From 9e661e0919417026c68e37213cfc3718dfb51f27 Mon Sep 17 00:00:00 2001
From: Roy Osherove <575051+royosherove@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:05:26 +0000
Subject: [PATCH] fix(installer): use STACK_NAME (not ENV_NAME) + guard
 post-deploy pipes

Two bugs caused exit code 254 after 'Stack created!' completed successfully:

1. **Wrong stack name**: Post-deploy Cognito output block used $ENV_NAME
   (e.g. 'kirocrew-8-549') instead of $STACK_NAME
   (e.g. 'kirocrew-8-549-stack'). aws cloudformation describe-stacks
   returned 254 (stack not found), pipefail propagated, set -e killed
   the script before show_complete ran.

2. **Unguarded pipes with pipefail**: 'aws ... | jq ...' fails the whole
   pipeline if either side errors. Wrapped each fetch with '|| true' and
   uses jq default '// empty' / '// []' so partial output failures no
   longer abort the installer.

Result: the credential display box now shows even if a specific output
is missing, and show_complete (which prints the click-through token
URL) runs to completion.
---
 install.sh | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/install.sh b/install.sh
index 0cde8a3..37fe4c0 100755
--- a/install.sh
+++ b/install.sh
@@ -3478,22 +3478,24 @@ main() {
   _telem_deploy_completed 2>/dev/null || true
 
   # Post-deploy: read Cognito outputs from the stack and display admin credentials
+  # Wrapped in `|| true` and explicit guards so a transient AWS/jq failure here
+  # doesn't abort the installer between stack success and show_complete.
   if [[ "${WEBUI_AUTH_ENABLED:-false}" == "true" ]]; then
-    local stack_outputs pool_id client_id domain admin_email admin_password secret_arn dashboard_url
-    stack_outputs=$(aws cloudformation describe-stacks --stack-name "${ENV_NAME}" \
-      --region "$DEPLOY_REGION" --output json 2>/dev/null | jq -r '.Stacks[0].Outputs')
-    if [[ -n "$stack_outputs" && "$stack_outputs" != "null" ]]; then
-      pool_id=$(echo "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUICognitoPoolId") | .OutputValue')
-      client_id=$(echo "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUICognitoClientId") | .OutputValue')
-      domain=$(echo "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUICognitoDomain") | .OutputValue')
-      admin_email=$(echo "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUIAdminEmailOutput") | .OutputValue')
-      secret_arn=$(echo "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUIAdminSecretArn") | .OutputValue')
-      dashboard_url=$(echo "$stack_outputs" | jq -r '.[] | select(.OutputKey=="KiroCrewDashboardUrl") | .OutputValue')
-      admin_password=""
+    local stack_outputs="" pool_id="" client_id="" domain="" admin_email="" admin_password="" secret_arn="" dashboard_url=""
+    stack_outputs=$(aws cloudformation describe-stacks --stack-name "${STACK_NAME}" \
+      --region "$DEPLOY_REGION" --output json 2>/dev/null || echo '{}')
+    stack_outputs=$(printf '%s' "$stack_outputs" | jq -r '.Stacks[0].Outputs // []' 2>/dev/null || echo '[]')
+    if [[ -n "$stack_outputs" && "$stack_outputs" != "null" && "$stack_outputs" != "[]" ]]; then
+      pool_id=$(printf '%s' "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUICognitoPoolId") | .OutputValue' 2>/dev/null || true)
+      client_id=$(printf '%s' "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUICognitoClientId") | .OutputValue' 2>/dev/null || true)
+      domain=$(printf '%s' "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUICognitoDomain") | .OutputValue' 2>/dev/null || true)
+      admin_email=$(printf '%s' "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUIAdminEmailOutput") | .OutputValue' 2>/dev/null || true)
+      secret_arn=$(printf '%s' "$stack_outputs" | jq -r '.[] | select(.OutputKey=="WebUIAdminSecretArn") | .OutputValue' 2>/dev/null || true)
+      dashboard_url=$(printf '%s' "$stack_outputs" | jq -r '.[] | select(.OutputKey=="KiroCrewDashboardUrl") | .OutputValue' 2>/dev/null || true)
       if [[ -n "$secret_arn" && "$secret_arn" != "null" ]]; then
         admin_password=$(aws secretsmanager get-secret-value --secret-id "$secret_arn" \
           --region "$DEPLOY_REGION" --query SecretString --output text 2>/dev/null \
-          | jq -r '.password // empty')
+          | jq -r '.password // empty' 2>/dev/null || true)
       fi
       if [[ -n "$admin_email" && "$admin_email" != "null" ]]; then
         echo ""
@@ -3508,7 +3510,7 @@ main() {
           "  Client:    ${client_id}" \
           "  Domain:    ${domain}" \
           "" \
-          "  Secret:    ${secret_arn}"
+          "  Secret:    ${secret_arn}" || true
         echo ""
       fi
     fi