fix(secrets): recover encrypted tokens on all backends

tests/unit/test_macos_container_util.py

@@ -28,6 +28,21 @@ class TestMacosContainerAvailability(unittest.TestCase):
 
 
 class TestMacosContainerCommands(unittest.TestCase):
+    def test_read_container_env(self):
+        completed = util.subprocess.CompletedProcess(
+            args=[], returncode=0, stdout="secret\n", stderr="",
+        )
+        with patch.object(util, "_run_container_op", return_value=completed) as run:
+            self.assertEqual("secret", util.read_container_env("bottle", "KEY"))
+        run.assert_called_once_with(["container", "exec", "bottle", "printenv", "KEY"])
+
+    def test_read_container_env_returns_empty_on_failure(self):
+        completed = util.subprocess.CompletedProcess(
+            args=[], returncode=1, stdout="", stderr="missing",
+        )
+        with patch.object(util, "_run_container_op", return_value=completed):
+            self.assertEqual("", util.read_container_env("bottle", "KEY"))
+
     def test_dns_server_prefers_direct_host_ipv4_resolver(self):
         scutil = util.subprocess.CompletedProcess(
             args=[],