From 184bc21b3a4b238bc9fcf559f7b2e3b7ad574b0e Mon Sep 17 00:00:00 2001 From: A <258483684+la14-1@users.noreply.github.com> Date: Sat, 21 Feb 2026 03:42:14 -0800 Subject: [PATCH] fix: replace printf -v with export for bash 3.2 compat in key-request.sh (#1561) printf -v requires bash 4.0+; macOS ships bash 3.2, causing _try_load_env_var() to fail with 'printf: -v: invalid option' and breaking saved API key loading for all cloud providers. Both var_name and val are validated against strict regexes immediately above, so export "NAME=VALUE" is injection-safe and works on bash 3.2+. The macos-compat linter already flags this pattern as MC013 error. Agent: team-lead Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 --- shared/key-request.sh | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/shared/key-request.sh b/shared/key-request.sh index 3e16db9c..9d0da525 100644 --- a/shared/key-request.sh +++ b/shared/key-request.sh @@ -92,9 +92,8 @@ print(v) fi # SECURITY: val is already validated against ^[a-zA-Z0-9._/@-]+$ above, # and var_name is validated against ^[A-Z_][A-Z0-9_]*$ by the caller. - # Use printf -v for safe variable assignment (no command substitution/expansion). - printf -v "${var_name}" '%s' "${val}" - export "${var_name}" + # Use export NAME=VALUE (bash 3.2 compatible; printf -v requires bash 4.0+). + export "${var_name}=${val}" return 0 fi fi