From de318d351102d96959768107b0f82e61d1e950f8 Mon Sep 17 00:00:00 2001
From: dev-qwen2 <dev-qwen2@disinto.local>
Date: Thu, 16 Apr 2026 16:45:14 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20[nomad-step-2]=20S2.2=20=E2=80=94=20Fix?=
 =?UTF-8?q?=20bot/runner=20operation=20parsing=20and=20sops=20value=20extr?=
 =?UTF-8?q?action=20(#880)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tools/vault-import.sh | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/tools/vault-import.sh b/tools/vault-import.sh
index 4a3d3ab..a9424ac 100755
--- a/tools/vault-import.sh
+++ b/tools/vault-import.sh
@@ -420,25 +420,38 @@ EOF
   local unchanged=0
 
   for op in "${operations[@]}"; do
-    # Parse operation: category|field|file|key (4 fields for most, 5 for bots/runner)
-    IFS='|' read -r category field file key <<< "$op"
-    local source_value=""
+    # Parse operation: category|field|subkey|file|envvar (5 fields for bots/runner)
+    # or category|field|file|envvar (4 fields for forge/woodpecker/chat)
+    local category field subkey file envvar=""
+    local field_count
+    field_count="$(printf '%s' "$op" | awk -F'|' '{print NF}')"
 
-    if [ "$file" = "$env_file" ]; then
-      source_value="${!key:-}"
+    if [ "$field_count" -eq 5 ]; then
+      # 5 fields: category|role|subkey|file|envvar
+      IFS='|' read -r category field subkey file envvar <<< "$op"
     else
-      # Source from sops-decrypted env
-      source_value="$(printf '%s' "$sops_env" | grep "^${key}=" | sed "s/^${key=}//" || true)"
+      # 4 fields: category|field|file|envvar
+      IFS='|' read -r category field file envvar <<< "$op"
+      subkey="$field"  # For 4-field ops, field is the vault key
     fi
 
     # Determine Vault path and key based on category
     local vault_path=""
-    local vault_key="$key"
+    local vault_key="$subkey"
+    local source_value=""
+
+    if [ "$file" = "$env_file" ]; then
+      # Source from environment file (envvar contains the variable name)
+      source_value="${!envvar:-}"
+    else
+      # Source from sops-decrypted env (envvar contains the variable name)
+      source_value="$(printf '%s' "$sops_env" | grep "^${envvar}=" | sed "s/^${envvar}=//" || true)"
+    fi
 
     case "$category" in
       bots)
         vault_path="disinto/bots/${field}"
-        vault_key="$field"
+        vault_key="$subkey"
         ;;
       forge)
         vault_path="disinto/shared/forge"