From 824d5d44cd189808deb30ed51722d825aed29c4e Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Sun, 7 Jun 2026 02:23:27 +0200
Subject: [PATCH] fix(test): require advisory cli provider skips

---
 src/gateway/gateway-cli-backend.live-helpers.test.ts | 10 +++++++++-
 src/gateway/gateway-cli-backend.live-helpers.ts      | 10 ++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/src/gateway/gateway-cli-backend.live-helpers.test.ts b/src/gateway/gateway-cli-backend.live-helpers.test.ts
index 693c981ea104..c4013aa577c0 100644
--- a/src/gateway/gateway-cli-backend.live-helpers.test.ts
+++ b/src/gateway/gateway-cli-backend.live-helpers.test.ts
@@ -34,6 +34,7 @@ describe("gateway cli backend live helpers", () => {
     delete process.env.OPENCLAW_BUNDLED_PLUGINS_DIR;
     delete process.env.OPENCLAW_TEST_MINIMAL_GATEWAY;
     delete process.env.OPENCLAW_LIVE_CLI_BACKEND_ALLOW_PROVIDER_SKIP;
+    delete process.env.OPENCLAW_LIVE_CLI_BACKEND_ADVISORY;
     delete process.env.ANTHROPIC_API_KEY;
     delete process.env.ANTHROPIC_API_KEY_OLD;
   });
@@ -155,6 +156,7 @@ describe("gateway cli backend live helpers", () => {
 
   it("requires provider results by default for explicit CLI backend live probes", async () => {
     const {
+      CLI_BACKEND_LIVE_ADVISORY_ENV,
       CLI_BACKEND_LIVE_PROVIDER_SKIP_ENV,
       resolveCliBackendLiveProviderSkipDecision,
       shouldAllowCliBackendLiveProviderSkip,
@@ -171,11 +173,17 @@ describe("gateway cli backend live helpers", () => {
     ).toEqual({
       action: "fail",
       message:
-        'agent request for provider "claude-cli" was blocked by auth drift. Set OPENCLAW_LIVE_CLI_BACKEND_ALLOW_PROVIDER_SKIP=1 only for advisory live probes.',
+        'agent request for provider "claude-cli" was blocked by auth drift. Set OPENCLAW_LIVE_CLI_BACKEND_ADVISORY=1 and OPENCLAW_LIVE_CLI_BACKEND_ALLOW_PROVIDER_SKIP=1 only for advisory live probes.',
     });
 
     expect(
       shouldAllowCliBackendLiveProviderSkip({ [CLI_BACKEND_LIVE_PROVIDER_SKIP_ENV]: "1" }),
+    ).toBe(false);
+    expect(
+      shouldAllowCliBackendLiveProviderSkip({
+        [CLI_BACKEND_LIVE_ADVISORY_ENV]: "1",
+        [CLI_BACKEND_LIVE_PROVIDER_SKIP_ENV]: "1",
+      }),
     ).toBe(true);
     expect(
       resolveCliBackendLiveProviderSkipDecision({
diff --git a/src/gateway/gateway-cli-backend.live-helpers.ts b/src/gateway/gateway-cli-backend.live-helpers.ts
index ac017af8651a..432cdbdef9c0 100644
--- a/src/gateway/gateway-cli-backend.live-helpers.ts
+++ b/src/gateway/gateway-cli-backend.live-helpers.ts
@@ -65,6 +65,7 @@ export type CliBackendLiveEnvSnapshot = {
 };
 
 export const CLI_BACKEND_LIVE_PROVIDER_SKIP_ENV = "OPENCLAW_LIVE_CLI_BACKEND_ALLOW_PROVIDER_SKIP";
+export const CLI_BACKEND_LIVE_ADVISORY_ENV = "OPENCLAW_LIVE_CLI_BACKEND_ADVISORY";
 
 export type CliBackendLiveProviderSkipDecision = {
   action: "fail" | "skip";
@@ -213,7 +214,10 @@ export function shouldRunCliModelSwitchProbe(providerId: string, modelRef: strin
 export function shouldAllowCliBackendLiveProviderSkip(
   env: Record<string, string | undefined> = process.env,
 ): boolean {
-  return isTruthyEnvValue(env[CLI_BACKEND_LIVE_PROVIDER_SKIP_ENV]);
+  return (
+    isTruthyEnvValue(env[CLI_BACKEND_LIVE_PROVIDER_SKIP_ENV]) &&
+    isTruthyEnvValue(env[CLI_BACKEND_LIVE_ADVISORY_ENV])
+  );
 }
 
 export function resolveCliBackendLiveProviderSkipDecision(params: {
@@ -228,7 +232,9 @@ export function resolveCliBackendLiveProviderSkipDecision(params: {
   }
   return {
     action: "fail",
-    message: `${message} Set ${CLI_BACKEND_LIVE_PROVIDER_SKIP_ENV}=1 only for advisory live probes.`,
+    message:
+      `${message} Set ${CLI_BACKEND_LIVE_ADVISORY_ENV}=1 and ` +
+      `${CLI_BACKEND_LIVE_PROVIDER_SKIP_ENV}=1 only for advisory live probes.`,
   };
 }