fix(p0-1): npm wrapper fake success — ENOENT + PATH persistence + --no-init (#427)

* test(npm-wrapper): add failing scaffold for ENOENT detection (F003 S1)

* fix(npm-wrapper): exit non-zero on spawn ENOENT with fix hint (F003 S2)

* test(install-sh): add failing scaffold for PATH persistence (F003 S3)

* fix(install-sh): persist PATH to shell profile only when missing (F003 S4)

* fix(npm-wrapper): prepend ~/.local/bin to PATH before post-install spawn (F003 S5)

* fix(npm-wrapper): pass --no-init to installer to avoid implicit init (F003 S6)

* test(install-script): add e2e smoke for install → spawn happy path (F003 S7)

* chore(gitleaks): allowlist install + npm-wrapper paths for .local XDG dirs

Tailscale-domain rule's regex was matching POSIX XDG user paths
($HOME/.local/bin) introduced by F003 npm wrapper PATH-persistence work.
These are filesystem paths, not mDNS/Tailscale hostnames.

Allowlist scoped to scripts/install.sh, npm/bin/*.js, and the related
smoke/unit tests; regexes pinned to recognized XDG path components.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(install-sh): prefer sourced bash profile

* docs(install-sh): clarify path persistence writes

* test(npm-wrapper): skip POSIX wrapper shims on Windows

* test(install-script): skip e2e bash stub on Windows

* fix(npm-wrapper): handle spawn permission errors

* fix(p0-6): redact scenario error + stderr in e2b reports (#432)

* test(e2b-report): add failing scaffold for error redaction in summary + results.json (F008 S1)

* fix(e2b-report): redact scenario error in summary.md (F008 S2)

* fix(e2b-report): redact scenario error in results.json (F008 S3)

* fix(e2b-comprehensive): redact scenario error + stderr in transcripts (F008 S4)

* chore(gitleaks): widen install/wrapper allowlist to cover new permission test file

* fix(install-sh): skip PATH persist for unknown shells (don't write bash syntax to .bashrc)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 0xmariowu

.gitleaks.toml

@@ -35,6 +35,11 @@ keywords = [".ts.net", ".local"]
   paths = ['''skills/.*/SKILL\.md$''', '''docs/.*\.md$''']
   regexes = ['''\.local/''']
 
+  [[rules.allowlists]]
+  description = "Install scripts + npm wrapper + their tests reference $HOME/.local POSIX user dirs (XDG, not Tailscale .local hostname)"
+  paths = ['''scripts/install\.sh$''', '''npm/bin/.*\.js$''', '''tests/(smoke|unit)/test_(npm_wrapper|install_script|install_sh_flags|npm_wrapper_permissions)\.py$''']
+  regexes = ['''\.local/(bin|share|lib|var|state|cache|tmp)''', '''\$HOME/\.local''', '''process\.env\.HOME[^"]*\.local''']
+
 # ── Public-repo-only rules ───────────────────────────────────────────────────
 
 [[rules]]

npm/bin/autosearch-ai.js

@@ -48,6 +48,72 @@ function hasAutosearch() {
   return getInstalledAutosearchVersion() !== null;
 }
 
+function expectedAutosearchPath() {
+  if (isWindows()) {
+    return "%USERPROFILE%\\AppData\\Roaming\\Python\\Python312\\Scripts\\autosearch.exe";
+  }
+  return `${process.env.HOME || "~"}/.local/bin/autosearch`;
+}
+
+function prependHomeLocalBinToPath() {
+  if (!process.env.HOME) return;
+
+  const localBin = `${process.env.HOME}/.local/bin`;
+  const separator = isWindows() ? ";" : ":";
+  const currentPath = process.env.PATH || "";
+  if (currentPath.split(separator).includes(localBin)) return;
+
+  process.env.PATH = currentPath
+    ? `${localBin}${separator}${currentPath}`
+    : localBin;
+}
+
+function printAutosearchNotFoundHint(error) {
+  process.stderr.write(
+    `\nautosearch not found after install.\n` +
+      `Expected executable: ${expectedAutosearchPath()}\n` +
+      `Your PATH may not include the install location yet.\n` +
+      `Re-source your shell profile or install AutoSearch directly:\n` +
+      `  curl -fsSL ${INSTALL_SCRIPT} | bash\n` +
+      `  pipx install autosearch && autosearch init\n` +
+      `  pip install --user autosearch && autosearch init\n` +
+      (error?.message ? `\nOriginal error: ${error.message}\n` : "\n"),
+  );
+}
+
+function printInstallerNotFoundHint(error) {
+  process.stderr.write(
+    `\nUnable to start the AutoSearch installer.\n` +
+      `The underlying installer command was not found. Ensure one of these ` +
+      `commands is available on PATH: curl, bash, pipx, py, python.\n` +
+      `Then re-run: npx autosearch-ai --yes\n` +
+      (error?.message ? `\nOriginal error: ${error.message}\n` : "\n"),
+  );
+}
+
+function isPermissionError(error) {
+  return error?.code === "EACCES" || error?.code === "EPERM";
+}
+
+function printAutosearchPermissionHint(error) {
+  process.stderr.write(
+    `\nautosearch failed to start: permission denied.\n` +
+      `Expected executable: ${expectedAutosearchPath()}\n` +
+      `Check that the autosearch executable has execute permission, ` +
+      `or reinstall AutoSearch with pipx or pip.\n` +
+      (error?.message ? `\nOriginal error: ${error.message}\n` : "\n"),
+  );
+}
+
+function printInstallerPermissionHint(error) {
+  process.stderr.write(
+    `\nUnable to start the AutoSearch installer: permission denied.\n` +
+      `Check permissions for the installer command on PATH ` +
+      `(bash, pipx, py, or python), then re-run: npx autosearch-ai --yes\n` +
+      (error?.message ? `\nOriginal error: ${error.message}\n` : "\n"),
+  );
+}
+
 // Bug 6 (fix-plan v8 follow-up): compare the wrapper's expected Python CLI
 // version against what's actually installed. The npm package version
 // `YYYY.M.DD` derives from pyproject `YYYY.MM.DD.N` (N is the daily counter
@@ -150,7 +216,7 @@ function describeInstallStep() {
     if (hasOnPath("python")) return `python -m pip install --user autosearch`;
     return null;
   }
-  return `curl -fsSL ${INSTALL_SCRIPT} | bash`;
+  return `curl -fsSL ${INSTALL_SCRIPT} | bash -s -- --no-init`;
 }
 
 function runInstall() {
@@ -182,7 +248,7 @@ function runInstall() {
   }
   return spawnSync(
     "bash",
-    ["-c", `curl -fsSL ${INSTALL_SCRIPT} | bash`],
+    ["-c", `curl -fsSL ${INSTALL_SCRIPT} | bash -s -- --no-init`],
     { stdio: "inherit" },
   );
 }
@@ -226,15 +292,40 @@ async function main() {
       }
     }
     const result = runInstall();
+    if (isPermissionError(result.error)) {
+      printInstallerPermissionHint(result.error);
+      process.exit(1);
+    }
+    if (result.error?.code === "ENOENT") {
+      printInstallerNotFoundHint(result.error);
+      process.exit(1);
+    }
+    if (result.error) {
+      printInstallerNotFoundHint(result.error);
+      process.exit(1);
+    }
     if ((result.status ?? 0) !== 0) {
       process.exit(result.status ?? 1);
     }
+    prependHomeLocalBinToPath();
   } else {
     checkVersionAlignment(installedVersion);
   }
 
   const cmd = args.length > 0 ? args : ["init"];
   const result = spawnSync("autosearch", cmd, { stdio: "inherit" });
+  if (isPermissionError(result.error)) {
+    printAutosearchPermissionHint(result.error);
+    process.exit(1);
+  }
+  if (result.error?.code === "ENOENT") {
+    printAutosearchNotFoundHint(result.error);
+    process.exit(1);
+  }
+  if (result.error) {
+    printAutosearchNotFoundHint(result.error);
+    process.exit(1);
+  }
   process.exit(result.status ?? 0);
 }
 

scripts/install.sh

@@ -7,6 +7,7 @@ GREEN="\033[32m"
 YELLOW="\033[33m"
 RED="\033[31m"
 RESET="\033[0m"
+ORIGINAL_PATH="$PATH"
 
 info()    { echo -e "${BOLD}$*${RESET}"; }
 success() { echo -e "${GREEN}✓${RESET} $*"; }
@@ -16,6 +17,7 @@ die()     { echo -e "${RED}✗${RESET} $*" >&2; exit 1; }
 # ── Flag parsing ─────────────────────────────────────────────────────────────
 DRY_RUN=false
 NO_INIT=false
+CHECK_PATH_PERSISTENCE=false
 VERSION=""
 
 usage() {
@@ -33,6 +35,10 @@ Flags:
                     config separately.
   --version VER     Pin a specific version (e.g. 2026.04.24.4) instead of
                     installing the latest. Applies to uv / pipx / pip.
+  --check-path-persistence
+                    Check shell-profile PATH persistence logic, then exit.
+                    May append PATH export to the shell profile if missing;
+                    combine with --dry-run to preview without writing.
   -h, --help        Show this help.
 EOF
 }
@@ -41,6 +47,7 @@ while [[ $# -gt 0 ]]; do
   case "$1" in
     --dry-run)     DRY_RUN=true; shift ;;
     --no-init)     NO_INIT=true; shift ;;
+    --check-path-persistence) CHECK_PATH_PERSISTENCE=true; shift ;;
     --version)     [[ -z "${2:-}" ]] && die "--version requires an argument"; VERSION="$2"; shift 2 ;;
     --version=*)   VERSION="${1#--version=}"; shift ;;
     -h|--help)     usage; exit 0 ;;
@@ -130,24 +137,58 @@ fix_path() {
 }
 
 # ── 4. Persist PATH to shell profile ─────────────────────────────────────────
+shell_profile() {
+  case "$(basename "${SHELL:-}")" in
+    zsh)  echo "$HOME/.zshrc" ;;
+    bash)
+      for profile in "$HOME/.bash_profile" "$HOME/.bashrc" "$HOME/.profile"; do
+        if [[ -f "$profile" ]]; then
+          echo "$profile"
+          return 0
+        fi
+      done
+      echo "$HOME/.bashrc"
+      ;;
+    *)    return 1 ;;
+  esac
+}
+
 persist_path() {
   local line='export PATH="$HOME/.local/bin:$PATH"'
-  for profile in "$HOME/.zshrc" "$HOME/.bashrc" "$HOME/.profile"; do
-    if [ -f "$profile" ] && ! grep -q '.local/bin' "$profile" 2>/dev/null; then
-      if [[ "$DRY_RUN" == true ]]; then
-        printf "  [dry-run] would append PATH export to %s\n" "$profile"
-      else
-        echo "" >> "$profile"
-        echo "# Added by AutoSearch installer" >> "$profile"
-        echo "$line" >> "$profile"
-        warn "Added ~/.local/bin to PATH in $profile"
-      fi
-      break
-    fi
-  done
+  local profile
+
+  if [[ ":$ORIGINAL_PATH:" == *":$HOME/.local/bin:"* ]]; then
+    return 0
+  fi
+
+  if ! profile="$(shell_profile)"; then
+    warn "Unknown shell ($(basename "${SHELL:-}")) — skipping PATH persistence."
+    warn "Add this line to your shell profile manually: $line"
+    return 0
+  fi
+  if [[ -f "$profile" ]] && grep -Fqx "$line" "$profile" 2>/dev/null; then
+    return 0
+  fi
+
+  if [[ "$DRY_RUN" == true ]]; then
+    printf "  [dry-run] would append PATH export to %s\n" "$profile"
+    return 0
+  fi
+
+  mkdir -p "$(dirname "$profile")"
+  touch "$profile"
+  echo "" >> "$profile"
+  echo "# Added by AutoSearch installer" >> "$profile"
+  echo "$line" >> "$profile"
+  warn "Added ~/.local/bin to PATH in $profile"
 }
 
 # ── Main ─────────────────────────────────────────────────────────────────────
+if [[ "$CHECK_PATH_PERSISTENCE" == true ]]; then
+  persist_path
+  exit 0
+fi
+
 install_autosearch
 fix_path
 
@@ -163,8 +204,9 @@ if [[ "$DRY_RUN" == true ]]; then
   exit 0
 fi
 
+persist_path
+
 if ! command -v autosearch &>/dev/null; then
-  persist_path
   fix_path
 fi
 

tests/smoke/test_install_script.py

@@ -1,8 +1,13 @@
+import os
+import shutil
 import subprocess
 from pathlib import Path
 
+import pytest
+
 
 ROOT = Path(__file__).resolve().parents[2]
+NPM_DIR = ROOT / "npm"
 INSTALL_SCRIPT = ROOT / "scripts" / "install.sh"
 
 
@@ -42,3 +47,48 @@ def test_install_script_rejects_path_traversal_version() -> None:
 
     assert result.returncode != 0
     assert "PEP 440-style version" in combined_output
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX-only fake bash installer shim")
+def test_install_then_run_e2e_smoke(tmp_path: Path) -> None:
+    home = tmp_path / "home"
+    home.mkdir()
+    fake_bin = tmp_path / "bin"
+    fake_bin.mkdir()
+    fake_bash = fake_bin / "bash"
+    fake_bash.write_text(
+        "#!/bin/sh\n"
+        'mkdir -p "$HOME/.local/bin"\n'
+        "cat > \"$HOME/.local/bin/autosearch\" <<'EOF'\n"
+        "#!/bin/sh\n"
+        'echo "e2e autosearch $*"\n'
+        "exit 0\n"
+        "EOF\n"
+        'chmod +x "$HOME/.local/bin/autosearch"\n'
+        "exit 0\n",
+        encoding="utf-8",
+    )
+    fake_bash.chmod(0o755)
+
+    env = os.environ.copy()
+    env["HOME"] = str(home)
+    env["PATH"] = os.pathsep.join([str(fake_bin), "/usr/bin", "/bin"])
+
+    result = subprocess.run(
+        [
+            shutil.which("node") or "node",
+            str(NPM_DIR / "bin" / "autosearch-ai.js"),
+            "--yes",
+            "doctor",
+        ],
+        cwd=ROOT,
+        env=env,
+        capture_output=True,
+        text=True,
+        timeout=30,
+        check=False,
+    )
+
+    combined_output = result.stdout + result.stderr
+    assert result.returncode == 0, combined_output
+    assert "e2e autosearch doctor" in result.stdout