From 855748a1a2f131ed42a94e1ab09a91f4717f1d0d Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 13 Mar 2026 19:13:13 +0000
Subject: [PATCH] refactor: share secret fallback diagnostics

---
 src/cli/command-secret-gateway.test.ts | 55 +++++++++-----------------
 1 file changed, 19 insertions(+), 36 deletions(-)

diff --git a/src/cli/command-secret-gateway.test.ts b/src/cli/command-secret-gateway.test.ts
index 6d0f89f6349..74c47f637e9 100644
--- a/src/cli/command-secret-gateway.test.ts
+++ b/src/cli/command-secret-gateway.test.ts
@@ -64,6 +64,17 @@ describe("resolveCommandSecretRefsViaGateway", () => {
     });
   }
 
+  function expectGatewayUnavailableLocalFallbackDiagnostics(
+    result: Awaited<ReturnType<typeof resolveCommandSecretRefsViaGateway>>,
+  ) {
+    expect(
+      result.diagnostics.some((entry) => entry.includes("gateway secrets.resolve unavailable")),
+    ).toBe(true);
+    expect(
+      result.diagnostics.some((entry) => entry.includes("resolved command secrets locally")),
+    ).toBe(true);
+  }
+
   it("returns config unchanged when no target SecretRefs are configured", async () => {
     const config = {
       talk: {
@@ -208,11 +219,8 @@ describe("resolveCommandSecretRefsViaGateway", () => {
 
   it("falls back to local resolution for web search SecretRefs when gateway is unavailable", async () => {
     const envKey = "WEB_SEARCH_GEMINI_API_KEY_LOCAL_FALLBACK";
-    const priorValue = process.env[envKey];
-    process.env[envKey] = "gemini-local-fallback-key";
-    callGateway.mockRejectedValueOnce(new Error("gateway closed"));
-
-    try {
+    await withEnvValue(envKey, "gemini-local-fallback-key", async () => {
+      callGateway.mockRejectedValueOnce(new Error("gateway closed"));
       const result = await resolveCommandSecretRefsViaGateway({
         config: {
           tools: {
@@ -234,28 +242,14 @@ describe("resolveCommandSecretRefsViaGateway", () => {
         "gemini-local-fallback-key",
       );
       expect(result.targetStatesByPath["tools.web.search.gemini.apiKey"]).toBe("resolved_local");
-      expect(
-        result.diagnostics.some((entry) => entry.includes("gateway secrets.resolve unavailable")),
-      ).toBe(true);
-      expect(
-        result.diagnostics.some((entry) => entry.includes("resolved command secrets locally")),
-      ).toBe(true);
-    } finally {
-      if (priorValue === undefined) {
-        delete process.env[envKey];
-      } else {
-        process.env[envKey] = priorValue;
-      }
-    }
+      expectGatewayUnavailableLocalFallbackDiagnostics(result);
+    });
   });
 
   it("falls back to local resolution for Firecrawl SecretRefs when gateway is unavailable", async () => {
     const envKey = "WEB_FETCH_FIRECRAWL_API_KEY_LOCAL_FALLBACK";
-    const priorValue = process.env[envKey];
-    process.env[envKey] = "firecrawl-local-fallback-key";
-    callGateway.mockRejectedValueOnce(new Error("gateway closed"));
-
-    try {
+    await withEnvValue(envKey, "firecrawl-local-fallback-key", async () => {
+      callGateway.mockRejectedValueOnce(new Error("gateway closed"));
       const result = await resolveCommandSecretRefsViaGateway({
         config: {
           tools: {
@@ -276,19 +270,8 @@ describe("resolveCommandSecretRefsViaGateway", () => {
         "firecrawl-local-fallback-key",
       );
       expect(result.targetStatesByPath["tools.web.fetch.firecrawl.apiKey"]).toBe("resolved_local");
-      expect(
-        result.diagnostics.some((entry) => entry.includes("gateway secrets.resolve unavailable")),
-      ).toBe(true);
-      expect(
-        result.diagnostics.some((entry) => entry.includes("resolved command secrets locally")),
-      ).toBe(true);
-    } finally {
-      if (priorValue === undefined) {
-        delete process.env[envKey];
-      } else {
-        process.env[envKey] = priorValue;
-      }
-    }
+      expectGatewayUnavailableLocalFallbackDiagnostics(result);
+    });
   });
 
   it("marks web SecretRefs inactive when the web surface is disabled during local fallback", async () => {