Sealed-input gate: NAME=PATH arguments and a missing deployment key

packages/flow/openadapt_flow/__main__.py

@@ -13339,10 +13339,20 @@ def _sealed_paths_in(args: argparse.Namespace) -> list[Path]:
             text = str(item)
             if "://" in text or "\n" in text or len(text) > 4096:
                 continue
-            path = Path(text)
-            root = path if sealed_set.is_sealed(path) else sealed_set.sealed_root(path)
-            if root is not None and root not in found:
-                found.append(root)
+            # NAME=PATH arguments (--child, --admission, --variant) name a
+            # path after the first "="; check both readings.
+            candidates = [text]
+            if isinstance(item, str) and "=" in text:
+                candidates.append(text.split("=", 1)[1])
+            for candidate in candidates:
+                if not candidate:
+                    continue
+                path = Path(candidate)
+                root = (
+                    path if sealed_set.is_sealed(path) else sealed_set.sealed_root(path)
+                )
+                if root is not None and root not in found:
+                    found.append(root)
     return found
 
 
@@ -13372,6 +13382,12 @@ def _sealed_input_refusal(args: argparse.Namespace) -> Optional[str]:
         kind = sealed_set.header_kind(root)
         if not sealed_set.passphrase_for(kind):
             return sealed_set.missing_key_message(root, kind)
+        try:
+            # With no key configured the local key resolves; opening the set
+            # tells "sealed with a key that isn't set" apart before any work.
+            sealed_set.open_set(root)
+        except sealed_set.SealedSetKeyError as exc:
+            return str(exc)
     return None
 
 

packages/flow/tests/test_artifact_reads.py

@@ -429,3 +429,19 @@ def test_variants_and_route_read_sealed_variants(
     assert json.loads(capsys.readouterr().out)["variant"] == "posting"
     for bundle, _ in children.values():
         _assert_ciphertext_only(bundle)
+
+
+def test_name_path_arguments_go_through_the_missing_key_check(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys
+) -> None:
+    children = _sealed_admitted(tmp_path, monkeypatch)
+    monkeypatch.delenv(crypto.ENV_KEY)
+    monkeypatch.delenv("OPENADAPT_FLOW_PLAINTEXT_AT_REST", raising=False)
+    args = ["compose", "--out", str(tmp_path / "composed")]
+    for name, (bundle, _) in children.items():
+        args += ["--child", f"{name}={bundle}"]
+    args += ["--handoff", "intake.patient_id=posting.patient_id"]
+    assert main(args) == 2
+    err = capsys.readouterr().err
+    assert "OPENADAPT_BUNDLE_KEY" in err and "Nothing was read" in err
+    assert not (tmp_path / "composed").exists()