pkg/engine: debugPhase panics on empty patch in --debug output loop #152

Summary

pkg/engine/engine.go:99 indexes into patch[0] without checking that patch is non-empty. An empty patch string in the slice passed to debugPhase triggers a runtime panic instead of a clean error.

Code

// pkg/engine/engine.go:97-105
for _, patch := range patches {
    if string(patch[0]) == "@" {        // <- panic if patch == ""
        fmt.Printf(" %s=%s\n", patchOption, patch)
    } else {
        fmt.Printf("\n---")
        fmt.Printf("\n# DEBUG(phase %d): %s=\n%s", phase, patchOption, patch)
    }
}

Trigger conditions

debugPhase is invoked from applyPatchesAndRenderConfig and FullConfigProcess when opts.Debug == true (--debug flag / TALM_DEBUG). The argument patches is the rendered chart output, one entry per template file. A template that produces an empty document (e.g. an entirely conditional template where every guard evaluates false) feeds "" into the slice. Result: panic on the first iteration.

The path is gated behind --debug so the only operator-observable form is "talm crashed when I tried to debug a problem" — exactly the worst time for the tool to fail loudly.

Suggested fix

for _, patch := range patches {
    if patch == "" {
        continue   // or print a placeholder
    }
    if patch[0] == '@' {
        // ...
    }
}

Notes

Spotted by inspection while raising pkg/engine test coverage on branch test/chart-contract. Not currently triggerable from the shipped charts (every template they ship produces non-empty output), but reachable by any user-authored template that conditionally emits.