From 8ea747050805d88ca2504b76f0e87246df2c768f Mon Sep 17 00:00:00 2001
From: Peter Steinberger <peter@steipete.me>
Date: Sat, 11 Jul 2026 01:03:30 +0100
Subject: [PATCH] fix(release): avoid token-shaped Claude live probe (#103994)

(cherry picked from commit b71e0c78f05551718c10e72d883913cd194685a4)
---
 scripts/test-live-cli-backend-docker.sh       | 20 ++++++++++---------
 .../test-live-cli-backend-docker.test.ts      |  4 ++++
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/scripts/test-live-cli-backend-docker.sh b/scripts/test-live-cli-backend-docker.sh
index b358e652a6da..4d5f187bb2fa 100644
--- a/scripts/test-live-cli-backend-docker.sh
+++ b/scripts/test-live-cli-backend-docker.sh
@@ -374,11 +374,10 @@ WRAP
   fi
   if [ "$auth_mode" = "subscription" ]; then
     claude --version
-    direct_token="violet-lantern-42"
     direct_probe_log="$(mktemp)"
     set +e
     claude \
-      -p "This is a local CLI smoke test. Reply with only this harmless phrase: $direct_token" \
+      -p "This is a local CLI smoke test. What is two plus two? Reply with only the result." \
       --output-format text \
       --model sonnet \
       --permission-mode bypassPermissions \
@@ -388,22 +387,25 @@ WRAP
       --no-session-persistence >"$direct_probe_log" 2>&1
     direct_probe_status=$?
     set -e
-    direct_output="$(<"$direct_probe_log")"
-    if [ "$direct_probe_status" -ne 0 ]; then
-      echo "ERROR: direct Claude subscription probe exited with status $direct_probe_status." >&2
+    print_redacted_direct_probe_log() {
       sed -E \
         -e 's/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/<redacted-email>/g' \
         -e 's/(sk-ant-|sk-)[A-Za-z0-9_-]+/<redacted-secret>/g' \
         "$direct_probe_log" >&2
+    }
+    if [ "$direct_probe_status" -ne 0 ]; then
+      echo "ERROR: direct Claude subscription probe exited with status $direct_probe_status." >&2
+      print_redacted_direct_probe_log
       rm -f "$direct_probe_log"
       exit "$direct_probe_status"
     fi
-    rm -f "$direct_probe_log"
-    if [[ "$direct_output" != *"$direct_token"* ]]; then
-      echo "ERROR: direct Claude subscription probe did not return expected token." >&2
-      echo "$direct_output" >&2
+    if ! grep -Eiq '(^|[^[:alnum:]])(4|four)([^[:alnum:]]|$)' "$direct_probe_log"; then
+      echo "ERROR: direct Claude subscription probe did not return the expected arithmetic result." >&2
+      print_redacted_direct_probe_log
+      rm -f "$direct_probe_log"
       exit 1
     fi
+    rm -f "$direct_probe_log"
     echo "[claude-subscription] direct claude -p probe ok"
   else
     claude auth status || true
diff --git a/test/scripts/test-live-cli-backend-docker.test.ts b/test/scripts/test-live-cli-backend-docker.test.ts
index ecfe76f0a792..1925decf1ba4 100644
--- a/test/scripts/test-live-cli-backend-docker.test.ts
+++ b/test/scripts/test-live-cli-backend-docker.test.ts
@@ -61,6 +61,10 @@ describe("scripts/test-live-cli-backend-docker.sh", () => {
 
     expect(script).toContain('direct_probe_log="$(mktemp)"');
     expect(script).toContain("This is a local CLI smoke test.");
+    expect(script).toContain("What is two plus two?");
+    expect(script).toContain("(4|four)");
+    expect(script).not.toContain("direct_token=");
+    expect(script).not.toContain("expected token");
     expect(script).not.toContain("OPENCLAW-CLAUDE-SUBSCRIPTION-DIRECT");
     expect(script).toContain("direct Claude subscription probe exited with status");
     expect(script).toContain("<redacted-email>");