fix(agent): list all compose profiles and fail closed on unknown services (#7)

internal/agent/updater/build.go

@@ -49,7 +49,9 @@ func NewBuildChecker(cli SelfInspector, selfID string, run OutputRunner) *BuildC
 	return &BuildChecker{cli: cli, selfID: selfID, run: run}
 }
 
-// BuiltServices returns the services of project that have a build: section.
+// BuiltServices returns every service of project (all profiles) mapped to
+// whether it has a build: section. A service that is not a key is not in the
+// project's configuration.
 // The arguments are the labels of one of the project's containers. Files that
 // are not inside the agent's read-write same-path mounts are refused.
 func (b *BuildChecker) BuiltServices(ctx context.Context, project, workingDir, configFilesLabel, envFileLabel string) (map[string]bool, error) {
@@ -77,7 +79,9 @@ func (b *BuildChecker) BuiltServices(ctx context.Context, project, workingDir, c
 // already checked.
 func (b *BuildChecker) builtServices(ctx context.Context, project, workingDir string, files, envs []string) (map[string]bool, error) {
 	args := composeBase(project, workingDir, files, envs)
-	args = append(args, "config", "--format", "json")
+	// Without --profile * compose omits services whose profile is not active,
+	// and a built service behind a profile would read as absent.
+	args = append(args, "--profile", "*", "config", "--format", "json")
 	raw, err := b.run(ctx, workingDir, args...)
 	if err != nil {
 		return nil, fmt.Errorf("docker compose config: %w", err)