expect.objectContaining({
+        write: true,
+        allowExec: true,
+      }),
+    );
+    await fs.rm(planPath, { force: true });
+  });
+
+  it("does not print skipped-exec note when apply dry-run skippedExecRefs is zero", async () => {
+    const planPath = path.join(
+      os.tmpdir(),
+      `openclaw-secrets-cli-test-${Date.now()}-${Math.random().toString(16).slice(2)}.json`,
+    );
+    await fs.writeFile(
+      planPath,
+      `${JSON.stringify({
+        version: 1,
+        protocolVersion: 1,
+        generatedAt: new Date().toISOString(),
+        generatedBy: "manual",
+        targets: [],
+      })}\n`,
+      "utf8",
+    );
+    runSecretsApply.mockResolvedValue({
+      mode: "dry-run",
+      changed: false,
+      changedFiles: [],
+      checks: {
+        resolvability: true,
+        resolvabilityComplete: false,
+      },
+      refsChecked: 0,
+      skippedExecRefs: 0,
+      warningCount: 0,
+      warnings: [],
+    });
+
+    await createProgram().parseAsync(["secrets", "apply", "--from", planPath, "--dry-run"], {
+      from: "user",
+    });
+    expect(runtimeLogs.some((line) => line.includes("Secrets apply dry-run note: skipped"))).toBe(
+      false,
+    );
+    await fs.rm(planPath, { force: true });
+  });
+
+  it("does not print skipped-exec note when configure preflight skippedExecRefs is zero", async () => {
+    runSecretsConfigureInteractive.mockResolvedValue({
+      plan: {
+        version: 1,
+        protocolVersion: 1,
+        generatedAt: "2026-02-26T00:00:00.000Z",
+        generatedBy: "openclaw secrets configure",
+        targets: [],
+      },
+      preflight: {
+        mode: "dry-run",
+        changed: false,
+        changedFiles: [],
+        checks: {
+          resolvability: true,
+          resolvabilityComplete: false,
+        },
+        refsChecked: 0,
+        skippedExecRefs: 0,
+        warningCount: 0,
+        warnings: [],
+      },
+    });
+    confirm.mockResolvedValue(false);
+
+    await createProgram().parseAsync(["secrets", "configure"], { from: "user" });
+    expect(runtimeLogs.some((line) => line.includes("Preflight note: skipped"))).toBe(false);
+  });
+
+  it("forwards --allow-exec to configure preflight and apply", async () => {
+    runSecretsConfigureInteractive.mockResolvedValue({
+      plan: {
+        version: 1,
+        protocolVersion: 1,
+        generatedAt: "2026-02-26T00:00:00.000Z",
+        generatedBy: "openclaw secrets configure",
+        targets: [],
+      },
+      preflight: {
+        mode: "dry-run",
+        changed: false,
+        changedFiles: [],
+        checks: {
+          resolvability: true,
+          resolvabilityComplete: true,
+        },
+        refsChecked: 0,
+        skippedExecRefs: 0,
+        warningCount: 0,
+        warnings: [],
+      },
+    });
+    runSecretsApply.mockResolvedValue({
+      mode: "write",
+      changed: false,
+      changedFiles: [],
+      checks: {
+        resolvability: true,
+        resolvabilityComplete: true,
+      },
+      refsChecked: 0,
+      skippedExecRefs: 0,
+      warningCount: 0,
+      warnings: [],
+    });
+
+    await createProgram().parseAsync(["secrets", "configure", "--apply", "--yes", "--allow-exec"], {
+      from: "user",
+    });
+    expect(runSecretsConfigureInteractive).toHaveBeenCalledWith(
+      expect.objectContaining({
+        allowExecInPreflight: true,
+      }),
+    );
+    expect(runSecretsApply).toHaveBeenCalledWith(
+      expect.objectContaining({
+        write: true,
+        allowExec: true,
       }),
     );
   });