[anirudhwarrier]

Summary

cre secrets create, update, delete and list exited 0 even when the Vault rejected the request. The CLI only printed ✗ Secret <op> failed: … error=…, so scripts and CI took the failure for success.

Found by the CRE live E2E suite. In a production run, a secrets create stalled on its allowlist tx and was killed, and the harness's fallback secrets update then printed ✗ Secret update failed: … key does not exist but exited 0. The secret was never stored, and every following workflow execution failed on GetSecret.

Change (cmd/secrets/common/handler.go, ParseVaultGatewayResponse):

• create / update / delete: each rejected secret is still printed as before. If any were rejected, the command now returns an error such as 1 of 1 secret(s) failed to update, so it exits 1.
• list: a failed listing returns secret list failed: <error>.
• Coverage: this one function serves the wallet (on-chain) flow, the browser flow and secrets execute. Gateway POSTs aren't retried, so returning the error has no side effects.

Breaking Changes

• Exit code: cre secrets create|update|delete|list now exit 1 when the Vault rejects any secret in the request, where they used to exit 0. Scripts that ignored these failures will now see them. This is the intended fix.
• No flag, output-format or API changes. Success and failure lines print as before.

Testing Verification

• Five existing tests assumed a rejection returns nil and now expect the error. The two signature-verification tests still verify signatures; their fixtures happen to contain a rejected secret.
• New TestParseVaultGatewayResponse_RejectedSecretsReturnError: a rejected update ("key does not exist"), delete and create each return an error.
• New TestParseVaultGatewayResponse_AllSucceededReturnsNil: an all-success response returns nil.
• go test ./cmd/... ./internal/...: all pass.
• go test ./test/ -run 'TestMultiCommandHappyPaths/Secrets': pass (end-to-end create → update → list → delete).
• golangci-lint run ./...: 0 issues.
• Changeset: .changeset/secrets-exit-code.md (patch).

🤖 Generated with Claude Code