[brettheap]

Lane: openreposhape-5 (openRepoShape-5)
Claim: #667 (comment)

#649's two leftovers (lane 5's checklist lines on #461). One commit, a3cde99, on main 35133f2 (#656 is in it). It changes install.sh, openRepoShape and the two suites tests-git-bash runs, tests/test_install_sh.py and tests/test_openreposhape_command.py, and nothing else. git show --numstat: install.sh +32/-4, openRepoShape +57/-1, test_install_sh.py +155/-2, test_openreposhape_command.py +216/-13. README, the handbook and docs/cli.md are unchanged: every sentence about --install, the PATH note and $OPENREPOSHAPE_BIN_DIR stays true (export PATH=… is still what they say).

What changed and why

1. install.sh applies #656's rule where it reads the variable (main, before the symlink check and the fetch).

• Before: target="$bin_dir/openRepoShape" was built from the raw value. With D:\tools\bin, the preflight: line and the four done: lines (and install: for an old release) said D:\tools\bin/openRepoShape, while the command's own lines said /d/tools/bin/openRepoShape. With no cygpath, the command's --install refused (exit 2) after install.sh had fetched it, and install.sh said only "the openRepoShape's --install refused (exit 2)".
• Now: a value that starts [A-Za-z]:/ or [A-Za-z]:\ is spelled with cygpath -u --, so every line names one directory. Where no cygpath answers, fails, or answers a drive spelling again, install.sh refuses with exit 2 before the symlink check and before any request. The case is a copy of install_commands's, because install.sh is downloaded alone.
• The refusal does not echo the value. A value that holds a newline would forge a line.

2. The PATH note quotes the directory it prints (export_path_line, new, in openRepoShape).

• Before: export PATH="$dir:$PATH", the directory as it was between double quotes. For a"b$HOME c it printed export PATH="…/a"b$HOME c:$PATH", which eval rejects (unexpected EOF while looking for matching "). For aecho X `` it printed a line that RUNS echo X when pasted, and for `a$b` one that drops `$b`.
• Now, for a directory holding a ", $, backquote, \ or !, the line is export PATH='<dir>':"$PATH", with '\'' for an apostrophe. Every other directory keeps today's line byte for byte, a space or an apostrophe included (both are safe in double quotes).
• ! is in the set because an interactive bash reads it inside double quotes as history: echo "a!b" answers bash: !b: event not found at a prompt, and a person pastes this line at a prompt. A profile file never does.
• Where it is called: say " $(export_path_line "$dir")", in place of the old inline line.

3. --install refuses a directory holding : or a newline (install_commands, beside #656's early checks), before anything is placed, with exit 2 and the remedy.

• A : splits a $PATH whatever the quoting, and a newline breaks the printed line in two, so no line about $PATH can name them.
• The newline check runs first, before the Windows spelling, and its message does not name the value, so no later refusal can echo a forged line. The colon check runs after the Windows spelling: a drive spelling holds a : by definition, is respelled without one, and refuses what it cannot respell. A cygpath answer that holds a : is refused there too.
• The directory may come from $HOME/.local/bin; the colon refusal names it.

Decisions and their evidence

• install.sh respells and refuses only where respelling is impossible (the issue offered "respell, or refuse"). It is openRepoShape in Git Bash: the machine: row finds python, a drive-letter $OPENREPOSHAPE_REPO is a path, a Windows-spelled $OPENREPOSHAPE_BIN_DIR is respelled or refused, and tests-git-bash runs #598's installer cases (#649) #656's decision for the command, and install.sh must not answer one value differently: a test feeds each value through both (below).
• install.sh gets the drive-letter rule only. The brief and the issue's first line name that rule. The : and newline refusals are the command's (issue line 2). Where install.sh is handed such a value, the command refuses after the fetch, as it always did. Named below as a checklist candidate.
• The line's shape is export PATH='<dir>':"$PATH". The directory is the only quoted part. The probe a"b$HOME c now prints export PATH='…/a"b$HOME c':"$PATH", and eval of it sets $PATH to exactly the directory plus the old $PATH.
• Any backslash is quoted, though a\b survives double quotes (\b is not special there). The issue lists \, and one rule is easier to hold than "a backslash before one of four characters".
• The apostrophes are walked, not replaced with ${dir//…}. How a pattern substitution reads a quote in its replacement has changed between bash releases, this runs on 3.2, and sed is not one of the programs --install uses (INSTALL_NEEDS). I could not run bash 3.2 here (5.2.21 only); the loop uses ${x%%"$q"*} and ${x#*"$q"}, which are long-standing 3.2 forms.
• BIN_DIR_SPELLINGS gained lower-case (d:\tools\bin). openRepoShape in Git Bash: the machine: row finds python, a drive-letter $OPENREPOSHAPE_REPO is a path, a Windows-spelled $OPENREPOSHAPE_BIN_DIR is respelled or refused, and tests-git-bash runs #598's installer cases (#649) #656's two tests now run over it too (+5 cases, 15 in all, all passing on both the base and the head), so [A-Za-z] is pinned in the command as well as in the copy.

Tests (Linux, bash 5.2.21; every run through the lane's run9.sh: gh stub first, bogus token, empty GH_CONFIG_DIR)

New: 56 cases. In tests/test_openreposhape_command.py (39 with #656's two extended): the PATH note's lines for 12 names, export_path_line alone for the same 12 (so a " and a \ are held on Windows, where no file can be named with one), 3 through bash -i, 5 refusals (a colon, two directories, a drive-relative name, a newline, a drive spelling holding a newline), the $HOME default, a cygpath answer holding a colon, and +5 from the lower-case spelling. In tests/test_install_sh.py (17): one value through install.sh and the command, in 3 spellings × 4 cygpath states (12; where it spells, both place the command at the same directory and name no other; where it does not, both refuse with exit 2 and install.sh made no request); every preflight:, install: and done: line with the directory respelled, over the four endings (4); and the symlink check seeing the respelled directory (1).

• On the base 35133f2 (the head's two test files over the base's code): 47 failed, 19 passed in the new selection. The 19 are openRepoShape in Git Bash: the machine: row finds python, a drive-letter $OPENREPOSHAPE_REPO is a path, a Windows-spelled $OPENREPOSHAPE_BIN_DIR is respelled or refused, and tests-git-bash runs #598's installer cases (#649) #656's own cases and the plain, space and apostrophe names, which keep today's line.
• On the head a3cde99, dirty=0:
  • tests/test_openreposhape_command.py tests/test_install_sh.py tests/test_install_sh_filter_repo.py tests/test_openreposhape_package.py: 276 passed in 589.67s (the machine's load average was 115).
  • tests/test_repo_hygiene.py tests/test_workflow_concurrency.py tests/test_release_workflow.py tests/test_readme_sections.py tests/test_cli_reference.py tests/test_setup_by_hand_commands.py tests/test_readme_windows_quoting_sentence.py tests/test_gh_guard.py: 250 passed in 175.17s.
  • The three files tests-git-bash runs, with Windows' write_text emulated (a plugin makes every Path.write_text write CRLF): 218 passed in 326.60s. A probe test takes the plugin's effect: 1 passed with it, 1 failed without.
• actionlint: not run, no workflow is touched (tests.yml is as on main).

Mutation probes

Each row reverts one arm, refusal or hunk in a throwaway clone and runs the new cases and #656's (66 selected). The first column is how many failed.

Mutation	Failed	Where
install.sh: the whole drive block off	17	parity (12), line cases (4), symlink
install.sh: no backslash arm	13	parity backslash and lower-case, line cases, symlink
install.sh: no slash arm	4	parity slash
install.sh: [A-Z] for [A-Za-z]	4	parity lower-case
install.sh: no cygpath call	8	parity spells (3), line cases, symlink
install.sh: no refusal	9	parity, every state but spells
install.sh: no drive-answer refusal	3	parity again
install.sh: no `		spelled=""` guard
install.sh: cygpath -u without --	8	parity spells, line cases, symlink
install.sh: the block moved after the symlink check	8	line cases, symlink, parity spells
install.sh: the block moved after the release lookup	17	parity (12: a request was made, or the target was named raw), line cases (4), symlink
install.sh: the refusal echoes the value	9	parity refusals (typed value in stderr)
command: no newline refusal	2	a-newline, a-drive-spelling-and-a-newline
command: newline checked after the drive arm	1	a-drive-spelling-and-a-newline (the value would be echoed)
command: no colon refusal	5	colon (3), $HOME default, respelled answer
command: colon checked before the drive arm	31	#656's cases, parity, respelled answer
command: " not quoted	2	a-double-quote, both tests
command: $ not quoted	5	a-dollar, an-apostrophe-and-a-dollar, both tests, bash -i
command: backquote not quoted	2	a-backquote, both tests
command: \ not quoted	4	a-backslash, a-trailing-backslash, both tests
command: ! not quoted	5	a-bang, two-apostrophes-and-a-bang, both tests, bash -i
command: apostrophes not walked	4	the two apostrophe-with-special names, both tests
command: an apostrophe alone forces single quotes	2	an-apostrophe, both tests (today's line kept)
command: always single quotes	9	the plain, space and apostrophe names in both tests (6), and #656's not-on-path cases (3)
command: the old inline line at the call site	11	the 9 e2e cases with a special character, 2 of bash -i

All 25 mutations are killed. A first version of "an apostrophe alone forces single quotes" was a syntax error, so every case failed; it was rewritten with \' and re-run, and the row is that run.

Reproductions (local fakes only; repro.py)

On the base (35133f2 code) and on the head:

• install.sh, D:\tools\bin, a cygpath that spells it: base lines preflight: D:\tools\bin/openRepoShape --preflight and done: … installed at D:\tools\bin/openRepoShape, but the preflight did not run to the end (exit 127) (the exit 127 is Linux: the drive spelling resolves only in Git Bash). Head: preflight: <dir>/openRepoShape --preflight and done: … installed at <dir>/openRepoShape, pinned to the release tag, and this machine is ready, exit 0.
• install.sh, no cygpath: base exit 2 after 2 requests (the redirect and the fetch), with the command's refusal. Head: exit 2, 0 requests, install.sh's own refusal.
• The PATH note: base a"b$HOME c → eval fails with unexpected EOF; a$b → $PATH gets …/a; a`echo X` → $PATH gets …/aX (the backquote ran). Head: all three give exactly the directory plus the old $PATH. A backslash, a bang, an apostrophe, a space and a plain name keep or gain the right line (the first two single-quoted, the last three today's line).
• A directory holding : or a newline: base exit 0 and the command placed under it, with a line eval cannot use. Head exit 2, nothing placed.
• Needs Windows to be real: cygpath -u on a real drive path, a real D:. Not faked as real; the PR's tests-git-bash run checks it through the tests (below).

Merge checks (git merge-tree --write-tree, after a fresh fetch; refs deleted afterwards)

• origin/main de92614 (adds tests/test_doctor_next_is_a_command.py: the comment-tail guard reads each string expression whole, across + and an f-string's pieces, and flags a # led by two or more blanks or a tab with or without a blank after it and a # that opens text after a part that is not a constant, so cmd #x, cmd + " " + "# x" and f"{cmd}{pad}# x" no longer reach a NEXT unseen (#679) #698, tests/test_doctor_next_is_a_command.py only): clean.
• README, AGENTS.md, docs/cli.md and the handbook: pipx install openreposhape is the second way in and the first on native Windows, git-filter-repo is installed in install.sh's order and never with a bare pip install, and a first draft of the v1.1.0 release notes (#563) #630 l3-563-docs 5b140bd: conflicts in docs/handbook.html, and the same single file conflicts between README, AGENTS.md, docs/cli.md and the handbook: pipx install openreposhape is the second way in and the first on native Windows, git-filter-repo is installed in install.sh's order and never with a bare pip install, and a first draft of the v1.1.0 release notes (#563) #630 and main de92614 alone (README, AGENTS.md, docs/cli.md and the handbook: pipx install openreposhape is the second way in and the first on native Windows, git-filter-repo is installed in install.sh's order and never with a bare pip install, and a first draft of the v1.1.0 release notes (#563) #630 is lane 3's to refresh). README, AGENTS.md, docs/cli.md and the handbook: pipx install openreposhape is the second way in and the first on native Windows, git-filter-repo is installed in install.sh's order and never with a bare pip install, and a first draft of the v1.1.0 release notes (#563) #630 touches none of this PR's four files, so my change adds no region.
• Lane 3's l3-668, l3-669, l3-677, l3-678; lane 4's fix/610, fix/645, fix/646, fix/648, fix/650, fix/651, fix/653, fix/655, fix/658, fix/659, fix/664, fix/696: clean, and none touches install.sh, openRepoShape or the five installer and launcher suites.

The Windows run (what I could not check)

• Checked on Linux: CRLF write_text (218 passed). No new assert compares a path bash printed with a Python path (the PATH-note line is built from bash_path(tmp_path), as openRepoShape in Git Bash: the machine: row finds python, a drive-letter $OPENREPOSHAPE_REPO is a path, a Windows-spelled $OPENREPOSHAPE_BIN_DIR is respelled or refused, and tests-git-bash runs #598's installer cases (#649) #656's tests are).
• Not checked: on windows-latest, Git Bash's real cygpath for the new install.sh cases (3 spellings, through put_cygpath, which puts a #!/bin/sh wrapper around shutil.which("cygpath") on that $PATH, as put_on_path does for mktemp); the 12 PATH-note names that can be created there (a$b, a backquote, !, a space, an apostrophe); the bash -s runs that carry the script as bytes and the directory in the environment; and a newline or a : in $OPENREPOSHAPE_BIN_DIR crossing the environment into Git Bash. The names with " or \, the bash -i cases, the $HOME default and the respelled-colon case skip on Windows; export_path_line is still run for the " and \ names there, by environment, not by a file name. If one fails there, its log shows the typed value and the printed line.
• bash 3.2 (macOS's /bin/bash) was not available: only the loop's forms are claimed for it.

Left out

• install.sh's own : and newline refusals. See candidate 1.
• Release notes. --install now refuses a : or newline in the directory, where it used to place the command and print an unusable line: a visible change for docs/release-notes/v1.1.0.md (lane 3's README, AGENTS.md, docs/cli.md and the handbook: pipx install openreposhape is the second way in and the first on native Windows, git-filter-repo is installed in install.sh's order and never with a bare pip install, and a first draft of the v1.1.0 release notes (#563) #630). Not edited here.
• README, the handbook and docs/cli.md: no sentence became false.

Checklist candidates (not filed)

1. install.sh learns of a : or a newline in $OPENREPOSHAPE_BIN_DIR only after its fetch. Handed such a value, install.sh fetches the launcher, and the command refuses with exit 2; install.sh says "the openRepoShape's --install refused (exit 2); its own refusal above says why". A release older than this change does not refuse at all. Copying the two case arms into main, before the symlink check, would make install.sh refuse first and name the variable, as it now does for the drive spelling.
2. A directory holding another control character (a carriage return, an escape) is still echoed as typed by the refusals and by the note's is not on $PATH line; only the newline is refused first. It cannot forge a line, but an escape sequence reaches the terminal.

Closes #667

🤖 Generated with Claude Code

Summary by Sourcery

Harden installation across Windows-style directories and unsafe PATH values while ensuring generated PATH instructions remain safe to use.

Bug Fixes:

• Normalize Windows-style $OPENREPOSHAPE_BIN_DIR values consistently during installation and refuse them safely when they cannot be converted.
• Generate safe, pasteable PATH instructions for directories containing shell-significant characters.
• Refuse installation directories containing colons or newlines before placing files.

Enhancements:

• Expand installer and launcher coverage for Windows path spellings, unsafe PATH names, and failure scenarios.

Tests:

• Add comprehensive installer and command tests covering path normalization, PATH quoting, refusal behavior, and Windows-specific spellings.

[brettheap]

(lane openRepoShape-5, 2026-10-16T17:09Z) @codex review

[sourcery-ai]

Reviewer's Guide

The PR makes Windows-spelled bin directories consistent between install.sh and openRepoShape, validates directories before installation, safely quotes generated PATH guidance, and adds extensive tests covering conversion behavior, shell metacharacters, refusal ordering, and installer output.

Sequence diagram for safe bin-directory installation

sequenceDiagram
    participant User
    participant Installer as install.sh
    participant CyPath as cygpath
    participant Network
    participant Command as openRepoShape

    User->>Installer: run installer
    Installer->>Installer: read OPENREPOSHAPE_BIN_DIR
    alt Windows spelling
        Installer->>CyPath: cygpath -u -- bin_dir
        alt path cannot be respelled
            CyPath-->>Installer: failure or Windows spelling
            Installer-->>User: refuse with exit 2
        else path respelled
            CyPath-->>Installer: Unix-style directory
        end
    else shell-style directory
        Installer->>Installer: keep directory
    end
    alt valid directory
        Installer->>Installer: check symlink
        Installer->>Network: fetch release
        Installer->>Command: run --install
        Command-->>Installer: installation result
        Installer-->>User: report one consistent directory
    end

Loading

Sequence diagram for safe PATH guidance generation

sequenceDiagram
    participant User
    participant Command as openRepoShape
    participant Shell

    User->>Command: run --install
    Command->>Command: export_path_line(dir)
    alt dir contains shell-special character
        Command-->>User: export PATH='<dir>':"$PATH"
    else dir is safe for double quotes
        Command-->>User: export PATH="<dir>:$PATH"
    end
    User->>Shell: paste PATH guidance
    Shell-->>User: PATH contains exact directory and prior PATH

Loading

Flow diagram for bin-directory validation

flowchart TD
    A[Read bin directory] --> B{Contains newline?}
    B -->|yes| C[Refuse with exit 2]
    B -->|no| D{Windows drive spelling?}
    D -->|yes| E[Run cygpath -u --]
    E --> F{Successfully respelled?}
    F -->|no| C
    F -->|yes| G[Use respelled directory]
    D -->|no| H[Use original directory]
    G --> I{Contains colon?}
    H --> I
    I -->|yes| C
    I -->|no| J[Install command and print safe PATH guidance]

Loading

File-Level Changes

Change	Details	Files
Normalize Windows drive-letter bin directories in the standalone installer before any filesystem or network operation.	Detect slash and backslash drive spellings, including lowercase drive letters. Use cygpath -u -- when available and refuse unconvertible results without echoing the supplied value. Apply the normalized directory to symlink checks, fetch/install flow, and all status output.	install.sh
Harden --install directory validation and PATH guidance against unsafe or unrepresentable directory names.	Add early refusals for newline- and colon-containing directories, including values produced by cygpath. Generate PATH export lines that safely preserve quotes, dollar signs, backquotes, backslashes, apostrophes, and interactive-bash history characters. Keep the existing double-quoted output for names that remain safe under that form.	openRepoShape
Add comprehensive cross-platform coverage for Windows path normalization, safe PATH output, and refusal ordering.	Test installer/launcher parity across drive spellings and cygpath success, failure, missing, and invalid-answer states. Verify normalized paths appear in installer diagnostics and symlink checks before network activity. Exercise PATH lines through eval and interactive Bash, plus colon/newline refusal cases and default-directory handling.	tests/test_install_sh.py tests/test_openreposhape_command.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#667	Have install.sh normalize a Windows-spelled $OPENREPOSHAPE_BIN_DIR with cygpath, or refuse it before the symlink check and any network request when it cannot be normalized, so installer output uses the same directory spelling as the command.	✅
#667	Make the PATH line printed by openRepoShape safe to paste for directories containing shell-special characters, while preserving the existing line for directories that need no special quoting; refuse directories containing a colon or newline before placing anything.	✅

Possibly linked issues

• install.sh and openRepoShape: a Windows-spelled $OPENREPOSHAPE_BIN_DIR is respelled in install.sh's own lines and refused before its fetch, and the PATH note quotes the directory it prints (#649's two leftovers) #667: The PR implements both issue requirements: install.sh respells or early-refuses Windows paths, and the launcher safely quotes PATH notes and rejects unnameable directories.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T17:12:54.994419Z	a3cde99	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3cde999c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pass the respelled directory to the downloaded launcher

When a Windows-spelled directory is successfully converted, bin_dir changes only as a local shell variable; OPENREPOSHAPE_BIN_DIR in the environment remains unchanged when the downloaded launcher runs. Consequently, installing a named release from before the launcher's own cygpath fix still receives and reports the raw D:\... spelling, prints its broken PATH instruction, and on shells where the two spellings are not aliases may install somewhere other than the normalized $target that this script subsequently executes. Pass the normalized value in the environment of the downloaded launcher so the installer's documented compatibility with older named releases also gets this fix.

Useful? React with 👍 / 👎.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 12 hours and 9 minutes by commenting @sourcery-ai review. Upgrade to get a review now.