aquaman-proxy 0.13.0 → 0.14.0

package/README.md

@@ -18,7 +18,7 @@ Agent / OpenClaw / Coding Agent              Aquaman Proxy
 │  No credentials.     │  proxy.sock         │                      │
 │  No open ports.      │  (chmod 0o600)      │                      │
 │  Nothing to steal.   │                     │                      │
-└──────────────────────┘                     └───┬──────────┬───────┘
+└──────────────────────┘                     └──┬──────────┬────────┘
                                                 │          │
                                                 │          ▼
                                                 │  ~/.aquaman/audit/

package/dist/cli/index.js

@@ -12,12 +12,14 @@ import { Command, Help } from 'commander';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import * as http from 'node:http';
-import { loadConfig, getConfigDir, ensureConfigDir, getDefaultConfig, expandPath, createAuditLogger, createCredentialStore, saveConfig, generateLoopbackToken, DEFAULT_LOOPBACK_PORT } from '../core/index.js';
+import { loadConfig, getConfigDir, ensureConfigDir, getDefaultConfig, expandPath, createAuditLogger, createCredentialStore, saveConfig, generateLoopbackToken, DEFAULT_LOOPBACK_PORT, wrapWithCache, resolveCacheTtl } from '../core/index.js';
 import { fileURLToPath } from 'node:url';
 import { createCredentialProxy } from '../daemon.js';
 import { createServiceRegistry, ServiceRegistry } from '../service-registry.js';
 import { createOpenClawIntegration, authProfilesAreSqliteOnly } from '../openclaw/integration.js';
+import { supportsSecretRefIntegrations, wireSecretRefProviders, secretRefWiringStatus } from '../openclaw/secretref.js';
 import { createHermesIntegration, detectHermes } from '../hermes/integration.js';
+import { managedScopeShadowedKeys, HERMES_MANAGED_ENV_PATH } from '../hermes/config-writer.js';
 import { loadPolicyFromConfig, validatePolicyConfig, getDefaultPolicyPresets, matchPolicy } from '../request-policy.js';
 import { stringify as yamlStringify, parse as yamlParse } from 'yaml';
 // Read version from package.json (single source of truth)
@@ -38,6 +40,49 @@ function validateCredName(label, value) {
         process.exit(1);
     }
 }
+/**
+ * Soft hint for 1Password users running in biometric/desktop-app mode: every
+ * `op` spawn prompts, which makes unattended agents unusable. The daemon cache
+ * (v0.13.1+) bounds it to one prompt per TTL per credential; a service account
+ * removes prompts entirely. Printed by `aquaman doctor` and deep doctors.
+ */
+function printOnePasswordModeHint(config, indent = '    ') {
+    if (config.credentials.backend !== '1password')
+        return;
+    if (process.env['OP_SERVICE_ACCOUNT_TOKEN'] || process.env['OP_CONNECT_HOST'])
+        return;
+    const vault = config.credentials.onePasswordVault || 'aquaman';
+    const ttl = resolveCacheTtl(config);
+    const cacheNote = ttl > 0
+        ? `the daemon cache bounds this to one per ${Math.round(ttl / 60)} min per credential`
+        : 'and the credential cache is disabled (cacheTtlSeconds: 0)';
+    console.log(`${indent}• 1Password is in biometric/desktop-app mode — each vault read prompts (${cacheNote}).`);
+    console.log(`${indent}  For zero prompts, create a service account scoped to the "${vault}" vault (create the`);
+    console.log(`${indent}  vault + credentials as a human first, or grant write_items) and start the daemon with`);
+    console.log(`${indent}  OP_SERVICE_ACCOUNT_TOKEN. If OP_CONNECT_HOST/OP_CONNECT_TOKEN are set they take precedence.`);
+}
+/**
+ * Map config.credentials onto CredentialStoreOptions — the single source for
+ * every createCredentialStore() call in this CLI. Env fallbacks mirror
+ * applyEnvOverrides() (belt and braces for callers that build partial configs).
+ */
+function storeOptionsFromConfig(config) {
+    return {
+        backend: config.credentials.backend,
+        encryptionPassword: config.credentials.encryptionPassword || process.env['AQUAMAN_ENCRYPTION_PASSWORD'] || process.env['AQUAMAN_KEEPASS_PASSWORD'],
+        vaultAddress: config.credentials.vaultAddress || process.env['VAULT_ADDR'],
+        vaultToken: config.credentials.vaultToken || process.env['VAULT_TOKEN'],
+        vaultNamespace: config.credentials.vaultNamespace,
+        vaultMountPath: config.credentials.vaultMountPath,
+        onePasswordVault: config.credentials.onePasswordVault,
+        onePasswordAccount: config.credentials.onePasswordAccount,
+        keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
+        keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+        bitwardenFolder: config.credentials.bitwardenFolder,
+        bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+        bitwardenCollectionId: config.credentials.bitwardenCollectionId
+    };
+}
 /**
  * Build loopback listener options from config for the daemon. Returns undefined
  * unless the loopback listener is explicitly enabled. If it's enabled but no
@@ -310,21 +355,10 @@ program
         // Vault \u2014 backend + creds
         try {
             const config = loadConfig();
-            const store = await createCredentialStore({
-                backend: config.credentials.backend,
-                encryptionPassword: config.credentials.encryptionPassword,
-                vaultAddress: config.credentials.vaultAddress,
-                vaultToken: config.credentials.vaultToken,
-                onePasswordVault: config.credentials.onePasswordVault,
-                onePasswordAccount: config.credentials.onePasswordAccount,
-                keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-                keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-                bitwardenFolder: config.credentials.bitwardenFolder,
-                bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-                bitwardenCollectionId: config.credentials.bitwardenCollectionId
-            });
+            const store = await createCredentialStore(storeOptionsFromConfig(config));
             const creds = await store.list();
             console.log(`    \u2713 ${config.credentials.backend} backend (${creds.length} credential${creds.length !== 1 ? 's' : ''})`);
+            printOnePasswordModeHint(config);
         }
         catch (err) {
             console.log(`    \u2717 Backend not accessible: ${err.message}`);
@@ -528,19 +562,7 @@ async function runVaultSetup(opts) {
     fs.mkdirSync(auditDir, { recursive: true, mode: 0o700 });
     let store;
     try {
-        store = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword || process.env['AQUAMAN_ENCRYPTION_PASSWORD'] || process.env['AQUAMAN_KEEPASS_PASSWORD'],
-            vaultAddress: config.credentials.vaultAddress || process.env['VAULT_ADDR'],
-            vaultToken: config.credentials.vaultToken || process.env['VAULT_TOKEN'],
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        store = await createCredentialStore(storeOptionsFromConfig(config));
     }
     catch (err) {
         console.error(`  Failed to initialize ${backend}: ${err instanceof Error ? err.message : err}`);
@@ -666,21 +688,7 @@ openclaw
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword,
-            vaultAddress: config.credentials.vaultAddress,
-            vaultToken: config.credentials.vaultToken,
-            vaultNamespace: config.credentials.vaultNamespace,
-            vaultMountPath: config.credentials.vaultMountPath,
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        credentialStore = wrapWithCache(await createCredentialStore(storeOptionsFromConfig(config)), resolveCacheTtl(config));
     }
     catch (err) {
         console.error(`Credential backend "${config.credentials.backend}" failed to initialize: ${err instanceof Error ? err.message : err}`);
@@ -822,21 +830,7 @@ program
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword,
-            vaultAddress: config.credentials.vaultAddress,
-            vaultToken: config.credentials.vaultToken,
-            vaultNamespace: config.credentials.vaultNamespace,
-            vaultMountPath: config.credentials.vaultMountPath,
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        credentialStore = wrapWithCache(await createCredentialStore(storeOptionsFromConfig(config)), resolveCacheTtl(config));
     }
     catch (err) {
         console.error(`Credential backend "${config.credentials.backend}" failed to initialize: ${err instanceof Error ? err.message : err}`);
@@ -896,21 +890,7 @@ openclaw
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword,
-            vaultAddress: config.credentials.vaultAddress,
-            vaultToken: config.credentials.vaultToken,
-            vaultNamespace: config.credentials.vaultNamespace,
-            vaultMountPath: config.credentials.vaultMountPath,
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        credentialStore = wrapWithCache(await createCredentialStore(storeOptionsFromConfig(config)), resolveCacheTtl(config));
     }
     catch (err) {
         console.error(`Credential backend "${config.credentials.backend}" failed to initialize: ${err instanceof Error ? err.message : err}`);
@@ -1104,6 +1084,10 @@ hermes
     }
     catch { /* unreadable */ }
     console.log(`  ~/.hermes/.env:    ${envWired ? aqua('wired') : 'not wired'}  (${envPath})`);
+    const shadowed = managedScopeShadowedKeys(integration.configureHermes());
+    if (shadowed.length > 0) {
+        console.log(`  Managed scope:     ⚠ ${HERMES_MANAGED_ENV_PATH} pins ${shadowed.join(', ')} — proxy bypassed for these keys`);
+    }
     const info = await detectHermes(config.hermes?.binaryPath || 'hermes');
     console.log(`  Hermes CLI:        ${info.installed ? aqua(`v${info.version}`) : 'not found'}`);
     // Live liveness probe of the loopback listener (no token needed for _health).
@@ -1162,6 +1146,16 @@ hermes
     catch {
         fail(`Could not read ${envPath}`);
     }
+    // 3b. Hermes >=0.17 managed scope: /etc/hermes/.env overrides ~/.hermes/.env
+    {
+        const shadowed = managedScopeShadowedKeys(integration.configureHermes());
+        if (shadowed.length > 0) {
+            fail(`Hermes managed scope (${HERMES_MANAGED_ENV_PATH}) pins ${shadowed.join(', ')} — it overrides ~/.hermes/.env, so the proxy is BYPASSED for these keys. Remove them from the managed file or point them at the proxy.`);
+        }
+        else {
+            pass('No managed-scope override of aquaman env vars');
+        }
+    }
     // 4. Per-service vault credentials resolve
     const wired = integration.wiredServices();
     if (wired.length === 0) {
@@ -1169,21 +1163,7 @@ hermes
     }
     else {
         try {
-            const store = await createCredentialStore({
-                backend: config.credentials.backend,
-                encryptionPassword: config.credentials.encryptionPassword,
-                vaultAddress: config.credentials.vaultAddress,
-                vaultToken: config.credentials.vaultToken,
-                vaultNamespace: config.credentials.vaultNamespace,
-                vaultMountPath: config.credentials.vaultMountPath,
-                onePasswordVault: config.credentials.onePasswordVault,
-                onePasswordAccount: config.credentials.onePasswordAccount,
-                keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-                keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-                bitwardenFolder: config.credentials.bitwardenFolder,
-                bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-                bitwardenCollectionId: config.credentials.bitwardenCollectionId,
-            });
+            const store = await createCredentialStore(storeOptionsFromConfig(config));
             for (const svc of wired) {
                 const val = await store.get(svc, 'api_key');
                 if (val)
@@ -1191,6 +1171,7 @@ hermes
                 else
                     fail(`No credential for ${svc}/api_key — run: aquaman credentials add ${svc} api_key`);
             }
+            printOnePasswordModeHint(config, '  ');
         }
         catch (err) {
             fail(`Vault backend "${config.credentials.backend}" failed: ${err instanceof Error ? err.message : err}`);
@@ -1379,7 +1360,7 @@ openclaw
                     process.exit(1);
                 }
             }
-            catch (err) {
+            catch {
                 console.error(`  Cannot reach Vault at ${vaultAddr}.`);
                 process.exit(1);
             }
@@ -1459,19 +1440,7 @@ openclaw
     // 3. Prompt for API keys (or read from env in non-interactive mode)
     let store;
     try {
-        store = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword || process.env['AQUAMAN_ENCRYPTION_PASSWORD'] || process.env['AQUAMAN_KEEPASS_PASSWORD'],
-            vaultAddress: config.credentials.vaultAddress || process.env['VAULT_ADDR'],
-            vaultToken: config.credentials.vaultToken || process.env['VAULT_TOKEN'],
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        store = await createCredentialStore(storeOptionsFromConfig(config));
     }
     catch (err) {
         console.error(`  Failed to initialize ${backend} credential store: ${err instanceof Error ? err.message : err}`);
@@ -1657,22 +1626,54 @@ openclaw
                 if (!openclawConfig.plugins.allow.includes('aquaman-plugin')) {
                     openclawConfig.plugins.allow.push('aquaman-plugin');
                 }
+                const configuredServices = storedServices.length > 0 ? storedServices : ['anthropic', 'openai'];
                 openclawConfig.plugins.entries['aquaman-plugin'] = {
                     enabled: true,
                     config: {
                         backend,
-                        services: storedServices.length > 0 ? storedServices : ['anthropic', 'openai'],
+                        services: configuredServices,
                     }
                 };
+                // Detect the gateway version once \u2014 it gates the credential surface:
+                // SecretRef wiring (canonical, >= 2026.6.5) vs the legacy
+                // auth-profiles.json placeholder. AQUAMAN_OPENCLAW_VERSION overrides
+                // detection (tests + operators pinning behavior explicitly).
+                let ocVersion = process.env.AQUAMAN_OPENCLAW_VERSION || null;
+                if (!ocVersion) {
+                    try {
+                        const { execSync } = await import('node:child_process');
+                        ocVersion = execSync('openclaw --version', { stdio: 'pipe', encoding: 'utf-8', timeout: 5000 }).trim();
+                    }
+                    catch { /* CLI not on PATH */ }
+                }
+                // b2. SecretRef provider wiring (v0.14.0+, OpenClaw >= 2026.6.5).
+                // Config-level refs in openclaw.json are runtime-read on every
+                // version and survive OpenClaw's plaintext scrubs \u2014 no SQLite
+                // import step needed, unlike the legacy placeholder.
+                const secretRefSupported = supportsSecretRefIntegrations(ocVersion);
+                if (secretRefSupported) {
+                    const wiring = wireSecretRefProviders(openclawConfig, configuredServices);
+                    if (wiring.wiredProviders.length > 0) {
+                        console.log(`  \u2713 SecretRef wiring for ${wiring.wiredProviders.join(', ')} (canonical credential surface)`);
+                    }
+                    const userKept = wiring.skippedProviders.filter(s => s === 'anthropic' || s === 'openai');
+                    if (userKept.length > 0) {
+                        console.log(`  \u2192 Left existing user-set apiKey untouched for: ${userKept.join(', ')}`);
+                    }
+                }
                 fs.writeFileSync(openclawJsonPath, JSON.stringify(openclawConfig, null, 2), 'utf-8');
                 console.log('  \u2713 Plugin config written to ' + openclawJsonPath);
-                // c. Generate auth-profiles.json (only if missing)
+                // c. Generate auth-profiles.json (only if missing). With SecretRef
+                // wiring active this is a redundant legacy surface \u2014 skip it so
+                // `openclaw secrets audit` has no plaintext placeholder to flag.
                 const profilesPath = path.join(openclawStateDir, 'agents', 'main', 'agent', 'auth-profiles.json');
-                if (!fs.existsSync(profilesPath)) {
+                if (secretRefSupported) {
+                    console.log('  \u2192 Legacy auth-profiles.json placeholder skipped (SecretRef wiring replaces it)');
+                }
+                else if (!fs.existsSync(profilesPath)) {
                     const profiles = {};
                     const order = {};
-                    const profileServices = storedServices.length > 0 ? storedServices : ['anthropic', 'openai'];
-                    for (const svc of profileServices) {
+                    for (const svc of configuredServices) {
                         if (svc === 'anthropic' || svc === 'openai') {
                             profiles[`${svc}:default`] = {
                                 type: 'api_key',
@@ -1688,20 +1689,13 @@ openclaw
                     console.log('  \u2713 Auth profiles generated at ' + profilesPath);
                     // OpenClaw >= 2026.6.5 reads provider auth profiles from each agent's
                     // openclaw-agent.sqlite, not auth-profiles.json (openclaw/openclaw#89102).
-                    // The placeholder above must be imported into SQLite once with
-                    // `openclaw doctor --fix`. We deliberately do NOT auto-run that here:
+                    // On those versions the SecretRef branch above applies instead; this
+                    // hint only fires when the version couldn't be detected (SecretRef
+                    // gate returned false) but the runtime turns out to be >= 2026.6.5.
+                    // We deliberately do NOT auto-run `openclaw doctor --fix` here:
                     // it is OpenClaw's broad config-healing command \u2014 verified to take
                     // ~19s (gateway probes) and to rewrite openclaw.json (it reset our
-                    // plugin entry to bundled defaults in testing). `aquaman openclaw
-                    // doctor` detects the SQLite-only case and prints the import step so
-                    // the operator runs it intentionally. Holistic fix (SecretRef
-                    // provider manifest) is tracked for the next plugin touch.
-                    let ocVersion = null;
-                    try {
-                        const { execSync } = await import('node:child_process');
-                        ocVersion = execSync('openclaw --version', { stdio: 'pipe', encoding: 'utf-8', timeout: 5000 }).trim();
-                    }
-                    catch { /* CLI not on PATH */ }
+                    // plugin entry to bundled defaults in testing).
                     if (authProfilesAreSqliteOnly(ocVersion)) {
                         console.log('  \u2192 OpenClaw \u2265 2026.6.5 reads auth profiles from SQLite; import the placeholder once:');
                         console.log('      openclaw doctor --fix    (backs up openclaw.json first; see aquaman openclaw doctor)');
@@ -1943,9 +1937,10 @@ openclaw
         console.log(`  \u2139 ${aqua('Policy')} not configured \u2014 agents can call any endpoint on proxied services`);
         console.log('    \u2192 Run: aquaman setup (or add policy rules to ~/.aquaman/config.yaml)');
     }
-    // 6. OpenClaw detection
+    // 6. OpenClaw detection. AQUAMAN_OPENCLAW_VERSION overrides version
+    // detection (tests + operators pinning behavior explicitly).
     let openclawDetected = false;
-    let openclawVersion = null;
+    let openclawVersion = process.env.AQUAMAN_OPENCLAW_VERSION || null;
     let cliFound = false;
     try {
         const { execSync } = await import('node:child_process');
@@ -1956,7 +1951,8 @@ openclaw
     if (cliFound) {
         try {
             const { execSync } = await import('node:child_process');
-            const ver = execSync('openclaw --version', { stdio: 'pipe', encoding: 'utf-8', timeout: 5000 }).trim();
+            const ver = openclawVersion ??
+                execSync('openclaw --version', { stdio: 'pipe', encoding: 'utf-8', timeout: 5000 }).trim();
             openclawVersion = ver;
             console.log(`  \u2713 ${aqua('OpenClaw')} installed (${ver})`);
         }
@@ -2040,15 +2036,55 @@ openclaw
                 // openclaw.json invalid — already reported above
             }
         }
-        // 9. Auth profiles. OpenClaw >= 2026.6.5 reads provider auth profiles from
-        //    each agent's openclaw-agent.sqlite and no longer reads
-        //    auth-profiles.json at runtime (openclaw/openclaw#89102). On those
-        //    versions the placeholder the plugin writes to the JSON file must be
-        //    imported into SQLite once via `openclaw doctor --fix`.
+        // 8.5. SecretRef provider wiring (v0.14.0+, OpenClaw >= 2026.6.5) — the
+        //      canonical credential surface that replaces the placeholder
+        //      auth-profiles dance.
+        let secretRefFullyWired = false;
+        if (supportsSecretRefIntegrations(openclawVersion) && fs.existsSync(openclawJsonPath)) {
+            try {
+                const openclawConfig = JSON.parse(fs.readFileSync(openclawJsonPath, 'utf-8'));
+                const pluginServices = openclawConfig.plugins?.entries?.['aquaman-plugin']?.config?.services ?? ['anthropic', 'openai'];
+                const status = secretRefWiringStatus(openclawConfig, pluginServices);
+                if (status.providerConfigured && status.missingProviders.length === 0) {
+                    secretRefFullyWired = true;
+                    console.log(`  ✓ ${aqua('SecretRef')} wiring active (${status.wiredProviders.join(', ') || 'no providers'})`);
+                }
+                else if (status.providerConfigured) {
+                    // Half-migrated: the provider block exists but some providers still
+                    // lack refs — a real inconsistency, fail the check.
+                    console.log(`  ✗ ${aqua('SecretRef')} wiring incomplete (providers not wired: ${status.missingProviders.join(', ')})`);
+                    console.log('    → Run: aquaman openclaw setup   (completes the SecretRef wiring in openclaw.json)');
+                    issues++;
+                }
+                else {
+                    // Legacy placeholder flow still functional — upgrade suggestion,
+                    // not a failure. (OpenClaw's configure-flow scrubs treat the
+                    // plaintext placeholder as residue; SecretRef wiring is immune.)
+                    console.log(`  → ${aqua('SecretRef')} wiring available on this OpenClaw — run: aquaman openclaw setup`);
+                    console.log('    (replaces the legacy plaintext placeholder, which OpenClaw now scrubs by default)');
+                }
+            }
+            catch {
+                // openclaw.json invalid — already reported above
+            }
+        }
+        // 9. Auth profiles. With SecretRef wiring active this surface is
+        //    legacy/inert. Otherwise: OpenClaw >= 2026.6.5 reads provider auth
+        //    profiles from each agent's openclaw-agent.sqlite and no longer reads
+        //    auth-profiles.json at runtime (openclaw/openclaw#89102) — the
+        //    placeholder the plugin writes to the JSON file must be imported
+        //    into SQLite once via `openclaw doctor --fix`.
         const agentDir = path.join(openclawStateDir, 'agents', 'main', 'agent');
         const profilesPath = path.join(agentDir, 'auth-profiles.json');
         const sqlitePath = path.join(agentDir, 'openclaw-agent.sqlite');
-        if (authProfilesAreSqliteOnly(openclawVersion)) {
+        if (secretRefFullyWired) {
+            console.log(`  ✓ ${aqua('Auth profiles')} not needed (SecretRef wiring replaces the placeholder flow)`);
+            if (fs.existsSync(profilesPath)) {
+                console.log('    → Optional: the legacy auth-profiles.json placeholder is inert and may be deleted');
+                console.log('      (`openclaw secrets audit` flags its plaintext placeholder as PLAINTEXT_FOUND)');
+            }
+        }
+        else if (authProfilesAreSqliteOnly(openclawVersion)) {
             if (fs.existsSync(profilesPath)) {
                 console.log(`  \u2717 ${aqua('Auth profiles')} JSON present but ${openclawVersion} reads from SQLite`);
                 console.log('    \u2192 Import the placeholder once: openclaw doctor --fix  (backs up openclaw.json first)');