feat: add agent-led OpenHands Enterprise Replicated install skill - #458

This review was created by an AI agent (OpenHands) on behalf of the repository maintainers.

Summary

This PR adds install-openhands-replicated, a well-structured skill for guiding OpenHands Enterprise VM installations through Replicated Embedded Cluster. The skill covers preflight checks, infrastructure provisioning, installer execution, Admin Console configuration, validation, and operator handoff.

The safety contract is strong: all mutating operations require explicit approval, secrets are treated as sensitive throughout, and the skill explicitly does not claim headless installation. The progressive disclosure structure (SKILL.md entry point + references/ + scripts/) follows the AgentSkills standard. The marketplace registration, vendor symlinks, and catalog updates are consistent with the repo conventions.

Risk Assessment: LOW

The skill is documentation and read-only preflight scripts. The main correctness issue (missing curl availability check) affects a preflight script but does not modify state. All mutating operations are gated behind explicit approval. No secrets are hardcoded.

Findings

Correctness

1. check_outbound.sh does not verify curl is installed (line 35): If curl is missing, code is an empty string, [[ "${code}" == "000" ]] is false, and every URL reports OK - a false negative that could allow proceeding with installation without verifying outbound connectivity. The other preflight scripts guard their dependencies (check_tls_files.sh checks for openssl on line 42, summarize_terraform_outputs.sh checks for terraform on line 16). Consider adding command -v curl at the top and exiting with a clear error if missing. Additionally, even when curl is installed but fails before producing a status code, the empty string passes the check - consider also failing on empty code.

Minor

2. apply_kots_config.sh preview description is slightly misleading (line 8): The usage text says "Previews a KOTS ConfigValues merge by default" but the preview (lines 159-169) only prints the command that would be executed; it does not show the resulting merged configuration. An agent following the skill might assume the preview shows a diff. Consider clarifying the usage text to say the preview prints the command to be run.

3. check_dns.sh nslookup fallback has inconsistent output (line 55): The getent and dig branches capture output and re-print it with printf, but the nslookup branch runs the command directly, producing verbose unstructured output to stdout. This is a UX inconsistency, not a correctness issue (the exit-code check correctly detects resolution failures).

Positive observations

• Explicit approval gates for all mutating operations (installer, ConfigValues, deployments, provider setup, restores)
• Private key hashes are unset after comparison in check_tls_files.sh (line 84)
• Temp files in check_tls_files.sh are cleaned up via trap cleanup EXIT
• Storage guard correctly detects emptyDir/hostPath volumes that could lose state
• No em-dashes in new content (follows repo punctuation convention)
• Correct environment category and valid marketplace entry
• Good separation of concerns: read-only preflights vs. mutating helpers
• Blue/green reinstall reference explicitly requires separate approval

This review was created by an AI agent (OpenHands) on behalf of the repository maintainers.

Summary

This PR adds install-openhands-replicated, a customer-neutral skill for guiding OpenHands Enterprise VM installations through Replicated Embedded Cluster. The safety contract is strong: all mutating operations require explicit approval, secrets are treated as sensitive throughout, and the skill explicitly does not claim headless installation. The progressive disclosure structure (SKILL.md + references/ + scripts/) and marketplace registration follow the repo conventions.

Risk Assessment: LOW

The skill is documentation plus read-only preflight scripts. No mutating operations are automated. No secrets are hardcoded. The one material finding is a preflight reliability bug in check_outbound.sh.

Findings

Correctness

1. check_outbound.sh does not verify curl is installed (inline comment on line 35): If curl is missing, the || true on the command-substitution line swallows the failure, code is empty, [[ "${code}" == "000" ]] is false, and every URL reports OK - a false positive that could lead an operator to proceed with installation without verifying outbound connectivity. The other preflight scripts guard their dependencies (check_tls_files.sh checks openssl, summarize_terraform_outputs.sh checks terraform, apply_kots_config.sh and preflight_storage_guard.sh detect kubectl). Consider adding command -v curl at the top and exiting with a clear error if missing. Additionally, failing on empty code (not just "000") would harden the check against curl failures that occur before a status code is produced.

This was noted in a prior review against an earlier commit and appears to still be present at the current head.

This review was created by an AI agent (OpenHands) on behalf of the repository maintainers.

Summary

This PR adds install-openhands-replicated, a well-structured skill for guiding OpenHands Enterprise VM installations through Replicated Embedded Cluster. The safety contract is strong: all mutating operations require explicit approval, secrets are treated as sensitive throughout, and the skill explicitly does not claim headless installation.

The previous review's material finding (missing curl guard and empty-status-code false positive in check_outbound.sh) has been addressed at the current head. The script now checks command -v curl (lines 9-12) and fails on both empty and 000 status codes (line 49).

All 12 bash scripts pass bash -n syntax checks. Marketplace registration, skills/index.js, and the README catalog are consistent and correctly regenerated. The environment category count and total extension count are accurate.

Risk Assessment: LOW

The skill is documentation plus read-only preflight scripts. No mutating operations are automated. No secrets are hardcoded. Command construction in apply_kots_config.sh uses arrays (no shell injection). Private key hashes in check_tls_files.sh are unset after comparison and temp files are cleaned via trap.

Findings

No material issues found. The previous review's findings have been resolved.