@fjall/components-infrastructure 39.0.7 → 39.0.8

package/dist/lib/layers/secrets-resolver/bin/error-identity.mjs

@@ -0,0 +1,57 @@
+/**
+ * How the secrets resolver names a failure without anything it carries: the
+ * class name and code of the error and of up to two causes, as
+ * `TypeError (cause: AggregateError ECONNREFUSED)`. Node's fetch keeps the
+ * bytes of an answer it could not parse as HTTP on its cause, and quotes a
+ * header value it refuses in its message (Node 20.19.2, 22.17.1, 24.18.1,
+ * 24.19.0 and 24.21.0, measured 2026-10-12), so no message is repeated.
+ *
+ * The rule is `describeErrorIdentity`'s in `@fjall/util` from 40.0.0, which
+ * this layer cannot load; 39.x's `@fjall/util` has no such function, so
+ * `lib/__tests__/secretsResolverErrorIdentity.test.ts` holds this layer to
+ * the rule's text alone.
+ */
+
+/** The shape of an error's class name, such as `TypeError`. */
+const ERROR_NAME = /^[A-Z][A-Za-z0-9]{0,58}(?:Error|Exception)$/;
+
+/** The shape of a Node or undici error code, such as `ECONNREFUSED`. */
+const ERROR_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
+
+/** How many links of a cause chain a description names, the error's own first. */
+const CAUSE_LINKS = 3;
+
+function nameAndCode(link) {
+  if (!(link instanceof Error)) return "a value that is not an Error";
+  const name =
+    typeof link.name === "string" && ERROR_NAME.test(link.name)
+      ? link.name
+      : "Error";
+  const code =
+    "code" in link &&
+    typeof link.code === "string" &&
+    ERROR_CODE.test(link.code)
+      ? ` ${link.code}`
+      : "";
+  return `${name}${code}`;
+}
+
+/**
+ * `err` named by its class name and code, and its causes', never by a
+ * message. A name or code is repeated only in the shape Node and undici give
+ * one; a shape is not proof of origin, so this is for errors the runtime
+ * built, as a failed fetch or body read is.
+ */
+export function describeErrorIdentity(err) {
+  const links = [];
+  const seen = new Set();
+  let link = err;
+  while (links.length < CAUSE_LINKS) {
+    links.push(nameAndCode(link));
+    if (!(link instanceof Error)) break;
+    seen.add(link);
+    if (link.cause === undefined || seen.has(link.cause)) break;
+    link = link.cause;
+  }
+  return links.reduceRight((inner, outer) => `${outer} (cause: ${inner})`);
+}

package/dist/lib/layers/secrets-resolver/bin/resolve-secrets

@@ -3,28 +3,72 @@
 #
 # Invoked by AWS_LAMBDA_EXEC_WRAPPER before the Lambda runtime starts.
 # Calls the Node.js resolver to fetch secrets from the AWS Parameters and
-# Secrets Extension, then execs into the original runtime bootstrap.
+# Secrets Extension, then execs into the original runtime bootstrap with
+# each secret in its environment.
 #
-# The resolver outputs `export KEY='value'` lines which we eval to inject
-# secrets as environment variables visible to the handler.
+# The resolver writes one `NAME=VALUE` line per secret, VALUE with each
+# backslash written `\\` and each newline `\n` (encodeValue in
+# resolve-secrets.mjs). Each VALUE is decoded with `printf '%b'` and handed
+# to env(1) as an assignment: nothing the resolver writes is evaluated, so no
+# value can run as code, and no shell variable is assigned from a secret's
+# name, so none can clash with this script's variables or bash's own. The
+# Lambda construct attaches this layer only to a function with secrets
+# (addSecretsSupport in lib/resources/aws/compute/lambda.ts), so the resolver
+# runs at every start and decides for itself what is configured. It runs
+# the resolver without the function's NODE_OPTIONS, so its output holds the
+# resolver's lines alone.
+#
+# Limit (2026-10-12): each value is in env(1)'s argument list for the moment
+# between this script's exec and env's own. Every process of a Lambda
+# function runs as one user, so nothing that cannot already read the
+# function's environment can read it there, but a monitor that records each
+# exec's arguments would record it.
 
+# A SHELLOPTS in the function's environment can turn on tracing, which would
+# write each command this script runs, secrets included, to the function's
+# logs, or verbose mode, which would write the script itself.
+set +o xtrace +o verbose
 set -euo pipefail
 
-# Only run resolver if secrets are configured
-if [ -n "${SSM_SECRET_NAMES:-}" ] || env | grep -q '_SECRET_ARN='; then
-  RESOLVER_OUTPUT=$(/var/lang/bin/node /opt/bin/resolve-secrets.mjs)
-  if [ -n "$RESOLVER_OUTPUT" ]; then
-    # Validate each line matches `export NAME='...'` before eval to prevent
-    # accidental code execution if the resolver ever emits unexpected output
-    while IFS= read -r line; do
-      if [[ "$line" =~ ^export\ [a-zA-Z_][a-zA-Z0-9_]*= ]]; then
-        eval "$line"
-      else
-        echo "[fjall-resolver] Unexpected output from resolver: ${line:0:80}" >&2
-        exit 1
-      fi
-    done <<< "$RESOLVER_OUTPUT"
-  fi
+if [ "$#" -eq 0 ]; then
+  # env(1) given no command lists its environment, every secret with it.
+  echo "[fjall-resolver] No runtime command was given to start" >&2
+  exit 64
 fi
 
-exec "$@"
+# Appends one NAME=VALUE word to `assignments` for each line the resolver
+# writes. Its variables are local: a variable of the function's environment
+# that shares a name with one of them reaches the runtime as configured, and
+# none of them reaches it when the function's SHELLOPTS includes allexport.
+collect_assignments() {
+  local RESOLVER_OUTPUT line line_number name value
+  # The resolver runs without the function's NODE_OPTIONS: a module that
+  # option preloads would run in the resolver's process too, and anything it
+  # printed would join the resolver's output.
+  RESOLVER_OUTPUT=$(/usr/bin/env -u NODE_OPTIONS /var/lang/bin/node /opt/bin/resolve-secrets.mjs)
+  [ -n "$RESOLVER_OUTPUT" ] || return 0
+  line_number=0
+  while IFS= read -r line; do
+    line_number=$((line_number + 1))
+    name=${line%%=*}
+    if [[ "$line" != *=* || ! "$name" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
+      # The line can hold a secret, so only its number is named.
+      echo "[fjall-resolver] Line ${line_number} of the resolver's output is not NAME=VALUE" >&2
+      exit 1
+    fi
+    # The dot keeps printf's result from being empty, which bash 3.2's
+    # printf -v takes as an order to unset the variable; it comes off after.
+    printf -v value '%b.' "${line#*=}"
+    assignments+=("$name=${value%.}")
+  done <<< "$RESOLVER_OUTPUT"
+}
+
+# bash exports no array, so a variable of the function's environment named
+# `assignments` is handed to the runtime as the first assignment instead.
+assignments=(${assignments+"assignments=$assignments"})
+collect_assignments
+# allexport exports a function as it does a variable.
+unset -f collect_assignments
+
+# The guarded expansion keeps an empty list legal under `set -u` before bash 4.4.
+exec /usr/bin/env ${assignments[@]+"${assignments[@]}"} "$@"

package/dist/lib/layers/secrets-resolver/bin/resolve-secrets.mjs

@@ -1,25 +1,38 @@
 /**
- * Fjall Secrets Resolver — runs before Lambda handler via AWS_LAMBDA_EXEC_WRAPPER.
+ * Fjall Secrets Resolver — runs before the Lambda handler via
+ * AWS_LAMBDA_EXEC_WRAPPER.
  *
- * Resolves secrets from two sources using the AWS Parameters and Secrets Extension
- * HTTP cache at localhost:2773:
+ * Resolves secrets from two sources using the AWS Parameters and Secrets
+ * Extension HTTP cache at localhost:2773:
  *
  * 1. SSM Parameter Store (user-managed secrets via `fjall secrets set`)
- *    Reads SSM_SECRETS_PATH + SSM_SECRET_NAMES, fetches each parameter,
- *    exports as environment variables.
+ *    Reads SSM_SECRETS_PATH + SSM_SECRET_NAMES and fetches each parameter.
  *
  * 2. Secrets Manager (CDK-managed secrets, e.g. database credentials)
- *    Scans for *_SECRET_ARN env vars, fetches each secret,
- *    optionally extracts a JSON field via the matching *_SECRET_FIELD var,
- *    exports as the prefix (e.g. DATABASE_PASSWORD_SECRET_ARN → DATABASE_PASSWORD).
+ *    Scans for *_SECRET_ARN env vars, fetches each secret, optionally
+ *    extracts a JSON field via the matching *_SECRET_FIELD var, and names it
+ *    by the prefix (e.g. DATABASE_PASSWORD_SECRET_ARN → DATABASE_PASSWORD).
  *
- * Outputs `export KEY='value'` lines to stdout. The bash wrapper evals this output
- * and then execs into the Lambda runtime.
+ * Writes one `NAME=VALUE` line per secret to stdout, VALUE as `encodeValue`
+ * writes it. The bash wrapper beside this file decodes each VALUE with
+ * `printf '%b'` and execs into the Lambda runtime with it in the
+ * environment, never evaluating it.
+ *
+ * Every line it writes to stderr, which Lambda sends to the function's
+ * CloudWatch Logs, is identifier-only: fixed text; what the function's
+ * configuration holds, a parameter path or a secret's name, ARN and field;
+ * the position of a name it refuses; an HTTP status; a length or a count; and
+ * an error's class name and code (`describeErrorIdentity`, in
+ * `error-identity.mjs` beside this file). It
+ * never repeats the extension's answer, an error's message or a name it
+ * refuses: it runs alone in its layer and cannot load `@fjall/util`'s mask.
  *
  * The Extension may not be ready immediately during INIT phase, so all HTTP
  * calls use a retry loop with exponential backoff.
  */
 
+import { describeErrorIdentity } from "./error-identity.mjs";
+
 const EXTENSION_PORT =
   process.env.PARAMETERS_SECRETS_EXTENSION_HTTP_PORT || "2773";
 const EXTENSION_URL = `http://localhost:${EXTENSION_PORT}`;
@@ -28,6 +41,36 @@ const INITIAL_DELAY_MS = 100;
 /** Per-request timeout — generous for localhost; total budget bounded by Lambda INIT timeout */
 const REQUEST_TIMEOUT_MS = 2000;
 
+/** A failure in this script's own words, so its message may be written. */
+class ResolverFailure extends Error {
+  constructor(message, { retriable = false } = {}) {
+    super(message);
+    this.retriable = retriable;
+  }
+}
+
+/**
+ * What a function's operator checks when the extension refuses a read. Its
+ * refusal can be for a parameter or secret that does not exist, a role that
+ * may not read or decrypt it, or throttling, and the body that would say
+ * which is not repeated.
+ */
+const REFUSAL_CURE =
+  "Check that it exists, that the function's role may read it and decrypt it with its key, and that Systems Manager or Secrets Manager was not throttling the function's requests.";
+
+/**
+ * An answer the extension refused with, named by its status and its body's
+ * length. The body is AWS's error, which can name the parameter or secret
+ * and the function's role in words this repository does not control.
+ */
+async function describeRefusal(response) {
+  const body = await response.text().then(
+    (text) => `a body of ${text.length} characters, not repeated here`,
+    () => "a body that could not be read"
+  );
+  return `Extension returned ${response.status} with ${body}`;
+}
+
 /**
  * Fetch from the Extension HTTP API with retry and exponential backoff.
  * The Extension starts during INIT phase 1 (Extension init) and the wrapper
@@ -36,7 +79,7 @@ const REQUEST_TIMEOUT_MS = 2000;
  */
 async function fetchWithRetry(path) {
   let delay = INITIAL_DELAY_MS;
-  let lastError;
+  let lastFailure;
 
   for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
     try {
@@ -53,26 +96,24 @@ async function fetchWithRetry(path) {
         } catch {
           // The body carries the parameter's value or the secret string, and
           // V8's message quotes a window of it, so only its length is named.
-          throw new Error(
-            `Extension returned a body that is not valid JSON (${body.length} characters)`
+          throw new ResolverFailure(
+            `Extension returned a body that is not valid JSON (${body.length} characters)`,
+            { retriable: true }
           );
         }
       }
-      // 4xx errors (e.g. secret not found) — don't retry
+      // 4xx errors (e.g. secret not found) — don't retry; 5xx — retriable
       if (response.status >= 400 && response.status < 500) {
-        const body = await response.text().catch(() => "");
-        const err = new Error(`Extension returned ${response.status}: ${body}`);
-        err.nonRetriable = true;
-        throw err;
+        throw new ResolverFailure(
+          `${await describeRefusal(response)}. ${REFUSAL_CURE}`
+        );
       }
-      // 5xx — retriable
-      const body = await response.text().catch(() => "");
-      lastError = new Error(`Extension returned ${response.status}: ${body}`);
+      throw new ResolverFailure(await describeRefusal(response), {
+        retriable: true
+      });
     } catch (err) {
-      if (err.nonRetriable) {
-        throw err;
-      }
-      lastError = err;
+      if (err instanceof ResolverFailure && !err.retriable) throw err;
+      lastFailure = describeFailure(err);
     }
 
     // Retry with backoff (both 5xx and network errors)
@@ -82,28 +123,42 @@ async function fetchWithRetry(path) {
     }
   }
 
-  throw new Error(
-    `Failed to reach Extension after ${MAX_RETRIES} attempts: ${lastError?.message}`
+  throw new ResolverFailure(
+    `Failed to reach Extension after ${MAX_RETRIES} attempts: ${lastFailure}`
   );
 }
 
 /**
- * Escape a value for safe inclusion in a shell `export KEY='value'` statement.
- * Single-quotes are the safest quoting mechanism — only embedded single-quotes
- * need escaping via the close-reopen pattern: ' → '\''
+ * A value as the wrapper's `printf '%b'` reads it back: each backslash
+ * written `\\` and each newline `\n`, so every value is one line and no
+ * escape `%b` knows can begin anywhere else. As through 39.0.6, the
+ * wrapper's command substitution drops a NUL, and an unpaired surrogate
+ * reaches the function as U+FFFD; 40.0.0 refuses both.
  */
-function shellEscape(value) {
-  return "'" + value.replace(/'/g, "'\\''") + "'";
+function encodeValue(value) {
+  return value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n");
+}
+
+/** What a failure to resolve one secret says: this script's words, or the error's identity. */
+function describeFailure(err) {
+  return err instanceof ResolverFailure
+    ? err.message
+    : describeErrorIdentity(err);
 }
 
 // POSIX env var names: letters, digits, underscores; must not start with a digit
 const VALID_ENV_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-function assertValidEnvName(name, source) {
+/**
+ * Stops the resolver when `name` cannot name an environment variable,
+ * naming it by `where` alone: the name is the operator's text, and an entry
+ * written by mistake can hold a value (`DB_PASSWORD=<value>`).
+ */
+function assertValidEnvName(name, where) {
   if (!VALID_ENV_NAME.test(name)) {
     process.stderr.write(
-      `[fjall-resolver] Invalid env var name '${name}' from ${source}. ` +
-        `Names must match [a-zA-Z_][a-zA-Z0-9_]* (no dots or hyphens).\n`
+      `[fjall-resolver] ${where} is not a valid environment variable name, and is not repeated here. ` +
+        `Names must match [a-zA-Z_][a-zA-Z0-9_]* (no dots, hyphens or '=').\n`
     );
     process.exit(1);
   }
@@ -119,11 +174,13 @@ async function resolveSsmSecrets() {
 
   if (!basePath || !secretNames) return [];
 
-  const names = secretNames.split(",").filter(Boolean);
-  const exports = [];
+  const lines = [];
 
-  for (const name of names) {
-    assertValidEnvName(name, "SSM_SECRET_NAMES");
+  // Positions count the empty entries a doubled comma leaves, so each names
+  // the entry an operator reading SSM_SECRET_NAMES counts to.
+  for (const [index, name] of secretNames.split(",").entries()) {
+    if (name === "") continue;
+    assertValidEnvName(name, `Entry ${index + 1} of SSM_SECRET_NAMES`);
     const paramPath = `${basePath}/${name}`;
     const encodedPath = encodeURIComponent(paramPath);
 
@@ -132,34 +189,37 @@ async function resolveSsmSecrets() {
         `/systemsmanager/parameters/get?name=${encodedPath}&withDecryption=true`
       );
       const value = data?.Parameter?.Value;
-      if (value !== undefined && value !== null) {
-        exports.push(`export ${name}=${shellEscape(value)}`);
-      }
+      // As through 39.0.6; 40.0.0 stops the function instead.
+      if (value === undefined || value === null) continue;
+      lines.push(`${name}=${encodeValue(value)}`);
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(
-        `[fjall-resolver] Failed to resolve SSM parameter ${paramPath}: ${msg}\n`
+        `[fjall-resolver] Failed to resolve SSM parameter ${paramPath}: ${describeFailure(err)}\n`
       );
       process.exit(1);
     }
   }
 
-  return exports;
+  return lines;
 }
 
 /**
  * Resolve Secrets Manager secrets.
  * Scans for *_SECRET_ARN env vars, fetches each secret from SM,
- * optionally extracts a JSON field, and exports as the prefix.
+ * optionally extracts a JSON field, and writes it as NAME=VALUE under the
+ * prefix.
  */
 async function resolveSecretsManagerSecrets() {
-  const exports = [];
+  const lines = [];
 
   for (const [key, arn] of Object.entries(process.env)) {
     if (!key.endsWith("_SECRET_ARN") || !arn) continue;
 
     const prefix = key.slice(0, -"_SECRET_ARN".length);
-    assertValidEnvName(prefix, "Secrets Manager");
+    assertValidEnvName(
+      prefix,
+      "The prefix of an environment variable ending _SECRET_ARN"
+    );
     const fieldKey = `${prefix}_SECRET_FIELD`;
     const field = process.env[fieldKey];
 
@@ -169,54 +229,57 @@ async function resolveSecretsManagerSecrets() {
       const data = await fetchWithRetry(
         `/secretsmanager/get?secretId=${encodedArn}`
       );
+      const secretString = data?.SecretString;
+      // As through 39.0.6; 40.0.0 stops the function instead.
+      if (secretString === undefined || secretString === null) continue;
 
       let value;
-      if (field && data?.SecretString) {
+      if (field && secretString) {
         let parsed;
         try {
-          parsed = JSON.parse(data.SecretString);
+          parsed = JSON.parse(secretString);
         } catch {
-          throw new Error(
+          throw new ResolverFailure(
             `Secret is not valid JSON but field '${field}' was requested. Store the secret as a JSON object.`
           );
         }
         value = parsed[field];
         if (value === undefined) {
-          throw new Error(
+          throw new ResolverFailure(
             `Field '${field}' not found in secret (${Object.keys(parsed).length} fields present).`
           );
         }
+        // As through 39.0.6; 40.0.0 stops the function instead.
+        if (value === null) continue;
       } else {
-        value = data?.SecretString;
+        value = secretString;
       }
 
-      if (value !== undefined && value !== null) {
-        exports.push(`export ${prefix}=${shellEscape(String(value))}`);
-      }
+      lines.push(`${prefix}=${encodeValue(String(value))}`);
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(
-        `[fjall-resolver] Failed to resolve SM secret ${prefix} (${arn}): ${msg}\n`
+        `[fjall-resolver] Failed to resolve SM secret ${prefix} (${arn}): ${describeFailure(err)}\n`
       );
       process.exit(1);
     }
   }
 
-  return exports;
+  return lines;
 }
 
 async function main() {
-  const ssmExports = await resolveSsmSecrets();
-  const smExports = await resolveSecretsManagerSecrets();
-  const allExports = [...ssmExports, ...smExports];
+  const ssmLines = await resolveSsmSecrets();
+  const smLines = await resolveSecretsManagerSecrets();
+  const allLines = [...ssmLines, ...smLines];
 
-  if (allExports.length > 0) {
-    process.stdout.write(allExports.join("\n") + "\n");
+  if (allLines.length > 0) {
+    process.stdout.write(allLines.join("\n") + "\n");
   }
 }
 
 main().catch((err) => {
-  const msg = err instanceof Error ? err.message : String(err);
-  process.stderr.write(`[fjall-resolver] Fatal error: ${msg}\n`);
+  process.stderr.write(
+    `[fjall-resolver] Fatal error: ${describeFailure(err)}\n`
+  );
   process.exit(1);
 });

package/dist/lib/patterns/aws/buildkite/buildkite.d.ts

@@ -87,11 +87,16 @@ export interface AgentSecretsEnvHookOptions {
  * `set -o allexport` (every assignment auto-exports) + `nounset` — pinned in
  * `lib/__tests__/fixtures/buildkite/upstream-hooks-v6.68.1/`. Hence: every
  * fallible command is guarded, every env read uses `${VAR:-}`, every temp
- * variable is unset after use, and the script never exits. `private_ssh_key`
- * loads into an ephemeral ssh-agent (stdin → agent memory, never disk or
- * argv); the upstream pre-exit hook kills whatever `SSH_AGENT_PID` is
- * exported, so our agent's lifecycle is owned upstream. Every fetched value
- * is registered with the agent redactor (stdin form) before use — the
- * upstream helper cannot see values we fetch at eval time.
+ * variable is unset after use, and the script never exits. A per-pipeline
+ * secret name the hook's shell already holds (other than as a plain exported
+ * string) is refused before the assignment, so a value bash would read as
+ * arithmetic is never evaluated; the refusing helper keeps its one temp
+ * `local` and is `unset -f` at the end, so under `allexport` neither it nor
+ * its temp reaches the job. `private_ssh_key` loads into an ephemeral
+ * ssh-agent (stdin → agent memory, never disk or argv); the upstream pre-exit
+ * hook kills whatever `SSH_AGENT_PID` is exported, so our agent's lifecycle is
+ * owned upstream. Every fetched value is registered with the agent redactor
+ * (stdin form) before use — the upstream helper cannot see values we fetch at
+ * eval time.
  */
 export declare function buildAgentSecretsEnvHookScript(options: AgentSecretsEnvHookOptions): string;

package/dist/lib/patterns/aws/buildkite/buildkite.js

@@ -327,12 +327,17 @@ export const FJALL_API_KEY_SECRET_NAME = "fjall-api-key";
  * `set -o allexport` (every assignment auto-exports) + `nounset` — pinned in
  * `lib/__tests__/fixtures/buildkite/upstream-hooks-v6.68.1/`. Hence: every
  * fallible command is guarded, every env read uses `${VAR:-}`, every temp
- * variable is unset after use, and the script never exits. `private_ssh_key`
- * loads into an ephemeral ssh-agent (stdin → agent memory, never disk or
- * argv); the upstream pre-exit hook kills whatever `SSH_AGENT_PID` is
- * exported, so our agent's lifecycle is owned upstream. Every fetched value
- * is registered with the agent redactor (stdin form) before use — the
- * upstream helper cannot see values we fetch at eval time.
+ * variable is unset after use, and the script never exits. A per-pipeline
+ * secret name the hook's shell already holds (other than as a plain exported
+ * string) is refused before the assignment, so a value bash would read as
+ * arithmetic is never evaluated; the refusing helper keeps its one temp
+ * `local` and is `unset -f` at the end, so under `allexport` neither it nor
+ * its temp reaches the job. `private_ssh_key` loads into an ephemeral
+ * ssh-agent (stdin → agent memory, never disk or argv); the upstream pre-exit
+ * hook kills whatever `SSH_AGENT_PID` is exported, so our agent's lifecycle is
+ * owned upstream. Every fetched value is registered with the agent redactor
+ * (stdin form) before use — the upstream helper cannot see values we fetch at
+ * eval time.
  */
 export function buildAgentSecretsEnvHookScript(options) {
     const { fjallApiKeyParameterName, pipelineSecretsPrefix, region } = options;
@@ -341,23 +346,40 @@ export function buildAgentSecretsEnvHookScript(options) {
         lines.push(`FJALL_API_KEY="$(aws ssm get-parameter --name '${fjallApiKeyParameterName}' --with-decryption --query Parameter.Value --output text --region '${region}' 2>/dev/null)" || true`, 'if [ -n "${FJALL_API_KEY:-}" ]; then', `  printf '%s' "$FJALL_API_KEY" | buildkite-agent redactor add >/dev/null 2>&1 || true`, "  export FJALL_API_KEY", "else", "  unset FJALL_API_KEY", `  echo 'fjall-secrets: could not fetch ${fjallApiKeyParameterName}' >&2`, "fi");
     }
     if (pipelineSecretsPrefix !== undefined) {
-        lines.push('if [ -n "${BUILDKITE_PIPELINE_SLUG:-}" ]; then', `  _fjall_names="$(aws ssm get-parameters-by-path --path "${pipelineSecretsPrefix}/\${BUILDKITE_PIPELINE_SLUG:-}" --query 'Parameters[].Name' --output text --region '${region}' 2>/dev/null)" || true`, "  for _fjall_param in ${_fjall_names:-}; do", '    _fjall_name="${_fjall_param##*/}"', `    _fjall_value="$(aws ssm get-parameter --name "$_fjall_param" --with-decryption --query Parameter.Value --output text --region '${region}' 2>/dev/null)" || true`, '    if [ -z "${_fjall_value:-}" ]; then', '      echo "fjall-secrets: could not fetch $_fjall_param" >&2', "      unset _fjall_value", "      continue", "    fi", `    printf '%s' "$_fjall_value" | buildkite-agent redactor add >/dev/null 2>&1 || true`, `    if [ "$_fjall_name" = 'private_ssh_key' ]; then`, `      _fjall_agent_out="$(ssh-agent -s 2>/dev/null)" || true`, '      if [ -n "${_fjall_agent_out:-}" ]; then', '        eval "$_fjall_agent_out" >/dev/null 2>&1 || true', `        printf '%s\\n' "$_fjall_value" | ssh-add - >/dev/null 2>&1 || echo 'fjall-secrets: ssh-add failed for private_ssh_key' >&2`, "      else", `        echo 'fjall-secrets: ssh-agent unavailable - private_ssh_key not loaded' >&2`, "      fi", "      unset _fjall_agent_out", `    elif printf '%s' "$_fjall_name" | grep -Eq '${JOB_ENV_NAME_ALLOW_REGEX}' && ! printf '%s' "$_fjall_name" | grep -Eq '${JOB_ENV_NAME_DENY_REGEX}'; then`, `      export "$_fjall_name=$_fjall_value" 2>/dev/null || echo "fjall-secrets: could not export $_fjall_name" >&2`, "    else", '      echo "fjall-secrets: skipping non-conforming secret name $_fjall_name" >&2', "    fi", "    unset _fjall_value", "  done", "  unset _fjall_names", "  unset _fjall_param", "  unset _fjall_name", "fi");
+        lines.push('if [ -n "${BUILDKITE_PIPELINE_SLUG:-}" ]; then', 
+        // Bash evaluates an assignment to a name it holds specially (RANDOM,
+        // OPTIND, SECONDS, …) as arithmetic, so a value shaped PATH[$(cmd)]
+        // would run cmd on assignment (FJL-1368); refuse such a name before the
+        // export. Gotchas: probe with `|| return 1` first, never as the tail of
+        // a $() (that fires the upstream ERR trap on bash 3.2.57); `local` so
+        // allexport does not carry the temp into the job; only a plain exported
+        // string (-x) is an ordinary env var that defers to the deny regex.
+        "  _fjall_is_reserved_name() {", '    declare -p "$1" >/dev/null 2>&1 || return 1', "    local _fjall_decl", '    _fjall_decl="$(declare -p "$1" 2>/dev/null)"', '    _fjall_decl="${_fjall_decl#declare }"', '    case "${_fjall_decl%% *}" in', "      -x) return 1 ;;", "      *) return 0 ;;", "    esac", "  }", `  _fjall_names="$(aws ssm get-parameters-by-path --path "${pipelineSecretsPrefix}/\${BUILDKITE_PIPELINE_SLUG:-}" --query 'Parameters[].Name' --output text --region '${region}' 2>/dev/null)" || true`, "  for _fjall_param in ${_fjall_names:-}; do", '    _fjall_name="${_fjall_param##*/}"', `    _fjall_value="$(aws ssm get-parameter --name "$_fjall_param" --with-decryption --query Parameter.Value --output text --region '${region}' 2>/dev/null)" || true`, '    if [ -z "${_fjall_value:-}" ]; then', '      echo "fjall-secrets: could not fetch $_fjall_param" >&2', "      unset _fjall_value", "      continue", "    fi", `    printf '%s' "$_fjall_value" | buildkite-agent redactor add >/dev/null 2>&1 || true`, `    if [ "$_fjall_name" = 'private_ssh_key' ]; then`, `      _fjall_agent_out="$(ssh-agent -s 2>/dev/null)" || true`, '      if [ -n "${_fjall_agent_out:-}" ]; then', '        eval "$_fjall_agent_out" >/dev/null 2>&1 || true', `        printf '%s\\n' "$_fjall_value" | ssh-add - >/dev/null 2>&1 || echo 'fjall-secrets: ssh-add failed for private_ssh_key' >&2`, "      else", `        echo 'fjall-secrets: ssh-agent unavailable - private_ssh_key not loaded' >&2`, "      fi", "      unset _fjall_agent_out", `    elif printf '%s' "$_fjall_name" | grep -Eq '${JOB_ENV_NAME_ALLOW_REGEX}' && ! printf '%s' "$_fjall_name" | grep -Eq '${JOB_ENV_NAME_DENY_REGEX}'; then`, `      if _fjall_is_reserved_name "$_fjall_name"; then`, `        echo "fjall-secrets: skipping shell-reserved secret name $_fjall_name" >&2`, "      else", `        export "$_fjall_name=$_fjall_value" 2>/dev/null || echo "fjall-secrets: could not export $_fjall_name" >&2`, "      fi", "    else", '      echo "fjall-secrets: skipping non-conforming secret name $_fjall_name" >&2', "    fi", "    unset _fjall_value", "  done", "  unset _fjall_names", "  unset _fjall_param", "  unset _fjall_name", "  unset -f _fjall_is_reserved_name", "fi");
     }
     lines.push("");
     return lines.join("\n");
 }
 /**
  * Job-env eligibility for per-pipeline secret names: the allow shape is a
- * portable shell identifier; the deny list removes the bash-readonly names
- * (`export UID=…` fails "readonly variable" — under the upstream ERR trap
- * that would exit-53 EVERY job on the pipeline until the parameter is
- * deleted), the ssh-agent lifecycle vars the D-B3 flow owns, the
- * loader-injection vector vars, and the `BUILDKITE_`/`AWS_` prefixes.
- * `private_ssh_key` is handled before this filter; denied/non-conforming
- * names are skipped with an identifier-only warning.
+ * portable shell identifier; the deny list removes the names Fjall forbids as
+ * job env vars even though bash would let them be exported — the shell-hijack
+ * vars (`PATH`, `HOME`, `IFS`, `CDPATH`, `BASH_ENV`, `GLOBIGNORE`, the loader
+ * names), the read-only names (`export UID=…` fails "readonly variable" under
+ * the upstream ERR trap that would exit-53 EVERY job on the pipeline), the
+ * ssh-agent lifecycle vars the D-B3 flow owns, and the `BUILDKITE_`/`AWS_`
+ * prefixes. `ENV` is deliberately NOT listed: it is a name an operator gives
+ * an environment selector, and only an interactive POSIX `sh` reads it (bash
+ * 5.2.15 as `sh`, dash and busybox ash, measured 2026-10-13). Nor are the
+ * arithmetic/special-on-assignment names (`RANDOM`, `SRANDOM`, `OPTIND`,
+ * `HISTCMD`, `SECONDS`, …): that set grows and shifts with the bash version,
+ * and `_fjall_is_reserved_name` refuses it structurally — any name the hook's
+ * own shell already holds, unless it holds it as a plain exported string — so
+ * no list has to track bash here. `private_ssh_key` is handled before this
+ * filter; denied, reserved and non-conforming names are each skipped with an
+ * identifier-only warning.
  */
 const JOB_ENV_NAME_ALLOW_REGEX = "^[A-Za-z_][A-Za-z0-9_]*$";
-const JOB_ENV_NAME_DENY_REGEX = "^(PATH|HOME|IFS|LD_PRELOAD|LD_LIBRARY_PATH|BASH_ENV|SSH_AUTH_SOCK|SSH_AGENT_PID|UID|EUID|PPID|SHELLOPTS|BASHOPTS|BASH_VERSINFO)$|^(BUILDKITE_|AWS_)";
+const JOB_ENV_NAME_DENY_REGEX = "^(PATH|HOME|IFS|CDPATH|BASH_ENV|GLOBIGNORE|LD_PRELOAD|LD_LIBRARY_PATH|SSH_AUTH_SOCK|SSH_AGENT_PID|UID|EUID|PPID|SHELLOPTS|BASHOPTS|BASH_VERSINFO)$|^(BUILDKITE_|AWS_)";
 function deriveCpuArchitecture(instanceTypeIdentifier) {
     const architecture = new InstanceType(instanceTypeIdentifier).architecture;
     return architecture === InstanceArchitecture.ARM_64 ? "arm64" : "amd64";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "39.0.7",
+  "version": "39.0.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -81,8 +81,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^39.0.7",
-    "@fjall/util": "^39.0.7",
+    "@fjall/generator": "^39.0.8",
+    "@fjall/util": "^39.0.8",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },