review-fix(suppress-audit): gateway/run_turn.py — restore BASE exception semantics (proxy key UnscopedSecretError-only fallback)

gateway/run_turn.py

@@ -2434,10 +2434,17 @@ class GatewayTurnMixin:
             return self._proxy_error_result("⚠️ Proxy URL not configured (GATEWAY_PROXY_URL or gateway.proxy_url)")
 
         # The proxy key is a per-profile credential: honor the installed secret scope under multiplex.
-        proxy_key = os.getenv("GATEWAY_PROXY_KEY", "").strip()
-        with suppress(Exception):  # UnscopedSecretError and import failures fall back to the env
-            from agent.secret_scope import get_secret
-            proxy_key = (get_secret("GATEWAY_PROXY_KEY") or "").strip()
+        # Only UnscopedSecretError / import failures fall back to the env; any other get_secret()
+        # error propagates (same as BASE) rather than silently degrading to the ambient key.
+        try:
+            from agent.secret_scope import UnscopedSecretError, get_secret
+
+            try:
+                proxy_key = (get_secret("GATEWAY_PROXY_KEY") or "").strip()
+            except UnscopedSecretError:
+                proxy_key = os.getenv("GATEWAY_PROXY_KEY", "").strip()
+        except Exception:
+            proxy_key = os.getenv("GATEWAY_PROXY_KEY", "").strip()
 
         _run_still_current = self._run_still_current_fn(session_key, run_generation)