az resource wait --custom returns exit code 0 when condition times out

[vadim-kovalyov]

Describe the bug

az resource wait --custom honors --timeout, but when the custom condition remains false for the entire timeout, the command prints {} and exits with code 0.

A true condition also exits with code 0, so scripts and CI systems cannot distinguish condition satisfaction from timeout.

The current dev source still contains the apparent root cause in src/azure-cli-core/azure/cli/core/commands/command_operation.py: WaitCommandOperation.wait returns a CLIError object on timeout instead of raising it.

progress_indicator.end()
return CLIError('Wait operation timed-out after {} seconds'.format(timeout))

This appears to affect generic Azure CLI wait commands, not only this resource type.

Related command

az resource wait --ids "<RESOURCE_ID>" --custom "properties.connectivityStatus=='Connecting'" --interval 5 --timeout 30

Errors

No error is emitted. The timeout result is:

{}
exit code: 0
elapsed time: 33 seconds

Issue script and debug output

Given an existing ARM resource whose properties.connectivityStatus is Connected:

az resource show \
  --ids "<RESOURCE_ID>" \
  --query "{connectivityStatus:properties.connectivityStatus,provisioningState:properties.provisioningState}" \
  -o json

Result:

{
  "connectivityStatus": "Connected",
  "provisioningState": "Succeeded"
}

Positive control - true condition:

az resource wait \
  --ids "<RESOURCE_ID>" \
  --custom "properties.connectivityStatus=='Connected'" \
  --interval 15 \
  --timeout 900

echo $?

Observed:

exit code: 0
elapsed time: 1.6 seconds

Negative test - false condition:

start_time=$(date +%s)

az resource wait \
  --ids "<RESOURCE_ID>" \
  --custom "properties.connectivityStatus=='Connecting'" \
  --interval 5 \
  --timeout 30

wait_exit_code=$?
elapsed_seconds=$(($(date +%s) - start_time))

printf 'wait_exit_code=%s\nelapsed_seconds=%s\n' \
  "$wait_exit_code" \
  "$elapsed_seconds"

Observed:

{}
wait_exit_code=0
elapsed_seconds=33

Impossible-condition test:

start_time=$(date +%s)

output=$(az resource wait \
  --ids "<RESOURCE_ID>" \
  --custom "properties.connectivityStatus=='DefinitelyNotAStatus'" \
  --interval 2 \
  --timeout 10 2>&1)

wait_exit_code=$?
elapsed_seconds=$(($(date +%s) - start_time))

printf 'output=%s\nwait_exit_code=%s\nelapsed_seconds=%s\n' \
  "$output" \
  "$wait_exit_code" \
  "$elapsed_seconds"

Observed:

output={}
wait_exit_code=0
elapsed_seconds=12

The impossible value rules out a transient state transition. No resource identifiers or debug output are included because they are unnecessary for reproduction.

Expected behavior

When --timeout expires before --custom evaluates to true, the command should:

1. Exit with a nonzero code.
2. Emit Wait operation timed-out after <seconds> seconds or another clear timeout error.
3. Remain distinguishable from successful condition satisfaction in automation.

Environment Summary

Azure CLI:           2.89.1
azure-cli-core:      2.89.1
azure-cli-telemetry: 1.1.0
OS:                  Linux 6.17.0-1022-azure, x86_64
Shell:               GNU bash 5.2.21
Resource type:       Microsoft.Kubernetes/connectedClusters

The same timeout code path remains present on current dev commit b92a89e7781c11a5ee8437a84ef4b8fd9edab4f0 (August 27, 2026).

Additional context

Related but not duplicate:

• az cli incorrectly returns exit code 0 even on failure #28523 reports another command returning exit code 0 on failure.
• az network application-gateway wait --custom with != JMESPath expression returns immediately instead of blocking #32961 reports a custom JMESPath condition returning immediately, rather than timeout being returned as success.

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

🔔 Routing this issue to @Azure/act-identity-squad.

[x-engineering-agent]

Bug Analysis

Root cause: WaitCommandOperation.wait in src/azure-cli-core/azure/cli/core/commands/command_operation.py (line 461) returns a CLIError object on timeout instead of raising it:

# CURRENT (broken)
return CLIError('Wait operation timed-out after {} seconds'.format(timeout))

# FIX
raise CLIError('Wait operation timed-out after {} seconds'.format(timeout))

This means the caller receives None (the return value is discarded), the command exits with code 0, and no error is emitted — indistinguishable from a successful wait.

Affected command: az resource wait --custom (and all other wait subcommands that share WaitCommandOperation).

Fix: Change return CLIError(...) to raise CLIError(...) at line 461 of src/azure-cli-core/azure/cli/core/commands/command_operation.py.

Test: Add or update a unit test in src/azure-cli-core/azure/cli/core/tests/ that invokes wait with a condition that cannot be satisfied within the timeout and asserts exit code 1 and the timeout error message.

Use this EXACT PR title: [Resource] Fix #34004: az resource wait: Raise CLIError on timeout instead of returning it

Mandatory Codegen execution protocol

Before editing implementation files, determine whether the affected resource command is AAZ-generated. Files under aaz/<profile>/ are generated output and must never be patched directly, including by an AI agent. Check out Azure/aaz beside Azure/azure-rest-api-specs, Azure/aaz-dev-tools, and the downstream repository. API-schema defects start in the specification; command naming, grouping, arguments, API-version selection, help, and examples belong in the durable Azure/aaz command model; non-modelable client behavior belongs in a handwritten subclass or wrapper in custom.py, registered from commands.py. Azure Client Tools Agent creates and promotes the corresponding durable Azure/aaz source pull request before it promotes downstream generated output.

Follow the Azure CLI repository's Codegen workflow and the aaz-dev setup documentation. Set up the checked-out repositories with azdev setup. Use generate only when importing or redesigning command models from Swagger/TypeSpec. For an existing module whose durable Azure/aaz model has been updated, render that model with regenerate:

aaz-dev cli regenerate --name resource --cli-path <azure-cli>

# New/imported command model only:
aaz-dev cli generate --spec <specification-name> --module resource

You MUST actually run the generator; do not merely describe it or imitate its output. If the AAZ/specification checkout, local source change, credentials, or generator is unavailable, stop and report the blocker instead of editing generated files. Inspect _aaz_info provenance and the complete regenerated diff, then run focused azdev style, azdev linter, and azdev test validation. For an extension, also update its version and HISTORY.rst, preserve azext_metadata.json compatibility, and let release automation update src/index.json.

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Use this EXACT PR title (copy verbatim, do not reword):

[Resource] Fix #34004: `az resource wait`: Raise CLIError on timeout instead of returning it

Keep the backticks around the command and the Fix #34004: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [Resource] prefix, issue link, and backticked command must stay.

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #34004.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [Resource] `az <command>`: <note>.
• Keep the template checklist and tick the items you've satisfied.

[x-engineering-agent]

Started a Copilot task in a0x1ab/azure-cli using claude-sonnet-4.6: https://github.com/a0x1ab/azure-cli/tasks/01860701-4491-4c3d-8172-cb03f0112e71