From b4c25b8bf0b4dc71a1af9cfea645c7b802f254f3 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Sat, 9 May 2026 14:56:14 -0500
Subject: [PATCH] Preserve resolved secrets when audit writes fail

---
 server/src/__tests__/secrets-service.test.ts | 31 ++++++++++++++++++++
 server/src/services/secrets.ts               |  5 ++--
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/server/src/__tests__/secrets-service.test.ts b/server/src/__tests__/secrets-service.test.ts
index 6cbcf9cacdc..83ae57cfe01 100644
--- a/server/src/__tests__/secrets-service.test.ts
+++ b/server/src/__tests__/secrets-service.test.ts
@@ -205,6 +205,37 @@ describeEmbeddedPostgres("secretService", () => {
     expect(JSON.stringify(events)).not.toContain("runtime-secret");
   });
 
+  it("returns resolved secrets even when success metadata writes fail", async () => {
+    const companyId = await seedCompany();
+    const svc = secretService(db);
+    const secret = await svc.create(companyId, {
+      name: `metadata-write-${randomUUID()}`,
+      provider: "local_encrypted",
+      value: "runtime-secret",
+    });
+    const env = {
+      API_KEY: { type: "secret_ref" as const, secretId: secret.id, version: "latest" as const },
+    };
+    await svc.syncEnvBindingsForTarget(companyId, { targetType: "agent", targetId: "agent-1" }, env);
+
+    vi.spyOn(db, "update").mockImplementationOnce(
+      () => ({
+        set: () => ({
+          where: () => Promise.reject(new Error("metadata write failed")),
+        }),
+      }) as ReturnType<typeof db.update>,
+    );
+
+    const resolved = await svc.resolveEnvBindings(companyId, env, {
+      consumerType: "agent",
+      consumerId: "agent-1",
+      actorType: "agent",
+      actorId: "agent-1",
+    });
+
+    expect(resolved.env.API_KEY).toBe("runtime-secret");
+  });
+
   it("stores external references without requiring or persisting secret values", async () => {
     const companyId = await seedCompany();
     const svc = secretService(db);
diff --git a/server/src/services/secrets.ts b/server/src/services/secrets.ts
index 2060774b8ec..5fc2e5715fc 100644
--- a/server/src/services/secrets.ts
+++ b/server/src/services/secrets.ts
@@ -528,7 +528,8 @@ export function secretService(db: Db) {
         db
           .update(companySecrets)
           .set({ lastResolvedAt: new Date(), updatedAt: new Date() })
-          .where(eq(companySecrets.id, secret.id)),
+          .where(eq(companySecrets.id, secret.id))
+          .catch(() => undefined),
         recordAccessEvent({
           companyId,
           secretId: secret.id,
@@ -536,7 +537,7 @@ export function secretService(db: Db) {
           provider: providerId,
           context,
           outcome: "success",
-        }),
+        }).catch(() => undefined),
       ]);
       return {
         value,