- DU-H1: flags are parsed wherever they sit, so `install --unattended`
and `--unattended install` are the same run; any unknown flag, word,
or subcommand exits 2 to stderr before a package manager is touched.
- DU-H2: every download lands in one private mktemp -d (mode 700)
workdir per run, is checked non-empty before sudo tar sees it, and an
EXIT/INT/TERM trap cleans up. No fixed /tmp paths remain.
- BUG-1: ^t is now toggle-shown — it ticks only the rows the active
filter is showing, and @needs expansion stops at the first invasive
row, so an invasive package can never be ticked off-screen.
- BUG-2: ^t journals what it added, so a second ^t over the same shown
set unticks exactly that set; the bind no longer clears the query.
- lab: the type verb polls fzf's reported query to a deadline instead
of a fixed sleep; marks_settled retries within its deadline.
Suite 256/0 host, 214/0 docker (ubuntu:24.04), mutations 24/24 killed
(six new mutants re-introduce each bug and all die), lab 6/6 green.
The old harness put .tests/fakebin at the front of $PATH, which fails OPEN: a
package manager with no fake fell through to the real one, and an audit of this
suite invoked the host's actual `brew`. The twelve one-line fakes are replaced
by a single dispatcher every fake symlinks to, plus seal.sh, which builds the
WHOLE of $PATH for a run — real binaries for the pure tools, fakes for anything
that installs, downloads or needs root, and command-not-found for everything
else. Runs go under `env -i` so they inherit nothing.
Two audits ship with it: any `have`/`find_tool` probe the seal has never heard
of is an error, and the four absolute paths find_tool probes are written to
.shadowed so a test needing a tool to be genuinely absent can say so.
The dispatcher also fails on demand (FAKE_FAIL), which is what makes the
installers' failure paths reachable at all — the apt and npm one-at-a-time
retries, note_fail, and cmd_install's non-zero exit had all been unreachable,
and all three survived being deleted outright.
_curl stands in for every remote the installer talks to and for nothing else:
an unrecognised URL is a failed download, so a typo'd host shows up as the
failure it would really be. The fzf fake records its argv, which is what makes
the picker's bindings testable.
bcherb2