fix: use __EMPTY__ placeholder for empty arguments through eval

Empty string arguments are lost when passed through eval in ssh_retry.
Use __EMPTY__ placeholder for empty COMPOSE_ARGS and CRITICAL_SERVICES
to ensure they survive the eval chain and are properly converted back
to empty strings on the remote side.

This fixes the bug where COMPOSE_ARGS="" was being lost, causing the
remote script to incorrectly parse arguments:
- Expected: $1=stack1, $2=stack2, $3=TARGET_REF, $4=""
- Actually got: $1=stack1, $2=stack2, $3=TARGET_REF (missing $4!)
- Result: COMPOSE_ARGS got TARGET_REF value, causing "no such service" error

Also removed debug output from deploy-stacks.sh.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: owine

scripts/deployment/deploy-stacks.sh

@@ -97,9 +97,15 @@ log_info "Target ref: $TARGET_REF"
 # Execute deployment via SSH with retry
 # Use 'env' on remote side to set environment variables for the remote bash session
 # Use printf %q to properly escape arguments for eval in ssh_retry
+# Empty COMPOSE_ARGS uses placeholder to survive eval
 STACKS_ESCAPED=$(printf '%q ' $STACKS)
 TARGET_REF_ESCAPED=$(printf '%q' "$TARGET_REF")
-COMPOSE_ARGS_ESCAPED=$(printf '%q' "$COMPOSE_ARGS")
+
+if [ -z "$COMPOSE_ARGS" ]; then
+  COMPOSE_ARGS_ESCAPED="__EMPTY__"
+else
+  COMPOSE_ARGS_ESCAPED=$(printf '%q' "$COMPOSE_ARGS")
+fi
 
 ssh_retry 3 10 "ssh -o \"StrictHostKeyChecking no\" $SSH_USER@$SSH_HOST env OP_SERVICE_ACCOUNT_TOKEN=\"$OP_TOKEN\" GIT_FETCH_TIMEOUT=\"$GIT_FETCH_TIMEOUT\" GIT_CHECKOUT_TIMEOUT=\"$GIT_CHECKOUT_TIMEOUT\" IMAGE_PULL_TIMEOUT=\"$IMAGE_PULL_TIMEOUT\" SERVICE_STARTUP_TIMEOUT=\"$SERVICE_STARTUP_TIMEOUT\" VALIDATION_ENV_TIMEOUT=\"$VALIDATION_ENV_TIMEOUT\" VALIDATION_SYNTAX_TIMEOUT=\"$VALIDATION_SYNTAX_TIMEOUT\" /bin/bash -s $STACKS_ESCAPED $TARGET_REF_ESCAPED $COMPOSE_ARGS_ESCAPED" << 'EOF'
   set -e
@@ -117,22 +123,20 @@ ssh_retry 3 10 "ssh -o \"StrictHostKeyChecking no\" $SSH_USER@$SSH_HOST env OP_S
 
   TOTAL_ARGS=$#
 
-  # Debug: Show what arguments were received
-  echo "DEBUG: Received $TOTAL_ARGS arguments:"
-  for i in $(seq 1 $TOTAL_ARGS); do
-    eval "arg=\${$i}"
-    echo "  \$$i = [$arg]"
-  done
-
   # Validate minimum arguments (at least 1 stack + TARGET_REF + COMPOSE_ARGS)
   if [ $TOTAL_ARGS -lt 3 ]; then
     echo "❌ Insufficient arguments: expected at least 3 (stacks, target-ref, compose-args), got $TOTAL_ARGS"
     exit 1
   fi
 
-  # Last argument is always COMPOSE_ARGS (could be empty)
+  # Last argument is always COMPOSE_ARGS (could be empty placeholder)
   COMPOSE_ARGS="${!TOTAL_ARGS}"
 
+  # Convert __EMPTY__ placeholder back to empty string
+  if [ "$COMPOSE_ARGS" = "__EMPTY__" ]; then
+    COMPOSE_ARGS=""
+  fi
+
   # Second-to-last argument is always TARGET_REF
   TARGET_REF="${@:$((TOTAL_ARGS-1)):1}"
 

scripts/deployment/rollback-stacks.sh

@@ -104,9 +104,20 @@ log_info "Initiating rollback to $PREVIOUS_SHA"
 
 # Execute rollback via SSH with retry
 # Use printf %q to properly escape arguments for eval in ssh_retry
+# Empty strings use placeholder to survive eval
 PREVIOUS_SHA_ESCAPED=$(printf '%q' "$PREVIOUS_SHA")
-COMPOSE_ARGS_ESCAPED=$(printf '%q' "$COMPOSE_ARGS")
-CRITICAL_SERVICES_ESCAPED=$(printf '%q' "$CRITICAL_SERVICES")
+
+if [ -z "$COMPOSE_ARGS" ]; then
+  COMPOSE_ARGS_ESCAPED="__EMPTY__"
+else
+  COMPOSE_ARGS_ESCAPED=$(printf '%q' "$COMPOSE_ARGS")
+fi
+
+if [ -z "$CRITICAL_SERVICES" ]; then
+  CRITICAL_SERVICES_ESCAPED="__EMPTY__"
+else
+  CRITICAL_SERVICES_ESCAPED=$(printf '%q' "$CRITICAL_SERVICES")
+fi
 
 ROLLBACK_RESULT=$(ssh_retry 3 10 "ssh -o \"StrictHostKeyChecking no\" $SSH_USER@$SSH_HOST env OP_SERVICE_ACCOUNT_TOKEN=\"$OP_TOKEN\" GIT_FETCH_TIMEOUT=\"$GIT_FETCH_TIMEOUT\" GIT_CHECKOUT_TIMEOUT=\"$GIT_CHECKOUT_TIMEOUT\" IMAGE_PULL_TIMEOUT=\"$IMAGE_PULL_TIMEOUT\" SERVICE_STARTUP_TIMEOUT=\"$SERVICE_STARTUP_TIMEOUT\" VALIDATION_ENV_TIMEOUT=\"$VALIDATION_ENV_TIMEOUT\" VALIDATION_SYNTAX_TIMEOUT=\"$VALIDATION_SYNTAX_TIMEOUT\" /bin/bash -s $PREVIOUS_SHA_ESCAPED $COMPOSE_ARGS_ESCAPED $CRITICAL_SERVICES_ESCAPED" << 'EOF'
   set -e
@@ -116,6 +127,10 @@ ROLLBACK_RESULT=$(ssh_retry 3 10 "ssh -o \"StrictHostKeyChecking no\" $SSH_USER@
   COMPOSE_ARGS="$2"
   CRITICAL_SERVICES="$3"
 
+  # Convert __EMPTY__ placeholders back to empty strings
+  [ "$COMPOSE_ARGS" = "__EMPTY__" ] && COMPOSE_ARGS=""
+  [ "$CRITICAL_SERVICES" = "__EMPTY__" ] && CRITICAL_SERVICES=""
+
   # OP_SERVICE_ACCOUNT_TOKEN and timeouts are passed via 'env' command on remote side
   # They are already in the environment, no need to export again