From bdcbbefce69929d6fdfb9878df0f2d3bb37b060c Mon Sep 17 00:00:00 2001
From: Justin Linenkohl <83235841+jlinenkohl@users.noreply.github.com>
Date: Wed, 14 Oct 2026 22:17:00 -0400
Subject: [PATCH] fix(clone): finish renaming actionMode Automatic to
 Autonomous

0b900d8 changed the Bicep @allowed list from ['Review', 'Automatic'] to
['Review', 'Autonomous'], but clone-agent.sh was not updated with it. The two
halves now disagree, and between them they reject every value except Review:

  --action-mode Autonomous   rejected by clone-agent.sh, which still validates
                             against the old name
  --action-mode Automatic    accepted by clone-agent.sh, then rejected by the
                             template at deploy time as not in @allowed

The safety warning at the High access level is tied to the same literal, so it
silently stopped firing for exactly the configuration it exists to warn about:
an agent that can act without human approval.

This updates the validation, the usage text, the error message and the warning
to the current name. The old spelling is still accepted and mapped forward, so
an export taken before the rename keeps working rather than failing validation.

The remaining Automatic references are a different parameter, defaultModelName,
and are deliberately untouched.
---
 sreagent-templates/bin/clone-agent.sh | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/sreagent-templates/bin/clone-agent.sh b/sreagent-templates/bin/clone-agent.sh
index b863b265b..154f420b3 100755
--- a/sreagent-templates/bin/clone-agent.sh
+++ b/sreagent-templates/bin/clone-agent.sh
@@ -45,7 +45,7 @@ Optional:
   --target-resource-groups  Comma-separated RGs the clone should monitor
   --subscription        Target subscription (default: current az account)
   --access-level        Override access level (High/Low)
-  --action-mode         Override action mode (Review/Automatic)
+  --action-mode         Override action mode (Review/Autonomous)
   --override            key=value override (repeatable). e.g.:
                           --override connectors.0.properties.dataSource=/subscriptions/.../new-ai
   --backend             Deploy backend: bicep (default) or terraform
@@ -252,10 +252,16 @@ if [[ "$NEW_ACCESS" == "High" || "$NEW_ACCESS" == "Low" ]]; then
 else
   _err "Invalid access level '${NEW_ACCESS}' — must be High or Low"
 fi
-if [[ "$NEW_ACTION" == "Review" || "$NEW_ACTION" == "Automatic" ]]; then
+# "Automatic" was renamed to "Autonomous" in the Bicep @allowed list, but this validation
+# was not updated with it, so --action-mode Autonomous was rejected here while
+# --action-mode Automatic was accepted here and then rejected by the template at deploy
+# time. Only Review worked at all. The old spelling is still accepted and mapped forward,
+# so an export taken before the rename keeps working.
+[[ "$NEW_ACTION" == "Automatic" ]] && NEW_ACTION="Autonomous"
+if [[ "$NEW_ACTION" == "Review" || "$NEW_ACTION" == "Autonomous" ]]; then
   _ok "Action mode: ${NEW_ACTION}"
 else
-  _err "Invalid action mode '${NEW_ACTION}' — must be Review or Automatic"
+  _err "Invalid action mode '${NEW_ACTION}' — must be Review or Autonomous"
 fi
 
 echo
@@ -417,8 +423,8 @@ else
 fi
 
 # 4e. Access level + action mode coherence
-if [[ "$NEW_ACCESS" == "High" && "$NEW_ACTION" == "Automatic" ]]; then
-  _warn "accessLevel=High + actionMode=Automatic — agent can take actions WITHOUT human approval. Make sure this is intentional"
+if [[ "$NEW_ACCESS" == "High" && "$NEW_ACTION" == "Autonomous" ]]; then
+  _warn "accessLevel=High + actionMode=Autonomous — agent can take actions WITHOUT human approval. Make sure this is intentional"
 fi
 
 # 4f. Feature flags — check if source agent had workspace tools + v2 loop enabled