fix(installer): make the bats suite green on stock macOS (bash 3.2 + tmpdir symlink + host-CLI leak)

[LukasWodka]

Summary

Three bats tests failed when the suite runs locally on macOS but passed in ubuntu CI (verified on a clean origin/develop checkout) — noise that masks real regressions for anyone running bats scripts/tests/*.bats before pushing. All three are local-environment artifacts; this fixes each at its actual root cause and silences the one bats warning the suite emitted. Suite is now 468/468 green on stock macOS (bash 3.2, bats 1.13) with zero warnings, and unchanged on Linux.

Root causes & fixes

1. _extract_yaml_value: single-quoted with '' escape (install-client-helm.bats) — bash 3.2 bug in the lib code.
In ${var//pat/rep}, macOS's bash 3.2 keeps the backslash when the replacement is an escaped quote: the '' de-escape turned 'a''b' into a\'b (bash 4+/5 gives a'b). Fixed by building pattern/replacement from a $sq variable — identical semantics on every bash. The mirror-image escape site (' -> '' for TB_CLIENT_PASSWORD_ESCAPED) had the same latent bug and gets the same two-line fix. scripts/manifest.sha256 regenerated since this lib is on the R8 integrity surface (gen-manifest.sh --check passes).

2. validate_config: valid config passes (common.bats) — tmpdir symlink shape.
macOS puts BATS_TEST_TMPDIR under the /var -> /private/var symlink. validate_config resolves the data dir via cd -P (symlinks resolved) but compared it against the unresolved $HOME, spuriously failing the under-$HOME check. Fixed the test by pre-resolving HOME with cd -P — the exact pattern (and comment rationale) the sibling tilde tests in the same file already use; this first test simply predated them.

3. un-stamped DEFAULT_REF fails closed (install-bootstrap.bats) — host CLI leaking into the sandbox.
This is the only bootstrap test that sets no REF/BRANCH, so _tb_bail_ok stays armed — and run_boot's PATH="$BIN:$PATH" let the dev box's real /usr/local/bin/tracebloc satisfy command -v tracebloc. The test then ran the host's real tracebloc doctor and, the box being healthy, exec'd the real CLI, which exited 0 before the REF gate was ever reached (CI has no tracebloc binary, so it never saw this). Added run_boot_hermetic — PATH=$BIN alone (setup already symlinks the needed coreutils for exactly this pattern) plus a sandboxed HOME, since the bootstrap re-prepends ~/.local/bin to PATH. Beyond determinism, this stops the suite from executing a real CLI binary on dev machines.

4. bats BW01 warning on sudo modprobe overlay (common.bats).
The sudo(): non-root without sudo returns 127 test deliberately expects 127, which bats flags as "command not found". Switched to run -127 plus the documented bats_require_minimum_version 1.5.0 declaration (CI's apt bats is 1.10, fine with both).

Related

Local dev-environment fix — no tracked issue.

Type of change

• Bug fix
• Tech-debt / refactor

Test plan

• macOS (bash 3.2.57, bats 1.13.0): full suite bats scripts/tests/*.bats — 468/468 pass, zero warnings (was: 3 failures + BW01)
• scripts/gen-manifest.sh --check — manifest up to date
• CI-equivalent lint locally: bash -n over all scripts + shellcheck --severity=error on the same file set as the Lint job — clean
• bash scripts/check-style.sh — clean
• Behavior spot-check of the substitution fix on bash 3.2: 'a''b' unescapes to a'b; a'b escapes to a''b

Checklist

• Tests added / updated and passing locally
• Docs updated if behavior or config changed (N/A)
• No secrets / credentials in the diff
• For security-sensitive paths: appropriate reviewer requested (manifest regenerated; no gate/verify logic touched)
• Terminal output follows STYLE.md — bash scripts/check-style.sh passes
• Cross-repo issues use Fixes tracebloc/<repo>#N (N/A)

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are localized to bash 3.2–compatible string substitution and test harness determinism; credential escaping semantics are preserved and manifest integrity is updated accordingly.

Overview
Makes the installer bats suite reliable on stock macOS (bash 3.2) without changing Linux CI behavior.

Installer lib: _extract_yaml_value and clientPassword YAML escaping no longer use backslash-quote replacements in ${var//pat/rep} — bash 3.2 leaves stray backslashes, breaking '' unescape and ' → '' escape. Both sites now use a $sq variable for pattern/replacement. scripts/manifest.sha256 is updated for the touched lib.

Tests: validate_config: valid config passes resolves HOME with cd -P so it matches macOS /var → /private/var tmpdir layout. Bootstrap un-stamped DEFAULT_REF runs via new run_boot_hermetic (PATH=$BIN only + sandboxed HOME) so a host tracebloc CLI cannot satisfy the early healthy bailout before the REF gate. run -127 silences bats BW01 on the intentional sudo-127 test; bats_require_minimum_version 1.5.0 added.

^{Reviewed by Cursor Bugbot for commit 4e4c3bf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4e4c3bf. Configure here.}