From f36e54cd688bd4ef4749002200ea0d00d21889e8 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Sun, 7 Jun 2026 11:22:43 +0200
Subject: [PATCH] fix(e2e): require secret probe success

---
 scripts/e2e/secret-provider-integrations.mjs  | 15 +++++++++++++++
 .../secret-provider-integrations.test.ts      | 19 +++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/scripts/e2e/secret-provider-integrations.mjs b/scripts/e2e/secret-provider-integrations.mjs
index e8726f85654f..5ce431a9e4e2 100644
--- a/scripts/e2e/secret-provider-integrations.mjs
+++ b/scripts/e2e/secret-provider-integrations.mjs
@@ -1265,6 +1265,15 @@ async function p3ThroughP6StaticReloadAndCommandSnapshot() {
   return "static capture, reload success, reload LKG, and command snapshot resolution proved";
 }
 
+function assertAllowedFailureCommandSucceeded(result, label, combinedOutput) {
+  if (result.signal) {
+    throw new Error(`${label} terminated by signal ${result.signal}: ${combinedOutput}`);
+  }
+  if (result.code !== 0) {
+    throw new Error(`${label} failed (${String(result.code)}): ${combinedOutput}`);
+  }
+}
+
 async function p7AuthProfileSecretRefPersistsAndResolves() {
   await withProofEnv("p7", async (envCtx, _plugin, storePath) => {
     const port = await allocatePort();
@@ -1316,6 +1325,11 @@ async function p7AuthProfileSecretRefPersistsAndResolves() {
         `auth-profile SecretRef did not resolve through plugin integration: ${combined}`,
       );
     }
+    assertAllowedFailureCommandSucceeded(
+      result,
+      "auth-profile SecretRef model status probe",
+      combined,
+    );
     const callsAfter = readJson(storePath).calls;
     if (callsAfter <= callsBefore) {
       throw new Error("auth-profile proof did not invoke the plugin-managed resolver");
@@ -1897,6 +1911,7 @@ async function main() {
 }
 
 export {
+  assertAllowedFailureCommandSucceeded,
   collectBlockingProofResults,
   cleanupEnv,
   expectGatewayStartupFails,
diff --git a/test/scripts/secret-provider-integrations.test.ts b/test/scripts/secret-provider-integrations.test.ts
index c5ad8c6bceba..8a2df42cde91 100644
--- a/test/scripts/secret-provider-integrations.test.ts
+++ b/test/scripts/secret-provider-integrations.test.ts
@@ -294,6 +294,25 @@ describe("secret provider integration proof harness", () => {
     }
   });
 
+  it("fails allowed-failure probes when the command exits nonzero", async () => {
+    const proof = await import(
+      `${pathToFileURL(proofScriptPath).href}?case=allowed-failure-${Date.now()}`
+    );
+
+    expect(() =>
+      proof.assertAllowedFailureCommandSucceeded(
+        {
+          code: 1,
+          signal: null,
+          stderr: "resolver invoked openai-profile",
+          stdout: "openai-profile",
+        },
+        "auth-profile SecretRef model status probe",
+        "openai-profile\nresolver invoked",
+      ),
+    ).toThrow("auth-profile SecretRef model status probe failed (1)");
+  });
+
   it.runIf(process.platform !== "win32")("bounds captured PTY configure output", async () => {
     const root = makeTempDir();
     const fakeOpenClaw = writeNoisySecretsConfigureOpenClaw(root);