From 6267dcdcd3a368b1ec2027ebb77a301f9e991d8a Mon Sep 17 00:00:00 2001
From: enricobuehler <buehler@unom.io>
Date: Tue, 4 Aug 2026 21:04:16 +0200
Subject: [PATCH] fix(decky): let a CLI payload's own key never override this
 layer's `ok`

`{"ok": True, **data}` let a future payload carrying its own `ok` report failure through the
field the shell layer owns. Spread first, set `ok` last.
---
 clients/decky/main.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/clients/decky/main.py b/clients/decky/main.py
index 8107a023..64695fb8 100644
--- a/clients/decky/main.py
+++ b/clients/decky/main.py
@@ -426,7 +426,9 @@ async def _cli_json(args: list[str], timeout: float = 20.0) -> dict:
         try:
             data = json.loads(out)
             if isinstance(data, dict):
-                return {"ok": True, **data}
+                # `ok` last: a payload that ever grows its own `ok` key must not be able to
+                # report failure through the field this layer owns.
+                return {**data, "ok": True}
         except json.JSONDecodeError:
             decky.logger.warning("cli %s: unparseable output: %s", args[0], out[:200])
         return {"ok": False, "error": "client-error", "detail": "unreadable output"}