openRepoShape, setup.sh and install.sh: under the C locale a $OPENREPOSHAPE_REPO URL or path, or a ref, with a letter past ASCII is refused as "a control character", so --version, --install and --preflight refuse what v1.1.0 ran #940

Goal: under the C locale (and POSIX) the launcher, setup.sh and install.sh take a repository URL or path, or a ref, that holds a letter past ASCII (/srv/café/openRepoShape.git) the way they take it under C.UTF-8, and still refuse every control character. One rule, #760's byte rule, in every place that asks, so the three scripts and the package agree.

Filed by lane openRepoShape-2 on Brett Heap's word ("file all", 2026-10-18T14:45:31Z).

• Source: w866, openRepoShape: --version and two fetch refusals print $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF with no check, so an escape or a bidi override in either reaches the terminal as typed, and a scaffold run sends its fetch with them #866's writer, found it and left it alone. rv872, lane 2's re-verification of openRepoShape: $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF are checked once, before --version answers and before any fetch, so a control character or a character a terminal draws as another in either is refused, never printed or sent #872 (openRepoShape: --version and two fetch refusals print $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF with no check, so an escape or a bidi override in either reaches the terminal as typed, and a scaffold run sends its fetch with them #866), measured it as SHOULD-2 and ruled it out of scope for openRepoShape: $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF are checked once, before --version answers and before any fetch, so a control character or a character a terminal draws as another in either is refused, never printed or sent #872: "resolve it with a follow-up issue covering checked_repo, ref_character_fault and setup.sh's two guards".
• Why it is not openRepoShape: --version and two fetch refusals print $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF with no check, so an escape or a bidi override in either reaches the terminal as typed, and a scaffold run sends its fetch with them #866's: openRepoShape: --version and two fetch refusals print $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF with no check, so an escape or a bidi override in either reaches the terminal as typed, and a scaffold run sends its fetch with them #866 moved shape_checkout's check up front, whole, so every run but --help now meets the locale's [![:print:]]. The rule is the fault, and it sits in six places that have to move together (measured below: fixing the launcher alone only moves the refusal into setup.sh).
• Why it is filed: the tracking issues' rule (Tracking: setup, scaffold, family and the shared helpers, creating projects and families #459 and Tracking: the test suite, CI and the docs #461, "Known limits", Brett Heap 2026-10-12) puts a new edge case on a checklist. His word above overrides it for this one.

Lands on: main at 50178305, the v1.1.1 release commit. Every path:line below is read there. None of the six open PRs touches openRepoShape, setup.sh, install.sh, src/openreposhape/ or their test files (the coordinator's check, 2026-10-18T14:48Z).

Lines

• The launcher's checked_repo refuses a URL or path with a letter past ASCII under C, and says it "carries a control character".

  • The line is openRepoShape:811-813: -* | *[![:print:]]*) die "OPENREPOSHAPE_REPO is not a value this tool will put on a `git clone` command line: it starts with '-' or carries a control character. ...". refuse_bad_values (:996-1002) calls it for every run but --help (openRepoShape: --version and two fetch refusals print $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF with no check, so an escape or a bidi override in either reaches the terminal as typed, and a scaffold run sends its fetch with them #866). Under C, [![:print:]] matches each byte past 0x7F, so é (C3 A9) is "not printable".

  • Measured (bash 5.2.21; a clean environment; a stub gh and curl first on PATH, both failing; OPENREPOSHAPE_REPO is .../café/openRepoShape.git, a real bare repository in a folder whose name holds the bytes C3 A9). Each run is the launcher at v1.1.0 (190133d5) and at 50178305 under C, at 50178305 under C.UTF-8, and at 50178305 with the rule below put in under C:

    Run	v1.1.0, C	50178305, C	50178305, C.UTF-8	rule moved, C
    --version	prints it, exit 0	exit 2	prints it, exit 0	prints it, exit 0
    scaffold run Atlas --org acme	2 requests, the fetch of setup.sh (the stub fails both), then exit 2	exit 2, no request	as v1.1.0	as v1.1.0
    --install from a file	installed	exit 2, nothing placed	installed	installed
    --doctor <dir> beside a checkout	the doctor ran, exit 2 (not a shape root)	exit 2, the doctor never ran	the doctor ran	the doctor ran
    --doctor <dir>, no checkout, a clone	exit 2, refused	exit 2, refused	the clone was made, the doctor ran	the same
    --preflight, $OPENREPOSHAPE_SETUP_SH in a checkout	the preflight ran	exit 2	the preflight ran	the preflight ran

  • So openRepoShape: $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF are checked once, before --version answers and before any fetch, so a control character or a character a terminal draws as another in either is refused, never printed or sent #872 (in v1.1.1) made four runs refuse under C a value that v1.1.0 ran. At v1.1.0 only --doctor's clone refused it, and the setup.sh a scaffold run fetched (next line).

• The launcher's ref_character_fault does the same to a ref.
  • The line is openRepoShape:915-917: *[![:print:]]*) printf '%s' "$what carries a control character, which is not a branch, tag or commit this tool will pass to `git checkout`." ;;. refuse_bad_values calls it at :1000, and ref_fault at :889. A ref with a letter past ASCII is no control character, and git takes one (git check-ref-format --branch café exits 0, measured).
  • Measured with OPENREPOSHAPE_REF set to café (63 61 66 C3 A9) and an ASCII local repository:
    • under C, --version, a scaffold run, --install (with and without OPENREPOSHAPE_RECORD_REF=1) and --doctor each exit 2 with $OPENREPOSHAPE_REF carries a control character, ..., and no request is sent;
    • under C.UTF-8, --version prints it (exit 0), a scaffold run sends 2 requests, and --install without the record installs;
    • under C.UTF-8, --install with the record and --doctor exit 2 with ref_fault's shape refusal, $OPENREPOSHAPE_REF is 'café', which is not a branch, tag or commit ...: a ref starts with an ASCII letter or digit, uses only ASCII letters, ....
  • So for a ref the outcome differs for the runs that never ask the shape (--version, a scaffold run, --install without the record), and the words are wrong for the rest.
• setup.sh's two guards refuse the same under C, and the launcher passes the value to setup.sh as it was typed.
  • Guard 1, setup.sh:207-210: -*|*[![:print:]]* on $SHAPE_REPO, which is $OPENREPOSHAPE_REPO (or the default). The launcher exports the clone URL it made as $OPENREPOSHAPE_REPO (openRepoShape:1360), so a value the launcher passes still meets this guard.
  • Guard 2, setup.sh:242-245: *[![:print:]]* on $SHAPE_REF, which is the --shape-ref argument and not $OPENREPOSHAPE_REF. It runs after the length check and before the shape case.
  • Both run only on the self-bootstrap path, after is_shape_checkout found no checkout (:114-119). README.md:348-350's curl ... setup.sh | bash -s -- is that path with no launcher.
  • Measured with a setup.sh outside any checkout, --preflight, a stub gh:
    • OPENREPOSHAPE_REPO = the café path, under C: exit 2, OPENREPOSHAPE_REPO is not a value this tool will put on a `git clone` command line: it starts with '-' or carries a control character. .... Under C.UTF-8: the clone was made and the preflight ran (exit 1 here, the stub gh is not logged in).
    • --shape-ref café with an ASCII repository, under C: exit 2, --shape-ref carries a control character, .... Under C.UTF-8: exit 2, --shape-ref is 'café', which is not a branch, tag or commit ...: ... uses only ASCII letters .... Both refuse; only the words differ.
    • The launcher and setup.sh together, LC_ALL=C, the café path, --preflight with a local setup.sh outside any checkout: both as they are at 50178305, exit 2 from the launcher; the launcher moved and setup.sh as it is, exit 2 from setup.sh:208; both moved, the clone was made and the preflight ran. So the launcher and setup.sh move in one change.
• install.sh refuses the same under C, in the same wrong words, and it has two more uses of the same class.
  • checked_repo, install.sh:136-138: *[![:print:]]* before the owner/name checks. An owner/name on github.com is ASCII (:139-145 refuse anything else), so café is refused under both locales: $OPENREPOSHAPE_REPO carries a control character; it must be an owner/name ... under C, $OPENREPOSHAPE_REPO is '...', which is not an owner/name on github.com ... under C.UTF-8 (measured, exit 2, no request, for the café path and for acme/café). Only the words differ.
  • checked_version, :172-174 (café as the version: the version carries a control character ... under C, the shape refusal under C.UTF-8), and the option check, :453-455 (-café: an option carries a control character ... under C, unknown option '-café' ... under C.UTF-8). All exit 2 with no request, in both locales.
  • :226, which decides whether a redirect's location is named in a fault, is the same class and is left to the writer.
• The package's openRepoShape --version prints the same path under C with exit 0, so the two --version commands disagree.
  • Measured (Python 3.12.3, a copy of the package outside any checkout, python3 -m openreposhape --version): the café path prints openRepoShape 0.0.0 (.../café/openRepoShape.git @ main), exit 0, under C and C.UTF-8. A lone 0x9B byte prints as ?, exit 0, under both. U+009B as UTF-8 (C2 9B) and an escape are refused, exit 2.
  • Its rule is CONTROL_RE = [\x00-\x1f\x7f-\x9f] over the decoded text (src/openreposhape/standard.py:72, used at :190). That is install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding : or a newline is refused by install.sh only after its fetch, and one holding a carriage return or an escape is placed and echoed as typed, so both refuse every control character before they fetch or print anything #760's rule with the lone byte passing, and the launcher would then agree with it.

What is checked today

• The rule the launcher already holds elsewhere, install_commands for $OPENREPOSHAPE_BIN_DIR (install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding : or a newline is refused by install.sh only after its fetch, and one holding a carriage return or an escape is placed and echoed as typed, so both refuse every control character before they fetch or print anything #760, install.sh and openRepoShape: the control-character check matches bytes, so a GBK or GB18030 name holding 0xC2 and a byte from 0x80 to 0x9F is refused as a control, and a lone 0x9B, which an 8-bit terminal acts on, is placed #858), openRepoShape:639-646:

  	seen="$dir"
  	if (LC_ALL=C; case "$dir" in *$'\302'[$'\200'-$'\237']*) exit 0 ;; *) exit 1 ;; esac) ||
  		[ -n "$(LC_ALL=C; misdrawn_characters "$dir")" ]; then
  		seen="$(locale_reading "$dir")" || seen="$dir"
  	fi
  	if (LC_ALL=C
  		case "$dir" in *[[:cntrl:]]*) exit 0 ;; *) ;; esac
  		case "$seen" in *$'\302'[$'\200'-$'\237']*) exit 0 ;; *) exit 1 ;; esac); then
  

  • Its comment says the other rule is the wrong one for café (:605-608): "It is [[:cntrl:]] and not [![:print:]], which is what this file holds the repository and the ref to: a name with a letter the locale does not print, as café under LC_ALL=C, is no fault of the directory's." install.sh:477-479 says the same.
  • install.sh copies the block (:501-510). setup.sh has none of it.
• misdrawn_characters (install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding a bidi override, U+200B, U+2028 or U+FEFF passes #804's control-character check and is echoed as typed, so the PATH note can show a directory as another #837, install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841) runs first in checked_repo (:808-810), ref_character_fault (:910-914) and install.sh's three checks. It builds each character's UTF-8 bytes and looks for them under LC_ALL=C, so the locale does not change it.
• No test pins café under C. test_version_prints_a_path_a_utf_8_locale_prints (tests/test_openreposhape_command.py:2399-2411) runs NOT_CONTROLS under C.UTF-8 only, and its docstring says: "Under C that class matches every byte past ASCII, so there the path is refused, as setup.sh's clone and the doctor's refuse it." tests/test_setup_sh.py has no locale case, and each of its two guards has one newline case (:877 and :997).
• Not checked by setup.sh at all: install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding a bidi override, U+200B, U+2028 or U+FEFF passes #804's control-character check and is echoed as typed, so the PATH note can show a directory as another #837's characters. Measured under C.UTF-8, a setup.sh outside a checkout takes U+202E in OPENREPOSHAPE_REPO past guard 1, and git then prints it (fatal: repository '.../openRepoShape.git, the bytes E2 80 AE, then x' does not exist); --shape-ref v1 U+202E x passes guard 2 and the shape refusal prints it as typed. Under C both are refused today, by the same [![:print:]]. The launcher refuses them first when it is the way in.

The fix, and what it costs

• The rule: install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding : or a newline is refused by install.sh only after its fetch, and one holding a carriage return or an escape is placed and echoed as typed, so both refuse every control character before they fetch or print anything #760's, as install_commands holds it, without locale_reading: under LC_ALL=C, *[[:cntrl:]]* or *$'\302'[$'\200'-$'\237']*. For checked_repo the leading - stays: -* | *[[:cntrl:]]* | *$'\302'[$'\200'-$'\237']*. Each place becomes if (LC_ALL=C; case "$value" in ... ) exit 0 ;; *) exit 1 ;; esac); then die ...; fi, three lines, as the case it replaces is.

• Probed by putting it in the launcher's two places, setup.sh's two and install.sh's three in a scratch copy, then --version with each value in the repository and, where it applies, the ref (bash 5.2.21). UNPRINTABLE_VALUES (tests/test_openreposhape_command.py:2245) has 12 values: the 9 rv872 probed and 3 trailing-newline forms added since.

  Value	now, C	now, C.UTF-8	rule moved, both
  é in a path or a ref	refused	passes	passes
  the 12 values: for the repository an escape, U+009B, U+202E, U+200B, a leading - and three trailing-newline forms, for the ref the first four	refused	refused	refused
  DEL, TAB, U+0085, U+0080, U+009F	refused	refused	refused
  a lone E9 byte then U+009B	refused	refused	refused
  a lone 9B or 85 byte (not UTF-8)	refused	refused	passes
  a lone E9 byte (Latin-1 café)	refused	refused	passes
  U+00A0, U+200C, U+1F600, U+0301, U+E000	refused	passes	passes
  U+0378 (unassigned), U+FFFE (a noncharacter)	refused	refused	passes

  • The ref column gave the same answers for the 11 values it was run on.
  • misdrawn_characters still covers U+202E and U+200B under C: all 41 code points of MISDRAWN_CHARACTERS are refused by their code point, in the repository and the ref, under C and C.UTF-8, before and after (measured).

• Existing tests: with the rule in all seven places, tests/test_openreposhape_command.py, tests/test_setup_sh.py and tests/test_install_sh.py give 842 passed (563 s, at a load average of 40 to 58). Nothing fails, because nothing pins the old behavior or words under C.

• Mutants against those tests, one arm dropped from one place (rule moved, scratch copy):

  • killed: the launcher's five (checked_repo without the C1 arm, without the control arm, without the leading -; ref_character_fault without either arm), setup.sh guard 1 without the control arm, guard 2 without the control arm, install.sh's checked_version and option check without the control arm;
  • survive: setup.sh guard 1 without the C1 arm and without the leading -, guard 2 without the C1 arm, and install.sh's checked_repo without either arm, checked_version without the C1 arm, the option check without the C1 arm. So setup.sh has no C1 case and no leading-- case for its repository, install.sh has no C1 case, and install.sh's checked_repo has no control-character case at all: measured with its control arm gone, the refusal at :141 prints an escape in $OPENREPOSHAPE_REPO as typed.

• Who can meet it: a real person can, and few will.

  • The launcher documents $OPENREPOSHAPE_REPO as "owner/name to fetch from" (openRepoShape:125, docs/cli.md:162), and an owner/name on github.com is ASCII.
  • The URL and path forms are setup.sh's clone (docs/cli.md:118, "a fork or mirror in self-bootstrap mode") and the package's (src/openreposhape/cli.py:80, "owner/name, URL or path to clone").
  • So it takes a mirror at a URL or path with a letter past ASCII (/srv/café/..., a home folder named josé) and a shell at C or POSIX: cron, a CI step, a minimal container, env -i, a sudo that resets the locale, or LANG=C set on purpose. An owner/name is never met by it, which is why install.sh is wording only.

• The lone 0x9B trade, and the decision. The rule lets a lone 9B byte (not UTF-8) through in both locales, where [![:print:]] refuses it. install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR the bytes refuse is read again in the locale's own charset, so a GB18030, GBK or Shift_JIS name that holds no control character and nothing drawn as another is placed, and where nothing can read it the bytes decide as before #867's comment states the same trade for the bin dir, openRepoShape:632-634: "A lone C1 byte that is not UTF-8 (0x9B) is placed, as before: a terminal that reads UTF-8 draws it as a character it cannot read, and only one set to an 8-bit charset acts on it."

  • The package already makes it: its --version printed a lone 9B as ?, exit 0 (above).
  • No locale-free pattern keeps the refusal. The class $'\200'-$'\237' over bytes also matches the second byte of U+00C0 (C3 80): measured under LC_ALL=C, it matches a C3 80 b, and the C1 pair pattern does not.
  • Decision: take the trade, as install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR the bytes refuse is read again in the locale's own charset, so a GB18030, GBK or Shift_JIS name that holds no control character and nothing drawn as another is placed, and where nothing can read it the bytes decide as before #867 did for the bin dir, so the launcher, setup.sh, install.sh and the package give one answer. The other way, leaving a locale-keyed rule ([![:print:]] under UTF-8, bytes under C), keeps today's two answers.
  • A second cost, not measured in a locale: GBK, GB18030 and CP936 read each of C2 80 to C2 9F as one hanzi (32 of 32 with Python's codecs; no such locale is installed here). Under such a locale [![:print:]] passes a path holding one, and the byte rule refuses it as a C1 control. install.sh and openRepoShape: the control-character check matches bytes, so a GBK or GB18030 name holding 0xC2 and a byte from 0x80 to 0x9F is refused as a control, and a lone 0x9B, which an 8-bit terminal acts on, is placed #858 asked the locale again for $OPENREPOSHAPE_BIN_DIR (locale_reading). This issue does not: setup.sh has no copy of it, and the same locale already refuses a hanzi made of C2 AD through misdrawn_characters, which openRepoShape:543-551 describes (install.sh and openRepoShape: the control-character check matches bytes, so a GBK or GB18030 name holding 0xC2 and a byte from 0x80 to 0x9F is refused as a control, and a lone 0x9B, which an 8-bit terminal acts on, is placed #858's ground, unchanged).

Direction

• Move together, in one change: checked_repo (openRepoShape:811-813), ref_character_fault (:915-917), setup.sh's guards (:207-210, :242-245), and install.sh's checked_repo (:136-138), checked_version (:172-174) and option check (:453-455), to the rule above. misdrawn_characters stays first where it is. No refusal's words change: "carries a control character" is then true of what it names.
• Keep setup.sh as it is otherwise. It gets no misdrawn_characters here: the rule puts C where C.UTF-8 is (above). Whether setup.sh should refuse install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding a bidi override, U+200B, U+2028 or U+FEFF passes #804's control-character check and is echoed as typed, so the PATH note can show a directory as another #837's characters is the writer's call to note under "Not changed", or to file.
• Reword what says the repository and ref are held to [![:print:]]: openRepoShape:605-608, :797-801 and :866-871, install.sh:128-130 and :477-479, and the docstring at tests/test_openreposhape_command.py:2401-2406.
• Decide the lone 9B as above, and write it into the comment where the rule is, as :632-634 does.

Verify

• tests/test_openreposhape_command.py, tests/test_setup_sh.py and tests/test_install_sh.py pass on Linux.
• New cases, one table in tests/conftest.py read by all three files, as setup.sh, install.sh and the openRepoShape command: each keeps its own copy of the old ref rule (*..* | *.lock), so a ref git refuses part by part (a.lock/b, a/.b, a//b) clones the standard before it fails #874's REF_PARTS is, so the three agree:
  • café (a path, a URL and an scp address for the repository, and a ref) under C and C.UTF-8, in each place: the launcher's --version, a scaffold run (the fake gh and curl are asked, as under C.UTF-8), --install from a file, --doctor (a fake git sees the clone) and --preflight; setup.sh's two guards; install.sh's three checks (refused, in the words C.UTF-8 gives);
  • every control still refused in both locales, in each place: an escape, U+009B, DEL, TAB, U+0085, U+0080, U+009F and a trailing newline, and a leading - for both repository guards. setup.sh and install.sh hold none of these but a newline today;
  • U+202E and U+200B refused by code point under C;
  • the lone 9B and the lone E9 pass in both locales, which pins the decision;
  • a lone E9 then U+009B is refused, as C1_BIN_DIRS has it.
• Mutants: each arm of the rule dropped from each place, as above: all killed, the seven that survive today included.
• A clean pair still prints openRepoShape (opensoft/openRepoShape @ main).

Overlaps

• openRepoShape: --doctor's shape_checkout runs git clone before checked_ref, so a ref it refuses (a.lock/b, a//b, one over 255 characters) costs a whole clone first, and where the clone fails the ref's refusal is never reached #942, filed beside this one for shape_checkout (the clone before checked_ref, openRepoShape:829-848), is in the same file and tests/test_openreposhape_command.py, at other lines. After this change a ref café under C is held as it is under C.UTF-8: --doctor reaches the clone and checked_ref refuses it after.
• openreposhape package: openRepoShape --version prints a repository holding U+202E or U+200B as typed and exits 0, and a ref holding either is refused with the value as typed, where the launcher refuses both before it prints (#866) #939, filed beside this one for the package's --version (U+202E and U+200B printed as typed), is in src/openreposhape/cli.py, which this issue does not touch.
• No other open PR touches these files (checked at 2026-10-18T14:48Z).

Parent: #459: the launcher's own items went there, such as #649's machine: block and drive-letter lines, and setup.sh and install.sh are its subject.

Milestone: v1.2.0. v1.1.1 is released, and lane 3 places issues. It needs a value a person set in their own environment: a URL or path with a letter past ASCII, in a shell at C or POSIX. It is a change from v1.1.0 (above), but the usual owner/name is untouched, the outcome is right for every control character, and --doctor's clone and setup.sh refused this value long before. #872 (lane 2's, in v1.1.1) made the change, so lane 3 may place this as a v1.1.x back-port (#850) instead.

🤖 Generated with Claude Code