From e0ef954454f6dbb6b9795bf61751913ce80817bb Mon Sep 17 00:00:00 2001 From: Felix Faerber Date: Sun, 5 Jul 2026 18:32:21 +0300 Subject: [PATCH] agents: fix ${SECRETS_JSON:-{}} brace bug that silently skipped caller skills MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `${VAR:-{}}` appends a stray '}' when VAR is set (bash brace-matching), so the JSON handed to a caller skill's setup.sh was corrupted and its jq failed with "Unmatched '}'" — install-caller-skills.sh then caught the non-zero exit and skipped the skill. Default SECRETS_JSON in two safe steps and pass it as a plain var. This is why node1-ssh never installed. Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/scripts/install-caller-skills.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/scripts/install-caller-skills.sh b/.gitea/workflows/scripts/install-caller-skills.sh index 84ba3a4..6e3e664 100644 --- a/.gitea/workflows/scripts/install-caller-skills.sh +++ b/.gitea/workflows/scripts/install-caller-skills.sh @@ -26,6 +26,8 @@ # decode them inside setup.sh. Single-line values mask correctly. set -eu +# Safe default for SECRETS_JSON (see note at the setup.sh call below re: the ${x:-{}} brace bug). +SJ="${SECRETS_JSON:-}"; [ -n "$SJ" ] || SJ='{}' DIR="${WORKSPACE:-$GITHUB_WORKSPACE}/.gitea/agent-skills" CFG="$HOME/.config/opencode/opencode.json" [ -d "$DIR" ] || { echo "no caller skills (.gitea/agent-skills/ absent) — nothing to install"; exit 0; } @@ -48,9 +50,12 @@ for skill_dir in "$DIR"/*/; do cp "$md" "$dest/SKILL.md" chmod -R o=rX "$dest" # Optional runtime setup, with all inherited secrets available as JSON (never printed here). + # NOTE: pass SECRETS_JSON via a plain variable — do NOT inline ${SECRETS_JSON:-{}} here or in + # setup.sh: bash brace-matching appends a stray '}' when the var is set, corrupting the JSON so + # the skill's `jq` fails ("Unmatched '}'") and the skill is silently skipped. if [ -f "$skill_dir/setup.sh" ]; then echo "caller skill '$name': running setup.sh for @$NAME" - SECRETS_JSON="${SECRETS_JSON:-{}}" NAME="$NAME" WORKSPACE="${WORKSPACE:-$GITHUB_WORKSPACE}" \ + SECRETS_JSON="$SJ" NAME="$NAME" WORKSPACE="${WORKSPACE:-$GITHUB_WORKSPACE}" \ bash "$skill_dir/setup.sh" || { echo "caller skill '$name': setup.sh failed — skipping this skill"; continue; } fi allow=$(jq -nc --argjson a "$allow" --arg n "$name" '$a + {($n):"allow"}')