Fix potential panic on bare ${var} reference and add early exit in closestMatch

Guard against out-of-bounds access when the suggest function receives a
single-segment path like "var" (without a variable name). Also short-circuit
closestMatch on exact match (distance 0) to skip unnecessary iterations.

Co-authored-by: Isaac

Author: shreyas-goenka

bundle/config/mutator/suggest.go

@@ -30,6 +30,9 @@ func closestMatch(key string, candidates []string) (string, int) {
 		if d < bestDist {
 			bestDist = d
 			best = c
+			if d == 0 {
+				break
+			}
 		}
 	}
 	if bestDist > threshold {
@@ -144,7 +147,8 @@ func (m *resolveVariableReferences) suggest(
 
 	// Handle var.X → variables.X.value rewriting for internal lookup.
 	// Also detect typos in the "var" prefix itself (e.g., "vr", "va").
-	isVar := path.HasPrefix(varPath)
+	// Require at least 2 segments (e.g., "var.X") to avoid a panic on bare "var".
+	isVar := len(path) >= 2 && path.HasPrefix(varPath)
 	varPrefixCorrected := false
 	if !isVar && len(path) >= 2 {
 		if c, _ := closestMatch(path[0].Key(), []string{"var"}); c != "" {

bundle/config/mutator/suggest_test.go

@@ -238,6 +238,22 @@ func TestSuggestVarPrefixTypo(t *testing.T) {
 	assert.Equal(t, "", m.suggest("vr.nonexistent", normalized))
 }
 
+func TestSuggestBareVarDoesNotPanic(t *testing.T) {
+	normalized := dyn.V(map[string]dyn.Value{
+		"variables": dyn.V(map[string]dyn.Value{
+			"my_cluster_id": dyn.V(map[string]dyn.Value{
+				"value": dyn.V("abc-123"),
+			}),
+		}),
+	})
+
+	m := &resolveVariableReferences{
+		prefixes: defaultPrefixes,
+	}
+
+	assert.Equal(t, "", m.suggest("var", normalized))
+}
+
 func TestSuggestNoSuggestionForCorrectPath(t *testing.T) {
 	normalized := dyn.V(map[string]dyn.Value{
 		"variables": dyn.V(map[string]dyn.Value{