Fail closed on resolver input errors

Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3158e06f-95df-4e3a-843f-f159a35aa30c

Author: mnriem

scripts/bash/common.sh

@@ -598,7 +598,10 @@ resolve_template_content() {
     # Priority 1: Project overrides (always "replace")
     local override="$base/overrides/${template_name}.md"
     if [ -f "$override" ]; then
-        cat "$override"
+        if ! cat "$override"; then
+            echo "Error: failed to read template layer $override" >&2
+            return 2
+        fi
         return 0
     fi
 
@@ -685,13 +688,16 @@ try:
     for t in templates:
         if not isinstance(t, dict):
             raise ValueError('manifest template entries must be mappings')
+        file_value = t.get('file', '')
+        strategy = t.get('strategy', 'replace')
+        if not isinstance(file_value, str):
+            raise ValueError('manifest template file must be a string')
+        if not isinstance(strategy, str):
+            raise ValueError('manifest template strategy must be a string')
+    for t in templates:
         if t.get('name') == os.environ['SPECKIT_TMPL'] and t.get('type', 'template') == 'template':
             file_value = t.get('file', '')
             strategy = t.get('strategy', 'replace')
-            if not isinstance(file_value, str):
-                raise ValueError('manifest template file must be a string')
-            if not isinstance(strategy, str):
-                raise ValueError('manifest template strategy must be a string')
             print('found\t' + strategy + '\t' + file_value)
             sys.exit(0)
     print('absent\treplace\t')
@@ -791,12 +797,18 @@ except Exception as exc:
     # If the top (highest-priority) layer is replace, it wins entirely —
     # lower layers are irrelevant regardless of their strategies.
     if [ "${layer_strategies[0]}" = "replace" ]; then
-        cat "${layer_paths[0]}"
+        if ! cat "${layer_paths[0]}"; then
+            echo "Error: failed to read template layer ${layer_paths[0]}" >&2
+            return 2
+        fi
         return 0
     fi
 
     if [ "$has_composition" = false ]; then
-        cat "${layer_paths[0]}"
+        if ! cat "${layer_paths[0]}"; then
+            echo "Error: failed to read template layer ${layer_paths[0]}" >&2
+            return 2
+        fi
         return 0
     fi
 
@@ -818,15 +830,21 @@ except Exception as exc:
 
     # Read the base content; compose layers above the base (higher priority)
     local content
-    content=$(cat "${layer_paths[$base_idx]}"; printf x)
+    if ! content=$(cat "${layer_paths[$base_idx]}"; status=$?; printf x; exit "$status"); then
+        echo "Error: failed to read template layer ${layer_paths[$base_idx]}" >&2
+        return 2
+    fi
     content="${content%x}"
 
     for (( i=base_idx-1; i>=0; i-- )); do
         local path="${layer_paths[$i]}"
         local strat="${layer_strategies[$i]}"
         local layer_content
         # Preserve trailing newlines
-        layer_content=$(cat "$path"; printf x)
+        if ! layer_content=$(cat "$path"; status=$?; printf x; exit "$status"); then
+            echo "Error: failed to read template layer $path" >&2
+            return 2
+        fi
         layer_content="${layer_content%x}"
 
         case "$strat" in

scripts/powershell/common.ps1

@@ -611,13 +611,16 @@ try:
     for t in templates:
         if not isinstance(t, dict):
             raise ValueError('manifest template entries must be mappings')
+        file_value = t.get('file', '')
+        strategy = t.get('strategy', 'replace')
+        if not isinstance(file_value, str):
+            raise ValueError('manifest template file must be a string')
+        if not isinstance(strategy, str):
+            raise ValueError('manifest template strategy must be a string')
+    for t in templates:
         if t.get('name') == sys.argv[2] and t.get('type', 'template') == 'template':
             file_value = t.get('file', '')
             strategy = t.get('strategy', 'replace')
-            if not isinstance(file_value, str):
-                raise ValueError('manifest template file must be a string')
-            if not isinstance(strategy, str):
-                raise ValueError('manifest template strategy must be a string')
             print('found\t' + strategy + '\t' + file_value)
             sys.exit(0)
     print('absent\treplace\t')

scripts/python/common.py

@@ -365,17 +365,20 @@ def _preset_template_layer(
             for entry in templates:
                 if not isinstance(entry, dict):
                     raise ValueError("manifest template entries must be mappings")
+                file_value = entry.get("file", "")
+                strategy = entry.get("strategy", "replace")
+                if not isinstance(file_value, str):
+                    raise ValueError("manifest template file must be a string")
+                if not isinstance(strategy, str):
+                    raise ValueError("manifest template strategy must be a string")
+            for entry in templates:
                 if (
                     entry.get("name") != template_name
                     or entry.get("type", "template") != "template"
                 ):
                     continue
                 file_value = entry.get("file", "")
                 strategy = entry.get("strategy", "replace")
-                if not isinstance(file_value, str):
-                    raise ValueError("manifest template file must be a string")
-                if not isinstance(strategy, str):
-                    raise ValueError("manifest template strategy must be a string")
                 relative = Path(file_value)
                 if (
                     not relative

tests/test_resolve_template_python_parity.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import os
 from pathlib import Path
 
 import pytest
@@ -470,6 +471,34 @@ def test_all_variants_fail_when_yaml_parser_is_unavailable(
     assert all(result.stdout == "" for result in results)
 
 
+@requires_bash
+def test_bash_fails_when_override_read_fails(tmp_path: Path) -> None:
+    repo = make_repo(tmp_path)
+    install_scripts(repo, SCRIPT)
+    override = repo / ".specify" / "templates" / "overrides"
+    override.mkdir(parents=True)
+    (override / f"{TEMPLATE}.md").write_text("# Override\n", encoding="utf-8")
+    shim_dir = tmp_path / "bin"
+    shim_dir.mkdir()
+    cat_shim = shim_dir / "cat"
+    cat_shim.write_text(
+        "#!/bin/sh\n"
+        "case \"$1\" in\n"
+        "  */.specify/templates/overrides/*) exit 1 ;;\n"
+        "esac\n"
+        "exec /bin/cat \"$@\"\n",
+        encoding="utf-8",
+    )
+    cat_shim.chmod(0o755)
+    env = clean_env()
+    env["PATH"] = f"{shim_dir}{os.pathsep}{env.get('PATH', '')}"
+
+    result = run(bash_cmd(repo, SCRIPT, TEMPLATE, "--json"), repo, env)
+
+    assert result.returncode != 0
+    assert result.stdout == ""
+
+
 @requires_bash
 @pytest.mark.parametrize(
     "manifest_content",
@@ -491,6 +520,17 @@ def test_all_variants_fail_when_yaml_parser_is_unavailable(
       name: {TEMPLATE}
       file: templates/{TEMPLATE}.md
       strategy: 123
+""",
+        f"""provides:
+  templates:
+    - type: template
+      name: {TEMPLATE}
+      file: templates/{TEMPLATE}.md
+      strategy: wrap
+    - type: template
+      name: unrelated-template
+      file: null
+      strategy: append
 """,
     ],
     ids=[
@@ -500,6 +540,7 @@ def test_all_variants_fail_when_yaml_parser_is_unavailable(
         "non_list_templates",
         "non_string_file",
         "non_string_strategy",
+        "malformed_entry_after_match",
     ],
 )
 def test_all_variants_fail_for_malformed_preset_manifest(