From 113062887019e3304b7aad44aa89a8d7b6d056a6 Mon Sep 17 00:00:00 2001
From: Akhilesh Arora <akhildawra@gmail.com>
Date: Fri, 29 May 2026 13:16:39 +0200
Subject: [PATCH] Make deploy-managed-agent.sh fail when an env-var value is
 refused

set -euo pipefail does not abort on a failed assignment inside a command
substitution, and the deploy nests three deep (yaml2json -> resolve_manifest
-> create_agent), so a refused env-var value (SAFE allowlist rejects ? & =)
left resolve_manifest continuing with empty json. The dry-run then printed []
and exited 0, and test-cookbooks.sh green-lit a cookbook with zero bodies.
Guard the four masked command substitutions with || exit 1 so the refusal
propagates.
---
 scripts/deploy-managed-agent.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/deploy-managed-agent.sh b/scripts/deploy-managed-agent.sh
index 392739f6ec..8192a62cfc 100755
--- a/scripts/deploy-managed-agent.sh
+++ b/scripts/deploy-managed-agent.sh
@@ -108,7 +108,7 @@ resolve_manifest() {
   local file="$1" base
   base="$(cd "$(dirname "$file")" && pwd)"
   local json
-  json=$(yaml2json "$file")
+  json=$(yaml2json "$file") || exit 1
   # Expand any {from_plugin: <dir>} into one {path: ...} per skills/* under that dir.
   local fp
   fp=$(jq -r '.skills[]? | select(.from_plugin) | .from_plugin' <<<"$json" | head -1)
@@ -151,7 +151,7 @@ inline_system() {
 create_agent() {
   local file="$1" base json sub_ids skills_json
   base="$(cd "$(dirname "$file")" && pwd)"
-  json=$(resolve_manifest "$file")
+  json=$(resolve_manifest "$file") || exit 1
   json=$(inline_system "$json" "$base")
 
   skills_json="[]"
@@ -166,7 +166,7 @@ create_agent() {
   while IFS= read -r m; do
     [[ -z "$m" ]] && continue
     local out sid sver
-    out=$(create_agent "$base/$m")
+    out=$(create_agent "$base/$m") || exit 1
     sid=${out%% *}; sver=${out##* }
     sub_ids=$(jq --arg i "$sid" --argjson v "$sver" '. + [{type:"agent", id:$i, version:$v}]' <<<"$sub_ids")
   done < <(jq -r '.callable_agents[]?.manifest // empty' <<<"$json")
@@ -199,7 +199,7 @@ if [[ $DRY_RUN -eq 1 ]]; then
   exit 0
 fi
 
-OUT=$(create_agent "$DIR/agent.yaml")
+OUT=$(create_agent "$DIR/agent.yaml") || exit 1
 AGENT_ID=${OUT%% *}
 echo "deployed: $ROLE"
 echo "agent id: $AGENT_ID"