fix: fail open instead of aborting under set -e on 1Password DB lookup

[J-MaFf]

Problem

hooks/1password-validate-mounted-env-files/hook.sh runs under set -euo pipefail. find_1password_db and query_mounts return non-zero as a normal "not found / unavailable" signal, but their results are assigned via command substitution:

db_path=$(find_1password_db "$os_type")
mount_hex_data=$(query_mounts "$db_path")

Under set -e, a non-zero command substitution in an assignment aborts the whole script. So on any machine without the 1Password desktop database on disk (CLI-only, CI), or without sqlite3 installed, the hook exits 1 with empty stdout before reaching its fail-open logic.

bin/run-hook.sh masks this by treating empty hook output as "allow", so the end result is usually still safe — but the hook never reaches its own intended fail-open branches, its log warnings never fire, and configured-mode deny is short-circuited: a required-but-missing mount can't block, because the script dies before validating.

Reproduction

On a machine with no 1Password desktop database present:

echo '{"client":"cursor","event":"before_shell_execution","type":"command","workspace_roots":["/tmp"],"cwd":"/tmp","command":"echo hi","raw_payload":{}}' \
  | env HOME="$(mktemp -d)" bash hooks/1password-validate-mounted-env-files/hook.sh
echo "exit=$?"

• Actual: exit=1, empty stdout (aborted by set -e).
• Expected: exit=0, {"decision":"allow","message":""} (fail open as designed).

Fix

Guard both assignments with || true — the same idiom already used in extract_toml_array_items — so the existing emptiness checks (if [[ -n "$db_path" ]]) run and the hook falls through to its fail-open allow.

Tests

Added two regression tests to tests/hooks/1password-validate-mounted-env-files.bats:

• fails open (allow) when no 1Password database is present (covers the find_1password_db path)
• fails open (allow) when the 1Password database cannot be queried (covers the query_mounts path)

Both fail before this change and pass after, and run without sqlite3 — exactly the path the existing deny test skips when sqlite3 is unavailable, which is why the regression went uncaught.

Full suite: 160/160 passing (npx bats -r tests/).