install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding : or a newline is refused by install.sh only after its fetch, and one holding a carriage return or an escape is placed and echoed as typed, so both refuse every control character before they fetch or print anything #760

Goal: install.sh and openRepoShape --install refuse a $OPENREPOSHAPE_BIN_DIR that no line about $PATH can name, whatever release they fetch, before any request is made, and never echo it.

Filed by lane openRepoShape-5, from the checklist candidates of #667's PR (#726: "install.sh learns of a : or a newline ... only after its fetch" and "A directory holding another control character") and from rv667's final review of that PR, NIT 2 (measured).

Lands after: lane 5's #667 (PR #726, fix/667-install-bin-dir-spelling, head a3cde999). It adds the colon and newline refusals to the command (install_commands) and the drive-letter rule to install.sh; main has neither. Every path:line below is at that head.

Lines

• install.sh learns of a : or a newline only after its fetch (the writer's candidate 1; read from source, not measured here). install.sh:367-392 reads $OPENREPOSHAPE_BIN_DIR, respells a drive letter or refuses it, and builds target (:401); nothing in it looks for : or a newline. Handed one, it fetches the launcher and runs openRepoShape --install (:450-453); the command refuses with exit 2, and install.sh says only "the <version> openRepoShape's --install refused (exit 2); its own refusal above says why." A release older than install.sh and openRepoShape: a Windows-spelled $OPENREPOSHAPE_BIN_DIR is respelled in install.sh's own lines and refused before its fetch, and the PATH note quotes the directory it prints (#649's two leftovers) #667 has no such refusal at all and places the command under the directory. Direction: copy the command's two case arms into main, before the symlink check at :401: the newline arm (openRepoShape:455-459, which names nothing of the value) first, and the colon arm (:482-486) after the drive-letter respelling, as install.sh and openRepoShape: a Windows-spelled $OPENREPOSHAPE_BIN_DIR is respelled in install.sh's own lines and refused before its fetch, and the PATH note quotes the directory it prints (#649's two leftovers) #667 copied the drive-letter case ("install.sh arrives alone down a pipe"). tests/test_install_sh.py already feeds one value through both files (12 cases); add the two values.
• Any other control character is placed, and echoed as typed. Only a newline is refused first (openRepoShape:455-459). Measured by rv667 (NIT 2): $OPENREPOSHAPE_BIN_DIR set to /tmp/x, a carriage return, then FORGED places the command and prints /tmp/x^MFORGED is not on $PATH. An escape sequence reaches the terminal the same way (the writer's candidate 2; read from source, not measured): the colon refusal prints '$dir' (openRepoShape:484), the PATH note prints $dir is not on \$PATH (:556), and install.sh prints $target in its symlink refusal (:402-405), its install: line (:463), its preflight: line (:477) and its four done: lines (:504-516). install.sh already holds $OPENREPOSHAPE_REPO to this rule: checked_repo refuses *[![:print:]]* before anything is echoed (install.sh:125-128). Direction: widen the newline arm in both files to *[[:cntrl:]]*, keep the refusal's wording free of the value as the newline's is, and keep the arms before every line that names the directory. [[:cntrl:]] and not [![:print:]], so a directory with a letter the locale prints is not refused. Which C1 controls (U+0080 to U+009F) match depends on the locale bash runs under: test one under a UTF-8 locale and say which.

Verify: tests/test_openreposhape_command.py, tests/test_install_sh.py, tests/test_install_sh_filter_repo.py and tests/test_openreposhape_package.py pass on Linux. New BIN_DIR_SPELLINGS cases for a colon, a newline, a carriage return and an escape, through install.sh and through the command: both exit 2, install.sh makes no request (the fake curl records none), nothing is placed, and neither stream holds the value. A mutant for each arm in the order #726's mutation table uses (its row "command: newline checked after the drive arm" is the model). The three files tests-git-bash runs, with CRLF write_text emulated as #726 ran them. A value crossing the environment into Git Bash is Windows-only and is not run here.

Overlaps. fix/667-install-bin-dir-spelling (#726) is the only open branch that edits install.sh, openRepoShape, tests/test_install_sh.py or tests/test_openreposhape_command.py. install.sh is a release asset and openRepoShape is the launcher: neither is a pinned shape copy, so no upstream-changed row follows. #630 (lane 3) describes $OPENREPOSHAPE_BIN_DIR; the release-notes line for #726's refusals is on the comment drafted for #630, and this issue changes no documented sentence.

Parent: #461.

Milestone: v1.1.1. A directory with a control character in its name is not a regression and does not block v1.1.0: nothing is lost, and the person who typed it sees what they typed.

🤖 Generated with Claude Code