fix: fail closed on shell producer errors

.mise/tasks/changes

@@ -23,17 +23,28 @@ fi
 # Parse variadic args
 ARGS=()
 if [ -n "${usage_files:-}" ]; then
+  args_snapshot=$(mktemp) || { echo "Error: failed to create argument snapshot" >&2; exit 1; }
+  parse_status=0
+  parse_variadic_args "$usage_files" > "$args_snapshot" || parse_status=$?
+  if [ "$parse_status" -ne 0 ]; then
+    rm -f "$args_snapshot"
+    exit "$parse_status"
+  fi
   while IFS= read -r arg; do
     arg="${arg#"${notes_dir}/"}"
     [ -z "$arg" ] && continue
     ARGS+=("$arg")
-  done < <(printf '%s' "${usage_files}" | xargs printf '%s\n')
+  done < "$args_snapshot"
+  rm -f "$args_snapshot"
 fi
 
 if [ "${usage_summary:-}" = "true" ]; then
   # Summary mode: just list changes. An unavailable manifest is a clean result.
-  if ! changes=$(detect_changes "$abs_notes_dir"); then
-    changes=""
+  detect_status=0
+  changes=$(detect_changes "$abs_notes_dir") || detect_status=$?
+  if [ "$detect_status" -ne 0 ]; then
+    echo "Error: failed to inspect note changes." >&2
+    exit "$detect_status"
   fi
 
   if [ -z "$changes" ]; then
@@ -80,8 +91,11 @@ if [ "${usage_summary:-}" = "true" ]; then
   fi
 else
   # Diff mode: show full diffs. An unavailable manifest is a clean result.
-  if ! changes=$(detect_changes "$abs_notes_dir"); then
-    changes=""
+  detect_status=0
+  changes=$(detect_changes "$abs_notes_dir") || detect_status=$?
+  if [ "$detect_status" -ne 0 ]; then
+    echo "Error: failed to inspect note changes." >&2
+    exit "$detect_status"
   fi
 
   if [ -z "$changes" ]; then

.mise/tasks/commit

@@ -27,11 +27,19 @@ fi
 
 ARGS=()
 if [ -n "${usage_files:-}" ]; then
+  args_snapshot=$(mktemp) || { echo "Error: failed to create argument snapshot" >&2; exit 1; }
+  parse_status=0
+  parse_variadic_args "$usage_files" > "$args_snapshot" || parse_status=$?
+  if [ "$parse_status" -ne 0 ]; then
+    rm -f "$args_snapshot"
+    exit "$parse_status"
+  fi
   while IFS= read -r arg; do
     arg="${arg#"${notes_dir}/"}"
     [ -z "$arg" ] && continue
     ARGS+=("$arg")
-  done < <(printf '%s' "${usage_files}" | xargs printf '%s\n')
+  done < "$args_snapshot"
+  rm -f "$args_snapshot"
 fi
 
 if [ -z "$message" ]; then
@@ -156,11 +164,18 @@ verify_no_staged_residue() {
 }
 
 verify_commit_touched_only_notes() {
-  local changed=() bad=() path
+  local changed=() bad=() path changed_snapshot
+  changed_snapshot=$(mktemp) || return 1
+  if ! git -C "$TARGET_DIR" diff-tree --no-commit-id --name-only -r HEAD -- > "$changed_snapshot"; then
+    echo "Error: failed to inspect committed paths." >&2
+    rm -f "$changed_snapshot"
+    return 1
+  fi
   while IFS= read -r path; do
     [ -z "$path" ] && continue
     changed+=("$path")
-  done < <(git -C "$TARGET_DIR" diff-tree --no-commit-id --name-only -r HEAD --)
+  done < "$changed_snapshot"
+  rm -f "$changed_snapshot"
 
   for path in ${changed[@]+"${changed[@]}"}; do
     case "$path" in
@@ -180,8 +195,11 @@ verify_commit_touched_only_notes() {
 
 verify_selected_changes_clean() {
   local remaining bad_selected=() status relpath
-  if ! remaining=$(detect_changes "$abs_notes_dir"); then
-    remaining=""
+  if remaining=$(detect_changes "$abs_notes_dir"); then
+    :
+  else
+    echo "Error: failed to verify remaining note changes." >&2
+    return 1
   fi
 
   if [ -z "$remaining" ]; then

.mise/tasks/deobfuscate

@@ -23,6 +23,13 @@ fi
 # Limitation: backslashes in filenames are treated as escape characters by xargs.
 ARGS=()
 if [ -n "${usage_files:-}" ]; then
+  args_snapshot=$(mktemp) || { echo "Error: failed to create argument snapshot" >&2; exit 1; }
+  parse_status=0
+  parse_variadic_args "$usage_files" > "$args_snapshot" || parse_status=$?
+  if [ "$parse_status" -ne 0 ]; then
+    rm -f "$args_snapshot"
+    exit "$parse_status"
+  fi
   while IFS= read -r arg; do
     # Strip notes_dir prefix if provided (e.g. "notes/abc123" → "abc123")
     arg="${arg#"${notes_dir}/"}"
@@ -36,7 +43,8 @@ if [ -n "${usage_files:-}" ]; then
     done
     [ "$arg" = "/" ] || arg="${arg##*/}"
     ARGS+=("$arg")
-  done < <(printf '%s' "${usage_files}" | xargs printf '%s\n')
+  done < "$args_snapshot"
+  rm -f "$args_snapshot"
 fi
 
 if [ "${usage_dry_run:-}" = "true" ]; then

.mise/tasks/diff

@@ -19,10 +19,18 @@ repo_root=$(git -C "$TARGET_DIR" rev-parse --show-toplevel)
 
 ARGS=()
 if [ -n "${usage_refs:-}" ]; then
+  args_snapshot=$(mktemp) || { echo "Error: failed to create argument snapshot" >&2; exit 1; }
+  parse_status=0
+  parse_variadic_args "$usage_refs" > "$args_snapshot" || parse_status=$?
+  if [ "$parse_status" -ne 0 ]; then
+    rm -f "$args_snapshot"
+    exit "$parse_status"
+  fi
   while IFS= read -r arg; do
     [ -z "$arg" ] && continue
     ARGS+=("$arg")
-  done < <(printf '%s' "$usage_refs" | xargs printf '%s\n')
+  done < "$args_snapshot"
+  rm -f "$args_snapshot"
 fi
 
 if [ -n "$pr_number" ] && [ ${#ARGS[@]} -gt 0 ]; then
@@ -37,8 +45,11 @@ if [ -z "$pr_number" ] && [ ${#ARGS[@]} -eq 0 ]; then
     exit 1
   fi
 
-  if ! changes=$(detect_changes "$abs_notes_dir"); then
-    changes=""
+  detect_status=0
+  changes=$(detect_changes "$abs_notes_dir") || detect_status=$?
+  if [ "$detect_status" -ne 0 ]; then
+    echo "Error: failed to inspect note changes." >&2
+    exit "$detect_status"
   fi
   if [ -z "$changes" ]; then
     echo "No changes."

.mise/tasks/obfuscate

@@ -22,12 +22,20 @@ fi
 # Limitation: backslashes in filenames are treated as escape characters by xargs.
 ARGS=()
 if [ -n "${usage_files:-}" ]; then
+  args_snapshot=$(mktemp) || { echo "Error: failed to create argument snapshot" >&2; exit 1; }
+  parse_status=0
+  parse_variadic_args "$usage_files" > "$args_snapshot" || parse_status=$?
+  if [ "$parse_status" -ne 0 ]; then
+    rm -f "$args_snapshot"
+    exit "$parse_status"
+  fi
   while IFS= read -r arg; do
     # Strip notes_dir prefix if provided (e.g. "notes/alpha.md" → "alpha.md")
     arg="${arg#"${notes_dir}/"}"
     [ -z "$arg" ] && continue
     ARGS+=("$arg")
-  done < <(printf '%s' "${usage_files}" | xargs printf '%s\n')
+  done < "$args_snapshot"
+  rm -f "$args_snapshot"
 fi
 
 plan=$(mktemp) || {

.mise/tasks/setup

@@ -17,6 +17,39 @@ cd "$TARGET_DIR"
 
 NOTES_DIR="${usage_dir:-notes}"
 
+keys=()
+if [ -n "${usage_gpg_key:-}" ]; then
+  args_snapshot=$(mktemp) || { echo "Error: failed to create argument snapshot" >&2; exit 1; }
+  parse_status=0
+  parse_variadic_args "$usage_gpg_key" > "$args_snapshot" || parse_status=$?
+  if [ "$parse_status" -ne 0 ]; then
+    rm -f "$args_snapshot"
+    exit "$parse_status"
+  fi
+  while IFS= read -r key; do
+    [ -n "$key" ] && keys+=("$key")
+  done < "$args_snapshot"
+  rm -f "$args_snapshot"
+fi
+
+patterns=()
+if [ -n "${usage_pattern:-}" ]; then
+  args_snapshot=$(mktemp) || { echo "Error: failed to create argument snapshot" >&2; exit 1; }
+  parse_status=0
+  parse_variadic_args "$usage_pattern" > "$args_snapshot" || parse_status=$?
+  if [ "$parse_status" -ne 0 ]; then
+    rm -f "$args_snapshot"
+    exit "$parse_status"
+  fi
+  while IFS= read -r pattern; do
+    [ -n "$pattern" ] && patterns+=("$pattern")
+  done < "$args_snapshot"
+  rm -f "$args_snapshot"
+fi
+if [ ${#patterns[@]} -eq 0 ]; then
+  patterns=("$NOTES_DIR/**")
+fi
+
 setup_confirmation_message="notes setup will initialize/update git-crypt, .gitattributes, $NOTES_DIR/.manifest, and git hooks for $NOTES_DIR/ in this repo."
 if [ "${usage_unlock:-false}" = "true" ]; then
   setup_confirmation_message="$setup_confirmation_message It will also unlock/decrypt all git-crypt files after setup."
@@ -32,13 +65,6 @@ else
 fi
 
 # --- Add GPG keys via rudi ---
-keys=()
-if [ -n "${usage_gpg_key:-}" ]; then
-  while IFS= read -r key; do
-    [ -n "$key" ] && keys+=("$key")
-  done < <(printf '%s' "$usage_gpg_key" | xargs printf '%s\n')
-fi
-
 if [ ${#keys[@]} -gt 0 ]; then
   echo ""
   echo "Adding GPG collaborators..."
@@ -78,16 +104,6 @@ gitattributes_has_encrypted_pattern() {
   ' "$GITATTRIBUTES" 2>/dev/null
 }
 
-patterns=()
-if [ -n "${usage_pattern:-}" ]; then
-  while IFS= read -r pattern; do
-    [ -n "$pattern" ] && patterns+=("$pattern")
-  done < <(printf '%s' "$usage_pattern" | xargs printf '%s\n')
-fi
-if [ ${#patterns[@]} -eq 0 ]; then
-  patterns=("$NOTES_DIR/**")
-fi
-
 missing_patterns=()
 for p in "${patterns[@]}"; do
   [ -z "$p" ] && continue
@@ -142,12 +158,21 @@ else
   # (i.e., joining an existing repo vs creating a new one).
   has_encrypted_notes=false
   if [ -d "$TARGET_DIR/$NOTES_DIR" ]; then
+    encrypted_notes_snapshot=$(mktemp) || { echo "Error: failed to create encrypted note snapshot" >&2; exit 1; }
+    encrypted_notes_status=0
+    find "$TARGET_DIR/$NOTES_DIR" -type f ! -name .manifest -print0 > "$encrypted_notes_snapshot" || encrypted_notes_status=$?
+    if [ "$encrypted_notes_status" -ne 0 ]; then
+      rm -f "$encrypted_notes_snapshot"
+      echo "Error: failed to inspect existing encrypted notes." >&2
+      exit "$encrypted_notes_status"
+    fi
     while IFS= read -r -d '' f; do
       if head -c 10 "$f" 2>/dev/null | grep -q "GITCRYPT"; then
         has_encrypted_notes=true
         break
       fi
-    done < <(find "$TARGET_DIR/$NOTES_DIR" -type f ! -name .manifest -print0 2>/dev/null)
+    done < "$encrypted_notes_snapshot"
+    rm -f "$encrypted_notes_snapshot"
   fi
 
   echo ""

.mise/tasks/stage

@@ -24,12 +24,20 @@ fi
 # Parse variadic args
 ARGS=()
 if [ -n "${usage_files:-}" ]; then
+  args_snapshot=$(mktemp) || { echo "Error: failed to create argument snapshot" >&2; exit 1; }
+  parse_status=0
+  parse_variadic_args "$usage_files" > "$args_snapshot" || parse_status=$?
+  if [ "$parse_status" -ne 0 ]; then
+    rm -f "$args_snapshot"
+    exit "$parse_status"
+  fi
   while IFS= read -r arg; do
     arg="${arg#"${notes_dir}/"}"
     # Skip empty variadic defaults after xargs unquotes "''".
     [ -z "$arg" ] && continue
     ARGS+=("$arg")
-  done < <(printf '%s' "${usage_files}" | xargs printf '%s\n')
+  done < "$args_snapshot"
+  rm -f "$args_snapshot"
 fi
 
 scope_all="${usage_all:-false}"
@@ -60,8 +68,11 @@ scope_matches() {
 }
 
 # Detect changes. An unavailable manifest is a clean result.
-if ! changes=$(detect_changes "$abs_notes_dir"); then
-  changes=""
+detect_status=0
+changes=$(detect_changes "$abs_notes_dir") || detect_status=$?
+if [ "$detect_status" -ne 0 ]; then
+  echo "Error: failed to inspect note changes." >&2
+  exit "$detect_status"
 fi
 
 if [ "$scope_all" != "true" ]; then
@@ -111,8 +122,12 @@ if [ ${#stale_notes[@]} -gt 0 ]; then
   exit 1
 fi
 
-if ! conflicting_notes=$(detect_dual_present_conflicts "$abs_notes_dir"); then
-  conflicting_notes=""
+conflicting_notes=""
+conflicting_notes_status=0
+conflicting_notes=$(detect_dual_present_conflicts "$abs_notes_dir") || conflicting_notes_status=$?
+if [ "$conflicting_notes_status" -ne 0 ]; then
+  echo "Error: failed to inspect dual-present note paths." >&2
+  exit "$conflicting_notes_status"
 fi
 if [ -n "$conflicting_notes" ]; then
   blocked_conflicts=()
@@ -140,8 +155,11 @@ if [ -n "$conflicting_notes" ]; then
 fi
 
 double_tracked=""
-if ! double_tracked=$(detect_double_tracked_notes "$TARGET_DIR" "$notes_dir" 2>/dev/null); then
-  double_tracked=""
+double_tracked_status=0
+double_tracked=$(detect_double_tracked_notes "$TARGET_DIR" "$notes_dir") || double_tracked_status=$?
+if [ "$double_tracked_status" -ne 0 ]; then
+  echo "Error: failed to inspect double-tracked note paths." >&2
+  exit "$double_tracked_status"
 fi
 if [ -n "$double_tracked" ]; then
   blocked_tracked=()