fix(core): keep generated entrypoint heredoc shell-valid

- remove problematic indentation around EOFMOVE block in agent entrypoint template

- add regression checks for EOFMOVE layout and bash -n syntax validation

Author: skulidropek

packages/lib/src/core/templates-entrypoint/agent.ts

@@ -163,7 +163,7 @@ const renderAgentIssueReview = (config: TemplateConfig): string =>
     String.raw`if [[ "$AGENT_OK" -eq 1 && "$AGENT_AUTO" == "1" && -n "$ISSUE_NUM" ]]; then`,
     indentBlock(renderAgentIssueComment(config)),
     "",
-    indentBlock(renderAgentIssueMove(config)),
+    renderAgentIssueMove(config),
     "fi"
   ].join("\n")
 
@@ -184,7 +184,7 @@ if [[ "$CLONE_OK" -eq 1 && -n "$AGENT_MODE" ]]; then`,
     "",
     indentBlock(renderAgentModeCase(config)),
     "",
-    indentBlock(renderAgentIssueReview(config)),
+    renderAgentIssueReview(config),
     "",
     indentBlock(renderAgentFinalize()),
     "fi"

packages/lib/tests/usecases/prepare-files.test.ts

@@ -5,6 +5,7 @@ import { describe, expect, it } from "@effect/vitest"
 import { Effect } from "effect"
 
 import type { TemplateConfig } from "../../src/core/domain.js"
+import { runCommandExitCode } from "../../src/shell/command-runner.js"
 import { prepareProjectFiles } from "../../src/usecases/actions/prepare-files.js"
 
 const withTempDir = <A, E, R>(
@@ -113,8 +114,17 @@ describe("prepareProjectFiles", () => {
         )
 
         const dockerfile = yield* _(fs.readFileString(path.join(outDir, "Dockerfile")))
-        const entrypoint = yield* _(fs.readFileString(path.join(outDir, "entrypoint.sh")))
+        const entrypointPath = path.join(outDir, "entrypoint.sh")
+        const entrypoint = yield* _(fs.readFileString(entrypointPath))
         const composeBefore = yield* _(fs.readFileString(path.join(outDir, "docker-compose.yml")))
+        const entrypointSyntaxExitCode = yield* _(
+          runCommandExitCode({
+            cwd: outDir,
+            command: "bash",
+            args: ["-n", entrypointPath]
+          })
+        )
+        expect(entrypointSyntaxExitCode).toBe(0)
         expect(dockerfile).toContain("docker-compose-v2")
         expect(dockerfile).toContain("gitleaks version")
         expect(dockerfile).toContain(
@@ -130,6 +140,9 @@ describe("prepareProjectFiles", () => {
         expect(entrypoint).toContain('"plugin": ["oh-my-opencode"]')
         expect(entrypoint).toContain("branch '$REPO_REF' missing; retrying without --branch")
         expect(entrypoint).not.toContain("git ls-remote --symref")
+        expect(entrypoint).toContain("cat > \"$MOVE_SCRIPT\" << 'EOFMOVE'")
+        expect(entrypoint).toMatch(/\nEOFMOVE\n\s*chmod \+x "\$MOVE_SCRIPT"/)
+        expect(entrypoint).not.toContain("\n  EOFMOVE\n")
         expect(composeBefore).toContain("container_name: dg-test")
         expect(composeBefore).toContain("restart: unless-stopped")
         expect(composeBefore).toContain(":/home/dev/.docker-git")