From e966e921bc3fe9aa39362cd0402dda8851b10e79 Mon Sep 17 00:00:00 2001
From: Christopher Maher <chris@mahercode.io>
Date: Sat, 23 May 2026 16:13:49 -0700
Subject: [PATCH] fix(bootstrap): EXTRA_ARGS expansion produced phantom empty
 positional arg

bootstrap.sh ended with:

  ansible-playbook ... "${EXTRA_ARGS[@]:-}"

When EXTRA_ARGS=() (the no-`--` invocation, which is the documented
baseline path), `${arr[@]:-}` expands to a SINGLE empty-string
positional argument, not zero arguments. ansible-playbook receives
"" as a trailing positional, doesn't recognize it, and bails with
the unhelpful error 'unrecognized arguments:' (with empty space
after the colon -- the empty string is the bad arg).

The `:-` default form treats arrays the same as scalars: returns
the default string when null/empty. For arrays we want zero
positional args, not the default. The canonical safe form for
bash-3.2+ under `set -u` is:

  ${arr[@]+"${arr[@]}"}

which expands to nothing if the array is unset OR empty, and to
the array contents otherwise. Safe under `set -u` because
EXTRA_ARGS=() is always declared at the top of the script.

Verified with a mock ansible-playbook that prints argc + each
arg:

  ==== old broken behavior ====
  argc=7
    arg[6]=[--diff]
    arg[7]=[]                  <-- phantom empty positional arg

  ==== fixed: empty EXTRA_ARGS ====
  argc=6
    arg[6]=[--diff]            <-- no trailing arg

  ==== fixed: non-empty EXTRA_ARGS=(--check -vv) ====
  argc=8
    arg[6]=[--diff]
    arg[7]=[--check]
    arg[8]=[-vv]

Fixes #2.
---
 bootstrap.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bootstrap.sh b/bootstrap.sh
index 5b6ce2b..2aade12 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -96,6 +96,6 @@ ansible-playbook \
   playbook.yml \
   --tags "${TAGS}" \
   --diff \
-  "${EXTRA_ARGS[@]:-}"
+  ${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}
 
 log "Bootstrap complete. Next: set the secrets listed in README.md."