From 56e5b8b9e85a3268d56cbaf7e22448bbba69ed78 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 13 Mar 2026 22:04:54 +0000
Subject: [PATCH] test: tighten secret file error coverage

---
 src/infra/secret-file.test.ts | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/src/infra/secret-file.test.ts b/src/infra/secret-file.test.ts
index ca7841891e5..5e9e6fe7b90 100644
--- a/src/infra/secret-file.test.ts
+++ b/src/infra/secret-file.test.ts
@@ -29,6 +29,37 @@ describe("readSecretFileSync", () => {
     await writeFile(file, " top-secret \n", "utf8");
 
     expect(readSecretFileSync(file, "Gateway password")).toBe("top-secret");
+    expect(tryReadSecretFileSync(file, "Gateway password")).toBe("top-secret");
+  });
+
+  it("surfaces resolvedPath and error details for missing files", async () => {
+    const dir = await createTempDir();
+    const file = path.join(dir, "missing-secret.txt");
+
+    const result = loadSecretFileSync(file, "Gateway password");
+
+    expect(result).toMatchObject({
+      ok: false,
+      resolvedPath: file,
+      message: expect.stringContaining(`Failed to inspect Gateway password file at ${file}:`),
+      error: expect.any(Error),
+    });
+  });
+
+  it("preserves the underlying cause when throwing for missing files", async () => {
+    const dir = await createTempDir();
+    const file = path.join(dir, "missing-secret.txt");
+
+    let thrown: Error | undefined;
+    try {
+      readSecretFileSync(file, "Gateway password");
+    } catch (error) {
+      thrown = error as Error;
+    }
+
+    expect(thrown).toBeInstanceOf(Error);
+    expect(thrown?.message).toContain(`Failed to inspect Gateway password file at ${file}:`);
+    expect((thrown as Error & { cause?: unknown }).cause).toBeInstanceOf(Error);
   });
 
   it("rejects files larger than the secret-file limit", async () => {