Repository navigation
fix(macos): use literal key matching and safe awk replacement in upsert_env_value - #5871
Merged
gabsprogrammer merged 1 commit intoSep 19, 2026
Conversation
This was referenced Sep 19, 2026
This was referenced Sep 19, 2026
Closed
Closed
This was referenced Sep 20, 2026
roshangupta00750
added a commit
to roshangupta00750/ODS
that referenced
this pull request
Sep 29, 2026
…ter-safe Osmantic#5871 fixed upsert_env_value in installers/macos/lib/env-generator.sh to probe and rewrite .env keys with a literal awk match, but installers/macos/ods-macos.sh carries an identical copy that the fix missed. It still probes with a regex and updates with sed: if grep -qE "^${key}=" "$env_file"; then sed -i '' "s|^${key}=.*|${key}=${value}|" "$env_file" Two failures result on macOS, where this copy runs (HERMES session token, WEBUI_AUTH, CPU budgets, SHIELD_API_KEY): - A key containing regex metacharacters rewrites the wrong line. Setting FOO.BAR against an .env that has FOO_BAR=... matches it (`.` is a wildcard), and the sed rewrites FOO_BAR into FOO.BAR=..., destroying the original key. - A value containing the sed delimiter `|` (a URL or token) aborts the update with `sed: bad flag in substitute command` and drops the write, while `&` and `\` are interpreted as sed replacement syntax. Apply the same literal-prefix awk probe and awk rewrite Osmantic#5871 used, so the two macOS copies behave identically. tests/test_macos_upsert_env_value.py now parametrizes over both env-generator.sh and ods-macos.sh; the ods-macos case fails on the base branch (FOO_BAR clobbered by FOO.BAR) and passes with this change, on macOS and Linux. shellcheck clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this matters
In
ods/installers/macos/lib/env-generator.sh,upsert_env_value()checked for key existence using a regex patterngrep -qE "^${key}="and updated values viased -i '' "s|^${key}=.*|${key}=${value}|". As highlighted in #5819, regex key matching causes keys containing metacharacters (such as.) to clobber sibling variables (e.g. settingFOO.BARmatches and overwritesFOO_BAR). Additionally, using delimiter|insedbreaks if values contain pipe characters or ampersands (&), resulting in syntax errors or value corruption.This patch replaces the regex probe and
sedsubstitution with POSIXawkmatching on literal key prefixes (index($0, k "=") == 1) and literal value reconstruction, preventing sibling key collisions and delimiter injection.Validation
upsert_env_valuewith keyFOO.BARagainst an environment file containingFOO_BAR=existing_value; confirmed baseline overwroteFOO_BARwithFOO.BAR.test_macos_upsert_env_value.pypasses with exit code 0;FOO_BARis preserved whenFOO.BARis added, and values containing delimiters (|,&) update cleanly without corruption.Overlap check
ods-cliandmode-switch.sh, explicitly noting that macOSupsert_env_valuewas out of scope and left for a separate PR. This PR fulfills that exact targeted improvement.ods/scripts/llm-cold-storage.sh.Risk / AI disclosure
AI-assisted investigation, implementation and CLI regressions. This strengthens key-matching and delimiter escaping in macOS installer environment generation, not runtime process admission. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.
Follow-up integration evidence
Composed with #5863 at 1de196a without conflicts. Production and test diffs passed together; macOS bridge and environment generation contracts remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.