check.sh: footgun-grep for VAR="$(cmd 2>/dev/null | filter)" silent-exit

Captures the heal-hf bug class (commit 385ed94) as a regression
guard. Pattern: top-level variable assignment whose `$(...)` body
both suppresses stderr (`2>/dev/null`) AND contains a pipe. Under
`set -euo pipefail`, the first command's failure propagates
through the pipeline (`pipefail`), set -e aborts on the
assignment, and any subsequent `[[ -z "${VAR}" ]]` empty-check
never runs — the user sees only `make: *** Error 1`.

The `2>/dev/null` is the load-bearing tell: a script author who
suppresses stderr knows the command can fail loudly. Combined
with a pipeline, that's the exact silent-exit footgun. Without
the `2>/dev/null`, the failing command would print its own error
and the user would have a clue; we don't flag those.

Regex: `^\s*[A-Za-z_][A-Za-z0-9_]*=("?)\$\([^)]*2>/dev/null[^|]*\|`
Walks scripts/*.sh via grep -R. Currently passes — the heal-hf
fix already uses the if-form.

Failure message points at the fix recipe:
if VAR="$(cmd 2>/dev/null)"; then
VAR2="$(filter <<<"${VAR}")"
fi
and at commit 385ed94 for the original incident.

Header comment at the top of check.sh updated to enumerate this
as check #6 (was 5 checks), parallel to the existing dash/dot
footgun (#5) that traces back to 6f2884f → 82677d0.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,20 @@ and documentation**, not the underlying base model.
 
 ## [Unreleased]
 
+### Added
+- `scripts/check.sh` now greps for the `VAR="$(cmd 2>/dev/null | filter)"`
+  silent-exit pattern that bit `heal_hf_pull.sh` (commit 385ed94).
+  Pattern fires on any top-level assignment whose `$(...)` body
+  both suppresses stderr (`2>/dev/null`) and pipes through a
+  filter — the exact combination where `set -e + pipefail`
+  swallows the failure of the first command and aborts the script
+  before any explicit `[[ -z "${VAR}" ]]` check can run, leaving
+  the user staring at `make: *** [Makefile:N: <target>] Error 1`
+  with no diagnostic. Suggested fix in the failure message:
+  `if VAR=$(cmd 2>/dev/null); then VAR2=$(filter <<<"${VAR}"); fi`.
+  Currently passes (the heal-hf fix already uses the if-form);
+  pre-commit hook + `make check` now block regressions.
+
 ### Fixed
 - `scripts/heal_hf_pull.sh` silent-exit when the target tag isn't
   pulled. The blob-locator line was

scripts/check.sh

@@ -9,6 +9,8 @@
 #   4. python3 -m py_compile on every *.py        (catches actual syntax errors)
 #   5. grep -E for the dash/dot filename footgun  (the one we shipped in 6f2884f
 #      and had to fix in 82677d0)
+#   6. grep -E for the VAR="$(cmd 2>/dev/null | filter)" silent-exit pattern
+#      under set -e + pipefail (the one we shipped in d87bc64 and fixed in 385ed94)
 #
 # Exit non-zero on any failure. Designed to run from .git/hooks/pre-commit.
 #
@@ -118,7 +120,40 @@ else
     echo "  [ ok ] no stale dot-pattern matches"
 fi
 
-# ---- 6. Modelfile <-> bridge files sync -----------------------------------
+# ---- 6. footgun: VAR="$(cmd 2>/dev/null | filter)" silent-exit pattern -----
+#
+# Under `set -euo pipefail`, a direct command substitution like
+#   VAR="$(ollama show "${TAG}" 2>/dev/null | awk ...)"
+# silently kills the script when ollama show fails: pipefail
+# propagates the non-zero exit through the pipeline, set -e
+# aborts on the assignment, and the explicit `[[ -z "${VAR}" ]]`
+# check below it never runs. The user sees only
+#   make: *** [Makefile:N: <target>] Error 1
+# with no diagnostic. We shipped this exact bug in
+# scripts/heal_hf_pull.sh and only caught it this session by
+# running `make heal-hf` against an empty store — see commit
+# 385ed94 for the fix recipe: split the assignment with
+#   if VAR="$(cmd 2>/dev/null)"; then
+#       VAR2="$(filter <<<"${VAR}")"
+#   fi
+# The `2>/dev/null` is the tell — its presence says "this command
+# can fail loudly, we want to suppress the noise" — which is
+# exactly the case where set -e + pipefail silently kills.
+
+blue "[*] grep: forbidden VAR=\$(... 2>/dev/null | ...) silent-exit pattern"
+if grep -RnE '^\s*[A-Za-z_][A-Za-z0-9_]*=("?)\$\([^)]*2>/dev/null[^|]*\|' \
+        --include='*.sh' \
+        --exclude-dir=.git \
+        scripts/ ; then
+    red "  [FAIL] silent-exit substitution under set -e + pipefail."
+    red "    Rewrite as 'if VAR=\$(cmd 2>/dev/null); then VAR2=\$(filter <<<\"\${VAR}\"); fi'."
+    red "    See commit 385ed94 for the bug we shipped and the fix recipe."
+    FAIL=1
+else
+    echo "  [ ok ] no silent-exit substitution patterns"
+fi
+
+# ---- 7. Modelfile <-> bridge files sync -----------------------------------
 #
 # 'Modelfile' (consumed by 'ollama create -f Modelfile') and the root-level
 # 'template' / 'system' / 'params' files (consumed by HF's Ollama bridge,