Publish curated Unraid-AppOps-Gateway source from 5f1a0fc2fdd07082637995b2c8b4514a1ecbbbb8

backend/tests/test_runner_specialization_controller_surface.py

@@ -87,6 +87,25 @@ def test_pending_protected_validation_blocks_specialization(controller, monkeypa
     assert responses[0][1]["status"] == "preflight_rejected"
 
 
+@pytest.mark.parametrize("private, expected", [
+    ("runner_fleet_specialization_entrypoint_untrusted", "runner_fleet_specialization_entrypoint_untrusted"),
+    ("private-token-value", "runner_fleet_specialization_script_execution_failed"),
+    ("runner_fleet_specialization_entrypoint_untrusted\nprivate-token-value",
+     "runner_fleet_specialization_script_execution_failed"),
+])
+def test_specialization_failure_response_contains_only_finite_safe_reason(controller, monkeypatch, private, expected):
+    instance, responses, _ = handler(controller, monkeypatch)
+    monkeypatch.setattr(controller.subprocess, "run", lambda *args, **kwargs:
+                        SimpleNamespace(returncode=0, stdout=b"exact source script"))
+
+    def fail(_script):
+        raise controller.RunnerFleetSpecializeError(private)
+
+    monkeypatch.setattr(controller, "execute_runner_fleet_specialize", fail)
+    instance.do_POST()
+    assert responses == [(409, {"status": "upgrade_failed", "revision": "a" * 40, "reason": expected})]
+
+
 def test_caller_cannot_choose_script_image_or_runner(controller, monkeypatch):
     instance, responses, _ = handler(controller, monkeypatch, {"reason": "Specialize CI profiles", "script": "untrusted.sh"})
     instance.do_POST()